diff --git a/accessible/public/nsIAccessibleEditableText.idl b/accessible/public/nsIAccessibleEditableText.idl
index 14669159025..36b72a880bf 100644
--- a/accessible/public/nsIAccessibleEditableText.idl
+++ b/accessible/public/nsIAccessibleEditableText.idl
@@ -43,7 +43,7 @@
 
 interface nsIEditor;
 
-[scriptable, uuid(52837507-202d-4e72-a482-5f068a1fd720)]
+[scriptable, uuid(e242d495-5cde-4b1c-8c84-2525b14939f5)]
 interface nsIAccessibleEditableText : nsISupports
 {
   /**
@@ -103,19 +103,4 @@ interface nsIAccessibleEditableText : nsISupports
    *                   clipboard into the text represented by this object.
    */
   void pasteText (in long position);
-
-  /**
-   * Returns an editor associated with the accessible.
-   */
-  [noscript] readonly attribute nsIEditor associatedEditor;
 };
-
-/*
- Assumptions:
-
- selectAttributes method takes an nsISupports parameter.
-        'set' methods throw exception on failure.
- 'wstring' inputs are potentially multibyte (UTF-16 for
-        instance); 'string' and UTF-8 may be a better choice.
-
-*/
diff --git a/accessible/src/base/NotificationController.cpp b/accessible/src/base/NotificationController.cpp
index 5a1db68a8d2..f0c99cb5cb8 100644
--- a/accessible/src/base/NotificationController.cpp
+++ b/accessible/src/base/NotificationController.cpp
@@ -680,8 +680,7 @@ NotificationController::CreateTextChangeEventFor(AccMutationEvent* aEvent)
 
   // Don't fire event for the first html:br in an editor.
   if (aEvent->mAccessible->Role() == roles::WHITESPACE) {
-    nsCOMPtr<nsIEditor> editor;
-    textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
+    nsCOMPtr<nsIEditor> editor = textAccessible->GetEditor();
     if (editor) {
       bool isEmpty = false;
       editor->GetDocumentIsEmpty(&isEmpty);
diff --git a/accessible/src/base/nsAccessible.h b/accessible/src/base/nsAccessible.h
index 5b638e4623d..5a40ed68e83 100644
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -214,6 +214,11 @@ public:
    */
   virtual PRUint64 NativeState();
 
+  /**
+   * Return bit set of invisible and offscreen states.
+   */
+  PRUint64 VisibilityState();
+
   /**
    * Returns attributes for accessible without explicitly setted ARIA
    * attributes.
@@ -702,8 +707,6 @@ protected:
   virtual nsIFrame* GetBoundsFrame();
   virtual void GetBoundsRect(nsRect& aRect, nsIFrame** aRelativeFrame);
 
-  PRUint64 VisibilityState(); 
-
   //////////////////////////////////////////////////////////////////////////////
   // Name helpers
 
diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
index 483f642c457..8eeb28aa06c 100644
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -333,8 +333,7 @@ nsDocAccessible::NativeState()
     state |= states::INVISIBLE | states::OFFSCREEN;
   }
 
-  nsCOMPtr<nsIEditor> editor;
-  GetAssociatedEditor(getter_AddRefs(editor));
+  nsCOMPtr<nsIEditor> editor = GetEditor();
   state |= editor ? states::EDITABLE : states::READONLY;
 
   return state;
@@ -553,37 +552,32 @@ nsDocAccessible::GetVirtualCursor(nsIAccessiblePivot** aVirtualCursor)
   return NS_OK;
 }
 
-// nsIAccessibleHyperText method
-NS_IMETHODIMP nsDocAccessible::GetAssociatedEditor(nsIEditor **aEditor)
+// nsHyperTextAccessible method
+already_AddRefed<nsIEditor>
+nsDocAccessible::GetEditor() const
 {
-  NS_ENSURE_ARG_POINTER(aEditor);
-  *aEditor = nsnull;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
   // Check if document is editable (designMode="on" case). Otherwise check if
   // the html:body (for HTML document case) or document element is editable.
   if (!mDocument->HasFlag(NODE_IS_EDITABLE) &&
       !mContent->HasFlag(NODE_IS_EDITABLE))
-    return NS_OK;
+    return nsnull;
 
   nsCOMPtr<nsISupports> container = mDocument->GetContainer();
   nsCOMPtr<nsIEditingSession> editingSession(do_GetInterface(container));
   if (!editingSession)
-    return NS_OK; // No editing session interface
+    return nsnull; // No editing session interface
 
   nsCOMPtr<nsIEditor> editor;
   editingSession->GetEditorForWindow(mDocument->GetWindow(), getter_AddRefs(editor));
-  if (!editor) {
-    return NS_OK;
-  }
-  bool isEditable;
+  if (!editor)
+    return nsnull;
+
+  bool isEditable = false;
   editor->GetIsDocumentEditable(&isEditable);
-  if (isEditable) {
-    NS_ADDREF(*aEditor = editor);
-  }
-  return NS_OK;
+  if (isEditable)
+    return editor.forget();
+
+  return nsnull;
 }
 
 // nsDocAccessible public method
diff --git a/accessible/src/base/nsDocAccessible.h b/accessible/src/base/nsDocAccessible.h
index 47cc3e1da3f..5368be297b6 100644
--- a/accessible/src/base/nsDocAccessible.h
+++ b/accessible/src/base/nsDocAccessible.h
@@ -133,8 +133,8 @@ public:
   virtual nsresult HandleAccEvent(AccEvent* aAccEvent);
 #endif
 
-  // nsIAccessibleText
-  NS_IMETHOD GetAssociatedEditor(nsIEditor **aEditor);
+  // nsHyperTextAccessible
+  virtual already_AddRefed<nsIEditor> GetEditor() const;
 
   // nsDocAccessible
 
diff --git a/accessible/src/html/nsHTMLFormControlAccessible.cpp b/accessible/src/html/nsHTMLFormControlAccessible.cpp
index 98c8771c4e0..defd4c5208f 100644
--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
+++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
@@ -544,11 +544,12 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible::DoAction(PRUint8 index)
   return NS_ERROR_INVALID_ARG;
 }
 
-NS_IMETHODIMP nsHTMLTextFieldAccessible::GetAssociatedEditor(nsIEditor **aEditor)
+already_AddRefed<nsIEditor>
+nsHTMLTextFieldAccessible::GetEditor() const
 {
-  *aEditor = nsnull;
   nsCOMPtr<nsIDOMNSEditableElement> editableElt(do_QueryInterface(mContent));
-  NS_ENSURE_TRUE(editableElt, NS_ERROR_FAILURE);
+  if (!editableElt)
+    return nsnull;
 
   // nsGenericHTMLElement::GetEditor has a security check.
   // Make sure we're not restricted by the permissions of
@@ -558,7 +559,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible::GetAssociatedEditor(nsIEditor **aEditor
   bool pushed = stack && NS_SUCCEEDED(stack->Push(nsnull));
 
   nsCOMPtr<nsIEditor> editor;
-  nsresult rv = editableElt->GetEditor(aEditor);
+  editableElt->GetEditor(getter_AddRefs(editor));
 
   if (pushed) {
     JSContext* cx;
@@ -566,7 +567,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible::GetAssociatedEditor(nsIEditor **aEditor
     NS_ASSERTION(!cx, "context should be null");
   }
 
-  return rv;
+  return editor.forget();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/accessible/src/html/nsHTMLFormControlAccessible.h b/accessible/src/html/nsHTMLFormControlAccessible.h
index 0dd3a0fb321..8bc5ba49238 100644
--- a/accessible/src/html/nsHTMLFormControlAccessible.h
+++ b/accessible/src/html/nsHTMLFormControlAccessible.h
@@ -138,8 +138,8 @@ public:
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
-  // nsIAccessibleEditableText
-  NS_IMETHOD GetAssociatedEditor(nsIEditor **aEditor);
+  // nsHyperTextAccessible
+  virtual already_AddRefed<nsIEditor> GetEditor() const;
 
   // nsAccessible
   virtual void ApplyARIAState(PRUint64* aState);
diff --git a/accessible/src/html/nsHyperTextAccessible.cpp b/accessible/src/html/nsHyperTextAccessible.cpp
index 31426a26ef2..b51741676ba 100644
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -166,8 +166,7 @@ nsHyperTextAccessible::NativeState()
 {
   PRUint64 states = nsAccessibleWrap::NativeState();
 
-  nsCOMPtr<nsIEditor> editor;
-  GetAssociatedEditor(getter_AddRefs(editor));
+  nsCOMPtr<nsIEditor> editor = GetEditor();
   if (editor) {
     PRUint32 flags;
     editor->GetFlags(&flags);
@@ -711,8 +710,7 @@ nsHyperTextAccessible::HypertextOffsetsToDOMRange(PRInt32 aStartHTOffset,
   // If the given offsets are 0 and associated editor is empty then return
   // collapsed range with editor root element as range container.
   if (aStartHTOffset == 0 && aEndHTOffset == 0) {
-    nsCOMPtr<nsIEditor> editor;
-    GetAssociatedEditor(getter_AddRefs(editor));
+    nsCOMPtr<nsIEditor> editor = GetEditor();
     if (editor) {
       bool isEmpty = false;
       editor->GetDocumentIsEmpty(&isEmpty);
@@ -1455,8 +1453,10 @@ NS_IMETHODIMP nsHyperTextAccessible::SetTextContents(const nsAString &aText)
 NS_IMETHODIMP
 nsHyperTextAccessible::InsertText(const nsAString &aText, PRInt32 aPosition)
 {
-  nsCOMPtr<nsIEditor> editor;
-  GetAssociatedEditor(getter_AddRefs(editor));
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsIEditor> editor = GetEditor();
 
   nsCOMPtr<nsIPlaintextEditor> peditor(do_QueryInterface(editor));
   NS_ENSURE_STATE(peditor);
@@ -1470,8 +1470,10 @@ nsHyperTextAccessible::InsertText(const nsAString &aText, PRInt32 aPosition)
 NS_IMETHODIMP
 nsHyperTextAccessible::CopyText(PRInt32 aStartPos, PRInt32 aEndPos)
 {
-  nsCOMPtr<nsIEditor> editor;
-  GetAssociatedEditor(getter_AddRefs(editor));
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsIEditor> editor = GetEditor();
   NS_ENSURE_STATE(editor);
 
   nsresult rv = SetSelectionRange(aStartPos, aEndPos);
@@ -1483,8 +1485,10 @@ nsHyperTextAccessible::CopyText(PRInt32 aStartPos, PRInt32 aEndPos)
 NS_IMETHODIMP
 nsHyperTextAccessible::CutText(PRInt32 aStartPos, PRInt32 aEndPos)
 {
-  nsCOMPtr<nsIEditor> editor;
-  GetAssociatedEditor(getter_AddRefs(editor));
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsIEditor> editor = GetEditor();
   NS_ENSURE_STATE(editor);
 
   nsresult rv = SetSelectionRange(aStartPos, aEndPos);
@@ -1496,8 +1500,10 @@ nsHyperTextAccessible::CutText(PRInt32 aStartPos, PRInt32 aEndPos)
 NS_IMETHODIMP
 nsHyperTextAccessible::DeleteText(PRInt32 aStartPos, PRInt32 aEndPos)
 {
-  nsCOMPtr<nsIEditor> editor;
-  GetAssociatedEditor(getter_AddRefs(editor));
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsIEditor> editor = GetEditor();
   NS_ENSURE_STATE(editor);
 
   nsresult rv = SetSelectionRange(aStartPos, aEndPos);
@@ -1509,8 +1515,10 @@ nsHyperTextAccessible::DeleteText(PRInt32 aStartPos, PRInt32 aEndPos)
 NS_IMETHODIMP
 nsHyperTextAccessible::PasteText(PRInt32 aPosition)
 {
-  nsCOMPtr<nsIEditor> editor;
-  GetAssociatedEditor(getter_AddRefs(editor));
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsIEditor> editor = GetEditor();
   NS_ENSURE_STATE(editor);
 
   nsresult rv = SetSelectionRange(aPosition, aPosition);
@@ -1519,44 +1527,37 @@ nsHyperTextAccessible::PasteText(PRInt32 aPosition)
   return editor->Paste(nsIClipboard::kGlobalClipboard);
 }
 
-NS_IMETHODIMP
-nsHyperTextAccessible::GetAssociatedEditor(nsIEditor **aEditor)
+already_AddRefed<nsIEditor>
+nsHyperTextAccessible::GetEditor() const
 {
-  NS_ENSURE_ARG_POINTER(aEditor);
-  *aEditor = nsnull;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
   if (!mContent->HasFlag(NODE_IS_EDITABLE)) {
     // If we're inside an editable container, then return that container's editor
-    nsCOMPtr<nsIAccessible> ancestor, current = this;
-    while (NS_SUCCEEDED(current->GetParent(getter_AddRefs(ancestor))) && ancestor) {
-      nsRefPtr<nsHyperTextAccessible> ancestorTextAccessible;
-      ancestor->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
-                               getter_AddRefs(ancestorTextAccessible));
-      if (ancestorTextAccessible) {
+    nsAccessible* ancestor = Parent();
+    while (ancestor) {
+      nsHyperTextAccessible* hyperText = ancestor->AsHyperText();
+      if (hyperText) {
         // Recursion will stop at container doc because it has its own impl
-        // of GetAssociatedEditor()
-        return ancestorTextAccessible->GetAssociatedEditor(aEditor);
+        // of GetEditor()
+        return hyperText->GetEditor();
       }
-      current = ancestor;
+
+      ancestor = ancestor->Parent();
     }
-    return NS_OK;
+
+    return nsnull;
   }
 
   nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
     nsCoreUtils::GetDocShellTreeItemFor(mContent);
   nsCOMPtr<nsIEditingSession> editingSession(do_GetInterface(docShellTreeItem));
   if (!editingSession)
-    return NS_OK; // No editing session interface
-
-  NS_ENSURE_TRUE(mDoc, NS_ERROR_FAILURE);
-  nsIDocument* docNode = mDoc->GetDocumentNode();
-  NS_ENSURE_TRUE(docNode, NS_ERROR_FAILURE);
+    return nsnull; // No editing session interface
 
   nsCOMPtr<nsIEditor> editor;
-  return editingSession->GetEditorForWindow(docNode->GetWindow(), aEditor);
+  nsIDocument* docNode = mDoc->GetDocumentNode();
+  editingSession->GetEditorForWindow(docNode->GetWindow(),
+                                     getter_AddRefs(editor));
+  return editor.forget();
 }
 
 /**
@@ -1770,8 +1771,7 @@ nsHyperTextAccessible::GetSelectionDOMRanges(PRInt16 aType,
 
   nsCOMPtr<nsINode> startNode = GetNode();
 
-  nsCOMPtr<nsIEditor> editor;
-  GetAssociatedEditor(getter_AddRefs(editor));
+  nsCOMPtr<nsIEditor> editor = GetEditor();
   if (editor) {
     nsCOMPtr<nsIDOMElement> editorRoot;
     editor->GetRootElement(getter_AddRefs(editorRoot));
diff --git a/accessible/src/html/nsHyperTextAccessible.h b/accessible/src/html/nsHyperTextAccessible.h
index a53d20bb7b7..8c42d12d7a6 100644
--- a/accessible/src/html/nsHyperTextAccessible.h
+++ b/accessible/src/html/nsHyperTextAccessible.h
@@ -264,6 +264,14 @@ public:
     return GetChildAt(GetChildIndexAtOffset(aOffset));
   }
 
+  //////////////////////////////////////////////////////////////////////////////
+  // EditableTextAccessible
+
+  /**
+   * Return the editor associated with the accessible.
+   */
+  virtual already_AddRefed<nsIEditor> GetEditor() const;
+
 protected:
   // nsHyperTextAccessible
 
diff --git a/accessible/src/xforms/nsXFormsAccessible.cpp b/accessible/src/xforms/nsXFormsAccessible.cpp
index fd65c81a64a..2cc0c1e9e94 100644
--- a/accessible/src/xforms/nsXFormsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsAccessible.cpp
@@ -273,8 +273,7 @@ nsXFormsEditableAccessible::NativeState()
     }
   }
 
-  nsCOMPtr<nsIEditor> editor;
-  GetAssociatedEditor(getter_AddRefs(editor));
+  nsCOMPtr<nsIEditor> editor = GetEditor();
   NS_ENSURE_TRUE(editor, state);
   PRUint32 flags;
   editor->GetFlags(&flags);
@@ -286,11 +285,14 @@ nsXFormsEditableAccessible::NativeState()
   return state;
 }
 
-NS_IMETHODIMP
-nsXFormsEditableAccessible::GetAssociatedEditor(nsIEditor **aEditor)
+already_AddRefed<nsIEditor>
+nsXFormsEditableAccessible::GetEditor() const
 {
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
-  return sXFormsService->GetEditor(DOMNode, aEditor);
+
+  nsCOMPtr<nsIEditor> editor;
+  sXFormsService->GetEditor(DOMNode, getter_AddRefs(editor));
+  return editor.forget();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/accessible/src/xforms/nsXFormsAccessible.h b/accessible/src/xforms/nsXFormsAccessible.h
index 512ea7fefac..76350d639b8 100644
--- a/accessible/src/xforms/nsXFormsAccessible.h
+++ b/accessible/src/xforms/nsXFormsAccessible.h
@@ -144,8 +144,8 @@ class nsXFormsEditableAccessible : public nsXFormsAccessible
 public:
   nsXFormsEditableAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
-  // nsIAccessibleEditableText
-  NS_IMETHOD GetAssociatedEditor(nsIEditor **aEditor);
+  // nsHyperTextAccessible
+  virtual already_AddRefed<nsIEditor> GetEditor() const;
 
   // nsAccessible
   virtual PRUint64 NativeState();
diff --git a/accessible/src/xul/nsXULFormControlAccessible.cpp b/accessible/src/xul/nsXULFormControlAccessible.cpp
index 8ff7c46d2fa..671a515dda7 100644
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -850,14 +850,17 @@ nsXULTextFieldAccessible::CanHaveAnonChildren()
   return false;
 }
 
-NS_IMETHODIMP nsXULTextFieldAccessible::GetAssociatedEditor(nsIEditor **aEditor)
+already_AddRefed<nsIEditor>
+nsXULTextFieldAccessible::GetEditor() const
 {
-  *aEditor = nsnull;
-
   nsCOMPtr<nsIContent> inputField = GetInputField();
   nsCOMPtr<nsIDOMNSEditableElement> editableElt(do_QueryInterface(inputField));
-  NS_ENSURE_TRUE(editableElt, NS_ERROR_FAILURE);
-  return editableElt->GetEditor(aEditor);
+  if (!editableElt)
+    return nsnull;
+
+  nsCOMPtr<nsIEditor> editor;
+  editableElt->GetEditor(getter_AddRefs(editor));
+  return editor.forget();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/accessible/src/xul/nsXULFormControlAccessible.h b/accessible/src/xul/nsXULFormControlAccessible.h
index 965119dd967..a7bb22aa47e 100644
--- a/accessible/src/xul/nsXULFormControlAccessible.h
+++ b/accessible/src/xul/nsXULFormControlAccessible.h
@@ -260,8 +260,8 @@ public:
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
-  // nsIAccessibleEditableText
-  NS_IMETHOD GetAssociatedEditor(nsIEditor **aEditor);
+  // nsHyperTextAccessible
+  virtual already_AddRefed<nsIEditor> GetEditor() const;
 
   // nsAccessible
   virtual void ApplyARIAState(PRUint64* aState);
diff --git a/accessible/tests/mochitest/common.js b/accessible/tests/mochitest/common.js
index d17b8c1721d..a80193e6fad 100644
--- a/accessible/tests/mochitest/common.js
+++ b/accessible/tests/mochitest/common.js
@@ -613,9 +613,9 @@ function getNodePrettyName(aNode)
 function getObjAddress(aObj)
 {
   var exp = /native\s*@\s*(0x[a-f0-9]+)/g;
-  var match = exp.exec(aObj.valueOf());
+  var match = exp.exec(aObj.toString());
   if (match)
     return match[1];
 
-  return aObj.valueOf();
+  return aObj.toString();
 }
diff --git a/accessible/tests/mochitest/events.js b/accessible/tests/mochitest/events.js
index 8a2dd91c37d..f64bf4d779b 100644
--- a/accessible/tests/mochitest/events.js
+++ b/accessible/tests/mochitest/events.js
@@ -304,12 +304,20 @@ function eventQueue(aEventType)
     // Start processing of next invoker.
     invoker = this.getNextInvoker();
 
+    this.setEventHandler(invoker);
+
     if (gLogger.isEnabled()) {
       gLogger.logToConsole("Event queue: \n  invoke: " + invoker.getID());
       gLogger.logToDOM("EQ: invoke: " + invoker.getID(), true);
     }
 
-    this.setEventHandler(invoker);
+    var infoText = "Invoke the '" + invoker.getID() + "' test { ";
+    for (var idx = 0; idx < this.mEventSeq.length; idx++) {
+      infoText += this.isEventUnexpected(idx) ? "un" : "";
+      infoText += "expected '" + this.getEventTypeAsString(idx) + "' event; ";
+    }
+    infoText += " }";
+    info(infoText);
 
     if (invoker.invoke() == INVOKER_ACTION_FAILED) {
       // Invoker failed to prepare action, fail and finish tests.
diff --git a/aclocal.m4 b/aclocal.m4
index 77f9452fb6c..c8a04e5737e 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -18,6 +18,7 @@ builtin(include, build/autoconf/lto.m4)dnl
 builtin(include, build/autoconf/gcc-pr49911.m4)dnl
 builtin(include, build/autoconf/frameptr.m4)dnl
 builtin(include, build/autoconf/compiler-opts.m4)dnl
+builtin(include, build/autoconf/expandlibs.m4)dnl
 
 MOZ_PROG_CHECKMSYS()
 
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index ea78fb7a147..cea04b8f81a 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -46,7 +46,7 @@ pref("browser.homescreenURL", "file:///data/local/homescreen.html,file:///system
 #endif
 
 // URL for the dialer application.
-pref("dom.telephony.app.phone.url", "http://localhost:7777/data/local/apps/dialer/dialer.html");
+pref("dom.telephony.app.phone.url", "http://localhost:7777/data/local/apps/dialer/dialer.html http://localhost:7777/data/local/apps/homescreen/homescreen.html http://localhost:7777/apps/dialer/dialer.html http://localhost:7777/apps/homescreen/homescreen.html");
 
 // Device pixel to CSS px ratio, in percent. Set to -1 to calculate based on display density.
 pref("browser.viewport.scaleRatio", -1);
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index b47c149a259..3f1ccb08dc5 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -66,7 +66,7 @@ pref("extensions.getAddons.cache.enabled", true);
 pref("extensions.getAddons.maxResults", 15);
 pref("extensions.getAddons.get.url", "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/guid:%IDS%?src=firefox&appOS=%OS%&appVersion=%VERSION%");
 pref("extensions.getAddons.getWithPerformance.url", "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/guid:%IDS%?src=firefox&appOS=%OS%&appVersion=%VERSION%&tMain=%TIME_MAIN%&tFirstPaint=%TIME_FIRST_PAINT%&tSessionRestored=%TIME_SESSION_RESTORED%");
-pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%");
+pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%");
 pref("extensions.getAddons.search.url", "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/%TERMS%/all/%MAX_RESULTS%/%OS%/%VERSION%/%COMPATIBILITY_MODE%?src=firefox");
 pref("extensions.webservice.discoverURL", "https://services.addons.mozilla.org/%LOCALE%/firefox/discovery/pane/%VERSION%/%OS%/%COMPATIBILITY_MODE%");
 
@@ -214,6 +214,7 @@ pref("app.update.service.enabled", true);
 //
 pref("extensions.update.enabled", true);
 pref("extensions.update.url", "https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%&currentAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%");
+pref("extensions.update.background.url", "https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%&currentAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%");
 pref("extensions.update.interval", 86400);  // Check for updates to Extensions and 
                                             // Themes every day
 // Non-symmetric (not shared by extensions) extension-specific [update] preferences
@@ -1041,6 +1042,9 @@ pref("devtools.debugger.enabled", false);
 // The default Debugger UI height
 pref("devtools.debugger.ui.height", 250);
 
+// Disable remote debugging protocol logging
+pref("devtools.debugger.log", false);
+
 // Enable the style inspector
 pref("devtools.styleinspector.enabled", true);
 
diff --git a/browser/base/content/newtab/dropTargetShim.js b/browser/base/content/newtab/dropTargetShim.js
index 5e6ea5c3c1e..a2c708f66e1 100644
--- a/browser/base/content/newtab/dropTargetShim.js
+++ b/browser/base/content/newtab/dropTargetShim.js
@@ -40,10 +40,12 @@ let gDropTargetShim = {
    * @param aEvent The 'dragstart' event.
    */
   _start: function DropTargetShim_start(aEvent) {
-    gGrid.lock();
+    if (aEvent.target.classList.contains("site")) {
+      gGrid.lock();
 
-    // XXX bug 505521 - Listen for dragover on the document.
-    document.documentElement.addEventListener("dragover", this._dragover, false);
+      // XXX bug 505521 - Listen for dragover on the document.
+      document.documentElement.addEventListener("dragover", this._dragover, false);
+    }
   },
 
   /**
diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index e54cadbe2f6..f6f44210dfd 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -850,7 +850,7 @@ nsContextMenu.prototype = {
       let uri = makeURI(this.mediaURL);
       let url = uri.QueryInterface(Ci.nsIURL);
       if (url.fileBaseName)
-        name = url.fileBaseName + ".jpg";
+        name = decodeURI(url.fileBaseName) + ".jpg";
     } catch (e) { }
     if (!name)
       name = "snapshot.jpg";
diff --git a/browser/base/content/test/newtab/Makefile.in b/browser/base/content/test/newtab/Makefile.in
index 9718eaf4931..00d30c17b34 100644
--- a/browser/base/content/test/newtab/Makefile.in
+++ b/browser/base/content/test/newtab/Makefile.in
@@ -20,7 +20,9 @@ _BROWSER_FILES = \
 	browser_newtab_reset.js \
 	browser_newtab_tabsync.js \
 	browser_newtab_unpin.js \
+	browser_newtab_bug722273.js \
 	browser_newtab_bug723102.js \
+	browser_newtab_bug723121.js \
 	head.js \
 	$(NULL)
 
diff --git a/browser/base/content/test/newtab/browser_newtab_bug722273.js b/browser/base/content/test/newtab/browser_newtab_bug722273.js
new file mode 100644
index 00000000000..a929aa8db90
--- /dev/null
+++ b/browser/base/content/test/newtab/browser_newtab_bug722273.js
@@ -0,0 +1,62 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+const NOW = Date.now() * 1000;
+const URL = "http://fake-site.com/";
+
+let tmp = {};
+Cu.import("resource:///modules/NewTabUtils.jsm", tmp);
+Cc["@mozilla.org/moz/jssubscript-loader;1"]
+  .getService(Ci.mozIJSSubScriptLoader)
+  .loadSubScript("chrome://browser/content/sanitize.js", tmp);
+
+let {NewTabUtils, Sanitizer} = tmp;
+
+let bhist = Cc["@mozilla.org/browser/global-history;2"]
+  .getService(Ci.nsIBrowserHistory);
+
+function runTests() {
+  clearHistory();
+  fillHistory();
+  yield addNewTabPageTab();
+
+  is(cells[0].site.url, URL, "first site is our fake site");
+
+  let page = {
+    update: function () {
+      executeSoon(TestRunner.next);
+    },
+
+    observe: function () {}
+  };
+
+  NewTabUtils.allPages.register(page);
+  yield clearHistory();
+
+  NewTabUtils.allPages.unregister(page);
+  ok(!cells[0].site, "the fake site is gone");
+}
+
+function fillHistory() {
+  let uri = makeURI(URL);
+  for (let i = 59; i > 0; i--)
+    bhist.addPageWithDetails(uri, "fake site", NOW - i * 60 * 1000000);
+}
+
+function clearHistory() {
+  let s = new Sanitizer();
+  s.prefDomain = "privacy.cpd.";
+
+  let prefs = gPrefService.getBranch(s.prefDomain);
+  prefs.setBoolPref("history", true);
+  prefs.setBoolPref("downloads", false);
+  prefs.setBoolPref("cache", false);
+  prefs.setBoolPref("cookies", false);
+  prefs.setBoolPref("formdata", false);
+  prefs.setBoolPref("offlineApps", false);
+  prefs.setBoolPref("passwords", false);
+  prefs.setBoolPref("sessions", false);
+  prefs.setBoolPref("siteSettings", false);
+
+  s.sanitize();
+}
diff --git a/browser/base/content/test/newtab/browser_newtab_bug723121.js b/browser/base/content/test/newtab/browser_newtab_bug723121.js
new file mode 100644
index 00000000000..d71a7396616
--- /dev/null
+++ b/browser/base/content/test/newtab/browser_newtab_bug723121.js
@@ -0,0 +1,44 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+function runTests() {
+  setLinks("0,1,2,3,4,5,6,7,8");
+  setPinnedLinks("");
+
+  yield addNewTabPageTab();
+  checkGridLocked(false, "grid is unlocked");
+
+  let cell = cells[0].node;
+  let site = cells[0].site.node;
+
+  sendDragEvent(site, "dragstart");
+  checkGridLocked(true, "grid is now locked");
+
+  sendDragEvent(site, "dragend");
+  checkGridLocked(false, "grid isn't locked anymore");
+
+  sendDragEvent(cell, "dragstart");
+  checkGridLocked(false, "grid isn't locked - dragstart was ignored");
+}
+
+function checkGridLocked(aLocked, aMessage) {
+  is(cw.gGrid.node.hasAttribute("locked"), aLocked, aMessage);
+}
+
+function sendDragEvent(aNode, aType) {
+  let ifaceReq = cw.QueryInterface(Ci.nsIInterfaceRequestor);
+  let windowUtils = ifaceReq.getInterface(Ci.nsIDOMWindowUtils);
+
+  let dataTransfer = {
+    mozUserCancelled: false,
+    setData: function () null,
+    setDragImage: function () null,
+    getData: function () "about:blank"
+  };
+
+  let event = cw.document.createEvent("DragEvents");
+  event.initDragEvent(aType, true, true, cw, 0, 0, 0, 0, 0,
+                      false, false, false, false, 0, null, dataTransfer);
+
+  windowUtils.dispatchDOMEventViaPresShell(aNode, event, true);
+}
diff --git a/browser/base/content/test/newtab/head.js b/browser/base/content/test/newtab/head.js
index 1695c90e22d..0800f1ca823 100644
--- a/browser/base/content/test/newtab/head.js
+++ b/browser/base/content/test/newtab/head.js
@@ -129,10 +129,11 @@ function addNewTabPageTab() {
     cw = browser.contentWindow;
 
     if (NewTabUtils.allPages.enabled) {
-      cells = cw.gGrid.cells;
-
       // Continue when the link cache has been populated.
-      NewTabUtils.links.populateCache(TestRunner.next);
+      NewTabUtils.links.populateCache(function () {
+        cells = cw.gGrid.cells;
+        executeSoon(TestRunner.next);
+      });
     } else {
       TestRunner.next();
     }
@@ -246,6 +247,8 @@ function unpinCell(aCell) {
  */
 function simulateDrop(aDropTarget, aDragSource) {
   let event = {
+    clientX: 0,
+    clientY: 0,
     dataTransfer: {
       mozUserCancelled: false,
       setData: function () null,
diff --git a/browser/components/certerror/content/aboutCertError.css b/browser/components/certerror/content/aboutCertError.css
index c0f87365e67..e20977b8e18 100644
--- a/browser/components/certerror/content/aboutCertError.css
+++ b/browser/components/certerror/content/aboutCertError.css
@@ -47,20 +47,6 @@
   white-space: pre-wrap;
 }
 
-#technicalContent > h2, #expertContent > h2 {
-  cursor: pointer;
-  -moz-padding-start: 20px;
-  position: relative;
-  left: -20px;
-}
-
-body[dir="rtl"] #technicalContent > h2,
-body[dir="rtl"] #expertContent > h2 {
-  left: auto;
-  right: -20px;
-}
-
-div[collapsed] > p,
-div[collapsed] > div {
+.expander[collapsed] + * {
   display: none;
 }
diff --git a/browser/components/certerror/content/aboutCertError.xhtml b/browser/components/certerror/content/aboutCertError.xhtml
index 64ec4201d5d..e54aba69596 100644
--- a/browser/components/certerror/content/aboutCertError.xhtml
+++ b/browser/components/certerror/content/aboutCertError.xhtml
@@ -260,18 +260,18 @@
         
         <!-- The following sections can be unhidden by default by setting the
              "browser.xul.error_pages.expert_bad_cert" pref to true -->
-        <div id="technicalContent" collapsed="true">
-          <h2 onclick="toggle('technicalContent');" id="technicalContentHeading">&certerror.technical.heading;</h2>
-          <p id="technicalContentText"/>
-        </div>
+        <h2 id="technicalContent" class="expander" collapsed="true">
+          <button onclick="toggle('technicalContent');">&certerror.technical.heading;</button>
+        </h2>
+        <p id="technicalContentText"/>
         
-        <div id="expertContent" collapsed="true">
-          <h2 onclick="toggle('expertContent');" id="expertContentHeading">&certerror.expert.heading;</h2>
-          <div>
-            <p>&certerror.expert.content;</p>
-            <p>&certerror.expert.contentPara2;</p>
-            <button id='exceptionDialogButton'>&certerror.addException.label;</button>
-          </div>
+        <h2 id="expertContent" class="expander" collapsed="true">
+          <button onclick="toggle('expertContent');">&certerror.expert.heading;</button>
+        </h2>
+        <div>
+          <p>&certerror.expert.content;</p>
+          <p>&certerror.expert.contentPara2;</p>
+          <button id='exceptionDialogButton'>&certerror.addException.label;</button>
         </div>
       </div>
     </div>
diff --git a/browser/components/dirprovider/DirectoryProvider.cpp b/browser/components/dirprovider/DirectoryProvider.cpp
index 1373adc6c51..5df1419c206 100644
--- a/browser/components/dirprovider/DirectoryProvider.cpp
+++ b/browser/components/dirprovider/DirectoryProvider.cpp
@@ -56,6 +56,7 @@
 #include "nsServiceManagerUtils.h"
 #include "nsStringAPI.h"
 #include "nsXULAppAPI.h"
+#include "nsIPrefLocalizedString.h"
 
 namespace mozilla {
 namespace browser {
@@ -200,7 +201,18 @@ AppendDistroSearchDirs(nsIProperties* aDirSvc, nsCOMArray<nsIFile> &array)
     localePlugins->AppendNative(NS_LITERAL_CSTRING("locale"));
 
     nsCString locale;
-    rv = prefs->GetCharPref("general.useragent.locale", getter_Copies(locale));
+    nsCOMPtr<nsIPrefLocalizedString> prefString;
+    rv = prefs->GetComplexValue("general.useragent.locale",
+                                NS_GET_IID(nsIPrefLocalizedString),
+                                getter_AddRefs(prefString));
+    if (NS_SUCCEEDED(rv)) {
+      nsAutoString wLocale;
+      prefString->GetData(getter_Copies(wLocale));
+      CopyUTF16toUTF8(wLocale, locale);
+    } else {
+      rv = prefs->GetCharPref("general.useragent.locale", getter_Copies(locale));
+    }
+
     if (NS_SUCCEEDED(rv)) {
 
       nsCOMPtr<nsIFile> curLocalePlugins;
diff --git a/browser/components/migration/Makefile.in b/browser/components/migration/Makefile.in
index f606260619e..80d21a5d580 100644
--- a/browser/components/migration/Makefile.in
+++ b/browser/components/migration/Makefile.in
@@ -43,6 +43,8 @@ include $(DEPTH)/config/autoconf.mk
 
 DIRS		= public src
 
+TEST_DIRS += tests
+
 include $(topsrcdir)/config/rules.mk
 
 # Needed for preprocessor removal of IE Profile Migrator label - bug 236901
diff --git a/browser/components/migration/content/migration.js b/browser/components/migration/content/migration.js
index 3bc34c76e87..ffb0c345eb7 100644
--- a/browser/components/migration/content/migration.js
+++ b/browser/components/migration/content/migration.js
@@ -65,6 +65,7 @@ var MigrationWizard = {
       this._source = window.arguments[0];
       this._migrator = window.arguments[1].QueryInterface(kIMig);
       this._autoMigrate = window.arguments[2].QueryInterface(kIPStartup);
+      this._skipImportSourcePage = window.arguments[3];
 
       if (this._autoMigrate) {
         // Show the "nothing" option in the automigrate case to provide an
@@ -94,7 +95,7 @@ var MigrationWizard = {
     // Reference to the "From File" radio button 
     var fromfile = null;
 
-    //XXXquark This function is called before init, so check for bookmarks here
+    // init is not called when openDialog opens the wizard, so check for bookmarks here.
     if ("arguments" in window && window.arguments[0] == "bookmarks") {
       this._bookmarks = true;
 
@@ -151,6 +152,12 @@ var MigrationWizard = {
       document.getElementById("importBookmarks").hidden = true;
       document.getElementById("importAll").hidden = true;
     }
+
+    // Advance to the next page if the caller told us to.
+    if (this._migrator && this._skipImportSourcePage) {
+      this._wiz.advance();
+      this._wiz.canRewind = false;
+    }
   },
   
   onImportSourcePageAdvanced: function ()
diff --git a/browser/components/migration/src/FirefoxProfileMigrator.js b/browser/components/migration/src/FirefoxProfileMigrator.js
index dad4217347b..7b4a6e4b772 100644
--- a/browser/components/migration/src/FirefoxProfileMigrator.js
+++ b/browser/components/migration/src/FirefoxProfileMigrator.js
@@ -227,6 +227,12 @@ FirefoxProfileMigrator.prototype = {
       this._replaceBookmarks = true;
     }
 
+    // Ensure that aProfile is not the current profile.
+    if (this._paths.currentProfile.path === this._sourceProfile.path) {
+      throw new Exception("Source and destination profiles are the same");
+      return;
+    }
+
     Services.obs.notifyObservers(null, "Migration:Started", null);
 
     // Reset pending count.  If this count becomes 0, "Migration:Ended"
@@ -278,6 +284,11 @@ FirefoxProfileMigrator.prototype = {
     this._sourceProfile.initWithPath(aProfile);
 
     let result = 0;
+
+    // Ensure that aProfile is not the current profile.
+    if (this._paths.currentProfile.path === this._sourceProfile.path)
+      return result;
+
     if (!this._sourceProfile.exists() || !this._sourceProfile.isReadable()) {
       Cu.reportError("source profile directory doesn't exist or is not readable");
       return result;
diff --git a/browser/components/migration/src/ProfileMigrator.js b/browser/components/migration/src/ProfileMigrator.js
index b713068cba3..ea666753193 100644
--- a/browser/components/migration/src/ProfileMigrator.js
+++ b/browser/components/migration/src/ProfileMigrator.js
@@ -16,10 +16,25 @@ function ProfileMigrator() {
 }
 
 ProfileMigrator.prototype = {
-  migrate: function PM_migrate(aStartup) {
+  migrate: function PM_migrate(aStartup, aKey) {
     // By opening the wizard with a supplied migrator, it will automatically
     // migrate from it.
-    let [key, migrator] = this._getDefaultMigrator();
+    let key = null, migrator = null;
+    let skipImportSourcePage = Cc["@mozilla.org/supports-PRBool;1"]
+                                 .createInstance(Ci.nsISupportsPRBool);
+    if (aKey) {
+      key = aKey;
+      migrator = this._getMigratorIfSourceExists(key);
+      if (!migrator) {
+        Cu.reportError("Invalid migrator key specified or source does not exist.");
+        return;
+      }
+      // If the migrator was passed to us from the caller, use that migrator
+      // and skip the import source page.
+      skipImportSourcePage.data = true;
+    } else {
+      [key, migrator] = this._getDefaultMigrator();
+    }
     if (!key)
         return;
 
@@ -27,6 +42,7 @@ ProfileMigrator.prototype = {
     params.appendElement(this._toCString(key), false);
     params.appendElement(migrator, false);
     params.appendElement(aStartup, false);
+    params.appendElement(skipImportSourcePage, false);
 
     Services.ww.openWindow(null,
                            "chrome://browser/content/migration/migration.xul",
@@ -43,10 +59,14 @@ ProfileMigrator.prototype = {
   },
 
   _getMigratorIfSourceExists: function PM__getMigratorIfSourceExists(aKey) {
-    let cid = "@mozilla.org/profile/migrator;1?app=browser&type=" + aKey;
-    let migrator = Cc[cid].createInstance(Ci.nsIBrowserProfileMigrator);
-    if (migrator.sourceExists)
-      return migrator;
+    try {
+      let cid = "@mozilla.org/profile/migrator;1?app=browser&type=" + aKey;
+      let migrator = Cc[cid].createInstance(Ci.nsIBrowserProfileMigrator);
+      if (migrator.sourceExists)
+        return migrator;
+    } catch (ex) {
+      Cu.reportError("Could not get migrator: " + ex);
+    }
     return null;
   },
 
diff --git a/browser/components/migration/src/nsIEProfileMigrator.cpp b/browser/components/migration/src/nsIEProfileMigrator.cpp
index f63b230f25d..636623bb2c3 100644
--- a/browser/components/migration/src/nsIEProfileMigrator.cpp
+++ b/browser/components/migration/src/nsIEProfileMigrator.cpp
@@ -1412,6 +1412,9 @@ nsIEProfileMigrator::CopyFavoritesBatched(bool aReplace)
 
     // Locate the Links toolbar folder, we want to replace the Personal Toolbar
     // content with Favorites in this folder.
+    // On versions minor or equal to IE6 the folder name is stored in the
+    // LinksFolderName registry key, but in newer versions it may be just a
+    // Links subfolder inside the default Favorites folder.
     nsCOMPtr<nsIWindowsRegKey> regKey =
       do_CreateInstance("@mozilla.org/windows-registry-key;1");
     if (regKey &&
@@ -1421,9 +1424,14 @@ nsIEProfileMigrator::CopyFavoritesBatched(bool aReplace)
       nsAutoString linksFolderName;
       if (NS_SUCCEEDED(regKey->ReadStringValue(
                          NS_LITERAL_STRING("LinksFolderName"),
-                         linksFolderName)))
+                         linksFolderName))) {
         personalToolbarFolderName = linksFolderName;
+      }
+      else {
+        personalToolbarFolderName.AssignLiteral("Links");
+      }
     }
+
     folder = bookmarksMenuFolderId;
   }
 
diff --git a/browser/components/migration/tests/Makefile.in b/browser/components/migration/tests/Makefile.in
new file mode 100644
index 00000000000..9e62100e0b3
--- /dev/null
+++ b/browser/components/migration/tests/Makefile.in
@@ -0,0 +1,15 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this file,
+# You can obtain one at http://mozilla.org/MPL/2.0/.
+
+DEPTH		  = ../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		  = @srcdir@
+relativesrcdir = browser/components/migration/tests
+
+include $(DEPTH)/config/autoconf.mk
+
+XPCSHELL_TESTS = unit
+
+include $(topsrcdir)/config/rules.mk
diff --git a/browser/components/migration/tests/unit/bookmarks.html b/browser/components/migration/tests/unit/bookmarks.html
new file mode 100644
index 00000000000..07b22e9b3fc
--- /dev/null
+++ b/browser/components/migration/tests/unit/bookmarks.html
@@ -0,0 +1,16 @@
+<!DOCTYPE NETSCAPE-Bookmark-file-1>
+<!-- This is an automatically generated file.
+     It will be read and overwritten.
+     DO NOT EDIT! -->
+<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8">
+<TITLE>Bookmarks</TITLE>
+<H1>Bookmarks Menu</H1>
+
+<DL><p>
+    <DT><A HREF="http://example.com/" ADD_DATE="1233157972" LAST_MODIFIED="1233157984">example</A>
+    <DT><H3 ADD_DATE="1233157910" LAST_MODIFIED="1233157972" PERSONAL_TOOLBAR_FOLDER="true">Bookmarks Toolbar</H3>
+<DD>Add bookmarks to this folder to see them displayed on the Bookmarks Toolbar
+    <DL><p>
+        <DT><A HREF="http://example.com/" ADD_DATE="1233157972" LAST_MODIFIED="1233157984">example</A>
+    </DL><p>
+</DL><p>
diff --git a/browser/components/migration/tests/unit/head_migration.js b/browser/components/migration/tests/unit/head_migration.js
new file mode 100644
index 00000000000..f24123ffde9
--- /dev/null
+++ b/browser/components/migration/tests/unit/head_migration.js
@@ -0,0 +1,28 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+const Cu = Components.utils;
+
+const IMIGRATOR = Ci.nsIBrowserProfileMigrator;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "PlacesUtils",
+                                  "resource://gre/modules/PlacesUtils.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "FileUtils",
+                                  "resource://gre/modules/FileUtils.jsm");
+
+// Initialize profile.
+let gProfD = do_get_profile();
+
+function newMigratorFor(aKey) {
+  let cid = "@mozilla.org/profile/migrator;1?app=browser&type=" + aKey;
+  return Cc[cid].createInstance(Ci.nsIBrowserProfileMigrator);
+}
+
+let (bookmarkshtml = do_get_file("bookmarks.html")) {
+  bookmarkshtml.copyTo(gProfD, "bookmarks.html");
+}
diff --git a/browser/components/migration/tests/unit/test_IE_bookmarks.js b/browser/components/migration/tests/unit/test_IE_bookmarks.js
new file mode 100644
index 00000000000..6a3fd8a9b9b
--- /dev/null
+++ b/browser/components/migration/tests/unit/test_IE_bookmarks.js
@@ -0,0 +1,28 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+function run_test() {
+  let migrator = newMigratorFor("ie");
+
+  // Sanity check for the source.
+  do_check_true(migrator.sourceExists);
+
+  // Ensure bookmarks migration is available.
+  let availableSources = migrator.getMigrateData("FieldOfFlowers", false);
+  do_check_true((availableSources & IMIGRATOR.BOOKMARKS) > 0);
+
+  // Needed to enforce bookmarks replacing.
+  let startup = {
+    doStartup: function () {},
+    get directory() do_get_profile()
+  }
+  migrator.migrate(IMIGRATOR.BOOKMARKS, startup, "FieldOfFlowers");
+
+  // Check that at least two bookmark have been added to the menu and the
+  // toolbar.  The first one comes from bookmarks.html, the others from IE.
+  do_check_true(PlacesUtils.bookmarks
+                           .getIdForItemAt(PlacesUtils.bookmarksMenuFolderId, 1) > 0);
+  do_check_true(PlacesUtils.bookmarks
+                           .getIdForItemAt(PlacesUtils.toolbarFolderId, 1) > 0);
+}
diff --git a/browser/components/migration/tests/unit/xpcshell.ini b/browser/components/migration/tests/unit/xpcshell.ini
new file mode 100644
index 00000000000..2704bc2cfbc
--- /dev/null
+++ b/browser/components/migration/tests/unit/xpcshell.ini
@@ -0,0 +1,6 @@
+[DEFAULT]
+head = head_migration.js
+tail =
+
+[test_IE_bookmarks.js]
+skip-if = os != "win"
diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js
index 18117ba39c9..e029167ad4e 100644
--- a/browser/components/nsBrowserGlue.js
+++ b/browser/components/nsBrowserGlue.js
@@ -411,18 +411,20 @@ BrowserGlue.prototype = {
 
     // For any add-ons that were installed disabled and can be enabled offer
     // them to the user
-    var win = this.getMostRecentBrowserWindow();
-    var browser = win.gBrowser;
     var changedIDs = AddonManager.getStartupChanges(AddonManager.STARTUP_CHANGE_INSTALLED);
-    AddonManager.getAddonsByIDs(changedIDs, function(aAddons) {
-      aAddons.forEach(function(aAddon) {
-        // If the add-on isn't user disabled or can't be enabled then skip it
-        if (!aAddon.userDisabled || !(aAddon.permissions & AddonManager.PERM_CAN_ENABLE))
-          return;
+    if (changedIDs.length > 0) {
+      AddonManager.getAddonsByIDs(changedIDs, function(aAddons) {
+        var win = this.getMostRecentBrowserWindow();
+        var browser = win.gBrowser;
+        aAddons.forEach(function(aAddon) {
+          // If the add-on isn't user disabled or can't be enabled then skip it.
+          if (!aAddon.userDisabled || !(aAddon.permissions & AddonManager.PERM_CAN_ENABLE))
+            return;
 
-        browser.selectedTab = browser.addTab("about:newaddon?id=" + aAddon.id);
-      })
-    });
+          browser.selectedTab = browser.addTab("about:newaddon?id=" + aAddon.id);
+        })
+      });
+    }
 
     let keywordURLUserSet = Services.prefs.prefHasUserValue("keyword.URL");
     Services.telemetry.getHistogramById("FX_KEYWORD_URL_USERSET").add(keywordURLUserSet);
diff --git a/browser/components/places/content/browserPlacesViews.js b/browser/components/places/content/browserPlacesViews.js
index 0cf3c274c0f..7ff3a4f66f7 100644
--- a/browser/components/places/content/browserPlacesViews.js
+++ b/browser/components/places/content/browserPlacesViews.js
@@ -657,7 +657,9 @@ PlacesViewBase.prototype = {
               aPlacesNode._siteURI = aLivemark.siteURI;
               if (aNewState == Ci.nsINavHistoryContainerResultNode.STATE_OPENED) {
                 aLivemark.registerForUpdates(aPlacesNode, this);
+                // Prioritize the current livemark.
                 aLivemark.reload();
+                PlacesUtils.livemarks.reloadLivemarks();
                 if (shouldInvalidate)
                   this.invalidateContainer(aPlacesNode);
               }
@@ -900,11 +902,6 @@ PlacesToolbar.prototype = {
   __proto__: PlacesViewBase.prototype,
 
   _cbEvents: ["dragstart", "dragover", "dragexit", "dragend", "drop",
-#ifdef XP_UNIX
-#ifndef XP_MACOSX
-              "mousedown", "mouseup",
-#endif
-#endif
               "mousemove", "mouseover", "mouseout"],
 
   QueryInterface: function PT_QueryInterface(aIID) {
@@ -1101,16 +1098,6 @@ PlacesToolbar.prototype = {
       case "mouseout":
         this._onMouseOut(aEvent);
         break;
-#ifdef XP_UNIX
-#ifndef XP_MACOSX
-      case "mouseup":
-        this._onMouseUp(aEvent);
-        break;
-      case "mousedown":
-        this._onMouseDown(aEvent);
-        break;
-#endif
-#endif
       case "popupshowing":
         this._onPopupShowing(aEvent);
         break;
@@ -1538,14 +1525,6 @@ PlacesToolbar.prototype = {
         draggedElt.getAttribute("type") == "menu") {
       // If the drag gesture on a container is toward down we open instead
       // of dragging.
-#ifdef XP_UNIX
-#ifndef XP_MACOSX
-      if (this._mouseDownTimer) {
-        this._mouseDownTimer.cancel();
-        this._mouseDownTimer = null;
-      }
-#endif
-#endif
       let translateY = this._cachedMouseMoveEvent.clientY - aEvent.clientY;
       let translateX = this._cachedMouseMoveEvent.clientX - aEvent.clientX;
       if ((translateY) >= Math.abs(translateX/2)) {
@@ -1718,47 +1697,6 @@ PlacesToolbar.prototype = {
     }
   },
 
-#ifdef XP_UNIX
-#ifndef XP_MACOSX
-  _onMouseDown: function PT__onMouseDown(aEvent) {
-    let target = aEvent.target;
-    if (aEvent.button == 0 &&
-        target.localName == "toolbarbutton" &&
-        target.getAttribute("type") == "menu") {
-      this._allowPopupShowing = false;
-      // On Linux we can open the popup only after a delay.
-      // Indeed as soon as the menupopup opens we are unable to start a
-      // drag aEvent.  See bug 500081 for details.
-      this._mouseDownTimer = Cc["@mozilla.org/timer;1"].
-                             createInstance(Ci.nsITimer);
-      let callback = {
-        _self: this,
-        _target: target,
-        notify: function(timer) {
-          this._target.open = true;
-          this._mouseDownTimer = null;
-        }
-      };
-
-      this._mouseDownTimer.initWithCallback(callback, 300,
-                                            Ci.nsITimer.TYPE_ONE_SHOT);
-    }
-  },
-
-  _onMouseUp: function PT__onMouseUp(aEvent) {
-    if (aEvent.button != 0)
-      return;
-
-    if (this._mouseDownTimer) {
-      // On a click (down/up), we should open the menu popup.
-      this._mouseDownTimer.cancel();
-      this._mouseDownTimer = null;
-      aEvent.target.open = true;
-    }
-  },
-#endif
-#endif
-
   _onMouseMove: function PT__onMouseMove(aEvent) {
     // Used in dragStart to prevent dragging folders when dragging down.
     this._cachedMouseMoveEvent = aEvent;
diff --git a/browser/components/places/content/editBookmarkOverlay.xul b/browser/components/places/content/editBookmarkOverlay.xul
index 09796c72f83..5d09a876b4d 100644
--- a/browser/components/places/content/editBookmarkOverlay.xul
+++ b/browser/components/places/content/editBookmarkOverlay.xul
@@ -90,7 +90,6 @@
                  observes="paneElementsBroadcaster"/>
           <textbox id="editBMPanel_feedLocationField"
                    class="uri-element"
-                   onblur="gEditItemOverlay.onFeedLocationFieldBlur();"
                    observes="paneElementsBroadcaster"/>
         </row>
 
@@ -102,7 +101,6 @@
                  observes="paneElementsBroadcaster"/>
           <textbox id="editBMPanel_siteLocationField"
                    class="uri-element"
-                   onblur="gEditItemOverlay.onSiteLocationFieldBlur();"
                    observes="paneElementsBroadcaster"/>
         </row>
 
diff --git a/browser/components/places/content/treeView.js b/browser/components/places/content/treeView.js
index f5ceb51db7f..c484cf35a98 100644
--- a/browser/components/places/content/treeView.js
+++ b/browser/components/places/content/treeView.js
@@ -896,7 +896,9 @@ PlacesTreeView.prototype = {
             aNode._feedURI = aLivemark.feedURI;
             if (aNewState == Components.interfaces.nsINavHistoryContainerResultNode.STATE_OPENED) {
               aLivemark.registerForUpdates(aNode, this);
+              // Prioritize the current livemark.
               aLivemark.reload();
+              PlacesUtils.livemarks.reloadLivemarks();
               if (shouldInvalidate)
                 this.invalidateContainer(aNode);
             }
diff --git a/browser/devtools/debugger/DebuggerUI.jsm b/browser/devtools/debugger/DebuggerUI.jsm
index 44154297cc9..b1d01de7bc3 100644
--- a/browser/devtools/debugger/DebuggerUI.jsm
+++ b/browser/devtools/debugger/DebuggerUI.jsm
@@ -24,6 +24,7 @@
  *   Dave Camp <dcamp@mozilla.com> (original author)
  *   Panos Astithas <past@mozilla.com>
  *   Victor Porof <vporof@mozilla.com>
+ *   Mihai Sucan <mihai.sucan@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -60,9 +61,37 @@ function DebuggerPane(aTab) {
   this._tab = aTab;
   this._close = this.close.bind(this);
   this._debugTab = this.debugTab.bind(this);
+  this.breakpoints = {};
 }
 
 DebuggerPane.prototype = {
+  /**
+   * Skip editor breakpoint change events.
+   *
+   * This property tells the source editor event handler to skip handling of
+   * the BREAKPOINT_CHANGE events. This is used when the debugger adds/removes
+   * breakpoints from the editor. Typically, the BREAKPOINT_CHANGE event handler
+   * adds/removes events from the debugger, but when breakpoints are added from
+   * the public debugger API, we need to do things in reverse.
+   *
+   * This implementation relies on the fact that the source editor fires the
+   * BREAKPOINT_CHANGE events synchronously.
+   *
+   * @private
+   * @type boolean
+   */
+  _skipEditorBreakpointChange: false,
+
+  /**
+   * The list of breakpoints in the debugger as tracked by the current
+   * DebuggerPane instance. This an object where the values are BreakpointActor
+   * objects received from the client, while the keys are actor names, for
+   * example "conn0.breakpoint3".
+   *
+   * @type object
+   */
+  breakpoints: null,
+
   /**
    * Creates and initializes the widgets contained in the debugger UI.
    */
@@ -87,11 +116,15 @@ DebuggerPane.prototype = {
       self.frame.removeEventListener("DOMContentLoaded", initPane, true);
       // Initialize the source editor.
       self.frame.contentWindow.editor = self.editor = new SourceEditor();
+      self.frame.contentWindow.updateEditorBreakpoints =
+        self._updateEditorBreakpoints.bind(self);
 
       let config = {
         mode: SourceEditor.MODES.JAVASCRIPT,
         showLineNumbers: true,
-        readOnly: true
+        readOnly: true,
+        showAnnotationRuler: true,
+        showOverviewRuler: true,
       };
 
       let editorPlaceholder = self.frame.contentDocument.getElementById("editor");
@@ -107,14 +140,217 @@ DebuggerPane.prototype = {
    * editor initialization.
    */
   _onEditorLoad: function DP__onEditorLoad() {
+    this.editor.addEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                                 this._onEditorBreakpointChange.bind(this));
     // Connect to the debugger server.
     this.connect();
   },
 
+  /**
+   * Event handler for breakpoint changes that happen in the editor. This
+   * function syncs the breakpoint changes in the editor to those in the
+   * debugger.
+   *
+   * @private
+   * @param object aEvent
+   *        The SourceEditor.EVENTS.BREAKPOINT_CHANGE event object.
+   */
+  _onEditorBreakpointChange: function DP__onEditorBreakpointChange(aEvent) {
+    if (this._skipEditorBreakpointChange) {
+      return;
+    }
+
+    aEvent.added.forEach(this._onEditorBreakpointAdd, this);
+    aEvent.removed.forEach(this._onEditorBreakpointRemove, this);
+  },
+
+  /**
+   * Retrieve the URL of the selected script in the debugger view.
+   *
+   * @private
+   * @return string
+   *         The URL of the selected script.
+   */
+  _selectedScript: function DP__selectedScript() {
+    return this.debuggerWindow ?
+           this.debuggerWindow.DebuggerView.Scripts.selected : null;
+  },
+
+  /**
+   * Event handler for new breakpoints that come from the editor.
+   *
+   * @private
+   * @param object aBreakpoint
+   *        The breakpoint object coming from the editor.
+   */
+  _onEditorBreakpointAdd: function DP__onEditorBreakpointAdd(aBreakpoint) {
+    let location = {
+      url: this._selectedScript(),
+      line: aBreakpoint.line + 1,
+    };
+
+    if (location.url) {
+      let callback = function (aClient, aError) {
+        if (aError) {
+          this._skipEditorBreakpointChange = true;
+          let result = this.editor.removeBreakpoint(aBreakpoint.line);
+          this._skipEditorBreakpointChange = false;
+        }
+      }.bind(this);
+      this.addBreakpoint(location, callback, true);
+    }
+  },
+
+  /**
+   * Event handler for breakpoints that are removed from the editor.
+   *
+   * @private
+   * @param object aBreakpoint
+   *        The breakpoint object that was removed from the editor.
+   */
+  _onEditorBreakpointRemove: function DP__onEditorBreakpointRemove(aBreakpoint) {
+    let url = this._selectedScript();
+    let line = aBreakpoint.line + 1;
+    if (!url) {
+      return;
+    }
+
+    let breakpoint = this.getBreakpoint(url, line);
+    if (breakpoint) {
+      this.removeBreakpoint(breakpoint, null, true);
+    }
+  },
+
+  /**
+   * Update the breakpoints in the editor view. This function takes the list of
+   * breakpoints in the debugger and adds them back into the editor view. This
+   * is invoked when the selected script is changed.
+   *
+   * @private
+   */
+  _updateEditorBreakpoints: function DP__updateEditorBreakpoints()
+  {
+    let url = this._selectedScript();
+    if (!url) {
+      return;
+    }
+
+    this._skipEditorBreakpointChange = true;
+    for each (let breakpoint in this.breakpoints) {
+      if (breakpoint.location.url == url) {
+        this.editor.addBreakpoint(breakpoint.location.line - 1);
+      }
+    }
+    this._skipEditorBreakpointChange = false;
+  },
+
+  /**
+   * Add a breakpoint.
+   *
+   * @param object aLocation
+   *        The location where you want the breakpoint. This object must have
+   *        two properties:
+   *          - url - the URL of the script.
+   *          - line - the line number (starting from 1).
+   * @param function [aCallback]
+   *        Optional function to invoke once the breakpoint is added. The
+   *        callback is invoked with two arguments:
+   *          - aBreakpointClient - the BreakpointActor client object, if the
+   *          breakpoint has been added successfully.
+   *          - aResponseError - if there was any error.
+   * @param boolean [aNoEditorUpdate=false]
+   *        Tells if you want to skip editor updates. Typically the editor is
+   *        updated to visually indicate that a breakpoint has been added.
+   */
+  addBreakpoint:
+  function DP_addBreakpoint(aLocation, aCallback, aNoEditorUpdate) {
+    let breakpoint = this.getBreakpoint(aLocation.url, aLocation.line);
+    if (breakpoint) {
+      aCallback && aCallback(breakpoint);
+      return;
+    }
+
+    this.activeThread.setBreakpoint(aLocation, function(aResponse, aBpClient) {
+      if (!aResponse.error) {
+        this.breakpoints[aBpClient.actor] = aBpClient;
+
+        if (!aNoEditorUpdate) {
+          let url = this._selectedScript();
+          if (url == aLocation.url) {
+            this._skipEditorBreakpointChange = true;
+            this.editor.addBreakpoint(aLocation.line - 1);
+            this._skipEditorBreakpointChange = false;
+          }
+        }
+      }
+
+      aCallback && aCallback(aBpClient, aResponse.error);
+    }.bind(this));
+  },
+
+  /**
+   * Remove a breakpoint.
+   *
+   * @param object aBreakpoint
+   *        The breakpoint you want to remove.
+   * @param function [aCallback]
+   *        Optional function to invoke once the breakpoint is removed. The
+   *        callback is invoked with one argument: the breakpoint location
+   *        object which holds the url and line properties.
+   * @param boolean [aNoEditorUpdate=false]
+   *        Tells if you want to skip editor updates. Typically the editor is
+   *        updated to visually indicate that a breakpoint has been removed.
+   */
+  removeBreakpoint:
+  function DP_removeBreakpoint(aBreakpoint, aCallback, aNoEditorUpdate) {
+    if (!(aBreakpoint.actor in this.breakpoints)) {
+      aCallback && aCallback(aBreakpoint.location);
+      return;
+    }
+
+    aBreakpoint.remove(function() {
+      delete this.breakpoints[aBreakpoint.actor];
+
+      if (!aNoEditorUpdate) {
+        let url = this._selectedScript();
+        if (url == aBreakpoint.location.url) {
+          this._skipEditorBreakpointChange = true;
+          this.editor.removeBreakpoint(aBreakpoint.location.line - 1);
+          this._skipEditorBreakpointChange = false;
+        }
+      }
+
+      aCallback && aCallback(aBreakpoint.location);
+    }.bind(this));
+  },
+
+  /**
+   * Get the breakpoint object at the given location.
+   *
+   * @param string aUrl
+   *        The URL of where the breakpoint is.
+   * @param number aLine
+   *        The line number where the breakpoint is.
+   * @return object
+   *         The BreakpointActor object.
+   */
+  getBreakpoint: function DP_getBreakpoint(aUrl, aLine) {
+    for each (let breakpoint in this.breakpoints) {
+      if (breakpoint.location.url == aUrl && breakpoint.location.line == aLine) {
+        return breakpoint;
+      }
+    }
+    return null;
+  },
+
   /**
    * Closes the debugger UI removing child nodes and event listeners.
    */
   close: function DP_close() {
+    for each (let breakpoint in this.breakpoints) {
+      this.removeBreakpoint(breakpoint);
+    }
+
     if (this._tab) {
       this._tab._scriptDebugger = null;
       this._tab = null;
@@ -192,7 +428,7 @@ DebuggerPane.prototype = {
   },
 
   get debuggerWindow() {
-    return this.frame.contentWindow;
+    return this.frame ? this.frame.contentWindow : null;
   },
 
   get debuggerClient() {
@@ -340,6 +576,7 @@ DebuggerUI.prototype = {
     script.text = aSourceText;
     script.contentType = aContentType;
     elt.setUserData("sourceScript", script, null);
+    dbg._updateEditorBreakpoints();
   }
 };
 
diff --git a/browser/devtools/debugger/debugger-view.js b/browser/devtools/debugger/debugger-view.js
index 888a122d889..ea4d3bca2e2 100644
--- a/browser/devtools/debugger/debugger-view.js
+++ b/browser/devtools/debugger/debugger-view.js
@@ -22,6 +22,7 @@
  *
  * Contributor(s):
  *   Victor Porof <vporof@mozilla.com> (original author)
+ *   Mihai Sucan <mihai.sucan@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -199,7 +200,6 @@ DebuggerView.Stackframes = {
 
     // the list item wasn't found in the stackframe container
     if (!frame) {
-      dump("The frame list item wasn't found in the stackframes container.");
       return;
     }
 
@@ -356,7 +356,6 @@ DebuggerView.Properties = {
 
     // make sure the element was created successfully
     if (!element) {
-      dump("The debugger scope container wasn't created properly: " + aId);
       return null;
     }
 
@@ -398,7 +397,6 @@ DebuggerView.Properties = {
 
     // make sure the element was created successfully
     if (!element) {
-      dump("The debugger variable container wasn't created properly: " + aId);
       return null;
     }
 
@@ -466,7 +464,6 @@ DebuggerView.Properties = {
 
     // make sure the info node exists
     if (!info) {
-      dump("Could not set the grip for the corresponding variable: " + aVar.id);
       return null;
     }
 
@@ -569,7 +566,6 @@ DebuggerView.Properties = {
 
     // make sure the element was created successfully
     if (!element) {
-      dump("The debugger property container wasn't created properly.");
       return null;
     }
 
@@ -710,11 +706,9 @@ DebuggerView.Properties = {
   _createPropertyElement: function DVP__createPropertyElement(aName, aId, aClass, aParent) {
     // make sure we don't duplicate anything and the parent exists
     if (document.getElementById(aId)) {
-      dump("Duplicating a property element id is not allowed.");
       return null;
     }
     if (!aParent) {
-      dump("A property element must have a valid parent node specified.");
       return null;
     }
 
@@ -1127,6 +1121,15 @@ DebuggerView.Scripts = {
     }
   },
 
+   /**
+   	* Retrieve the URL of the selected script.
+   	* @return string|null
+   	*/
+   get selected() {
+    return this._scripts.selectedItem ?
+           this._scripts.selectedItem.value : null;
+   },
+
   /**
    * Adds a script to the scripts container.
    * If the script already exists (was previously added), null is returned.
diff --git a/browser/devtools/debugger/debugger.js b/browser/devtools/debugger/debugger.js
index 9875ae4ea41..fb9beb4c210 100644
--- a/browser/devtools/debugger/debugger.js
+++ b/browser/devtools/debugger/debugger.js
@@ -78,7 +78,8 @@ function startDebuggingTab(aClient, aTabGrip)
       gTabClient = aTabClient;
       gClient.attachThread(aResponse.threadActor, function(aResponse, aThreadClient) {
         if (!aThreadClient) {
-          dump("Couldn't attach to thread: "+aResponse.error+"\n");
+          Components.utils.reportError("Couldn't attach to thread: " +
+                                       aResponse.error);
           return;
         }
         ThreadState.connect(aThreadClient, function() {
@@ -612,6 +613,7 @@ var SourceScripts = {
       window.editor.setText(DebuggerView.getStr("loadingText"));
     } else {
       window.editor.setText(aScript.text);
+      window.updateEditorBreakpoints();
     }
   }
 };
diff --git a/browser/devtools/debugger/test/Makefile.in b/browser/devtools/debugger/test/Makefile.in
index d85d6668285..bb3e29eb67b 100644
--- a/browser/devtools/debugger/test/Makefile.in
+++ b/browser/devtools/debugger/test/Makefile.in
@@ -73,6 +73,7 @@ _BROWSER_TEST_FILES = \
 	browser_dbg_update-editor-mode.js \
 	browser_dbg_select-line.js \
 	browser_dbg_clean-exit.js \
+	browser_dbg_bug723069_editor-breakpoints.js \
 	head.js \
 	$(NULL)
 
diff --git a/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js b/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js
new file mode 100644
index 00000000000..f2066d16226
--- /dev/null
+++ b/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js
@@ -0,0 +1,274 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Bug 723069: test the debugger breakpoint API and connection to the source
+ * editor.
+ */
+
+const TAB_URL = EXAMPLE_URL + "browser_dbg_script-switching.html";
+
+let gPane = null;
+let gTab = null;
+let gDebuggee = null;
+let gDebugger = null;
+let gScripts = null;
+let gEditor = null;
+let gBreakpoints = null;
+
+function test()
+{
+  let tempScope = {};
+  Cu.import("resource:///modules/source-editor.jsm", tempScope);
+  let SourceEditor = tempScope.SourceEditor;
+
+  debug_tab_pane(TAB_URL, function(aTab, aDebuggee, aPane) {
+    gTab = aTab;
+    gDebuggee = aDebuggee;
+    gPane = aPane;
+    gDebugger = gPane.debuggerWindow;
+
+    gPane.activeThread.addOneTimeListener("scriptsadded", function() {
+      Services.tm.currentThread.dispatch({ run: onScriptsAdded }, 0);
+    });
+    gDebuggee.firstCall();
+  });
+
+  function onScriptsAdded()
+  {
+    gScripts = gDebugger.DebuggerView.Scripts;
+
+    is(gDebugger.StackFrames.activeThread.state, "paused",
+      "Should only be getting stack frames while paused.");
+
+    is(gScripts._scripts.itemCount, 2, "Found the expected number of scripts.");
+
+    gEditor = gDebugger.editor;
+
+    isnot(gEditor.getText().indexOf("debugger"), -1,
+          "The correct script was loaded initially.");
+    isnot(gScripts.selected, gScripts.scriptLocations()[0],
+          "the correct sccript is selected");
+
+    gBreakpoints = gPane.breakpoints;
+    is(Object.keys(gBreakpoints), 0, "no breakpoints");
+    ok(!gPane.getBreakpoint("foo", 3), "getBreakpoint('foo', 3) returns falsey");
+
+    is(gEditor.getBreakpoints().length, 0, "no breakpoints in the editor");
+
+
+    info("add the first breakpoint");
+    gEditor.addEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                             onEditorBreakpointAddFirst);
+    let location = {url: gScripts.selected, line: 6};
+    executeSoon(function() {
+      gPane.addBreakpoint(location, onBreakpointAddFirst);
+    });
+  }
+
+  let breakpointsAdded = 0;
+  let breakpointsRemoved = 0;
+  let editorBreakpointChanges = 0;
+
+  function onEditorBreakpointAddFirst(aEvent)
+  {
+    gEditor.removeEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                                onEditorBreakpointAddFirst);
+    editorBreakpointChanges++;
+
+    ok(aEvent, "breakpoint1 added to the editor");
+    is(aEvent.added.length, 1, "one breakpoint added to the editor");
+    is(aEvent.removed.length, 0, "no breakpoint was removed from the editor");
+    is(aEvent.added[0].line, 5, "editor breakpoint line is correct");
+
+    is(gEditor.getBreakpoints().length, 1,
+       "editor.getBreakpoints().length is correct");
+  }
+
+  function onBreakpointAddFirst(aBreakpointClient, aResponseError)
+  {
+    breakpointsAdded++;
+
+    ok(aBreakpointClient, "breakpoint1 added, client received");
+    ok(!aResponseError, "breakpoint1 added without errors");
+    is(aBreakpointClient.location.url, gScripts.selected,
+       "breakpoint1 client url is correct");
+    is(aBreakpointClient.location.line, 6,
+       "breakpoint1 client line is correct");
+
+    executeSoon(function() {
+      ok(aBreakpointClient.actor in gBreakpoints,
+         "breakpoint1 client found in the list of debugger breakpoints");
+      is(Object.keys(gBreakpoints).length, 1,
+         "the list of debugger breakpoints holds only one breakpoint");
+      is(gPane.getBreakpoint(gScripts.selected, 6), aBreakpointClient,
+         "getBreakpoint(selectedScript, 2) returns the correct breakpoint");
+
+      info("remove the first breakpoint");
+      gEditor.addEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                               onEditorBreakpointRemoveFirst);
+      gPane.removeBreakpoint(aBreakpointClient, onBreakpointRemoveFirst);
+    });
+  }
+
+  function onBreakpointRemoveFirst(aLocation)
+  {
+    breakpointsRemoved++;
+
+    ok(aLocation, "breakpoint1 removed");
+    is(aLocation.url, gScripts.selected, "breakpoint1 remove: url is correct");
+    is(aLocation.line, 6, "breakpoint1 remove: line is correct");
+
+    executeSoon(testBreakpointAddBackground);
+  }
+
+  function onEditorBreakpointRemoveFirst(aEvent)
+  {
+    gEditor.removeEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                                onEditorBreakpointRemoveFirst);
+    editorBreakpointChanges++;
+
+    ok(aEvent, "breakpoint1 removed from the editor");
+    is(aEvent.added.length, 0, "no breakpoint was added to the editor");
+    is(aEvent.removed.length, 1, "one breakpoint was removed from the editor");
+    is(aEvent.removed[0].line, 5, "editor breakpoint line is correct");
+
+    is(gEditor.getBreakpoints().length, 0, "editor.getBreakpoints().length is correct");
+  }
+
+  function testBreakpointAddBackground()
+  {
+    info("add a breakpoint to the second script which is not selected");
+
+    is(Object.keys(gBreakpoints).length, 0, "no breakpoints in the debugger");
+    ok(!gPane.getBreakpoint(gScripts.selected, 6),
+       "getBreakpoint(selectedScript, 6) returns no breakpoint");
+
+    let script0 = gScripts.scriptLocations()[0];
+    isnot(script0, gScripts.selected,
+          "first script location is not the currently selected script");
+
+    let location = {url: script0, line: 5};
+    gEditor.addEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                             onEditorBreakpointAddBackgroundTrap);
+    gPane.addBreakpoint(location, onBreakpointAddBackground);
+  }
+
+  function onEditorBreakpointAddBackgroundTrap(aEvent)
+  {
+    // trap listener: no breakpoint must be added to the editor when a breakpoint
+    // is added to a script that is not currently selected.
+    gEditor.removeEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                                onEditorBreakpointAddBackgroundTrap);
+    editorBreakpointChanges++;
+    ok(false, "breakpoint2 must not be added to the editor");
+  }
+
+  function onBreakpointAddBackground(aBreakpointClient, aResponseError)
+  {
+    breakpointsAdded++;
+
+    ok(aBreakpointClient, "breakpoint2 added, client received");
+    ok(!aResponseError, "breakpoint2 added without errors");
+    is(aBreakpointClient.location.url, gScripts.scriptLocations()[0],
+       "breakpoint2 client url is correct");
+    is(aBreakpointClient.location.line, 5,
+       "breakpoint2 client line is correct");
+
+    executeSoon(function() {
+      ok(aBreakpointClient.actor in gBreakpoints,
+         "breakpoint2 client found in the list of debugger breakpoints");
+      is(Object.keys(gBreakpoints).length, 1, "one breakpoint in the debugger");
+      is(gPane.getBreakpoint(gScripts.scriptLocations()[0], 5), aBreakpointClient,
+         "getBreakpoint(scriptLocations[0], 5) returns the correct breakpoint");
+
+      // remove the trap listener
+      gEditor.removeEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                                  onEditorBreakpointAddBackgroundTrap);
+
+      gEditor.addEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                               onEditorBreakpointAddSwitch);
+      gEditor.addEventListener(SourceEditor.EVENTS.TEXT_CHANGED,
+                               onEditorTextChanged);
+
+      info("switch to the second script");
+
+      gScripts._scripts.selectedIndex = 0;
+      gDebugger.SourceScripts.onChange({ target: gScripts._scripts });
+    });
+  }
+
+  function onEditorBreakpointAddSwitch(aEvent)
+  {
+    gEditor.removeEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                                onEditorBreakpointAddSwitch);
+    editorBreakpointChanges++;
+
+    ok(aEvent, "breakpoint2 added to the editor");
+    is(aEvent.added.length, 1, "one breakpoint added to the editor");
+    is(aEvent.removed.length, 0, "no breakpoint was removed from the editor");
+    is(aEvent.added[0].line, 4, "editor breakpoint line is correct");
+
+    is(gEditor.getBreakpoints().length, 1,
+       "editor.getBreakpoints().length is correct");
+  }
+
+  function onEditorTextChanged()
+  {
+    gEditor.removeEventListener(SourceEditor.EVENTS.TEXT_CHANGED,
+                                onEditorTextChanged);
+
+    is(gEditor.getText().indexOf("debugger"), -1,
+       "The second script is no longer displayed.");
+
+    isnot(gEditor.getText().indexOf("firstCall"), -1,
+          "The first script is displayed.");
+
+    executeSoon(function() {
+      info("remove the second breakpoint using the mouse");
+
+      gEditor.addEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                               onEditorBreakpointRemoveSecond);
+
+      let testWin = gEditor.editorElement.ownerDocument.defaultView;
+      EventUtils.synthesizeMouse(gEditor.editorElement, 10, 70, {}, testWin);
+    });
+
+  }
+
+  function onEditorBreakpointRemoveSecond(aEvent)
+  {
+    gEditor.removeEventListener(SourceEditor.EVENTS.BREAKPOINT_CHANGE,
+                                onEditorBreakpointRemoveSecond);
+    editorBreakpointChanges++;
+
+    ok(aEvent, "breakpoint2 removed from the editor");
+    is(aEvent.added.length, 0, "no breakpoint was added to the editor");
+    is(aEvent.removed.length, 1, "one breakpoint was removed from the editor");
+    is(aEvent.removed[0].line, 4, "editor breakpoint line is correct");
+
+    is(gEditor.getBreakpoints().length, 0, "editor.getBreakpoints().length is correct");
+
+    executeSoon(function() {
+      gDebugger.StackFrames.activeThread.resume(finish);
+    });
+  }
+
+  registerCleanupFunction(function() {
+    is(Object.keys(gBreakpoints).length, 0, "no breakpoint in the debugger");
+    ok(!gPane.getBreakpoint(gScripts.scriptLocations()[0], 5),
+       "getBreakpoint(scriptLocations[0], 5) returns no breakpoint");
+
+    removeTab(gTab);
+    is(breakpointsAdded, 2, "correct number of breakpoints have been added");
+    is(breakpointsRemoved, 1, "correct number of breakpoints have been removed");
+    is(editorBreakpointChanges, 4, "correct number of editor breakpoint changes");
+    gPane = null;
+    gTab = null;
+    gDebuggee = null;
+    gDebugger = null;
+    gScripts = null;
+    gEditor = null;
+    gBreakpoints = null;
+  });
+}
diff --git a/browser/devtools/debugger/test/browser_dbg_clean-exit.js b/browser/devtools/debugger/test/browser_dbg_clean-exit.js
index 26eea1d3c2c..a152a8b5d84 100644
--- a/browser/devtools/debugger/test/browser_dbg_clean-exit.js
+++ b/browser/devtools/debugger/test/browser_dbg_clean-exit.js
@@ -7,7 +7,6 @@
 
 var gPane = null;
 var gTab = null;
-var gDebuggee = null;
 var gDebugger = null;
 
 const DEBUGGER_TAB_URL = EXAMPLE_URL + "browser_dbg_debuggerstatement.html";
@@ -15,7 +14,6 @@ const DEBUGGER_TAB_URL = EXAMPLE_URL + "browser_dbg_debuggerstatement.html";
 function test() {
   debug_tab_pane(DEBUGGER_TAB_URL, function(aTab, aDebuggee, aPane) {
     gTab = aTab;
-    gDebuggee = aDebuggee;
     gPane = aPane;
     gDebugger = gPane.debuggerWindow;
 
@@ -29,12 +27,16 @@ function testCleanExit() {
       is(gDebugger.StackFrames.activeThread.paused, true,
         "Should be paused after the debugger statement.");
 
-      gPane._client.addOneTimeListener("tabDetached", function () {
-        finish();
-      });
-      removeTab(gTab);
+      closeDebuggerAndFinish(gTab);
     }}, 0);
   });
 
   gTab.linkedBrowser.contentWindow.wrappedJSObject.runDebuggerStatement();
 }
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_location-changes.js b/browser/devtools/debugger/test/browser_dbg_location-changes.js
index c01e5e4c870..1132bd6a79f 100644
--- a/browser/devtools/debugger/test/browser_dbg_location-changes.js
+++ b/browser/devtools/debugger/test/browser_dbg_location-changes.js
@@ -55,10 +55,17 @@ function testLocationChange()
       gPane._client.addOneTimeListener("tabAttached", function(aEvent, aPacket) {
         ok(true, "Successfully reattached to the tab again.");
 
-        removeTab(gTab);
-        finish();
+        closeDebuggerAndFinish(gTab);
       });
     });
     content.location = TAB1_URL;
   });
 }
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_pause-resume.js b/browser/devtools/debugger/test/browser_dbg_pause-resume.js
index 4a549ae9b0e..3c7d11bfca5 100644
--- a/browser/devtools/debugger/test/browser_dbg_pause-resume.js
+++ b/browser/devtools/debugger/test/browser_dbg_pause-resume.js
@@ -6,13 +6,11 @@
 
 var gPane = null;
 var gTab = null;
-var gDebuggee = null;
 var gDebugger = null;
 
 function test() {
   debug_tab_pane(STACK_URL, function(aTab, aDebuggee, aPane) {
     gTab = aTab;
-    gDebuggee = aDebuggee;
     gPane = aPane;
     gDebugger = gPane.debuggerWindow;
 
@@ -63,8 +61,7 @@ function testResume() {
       is(button.label, gDebugger.DebuggerView.getStr("pauseLabel"),
         "Button label should be pause when running.");
 
-      removeTab(gTab);
-      finish();
+      closeDebuggerAndFinish(gTab);
     }}, 0);
   });
 
@@ -72,3 +69,9 @@ function testResume() {
     gDebugger.document.getElementById("resume"),
     gDebugger);
 }
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_propertyview-01.js b/browser/devtools/debugger/test/browser_dbg_propertyview-01.js
index 4d5b014e3fd..f1923f7a8cc 100644
--- a/browser/devtools/debugger/test/browser_dbg_propertyview-01.js
+++ b/browser/devtools/debugger/test/browser_dbg_propertyview-01.js
@@ -134,9 +134,15 @@ function resumeAndFinish() {
       is(vs._scripts.itemCount, 6,
         "Got too many script items in the list!");
 
-
-      removeTab(gTab);
-      finish();
+      closeDebuggerAndFinish(gTab);
     });
   });
 }
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_propertyview-02.js b/browser/devtools/debugger/test/browser_dbg_propertyview-02.js
index 284ecef58dd..37ed42054e3 100644
--- a/browser/devtools/debugger/test/browser_dbg_propertyview-02.js
+++ b/browser/devtools/debugger/test/browser_dbg_propertyview-02.js
@@ -116,16 +116,19 @@ function testSimpleCall() {
       ok(!testScope.expanded,
         "Clicking again the testScope tilte should collapse it.");
 
-      resumeAndFinish();
+      gDebugger.StackFrames.activeThread.resume(function() {
+        closeDebuggerAndFinish(gTab);
+      });
     }}, 0);
   });
 
   gDebuggee.simpleCall();
 }
 
-function resumeAndFinish() {
-  gDebugger.StackFrames.activeThread.resume(function() {
-    removeTab(gTab);
-    finish();
-  });
-}
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_propertyview-03.js b/browser/devtools/debugger/test/browser_dbg_propertyview-03.js
index d61692be32d..c48b2ce001b 100644
--- a/browser/devtools/debugger/test/browser_dbg_propertyview-03.js
+++ b/browser/devtools/debugger/test/browser_dbg_propertyview-03.js
@@ -118,16 +118,19 @@ function testSimpleCall() {
       is(gDebugger.DebuggerView.Properties._vars.childNodes.length, 4,
         "The scope should have been removed from the parent container tree.");
 
-      resumeAndFinish();
+      gDebugger.StackFrames.activeThread.resume(function() {
+        closeDebuggerAndFinish(gTab);
+      });
     }}, 0);
   });
 
   gDebuggee.simpleCall();
 }
 
-function resumeAndFinish() {
-  gDebugger.StackFrames.activeThread.resume(function() {
-    removeTab(gTab);
-    finish();
-  });
-}
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_propertyview-04.js b/browser/devtools/debugger/test/browser_dbg_propertyview-04.js
index a0be8a00703..c653f5abec1 100644
--- a/browser/devtools/debugger/test/browser_dbg_propertyview-04.js
+++ b/browser/devtools/debugger/test/browser_dbg_propertyview-04.js
@@ -73,16 +73,19 @@ function testSimpleCall() {
       is(testScope.querySelector(".details").childNodes.length, 0,
         "The var should have been removed from the parent container tree.");
 
-      resumeAndFinish();
+      gDebugger.StackFrames.activeThread.resume(function() {
+        closeDebuggerAndFinish(gTab);
+      });
     }}, 0);
   });
 
   gDebuggee.simpleCall();
 }
 
-function resumeAndFinish() {
-  gDebugger.StackFrames.activeThread.resume(function() {
-    removeTab(gTab);
-    finish();
-  });
-}
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_propertyview-05.js b/browser/devtools/debugger/test/browser_dbg_propertyview-05.js
index 73301399959..34cb3dbbe81 100644
--- a/browser/devtools/debugger/test/browser_dbg_propertyview-05.js
+++ b/browser/devtools/debugger/test/browser_dbg_propertyview-05.js
@@ -81,16 +81,19 @@ function testSimpleCall() {
       is(testScope.querySelector(".details").childNodes.length, 0,
         "The var should have been removed from the parent container tree.");
 
-      resumeAndFinish();
+      gDebugger.StackFrames.activeThread.resume(function() {
+        closeDebuggerAndFinish(gTab);
+      });
     }}, 0);
   });
 
   gDebuggee.simpleCall();
 }
 
-function resumeAndFinish() {
-  gDebugger.StackFrames.activeThread.resume(function() {
-    removeTab(gTab);
-    finish();
-  });
-}
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_propertyview-06.js b/browser/devtools/debugger/test/browser_dbg_propertyview-06.js
index 0c6b601397c..62fa96dbd6b 100644
--- a/browser/devtools/debugger/test/browser_dbg_propertyview-06.js
+++ b/browser/devtools/debugger/test/browser_dbg_propertyview-06.js
@@ -117,17 +117,19 @@ function testSimpleCall() {
       is(localVar5.querySelector(".info").textContent, "[object Object]",
         "The grip information for the localVar5 wasn't set correctly.");
 
-
-      resumeAndFinish();
+      gDebugger.StackFrames.activeThread.resume(function() {
+        closeDebuggerAndFinish(gTab);
+      });
     }}, 0);
   });
 
   gDebuggee.simpleCall();
 }
 
-function resumeAndFinish() {
-  gDebugger.StackFrames.activeThread.resume(function() {
-    removeTab(gTab);
-    finish();
-  });
-}
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_propertyview-07.js b/browser/devtools/debugger/test/browser_dbg_propertyview-07.js
index 3df26725b01..4c1b9f1e3a2 100644
--- a/browser/devtools/debugger/test/browser_dbg_propertyview-07.js
+++ b/browser/devtools/debugger/test/browser_dbg_propertyview-07.js
@@ -10,14 +10,12 @@ const TAB_URL = EXAMPLE_URL + "browser_dbg_frame-parameters.html";
 
 var gPane = null;
 var gTab = null;
-var gDebuggee = null;
 var gDebugger = null;
 
 function test()
 {
   debug_tab_pane(TAB_URL, function(aTab, aDebuggee, aPane) {
     gTab = aTab;
-    gDebuggee = aDebuggee;
     gPane = aPane;
     gDebugger = gPane.debuggerWindow;
 
@@ -87,10 +85,16 @@ function resumeAndFinish() {
       is(frames.querySelectorAll(".dbg-stackframe").length, 0,
         "Should have no frames.");
 
-      removeTab(gTab);
-      finish();
+      closeDebuggerAndFinish(gTab);
     }}, 0);
   });
 
   gDebugger.StackFrames.activeThread.resume();
 }
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_propertyview-08.js b/browser/devtools/debugger/test/browser_dbg_propertyview-08.js
index f7f49773006..59765da70fc 100644
--- a/browser/devtools/debugger/test/browser_dbg_propertyview-08.js
+++ b/browser/devtools/debugger/test/browser_dbg_propertyview-08.js
@@ -10,14 +10,12 @@ const TAB_URL = EXAMPLE_URL + "browser_dbg_frame-parameters.html";
 
 var gPane = null;
 var gTab = null;
-var gDebuggee = null;
 var gDebugger = null;
 
 function test()
 {
   debug_tab_pane(TAB_URL, function(aTab, aDebuggee, aPane) {
     gTab = aTab;
-    gDebuggee = aDebuggee;
     gPane = aPane;
     gDebugger = gPane.debuggerWindow;
 
@@ -103,10 +101,16 @@ function resumeAndFinish() {
       is(frames.querySelectorAll(".dbg-stackframe").length, 0,
         "Should have no frames.");
 
-      removeTab(gTab);
-      finish();
+      closeDebuggerAndFinish(gTab);
     }}, 0);
   });
 
   gDebugger.StackFrames.activeThread.resume();
 }
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_script-switching.js b/browser/devtools/debugger/test/browser_dbg_script-switching.js
index 90c71223d76..000b93d326d 100644
--- a/browser/devtools/debugger/test/browser_dbg_script-switching.js
+++ b/browser/devtools/debugger/test/browser_dbg_script-switching.js
@@ -103,6 +103,13 @@ function testSwitchRunning()
   ok(gDebugger.editor.getText().search(/firstCall/) == -1,
     "The first script is no longer displayed.");
 
-  removeTab(gTab);
-  finish();
+  closeDebuggerAndFinish(gTab);
 }
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_select-line.js b/browser/devtools/debugger/test/browser_dbg_select-line.js
index b33b3eea3cc..0b246593b32 100644
--- a/browser/devtools/debugger/test/browser_dbg_select-line.js
+++ b/browser/devtools/debugger/test/browser_dbg_select-line.js
@@ -68,14 +68,22 @@ function testSelectLine() {
                "The correct line is selected.");
 
             gDebugger.StackFrames.activeThread.resume(function() {
-              removeTab(gTab);
-              finish();
+              closeDebuggerAndFinish(gTab);
             });
           });
         });
 
+        // Scroll all the way down to ensure stackframe-3 is visible.
+        let stackframes = gDebugger.document.getElementById("stackframes");
+        stackframes.scrollTop = stackframes.scrollHeight;
+
         // Click the oldest stack frame.
+        let frames = gDebugger.DebuggerView.Stackframes._frames;
+        is(frames.querySelectorAll(".dbg-stackframe").length, 4,
+          "Should have four frames.");
+
         let element = gDebugger.document.getElementById("stackframe-3");
+        isnot(element, null, "Found the third stack frame.");
         EventUtils.synthesizeMouseAtCenter(element, {}, gDebugger);
       });
     }}, 0);
@@ -83,3 +91,11 @@ function testSelectLine() {
 
   gDebuggee.firstCall();
 }
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_stack-01.js b/browser/devtools/debugger/test/browser_dbg_stack-01.js
index f38997398e7..6ad23121b24 100644
--- a/browser/devtools/debugger/test/browser_dbg_stack-01.js
+++ b/browser/devtools/debugger/test/browser_dbg_stack-01.js
@@ -36,16 +36,19 @@ function testSimpleCall() {
       is(childNodes.length, frames.querySelectorAll(".dbg-stackframe").length,
         "All children should be frames.");
 
-      resumeAndFinish();
+      gDebugger.StackFrames.activeThread.resume(function() {
+        closeDebuggerAndFinish(gTab);
+      });
     }}, 0);
   });
 
   gDebuggee.simpleCall();
 }
 
-function resumeAndFinish() {
-  gDebugger.StackFrames.activeThread.resume(function() {
-    removeTab(gTab);
-    finish();
-  });
-}
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_stack-02.js b/browser/devtools/debugger/test/browser_dbg_stack-02.js
index 47af89e7234..2b6c223c705 100644
--- a/browser/devtools/debugger/test/browser_dbg_stack-02.js
+++ b/browser/devtools/debugger/test/browser_dbg_stack-02.js
@@ -67,17 +67,19 @@ function testEvalCall() {
       ok(!frames.querySelector("#stackframe-1").classList.contains("selected"),
          "Second frame should not be selected after click inside the first frame.");
 
-      resumeAndFinish();
+      gDebugger.StackFrames.activeThread.resume(function() {
+        closeDebuggerAndFinish(gTab);
+      });
     }}, 0);
   });
 
   gDebuggee.evalCall();
 }
 
-function resumeAndFinish() {
-  gDebugger.StackFrames.activeThread.resume(function() {
-    removeTab(gTab);
-    finish();
-  });
-}
-
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_stack-03.js b/browser/devtools/debugger/test/browser_dbg_stack-03.js
index bd48cfb8c3f..1475fc70c62 100644
--- a/browser/devtools/debugger/test/browser_dbg_stack-03.js
+++ b/browser/devtools/debugger/test/browser_dbg_stack-03.js
@@ -47,7 +47,9 @@ function testRecurse() {
           is(frames.querySelectorAll(".dbg-stackframe").length, recurseLimit,
             "Should have reached the recurse limit.");
 
-          resumeAndFinish();
+          gDebugger.StackFrames.activeThread.resume(function() {
+            closeDebuggerAndFinish(gTab);
+          });
         });
 
         frames.scrollTop = frames.scrollHeight;
@@ -60,9 +62,10 @@ function testRecurse() {
   gDebuggee.recurse();
 }
 
-function resumeAndFinish() {
-  gDebugger.StackFrames.activeThread.resume(function() {
-    removeTab(gTab);
-    finish();
-  });
-}
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_stack-04.js b/browser/devtools/debugger/test/browser_dbg_stack-04.js
index 246d5548a19..2585135087a 100644
--- a/browser/devtools/debugger/test/browser_dbg_stack-04.js
+++ b/browser/devtools/debugger/test/browser_dbg_stack-04.js
@@ -48,8 +48,7 @@ function testEvalCallResume() {
         is(frames.querySelectorAll(".empty").length, 1,
            "Should have the empty list explanation.");
 
-        removeTab(gTab);
-        finish();
+        closeDebuggerAndFinish(gTab);
       });
 
       gPane.activeThread.resume();
@@ -58,3 +57,11 @@ function testEvalCallResume() {
 
   gDebuggee.evalCall();
 }
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_update-editor-mode.js b/browser/devtools/debugger/test/browser_dbg_update-editor-mode.js
index 6588e7d01eb..7a1a44400a1 100644
--- a/browser/devtools/debugger/test/browser_dbg_update-editor-mode.js
+++ b/browser/devtools/debugger/test/browser_dbg_update-editor-mode.js
@@ -72,7 +72,15 @@ function testSwitchPaused()
      "Found the expected editor mode.");
 
   gDebugger.StackFrames.activeThread.resume(function() {
-    removeTab(gTab);
-    finish();
+    closeDebuggerAndFinish(gTab);
   });
 }
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+  gScripts = null;
+});
diff --git a/browser/devtools/debugger/test/head.js b/browser/devtools/debugger/test/head.js
index 2c5da2f5594..dced2c347ab 100644
--- a/browser/devtools/debugger/test/head.js
+++ b/browser/devtools/debugger/test/head.js
@@ -49,6 +49,14 @@ function removeTab(aTab) {
   gBrowser.removeTab(aTab);
 }
 
+function closeDebuggerAndFinish(aTab) {
+  DebuggerUI.aWindow.addEventListener("Debugger:Shutdown", function cleanup() {
+    DebuggerUI.aWindow.removeEventListener("Debugger:Shutdown", cleanup, false);
+    finish();
+  }, false);
+  DebuggerUI.getDebugger(aTab).close();
+}
+
 function get_tab_actor_for_url(aClient, aURL, aCallback) {
   aClient.listTabs(function(aResponse) {
     for each (let tab in aResponse.tabs) {
diff --git a/browser/devtools/sourceeditor/source-editor-orion.jsm b/browser/devtools/sourceeditor/source-editor-orion.jsm
index 3728ed2680f..e7dc16e24e1 100644
--- a/browser/devtools/sourceeditor/source-editor-orion.jsm
+++ b/browser/devtools/sourceeditor/source-editor-orion.jsm
@@ -23,6 +23,7 @@
  *   Mihai Sucan <mihai.sucan@gmail.com> (original author)
  *   Kenny Heaton <kennyheaton@gmail.com>
  *   Spyros Livathinos <livathinos.spyros@gmail.com>
+ *   Allen Eubank <adeubank@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -124,6 +125,18 @@ const DEFAULT_KEYBINDINGS = [
     code: Ci.nsIDOMKeyEvent.DOM_VK_TAB,
     shift: true,
   },
+  {
+    action: "Move Lines Up",
+    code: Ci.nsIDOMKeyEvent.DOM_VK_UP,
+    ctrl: Services.appinfo.OS == "Darwin",
+    alt: true,
+  },
+  {
+    action: "Move Lines Down",
+    code: Ci.nsIDOMKeyEvent.DOM_VK_DOWN,
+    ctrl: Services.appinfo.OS == "Darwin",
+    alt: true,
+  },
 ];
 
 var EXPORTED_SYMBOLS = ["SourceEditor"];
@@ -367,6 +380,7 @@ SourceEditor.prototype = {
       "Find Next Occurrence": [this.ui.findNext, this.ui],
       "Find Previous Occurrence": [this.ui.findPrevious, this.ui],
       "Goto Line...": [this.ui.gotoLine, this.ui],
+      "Move Lines Down": [this._moveLines, this],
     };
 
     for (let name in actions) {
@@ -374,9 +388,17 @@ SourceEditor.prototype = {
       this._view.setAction(name, action[0].bind(action[1]));
     }
 
+    this._view.setAction("Move Lines Up", this._moveLines.bind(this, true));
+
     let keys = (config.keys || []).concat(DEFAULT_KEYBINDINGS);
     keys.forEach(function(aKey) {
-      let binding = new KeyBinding(aKey.code, aKey.accel, aKey.shift, aKey.alt);
+      // In Orion mod1 refers to Cmd on Macs and Ctrl on Windows and Linux.
+      // So, if ctrl is in aKey we use it on Windows and Linux, otherwise
+      // we use aKey.accel for mod1.
+      let mod1 = Services.appinfo.OS != "Darwin" &&
+                 "ctrl" in aKey ? aKey.ctrl : aKey.accel;
+      let binding = new KeyBinding(aKey.code, mod1, aKey.shift, aKey.alt,
+                                  aKey.ctrl);
       this._view.setKeyBinding(binding, aKey.action);
 
       if (aKey.callback) {
@@ -578,6 +600,78 @@ SourceEditor.prototype = {
     return true;
   },
 
+  /**
+   * Move lines upwards or downwards, relative to the current caret location.
+   *
+   * @private
+   * @param boolean aLineAbove
+   *        True if moving lines up, false to move lines down.
+   */
+  _moveLines: function SE__moveLines(aLineAbove)
+  {
+    if (this.readOnly) {
+      return false;
+    }
+
+    let model = this._model;
+    let selection = this.getSelection();
+    let firstLine = model.getLineAtOffset(selection.start);
+    if (firstLine == 0 && aLineAbove) {
+      return true;
+    }
+
+    let lastLine = model.getLineAtOffset(selection.end);
+    let firstLineStart = model.getLineStart(firstLine);
+    let lastLineStart = model.getLineStart(lastLine);
+    if (selection.start != selection.end && lastLineStart == selection.end) {
+      lastLine--;
+    }
+    if (!aLineAbove && (lastLine + 1) == this.getLineCount()) {
+      return true;
+    }
+
+    let lastLineEnd = model.getLineEnd(lastLine, true);
+    let text = this.getText(firstLineStart, lastLineEnd);
+
+    if (aLineAbove) {
+      let aboveLine = firstLine - 1;
+      let aboveLineStart = model.getLineStart(aboveLine);
+
+      this.startCompoundChange();
+      if (lastLine == (this.getLineCount() - 1)) {
+        let delimiterStart = model.getLineEnd(aboveLine);
+        let delimiterEnd = model.getLineEnd(aboveLine, true);
+        let lineDelimiter = this.getText(delimiterStart, delimiterEnd);
+        text += lineDelimiter;
+        this.setText("", firstLineStart - lineDelimiter.length, lastLineEnd);
+      } else {
+        this.setText("", firstLineStart, lastLineEnd);
+      }
+      this.setText(text, aboveLineStart, aboveLineStart);
+      this.endCompoundChange();
+      this.setSelection(aboveLineStart, aboveLineStart + text.length);
+    } else {
+      let belowLine = lastLine + 1;
+      let belowLineEnd = model.getLineEnd(belowLine, true);
+
+      let insertAt = belowLineEnd - lastLineEnd + firstLineStart;
+      let lineDelimiter = "";
+      if (belowLine == this.getLineCount() - 1) {
+        let delimiterStart = model.getLineEnd(lastLine);
+        lineDelimiter = this.getText(delimiterStart, lastLineEnd);
+        text = lineDelimiter + text.substr(0, text.length -
+                                              lineDelimiter.length);
+      }
+      this.startCompoundChange();
+      this.setText("", firstLineStart, lastLineEnd);
+      this.setText(text, insertAt, insertAt);
+      this.endCompoundChange();
+      this.setSelection(insertAt + lineDelimiter.length,
+                        insertAt + text.length);
+    }
+    return true;
+  },
+
   /**
    * The Orion Selection event handler. The current caret line is
    * highlighted and for Linux users the selected text is copied into the X11
diff --git a/browser/devtools/sourceeditor/source-editor.jsm b/browser/devtools/sourceeditor/source-editor.jsm
index ae02faea5a5..7eb31982c65 100644
--- a/browser/devtools/sourceeditor/source-editor.jsm
+++ b/browser/devtools/sourceeditor/source-editor.jsm
@@ -192,6 +192,7 @@ SourceEditor.DEFAULTS = {
    *   - action - name of the editor action to invoke.
    *   - code - keyCode for the shortcut.
    *   - accel - boolean for the Accel key (Cmd on Macs, Ctrl on Linux/Windows).
+   *   - ctrl - boolean for the Control key
    *   - shift - boolean for the Shift key.
    *   - alt - boolean for the Alt key.
    *   - callback - optional function to invoke, if the action is not predefined
diff --git a/browser/devtools/sourceeditor/test/Makefile.in b/browser/devtools/sourceeditor/test/Makefile.in
index eff7bde8d1a..94aaf9beea0 100644
--- a/browser/devtools/sourceeditor/test/Makefile.in
+++ b/browser/devtools/sourceeditor/test/Makefile.in
@@ -58,6 +58,7 @@ _BROWSER_TEST_FILES = \
 		browser_bug725388_mouse_events.js \
 		browser_bug707987_debugger_breakpoints.js \
 		browser_bug712982_line_ruler_click.js \
+		browser_bug725618_moveLines_shortcut.js \
 		browser_bug700893_dirty_state.js \
 		head.js \
 
diff --git a/browser/devtools/sourceeditor/test/browser_bug725618_moveLines_shortcut.js b/browser/devtools/sourceeditor/test/browser_bug725618_moveLines_shortcut.js
new file mode 100644
index 00000000000..c86a436c699
--- /dev/null
+++ b/browser/devtools/sourceeditor/test/browser_bug725618_moveLines_shortcut.js
@@ -0,0 +1,117 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+let tempScope = {};
+Cu.import("resource:///modules/source-editor.jsm", tempScope);
+let SourceEditor = tempScope.SourceEditor;
+
+let editor;
+let testWin;
+
+function test()
+{
+  waitForExplicitFinish();
+
+  const windowUrl = "data:application/vnd.mozilla.xul+xml,<?xml version='1.0'?>" +
+    "<window xmlns='http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul'" +
+    " title='test for bug 725618 - moveLines shortcut' width='300' height='500'>" +
+    "<box flex='1'/></window>";
+  const windowFeatures = "chrome,titlebar,toolbar,centerscreen,resizable,dialog=no";
+
+  testWin = Services.ww.openWindow(null, windowUrl, "_blank", windowFeatures, null);
+  testWin.addEventListener("load", function onWindowLoad() {
+    testWin.removeEventListener("load", onWindowLoad, false);
+    waitForFocus(initEditor, testWin);
+  }, false);
+}
+
+function initEditor()
+{
+  let box = testWin.document.querySelector("box");
+
+  let text = "target\nfoo\nbar"
+  let config = {
+    initialText: text,
+  };
+
+  editor = new SourceEditor();
+  editor.init(box, config, editorLoaded);
+}
+
+function editorLoaded()
+{
+  editor.focus();
+
+  editor.setCaretOffset(0);
+
+  let modifiers = {altKey: true, ctrlKey: Services.appinfo.OS == "Darwin"};
+
+  EventUtils.synthesizeKey("VK_DOWN", modifiers, testWin);
+  is(editor.getText(), "foo\ntarget\nbar", "Move lines down works");
+  is(editor.getSelectedText(), "target\n", "selection is correct");
+
+  EventUtils.synthesizeKey("VK_DOWN", modifiers, testWin);
+  is(editor.getText(), "foo\nbar\ntarget", "Move lines down works");
+  is(editor.getSelectedText(), "target", "selection is correct");
+
+  EventUtils.synthesizeKey("VK_DOWN", modifiers, testWin);
+  is(editor.getText(), "foo\nbar\ntarget", "Check for bottom of editor works");
+  is(editor.getSelectedText(), "target", "selection is correct");
+
+  EventUtils.synthesizeKey("VK_UP", modifiers, testWin);
+  is(editor.getText(), "foo\ntarget\nbar", "Move lines up works");
+  is(editor.getSelectedText(), "target\n", "selection is correct");
+
+  EventUtils.synthesizeKey("VK_UP", modifiers, testWin);
+  is(editor.getText(), "target\nfoo\nbar", "Move lines up works");
+  is(editor.getSelectedText(), "target\n", "selection is correct");
+
+  EventUtils.synthesizeKey("VK_UP", modifiers, testWin);
+  is(editor.getText(), "target\nfoo\nbar", "Check for top of editor works");
+  is(editor.getSelectedText(), "target\n", "selection is correct");
+
+  editor.setSelection(0, 10);
+  info("text within selection =" + editor.getSelectedText());
+
+  EventUtils.synthesizeKey("VK_DOWN", modifiers, testWin);
+  is(editor.getText(), "bar\ntarget\nfoo", "Multiple line move down works");
+  is(editor.getSelectedText(), "target\nfoo", "selection is correct");
+
+  EventUtils.synthesizeKey("VK_DOWN", modifiers, testWin);
+  is(editor.getText(), "bar\ntarget\nfoo",
+      "Check for bottom of editor works with multiple line selection");
+  is(editor.getSelectedText(), "target\nfoo", "selection is correct");
+
+  EventUtils.synthesizeKey("VK_UP", modifiers, testWin);
+  is(editor.getText(), "target\nfoo\nbar", "Multiple line move up works");
+  is(editor.getSelectedText(), "target\nfoo\n", "selection is correct");
+
+  EventUtils.synthesizeKey("VK_UP", modifiers, testWin);
+  is(editor.getText(), "target\nfoo\nbar",
+      "Check for top of editor works with multiple line selection");
+  is(editor.getSelectedText(), "target\nfoo\n", "selection is correct");
+
+  editor.readOnly = true;
+
+  editor.setCaretOffset(0);
+
+  EventUtils.synthesizeKey("VK_UP", modifiers, testWin);
+  is(editor.getText(), "target\nfoo\nbar",
+     "Check for readOnly mode works with move lines up");
+
+  EventUtils.synthesizeKey("VK_DOWN", modifiers, testWin);
+  is(editor.getText(), "target\nfoo\nbar",
+     "Check for readOnly mode works with move lines down");
+
+  finish();
+}
+
+registerCleanupFunction(function()
+{
+  editor.destroy();
+  testWin.close();
+  testWin = editor = null;
+});
diff --git a/browser/devtools/styleinspector/CssLogic.jsm b/browser/devtools/styleinspector/CssLogic.jsm
index d450536fc27..0a431db857d 100644
--- a/browser/devtools/styleinspector/CssLogic.jsm
+++ b/browser/devtools/styleinspector/CssLogic.jsm
@@ -1198,11 +1198,19 @@ function CssRule(aCssSheet, aDomRule, aElement)
   this._cssSheet = aCssSheet;
   this._domRule = aDomRule;
 
+  let parentRule = aDomRule.parentRule;
+  if (parentRule && parentRule.type == Ci.nsIDOMCSSRule.MEDIA_RULE) {
+    this.mediaText = parentRule.media.mediaText;
+  }
+
   if (this._cssSheet) {
     // parse _domRule.selectorText on call to this.selectors
     this._selectors = null;
     this.line = this._cssSheet._cssLogic.domUtils.getRuleLine(this._domRule);
     this.source = this._cssSheet.shortSource + ":" + this.line;
+    if (this.mediaText) {
+      this.source += " @media " + this.mediaText;
+    }
     this.href = this._cssSheet.href;
     this.contentRule = this._cssSheet.contentSheet;
   } else if (aElement) {
@@ -1218,6 +1226,13 @@ function CssRule(aCssSheet, aDomRule, aElement)
 CssRule.prototype = {
   _passId: null,
 
+  mediaText: "",
+
+  get isMediaRule()
+  {
+    return !!this.mediaText;
+  },
+
   /**
    * Check if the parent stylesheet is allowed by the CssLogic.sourceFilter.
    *
diff --git a/browser/devtools/styleinspector/CssRuleView.jsm b/browser/devtools/styleinspector/CssRuleView.jsm
index 9d179a30dbe..26330951327 100644
--- a/browser/devtools/styleinspector/CssRuleView.jsm
+++ b/browser/devtools/styleinspector/CssRuleView.jsm
@@ -356,10 +356,20 @@ function Rule(aElementStyle, aOptions)
   this.style = aOptions.style || this.domRule.style;
   this.selectorText = aOptions.selectorText || this.domRule.selectorText;
   this.inherited = aOptions.inherited || null;
+
+  if (this.domRule) {
+    let parentRule = this.domRule.parentRule;
+    if (parentRule && parentRule.type == Ci.nsIDOMCSSRule.MEDIA_RULE) {
+      this.mediaText = parentRule.media.mediaText;
+    }
+  }
+
   this._getTextProperties();
 }
 
 Rule.prototype = {
+  mediaText: "",
+
   get title()
   {
     if (this._title) {
@@ -380,7 +390,7 @@ Rule.prototype = {
                                                            args, args.length);
     }
 
-    return this._title;
+    return this._title + (this.mediaText ? " @media " + this.mediaText : "");
   },
 
   /**
@@ -722,8 +732,26 @@ CssRuleView.prototype = {
     }.bind(this);
 
     this._createEditors();
+
+    // When creating a new property, we fake the normal property
+    // editor behavior (focusing a property's value after entering its
+    // name) by responding to the name's blur event, creating the
+    // value editor, and grabbing focus to the value editor.  But if
+    // focus has already moved to another document, we won't be able
+    // to move focus to the new editor.
+    // Create a focusable item at the end of the editors to catch these
+    // cases.
+    this._focusBackstop = createChild(this.element, "div", {
+      tabindex: 0,
+    });
+    this._backstopHandler = function() {
+      // If this item is actually focused long enough to get the focus
+      // event, allow focus to move on out of this document.
+      moveFocus(this.doc.defaultView, FOCUS_FORWARD);
+    }.bind(this);
+    this._focusBackstop.addEventListener("focus", this._backstopHandler, false);
   },
-  
+
   /**
    * Update the rules for the currently highlighted element.
    */
@@ -752,6 +780,12 @@ CssRuleView.prototype = {
     this._clearRules();
     this._viewedElement = null;
     this._elementStyle = null;
+
+    if (this._focusBackstop) {
+      this._focusBackstop.removeEventListener("focus", this._backstopHandler, false);
+      this._backstopHandler = null;
+      this._focusBackstop = null;
+    }
   },
 
   /**
@@ -835,7 +869,6 @@ RuleEditor.prototype = {
 
     this.openBrace = createChild(header, "span", {
       class: "ruleview-ruleopen",
-      tabindex: "0",
       textContent: " {"
     });
 
diff --git a/browser/devtools/styleinspector/test/Makefile.in b/browser/devtools/styleinspector/test/Makefile.in
index a313cb6b630..104a4a4f0f2 100644
--- a/browser/devtools/styleinspector/test/Makefile.in
+++ b/browser/devtools/styleinspector/test/Makefile.in
@@ -60,7 +60,10 @@ _BROWSER_TEST_FILES = \
   browser_ruleview_manipulation.js \
   browser_ruleview_override.js \
   browser_ruleview_ui.js \
+  browser_ruleview_focus.js \
   browser_bug705707_is_content_stylesheet.js \
+  browser_bug722196_property_view_media_queries.js \
+  browser_bug722196_rule_view_media_queries.js \
   browser_bug_592743_specificity.js \
   head.js \
   $(NULL)
@@ -74,6 +77,7 @@ _BROWSER_TEST_PAGES = \
   browser_bug705707_is_content_stylesheet_script.css \
   browser_bug705707_is_content_stylesheet.xul \
   browser_bug705707_is_content_stylesheet_xul.css \
+  browser_bug722196_identify_media_queries.html \
   $(NULL)
 
 libs:: $(_BROWSER_TEST_FILES)
diff --git a/browser/devtools/styleinspector/test/browser_bug722196_identify_media_queries.html b/browser/devtools/styleinspector/test/browser_bug722196_identify_media_queries.html
new file mode 100644
index 00000000000..1adb8bc7a73
--- /dev/null
+++ b/browser/devtools/styleinspector/test/browser_bug722196_identify_media_queries.html
@@ -0,0 +1,24 @@
+<html>
+<head>
+  <title>test</title>
+  <script type="application/javascript;version=1.7">
+
+  </script>
+  <style>
+    div {
+      width: 1000px;
+      height: 100px;
+      background-color: #f00;
+    }
+
+    @media screen and (min-width: 1px) {
+      div {
+        width: 200px;
+      }
+    }
+  </style>
+</head>
+<body>
+<div></div>
+</body>
+</html>
diff --git a/browser/devtools/styleinspector/test/browser_bug722196_property_view_media_queries.js b/browser/devtools/styleinspector/test/browser_bug722196_property_view_media_queries.js
new file mode 100644
index 00000000000..fa1602b23ec
--- /dev/null
+++ b/browser/devtools/styleinspector/test/browser_bug722196_property_view_media_queries.js
@@ -0,0 +1,68 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// Tests that we correctly display appropriate media query titles in the
+// property view.
+
+let doc;
+let stylePanel;
+
+const TEST_URI = "http://example.com/browser/browser/devtools/styleinspector/" +
+  "test/browser_bug722196_identify_media_queries.html";
+
+function test()
+{
+  waitForExplicitFinish();
+  addTab(TEST_URI);
+  browser.addEventListener("load", docLoaded, true);
+}
+
+function docLoaded()
+{
+  browser.removeEventListener("load", docLoaded, true);
+  doc = content.document;
+  stylePanel = new StyleInspector(window);
+  Services.obs.addObserver(checkSheets, "StyleInspector-opened", false);
+  stylePanel.createPanel(false, function() {
+    stylePanel.open(doc.body);
+  });
+}
+
+function checkSheets()
+{
+  Services.obs.removeObserver(checkSheets, "StyleInspector-opened", false);
+
+  ok(stylePanel.isOpen(), "style inspector is open");
+
+  var div = doc.querySelector("div");
+  ok(div, "captain, we have the div");
+
+  stylePanel.selectNode(div);
+
+  let cssLogic = stylePanel.cssLogic;
+  cssLogic.processMatchedSelectors();
+
+  let _strings = Services.strings
+    .createBundle("chrome://browser/locale/devtools/styleinspector.properties");
+
+  let inline = _strings.GetStringFromName("rule.sourceInline");
+
+  let source1 = inline + ":8";
+  let source2 = inline + ":15 @media screen and (min-width: 1px)";
+  is(cssLogic._matchedRules[0][0].source, source1,
+    "rule.source gives correct output for rule 1");
+  is(cssLogic._matchedRules[1][0].source, source2,
+    "rule.source gives correct output for rule 2");
+
+  Services.obs.addObserver(finishUp, "StyleInspector-closed", false);
+  stylePanel.close();
+}
+
+function finishUp()
+{
+  Services.obs.removeObserver(finishUp, "StyleInspector-closed", false);
+  doc = null;
+  gBrowser.removeCurrentTab();
+  finish();
+}
diff --git a/browser/devtools/styleinspector/test/browser_bug722196_rule_view_media_queries.js b/browser/devtools/styleinspector/test/browser_bug722196_rule_view_media_queries.js
new file mode 100644
index 00000000000..9ba647ce959
--- /dev/null
+++ b/browser/devtools/styleinspector/test/browser_bug722196_rule_view_media_queries.js
@@ -0,0 +1,55 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// Tests that we correctly display appropriate media query titles in the
+// rule view.
+
+let tempScope = {};
+Cu.import("resource:///modules/devtools/CssRuleView.jsm", tempScope);
+let _ElementStyle = tempScope._ElementStyle;
+let doc;
+
+const TEST_URI = "http://example.com/browser/browser/devtools/styleinspector/" +
+  "test/browser_bug722196_identify_media_queries.html";
+
+function test()
+{
+  waitForExplicitFinish();
+  addTab(TEST_URI);
+  browser.addEventListener("load", docLoaded, true);
+}
+
+function docLoaded()
+{
+  browser.removeEventListener("load", docLoaded, true);
+  doc = content.document;
+  checkSheets();
+}
+
+function checkSheets()
+{
+  var div = doc.querySelector("div");
+  ok(div, "captain, we have the div");
+
+  let elementStyle = new _ElementStyle(div);
+  is(elementStyle.rules.length, 3, "Should have 3 rules.");
+
+  let _strings = Services.strings
+    .createBundle("chrome://browser/locale/devtools/styleinspector.properties");
+
+  let inline = _strings.GetStringFromName("rule.sourceInline");
+
+  is(elementStyle.rules[0].title, inline, "check rule 0 title");
+  is(elementStyle.rules[1].title, inline +
+    ":15 @media screen and (min-width: 1px)", "check rule 1 title");
+  is(elementStyle.rules[2].title, inline + ":8", "check rule 2 title");
+  finishUp();
+}
+
+function finishUp()
+{
+  doc = null;
+  gBrowser.removeCurrentTab();
+  finish();
+}
diff --git a/browser/devtools/styleinspector/test/browser_ruleview_focus.js b/browser/devtools/styleinspector/test/browser_ruleview_focus.js
new file mode 100644
index 00000000000..188255e4b73
--- /dev/null
+++ b/browser/devtools/styleinspector/test/browser_ruleview_focus.js
@@ -0,0 +1,106 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// Test that focus doesn't leave the style editor when adding a property
+// (bug 719916)
+
+let doc;
+let stylePanel;
+
+function waitForRuleView(aCallback)
+{
+  if (InspectorUI.ruleView) {
+    aCallback();
+    return;
+  }
+
+  let ruleViewFrame = InspectorUI.getToolIframe(InspectorUI.ruleViewObject);
+  ruleViewFrame.addEventListener("load", function(evt) {
+    ruleViewFrame.removeEventListener(evt.type, arguments.callee, true);
+    executeSoon(function() {
+      aCallback();
+    });
+  }, true);
+}
+
+function waitForEditorFocus(aParent, aCallback)
+{
+  aParent.addEventListener("focus", function onFocus(evt) {
+    if (evt.target.inplaceEditor) {
+      aParent.removeEventListener("focus", onFocus, true);
+      let editor = evt.target.inplaceEditor;
+      executeSoon(function() {
+        aCallback(editor);
+      });
+    }
+  }, true);
+}
+
+function openRuleView()
+{
+  Services.obs.addObserver(function onOpened() {
+    Services.obs.removeObserver(onOpened,
+    InspectorUI.INSPECTOR_NOTIFICATIONS.OPENED, false);
+
+    // Highlight a node.
+    let node = content.document.getElementsByTagName("h1")[0];
+    InspectorUI.inspectNode(node);
+    InspectorUI.stopInspecting();
+
+    // Open the rule view sidebar.
+    waitForRuleView(testFocus);
+
+    InspectorUI.showSidebar();
+    InspectorUI.ruleButton.click();
+
+    testFocus();
+  }, InspectorUI.INSPECTOR_NOTIFICATIONS.OPENED, false);
+  InspectorUI.openInspectorUI();
+}
+
+function testFocus()
+{
+  let ruleViewFrame = InspectorUI.getToolIframe(InspectorUI.ruleViewObject);
+  let brace = ruleViewFrame.contentDocument.querySelectorAll(".ruleview-ruleclose")[0];
+  waitForEditorFocus(brace.parentNode, function onNewElement(aEditor) {
+    aEditor.input.value = "color";
+    waitForEditorFocus(brace.parentNode, function onEditingValue(aEditor) {
+      // If we actually get this focus we're ok.
+      ok(true, "We got focus.");
+      aEditor.input.value = "green";
+
+      // If we've retained focus, pressing return will start a new editor.
+      // If not, we'll wait here until we time out.
+      waitForEditorFocus(brace.parentNode, function onNewEditor(aEditor) {
+        aEditor.input.blur();
+        finishTest();
+      });
+      EventUtils.sendKey("return");
+    });
+    EventUtils.sendKey("return");
+  });
+
+  brace.focus();
+}
+
+function finishUp()
+{
+  doc = stylePanel = null;
+  gBrowser.removeCurrentTab();
+  finish();
+}
+
+function test()
+{
+  waitForExplicitFinish();
+  gBrowser.selectedTab = gBrowser.addTab();
+  gBrowser.selectedBrowser.addEventListener("load", function(evt) {
+    gBrowser.selectedBrowser.removeEventListener(evt.type, arguments.callee, true);
+    doc = content.document;
+    doc.title = "Rule View Test";
+    waitForFocus(openRuleView, content);
+  }, true);
+
+  content.location = "data:text/html,<h1>Some header text</h1>";
+}
diff --git a/browser/devtools/webconsole/GcliCommands.jsm b/browser/devtools/webconsole/GcliCommands.jsm
index 07dbf13d82d..92ba54fc773 100644
--- a/browser/devtools/webconsole/GcliCommands.jsm
+++ b/browser/devtools/webconsole/GcliCommands.jsm
@@ -20,6 +20,7 @@
  *
  * Contributor(s):
  *   Joe Walker <jwalker@mozilla.com> (original author)
+ *   Mihai Sucan <mihai.sucan@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -160,8 +161,6 @@ gcli.addCommand({
    }
 });
 
-let breakpoints = [];
-
 /**
  * 'break' command
  */
@@ -180,17 +179,25 @@ gcli.addCommand({
   description: gcli.lookup("breaklistDesc"),
   returnType: "html",
   exec: function(args, context) {
-    if (breakpoints.length === 0) {
+    let win = HUDService.currentContext();
+    let dbg = win.DebuggerUI.getDebugger(win.gBrowser.selectedTab);
+    if (!dbg) {
+      return gcli.lookup("breakaddDebuggerStopped");
+    }
+    let breakpoints = dbg.breakpoints;
+
+    if (Object.keys(breakpoints).length === 0) {
       return gcli.lookup("breaklistNone");
     }
 
     let reply = gcli.lookup("breaklistIntro");
     reply += "<ol>";
-    breakpoints.forEach(function(breakpoint) {
+    for each (let breakpoint in breakpoints) {
       let text = gcli.lookupFormat("breaklistLineEntry",
-                                   [breakpoint.file, breakpoint.line]);
+                                   [breakpoint.location.url,
+                                    breakpoint.location.line]);
       reply += "<li>" + text + "</li>";
-    });
+    };
     reply += "</ol>";
     return reply;
   }
@@ -248,14 +255,11 @@ gcli.addCommand({
     }
     var promise = context.createPromise();
     let position = { url: args.file, line: args.line };
-    dbg.activeThread.setBreakpoint(position, function(aResponse, aBpClient) {
-      if (aResponse.error) {
-        promise.resolve(gcli.lookupFormat("breakaddFailed",
-                        [ aResponse.error ]));
+    dbg.addBreakpoint(position, function(aBreakpoint, aError) {
+      if (aError) {
+        promise.resolve(gcli.lookupFormat("breakaddFailed", [aError]));
         return;
       }
-      args.client = aBpClient;
-      breakpoints.push(args);
       promise.resolve(gcli.lookup("breakaddAdded"));
     });
     return promise;
@@ -275,19 +279,37 @@ gcli.addCommand({
       type: {
         name: "number",
         min: 0,
-        max: function() { return breakpoints.length - 1; }
+        max: function() {
+          let win = HUDService.currentContext();
+          let dbg = win.DebuggerUI.getDebugger(win.gBrowser.selectedTab);
+          if (!dbg) {
+            return gcli.lookup("breakaddDebuggerStopped");
+          }
+          return Object.keys(dbg.breakpoints).length - 1;
+        },
       },
       description: gcli.lookup("breakdelBreakidDesc")
     }
   ],
   returnType: "html",
   exec: function(args, context) {
-    let breakpoint = breakpoints.splice(args.breakid, 1)[0];
-    var promise = context.createPromise();
+    let win = HUDService.currentContext();
+    let dbg = win.DebuggerUI.getDebugger(win.gBrowser.selectedTab);
+    if (!dbg) {
+      return gcli.lookup("breakaddDebuggerStopped");
+    }
+
+    let breakpoints = dbg.breakpoints;
+    let id = Object.keys(dbg.breakpoints)[args.breakid];
+    if (!id || !(id in breakpoints)) {
+      return gcli.lookup("breakNotFound");
+    }
+
+    let promise = context.createPromise();
     try {
-      breakpoint.client.remove(function(aResponse) {
-                                 promise.resolve(gcli.lookup("breakdelRemoved"));
-                               });
+      dbg.removeBreakpoint(breakpoints[id], function() {
+        promise.resolve(gcli.lookup("breakdelRemoved"));
+      });
     } catch (ex) {
       // If the debugger has been closed already, don't scare the user.
       promise.resolve(gcli.lookup("breakdelRemoved"));
diff --git a/browser/locales/en-US/chrome/browser/devtools/gclicommands.properties b/browser/locales/en-US/chrome/browser/devtools/gclicommands.properties
index e5fd687186e..52bda769868 100644
--- a/browser/locales/en-US/chrome/browser/devtools/gclicommands.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/gclicommands.properties
@@ -255,6 +255,10 @@ breakdelBreakidDesc=Index of breakpoint
 # command to explain that a breakpoint was removed.
 breakdelRemoved=Breakpoint removed
 
+# LOCALIZATION NOTE (breakNotFound) Used in the output of the 'break del'
+# command to explain that the breakpoint was not found.
+breakNotFound=Breakpoint was not found
+
 # LOCALIZATION NOTE (consolecloseDesc) A very short description of the
 # 'console close' command. This string is designed to be shown in a menu
 # alongside the command name, which is why it should be as short as possible.
diff --git a/browser/makefiles.sh b/browser/makefiles.sh
index d76045f8cfa..663e677165d 100644
--- a/browser/makefiles.sh
+++ b/browser/makefiles.sh
@@ -139,6 +139,7 @@ if [ "$ENABLE_TESTS" ]; then
     browser/components/shell/test/Makefile
     browser/components/feeds/test/Makefile
     browser/components/feeds/test/chrome/Makefile
+    browser/components/migration/tests/Makefile
     browser/components/places/tests/Makefile
     browser/components/places/tests/chrome/Makefile
     browser/components/places/tests/browser/Makefile
diff --git a/browser/modules/NewTabUtils.jsm b/browser/modules/NewTabUtils.jsm
index 549c64434b2..072b970a370 100644
--- a/browser/modules/NewTabUtils.jsm
+++ b/browser/modules/NewTabUtils.jsm
@@ -121,8 +121,6 @@ let Storage = {
       // want any data from private browsing to show up.
       PinnedLinks.resetCache();
       BlockedLinks.resetCache();
-
-      Pages.update();
     }
   },
 
@@ -187,11 +185,6 @@ let AllPages = {
    */
   _pages: [],
 
-  /**
-   * Tells whether we already added a preference observer.
-   */
-  _observing: false,
-
   /**
    * Cached value that tells whether the New Tab Page feature is enabled.
    */
@@ -203,12 +196,7 @@ let AllPages = {
    */
   register: function AllPages_register(aPage) {
     this._pages.push(aPage);
-
-    // Add the preference observer if we haven't already.
-    if (!this._observing) {
-      this._observing = true;
-      Services.prefs.addObserver(PREF_NEWTAB_ENABLED, this, true);
-    }
+    this._addObserver();
   },
 
   /**
@@ -238,6 +226,14 @@ let AllPages = {
       Services.prefs.setBoolPref(PREF_NEWTAB_ENABLED, !!aEnabled);
   },
 
+  /**
+   * Returns the number of registered New Tab Pages (i.e. the number of open
+   * about:newtab instances).
+   */
+  get length() {
+    return this._pages.length;
+  },
+
   /**
    * Updates all currently active pages but the given one.
    * @param aExceptPage The page to exclude from updating.
@@ -264,6 +260,15 @@ let AllPages = {
     }, this);
   },
 
+  /**
+   * Adds a preference observer and turns itself into a no-op after the first
+   * invokation.
+   */
+  _addObserver: function AllPages_addObserver() {
+    Services.prefs.addObserver(PREF_NEWTAB_ENABLED, this, true);
+    this._addObserver = function () {};
+  },
+
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver,
                                          Ci.nsISupportsWeakReference])
 };
@@ -512,6 +517,8 @@ let Links = {
         this._links = aLinks;
         executeCallbacks();
       }.bind(this));
+
+      this._addObserver();
     }
   },
 
@@ -544,7 +551,32 @@ let Links = {
    */
   resetCache: function Links_resetCache() {
     this._links = [];
-  }
+  },
+
+  /**
+   * Implements the nsIObserver interface to get notified about browser history
+   * sanitization.
+   */
+  observe: function Links_observe(aSubject, aTopic, aData) {
+    // Make sure to update open about:newtab instances. If there are no opened
+    // pages we can just wait for the next new tab to populate the cache again.
+    if (AllPages.length && AllPages.enabled)
+      this.populateCache(function () { AllPages.update() }, true);
+    else
+      this._links = null;
+  },
+
+  /**
+   * Adds a sanitization observer and turns itself into a no-op after the first
+   * invokation.
+   */
+  _addObserver: function Links_addObserver() {
+    Services.obs.addObserver(this, "browser:purge-session-history", true);
+    this._addObserver = function () {};
+  },
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver,
+                                         Ci.nsISupportsWeakReference])
 };
 
 /**
diff --git a/browser/themes/gnomestripe/aboutCertError.css b/browser/themes/gnomestripe/aboutCertError.css
index e0d9e9b9347..17343b1c782 100644
--- a/browser/themes/gnomestripe/aboutCertError.css
+++ b/browser/themes/gnomestripe/aboutCertError.css
@@ -86,21 +86,24 @@ body[dir="rtl"] #errorPageContainer {
   -moz-margin-start: 80px;
 }
 
-#technicalContent > h2, #expertContent > h2 {
-  background : url("chrome://browser/skin/section_expanded.png") left 0 no-repeat;
+.expander > button {
+  -moz-padding-start: 20px;
+  -moz-margin-start: -20px;
+  background: url("chrome://browser/skin/aboutCertError_sectionExpanded.png") left center no-repeat;
+  border: none;
+  font: inherit;
+  color: inherit;
+  cursor: pointer;
 }
 
-body[dir="rtl"] #technicalContent > h2,
-body[dir="rtl"] #expertContent > h2 {
-  background-position: right 0;
+body[dir="rtl"] .expander > button {
+  background-position: right center;
 }
 
-#technicalContent[collapsed] > h2,
-#expertContent[collapsed] > h2{
-  background-image: url("chrome://browser/skin/section_collapsed.png");
+.expander[collapsed] > button {
+  background-image: url("chrome://browser/skin/aboutCertError_sectionCollapsed.png");
 }
 
-body[dir="rtl"] #technicalContent[collapsed] > h2,
-body[dir="rtl"] #expertContent[collapsed] > h2 {
-  background-image: url("chrome://browser/skin/section_collapsed-rtl.png");
+body[dir="rtl"] .expander[collapsed] > button {
+  background-image: url("chrome://browser/skin/aboutCertError_sectionCollapsed-rtl.png");
 }
diff --git a/browser/themes/gnomestripe/section_collapsed-rtl.png b/browser/themes/gnomestripe/aboutCertError_sectionCollapsed-rtl.png
similarity index 100%
rename from browser/themes/gnomestripe/section_collapsed-rtl.png
rename to browser/themes/gnomestripe/aboutCertError_sectionCollapsed-rtl.png
diff --git a/browser/themes/gnomestripe/section_collapsed.png b/browser/themes/gnomestripe/aboutCertError_sectionCollapsed.png
similarity index 100%
rename from browser/themes/gnomestripe/section_collapsed.png
rename to browser/themes/gnomestripe/aboutCertError_sectionCollapsed.png
diff --git a/browser/themes/gnomestripe/section_expanded.png b/browser/themes/gnomestripe/aboutCertError_sectionExpanded.png
similarity index 100%
rename from browser/themes/gnomestripe/section_expanded.png
rename to browser/themes/gnomestripe/aboutCertError_sectionExpanded.png
diff --git a/browser/themes/gnomestripe/devtools/csshtmltree.css b/browser/themes/gnomestripe/devtools/csshtmltree.css
index 738130a17f5..0ee9c461260 100644
--- a/browser/themes/gnomestripe/devtools/csshtmltree.css
+++ b/browser/themes/gnomestripe/devtools/csshtmltree.css
@@ -146,6 +146,7 @@
   direction: ltr;
   padding: 0;
   -moz-padding-start: 20px;
+  vertical-align: text-bottom;
 }
 
 .bestmatch {
diff --git a/browser/themes/gnomestripe/fullscreen-video.css b/browser/themes/gnomestripe/fullscreen-video.css
deleted file mode 100644
index 2a090def7d3..00000000000
--- a/browser/themes/gnomestripe/fullscreen-video.css
+++ /dev/null
@@ -1,8 +0,0 @@
-#close {
-  position: absolute;
-  top: 0;
-  right: 0;
-  width: 32px;
-  height: 32px;
-  background: url(KUI-close.png) center center no-repeat;
-}
diff --git a/browser/themes/gnomestripe/jar.mn b/browser/themes/gnomestripe/jar.mn
index 2772429a8e1..aaabfdde100 100644
--- a/browser/themes/gnomestripe/jar.mn
+++ b/browser/themes/gnomestripe/jar.mn
@@ -5,14 +5,16 @@ browser.jar:
 * skin/classic/browser/aboutPrivateBrowsing.css             (aboutPrivateBrowsing.css)
 * skin/classic/browser/aboutSessionRestore.css        (aboutSessionRestore.css)
   skin/classic/browser/aboutSessionRestore-window-icon.png
-  skin/classic/browser/aboutCertError.css             (aboutCertError.css)
+  skin/classic/browser/aboutCertError.css
+  skin/classic/browser/aboutCertError_sectionCollapsed.png
+  skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
+  skin/classic/browser/aboutCertError_sectionExpanded.png
 #ifdef MOZ_SERVICES_SYNC
   skin/classic/browser/aboutSyncTabs.css
 #endif
   skin/classic/browser/actionicon-tab.png
 * skin/classic/browser/browser.css                    (browser.css)
 * skin/classic/browser/engineManager.css              (engineManager.css)
-  skin/classic/browser/fullscreen-video.css
   skin/classic/browser/Geolocation-16.png
   skin/classic/browser/Geolocation-64.png
   skin/classic/browser/Go-arrow.png
@@ -27,9 +29,6 @@ browser.jar:
   skin/classic/browser/Privacy-16.png
   skin/classic/browser/Privacy-48.png
   skin/classic/browser/searchbar.css                  (searchbar.css)
-  skin/classic/browser/section_collapsed.png
-  skin/classic/browser/section_collapsed-rtl.png
-  skin/classic/browser/section_expanded.png
   skin/classic/browser/Secure.png
   skin/classic/browser/Security-broken.png
   skin/classic/browser/setDesktopBackground.css
diff --git a/browser/themes/pinstripe/aboutCertError.css b/browser/themes/pinstripe/aboutCertError.css
index e0d9e9b9347..17343b1c782 100644
--- a/browser/themes/pinstripe/aboutCertError.css
+++ b/browser/themes/pinstripe/aboutCertError.css
@@ -86,21 +86,24 @@ body[dir="rtl"] #errorPageContainer {
   -moz-margin-start: 80px;
 }
 
-#technicalContent > h2, #expertContent > h2 {
-  background : url("chrome://browser/skin/section_expanded.png") left 0 no-repeat;
+.expander > button {
+  -moz-padding-start: 20px;
+  -moz-margin-start: -20px;
+  background: url("chrome://browser/skin/aboutCertError_sectionExpanded.png") left center no-repeat;
+  border: none;
+  font: inherit;
+  color: inherit;
+  cursor: pointer;
 }
 
-body[dir="rtl"] #technicalContent > h2,
-body[dir="rtl"] #expertContent > h2 {
-  background-position: right 0;
+body[dir="rtl"] .expander > button {
+  background-position: right center;
 }
 
-#technicalContent[collapsed] > h2,
-#expertContent[collapsed] > h2{
-  background-image: url("chrome://browser/skin/section_collapsed.png");
+.expander[collapsed] > button {
+  background-image: url("chrome://browser/skin/aboutCertError_sectionCollapsed.png");
 }
 
-body[dir="rtl"] #technicalContent[collapsed] > h2,
-body[dir="rtl"] #expertContent[collapsed] > h2 {
-  background-image: url("chrome://browser/skin/section_collapsed-rtl.png");
+body[dir="rtl"] .expander[collapsed] > button {
+  background-image: url("chrome://browser/skin/aboutCertError_sectionCollapsed-rtl.png");
 }
diff --git a/browser/themes/pinstripe/section_collapsed-rtl.png b/browser/themes/pinstripe/aboutCertError_sectionCollapsed-rtl.png
similarity index 100%
rename from browser/themes/pinstripe/section_collapsed-rtl.png
rename to browser/themes/pinstripe/aboutCertError_sectionCollapsed-rtl.png
diff --git a/browser/themes/pinstripe/section_collapsed.png b/browser/themes/pinstripe/aboutCertError_sectionCollapsed.png
similarity index 100%
rename from browser/themes/pinstripe/section_collapsed.png
rename to browser/themes/pinstripe/aboutCertError_sectionCollapsed.png
diff --git a/browser/themes/pinstripe/section_expanded.png b/browser/themes/pinstripe/aboutCertError_sectionExpanded.png
similarity index 100%
rename from browser/themes/pinstripe/section_expanded.png
rename to browser/themes/pinstripe/aboutCertError_sectionExpanded.png
diff --git a/browser/themes/pinstripe/devtools/csshtmltree.css b/browser/themes/pinstripe/devtools/csshtmltree.css
index 8593a585845..e40f46af724 100644
--- a/browser/themes/pinstripe/devtools/csshtmltree.css
+++ b/browser/themes/pinstripe/devtools/csshtmltree.css
@@ -148,6 +148,7 @@
   direction: ltr;
   padding: 0;
   -moz-padding-start: 20px;
+  vertical-align: text-bottom;
 }
 
 .bestmatch {
diff --git a/browser/themes/pinstripe/fullscreen-video.css b/browser/themes/pinstripe/fullscreen-video.css
deleted file mode 100644
index ee39ad1bf67..00000000000
--- a/browser/themes/pinstripe/fullscreen-video.css
+++ /dev/null
@@ -1,8 +0,0 @@
-#close {
-  position: absolute;
-  top: 0;
-  left: 0;
-  width: 32px;
-  height: 32px;
-  background: url(KUI-close.png) center center no-repeat;
-}
diff --git a/browser/themes/pinstripe/jar.mn b/browser/themes/pinstripe/jar.mn
index dec60186dec..95987071c55 100644
--- a/browser/themes/pinstripe/jar.mn
+++ b/browser/themes/pinstripe/jar.mn
@@ -4,14 +4,16 @@ browser.jar:
 * skin/classic/browser/aboutPrivateBrowsing.css             (aboutPrivateBrowsing.css)
 * skin/classic/browser/aboutSessionRestore.css              (aboutSessionRestore.css)
   skin/classic/browser/aboutSessionRestore-window-icon.png
-  skin/classic/browser/aboutCertError.css                   (aboutCertError.css)
+  skin/classic/browser/aboutCertError.css
+  skin/classic/browser/aboutCertError_sectionCollapsed.png
+  skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
+  skin/classic/browser/aboutCertError_sectionExpanded.png
 #ifdef MOZ_SERVICES_SYNC
   skin/classic/browser/aboutSyncTabs.css
 #endif
   skin/classic/browser/actionicon-tab.png
 * skin/classic/browser/browser.css                          (browser.css)
 * skin/classic/browser/engineManager.css                    (engineManager.css)
-  skin/classic/browser/fullscreen-video.css
   skin/classic/browser/Geolocation-16.png
   skin/classic/browser/Geolocation-64.png
   skin/classic/browser/home.png
@@ -36,9 +38,6 @@ browser.jar:
   skin/classic/browser/searchbar-dropmarker.png
   skin/classic/browser/searchbar.css
   skin/classic/browser/Search.png
-  skin/classic/browser/section_collapsed.png
-  skin/classic/browser/section_collapsed-rtl.png
-  skin/classic/browser/section_expanded.png
   skin/classic/browser/Secure-Glyph-White.png
   skin/classic/browser/keyhole-circle.png
   skin/classic/browser/Toolbar.png
diff --git a/browser/themes/winstripe/aboutCertError.css b/browser/themes/winstripe/aboutCertError.css
index f67a7b9590b..17343b1c782 100644
--- a/browser/themes/winstripe/aboutCertError.css
+++ b/browser/themes/winstripe/aboutCertError.css
@@ -86,21 +86,24 @@ body[dir="rtl"] #errorPageContainer {
   -moz-margin-start: 80px;
 }
 
-#technicalContent > h2, #expertContent > h2 {
-  background : url("chrome://browser/skin/section_expanded.png") left center no-repeat;
+.expander > button {
+  -moz-padding-start: 20px;
+  -moz-margin-start: -20px;
+  background: url("chrome://browser/skin/aboutCertError_sectionExpanded.png") left center no-repeat;
+  border: none;
+  font: inherit;
+  color: inherit;
+  cursor: pointer;
 }
 
-body[dir="rtl"] #technicalContent > h2,
-body[dir="rtl"] #expertContent > h2 {
+body[dir="rtl"] .expander > button {
   background-position: right center;
 }
 
-#technicalContent[collapsed] > h2,
-#expertContent[collapsed] > h2{
-  background-image: url("chrome://browser/skin/section_collapsed.png");
+.expander[collapsed] > button {
+  background-image: url("chrome://browser/skin/aboutCertError_sectionCollapsed.png");
 }
 
-body[dir="rtl"] #technicalContent[collapsed] > h2,
-body[dir="rtl"] #expertContent[collapsed] > h2 {
-  background-image: url("chrome://browser/skin/section_collapsed-rtl.png");
+body[dir="rtl"] .expander[collapsed] > button {
+  background-image: url("chrome://browser/skin/aboutCertError_sectionCollapsed-rtl.png");
 }
diff --git a/browser/themes/winstripe/section_collapsed-rtl.png b/browser/themes/winstripe/aboutCertError_sectionCollapsed-rtl.png
similarity index 100%
rename from browser/themes/winstripe/section_collapsed-rtl.png
rename to browser/themes/winstripe/aboutCertError_sectionCollapsed-rtl.png
diff --git a/browser/themes/winstripe/section_collapsed.png b/browser/themes/winstripe/aboutCertError_sectionCollapsed.png
similarity index 100%
rename from browser/themes/winstripe/section_collapsed.png
rename to browser/themes/winstripe/aboutCertError_sectionCollapsed.png
diff --git a/browser/themes/winstripe/section_expanded.png b/browser/themes/winstripe/aboutCertError_sectionExpanded.png
similarity index 100%
rename from browser/themes/winstripe/section_expanded.png
rename to browser/themes/winstripe/aboutCertError_sectionExpanded.png
diff --git a/browser/themes/winstripe/devtools/csshtmltree.css b/browser/themes/winstripe/devtools/csshtmltree.css
index 3448e8f6076..42dce67568c 100644
--- a/browser/themes/winstripe/devtools/csshtmltree.css
+++ b/browser/themes/winstripe/devtools/csshtmltree.css
@@ -146,6 +146,7 @@
   direction: ltr;
   padding: 0;
   -moz-padding-start: 20px;
+  vertical-align: text-bottom;
 }
 
 .bestmatch {
diff --git a/browser/themes/winstripe/fullscreen-video.css b/browser/themes/winstripe/fullscreen-video.css
deleted file mode 100644
index 2a090def7d3..00000000000
--- a/browser/themes/winstripe/fullscreen-video.css
+++ /dev/null
@@ -1,8 +0,0 @@
-#close {
-  position: absolute;
-  top: 0;
-  right: 0;
-  width: 32px;
-  height: 32px;
-  background: url(KUI-close.png) center center no-repeat;
-}
diff --git a/browser/themes/winstripe/jar.mn b/browser/themes/winstripe/jar.mn
index 83c61045eda..e5d860334d2 100644
--- a/browser/themes/winstripe/jar.mn
+++ b/browser/themes/winstripe/jar.mn
@@ -7,7 +7,10 @@ browser.jar:
 *       skin/classic/browser/aboutPrivateBrowsing.css                (aboutPrivateBrowsing.css)
 *       skin/classic/browser/aboutSessionRestore.css                 (aboutSessionRestore.css)
         skin/classic/browser/aboutSessionRestore-window-icon.png     (preferences/application.png)
-        skin/classic/browser/aboutCertError.css                      (aboutCertError.css)
+        skin/classic/browser/aboutCertError.css
+        skin/classic/browser/aboutCertError_sectionCollapsed.png
+        skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
+        skin/classic/browser/aboutCertError_sectionExpanded.png
 #ifdef MOZ_SERVICES_SYNC
         skin/classic/browser/aboutSyncTabs.css
 #endif
@@ -16,7 +19,6 @@ browser.jar:
         skin/classic/browser/appmenu-dropmarker.png
 *       skin/classic/browser/browser.css                             (browser.css)
 *       skin/classic/browser/engineManager.css                       (engineManager.css)
-        skin/classic/browser/fullscreen-video.css
         skin/classic/browser/Geolocation-16.png
         skin/classic/browser/Geolocation-64.png
         skin/classic/browser/Info.png                                (Info.png)
@@ -38,9 +40,6 @@ browser.jar:
         skin/classic/browser/toolbarbutton-dropdown-arrow-inverted.png
 *       skin/classic/browser/searchbar.css                           (searchbar.css)
         skin/classic/browser/searchbar-dropdown-arrow.png
-        skin/classic/browser/section_collapsed.png
-        skin/classic/browser/section_collapsed-rtl.png
-        skin/classic/browser/section_expanded.png
         skin/classic/browser/setDesktopBackground.css
         skin/classic/browser/menu-back.png                           (menu-back.png)
         skin/classic/browser/menu-forward.png                        (menu-forward.png)
@@ -177,7 +176,10 @@ browser.jar:
 *       skin/classic/aero/browser/aboutPrivateBrowsing.css           (aboutPrivateBrowsing.css)
 *       skin/classic/aero/browser/aboutSessionRestore.css            (aboutSessionRestore.css)
         skin/classic/aero/browser/aboutSessionRestore-window-icon.png (aboutSessionRestore-window-icon-aero.png)
-        skin/classic/aero/browser/aboutCertError.css                 (aboutCertError.css)
+        skin/classic/aero/browser/aboutCertError.css
+        skin/classic/aero/browser/aboutCertError_sectionCollapsed.png
+        skin/classic/aero/browser/aboutCertError_sectionCollapsed-rtl.png
+        skin/classic/aero/browser/aboutCertError_sectionExpanded.png
 #ifdef MOZ_SERVICES_SYNC
         skin/classic/aero/browser/aboutSyncTabs.css
 #endif
@@ -186,7 +188,6 @@ browser.jar:
         skin/classic/aero/browser/appmenu-icons.png
 *       skin/classic/aero/browser/browser.css                        (browser-aero.css)
 *       skin/classic/aero/browser/engineManager.css                  (engineManager.css)
-        skin/classic/aero/browser/fullscreen-video.css
         skin/classic/aero/browser/Geolocation-16.png
         skin/classic/aero/browser/Geolocation-64.png
         skin/classic/aero/browser/Info.png                           (Info-aero.png)
@@ -208,9 +209,6 @@ browser.jar:
         skin/classic/aero/browser/toolbarbutton-dropdown-arrow-inverted.png
 *       skin/classic/aero/browser/searchbar.css                      (searchbar.css)
         skin/classic/aero/browser/searchbar-dropdown-arrow.png       (searchbar-dropdown-arrow-aero.png)
-        skin/classic/aero/browser/section_collapsed.png
-        skin/classic/aero/browser/section_collapsed-rtl.png
-        skin/classic/aero/browser/section_expanded.png
         skin/classic/aero/browser/setDesktopBackground.css
         skin/classic/aero/browser/menu-back.png                      (menu-back-aero.png)
         skin/classic/aero/browser/menu-forward.png                   (menu-forward-aero.png)
diff --git a/build/unix/check_debug_ranges.py b/build/autoconf/check_debug_ranges.py
similarity index 100%
rename from build/unix/check_debug_ranges.py
rename to build/autoconf/check_debug_ranges.py
diff --git a/build/autoconf/compiler-opts.m4 b/build/autoconf/compiler-opts.m4
index 081d8e4f5d8..e4f75b0eee1 100644
--- a/build/autoconf/compiler-opts.m4
+++ b/build/autoconf/compiler-opts.m4
@@ -9,5 +9,76 @@ if test "$CLANG_CXX"; then
     ## from C.
     _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-unknown-warning-option -Wno-return-type-c-linkage"
 fi
-])
 
+if test "$GNU_CC"; then
+    CFLAGS="$CFLAGS -ffunction-sections -fdata-sections"
+    CXXFLAGS="$CXXFLAGS -ffunction-sections -fdata-sections"
+fi
+
+dnl ========================================================
+dnl = Identical Code Folding
+dnl ========================================================
+
+MOZ_ARG_DISABLE_BOOL(icf,
+[  --disable-icf          Disable Identical Code Folding],
+    MOZ_DISABLE_ICF=1,
+    MOZ_DISABLE_ICF= )
+
+if test "$GNU_CC" -a "$GCC_USE_GNU_LD" -a -z "$MOZ_DISABLE_ICF"; then
+    AC_CACHE_CHECK([whether the linker supports Identical Code Folding],
+        LD_SUPPORTS_ICF,
+        [echo 'int foo() {return 42;}' \
+              'int bar() {return 42;}' \
+              'int main() {return foo() - bar();}' > conftest.${ac_ext}
+        # If the linker supports ICF, foo and bar symbols will have
+        # the same address
+        if AC_TRY_COMMAND([${CC-cc} -o conftest${ac_exeext} $LDFLAGS -Wl,--icf=safe -ffunction-sections conftest.${ac_ext} $LIBS 1>&2]) &&
+           test -s conftest${ac_exeext} &&
+           objdump -t conftest${ac_exeext} | awk changequote(<<, >>)'{a[<<$>>6] = <<$>>1} END {if (a["foo"] && (a["foo"] != a["bar"])) { exit 1 }}'changequote([, ]); then
+            LD_SUPPORTS_ICF=yes
+        else
+            LD_SUPPORTS_ICF=no
+        fi
+        rm -rf conftest*])
+    if test "$LD_SUPPORTS_ICF" = yes; then
+        _SAVE_LDFLAGS="$LDFLAGS -Wl,--icf=safe"
+        LDFLAGS="$LDFLAGS -Wl,--icf=safe -Wl,--print-icf-sections"
+        AC_TRY_LINK([], [],
+                    [LD_PRINT_ICF_SECTIONS=-Wl,--print-icf-sections],
+                    [LD_PRINT_ICF_SECTIONS=])
+        AC_SUBST([LD_PRINT_ICF_SECTIONS])
+        LDFLAGS="$_SAVE_LDFLAGS"
+    fi
+fi
+
+dnl ========================================================
+dnl = Automatically remove dead symbols
+dnl ========================================================
+
+if test "$GNU_CC" -a "$GCC_USE_GNU_LD" -a -n "$MOZ_DEBUG_FLAGS"; then
+   dnl See bug 670659
+   AC_CACHE_CHECK([whether removing dead symbols breaks debugging],
+       GC_SECTIONS_BREAKS_DEBUG_RANGES,
+       [echo 'int foo() {return 42;}' \
+             'int bar() {return 1;}' \
+             'int main() {return foo();}' > conftest.${ac_ext}
+        if AC_TRY_COMMAND([${CC-cc} -o conftest.${ac_objext} $CFLAGS $MOZ_DEBUG_FLAGS -c conftest.${ac_ext} 1>&2]) &&
+           AC_TRY_COMMAND([${CC-cc} -o conftest${ac_exeext} $LDFLAGS $MOZ_DEBUG_FLAGS -Wl,--gc-sections conftest.${ac_objext} $LIBS 1>&2]) &&
+           test -s conftest${ac_exeext} -a -s conftest.${ac_objext}; then
+            if test "`$PYTHON "$_topsrcdir"/build/autoconf/check_debug_ranges.py conftest.${ac_objext} conftest.${ac_ext}`" = \
+                    "`$PYTHON "$_topsrcdir"/build/autoconf/check_debug_ranges.py conftest${ac_exeext} conftest.${ac_ext}`"; then
+                GC_SECTIONS_BREAKS_DEBUG_RANGES=no
+            else
+                GC_SECTIONS_BREAKS_DEBUG_RANGES=yes
+            fi
+        else
+             dnl We really don't expect to get here, but just in case
+             GC_SECTIONS_BREAKS_DEBUG_RANGES="no, but it's broken in some other way"
+        fi
+        rm -rf conftest*])
+    if test "$GC_SECTIONS_BREAKS_DEBUG_RANGES" = no; then
+        DSO_LDOPTS="$DSO_LDOPTS -Wl,--gc-sections"
+    fi
+fi
+
+])
diff --git a/build/autoconf/expandlibs.m4 b/build/autoconf/expandlibs.m4
new file mode 100644
index 00000000000..ef228abf708
--- /dev/null
+++ b/build/autoconf/expandlibs.m4
@@ -0,0 +1,56 @@
+AC_DEFUN([MOZ_EXPAND_LIBS],
+[
+dnl ========================================================
+dnl =
+dnl = Check what kind of list files are supported by the
+dnl = linker
+dnl =
+dnl ========================================================
+
+AC_CACHE_CHECK(what kind of list files are supported by the linker,
+    EXPAND_LIBS_LIST_STYLE,
+    [echo "int main() {return 0;}" > conftest.${ac_ext}
+     if AC_TRY_COMMAND(${CC-cc} -o conftest.${OBJ_SUFFIX} -c $CFLAGS $CPPFLAGS conftest.${ac_ext} 1>&5) && test -s conftest.${OBJ_SUFFIX}; then
+         echo "INPUT(conftest.${OBJ_SUFFIX})" > conftest.list
+         if AC_TRY_COMMAND(${CC-cc} -o conftest${ac_exeext} $LDFLAGS conftest.list $LIBS 1>&5) && test -s conftest${ac_exeext}; then
+             EXPAND_LIBS_LIST_STYLE=linkerscript
+         else
+             echo "conftest.${OBJ_SUFFIX}" > conftest.list
+             if AC_TRY_COMMAND(${CC-cc} -o conftest${ac_exeext} $LDFLAGS @conftest.list $LIBS 1>&5) && test -s conftest${ac_exeext}; then
+                 EXPAND_LIBS_LIST_STYLE=list
+             else
+                 EXPAND_LIBS_LIST_STYLE=none
+             fi
+         fi
+     else
+         dnl We really don't expect to get here, but just in case
+         AC_ERROR([couldn't compile a simple C file])
+     fi
+     rm -rf conftest*])
+
+LIBS_DESC_SUFFIX=desc
+AC_SUBST(LIBS_DESC_SUFFIX)
+AC_SUBST(EXPAND_LIBS_LIST_STYLE)
+
+if test "$GCC_USE_GNU_LD"; then
+    AC_CACHE_CHECK(what kind of ordering can be done with the linker,
+        EXPAND_LIBS_ORDER_STYLE,
+        [> conftest.order
+         _SAVE_LDFLAGS="$LDFLAGS"
+         LDFLAGS="${LDFLAGS} -Wl,--section-ordering-file,conftest.order"
+         AC_TRY_LINK([], [],
+             EXPAND_LIBS_ORDER_STYLE=section-ordering-file,
+             EXPAND_LIBS_ORDER_STYLE=)
+         LDFLAGS="$_SAVE_LDFLAGS"
+         if test -z "$EXPAND_LIBS_ORDER_STYLE"; then
+             if AC_TRY_COMMAND(${CC-cc} ${DSO_LDOPTS} ${LDFLAGS} -o ${DLL_PREFIX}conftest${DLL_SUFFIX} -Wl,--verbose 2> /dev/null | sed -n '/^===/,/^===/p' | grep '\.text'); then
+                 EXPAND_LIBS_ORDER_STYLE=linkerscript
+             else
+                 EXPAND_LIBS_ORDER_STYLE=none
+             fi
+             rm -f ${DLL_PREFIX}conftest${DLL_SUFFIX}
+         fi])
+fi
+AC_SUBST(EXPAND_LIBS_ORDER_STYLE)
+
+])
diff --git a/build/automation.py.in b/build/automation.py.in
index ca9c8ce4c33..5b4a5272aed 100644
--- a/build/automation.py.in
+++ b/build/automation.py.in
@@ -395,6 +395,7 @@ user_pref("browser.safebrowsing.provider.0.keyURL", "http://%(server)s/safebrows
 user_pref("browser.safebrowsing.provider.0.updateURL", "http://%(server)s/safebrowsing-dummy/update");
 // Point update checks to the local testing server for fast failures
 user_pref("extensions.update.url", "http://%(server)s/extensions-dummy/updateURL");
+user_pref("extensions.update.background.url", "http://%(server)s/extensions-dummy/updateBackgroundURL");
 user_pref("extensions.blocklist.url", "http://%(server)s/extensions-dummy/blocklistURL");
 user_pref("extensions.hotfix.url", "http://%(server)s/extensions-dummy/hotfixURL");
 // Make sure opening about:addons won't hit the network
@@ -737,8 +738,11 @@ user_pref("camino.use_system_proxy_settings", false); // Camino-only, harmless t
 
   def killAndGetStack(self, proc, utilityPath, debuggerInfo):
     """Kill the process, preferrably in a way that gets us a stack trace."""
-    if not debuggerInfo and not self.haveDumpedScreen:
-      self.dumpScreen(utilityPath)
+    if not debuggerInfo:
+      if self.haveDumpedScreen:
+        self.log.info("Not taking screenshot here: see the one that was previously logged")
+      else:
+        self.dumpScreen(utilityPath)
 
     if self.CRASHREPORTER and not debuggerInfo:
       if self.UNIXISH:
@@ -795,8 +799,11 @@ user_pref("camino.use_system_proxy_settings", false); // Camino-only, harmless t
         if stackFixerFunction:
           line = stackFixerFunction(line)
         self.log.info(line.rstrip().decode("UTF-8", "ignore"))
-        if not debuggerInfo and not self.haveDumpedScreen and "TEST-UNEXPECTED-FAIL" in line and "Test timed out" in line:
-          self.dumpScreen(utilityPath)
+        if not debuggerInfo and "TEST-UNEXPECTED-FAIL" in line and "Test timed out" in line:
+          if self.haveDumpedScreen:
+            self.log.info("Not taking screenshot here: see the one that was previously logged")
+          else:
+            self.dumpScreen(utilityPath)
 
         (line, didTimeout) = self.readWithTimeout(logsource, timeout)
         if not hitMaxTime and maxTime and datetime.now() - startTime > timedelta(seconds = maxTime):
diff --git a/build/automationutils.py b/build/automationutils.py
index c8067bd0347..fa72bdc0d1a 100644
--- a/build/automationutils.py
+++ b/build/automationutils.py
@@ -459,7 +459,7 @@ class ShutdownLeakLogger(object):
   DOM windows (that are still around after test suite shutdown, despite running
   the GC) to the tests that created them and prints leak statistics.
   """
-  MAX_LEAK_COUNT = 123
+  MAX_LEAK_COUNT = 120
 
   def __init__(self, logger):
     self.logger = logger
diff --git a/build/mobile/robocop/Makefile.in b/build/mobile/robocop/Makefile.in
index 47e3aca33d8..6488befce41 100644
--- a/build/mobile/robocop/Makefile.in
+++ b/build/mobile/robocop/Makefile.in
@@ -66,7 +66,10 @@ _JAVA_HARNESS = \
 
 _JAVA_TESTS = $(patsubst $(TESTPATH)/%.in,%,$(wildcard $(TESTPATH)/*.java.in))
 
-_TEST_FILES = $(wildcard $(TESTPATH)/*.html)
+_TEST_FILES = \
+  $(wildcard $(TESTPATH)/*.html) \
+  $(wildcard $(TESTPATH)/*.sjs) \
+  $(NULL)
 
 _ROBOCOP_TOOLS = \
   $(TESTPATH)/robocop.ini \
diff --git a/caps/idl/nsIPrincipal.idl b/caps/idl/nsIPrincipal.idl
index 3a09ca8db51..cfc2bac4dfa 100644
--- a/caps/idl/nsIPrincipal.idl
+++ b/caps/idl/nsIPrincipal.idl
@@ -52,7 +52,7 @@ interface nsIContentSecurityPolicy;
 [ptr] native JSContext(JSContext);
 [ptr] native JSPrincipals(JSPrincipals);
 
-[scriptable, uuid(1f83b0e0-6b63-4bdc-a50a-b9afe256bd25)]
+[scriptable, uuid(f8c4c89a-d726-421b-8415-3e34b241175b)]
 interface nsIPrincipal : nsISerializable
 {
     /**
@@ -96,12 +96,6 @@ interface nsIPrincipal : nsISerializable
      */
     [noscript] readonly attribute unsigned long hashValue;
 
-    /**
-     * Returns the JS equivalent of the principal.
-     * @see JSPrincipals.h
-     */
-    [noscript] JSPrincipals getJSPrincipals(in JSContext cx);
-
     /**
      * The domain security policy of the principal.
      */
diff --git a/caps/include/nsJSPrincipals.h b/caps/include/nsJSPrincipals.h
index 782ac029294..f983532cecb 100644
--- a/caps/include/nsJSPrincipals.h
+++ b/caps/include/nsJSPrincipals.h
@@ -43,14 +43,47 @@
 
 class nsCString;
 
-struct nsJSPrincipals : JSPrincipals
+struct nsJSPrincipals : nsIPrincipal, JSPrincipals
 {
-  static nsresult Startup();
-  nsJSPrincipals();
-  nsresult Init(nsIPrincipal* aPrincipal, const nsCString& aCodebase);
-  ~nsJSPrincipals(void);
+  static JSBool Subsume(JSPrincipals *jsprin, JSPrincipals *other);
+  static void Destroy(JSPrincipals *jsprin);
+  static JSBool Transcode(JSXDRState *xdr, JSPrincipals **jsprinp);
 
-  nsIPrincipal *nsIPrincipalPtr; // [WEAK] it owns us.
+  /*
+   * Get a weak reference to nsIPrincipal associated with the given JS
+   * principal.
+   */
+  static nsJSPrincipals* get(JSPrincipals *principals) {
+    nsJSPrincipals *self = static_cast<nsJSPrincipals *>(principals);
+    MOZ_ASSERT_IF(self, self->debugToken == DEBUG_TOKEN);
+    return self;
+  }
+  
+  static nsJSPrincipals* get(nsIPrincipal *principal) {
+    nsJSPrincipals *self = static_cast<nsJSPrincipals *>(principal);
+    MOZ_ASSERT_IF(self, self->debugToken == DEBUG_TOKEN);
+    return self;
+  }
+
+  nsJSPrincipals() {
+    refcount = 0;
+    setDebugToken(DEBUG_TOKEN);
+  }
+
+  virtual ~nsJSPrincipals() {
+    setDebugToken(0);
+  }
+
+  /**
+   * Return a string that can be used as JS script filename in error reports.
+   */
+  virtual void GetScriptLocation(nsACString &aStr) = 0;
+
+#ifdef DEBUG
+  virtual void dumpImpl() = 0;
+#endif
+
+  static const uint32_t DEBUG_TOKEN = 0x0bf41760;
 };
 
 #endif /* nsJSPrincipals_h__ */
diff --git a/caps/include/nsNullPrincipal.h b/caps/include/nsNullPrincipal.h
index e342d287bb7..a2cbe139b0e 100644
--- a/caps/include/nsNullPrincipal.h
+++ b/caps/include/nsNullPrincipal.h
@@ -59,16 +59,16 @@ class nsIURI;
 
 #define NS_NULLPRINCIPAL_SCHEME "moz-nullprincipal"
 
-class nsNullPrincipal : public nsIPrincipal
+class nsNullPrincipal : public nsJSPrincipals
 {
 public:
   nsNullPrincipal();
   
-  // Our refcount is managed by mJSPrincipals.  Use this macro to avoid an
+  // Our refcount is managed by nsJSPrincipals.  Use this macro to avoid an
   // extra refcount member.
 
