Merge inbound to m-c.

2014-01-16 15:06:12 -05:00 · 2014-01-16 15:06:12 -05:00 · 127438a7eb
--- a/.lldbinit
+++ b/.lldbinit
@ -1,5 +1,10 @@
 # .lldbinit file for debugging Mozilla

+# -----------------------------------------------------------------------------
+# For documentation on all of the commands and type summaries defined here
+# and in the accompanying Python scripts, see python/lldbutils/README.txt.
+# -----------------------------------------------------------------------------
+
 # Mozilla's use of UNIFIED_SOURCES to include multiple source files into a
 # single compiled file breaks lldb breakpoint setting. This works around that.
 # See http://lldb.llvm.org/troubleshooting.html for more info.
@ -20,3 +25,6 @@ type summary add nsIAtom --summary-string "${var.mString}"

 # Show the value of text nodes.
 type summary add nsTextNode --summary-string "${var.mText}"
+
+# Dump the current JS stack.
+command alias js expr DumpJSStack()
--- a/addon-sdk/source/python-lib/cuddlefish/prefs.py
+++ b/addon-sdk/source/python-lib/cuddlefish/prefs.py
@ -62,7 +62,6 @@ DEFAULT_FIREFOX_PREFS = {
    'urlclassifier.updateinterval' : 172800,
    # Point the url-classifier to a nonexistent local URL for fast failures.
    'browser.safebrowsing.provider.0.gethashURL' : 'http://localhost/safebrowsing-dummy/gethash',
-    'browser.safebrowsing.provider.0.keyURL' : 'http://localhost/safebrowsing-dummy/newkey',
    'browser.safebrowsing.provider.0.updateURL' : 'http://localhost/safebrowsing-dummy/update',
    }

--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@ -243,21 +243,23 @@ pref("ui.buttonshadow", "#aea194");
 pref("ui.buttontext", "#101010");
 pref("ui.captiontext", "#101010");
 pref("ui.graytext", "#b1a598");
-pref("ui.highlight", "#fad184");
 pref("ui.highlighttext", "#1a1a1a");
-pref("ui.infobackground", "#f5f5b5");
-pref("ui.infotext", "#000");
-pref("ui.menu", "#f7f5f3");
-pref("ui.menutext", "#101010");
 pref("ui.threeddarkshadow", "#000");
 pref("ui.threedface", "#ece7e2");
 pref("ui.threedhighlight", "#fff");
 pref("ui.threedlightshadow", "#ece7e2");
 pref("ui.threedshadow", "#aea194");
-pref("ui.window", "#efebe7");
-pref("ui.windowtext", "#101010");
 pref("ui.windowframe", "#efebe7");

+// Themable via mozSettings
+pref("ui.menu", "#f97c17");
+pref("ui.menutext", "#ffffff");
+pref("ui.infobackground", "#343e40");
+pref("ui.infotext", "#686868");
+pref("ui.window", "#ffffff");
+pref("ui.windowtext", "#000000");
+pref("ui.highlight", "#b2f2ff");
+
 // replace newlines with spaces on paste into single-line text boxes
 pref("editor.singleLine.pasteNewlines", 2);

@ -319,15 +321,14 @@ pref("browser.safebrowsing.enabled", true);
 pref("browser.safebrowsing.malware.enabled", true);

 // Non-enhanced mode (local url lists) URL list to check for updates
-pref("browser.safebrowsing.provider.0.updateURL", "http://safebrowsing.clients.google.com/safebrowsing/downloads?client={moz:client}&appver={moz:version}&pver=2.2");
+pref("browser.safebrowsing.provider.0.updateURL", "https://safebrowsing.google.com/safebrowsing/downloads?client={moz:client}&appver={moz:version}&pver=2.2&key=%GOOGLE_API_KEY%");

 pref("browser.safebrowsing.dataProvider", 0);