   // FIXME: bug 327245 -- I sorta wish there were a clean way to share the
-  // mJSPrincipals munging code between the various principal classes without
+  // nsJSPrincipals munging code between the various principal classes without
   // giving up the NS_DECL_NSIPRINCIPAL goodness.
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIPRINCIPAL
@@ -76,10 +76,15 @@ public:
 
   nsresult Init();
 
-protected:
+  virtual void GetScriptLocation(nsACString &aStr) MOZ_OVERRIDE;
+
+#ifdef DEBUG
+  virtual void dumpImpl() MOZ_OVERRIDE;
+#endif 
+
+ protected:
   virtual ~nsNullPrincipal();
 
-  nsJSPrincipals mJSPrincipals;
   nsCOMPtr<nsIURI> mURI;
 };
 
diff --git a/caps/include/nsPrincipal.h b/caps/include/nsPrincipal.h
index 8f78db43ef6..1542dc6ba7d 100644
--- a/caps/include/nsPrincipal.h
+++ b/caps/include/nsPrincipal.h
@@ -51,7 +51,7 @@
 class nsIObjectInputStream;
 class nsIObjectOutputStream;
 
-class nsPrincipal : public nsIPrincipal
+class nsPrincipal : public nsJSPrincipals
 {
 public:
   nsPrincipal();
@@ -60,7 +60,7 @@ protected:
   virtual ~nsPrincipal();
 
 public:
-  // Our refcount is managed by mJSPrincipals.  Use this macro to avoid
+  // Our refcount is managed by nsJSPrincipals.  Use this macro to avoid
   // an extra refcount member.
   NS_DECL_ISUPPORTS_INHERITED
 public:
@@ -100,8 +100,13 @@ public:
 
   static const char sInvalid[];
 
+  virtual void GetScriptLocation(nsACString &aStr) MOZ_OVERRIDE;
+
+#ifdef DEBUG
+  virtual void dumpImpl() MOZ_OVERRIDE;
+#endif 
+
 protected:
-  nsJSPrincipals mJSPrincipals;
   nsTArray< nsAutoPtr<nsHashtable> > mAnnotations;
   nsHashtable* mCapabilities;
   nsCString mPrefName;
diff --git a/caps/include/nsScriptSecurityManager.h b/caps/include/nsScriptSecurityManager.h
index ca0a9fb7079..94e5e469a15 100644
--- a/caps/include/nsScriptSecurityManager.h
+++ b/caps/include/nsScriptSecurityManager.h
@@ -428,6 +428,9 @@ private:
                       jsid id, JSAccessMode mode,
                       jsval *vp);
 
+    static JSPrincipals *
+    ObjectPrincipalFinder(JSObject *obj);
+    
     // Decides, based on CSP, whether or not eval() and stuff can be executed.
     static JSBool
     ContentSecurityPolicyPermitsJSAction(JSContext *cx);
diff --git a/caps/include/nsSystemPrincipal.h b/caps/include/nsSystemPrincipal.h
index d9154a6c4b1..25eaee25427 100644
--- a/caps/include/nsSystemPrincipal.h
+++ b/caps/include/nsSystemPrincipal.h
@@ -50,23 +50,26 @@
 #define NS_SYSTEMPRINCIPAL_CONTRACTID "@mozilla.org/systemprincipal;1"
 
 
-class nsSystemPrincipal : public nsIPrincipal
+class nsSystemPrincipal : public nsJSPrincipals
 {
 public:
-    // Our refcount is managed by mJSPrincipals.  Use this macro to avoid
+    // Our refcount is managed by nsJSPrincipals.  Use this macro to avoid
     // an extra refcount member.
     NS_DECL_ISUPPORTS_INHERITED
     NS_DECL_NSIPRINCIPAL
     NS_DECL_NSISERIALIZABLE
 
-    nsresult Init(JSPrincipals **jsprin);
-
     nsSystemPrincipal();
 
+    virtual void GetScriptLocation(nsACString &aStr) MOZ_OVERRIDE;
+
+#ifdef DEBUG
+    virtual void dumpImpl() MOZ_OVERRIDE;
+#endif 
+
 protected:
     virtual ~nsSystemPrincipal(void);
 
-    nsJSPrincipals mJSPrincipals;
     // XXX Probably unnecessary.  See bug 143559.
     NS_DECL_OWNINGTHREAD
 };
diff --git a/caps/src/nsJSPrincipals.cpp b/caps/src/nsJSPrincipals.cpp
index f86f0d38a33..5907b35ffea 100644
--- a/caps/src/nsJSPrincipals.cpp
+++ b/caps/src/nsJSPrincipals.cpp
@@ -50,46 +50,44 @@
 #include "nsMemory.h"
 #include "nsStringBuffer.h"
 
-static JSBool
-nsJSPrincipalsSubsume(JSPrincipals *jsprin, JSPrincipals *other)
-{
-    nsJSPrincipals *nsjsprin = static_cast<nsJSPrincipals *>(jsprin);
-    nsJSPrincipals *nsother  = static_cast<nsJSPrincipals *>(other);
+// for mozilla::dom::workers::kJSPrincipalsDebugToken
+#include "mozilla/dom/workers/Workers.h"
 
+/* static */ JSBool
+nsJSPrincipals::Subsume(JSPrincipals *jsprin, JSPrincipals *other)
+{
     bool result;
-    nsresult rv = nsjsprin->nsIPrincipalPtr->Subsumes(nsother->nsIPrincipalPtr,
-                                                      &result);
+    nsresult rv = nsJSPrincipals::get(jsprin)->Subsumes(nsJSPrincipals::get(other), &result);
     return NS_SUCCEEDED(rv) && result;
 }
 
-static void
-nsDestroyJSPrincipals(JSContext *cx, struct JSPrincipals *jsprin)
+/* static */ void
+nsJSPrincipals::Destroy(JSPrincipals *jsprin)
 {
-    nsJSPrincipals *nsjsprin = static_cast<nsJSPrincipals *>(jsprin);
+    // The JS runtime can call this method during the last GC when
+    // nsScriptSecurityManager is destroyed. So we must not assume here that
+    // the security manager still exists.
+
+    nsJSPrincipals *nsjsprin = nsJSPrincipals::get(jsprin);
 
     // We need to destroy the nsIPrincipal. We'll do this by adding
     // to the refcount and calling release
 
-    // Note that we don't want to use NS_IF_RELEASE because it will try
-    // to set nsjsprin->nsIPrincipalPtr to nsnull *after* nsjsprin has
-    // already been destroyed.
 #ifdef NS_BUILD_REFCNT_LOGGING
     // The refcount logging considers AddRef-to-1 to indicate creation,
     // so trick it into thinking it's otherwise, but balance the
     // Release() we do below.
     nsjsprin->refcount++;
-    nsjsprin->nsIPrincipalPtr->AddRef();
+    nsjsprin->AddRef();
     nsjsprin->refcount--;
 #else
     nsjsprin->refcount++;
 #endif
-    nsjsprin->nsIPrincipalPtr->Release();
-    // The nsIPrincipal that we release owns the JSPrincipal struct,
-    // so we don't need to worry about "codebase"
+    nsjsprin->Release();
 }
 
-static JSBool
-nsTranscodeJSPrincipals(JSXDRState *xdr, JSPrincipals **jsprinp)
+/* static */ JSBool
+nsJSPrincipals::Transcode(JSXDRState *xdr, JSPrincipals **jsprinp)
 {
     nsresult rv;
 
@@ -107,12 +105,7 @@ nsTranscodeJSPrincipals(JSXDRState *xdr, JSPrincipals **jsprinp)
             if (NS_SUCCEEDED(rv)) {
                 ::JS_XDRMemResetData(xdr);
 
-                // Require that GetJSPrincipals has been called already by the
-                // code that compiled the script that owns the principals.
-                nsJSPrincipals *nsjsprin =
-                    static_cast<nsJSPrincipals*>(*jsprinp);
-
-                rv = stream->WriteObject(nsjsprin->nsIPrincipalPtr, true);
+                rv = stream->WriteObject(nsJSPrincipals::get(*jsprinp), true);
             }
         }
     } else {
@@ -141,7 +134,8 @@ nsTranscodeJSPrincipals(JSXDRState *xdr, JSPrincipals **jsprinp)
                     nsMemory::Free(olddata);
                     ::JS_XDRMemSetData(xdr, data, size);
 
-                    prin->GetJSPrincipals(xdr->cx, jsprinp);
+                    *jsprinp = nsJSPrincipals::get(prin);
+                    JS_HoldPrincipals(*jsprinp);
                 }
             }
         }
@@ -156,69 +150,22 @@ nsTranscodeJSPrincipals(JSXDRState *xdr, JSPrincipals **jsprinp)
     return JS_TRUE;
 }
 
-nsresult
-nsJSPrincipals::Startup()
+#ifdef DEBUG
+
+// Defined here so one can do principals->dump() in the debugger
+JS_EXPORT_API(void)
+JSPrincipals::dump()
 {
-    nsCOMPtr<nsIJSRuntimeService> rtsvc = nsXPConnect::GetXPConnect();
-    if (!rtsvc)
-        return NS_ERROR_FAILURE;
-
-    JSRuntime *rt;
-    rtsvc->GetRuntime(&rt);
-    NS_ASSERTION(rt != nsnull, "no JSRuntime?!");
-
-    JSSecurityCallbacks *callbacks = JS_GetRuntimeSecurityCallbacks(rt);
-    NS_ASSERTION(callbacks, "Need a callbacks struct by now!");
-
-    NS_ASSERTION(!callbacks->principalsTranscoder,
-                 "oops, JS_SetPrincipalsTranscoder wars!");
-
-    callbacks->principalsTranscoder = nsTranscodeJSPrincipals;
-    return NS_OK;
-}
-
-nsJSPrincipals::nsJSPrincipals()
-{
-    codebase = nsnull;
-    refcount = 0;
-    destroy = nsDestroyJSPrincipals;
-    subsume = nsJSPrincipalsSubsume;
-    nsIPrincipalPtr = nsnull;
-}
-
-nsresult
-nsJSPrincipals::Init(nsIPrincipal *aPrincipal, const nsCString& aCodebase)
-{
-    if (nsIPrincipalPtr) {
-        NS_ERROR("Init called twice!");
-        return NS_ERROR_UNEXPECTED;
-    }
-
-    nsIPrincipalPtr = aPrincipal;
-    nsStringBuffer* buf = nsStringBuffer::FromString(aCodebase);
-    char* data;
-    if (buf) {
-        buf->AddRef();
-        data = static_cast<char*>(buf->Data());
+    if (debugToken == nsJSPrincipals::DEBUG_TOKEN) {
+        static_cast<nsJSPrincipals *>(this)->dumpImpl();
+    } else if (debugToken == mozilla::dom::workers::kJSPrincipalsDebugToken) {
+        fprintf(stderr, "Web Worker principal singleton (%p)\n", this);
     } else {
-        PRUint32 len = aCodebase.Length();
-        buf = nsStringBuffer::Alloc(len + 1); // addrefs
-        if (!buf) {
-            return NS_ERROR_OUT_OF_MEMORY;
-        }
-        data = static_cast<char*>(buf->Data());
-        memcpy(data, aCodebase.get(), len);
-        data[len] = '\0';
-    }
-    
-    codebase = data;
-
-    return NS_OK;
-}
-
-nsJSPrincipals::~nsJSPrincipals()
-{
-    if (codebase) {
-        nsStringBuffer::FromData(codebase)->Release();
+        fprintf(stderr,
+                "!!! JSPrincipals (%p) is not nsJSPrincipals instance - bad token: "
+                "actual=0x%x expected=0x%x\n",
+                this, unsigned(debugToken), unsigned(nsJSPrincipals::DEBUG_TOKEN));
     }
 }
+
+#endif 
diff --git a/caps/src/nsNullPrincipal.cpp b/caps/src/nsNullPrincipal.cpp
index 8851652d71c..8f69ade01b5 100644
--- a/caps/src/nsNullPrincipal.cpp
+++ b/caps/src/nsNullPrincipal.cpp
@@ -69,8 +69,8 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsNullPrincipal,
 NS_IMETHODIMP_(nsrefcnt) 
 nsNullPrincipal::AddRef()
 {
-  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
-  nsrefcnt count = PR_ATOMIC_INCREMENT(&mJSPrincipals.refcount);
+  NS_PRECONDITION(PRInt32(refcount) >= 0, "illegal refcnt");
+  nsrefcnt count = PR_ATOMIC_INCREMENT(&refcount);
   NS_LOG_ADDREF(this, count, "nsNullPrincipal", sizeof(*this));
   return count;
 }
@@ -78,8 +78,8 @@ nsNullPrincipal::AddRef()
 NS_IMETHODIMP_(nsrefcnt)
 nsNullPrincipal::Release()
 {
-  NS_PRECONDITION(0 != mJSPrincipals.refcount, "dup release");
-  nsrefcnt count = PR_ATOMIC_DECREMENT(&mJSPrincipals.refcount);
+  NS_PRECONDITION(0 != refcount, "dup release");
+  nsrefcnt count = PR_ATOMIC_DECREMENT(&refcount);
   NS_LOG_RELEASE(this, count, "nsNullPrincipal");
   if (count == 0) {
     delete this;
@@ -133,9 +133,24 @@ nsNullPrincipal::Init()
   mURI = new nsNullPrincipalURI(str);
   NS_ENSURE_TRUE(mURI, NS_ERROR_OUT_OF_MEMORY);
 
-  return mJSPrincipals.Init(this, str);
+  return NS_OK;
 }
 
+void
+nsNullPrincipal::GetScriptLocation(nsACString &aStr)
+{
+  mURI->GetSpec(aStr);
+}
+
+#ifdef DEBUG
+void nsNullPrincipal::dumpImpl()
+{
+  nsCAutoString str;
+  mURI->GetSpec(str);
+  fprintf(stderr, "nsNullPrincipal (%p) = %s\n", this, str.get());
+}
+#endif 
+
 /**
  * nsIPrincipal implementation
  */
@@ -179,17 +194,6 @@ nsNullPrincipal::GetHashValue(PRUint32 *aResult)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsNullPrincipal::GetJSPrincipals(JSContext *cx, JSPrincipals **aJsprin)
-{
-  NS_PRECONDITION(mJSPrincipals.nsIPrincipalPtr,
-                  "mJSPrincipals is uninitalized!");
-
-  JSPRINCIPALS_HOLD(cx, &mJSPrincipals);
-  *aJsprin = &mJSPrincipals;
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsNullPrincipal::GetSecurityPolicy(void** aSecurityPolicy)
 {
diff --git a/caps/src/nsPrincipal.cpp b/caps/src/nsPrincipal.cpp
index 97005d838ad..e7b0897005e 100644
--- a/caps/src/nsPrincipal.cpp
+++ b/caps/src/nsPrincipal.cpp
@@ -93,9 +93,9 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsPrincipal,
 NS_IMETHODIMP_(nsrefcnt)
 nsPrincipal::AddRef()
 {
-  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
+  NS_PRECONDITION(PRInt32(refcount) >= 0, "illegal refcnt");
   // XXXcaa does this need to be threadsafe?  See bug 143559.
-  nsrefcnt count = PR_ATOMIC_INCREMENT(&mJSPrincipals.refcount);
+  nsrefcnt count = PR_ATOMIC_INCREMENT(&refcount);
   NS_LOG_ADDREF(this, count, "nsPrincipal", sizeof(*this));
   return count;
 }
@@ -103,8 +103,8 @@ nsPrincipal::AddRef()
 NS_IMETHODIMP_(nsrefcnt)
 nsPrincipal::Release()
 {
-  NS_PRECONDITION(0 != mJSPrincipals.refcount, "dup release");
-  nsrefcnt count = PR_ATOMIC_DECREMENT(&mJSPrincipals.refcount);
+  NS_PRECONDITION(0 != refcount, "dup release");
+  nsrefcnt count = PR_ATOMIC_DECREMENT(&refcount);
   NS_LOG_RELEASE(this, count, "nsPrincipal");
   if (count == 0) {
     delete this;
@@ -147,24 +147,10 @@ nsPrincipal::Init(const nsACString& aCertFingerprint,
   mCodebase = NS_TryToMakeImmutable(aCodebase);
   mCodebaseImmutable = URIIsImmutable(mCodebase);
 
-  nsresult rv;
-  if (!aCertFingerprint.IsEmpty()) {
-    rv = SetCertificate(aCertFingerprint, aSubjectName, aPrettyName, aCert);
-    if (NS_SUCCEEDED(rv)) {
-      rv = mJSPrincipals.Init(this, mCert->fingerprint);
-    }
-  }
-  else {
-    nsCAutoString spec;
-    rv = mCodebase->GetSpec(spec);
-    if (NS_SUCCEEDED(rv)) {
-      rv = mJSPrincipals.Init(this, spec);
-    }
-  }
+  if (aCertFingerprint.IsEmpty())
+    return NS_OK;
 
-  NS_ASSERTION(NS_SUCCEEDED(rv), "nsPrincipal::Init() failed");
-
-  return rv;
+  return SetCertificate(aCertFingerprint, aSubjectName, aPrettyName, aCert);
 }
 
 nsPrincipal::~nsPrincipal(void)
@@ -173,16 +159,25 @@ nsPrincipal::~nsPrincipal(void)
   delete mCapabilities;
 }
 
-NS_IMETHODIMP
-nsPrincipal::GetJSPrincipals(JSContext *cx, JSPrincipals **jsprin)
+void
+nsPrincipal::GetScriptLocation(nsACString &aStr)
 {
-  NS_PRECONDITION(mJSPrincipals.nsIPrincipalPtr, "mJSPrincipals is uninitialized!");
-
-  JSPRINCIPALS_HOLD(cx, &mJSPrincipals);
-  *jsprin = &mJSPrincipals;
-  return NS_OK;
+  if (mCert) {
+    aStr.Assign(mCert->fingerprint);
+  } else {
+    mCodebase->GetSpec(aStr);
+  }
 }
 
+#ifdef DEBUG
+void nsPrincipal::dumpImpl()
+{
+  nsCAutoString str;
+  GetScriptLocation(str);
+  fprintf(stderr, "nsPrincipal (%p) = %s\n", this, str.get());
+}
+#endif 
+
 NS_IMETHODIMP
 nsPrincipal::GetOrigin(char **aOrigin)
 {
@@ -883,9 +878,6 @@ nsPrincipal::InitFromPersistent(const char* aPrefName,
     mTrusted = aTrusted;
   }
 
-  rv = mJSPrincipals.Init(this, aToken);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   //-- Save the preference name
   mPrefName = aPrefName;
 
diff --git a/caps/src/nsScriptSecurityManager.cpp b/caps/src/nsScriptSecurityManager.cpp
index bf2b8424a49..169edef4f24 100644
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@@ -517,6 +517,13 @@ NS_IMPL_ISUPPORTS4(nsScriptSecurityManager,
 ///////////////////////////////////////////////////
 
 ///////////////// Security Checks /////////////////
+
+/* static */ JSPrincipals *
+nsScriptSecurityManager::ObjectPrincipalFinder(JSObject *aObj)
+{
+    return nsJSPrincipals::get(doGetObjectPrincipal(aObj));
+}
+
 JSBool
 nsScriptSecurityManager::ContentSecurityPolicyPermitsJSAction(JSContext *cx)
 {
@@ -537,7 +544,7 @@ nsScriptSecurityManager::ContentSecurityPolicyPermitsJSAction(JSContext *cx)
 
     if (!subjectPrincipal) {
         // See bug 553448 for discussion of this case.
-        NS_ASSERTION(!JS_GetSecurityCallbacks(cx)->findObjectPrincipals,
+        NS_ASSERTION(!JS_GetSecurityCallbacks(js::GetRuntime(cx))->findObjectPrincipals,
                      "CSP: Should have been able to find subject principal. "
                      "Reluctantly granting access.");
         return JS_TRUE;
@@ -2179,11 +2186,7 @@ nsScriptSecurityManager::GetScriptPrincipal(JSContext *cx,
         NS_ERROR("Script compiled without principals!");
         return nsnull;
     }
-    nsJSPrincipals *nsJSPrin = static_cast<nsJSPrincipals *>(jsp);
-    nsIPrincipal* result = nsJSPrin->nsIPrincipalPtr;
-    if (!result)
-        *rv = NS_ERROR_FAILURE;
-    return result;
+    return nsJSPrincipals::get(jsp);
 }
 
 // static
@@ -3330,7 +3333,6 @@ nsScriptSecurityManager::nsScriptSecurityManager(void)
     mPrincipals.Init(31);
 }
 
-
 nsresult nsScriptSecurityManager::Init()
 {
     nsXPConnect* xpconnect = nsXPConnect::GetXPConnect();
@@ -3365,10 +3367,6 @@ nsresult nsScriptSecurityManager::Init()
     nsRefPtr<nsSystemPrincipal> system = new nsSystemPrincipal();
     NS_ENSURE_TRUE(system, NS_ERROR_OUT_OF_MEMORY);
 
-    JSPrincipals *jsprin;
-    rv = system->Init(&jsprin);
-    NS_ENSURE_SUCCESS(rv, rv);
-
     mSystemPrincipal = system;
 
     //-- Register security check callback in the JS engine
@@ -3380,20 +3378,19 @@ nsresult nsScriptSecurityManager::Init()
     rv = runtimeService->GetRuntime(&sRuntime);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    static JSSecurityCallbacks securityCallbacks = {
+    static const JSSecurityCallbacks securityCallbacks = {
         CheckObjectAccess,
-        NULL,
-        NULL,
+        nsJSPrincipals::Subsume,
+        nsJSPrincipals::Transcode,
+        ObjectPrincipalFinder,
         ContentSecurityPolicyPermitsJSAction
     };
 
-#ifdef DEBUG
-    JSSecurityCallbacks *oldcallbacks =
-#endif
-    JS_SetRuntimeSecurityCallbacks(sRuntime, &securityCallbacks);
-    NS_ASSERTION(!oldcallbacks, "Someone else set security callbacks!");
+    MOZ_ASSERT(!JS_GetSecurityCallbacks(sRuntime));
+    JS_SetSecurityCallbacks(sRuntime, &securityCallbacks);
+    JS_InitDestroyPrincipalsCallback(sRuntime, nsJSPrincipals::Destroy);
 
-    JS_SetTrustedPrincipals(sRuntime, jsprin);
+    JS_SetTrustedPrincipals(sRuntime, system);
 
     return NS_OK;
 }
@@ -3417,7 +3414,7 @@ void
 nsScriptSecurityManager::Shutdown()
 {
     if (sRuntime) {
-        JS_SetRuntimeSecurityCallbacks(sRuntime, NULL);
+        JS_SetSecurityCallbacks(sRuntime, NULL);
         JS_SetTrustedPrincipals(sRuntime, NULL);
         sRuntime = nsnull;
     }
@@ -3445,13 +3442,6 @@ nsScriptSecurityManager::GetScriptSecurityManager()
             return nsnull;
         }
  
-        rv = nsJSPrincipals::Startup();
-        if (NS_FAILED(rv)) {
-            NS_WARNING("can't initialize JS engine security protocol glue!");
-            delete ssManager;
-            return nsnull;
-        }
- 
         rv = sXPConnect->SetDefaultSecurityManager(ssManager,
                                                    nsIXPCSecurityManager::HOOK_ALL);
         if (NS_FAILED(rv)) {
diff --git a/caps/src/nsSystemPrincipal.cpp b/caps/src/nsSystemPrincipal.cpp
index c223d07cfb6..2b3f5b499bc 100644
--- a/caps/src/nsSystemPrincipal.cpp
+++ b/caps/src/nsSystemPrincipal.cpp
@@ -62,8 +62,8 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsSystemPrincipal,
 NS_IMETHODIMP_(nsrefcnt) 
 nsSystemPrincipal::AddRef()
 {
-  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
-  nsrefcnt count = PR_ATOMIC_INCREMENT(&mJSPrincipals.refcount);
+  NS_PRECONDITION(PRInt32(refcount) >= 0, "illegal refcnt");
+  nsrefcnt count = PR_ATOMIC_INCREMENT(&refcount);
   NS_LOG_ADDREF(this, count, "nsSystemPrincipal", sizeof(*this));
   return count;
 }
@@ -71,8 +71,8 @@ nsSystemPrincipal::AddRef()
 NS_IMETHODIMP_(nsrefcnt)
 nsSystemPrincipal::Release()
 {
-  NS_PRECONDITION(0 != mJSPrincipals.refcount, "dup release");
-  nsrefcnt count = PR_ATOMIC_DECREMENT(&mJSPrincipals.refcount);
+  NS_PRECONDITION(0 != refcount, "dup release");
+  nsrefcnt count = PR_ATOMIC_DECREMENT(&refcount);
   NS_LOG_RELEASE(this, count, "nsSystemPrincipal");
   if (count == 0) {
     delete this;
@@ -81,13 +81,26 @@ nsSystemPrincipal::Release()
   return count;
 }
 
+static const char SYSTEM_PRINCIPAL_SPEC[] = "[System Principal]";
+
+void
+nsSystemPrincipal::GetScriptLocation(nsACString &aStr)
+{
+    aStr.Assign(SYSTEM_PRINCIPAL_SPEC);
+}
+
+#ifdef DEBUG
+void nsSystemPrincipal::dumpImpl()
+{
+  fprintf(stderr, "nsSystemPrincipal (%p)\n", this);
+}
+#endif 
+
 
 ///////////////////////////////////////
 // Methods implementing nsIPrincipal //
 ///////////////////////////////////////
 
-#define SYSTEM_PRINCIPAL_SPEC "[System Principal]"
-
 NS_IMETHODIMP
 nsSystemPrincipal::GetPreferences(char** aPrefName, char** aID,
                                   char** aSubjectName,
@@ -280,16 +293,6 @@ nsSystemPrincipal::SetSecurityPolicy(void* aSecurityPolicy)
     return NS_OK;
 }
 
-NS_IMETHODIMP
-nsSystemPrincipal::GetJSPrincipals(JSContext *cx, JSPrincipals **jsprin)
-{
-    NS_PRECONDITION(mJSPrincipals.nsIPrincipalPtr, "mJSPrincipals is uninitialized!");
-
-    JSPRINCIPALS_HOLD(cx, &mJSPrincipals);
-    *jsprin = &mJSPrincipals;
-    return NS_OK;
-}
-
 
 //////////////////////////////////////////
 // Methods implementing nsISerializable //
@@ -317,24 +320,6 @@ nsSystemPrincipal::nsSystemPrincipal()
 {
 }
 
-nsresult
-nsSystemPrincipal::Init(JSPrincipals **jsprin)
-{
-    // Use an nsCString so we only do the allocation once here and then
-    // share with nsJSPrincipals
-    nsCString str(SYSTEM_PRINCIPAL_SPEC);
-    if (!str.EqualsLiteral(SYSTEM_PRINCIPAL_SPEC)) {
-        NS_WARNING("Out of memory initializing system principal");
-        return NS_ERROR_OUT_OF_MEMORY;
-    }
-
-    nsresult rv = mJSPrincipals.Init(this, str);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    *jsprin = &mJSPrincipals;
-    return NS_OK;
-}
-
-nsSystemPrincipal::~nsSystemPrincipal(void)
+nsSystemPrincipal::~nsSystemPrincipal()
 {
 }
diff --git a/config/autoconf.mk.in b/config/autoconf.mk.in
index d0eeb0c7897..84233fbb2c9 100644
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -301,6 +301,10 @@ MOZ_NATIVE_NSS = @MOZ_NATIVE_NSS@
 MOZ_B2G_RIL = @MOZ_B2G_RIL@
 MOZ_B2G_BT = @MOZ_B2G_BT@
 
+MOZ_ASAN = @MOZ_ASAN@
+MOZ_CFLAGS_NSS = @MOZ_CFLAGS_NSS@
+MOZ_NO_WLZDEFS = @MOZ_NO_WLZDEFS@
+
 BUILD_CTYPES = @BUILD_CTYPES@
 
 COMPILE_ENVIRONMENT = @COMPILE_ENVIRONMENT@
diff --git a/config/config.mk b/config/config.mk
index 21d37ea5bd1..a830bfe969b 100644
--- a/config/config.mk
+++ b/config/config.mk
@@ -789,8 +789,12 @@ EXPAND_LIBS_GEN = $(PYTHON) $(topsrcdir)/config/pythonpath.py -I$(DEPTH)/config
 EXPAND_AR = $(EXPAND_LIBS_EXEC) --extract -- $(AR)
 EXPAND_CC = $(EXPAND_LIBS_EXEC) --uselist -- $(CC)
 EXPAND_CCC = $(EXPAND_LIBS_EXEC) --uselist -- $(CCC)
-EXPAND_LD = $(EXPAND_LIBS_EXEC) --uselist $(if $(REORDER),--reorder $(REORDER))-- $(LD)
-EXPAND_MKSHLIB = $(EXPAND_LIBS_EXEC) --uselist $(if $(REORDER),--reorder $(REORDER))-- $(MKSHLIB)
+EXPAND_LD = $(EXPAND_LIBS_EXEC) --uselist -- $(LD)
+EXPAND_MKSHLIB_ARGS = --uselist
+ifdef SYMBOL_ORDER
+EXPAND_MKSHLIB_ARGS += --symbol-order $(SYMBOL_ORDER)
+endif
+EXPAND_MKSHLIB = $(EXPAND_LIBS_EXEC) $(EXPAND_MKSHLIB_ARGS) -- $(MKSHLIB)
 
 ifdef STDCXX_COMPAT
 ifneq ($(OS_ARCH),Darwin)
diff --git a/config/expandlibs_config.py.in b/config/expandlibs_config.py.in
index e204bb9e85e..32a48ac5fd4 100644
--- a/config/expandlibs_config.py.in
+++ b/config/expandlibs_config.py.in
@@ -54,3 +54,5 @@ DLL_SUFFIX = normalize_suffix("@DLL_SUFFIX@")
 IMPORT_LIB_SUFFIX = normalize_suffix("@IMPORT_LIB_SUFFIX@")
 LIBS_DESC_SUFFIX = normalize_suffix("@LIBS_DESC_SUFFIX@")
 EXPAND_LIBS_LIST_STYLE = "@EXPAND_LIBS_LIST_STYLE@"
+EXPAND_LIBS_ORDER_STYLE = "@EXPAND_LIBS_ORDER_STYLE@"
+LD_PRINT_ICF_SECTIONS = "@LD_PRINT_ICF_SECTIONS@"
diff --git a/config/expandlibs_exec.py b/config/expandlibs_exec.py
index b6671cfdef7..afc0fc8fd60 100644
--- a/config/expandlibs_exec.py
+++ b/config/expandlibs_exec.py
@@ -49,9 +49,9 @@ EXPAND_LIBS_LIST_STYLE variable: 'list' for MSVC style lists (@file.list)
 or 'linkerscript' for GNU ld linker scripts.
 See https://bugzilla.mozilla.org/show_bug.cgi?id=584474#c59 for more details.
 
-With the --reorder argument, followed by a file name, it will reorder the
-object files from the command line according to the order given in the file.
-Implies --extract.
+With the --symbol-order argument, followed by a file name, it will add the
+relevant linker options to change the order in which the linker puts the
+symbols appear in the resulting binary. Only works for ELF targets.
 '''
 from __future__ import with_statement
 import sys
@@ -62,6 +62,18 @@ from optparse import OptionParser
 import subprocess
 import tempfile
 import shutil
+import subprocess
+import re
+
+# The are the insert points for a GNU ld linker script, assuming a more
+# or less "standard" default linker script. This is not a dict because
+# order is important.
+SECTION_INSERT_BEFORE = [
+  ('.text', '.fini'),
+  ('.rodata', '.rodata1'),
+  ('.data.rel.ro', '.dynamic'),
+  ('.data', '.data1'),
+]
 
 class ExpandArgsMore(ExpandArgs):
     ''' Meant to be used as 'with ExpandArgsMore(args) as ...: '''
@@ -119,6 +131,7 @@ class ExpandArgsMore(ExpandArgs):
             content = ["%s\n" % obj for obj in objs]
             ref = "@" + tmp
         else:
+            os.close(fd)
             os.remove(tmp)
             return
         self.tmp.append(tmp)
@@ -129,21 +142,163 @@ class ExpandArgsMore(ExpandArgs):
         newlist = self[0:idx] + [ref] + [item for item in self[idx:] if item not in objs]
         self[0:] = newlist
 
-    def reorder(self, order_list):
-        '''Given a list of file names without OBJ_SUFFIX, rearrange self
-        so that the object file names it contains are ordered according to
-        that list.
-        '''
-        objs = [o for o in self if isObject(o)]
-        if not objs: return
-        idx = self.index(objs[0])
-        # Keep everything before the first object, then the ordered objects,
-        # then any other objects, then any non-objects after the first object
-        objnames = dict([(os.path.splitext(os.path.basename(o))[0], o) for o in objs])
-        self[0:] = self[0:idx] + [objnames[o] for o in order_list if o in objnames] + \
-                   [o for o in objs if os.path.splitext(os.path.basename(o))[0] not in order_list] + \
-                   [x for x in self[idx:] if not isObject(x)]
+    def _getFoldedSections(self):
+        '''Returns a dict about folded sections.
+        When section A and B are folded into section C, the dict contains:
+        { 'A': 'C',
+          'B': 'C',
+          'C': ['A', 'B'] }'''
+        if not conf.LD_PRINT_ICF_SECTIONS:
+            return {}
 
+        proc = subprocess.Popen(self + [conf.LD_PRINT_ICF_SECTIONS], stdout = subprocess.PIPE, stderr = subprocess.PIPE)
+        (stdout, stderr) = proc.communicate()
+        result = {}
+        # gold's --print-icf-sections output looks like the following:
+        # ld: ICF folding section '.section' in file 'file.o'into '.section' in file 'file.o'
+        # In terms of words, chances are this will change in the future,
+        # especially considering "into" is misplaced. Splitting on quotes
+        # seems safer.
+        for l in stderr.split('\n'):
+            quoted = l.split("'")
+            if len(quoted) > 5 and quoted[1] != quoted[5]:
+                result[quoted[1]] = quoted[5]
+                if quoted[5] in result:
+                    result[quoted[5]].append(quoted[1])
+                else:
+                    result[quoted[5]] = [quoted[1]]
+        return result
+
+    def _getOrderedSections(self, ordered_symbols):
+        '''Given an ordered list of symbols, returns the corresponding list
+        of sections following the order.'''
+        if not conf.EXPAND_LIBS_ORDER_STYLE in ['linkerscript', 'section-ordering-file']:
+            raise Exception('EXPAND_LIBS_ORDER_STYLE "%s" is not supported' % conf.EXPAND_LIBS_ORDER_STYLE)
+        finder = SectionFinder([arg for arg in self if isObject(arg) or os.path.splitext(arg)[1] == conf.LIB_SUFFIX])
+        folded = self._getFoldedSections()
+        sections = set()
+        ordered_sections = []
+        for symbol in ordered_symbols:
+            symbol_sections = finder.getSections(symbol)
+            all_symbol_sections = []
+            for section in symbol_sections:
+                if section in folded:
+                    if isinstance(folded[section], str):
+                        section = folded[section]
+                    all_symbol_sections.append(section)
+                    all_symbol_sections.extend(folded[section])
+                else:
+                    all_symbol_sections.append(section)
+            for section in all_symbol_sections:
+                if not section in sections:
+                    ordered_sections.append(section)
+                    sections.add(section)
+        return ordered_sections
+
+    def orderSymbols(self, order):
+        '''Given a file containing a list of symbols, adds the appropriate
+        argument to make the linker put the symbols in that order.'''
+        with open(order) as file:
+            sections = self._getOrderedSections([l.strip() for l in file.readlines() if l.strip()])
+        split_sections = {}
+        linked_sections = [s[0] for s in SECTION_INSERT_BEFORE]
+        for s in sections:
+            for linked_section in linked_sections:
+                if s.startswith(linked_section):
+                    if linked_section in split_sections:
+                        split_sections[linked_section].append(s)
+                    else:
+                        split_sections[linked_section] = [s]
+                    break
+        content = []
+        # Order is important
+        linked_sections = [s for s in linked_sections if s in split_sections]
+
+        if conf.EXPAND_LIBS_ORDER_STYLE == 'section-ordering-file':
+            option = '-Wl,--section-ordering-file,%s'
+            content = sections
+            for linked_section in linked_sections:
+                content.extend(split_sections[linked_section])
+                content.append('%s.*' % linked_section)
+                content.append(linked_section)
+
+        elif conf.EXPAND_LIBS_ORDER_STYLE == 'linkerscript':
+            option = '-Wl,-T,%s'
+            section_insert_before = dict(SECTION_INSERT_BEFORE)
+            for linked_section in linked_sections:
+                content.append('SECTIONS {')
+                content.append('  %s : {' % linked_section)
+                content.extend('    *(%s)' % s for s in split_sections[linked_section])
+                content.append('  }')
+                content.append('}')
+                content.append('INSERT BEFORE %s' % section_insert_before[linked_section])
+        else:
+            raise Exception('EXPAND_LIBS_ORDER_STYLE "%s" is not supported' % conf.EXPAND_LIBS_ORDER_STYLE)
+
+        fd, tmp = tempfile.mkstemp(dir=os.curdir)
+        f = os.fdopen(fd, "w")
+        f.write('\n'.join(content)+'\n')
+        f.close()
+        self.tmp.append(tmp)
+        self.append(option % tmp)
+
+class SectionFinder(object):
+    '''Instances of this class allow to map symbol names to sections in
+    object files.'''
+
+    def __init__(self, objs):
+        '''Creates an instance, given a list of object files.'''
+        if not conf.EXPAND_LIBS_ORDER_STYLE in ['linkerscript', 'section-ordering-file']:
+            raise Exception('EXPAND_LIBS_ORDER_STYLE "%s" is not supported' % conf.EXPAND_LIBS_ORDER_STYLE)
+        self.mapping = {}
+        for obj in objs:
+            if not isObject(obj) and os.path.splitext(obj)[1] != conf.LIB_SUFFIX:
+                raise Exception('%s is not an object nor a static library' % obj)
+            for symbol, section in SectionFinder._getSymbols(obj):
+                sym = SectionFinder._normalize(symbol)
+                if sym in self.mapping:
+                    if not section in self.mapping[sym]:
+                        self.mapping[sym].append(section)
+                else:
+                    self.mapping[sym] = [section]
+
+    def getSections(self, symbol):
+        '''Given a symbol, returns a list of sections containing it or the
+        corresponding thunks. When the given symbol is a thunk, returns the
+        list of sections containing its corresponding normal symbol and the
+        other thunks for that symbol.'''
+        sym = SectionFinder._normalize(symbol)
+        if sym in self.mapping:
+            return self.mapping[sym]
+        return []
+
+    @staticmethod
+    def _normalize(symbol):
+        '''For normal symbols, return the given symbol. For thunks, return
+        the corresponding normal symbol.'''
+        if re.match('^_ZThn[0-9]+_', symbol):
+            return re.sub('^_ZThn[0-9]+_', '_Z', symbol)
+        return symbol
+
+    @staticmethod
+    def _getSymbols(obj):
+        '''Returns a list of (symbol, section) contained in the given object
+        file.'''
+        proc = subprocess.Popen(['objdump', '-t', obj], stdout = subprocess.PIPE, stderr = subprocess.PIPE)
+        (stdout, stderr) = proc.communicate()
+        syms = []
+        for line in stdout.splitlines():
+            # Each line has the following format:
+            # <addr> [lgu!][w ][C ][W ][Ii ][dD ][FfO ] <section>\t<length> <symbol>
+            tmp = line.split(' ',1)
+            # This gives us ["<addr>", "[lgu!][w ][C ][W ][Ii ][dD ][FfO ] <section>\t<length> <symbol>"]
+            # We only need to consider cases where "<section>\t<length> <symbol>" is present,
+            # and where the [FfO] flag is either F (function) or O (object).
+            if len(tmp) > 1 and len(tmp[1]) > 6 and tmp[1][6] in ['O', 'F']:
+                tmp = tmp[1][8:].split()
+                # That gives us ["<section>","<length>", "<symbol>"]
+                syms.append((tmp[-1], tmp[0]))
+        return syms
 
 def main():
     parser = OptionParser()
@@ -153,17 +308,16 @@ def main():
         help="use a list file for objects when executing a command")
     parser.add_option("--verbose", action="store_true", dest="verbose",
         help="display executed command and temporary files content")
-    parser.add_option("--reorder", dest="reorder",
-        help="reorder the objects according to the given list", metavar="FILE")
+    parser.add_option("--symbol-order", dest="symbol_order", metavar="FILE",
+        help="use the given list of symbols to order symbols in the resulting binary when using with a linker")
 
     (options, args) = parser.parse_args()
 
     with ExpandArgsMore(args) as args:
-        if options.extract or options.reorder:
+        if options.extract:
             args.extract()
-        if options.reorder:
-            with open(options.reorder) as file:
-                args.reorder([l.strip() for l in file.readlines()])
+        if options.symbol_order:
+            args.orderSymbols(options.symbol_order)
         if options.uselist:
             args.makelist()
 
diff --git a/config/tests/unit-expandlibs.py b/config/tests/unit-expandlibs.py
index 0582d70c05d..491c95448b1 100644
--- a/config/tests/unit-expandlibs.py
+++ b/config/tests/unit-expandlibs.py
@@ -38,7 +38,7 @@ config = sys.modules['expandlibs_config'] = imp.new_module('expandlibs_config')
 
 from expandlibs import LibDescriptor, ExpandArgs, relativize
 from expandlibs_gen import generate
-from expandlibs_exec import ExpandArgsMore
+from expandlibs_exec import ExpandArgsMore, SectionFinder
 
 def Lib(name):
     return config.LIB_PREFIX + name + config.LIB_SUFFIX
@@ -267,28 +267,101 @@ class TestExpandArgsMore(TestExpandInit):
         # Restore subprocess.call
         subprocess.call = subprocess_call
 
-    def test_reorder(self):
-        '''Test object reordering'''
-        # We don't care about AR_EXTRACT testing, which is done in test_extract
-        config.AR_EXTRACT = ''
+class FakeProcess(object):
+    def __init__(self, out, err = ''):
+        self.out = out
+        self.err = err
 
-        # ExpandArgsMore does the same as ExpandArgs
-        with ExpandArgsMore(['foo', '-bar'] + self.arg_files + [self.tmpfile('liby', Lib('y'))]) as args:
-            self.assertRelEqual(args, ['foo', '-bar'] + self.files + self.liby_files + self.libx_files) 
+    def communicate(self):
+        return (self.out, self.err)
 
-            # Use an order containing object files from libraries
-            order_files = [self.libx_files[1], self.libx_files[0], self.liby_files[2], self.files[1]]
-            order = [os.path.splitext(os.path.basename(f))[0] for f in order_files]
-            args.reorder(order[:2] + ['unknown'] + order[2:])
+OBJDUMPS = {
+'foo.o': '''
+00000000 g     F .text\t00000001 foo
+00000000 g     F .text._Z6foobarv\t00000001 _Z6foobarv
+00000000 g     F .text.hello\t00000001 hello
+00000000 g     F .text._ZThn4_6foobarv\t00000001 _ZThn4_6foobarv
+''',
+'bar.o': '''
+00000000 g     F .text.hi\t00000001 hi
+00000000 g     F .text.hot._Z6barbazv\t00000001 .hidden _Z6barbazv
+''',
+}
+
+PRINT_ICF = '''
+ld: ICF folding section '.text.hello' in file 'foo.o'into '.text.hi' in file 'bar.o'
+ld: ICF folding section '.foo' in file 'foo.o'into '.foo' in file 'bar.o'
+'''
+
+class SubprocessPopen(object):
+    def __init__(self, test):
+        self.test = test
+
+    def __call__(self, args, stdout = None, stderr = None):
+        self.test.assertEqual(stdout, subprocess.PIPE)
+        self.test.assertEqual(stderr, subprocess.PIPE)
+        if args[0] == 'objdump':
+            self.test.assertEqual(args[1], '-t')
+            self.test.assertTrue(args[2] in OBJDUMPS)
+            return FakeProcess(OBJDUMPS[args[2]])
+        else:
+            return FakeProcess('', PRINT_ICF)
+
+class TestSectionFinder(unittest.TestCase):
+    def test_getSections(self):
+        '''Test SectionFinder'''
+        # Divert subprocess.Popen
+        subprocess_popen = subprocess.Popen
+        subprocess.Popen = SubprocessPopen(self)
+        config.EXPAND_LIBS_ORDER_STYLE = 'linkerscript'
+        config.OBJ_SUFFIX = '.o'
+        config.LIB_SUFFIX = '.a'
+        finder = SectionFinder(['foo.o', 'bar.o'])
+        self.assertEqual(finder.getSections('foobar'), [])
+        self.assertEqual(finder.getSections('_Z6barbazv'), ['.text.hot._Z6barbazv'])
+        self.assertEqual(finder.getSections('_Z6foobarv'), ['.text._Z6foobarv', '.text._ZThn4_6foobarv'])
+        self.assertEqual(finder.getSections('_ZThn4_6foobarv'), ['.text._Z6foobarv', '.text._ZThn4_6foobarv'])
+        subprocess.Popen = subprocess_popen
+
+class TestSymbolOrder(unittest.TestCase):
+    def test_getOrderedSections(self):
+        '''Test ExpandMoreArgs' _getOrderedSections'''
+        # Divert subprocess.Popen
+        subprocess_popen = subprocess.Popen
+        subprocess.Popen = SubprocessPopen(self)
+        config.EXPAND_LIBS_ORDER_STYLE = 'linkerscript'
+        config.OBJ_SUFFIX = '.o'
+        config.LIB_SUFFIX = '.a'
+        config.LD_PRINT_ICF_SECTIONS = ''
+        args = ExpandArgsMore(['foo', '-bar', 'bar.o', 'foo.o'])
+        self.assertEqual(args._getOrderedSections(['_Z6foobarv', '_Z6barbazv']), ['.text._Z6foobarv', '.text._ZThn4_6foobarv', '.text.hot._Z6barbazv'])
+        self.assertEqual(args._getOrderedSections(['_ZThn4_6foobarv', '_Z6barbazv']), ['.text._Z6foobarv', '.text._ZThn4_6foobarv', '.text.hot._Z6barbazv'])
+        subprocess.Popen = subprocess_popen
+
+    def test_getFoldedSections(self):
+        '''Test ExpandMoreArgs' _getFoldedSections'''
+        # Divert subprocess.Popen
+        subprocess_popen = subprocess.Popen
+        subprocess.Popen = SubprocessPopen(self)
+        config.LD_PRINT_ICF_SECTIONS = '-Wl,--print-icf-sections'
+        args = ExpandArgsMore(['foo', '-bar', 'bar.o', 'foo.o'])
+        self.assertEqual(args._getFoldedSections(), {'.text.hello': '.text.hi', '.text.hi': ['.text.hello']})
+        subprocess.Popen = subprocess_popen
+
+    def test_getOrderedSectionsWithICF(self):
+        '''Test ExpandMoreArgs' _getOrderedSections, with ICF'''
+        # Divert subprocess.Popen
+        subprocess_popen = subprocess.Popen
+        subprocess.Popen = SubprocessPopen(self)
+        config.EXPAND_LIBS_ORDER_STYLE = 'linkerscript'
+        config.OBJ_SUFFIX = '.o'
+        config.LIB_SUFFIX = '.a'
+        config.LD_PRINT_ICF_SECTIONS = '-Wl,--print-icf-sections'
+        args = ExpandArgsMore(['foo', '-bar', 'bar.o', 'foo.o'])
+        self.assertEqual(args._getOrderedSections(['hello', '_Z6barbazv']), ['.text.hi', '.text.hello', '.text.hot._Z6barbazv'])
+        self.assertEqual(args._getOrderedSections(['_ZThn4_6foobarv', 'hi', '_Z6barbazv']), ['.text._Z6foobarv', '.text._ZThn4_6foobarv', '.text.hi', '.text.hello', '.text.hot._Z6barbazv'])
+        subprocess.Popen = subprocess_popen
 
-            # self.files has objects at #1, #2, #4
-            self.assertRelEqual(args[:3], ['foo', '-bar'] + self.files[:1])
-            self.assertRelEqual(args[3:7], order_files)
-            self.assertRelEqual(args[7:9], [self.files[2], self.files[4]])
-            self.assertRelEqual(args[9:11], self.liby_files[:2])
-            self.assertRelEqual(args[11:12], [self.libx_files[2]])
-            self.assertRelEqual(args[12:14], [self.files[3], self.files[5]])
-            self.assertRelEqual(args[14:], [self.liby_files[3]])
 
 if __name__ == '__main__':
     unittest.main(testRunner=MozTestRunner())
diff --git a/configure.in b/configure.in
index 091841e731d..d1c61263d28 100644
--- a/configure.in
+++ b/configure.in
@@ -1837,6 +1837,33 @@ if test -n "$CLANG_CXX"; then
     _WARNINGS_CXXFLAGS="-Qunused-arguments ${_WARNINGS_CXXFLAGS}"
 fi
 
+dnl ========================================================
+dnl = Use Address Sanitizer
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(address-sanitizer,
+[  --enable-address-sanitizer       Enable Address Sanitizer (default=no)],
+    MOZ_ASAN=1,
+    MOZ_ASAN= )
+if test -n "$MOZ_ASAN"; then
+    MOZ_LLVM_HACKS=1
+    AC_DEFINE(MOZ_ASAN)
+fi
+AC_SUBST(MOZ_ASAN)
+
+dnl ========================================================
+dnl = Enable hacks required for LLVM instrumentations
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(llvm-hacks,
+[  --enable-llvm-hacks       Enable workarounds required for several LLVM instrumentations (default=no)],
+    MOZ_LLVM_HACKS=1,
+    MOZ_LLVM_HACKS= )
+if test -n "$MOZ_LLVM_HACKS"; then
+    MOZ_NO_WLZDEFS=1
+    MOZ_CFLAGS_NSS=1
+fi
+AC_SUBST(MOZ_NO_WLZDEFS)
+AC_SUBST(MOZ_CFLAGS_NSS)
+
 dnl ========================================================
 dnl GNU specific defaults
 dnl ========================================================
@@ -1847,8 +1874,13 @@ if test "$GNU_CC"; then
     MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-h,$@ -o $@'
     DSO_LDOPTS='-shared'
     if test "$GCC_USE_GNU_LD"; then
-        # Don't allow undefined symbols in libraries
-        DSO_LDOPTS="$DSO_LDOPTS -Wl,-z,defs"
+        # Some tools like ASan use a runtime library that is only
+        # linked against executables, so we must allow undefined
+        # symbols for shared objects in some cases.
+        if test -z "$MOZ_NO_WLZDEFS"; then
+            # Don't allow undefined symbols in libraries
+            DSO_LDOPTS="$DSO_LDOPTS -Wl,-z,defs"
+        fi
     fi
     WARNINGS_AS_ERRORS='-Werror -Wno-error=uninitialized'
     DSO_CFLAGS=''
@@ -2492,6 +2524,8 @@ ia64*-hpux*)
     no_x=yes
     if test -n "$gonkdir"; then
         _PLATFORM_DEFAULT_TOOLKIT=cairo-gonk
+        MOZ_B2G_RIL=1
+        MOZ_B2G_BT=1
     else
         _PLATFORM_DEFAULT_TOOLKIT=cairo-android
         MOZ_LINKER=1
@@ -5006,7 +5040,6 @@ cairo-gonk)
     TK_LIBS='$(MOZ_CAIRO_LIBS)'
     MOZ_WEBGL=1
     MOZ_PDF_PRINTING=1
-    MOZ_B2G_RIL=1
     MOZ_TOUCH=1
     ;;
 
@@ -7147,78 +7180,6 @@ if test -n "$MOZ_DEBUG" -o -n "$MOZ_DEBUG_SYMBOLS"; then
     export MOZ_DEBUG_SYMBOLS
 fi
 
-dnl ========================================================
-dnl = Identical Code Folding
-dnl ========================================================
-
-MOZ_ARG_DISABLE_BOOL(icf,
-[  --disable-icf          Disable Identical Code Folding],
-    MOZ_DISABLE_ICF=1,
-    MOZ_DISABLE_ICF= )
-
-if test "$GNU_CC" -a "$GCC_USE_GNU_LD" -a -z "$MOZ_DISABLE_ICF"; then
-    AC_CACHE_CHECK([whether the linker supports Identical Code Folding],
-        LD_SUPPORTS_ICF,
-        [echo 'int foo() {return 42;}' \
-              'int bar() {return 42;}' \
-              'int main() {return foo() - bar();}' > conftest.${ac_ext}
-        # If the linker supports ICF, foo and bar symbols will have
-        # the same address
-        if AC_TRY_COMMAND([${CC-cc} -o conftest${ac_exeext} $LDFLAGS -Wl,--icf=safe -ffunction-sections conftest.${ac_ext} $LIBS 1>&2]) &&
-           test -s conftest${ac_exeext} &&
-           objdump -t conftest${ac_exeext} | awk '{a[[$6]] = $1} END {if (a[["foo"]] && (a[["foo"]] != a[["bar"]])) { exit 1 }}'; then
-            LD_SUPPORTS_ICF=yes
-        else
-            LD_SUPPORTS_ICF=no
-        fi
-        rm -rf conftest*])
-    if test "$LD_SUPPORTS_ICF" = yes; then
-        LDFLAGS="$LDFLAGS -Wl,--icf=safe"
-        CFLAGS="$CFLAGS -ffunction-sections"
-        CXXFLAGS="$CXXFLAGS -ffunction-sections"
-    fi
-fi
-
-dnl ========================================================
-dnl = Automatically remove dead symbols
-dnl ========================================================
-
-if test "$GNU_CC" -a "$GCC_USE_GNU_LD" -a -n "$MOZ_DEBUG_FLAGS"; then
-   dnl See bug 670659
-   AC_CACHE_CHECK([whether removing dead symbols breaks debugging],
-       GC_SECTIONS_BREAKS_DEBUG_RANGES,
-       [echo 'int foo() {return 42;}' \
-             'int bar() {return 1;}' \
-             'int main() {return foo();}' > conftest.${ac_ext}
-        if AC_TRY_COMMAND([${CC-cc} -o conftest.${ac_objext} $CFLAGS $MOZ_DEBUG_FLAGS -ffunction-sections -c conftest.${ac_ext} 1>&2]) &&
-           AC_TRY_COMMAND([${CC-cc} -o conftest${ac_exeext} $LDFLAGS $MOZ_DEBUG_FLAGS -Wl,--gc-sections conftest.${ac_objext} $LIBS 1>&2]) &&
-           test -s conftest${ac_exeext} -a -s conftest.${ac_objext}; then
-            if test "`$PYTHON "$_topsrcdir"/build/unix/check_debug_ranges.py conftest.${ac_objext} conftest.${ac_ext}`" = \
-                    "`$PYTHON "$_topsrcdir"/build/unix/check_debug_ranges.py conftest${ac_exeext} conftest.${ac_ext}`"; then
-                GC_SECTIONS_BREAKS_DEBUG_RANGES=no
-            else
-                GC_SECTIONS_BREAKS_DEBUG_RANGES=yes
-            fi
-        else
-             dnl We really don't expect to get here, but just in case
-             GC_SECTIONS_BREAKS_DEBUG_RANGES="no, but it's broken in some other way"
-        fi
-        rm -rf conftest*])
-    if test "$GC_SECTIONS_BREAKS_DEBUG_RANGES" = no; then
-        DSO_LDOPTS="$DSO_LDOPTS -Wl,--gc-sections"
-        case "$CFLAGS" in
-        *-ffunction-sections*)
-            CFLAGS="$CFLAGS -fdata-sections"
-            CXXFLAGS="$CXXFLAGS -fdata-sections"
-            ;;
-        *)
-            CFLAGS="$CFLAGS -ffunction-sections -fdata-sections"
-            CXXFLAGS="$CXXFLAGS -ffunction-sections -fdata-sections"
-            ;;
-        esac
-    fi
-fi
-
 dnl ========================================================
 dnl = Enable any treating of compile warnings as errors
 dnl ========================================================
@@ -8040,37 +8001,7 @@ fi # ! SKIP_COMPILER_CHECKS
 AC_DEFINE(CPP_THROW_NEW, [throw()])
 AC_LANG_C
 
-dnl ========================================================
-dnl =
-dnl = Check what kind of list files are supported by the
-dnl = linker
-dnl =
-dnl ========================================================
-
-AC_CACHE_CHECK(what kind of list files are supported by the linker,
-    EXPAND_LIBS_LIST_STYLE,
-    [echo "int main() {return 0;}" > conftest.${ac_ext}
-     if AC_TRY_COMMAND(${CC-cc} -o conftest.${OBJ_SUFFIX} -c $CFLAGS $CPPFLAGS conftest.${ac_ext} 1>&2) && test -s conftest.${OBJ_SUFFIX}; then
-         echo "INPUT(conftest.${OBJ_SUFFIX})" > conftest.list
-         if AC_TRY_COMMAND(${CC-cc} -o conftest${ac_exeext} $LDFLAGS conftest.list $LIBS 1>&2) && test -s conftest${ac_exeext}; then
-             EXPAND_LIBS_LIST_STYLE=linkerscript
-         else
-             echo "conftest.${OBJ_SUFFIX}" > conftest.list
-             if AC_TRY_COMMAND(${CC-cc} -o conftest${ac_exeext} $LDFLAGS @conftest.list $LIBS 1>&2) && test -s conftest${ac_exeext}; then
-                 EXPAND_LIBS_LIST_STYLE=list
-             else
-                 EXPAND_LIBS_LIST_STYLE=none
-             fi
-         fi
-     else
-         dnl We really don't expect to get here, but just in case
-         AC_ERROR([couldn't compile a simple C file])
-     fi
-     rm -rf conftest*])
-
-LIBS_DESC_SUFFIX=desc
-AC_SUBST(LIBS_DESC_SUFFIX)
-AC_SUBST(EXPAND_LIBS_LIST_STYLE)
+MOZ_EXPAND_LIBS
 
 dnl ========================================================
 dnl =
diff --git a/content/base/public/Makefile.in b/content/base/public/Makefile.in
index 5a8e717f0c4..3a9f08e5275 100644
--- a/content/base/public/Makefile.in
+++ b/content/base/public/Makefile.in
@@ -65,7 +65,6 @@ nsINodeList.h \
 nsIScriptElement.h \
 nsIStyleSheetLinkingElement.h \
 nsIContentSerializer.h \
-nsIHTMLToTextSink.h \
 nsIXPathEvaluatorInternal.h \
 mozISanitizingSerializer.h \
 nsCaseTreatment.h \
diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
index 89fe3a6e400..4fdfaad807a 100644
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -441,6 +441,16 @@ public:
    */
   static bool IsHTMLWhitespace(PRUnichar aChar);
 
+  /**
+   * Is the HTML local name a block element?
+   */
+  static bool IsHTMLBlock(nsIAtom* aLocalName);
+
+  /**
+   * Is the HTML local name a void element?
+   */
+  static bool IsHTMLVoid(nsIAtom* aLocalName);
+
   /**
    * Parse a margin string of format 'top, right, bottom, left' into
    * an nsIntMargin.
@@ -838,11 +848,22 @@ public:
    * Fill (with the parameters given) the localized string named |aKey| in
    * properties file |aFile|.
    */
+private:
   static nsresult FormatLocalizedString(PropertiesFile aFile,
                                         const char* aKey,
-                                        const PRUnichar **aParams,
+                                        const PRUnichar** aParams,
                                         PRUint32 aParamsLength,
                                         nsXPIDLString& aResult);
+  
+public:
+  template<PRUint32 N>
+  static nsresult FormatLocalizedString(PropertiesFile aFile,
+                                        const char* aKey,
+                                        const PRUnichar* (&aParams)[N],
+                                        nsXPIDLString& aResult)
+  {
+    return FormatLocalizedString(aFile, aKey, aParams, N, aResult);
+  }
 
   /**
    * Returns true if aDocument is a chrome document
diff --git a/content/base/public/nsIHTMLToTextSink.h b/content/base/public/nsIHTMLToTextSink.h
deleted file mode 100644
index 13c7c9d6dae..00000000000
--- a/content/base/public/nsIHTMLToTextSink.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef _nsIPlainTextSink_h__
-#define _nsIPlainTextSink_h__
-
-#include "nsISupports.h"
-#include "nsStringGlue.h"
-
-#define NS_PLAINTEXTSINK_CONTRACTID "@mozilla.org/layout/plaintextsink;1"
-
-/* starting interface:    nsIContentSerializer */
-#define NS_IHTMLTOTEXTSINK_IID_STR "b12b5643-07cb-401e-aabb-64b2dcd2717f"
-
-#define NS_IHTMLTOTEXTSINK_IID \
-  {0xb12b5643, 0x07cb, 0x401e, \
-    { 0xaa, 0xbb, 0x64, 0xb2, 0xdc, 0xd2, 0x71, 0x7f }}
-
-
-class nsIHTMLToTextSink : public nsISupports {
- public: 
-
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IHTMLTOTEXTSINK_IID)
-
-  NS_IMETHOD Initialize(nsAString* aOutString,
-                        PRUint32 aFlags, PRUint32 aWrapCol) = 0;
-     // This function violates string ownership rules, see impl.
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsIHTMLToTextSink, NS_IHTMLTOTEXTSINK_IID)
-
-#endif
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index 9c103340543..3c764c9c32f 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -1190,6 +1190,72 @@ nsContentUtils::IsHTMLWhitespace(PRUnichar aChar)
          aChar == PRUnichar(0x0020);
 }
 
+/* static */
+bool
+nsContentUtils::IsHTMLBlock(nsIAtom* aLocalName)
+{
+  return
+    (aLocalName == nsGkAtoms::address) ||
+    (aLocalName == nsGkAtoms::article) ||
+    (aLocalName == nsGkAtoms::aside) ||
+    (aLocalName == nsGkAtoms::blockquote) ||
+    (aLocalName == nsGkAtoms::center) ||
+    (aLocalName == nsGkAtoms::dir) ||
+    (aLocalName == nsGkAtoms::div) ||
+    (aLocalName == nsGkAtoms::dl) || // XXX why not dt and dd?
+    (aLocalName == nsGkAtoms::fieldset) ||
+    (aLocalName == nsGkAtoms::figure) || // XXX shouldn't figcaption be on this list
+    (aLocalName == nsGkAtoms::footer) ||
+    (aLocalName == nsGkAtoms::form) ||
+    (aLocalName == nsGkAtoms::h1) ||
+    (aLocalName == nsGkAtoms::h2) ||
+    (aLocalName == nsGkAtoms::h3) ||
+    (aLocalName == nsGkAtoms::h4) ||
+    (aLocalName == nsGkAtoms::h5) ||
+    (aLocalName == nsGkAtoms::h6) ||
+    (aLocalName == nsGkAtoms::header) ||
+    (aLocalName == nsGkAtoms::hgroup) ||
+    (aLocalName == nsGkAtoms::hr) ||
+    (aLocalName == nsGkAtoms::li) ||
+    (aLocalName == nsGkAtoms::listing) ||
+    (aLocalName == nsGkAtoms::menu) ||
+    (aLocalName == nsGkAtoms::multicol) || // XXX get rid of this one?
+    (aLocalName == nsGkAtoms::nav) ||
+    (aLocalName == nsGkAtoms::ol) ||
+    (aLocalName == nsGkAtoms::p) ||
+    (aLocalName == nsGkAtoms::pre) ||
+    (aLocalName == nsGkAtoms::section) ||
+    (aLocalName == nsGkAtoms::table) ||
+    (aLocalName == nsGkAtoms::ul) ||
+    (aLocalName == nsGkAtoms::xmp);
+}
+
+/* static */
+bool
+nsContentUtils::IsHTMLVoid(nsIAtom* aLocalName)
+{
+  return
+    (aLocalName == nsGkAtoms::area) ||
+    (aLocalName == nsGkAtoms::base) ||
+    (aLocalName == nsGkAtoms::basefont) ||
+    (aLocalName == nsGkAtoms::bgsound) ||
+    (aLocalName == nsGkAtoms::br) ||
+    (aLocalName == nsGkAtoms::col) ||
+    (aLocalName == nsGkAtoms::command) ||
+    (aLocalName == nsGkAtoms::embed) ||
+    (aLocalName == nsGkAtoms::frame) ||
+    (aLocalName == nsGkAtoms::hr) ||
+    (aLocalName == nsGkAtoms::img) ||
+    (aLocalName == nsGkAtoms::input) ||
+    (aLocalName == nsGkAtoms::keygen) ||
+    (aLocalName == nsGkAtoms::link) ||
+    (aLocalName == nsGkAtoms::meta) ||
+    (aLocalName == nsGkAtoms::param) ||
+    (aLocalName == nsGkAtoms::source) ||
+    (aLocalName == nsGkAtoms::track) ||
+    (aLocalName == nsGkAtoms::wbr);
+}
+
 /* static */
 bool
 nsContentUtils::ParseIntMarginValue(const nsAString& aString, nsIntMargin& result)
diff --git a/content/base/src/nsFrameMessageManager.cpp b/content/base/src/nsFrameMessageManager.cpp
index 179d9af871e..7cc0d44a874 100644
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -43,6 +43,7 @@
 #include "nsIXPConnect.h"
 #include "jsapi.h"
 #include "nsJSUtils.h"
+#include "nsJSPrincipals.h"
 #include "nsNetUtil.h"
 #include "nsScriptLoader.h"
 #include "nsIJSContextStack.h"
@@ -811,15 +812,13 @@ nsFrameScriptExecutor::LoadFrameScriptInternal(const nsAString& aURL)
       JSObject* global = nsnull;
       mGlobal->GetJSObject(&global);
       if (global) {
-        JSPrincipals* jsprin = nsnull;
-        mPrincipal->GetJSPrincipals(mCx, &jsprin);
-
         uint32 oldopts = JS_GetOptions(mCx);
         JS_SetOptions(mCx, oldopts | JSOPTION_NO_SCRIPT_RVAL);
 
         JSScript* script =
-          JS_CompileUCScriptForPrincipals(mCx, nsnull, jsprin,
-                                         (jschar*)dataString.get(),
+          JS_CompileUCScriptForPrincipals(mCx, nsnull,
+                                          nsJSPrincipals::get(mPrincipal),
+                                          static_cast<const jschar*>(dataString.get()),
                                           dataString.Length(),
                                           url.get(), 1);
 
@@ -839,8 +838,6 @@ nsFrameScriptExecutor::LoadFrameScriptInternal(const nsAString& aURL)
           }
           (void) JS_ExecuteScript(mCx, global, script, nsnull);
         }
-        //XXX Argh, JSPrincipals are manually refcounted!
-        JSPRINCIPALS_DROP(mCx, jsprin);
       }
     } 
     JSContext* unused;
diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
index e03df4da2b1..88f1167a93d 100644
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -2736,6 +2736,9 @@ nsGenericElement::RemoveAttribute(const nsAString& aName)
   const nsAttrName* name = InternalGetExistingAttrNameFromQName(aName);
 
   if (!name) {
+    // If there is no canonical nsAttrName for this attribute name, then the
+    // attribute does not exist and we can't get its namespace ID and
+    // local name below, so we return early.
     return NS_OK;
   }
 
@@ -2889,8 +2892,9 @@ nsGenericElement::RemoveAttributeNS(const nsAString& aNamespaceURI,
     nsContentUtils::NameSpaceManager()->GetNameSpaceID(aNamespaceURI);
 
   if (nsid == kNameSpaceID_Unknown) {
-    // Unknown namespace means no attr...
-
+    // If the namespace ID is unknown, it means there can't possibly be an
+    // existing attribute. We would need a known namespace ID to pass into
+    // UnsetAttr, so we return early if we don't have one.
     return NS_OK;
   }
 
diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index 1208809ffad..18578f3a162 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -142,6 +142,7 @@ GK_ATOM(before_end, "before_end")
 GK_ATOM(before_start, "before_start")
 GK_ATOM(below, "below")
 GK_ATOM(bgcolor, "bgcolor")
+GK_ATOM(bgsound, "bgsound")
 GK_ATOM(big, "big")
 GK_ATOM(binding, "binding")
 GK_ATOM(bindings, "bindings")
@@ -493,6 +494,7 @@ GK_ATOM(keepcurrentinview, "keepcurrentinview")
 GK_ATOM(key, "key")
 GK_ATOM(keycode, "keycode")
 GK_ATOM(keydown, "keydown")
+GK_ATOM(keygen, "keygen")
 GK_ATOM(keypress, "keypress")
 GK_ATOM(keyset, "keyset")
 GK_ATOM(keytext, "keytext")
diff --git a/content/base/src/nsGkAtoms.cpp b/content/base/src/nsGkAtoms.cpp
index c0c70357f01..30294e21069 100644
--- a/content/base/src/nsGkAtoms.cpp
+++ b/content/base/src/nsGkAtoms.cpp
@@ -65,6 +65,6 @@ static const nsStaticAtom GkAtoms_info[] = {
 
 void nsGkAtoms::AddRefAtoms()
 {
-  NS_RegisterStaticAtoms(GkAtoms_info, ArrayLength(GkAtoms_info));
+  NS_RegisterStaticAtoms(GkAtoms_info);
 }
 
diff --git a/content/base/src/nsPlainTextSerializer.cpp b/content/base/src/nsPlainTextSerializer.cpp
index c6799f73032..27ccb56fa27 100644
--- a/content/base/src/nsPlainTextSerializer.cpp
+++ b/content/base/src/nsPlainTextSerializer.cpp
@@ -53,7 +53,6 @@
 #include "nsReadableUtils.h"
 #include "nsUnicharUtils.h"
 #include "nsCRT.h"
-#include "nsIParserService.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/Preferences.h"
 
@@ -79,7 +78,7 @@ static const  PRInt32 kIndentSizeDD = kTabSize;  // Indention of <dd>
 static const  PRUnichar  kNBSP = 160;
 static const  PRUnichar kSPACE = ' ';
 
-static PRInt32 HeaderLevel(eHTMLTags aTag);
+static PRInt32 HeaderLevel(nsIAtom* aTag);
 static PRInt32 GetUnicharWidth(PRUnichar ucs);
 static PRInt32 GetUnicharStringWidth(const PRUnichar* pwcs, PRInt32 n);
 
@@ -126,7 +125,9 @@ nsPlainTextSerializer::nsPlainTextSerializer()
   mStartedOutput = false;
 
   // initialize the tag stack to zero:
-  mTagStack = new nsHTMLTag[TagStackSize];
+  // The stack only ever contains pointers to static atoms, so they don't
+  // need refcounting.
+  mTagStack = new nsIAtom*[TagStackSize];
   mTagStackIndex = 0;
   mIgnoreAboveIndex = (PRUint32)kNotFound;
 
@@ -144,11 +145,8 @@ nsPlainTextSerializer::~nsPlainTextSerializer()
   NS_WARN_IF_FALSE(mHeadLevel == 0, "Wrong head level!");
 }
 
-NS_IMPL_ISUPPORTS4(nsPlainTextSerializer, 
-                   nsIContentSerializer,
-                   nsIContentSink,
-                   nsIHTMLContentSink,
-                   nsIHTMLToTextSink)
+NS_IMPL_ISUPPORTS1(nsPlainTextSerializer,
+                   nsIContentSerializer)
 
 
 NS_IMETHODIMP 
@@ -158,20 +156,18 @@ nsPlainTextSerializer::Init(PRUint32 aFlags, PRUint32 aWrapColumn,
 {
 #ifdef DEBUG
   // Check if the major control flags are set correctly.
-  if(aFlags & nsIDocumentEncoder::OutputFormatFlowed) {
+  if (aFlags & nsIDocumentEncoder::OutputFormatFlowed) {
     NS_ASSERTION(aFlags & nsIDocumentEncoder::OutputFormatted,
                  "If you want format=flowed, you must combine it with "
                  "nsIDocumentEncoder::OutputFormatted");
   }
 
-  if(aFlags & nsIDocumentEncoder::OutputFormatted) {
+  if (aFlags & nsIDocumentEncoder::OutputFormatted) {
     NS_ASSERTION(!(aFlags & nsIDocumentEncoder::OutputPreformatted),
                  "Can't do formatted and preformatted output at the same time!");
   }
 #endif
 
-  NS_ENSURE_TRUE(nsContentUtils::GetParserService(), NS_ERROR_UNEXPECTED);
-
   mFlags = aFlags;
   mWrapColumn = aWrapColumn;
 
@@ -270,21 +266,6 @@ nsPlainTextSerializer::PopBool(nsTArray<bool>& aStack)
   return returnValue;
 }
 
-NS_IMETHODIMP
-nsPlainTextSerializer::Initialize(nsAString* aOutString,
-                                  PRUint32 aFlags, PRUint32 aWrapCol)
-{
-  nsresult rv = Init(aFlags, aWrapCol, nsnull, false, false);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // XXX This is wrong. It violates XPCOM string ownership rules.
-  // We're only getting away with this because instances of this
-  // class are restricted to single function scope.
-  mOutputString = aOutString;
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP 
 nsPlainTextSerializer::AppendText(nsIContent* aText,
                                   PRInt32 aStartOffset,
@@ -335,31 +316,26 @@ nsPlainTextSerializer::AppendText(nsIContent* aText,
   PRInt32 offset = textstr.FindCharInSet("\n\r");
   while (offset != kNotFound) {
 
-    if(offset>start) {
+    if (offset>start) {
       // Pass in the line
-      rv = DoAddLeaf(nsnull,
-                     eHTMLTag_text,
-                     Substring(textstr, start, offset-start));
-      if (NS_FAILED(rv)) break;
+      DoAddText(false,
+                Substring(textstr, start, offset-start));
     }
 
     // Pass in a newline
-    rv = DoAddLeaf(nsnull, eHTMLTag_newline, mLineBreak);
-    if (NS_FAILED(rv)) break;
+    DoAddText(true, mLineBreak);
     
     start = offset+1;
     offset = textstr.FindCharInSet("\n\r", start);
   }
 
   // Consume the last bit of the string if there's any left
-  if (NS_SUCCEEDED(rv) && start < length) {
+  if (start < length) {
     if (start) {
-      rv = DoAddLeaf(nsnull,
-                     eHTMLTag_text,
-                     Substring(textstr, start, length-start));
+      DoAddText(false, Substring(textstr, start, length - start));
     }
     else {
-      rv = DoAddLeaf(nsnull, eHTMLTag_text, textstr);
+      DoAddText(false, textstr);
     }
   }
   
@@ -387,23 +363,23 @@ nsPlainTextSerializer::AppendElementStart(Element* aElement,
   mElement = aElement;
 
   nsresult rv;
-  PRInt32 id = GetIdForContent(mElement);
+  nsIAtom* id = GetIdForContent(mElement);
 
-  bool isContainer = IsContainer(id);
+  bool isContainer = !nsContentUtils::IsHTMLVoid(id);
 
   mOutputString = &aStr;
 
   if (isContainer) {
-    rv = DoOpenContainer(nsnull, id);
+    rv = DoOpenContainer(id);
   }
   else {
-    rv = DoAddLeaf(nsnull, id, EmptyString());
+    rv = DoAddLeaf(id);
   }
 
   mElement = nsnull;
   mOutputString = nsnull;
 
-  if (id == eHTMLTag_head) {
+  if (id == nsGkAtoms::head) {
     ++mHeadLevel;
   }
 
@@ -419,9 +395,9 @@ nsPlainTextSerializer::AppendElementEnd(Element* aElement,
   mElement = aElement;
 
   nsresult rv;
-  PRInt32 id = GetIdForContent(mElement);
+  nsIAtom* id = GetIdForContent(mElement);
 
-  bool isContainer = IsContainer(id);
+  bool isContainer = !nsContentUtils::IsHTMLVoid(id);
 
   mOutputString = &aStr;
 
@@ -433,7 +409,7 @@ nsPlainTextSerializer::AppendElementEnd(Element* aElement,
   mElement = nsnull;
   mOutputString = nsnull;
 
-  if (id == eHTMLTag_head) {
+  if (id == nsGkAtoms::head) {
     --mHeadLevel;
     NS_ASSERTION(mHeadLevel >= 0, "mHeadLevel < 0");
   }
@@ -457,89 +433,8 @@ nsPlainTextSerializer::AppendDocumentStart(nsIDocument *aDocument,
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsPlainTextSerializer::OpenContainer(const nsIParserNode& aNode)
-{
-  PRInt32 type = aNode.GetNodeType();
-
-  if (type == eHTMLTag_head) {
-    ++mHeadLevel;
-    return NS_OK;
-  }
-
-  return DoOpenContainer(&aNode, type);
-}
-
-NS_IMETHODIMP 
-nsPlainTextSerializer::CloseContainer(const nsHTMLTag aTag)
-{
-  if (aTag == eHTMLTag_head) {
-    --mHeadLevel;
-    NS_ASSERTION(mHeadLevel >= 0, "mHeadLevel < 0");
-    return NS_OK;
-  }
-
-  return DoCloseContainer(aTag);
-}
-
-NS_IMETHODIMP 
-nsPlainTextSerializer::AddLeaf(const nsIParserNode& aNode)
-{
-  if (mIgnoreAboveIndex != (PRUint32)kNotFound) {
-    return NS_OK;
-  }
-
-  eHTMLTags type = (eHTMLTags)aNode.GetNodeType();
-  const nsAString& text = aNode.GetText();
-
-  if ((type == eHTMLTag_text) ||
-      (type == eHTMLTag_whitespace) ||
-      (type == eHTMLTag_newline)) {
-    // Copy the text out, stripping out CRs
-    nsAutoString str;
-    PRUint32 length;
-    str.SetCapacity(text.Length());
-    nsReadingIterator<PRUnichar> srcStart, srcEnd;
-    length = nsContentUtils::CopyNewlineNormalizedUnicodeTo(text.BeginReading(srcStart), text.EndReading(srcEnd), str);
-    str.SetLength(length);
-    return DoAddLeaf(&aNode, type, str);
-  }
-  else {
-    return DoAddLeaf(&aNode, type, text);
-  }
-}
-
-NS_IMETHODIMP 
-nsPlainTextSerializer::OpenHead()
-{
-  ++mHeadLevel;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsPlainTextSerializer::IsEnabled(PRInt32 aTag, bool* aReturn)
-{
-  nsHTMLTag theHTMLTag = nsHTMLTag(aTag);
-
-  if (theHTMLTag == eHTMLTag_script) {
-    *aReturn = !(mFlags & nsIDocumentEncoder::OutputNoScriptContent);
-  }
-  else if (theHTMLTag == eHTMLTag_frameset) {
-    *aReturn = !(mFlags & nsIDocumentEncoder::OutputNoFramesContent);
-  }
-  else {
-    *aReturn = false;
-  }
-
-  return NS_OK;
-}
-
-/**
- * aNode may be null when we're working with the DOM, but then mElement is
- * useable instead.
- */
 nsresult
-nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
+nsPlainTextSerializer::DoOpenContainer(nsIAtom* aTag)
 {
   if (mFlags & nsIDocumentEncoder::OutputRaw) {
     // Raw means raw.  Don't even think about doing anything fancy
@@ -550,10 +445,8 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
     return NS_OK;
   }
 
-  eHTMLTags type = (eHTMLTags)aTag;
-
   if (mTagStackIndex < TagStackSize) {
-    mTagStack[mTagStackIndex++] = type;
+    mTagStack[mTagStackIndex++] = aTag;
   }
 
   if (mIgnoreAboveIndex != (PRUint32)kNotFound) {
@@ -562,15 +455,16 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
 
   // Reset this so that <blockquote type=cite> doesn't affect the whitespace
   // above random <pre>s below it.
-  mHasWrittenCiteBlockquote = mHasWrittenCiteBlockquote && aTag == eHTMLTag_pre;
+  mHasWrittenCiteBlockquote = mHasWrittenCiteBlockquote &&
+                              aTag == nsGkAtoms::pre;
 
   bool isInCiteBlockquote = false;
 
   // XXX special-case <blockquote type=cite> so that we don't add additional
   // newlines before the text.
-  if (aTag == eHTMLTag_blockquote) {
+  if (aTag == nsGkAtoms::blockquote) {
     nsAutoString value;
-    nsresult rv = GetAttributeValue(aNode, nsGkAtoms::type, value);
+    nsresult rv = GetAttributeValue(nsGkAtoms::type, value);
     isInCiteBlockquote = NS_SUCCEEDED(rv) && value.EqualsIgnoreCase("cite");
   }
 
@@ -578,9 +472,9 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
     EnsureVerticalSpace(mFloatingLines);
 
   // Check if this tag's content that should not be output
-  if ((type == eHTMLTag_noscript &&
+  if ((aTag == nsGkAtoms::noscript &&
        !(mFlags & nsIDocumentEncoder::OutputNoScriptContent)) ||
-      ((type == eHTMLTag_iframe || type == eHTMLTag_noframes) &&
+      ((aTag == nsGkAtoms::iframe || aTag == nsGkAtoms::noframes) &&
        !(mFlags & nsIDocumentEncoder::OutputNoFramesContent))) {
     // Ignore everything that follows the current tag in 
     // question until a matching end tag is encountered.
@@ -588,7 +482,7 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
     return NS_OK;
   }
 
-  if (type == eHTMLTag_body) {
+  if (aTag == nsGkAtoms::body) {
     // Try to figure out here whether we have a
     // preformatted style attribute.
     //
@@ -599,7 +493,7 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
     // (which arguably we should only do if told to do so).
     nsAutoString style;
     PRInt32 whitespace;
-    if(NS_SUCCEEDED(GetAttributeValue(aNode, nsGkAtoms::style, style)) &&
+    if (NS_SUCCEEDED(GetAttributeValue(nsGkAtoms::style, style)) &&
        (kNotFound != (whitespace = style.Find("white-space:")))) {
 
       if (kNotFound != style.Find("pre-wrap", true, whitespace)) {
@@ -652,9 +546,9 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
     return NS_OK;
   }
 
-  if (type == eHTMLTag_p)
+  if (aTag == nsGkAtoms::p)
     EnsureVerticalSpace(1);
-  else if (type == eHTMLTag_pre) {
+  else if (aTag == nsGkAtoms::pre) {
     if (GetLastBool(mIsInCiteBlockquote))
       EnsureVerticalSpace(0);
     else if (mHasWrittenCiteBlockquote) {
@@ -664,10 +558,10 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
     else
       EnsureVerticalSpace(1);
   }
-  else if (type == eHTMLTag_tr) {
+  else if (aTag == nsGkAtoms::tr) {
     PushBool(mHasWrittenCellsForRow, false);
   }
-  else if (type == eHTMLTag_td || type == eHTMLTag_th) {
+  else if (aTag == nsGkAtoms::td || aTag == nsGkAtoms::th) {
     // We must make sure that the content of two table cells get a
     // space between them.
 
@@ -687,21 +581,21 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
       SetLastBool(mHasWrittenCellsForRow, true);
     }
   }
-  else if (type == eHTMLTag_ul) {
+  else if (aTag == nsGkAtoms::ul) {
     // Indent here to support nested lists, which aren't included in li :-(
     EnsureVerticalSpace(mULCount + mOLStackIndex == 0 ? 1 : 0);
          // Must end the current line before we change indention
     mIndent += kIndentSizeList;
     mULCount++;
   }
-  else if (type == eHTMLTag_ol) {
+  else if (aTag == nsGkAtoms::ol) {
     EnsureVerticalSpace(mULCount + mOLStackIndex == 0 ? 1 : 0);
     if (mFlags & nsIDocumentEncoder::OutputFormatted) {
       // Must end the current line before we change indention
       if (mOLStackIndex < OLStackSize) {
         nsAutoString startAttr;
         PRInt32 startVal = 1;
-        if(NS_SUCCEEDED(GetAttributeValue(aNode, nsGkAtoms::start, startAttr))){
+        if (NS_SUCCEEDED(GetAttributeValue(nsGkAtoms::start, startAttr))) {
           PRInt32 rv = 0;
           startVal = startAttr.ToInteger(&rv);
           if (NS_FAILED(rv))
@@ -714,12 +608,12 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
     }
     mIndent += kIndentSizeList;  // see ul
   }
-  else if (type == eHTMLTag_li &&
+  else if (aTag == nsGkAtoms::li &&
            (mFlags & nsIDocumentEncoder::OutputFormatted)) {
     if (mTagStackIndex > 1 && IsInOL()) {
       if (mOLStackIndex > 0) {
         nsAutoString valueAttr;
-        if(NS_SUCCEEDED(GetAttributeValue(aNode, nsGkAtoms::value, valueAttr))){
+        if (NS_SUCCEEDED(GetAttributeValue(nsGkAtoms::value, valueAttr))) {
           PRInt32 rv = 0;
           PRInt32 valueAttrVal = valueAttr.ToInteger(&rv);
           if (NS_SUCCEEDED(rv))
@@ -744,20 +638,20 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
 
     mInIndentString.Append(PRUnichar(' '));
   }
-  else if (type == eHTMLTag_dl) {
+  else if (aTag == nsGkAtoms::dl) {
     EnsureVerticalSpace(1);
   }
-  else if (type == eHTMLTag_dt) {
+  else if (aTag == nsGkAtoms::dt) {
     EnsureVerticalSpace(0);
   }
-  else if (type == eHTMLTag_dd) {
+  else if (aTag == nsGkAtoms::dd) {
     EnsureVerticalSpace(0);
     mIndent += kIndentSizeDD;
   }
-  else if (type == eHTMLTag_span) {
+  else if (aTag == nsGkAtoms::span) {
     ++mSpanLevel;
   }
-  else if (type == eHTMLTag_blockquote) {
+  else if (aTag == nsGkAtoms::blockquote) {
     // Push
     PushBool(mIsInCiteBlockquote, isInCiteBlockquote);
     if (isInCiteBlockquote) {
@@ -769,13 +663,13 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
       mIndent += kTabSize; // Check for some maximum value?
     }
   }
-  else if (type == eHTMLTag_q) {
+  else if (aTag == nsGkAtoms::q) {
     Write(NS_LITERAL_STRING("\""));
   }
 
   // Else make sure we'll separate block level tags,
   // even if we're about to leave, before doing any other formatting.
-  else if (IsBlockLevel(aTag)) {
+  else if (nsContentUtils::IsHTMLBlock(aTag)) {
     EnsureVerticalSpace(0);
   }
 
@@ -789,18 +683,17 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
   //////////////////////////////////////////////////////////////
 
   // Push on stack
-  bool currentNodeIsConverted = IsCurrentNodeConverted(aNode);
-  PushBool(mCurrentNodeIsConverted, currentNodeIsConverted);
+  bool currentNodeIsConverted = IsCurrentNodeConverted();
 
-  if (type == eHTMLTag_h1 || type == eHTMLTag_h2 ||
-      type == eHTMLTag_h3 || type == eHTMLTag_h4 ||
-      type == eHTMLTag_h5 || type == eHTMLTag_h6)
+  if (aTag == nsGkAtoms::h1 || aTag == nsGkAtoms::h2 ||
+      aTag == nsGkAtoms::h3 || aTag == nsGkAtoms::h4 ||
+      aTag == nsGkAtoms::h5 || aTag == nsGkAtoms::h6)
   {
     EnsureVerticalSpace(2);
     if (mHeaderStrategy == 2) {  // numbered
       mIndent += kIndentSizeHeaders;
       // Caching
-      PRInt32 level = HeaderLevel(type);
+      PRInt32 level = HeaderLevel(aTag);
       // Increase counter for current level
       mHeaderCounter[level]++;
       // Reset all lower levels
@@ -821,37 +714,37 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
     }
     else if (mHeaderStrategy == 1) { // indent increasingly
       mIndent += kIndentSizeHeaders;
-      for (PRInt32 i = HeaderLevel(type); i > 1; i--) {
+      for (PRInt32 i = HeaderLevel(aTag); i > 1; i--) {
            // for h(x), run x-1 times
         mIndent += kIndentIncrementHeaders;
       }
     }
   }
-  else if (type == eHTMLTag_a && !currentNodeIsConverted) {
+  else if (aTag == nsGkAtoms::a && !currentNodeIsConverted) {
     nsAutoString url;
-    if (NS_SUCCEEDED(GetAttributeValue(aNode, nsGkAtoms::href, url))
+    if (NS_SUCCEEDED(GetAttributeValue(nsGkAtoms::href, url))
         && !url.IsEmpty()) {
       mURL = url;
     }
   }
-  else if (type == eHTMLTag_sup && mStructs && !currentNodeIsConverted) {
+  else if (aTag == nsGkAtoms::sup && mStructs && !currentNodeIsConverted) {
     Write(NS_LITERAL_STRING("^"));
   }
-  else if (type == eHTMLTag_sub && mStructs && !currentNodeIsConverted) { 
+  else if (aTag == nsGkAtoms::sub && mStructs && !currentNodeIsConverted) {
     Write(NS_LITERAL_STRING("_"));
   }
-  else if (type == eHTMLTag_code && mStructs && !currentNodeIsConverted) {
+  else if (aTag == nsGkAtoms::code && mStructs && !currentNodeIsConverted) {
     Write(NS_LITERAL_STRING("|"));
   }
-  else if ((type == eHTMLTag_strong || type == eHTMLTag_b)
+  else if ((aTag == nsGkAtoms::strong || aTag == nsGkAtoms::b)
            && mStructs && !currentNodeIsConverted) {
     Write(NS_LITERAL_STRING("*"));
   }
-  else if ((type == eHTMLTag_em || type == eHTMLTag_i)
+  else if ((aTag == nsGkAtoms::em || aTag == nsGkAtoms::i)
            && mStructs && !currentNodeIsConverted) {
     Write(NS_LITERAL_STRING("/"));
   }
-  else if (type == eHTMLTag_u && mStructs && !currentNodeIsConverted) {
+  else if (aTag == nsGkAtoms::u && mStructs && !currentNodeIsConverted) {
     Write(NS_LITERAL_STRING("_"));
   }
 
@@ -866,7 +759,7 @@ nsPlainTextSerializer::DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag)
 }
 
 nsresult
-nsPlainTextSerializer::DoCloseContainer(PRInt32 aTag)
+nsPlainTextSerializer::DoCloseContainer(nsIAtom* aTag)
 {
   if (mFlags & nsIDocumentEncoder::OutputRaw) {
     // Raw means raw.  Don't even think about doing anything fancy
@@ -891,9 +784,8 @@ nsPlainTextSerializer::DoCloseContainer(PRInt32 aTag)
     return NS_OK;
   }
 
-  eHTMLTags type = (eHTMLTags)aTag;
   // End current line if we're ending a block level tag
-  if((type == eHTMLTag_body) || (type == eHTMLTag_html)) {
+  if ((aTag == nsGkAtoms::body) || (aTag == nsGkAtoms::html)) {
     // We want the output to end with a new line,
     // but in preformatted areas like text fields,
     // we can't emit newlines that weren't there.
@@ -914,26 +806,26 @@ nsPlainTextSerializer::DoCloseContainer(PRInt32 aTag)
     return NS_OK;
   }
 
-  if (type == eHTMLTag_tr) {
+  if (aTag == nsGkAtoms::tr) {
     PopBool(mHasWrittenCellsForRow);
     // Should always end a line, but get no more whitespace
     if (mFloatingLines < 0)
       mFloatingLines = 0;
     mLineBreakDue = true;
   }
-  else if (((type == eHTMLTag_li) ||
-            (type == eHTMLTag_dt)) &&
+  else if (((aTag == nsGkAtoms::li) ||
+            (aTag == nsGkAtoms::dt)) &&
            (mFlags & nsIDocumentEncoder::OutputFormatted)) {
     // Items that should always end a line, but get no more whitespace
     if (mFloatingLines < 0)
       mFloatingLines = 0;
     mLineBreakDue = true;
   }
-  else if (type == eHTMLTag_pre) {
+  else if (aTag == nsGkAtoms::pre) {
     mFloatingLines = GetLastBool(mIsInCiteBlockquote) ? 0 : 1;
     mLineBreakDue = true;
   }
-  else if (type == eHTMLTag_ul) {
+  else if (aTag == nsGkAtoms::ul) {
     FlushLine();
     mIndent -= kIndentSizeList;
     if (--mULCount + mOLStackIndex == 0) {
@@ -941,7 +833,7 @@ nsPlainTextSerializer::DoCloseContainer(PRInt32 aTag)
       mLineBreakDue = true;
     }
   }
-  else if (type == eHTMLTag_ol) {
+  else if (aTag == nsGkAtoms::ol) {
     FlushLine(); // Doing this after decreasing OLStackIndex would be wrong.
     mIndent -= kIndentSizeList;
     NS_ASSERTION(mOLStackIndex, "Wrong OLStack level!");
@@ -951,24 +843,24 @@ nsPlainTextSerializer::DoCloseContainer(PRInt32 aTag)
       mLineBreakDue = true;
     }
   }  
-  else if (type == eHTMLTag_dl) {
+  else if (aTag == nsGkAtoms::dl) {
     mFloatingLines = 1;
     mLineBreakDue = true;
   }
-  else if (type == eHTMLTag_dd) {
+  else if (aTag == nsGkAtoms::dd) {
     FlushLine();
     mIndent -= kIndentSizeDD;
   }
-  else if (type == eHTMLTag_span) {
+  else if (aTag == nsGkAtoms::span) {
     NS_ASSERTION(mSpanLevel, "Span level will be negative!");
     --mSpanLevel;
   }
-  else if (type == eHTMLTag_div) {
+  else if (aTag == nsGkAtoms::div) {
     if (mFloatingLines < 0)
       mFloatingLines = 0;
     mLineBreakDue = true;
   }
-  else if (type == eHTMLTag_blockquote) {
+  else if (aTag == nsGkAtoms::blockquote) {
     FlushLine();    // Is this needed?
 
     // Pop
@@ -986,13 +878,11 @@ nsPlainTextSerializer::DoCloseContainer(PRInt32 aTag)
     }
     mLineBreakDue = true;
   }
-  else if (type == eHTMLTag_q) {
+  else if (aTag == nsGkAtoms::q) {
     Write(NS_LITERAL_STRING("\""));
   }
-  else if (IsBlockLevel(aTag)
-           && type != eHTMLTag_script
-           && type != eHTMLTag_doctypeDecl
-           && type != eHTMLTag_markupDecl) {
+  else if (nsContentUtils::IsHTMLBlock(aTag)
+           && aTag != nsGkAtoms::script) {
     // All other blocks get 1 vertical space after them
     // in formatted mode, otherwise 0.
     // This is hard. Sometimes 0 is a better number, but
@@ -1016,24 +906,24 @@ nsPlainTextSerializer::DoCloseContainer(PRInt32 aTag)
   //////////////////////////////////////////////////////////////
 
   // Pop the currentConverted stack
-  bool currentNodeIsConverted = PopBool(mCurrentNodeIsConverted);
+  bool currentNodeIsConverted = IsCurrentNodeConverted();
   
-  if (type == eHTMLTag_h1 || type == eHTMLTag_h2 ||
-      type == eHTMLTag_h3 || type == eHTMLTag_h4 ||
-      type == eHTMLTag_h5 || type == eHTMLTag_h6) {
+  if (aTag == nsGkAtoms::h1 || aTag == nsGkAtoms::h2 ||
+      aTag == nsGkAtoms::h3 || aTag == nsGkAtoms::h4 ||
+      aTag == nsGkAtoms::h5 || aTag == nsGkAtoms::h6) {
     
     if (mHeaderStrategy) {  /*numbered or indent increasingly*/ 
       mIndent -= kIndentSizeHeaders;
     }
     if (mHeaderStrategy == 1 /*indent increasingly*/ ) {
-      for (PRInt32 i = HeaderLevel(type); i > 1; i--) {
+      for (PRInt32 i = HeaderLevel(aTag); i > 1; i--) {
            // for h(x), run x-1 times
         mIndent -= kIndentIncrementHeaders;
       }
     }
     EnsureVerticalSpace(1);
   }
-  else if (type == eHTMLTag_a && !currentNodeIsConverted && !mURL.IsEmpty()) {
+  else if (aTag == nsGkAtoms::a && !currentNodeIsConverted && !mURL.IsEmpty()) {
     nsAutoString temp; 
     temp.AssignLiteral(" <");
     temp += mURL;
@@ -1041,122 +931,124 @@ nsPlainTextSerializer::DoCloseContainer(PRInt32 aTag)
     Write(temp);
     mURL.Truncate();
   }
-  else if ((type == eHTMLTag_sup || type == eHTMLTag_sub) 
+  else if ((aTag == nsGkAtoms::sup || aTag == nsGkAtoms::sub)
            && mStructs && !currentNodeIsConverted) {
     Write(kSpace);
   }
-  else if (type == eHTMLTag_code && mStructs && !currentNodeIsConverted) {
+  else if (aTag == nsGkAtoms::code && mStructs && !currentNodeIsConverted) {
     Write(NS_LITERAL_STRING("|"));
   }
-  else if ((type == eHTMLTag_strong || type == eHTMLTag_b)
+  else if ((aTag == nsGkAtoms::strong || aTag == nsGkAtoms::b)
            && mStructs && !currentNodeIsConverted) {
     Write(NS_LITERAL_STRING("*"));
   }
-  else if ((type == eHTMLTag_em || type == eHTMLTag_i)
+  else if ((aTag == nsGkAtoms::em || aTag == nsGkAtoms::i)
            && mStructs && !currentNodeIsConverted) {
     Write(NS_LITERAL_STRING("/"));
   }
-  else if (type == eHTMLTag_u && mStructs && !currentNodeIsConverted) {
+  else if (aTag == nsGkAtoms::u && mStructs && !currentNodeIsConverted) {
     Write(NS_LITERAL_STRING("_"));
   }
 
   return NS_OK;
 }
 
-/**
- * aNode may be null when we're working with the DOM, but then mElement is
- * useable instead.
- */
-nsresult
-nsPlainTextSerializer::DoAddLeaf(const nsIParserNode *aNode, PRInt32 aTag, 
-                                 const nsAString& aText)
+bool
+nsPlainTextSerializer::MustSuppressLeaf()
 {
-  // If we don't want any output, just return
-  if (!DoOutput()) {
-    return NS_OK;
-  }
-
-  if (aTag != eHTMLTag_whitespace && aTag != eHTMLTag_newline) {
-    // Make sure to reset this, since it's no longer true.
-    mHasWrittenCiteBlockquote = false;
-  }
-  
-  if (mLineBreakDue)
-    EnsureVerticalSpace(mFloatingLines);
-
-  eHTMLTags type = (eHTMLTags)aTag;
-  
   if ((mTagStackIndex > 1 &&
-       mTagStack[mTagStackIndex-2] == eHTMLTag_select) ||
+       mTagStack[mTagStackIndex-2] == nsGkAtoms::select) ||
       (mTagStackIndex > 0 &&
-        mTagStack[mTagStackIndex-1] == eHTMLTag_select)) {
+        mTagStack[mTagStackIndex-1] == nsGkAtoms::select)) {
     // Don't output the contents of SELECT elements;
     // Might be nice, eventually, to output just the selected element.
     // Read more in bug 31994.
-    return NS_OK;
+    return true;
   }
-  else if (mTagStackIndex > 0 &&
-           (mTagStack[mTagStackIndex-1] == eHTMLTag_script ||
-            mTagStack[mTagStackIndex-1] == eHTMLTag_style)) {
+
+  if (mTagStackIndex > 0 &&
+      (mTagStack[mTagStackIndex-1] == nsGkAtoms::script ||
+       mTagStack[mTagStackIndex-1] == nsGkAtoms::style)) {
     // Don't output the contents of <script> or <style> tags;
-    return NS_OK;
+    return true;
   }
-  else if (type == eHTMLTag_text) {
-    /* Check, if we are in a link (symbolized with mURL containing the URL)
-       and the text is equal to the URL. In that case we don't want to output
-       the URL twice so we scrap the text in mURL. */
-    if (!mURL.IsEmpty() && mURL.Equals(aText)) {
-      mURL.Truncate();
-    }
-    Write(aText);
+
+  return false;
+}
+
+void
+nsPlainTextSerializer::DoAddText(bool aIsLineBreak, const nsAString& aText)
+{
+  // If we don't want any output, just return
+  if (!DoOutput()) {
+    return;
   }
-  else if (type == eHTMLTag_entity) {
-    nsIParserService* parserService = nsContentUtils::GetParserService();
-    if (parserService) {
-      nsAutoString str(aText);
-      PRInt32 entity;
-      parserService->HTMLConvertEntityToUnicode(str, &entity);
-      if (entity == -1 && 
-          !str.IsEmpty() &&
-          str.First() == (PRUnichar) '#') {
-        PRInt32 err = 0;
-        entity = str.ToInteger(&err, kAutoDetect);  // NCR
-      }
-      nsAutoString temp;
-      temp.Append(PRUnichar(entity));
-      Write(temp);
-    }
+
+  if (!aIsLineBreak) {
+    // Make sure to reset this, since it's no longer true.
+    mHasWrittenCiteBlockquote = false;
   }
-  else if (type == eHTMLTag_br) {
-    // Another egregious editor workaround, see bug 38194:
-    // ignore the bogus br tags that the editor sticks here and there.
-    nsAutoString typeAttr;
-    if (NS_FAILED(GetAttributeValue(aNode, nsGkAtoms::type, typeAttr))
-        || !typeAttr.EqualsLiteral("_moz")) {
-      EnsureVerticalSpace(mEmptyLines+1);
-    }
+
+  if (mLineBreakDue)
+    EnsureVerticalSpace(mFloatingLines);
+
+  if (MustSuppressLeaf()) {
+    return;
   }
-  else if (type == eHTMLTag_whitespace || type == eHTMLTag_newline) {
+
+  if (aIsLineBreak) {
     // The only times we want to pass along whitespace from the original
     // html source are if we're forced into preformatted mode via flags,
     // or if we're prettyprinting and we're inside a <pre>.
     // Otherwise, either we're collapsing to minimal text, or we're
     // prettyprinting to mimic the html format, and in neither case
     // does the formatting of the html source help us.
-    if (mFlags & nsIDocumentEncoder::OutputPreformatted ||
+    if ((mFlags & nsIDocumentEncoder::OutputPreformatted) ||
         (mPreFormatted && !mWrapColumn) ||
         IsInPre()) {
-      if (type == eHTMLTag_newline)
-        EnsureVerticalSpace(mEmptyLines+1);
-      else  
-        Write(aText);
+      EnsureVerticalSpace(mEmptyLines+1);
     }
-    else if(!mInWhitespace) {
+    else if (!mInWhitespace) {
       Write(kSpace);
       mInWhitespace = true;
     }
+    return;
   }
-  else if (type == eHTMLTag_hr &&
+
+  /* Check, if we are in a link (symbolized with mURL containing the URL)
+     and the text is equal to the URL. In that case we don't want to output
+     the URL twice so we scrap the text in mURL. */
+  if (!mURL.IsEmpty() && mURL.Equals(aText)) {
+    mURL.Truncate();
+  }
+  Write(aText);
+}
+
+nsresult
+nsPlainTextSerializer::DoAddLeaf(nsIAtom* aTag)
+{
+  // If we don't want any output, just return
+  if (!DoOutput()) {
+    return NS_OK;
+  }
+
+  if (mLineBreakDue)
+    EnsureVerticalSpace(mFloatingLines);
+
+  if (MustSuppressLeaf()) {
+    return NS_OK;
+  }
+
+  if (aTag == nsGkAtoms::br) {
+    // Another egregious editor workaround, see bug 38194:
+    // ignore the bogus br tags that the editor sticks here and there.
+    nsAutoString tagAttr;
+    if (NS_FAILED(GetAttributeValue(nsGkAtoms::type, tagAttr))
+        || !tagAttr.EqualsLiteral("_moz")) {
+      EnsureVerticalSpace(mEmptyLines+1);
+    }
+  }
+  else if (aTag == nsGkAtoms::hr &&
            (mFlags & nsIDocumentEncoder::OutputFormatted)) {
     EnsureVerticalSpace(0);
 
@@ -1171,18 +1063,16 @@ nsPlainTextSerializer::DoAddLeaf(const nsIParserNode *aNode, PRInt32 aTag,
 
     EnsureVerticalSpace(0);
   }
-  else if (type == eHTMLTag_img) {
+  else if (aTag == nsGkAtoms::img) {
     /* Output (in decreasing order of preference)
        alt, title or nothing */
     // See <http://www.w3.org/TR/REC-html40/struct/objects.html#edef-IMG>
     nsAutoString imageDescription;
-    if (NS_SUCCEEDED(GetAttributeValue(aNode,
-                                       nsGkAtoms::alt,
+    if (NS_SUCCEEDED(GetAttributeValue(nsGkAtoms::alt,
                                        imageDescription))) {
       // If the alt attribute has an empty value (|alt=""|), output nothing
     }
-    else if (NS_SUCCEEDED(GetAttributeValue(aNode,
-                                            nsGkAtoms::title,
+    else if (NS_SUCCEEDED(GetAttributeValue(nsGkAtoms::title,
                                             imageDescription))
              && !imageDescription.IsEmpty()) {
       imageDescription = NS_LITERAL_STRING(" [") +
@@ -1193,7 +1083,6 @@ nsPlainTextSerializer::DoAddLeaf(const nsIParserNode *aNode, PRInt32 aTag,
     Write(imageDescription);
   }
 
-
   return NS_OK;
 }
 
@@ -1210,7 +1099,7 @@ nsPlainTextSerializer::EnsureVerticalSpace(PRInt32 noOfRows)
   // If we have something in the indent we probably want to output
   // it and it's not included in the count for empty lines so we don't
   // realize that we should start a new line.
-  if(noOfRows >= 0 && !mInIndentString.IsEmpty()) {
+  if (noOfRows >= 0 && !mInIndentString.IsEmpty()) {
     EndLine(false);
     mInWhitespace = true;
   }
@@ -1234,8 +1123,8 @@ nsPlainTextSerializer::EnsureVerticalSpace(PRInt32 noOfRows)
 void
 nsPlainTextSerializer::FlushLine()
 {
-  if(!mCurrentLine.IsEmpty()) {
-    if(mAtFirstColumn) {
+  if (!mCurrentLine.IsEmpty()) {
+    if (mAtFirstColumn) {
       OutputQuotesAndIndent(); // XXX: Should we always do this? Bug?
     }
 
@@ -1293,21 +1182,21 @@ nsPlainTextSerializer::AddToLine(const PRUnichar * aLineFragment,
     EnsureVerticalSpace(mFloatingLines);
 
   PRInt32 linelength = mCurrentLine.Length();
-  if(0 == linelength) {
-    if(0 == aLineFragmentLength) {
+  if (0 == linelength) {
+    if (0 == aLineFragmentLength) {
       // Nothing at all. Are you kidding me?
       return;
     }
 
-    if(mFlags & nsIDocumentEncoder::OutputFormatFlowed) {
-      if(IsSpaceStuffable(aLineFragment)
+    if (mFlags & nsIDocumentEncoder::OutputFormatFlowed) {
+      if (IsSpaceStuffable(aLineFragment)
          && mCiteQuoteLevel == 0  // We space-stuff quoted lines anyway
          )
         {
           // Space stuffing a la RFC 2646 (format=flowed).
           mCurrentLine.Append(PRUnichar(' '));
           
-          if(MayWrap()) {
+          if (MayWrap()) {
             mCurrentLineWidth += GetUnicharWidth(' ');
 #ifdef DEBUG_wrapping
             NS_ASSERTION(GetUnicharStringWidth(mCurrentLine.get(),
@@ -1322,7 +1211,7 @@ nsPlainTextSerializer::AddToLine(const PRUnichar * aLineFragment,
   }
     
   mCurrentLine.Append(aLineFragment, aLineFragmentLength);
-  if(MayWrap()) {
+  if (MayWrap()) {
     mCurrentLineWidth += GetUnicharStringWidth(aLineFragment,
                                                aLineFragmentLength);
 #ifdef DEBUG_wrapping
@@ -1336,7 +1225,7 @@ nsPlainTextSerializer::AddToLine(const PRUnichar * aLineFragment,
   linelength = mCurrentLine.Length();
 
   //  Wrap?
-  if(MayWrap())
+  if (MayWrap())
   {
 #ifdef DEBUG_wrapping
     NS_ASSERTION(GetUnicharstringWidth(mCurrentLine.get(),
@@ -1402,7 +1291,7 @@ nsPlainTextSerializer::AddToLine(const PRUnichar * aLineFragment,
         }
       }
       
-      if((goodSpace < linelength) && (goodSpace > 0)) {
+      if ((goodSpace < linelength) && (goodSpace > 0)) {
         // Found a place to break
 
         // -1 (trim a char at the break position)
@@ -1419,8 +1308,8 @@ nsPlainTextSerializer::AddToLine(const PRUnichar * aLineFragment,
         EndLine(true, breakBySpace);
         mCurrentLine.Truncate();
         // Space stuff new line?
-        if(mFlags & nsIDocumentEncoder::OutputFormatFlowed) {
-          if(!restOfLine.IsEmpty() && IsSpaceStuffable(restOfLine.get())
+        if (mFlags & nsIDocumentEncoder::OutputFormatFlowed) {
+          if (!restOfLine.IsEmpty() && IsSpaceStuffable(restOfLine.get())
               && mCiteQuoteLevel == 0  // We space-stuff quoted lines anyway
             )
           {
@@ -1458,7 +1347,7 @@ nsPlainTextSerializer::EndLine(bool aSoftlinebreak, bool aBreakBySpace)
 {
   PRUint32 currentlinelength = mCurrentLine.Length();
 
-  if(aSoftlinebreak && 0 == currentlinelength) {
+  if (aSoftlinebreak && 0 == currentlinelength) {
     // No meaning
     return;
   }
@@ -1469,7 +1358,7 @@ nsPlainTextSerializer::EndLine(bool aSoftlinebreak, bool aBreakBySpace)
    * "- -- ", the OpenPGP dash-escaped signature separator in inline
    * signed messages according to the OpenPGP standard (RFC 2440).
    */  
-  if(!(mFlags & nsIDocumentEncoder::OutputPreformatted) &&
+  if (!(mFlags & nsIDocumentEncoder::OutputPreformatted) &&
      (aSoftlinebreak || 
      !(mCurrentLine.EqualsLiteral("-- ") || mCurrentLine.EqualsLiteral("- -- ")))) {
     // Remove spaces from the end of the line.
@@ -1480,7 +1369,7 @@ nsPlainTextSerializer::EndLine(bool aSoftlinebreak, bool aBreakBySpace)
     mCurrentLine.SetLength(currentlinelength);
   }
   
-  if(aSoftlinebreak &&
+  if (aSoftlinebreak &&
      (mFlags & nsIDocumentEncoder::OutputFormatFlowed) &&
      (mIndent == 0)) {
     // Add the soft part of the soft linebreak (RFC 2646 4.1)
@@ -1489,25 +1378,25 @@ nsPlainTextSerializer::EndLine(bool aSoftlinebreak, bool aBreakBySpace)
 
     // If breaker character is ASCII space with RFC 3676 support (delsp=yes),
     // add twice space.
-    if (mFlags & nsIDocumentEncoder::OutputFormatDelSp && aBreakBySpace)
+    if ((mFlags & nsIDocumentEncoder::OutputFormatDelSp) && aBreakBySpace)
       mCurrentLine.Append(NS_LITERAL_STRING("  "));
     else
       mCurrentLine.Append(PRUnichar(' '));
   }
 
-  if(aSoftlinebreak) {
+  if (aSoftlinebreak) {
     mEmptyLines=0;
   } 
   else {
     // Hard break
-    if(!mCurrentLine.IsEmpty() || !mInIndentString.IsEmpty()) {
+    if (!mCurrentLine.IsEmpty() || !mInIndentString.IsEmpty()) {
       mEmptyLines=-1;
     }
 
     mEmptyLines++;
   }
 
-  if(mAtFirstColumn) {
+  if (mAtFirstColumn) {
     // If we don't have anything "real" to output we have to
     // make sure the indent doesn't end in a space since that
     // would trick a format=flowed-aware receiver.
@@ -1567,13 +1456,13 @@ nsPlainTextSerializer::OutputQuotesAndIndent(bool stripTrailingSpaces /* = false
     mAtFirstColumn = false;
   }
   
-  if(!mInIndentString.IsEmpty()) {
+  if (!mInIndentString.IsEmpty()) {
     stringToOutput += mInIndentString;
     mAtFirstColumn = false;
     mInIndentString.Truncate();
   }
 
-  if(stripTrailingSpaces) {
+  if (stripTrailingSpaces) {
     PRInt32 lineLength = stringToOutput.Length();
     while(lineLength > 0 &&
           ' ' == stringToOutput[lineLength-1]) {
@@ -1582,7 +1471,7 @@ nsPlainTextSerializer::OutputQuotesAndIndent(bool stripTrailingSpaces /* = false
     stringToOutput.SetLength(lineLength);
   }
 
-  if(!stringToOutput.IsEmpty()) {
+  if (!stringToOutput.IsEmpty()) {
     Output(stringToOutput);
   }
     
@@ -1659,11 +1548,11 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
       PRInt32 new_newline = bol;
       newline = kNotFound;
       while(iter != done_searching) {
-        if('\n' == *iter || '\r' == *iter) {
+        if ('\n' == *iter || '\r' == *iter) {
           newline = new_newline;
           break;
         }
-        if(' ' != *iter)
+        if (' ' != *iter)
           spacesOnly = false;
         ++new_newline;
         ++iter;
@@ -1671,12 +1560,12 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
 
       // Done searching
       nsAutoString stringpart;
-      if(newline == kNotFound) {
+      if (newline == kNotFound) {
         // No new lines.
         stringpart.Assign(Substring(str, bol, totLen - bol));
-        if(!stringpart.IsEmpty()) {
+        if (!stringpart.IsEmpty()) {
           PRUnichar lastchar = stringpart[stringpart.Length()-1];
-          if((lastchar == '\t') || (lastchar == ' ') ||
+          if ((lastchar == '\t') || (lastchar == ' ') ||
              (lastchar == '\r') ||(lastchar == '\n')) {
             mInWhitespace = true;
           } 
@@ -1696,7 +1585,7 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
         mEmptyLines=0;
         atFirstColumn = true;
         bol = newline+1;
-        if('\r' == *iter && bol < totLen && '\n' == *++iter) {
+        if ('\r' == *iter && bol < totLen && '\n' == *++iter) {
           // There was a CRLF in the input. This used to be illegal and
           // stripped by the parser. Apparently not anymore. Let's skip
           // over the LF.
@@ -1715,7 +1604,7 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
       }
       mCurrentLine.Append(stringpart);
 
-      if(outputQuotes) {
+      if (outputQuotes) {
         // Note: this call messes with mAtFirstColumn
         OutputQuotesAndIndent();
       }
@@ -1755,7 +1644,7 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
     nsMemory::Free(foo);
 #endif
 
-    if(nextpos == kNotFound) {
+    if (nextpos == kNotFound) {
       // The rest of the string
       offsetIntoBuffer = str.get() + bol;
       AddToLine(offsetIntoBuffer, totLen-bol);
@@ -1782,7 +1671,7 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
         continue;
       }
 
-      if(nextpos == bol) {
+      if (nextpos == bol) {
         // Note that we are in whitespace.
         mInWhitespace = true;
         offsetIntoBuffer = str.get() + nextpos;
@@ -1794,7 +1683,7 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
       mInWhitespace = true;
       
       offsetIntoBuffer = str.get() + bol;
-      if(mPreFormatted || (mFlags & nsIDocumentEncoder::OutputPreformatted)) {
+      if (mPreFormatted || (mFlags & nsIDocumentEncoder::OutputPreformatted)) {
         // Preserve the real whitespace character
         nextpos++;
         AddToLine(offsetIntoBuffer, nextpos-bol);
@@ -1816,8 +1705,7 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
  * NS_ERROR_NOT_AVAILABLE, there was none such attribute specified.
  */
 nsresult
-nsPlainTextSerializer::GetAttributeValue(const nsIParserNode* aNode,
-                                         nsIAtom* aName,
+nsPlainTextSerializer::GetAttributeValue(nsIAtom* aName,
                                          nsString& aValueRet)
 {
   if (mElement) {
@@ -1825,18 +1713,6 @@ nsPlainTextSerializer::GetAttributeValue(const nsIParserNode* aNode,
       return NS_OK;
     }
   }
-  else if (aNode) {
-    nsDependentAtomString name(aName); 
-
-    PRInt32 count = aNode->GetAttributeCount();
-    for (PRInt32 i=0;i<count;i++) {
-      const nsAString& key = aNode->GetKeyAt(i);
-      if (key.Equals(name, nsCaseInsensitiveStringComparator())) {
-        aValueRet = aNode->GetValueAt(i);
-        return NS_OK;
-      }
-    }
-  }
 
   return NS_ERROR_NOT_AVAILABLE;
 }
@@ -1846,10 +1722,10 @@ nsPlainTextSerializer::GetAttributeValue(const nsIParserNode* aNode,
  * In this case, we should ignore it.
  */
 bool 
-nsPlainTextSerializer::IsCurrentNodeConverted(const nsIParserNode* aNode)
+nsPlainTextSerializer::IsCurrentNodeConverted()
 {
   nsAutoString value;
-  nsresult rv = GetAttributeValue(aNode, nsGkAtoms::_class, value);
+  nsresult rv = GetAttributeValue(nsGkAtoms::_class, value);
   return (NS_SUCCEEDED(rv) &&
           (value.EqualsIgnoreCase("moz-txt", 7) ||
            value.EqualsIgnoreCase("\"moz-txt", 8)));
@@ -1857,50 +1733,15 @@ nsPlainTextSerializer::IsCurrentNodeConverted(const nsIParserNode* aNode)
 
 
 // static
-PRInt32
+nsIAtom*
 nsPlainTextSerializer::GetIdForContent(nsIContent* aContent)
 {
   if (!aContent->IsHTML()) {
-    return eHTMLTag_unknown;
+    return nsnull;
   }
 
-  nsIParserService* parserService = nsContentUtils::GetParserService();
-
-  return parserService ? parserService->HTMLAtomTagToId(aContent->Tag()) :
-                         eHTMLTag_unknown;
-}
-
-/**
- * Returns true if the id represents an element of block type.
- * Can be used to determine if a new paragraph should be started.
- */
-bool 
-nsPlainTextSerializer::IsBlockLevel(PRInt32 aId)
-{
-  bool isBlock = false;
-
-  nsIParserService* parserService = nsContentUtils::GetParserService();
-  if (parserService) {
-    parserService->IsBlock(aId, isBlock);
-  }
-
-  return isBlock;
-}
-
-/**
- * Returns true if the id represents a container.
- */
-bool 
-nsPlainTextSerializer::IsContainer(PRInt32 aId)
-{
-  bool isContainer = false;
-
-  nsIParserService* parserService = nsContentUtils::GetParserService();
-  if (parserService) {
-    parserService->IsContainer(aId, isContainer);
-  }
-
-  return isContainer;
+  nsIAtom* localName = aContent->Tag();
+  return localName->IsStaticAtom() ? localName : nsnull;
 }
 
 /**
@@ -1915,9 +1756,9 @@ nsPlainTextSerializer::IsInPre()
 {
   PRInt32 i = mTagStackIndex;
   while(i > 0) {
-    if(mTagStack[i-1] == eHTMLTag_pre)
+    if (mTagStack[i - 1] == nsGkAtoms::pre)
       return true;
-    if(IsBlockLevel(mTagStack[i-1])) {
+    if (nsContentUtils::IsHTMLBlock(mTagStack[i - 1])) {
       // We assume that every other block overrides a <pre>
       return false;
     }
@@ -1937,9 +1778,9 @@ nsPlainTextSerializer::IsInOL()
 {
   PRInt32 i = mTagStackIndex;
   while(--i >= 0) {
-    if(mTagStack[i] == eHTMLTag_ol)
+    if (mTagStack[i] == nsGkAtoms::ol)
       return true;
-    if (mTagStack[i] == eHTMLTag_ul) {
+    if (mTagStack[i] == nsGkAtoms::ul) {
       // If a UL is reached first, LI belongs the UL nested in OL.
       return false;
     }
@@ -1951,27 +1792,27 @@ nsPlainTextSerializer::IsInOL()
 /*
   @return 0 = no header, 1 = h1, ..., 6 = h6
 */
-PRInt32 HeaderLevel(eHTMLTags aTag)
+PRInt32 HeaderLevel(nsIAtom* aTag)
 {
-  PRInt32 result;
-  switch (aTag)
-  {
-    case eHTMLTag_h1:
-      result = 1; break;
-    case eHTMLTag_h2:
-      result = 2; break;
-    case eHTMLTag_h3:
-      result = 3; break;
-    case eHTMLTag_h4:
-      result = 4; break;
-    case eHTMLTag_h5:
-      result = 5; break;
-    case eHTMLTag_h6:
-      result = 6; break;
-    default:
-      result = 0; break;
+  if (aTag == nsGkAtoms::h1) {
+    return 1;
   }
-  return result;
+  if (aTag == nsGkAtoms::h2) {
+    return 2;
+  }
+  if (aTag == nsGkAtoms::h3) {
+    return 3;
+  }
+  if (aTag == nsGkAtoms::h4) {
+    return 4;
+  }
+  if (aTag == nsGkAtoms::h5) {
+    return 5;
+  }
+  if (aTag == nsGkAtoms::h6) {
+    return 6;
+  }
+  return 0;
 }
 
 
diff --git a/content/base/src/nsPlainTextSerializer.h b/content/base/src/nsPlainTextSerializer.h
index 9edf91ba7c5..ed06bec1a8c 100644
--- a/content/base/src/nsPlainTextSerializer.h
+++ b/content/base/src/nsPlainTextSerializer.h
@@ -45,14 +45,11 @@
 #define nsPlainTextSerializer_h__
 
 #include "nsIContentSerializer.h"
-#include "nsIHTMLContentSink.h"
-#include "nsHTMLTags.h"
 #include "nsCOMPtr.h"
 #include "nsString.h"
 #include "nsILineBreaker.h"
 #include "nsIContent.h"
 #include "nsIAtom.h"
-#include "nsIHTMLToTextSink.h"
 #include "nsIDocumentEncoder.h"
 #include "nsTArray.h"
 
@@ -62,9 +59,7 @@ class Element;
 } // namespace dom
 } // namespace mozilla
 
-class nsPlainTextSerializer : public nsIContentSerializer,
-                              public nsIHTMLContentSink,
-                              public nsIHTMLToTextSink
+class nsPlainTextSerializer : public nsIContentSerializer
 {
 public:
   nsPlainTextSerializer();
@@ -100,35 +95,8 @@ public:
   NS_IMETHOD AppendDocumentStart(nsIDocument *aDocument,
                                  nsAString& aStr);
 
-  // nsIContentSink
-  NS_IMETHOD WillParse(void) { return NS_OK; }
-  NS_IMETHOD WillInterrupt(void) { return NS_OK; }
-  NS_IMETHOD WillResume(void) { return NS_OK; }
-  NS_IMETHOD SetParser(nsParserBase* aParser) { return NS_OK; }
-  NS_IMETHOD OpenContainer(const nsIParserNode& aNode);
-  NS_IMETHOD CloseContainer(const nsHTMLTag aTag);
-  NS_IMETHOD AddLeaf(const nsIParserNode& aNode);
-  virtual void FlushPendingNotifications(mozFlushType aType) { }
-  NS_IMETHOD SetDocumentCharset(nsACString& aCharset) { return NS_OK; }
-  virtual nsISupports *GetTarget() { return nsnull; }
-
-  // nsIHTMLContentSink
-  NS_IMETHOD OpenHead();
-  NS_IMETHOD IsEnabled(PRInt32 aTag, bool* aReturn);
-  NS_IMETHOD NotifyTagObservers(nsIParserNode* aNode) { return NS_OK; }
-
-  NS_IMETHOD BeginContext(PRInt32 aPosition) { return NS_OK; }
-  NS_IMETHOD EndContext(PRInt32 aPosition) { return NS_OK; }
-  NS_IMETHOD DidProcessTokens(void) { return NS_OK; }
-  NS_IMETHOD WillProcessAToken(void) { return NS_OK; }
-  NS_IMETHOD DidProcessAToken(void) { return NS_OK; }
-
-  // nsIHTMLToTextSink
-  NS_IMETHOD Initialize(nsAString* aOutString,
-                        PRUint32 aFlags, PRUint32 aWrapCol);
-
 protected:
-  nsresult GetAttributeValue(const nsIParserNode* node, nsIAtom* aName, nsString& aValueRet);
+  nsresult GetAttributeValue(nsIAtom* aName, nsString& aValueRet);
   void AddToLine(const PRUnichar* aStringToAdd, PRInt32 aLength);
   void EndLine(bool softlinebreak, bool aBreakBySpace = false);
   void EnsureVerticalSpace(PRInt32 noOfRows);
@@ -136,17 +104,20 @@ protected:
   void OutputQuotesAndIndent(bool stripTrailingSpaces=false);
   void Output(nsString& aString);
   void Write(const nsAString& aString);
-  bool IsBlockLevel(PRInt32 aId);
-  bool IsContainer(PRInt32 aId);
   bool IsInPre();
   bool IsInOL();
-  bool IsCurrentNodeConverted(const nsIParserNode* aNode);
-  static PRInt32 GetIdForContent(nsIContent* aContent);
-  nsresult DoOpenContainer(const nsIParserNode* aNode, PRInt32 aTag);
-  nsresult DoCloseContainer(PRInt32 aTag);
-  nsresult DoAddLeaf(const nsIParserNode* aNode,
-                     PRInt32 aTag,
-                     const nsAString& aText);
+  bool IsCurrentNodeConverted();
+  bool MustSuppressLeaf();
+
+  /**
+   * Returns the local name of the element as an atom if the element is an
+   * HTML element and the atom is a static atom. Otherwise, nsnull is returned.
+   */
+  static nsIAtom* GetIdForContent(nsIContent* aContent);
+  nsresult DoOpenContainer(nsIAtom* aTag);
+  nsresult DoCloseContainer(nsIAtom* aTag);
+  nsresult DoAddLeaf(nsIAtom* aTag);
+  void DoAddText(bool aIsWhitespace, const nsAString& aText);
 
   // Inlined functions
   inline bool MayWrap()
@@ -240,14 +211,15 @@ protected:
   nsAutoTArray<bool, 8> mHasWrittenCellsForRow;
   
   // Values gotten in OpenContainer that is (also) needed in CloseContainer
-  nsAutoTArray<bool, 8> mCurrentNodeIsConverted;
   nsAutoTArray<bool, 8> mIsInCiteBlockquote;
 
   // The output data
   nsAString*            mOutputString;
 
-  // The tag stack: the stack of tags we're operating on, so we can nest:
-  nsHTMLTag       *mTagStack;
+  // The tag stack: the stack of tags we're operating on, so we can nest.
+  // The stack only ever points to static atoms, so they don't need to be
+  // refcounted.
+  nsIAtom**        mTagStack;
   PRUint32         mTagStackIndex;
 
   // Content in the stack above this index should be ignored:
diff --git a/content/canvas/src/WebGLContext.h b/content/canvas/src/WebGLContext.h
index 6ee014477a6..ffc1154f159 100644
--- a/content/canvas/src/WebGLContext.h
+++ b/content/canvas/src/WebGLContext.h
@@ -754,7 +754,7 @@ protected:
         WebGL_MOZ_WEBGL_lose_context,
         WebGLExtensionID_Max
     };
-    nsCOMPtr<WebGLExtension> mEnabledExtensions[WebGLExtensionID_Max];
+    nsRefPtr<WebGLExtension> mEnabledExtensions[WebGLExtensionID_Max];
     bool IsExtensionEnabled(WebGLExtensionID ext) const {
         NS_ABORT_IF_FALSE(ext >= 0 && ext < WebGLExtensionID_Max, "bogus index!");
         return mEnabledExtensions[ext] != nsnull;
diff --git a/content/canvas/src/WebGLContextReporter.cpp b/content/canvas/src/WebGLContextReporter.cpp
index 8584643770a..d3bb7098dd6 100644
--- a/content/canvas/src/WebGLContextReporter.cpp
+++ b/content/canvas/src/WebGLContextReporter.cpp
@@ -70,101 +70,83 @@ NS_IMETHODIMP
 WebGLMemoryMultiReporter::CollectReports(nsIMemoryMultiReporterCallback* aCb, 
                                          nsISupports* aClosure)
 {
-    aCb->Callback(
-        EmptyCString(), 
-        NS_LITERAL_CSTRING("webgl-texture-memory"),
-        nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_BYTES,
-        WebGLMemoryMultiReporterWrapper::GetTextureMemoryUsed(),
-        NS_LITERAL_CSTRING("Memory used by WebGL textures.The OpenGL"
-            " implementation is free to store these textures in either video"
-            " memory or main memory. This measurement is only a lower bound,"
-            " actual memory usage may be higher for example if the storage" 
-            " is strided."),  
-        aClosure);
-   
-    aCb->Callback(
-        EmptyCString(), 
-        NS_LITERAL_CSTRING("webgl-texture-count"),
-        nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_COUNT,
-         WebGLMemoryMultiReporterWrapper::GetTextureCount(), 
-        NS_LITERAL_CSTRING("Number of WebGL textures."), 
-        aClosure);
+#define REPORT(_path, _kind, _units, _amount, _desc)                          \
+    do {                                                                      \
+      nsresult rv;                                                            \
+      rv = aCb->Callback(EmptyCString(), NS_LITERAL_CSTRING(_path), _kind,    \
+                         _units, _amount, NS_LITERAL_CSTRING(_desc),          \
+                         aClosure);                                           \
+      NS_ENSURE_SUCCESS(rv, rv);                                              \
+    } while (0)
 
-    aCb->Callback(
-        EmptyCString(), 
-        NS_LITERAL_CSTRING("webgl-buffer-memory"),
-        nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_BYTES,
-         WebGLMemoryMultiReporterWrapper::GetBufferMemoryUsed(), 
-        NS_LITERAL_CSTRING("Memory used by WebGL buffers. The OpenGL"
-            " implementation is free to store these buffers in either video"
-            " memory or main memory. This measurement is only a lower bound,"
-            " actual memory usage may be higher for example if the storage"
-            " is strided."),
-        aClosure);
-
-    aCb->Callback(
-        EmptyCString(), 
-        NS_LITERAL_CSTRING("explicit/webgl/buffer-cache-memory"),
-        nsIMemoryReporter::KIND_HEAP, nsIMemoryReporter::UNITS_BYTES,
-        WebGLMemoryMultiReporterWrapper::GetBufferCacheMemoryUsed(),
-        NS_LITERAL_CSTRING("Memory used by WebGL buffer caches. The WebGL"
-            " implementation caches the contents of element array buffers"
-            " only.This adds up with the webgl-buffer-memory value, but"
-            " contrary to it, this one represents bytes on the heap,"
-            " not managed by OpenGL."),
-        aClosure);
-
-    aCb->Callback(
-        EmptyCString(), NS_LITERAL_CSTRING("webgl-buffer-count"),
-        nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_COUNT,
-        WebGLMemoryMultiReporterWrapper::GetBufferCount(),
-        NS_LITERAL_CSTRING("Number of WebGL buffers."), 
-        aClosure);
+    REPORT("webgl-texture-memory",
+           nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_BYTES,
+           WebGLMemoryMultiReporterWrapper::GetTextureMemoryUsed(),
+           "Memory used by WebGL textures.The OpenGL"
+           " implementation is free to store these textures in either video"
+           " memory or main memory. This measurement is only a lower bound,"
+           " actual memory usage may be higher for example if the storage" 
+           " is strided.");
    
-    aCb->Callback(
-        EmptyCString(), 
-        NS_LITERAL_CSTRING("webgl-renderbuffer-memory"),
-        nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_BYTES,
-        WebGLMemoryMultiReporterWrapper::GetRenderbufferMemoryUsed(), 
-        NS_LITERAL_CSTRING("Memory used by WebGL renderbuffers. The OpenGL"
-            " implementation is free to store these renderbuffers in either"
-            " video memory or main memory. This measurement is only a lower"
-            " bound, actual memory usage may be higher for example if the"
-            " storage is strided."),
-        aClosure);
+    REPORT("webgl-texture-count",
+           nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_COUNT,
+           WebGLMemoryMultiReporterWrapper::GetTextureCount(), 
+           "Number of WebGL textures.");
+
+    REPORT("webgl-buffer-memory",
+           nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_BYTES,
+           WebGLMemoryMultiReporterWrapper::GetBufferMemoryUsed(), 
+           "Memory used by WebGL buffers. The OpenGL"
+           " implementation is free to store these buffers in either video"
+           " memory or main memory. This measurement is only a lower bound,"
+           " actual memory usage may be higher for example if the storage"
+           " is strided.");
+
+    REPORT("explicit/webgl/buffer-cache-memory",
+           nsIMemoryReporter::KIND_HEAP, nsIMemoryReporter::UNITS_BYTES,
+           WebGLMemoryMultiReporterWrapper::GetBufferCacheMemoryUsed(),
+           "Memory used by WebGL buffer caches. The WebGL"
+           " implementation caches the contents of element array buffers"
+           " only.This adds up with the webgl-buffer-memory value, but"
+           " contrary to it, this one represents bytes on the heap,"
+           " not managed by OpenGL.");
+
+    REPORT("webgl-buffer-count",
+           nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_COUNT,
+           WebGLMemoryMultiReporterWrapper::GetBufferCount(),
+           "Number of WebGL buffers."); 
    
-    aCb->Callback(
-        EmptyCString(),
-        NS_LITERAL_CSTRING("webgl-renderbuffer-count"),
-        nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_COUNT,
-        WebGLMemoryMultiReporterWrapper::GetRenderbufferCount(),
-        NS_LITERAL_CSTRING("Number of WebGL renderbuffers."),
-        aClosure);
+    REPORT("webgl-renderbuffer-memory",
+           nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_BYTES,
+           WebGLMemoryMultiReporterWrapper::GetRenderbufferMemoryUsed(), 
+           "Memory used by WebGL renderbuffers. The OpenGL"
+           " implementation is free to store these renderbuffers in either"
+           " video memory or main memory. This measurement is only a lower"
+           " bound, actual memory usage may be higher for example if the"
+           " storage is strided.");
+   
+    REPORT("webgl-renderbuffer-count",
+           nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_COUNT,
+           WebGLMemoryMultiReporterWrapper::GetRenderbufferCount(),
+           "Number of WebGL renderbuffers.");
   
-    aCb->Callback(
-        EmptyCString(),
-        NS_LITERAL_CSTRING("explicit/webgl/shader"),
-        nsIMemoryReporter::KIND_HEAP, nsIMemoryReporter::UNITS_BYTES,
-        WebGLMemoryMultiReporterWrapper::GetShaderSize(), 
-        NS_LITERAL_CSTRING("Combined size of WebGL shader ASCII sources and"
-            " translation logs cached on the heap."), 
-        aClosure);
+    REPORT("explicit/webgl/shader",
+           nsIMemoryReporter::KIND_HEAP, nsIMemoryReporter::UNITS_BYTES,
+           WebGLMemoryMultiReporterWrapper::GetShaderSize(), 
+           "Combined size of WebGL shader ASCII sources and translation"
+           " logs cached on the heap."); 
 
-    aCb->Callback(
-        EmptyCString(), 
-        NS_LITERAL_CSTRING("webgl-shader-count"),
-        nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_COUNT,
-        WebGLMemoryMultiReporterWrapper::GetShaderCount(), 
-        NS_LITERAL_CSTRING("Number of WebGL shaders."), 
-        aClosure);
+    REPORT("webgl-shader-count",
+           nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_COUNT,
+           WebGLMemoryMultiReporterWrapper::GetShaderCount(), 
+           "Number of WebGL shaders."); 
 
-    aCb->Callback(
-        EmptyCString(), 
-        NS_LITERAL_CSTRING("webgl-context-count"),
-        nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_COUNT,
-        WebGLMemoryMultiReporterWrapper::GetContextCount(), 
-        NS_LITERAL_CSTRING("Number of WebGL contexts."), 
-        aClosure);
+    REPORT("webgl-context-count",
+           nsIMemoryReporter::KIND_OTHER, nsIMemoryReporter::UNITS_COUNT,
+           WebGLMemoryMultiReporterWrapper::GetContextCount(), 
+           "Number of WebGL contexts."); 
+
+#undef REPORT
 
     return NS_OK;
 }
diff --git a/content/canvas/test/webgl/test_webgl_conformance_test_suite.html b/content/canvas/test/webgl/test_webgl_conformance_test_suite.html
index 8de194fa511..fde004a6b0f 100644
--- a/content/canvas/test/webgl/test_webgl_conformance_test_suite.html
+++ b/content/canvas/test/webgl/test_webgl_conformance_test_suite.html
@@ -377,7 +377,7 @@ function start() {
       default:
         throw 'unhandled';
         break;
-    };
+    }
   };
 
   var getURLOptions = function(obj) {
@@ -404,27 +404,12 @@ function start() {
 
     // try to create a dummy WebGL context, just to catch context creation failures once here,
     // rather than having them result in 100's of failures (one in each test page)
-    var canvas = document.getElementById("webglcheck-default");
     var ctx;
     try {
-        ctx = canvas.getContext("experimental-webgl");
-    } catch(e) {
-        ok(false, "canvas.getContext() failed", e);
-    }
-
-    if (ctx) {
-        statusTextNode.textContent = 'Loading test lists...';
-        var iframe = document.getElementById("testframe");
-        var testHarness = new WebGLTestHarnessModule.TestHarness(
-            iframe,
-            '00_test_list.txt',
-            function(type, msg, success) {
-                return reporter.reportFunc(type, msg, success);
-            },
-            OPTIONS);
-        testHarness.setTimeoutDelay(20000); // and make it much higher when running under valgrind.
-        window.webglTestHarness = testHarness;
-    } else {
+      ctx = document.getElementById("webglcheck-default")
+                    .getContext("experimental-webgl");
+    } catch(e) {}
+    if (!ctx) {
         var errmsg = "Can't create a WebGL context";
         reporter.fullResultsNode.textContent = errmsg;
         // Workaround for SeaMonkey tinderboxes which don't support WebGL.
@@ -434,8 +419,22 @@ function start() {
           ok(false, errmsg);
         dump("WebGL mochitest failed: " + errmsg + "\n");
         reporter.finishedTestSuite();
+        return;
     }
-  };
+
+    statusTextNode.textContent = 'Loading test lists...';
+    var iframe = document.getElementById("testframe");
+    var testHarness = new WebGLTestHarnessModule.TestHarness(
+        iframe,
+        '00_test_list.txt',
+        function(type, msg, success) {
+          return reporter.reportFunc(type, msg, success);
+        },
+        OPTIONS);
+    // Make timeout delay much higher when running under valgrind.
+    testHarness.setTimeoutDelay(20000);
+    window.webglTestHarness = testHarness;
+  }
 
   SimpleTest.requestLongerTimeout(3);
 
diff --git a/content/events/test/test_eventctors.html b/content/events/test/test_eventctors.html
index 4efecf7c603..516e9e17e75 100644
--- a/content/events/test/test_eventctors.html
+++ b/content/events/test/test_eventctors.html
@@ -326,10 +326,48 @@ is(e.view, window, "view should be window");
 document.dispatchEvent(e);
 is(receivedEvent, e, "Wrong event!");
 
-// UIEvent
+// StorageEvent
 
 try {
-  e = new UIEvent();
+  e = new StorageEvent();
+} catch(exp) {
+  ex = true;
+}
+ok(ex, "First parameter is required!");
+ex = false;
+
+e = new StorageEvent("hello");
+ok(e.type, "hello", "Wrong event type!");
+ok(!e.isTrusted, "Event shouldn't be trusted!");
+ok(!e.bubbles, "Event shouldn't bubble!");
+ok(!e.cancelable, "Event shouldn't be cancelable!");
+is(e.key, "", "key should be ''");
+is(e.oldValue, null, "oldValue should be null");
+is(e.newValue, null, "newValue should be null");
+is(e.url, "", "url should be ''");
+document.dispatchEvent(e);
+is(receivedEvent, e, "Wrong event!");
+
+e = new StorageEvent("hello",
+  { bubbles: true, cancelable: true, key: "key",
+    oldValue: "oldValue", newValue: "newValue", url: "url",
+    storageArea: localStorage });
+ok(e.type, "hello", "Wrong event type!");
+ok(!e.isTrusted, "Event shouldn't be trusted!");
+ok(e.bubbles, "Event should bubble!");
+ok(e.cancelable, "Event should be cancelable!");
+is(e.key, "key", "Wrong value");
+is(e.oldValue, "oldValue", "Wrong value");
+is(e.newValue, "newValue", "Wrong value");
+is(e.url, "url", "Wrong value");
+is(e.storageArea, localStorage, "Wrong value");
+document.dispatchEvent(e);
+is(receivedEvent, e, "Wrong event!");
+
+// MouseEvent
+
+try {
+  e = new MouseEvent();
 } catch(exp) {
   ex = true;
 }
diff --git a/content/html/content/src/nsFormSubmission.cpp b/content/html/content/src/nsFormSubmission.cpp
index 08627f66d53..0b37bec0cf3 100644
--- a/content/html/content/src/nsFormSubmission.cpp
+++ b/content/html/content/src/nsFormSubmission.cpp
@@ -269,7 +269,6 @@ HandleMailtoSubject(nsCString& aPath) {
                                            nsContentUtils::eFORMS_PROPERTIES,
                                            "DefaultFormSubject",
                                            formatStrings,
-                                           ArrayLength(formatStrings),
                                            subjectStr);
     if (NS_FAILED(rv))
       return;
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index 8110770129c..9502b7dc550 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -3830,7 +3830,7 @@ nsHTMLInputElement::GetValidationMessage(nsAString& aValidationMessage,
       const PRUnichar* params[] = { strMaxLength.get(), strTextLength.get() };
       rv = nsContentUtils::FormatLocalizedString(nsContentUtils::eDOM_PROPERTIES,
                                                  "FormValidationTextTooLong",
-                                                 params, 2, message);
+                                                 params, message);
       aValidationMessage = message;
       break;
     }
@@ -3889,7 +3889,7 @@ nsHTMLInputElement::GetValidationMessage(nsAString& aValidationMessage,
         const PRUnichar* params[] = { title.get() };
         rv = nsContentUtils::FormatLocalizedString(nsContentUtils::eDOM_PROPERTIES,
                                                    "FormValidationPatternMismatchWithTitle",
-                                                   params, 1, message);
+                                                   params, message);
       }
       aValidationMessage = message;
       break;
diff --git a/content/html/content/src/nsHTMLTextAreaElement.cpp b/content/html/content/src/nsHTMLTextAreaElement.cpp
index fe76755a586..64153d96c64 100644
--- a/content/html/content/src/nsHTMLTextAreaElement.cpp
+++ b/content/html/content/src/nsHTMLTextAreaElement.cpp
@@ -1423,7 +1423,7 @@ nsHTMLTextAreaElement::GetValidationMessage(nsAString& aValidationMessage,
         const PRUnichar* params[] = { strMaxLength.get(), strTextLength.get() };
         rv = nsContentUtils::FormatLocalizedString(nsContentUtils::eDOM_PROPERTIES,
                                                    "FormValidationTextTooLong",
-                                                   params, 2, message);
+                                                   params, message);
         aValidationMessage = message;
       }
       break;
diff --git a/content/html/document/src/ImageDocument.cpp b/content/html/document/src/ImageDocument.cpp
index 6b4a804f8e5..23a5f01483b 100644
--- a/content/html/document/src/ImageDocument.cpp
+++ b/content/html/document/src/ImageDocument.cpp
@@ -691,7 +691,7 @@ ImageDocument::CheckOverflowing(bool changeState)
 {
   /* Create a scope so that the style context gets destroyed before we might
    * call RebuildStyleData.  Also, holding onto pointers to the
-   * presentatation through style resolution is potentially dangerous.
+   * presentation through style resolution is potentially dangerous.
    */
   {
     nsIPresShell *shell = GetShell();
@@ -702,23 +702,6 @@ ImageDocument::CheckOverflowing(bool changeState)
     nsPresContext *context = shell->GetPresContext();
     nsRect visibleArea = context->GetVisibleArea();
 
-    Element* body = GetBodyElement();
-    if (!body) {
-      NS_WARNING("no body on image document!");
-      return NS_ERROR_FAILURE;
-    }
-
-    nsRefPtr<nsStyleContext> styleContext =
-      context->StyleSet()->ResolveStyleFor(body, nsnull);
-
-    nsMargin m;
-    if (styleContext->GetStyleMargin()->GetMargin(m))
-      visibleArea.Deflate(m);
-    m = styleContext->GetStyleBorder()->GetActualBorder();
-    visibleArea.Deflate(m);
-    if (styleContext->GetStylePadding()->GetPadding(m))
-      visibleArea.Deflate(m);
-
     mVisibleWidth = nsPresContext::AppUnitsToIntCSSPixels(visibleArea.width);
     mVisibleHeight = nsPresContext::AppUnitsToIntCSSPixels(visibleArea.height);
   }
diff --git a/content/html/document/test/test_bug369370.html b/content/html/document/test/test_bug369370.html
index 235cbe181d8..cafbcbace87 100644
--- a/content/html/document/test/test_bug369370.html
+++ b/content/html/document/test/test_bug369370.html
@@ -39,8 +39,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=369370
         is(kidWin.innerHeight, 300, "Checking doc height");
 
         // Image just loaded and is scaled to window size.
-        is(img.width,  378, "image width");
-        is(img.height, 284, "image height");
+        is(img.width,  400, "image width");
+        is(img.height, 300, "image height");
         is(kidDoc.body.scrollLeft,  0, "Checking scrollLeft");
         is(kidDoc.body.scrollTop,   0, "Checking scrollTop");
 
@@ -61,8 +61,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=369370
         img.dispatchEvent(event);
         ok(true, "----- click 2 -----");
 
-        is(img.width,  378, "image width");
-        is(img.height, 284, "image height");
+        is(img.width,  400, "image width");
+        is(img.height, 300, "image height");
         is(kidDoc.body.scrollLeft,  0, "Checking scrollLeft");
         is(kidDoc.body.scrollTop,   0, "Checking scrollTop");
 
@@ -83,8 +83,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=369370
         img.dispatchEvent(event);
         ok(true, "----- click 4 -----");
 
-        is(img.width,  378, "image width");
-        is(img.height, 284, "image height");
+        is(img.width,  400, "image width");
+        is(img.height, 300, "image height");
         is(kidDoc.body.scrollLeft,  0, "Checking scrollLeft");
         is(kidDoc.body.scrollTop,   0, "Checking scrollTop");
 
diff --git a/content/svg/content/src/nsSVGElement.cpp b/content/svg/content/src/nsSVGElement.cpp
index 753cb829cbd..080521dd308 100644
--- a/content/svg/content/src/nsSVGElement.cpp
+++ b/content/svg/content/src/nsSVGElement.cpp
@@ -1466,10 +1466,14 @@ nsSVGElement::MaybeSerializeAttrBeforeRemoval(nsIAtom* aName, bool aNotify)
     return;
   }
 
+  const nsAttrValue* attrValue = mAttrsAndChildren.GetAttr(aName);
+  if (!attrValue)
+    return;
+
   nsAutoString serializedValue;
-  mAttrsAndChildren.GetAttr(aName)->ToString(serializedValue);
-  nsAttrValue attrValue(serializedValue);
-  mAttrsAndChildren.SetAndTakeAttr(aName, attrValue);
+  attrValue->ToString(serializedValue);
+  nsAttrValue oldAttrValue(serializedValue);
+  mAttrsAndChildren.SetAndTakeAttr(aName, oldAttrValue);
 }
 
 /* static */
diff --git a/content/svg/content/src/nsSVGFilters.cpp b/content/svg/content/src/nsSVGFilters.cpp
index 624be8b8da7..f97e8e4035c 100644
--- a/content/svg/content/src/nsSVGFilters.cpp
+++ b/content/svg/content/src/nsSVGFilters.cpp
@@ -144,12 +144,12 @@ nsSVGFE::SetupScalingFilter(nsSVGFilterInstance *aInstance,
     return result;
   }
 
-  float kernelX = aInstance->GetPrimitiveNumber(nsSVGUtils::X,
-                                                aKernelUnitLength,
-                                                nsSVGNumberPair::eFirst);
-  float kernelY = aInstance->GetPrimitiveNumber(nsSVGUtils::Y,
-                                                aKernelUnitLength,
-                                                nsSVGNumberPair::eSecond);
+  gfxFloat kernelX = aInstance->GetPrimitiveNumber(nsSVGUtils::X,
+                                                   aKernelUnitLength,
+                                                   nsSVGNumberPair::eFirst);
+  gfxFloat kernelY = aInstance->GetPrimitiveNumber(nsSVGUtils::Y,
+                                                   aKernelUnitLength,
+                                                   nsSVGNumberPair::eSecond);
   if (kernelX <= 0 || kernelY <= 0)
     return result;
 
diff --git a/content/svg/content/src/nsSVGUseElement.cpp b/content/svg/content/src/nsSVGUseElement.cpp
index e34524ecba4..1e77b3ae0af 100644
--- a/content/svg/content/src/nsSVGUseElement.cpp
+++ b/content/svg/content/src/nsSVGUseElement.cpp
@@ -428,9 +428,7 @@ nsSVGUseElement::SyncWidthOrHeight(nsIAtom* aName)
       // Our width/height attribute is now no longer explicitly set, so we
       // need to revert the clone's width/height to the width/height of the
       // content that's being cloned.
-      nsSVGSVGElement* svgElement =
-        static_cast<nsSVGSVGElement*>(mSource.get());
-      svgElement->SyncWidthOrHeight(aName, target);
+      TriggerReclone();
       return;
     }
     // Our width/height attribute is now no longer explicitly set, so we
diff --git a/content/svg/content/test/test_SVGLengthList.xhtml b/content/svg/content/test/test_SVGLengthList.xhtml
index fe96cb2c205..928baba7254 100644
--- a/content/svg/content/test/test_SVGLengthList.xhtml
+++ b/content/svg/content/test/test_SVGLengthList.xhtml
@@ -61,6 +61,13 @@ function run_tests()
   lengths[0].valueAsString = "10";
   lengths[0].convertToSpecifiedUnits(SVGLength.SVG_LENGTHTYPE_NUMBER);
   lengths[0].newValueSpecifiedUnits(SVGLength.SVG_LENGTHTYPE_NUMBER, 10);
+  // -- Attribute removal
+  eventChecker.expect("remove");
+  text.removeAttribute("x");
+  // -- Non-existent attribute removal
+  eventChecker.expect("");
+  text.removeAttribute("x");
+  text.removeAttributeNS(null, "x");
   eventChecker.finish();
 
   SimpleTest.finish();
diff --git a/content/svg/content/test/test_SVGNumberList.xhtml b/content/svg/content/test/test_SVGNumberList.xhtml
index fcd471f4c4f..2ac8861dccf 100644
--- a/content/svg/content/test/test_SVGNumberList.xhtml
+++ b/content/svg/content/test/test_SVGNumberList.xhtml
@@ -50,6 +50,13 @@ function run_tests()
   numbers[0].value = 17;
   numbers[1].value = 20;
   text.setAttribute("rotate", "17 20 30");
+  // -- Attribute removal
+  eventChecker.expect("remove");
+  text.removeAttribute("rotate");
+  // -- Non-existent attribute removal
+  eventChecker.expect("");
+  text.removeAttribute("rotate");
+  text.removeAttributeNS(null, "rotate");
   eventChecker.finish();
 
   SimpleTest.finish();
diff --git a/content/svg/content/test/test_SVGPathSegList.xhtml b/content/svg/content/test/test_SVGPathSegList.xhtml
index b1c42bc1e8b..5b442676a12 100644
--- a/content/svg/content/test/test_SVGPathSegList.xhtml
+++ b/content/svg/content/test/test_SVGPathSegList.xhtml
@@ -105,6 +105,15 @@ function run_tests()
   list[0].x = 20;
   list[1].y = 34;
   path.setAttribute("d", "M20,5 L12,34");
+
+  // -- Attribute removal
+  eventChecker.expect("remove");
+  path.removeAttribute("d");
+
+  // -- Non-existent attribute removal
+  eventChecker.expect("");
+  path.removeAttribute("d");
+  path.removeAttributeNS(null, "d");
   eventChecker.finish();
 
   SimpleTest.finish();
diff --git a/content/svg/content/test/test_SVGPointList.xhtml b/content/svg/content/test/test_SVGPointList.xhtml
index fbeaacf77a5..ee4712a9f4b 100644
--- a/content/svg/content/test/test_SVGPointList.xhtml
+++ b/content/svg/content/test/test_SVGPointList.xhtml
@@ -50,6 +50,13 @@ function run_tests()
   points[0].x = 30;
   points[1].y = 380;
   polyline.setAttribute("points", "30,375 150,380");
+  // -- Attribute removal
+  eventChecker.expect("remove");
+  polyline.removeAttribute("points");
+  // -- Non-existent attribute removal
+  eventChecker.expect("");
+  polyline.removeAttribute("points");
+  polyline.removeAttributeNS(null, "points");
   eventChecker.finish();
 
   SimpleTest.finish();
diff --git a/content/svg/content/test/test_SVGTransformList.xhtml b/content/svg/content/test/test_SVGTransformList.xhtml
index 453f1efefb1..17749ec2cfa 100644
--- a/content/svg/content/test/test_SVGTransformList.xhtml
+++ b/content/svg/content/test/test_SVGTransformList.xhtml
@@ -424,6 +424,16 @@ function testMutationEvents(g)
   eventChecker.expect("");
   g.setAttribute("transform", "matrix(1, 0, 0, 1, 0, 0)");
   list[0].setMatrix(mx);
+
+  // Attribute removal
+  eventChecker.expect("remove");
+  g.removeAttribute("transform");
+
+  // Non-existent attribute removal
+  eventChecker.expect("");
+  g.removeAttribute("transform");
+  g.removeAttributeNS(null, "transform");
+
   eventChecker.finish();
 }
 
diff --git a/content/svg/content/test/test_SVGxxxList.xhtml b/content/svg/content/test/test_SVGxxxList.xhtml
index 08286d487ff..3c939babf3c 100644
--- a/content/svg/content/test/test_SVGxxxList.xhtml
+++ b/content/svg/content/test/test_SVGxxxList.xhtml
@@ -835,6 +835,7 @@ function run_baseVal_API_tests()
 
     eventChecker.expect("remove add");
     t.element.removeAttribute(t.attr_name);
+    t.element.removeAttributeNS(null, t.attr_name);
     res = t.baseVal.appendItem(item);
     eventChecker.finish();
   }
diff --git a/content/svg/content/test/test_dataTypesModEvents.html b/content/svg/content/test/test_dataTypesModEvents.html
index e45c6415a61..380c31a9ea4 100644
--- a/content/svg/content/test/test_dataTypesModEvents.html
+++ b/content/svg/content/test/test_dataTypesModEvents.html
@@ -38,6 +38,7 @@ function runTests()
   filter.setAttribute("class", "foo");
   filter.className.baseVal = "bar";
   filter.removeAttribute("class");
+  filter.removeAttributeNS(null, "class");
   filter.className.baseVal = "foo";
 
   eventChecker.expect("");
@@ -57,6 +58,7 @@ function runTests()
   marker.markerWidth.baseVal.newValueSpecifiedUnits(
     SVGLength.SVG_LENGTHTYPE_MM, 11);
   marker.removeAttribute("markerWidth");
+  marker.removeAttributeNS(null, "markerWidth");
   marker.markerWidth.baseVal.value = 8;
 
   eventChecker.expect("remove add modify");
@@ -84,6 +86,7 @@ function runTests()
   convolve.setAttribute("divisor", "12.5");
   convolve.divisor.baseVal = 6;
   convolve.removeAttribute("divisor");
+  convolve.removeAttributeNS(null, "divisor");
   convolve.divisor.baseVal = 8;
 
   eventChecker.expect("");
@@ -97,6 +100,7 @@ function runTests()
   blur.setAttribute("stdDeviation", "5, 6");
   blur.stdDeviationX.baseVal = 8;
   blur.removeAttribute("stdDeviation");
+  blur.removeAttributeNS(null, "stdDeviation");
   blur.setAttribute("stdDeviation", "2, 3");
 
   eventChecker.expect("");
@@ -111,6 +115,7 @@ function runTests()
   convolve.setAttribute("targetX", "12");
   convolve.targetX.baseVal = 6;
   convolve.removeAttribute("targetX");
+  convolve.removeAttributeNS(null, "targetX");
   convolve.targetX.baseVal = 8;
 
   // Check redundant change when comparing typed value to attribute value
@@ -129,6 +134,7 @@ function runTests()
   filter.setAttribute("filterRes", "60, 70");
   filter.filterResX.baseVal = 50;
   filter.removeAttribute("filterRes");
+  filter.removeAttributeNS(null, "filterRes");
   filter.setAttribute("filterRes", "50, 60");
 
   eventChecker.expect("");
@@ -149,6 +155,7 @@ function runTests()
   marker.orientAngle.baseVal.newValueSpecifiedUnits(
     SVGAngle.SVG_ANGLETYPE_GRAD, 45);
   marker.removeAttribute("orient");
+  marker.removeAttributeNS(null, "orient");
   marker.orientAngle.baseVal.value = 40;
 
   eventChecker.expect("");
@@ -167,6 +174,7 @@ function runTests()
   convolve.setAttribute("preserveAlpha", "true");
   convolve.preserveAlpha.baseVal = false;
   convolve.removeAttribute("preserveAlpha");
+  convolve.removeAttributeNS(null, "preserveAlpha");
   convolve.preserveAlpha.baseVal = true;
 
   eventChecker.expect("");
@@ -180,6 +188,7 @@ function runTests()
   convolve.setAttribute("edgeMode", "none");
   convolve.edgeMode.baseVal = SVGFEConvolveMatrixElement.SVG_EDGEMODE_WRAP;
   convolve.removeAttribute("edgeMode");
+  convolve.removeAttributeNS(null, "edgeMode");
   convolve.edgeMode.baseVal = SVGFEConvolveMatrixElement.SVG_EDGEMODE_NONE;
 
   eventChecker.expect("");
@@ -194,6 +203,7 @@ function runTests()
   convolve.setAttribute("result", "bar");
   convolve.result.baseVal = "foo";
   convolve.removeAttribute("result");
+  convolve.removeAttributeNS(null, "result");
   convolve.result.baseVal = "bar";
 
   eventChecker.expect("");
@@ -209,6 +219,7 @@ function runTests()
   marker.preserveAspectRatio.baseVal.align =
     SVGPreserveAspectRatio.SVG_PRESERVEASPECTRATIO_XMAXYMAX;
   marker.removeAttribute("preserveAspectRatio");
+  marker.removeAttributeNS(null, "preserveAspectRatio");
   marker.preserveAspectRatio.baseVal.align =
     SVGPreserveAspectRatio.SVG_PRESERVEASPECTRATIO_XMIDYMIN;
 
@@ -224,6 +235,7 @@ function runTests()
   marker.setAttribute("viewBox", "1 2 3 4");
   marker.viewBox.baseVal.height = 5;
   marker.removeAttribute("viewBox");
+  marker.removeAttributeNS(null, "viewBox");
   marker.viewBox.baseVal.height = 4;
 
   eventChecker.ignoreEvents();
diff --git a/content/xbl/src/nsBindingManager.cpp b/content/xbl/src/nsBindingManager.cpp
index 5f56ec3938e..82d9b93467f 100644
--- a/content/xbl/src/nsBindingManager.cpp
+++ b/content/xbl/src/nsBindingManager.cpp
@@ -41,7 +41,6 @@
 #include "nsCOMPtr.h"
 #include "nsIXBLService.h"
 #include "nsIInputStream.h"
-#include "nsDoubleHashtable.h"
 #include "nsIURI.h"
 #include "nsIURL.h"
 #include "nsIChannel.h"
diff --git a/content/xbl/test/test_bug389322.xhtml b/content/xbl/test/test_bug389322.xhtml
index 95190f4cb69..13ff8c672ff 100644
--- a/content/xbl/test/test_bug389322.xhtml
+++ b/content/xbl/test/test_bug389322.xhtml
@@ -113,7 +113,7 @@ function report(testName, success) {
 ]]></script>
 <script type="text/javascript"><![CDATA[
   try {
-    let (x=1) (x);
+    eval("let (x=1) (x)");
     var success = false;
   }
   catch (e) { success = true; }
diff --git a/content/xslt/src/xml/txDOM.h b/content/xslt/src/xml/txDOM.h
index 7b0a3504b70..4dcb7cdd7c5 100644
--- a/content/xslt/src/xml/txDOM.h
+++ b/content/xslt/src/xml/txDOM.h
@@ -55,7 +55,8 @@
 
 #include "txList.h"
 #include "nsIAtom.h"
-#include "nsDoubleHashtable.h"
+#include "nsTHashtable.h"
+#include "nsBaseHashtable.h"
 #include "nsString.h"
 #include "txCore.h"
 #include "nsAutoPtr.h"
@@ -229,24 +230,7 @@ class NodeDefinition : public Node
 //Definition and Implementation of a Document.
 //
 
-/**
- * nsDoubleHashtable definitions for IDs
- *
- * It may be possible to share the key value with the element,
- * but that may leave entries without keys, as the entries
- * are constructed from the key value and the setting of mElement
- * happens late. As pldhash.h ain't clear on this, we store the
- * key by inheriting from PLDHashStringEntry.
- */
-class txIDEntry : public PLDHashStringEntry
-{
-public:
-    txIDEntry(const void* aKey) : PLDHashStringEntry(aKey), mElement(nsnull)
-    {
-    }
-    Element* mElement;
-};
-DECL_DHASH_WRAPPER(txIDMap, txIDEntry, nsAString&)
+typedef nsTHashtable<nsBaseHashtableET<nsStringHashKey, Element*> > txIDMap;
 
 class Document : public NodeDefinition
 {
diff --git a/content/xslt/src/xslt/txKey.h b/content/xslt/src/xslt/txKey.h
index 9440766c473..212ea4a6b4a 100644
--- a/content/xslt/src/xslt/txKey.h
+++ b/content/xslt/src/xslt/txKey.h
@@ -39,7 +39,7 @@
 #ifndef txKey_h__
 #define txKey_h__
 
-#include "nsDoubleHashtable.h"
+#include "nsTHashtable.h"
 #include "txNodeSet.h"
 #include "txList.h"
 #include "txXSLTPatterns.h"
@@ -68,21 +68,31 @@ public:
 
 struct txKeyValueHashEntry : public PLDHashEntryHdr
 {
-    txKeyValueHashEntry(const void* aKey)
-        : mKey(*static_cast<const txKeyValueHashKey*>(aKey)),
-          mNodeSet(new txNodeSet(nsnull))
-    {
-    }
+public:
+    typedef const txKeyValueHashKey& KeyType;
+    typedef const txKeyValueHashKey* KeyTypePointer;
 
-    // @see nsDoubleHashtable.h
-    bool MatchEntry(const void* aKey) const;
-    static PLDHashNumber HashKey(const void* aKey);
+    txKeyValueHashEntry(KeyTypePointer aKey)
+        : mKey(*aKey),
+          mNodeSet(new txNodeSet(nsnull)) { }
+
+    txKeyValueHashEntry(const txKeyValueHashEntry& entry)
+        : mKey(entry.mKey),
+          mNodeSet(entry.mNodeSet) { }
+
+    bool KeyEquals(KeyTypePointer aKey) const;
+
+    static KeyTypePointer KeyToPointer(KeyType aKey) { return &aKey; }
+
+    static PLDHashNumber HashKey(KeyTypePointer aKey);
+
+    enum { ALLOW_MEMMOVE = true };
     
     txKeyValueHashKey mKey;
     nsRefPtr<txNodeSet> mNodeSet;
 };
 
-DECL_DHASH_WRAPPER(txKeyValueHash, txKeyValueHashEntry, txKeyValueHashKey&)
+typedef nsTHashtable<txKeyValueHashEntry> txKeyValueHash;
 
 class txIndexedKeyHashKey
 {
@@ -100,22 +110,31 @@ public:
 
 struct txIndexedKeyHashEntry : public PLDHashEntryHdr
 {
-    txIndexedKeyHashEntry(const void* aKey)
-        : mKey(*static_cast<const txIndexedKeyHashKey*>(aKey)),
-          mIndexed(false)
-    {
-    }
+public:
+    typedef const txIndexedKeyHashKey& KeyType;
+    typedef const txIndexedKeyHashKey* KeyTypePointer;
 
-    // @see nsDoubleHashtable.h
-    bool MatchEntry(const void* aKey) const;
-    static PLDHashNumber HashKey(const void* aKey);
+    txIndexedKeyHashEntry(KeyTypePointer aKey)
+        : mKey(*aKey),
+          mIndexed(false) { }
+
+    txIndexedKeyHashEntry(const txIndexedKeyHashEntry& entry)
+        : mKey(entry.mKey),
+          mIndexed(entry.mIndexed) { }
+
+    bool KeyEquals(KeyTypePointer aKey) const;
+
+    static KeyTypePointer KeyToPointer(KeyType aKey) { return &aKey; }
+
+    static PLDHashNumber HashKey(KeyTypePointer aKey);
+
+    enum { ALLOW_MEMMOVE = true };
 
     txIndexedKeyHashKey mKey;
     bool mIndexed;
 };
 
-DECL_DHASH_WRAPPER(txIndexedKeyHash, txIndexedKeyHashEntry,
-                   txIndexedKeyHashKey&)
+typedef nsTHashtable<txIndexedKeyHashEntry> txIndexedKeyHash;
 
 /**
  * Class holding all <xsl:key>s of a particular expanded name in the
diff --git a/content/xslt/src/xslt/txKeyFunctionCall.cpp b/content/xslt/src/xslt/txKeyFunctionCall.cpp
index f5f24676473..e3993c23497 100644
--- a/content/xslt/src/xslt/txKeyFunctionCall.cpp
+++ b/content/xslt/src/xslt/txKeyFunctionCall.cpp
@@ -152,51 +152,36 @@ txKeyFunctionCall::getNameAtom(nsIAtom** aAtom)
  * Hash functions
  */
 
-DHASH_WRAPPER(txKeyValueHash, txKeyValueHashEntry, txKeyValueHashKey&)
-DHASH_WRAPPER(txIndexedKeyHash, txIndexedKeyHashEntry, txIndexedKeyHashKey&)
-
 bool
-txKeyValueHashEntry::MatchEntry(const void* aKey) const
+txKeyValueHashEntry::KeyEquals(KeyTypePointer aKey) const
 {
-    const txKeyValueHashKey* key =
-        static_cast<const txKeyValueHashKey*>(aKey);
-
-    return mKey.mKeyName == key->mKeyName &&
-           mKey.mRootIdentifier == key->mRootIdentifier &&
-           mKey.mKeyValue.Equals(key->mKeyValue);
+    return mKey.mKeyName == aKey->mKeyName &&
+           mKey.mRootIdentifier == aKey->mRootIdentifier &&
+           mKey.mKeyValue.Equals(aKey->mKeyValue);
 }
 
 PLDHashNumber
-txKeyValueHashEntry::HashKey(const void* aKey)
+txKeyValueHashEntry::HashKey(KeyTypePointer aKey)
 {
-    const txKeyValueHashKey* key =
-        static_cast<const txKeyValueHashKey*>(aKey);
-
-    return key->mKeyName.mNamespaceID ^
-           NS_PTR_TO_INT32(key->mKeyName.mLocalName.get()) ^
-           key->mRootIdentifier ^
-           HashString(key->mKeyValue);
+    return aKey->mKeyName.mNamespaceID ^
+           NS_PTR_TO_INT32(aKey->mKeyName.mLocalName.get()) ^
+           aKey->mRootIdentifier ^
+           HashString(aKey->mKeyValue);
 }
 
 bool
-txIndexedKeyHashEntry::MatchEntry(const void* aKey) const
+txIndexedKeyHashEntry::KeyEquals(KeyTypePointer aKey) const
 {
-    const txIndexedKeyHashKey* key =
-        static_cast<const txIndexedKeyHashKey*>(aKey);
-
-    return mKey.mKeyName == key->mKeyName &&
-           mKey.mRootIdentifier == key->mRootIdentifier;
+    return mKey.mKeyName == aKey->mKeyName &&
+           mKey.mRootIdentifier == aKey->mRootIdentifier;
 }
 
 PLDHashNumber
-txIndexedKeyHashEntry::HashKey(const void* aKey)
+txIndexedKeyHashEntry::HashKey(KeyTypePointer aKey)
 {
-    const txIndexedKeyHashKey* key =
-        static_cast<const txIndexedKeyHashKey*>(aKey);
-
-    return key->mKeyName.mNamespaceID ^
-           NS_PTR_TO_INT32(key->mKeyName.mLocalName.get()) ^
-           key->mRootIdentifier;
+    return aKey->mKeyName.mNamespaceID ^
+           NS_PTR_TO_INT32(aKey->mKeyName.mLocalName.get()) ^
+           aKey->mRootIdentifier;
 }
 
 /*
@@ -211,9 +196,6 @@ txKeyHash::getKeyNodes(const txExpandedName& aKeyName,
                        txExecutionState& aEs,
                        txNodeSet** aResult)
 {
-    NS_ENSURE_TRUE(mKeyValues.mHashTable.ops && mIndexedKeys.mHashTable.ops,
-                   NS_ERROR_OUT_OF_MEMORY);
-
     *aResult = nsnull;
 
     PRInt32 identifier = txXPathNodeUtils::getUniqueIdentifier(aRoot);
@@ -241,7 +223,7 @@ txKeyHash::getKeyNodes(const txExpandedName& aKeyName,
     }
 
     txIndexedKeyHashKey indexKey(aKeyName, identifier);
-    txIndexedKeyHashEntry* indexEntry = mIndexedKeys.AddEntry(indexKey);
+    txIndexedKeyHashEntry* indexEntry = mIndexedKeys.PutEntry(indexKey);
     NS_ENSURE_TRUE(indexEntry, NS_ERROR_OUT_OF_MEMORY);
 
     if (indexEntry->mIndexed) {
@@ -412,7 +394,7 @@ nsresult txXSLKey::testNode(const txXPathNode& aNode,
                     txXPathNodeUtils::appendNodeValue(res->get(i), val);
 
                     aKey.mKeyValue.Assign(val);
-                    txKeyValueHashEntry* entry = aKeyValueHash.AddEntry(aKey);
+                    txKeyValueHashEntry* entry = aKeyValueHash.PutEntry(aKey);
                     NS_ENSURE_TRUE(entry && entry->mNodeSet,
                                    NS_ERROR_OUT_OF_MEMORY);
 
@@ -427,7 +409,7 @@ nsresult txXSLKey::testNode(const txXPathNode& aNode,
                 exprResult->stringValue(val);
 
                 aKey.mKeyValue.Assign(val);
-                txKeyValueHashEntry* entry = aKeyValueHash.AddEntry(aKey);
+                txKeyValueHashEntry* entry = aKeyValueHash.PutEntry(aKey);
                 NS_ENSURE_TRUE(entry && entry->mNodeSet,
                                NS_ERROR_OUT_OF_MEMORY);
 
diff --git a/dom/base/Makefile.in b/dom/base/Makefile.in
index 034e1dbab03..6024f020959 100644
--- a/dom/base/Makefile.in
+++ b/dom/base/Makefile.in
@@ -66,10 +66,12 @@ EXTRA_COMPONENTS = \
 		$(NULL)
 
 EXTRA_JS_MODULES += Webapps.jsm \
-        DOMRequestHelper.jsm \
 		$(NULL)
 endif
 
+EXTRA_JS_MODULES += DOMRequestHelper.jsm \
+		$(NULL)
+
 XPIDLSRCS = \
   nsIDOMDOMError.idl \
   nsIDOMDOMRequest.idl \
diff --git a/dom/base/Navigator.cpp b/dom/base/Navigator.cpp
index b8cf9f6a33a..022e6779b90 100644
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -70,6 +70,8 @@
 #include "mozilla/Telemetry.h"
 #include "BatteryManager.h"
 #include "PowerManager.h"
+#include "nsIDOMWakeLock.h"
+#include "nsIPowerManagerService.h"
 #include "SmsManager.h"
 #include "nsISmsService.h"
 #include "mozilla/Hal.h"
@@ -172,7 +174,10 @@ Navigator::Invalidate()
     mBatteryManager = nsnull;
   }
 
-  mPowerManager = nsnull;
+  if (mPowerManager) {
+    mPowerManager->Shutdown();
+    mPowerManager = nsnull;
+  }
 
   if (mSmsManager) {
     mSmsManager->Shutdown();
@@ -958,15 +963,38 @@ Navigator::GetMozBattery(nsIDOMMozBatteryManager** aBattery)
 NS_IMETHODIMP
 Navigator::GetMozPower(nsIDOMMozPowerManager** aPower)
 {
+  *aPower = nsnull;
+
   if (!mPowerManager) {
+    nsCOMPtr<nsPIDOMWindow> win = do_QueryReferent(mWindow);
+    NS_ENSURE_TRUE(win, NS_OK);
+
     mPowerManager = new power::PowerManager();
+    mPowerManager->Init(win);
   }
 
-  NS_ADDREF(*aPower = mPowerManager);
+  nsCOMPtr<nsIDOMMozPowerManager> power =
+    do_QueryInterface(NS_ISUPPORTS_CAST(nsIDOMMozPowerManager*, mPowerManager));
+  power.forget(aPower);
 
   return NS_OK;
 }
 
+NS_IMETHODIMP
+Navigator::RequestWakeLock(const nsAString &aTopic, nsIDOMMozWakeLock **aWakeLock)
+{
+  *aWakeLock = nsnull;
+
+  nsCOMPtr<nsPIDOMWindow> win = do_QueryReferent(mWindow);
+  NS_ENSURE_TRUE(win, NS_OK);
+
+  nsCOMPtr<nsIPowerManagerService> pmService =
+    do_GetService(POWERMANAGERSERVICE_CONTRACTID);
+  NS_ENSURE_TRUE(pmService, NS_OK);
+
+  return pmService->NewWakeLock(aTopic, win, aWakeLock);
+}
+
 //*****************************************************************************
 //    Navigator::nsIDOMNavigatorSms
 //*****************************************************************************
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index d671508d33f..115d59ab4bd 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -507,6 +507,7 @@ using mozilla::dom::indexedDB::IDBWrapperCache;
 #include "nsIDOMBatteryManager.h"
 #include "BatteryManager.h"
 #include "nsIDOMPowerManager.h"
+#include "nsIDOMWakeLock.h"
 #include "nsIDOMSmsManager.h"
 #include "nsIDOMSmsMessage.h"
 #include "nsIDOMSmsEvent.h"
@@ -1436,6 +1437,9 @@ static nsDOMClassInfoData sClassInfoData[] = {
   NS_DEFINE_CLASSINFO_DATA(MozPowerManager, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
+  NS_DEFINE_CLASSINFO_DATA(MozWakeLock, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
+
   NS_DEFINE_CLASSINFO_DATA(MozSmsManager, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
@@ -1671,6 +1675,12 @@ NS_DEFINE_EVENT_CTOR(PageTransitionEvent)
 NS_DEFINE_EVENT_CTOR(CloseEvent)
 NS_DEFINE_EVENT_CTOR(UIEvent)
 NS_DEFINE_EVENT_CTOR(MouseEvent)
+nsresult
+NS_DOMStorageEventCtor(nsISupports** aInstancePtrResult)
+{
+  nsDOMStorageEvent* e = new nsDOMStorageEvent();
+  return CallQueryInterface(e, aInstancePtrResult);
+}
 
 struct nsConstructorFuncMapData
 {
@@ -1696,6 +1706,7 @@ static const nsConstructorFuncMapData kConstructorFuncMap[] =
   NS_DEFINE_EVENT_CONSTRUCTOR_FUNC_DATA(CloseEvent)
   NS_DEFINE_EVENT_CONSTRUCTOR_FUNC_DATA(UIEvent)
   NS_DEFINE_EVENT_CONSTRUCTOR_FUNC_DATA(MouseEvent)
+  NS_DEFINE_EVENT_CONSTRUCTOR_FUNC_DATA(StorageEvent)
   NS_DEFINE_CONSTRUCTOR_FUNC_DATA(MozSmsFilter, sms::SmsFilter::NewSmsFilter)
 };
 
@@ -3891,6 +3902,7 @@ nsDOMClassInfo::Init()
 
   DOM_CLASSINFO_MAP_BEGIN(StorageEvent, nsIDOMStorageEvent)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMStorageEvent)
+    DOM_CLASSINFO_EVENT_MAP_ENTRIES
   DOM_CLASSINFO_MAP_END
 
   DOM_CLASSINFO_MAP_BEGIN(StorageEventObsolete, nsIDOMStorageEventObsolete)
@@ -4031,6 +4043,10 @@ nsDOMClassInfo::Init()
      DOM_CLASSINFO_MAP_ENTRY(nsIDOMMozPowerManager)
   DOM_CLASSINFO_MAP_END
 
+  DOM_CLASSINFO_MAP_BEGIN(MozWakeLock, nsIDOMMozWakeLock)
+     DOM_CLASSINFO_MAP_ENTRY(nsIDOMMozWakeLock)
+  DOM_CLASSINFO_MAP_END
+
   DOM_CLASSINFO_MAP_BEGIN(MozSmsManager, nsIDOMMozSmsManager)
      DOM_CLASSINFO_MAP_ENTRY(nsIDOMMozSmsManager)
   DOM_CLASSINFO_MAP_END
diff --git a/dom/base/nsDOMClassInfoClasses.h b/dom/base/nsDOMClassInfoClasses.h
index 37d56358bec..14c7e78114a 100644
--- a/dom/base/nsDOMClassInfoClasses.h
+++ b/dom/base/nsDOMClassInfoClasses.h
@@ -429,6 +429,7 @@ DOMCI_CLASS(GeoPositionError)
 DOMCI_CLASS(MozBatteryManager)
 
 DOMCI_CLASS(MozPowerManager)
+DOMCI_CLASS(MozWakeLock)
 
 DOMCI_CLASS(MozSmsManager)
 DOMCI_CLASS(MozSmsMessage)
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index 275b42ec2a3..222693acb05 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -855,7 +855,7 @@ nsFocusManager::ContentRemoved(nsIDocument* aDocument, nsIContent* aContent)
       }
     }
 
-    NotifyFocusStateChange(aContent, shouldShowFocusRing, false);
+    NotifyFocusStateChange(content, shouldShowFocusRing, false);
   }
 
   return NS_OK;
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 02f49b0ad53..5a6c2c24db3 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1933,12 +1933,6 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
 
   bool reUseInnerWindow = aForceReuseInnerWindow || wouldReuseInnerWindow;
 
-  // Remember the old document's principal.
-  nsIPrincipal *oldPrincipal = nsnull;
-  if (oldDoc) {
-    oldPrincipal = oldDoc->NodePrincipal();
-  }
-
   nsresult rv = NS_OK;
 
   // Set mDocument even if this is an outer window to avoid
@@ -1956,6 +1950,7 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
   nsGlobalWindow *currentInner = GetCurrentInnerWindowInternal();
 
   nsRefPtr<nsGlobalWindow> newInnerWindow;
+  bool createdInnerWindow = false;
 
   bool thisChrome = IsChromeWindow();
 
@@ -2034,6 +2029,7 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
                    "Failed to get script global and holder");
 
       mCreatingInnerWindow = false;
+      createdInnerWindow = true;
       Thaw();
 
       NS_ENSURE_SUCCESS(rv, rv);
@@ -2114,6 +2110,19 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
       }
     }
 
+    // If we created a new inner window above, we need to do the last little bit
+    // of initialization now that the dust has settled.
+    if (createdInnerWindow) {
+      nsIXPConnect *xpc = nsContentUtils::XPConnect();
+      nsCOMPtr<nsIXPConnectWrappedNative> wrapper;
+      nsresult rv = xpc->GetWrappedNativeOfJSObject(cx, newInnerWindow->mJSObject,
+                                                    getter_AddRefs(wrapper));
+      NS_ENSURE_SUCCESS(rv, rv);
+      NS_ABORT_IF_FALSE(wrapper, "bad wrapper");
+      rv = wrapper->FinishInitForWrappedGlobal();
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+
     JSAutoEnterCompartment ac;
     if (!ac.enter(cx, mJSObject)) {
       NS_ERROR("unable to enter a compartment");
@@ -4693,7 +4702,7 @@ nsGlobalWindow::MakeScriptDialogTitle(nsAString &aOutTitle)
               nsXPIDLString tempString;
               nsContentUtils::FormatLocalizedString(nsContentUtils::eCOMMON_DIALOG_PROPERTIES,
                                                     "ScriptDlgHeading",
-                                                    formatStrings, ArrayLength(formatStrings),
+                                                    formatStrings,
                                                     tempString);
               aOutTitle = tempString;
             }
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 495e5658654..94b8f64bf73 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -147,6 +147,9 @@ static PRLogModuleInfo* gJSDiagnostics;
 // Force a CC after this long if there's anything in the purple buffer.
 #define NS_CC_FORCED                (2 * 60 * PR_USEC_PER_SEC) // 2 min
 
+// Don't allow an incremental GC to lock out the CC for too long.
+#define NS_MAX_CC_LOCKEDOUT_TIME    (5 * PR_USEC_PER_SEC) // 5 seconds
+
 // Trigger a CC if the purple buffer exceeds this size when we check it.
 #define NS_CC_PURPLE_LIMIT          250
 
@@ -160,8 +163,8 @@ static nsITimer *sCCTimer;
 
 static PRTime sLastCCEndTime;
 
-static bool sGCHasRun;
 static bool sCCLockedOut;
+static PRTime sCCLockedOutTime;
 
 static js::GCSliceCallback sPrevGCSliceCallback;
 
@@ -515,11 +518,10 @@ NS_ScriptErrorReporter(JSContext *cx,
           innerWindowID = innerWin->WindowID();
         }
       }
-      JSPrincipals *prin = report->originPrincipals;
-      nsIPrincipal *principal =
-        prin ? static_cast<nsJSPrincipals*>(prin)->nsIPrincipalPtr : nsnull;
       nsContentUtils::AddScriptRunner(
-        new ScriptErrorEvent(globalObject, principal, report->lineno,
+        new ScriptErrorEvent(globalObject,
+                             nsJSPrincipals::get(report->originPrincipals),
+                             report->lineno,
                              report->uctokenptr - report->uclinebuf,
                              report->flags, msg, fileName, sourceLine,
                              report->errorNumber != JSMSG_OUT_OF_MEMORY,
@@ -812,7 +814,7 @@ nsJSContext::DOMOperationCallback(JSContext *cx)
       const PRUnichar *formatParams[] = { filenameUTF16.get() };
       rv = nsContentUtils::FormatLocalizedString(nsContentUtils::eDOM_PROPERTIES,
                                                  "KillScriptLocation",
-                                                 formatParams, 1,
+                                                 formatParams,
                                                  scriptLocation);
 
       if (NS_SUCCEEDED(rv) && scriptLocation) {
@@ -1215,8 +1217,7 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
   // Safety first: get an object representing the script's principals, i.e.,
   // the entities who signed this script, or the fully-qualified-domain-name
   // or "codebase" from which it was loaded.
-  JSPrincipals *jsprin;
-  nsIPrincipal *principal = aPrincipal;
+  nsCOMPtr<nsIPrincipal> principal = aPrincipal;
   nsresult rv;
   if (!aPrincipal) {
     nsIScriptGlobalObject *global = GetGlobalObject();
@@ -1231,15 +1232,10 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
       return NS_ERROR_FAILURE;
   }
 
-  principal->GetJSPrincipals(mContext, &jsprin);
-
-  // From here on, we must JSPRINCIPALS_DROP(jsprin) before returning...
-
   bool ok = false;
 
   rv = sSecurityManager->CanExecuteScripts(mContext, principal, &ok);
   if (NS_FAILED(rv)) {
-    JSPRINCIPALS_DROP(mContext, jsprin);
     return NS_ERROR_FAILURE;
   }
 
@@ -1250,7 +1246,6 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
   nsCOMPtr<nsIJSContextStack> stack =
            do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
   if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
-    JSPRINCIPALS_DROP(mContext, jsprin);
     return NS_ERROR_FAILURE;
   }
 
@@ -1270,7 +1265,6 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
 
     JSAutoEnterCompartment ac;
     if (!ac.enter(mContext, aScopeObject)) {
-      JSPRINCIPALS_DROP(mContext, jsprin);
       stack->Pop(nsnull);
       return NS_ERROR_FAILURE;
     }
@@ -1279,7 +1273,7 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
 
     ok = ::JS_EvaluateUCScriptForPrincipalsVersion(mContext,
                                                    aScopeObject,
-                                                   jsprin,
+                                                   nsJSPrincipals::get(principal),
                                                    static_cast<const jschar*>(PromiseFlatString(aScript).get()),
                                                    aScript.Length(),
                                                    aURL,
@@ -1298,9 +1292,6 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
     }
   }
 
-  // Whew!  Finally done with these manually ref-counted things.
-  JSPRINCIPALS_DROP(mContext, jsprin);
-
   // If all went well, convert val to a string (XXXbe unless undefined?).
   if (ok) {
     if (aIsUndefined) {
@@ -1424,12 +1415,8 @@ nsJSContext::EvaluateString(const nsAString& aScript,
   // Safety first: get an object representing the script's principals, i.e.,
   // the entities who signed this script, or the fully-qualified-domain-name
   // or "codebase" from which it was loaded.
-  JSPrincipals *jsprin;
-  nsIPrincipal *principal = aPrincipal;
-  if (aPrincipal) {
-    aPrincipal->GetJSPrincipals(mContext, &jsprin);
-  }
-  else {
+  nsCOMPtr<nsIPrincipal> principal = aPrincipal;
+  if (!aPrincipal) {
     nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
       do_QueryInterface(GetGlobalObject());
     if (!objPrincipal)
@@ -1437,26 +1424,12 @@ nsJSContext::EvaluateString(const nsAString& aScript,
     principal = objPrincipal->GetPrincipal();
     if (!principal)
       return NS_ERROR_FAILURE;
-    principal->GetJSPrincipals(mContext, &jsprin);
   }
 
-  JSPrincipals *originJSprin;
-  if (aOriginPrincipal) {
-    aOriginPrincipal->GetJSPrincipals(mContext, &originJSprin);
-  } else {
-    originJSprin = nsnull;
-  }
-
-  // From here on, we must JSPRINCIPALS_DROP(jsprin) before returning...
-
   bool ok = false;
 
   nsresult rv = sSecurityManager->CanExecuteScripts(mContext, principal, &ok);
   if (NS_FAILED(rv)) {
-    JSPRINCIPALS_DROP(mContext, jsprin);
-    if (originJSprin) {
-      JSPRINCIPALS_DROP(mContext, originJSprin);
-    }
     return NS_ERROR_FAILURE;
   }
 
@@ -1467,10 +1440,6 @@ nsJSContext::EvaluateString(const nsAString& aScript,
   nsCOMPtr<nsIJSContextStack> stack =
            do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
   if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
-    JSPRINCIPALS_DROP(mContext, jsprin);
-    if (originJSprin) {
-      JSPRINCIPALS_DROP(mContext, originJSprin);
-    }
     return NS_ERROR_FAILURE;
   }
 
@@ -1495,15 +1464,12 @@ nsJSContext::EvaluateString(const nsAString& aScript,
     JSAutoEnterCompartment ac;
     if (!ac.enter(mContext, aScopeObject)) {
       stack->Pop(nsnull);
-      JSPRINCIPALS_DROP(mContext, jsprin);
-      if (originJSprin) {
-        JSPRINCIPALS_DROP(mContext, originJSprin);
-      }
       return NS_ERROR_FAILURE;
     }
 
     ok = JS_EvaluateUCScriptForPrincipalsVersionOrigin(
-      mContext, aScopeObject, jsprin, originJSprin,
+      mContext, aScopeObject,
+      nsJSPrincipals::get(principal), nsJSPrincipals::get(aOriginPrincipal),
       static_cast<const jschar*>(PromiseFlatString(aScript).get()),
       aScript.Length(), aURL, aLineNo, vp, JSVersion(aVersion));
 
@@ -1516,12 +1482,6 @@ nsJSContext::EvaluateString(const nsAString& aScript,
     }
   }
 
-  // Whew!  Finally done with these manually ref-counted things.
-  JSPRINCIPALS_DROP(mContext, jsprin);
-  if (originJSprin) {
-    JSPRINCIPALS_DROP(mContext, originJSprin);
-  }
-
   // If all went well, convert val to a string if one is wanted.
   if (ok) {
     JSAutoRequest ar(mContext);
@@ -1570,47 +1530,38 @@ nsJSContext::CompileScript(const PRUnichar* aText,
 
   JSObject* scopeObject = ::JS_GetGlobalObject(mContext);
 
-  JSPrincipals *jsprin;
-  aPrincipal->GetJSPrincipals(mContext, &jsprin);
-  // From here on, we must JSPRINCIPALS_DROP(jsprin) before returning...
-
   bool ok = false;
 
   nsresult rv = sSecurityManager->CanExecuteScripts(mContext, aPrincipal, &ok);
   if (NS_FAILED(rv)) {
-    JSPRINCIPALS_DROP(mContext, jsprin);
     return NS_ERROR_FAILURE;
   }
 
   aScriptObject.drop(); // ensure old object not used on failure...
 
-  // SecurityManager said "ok", but don't compile if aVersion is unknown.
+  // Don't compile if SecurityManager said "not ok" or aVersion is unknown.
   // Since the caller is responsible for parsing the version strings, we just
   // check it isn't JSVERSION_UNKNOWN.
-  if (ok && ((JSVersion)aVersion) != JSVERSION_UNKNOWN) {
-    JSAutoRequest ar(mContext);
+  if (!ok || JSVersion(aVersion) == JSVERSION_UNKNOWN)
+    return NS_OK;
+    
+  JSAutoRequest ar(mContext);
 
-    JSScript* script =
-        ::JS_CompileUCScriptForPrincipalsVersion(mContext,
-                                                 scopeObject,
-                                                 jsprin,
-                                                 static_cast<const jschar*>(aText),
-                                                 aTextLength,
-                                                 aURL,
-                                                 aLineNo,
-                                                 JSVersion(aVersion));
-    if (script) {
-      NS_ASSERTION(aScriptObject.getScriptTypeID()==JAVASCRIPT,
-                   "Expecting JS script object holder");
-      rv = aScriptObject.set(script);
-    } else {
-      rv = NS_ERROR_OUT_OF_MEMORY;
-    }
+  JSScript* script =
+    ::JS_CompileUCScriptForPrincipalsVersion(mContext,
+                                             scopeObject,
+                                             nsJSPrincipals::get(aPrincipal),
+                                             static_cast<const jschar*>(aText),
+                                             aTextLength,
+                                             aURL,
+                                             aLineNo,
+                                             JSVersion(aVersion));
+  if (!script) {
+    return NS_ERROR_OUT_OF_MEMORY;
   }
-
-  // Whew!  Finally done.
-  JSPRINCIPALS_DROP(mContext, jsprin);
-  return rv;
+  NS_ASSERTION(aScriptObject.getScriptTypeID()==JAVASCRIPT,
+               "Expecting JS script object holder");
+  return aScriptObject.set(script);
 }
 
 nsresult
@@ -1833,17 +1784,15 @@ nsJSContext::CompileFunction(JSObject* aTarget,
     return NS_ERROR_ILLEGAL_VALUE;
   }
 
-  JSPrincipals *jsprin = nsnull;
-
   nsIScriptGlobalObject *global = GetGlobalObject();
+  nsCOMPtr<nsIPrincipal> principal;
   if (global) {
     // XXXbe why the two-step QI? speed up via a new GetGlobalObjectData func?
     nsCOMPtr<nsIScriptObjectPrincipal> globalData = do_QueryInterface(global);
     if (globalData) {
-      nsIPrincipal *prin = globalData->GetPrincipal();
-      if (!prin)
+      principal = globalData->GetPrincipal();
+      if (!principal)
         return NS_ERROR_FAILURE;
-      prin->GetJSPrincipals(mContext, &jsprin);
     }
   }
 
@@ -1853,7 +1802,8 @@ nsJSContext::CompileFunction(JSObject* aTarget,
 
   JSFunction* fun =
       ::JS_CompileUCFunctionForPrincipalsVersion(mContext,
-                                                 aShared ? nsnull : target, jsprin,
+                                                 aShared ? nsnull : target,
+                                                 nsJSPrincipals::get(principal),
                                                  PromiseFlatCString(aName).get(),
                                                  aArgCount, aArgArray,
                                                  static_cast<const jschar*>(PromiseFlatString(aBody).get()),
@@ -1861,8 +1811,6 @@ nsJSContext::CompileFunction(JSObject* aTarget,
                                                  aURL, aLineNo,
                                                  JSVersion(aVersion));
 
-  if (jsprin)
-    JSPRINCIPALS_DROP(mContext, jsprin);
   if (!fun)
     return NS_ERROR_FAILURE;
 
@@ -2314,19 +2262,11 @@ nsresult
 nsJSContext::SetOuterObject(JSObject* aOuterObject)
 {
   // Force our context's global object to be the outer.
+  // NB: JS_SetGlobalObject sets mContext->compartment.
   JS_SetGlobalObject(mContext, aOuterObject);
 
-  // NB: JS_SetGlobalObject sets mContext->compartment.
+  // Set up the prototype for the outer object.
   JSObject *inner = JS_GetParent(aOuterObject);
-
-  nsIXPConnect *xpc = nsContentUtils::XPConnect();
-  nsCOMPtr<nsIXPConnectWrappedNative> wrapper;
-  nsresult rv = xpc->GetWrappedNativeOfJSObject(mContext, inner,
-                                                getter_AddRefs(wrapper));
-  NS_ENSURE_SUCCESS(rv, rv);
-  NS_ABORT_IF_FALSE(wrapper, "bad wrapper");
-
-  wrapper->FinishInitForWrappedGlobal();
   JS_SetPrototype(mContext, aOuterObject, JS_GetPrototype(inner));
 
   return NS_OK;
@@ -3318,9 +3258,24 @@ TimerFireForgetSkippable(PRUint32 aSuspected, bool aRemoveChildless)
 static void
 CCTimerFired(nsITimer *aTimer, void *aClosure)
 {
-  if (sDidShutdown || sCCLockedOut) {
+  if (sDidShutdown) {
     return;
   }
+
+  if (sCCLockedOut) {
+    PRTime now = PR_Now();
+    if (sCCLockedOutTime == 0) {
+      sCCLockedOutTime = now;
+      return;
+    }
+    if (now - sCCLockedOutTime < NS_MAX_CC_LOCKEDOUT_TIME) {
+      return;
+    }
+
+    // Finish the current incremental GC
+    nsJSContext::GarbageCollectNow(js::gcreason::CC_FORCED, nsGCNormal);
+  }
+
   ++sCCTimerFireCount;
 
   // During early timer fires, we only run forgetSkippable. During the first
@@ -3486,6 +3441,8 @@ nsJSContext::KillShrinkGCBuffersTimer()
 void
 nsJSContext::KillCCTimer()
 {
+  sCCLockedOutTime = 0;
+
   if (sCCTimer) {
     sCCTimer->Cancel();
 
@@ -3524,9 +3481,10 @@ DOMGCSliceCallback(JSRuntime *aRt, js::GCProgress aProgress, const js::GCDescrip
     }
   }
 
-  // Prevent cycle collections during incremental GC.
+  // Prevent cycle collections and shrinking during incremental GC.
   if (aProgress == js::GC_CYCLE_BEGIN) {
     sCCLockedOut = true;
+    nsJSContext::KillShrinkGCBuffersTimer();
   } else if (aProgress == js::GC_CYCLE_END) {
     sCCLockedOut = false;
   }
@@ -3534,43 +3492,31 @@ DOMGCSliceCallback(JSRuntime *aRt, js::GCProgress aProgress, const js::GCDescrip
   // The GC has more work to do, so schedule another GC slice.
   if (aProgress == js::GC_SLICE_END) {
     nsJSContext::KillGCTimer();
-    nsJSContext::KillCCTimer();
-
     nsJSContext::PokeGC(js::gcreason::INTER_SLICE_GC, NS_INTERSLICE_GC_DELAY);
   }
 
   if (aProgress == js::GC_CYCLE_END) {
+    // May need to kill the inter-slice GC timer
+    nsJSContext::KillGCTimer();
+
     sCCollectedWaitingForGC = 0;
     sCleanupSinceLastGC = false;
 
-    if (sGCTimer) {
-      // If we were waiting for a GC to happen, kill the timer.
-      nsJSContext::KillGCTimer();
-
+    if (aDesc.isCompartment) {
       // If this is a compartment GC, restart it. We still want
       // a full GC to happen. Compartment GCs usually happen as a
-      // result of last-ditch or MaybeGC. In both cases its
+      // result of last-ditch or MaybeGC. In both cases it is
       // probably a time of heavy activity and we want to delay
       // the full GC, but we do want it to happen eventually.
-      if (aDesc.isCompartment) {
-        nsJSContext::PokeGC(js::gcreason::POST_COMPARTMENT);
-
-        // We poked the GC, so we can kill any pending CC here.
-        nsJSContext::KillCCTimer();
-      }
-    } else {
-      // If this was a full GC, poke the CC to run soon.
-      if (!aDesc.isCompartment) {
-        sGCHasRun = true;
-        sNeedsFullCC = true;
-        nsJSContext::MaybePokeCC();
-      }
+      nsJSContext::PokeGC(js::gcreason::POST_COMPARTMENT);
     }
 
-    // If we didn't end up scheduling a GC, make sure that we release GC buffers
-    // soon after canceling previous shrinking attempt.
-    nsJSContext::KillShrinkGCBuffersTimer();
-    if (!sGCTimer) {
+    sNeedsFullCC = true;
+    nsJSContext::MaybePokeCC();
+
+    if (!aDesc.isCompartment) {
+      // Avoid shrinking during heavy activity, which is suggested by
+      // compartment GC.
       nsJSContext::PokeShrinkGCBuffers();
     }
   }
@@ -3669,8 +3615,8 @@ nsJSRuntime::Startup()
 {
   // initialize all our statics, so that we can restart XPCOM
   sGCTimer = sCCTimer = nsnull;
-  sGCHasRun = false;
   sCCLockedOut = false;
+  sCCLockedOutTime = 0;
   sLastCCEndTime = 0;
   sPendingLoadCount = 0;
   sLoadingInProgress = false;
@@ -3767,33 +3713,6 @@ SetMemoryGCSliceTimePrefChangedCallback(const char* aPrefName, void* aClosure)
   return 0;
 }
 
-static JSPrincipals *
-ObjectPrincipalFinder(JSContext *cx, JSObject *obj)
-{
-  if (!sSecurityManager)
-    return nsnull;
-
-  nsCOMPtr<nsIPrincipal> principal;
-  nsresult rv =
-    sSecurityManager->GetObjectPrincipal(cx, obj,
-                                         getter_AddRefs(principal));
-
-  if (NS_FAILED(rv) || !principal) {
-    return nsnull;
-  }
-
-  JSPrincipals *jsPrincipals = nsnull;
-  principal->GetJSPrincipals(cx, &jsPrincipals);
-
-  // nsIPrincipal::GetJSPrincipals() returns a strong reference to the
-  // JS principals, but the caller of this function expects a weak
-  // reference. So we need to release here.
-
-  JSPRINCIPALS_DROP(cx, jsPrincipals);
-
-  return jsPrincipals;
-}
-
 JSObject*
 NS_DOMReadStructuredClone(JSContext* cx,
                           JSStructuredCloneReader* reader,
@@ -3852,11 +3771,6 @@ nsJSRuntime::Init()
 
   sPrevGCSliceCallback = js::SetGCSliceCallback(sRuntime, DOMGCSliceCallback);
 
-  JSSecurityCallbacks *callbacks = JS_GetRuntimeSecurityCallbacks(sRuntime);
-  NS_ASSERTION(callbacks, "SecMan should have set security callbacks!");
-
-  callbacks->findObjectPrincipals = ObjectPrincipalFinder;
-
   // Set up the structured clone callbacks.
   static JSStructuredCloneCallbacks cloneCallbacks = {
     NS_DOMReadStructuredClone,
@@ -3954,14 +3868,6 @@ nsJSRuntime::Shutdown()
     // We're being shutdown, and there are no more contexts
     // alive, release the JS runtime service and the security manager.
 
-    if (sRuntimeService && sSecurityManager) {
-      JSSecurityCallbacks *callbacks = JS_GetRuntimeSecurityCallbacks(sRuntime);
-      if (callbacks) {
-        NS_ASSERTION(callbacks->findObjectPrincipals == ObjectPrincipalFinder,
-                     "Fighting over the findObjectPrincipals callback!");
-        callbacks->findObjectPrincipals = NULL;
-      }
-    }
     NS_IF_RELEASE(sRuntimeService);
     NS_IF_RELEASE(sSecurityManager);
   }
diff --git a/dom/base/nsWindowMemoryReporter.cpp b/dom/base/nsWindowMemoryReporter.cpp
index 8d8bd1bdddf..b94e7afe683 100644
--- a/dom/base/nsWindowMemoryReporter.cpp
+++ b/dom/base/nsWindowMemoryReporter.cpp
@@ -90,7 +90,7 @@ AppendWindowURI(nsGlobalWindow *aWindow, nsACString& aStr)
 
 NS_MEMORY_REPORTER_MALLOC_SIZEOF_FUN(DOMStyleMallocSizeOf, "windows")
 
-static void
+static nsresult
 CollectWindowReports(nsGlobalWindow *aWindow,
                      nsWindowSizes *aWindowTotalSizes,
                      nsIMemoryMultiReporterCallback *aCb,
@@ -197,9 +197,11 @@ CollectWindowReports(nsGlobalWindow *aWindow,
     if (_amount > 0) {                                                        \
         nsCAutoString path(_path1);                                           \
         path += _path2;                                                       \
-        aCb->Callback(EmptyCString(), path, nsIMemoryReporter::KIND_HEAP,     \
+        nsresult rv;                                                          \
+        rv = aCb->Callback(EmptyCString(), path, nsIMemoryReporter::KIND_HEAP,\
                       nsIMemoryReporter::UNITS_BYTES, _amount,                \
                       NS_LITERAL_CSTRING(_desc), aClosure);                   \
+        NS_ENSURE_SUCCESS(rv, rv);                                            \
     }                                                                         \
   } while (0)
 
@@ -226,6 +228,8 @@ CollectWindowReports(nsGlobalWindow *aWindow,
   aWindowTotalSizes->mLayoutTextRuns += windowSizes.mLayoutTextRuns;
 
 #undef REPORT
+
+  return NS_OK;
 }
 
 typedef nsTArray< nsRefPtr<nsGlobalWindow> > WindowArray;
@@ -264,15 +268,18 @@ nsWindowMemoryReporter::CollectReports(nsIMemoryMultiReporterCallback* aCb,
   nsRefPtr<nsGlobalWindow> *end = w + windows.Length();
   nsWindowSizes windowTotalSizes(NULL);
   for (; w != end; ++w) {
-    CollectWindowReports(*w, &windowTotalSizes, aCb, aClosure);
+    nsresult rv = CollectWindowReports(*w, &windowTotalSizes, aCb, aClosure);
+    NS_ENSURE_SUCCESS(rv, rv);
   }
 
 #define REPORT(_path, _amount, _desc)                                         \
   do {                                                                        \
-    aCb->Callback(EmptyCString(), NS_LITERAL_CSTRING(_path),                  \
-                  nsIMemoryReporter::KIND_OTHER,                              \
-                  nsIMemoryReporter::UNITS_BYTES, _amount,                    \
-                  NS_LITERAL_CSTRING(_desc), aClosure);                       \
+    nsresult rv;                                                              \
+    rv = aCb->Callback(EmptyCString(), NS_LITERAL_CSTRING(_path),             \
+                       nsIMemoryReporter::KIND_OTHER,                         \
+                       nsIMemoryReporter::UNITS_BYTES, _amount,               \
+                       NS_LITERAL_CSTRING(_desc), aClosure);                  \
+    NS_ENSURE_SUCCESS(rv, rv);                                                \
   } while (0)
 
   REPORT("window-objects-dom", windowTotalSizes.mDOM, 
diff --git a/dom/bluetooth/BluetoothAdapter.cpp b/dom/bluetooth/BluetoothAdapter.cpp
index 0b974922044..0a1ec123a27 100644
--- a/dom/bluetooth/BluetoothAdapter.cpp
+++ b/dom/bluetooth/BluetoothAdapter.cpp
@@ -9,15 +9,61 @@
 #include "nsThreadUtils.h"
 #include "nsXPCOMCIDInternal.h"
 #include "mozilla/LazyIdleThread.h"
-
+#include <dlfcn.h>
 #include "BluetoothAdapter.h"
 
-#if defined(MOZ_WIDGET_GONK)
-#include <bluedroid/bluetooth.h>
-#endif
-
 USING_BLUETOOTH_NAMESPACE
 
+static struct BluedroidFunctions {
+  bool initialized;
+  bool tried_initialization;
+
+  BluedroidFunctions() :
+    initialized(false),
+    tried_initialization(false)
+  {
+  }
+  
+  int (* bt_enable)();
+  int (* bt_disable)();
+  int (* bt_is_enabled)();
+} sBluedroidFunctions;
+
+static bool EnsureBluetoothInit() {
+  if (sBluedroidFunctions.tried_initialization)
+  {
+    return sBluedroidFunctions.initialized;
+  }
+
+  sBluedroidFunctions.initialized = false;
+  sBluedroidFunctions.tried_initialization = true;
+  
+  void* handle = dlopen("libbluedroid.so", RTLD_LAZY);
+
+  if(!handle) {
+    NS_ERROR("Failed to open libbluedroid.so, bluetooth cannot run");
+    return false;
+  }
+
+  sBluedroidFunctions.bt_enable = (int (*)())dlsym(handle, "bt_enable");
+  if(sBluedroidFunctions.bt_enable == NULL) {
+    NS_ERROR("Failed to attach bt_enable function");
+    return false;
+  }
+  sBluedroidFunctions.bt_disable = (int (*)())dlsym(handle, "bt_disable");
+  if(sBluedroidFunctions.bt_disable == NULL) {
+    NS_ERROR("Failed to attach bt_disable function");
+    return false;
+  }
+  sBluedroidFunctions.bt_is_enabled = (int (*)())dlsym(handle, "bt_is_enabled");
+  if(sBluedroidFunctions.bt_is_enabled == NULL) {
+    NS_ERROR("Failed to attach bt_is_enabled function");
+    return false;
+  }
+  sBluedroidFunctions.initialized = true;
+  return true;
+}
+
 class ToggleBtResultTask : public nsRunnable
 {
   public:
@@ -54,7 +100,7 @@ class ToggleBtResultTask : public nsRunnable
 class ToggleBtTask : public nsRunnable
 {
   public:
-    ToggleBtTask(bool onOff, BluetoothAdapter* adapterPtr) 
+    ToggleBtTask(bool onOff, BluetoothAdapter* adapterPtr)
       : mOnOff(onOff),
         mAdapterPtr(adapterPtr) 
     {
@@ -65,18 +111,20 @@ class ToggleBtTask : public nsRunnable
     {
       MOZ_ASSERT(!NS_IsMainThread());
 
+      if(!EnsureBluetoothInit()) {
+        NS_ERROR("Failed to load bluedroid library.\n");
+        return NS_ERROR_FAILURE;
+      }
+
       bool result;
 
       //Toggle BT here
-#if defined(MOZ_WIDGET_GONK)  
+
       if (mOnOff) {
-        result = bt_enable();
+        result = sBluedroidFunctions.bt_enable();
       } else {
-        result = bt_disable();
+        result = sBluedroidFunctions.bt_disable();
       }
-#else 
-      result = true;
-#endif
 
       // Create a result thread and pass it to Main Thread, 
       nsCOMPtr<nsIRunnable> resultRunnable = new ToggleBtResultTask(mAdapterPtr, result);
@@ -89,8 +137,8 @@ class ToggleBtTask : public nsRunnable
     }
 
   private:
-    nsRefPtr<BluetoothAdapter> mAdapterPtr;
     bool mOnOff;
+    nsRefPtr<BluetoothAdapter> mAdapterPtr;
 };
 
 DOMCI_DATA(BluetoothAdapter, BluetoothAdapter)
@@ -123,18 +171,37 @@ BluetoothAdapter::BluetoothAdapter()
 NS_IMETHODIMP
 BluetoothAdapter::GetPower(bool* aPower)
 {
+#ifdef MOZ_WIDGET_GONK
+  if(!EnsureBluetoothInit()) {
+    NS_ERROR("Failed to load bluedroid library.\n");
+    return NS_ERROR_FAILURE;
+  }
+  *aPower = sBluedroidFunctions.bt_is_enabled();
+#else
   *aPower = mPower;
-
+#endif
   return NS_OK;
 }
 
 NS_IMETHODIMP
 BluetoothAdapter::SetPower(bool aPower)
 {
+
+#ifdef MOZ_WIDGET_GONK
+  // Platform specific check for gonk until object is divided in
+  // different implementations per platform. Linux doesn't require
+  // bluetooth firmware loading, but code should work otherwise.
+  if(!EnsureBluetoothInit()) {
+    NS_ERROR("Failed to load bluedroid library.\n");
+    return NS_ERROR_FAILURE;
+  }
+#endif
   if (mPower != aPower) {
     mPower = aPower;
 
+#ifdef MOZ_WIDGET_GONK
     return ToggleBluetoothAsync();
+#endif
   }
 
   return NS_OK;
diff --git a/dom/contacts/ContactManager.js b/dom/contacts/ContactManager.js
index 9821330351d..00955a56fd7 100644
--- a/dom/contacts/ContactManager.js
+++ b/dom/contacts/ContactManager.js
@@ -17,6 +17,15 @@ const Cu = Components.utils;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/DOMRequestHelper.jsm");
+
+XPCOMUtils.defineLazyGetter(Services, "rs", function() {
+  return Cc["@mozilla.org/dom/dom-request-service;1"].getService(Ci.nsIDOMRequestService);
+});
+
+XPCOMUtils.defineLazyGetter(this, "cpmm", function() {
+  return Cc["@mozilla.org/childprocessmessagemanager;1"].getService(Ci.nsIFrameMessageManager);
+});
 
 const nsIClassInfo            = Ci.nsIClassInfo;
 const CONTACTPROPERTIES_CID   = Components.ID("{53ed7c20-ceda-11e0-9572-0800200c9a66}");
@@ -184,6 +193,7 @@ function ContactManager()
 }
 
 ContactManager.prototype = {
+  __proto__: DOMRequestIpcHelper.prototype,
 
   save: function save(aContact) {
     let request;
@@ -222,9 +232,9 @@ ContactManager.prototype = {
 
       this._setMetaData(newContact, aContact);
       debug("send: " + JSON.stringify(newContact));
-      request = this._rs.createRequest(this._window);
-      this._mm.sendAsyncMessage("Contact:Save", {contact: newContact,
-                                                 requestID: this.getRequestId({ request: request })});
+      request = this.createRequest();
+      cpmm.sendAsyncMessage("Contact:Save", {contact: newContact,
+                                             requestID: this.getRequestId(request)});
       return request;
     } else {
       throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
@@ -234,9 +244,9 @@ ContactManager.prototype = {
   remove: function removeContact(aRecord) {
     let request;
     if (this.hasPrivileges) {
-      request = this._rs.createRequest(this._window);
-      this._mm.sendAsyncMessage("Contact:Remove", {id: aRecord.id,
-                                                   requestID: this.getRequestId({ request: request })});
+      request = this.createRequest();
+      cpmm.sendAsyncMessage("Contact:Remove", {id: aRecord.id,
+                                               requestID: this.getRequestId(request)});
       return request;
     } else {
       throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
@@ -260,26 +270,6 @@ ContactManager.prototype = {
     return contacts;
   },
 
-  getRequestId: function(aRequest) {
-    let id = "id" + this._getRandomId();
-    this._requests[id] = aRequest;
-    return id;
-  },
-
-  getRequest: function(aId) {
-    if (this._requests[aId])
-      return this._requests[aId].request;
-  },
-
-  removeRequest: function(aId) {
-    if (this._requests[aId])
-      delete this._requests[aId];
-  },
-  
-  _getRandomId: function() {
-    return Cc["@mozilla.org/uuid-generator;1"].getService(Ci.nsIUUIDGenerator).generateUUID().toString();
-  },
-
   receiveMessage: function(aMessage) {
     debug("Contactmanager::receiveMessage: " + aMessage.name);
     let msg = aMessage.json;
@@ -291,7 +281,7 @@ ContactManager.prototype = {
         if (req) {
           let result = this._convertContactsArray(contacts);
           debug("result: " + JSON.stringify(result));
-          this._rs.fireSuccess(req, result);
+          Services.rs.fireSuccess(req, result);
         } else {
           debug("no request stored!" + msg.requestID);
         }
@@ -301,7 +291,7 @@ ContactManager.prototype = {
       case "Contact:Remove:Return:OK":
         req = this.getRequest(msg.requestID);
         if (req)
-          this._rs.fireSuccess(req, 0);
+          Services.rs.fireSuccess(req, null);
         break;
       case "Contacts:Find:Return:KO":
       case "Contact:Save:Return:KO":
@@ -309,7 +299,7 @@ ContactManager.prototype = {
       case "Contacts:Clear:Return:KO":
         req = this.getRequest(msg.requestID);
         if (req)
-          this._rs.fireError(req, msg.errorMsg);
+          Services.rs.fireError(req, msg.errorMsg);
         break;
       default: 
         debug("Wrong message: " + aMessage.name);
@@ -320,9 +310,9 @@ ContactManager.prototype = {
   find: function(aOptions) {
     let request;
     if (this.hasPrivileges) {
-      request = this._rs.createRequest(this._window);
-      this._mm.sendAsyncMessage("Contacts:Find", {findOptions: aOptions, 
-                                                  requestID: this.getRequestId({ request: request })});
+      request = this.createRequest();
+      cpmm.sendAsyncMessage("Contacts:Find", {findOptions: aOptions, 
+                                              requestID: this.getRequestId(request)});
       return request;
     } else {
       debug("find not allowed");
@@ -333,8 +323,8 @@ ContactManager.prototype = {
   clear: function() {
     let request;
     if (this.hasPrivileges) {
-      request = this._rs.createRequest(this._window);
-      this._mm.sendAsyncMessage("Contacts:Clear", {requestID: this.getRequestId({ request: request })});
+      request = this.createRequest();
+      cpmm.sendAsyncMessage("Contacts:Clear", {requestID: this.getRequestId(request)});
       return request;
     } else {
       debug("clear not allowed");
@@ -347,22 +337,12 @@ ContactManager.prototype = {
     if (!Services.prefs.getBoolPref("dom.mozContacts.enabled"))
       return null;
 
-    this._window = aWindow;
-    this._messages = ["Contacts:Find:Return:OK", "Contacts:Find:Return:KO",
+    this.initHelper(aWindow, ["Contacts:Find:Return:OK", "Contacts:Find:Return:KO",
                      "Contacts:Clear:Return:OK", "Contacts:Clear:Return:KO",
                      "Contact:Save:Return:OK", "Contact:Save:Return:KO",
-                     "Contact:Remove:Return:OK", "Contact:Remove:Return:KO"];
+                     "Contact:Remove:Return:OK", "Contact:Remove:Return:KO"]);
 
-    this._mm = Cc["@mozilla.org/childprocessmessagemanager;1"].getService(Ci.nsIFrameMessageManager);
-    this._messages.forEach((function(msgName) {
-      this._mm.addMessageListener(msgName, this);
-    }).bind(this));
-
-    this._rs = Cc["@mozilla.org/dom/dom-request-service;1"].getService(Ci.nsIDOMRequestService);
-    this._requests = [];
     Services.obs.addObserver(this, "inner-window-destroyed", false);
-    let util = this._window.QueryInterface(Ci.nsIInterfaceRequestor).getInterface(Ci.nsIDOMWindowUtils);
-    this._innerWindowID = util.currentInnerWindowID;
 
     let principal = aWindow.document.nodePrincipal;
     let secMan = Cc["@mozilla.org/scriptsecuritymanager;1"].getService(Ci.nsIScriptSecurityManager);
@@ -376,21 +356,6 @@ ContactManager.prototype = {
     debug("has privileges :" + this.hasPrivileges);
   },
 
-  observe: function(aSubject, aTopic, aData) {
-    let wId = aSubject.QueryInterface(Ci.nsISupportsPRUint64).data;
-    if (wId == this.innerWindowID) {
-      Services.obs.removeObserver(this, "inner-window-destroyed");
-      this._messages.forEach((function(msgName) {
-        this._mm.removeMessageListener(msgName, this);
-      }).bind(this));
-      this._mm = null;
-      this._messages = null;
-      this._requests = null;
-      this._window = null;
-      this._innerWindowID = null;
-    }
-  },
-
   classID : CONTACTMANAGER_CID,
   QueryInterface : XPCOMUtils.generateQI([nsIDOMContactManager, Ci.nsIDOMGlobalPropertyInitializer]),
 
diff --git a/dom/contacts/fallback/ContactService.jsm b/dom/contacts/fallback/ContactService.jsm
index 9b76da688b1..63aa0c9dc00 100644
--- a/dom/contacts/fallback/ContactService.jsm
+++ b/dom/contacts/fallback/ContactService.jsm
@@ -20,16 +20,18 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/ContactDB.jsm");
 
+XPCOMUtils.defineLazyGetter(this, "ppmm", function() {
+  return Cc["@mozilla.org/parentprocessmessagemanager;1"].getService(Ci.nsIFrameMessageManager);
+});
+
 let myGlobal = this;
 
 let DOMContactManager = {
-
   init: function() {
     debug("Init");
-    this._mm = Cc["@mozilla.org/parentprocessmessagemanager;1"].getService(Ci.nsIFrameMessageManager);
     this._messages = ["Contacts:Find", "Contacts:Clear", "Contact:Save", "Contact:Remove"];
     this._messages.forEach((function(msgName) {
-      this._mm.addMessageListener(msgName, this);
+      ppmm.addMessageListener(msgName, this);
     }).bind(this));
 
     var idbManager = Components.classes["@mozilla.org/dom/indexeddb/manager;1"].getService(Ci.nsIIndexedDatabaseManager);
@@ -52,10 +54,10 @@ let DOMContactManager = {
   observe: function(aSubject, aTopic, aData) {
     myGlobal = null;
     this._messages.forEach((function(msgName) {
-      this._mm.removeMessageListener(msgName, this);
+      ppmm.removeMessageListener(msgName, this);
     }).bind(this));
     Services.obs.removeObserver(this, "profile-before-change");
-    this._mm = null;
+    ppmm = null;
     this._messages = null;
     if (this._db)
       this._db.close();
@@ -72,23 +74,23 @@ let DOMContactManager = {
             for (let i in contacts)
               result.push(contacts[i]);
             debug("result:" + JSON.stringify(result));
-            this._mm.sendAsyncMessage("Contacts:Find:Return:OK", {requestID: msg.requestID, contacts: result});
+            ppmm.sendAsyncMessage("Contacts:Find:Return:OK", {requestID: msg.requestID, contacts: result});
           }.bind(this),
-          function(aErrorMsg) { this._mm.sendAsyncMessage("Contacts:Find:Return:KO", { requestID: msg.requestID, errorMsg: aErrorMsg }) }.bind(this), 
+          function(aErrorMsg) { ppmm.sendAsyncMessage("Contacts:Find:Return:KO", { requestID: msg.requestID, errorMsg: aErrorMsg }) }.bind(this), 
           msg.findOptions);
         break;
       case "Contact:Save":
-        this._db.saveContact(msg.contact, function() {this._mm.sendAsyncMessage("Contact:Save:Return:OK", { requestID: msg.requestID }); }.bind(this), 
-                             function(aErrorMsg) { this._mm.sendAsyncMessage("Contact:Save:Return:KO", { requestID: msg.requestID, errorMsg: aErrorMsg }); }.bind(this));
+        this._db.saveContact(msg.contact, function() { ppmm.sendAsyncMessage("Contact:Save:Return:OK", { requestID: msg.requestID }); }.bind(this), 
+                             function(aErrorMsg) { ppmm.sendAsyncMessage("Contact:Save:Return:KO", { requestID: msg.requestID, errorMsg: aErrorMsg }); }.bind(this));
         break;
       case "Contact:Remove":
         this._db.removeContact(msg.id, 
-                               function() {this._mm.sendAsyncMessage("Contact:Remove:Return:OK", { requestID: msg.requestID }); }.bind(this), 
-                               function(aErrorMsg) {this._mm.sendAsyncMessage("Contact:Remove:Return:KO", { requestID: msg.requestID, errorMsg: aErrorMsg }); }.bind(this));
+                               function() { ppmm.sendAsyncMessage("Contact:Remove:Return:OK", { requestID: msg.requestID }); }.bind(this), 
+                               function(aErrorMsg) { ppmm.sendAsyncMessage("Contact:Remove:Return:KO", { requestID: msg.requestID, errorMsg: aErrorMsg }); }.bind(this));
         break;
       case "Contacts:Clear":
-        this._db.clear(function() { this._mm.sendAsyncMessage("Contacts:Clear:Return:OK", { requestID: msg.requestID }); }.bind(this),
-                       function(aErrorMsg) { this._mm.sendAsyncMessage("Contacts:Clear:Return:KO", { requestID: msg.requestID, errorMsg: aErrorMsg }); }.bind(this));
+        this._db.clear(function() { ppmm.sendAsyncMessage("Contacts:Clear:Return:OK", { requestID: msg.requestID }); }.bind(this),
+                       function(aErrorMsg) { ppmm.sendAsyncMessage("Contacts:Clear:Return:KO", { requestID: msg.requestID, errorMsg: aErrorMsg }); }.bind(this));
     }
   }
 }
diff --git a/dom/interfaces/base/domstubs.idl b/dom/interfaces/base/domstubs.idl
index 0505386a715..26091974430 100644
--- a/dom/interfaces/base/domstubs.idl
+++ b/dom/interfaces/base/domstubs.idl
@@ -131,3 +131,4 @@ interface nsIDOMFontFaceList;
 
 // Power
 interface nsIDOMMozPowerManager;
+interface nsIDOMMozWakeLock;
diff --git a/dom/interfaces/base/nsIDOMNavigator.idl b/dom/interfaces/base/nsIDOMNavigator.idl
index 84c10fd2a11..90bddee82d9 100644
--- a/dom/interfaces/base/nsIDOMNavigator.idl
+++ b/dom/interfaces/base/nsIDOMNavigator.idl
@@ -39,7 +39,7 @@
 
 #include "domstubs.idl"
 
-[scriptable, uuid(b1f4b1fa-49c2-4375-9ce8-bf97ecf6b428)]
+[scriptable, uuid(e610c037-db58-4cd7-8ed3-0d7f1422b4d3)]
 interface nsIDOMNavigator : nsISupports
 {
   readonly attribute DOMString             appCodeName;
@@ -110,4 +110,34 @@ interface nsIDOMNavigator : nsISupports
    */
   [implicit_jscontext]
   void mozVibrate(in jsval aPattern);
+
+  /**
+   * Request a wake lock for a resource.
+   *
+   * A page holds a wake lock to request that a resource not be turned
+   * off (or otherwise made unavailable).
+   *
+   * The topic is the name of a resource that might be made unavailable for
+   * various reasons. For example, on a mobile device the power manager might
+   * decide to turn off the screen after a period of idle time to save power.
+   *
+   * The resource manager checks the lock state of a topic before turning off
+   * the associated resource. For example, a page could hold a lock on the
+   * "screen" topic to prevent the screensaver from appearing or the screen
+   * from turning off.
+   *
+   * The resource manager defines what each topic means and sets policy.  For
+   * example, the resource manager might decide to ignore 'screen' wake locks
+   * held by pages which are not visible.
+   *
+   * One topic can be locked multiple times; it is considered released only when
+   * all locks on the topic have been released.
+   *
+   * The returned nsIDOMMozWakeLock object is a token of the lock.  You can
+   * unlock the lock via the object's |unlock| method.  The lock is released
+   * automatically when its associated window is unloaded.
+   *
+   * @param aTopic resource name
+   */
+  nsIDOMMozWakeLock requestWakeLock(in DOMString aTopic);
 };
diff --git a/dom/interfaces/storage/nsIDOMStorageEvent.idl b/dom/interfaces/storage/nsIDOMStorageEvent.idl
index f98da61b1e8..4fa117c142a 100644
--- a/dom/interfaces/storage/nsIDOMStorageEvent.idl
+++ b/dom/interfaces/storage/nsIDOMStorageEvent.idl
@@ -94,3 +94,13 @@ interface nsIDOMStorageEvent : nsIDOMEvent
                         in DOMString urlArg,
                         in nsIDOMStorage storageAreaArg);
 };
+
+[scriptable, uuid(6335e5b5-13ce-4c8a-b452-5c5895f4e90e)]
+interface nsIStorageEventInit : nsIEventInit
+{
+  attribute DOMString key;
+  attribute DOMString oldValue;
+  attribute DOMString newValue;
+  attribute DOMString url;
+  attribute nsIDOMStorage storageArea;
+};
diff --git a/dom/power/Makefile.in b/dom/power/Makefile.in
index 0cb7635960d..3969391db2f 100644
--- a/dom/power/Makefile.in
+++ b/dom/power/Makefile.in
@@ -52,15 +52,19 @@ EXPORTS_NAMESPACES = mozilla/dom/power
 
 EXPORTS_mozilla/dom/power = \
   PowerManagerService.h \
+  Types.h \
   $(NULL)
 
 CPPSRCS = \
   PowerManager.cpp \
   PowerManagerService.cpp \
+  WakeLock.cpp \
   $(NULL)
 
 XPIDLSRCS = \
   nsIDOMPowerManager.idl \
+  nsIDOMWakeLock.idl \
+  nsIDOMWakeLockListener.idl \
   nsIPowerManagerService.idl \
   $(NULL)
 
diff --git a/dom/power/PowerManager.cpp b/dom/power/PowerManager.cpp
index b0196f2070a..8d6ec778086 100644
--- a/dom/power/PowerManager.cpp
+++ b/dom/power/PowerManager.cpp
@@ -36,9 +36,13 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "PowerManager.h"
+#include "WakeLock.h"
 #include "nsContentUtils.h"
 #include "nsDOMClassInfoID.h"
+#include "nsIDOMWakeLockListener.h"
 #include "nsIPowerManagerService.h"
+#include "nsIPrincipal.h"
+#include "nsPIDOMWindow.h"
 #include "nsServiceManagerUtils.h"
 
 DOMCI_DATA(MozPowerManager, mozilla::dom::power::PowerManager)
@@ -50,20 +54,66 @@ namespace power {
 NS_INTERFACE_MAP_BEGIN(PowerManager)
   NS_INTERFACE_MAP_ENTRY(nsIDOMMozPowerManager)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMMozPowerManager)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMMozWakeLockListener)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(MozPowerManager)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_ADDREF(PowerManager)
 NS_IMPL_RELEASE(PowerManager)
 
-NS_IMETHODIMP
-PowerManager::Reboot()
+nsresult
+PowerManager::Init(nsIDOMWindow *aWindow)
 {
-  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome(), NS_ERROR_DOM_SECURITY_ERR);
+  mWindow = do_GetWeakReference(aWindow);
 
   nsCOMPtr<nsIPowerManagerService> pmService =
     do_GetService(POWERMANAGERSERVICE_CONTRACTID);
-  NS_ENSURE_TRUE(pmService, NS_OK);
+  NS_ENSURE_STATE(pmService);
+
+  // Add ourself to the global notification list.
+  pmService->AddWakeLockListener(this);
+  return NS_OK;
+}
+
+nsresult
+PowerManager::Shutdown()
+{
+  nsCOMPtr<nsIPowerManagerService> pmService =
+    do_GetService(POWERMANAGERSERVICE_CONTRACTID);
+  NS_ENSURE_STATE(pmService);
+
+  // Remove ourself from the global notification list.
+  pmService->RemoveWakeLockListener(this);
+  return NS_OK;
+}
+
+nsresult
+PowerManager::CheckPermission()
+{
+  nsCOMPtr<nsPIDOMWindow> win = do_QueryReferent(mWindow);
+  NS_ENSURE_STATE(win);
+  nsCOMPtr<nsIDocument> doc = do_QueryInterface(win->GetExtantDocument());
+  NS_ENSURE_STATE(doc);
+
+  nsCOMPtr<nsIURI> uri;
+  doc->NodePrincipal()->GetURI(getter_AddRefs(uri));
+
+  if (!nsContentUtils::URIIsChromeOrInPref(uri, "dom.power.whitelist")) {
+    return NS_ERROR_DOM_SECURITY_ERR;
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+PowerManager::Reboot()
+{
+  nsresult rv = CheckPermission();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIPowerManagerService> pmService =
+    do_GetService(POWERMANAGERSERVICE_CONTRACTID);
+  NS_ENSURE_STATE(pmService);
 
   pmService->Reboot();
 
@@ -73,17 +123,74 @@ PowerManager::Reboot()
 NS_IMETHODIMP
 PowerManager::PowerOff()
 {
-  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome(), NS_ERROR_DOM_SECURITY_ERR);
+  nsresult rv = CheckPermission();
+  NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIPowerManagerService> pmService =
     do_GetService(POWERMANAGERSERVICE_CONTRACTID);
-  NS_ENSURE_TRUE(pmService, NS_OK);
+  NS_ENSURE_STATE(pmService);
 
   pmService->PowerOff();
 
   return NS_OK;
 }
 
+NS_IMETHODIMP
+PowerManager::AddWakeLockListener(nsIDOMMozWakeLockListener *aListener)
+{
+  nsresult rv = CheckPermission();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // already added? bail out.
+  if (mListeners.Contains(aListener))
+    return NS_OK;
+
+  mListeners.AppendElement(aListener);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+PowerManager::RemoveWakeLockListener(nsIDOMMozWakeLockListener *aListener)
+{
+  nsresult rv = CheckPermission();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  mListeners.RemoveElement(aListener);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+PowerManager::GetWakeLockState(const nsAString &aTopic, nsAString &aState)
+{
+  nsresult rv = CheckPermission();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIPowerManagerService> pmService =
+    do_GetService(POWERMANAGERSERVICE_CONTRACTID);
+  NS_ENSURE_STATE(pmService);
+
+  return pmService->GetWakeLockState(aTopic, aState);
+}
+
+NS_IMETHODIMP
+PowerManager::Callback(const nsAString &aTopic, const nsAString &aState)
+{
+  /**
+   * We maintain a local listener list instead of using the global
+   * list so that when the window is destroyed we don't have to
+   * cleanup the mess.
+   * Copy the listeners list before we walk through the callbacks
+   * because the callbacks may install new listeners. We expect no
+   * more than one listener per window, so it shouldn't be too long.
+   */
+  nsAutoTArray<nsCOMPtr<nsIDOMMozWakeLockListener>, 2> listeners(mListeners);
+  for (PRUint32 i = 0; i < listeners.Length(); ++i) {
+    listeners[i]->Callback(aTopic, aState);
+  }
+
+  return NS_OK;
+}
+
 } // power
 } // dom
 } // mozilla
diff --git a/dom/power/PowerManager.h b/dom/power/PowerManager.h
index 799ec0f926d..72894141852 100644
--- a/dom/power/PowerManager.h
+++ b/dom/power/PowerManager.h
@@ -37,7 +37,12 @@
 #ifndef mozilla_dom_power_PowerManager_h
 #define mozilla_dom_power_PowerManager_h
 
+#include "nsCOMPtr.h"
+#include "nsTArray.h"
 #include "nsIDOMPowerManager.h"
+#include "nsIDOMWakeLockListener.h"
+#include "nsIDOMWindow.h"
+#include "nsWeakReference.h"
 
 namespace mozilla {
 namespace dom {
@@ -45,13 +50,24 @@ namespace power {
 
 class PowerManager
   : public nsIDOMMozPowerManager
+  , public nsIDOMMozWakeLockListener
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMMOZPOWERMANAGER
+  NS_DECL_NSIDOMMOZWAKELOCKLISTENER
 
   PowerManager() {};
   virtual ~PowerManager() {};
+
+  nsresult Init(nsIDOMWindow *aWindow);
+  nsresult Shutdown();
+
+private:
+  nsresult CheckPermission();
+
+  nsWeakPtr mWindow;
+  nsTArray<nsCOMPtr<nsIDOMMozWakeLockListener> > mListeners;
 };
 
 } // namespace power
diff --git a/dom/power/PowerManagerService.cpp b/dom/power/PowerManagerService.cpp
index 6cd0092eb7b..baf4923a714 100644
--- a/dom/power/PowerManagerService.cpp
+++ b/dom/power/PowerManagerService.cpp
@@ -36,7 +36,12 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "mozilla/Hal.h"
+#include "mozilla/HalWakeLock.h"
+#include "mozilla/ClearOnShutdown.h"
+#include "nsIDOMWakeLockListener.h"
+#include "nsIDOMWindow.h"
 #include "PowerManagerService.h"
+#include "WakeLock.h"
 
 namespace mozilla {
 namespace dom {
@@ -44,14 +49,67 @@ namespace power {
 
 NS_IMPL_ISUPPORTS1(PowerManagerService, nsIPowerManagerService)
 
+/* static */ nsRefPtr<PowerManagerService> PowerManagerService::sSingleton;
+
 /* static */ already_AddRefed<nsIPowerManagerService>
 PowerManagerService::GetInstance()
 {
-  nsCOMPtr<nsIPowerManagerService> pmService;
+  if (!sSingleton) {
+    sSingleton = new PowerManagerService();
+    sSingleton->Init();
+    ClearOnShutdown(&sSingleton);
+  }
 
-  pmService = new PowerManagerService();
+  nsCOMPtr<nsIPowerManagerService> service(do_QueryInterface(sSingleton));
+  return service.forget();
+}
 
-  return pmService.forget();
+void
+PowerManagerService::Init()
+{
+  hal::RegisterWakeLockObserver(this);
+}
+
+PowerManagerService::~PowerManagerService()
+{
+  hal::UnregisterWakeLockObserver(this);
+}
+
+void
+PowerManagerService::ComputeWakeLockState(const hal::WakeLockInformation& aWakeLockInfo,
+                                          nsAString &aState)
+{
+  hal::WakeLockState state = hal::ComputeWakeLockState(aWakeLockInfo.numLocks(),
+                                                       aWakeLockInfo.numHidden());
+  switch (state) {
+  case hal::WAKE_LOCK_STATE_UNLOCKED:
+    aState.AssignLiteral("unlocked");
+    break;
+  case hal::WAKE_LOCK_STATE_HIDDEN:
+    aState.AssignLiteral("locked-background");
+    break;
+  case hal::WAKE_LOCK_STATE_VISIBLE:
+    aState.AssignLiteral("locked-foreground");
+    break;
+  }
+}
+
+void
+PowerManagerService::Notify(const hal::WakeLockInformation& aWakeLockInfo)
+{
+  nsAutoString state;
+  ComputeWakeLockState(aWakeLockInfo, state);
+
+  /**
+   * Copy the listeners list before we walk through the callbacks
+   * because the callbacks may install new listeners. We expect no
+   * more than one listener per window, so it shouldn't be too long.
+   */
+  nsAutoTArray<nsCOMPtr<nsIDOMMozWakeLockListener>, 2> listeners(mWakeLockListeners);
+
+  for (PRUint32 i = 0; i < listeners.Length(); ++i) {
+    listeners[i]->Callback(aWakeLockInfo.topic(), state);
+  }
 }
 
 NS_IMETHODIMP
@@ -68,6 +126,50 @@ PowerManagerService::PowerOff()
   return NS_OK;
 }
 
+NS_IMETHODIMP
+PowerManagerService::AddWakeLockListener(nsIDOMMozWakeLockListener *aListener)
+{
+  if (mWakeLockListeners.Contains(aListener))
+    return NS_OK;
+
+  mWakeLockListeners.AppendElement(aListener);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+PowerManagerService::RemoveWakeLockListener(nsIDOMMozWakeLockListener *aListener)
+{
+  mWakeLockListeners.RemoveElement(aListener);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+PowerManagerService::GetWakeLockState(const nsAString &aTopic, nsAString &aState)
+{
+  hal::WakeLockInformation info;
+  hal::GetWakeLockInfo(aTopic, &info);
+
+  ComputeWakeLockState(info, aState);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+PowerManagerService::NewWakeLock(const nsAString &aTopic,
+                                 nsIDOMWindow *aWindow,
+                                 nsIDOMMozWakeLock **aWakeLock)
+{
+  nsRefPtr<WakeLock> wakelock = new WakeLock();
+  nsresult rv = wakelock->Init(aTopic, aWindow);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIDOMMozWakeLock> wl =
+    do_QueryInterface(NS_ISUPPORTS_CAST(nsIDOMMozWakeLock*, wakelock));
+  wl.forget(aWakeLock);
+
+  return NS_OK;
+}
+
 } // power
 } // dom
 } // mozilla
diff --git a/dom/power/PowerManagerService.h b/dom/power/PowerManagerService.h
index 0a1f1f21350..2c912b18811 100644
--- a/dom/power/PowerManagerService.h
+++ b/dom/power/PowerManagerService.h
@@ -37,8 +37,13 @@
 #ifndef mozilla_dom_power_PowerManagerService_h
 #define mozilla_dom_power_PowerManagerService_h
 
+#include "nsCOMPtr.h"
+#include "nsDataHashtable.h"
+#include "nsHashKeys.h"
+#include "nsTArray.h"
 #include "nsIPowerManagerService.h"
-#include "nsCOMPtr.h" // for already_AddRefed
+#include "mozilla/Observer.h"
+#include "Types.h"
 
 namespace mozilla {
 namespace dom {
@@ -46,12 +51,29 @@ namespace power {
 
 class PowerManagerService
   : public nsIPowerManagerService
+  , public WakeLockObserver
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIPOWERMANAGERSERVICE
 
   static already_AddRefed<nsIPowerManagerService> GetInstance();
+
+  void Init();
+
+  // Implement WakeLockObserver
+  void Notify(const hal::WakeLockInformation& aWakeLockInfo);
+
+private:
+
+  ~PowerManagerService();
+
+  void ComputeWakeLockState(const hal::WakeLockInformation& aWakeLockInfo,
+                            nsAString &aState);
+
+  static nsRefPtr<PowerManagerService> sSingleton;
+
+  nsTArray<nsCOMPtr<nsIDOMMozWakeLockListener> > mWakeLockListeners;
 };
 
 } // namespace power
diff --git a/dom/power/Types.h b/dom/power/Types.h
new file mode 100644
index 00000000000..74a421772c1
--- /dev/null
+++ b/dom/power/Types.h
@@ -0,0 +1,21 @@
+/* -*- Mode: C++; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef mozilla_dom_power_Types_h
+#define mozilla_dom_power_Types_h
+
+namespace mozilla {
+namespace hal {
+class WakeLockInformation;
+} // namespace hal
+
+template <class T>
+class Observer;
+
+typedef Observer<hal::WakeLockInformation> WakeLockObserver;
+
+} // namespace mozilla
+
+#endif // mozilla_dom_power_Types_h
+
diff --git a/dom/power/WakeLock.cpp b/dom/power/WakeLock.cpp
new file mode 100644
index 00000000000..e6f7cb09bbd
--- /dev/null
+++ b/dom/power/WakeLock.cpp
@@ -0,0 +1,204 @@
+/* -*- Mode: C++; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/Hal.h"
+#include "mozilla/HalWakeLock.h"
+#include "nsDOMClassInfoID.h"
+#include "nsDOMError.h"
+#include "nsIDOMWindow.h"
+#include "nsIDOMEvent.h"
+#include "nsIDOMDocument.h"
+#include "nsIDOMEventTarget.h"
+#include "nsPIDOMWindow.h"
+#include "PowerManager.h"
+#include "WakeLock.h"
+
+DOMCI_DATA(MozWakeLock, mozilla::dom::power::WakeLock)
+
+namespace mozilla {
+namespace dom {
+namespace power {
+
+NS_INTERFACE_MAP_BEGIN(WakeLock)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMMozWakeLock)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMMozWakeLock)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMEventListener)
+  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(MozWakeLock)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_ADDREF(WakeLock)
+NS_IMPL_RELEASE(WakeLock)
+
+WakeLock::WakeLock()
+  : mLocked(false)
+  , mHidden(true)
+{
+}
+
+WakeLock::~WakeLock()
+{
+  DoUnlock();
+  DetachEventListener();
+}
+
+nsresult
+WakeLock::Init(const nsAString &aTopic, nsIDOMWindow *aWindow)
+{
+  mTopic.Assign(aTopic);
+
+  mWindow = do_GetWeakReference(aWindow);
+  nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(aWindow);
+
+  /**
+   * Null windows are allowed. A wake lock without associated window
+   * is always considered invisible.
+   */
+  if (window) {
+    nsCOMPtr<nsIDOMDocument> domDoc = window->GetExtantDocument();
+    NS_ENSURE_STATE(domDoc);
+    domDoc->GetMozHidden(&mHidden);
+  }
+
+  AttachEventListener();
+  DoLock();
+
+  return NS_OK;
+}
+
+void
+WakeLock::DoLock()
+{
+  if (!mLocked) {
+    // Change the flag immediately to prevent recursive reentering
+    mLocked = true;
+    hal::ModifyWakeLock(mTopic,
+                        hal::WAKE_LOCK_ADD_ONE,
+                        mHidden ? hal::WAKE_LOCK_ADD_ONE : hal::WAKE_LOCK_NO_CHANGE);
+  }
+}
+
+void
+WakeLock::DoUnlock()
+{
+  if (mLocked) {
+    // Change the flag immediately to prevent recursive reentering
+    mLocked = false;
+    hal::ModifyWakeLock(mTopic,
+                        hal::WAKE_LOCK_REMOVE_ONE,
+                        mHidden ? hal::WAKE_LOCK_REMOVE_ONE : hal::WAKE_LOCK_NO_CHANGE);
+  }
+}
+
+void
+WakeLock::AttachEventListener()
+{
+  nsCOMPtr<nsPIDOMWindow> window = do_QueryReferent(mWindow);
+  
+  if (window) {
+    nsCOMPtr<nsIDOMDocument> domDoc = window->GetExtantDocument();
+    if (domDoc) {
+      nsCOMPtr<nsIDOMEventTarget> target = do_QueryInterface(domDoc);
+      target->AddSystemEventListener(NS_LITERAL_STRING("mozvisibilitychange"),
+                                     this,
+                                     /* useCapture = */ true,
+                                     /* wantsUntrusted = */ false);
+
+      target = do_QueryInterface(window);
+      target->AddSystemEventListener(NS_LITERAL_STRING("pagehide"),
+                                     this,
+                                     /* useCapture = */ true,
+                                     /* wantsUntrusted = */ false);
+      target->AddSystemEventListener(NS_LITERAL_STRING("pageshow"),
+                                     this,
+                                     /* useCapture = */ true,
+                                     /* wantsUntrusted = */ false);
+    }
+  }
+}
+
+void
+WakeLock::DetachEventListener()
+{
+  nsCOMPtr<nsPIDOMWindow> window = do_QueryReferent(mWindow);
+
+  if (window) {
+    nsCOMPtr<nsIDOMDocument> domDoc = window->GetExtantDocument();
+    if (domDoc) {
+      nsCOMPtr<nsIDOMEventTarget> target = do_QueryInterface(domDoc);
+      target->RemoveSystemEventListener(NS_LITERAL_STRING("mozvisibilitychange"),
+                                        this,
+                                        /* useCapture = */ true);
+      target = do_QueryInterface(window);
+      target->RemoveSystemEventListener(NS_LITERAL_STRING("pagehide"),
+                                        this,
+                                        /* useCapture = */ true);
+      target->RemoveSystemEventListener(NS_LITERAL_STRING("pageshow"),
+                                        this,
+                                        /* useCapture = */ true);
+    }
+  }
+}
+
+NS_IMETHODIMP
+WakeLock::Unlock()
+{
+  /*
+   * We throw NS_ERROR_DOM_INVALID_STATE_ERR on double unlock.
+   */
+  if (!mLocked) {
+    return NS_ERROR_DOM_INVALID_STATE_ERR;
+  }
+
+  DoUnlock();
+  DetachEventListener();
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+WakeLock::GetTopic(nsAString &aTopic)
+{
+  aTopic.Assign(mTopic);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+WakeLock::HandleEvent(nsIDOMEvent *aEvent)
+{
+  nsAutoString type;
+  aEvent->GetType(type);
+
+  if (type.EqualsLiteral("mozvisibilitychange")) {
+    nsCOMPtr<nsIDOMEventTarget> target;
+    aEvent->GetTarget(getter_AddRefs(target));
+    nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(target);
+    NS_ENSURE_STATE(domDoc);
+    domDoc->GetMozHidden(&mHidden);
+
+    if (mLocked) {
+      hal::ModifyWakeLock(mTopic,
+                          hal::WAKE_LOCK_NO_CHANGE,
+                          mHidden ? hal::WAKE_LOCK_ADD_ONE : hal::WAKE_LOCK_REMOVE_ONE);
+    }
+
+    return NS_OK;
+  }
+
+  if (type.EqualsLiteral("pagehide")) {
+    DoUnlock();
+    return NS_OK;
+  }
+
+  if (type.EqualsLiteral("pageshow")) {
+    DoLock();
+    return NS_OK;
+  }
+
+  return NS_OK;
+}
+
+} // power
+} // dom
+} // mozilla
diff --git a/dom/power/WakeLock.h b/dom/power/WakeLock.h
new file mode 100644
index 00000000000..e4e82d377a3
--- /dev/null
+++ b/dom/power/WakeLock.h
@@ -0,0 +1,53 @@
+/* -*- Mode: C++; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_power_WakeLock_h
+#define mozilla_dom_power_WakeLock_h
+
+#include "nsCOMPtr.h"
+#include "nsIDOMWakeLock.h"
+#include "nsIDOMEventListener.h"
+#include "nsString.h"
+#include "nsWeakReference.h"
+
+class nsIDOMWindow;
+
+namespace mozilla {
+namespace dom {
+namespace power {
+
+class WakeLock
+  : public nsIDOMMozWakeLock
+  , public nsIDOMEventListener
+{
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMMOZWAKELOCK
+  NS_DECL_NSIDOMEVENTLISTENER
+
+  WakeLock();
+  virtual ~WakeLock();
+
+  nsresult Init(const nsAString &aTopic, nsIDOMWindow *aWindow);
+
+private:
+  void     DoUnlock();
+  void     DoLock();
+  void     AttachEventListener();
+  void     DetachEventListener();
+
+  bool      mLocked;
+  bool      mHidden;
+  nsString  mTopic;
+
+  // window that this was created for.  Weak reference.
+  nsWeakPtr mWindow;
+};
+
+} // namespace power
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_power_WakeLock_h
diff --git a/dom/power/nsIDOMPowerManager.idl b/dom/power/nsIDOMPowerManager.idl
index 7ff1f7c6df5..b8247f12803 100644
--- a/dom/power/nsIDOMPowerManager.idl
+++ b/dom/power/nsIDOMPowerManager.idl
@@ -37,9 +37,40 @@
 
 #include "nsISupports.idl"
 
-[scriptable, uuid(6ec16abc-2fe8-4ab3-99b0-0f08405be81b)]
+interface nsIDOMMozWakeLockListener;
+
+/**
+ * This interface implements navigator.mozPower
+ */
+[scriptable, uuid(abf4b2b1-139d-4eff-998d-8f24616910ae)]
 interface nsIDOMMozPowerManager : nsISupports
 {
-    void powerOff();
-    void reboot();
+    void    powerOff();
+    void    reboot();
+
+    /**
+     * The listeners are notified when a resource changes its lock state to:
+     *  - unlocked
+     *  - locked but not visible
+     *  - locked and visible
+     */
+    void    addWakeLockListener(in nsIDOMMozWakeLockListener aListener);
+    void    removeWakeLockListener(in nsIDOMMozWakeLockListener aListener);
+
+    /**
+     * Query the wake lock state of the topic.
+     *
+     * Possible states are:
+     *
+     *  - "unlocked" - nobody holds the wake lock.
+     *
+     *  - "locked-foreground" - at least one window holds the wake lock,
+     *    and it is visible.
+     *
+     *  - "locked-background" - at least one window holds the wake lock,
+     *    but all of them are hidden.
+     *
+     * @param aTopic The resource name related to the wake lock.
+     */
+    DOMString getWakeLockState(in DOMString aTopic);
 };
diff --git a/dom/power/nsIDOMWakeLock.idl b/dom/power/nsIDOMWakeLock.idl
new file mode 100644
index 00000000000..c83ebd61383
--- /dev/null
+++ b/dom/power/nsIDOMWakeLock.idl
@@ -0,0 +1,19 @@
+/* -*- Mode: C++; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+[scriptable, uuid(2e61eed1-5983-4562-8f26-fd361ab4a00d)]
+interface nsIDOMMozWakeLock : nsISupports
+{
+    readonly attribute DOMString topic;
+
+    /**
+     * Release the wake lock.
+     *
+     * @throw NS_ERROR_DOM_INVALID_STATE_ERR if already unlocked.
+     */
+    void unlock();
+};
diff --git a/dom/power/nsIDOMWakeLockListener.idl b/dom/power/nsIDOMWakeLockListener.idl
new file mode 100644
index 00000000000..b837c3b0577
--- /dev/null
+++ b/dom/power/nsIDOMWakeLockListener.idl
@@ -0,0 +1,29 @@
+/* -*- Mode: C++; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+[scriptable, function, uuid(4e258af8-cffb-47bc-b16d-e8241243426e)]
+interface nsIDOMMozWakeLockListener : nsISupports
+{
+  /**
+   * The callback will be called when a lock topic changes its lock
+   * state.
+   *
+   * Possible states are:
+   *
+   *  - "unlocked" - nobody holds the wake lock.
+   *
+   *  - "locked-foreground" - at least one window holds the wake lock,
+   *    and it is visible.
+   *
+   *  - "locked-background" - at least one window holds the wake lock,
+   *    but all of them are hidden.
+   *
+   * @param aTopic The resource name related to the wake lock.
+   * @param aState The wake lock state
+   */
+  void callback(in DOMString aTopic, in DOMString aState);
+};
diff --git a/dom/power/nsIPowerManagerService.idl b/dom/power/nsIPowerManagerService.idl
index 808a6cf7506..afd28d570dc 100644
--- a/dom/power/nsIPowerManagerService.idl
+++ b/dom/power/nsIPowerManagerService.idl
@@ -42,9 +42,26 @@
 #define POWERMANAGERSERVICE_CONTRACTID "@mozilla.org/power/powermanagerservice;1"
 %}
 
-[scriptable, builtinclass, uuid(38919539-4641-4f0b-9f11-6b6294a9386f)]
+interface nsIDOMMozWakeLock;
+interface nsIDOMMozWakeLockListener;
+interface nsIDOMWindow;
+
+/**
+ * For use with non-content code.
+ */
+[scriptable, builtinclass, uuid(235ca1a1-d0c8-41f3-9b4a-dbaa4437d69c)]
 interface nsIPowerManagerService : nsISupports
 {
-    void powerOff();
-    void reboot();
+  void              powerOff();
+  void              reboot();
+  void              addWakeLockListener(in nsIDOMMozWakeLockListener aListener);
+  void              removeWakeLockListener(in nsIDOMMozWakeLockListener aListener);
+  DOMString         getWakeLockState(in DOMString aTopic);
+
+  /**
+   * Return a wake lock object of aTopic associated with aWindow.
+   * A wake lock without associated window, e.g. used in chrome, is
+   * always considered invisible.
+   */
+  nsIDOMMozWakeLock newWakeLock(in DOMString aTopic, [optional] in nsIDOMWindow aWindow);
 };
diff --git a/dom/power/test/Makefile.in b/dom/power/test/Makefile.in
index 9f9cdfe2338..14e27eb9ce4 100644
--- a/dom/power/test/Makefile.in
+++ b/dom/power/test/Makefile.in
@@ -52,8 +52,15 @@ _TEST_FILES = \
   test_power_basics.html \
   $(NULL)
 
+_BROWSER_TEST_FILES = \
+  browser_bug697132.js \
+  $(NULL)
+
 libs:: $(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
 
+libs:: $(_BROWSER_TEST_FILES)
+	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/browser/$(relativesrcdir)
+
 #libs:: $(_CHROME_TEST_FILES)
 #	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/chrome/$(relativesrcdir)
diff --git a/dom/power/test/browser_bug697132.js b/dom/power/test/browser_bug697132.js
new file mode 100644
index 00000000000..da479d72b19
--- /dev/null
+++ b/dom/power/test/browser_bug697132.js
@@ -0,0 +1,235 @@
+"use strict";
+
+waitForExplicitFinish();
+
+let kPrefNode = "dom.power.whitelist";
+let kPageSource1 = "data:text/html,1";
+let kPageSource2 = "data:text/html,2";
+
+let gOldPref;
+let gWin, gWin1, gWin2;
+let gTab, gTab1, gTab2;
+let gLock, gLock1, gLock2;
+let gCurStepIndex = -1;
+let gSteps = [
+  function basicWakeLock() {
+    gTab = gBrowser.addTab(kPageSource1);
+    gWin = gBrowser.getBrowserForTab(gTab).contentWindow;
+    let browser = gBrowser.getBrowserForTab(gTab);
+
+    browser.addEventListener("load", function onLoad(e) {
+      browser.removeEventListener("load", onLoad, true);
+      let nav = gWin.navigator;
+      let power = nav.mozPower;
+      gLock = nav.requestWakeLock("test");
+
+      ok(gLock != null,
+         "navigator.requestWakeLock should return a wake lock");
+      is(gLock.topic, "test",
+         "wake lock should remember the locked topic");
+      isnot(power.getWakeLockState("test"), "unlocked",
+            "topic is locked");
+
+      gLock.unlock();
+
+      is(gLock.topic, "test",
+         "wake lock should remember the locked topic even after unlock");
+      is(power.getWakeLockState("test"), "unlocked",
+         "topic is unlocked");
+
+      try {
+        gLock.unlock();
+        ok(false, "Should have thrown an error.");
+      } catch (e) {
+        is(e.code, DOMException.INVALID_STATE_ERR, "double unlock should throw InvalidStateError");
+      }
+
+      gBrowser.removeTab(gTab);
+
+      executeSoon(runNextStep);
+    }, true);
+  },
+  function multiWakeLock() {
+    gTab = gBrowser.addTab(kPageSource1);
+    gWin = gBrowser.getBrowserForTab(gTab).contentWindow;
+    let browser = gBrowser.getBrowserForTab(gTab);
+
+    browser.addEventListener("load", function onLoad(e) {
+      browser.removeEventListener("load", onLoad, true);
+      let nav = gWin.navigator;
+      let power = nav.mozPower;
+      let count = 0;
+      power.addWakeLockListener(function onWakeLockEvent(topic, state) {
+        is(topic, "test", "gLock topic is test");
+        ok(state == "unlocked" ||
+           state == "locked-foreground" ||
+           state == "locked-background",
+           "wake lock should be either locked or unlocked");
+        count++;
+        if (state == "locked-foreground" ||
+            state == "locked-background") {
+          is(count, 1,
+             "wake lock should be locked and the listener should only fire once");
+        }
+        if (state == "unlocked") {
+          is(count, 2,
+             "wake lock should be unlocked and the listener should only fire once");
+
+          ok(power.getWakeLockState("test") == "unlocked",
+             "topic is unlocked");
+          power.removeWakeLockListener(onWakeLockEvent);
+          gBrowser.removeTab(gTab);
+          executeSoon(runNextStep);
+        }
+      });
+
+      gLock1 = nav.requestWakeLock("test");
+      isnot(power.getWakeLockState("test"), "unlocked",
+            "topic is locked");
+
+      gLock2 = nav.requestWakeLock("test");
+      isnot(power.getWakeLockState("test"), "unlocked",
+            "topic is locked");
+
+      gLock1.unlock();
+      isnot(power.getWakeLockState("test"), "unlocked",
+            "topic is locked");
+
+      gLock2.unlock();
+    }, true);
+  },
+  function crossTabWakeLock1() {
+    gTab1 = gBrowser.addTab(kPageSource1);
+    gWin1 = gBrowser.getBrowserForTab(gTab1).contentWindow;
+    gTab2 = gBrowser.addTab(kPageSource1);
+    gWin2 = gBrowser.getBrowserForTab(gTab2).contentWindow;
+
+    gBrowser.selectedTab = gTab1;
+    let browser = gBrowser.getBrowserForTab(gTab2);
+
+    browser.addEventListener("load", function onLoad(e) {
+      browser.removeEventListener("load", onLoad, true);
+      gLock2 = gWin2.navigator.requestWakeLock("test");
+      is(gWin2.document.mozHidden, true,
+         "window is background")
+      is(gWin2.navigator.mozPower.getWakeLockState("test"), "locked-background",
+         "wake lock is background");
+      let doc2 = gWin2.document;
+      doc2.addEventListener("mozvisibilitychange", function onVisibilityChange(e) {
+        if (!doc2.mozHidden) {
+          doc2.removeEventListener("mozvisibilitychange", onVisibilityChange);
+          executeSoon(runNextStep);
+        }
+      });
+      gBrowser.selectedTab = gTab2;
+    }, true);
+  },
+  function crossTabWakeLock2() {
+    is(gWin2.document.mozHidden, false,
+       "window is foreground")
+    is(gWin2.navigator.mozPower.getWakeLockState("test"), "locked-foreground",
+      "wake lock is foreground");
+    gWin2.addEventListener("pagehide", function onPageHide(e) {
+      gWin2.removeEventListener("pagehide", onPageHide, true);
+      executeSoon(runNextStep);
+    }, true);
+    gWin2.addEventListener("pageshow", function onPageShow(e) {
+      gWin2.removeEventListener("pageshow", onPageShow, true);
+      executeSoon(runNextStep);
+    }, true);
+    gWin2.location = kPageSource2;
+  },
+  function crossTabWakeLock3() {
+    is(gWin1.navigator.mozPower.getWakeLockState("test"), "unlocked",
+       "wake lock should auto-unlock when page is unloaded");
+    gWin2.back();
+    // runNextStep called in onPageShow
+  },
+  function crossTabWakeLock4() {
+    is(gWin1.navigator.mozPower.getWakeLockState("test"), "locked-foreground",
+       "wake lock should auto-reacquire when page is available again");
+    gBrowser.selectedTab = gTab1;
+    executeSoon(runNextStep);
+  },
+  function crossTabWakeLock5() {
+    // Test again in background tab
+    is(gWin2.document.mozHidden, true,
+       "window is background")
+    is(gWin2.navigator.mozPower.getWakeLockState("test"), "locked-background",
+      "wake lock is background");
+    gWin2.addEventListener("pagehide", function onPageHide(e) {
+      gWin2.removeEventListener("pagehide", onPageHide, true);
+      executeSoon(runNextStep);
+    }, true);
+    gWin2.addEventListener("pageshow", function onPageShow(e) {
+      gWin2.removeEventListener("pageshow", onPageShow, true);
+      executeSoon(runNextStep);
+    }, true);
+    gWin2.location = kPageSource2;
+  },
+  function crossTabWakeLock6() {
+    is(gWin1.navigator.mozPower.getWakeLockState("test"), "unlocked",
+       "wake lock should auto-unlock when page is unloaded");
+    gWin2.back();
+    // runNextStep called in onPageShow
+  },
+  function crossTabWakeLock7() {
+    is(gWin1.navigator.mozPower.getWakeLockState("test"), "locked-background",
+       "wake lock should auto-reacquire when page is available again");
+    gLock2.unlock();
+    gBrowser.selectedTab = gTab2;
+    executeSoon(runNextStep);
+  },
+  function crossTabWakeLock8() {
+    is(gWin1.document.mozHidden, true,
+       "gWin1 is background");
+    is(gWin2.document.mozHidden, false,
+       "gWin2 is foreground");
+
+    gLock1 = gWin1.navigator.requestWakeLock("test");
+    gLock2 = gWin2.navigator.requestWakeLock("test");
+
+    is(gWin1.navigator.mozPower.getWakeLockState("test"), "locked-foreground",
+       "topic is locked-foreground when one page is foreground and one is background");
+
+    gLock2.unlock();
+
+    is(gWin1.navigator.mozPower.getWakeLockState("test"), "locked-background",
+       "topic is locked-background when all locks are background");
+
+    gLock2 = gWin2.navigator.requestWakeLock("test");
+
+    is(gWin1.navigator.mozPower.getWakeLockState("test"), "locked-foreground",
+       "topic is locked-foreground when one page is foreground and one is background");
+
+    gLock1.unlock();
+
+    is(gWin1.navigator.mozPower.getWakeLockState("test"), "locked-foreground",
+       "topic is locked-foreground");
+
+    gBrowser.removeTab(gTab1);
+    gBrowser.removeTab(gTab2);
+    executeSoon(runNextStep);
+  },
+];
+
+function runNextStep() {
+  gCurStepIndex++;
+  if (gCurStepIndex < gSteps.length) {
+    gSteps[gCurStepIndex]();
+  } else {
+    Services.prefs.setCharPref(kPrefNode, gOldPref);
+    finish();
+  }
+}
+
+function test() {
+  try {
+    gOldPref = Services.prefs.getCharPref(kPrefNode);
+  } catch (e) {
+    gOldPref = "";
+  }
+  // data url inherits its parent's principal, which is |about:| here.
+  Services.prefs.setCharPref(kPrefNode, "about:");
+  runNextStep();
+}
diff --git a/dom/sms/src/ril/SmsDatabaseService.js b/dom/sms/src/ril/SmsDatabaseService.js
index 2fa654413bc..e641352565b 100644
--- a/dom/sms/src/ril/SmsDatabaseService.js
+++ b/dom/sms/src/ril/SmsDatabaseService.js
@@ -487,7 +487,7 @@ SmsDatabaseService.prototype = {
       // In first place, we retrieve the keys that match the filter.startDate
       // and filter.endDate search criteria.
       let timeKeyRange = null;
-      if (!filter.startDate != null && filter.endDate != null) {
+      if (filter.startDate != null && filter.endDate != null) {
         timeKeyRange = IDBKeyRange.bound(filter.startDate.getTime(),
                                          filter.endDate.getTime());
       } else if (filter.startDate != null) {
diff --git a/dom/src/storage/nsDOMStorage.cpp b/dom/src/storage/nsDOMStorage.cpp
index 36b50a04340..fdff85f66bb 100644
--- a/dom/src/storage/nsDOMStorage.cpp
+++ b/dom/src/storage/nsDOMStorage.cpp
@@ -74,6 +74,7 @@ using mozilla::dom::StorageChild;
 #include "mozilla/Preferences.h"
 #include "nsThreadUtils.h"
 #include "mozilla/Telemetry.h"
+#include "DictionaryHelpers.h"
 
 // calls FlushAndDeleteTemporaryTables(false)
 #define NS_DOMSTORAGE_FLUSH_TIMER_TOPIC "domstorage-flush-timer"
@@ -2390,6 +2391,19 @@ NS_IMETHODIMP nsDOMStorageEvent::InitStorageEvent(const nsAString & typeArg,
   return NS_OK;
 }
 
+nsresult
+nsDOMStorageEvent::InitFromCtor(const nsAString& aType,
+                                JSContext* aCx, jsval* aVal)
+{
+  mozilla::dom::StorageEventInit d;
+  d.oldValue.SetIsVoid(true);
+  d.newValue.SetIsVoid(true);
+  nsresult rv = d.Init(aCx, aVal);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return InitStorageEvent(aType, d.bubbles, d.cancelable, d.key, d.oldValue,
+                          d.newValue, d.url, d.storageArea);
+}
+
 // Obsolete globalStorage event
 
 DOMCI_DATA(StorageEventObsolete, nsDOMStorageEventObsolete)
diff --git a/dom/src/storage/nsDOMStorage.h b/dom/src/storage/nsDOMStorage.h
index 9b04d85a66f..28462df4d35 100644
--- a/dom/src/storage/nsDOMStorage.h
+++ b/dom/src/storage/nsDOMStorage.h
@@ -600,6 +600,8 @@ public:
   NS_DECL_NSIDOMSTORAGEEVENT
   NS_FORWARD_NSIDOMEVENT(nsDOMEvent::)
 
+  virtual nsresult InitFromCtor(const nsAString& aType,
+                                JSContext* aCx, jsval* aVal);
 protected:
   nsString mKey;
   nsString mOldValue;
diff --git a/dom/system/b2g/ril_consts.js b/dom/system/b2g/ril_consts.js
index c60008cf4dd..d75d27a890b 100644
--- a/dom/system/b2g/ril_consts.js
+++ b/dom/system/b2g/ril_consts.js
@@ -178,6 +178,23 @@ const UNSOLICITED_OEM_HOOK_RAW = 1028;
 const UNSOLICITED_RINGBACK_TONE = 1029;
 const UNSOLICITED_RESEND_INCALL_MUTE = 1030;
 
+const ERROR_SUCCESS = 0;
+const ERROR_RADIO_NOT_AVAILABLE = 1;
+const ERROR_GENERIC_FAILURE = 2;
+const ERROR_PASSWORD_INCORRECT = 3;
+const ERROR_SIM_PIN2 = 4;
+const ERROR_SIM_PUK2 = 5;
+const ERROR_REQUEST_NOT_SUPPORTED = 6;
+const ERROR_CANCELLED = 7;
+const ERROR_OP_NOT_ALLOWED_DURING_VOICE_CALL = 8;
+const ERROR_OP_NOT_ALLOWED_BEFORE_REG_TO_NW = 9;
+const ERROR_SMS_SEND_FAIL_RETRY = 10;
+const ERROR_SIM_ABSENT = 11;
+const ERROR_SUBSCRIPTION_NOT_AVAILABLE = 12;
+const ERROR_MODE_NOT_SUPPORTED = 13;
+const ERROR_FDN_CHECK_FAILURE = 14;
+const ERROR_ILLEGAL_SIM_OR_ME = 15;
+
 const RADIO_STATE_OFF = 0;
 const RADIO_STATE_UNAVAILABLE = 1;
 const RADIO_STATE_SIM_NOT_READY = 2;
@@ -243,6 +260,80 @@ const CALL_PRESENTATION_PAYPHONE = 3;
 
 const SMS_HANDLED = 0;
 
+// ICC commands, see TS 27.007 +CRSM commands
+const ICC_COMMAND_READ_BINARY = 0xb0;
+const ICC_COMMAND_UPDATE_BINARY = 0xd6;
+const ICC_COMMAND_READ_RECORD = 0xb2;
+const ICC_COMMAND_UPDATE_RECORD = 0xdc;
+const ICC_COMMAND_SEEK = 0xa2;
+const ICC_COMMAND_GET_RESPONSE = 0xc0;
+
+// ICC constants, GSM SIM file ids from TS 51.011
+const ICC_EF_ADN = 0x6F3A;
+const ICC_EF_FDN = 0x6F3B;
+const ICC_EF_SDN = 0x6F49;
+const ICC_EF_EXT1 = 0x6F4A;
+const ICC_EF_EXT2 = 0x6F4B;
+const ICC_EF_EXT3 = 0x6F4C;
+const ICC_EF_EXT6 = 0x6fc8;   // Ext record for EF[MBDN]
+const ICC_EF_MWIS = 0x6FCA;
+const ICC_EF_MBDN = 0x6fc7;
+const ICC_EF_PNN = 0x6fc5;
+const ICC_EF_SPN = 0x6F46;
+const ICC_EF_SMS = 0x6F3C;
+const ICC_EF_ICCID = 0x2fe2;
+const ICC_EF_AD = 0x6FAD;
+const ICC_EF_MBI = 0x6fc9;
+const ICC_EF_MSISDN = 0x6f40;
+const ICC_EF_SPDI = 0x6fcd;
+const ICC_EF_SST = 0x6f38;
+const ICC_EF_CFIS = 0x6FCB;
+const ICC_EF_IMG = 0x4f20;
+
+// Types of files  TS 11.11 9.3
+const TYPE_RFU = 0;
+const TYPE_MF  = 1;
+const TYPE_DF  = 2;
+const TYPE_EF  = 4;
+
+const RESPONSE_DATA_FILE_ID_1 = 4;
+const RESPONSE_DATA_FILE_ID_2 = 5;
+const RESPONSE_DATA_FILE_TYPE = 6;
+const RESPONSE_DATA_RFU_3 = 7;
+const RESPONSE_DATA_ACCESS_CONDITION_1 = 8;
+const RESPONSE_DATA_ACCESS_CONDITION_2 = 9;
+const RESPONSE_DATA_ACCESS_CONDITION_3 = 10;
+const RESPONSE_DATA_FILE_STATUS = 11;
+const RESPONSE_DATA_LENGTH = 12;
+const RESPONSE_DATA_STRUCTURE = 13;
+const RESPONSE_DATA_RECORD_LENGTH = 14;
+
+// Types of files  TS 11.11 9.3
+const EF_TYPE_TRANSPARENT = 0;
+const EF_TYPE_LINEAR_FIXED = 1;
+const EF_TYPE_CYCLIC = 3;
+
+// For retriveing MSISDN
+const FOOTER_SIZE_BYTES = 14;
+const MAX_NUMBER_SIZE_BYTES = 11;
+
+// READ_RECORD mode,  TS 102.221
+const READ_RECORD_ABSOLUTE_MODE = 4;
+
+// GET_RESPONSE mandatory response size for EF, see TS 51.011 clause 9, 
+// 'Response data in case of an EF.'
+const GET_RESPONSE_EF_SIZE_BYTES = 15;
+
+// EF path
+const EF_PATH_MF_SIM = "3f00";
+const EF_PATH_DF_TELECOM = "7f10";
+
+// Status code for ICC I/O, 
+// see GSM11.11 and TS 51.011 clause 9.4.
+const STATUS_NORMAL_ENDING = 0x90;
+const STATUS_NORMAL_ENDING_WITH_EXTRA = 0x91;
+const STATUS_WITH_SIM_DATA = 0x9e;
+const STATUS_WITH_RESPONSE_DATA = 0x9f;
 
 /**
  * GSM PDU constants
diff --git a/dom/system/b2g/ril_worker.js b/dom/system/b2g/ril_worker.js
index d3763336bc2..39ebe1703c8 100644
--- a/dom/system/b2g/ril_worker.js
+++ b/dom/system/b2g/ril_worker.js
@@ -463,12 +463,14 @@ let Buf = {
 
       options = this.tokenRequestMap[token];
       request_type = options.rilRequestType;
-      if (error) {
-        //TODO
+
+      options.rilRequestError = error;
+      if (error) {   	  
         if (DEBUG) {
           debug("Received error " + error + " for solicited parcel type " +
                 request_type);
         }
+        RIL.handleRequestError(options);
         return;
       }
       if (DEBUG) {
@@ -509,6 +511,7 @@ let Buf = {
       options = {};
     }
     options.rilRequestType = type;
+    options.rilRequestError = null;
     this.tokenRequestMap[token] = options;
     this.token++;
     return token;
@@ -909,6 +912,41 @@ let RIL = {
     return token;
   },
 
+   /**
+   *  Request an ICC I/O operation.
+   * 
+   *  See TS 27.007 "restricted SIM" operation, "AT Command +CRSM".
+   *  The sequence is in the same order as how libril reads this parcel,
+   *  see the struct RIL_SIM_IO_v5 or RIL_SIM_IO_v6 defined in ril.h
+   *
+   *  @param command 
+   *         The I/O command, one of the ICC_COMMAND_* constants.
+   *  @param fileid
+   *         The file to operate on, one of the ICC_EF_* constants.
+   *  @param pathid
+   *         String type, check pathid from TS 27.007 +CRSM  
+   *  @param p1, p2, p3
+   *         Arbitrary integer parameters for the command.
+   *  @param data
+   *         String parameter for the command.
+   *  @param pin2 [optional]
+   *         String containing the PIN2.
+   */
+  iccIO: function iccIO (options) {
+    let token = Buf.newParcel(REQUEST_SIM_IO, options);
+    Buf.writeUint32(options.command);
+    Buf.writeUint32(options.fileid);
+    Buf.writeString(options.path);
+    Buf.writeUint32(options.p1);
+    Buf.writeUint32(options.p2);
+    Buf.writeUint32(options.p3);
+    Buf.writeString(options.data);
+    if (request.pin2 != null) {
+      Buf.writeString(pin2);
+    }
+    Buf.sendParcel();
+  },
+  
   /**
    * Deactivate a data call.
    *
@@ -939,6 +977,14 @@ let RIL = {
   getFailCauseCode: function getFailCauseCode() {
     Buf.simpleRequest(REQUEST_LAST_CALL_FAIL_CAUSE);
   },
+  
+  /**
+   * Handle the RIL request errors
+   */ 
+  handleRequestError: function handleRequestError(options) {	  
+	options.type = "error";
+	Phone.sendDOMMessage(options);
+  },   
 
   /**
    * Handle incoming requests from the RIL. We find the method that
@@ -1114,7 +1160,9 @@ RIL[REQUEST_SETUP_DATA_CALL] = function REQUEST_SETUP_DATA_CALL() {
   let [cid, ifname, ipaddr, dns, gw] = Buf.readStringList();
   Phone.onSetupDataCall(Buf.lastSolicitedToken, cid, ifname, ipaddr, dns, gw);
 };
-RIL[REQUEST_SIM_IO] = null;
+RIL[REQUEST_SIM_IO] = function REQUEST_SIM_IO(length, options) {
+  Phone.onICCIO(options);
+};
 RIL[REQUEST_SEND_USSD] = null;
 RIL[REQUEST_CANCEL_USSD] = null;
 RIL[REQUEST_GET_CLIR] = null;
@@ -1327,6 +1375,7 @@ let Phone = {
   IMEISV: null,
   IMSI: null,
   SMSC: null,
+  MSISDN: null,
 
   registrationState: {},
   gprsRegistrationState: {},
@@ -1473,6 +1522,7 @@ let Phone = {
       this.requestNetworkInfo();
       RIL.getSignalStrength();
       RIL.getSMSCAddress();
+      this.getMSISDN();
       this.sendDOMMessage({type: "cardstatechange",
                            cardState: GECKO_CARDSTATE_READY});
     }
@@ -1676,6 +1726,52 @@ let Phone = {
     this.IMEISV = imeiSV;
   },
 
+  onICCIO: function onICCIO(options) {
+    switch (options.fileid) {
+      case ICC_EF_MSISDN:
+        this.readMSISDNResponse(options);
+        break;
+    }
+  },
+  
+  readMSISDNResponse: function readMSISDNResponse(options) {
+    let sw1 = Buf.readUint32();
+    let sw2 = Buf.readUint32();
+    // See GSM11.11 section 9.4 for sw1 and sw2
+    if (sw1 != STATUS_NORMAL_ENDING) {
+      // TODO: error 
+      // Wait for fix for Bug 713451 to report error.
+      debug("Error in iccIO");
+    }
+    if (DEBUG) debug("ICC I/O (" + sw1 + "/" + sw2 + ")");
+
+    switch (options.command) {
+      case ICC_COMMAND_GET_RESPONSE:
+        let response = Buf.readString();
+        let recordSize = parseInt(
+            response.substr(RESPONSE_DATA_RECORD_LENGTH * 2, 2), 16) & 0xff;
+        let request = {
+          command: ICC_COMMAND_READ_RECORD,
+          fileid:  ICC_EF_MSISDN,
+          pathid:  EF_PATH_MF_SIM + EF_PATH_DF_TELECOM,
+          p1:      1, // Record number, MSISDN is always in the 1st record
+          p2:      READ_RECORD_ABSOLUTE_MODE,
+          p3:      recordSize,
+          data:    null,
+          pin2:    null,
+        };
+        RIL.iccIO(request);
+        break;
+
+      case ICC_COMMAND_READ_RECORD:
+        // Ignore 2 bytes prefix, which is 4 chars
+        let number = GsmPDUHelper.readStringAsBCD().toString().substr(4); 
+        if (DEBUG) debug("MSISDN: " + number);
+        this.MSISDN = number;
+        break;
+    } 
+  },
+
   onRegistrationState: function onRegistrationState(state) {
     let rs = this.registrationState;
     let stateChanged = false;
@@ -2131,6 +2227,23 @@ let Phone = {
     RIL.getFailCauseCode();
   },
 
+  /**
+   *  Get MSISDN
+   */ 
+  getMSISDN: function getMSISDN() {
+    let request = {
+      command: ICC_COMMAND_GET_RESPONSE,
+      fileid:  ICC_EF_MSISDN,
+      pathid:  EF_PATH_MF_SIM + EF_PATH_DF_TELECOM,
+      p1:      0, // For GET_RESPONSE, p1 = 0
+      p2:      0, // For GET_RESPONSE, p2 = 0
+      p3:      GET_RESPONSE_EF_SIZE_BYTES,
+      data:    null,
+      pin2:    null,
+    };
+    RIL.iccIO(request);
+  },
+
   /**
    * Handle incoming messages from the main UI thread.
    *
@@ -2259,6 +2372,8 @@ let GsmPDUHelper = {
     let number = 0;
     for (let i = 0; i < length; i++) {
       let octet = this.readHexOctet();
+      if (octet == 0xff)
+        continue;
       // If the first nibble is an "F" , only the second nibble is to be taken
       // into account.
       if ((octet & 0xf0) == 0xf0) {
@@ -2272,6 +2387,21 @@ let GsmPDUHelper = {
     return number;
   },
 
+  /**
+   *  Read a string from Buf and convert it to BCD
+   * 
+   *  @return the decimal as a number.
+   */ 
+  readStringAsBCD: function readStringAsBCD() {
+    let length = Buf.readUint32();
+    let bcd = this.readSwappedNibbleBCD(length / 2);
+    let delimiter = Buf.readUint16();
+    if (!(length & 1)) {
+      delimiter |= Buf.readUint16();
+    }
+    return bcd;
+  },
+
   /**
    * Write numerical data as swapped nibble BCD.
    *
@@ -2363,6 +2493,9 @@ let GsmPDUHelper = {
           }
         } else if (septet == PDU_NL_EXTENDED_ESCAPE) {
           escapeFound = true;
+
+          // <escape> is not an effective character
+          --length;
         } else {
           ret += langTable[septet];
         }
@@ -2370,6 +2503,22 @@ let GsmPDUHelper = {
     } while (byteLength);
 
     if (ret.length != length) {
+      /**
+       * If num of effective characters does not equal to the length of read
+       * string, cut the tail off. This happens when the last octet of user
+       * data has following layout:
+       *
+       * |<-              penultimate octet in user data               ->|
+       * |<-               data septet N               ->|<-   dsN-1   ->|
+       * +===7===|===6===|===5===|===4===|===3===|===2===|===1===|===0===|
+       *
+       * |<-                  last octet in user data                  ->|
+       * |<-                       fill bits                   ->|<-dsN->|
+       * +===7===|===6===|===5===|===4===|===3===|===2===|===1===|===0===|
+       *
+       * The fill bits in the last octet may happen to form a full septet and
+       * be appended at the end of result string.
+       */
       ret = ret.slice(0, length);
     }
     return ret;
@@ -2463,10 +2612,12 @@ let GsmPDUHelper = {
    * @param langShiftTable
    *        single shift table string.
    *
+   * @return encoded length in septets.
+   *
    * @note that the algorithm used in this function must match exactly with
    * #writeStringAsSeptets.
    */
-  _calculateLangEncodedLength: function _calculateLangEncodedLength(message, langTable, langShiftTable) {
+  _calculateLangEncodedSeptets: function _calculateLangEncodedSeptets(message, langTable, langShiftTable) {
     let length = 0;
     for (let msgIndex = 0; msgIndex < message.length; msgIndex++) {
       let septet = langTable.indexOf(message.charAt(msgIndex));
@@ -2537,17 +2688,17 @@ let GsmPDUHelper = {
     options.userDataHeaderLength = 0;
 
     let needUCS2 = true;
-    let minUserDataLength = Number.MAX_VALUE;
+    let minUserDataSeptets = Number.MAX_VALUE;
     for (let i = 0; i < this.enabledGsmTableTuples.length; i++) {
       let [langIndex, langShiftIndex] = this.enabledGsmTableTuples[i];
 
       const langTable = PDU_NL_LOCKING_SHIFT_TABLES[langIndex];
       const langShiftTable = PDU_NL_SINGLE_SHIFT_TABLES[langShiftIndex];
 
-      let length = this._calculateLangEncodedLength(options.body,
-                                                    langTable,
-                                                    langShiftTable);
-      if (length < 0) {
+      let bodySeptets = this._calculateLangEncodedSeptets(options.body,
+                                                          langTable,
+                                                          langShiftTable);
+      if (bodySeptets < 0) {
         continue;
       }
 
@@ -2560,23 +2711,19 @@ let GsmPDUHelper = {
       }
 
       // Calculate full user data length, note the extra byte is for header len
-      let userDataLength = length + (headerLen ? headerLen + 1 : 0);
-      if (userDataLength >= minUserDataLength) {
+      let headerSeptets = Math.ceil((headerLen ? headerLen + 1 : 0) * 8 / 7);
+      let userDataSeptets = bodySeptets + headerSeptets;
+      if (userDataSeptets >= minUserDataSeptets) {
         continue;
       }
 
       needUCS2 = false;
-      minUserDataLength = userDataLength;
+      minUserDataSeptets = userDataSeptets;
 
-      options.encodedBodyLength = length;
+      options.encodedBodyLength = bodySeptets;
       options.userDataHeaderLength = headerLen;
       options.langIndex = langIndex;
       options.langShiftIndex = langShiftIndex;
-
-      if (userDataLength <= options.body.length) {
-        // Found minimum user data length already
-        return;
-      }
     }
 
     if (needUCS2) {
@@ -2850,10 +2997,10 @@ let GsmPDUHelper = {
       // - TP-Service-Center-Time-Stamp -
       let year   = this.readSwappedNibbleBCD(1) + PDU_TIMESTAMP_YEAR_OFFSET;
       let month  = this.readSwappedNibbleBCD(1) - 1;
-      let day    = this.readSwappedNibbleBCD(1) - 1;
-      let hour   = this.readSwappedNibbleBCD(1) - 1;
-      let minute = this.readSwappedNibbleBCD(1) - 1;
-      let second = this.readSwappedNibbleBCD(1) - 1;
+      let day    = this.readSwappedNibbleBCD(1);
+      let hour   = this.readSwappedNibbleBCD(1);
+      let minute = this.readSwappedNibbleBCD(1);
+      let second = this.readSwappedNibbleBCD(1);
       msg.timestamp = Date.UTC(year, month, day, hour, minute, second);
 
       // If the most significant bit of the least significant nibble is 1,
diff --git a/dom/system/b2g/tests/test_ril_worker_sms.js b/dom/system/b2g/tests/test_ril_worker_sms.js
new file mode 100644
index 00000000000..d08876cad8a
--- /dev/null
+++ b/dom/system/b2g/tests/test_ril_worker_sms.js
@@ -0,0 +1,453 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+subscriptLoader.loadSubScript("resource://gre/modules/ril_consts.js", this);
+
+const ESCAPE = "\uffff";
+const RESCTL = "\ufffe";
+const LF = "\n";
+const CR = "\r";
+const SP = " ";
+const FF = "\u000c";
+
+function run_test() {
+  run_next_test();
+}
+
+/**
+ * Verify validity of the national language tables
+ */
+add_test(function test_nl_locking_shift_tables_validity() {
+  for (let lst = 0; lst < PDU_NL_LOCKING_SHIFT_TABLES.length; lst++) {
+    do_print("Verifying PDU_NL_LOCKING_SHIFT_TABLES[" + lst + "]");
+
+    let table = PDU_NL_LOCKING_SHIFT_TABLES[lst];
+
+    // Make sure table length is 128, or it will break table lookup algorithm.
+    do_check_eq(table.length, 128);
+
+    // Make sure special values are preserved.
+    do_check_eq(table[PDU_NL_EXTENDED_ESCAPE], ESCAPE);
+    do_check_eq(table[PDU_NL_LINE_FEED], LF);
+    do_check_eq(table[PDU_NL_CARRIAGE_RETURN], CR);
+    do_check_eq(table[PDU_NL_SPACE], SP);
+  }
+
+  run_next_test();
+});
+
+add_test(function test_nl_single_shift_tables_validity() {
+  for (let sst = 0; sst < PDU_NL_SINGLE_SHIFT_TABLES.length; sst++) {
+    do_print("Verifying PDU_NL_SINGLE_SHIFT_TABLES[" + sst + "]");
+
+    let table = PDU_NL_SINGLE_SHIFT_TABLES[sst];
+
+    // Make sure table length is 128, or it will break table lookup algorithm.
+    do_check_eq(table.length, 128);
+
+    // Make sure special values are preserved.
+    do_check_eq(table[PDU_NL_EXTENDED_ESCAPE], ESCAPE);
+    do_check_eq(table[PDU_NL_PAGE_BREAK], FF);
+    do_check_eq(table[PDU_NL_RESERVED_CONTROL], RESCTL);
+  }
+
+  run_next_test();
+});
+
+/**
+ * Verify GsmPDUHelper#_calculateLangEncodedSeptets() and
+ * GsmPDUHelper#writeStringAsSeptets() algorithm match each other.
+ */
+add_test(function test_GsmPDUHelper__calculateLangEncodedSeptets() {
+  let worker = newWorker({
+    postRILMessage: function fakePostRILMessage(data) {
+      // Do nothing
+    },
+    postMessage: function fakePostMessage(message) {
+      // Do nothing
+    }
+  });
+
+  let helper = worker.GsmPDUHelper;
+  helper.resetOctetWritten = function () {
+    helper.octetsWritten = 0;
+  };
+  helper.writeHexOctet = function () {
+    helper.octetsWritten++;
+  };
+
+  function do_check_calc(str, expectedCalcLen, lst, sst) {
+    do_check_eq(expectedCalcLen,
+                helper._calculateLangEncodedSeptets(str,
+                                                    PDU_NL_LOCKING_SHIFT_TABLES[lst],
+                                                    PDU_NL_SINGLE_SHIFT_TABLES[sst]));
+
+    helper.resetOctetWritten();
+    helper.writeStringAsSeptets(str, 0, lst, sst);
+    do_check_eq(Math.ceil(expectedCalcLen * 7 / 8), helper.octetsWritten);
+  }
+
+  // Test calculation encoded message length using both locking/single shift tables.
+  for (let lst = 0; lst < PDU_NL_LOCKING_SHIFT_TABLES.length; lst++) {
+    let langTable = PDU_NL_LOCKING_SHIFT_TABLES[lst];
+
+    let str = langTable.substring(0, PDU_NL_EXTENDED_ESCAPE)
+              + langTable.substring(PDU_NL_EXTENDED_ESCAPE + 1);
+
+    for (let sst = 0; sst < PDU_NL_SINGLE_SHIFT_TABLES.length; sst++) {
+      let langShiftTable = PDU_NL_SINGLE_SHIFT_TABLES[sst];
+
+      // <escape>, <resctrl> should be ignored.
+      do_check_calc(ESCAPE + RESCTL, 0, lst, sst);
+
+      // Characters defined in locking shift table should be encoded directly.
+      do_check_calc(str, str.length, lst, sst);
+
+      let [str1, str2] = ["", ""];
+      for (let i = 0; i < langShiftTable.length; i++) {
+        if ((i == PDU_NL_EXTENDED_ESCAPE) || (i == PDU_NL_RESERVED_CONTROL)) {
+          continue;
+        }
+
+        let c = langShiftTable[i];
+        if (langTable.indexOf(c) >= 0) {
+          str1 += c;
+        } else {
+          str2 += c;
+        }
+      }
+
+      // Characters found in both locking/single shift tables should be
+      // directly encoded.
+      do_check_calc(str1, str1.length, lst, sst);
+
+      // Characters found only in single shift tables should be encoded as
+      // <escape><code>, therefore doubles its original length.
+      do_check_calc(str2, str2.length * 2, lst, sst);
+    }
+  }
+
+  run_next_test();
+});
+
+/**
+ * Verify GsmPDUHelper#calculateUserDataLength handles national language
+ * selection correctly.
+ */
+add_test(function test_GsmPDUHelper_calculateUserDataLength() {
+  let worker = newWorker({
+    postRILMessage: function fakePostRILMessage(data) {
+      // Do nothing
+    },
+    postMessage: function fakePostMessage(message) {
+      // Do nothing
+    }
+  });
+
+  let helper = worker.GsmPDUHelper;
+  let calc = helper.calculateUserDataLength;
+  function test_calc(str, expected, enabledGsmTableTuples) {
+    helper.enabledGsmTableTuples = enabledGsmTableTuples;
+    let options = {body: str};
+    calc.call(helper, options);
+
+    do_check_eq(expected[0], options.dcs);
+    do_check_eq(expected[1], options.encodedBodyLength);
+    do_check_eq(expected[2], options.userDataHeaderLength);
+    do_check_eq(expected[3], options.langIndex);
+    do_check_eq(expected[4], options.langShiftIndex);
+  }
+
+  // Test UCS fallback
+  // - No any default enabled nl tables
+  test_calc("A", [PDU_DCS_MSG_CODING_16BITS_ALPHABET, 2, 0, 0, 0], []);
+  // - Character not defined in enabled nl tables
+  test_calc("A", [PDU_DCS_MSG_CODING_16BITS_ALPHABET, 2, 0, 0, 0], [[2, 2]]);
+
+  // With GSM default nl tables
+  test_calc("A", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 1, 0, 0, 0], [[0, 0]]);
+  // - SP is defined in both locking/single shift tables, should be directly
+  //   encoded.
+  test_calc(SP, [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 1, 0, 0, 0], [[0, 0]]);
+  // - '^' is only defined in single shift table, should be encoded as
+  //   <escape>^.
+  test_calc("^", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 2, 0, 0, 0], [[0, 0]]);
+
+  // Test userDataHeaderLength calculation
+  // - Header contains both IEIs
+  test_calc("A", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 1, 6, 1, 1], [[1, 1]]);
+  // - Header contains only locking shift table IEI
+  test_calc("A", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 1, 3, 1, 0], [[1, 0]]);
+  // - Header contains only single shift table IEI
+  test_calc("^", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 2, 3, 0, 1], [[0, 1]]);
+
+  // Test minimum cost nl tables selection
+  // - 'A' is defined in locking shift table
+  test_calc("A", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 1, 3, 1, 0], [[1, 0], [2, 0]]);
+  test_calc("A", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 1, 3, 1, 0], [[2, 0], [1, 0]]);
+  // - 'A' is defined in single shift table
+  test_calc("A", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 2, 6, 2, 4], [[2, 0], [2, 4]]);
+  test_calc("A", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 2, 6, 2, 4], [[2, 4], [2, 0]]);
+  // - 'A' is defined in locking shift table of one tuple and in single shift
+  //   table of another.
+  test_calc("A", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 1, 3, 1, 0], [[1, 0], [2, 4]]);
+  test_calc("A", [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 1, 3, 1, 0], [[2, 4], [1, 0]]);
+
+  // Test Bug 733981
+  // - Case 1, headerLen is in octets, not septets. "\\" is defined in default
+  //   single shift table and Portuguese locking shift table. The original code
+  //   will add headerLen 7(octets), which should be 8(septets), to calculated
+  //   cost and gets 14, which should be 15 in total for the first run. As for
+  //   the second run, it will be undoubtedly 14 in total. With correct fix,
+  //   the best choice should be the second one.
+  test_calc("\\\\\\\\\\\\\\",
+            [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 14, 0, 0, 0], [[3, 1], [0, 0]]);
+  // - Case 2, possible early return non-best choice. The original code will
+  //   get total cost 6 in the first run and returns immediately. With correct
+  //   fix, the best choice should be the second one.
+  test_calc(ESCAPE + ESCAPE + ESCAPE + ESCAPE + ESCAPE + "\\",
+            [PDU_DCS_MSG_CODING_7BITS_ALPHABET, 2, 0, 0, 0], [[3, 0], [0, 0]]);
+
+  run_next_test();
+});
+
+/**
+ * Verify GsmPDUHelper#writeStringAsSeptets() padding bits handling.
+ */
+add_test(function test_GsmPDUHelper_writeStringAsSeptets() {
+  let worker = newWorker({
+    postRILMessage: function fakePostRILMessage(data) {
+      // Do nothing
+    },
+    postMessage: function fakePostMessage(message) {
+      // Do nothing
+    }
+  });
+
+  let helper = worker.GsmPDUHelper;
+  helper.resetOctetWritten = function () {
+    helper.octetsWritten = 0;
+  };
+  helper.writeHexOctet = function () {
+    helper.octetsWritten++;
+  };
+
+  let base = "AAAAAAAA"; // Base string of 8 characters long
+  for (let len = 0; len < 8; len++) {
+    let str = base.substring(0, len);
+
+    for (let paddingBits = 0; paddingBits < 8; paddingBits++) {
+      do_print("Verifying GsmPDUHelper.writeStringAsSeptets("
+               + str + ", " + paddingBits + ", <default>, <default>)");
+      helper.resetOctetWritten();
+      helper.writeStringAsSeptets(str, paddingBits, PDU_NL_IDENTIFIER_DEFAULT,
+                                  PDU_NL_IDENTIFIER_DEFAULT);
+      do_check_eq(Math.ceil(((len * 7) + paddingBits) / 8),
+                  helper.octetsWritten);
+    }
+  }
+
+  run_next_test();
+});
+
+/**
+ * Verify receiving SMS-DELIVERY messages
+ */
+
+function hexToNibble(nibble) {
+  nibble &= 0x0f;
+  if (nibble < 10) {
+    nibble += 48; // ASCII '0'
+  } else {
+    nibble += 55; // ASCII 'A'
+  }
+  return nibble;
+}
+
+function pduToParcelData(pdu) {
+  let dataLength = 4 + pdu.length * 4 + 4;
+  let data = new Uint8Array(dataLength);
+  let offset = 0;
+
+  // String length
+  data[offset++] = pdu.length & 0xFF;
+  data[offset++] = (pdu.length >> 8) & 0xFF;
+  data[offset++] = (pdu.length >> 16) & 0xFF;
+  data[offset++] = (pdu.length >> 24) & 0xFF;
+
+  // PDU data
+  for (let i = 0; i < pdu.length; i++) {
+    let hi = (pdu[i] >>> 4) & 0x0F;
+    let lo = pdu[i] & 0x0F;
+
+    data[offset++] = hexToNibble(hi);
+    data[offset++] = 0;
+    data[offset++] = hexToNibble(lo);
+    data[offset++] = 0;
+  }
+
+  // String delimitor
+  data[offset++] = 0;
+  data[offset++] = 0;
+  data[offset++] = 0;
+  data[offset++] = 0;
+
+  return data;
+}
+
+function compose7bitPdu(lst, sst, data, septets) {
+  if ((lst == 0) && (sst == 0)) {
+    return [0x00,                              // SMSC
+            PDU_MTI_SMS_DELIVER,               // firstOctet
+            1, 0x00, 0,                        // senderAddress
+            0x00,                              // protocolIdentifier
+            PDU_DCS_MSG_CODING_7BITS_ALPHABET, // dataCodingScheme
+            0, 0, 0, 0, 0, 0, 0,               // y m d h m s tz
+            septets]                           // userDataLength
+           .concat(data);
+  }
+
+  return [0x00,                                            // SMSC
+          PDU_MTI_SMS_DELIVER | PDU_UDHI,                  // firstOctet
+          1, 0x00, 0,                                      // senderAddress
+          0x00,                                            // protocolIdentifier
+          PDU_DCS_MSG_CODING_7BITS_ALPHABET,               // dataCodingScheme
+          0, 0, 0, 0, 0, 0, 0,                             // y m d h m s tz
+          8 + septets,                                     // userDataLength
+          6,                                               // user data header length
+          PDU_IEI_NATIONAL_LANGUAGE_LOCKING_SHIFT, 1, lst, // PDU_IEI_NATIONAL_LANGUAGE_LOCKING_SHIFT
+          PDU_IEI_NATIONAL_LANGUAGE_SINGLE_SHIFT, 1, sst]  // PDU_IEI_NATIONAL_LANGUAGE_SINGLE_SHIFT
+         .concat(data);
+}
+
+function composeUcs2Pdu(rawBytes) {
+  return [0x00,                               // SMSC
+          PDU_MTI_SMS_DELIVER,                // firstOctet
+          1, 0x00, 0,                         // senderAddress
+          0x00,                               // protocolIdentifier
+          PDU_DCS_MSG_CODING_16BITS_ALPHABET, // dataCodingScheme
+          0, 0, 0, 0, 0, 0, 0,                // y m d h m s tz
+          rawBytes.length]                    // userDataLength
+         .concat(rawBytes);
+}
+
+function newSmsParcel(pdu) {
+  return newIncomingParcel(-1,
+                           RESPONSE_TYPE_UNSOLICITED,
+                           UNSOLICITED_RESPONSE_NEW_SMS,
+                           pduToParcelData(pdu));
+}
+
+function removeSpecialChar(str, needle) {
+  for (let i = 0; i < needle.length; i++) {
+    let pos;
+    while ((pos = str.indexOf(needle[i])) >= 0) {
+      str = str.substring(0, pos) + str.substring(pos + 1);
+    }
+  }
+  return str;
+}
+
+function newWriteHexOctetAsUint8Worker() {
+  let worker = newWorker({
+    postRILMessage: function fakePostRILMessage(data) {
+      // Do nothing
+    },
+    postMessage: function fakePostMessage(message) {
+      // Do nothing
+    }
+  });
+
+  worker.GsmPDUHelper.writeHexOctet = function (value) {
+    worker.Buf.writeUint8(value);
+  };
+
+  return worker;
+}
+
+function add_test_receiving_sms(expected, pdu) {
+  add_test(function test_receiving_sms() {
+    let worker = newWorker({
+      postRILMessage: function fakePostRILMessage(data) {
+        // Do nothing
+      },
+      postMessage: function fakePostMessage(message) {
+        do_print("body: " + message.body);
+        do_check_eq(expected, message.body)
+      }
+    });
+
+    do_print("expect: " + expected);
+    do_print("pdu: " + pdu);
+    worker.onRILMessage(newSmsParcel(pdu));
+
+    run_next_test();
+  });
+}
+
+function test_receiving_7bit_alphabets(lst, sst) {
+  let worker = newWriteHexOctetAsUint8Worker();
+  let helper = worker.GsmPDUHelper;
+  let buf = worker.Buf;
+
+  function get7bitRawBytes(expected) {
+    buf.outgoingIndex = 0;
+    helper.writeStringAsSeptets(expected, 0, lst, sst);
+
+    let subArray = buf.outgoingBytes.subarray(0, buf.outgoingIndex);
+    return Array.slice(subArray);
+  }
+
+  let langTable = PDU_NL_LOCKING_SHIFT_TABLES[lst];
+  let langShiftTable = PDU_NL_SINGLE_SHIFT_TABLES[sst];
+
+  let text = removeSpecialChar(langTable + langShiftTable, ESCAPE + RESCTL);
+  for (let i = 0; i < text.length;) {
+    let len = Math.min(70, text.length - i);
+    let expected = text.substring(i, i + len);
+    let septets = helper._calculateLangEncodedSeptets(expected, langTable,
+                                                      langShiftTable);
+    let rawBytes = get7bitRawBytes(expected);
+    let pdu = compose7bitPdu(lst, sst, rawBytes, septets);
+    add_test_receiving_sms(expected, pdu);
+
+    i += len;
+  }
+}
+
+function test_receiving_ucs2_alphabets(text) {
+  let worker = newWriteHexOctetAsUint8Worker();
+  let buf = worker.Buf;
+
+  function getUCS2RawBytes(expected) {
+    buf.outgoingIndex = 0;
+    worker.GsmPDUHelper.writeUCS2String(expected);
+
+    let subArray = buf.outgoingBytes.subarray(0, buf.outgoingIndex);
+    return Array.slice(subArray);
+  }
+
+  for (let i = 0; i < text.length;) {
+    let len = Math.min(70, text.length - i);
+    let expected = text.substring(i, i + len);
+    let rawBytes = getUCS2RawBytes(expected);
+    let pdu = composeUcs2Pdu(rawBytes);
+    add_test_receiving_sms(expected, pdu);
+
+    i += len;
+  }
+}
+
+let ucs2str = "";
+for (let lst = 0; lst < PDU_NL_LOCKING_SHIFT_TABLES.length; lst++) {
+  ucs2str += PDU_NL_LOCKING_SHIFT_TABLES[lst];
+  for (let sst = 0; sst < PDU_NL_SINGLE_SHIFT_TABLES.length; sst++) {
+    test_receiving_7bit_alphabets(lst, sst);
+
+    if (lst == 0) {
+      ucs2str += PDU_NL_SINGLE_SHIFT_TABLES[sst];
+    }
+  }
+}
+test_receiving_ucs2_alphabets(ucs2str);
+
diff --git a/dom/system/b2g/tests/xpcshell.ini b/dom/system/b2g/tests/xpcshell.ini
index ec58d374a5b..fa5b5e068ed 100644
--- a/dom/system/b2g/tests/xpcshell.ini
+++ b/dom/system/b2g/tests/xpcshell.ini
@@ -3,3 +3,4 @@ head = header_helpers.js
 tail =
 