 // Does the provider name need to be localizable?
 pref("browser.safebrowsing.provider.0.name", "Google");
-pref("browser.safebrowsing.provider.0.keyURL", "https://sb-ssl.google.com/safebrowsing/newkey?client={moz:client}&appver={moz:version}&pver=2.2");
-pref("browser.safebrowsing.provider.0.reportURL", "http://safebrowsing.clients.google.com/safebrowsing/report?");
-pref("browser.safebrowsing.provider.0.gethashURL", "http://safebrowsing.clients.google.com/safebrowsing/gethash?client={moz:client}&appver={moz:version}&pver=2.2");
+pref("browser.safebrowsing.provider.0.reportURL", "https://safebrowsing.google.com/safebrowsing/report?");
+pref("browser.safebrowsing.provider.0.gethashURL", "https://safebrowsing.google.com/safebrowsing/gethash?client={moz:client}&appver={moz:version}&pver=2.2");

 // HTML report pages
 pref("browser.safebrowsing.provider.0.reportGenericURL", "http://{moz:locale}.phish-generic.mozilla.com/?hl={moz:locale}");
@ -352,7 +353,7 @@ pref("urlclassifier.gethashnoise", 4);
 pref("urlclassifier.max-complete-age", 2700);

 // URL for checking the reason for a malware warning.
-pref("browser.safebrowsing.malware.reportURL", "http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");
+pref("browser.safebrowsing.malware.reportURL", "https://safebrowsing.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");
 #endif

 // True if this is the first time we are showing about:firstrun
--- a/b2g/chrome/content/settings.js
+++ b/b2g/chrome/content/settings.js
@ -637,3 +637,17 @@ SettingsListener.observe("accessibility.screenreader", false, function(value) {
    AccessFu.attach(window);
  }
 });
+
+// ================ Theming ============
+(function themingSettingsListener() {
+  let themingPrefs = ['ui.menu', 'ui.menutext', 'ui.infobackground', 'ui.infotext',
+                      'ui.window', 'ui.windowtext', 'ui.highlight'];
+
+  themingPrefs.forEach(function(pref) {
+    SettingsListener.observe('gaia.' + pref, null, function(value) {
+      if (value) {
+        Services.prefs.setCharPref(pref, value);
+      }
+    });
+  });
+})();
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@ -790,17 +790,16 @@ pref("browser.safebrowsing.enabled", true);
 pref("browser.safebrowsing.malware.enabled", true);
 pref("browser.safebrowsing.debug", false);

-pref("browser.safebrowsing.updateURL", "http://safebrowsing.clients.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%VERSION%&pver=2.2&key=%GOOGLE_API_KEY%");
-pref("browser.safebrowsing.keyURL", "https://sb-ssl.google.com/safebrowsing/newkey?client=SAFEBROWSING_ID&appver=%VERSION%&pver=2.2");
-pref("browser.safebrowsing.gethashURL", "http://safebrowsing.clients.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%VERSION%&pver=2.2");
-pref("browser.safebrowsing.reportURL", "http://safebrowsing.clients.google.com/safebrowsing/report?");
+pref("browser.safebrowsing.updateURL", "https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%VERSION%&pver=2.2&key=%GOOGLE_API_KEY%");
+pref("browser.safebrowsing.gethashURL", "https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%VERSION%&pver=2.2");
+pref("browser.safebrowsing.reportURL", "https://safebrowsing.google.com/safebrowsing/report?");
 pref("browser.safebrowsing.reportGenericURL", "http://%LOCALE%.phish-generic.mozilla.com/?hl=%LOCALE%");
 pref("browser.safebrowsing.reportErrorURL", "http://%LOCALE%.phish-error.mozilla.com/?hl=%LOCALE%");
 pref("browser.safebrowsing.reportPhishURL", "http://%LOCALE%.phish-report.mozilla.com/?hl=%LOCALE%");
 pref("browser.safebrowsing.reportMalwareURL", "http://%LOCALE%.malware-report.mozilla.com/?hl=%LOCALE%");
 pref("browser.safebrowsing.reportMalwareErrorURL", "http://%LOCALE%.malware-error.mozilla.com/?hl=%LOCALE%");