 [test_ril_worker_buf.js]
+[test_ril_worker_sms.js]
diff --git a/dom/tests/mochitest/general/file_frameElementWrapping.html b/dom/tests/mochitest/general/file_frameElementWrapping.html
index 4e91efe4ab6..44237f7e047 100644
--- a/dom/tests/mochitest/general/file_frameElementWrapping.html
+++ b/dom/tests/mochitest/general/file_frameElementWrapping.html
@@ -1,26 +1,32 @@
 <html>
     <script>
-        function check(elt, expectProxy, message) {
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
-            var utils = window.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
-                              .getInterface(Components.interfaces.nsIDOMWindowUtils);
-            var result = ((utils.getClassName(elt) === 'Proxy') === expectProxy)
-                         ? "PASS"
-                         : "FAIL";
+        function check(elt, expectAccess, prop) {
+            var access = false;
+            try {
+                elt[prop];
+                access = true;
+            }
+            catch (e) {}
+            return access === expectAccess;
+        }
 
+        function sendMessage(success, sameOrigin, prop) {
+            var result = success ? 'PASS' : 'FAIL';
+            var message;
+            if (sameOrigin)
+                message = 'Can access |' + prop + '| if same origin';
+            else
+                message = 'Cannot access |' + prop + '| if not same origin';
             parent.postMessage(result + ',' + message, '*');
         }
 
-        try {
-            // true if same origin, throws otherwise
-            var sameOrigin = parent.location.href !== '';
-        } catch (e) {
-            sameOrigin = false;
+        var sameOrigin = location.host !== 'example.org';
+        var pass = check(frameElement, sameOrigin, 'src');
+        if (!pass) {
+            sendMessage(false, sameOrigin, 'src');
+        } else {
+            pass = check(parent.location, sameOrigin, 'href');
+            sendMessage(pass, sameOrigin, 'href');
         }
-
-        check(frameElement, !sameOrigin,
-              sameOrigin
-              ? 'no wrapper needed if same origin'
-              : 'wrapper needed if not same origin');
     </script>
 </html>
diff --git a/dom/tests/mochitest/general/test_frameElementWrapping.html b/dom/tests/mochitest/general/test_frameElementWrapping.html
index 1cc5b18f8c2..33bc7fdde85 100644
--- a/dom/tests/mochitest/general/test_frameElementWrapping.html
+++ b/dom/tests/mochitest/general/test_frameElementWrapping.html
@@ -1,7 +1,7 @@
 <!DOCTYPE HTML>
 <html>
 <head>
-  <title>Test for location object behaviors</title>
+  <title>Test for same-origin and cross-origin wrapping of frameElement</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
@@ -14,6 +14,14 @@
 <pre id="test">
 <script class="testbody" type="text/javascript">
 
+//
+// This test has sort of morphed over time to become less and less useful.
+// In the past, we had special security policy for frameElement, but that's
+// more or less gone away with compartment/proxy wrapping. So we just go
+// through the motions to make sure that, indeed, frameElement is subject
+// to the same-origin policy.
+//
+
 SimpleTest.waitForExplicitFinish();
 
 var count = 0;
diff --git a/dom/workers/Principal.cpp b/dom/workers/Principal.cpp
index 8427db586b6..678092b32f4 100644
--- a/dom/workers/Principal.cpp
+++ b/dom/workers/Principal.cpp
@@ -40,31 +40,19 @@
 
 #include "jsapi.h"
 
+BEGIN_WORKERS_NAMESPACE
+
 namespace {
 
-void
-PrincipalDestroy(JSContext*, JSPrincipals*)
-{
-  // nothing
-}
-
-JSBool
-PrincipalSubsume(JSPrincipals*, JSPrincipals*)
-{
-  return JS_TRUE;
-}
-
-const char gPrincipalCodebase[] = "Web Worker";
-
 JSPrincipals gPrincipal = {
-  const_cast<char*>(gPrincipalCodebase),
-  1, PrincipalDestroy, PrincipalSubsume
+  1
+#ifdef DEBUG
+  , kJSPrincipalsDebugToken
+#endif
 };
 
 } // anonymous namespace
 
-BEGIN_WORKERS_NAMESPACE
-
 JSPrincipals*
 GetWorkerPrincipal()
 {
diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index e64ef2d9592..cc3d5be6cac 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -85,9 +85,14 @@ using namespace mozilla::xpconnect::memory;
 // consistency.
 #define WORKER_STACK_SIZE 256 * sizeof(size_t) * 1024
 
-// The stack limit the JS engine will check. Half the size of the
-// actual C stack, to be safe.
+// The stack limit the JS engine will check. 
+#ifdef MOZ_ASAN
+// For ASan, we need more stack space, so we use all that is available
+#define WORKER_CONTEXT_NATIVE_STACK_LIMIT WORKER_STACK_SIZE
+#else
+// Half the size of the actual C stack, to be safe.
 #define WORKER_CONTEXT_NATIVE_STACK_LIMIT 128 * sizeof(size_t) * 1024
+#endif
 
 // The maximum number of threads to use for workers, overridable via pref.
 #define MAX_WORKERS_PER_DOMAIN 10
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index cf9aba1a4a0..1881f22079a 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -157,6 +157,22 @@ SwapToISupportsArray(SmartPtr<T>& aSrc,
 
 NS_MEMORY_REPORTER_MALLOC_SIZEOF_FUN(JsWorkerMallocSizeOf, "js-worker")
 
+struct WorkerJSRuntimeStats : public JS::RuntimeStats
+{
+  WorkerJSRuntimeStats()
+   : JS::RuntimeStats(JsWorkerMallocSizeOf) { }
+
+  virtual void initExtraCompartmentStats(JSCompartment *c,
+                                         JS::CompartmentStats *cstats) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(!cstats->extra);
+    
+    // ReportJSRuntimeExplicitTreeStats expects that cstats->extra is a char pointer
+    const char *name = js::IsAtomsCompartment(c) ? "Web Worker Atoms" : "Web Worker";
+    cstats->extra = const_cast<char *>(name);
+  }
+};
+  
 class WorkerMemoryReporter : public nsIMemoryMultiReporter
 {
   WorkerPrivate* mWorkerPrivate;
@@ -240,8 +256,7 @@ public:
   {
     AssertIsOnMainThread();
 
-    JS::RuntimeStats rtStats(JsWorkerMallocSizeOf, xpc::GetCompartmentName,
-                             xpc::DestroyCompartmentName);
+    WorkerJSRuntimeStats rtStats;
     nsresult rv = CollectForRuntime(/* isQuick = */false, &rtStats);
     if (NS_FAILED(rv)) {
       return rv;
@@ -249,7 +264,10 @@ public:
 
     // Always report, even if we're disabled, so that we at least get an entry
     // in about::memory.
-    ReportJSRuntimeExplicitTreeStats(rtStats, mPathPrefix, aCallback, aClosure);
+    rv = ReportJSRuntimeExplicitTreeStats(rtStats, mPathPrefix, aCallback, aClosure);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
 
     return NS_OK;
   }
@@ -2925,7 +2943,7 @@ WorkerPrivate::Dispatch(WorkerRunnable* aEvent, EventQueue* aQueue)
     }
 
     if (aQueue == &mControlQueue && mJSContext) {
-      JS_TriggerOperationCallback(mJSContext);
+      JS_TriggerOperationCallback(JS_GetRuntime(mJSContext));
     }
 
     mCondVar.Notify();
diff --git a/dom/workers/Workers.h b/dom/workers/Workers.h
index 52944c1ee94..4451c2c8473 100644
--- a/dom/workers/Workers.h
+++ b/dom/workers/Workers.h
@@ -123,6 +123,9 @@ protected:
 WorkerCrossThreadDispatcher*
 GetWorkerCrossThreadDispatcher(JSContext* aCx, jsval aWorker);
 
+// Random unique constant to facilitate JSPrincipal debugging
+const uint32_t kJSPrincipalsDebugToken = 0x7e2df9d2;
+
 END_WORKERS_NAMESPACE
 
 #endif /* mozilla_dom_workers_workers_h__ */
diff --git a/dom/workers/test/importScripts_worker.js b/dom/workers/test/importScripts_worker.js
index e14e934660f..7176ce8386b 100644
--- a/dom/workers/test/importScripts_worker.js
+++ b/dom/workers/test/importScripts_worker.js
@@ -20,9 +20,9 @@ function tryBadScripts() {
     // Throws an exception
     "importScripts_worker_imported4.js",
     // Shouldn't exist!
-    "http://flippety.com/floppety/foo.js",
+    "http://example.com/non-existing/importScripts_worker_foo.js",
     // Not a valid url
-    "http://flippety::foo_js ftw"
+    "http://notadomain::notafile aword"
   ];
 
   for (var i = 0; i < badScripts.length; i++) {
diff --git a/editor/libeditor/html/nsEditProperty.cpp b/editor/libeditor/html/nsEditProperty.cpp
index eeda5d2c133..de3480c874e 100644
--- a/editor/libeditor/html/nsEditProperty.cpp
+++ b/editor/libeditor/html/nsEditProperty.cpp
@@ -85,5 +85,5 @@ nsEditProperty::RegisterAtoms()
 #undef EDITOR_ATOM
   };
   
-  NS_RegisterStaticAtoms(property_atoms, ArrayLength(property_atoms));
+  NS_RegisterStaticAtoms(property_atoms);
 }
diff --git a/editor/txtsvc/src/nsTextServicesDocument.cpp b/editor/txtsvc/src/nsTextServicesDocument.cpp
index 8c3e934b403..032fcc12d48 100644
--- a/editor/txtsvc/src/nsTextServicesDocument.cpp
+++ b/editor/txtsvc/src/nsTextServicesDocument.cpp
@@ -134,7 +134,7 @@ nsTextServicesDocument::RegisterAtoms()
 #undef TS_ATOM
   };
 
-  NS_RegisterStaticAtoms(ts_atoms, ArrayLength(ts_atoms));
+  NS_RegisterStaticAtoms(ts_atoms);
 }
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsTextServicesDocument)
diff --git a/embedding/android/GeckoAppShell.java b/embedding/android/GeckoAppShell.java
index 499eed4f80b..683f3831cdf 100644
--- a/embedding/android/GeckoAppShell.java
+++ b/embedding/android/GeckoAppShell.java
@@ -1820,6 +1820,9 @@ public class GeckoAppShell
         return false;
     }
 
+    public static void emitGeckoAccessibilityEvent (int eventType, String[] textList, String description, boolean enabled, boolean checked, boolean password) {
+    }
+
     public static double[] getCurrentNetworkInformation() {
         return GeckoNetworkManager.getInstance().getCurrentInformation();
     }
diff --git a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
index 1ac0bc55c43..008e0992687 100644
--- a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
+++ b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
@@ -1540,8 +1540,17 @@ PRUint32 nsWindowWatcher::CalculateChromeFlags(const char *aFeatures,
     nsIWebBrowserChrome::CHROME_DEPENDENT : 0;
   chromeFlags |= WinHasOption(aFeatures, "modal", 0, nsnull) ?
     (nsIWebBrowserChrome::CHROME_MODAL | nsIWebBrowserChrome::CHROME_DEPENDENT) : 0;
-  chromeFlags |= WinHasOption(aFeatures, "dialog", 0, nsnull) ?
-    nsIWebBrowserChrome::CHROME_OPENAS_DIALOG : 0;
+
+  /* On mobile we want to ignore the dialog window feature, since the mobile UI
+     does not provide any affordance for dialog windows. This does not interfere
+     with dialog windows created through openDialog. */
+  bool disableDialogFeature = false;
+  nsCOMPtr<nsIPrefBranch> branch = do_QueryInterface(prefs);
+  branch->GetBoolPref("dom.disable_window_open_dialog_feature", &disableDialogFeature);
+  if (!disableDialogFeature) {
+    chromeFlags |= WinHasOption(aFeatures, "dialog", 0, nsnull) ?
+      nsIWebBrowserChrome::CHROME_OPENAS_DIALOG : 0;
+  }
 
   /* and dialogs need to have the last word. assume dialogs are dialogs,
      and opened as chrome, unless explicitly told otherwise. */
diff --git a/extensions/spellcheck/locales/en-US/hunspell/dictionary-sources/upstream-hunspell.diff b/extensions/spellcheck/locales/en-US/hunspell/dictionary-sources/upstream-hunspell.diff
index 4d7c80803a5..20bd1c2c6ce 100644
--- a/extensions/spellcheck/locales/en-US/hunspell/dictionary-sources/upstream-hunspell.diff
+++ b/extensions/spellcheck/locales/en-US/hunspell/dictionary-sources/upstream-hunspell.diff
@@ -9443,125 +9443,127 @@
 > proprietorship/MS
 39039a44848
 > provender/M
-40036a45846
+39564a45374
+> quinoa
+40036a45847
 > recency
-40141a45952
+40141a45953
 > recuse/DGS
-40208a46020
+40208a46021
 > refactor/SMDG
-40244d46055
+40244d46056
 < reflexion/SM
-40829c46640
+40829c46641
 < reverie/M
 ---
 > reverie/MS
-41415a47227
+41415a47228
 > sabre/MS
-41914c47726
+41914c47727
 < schnaps's
 ---
 > schnaps/M
-41949c47761
+41949c47762
 < schrod's
 ---
 > schrod/SM
-41998a47811
+41998a47812
 > scot-free
-42883,42885c48696
+42883,42885c48697
 < shit's
 < shit/S!
 < shite/S!
 ---
 > shit/MS!
-42887,42888c48698,48699
+42887,42888c48699,48700
 < shithead/S!
 < shitload/!
 ---
 > shithead/MS!
 > shitload/MS!
-42891c48702
+42891c48703
 < shitty/RT!
 ---
 > shitty/TR!
-42976a48788
+42976a48789
 > should've
-43008c48820
+43008c48821
 < showtime
 ---
 > showtime/MS
-43724,43726c49536
+43724,43726c49537
 < smoulder's
 < smouldered
 < smoulders
 ---
 > smoulder/GSMD
-44062c49872
+44062c49873
 < sonofabitch
 ---
 > sonofabitch/!
-44371a50182
+44371a50183
 > spick/S!
-44383c50194
+44383c50195
 < spik/S
 ---
 > spik/S!
-46106a51918
+46106a51919
 > syllabi
-46160c51972
+46160c51973
 < synch/GMD
 ---
 > synch/GMDS
-46167d51978
+46167d51979
 < synchs
-46203,46204c52014,52015
+46203,46204c52015,52016
 < sysadmin/S
 < sysop/S
 ---
 > sysadmin/MS
 > sysop/MS
-46752a52564
+46752a52565
 > terabit/MS
-46753a52566,52567
+46753a52567,52568
 > terahertz/M
 > terapixel/MS
-46817a52632
+46817a52633
 > testcase/MS
-46831a52647
+46831a52648
 > testsuite/MS
-46925a52742
+46925a52743
 > theremin/MS
-47755a53573
+47755a53574
 > transfect/DSMG
-47774a53593,53594
+47774a53594,53595
 > transgenderism
 > transgene/MS
-47951c53771
+47951c53772
 < triage/M
 ---
 > triage/MG
-48869a54690
+48869a54691
 > unlikeable
-49211c55032
+49211c55033
 < vagina/M
 ---
 > vagina/MS
-49368,49369c55189
+49368,49369c55190
 < velour's
 < velours's
 ---
 > velour/MS
-49478a55299
+49478a55300
 > vertices
-50148a55970
+50148a55971
 > weaponize/DSG
-50260,50261d56081
+50260,50261d56082
 < werwolf/M
 < werwolves
-50728c56548
+50728c56549
 < women
 ---
 > women/M
-50794c56614
+50794c56615
 < wop/S!
 ---
 > wop/MS!
diff --git a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
index 9b5665d8fb4..361d285dec0 100644
--- a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
+++ b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
@@ -1,4 +1,4 @@
-57436
+57437
 0/nm
 0th/pt
 1/n1
@@ -45698,6 +45698,7 @@ quince/SM
 quincentenary
 quine/S
 quinine/M
+quinoa
 quinquennial
 quinsy/M
 quint/SM
diff --git a/gfx/gl/GLContext.cpp b/gfx/gl/GLContext.cpp
index 9afcd48a362..acf9cb95740 100644
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -892,7 +892,7 @@ TiledTextureImage::DirectUpdate(gfxASurface* aSurf, const nsIntRegion& aRegion,
 {
     nsIntRegion region;
 
-    if (mTextureState != Valid || !mGL->CanUploadSubTextures()) {
+    if (mTextureState != Valid) {
         nsIntRect bounds = nsIntRect(0, 0, mSize.width, mSize.height);
         region = nsIntRegion(bounds);
     } else {
@@ -904,10 +904,17 @@ TiledTextureImage::DirectUpdate(gfxASurface* aSurf, const nsIntRegion& aRegion,
         int xPos = (i % mColumns) * mTileSize;
         int yPos = (i / mColumns) * mTileSize;
         nsIntRegion tileRegion;
-        tileRegion.And(region, nsIntRect(nsIntPoint(xPos,yPos), mImages[i]->GetSize())); // intersect with tile
+        nsIntRect tileRect = nsIntRect(nsIntPoint(xPos, yPos), mImages[i]->GetSize());
+        tileRegion.And(region, tileRect); // intersect with tile
         if (tileRegion.IsEmpty())
             continue;
-        tileRegion.MoveBy(-xPos, -yPos); // translate into tile local space
+        if (mGL->CanUploadSubTextures()) {
+          tileRegion.MoveBy(-xPos, -yPos); // translate into tile local space
+        } else {
+          // If sub-textures are unsupported, expand to tile boundaries
+          tileRect.x = tileRect.y = 0;
+          tileRegion = nsIntRegion(tileRect);
+        }
         result &= mImages[i]->DirectUpdate(aSurf,
                                            tileRegion,
                                            aFrom + nsIntPoint(xPos, yPos));
diff --git a/gfx/gl/GLContextProviderEGL.cpp b/gfx/gl/GLContextProviderEGL.cpp
index d321f6e5c6f..c269923ea9e 100644
--- a/gfx/gl/GLContextProviderEGL.cpp
+++ b/gfx/gl/GLContextProviderEGL.cpp
@@ -42,6 +42,9 @@
 #include "mozilla/Preferences.h"
 #include "mozilla/Util.h"
 
+#include "nsIScreen.h"
+#include "nsIScreenManager.h"
+
 #if defined(XP_UNIX)
 
 #ifdef MOZ_WIDGET_GTK2
@@ -2190,13 +2193,6 @@ static const EGLint kEGLConfigAttribsRGBA32[] = {
     LOCAL_EGL_NONE
 };
 
-// This struct is used only by CreateConfig below, but ISO C++98 forbids
-// instantiating a template dependent on a locally-defined type.  Boo-urns!
-struct EGLAttribs {
-    gfxASurface::gfxImageFormat mFormat;
-    const EGLint* mAttribs;
-};
-
 // Return true if a suitable EGLConfig was found and pass it out
 // through aConfig.  Return false otherwise.
 //
@@ -2205,47 +2201,41 @@ struct EGLAttribs {
 static bool
 CreateConfig(EGLConfig* aConfig)
 {
-    EGLAttribs attribsToTry[] = {
-#ifdef MOZ_GFX_OPTIMIZE_MOBILE
-        // Prefer r5g6b5 for potential savings in memory bandwidth.
-        // This needs to be reevaluated for newer devices.
-        { gfxASurface::ImageFormatRGB16_565, kEGLConfigAttribsRGB16 },
-#endif
-        { gfxASurface::ImageFormatARGB32, kEGLConfigAttribsRGBA32 },
-    };
+    nsCOMPtr<nsIScreenManager> screenMgr = do_GetService("@mozilla.org/gfx/screenmanager;1");
+    nsCOMPtr<nsIScreen> screen;
+    screenMgr->GetPrimaryScreen(getter_AddRefs(screen));
+    PRInt32 depth = 24;
+    screen->GetColorDepth(&depth);
 
     EGLConfig configs[64];
-    for (unsigned i = 0; i < ArrayLength(attribsToTry); ++i) {
-        const EGLAttribs& attribs = attribsToTry[i];
-        EGLint ncfg = ArrayLength(configs);
+    gfxASurface::gfxImageFormat format;
+    const EGLint* attribs = depth == 16 ? kEGLConfigAttribsRGB16 :
+                                          kEGLConfigAttribsRGBA32;
+    EGLint ncfg = ArrayLength(configs);
 
-        if (!sEGLLibrary.fChooseConfig(EGL_DISPLAY(), attribs.mAttribs,
-                                       configs, ncfg, &ncfg) ||
-            ncfg < 1)
+    if (!sEGLLibrary.fChooseConfig(EGL_DISPLAY(), attribs,
+                                   configs, ncfg, &ncfg) ||
+        ncfg < 1) {
+        return false;
+    }
+
+    for (int j = 0; j < ncfg; ++j) {
+        EGLConfig config = configs[j];
+        EGLint r, g, b, a;
+
+        if (sEGLLibrary.fGetConfigAttrib(EGL_DISPLAY(), config,
+                                         LOCAL_EGL_RED_SIZE, &r) &&
+            sEGLLibrary.fGetConfigAttrib(EGL_DISPLAY(), config,
+                                         LOCAL_EGL_GREEN_SIZE, &g) &&
+            sEGLLibrary.fGetConfigAttrib(EGL_DISPLAY(), config,
+                                         LOCAL_EGL_BLUE_SIZE, &b) &&
+            sEGLLibrary.fGetConfigAttrib(EGL_DISPLAY(), config,
+                                         LOCAL_EGL_ALPHA_SIZE, &a) &&
+            ((depth == 16 && r == 5 && g == 6 && b == 5) ||
+             (depth == 24 && r == 8 && g == 8 && b == 8 && a == 8)))
         {
-            continue;
-        }
-
-        for (int j = 0; j < ncfg; ++j) {
-            EGLConfig config = configs[j];
-            EGLint r, g, b, a;
-
-            if (sEGLLibrary.fGetConfigAttrib(EGL_DISPLAY(), config,
-                                             LOCAL_EGL_RED_SIZE, &r) &&
-                sEGLLibrary.fGetConfigAttrib(EGL_DISPLAY(), config,
-                                             LOCAL_EGL_GREEN_SIZE, &g) &&
-                sEGLLibrary.fGetConfigAttrib(EGL_DISPLAY(), config,
-                                             LOCAL_EGL_BLUE_SIZE, &b) &&
-                sEGLLibrary.fGetConfigAttrib(EGL_DISPLAY(), config,
-                                             LOCAL_EGL_ALPHA_SIZE, &a) &&
-                ((gfxASurface::ImageFormatRGB16_565 == attribs.mFormat &&
-                  r == 5 && g == 6 && b == 5) ||
-                 (gfxASurface::ImageFormatARGB32 == attribs.mFormat &&
-                  r == 8 && g == 8 && b == 8 && a == 8)))
-            {
-                *aConfig = config;
-                return true;
-            }
+            *aConfig = config;
+            return true;
         }
     }
     return false;
diff --git a/gfx/thebes/gfxAtoms.cpp b/gfx/thebes/gfxAtoms.cpp
index 5431de00d89..17395d68470 100644
--- a/gfx/thebes/gfxAtoms.cpp
+++ b/gfx/thebes/gfxAtoms.cpp
@@ -58,5 +58,5 @@ static const nsStaticAtom atoms[] = {
 
 void gfxAtoms::RegisterAtoms()
 {
-    NS_RegisterStaticAtoms(atoms, ArrayLength(atoms));
+    NS_RegisterStaticAtoms(atoms);
 }
diff --git a/gfx/thebes/gfxDWriteFontList.cpp b/gfx/thebes/gfxDWriteFontList.cpp
index 5c3c8dfca37..0cdf0b1bc0a 100644
--- a/gfx/thebes/gfxDWriteFontList.cpp
+++ b/gfx/thebes/gfxDWriteFontList.cpp
@@ -68,6 +68,10 @@ using namespace mozilla;
                                    gfxPlatform::GetLog(eGfxLog_fontinit), \
                                    PR_LOG_DEBUG)
 
+#define LOG_CMAPDATA_ENABLED() PR_LOG_TEST( \
+                                   gfxPlatform::GetLog(eGfxLog_cmapdata), \
+                                   PR_LOG_DEBUG)
+
 // font info loader constants
 
 // avoid doing this during startup even on slow machines but try to start
@@ -371,6 +375,16 @@ gfxDWriteFontEntry::ReadCMAP()
         rv = gfxFontUtils::ReadCMAP(cmap, buffer.Length(),
                                     mCharacterMap, mUVSOffset,
                                     unicodeFont, symbolFont);
+#ifdef PR_LOGGING
+        LOG_FONTLIST(("(fontlist-cmap) name: %s, size: %d\n",
+                      NS_ConvertUTF16toUTF8(mName).get(), mCharacterMap.GetSize()));
+        if (LOG_CMAPDATA_ENABLED()) {
+            char prefix[256];
+            sprintf(prefix, "(cmapdata) name: %.220s",
+                    NS_ConvertUTF16toUTF8(mName).get());
+            mCharacterMap.Dump(prefix, eGfxLog_cmapdata);
+        }
+#endif
         mHasCmapTable = NS_SUCCEEDED(rv);
         return rv;
     }
@@ -411,6 +425,12 @@ gfxDWriteFontEntry::ReadCMAP()
 #ifdef PR_LOGGING
     LOG_FONTLIST(("(fontlist-cmap) name: %s, size: %d\n",
                   NS_ConvertUTF16toUTF8(mName).get(), mCharacterMap.GetSize()));
+    if (LOG_CMAPDATA_ENABLED()) {
+        char prefix[256];
+        sprintf(prefix, "(cmapdata) name: %.220s",
+                NS_ConvertUTF16toUTF8(mName).get());
+        mCharacterMap.Dump(prefix, eGfxLog_cmapdata);
+    }
 #endif
 
     mHasCmapTable = NS_SUCCEEDED(rv);
@@ -1174,3 +1194,182 @@ gfxDWriteFontList::ResolveFontName(const nsAString& aFontName,
 
     return gfxPlatformFontList::ResolveFontName(aFontName, aResolvedFontName);
 }
+
+static nsresult GetFamilyName(IDWriteFont *aFont, nsString& aFamilyName)
+{
+    HRESULT hr;
+    nsRefPtr<IDWriteFontFamily> family;
+
+    // clean out previous value
+    aFamilyName.Truncate();
+
+    hr = aFont->GetFontFamily(getter_AddRefs(family));
+    if (FAILED(hr)) {
+        return hr;
+    }
+
+    nsRefPtr<IDWriteLocalizedStrings> familyNames;
+
+    hr = family->GetFamilyNames(getter_AddRefs(familyNames));
+    if (FAILED(hr)) {
+        return hr;
+    }
+
+    UINT32 index = 0;
+    BOOL exists = false;
+
+    hr = familyNames->FindLocaleName(L"en-us", &index, &exists);
+    if (FAILED(hr)) {
+        return hr;
+    }
+
+    // If the specified locale doesn't exist, select the first on the list.
+    if (!exists) {
+        index = 0;
+    }
+
+    nsAutoTArray<WCHAR, 32> name;
+    UINT32 length;
+
+    hr = familyNames->GetStringLength(index, &length);
+    if (FAILED(hr)) {
+        return hr;
+    }
+
+    if (!name.SetLength(length + 1)) {
+        return NS_ERROR_FAILURE;
+    }
+    hr = familyNames->GetString(index, name.Elements(), length + 1);
+    if (FAILED(hr)) {
+        return hr;
+    }
+
+    aFamilyName.Assign(name.Elements());
+    return NS_OK;
+}
+
+// bug 705594 - the method below doesn't actually do any "drawing", it's only
+// used to invoke the DirectWrite layout engine to determine the fallback font
+// for a given character.
+
+IFACEMETHODIMP FontFallbackRenderer::DrawGlyphRun(
+    __maybenull void* clientDrawingContext,
+    FLOAT baselineOriginX,
+    FLOAT baselineOriginY,
+    DWRITE_MEASURING_MODE measuringMode,
+    __in DWRITE_GLYPH_RUN const* glyphRun,
+    __in DWRITE_GLYPH_RUN_DESCRIPTION const* glyphRunDescription,
+    __maybenull IUnknown* clientDrawingEffect
+    )
+{
+    if (!mSystemFonts) {
+        return E_FAIL;
+    }
+
+    HRESULT hr = S_OK;
+
+    nsRefPtr<IDWriteFont> font;
+    hr = mSystemFonts->GetFontFromFontFace(glyphRun->fontFace,
+                                           getter_AddRefs(font));
+    if (FAILED(hr)) {
+        return hr;
+    }
+
+    // copy the family name
+    hr = GetFamilyName(font, mFamilyName);
+    if (FAILED(hr)) {
+        return hr;
+    }
+
+    // Arial is used as the default fallback font
+    // so if it matches ==> no font found
+    if (mFamilyName.EqualsLiteral("Arial")) {
+        mFamilyName.Truncate();
+        return E_FAIL;
+    }
+    return hr;
+}
+
+gfxFontEntry*
+gfxDWriteFontList::GlobalFontFallback(const PRUint32 aCh,
+                                      PRInt32 aRunScript,
+                                      const gfxFontStyle* aMatchStyle,
+                                      PRUint32& aCmapCount)
+{
+    bool useCmaps = gfxPlatform::GetPlatform()->UseCmapsDuringSystemFallback();
+
+    if (useCmaps) {
+        return gfxPlatformFontList::GlobalFontFallback(aCh,
+                                                       aRunScript,
+                                                       aMatchStyle,
+                                                       aCmapCount);
+    }
+
+    HRESULT hr;
+
+    nsRefPtr<IDWriteFactory> dwFactory =
+        gfxWindowsPlatform::GetPlatform()->GetDWriteFactory();
+    if (!dwFactory) {
+        return nsnull;
+    }
+
+    // initialize fallback renderer
+    if (!mFallbackRenderer) {
+        mFallbackRenderer = new FontFallbackRenderer(dwFactory);
+    }
+
+    // initialize text format
+    if (!mFallbackFormat) {
+        hr = dwFactory->CreateTextFormat(L"Arial", NULL,
+                                         DWRITE_FONT_WEIGHT_REGULAR,
+                                         DWRITE_FONT_STYLE_NORMAL,
+                                         DWRITE_FONT_STRETCH_NORMAL,
+                                         72.0f, L"en-us",
+                                         getter_AddRefs(mFallbackFormat));
+        if (FAILED(hr)) {
+            return nsnull;
+        }
+    }
+
+    // set up string with fallback character
+    wchar_t str[16];
+    PRUint32 strLen;
+
+    if (IS_IN_BMP(aCh)) {
+        str[0] = static_cast<wchar_t> (aCh);
+        str[1] = 0;
+        strLen = 1;
+    } else {
+        str[0] = static_cast<wchar_t> (H_SURROGATE(aCh));
+        str[1] = static_cast<wchar_t> (L_SURROGATE(aCh));
+        str[2] = 0;
+        strLen = 2;
+    }
+
+    // set up layout
+    nsRefPtr<IDWriteTextLayout> fallbackLayout;
+
+    hr = dwFactory->CreateTextLayout(str, strLen, mFallbackFormat,
+                                     200.0f, 200.0f,
+                                     getter_AddRefs(fallbackLayout));
+    if (FAILED(hr)) {
+        return nsnull;
+    }
+
+    // call the draw method to invoke the DirectWrite layout functions
+    // which determine the fallback font
+    hr = fallbackLayout->Draw(NULL, mFallbackRenderer, 50.0f, 50.0f);
+    if (FAILED(hr)) {
+        return nsnull;
+    }
+
+    gfxFontEntry *fontEntry = nsnull;
+    bool needsBold;  // ignored in the system fallback case
+    fontEntry = FindFontForFamily(mFallbackRenderer->FallbackFamilyName(),
+                                  aMatchStyle, needsBold);
+    if (fontEntry && !fontEntry->TestCharacterMap(aCh)) {
+        fontEntry = nsnull;
+        Telemetry::Accumulate(Telemetry::BAD_FALLBACK_FONT, true);
+    }
+    return fontEntry;
+}
diff --git a/gfx/thebes/gfxDWriteFontList.h b/gfx/thebes/gfxDWriteFontList.h
index a40081e0068..c1db3f0456f 100644
--- a/gfx/thebes/gfxDWriteFontList.h
+++ b/gfx/thebes/gfxDWriteFontList.h
@@ -204,6 +204,145 @@ protected:
     bool mForceGDIClassic;
 };
 
+// custom text renderer used to determine the fallback font for a given char
+class FontFallbackRenderer : public IDWriteTextRenderer
+{
+public:
+    FontFallbackRenderer(IDWriteFactory *aFactory)
+        : mRefCount(0)
+    {
+        HRESULT hr = S_OK;
+
+        hr = aFactory->GetSystemFontCollection(getter_AddRefs(mSystemFonts));
+        NS_ASSERTION(SUCCEEDED(hr), "GetSystemFontCollection failed!");
+    }
+
+    ~FontFallbackRenderer()
+    {}
+
+    // IDWriteTextRenderer methods
+    IFACEMETHOD(DrawGlyphRun)(
+        __maybenull void* clientDrawingContext,
+        FLOAT baselineOriginX,
+        FLOAT baselineOriginY,
+        DWRITE_MEASURING_MODE measuringMode,
+        __in DWRITE_GLYPH_RUN const* glyphRun,
+        __in DWRITE_GLYPH_RUN_DESCRIPTION const* glyphRunDescription,
+        __maybenull IUnknown* clientDrawingEffect
+        );
+
+    IFACEMETHOD(DrawUnderline)(
+        __maybenull void* clientDrawingContext,
+        FLOAT baselineOriginX,
+        FLOAT baselineOriginY,
+        __in DWRITE_UNDERLINE const* underline,
+        __maybenull IUnknown* clientDrawingEffect
+        )
+    {
+        return E_NOTIMPL;
+    }
+
+
+    IFACEMETHOD(DrawStrikethrough)(
+        __maybenull void* clientDrawingContext,
+        FLOAT baselineOriginX,
+        FLOAT baselineOriginY,
+        __in DWRITE_STRIKETHROUGH const* strikethrough,
+        __maybenull IUnknown* clientDrawingEffect
+        )
+    {
+        return E_NOTIMPL;
+    }
+
+
+    IFACEMETHOD(DrawInlineObject)(
+        __maybenull void* clientDrawingContext,
+        FLOAT originX,
+        FLOAT originY,
+        IDWriteInlineObject* inlineObject,
+        BOOL isSideways,
+        BOOL isRightToLeft,
+        __maybenull IUnknown* clientDrawingEffect
+        )
+    {
+        return E_NOTIMPL;
+    }
+
+    // IDWritePixelSnapping methods
+
+    IFACEMETHOD(IsPixelSnappingDisabled)(
+        __maybenull void* clientDrawingContext,
+        __out BOOL* isDisabled
+        )
+    {
+        *isDisabled = FALSE;
+        return S_OK;
+    }
+
+    IFACEMETHOD(GetCurrentTransform)(
+        __maybenull void* clientDrawingContext,
+        __out DWRITE_MATRIX* transform
+        )
+    {
+        const DWRITE_MATRIX ident = {1.0, 0.0, 0.0, 1.0, 0.0, 0.0};
+        *transform = ident;
+        return S_OK;
+    }
+
+    IFACEMETHOD(GetPixelsPerDip)(
+        __maybenull void* clientDrawingContext,
+        __out FLOAT* pixelsPerDip
+        )
+    {
+        *pixelsPerDip = 1.0f;
+        return S_OK;
+    }
+
+    // IUnknown methods
+
+    IFACEMETHOD_(unsigned long, AddRef) ()
+    {
+        return InterlockedIncrement(&mRefCount);
+    }
+
+    IFACEMETHOD_(unsigned long,  Release) ()
+    {
+        unsigned long newCount = InterlockedDecrement(&mRefCount);
+        if (newCount == 0)
+        {
+            delete this;
+            return 0;
+        }
+
+        return newCount;
+    }
+
+    IFACEMETHOD(QueryInterface) (IID const& riid, void** ppvObject)
+    {
+        if (__uuidof(IDWriteTextRenderer) == riid) {
+            *ppvObject = this;
+        } else if (__uuidof(IDWritePixelSnapping) == riid) {
+            *ppvObject = this;
+        } else if (__uuidof(IUnknown) == riid) {
+            *ppvObject = this;
+        } else {
+            *ppvObject = NULL;
+            return E_FAIL;
+        }
+
+        this->AddRef();
+        return S_OK;
+    }
+
+    const nsString& FallbackFamilyName() { return mFamilyName; }
+
+protected:
+    unsigned long mRefCount;
+    nsRefPtr<IDWriteFontCollection> mSystemFonts;
+    nsString mFamilyName;
+};
+
+
 
 class gfxDWriteFontList : public gfxPlatformFontList {
 public:
@@ -248,6 +387,14 @@ private:
 
     void GetDirectWriteSubstitutes();
 
+    // search fonts system-wide for a given character, null otherwise
+    virtual gfxFontEntry* GlobalFontFallback(const PRUint32 aCh,
+                                             PRInt32 aRunScript,
+                                             const gfxFontStyle* aMatchStyle,
+                                             PRUint32& aCmapCount);
+
+    virtual bool UsesSystemFallback() { return true; }
+
     /**
      * Fonts listed in the registry as substitutes but for which no actual
      * font family is found.
@@ -270,6 +417,9 @@ private:
     // whether to use GDI font table access routines
     bool mGDIFontTableAccess;
     nsRefPtr<IDWriteGdiInterop> mGDIInterop;
+
+    nsRefPtr<FontFallbackRenderer> mFallbackRenderer;
+    nsRefPtr<IDWriteTextFormat>    mFallbackFormat;
 };
 
 
diff --git a/gfx/thebes/gfxFT2Fonts.cpp b/gfx/thebes/gfxFT2Fonts.cpp
index a243e3aa8e9..da12c91371c 100644
--- a/gfx/thebes/gfxFT2Fonts.cpp
+++ b/gfx/thebes/gfxFT2Fonts.cpp
@@ -397,11 +397,12 @@ gfxFT2FontGroup::WhichPrefFontSupportsChar(PRUint32 aCh)
 }
 
 already_AddRefed<gfxFont>
-gfxFT2FontGroup::WhichSystemFontSupportsChar(PRUint32 aCh)
+gfxFT2FontGroup::WhichSystemFontSupportsChar(PRUint32 aCh, PRInt32 aRunScript)
 {
 #if defined(XP_WIN) || defined(ANDROID)
     FontEntry *fe = static_cast<FontEntry*>
-        (gfxPlatformFontList::PlatformFontList()->FindFontForChar(aCh, GetFontAt(0)));
+        (gfxPlatformFontList::PlatformFontList()->
+            SystemFindFontForChar(aCh, aRunScript, &mStyle));
     if (fe) {
         nsRefPtr<gfxFT2Font> f = gfxFT2Font::GetOrMakeFont(fe, &mStyle);
         nsRefPtr<gfxFont> font = f.get();
diff --git a/gfx/thebes/gfxFT2Fonts.h b/gfx/thebes/gfxFT2Fonts.h
index dc74c6c2dc7..61c8b51093e 100644
--- a/gfx/thebes/gfxFT2Fonts.h
+++ b/gfx/thebes/gfxFT2Fonts.h
@@ -141,7 +141,8 @@ protected: // new functions
     already_AddRefed<gfxFT2Font> WhichFontSupportsChar(const nsTArray<nsRefPtr<gfxFontEntry> >& aFontEntryList,
                                                        PRUint32 aCh);
     already_AddRefed<gfxFont> WhichPrefFontSupportsChar(PRUint32 aCh);
-    already_AddRefed<gfxFont> WhichSystemFontSupportsChar(PRUint32 aCh);
+    already_AddRefed<gfxFont>
+        WhichSystemFontSupportsChar(PRUint32 aCh, PRInt32 aRunScript);
 
     nsTArray<gfxTextRange> mRanges;
     nsString mString;
diff --git a/gfx/thebes/gfxFont.cpp b/gfx/thebes/gfxFont.cpp
index 93a3f21ff68..c8efcd8b607 100644
--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@@ -690,37 +690,60 @@ void gfxFontFamily::LocalizedName(nsAString& aLocalizedName)
     aLocalizedName = mName;
 }
 
-
-void
-gfxFontFamily::FindFontForChar(FontSearch *aMatchData)
+// metric for how close a given font matches a style
+static PRInt32
+CalcStyleMatch(gfxFontEntry *aFontEntry, const gfxFontStyle *aStyle)
 {
-    if (!mHasStyles) {
-        FindStyleVariations();
+    PRInt32 rank = 0;
+    if (aStyle) {
+         // italics
+         bool wantItalic =
+             ((aStyle->style & (FONT_STYLE_ITALIC | FONT_STYLE_OBLIQUE)) != 0);
+         if (aFontEntry->IsItalic() == wantItalic) {
+             rank += 10;
+         }
+
+        // measure of closeness of weight to the desired value
+        rank += 9 - abs(aFontEntry->Weight() / 100 - aStyle->ComputeWeight());
+    } else {
+        // if no font to match, prefer non-bold, non-italic fonts
+        if (!aFontEntry->IsItalic()) {
+            rank += 3;
+        }
+        if (!aFontEntry->IsBold()) {
+            rank += 2;
+        }
     }
 
-    if (!TestCharacterMap(aMatchData->mCh)) {
+    return rank;
+}
+
+#define RANK_MATCHED_CMAP   20
+
+void
+gfxFontFamily::FindFontForChar(GlobalFontMatch *aMatchData)
+{
+    if (mCharacterMapInitialized && !TestCharacterMap(aMatchData->mCh)) {
         // none of the faces in the family support the required char,
         // so bail out immediately
         return;
     }
 
-    // iterate over fonts
-    PRUint32 numFonts = mAvailableFonts.Length();
-    for (PRUint32 i = 0; i < numFonts; i++) {
-        gfxFontEntry *fe = mAvailableFonts[i];
-
-        // skip certain fonts during system fallback
-        if (!fe || fe->SkipDuringSystemFallback())
-            continue;
+    bool needsBold;
+    gfxFontStyle normal;
+    gfxFontEntry *fe = FindFontForStyle(
+                  (aMatchData->mStyle == nsnull) ? *aMatchData->mStyle : normal,
+                  needsBold);
 
+    if (fe && !fe->SkipDuringSystemFallback()) {
         PRInt32 rank = 0;
 
         if (fe->TestCharacterMap(aMatchData->mCh)) {
-            rank += 20;
+            rank += RANK_MATCHED_CMAP;
             aMatchData->mCount++;
 #ifdef PR_LOGGING
             PRLogModuleInfo *log = gfxPlatform::GetLog(eGfxLog_textrun);
-        
+
             if (NS_UNLIKELY(log)) {
                 PRUint32 charRange = gfxFontUtils::CharRangeBit(aMatchData->mCh);
                 PRUint32 unicodeRange = FindCharUnicodeRange(aMatchData->mCh);
@@ -735,40 +758,20 @@ gfxFontFamily::FindFontForChar(FontSearch *aMatchData)
 #endif
         }
 
-        // if we didn't match any characters don't bother wasting more time with this face.
-        if (rank == 0)
-            continue;
-            
-        // omitting from original windows code -- family name, lang group, pitch
-        // not available in current FontEntry implementation
-
-        if (aMatchData->mFontToMatch) { 
-            const gfxFontStyle *style = aMatchData->mFontToMatch->GetStyle();
-
-            // matching italics takes precedence over weight
-            bool wantItalic =
-                ((style->style & (FONT_STYLE_ITALIC | FONT_STYLE_OBLIQUE)) != 0);
-            if (fe->IsItalic() == wantItalic) {
-                rank += 10;
-            }
-
-            // measure of closeness of weight to the desired value
-            rank += 9 - abs(fe->Weight() / 100 - style->ComputeWeight());
-        } else {
-            // if no font to match, prefer non-bold, non-italic fonts
-            if (!fe->IsItalic()) {
-                rank += 3;
-            }
-            if (!fe->IsBold()) {
-                rank += 2;
-            }
+        aMatchData->mCmapsTested++;
+        if (rank == 0) {
+            return;
         }
-        
+
+         // omitting from original windows code -- family name, lang group, pitch
+         // not available in current FontEntry implementation
+        rank += CalcStyleMatch(fe, aMatchData->mStyle);
+
         // xxx - add whether AAT font with morphing info for specific lang groups
-        
+
         if (rank > aMatchData->mMatchRank
             || (rank == aMatchData->mMatchRank &&
-                Compare(fe->Name(), aMatchData->mBestMatch->Name()) > 0)) 
+                Compare(fe->Name(), aMatchData->mBestMatch->Name()) > 0))
         {
             aMatchData->mBestMatch = fe;
             aMatchData->mMatchRank = rank;
@@ -776,6 +779,26 @@ gfxFontFamily::FindFontForChar(FontSearch *aMatchData)
     }
 }
 
+void
+gfxFontFamily::SearchAllFontsForChar(GlobalFontMatch *aMatchData)
+{
+    PRUint32 i, numFonts = mAvailableFonts.Length();
+    for (i = 0; i < numFonts; i++) {
+        gfxFontEntry *fe = mAvailableFonts[i];
+        if (fe && fe->TestCharacterMap(aMatchData->mCh)) {
+            PRInt32 rank = RANK_MATCHED_CMAP;
+            rank += CalcStyleMatch(fe, aMatchData->mStyle);
+            if (rank > aMatchData->mMatchRank
+                || (rank == aMatchData->mMatchRank &&
+                    Compare(fe->Name(), aMatchData->mBestMatch->Name()) > 0))
+            {
+                aMatchData->mBestMatch = fe;
+                aMatchData->mMatchRank = rank;
+            }
+        }
+    }
+}
+
 // returns true if other names were found, false otherwise
 bool
 gfxFontFamily::ReadOtherFamilyNamesForFace(gfxPlatformFontList *aPlatformFontList,
@@ -3153,7 +3176,7 @@ gfxFontGroup::InitTextRun(gfxContext *aContext,
                 nsCAutoString lang;
                 mStyle.language->ToUTF8String(lang);
                 PRUint32 runLen = runLimit - runStart;
-                PR_LOG(log, PR_LOG_DEBUG,\
+                PR_LOG(log, PR_LOG_WARNING,\
                        ("(%s) fontgroup: [%s] lang: %s script: %d len %d "
                         "weight: %d width: %d style: %s "
                         "TEXTRUN [%s] ENDTEXTRUN\n",
@@ -3359,11 +3382,12 @@ gfxFontGroup::FindFontForChar(PRUint32 aCh, PRUint32 aPrevCh,
             *aMatchType = gfxTextRange::kFontGroup;
             return font.forget();
         }
+
         // check other faces of the family
         gfxFontFamily *family = font->GetFontEntry()->Family();
         if (family && family->TestCharacterMap(aCh)) {
-            FontSearch matchData(aCh, font);
-            family->FindFontForChar(&matchData);
+            GlobalFontMatch matchData(aCh, aRunScript, &mStyle);
+            family->SearchAllFontsForChar(&matchData);
             gfxFontEntry *fe = matchData.mBestMatch;
             if (fe) {
                 bool needsBold =
@@ -3395,6 +3419,11 @@ gfxFontGroup::FindFontForChar(PRUint32 aCh, PRUint32 aPrevCh,
         return selectedFont.forget();
     }
 
+    // never fall back for characters from unknown scripts
+    if (aRunScript == HB_SCRIPT_UNKNOWN) {
+        return nsnull;
+    }
+
     // for known "space" characters, don't do a full system-fallback search;
     // we'll synthesize appropriate-width spaces instead of missing-glyph boxes
     if (GetGeneralCategory(aCh) ==
@@ -3407,7 +3436,7 @@ gfxFontGroup::FindFontForChar(PRUint32 aCh, PRUint32 aPrevCh,
     // -- otherwise look for other stuff
     if (!selectedFont) {
         *aMatchType = gfxTextRange::kSystemFallback;
-        selectedFont = WhichSystemFontSupportsChar(aCh);
+        selectedFont = WhichSystemFontSupportsChar(aCh, aRunScript);
         return selectedFont.forget();
     }
 
@@ -3552,10 +3581,6 @@ gfxFontGroup::WhichPrefFontSupportsChar(PRUint32 aCh)
 {
     gfxFont *font;
 
-    // FindCharUnicodeRange only supports BMP character points and there are no non-BMP fonts in prefs
-    if (aCh > 0xFFFF)
-        return nsnull;
-
     // get the pref font list if it hasn't been set up already
     PRUint32 unicodeRange = FindCharUnicodeRange(aCh);
     eFontPrefLang charLang = gfxPlatform::GetPlatform()->GetFontPrefLangFor(unicodeRange);
@@ -3627,12 +3652,14 @@ gfxFontGroup::WhichPrefFontSupportsChar(PRUint32 aCh)
 }
 
 already_AddRefed<gfxFont>
-gfxFontGroup::WhichSystemFontSupportsChar(PRUint32 aCh)
+gfxFontGroup::WhichSystemFontSupportsChar(PRUint32 aCh, PRInt32 aRunScript)
 {
     gfxFontEntry *fe = 
-        gfxPlatformFontList::PlatformFontList()->FindFontForChar(aCh, GetFontAt(0));
+        gfxPlatformFontList::PlatformFontList()->
+            SystemFindFontForChar(aCh, aRunScript, &mStyle);
     if (fe) {
-        nsRefPtr<gfxFont> font = fe->FindOrMakeFont(&mStyle, false); // ignore bolder considerations in system fallback case...
+        // ignore bolder considerations in system fallback case...
+        nsRefPtr<gfxFont> font = fe->FindOrMakeFont(&mStyle, false);
         return font.forget();
     }
 
diff --git a/gfx/thebes/gfxFont.h b/gfx/thebes/gfxFont.h
index d730594233c..558b6afc17a 100644
--- a/gfx/thebes/gfxFont.h
+++ b/gfx/thebes/gfxFont.h
@@ -487,16 +487,24 @@ private:
 };
 
 
-// used when picking fallback font
-struct FontSearch {
-    FontSearch(const PRUint32 aCharacter, gfxFont *aFont) :
-        mCh(aCharacter), mFontToMatch(aFont), mMatchRank(0), mCount(0) {
-    }
-    const PRUint32         mCh;
-    gfxFont*               mFontToMatch;
-    PRInt32                mMatchRank;
-    nsRefPtr<gfxFontEntry> mBestMatch;
-    PRUint32               mCount;
+// used when iterating over all fonts looking for a match for a given character
+struct GlobalFontMatch {
+    GlobalFontMatch(const PRUint32 aCharacter,
+                    PRInt32 aRunScript,
+                    const gfxFontStyle *aStyle) :
+        mCh(aCharacter), mRunScript(aRunScript), mStyle(aStyle),
+        mMatchRank(0), mCount(0), mCmapsTested(0)
+        {
+
+        }
+
+    const PRUint32         mCh;          // codepoint to be matched
+    PRInt32                mRunScript;   // Unicode script for the codepoint
+    const gfxFontStyle*    mStyle;       // style to match
+    PRInt32                mMatchRank;   // metric indicating closest match
+    nsRefPtr<gfxFontEntry> mBestMatch;   // current best match
+    PRUint32               mCount;       // number of fonts matched
+    PRUint32               mCmapsTested; // number of cmaps tested
 };
 
 class gfxFontFamily {
@@ -557,9 +565,12 @@ public:
     gfxFontEntry *FindFontForStyle(const gfxFontStyle& aFontStyle, 
                                    bool& aNeedsSyntheticBold);
 
-    // iterates over faces looking for a match with a given characters
+    // checks for a matching font within the family
     // used as part of the font fallback process
-    void FindFontForChar(FontSearch *aMatchData);
+    void FindFontForChar(GlobalFontMatch *aMatchData);
+
+    // checks all fonts for a matching font within the family
+    void SearchAllFontsForChar(GlobalFontMatch *aMatchData);
 
     // read in other family names, if any, and use functor to add each into cache
     virtual void ReadOtherFamilyNames(gfxPlatformFontList *aPlatformFontList);
@@ -582,7 +593,7 @@ public:
     gfxFontEntry* FindFont(const nsAString& aPostscriptName);
 
     // read in cmaps for all the faces
-    void ReadCMAP() {
+    void ReadAllCMAPs() {
         PRUint32 i, numFonts = mAvailableFonts.Length();
         for (i = 0; i < numFonts; i++) {
             gfxFontEntry *fe = mAvailableFonts[i];
@@ -598,7 +609,7 @@ public:
 
     bool TestCharacterMap(PRUint32 aCh) {
         if (!mCharacterMapInitialized) {
-            ReadCMAP();
+            ReadAllCMAPs();
         }
         return mCharacterMap.test(aCh);
     }
@@ -2975,7 +2986,8 @@ public:
     // search through pref fonts for a character, return nsnull if no matching pref font
     virtual already_AddRefed<gfxFont> WhichPrefFontSupportsChar(PRUint32 aCh);
 
-    virtual already_AddRefed<gfxFont> WhichSystemFontSupportsChar(PRUint32 aCh);
+    virtual already_AddRefed<gfxFont>
+        WhichSystemFontSupportsChar(PRUint32 aCh, PRInt32 aRunScript);
 
     template<typename T>
     void ComputeRanges(nsTArray<gfxTextRange>& mRanges,
diff --git a/gfx/thebes/gfxFontUtils.cpp b/gfx/thebes/gfxFontUtils.cpp
index e23db3e7fac..e7c07ba56b6 100644
--- a/gfx/thebes/gfxFontUtils.cpp
+++ b/gfx/thebes/gfxFontUtils.cpp
@@ -37,6 +37,11 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+#ifdef MOZ_LOGGING
+#define FORCE_PR_LOG /* Allow logging in the release build */
+#endif
+#include "prlog.h"
+
 #include "mozilla/Util.h"
 
 #include "gfxFontUtils.h"
@@ -51,6 +56,7 @@
 #include "nsICharsetConverterManager.h"
 
 #include "plbase64.h"
+#include "prlog.h"
 
 #include "woff.h"
 
@@ -58,6 +64,13 @@
 #include <CoreFoundation/CoreFoundation.h>
 #endif
 
+#ifdef PR_LOGGING
+
+#define LOG(log, args) PR_LOG(gfxPlatform::GetLog(log), \
+                               PR_LOG_DEBUG, args)
+
+#endif // PR_LOGGING
+
 #define NO_RANGE_FOUND 126 // bit 126 in the font unicode ranges is required to be 0
 
 #define UNICODE_BMP_LIMIT 0x10000
@@ -269,6 +282,37 @@ typedef struct {
 
 #pragma pack()
 
+#if PR_LOGGING
+void
+gfxSparseBitSet::Dump(const char* aPrefix, eGfxLog aWhichLog) const
+{
+    NS_ASSERTION(mBlocks.DebugGetHeader(), "mHdr is null, this is bad");
+    PRUint32 b, numBlocks = mBlocks.Length();
+
+    for (b = 0; b < numBlocks; b++) {
+        Block *block = mBlocks[b];
+        if (!block) continue;
+        char outStr[256];
+        int index = 0;
+        index += sprintf(&outStr[index], "%s u+%6.6x [", aPrefix, (b << BLOCK_INDEX_SHIFT));
+        for (int i = 0; i < 32; i += 4) {
+            for (int j = i; j < i + 4; j++) {
+                PRUint8 bits = block->mBits[j];
+                PRUint8 flip1 = ((bits & 0xaa) >> 1) | ((bits & 0x55) << 1);
+                PRUint8 flip2 = ((flip1 & 0xcc) >> 2) | ((flip1 & 0x33) << 2);
+                PRUint8 flipped = ((flip2 & 0xf0) >> 4) | ((flip2 & 0x0f) << 4);
+
+                index += sprintf(&outStr[index], "%2.2x", flipped);
+            }
+            if (i + 4 != 32) index += sprintf(&outStr[index], " ");
+        }
+        index += sprintf(&outStr[index], "]");
+        LOG(aWhichLog, ("%s", outStr));
+    }
+}
+#endif
+
+
 nsresult
 gfxFontUtils::ReadCMAPTableFormat12(const PRUint8 *aBuf, PRUint32 aLength,
                                     gfxSparseBitSet& aCharacterMap) 
diff --git a/gfx/thebes/gfxFontUtils.h b/gfx/thebes/gfxFontUtils.h
index 24292526b03..e7f853f4893 100644
--- a/gfx/thebes/gfxFontUtils.h
+++ b/gfx/thebes/gfxFontUtils.h
@@ -41,6 +41,7 @@
 #define GFX_FONT_UTILS_H
 
 #include "gfxTypes.h"
+#include "gfxPlatform.h"
 
 #include "prtypes.h"
 #include "nsAlgorithm.h"
@@ -97,6 +98,11 @@ public:
         return ((block->mBits[(aIndex>>3) & (BLOCK_SIZE - 1)]) & (1 << (aIndex & 0x7))) != 0;
     }
 
+#if PR_LOGGING
+    // dump out contents of bitmap
+    void Dump(const char* aPrefix, eGfxLog aWhichLog) const;
+#endif
+
     bool TestRange(PRUint32 aStart, PRUint32 aEnd) {
         PRUint32 startBlock, endBlock, blockLen;
         
diff --git a/gfx/thebes/gfxGDIFontList.cpp b/gfx/thebes/gfxGDIFontList.cpp
index 1919f089813..8b6ae5a2861 100644
--- a/gfx/thebes/gfxGDIFontList.cpp
+++ b/gfx/thebes/gfxGDIFontList.cpp
@@ -83,6 +83,10 @@ using namespace mozilla;
                                    gfxPlatform::GetLog(eGfxLog_fontlist), \
                                    PR_LOG_DEBUG)
 
+#define LOG_CMAPDATA_ENABLED() PR_LOG_TEST( \
+                                   gfxPlatform::GetLog(eGfxLog_cmapdata), \
+                                   PR_LOG_DEBUG)
+
 #endif // PR_LOGGING
 
 // font info loader constants
@@ -227,6 +231,12 @@ GDIFontEntry::ReadCMAP()
 #ifdef PR_LOGGING
     LOG_FONTLIST(("(fontlist-cmap) name: %s, size: %d\n",
                   NS_ConvertUTF16toUTF8(mName).get(), mCharacterMap.GetSize()));
+    if (LOG_CMAPDATA_ENABLED()) {
+        char prefix[256];
+        sprintf(prefix, "(cmapdata) name: %.220s",
+                NS_ConvertUTF16toUTF8(mName).get());
+        mCharacterMap.Dump(prefix, eGfxLog_cmapdata);
+    }
 #endif
     return rv;
 }
diff --git a/gfx/thebes/gfxMacPlatformFontList.h b/gfx/thebes/gfxMacPlatformFontList.h
index 4b66f3109df..30d527b240e 100644
--- a/gfx/thebes/gfxMacPlatformFontList.h
+++ b/gfx/thebes/gfxMacPlatformFontList.h
@@ -166,6 +166,7 @@ private:
     friend class gfxPlatformMac;
 
     gfxMacPlatformFontList();
+    virtual ~gfxMacPlatformFontList();
 
     // initialize font lists
     virtual nsresult InitFontList();
@@ -181,12 +182,23 @@ private:
 
     static void ATSNotification(ATSFontNotificationInfoRef aInfo, void* aUserArg);
 
+    // search fonts system-wide for a given character, null otherwise
+    virtual gfxFontEntry* GlobalFontFallback(const PRUint32 aCh,
+                                             PRInt32 aRunScript,
+                                             const gfxFontStyle* aMatchStyle,
+                                             PRUint32& aCmapCount);
+
+    virtual bool UsesSystemFallback() { return true; }
+
     // keep track of ATS generation to prevent unneeded updates when loading downloaded fonts
     PRUint32 mATSGeneration;
 
     enum {
         kATSGenerationInitial = -1
     };
+
+    // default font for use with system-wide font fallback
+    CTFontRef mDefaultFont;
 };
 
 #endif /* gfxMacPlatformFontList_H_ */
diff --git a/gfx/thebes/gfxMacPlatformFontList.mm b/gfx/thebes/gfxMacPlatformFontList.mm
index 598079212e3..e84884d881a 100644
--- a/gfx/thebes/gfxMacPlatformFontList.mm
+++ b/gfx/thebes/gfxMacPlatformFontList.mm
@@ -58,6 +58,7 @@
 #include "nsDirectoryServiceUtils.h"
 #include "nsDirectoryServiceDefs.h"
 #include "nsISimpleEnumerator.h"
+#include "nsCharTraits.h"
 
 #include "mozilla/Telemetry.h"
 
@@ -136,6 +137,9 @@ static NSString* GetNSStringForString(const nsAString& aSrc)
 #define LOG_FONTLIST_ENABLED() PR_LOG_TEST( \
                                    gfxPlatform::GetLog(eGfxLog_fontlist), \
                                    PR_LOG_DEBUG)
+#define LOG_CMAPDATA_ENABLED() PR_LOG_TEST( \
+                                   gfxPlatform::GetLog(eGfxLog_cmapdata), \
+                                   PR_LOG_DEBUG)
 
 #endif // PR_LOGGING
 
@@ -267,6 +271,12 @@ MacOSFontEntry::ReadCMAP()
     LOG_FONTLIST(("(fontlist-cmap) name: %s, size: %d\n",
                   NS_ConvertUTF16toUTF8(mName).get(),
                   mCharacterMap.GetSize()));
+    if (LOG_CMAPDATA_ENABLED()) {
+        char prefix[256];
+        sprintf(prefix, "(cmapdata) name: %.220s",
+                NS_ConvertUTF16toUTF8(mName).get());
+        mCharacterMap.Dump(prefix, eGfxLog_cmapdata);
+    }
 #endif
 
     return rv;
@@ -695,7 +705,8 @@ gfxSingleFaceMacFontFamily::ReadOtherFamilyNames(gfxPlatformFontList *aPlatformF
 #pragma mark-
 
 gfxMacPlatformFontList::gfxMacPlatformFontList() :
-    gfxPlatformFontList(false), mATSGeneration(PRUint32(kATSGenerationInitial))
+    gfxPlatformFontList(false), mATSGeneration(PRUint32(kATSGenerationInitial)),
+    mDefaultFont(nsnull)
 {
     ::ATSFontNotificationSubscribe(ATSNotification,
                                    kATSFontNotifyOptionDefault,
@@ -710,6 +721,13 @@ gfxMacPlatformFontList::gfxMacPlatformFontList() :
     sFontManager = [NSFontManager sharedFontManager];
 }
 
+gfxMacPlatformFontList::~gfxMacPlatformFontList()
+{
+    if (mDefaultFont) {
+        ::CFRelease(mDefaultFont);
+    }
+}
+
 nsresult
 gfxMacPlatformFontList::InitFontList()
 {
@@ -866,6 +884,93 @@ gfxMacPlatformFontList::ATSNotification(ATSFontNotificationInfoRef aInfo,
     qfc->UpdateFontList();
 }
 
+gfxFontEntry*
+gfxMacPlatformFontList::GlobalFontFallback(const PRUint32 aCh,
+                                           PRInt32 aRunScript,
+                                           const gfxFontStyle* aMatchStyle,
+                                           PRUint32& aCmapCount)
+{
+    bool useCmaps = gfxPlatform::GetPlatform()->UseCmapsDuringSystemFallback();
+
+    if (useCmaps) {
+        return gfxPlatformFontList::GlobalFontFallback(aCh,
+                                                       aRunScript,
+                                                       aMatchStyle,
+                                                       aCmapCount);
+    }
+
+    CFStringRef str;
+    UniChar ch[2];
+    CFIndex len = 1;
+
+    if (IS_IN_BMP(aCh)) {
+        ch[0] = aCh;
+        str = ::CFStringCreateWithCharactersNoCopy(kCFAllocatorDefault, ch, 1,
+                                                   kCFAllocatorNull);
+    } else {
+        ch[0] = H_SURROGATE(aCh);
+        ch[1] = L_SURROGATE(aCh);
+        str = ::CFStringCreateWithCharactersNoCopy(kCFAllocatorDefault, ch, 2,
+                                                   kCFAllocatorNull);
+        if (!str) {
+            return nsnull;
+        }
+        len = 2;
+    }
+
+    // use CoreText to find the fallback family
+
+    gfxFontEntry *fontEntry = nsnull;
+    CTFontRef fallback;
+    bool cantUseFallbackFont = false;
+
+    if (!mDefaultFont) {
+        mDefaultFont = ::CTFontCreateWithName(CFSTR("Lucida Grande"), 12.f,
+                                              NULL);
+    }
+
+    fallback = ::CTFontCreateForString(mDefaultFont, str,
+                                       ::CFRangeMake(0, len));
+
+    if (fallback) {
+        CFStringRef familyName = ::CTFontCopyFamilyName(fallback);
+        ::CFRelease(fallback);
+
+        if (familyName &&
+            ::CFStringCompare(familyName, CFSTR("LastResort"),
+                              kCFCompareCaseInsensitive) != kCFCompareEqualTo)
+        {
+            nsAutoTArray<UniChar, 1024> buffer;
+            CFIndex len = ::CFStringGetLength(familyName);
+            buffer.SetLength(len+1);
+            ::CFStringGetCharacters(familyName, ::CFRangeMake(0, len),
+                                    buffer.Elements());
+            buffer[len] = 0;
+            nsDependentString family(buffer.Elements(), len);
+
+            bool needsBold;  // ignored in the system fallback case
+
+            fontEntry = FindFontForFamily(family, aMatchStyle, needsBold);
+            if (fontEntry && !fontEntry->TestCharacterMap(aCh)) {
+                fontEntry = nsnull;
+                cantUseFallbackFont = true;
+            }
+        }
+
+        if (familyName) {
+            ::CFRelease(familyName);
+        }
+    }
+
+    if (cantUseFallbackFont) {
+        Telemetry::Accumulate(Telemetry::BAD_FALLBACK_FONT, cantUseFallbackFont);
+    }
+
+    ::CFRelease(str);
+
+    return fontEntry;
+}
+
 gfxFontEntry*
 gfxMacPlatformFontList::GetDefaultFont(const gfxFontStyle* aStyle, bool& aNeedsBold)
 {
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index 4a0a3160650..fb06fba127d 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -118,6 +118,7 @@ static PRLogModuleInfo *sFontlistLog = nsnull;
 static PRLogModuleInfo *sFontInitLog = nsnull;
 static PRLogModuleInfo *sTextrunLog = nsnull;
 static PRLogModuleInfo *sTextrunuiLog = nsnull;
+static PRLogModuleInfo *sCmapDataLog = nsnull;
 #endif
 
 /* Class to listen for pref changes so that chrome code can dynamically
@@ -149,6 +150,7 @@ SRGBOverrideObserver::Observe(nsISupports *aSubject,
 
 #define GFX_PREF_HARFBUZZ_SCRIPTS "gfx.font_rendering.harfbuzz.scripts"
 #define HARFBUZZ_SCRIPTS_DEFAULT  mozilla::unicode::SHAPING_DEFAULT
+#define GFX_PREF_FALLBACK_USE_CMAPS  "gfx.font_rendering.fallback.always_use_cmaps"
 
 #ifdef MOZ_GRAPHITE
 #define GFX_PREF_GRAPHITE_SHAPING "gfx.font_rendering.graphite.enabled"
@@ -232,6 +234,8 @@ gfxPlatform::gfxPlatform()
     mUseHarfBuzzScripts = UNINITIALIZED_VALUE;
     mAllowDownloadableFonts = UNINITIALIZED_VALUE;
     mDownloadableFontsSanitize = UNINITIALIZED_VALUE;
+    mFallbackUsesCmaps = UNINITIALIZED_VALUE;
+
 #ifdef MOZ_GRAPHITE
     mGraphiteShapingEnabled = UNINITIALIZED_VALUE;
 #endif
@@ -268,6 +272,7 @@ gfxPlatform::Init()
     sFontInitLog = PR_NewLogModule("fontinit");;
     sTextrunLog = PR_NewLogModule("textrun");;
     sTextrunuiLog = PR_NewLogModule("textrunui");;
+    sCmapDataLog = PR_NewLogModule("cmapdata");;
 #endif
 
 
@@ -680,6 +685,17 @@ gfxPlatform::SanitizeDownloadedFonts()
     return mDownloadableFontsSanitize;
 }
 
+bool
+gfxPlatform::UseCmapsDuringSystemFallback()
+{
+    if (mFallbackUsesCmaps == UNINITIALIZED_VALUE) {
+        mFallbackUsesCmaps =
+            Preferences::GetBool(GFX_PREF_FALLBACK_USE_CMAPS, false);
+    }
+
+    return mFallbackUsesCmaps;
+}
+
 #ifdef MOZ_GRAPHITE
 bool
 gfxPlatform::UseGraphiteShaping()
@@ -1358,6 +1374,8 @@ gfxPlatform::FontsPrefsChanged(const char *aPref)
         mAllowDownloadableFonts = UNINITIALIZED_VALUE;
     } else if (!strcmp(GFX_DOWNLOADABLE_FONTS_SANITIZE, aPref)) {
         mDownloadableFontsSanitize = UNINITIALIZED_VALUE;
+    } else if (!strcmp(GFX_PREF_FALLBACK_USE_CMAPS, aPref)) {
+        mFallbackUsesCmaps = UNINITIALIZED_VALUE;
 #ifdef MOZ_GRAPHITE
     } else if (!strcmp(GFX_PREF_GRAPHITE_SHAPING, aPref)) {
         mGraphiteShapingEnabled = UNINITIALIZED_VALUE;
@@ -1397,6 +1415,9 @@ gfxPlatform::GetLog(eGfxLog aWhichLog)
     case eGfxLog_textrunui:
         return sTextrunuiLog;
         break;
+    case eGfxLog_cmapdata:
+        return sCmapDataLog;
+        break;
     default:
         break;
     }
diff --git a/gfx/thebes/gfxPlatform.h b/gfx/thebes/gfxPlatform.h
index f9827d50f29..f4fefeea934 100644
--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -136,7 +136,9 @@ enum eGfxLog {
     // dump text runs, font matching, system fallback for content
     eGfxLog_textrun          = 2,
     // dump text runs, font matching, system fallback for chrome
-    eGfxLog_textrunui        = 3
+    eGfxLog_textrunui        = 3,
+    // dump cmap coverage data as they are loaded
+    eGfxLog_cmapdata         = 4
 };
 
 // when searching through pref langs, max number of pref langs
@@ -317,6 +319,11 @@ public:
      */
     virtual bool FontHintingEnabled() { return true; }
 
+    /**
+     * Whether to check all font cmaps during system font fallback
+     */
+    bool UseCmapsDuringSystemFallback();
+
 #ifdef MOZ_GRAPHITE
     /**
      * Whether to use the SIL Graphite rendering engine
@@ -369,6 +376,15 @@ public:
     // helper method to add a pref lang to an array, if not already in array
     static void AppendPrefLang(eFontPrefLang aPrefLangs[], PRUint32& aLen, eFontPrefLang aAddLang);
 
+    // returns a list of commonly used fonts for a given character
+    // these are *possible* matches, no cmap-checking is done at this level
+    virtual void GetCommonFallbackFonts(const PRUint32 /*aCh*/,
+                                        PRInt32 /*aRunScript*/,
+                                        nsTArray<const char*>& /*aFontList*/)
+    {
+        // platform-specific override, by default do nothing
+    }
+
     // helper method to indicate if we want to use Azure content drawing
     static bool UseAzureContentDrawing();
     
@@ -454,6 +470,10 @@ protected:
 
     PRInt8  mBidiNumeralOption;
 
+    // whether to always search font cmaps globally 
+    // when doing system font fallback
+    PRInt8  mFallbackUsesCmaps;
+
     // which scripts should be shaped with harfbuzz
     PRInt32 mUseHarfBuzzScripts;
 
diff --git a/gfx/thebes/gfxPlatformFontList.cpp b/gfx/thebes/gfxPlatformFontList.cpp
index d7c9fa4a027..b65675f8ad9 100644
--- a/gfx/thebes/gfxPlatformFontList.cpp
+++ b/gfx/thebes/gfxPlatformFontList.cpp
@@ -20,6 +20,7 @@
  *
  * Contributor(s):
  *   Jonathan Kew <jfkthame@gmail.com>
+ *   John Daggett <jdaggett@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -376,44 +377,45 @@ gfxPlatformFontList::GetFontFamilyList(nsTArray<nsRefPtr<gfxFontFamily> >& aFami
     mFontFamilies.Enumerate(FontFamilyListData::AppendFamily, &data);
 }
 
-gfxFontEntry*  
-gfxPlatformFontList::FindFontForChar(const PRUint32 aCh, gfxFont *aPrevFont)
-{
+gfxFontEntry*
+gfxPlatformFontList::SystemFindFontForChar(const PRUint32 aCh,
+                                           PRInt32 aRunScript,
+                                           const gfxFontStyle* aStyle)
+ {
+    gfxFontEntry* fontEntry = nsnull;
+
     // is codepoint with no matching font? return null immediately
     if (mCodepointsWithNoFonts.test(aCh)) {
         return nsnull;
     }
 
-    // TODO: optimize fallback e.g. by caching lists of fonts to try for a given
-    // unicode range or script
-
-    // try to short-circuit font fallback for U+FFFD, used to represent encoding errors:
-    // just use a platform-specific fallback system font that is guaranteed (or at least
-    // highly likely) to be around, or a cached family from last time U+FFFD was seen.
-    // this helps speed up pages with lots of encoding errors, binary-as-text, etc.
+    // try to short-circuit font fallback for U+FFFD, used to represent
+    // encoding errors: just use a platform-specific fallback system
+    // font that is guaranteed (or at least highly likely) to be around,
+    // or a cached family from last time U+FFFD was seen. this helps
+    // speed up pages with lots of encoding errors, binary-as-text, etc.
     if (aCh == 0xFFFD && mReplacementCharFallbackFamily.Length() > 0) {
-        gfxFontEntry* fontEntry = nsnull;
         bool needsBold;  // ignored in the system fallback case
 
-        if (aPrevFont) {
-            fontEntry = FindFontForFamily(mReplacementCharFallbackFamily, aPrevFont->GetStyle(), needsBold);
-        } else {
-            gfxFontStyle normalStyle;
-            fontEntry = FindFontForFamily(mReplacementCharFallbackFamily, &normalStyle, needsBold);
-        }
+        fontEntry = FindFontForFamily(mReplacementCharFallbackFamily,
+                                      aStyle, needsBold);
 
         if (fontEntry && fontEntry->TestCharacterMap(aCh))
             return fontEntry;
     }
 
-    static bool first = true;
     TimeStamp start = TimeStamp::Now();
 
-    FontSearch data(aCh, aPrevFont);
-
-    // iterate over all font families to find a font that support the character
-    mFontFamilies.Enumerate(gfxPlatformFontList::FindFontForCharProc, &data);
-
+    // search commonly available fonts
+    bool common = true;
+    fontEntry = CommonFontFallback(aCh, aRunScript, aStyle);
+ 
+    // if didn't find a font, do system-wide fallback (except for specials)
+    PRUint32 cmapCount = 0;
+    if (!fontEntry) {
+        common = false;
+        fontEntry = GlobalFontFallback(aCh, aRunScript, aStyle, cmapCount);
+    }
     TimeDuration elapsed = TimeStamp::Now() - start;
 
 #ifdef PR_LOGGING
@@ -423,27 +425,28 @@ gfxPlatformFontList::FindFontForChar(const PRUint32 aCh, gfxFont *aPrevFont)
         PRUint32 charRange = gfxFontUtils::CharRangeBit(aCh);
         PRUint32 unicodeRange = FindCharUnicodeRange(aCh);
         PRInt32 script = mozilla::unicode::GetScriptCode(aCh);
-        PR_LOG(log, PR_LOG_DEBUG,\
-               ("(textrun-systemfallback) char: u+%6.6x "
-                "char-range: %d unicode-range: %d script: %d match: [%s]"
-                " count: %d time: %dus\n",
-                aCh,
-                charRange, unicodeRange, script,
-                (data.mBestMatch ?
-                 NS_ConvertUTF16toUTF8(data.mBestMatch->Name()).get() :
-                 "<none>"),
-                data.mCount,
-                PRInt32(elapsed.ToMicroseconds())));
+        PR_LOG(log, PR_LOG_WARNING,\
+               ("(textrun-systemfallback-%s) char: u+%6.6x "
+                 "char-range: %d unicode-range: %d script: %d match: [%s]"
+                " time: %dus cmaps: %d\n",
+                (common ? "common" : "global"), aCh,
+                 charRange, unicodeRange, script,
+                (fontEntry ? NS_ConvertUTF16toUTF8(fontEntry->Name()).get() :
+                    "<none>"),
+                PRInt32(elapsed.ToMicroseconds()),
+                cmapCount));
     }
 #endif
 
     // no match? add to set of non-matching codepoints
-    if (!data.mBestMatch) {
-        mCodepointsWithNoFonts.set(aCh);
-    } else if (aCh == 0xFFFD) {
-        mReplacementCharFallbackFamily = data.mBestMatch->FamilyName();
-    }
-
+    if (!fontEntry) {
+         mCodepointsWithNoFonts.set(aCh);
+    } else if (aCh == 0xFFFD && fontEntry) {
+        mReplacementCharFallbackFamily = fontEntry->FamilyName();
+     }
+ 
+    // track system fallback time
+    static bool first = true;
     PRInt32 intElapsed = PRInt32(first ? elapsed.ToMilliseconds() :
                                          elapsed.ToMicroseconds());
     Telemetry::Accumulate((first ? Telemetry::SYSTEM_FONT_FALLBACK_FIRST :
@@ -451,18 +454,76 @@ gfxPlatformFontList::FindFontForChar(const PRUint32 aCh, gfxFont *aPrevFont)
                           intElapsed);
     first = false;
 
-    return data.mBestMatch;
+    // track the script for which fallback occurred (incremented one make it
+    // 1-based)
+    Telemetry::Accumulate(Telemetry::SYSTEM_FONT_FALLBACK_SCRIPT, aRunScript + 1);
+
+    return fontEntry;
 }
 
 PLDHashOperator PR_CALLBACK 
 gfxPlatformFontList::FindFontForCharProc(nsStringHashKey::KeyType aKey, nsRefPtr<gfxFontFamily>& aFamilyEntry,
      void *userArg)
 {
-    FontSearch *data = static_cast<FontSearch*>(userArg);
+    GlobalFontMatch *data = static_cast<GlobalFontMatch*>(userArg);
+ 
+     // evaluate all fonts in this family for a match
+     aFamilyEntry->FindFontForChar(data);
 
-    // evaluate all fonts in this family for a match
-    aFamilyEntry->FindFontForChar(data);
-    return PL_DHASH_NEXT;
+     return PL_DHASH_NEXT;
+}
+
+#define NUM_FALLBACK_FONTS        8
+
+gfxFontEntry*
+gfxPlatformFontList::CommonFontFallback(const PRUint32 aCh,
+                                        PRInt32 aRunScript,
+                                        const gfxFontStyle* aMatchStyle)
+{
+    nsAutoTArray<const char*,NUM_FALLBACK_FONTS> defaultFallbacks;
+    PRUint32 i, numFallbacks;
+
+    gfxPlatform::GetPlatform()->GetCommonFallbackFonts(aCh, aRunScript,
+                                                       defaultFallbacks);
+    numFallbacks = defaultFallbacks.Length();
+    for (i = 0; i < numFallbacks; i++) {
+        nsAutoString familyName;
+        const char *fallbackFamily = defaultFallbacks[i];
+
+        familyName.AppendASCII(fallbackFamily);
+        gfxFontFamily *fallback =
+                gfxPlatformFontList::PlatformFontList()->FindFamily(familyName);
+        if (!fallback)
+            continue;
+
+        gfxFontEntry *fontEntry;
+        bool needsBold;  // ignored in the system fallback case
+
+        // use first font in list that supports a given character
+        fontEntry = fallback->FindFontForStyle(*aMatchStyle, needsBold);
+        if (fontEntry && fontEntry->TestCharacterMap(aCh)) {
+            return fontEntry;
+        }
+    }
+
+    return nsnull;
+}
+
+gfxFontEntry*
+gfxPlatformFontList::GlobalFontFallback(const PRUint32 aCh,
+                                        PRInt32 aRunScript,
+                                        const gfxFontStyle* aMatchStyle,
+                                        PRUint32& aCmapCount)
+{
+    // otherwise, try to find it among local fonts
+    GlobalFontMatch data(aCh, aRunScript, aMatchStyle);
+
+    // iterate over all font families to find a font that support the character
+    mFontFamilies.Enumerate(gfxPlatformFontList::FindFontForCharProc, &data);
+
+    aCmapCount = data.mCmapsTested;
+
+    return data.mBestMatch;
 }
 
 #ifdef XP_WIN
@@ -609,10 +670,12 @@ gfxPlatformFontList::InitLoader()
     mNumFamilies = mFontFamiliesToLoad.Length();
 }
 
-bool 
+bool
 gfxPlatformFontList::RunLoader()
 {
     PRUint32 i, endIndex = (mStartIndex + mIncrement < mNumFamilies ? mStartIndex + mIncrement : mNumFamilies);
+    bool loadCmaps = !UsesSystemFallback() ||
+        gfxPlatform::GetPlatform()->UseCmapsDuringSystemFallback();
 
     // for each font family, load in various font info
     for (i = mStartIndex; i < endIndex; i++) {
@@ -628,8 +691,10 @@ gfxPlatformFontList::RunLoader()
             continue;
         }
 
-        // load the cmaps
-        familyEntry->ReadCMAP();
+        // load the cmaps if needed
+        if (loadCmaps) {
+            familyEntry->ReadAllCMAPs();
+        }
 
         // read in face names
         familyEntry->ReadFaceNames(this, mNeedFullnamePostscriptNames);
diff --git a/gfx/thebes/gfxPlatformFontList.h b/gfx/thebes/gfxPlatformFontList.h
index 412a311877b..59509552660 100644
--- a/gfx/thebes/gfxPlatformFontList.h
+++ b/gfx/thebes/gfxPlatformFontList.h
@@ -20,6 +20,7 @@
  *
  * Contributor(s):
  *   Jonathan Kew <jfkthame@gmail.com>
+ *   John Daggett <jdaggett@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -97,7 +98,10 @@ public:
 
     virtual void GetFontFamilyList(nsTArray<nsRefPtr<gfxFontFamily> >& aFamilyArray);
 
-    gfxFontEntry* FindFontForChar(const PRUint32 aCh, gfxFont *aPrevFont);
+    virtual gfxFontEntry*
+    SystemFindFontForChar(const PRUint32 aCh,
+                          PRInt32 aRunScript,
+                          const gfxFontStyle* aStyle);
 
     // TODO: make this virtual, for lazily adding to the font list
     virtual gfxFontFamily* FindFamily(const nsAString& aFamily);
@@ -146,6 +150,21 @@ protected:
                                                nsRefPtr<gfxFontFamily>& aFamilyEntry,
                                                void* userArg);
 
+    // returns default font for a given character, null otherwise
+    virtual gfxFontEntry* CommonFontFallback(const PRUint32 aCh,
+                                             PRInt32 aRunScript,
+                                             const gfxFontStyle* aMatchStyle);
+
+    // search fonts system-wide for a given character, null otherwise
+    virtual gfxFontEntry* GlobalFontFallback(const PRUint32 aCh,
+                                             PRInt32 aRunScript,
+                                             const gfxFontStyle* aMatchStyle,
+                                             PRUint32& aCmapCount);
+
+    // whether system-based font fallback is used or not
+    // if system fallback is used, no need to load all cmaps
+    virtual bool UsesSystemFallback() { return false; }
+
     // separate initialization for reading in name tables, since this is expensive
     void InitOtherFamilyNames();
 
diff --git a/gfx/thebes/gfxPlatformGtk.cpp b/gfx/thebes/gfxPlatformGtk.cpp
index 5ed29833043..2a106d3fbbd 100644
--- a/gfx/thebes/gfxPlatformGtk.cpp
+++ b/gfx/thebes/gfxPlatformGtk.cpp
@@ -45,6 +45,7 @@
 #include "gfxPlatformGtk.h"
 
 #include "nsUnicharUtils.h"
+#include "nsUnicodeProperties.h"
 #include "gfxFontconfigUtils.h"
 #ifdef MOZ_PANGO
 #include "gfxPangoFonts.h"
@@ -82,6 +83,7 @@
 
 using namespace mozilla;
 using namespace mozilla::gfx;
+using namespace mozilla::unicode;
 
 gfxFontconfigUtils *gfxPlatformGtk::sFontconfigUtils = nsnull;
 
@@ -668,7 +670,7 @@ FindFontForCharProc(nsStringHashKey::KeyType aKey,
                     nsRefPtr<FontFamily>& aFontFamily,
                     void* aUserArg)
 {
-    FontSearch *data = (FontSearch*)aUserArg;
+    GlobalFontMatch *data = (GlobalFontMatch*)aUserArg;
     aFontFamily->FindFontForChar(data);
     return PL_DHASH_NEXT;
 }
@@ -684,7 +686,8 @@ gfxPlatformGtk::FindFontForChar(PRUint32 aCh, gfxFont *aFont)
         return nsnull;
     }
 
-    FontSearch data(aCh, aFont);
+    GlobalFontMatch data(aCh, GetScriptCode(aCh),
+                         (aFont ? aFont->GetStyle() : nsnull));
 
     // find fonts that support the character
     gPlatformFonts->Enumerate(FindFontForCharProc, &data);
diff --git a/gfx/thebes/gfxPlatformMac.cpp b/gfx/thebes/gfxPlatformMac.cpp
index 55b6694262e..7d7e62ddf74 100644
--- a/gfx/thebes/gfxPlatformMac.cpp
+++ b/gfx/thebes/gfxPlatformMac.cpp
@@ -263,6 +263,108 @@ gfxPlatformMac::UpdateFontList()
     return NS_OK;
 }
 
+static const char kFontArialUnicodeMS[] = "Arial Unicode MS";
+static const char kFontAppleBraille[] = "Apple Braille";
+static const char kFontAppleSymbols[] = "Apple Symbols";
+static const char kFontAppleMyungjo[] = "AppleMyungjo";
+static const char kFontGeneva[] = "Geneva";
+static const char kFontGeezaPro[] = "Geeza Pro";
+static const char kFontHiraginoKakuGothic[] = "Hiragino Kaku Gothic ProN";
+static const char kFontLucidaGrande[] = "Lucida Grande";
+static const char kFontMenlo[] = "Menlo";
+static const char kFontPlantagenetCherokee[] = "Plantagenet Cherokee";
+static const char kFontSTHeiti[] = "STHeiti";
+
+void
+gfxPlatformMac::GetCommonFallbackFonts(const PRUint32 aCh,
+                                       PRInt32 aRunScript,
+                                       nsTArray<const char*>& aFontList)
+{
+    aFontList.AppendElement(kFontLucidaGrande);
+
+    if (!IS_IN_BMP(aCh)) {
+        PRUint32 p = aCh >> 16;
+        if (p == 1) {
+            aFontList.AppendElement(kFontAppleSymbols);
+            aFontList.AppendElement(kFontGeneva);
+        }
+    } else {
+        PRUint32 b = (aCh >> 8) & 0xff;
+
+        switch (b) {
+        case 0x03:
+        case 0x05:
+            aFontList.AppendElement(kFontGeneva);
+            break;
+        case 0x07:
+            aFontList.AppendElement(kFontGeezaPro);
+            break;
+        case 0x10:
+            aFontList.AppendElement(kFontMenlo);
+            break;
+        case 0x13:  // Cherokee
+            aFontList.AppendElement(kFontPlantagenetCherokee);
+            break;
+        case 0x18:  // Mongolian
+            aFontList.AppendElement(kFontSTHeiti);
+            break;
+        case 0x1d:
+        case 0x1e:
+            aFontList.AppendElement(kFontGeneva);
+            break;
+        case 0x20:  // Symbol ranges
+        case 0x21:
+        case 0x22:
+        case 0x23:
+        case 0x24:
+        case 0x25:
+        case 0x26:
+        case 0x27:
+        case 0x29:
+        case 0x2a:
+        case 0x2b:
+        case 0x2e:
+            aFontList.AppendElement(kFontAppleSymbols);
+            aFontList.AppendElement(kFontMenlo);
+            aFontList.AppendElement(kFontGeneva);
+            aFontList.AppendElement(kFontHiraginoKakuGothic);
+            break;
+        case 0x2c:
+        case 0x2d:
+            aFontList.AppendElement(kFontGeneva);
+            break;
+        case 0x28:  // Braille
+            aFontList.AppendElement(kFontAppleBraille);
+            break;
+        case 0x4d:
+            aFontList.AppendElement(kFontAppleSymbols);
+            break;
+        case 0xa0:  // Yi
+        case 0xa1:
+        case 0xa2:
+        case 0xa3:
+        case 0xa4:
+            aFontList.AppendElement(kFontSTHeiti);
+            break;
+        case 0xa6:
+        case 0xa7:
+            aFontList.AppendElement(kFontGeneva);
+            aFontList.AppendElement(kFontAppleSymbols);
+            break;
+        case 0xfc:
+        case 0xff:
+            aFontList.AppendElement(kFontAppleSymbols);
+            break;
+        default:
+            break;
+        }
+    }
+
+    // Arial Unicode MS has lots of glyphs for obscure, use it as a last resort
+    aFontList.AppendElement(kFontArialUnicodeMS);
+}
+
+
 PRInt32 
 gfxPlatformMac::OSXVersion()
 {
diff --git a/gfx/thebes/gfxPlatformMac.h b/gfx/thebes/gfxPlatformMac.h
index 8bedb9a857e..226d1ebda2a 100644
--- a/gfx/thebes/gfxPlatformMac.h
+++ b/gfx/thebes/gfxPlatformMac.h
@@ -50,6 +50,7 @@
 #define MAC_OS_X_MAJOR_VERSION_MASK 0xFFFFFFF0U
 
 class gfxTextRun;
+class gfxFontFamily;
 class mozilla::gfx::DrawTarget;
 
 class THEBES_API gfxPlatformMac : public gfxPlatform {
@@ -98,6 +99,10 @@ public:
                          nsTArray<nsString>& aListOfFonts);
     nsresult UpdateFontList();
 
+    virtual void GetCommonFallbackFonts(const PRUint32 aCh,
+                                        PRInt32 aRunScript,
+                                        nsTArray<const char*>& aFontList);
+
     // Returns the OS X version as returned from Gestalt(gestaltSystemVersion, ...)
     // Ex: Mac OS X 10.4.x ==> 0x104x 
     PRInt32 OSXVersion();
diff --git a/gfx/thebes/gfxQtPlatform.cpp b/gfx/thebes/gfxQtPlatform.cpp
index 76c6b970238..81548348842 100644
--- a/gfx/thebes/gfxQtPlatform.cpp
+++ b/gfx/thebes/gfxQtPlatform.cpp
@@ -50,6 +50,7 @@
 
 #include "gfxImageSurface.h"
 #include "gfxQPainterSurface.h"
+#include "nsUnicodeProperties.h"
 
 #ifdef MOZ_PANGO
 #include "gfxPangoFonts.h"
@@ -79,6 +80,7 @@
 #include "mozilla/Preferences.h"
 
 using namespace mozilla;
+using namespace mozilla::unicode;
 
 #define DEFAULT_RENDER_MODE RENDER_DIRECT
 
@@ -526,7 +528,7 @@ FindFontForCharProc(nsStringHashKey::KeyType aKey,
                     nsRefPtr<FontFamily>& aFontFamily,
                     void* aUserArg)
 {
-    FontSearch *data = (FontSearch*)aUserArg;
+    GlobalFontMatch *data = (GlobalFontMatch*)aUserArg;
     aFontFamily->FindFontForChar(data);
     return PL_DHASH_NEXT;
 }
@@ -542,7 +544,8 @@ gfxQtPlatform::FindFontForChar(PRUint32 aCh, gfxFont *aFont)
         return nsnull;
     }
 
-    FontSearch data(aCh, aFont);
+    GlobalFontMatch data(aCh, GetScriptCode(aCh),
+                         (aFont ? aFont->GetStyle() : nsnull));
 
     // find fonts that support the character
     gPlatformFonts->Enumerate(FindFontForCharProc, &data);
diff --git a/gfx/thebes/gfxUserFontSet.cpp b/gfx/thebes/gfxUserFontSet.cpp
index dba646a706c..1080a8a0f14 100644
--- a/gfx/thebes/gfxUserFontSet.cpp
+++ b/gfx/thebes/gfxUserFontSet.cpp
@@ -402,6 +402,22 @@ StoreUserFontData(gfxFontEntry* aFontEntry, gfxProxyFontEntry* aProxy,
     }
 }
 
+struct WOFFHeader {
+    AutoSwap_PRUint32 signature;
+    AutoSwap_PRUint32 flavor;
+    AutoSwap_PRUint32 length;
+    AutoSwap_PRUint16 numTables;
+    AutoSwap_PRUint16 reserved;
+    AutoSwap_PRUint32 totalSfntSize;
+    AutoSwap_PRUint16 majorVersion;
+    AutoSwap_PRUint16 minorVersion;
+    AutoSwap_PRUint32 metaOffset;
+    AutoSwap_PRUint32 metaCompLen;
+    AutoSwap_PRUint32 metaOrigLen;
+    AutoSwap_PRUint32 privOffset;
+    AutoSwap_PRUint32 privLen;
+};
+
 void
 gfxUserFontSet::CopyWOFFMetadata(const PRUint8* aFontData,
                                  PRUint32 aLength,
@@ -414,21 +430,6 @@ gfxUserFontSet::CopyWOFFMetadata(const PRUint8* aFontData,
     // This just saves a copy of the compressed data block; it does NOT check
     // that the block can be successfully decompressed, or that it contains
     // well-formed/valid XML metadata.
-    struct WOFFHeader {
-        AutoSwap_PRUint32 signature;
-        AutoSwap_PRUint32 flavor;
-        AutoSwap_PRUint32 length;
-        AutoSwap_PRUint16 numTables;
-        AutoSwap_PRUint16 reserved;
-        AutoSwap_PRUint32 totalSfntSize;
-        AutoSwap_PRUint16 majorVersion;
-        AutoSwap_PRUint16 minorVersion;
-        AutoSwap_PRUint32 metaOffset;
-        AutoSwap_PRUint32 metaCompLen;
-        AutoSwap_PRUint32 metaOrigLen;
-        AutoSwap_PRUint32 privOffset;
-        AutoSwap_PRUint32 privLen;
-    };
     if (aLength < sizeof(WOFFHeader)) {
         return;
     }
diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index cf5066a383e..e8b04770d37 100644
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -293,29 +293,28 @@ public:
         
         FreeLibrary(gdi32Handle);
         
-        aCb->Callback(EmptyCString(),
-                      NS_LITERAL_CSTRING("gpu-committed"),
-                      nsIMemoryReporter::KIND_OTHER,
-                      nsIMemoryReporter::UNITS_BYTES,
-                      committedBytesUsed,
-                      NS_LITERAL_CSTRING("Memory committed by the Windows graphics system."),
-                      aClosure);
-        aCb->Callback(EmptyCString(),
-                      NS_LITERAL_CSTRING("gpu-dedicated"),
-                      nsIMemoryReporter::KIND_OTHER,
-                      nsIMemoryReporter::UNITS_BYTES,
-                      dedicatedBytesUsed,
-                      NS_LITERAL_CSTRING("Out-of-process memory allocated for this process in a "
-                                         "physical GPU adapter's memory."),
-                      aClosure);
-        aCb->Callback(EmptyCString(),
-                      NS_LITERAL_CSTRING("gpu-shared"),
-                      nsIMemoryReporter::KIND_OTHER,
-                      nsIMemoryReporter::UNITS_BYTES,
-                      sharedBytesUsed,
-                      NS_LITERAL_CSTRING("In-process memory that is shared with the GPU."),
-                      aClosure);
+#define REPORT(_path, _amount, _desc)                                         \
+    do {                                                                      \
+      nsresult rv;                                                            \
+      rv = aCb->Callback(EmptyCString(), NS_LITERAL_CSTRING(_path),           \
+                         nsIMemoryReporter::KIND_OTHER,                       \
+                         nsIMemoryReporter::UNITS_BYTES, _amount,             \
+                         NS_LITERAL_CSTRING(_desc), aClosure);                \
+      NS_ENSURE_SUCCESS(rv, rv);                                              \
+    } while (0)
+
+        REPORT("gpu-committed", committedBytesUsed,
+               "Memory committed by the Windows graphics system.");
+
+        REPORT("gpu-dedicated", dedicatedBytesUsed,
+               "Out-of-process memory allocated for this process in a "
+               "physical GPU adapter's memory.");
+
+        REPORT("gpu-shared", sharedBytesUsed,
+               "In-process memory that is shared with the GPU.");
         
+#undef REPORT
+
         return NS_OK;
     }
 
@@ -828,6 +827,175 @@ gfxWindowsPlatform::UpdateFontList()
     return NS_OK;
 }
 
+static const char kFontArabicTypesetting[] = "Arabic Typesetting";
+static const char kFontArial[] = "Arial";
+static const char kFontArialUnicodeMS[] = "Arial Unicode MS";
+static const char kFontCambria[] = "Cambria";
+static const char kFontCambriaMath[] = "Cambria Math";
+static const char kFontEbrima[] = "Ebrima";
+static const char kFontEstrangeloEdessa[] = "Estrangelo Edessa";
+static const char kFontEuphemia[] = "Euphemia";
+static const char kFontGabriola[] = "Gabriola";
+static const char kFontKhmerUI[] = "Khmer UI";
+static const char kFontLaoUI[] = "Lao UI";
+static const char kFontMVBoli[] = "MV Boli";
+static const char kFontMalgunGothic[] = "Malgun Gothic";
+static const char kFontMicrosoftJhengHei[] = "Microsoft JhengHei";
+static const char kFontMicrosoftNewTaiLue[] = "Microsoft New Tai Lue";
+static const char kFontMicrosoftPhagsPa[] = "Microsoft PhagsPa";
+static const char kFontMicrosoftTaiLe[] = "Microsoft Tai Le";
+static const char kFontMicrosoftUighur[] = "Microsoft Uighur";
+static const char kFontMicrosoftYaHei[] = "Microsoft YaHei";
+static const char kFontMicrosoftYiBaiti[] = "Microsoft Yi Baiti";
+static const char kFontMeiryo[] = "Meiryo";
+static const char kFontMongolianBaiti[] = "Mongolian Baiti";
+static const char kFontNyala[] = "Nyala";
+static const char kFontPlantagenetCherokee[] = "Plantagenet Cherokee";
+static const char kFontSegoeUI[] = "Segoe UI";
+static const char kFontSegoeUISymbol[] = "Segoe UI Symbol";
+static const char kFontSylfaen[] = "Sylfaen";
+static const char kFontTraditionalArabic[] = "Traditional Arabic";
+
+void
+gfxWindowsPlatform::GetCommonFallbackFonts(const PRUint32 aCh,
+                                           PRInt32 aRunScript,
+                                           nsTArray<const char*>& aFontList)
+{
+    // Arial is used as the default fallback for system fallback
+    aFontList.AppendElement(kFontArial);
+
+    if (!IS_IN_BMP(aCh)) {
+        PRUint32 p = aCh >> 16;
+        if (p == 1) { // SMP plane
+            aFontList.AppendElement(kFontCambriaMath);
+            aFontList.AppendElement(kFontSegoeUISymbol);
+            aFontList.AppendElement(kFontEbrima);
+        }
+    } else {
+        PRUint32 b = (aCh >> 8) & 0xff;
+
+        switch (b) {
+        case 0x05:
+            aFontList.AppendElement(kFontEstrangeloEdessa);
+            aFontList.AppendElement(kFontCambria);
+            break;
+        case 0x06:
+            aFontList.AppendElement(kFontMicrosoftUighur);
+            break;
+        case 0x07:
+            aFontList.AppendElement(kFontEstrangeloEdessa);
+            aFontList.AppendElement(kFontMVBoli);
+            aFontList.AppendElement(kFontEbrima);
+            break;
+        case 0x0e:
+            aFontList.AppendElement(kFontLaoUI);
+            break;
+        case 0x12:
+        case 0x13:
+            aFontList.AppendElement(kFontNyala);
+            aFontList.AppendElement(kFontPlantagenetCherokee);
+            break;
+        case 0x14:
+        case 0x15:
+        case 0x16:
+            aFontList.AppendElement(kFontEuphemia);
+            aFontList.AppendElement(kFontSegoeUISymbol);
+            break;
+        case 0x17:
+            aFontList.AppendElement(kFontKhmerUI);
+            break;
+        case 0x18:  // Mongolian
+            aFontList.AppendElement(kFontMongolianBaiti);
+            break;
+        case 0x19:
+            aFontList.AppendElement(kFontMicrosoftTaiLe);
+            aFontList.AppendElement(kFontMicrosoftNewTaiLue);
+            aFontList.AppendElement(kFontKhmerUI);
+            break;
+            break;
+        case 0x20:  // Symbol ranges
+        case 0x21:
+        case 0x22:
+        case 0x23:
+        case 0x24:
+        case 0x25:
+        case 0x26:
+        case 0x27:
+        case 0x29:
+        case 0x2a:
+        case 0x2b:
+        case 0x2c:
+            aFontList.AppendElement(kFontSegoeUI);
+            aFontList.AppendElement(kFontSegoeUISymbol);
+            aFontList.AppendElement(kFontCambria);
+            aFontList.AppendElement(kFontCambriaMath);
+            aFontList.AppendElement(kFontMeiryo);
+            aFontList.AppendElement(kFontArial);
+            aFontList.AppendElement(kFontEbrima);
+            break;
+        case 0x2d:
+        case 0x2e:
+        case 0x2f:
+            aFontList.AppendElement(kFontEbrima);
+            aFontList.AppendElement(kFontNyala);
+            aFontList.AppendElement(kFontMeiryo);
+            break;
+        case 0x28:  // Braille
+            aFontList.AppendElement(kFontSegoeUISymbol);
+            break;
+        case 0x30:
+        case 0x31:
+            aFontList.AppendElement(kFontMicrosoftYaHei);
+            break;
+        case 0x32:
+            aFontList.AppendElement(kFontMalgunGothic);
+            break;
+        case 0x4d:
+            aFontList.AppendElement(kFontSegoeUISymbol);
+            break;
+        case 0xa0:  // Yi
+        case 0xa1:
+        case 0xa2:
+        case 0xa3:
+        case 0xa4:
+            aFontList.AppendElement(kFontMicrosoftYiBaiti);
+            break;
+        case 0xa5:
+        case 0xa6:
+        case 0xa7:
+            aFontList.AppendElement(kFontEbrima);
+            aFontList.AppendElement(kFontCambriaMath);
+            break;
+        case 0xa8:
+             aFontList.AppendElement(kFontMicrosoftPhagsPa);
+             break;
+        case 0xfb:
+            aFontList.AppendElement(kFontMicrosoftUighur);
+            aFontList.AppendElement(kFontGabriola);
+            aFontList.AppendElement(kFontSylfaen);
+            break;
+        case 0xfc:
+        case 0xfd:
+            aFontList.AppendElement(kFontTraditionalArabic);
+            aFontList.AppendElement(kFontArabicTypesetting);
+            break;
+        case 0xfe:
+            aFontList.AppendElement(kFontTraditionalArabic);
+            aFontList.AppendElement(kFontMicrosoftJhengHei);
+           break;
+       case 0xff:
+            aFontList.AppendElement(kFontMicrosoftJhengHei);
+            break;
+        default:
+            break;
+        }
+    }
+
+    // Arial Unicode MS has lots of glyphs for obscure characters,
+    // use it as a last resort
+    aFontList.AppendElement(kFontArialUnicodeMS);
+}
+
 struct ResolveData {
     ResolveData(gfxPlatform::FontResolverCallback aCallback,
                 gfxWindowsPlatform *aCaller, const nsAString *aFontName,
diff --git a/gfx/thebes/gfxWindowsPlatform.h b/gfx/thebes/gfxWindowsPlatform.h
index 3c1716f3df5..f61be30a2d9 100644
--- a/gfx/thebes/gfxWindowsPlatform.h
+++ b/gfx/thebes/gfxWindowsPlatform.h
@@ -179,6 +179,10 @@ public:
 
     nsresult UpdateFontList();
 
+    virtual void GetCommonFallbackFonts(const PRUint32 aCh,
+                                        PRInt32 aRunScript,
+                                        nsTArray<const char*>& aFontList);
+
     nsresult ResolveFontName(const nsAString& aFontName,
                              FontResolverCallback aCallback,
                              void *aClosure, bool& aAborted);
diff --git a/gfx/thebes/nsUnicodeRange.cpp b/gfx/thebes/nsUnicodeRange.cpp
index 78c5898e23d..756492537ca 100644
--- a/gfx/thebes/nsUnicodeRange.cpp
+++ b/gfx/thebes/nsUnicodeRange.cpp
@@ -213,7 +213,7 @@ static nsIAtom **gUnicodeRangeToLangGroupAtomTable[] =
 
 
 
-#define NUM_OF_SUBTABLES      9
+#define NUM_OF_SUBTABLES      10
 #define SUBTABLE_SIZE         16
 
 static const PRUint8 gUnicodeSubrangeTable[NUM_OF_SUBTABLES][SUBTABLE_SIZE] = 
@@ -252,7 +252,7 @@ static const PRUint8 gUnicodeSubrangeTable[NUM_OF_SUBTABLES][SUBTABLE_SIZE] =
     kRangeTertiaryTable,     //u0cxx
     kRangeTertiaryTable,     //u0dxx
     kRangeTertiaryTable,     //u0exx
-    kRangeTibetan,           //u0fxx
+    kRangeTibetan            //u0fxx
   },
   { //table for 1x--
     kRangeTertiaryTable,     //u10xx
@@ -270,7 +270,7 @@ static const PRUint8 gUnicodeSubrangeTable[NUM_OF_SUBTABLES][SUBTABLE_SIZE] =
     kRangeUnassigned,        //u1cxx
     kRangeUnassigned,        //u1dxx
     kRangeSetLatin,          //u1exx
-    kRangeGreek,             //u1fxx
+    kRangeGreek              //u1fxx
   },
   { //table for 2x--
     kRangeSetLatin,          //u20xx
@@ -288,7 +288,7 @@ static const PRUint8 gUnicodeSubrangeTable[NUM_OF_SUBTABLES][SUBTABLE_SIZE] =
     kRangeUnassigned,        //u2cxx
     kRangeUnassigned,        //u2dxx
     kRangeSetCJK,            //u2exx
-    kRangeSetCJK,            //u2fxx
+    kRangeSetCJK             //u2fxx
   },
   {  //table for ax--
     kRangeYi,                //ua0xx
@@ -306,7 +306,7 @@ static const PRUint8 gUnicodeSubrangeTable[NUM_OF_SUBTABLES][SUBTABLE_SIZE] =
     kRangeKorean,            //uacxx
     kRangeKorean,            //uadxx
     kRangeKorean,            //uaexx
-    kRangeKorean,            //uafxx
+    kRangeKorean             //uafxx
   },
   {  //table for dx--
     kRangeKorean,            //ud0xx
@@ -324,7 +324,7 @@ static const PRUint8 gUnicodeSubrangeTable[NUM_OF_SUBTABLES][SUBTABLE_SIZE] =
     kRangeSurrogate,         //udcxx
     kRangeSurrogate,         //uddxx
     kRangeSurrogate,         //udexx
-    kRangeSurrogate,         //udfxx
+    kRangeSurrogate          //udfxx
   },
   { // table for fx--
     kRangePrivate,           //uf0xx 
@@ -341,11 +341,8 @@ static const PRUint8 gUnicodeSubrangeTable[NUM_OF_SUBTABLES][SUBTABLE_SIZE] =
     kRangeArabic,            //ufbxx, includes alphabic presentation form
     kRangeArabic,            //ufcxx
     kRangeArabic,            //ufdxx
-    kRangeArabic,            //ufexx, includes Combining half marks, 
-                             //                CJK compatibility forms, 
-                             //                CJK compatibility forms, 
-                             //                small form variants
-    kRangeTableBase+8,       //uffxx, halfwidth and fullwidth forms, includes Specials
+    kRangeTableBase+8,       //ufexx
+    kRangeTableBase+9        //uffxx, halfwidth and fullwidth forms, includes Specials
   },
   { //table for 0x0500 - 0x05ff
     kRangeCyrillic,          //u050x
@@ -363,7 +360,25 @@ static const PRUint8 gUnicodeSubrangeTable[NUM_OF_SUBTABLES][SUBTABLE_SIZE] =
     kRangeHebrew,            //u05cx
     kRangeHebrew,            //u05dx
     kRangeHebrew,            //u05ex
-    kRangeHebrew,            //u05fx
+    kRangeHebrew             //u05fx
+  },
+  { //table for 0xfe00 - 0xfeff
+    kRangeSetCJK,            //ufe0x
+    kRangeSetCJK,            //ufe1x
+    kRangeSetCJK,            //ufe2x
+    kRangeSetCJK,            //ufe3x
+    kRangeSetCJK,            //ufe4x
+    kRangeSetCJK,            //ufe5x
+    kRangeSetCJK,            //ufe6x
+    kRangeArabic,            //ufe7x
+    kRangeArabic,            //ufe8x
+    kRangeArabic,            //ufe9x
+    kRangeArabic,            //ufeax
+    kRangeArabic,            //ufebx
+    kRangeArabic,            //ufecx
+    kRangeArabic,            //ufedx
+    kRangeArabic,            //ufeex
+    kRangeArabic             //ufefx
   },
   { //table for 0xff00 - 0xffff
     kRangeSetCJK,            //uff0x, fullwidth latin
@@ -425,7 +440,7 @@ static const PRUint8 gUnicodeTertiaryRangeTable[TERTIARY_TABLE_SIZE] =
     kRangeCanadian,          //u150x  place holder(resolved in the 2ndary tab.)
     kRangeCanadian,          //u158x  place holder(resolved in the 2ndary tab.)
     kRangeCanadian,          //u160x  
-    kRangeOghamRunic,        //u168x  this contains two scripts, Ogham & Runic
+    kRangeOghamRunic         //u168x  this contains two scripts, Ogham & Runic
 };
 
 // A two level index is almost enough for locating a range, with the 
@@ -436,18 +451,31 @@ static const PRUint8 gUnicodeTertiaryRangeTable[TERTIARY_TABLE_SIZE] =
 // there is such a need.
 // For Indic, Southeast Asian scripts and some other scripts between
 // U+0700 and U+16FF, it's extended to the third level.
-PRUint32 FindCharUnicodeRange(PRUnichar ch)
+PRUint32 FindCharUnicodeRange(PRUint32 ch)
 {
   PRUint32 range;
+  
+  // aggregate ranges for non-BMP codepoints
+  if (ch > 0xFFFF) {
+    PRUint32 p = (ch >> 16);
+    if (p == 1) {
+        return kRangeSMP;
+    } else if (p == 2) {
+        return kRangeSetCJK;
+    }
+    return kRangeHigherPlanes;
+  }
 
-  //search the first table
+  // lookup explicit range for BMP codepoints
+  // first general range
   range = gUnicodeSubrangeTable[0][ch >> 12];
   
+  // if general range is good enough, return that
   if (range < kRangeTableBase)
     // we try to get a specific range 
     return range;
 
-  // otherwise, we have one more table to look at
+  // otherwise, use subrange tables
   range = gUnicodeSubrangeTable[range - kRangeTableBase][(ch & 0x0f00) >> 8];
   if (range < kRangeTableBase)
     return range;
diff --git a/gfx/thebes/nsUnicodeRange.h b/gfx/thebes/nsUnicodeRange.h
index 46b424c50f0..8a681ec705c 100644
--- a/gfx/thebes/nsUnicodeRange.h
+++ b/gfx/thebes/nsUnicodeRange.h
@@ -108,6 +108,10 @@ const PRUint8   kRangeYi                   = 50;
 const PRUint8   kRangeCombiningDiacriticalMarks = 51;
 const PRUint8   kRangeSpecials             = 52;
 
+// aggregate ranges for non-BMP codepoints (u+2xxxx are all CJK)
+const PRUint8   kRangeSMP                  = 53;  // u+1xxxx
+const PRUint8   kRangeHigherPlanes         = 54;  // u+3xxxx and above
+
 const PRUint8   kRangeTableBase   = 128;    //values over 127 are reserved for internal use only
 const PRUint8   kRangeTertiaryTable  = 145; // leave room for 16 subtable 
                                             // indices (kRangeTableBase + 1 ..
@@ -115,5 +119,5 @@ const PRUint8   kRangeTertiaryTable  = 145; // leave room for 16 subtable
 
 
 
-PRUint32 FindCharUnicodeRange(PRUnichar ch);
+PRUint32 FindCharUnicodeRange(PRUint32 ch);
 nsIAtom* LangGroupFromUnicodeRange(PRUint8 unicodeRange);
diff --git a/hal/Hal.cpp b/hal/Hal.cpp
index 480e3b3678a..da187f28a4b 100644
--- a/hal/Hal.cpp
+++ b/hal/Hal.cpp
@@ -184,19 +184,36 @@ public:
     if (mObservers->Length() == 0) {
       DisableNotifications();
 
+      OnNotificationsDisabled();
+
       delete mObservers;
       mObservers = 0;
-
-      mHasValidCache = false;
     }
   }
 
+  void BroadcastInformation(const InfoType& aInfo) {
+    MOZ_ASSERT(mObservers);
+    mObservers->Broadcast(aInfo);
+  }
+
+protected:
+  virtual void EnableNotifications() = 0;
+  virtual void DisableNotifications() = 0;
+  virtual void OnNotificationsDisabled() {}
+
+private:
+  mozilla::ObserverList<InfoType>* mObservers;
+};
+
+template <class InfoType>
+class CachingObserversManager : public ObserversManager<InfoType>
+{
+public:
   InfoType GetCurrentInformation() {
     if (mHasValidCache) {
       return mInfo;
     }
 
-    mHasValidCache = true;
     GetCurrentInformationInternal(&mInfo);
     return mInfo;
   }
@@ -207,22 +224,22 @@ public:
   }
 
   void BroadcastCachedInformation() {
-    MOZ_ASSERT(mObservers);
-    mObservers->Broadcast(mInfo);
+    this->BroadcastInformation(mInfo);
   }
 
 protected:
-  virtual void EnableNotifications() = 0;
-  virtual void DisableNotifications() = 0;
   virtual void GetCurrentInformationInternal(InfoType*) = 0;
 
+  virtual void OnNotificationsDisabled() {
+    mHasValidCache = false;
+  }
+
 private:
-  mozilla::ObserverList<InfoType>* mObservers;
   InfoType                mInfo;
   bool                    mHasValidCache;
 };
 
-class BatteryObserversManager : public ObserversManager<BatteryInformation>
+class BatteryObserversManager : public CachingObserversManager<BatteryInformation>
 {
 protected:
   void EnableNotifications() {
@@ -240,7 +257,7 @@ protected:
 
 static BatteryObserversManager sBatteryObservers;
 
-class NetworkObserversManager : public ObserversManager<NetworkInformation>
+class NetworkObserversManager : public CachingObserversManager<NetworkInformation>
 {
 protected:
   void EnableNotifications() {
@@ -258,6 +275,20 @@ protected:
 
 static NetworkObserversManager sNetworkObservers;
 
+class WakeLockObserversManager : public ObserversManager<WakeLockInformation>
+{
+protected:
+  void EnableNotifications() {
+    PROXY_IF_SANDBOXED(EnableWakeLockNotifications());
+  }
+
+  void DisableNotifications() {
+    PROXY_IF_SANDBOXED(DisableWakeLockNotifications());
+  }
+};
+
+static WakeLockObserversManager sWakeLockObservers;
+
 void
 RegisterBatteryObserver(BatteryObserver* aObserver)
 {
@@ -435,5 +466,42 @@ void PowerOff()
   PROXY_IF_SANDBOXED(PowerOff());
 }
 
+void
+RegisterWakeLockObserver(WakeLockObserver* aObserver)
+{
+  AssertMainThread();
+  sWakeLockObservers.AddObserver(aObserver);
+}
+
+void
+UnregisterWakeLockObserver(WakeLockObserver* aObserver)
+{
+  AssertMainThread();
+  sWakeLockObservers.RemoveObserver(aObserver);
+}
+
+void
+ModifyWakeLock(const nsAString &aTopic,
+               hal::WakeLockControl aLockAdjust,
+               hal::WakeLockControl aHiddenAdjust)
+{
+  AssertMainThread();
+  PROXY_IF_SANDBOXED(ModifyWakeLock(aTopic, aLockAdjust, aHiddenAdjust));
+}
+
+void
+GetWakeLockInfo(const nsAString &aTopic, WakeLockInformation *aWakeLockInfo)
+{
+  AssertMainThread();
+  PROXY_IF_SANDBOXED(GetWakeLockInfo(aTopic, aWakeLockInfo));
+}
+
+void
+NotifyWakeLockChange(const WakeLockInformation& aInfo)
+{
+  AssertMainThread();
+  sWakeLockObservers.BroadcastInformation(aInfo);
+}
+
 } // namespace hal
 } // namespace mozilla
diff --git a/hal/Hal.h b/hal/Hal.h
index d4ab25ac140..15072f464f1 100644
--- a/hal/Hal.h
+++ b/hal/Hal.h
@@ -14,6 +14,7 @@
 #include "prlog.h"
 #include "mozilla/dom/battery/Types.h"
 #include "mozilla/dom/network/Types.h"
+#include "mozilla/dom/power/Types.h"
 #include "mozilla/hal_sandbox/PHal.h"
 
 /*
@@ -240,6 +241,55 @@ void Reboot();
  */
 void PowerOff();
 
+/**
+ * Enable wake lock notifications from the backend.
+ *
+ * This method is only used by WakeLockObserversManager.
+ */
+void EnableWakeLockNotifications();
+
+/**
+ * Disable wake lock notifications from the backend.
+ *
+ * This method is only used by WakeLockObserversManager.
+ */
+void DisableWakeLockNotifications();
+
+/**
+ * Inform the wake lock backend there is a new wake lock observer.
+ * @param aWakeLockObserver The observer that should be added.
+ */
+void RegisterWakeLockObserver(WakeLockObserver* aObserver);
+
+/**
+ * Inform the wake lock backend a wake lock observer unregistered.
+ * @param aWakeLockObserver The observer that should be removed.
+ */
+void UnregisterWakeLockObserver(WakeLockObserver* aObserver);
+
+/**
+ * Adjust the internal wake lock counts.
+ * @param aTopic        lock topic
+ * @param aLockAdjust   to increase or decrease active locks
+ * @param aHiddenAdjust to increase or decrease hidden locks
+ */
+void ModifyWakeLock(const nsAString &aTopic,
+                    hal::WakeLockControl aLockAdjust,
+                    hal::WakeLockControl aHiddenAdjust);
+
+/**
+ * Query the wake lock numbers of aTopic.
+ * @param aTopic        lock topic
+ * @param aWakeLockInfo wake lock numbers
+ */
+void GetWakeLockInfo(const nsAString &aTopic, hal::WakeLockInformation *aWakeLockInfo);
+
+/**
+ * Notify of a change in the wake lock state.
+ * @param aWakeLockInfo The new wake lock information.
+ */
+void NotifyWakeLockChange(const hal::WakeLockInformation& aWakeLockInfo);
+
 } // namespace MOZ_HAL_NAMESPACE
 } // namespace mozilla
 
diff --git a/hal/HalTypes.h b/hal/HalTypes.h
index 5c3e8a60c99..39bc1f24d5b 100644
--- a/hal/HalTypes.h
+++ b/hal/HalTypes.h
@@ -36,9 +36,25 @@ enum FlashMode {
     eHalLightFlash_Timed = 1,     // timed flashing.  Use flashOnMS and flashOffMS for timing
     eHalLightFlash_Hardware = 2   // hardware assisted flashing
 };
+
 } // namespace hal
 } // namespace mozilla
 
+namespace mozilla {
+namespace hal {
+
+/**
+ * Used by ModifyWakeLock
+ */
+enum WakeLockControl {
+  WAKE_LOCK_REMOVE_ONE = -1,
+  WAKE_LOCK_NO_CHANGE  = 0,
+  WAKE_LOCK_ADD_ONE    = 1,
+};
+
+}
+}
+
 namespace IPC {
 
 /**
@@ -71,6 +87,16 @@ struct ParamTraits<mozilla::hal::FlashMode>
                           mozilla::hal::eHalLightFlash_Hardware>
 {};
 
+/**
+ * WakeLockControl serializer.
+ */
+template <>
+struct ParamTraits<mozilla::hal::WakeLockControl>
+  : public EnumSerializer<mozilla::hal::WakeLockControl,
+                          mozilla::hal::WAKE_LOCK_REMOVE_ONE,
+                          mozilla::hal::WAKE_LOCK_ADD_ONE>
+{};
+
 } // namespace IPC
 
 #endif // mozilla_hal_Types_h
diff --git a/hal/HalWakeLock.cpp b/hal/HalWakeLock.cpp
new file mode 100644
index 00000000000..9d415ce56bc
--- /dev/null
+++ b/hal/HalWakeLock.cpp
@@ -0,0 +1,125 @@
+/* -*- Mode: C++; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/Hal.h"
+#include "mozilla/HalWakeLock.h"
+#include "mozilla/ClearOnShutdown.h"
+#include "nsDataHashtable.h"
+#include "nsHashKeys.h"
+
+using namespace mozilla::hal;
+
+namespace mozilla {
+namespace hal {
+
+WakeLockState
+ComputeWakeLockState(int aNumLocks, int aNumHidden)
+{
+  if (aNumLocks == 0) {
+    return WAKE_LOCK_STATE_UNLOCKED;
+  } else if (aNumLocks == aNumHidden) {
+    return WAKE_LOCK_STATE_HIDDEN;
+  } else {
+    return WAKE_LOCK_STATE_VISIBLE;
+  }
+}
+
+} // hal
+} // mozilla
+
+namespace mozilla {
+namespace hal_impl {
+
+namespace {
+struct LockCount {
+  PRUint32 numLocks;
+  PRUint32 numHidden;
+};
+}
+
+static int sActiveChildren = 0;
+static nsAutoPtr<nsDataHashtable<nsStringHashKey, LockCount> > sLockTable;
+static bool sInitialized = false;
+
+static void
+Init()
+{
+  sLockTable = new nsDataHashtable<nsStringHashKey, LockCount>();
+  sLockTable->Init();
+  ClearOnShutdown(&sLockTable);
+  sInitialized = true;
+}
+
+void
+EnableWakeLockNotifications()
+{
+  sActiveChildren++;
+}
+
+void
+DisableWakeLockNotifications()
+{
+  sActiveChildren--;
+}
+
+void
+ModifyWakeLock(const nsAString &aTopic,
+               hal::WakeLockControl aLockAdjust,
+               hal::WakeLockControl aHiddenAdjust)
+{
+  if (!sInitialized) {
+    Init();
+  }
+
+  LockCount count;
+  count.numLocks = 0;
+  count.numHidden = 0;
+  sLockTable->Get(aTopic, &count);
+  MOZ_ASSERT(count.numLocks >= count.numHidden);
+  MOZ_ASSERT(aLockAdjust >= 0 || count.numLocks > 0);
+  MOZ_ASSERT(aHiddenAdjust >= 0 || count.numHidden > 0);
+
+  WakeLockState oldState = ComputeWakeLockState(count.numLocks, count.numHidden);
+
+  count.numLocks += aLockAdjust;
+  count.numHidden += aHiddenAdjust;
+  MOZ_ASSERT(count.numLocks >= count.numHidden);
+
+  if (count.numLocks) {
+    sLockTable->Put(aTopic, count);
+  } else {
+    sLockTable->Remove(aTopic);
+  }
+
+  WakeLockState newState = ComputeWakeLockState(count.numLocks, count.numHidden);
+
+  if (sActiveChildren && oldState != newState) {
+    WakeLockInformation info;
+    info.numLocks() = count.numLocks;
+    info.numHidden() = count.numHidden;
+    info.topic() = aTopic;
+    NotifyWakeLockChange(info);
+  }
+}
+
+void
+GetWakeLockInfo(const nsAString &aTopic, WakeLockInformation *aWakeLockInfo)
+{
+  if (!sInitialized) {
+    Init();
+  }
+
+  LockCount count;
+  count.numLocks = 0;
+  count.numHidden = 0;
+  sLockTable->Get(aTopic, &count);
+
+  aWakeLockInfo->numLocks() = count.numLocks;
+  aWakeLockInfo->numHidden() = count.numHidden;
+  aWakeLockInfo->topic() = aTopic;
+}
+
+} // hal_impl
+} // mozilla
diff --git a/hal/HalWakeLock.h b/hal/HalWakeLock.h
new file mode 100644
index 00000000000..0462f30cba4
--- /dev/null
+++ b/hal/HalWakeLock.h
@@ -0,0 +1,26 @@
+/* -*- Mode: C++; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef __HAL_WAKELOCK_H_
+#define __HAL_WAKELOCK_H_
+
+namespace mozilla {
+namespace hal {
+
+enum WakeLockState {
+  WAKE_LOCK_STATE_UNLOCKED,
+  WAKE_LOCK_STATE_HIDDEN,
+  WAKE_LOCK_STATE_VISIBLE
+};
+
+/**
+ * Return the wake lock state according to the numbers.
+ */
+WakeLockState ComputeWakeLockState(int aNumLocks, int aNumHidden);
+
+} // hal
+} // mozilla
+
+#endif /* __HAL_WAKELOCK_H_ */
diff --git a/hal/Makefile.in b/hal/Makefile.in
index 7592e0e14f6..8fde9d4d562 100644
--- a/hal/Makefile.in
+++ b/hal/Makefile.in
@@ -63,12 +63,14 @@ EXPORTS_mozilla = \
   HalSandbox.h \
   HalSensor.h \
   HalTypes.h \
+  HalWakeLock.h \
   $(NULL)
 
 CPPSRCS = \
   Hal.cpp \
   SandboxHal.cpp \
   WindowIdentifier.cpp \
+  HalWakeLock.cpp \
   $(NULL)
 
 ifeq (android,$(MOZ_WIDGET_TOOLKIT))
@@ -113,4 +115,4 @@ include $(topsrcdir)/ipc/chromium/chromium-config.mk
 include $(topsrcdir)/config/rules.mk
 
 CFLAGS          += $(MOZ_DBUS_GLIB_CFLAGS)
-CXXFLAGS        += $(MOZ_DBUS_GLIB_CFLAGS) -DHAVE_PTHREADS
+CXXFLAGS        += $(MOZ_DBUS_GLIB_CFLAGS)
diff --git a/hal/gonk/GonkSensor.cpp b/hal/gonk/GonkSensor.cpp
index 41a1e93f618..842342e0d51 100644
--- a/hal/gonk/GonkSensor.cpp
+++ b/hal/gonk/GonkSensor.cpp
@@ -11,10 +11,13 @@
 #include "hardware/sensors.h"
 #include "mozilla/Util.h"
 #include "SensorDevice.h"
+#include "nsThreadUtils.h"
 
 using namespace mozilla::hal;
 using namespace android;
 
+namespace mozilla {
+
 static SensorType
 HardwareSensorToHalSensor(int type)
 {     
@@ -63,19 +66,19 @@ SensorseventToSensorData(const sensors_event_t& data, SensorData* aSensorData)
 static void
 onSensorChanged(const sensors_event_t& data, SensorData* aSensorData)
 {
-  mozilla::DebugOnly<bool> convertedData = SensorseventToSensorData(data, aSensorData);
+  DebugOnly<bool> convertedData = SensorseventToSensorData(data, aSensorData);
   MOZ_ASSERT(convertedData);
   NotifySensorChange(*aSensorData);
 }
 
-namespace mozilla {
 namespace hal_impl {
 
 static pthread_t sThread;
-static bool sInitialized = false;
-static bool sContinue = false;
-static int sActivatedSensors = 0;
+static bool sInitialized;
+static bool sContinue;
+static int sActivatedSensors;
 static SensorData sSensordata[NUM_SENSOR_TYPE];
+static nsCOMPtr<nsIThread> sSwitchThread;
 
 static void*
 UpdateSensorData(void* /*unused*/)
@@ -100,9 +103,10 @@ UpdateSensorData(void* /*unused*/)
 }
 
 static void 
-InitialResources()
+InitializeResources()
 {
   pthread_create(&sThread, NULL, &UpdateSensorData, NULL);
+  NS_NewThread(getter_AddRefs(sSwitchThread));
   sInitialized = true;
   sContinue = true;
 }
@@ -112,9 +116,30 @@ ReleaseResources()
 {
   sContinue = false;
   pthread_join(sThread, NULL);
+  sSwitchThread->Shutdown();
   sInitialized = false;
 }
 
+// This class is used as a runnable on the sSwitchThread
+class SensorInfo {
+  public:
+    NS_INLINE_DECL_REFCOUNTING(SensorInfo)
+
+    SensorInfo(bool aActivate, sensor_t aSensor, pthread_t aThreadId) :
+               activate(aActivate), sensor(aSensor), threadId(aThreadId) { }
+
+    void Switch() {
+     SensorDevice& device = SensorDevice::getInstance();
+     device.activate((void*)threadId, sensor.handle, activate);
+    }
+
+  protected:
+    SensorInfo() { };
+    bool      activate;
+    sensor_t  sensor;
+    pthread_t threadId;
+};
+
 static void
 SensorSwitch(SensorType aSensor, bool activate)
 {
@@ -122,10 +147,12 @@ SensorSwitch(SensorType aSensor, bool activate)
   const sensor_t* sensors = NULL;
   SensorDevice& device = SensorDevice::getInstance();
   size_t size = device.getSensorList(&sensors);
-
-  for (size_t i=0; i<size; i++) {
+  for (size_t i = 0; i < size; i++) {
     if (sensors[i].type == type) {
-      device.activate((void*)pthread_self(), sensors[i].handle, activate);
+      // Post an event to the activation thread
+      nsCOMPtr<nsIRunnable> event = NS_NewRunnableMethod(new SensorInfo(activate, sensors[i], pthread_self()),
+                                                         &SensorInfo::Switch);
+      sSwitchThread->Dispatch(event, NS_DISPATCH_NORMAL);
       break;
     }
   }
@@ -135,7 +162,7 @@ void
 EnableSensorNotifications(SensorType aSensor) 
 {
   if (!sInitialized) {
-    InitialResources();
+    InitializeResources();
   }
   
   SensorSwitch(aSensor, true);
diff --git a/hal/sandbox/PHal.ipdl b/hal/sandbox/PHal.ipdl
index 1ea1baa8bab..cdfd51397a1 100644
--- a/hal/sandbox/PHal.ipdl
+++ b/hal/sandbox/PHal.ipdl
@@ -48,6 +48,7 @@ using mozilla::hal::FlashMode;
 using mozilla::hal::LightType;
 using mozilla::hal::LightMode;
 using mozilla::hal::SensorType;
+using mozilla::hal::WakeLockControl;
 
 namespace mozilla {
 
@@ -81,6 +82,14 @@ namespace hal {
   };
 }
 
+namespace hal {
+  struct WakeLockInformation {
+    uint32_t numLocks;
+    uint32_t numHidden;
+    nsString topic;
+  };
+}
+
 namespace hal_sandbox {
 
 sync protocol PHal {
@@ -89,6 +98,7 @@ sync protocol PHal {
 child:
     NotifyBatteryChange(BatteryInformation aBatteryInfo);
     NotifyNetworkChange(NetworkInformation aNetworkInfo);
+    NotifyWakeLockChange(WakeLockInformation aWakeLockInfo);
 
 parent:
     Vibrate(uint32[] pattern, uint64[] id, PBrowser browser);
@@ -121,6 +131,12 @@ parent:
     Reboot();
     PowerOff();
 
+    ModifyWakeLock(nsString aTopic, WakeLockControl aLockAdjust, WakeLockControl aHiddenAdjust);
+    EnableWakeLockNotifications();
+    DisableWakeLockNotifications();
+    sync GetWakeLockInfo(nsString aTopic)
+      returns (WakeLockInformation aWakeLockInfo);
+
 child:
     NotifySensorChange(SensorData aSensorData);
 
diff --git a/hal/sandbox/SandboxHal.cpp b/hal/sandbox/SandboxHal.cpp
index 92a7d9c0a69..0f190f5b062 100644
--- a/hal/sandbox/SandboxHal.cpp
+++ b/hal/sandbox/SandboxHal.cpp
@@ -169,10 +169,35 @@ DisableSensorNotifications(SensorType aSensor) {
   Hal()->SendDisableSensorNotifications(aSensor);
 }
 
+void
+EnableWakeLockNotifications()
+{
+  Hal()->SendEnableWakeLockNotifications();
+}
+
+void
+DisableWakeLockNotifications()
+{
+  Hal()->SendDisableWakeLockNotifications();
+}
+
+void
+ModifyWakeLock(const nsAString &aTopic, WakeLockControl aLockAdjust, WakeLockControl aHiddenAdjust)
+{
+  Hal()->SendModifyWakeLock(nsString(aTopic), aLockAdjust, aHiddenAdjust);
+}
+
+void
+GetWakeLockInfo(const nsAString &aTopic, WakeLockInformation *aWakeLockInfo)
+{
+  Hal()->SendGetWakeLockInfo(nsString(aTopic), aWakeLockInfo);
+}
+
 class HalParent : public PHalParent
                 , public BatteryObserver
                 , public NetworkObserver
                 , public ISensorObserver
+                , public WakeLockObserver
 {
 public:
   NS_OVERRIDE virtual bool
@@ -343,6 +368,41 @@ public:
   void Notify(const SensorData& aSensorData) {
     unused << SendNotifySensorChange(aSensorData);
   }
+
+  NS_OVERRIDE virtual bool
+  RecvModifyWakeLock(const nsString &aTopic,
+                     const WakeLockControl &aLockAdjust,
+                     const WakeLockControl &aHiddenAdjust)
+  {
+    hal::ModifyWakeLock(aTopic, aLockAdjust, aHiddenAdjust);
+    return true;
+  }
+
+  NS_OVERRIDE virtual bool
+  RecvEnableWakeLockNotifications()
+  {
+    hal::RegisterWakeLockObserver(this);
+    return true;
+  }
+   
+  NS_OVERRIDE virtual bool
+  RecvDisableWakeLockNotifications()
+  {
+    hal::UnregisterWakeLockObserver(this);
+    return true;
+  }
+
+  NS_OVERRIDE virtual bool
+  RecvGetWakeLockInfo(const nsString &aTopic, WakeLockInformation *aWakeLockInfo)
+  {
+    hal::GetWakeLockInfo(aTopic, aWakeLockInfo);
+    return true;
+  }
+  
+  void Notify(const WakeLockInformation& aWakeLockInfo)
+  {
+    unused << SendNotifyWakeLockChange(aWakeLockInfo);
+  }
 };
 
 class HalChild : public PHalChild {
@@ -361,6 +421,12 @@ public:
     hal::NotifyNetworkChange(aNetworkInfo);
     return true;
   }
+
+  NS_OVERRIDE virtual bool
+  RecvNotifyWakeLockChange(const WakeLockInformation& aWakeLockInfo) {
+    hal::NotifyWakeLockChange(aWakeLockInfo);
+    return true;
+  }
 };
 
 bool
diff --git a/image/src/RasterImage.cpp b/image/src/RasterImage.cpp
index 042e6b85e1e..6f778745580 100644
--- a/image/src/RasterImage.cpp
+++ b/image/src/RasterImage.cpp
@@ -2581,6 +2581,16 @@ RasterImage::Draw(gfxContext *aContext,
     mFrameDecodeFlags = DECODE_FLAGS_DEFAULT;
   }
 
+  // If this image is a candidate for discarding, reset its position in the
+  // discard tracker so we're less likely to discard it right away.
+  //
+  // (We don't normally draw unlocked images, so this conditition will usually
+  // be false.  But we will draw unlocked images if image locking is globally
+  // disabled via the content.image.allow_locking pref.)
+  if (DiscardingActive()) {
+    DiscardTracker::Reset(&mDiscardTrackerNode);
+  }
+
   // We use !mDecoded && mHasSourceData to mean discarded.
   if (!mDecoded && mHasSourceData) {
       mDrawStartTime = TimeStamp::Now();
diff --git a/image/test/reftest/reftest.list b/image/test/reftest/reftest.list
index f1d4e0e216c..976fce01033 100644
--- a/image/test/reftest/reftest.list
+++ b/image/test/reftest/reftest.list
@@ -1,5 +1,5 @@
 # Check for 24-bit color mode (test for bug 414720)
-== colordepth.html about:blank
+skip-if(Android) == colordepth.html about:blank
 
 # "PngSuite, the official set of PNG test images"
 # Images by Willem van Schaik
diff --git a/ipc/chromium/src/base/histogram.cc b/ipc/chromium/src/base/histogram.cc
index 56b9a2cf08b..a6d3579957c 100644
--- a/ipc/chromium/src/base/histogram.cc
+++ b/ipc/chromium/src/base/histogram.cc
@@ -916,6 +916,52 @@ BooleanHistogram::BooleanHistogram(const std::string& name)
     : LinearHistogram(name, 1, 2, 3) {
 }
 
+//------------------------------------------------------------------------------
+// FlagHistogram:
+//------------------------------------------------------------------------------
+
+Histogram *
+FlagHistogram::FactoryGet(const std::string &name, Flags flags)
+{
+  Histogram *h(nsnull);
+
+  if (!StatisticsRecorder::FindHistogram(name, &h)) {
+    // To avoid racy destruction at shutdown, the following will be leaked.
+    FlagHistogram *fh = new FlagHistogram(name);
+    fh->InitializeBucketRange();
+    fh->SetFlags(flags);
+    size_t zero_index = fh->BucketIndex(0);
+    fh->Histogram::Accumulate(1, 1, zero_index);
+    h = StatisticsRecorder::RegisterOrDeleteDuplicate(fh);
+  }
+
+  return h;
+}
+
+FlagHistogram::FlagHistogram(const std::string &name)
+  : BooleanHistogram(name), mSwitched(false) {
+}
+
+Histogram::ClassType
+FlagHistogram::histogram_type() const
+{
+  return FLAG_HISTOGRAM;
+}
+
+void
+FlagHistogram::Accumulate(Sample value, Count count, size_t index)
+{
+  if (mSwitched) {
+    return;
+  }
+
+  mSwitched = true;
+  DCHECK_EQ(value, 1);
+  Histogram::Accumulate(value, 1, index);
+  size_t zero_index = BucketIndex(0);
+  Histogram::Accumulate(1, -1, zero_index);
+}
+
 //------------------------------------------------------------------------------
 // CustomHistogram:
 //------------------------------------------------------------------------------
diff --git a/ipc/chromium/src/base/histogram.h b/ipc/chromium/src/base/histogram.h
index e80f86a174f..1995ddbbaf3 100644
--- a/ipc/chromium/src/base/histogram.h
+++ b/ipc/chromium/src/base/histogram.h
@@ -276,6 +276,7 @@ class Histogram {
     HISTOGRAM,
     LINEAR_HISTOGRAM,
     BOOLEAN_HISTOGRAM,
+    FLAG_HISTOGRAM,
     CUSTOM_HISTOGRAM,
     NOT_VALID_IN_RENDERER
   };
@@ -642,7 +643,7 @@ class BooleanHistogram : public LinearHistogram {
 
   virtual void AddBoolean(bool value);
 
- private:
+ protected:
   explicit BooleanHistogram(const std::string& name);
 
   DISALLOW_COPY_AND_ASSIGN(BooleanHistogram);
@@ -650,6 +651,25 @@ class BooleanHistogram : public LinearHistogram {
 
 //------------------------------------------------------------------------------
 
+// FlagHistogram is like boolean histogram, but only allows a single off/on value.
+class FlagHistogram : public BooleanHistogram
+{
+public:
+  static Histogram *FactoryGet(const std::string &name, Flags flags);
+
+  virtual ClassType histogram_type() const;
+
+  virtual void Accumulate(Sample value, Count count, size_t index);
+
+private:
+  explicit FlagHistogram(const std::string &name);
+  bool mSwitched;
+
+  DISALLOW_COPY_AND_ASSIGN(FlagHistogram);
+};
+
+//------------------------------------------------------------------------------
+
 // CustomHistogram is a histogram for a set of custom integers.
 class CustomHistogram : public Histogram {
  public:
diff --git a/ipc/testshell/XPCShellEnvironment.cpp b/ipc/testshell/XPCShellEnvironment.cpp
index 4a5f56e7988..c985744f7d8 100644
--- a/ipc/testshell/XPCShellEnvironment.cpp
+++ b/ipc/testshell/XPCShellEnvironment.cpp
@@ -67,6 +67,7 @@
 #include "nsIXPCScriptable.h"
 
 #include "nsJSUtils.h"
+#include "nsJSPrincipals.h"
 #include "nsThreadUtils.h"
 #include "nsXULAppAPI.h"
 
@@ -1058,7 +1059,7 @@ XPCShellEnvironment::~XPCShellEnvironment()
         mCxStack = nsnull;
 
         if (mJSPrincipals) {
-            JSPRINCIPALS_DROP(mCx, mJSPrincipals);
+            JS_DropPrincipals(JS_GetRuntime(mCx), mJSPrincipals);
         }
 
         JSRuntime* rt = gOldContextCallback ? JS_GetRuntime(mCx) : NULL;
@@ -1140,10 +1141,8 @@ XPCShellEnvironment::Init()
             fprintf(stderr, "+++ Failed to obtain SystemPrincipal from ScriptSecurityManager service.\n");
         } else {
             // fetch the JS principals and stick in a global
-            rv = principal->GetJSPrincipals(cx, &mJSPrincipals);
-            if (NS_FAILED(rv)) {
-                fprintf(stderr, "+++ Failed to obtain JS principals from SystemPrincipal.\n");
-            }
+            mJSPrincipals = nsJSPrincipals::get(principal);
+            JS_HoldPrincipals(mJSPrincipals);
             secman->SetSystemPrincipal(principal);
         }
     } else {
diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index c79f8b9454e..513db5b5e26 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -1,4 +1,7 @@
-/* ***** BEGIN LICENSE BLOCK *****
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sw=4 et tw=99 ft=cpp:
+ *
+ * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
@@ -61,31 +64,13 @@ struct TypeInferenceSizes
     size_t temporary;
 };
 
-typedef void* (* GetNameCallback)(JSRuntime *rt, JSCompartment *c);
-typedef void (* DestroyNameCallback)(void *string);
-
 struct CompartmentStats
 {
-    CompartmentStats()
-    {
+    CompartmentStats() {
         memset(this, 0, sizeof(*this));
     }
 
-    void init(void *name_, DestroyNameCallback destroyName)
-    {
-        name = name_;
-        destroyNameCb = destroyName;
-    }
-
-    ~CompartmentStats()
-    {
-        destroyNameCb(name);
-    }
-
-    // Pointer to an nsCString, which we can't use here.
-    void *name;
-    DestroyNameCallback destroyNameCb;
-
+    void   *extra;
     size_t gcHeapArenaHeaders;
     size_t gcHeapArenaPadding;
     size_t gcHeapArenaUnused;
@@ -119,8 +104,7 @@ struct CompartmentStats
 
 struct RuntimeStats
 {
-    RuntimeStats(JSMallocSizeOfFun mallocSizeOf, GetNameCallback getNameCb,
-                 DestroyNameCallback destroyNameCb)
+    RuntimeStats(JSMallocSizeOfFun mallocSizeOf)
       : runtimeObject(0)
       , runtimeAtomsTable(0)
       , runtimeContexts(0)
@@ -149,8 +133,6 @@ struct RuntimeStats
       , compartmentStatsVector()
       , currCompartmentStats(NULL)
       , mallocSizeOf(mallocSizeOf)
-      , getNameCb(getNameCb)
-      , destroyNameCb(destroyNameCb)
     {}
 
     size_t runtimeObject;
@@ -183,8 +165,8 @@ struct RuntimeStats
     CompartmentStats *currCompartmentStats;
 
     JSMallocSizeOfFun mallocSizeOf;
-    GetNameCallback getNameCb;
-    DestroyNameCallback destroyNameCb;
+
+    virtual void initExtraCompartmentStats(JSCompartment *c, CompartmentStats *cstats) = 0;
 };
 
 #ifdef JS_THREADSAFE
diff --git a/js/src/MemoryMetrics.cpp b/js/src/MemoryMetrics.cpp
index bd96b7f5dcc..39b4e011163 100644
--- a/js/src/MemoryMetrics.cpp
+++ b/js/src/MemoryMetrics.cpp
@@ -63,7 +63,7 @@ StatsCompartmentCallback(JSRuntime *rt, void *data, JSCompartment *compartment)
     // CollectRuntimeStats reserves enough space.
     MOZ_ALWAYS_TRUE(rtStats->compartmentStatsVector.growBy(1));
     CompartmentStats &cStats = rtStats->compartmentStatsVector.back();
-    cStats.init(rtStats->getNameCb(rt, compartment), rtStats->destroyNameCb);
+    rtStats->initExtraCompartmentStats(compartment, &cStats);
     rtStats->currCompartmentStats = &cStats;
 
     // Get the compartment-level numbers.
diff --git a/js/src/aclocal.m4 b/js/src/aclocal.m4
index cd5b6727cfa..d530a61e3a3 100644
--- a/js/src/aclocal.m4
+++ b/js/src/aclocal.m4
@@ -15,5 +15,6 @@ builtin(include, build/autoconf/lto.m4)dnl
 builtin(include, build/autoconf/gcc-pr49911.m4)dnl
 builtin(include, build/autoconf/frameptr.m4)dnl
 builtin(include, build/autoconf/compiler-opts.m4)dnl
+builtin(include, build/autoconf/expandlibs.m4)dnl
 
 MOZ_PROG_CHECKMSYS()
diff --git a/js/src/build/autoconf/check_debug_ranges.py b/js/src/build/autoconf/check_debug_ranges.py
new file mode 100644
index 00000000000..e2f0bd0f77f
--- /dev/null
+++ b/js/src/build/autoconf/check_debug_ranges.py
@@ -0,0 +1,93 @@
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org
+#
+# The Initial Developer of the Original Code is
+# the Mozilla Foundation
+# Portions created by the Initial Developer are Copyright (C) 2011
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+# Mike Hommey <mh@glandium.org>
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+# This script returns the number of items for the DW_AT_ranges corresponding
+# to a given compilation unit. This is used as a helper to find a bug in some
+# versions of GNU ld.
+
+import subprocess
+import sys
+import re
+
+def get_range_for(compilation_unit, debug_info):
+    '''Returns the range offset for a given compilation unit
+       in a given debug_info.'''
+    name = ranges = ''
+    search_cu = False
+    for nfo in debug_info.splitlines():
+        if 'DW_TAG_compile_unit' in nfo:
+            search_cu = True
+        elif 'DW_TAG_' in nfo or not nfo.strip():
+            if name == compilation_unit:
+                return int(ranges, 16)
+            name = ranges = ''
+            search_cu = False
+        if search_cu:
+            if 'DW_AT_name' in nfo:
+                name = nfo.rsplit(None, 1)[1]
+            elif 'DW_AT_ranges' in nfo:
+                ranges = nfo.rsplit(None, 1)[1]
+    return None
+
+def get_range_length(range, debug_ranges):
+    '''Returns the number of items in the range starting at the
+       given offset.'''
+    length = 0
+    for line in debug_ranges.splitlines():
+        m = re.match('\s*([0-9a-fA-F]+)\s+([0-9a-fA-F]+)\s+([0-9a-fA-F]+)', line)
+        if m and int(m.group(1), 16) == range:
+            length += 1
+    return length
+
+def main(bin, compilation_unit):
+    p = subprocess.Popen(['objdump', '-W', bin], stdout = subprocess.PIPE, stderr = subprocess.PIPE)
+    (out, err) = p.communicate()
+    sections = re.split('\n(Contents of the|The section) ', out)
+    debug_info = [s for s in sections if s.startswith('.debug_info')]
+    debug_ranges = [s for s in sections if s.startswith('.debug_ranges')]
+    if not debug_ranges or not debug_info:
+        return 0
+
+    range = get_range_for(compilation_unit, debug_info[0])
+    if range is not None:
+        return get_range_length(range, debug_ranges[0])
+
+    return -1
+
+
+if __name__ == '__main__':
+    print main(*sys.argv[1:])
diff --git a/js/src/build/autoconf/compiler-opts.m4 b/js/src/build/autoconf/compiler-opts.m4
index 081d8e4f5d8..e4f75b0eee1 100644
--- a/js/src/build/autoconf/compiler-opts.m4
+++ b/js/src/build/autoconf/compiler-opts.m4
@@ -9,5 +9,76 @@ if test "$CLANG_CXX"; then
     ## from C.
     _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-unknown-warning-option -Wno-return-type-c-linkage"
 fi
-])
 
+if test "$GNU_CC"; then
+    CFLAGS="$CFLAGS -ffunction-sections -fdata-sections"
+    CXXFLAGS="$CXXFLAGS -ffunction-sections -fdata-sections"
+fi
+
+dnl ========================================================
+dnl = Identical Code Folding
+dnl ========================================================
+
+MOZ_ARG_DISABLE_BOOL(icf,
+[  --disable-icf          Disable Identical Code Folding],
+    MOZ_DISABLE_ICF=1,
+    MOZ_DISABLE_ICF= )
+
+if test "$GNU_CC" -a "$GCC_USE_GNU_LD" -a -z "$MOZ_DISABLE_ICF"; then
+    AC_CACHE_CHECK([whether the linker supports Identical Code Folding],
+        LD_SUPPORTS_ICF,
+        [echo 'int foo() {return 42;}' \
+              'int bar() {return 42;}' \
+              'int main() {return foo() - bar();}' > conftest.${ac_ext}
+        # If the linker supports ICF, foo and bar symbols will have
+        # the same address
+        if AC_TRY_COMMAND([${CC-cc} -o conftest${ac_exeext} $LDFLAGS -Wl,--icf=safe -ffunction-sections conftest.${ac_ext} $LIBS 1>&2]) &&
+           test -s conftest${ac_exeext} &&
+           objdump -t conftest${ac_exeext} | awk changequote(<<, >>)'{a[<<$>>6] = <<$>>1} END {if (a["foo"] && (a["foo"] != a["bar"])) { exit 1 }}'changequote([, ]); then
+            LD_SUPPORTS_ICF=yes
+        else
+            LD_SUPPORTS_ICF=no
+        fi
+        rm -rf conftest*])
+    if test "$LD_SUPPORTS_ICF" = yes; then
+        _SAVE_LDFLAGS="$LDFLAGS -Wl,--icf=safe"
+        LDFLAGS="$LDFLAGS -Wl,--icf=safe -Wl,--print-icf-sections"
+        AC_TRY_LINK([], [],
+                    [LD_PRINT_ICF_SECTIONS=-Wl,--print-icf-sections],
+                    [LD_PRINT_ICF_SECTIONS=])
+        AC_SUBST([LD_PRINT_ICF_SECTIONS])
+        LDFLAGS="$_SAVE_LDFLAGS"
+    fi
+fi
+
+dnl ========================================================
+dnl = Automatically remove dead symbols
+dnl ========================================================
+
+if test "$GNU_CC" -a "$GCC_USE_GNU_LD" -a -n "$MOZ_DEBUG_FLAGS"; then
+   dnl See bug 670659
+   AC_CACHE_CHECK([whether removing dead symbols breaks debugging],
+       GC_SECTIONS_BREAKS_DEBUG_RANGES,
+       [echo 'int foo() {return 42;}' \
+             'int bar() {return 1;}' \
+             'int main() {return foo();}' > conftest.${ac_ext}
+        if AC_TRY_COMMAND([${CC-cc} -o conftest.${ac_objext} $CFLAGS $MOZ_DEBUG_FLAGS -c conftest.${ac_ext} 1>&2]) &&
+           AC_TRY_COMMAND([${CC-cc} -o conftest${ac_exeext} $LDFLAGS $MOZ_DEBUG_FLAGS -Wl,--gc-sections conftest.${ac_objext} $LIBS 1>&2]) &&
+           test -s conftest${ac_exeext} -a -s conftest.${ac_objext}; then
+            if test "`$PYTHON "$_topsrcdir"/build/autoconf/check_debug_ranges.py conftest.${ac_objext} conftest.${ac_ext}`" = \
+                    "`$PYTHON "$_topsrcdir"/build/autoconf/check_debug_ranges.py conftest${ac_exeext} conftest.${ac_ext}`"; then
+                GC_SECTIONS_BREAKS_DEBUG_RANGES=no
+            else
+                GC_SECTIONS_BREAKS_DEBUG_RANGES=yes
+            fi
+        else
+             dnl We really don't expect to get here, but just in case
+             GC_SECTIONS_BREAKS_DEBUG_RANGES="no, but it's broken in some other way"
+        fi
+        rm -rf conftest*])
+    if test "$GC_SECTIONS_BREAKS_DEBUG_RANGES" = no; then
+        DSO_LDOPTS="$DSO_LDOPTS -Wl,--gc-sections"
+    fi
+fi
+
+])
diff --git a/js/src/build/autoconf/expandlibs.m4 b/js/src/build/autoconf/expandlibs.m4
new file mode 100644
index 00000000000..ef228abf708
--- /dev/null
+++ b/js/src/build/autoconf/expandlibs.m4
@@ -0,0 +1,56 @@
+AC_DEFUN([MOZ_EXPAND_LIBS],
+[
+dnl ========================================================
+dnl =
+dnl = Check what kind of list files are supported by the
+dnl = linker
+dnl =
+dnl ========================================================
+
+AC_CACHE_CHECK(what kind of list files are supported by the linker,
+    EXPAND_LIBS_LIST_STYLE,
+    [echo "int main() {return 0;}" > conftest.${ac_ext}
+     if AC_TRY_COMMAND(${CC-cc} -o conftest.${OBJ_SUFFIX} -c $CFLAGS $CPPFLAGS conftest.${ac_ext} 1>&5) && test -s conftest.${OBJ_SUFFIX}; then
+         echo "INPUT(conftest.${OBJ_SUFFIX})" > conftest.list
+         if AC_TRY_COMMAND(${CC-cc} -o conftest${ac_exeext} $LDFLAGS conftest.list $LIBS 1>&5) && test -s conftest${ac_exeext}; then
+             EXPAND_LIBS_LIST_STYLE=linkerscript
+         else
+             echo "conftest.${OBJ_SUFFIX}" > conftest.list
+             if AC_TRY_COMMAND(${CC-cc} -o conftest${ac_exeext} $LDFLAGS @conftest.list $LIBS 1>&5) && test -s conftest${ac_exeext}; then
+                 EXPAND_LIBS_LIST_STYLE=list
+             else
+                 EXPAND_LIBS_LIST_STYLE=none
+             fi
+         fi
+     else
+         dnl We really don't expect to get here, but just in case
+         AC_ERROR([couldn't compile a simple C file])
+     fi
+     rm -rf conftest*])
+
+LIBS_DESC_SUFFIX=desc
+AC_SUBST(LIBS_DESC_SUFFIX)
+AC_SUBST(EXPAND_LIBS_LIST_STYLE)
+
+if test "$GCC_USE_GNU_LD"; then
+    AC_CACHE_CHECK(what kind of ordering can be done with the linker,
+        EXPAND_LIBS_ORDER_STYLE,
+        [> conftest.order
+         _SAVE_LDFLAGS="$LDFLAGS"
+         LDFLAGS="${LDFLAGS} -Wl,--section-ordering-file,conftest.order"
+         AC_TRY_LINK([], [],
+             EXPAND_LIBS_ORDER_STYLE=section-ordering-file,
+             EXPAND_LIBS_ORDER_STYLE=)
+         LDFLAGS="$_SAVE_LDFLAGS"
+         if test -z "$EXPAND_LIBS_ORDER_STYLE"; then
+             if AC_TRY_COMMAND(${CC-cc} ${DSO_LDOPTS} ${LDFLAGS} -o ${DLL_PREFIX}conftest${DLL_SUFFIX} -Wl,--verbose 2> /dev/null | sed -n '/^===/,/^===/p' | grep '\.text'); then
+                 EXPAND_LIBS_ORDER_STYLE=linkerscript
+             else
+                 EXPAND_LIBS_ORDER_STYLE=none
+             fi
+             rm -f ${DLL_PREFIX}conftest${DLL_SUFFIX}
+         fi])
+fi
+AC_SUBST(EXPAND_LIBS_ORDER_STYLE)
+
+])
diff --git a/js/src/config/config.mk b/js/src/config/config.mk
index 21d37ea5bd1..a830bfe969b 100644
--- a/js/src/config/config.mk
+++ b/js/src/config/config.mk
@@ -789,8 +789,12 @@ EXPAND_LIBS_GEN = $(PYTHON) $(topsrcdir)/config/pythonpath.py -I$(DEPTH)/config
 EXPAND_AR = $(EXPAND_LIBS_EXEC) --extract -- $(AR)
 EXPAND_CC = $(EXPAND_LIBS_EXEC) --uselist -- $(CC)
 EXPAND_CCC = $(EXPAND_LIBS_EXEC) --uselist -- $(CCC)
-EXPAND_LD = $(EXPAND_LIBS_EXEC) --uselist $(if $(REORDER),--reorder $(REORDER))-- $(LD)
-EXPAND_MKSHLIB = $(EXPAND_LIBS_EXEC) --uselist $(if $(REORDER),--reorder $(REORDER))-- $(MKSHLIB)
+EXPAND_LD = $(EXPAND_LIBS_EXEC) --uselist -- $(LD)
+EXPAND_MKSHLIB_ARGS = --uselist
+ifdef SYMBOL_ORDER
+EXPAND_MKSHLIB_ARGS += --symbol-order $(SYMBOL_ORDER)
+endif
+EXPAND_MKSHLIB = $(EXPAND_LIBS_EXEC) $(EXPAND_MKSHLIB_ARGS) -- $(MKSHLIB)
 
 ifdef STDCXX_COMPAT
 ifneq ($(OS_ARCH),Darwin)
diff --git a/js/src/config/expandlibs_config.py.in b/js/src/config/expandlibs_config.py.in
index e204bb9e85e..32a48ac5fd4 100644
--- a/js/src/config/expandlibs_config.py.in
+++ b/js/src/config/expandlibs_config.py.in
@@ -54,3 +54,5 @@ DLL_SUFFIX = normalize_suffix("@DLL_SUFFIX@")
 IMPORT_LIB_SUFFIX = normalize_suffix("@IMPORT_LIB_SUFFIX@")
 LIBS_DESC_SUFFIX = normalize_suffix("@LIBS_DESC_SUFFIX@")
 EXPAND_LIBS_LIST_STYLE = "@EXPAND_LIBS_LIST_STYLE@"
+EXPAND_LIBS_ORDER_STYLE = "@EXPAND_LIBS_ORDER_STYLE@"
+LD_PRINT_ICF_SECTIONS = "@LD_PRINT_ICF_SECTIONS@"
diff --git a/js/src/config/expandlibs_exec.py b/js/src/config/expandlibs_exec.py
index b6671cfdef7..afc0fc8fd60 100644
--- a/js/src/config/expandlibs_exec.py
+++ b/js/src/config/expandlibs_exec.py
@@ -49,9 +49,9 @@ EXPAND_LIBS_LIST_STYLE variable: 'list' for MSVC style lists (@file.list)
 or 'linkerscript' for GNU ld linker scripts.
 See https://bugzilla.mozilla.org/show_bug.cgi?id=584474#c59 for more details.
 
-With the --reorder argument, followed by a file name, it will reorder the
-object files from the command line according to the order given in the file.
-Implies --extract.
+With the --symbol-order argument, followed by a file name, it will add the
+relevant linker options to change the order in which the linker puts the
+symbols appear in the resulting binary. Only works for ELF targets.
 '''
 from __future__ import with_statement
 import sys
@@ -62,6 +62,18 @@ from optparse import OptionParser
 import subprocess
 import tempfile
 import shutil
+import subprocess
+import re
+
+# The are the insert points for a GNU ld linker script, assuming a more
+# or less "standard" default linker script. This is not a dict because
+# order is important.
+SECTION_INSERT_BEFORE = [
+  ('.text', '.fini'),
+  ('.rodata', '.rodata1'),
+  ('.data.rel.ro', '.dynamic'),
+  ('.data', '.data1'),
+]
 
 class ExpandArgsMore(ExpandArgs):
     ''' Meant to be used as 'with ExpandArgsMore(args) as ...: '''
@@ -119,6 +131,7 @@ class ExpandArgsMore(ExpandArgs):
             content = ["%s\n" % obj for obj in objs]
             ref = "@" + tmp
         else:
+            os.close(fd)
             os.remove(tmp)
             return
         self.tmp.append(tmp)
@@ -129,21 +142,163 @@ class ExpandArgsMore(ExpandArgs):
         newlist = self[0:idx] + [ref] + [item for item in self[idx:] if item not in objs]
         self[0:] = newlist
 
-    def reorder(self, order_list):
-        '''Given a list of file names without OBJ_SUFFIX, rearrange self
-        so that the object file names it contains are ordered according to
-        that list.
-        '''
-        objs = [o for o in self if isObject(o)]
-        if not objs: return
-        idx = self.index(objs[0])
-        # Keep everything before the first object, then the ordered objects,
-        # then any other objects, then any non-objects after the first object
-        objnames = dict([(os.path.splitext(os.path.basename(o))[0], o) for o in objs])
-        self[0:] = self[0:idx] + [objnames[o] for o in order_list if o in objnames] + \
-                   [o for o in objs if os.path.splitext(os.path.basename(o))[0] not in order_list] + \
-                   [x for x in self[idx:] if not isObject(x)]
+    def _getFoldedSections(self):
+        '''Returns a dict about folded sections.
+        When section A and B are folded into section C, the dict contains:
+        { 'A': 'C',
+          'B': 'C',
+          'C': ['A', 'B'] }'''
+        if not conf.LD_PRINT_ICF_SECTIONS:
+            return {}
 
+        proc = subprocess.Popen(self + [conf.LD_PRINT_ICF_SECTIONS], stdout = subprocess.PIPE, stderr = subprocess.PIPE)
+        (stdout, stderr) = proc.communicate()
+        result = {}
+        # gold's --print-icf-sections output looks like the following:
+        # ld: ICF folding section '.section' in file 'file.o'into '.section' in file 'file.o'
+        # In terms of words, chances are this will change in the future,
+        # especially considering "into" is misplaced. Splitting on quotes
+        # seems safer.
+        for l in stderr.split('\n'):
+            quoted = l.split("'")
+            if len(quoted) > 5 and quoted[1] != quoted[5]:
+                result[quoted[1]] = quoted[5]
+                if quoted[5] in result:
+                    result[quoted[5]].append(quoted[1])
+                else:
+                    result[quoted[5]] = [quoted[1]]
+        return result
+
+    def _getOrderedSections(self, ordered_symbols):
+        '''Given an ordered list of symbols, returns the corresponding list
+        of sections following the order.'''
+        if not conf.EXPAND_LIBS_ORDER_STYLE in ['linkerscript', 'section-ordering-file']:
+            raise Exception('EXPAND_LIBS_ORDER_STYLE "%s" is not supported' % conf.EXPAND_LIBS_ORDER_STYLE)
+        finder = SectionFinder([arg for arg in self if isObject(arg) or os.path.splitext(arg)[1] == conf.LIB_SUFFIX])
+        folded = self._getFoldedSections()
+        sections = set()
+        ordered_sections = []
+        for symbol in ordered_symbols:
+            symbol_sections = finder.getSections(symbol)
+            all_symbol_sections = []
+            for section in symbol_sections:
+                if section in folded:
+                    if isinstance(folded[section], str):
+                        section = folded[section]
+                    all_symbol_sections.append(section)
+                    all_symbol_sections.extend(folded[section])
+                else:
+                    all_symbol_sections.append(section)
+            for section in all_symbol_sections:
+                if not section in sections:
+                    ordered_sections.append(section)
+                    sections.add(section)
+        return ordered_sections
+
+    def orderSymbols(self, order):
+        '''Given a file containing a list of symbols, adds the appropriate
+        argument to make the linker put the symbols in that order.'''
+        with open(order) as file:
+            sections = self._getOrderedSections([l.strip() for l in file.readlines() if l.strip()])
+        split_sections = {}
+        linked_sections = [s[0] for s in SECTION_INSERT_BEFORE]
+        for s in sections:
+            for linked_section in linked_sections:
+                if s.startswith(linked_section):
+                    if linked_section in split_sections:
+                        split_sections[linked_section].append(s)
+                    else:
+                        split_sections[linked_section] = [s]
+                    break
+        content = []
+        # Order is important
+        linked_sections = [s for s in linked_sections if s in split_sections]
+
+        if conf.EXPAND_LIBS_ORDER_STYLE == 'section-ordering-file':
+            option = '-Wl,--section-ordering-file,%s'
+            content = sections
+            for linked_section in linked_sections:
+                content.extend(split_sections[linked_section])
+                content.append('%s.*' % linked_section)
+                content.append(linked_section)
+
+        elif conf.EXPAND_LIBS_ORDER_STYLE == 'linkerscript':
+            option = '-Wl,-T,%s'
+            section_insert_before = dict(SECTION_INSERT_BEFORE)
+            for linked_section in linked_sections:
+                content.append('SECTIONS {')
+                content.append('  %s : {' % linked_section)
+                content.extend('    *(%s)' % s for s in split_sections[linked_section])
+                content.append('  }')
+                content.append('}')
+                content.append('INSERT BEFORE %s' % section_insert_before[linked_section])
+        else:
+            raise Exception('EXPAND_LIBS_ORDER_STYLE "%s" is not supported' % conf.EXPAND_LIBS_ORDER_STYLE)
+
+        fd, tmp = tempfile.mkstemp(dir=os.curdir)
+        f = os.fdopen(fd, "w")
+        f.write('\n'.join(content)+'\n')
+        f.close()
+        self.tmp.append(tmp)
+        self.append(option % tmp)
+
+class SectionFinder(object):
+    '''Instances of this class allow to map symbol names to sections in
+    object files.'''
+
+    def __init__(self, objs):
+        '''Creates an instance, given a list of object files.'''
+        if not conf.EXPAND_LIBS_ORDER_STYLE in ['linkerscript', 'section-ordering-file']:
+            raise Exception('EXPAND_LIBS_ORDER_STYLE "%s" is not supported' % conf.EXPAND_LIBS_ORDER_STYLE)
+        self.mapping = {}
+        for obj in objs:
+            if not isObject(obj) and os.path.splitext(obj)[1] != conf.LIB_SUFFIX:
+                raise Exception('%s is not an object nor a static library' % obj)
+            for symbol, section in SectionFinder._getSymbols(obj):
+                sym = SectionFinder._normalize(symbol)
+                if sym in self.mapping:
+                    if not section in self.mapping[sym]:
+                        self.mapping[sym].append(section)
+                else:
+                    self.mapping[sym] = [section]
+
+    def getSections(self, symbol):
+        '''Given a symbol, returns a list of sections containing it or the
+        corresponding thunks. When the given symbol is a thunk, returns the
+        list of sections containing its corresponding normal symbol and the
+        other thunks for that symbol.'''
+        sym = SectionFinder._normalize(symbol)
+        if sym in self.mapping:
+            return self.mapping[sym]
+        return []
+
+    @staticmethod
+    def _normalize(symbol):
+        '''For normal symbols, return the given symbol. For thunks, return
+        the corresponding normal symbol.'''
+        if re.match('^_ZThn[0-9]+_', symbol):
+            return re.sub('^_ZThn[0-9]+_', '_Z', symbol)
+        return symbol
+
+    @staticmethod
+    def _getSymbols(obj):
+        '''Returns a list of (symbol, section) contained in the given object
+        file.'''
+        proc = subprocess.Popen(['objdump', '-t', obj], stdout = subprocess.PIPE, stderr = subprocess.PIPE)
+        (stdout, stderr) = proc.communicate()
+        syms = []
+        for line in stdout.splitlines():
+            # Each line has the following format:
+            # <addr> [lgu!][w ][C ][W ][Ii ][dD ][FfO ] <section>\t<length> <symbol>
+            tmp = line.split(' ',1)
+            # This gives us ["<addr>", "[lgu!][w ][C ][W ][Ii ][dD ][FfO ] <section>\t<length> <symbol>"]
+            # We only need to consider cases where "<section>\t<length> <symbol>" is present,
+            # and where the [FfO] flag is either F (function) or O (object).
+            if len(tmp) > 1 and len(tmp[1]) > 6 and tmp[1][6] in ['O', 'F']:
+                tmp = tmp[1][8:].split()
+                # That gives us ["<section>","<length>", "<symbol>"]
+                syms.append((tmp[-1], tmp[0]))
+        return syms
 
 def main():
     parser = OptionParser()
@@ -153,17 +308,16 @@ def main():
         help="use a list file for objects when executing a command")
     parser.add_option("--verbose", action="store_true", dest="verbose",
         help="display executed command and temporary files content")
-    parser.add_option("--reorder", dest="reorder",
-        help="reorder the objects according to the given list", metavar="FILE")
+    parser.add_option("--symbol-order", dest="symbol_order", metavar="FILE",
+        help="use the given list of symbols to order symbols in the resulting binary when using with a linker")
 
     (options, args) = parser.parse_args()
 
     with ExpandArgsMore(args) as args:
-        if options.extract or options.reorder:
+        if options.extract:
             args.extract()
-        if options.reorder:
-            with open(options.reorder) as file:
-                args.reorder([l.strip() for l in file.readlines()])
+        if options.symbol_order:
+            args.orderSymbols(options.symbol_order)
         if options.uselist:
             args.makelist()
 
diff --git a/js/src/configure.in b/js/src/configure.in
index 8f4fd37850f..a6277a51ed7 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -1767,6 +1767,33 @@ if test -n "$CLANG_CXX"; then
     _WARNINGS_CXXFLAGS="-Qunused-arguments ${_WARNINGS_CXXFLAGS}"
 fi
 
+dnl ========================================================
+dnl = Use Address Sanitizer
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(address-sanitizer,
+[  --enable-address-sanitizer       Enable Address Sanitizer (default=no)],
+    MOZ_ASAN=1,
+    MOZ_ASAN= )
+if test -n "$MOZ_ASAN"; then
+    MOZ_LLVM_HACKS=1
+    AC_DEFINE(MOZ_ASAN)
+fi
+AC_SUBST(MOZ_ASAN)
+
+dnl ========================================================
+dnl = Enable hacks required for LLVM instrumentations
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(llvm-hacks,
+[  --enable-llvm-hacks       Enable workarounds required for several LLVM instrumentations (default=no)],
+    MOZ_LLVM_HACKS=1,
+    MOZ_LLVM_HACKS= )
+if test -n "$MOZ_LLVM_HACKS"; then
+    MOZ_NO_WLZDEFS=1
+    MOZ_CFLAGS_NSS=1
+fi
+AC_SUBST(MOZ_NO_WLZDEFS)
+AC_SUBST(MOZ_CFLAGS_NSS)
+
 dnl ========================================================
 dnl GNU specific defaults
 dnl ========================================================
@@ -1775,8 +1802,13 @@ if test "$GNU_CC"; then
     MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-h,$@ -o $@'
     DSO_LDOPTS='-shared'
     if test "$GCC_USE_GNU_LD"; then
-        # Don't allow undefined symbols in libraries
-        DSO_LDOPTS="$DSO_LDOPTS -Wl,-z,defs"
+        # Some tools like ASan use a runtime library that is only
+        # linked against executables, so we must allow undefined
+        # symbols for shared objects in some cases.
+        if test -z "$MOZ_NO_WLZDEFS"; then
+            # Don't allow undefined symbols in libraries
+            DSO_LDOPTS="$DSO_LDOPTS -Wl,-z,defs"
+        fi
     fi
     WARNINGS_AS_ERRORS='-Werror -Wno-error=uninitialized'
     DSO_CFLAGS=''
@@ -4797,37 +4829,7 @@ AC_SUBST(_MOZ_RTTI_FLAGS_ON)
 AC_DEFINE(CPP_THROW_NEW, [throw()])
 AC_LANG_C
 
-dnl ========================================================
-dnl =
-dnl = Check what kind of list files are supported by the
-dnl = linker
-dnl =
-dnl ========================================================
-
-AC_CACHE_CHECK(what kind of list files are supported by the linker,
-    EXPAND_LIBS_LIST_STYLE,
-    [echo "int main() {return 0;}" > conftest.${ac_ext}
-     if AC_TRY_COMMAND(${CC-cc} -o conftest.${OBJ_SUFFIX} -c $CFLAGS $CPPFLAGS conftest.${ac_ext} 1>&2) && test -s conftest.${OBJ_SUFFIX}; then
-         echo "INPUT(conftest.${OBJ_SUFFIX})" > conftest.list
-         if AC_TRY_COMMAND(${CC-cc} -o conftest${ac_exeext} $LDFLAGS conftest.list $LIBS 1>&2) && test -s conftest${ac_exeext}; then
-             EXPAND_LIBS_LIST_STYLE=linkerscript
-         else
-             echo "conftest.${OBJ_SUFFIX}" > conftest.list
-             if AC_TRY_COMMAND(${CC-cc} -o conftest${ac_exeext} $LDFLAGS @conftest.list $LIBS 1>&2) && test -s conftest${ac_exeext}; then
-                 EXPAND_LIBS_LIST_STYLE=list
-             else
-                 EXPAND_LIBS_LIST_STYLE=none
-             fi
-         fi
-     else
-         dnl We really don't expect to get here, but just in case
-         AC_ERROR([couldn't compile a simple C file])
-     fi
-     rm -rf conftest*])
-
-LIBS_DESC_SUFFIX=desc
-AC_SUBST(LIBS_DESC_SUFFIX)
-AC_SUBST(EXPAND_LIBS_LIST_STYLE)
+MOZ_EXPAND_LIBS
 
 dnl ========================================================
 dnl =
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index ffe7cc4d923..9d9e9c2658c 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -4086,7 +4086,11 @@ EmitCatch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     return true;
 }
 
-static bool
+/*
+ * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr12127. See
+ * the comment on EmitSwitch.
+ */
+MOZ_NEVER_INLINE static bool
 EmitTry(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     StmtInfo stmtInfo;
@@ -4446,7 +4450,11 @@ EmitIf(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
  * JSOP_LEAVEBLOCKEXPR to the beginning of the let and is only needed for
  * let-expressions.
  */
-static bool
+/*
+ * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr12127. See
+ * the comment on EmitSwitch.
+ */
+MOZ_NEVER_INLINE static bool
 EmitLet(JSContext *cx, BytecodeEmitter *bce, ParseNode *pnLet)
 {
     JS_ASSERT(pnLet->isArity(PN_BINARY));
@@ -4590,7 +4598,11 @@ EmitXMLProcessingInstruction(JSContext *cx, BytecodeEmitter *bce, XMLProcessingI
 }
 #endif
 
-static bool
+/*
+ * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr12127. See
+ * the comment on EmitSwitch.
+ */
+MOZ_NEVER_INLINE static bool
 EmitLexicalScope(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     JS_ASSERT(pn->isKind(PNK_LEXICALSCOPE));
@@ -5811,7 +5823,11 @@ EmitIncOrDec(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     return true;
 }
 
-static bool
+/*
+ * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr12127. See
+ * the comment on EmitSwitch.
+ */
+MOZ_NEVER_INLINE static bool
 EmitLabel(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     /*
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 29465f3258f..e40b0023be8 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -156,9 +156,9 @@ Parser::~Parser()
 {
     JSContext *cx = context;
     if (principals)
-        JSPRINCIPALS_DROP(cx, principals);
+        JS_DropPrincipals(cx->runtime, principals);
     if (originPrincipals)
-        JSPRINCIPALS_DROP(cx, originPrincipals);
+        JS_DropPrincipals(cx->runtime, originPrincipals);
     cx->tempLifoAlloc().release(tempPoolMark);
     cx->activeCompilations--;
 }
@@ -169,10 +169,10 @@ Parser::setPrincipals(JSPrincipals *prin, JSPrincipals *originPrin)
     JS_ASSERT(!principals && !originPrincipals);
     principals = prin;
     if (principals)
-        JSPRINCIPALS_HOLD(context, principals);
+        JS_HoldPrincipals(principals);
     originPrincipals = originPrin;
     if (originPrincipals)
-        JSPRINCIPALS_HOLD(context, originPrincipals);
+        JS_HoldPrincipals(originPrincipals);
 }
 
 ObjectBox *
diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
index 50bcf5497cc..097f8a8a2eb 100644
--- a/js/src/frontend/TokenStream.cpp
+++ b/js/src/frontend/TokenStream.cpp
@@ -158,7 +158,7 @@ TokenStream::TokenStream(JSContext *cx, JSPrincipals *prin, JSPrincipals *origin
     cx(cx), originPrincipals(JSScript::normalizeOriginPrincipals(prin, originPrin))
 {
     if (originPrincipals)
-        JSPRINCIPALS_HOLD(cx, originPrincipals);
+        JS_HoldPrincipals(originPrincipals);
 }
 
 #ifdef _MSC_VER
@@ -248,7 +248,7 @@ TokenStream::~TokenStream()
     if (sourceMap)
         cx->free_(sourceMap);
     if (originPrincipals)
-        JSPRINCIPALS_DROP(cx, originPrincipals);
+        JS_DropPrincipals(cx->runtime, originPrincipals);
 }
 
 /* Use the fastest available getc. */
@@ -1322,12 +1322,18 @@ TokenStream::checkForKeyword(const jschar *s, size_t length, TokenKind *ttp, JSO
                                             JSMSG_RESERVED_ID, kw->chars);
         }
 
+        /* The let keyword is reserved on <1.7 */
+        if (kw->tokentype == TOK_LET) {
+            return ReportCompileErrorNumber(cx, this, NULL, JSREPORT_ERROR,
+                                            JSMSG_RESERVED_ID, kw->chars);
+        }
+
         /*
          * The keyword is not in this version. Treat it as an identifier,
-         * unless it is let or yield which we treat as TOK_STRICT_RESERVED by
-         * falling through to the code below (ES5 forbids them in strict mode).
+         * unless it is yield which we treat as TOK_STRICT_RESERVED by
+         * falling through to the code below (ES5 forbids it in strict mode).
          */
-        if (kw->tokentype != TOK_LET && kw->tokentype != TOK_YIELD)
+        if (kw->tokentype != TOK_YIELD)
             return true;
     }
 
diff --git a/js/src/jit-test/tests/basic/bug734196.js b/js/src/jit-test/tests/basic/bug734196.js
new file mode 100644
index 00000000000..9a0f588f741
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug734196.js
@@ -0,0 +1,4 @@
+var x = new ArrayBuffer(2);
+gczeal(4);
+actual = [].concat(x).toString();
+var count2 = countHeap();
diff --git a/js/src/jit-test/tests/basic/regress-bug720680.js b/js/src/jit-test/tests/basic/regress-bug720680.js
index ebb794fb545..75013399c8d 100644
--- a/js/src/jit-test/tests/basic/regress-bug720680.js
+++ b/js/src/jit-test/tests/basic/regress-bug720680.js
@@ -9,7 +9,7 @@ function addTestCase( t ) {\
                   SECTION,\
                   '(new Date('+d+')).getUTCDay()',\
                   WeekDay((d)),\
-                  (new Date(let ({ stop } = 'properties.length' )('/ab[c\\\n]/'))).getUTCDay() \
+                  (new Date(foo ({ stop } = 'properties.length' )('/ab[c\\\n]/'))).getUTCDay() \
                 );\
 }\
 ");
diff --git a/js/src/jit-test/tests/jaeger/bug732423.js b/js/src/jit-test/tests/jaeger/bug732423.js
new file mode 100644
index 00000000000..fa09bbde763
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug732423.js
@@ -0,0 +1,23 @@
+function testXML(x, y) {
+    for (var i = 0; i < 60; i++) {
+        x[y]();
+        x[y];
+    }
+}
+testXML(<x/>, "elements");
+
+var o = {
+    res: 0,
+    f: function() { this.res += 3; },
+    __noSuchMethod__: function() { this.res += 5; }
+};
+
+function testNoSuchMethod(x, y) {
+    for (var i = 0; i < 60; i++) {
+        x[y]();
+    }
+}
+
+testNoSuchMethod(o, "f");
+testNoSuchMethod(o, "g");
+assertEq(o.res, 480);
diff --git a/js/src/jsapi-tests/testChromeBuffer.cpp b/js/src/jsapi-tests/testChromeBuffer.cpp
index fb72c15a4e3..49a60cc18ee 100644
--- a/js/src/jsapi-tests/testChromeBuffer.cpp
+++ b/js/src/jsapi-tests/testChromeBuffer.cpp
@@ -1,18 +1,9 @@
 #include "tests.h"
 
-static void
-Destroy(JSContext *cx, JSPrincipals *prin);
-
 JSPrincipals system_principals = {
-    (char *)"", 1, Destroy, NULL
+    1
 };
 
-static void
-Destroy(JSContext *cx, JSPrincipals *prin)
-{
-    JS_ASSERT(prin == &system_principals);
-}
-
 JSClass global_class = {
     "global",
     JSCLASS_IS_GLOBAL | JSCLASS_GLOBAL_FLAGS,
diff --git a/js/src/jsapi-tests/testCloneScript.cpp b/js/src/jsapi-tests/testCloneScript.cpp
index 13da8a0a56f..f246348a410 100644
--- a/js/src/jsapi-tests/testCloneScript.cpp
+++ b/js/src/jsapi-tests/testCloneScript.cpp
@@ -52,7 +52,7 @@ BEGIN_TEST(test_cloneScript)
 END_TEST(test_cloneScript)
 
 void
-DestroyPrincipals(JSContext *cx, JSPrincipals *principals)
+DestroyPrincipals(JSPrincipals *principals)
 {
     delete principals;
 }
@@ -60,54 +60,38 @@ DestroyPrincipals(JSContext *cx, JSPrincipals *principals)
 struct Principals : public JSPrincipals
 {
   public:
-    Principals(const char *name)
+    Principals()
     {
         refcount = 0;
-        codebase = const_cast<char *>(name);
-        destroy = DestroyPrincipals;
-        subsume = NULL;
     }
 };
 
 class AutoDropPrincipals
 {
-    JSContext *cx;
+    JSRuntime *rt;
     JSPrincipals *principals;
 
   public:
-    AutoDropPrincipals(JSContext *cx, JSPrincipals *principals)
-      : cx(cx), principals(principals)
+    AutoDropPrincipals(JSRuntime *rt, JSPrincipals *principals)
+      : rt(rt), principals(principals)
     {
-        JSPRINCIPALS_HOLD(cx, principals);
+        JS_HoldPrincipals(principals);
     }
 
     ~AutoDropPrincipals()
     {
-        JSPRINCIPALS_DROP(cx, principals);
+        JS_DropPrincipals(rt, principals);
     }
 };
 
-JSBool
-TranscodePrincipals(JSXDRState *xdr, JSPrincipals **principalsp)
-{
-    return JS_XDRBytes(xdr, reinterpret_cast<char *>(principalsp), sizeof(*principalsp));
-}
-
 BEGIN_TEST(test_cloneScriptWithPrincipals)
 {
-    JSSecurityCallbacks cbs = {
-        NULL,
-        TranscodePrincipals,
-        NULL,
-        NULL
-    };
+    JS_InitDestroyPrincipalsCallback(rt, DestroyPrincipals);
 
-    JS_SetRuntimeSecurityCallbacks(rt, &cbs);
-
-    JSPrincipals *principalsA = new Principals("A");
-    AutoDropPrincipals dropA(cx, principalsA);
-    JSPrincipals *principalsB = new Principals("B");
-    AutoDropPrincipals dropB(cx, principalsB);
+    JSPrincipals *principalsA = new Principals();
+    AutoDropPrincipals dropA(rt, principalsA);
+    JSPrincipals *principalsB = new Principals();
+    AutoDropPrincipals dropB(rt, principalsB);
 
     JSObject *A, *B;
 
diff --git a/js/src/jsapi-tests/testOriginPrincipals.cpp b/js/src/jsapi-tests/testOriginPrincipals.cpp
index ae448e5ab8e..8ff3fe4ae46 100644
--- a/js/src/jsapi-tests/testOriginPrincipals.cpp
+++ b/js/src/jsapi-tests/testOriginPrincipals.cpp
@@ -5,28 +5,19 @@
 JSPrincipals *sCurrentGlobalPrincipals = NULL;
 
 JSPrincipals *
-ObjectPrincipalsFinder(JSContext *, JSObject *)
+ObjectPrincipalsFinder(JSObject *)
 {
     return sCurrentGlobalPrincipals;
 }
 
-JSSecurityCallbacks seccb = {
+static const JSSecurityCallbacks seccb = {
+    NULL,
     NULL,
     NULL,
     ObjectPrincipalsFinder,
     NULL
 };
 
-static void
-Destroy(JSContext *, JSPrincipals *)
-{}
-
-static JSBool
-Subsume(JSPrincipals *, JSPrincipals *)
-{
-    return true;
-}
-
 JSPrincipals *sOriginPrincipalsInErrorReporter = NULL;
 
 static void
@@ -35,14 +26,12 @@ ErrorReporter(JSContext *cx, const char *message, JSErrorReport *report)
     sOriginPrincipalsInErrorReporter = report->originPrincipals;
 }
 
-char p1str[] = "principal1";
-JSPrincipals prin1 = { p1str, 0, Destroy, Subsume };
-char p2str[] = "principal2";
-JSPrincipals prin2 = { p2str, 0, Destroy, Subsume };
+JSPrincipals prin1 = { 1 };
+JSPrincipals prin2 = { 1 };
 
 BEGIN_TEST(testOriginPrincipals)
 {
-    JS_SetContextSecurityCallbacks(cx, &seccb);
+    JS_SetSecurityCallbacks(rt, &seccb);
 
     /*
      * Currently, the only way to set a non-trivial originPrincipal is to use
diff --git a/js/src/jsapi-tests/testXDR.cpp b/js/src/jsapi-tests/testXDR.cpp
index c20b8378565..8a23f9b3711 100644
--- a/js/src/jsapi-tests/testXDR.cpp
+++ b/js/src/jsapi-tests/testXDR.cpp
@@ -72,23 +72,11 @@ FreezeThaw(JSContext *cx, JSObject *funobj)
     return FreezeThawImpl(cx, funobj, JS_XDRFunctionObject);
 }
 
-static JSBool
-SubsumePrincipals(JSPrincipals *, JSPrincipals *)
-{
-    return true;
-}
-
 static JSPrincipals testPrincipals[] = {
-    { const_cast<char *>("foo.bar"), 1, NULL, SubsumePrincipals },
-    { const_cast<char *>("dot.com"), 1, NULL, SubsumePrincipals },
+    { 1 },
+    { 1 },
 };
 
-static JSBool
-CheckAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode, jsval *vp)
-{
-    return true;
-}
-
 static JSBool
 TranscodePrincipals(JSXDRState *xdr, JSPrincipals **principalsp)
 {
@@ -110,7 +98,7 @@ TranscodePrincipals(JSXDRState *xdr, JSPrincipals **principalsp)
         if (index >= mozilla::ArrayLength(testPrincipals))
             return false;
         *principalsp = &testPrincipals[index];
-        JSPRINCIPALS_HOLD(xdr->cx, *principalsp);
+        JS_HoldPrincipals(*principalsp);
     }
 
     return true;
@@ -118,14 +106,15 @@ TranscodePrincipals(JSXDRState *xdr, JSPrincipals **principalsp)
 
 BEGIN_TEST(testXDR_principals)
 {
-    static JSSecurityCallbacks seccb = {
-        CheckAccess,
+    static const JSSecurityCallbacks seccb = {
+        NULL,
+        NULL,
         TranscodePrincipals,
         NULL,
         NULL
     };
 
-    JS_SetRuntimeSecurityCallbacks(rt, &seccb);
+    JS_SetSecurityCallbacks(rt, &seccb);
 
     JSScript *script;
     for (int i = TEST_FIRST; i != TEST_END; ++i) {
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 04af605afd7..a214fd41fd0 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -696,6 +696,8 @@ JS_IsBuiltinFunctionConstructor(JSFunction *fun)
  */
 static JSBool js_NewRuntimeWasCalled = JS_FALSE;
 
+static const JSSecurityCallbacks NullSecurityCallbacks = { };
+
 JSRuntime::JSRuntime()
   : atomsCompartment(NULL),
 #ifdef JS_THREADSAFE
@@ -778,7 +780,8 @@ JSRuntime::JSRuntime()
     gcHelperThread(thisFromCtor()),
 #endif
     debuggerMutations(0),
-    securityCallbacks(NULL),
+    securityCallbacks(const_cast<JSSecurityCallbacks *>(&NullSecurityCallbacks)),
+    destroyPrincipals(NULL),
     structuredCloneCallbacks(NULL),
     telemetryCallback(NULL),
     propertyRemovals(0),
@@ -841,7 +844,7 @@ JSRuntime::init(uint32_t maxbytes)
     }
 
     atomsCompartment->isSystemCompartment = true;
-    atomsCompartment->setGCLastBytes(8192, GC_NORMAL);
+    atomsCompartment->setGCLastBytes(8192, 8192, GC_NORMAL);
 
     if (!js_InitAtomState(this))
         return false;
@@ -1014,8 +1017,6 @@ StartRequest(JSContext *cx)
     if (rt->requestDepth) {
         rt->requestDepth++;
     } else {
-        AutoLockGC lock(rt);
-
         /* Indicate that a request is running. */
         rt->requestDepth = 1;
 
@@ -1034,10 +1035,6 @@ StopRequest(JSContext *cx)
         rt->requestDepth--;
     } else {
         rt->conservativeGC.updateForRequestEnd(rt->suspendCount);
-
-        /* Lock before clearing to interlock with ClaimScope, in jslock.c. */
-        AutoLockGC lock(rt);
-
         rt->requestDepth = 0;
 
         if (rt->activityCallback)
@@ -1307,14 +1304,12 @@ SetOptionsCommon(JSContext *cx, unsigned options)
 JS_PUBLIC_API(uint32_t)
 JS_SetOptions(JSContext *cx, uint32_t options)
 {
-    AutoLockGC lock(cx->runtime);
     return SetOptionsCommon(cx, options);
 }
 
 JS_PUBLIC_API(uint32_t)
 JS_ToggleOptions(JSContext *cx, uint32_t options)
 {
-    AutoLockGC lock(cx->runtime);
     unsigned oldopts = cx->allOptions();
     unsigned newopts = oldopts ^ options;
     return SetOptionsCommon(cx, newopts);
@@ -2203,6 +2198,18 @@ JS_ComputeThis(JSContext *cx, jsval *vp)
     return call.thisv();
 }
 
+JS_PUBLIC_API(void)
+JS_MallocInCompartment(JSCompartment *comp, size_t nbytes)
+{
+    comp->mallocInCompartment(nbytes);
+}
+
+JS_PUBLIC_API(void)
+JS_FreeInCompartment(JSCompartment *comp, size_t nbytes)
+{
+    comp->freeInCompartment(nbytes);
+}
+
 JS_PUBLIC_API(void *)
 JS_malloc(JSContext *cx, size_t nbytes)
 {
@@ -2884,7 +2891,6 @@ JS_SetGCParameter(JSRuntime *rt, JSGCParamKey key, uint32_t value)
 {
     switch (key) {
       case JSGC_MAX_BYTES: {
-        AutoLockGC lock(rt);
         JS_ASSERT(value >= rt->gcBytes);
         rt->gcMaxBytes = value;
         break;
@@ -4268,7 +4274,7 @@ prop_iter_trace(JSTracer *trc, JSObject *obj)
          */
         Shape *tmp = (Shape *)pdata;
         MarkShapeUnbarriered(trc, &tmp, "prop iter shape");
-        JS_ASSERT(tmp == pdata);
+        obj->setPrivateUnbarriered(tmp);
     } else {
         /* Non-native case: mark each id in the JSIdArray private. */
         JSIdArray *ida = (JSIdArray *) pdata;
@@ -4448,55 +4454,31 @@ JS_CheckAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode,
     return CheckAccess(cx, obj, id, mode, vp, attrsp);
 }
 
-#ifdef JS_THREADSAFE
-JS_PUBLIC_API(int)
-JS_HoldPrincipals(JSContext *cx, JSPrincipals *principals)
+JS_PUBLIC_API(void)
+JS_HoldPrincipals(JSPrincipals *principals)
 {
-    return JS_ATOMIC_INCREMENT(&principals->refcount);
+    JS_ATOMIC_INCREMENT(&principals->refcount);
 }
 
-JS_PUBLIC_API(int)
-JS_DropPrincipals(JSContext *cx, JSPrincipals *principals)
+JS_PUBLIC_API(void)
+JS_DropPrincipals(JSRuntime *rt, JSPrincipals *principals)
 {
     int rc = JS_ATOMIC_DECREMENT(&principals->refcount);
     if (rc == 0)
-        principals->destroy(cx, principals);
-    return rc;
-}
-#endif
-
-JS_PUBLIC_API(JSSecurityCallbacks *)
-JS_SetRuntimeSecurityCallbacks(JSRuntime *rt, JSSecurityCallbacks *callbacks)
-{
-    JSSecurityCallbacks *oldcallbacks;
-
-    oldcallbacks = rt->securityCallbacks;
-    rt->securityCallbacks = callbacks;
-    return oldcallbacks;
+        rt->destroyPrincipals(principals);
 }
 
-JS_PUBLIC_API(JSSecurityCallbacks *)
-JS_GetRuntimeSecurityCallbacks(JSRuntime *rt)
+JS_PUBLIC_API(void)
+JS_SetSecurityCallbacks(JSRuntime *rt, const JSSecurityCallbacks *scb)
 {
-  return rt->securityCallbacks;
+    JS_ASSERT(scb != &NullSecurityCallbacks);
+    rt->securityCallbacks = scb ? scb : &NullSecurityCallbacks;
 }
 
-JS_PUBLIC_API(JSSecurityCallbacks *)
-JS_SetContextSecurityCallbacks(JSContext *cx, JSSecurityCallbacks *callbacks)
+JS_PUBLIC_API(const JSSecurityCallbacks *)
+JS_GetSecurityCallbacks(JSRuntime *rt)
 {
-    JSSecurityCallbacks *oldcallbacks;
-
-    oldcallbacks = cx->securityCallbacks;
-    cx->securityCallbacks = callbacks;
-    return oldcallbacks;
-}
-
-JS_PUBLIC_API(JSSecurityCallbacks *)
-JS_GetSecurityCallbacks(JSContext *cx)
-{
-  return cx->securityCallbacks
-         ? cx->securityCallbacks
-         : cx->runtime->securityCallbacks;
+    return (rt->securityCallbacks != &NullSecurityCallbacks) ? rt->securityCallbacks : NULL;
 }
 
 JS_PUBLIC_API(void)
@@ -4505,6 +4487,14 @@ JS_SetTrustedPrincipals(JSRuntime *rt, JSPrincipals *prin)
     rt->setTrustedPrincipals(prin);
 }
 
+extern JS_PUBLIC_API(void)
+JS_InitDestroyPrincipalsCallback(JSRuntime *rt, JSDestroyPrincipalsOp destroyPrincipals)
+{
+    JS_ASSERT(destroyPrincipals);
+    JS_ASSERT(!rt->destroyPrincipals);
+    rt->destroyPrincipals = destroyPrincipals;
+}
+
 JS_PUBLIC_API(JSFunction *)
 JS_NewFunction(JSContext *cx, JSNative native, unsigned nargs, unsigned flags,
                JSObject *parent, const char *name)
@@ -5511,20 +5501,8 @@ JS_GetOperationCallback(JSContext *cx)
 }
 
 JS_PUBLIC_API(void)
-JS_TriggerOperationCallback(JSContext *cx)
+JS_TriggerOperationCallback(JSRuntime *rt)
 {
-#ifdef JS_THREADSAFE
-    AutoLockGC lock(cx->runtime);
-#endif
-    cx->runtime->triggerOperationCallback();
-}
-
-JS_PUBLIC_API(void)
-JS_TriggerRuntimeOperationCallback(JSRuntime *rt)
-{
-#ifdef JS_THREADSAFE
-    AutoLockGC lock(rt);
-#endif
     rt->triggerOperationCallback();
 }
 
@@ -6467,10 +6445,23 @@ JS_ClearPendingException(JSContext *cx)
 JS_PUBLIC_API(JSBool)
 JS_ReportPendingException(JSContext *cx)
 {
+    JSBool ok;
+    bool save;
+
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
 
-    return js_ReportUncaughtException(cx);
+    /*
+     * Set cx->generatingError to suppress the standard error-to-exception
+     * conversion done by all {js,JS}_Report* functions except for OOM.  The
+     * cx->generatingError flag was added to suppress recursive divergence
+     * under js_ErrorToException, but it serves for our purposes here too.
+     */
+    save = cx->generatingError;
+    cx->generatingError = JS_TRUE;
+    ok = js_ReportUncaughtException(cx);
+    cx->generatingError = save;
+    return ok;
 }
 
 struct JSExceptionState {
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 65baa1f3750..e23ac859a10 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -1520,6 +1520,12 @@ typedef JSBool
  * Security protocol types.
  */
 
+typedef void
+(* JSDestroyPrincipalsOp)(JSPrincipals *principals);
+
+typedef JSBool
+(* JSSubsumePrincipalsOp)(JSPrincipals *principals1, JSPrincipals *principals2);
+
 /*
  * XDR-encode or -decode a principals instance, based on whether xdr->mode is
  * JSXDR_ENCODE, in which case *principalsp should be encoded; or JSXDR_DECODE,
@@ -1539,7 +1545,7 @@ typedef JSBool
  * callback's implementation.
  */
 typedef JSPrincipals *
-(* JSObjectPrincipalsFinder)(JSContext *cx, JSObject *obj);
+(* JSObjectPrincipalsFinder)(JSObject *obj);
 
 /*
  * Used to check if a CSP instance wants to disable eval() and friends.
@@ -2879,6 +2885,12 @@ JS_THIS(JSContext *cx, jsval *vp)
  */
 #define JS_THIS_VALUE(cx,vp)    ((vp)[1])
 
+extern JS_PUBLIC_API(void)
+JS_MallocInCompartment(JSCompartment *comp, size_t nbytes);
+
+extern JS_PUBLIC_API(void)
+JS_FreeInCompartment(JSCompartment *comp, size_t nbytes);
+
 extern JS_PUBLIC_API(void *)
 JS_malloc(JSContext *cx, size_t nbytes);
 
@@ -4082,52 +4094,48 @@ JS_SetReservedSlot(JSObject *obj, uint32_t index, jsval v);
  * Security protocol.
  */
 struct JSPrincipals {
-    char *codebase;
-
     /* Don't call "destroy"; use reference counting macros below. */
     int refcount;
 
-    void   (* destroy)(JSContext *cx, JSPrincipals *);
-    JSBool (* subsume)(JSPrincipals *, JSPrincipals *);
-};
-
-#ifdef JS_THREADSAFE
-#define JSPRINCIPALS_HOLD(cx, principals)   JS_HoldPrincipals(cx,principals)
-#define JSPRINCIPALS_DROP(cx, principals)   JS_DropPrincipals(cx,principals)
-
-extern JS_PUBLIC_API(int)
-JS_HoldPrincipals(JSContext *cx, JSPrincipals *principals);
-
-extern JS_PUBLIC_API(int)
-JS_DropPrincipals(JSContext *cx, JSPrincipals *principals);
-
-#else
-#define JSPRINCIPALS_HOLD(cx, principals)   (++(principals)->refcount)
-#define JSPRINCIPALS_DROP(cx, principals)                                     \
-    ((--(principals)->refcount == 0)                                          \
-     ? ((*(principals)->destroy)((cx), (principals)), 0)                      \
-     : (principals)->refcount)
+#ifdef DEBUG
+    /* A helper to facilitate principals debugging. */
+    uint32_t    debugToken;
 #endif
 
+#ifdef __cplusplus
+    void setDebugToken(uint32_t token) {
+# ifdef DEBUG
+        debugToken = token;
+# endif
+    }
+
+    /*
+     * This is not defined by the JS engine but should be provided by the
+     * embedding.
+     */
+    JS_PUBLIC_API(void) dump();
+#endif
+};
+
+extern JS_PUBLIC_API(void)
+JS_HoldPrincipals(JSPrincipals *principals);
+
+extern JS_PUBLIC_API(void)
+JS_DropPrincipals(JSRuntime *rt, JSPrincipals *principals);
 
 struct JSSecurityCallbacks {
     JSCheckAccessOp            checkObjectAccess;
+    JSSubsumePrincipalsOp      subsumePrincipals;
     JSPrincipalsTranscoder     principalsTranscoder;
     JSObjectPrincipalsFinder   findObjectPrincipals;
     JSCSPEvalChecker           contentSecurityPolicyAllows;
 };
 
-extern JS_PUBLIC_API(JSSecurityCallbacks *)
-JS_SetRuntimeSecurityCallbacks(JSRuntime *rt, JSSecurityCallbacks *callbacks);
+extern JS_PUBLIC_API(void)
+JS_SetSecurityCallbacks(JSRuntime *rt, const JSSecurityCallbacks *callbacks);
 
-extern JS_PUBLIC_API(JSSecurityCallbacks *)
-JS_GetRuntimeSecurityCallbacks(JSRuntime *rt);
-
-extern JS_PUBLIC_API(JSSecurityCallbacks *)
-JS_SetContextSecurityCallbacks(JSContext *cx, JSSecurityCallbacks *callbacks);
-
-extern JS_PUBLIC_API(JSSecurityCallbacks *)
-JS_GetSecurityCallbacks(JSContext *cx);
+extern JS_PUBLIC_API(const JSSecurityCallbacks *)
+JS_GetSecurityCallbacks(JSRuntime *rt);
 
 /*
  * Code running with "trusted" principals will be given a deeper stack
@@ -4144,6 +4152,14 @@ JS_GetSecurityCallbacks(JSContext *cx);
 extern JS_PUBLIC_API(void)
 JS_SetTrustedPrincipals(JSRuntime *rt, JSPrincipals *prin);
 
+/*
+ * Initialize the callback that is called to destroy JSPrincipals instance
+ * when its reference counter drops to zero. The initialization can be done
+ * only once per JS runtime.
+ */
+extern JS_PUBLIC_API(void)
+JS_InitDestroyPrincipalsCallback(JSRuntime *rt, JSDestroyPrincipalsOp destroyPrincipals);
+
 /************************************************************************/
 
 /*
@@ -4498,21 +4514,17 @@ JS_BEGIN_EXTERN_C
 
 /*
  * These functions allow setting an operation callback that will be called
- * from the thread the context is associated with some time after any thread
- * triggered the callback using JS_TriggerOperationCallback(cx).
+ * from the JS thread some time after any thread triggered the callback using
+ * JS_TriggerOperationCallback(rt).
  *
- * In a threadsafe build the engine internally triggers operation callbacks
- * under certain circumstances (i.e. GC and title transfer) to force the
- * context to yield its current request, which the engine always
- * automatically does immediately prior to calling the callback function.
- * The embedding should thus not rely on callbacks being triggered through
- * the external API only.
+ * To schedule the GC and for other activities the engine internally triggers
+ * operation callbacks. The embedding should thus not rely on callbacks being
+ * triggered through the external API only.
  *
  * Important note: Additional callbacks can occur inside the callback handler
  * if it re-enters the JS engine. The embedding must ensure that the callback
  * is disconnected before attempting such re-entry.
  */
-
 extern JS_PUBLIC_API(JSOperationCallback)
 JS_SetOperationCallback(JSContext *cx, JSOperationCallback callback);
 
@@ -4520,10 +4532,7 @@ extern JS_PUBLIC_API(JSOperationCallback)
 JS_GetOperationCallback(JSContext *cx);
 
 extern JS_PUBLIC_API(void)
-JS_TriggerOperationCallback(JSContext *cx);
-
-extern JS_PUBLIC_API(void)
-JS_TriggerRuntimeOperationCallback(JSRuntime *rt);
+JS_TriggerOperationCallback(JSRuntime *rt);
 
 extern JS_PUBLIC_API(JSBool)
 JS_IsRunning(JSContext *cx);
diff --git a/js/src/jsbool.cpp b/js/src/jsbool.cpp
index 98905bebf11..cd1a08ed69c 100644
--- a/js/src/jsbool.cpp
+++ b/js/src/jsbool.cpp
@@ -186,13 +186,6 @@ js_BooleanToString(JSContext *cx, JSBool b)
     return cx->runtime->atomState.booleanAtoms[b ? 1 : 0];
 }
 
-/* This function implements E-262-3 section 9.8, toString. */
-bool
-js::BooleanToStringBuffer(JSContext *cx, JSBool b, StringBuffer &sb)
-{
-    return b ? sb.append("true") : sb.append("false");
-}
-
 namespace js {
 
 bool
diff --git a/js/src/jsbool.h b/js/src/jsbool.h
index c5e857fcecb..74f88e390dd 100644
--- a/js/src/jsbool.h
+++ b/js/src/jsbool.h
@@ -54,9 +54,6 @@ js_BooleanToString(JSContext *cx, JSBool b);
 
 namespace js {
 
-extern bool
-BooleanToStringBuffer(JSContext *cx, JSBool b, StringBuffer &sb);
-
 inline bool
 BooleanGetPrimitiveValue(JSContext *cx, JSObject &obj, Value *vp);
 
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 414ed5b67d0..6711f473edf 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -118,7 +118,7 @@ JSRuntime::sizeOfExcludingThis(JSMallocSizeOfFun mallocSizeOf, size_t *normal, s
         *gcMarkerSize = gcMarker.sizeOfExcludingThis(mallocSizeOf);
 }
 
-JS_FRIEND_API(void)
+void
 JSRuntime::triggerOperationCallback()
 {
     /*
@@ -250,49 +250,48 @@ js_DestroyContext(JSContext *cx, JSDestroyContextMode mode)
         }
     }
 
-    JS_LOCK_GC(rt);
     JS_REMOVE_LINK(&cx->link);
     bool last = !rt->hasContexts();
-    if (last || mode == JSDCM_FORCE_GC || mode == JSDCM_MAYBE_GC) {
+    if (last) {
         JS_ASSERT(!rt->gcRunning);
 
 #ifdef JS_THREADSAFE
-        rt->gcHelperThread.waitBackgroundSweepEnd();
-#endif
-        JS_UNLOCK_GC(rt);
-
-        if (last) {
-            /*
-             * Dump remaining type inference results first. This printing
-             * depends on atoms still existing.
-             */
-            {
-                AutoLockGC lock(rt);
-                for (CompartmentsIter c(rt); !c.done(); c.next())
-                    c->types.print(cx, false);
-            }
-
-            /* Unpin all common atoms before final GC. */
-            js_FinishCommonAtoms(cx);
-
-            /* Clear debugging state to remove GC roots. */
-            for (CompartmentsIter c(rt); !c.done(); c.next())
-                c->clearTraps(cx);
-            JS_ClearAllWatchPoints(cx);
-
-            GC(cx, NULL, GC_NORMAL, gcreason::LAST_CONTEXT);
-
-        } else if (mode == JSDCM_FORCE_GC) {
-            GC(cx, NULL, GC_NORMAL, gcreason::DESTROY_CONTEXT);
-        } else if (mode == JSDCM_MAYBE_GC) {
-            JS_MaybeGC(cx);
+        {
+            AutoLockGC lock(rt);
+            rt->gcHelperThread.waitBackgroundSweepEnd();
         }
-        JS_LOCK_GC(rt);
-    }
-#ifdef JS_THREADSAFE
-    rt->gcHelperThread.waitBackgroundSweepEnd();
 #endif
-    JS_UNLOCK_GC(rt);
+        
+        /*
+         * Dump remaining type inference results first. This printing
+         * depends on atoms still existing.
+         */
+        for (CompartmentsIter c(rt); !c.done(); c.next())
+            c->types.print(cx, false);
+
+        /* Unpin all common atoms before final GC. */
+        js_FinishCommonAtoms(cx);
+        
+        /* Clear debugging state to remove GC roots. */
+        for (CompartmentsIter c(rt); !c.done(); c.next())
+            c->clearTraps(cx);
+        JS_ClearAllWatchPoints(cx);
+        
+        GC(cx, NULL, GC_NORMAL, gcreason::LAST_CONTEXT);
+    } else if (mode == JSDCM_FORCE_GC) {
+        JS_ASSERT(!rt->gcRunning);
+        GC(cx, NULL, GC_NORMAL, gcreason::DESTROY_CONTEXT);
+    } else if (mode == JSDCM_MAYBE_GC) {
+        JS_ASSERT(!rt->gcRunning);
+        JS_MaybeGC(cx);
+    }
+
+#ifdef JS_THREADSAFE
+    {
+        AutoLockGC lock(rt);
+        rt->gcHelperThread.waitBackgroundSweepEnd();
+    }
+#endif
     Foreground::delete_(cx);
 }
 
@@ -989,7 +988,6 @@ JSContext::JSContext(JSRuntime *rt)
 #ifdef JS_THREADSAFE
     outstandingRequests(0),
 #endif
-    securityCallbacks(NULL),
     resolveFlags(0),
     rngSeed(0),
     iterValue(MagicValue(JS_NO_ITER_VALUE)),
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 4d1afcb45f0..3434c394e32 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -509,11 +509,8 @@ struct JSRuntime : js::RuntimeFriendFields
 
     uint32_t            debuggerMutations;
 
-    /*
-     * Security callbacks set on the runtime are used by each context unless
-     * an override is set on the context.
-     */
-    JSSecurityCallbacks *securityCallbacks;
+    const JSSecurityCallbacks *securityCallbacks;
+    JSDestroyPrincipalsOp destroyPrincipals;
 
     /* Structured data callbacks are runtime-wide. */
     const JSStructuredCloneCallbacks *structuredCloneCallbacks;
@@ -686,7 +683,7 @@ struct JSRuntime : js::RuntimeFriendFields
      */
     JS_FRIEND_API(void *) onOutOfMemory(void *p, size_t nbytes, JSContext *cx);
 
-    JS_FRIEND_API(void) triggerOperationCallback();
+    void triggerOperationCallback();
 
     void setJitHardening(bool enabled);
     bool getJitHardening() const {
@@ -830,11 +827,11 @@ struct JSContext : js::ContextFriendFields
     bool                hasVersionOverride;
 
     /* Exception state -- the exception member is a GC root by definition. */
-    JSBool              throwing;            /* is there a pending exception? */
-    js::Value           exception;           /* most-recently-thrown exception */
+    JSBool              throwing;           /* is there a pending exception? */
+    js::Value           exception;          /* most-recently-thrown exception */
 
     /* Per-context run options. */
-    unsigned            runOptions;          /* see jsapi.h for JSOPTION_* */
+    unsigned               runOptions;            /* see jsapi.h for JSOPTION_* */
 
   public:
     int32_t             reportGranularity;  /* see jsprobes.h */
@@ -844,8 +841,11 @@ struct JSContext : js::ContextFriendFields
 
     js::AutoResolving   *resolvingList;
 
-    /* True if generating an error, to prevent runaway recursion. */
-    bool                generatingError;
+    /*
+     * True if generating an error, to prevent runaway recursion.
+     * NB: generatingError packs with throwing below.
+     */
+    bool        generatingError;
 
     /* GC heap compartment. */
     JSCompartment       *compartment;
@@ -1010,9 +1010,6 @@ struct JSContext : js::ContextFriendFields
 
 #endif /* JSGC_ROOT_ANALYSIS */
 
-    /* Security callbacks that override any defined on the runtime. */
-    JSSecurityCallbacks *securityCallbacks;
-
     /* Stored here to avoid passing it around as a parameter. */
     unsigned               resolveFlags;
 
@@ -1247,6 +1244,40 @@ class AutoXMLRooter : private AutoGCRooter {
 # define JS_UNLOCK_GC(rt)
 #endif
 
+class AutoLockGC
+{
+  public:
+    explicit AutoLockGC(JSRuntime *rt = NULL
+                        MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+      : runtime(rt)
+    {
+        MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+        if (rt)
+            JS_LOCK_GC(rt);
+    }
+
+    ~AutoLockGC()
+    {
+        if (runtime)
+            JS_UNLOCK_GC(runtime);
+    }
+
+    bool locked() const {
+        return !!runtime;
+    }
+
+    void lock(JSRuntime *rt) {
+        JS_ASSERT(rt);
+        JS_ASSERT(!runtime);
+        runtime = rt;
+        JS_LOCK_GC(rt);
+    }
+
+  private:
+    JSRuntime *runtime;
+    MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
+};
+
 class AutoUnlockGC {
   private:
     JSRuntime *rt;
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 013cae65060..fbd21f7da7f 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -75,7 +75,6 @@ JSCompartment::JSCompartment(JSRuntime *rt)
     needsBarrier_(false),
     gcBytes(0),
     gcTriggerBytes(0),
-    gcLastBytes(0),
     hold(false),
     typeLifoAlloc(TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
     data(NULL),
@@ -86,6 +85,9 @@ JSCompartment::JSCompartment(JSRuntime *rt)
     regExps(rt),
     propertyTree(thisForCtor()),
     emptyTypeObject(NULL),
+    gcMallocAndFreeBytes(0),
+    gcTriggerMallocAndFreeBytes(0),
+    gcMallocBytes(0),
     debugModeBits(rt->debugMode ? DebugFromC : 0),
     mathCache(NULL),
     watchpointMap(NULL)
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index 27d72cd5935..466742453f9 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -205,7 +205,6 @@ struct JSCompartment
 
     size_t                       gcBytes;
     size_t                       gcTriggerBytes;
-    size_t                       gcLastBytes;
     size_t                       gcMaxMallocBytes;
 
     bool                         hold;
@@ -267,14 +266,6 @@ struct JSCompartment
      */
     js::PropertyTree             propertyTree;
 
-#ifdef DEBUG
-    /* Property metering. */
-    unsigned                     livePropTreeNodes;
-    unsigned                     totalPropTreeNodes;
-    unsigned                     propTreeKidsChunks;
-    unsigned                     liveDictModeNodes;
-#endif
-
     /* Set of all unowned base shapes in the compartment. */
     js::BaseShapeSet             baseShapes;
     void sweepBaseShapeTable(JSContext *cx);
@@ -298,16 +289,26 @@ struct JSCompartment
     /* Cache to speed up object creation. */
     js::NewObjectCache           newObjectCache;
 
+    /*
+     * Keeps track of the total number of malloc bytes connected to a
+     * compartment's GC things. This counter should be used in preference to
+     * gcMallocBytes. These counters affect collection in the same way as
+     * gcBytes and gcTriggerBytes.
+     */
+    size_t                       gcMallocAndFreeBytes;
+    size_t                       gcTriggerMallocAndFreeBytes;
+
   private:
+    /*
+     * Malloc counter to measure memory pressure for GC scheduling. It runs from
+     * gcMaxMallocBytes down to zero. This counter should be used only when it's
+     * not possible to know the size of a free.
+     */
+    ptrdiff_t                    gcMallocBytes;
+
     enum { DebugFromC = 1, DebugFromJS = 2 };
 
-    unsigned                        debugModeBits;  // see debugMode() below
-    
-    /*
-     * Malloc counter to measure memory pressure for GC scheduling. It runs
-     * from gcMaxMallocBytes down to zero.
-     */
-    volatile ptrdiff_t           gcMallocBytes;
+    unsigned                     debugModeBits;  // see debugMode() below
 
   public:
     js::NativeIterCache          nativeIterCache;
@@ -340,9 +341,9 @@ struct JSCompartment
     void sweep(JSContext *cx, bool releaseTypes);
     void purge();
 
-    void setGCLastBytes(size_t lastBytes, js::JSGCInvocationKind gckind);
+    void setGCLastBytes(size_t lastBytes, size_t lastMallocBytes, js::JSGCInvocationKind gckind);
     void reduceGCTriggerBytes(size_t amount);
-    
+
     void resetGCMallocBytes();
     void setGCMaxMallocBytes(size_t value);
     void updateMallocCounter(size_t nbytes) {
@@ -352,9 +353,18 @@ struct JSCompartment
         if (JS_UNLIKELY(newCount <= 0 && oldCount > 0))
             onTooMuchMalloc();
     }
-    
+
     void onTooMuchMalloc();
 
+    void mallocInCompartment(size_t nbytes) {
+        gcMallocAndFreeBytes += nbytes;
+    }
+
+    void freeInCompartment(size_t nbytes) {
+        JS_ASSERT(gcMallocAndFreeBytes >= nbytes);
+        gcMallocAndFreeBytes -= nbytes;
+    }
+
     js::DtoaCache dtoaCache;
 
   private:
diff --git a/js/src/jsexn.cpp b/js/src/jsexn.cpp
index c6180b2ce33..3c83f78e55d 100644
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -304,8 +304,7 @@ InitExnPrivate(JSContext *cx, JSObject *exnObject, JSString *message,
     JS_ASSERT(exnObject->isError());
     JS_ASSERT(!exnObject->getPrivate());
 
-    JSSecurityCallbacks *callbacks = JS_GetSecurityCallbacks(cx);
-    JSCheckAccessOp checkAccess = callbacks ? callbacks->checkObjectAccess : NULL;
+    JSCheckAccessOp checkAccess = cx->runtime->securityCallbacks->checkObjectAccess;
 
     Vector<JSStackTraceElem> frames(cx);
     Vector<Value> values(cx);
@@ -443,7 +442,7 @@ SetExnPrivate(JSContext *cx, JSObject *exnObject, JSExnPrivate *priv)
     JS_ASSERT(exnObject->isError());
     if (JSErrorReport *report = priv->errorReport) {
         if (JSPrincipals *prin = report->originPrincipals)
-            JSPRINCIPALS_HOLD(cx, prin);
+            JS_HoldPrincipals(prin);
     }
     exnObject->setPrivate(priv);
 }
@@ -455,7 +454,7 @@ exn_finalize(JSContext *cx, JSObject *obj)
         if (JSErrorReport *report = priv->errorReport) {
             /* HOLD called by SetExnPrivate. */
             if (JSPrincipals *prin = report->originPrincipals)
-                JSPRINCIPALS_DROP(cx, prin);
+                JS_DropPrincipals(cx->runtime, prin);
             cx->free_(report);
         }
         cx->free_(priv);
@@ -1084,7 +1083,7 @@ js_ErrorToException(JSContext *cx, const char *message, JSErrorReport *reportp,
      */
     JS_ASSERT(reportp);
     if (JSREPORT_IS_WARNING(reportp->flags))
-        return false;
+        return JS_FALSE;
 
     /* Find the exception index associated with this error. */
     errorNumber = (JSErrNum) reportp->errorNumber;
@@ -1107,12 +1106,19 @@ js_ErrorToException(JSContext *cx, const char *message, JSErrorReport *reportp,
      * with the given error number.
      */
     if (exn == JSEXN_NONE)
-        return false;
+        return JS_FALSE;
 
-    /* Prevent infinite recursion. */
+    /*
+     * Prevent runaway recursion, via cx->generatingError.  If an out-of-memory
+     * error occurs, no exception object will be created, but we don't assume
+     * that OOM is the only kind of error that subroutines of this function
+     * called below might raise.
+     */
     if (cx->generatingError)
-        return false;
-    AutoScopedAssign<bool> asa(&cx->generatingError, false);
+        return JS_FALSE;
+
+    MUST_FLOW_THROUGH("out");
+    cx->generatingError = JS_TRUE;
 
     /* Protect the newly-created strings below from nesting GCs. */
     PodArrayZero(tv);
@@ -1125,34 +1131,43 @@ js_ErrorToException(JSContext *cx, const char *message, JSErrorReport *reportp,
      */
     ok = js_GetClassPrototype(cx, NULL, GetExceptionProtoKey(exn), &errProto);
     if (!ok)
-        return false;
+        goto out;
     tv[0] = OBJECT_TO_JSVAL(errProto);
 
     errObject = NewObjectWithGivenProto(cx, &ErrorClass, errProto, NULL);
-    if (!errObject)
-        return false;
+    if (!errObject) {
+        ok = JS_FALSE;
+        goto out;
+    }
     tv[1] = OBJECT_TO_JSVAL(errObject);
 
     messageStr = JS_NewStringCopyZ(cx, message);
-    if (!messageStr)
-        return false;
+    if (!messageStr) {
+        ok = JS_FALSE;
+        goto out;
+    }
     tv[2] = STRING_TO_JSVAL(messageStr);
 
     filenameStr = JS_NewStringCopyZ(cx, reportp->filename);
-    if (!filenameStr)
-        return false;
+    if (!filenameStr) {
+        ok = JS_FALSE;
+        goto out;
+    }
     tv[3] = STRING_TO_JSVAL(filenameStr);
 
     ok = InitExnPrivate(cx, errObject, messageStr, filenameStr,
                         reportp->lineno, reportp, exn);
     if (!ok)
-        return false;
+        goto out;
 
     JS_SetPendingException(cx, OBJECT_TO_JSVAL(errObject));
 
     /* Flag the error report passed in to indicate an exception was raised. */
     reportp->flags |= JSREPORT_EXCEPTION;
-    return true;
+
+out:
+    cx->generatingError = JS_FALSE;
+    return ok;
 }
 
 JSBool
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index e9f8d0590fa..f4bd7aa1611 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -609,29 +609,6 @@ js::DumpHeapComplete(JSRuntime *rt, FILE *fp)
 
 namespace js {
 
-/* static */ void
-AutoLockGC::LockGC(JSRuntime *rt)
-{
-    JS_ASSERT(rt);
-    JS_LOCK_GC(rt);
-}
-
-/* static */ void
-AutoLockGC::UnlockGC(JSRuntime *rt)
-{
-    JS_ASSERT(rt);
-    JS_UNLOCK_GC(rt);
-}
-
-void
-AutoLockGC::lock(JSRuntime *rt)
-{
-    JS_ASSERT(rt);
-    JS_ASSERT(!runtime);
-    runtime = rt;
-    JS_LOCK_GC(rt);
-}
-
 JS_FRIEND_API(const JSStructuredCloneCallbacks *)
 GetContextStructuredCloneCallbacks(JSContext *cx)
 {
@@ -674,12 +651,6 @@ GetContextOutstandingRequests(const JSContext *cx)
     return cx->outstandingRequests;
 }
 
-JS_FRIEND_API(PRLock *)
-GetRuntimeGCLock(const JSRuntime *rt)
-{
-    return rt->gcLock;
-}
-
 AutoSkipConservativeScan::AutoSkipConservativeScan(JSContext *cx
                                                    MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
   : context(cx)
@@ -726,12 +697,6 @@ IsContextRunningJS(JSContext *cx)
     return !cx->stack.empty();
 }
 
-JS_FRIEND_API(void)
-TriggerOperationCallback(JSRuntime *rt)
-{
-    rt->triggerOperationCallback();
-}
-
 JS_FRIEND_API(const CompartmentVector&)
 GetRuntimeCompartments(JSRuntime *rt)
 {
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index a2273d29929..b4d2f041826 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -187,8 +187,6 @@ JS_END_EXTERN_C
 
 #ifdef __cplusplus
 
-struct PRLock;
-
 namespace js {
 
 struct ContextFriendFields {
@@ -573,9 +571,6 @@ GetOwnerThread(const JSContext *cx);
 JS_FRIEND_API(unsigned)
 GetContextOutstandingRequests(const JSContext *cx);
 
-JS_FRIEND_API(PRLock *)
-GetRuntimeGCLock(const JSRuntime *rt);
-
 class JS_FRIEND_API(AutoSkipConservativeScan)
 {
   public:
@@ -600,43 +595,11 @@ typedef void
 /*
  * Sets a callback that is run whenever the runtime goes idle - the
  * last active request ceases - and begins activity - when it was
- * idle and a request begins. Note: The callback is called under the
- * GC lock.
+ * idle and a request begins.
  */
 JS_FRIEND_API(void)
 SetActivityCallback(JSRuntime *rt, ActivityCallback cb, void *arg);
 
-class JS_FRIEND_API(AutoLockGC)
-{
-  public:
-    explicit AutoLockGC(JSRuntime *rt = NULL
-                        MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-      : runtime(rt)
-    {
-        MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-        if (rt)
-            LockGC(rt);
-    }
-
-    ~AutoLockGC()
-    {
-        if (runtime)
-            UnlockGC(runtime);
-    }
-
-    bool locked() const {
-        return !!runtime;
-    }
-    void lock(JSRuntime *rt);
-
-  private:
-    static void LockGC(JSRuntime *rt);
-    static void UnlockGC(JSRuntime *rt);
-
-    JSRuntime *runtime;
-    MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
-};
-
 extern JS_FRIEND_API(const JSStructuredCloneCallbacks *)
 GetContextStructuredCloneCallbacks(JSContext *cx);
 
@@ -652,10 +615,6 @@ CallContextDebugHandler(JSContext *cx, JSScript *script, jsbytecode *bc, Value *
 extern JS_FRIEND_API(bool)
 IsContextRunningJS(JSContext *cx);
 
-/* Must be called with GC lock taken. */
-extern JS_FRIEND_API(void)
-TriggerOperationCallback(JSRuntime *rt);
-
 class SystemAllocPolicy;
 typedef Vector<JSCompartment*, 0, SystemAllocPolicy> CompartmentVector;
 extern JS_FRIEND_API(const CompartmentVector&)
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index ba36807a735..32e58abb2bb 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1308,15 +1308,6 @@ js_AddGCThingRoot(JSContext *cx, void **rp, const char *name)
 JS_FRIEND_API(JSBool)
 js_AddRootRT(JSRuntime *rt, jsval *vp, const char *name)
 {
-    /*
-     * Due to the long-standing, but now removed, use of rt->gcLock across the
-     * bulk of js::GC, API users have come to depend on JS_AddRoot etc. locking
-     * properly with a racing GC, without calling JS_AddRoot from a request.
-     * We have to preserve API compatibility here, now that we avoid holding
-     * rt->gcLock across the mark phase (including the root hashtable mark).
-     */
-    AutoLockGC lock(rt);
-
     return !!rt->gcRootsHash.put((void *)vp,
                                  RootInfo(name, JS_GC_ROOT_VALUE_PTR));
 }
@@ -1324,15 +1315,6 @@ js_AddRootRT(JSRuntime *rt, jsval *vp, const char *name)
 JS_FRIEND_API(JSBool)
 js_AddGCThingRootRT(JSRuntime *rt, void **rp, const char *name)
 {
-    /*
-     * Due to the long-standing, but now removed, use of rt->gcLock across the
-     * bulk of js::GC, API users have come to depend on JS_AddRoot etc. locking
-     * properly with a racing GC, without calling JS_AddRoot from a request.
-     * We have to preserve API compatibility here, now that we avoid holding
-     * rt->gcLock across the mark phase (including the root hashtable mark).
-     */
-    AutoLockGC lock(rt);
-
     return !!rt->gcRootsHash.put((void *)rp,
                                  RootInfo(name, JS_GC_ROOT_GCTHING_PTR));
 }
@@ -1340,11 +1322,6 @@ js_AddGCThingRootRT(JSRuntime *rt, void **rp, const char *name)
 JS_FRIEND_API(JSBool)
 js_RemoveRoot(JSRuntime *rt, void *rp)
 {
-    /*
-     * Due to the JS_RemoveRootRT API, we may be called outside of a request.
-     * Same synchronization drill as above in js_AddRoot.
-     */
-    AutoLockGC lock(rt);
     rt->gcRootsHash.remove(rp);
     rt->gcPoke = JS_TRUE;
     return JS_TRUE;
@@ -1404,7 +1381,6 @@ js_DumpNamedRoots(JSRuntime *rt,
 uint32_t
 js_MapGCRoots(JSRuntime *rt, JSGCRootMapFun map, void *data)
 {
-    AutoLockGC lock(rt);
     int ct = 0;
     for (RootEnum e(rt->gcRootsHash); !e.empty(); e.popFront()) {
         RootEntry &entry = e.front();
@@ -1421,14 +1397,19 @@ js_MapGCRoots(JSRuntime *rt, JSGCRootMapFun map, void *data)
     return ct;
 }
 
-void
-JSCompartment::setGCLastBytes(size_t lastBytes, JSGCInvocationKind gckind)
+static size_t
+ComputeTriggerBytes(size_t lastBytes, size_t maxBytes, JSGCInvocationKind gckind)
 {
-    gcLastBytes = lastBytes;
-
     size_t base = gckind == GC_SHRINK ? lastBytes : Max(lastBytes, GC_ALLOCATION_THRESHOLD);
     float trigger = float(base) * GC_HEAP_GROWTH_FACTOR;
-    gcTriggerBytes = size_t(Min(float(rt->gcMaxBytes), trigger));
+    return size_t(Min(float(maxBytes), trigger));
+}
+
+void
+JSCompartment::setGCLastBytes(size_t lastBytes, size_t lastMallocBytes, JSGCInvocationKind gckind)
+{
+    gcTriggerBytes = ComputeTriggerBytes(lastBytes, rt->gcMaxBytes, gckind);
+    gcTriggerMallocAndFreeBytes = ComputeTriggerBytes(lastMallocBytes, SIZE_MAX, gckind);
 }
 
 void
@@ -1790,7 +1771,6 @@ js_LockGCThingRT(JSRuntime *rt, void *thing)
     if (!thing)
         return true;
 
-    AutoLockGC lock(rt);
     if (GCLocks::Ptr p = rt->gcLocksHash.lookupWithDefault(thing, 0)) {
         p->value++;
         return true;
@@ -1805,10 +1785,7 @@ js_UnlockGCThingRT(JSRuntime *rt, void *thing)
     if (!thing)
         return;
 
-    AutoLockGC lock(rt);
-    GCLocks::Ptr p = rt->gcLocksHash.lookup(thing);
-
-    if (p) {
+    if (GCLocks::Ptr p = rt->gcLocksHash.lookup(thing)) {
         rt->gcPoke = true;
         if (--p->value == 0)
             rt->gcLocksHash.remove(p);
@@ -2412,6 +2389,7 @@ MarkRuntime(JSTracer *trc, bool useSavedRoots = false)
         }
     }
 }
+
 void
 TriggerGC(JSRuntime *rt, gcreason::Reason reason)
 {
@@ -2458,7 +2436,7 @@ TriggerCompartmentGC(JSCompartment *comp, gcreason::Reason reason)
     rt->gcIsNeeded = true;
     rt->gcTriggerCompartment = comp;
     rt->gcTriggerReason = reason;
-    comp->rt->triggerOperationCallback();
+    rt->triggerOperationCallback();
 }
 
 void
@@ -2487,6 +2465,11 @@ MaybeGC(JSContext *cx)
         return;
     }
 
+    if (comp->gcMallocAndFreeBytes >= comp->gcTriggerMallocAndFreeBytes) {
+        GCSlice(cx, comp, GC_NORMAL, gcreason::MAYBEGC);
+        return;
+    }
+
     /*
      * Access to the counters and, on 32 bit, setting gcNextFullGCTime below
      * is not atomic and a race condition could trigger or suppress the GC. We
@@ -2932,7 +2915,7 @@ SweepCompartments(JSContext *cx, JSGCInvocationKind gckind)
             if (callback)
                 JS_ALWAYS_TRUE(callback(cx, compartment, JSCOMPARTMENT_DESTROY));
             if (compartment->principals)
-                JSPRINCIPALS_DROP(cx, compartment->principals);
+                JS_DropPrincipals(rt, compartment->principals);
             cx->delete_(compartment);
             continue;
         }
@@ -3272,7 +3255,7 @@ SweepPhase(JSContext *cx, JSGCInvocationKind gckind)
     }
 
     for (CompartmentsIter c(rt); !c.done(); c.next())
-        c->setGCLastBytes(c->gcBytes, gckind);
+        c->setGCLastBytes(c->gcBytes, c->gcMallocAndFreeBytes, gckind);
 }
 
 /* Perform mark-and-sweep GC. If comp is set, we perform a single-compartment GC. */
@@ -3922,10 +3905,10 @@ NewCompartment(JSContext *cx, JSPrincipals *principals)
         compartment->isSystemCompartment = principals && rt->trustedPrincipals() == principals;
         if (principals) {
             compartment->principals = principals;
-            JSPRINCIPALS_HOLD(cx, principals);
+            JS_HoldPrincipals(principals);
         }
 
-        compartment->setGCLastBytes(8192, GC_NORMAL);
+        compartment->setGCLastBytes(8192, 8192, GC_NORMAL);
 
         /*
          * Before reporting the OOM condition, |lock| needs to be cleaned up,
@@ -4506,7 +4489,6 @@ JS_FRIEND_API(void)
 StartPCCountProfiling(JSContext *cx)
 {
     JSRuntime *rt = cx->runtime;
-    AutoLockGC lock(rt);
 
     if (rt->profilingScripts)
         return;
@@ -4523,7 +4505,6 @@ JS_FRIEND_API(void)
 StopPCCountProfiling(JSContext *cx)
 {
     JSRuntime *rt = cx->runtime;
-    AutoLockGC lock(rt);
 
     if (!rt->profilingScripts)
         return;
@@ -4556,7 +4537,6 @@ JS_FRIEND_API(void)
 PurgePCCounts(JSContext *cx)
 {
     JSRuntime *rt = cx->runtime;
-    AutoLockGC lock(rt);
 
     if (!rt->scriptPCCounters)
         return;
@@ -4575,6 +4555,10 @@ JS_IterateCompartments(JSRuntime *rt, void *data,
 
     AutoLockGC lock(rt);
     AutoHeapSession session(rt);
+#ifdef JS_THREADSAFE
+    rt->gcHelperThread.waitBackgroundSweepOrAllocEnd();
+#endif
+    AutoUnlockGC unlock(rt);
 
     for (CompartmentsIter c(rt); !c.done(); c.next())
         (*compartmentCallback)(rt, data, c);
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index d344b888d35..a36d154edea 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -2179,17 +2179,6 @@ TypeCompartment::nukeTypes(JSContext *cx)
         pendingRecompiles = NULL;
     }
 
-    /*
-     * We may or may not be under the GC. In either case don't allocate, and
-     * acquire the GC lock so we can update inferenceEnabled for all contexts.
-     */
-
-#ifdef JS_THREADSAFE
-    AutoLockGC maybeLock;
-    if (!cx->runtime->gcRunning)
-        maybeLock.lock(cx->runtime);
-#endif
-
     inferenceEnabled = false;
 
     /* Update the cached inferenceEnabled bit in all contexts. */
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 96ed1a0b741..0b8e68a8bdb 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -2561,45 +2561,17 @@ BEGIN_CASE(JSOP_SETMETHOD)
 END_CASE(JSOP_SETPROP)
 
 BEGIN_CASE(JSOP_GETELEM)
+BEGIN_CASE(JSOP_CALLELEM)
 {
     Value &lref = regs.sp[-2];
     Value &rref = regs.sp[-1];
-    if (!GetElementOperation(cx, lref, rref, &regs.sp[-2]))
+    if (!GetElementOperation(cx, op, lref, rref, &regs.sp[-2]))
         goto error;
     TypeScript::Monitor(cx, script, regs.pc, regs.sp[-2]);
     regs.sp--;
 }
 END_CASE(JSOP_GETELEM)
 
-BEGIN_CASE(JSOP_CALLELEM)
-{
-    /* Find the object on which to look for |this|'s properties. */
-    Value thisv = regs.sp[-2];
-    JSObject *thisObj = ValuePropertyBearer(cx, regs.fp(), thisv, -2);
-    if (!thisObj)
-        goto error;
-
-    /* Fetch index and convert it to id suitable for use with obj. */
-    jsid id;
-    FETCH_ELEMENT_ID(thisObj, -1, id);
-
-    /* Get the method. */
-    if (!js_GetMethod(cx, thisObj, id, JSGET_NO_METHOD_BARRIER, &regs.sp[-2]))
-        goto error;
-
-#if JS_HAS_NO_SUCH_METHOD
-    if (JS_UNLIKELY(regs.sp[-2].isPrimitive()) && thisv.isObject()) {
-        if (!OnUnknownMethod(cx, &thisv.toObject(), regs.sp[-1], regs.sp - 2))
-            goto error;
-    }
-#endif
-
-    regs.sp--;
-
-    TypeScript::Monitor(cx, script, regs.pc, regs.sp[-1]);
-}
-END_CASE(JSOP_CALLELEM)
-
 BEGIN_CASE(JSOP_SETELEM)
 {
     JSObject *obj;
diff --git a/js/src/jsinterpinlines.h b/js/src/jsinterpinlines.h
index 9c11ef007a2..84b1cee5d1e 100644
--- a/js/src/jsinterpinlines.h
+++ b/js/src/jsinterpinlines.h
@@ -702,8 +702,17 @@ ToIdOperation(JSContext *cx, const Value &objval, const Value &idval, Value *res
 }
 
 static JS_ALWAYS_INLINE bool
-GetObjectElementOperation(JSContext *cx, JSObject *obj, const Value &rref, Value *res)
+GetObjectElementOperation(JSContext *cx, JSOp op, JSObject *obj, const Value &rref, Value *res)
 {
+#if JS_HAS_XML_SUPPORT
+    if (op == JSOP_CALLELEM && JS_UNLIKELY(obj->isXML())) {
+        jsid id;
+        if (!FetchElementId(cx, obj, rref, id, res))
+            return false;
+        return js_GetXMLMethod(cx, obj, id, res);
+    }
+#endif
+
     uint32_t index;
     if (IsDefinitelyIndex(rref, &index)) {
         do {
@@ -753,8 +762,10 @@ GetObjectElementOperation(JSContext *cx, JSObject *obj, const Value &rref, Value
 }
 
 static JS_ALWAYS_INLINE bool
-GetElementOperation(JSContext *cx, const Value &lref, const Value &rref, Value *res)
+GetElementOperation(JSContext *cx, JSOp op, const Value &lref, const Value &rref, Value *res)
 {
+    JS_ASSERT(op == JSOP_GETELEM || op == JSOP_CALLELEM);
+
     if (lref.isString() && rref.isInt32()) {
         JSString *str = lref.toString();
         int32_t i = rref.toInt32();
@@ -776,10 +787,20 @@ GetElementOperation(JSContext *cx, const Value &lref, const Value &rref, Value *
         JS_ASSERT(!lref.isMagic(JS_LAZY_ARGUMENTS));
     }
 
+    bool isObject = lref.isObject();
     JSObject *obj = ValueToObject(cx, lref);
     if (!obj)
         return false;
-    return GetObjectElementOperation(cx, obj, rref, res);
+    if (!GetObjectElementOperation(cx, op, obj, rref, res))
+        return false;
+
+#if JS_HAS_NO_SUCH_METHOD
+    if (op == JSOP_CALLELEM && JS_UNLIKELY(res->isPrimitive()) && isObject) {
+        if (!OnUnknownMethod(cx, obj, rref, res))
+            return false;
+    }
+#endif
+    return true;
 }
 
 static JS_ALWAYS_INLINE bool
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index f1eef386499..e7385d1277e 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -789,15 +789,15 @@ EvalCacheLookup(JSContext *cx, JSLinearString *str, StackFrame *caller, unsigned
 
     JSVersion version = cx->findVersion();
     JSScript *script;
+    JSSubsumePrincipalsOp subsume = cx->runtime->securityCallbacks->subsumePrincipals;
     while ((script = *scriptp) != NULL) {
         if (script->savedCallerFun &&
             script->staticLevel == staticLevel &&
             script->getVersion() == version &&
             !script->hasSingletons &&
-            (script->principals == principals ||
-             (principals && script->principals &&
-              principals->subsume(principals, script->principals) &&
-              script->principals->subsume(script->principals, principals)))) {
+            (!subsume || script->principals == principals ||
+             (subsume(principals, script->principals) &&
+              subsume(script->principals, principals)))) {
             /*
              * Get the prior (cache-filling) eval's saved caller function.
              * See frontend::CompileScript.
@@ -1163,12 +1163,14 @@ obj_watch_handler(JSContext *cx, JSObject *obj, jsid id, jsval old,
                   jsval *nvp, void *closure)
 {
     JSObject *callable = (JSObject *) closure;
-    if (JSPrincipals *watcher = callable->principals(cx)) {
-        if (JSObject *scopeChain = cx->stack.currentScriptedScopeChain()) {
-            if (JSPrincipals *subject = scopeChain->principals(cx)) {
-                if (!watcher->subsume(watcher, subject)) {
-                    /* Silently don't call the watch handler. */
-                    return JS_TRUE;
+    if (JSSubsumePrincipalsOp subsume = cx->runtime->securityCallbacks->subsumePrincipals) {
+        if (JSPrincipals *watcher = callable->principals(cx)) {
+            if (JSObject *scopeChain = cx->stack.currentScriptedScopeChain()) {
+                if (JSPrincipals *subject = scopeChain->principals(cx)) {
+                    if (!subsume(watcher, subject)) {
+                        /* Silently don't call the watch handler. */
+                        return true;
+                    }
                 }
             }
         }
@@ -5881,10 +5883,7 @@ CheckAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode,
     JSBool writing;
     JSObject *pobj;
     JSProperty *prop;
-    Class *clasp;
     const Shape *shape;
-    JSSecurityCallbacks *callbacks;
-    JSCheckAccessOp check;
 
     while (JS_UNLIKELY(obj->isWith()))
         obj = obj->getProto();
@@ -5948,12 +5947,9 @@ CheckAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode,
      * hook.  This covers precompilation-based sharing and (possibly
      * unintended) runtime sharing across trust boundaries.
      */
-    clasp = pobj->getClass();
-    check = clasp->checkAccess;
-    if (!check) {
-        callbacks = JS_GetSecurityCallbacks(cx);
-        check = callbacks ? callbacks->checkObjectAccess : NULL;
-    }
+    JSCheckAccessOp check = pobj->getClass()->checkAccess;
+    if (!check)
+        check = cx->runtime->securityCallbacks->checkObjectAccess;
     return !check || check(cx, pobj, id, mode, vp);
 }
 
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index 1224884999d..8067516d56b 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -774,6 +774,7 @@ struct JSObject : public js::ObjectImpl
     inline bool hasPrivate() const;
     inline void *getPrivate() const;
     inline void setPrivate(void *data);
+    inline void setPrivateUnbarriered(void *data);
     inline void initPrivate(void *data);
 
     /* Access private data for an object with a known number of fixed slots. */
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 5fe9f8a4df4..4f62733e014 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -121,6 +121,13 @@ JSObject::setPrivate(void *data)
     privateWriteBarrierPost(pprivate);
 }
 
+inline void
+JSObject::setPrivateUnbarriered(void *data)
+{
+    void **pprivate = &privateRef(numFixedSlots());
+    *pprivate = data;
+}
+
 inline void
 JSObject::initPrivate(void *data)
 {
@@ -1111,9 +1118,8 @@ JSObject::isCallable()
 inline JSPrincipals *
 JSObject::principals(JSContext *cx)
 {
-    JSSecurityCallbacks *cb = JS_GetSecurityCallbacks(cx);
-    if (JSObjectPrincipalsFinder finder = cb ? cb->findObjectPrincipals : NULL)
-        return finder(cx, this);
+    if (JSObjectPrincipalsFinder find = cx->runtime->securityCallbacks->findObjectPrincipals)
+        return find(this);
     return cx->compartment ? cx->compartment->principals : NULL;
 }
 
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index fd4fa7036c2..2440f3656a3 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -703,11 +703,11 @@ XDRScript(JSXDRState *xdr, JSScript **scriptp)
         JS_ASSERT_IF(script->principals, script->originPrincipals);
         if (xdr->principals) {
             script->principals = xdr->principals;
-            JSPRINCIPALS_HOLD(cx, xdr->principals);
+            JS_HoldPrincipals(xdr->principals);
         }
         if (xdr->originPrincipals) {
             script->originPrincipals = xdr->originPrincipals;
-            JSPRINCIPALS_HOLD(cx, xdr->originPrincipals);
+            JS_HoldPrincipals(xdr->originPrincipals);
         }
     }
 
@@ -1256,14 +1256,14 @@ JSScript::NewScriptFromEmitter(JSContext *cx, BytecodeEmitter *bce)
     script->principals = bce->parser->principals;
 
     if (script->principals)
-        JSPRINCIPALS_HOLD(cx, script->principals);
+        JS_HoldPrincipals(script->principals);
 
     /* Establish invariant: principals implies originPrincipals. */
     script->originPrincipals = bce->parser->originPrincipals;
     if (!script->originPrincipals)
         script->originPrincipals = script->principals;
     if (script->originPrincipals)
-        JSPRINCIPALS_HOLD(cx, script->originPrincipals);
+        JS_HoldPrincipals(script->originPrincipals);
 
     script->sourceMap = (jschar *) bce->parser->tokenStream.releaseSourceMap();
 
@@ -1462,9 +1462,9 @@ JSScript::finalize(JSContext *cx, bool background)
 
     JS_ASSERT_IF(principals, originPrincipals);
     if (principals)
-        JSPRINCIPALS_DROP(cx, principals);
+        JS_DropPrincipals(cx->runtime, principals);
     if (originPrincipals)
-        JSPRINCIPALS_DROP(cx, originPrincipals);
+        JS_DropPrincipals(cx->runtime, originPrincipals);
 
     if (types)
         types->destroy();
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index ec570757ebc..5c412d0dd0d 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -3265,26 +3265,6 @@ js::ToStringSlow(JSContext *cx, const Value &arg)
     return str;
 }
 
-/* This function implements E-262-3 section 9.8, toString. */
-bool
-js::ValueToStringBufferSlow(JSContext *cx, const Value &arg, StringBuffer &sb)
-{
-    Value v = arg;
-    if (!ToPrimitive(cx, JSTYPE_STRING, &v))
-        return false;
-
-    if (v.isString())
-        return sb.append(v.toString());
-    if (v.isNumber())
-        return NumberValueToStringBuffer(cx, v, sb);
-    if (v.isBoolean())
-        return BooleanToStringBuffer(cx, v.toBoolean(), sb);
-    if (v.isNull())
-        return sb.append(cx->runtime->atomState.nullAtom);
-    JS_ASSERT(v.isUndefined());
-    return sb.append(cx->runtime->atomState.typeAtoms[JSTYPE_VOID]);
-}
-
 JS_FRIEND_API(JSString *)
 js_ValueToSource(JSContext *cx, const Value &v)
 {
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 0e274733f91..e661d487ef3 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -332,7 +332,7 @@ ArrayBuffer::obj_trace(JSTracer *trc, JSObject *obj)
     JSObject *delegate = static_cast<JSObject*>(obj->getPrivate());
     if (delegate) {
         MarkObjectUnbarriered(trc, &delegate, "arraybuffer.delegate");
-        obj->setPrivate(delegate);
+        obj->setPrivateUnbarriered(delegate);
     }
 }
 
diff --git a/js/src/jsxdrapi.cpp b/js/src/jsxdrapi.cpp
index cfddb60323e..29b5572251d 100644
--- a/js/src/jsxdrapi.cpp
+++ b/js/src/jsxdrapi.cpp
@@ -559,7 +559,7 @@ XDRPrincipals(JSXDRState *xdr)
         return false;
 
     if (flags & (HAS_PRINCIPALS | HAS_ORIGIN)) {
-        JSSecurityCallbacks *scb = JS_GetSecurityCallbacks(xdr->cx);
+        const JSSecurityCallbacks *scb = JS_GetSecurityCallbacks(xdr->cx->runtime);
         if (xdr->mode == JSXDR_DECODE) {
             if (!scb || !scb->principalsTranscoder) {
                 JS_ReportErrorNumber(xdr->cx, js_GetErrorMessage, NULL,
@@ -581,7 +581,7 @@ XDRPrincipals(JSXDRState *xdr)
                 return false;
         } else if (xdr->mode == JSXDR_DECODE && xdr->principals) {
             xdr->originPrincipals = xdr->principals;
-            JSPRINCIPALS_HOLD(xdr->cx, xdr->principals);
+            JS_HoldPrincipals(xdr->principals);
         }
     }
 
@@ -599,9 +599,9 @@ struct AutoDropXDRPrincipals {
     ~AutoDropXDRPrincipals() {
         if (xdr->mode == JSXDR_DECODE) {
             if (xdr->principals)
-                JSPRINCIPALS_DROP(xdr->cx, xdr->principals);
+                JS_DropPrincipals(xdr->cx->runtime, xdr->principals);
             if (xdr->originPrincipals)
-                JSPRINCIPALS_DROP(xdr->cx, xdr->originPrincipals);
+                JS_DropPrincipals(xdr->cx->runtime, xdr->originPrincipals);
         }
         xdr->principals = NULL;
         xdr->originPrincipals = NULL;
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index a5b7ca90f31..04c339d8738 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -1213,25 +1213,29 @@ mjit::Compiler::ensureDoubleArguments()
 }
 
 void
-mjit::Compiler::markUndefinedLocals()
+mjit::Compiler::markUndefinedLocal(uint32_t offset, uint32_t i)
 {
     uint32_t depth = ssa.getFrame(a->inlineIndex).depth;
+    uint32_t slot = LocalSlot(script, i);
+    Address local(JSFrameReg, sizeof(StackFrame) + (depth + i) * sizeof(Value));
+    if (!cx->typeInferenceEnabled() || !analysis->trackSlot(slot)) {
+        masm.storeValue(UndefinedValue(), local);
+    } else {
+        Lifetime *lifetime = analysis->liveness(slot).live(offset);
+        if (lifetime)
+            masm.storeValue(UndefinedValue(), local);
+    }
+}
 
+void
+mjit::Compiler::markUndefinedLocals()
+{
     /*
      * Set locals to undefined, as in initCallFrameLatePrologue.
      * Skip locals which aren't closed and are known to be defined before used,
      */
-    for (uint32_t i = 0; i < script->nfixed; i++) {
-        uint32_t slot = LocalSlot(script, i);
-        Address local(JSFrameReg, sizeof(StackFrame) + (depth + i) * sizeof(Value));
-        if (!cx->typeInferenceEnabled() || !analysis->trackSlot(slot)) {
-            masm.storeValue(UndefinedValue(), local);
-        } else {
-            Lifetime *lifetime = analysis->liveness(slot).live(0);
-            if (lifetime)
-                masm.storeValue(UndefinedValue(), local);
-        }
-    }
+    for (uint32_t i = 0; i < script->nfixed; i++)
+        markUndefinedLocal(0, i);
 }
 
 CompileStatus
@@ -3050,6 +3054,10 @@ mjit::Compiler::generateMethod()
           {
             uint32_t slot = GET_SLOTNO(PC);
             JSFunction *fun = script->getFunction(GET_UINT32_INDEX(PC + SLOTNO_LEN));
+
+            /* See JSOP_DEFLOCALFUN. */
+            markUndefinedLocal(PC - script->code, slot);
+
             prepareStubCall(Uses(frame.frameSlots()));
             masm.move(ImmPtr(fun), Registers::ArgReg1);
             INLINE_STUBCALL(stubs::DefLocalFun_FC, REJOIN_DEFLOCALFUN);
@@ -3130,6 +3138,16 @@ mjit::Compiler::generateMethod()
           {
             uint32_t slot = GET_SLOTNO(PC);
             JSFunction *fun = script->getFunction(GET_UINT32_INDEX(PC + SLOTNO_LEN));
+
+            /*
+             * The liveness analysis will report that the value in |slot| is
+             * defined at the start of this opcode. However, we don't actually
+             * fill it in until the stub returns. This will cause a problem if
+             * we GC inside the stub. So we write a safe value here so that the
+             * GC won't crash.
+             */
+            markUndefinedLocal(PC - script->code, slot);
+
             prepareStubCall(Uses(0));
             masm.move(ImmPtr(fun), Registers::ArgReg1);
             INLINE_STUBCALL(stubs::DefLocalFun, REJOIN_DEFLOCALFUN);
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index d93f3fc3d09..4c0218f850f 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -574,6 +574,7 @@ private:
     /* Analysis helpers. */
     CompileStatus prepareInferenceTypes(JSScript *script, ActiveFrame *a);
     void ensureDoubleArguments();
+    void markUndefinedLocal(uint32_t offset, uint32_t i);
     void markUndefinedLocals();
     void fixDoubleTypes(jsbytecode *target);
     void watchGlobalReallocation();
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index 3c5509c4303..36e33e5d992 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -2660,6 +2660,16 @@ ic::GetElement(VMFrame &f, ic::GetElementIC *ic)
     if (!obj)
         THROW();
 
+#if JS_HAS_XML_SUPPORT
+    // Some XML properties behave differently when accessed in a call vs. normal
+    // context, so we fall back to stubs::GetElem.
+    if (obj->isXML()) {
+        ic->disable(f, "XML object");
+        stubs::GetElem(f);
+        return;
+    }
+#endif
+
     jsid id;
     if (idval.isInt32() && INT_FITS_IN_JSID(idval.toInt32())) {
         id = INT_TO_JSID(idval.toInt32());
@@ -2685,6 +2695,13 @@ ic::GetElement(VMFrame &f, ic::GetElementIC *ic)
 
     if (!obj->getGeneric(cx, id, &f.regs.sp[-2]))
         THROW();
+
+#if JS_HAS_NO_SUCH_METHOD
+    if (*f.pc() == JSOP_CALLELEM && JS_UNLIKELY(f.regs.sp[-2].isPrimitive())) {
+        if (!OnUnknownMethod(cx, obj, idval, &f.regs.sp[-2]))
+            THROW();
+    }
+#endif
 }
 
 #define APPLY_STRICTNESS(f, s)                          \
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index 2607c5bed26..91c88713a60 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -134,79 +134,12 @@ stubs::Name(VMFrame &f)
 void JS_FASTCALL
 stubs::GetElem(VMFrame &f)
 {
-    JSContext *cx = f.cx;
-    FrameRegs &regs = f.regs;
+    Value &lref = f.regs.sp[-2];
+    Value &rref = f.regs.sp[-1];
+    Value &rval = f.regs.sp[-2];
 
-    Value &lref = regs.sp[-2];
-    Value &rref = regs.sp[-1];
-    Value &rval = regs.sp[-2];
-    if (lref.isString() && rref.isInt32()) {
-        JSString *str = lref.toString();
-        int32_t i = rref.toInt32();
-        if ((size_t)i < str->length()) {
-            str = f.cx->runtime->staticStrings.getUnitStringForElement(cx, str, (size_t)i);
-            if (!str)
-                THROW();
-            rval.setString(str);
-            return;
-        }
-    }
-
-    if (lref.isMagic(JS_LAZY_ARGUMENTS)) {
-        if (rref.isInt32() && size_t(rref.toInt32()) < regs.fp()->numActualArgs()) {
-            rval = regs.fp()->canonicalActualArg(rref.toInt32());
-            return;
-        }
-        MarkArgumentsCreated(cx, f.script());
-        JS_ASSERT(!lref.isMagic(JS_LAZY_ARGUMENTS));
-    }
-
-    bool isObject = lref.isObject();
-    JSObject *obj = ValueToObject(cx, lref);
-    if (!obj)
+    if (!GetElementOperation(f.cx, JSOp(*f.pc()), lref, rref, &rval))
         THROW();
-
-    uint32_t index;
-    if (IsDefinitelyIndex(rref, &index)) {
-        if (obj->isDenseArray()) {
-            if (index < obj->getDenseArrayInitializedLength()) {
-                rval = obj->getDenseArrayElement(index);
-                if (!rval.isMagic())
-                    return;
-            }
-        } else if (obj->isArguments()) {
-            if (obj->asArguments().getElement(index, &rval))
-                return;
-        }
-
-        if (!obj->getElement(cx, index, &rval))
-            THROW();
-    } else {
-        SpecialId special;
-        if (ValueIsSpecial(obj, &rref, &special, cx)) {
-            if (!obj->getSpecial(cx, obj, special, &rval))
-                THROW();
-        } else {
-            JSAtom *name;
-            if (!js_ValueToAtom(cx, rref, &name))
-                THROW();
-
-            if (name->isIndex(&index)) {
-                if (!obj->getElement(cx, index, &rval))
-                    THROW();
-            } else {
-                if (!obj->getProperty(cx, name->asPropertyName(), &rval))
-                    THROW();
-            }
-        }
-    }
-
-#if JS_HAS_NO_SUCH_METHOD
-    if (*f.pc() == JSOP_CALLELEM && JS_UNLIKELY(rval.isPrimitive()) && isObject) {
-        if (!OnUnknownMethod(cx, obj, rref, &rval))
-            THROW();
-    }
-#endif
 }
 
 template<JSBool strict>
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index d2d06854a79..7e5edcc0227 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -3134,7 +3134,7 @@ CancelExecution(JSRuntime *rt)
     if (gWorkerThreadPool)
         js::workers::terminateAll(gWorkerThreadPool);
 #endif
-    JS_TriggerRuntimeOperationCallback(rt);
+    JS_TriggerOperationCallback(rt);
 
     static const char msg[] = "Script runs for too long, terminating.\n";
 #if defined(XP_UNIX) && !defined(JS_THREADSAFE)
@@ -4867,22 +4867,11 @@ MaybeOverrideOutFileFromEnv(const char* const envVar,
     }
 }
 
-JSBool
-ShellPrincipalsSubsume(JSPrincipals *, JSPrincipals *)
-{
-    return JS_TRUE;
-}
-
-JSPrincipals shellTrustedPrincipals = {
-    (char *)"[shell trusted principals]",
-    1,
-    NULL, /* nobody should be destroying this */
-    ShellPrincipalsSubsume
-};
+/* Set the initial counter to 1 so the principal will never be destroyed. */ 
+JSPrincipals shellTrustedPrincipals = { 1 };
 
 JSBool
-CheckObjectAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode,
-                  jsval *vp)
+CheckObjectAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode, jsval *vp)
 {
     return true;
 }
@@ -4891,6 +4880,7 @@ JSSecurityCallbacks securityCallbacks = {
     CheckObjectAccess,
     NULL,
     NULL,
+    NULL,
     NULL
 };
 
@@ -5033,7 +5023,7 @@ main(int argc, char **argv, char **envp)
     JS_SetGCParameter(rt, JSGC_MAX_BYTES, 0xffffffff);
 
     JS_SetTrustedPrincipals(rt, &shellTrustedPrincipals);
-    JS_SetRuntimeSecurityCallbacks(rt, &securityCallbacks);
+    JS_SetSecurityCallbacks(rt, &securityCallbacks);
 
     JS_SetNativeStackQuota(rt, gMaxStackSize);
 
diff --git a/js/src/shell/jsworkers.cpp b/js/src/shell/jsworkers.cpp
index b319254b2ff..963000fbbb8 100644
--- a/js/src/shell/jsworkers.cpp
+++ b/js/src/shell/jsworkers.cpp
@@ -827,7 +827,7 @@ class Worker MOZ_FINAL : public WorkerParent
         AutoLock hold(lock);
         terminateFlag = true;
         if (current)
-            JS_TriggerOperationCallback(context);
+            JS_TriggerOperationCallback(runtime);
     }
 
     void notifyTerminating() {
diff --git a/js/src/tests/ecma_5/misc/future-reserved-words.js b/js/src/tests/ecma_5/misc/future-reserved-words.js
index 207e74916d4..f87d7726109 100644
--- a/js/src/tests/ecma_5/misc/future-reserved-words.js
+++ b/js/src/tests/ecma_5/misc/future-reserved-words.js
@@ -21,6 +21,7 @@ var futureReservedWords =
    "export",
    "extends",
    "import",
+   "let",  // Reserved even for versionless code, contrary to ES5 - see bug 730139
    "super",
   ];
 
@@ -28,7 +29,6 @@ var strictFutureReservedWords =
   [
    "implements",
    "interface",
-   "let", // enabled: this file doesn't execute as JS1.7
    "package",
    "private",
    "protected",
diff --git a/js/src/tests/js1_5/LexicalConventions/jstests.list b/js/src/tests/js1_5/LexicalConventions/jstests.list
index 59b681c3c71..61a2fb22d27 100644
--- a/js/src/tests/js1_5/LexicalConventions/jstests.list
+++ b/js/src/tests/js1_5/LexicalConventions/jstests.list
@@ -1,4 +1,5 @@
 url-prefix ../../jsreftest.html?test=js1_5/LexicalConventions/
+script let.js
 script lexical-001.js
 script regress-177314.js
 script regress-343675.js
diff --git a/js/src/tests/js1_5/LexicalConventions/let.js b/js/src/tests/js1_5/LexicalConventions/let.js
new file mode 100644
index 00000000000..b2d1b4568da
--- /dev/null
+++ b/js/src/tests/js1_5/LexicalConventions/let.js
@@ -0,0 +1,14 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var actual = 'No error';
+try {
+    eval("var let = true");
+} catch (exc) {
+    actual = exc + '';
+}
+
+reportCompare('SyntaxError: let is a reserved identifier', actual, 'ok'); 
+
diff --git a/js/src/tests/js1_5/Regress/regress-351515.js b/js/src/tests/js1_5/Regress/regress-351515.js
index 431c7b73cb7..3b85755ce08 100644
--- a/js/src/tests/js1_5/Regress/regress-351515.js
+++ b/js/src/tests/js1_5/Regress/regress-351515.js
@@ -47,7 +47,6 @@ test();
 //-----------------------------------------------------------------------------
 
 yield = 1;
-let   = 1;
 
 function test()
 {
@@ -55,10 +54,9 @@ function test()
   printBugNumber(BUGNUMBER);
   printStatus (summary);
  
-  function f(yield, let) { return yield+let; }
+  function f(yield) { return yield; }
 
   var yield = 1;
-  var let = 1;
 
   function yield() {}
 
diff --git a/js/src/tests/js1_6/extensions/regress-352392.js b/js/src/tests/js1_6/extensions/regress-352392.js
index e99313224cf..16f8c3700e7 100644
--- a/js/src/tests/js1_6/extensions/regress-352392.js
+++ b/js/src/tests/js1_6/extensions/regress-352392.js
@@ -52,7 +52,7 @@ function test()
   printBugNumber(BUGNUMBER);
   printStatus (summary);
 
-  expect = 'SyntaxError: invalid for each loop';
+  expect = 'SyntaxError: let is a reserved identifier';
   try
   {
     var obj = { };
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index a4e45665ccc..808a5c1b469 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -429,7 +429,6 @@ Debugger::Debugger(JSContext *cx, JSObject *dbg)
     assertSameCompartment(cx, dbg);
 
     JSRuntime *rt = cx->runtime;
-    AutoLockGC lock(rt);
     JS_APPEND_LINK(&link, &rt->debuggerList);
     JS_INIT_CLIST(&breakpoints);
 }
@@ -3215,7 +3214,7 @@ DebuggerObject_trace(JSTracer *trc, JSObject *obj)
          */
         if (JSObject *referent = (JSObject *) obj->getPrivate()) {
             MarkObjectUnbarriered(trc, &referent, "Debugger.Object referent");
-            obj->setPrivate(referent);
+            obj->setPrivateUnbarriered(referent);
         }
     }
 }
@@ -3859,7 +3858,7 @@ DebuggerEnv_trace(JSTracer *trc, JSObject *obj)
          */
         if (Env *referent = (JSObject *) obj->getPrivate()) {
             MarkObjectUnbarriered(trc, &referent, "Debugger.Environment referent");
-            obj->setPrivate(referent);
+            obj->setPrivateUnbarriered(referent);
         }
     }
 }
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index fa0946724ee..2b3201e72e0 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -386,15 +386,12 @@ GlobalObject::isRuntimeCodeGenEnabled(JSContext *cx)
 {
     HeapSlot &v = getSlotRef(RUNTIME_CODEGEN_ENABLED);
     if (v.isUndefined()) {
-        JSSecurityCallbacks *callbacks = JS_GetSecurityCallbacks(cx);
-
         /*
          * If there are callbacks, make sure that the CSP callback is installed
          * and that it permits runtime code generation, then cache the result.
          */
-        v.set(this, RUNTIME_CODEGEN_ENABLED,
-              BooleanValue((!callbacks || !callbacks->contentSecurityPolicyAllows) ||
-                           callbacks->contentSecurityPolicyAllows(cx)));
+        JSCSPEvalChecker allows = cx->runtime->securityCallbacks->contentSecurityPolicyAllows;
+        v.set(this, RUNTIME_CODEGEN_ENABLED, BooleanValue(!allows || allows(cx)));
     }
     return !v.isFalse();
 }
diff --git a/js/src/vm/StringBuffer-inl.h b/js/src/vm/StringBuffer-inl.h
index b8b79fe372c..907077e979d 100644
--- a/js/src/vm/StringBuffer-inl.h
+++ b/js/src/vm/StringBuffer-inl.h
@@ -67,6 +67,7 @@ StringBuffer::appendN(const jschar c, size_t n)
     return cb.appendN(c, n);
 }
 
+/* ES5 9.8 ToString, appending the result to the string buffer. */
 extern bool
 ValueToStringBufferSlow(JSContext *cx, const Value &v, StringBuffer &sb);
 
@@ -79,6 +80,13 @@ ValueToStringBuffer(JSContext *cx, const Value &v, StringBuffer &sb)
     return ValueToStringBufferSlow(cx, v, sb);
 }
 
+/* ES5 9.8 ToString for booleans, appending the result to the string buffer. */
+inline bool
+BooleanToStringBuffer(JSContext *cx, bool b, StringBuffer &sb)
+{
+    return b ? sb.append("true") : sb.append("false");
+}
+
 }  /* namespace js */
 
 #endif /* StringBuffer_inl_h__ */
diff --git a/js/src/vm/StringBuffer.cpp b/js/src/vm/StringBuffer.cpp
index dab55c083a7..3e608019635 100644
--- a/js/src/vm/StringBuffer.cpp
+++ b/js/src/vm/StringBuffer.cpp
@@ -6,6 +6,8 @@
 
 #include "vm/StringBuffer.h"
 
+#include "jsobjinlines.h"
+
 #include "vm/String-inl.h"
 #include "vm/StringBuffer-inl.h"
 
@@ -45,8 +47,7 @@ StringBuffer::finishString()
         return cx->runtime->atomState.emptyAtom;
 
     size_t length = cb.length();
-    if (!checkLength(length))
-        return NULL;
+    JS_ASSERT(checkLength(length));
 
     JS_STATIC_ASSERT(JSShortString::MAX_SHORT_LENGTH < CharBuffer::InlineLength);
     if (JSShortString::lengthFits(length))
@@ -78,3 +79,22 @@ StringBuffer::finishAtom()
     cb.clear();
     return atom;
 }
+
+bool
+js::ValueToStringBufferSlow(JSContext *cx, const Value &arg, StringBuffer &sb)
+{
+    Value v = arg;
+    if (!ToPrimitive(cx, JSTYPE_STRING, &v))
+        return false;
+
+    if (v.isString())
+        return sb.append(v.toString());
+    if (v.isNumber())
+        return NumberValueToStringBuffer(cx, v, sb);
+    if (v.isBoolean())
+        return BooleanToStringBuffer(cx, v.toBoolean(), sb);
+    if (v.isNull())
+        return sb.append(cx->runtime->atomState.nullAtom);
+    JS_ASSERT(v.isUndefined());
+    return sb.append(cx->runtime->atomState.typeAtoms[JSTYPE_VOID]);
+}
diff --git a/js/src/vm/StringBuffer.h b/js/src/vm/StringBuffer.h
index 6e8f96c3ab6..769b569dd23 100644
--- a/js/src/vm/StringBuffer.h
+++ b/js/src/vm/StringBuffer.h
@@ -26,10 +26,6 @@ namespace js {
  * Well-sized extractions (which waste no more than 1/4 of their char
  * buffer space) are guaranteed for strings built by this interface.
  * See |extractWellSized|.
- *
- * Note: over-allocation is not checked for when using the infallible
- * |replaceRawBuffer|, so the implementation of |finishString| also must check
- * for over-allocation.
  */
 class StringBuffer
 {
@@ -38,7 +34,6 @@ class StringBuffer
 
     CharBuffer cb;
 
-    static inline bool checkLength(JSContext *cx, size_t length);
     inline bool checkLength(size_t length);
     JSContext *context() const { return cb.allocPolicy().context(); }
     jschar *extractWellSized();
@@ -47,7 +42,8 @@ class StringBuffer
     void operator=(const StringBuffer &other) MOZ_DELETE;
 
   public:
-    explicit inline StringBuffer(JSContext *cx);
+    explicit StringBuffer(JSContext *cx) : cb(cx) { }
+
     inline bool reserve(size_t len);
     inline bool resize(size_t len);
     inline bool append(const jschar c);
@@ -58,6 +54,11 @@ class StringBuffer
     inline bool appendN(const jschar c, size_t n);
     inline bool appendInflated(const char *cstr, size_t len);
 
+    template <size_t ArrayLength>
+    bool append(const char (&array)[ArrayLength]) {
+        return cb.append(array, array + ArrayLength - 1); /* No trailing '\0'. */
+    }
+
     /* Infallible variants usable when the corresponding space is reserved. */
     void infallibleAppend(const jschar c) {
         cb.infallibleAppend(c);
@@ -72,11 +73,6 @@ class StringBuffer
         cb.infallibleAppendN(c, n);
     }
 
-    JSAtom *atomize(unsigned flags = 0);
-    static JSAtom *atomize(JSContext *cx, const CharBuffer &cb, unsigned flags = 0);
-    static JSAtom *atomize(JSContext *cx, const jschar *begin, size_t length, unsigned flags = 0);
-
-    void replaceRawBuffer(jschar *chars, size_t len) { cb.replaceRawBuffer(chars, len); }
     jschar *begin() { return cb.begin(); }
     jschar *end() { return cb.end(); }
     const jschar *begin() const { return cb.begin(); }
@@ -92,17 +88,14 @@ class StringBuffer
 
     /* Identical to finishString() except that an atom is created. */
     JSAtom *finishAtom();
-
-    template <size_t ArrayLength>
-    bool append(const char (&array)[ArrayLength]) {
-        return cb.append(array, array + ArrayLength - 1); /* No trailing '\0'. */
-    }
 };
 
-inline
-StringBuffer::StringBuffer(JSContext *cx)
-  : cb(cx)
-{}
+inline bool
+StringBuffer::append(JSLinearString *str)
+{
+    JS::Anchor<JSString *> anch(str);
+    return cb.append(str->chars(), str->length());
+}
 
 inline bool
 StringBuffer::append(JSString *str)
@@ -113,13 +106,6 @@ StringBuffer::append(JSString *str)
     return append(linear);
 }
 
-inline bool
-StringBuffer::append(JSLinearString *str)
-{
-    JS::Anchor<JSString *> anch(str);
-    return cb.append(str->chars(), str->length());
-}
-
 inline size_t
 StringBuffer::length() const
 {
diff --git a/js/xpconnect/loader/mozJSComponentLoader.cpp b/js/xpconnect/loader/mozJSComponentLoader.cpp
index 85eb682d27a..1cdd03dd854 100644
--- a/js/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/xpconnect/loader/mozJSComponentLoader.cpp
@@ -80,6 +80,7 @@
 #include "nsDOMFile.h"
 #include "jsxdrapi.h"
 #include "jsprf.h"
+#include "nsJSPrincipals.h"
 // For reporting errors with the console service
 #include "nsIScriptError.h"
 #include "nsIConsoleService.h"
@@ -645,17 +646,6 @@ class ANSIFileAutoCloser
 };
 #endif
 
-class JSPrincipalsHolder
-{
- public:
-    JSPrincipalsHolder(JSContext *cx, JSPrincipals *principals)
-        : mCx(cx), mPrincipals(principals) {}
-    ~JSPrincipalsHolder() { JSPRINCIPALS_DROP(mCx, mPrincipals); }
- private:
-    JSContext *mCx;
-    JSPrincipals *mPrincipals;
-};
-
 nsresult
 mozJSComponentLoader::GlobalForLocation(nsILocalFile *aComponentFile,
                                         nsIURI *aURI,
@@ -665,7 +655,6 @@ mozJSComponentLoader::GlobalForLocation(nsILocalFile *aComponentFile,
 {
     nsresult rv;
 
-    JSPrincipals* jsPrincipals = nsnull;
     JSCLContextHelper cx(this);
 
     JS_AbortIfWrongThread(JS_GetRuntime(cx));
@@ -673,11 +662,6 @@ mozJSComponentLoader::GlobalForLocation(nsILocalFile *aComponentFile,
     // preserve caller's compartment
     js::AutoPreserveCompartment pc(cx);
 
-    rv = mSystemPrincipal->GetJSPrincipals(cx, &jsPrincipals);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    JSPrincipalsHolder princHolder(mContext, jsPrincipals);
-
     nsCOMPtr<nsIXPCScriptable> backstagePass;
     rv = mRuntimeService->GetBackstagePass(getter_AddRefs(backstagePass));
     NS_ENSURE_SUCCESS(rv, rv);
@@ -837,7 +821,9 @@ mozJSComponentLoader::GlobalForLocation(nsILocalFile *aComponentFile,
                 return NS_ERROR_FAILURE;
             }
 
-            script = JS_CompileScriptForPrincipalsVersion(cx, global, jsPrincipals, buf, fileSize32, nativePath.get(), 1,
+            script = JS_CompileScriptForPrincipalsVersion(cx, global,
+                                                          nsJSPrincipals::get(mSystemPrincipal),
+                                                          buf, fileSize32, nativePath.get(), 1,
                                                           JSVERSION_LATEST);
 
             PR_MemUnmap(buf, fileSize32);
@@ -880,7 +866,9 @@ mozJSComponentLoader::GlobalForLocation(nsILocalFile *aComponentFile,
                 NS_WARNING("Failed to read file");
                 return NS_ERROR_FAILURE;
             }
-            script = JS_CompileScriptForPrincipalsVersion(cx, global, jsPrincipals, buf, rlen, nativePath.get(), 1,
+            script = JS_CompileScriptForPrincipalsVersion(cx, global,
+                                                          nsJSPrincipals::get(mSystemPrincipal),
+                                                          buf, rlen, nativePath.get(), 1,
                                                           JSVERSION_LATEST);
 
             free(buf);
@@ -917,7 +905,9 @@ mozJSComponentLoader::GlobalForLocation(nsILocalFile *aComponentFile,
 
             buf[len] = '\0';
 
-            script = JS_CompileScriptForPrincipalsVersion(cx, global, jsPrincipals, buf, bytesRead, nativePath.get(), 1,
+            script = JS_CompileScriptForPrincipalsVersion(cx, global,
+                                                          nsJSPrincipals::get(mSystemPrincipal),
+                                                          buf, bytesRead, nativePath.get(), 1,
                                                           JSVERSION_LATEST);
         }
         // Propagate the exception, if one exists. Also, don't leave the stale
diff --git a/js/xpconnect/loader/mozJSSubScriptLoader.cpp b/js/xpconnect/loader/mozJSSubScriptLoader.cpp
index 2eacc2fd992..10fcb9773e8 100644
--- a/js/xpconnect/loader/mozJSSubScriptLoader.cpp
+++ b/js/xpconnect/loader/mozJSSubScriptLoader.cpp
@@ -61,6 +61,7 @@
 #include "jsapi.h"
 #include "jsdbgapi.h"
 #include "jsfriendapi.h"
+#include "nsJSPrincipals.h"
 
 #include "mozilla/FunctionTimer.h"
 #include "mozilla/scache/StartupCache.h"
@@ -111,7 +112,6 @@ mozJSSubScriptLoader::ReadScript(nsIURI *uri, JSContext *cx, JSObject *target_ob
 {
     nsCOMPtr<nsIChannel>     chan;
     nsCOMPtr<nsIInputStream> instream;
-    JSPrincipals    *jsPrincipals;
     JSErrorReporter  er;
 
     nsresult rv;
@@ -140,14 +140,6 @@ mozJSSubScriptLoader::ReadScript(nsIURI *uri, JSContext *cx, JSObject *target_ob
     if (NS_FAILED(rv))
         return rv;
 
-    /* we can't hold onto jsPrincipals as a module var because the
-     * JSPRINCIPALS_DROP macro takes a JSContext, which we won't have in the
-     * destructor */
-    rv = principal->GetJSPrincipals(cx, &jsPrincipals);
-    if (NS_FAILED(rv) || !jsPrincipals) {
-        return ReportError(cx, LOAD_ERROR_NOPRINCIPALS);
-    }
-
     /* set our own error reporter so we can report any bad things as catchable
      * exceptions, including the source/line number */
     er = JS_SetErrorReporter(cx, mozJSLoaderErrorReporter);
@@ -158,21 +150,18 @@ mozJSSubScriptLoader::ReadScript(nsIURI *uri, JSContext *cx, JSObject *target_ob
                                             charset, nsnull, script);
 
         if (NS_FAILED(rv)) {
-            JSPRINCIPALS_DROP(cx, jsPrincipals);
             return ReportError(cx, LOAD_ERROR_BADCHARSET);
         }
 
         *scriptp =
-            JS_CompileUCScriptForPrincipals(cx, target_obj, jsPrincipals,
+            JS_CompileUCScriptForPrincipals(cx, target_obj, nsJSPrincipals::get(principal),
                                             reinterpret_cast<const jschar*>(script.get()),
                                             script.Length(), uriStr, 1);
     } else {
-        *scriptp = JS_CompileScriptForPrincipals(cx, target_obj, jsPrincipals, buf.get(),
-                                                 len, uriStr, 1);
+        *scriptp = JS_CompileScriptForPrincipals(cx, target_obj, nsJSPrincipals::get(principal),
+                                                 buf.get(), len, uriStr, 1);
     }
 
-    JSPRINCIPALS_DROP(cx, jsPrincipals);
-
     /* repent for our evil deeds */
     JS_SetErrorReporter(cx, er);
 
@@ -204,7 +193,7 @@ mozJSSubScriptLoader::LoadSubScript(const nsAString& url,
                          __LINE__, NS_LossyConvertUTF16toASCII(url).get());
 #endif
 
-    /* set mJSPrincipals if it's not here already */
+    /* set the system principal if it's not here already */
     if (!mSystemPrincipal) {
         nsCOMPtr<nsIScriptSecurityManager> secman =
             do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID);
diff --git a/js/xpconnect/shell/xpcshell.cpp b/js/xpconnect/shell/xpcshell.cpp
index 82a198cf5b9..4ec492f7593 100644
--- a/js/xpconnect/shell/xpcshell.cpp
+++ b/js/xpconnect/shell/xpcshell.cpp
@@ -81,6 +81,7 @@
 #include "nsCOMPtr.h"
 #include "nsAutoPtr.h"
 #include "nsIXPCSecurityManager.h"
+#include "nsJSPrincipals.h"
 #include "xpcpublic.h"
 #ifdef XP_MACOSX
 #include "xpcshellMacUtils.h"
@@ -1739,11 +1740,13 @@ GetCurrentWorkingDirectory(nsAString& workingDirectory)
 }
 
 static JSPrincipals *
-FindObjectPrincipals(JSContext *cx, JSObject *obj)
+FindObjectPrincipals(JSObject *obj)
 {
     return gJSPrincipals;
 }
 
+static JSSecurityCallbacks shellSecurityCallbacks;
+
 int
 main(int argc, char **argv, char **envp)
 {
@@ -1905,10 +1908,8 @@ main(int argc, char **argv, char **envp)
                     fprintf(gErrFile, "+++ Failed to obtain SystemPrincipal from ScriptSecurityManager service.\n");
                 } else {
                     // fetch the JS principals and stick in a global
-                    rv = systemprincipal->GetJSPrincipals(cx, &gJSPrincipals);
-                    if (NS_FAILED(rv)) {
-                        fprintf(gErrFile, "+++ Failed to obtain JS principals from SystemPrincipal.\n");
-                    }
+                    gJSPrincipals = nsJSPrincipals::get(systemprincipal);
+                    JS_HoldPrincipals(gJSPrincipals);
                     secman->SetSystemPrincipal(systemprincipal);
                 }
             } else {
@@ -1916,10 +1917,11 @@ main(int argc, char **argv, char **envp)
             }
         }
 
-        JSSecurityCallbacks *cb = JS_GetRuntimeSecurityCallbacks(rt);
-        NS_ASSERTION(cb, "We are assuming that nsScriptSecurityManager::Init() has been run");
-        NS_ASSERTION(!cb->findObjectPrincipals, "Your pigeon is in my hole!");
-        cb->findObjectPrincipals = FindObjectPrincipals;
+        const JSSecurityCallbacks *scb = JS_GetSecurityCallbacks(rt);
+        NS_ASSERTION(scb, "We are assuming that nsScriptSecurityManager::Init() has been run");
+        shellSecurityCallbacks = *scb;
+        shellSecurityCallbacks.findObjectPrincipals = FindObjectPrincipals;
+        JS_SetSecurityCallbacks(rt, &shellSecurityCallbacks);
 
 #ifdef TEST_TranslateThis
         nsCOMPtr<nsIXPCFunctionThisTranslator>
@@ -2009,7 +2011,7 @@ main(int argc, char **argv, char **envp)
             xpc->WrapJS(cx, glob, NS_GET_IID(nsIJSContextStack),
                         (void**) getter_AddRefs(bogus));
 #endif
-            JSPRINCIPALS_DROP(cx, gJSPrincipals);
+            JS_DropPrincipals(rt, gJSPrincipals);
             JS_ClearScope(cx, glob);
             JS_GC(cx);
             JSContext *oldcx;
diff --git a/js/xpconnect/src/XPCComponents.cpp b/js/xpconnect/src/XPCComponents.cpp
index 66c285f35cb..a2a110270a4 100644
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -3437,14 +3437,18 @@ xpc_EvalInSandbox(JSContext *cx, JSObject *sandbox, const nsAString& source,
     NS_ASSERTION(sop, "Invalid sandbox passed");
     nsCOMPtr<nsIPrincipal> prin = sop->GetPrincipal();
 
-    JSPrincipals *jsPrincipals;
-
-    if (!prin ||
-        NS_FAILED(prin->GetJSPrincipals(cx, &jsPrincipals)) ||
-        !jsPrincipals) {
+    if (!prin) {
         return NS_ERROR_FAILURE;
     }
 
+    nsCAutoString filenameBuf;
+    if (!filename) {
+        // Default to the spec of the principal.
+        nsJSPrincipals::get(prin)->GetScriptLocation(filenameBuf);
+        filename = filenameBuf.get();
+        lineNo = 1;
+    }
+
     JSObject *callingScope;
     {
         JSAutoRequest req(cx);
@@ -3458,7 +3462,6 @@ xpc_EvalInSandbox(JSContext *cx, JSObject *sandbox, const nsAString& source,
     nsRefPtr<ContextHolder> sandcx = new ContextHolder(cx, sandbox);
     if (!sandcx || !sandcx->GetJSContext()) {
         JS_ReportError(cx, "Can't prepare context for evalInSandbox");
-        JSPRINCIPALS_DROP(cx, jsPrincipals);
         return NS_ERROR_OUT_OF_MEMORY;
     }
 
@@ -3471,24 +3474,15 @@ xpc_EvalInSandbox(JSContext *cx, JSObject *sandbox, const nsAString& source,
         if (!stack->Push(sandcx->GetJSContext())) {
             JS_ReportError(cx,
                            "Unable to initialize XPConnect with the sandbox context");
-            JSPRINCIPALS_DROP(cx, jsPrincipals);
             return NS_ERROR_FAILURE;
         }
     }
 
-    if (!filename) {
-        // Default the filename to the codebase.
-        filename = jsPrincipals->codebase;
-        lineNo = 1;
-    }
-
     nsresult rv = NS_OK;
 
     {
         JSAutoRequest req(sandcx->GetJSContext());
         JSAutoEnterCompartment ac;
-        jsval v;
-        JSString *str = nsnull;
 
         if (!ac.enter(sandcx->GetJSContext(), sandbox)) {
             if (stack)
@@ -3496,9 +3490,11 @@ xpc_EvalInSandbox(JSContext *cx, JSObject *sandbox, const nsAString& source,
             return NS_ERROR_FAILURE;
         }
 
+        jsval v;
+        JSString *str = nsnull;
         JSBool ok =
             JS_EvaluateUCScriptForPrincipals(sandcx->GetJSContext(), sandbox,
-                                             jsPrincipals,
+                                             nsJSPrincipals::get(prin),
                                              reinterpret_cast<const jschar *>
                                                              (PromiseFlatString(source).get()),
                                              source.Length(), filename, lineNo,
@@ -3571,8 +3567,6 @@ xpc_EvalInSandbox(JSContext *cx, JSObject *sandbox, const nsAString& source,
     if (stack)
         unused << stack->Pop();
 
-    JSPRINCIPALS_DROP(cx, jsPrincipals);
-
     return rv;
 }
 
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index e0e6fd433dd..1ea2a130b40 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -60,6 +60,8 @@
 #include "jsfriendapi.h"
 #include "js/MemoryMetrics.h"
 
+#include "nsJSPrincipals.h"
+
 #ifdef MOZ_CRASHREPORTER
 #include "nsExceptionHandler.h"
 #endif
@@ -926,6 +928,20 @@ XPCJSRuntime::FinalizeCallback(JSContext *cx, JSFinalizeStatus status)
     }
 }
 
+class AutoLockWatchdog {
+    XPCJSRuntime* const mRuntime;
+
+  public:
+    AutoLockWatchdog(XPCJSRuntime* aRuntime)
+      : mRuntime(aRuntime) {
+        PR_Lock(mRuntime->mWatchdogLock);
+    }
+
+    ~AutoLockWatchdog() {
+        PR_Unlock(mRuntime->mWatchdogLock);
+    }
+};
+
 //static
 void
 XPCJSRuntime::WatchdogMain(void *arg)
@@ -933,7 +949,7 @@ XPCJSRuntime::WatchdogMain(void *arg)
     XPCJSRuntime* self = static_cast<XPCJSRuntime*>(arg);
 
     // Lock lasts until we return
-    js::AutoLockGC lock(self->mJSRuntime);
+    AutoLockWatchdog lock(self);
 
     PRIntervalTime sleepInterval;
     while (self->mWatchdogThread) {
@@ -944,12 +960,8 @@ XPCJSRuntime::WatchdogMain(void *arg)
             sleepInterval = PR_INTERVAL_NO_TIMEOUT;
             self->mWatchdogHibernating = true;
         }
-#ifdef DEBUG
-        PRStatus status =
-#endif
-            PR_WaitCondVar(self->mWatchdogWakeup, sleepInterval);
-        JS_ASSERT(status == PR_SUCCESS);
-        js::TriggerOperationCallback(self->mJSRuntime);
+        MOZ_ALWAYS_TRUE(PR_WaitCondVar(self->mWatchdogWakeup, sleepInterval) == PR_SUCCESS);
+        JS_TriggerOperationCallback(self->mJSRuntime);
     }
 
     /* Wake up the main thread waiting for the watchdog to terminate. */
@@ -961,6 +973,9 @@ void
 XPCJSRuntime::ActivityCallback(void *arg, JSBool active)
 {
     XPCJSRuntime* self = static_cast<XPCJSRuntime*>(arg);
+
+    AutoLockWatchdog lock(self);
+    
     if (active) {
         self->mLastActiveTime = -1;
         if (self->mWatchdogHibernating) {
@@ -1058,7 +1073,7 @@ XPCJSRuntime::~XPCJSRuntime()
         // must release the lock before calling PR_DestroyCondVar, we use an
         // extra block here.
         {
-            js::AutoLockGC lock(mJSRuntime);
+            AutoLockWatchdog lock(this);
             if (mWatchdogThread) {
                 mWatchdogThread = nsnull;
                 PR_NotifyCondVar(mWatchdogWakeup);
@@ -1066,6 +1081,7 @@ XPCJSRuntime::~XPCJSRuntime()
             }
         }
         PR_DestroyCondVar(mWatchdogWakeup);
+        PR_DestroyLock(mWatchdogLock);
         mWatchdogWakeup = nsnull;
     }
 
@@ -1206,153 +1222,43 @@ XPCJSRuntime::~XPCJSRuntime()
     XPCPerThreadData::ShutDown();
 }
 
-static void*
-GetCompartmentNameHelper(JSCompartment *c, bool getAddress)
+static void
+GetCompartmentName(JSCompartment *c, bool getAddress, nsCString &name)
 {
-    nsCString* name = new nsCString();
     if (js::IsAtomsCompartment(c)) {
-        name->AssignLiteral("atoms");
+        name.AssignLiteral("atoms");
     } else if (JSPrincipals *principals = JS_GetCompartmentPrincipals(c)) {
-        if (principals->codebase) {
-            name->Assign(principals->codebase);
+        nsJSPrincipals::get(principals)->GetScriptLocation(name);
 
-            // For system compartments we append the location, if there is one.
-            // And we append the address if |getAddress| is true, so that
-            // multiple system compartments (and there can be many) can be
-            // distinguished.
-            if (js::IsSystemCompartment(c)) {
-                xpc::CompartmentPrivate *compartmentPrivate =
-                    static_cast<xpc::CompartmentPrivate*>(JS_GetCompartmentPrivate(c));
-                if (compartmentPrivate &&
-                    !compartmentPrivate->location.IsEmpty()) {
-                    name->AppendLiteral(", ");
-                    name->Append(compartmentPrivate->location);
-                }
-
-                if (getAddress) {
-                    // ample; 64-bit address max is 18 chars
-                    static const int maxLength = 31;
-                    nsPrintfCString address(maxLength, ", 0x%llx", PRUint64(c));
-                    name->Append(address);
-                }
+        // For system compartments we append the location, if there is one.
+        // And we append the address if |getAddress| is true, so that
+        // multiple system compartments (and there can be many) can be
+        // distinguished.
+        if (js::IsSystemCompartment(c)) {
+            xpc::CompartmentPrivate *compartmentPrivate =
+                static_cast<xpc::CompartmentPrivate*>(JS_GetCompartmentPrivate(c));
+            if (compartmentPrivate && !compartmentPrivate->location.IsEmpty()) {
+                name.AppendLiteral(", ");
+                name.Append(compartmentPrivate->location);
+            }
+            
+            if (getAddress) {
+                // ample; 64-bit address max is 18 chars
+                const int maxLength = 31;
+                nsPrintfCString address(maxLength, ", 0x%llx", PRUint64(c));
+                name.Append(address);
             }
-
-            // A hack: replace forward slashes with '\\' so they aren't
-            // treated as path separators.  Users of the reporters
-            // (such as about:memory) have to undo this change.
-            name->ReplaceChar('/', '\\');
-        } else {
-            name->AssignLiteral("null-codebase");
         }
+        
+        // A hack: replace forward slashes with '\\' so they aren't
+        // treated as path separators.  Users of the reporters
+        // (such as about:memory) have to undo this change.
+        name.ReplaceChar('/', '\\');
     } else {
-        name->AssignLiteral("null-principal");
+        name.AssignLiteral("null-principal");
     }
-    return name;
 }
 
-static void*
-GetCompartmentNameAndAddress(JSRuntime *rt, JSCompartment *c)
-{
-    return GetCompartmentNameHelper(c, /* get address = */true);
-}
-
-namespace xpc {
-
-void*
-GetCompartmentName(JSRuntime *rt, JSCompartment *c)
-{
-    return GetCompartmentNameHelper(c, /* get address = */false);
-}
-
-void
-DestroyCompartmentName(void *string)
-{
-    delete static_cast<nsCString*>(string);
-}
-
-} // namespace xpc
-
-namespace {
-
-template <int N>
-inline void
-ReportMemory(const nsACString &path, PRInt32 kind, PRInt32 units,
-             PRInt64 amount, const char (&desc)[N],
-             nsIMemoryMultiReporterCallback *callback, nsISupports *closure)
-{
-    callback->Callback(NS_LITERAL_CSTRING(""), path, kind, units, amount,
-                       NS_LITERAL_CSTRING(desc), closure);
-}
-
-template <int N>
-inline void
-ReportMemoryBytes(const nsACString &path, PRInt32 kind, PRInt64 amount,
-                  const char (&desc)[N],
-                  nsIMemoryMultiReporterCallback *callback,
-                  nsISupports *closure)
-{
-    ReportMemory(path, kind, nsIMemoryReporter::UNITS_BYTES, amount, desc,
-                 callback, closure);
-}
-
-template <int N>
-inline void
-ReportMemoryBytes0(const nsCString &path, PRInt32 kind, PRInt64 amount,
-                   const char (&desc)[N],
-                   nsIMemoryMultiReporterCallback *callback,
-                   nsISupports *closure)
-{
-    if (amount)
-        ReportMemoryBytes(path, kind, amount, desc, callback, closure);
-}
-
-template <int N>
-inline void
-ReportGCHeapBytes(const nsACString &path, PRInt64 *total, PRInt64 amount,
-                  const char (&desc)[N],
-                  nsIMemoryMultiReporterCallback *callback,
-                  nsISupports *closure)
-{
-    ReportMemory(path, nsIMemoryReporter::KIND_NONHEAP, nsIMemoryReporter::UNITS_BYTES, amount,
-                 desc, callback, closure);
-    *total += amount;
-}
-
-template <int N>
-inline void
-ReportGCHeapBytes0(const nsCString &path, PRInt64 *total, PRInt64 amount,
-                   const char (&desc)[N],
-                   nsIMemoryMultiReporterCallback *callback,
-                   nsISupports *closure)
-{
-    if (amount) 
-        return ReportGCHeapBytes(path, total, amount, desc, callback, closure);
-}
-
-template <int N>
-inline void
-ReportMemoryPercentage(const nsACString &path, PRInt32 kind, PRInt64 amount,
-                       const char (&desc)[N],
-                       nsIMemoryMultiReporterCallback *callback,
-                       nsISupports *closure)
-{
-    ReportMemory(path, kind, nsIMemoryReporter::UNITS_PERCENTAGE, amount, desc,
-                 callback, closure);
-}
-
-template <int N>
-inline const nsCString
-MakeMemoryReporterPath(const nsACString &pathPrefix,
-                       const JS::CompartmentStats &cStats,
-                       const char (&reporterName)[N])
-{
-  return pathPrefix + NS_LITERAL_CSTRING("compartment(") +
-         *static_cast<nsCString*>(cStats.name) +
-         NS_LITERAL_CSTRING(")/") + nsDependentCString(reporterName);
-}
-
-} // anonymous namespace
-
 // We have per-compartment GC heap totals, so we can't put the total GC heap
 // size in the explicit allocations tree.  But it's a useful figure, so put it
 // in the "others" list.
@@ -1390,340 +1296,357 @@ GetJSUserCompartmentCount()
 // XPConnectJSCompartmentCount to avoid that problem, but then we couldn't
 // easily report them via telemetry, so we live with the small risk of
 // inconsistencies.
-NS_MEMORY_REPORTER_IMPLEMENT(XPConnectJSSystemCompartmentCount,
-                             "js-compartments-system",
-                             KIND_OTHER,
-                             nsIMemoryReporter::UNITS_COUNT,
-                             GetJSSystemCompartmentCount,
-                             "The number of JavaScript compartments for system code.  The sum of this "
-                             "and 'js-compartments-user' might not match the number of "
-                             "compartments listed under 'js' if a garbage collection occurs at an "
-                             "inopportune time, but such cases should be rare.")
+NS_MEMORY_REPORTER_IMPLEMENT(
+    XPConnectJSSystemCompartmentCount,
+    "js-compartments-system",
+    KIND_OTHER,
+    nsIMemoryReporter::UNITS_COUNT,
+    GetJSSystemCompartmentCount,
+    "The number of JavaScript compartments for system code.  The sum of this "
+    "and 'js-compartments-user' might not match the number of compartments "
+    "listed under 'js' if a garbage collection occurs at an inopportune time, "
+    "but such cases should be rare.")
 
-NS_MEMORY_REPORTER_IMPLEMENT(XPConnectJSUserCompartmentCount,
-                             "js-compartments-user",
-                             KIND_OTHER,
-                             nsIMemoryReporter::UNITS_COUNT,
-                             GetJSUserCompartmentCount,
-                             "The number of JavaScript compartments for user code.  The sum of this "
-                             "and 'js-compartments-system' might not match the number of "
-                             "compartments listed under 'js' if a garbage collection occurs at an "
-                             "inopportune time, but such cases should be rare.")
+NS_MEMORY_REPORTER_IMPLEMENT(
+    XPConnectJSUserCompartmentCount,
+    "js-compartments-user",
+    KIND_OTHER,
+    nsIMemoryReporter::UNITS_COUNT,
+    GetJSUserCompartmentCount,
+    "The number of JavaScript compartments for user code.  The sum of this "
+    "and 'js-compartments-system' might not match the number of compartments "
+    "listed under 'js' if a garbage collection occurs at an inopportune time, "
+    "but such cases should be rare.")
+
+// The REPORT* macros do an unconditional report.  The REPORT*0 macros only
+// report if the value is non-zero.
+
+#define REPORT(_path, _kind, _units, _amount, _desc)                          \
+    do {                                                                      \
+        nsresult rv;                                                          \
+        rv = cb->Callback(EmptyCString(), _path, _kind, _units, _amount,      \
+                          NS_LITERAL_CSTRING(_desc), closure);                \
+        NS_ENSURE_SUCCESS(rv, rv);                                            \
+    } while (0)
+
+#define REPORT0(_path, _kind, _units, _amount, _desc)                         \
+    do {                                                                      \
+        size_t amount = _amount;  /* evaluate _amount only once */            \
+        if (amount > 0) {                                                     \
+            nsresult rv;                                                      \
+            rv = cb->Callback(EmptyCString(), _path, _kind, _units, amount,   \
+                              NS_LITERAL_CSTRING(_desc), closure);            \
+            NS_ENSURE_SUCCESS(rv, rv);                                        \
+        }                                                                     \
+    } while (0)
+
+#define REPORT_BYTES(_path, _kind, _amount, _desc)                            \
+    REPORT(_path, _kind, nsIMemoryReporter::UNITS_BYTES, _amount, _desc);
+
+#define REPORT_BYTES0(_path, _kind, _amount, _desc)                           \
+    REPORT0(_path, _kind, nsIMemoryReporter::UNITS_BYTES, _amount, _desc);
+
+#define REPORT_GC_BYTES(_path, _amount, _desc)                                \
+    do {                                                                      \
+        size_t amount = _amount;  /* evaluate _amount only once */            \
+        nsresult rv;                                                          \
+        rv = cb->Callback(EmptyCString(), _path,                              \
+                          nsIMemoryReporter::KIND_NONHEAP,                    \
+                          nsIMemoryReporter::UNITS_BYTES, amount,             \
+                          NS_LITERAL_CSTRING(_desc), closure);                \
+        NS_ENSURE_SUCCESS(rv, rv);                                            \
+        gcTotal += amount;                                                    \
+    } while (0)
+
+#define REPORT_GC_BYTES0(_path, _amount, _desc)                               \
+    do {                                                                      \
+        size_t amount = _amount;  /* evaluate _amount only once */            \
+        if (amount > 0) {                                                     \
+            nsresult rv;                                                      \
+            rv = cb->Callback(EmptyCString(), _path,                          \
+                              nsIMemoryReporter::KIND_NONHEAP,                \
+                              nsIMemoryReporter::UNITS_BYTES, amount,         \
+                              NS_LITERAL_CSTRING(_desc), closure);            \
+            NS_ENSURE_SUCCESS(rv, rv);                                        \
+            gcTotal += amount;                                                \
+        }                                                                     \
+    } while (0)
+
+template <int N>
+inline const nsCString
+MakePath(const nsACString &pathPrefix, const JS::CompartmentStats &cStats,
+         const char (&reporterName)[N])
+{
+    const char *name = static_cast<char *>(cStats.extra);
+    if (!name)
+        name = "error while initializing compartment name";
+    return pathPrefix + NS_LITERAL_CSTRING("compartment(") +
+           nsDependentCString(name) + NS_LITERAL_CSTRING(")/") +
+           nsDependentCString(reporterName);
+}
 
 namespace mozilla {
 namespace xpconnect {
 namespace memory {
 
-static PRInt64
+static nsresult
 ReportCompartmentStats(const JS::CompartmentStats &cStats,
                        const nsACString &pathPrefix,
-                       nsIMemoryMultiReporterCallback *callback,
-                       nsISupports *closure)
+                       nsIMemoryMultiReporterCallback *cb,
+                       nsISupports *closure, size_t *gcTotalOut)
 {
-    PRInt64 gcTotal = 0;
+    size_t gcTotal = 0;
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/arena/headers"),
-                       &gcTotal, cStats.gcHeapArenaHeaders,
-                       "Memory on the compartment's garbage-collected JavaScript heap, within "
-                       "arenas, that is used to hold internal book-keeping information.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/arena/headers"),
+                     cStats.gcHeapArenaHeaders,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap, within arenas, that is used to hold internal "
+                     "book-keeping information.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/arena/padding"),
-                       &gcTotal, cStats.gcHeapArenaPadding,
-                       "Memory on the compartment's garbage-collected JavaScript heap, within "
-                       "arenas, that is unused and present only so that other data is aligned. "
-                       "This constitutes internal fragmentation.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/arena/padding"),
+                     cStats.gcHeapArenaPadding,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap, within arenas, that is unused and present only so "
+                     "that other data is aligned. This constitutes internal "
+                     "fragmentation.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/arena/unused"),
-                       &gcTotal, cStats.gcHeapArenaUnused,
-                       "Memory on the compartment's garbage-collected JavaScript heap, within "
-                       "arenas, that could be holding useful data but currently isn't.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/arena/unused"),
+                     cStats.gcHeapArenaUnused,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap, within arenas, that could be holding useful data "
+                     "but currently isn't.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/objects/non-function"),
-                       &gcTotal, cStats.gcHeapObjectsNonFunction,
-                       "Memory on the compartment's garbage-collected JavaScript heap that holds "
-                       "non-function objects.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/objects/non-function"),
+                     cStats.gcHeapObjectsNonFunction,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap that holds non-function objects.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/objects/function"),
-                       &gcTotal, cStats.gcHeapObjectsFunction,
-                       "Memory on the compartment's garbage-collected JavaScript heap that holds "
-                       "function objects.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/objects/function"),
+                     cStats.gcHeapObjectsFunction,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap that holds function objects.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/strings"),
-                       &gcTotal, cStats.gcHeapStrings,
-                       "Memory on the compartment's garbage-collected JavaScript heap that holds "
-                       "string headers.  String headers contain various pieces of information "
-                       "about a string, but do not contain (except in the case of very short "
-                       "strings) the string characters;  characters in longer strings are counted "
-                       "under 'gc-heap/string-chars' instead.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/strings"),
+                     cStats.gcHeapStrings,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap that holds string headers.  String headers contain "
+                     "various pieces of information about a string, but do not "
+                     "contain (except in the case of very short strings) the "
+                     "string characters;  characters in longer strings are "
+                     "counted " "under 'gc-heap/string-chars' instead.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/scripts"),
-                       &gcTotal, cStats.gcHeapScripts,
-                       "Memory on the compartment's garbage-collected JavaScript heap that holds "
-                       "JSScript instances. A JSScript is created for each user-defined function "
-                       "in a script. One is also created for the top-level code in a script.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/scripts"),
+                     cStats.gcHeapScripts,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap that holds JSScript instances. A JSScript is "
+                     "created for each user-defined function in a script. One "
+                     "is also created for the top-level code in a script.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/shapes/tree"),
-                       &gcTotal, cStats.gcHeapShapesTree,
-                       "Memory on the compartment's garbage-collected JavaScript heap that holds "
-                       "shapes that are in a property tree.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/shapes/tree"),
+                     cStats.gcHeapShapesTree,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap that holds shapes that are in a property tree.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/shapes/dict"),
-                       &gcTotal, cStats.gcHeapShapesDict,
-                       "Memory on the compartment's garbage-collected JavaScript heap that holds "
-                       "shapes that are in dictionary mode.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/shapes/dict"),
+                     cStats.gcHeapShapesDict,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap that holds shapes that are in dictionary mode.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/shapes/base"),
-                       &gcTotal, cStats.gcHeapShapesBase,
-                       "Memory on the compartment's garbage-collected JavaScript heap that collates "
-                       "data common to many shapes.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/shapes/base"),
+                     cStats.gcHeapShapesBase,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap that collates data common to many shapes.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/type-objects"),
-                       &gcTotal, cStats.gcHeapTypeObjects,
-                       "Memory on the compartment's garbage-collected JavaScript heap that holds "
-                       "type inference information.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/type-objects"),
+                     cStats.gcHeapTypeObjects,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap that holds type inference information.");
 
-    ReportGCHeapBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "gc-heap/xml"),
-                       &gcTotal, cStats.gcHeapXML,
-                       "Memory on the compartment's garbage-collected JavaScript heap that holds "
-                       "E4X XML objects.",
-                       callback, closure);
+    REPORT_GC_BYTES0(MakePath(pathPrefix, cStats, "gc-heap/xml"),
+                     cStats.gcHeapXML,
+                     "Memory on the compartment's garbage-collected JavaScript "
+                     "heap that holds E4X XML objects.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "objects/slots"),
-                       nsIMemoryReporter::KIND_HEAP, cStats.objectSlots,
-                       "Memory allocated for the compartment's non-fixed object slot arrays, "
-                       "which are used to represent object properties.  Some objects also "
-                       "contain a fixed number of slots which are stored on the compartment's "
-                       "JavaScript heap; those slots are not counted here, but in "
-                       "'gc-heap/objects' instead.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "objects/slots"),
+                  nsIMemoryReporter::KIND_HEAP, cStats.objectSlots,
+                  "Memory allocated for the compartment's non-fixed object "
+                  "slot arrays, which are used to represent object properties. "
+                  "Some objects also contain a fixed number of slots which are "
+                  "stored on the compartment's JavaScript heap; those slots "
+                  "are not counted here, but in 'gc-heap/objects' instead.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "objects/elements"),
-                       nsIMemoryReporter::KIND_HEAP, cStats.objectElements,
-                       "Memory allocated for the compartment's object element arrays, "
-                       "which are used to represent indexed object properties.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "objects/elements"),
+                  nsIMemoryReporter::KIND_HEAP, cStats.objectElements,
+                  "Memory allocated for the compartment's object element "
+                  "arrays, which are used to represent indexed object "
+                  "properties.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "objects/misc"),
-                       nsIMemoryReporter::KIND_HEAP, cStats.objectMisc,
-                       "Memory allocated for various small, miscellaneous "
-                       "structures that hang off certain kinds of objects.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "objects/misc"),
+                  nsIMemoryReporter::KIND_HEAP, cStats.objectMisc,
+                  "Memory allocated for various small, miscellaneous "
+                  "structures that hang off certain kinds of objects.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "string-chars"),
-                       nsIMemoryReporter::KIND_HEAP, cStats.stringChars,
-                       "Memory allocated to hold the compartment's string characters.  Sometimes "
-                       "more memory is allocated than necessary, to simplify string "
-                       "concatenation.  Each string also includes a header which is stored on the "
-                       "compartment's JavaScript heap;  that header is not counted here, but in "
-                       "'gc-heap/strings' instead.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "string-chars"),
+                  nsIMemoryReporter::KIND_HEAP, cStats.stringChars,
+                  "Memory allocated to hold the compartment's string "
+                  "characters.  Sometimes more memory is allocated than "
+                  "necessary, to simplify string concatenation.  Each string "
+                  "also includes a header which is stored on the "
+                  "compartment's JavaScript heap;  that header is not counted "
+                  "here, but in 'gc-heap/strings' instead.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "shapes-extra/tree-tables"),
-                       nsIMemoryReporter::KIND_HEAP, cStats.shapesExtraTreeTables,
-                       "Memory allocated for the compartment's property tables that belong to "
-                       "shapes that are in a property tree.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "shapes-extra/tree-tables"),
+                  nsIMemoryReporter::KIND_HEAP, cStats.shapesExtraTreeTables,
+                  "Memory allocated for the compartment's property tables "
+                  "that belong to shapes that are in a property tree.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "shapes-extra/dict-tables"),
-                       nsIMemoryReporter::KIND_HEAP, cStats.shapesExtraDictTables,
-                       "Memory allocated for the compartment's property tables that belong to "
-                       "shapes that are in dictionary mode.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "shapes-extra/dict-tables"),
+                  nsIMemoryReporter::KIND_HEAP, cStats.shapesExtraDictTables,
+                  "Memory allocated for the compartment's property tables "
+                  "that belong to shapes that are in dictionary mode.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "shapes-extra/tree-shape-kids"),
-                       nsIMemoryReporter::KIND_HEAP, cStats.shapesExtraTreeShapeKids,
-                       "Memory allocated for the compartment's kid hashes that belong to shapes "
-                       "that are in a property tree.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "shapes-extra/tree-shape-kids"),
+                  nsIMemoryReporter::KIND_HEAP, cStats.shapesExtraTreeShapeKids,
+                  "Memory allocated for the compartment's kid hashes that "
+                  "belong to shapes that are in a property tree.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "shapes-extra/compartment-tables"),
-                       nsIMemoryReporter::KIND_HEAP, cStats.shapesCompartmentTables,
-                       "Memory used by compartment wide tables storing shape information "
-                       "for use during object construction.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "shapes-extra/compartment-tables"),
+                  nsIMemoryReporter::KIND_HEAP, cStats.shapesCompartmentTables,
+                  "Memory used by compartment wide tables storing shape "
+                  "information for use during object construction.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "script-data"),
-                       nsIMemoryReporter::KIND_HEAP, cStats.scriptData,
-                       "Memory allocated for JSScript bytecode and various variable-length "
-                       "tables.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "script-data"),
+                  nsIMemoryReporter::KIND_HEAP, cStats.scriptData,
+                  "Memory allocated for JSScript bytecode and various "
+                  "variable-length tables.");
 
 #ifdef JS_METHODJIT
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "mjit/code"),
-                       nsIMemoryReporter::KIND_NONHEAP, cStats.mjitCode,
-                       "Memory used by the method JIT to hold the compartment's generated code.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "mjit/code"),
+                  nsIMemoryReporter::KIND_NONHEAP, cStats.mjitCode,
+                  "Memory used by the method JIT to hold the compartment's "
+                  "generated code.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "mjit/data"),
-                       nsIMemoryReporter::KIND_HEAP, cStats.mjitData,
-                       "Memory used by the method JIT for the compartment's compilation data: "
-                       "JITScripts, native maps, and inline cache structs.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "mjit/data"),
+                  nsIMemoryReporter::KIND_HEAP, cStats.mjitData,
+                  "Memory used by the method JIT for the compartment's "
+                  "compilation data: JITScripts, native maps, and inline "
+                  "cache structs.");
 #endif
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "type-inference/script-main"),
-                       nsIMemoryReporter::KIND_HEAP,
-                       cStats.typeInferenceSizes.scripts,
-                       "Memory used during type inference to store type sets of variables "
-                       "and dynamically observed types.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "type-inference/script-main"),
+                  nsIMemoryReporter::KIND_HEAP,
+                  cStats.typeInferenceSizes.scripts,
+                  "Memory used during type inference to store type sets of "
+                  "variables and dynamically observed types.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "type-inference/object-main"),
-                       nsIMemoryReporter::KIND_HEAP,
-                       cStats.typeInferenceSizes.objects,
-                       "Memory used during type inference to store types and possible "
-                       "property types of JS objects.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "type-inference/object-main"),
+                  nsIMemoryReporter::KIND_HEAP,
+                  cStats.typeInferenceSizes.objects,
+                  "Memory used during type inference to store types and "
+                  "possible property types of JS objects.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "type-inference/tables"),
-                       nsIMemoryReporter::KIND_HEAP,
-                       cStats.typeInferenceSizes.tables,
-                       "Memory used during type inference for compartment-wide tables.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "type-inference/tables"),
+                  nsIMemoryReporter::KIND_HEAP,
+                  cStats.typeInferenceSizes.tables,
+                  "Memory used during type inference for compartment-wide "
+                  "tables.");
 
-    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, cStats,
-                                              "analysis-temporary"),
-                       nsIMemoryReporter::KIND_HEAP,
-                       cStats.typeInferenceSizes.temporary,
-                       "Memory used during type inference and compilation to hold transient "
-                       "analysis information.  Cleared on GC.",
-                       callback, closure);
+    REPORT_BYTES0(MakePath(pathPrefix, cStats, "analysis-temporary"),
+                  nsIMemoryReporter::KIND_HEAP,
+                  cStats.typeInferenceSizes.temporary,
+                  "Memory used during type inference and compilation to hold "
+                  "transient analysis information.  Cleared on GC.");
 
-    return gcTotal;
+    *gcTotalOut += gcTotal;
+
+    return NS_OK;
 }
 
-void
-ReportJSRuntimeExplicitTreeStats(const JS::RuntimeStats &rtStats, const nsACString &pathPrefix,
-                                 nsIMemoryMultiReporterCallback *callback,
+nsresult
+ReportJSRuntimeExplicitTreeStats(const JS::RuntimeStats &rtStats,
+                                 const nsACString &pathPrefix,
+                                 nsIMemoryMultiReporterCallback *cb,
                                  nsISupports *closure)
 {
-    PRInt64 gcTotal = 0;
+    nsresult rv;
+    size_t gcTotal = 0;
     for (size_t index = 0;
          index < rtStats.compartmentStatsVector.length();
          index++) {
-        gcTotal += ReportCompartmentStats(rtStats.compartmentStatsVector[index], pathPrefix,
-                                    callback, closure);
+        rv = ReportCompartmentStats(rtStats.compartmentStatsVector[index],
+                                    pathPrefix, cb, closure, &gcTotal);
+        NS_ENSURE_SUCCESS(rv, rv);
     }
 
-    ReportMemoryBytes(pathPrefix + NS_LITERAL_CSTRING("runtime/runtime-object"),
-                      nsIMemoryReporter::KIND_HEAP, rtStats.runtimeObject,
-                      "Memory used by the JSRuntime object.",
-                      callback, closure);
+    REPORT_BYTES(pathPrefix + NS_LITERAL_CSTRING("runtime/runtime-object"),
+                 nsIMemoryReporter::KIND_HEAP, rtStats.runtimeObject,
+                 "Memory used by the JSRuntime object.");
 
-    ReportMemoryBytes(pathPrefix + NS_LITERAL_CSTRING("runtime/atoms-table"),
-                      nsIMemoryReporter::KIND_HEAP, rtStats.runtimeAtomsTable,
-                      "Memory used by the atoms table.",
-                      callback, closure);
+    REPORT_BYTES(pathPrefix + NS_LITERAL_CSTRING("runtime/atoms-table"),
+                 nsIMemoryReporter::KIND_HEAP, rtStats.runtimeAtomsTable,
+                 "Memory used by the atoms table.");
 
-    ReportMemoryBytes(pathPrefix + NS_LITERAL_CSTRING("runtime/contexts"),
-                      nsIMemoryReporter::KIND_HEAP, rtStats.runtimeContexts,
-                      "Memory used by JSContext objects and certain structures "
-                      "hanging off them." ,
-                      callback, closure);
+    REPORT_BYTES(pathPrefix + NS_LITERAL_CSTRING("runtime/contexts"),
+                 nsIMemoryReporter::KIND_HEAP, rtStats.runtimeContexts,
+                 "Memory used by JSContext objects and certain structures "
+                 "hanging off them.");
 
-    ReportMemoryBytes(pathPrefix + NS_LITERAL_CSTRING("runtime/normal"),
-                      nsIMemoryReporter::KIND_HEAP, rtStats.runtimeNormal,
-                      "Memory used by a JSRuntime, "
-                      "excluding memory that is reported by "
-                      "other reporters under 'explicit/js/runtime/'.",
-                      callback, closure);
+    REPORT_BYTES(pathPrefix + NS_LITERAL_CSTRING("runtime/normal"),
+                 nsIMemoryReporter::KIND_HEAP, rtStats.runtimeNormal,
+                 "Memory used by a JSRuntime, excluding memory that is "
+                 "reported by other reporters under 'explicit/js/runtime/'.");
 
-    ReportMemoryBytes(pathPrefix + NS_LITERAL_CSTRING("runtime/temporary"),
-                      nsIMemoryReporter::KIND_HEAP, rtStats.runtimeTemporary,
-                      "Memory held transiently in JSRuntime and used during "
-                      "compilation.  It mostly holds parse nodes.",
-                      callback, closure);
+    REPORT_BYTES(pathPrefix + NS_LITERAL_CSTRING("runtime/temporary"),
+                 nsIMemoryReporter::KIND_HEAP, rtStats.runtimeTemporary,
+                 "Memory held transiently in JSRuntime and used during "
+                 "compilation.  It mostly holds parse nodes.");
 
-    ReportMemoryBytes0(pathPrefix + NS_LITERAL_CSTRING("runtime/regexp-code"),
-                       nsIMemoryReporter::KIND_NONHEAP, rtStats.runtimeRegexpCode,
-                       "Memory used by the regexp JIT to hold generated code.",
-                       callback, closure);
+    REPORT_BYTES(pathPrefix + NS_LITERAL_CSTRING("runtime/regexp-code"),
+                 nsIMemoryReporter::KIND_NONHEAP, rtStats.runtimeRegexpCode,
+                 "Memory used by the regexp JIT to hold generated code.");
 
-    ReportMemoryBytes(pathPrefix + NS_LITERAL_CSTRING("runtime/stack-committed"),
-                      nsIMemoryReporter::KIND_NONHEAP, rtStats.runtimeStackCommitted,
-                      "Memory used for the JS call stack.  This is the committed portion "
-                      "of the stack; the uncommitted portion is not measured because it "
-                      "hardly costs anything.",
-                      callback, closure);
+    REPORT_BYTES(pathPrefix + NS_LITERAL_CSTRING("runtime/stack-committed"),
+                 nsIMemoryReporter::KIND_NONHEAP, rtStats.runtimeStackCommitted,
+                 "Memory used for the JS call stack.  This is the committed "
+                 "portion of the stack; the uncommitted portion is not "
+                 "measured because it hardly costs anything.");
 
-    ReportMemoryBytes(pathPrefix + NS_LITERAL_CSTRING("runtime/gc-marker"),
-                      nsIMemoryReporter::KIND_HEAP, rtStats.runtimeGCMarker,
-                      "Memory used for the GC mark stack and gray roots.",
-                      callback, closure);
+    REPORT_BYTES(pathPrefix + NS_LITERAL_CSTRING("runtime/gc-marker"),
+                 nsIMemoryReporter::KIND_HEAP, rtStats.runtimeGCMarker,
+                 "Memory used for the GC mark stack and gray roots.");
 
-    ReportGCHeapBytes(pathPrefix +
-                      NS_LITERAL_CSTRING("gc-heap-chunk-dirty-unused"),
-                      &gcTotal, rtStats.gcHeapChunkDirtyUnused,
-                      "Memory on the garbage-collected JavaScript heap, within chunks with at "
-                      "least one allocated GC thing, that could be holding useful data but "
-                      "currently isn't.  Memory here is mutually exclusive with memory reported"
-                      "under 'explicit/js/gc-heap-decommitted'.",
-                      callback, closure);
+    REPORT_GC_BYTES(pathPrefix + NS_LITERAL_CSTRING("gc-heap-chunk-dirty-unused"),
+                    rtStats.gcHeapChunkDirtyUnused,
+                    "Memory on the garbage-collected JavaScript heap, within "
+                    "chunks with at least one allocated GC thing, that could "
+                    "be holding useful data but currently isn't.  Memory here "
+                    "is mutually exclusive with memory reported under "
+                    "'explicit/js/gc-heap-decommitted'.");
 
-    ReportGCHeapBytes(pathPrefix +
-                      NS_LITERAL_CSTRING("gc-heap-chunk-clean-unused"),
-                      &gcTotal, rtStats.gcHeapChunkCleanUnused,
-                      "Memory on the garbage-collected JavaScript heap taken by completely empty "
-                      "chunks, that soon will be released unless claimed for new allocations.  "
-                      "Memory here is mutually exclusive with memory reported under "
-                      "'explicit/js/gc-heap-decommitted'.",
-                      callback, closure);
+    REPORT_GC_BYTES(pathPrefix + NS_LITERAL_CSTRING("gc-heap-chunk-clean-unused"),
+                    rtStats.gcHeapChunkCleanUnused,
+                    "Memory on the garbage-collected JavaScript heap taken by "
+                    "completely empty chunks, that soon will be released "
+                    "unless claimed for new allocations.  Memory here is "
+                    "mutually exclusive with memory reported under "
+                    "'explicit/js/gc-heap-decommitted'.");
 
-    ReportGCHeapBytes(pathPrefix +
-                      NS_LITERAL_CSTRING("gc-heap-decommitted"),
-                      &gcTotal,
-                      rtStats.gcHeapChunkCleanDecommitted + rtStats.gcHeapChunkDirtyDecommitted,
-                      "Memory in the address space of the garbage-collected JavaScript heap that "
-                      "is currently returned to the OS.",
-                      callback, closure);
+    REPORT_GC_BYTES(pathPrefix + NS_LITERAL_CSTRING("gc-heap-decommitted"),
+                    rtStats.gcHeapChunkCleanDecommitted + rtStats.gcHeapChunkDirtyDecommitted,
+                    "Memory in the address space of the garbage-collected "
+                    "JavaScript heap that is currently returned to the OS.");
 
-    ReportGCHeapBytes(pathPrefix +
-                      NS_LITERAL_CSTRING("gc-heap-chunk-admin"),
-                      &gcTotal, rtStats.gcHeapChunkAdmin,
-                      "Memory on the garbage-collected JavaScript heap, within chunks, that is "
-                      "used to hold internal book-keeping information.",
-                      callback, closure);
+    REPORT_GC_BYTES(pathPrefix + NS_LITERAL_CSTRING("gc-heap-chunk-admin"),
+                    rtStats.gcHeapChunkAdmin,
+                    "Memory on the garbage-collected JavaScript heap, within "
+                    "chunks, that is used to hold internal book-keeping "
+                    "information.");
 
     // gcTotal is the sum of everything we've reported for the GC heap.  It
     // should equal rtStats.gcHeapChunkTotal.
-    JS_ASSERT(size_t(gcTotal) == rtStats.gcHeapChunkTotal);
+    JS_ASSERT(gcTotal == rtStats.gcHeapChunkTotal);
+
+    return NS_OK;
 }
 
 } // namespace memory
@@ -1747,25 +1670,22 @@ class JSCompartmentsMultiReporter : public nsIMemoryMultiReporter
 
     static void CompartmentCallback(JSRuntime *rt, void* data, JSCompartment *c)
     {
+        // silently ignore OOM errors
         Paths *paths = static_cast<Paths *>(data);
-        nsCString *name =
-            static_cast<nsCString *>(xpc::GetCompartmentName(rt, c));
         nsCString path;
-        if (js::IsSystemCompartment(c))
-            path = NS_LITERAL_CSTRING("compartments/system/") + *name;
-        else
-            path = NS_LITERAL_CSTRING("compartments/user/") + *name;
-        if (!paths->append(path))
-            return;     // silent failure, but it's very unlikely
-
-        xpc::DestroyCompartmentName(name);
+        GetCompartmentName(c, /* getAddress = */ false, path);
+        path.Insert(js::IsSystemCompartment(c)
+                    ? NS_LITERAL_CSTRING("compartments/system/")
+                    : NS_LITERAL_CSTRING("compartments/user/"),
+                    0);
+        paths->append(path);
     }
 
-    NS_IMETHOD CollectReports(nsIMemoryMultiReporterCallback *callback,
+    NS_IMETHOD CollectReports(nsIMemoryMultiReporterCallback *cb,
                               nsISupports *closure)
     {
         // First we collect the compartment paths.  Then we report them.  Doing
-        // the two steps interleaved is a bad idea, because calling |callback|
+        // the two steps interleaved is a bad idea, because calling |cb|
         // from within CompartmentCallback() leads to all manner of assertions.
 
         // Collect.
@@ -1777,10 +1697,10 @@ class JSCompartmentsMultiReporter : public nsIMemoryMultiReporter
         // Report.
         for (size_t i = 0; i < paths.length(); i++)
             // These ones don't need a description, hence the "".
-            ReportMemory(paths[i],
-                         nsIMemoryReporter::KIND_OTHER,
-                         nsIMemoryReporter::UNITS_COUNT,
-                         1, "", callback, closure);
+            REPORT(nsCString(paths[i]),
+                   nsIMemoryReporter::KIND_OTHER,
+                   nsIMemoryReporter::UNITS_COUNT,
+                   1, "");
 
         return NS_OK;
     }
@@ -1798,6 +1718,23 @@ NS_IMPL_THREADSAFE_ISUPPORTS1(JSCompartmentsMultiReporter
                               , nsIMemoryMultiReporter
                               )
 
+struct XPCJSRuntimeStats : public JS::RuntimeStats {
+    XPCJSRuntimeStats()
+      : JS::RuntimeStats(JsMallocSizeOf) { }
+    
+    ~XPCJSRuntimeStats() {
+        for (size_t i = 0; i != compartmentStatsVector.length(); ++i)
+            free(compartmentStatsVector[i].extra);
+    }
+
+    virtual void initExtraCompartmentStats(JSCompartment *c,
+                                           JS::CompartmentStats *cstats) MOZ_OVERRIDE {
+        nsCAutoString name;
+        GetCompartmentName(c, /* getAddress = */ true, name);
+        cstats->extra = strdup(name.get());
+    }
+};
+    
 class JSMemoryMultiReporter : public nsIMemoryMultiReporter
 {
 public:
@@ -1809,7 +1746,7 @@ public:
         return NS_OK;
     }
 
-    NS_IMETHOD CollectReports(nsIMemoryMultiReporterCallback *callback,
+    NS_IMETHOD CollectReports(nsIMemoryMultiReporterCallback *cb,
                               nsISupports *closure)
     {
         XPCJSRuntime *xpcrt = nsXPConnect::GetRuntimeInstance();
@@ -1819,8 +1756,7 @@ public:
         // the callback.  Separating these steps is important because the
         // callback may be a JS function, and executing JS while getting these
         // stats seems like a bad idea.
-        JS::RuntimeStats rtStats(JsMallocSizeOf, GetCompartmentNameAndAddress,
-                                 xpc::DestroyCompartmentName);
+        XPCJSRuntimeStats rtStats;
         if (!JS::CollectRuntimeStats(xpcrt->GetJSRuntime(), &rtStats))
             return NS_ERROR_FAILURE;
 
@@ -1833,102 +1769,101 @@ public:
         // This is the second step (see above).  First we report stuff in the
         // "explicit" tree, then we report other stuff.
 
-        ReportJSRuntimeExplicitTreeStats(rtStats, pathPrefix, callback, closure);
+        nsresult rv =
+            ReportJSRuntimeExplicitTreeStats(rtStats, pathPrefix, cb, closure);
+        NS_ENSURE_SUCCESS(rv, rv);
 
-        ReportMemoryBytes(pathPrefix + NS_LITERAL_CSTRING("xpconnect"),
-                          nsIMemoryReporter::KIND_HEAP, xpconnect,
-                          "Memory used by XPConnect.",
-                          callback, closure);
+        REPORT_BYTES(pathPrefix + NS_LITERAL_CSTRING("xpconnect"),
+                     nsIMemoryReporter::KIND_HEAP, xpconnect,
+                     "Memory used by XPConnect.");
 
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-chunk-dirty-unused"),
-                          nsIMemoryReporter::KIND_OTHER,
-                          rtStats.gcHeapChunkDirtyUnused,
-                          "The same as 'explicit/js/gc-heap-chunk-dirty-unused'.  Shown here for "
-                          "easy comparison with other 'js-gc' reporters.",
-                          callback, closure);
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-chunk-dirty-unused"),
+                     nsIMemoryReporter::KIND_OTHER,
+                     rtStats.gcHeapChunkDirtyUnused,
+                     "The same as 'explicit/js/gc-heap-chunk-dirty-unused'. "
+                     "Shown here for easy comparison with other 'js-gc' "
+                     "reporters.");
 
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-chunk-clean-unused"),
-                          nsIMemoryReporter::KIND_OTHER,
-                          rtStats.gcHeapChunkCleanUnused,
-                          "The same as 'explicit/js/gc-heap-chunk-clean-unused'.  Shown here for "
-                          "easy comparison with other 'js-gc' reporters.",
-                          callback, closure);
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-chunk-clean-unused"),
+                     nsIMemoryReporter::KIND_OTHER,
+                     rtStats.gcHeapChunkCleanUnused,
+                     "The same as 'explicit/js/gc-heap-chunk-clean-unused'.  "
+                     "Shown here for easy comparison with other 'js-gc' "
+                     "reporters.");
 
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-decommitted"),
-                          nsIMemoryReporter::KIND_OTHER,
-                          rtStats.gcHeapChunkCleanDecommitted + rtStats.gcHeapChunkDirtyDecommitted,
-                          "The same as 'explicit/js/gc-heap-decommitted'.  Shown here for "
-                          "easy comparison with other 'js-gc' reporters.",
-                          callback, closure);
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-decommitted"),
+                     nsIMemoryReporter::KIND_OTHER,
+                     rtStats.gcHeapChunkCleanDecommitted + rtStats.gcHeapChunkDirtyDecommitted,
+                     "The same as 'explicit/js/gc-heap-decommitted'.  Shown "
+                     "here for easy comparison with other 'js-gc' reporters.");
 
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-arena-unused"),
-                          nsIMemoryReporter::KIND_OTHER,
-                          rtStats.gcHeapArenaUnused,
-                          "Memory on the main JSRuntime's garbage-collected JavaScript heap, "
-                          "within arenas, that could be holding useful data but currently isn't. "
-                          "This is the sum of all compartments' 'gc-heap/arena-unused' numbers.",
-                          callback, closure);
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-arena-unused"),
+                     nsIMemoryReporter::KIND_OTHER,
+                     rtStats.gcHeapArenaUnused,
+                     "Memory on the main JSRuntime's garbage-collected "
+                     "JavaScript heap, within arenas, that could be holding "
+                     "useful data but currently isn't. This is the sum of all "
+                     "compartments' 'gc-heap/arena-unused' numbers.");
 
-        ReportMemoryPercentage(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-unused-fraction"),
-                               nsIMemoryReporter::KIND_OTHER,
-                               rtStats.gcHeapUnusedPercentage,
-                               "Fraction of the main JSRuntime's garbage-collected JavaScript "
-                               "heap that is unused. Computed as ('js-gc-heap-chunk-clean-unused' "
-                               "+ 'js-gc-heap-chunk-dirty-unused' + 'js-gc-heap-decommitted' + "
-                               "'js-gc-heap-arena-unused') / 'js-gc-heap'.",
-                               callback, closure);
+        REPORT(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-unused-fraction"),
+               nsIMemoryReporter::KIND_OTHER,
+               nsIMemoryReporter::UNITS_PERCENTAGE,
+               rtStats.gcHeapUnusedPercentage,
+               "Fraction of the main JSRuntime's garbage-collected JavaScript "
+               "heap that is unused. Computed as "
+               "('js-gc-heap-chunk-clean-unused' + "
+               "'js-gc-heap-chunk-dirty-unused' + 'js-gc-heap-decommitted' + "
+               "'js-gc-heap-arena-unused') / 'js-gc-heap'.");
 
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-objects"),
-                          nsIMemoryReporter::KIND_OTHER, rtStats.totalObjects,
-                          "Memory used for all object-related data in the main JSRuntime. "
-                          "This is the sum of all compartments' 'gc-heap/objects-non-function', "
-                          "'gc-heap/objects-function' and 'object-slots' numbers.",
-                          callback, closure);
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-objects"),
+                     nsIMemoryReporter::KIND_OTHER, rtStats.totalObjects,
+                     "Memory used for all object-related data in the main "
+                     "JSRuntime. This is the sum of all compartments' "
+                     "'gc-heap/objects-non-function', "
+                     "'gc-heap/objects-function' and 'object-slots' numbers.");
 
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-shapes"),
-                          nsIMemoryReporter::KIND_OTHER, rtStats.totalShapes,
-                          "Memory used for all shape-related data in the main JSRuntime. "
-                          "This is the sum of all compartments' 'gc-heap/shapes/tree', "
-                          "'gc-heap/shapes/dict', 'gc-heap/shapes/base', "
-                          "'shapes-extra/tree-tables', 'shapes-extra/dict-tables', "
-                          "'shapes-extra/tree-shape-kids' and 'shapes-extra/empty-shape-arrays'.",
-                          callback, closure);
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-shapes"),
+                     nsIMemoryReporter::KIND_OTHER, rtStats.totalShapes,
+                     "Memory used for all shape-related data in the main "
+                     "JSRuntime. This is the sum of all compartments' "
+                     "'gc-heap/shapes/tree', 'gc-heap/shapes/dict', "
+                     "'gc-heap/shapes/base', 'shapes-extra/tree-tables', "
+                     "'shapes-extra/dict-tables', "
+                     "'shapes-extra/tree-shape-kids' and "
+                     "'shapes-extra/empty-shape-arrays'.");
 
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-scripts"),
-                          nsIMemoryReporter::KIND_OTHER, rtStats.totalScripts,
-                          "Memory used for all script-related data in the main JSRuntime. "
-                          "This is the sum of all compartments' 'gc-heap/scripts' and "
-                          "'script-data' numbers.",
-                          callback, closure);
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-scripts"),
+                     nsIMemoryReporter::KIND_OTHER, rtStats.totalScripts,
+                     "Memory used for all script-related data in the main "
+                     "JSRuntime. This is the sum of all compartments' "
+                     "'gc-heap/scripts' and 'script-data' numbers.");
+
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-strings"),
+                     nsIMemoryReporter::KIND_OTHER, rtStats.totalStrings,
+                     "Memory used for all string-related data in the main "
+                     "JSRuntime. This is the sum of all compartments' "
+                     "'gc-heap/strings' and 'string-chars' numbers.");
 
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-strings"),
-                          nsIMemoryReporter::KIND_OTHER, rtStats.totalStrings,
-                          "Memory used for all string-related data in the main JSRuntime. "
-                          "This is the sum of all compartments' 'gc-heap/strings' and "
-                          "'string-chars' numbers.",
-                          callback, closure);
 #ifdef JS_METHODJIT
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-mjit"),
-                          nsIMemoryReporter::KIND_OTHER, rtStats.totalMjit,
-                          "Memory used by the method JIT in the main JSRuntime.  "
-                          "This is the sum of all compartments' 'mjit/code', and 'mjit/data' "
-                          "numbers.",
-                          callback, closure);
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-mjit"),
+                     nsIMemoryReporter::KIND_OTHER, rtStats.totalMjit,
+                     "Memory used by the method JIT in the main JSRuntime.  "
+                     "This is the sum of all compartments' 'mjit/code', and "
+                     "'mjit/data' numbers.");
 #endif
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-type-inference"),
-                          nsIMemoryReporter::KIND_OTHER, rtStats.totalTypeInference,
-                          "Non-transient memory used by type inference in the main JSRuntime. "
-                          "This is the sum of all compartments' 'gc-heap/type-objects', "
-                          "'type-inference/script-main', 'type-inference/object-main' and "
-                          "'type-inference/tables' numbers.",
-                          callback, closure);
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-type-inference"),
+                     nsIMemoryReporter::KIND_OTHER, rtStats.totalTypeInference,
+                     "Non-transient memory used by type inference in the main "
+                     "JSRuntime. This is the sum of all compartments' "
+                     "'gc-heap/type-objects', 'type-inference/script-main', "
+                     "'type-inference/object-main' and "
+                     "'type-inference/tables' numbers.");
 
-        ReportMemoryBytes(NS_LITERAL_CSTRING("js-main-runtime-analysis-temporary"),
-                          nsIMemoryReporter::KIND_OTHER, rtStats.totalAnalysisTemp,
-                          "Memory used transiently during type inference and compilation in the "
-                          "main JSRuntime. This is the sum of all compartments' "
-                          "'analysis-temporary' numbers.",
-                          callback, closure);
+        REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-analysis-temporary"),
+                     nsIMemoryReporter::KIND_OTHER, rtStats.totalAnalysisTemp,
+                     "Memory used transiently during type inference and "
+                     "compilation in the main JSRuntime. This is the sum of "
+                     "all compartments' 'analysis-temporary' numbers.");
 
         return NS_OK;
     }
@@ -2029,6 +1964,7 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect)
    mVariantRoots(nsnull),
    mWrappedJSRoots(nsnull),
    mObjectHolderRoots(nsnull),
+   mWatchdogLock(nsnull),
    mWatchdogWakeup(nsnull),
    mWatchdogThread(nsnull),
    mWatchdogHibernating(false),
@@ -2053,42 +1989,40 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect)
     if (!mJSRuntime)
         NS_RUNTIMEABORT("JS_NewRuntime failed.");
 
-    {
-        // Unconstrain the runtime's threshold on nominal heap size, to avoid
-        // triggering GC too often if operating continuously near an arbitrary
-        // finite threshold (0xffffffff is infinity for uint32_t parameters).
-        // This leaves the maximum-JS_malloc-bytes threshold still in effect
-        // to cause period, and we hope hygienic, last-ditch GCs from within
-        // the GC's allocator.
-        JS_SetGCParameter(mJSRuntime, JSGC_MAX_BYTES, 0xffffffff);
-        JS_SetNativeStackQuota(mJSRuntime, 128 * sizeof(size_t) * 1024);
-        JS_SetContextCallback(mJSRuntime, ContextCallback);
-        JS_SetCompartmentCallback(mJSRuntime, CompartmentCallback);
-        JS_SetGCCallback(mJSRuntime, GCCallback);
-        JS_SetFinalizeCallback(mJSRuntime, FinalizeCallback);
-        JS_SetExtraGCRootsTracer(mJSRuntime, TraceBlackJS, this);
-        JS_SetGrayGCRootsTracer(mJSRuntime, TraceGrayJS, this);
-        JS_SetWrapObjectCallbacks(mJSRuntime,
-                                  xpc::WrapperFactory::Rewrap,
-                                  xpc::WrapperFactory::PrepareForWrapping);
-        js::SetPreserveWrapperCallback(mJSRuntime, PreserveWrapper);
-
-#ifdef MOZ_CRASHREPORTER
-        JS_EnumerateDiagnosticMemoryRegions(DiagnosticMemoryCallback);
+    // Unconstrain the runtime's threshold on nominal heap size, to avoid
+    // triggering GC too often if operating continuously near an arbitrary
+    // finite threshold (0xffffffff is infinity for uint32_t parameters).
+    // This leaves the maximum-JS_malloc-bytes threshold still in effect
+    // to cause period, and we hope hygienic, last-ditch GCs from within
+    // the GC's allocator.
+    JS_SetGCParameter(mJSRuntime, JSGC_MAX_BYTES, 0xffffffff);
+#ifdef MOZ_ASAN
+    // ASan requires more stack space due to redzones
+    JS_SetNativeStackQuota(mJSRuntime, 2 * 128 * sizeof(size_t) * 1024);
+#else  
+    JS_SetNativeStackQuota(mJSRuntime, 128 * sizeof(size_t) * 1024);
 #endif
-        JS_SetAccumulateTelemetryCallback(mJSRuntime, AccumulateTelemetryCallback);
-        mWatchdogWakeup = PR_NewCondVar(js::GetRuntimeGCLock(mJSRuntime));
-        if (!mWatchdogWakeup)
-            NS_RUNTIMEABORT("PR_NewCondVar failed.");
-
-        js::SetActivityCallback(mJSRuntime, ActivityCallback, this);
-
-        NS_RegisterMemoryReporter(new NS_MEMORY_REPORTER_NAME(XPConnectJSGCHeap));
-        NS_RegisterMemoryReporter(new NS_MEMORY_REPORTER_NAME(XPConnectJSSystemCompartmentCount));
-        NS_RegisterMemoryReporter(new NS_MEMORY_REPORTER_NAME(XPConnectJSUserCompartmentCount));
-        NS_RegisterMemoryMultiReporter(new JSMemoryMultiReporter);
-        NS_RegisterMemoryMultiReporter(new JSCompartmentsMultiReporter);
-    }
+    JS_SetContextCallback(mJSRuntime, ContextCallback);
+    JS_SetCompartmentCallback(mJSRuntime, CompartmentCallback);
+    JS_SetGCCallback(mJSRuntime, GCCallback);
+    JS_SetFinalizeCallback(mJSRuntime, FinalizeCallback);
+    JS_SetExtraGCRootsTracer(mJSRuntime, TraceBlackJS, this);
+    JS_SetGrayGCRootsTracer(mJSRuntime, TraceGrayJS, this);
+    JS_SetWrapObjectCallbacks(mJSRuntime,
+                              xpc::WrapperFactory::Rewrap,
+                              xpc::WrapperFactory::PrepareForWrapping);
+    js::SetPreserveWrapperCallback(mJSRuntime, PreserveWrapper);
+#ifdef MOZ_CRASHREPORTER
+    JS_EnumerateDiagnosticMemoryRegions(DiagnosticMemoryCallback);
+#endif
+    JS_SetAccumulateTelemetryCallback(mJSRuntime, AccumulateTelemetryCallback);
+    js::SetActivityCallback(mJSRuntime, ActivityCallback, this);
+        
+    NS_RegisterMemoryReporter(new NS_MEMORY_REPORTER_NAME(XPConnectJSGCHeap));
+    NS_RegisterMemoryReporter(new NS_MEMORY_REPORTER_NAME(XPConnectJSSystemCompartmentCount));
+    NS_RegisterMemoryReporter(new NS_MEMORY_REPORTER_NAME(XPConnectJSUserCompartmentCount));
+    NS_RegisterMemoryMultiReporter(new JSMemoryMultiReporter);
+    NS_RegisterMemoryMultiReporter(new JSCompartmentsMultiReporter);
 
     if (!JS_DHashTableInit(&mJSHolders, JS_DHashGetStubOps(), nsnull,
                            sizeof(ObjectHolder), 512))
@@ -2098,12 +2032,19 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect)
 
     // Install a JavaScript 'debugger' keyword handler in debug builds only
 #ifdef DEBUG
-    if (mJSRuntime && !JS_GetGlobalDebugHooks(mJSRuntime)->debuggerHandler)
+    if (!JS_GetGlobalDebugHooks(mJSRuntime)->debuggerHandler)
         xpc_InstallJSDebuggerKeywordHandler(mJSRuntime);
 #endif
 
-    if (mWatchdogWakeup) {
-        js::AutoLockGC lock(mJSRuntime);
+    mWatchdogLock = PR_NewLock();
+    if (!mWatchdogLock)
+        NS_RUNTIMEABORT("PR_NewLock failed.");
+    mWatchdogWakeup = PR_NewCondVar(mWatchdogLock);
+    if (!mWatchdogWakeup)
+        NS_RUNTIMEABORT("PR_NewCondVar failed.");
+
+    {
+        AutoLockWatchdog lock(this);
 
         mWatchdogThread = PR_CreateThread(PR_USER_THREAD, WatchdogMain, this,
                                           PR_PRIORITY_NORMAL, PR_LOCAL_THREAD,
diff --git a/js/xpconnect/src/XPCWrappedJS.cpp b/js/xpconnect/src/XPCWrappedJS.cpp
index bccfa81d7f5..1cc58a9f7fa 100644
--- a/js/xpconnect/src/XPCWrappedJS.cpp
+++ b/js/xpconnect/src/XPCWrappedJS.cpp
@@ -668,15 +668,8 @@ nsXPCWrappedJS::GetProperty(const nsAString & name, nsIVariant **_retval)
     if (!ccx.IsValid())
         return NS_ERROR_UNEXPECTED;
 
-    nsStringBuffer* buf;
-    jsval jsstr = XPCStringConvert::ReadableToJSVal(ccx, name, &buf);
-    if (JSVAL_IS_NULL(jsstr))
-        return NS_ERROR_OUT_OF_MEMORY;
-    if (buf)
-        buf->AddRef();
-
     return nsXPCWrappedJSClass::
-        GetNamedPropertyAsVariant(ccx, GetJSObject(), jsstr, _retval);
+        GetNamedPropertyAsVariant(ccx, GetJSObject(), name, _retval);
 }
 
 /***************************************************************************/
diff --git a/js/xpconnect/src/XPCWrappedJSClass.cpp b/js/xpconnect/src/XPCWrappedJSClass.cpp
index 27197366090..8b7c5002cbb 100644
--- a/js/xpconnect/src/XPCWrappedJSClass.cpp
+++ b/js/xpconnect/src/XPCWrappedJSClass.cpp
@@ -375,7 +375,7 @@ GetNamedPropertyAsVariantRaw(XPCCallContext& ccx,
 nsresult
 nsXPCWrappedJSClass::GetNamedPropertyAsVariant(XPCCallContext& ccx,
                                                JSObject* aJSObj,
-                                               jsval aName,
+                                               const nsAString& aName,
                                                nsIVariant** aResult)
 {
     JSContext* cx = ccx.GetJSContext();
@@ -387,7 +387,16 @@ nsXPCWrappedJSClass::GetNamedPropertyAsVariant(XPCCallContext& ccx,
     if (!scriptEval.StartEvaluating(aJSObj))
         return NS_ERROR_FAILURE;
 
-    ok = JS_ValueToId(cx, aName, &id) &&
+    // Wrap the string in a jsval after the AutoScriptEvaluate, so that the
+    // resulting value ends up in the correct compartment.
+    nsStringBuffer* buf;
+    jsval jsstr = XPCStringConvert::ReadableToJSVal(ccx, aName, &buf);
+    if (JSVAL_IS_NULL(jsstr))
+        return NS_ERROR_OUT_OF_MEMORY;
+    if (buf)
+        buf->AddRef();
+
+    ok = JS_ValueToId(cx, jsstr, &id) &&
          GetNamedPropertyAsVariantRaw(ccx, aJSObj, id, aResult, &rv);
 
     return ok ? NS_OK : NS_FAILED(rv) ? rv : NS_ERROR_FAILURE;
diff --git a/js/xpconnect/src/dictionary_helper_gen.conf b/js/xpconnect/src/dictionary_helper_gen.conf
index a25c4665618..50144a0c477 100644
--- a/js/xpconnect/src/dictionary_helper_gen.conf
+++ b/js/xpconnect/src/dictionary_helper_gen.conf
@@ -9,7 +9,8 @@ dictionaries = [
      [ 'nsIUIEventInit', 'nsIDOMUIEvent.idl' ],
      [ 'nsIMouseEventInit', 'nsIDOMMouseEvent.idl' ],
      [ 'nsIIDBObjectStoreParameters', 'nsIIDBDatabase.idl' ],
-     [ 'nsIIDBIndexParameters', 'nsIIDBObjectStore.idl' ]
+     [ 'nsIIDBIndexParameters', 'nsIIDBObjectStore.idl' ],
+     [ 'nsIStorageEventInit', 'nsIDOMStorageEvent.idl' ]
    ]
 
 # include file names
diff --git a/js/xpconnect/src/dictionary_helper_gen.py b/js/xpconnect/src/dictionary_helper_gen.py
index 833a8fbb638..2fc30ff84db 100644
--- a/js/xpconnect/src/dictionary_helper_gen.py
+++ b/js/xpconnect/src/dictionary_helper_gen.py
@@ -320,23 +320,8 @@ def write_header(iface, fd):
     if iface.base != "nsISupports":
         fd.write(" : public %s" % dict_name(iface.base))
     fd.write("\n{\npublic:\n")
-    fd.write("  %s()" % dict_name(iface.name))
-
-    if iface.base != "nsISupports" or len(attributes) > 0:
-        fd.write(" :\n")
-    
-    if iface.base != "nsISupports":
-        fd.write("    %s()" % dict_name(iface.base))
-        if len(attributes) > 0:
-            fd.write(",\n")
-
-    for i in range(len(attributes)):
-        fd.write("    %s(%s)" % (attributes[i].name, init_value(attributes[i])))
-        if i < (len(attributes) - 1):
-            fd.write(",")
-        fd.write("\n")
-
-    fd.write("  {}\n\n")
+    fd.write("  %s();\n" % dict_name(iface.name))
+    fd.write("  ~%s();\n\n" % dict_name(iface.name))
 
     fd.write("  // If aCx or aVal is null, NS_OK is returned and \n"
              "  // dictionary will use the default values. \n"
@@ -355,6 +340,25 @@ def write_cpp(iface, fd):
         if isinstance(member, xpidl.Attribute):
             attributes.append(member)
 
+    fd.write("%s::%s()" % (dict_name(iface.name), dict_name(iface.name)))
+
+    if iface.base != "nsISupports" or len(attributes) > 0:
+        fd.write(" :\n")
+    
+    if iface.base != "nsISupports":
+        fd.write("  %s()" % dict_name(iface.base))
+        if len(attributes) > 0:
+            fd.write(",\n")
+
+    for i in range(len(attributes)):
+        fd.write("  %s(%s)" % (attributes[i].name, init_value(attributes[i])))
+        if i < (len(attributes) - 1):
+            fd.write(",")
+        fd.write("\n")
+
+    fd.write("  {}\n\n")
+    fd.write("%s::~%s() {}\n\n" % (dict_name(iface.name), dict_name(iface.name)))
+
     fd.write("static nsresult\n%s_InitInternal(%s& aDict, %s* aIfaceObject, JSContext* aCx, JSObject* aObj)\n" %
              (dict_name(iface.name), dict_name(iface.name), iface.name))
     fd.write("{\n")
diff --git a/js/xpconnect/src/nsXPConnect.cpp b/js/xpconnect/src/nsXPConnect.cpp
index 138f0467283..2912907805c 100644
--- a/js/xpconnect/src/nsXPConnect.cpp
+++ b/js/xpconnect/src/nsXPConnect.cpp
@@ -1145,12 +1145,8 @@ CreateNewCompartment(JSContext *cx, JSClass *clasp, nsIPrincipal *principal,
     // of failure or give ownership to the compartment in case of success (in
     // that case it will be free'd in CompartmentCallback during GC).
     nsAutoPtr<xpc::CompartmentPrivate> priv_holder(priv);
-    JSPrincipals *principals = nsnull;
-    if (principal)
-        principal->GetJSPrincipals(cx, &principals);
-    JSObject *tempGlobal = JS_NewCompartmentAndGlobalObject(cx, clasp, principals);
-    if (principals)
-        JSPRINCIPALS_DROP(cx, principals);
+    JSObject *tempGlobal =
+        JS_NewCompartmentAndGlobalObject(cx, clasp, nsJSPrincipals::get(principal));
 
     if (!tempGlobal)
         return false;
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 8d17f18b41b..222f8677e32 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -837,11 +837,14 @@ private:
     XPCRootSetElem *mWrappedJSRoots;
     XPCRootSetElem *mObjectHolderRoots;
     JSDHashTable mJSHolders;
+    PRLock *mWatchdogLock;
     PRCondVar *mWatchdogWakeup;
     PRThread *mWatchdogThread;
     nsTArray<JSGCCallback> extraGCCallbacks;
     bool mWatchdogHibernating;
     PRTime mLastActiveTime; // -1 if active NOW
+
+    friend class AutoLockWatchdog;
 };
 
 /***************************************************************************/
@@ -2898,7 +2901,7 @@ public:
 
     static nsresult GetNamedPropertyAsVariant(XPCCallContext& ccx,
                                               JSObject* aJSObj,
-                                              jsval aName,
+                                              const nsAString& aName,
                                               nsIVariant** aResult);
 
     virtual ~nsXPCWrappedJSClass();
diff --git a/js/xpconnect/src/xpcpublic.h b/js/xpconnect/src/xpcpublic.h
index 46830c44d29..2e72278785a 100644
--- a/js/xpconnect/src/xpcpublic.h
+++ b/js/xpconnect/src/xpcpublic.h
@@ -222,9 +222,6 @@ bool Base64Decode(JSContext *cx, JS::Value val, JS::Value *out);
 bool StringToJsval(JSContext *cx, nsAString &str, JS::Value *rval);
 bool NonVoidStringToJsval(JSContext *cx, nsAString &str, JS::Value *rval);
 
-void *GetCompartmentName(JSRuntime *rt, JSCompartment *c);
-void DestroyCompartmentName(void *string);
-
 #ifdef DEBUG
 void DumpJSHeap(FILE* file);
 #endif
@@ -238,9 +235,10 @@ namespace memory {
 
 // This reports all the stats in |rtStats| that belong in the "explicit" tree,
 // (which isn't all of them).
-void
-ReportJSRuntimeExplicitTreeStats(const JS::RuntimeStats &rtStats, const nsACString &pathPrefix,
-                                 nsIMemoryMultiReporterCallback *callback,
+nsresult
+ReportJSRuntimeExplicitTreeStats(const JS::RuntimeStats &rtStats,
+                                 const nsACString &pathPrefix,
+                                 nsIMemoryMultiReporterCallback *cb,
                                  nsISupports *closure);
 
 } // namespace memory
diff --git a/js/xpconnect/wrappers/AccessCheck.cpp b/js/xpconnect/wrappers/AccessCheck.cpp
index 6f0364572cd..9e17cf49a8a 100644
--- a/js/xpconnect/wrappers/AccessCheck.cpp
+++ b/js/xpconnect/wrappers/AccessCheck.cpp
@@ -61,8 +61,7 @@ namespace xpc {
 nsIPrincipal *
 GetCompartmentPrincipal(JSCompartment *compartment)
 {
-    JSPrincipals *prin = JS_GetCompartmentPrincipals(compartment);
-    return prin ? static_cast<nsJSPrincipals *>(prin)->nsIPrincipalPtr : nsnull;
+    return nsJSPrincipals::get(JS_GetCompartmentPrincipals(compartment));
 }
 
 bool
diff --git a/layout/base/nsBidiPresUtils.cpp b/layout/base/nsBidiPresUtils.cpp
index 28b44382a32..104b8888ae5 100644
--- a/layout/base/nsBidiPresUtils.cpp
+++ b/layout/base/nsBidiPresUtils.cpp
@@ -644,7 +644,7 @@ nsBidiPresUtils::Resolve(nsBlockFrame* aBlockFrame)
   for (nsBlockFrame* block = aBlockFrame; block;
        block = static_cast<nsBlockFrame*>(block->GetNextContinuation())) {
     block->RemoveStateBits(NS_BLOCK_NEEDS_BIDI_RESOLUTION);
-    nsBlockInFlowLineIterator lineIter(block, block->begin_lines(), false);
+    nsBlockInFlowLineIterator lineIter(block, block->begin_lines());
     bpd.mPrevFrame = nsnull;
     bpd.GetSubParagraph()->mPrevFrame = nsnull;
     TraverseFrames(aBlockFrame, &lineIter, block->GetFirstPrincipalChild(), &bpd);
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 7efed165331..e1f55b2f739 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -7580,7 +7580,14 @@ DoApplyRenderingChangeToTree(nsIFrame* aFrame,
     // if frame has view, will already be invalidated
     if (aChange & nsChangeHint_RepaintFrame) {
       if (aFrame->IsFrameOfType(nsIFrame::eSVG)) {
-        nsSVGUtils::UpdateGraphic(aFrame);
+        if (aChange & nsChangeHint_UpdateEffects) {
+          // Invalidate the frame's old bounds, update its bounds, invalidate its new
+          // bounds, and then inform anyone observing _us_ that we've changed:
+          nsSVGUtils::UpdateGraphic(aFrame);
+        } else {
+          // Just invalidate our area:
+          nsSVGUtils::InvalidateCoveredRegion(aFrame);
+        }
       } else {
         aFrame->InvalidateOverflowRect();
       }
diff --git a/layout/base/tests/Makefile.in b/layout/base/tests/Makefile.in
index 4f4ed0fd20b..e667df82a55 100644
--- a/layout/base/tests/Makefile.in
+++ b/layout/base/tests/Makefile.in
@@ -169,6 +169,7 @@ _TEST_FILES =	\
 		test_bug588174.html \
 		test_bug607529.html \
 		file_bug607529.html \
+		test_bug667512.html \
 		test_bug677878.html \
 		test_bug696020.html \
 		test_flush_on_paint.html \
diff --git a/layout/base/tests/test_bug667512.html b/layout/base/tests/test_bug667512.html
new file mode 100644
index 00000000000..600b6d0f6b4
--- /dev/null
+++ b/layout/base/tests/test_bug667512.html
@@ -0,0 +1,41 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=667512
+-->
+<head>
+  <title>Test for Bug 667512</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<table contenteditable="true"><tbody><tr><td id="b"><br id="a"></td></tr></tbody></table>
+<span style="display: list-item;direction: rtl;"></span>
+<script type="application/javascript">
+
+/** Test for Bug 667512 **/
+function appendElements() {
+  window.focus();
+  window.getSelection().collapse(document.documentElement, 0);
+
+  var x=document.getElementById('a');
+  x.parentNode.removeChild(x);
+
+  var x=document.getElementById('b');
+  x.parentNode.removeChild(x);
+
+  synthesizeKey("VK_LEFT", {});
+  synthesizeKey("VK_RIGHT", {});
+
+  ok(true, "Should not crash!");
+  SimpleTest.finish();
+}
+
+addLoadEvent(appendElements);
+SimpleTest.waitForExplicitFinish();
+
+</script>
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/build/nsLayoutModule.cpp b/layout/build/nsLayoutModule.cpp
index d2dc08f232f..a7e24e95325 100644
--- a/layout/build/nsLayoutModule.cpp
+++ b/layout/build/nsLayoutModule.cpp
@@ -62,7 +62,6 @@
 #include "nsIFactory.h"
 #include "nsIFrameUtil.h"
 #include "nsHTMLStyleSheet.h"
-#include "nsIHTMLToTextSink.h"
 #include "nsILayoutDebugger.h"
 #include "nsINameSpaceManager.h"
 #include "nsINodeInfo.h"
@@ -1136,7 +1135,6 @@ static const mozilla::Module::ContractIDEntry kLayoutContracts[] = {
   { NS_CONTENTSERIALIZER_CONTRACTID_PREFIX "text/html", &kNS_HTMLCONTENTSERIALIZER_CID },
   { NS_CONTENTSERIALIZER_CONTRACTID_PREFIX "application/vnd.mozilla.xul+xml", &kNS_XMLCONTENTSERIALIZER_CID },
   { NS_CONTENTSERIALIZER_CONTRACTID_PREFIX "text/plain", &kNS_PLAINTEXTSERIALIZER_CID },
-  { NS_PLAINTEXTSINK_CONTRACTID, &kNS_PLAINTEXTSERIALIZER_CID },
   { MOZ_SANITIZINGHTMLSERIALIZER_CONTRACTID, &kMOZ_SANITIZINGHTMLSERIALIZER_CID },
   { NS_PARSERUTILS_CONTRACTID, &kNS_PARSERUTILS_CID },
   { NS_SCRIPTABLEUNESCAPEHTML_CONTRACTID, &kNS_SCRIPTABLEUNESCAPEHTML_CID },
diff --git a/layout/forms/nsComboboxControlFrame.cpp b/layout/forms/nsComboboxControlFrame.cpp
index 3f605eae2f6..5a61ab784f4 100644
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -1324,7 +1324,7 @@ nsComboboxControlFrame::DestroyFrom(nsIFrame* aDestructRoot)
   nsBlockFrame::DestroyFrom(aDestructRoot);
 }
 
-nsFrameList
+const nsFrameList&
 nsComboboxControlFrame::GetChildList(ChildListID aListID) const
 {
   if (kSelectPopupList == aListID) {
diff --git a/layout/forms/nsComboboxControlFrame.h b/layout/forms/nsComboboxControlFrame.h
index ea412a8a4fc..91cd8b6a3d2 100644
--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@@ -141,7 +141,7 @@ public:
   virtual void DestroyFrom(nsIFrame* aDestructRoot);
   NS_IMETHOD SetInitialChildList(ChildListID     aListID,
                                  nsFrameList&    aChildList);
-  virtual nsFrameList GetChildList(ChildListID aListID) const;
+  virtual const nsFrameList& GetChildList(ChildListID aListID) const;
   virtual void GetChildLists(nsTArray<ChildList>* aLists) const;
 
   virtual nsIFrame* GetContentInsertionFrame();
diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
index c6a384e6c1b..6b0f5812a1e 100644
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -285,6 +285,11 @@ NS_DECLARE_FRAME_PROPERTY(LineCursorProperty, nsnull)
 NS_DECLARE_FRAME_PROPERTY(OverflowLinesProperty, DestroyOverflowLines)
 NS_DECLARE_FRAME_PROPERTY(OverflowOutOfFlowsProperty,
                           nsContainerFrame::DestroyFrameList)
+NS_DECLARE_FRAME_PROPERTY(PushedFloatProperty,
+                          nsContainerFrame::DestroyFrameList)
+NS_DECLARE_FRAME_PROPERTY(OutsideBulletProperty,
+                          nsContainerFrame::DestroyFrameList)
+NS_DECLARE_FRAME_PROPERTY(InsideBulletProperty, nsnull)
 
 //----------------------------------------------------------------------
 
@@ -308,12 +313,6 @@ void
 nsBlockFrame::DestroyFrom(nsIFrame* aDestructRoot)
 {
   DestroyAbsoluteFrames(aDestructRoot);
-  // Outside bullets are not in our child-list so check for them here
-  // and delete them when present.
-  if (mBullet && HaveOutsideBullet()) {
-    mBullet->DestroyFrom(aDestructRoot);
-    mBullet = nsnull;
-  }
 
   mFloats.DestroyFramesFrom(aDestructRoot);
 
@@ -329,9 +328,10 @@ nsBlockFrame::DestroyFrom(nsIFrame* aDestructRoot)
   }
 
   // destroy overflow lines now
-  nsLineList* overflowLines = RemoveOverflowLines();
+  FrameLines* overflowLines = RemoveOverflowLines();
   if (overflowLines) {
-    nsLineBox::DeleteLineList(presContext, *overflowLines, aDestructRoot);
+    nsLineBox::DeleteLineList(presContext, overflowLines->mLines,
+                              aDestructRoot);
     delete overflowLines;
   }
 
@@ -454,12 +454,12 @@ nsBlockFrame::List(FILE* out, PRInt32 aIndent) const
   }
 
   // Output the overflow lines.
-  const nsLineList* overflowLines = GetOverflowLines();
-  if (overflowLines && !overflowLines->empty()) {
+  const FrameLines* overflowLines = GetOverflowLines();
+  if (overflowLines && !overflowLines->mLines.empty()) {
     IndentBy(out, aIndent);
     fputs("Overflow-lines<\n", out);
-    const_line_iterator line = overflowLines->begin(),
-                        line_end = overflowLines->end();
+    const_line_iterator line = overflowLines->mLines.begin(),
+                        line_end = overflowLines->mLines.end();
     for ( ; line != line_end; ++line) {
       line->List(out, aIndent + 1);
     }
@@ -574,19 +574,15 @@ nsBlockFrame::GetCaretBaseline() const
 /////////////////////////////////////////////////////////////////////////////
 // Child frame enumeration
 
-nsFrameList
+const nsFrameList&
 nsBlockFrame::GetChildList(ChildListID aListID) const
 {
   switch (aListID) {
     case kPrincipalList:
       return mFrames;
     case kOverflowList: {
-      // XXXbz once we start using nsFrameList for our overflow list, we
-      // could switch GetChildList to returning a |const nsFrameList&|.
-      nsLineList* overflowLines = GetOverflowLines();
-      return overflowLines ? nsFrameList(overflowLines->front()->mFirstChild,
-                                         overflowLines->back()->LastChild())
-                           : nsFrameList::EmptyList();
+      FrameLines* overflowLines = GetOverflowLines();
+      return overflowLines ? overflowLines->mFrames : nsFrameList::EmptyList();
     }
     case kFloatList:
       return mFloats;
@@ -598,9 +594,10 @@ nsBlockFrame::GetChildList(ChildListID aListID) const
       const nsFrameList* list = GetPushedFloats();
       return list ? *list : nsFrameList::EmptyList();
     }
-    case kBulletList:
-      return HaveOutsideBullet() ? nsFrameList(mBullet, mBullet)
-                                 : nsFrameList::EmptyList();
+    case kBulletList: {
+      const nsFrameList* list = GetOutsideBulletList();
+      return list ? *list : nsFrameList::EmptyList();
+    }
     default:
       return nsContainerFrame::GetChildList(aListID);
   }
@@ -610,20 +607,18 @@ void
 nsBlockFrame::GetChildLists(nsTArray<ChildList>* aLists) const
 {
   nsContainerFrame::GetChildLists(aLists);
-  nsLineList* overflowLines = GetOverflowLines();
-  if (overflowLines && overflowLines->front()->mFirstChild) {
-    nsFrameList overflowList(overflowLines->front()->mFirstChild,
-                             overflowLines->back()->LastChild());
-    overflowList.AppendIfNonempty(aLists, kOverflowList);
+  FrameLines* overflowLines = GetOverflowLines();
+  if (overflowLines) {
+    overflowLines->mFrames.AppendIfNonempty(aLists, kOverflowList);
   }
   const nsFrameList* list = GetOverflowOutOfFlows();
   if (list) {
     list->AppendIfNonempty(aLists, kOverflowOutOfFlowList);
   }
   mFloats.AppendIfNonempty(aLists, kFloatList);
-  if (HaveOutsideBullet()) {
-    nsFrameList bullet(mBullet, mBullet);
-    bullet.AppendIfNonempty(aLists, kBulletList);
+  list = GetOutsideBulletList();
+  if (list) {
+    list->AppendIfNonempty(aLists, kBulletList);
   }
   list = GetPushedFloats();
   if (list) {
@@ -637,8 +632,9 @@ nsBlockFrame::IsFloatContainingBlock() const
   return true;
 }
 
-static void ReparentFrame(nsIFrame* aFrame, nsIFrame* aOldParent,
-                          nsIFrame* aNewParent) {
+static void
+ReparentFrame(nsIFrame* aFrame, nsIFrame* aOldParent, nsIFrame* aNewParent)
+{
   NS_ASSERTION(aOldParent == aFrame->GetParent(),
                "Parent not consistent with expectations");
 
@@ -650,8 +646,37 @@ static void ReparentFrame(nsIFrame* aFrame, nsIFrame* aOldParent,
                                       aOldParent, aNewParent);
 }
  
-//////////////////////////////////////////////////////////////////////
-// Frame structure methods
+static void
+ReparentFrames(nsFrameList& aFrameList, nsIFrame* aOldParent,
+               nsIFrame* aNewParent)
+{
+  for (nsFrameList::Enumerator e(aFrameList); !e.AtEnd(); e.Next()) {
+    ReparentFrame(e.get(), aOldParent, aNewParent);
+  }
+}
+ 
+/**
+ * Remove the first line from aFromLines and adjust the associated frame list
+ * aFromFrames accordingly.  The removed line is assigned to *aOutLine and
+ * a frame list with its frames is assigned to *aOutFrames, i.e. the frames
+ * that were extracted from the head of aFromFrames.
+ * aFromLines must contain at least one line, the line may be empty.
+ * @return true if aFromLines becomes empty
+ */
+static bool
+RemoveFirstLine(nsLineList& aFromLines, nsFrameList& aFromFrames,
+                nsLineBox** aOutLine, nsFrameList* aOutFrames)
+{
+  nsLineList_iterator removedLine = aFromLines.begin();
+  *aOutLine = removedLine;
+  nsLineList_iterator next = aFromLines.erase(removedLine);
+  bool isLastLine = next == aFromLines.end();
+  nsIFrame* lastFrame = isLastLine ? aFromFrames.LastChild()
+                                   : next->mFirstChild->GetPrevSibling();
+  nsFrameList::FrameLinkEnumerator linkToBreak(aFromFrames, lastFrame);
+  *aOutFrames = aFromFrames.ExtractHead(linkToBreak);
+  return isLastLine;
+}
 
 //////////////////////////////////////////////////////////////////////
 // Reflow methods
@@ -1059,7 +1084,7 @@ nsBlockFrame::Reflow(nsPresContext*           aPresContext,
   }
 
   if (!NS_FRAME_IS_FULLY_COMPLETE(state.mReflowStatus)) {
-    if (GetOverflowLines() || GetPushedFloats()) {
+    if (HasOverflowLines() || HasPushedFloats()) {
       state.mReflowStatus |= NS_FRAME_REFLOW_NEXTINFLOW;
     }
 
@@ -1082,7 +1107,7 @@ nsBlockFrame::Reflow(nsPresContext*           aPresContext,
   // rare case: an empty first line followed by a second line that
   // contains a block (example: <LI>\n<P>... ). This is where
   // the second case can happen.
-  if (mBullet && HaveOutsideBullet() && !mLines.empty() &&
+  if (HasOutsideBullet() && !mLines.empty() &&
       (mLines.front()->IsBlock() ||
        (0 == mLines.front()->mBounds.height &&
         mLines.front() != mLines.back() &&
@@ -1094,7 +1119,8 @@ nsBlockFrame::Reflow(nsPresContext*           aPresContext,
     bool havePosition = nsLayoutUtils::GetFirstLinePosition(this, &position);
     nscoord lineTop = havePosition ? position.mTop
                                    : reflowState->mComputedBorderPadding.top;
-    ReflowBullet(state, metrics, lineTop);
+    nsIFrame* bullet = GetOutsideBullet();
+    ReflowBullet(bullet, state, metrics, lineTop);
     NS_ASSERTION(!BulletIsEmpty() || metrics.height == 0,
                  "empty bullet took up space");
 
@@ -1105,9 +1131,9 @@ nsBlockFrame::Reflow(nsPresContext*           aPresContext,
       // bullets that are placed next to a child block (bug 92896)
     
       // Tall bullets won't look particularly nice here...
-      nsRect bbox = mBullet->GetRect();
+      nsRect bbox = bullet->GetRect();
       bbox.y = position.mBaseline - metrics.ascent;
-      mBullet->SetRect(bbox);
+      bullet->SetRect(bbox);
     }
     // Otherwise just leave the bullet where it is, up against our top padding.
   }
@@ -1463,13 +1489,14 @@ nsBlockFrame::ComputeOverflowAreas(const nsRect&         aBounds,
       areas.UnionWith(line->GetOverflowAreas());
     }
 
-    // Factor the bullet in; normally the bullet will be factored into
+    // Factor an outside bullet in; normally the bullet will be factored into
     // the line-box's overflow areas. However, if the line is a block
     // line then it won't; if there are no lines, it won't. So just
     // factor it in anyway (it can't hurt if it was already done).
     // XXXldb Can we just fix GetOverflowArea instead?
-    if (mBullet) {
-      areas.UnionAllWith(mBullet->GetRect());
+    nsIFrame* outsideBullet = GetOutsideBullet();
+    if (outsideBullet) {
+      areas.UnionAllWith(outsideBullet->GetRect());
     }
 
     // Factor in the bottom edge of the children.  Child frames will be added
@@ -2190,7 +2217,7 @@ nsBlockFrame::ReflowDirtyLines(nsBlockReflowState& aState)
     line_iterator lineIter = this->end_lines();
     if (lineIter != this->begin_lines()) {
       lineIter--; // I have lines; step back from dummy iterator to last line.
-      nsBlockInFlowLineIterator bifLineIter(this, lineIter, false);
+      nsBlockInFlowLineIterator bifLineIter(this, lineIter);
 
       // Check for next-in-flow-chain's first line.
       // (First, see if there is such a line, and second, see if it's clean)
@@ -2212,92 +2239,59 @@ nsBlockFrame::ReflowDirtyLines(nsBlockReflowState& aState)
   if (!skipPull && aState.mNextInFlow) {
     // Pull data from a next-in-flow if there's still room for more
     // content here.
-    while (keepGoing && (nsnull != aState.mNextInFlow)) {
+    while (keepGoing && aState.mNextInFlow) {
       // Grab first line from our next-in-flow
       nsBlockFrame* nextInFlow = aState.mNextInFlow;
-      line_iterator nifLine = nextInFlow->begin_lines();
-      nsLineBox *toMove;
-      bool toMoveIsOverflowLine;
-      if (nifLine != nextInFlow->end_lines()) {
-        toMove = nifLine;
-        nextInFlow->mLines.erase(nifLine);
-        toMoveIsOverflowLine = false;
+      nsLineBox* pulledLine;
+      nsFrameList pulledFrames;
+      bool isOverflowLine = false;
+      if (!nextInFlow->mLines.empty()) {
+        RemoveFirstLine(nextInFlow->mLines, nextInFlow->mFrames,
+                        &pulledLine, &pulledFrames);
       } else {
         // Grab an overflow line if there are any
-        nsLineList* overflowLines = nextInFlow->GetOverflowLines();
+        FrameLines* overflowLines = nextInFlow->GetOverflowLines();
         if (!overflowLines) {
           aState.mNextInFlow =
             static_cast<nsBlockFrame*>(nextInFlow->GetNextInFlow());
           continue;
         }
-        nifLine = overflowLines->begin();
-        NS_ASSERTION(nifLine != overflowLines->end(),
-                     "Stored overflow line list should not be empty");
-        toMove = nifLine;
-        nextInFlow->RemoveOverflowLines();
-        nifLine = overflowLines->erase(nifLine);
-        if (nifLine != overflowLines->end()) {
-          // We need to this remove-and-put-back dance because we want
-          // to avoid making the overflow line list empty while it's
-          // stored in the property (because the property has the
-          // invariant that the list is never empty).
-          nextInFlow->SetOverflowLines(overflowLines);
-        } else {
-          delete overflowLines;
+        bool last =
+          RemoveFirstLine(overflowLines->mLines, overflowLines->mFrames,
+                          &pulledLine, &pulledFrames);
+        if (last) {
+          nextInFlow->DestroyOverflowLines();
         }
-        toMoveIsOverflowLine = true;
+        isOverflowLine = true;
       }
 
-      if (0 == toMove->GetChildCount()) {
+      if (pulledFrames.IsEmpty()) {
         // The line is empty. Try the next one.
-        NS_ASSERTION(nsnull == toMove->mFirstChild, "bad empty line");
-        aState.FreeLineBox(toMove);
+        NS_ASSERTION(pulledLine->GetChildCount() == 0 &&
+                     !pulledLine->mFirstChild, "bad empty line");
+        aState.FreeLineBox(pulledLine);
         continue;
       }
 
-      // XXX move to a subroutine: run-in, overflow, pullframe and this do this
-      // Make the children in the line ours.
-      nsIFrame* frame = toMove->mFirstChild;
-      nsIFrame* lastFrame = nsnull;
-      PRInt32 n = toMove->GetChildCount();
-      while (--n >= 0) {
-        ReparentFrame(frame, nextInFlow, this);
-        lastFrame = frame;
-        frame = frame->GetNextSibling();
-      }
-
-      NS_ASSERTION(lastFrame == toMove->LastChild(), "Unexpected lastFrame");
+      ReparentFrames(pulledFrames, nextInFlow, this);
 
+      NS_ASSERTION(pulledFrames.LastChild() == pulledLine->LastChild(),
+                   "Unexpected last frame");
       NS_ASSERTION(aState.mPrevChild || mLines.empty(), "should have a prevchild here");
-
       NS_ASSERTION(aState.mPrevChild == mFrames.LastChild(),
                    "Incorrect aState.mPrevChild before inserting line at end");
 
-      // Shift toMove's frames into our mFrames list.
-      if (toMoveIsOverflowLine) {
-        // Pulling from an overflow list
-        // XXXbz If we switch overflow lines to nsFrameList, we should
-        // change this SetNextSibling call.
-        lastFrame->SetNextSibling(nsnull);
-      } else {
-        // Pulling from nextInFlow->mFrames
-        nsFrameList::FrameLinkEnumerator linkToBreak(nextInFlow->mFrames, lastFrame);
-        nextInFlow->mFrames.ExtractHead(linkToBreak);
-      }
-      nsFrameList newFrames(toMove->mFirstChild, lastFrame);
-      mFrames.AppendFrames(nsnull, newFrames);
+      // Shift pulledLine's frames into our mFrames list.
+      mFrames.AppendFrames(nsnull, pulledFrames);
 
       // Add line to our line list, and set its last child as our new prev-child
-      line = mLines.before_insert(end_lines(), toMove);
-      aState.mPrevChild = lastFrame;
-
-      NS_ASSERTION(aState.mPrevChild == mFrames.LastChild(),
-                   "Incorrect aState.mPrevChild after inserting line at end");
+      line = mLines.before_insert(end_lines(), pulledLine);
+      aState.mPrevChild = mFrames.LastChild();
 
       // Reparent floats whose placeholders are in the line.
-      ReparentFloats(toMove->mFirstChild, nextInFlow, toMoveIsOverflowLine, true);
+      ReparentFloats(pulledLine->mFirstChild, nextInFlow, isOverflowLine, true);
 
-      DumpLine(aState, toMove, deltaY, 0);
+      DumpLine(aState, pulledLine, deltaY, 0);
 #ifdef DEBUG
       AutoNoisyIndenter indent2(gNoisyReflow);
 #endif
@@ -2350,9 +2344,10 @@ nsBlockFrame::ReflowDirtyLines(nsBlockReflowState& aState)
   }
 
   // Handle an odd-ball case: a list-item with no lines
-  if (mBullet && HaveOutsideBullet() && mLines.empty()) {
+  if (HasOutsideBullet() && mLines.empty()) {
     nsHTMLReflowMetrics metrics;
-    ReflowBullet(aState, metrics,
+    nsIFrame* bullet = GetOutsideBullet();
+    ReflowBullet(bullet, aState, metrics,
                  aState.mReflowState.mComputedBorderPadding.top);
     NS_ASSERTION(!BulletIsEmpty() || metrics.height == 0,
                  "empty bullet took up space");
@@ -2362,7 +2357,7 @@ nsBlockFrame::ReflowDirtyLines(nsBlockReflowState& aState)
       // we end up with *some* height.
 
       if (metrics.ascent == nsHTMLReflowMetrics::ASK_FOR_BASELINE &&
-          !nsLayoutUtils::GetFirstLineBaseline(mBullet, &metrics.ascent)) {
+          !nsLayoutUtils::GetFirstLineBaseline(bullet, &metrics.ascent)) {
         metrics.ascent = metrics.height;
       }
 
@@ -2380,7 +2375,7 @@ nsBlockFrame::ReflowDirtyLines(nsBlockReflowState& aState)
 
       nscoord offset = minAscent - metrics.ascent;
       if (offset > 0) {
-        mBullet->SetRect(mBullet->GetRect() + nsPoint(0, offset));
+        bullet->SetRect(bullet->GetRect() + nsPoint(0, offset));
       }
     }
   }
@@ -2594,7 +2589,7 @@ nsBlockFrame::PullFrame(nsBlockReflowState& aState,
 {
   // First check our remaining lines.
   if (end_lines() != aLine.next()) {
-    return PullFrameFrom(aState, aLine, this, false, aLine.next());
+    return PullFrameFrom(aState, aLine, this, false, mFrames, aLine.next());
   }
 
   NS_ASSERTION(!GetOverflowLines(),
@@ -2606,13 +2601,15 @@ nsBlockFrame::PullFrame(nsBlockReflowState& aState,
     // first normal lines, then overflow lines
     if (!nextInFlow->mLines.empty()) {
       return PullFrameFrom(aState, aLine, nextInFlow, false,
+                           nextInFlow->mFrames,
                            nextInFlow->mLines.begin());
     }
 
-    nsLineList* overflowLines = nextInFlow->GetOverflowLines();
+    FrameLines* overflowLines = nextInFlow->GetOverflowLines();
     if (overflowLines) {
       return PullFrameFrom(aState, aLine, nextInFlow, true,
-                           overflowLines->begin());
+                           overflowLines->mFrames,
+                           overflowLines->mLines.begin());
     }
 
     nextInFlow = static_cast<nsBlockFrame*>(nextInFlow->GetNextInFlow());
@@ -2627,6 +2624,7 @@ nsBlockFrame::PullFrameFrom(nsBlockReflowState&  aState,
                             nsLineBox*           aLine,
                             nsBlockFrame*        aFromContainer,
                             bool                 aFromOverflowLine,
+                            nsFrameList&         aFromFrameList,
                             nsLineList::iterator aFromLine)
 {
   nsLineBox* fromLine = aFromLine;
@@ -2653,16 +2651,12 @@ nsBlockFrame::PullFrameFrom(nsBlockReflowState&  aState,
     // The frame is being pulled from a next-in-flow; therefore we
     // need to add it to our sibling list.
     if (NS_LIKELY(!aFromOverflowLine)) {
+      NS_ASSERTION(&aFromFrameList == &aFromContainer->mFrames,
+                   "must be normal flow if not overflow line");
       NS_ASSERTION(aFromLine == aFromContainer->mLines.begin(),
                    "should only pull from first line");
-      // Pulling from the next-in-flow's normal line list
-      aFromContainer->mFrames.RemoveFrame(frame);
-    } else {
-      // Pulling from the next-in-flow's overflow list
-      // XXXbz If we switch overflow lines to nsFrameList, we should
-      // change this SetNextSibling call.
-      frame->SetNextSibling(nsnull);
     }
+    aFromFrameList.RemoveFrame(frame);
 
     // When pushing and pulling frames we need to check for whether any
     // views need to be reparented
@@ -2692,9 +2686,10 @@ nsBlockFrame::PullFrameFrom(nsBlockReflowState&  aState,
     // XXX WHY do we invalidate the bounds AND the combined area? doesn't
     // the combined area always enclose the bounds?
     Invalidate(fromLine->mBounds);
-    nsLineList* fromLineList = aFromOverflowLine
-      ? aFromContainer->RemoveOverflowLines()
-      : &aFromContainer->mLines;
+    FrameLines* overflowLines =
+      aFromOverflowLine ? aFromContainer->RemoveOverflowLines() : nsnull;
+    nsLineList* fromLineList =
+      aFromOverflowLine ? &overflowLines->mLines : &aFromContainer->mLines;
     if (aFromLine.next() != fromLineList->end())
       aFromLine.next()->MarkPreviousMarginDirty();
 
@@ -2706,9 +2701,9 @@ nsBlockFrame::PullFrameFrom(nsBlockReflowState&  aState,
     // Put any remaining overflow lines back.
     if (aFromOverflowLine) {
       if (!fromLineList->empty()) {
-        aFromContainer->SetOverflowLines(fromLineList);
+        aFromContainer->SetOverflowLines(overflowLines);
       } else {
-        delete fromLineList;
+        delete overflowLines;
         // Now any iterators into fromLineList are invalid (but
         // aFromLine already was invalidated above)
       }
@@ -2866,7 +2861,7 @@ nsBlockFrame::IsSelfEmpty()
     return false;
   }
 
-  if (HaveOutsideBullet() && !BulletIsEmpty()) {
+  if (HasOutsideBullet() && !BulletIsEmpty()) {
     return false;
   }
 
@@ -3780,15 +3775,15 @@ nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState& aState,
 
   if (aLineLayout.GetDirtyNextLine()) {
     // aLine may have been pushed to the overflow lines.
-    nsLineList* overflowLines = GetOverflowLines();
+    FrameLines* overflowLines = GetOverflowLines();
     // We can't just compare iterators front() to aLine here, since they may be in
     // different lists.
     bool pushedToOverflowLines = overflowLines &&
-      overflowLines->front() == aLine.get();
+      overflowLines->mLines.front() == aLine.get();
     if (pushedToOverflowLines) {
       // aLine is stale, it's associated with the main line list but it should
       // be associated with the overflow line list now
-      aLine = overflowLines->begin();
+      aLine = overflowLines->mLines.begin();
     }
     nsBlockInFlowLineIterator iter(this, aLine, pushedToOverflowLines);
     if (iter.Next() && iter.GetLine()->IsInline()) {
@@ -4192,17 +4187,18 @@ nsBlockFrame::PlaceLine(nsBlockReflowState& aState,
   // first or second line. It's only placed on the second line in a
   // rare case: when the first line is empty.
   bool addedBullet = false;
-  if (mBullet && HaveOutsideBullet() &&
+  if (HasOutsideBullet() &&
       ((aLine == mLines.front() &&
         (!aLineLayout.IsZeroHeight() || (aLine == mLines.back()))) ||
        (mLines.front() != mLines.back() &&
         0 == mLines.front()->mBounds.height &&
         aLine == mLines.begin().next()))) {
     nsHTMLReflowMetrics metrics;
-    ReflowBullet(aState, metrics, aState.mY);
+    nsIFrame* bullet = GetOutsideBullet();
+    ReflowBullet(bullet, aState, metrics, aState.mY);
     NS_ASSERTION(!BulletIsEmpty() || metrics.height == 0,
                  "empty bullet took up space");
-    aLineLayout.AddBulletFrame(mBullet, metrics);
+    aLineLayout.AddBulletFrame(bullet, metrics);
     addedBullet = true;
   }
   aLineLayout.VerticalAlignLine();
@@ -4285,7 +4281,7 @@ nsBlockFrame::PlaceLine(nsBlockReflowState& aState,
   aLineLayout.RelativePositionFrames(overflowAreas);
   aLine->SetOverflowAreas(overflowAreas);
   if (addedBullet) {
-    aLineLayout.RemoveBulletFrame(mBullet);
+    aLineLayout.RemoveBulletFrame(GetOutsideBullet());
   }
 
   // Inline lines do not have margins themselves; however they are
@@ -4386,6 +4382,10 @@ void
 nsBlockFrame::PushLines(nsBlockReflowState&  aState,
                         nsLineList::iterator aLineBefore)
 {
+  // NOTE: aLineBefore is always a normal line, not an overflow line.
+  // The following expression will assert otherwise.
+  DebugOnly<bool> check = aLineBefore == mLines.begin();
+
   nsLineList::iterator overBegin(aLineBefore.next());
 
   // PushTruncatedPlaceholderLine sometimes pushes the first line.  Ugh.
@@ -4407,32 +4407,27 @@ nsBlockFrame::PushLines(nsBlockReflowState&  aState,
     // the height of some child block to grow which creates additional
     // overflowing content. In such cases we must prepend the new
     // overflow to the existing overflow.
-    nsLineList* overflowLines = RemoveOverflowLines();
+    FrameLines* overflowLines = RemoveOverflowLines();
     if (!overflowLines) {
       // XXXldb use presshell arena!
-      overflowLines = new nsLineList();
+      overflowLines = new FrameLines();
     }
     if (overflowLines) {
-      // First, remove the frames we're pushing from mFrames
-      nsIFrame* oldLastChild = mFrames.LastChild();
+      nsIFrame* lineBeforeLastFrame;
       if (firstLine) {
-        mFrames.Clear();
+        lineBeforeLastFrame = nsnull; // removes all frames
       } else {
         nsIFrame* f = overBegin->mFirstChild;
-        nsIFrame* lineBeforeLastFrame =
-          f ? f->GetPrevSibling() : aLineBefore->LastChild();
+        lineBeforeLastFrame = f ? f->GetPrevSibling() : mFrames.LastChild();
         NS_ASSERTION(!f || lineBeforeLastFrame == aLineBefore->LastChild(),
                      "unexpected line frames");
-        mFrames.RemoveFramesAfter(lineBeforeLastFrame);
       }
-      if (!overflowLines->empty()) {
-        // XXXbz If we switch overflow lines to nsFrameList, we should
-        // change this SetNextSibling call.
-        oldLastChild->SetNextSibling(overflowLines->front()->mFirstChild);
-      }
-      overflowLines->splice(overflowLines->begin(), mLines, overBegin,
-                            end_lines());
-      NS_ASSERTION(!overflowLines->empty(), "should not be empty");
+      nsFrameList pushedFrames = mFrames.RemoveFramesAfter(lineBeforeLastFrame);
+      overflowLines->mFrames.InsertFrames(nsnull, nsnull, pushedFrames);
+
+      overflowLines->mLines.splice(overflowLines->mLines.begin(), mLines,
+                                    overBegin, end_lines());
+      NS_ASSERTION(!overflowLines->mLines.empty(), "should not be empty");
       // this takes ownership but it won't delete it immediately so we
       // can keep using it.
       SetOverflowLines(overflowLines);
@@ -4441,18 +4436,18 @@ nsBlockFrame::PushLines(nsBlockReflowState&  aState,
       // they are pulled up by our next-in-flow.
 
       // XXXldb Can this get called O(N) times making the whole thing O(N^2)?
-      for (line_iterator line = overflowLines->begin(),
-             line_end = overflowLines->end();
+      for (line_iterator line = overflowLines->mLines.begin(),
+             line_end = overflowLines->mLines.end();
            line != line_end;
            ++line)
-        {
-          line->MarkDirty();
-          line->MarkPreviousMarginDirty();
-          line->mBounds.SetRect(0, 0, 0, 0);
-          if (line->HasFloats()) {
-            line->FreeFloats(aState.mFloatCacheFreeList);
-          }
+      {
+        line->MarkDirty();
+        line->MarkPreviousMarginDirty();
+        line->mBounds.SetRect(0, 0, 0, 0);
+        if (line->HasFloats()) {
+          line->FreeFloats(aState.mFloatCacheFreeList);
         }
+      }
     }
   }
 
@@ -4471,31 +4466,23 @@ nsBlockFrame::DrainOverflowLines()
 #ifdef DEBUG
   VerifyOverflowSituation();
 #endif
-  nsLineList* overflowLines = nsnull;
-  nsLineList* ourOverflowLines = nsnull;
+  FrameLines* overflowLines = nsnull;
+  FrameLines* ourOverflowLines = nsnull;
 
   // First grab the prev-in-flows overflow lines
   nsBlockFrame* prevBlock = (nsBlockFrame*) GetPrevInFlow();
   if (prevBlock) {
     overflowLines = prevBlock->RemoveOverflowLines();
     if (overflowLines) {
-      NS_ASSERTION(! overflowLines->empty(),
+      NS_ASSERTION(!overflowLines->mLines.empty(),
                    "overflow lines should never be set and empty");
-      // Make all the frames on the overflow line list mine
-      nsIFrame* frame = overflowLines->front()->mFirstChild;
-      while (nsnull != frame) {
-        ReparentFrame(frame, prevBlock, this);
+      // Make all the frames on the overflow line list mine.
+      ReparentFrames(overflowLines->mFrames, prevBlock, this);
 
-        // Get the next frame
-        frame = frame->GetNextSibling();
-      }
-
-      // make the overflow out-of-flow frames mine too
+      // Make the overflow out-of-flow frames mine too.
       nsAutoOOFFrameList oofs(prevBlock);
       if (oofs.mList.NotEmpty()) {
-        for (nsIFrame* f = oofs.mList.FirstChild(); f; f = f->GetNextSibling()) {
-          ReparentFrame(f, prevBlock, this);
-        }
+        ReparentFrames(oofs.mList, prevBlock, this);
         mFloats.InsertFrames(nsnull, nsnull, oofs.mList);
       }
     }
@@ -4522,7 +4509,7 @@ nsBlockFrame::DrainOverflowLines()
 
   // Now join the line lists into mLines
   if (overflowLines) {
-    if (!overflowLines->empty()) {
+    if (!overflowLines->mLines.empty()) {
       // Join the line lists
       if (!mLines.empty()) {
           // Remember to recompute the margins on the first line. This will
@@ -4531,26 +4518,18 @@ nsBlockFrame::DrainOverflowLines()
       }
       
       // Join the sibling lists together
-      nsIFrame* firstFrame = overflowLines->front()->mFirstChild;
-      nsIFrame* lastFrame = overflowLines->back()->LastChild();
-      nsFrameList framesToInsert(firstFrame, lastFrame);
-      mFrames.InsertFrames(nsnull, nsnull, framesToInsert);
+      mFrames.InsertFrames(nsnull, nsnull, overflowLines->mFrames);
 
       // Place overflow lines at the front of our line list
-      mLines.splice(mLines.begin(), *overflowLines);
-      NS_ASSERTION(overflowLines->empty(), "splice should empty list");
+      mLines.splice(mLines.begin(), overflowLines->mLines);
+      NS_ASSERTION(overflowLines->mLines.empty(), "splice should empty list");
     }
     delete overflowLines;
   }
   if (ourOverflowLines) {
-    if (!ourOverflowLines->empty()) {
-      nsIFrame* firstFrame = ourOverflowLines->front()->mFirstChild;
-      nsIFrame* lastFrame = ourOverflowLines->back()->LastChild();
-      nsFrameList framesToAppend(firstFrame, lastFrame);
-      mFrames.AppendFrames(nsnull, framesToAppend);
-
-      // append the overflow to mLines
-      mLines.splice(mLines.end(), *ourOverflowLines);
+    if (!ourOverflowLines->mLines.empty()) {
+      mFrames.AppendFrames(nsnull, ourOverflowLines->mFrames);
+      mLines.splice(mLines.end(), ourOverflowLines->mLines);
     }
     delete ourOverflowLines;
   }
@@ -4586,40 +4565,57 @@ nsBlockFrame::DrainPushedFloats(nsBlockReflowState& aState)
   }
 }
 
-nsLineList*
+nsBlockFrame::FrameLines*
 nsBlockFrame::GetOverflowLines() const
 {
-  if (!(GetStateBits() & NS_BLOCK_HAS_OVERFLOW_LINES)) {
+  if (!HasOverflowLines()) {
     return nsnull;
   }
-  nsLineList* lines = static_cast<nsLineList*>
-    (Properties().Get(OverflowLinesProperty()));
-  NS_ASSERTION(lines && !lines->empty(),
+  FrameLines* prop =
+    static_cast<FrameLines*>(Properties().Get(OverflowLinesProperty()));
+  NS_ASSERTION(prop && !prop->mLines.empty() &&
+               prop->mLines.front()->mFirstChild == prop->mFrames.FirstChild(),
                "value should always be stored and non-empty when state set");
-  return lines;
+  return prop;
 }
 
-nsLineList*
+nsBlockFrame::FrameLines*
 nsBlockFrame::RemoveOverflowLines()
 {
-  if (!(GetStateBits() & NS_BLOCK_HAS_OVERFLOW_LINES)) {
+  if (!HasOverflowLines()) {
     return nsnull;
   }
-  nsLineList* lines = static_cast<nsLineList*>
-    (Properties().Remove(OverflowLinesProperty()));
-  NS_ASSERTION(lines && !lines->empty(),
+  FrameLines* prop =
+    static_cast<FrameLines*>(Properties().Remove(OverflowLinesProperty()));
+  NS_ASSERTION(prop && !prop->mLines.empty() &&
+               prop->mLines.front()->mFirstChild == prop->mFrames.FirstChild(),
                "value should always be stored and non-empty when state set");
   RemoveStateBits(NS_BLOCK_HAS_OVERFLOW_LINES);
-  return lines;
+  return prop;
+}
+
+void
+nsBlockFrame::DestroyOverflowLines()
+{
+  NS_ASSERTION(HasOverflowLines(), "huh?");
+  FrameLines* prop =
+    static_cast<FrameLines*>(Properties().Remove(OverflowLinesProperty()));
+  NS_ASSERTION(prop && prop->mLines.empty(),
+               "value should always be stored but empty when destroying");
+  RemoveStateBits(NS_BLOCK_HAS_OVERFLOW_LINES);
+  delete prop;
 }
 
 // This takes ownership of aOverflowLines.
 // XXX We should allocate overflowLines from presShell arena!
-nsresult
-nsBlockFrame::SetOverflowLines(nsLineList* aOverflowLines)
+void
+nsBlockFrame::SetOverflowLines(FrameLines* aOverflowLines)
 {
   NS_ASSERTION(aOverflowLines, "null lines");
-  NS_ASSERTION(!aOverflowLines->empty(), "empty lines");
+  NS_ASSERTION(!aOverflowLines->mLines.empty(), "empty lines");
+  NS_ASSERTION(aOverflowLines->mLines.front()->mFirstChild ==
+               aOverflowLines->mFrames.FirstChild(),
+               "invalid overflow lines / frames");
   NS_ASSERTION(!(GetStateBits() & NS_BLOCK_HAS_OVERFLOW_LINES),
                "Overwriting existing overflow lines");
 
@@ -4628,7 +4624,6 @@ nsBlockFrame::SetOverflowLines(nsLineList* aOverflowLines)
   NS_ASSERTION(!props.Get(OverflowLinesProperty()), "existing overflow list");
   props.Set(OverflowLinesProperty(), aOverflowLines);
   AddStateBits(NS_BLOCK_HAS_OVERFLOW_LINES);
-  return NS_OK;
 }
 
 nsFrameList*
@@ -4675,10 +4670,47 @@ nsBlockFrame::SetOverflowOutOfFlows(const nsFrameList& aList,
   }
 }
 
+nsBulletFrame*
+nsBlockFrame::GetInsideBullet() const
+{
+  if (!HasInsideBullet()) {
+    return nsnull;
+  }
+  NS_ASSERTION(!HasOutsideBullet(), "invalid bullet state");
+  nsBulletFrame* frame =
+    static_cast<nsBulletFrame*>(Properties().Get(InsideBulletProperty()));
+  NS_ASSERTION(frame && frame->GetType() == nsGkAtoms::bulletFrame,
+               "bogus inside bullet frame");
+  return frame;
+}
+
+nsBulletFrame*
+nsBlockFrame::GetOutsideBullet() const
+{
+  nsFrameList* list = GetOutsideBulletList();
+  return list ? static_cast<nsBulletFrame*>(list->FirstChild())
+              : nsnull;
+}
+
+nsFrameList*
+nsBlockFrame::GetOutsideBulletList() const
+{
+  if (!HasOutsideBullet()) {
+    return nsnull;
+  }
+  NS_ASSERTION(!HasInsideBullet(), "invalid bullet state");
+  nsFrameList* list =
+    static_cast<nsFrameList*>(Properties().Get(OutsideBulletProperty()));
+  NS_ASSERTION(list && list->GetLength() == 1 &&
+               list->FirstChild()->GetType() == nsGkAtoms::bulletFrame,
+               "bogus outside bullet list");
+  return list;
+}
+
 nsFrameList*
 nsBlockFrame::GetPushedFloats() const
 {
-  if (!(GetStateBits() & NS_BLOCK_HAS_PUSHED_FLOATS)) {
+  if (!HasPushedFloats()) {
     return nsnull;
   }
   nsFrameList* result =
@@ -4704,10 +4736,9 @@ nsBlockFrame::EnsurePushedFloats()
 nsFrameList*
 nsBlockFrame::RemovePushedFloats()
 {
-  if (!(GetStateBits() & NS_BLOCK_HAS_PUSHED_FLOATS)) {
+  if (!HasPushedFloats()) {
     return nsnull;
   }
-
   nsFrameList *result =
     static_cast<nsFrameList*>(Properties().Remove(PushedFloatProperty()));
   RemoveStateBits(NS_BLOCK_HAS_PUSHED_FLOATS);
@@ -4839,16 +4870,14 @@ nsBlockFrame::AddFrames(nsFrameList& aFrameList, nsIFrame* aPrevSibling)
 
   // If we're inserting at the beginning of our list and we have an
   // inside bullet, insert after that bullet.
-  if (!aPrevSibling && mBullet && !HaveOutsideBullet()) {
-    NS_ASSERTION(!aFrameList.ContainsFrame(mBullet),
-                 "Trying to make mBullet prev sibling to itself");
-    aPrevSibling = mBullet;
+  if (!aPrevSibling && HasInsideBullet()) {
+    aPrevSibling = GetInsideBullet();
   }
   
   nsIPresShell *presShell = PresContext()->PresShell();
 
   // Attempt to find the line that contains the previous sibling
-  nsFrameList overflowFrames;
+  FrameLines* overflowLines;
   nsLineList* lineList = &mLines;
   nsLineList::iterator prevSibLine = lineList->end();
   PRInt32 prevSiblingIndex = -1;
@@ -4862,15 +4891,14 @@ nsBlockFrame::AddFrames(nsFrameList& aFrameList, nsIFrame* aPrevSibling)
                                         prevSibLine, mFrames.LastChild(),
                                         &prevSiblingIndex)) {
       // Not in mLines - try overflow lines.
-      lineList = GetOverflowLines();
-      if (lineList) {
-        prevSibLine = lineList->end();
+      overflowLines = GetOverflowLines();
+      lineList = overflowLines ? &overflowLines->mLines : nsnull;
+      if (overflowLines) {
+        prevSibLine = overflowLines->mLines.end();
         prevSiblingIndex = -1;
-        overflowFrames = nsFrameList(lineList->front()->mFirstChild,
-                                     lineList->back()->LastChild());
         if (!nsLineBox::RFindLineContaining(aPrevSibling, lineList->begin(),
                                             prevSibLine,
-                                            overflowFrames.LastChild(),
+                                            overflowLines->mFrames.LastChild(),
                                             &prevSiblingIndex)) {
           lineList = nsnull;
         }
@@ -4914,7 +4942,7 @@ nsBlockFrame::AddFrames(nsFrameList& aFrameList, nsIFrame* aPrevSibling)
     lineList->front()->MarkDirty();
     lineList->front()->SetInvalidateTextRuns(true);
   }
-  nsFrameList& frames = lineList == &mLines ? mFrames : overflowFrames;
+  nsFrameList& frames = lineList == &mLines ? mFrames : overflowLines->mFrames;
   const nsFrameList::Slice& newFrames =
     frames.InsertFrames(nsnull, aPrevSibling, aFrameList);
 
@@ -5129,28 +5157,38 @@ void
 nsBlockFrame::TryAllLines(nsLineList::iterator* aIterator,
                           nsLineList::iterator* aStartIterator,
                           nsLineList::iterator* aEndIterator,
-                          bool* aInOverflowLines) {
+                          bool* aInOverflowLines,
+                          FrameLines** aOverflowLines)
+{
   if (*aIterator == *aEndIterator) {
     if (!*aInOverflowLines) {
-      *aInOverflowLines = true;
       // Try the overflow lines
-      nsLineList* overflowLines = GetOverflowLines();
-      if (overflowLines) {
-        *aStartIterator = overflowLines->begin();
+      *aInOverflowLines = true;
+      FrameLines* lines = GetOverflowLines();
+      if (lines) {
+        *aStartIterator = lines->mLines.begin();
         *aIterator = *aStartIterator;
-        *aEndIterator = overflowLines->end();
+        *aEndIterator = lines->mLines.end();
+        *aOverflowLines = lines;
       }
     }
   }
 }
 
+nsBlockInFlowLineIterator::nsBlockInFlowLineIterator(nsBlockFrame* aFrame,
+    line_iterator aLine)
+  : mFrame(aFrame), mLine(aLine), mInOverflowLines(nsnull)
+{
+  // This will assert if aLine isn't in mLines of aFrame:
+  DebugOnly<bool> check = aLine == mFrame->begin_lines();
+}
+
 nsBlockInFlowLineIterator::nsBlockInFlowLineIterator(nsBlockFrame* aFrame,
     line_iterator aLine, bool aInOverflow)
   : mFrame(aFrame), mLine(aLine), mInOverflowLines(nsnull)
 {
   if (aInOverflow) {
-    mInOverflowLines = aFrame->GetOverflowLines();
-    NS_ASSERTION(mInOverflowLines, "How can we be in overflow if there isn't any?");
+    mInOverflowLines = &aFrame->GetOverflowLines()->mLines;
   }
 }
 
@@ -5297,7 +5335,8 @@ nsBlockInFlowLineIterator::Prev()
       mFrame = static_cast<nsBlockFrame*>(mFrame->GetPrevInFlow());
       if (!mFrame)
         return false;
-      mInOverflowLines = mFrame->GetOverflowLines();
+      nsBlockFrame::FrameLines* overflowLines = mFrame->GetOverflowLines();
+      mInOverflowLines = overflowLines ? &overflowLines->mLines : nsnull;
       if (mInOverflowLines) {
         mLine = mInOverflowLines->end();
         NS_ASSERTION(mLine != mInOverflowLines->begin(), "empty overflow line list?");
@@ -5326,7 +5365,8 @@ nsBlockInFlowLineIterator::FindValidLine()
       if (mLine != mFrame->end_lines())
         return true;
     } else {
-      mInOverflowLines = mFrame->GetOverflowLines();
+      nsBlockFrame::FrameLines* overflowLines = mFrame->GetOverflowLines();
+      mInOverflowLines = overflowLines ? &overflowLines->mLines : nsnull;
       if (mInOverflowLines) {
         mLine = mInOverflowLines->begin();
         NS_ASSERTION(mLine != mInOverflowLines->end(), "empty overflow line list?");
@@ -5384,16 +5424,19 @@ nsBlockFrame::DoRemoveFrame(nsIFrame* aDeletedFrame, PRUint32 aFlags)
   nsLineList::iterator line_start = mLines.begin(),
                        line_end = mLines.end();
   nsLineList::iterator line = line_start;
+  FrameLines* overflowLines = nsnull;
   bool searchingOverflowList = false;
   // Make sure we look in the overflow lines even if the normal line
   // list is empty
-  TryAllLines(&line, &line_start, &line_end, &searchingOverflowList);
+  TryAllLines(&line, &line_start, &line_end, &searchingOverflowList,
+              &overflowLines);
   while (line != line_end) {
     if (line->Contains(aDeletedFrame)) {
       break;
     }
     ++line;
-    TryAllLines(&line, &line_start, &line_end, &searchingOverflowList);
+    TryAllLines(&line, &line_start, &line_end, &searchingOverflowList,
+                &overflowLines);
   }
 
   if (line == line_end) {
@@ -5412,7 +5455,7 @@ nsBlockFrame::DoRemoveFrame(nsIFrame* aDeletedFrame, PRUint32 aFlags)
     }
   }
 
-  while ((line != line_end) && (nsnull != aDeletedFrame)) {
+  while (line != line_end && aDeletedFrame) {
     NS_ASSERTION(this == aDeletedFrame->GetParent(), "messed up delete code");
     NS_ASSERTION(line->Contains(aDeletedFrame), "frame not in line");
 
@@ -5428,19 +5471,19 @@ nsBlockFrame::DoRemoveFrame(nsIFrame* aDeletedFrame, PRUint32 aFlags)
       line_iterator next = line.next();
       nsIFrame* lastFrame = next != line_end ?
         next->mFirstChild->GetPrevSibling() :
-        (searchingOverflowList ? line->LastChild() : mFrames.LastChild());
+        (searchingOverflowList ? overflowLines->mFrames.LastChild() : 
+                                 mFrames.LastChild());
       NS_ASSERTION(next == line_end || lastFrame == line->LastChild(),
                    "unexpected line frames");
       isLastFrameOnLine = lastFrame == aDeletedFrame;
     }
 
     // Remove aDeletedFrame from the line
-    nsIFrame* nextFrame = aDeletedFrame->GetNextSibling();
     if (line->mFirstChild == aDeletedFrame) {
       // We should be setting this to null if aDeletedFrame
       // is the only frame on the line. HOWEVER in that case
       // we will be removing the line anyway, see below.
-      line->mFirstChild = nextFrame;
+      line->mFirstChild = aDeletedFrame->GetNextSibling();
     }
 
     // Hmm, this won't do anything if we're removing a frame in the first
@@ -5457,13 +5500,7 @@ nsBlockFrame::DoRemoveFrame(nsIFrame* aDeletedFrame, PRUint32 aFlags)
     // prevSibling will only be nsnull when we are deleting the very
     // first frame in the main or overflow list.
     if (searchingOverflowList) {
-      nsIFrame* prevSibling = aDeletedFrame->GetPrevSibling();
-      if (prevSibling) {
-        // XXXbz If we switch overflow lines to nsFrameList, we should
-        // change this SetNextSibling call.
-        prevSibling->SetNextSibling(nextFrame);
-      }
-      aDeletedFrame->SetNextSibling(nsnull);
+      overflowLines->mFrames.RemoveFrame(aDeletedFrame);
     } else {
       mFrames.RemoveFrame(aDeletedFrame);
     }
@@ -5518,12 +5555,13 @@ nsBlockFrame::DoRemoveFrame(nsIFrame* aDeletedFrame, PRUint32 aFlags)
 #endif
         Invalidate(visOverflow);
       } else {
-        nsLineList* lineList = RemoveOverflowLines();
-        line = lineList->erase(line);
-        if (!lineList->empty()) {
-          SetOverflowLines(lineList);
+        // XXX update searchingOverflowList directly, remove only when empty
+        FrameLines* overflowLines = RemoveOverflowLines();
+        line = overflowLines->mLines.erase(line);
+        if (!overflowLines->mLines.empty()) {
+          SetOverflowLines(overflowLines);
         } else {
-          delete lineList;
+          delete overflowLines;
           // We just invalidated our iterators.  Since we were in
           // the overflow lines list, which is now empty, set them
           // so we're at the end of the regular line list.
@@ -5577,7 +5615,8 @@ nsBlockFrame::DoRemoveFrame(nsIFrame* aDeletedFrame, PRUint32 aFlags)
           line = line_end;
         }
 
-        TryAllLines(&line, &line_start, &line_end, &searchingOverflowList);
+        TryAllLines(&line, &line_start, &line_end, &searchingOverflowList,
+                    &overflowLines);
 #ifdef NOISY_REMOVE_FRAME
         printf("DoRemoveFrame: now on %s line=%p\n",
                searchingOverflowList?"overflow":"normal", line.get());
@@ -5628,25 +5667,22 @@ nsBlockFrame::StealFrame(nsPresContext* aPresContext,
                        line_start = line,
                        line_end = mLines.end();
   bool searchingOverflowList = false;
+  FrameLines* overflowLines = nsnull;
   nsIFrame* prevSibling = nsnull;
   // Make sure we look in the overflow lines even if the normal line
   // list is empty
-  TryAllLines(&line, &line_start, &line_end, &searchingOverflowList);
+  TryAllLines(&line, &line_start, &line_end, &searchingOverflowList,
+              &overflowLines);
   while (line != line_end) {
     nsIFrame* frame = line->mFirstChild;
     PRInt32 n = line->GetChildCount();
     while (--n >= 0) {
       if (frame == aChild) {
-        // Disconnect from sibling list
         if (frame == line->mFirstChild) {
           line->mFirstChild = frame->GetNextSibling();
         }
         if (searchingOverflowList) {
-          // XXXbz If we switch overflow lines to nsFrameList, we should
-          // change this SetNextSibling call.
-          if (prevSibling)
-            prevSibling->SetNextSibling(frame->GetNextSibling());
-          frame->SetNextSibling(nsnull);
+          overflowLines->mFrames.RemoveFrame(frame);
         } else {
           mFrames.RemoveFrame(frame);
         }
@@ -5662,13 +5698,13 @@ nsBlockFrame::StealFrame(nsPresContext* aPresContext,
           nsLineBox* lineBox = line;
           if (searchingOverflowList) {
             // Erase line, but avoid making the overflow line list empty
-            nsLineList* lineList = RemoveOverflowLines();
-            line = lineList->erase(line);
-            if (!lineList->empty()) {
-              nsresult rv = SetOverflowLines(lineList);
-              NS_ENSURE_SUCCESS(rv, rv);
+            // XXX update overflowLines directly, remove only when empty
+            RemoveOverflowLines();
+            line = overflowLines->mLines.erase(line);
+            if (!overflowLines->mLines.empty()) {
+              SetOverflowLines(overflowLines);
             } else {
-              delete lineList;
+              delete overflowLines;
               // We just invalidated our iterators.  Since we were in
               // the overflow lines list, which is now empty, set them
               // so we're at the end of the regular line list.
@@ -5694,7 +5730,8 @@ nsBlockFrame::StealFrame(nsPresContext* aPresContext,
       frame = frame->GetNextSibling();
     }
     ++line;
-    TryAllLines(&line, &line_start, &line_end, &searchingOverflowList);
+    TryAllLines(&line, &line_start, &line_end, &searchingOverflowList,
+                &overflowLines);
     if (prevSibling && !prevSibling->GetNextSibling()) {
       // We just switched to the overflow list.  Null out prevSibling
       prevSibling = nsnull;
@@ -6303,9 +6340,10 @@ nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
     }
   }
 
-  if (NS_SUCCEEDED(rv) && (nsnull != mBullet) && HaveOutsideBullet()) {
+  if (NS_SUCCEEDED(rv) && HasOutsideBullet()) {
     // Display outside bullets manually
-    rv = BuildDisplayListForChild(aBuilder, mBullet, aDirtyRect, aLists);
+    nsIFrame* bullet = GetOutsideBullet();
+    rv = BuildDisplayListForChild(aBuilder, bullet, aDirtyRect, aLists);
   }
 
 #ifdef DEBUG
@@ -6349,7 +6387,7 @@ nsBlockFrame::CreateAccessible()
                                               presContext->PresShell());
   }
 
-  if (!mBullet || !presContext) {
+  if (!HasBullet() || !presContext) {
     if (!mContent->GetParent()) {
       // Don't create accessible objects for the root content node, they are redundant with
       // the nsDocAccessible object created with the document node
@@ -6437,7 +6475,7 @@ nsBlockFrame::ChildIsDirty(nsIFrame* aChild)
   if (aChild->GetStateBits() & NS_FRAME_OUT_OF_FLOW &&
       aChild->GetStyleDisplay()->IsAbsolutelyPositioned()) {
     // do nothing
-  } else if (aChild == mBullet && HaveOutsideBullet()) {
+  } else if (aChild == GetOutsideBullet()) {
     // The bullet lives in the first line, unless the first line has
     // height 0 and there is a second line, in which case it lives
     // in the second line.
@@ -6472,15 +6510,9 @@ nsBlockFrame::Init(nsIContent*      aContent,
                    nsIFrame*        aPrevInFlow)
 {
   if (aPrevInFlow) {
-    // Copy over the block frame type flags
-    nsBlockFrame*  blockFrame = (nsBlockFrame*)aPrevInFlow;
-
-    // Don't copy NS_BLOCK_HAS_FIRST_LETTER_CHILD as that is set on the first
-    // continuation only.
-    SetFlags(blockFrame->mState &
-             (NS_BLOCK_FLAGS_MASK &
-               (~NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET &
-                ~NS_BLOCK_HAS_FIRST_LETTER_CHILD)));
+    // Copy over the inherited block frame bits from the prev-in-flow.
+    SetFlags(aPrevInFlow->GetStateBits() &
+             (NS_BLOCK_FLAGS_MASK & ~NS_BLOCK_FLAGS_NON_INHERITED_MASK));
   }
 
   nsresult rv = nsBlockFrameSuper::Init(aContent, aParent, aPrevInFlow);
@@ -6496,6 +6528,11 @@ NS_IMETHODIMP
 nsBlockFrame::SetInitialChildList(ChildListID     aListID,
                                   nsFrameList&    aChildList)
 {
+  NS_ASSERTION(aListID != kPrincipalList ||
+               (GetStateBits() & (NS_BLOCK_FRAME_HAS_INSIDE_BULLET |
+                                  NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET)) == 0,
+               "how can we have a bullet already?");
+
   nsresult rv = NS_OK;
 
   if (kAbsoluteList == aListID) {
@@ -6554,10 +6591,9 @@ nsBlockFrame::SetInitialChildList(ChildListID     aListID,
       }
       possibleListItem = parent;
     }
-    if ((nsnull == GetPrevInFlow()) &&
-        (NS_STYLE_DISPLAY_LIST_ITEM ==
-           possibleListItem->GetStyleDisplay()->mDisplay) &&
-        (nsnull == mBullet)) {
+    if (NS_STYLE_DISPLAY_LIST_ITEM ==
+          possibleListItem->GetStyleDisplay()->mDisplay &&
+        !GetPrevInFlow()) {
       // Resolve style for the bullet frame
       const nsStyleList* styleList = GetStyleList();
       nsCSSPseudoElements::Type pseudoType;
@@ -6583,7 +6619,7 @@ nsBlockFrame::SetInitialChildList(ChildListID     aListID,
 
       // Create bullet frame
       nsBulletFrame* bullet = new (shell) nsBulletFrame(kidSC);
-      if (nsnull == bullet) {
+      if (!bullet) {
         return NS_ERROR_OUT_OF_MEMORY;
       }
       bullet->Init(mContent, this, nsnull);
@@ -6591,16 +6627,16 @@ nsBlockFrame::SetInitialChildList(ChildListID     aListID,
       // If the list bullet frame should be positioned inside then add
       // it to the flow now.
       if (NS_STYLE_LIST_STYLE_POSITION_INSIDE ==
-          styleList->mListStylePosition) {
+            styleList->mListStylePosition) {
         nsFrameList bulletList(bullet, bullet);
         AddFrames(bulletList, nsnull);
-        mState &= ~NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET;
+        Properties().Set(InsideBulletProperty(), bullet);
+        AddStateBits(NS_BLOCK_FRAME_HAS_INSIDE_BULLET);
+      } else {
+        nsFrameList* bulletList = new nsFrameList(bullet, bullet);
+        Properties().Set(OutsideBulletProperty(), bulletList);
+        AddStateBits(NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET);
       }
-      else {
-        mState |= NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET;
-      }
-
-      mBullet = bullet;
     }
   }
 
@@ -6611,8 +6647,7 @@ bool
 nsBlockFrame::BulletIsEmpty() const
 {
   NS_ASSERTION(mContent->GetPrimaryFrame()->GetStyleDisplay()->mDisplay ==
-                 NS_STYLE_DISPLAY_LIST_ITEM &&
-               HaveOutsideBullet(),
+                 NS_STYLE_DISPLAY_LIST_ITEM && HasOutsideBullet(),
                "should only care when we have an outside bullet");
   const nsStyleList* list = GetStyleList();
   return list->mListStyleType == NS_STYLE_LIST_STYLE_NONE &&
@@ -6636,24 +6671,15 @@ nsBlockFrame::GetBulletText(nsAString& aText) const
     aText.Assign(kSquareCharacter);
   }
   else if (myList->mListStyleType != NS_STYLE_LIST_STYLE_NONE) {
-    nsAutoString text;
-    mBullet->GetListItemText(*myList, text);
-    aText = text;
+    nsBulletFrame* bullet = GetBullet();
+    if (bullet) {
+      nsAutoString text;
+      bullet->GetListItemText(*myList, text);
+      aText = text;
+    }
   }
 }
 
-bool
-nsBlockFrame::HasBullet() const
-{
-  if (mBullet) {
-    const nsStyleList* styleList = GetStyleList();
-    return styleList->GetListStyleImage() ||
-      styleList->mListStyleType != NS_STYLE_LIST_STYLE_NONE;
-  }
-
-  return false;
-}
-
 // static
 bool
 nsBlockFrame::FrameStartsCounterScope(nsIFrame* aFrame)
@@ -6761,15 +6787,15 @@ nsBlockFrame::RenumberListsFor(nsPresContext* aPresContext,
     // something foreign has crept in.
     nsBlockFrame* listItem = nsLayoutUtils::GetAsBlock(kid);
     if (listItem) {
-      if (nsnull != listItem->mBullet) {
+      nsBulletFrame* bullet = listItem->GetBullet();
+      if (bullet) {
         bool changed;
-        *aOrdinal = listItem->mBullet->SetListItemOrdinal(*aOrdinal,
-                                                          &changed);
+        *aOrdinal = bullet->SetListItemOrdinal(*aOrdinal, &changed);
         if (changed) {
           kidRenumberedABullet = true;
 
           // The ordinal changed - mark the bullet frame dirty.
-          listItem->ChildIsDirty(listItem->mBullet);
+          listItem->ChildIsDirty(bullet);
         }
       }
 
@@ -6801,7 +6827,8 @@ nsBlockFrame::RenumberListsFor(nsPresContext* aPresContext,
 }
 
 void
-nsBlockFrame::ReflowBullet(nsBlockReflowState& aState,
+nsBlockFrame::ReflowBullet(nsIFrame* aBulletFrame,
+                           nsBlockReflowState& aState,
                            nsHTMLReflowMetrics& aMetrics,
                            nscoord aLineTop)
 {
@@ -6817,10 +6844,10 @@ nsBlockFrame::ReflowBullet(nsBlockReflowState& aState,
   // XXXwaterson Should this look just like the logic in
   // nsBlockReflowContext::ReflowBlock and nsLineLayout::ReflowFrame?
   nsHTMLReflowState reflowState(aState.mPresContext, rs,
-                                mBullet, availSize);
+                                aBulletFrame, availSize);
   nsReflowStatus  status;
-  mBullet->WillReflow(aState.mPresContext);
-  mBullet->Reflow(aState.mPresContext, aMetrics, reflowState, status);
+  aBulletFrame->WillReflow(aState.mPresContext);
+  aBulletFrame->Reflow(aState.mPresContext, aMetrics, reflowState, status);
 
   // Get the float available space using our saved state from before we
   // started reflowing the block, so that we ignore any floats inside
@@ -6860,8 +6887,9 @@ nsBlockFrame::ReflowBullet(nsBlockReflowState& aState,
   // Approximate the bullets position; vertical alignment will provide
   // the final vertical location.
   nscoord y = aState.mContentArea.y;
-  mBullet->SetRect(nsRect(x, y, aMetrics.width, aMetrics.height));
-  mBullet->DidReflow(aState.mPresContext, &aState.mReflowState, NS_FRAME_REFLOW_FINISHED);
+  aBulletFrame->SetRect(nsRect(x, y, aMetrics.width, aMetrics.height));
+  aBulletFrame->DidReflow(aState.mPresContext, &aState.mReflowState,
+                          NS_FRAME_REFLOW_FINISHED);
 }
 
 // This is used to scan frames for any float placeholders, add their
@@ -7175,14 +7203,19 @@ nsBlockFrame::VerifyLines(bool aFinalCheckOK)
 void
 nsBlockFrame::VerifyOverflowSituation()
 {
-  nsBlockFrame* flow = (nsBlockFrame*) GetFirstInFlow();
-  while (nsnull != flow) {
-    nsLineList* overflowLines = GetOverflowLines();
-    if (nsnull != overflowLines) {
-      NS_ASSERTION(! overflowLines->empty(), "should not be empty if present");
-      NS_ASSERTION(overflowLines->front()->mFirstChild, "bad overflow list");
+  nsBlockFrame* flow = static_cast<nsBlockFrame*>(GetFirstInFlow());
+  while (flow) {
+    FrameLines* overflowLines = GetOverflowLines();
+    if (overflowLines) {
+      NS_ASSERTION(!overflowLines->mLines.empty(),
+                   "should not be empty if present");
+      NS_ASSERTION(overflowLines->mLines.front()->mFirstChild,
+                   "bad overflow lines");
+      NS_ASSERTION(overflowLines->mLines.front()->mFirstChild ==
+                   overflowLines->mFrames.FirstChild(),
+                   "bad overflow frames / lines");
     }
-    flow = (nsBlockFrame*) flow->GetNextInFlow();
+    flow = static_cast<nsBlockFrame*>(flow->GetNextInFlow());
   }
 }
 
diff --git a/layout/generic/nsBlockFrame.h b/layout/generic/nsBlockFrame.h
index 836e3a10d7f..b61207fdc3b 100644
--- a/layout/generic/nsBlockFrame.h
+++ b/layout/generic/nsBlockFrame.h
@@ -154,11 +154,6 @@ public:
 
   friend nsIFrame* NS_NewBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRUint32 aFlags);
 
-  // This is a child list too, but we let nsBlockReflowState get to it
-  // directly too.
-  NS_DECLARE_FRAME_PROPERTY(PushedFloatProperty,
-                            nsContainerFrame::DestroyFrameList)
-
   // nsQueryFrame
   NS_DECL_QUERYFRAME
 
@@ -175,7 +170,7 @@ public:
                            nsFrameList&    aFrameList);
   NS_IMETHOD  RemoveFrame(ChildListID     aListID,
                           nsIFrame*       aOldFrame);
-  virtual nsFrameList GetChildList(ChildListID aListID) const;
+  virtual const nsFrameList& GetChildList(ChildListID aListID) const;
   virtual void GetChildLists(nsTArray<ChildList>* aLists) const;
   virtual nscoord GetBaseline() const;
   virtual nscoord GetCaretBaseline() const;
@@ -246,12 +241,14 @@ public:
   /**
    * Return the bullet text equivalent.
    */
-  virtual void GetBulletText(nsAString& aText) const;
+  void GetBulletText(nsAString& aText) const;
 
   /**
    * Return true if there's a bullet.
    */
-  virtual bool HasBullet() const;
+  bool HasBullet() const {
+    return HasOutsideBullet() || HasInsideBullet();
+  }
 
   virtual void MarkIntrinsicWidthsDirty();
   virtual nscoord GetMinWidth(nsRenderingContext *aRenderingContext);
@@ -328,6 +325,11 @@ public:
    */
   static nsBlockFrame* GetNearestAncestorBlock(nsIFrame* aCandidate);
   
+  struct FrameLines {
+    nsLineList mLines;
+    nsFrameList mFrames;
+  };
+
 protected:
   nsBlockFrame(nsStyleContext* aContext)
     : nsContainerFrame(aContext)
@@ -355,22 +357,14 @@ protected:
   void TryAllLines(nsLineList::iterator* aIterator,
                    nsLineList::iterator* aStartIterator,
                    nsLineList::iterator* aEndIterator,
-                   bool* aInOverflowLines);
+                   bool*        aInOverflowLines,
+                   FrameLines** aOverflowLines);
 
   void SetFlags(nsFrameState aFlags) {
     mState &= ~NS_BLOCK_FLAGS_MASK;
     mState |= aFlags;
   }
 
-  bool HaveOutsideBullet() const {
-#if defined(DEBUG) && !defined(DEBUG_rods)
-    if(mState & NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET) {
-      NS_ASSERTION(mBullet,"NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET flag set and no mBullet");
-    }
-#endif
-    return 0 != (mState & NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET);
-  }
-
   /** move the frames contained by aLine by aDY
     * if aLine is a block, its child floats are added to the state manager
     */
@@ -646,8 +640,14 @@ protected:
                           nsLineBox*           aLine,
                           nsBlockFrame*        aFromContainer,
                           bool                 aFromOverflowLine,
+                          nsFrameList&         aFromFrameList,
                           nsLineList::iterator aFromLine);
 
+  /**
+   * Push the line after aLineBefore to the overflow line list.
+   * @param aLineBefore a line in 'mLines' (or begin_lines() when
+   *        pushing the first line)
+   */
   void PushLines(nsBlockReflowState& aState,
                  nsLineList::iterator aLineBefore);
 
@@ -675,7 +675,8 @@ protected:
 
   static bool FrameStartsCounterScope(nsIFrame* aFrame);
 
-  void ReflowBullet(nsBlockReflowState& aState,
+  void ReflowBullet(nsIFrame* aBulletFrame,
+                    nsBlockReflowState& aState,
                     nsHTMLReflowMetrics& aMetrics,
                     nscoord aLineTop);
 
@@ -684,10 +685,14 @@ protected:
   virtual nsILineIterator* GetLineIterator();
 
 public:
-  nsLineList* GetOverflowLines() const;
+  bool HasOverflowLines() const {
+    return 0 != (GetStateBits() & NS_BLOCK_HAS_OVERFLOW_LINES);
+  }
+  FrameLines* GetOverflowLines() const;
 protected:
-  nsLineList* RemoveOverflowLines();
-  nsresult SetOverflowLines(nsLineList* aOverflowLines);
+  FrameLines* RemoveOverflowLines();
+  void SetOverflowLines(FrameLines* aOverflowLines);
+  void DestroyOverflowLines();
 
   // Determine the computed height that's in effect for this block
   // frame (that is, our computed height minus the heights of our
@@ -724,6 +729,50 @@ protected:
   nsFrameList* GetOverflowOutOfFlows() const;
   void SetOverflowOutOfFlows(const nsFrameList& aList, nsFrameList* aPropValue);
 
+  /**
+   * @return true if this frame has an inside bullet frame.
+   */
+  bool HasInsideBullet() const {
+    return 0 != (mState & NS_BLOCK_FRAME_HAS_INSIDE_BULLET);
+  }
+
+  /**
+   * @return the inside bullet frame or nsnull if we don't have one.
+   */
+  nsBulletFrame* GetInsideBullet() const;
+
+  /**
+   * @return true if this frame has an outside bullet frame.
+   */
+  bool HasOutsideBullet() const {
+    return 0 != (mState & NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET);
+  }
+
+  /**
+   * @return the outside bullet frame or nsnull if we don't have one.
+   */
+  nsBulletFrame* GetOutsideBullet() const;
+
+  /**
+   * @return the outside bullet frame list frame property.
+   */
+  nsFrameList* GetOutsideBulletList() const;
+
+  /**
+   * @return the bullet frame or nsnull if we don't have one.
+   */
+  nsBulletFrame* GetBullet() const {
+    nsBulletFrame* outside = GetOutsideBullet();
+    return outside ? outside : GetInsideBullet();
+  }
+  
+  /**
+   * @return true if this frame has pushed floats.
+   */
+  bool HasPushedFloats() const {
+    return 0 != (GetStateBits() & NS_BLOCK_HAS_PUSHED_FLOATS);
+  }
+
   // Get the pushed floats list
   nsFrameList* GetPushedFloats() const;
   // Get the pushed floats list, or if there is not currently one,
@@ -743,12 +792,9 @@ protected:
   nsLineList mLines;
 
   // List of all floats in this block
+  // XXXmats blocks rarely have floats, make it a frame property
   nsFrameList mFloats;
 
-  // XXX_fix_me: subclass one more time!
-  // For list-item frames, this is the bullet frame.
-  nsBulletFrame* mBullet;
-
   friend class nsBlockReflowState;
   friend class nsBlockInFlowLineIterator;
 
@@ -798,7 +844,11 @@ private:
 class nsBlockInFlowLineIterator {
 public:
   typedef nsBlockFrame::line_iterator line_iterator;
-  nsBlockInFlowLineIterator(nsBlockFrame* aFrame, line_iterator aLine, bool aInOverflow);
+  /**
+   * Set up the iterator to point to aLine which must be a normal line
+   * in aFrame (not an overflow line).
+   */
+  nsBlockInFlowLineIterator(nsBlockFrame* aFrame, line_iterator aLine);
   /**
    * Set up the iterator to point to the first line found starting from
    * aFrame. Sets aFoundValidLine to false if there is no such line.
@@ -845,6 +895,10 @@ public:
   bool Prev();
 
 private:
+  friend class nsBlockFrame;
+  // XXX nsBlockFrame uses this internally in one place.  Try to remove it.
+  nsBlockInFlowLineIterator(nsBlockFrame* aFrame, line_iterator aLine, bool aInOverflow);
+
   nsBlockFrame* mFrame;
   line_iterator mLine;
   nsLineList*   mInOverflowLines;
diff --git a/layout/generic/nsBlockReflowContext.cpp b/layout/generic/nsBlockReflowContext.cpp
index 3ed89cc2ce1..abd16f83301 100644
--- a/layout/generic/nsBlockReflowContext.cpp
+++ b/layout/generic/nsBlockReflowContext.cpp
@@ -124,7 +124,8 @@ nsBlockReflowContext::ComputeCollapsedTopMargin(const nsHTMLReflowState& aRS,
         nsBlockFrame::line_iterator line_end;
         bool anyLines = true;
         if (overflowLines) {
-          nsLineList* lines = block->GetOverflowLines();
+          nsBlockFrame::FrameLines* frames = block->GetOverflowLines();
+          nsLineList* lines = frames ? &frames->mLines : nsnull;
           if (!lines) {
             anyLines = false;
           } else {
diff --git a/layout/generic/nsContainerFrame.cpp b/layout/generic/nsContainerFrame.cpp
index 8a4193b3257..8efb9538e6d 100644
--- a/layout/generic/nsContainerFrame.cpp
+++ b/layout/generic/nsContainerFrame.cpp
@@ -273,7 +273,7 @@ nsContainerFrame::DestroyFrom(nsIFrame* aDestructRoot)
 /////////////////////////////////////////////////////////////////////////////
 // Child frame enumeration
 
-nsFrameList
+const nsFrameList&
 nsContainerFrame::GetChildList(ChildListID aListID) const
 {
   // We only know about the principal child list and the overflow lists.
diff --git a/layout/generic/nsContainerFrame.h b/layout/generic/nsContainerFrame.h
index b8e5282a216..b3b559d6e0a 100644
--- a/layout/generic/nsContainerFrame.h
+++ b/layout/generic/nsContainerFrame.h
@@ -95,7 +95,7 @@ public:
   NS_IMETHOD RemoveFrame(ChildListID aListID,
                          nsIFrame* aOldFrame);
 
-  virtual nsFrameList GetChildList(ChildListID aList) const;
+  virtual const nsFrameList& GetChildList(ChildListID aList) const;
   virtual void GetChildLists(nsTArray<ChildList>* aLists) const;
   virtual void DestroyFrom(nsIFrame* aDestructRoot);
   virtual void ChildIsDirty(nsIFrame* aChild);
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index fc486698fc5..a82bc6afde0 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -1187,7 +1187,7 @@ nsFrame::GetBaseline() const
   return mRect.height + GetUsedMargin().bottom;
 }
 
-nsFrameList
+const nsFrameList&
 nsFrame::GetChildList(ChildListID aListID) const
 {
   if (IsAbsoluteContainer() &&
diff --git a/layout/generic/nsFrame.h b/layout/generic/nsFrame.h
index d75e62af473..fbb922bc29b 100644
--- a/layout/generic/nsFrame.h
+++ b/layout/generic/nsFrame.h
@@ -190,7 +190,7 @@ public:
                                          nsStyleContext* aStyleContext);
   virtual void SetParent(nsIFrame* aParent);
   virtual nscoord GetBaseline() const;
-  virtual nsFrameList GetChildList(ChildListID aListID) const;
+  virtual const nsFrameList& GetChildList(ChildListID aListID) const;
   virtual void GetChildLists(nsTArray<ChildList>* aLists) const;
 
   NS_IMETHOD  HandleEvent(nsPresContext* aPresContext, 
diff --git a/layout/generic/nsHTMLParts.h b/layout/generic/nsHTMLParts.h
index 7c5dbd8163b..4a282fc6d29 100644
--- a/layout/generic/nsHTMLParts.h
+++ b/layout/generic/nsHTMLParts.h
@@ -73,6 +73,10 @@ class nsTableColFrame;
  *  frame among the block's descendants. If there is a floating first-letter
  *  frame, or the block has first-letter style but has no first letter, this
  *  bit is not set. This bit is set on the first continuation only.
+ *
+ * NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET and NS_BLOCK_FRAME_HAS_INSIDE_BULLET
+ * means the block has an associated bullet frame, they are mutually exclusive.
+ *
  */
 #define NS_BLOCK_MARGIN_ROOT              NS_FRAME_STATE_BIT(22)
 #define NS_BLOCK_FLOAT_MGR                NS_FRAME_STATE_BIT(23)
@@ -80,14 +84,25 @@ class nsTableColFrame;
 #define NS_BLOCK_HAS_FIRST_LETTER_STYLE   NS_FRAME_STATE_BIT(29)
 #define NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET NS_FRAME_STATE_BIT(30)
 #define NS_BLOCK_HAS_FIRST_LETTER_CHILD   NS_FRAME_STATE_BIT(31)
-// These are the bits that get inherited from a block frame to its
-// next-in-flows and are not private to blocks
-#define NS_BLOCK_FLAGS_MASK               (NS_BLOCK_MARGIN_ROOT | \
-                                           NS_BLOCK_FLOAT_MGR | \
-                                           NS_BLOCK_CLIP_PAGINATED_OVERFLOW | \
-                                           NS_BLOCK_HAS_FIRST_LETTER_STYLE | \
-                                           NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET | \
-                                           NS_BLOCK_HAS_FIRST_LETTER_CHILD)
+#define NS_BLOCK_FRAME_HAS_INSIDE_BULLET  NS_FRAME_STATE_BIT(63)
+// These are all the block specific frame bits, they are copied from
+// the prev-in-flow to a newly created next-in-flow, except for the
+// NS_BLOCK_FLAGS_NON_INHERITED_MASK bits below.
+#define NS_BLOCK_FLAGS_MASK (NS_BLOCK_MARGIN_ROOT              | \
+                             NS_BLOCK_FLOAT_MGR                | \
+                             NS_BLOCK_CLIP_PAGINATED_OVERFLOW  | \
+                             NS_BLOCK_HAS_FIRST_LETTER_STYLE   | \
+                             NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET | \
+                             NS_BLOCK_HAS_FIRST_LETTER_CHILD   | \
+                             NS_BLOCK_FRAME_HAS_INSIDE_BULLET)
+
+// This is the subset of NS_BLOCK_FLAGS_MASK that is NOT inherited
+// by default.  They should only be set on the first-in-flow.
+// See nsBlockFrame::Init.
+#define NS_BLOCK_FLAGS_NON_INHERITED_MASK                        \
+                            (NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET | \
+                             NS_BLOCK_HAS_FIRST_LETTER_CHILD   | \
+                             NS_BLOCK_FRAME_HAS_INSIDE_BULLET)
 
 // Factory methods for creating html layout objects
 
diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
index ab8112bc05e..ced7251601d 100644
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -1057,12 +1057,8 @@ public:
    * @return  the child list.  If the requested list is unsupported by this
    *          frame type, an empty list will be returned.
    */
-  // XXXbz if all our frame storage were actually backed by nsFrameList, we
-  // could make this return a const reference...  nsBlockFrame is the only real
-  // culprit here.  Make sure to assign the return value of this function into
-  // a |const nsFrameList&|, not an nsFrameList.
-  virtual nsFrameList GetChildList(ChildListID aListID) const = 0;
-  nsFrameList PrincipalChildList() { return GetChildList(kPrincipalList); }
+  virtual const nsFrameList& GetChildList(ChildListID aListID) const = 0;
+  const nsFrameList& PrincipalChildList() { return GetChildList(kPrincipalList); }
   virtual void GetChildLists(nsTArray<ChildList>* aLists) const = 0;
   // XXXbz this method should go away
   nsIFrame* GetFirstChild(ChildListID aListID) const {
diff --git a/layout/generic/nsLineBox.cpp b/layout/generic/nsLineBox.cpp
index 6e4010c8c62..6ef3a1fc40b 100644
--- a/layout/generic/nsLineBox.cpp
+++ b/layout/generic/nsLineBox.cpp
@@ -235,6 +235,7 @@ nsLineBox::List(FILE* out, PRInt32 aIndent) const
 }
 #endif
 
+#ifdef DEBUG
 nsIFrame*
 nsLineBox::LastChild() const
 {
@@ -245,13 +246,7 @@ nsLineBox::LastChild() const
   }
   return frame;
 }
-
-bool
-nsLineBox::IsLastChild(nsIFrame* aFrame) const
-{
-  nsIFrame* lastFrame = LastChild();
-  return aFrame == lastFrame;
-}
+#endif
 
 PRInt32
 nsLineBox::IndexOf(nsIFrame* aFrame) const
@@ -373,7 +368,7 @@ nsLineBox::RFindLineContaining(nsIFrame* aFrame,
   nsIFrame* curFrame = aLastFrameBeforeEnd;
   while (aBegin != aEnd) {
     --aEnd;
-    NS_ASSERTION(aEnd->IsLastChild(curFrame), "Unexpected curFrame");
+    NS_ASSERTION(aEnd->LastChild() == curFrame, "Unexpected curFrame");
     // i is the index of curFrame in aEnd
     PRInt32 i = aEnd->GetChildCount() - 1;
     while (i >= 0) {
diff --git a/layout/generic/nsLineBox.h b/layout/generic/nsLineBox.h
index ef88e822bd8..f20023e3087 100644
--- a/layout/generic/nsLineBox.h
+++ b/layout/generic/nsLineBox.h
@@ -470,11 +470,8 @@ public:
   char* StateToString(char* aBuf, PRInt32 aBufSize) const;
 
   void List(FILE* out, PRInt32 aIndent) const;
-#endif
-
   nsIFrame* LastChild() const;
-
-  bool IsLastChild(nsIFrame* aFrame) const;
+#endif
 
   PRInt32 IndexOf(nsIFrame* aFrame) const;
 
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index d24cdb12400..24c494c3c09 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -351,6 +351,9 @@ nsObjectFrame::DestroyFrom(nsIFrame* aDestructRoot)
     mBackgroundSink->Destroy();
   }
 
+  if (mInstanceOwner) {
+    mInstanceOwner->SetFrame(nsnull);
+  }
   SetInstanceOwner(nsnull);
 
   nsObjectFrameSuper::DestroyFrom(aDestructRoot);
diff --git a/layout/generic/nsTextFrameThebes.cpp b/layout/generic/nsTextFrameThebes.cpp
index b57d5af5193..c3a7acede07 100644
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -1212,7 +1212,7 @@ BuildTextRuns(gfxContext* aContext, nsTextFrame* aForFrame,
   bool isValid = true;
   nsBlockInFlowLineIterator backIterator(block, &isValid);
   if (aForFrameLine) {
-    backIterator = nsBlockInFlowLineIterator(block, *aForFrameLine, false);
+    backIterator = nsBlockInFlowLineIterator(block, *aForFrameLine);
   } else {
     backIterator = nsBlockInFlowLineIterator(block, lineContainerChild, &isValid);
     NS_ASSERTION(isValid, "aForFrame not found in block, someone lied to us");
diff --git a/layout/inspector/src/inDOMView.cpp b/layout/inspector/src/inDOMView.cpp
index bbe38562524..0998b9a1a8f 100644
--- a/layout/inspector/src/inDOMView.cpp
+++ b/layout/inspector/src/inDOMView.cpp
@@ -142,7 +142,7 @@ inDOMView::~inDOMView()
 /* static */ void
 inDOMView::InitAtoms()
 {
-  NS_RegisterStaticAtoms(Atoms_info, ArrayLength(Atoms_info));
+  NS_RegisterStaticAtoms(Atoms_info);
 }
 
 ////////////////////////////////////////////////////////////////////////
diff --git a/layout/mathml/nsMathMLContainerFrame.cpp b/layout/mathml/nsMathMLContainerFrame.cpp
index 2f2c665d6bd..4b0231ac7c0 100644
--- a/layout/mathml/nsMathMLContainerFrame.cpp
+++ b/layout/mathml/nsMathMLContainerFrame.cpp
@@ -1107,7 +1107,7 @@ static PRInt32 kInterFrameSpacingTable[eMathMLFrameType_COUNT][eMathMLFrameType_
   /*OpUsr*/   {0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01},
   /*Inner*/   {0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01},
   /*Italic*/  {0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01},
-  /*Upright*/ {0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01}
+  /*Upright*/ {0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00}
 };
 
 #define GET_INTERSPACE(scriptlevel_, frametype1_, frametype2_, space_)  \
diff --git a/layout/reftests/bidi/reftest.list b/layout/reftests/bidi/reftest.list
index 5d635c0162d..bcf98e6e4cd 100644
--- a/layout/reftests/bidi/reftest.list
+++ b/layout/reftests/bidi/reftest.list
@@ -7,8 +7,8 @@
 == bidi-004.html bidi-004-ref.html
 == bidi-004-j.html bidi-004-ref.html
 == bidi-005.html bidi-005-ref.html
-== bidi-006.html bidi-006-ref.html
-== bidi-006-j.html bidi-006-ref.html
+random-if(cocoaWidget) == bidi-006.html bidi-006-ref.html # bug 734313
+random-if(cocoaWidget) == bidi-006-j.html bidi-006-ref.html # bug 734313
 == bidiSVG-01.svg bidiSVG-01-ref.svg
 == bidiSVG-02.svg bidiSVG-02-ref.svg
 == bidiSVG-03.svg bidiSVG-03-ref.svg
@@ -34,8 +34,8 @@ random-if(cocoaWidget) == mirroring-02.html mirroring-02-ref.html
 == unicode-bidi-anonymous-002.html unicode-bidi-anonymous-002-ref.html
 == with-first-letter-1a.html with-first-letter-1-ref.html
 == with-first-letter-1b.html with-first-letter-1-ref.html
-== with-first-letter-2a.html with-first-letter-2-ref.html
-== with-first-letter-2b.html with-first-letter-2-ref.html
+random-if(cocoaWidget) == with-first-letter-2a.html with-first-letter-2-ref.html # bug 734313
+random-if(cocoaWidget) == with-first-letter-2b.html with-first-letter-2-ref.html # bug 734313
 == 83958-1a.html 83958-1-ref.html
 == 83958-1b.html 83958-1-ref.html
 == 83958-1c.html 83958-1-ref.html
diff --git a/layout/reftests/bugs/731726-1-ref.html b/layout/reftests/bugs/731726-1-ref.html
new file mode 100644
index 00000000000..34a58f1a9ef
--- /dev/null
+++ b/layout/reftests/bugs/731726-1-ref.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <style type="text/css">input{border: none}</style>
+</head>
+<body>
+  <input id="button2" type="button"/>
+  <div id="target"><div><input id="button" type="button"/></div></div>
+<script>
+document.getElementById("button2").focus();
+</script>
+</body>
+</html>
diff --git a/layout/reftests/bugs/731726-1.html b/layout/reftests/bugs/731726-1.html
new file mode 100644
index 00000000000..a016e62ae8a
--- /dev/null
+++ b/layout/reftests/bugs/731726-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <style type="text/css">input{border: none}</style>
+</head>
+<body>
+  <div><input id="button" type="button"/></div>
+  <input id="button2" type="button"/>
+  <div id="target"/>
+<script>
+var button = document.getElementById("button");
+button.focus();
+document.getElementById("target").appendChild(button.parentNode);
+document.getElementById("button2").focus();
+</script>
+</body>
+</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 88a08c269cd..f1a137827b3 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1694,3 +1694,4 @@ fuzzy-if(d2d,1,19) fuzzy-if(cocoaWidget,1,170) == 718521.html 718521-ref.html
 == 720987.html 720987-ref.html
 == 722923-1.html 722923-1-ref.html
 == 729143-1.html 729143-1-ref.html
+needs-focus == 731726-1.html 731726-1-ref.html
diff --git a/layout/style/nsCSSAnonBoxes.cpp b/layout/style/nsCSSAnonBoxes.cpp
index a96b43ef52b..b346ae0f1b4 100644
--- a/layout/style/nsCSSAnonBoxes.cpp
+++ b/layout/style/nsCSSAnonBoxes.cpp
@@ -68,8 +68,7 @@ static const nsStaticAtom CSSAnonBoxes_info[] = {
 
 void nsCSSAnonBoxes::AddRefAtoms()
 {
-  NS_RegisterStaticAtoms(CSSAnonBoxes_info,
-                         ArrayLength(CSSAnonBoxes_info));
+  NS_RegisterStaticAtoms(CSSAnonBoxes_info);
 }
 
 bool nsCSSAnonBoxes::IsAnonBox(nsIAtom *aAtom)
diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp
index 8c36e65af73..2a22ad214c9 100644
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@@ -735,7 +735,7 @@ static void AppendRuleToSheet(css::Rule* aRule, void* aParser)
   mScanner.ReportUnexpected(#msg_)
 
 #define REPORT_UNEXPECTED_P(msg_, params_) \
-  mScanner.ReportUnexpectedParams(#msg_, params_, ArrayLength(params_))
+  mScanner.ReportUnexpectedParams(#msg_, params_)
 
 #define REPORT_UNEXPECTED_EOF(lf_) \
   mScanner.ReportUnexpectedEOF(#lf_)
diff --git a/layout/style/nsCSSPseudoClasses.cpp b/layout/style/nsCSSPseudoClasses.cpp
index 7ea0e69fd9c..3f6b600c1dd 100644
--- a/layout/style/nsCSSPseudoClasses.cpp
+++ b/layout/style/nsCSSPseudoClasses.cpp
@@ -66,8 +66,7 @@ static const nsStaticAtom CSSPseudoClasses_info[] = {
 
 void nsCSSPseudoClasses::AddRefAtoms()
 {
-  NS_RegisterStaticAtoms(CSSPseudoClasses_info,
-                         ArrayLength(CSSPseudoClasses_info));
+  NS_RegisterStaticAtoms(CSSPseudoClasses_info);
 }
 
 bool
diff --git a/layout/style/nsCSSPseudoElements.cpp b/layout/style/nsCSSPseudoElements.cpp
index 4dd1172d903..bbaf46facf1 100644
--- a/layout/style/nsCSSPseudoElements.cpp
+++ b/layout/style/nsCSSPseudoElements.cpp
@@ -80,8 +80,7 @@ static const PRUint32 CSSPseudoElements_flags[] = {
 
 void nsCSSPseudoElements::AddRefAtoms()
 {
-  NS_RegisterStaticAtoms(CSSPseudoElements_info,
-                         ArrayLength(CSSPseudoElements_info));
+  NS_RegisterStaticAtoms(CSSPseudoElements_info);
 }
 
 bool nsCSSPseudoElements::IsPseudoElement(nsIAtom *aAtom)
diff --git a/layout/style/nsCSSScanner.cpp b/layout/style/nsCSSScanner.cpp
index b8fb0b55655..d157e91a605 100644
--- a/layout/style/nsCSSScanner.cpp
+++ b/layout/style/nsCSSScanner.cpp
@@ -547,7 +547,7 @@ nsCSSScanner::ReportUnexpectedToken(nsCSSToken& tok,
     tokenString.get()
   };
 
-  ReportUnexpectedParams(aMessage, params, ArrayLength(params));
+  ReportUnexpectedParams(aMessage, params);
 }
 
 // aParams's first entry must be null, and we'll fill in the token
diff --git a/layout/style/nsCSSScanner.h b/layout/style/nsCSSScanner.h
index 6871c10b887..b9897a6065b 100644
--- a/layout/style/nsCSSScanner.h
+++ b/layout/style/nsCSSScanner.h
@@ -160,9 +160,19 @@ class nsCSSScanner {
 
   // aMessage must take no parameters
   void ReportUnexpected(const char* aMessage);
+  
+private:
   void ReportUnexpectedParams(const char* aMessage,
-                              const PRUnichar **aParams,
+                              const PRUnichar** aParams,
                               PRUint32 aParamsLength);
+
+public:
+  template<PRUint32 N>                           
+  void ReportUnexpectedParams(const char* aMessage,
+                              const PRUnichar* (&aParams)[N])
+    {
+      return ReportUnexpectedParams(aMessage, aParams, N);
+    }
   // aLookingFor is a plain string, not a format string
   void ReportUnexpectedEOF(const char* aLookingFor);
   // aLookingFor is a single character
diff --git a/layout/svg/base/src/nsSVGUtils.cpp b/layout/svg/base/src/nsSVGUtils.cpp
index 984cb86b18d..9603735e899 100644
--- a/layout/svg/base/src/nsSVGUtils.cpp
+++ b/layout/svg/base/src/nsSVGUtils.cpp
@@ -1215,6 +1215,11 @@ nsSVGUtils::HitTestChildren(nsIFrame *aFrame, const nsPoint &aPoint)
        current = current->GetPrevSibling()) {
     nsISVGChildFrame* SVGFrame = do_QueryFrame(current);
     if (SVGFrame) {
+      const nsIContent* content = current->GetContent();
+      if (content->IsSVG() &&
+          !static_cast<const nsSVGElement*>(content)->HasValidDimensions()) {
+        continue;
+      }
       result = SVGFrame->GetFrameForPoint(aPoint);
       if (result)
         break;
diff --git a/layout/svg/crashtests/732836-1.svg b/layout/svg/crashtests/732836-1.svg
new file mode 100644
index 00000000000..a9abb46668c
--- /dev/null
+++ b/layout/svg/crashtests/732836-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" >
+
+  <symbol id="z">
+    <use xlink:href="data:image/svg+xml,&lt;svg xmlns='http://www.w3.org/2000/svg' id='root' /&gt;#root" />
+  </symbol>
+
+  <use id="a" xlink:href="#z" width="20"/>
+
+  <script>
+  window.addEventListener("load", function() {
+    window.scrollByPages(0);
+    document.getElementById("a").removeAttribute("width");
+    document.elementFromPoint(0, 0);
+  }, false);
+  </script>
+
+</svg>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
index ed07648dd11..467879c3006 100644
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -124,3 +124,4 @@ load 709920-2.svg
 load 713413-1.svg
 load 722003-1.svg
 load 725918-1.svg
+load 732836-1.svg
diff --git a/layout/tables/nsTableFrame.cpp b/layout/tables/nsTableFrame.cpp
index 53062d11451..66436822ce0 100644
--- a/layout/tables/nsTableFrame.cpp
+++ b/layout/tables/nsTableFrame.cpp
@@ -1045,7 +1045,7 @@ nsTableFrame::InsertRowGroups(const nsFrameList::Slice& aRowGroups)
 /////////////////////////////////////////////////////////////////////////////
 // Child frame enumeration
 
-nsFrameList
+const nsFrameList&
 nsTableFrame::GetChildList(ChildListID aListID) const
 {
   if (aListID == kColGroupList) {
diff --git a/layout/tables/nsTableFrame.h b/layout/tables/nsTableFrame.h
index 872ca469b92..e52d8f868e3 100644
--- a/layout/tables/nsTableFrame.h
+++ b/layout/tables/nsTableFrame.h
@@ -244,7 +244,7 @@ public:
   NS_IMETHOD SetInitialChildList(ChildListID     aListID,
                                  nsFrameList&    aChildList);
 
-  virtual nsFrameList GetChildList(ChildListID aListID) const;
+  virtual const nsFrameList& GetChildList(ChildListID aListID) const;
   virtual void GetChildLists(nsTArray<ChildList>* aLists) const;
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
diff --git a/layout/tables/nsTableOuterFrame.cpp b/layout/tables/nsTableOuterFrame.cpp
index c1bc6f30d01..49206de5e3c 100644
--- a/layout/tables/nsTableOuterFrame.cpp
+++ b/layout/tables/nsTableOuterFrame.cpp
@@ -215,7 +215,7 @@ nsTableOuterFrame::DestroyFrom(nsIFrame* aDestructRoot)
   nsContainerFrame::DestroyFrom(aDestructRoot);
 }
 
-nsFrameList
+const nsFrameList&
 nsTableOuterFrame::GetChildList(ChildListID aListID) const
 {
   if (aListID == kCaptionList) {
diff --git a/layout/tables/nsTableOuterFrame.h b/layout/tables/nsTableOuterFrame.h
index fa33ce7015f..d7be9e5ba84 100644
--- a/layout/tables/nsTableOuterFrame.h
+++ b/layout/tables/nsTableOuterFrame.h
@@ -102,7 +102,7 @@ public:
   NS_IMETHOD SetInitialChildList(ChildListID     aListID,
                                  nsFrameList&    aChildList);
  
-  virtual nsFrameList GetChildList(ChildListID aListID) const;
+  virtual const nsFrameList& GetChildList(ChildListID aListID) const;
   virtual void GetChildLists(nsTArray<ChildList>* aLists) const;
 
   NS_IMETHOD AppendFrames(ChildListID     aListID,
diff --git a/layout/xul/base/src/nsBoxFrame.h b/layout/xul/base/src/nsBoxFrame.h
index bb58524c590..3938e84dbf4 100644
--- a/layout/xul/base/src/nsBoxFrame.h
+++ b/layout/xul/base/src/nsBoxFrame.h
@@ -61,7 +61,7 @@ class nsBoxLayoutState;
 #define NS_STATE_CURRENTLY_IN_DEBUG      NS_FRAME_STATE_BIT(25)
 //#define NS_STATE_SET_TO_DEBUG            NS_FRAME_STATE_BIT(26)  moved to nsBox.h
 //#define NS_STATE_DEBUG_WAS_SET           NS_FRAME_STATE_BIT(27)  moved to nsBox.h
-//                                         NS_FRAME_STATE_BIT(28)  not used anymore
+#define NS_STATE_MENU_HAS_POPUP_LIST       NS_FRAME_STATE_BIT(28) /* used on nsMenuFrame */
 #define NS_STATE_BOX_WRAPS_KIDS_IN_BLOCK NS_FRAME_STATE_BIT(29)
 #define NS_STATE_EQUAL_SIZE              NS_FRAME_STATE_BIT(30)
 //#define NS_STATE_IS_DIRECTION_NORMAL     NS_FRAME_STATE_BIT(31)  moved to nsIFrame.h
diff --git a/layout/xul/base/src/nsMenuFrame.cpp b/layout/xul/base/src/nsMenuFrame.cpp
index 65efb99b610..9b15135f371 100644
--- a/layout/xul/base/src/nsMenuFrame.cpp
+++ b/layout/xul/base/src/nsMenuFrame.cpp
@@ -87,6 +87,13 @@ using namespace mozilla;
 #define NSCONTEXTMENUISMOUSEUP 1
 #endif
 
+static void
+AssertNotCalled(void* aPropertyValue)
+{
+  NS_ERROR("popup list should never be destroyed by the FramePropertyTable");
+}
+NS_DECLARE_FRAME_PROPERTY(PopupListProperty, AssertNotCalled)
+
 static PRInt32 gEatMouseMove = false;
 
 const PRInt32 kBlinkDelay = 67; // milliseconds
@@ -207,9 +214,6 @@ NS_QUERYFRAME_HEAD(nsMenuFrame)
   NS_QUERYFRAME_ENTRY(nsMenuFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsBoxFrame)
 
-//
-// nsMenuFrame cntr
-//
 nsMenuFrame::nsMenuFrame(nsIPresShell* aShell, nsStyleContext* aContext):
   nsBoxFrame(aShell, aContext),
     mIsMenu(false),
@@ -217,11 +221,9 @@ nsMenuFrame::nsMenuFrame(nsIPresShell* aShell, nsStyleContext* aContext):
     mIgnoreAccelTextChange(false),
     mType(eMenuType_Normal),
     mMenuParent(nsnull),
-    mPopupFrame(nsnull),
     mBlinkState(0)
 {
-
-} // cntr
+}
 
 void
 nsMenuFrame::SetParent(nsIFrame* aParent)
@@ -298,11 +300,12 @@ nsMenuFrame::Init(nsIContent*      aContent,
   return rv;
 }
 
-nsFrameList
+const nsFrameList&
 nsMenuFrame::GetChildList(ChildListID aListID) const
 {
   if (kPopupList == aListID) {
-    return nsFrameList(mPopupFrame, mPopupFrame);
+    nsFrameList* list = GetPopupList();
+    return list ? *list : nsFrameList::EmptyList();
   }
   return nsBoxFrame::GetChildList(aListID);
 }
@@ -311,8 +314,44 @@ void
 nsMenuFrame::GetChildLists(nsTArray<ChildList>* aLists) const
 {
   nsBoxFrame::GetChildLists(aLists);
-  nsFrameList popupList(mPopupFrame, mPopupFrame);
-  popupList.AppendIfNonempty(aLists, kPopupList);
+  nsFrameList* list = GetPopupList();
+  if (list) {
+    list->AppendIfNonempty(aLists, kPopupList);
+  }
+}
+
+nsMenuPopupFrame*
+nsMenuFrame::GetPopup()
+{
+  nsFrameList* popupList = GetPopupList();
+  return popupList ? static_cast<nsMenuPopupFrame*>(popupList->FirstChild()) :
+                     nsnull;
+}
+
+nsFrameList*
+nsMenuFrame::GetPopupList() const
+{
+  if (!HasPopup()) {
+    return nsnull;
+  }
+  nsFrameList* prop =
+    static_cast<nsFrameList*>(Properties().Get(PopupListProperty()));
+  NS_ASSERTION(prop && prop->GetLength() == 1 &&
+               prop->FirstChild()->GetType() == nsGkAtoms::menuPopupFrame,
+               "popup list should have exactly one nsMenuPopupFrame");
+  return prop;
+}
+
+void
+nsMenuFrame::DestroyPopupList()
+{
+  NS_ASSERTION(HasPopup(), "huh?");
+  nsFrameList* prop =
+    static_cast<nsFrameList*>(Properties().Remove(PopupListProperty()));
+  NS_ASSERTION(prop && prop->IsEmpty(),
+               "popup list must exist and be empty when destroying");
+  RemoveStateBits(NS_STATE_MENU_HAS_POPUP_LIST);
+  delete prop;
 }
 
 void
@@ -320,9 +359,12 @@ nsMenuFrame::SetPopupFrame(nsFrameList& aFrameList)
 {
   for (nsFrameList::Enumerator e(aFrameList); !e.AtEnd(); e.Next()) {
     if (e.get()->GetType() == nsGkAtoms::menuPopupFrame) {
-      // Remove this frame from the list and set it as mPopupFrame
-      mPopupFrame = (nsMenuPopupFrame *)e.get();
-      aFrameList.RemoveFrame(e.get());
+      // Remove the frame from the list and store it in a nsFrameList* property.
+      nsIFrame* popupFrame = e.get();
+      aFrameList.RemoveFrame(popupFrame);
+      nsFrameList* popupList = new nsFrameList(popupFrame, popupFrame);
+      Properties().Set(PopupListProperty(), popupList);
+      AddStateBits(NS_STATE_MENU_HAS_POPUP_LIST);
       break;
     }
   }
@@ -332,7 +374,7 @@ NS_IMETHODIMP
 nsMenuFrame::SetInitialChildList(ChildListID     aListID,
                                  nsFrameList&    aChildList)
 {
-  NS_ASSERTION(!mPopupFrame, "already have a popup frame set");
+  NS_ASSERTION(!HasPopup(), "SetInitialChildList called twice?");
   if (aListID == kPrincipalList || aListID == kPopupList) {
     SetPopupFrame(aChildList);
   }
@@ -365,8 +407,11 @@ nsMenuFrame::DestroyFrom(nsIFrame* aDestructRoot)
     mMenuParent->CurrentMenuIsBeingDestroyed();
   }
 
-  if (mPopupFrame)
-    mPopupFrame->DestroyFrom(aDestructRoot);
+  nsFrameList* popupList = GetPopupList();
+  if (popupList) {
+    popupList->DestroyFramesFrom(aDestructRoot);
+    DestroyPopupList();
+  }
 
   nsBoxFrame::DestroyFrom(aDestructRoot);
 }
@@ -675,8 +720,8 @@ nsMenuFrame::CloseMenu(bool aDeselectMenu)
 
   // Close the menu asynchronously
   nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
-  if (pm && mPopupFrame)
-    pm->HidePopup(mPopupFrame->GetContent(), false, aDeselectMenu, true);
+  if (pm && HasPopup())
+    pm->HidePopup(GetPopup()->GetContent(), false, aDeselectMenu, true);
 }
 
 bool
@@ -713,9 +758,10 @@ nsMenuFrame::DoLayout(nsBoxLayoutState& aState)
   // lay us out
   nsresult rv = nsBoxFrame::DoLayout(aState);
 
-  if (mPopupFrame) {
+  nsMenuPopupFrame* popupFrame = GetPopup();
+  if (popupFrame) {
     bool sizeToPopup = IsSizedToPopup(mContent, false);
-    mPopupFrame->LayoutPopup(aState, this, sizeToPopup);
+    popupFrame->LayoutPopup(aState, this, sizeToPopup);
   }
 
   return rv;
@@ -733,8 +779,9 @@ nsMenuFrame::SetDebug(nsBoxLayoutState& aState, bool aDebug)
   if (debugChanged)
   {
       nsBoxFrame::SetDebug(aState, aDebug);
-      if (mPopupFrame)
-        SetDebug(aState, mPopupFrame, aDebug);
+      nsMenuPopupFrame* popupFrame = GetPopup();
+      if (popupFrame)
+        SetDebug(aState, popupFrame, aDebug);
   }
 
   return NS_OK;
@@ -797,7 +844,8 @@ nsMenuFrame::Enter(nsGUIEvent *aEvent)
 bool
 nsMenuFrame::IsOpen()
 {
-  return mPopupFrame && mPopupFrame->IsOpen();
+  nsMenuPopupFrame* popupFrame = GetPopup();
+  return popupFrame && popupFrame->IsOpen();
 }
 
 bool
@@ -1248,21 +1296,15 @@ NS_IMETHODIMP
 nsMenuFrame::RemoveFrame(ChildListID     aListID,
                          nsIFrame*       aOldFrame)
 {
-  nsresult rv =  NS_OK;
-
-  if (mPopupFrame == aOldFrame) {
-    // Go ahead and remove this frame.
-    mPopupFrame->Destroy();
-    mPopupFrame = nsnull;
+  nsFrameList* popupList = GetPopupList();
+  if (popupList && popupList->DestroyFrameIfPresent(aOldFrame)) {
+    DestroyPopupList();
     PresContext()->PresShell()->
       FrameNeedsReflow(this, nsIPresShell::eTreeChange,
                        NS_FRAME_HAS_DIRTY_CHILDREN);
-    rv = NS_OK;
-  } else {
-    rv = nsBoxFrame::RemoveFrame(aListID, aOldFrame);
+    return NS_OK;
   }
-
-  return rv;
+  return nsBoxFrame::RemoveFrame(aListID, aOldFrame);
 }
 
 NS_IMETHODIMP
@@ -1270,9 +1312,9 @@ nsMenuFrame::InsertFrames(ChildListID     aListID,
                           nsIFrame*       aPrevFrame,
                           nsFrameList&    aFrameList)
 {
-  if (!mPopupFrame && (aListID == kPrincipalList || aListID == kPopupList)) {
+  if (!HasPopup() && (aListID == kPrincipalList || aListID == kPopupList)) {
     SetPopupFrame(aFrameList);
-    if (mPopupFrame) {
+    if (HasPopup()) {
 #ifdef DEBUG_LAYOUT
       nsBoxLayoutState state(PresContext());
       SetDebug(state, aFrameList, mState & NS_STATE_CURRENTLY_IN_DEBUG);
@@ -1287,7 +1329,7 @@ nsMenuFrame::InsertFrames(ChildListID     aListID,
   if (aFrameList.IsEmpty())
     return NS_OK;
 
-  if (NS_UNLIKELY(aPrevFrame == mPopupFrame)) {
+  if (NS_UNLIKELY(aPrevFrame && aPrevFrame == GetPopup())) {
     aPrevFrame = nsnull;
   }
 
@@ -1298,9 +1340,9 @@ NS_IMETHODIMP
 nsMenuFrame::AppendFrames(ChildListID     aListID,
                           nsFrameList&    aFrameList)
 {
-  if (!mPopupFrame && (aListID == kPrincipalList || aListID == kPopupList)) {
+  if (!HasPopup() && (aListID == kPrincipalList || aListID == kPopupList)) {
     SetPopupFrame(aFrameList);
-    if (mPopupFrame) {
+    if (HasPopup()) {
 
 #ifdef DEBUG_LAYOUT
       nsBoxLayoutState state(PresContext());
@@ -1326,9 +1368,10 @@ nsMenuFrame::SizeToPopup(nsBoxLayoutState& aState, nsSize& aSize)
     nsSize tmpSize(-1, 0);
     nsIBox::AddCSSPrefSize(this, tmpSize, widthSet, heightSet);
     if (!widthSet && GetFlex(aState) == 0) {
-      if (!mPopupFrame)
+      nsMenuPopupFrame* popupFrame = GetPopup();
+      if (!popupFrame)
         return false;
-      tmpSize = mPopupFrame->GetPrefSize(aState);
+      tmpSize = popupFrame->GetPrefSize(aState);
 
       // Produce a size such that:
       //  (1) the menu and its popup can be the same width
@@ -1340,7 +1383,7 @@ nsMenuFrame::SizeToPopup(nsBoxLayoutState& aState, nsSize& aSize)
       GetBorderAndPadding(borderPadding);
 
       // if there is a scroll frame, add the desired width of the scrollbar as well
-      nsIScrollableFrame* scrollFrame = do_QueryFrame(mPopupFrame->GetFirstPrincipalChild());
+      nsIScrollableFrame* scrollFrame = do_QueryFrame(popupFrame->GetFirstPrincipalChild());
       nscoord scrollbarWidth = 0;
       if (scrollFrame) {
         scrollbarWidth =
@@ -1380,10 +1423,11 @@ nsMenuFrame::GetPrefSize(nsBoxLayoutState& aState)
 NS_IMETHODIMP
 nsMenuFrame::GetActiveChild(nsIDOMElement** aResult)
 {
-  if (!mPopupFrame)
+  nsMenuPopupFrame* popupFrame = GetPopup();
+  if (!popupFrame)
     return NS_ERROR_FAILURE;
 
-  nsMenuFrame* menuFrame = mPopupFrame->GetCurrentMenuItem();
+  nsMenuFrame* menuFrame = popupFrame->GetCurrentMenuItem();
   if (!menuFrame) {
     *aResult = nsnull;
   }
@@ -1399,12 +1443,13 @@ nsMenuFrame::GetActiveChild(nsIDOMElement** aResult)
 NS_IMETHODIMP
 nsMenuFrame::SetActiveChild(nsIDOMElement* aChild)
 {
-  if (!mPopupFrame)
+  nsMenuPopupFrame* popupFrame = GetPopup();
+  if (!popupFrame)
     return NS_ERROR_FAILURE;
 
   if (!aChild) {
     // Remove the current selection
-    mPopupFrame->ChangeMenuItem(nsnull, false);
+    popupFrame->ChangeMenuItem(nsnull, false);
     return NS_OK;
   }
 
@@ -1412,17 +1457,18 @@ nsMenuFrame::SetActiveChild(nsIDOMElement* aChild)
 
   nsIFrame* kid = child->GetPrimaryFrame();
   if (kid && kid->GetType() == nsGkAtoms::menuFrame)
-    mPopupFrame->ChangeMenuItem(static_cast<nsMenuFrame *>(kid), false);
+    popupFrame->ChangeMenuItem(static_cast<nsMenuFrame *>(kid), false);
   return NS_OK;
 }
 
 nsIScrollableFrame* nsMenuFrame::GetScrollTargetFrame()
 {
-  if (!mPopupFrame)
+  nsMenuPopupFrame* popupFrame = GetPopup();
+  if (!popupFrame)
     return nsnull;
-  nsIFrame* childFrame = mPopupFrame->GetFirstPrincipalChild();
+  nsIFrame* childFrame = popupFrame->GetFirstPrincipalChild();
   if (childFrame)
-    return mPopupFrame->GetScrollFrame(childFrame);
+    return popupFrame->GetScrollFrame(childFrame);
   return nsnull;
 }
 
diff --git a/layout/xul/base/src/nsMenuFrame.h b/layout/xul/base/src/nsMenuFrame.h
index 9731c41bf9d..dc5476dd913 100644
--- a/layout/xul/base/src/nsMenuFrame.h
+++ b/layout/xul/base/src/nsMenuFrame.h
@@ -130,7 +130,7 @@ public:
   // The following methods are all overridden so that the menupopup
   // can be stored in a separate list, so that it doesn't impact reflow of the
   // actual menu item at all.
-  virtual nsFrameList GetChildList(ChildListID aList) const;
+  virtual const nsFrameList& GetChildList(ChildListID aList) const;
   virtual void GetChildLists(nsTArray<ChildList>* aLists) const;
   NS_IMETHOD SetInitialChildList(ChildListID     aListID,
                                  nsFrameList&    aChildList);
@@ -185,7 +185,16 @@ public:
   virtual nsMenuParent *GetMenuParent() { return mMenuParent; }
   const nsAString& GetRadioGroupName() { return mGroupName; }
   nsMenuType GetMenuType() { return mType; }
-  nsMenuPopupFrame* GetPopup() { return mPopupFrame; }
+  nsMenuPopupFrame* GetPopup();
+
+  /**
+   * @return true if this frame has a popup child frame.
+   */
+  bool HasPopup() const
+  {
+    return (GetStateBits() & NS_STATE_MENU_HAS_POPUP_LIST) != 0;
+  }
+
 
   // nsMenuFrame methods 
 
@@ -226,10 +235,23 @@ protected:
   friend class nsASyncMenuInitialization;
   friend class nsMenuAttributeChangedEvent;
 
-  // initialize mPopupFrame to the first popup frame within
-  // aChildList. Removes the popup, if any, from aChildList.
+  /**
+   * Initialize the popup list to the first popup frame within
+   * aChildList. Removes the popup, if any, from aChildList.
+   */
   void SetPopupFrame(nsFrameList& aChildList);
 
+  /**
+   * Get the popup frame list from the frame property.
+   * @return the property value if it exists, nsnull otherwise.
+   */
+  nsFrameList* GetPopupList() const;
+
+  /**
+   * Destroy the popup list property.  The list must exist and be empty.
+   */
+  void DestroyPopupList();
+
   // set mMenuParent to the nearest enclosing menu bar or menupopup frame of
   // aParent (or aParent itself). This is called when initializing the frame,
   // so aParent should be the expected parent of this frame.
@@ -275,9 +297,6 @@ protected:
 
   nsMenuParent* mMenuParent; // Our parent menu.
 
-  // the popup for this menu, owned
-  nsMenuPopupFrame* mPopupFrame;
-
   // Reference to the mediator which wraps this frame.
   nsRefPtr<nsMenuTimerMediator> mTimerMediator;
 
diff --git a/media/libpng/mozpngconf.h b/media/libpng/mozpngconf.h
index 0f5f4cf1dd5..f67897ed334 100644
--- a/media/libpng/mozpngconf.h
+++ b/media/libpng/mozpngconf.h
@@ -41,7 +41,6 @@
 
 #define PNG_API_RULE 0
 #define PNG_COST_SHIFT 3
-#define PNG_DEFAULT_READ_MACROS 1
 #define PNG_GAMMA_THRESHOLD_FIXED 5000
 #define PNG_MAX_GAMMA_8 11
 #define PNG_USER_CHUNK_MALLOC_MAX 4000000L
@@ -72,7 +71,6 @@
 #define PNG_READ_EXPAND_SUPPORTED
 #define PNG_READ_GAMMA_SUPPORTED
 #define PNG_READ_GRAY_TO_RGB_SUPPORTED
-#define PNG_READ_INT_FUNCTIONS_SUPPORTED
 #define PNG_READ_INTERLACING_SUPPORTED
 #define PNG_READ_SCALE_16_TO_8_SUPPORTED
 #define PNG_READ_TEXT_SUPPORTED
@@ -86,8 +84,8 @@
 #define PNG_WRITE_16BIT_SUPPORTED
 #define PNG_WRITE_ANCILLARY_CHUNKS_SUPPORTED
 #define PNG_WRITE_FLUSH_SUPPORTED
-#define PNG_WRITE_INT_FUNCTIONS_SUPPORTED
 #define PNG_WRITE_OPTIMIZE_CMF_SUPPORTED
+#define PNG_WRITE_INT_FUNCTIONS_SUPPORTED
 #endif
 
 #define PNG_APNG_SUPPORTED
@@ -144,7 +142,6 @@
 /* The following may have changed, or can be affected by conditional compilation
    choices, and will be mangled. */
 #define png_64bit_product               MOZ_PNG_64bit_product
-#define png_benign_error                MOZ_PNG_benign_error
 #define png_build_gamma_table           MOZ_PNG_build_gamma_tab
 #define png_build_grayscale_palette     MOZ_PNG_build_g_p
 #define png_calculate_crc               MOZ_PNG_calc_crc
@@ -153,7 +150,6 @@
 #define png_check_chunk_name            MOZ_PNG_ck_chunk_name
 #define png_check_IHDR                  MOZ_PNG_ck_IHDR
 #define png_check_keyword               MOZ_PNG_ck_keyword
-#define png_chunk_benign_error          MOZ_PNG_ck_benign_error
 #define png_combine_row                 MOZ_PNG_combine_row
 #define png_convert_from_struct_tm      MOZ_PNG_cv_from_struct_tm
 #define png_convert_from_time_t         MOZ_PNG_cv_from_time_t
@@ -234,7 +230,6 @@
 #define png_get_IHDR                    MOZ_PNG_get_IHDR
 #define png_get_image_height            MOZ_PNG_get_image_h
 #define png_get_image_width             MOZ_PNG_get_image_w
-#define png_get_int_32                  MOZ_PNG_get_int_32
 #define png_get_interlace_type          MOZ_PNG_get_interlace_type
 #define png_get_libpng_ver              MOZ_PNG_get_libpng_ver
 #define png_get_mem_ptr                 MOZ_PNG_get_mem_ptr
@@ -259,9 +254,6 @@
 #define png_get_text                    MOZ_PNG_get_text
 #define png_get_tIME                    MOZ_PNG_get_tIME
 #define png_get_tRNS                    MOZ_PNG_get_tRNS
-#define png_get_uint_16                 MOZ_PNG_get_uint_16
-#define png_get_uint_31                 MOZ_PNG_get_uint_31
-#define png_get_uint_32                 MOZ_PNG_get_uint_32
 #define png_get_unknown_chunks          MOZ_PNG_get_unk_chunks
 #define png_get_user_chunk_ptr          MOZ_PNG_get_user_chunk_ptr
 #define png_get_user_height_max         MOZ_PNG_get_user_height_max
@@ -545,10 +537,8 @@
 #define png_exp                                   MOZ_PNG_exp
 #define png_exp16bit                              MOZ_PNG_exp16bit
 #define png_exp8bit                               MOZ_PNG_exp8bit
-#define png_fixed_error                           MOZ_PNG_fixed_error
 #define png_fixed_inches_from_microns             MOZ_PNG_fixed_inch_from_micr
 #define png_format_number                         MOZ_PNG_format_number
-#define png_formatted_warning                     MOZ_PNG_formatted_warning
 #define png_gamma_16bit_correct                   MOZ_PNG_gamma_16bit_correct
 #define png_gamma_8bit_correct                    MOZ_PNG_gamma_8bit_correct
 #define png_gamma_correct                         MOZ_PNG_gamma_correct
@@ -610,9 +600,6 @@
 #define png_set_text_compression_strategy         MOZ_PNG_set_text_c_strategy
 #define png_set_text_compression_window_bits      MOZ_PNG_set_text_c_wnd_bits
 #define png_user_version_check                    MOZ_PNG_user_version_check
-#define png_warning_parameter                     MOZ_PNG_warn_param
-#define png_warning_parameter_signed              MOZ_PNG_warn_param_signed
-#define png_warning_parameter_unsigned            MOZ_PNG_warn_param_unsigned
 #define png_write_chunk_header                    MOZ_PNG_write_chunk_header
 #define png_write_complete_chunk                  MOZ_PNG_write_complete_chunk
 #define png_xy_from_XYZ                           MOZ_PNG_xy_from_XYZ
@@ -624,11 +611,16 @@
 #define ppi_from_ppm                              MOZ_ppi_from_ppm
 #define translate_gamma_flags                     MOZ_translate_gamma_flags
 
-#ifdef PR_LOGGING
+#if defined(PR_LOGGING) && defined(PNG_WARNINGS_SUPPORTED)
 #define png_warning                     MOZ_PNG_warning
 #define png_error                       MOZ_PNG_error
 #define png_chunk_error                 MOZ_PNG_chunk_err
+#define png_fixed_error                 MOZ_PNG_fixed_err
+#define png_formatted_warning           MOZ_PNG_formatted_warning
 #define png_chunk_warning               MOZ_PNG_chunk_warn
+#define png_warning_parameter           MOZ_PNG_warn_param
+#define png_warning_parameter_signed    MOZ_PNG_warn_param_signed
+#define png_warning_parameter_unsigned  MOZ_PNG_warn_param_unsigned
 #endif
 
 #endif /* MOZPNGCONF_H */
diff --git a/mfbt/STYLE b/mfbt/STYLE
new file mode 100644
index 00000000000..31b3ceec138
--- /dev/null
+++ b/mfbt/STYLE
@@ -0,0 +1,273 @@
+= mfbt style rules =
+
+== Line length ==
+
+The line limit is 80 characters, except that excessively long blocks of preprocessor directives may exceed this if it makes the code more readable (e.g. MOZ_STATIC_ASSERT in Assertions.h.), and unbreakable text in comments (e.g. URLs) may exceed this as well.  Wrap expressions after binary operators.
+
+== Capitalization ==
+
+Standalone functions, classes, structs, and template parameters are named InterCaps-style.  Member functions and fields in classes and structs are named camelCaps-style.
+
+== Indentation ==
+
+Indentation is two spaces, never tabs.
+
+  if (x == 2)
+    return 17;
+
+== Whitespace ==
+
+Surround binary operators with a single space on either side.
+
+  if (x == 2)
+    return 17;
+
+When describing pointer types, the * shall be adjacent to the type name.  (Same goes for references -- & goes by the type name.)
+
+  int
+  Foo(int* p)
+  {
+    typedef void* VoidPtr;
+    int& i = *p;
+  }
+
+A corollary: don't mix declaration types by declaring a T and a T* (or a T**, &c.) in the same declaration.
+
+  T* foo, bar; // BAD
+
+== Bracing ==
+
+Don't brace single statements.
+
+  if (y == 7)
+    return 3;
+  for (size_t i = 0; i < 5; i++)
+    frob(i);
+
+But do brace them if the statement (or condition(s) or any additional consequents, if the braces would be associated with an if statement) occupies multiple lines.
+
+  if (cond1 ||
+      cond2)
+  {
+    action();
+  }
+  if (cond1) {
+    consequent();
+  } else {
+    alternative(arg1,
+                arg2);
+  }
+  if (cond1 || cond2) {
+    callMethod(arg1,
+               arg2);
+  }
+  for (size_t j = 0;
+       j < 17;
+       j++)
+  {
+    action();
+  }
+
+Braces in control flow go at the end of the line except when associated with an |if| or loop-head where the condition covers multiple lines
+
+== Classes and structs ==
+
+Inside class and structure definitions, public/private consume one level of indentation.
+
+  class Baz
+  {
+    public:
+      Baz() { }
+  };
+
+The absence of public/private in structs in which all members are public still consumes a level.
+
+  struct Foo
+  {
+      int field;
+  };
+
+Braces delimiting a class or struct go on their own lines.
+
+Member initialization in constructors should be formatted as follows:
+
+  class Fnord
+  {
+      size_t s1, s2, s3, s4, s5;
+
+    public:
+      Fnord(size_t s) : s1(s), s2(s), s3(s), s4(s), s5(s) { }
+      Fnord()
+        : s1(0), /* member initialization can be compressed if desired */
+          s2(0),
+          s3(0),
+          s4(0),
+          s5(0)
+      {
+        ...
+      }
+  };
+
+Fields should go first in the class so that the basic structure is all in one place, consistently.
+
+Use the inline keyword to annotate functions defined inline in a header.  (If the function is defined inline in the class, don't bother adding it redundantly.)
+
+Explicitly delete (using Attributes.h's MOZ_DELETE) the copy constructor and assignment operator from classes not intended to be copied or assigned to avoid mistakes.
+
+  class Funky
+  {
+    public:
+      Funky() { }
+
+    private:
+      Funky(const Funky& other) MOZ_DELETE;
+      void operator=(const Funky& other) MOZ_DELETE;
+  };
+
+Include a blank line between sections of structs and classes with different access control.
+
+The "get" prefix is used when a method is fallible.  If it's infallible, don't use it.
+
+  class String
+  {
+    public:
+      size_t length() const; // not getLength()
+  };
+
+== Templates ==
+
+Capitalize template parameter names to distinguish them from fields.
+
+  template<size_t KeySize, typename T>
+  class BloomFilter
+  {
+  };
+
+Use single-letter names if it makes sense (T for an arbitrary type, K for key type, V for value type, &c.).  Otherwise use InterCaps-style names.
+
+When declaring or defining a function, template<...> goes on one line, the return type and other specifiers go on another line, and the function name and argument list go on a third line.
+
+  template<typename T>
+  inline bool
+  Vector::add(T t)
+  {
+  }
+
+== Namespaces ==
+
+All C++ code shall be in the mozilla namespace, except that functionality only used to implement external-facing API should be in the mozilla::detail namespace, indicating that it should not be directly used.
+
+Namespace opening braces go on the same line as the namespace declaration.  Namespace closing braces shall be commented.  Namespace contents are not indented.
+
+  namespace mozilla {
+  ...
+  } // namespace mozilla
+
+Don't use |using| in a header unless it's confined to a class or method.  Implementation files for out-of-line functionality may use |using|.
+
+== #includes ==
+
+Headers that include mfbt headers use a fully-qualified include path, even if full qualification is not strictly necessary.
+
+  #include "mozilla/Assertions.h"
+
+mfbt headers should be included first, alphabetically.  Standard includes should follow, separated from mfbt includes by a blank line.
+
+  #include "mozilla/Assertions.h"
+  #include "mozilla/Attributes.h"
+  
+  #include <string.h>
+
+If a header dependency is limited simply to the existence of a class, forward-declare it rather than #include that header.
+
+  namespace mozilla {
+  
+  class BloomFilter;
+  extern bool
+  Test(BloomFilter* bf);
+  
+  } // namespace mozilla
+
+== Preprocessor ==
+
+Include guards should be named by determining the fully-qualified include path, then substituting _ for / and . in it, and finally appending a trailing _.  For example, "mozilla/Assertions.h" becomes mozilla_Assertions_h_.
+
+Nested preprocessor directives indent the directive name (but not the #) by two spaces.
+
+  #ifdef __clang__
+  #  define FOO ...
+  #else
+  #  define FOO ...
+  #endif
+
+Comments within nested preprocessor directives align with directive names at that nesting depth.
+
+  #if defined(__GNUC__)
+     /* gcc supports C++11 override syntax. */
+  #  define MOZ_OVERRIDE override
+  #else
+  #  define MOZ_OVERRIDE /* unsupported */
+  #endif
+
+Feature-testing macros may be defined to nothing.  Macros intended to be textually expanded should be defined to a comment indicating non-support, as above or as appropriate to the situation.
+
+No particular preference is expressed between testing for a macro being defined using defined(...) and using #ifdef.
+
+When defining a macro with different expansions for different compilers, the top level of distinction should be the compiler, and the next nested level should be the compiler version.  Clang seems likely to be around for awhile, so to reduce confusion test for it separately from gcc even when it's not strictly necessary.
+
+  #if defined(__clang__)
+  #elif defined(__GNUC__)
+  #  if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+  #  else
+  #  endif
+  #elif defined(_MSC_VER)
+  #endif
+
+But don't distinguish clang's feature support using version checks: use the __has_feature() and __has_extension() macros instead, because vendors may customize clang's version numbers.
+
+Prefer inline functions to macros whenever possible.
+
+== Comments ==
+
+Header files shall have a short descriptive comment underneath license boilerplate indicating what functionality the file implements, to be picked up by MXR and displayed in directory listings.  (But see bug 717196, which currently prevents MXR from doing this if the MPL2 boilerplate is used.)
+
+  Assertions.h:
+  ...license boilerplate...
+  
+  /* Implementations of runtime and static assertion macros for C and C++. */
+
+Classes intended for public use shall have interface comments explaining their functionality from the user's perspective.  These comments shall include examples of how the relevant functionality might be used.  These interface comments use /** */ doxygen/Javadoc-style comments.
+
+  /**
+   * The Frobber class simplifies the process of frobbing.
+   */
+  class Frobber
+  {
+  };
+
+Comments describing implementation details (tradeoffs considered, assumptions made, mathematical background, &c.) occur separately from interface comments so that users need not consider them.  They should go inside the class definition or inside the appropriate method, depending on the specificity of the comment.
+
+Headers which are intended to be C-compatible shall use only /**/-style comments.  (Code examples nested inside documentation comments may use //-style comments.)  Headers which are C++-compatible may also use //-style comments.
+
+Non-interface comments that are /**/-style shall not also be doxygen-style.
+
+Use Python-style ** to denote exponentiation inside comments, not ^ (which can be confused with C-style bitwise xor).  If you're writing sufficiently complex math, feel free to descend into LaTeX math mode ;-) inside implementation comments if you need to.  (But keep it out of interface comments, because most people probably haven't seen LaTeX.)
+
+== Miscellaneous ==
+
+Enclose C-compatible code in |extern "C"| blocks, and #ifdef __cplusplus the block start/end as needed.  The contents of these blocks should not be indented.
+
+Add new functionality to new headers unless an existing header makes sense.  Err on the side of more headers rather than fewer, as this helps to minimize dependencies.  Don't add anything to Util.h, which will be split into multiple headers at some point (bug 713082).
+
+Don't use bool for argument types unless the method is a "set" or "enable"-style method where the method name and bool value together indicate the sense of its effect.  Use well-named enums in all other places, so that the semantics of the argument are clear at a glance and do not require knowing how the method interprets that argument.
+
+  void
+  setVisible(bool visible); // true clearly means visible, false clearly not
+  enum Enumerability {
+    Enumerable,
+    NonEnumerable
+  };
+  bool
+  DefineProperty(JSObject* obj, const char* name, Value v, Enumerability e);
+
+Use NULL for the null pointer constant.
diff --git a/mobile/android/app/mobile.js b/mobile/android/app/mobile.js
index 25a57c1a793..f4950117307 100644
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@@ -221,13 +221,14 @@ pref("extensions.strictCompatibility", false);
 pref("extensions.minCompatibleAppVersion", "11.0");
 
 pref("extensions.update.url", "https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%&currentAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%");
+pref("extensions.update.background.url", "https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%&currentAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%");
 
 /* preferences for the Get Add-ons pane */
 pref("extensions.getAddons.cache.enabled", true);
 pref("extensions.getAddons.maxResults", 15);
 pref("extensions.getAddons.recommended.browseURL", "https://addons.mozilla.org/%LOCALE%/android/recommended/");
 pref("extensions.getAddons.recommended.url", "https://services.addons.mozilla.org/%LOCALE%/android/api/%API_VERSION%/list/featured/all/%MAX_RESULTS%/%OS%/%VERSION%");
-pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/android/search?q=%TERMS%");
+pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/android/search?q=%TERMS%&platform=%OS%&appver=%VERSION%");
 pref("extensions.getAddons.search.url", "https://services.addons.mozilla.org/%LOCALE%/android/api/%API_VERSION%/search/%TERMS%/all/%MAX_RESULTS%/%OS%/%VERSION%/%COMPATIBILITY_MODE%");
 pref("extensions.getAddons.browseAddons", "https://addons.mozilla.org/%LOCALE%/android/");
 pref("extensions.getAddons.get.url", "https://services.addons.mozilla.org/%LOCALE%/android/api/%API_VERSION%/search/guid:%IDS%?src=mobile&appOS=%OS%&appVersion=%VERSION%");
@@ -247,6 +248,9 @@ pref("extensions.blocklist.detailsURL", "https://www.mozilla.com/%LOCALE%/blockl
 pref("dom.disable_open_during_load", true);
 pref("privacy.popups.showBrowserMessage", true);
 
+/* disable opening windows with the dialog feature */
+pref("dom.disable_window_open_dialog_feature", true);
+
 pref("keyword.enabled", true);
 pref("keyword.URL", "http://www.google.com/m?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=");
 
diff --git a/mobile/android/base/AboutHomeContent.java b/mobile/android/base/AboutHomeContent.java
index ef77b9e03e8..e1075fd57fe 100644
--- a/mobile/android/base/AboutHomeContent.java
+++ b/mobile/android/base/AboutHomeContent.java
@@ -112,6 +112,7 @@ public class AboutHomeContent extends ScrollView {
     private LayoutInflater mInflater;
 
     private AccountManager mAccountManager;
+    private OnAccountsUpdateListener mAccountListener = null;
 
     protected SimpleCursorAdapter mTopSitesAdapter;
     protected GridView mTopSitesGrid;
@@ -139,7 +140,7 @@ public class AboutHomeContent extends ScrollView {
         mAccountManager = AccountManager.get(context);
 
         // The listener will run on the background thread (see 2nd argument)
-        mAccountManager.addOnAccountsUpdatedListener(new OnAccountsUpdateListener() {
+        mAccountManager.addOnAccountsUpdatedListener(mAccountListener = new OnAccountsUpdateListener() {
             public void onAccountsUpdated(Account[] accounts) {
                 final GeckoApp.StartupMode startupMode = GeckoApp.mAppContext.getStartupMode();
                 final boolean syncIsSetup = isSyncSetup();
@@ -210,6 +211,13 @@ public class AboutHomeContent extends ScrollView {
         });
     }
 
+    public void onDestroy() {
+        if (mAccountListener != null) {
+            mAccountManager.removeOnAccountsUpdatedListener(mAccountListener);
+            mAccountListener = null;
+        }
+    }
+
     void setLastTabsVisibility(boolean visible) {
         int visibility = visible ? View.VISIBLE : View.GONE;
         findViewById(R.id.last_tabs_title).setVisibility(visibility);
diff --git a/mobile/android/base/AwesomeBarTabs.java b/mobile/android/base/AwesomeBarTabs.java
index 1662f153edc..4d3a5f62307 100644
--- a/mobile/android/base/AwesomeBarTabs.java
+++ b/mobile/android/base/AwesomeBarTabs.java
@@ -202,6 +202,7 @@ public class AwesomeBarTabs extends TabHost {
         private static final int VIEW_TYPE_COUNT = 2;
 
         private LayoutInflater mInflater;
+        private Resources mResources;
         private LinkedList<Pair<Integer, String>> mParentStack;
         private RefreshBookmarkCursorTask mRefreshTask = null;
         private TextView mBookmarksTitleView;
@@ -210,6 +211,7 @@ public class AwesomeBarTabs extends TabHost {
             super(context, layout, c, from, to);
 
             mInflater = (LayoutInflater) mContext.getSystemService(Context.LAYOUT_INFLATER_SERVICE);
+            mResources = mContext.getResources();
 
             // mParentStack holds folder id/title pairs that allow us to navigate
             // back up the folder heirarchy
@@ -268,6 +270,24 @@ public class AwesomeBarTabs extends TabHost {
             if (!c.moveToPosition(position))
                 return "";
 
+            String guid = c.getString(c.getColumnIndexOrThrow(Bookmarks.GUID));
+
+            // If we don't have a special GUID, just return the folder title from the DB.
+            if (guid == null || guid.length() == 12)
+                return c.getString(c.getColumnIndexOrThrow(Bookmarks.TITLE));
+
+            // Use localized strings for special folder names.
+            if (guid.equals(Bookmarks.MOBILE_FOLDER_GUID))
+                return mResources.getString(R.string.bookmarks_folder_mobile);
+            else if (guid.equals(Bookmarks.MENU_FOLDER_GUID))
+                return mResources.getString(R.string.bookmarks_folder_menu);
+            else if (guid.equals(Bookmarks.TOOLBAR_FOLDER_GUID))
+                return mResources.getString(R.string.bookmarks_folder_toolbar);
+            else if (guid.equals(Bookmarks.UNFILED_FOLDER_GUID))
+                return mResources.getString(R.string.bookmarks_folder_unfiled);
+
+            // If for some reason we have a folder with a special GUID, but it's not one of
+            // the special folders we expect in the UI, just return the title from the DB.
             return c.getString(c.getColumnIndexOrThrow(Bookmarks.TITLE));
         }
 
diff --git a/mobile/android/base/BrowserToolbar.java b/mobile/android/base/BrowserToolbar.java
index 6638c927b23..1658797cec5 100644
--- a/mobile/android/base/BrowserToolbar.java
+++ b/mobile/android/base/BrowserToolbar.java
@@ -300,7 +300,7 @@ public class BrowserToolbar extends LinearLayout {
     }
 
     public void setFavicon(Drawable image) {
-        if (Tabs.getInstance().getSelectedTab().isLoading())
+        if (Tabs.getInstance().getSelectedTab().getState() == Tab.STATE_LOADING)
             return;
 
         if (image != null)
@@ -343,7 +343,7 @@ public class BrowserToolbar extends LinearLayout {
             setTitle(tab.getDisplayTitle());
             setFavicon(tab.getFavicon());
             setSecurityMode(tab.getSecurityMode());
-            setProgressVisibility(tab.isLoading());
+            setProgressVisibility(tab.getState() == Tab.STATE_LOADING);
             setShadowVisibility((url == null) || !url.startsWith("about:"));
             updateTabCount(Tabs.getInstance().getCount());
         }
diff --git a/mobile/android/base/GeckoApp.java b/mobile/android/base/GeckoApp.java
index a9fb20554eb..36f69a352e4 100644
--- a/mobile/android/base/GeckoApp.java
+++ b/mobile/android/base/GeckoApp.java
@@ -121,7 +121,6 @@ abstract public class GeckoApp
     public static SurfaceView cameraView;
     public static GeckoApp mAppContext;
     public static boolean mDOMFullScreen = false;
-    public static File sGREDir = null;
     public static Menu sMenu;
     private static GeckoThread sGeckoThread = null;
     public GeckoAppHandler mMainHandler;
@@ -174,7 +173,6 @@ abstract public class GeckoApp
     public enum LaunchState {Launching, WaitForDebugger,
                              Launched, GeckoRunning, GeckoExiting};
     private static LaunchState sLaunchState = LaunchState.Launching;
-    private static boolean sTryCatchAttached = false;
 
     private static final int FILE_PICKER_REQUEST = 1;
     private static final int AWESOMEBAR_REQUEST = 2;
@@ -610,7 +608,7 @@ abstract public class GeckoApp
             bitmap.compress(Bitmap.CompressFormat.PNG, 0, bos);
             processThumbnail(tab, bitmap, bos.toByteArray());
         } else {
-            if (!tab.hasLoaded()) {
+            if (tab.getState() == Tab.STATE_DELAYED) {
                 byte[] thumbnail = BrowserDB.getThumbnailForUrl(getContentResolver(), tab.getURL());
                 if (thumbnail != null)
                     processThumbnail(tab, null, thumbnail);
@@ -783,7 +781,7 @@ abstract public class GeckoApp
                     mBrowserToolbar.setTitle(tab.getDisplayTitle());
                     mBrowserToolbar.setFavicon(tab.getFavicon());
                     mBrowserToolbar.setSecurityMode(tab.getSecurityMode());
-                    mBrowserToolbar.setProgressVisibility(tab.isLoading());
+                    mBrowserToolbar.setProgressVisibility(tab.getState() == Tab.STATE_LOADING);
                 }
             }
         });
@@ -925,6 +923,7 @@ abstract public class GeckoApp
                 handleSecurityChange(tabId, mode);
             } else if (event.equals("Content:StateChange")) {
                 final int tabId = message.getInt("tabID");
+                final boolean success = message.getBoolean("success");
                 int state = message.getInt("state");
                 Log.i(LOGTAG, "State - " + state);
                 if ((state & GeckoAppShell.WPL_STATE_IS_NETWORK) != 0) {
@@ -934,7 +933,7 @@ abstract public class GeckoApp
                         handleDocumentStart(tabId, showProgress);
                     } else if ((state & GeckoAppShell.WPL_STATE_STOP) != 0) {
                         Log.i(LOGTAG, "Got a document stop");
-                        handleDocumentStop(tabId);
+                        handleDocumentStop(tabId, success);
                     }
                 }
             } else if (event.equals("Content:LoadError")) {
@@ -972,6 +971,13 @@ abstract public class GeckoApp
                         mBrowserToolbar.show();
                     }
                 });
+            } else if (event.equals("ToggleChrome:Focus")) {
+                mMainHandler.post(new Runnable() {
+                    public void run() {
+                        mBrowserToolbar.setVisibility(View.VISIBLE);
+                        mBrowserToolbar.requestFocusFromTouch();
+                    }
+                });
             } else if (event.equals("DOMFullScreen:Start")) {
                 mDOMFullScreen = true;
             } else if (event.equals("DOMFullScreen:Stop")) {
@@ -1218,7 +1224,7 @@ abstract public class GeckoApp
         if (tab == null)
             return;
 
-        tab.setLoading(true);
+        tab.setState(Tab.STATE_LOADING);
         tab.updateSecurityMode("unknown");
 
         mMainHandler.post(new Runnable() {
@@ -1233,12 +1239,12 @@ abstract public class GeckoApp
         });
     }
 
-    void handleDocumentStop(int tabId) {
+    void handleDocumentStop(int tabId, boolean success) {
         final Tab tab = Tabs.getInstance().getTab(tabId);
         if (tab == null)
             return;
 
-        tab.setLoading(false);
+        tab.setState(success ? Tab.STATE_SUCCESS : Tab.STATE_ERROR);
 
         mMainHandler.post(new Runnable() {
             public void run() {
@@ -1273,7 +1279,6 @@ abstract public class GeckoApp
             return;
 
         tab.updateTitle(title);
-        tab.setHasLoaded(true);
 
         // Make the UI changes
         mMainHandler.post(new Runnable() {
@@ -1314,7 +1319,7 @@ abstract public class GeckoApp
                 // want to load the image straight away. If tab is still
                 // loading, we only load the favicon once the page's content
                 // is fully loaded (see handleContentLoaded()).
-                if (!tab.isLoading()) {
+                if (tab.getState() != tab.STATE_LOADING) {
                     mMainHandler.post(new Runnable() {
                         public void run() {
                             loadFavicon(tab);
@@ -1602,6 +1607,8 @@ abstract public class GeckoApp
     @Override
     public void onCreate(Bundle savedInstanceState)
     {
+        GeckoAppShell.registerGlobalExceptionHandler();
+
         mAppContext = this;
 
         // StrictMode is set by defaults resource flag |enableStrictMode|.
@@ -1609,7 +1616,7 @@ abstract public class GeckoApp
             enableStrictMode();
         }
 
-        System.loadLibrary("mozglue");
+        GeckoAppShell.loadMozGlue();
         mMainHandler = new GeckoAppHandler();
         Log.w(LOGTAG, "zerdatime " + SystemClock.uptimeMillis() + " - onCreate");
         if (savedInstanceState != null) {
@@ -1644,6 +1651,7 @@ abstract public class GeckoApp
         mInitialized = true;
 
         Intent intent = getIntent();
+        String action = intent.getAction();
         String args = intent.getStringExtra("args");
         if (args != null && args.contains("-profile")) {
             Pattern p = Pattern.compile("(?:-profile\\s*)(\\w*)(\\s*)");
@@ -1656,7 +1664,7 @@ abstract public class GeckoApp
             }
         }
 
-        if (ACTION_UPDATE.equals(intent.getAction()) || args != null && args.contains("-alert update-app")) {
+        if (ACTION_UPDATE.equals(action) || args != null && args.contains("-alert update-app")) {
             Log.i(LOGTAG,"onCreate: Update request");
             checkAndLaunchUpdate();
         }
@@ -1679,9 +1687,6 @@ abstract public class GeckoApp
             mBrowserToolbar.updateTabCount(1);
         }
 
-        if (sGREDir == null)
-            sGREDir = new File(this.getApplicationInfo().dataDir);
-
         Uri data = intent.getData();
         if (data != null && "http".equals(data.getScheme()) &&
             isHostOnPrefetchWhitelist(data.getHost())) {
@@ -1697,9 +1702,20 @@ abstract public class GeckoApp
         }
 
         sGeckoThread = new GeckoThread(intent, passedUri, mRestoreSession);
-        if (!ACTION_DEBUG.equals(intent.getAction()) &&
-            checkAndSetLaunchState(LaunchState.Launching, LaunchState.Launched))
+        if (!ACTION_DEBUG.equals(action) &&
+            checkAndSetLaunchState(LaunchState.Launching, LaunchState.Launched)) {
             sGeckoThread.start();
+        } else if (ACTION_DEBUG.equals(action) &&
+            checkAndSetLaunchState(LaunchState.Launching, LaunchState.WaitForDebugger)) {
+            mMainHandler.postDelayed(new Runnable() {
+                public void run() {
+                    Log.i(LOGTAG, "Launching from debug intent after 5s wait");
+                    setLaunchState(LaunchState.Launching);
+                    sGeckoThread.start();
+                }
+            }, 1000 * 5 /* 5 seconds */);
+            Log.i(LOGTAG, "Intent : ACTION_DEBUG - waiting 5s before launching");
+        }
 
         mFavicons = new Favicons(this);
 
@@ -1740,21 +1756,6 @@ abstract public class GeckoApp
 
         Log.w(LOGTAG, "zerdatime " + SystemClock.uptimeMillis() + " - UI almost up");
 
-        if (!sTryCatchAttached) {
-            sTryCatchAttached = true;
-            mMainHandler.post(new Runnable() {
-                public void run() {
-                    try {
-                        Looper.loop();
-                    } catch (Exception e) {
-                        GeckoAppShell.reportJavaCrash(e);
-                    }
-                    // resetting this is kinda pointless, but oh well
-                    sTryCatchAttached = false;
-                }
-            });
-        }
-
         //register for events
         GeckoAppShell.registerGeckoEventListener("DOMContentLoaded", GeckoApp.mAppContext);
         GeckoAppShell.registerGeckoEventListener("DOMTitleChanged", GeckoApp.mAppContext);
@@ -1776,6 +1777,7 @@ abstract public class GeckoApp
         GeckoAppShell.registerGeckoEventListener("DOMFullScreen:Stop", GeckoApp.mAppContext);
         GeckoAppShell.registerGeckoEventListener("ToggleChrome:Hide", GeckoApp.mAppContext);
         GeckoAppShell.registerGeckoEventListener("ToggleChrome:Show", GeckoApp.mAppContext);
+        GeckoAppShell.registerGeckoEventListener("ToggleChrome:Focus", GeckoApp.mAppContext);
         GeckoAppShell.registerGeckoEventListener("Permissions:Data", GeckoApp.mAppContext);
         GeckoAppShell.registerGeckoEventListener("Downloads:Done", GeckoApp.mAppContext);
         GeckoAppShell.registerGeckoEventListener("CharEncoding:Data", GeckoApp.mAppContext);
@@ -1946,6 +1948,10 @@ abstract public class GeckoApp
             return;
         }
 
+        // don't perform any actions if launching from recent apps
+        if ((intent.getFlags() & Intent.FLAG_ACTIVITY_LAUNCHED_FROM_HISTORY) != 0)
+            return;
+
         if (checkLaunchState(LaunchState.Launched)) {
             Uri data = intent.getData();
             Bundle bundle = intent.getExtras();
@@ -2148,6 +2154,7 @@ abstract public class GeckoApp
         GeckoAppShell.unregisterGeckoEventListener("Toast:Show", GeckoApp.mAppContext);
         GeckoAppShell.unregisterGeckoEventListener("ToggleChrome:Hide", GeckoApp.mAppContext);
         GeckoAppShell.unregisterGeckoEventListener("ToggleChrome:Show", GeckoApp.mAppContext);
+        GeckoAppShell.unregisterGeckoEventListener("ToggleChrome:Focus", GeckoApp.mAppContext);
         GeckoAppShell.unregisterGeckoEventListener("Permissions:Data", GeckoApp.mAppContext);
         GeckoAppShell.unregisterGeckoEventListener("Downloads:Done", GeckoApp.mAppContext);
         GeckoAppShell.unregisterGeckoEventListener("CharEncoding:Data", GeckoApp.mAppContext);
@@ -2169,6 +2176,10 @@ abstract public class GeckoApp
         super.onDestroy();
 
         unregisterReceiver(mBatteryReceiver);
+
+        if (mAboutHomeContent != null) {
+            mAboutHomeContent.onDestroy();
+        }
     }
 
     @Override
@@ -2488,7 +2499,7 @@ abstract public class GeckoApp
                         fileExt = name.substring(period);
                         fileName = name.substring(0, period);
                     }
-                    File file = File.createTempFile(fileName, fileExt, sGREDir);
+                    File file = File.createTempFile(fileName, fileExt, GeckoAppShell.getGREDir(GeckoApp.mAppContext));
 
                     FileOutputStream fos = new FileOutputStream(file);
                     InputStream is = cr.openInputStream(uri);
diff --git a/mobile/android/base/GeckoAppShell.java b/mobile/android/base/GeckoAppShell.java
index 99a66ac39db..2ffb9d04afe 100644
--- a/mobile/android/base/GeckoAppShell.java
+++ b/mobile/android/base/GeckoAppShell.java
@@ -112,6 +112,8 @@ public class GeckoAppShell
     static File sHomeDir = null;
     static private int sDensityDpi = 0;
     private static Boolean sSQLiteLibsLoaded = false;
+    private static Boolean sLibsSetup = false;
+    private static File sGREDir = null;
 
     private static HashMap<String, ArrayList<GeckoEventListener>> mEventListeners;
 
@@ -141,13 +143,22 @@ public class GeckoAppShell
     public static native void loadSQLiteLibsNative(String apkName, boolean shouldExtract);
     public static native void onChangeNetworkLinkStatus(String status);
 
-    public static void reportJavaCrash(Throwable e) {
-        Log.e(LOGTAG, "top level exception", e);
+    public static void registerGlobalExceptionHandler() {
+        Thread.setDefaultUncaughtExceptionHandler(new Thread.UncaughtExceptionHandler() {
+            public void uncaughtException(Thread thread, Throwable e) {
+                Log.e(LOGTAG, ">>> REPORTING UNCAUGHT EXCEPTION FROM THREAD "
+                              + thread.getId() + " (\"" + thread.getName() + "\")", e);
+                reportJavaCrash(getStackTraceString(e));
+            }
+        });
+    }
+
+    private static String getStackTraceString(Throwable e) {
         StringWriter sw = new StringWriter();
         PrintWriter pw = new PrintWriter(sw);
         e.printStackTrace(pw);
         pw.flush();
-        reportJavaCrash(sw.toString());
+        return sw.toString();
     }
 
     private static native void reportJavaCrash(String stackTrace);
@@ -212,16 +223,16 @@ public class GeckoAppShell
         return GeckoBackgroundThread.getHandler();
     }
 
-    public static File getCacheDir() {
+    public static File getCacheDir(Context context) {
         if (sCacheFile == null)
-            sCacheFile = GeckoApp.mAppContext.getCacheDir();
+            sCacheFile = context.getCacheDir();
         return sCacheFile;
     }
 
-    public static long getFreeSpace() {
+    public static long getFreeSpace(Context context) {
         try {
             if (sFreeSpace == -1) {
-                File cacheDir = getCacheDir();
+                File cacheDir = getCacheDir(context);
                 if (cacheDir != null) {
                     StatFs cacheStats = new StatFs(cacheDir.getPath());
                     sFreeSpace = cacheStats.getFreeBlocks() *
@@ -236,17 +247,46 @@ public class GeckoAppShell
         return sFreeSpace;
     }
 
+    public static File getGREDir(Context context) {
+        if (sGREDir == null)
+            sGREDir = new File(context.getApplicationInfo().dataDir);
+        return sGREDir;
+    }
+
     // java-side stuff
-    public static boolean loadLibsSetup(String apkName) {
+    public static void loadLibsSetup(Context context) {
+        if (sLibsSetup)
+            return;
+
         // The package data lib directory isn't placed in ld.so's
         // search path, so we have to manually load libraries that
         // libxul will depend on.  Not ideal.
-        GeckoApp geckoApp = GeckoApp.mAppContext;
-        GeckoProfile profile = geckoApp.getProfile();
-        profile.moveProfilesToAppInstallLocation();
+        GeckoProfile profile = GeckoProfile.get(context);
 
+        File cacheFile = getCacheDir(context);
+        putenv("GRE_HOME=" + getGREDir(context).getPath());
+        File[] files = cacheFile.listFiles();
+        if (files != null) {
+            Iterator<File> cacheFiles = Arrays.asList(files).iterator();
+            while (cacheFiles.hasNext()) {
+                File libFile = cacheFiles.next();
+                if (libFile.getName().endsWith(".so"))
+                    libFile.delete();
+            }
+        }
+
+        // setup the libs cache
+        String linkerCache = System.getenv("MOZ_LINKER_CACHE");
+        if (System.getenv("MOZ_LINKER_CACHE") == null) {
+            GeckoAppShell.putenv("MOZ_LINKER_CACHE=" + cacheFile.getPath());
+        }
+        sLibsSetup = true;
+    }
+
+    private static void setupPluginEnvironment(GeckoApp context) {
+        // setup plugin path directories
         try {
-            String[] dirs = GeckoApp.mAppContext.getPluginDirectories();
+            String[] dirs = context.getPluginDirectories();
             StringBuffer pluginSearchPath = new StringBuffer();
             for (int i = 0; i < dirs.length; i++) {
                 Log.i(LOGTAG, "dir: " + dirs[i]);
@@ -254,49 +294,22 @@ public class GeckoAppShell
                 pluginSearchPath.append(":");
             }
             GeckoAppShell.putenv("MOZ_PLUGIN_PATH="+pluginSearchPath);
+
+            File pluginDataDir = context.getDir("plugins", 0);
+            GeckoAppShell.putenv("ANDROID_PLUGIN_DATADIR=" + pluginDataDir.getPath());
+
         } catch (Exception ex) {
             Log.i(LOGTAG, "exception getting plugin dirs", ex);
         }
+    }
 
-        GeckoAppShell.putenv("HOME=" + profile.getFilesDir().getPath());
-        GeckoAppShell.putenv("GRE_HOME=" + GeckoApp.sGREDir.getPath());
-        Intent i = geckoApp.getIntent();
-        String env = i.getStringExtra("env0");
-        Log.i(LOGTAG, "env0: "+ env);
-        for (int c = 1; env != null; c++) {
-            GeckoAppShell.putenv(env);
-            env = i.getStringExtra("env" + c);
-            Log.i(LOGTAG, "env"+ c +": "+ env);
-        }
-
-        File f = geckoApp.getDir("tmp", Context.MODE_WORLD_READABLE |
-                                 Context.MODE_WORLD_WRITEABLE );
-
-        if (!f.exists())
-            f.mkdirs();
-
-        GeckoAppShell.putenv("TMPDIR=" + f.getPath());
-
-        f = Environment.getDownloadCacheDirectory();
-        GeckoAppShell.putenv("EXTERNAL_STORAGE=" + f.getPath());
-
-        File cacheFile = getCacheDir();
-        String linkerCache = System.getenv("MOZ_LINKER_CACHE");
-        if (System.getenv("MOZ_LINKER_CACHE") == null) {
-            GeckoAppShell.putenv("MOZ_LINKER_CACHE=" + cacheFile.getPath());
-        }
-
-        File pluginDataDir = GeckoApp.mAppContext.getDir("plugins", 0);
-        GeckoAppShell.putenv("ANDROID_PLUGIN_DATADIR=" + pluginDataDir.getPath());
-
-        // gingerbread introduces File.getUsableSpace(). We should use that.
-        long freeSpace = getFreeSpace();
+    private static void setupDownloadEnvironment(GeckoApp context) {
         try {
             File downloadDir = null;
             File updatesDir  = null;
             if (Build.VERSION.SDK_INT >= 8) {
                 downloadDir = Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS);
-                updatesDir  = GeckoApp.mAppContext.getExternalFilesDir(Environment.DIRECTORY_DOWNLOADS);
+                updatesDir  = context.getExternalFilesDir(Environment.DIRECTORY_DOWNLOADS);
             } else {
                 updatesDir = downloadDir = new File(Environment.getExternalStorageDirectory().getPath(), "download");
             }
@@ -306,38 +319,63 @@ public class GeckoAppShell
         catch (Exception e) {
             Log.i(LOGTAG, "No download directory has been found: " + e);
         }
-
-        putLocaleEnv();
-
-        boolean extractLibs = GeckoApp.ACTION_DEBUG.equals(i.getAction());
-        if (!extractLibs) {
-            // remove any previously extracted libs
-            File[] files = cacheFile.listFiles();
-            if (files != null) {
-                Iterator<File> cacheFiles = Arrays.asList(files).iterator();
-                while (cacheFiles.hasNext()) {
-                    File libFile = cacheFiles.next();
-                    if (libFile.getName().endsWith(".so"))
-                        libFile.delete();
-                }
-            }
-        }
-        return extractLibs;
     }
 
-    public static void ensureSQLiteLibsLoaded(String apkName) {
+    public static void setupGeckoEnvironment(Context context) {
+        GeckoProfile profile = GeckoProfile.get(context);
+        profile.moveProfilesToAppInstallLocation();
+
+        setupPluginEnvironment((GeckoApp) context);
+        setupDownloadEnvironment((GeckoApp) context);
+
+        // profile home path
+        GeckoAppShell.putenv("HOME=" + profile.getFilesDir().getPath());
+
+        Intent i = null;
+        i = ((Activity)context).getIntent();
+
+        // if we have an intent (we're being launched by an activity)
+        // read in any environmental variables from it here
+        String env = i.getStringExtra("env0");
+        Log.i(LOGTAG, "env0: "+ env);
+        for (int c = 1; env != null; c++) {
+            GeckoAppShell.putenv(env);
+            env = i.getStringExtra("env" + c);
+            Log.i(LOGTAG, "env"+ c +": "+ env);
+        }
+        // setup the tmp path
+        File f = context.getDir("tmp", Context.MODE_WORLD_READABLE |
+                                 Context.MODE_WORLD_WRITEABLE );
+        if (!f.exists())
+            f.mkdirs();
+        GeckoAppShell.putenv("TMPDIR=" + f.getPath());
+
+        // setup the downloads path
+        f = Environment.getDownloadCacheDirectory();
+        GeckoAppShell.putenv("EXTERNAL_STORAGE=" + f.getPath());
+
+        putLocaleEnv();
+    }
+
+    public static void loadSQLiteLibs(Context context, String apkName) {
         if (sSQLiteLibsLoaded)
             return;
         synchronized(sSQLiteLibsLoaded) {
             if (sSQLiteLibsLoaded)
                 return;
-            loadSQLiteLibsNative(apkName, loadLibsSetup(apkName));
+            loadMozGlue();
+            // the extract libs parameter is being removed in bug 732069
+            loadSQLiteLibsNative(apkName, false);
             sSQLiteLibsLoaded = true;
         }
     }
 
+    public static void loadMozGlue() {
+        System.loadLibrary("mozglue");
+    }
+
     public static void loadGeckoLibs(String apkName) {
-        boolean extractLibs = loadLibsSetup(apkName);
+        loadLibsSetup(GeckoApp.mAppContext);
         loadGeckoLibsNative(apkName);
     }
 
@@ -1773,7 +1811,7 @@ public class GeckoAppShell
         return false;
     }
 
-    public static void emitGeckoAccessibilityEvent (int eventType, String role, String text, String description, boolean enabled, boolean checked, boolean password) {
+    public static void emitGeckoAccessibilityEvent (int eventType, String[] textList, String description, boolean enabled, boolean checked, boolean password) {
         AccessibilityManager accessibilityManager =
             (AccessibilityManager) GeckoApp.mAppContext.getSystemService(Context.ACCESSIBILITY_SERVICE);
 
@@ -1784,13 +1822,14 @@ public class GeckoAppShell
         LayerView layerView = layerController.getView();
 
         AccessibilityEvent event = AccessibilityEvent.obtain(eventType);
-        event.setClassName(layerView.getClass().getName() + "$" + role);
+        event.setClassName(layerView.getClass().getName());
         event.setPackageName(GeckoApp.mAppContext.getPackageName());
         event.setEnabled(enabled);
         event.setChecked(checked);
         event.setPassword(password);
         event.setContentDescription(description);
-        event.getText().add(text);
+        for (String text: textList)
+            event.getText().add(text);
 
         accessibilityManager.sendAccessibilityEvent(event);
     }
diff --git a/mobile/android/base/GeckoThread.java b/mobile/android/base/GeckoThread.java
index 3276ed219aa..2f339278703 100644
--- a/mobile/android/base/GeckoThread.java
+++ b/mobile/android/base/GeckoThread.java
@@ -66,7 +66,7 @@ public class GeckoThread extends Thread {
 
     public void run() {
         final GeckoApp app = GeckoApp.mAppContext;
-        File cacheFile = GeckoAppShell.getCacheDir();
+        File cacheFile = GeckoAppShell.getCacheDir(app);
         File libxulFile = new File(cacheFile, "libxul.so");
 
         if ((!libxulFile.exists() ||
@@ -86,9 +86,12 @@ public class GeckoThread extends Thread {
         // At some point while loading the gecko libs our default locale gets set
         // so just save it to locale here and reset it as default after the join
         Locale locale = Locale.getDefault();
+
         String resourcePath = app.getApplication().getPackageResourcePath();
-        GeckoAppShell.ensureSQLiteLibsLoaded(resourcePath);
+        GeckoAppShell.setupGeckoEnvironment(app);
+        GeckoAppShell.loadSQLiteLibs(app, resourcePath);
         GeckoAppShell.loadGeckoLibs(resourcePath);
+
         Locale.setDefault(locale);
         Resources res = app.getBaseContext().getResources();
         Configuration config = res.getConfiguration();
@@ -98,15 +101,10 @@ public class GeckoThread extends Thread {
         Log.w(LOGTAG, "zerdatime " + SystemClock.uptimeMillis() + " - runGecko");
 
         // and then fire us up
-        try {
-            Log.w(LOGTAG, "RunGecko - URI = " + mUri);
-
-            GeckoAppShell.runGecko(app.getApplication().getPackageResourcePath(),
-                                   mIntent.getStringExtra("args"),
-                                   mUri,
-                                   mRestoreSession);
-        } catch (Exception e) {
-            GeckoAppShell.reportJavaCrash(e);
-        }
+        Log.w(LOGTAG, "RunGecko - URI = " + mUri);
+        GeckoAppShell.runGecko(app.getApplication().getPackageResourcePath(),
+                               mIntent.getStringExtra("args"),
+                               mUri,
+                               mRestoreSession);
     }
 }
diff --git a/mobile/android/base/ProfileMigrator.java b/mobile/android/base/ProfileMigrator.java
index 7c956d47e8c..2c0544ba95c 100644
--- a/mobile/android/base/ProfileMigrator.java
+++ b/mobile/android/base/ProfileMigrator.java
@@ -640,7 +640,7 @@ public class ProfileMigrator {
             File dbFileShm = new File(dbPathShm);
 
             SQLiteBridge db = null;
-            GeckoAppShell.ensureSQLiteLibsLoaded(GeckoApp.mAppContext.getApplication().getPackageResourcePath());
+            GeckoAppShell.loadSQLiteLibs(GeckoApp.mAppContext, GeckoApp.mAppContext.getApplication().getPackageResourcePath());
             try {
                 db = new SQLiteBridge(dbPath);
                 calculateReroot(db);
@@ -664,7 +664,7 @@ public class ProfileMigrator {
         }
 
         protected void cleanupXULLibCache() {
-            File cacheFile = GeckoAppShell.getCacheDir();
+            File cacheFile = GeckoAppShell.getCacheDir(GeckoApp.mAppContext);
             File[] files = cacheFile.listFiles();
             if (files != null) {
                 Iterator<File> cacheFiles = Arrays.asList(files).iterator();
diff --git a/mobile/android/base/Tab.java b/mobile/android/base/Tab.java
index 0386316ab45..26795b293f4 100644
--- a/mobile/android/base/Tab.java
+++ b/mobile/android/base/Tab.java
@@ -78,7 +78,6 @@ public final class Tab {
     private int mHistoryIndex;
     private int mParentId;
     private boolean mExternal;
-    private boolean mLoading;
     private boolean mBookmark;
     private HashMap<String, DoorHanger> mDoorHangers;
     private long mFaviconLoadId;
@@ -88,9 +87,14 @@ public final class Tab {
     private boolean mHasTouchListeners;
     private ArrayList<View> mPluginViews;
     private HashMap<Surface, Layer> mPluginLayers;
-    private boolean mHasLoaded;
     private ContentResolver mContentResolver;
     private ContentObserver mContentObserver;
+    private int mState;
+
+    public static final int STATE_DELAYED = 0;
+    public static final int STATE_LOADING = 1;
+    public static final int STATE_SUCCESS = 2;
+    public static final int STATE_ERROR = 3;
 
     public static final class HistoryEntry {
         public String mUri;         // must never be null
@@ -121,7 +125,7 @@ public final class Tab {
         mContentType = "";
         mPluginViews = new ArrayList<View>();
         mPluginLayers = new HashMap<Surface, Layer>();
-        mHasLoaded = false;
+        mState = STATE_LOADING;
         mContentResolver = Tabs.getInstance().getContentResolver();
         mContentObserver = new ContentObserver(GeckoAppShell.getHandler()) {
             public void onChange(boolean selfChange) {
@@ -232,7 +236,9 @@ public final class Tab {
                                                           b.getHeight());
 
                         Bitmap bitmap = Bitmap.createScaledBitmap(cropped, getThumbnailWidth(), getThumbnailHeight(), false);
-                        saveThumbnailToDB(new BitmapDrawable(bitmap));
+
+                        if (mState == Tab.STATE_SUCCESS)
+                            saveThumbnailToDB(new BitmapDrawable(bitmap));
 
                         if (!cropped.equals(b))
                             b.recycle();
@@ -262,10 +268,6 @@ public final class Tab {
         return mSecurityMode;
     }
 
-    public boolean isLoading() {
-        return mLoading;
-    }
-
     public boolean isBookmark() {
         return mBookmark;
     }
@@ -321,8 +323,12 @@ public final class Tab {
         }
     }
 
-    public void setLoading(boolean loading) {
-        mLoading = loading;
+    public void setState(int state) {
+        mState = state;
+    }
+
+    public int getState() {
+        return mState;
     }
 
     public void setHasTouchListeners(boolean aValue) {
@@ -467,14 +473,6 @@ public final class Tab {
         return mDoorHangers;
     }
 
-    public void setHasLoaded(boolean hasLoaded) {
-        mHasLoaded = hasLoaded;
-    }
-
-    public boolean hasLoaded() {
-        return mHasLoaded;
-    }
-
     void handleSessionHistoryMessage(String event, JSONObject message) throws JSONException {
         if (event.equals("New")) {
             final String uri = message.getString("uri");
diff --git a/mobile/android/base/Tabs.java b/mobile/android/base/Tabs.java
index 1626b59dcd7..43a52ddae74 100644
--- a/mobile/android/base/Tabs.java
+++ b/mobile/android/base/Tabs.java
@@ -136,7 +136,7 @@ public class Tabs implements GeckoEventListener {
                     GeckoApp.mBrowserToolbar.setTitle(tab.getDisplayTitle());
                     GeckoApp.mBrowserToolbar.setFavicon(tab.getFavicon());
                     GeckoApp.mBrowserToolbar.setSecurityMode(tab.getSecurityMode());
-                    GeckoApp.mBrowserToolbar.setProgressVisibility(tab.isLoading());
+                    GeckoApp.mBrowserToolbar.setProgressVisibility(tab.getState() == Tab.STATE_LOADING);
                     GeckoApp.mDoorHangerPopup.updatePopup();
                     GeckoApp.mBrowserToolbar.setShadowVisibility((url == null) || !url.startsWith("about:"));
                     notifyListeners(tab, TabEvents.SELECTED);
@@ -283,7 +283,7 @@ public class Tabs implements GeckoEventListener {
                 if (message.getBoolean("selected"))
                     selectTab(tab.getId());
                 if (message.getBoolean("delayLoad"))
-                    tab.setHasLoaded(false);
+                    tab.setState(Tab.STATE_DELAYED);
             } else if (event.equals("Tab:Close")) {
                 Tab tab = getTab(message.getInt("tabID"));
                 closeTab(tab);
diff --git a/mobile/android/base/db/GeckoProvider.java.in b/mobile/android/base/db/GeckoProvider.java.in
index 4cbb30cdf2f..6944efc18ff 100644
--- a/mobile/android/base/db/GeckoProvider.java.in
+++ b/mobile/android/base/db/GeckoProvider.java.in
@@ -88,6 +88,8 @@ public abstract class GeckoProvider extends ContentProvider {
 
         boolean dbNeedsSetup = true;
         try {
+            String resourcePath = context.getPackageResourcePath();
+            GeckoAppShell.loadSQLiteLibs(context, resourcePath);
             bridge = new SQLiteBridge(databasePath);
             int version = bridge.getVersion();
             Log.i(mLogTag, version + " == " + mDBVersion);
diff --git a/mobile/android/base/db/LocalBrowserDB.java b/mobile/android/base/db/LocalBrowserDB.java
index 8eeed44d3c9..ff734c51e0a 100644
--- a/mobile/android/base/db/LocalBrowserDB.java
+++ b/mobile/android/base/db/LocalBrowserDB.java
@@ -89,6 +89,7 @@ public class LocalBrowserDB implements BrowserDB.BrowserDBIface {
 
     private static final String[] DEFAULT_BOOKMARK_COLUMNS =
             new String[] { Bookmarks._ID,
+                           Bookmarks.GUID,
                            Bookmarks.URL,
                            Bookmarks.TITLE,
                            Bookmarks.IS_FOLDER,
diff --git a/mobile/android/base/gfx/ViewportMetrics.java b/mobile/android/base/gfx/ViewportMetrics.java
index 5afd9df5e48..eee9ead3df9 100644
--- a/mobile/android/base/gfx/ViewportMetrics.java
+++ b/mobile/android/base/gfx/ViewportMetrics.java
@@ -64,6 +64,7 @@ public class ViewportMetrics {
     private RectF mViewportRect;
     private PointF mViewportOffset;
     private float mZoomFactor;
+    private boolean mAllowZoom;
 
     // A scale from -1,-1 to 1,1 that represents what edge of the displayport
     // we want the viewport to be biased towards.
@@ -79,6 +80,7 @@ public class ViewportMetrics {
         mViewportOffset = new PointF(0, 0);
         mZoomFactor = 1.0f;
         mViewportBias = new PointF(0.0f, 0.0f);
+        mAllowZoom = true;
     }
 
     public ViewportMetrics(ViewportMetrics viewport) {
@@ -88,6 +90,7 @@ public class ViewportMetrics {
         mViewportOffset = new PointF(offset.x, offset.y);
         mZoomFactor = viewport.getZoomFactor();
         mViewportBias = viewport.mViewportBias;
+        mAllowZoom = viewport.mAllowZoom;
     }
 
     public ViewportMetrics(JSONObject json) throws JSONException {
@@ -101,6 +104,8 @@ public class ViewportMetrics {
         float offsetY = (float)json.getDouble("offsetY");
         float zoom = (float)json.getDouble("zoom");
 
+        mAllowZoom = json.getBoolean("allowZoom");
+
         mPageSize = new FloatSize(pageWidth, pageHeight);
         mViewportRect = new RectF(x, y, x + width, y + height);
         mViewportOffset = new PointF(offsetX, offsetY);
@@ -186,6 +191,10 @@ public class ViewportMetrics {
         return mZoomFactor;
     }
 
+    public boolean getAllowZoom() {
+        return mAllowZoom;
+    }
+
     public void setPageSize(FloatSize pageSize) {
         mPageSize = pageSize;
     }
diff --git a/mobile/android/base/resources/layout/awesomebar_search.xml b/mobile/android/base/resources/layout/awesomebar_search.xml
index d66e21e24f6..38ca20d3f40 100644
--- a/mobile/android/base/resources/layout/awesomebar_search.xml
+++ b/mobile/android/base/resources/layout/awesomebar_search.xml
@@ -14,6 +14,7 @@
           android:hint="@string/awesomebar_default_text"
           android:inputType="textUri|textNoSuggestions"
           android:imeOptions="actionSearch"
+          android:selectAllOnFocus="true"
           android:singleLine="true"
           android:gravity="center_vertical|left">
               <requestFocus/>
diff --git a/mobile/android/base/sync/CollectionKeys.java b/mobile/android/base/sync/CollectionKeys.java
index 8a8f0903c9f..f3a7a77f602 100644
--- a/mobile/android/base/sync/CollectionKeys.java
+++ b/mobile/android/base/sync/CollectionKeys.java
@@ -42,7 +42,6 @@ import java.io.UnsupportedEncodingException;
 import java.util.HashMap;
 import java.util.Map.Entry;
 
-import org.json.JSONException;
 import org.json.simple.JSONArray;
 import org.json.simple.parser.ParseException;
 import org.mozilla.apache.commons.codec.binary.Base64;
@@ -101,11 +100,6 @@ public class CollectionKeys {
   /**
    * Take a pair of values in a JSON array, handing them off to KeyBundle to
    * produce a usable keypair.
-   *
-   * @param array
-   * @return
-   * @throws JSONException
-   * @throws UnsupportedEncodingException
    */
   private static KeyBundle arrayToKeyBundle(JSONArray array) throws UnsupportedEncodingException {
     String encKeyStr  = (String) array.get(0);
@@ -168,14 +162,6 @@ public class CollectionKeys {
   /**
    * Take a downloaded record, and the Sync Key, decrypting the record and
    * setting our own keys accordingly.
-   *
-   * @param keys
-   * @param syncKeyBundle
-   * @throws CryptoException
-   * @throws IOException
-   * @throws ParseException
-   * @throws NonObjectJSONException
-   * @throws JSONException
    */
   public void setKeyPairsFromWBO(CryptoRecord keys, KeyBundle syncKeyBundle)
                                                                             throws CryptoException,
diff --git a/mobile/android/base/sync/HTTPFailureException.java b/mobile/android/base/sync/HTTPFailureException.java
index cb7e5845c15..6fbb2a300e1 100644
--- a/mobile/android/base/sync/HTTPFailureException.java
+++ b/mobile/android/base/sync/HTTPFailureException.java
@@ -51,11 +51,12 @@ public class HTTPFailureException extends SyncException {
 
   @Override
   public String toString() {
-    String errorMessage = "[unknown error message]";
+    String errorMessage;
     try {
       errorMessage = this.response.getErrorMessage();
     } catch (Exception e) {
       // Oh well.
+      errorMessage = "[unknown error message]";
     }
     return "<HTTPFailureException " + this.response.getStatusCode() +
            " :: (" + errorMessage + ")>";
diff --git a/mobile/android/base/sync/SyncConfiguration.java b/mobile/android/base/sync/SyncConfiguration.java
index b0019136965..145ae1a5865 100644
--- a/mobile/android/base/sync/SyncConfiguration.java
+++ b/mobile/android/base/sync/SyncConfiguration.java
@@ -193,9 +193,6 @@ public class SyncConfiguration implements CredentialsSource {
   /**
    * Create a new SyncConfiguration instance. Pass in a PrefsSource to
    * provide access to preferences.
-   *
-   * @param prefsPath
-   * @param prefsSource
    */
   public SyncConfiguration(String prefsPath, PrefsSource prefsSource) {
     this.prefsPath   = prefsPath;
@@ -210,7 +207,6 @@ public class SyncConfiguration implements CredentialsSource {
 
   /**
    * Return a convenient accessor for part of prefs.
-   * @param prefix
    * @return
    *        A ConfigurationBranch object representing this
    *        section of the preferences space.
diff --git a/mobile/android/base/sync/Utils.java b/mobile/android/base/sync/Utils.java
index 66e3c4bba1f..d4d16b88bb2 100644
--- a/mobile/android/base/sync/Utils.java
+++ b/mobile/android/base/sync/Utils.java
@@ -69,10 +69,11 @@ public class Utils {
     return new String(encodedBytes).replace("+", "-").replace("/", "_");
   }
 
-  /*
+  /**
    * Helper to generate secure random bytes.
    *
-   * @param length Number of bytes to generate.
+   * @param length
+   *        Number of bytes to generate.
    */
   public static byte[] generateRandomBytes(int length) {
     byte[] bytes = new byte[length];
@@ -80,10 +81,11 @@ public class Utils {
     return bytes;
   }
 
-  /*
+  /**
    * Helper to generate a random integer in a specified range.
    *
-   * @param r Generate an integer between 0 and r-1 inclusive.
+   * @param r
+   *        Generate an integer between 0 and r-1 inclusive.
    */
   public static BigInteger generateBigIntegerLessThan(BigInteger r) {
     int maxBytes = (int) Math.ceil(((double) r.bitLength()) / 8);
@@ -91,17 +93,15 @@ public class Utils {
     return randInt.mod(r);
   }
 
-  /*
+  /**
    * Helper to reseed the shared secure random number generator.
    */
   public static void reseedSharedRandom() {
     sharedSecureRandom.setSeed(sharedSecureRandom.generateSeed(8));
   }
 
-  /*
-   * Helper to convert Byte Array to a Hex String
-   * Input: byte[] array
-   * Output: Hex string
+  /**
+   * Helper to convert a byte array to a hex-encoded string
    */
   public static String byte2hex(byte[] b) {
     // StringBuffer should be used instead.
@@ -125,11 +125,6 @@ public class Utils {
     return hs;
   }
 
-  /*
-   * Helper for array concatenation.
-   * Input: At least two byte[]
-   * Output: A concatenated version of them
-   */
   public static byte[] concatAll(byte[] first, byte[]... rest) {
     int totalLength = first.length;
     for (byte[] array : rest) {
@@ -163,20 +158,12 @@ public class Utils {
     return Base64.decodeBase64(base64.getBytes("UTF-8"));
   }
 
-  /*
-   * Decode a friendly base32 string.
-   */
   public static byte[] decodeFriendlyBase32(String base32) {
     Base32 converter = new Base32();
     final String translated = base32.replace('8', 'l').replace('9', 'o');
     return converter.decode(translated.toUpperCase());
   }
 
-  /*
-   * Helper to convert Hex String to Byte Array
-   * Input: Hex string
-   * Output: byte[] version of hex string
-   */
   public static byte[] hex2Byte(String str) {
     if (str.length() % 2 == 1) {
       str = "0" + str;
@@ -247,10 +234,6 @@ public class Utils {
 
   /**
    * Yes, an equality method that's null-safe.
-   *
-   * @param a
-   * @param b
-   * @return
    */
   private static boolean same(Object a, Object b) {
     if (a == b) {
@@ -265,10 +248,6 @@ public class Utils {
   /**
    * Return true if the two arrays are both null, or are both arrays
    * containing the same elements in the same order.
-   *
-   * @param a
-   * @param b
-   * @return
    */
   public static boolean sameArrays(JSONArray a, JSONArray b) {
     if (a == b) {
diff --git a/mobile/android/base/sync/crypto/KeyBundle.java b/mobile/android/base/sync/crypto/KeyBundle.java
index ce149993a3f..c05fa787029 100644
--- a/mobile/android/base/sync/crypto/KeyBundle.java
+++ b/mobile/android/base/sync/crypto/KeyBundle.java
@@ -46,7 +46,6 @@ import javax.crypto.Mac;
 
 import org.mozilla.apache.commons.codec.binary.Base64;
 import org.mozilla.gecko.sync.Utils;
-import org.mozilla.gecko.sync.crypto.CryptoException;
 import java.security.InvalidKeyException;
 import java.util.Locale;
 
diff --git a/mobile/android/base/sync/jpake/JPakeCrypto.java b/mobile/android/base/sync/jpake/JPakeCrypto.java
index d3f5104b71e..2c4bb6bc4cd 100644
--- a/mobile/android/base/sync/jpake/JPakeCrypto.java
+++ b/mobile/android/base/sync/jpake/JPakeCrypto.java
@@ -98,10 +98,6 @@ public class JPakeCrypto {
    *
    * Round 1 of J-PAKE protocol.
    * Generate x1, x2, and ZKP for other party.
-   *
-   * @param mySignerId
-   * @param valuesOut
-   * @throws NoSuchAlgorithmException 
    */
   public static void round1(JPakeParty jp, JPakeNumGenerator gen) throws NoSuchAlgorithmException, UnsupportedEncodingException {
     // Randomly select x1 from [0,q), x2 from [1,q).
@@ -124,16 +120,6 @@ public class JPakeCrypto {
    * Round 2 of J-PAKE protocol.
    * Generate A and ZKP for A.
    * Verify ZKP from other party. Does not check for replay ZKP.
-   *
-   * @param mySignerId
-   * @param valuesOut
-   * @param secret
-   * @param gx3
-   * @param gx4
-   * @param zkp3
-   * @param zkp4
-   * @throws IncorrectZkpException
-   * @throws NoSuchAlgorithmException
    */
   public static void round2(BigInteger secretValue, JPakeParty jp, JPakeNumGenerator gen)
       throws IncorrectZkpException, NoSuchAlgorithmException,
@@ -164,13 +150,6 @@ public class JPakeCrypto {
 
   /**
    * Final round of J-PAKE protocol.
-   *
-   * @param b
-   * @param zkp
-   * @param secret
-   *
-   * @return KeyBundle
-   * @throws IncorrectZkpException
    */
   public static KeyBundle finalRound(BigInteger secretValue, JPakeParty jp)
       throws IncorrectZkpException, NoSuchAlgorithmException, InvalidKeyException, UnsupportedEncodingException {
diff --git a/mobile/android/base/sync/jpake/stage/GetChannelStage.java b/mobile/android/base/sync/jpake/stage/GetChannelStage.java
index 7efd92dd370..5ac2ccfed72 100644
--- a/mobile/android/base/sync/jpake/stage/GetChannelStage.java
+++ b/mobile/android/base/sync/jpake/stage/GetChannelStage.java
@@ -54,14 +54,12 @@ public class GetChannelStage extends JPakeStage {
       public void handleFailure(String error) {
         Logger.error(LOG_TAG, "Got HTTP failure: " + error);
         jClient.abort(error);
-        return;
       }
 
       @Override
       public void handleError(Exception e) {
         Logger.error(LOG_TAG, "Threw HTTP exception.", e);
         jClient.abort(Constants.JPAKE_ERROR_CHANNEL);
-        return;
       }
     };
 
diff --git a/mobile/android/base/sync/jpake/stage/GetRequestStage.java b/mobile/android/base/sync/jpake/stage/GetRequestStage.java
index d697e6e624b..c571e157a78 100644
--- a/mobile/android/base/sync/jpake/stage/GetRequestStage.java
+++ b/mobile/android/base/sync/jpake/stage/GetRequestStage.java
@@ -75,14 +75,12 @@ public class GetRequestStage extends JPakeStage {
       public void handleFailure(String error) {
         Logger.error(LOG_TAG, "Got HTTP failure: " + error);
         jClient.abort(error);
-        return;
       }
 
       @Override
       public void handleError(Exception e) {
         Logger.error(LOG_TAG, "Threw HTTP exception.", e);
         jClient.abort(Constants.JPAKE_ERROR_NETWORK);
-        return;
       }
     };
 
diff --git a/mobile/android/base/sync/jpake/stage/PutRequestStage.java b/mobile/android/base/sync/jpake/stage/PutRequestStage.java
index bdf0c2e7fa6..6264906f857 100644
--- a/mobile/android/base/sync/jpake/stage/PutRequestStage.java
+++ b/mobile/android/base/sync/jpake/stage/PutRequestStage.java
@@ -60,14 +60,12 @@ public class PutRequestStage extends JPakeStage {
       public void handleFailure(String error) {
         Logger.error(LOG_TAG, "Got HTTP failure: " + error);
         jClient.abort(error);
-        return;
       }
 
       @Override
       public void handleError(Exception e) {
         Logger.error(LOG_TAG, "HTTP exception.", e);
         jClient.abort(Constants.JPAKE_ERROR_NETWORK);
-        return;
       }
     };
 
diff --git a/mobile/android/base/sync/net/BaseResource.java b/mobile/android/base/sync/net/BaseResource.java
index 999094df150..53884ec4aa0 100644
--- a/mobile/android/base/sync/net/BaseResource.java
+++ b/mobile/android/base/sync/net/BaseResource.java
@@ -82,6 +82,8 @@ import ch.boye.httpclientandroidlib.protocol.HttpContext;
  * Exposes simple get/post/put/delete methods.
  */
 public class BaseResource implements Resource {
+  private static final String ANDROID_LOOPBACK_IP = "10.0.2.2";
+
   public static boolean rewriteLocalhost = true;
 
   private static final String LOG_TAG = "BaseResource";
@@ -107,9 +109,9 @@ public class BaseResource implements Resource {
   public BaseResource(URI uri, boolean rewrite) {
     if (rewrite && uri.getHost().equals("localhost")) {
       // Rewrite localhost URIs to refer to the special Android emulator loopback passthrough interface.
-      Log.d(LOG_TAG, "Rewriting " + uri + " to point to 10.0.2.2.");
+      Log.d(LOG_TAG, "Rewriting " + uri + " to point to " + ANDROID_LOOPBACK_IP + ".");
       try {
-        this.uri = new URI(uri.getScheme(), uri.getUserInfo(), "10.0.2.2", uri.getPort(), uri.getPath(), uri.getQuery(), uri.getFragment());
+        this.uri = new URI(uri.getScheme(), uri.getUserInfo(), ANDROID_LOOPBACK_IP, uri.getPort(), uri.getPath(), uri.getQuery(), uri.getFragment());
       } catch (URISyntaxException e) {
         Log.e(LOG_TAG, "Got error rewriting URI for Android emulator.", e);
       }
@@ -167,7 +169,6 @@ public class BaseResource implements Resource {
 
   /**
    * This method exists for test code.
-   * @return
    */
   public static ClientConnectionManager enablePlainHTTPConnectionManager() {
     synchronized (connManagerMonitor) {
diff --git a/mobile/android/base/sync/net/SyncResponse.java b/mobile/android/base/sync/net/SyncResponse.java
index 5a6a8ea2ffa..4d7bb197675 100644
--- a/mobile/android/base/sync/net/SyncResponse.java
+++ b/mobile/android/base/sync/net/SyncResponse.java
@@ -148,9 +148,9 @@ public class SyncResponse {
   }
 
   /**
-   * @return A number of seconds, or -1 if the header was not present.
+   * @return A number of seconds, or -1 if the 'Retry-After' header was not present.
    */
-  public int retryAfter() throws NumberFormatException {
+  public int retryAfterInSeconds() throws NumberFormatException {
     if (!this.hasHeader(HEADER_RETRY_AFTER)) {
       return -1;
     }
@@ -178,10 +178,39 @@ public class SyncResponse {
     }
   }
 
-  public int weaveBackoff() throws NumberFormatException {
+  /**
+   * @return A number of seconds, or -1 if the 'X-Weave-Backoff' header was not
+   *         present.
+   */
+  public int weaveBackoffInSeconds() throws NumberFormatException {
     return this.getIntegerHeader("x-weave-backoff");
   }
 
+  /**
+   * @return A number of milliseconds, or -1 if neither the 'Retry-After' or
+   *         'X-Weave-Backoff' header was present.
+   */
+  public int totalBackoffInMilliseconds() {
+    int retryAfterInSeconds = -1;
+    try {
+      retryAfterInSeconds = retryAfterInSeconds();
+    } catch (NumberFormatException e) {
+    }
+
+    int weaveBackoffInSeconds = -1;
+    try {
+      weaveBackoffInSeconds = weaveBackoffInSeconds();
+    } catch (NumberFormatException e) {
+    }
+
+    int totalBackoff = Math.max(retryAfterInSeconds, weaveBackoffInSeconds);
+    if (totalBackoff < 0) {
+      return -1;
+    } else {
+      return 1000 * totalBackoff;
+    }
+  }
+
   /**
    * The timestamp returned from a Sync server is a decimal number of seconds,
    * e.g., 1323393518.04.
diff --git a/mobile/android/base/sync/net/SyncStorageRecordRequest.java b/mobile/android/base/sync/net/SyncStorageRecordRequest.java
index bb303249e20..5987ee46aaf 100644
--- a/mobile/android/base/sync/net/SyncStorageRecordRequest.java
+++ b/mobile/android/base/sync/net/SyncStorageRecordRequest.java
@@ -90,8 +90,6 @@ public class SyncStorageRecordRequest extends SyncStorageRequest {
 
   /**
    * Helper for turning a JSON object into a payload.
-   * @param body
-   * @return
    * @throws UnsupportedEncodingException
    */
   protected StringEntity jsonEntity(JSONObject body) throws UnsupportedEncodingException {
diff --git a/mobile/android/base/sync/repositories/RepositorySession.java b/mobile/android/base/sync/repositories/RepositorySession.java
index 443b763c029..205735b2689 100644
--- a/mobile/android/base/sync/repositories/RepositorySession.java
+++ b/mobile/android/base/sync/repositories/RepositorySession.java
@@ -209,9 +209,6 @@ public abstract class RepositorySession {
    *
    * The Synchronizer most likely wants to bump the bundle timestamp to be a value
    * return from a fetch call.
-   *
-   * @param optional
-   * @return
    */
   protected RepositorySessionBundle getBundle(RepositorySessionBundle optional) {
     Logger.debug(LOG_TAG, "RepositorySession.getBundle(optional).");
@@ -225,8 +222,6 @@ public abstract class RepositorySession {
   /**
    * Just like finish(), but doesn't do any work that should only be performed
    * at the end of a successful sync, and can be called any time.
-   *
-   * @param delegate
    */
   public void abort(RepositorySessionFinishDelegate delegate) {
     this.abort();
@@ -267,9 +262,6 @@ public abstract class RepositorySession {
   /**
    * Run the provided command if we're active and our delegate queue
    * is not shut down.
-   *
-   * @param command
-   * @throws InactiveSessionException
    */
   protected synchronized void executeDelegateCommand(Runnable command)
       throws InactiveSessionException {
@@ -389,8 +381,6 @@ public abstract class RepositorySession {
    * redundantly.
    *
    * The default implementation does nothing.
-   *
-   * @param record
    */
   protected synchronized void trackRecord(Record record) {
   }
diff --git a/mobile/android/base/sync/repositories/android/AndroidBrowserBookmarksDataAccessor.java b/mobile/android/base/sync/repositories/android/AndroidBrowserBookmarksDataAccessor.java
index 35c21e4518d..e9b623ab1bb 100644
--- a/mobile/android/base/sync/repositories/android/AndroidBrowserBookmarksDataAccessor.java
+++ b/mobile/android/base/sync/repositories/android/AndroidBrowserBookmarksDataAccessor.java
@@ -100,10 +100,6 @@ public class AndroidBrowserBookmarksDataAccessor extends AndroidBrowserRepositor
 
   /**
    * Bump the modified time of a record by ID.
-   *
-   * @param id
-   * @param modified
-   * @return
    */
   public int bumpModified(long id, long modified) {
     Logger.debug(LOG_TAG, "Bumping modified for " + id + " to " + modified);
diff --git a/mobile/android/base/sync/repositories/android/AndroidBrowserBookmarksRepositorySession.java b/mobile/android/base/sync/repositories/android/AndroidBrowserBookmarksRepositorySession.java
index 8f0044c04e9..3fa15fbe581 100644
--- a/mobile/android/base/sync/repositories/android/AndroidBrowserBookmarksRepositorySession.java
+++ b/mobile/android/base/sync/repositories/android/AndroidBrowserBookmarksRepositorySession.java
@@ -172,9 +172,6 @@ public class AndroidBrowserBookmarksRepositorySession extends AndroidBrowserRepo
   /**
    * Return true if the provided record GUID should be skipped
    * in child lists or fetch results.
-   *
-   * @param recordGUID
-   * @return
    */
   public static boolean forbiddenGUID(String recordGUID) {
     return recordGUID == null ||
diff --git a/mobile/android/base/sync/repositories/android/AndroidBrowserRepositorySession.java b/mobile/android/base/sync/repositories/android/AndroidBrowserRepositorySession.java
index 37beaa02972..8505f423b75 100644
--- a/mobile/android/base/sync/repositories/android/AndroidBrowserRepositorySession.java
+++ b/mobile/android/base/sync/repositories/android/AndroidBrowserRepositorySession.java
@@ -101,8 +101,6 @@ public abstract class AndroidBrowserRepositorySession extends StoreTrackingRepos
    *
    * Return null if this record should not be processed.
    *
-   * @param cur
-   * @return
    * @throws NoGuidForIdException
    * @throws NullCursorException
    * @throws ParentNotFoundException
@@ -114,8 +112,6 @@ public abstract class AndroidBrowserRepositorySession extends StoreTrackingRepos
    * updated to match the record that we're constructing: for example, the children
    * of a folder might be repositioned as we generate the folder's record.
    *
-   * @param cur
-   * @return
    * @throws NoGuidForIdException
    * @throws NullCursorException
    * @throws ParentNotFoundException
@@ -555,8 +551,6 @@ public abstract class AndroidBrowserRepositorySession extends StoreTrackingRepos
    * Retrieve a record from the store by GUID, without writing unnecessarily to the
    * database.
    *
-   * @param guid
-   * @return
    * @throws NoGuidForIdException
    * @throws NullCursorException
    * @throws ParentNotFoundException
diff --git a/mobile/android/base/sync/repositories/android/ClientsDatabaseAccessor.java b/mobile/android/base/sync/repositories/android/ClientsDatabaseAccessor.java
index d1346a81ff8..102a2fec3eb 100644
--- a/mobile/android/base/sync/repositories/android/ClientsDatabaseAccessor.java
+++ b/mobile/android/base/sync/repositories/android/ClientsDatabaseAccessor.java
@@ -88,11 +88,17 @@ public class ClientsDatabaseAccessor {
   }
 
   public int clientsCount() {
+    Cursor cur;
     try {
-      return db.fetchAll().getCount();
+      cur = db.fetchAll();
     } catch (NullCursorException e) {
       return 0;
     }
+    try {
+      return cur.getCount();
+    } finally {
+      cur.close();
+    }
   }
 
   private String getProfileId() {
diff --git a/mobile/android/base/sync/repositories/delegates/RepositorySessionFetchRecordsDelegate.java b/mobile/android/base/sync/repositories/delegates/RepositorySessionFetchRecordsDelegate.java
index 5983f13d279..a27f5a2d4bc 100644
--- a/mobile/android/base/sync/repositories/delegates/RepositorySessionFetchRecordsDelegate.java
+++ b/mobile/android/base/sync/repositories/delegates/RepositorySessionFetchRecordsDelegate.java
@@ -1,40 +1,6 @@
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Android Sync Client.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2011
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- * Jason Voll <jvoll@mozilla.com>
- * Richard Newman <rnewman@mozilla.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 package org.mozilla.gecko.sync.repositories.delegates;
 
@@ -49,7 +15,7 @@ public interface RepositorySessionFetchRecordsDelegate {
   /**
    * Called when all records in this fetch have been returned.
    *
-   * @param end
+   * @param fetchEnd
    *        A millisecond-resolution timestamp indicating the *remote* timestamp
    *        at the end of the range of records. Usually this is the timestamp at
    *        which the request was received.
@@ -57,8 +23,19 @@ public interface RepositorySessionFetchRecordsDelegate {
    */
   public void onFetchCompleted(final long fetchEnd);
 
-  // Shorthand for calling onFetchedRecord for each record in turn, then
-  // calling onFetchCompleted.
+  /**
+   * Shorthand for calling onFetchedRecord for each record in turn, then
+   * calling onFetchCompleted.
+   *
+   * @param records
+   *        An array of fetched records. Can be empty.
+   *
+   * @param fetchEnd
+   *        A millisecond-resolution timestamp indicating the *remote* timestamp
+   *        at the end of the range of records. Usually this is the timestamp at
+   *        which the request was received.
+   *        E.g., the (normalized) value of the X-Weave-Timestamp header.
+   */
   public void onFetchSucceeded(Record[] records, final long fetchEnd);
 
   public RepositorySessionFetchRecordsDelegate deferredFetchDelegate(ExecutorService executor);
diff --git a/mobile/android/base/sync/repositories/domain/Record.java b/mobile/android/base/sync/repositories/domain/Record.java
index 4ce59b4b6c1..c0eae5ab7fc 100644
--- a/mobile/android/base/sync/repositories/domain/Record.java
+++ b/mobile/android/base/sync/repositories/domain/Record.java
@@ -118,9 +118,6 @@ public abstract class Record {
   /**
    * Return true iff the input is a Record and has the same
    * collection and guid as this object.
-   *
-   * @param o
-   * @return
    */
   public boolean equalIdentifiers(Object o) {
     if (o == null || !(o instanceof Record)) {
diff --git a/mobile/android/base/sync/repositories/domain/TabsRecord.java b/mobile/android/base/sync/repositories/domain/TabsRecord.java
index 4b9b7c47410..e2726da1958 100644
--- a/mobile/android/base/sync/repositories/domain/TabsRecord.java
+++ b/mobile/android/base/sync/repositories/domain/TabsRecord.java
@@ -12,7 +12,6 @@ import org.mozilla.gecko.sync.ExtendedJSONObject;
 import org.mozilla.gecko.sync.Logger;
 import org.mozilla.gecko.sync.NonArrayJSONException;
 import org.mozilla.gecko.sync.Utils;
-import org.mozilla.gecko.sync.repositories.domain.Record;
 
 /**
  * Represents a client's collection of tabs.
diff --git a/mobile/android/base/sync/setup/activities/AccountActivity.java b/mobile/android/base/sync/setup/activities/AccountActivity.java
index 03c749f4ac4..9809683095e 100644
--- a/mobile/android/base/sync/setup/activities/AccountActivity.java
+++ b/mobile/android/base/sync/setup/activities/AccountActivity.java
@@ -213,11 +213,25 @@ public class AccountActivity extends AccountAuthenticatorActivity {
       userbundle.putString(Constants.OPTION_SERVER, DEFAULT_SERVER);
     }
     Log.d(LOG_TAG, "Adding account for " + Constants.ACCOUNTTYPE_SYNC);
-    boolean result = accountManager.addAccountExplicitly(account, password, userbundle);
+    boolean result = false;
+    try {
+      result = accountManager.addAccountExplicitly(account, password, userbundle);
+    } catch (SecurityException e) {
+      final String message = e.getMessage();
+      if (message != null && (message.indexOf("is different than the authenticator's uid") > 0)) {
+        Log.wtf("FirefoxSync",
+                "Unable to create account. " +
+                "If you have more than one version of " +
+                "Firefox/Beta/Aurora/Nightly/Fennec installed, that's why.",
+                e);
+      } else {
+        Log.e("FirefoxSync", "Unable to create account.", e);
+      }
+    }
 
     Log.d(LOG_TAG, "Account: " + account + " added successfully? " + result);
     if (!result) {
-      Log.e(LOG_TAG, "Error adding account!");
+      Log.e(LOG_TAG, "Failed to add account!");
     }
 
     // Set components to sync (default: all).
diff --git a/mobile/android/base/sync/stage/AndroidBrowserBookmarksServerSyncStage.java b/mobile/android/base/sync/stage/AndroidBrowserBookmarksServerSyncStage.java
index 4ab79d634c7..be0697f01fc 100644
--- a/mobile/android/base/sync/stage/AndroidBrowserBookmarksServerSyncStage.java
+++ b/mobile/android/base/sync/stage/AndroidBrowserBookmarksServerSyncStage.java
@@ -52,11 +52,6 @@ public class AndroidBrowserBookmarksServerSyncStage extends ServerSyncStage {
   private static final String BOOKMARKS_SORT          = "index";
   private static final long   BOOKMARKS_REQUEST_LIMIT = 5000;         // Sanity limit.
 
-  @Override
-  public void execute(org.mozilla.gecko.sync.GlobalSession session) throws NoSuchStageException {
-    super.execute(session);
-  }
-
   @Override
   protected String getCollection() {
     return "bookmarks";
diff --git a/mobile/android/base/sync/stage/AndroidBrowserHistoryServerSyncStage.java b/mobile/android/base/sync/stage/AndroidBrowserHistoryServerSyncStage.java
index ab52ff13060..13bdc81dde6 100644
--- a/mobile/android/base/sync/stage/AndroidBrowserHistoryServerSyncStage.java
+++ b/mobile/android/base/sync/stage/AndroidBrowserHistoryServerSyncStage.java
@@ -52,11 +52,6 @@ public class AndroidBrowserHistoryServerSyncStage extends ServerSyncStage {
   private static final String HISTORY_SORT          = "index";
   private static final long   HISTORY_REQUEST_LIMIT = 250;
 
-  @Override
-  public void execute(org.mozilla.gecko.sync.GlobalSession session) throws NoSuchStageException {
-    super.execute(session);
-  }
-
   @Override
   protected String getCollection() {
     return "history";
diff --git a/mobile/android/base/sync/stage/ServerSyncStage.java b/mobile/android/base/sync/stage/ServerSyncStage.java
index 6679ed088ae..1f04c35f359 100644
--- a/mobile/android/base/sync/stage/ServerSyncStage.java
+++ b/mobile/android/base/sync/stage/ServerSyncStage.java
@@ -95,10 +95,6 @@ public abstract class ServerSyncStage implements
   /**
    * Return a Crypto5Middleware-wrapped Server11Repository.
    *
-   * @param clusterURI
-   * @param data.username
-   * @param collection
-   * @return
    * @throws NoCollectionKeysSetException
    * @throws URISyntaxException
    */
diff --git a/mobile/android/base/ui/PanZoomController.java b/mobile/android/base/ui/PanZoomController.java
index 44fcb51d6ac..81ccfdfafdb 100644
--- a/mobile/android/base/ui/PanZoomController.java
+++ b/mobile/android/base/ui/PanZoomController.java
@@ -770,6 +770,12 @@ public class PanZoomController
     public boolean onScale(SimpleScaleGestureDetector detector) {
         Log.d(LOGTAG, "onScale in state " + mState);
 
+        if (GeckoApp.mDOMFullScreen)
+            return false;
+
+        if (!mController.getViewportMetrics().getAllowZoom())
+            return false;
+
         if (mState == PanZoomState.ANIMATED_ZOOM)
             return false;
 
diff --git a/mobile/android/chrome/content/aboutAddons.js b/mobile/android/chrome/content/aboutAddons.js
index d1efd95a902..bd81f999d3f 100644
--- a/mobile/android/chrome/content/aboutAddons.js
+++ b/mobile/android/chrome/content/aboutAddons.js
@@ -208,6 +208,22 @@ var Addons = {
   },
 
   showDetails: function showDetails(aListItem) {
+    // This function removes and returns the text content of aNode without
+    // removing any child elements. Removing the text nodes ensures any XBL
+    // bindings apply properly.
+    function stripTextNodes(aNode) {
+      var text = "";
+      for (var i = 0; i < aNode.childNodes.length; i++) {
+        if (aNode.childNodes[i].nodeType != document.ELEMENT_NODE) {
+          text += aNode.childNodes[i].textContent;
+          aNode.removeChild(aNode.childNodes[i--]);
+        } else {
+          text += stripTextNodes(aNode.childNodes[i]);
+        }
+      }
+      return text;
+    }
+
     let detailItem = document.querySelector("#addons-details > .addon-item");
     detailItem.setAttribute("isDisabled", aListItem.getAttribute("isDisabled"));
     detailItem.setAttribute("opType", aListItem.getAttribute("opType"));
@@ -247,22 +263,6 @@ var Addons = {
       xhr.open("GET", optionsURL, false);
       xhr.send();
       if (xhr.responseXML) {
-        // This function removes and returns the text content of aNode without
-        // removing any child elements. Removing the text nodes ensures any XBL
-        // bindings apply properly.
-        function stripTextNodes(aNode) {
-          var text = '';
-          for (var i = 0; i < aNode.childNodes.length; i++) {
-            if (aNode.childNodes[i].nodeType != document.ELEMENT_NODE) {
-              text += aNode.childNodes[i].textContent;
-              aNode.removeChild(aNode.childNodes[i--]);
-            } else {
-              text += stripTextNodes(aNode.childNodes[i]);
-            }
-          }
-          return text;
-        }
-
         // Only allow <setting> for now
         let settings = xhr.responseXML.querySelectorAll(":root > setting");
         for (let i = 0; i < settings.length; i++) {
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index 513dc11c115..ebaa113d08b 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -507,7 +507,7 @@ var BrowserApp = {
     aParams = aParams || {};
 
     let flags = "flags" in aParams ? aParams.flags : Ci.nsIWebNavigation.LOAD_FLAGS_NONE;
-    let postData = ("postData" in aParams && aParams.postData) ? aParams.postData.value : null;
+    let postData = ("postData" in aParams && aParams.postData) ? aParams.postData : null;
     let referrerURI = "referrerURI" in aParams ? aParams.referrerURI : null;
     let charset = "charset" in aParams ? aParams.charset : null;
 
@@ -830,16 +830,6 @@ var BrowserApp = {
     });
   },
 
-  getSearchOrURI: function getSearchOrURI(aParams) {
-    let uri;
-    if (aParams.engine) {
-      let engine = Services.search.getEngineByName(aParams.engine);
-      if (engine)
-        uri = engine.getSubmission(aParams.url).uri;
-    }
-    return uri ? uri.spec : aParams.url;
-  },
-
   scrollToFocusedInput: function(aBrowser) {
     let doc = aBrowser.contentDocument;
     if (!doc)
@@ -955,7 +945,15 @@ var BrowserApp = {
         flags: flags
       };
 
-      let url = this.getSearchOrURI(data);
+      let url = data.url;
+      if (data.engine) {
+        let engine = Services.search.getEngineByName(data.engine);
+        if (engine) {
+          let submission = engine.getSubmission(url);
+          url = submission.uri.spec;
+          params.postData = submission.postData;
+        }
+      }
 
       // Don't show progress throbber for about:home
       if (url == "about:home")
@@ -1563,6 +1561,10 @@ Tab.prototype = {
     };
     sendMessageToJava(message);
 
+    this.overscrollController = new OverscrollController(this);
+    this.browser.contentWindow.controllers
+      .insertControllerAt(0, this.overscrollController);
+
     let flags = Ci.nsIWebProgress.NOTIFY_STATE_ALL |
                 Ci.nsIWebProgress.NOTIFY_LOCATION |
                 Ci.nsIWebProgress.NOTIFY_SECURITY;
@@ -1611,6 +1613,9 @@ Tab.prototype = {
     if (!this.browser)
       return;
 
+    this.browser.controllers.contentWindow
+      .removeController(this.overscrollController);
+
     this.browser.removeProgressListener(this);
     this.browser.removeEventListener("DOMContentLoaded", this, true);
     this.browser.removeEventListener("DOMLinkAdded", this, true);
@@ -1739,6 +1744,8 @@ Tab.prototype = {
       pageWidth *= this._viewport.zoom;
       pageHeight *= this._viewport.zoom;
 
+      this._viewport.allowZoom  = this.metadata.allowZoom;
+
       /*
        * Avoid sending page sizes of less than screen size before we hit DOMContentLoaded, because
        * this causes the page size to jump around wildly during page load. After the page is loaded,
@@ -1973,13 +1980,20 @@ Tab.prototype = {
       let restoring = aStateFlags & Ci.nsIWebProgressListener.STATE_RESTORING;
       let showProgress = restoring ? false : this.showProgress;
 
+      // true if the page loaded successfully (i.e., no 404s or other errors)
+      let success = false; 
+      try {
+        success = aRequest.QueryInterface(Components.interfaces.nsIHttpChannel).requestSucceeded;
+      } catch (e) { }
+
       let message = {
         gecko: {
           type: "Content:StateChange",
           tabID: this.id,
           uri: uri,
           state: aStateFlags,
-          showProgress: showProgress
+          showProgress: showProgress,
+          success: success
         }
       };
       sendMessageToJava(message);
@@ -2913,7 +2927,13 @@ var FormAssistant = {
     switch (aEvent.type) {
       case "focus":
         let currentElement = aEvent.target;
-        this._showValidationMessage(currentElement);
+
+        // Prioritize a form validation message over autocomplete suggestions
+        // when the element is first focused (a form validation message will
+        // only be available if an invalid form was submitted)
+        if (this._showValidationMessage(currentElement))
+          break;
+        this._showAutoCompleteSuggestions(currentElement)
         break;
 
       case "input":
@@ -3500,7 +3520,8 @@ var PopupBlockerObserver = {
         let popupFeatures = pageReport[i].popupWindowFeatures;
         let popupName = pageReport[i].popupWindowName;
 
-        BrowserApp.addTab(popupURIspec);
+        let parent = BrowserApp.selectedTab;
+        BrowserApp.addTab(popupURIspec, { parentId: parent.id });
       }
     }
   }
@@ -4309,3 +4330,25 @@ var CharacterEncoding = {
   }
 };
 
+function OverscrollController(aTab) {
+  this.tab = aTab;
+}
+
+OverscrollController.prototype = {
+  supportsCommand : function supportsCommand(aCommand) {
+    if (aCommand != "cmd_linePrevious" && aCommand != "cmd_scrollPageUp")
+      return false;
+
+    return (this.tab.viewport.y == 0);
+  },
+
+  isCommandEnabled : function isCommandEnabled(aCommand) {
+    return this.supportsCommand(aCommand);
+  },
+
+  doCommand : function doCommand(aCommand){
+    sendMessageToJava({ gecko: { type: "ToggleChrome:Focus" } });
+  },
+
+  onEvent : function onEvent(aEvent) { }
+};
diff --git a/mobile/xul/app/mobile.js b/mobile/xul/app/mobile.js
index 27b106108d5..c2c2fc6f6e4 100644
--- a/mobile/xul/app/mobile.js
+++ b/mobile/xul/app/mobile.js
@@ -216,13 +216,14 @@ pref("extensions.strictCompatibility", false);
 pref("extensions.minCompatibleAppVersion", "4.0");
 
 pref("extensions.update.url", "https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%&currentAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%");
+pref("extensions.update.background.url", "https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%&currentAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%");
 
 /* preferences for the Get Add-ons pane */
 pref("extensions.getAddons.cache.enabled", true);
 pref("extensions.getAddons.maxResults", 15);
 pref("extensions.getAddons.recommended.browseURL", "https://addons.mozilla.org/%LOCALE%/mobile/recommended/");
 pref("extensions.getAddons.recommended.url", "https://services.addons.mozilla.org/%LOCALE%/mobile/api/%API_VERSION%/list/featured/all/%MAX_RESULTS%/%OS%/%VERSION%");
-pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/mobile/search?q=%TERMS%");
+pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/mobile/search?q=%TERMS%&platform=%OS%&appver=%VERSION%");
 pref("extensions.getAddons.search.url", "https://services.addons.mozilla.org/%LOCALE%/mobile/api/%API_VERSION%/search/%TERMS%/all/%MAX_RESULTS%/%OS%/%VERSION%/%COMPATIBILITY_MODE%");
 pref("extensions.getAddons.browseAddons", "https://addons.mozilla.org/%LOCALE%/mobile/");
 pref("extensions.getAddons.get.url", "https://services.addons.mozilla.org/%LOCALE%/mobile/api/%API_VERSION%/search/guid:%IDS%?src=mobile&appOS=%OS%&appVersion=%VERSION%");
@@ -242,6 +243,9 @@ pref("extensions.blocklist.detailsURL", "https://www.mozilla.com/%LOCALE%/blockl
 pref("dom.disable_open_during_load", true);
 pref("privacy.popups.showBrowserMessage", true);
 
+/* disable opening windows with the dialog feature */
+pref("dom.disable_window_open_dialog_feature", true);
+
 pref("keyword.enabled", true);
 pref("keyword.URL", "http://www.google.com/m?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=");
 
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 32ab27737b2..d279ae13853 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -203,6 +203,9 @@ pref("gfx.downloadable_fonts.enabled", true);
 pref("gfx.downloadable_fonts.fallback_delay", 3000);
 pref("gfx.downloadable_fonts.sanitize", true);
 
+// whether to always search all font cmaps during system font fallback
+pref("gfx.font_rendering.fallback.always_use_cmaps", false);
+
 #ifdef MOZ_GRAPHITE
 pref("gfx.font_rendering.graphite.enabled", false);
 #endif
@@ -1514,14 +1517,14 @@ pref("plugins.click_to_play", false);
 #ifndef DEBUG
 // How long a plugin is allowed to process a synchronous IPC message
 // before we consider it "hung".
-pref("dom.ipc.plugins.timeoutSecs", 25);
+pref("dom.ipc.plugins.timeoutSecs", 45);
 // How long a plugin process will wait for a response from the parent
 // to a synchronous request before terminating itself. After this
 // point the child assumes the parent is hung. Currently disabled.
 pref("dom.ipc.plugins.parentTimeoutSecs", 0);
 // How long a plugin launch is allowed to take before
 // we consider it failed.
-pref("dom.ipc.plugins.processLaunchTimeoutSecs", 25);
+pref("dom.ipc.plugins.processLaunchTimeoutSecs", 45);
 #else
 // No timeout in DEBUG builds
 pref("dom.ipc.plugins.timeoutSecs", 0);
@@ -1627,9 +1630,9 @@ pref("font.name-list.cursive.he", "Guttman Yad, Ktav, Arial");
 pref("font.name.serif.ja", "MS PMincho");
 pref("font.name.sans-serif.ja", "MS PGothic");
 pref("font.name.monospace.ja", "MS Gothic");
-pref("font.name-list.serif.ja", "MS PMincho, MS Mincho, MS PGothic, MS Gothic");
-pref("font.name-list.sans-serif.ja", "MS PGothic, MS Gothic, MS PMincho, MS Mincho");
-pref("font.name-list.monospace.ja", "MS Gothic, MS Mincho, MS PGothic, MS PMincho");
+pref("font.name-list.serif.ja", "MS PMincho, MS Mincho, MS PGothic, MS Gothic,Meiryo");
+pref("font.name-list.sans-serif.ja", "MS PGothic, MS Gothic, MS PMincho, MS Mincho,Meiryo");
+pref("font.name-list.monospace.ja", "MS Gothic, MS Mincho, MS PGothic, MS PMincho,Meiryo");
 
 pref("font.name.serif.ko", "Batang");
 pref("font.name.sans-serif.ko", "Gulim");
@@ -1679,27 +1682,27 @@ pref("font.name.cursive.x-western", "Comic Sans MS");
 pref("font.name.serif.zh-CN", "SimSun");
 pref("font.name.sans-serif.zh-CN", "SimSun");
 pref("font.name.monospace.zh-CN", "SimSun");
-pref("font.name-list.serif.zh-CN", "MS Song, SimSun");
-pref("font.name-list.sans-serif.zh-CN", "MS Song, SimSun");
-pref("font.name-list.monospace.zh-CN", "MS Song, SimSun");
+pref("font.name-list.serif.zh-CN", "MS Song, SimSun, SimSun-ExtB");
+pref("font.name-list.sans-serif.zh-CN", "MS Song, SimSun, SimSun-ExtB");
+pref("font.name-list.monospace.zh-CN", "MS Song, SimSun, SimSun-ExtB");
 
 // Per Taiwanese users' demand. They don't want to use TC fonts for
 // rendering Latin letters. (bug 88579)
 pref("font.name.serif.zh-TW", "Times New Roman"); 
 pref("font.name.sans-serif.zh-TW", "Arial");
 pref("font.name.monospace.zh-TW", "MingLiU");
-pref("font.name-list.serif.zh-TW", "PMingLiu, MingLiU"); 
-pref("font.name-list.sans-serif.zh-TW", "PMingLiU, MingLiU");
-pref("font.name-list.monospace.zh-TW", "MingLiU");
+pref("font.name-list.serif.zh-TW", "PMingLiu, MingLiU, MingLiU-ExtB");
+pref("font.name-list.sans-serif.zh-TW", "PMingLiU, MingLiU, MingLiU-ExtB");
+pref("font.name-list.monospace.zh-TW", "MingLiU, MingLiU-ExtB");
 
 // hkscsm3u.ttf (HKSCS-2001) :  http://www.microsoft.com/hk/hkscs
 // Hong Kong users have the same demand about glyphs for Latin letters (bug 88579)
 pref("font.name.serif.zh-HK", "Times New Roman");
 pref("font.name.sans-serif.zh-HK", "Arial");
 pref("font.name.monospace.zh-HK", "MingLiu_HKSCS");
-pref("font.name-list.serif.zh-HK", "MingLiu_HKSCS, Ming(for ISO10646), MingLiU");
-pref("font.name-list.sans-serif.zh-HK", "MingLiU_HKSCS, Ming(for ISO10646), MingLiU");
-pref("font.name-list.monospace.zh-HK", "MingLiU_HKSCS, Ming(for ISO10646), MingLiU");
+pref("font.name-list.serif.zh-HK", "MingLiu_HKSCS, Ming(for ISO10646), MingLiU, MingLiU_HKSCS-ExtB");
+pref("font.name-list.sans-serif.zh-HK", "MingLiU_HKSCS, Ming(for ISO10646), MingLiU, MingLiU_HKSCS-ExtB");
+pref("font.name-list.monospace.zh-HK", "MingLiU_HKSCS, Ming(for ISO10646), MingLiU, MingLiU_HKSCS-ExtB");
 
 pref("font.name.serif.x-devanagari", "Mangal");
 pref("font.name.sans-serif.x-devanagari", "Raghindi");
@@ -2095,16 +2098,16 @@ pref("font.name-list.monospace.ar", "Geeza Pro");
 pref("font.name-list.cursive.ar", "DecoType Naskh");
 pref("font.name-list.fantasy.ar", "KufiStandardGK");
 
-pref("font.name.serif.el", "Lucida Grande");
-pref("font.name.sans-serif.el", "Lucida Grande");
-pref("font.name.monospace.el", "Lucida Grande");
+pref("font.name.serif.el", "Times");
+pref("font.name.sans-serif.el", "Helvetica");
+pref("font.name.monospace.el", "Courier New");
 pref("font.name.cursive.el", "Lucida Grande");
 pref("font.name.fantasy.el", "Lucida Grande");
-pref("font.name-list.serif.el", "Lucida Grande");
-pref("font.name-list.sans-serif.el", "Lucida Grande");
-pref("font.name-list.monospace.el", "Lucida Grande");
-pref("font.name-list.cursive.el", "Lucida Grande");
-pref("font.name-list.fantasy.el", "Lucida Grande");
+pref("font.name-list.serif.el", "Times,Times New Roman");
+pref("font.name-list.sans-serif.el", "Helvetica,Lucida Grande");
+pref("font.name-list.monospace.el", "Courier New,Lucida Grande");
+pref("font.name-list.cursive.el", "Times,Lucida Grande");
+pref("font.name-list.fantasy.el", "Times,Lucida Grande");
 
 pref("font.name.serif.he", "Times New Roman");
 pref("font.name.sans-serif.he", "Arial");
@@ -2117,11 +2120,11 @@ pref("font.name-list.monospace.he", "Courier New");
 pref("font.name-list.cursive.he", "Times New Roman");
 pref("font.name-list.fantasy.he", "Times New Roman");
 
-pref("font.name.serif.ja", "Hiragino Mincho Pro"); 
-pref("font.name.sans-serif.ja", "Hiragino Kaku Gothic Pro"); 
+pref("font.name.serif.ja", "Hiragino Mincho ProN");
+pref("font.name.sans-serif.ja", "Hiragino Kaku Gothic ProN");
 pref("font.name.monospace.ja", "Osaka-Mono"); 
-pref("font.name-list.serif.ja", "Hiragino Mincho Pro"); 
-pref("font.name-list.sans-serif.ja", "Hiragino Kaku Gothic Pro"); 
+pref("font.name-list.serif.ja", "Hiragino Mincho ProN,Hiragino Mincho Pro");
+pref("font.name-list.sans-serif.ja", "Hiragino Kaku Gothic ProN,Hiragino Kaku Gothic Pro");
 pref("font.name-list.monospace.ja", "Osaka-Mono"); 
 
 pref("font.name.serif.ko", "AppleMyungjo"); 
@@ -2200,9 +2203,9 @@ pref("font.name.sans-serif.x-cyrillic", "Helvetica");
 pref("font.name.monospace.x-cyrillic", "Monaco");
 pref("font.name.cursive.x-cyrillic", "Geneva");
 pref("font.name.fantasy.x-cyrillic", "Charcoal CY");
-pref("font.name-list.serif.x-cyrillic", "Times");
-pref("font.name-list.sans-serif.x-cyrillic", "Helvetica");
-pref("font.name-list.monospace.x-cyrillic", "Monaco");
+pref("font.name-list.serif.x-cyrillic", "Times,Times New Roman");
+pref("font.name-list.sans-serif.x-cyrillic", "Helvetica,Arial");
+pref("font.name-list.monospace.x-cyrillic", "Monaco,Courier New");
 pref("font.name-list.cursive.x-cyrillic", "Geneva");
 pref("font.name-list.fantasy.x-cyrillic", "Charcoal CY");
 
@@ -2311,32 +2314,32 @@ pref("font.name.sans-serif.x-western", "Helvetica");
 pref("font.name.monospace.x-western", "Courier");
 pref("font.name.cursive.x-western", "Apple Chancery");
 pref("font.name.fantasy.x-western", "Papyrus");
-pref("font.name-list.serif.x-western", "Times");
-pref("font.name-list.sans-serif.x-western", "Helvetica");
-pref("font.name-list.monospace.x-western", "Courier");
+pref("font.name-list.serif.x-western", "Times,Times New Roman");
+pref("font.name-list.sans-serif.x-western", "Helvetica,Arial");
+pref("font.name-list.monospace.x-western", "Courier,Courier New");
 pref("font.name-list.cursive.x-western", "Apple Chancery");
 pref("font.name-list.fantasy.x-western", "Papyrus");
 
 pref("font.name.serif.zh-CN", "STSong");
 pref("font.name.sans-serif.zh-CN", "STHeiti");
 pref("font.name.monospace.zh-CN", "STHeiti");
-pref("font.name-list.serif.zh-CN", "STSong");
-pref("font.name-list.sans-serif.zh-CN", "STHeiti");
-pref("font.name-list.monospace.zh-CN", "STHeiti");
+pref("font.name-list.serif.zh-CN", "STSong,Heiti SC");
+pref("font.name-list.sans-serif.zh-CN", "STHeiti,Heiti SC");
+pref("font.name-list.monospace.zh-CN", "STHeiti,Heiti SC");
 
 pref("font.name.serif.zh-TW", "Apple LiSung"); 
 pref("font.name.sans-serif.zh-TW", "Apple LiGothic");  
 pref("font.name.monospace.zh-TW", "Apple LiGothic");  
-pref("font.name-list.serif.zh-TW", "Apple LiSung"); 
-pref("font.name-list.sans-serif.zh-TW", "Apple LiGothic");  
-pref("font.name-list.monospace.zh-TW", "Apple LiGothic");  
+pref("font.name-list.serif.zh-TW", "Apple LiSung,Heiti TC");
+pref("font.name-list.sans-serif.zh-TW", "Apple LiGothic,Heiti TC");
+pref("font.name-list.monospace.zh-TW", "Apple LiGothic,Heiti TC");
 
 pref("font.name.serif.zh-HK", "LiSong Pro");
 pref("font.name.sans-serif.zh-HK", "LiHei Pro");
 pref("font.name.monospace.zh-HK", "LiHei Pro");
-pref("font.name-list.serif.zh-HK", "LiSong Pro");
-pref("font.name-list.sans-serif.zh-HK", "LiHei Pro");
-pref("font.name-list.monospace.zh-HK", "LiHei Pro");
+pref("font.name-list.serif.zh-HK", "LiSong Pro,Heiti TC");
+pref("font.name-list.sans-serif.zh-HK", "LiHei Pro,Heiti TC");
+pref("font.name-list.monospace.zh-HK", "LiHei Pro,Heiti TC");
 
 pref("font.default.ar", "sans-serif");
 pref("font.size.variable.ar", 16);
@@ -3461,12 +3464,16 @@ pref("dom.network.metered", false);
 // many mb of virtual address space available.
 pref("memory.low_virtual_memory_threshold_mb", 128);
 
+// On Windows 32- or 64-bit, fire a low-memory notification if we have less
+// than this many mb of commit space (physical memory plus page file) left.
+pref("memory.low_commit_space_threshold_mb", 128);
+
 // On Windows 32- or 64-bit, fire a low-memory notification if we have less
 // than this many mb of physical memory available on the whole machine.
 pref("memory.low_physical_memory_threshold_mb", 0);
 
 // On Windows 32- or 64-bit, don't fire a low-memory notification because of
-// low available physical memory more than once every
-// low_physical_memory_notification_interval_ms.
-pref("memory.low_physical_memory_notification_interval_ms", 10000);
+// low available physical memory or low commit space more than once every
+// low_memory_notification_interval_ms.
+pref("memory.low_memory_notification_interval_ms", 10000);
 #endif
diff --git a/mozglue/linker/CustomElf.cpp b/mozglue/linker/CustomElf.cpp
index 949e441b669..10b8f228b35 100644
--- a/mozglue/linker/CustomElf.cpp
+++ b/mozglue/linker/CustomElf.cpp
@@ -679,9 +679,12 @@ CustomElf::RelocateJumps()
       symptr = GetSymbolPtrInDeps(strtab.GetStringAt(sym.st_name));
 
     if (symptr == NULL) {
-      log("%s: Error: relocation to NULL @0x%08" PRIxAddr " for symbol \"%s\"",
-          GetPath(), rel->r_offset, strtab.GetStringAt(sym.st_name));
-      return false;
+      log("%s: %s: relocation to NULL @0x%08" PRIxAddr " for symbol \"%s\"",
+          GetPath(),
+          (ELF_ST_BIND(sym.st_info) == STB_WEAK) ? "Warning" : "Error",
+          rel->r_offset, strtab.GetStringAt(sym.st_name));
+      if (ELF_ST_BIND(sym.st_info) != STB_WEAK)
+        return false;
     }
     /* Apply relocation */
     *(void **) ptr = symptr;
diff --git a/mozglue/linker/CustomElf.h b/mozglue/linker/CustomElf.h
index 86906328d83..0efe96ac5f8 100644
--- a/mozglue/linker/CustomElf.h
+++ b/mozglue/linker/CustomElf.h
@@ -26,12 +26,18 @@
 #define ELFCLASS ELFCLASS64
 #define ELF_R_TYPE ELF64_R_TYPE
 #define ELF_R_SYM ELF64_R_SYM
+#ifndef ELF_ST_BIND
+#define ELF_ST_BIND ELF64_ST_BIND
+#endif
 #define PRIxAddr "lx"
 #else
 #define Elf_(type) Elf32_ ## type
 #define ELFCLASS ELFCLASS32
 #define ELF_R_TYPE ELF32_R_TYPE
 #define ELF_R_SYM ELF32_R_SYM
+#ifndef ELF_ST_BIND
+#define ELF_ST_BIND ELF32_ST_BIND
+#endif
 #define PRIxAddr "x"
 #endif
 
diff --git a/netwerk/base/src/nsIOService.cpp b/netwerk/base/src/nsIOService.cpp
index d6bc5b62135..bf7b8551b75 100644
--- a/netwerk/base/src/nsIOService.cpp
+++ b/netwerk/base/src/nsIOService.cpp
@@ -176,7 +176,7 @@ PRUint32   nsIOService::gDefaultSegmentCount = 24;
 nsIOService::nsIOService()
     : mOffline(true)
     , mOfflineForProfileChange(false)
-    , mManageOfflineStatus(true)
+    , mManageOfflineStatus(false)
     , mSettingOffline(false)
     , mSetOfflineValue(false)
     , mShutdown(false)
@@ -1119,10 +1119,19 @@ NS_IMETHODIMP
 nsIOService::SetManageOfflineStatus(bool aManage) {
     nsresult rv = NS_OK;
 
-    InitializeNetworkLinkService();
+    // SetManageOfflineStatus must throw when we fail to go from non-managed
+    // to managed.  Usually because there is no link monitoring service 
+    // available.  Failure to do this switch is detected by a failure of 
+    // TrackNetworkLinkStatusForOffline().  When there is no network link 
+    // available during call to InitializeNetworkLinkService(), application is
+    // put to offline mode.  And when we change mMangeOfflineStatus to false 
+    // on the next line we get stuck on being offline even though the link 
+    // becomes later available.
     bool wasManaged = mManageOfflineStatus;
     mManageOfflineStatus = aManage;
 
+    InitializeNetworkLinkService();
+
     if (mManageOfflineStatus && !wasManaged) {
         rv = TrackNetworkLinkStatusForOffline();
         if (NS_FAILED(rv))
diff --git a/parser/html/nsHtml5Atoms.cpp b/parser/html/nsHtml5Atoms.cpp
index 2494ebebf64..5ffbc00dfb3 100644
--- a/parser/html/nsHtml5Atoms.cpp
+++ b/parser/html/nsHtml5Atoms.cpp
@@ -66,5 +66,5 @@ static const nsStaticAtom Html5Atoms_info[] = {
 
 void nsHtml5Atoms::AddRefAtoms()
 {
-  NS_RegisterStaticAtoms(Html5Atoms_info, ArrayLength(Html5Atoms_info));
+  NS_RegisterStaticAtoms(Html5Atoms_info);
 }
diff --git a/parser/html/nsHtml5TreeOperation.cpp b/parser/html/nsHtml5TreeOperation.cpp
index 1b8040577ea..d03180b9f2f 100644
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@@ -795,12 +795,12 @@ nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor* aBuilder,
         const PRUnichar* params[] = { atom->GetUTF16String(),
                                       otherAtom->GetUTF16String() };
         rv = nsContentUtils::FormatLocalizedString(
-          nsContentUtils::eHTMLPARSER_PROPERTIES, msgId, params, 2, message);
+          nsContentUtils::eHTMLPARSER_PROPERTIES, msgId, params, message);
         NS_ENSURE_SUCCESS(rv, rv);
       } else if (atom) {
         const PRUnichar* params[] = { atom->GetUTF16String() };
         rv = nsContentUtils::FormatLocalizedString(
-          nsContentUtils::eHTMLPARSER_PROPERTIES, msgId, params, 1, message);
+          nsContentUtils::eHTMLPARSER_PROPERTIES, msgId, params, message);
         NS_ENSURE_SUCCESS(rv, rv);
       } else {
         rv = nsContentUtils::GetLocalizedString(
diff --git a/parser/htmlparser/src/nsHTMLTags.cpp b/parser/htmlparser/src/nsHTMLTags.cpp
index 85755f0e261..883fe939539 100644
--- a/parser/htmlparser/src/nsHTMLTags.cpp
+++ b/parser/htmlparser/src/nsHTMLTags.cpp
@@ -374,7 +374,7 @@ nsHTMLTags::AddRefTable(void)
 
   if (gTableRefCount++ == 0) {
     // Fill in our static atom pointers
-    NS_RegisterStaticAtoms(sTagAtoms_info, ArrayLength(sTagAtoms_info));
+    NS_RegisterStaticAtoms(sTagAtoms_info);
 
 
     NS_ASSERTION(!gTagTable && !gTagAtomTable, "pre existing hash!");
diff --git a/parser/htmlparser/tests/mochitest/file_bug594730-4.html b/parser/htmlparser/tests/mochitest/file_bug594730-4.html
index 2cbf7745cb9..bdce353a59f 100644
--- a/parser/htmlparser/tests/mochitest/file_bug594730-4.html
+++ b/parser/htmlparser/tests/mochitest/file_bug594730-4.html
@@ -1,3 +1,3 @@
 <!DOCTYPE html>
 <meta content="text/html; charset=Windows-1250">
-<script>parent.is_not("ø", "\u0159", "Decoded bytes should not have matched the Unicode escape.");</script>
+<script>parent.isnot("ø", "\u0159", "Decoded bytes should not have matched the Unicode escape.");</script>
diff --git a/rdf/base/src/nsRDFContentSink.cpp b/rdf/base/src/nsRDFContentSink.cpp
index 561c3e6be6b..c08289cd226 100644
--- a/rdf/base/src/nsRDFContentSink.cpp
+++ b/rdf/base/src/nsRDFContentSink.cpp
@@ -337,7 +337,7 @@ RDFContentSinkImpl::RDFContentSinkImpl()
 
         rv = CallGetService(kRDFContainerUtilsCID, &gRDFContainerUtils);
 
-        NS_RegisterStaticAtoms(rdf_atoms, ArrayLength(rdf_atoms));
+        NS_RegisterStaticAtoms(rdf_atoms);
     }
 
     mNodeIDMap.Init();
diff --git a/security/manager/Makefile.in b/security/manager/Makefile.in
index 1da94ccd215..535be9db069 100644
--- a/security/manager/Makefile.in
+++ b/security/manager/Makefile.in
@@ -278,6 +278,13 @@ ifeq ($(OS_TARGET),Linux)
 DEFAULT_GMAKE_FLAGS += FREEBL_LOWHASH=1
 endif
 
+ifdef MOZ_NO_WLZDEFS
+DEFAULT_GMAKE_FLAGS += ZDEFS_FLAG=
+endif
+ifdef MOZ_CFLAGS_NSS
+DEFAULT_GMAKE_FLAGS += XCFLAGS="$(CFLAGS)"
+endif
+
 SUBMAKEFILES = boot/Makefile ssl/Makefile pki/Makefile locales/Makefile
 
 include $(topsrcdir)/config/rules.mk
diff --git a/security/manager/ssl/src/nsCrypto.cpp b/security/manager/ssl/src/nsCrypto.cpp
index 1f532dc77f9..3a5a7898864 100644
--- a/security/manager/ssl/src/nsCrypto.cpp
+++ b/security/manager/ssl/src/nsCrypto.cpp
@@ -2164,7 +2164,6 @@ NS_IMETHODIMP
 nsCryptoRunnable::Run()
 {
   nsNSSShutDownPreventionLock locker;
-  JSPrincipals *principals;
   JSContext *cx = m_args->m_cx;
 
   JSAutoRequest ar(cx);
@@ -2174,29 +2173,20 @@ nsCryptoRunnable::Run()
     return NS_ERROR_FAILURE;
   }
 
-  nsresult rv = m_args->m_principals->GetJSPrincipals(cx, &principals);
-  if (NS_FAILED(rv))
-    return NS_ERROR_FAILURE;
-
   // make sure the right context is on the stack. must not return w/out popping
   nsCOMPtr<nsIJSContextStack> stack(do_GetService("@mozilla.org/js/xpc/ContextStack;1"));
   if (!stack || NS_FAILED(stack->Push(cx))) {
-    JSPRINCIPALS_DROP(cx, principals);
     return NS_ERROR_FAILURE;
   }
 
-  jsval retval;
-  if (JS_EvaluateScriptForPrincipals(cx, m_args->m_scope, principals,
-                                     m_args->m_jsCallback, 
-                                     strlen(m_args->m_jsCallback),
-                                     nsnull, 0,
-                                     &retval) != JS_TRUE) {
-    rv = NS_ERROR_FAILURE;
-  }
-
+  JSBool ok =
+    JS_EvaluateScriptForPrincipals(cx, m_args->m_scope,
+                                   nsJSPrincipals::get(m_args->m_principals),
+                                   m_args->m_jsCallback, 
+                                   strlen(m_args->m_jsCallback),
+                                   nsnull, 0, nsnull);
   stack->Pop(nsnull);
-  JSPRINCIPALS_DROP(cx, principals);
-  return rv;
+  return ok ? NS_OK : NS_ERROR_FAILURE;
 }
 
 //Quick helper function to check if a newly issued cert
diff --git a/security/manager/ssl/src/nsNSSCertHelper.cpp b/security/manager/ssl/src/nsNSSCertHelper.cpp
index 2101f6fd1e4..811aedba4a7 100644
--- a/security/manager/ssl/src/nsNSSCertHelper.cpp
+++ b/security/manager/ssl/src/nsNSSCertHelper.cpp
@@ -2125,7 +2125,7 @@ nsNSSCertificate::CreateTBSCertificateASN1Struct(nsIASN1Sequence **retSequence,
     // length to be in bytes, so let's convert the
     // length in a temporary SECItem
     data.data = mCert->issuerID.data;
-    data.len  = mCert->issuerID.len / 8;
+    data.len  = (mCert->issuerID.len + 7) / 8;
 
     ProcessRawBytes(nssComponent, &data, text);
     printableItem = new nsNSSASN1PrintableItem();
@@ -2143,8 +2143,8 @@ nsNSSCertificate::CreateTBSCertificateASN1Struct(nsIASN1Sequence **retSequence,
     // The function ProcessRawBytes expects the
     // length to be in bytes, so let's convert the
     // length in a temporary SECItem
-    data.data = mCert->issuerID.data;
-    data.len  = mCert->issuerID.len / 8;
+    data.data = mCert->subjectID.data;
+    data.len  = (mCert->subjectID.len + 7) / 8;
 
     ProcessRawBytes(nssComponent, &data, text);
     printableItem = new nsNSSASN1PrintableItem();
diff --git a/storage/src/mozStorageService.cpp b/storage/src/mozStorageService.cpp
index 4988ede95de..0999d7faa03 100644
--- a/storage/src/mozStorageService.cpp
+++ b/storage/src/mozStorageService.cpp
@@ -194,9 +194,10 @@ public:
   // main thread!  But at the time of writing this function is only called when
   // about:memory is loaded (not, for example, when telemetry pings occur) and
   // any delays in that case aren't so bad.
-  NS_IMETHOD CollectReports(nsIMemoryMultiReporterCallback *aCallback,
+  NS_IMETHOD CollectReports(nsIMemoryMultiReporterCallback *aCb,
                             nsISupports *aClosure)
   {
+    nsresult rv;
     size_t totalConnSize = 0;
     {
       nsTArray<nsRefPtr<Connection> > connections;
@@ -218,29 +219,32 @@ public:
 
         SQLiteMutexAutoLock lockedScope(conn->sharedDBMutex);
 
-        totalConnSize +=
-          doConnMeasurement(aCallback, aClosure, *conn.get(), pathHead,
-                            NS_LITERAL_CSTRING("stmt"), mStmtDesc,
-                            SQLITE_DBSTATUS_STMT_USED);
-        totalConnSize +=
-          doConnMeasurement(aCallback, aClosure, *conn.get(), pathHead,
-                            NS_LITERAL_CSTRING("cache"), mCacheDesc,
-                            SQLITE_DBSTATUS_CACHE_USED);
-        totalConnSize +=
-          doConnMeasurement(aCallback, aClosure, *conn.get(), pathHead,
-                            NS_LITERAL_CSTRING("schema"), mSchemaDesc,
-                            SQLITE_DBSTATUS_SCHEMA_USED);
+        rv = reportConn(aCb, aClosure, *conn.get(), pathHead,
+                        NS_LITERAL_CSTRING("stmt"), mStmtDesc,
+                        SQLITE_DBSTATUS_STMT_USED, &totalConnSize);
+        NS_ENSURE_SUCCESS(rv, rv);
+
+        rv = reportConn(aCb, aClosure, *conn.get(), pathHead,
+                        NS_LITERAL_CSTRING("cache"), mCacheDesc,
+                        SQLITE_DBSTATUS_CACHE_USED, &totalConnSize);
+        NS_ENSURE_SUCCESS(rv, rv);
+
+        rv = reportConn(aCb, aClosure, *conn.get(), pathHead,
+                        NS_LITERAL_CSTRING("schema"), mSchemaDesc,
+                        SQLITE_DBSTATUS_SCHEMA_USED, &totalConnSize);
+        NS_ENSURE_SUCCESS(rv, rv);
       }
     }
 
     PRInt64 other = ::sqlite3_memory_used() - totalConnSize;
 
-    aCallback->Callback(NS_LITERAL_CSTRING(""),
-                        NS_LITERAL_CSTRING("explicit/storage/sqlite/other"),
-                        nsIMemoryReporter::KIND_HEAP,
-                        nsIMemoryReporter::UNITS_BYTES, other,
-                        NS_LITERAL_CSTRING("All unclassified sqlite memory."),
-                        aClosure);
+    rv = aCb->Callback(NS_LITERAL_CSTRING(""),
+                       NS_LITERAL_CSTRING("explicit/storage/sqlite/other"),
+                       nsIMemoryReporter::KIND_HEAP,
+                       nsIMemoryReporter::UNITS_BYTES, other,
+                       NS_LITERAL_CSTRING("All unclassified sqlite memory."),
+                       aClosure);
+    NS_ENSURE_SUCCESS(rv, rv);
 
     return NS_OK;
   }
@@ -272,14 +276,17 @@ private:
    *        The memory report description.
    * @param aOption
    *        The SQLite constant for getting the measurement.
+   * @param aTotal
+   *        The accumulator for the measurement.
    */
-  size_t doConnMeasurement(nsIMemoryMultiReporterCallback *aCallback,
-                           nsISupports *aClosure,
-                           sqlite3 *aConn,
-                           const nsACString &aPathHead,
-                           const nsACString &aKind,
-                           const nsACString &aDesc,
-                           int aOption)
+  nsresult reportConn(nsIMemoryMultiReporterCallback *aCb,
+                      nsISupports *aClosure,
+                      sqlite3 *aConn,
+                      const nsACString &aPathHead,
+                      const nsACString &aKind,
+                      const nsACString &aDesc,
+                      int aOption,
+                      size_t *aTotal)
   {
     nsCString path(aPathHead);
     path.Append(aKind);
@@ -290,11 +297,14 @@ private:
     nsresult rv = convertResultCode(rc);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    aCallback->Callback(NS_LITERAL_CSTRING(""), path,
-                        nsIMemoryReporter::KIND_HEAP,
-                        nsIMemoryReporter::UNITS_BYTES, PRInt64(curr),
-                        aDesc, aClosure);
-    return curr;
+    rv = aCb->Callback(NS_LITERAL_CSTRING(""), path,
+                       nsIMemoryReporter::KIND_HEAP,
+                       nsIMemoryReporter::UNITS_BYTES, PRInt64(curr),
+                       aDesc, aClosure);
+    NS_ENSURE_SUCCESS(rv, rv);
+    *aTotal += curr;
+
+    return NS_OK;
   }
 };
 
diff --git a/testing/talos/talos.json b/testing/talos/talos.json
index 4f1c0326bc3..7ee379adc17 100644
--- a/testing/talos/talos.json
+++ b/testing/talos/talos.json
@@ -2,9 +2,5 @@
     "talos.zip": {
         "url": "http://build.mozilla.org/talos/zips/talos.bug732835.zip",
         "path": ""
-    },
-    "pageloader.xpi": {
-        "url": "http://build.mozilla.org/talos/xpis/pageloader.xpi",
-        "path": "talos/page_load_test"
     }
 }
diff --git a/testing/talos/talos_from_code.py b/testing/talos/talos_from_code.py
index 574dd2767d6..25d9334f0b0 100644
--- a/testing/talos/talos_from_code.py
+++ b/testing/talos/talos_from_code.py
@@ -44,18 +44,18 @@ def main():
     # 3) download the necessary files
     print "INFO: talos.json URL: %s" % options.talos_json_url
     try:
-        for key in ('talos.zip', 'pageloader.xpi',):
-            entity = get_value(jsonFilename, key)
-            if passesRestrictions(options.talos_json_url, entity["url"]):
-                # the key is at the same time the filename e.g. talos.zip
-                download_file(entity["url"], entity["path"], key)
-                print "INFO: %s -> %s" % (entity["url"], os.path.join(entity["path"], key))
-            else:
-                print "ERROR: You have tried to download a file " + \
-                      "from: %s " % fileUrl + \
-                      "which is a location different than http://build.mozilla.org/talos/"
-                print "ERROR: This is only allowed for the certain branches."
-                sys.exit(1)
+        key = 'talos.zip'
+        entity = get_value(jsonFilename, key)
+        if passesRestrictions(options.talos_json_url, entity["url"]):
+            # the key is at the same time the filename e.g. talos.zip
+            download_file(entity["url"], entity["path"], key)
+            print "INFO: %s -> %s" % (entity["url"], os.path.join(entity["path"], key))
+        else:
+            print "ERROR: You have tried to download a file " + \
+                  "from: %s " % fileUrl + \
+                  "which is a location different than http://build.mozilla.org/talos/"
+            print "ERROR: This is only allowed for the certain branches."
+            sys.exit(1)
     except Exception, e:
         print "ERROR: %s" % str(e)
         sys.exit(1)
diff --git a/testing/xpcshell/head.js b/testing/xpcshell/head.js
index c3d4707fab0..b33a066b614 100644
--- a/testing/xpcshell/head.js
+++ b/testing/xpcshell/head.js
@@ -843,7 +843,9 @@ function run_test_in_child(testFile, optionalCallback)
 
   var testPath = do_get_file(testFile).path.replace(/\\/g, "/");
   do_test_pending();
-  sendCommand("const _TEST_FILE=['" + testPath + "']; _execute_test();", 
+  sendCommand("_dump('CHILD-TEST-STARTED'); "
+              + "const _TEST_FILE=['" + testPath + "']; _execute_test(); "
+              + "_dump('CHILD-TEST-COMPLETED');", 
               callback);
 }
 
diff --git a/testing/xpcshell/runxpcshelltests.py b/testing/xpcshell/runxpcshelltests.py
index ba6699e55f6..114807eb656 100644
--- a/testing/xpcshell/runxpcshelltests.py
+++ b/testing/xpcshell/runxpcshelltests.py
@@ -679,10 +679,17 @@ class XPCShellTests(object):
           self.log.info("<<<<<<<")
 
         result = not ((self.getReturnCode(proc) != 0) or
+                      # if do_throw or do_check failed
                       (stdout and re.search("^((parent|child): )?TEST-UNEXPECTED-",
                                             stdout, re.MULTILINE)) or
+                      # if syntax error in xpcshell file
                       (stdout and re.search(": SyntaxError:", stdout,
-                                            re.MULTILINE)))
+                                            re.MULTILINE)) or
+                      # if e10s test started but never finished (child process crash)
+                      (stdout and re.search("^child: CHILD-TEST-STARTED", 
+                                            stdout, re.MULTILINE) 
+                              and not re.search("^child: CHILD-TEST-COMPLETED",
+                                                stdout, re.MULTILINE)))
 
         if result != expected:
           failureType = "TEST-UNEXPECTED-%s" % ("FAIL" if expected else "PASS")
diff --git a/testing/xpcshell/xpcshell.ini b/testing/xpcshell/xpcshell.ini
index 0221cd8e02d..2af59639ded 100644
--- a/testing/xpcshell/xpcshell.ini
+++ b/testing/xpcshell/xpcshell.ini
@@ -72,6 +72,7 @@ skip-if = os == "android"
 skip-if = os == "android"
 [include:browser/components/dirprovider/tests/unit/xpcshell.ini]
 [include:browser/components/feeds/test/unit/xpcshell.ini]
+[include:browser/components/migration/tests/unit/xpcshell.ini]
 [include:browser/components/places/tests/unit/xpcshell.ini]
 [include:browser/components/privatebrowsing/test/unit/xpcshell.ini]
 [include:browser/components/shell/test/unit/xpcshell.ini]
diff --git a/toolkit/components/aboutmemory/content/aboutMemory.js b/toolkit/components/aboutmemory/content/aboutMemory.js
index f2dc882a98e..54c55def0dc 100644
--- a/toolkit/components/aboutmemory/content/aboutMemory.js
+++ b/toolkit/components/aboutmemory/content/aboutMemory.js
@@ -124,7 +124,7 @@ function onLoad()
   } else if (document.title === "about:compartments") {
     onLoadAboutCompartments();
   } else {
-    assert(false, "Unknown location");
+    assert(false, "Unknown location: " + document.title);
   }
 }
 
diff --git a/toolkit/components/alerts/nsAlertsService.cpp b/toolkit/components/alerts/nsAlertsService.cpp
index 2a0905e4981..e197dcd3f07 100644
--- a/toolkit/components/alerts/nsAlertsService.cpp
+++ b/toolkit/components/alerts/nsAlertsService.cpp
@@ -74,6 +74,33 @@ nsAlertsService::nsAlertsService()
 nsAlertsService::~nsAlertsService()
 {}
 
+bool nsAlertsService::ShouldShowAlert()
+{
+  bool result = true;
+
+#ifdef XP_WIN
+  HMODULE shellDLL = ::LoadLibraryW(L"shell32.dll");
+  if (!shellDLL)
+    return result;
+
+  SHQueryUserNotificationStatePtr pSHQueryUserNotificationState =
+    (SHQueryUserNotificationStatePtr) ::GetProcAddress(shellDLL, "SHQueryUserNotificationState");
+
+  if (pSHQueryUserNotificationState) {
+    MOZ_QUERY_USER_NOTIFICATION_STATE qstate;
+    if (SUCCEEDED(pSHQueryUserNotificationState(&qstate))) {
+      if (qstate != QUNS_ACCEPTS_NOTIFICATIONS) {
+         result = false;
+      }
+    }
+  }
+
+  ::FreeLibrary(shellDLL);
+#endif
+
+  return result;
+}
+
 NS_IMETHODIMP nsAlertsService::ShowAlertNotification(const nsAString & aImageUrl, const nsAString & aAlertTitle, 
                                                      const nsAString & aAlertText, bool aAlertTextClickable,
                                                      const nsAString & aAlertCookie,
@@ -110,6 +137,13 @@ NS_IMETHODIMP nsAlertsService::ShowAlertNotification(const nsAString & aImageUrl
       return rv;
   }
 
+  if (!ShouldShowAlert()) {
+    // Do not display the alert. Instead call alertfinished and get out.
+    if (aAlertListener)
+      aAlertListener->Observe(NULL, "alertfinished", PromiseFlatString(aAlertCookie).get());
+    return NS_OK;
+  }
+
   nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
   nsCOMPtr<nsIDOMWindow> newWindow;
 
diff --git a/toolkit/components/alerts/nsAlertsService.h b/toolkit/components/alerts/nsAlertsService.h
index 7153ac75cea..c3895633db1 100644
--- a/toolkit/components/alerts/nsAlertsService.h
+++ b/toolkit/components/alerts/nsAlertsService.h
@@ -42,6 +42,23 @@
 #include "nsIAlertsService.h"
 #include "nsCOMPtr.h"
 
+#ifdef XP_WIN
+typedef enum tagMOZ_QUERY_USER_NOTIFICATION_STATE {
+    QUNS_NOT_PRESENT = 1,
+    QUNS_BUSY = 2,
+    QUNS_RUNNING_D3D_FULL_SCREEN = 3,
+    QUNS_PRESENTATION_MODE = 4,
+    QUNS_ACCEPTS_NOTIFICATIONS = 5,
+    QUNS_QUIET_TIME = 6,
+    QUNS_IMMERSIVE = 7
+} MOZ_QUERY_USER_NOTIFICATION_STATE;
+
+extern "C" {
+// This function is Windows Vista or later
+typedef HRESULT (__stdcall *SHQueryUserNotificationStatePtr)(MOZ_QUERY_USER_NOTIFICATION_STATE *pquns);
+}
+#endif // defined(XP_WIN)
+
 class nsAlertsService : public nsIAlertsService,
                         public nsIAlertsProgressListener
 {
@@ -54,6 +71,7 @@ public:
   virtual ~nsAlertsService();
 
 protected:
+  bool ShouldShowAlert();
 };
 
 #endif /* nsAlertsService_h__ */
diff --git a/toolkit/components/alerts/nsIAlertsService.idl b/toolkit/components/alerts/nsIAlertsService.idl
index 7318b0f4026..8726438a9d1 100644
--- a/toolkit/components/alerts/nsIAlertsService.idl
+++ b/toolkit/components/alerts/nsIAlertsService.idl
@@ -70,6 +70,11 @@ interface nsIAlertsService : nsISupports
     *   topic   - "alertfinished" when the alert goes away
     *             "alertclickcallback" when the text is clicked
     *   data    - the value of the cookie parameter passed to showAlertNotification.
+    *
+    * @note Depending on current circumstances (if the user's in a fullscreen
+    *       application, for instance), the alert might not be displayed at all.
+    *       In that case, if an alert listener is passed in it will receive the
+    *       "alertfinished" notification immediately.
     */
    void showAlertNotification(in AString  imageUrl, 
                               in AString  title, 
diff --git a/toolkit/components/passwordmgr/test/test_bug_627616.html b/toolkit/components/passwordmgr/test/test_bug_627616.html
index e4f5f0892f5..eaa2d8982d9 100644
--- a/toolkit/components/passwordmgr/test/test_bug_627616.html
+++ b/toolkit/components/passwordmgr/test/test_bug_627616.html
@@ -49,8 +49,8 @@
                       "realm=mochirealm&" +
                       extra || "");
       xhr.onloadend = function() {
-        is(xhr.status, expectedStatus);
-        is(xhr.statusText, expectedText);
+        is(xhr.status, expectedStatus, "xhr.status");
+        is(xhr.statusText, expectedText, "xhr.statusText");
         runNextTest();
       }
       return xhr;
diff --git a/toolkit/components/places/mozIAsyncLivemarks.idl b/toolkit/components/places/mozIAsyncLivemarks.idl
index 15c6f43fe53..b49a63973f2 100644
--- a/toolkit/components/places/mozIAsyncLivemarks.idl
+++ b/toolkit/components/places/mozIAsyncLivemarks.idl
@@ -16,7 +16,7 @@ interface mozILivemark;
 
 interface nsINavHistoryResultObserver;
 
-[scriptable, uuid(addaa7c5-bd85-4c83-9c21-81c8a825c358)]
+[scriptable, uuid(1dbf174c-696e-4d9b-af0f-350da50d2249)]
 interface mozIAsyncLivemarks : nsISupports
 {
   /**
@@ -67,9 +67,15 @@ interface mozIAsyncLivemarks : nsISupports
                    in mozILivemarkCallback aCallback);
 
   /**
-   * Forces a reload of all livemarks, whether or not they've expired.
+   * Reloads all livemarks if they are expired or if forced to do so.
+   *
+   * @param [optional]aForceUpdate
+   *        If set to true forces a reload even if contents are still valid.
+   *
+   * @note The update process is asynchronous, observers registered through
+   *       registerForUpdates will be notified of updated contents.
    */
-  void reloadLivemarks();
+  void reloadLivemarks([optional]in boolean aForceUpdate);
 };
 
 [scriptable, function, uuid(62a426f9-39a6-42f0-ad48-b7404d48188f)]
diff --git a/toolkit/components/places/nsLivemarkService.js b/toolkit/components/places/nsLivemarkService.js
index f6f258f0378..da44f4f5a51 100644
--- a/toolkit/components/places/nsLivemarkService.js
+++ b/toolkit/components/places/nsLivemarkService.js
@@ -151,6 +151,7 @@ LivemarkService.prototype = {
     }
   },
 
+  _reloading: false,
   _startReloadTimer: function LS__startReloadTimer()
   {
     if (this._reloadTimer) {
@@ -160,6 +161,7 @@ LivemarkService.prototype = {
       this._reloadTimer = Cc["@mozilla.org/timer;1"]
                             .createInstance(Ci.nsITimer);
     }
+    this._reloading = true;
     this._reloadTimer.initWithCallback(this._reloadNextLivemark.bind(this),
                                        RELOAD_DELAY_MS,
                                        Ci.nsITimer.TYPE_ONE_SHOT);
@@ -179,6 +181,7 @@ LivemarkService.prototype = {
       }
 
       if (this._reloadTimer) {
+        this._reloading = false;
         this._reloadTimer.cancel();
         delete this._reloadTimer;
       }
@@ -363,7 +366,7 @@ LivemarkService.prototype = {
   {
     this._reportDeprecatedMethod();
 
-    this._reloadLivemarks();
+    this._reloadLivemarks(true);
   },
 
   //////////////////////////////////////////////////////////////////////////////
@@ -393,7 +396,15 @@ LivemarkService.prototype = {
         throw new Components.Exception("", Cr.NS_ERROR_INVALID_ARG);
       }
 
-      livemark = new Livemark(aLivemarkInfo);
+      // Don't pass unexpected input data to the livemark constructor.
+      livemark = new Livemark({ title:        aLivemarkInfo.title
+                              , parentId:     aLivemarkInfo.parentId
+                              , index:        aLivemarkInfo.index
+                              , feedURI:      aLivemarkInfo.feedURI
+                              , siteURI:      aLivemarkInfo.siteURI
+                              , guid:         aLivemarkInfo.guid
+                              , lastModified: aLivemarkInfo.lastModified
+                              });
       if (this._itemAdded && this._itemAdded.id == livemark.id) {
         livemark.index = this._itemAdded.index;
         if (!aLivemarkInfo.guid) {
@@ -469,20 +480,31 @@ LivemarkService.prototype = {
   _reloaded: [],
   _reloadNextLivemark: function LS__reloadNextLivemark()
   {
+    this._reloading = false;
     // Find first livemark to be reloaded.
     for (let id in this._livemarks) {
       if (this._reloaded.indexOf(id) == -1) {
         this._reloaded.push(id);
-        this._livemarks[id].reload();
+        this._livemarks[id].reload(this._forceUpdate);
         this._startReloadTimer();
         break;
       }
     }
   },
 
-  reloadLivemarks: function LS_reloadLivemarks()
+  reloadLivemarks: function LS_reloadLivemarks(aForceUpdate)
   {
+    // Check if there's a currently running reload, to save some useless work.
+    let notWorthRestarting =
+      this._forceUpdate || // We're already forceUpdating.
+      !aForceUpdate;       // The caller didn't request a forced update.
+    if (this._reloading && notWorthRestarting) {
+      // Ignore this call.
+      return;
+    } 
+
     this._onCacheReady((function LS_reloadAllLivemarks_ETAT() {
+      this._forceUpdate = !!aForceUpdate;
       this._reloaded = [];
       // Livemarks reloads happen on a timer, and are delayed for performance
       // reasons.
@@ -841,6 +863,10 @@ Livemark.prototype = {
 
     this.status = Ci.mozILivemark.STATUS_LOADING;
 
+    // Setting the status notifies observers that may remove the livemark.
+    if (this._terminated)
+      return;
+
     try {
       // Create a load group for the request.  This will allow us to
       // automatically keep track of redirects, so we can always
@@ -851,7 +877,7 @@ Livemark.prototype = {
                     QueryInterface(Ci.nsIHttpChannel);
       channel.loadGroup = loadgroup;
       channel.loadFlags |= Ci.nsIRequest.LOAD_BACKGROUND |
-                           Ci.nsIRequest.VALIDATE_ALWAYS;
+                           Ci.nsIRequest.LOAD_BYPASS_CACHE;
       channel.requestMethod = "GET";
       channel.setRequestHeader("X-Moz", "livebookmarks", false);
 
@@ -1003,6 +1029,8 @@ Livemark.prototype = {
    */
   terminate: function LM_terminate()
   {
+    // Avoid handling any updateChildren request from now on.
+    this._terminated = true;
     // Clear the list before aborting, since abort() would try to set the
     // status and notify about it, but that's not really useful at this point.
     this._resultObserversList = [];
diff --git a/toolkit/components/places/tests/chrome/Makefile.in b/toolkit/components/places/tests/chrome/Makefile.in
index 12e9f579d26..d29f83e5f08 100644
--- a/toolkit/components/places/tests/chrome/Makefile.in
+++ b/toolkit/components/places/tests/chrome/Makefile.in
@@ -61,6 +61,7 @@ _CHROME_FILES	= \
 		test_favicon_annotations.xul \
 		test_303567.xul \
 		test_381357.xul \
+		test_reloadLivemarks.xul \
 		$(NULL)
 
 libs:: $(_HTTP_FILES)
diff --git a/toolkit/components/places/tests/chrome/test_reloadLivemarks.xul b/toolkit/components/places/tests/chrome/test_reloadLivemarks.xul
new file mode 100644
index 00000000000..8b0a66261bd
--- /dev/null
+++ b/toolkit/components/places/tests/chrome/test_reloadLivemarks.xul
@@ -0,0 +1,148 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet
+  href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+<window title="Reload Livemarks"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="runTest()" onunload="cleanup()">
+  <script type="application/javascript"
+   src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <body xmlns="http://www.w3.org/1999/xhtml" />
+
+<script type="application/javascript">
+<![CDATA[
+// Test that for concurrent reload of livemarks.
+
+SimpleTest.waitForExplicitFinish();
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+const Cr = Components.results;
+
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+Components.utils.import("resource://gre/modules/NetUtil.jsm");
+Components.utils.import("resource://gre/modules/PlacesUtils.jsm");
+
+let gLivemarks = [
+  { id: -1,
+    title: "foo",
+    parentId: PlacesUtils.toolbarFolderId,
+    index: PlacesUtils.bookmarks.DEFAULT_INDEX,
+    feedURI: NetUtil.newURI("http://mochi.test:8888/tests/toolkit/components/places/tests/chrome/link-less-items.rss")
+  },
+  { id: -1,
+    title: "bar",
+    parentId: PlacesUtils.toolbarFolderId,
+    index: PlacesUtils.bookmarks.DEFAULT_INDEX,
+    feedURI: NetUtil.newURI("http://mochi.test:8888/tests/toolkit/components/places/tests/chrome/link-less-items-no-site-uri.rss")
+  },
+];
+
+function runTest()
+{
+  addLivemarks(function () {
+    reloadLivemarks(false, function () {
+      reloadLivemarks(true, function () {
+        removeLivemarks(SimpleTest.finish);
+      });
+    });
+    // Ensure this normal reload doesn't overwrite the forced one.
+    PlacesUtils.livemarks.reloadLivemarks();
+  });
+}
+
+function addLivemarks(aCallback) {
+  info("Adding livemarks");
+  let count = gLivemarks.length;
+  gLivemarks.forEach(function(aLivemarkData) {
+    PlacesUtils.livemarks.addLivemark(aLivemarkData,
+      function (aStatus, aLivemark) {
+        ok(Components.isSuccessCode(aStatus), "Add livemark should succeed");
+        aLivemarkData.id = aLivemark.id;
+        if (--count == 0) {
+          aCallback();
+        }
+      }
+    );
+  });
+}
+
+function reloadLivemarks(aForceUpdate, aCallback) {
+  info("Reloading livemarks with forceUpdate: " + aForceUpdate);
+  let count = gLivemarks.length;
+  gLivemarks.forEach(function(aLivemarkData) {
+    PlacesUtils.livemarks.getLivemark(aLivemarkData,
+      function (aStatus, aLivemark) {
+        ok(Components.isSuccessCode(aStatus), "Get livemark should succeed");
+        aLivemarkData._observer = new resultObserver(aLivemark, function() {
+          if (++count == gLivemarks.length) {
+            aCallback();
+          }
+        });
+        if (--count == 0) {
+          PlacesUtils.livemarks.reloadLivemarks(aForceUpdate);
+        }
+      }
+    );
+  });
+}
+
+function removeLivemarks(aCallback) {
+  info("Removing livemarks");
+  let count = gLivemarks.length;
+  gLivemarks.forEach(function(aLivemarkData) {
+    PlacesUtils.livemarks.removeLivemark(aLivemarkData,
+      function (aStatus, aLivemark) {
+        ok(Components.isSuccessCode(aStatus), "Remove livemark should succeed");
+        if (--count == 0) {
+          aCallback();
+        }
+      }
+    );
+  });
+}
+
+function resultObserver(aLivemark, aCallback) {
+  this._node = {};
+  this._livemark = aLivemark;
+  this._callback = aCallback;
+  this._livemark.registerForUpdates(this._node, this);
+}
+resultObserver.prototype = {
+  nodeInserted: function() {},
+  nodeRemoved: function() {},
+  nodeAnnotationChanged: function() {},
+  nodeTitleChanged: function() {},
+  nodeHistoryDetailsChanged: function() {},
+  nodeReplaced: function() {},
+  nodeMoved: function() {},
+  ontainerStateChanged: function () {},
+  sortingChanged: function() {},
+  batching: function() {},
+  invalidateContainer: function(aContainer) {
+    // Wait for load finish.
+    if (this._livemark.status == Ci.mozILivemark.STATUS_LOADING)
+      return;
+
+    this._terminate();
+    this._callback();
+  },
+  _terminate: function () {
+    if (!this._terminated) {
+      this._livemark.unregisterForUpdates(this._node);
+      this._terminated = true;
+    }
+  }
+};
+
+function cleanup() {
+  gLivemarks.forEach(function(aLivemarkData) {
+    if (aLivemarkData._observer)
+      aLivemarkData._observer._terminate();
+  });
+}
+]]>
+</script>
+</window>
diff --git a/toolkit/components/places/tests/unit/test_mozIAsyncLivemarks.js b/toolkit/components/places/tests/unit/test_mozIAsyncLivemarks.js
index 3a57d19317f..3fcc1a3167f 100644
--- a/toolkit/components/places/tests/unit/test_mozIAsyncLivemarks.js
+++ b/toolkit/components/places/tests/unit/test_mozIAsyncLivemarks.js
@@ -243,6 +243,24 @@ add_test(function test_addLivemark_callback_succeeds()
   });
 });
 
+add_test(function test_addLivemark_bogusid_callback_succeeds()
+{
+  PlacesUtils.livemarks.addLivemark({ id: 100 // Should be ignored.
+                                    , title: "test"
+                                    , parentId: PlacesUtils.unfiledBookmarksFolderId
+                                    , index: PlacesUtils.bookmarks.DEFAULT_INDEX
+                                    , feedURI: FEED_URI
+                                    , siteURI: SITE_URI
+                                    }, function (aStatus, aLivemark)
+  {
+    do_check_true(Components.isSuccessCode(aStatus));
+    do_check_true(aLivemark.id > 0);
+    do_check_neq(aLivemark.id, 100);
+
+    run_next_test();
+  });
+});
+
 add_test(function test_addLivemark_bogusParent_callback_fails()
 {
   PlacesUtils.livemarks.addLivemark({ title: "test"
diff --git a/toolkit/components/places/tests/unit/test_null_interfaces.js b/toolkit/components/places/tests/unit/test_null_interfaces.js
index 23fab10fbf0..f40efb9d1f9 100644
--- a/toolkit/components/places/tests/unit/test_null_interfaces.js
+++ b/toolkit/components/places/tests/unit/test_null_interfaces.js
@@ -56,7 +56,7 @@ let testServices = [
   ["browser/nav-bookmarks-service;1","nsINavBookmarksService",
     ["createFolder", "getItemIdForGUID"]],
   ["browser/livemark-service;2","nsILivemarkService", []],
-  ["browser/livemark-service;2","mozIAsyncLivemarks", []],
+  ["browser/livemark-service;2","mozIAsyncLivemarks", ["reloadLivemarks"]],
   ["browser/annotation-service;1","nsIAnnotationService", []],
   ["browser/favicon-service;1","nsIFaviconService", []],
   ["browser/tagging-service;1","nsITaggingService", []],
diff --git a/toolkit/components/telemetry/Telemetry.cpp b/toolkit/components/telemetry/Telemetry.cpp
index 46f97c14387..2b0ab6331fe 100644
--- a/toolkit/components/telemetry/Telemetry.cpp
+++ b/toolkit/components/telemetry/Telemetry.cpp
@@ -162,13 +162,11 @@ private:
   typedef AutoHashtable<AddonHistogramEntryType> AddonHistogramMapType;
   typedef nsBaseHashtableET<nsCStringHashKey, AddonHistogramMapType *> AddonEntryType;
   typedef AutoHashtable<AddonEntryType> AddonMapType;
-  struct AddonEnumeratorArgs {
-    JSContext *cx;
-    JSObject *obj;
-  };
   static bool AddonHistogramReflector(AddonHistogramEntryType *entry,
                                       JSContext *cx, JSObject *obj);
   static bool AddonReflector(AddonEntryType *entry, JSContext *cx, JSObject *obj);
+  static bool CreateHistogramForAddon(const nsACString &name,
+                                      AddonHistogramInfo &info);
   AddonMapType mAddonMap;
 
   // This is used for speedy string->Telemetry::ID conversions
@@ -205,6 +203,7 @@ struct TelemetryHistogram {
 // errors.
 #define HISTOGRAM(id, min, max, bucket_count, histogram_type, b) \
   PR_STATIC_ASSERT(nsITelemetry::HISTOGRAM_ ## histogram_type == nsITelemetry::HISTOGRAM_BOOLEAN || \
+                   nsITelemetry::HISTOGRAM_ ## histogram_type == nsITelemetry::HISTOGRAM_FLAG || \
                    (min < max && bucket_count > 2 && min >= 1));
 
 #include "TelemetryHistograms.h"
@@ -235,6 +234,8 @@ TelemetryHistogramType(Histogram *h, PRUint32 *result)
   case Histogram::BOOLEAN_HISTOGRAM:
     *result = nsITelemetry::HISTOGRAM_BOOLEAN;
     break;
+  case Histogram::FLAG_HISTOGRAM:
+    *result = nsITelemetry::HISTOGRAM_FLAG;
   default:
     return false;
   }
@@ -245,7 +246,8 @@ nsresult
 HistogramGet(const char *name, PRUint32 min, PRUint32 max, PRUint32 bucketCount,
              PRUint32 histogramType, Histogram **result)
 {
-  if (histogramType != nsITelemetry::HISTOGRAM_BOOLEAN) {
+  if (histogramType != nsITelemetry::HISTOGRAM_BOOLEAN
+      && histogramType != nsITelemetry::HISTOGRAM_FLAG) {
     // Sanity checks for histogram parameters.
     if (min >= max)
       return NS_ERROR_ILLEGAL_VALUE;
@@ -267,6 +269,9 @@ HistogramGet(const char *name, PRUint32 min, PRUint32 max, PRUint32 bucketCount,
   case nsITelemetry::HISTOGRAM_BOOLEAN:
     *result = BooleanHistogram::FactoryGet(name, Histogram::kUmaTargetedHistogramFlag);
     break;
+  case nsITelemetry::HISTOGRAM_FLAG:
+    *result = FlagHistogram::FactoryGet(name, Histogram::kUmaTargetedHistogramFlag);
+    break;
   default:
     return NS_ERROR_INVALID_ARG;
   }
@@ -735,25 +740,14 @@ TelemetryImpl::GetAddonHistogram(const nsACString &id, const nsACString &name,
   }
 
   AddonHistogramInfo &info = histogramEntry->mData;
-  Histogram *h;
-  if (info.h) {
-    h = info.h;
-  } else {
+  if (!info.h) {
     nsCAutoString actualName;
     AddonHistogramName(id, name, actualName);
-    nsresult rv = HistogramGet(PromiseFlatCString(actualName).get(),
-                               info.min, info.max, info.bucketCount,
-                               info.histogramType, &h);
-    if (NS_FAILED(rv)) {
-      return rv;
+    if (!CreateHistogramForAddon(actualName, info)) {
+      return NS_ERROR_FAILURE;
     }
-    // Don't let this histogram be reported via the normal means
-    // (e.g. Telemetry.registeredHistograms); we'll make it available in
-    // other ways.
-    h->ClearFlags(Histogram::kUmaTargetedHistogramFlag);
-    info.h = h;
   }
-  return WrapAndReturnHistogram(h, cx, ret);
+  return WrapAndReturnHistogram(info.h, cx, ret);
 }
 
 NS_IMETHODIMP
@@ -780,6 +774,16 @@ TelemetryImpl::GetHistogramSnapshots(JSContext *cx, jsval *ret)
     return NS_ERROR_FAILURE;
   *ret = OBJECT_TO_JSVAL(root_obj);
 
+  // Ensure that all the HISTOGRAM_FLAG histograms have been created, so
+  // that their values are snapshotted.
+  for (size_t i = 0; i < Telemetry::HistogramCount; ++i) {
+    if (gHistograms[i].histogramType == nsITelemetry::HISTOGRAM_FLAG) {
+      Histogram *h;
+      DebugOnly<nsresult> rv = GetHistogramByEnumId(Telemetry::ID(i), &h);
+      MOZ_ASSERT(NS_SUCCEEDED(rv));
+    }
+  };
+
   StatisticsRecorder::Histograms hs;
   StatisticsRecorder::GetHistograms(&hs);
 
@@ -821,13 +825,40 @@ TelemetryImpl::GetHistogramSnapshots(JSContext *cx, jsval *ret)
   return NS_OK;
 }
 
+bool
+TelemetryImpl::CreateHistogramForAddon(const nsACString &name,
+                                       AddonHistogramInfo &info)
+{
+  Histogram *h;
+  nsresult rv = HistogramGet(PromiseFlatCString(name).get(),
+                             info.min, info.max, info.bucketCount,
+                             info.histogramType, &h);
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+  // Don't let this histogram be reported via the normal means
+  // (e.g. Telemetry.registeredHistograms); we'll make it available in
+  // other ways.
+  h->ClearFlags(Histogram::kUmaTargetedHistogramFlag);
+  info.h = h;
+  return true;
+}
+
 bool
 TelemetryImpl::AddonHistogramReflector(AddonHistogramEntryType *entry,
                                        JSContext *cx, JSObject *obj)
 {
+  AddonHistogramInfo &info = entry->mData;
+
   // Never even accessed the histogram.
-  if (!entry->mData.h) {
-    return true;
+  if (!info.h) {
+    // Have to force creation of HISTOGRAM_FLAG histograms.
+    if (info.histogramType != nsITelemetry::HISTOGRAM_FLAG) 
+      return true;
+
+    if (!CreateHistogramForAddon(entry->GetKey(), info)) {
+      return false;
+    }
   }
 
   JSObject *snapshot = JS_NewObject(cx, NULL, NULL, NULL);
@@ -836,7 +867,7 @@ TelemetryImpl::AddonHistogramReflector(AddonHistogramEntryType *entry,
     return true;
   }
   JS::AutoObjectRooter r(cx, snapshot);
-  switch (ReflectHistogramSnapshot(cx, snapshot, entry->mData.h)) {
+  switch (ReflectHistogramSnapshot(cx, snapshot, info.h)) {
   case REFLECT_FAILURE:
   case REFLECT_CORRUPT:
     return false;
diff --git a/toolkit/components/telemetry/TelemetryHistograms.h b/toolkit/components/telemetry/TelemetryHistograms.h
index 8a8f923acfb..87f2739d59c 100644
--- a/toolkit/components/telemetry/TelemetryHistograms.h
+++ b/toolkit/components/telemetry/TelemetryHistograms.h
@@ -51,6 +51,8 @@
 
 /* Convenience macro for BOOLEAN histograms. */
 #define HISTOGRAM_BOOLEAN(id, message) HISTOGRAM(id, 0, 1, 2, BOOLEAN, message)
+/* Likewise for FLAG histograms. */
+#define HISTOGRAM_FLAG(id, message) HISTOGRAM(id, 0, 1, 2, FLAG, message)
 
 /**
  * a11y telemetry
@@ -102,6 +104,7 @@ HISTOGRAM(MEMORY_FREE_PURGED_PAGES_MS, 1, 1024, 10, EXPONENTIAL, "Time(ms) to pu
 #elif defined(XP_WIN)
 HISTOGRAM(LOW_MEMORY_EVENTS_VIRTUAL, 1, 1024, 21, EXPONENTIAL, "Number of low-virtual-memory events fired since last ping")
 HISTOGRAM(LOW_MEMORY_EVENTS_PHYSICAL, 1, 1024, 21, EXPONENTIAL, "Number of low-physical-memory events fired since last ping")
+HISTOGRAM(LOW_MEMORY_EVENTS_COMMIT_SPACE, 1, 1024, 21, EXPONENTIAL, "Number of low-commit-space events fired since last ping")
 #endif
 
 #if defined(XP_WIN)
@@ -132,6 +135,8 @@ HISTOGRAM(MAC_INITFONTLIST_TOTAL, 1, 30000, 10, EXPONENTIAL, "gfxMacPlatformFont
 
 HISTOGRAM(SYSTEM_FONT_FALLBACK, 1, 100000, 50, EXPONENTIAL, "System font fallback (us)")
 HISTOGRAM(SYSTEM_FONT_FALLBACK_FIRST, 1, 40000, 20, EXPONENTIAL, "System font fallback, first call (ms)")
+HISTOGRAM(SYSTEM_FONT_FALLBACK_SCRIPT, 1, 110, 111, LINEAR, "System font fallback script")
+
 HISTOGRAM(STARTUP_CACHE_AGE_HOURS, 1, 3000, 20, EXPONENTIAL, "Startup cache age (hours)")
 
 /**
@@ -144,6 +149,7 @@ HISTOGRAM(WORD_CACHE_LOOKUP_SCRIPT, 1, 110, 111, LINEAR, "Word cache lookup (scr
 HISTOGRAM(WORD_CACHE_HIT_SCRIPT, 1, 110, 111, LINEAR, "Word cache hit (script)")
 
 HISTOGRAM_BOOLEAN(FONT_CACHE_HIT, "font cache hit")
+HISTOGRAM_BOOLEAN(BAD_FALLBACK_FONT, "system fallback font can't be used")
 
 HISTOGRAM_BOOLEAN(SHUTDOWN_OK, "Did the browser start after a successful shutdown")
 
@@ -412,5 +418,7 @@ HISTOGRAM(RANGE_CHECKSUM_ERRORS, 1, 3000, 10, EXPONENTIAL, "Number of histograms
 HISTOGRAM(BUCKET_ORDER_ERRORS, 1, 3000, 10, EXPONENTIAL, "Number of histograms with bucket order errors")
 HISTOGRAM(TOTAL_COUNT_HIGH_ERRORS, 1, 3000, 10, EXPONENTIAL, "Number of histograms with total count high errors")
 HISTOGRAM(TOTAL_COUNT_LOW_ERRORS, 1, 3000, 10, EXPONENTIAL, "Number of histograms with total count low errors")
+HISTOGRAM_FLAG(TELEMETRY_TEST_FLAG, "a testing histogram; not meant to be touched")
 
 #undef HISTOGRAM_BOOLEAN
+#undef HISTOGRAM_FLAG
diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index 6ff1661c92d..cccf36fcfbd 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -67,6 +67,7 @@ const MEM_HISTOGRAMS = {
   "heap-allocated": "MEMORY_HEAP_ALLOCATED",
   "page-faults-hard": "PAGE_FAULTS_HARD",
   "low-memory-events-virtual": "LOW_MEMORY_EVENTS_VIRTUAL",
+  "low-memory-events-commit-space": "LOW_MEMORY_EVENTS_COMMIT_SPACE",
   "low-memory-events-physical": "LOW_MEMORY_EVENTS_PHYSICAL"
 };
 // Seconds of idle time before pinging.
@@ -634,7 +635,11 @@ TelemetryPing.prototype = {
    */
   uninstall: function uninstall() {
     this.detachObservers()
-    Services.obs.removeObserver(this, "sessionstore-windows-restored");
+    try {
+      Services.obs.removeObserver(this, "sessionstore-windows-restored");
+    } catch (e) {
+      // Already observed this event.
+    }
     Services.obs.removeObserver(this, "profile-before-change");
     Services.obs.removeObserver(this, "private-browsing");
     Services.obs.removeObserver(this, "quit-application-granted");
@@ -674,6 +679,9 @@ TelemetryPing.prototype = {
       }
       break;
     case "sessionstore-windows-restored":
+      Services.obs.removeObserver(this, "sessionstore-windows-restored");
+      // fall through
+    case "test-gather-startup":
       this.gatherStartupInformation();
       break;
     case "idle-daily":
diff --git a/toolkit/components/telemetry/nsITelemetry.idl b/toolkit/components/telemetry/nsITelemetry.idl
index 6cb6aa7c331..9714cab73f5 100644
--- a/toolkit/components/telemetry/nsITelemetry.idl
+++ b/toolkit/components/telemetry/nsITelemetry.idl
@@ -78,10 +78,12 @@ interface nsITelemetry : nsISupports
    * HISTOGRAM_EXPONENTIAL - buckets increase exponentially
    * HISTOGRAM_LINEAR - buckets increase linearly
    * HISTOGRAM_BOOLEAN - For storing 0/1 values
+   * HISTOGRAM_FLAG - For storing a single value; its count is always == 1.
    */
   const unsigned long HISTOGRAM_EXPONENTIAL = 0;
   const unsigned long HISTOGRAM_LINEAR = 1;
   const unsigned long HISTOGRAM_BOOLEAN = 2;
+  const unsigned long HISTOGRAM_FLAG = 3;
 
   /*
    * An object containing a snapshot from all of the currently registered histograms.
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
index 4b8c6aeef5c..6683d554486 100644
--- a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
@@ -29,7 +29,7 @@ var gFinished = false;
 
 function telemetry_ping () {
   const TelemetryPing = Cc["@mozilla.org/base/telemetry-ping;1"].getService(Ci.nsIObserver);
-  TelemetryPing.observe(null, "sessionstore-windows-restored", null);
+  TelemetryPing.observe(null, "test-gather-startup", null);
   TelemetryPing.observe(null, "test-ping", SERVER);
 }
 
@@ -121,6 +121,7 @@ function checkHistograms(request, response) {
 
   const TELEMETRY_PING = "TELEMETRY_PING";
   const TELEMETRY_SUCCESS = "TELEMETRY_SUCCESS";
+  const TELEMETRY_TEST_FLAG = "TELEMETRY_TEST_FLAG";
   do_check_true(TELEMETRY_PING in payload.histograms);
   let rh = Telemetry.registeredHistograms;
   for (let name in rh) {
@@ -131,6 +132,17 @@ function checkHistograms(request, response) {
   do_check_false(IGNORE_HISTOGRAM in payload.histograms);
   do_check_false(IGNORE_CLONED_HISTOGRAM in payload.histograms);
 
+  // Flag histograms should automagically spring to life.
+  const expected_flag = {
+    range: [1, 2],
+    bucket_count: 3,
+    histogram_type: 3,
+    values: {0:1, 1:0},
+    sum: 1
+  };
+  let flag = payload.histograms[TELEMETRY_TEST_FLAG];
+  do_check_eq(uneval(flag), uneval(expected_flag));
+
   // There should be one successful report from the previous telemetry ping.
   const expected_tc = {
     range: [1, 2],
diff --git a/toolkit/components/telemetry/tests/unit/test_nsITelemetry.js b/toolkit/components/telemetry/tests/unit/test_nsITelemetry.js
index 844f0471d43..91846219872 100644
--- a/toolkit/components/telemetry/tests/unit/test_nsITelemetry.js
+++ b/toolkit/components/telemetry/tests/unit/test_nsITelemetry.js
@@ -85,6 +85,32 @@ function test_boolean_histogram()
   do_check_eq(s.counts[0], 2);
 }
 
+function test_flag_histogram()
+{
+  var h = Telemetry.newHistogram("test::flag histogram", 130, 4, 5, Telemetry.HISTOGRAM_FLAG);
+  var r = h.snapshot().ranges;
+  // Flag histograms ignore numeric parameters.
+  do_check_eq(uneval(r), uneval([0, 1, 2]))
+  // Should already have a 0 counted.
+  var c = h.snapshot().counts;
+  var s = h.snapshot().sum;
+  do_check_eq(uneval(c), uneval([1, 0, 0]));
+  do_check_eq(s, 1);
+  // Should switch counts.
+  h.add(2);
+  var c2 = h.snapshot().counts;
+  var s2 = h.snapshot().sum;
+  do_check_eq(uneval(c2), uneval([0, 1, 0]));
+  do_check_eq(s, 1);
+  // Should only switch counts once.
+  h.add(3);
+  var c3 = h.snapshot().counts;
+  var s3 = h.snapshot().sum;
+  do_check_eq(uneval(c3), uneval([0, 1, 0]));
+  do_check_eq(s3, 1);
+  do_check_eq(h.snapshot().histogram_type, Telemetry.FLAG_HISTOGRAM);
+}
+
 function test_getHistogramById() {
   try {
     Telemetry.getHistogramById("nonexistent");
@@ -148,10 +174,19 @@ function test_addons() {
   expect_success(function ()
 		 register(extra_addon, name1, 0, 1, 2, Telemetry.HISTOGRAM_BOOLEAN));
 
+  // Check that we can register flag histograms.
+  var flag_addon = "testing-flag-addon";
+  var flag_histogram = "flag-histogram";
+  expect_success(function() 
+                 register(flag_addon, flag_histogram, 0, 1, 2, Telemetry.HISTOGRAM_FLAG))
+  expect_success(function()
+		 register(flag_addon, name2, 2, 4, 4, Telemetry.HISTOGRAM_LINEAR));
+
   // Check that we reflect registered addons and histograms.
   snapshots = Telemetry.addonHistogramSnapshots;
   do_check_true(addon_id in snapshots)
   do_check_true(extra_addon in snapshots);
+  do_check_true(flag_addon in snapshots);
 
   // Check that we have data for our created histograms.
   do_check_true(name1 in snapshots[addon_id]);
@@ -168,6 +203,10 @@ function test_addons() {
   // Even though we've registered it, it shouldn't show up until data is added to it.
   do_check_false(name1 in snapshots[extra_addon]);
 
+  // Flag histograms should show up automagically.
+  do_check_true(flag_histogram in snapshots[flag_addon]);
+  do_check_false(name2 in snapshots[flag_addon]);
+
   // Check that we can remove addon histograms.
   Telemetry.unregisterAddonHistograms(addon_id);
   snapshots = Telemetry.addonHistogramSnapshots;
diff --git a/toolkit/content/Makefile.in b/toolkit/content/Makefile.in
index 11c1ab5d00e..50d633c9b5f 100644
--- a/toolkit/content/Makefile.in
+++ b/toolkit/content/Makefile.in
@@ -55,6 +55,8 @@ DEFINES += \
   -DCXX_VERSION="$(CXX_VERSION)" \
   -DCXXFLAGS="$(CXXFLAGS)" \
   -DCPPFLAGS="$(CPPFLAGS)" \
+  -DMOZ_APP_NAME=$(MOZ_APP_NAME) \
+  -DMOZ_BUILD_APP=$(MOZ_BUILD_APP) \
   $(NULL)
 
 MOZ_SOURCE_STAMP ?= $(shell hg -R $(topsrcdir) parent --template="{node|short}\n" 2>/dev/null)
diff --git a/toolkit/content/aboutSupport.js b/toolkit/content/aboutSupport.js
index 1e648dad65d..8fbb2eb198a 100644
--- a/toolkit/content/aboutSupport.js
+++ b/toolkit/content/aboutSupport.js
@@ -38,6 +38,7 @@
 
 const Cc = Components.classes;
 const Ci = Components.interfaces;
+const Cu = Components.utils;
 
 Components.utils.import("resource://gre/modules/AddonManager.jsm");
 Components.utils.import("resource://gre/modules/Services.jsm");
@@ -113,6 +114,7 @@ window.onload = function () {
   document.getElementById("version-box").textContent = version;
 
   // Update the other sections.
+  populateResetBox();
   populatePreferencesSection();
   populateExtensionsSection();
   populateGraphicsSection();
@@ -561,3 +563,51 @@ function openProfileDirectory() {
                                            "nsILocalFile", "initWithPath");
   new nsLocalFile(profileDir).reveal();
 }
+
+/**
+ * Profile reset is only supported for the default profile if the appropriate migrator exists.
+ */
+function populateResetBox() {
+  let profileService = Cc["@mozilla.org/toolkit/profile-service;1"]
+                         .getService(Ci.nsIToolkitProfileService);
+  let currentProfileDir = Services.dirsvc.get("ProfD", Ci.nsIFile);
+
+#expand const MOZ_APP_NAME = "__MOZ_APP_NAME__";
+#expand const MOZ_BUILD_APP = "__MOZ_BUILD_APP__";
+
+  // Only show the reset box for the default profile if the self-migrator used for reset exists.
+  try {
+    if (!currentProfileDir.equals(profileService.selectedProfile.rootDir) ||
+        !("@mozilla.org/profile/migrator;1?app=" + MOZ_BUILD_APP + "&type=" + MOZ_APP_NAME in Cc))
+      return;
+    document.getElementById("reset-box").style.visibility = "visible";
+  } catch (e) {
+    // Catch exception when there is no selected profile.
+    Cu.reportError(e);
+  }
+}
+
+/**
+ * Restart the application to reset the profile.
+ */
+function resetProfileAndRestart() {
+  let branding = Services.strings.createBundle("chrome://branding/locale/brand.properties");
+  let brandShortName = branding.GetStringFromName("brandShortName");
+
+  // Prompt the user to confirm.
+  let retVals = {
+    reset: false,
+  };
+  window.openDialog("chrome://global/content/resetProfile.xul", null,
+                    "chrome,modal,centerscreen,titlebar,dialog=yes", retVals);
+  if (!retVals.reset)
+    return;
+
+  // Set the reset profile environment variable.
+  let env = Cc["@mozilla.org/process/environment;1"]
+              .getService(Ci.nsIEnvironment);
+  env.set("MOZ_RESET_PROFILE_RESTART", "1");
+
+  let appStartup = Cc["@mozilla.org/toolkit/app-startup;1"].getService(Ci.nsIAppStartup);
+  appStartup.quit(Ci.nsIAppStartup.eForceQuit | Ci.nsIAppStartup.eRestart);
+}
diff --git a/toolkit/content/aboutSupport.xhtml b/toolkit/content/aboutSupport.xhtml
index e92194bdcc6..a392b9a1424 100644
--- a/toolkit/content/aboutSupport.xhtml
+++ b/toolkit/content/aboutSupport.xhtml
@@ -42,6 +42,7 @@
   <!ENTITY % globalDTD SYSTEM "chrome://global/locale/global.dtd"> %globalDTD;
   <!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd"> %brandDTD;
   <!ENTITY % aboutSupportDTD SYSTEM "chrome://global/locale/aboutSupport.dtd"> %aboutSupportDTD;
+  <!ENTITY % resetProfileDTD SYSTEM "chrome://global/locale/resetProfile.dtd"> %resetProfileDTD;
 ]>
 
 <html xmlns="http://www.w3.org/1999/xhtml">
@@ -57,6 +58,14 @@
 
   <body dir="&locale.dir;">
 
+    <div id="reset-box" style="visibility: hidden">
+      <h3>&resetProfile.title;</h3>
+      <p>&resetProfile.description;</p>
+      <button onclick="resetProfileAndRestart()">
+        &resetProfile.button.label;
+      </button>
+    </div>
+
     <h1>
       &aboutSupport.pageTitle;
     </h1>
diff --git a/toolkit/content/jar.mn b/toolkit/content/jar.mn
index afc8549acd0..6f0d2d6367f 100644
--- a/toolkit/content/jar.mn
+++ b/toolkit/content/jar.mn
@@ -37,6 +37,9 @@ toolkit.jar:
 *+ content/global/globalOverlay.js            (globalOverlay.js)
 +  content/global/mozilla.xhtml               (mozilla.xhtml)
 *+ content/global/nsDragAndDrop.js            (nsDragAndDrop.js)
+   content/global/resetProfile.css            (resetProfile.css)
+*  content/global/resetProfile.js             (resetProfile.js)
+*  content/global/resetProfile.xul            (resetProfile.xul)
 *  content/global/treeUtils.js                (treeUtils.js)
 *+ content/global/viewZoomOverlay.js          (viewZoomOverlay.js)
 *+ content/global/bindings/autocomplete.xml    (widgets/autocomplete.xml)
diff --git a/toolkit/content/resetProfile.css b/toolkit/content/resetProfile.css
new file mode 100644
index 00000000000..2a8114801a6
--- /dev/null
+++ b/toolkit/content/resetProfile.css
@@ -0,0 +1,11 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#migratedItems {
+  -moz-margin-start: 1.5em;
+}
+
+#resetProfileFooter {
+  font-weight: bold;
+}
diff --git a/toolkit/content/resetProfile.js b/toolkit/content/resetProfile.js
new file mode 100644
index 00000000000..975a9edcb64
--- /dev/null
+++ b/toolkit/content/resetProfile.js
@@ -0,0 +1,35 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+// based on onImportItemsPageShow from migration.js
+function onResetProfileLoad() {
+#expand const MOZ_BUILD_APP = "__MOZ_BUILD_APP__";
+#expand const MOZ_APP_NAME = "__MOZ_APP_NAME__";
+  const MAX_MIGRATED_TYPES = 16;
+
+  var migratedItems = document.getElementById("migratedItems");
+  var bundle = Services.strings.createBundle("chrome://" + MOZ_BUILD_APP +
+                                             "/locale/migration/migration.properties");
+
+  // Loop over possible data to migrate to give the user a list of what will be preserved. This
+  // assumes that if the string for the data exists then it will be migrated since calling
+  // getMigrateData now won't give the correct result.
+  for (var i = 1; i < MAX_MIGRATED_TYPES; ++i) {
+    var itemID = Math.pow(2, i);
+    try {
+      var checkbox = document.createElement("label");
+      checkbox.setAttribute("value", bundle.GetStringFromName(itemID + "_" + MOZ_APP_NAME));
+      migratedItems.appendChild(checkbox);
+    } catch (x) {
+      // Catch exceptions when the string for a data type doesn't exist because it's not migrated
+    }
+  }
+}
+
+function onResetProfileAccepted() {
+  var retVals = window.arguments[0];
+  retVals.reset = true;
+}
diff --git a/toolkit/content/resetProfile.xul b/toolkit/content/resetProfile.xul
new file mode 100644
index 00000000000..bd2ee2627b1
--- /dev/null
+++ b/toolkit/content/resetProfile.xul
@@ -0,0 +1,36 @@
+<?xml version="1.0"?>
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this file,
+# You can obtain one at http://mozilla.org/MPL/2.0/.
+
+<!DOCTYPE prefwindow [
+<!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd" >
+%brandDTD;
+<!ENTITY % resetProfileDTD SYSTEM "chrome://global/locale/resetProfile.dtd" >
+%resetProfileDTD;
+]>
+
+<?xml-stylesheet href="chrome://global/skin/"?>
+<?xml-stylesheet href="chrome://global/content/resetProfile.css"?>
+
+<dialog id="resetProfileDialog"
+            xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+            title="&resetProfile.dialog.title;"
+            buttons="accept,cancel"
+            buttonlabelaccept="&resetProfile.dialog.button.label;"
+            ondialogaccept="return onResetProfileAccepted();"
+            ondialogcancel="window.close();"
+            onload="onResetProfileLoad();">
+
+  <script type="application/javascript" src="chrome://global/content/resetProfile.js"/>
+
+  <description>&resetProfile.dialog.description;</description>
+
+  <label value="&resetProfile.dialog.items.label;"/>
+  <vbox id="migratedItems">
+  </vbox>
+
+  <label id="resetProfileFooter" value="&resetProfile.dialog.footer.label;"/>
+
+</dialog>
diff --git a/toolkit/devtools/debugger/dbg-client.jsm b/toolkit/devtools/debugger/dbg-client.jsm
index 76d392a044f..0b5d6e00972 100644
--- a/toolkit/devtools/debugger/dbg-client.jsm
+++ b/toolkit/devtools/debugger/dbg-client.jsm
@@ -23,6 +23,7 @@
  * Contributor(s):
  *   Dave Camp <dcamp@mozilla.com> (original author)
  *   Panos Astithas <past@mozilla.com>
+ *   Mihai Sucan <mihai.sucan@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -50,14 +51,19 @@ var EXPORTED_SYMBOLS = ["DebuggerTransport",
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/NetUtil.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
 
 XPCOMUtils.defineLazyServiceGetter(this, "socketTransportService",
                                    "@mozilla.org/network/socket-transport-service;1",
                                    "nsISocketTransportService");
 
+let wantLogging = Services.prefs.getBoolPref("devtools.debugger.log");
+
 function dumpn(str)
 {
-  dump("DBG-CLIENT: " + str + "\n");
+  if (wantLogging) {
+    dump("DBG-CLIENT: " + str + "\n");
+  }
 }
 
 let loader = Cc["@mozilla.org/moz/jssubscript-loader;1"]
@@ -644,7 +650,8 @@ ThreadClient.prototype = {
               }
               return;
             }
-            let bpClient = new BreakpointClient(this._client, aResponse.actor);
+            let bpClient = new BreakpointClient(this._client, aResponse.actor,
+                                                aLocation);
             if (aCallback) {
               aCallback(aOnResponse(aResponse, bpClient));
             } else {
@@ -951,10 +958,14 @@ GripClient.prototype = {
  *        The debugger client parent.
  * @param aActor string
  *        The actor ID for this breakpoint.
+ * @param aLocation object
+ *        The location of the breakpoint. This is an object with two properties:
+ *        url and line.
  */
-function BreakpointClient(aClient, aActor) {
+function BreakpointClient(aClient, aActor, aLocation) {
   this._client = aClient;
   this._actor = aActor;
+  this.location = aLocation;
 }
 
 BreakpointClient.prototype = {
diff --git a/toolkit/devtools/debugger/server/dbg-browser-actors.js b/toolkit/devtools/debugger/server/dbg-browser-actors.js
index bb7798eb6fe..02e95c21ef3 100644
--- a/toolkit/devtools/debugger/server/dbg-browser-actors.js
+++ b/toolkit/devtools/debugger/server/dbg-browser-actors.js
@@ -97,6 +97,10 @@ BrowserRootActor.prototype = {
     while (e.hasMoreElements()) {
       let win = e.getNext();
       this.unwatchWindow(win);
+      // Signal our imminent shutdown.
+      let evt = win.document.createEvent("Event");
+      evt.initEvent("Debugger:Shutdown", true, false);
+      win.document.documentElement.dispatchEvent(evt);
     }
   },
 
@@ -415,6 +419,10 @@ BrowserTabActor.prototype = {
    * Prepare to enter a nested event loop by disabling debuggee events.
    */
   preNest: function BTA_preNest() {
+    if (!this.browser) {
+      // The tab is already closed.
+      return;
+    }
     let windowUtils = this.browser.contentWindow
                           .QueryInterface(Ci.nsIInterfaceRequestor)
                           .getInterface(Ci.nsIDOMWindowUtils);
@@ -426,6 +434,10 @@ BrowserTabActor.prototype = {
    * Prepare to exit a nested event loop by enabling debuggee events.
    */
   postNest: function BTA_postNest(aNestData) {
+    if (!this.browser) {
+      // The tab is already closed.
+      return;
+    }
     let windowUtils = this.browser.contentWindow
                           .QueryInterface(Ci.nsIInterfaceRequestor)
                           .getInterface(Ci.nsIDOMWindowUtils);
diff --git a/toolkit/devtools/debugger/server/dbg-server.jsm b/toolkit/devtools/debugger/server/dbg-server.jsm
index 719b93bfba2..fa33a01f8ef 100644
--- a/toolkit/devtools/debugger/server/dbg-server.jsm
+++ b/toolkit/devtools/debugger/server/dbg-server.jsm
@@ -50,6 +50,9 @@ const Cu = Components.utils;
 
 var EXPORTED_SYMBOLS = ["DebuggerServer"];
 
+Cu.import("resource://gre/modules/Services.jsm");
+let wantLogging = Services.prefs.getBoolPref("devtools.debugger.log");
+
 function loadSubScript(aURL)
 {
   try {
@@ -57,14 +60,16 @@ function loadSubScript(aURL)
       .getService(Components.interfaces.mozIJSSubScriptLoader);
     loader.loadSubScript(aURL, this);
   } catch(e) {
-    dump("Error loading: " + aURL + ": " + e + " - " + e.stack + "\n");
+    dumpn("Error loading: " + aURL + ": " + e + " - " + e.stack + "\n");
 
     throw e;
   }
 }
 
 function dumpn(str) {
-  dump("DBG-SERVER: " + str + "\n");
+  if (wantLogging) {
+    dump("DBG-SERVER: " + str + "\n");
+  }
 }
 
 function dbg_assert(cond, e) {
diff --git a/toolkit/devtools/debugger/tests/unit/test_frameclient-01.js b/toolkit/devtools/debugger/tests/unit/test_frameclient-01.js
index 4aa580d7314..dc88449a078 100644
--- a/toolkit/devtools/debugger/tests/unit/test_frameclient-01.js
+++ b/toolkit/devtools/debugger/tests/unit/test_frameclient-01.js
@@ -42,7 +42,6 @@ function test_pause_frame()
   gDebuggee.eval("(" + function() {
     var recurseLeft = 5;
     function recurse() {
-      dump(recurseLeft);
       if (--recurseLeft == 0) {
         debugger;
         return;
diff --git a/toolkit/devtools/debugger/tests/unit/test_pauselifetime-04.js b/toolkit/devtools/debugger/tests/unit/test_pauselifetime-04.js
index 31b9962b1a9..5b55671b046 100644
--- a/toolkit/devtools/debugger/tests/unit/test_pauselifetime-04.js
+++ b/toolkit/devtools/debugger/tests/unit/test_pauselifetime-04.js
@@ -32,7 +32,6 @@ function test_pause_frame()
 
     gThreadClient.getFrames(0, 1, function(aResponse) {
       let frame = aResponse.frames[0];
-      dump(JSON.stringify(frame));
       do_check_eq(objActor1, frame.arguments[0].actor);
       gThreadClient.resume(function () {
         finishClient(gClient);
diff --git a/toolkit/library/Makefile.in b/toolkit/library/Makefile.in
index cf1c7bee2be..4878d53fe87 100644
--- a/toolkit/library/Makefile.in
+++ b/toolkit/library/Makefile.in
@@ -398,9 +398,6 @@ OS_LIBS += \
   -lbinder \
   -lsensorservice \
   $(NULL)
-ifdef MOZ_B2G_BT
-OS_LIBS += -lbluedroid
-endif
 endif
 
 EXTRA_DEPS += \
diff --git a/toolkit/locales/en-US/chrome/global/resetProfile.dtd b/toolkit/locales/en-US/chrome/global/resetProfile.dtd
new file mode 100644
index 00000000000..8b27b7b6c3c
--- /dev/null
+++ b/toolkit/locales/en-US/chrome/global/resetProfile.dtd
@@ -0,0 +1,13 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this file,
+   - You can obtain one at http://mozilla.org/MPL/2.0/.  -->
+
+<!ENTITY resetProfile.dialog.title        "Reset &brandShortName;">
+<!ENTITY resetProfile.dialog.description  "Are you sure you want to reset &brandShortName; to its initial state?">
+<!ENTITY resetProfile.dialog.items.label  "The following will be preserved:">
+<!ENTITY resetProfile.dialog.footer.label "&brandShortName; will restart and everything else will be removed.">
+<!ENTITY resetProfile.dialog.button.label "Reset &brandShortName;">
+
+<!ENTITY resetProfile.title               "Reset &brandShortName; to its default state">
+<!ENTITY resetProfile.description         "If you're having major problems which you can't resolve, start fresh with only your essential information.">
+<!ENTITY resetProfile.button.label        "Reset &brandShortName;">
diff --git a/toolkit/locales/jar.mn b/toolkit/locales/jar.mn
index e88a41d5510..da8a17925e4 100644
--- a/toolkit/locales/jar.mn
+++ b/toolkit/locales/jar.mn
@@ -52,6 +52,7 @@
   locale/@AB_CD@/global/printdialog.properties          (%chrome/global/printdialog.properties)
 + locale/@AB_CD@/global/printProgress.dtd               (%chrome/global/printProgress.dtd)
 + locale/@AB_CD@/global/regionNames.properties          (%chrome/global/regionNames.properties)
+  locale/@AB_CD@/global/resetProfile.dtd                (%chrome/global/resetProfile.dtd)
 + locale/@AB_CD@/global/dialog.properties               (%chrome/global/dialog.properties)
 + locale/@AB_CD@/global/tree.dtd                        (%chrome/global/tree.dtd)
 + locale/@AB_CD@/global/textcontext.dtd                 (%chrome/global/textcontext.dtd)
diff --git a/toolkit/mozapps/extensions/AddonManager.jsm b/toolkit/mozapps/extensions/AddonManager.jsm
index 8e58d50c1b5..e390473e87a 100644
--- a/toolkit/mozapps/extensions/AddonManager.jsm
+++ b/toolkit/mozapps/extensions/AddonManager.jsm
@@ -51,7 +51,7 @@ const PREF_EM_LAST_PLATFORM_VERSION   = "extensions.lastPlatformVersion";
 const PREF_EM_AUTOUPDATE_DEFAULT      = "extensions.update.autoUpdateDefault";
 const PREF_EM_STRICT_COMPATIBILITY    = "extensions.strictCompatibility";
 const PREF_EM_CHECK_UPDATE_SECURITY   = "extensions.checkUpdateSecurity";
-const PREF_EM_UPDATE_URL              = "extensions.update.url";
+const PREF_EM_UPDATE_BACKGROUND_URL   = "extensions.update.background.url";
 const PREF_APP_UPDATE_ENABLED         = "app.update.enabled";
 const PREF_APP_UPDATE_AUTO            = "app.update.auto";
 const PREF_EM_HOTFIX_ID               = "extensions.hotfix.id";
@@ -902,7 +902,7 @@ var AddonManagerInternal = {
       if (Services.prefs.getPrefType(PREF_EM_HOTFIX_URL) == Ci.nsIPrefBranch.PREF_STRING)
         url = Services.prefs.getCharPref(PREF_EM_HOTFIX_URL);
       else
-        url = Services.prefs.getCharPref(PREF_EM_UPDATE_URL);
+        url = Services.prefs.getCharPref(PREF_EM_UPDATE_BACKGROUND_URL);
 
       // Build the URI from a fake add-on data.
       url = AddonManager.escapeAddonURI({
diff --git a/toolkit/mozapps/extensions/XPIProvider.jsm b/toolkit/mozapps/extensions/XPIProvider.jsm
index 838dac9eacf..6ad1baf30b3 100644
--- a/toolkit/mozapps/extensions/XPIProvider.jsm
+++ b/toolkit/mozapps/extensions/XPIProvider.jsm
@@ -65,6 +65,7 @@ const PREF_DSS_SWITCHPENDING          = "extensions.dss.switchPending";
 const PREF_DSS_SKIN_TO_SELECT         = "extensions.lastSelectedSkin";
 const PREF_GENERAL_SKINS_SELECTEDSKIN = "general.skins.selectedSkin";
 const PREF_EM_UPDATE_URL              = "extensions.update.url";
+const PREF_EM_UPDATE_BACKGROUND_URL   = "extensions.update.background.url";
 const PREF_EM_ENABLED_ADDONS          = "extensions.enabledAddons";
 const PREF_EM_EXTENSION_FORMAT        = "extensions.";
 const PREF_EM_ENABLED_SCOPES          = "extensions.enabledScopes";
@@ -6927,8 +6928,15 @@ function UpdateChecker(aAddon, aListener, aReason, aAppVersion, aPlatformVersion
   this.platformVersion = aPlatformVersion;
   this.syncCompatibility = (aReason == AddonManager.UPDATE_WHEN_NEW_APP_INSTALLED);
 
-  let updateURL = aAddon.updateURL ? aAddon.updateURL :
-                                     Services.prefs.getCharPref(PREF_EM_UPDATE_URL);
+  let updateURL = aAddon.updateURL;
+  if (!updateURL) {
+    if (aReason == AddonManager.UPDATE_WHEN_PERIODIC_UPDATE &&
+        Services.prefs.getPrefType(PREF_EM_UPDATE_BACKGROUND_URL) == Services.prefs.PREF_STRING) {
+      updateURL = Services.prefs.getCharPref(PREF_EM_UPDATE_BACKGROUND_URL);
+    } else {
+      updateURL = Services.prefs.getCharPref(PREF_EM_UPDATE_URL);
+    }
+  }
 
   const UPDATE_TYPE_COMPATIBILITY = 32;
   const UPDATE_TYPE_NEWVERSION = 64;
diff --git a/toolkit/mozapps/extensions/content/extensions.js b/toolkit/mozapps/extensions/content/extensions.js
index 3c83b4b9174..81d51448b74 100644
--- a/toolkit/mozapps/extensions/content/extensions.js
+++ b/toolkit/mozapps/extensions/content/extensions.js
@@ -2756,6 +2756,12 @@ var gDetailView = {
     AddonManager.removeManagerListener(this);
     this.clearLoading();
     if (this._addon) {
+      if (this._addon.optionsType == AddonManager.OPTIONS_TYPE_INLINE) {
+        Services.obs.notifyObservers(document,
+                                     "addon-options-hidden",
+                                     this._addon.id);
+      }
+
       gEventManager.unregisterAddonListener(this, this._addon.id);
       gEventManager.unregisterInstallListener(this);
       this._addon = null;
@@ -2947,8 +2953,14 @@ var gDetailView = {
     this.fillSettingsRows();
   },
 
-  onDisabling: function() {
+  onDisabling: function(aNeedsRestart) {
     this.updateState();
+    if (!aNeedsRestart &&
+        this._addon.optionsType == AddonManager.OPTIONS_TYPE_INLINE) {
+      Services.obs.notifyObservers(document,
+                                   "addon-options-hidden",
+                                   this._addon.id);
+    }
   },
 
   onDisabled: function() {
diff --git a/toolkit/mozapps/extensions/content/setting.xml b/toolkit/mozapps/extensions/content/setting.xml
index a0af4a601e8..7ea8ed18ee3 100644
--- a/toolkit/mozapps/extensions/content/setting.xml
+++ b/toolkit/mozapps/extensions/content/setting.xml
@@ -293,7 +293,7 @@
         <xul:description class="preferences-description" flex="1" xbl:inherits="xbl:text=desc"/>
       </xul:vbox>
       <xul:hbox class="preferences-alignment">
-        <children includes="button|menulist"/>
+        <children/>
       </xul:hbox>
     </content>
   </binding>
diff --git a/toolkit/mozapps/extensions/test/browser/browser_inlinesettings.js b/toolkit/mozapps/extensions/test/browser/browser_inlinesettings.js
index 849c11cc7c1..3a2602a1420 100644
--- a/toolkit/mozapps/extensions/test/browser/browser_inlinesettings.js
+++ b/toolkit/mozapps/extensions/test/browser/browser_inlinesettings.js
@@ -14,10 +14,25 @@ var MockFilePicker = SpecialPowers.MockFilePicker;
 MockFilePicker.init();
 
 var observer = {
-  lastData: null,
+  lastDisplayed: null,
+  checkDisplayed: function(aExpected) {
+    is(this.lastDisplayed, aExpected, "'addon-options-displayed' notification should have fired");
+    this.lastDisplayed = null;
+  },
+  checkNotDisplayed: function() {
+    is(this.lastDisplayed, null, "'addon-options-displayed' notification should not have fired");
+  },
+  lastHidden: null,
+  checkHidden: function(aExpected) {
+    is(this.lastHidden, aExpected, "'addon-options-hidden' notification should have fired");
+    this.lastHidden = null;
+  },
+  checkNotHidden: function() {
+    is(this.lastHidden, null, "'addon-options-hidden' notification should not have fired");
+  },
   observe: function(aSubject, aTopic, aData) {
     if (aTopic == "addon-options-displayed") {
-      this.lastData = aData;
+      this.lastDisplayed = aData;
       // Test if the binding has applied before the observers are notified. We test the second setting here,
       // because the code operates on the first setting and we want to check it applies to all.
       var setting = aSubject.querySelector("rows > setting[first-row] ~ setting");
@@ -26,6 +41,8 @@ var observer = {
 
       // Add some extra height to the scrolling pane to ensure that it needs to scroll when appropriate.
       gManagerWindow.document.getElementById("detail-controls").style.marginBottom = "1000px";
+    } else if (aTopic == "addon-options-hidden") {
+      this.lastHidden = aData;
     }
   }
 };
@@ -63,7 +80,8 @@ function test() {
     name: "Inline Settings (Regular)",
     version: "1",
     optionsURL: CHROMEROOT + "options.xul",
-    optionsType: AddonManager.OPTIONS_TYPE_INLINE
+    optionsType: AddonManager.OPTIONS_TYPE_INLINE,
+    operationsRequiringRestart: AddonManager.OP_NEEDS_RESTART_DISABLE,
   },{
     id: "inlinesettings3@tests.mozilla.org",
     name: "Inline Settings (More Options)",
@@ -84,6 +102,7 @@ function test() {
       gCategoryUtilities = new CategoryUtilities(gManagerWindow);
 
       Services.obs.addObserver(observer, "addon-options-displayed", false);
+      Services.obs.addObserver(observer, "addon-options-hidden", false);
 
       run_next_test();
     });
@@ -108,6 +127,9 @@ function end_test() {
   MockFilePicker.cleanup();
 
   close_manager(gManagerWindow, function() {
+    observer.checkHidden("inlinesettings2@tests.mozilla.org");
+    Services.obs.removeObserver(observer, "addon-options-hidden");
+
     AddonManager.getAddonByID("inlinesettings1@tests.mozilla.org", function(aAddon) {
       aAddon.uninstall();
       finish();
@@ -160,7 +182,7 @@ add_test(function() {
   EventUtils.synthesizeMouseAtCenter(button, { clickCount: 1 }, gManagerWindow);
 
   wait_for_view_load(gManagerWindow, function() {
-    is(observer.lastData, "inlinesettings1@tests.mozilla.org", "Observer notification should have fired");
+    observer.checkDisplayed("inlinesettings1@tests.mozilla.org");
     is(gManagerWindow.gViewController.currentViewId,
        "addons://detail/inlinesettings1%40tests.mozilla.org/preferences",
        "Current view should scroll to preferences");
@@ -297,6 +319,8 @@ add_test(function() {
 
 // Tests for the setting.xml bindings introduced after Mozilla 7
 add_test(function() {
+  observer.checkHidden("inlinesettings1@tests.mozilla.org");
+
   var addon = get_addon_element(gManagerWindow, "inlinesettings3@tests.mozilla.org");
   addon.parentNode.ensureElementIsVisible(addon);
 
@@ -304,7 +328,7 @@ add_test(function() {
   EventUtils.synthesizeMouseAtCenter(button, { clickCount: 1 }, gManagerWindow);
 
   wait_for_view_load(gManagerWindow, function() {
-    is(observer.lastData, "inlinesettings3@tests.mozilla.org", "Observer notification should have fired");
+    observer.checkDisplayed("inlinesettings3@tests.mozilla.org");
 
     var grid = gManagerWindow.document.getElementById("detail-grid");
     var settings = grid.querySelectorAll("rows > setting");
@@ -360,6 +384,8 @@ add_test(function() {
 
 // Addon with inline preferences as optionsURL
 add_test(function() {
+  observer.checkHidden("inlinesettings3@tests.mozilla.org");
+
   var addon = get_addon_element(gManagerWindow, "inlinesettings2@tests.mozilla.org");
   addon.parentNode.ensureElementIsVisible(addon);
 
@@ -367,7 +393,7 @@ add_test(function() {
   EventUtils.synthesizeMouseAtCenter(button, { clickCount: 1 }, gManagerWindow);
 
   wait_for_view_load(gManagerWindow, function() {
-    is(observer.lastData, "inlinesettings2@tests.mozilla.org", "Observer notification should have fired");
+    observer.checkDisplayed("inlinesettings2@tests.mozilla.org");
 
     var grid = gManagerWindow.document.getElementById("detail-grid");
     var settings = grid.querySelectorAll("rows > setting");
@@ -411,6 +437,8 @@ add_test(function() {
 
 // Addon with non-inline preferences as optionsURL
 add_test(function() {
+  observer.checkHidden("inlinesettings2@tests.mozilla.org");
+
   var addon = get_addon_element(gManagerWindow, "noninlinesettings@tests.mozilla.org");
   addon.parentNode.ensureElementIsVisible(addon);
 
@@ -418,7 +446,7 @@ add_test(function() {
   EventUtils.synthesizeMouseAtCenter(button, { clickCount: 1 }, gManagerWindow);
 
   wait_for_view_load(gManagerWindow, function() {
-    is(observer.lastData, "inlinesettings2@tests.mozilla.org", "Observer notification should not have fired");
+    observer.checkNotDisplayed();
 
     var grid = gManagerWindow.document.getElementById("detail-grid");
     var settings = grid.querySelectorAll("rows > setting");
@@ -433,6 +461,8 @@ add_test(function() {
 
 // Addon with options.xul, disabling and enabling should hide and show settings UI
 add_test(function() {
+  observer.checkNotHidden();
+
   var addon = get_addon_element(gManagerWindow, "inlinesettings1@tests.mozilla.org");
   addon.parentNode.ensureElementIsVisible(addon);
 
@@ -440,6 +470,7 @@ add_test(function() {
   EventUtils.synthesizeMouseAtCenter(button, { clickCount: 1 }, gManagerWindow);
 
   wait_for_view_load(gManagerWindow, function() {
+    observer.checkDisplayed("inlinesettings1@tests.mozilla.org");
     is(gManagerWindow.gViewController.currentViewId,
        "addons://detail/inlinesettings1%40tests.mozilla.org",
        "Current view should not scroll to preferences");
@@ -454,6 +485,8 @@ add_test(function() {
     button.focus(); // make sure it's in view
     EventUtils.synthesizeMouseAtCenter(button, { clickCount: 1 }, gManagerWindow);
 
+    observer.checkHidden("inlinesettings1@tests.mozilla.org");
+
     settings = grid.querySelectorAll("rows > setting");
     is(settings.length, 0, "Grid should not have settings children");
 
@@ -472,13 +505,11 @@ add_test(function() {
         var settings = grid.querySelectorAll("rows > setting");
         is(settings.length, 0, "Grid should not have settings children");
         
-        observer.lastData = null;
-
         // enable
         var button = gManagerWindow.document.getElementById("detail-enable-btn");
         EventUtils.synthesizeMouseAtCenter(button, { clickCount: 1 }, gManagerWindow);
 
-        is(observer.lastData, "inlinesettings1@tests.mozilla.org", "Observer notification should have fired");
+        observer.checkDisplayed("inlinesettings1@tests.mozilla.org");
 
         settings = grid.querySelectorAll("rows > setting");
         is(settings.length, SETTINGS_ROWS, "Grid should have settings children");
@@ -488,3 +519,41 @@ add_test(function() {
     });
   });
 });
+
+
+// Addon with options.xul that requires a restart to disable,
+// disabling and enabling should not hide and show settings UI.
+add_test(function() {
+  observer.checkHidden("inlinesettings1@tests.mozilla.org");
+
+  var addon = get_addon_element(gManagerWindow, "inlinesettings2@tests.mozilla.org");
+  addon.parentNode.ensureElementIsVisible(addon);
+
+  var button = gManagerWindow.document.getAnonymousElementByAttribute(addon, "anonid", "details-btn");
+  EventUtils.synthesizeMouseAtCenter(button, { clickCount: 1 }, gManagerWindow);
+
+  wait_for_view_load(gManagerWindow, function() {
+    observer.checkDisplayed("inlinesettings2@tests.mozilla.org");
+
+    var grid = gManagerWindow.document.getElementById("detail-grid");
+    var settings = grid.querySelectorAll("rows > setting");
+    ok(settings.length > 0, "Grid should have settings children");
+
+    // disable
+    var button = gManagerWindow.document.getElementById("detail-disable-btn");
+    button.focus(); // make sure it's in view
+    EventUtils.synthesizeMouseAtCenter(button, { clickCount: 1 }, gManagerWindow);
+    observer.checkNotHidden();
+
+    settings = grid.querySelectorAll("rows > setting");
+    ok(settings.length > 0, "Grid should still have settings children");
+
+    // cancel pending disable
+    button = gManagerWindow.document.getElementById("detail-enable-btn");
+    button.focus(); // make sure it's in view
+    EventUtils.synthesizeMouseAtCenter(button, { clickCount: 1 }, gManagerWindow);
+    observer.checkNotDisplayed();
+
+    gCategoryUtilities.openType("extension", run_next_test);
+  });
+});
diff --git a/toolkit/mozapps/extensions/test/browser/head.js b/toolkit/mozapps/extensions/test/browser/head.js
index 5f9fb80a2ea..b1696847714 100644
--- a/toolkit/mozapps/extensions/test/browser/head.js
+++ b/toolkit/mozapps/extensions/test/browser/head.js
@@ -59,6 +59,7 @@ var gUseInContentUI = !gTestInWindow && ("switchToTabHavingURI" in window);
 var gRestorePrefs = [{name: PREF_LOGGING_ENABLED},
                      {name: "extensions.webservice.discoverURL"},
                      {name: "extensions.update.url"},
+                     {name: "extensions.update.background.url"},
                      {name: "extensions.getAddons.get.url"},
                      {name: "extensions.getAddons.getWithPerformance.url"},
                      {name: "extensions.getAddons.search.browseURL"},
diff --git a/toolkit/mozapps/extensions/test/xpcshell/data/test_backgroundupdate.rdf b/toolkit/mozapps/extensions/test/xpcshell/data/test_backgroundupdate.rdf
index 228c6b988c2..b1125943611 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/data/test_backgroundupdate.rdf
+++ b/toolkit/mozapps/extensions/test/xpcshell/data/test_backgroundupdate.rdf
@@ -45,5 +45,26 @@
     </em:updates>
   </RDF:Description>
 
+  <RDF:Description about="urn:mozilla:extension:addon3@tests.mozilla.org">
+    <em:updates>
+      <RDF:Seq>
+        <!-- app id compatible update available -->
+        <RDF:li>
+          <RDF:Description>
+            <em:version>2</em:version>
+            <em:targetApplication>
+              <RDF:Description>
+                <em:id>xpcshell@tests.mozilla.org</em:id>
+                <em:minVersion>1</em:minVersion>
+                <em:maxVersion>1</em:maxVersion>
+                <em:updateLink>http://localhost:4444/broken.xpi</em:updateLink>
+              </RDF:Description>
+            </em:targetApplication>
+          </RDF:Description>
+        </RDF:li>
+      </RDF:Seq>
+    </em:updates>
+  </RDF:Description>
+
 </RDF:RDF>
 
diff --git a/toolkit/mozapps/extensions/test/xpcshell/head_addons.js b/toolkit/mozapps/extensions/test/xpcshell/head_addons.js
index 101fa65f165..d988358dad8 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/head_addons.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/head_addons.js
@@ -1127,6 +1127,7 @@ Services.prefs.setBoolPref("extensions.showMismatchUI", false);
 
 // Point update checks to the local machine for fast failures
 Services.prefs.setCharPref("extensions.update.url", "http://127.0.0.1/updateURL");
+Services.prefs.setCharPref("extensions.update.background.url", "http://127.0.0.1/updateBackgroundURL");
 Services.prefs.setCharPref("extensions.blocklist.url", "http://127.0.0.1/blocklistURL");
 
 // By default ignore bundled add-ons
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_backgroundupdate.js b/toolkit/mozapps/extensions/test/xpcshell/test_backgroundupdate.js
index aafa0f2c136..19d05ba337f 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_backgroundupdate.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_backgroundupdate.js
@@ -2,7 +2,7 @@
  * http://creativecommons.org/publicdomain/zero/1.0/
  */
 
-// This verifies that background update notifications work as expected
+// This verifies that background updates & notifications work as expected
 
 // The test extension uses an insecure update url.
 Services.prefs.setBoolPref(PREF_EM_CHECK_UPDATE_SECURITY, false);
@@ -74,6 +74,20 @@ function run_test_2() {
     name: "Test Addon 2",
   }, profileDir);
 
+  writeInstallRDFForExtension({
+    id: "addon3@tests.mozilla.org",
+    version: "1.0",
+    targetApplications: [{
+      id: "xpcshell@tests.mozilla.org",
+      minVersion: "1",
+      maxVersion: "1"
+    }],
+    name: "Test Addon 3",
+  }, profileDir);
+
+  // Background update uses a different pref, if set
+  Services.prefs.setCharPref("extensions.update.background.url",
+                             "http://localhost:4444/data/test_backgroundupdate.rdf");
   restartManager();
 
   // Do hotfix checks
@@ -87,7 +101,7 @@ function run_test_2() {
   Services.obs.addObserver(function() {
     Services.obs.removeObserver(arguments.callee, "addons-background-update-complete");
 
-    do_check_eq(installCount, 2);
+    do_check_eq(installCount, 3);
     sawCompleteNotification = true;
   }, "addons-background-update-complete", false);
 
@@ -98,7 +112,7 @@ function run_test_2() {
 
     onDownloadFailed: function(aInstall) {
       completeCount++;
-      if (completeCount == 2) {
+      if (completeCount == 3) {
         do_check_true(sawCompleteNotification);
         end_test();
       }
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_hotfix.js b/toolkit/mozapps/extensions/test/xpcshell/test_hotfix.js
index 278319224b1..c082c2c83c8 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_hotfix.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_hotfix.js
@@ -36,7 +36,7 @@ function end_test() {
 // Test that background updates find and install any available hotfix
 function run_test_1() {
   Services.prefs.setCharPref("extensions.hotfix.id", "hotfix@tests.mozilla.org");
-  Services.prefs.setCharPref("extensions.update.url", "http://localhost:4444/data/test_hotfix_1.rdf");
+  Services.prefs.setCharPref("extensions.update.background.url", "http://localhost:4444/data/test_hotfix_1.rdf");
 
   prepare_test({
     "hotfix@tests.mozilla.org": [
diff --git a/toolkit/mozapps/installer/package-name.mk b/toolkit/mozapps/installer/package-name.mk
index 3ddca0918da..416ccd741dc 100644
--- a/toolkit/mozapps/installer/package-name.mk
+++ b/toolkit/mozapps/installer/package-name.mk
@@ -94,6 +94,7 @@ PKG_INST_BASENAME = $(PKG_BASENAME).installer
 PKG_INST_PATH = install/sea/
 PKG_UPDATE_BASENAME = $(PKG_BASENAME)
 CHECKSUMS_FILE_BASENAME = $(PKG_BASENAME)
+MOZ_SOURCESTAMP_FILE_BASENAME = $(PKG_BASENAME)
 PKG_UPDATE_PATH = update/
 COMPLETE_MAR = $(PKG_UPDATE_PATH)$(PKG_UPDATE_BASENAME).complete.mar
 # PARTIAL_MAR needs to be processed by $(wildcard) before you use it.
@@ -129,13 +130,15 @@ PKG_INST_BASENAME = $(MOZ_PKG_APPNAME_LC)-setup-$(MOZ_PKG_VERSION)
 endif
 endif
 PKG_PATH = $(MOZ_PKG_PLATFORM)/$(AB_CD)/
+CHECKSUMS_FILE_BASENAME = $(MOZ_PKG_APPNAME_LC)-$(MOZ_PKG_VERSION)
 ifeq ($(MOZ_APP_NAME),xulrunner)
 PKG_PATH = runtimes/
 PKG_BASENAME = $(MOZ_APP_NAME)-$(MOZ_PKG_VERSION).$(AB_CD).$(MOZ_PKG_PLATFORM)
+CHECKSUMS_FILE_BASENAME = $(PKG_BASENAME)
 endif
 PKG_INST_PATH = $(PKG_PATH)
 PKG_UPDATE_BASENAME = $(MOZ_PKG_APPNAME_LC)-$(MOZ_PKG_VERSION)
-CHECKSUMS_FILE_BASENAME = $(MOZ_PKG_APPNAME_LC)-$(MOZ_PKG_VERSION)
+MOZ_SOURCESTAMP_FILE_BASENAME = $(MOZ_PKG_APPNAME_LC)-$(MOZ_PKG_VERSION)
 PKG_UPDATE_PATH = update/$(PKG_PATH)
 COMPLETE_MAR = $(PKG_UPDATE_PATH)$(PKG_UPDATE_BASENAME).complete.mar
 # PARTIAL_MAR needs to be processed by $(wildcard) before you use it.
@@ -169,7 +172,7 @@ MOZ_SOURCE_STAMP = $(firstword $(shell hg -R $(MOZILLA_DIR) parent --template="{
 _dollar=$$
 MOZ_SOURCE_REPO = $(shell cd $(MOZILLA_DIR) && hg showconfig paths.default 2>/dev/null | head -n1 | sed -e "s/^ssh:/http:/" -e "s/\/$(_dollar)//" )
 
-MOZ_SOURCESTAMP_FILE = $(DIST)/$(PKG_PATH)/$(PKG_BASENAME).txt
+MOZ_SOURCESTAMP_FILE = $(DIST)/$(PKG_PATH)/$(MOZ_SOURCESTAMP_FILE_BASENAME).txt
 
 # JavaScript Shell
 PKG_JSSHELL = $(DIST)/jsshell-$(MOZ_PKG_PLATFORM).zip
diff --git a/toolkit/profile/nsIProfileMigrator.idl b/toolkit/profile/nsIProfileMigrator.idl
index f2b1ad23290..e941336bfe7 100644
--- a/toolkit/profile/nsIProfileMigrator.idl
+++ b/toolkit/profile/nsIProfileMigrator.idl
@@ -69,7 +69,7 @@ interface nsIProfileStartup : nsISupports
  * @client   Toolkit (Startup code)
  * @obtainable service, contractid("@mozilla.org/toolkit/profile-migrator;1")
  */
-[scriptable, uuid(24ce8b9d-b7ff-4279-aef4-26e158f03e34)]
+[scriptable, uuid(3df284a5-2258-4d46-a664-761ecdc04c22)]
 interface nsIProfileMigrator : nsISupports 
 {
   /**
@@ -86,10 +86,13 @@ interface nsIProfileMigrator : nsISupports
    * If your migrator needs to access services that use the profile (to
    * set profile prefs or bookmarks, for example), use aStartup.doStartup.
    *
+   * @param  aStartup nsIProfileStartup object to use during migration.
+   * @param  aKey     optional key of a migrator to use to skip source selection.
+   *
    * @note The startup code ignores COM exceptions thrown from this method.
    */
-  void migrate(in nsIProfileStartup aStartup);
-};  
+  void migrate(in nsIProfileStartup aStartup, in ACString aKey);
+};
 
 %{C++
 #define NS_PROFILEMIGRATOR_CONTRACTID "@mozilla.org/toolkit/profile-migrator;1"
diff --git a/toolkit/themes/winstripe/global/aboutSupport.css b/toolkit/themes/winstripe/global/aboutSupport.css
index 053f5add683..d0dc6353acd 100644
--- a/toolkit/themes/winstripe/global/aboutSupport.css
+++ b/toolkit/themes/winstripe/global/aboutSupport.css
@@ -111,3 +111,29 @@ td {
   white-space: nowrap;
   overflow: hidden;
 }
+
+#reset-box {
+  background-color: -moz-Dialog;
+  border: 1px solid ThreeDShadow;
+  color: -moz-DialogText;
+  float: right;
+  margin-top: 2em;
+  margin-bottom: 20px;
+  -moz-margin-start: 20px;
+  -moz-margin-end: 0;
+  padding: 16px;
+  width: 30%;
+}
+
+body[dir="rtl"] > #reset-box {
+  float: left;
+}
+
+#reset-box > h3 {
+  margin-top: 0;
+}
+
+#reset-box > button {
+  display: block;
+  margin: auto;
+}
diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index a63dd5cc032..32eef5c082a 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -150,6 +150,7 @@ using mozilla::unused;
 #include "nsXPCOM.h"
 #include "nsXPCOMCIDInternal.h"
 #include "nsXPIDLString.h"
+#include "nsPrintfCString.h"
 #include "nsVersionComparator.h"
 
 #include "nsAppDirectoryServiceDefs.h"
@@ -1911,9 +1912,72 @@ ShowProfileManager(nsIToolkitProfileService* aProfileSvc,
 // 6) display the profile-manager UI
 
 static bool gDoMigration = false;
+static bool gDoProfileReset = false;
+
+/**
+ * Creates a new profile with a timestamp in the name to use for profile reset.
+ */
+static nsresult
+ResetProfile(nsIToolkitProfileService* aProfileSvc, nsIToolkitProfile* *aNewProfile)
+{
+  NS_ENSURE_ARG_POINTER(aProfileSvc);
+
+  nsCOMPtr<nsIToolkitProfile> newProfile;
+  // Make the new profile "default-" + the time in seconds since epoch for uniqueness.
+  nsCAutoString newProfileName("default-");
+  newProfileName.Append(nsPrintfCString("%lld", PR_Now() / 1000));
+  nsresult rv = aProfileSvc->CreateProfile(nsnull, // choose a default dir for us
+                                           nsnull, // choose a default dir for us
+                                           newProfileName,
+                                           getter_AddRefs(newProfile));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = aProfileSvc->Flush();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  NS_IF_ADDREF(*aNewProfile = newProfile);
+
+  return NS_OK;
+}
+
+/**
+ * Set the currently running profile as the default/selected one.
+ *
+ * @param aCurrentProfileRoot The root directory of the current profile.
+ * @return an error if aCurrentProfileRoot is not found or the profile could not
+ * be set as the default.
+ */
+static nsresult
+SetCurrentProfileAsDefault(nsIToolkitProfileService* aProfileSvc,
+                           nsILocalFile* aCurrentProfileRoot)
+{
+  NS_ENSURE_ARG_POINTER(aProfileSvc);
+
+  nsCOMPtr<nsISimpleEnumerator> profiles;
+  nsresult rv = aProfileSvc->GetProfiles(getter_AddRefs(profiles));
+  if (NS_FAILED(rv))
+    return rv;
+
+  bool foundMatchingProfile = false;
+  nsCOMPtr<nsIToolkitProfile> profile;
+  rv = profiles->GetNext(getter_AddRefs(profile));
+  while (NS_SUCCEEDED(rv)) {
+    nsCOMPtr<nsILocalFile> profileRoot;
+    profile->GetRootDir(getter_AddRefs(profileRoot));
+    profileRoot->Equals(aCurrentProfileRoot, &foundMatchingProfile);
+    if (foundMatchingProfile && profile) {
+      rv = aProfileSvc->SetSelectedProfile(profile);
+      if (NS_SUCCEEDED(rv))
+        rv = aProfileSvc->Flush();
+      return rv;
+    }
+    rv = profiles->GetNext(getter_AddRefs(profile));
+  }
+  return rv;
+}
 
 static nsresult
-SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
+SelectProfile(nsIProfileLock* *aResult, nsIToolkitProfileService* aProfileSvc, nsINativeAppSupport* aNative,
               bool* aStartOffline, nsACString* aProfileName)
 {
   nsresult rv;
@@ -1931,6 +1995,28 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
   if (ar || EnvHasValue("XRE_START_OFFLINE"))
     *aStartOffline = true;
 
+  if (EnvHasValue("MOZ_RESET_PROFILE_RESTART")) {
+    gDoProfileReset = true;
+    gDoMigration = true;
+    SaveToEnv("MOZ_RESET_PROFILE_RESTART=");
+  }
+
+  // reset-profile and migration args need to be checked before any profiles are chosen below.
+  ar = CheckArg("reset-profile", true);
+  if (ar == ARG_BAD) {
+    PR_fprintf(PR_STDERR, "Error: argument -reset-profile is invalid when argument -osint is specified\n");
+    return NS_ERROR_FAILURE;
+  } else if (ar == ARG_FOUND) {
+    gDoProfileReset = true;
+  }
+
+  ar = CheckArg("migration", true);
+  if (ar == ARG_BAD) {
+    PR_fprintf(PR_STDERR, "Error: argument -migration is invalid when argument -osint is specified\n");
+    return NS_ERROR_FAILURE;
+  } else if (ar == ARG_FOUND) {
+    gDoMigration = true;
+  }
 
   nsCOMPtr<nsILocalFile> lf = GetFileFromEnv("XRE_PROFILE_PATH");
   if (lf) {
@@ -1950,15 +2036,30 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
     CheckArg("profile", false, &dummy);
     CheckArg("profilemanager");
 
-    return NS_LockProfilePath(lf, localDir, nsnull, aResult);
-  }
+    if (gDoProfileReset) {
+      // If we're resetting a profile, create a new one and use it to startup.
+      nsCOMPtr<nsIToolkitProfile> newProfile;
+      rv = ResetProfile(aProfileSvc, getter_AddRefs(newProfile));
+      if (NS_SUCCEEDED(rv)) {
+        rv = newProfile->GetRootDir(getter_AddRefs(lf));
+        NS_ENSURE_SUCCESS(rv, rv);
+        SaveFileToEnv("XRE_PROFILE_PATH", lf);
 
-  ar = CheckArg("migration", true);
-  if (ar == ARG_BAD) {
-    PR_fprintf(PR_STDERR, "Error: argument -migration is invalid when argument -osint is specified\n");
-    return NS_ERROR_FAILURE;
-  } else if (ar == ARG_FOUND) {
-    gDoMigration = true;
+        rv = newProfile->GetLocalDir(getter_AddRefs(localDir));
+        NS_ENSURE_SUCCESS(rv, rv);
+        SaveFileToEnv("XRE_PROFILE_LOCAL_PATH", localDir);
+
+        rv = newProfile->GetName(*aProfileName);
+        if (NS_FAILED(rv))
+          aProfileName->Truncate(0);
+        SaveWordToEnv("XRE_PROFILE_NAME", *aProfileName);
+      } else {
+        NS_WARNING("Profile reset failed.");
+        gDoProfileReset = false;
+      }
+    }
+
+    return NS_LockProfilePath(lf, localDir, nsnull, aResult);
   }
 
   ar = CheckArg("profile", true, &arg);
@@ -1967,6 +2068,11 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
     return NS_ERROR_FAILURE;
   }
   if (ar) {
+    if (gDoProfileReset) {
+      NS_WARNING("Profile reset is only supported for the default profile.");
+      gDoProfileReset = false;
+    }
+
     nsCOMPtr<nsILocalFile> lf;
     rv = XRE_GetFileFromPath(arg, getter_AddRefs(lf));
     NS_ENSURE_SUCCESS(rv, rv);
@@ -1990,13 +2096,6 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
     return ProfileLockedDialog(lf, lf, unlocker, aNative, aResult);
   }
 
-  nsCOMPtr<nsIToolkitProfileService> profileSvc;
-  rv = NS_NewToolkitProfileService(getter_AddRefs(profileSvc));
-  if (rv == NS_ERROR_FILE_ACCESS_DENIED)
-    PR_fprintf(PR_STDERR, "Error: Access was denied while trying to open files in " \
-                "your profile directory.\n"); 
-  NS_ENSURE_SUCCESS(rv, rv);
-
   ar = CheckArg("createprofile", true, &arg);
   if (ar == ARG_BAD) {
     PR_fprintf(PR_STDERR, "Error: argument -createprofile requires a profile name\n");
@@ -2017,10 +2116,10 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
       
       // As with -profile, assume that the given path will be used for both the
       // main profile directory and the temp profile directory.
-      rv = profileSvc->CreateProfile(lf, lf, nsDependentCSubstring(arg, delim),
+      rv = aProfileSvc->CreateProfile(lf, lf, nsDependentCSubstring(arg, delim),
                                      getter_AddRefs(profile));
     } else {
-      rv = profileSvc->CreateProfile(nsnull, nsnull, nsDependentCString(arg),
+      rv = aProfileSvc->CreateProfile(nsnull, nsnull, nsDependentCString(arg),
                                      getter_AddRefs(profile));
     }
     // Some pathological arguments can make it this far
@@ -2029,7 +2128,7 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
       return rv; 
     }
     rv = NS_ERROR_ABORT;  
-    profileSvc->Flush();
+    aProfileSvc->Flush();
 
     // XXXben need to ensure prefs.js exists here so the tinderboxes will
     //        not go orange.
@@ -2049,7 +2148,7 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
   }
 
   PRUint32 count;
-  rv = profileSvc->GetProfileCount(&count);
+  rv = aProfileSvc->GetProfileCount(&count);
   NS_ENSURE_SUCCESS(rv, rv);
 
   ar = CheckArg("p", false, &arg);
@@ -2059,7 +2158,7 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
       PR_fprintf(PR_STDERR, "Error: argument -p is invalid when argument -osint is specified\n");
       return NS_ERROR_FAILURE;
     }
-    return ShowProfileManager(profileSvc, aNative);
+    return ShowProfileManager(aProfileSvc, aNative);
   }
   if (ar) {
     ar = CheckArg("osint");
@@ -2068,9 +2167,15 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
       return NS_ERROR_FAILURE;
     }
     nsCOMPtr<nsIToolkitProfile> profile;
-    rv = profileSvc->GetProfileByName(nsDependentCString(arg),
+    rv = aProfileSvc->GetProfileByName(nsDependentCString(arg),
                                       getter_AddRefs(profile));
     if (NS_SUCCEEDED(rv)) {
+      // If we're resetting a profile, create a new one and use it to startup.
+      if (gDoProfileReset) {
+        NS_WARNING("Profile reset is only supported for the default profile.");
+        gDoProfileReset = false;
+      }
+
       nsCOMPtr<nsIProfileUnlocker> unlocker;
       rv = profile->Lock(nsnull, aResult);
       if (NS_SUCCEEDED(rv)) {
@@ -2091,7 +2196,7 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
                                  aNative, aResult);
     }
 
-    return ShowProfileManager(profileSvc, aNative);
+    return ShowProfileManager(aProfileSvc, aNative);
   }
 
   ar = CheckArg("profilemanager", true);
@@ -2099,20 +2204,21 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
     PR_fprintf(PR_STDERR, "Error: argument -profilemanager is invalid when argument -osint is specified\n");
     return NS_ERROR_FAILURE;
   } else if (ar == ARG_FOUND) {
-    return ShowProfileManager(profileSvc, aNative);
+    return ShowProfileManager(aProfileSvc, aNative);
   }
 
   if (!count) {
     gDoMigration = true;
+    gDoProfileReset = false;
 
     // create a default profile
     nsCOMPtr<nsIToolkitProfile> profile;
-    nsresult rv = profileSvc->CreateProfile(nsnull, // choose a default dir for us
-                                            nsnull, // choose a default dir for us
-                                            NS_LITERAL_CSTRING("default"),
-                                            getter_AddRefs(profile));
+    nsresult rv = aProfileSvc->CreateProfile(nsnull, // choose a default dir for us
+                                             nsnull, // choose a default dir for us
+                                             NS_LITERAL_CSTRING("default"),
+                                             getter_AddRefs(profile));
     if (NS_SUCCEEDED(rv)) {
-      profileSvc->Flush();
+      aProfileSvc->Flush();
       rv = profile->Lock(nsnull, aResult);
       if (NS_SUCCEEDED(rv)) {
         if (aProfileName)
@@ -2124,13 +2230,22 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
 
   bool useDefault = true;
   if (count > 1)
-    profileSvc->GetStartWithLastProfile(&useDefault);
+    aProfileSvc->GetStartWithLastProfile(&useDefault);
 
   if (useDefault) {
     nsCOMPtr<nsIToolkitProfile> profile;
     // GetSelectedProfile will auto-select the only profile if there's just one
-    profileSvc->GetSelectedProfile(getter_AddRefs(profile));
+    aProfileSvc->GetSelectedProfile(getter_AddRefs(profile));
     if (profile) {
+      // If we're resetting a profile, create a new one and use it to startup.
+      if (gDoProfileReset) {
+        nsCOMPtr<nsIToolkitProfile> newProfile;
+        rv = ResetProfile(aProfileSvc, getter_AddRefs(newProfile));
+        if (NS_SUCCEEDED(rv))
+          profile = newProfile;
+        else
+          gDoProfileReset = false;
+      }
       nsCOMPtr<nsIProfileUnlocker> unlocker;
       rv = profile->Lock(getter_AddRefs(unlocker), aResult);
       if (NS_SUCCEEDED(rv)) {
@@ -2156,7 +2271,7 @@ SelectProfile(nsIProfileLock* *aResult, nsINativeAppSupport* aNative,
     }
   }
 
-  return ShowProfileManager(profileSvc, aNative);
+  return ShowProfileManager(aProfileSvc, aNative);
 }
 
 /** 
@@ -3200,7 +3315,19 @@ XRE_main(int argc, char* argv[], const nsXREAppData* aAppData)
     bool startOffline = false;
     nsCAutoString profileName;
 
-    rv = SelectProfile(getter_AddRefs(profileLock), nativeApp, &startOffline,
+    nsCOMPtr<nsIToolkitProfileService> profileSvc;
+    rv = NS_NewToolkitProfileService(getter_AddRefs(profileSvc));
+    if (rv == NS_ERROR_FILE_ACCESS_DENIED) {
+      PR_fprintf(PR_STDERR, "Error: Access was denied while trying to open files in " \
+                 "your profile directory.\n");
+    }
+    if (NS_FAILED(rv)) {
+      // We failed to choose or create profile - notify user and quit
+      ProfileMissingDialog(nativeApp);
+      return 1;
+    }
+
+    rv = SelectProfile(getter_AddRefs(profileLock), profileSvc, nativeApp, &startOffline,
                        &profileName);
     if (rv == NS_ERROR_LAUNCHED_CHILD_PROCESS ||
         rv == NS_ERROR_ABORT) return 0;
@@ -3429,8 +3556,20 @@ XRE_main(int argc, char* argv[], const nsXREAppData* aAppData)
           gDoMigration = false;
           nsCOMPtr<nsIProfileMigrator> pm
             (do_CreateInstance(NS_PROFILEMIGRATOR_CONTRACTID));
-          if (pm)
-            pm->Migrate(&dirProvider);
+          if (pm) {
+            nsCAutoString aKey;
+            if (gDoProfileReset) {
+              // Automatically migrate from the current application if we just
+              // reset the profile.
+              aKey = MOZ_APP_NAME;
+              pm->Migrate(&dirProvider, aKey);
+              // Set the new profile as the default after migration.
+              rv = SetCurrentProfileAsDefault(profileSvc, profD);
+              if (NS_FAILED(rv)) NS_WARNING("Could not set current profile as the default");
+            } else {
+              pm->Migrate(&dirProvider, aKey);
+            }
+          }
         }
 
         NS_TIME_FUNCTION_MARK("Profile migration");
diff --git a/toolkit/xre/nsWindowsDllBlocklist.cpp b/toolkit/xre/nsWindowsDllBlocklist.cpp
index 5fc42e4ce01..0a66402918f 100644
--- a/toolkit/xre/nsWindowsDllBlocklist.cpp
+++ b/toolkit/xre/nsWindowsDllBlocklist.cpp
@@ -138,6 +138,9 @@ static DllBlockInfo sWindowsDllBlocklist[] = {
   {"rf-firefox.dll", MAKE_VERSION(7,6,1,0)},
   {"roboform.dll", MAKE_VERSION(7,6,1,0)},
 
+  // Topcrash in Firefox 10
+  {"bexternal.dll", ALL_VERSIONS},
+
   // leave these two in always for tests
   { "mozdllblockingtest.dll", ALL_VERSIONS },
   { "mozdllblockingtest_versioned.dll", 0x0000000400000000ULL },
diff --git a/widget/android/AndroidBridge.cpp b/widget/android/AndroidBridge.cpp
index 85860800f5c..b17deb1b8f8 100644
--- a/widget/android/AndroidBridge.cpp
+++ b/widget/android/AndroidBridge.cpp
@@ -178,6 +178,7 @@ AndroidBridge::Init(JNIEnv *jEnv,
     jGetCurrentNetworkInformation = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getCurrentNetworkInformation", "()[D");
     jEnableNetworkNotifications = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "enableNetworkNotifications", "()V");
     jDisableNetworkNotifications = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "disableNetworkNotifications", "()V");
+    jEmitGeckoAccessibilityEvent = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "emitGeckoAccessibilityEvent", "(I[Ljava/lang/String;Ljava/lang/String;ZZZ)V");
 
     jEGLContextClass = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("javax/microedition/khronos/egl/EGLContext"));
     jEGL10Class = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("javax/microedition/khronos/egl/EGL10"));
@@ -186,6 +187,8 @@ AndroidBridge::Init(JNIEnv *jEnv,
     jEGLConfigImplClass = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("com/google/android/gles_jni/EGLConfigImpl"));
     jEGLDisplayImplClass = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("com/google/android/gles_jni/EGLDisplayImpl"));
 
+    jStringClass = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("java/lang/String"));
+
     InitAndroidJavaWrappers(jEnv);
 
     // jEnv should NOT be cached here by anything -- the jEnv here
@@ -1487,17 +1490,17 @@ AndroidBridge::MarkURIVisited(const nsAString& aURI)
     env->CallStaticVoidMethod(mGeckoAppShellClass, jMarkUriVisited, jstrURI);
 }
 
-void AndroidBridge::EmitGeckoAccessibilityEvent (PRInt32 eventType, const nsAString& role, const nsAString& text, const nsAString& description, bool enabled, bool checked, bool password) {
-
-    JNIEnv *env = GetJNIEnv();
-    if (!env)
-        return;
-
-    AutoLocalJNIFrame jniFrame(env); 
-    jstring jstrRole = env->NewString(nsPromiseFlatString(role).get(), role.Length());
-    jstring jstrText = env->NewString(nsPromiseFlatString(text).get(), text.Length());
-    jstring jstrDescription = env->NewString(nsPromiseFlatString(description).get(), description.Length());
-    env->CallStaticVoidMethod(mGeckoAppShellClass, jEmitGeckoAccessibilityEvent, eventType, jstrRole, jstrText, jstrDescription, enabled, checked, password);
+void AndroidBridge::EmitGeckoAccessibilityEvent (PRInt32 eventType, const nsTArray<nsString>& text, const nsAString& description, bool enabled, bool checked, bool password) {
+    AutoLocalJNIFrame jniFrame;
+    jobjectArray jarrayText = mJNIEnv->NewObjectArray(text.Length(),
+                                                      jStringClass, 0);
+    for (PRUint32 i = 0; i < text.Length() ; i++) {
+        jstring jstrText = mJNIEnv->NewString(nsPromiseFlatString(text[i]).get(),
+                                              text[i].Length());
+        mJNIEnv->SetObjectArrayElement(jarrayText, i, jstrText);
+    }
+    jstring jstrDescription = mJNIEnv->NewString(nsPromiseFlatString(description).get(), description.Length());
+    mJNIEnv->CallStaticVoidMethod(mGeckoAppShellClass, jEmitGeckoAccessibilityEvent, eventType, jarrayText, jstrDescription, enabled, checked, password);
 }
 
 PRUint16
@@ -1584,8 +1587,8 @@ AndroidBridge::CreateMessageList(const dom::sms::SmsFilterData& aFilter, bool aR
 
     jobjectArray numbers =
       (jobjectArray)env->NewObjectArray(aFilter.numbers().Length(),
-                                          env->FindClass("java/lang/String"),
-                                          env->NewStringUTF(""));
+                                        jStringClass,
+                                        env->NewStringUTF(""));
 
     for (PRUint32 i = 0; i < aFilter.numbers().Length(); ++i) {
       env->SetObjectArrayElement(numbers, i,
diff --git a/widget/android/AndroidBridge.h b/widget/android/AndroidBridge.h
index 84e2de05561..c9ee11a0f8e 100644
--- a/widget/android/AndroidBridge.h
+++ b/widget/android/AndroidBridge.h
@@ -357,7 +357,7 @@ public:
 
     nsCOMPtr<nsIAndroidDrawMetadataProvider> GetDrawMetadataProvider();
 
-    void EmitGeckoAccessibilityEvent (PRInt32 eventType, const nsAString& role, const nsAString& text, const nsAString& description, bool enabled, bool checked, bool password);
+    void EmitGeckoAccessibilityEvent (PRInt32 eventType, const nsTArray<nsString>& text, const nsAString& description, bool enabled, bool checked, bool password);
 
     void CheckURIVisited(const nsAString& uri);
     void MarkURIVisited(const nsAString& uri);
@@ -498,6 +498,9 @@ protected:
     jclass jEGLContextClass;
     jclass jEGL10Class;
 
+    // some convinient types to have around
+    jclass jStringClass;
+
     // calls we've dlopened from libjnigraphics.so
     int (* AndroidBitmap_getInfo)(JNIEnv *env, jobject bitmap, void *info);
     int (* AndroidBitmap_lockPixels)(JNIEnv *env, jobject bitmap, void **buffer);
diff --git a/widget/android/nsScreenManagerAndroid.cpp b/widget/android/nsScreenManagerAndroid.cpp
index 079b6dc6633..4242d4b7ec7 100644
--- a/widget/android/nsScreenManagerAndroid.cpp
+++ b/widget/android/nsScreenManagerAndroid.cpp
@@ -78,7 +78,7 @@ nsScreenAndroid::GetPixelDepth(PRInt32 *aPixelDepth)
 {
     // XXX do we need to lie here about 16bpp?  Or
     // should we actually check and return the right thing?
-    *aPixelDepth = 24;
+    *aPixelDepth = 16;
     return NS_OK;
 }
 
diff --git a/widget/gonk/nsWindow.cpp b/widget/gonk/nsWindow.cpp
index 4bc61b0840f..afe5d9fab02 100644
--- a/widget/gonk/nsWindow.cpp
+++ b/widget/gonk/nsWindow.cpp
@@ -510,9 +510,7 @@ nsScreenGonk::GetAvailRect(PRInt32 *outLeft,  PRInt32 *outTop,
 NS_IMETHODIMP
 nsScreenGonk::GetPixelDepth(PRInt32 *aPixelDepth)
 {
-    // XXX do we need to lie here about 16bpp?  Or
-    // should we actually check and return the right thing?
-    *aPixelDepth = 24;
+    *aPixelDepth = gNativeWindow->getDevice()->format == GGL_PIXEL_FORMAT_RGB_565 ? 16 : 24;
     return NS_OK;
 }
 
diff --git a/widget/gtk2/nsGtkIMModule.cpp b/widget/gtk2/nsGtkIMModule.cpp
index 7c1cbd5f41f..99341c1ed09 100644
--- a/widget/gtk2/nsGtkIMModule.cpp
+++ b/widget/gtk2/nsGtkIMModule.cpp
@@ -114,8 +114,8 @@ nsGtkIMModule::nsGtkIMModule(nsWindow* aOwnerWindow) :
 #endif
     mDummyContext(nsnull),
     mCompositionStart(PR_UINT32_MAX), mProcessingKeyEvent(nsnull),
-    mIsComposing(false), mIsIMFocused(false),
-    mIgnoreNativeCompositionEvent(false)
+    mCompositionState(eCompositionState_NotComposing),
+    mIsIMFocused(false), mIgnoreNativeCompositionEvent(false)
 {
 #ifdef PR_LOGGING
     if (!gGtkIMLog) {
@@ -412,7 +412,7 @@ nsGtkIMModule::OnKeyEvent(nsWindow* aCaller, GdkEventKey* aEvent,
     // composed characters.
     bool filterThisEvent = isFiltered && mFilterKeyEvent;
 
-    if (mIsComposing && !isFiltered) {
+    if (IsComposing() && !isFiltered) {
         if (aEvent->type == GDK_KEY_PRESS) {
             if (!mDispatchedCompositionString.IsEmpty()) {
                 // If there is composition string, we shouldn't dispatch
@@ -448,10 +448,16 @@ void
 nsGtkIMModule::OnFocusChangeInGecko(bool aFocus)
 {
     PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
-        ("GtkIMModule(%p): OnFocusChangeInGecko, aFocus=%s mIsComposing=%s, mIsIMFocused=%s, mIgnoreNativeCompositionEvent=%s",
-         this, aFocus ? "YES" : "NO", mIsComposing ? "YES" : "NO",
+        ("GtkIMModule(%p): OnFocusChangeInGecko, aFocus=%s, "
+         "mCompositionState=%s, mIsIMFocused=%s, "
+         "mIgnoreNativeCompositionEvent=%s",
+         this, aFocus ? "YES" : "NO", GetCompositionStateName(),
          mIsIMFocused ? "YES" : "NO",
          mIgnoreNativeCompositionEvent ? "YES" : "NO"));
+
+    // We shouldn't carry over the removed string to another editor.
+    mSelectedString.Truncate();
+
     if (aFocus) {
         // If we failed to commit forcedely in previous focused editor,
         // we should reopen the gate for native signals in new focused editor.
@@ -463,8 +469,8 @@ void
 nsGtkIMModule::ResetIME()
 {
     PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
-        ("GtkIMModule(%p): ResetIME, mIsComposing=%s, mIsIMFocused=%s",
-         this, mIsComposing ? "YES" : "NO", mIsIMFocused ? "YES" : "NO"));
+        ("GtkIMModule(%p): ResetIME, mCompositionState=%s, mIsIMFocused=%s",
+         this, GetCompositionStateName(), mIsIMFocused ? "YES" : "NO"));
 
     GtkIMContext *im = GetContext();
     if (NS_UNLIKELY(!im)) {
@@ -485,8 +491,8 @@ nsGtkIMModule::ResetInputState(nsWindow* aCaller)
     }
 
     PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
-        ("GtkIMModule(%p): ResetInputState, aCaller=%p, mIsComposing=%s",
-         this, aCaller, mIsComposing ? "YES" : "NO"));
+        ("GtkIMModule(%p): ResetInputState, aCaller=%p, mCompositionState=%s",
+         this, aCaller, GetCompositionStateName()));
 
     if (aCaller != mLastFocusedWindow) {
         PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
@@ -495,7 +501,7 @@ nsGtkIMModule::ResetInputState(nsWindow* aCaller)
         return NS_OK;
     }
 
-    if (!mIsComposing) {
+    if (!IsComposing()) {
         return NS_OK;
     }
 
@@ -524,7 +530,7 @@ nsGtkIMModule::CancelIMEComposition(nsWindow* aCaller)
         return NS_OK;
     }
 
-    if (!mIsComposing) {
+    if (!IsComposing()) {
         return NS_OK;
     }
 
@@ -830,7 +836,7 @@ nsGtkIMModule::OnEndCompositionNative(GtkIMContext *aContext)
     // Note that the native commit can be fired *after* ResetIME().
     mIgnoreNativeCompositionEvent = false;
 
-    if (!mIsComposing || shouldIgnoreThisEvent) {
+    if (!IsComposing() || shouldIgnoreThisEvent) {
         // If we already handled the commit event, we should do nothing here.
         return;
     }
@@ -868,13 +874,13 @@ nsGtkIMModule::OnChangeCompositionNative(GtkIMContext *aContext)
 
     nsAutoString compositionString;
     GetCompositionString(compositionString);
-    if (!mIsComposing && compositionString.IsEmpty()) {
+    if (!IsComposing() && compositionString.IsEmpty()) {
         mDispatchedCompositionString.Truncate();
         return; // Don't start the composition with empty string.
     }
 
     // Be aware, widget can be gone
-    DispatchTextEvent(compositionString, true);
+    DispatchTextEvent(compositionString, false);
 }
 
 /* static */
@@ -989,7 +995,7 @@ nsGtkIMModule::OnCommitCompositionNative(GtkIMContext *aContext,
     // signal, we would dispatch compositionstart, text, compositionend
     // events with empty string.  Of course, they are unnecessary events
     // for Web applications and our editor.
-    if (!mIsComposing && !commitString[0]) {
+    if (!IsComposing() && !commitString[0]) {
         return;
     }
 
@@ -1000,7 +1006,7 @@ nsGtkIMModule::OnCommitCompositionNative(GtkIMContext *aContext,
     // If IME doesn't change their keyevent that generated this commit,
     // don't send it through XIM - just send it as a normal key press
     // event.
-    if (!mIsComposing && mProcessingKeyEvent) {
+    if (!IsComposing() && mProcessingKeyEvent) {
         char keyval_utf8[8]; /* should have at least 6 bytes of space */
         gint keyval_utf8_len;
         guint32 keyval_unicode;
@@ -1031,7 +1037,7 @@ nsGtkIMModule::CommitCompositionBy(const nsAString& aString)
          this, NS_ConvertUTF16toUTF8(aString).get(),
          NS_ConvertUTF16toUTF8(mDispatchedCompositionString).get()));
 
-    if (!DispatchTextEvent(aString, false)) {
+    if (!DispatchTextEvent(aString, true)) {
         return false;
     }
     // We should dispatch the compositionend event here because some IMEs
@@ -1067,7 +1073,7 @@ nsGtkIMModule::DispatchCompositionStart()
     PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
         ("GtkIMModule(%p): DispatchCompositionStart", this));
 
-    if (mIsComposing) {
+    if (IsComposing()) {
         PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
             ("    WARNING, we're already in composition"));
         return true;
@@ -1091,6 +1097,10 @@ nsGtkIMModule::DispatchCompositionStart()
         return false;
     }
 
+    // XXX The composition start point might be changed by composition events
+    //     even though we strongly hope it doesn't happen.
+    //     Every composition event should have the start offset for the result
+    //     because it may high cost if we query the offset every time.
     mCompositionStart = selection.mReply.mOffset;
     mDispatchedCompositionString.Truncate();
 
@@ -1120,7 +1130,7 @@ nsGtkIMModule::DispatchCompositionStart()
 
     PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
         ("    mCompositionStart=%u", mCompositionStart));
-    mIsComposing = true;
+    mCompositionState = eCompositionState_CompositionStartDispatched;
     nsCompositionEvent compEvent(true, NS_COMPOSITION_START,
                                  mLastFocusedWindow);
     InitEvent(compEvent);
@@ -1144,7 +1154,7 @@ nsGtkIMModule::DispatchCompositionEnd()
          "mDispatchedCompositionString=\"%s\"",
          this, NS_ConvertUTF16toUTF8(mDispatchedCompositionString).get()));
 
-    if (!mIsComposing) {
+    if (!IsComposing()) {
         PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
             ("    WARNING, we have alrady finished the composition"));
         return false;
@@ -1164,7 +1174,7 @@ nsGtkIMModule::DispatchCompositionEnd()
     nsEventStatus status;
     nsCOMPtr<nsIWidget> kungFuDeathGrip = mLastFocusedWindow;
     mLastFocusedWindow->DispatchEvent(&compEvent, status);
-    mIsComposing = false;
+    mCompositionState = eCompositionState_NotComposing;
     mCompositionStart = PR_UINT32_MAX;
     mDispatchedCompositionString.Truncate();
     if (static_cast<nsWindow*>(kungFuDeathGrip.get())->IsDestroyed() ||
@@ -1179,11 +1189,11 @@ nsGtkIMModule::DispatchCompositionEnd()
 
 bool
 nsGtkIMModule::DispatchTextEvent(const nsAString &aCompositionString,
-                                 bool aCheckAttr)
+                                 bool aIsCommit)
 {
     PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
-        ("GtkIMModule(%p): DispatchTextEvent, aCheckAttr=%s",
-         this, aCheckAttr ? "TRUE" : "FALSE"));
+        ("GtkIMModule(%p): DispatchTextEvent, aIsCommit=%s",
+         this, aIsCommit ? "TRUE" : "FALSE"));
 
     if (!mLastFocusedWindow) {
         PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
@@ -1191,7 +1201,7 @@ nsGtkIMModule::DispatchTextEvent(const nsAString &aCompositionString,
         return false;
     }
 
-    if (!mIsComposing) {
+    if (!IsComposing()) {
         PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
             ("    The composition wasn't started, force starting..."));
         nsCOMPtr<nsIWidget> kungFuDeathGrip = mLastFocusedWindow;
@@ -1218,13 +1228,27 @@ nsGtkIMModule::DispatchTextEvent(const nsAString &aCompositionString,
       }
     }
 
+    // Store the selected string which will be removed by following text event.
+    if (mCompositionState == eCompositionState_CompositionStartDispatched) {
+        // XXX We should assume, for now, any web applications don't change
+        //     selection at handling this text event.
+        nsQueryContentEvent querySelectedTextEvent(true,
+                                                   NS_QUERY_SELECTED_TEXT,
+                                                   mLastFocusedWindow);
+        mLastFocusedWindow->DispatchEvent(&querySelectedTextEvent, status);
+        if (querySelectedTextEvent.mSucceeded) {
+            mSelectedString = querySelectedTextEvent.mReply.mString;
+            mCompositionStart = querySelectedTextEvent.mReply.mOffset;
+        }
+    }
+
     nsTextEvent textEvent(true, NS_TEXT_TEXT, mLastFocusedWindow);
     InitEvent(textEvent);
 
     PRUint32 targetOffset = mCompositionStart;
 
     nsAutoTArray<nsTextRange, 4> textRanges;
-    if (aCheckAttr) {
+    if (!aIsCommit) {
         // NOTE: SetTextRangeList() assumes that mDispatchedCompositionString
         //       has been updated already.
         SetTextRangeList(textRanges);
@@ -1242,6 +1266,10 @@ nsGtkIMModule::DispatchTextEvent(const nsAString &aCompositionString,
     textEvent.rangeArray = textRanges.Elements();
     textEvent.theText = mDispatchedCompositionString.get();
 
+    mCompositionState = aIsCommit ?
+        eCompositionState_CommitTextEventDispatched :
+        eCompositionState_TextEventDispatched;
+
     mLastFocusedWindow->DispatchEvent(&textEvent, status);
     if (lastFocusedWindow->IsDestroyed() ||
         lastFocusedWindow != mLastFocusedWindow) {
@@ -1441,7 +1469,8 @@ nsresult
 nsGtkIMModule::GetCurrentParagraph(nsAString& aText, PRUint32& aCursorPos)
 {
     PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
-        ("GtkIMModule(%p): GetCurrentParagraph", this));
+        ("GtkIMModule(%p): GetCurrentParagraph, mCompositionState=%s",
+         this, GetCompositionStateName()));
 
     if (!mLastFocusedWindow) {
         PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
@@ -1451,15 +1480,26 @@ nsGtkIMModule::GetCurrentParagraph(nsAString& aText, PRUint32& aCursorPos)
 
     nsEventStatus status;
 
-    // Query cursor position & selection
-    nsQueryContentEvent querySelectedTextEvent(true,
-                                               NS_QUERY_SELECTED_TEXT,
-                                               mLastFocusedWindow);
-    mLastFocusedWindow->DispatchEvent(&querySelectedTextEvent, status);
-    NS_ENSURE_TRUE(querySelectedTextEvent.mSucceeded, NS_ERROR_FAILURE);
+    PRUint32 selOffset = mCompositionStart;
+    PRUint32 selLength = mSelectedString.Length();
 
-    PRUint32 selOffset = querySelectedTextEvent.mReply.mOffset;
-    PRUint32 selLength = querySelectedTextEvent.mReply.mString.Length();
+    // If focused editor doesn't have composition string, we should use
+    // current selection.
+    if (!EditorHasCompositionString()) {
+        // Query cursor position & selection
+        nsQueryContentEvent querySelectedTextEvent(true,
+                                                   NS_QUERY_SELECTED_TEXT,
+                                                   mLastFocusedWindow);
+        mLastFocusedWindow->DispatchEvent(&querySelectedTextEvent, status);
+        NS_ENSURE_TRUE(querySelectedTextEvent.mSucceeded, NS_ERROR_FAILURE);
+
+        selOffset = querySelectedTextEvent.mReply.mOffset;
+        selLength = querySelectedTextEvent.mReply.mString.Length();
+    }
+
+    PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
+        ("        selOffset=%u, selLength=%u",
+         selOffset, selLength));
 
     // XXX nsString::Find and nsString::RFind take PRInt32 for offset, so,
     //     we cannot support this request when the current offset is larger
@@ -1468,9 +1508,6 @@ nsGtkIMModule::GetCurrentParagraph(nsAString& aText, PRUint32& aCursorPos)
         selOffset + selLength > PR_INT32_MAX) {
         PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
             ("    FAILED, The selection is out of range"));
-        PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
-            ("        selOffset=%u, selLength=%u",
-             selOffset, selLength));
         return NS_ERROR_FAILURE;
     }
 
@@ -1485,13 +1522,20 @@ nsGtkIMModule::GetCurrentParagraph(nsAString& aText, PRUint32& aCursorPos)
     nsAutoString textContent(queryTextContentEvent.mReply.mString);
     if (selOffset + selLength > textContent.Length()) {
         PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
-            ("    FAILED, The selection is invalid"));
-        PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
-            ("        selOffset=%u, selLength=%u, textContent.Length()=%u",
-             selOffset, selLength, textContent.Length()));
+            ("    FAILED, The selection is invalid, textContent.Length()=%u",
+             textContent.Length()));
         return NS_ERROR_FAILURE;
     }
 
+    // Remove composing string and restore the selected string because
+    // GtkEntry doesn't remove selected string until committing, however,
+    // our editor does it.  We should emulate the behavior for IME.
+    if (EditorHasCompositionString() &&
+        mDispatchedCompositionString != mSelectedString) {
+        textContent.Replace(mCompositionStart,
+            mDispatchedCompositionString.Length(), mSelectedString);
+    }
+
     // Get only the focused paragraph, by looking for newlines
     PRInt32 parStart = (selOffset == 0) ? 0 :
         textContent.RFind("\n", false, selOffset - 1, -1) + 1;
@@ -1503,7 +1547,9 @@ nsGtkIMModule::GetCurrentParagraph(nsAString& aText, PRUint32& aCursorPos)
     aCursorPos = selOffset - PRUint32(parStart);
 
     PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
-        ("    aText.Length()=%u, aCursorPos=%u", aText.Length(), aCursorPos));
+        ("    aText=%s, aText.Length()=%u, aCursorPos=%u",
+         NS_ConvertUTF16toUTF8(aText).get(),
+         aText.Length(), aCursorPos));
 
     return NS_OK;
 }
@@ -1512,8 +1558,9 @@ nsresult
 nsGtkIMModule::DeleteText(const PRInt32 aOffset, const PRUint32 aNChars)
 {
     PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
-        ("GtkIMModule(%p): DeleteText, aOffset=%d, aNChars=%d",
-         this, aOffset, aNChars));
+        ("GtkIMModule(%p): DeleteText, aOffset=%d, aNChars=%d, "
+         "mCompositionState=%s",
+         this, aOffset, aNChars, GetCompositionStateName()));
 
     if (!mLastFocusedWindow) {
         PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
@@ -1521,31 +1568,93 @@ nsGtkIMModule::DeleteText(const PRInt32 aOffset, const PRUint32 aNChars)
         return NS_ERROR_NULL_POINTER;
     }
 
+    nsRefPtr<nsWindow> lastFocusedWindow(mLastFocusedWindow);
     nsEventStatus status;
 
-    // Query cursor position & selection
-    nsQueryContentEvent querySelectedTextEvent(true,
-                                               NS_QUERY_SELECTED_TEXT,
-                                               mLastFocusedWindow);
-    mLastFocusedWindow->DispatchEvent(&querySelectedTextEvent, status);
-    NS_ENSURE_TRUE(querySelectedTextEvent.mSucceeded, NS_ERROR_FAILURE);
+    // First, we should cancel current composition because editor cannot
+    // handle changing selection and deleting text.
+    PRUint32 selOffset;
+    bool wasComposing = IsComposing();
+    bool editorHadCompositionString = EditorHasCompositionString();
+    if (wasComposing) {
+        selOffset = mCompositionStart;
+        if (editorHadCompositionString &&
+            !DispatchTextEvent(mSelectedString, false)) {
+            PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
+                ("    FAILED, quitting from DeletText"));
+            return NS_ERROR_FAILURE;
+        }
+        if (!DispatchCompositionEnd()) {
+            PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
+                ("    FAILED, quitting from DeletText"));
+            return NS_ERROR_FAILURE;
+        }
+    } else {
+        // Query cursor position & selection
+        nsQueryContentEvent querySelectedTextEvent(true,
+                                                   NS_QUERY_SELECTED_TEXT,
+                                                   mLastFocusedWindow);
+        lastFocusedWindow->DispatchEvent(&querySelectedTextEvent, status);
+        NS_ENSURE_TRUE(querySelectedTextEvent.mSucceeded, NS_ERROR_FAILURE);
+
+        selOffset = querySelectedTextEvent.mReply.mOffset;
+    }
 
     // Set selection to delete
     nsSelectionEvent selectionEvent(true, NS_SELECTION_SET,
                                     mLastFocusedWindow);
-    selectionEvent.mOffset = querySelectedTextEvent.mReply.mOffset + aOffset;
+    selectionEvent.mOffset = selOffset + aOffset;
     selectionEvent.mLength = aNChars;
     selectionEvent.mReversed = false;
     selectionEvent.mExpandToClusterBoundary = false;
-    mLastFocusedWindow->DispatchEvent(&selectionEvent, status);
-    NS_ENSURE_TRUE(selectionEvent.mSucceeded, NS_ERROR_FAILURE);
+    lastFocusedWindow->DispatchEvent(&selectionEvent, status);
+
+    if (!selectionEvent.mSucceeded ||
+        lastFocusedWindow != mLastFocusedWindow ||
+        lastFocusedWindow->Destroyed()) {
+        PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
+            ("    FAILED, setting selection caused focus change "
+             "or window destroyed"));
+        return NS_ERROR_FAILURE;
+    }
 
     // Delete the selection
     nsContentCommandEvent contentCommandEvent(true,
                                               NS_CONTENT_COMMAND_DELETE,
                                               mLastFocusedWindow);
     mLastFocusedWindow->DispatchEvent(&contentCommandEvent, status);
-    NS_ENSURE_TRUE(contentCommandEvent.mSucceeded, NS_ERROR_FAILURE);
+
+    if (!contentCommandEvent.mSucceeded ||
+        lastFocusedWindow != mLastFocusedWindow ||
+        lastFocusedWindow->Destroyed()) {
+        PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
+            ("    FAILED, deleting the selection caused focus change "
+             "or window destroyed"));
+        return NS_ERROR_FAILURE;
+    }
+
+    if (!wasComposing) {
+        return NS_OK;
+    }
+
+    // Restore the composition at new caret position.
+    if (!DispatchCompositionStart()) {
+        PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
+            ("    FAILED, resterting composition start"));
+        return NS_ERROR_FAILURE;
+    }
+
+    if (!editorHadCompositionString) {
+        return NS_OK;
+    }
+
+    nsAutoString compositionString;
+    GetCompositionString(compositionString);
+    if (!DispatchTextEvent(compositionString, true)) {
+        PR_LOG(gGtkIMLog, PR_LOG_ALWAYS,
+            ("    FAILED, restoring composition string"));
+        return NS_ERROR_FAILURE;
+    }
 
     return NS_OK;
 }
diff --git a/widget/gtk2/nsGtkIMModule.h b/widget/gtk2/nsGtkIMModule.h
index 373a8c5b2db..5750c807375 100644
--- a/widget/gtk2/nsGtkIMModule.h
+++ b/widget/gtk2/nsGtkIMModule.h
@@ -169,16 +169,52 @@ protected:
     // was dispatched by compositionupdate event.
     nsString mDispatchedCompositionString;
 
+    // mSelectedString is the selected string which was removed by first
+    // text event.
+    nsString mSelectedString;
+
     // OnKeyEvent() temporarily sets mProcessingKeyEvent to the given native
     // event.
     GdkEventKey* mProcessingKeyEvent;
 
+    // mCompositionState indicates current status of composition.
+    enum eCompositionState {
+        eCompositionState_NotComposing,
+        eCompositionState_CompositionStartDispatched,
+        eCompositionState_TextEventDispatched,
+        eCompositionState_CommitTextEventDispatched
+    };
+    eCompositionState mCompositionState;
+
+    bool IsComposing()
+    {
+        return (mCompositionState != eCompositionState_NotComposing);
+    }
+
+    bool EditorHasCompositionString()
+    {
+        return (mCompositionState == eCompositionState_TextEventDispatched);
+    }
+
+#ifdef PR_LOGGING
+    const char* GetCompositionStateName()
+    {
+        switch (mCompositionState) {
+            case eCompositionState_NotComposing:
+                return "NotComposing";
+            case eCompositionState_CompositionStartDispatched:
+                return "CompositionStartDispatched";
+            case eCompositionState_TextEventDispatched:
+                return "TextEventDispatched";
+            case eCompositionState_CommitTextEventDispatched:
+                return "CommitTextEventDispatched";
+            default:
+                return "InvaildState";
+        }
+    }
+#endif // PR_LOGGING
+
 
-    // mIsComposing is set to TRUE when we dispatch the composition start
-    // event.  And it's set to FALSE when we dispatches the composition end
-    // event.  Note that mCompositionString can be empty string even if this is
-    // TRUE.
-    bool mIsComposing;
     // mIsIMFocused is set to TRUE when we call gtk_im_context_focus_in(). And
     // it's set to FALSE when we call gtk_im_context_focus_out().
     bool mIsIMFocused;
@@ -303,10 +339,10 @@ protected:
     bool DispatchCompositionStart();
     bool DispatchCompositionEnd();
 
-    // Dispatches a text event.  If aCheckAttr is TRUE, dispatches a committed
+    // Dispatches a text event.  If aIsCommit is TRUE, dispatches a committed
     // text event.  Otherwise, dispatches a composing text event.
     bool DispatchTextEvent(const nsAString& aCompositionString,
-                             bool aCheckAttr);
+                           bool aIsCommit);
 
 };
 
diff --git a/widget/gtk2/nsGtkKeyUtils.cpp b/widget/gtk2/nsGtkKeyUtils.cpp
index 867b098dd2a..9f1bc80cae3 100644
--- a/widget/gtk2/nsGtkKeyUtils.cpp
+++ b/widget/gtk2/nsGtkKeyUtils.cpp
@@ -68,6 +68,9 @@ struct KeyPair {
     guint GDKKeyval;
 };
 
+#define IS_ASCII_ALPHABETICAL(key) \
+    ((('a' <= key) && (key <= 'z')) || (('A' <= key) && (key <= 'Z')))
+
 //
 // Netscape keycodes are defined in widget/public/nsGUIEvent.h
 // GTK keycodes are defined in <gdk/gdkkeysyms.h>
@@ -879,9 +882,16 @@ KeymapWrapper::InitKeypressEvent(nsKeyEvent& aKeyEvent,
         aKeyEvent.alternativeCharCodes.AppendElement(altCharCodes);
     }
 
+    PRBool needLatinKeyCodes = !isLatin;
+    if (!needLatinKeyCodes) {
+        needLatinKeyCodes = 
+            (IS_ASCII_ALPHABETICAL(altCharCodes.mUnshiftedCharCode) !=
+             IS_ASCII_ALPHABETICAL(altCharCodes.mShiftedCharCode));
+    }
+
     // If current keyboard layout can input Latin characters, we don't need
     // more information.
-    if (isLatin) {
+    if (!needLatinKeyCodes) {
         PR_LOG(gKeymapWrapperLog, PR_LOG_ALWAYS,
             ("KeymapWrapper(%p): InitKeypressEvent, keyCode=0x%02X, "
              "charCode=0x%08X, level=%d, altCharCodes={ "
diff --git a/widget/windows/WinMouseScrollHandler.cpp b/widget/windows/WinMouseScrollHandler.cpp
index 4a755f97d43..7d2a4dad311 100644
--- a/widget/windows/WinMouseScrollHandler.cpp
+++ b/widget/windows/WinMouseScrollHandler.cpp
@@ -12,6 +12,7 @@
 #include "WinMouseScrollHandler.h"
 #include "nsWindow.h"
 #include "WinUtils.h"
+#include "nsGkAtoms.h"
 
 #include "mozilla/Preferences.h"
 
diff --git a/widget/xpwidgets/GfxInfoX11.cpp b/widget/xpwidgets/GfxInfoX11.cpp
index bb0ea7ebbe4..849c483907c 100644
--- a/widget/xpwidgets/GfxInfoX11.cpp
+++ b/widget/xpwidgets/GfxInfoX11.cpp
@@ -283,6 +283,8 @@ GfxInfo::GetFeatureStatusImpl(PRInt32 aFeature,
                               OperatingSystem* aOS /* = nsnull */)
 
 {
+  GetData();
+
   NS_ENSURE_ARG_POINTER(aStatus);
   *aStatus = nsIGfxInfo::FEATURE_STATUS_UNKNOWN;
   aSuggestedDriverVersion.SetIsVoid(true);
@@ -310,7 +312,6 @@ GfxInfo::GetFeatureStatusImpl(PRInt32 aFeature,
     if (aFeature == nsIGfxInfo::FEATURE_OPENGL_LAYERS ||
         aFeature == nsIGfxInfo::FEATURE_WEBGL_OPENGL ||
         aFeature == nsIGfxInfo::FEATURE_WEBGL_MSAA) {
-      GetData();
 
       // Disable OpenGL layers when we don't have texture_from_pixmap because it regresses performance. 
       if (aFeature == nsIGfxInfo::FEATURE_OPENGL_LAYERS && !mHasTextureFromPixmap) {
@@ -333,9 +334,9 @@ GfxInfo::GetFeatureStatusImpl(PRInt32 aFeature,
       }
 
       if (mIsMesa) {
-        if (mIsNouveau) {
+        if (mIsNouveau && version(mMajorVersion, mMinorVersion) < version(8,0)) {
           *aStatus = nsIGfxInfo::FEATURE_BLOCKED_DRIVER_VERSION;
-          aSuggestedDriverVersion.AssignLiteral("<Not the Nouveau driver>");
+          aSuggestedDriverVersion.AssignLiteral("Mesa 8.0");
         } else if (version(mMajorVersion, mMinorVersion, mRevisionVersion) < version(7,10,3)) {
           *aStatus = nsIGfxInfo::FEATURE_BLOCKED_DRIVER_VERSION;
           aSuggestedDriverVersion.AssignLiteral("Mesa 7.10.3");
diff --git a/widget/xpwidgets/nsIdleService.cpp b/widget/xpwidgets/nsIdleService.cpp
index e4b0b49e4f4..fd39230251e 100644
--- a/widget/xpwidgets/nsIdleService.cpp
+++ b/widget/xpwidgets/nsIdleService.cpp
@@ -81,13 +81,29 @@ public:
 ////////////////////////////////////////////////////////////////////////////////
 //// nsIdleServiceDaily
 
-NS_IMPL_ISUPPORTS1(nsIdleServiceDaily, nsIObserver)
+NS_IMPL_ISUPPORTS2(nsIdleServiceDaily, nsIObserver, nsISupportsWeakReference)
 
 NS_IMETHODIMP
 nsIdleServiceDaily::Observe(nsISupports *,
-                            const char *,
+                            const char *aTopic,
                             const PRUnichar *)
 {
+  if (strcmp(aTopic, "profile-after-change") == 0) {
+    // We are back. Start sending notifications again.
+    mShutdownInProgress = false;
+    return NS_OK;
+  }
+
+  if (strcmp(aTopic, "xpcom-will-shutdown") == 0 ||
+      strcmp(aTopic, "profile-change-teardown") == 0) {
+    mShutdownInProgress = true;
+  }
+
+  if (mShutdownInProgress || strcmp(aTopic, OBSERVER_TOPIC_BACK) == 0) {
+    return NS_OK;
+  }
+  MOZ_ASSERT(strcmp(aTopic, OBSERVER_TOPIC_IDLE) == 0);
+
   // Notify anyone who cares.
   nsCOMPtr<nsIObserverService> observerService =
     mozilla::services::GetObserverService();
@@ -123,6 +139,7 @@ nsIdleServiceDaily::nsIdleServiceDaily(nsIIdleService* aIdleService)
   : mIdleService(aIdleService)
   , mTimer(do_CreateInstance(NS_TIMER_CONTRACTID))
   , mCategoryObservers(OBSERVER_TOPIC_IDLE_DAILY)
+  , mShutdownInProgress(false)
 {
 }
 
@@ -150,6 +167,14 @@ nsIdleServiceDaily::Init()
                                        SECONDS_PER_DAY * PR_MSEC_PER_SEC,
                                        nsITimer::TYPE_ONE_SHOT);
   }
+
+  // Register for when we should terminate/pause
+  nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
+  if (obs) {
+    obs->AddObserver(this, "xpcom-will-shutdown", true);
+    obs->AddObserver(this, "profile-change-teardown", true);
+    obs->AddObserver(this, "profile-after-change", true);
+  }
 }
 
 nsIdleServiceDaily::~nsIdleServiceDaily()
diff --git a/widget/xpwidgets/nsIdleService.h b/widget/xpwidgets/nsIdleService.h
index fb8a3b583e3..174ee7c5a31 100644
--- a/widget/xpwidgets/nsIdleService.h
+++ b/widget/xpwidgets/nsIdleService.h
@@ -49,6 +49,7 @@
 #include "nsIObserver.h"
 #include "nsIIdleService.h"
 #include "nsCategoryCache.h"
+#include "nsWeakReference.h"
 
 /**
  * Class we can use to store an observer with its associated idle time
@@ -71,7 +72,8 @@ class nsIdleService;
 /**
  * Class to handle the daily idle timer.
  */
-class nsIdleServiceDaily : public nsIObserver
+class nsIdleServiceDaily : public nsIObserver,
+                           public nsSupportsWeakReference
 {
 public:
   NS_DECL_ISUPPORTS
@@ -116,6 +118,11 @@ private:
    * Cache of observers for the "idle-daily" category.
    */
   nsCategoryCache<nsIObserver> mCategoryObservers;
+
+  /**
+   * Boolean set to true when daily idle notifications should be disabled.
+   */
+  bool mShutdownInProgress;
 };
 
 class nsIdleService : public nsIIdleService
diff --git a/xpcom/base/AvailableMemoryTracker.cpp b/xpcom/base/AvailableMemoryTracker.cpp
index b51e866fd1f..80089fc6c34 100644
--- a/xpcom/base/AvailableMemoryTracker.cpp
+++ b/xpcom/base/AvailableMemoryTracker.cpp
@@ -141,10 +141,12 @@ void safe_write(PRUint64 x)
 #endif
 
 PRUint32 sLowVirtualMemoryThreshold = 0;
+PRUint32 sLowCommitSpaceThreshold = 0;
 PRUint32 sLowPhysicalMemoryThreshold = 0;
-PRUint32 sLowPhysicalMemoryNotificationIntervalMS = 0;
+PRUint32 sLowMemoryNotificationIntervalMS = 0;
 
 PRUint32 sNumLowVirtualMemEvents = 0;
+PRUint32 sNumLowCommitSpaceEvents = 0;
 PRUint32 sNumLowPhysicalMemEvents = 0;
 
 WindowsDllInterceptor sKernel32Intercept;
@@ -173,6 +175,37 @@ HBITMAP (WINAPI *sCreateDIBSectionOrig)
    UINT aUsage, VOID **aBits,
    HANDLE aSection, DWORD aOffset);
 
+/**
+ * Fire a memory pressure event if it's been long enough since the last one we
+ * fired.
+ */
+bool MaybeScheduleMemoryPressureEvent()
+{
+  // If this interval rolls over, we may fire an extra memory pressure
+  // event, but that's not a big deal.
+  PRIntervalTime interval = PR_IntervalNow() - sLastLowMemoryNotificationTime;
+  if (sHasScheduledOneLowMemoryNotification &&
+      PR_IntervalToMilliseconds(interval) < sLowMemoryNotificationIntervalMS) {
+
+    LOG("Not scheduling low physical memory notification, "
+        "because not enough time has elapsed since last one.");
+    return false;
+  }
+
+  // There's a bit of a race condition here, since an interval may be a
+  // 64-bit number, and 64-bit writes aren't atomic on x86-32.  But let's
+  // not worry about it -- the races only happen when we're already
+  // experiencing memory pressure and firing notifications, so the worst
+  // thing that can happen is that we fire two notifications when we
+  // should have fired only one.
+  sHasScheduledOneLowMemoryNotification = true;
+  sLastLowMemoryNotificationTime = PR_IntervalNow();
+
+  LOG("Scheduling memory pressure notification.");
+  ScheduleMemoryPressureEvent();
+  return true;
+}
+
 void CheckMemAvailable()
 {
   MEMORYSTATUSEX stat;
@@ -185,42 +218,23 @@ void CheckMemAvailable()
   {
     // sLowVirtualMemoryThreshold is in MB, but ullAvailVirtual is in bytes.
     if (stat.ullAvailVirtual < sLowVirtualMemoryThreshold * 1024 * 1024) {
-      // If we're running low on virtual memory, schedule the notification.
-      // We'll probably crash if we run out of virtual memory, so don't worry
-      // about firing this notification too often.
+      // If we're running low on virtual memory, unconditionally schedule the
+      // notification.  We'll probably crash if we run out of virtual memory,
+      // so don't worry about firing this notification too often.
       LOG("Detected low virtual memory.");
       PR_ATOMIC_INCREMENT(&sNumLowVirtualMemEvents);
       ScheduleMemoryPressureEvent();
     }
+    else if (stat.ullAvailPageFile < sLowCommitSpaceThreshold * 1024 * 1024) {
+      LOG("Detected low available page file space.");
+      if (MaybeScheduleMemoryPressureEvent()) {
+        PR_ATOMIC_INCREMENT(&sNumLowCommitSpaceEvents);
+      }
+    }
     else if (stat.ullAvailPhys < sLowPhysicalMemoryThreshold * 1024 * 1024) {
       LOG("Detected low physical memory.");
-      // If the machine is running low on physical memory and it's been long
-      // enough since we last fired a low-memory notification, fire a
-      // notification.
-      //
-      // If this interval rolls over, we may fire an extra memory pressure
-      // event, but that's not a big deal.
-      PRIntervalTime interval = PR_IntervalNow() - sLastLowMemoryNotificationTime;
-      if (!sHasScheduledOneLowMemoryNotification ||
-          PR_IntervalToMilliseconds(interval) >=
-            sLowPhysicalMemoryNotificationIntervalMS) {
-
-        // There's a bit of a race condition here, since an interval may be a
-        // 64-bit number, and 64-bit writes aren't atomic on x86-32.  But let's
-        // not worry about it -- the races only happen when we're already
-        // experiencing memory pressure and firing notifications, so the worst
-        // thing that can happen is that we fire two notifications when we
-        // should have fired only one.
-        sHasScheduledOneLowMemoryNotification = true;
-        sLastLowMemoryNotificationTime = PR_IntervalNow();
-
-        LOG("Scheduling memory pressure notification.");
+      if (MaybeScheduleMemoryPressureEvent()) {
         PR_ATOMIC_INCREMENT(&sNumLowPhysicalMemEvents);
-        ScheduleMemoryPressureEvent();
-      }
-      else {
-        LOG("Not scheduling low physical memory notification, "
-            "because not enough time has elapsed since last one.");
       }
     }
   }
@@ -389,6 +403,49 @@ public:
 
 NS_IMPL_ISUPPORTS1(NumLowVirtualMemoryEventsMemoryReporter, nsIMemoryReporter)
 
+class NumLowCommitSpaceEventsMemoryReporter : public NumLowMemoryEventsReporter
+{
+public:
+  NS_DECL_ISUPPORTS
+
+  NS_IMETHOD GetPath(nsACString &aPath)
+  {
+    aPath.AssignLiteral("low-commit-space-events");
+    return NS_OK;
+  }
+
+  NS_IMETHOD GetAmount(PRInt64 *aAmount)
+  {
+    *aAmount = sNumLowCommitSpaceEvents;
+    return NS_OK;
+  }
+
+  NS_IMETHOD GetDescription(nsACString &aDescription)
+  {
+    aDescription.AssignLiteral(
+      "Number of low-commit-space events fired since startup. ");
+
+    if (sLowCommitSpaceThreshold == 0 || !sHooksInstalled) {
+      aDescription.Append(nsPrintfCString(1024,
+        "Tracking low-commit-space events is disabled, but you can enable it "
+        "by giving the memory.low_commit_space_threshold_mb pref a non-zero "
+        "value%s.",
+        sHooksInstalled ? "" : " and restarting"));
+    }
+    else {
+      aDescription.Append(nsPrintfCString(1024,
+        "We fire such an event if we notice there is less than %d MB of "
+        "available commit space (controlled by the "
+        "'memory.low_commit_space_threshold_mb' pref).  Windows will likely "
+        "kill us if we run out of commit space, so this event is somewhat dire.",
+        sLowCommitSpaceThreshold));
+    }
+    return NS_OK;
+  }
+};
+
+NS_IMPL_ISUPPORTS1(NumLowCommitSpaceEventsMemoryReporter, nsIMemoryReporter)
+
 class NumLowPhysicalMemoryEventsMemoryReporter : public NumLowMemoryEventsReporter
 {
 public:
@@ -452,8 +509,10 @@ void Init()
 
   Preferences::AddUintVarCache(&sLowPhysicalMemoryThreshold,
       "memory.low_physical_memory_threshold_mb", 0);
-  Preferences::AddUintVarCache(&sLowPhysicalMemoryNotificationIntervalMS,
-      "memory.low_physical_memory_notification_interval_ms", 10000);
+  Preferences::AddUintVarCache(&sLowCommitSpaceThreshold,
+      "memory.low_commit_space_threshold_mb", 128);
+  Preferences::AddUintVarCache(&sLowMemoryNotificationIntervalMS,
+      "memory.low_memory_notification_interval_ms", 10000);
 
   // Don't register the hooks if we're a build instrumented for PGO or if both
   // thresholds are 0.  (If we're an instrumented build, the compiler adds
@@ -480,6 +539,7 @@ void Init()
     sHooksInstalled = false;
   }
 
+  NS_RegisterMemoryReporter(new NumLowCommitSpaceEventsMemoryReporter());
   NS_RegisterMemoryReporter(new NumLowPhysicalMemoryEventsMemoryReporter());
   if (sizeof(void*) == 4) {
     NS_RegisterMemoryReporter(new NumLowVirtualMemoryEventsMemoryReporter());
diff --git a/xpcom/base/MapsMemoryReporter.cpp b/xpcom/base/MapsMemoryReporter.cpp
index 923dc4dad17..ab2142f880c 100644
--- a/xpcom/base/MapsMemoryReporter.cpp
+++ b/xpcom/base/MapsMemoryReporter.cpp
@@ -157,7 +157,7 @@ public:
   }
 
   NS_IMETHOD
-  CollectReports(nsIMemoryMultiReporterCallback *aCallback,
+  CollectReports(nsIMemoryMultiReporterCallback *aCb,
                  nsISupports *aClosure);
 
   NS_IMETHOD
@@ -174,7 +174,7 @@ private:
 
   nsresult
   ParseMapping(FILE *aFile,
-               nsIMemoryMultiReporterCallback *aCallback,
+               nsIMemoryMultiReporterCallback *aCb,
                nsISupports *aClosure,
                CategoriesSeen *aCategoriesSeen);
 
@@ -188,7 +188,7 @@ private:
   ParseMapBody(FILE *aFile,
                const nsACString &aName,
                const nsACString &aDescription,
-               nsIMemoryMultiReporterCallback *aCallback,
+               nsIMemoryMultiReporterCallback *aCb,
                nsISupports *aClosure,
                CategoriesSeen *aCategoriesSeen);
 
@@ -212,7 +212,7 @@ MapsReporter::MapsReporter()
 }
 
 NS_IMETHODIMP
-MapsReporter::CollectReports(nsIMemoryMultiReporterCallback *aCallback,
+MapsReporter::CollectReports(nsIMemoryMultiReporterCallback *aCb,
                              nsISupports *aClosure)
 {
   CategoriesSeen categoriesSeen;
@@ -222,7 +222,7 @@ MapsReporter::CollectReports(nsIMemoryMultiReporterCallback *aCallback,
     return NS_ERROR_FAILURE;
 
   while (true) {
-    nsresult rv = ParseMapping(f, aCallback, aClosure, &categoriesSeen);
+    nsresult rv = ParseMapping(f, aCb, aClosure, &categoriesSeen);
     if (NS_FAILED(rv))
       break;
   }
@@ -237,13 +237,15 @@ MapsReporter::CollectReports(nsIMemoryMultiReporterCallback *aCallback,
   NS_ASSERTION(categoriesSeen.mSeenVsize, "Didn't create a vsize node?");
   NS_ASSERTION(categoriesSeen.mSeenVsize, "Didn't create a resident node?");
   if (!categoriesSeen.mSeenSwap) {
-    aCallback->Callback(NS_LITERAL_CSTRING(""),
-                        NS_LITERAL_CSTRING("smaps/swap/total"),
-                        nsIMemoryReporter::KIND_NONHEAP,
-                        nsIMemoryReporter::UNITS_BYTES,
-                        0,
-                        NS_LITERAL_CSTRING("This process uses no swap space."),
-                        aClosure);
+    nsresult rv;
+    rv = aCb->Callback(NS_LITERAL_CSTRING(""),
+                       NS_LITERAL_CSTRING("smaps/swap/total"),
+                       nsIMemoryReporter::KIND_NONHEAP,
+                       nsIMemoryReporter::UNITS_BYTES,
+                       0,
+                       NS_LITERAL_CSTRING("This process uses no swap space."),
+                       aClosure);
+    NS_ENSURE_SUCCESS(rv, rv);
   }
 
   return NS_OK;
@@ -293,7 +295,7 @@ MapsReporter::FindLibxul()
 nsresult
 MapsReporter::ParseMapping(
   FILE *aFile,
-  nsIMemoryMultiReporterCallback *aCallback,
+  nsIMemoryMultiReporterCallback *aCb,
   nsISupports *aClosure,
   CategoriesSeen *aCategoriesSeen)
 {
@@ -347,7 +349,7 @@ MapsReporter::ParseMapping(
   GetReporterNameAndDescription(path, perms, name, description);
 
   while (true) {
-    nsresult rv = ParseMapBody(aFile, name, description, aCallback,
+    nsresult rv = ParseMapBody(aFile, name, description, aCb,
                                aClosure, aCategoriesSeen);
     if (NS_FAILED(rv))
       break;
@@ -476,7 +478,7 @@ MapsReporter::ParseMapBody(
   FILE *aFile,
   const nsACString &aName,
   const nsACString &aDescription,
-  nsIMemoryMultiReporterCallback *aCallback,
+  nsIMemoryMultiReporterCallback *aCb,
   nsISupports *aClosure,
   CategoriesSeen *aCategoriesSeen)
 {
@@ -523,12 +525,14 @@ MapsReporter::ParseMapBody(
   path.Append("/");
   path.Append(aName);
 
-  aCallback->Callback(NS_LITERAL_CSTRING(""),
-                      path,
-                      nsIMemoryReporter::KIND_NONHEAP,
-                      nsIMemoryReporter::UNITS_BYTES,
-                      PRInt64(size) * 1024, // convert from kB to bytes
-                      aDescription, aClosure);
+  nsresult rv;
+  rv = aCb->Callback(NS_LITERAL_CSTRING(""),
+                     path,
+                     nsIMemoryReporter::KIND_NONHEAP,
+                     nsIMemoryReporter::UNITS_BYTES,
+                     PRInt64(size) * 1024, // convert from kB to bytes
+                     aDescription, aClosure);
+  NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_OK;
 }
diff --git a/xpcom/ds/Makefile.in b/xpcom/ds/Makefile.in
index 2f8569df246..955648db116 100644
--- a/xpcom/ds/Makefile.in
+++ b/xpcom/ds/Makefile.in
@@ -95,7 +95,6 @@ EXPORTS		= \
 		nsCheapSets.h \
 		nsCppSharedAllocator.h \
 		nsCRT.h \
-		nsDoubleHashtable.h \
 		nsExpirationTracker.h \
 		nsFixedSizeAllocator.h \
 		nsHashtable.h \
diff --git a/xpcom/ds/nsAtomTable.cpp b/xpcom/ds/nsAtomTable.cpp
index f60900bb28c..2f18e8b5ae8 100644
--- a/xpcom/ds/nsAtomTable.cpp
+++ b/xpcom/ds/nsAtomTable.cpp
@@ -547,7 +547,7 @@ class CheckStaticAtomSizes
 };
 
 nsresult
-NS_RegisterStaticAtoms(const nsStaticAtom* aAtoms, PRUint32 aAtomCount)
+RegisterStaticAtoms(const nsStaticAtom* aAtoms, PRUint32 aAtomCount)
 {
   // this does three things:
   // 1) wraps each static atom in a wrapper, if necessary
diff --git a/xpcom/ds/nsDoubleHashtable.h b/xpcom/ds/nsDoubleHashtable.h
deleted file mode 100644
index 72ecdf8eda6..00000000000
--- a/xpcom/ds/nsDoubleHashtable.h
+++ /dev/null
@@ -1,483 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Communicator client code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 2002
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/**
- * nsDoubleHashtable.h is OBSOLETE. Use nsTHashtable or a derivative instead.
- */
-
-#ifndef __nsDoubleHashtable_h__
-#define __nsDoubleHashtable_h__
-
-#include "pldhash.h"
-#include "nscore.h"
-#include "nsString.h"
-#include "nsHashKeys.h"
-
-/*
- * This file provides several major things to make PLDHashTable easier to use:
- * - hash class macros for you to define a hashtable
- * - default key classes to use as superclasses for your entries
- * - empty maps for string, cstring, int and void
- */
-
-/*
- * USAGE
- *
- * To use nsDoubleHashtable macros
- * (1) Define an entry class
- * (2) Create the hash class
- * (3) Use the hash class
- *
- * EXAMPLE
- *
- * As an example, let's create a dictionary, a mapping from a string (the word)
- * to the pronunciation and definition of those words.
- *
- * (1) Define an entry class
- *
- * What we want here is an entry class that contains the word, the
- * pronunciation string, and the definition string.  Since we have a string key
- * we can use the standard PLDHashStringEntry class as our base, it will handle
- * the key stuff for us automatically.
- *
- * #include "nsDoubleHashtable.h"
- *
- * // Do NOT ADD VIRTUAL METHODS INTO YOUR ENTRY.  Everything will break.
- * // This is because of the 4-byte pointer C++ magically prepends onto your
- * // entry class.  It interacts very unhappily with PLDHashTable.
- * class DictionaryEntry : public PLDHashStringEntry {
- * public:
- *   DictionaryEntry(const void* aKey) : PLDHashStringEntry(aKey) { }
- *   ~DictionaryEntry() { }
- *   nsString mPronunciation;
- *   nsString mDefinition;
- * }
- *
- * (2) Create the hash class
- *
- * The final hash class you will use in step 3 is defined by 2 macros.
- *
- * DECL_DHASH_WRAPPER(Dictionary, DictionaryEntry, const nsAString&)
- * DHASH_WRAPPER(Dictionary, DictionaryEntry, const nsAString&)
- * 
- * (3) Use the hash class
- *
- * Here is a simple main() that might look up a string:
- *
- * int main(void) {
- *   Dictionary d;
- *   nsresult rv = d.Init(10);
- *   if (NS_FAILED(rv)) return 1;
- *
- *   // Put an entry
- *   DictionaryEntry* a = d.AddEntry(NS_LITERAL_STRING("doomed"));
- *   if (!a) return 1;
- *   a->mDefinition.AssignLiteral("The state you get in when a Mozilla release is pending");
- *   a->mPronunciation.AssignLiteral("doom-d");
- *
- *   // Get the entry
- *   DictionaryEntry* b = d.GetEntry(NS_LITERAL_STRING("doomed"));
- *   printf("doomed: %s\n", NS_ConvertUTF16toUTF8(b->mDefinition).get());
- *
- *   // Entries will be automagically cleaned up when the Dictionary object goes away
- *   return 0;
- * }
- *
- *
- * BONUS POINTS
- *
- * You may wish to extend this class and add helper functions like
- * nsDependentString* GetDefinition(nsAString& aWord).  For example:
- *
- * class MyDictionary : public Dictionary {
- * public:
- *   MyDictionary() { }
- *   // Make SURE you have a virtual destructor
- *   virtual ~myDictionary() { }
- *   nsDependentString* GetDefinition(const nsAString& aWord) {
- *     DictionaryEntry* e = GetEntry(aWord);
- *     if (e) {
- *       // We're returning an nsDependentString here, callers need to delete it
- *       // and it doesn't last long, but at least it doesn't create a copy
- *       return new nsDependentString(e->mDefinition.get());
- *     } else {
- *       return nsnull;
- *     }
- *   }
- *   nsresult PutDefinition(const nsAString& aWord,
- *                          const nsAString& aDefinition,
- *                          const nsAString& aPronunciation) {
- *     DictionaryEntry* e = AddEntry(aWord);
- *     if (!e) {
- *       return NS_ERROR_OUT_OF_MEMORY;
- *     }
- *     e->mDefinition = aDefinition;
- *     e->mPronunciation = aPronunciation;
- *     return NS_OK;
- *   }
- * }
- */
-
-/*
- * ENTRY CLASS DEFINITION
- *
- * The simplifications of PLDHashTable all hinge upon the idea of an entry
- * class, which is a class you define, where you store the key and values that
- * you will place in each hash entry.  You must define six methods for an entry
- * (the standard key classes, which you can extend from, define all of these
- * for you except the constructor and destructor):
- *
- * CONSTRUCTOR(const void* aKey)
- * When your entry is constructed it will only be given a pointer to the key.
- *
- * DESTRUCTOR
- * Called when the entry is destroyed (of course).
- *
- * bool MatchEntry(const void* aKey) - return true or false depending on
- *        whether the key pointed to by aKey matches this entry
- *
- * static PLDHashNumber HashKey(const void* aKey) - get a hashcode based on the
- *        key (must be the same every time for the same key, but does not have
- *        to be unique)
- *
- * For a small hash that just does key->value, you will often just extend a
- * standard key class and put a value member into it, and have a destructor and
- * constructor--nothing else necessary.
- *
- * See the default key entry classes as example entry classes.
- *
- * NOTES:
- * - Do NOT ADD VIRTUAL METHODS INTO YOUR ENTRY.  Everything will break.
- *   This is because of the 4-byte pointer C++ magically prepends onto your
- *   entry class.  It interacts very unhappily with PLDHashTable.
- */
-
-/*
- * PRIVATE HASHTABLE MACROS
- *
- * These internal macros can be used to declare the callbacks for an entry
- * class, but the wrapper class macros call these for you so don't call them.
- */
-
-//
-// DHASH_CALLBACKS
-//
-// Define the hashtable callback functions.  Do this in one place only, as you
-// will have redundant symbols otherwise.
-//
-// ENTRY_CLASS: the classname of the entry
-//
-#define DHASH_CALLBACKS(ENTRY_CLASS)                                          \
-static PLDHashNumber                                                          \
-ENTRY_CLASS##HashKey(PLDHashTable* table, const void* key)                    \
-{                                                                             \
-  return ENTRY_CLASS::HashKey(key);                                           \
-}                                                                             \
-static bool                                                                   \
-ENTRY_CLASS##MatchEntry(PLDHashTable *table, const PLDHashEntryHdr *entry,    \
-                        const void *key)                                      \
-{                                                                             \
-  const ENTRY_CLASS* e = static_cast<const ENTRY_CLASS*>(entry);              \
-  return e->MatchEntry(key);                                                  \
-}                                                                             \
-static void                                                                   \
-ENTRY_CLASS##ClearEntry(PLDHashTable *table, PLDHashEntryHdr *entry)          \
-{                                                                             \
-  ENTRY_CLASS* e = static_cast<ENTRY_CLASS *>(entry);                         \
-  e->~ENTRY_CLASS();                                                          \
-}                                                                             \
-static bool                                                                   \
-ENTRY_CLASS##InitEntry(PLDHashTable *table, PLDHashEntryHdr *entry,           \
-                       const void *key)                                       \
-{                                                                             \
-  new (entry) ENTRY_CLASS(key);                                               \
-  return true;                                                             \
-}
-
-//
-// DHASH_INIT
-//
-// Initialize hashtable to a certain class.
-//
-// HASHTABLE: the name of the PLDHashTable variable
-// ENTRY_CLASS: the classname of the entry
-// NUM_INITIAL_ENTRIES: the number of entry slots the hashtable should start
-//                      with
-// RV: an nsresult variable to hold the outcome of the initialization.
-//     Will be NS_ERROR_OUT_OF_MEMORY if failed, NS_OK otherwise.
-//
-#define DHASH_INIT(HASHTABLE,ENTRY_CLASS,NUM_INITIAL_ENTRIES,RV)              \
-PR_BEGIN_MACRO                                                                \
-  static PLDHashTableOps hash_table_ops =                                     \
-  {                                                                           \
-    PL_DHashAllocTable,                                                       \
-    PL_DHashFreeTable,                                                        \
-    ENTRY_CLASS##HashKey,                                                     \
-    ENTRY_CLASS##MatchEntry,                                                  \
-    PL_DHashMoveEntryStub,                                                    \
-    ENTRY_CLASS##ClearEntry,                                                  \
-    PL_DHashFinalizeStub,                                                     \
-    ENTRY_CLASS##InitEntry                                                    \
-  };                                                                          \
-  bool isLive = PL_DHashTableInit(&(HASHTABLE),                             \
-                                    &hash_table_ops, nsnull,                  \
-                                    sizeof(ENTRY_CLASS),                      \
-                                    (NUM_INITIAL_ENTRIES));                   \
-  if (!isLive) {                                                              \
-    (HASHTABLE).ops = nsnull;                                                 \
-    RV = NS_ERROR_OUT_OF_MEMORY;                                              \
-  } else {                                                                    \
-    RV = NS_OK;                                                               \
-  }                                                                           \
-PR_END_MACRO
-
-
-/*
- * WRAPPER CLASS
- *
- * This class handles initialization and destruction of the hashtable
- * (you must call Init() yourself).  It defines these functions:
- *
- * Init(aNumInitialEntries)
- * Initialize the hashtable.  This must be called once, it is only separate
- * from the constructor so that you can get the return value.  You should pass
- * in the number of entries you think the hashtable will typically hold (this
- * will be the amount of space allocated initially so that it will not have to
- * grow).
- *
- * ENTRY_CLASS* GetEntry(aKey):
- * Get the entry referenced by aKey and return a pointer to it.  THIS IS A
- * TEMPORARY POINTER and is only guaranteed to exist until the next time you do
- * an operation on the hashtable.  But you can safely use it until then.
- *
- * Returns nsnull if the entry is not found.
- *
- * ENTRY_CLASS* AddEntry(aKey):
- * Create a new, empty entry and return a pointer to it for you to fill values
- * into.  THIS IS A TEMPORARY POINTER and is only guaranteed to exist until the
- * next time you do an operation on the hashtable.  But you can safely fill it
- * in.
- *
- * Returns nsnull if the entry cannot be created (usually a low memory
- * constraint).
- *
- * void Remove(aKey)
- * Remove the entry referenced by aKey.  If the entry does not exist, nothing
- * will happen.
- *
- *
- * DECL_DHASH_WRAPPER(CLASSNAME,ENTRY_CLASS,KEY_TYPE)
- *
- * Declare the hash class but do not define the functions.
- *
- * CLASSNAME: the name of the class to declare.
- * ENTRY_CLASS: the class of the entry struct.
- * KEY_TYPE: the name of the key type for GetEntry and AddEntry.
- *
- *
- * DHASH_WRAPPER(CLASSNAME,ENTRY_CLASS,KEY_TYPE)
- *
- * Define the functions for the hash class.
- *
- * CLASSNAME: the name of the class to declare.
- * ENTRY_CLASS: the class of the entry struct.
- * KEY_TYPE: the name of the key type for GetEntry and AddEntry.
- *
- *
- * CAVEATS:
- * - You may have only *one* wrapper class per entry class.
- */
-
-#define DECL_DHASH_WRAPPER(CLASSNAME,ENTRY_CLASS,KEY_TYPE)                    \
-class DHASH_EXPORT CLASSNAME {                                                \
-public:                                                                       \
-  CLASSNAME();                                                                \
-  ~CLASSNAME();                                                               \
-  nsresult Init(PRUint32 aNumInitialEntries);                                 \
-  ENTRY_CLASS* GetEntry(const KEY_TYPE aKey);                                 \
-  ENTRY_CLASS* AddEntry(const KEY_TYPE aKey);                                 \
-  void Remove(const KEY_TYPE aKey);                                           \
-  PLDHashTable mHashTable;                                                    \
-};
-
-#define DHASH_WRAPPER(CLASSNAME,ENTRY_CLASS,KEY_TYPE)                         \
-DHASH_CALLBACKS(ENTRY_CLASS)                                                  \
-CLASSNAME::CLASSNAME() {                                                      \
-  mHashTable.ops = nsnull;                                                    \
-}                                                                             \
-CLASSNAME::~CLASSNAME() {                                                     \
-  if (mHashTable.ops) {                                                       \
-    PL_DHashTableFinish(&mHashTable);                                         \
-  }                                                                           \
-}                                                                             \
-nsresult CLASSNAME::Init(PRUint32 aNumInitialEntries) {                       \
-  if (!mHashTable.ops) {                                                      \
-    nsresult rv;                                                              \
-    DHASH_INIT(mHashTable,ENTRY_CLASS,aNumInitialEntries,rv);                 \
-    return rv;                                                                \
-  }                                                                           \
-  return NS_OK;                                                               \
-}                                                                             \
-ENTRY_CLASS* CLASSNAME::GetEntry(const KEY_TYPE aKey) {                       \
-  ENTRY_CLASS* e = static_cast<ENTRY_CLASS*>(                                 \
-                                  PL_DHashTableOperate(&mHashTable, &aKey,    \
-                                                       PL_DHASH_LOOKUP));     \
-  return PL_DHASH_ENTRY_IS_BUSY(e) ? e : nsnull;                              \
-}                                                                             \
-ENTRY_CLASS* CLASSNAME::AddEntry(const KEY_TYPE aKey) {                       \
-  return static_cast<ENTRY_CLASS*>(                                           \
-                        PL_DHashTableOperate(&mHashTable, &aKey,              \
-                                             PL_DHASH_ADD));                  \
-}                                                                             \
-void CLASSNAME::Remove(const KEY_TYPE aKey) {                                 \
-  PL_DHashTableOperate(&mHashTable, &aKey, PL_DHASH_REMOVE);                  \
-}
-
-/*
- * STANDARD KEY ENTRY CLASSES
- *
- * We have declared some standard key classes for you to make life a little
- * easier.  These include string, int and void* keys.  You can extend these
- * and add value data members to make a working hash entry class with your
- * values.
- *
- * PLDHashStringEntry:  nsAString
- * PLDHashCStringEntry: nsACString
- * PLDHashInt32Entry:   PRInt32
- * PLDHashVoidEntry:    void*
- *
- * As a short example, if you want to make a class that maps int to string,
- * you could do:
- *
- * class MyIntStringEntry : public PLDHashInt32Entry
- * {
- * public:
- *   MyIntStringEntry(const void* aKey) : PLDHashInt32Entry(aKey) { }
- *   ~MyIntStringEntry() { };
- *   nsString mMyStr;
- * };
- *
- * XXX It could be advisable (unless COW strings ever happens) to have a
- * PLDHashDependentStringEntry
- */
-
-//
-// String-key entry
-//
-class PLDHashStringEntry : public PLDHashEntryHdr
-{
-public:
-  PLDHashStringEntry(const void* aKey) :
-    mKey(*static_cast<const nsAString*>(aKey)) { }
-  ~PLDHashStringEntry() { }
-
-  static PLDHashNumber HashKey(const void* key) {
-    return HashString(*static_cast<const nsAString*>(key));
-  }
-  bool MatchEntry(const void* key) const {
-    return static_cast<const nsAString*>(key)->Equals(mKey);
-  }
-
-  const nsString mKey;
-};
-
-//
-// CString-key entry
-//
-class PLDHashCStringEntry : public PLDHashEntryHdr
-{
-public:
-  PLDHashCStringEntry(const void* aKey) :
-    mKey(*static_cast<const nsACString*>(aKey)) { }
-  ~PLDHashCStringEntry() { }
-
-  static PLDHashNumber HashKey(const void* key) {
-    return HashString(*static_cast<const nsACString*>(key));
-  }
-  bool MatchEntry(const void* key) const {
-    return static_cast<const nsACString*>(key)->Equals(mKey);
-  }
-
-  const nsCString mKey;
-};
-
-//
-// Int-key entry
-//
-class PLDHashInt32Entry : public PLDHashEntryHdr
-{
-public:
-  PLDHashInt32Entry(const void* aKey) :
-    mKey(*(static_cast<const PRInt32*>(aKey))) { }
-  ~PLDHashInt32Entry() { }
-
-  static PLDHashNumber HashKey(const void* key) {
-    return *static_cast<const PRInt32*>(key);
-  }
-  bool MatchEntry(const void* key) const {
-    return *(static_cast<const PRInt32*>(key)) == mKey;
-  }
-
-  const PRInt32 mKey;
-};
-
-
-//
-// Void-key entry
-//
-class PLDHashVoidEntry : public PLDHashEntryHdr
-{
-public:
-  PLDHashVoidEntry(const void* aKey) :
-    mKey(*(const void**)aKey) { }
-  ~PLDHashVoidEntry() { }
-
-  static PLDHashNumber HashKey(const void* key) {
-    return PLDHashNumber(NS_PTR_TO_INT32(*(const void**)key)) >> 2;
-  }
-  bool MatchEntry(const void* key) const {
-    return *(const void**)key == mKey;
-  }
-
-  const void* mKey;
-};
-
-
-#define DHASH_EXPORT
-
-
-#endif
diff --git a/xpcom/ds/nsStaticAtom.h b/xpcom/ds/nsStaticAtom.h
index 901f7879d62..331898a75ca 100644
--- a/xpcom/ds/nsStaticAtom.h
+++ b/xpcom/ds/nsStaticAtom.h
@@ -76,8 +76,13 @@ struct nsFakeStringBuffer {
     nsStaticAtomStringType mStringData[size];
 };
 
-// Register static atoms with the atom table
+// Register an array of static atoms with the atom table
+template<PRUint32 N>
 nsresult
-NS_RegisterStaticAtoms(const nsStaticAtom*, PRUint32 aAtomCount);
+NS_RegisterStaticAtoms(const nsStaticAtom (&atoms)[N])
+{
+    extern nsresult RegisterStaticAtoms(const nsStaticAtom*, PRUint32 aAtomCount);
+    return RegisterStaticAtoms(atoms, N);
+}
 
 #endif
diff --git a/xpcom/io/nsDirectoryService.cpp b/xpcom/io/nsDirectoryService.cpp
index 2b42637e4c1..1e04108b564 100644
--- a/xpcom/io/nsDirectoryService.cpp
+++ b/xpcom/io/nsDirectoryService.cpp
@@ -307,7 +307,7 @@ nsDirectoryService::RealInit()
     if (NS_FAILED(rv))
         return rv;
 
-    NS_RegisterStaticAtoms(directory_atoms, ArrayLength(directory_atoms));
+    NS_RegisterStaticAtoms(directory_atoms);
     
     // Let the list hold the only reference to the provider.
     nsAppFileLocationProvider *defaultProvider = new nsAppFileLocationProvider;
diff --git a/xpcom/tests/MoreTestingAtoms.cpp b/xpcom/tests/MoreTestingAtoms.cpp
index f7a18063e68..60852bee6f6 100644
--- a/xpcom/tests/MoreTestingAtoms.cpp
+++ b/xpcom/tests/MoreTestingAtoms.cpp
@@ -59,6 +59,5 @@ static const nsStaticAtom MoreTestingAtoms_info[] = {
 
 void MoreTestingAtoms::AddRefAtoms()
 {
-  NS_RegisterStaticAtoms(MoreTestingAtoms_info, 
-                         mozilla::ArrayLength(MoreTestingAtoms_info));
+  NS_RegisterStaticAtoms(MoreTestingAtoms_info);
 }
diff --git a/xpcom/tests/TestAtoms.cpp b/xpcom/tests/TestAtoms.cpp
index 81a9bc02044..e24c940e84e 100644
--- a/xpcom/tests/TestAtoms.cpp
+++ b/xpcom/tests/TestAtoms.cpp
@@ -212,7 +212,7 @@ test_atomtable()
   if (!thirdNonPerm || NS_GetNumberOfAtoms() != count + 1)
     return false;
 
-  NS_RegisterStaticAtoms(sAtoms_info, ArrayLength(sAtoms_info));
+  NS_RegisterStaticAtoms(sAtoms_info);
 
   return sAtom1 &&
          sAtom1->Equals(NS_LITERAL_STRING(FIRST_ATOM_STR)) &&
diff --git a/xpcom/tests/TestingAtoms.cpp b/xpcom/tests/TestingAtoms.cpp
index abbba3462d0..e2b7a8f9991 100644
--- a/xpcom/tests/TestingAtoms.cpp
+++ b/xpcom/tests/TestingAtoms.cpp
@@ -58,5 +58,5 @@ static const nsStaticAtom TestingAtoms_info[] = {
 
 void TestingAtoms::AddRefAtoms()
 {
-  NS_RegisterStaticAtoms(TestingAtoms_info, mozilla::ArrayLength(TestingAtoms_info));
+  NS_RegisterStaticAtoms(TestingAtoms_info);
 }