-pref("browser.safebrowsing.malware.reportURL", "http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");
+pref("browser.safebrowsing.malware.reportURL", "https://safebrowsing.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");
 #ifndef MOZILLA_OFFICIAL
 pref("browser.safebrowsing.appRepURL", "https://sb-ssl.google.com/safebrowsing/clientreport/download&key=%GOOGLE_API_KEY%");
 #endif
--- a/browser/components/tabview/test/browser_tabview_bug625269.js
+++ b/browser/components/tabview/test/browser_tabview_bug625269.js
@ -64,14 +64,13 @@ function resizeWindow(win, diffX, diffY, callback) {
  let targetWidth = win.outerWidth + diffX;
  let targetHeight = win.outerHeight + diffY;

-  win.addEventListener("resize", function onResize() {
+  (function tryResize() {
    let {outerWidth: width, outerHeight: height} = win;
-    if (width != targetWidth || height != targetHeight)
-      return;
-
-    win.removeEventListener("resize", onResize, false);
-    executeSoon(callback);
-  }, false);
-
-  win.resizeBy(diffX, diffY);
+    if (width != targetWidth || height != targetHeight) {
+      win.resizeTo(targetWidth, targetHeight);
+      executeSoon(tryResize);
+    } else {
+      callback();
+    }
+  })();
 }
--- a/browser/devtools/styleinspector/test/browser_bug726427_csstransform_tooltip.js
+++ b/browser/devtools/styleinspector/test/browser_bug726427_csstransform_tooltip.js
@ -147,7 +147,13 @@ function assertTooltipShownOn(tooltip, element, cb) {
    tooltip.panel.removeEventListener("popupshown", shown, true);
    cb();
  }, true);
-  tooltip._showOnHover(element);
+
+  // Run _showOnHover at stable state after the next refresh driver tick.
+  // This way nothing during reflow or painting should be able to
+  // cancel showing the popup.
+  element.ownerDocument.defaultView.requestAnimationFrame(() => {
+      executeSoon(() => { tooltip._showOnHover(element); });
+    });
 }

 function assertTooltipNotShownOn(tooltip, element, cb) {
--- a/browser/metro/base/content/browser.xul
+++ b/browser/metro/base/content/browser.xul
@ -685,7 +685,13 @@ Desktop browser's sync prefs.
                  command="cmd_reportingCrashesSubmitURLs"/>
      </settings>
      <settings id="prefs-telemetry" label="&optionsHeader.telemetry.title;">
-        <setting pref="toolkit.telemetry.enabled" type="bool" title="&optionsHeader.telemetry.label;"/>
+        <setting
+#ifdef MOZ_TELEMETRY_ON_BY_DEFAULT
+          pref="toolkit.telemetry.enabledPreRelease"
+#else
+          pref="toolkit.telemetry.enabled"
+#endif
+          type="bool" title="&optionsHeader.telemetry.label;"/>
      </settings>
      <settings id="prefs-dnt" label="&doNotTrack.title;">
        <setting id="prefs-dnt-value" pref="privacy.donottrackheader.value" type="radio" >
--- a/browser/metro/base/tests/mochitest/browser_selection_inputs.js
+++ b/browser/metro/base/tests/mochitest/browser_selection_inputs.js
@ -187,7 +187,7 @@ gTests.push({
    is(getTrimmedSelection(gInput).toString(), "straight on like a tunnel for some way and then dipped suddenly down", "selection test");

    // left and up with no scrolling - selection should shrink
-    yield touchdrag.move(130, ystartpos);
+    yield touchdrag.move(135, ystartpos);
    touchdrag.end();

    yield SelectionHelperUI.pingSelectionHandler();
--- a/browser/metro/profile/metro.js
+++ b/browser/metro/profile/metro.js
@ -87,7 +87,11 @@ pref("browser.chromeURL", "chrome://browser/content/");
 pref("browser.tabs.remote", false);

 // Telemetry
+#ifdef MOZ_TELEMETRY_ON_BY_DEFAULT
+pref("toolkit.telemetry.enabledPreRelease", true);
+#else
 pref("toolkit.telemetry.enabled", true);
+#endif
 pref("toolkit.telemetry.prompted", 2);

 pref("toolkit.screen.lock", false);
@ -580,15 +584,14 @@ pref("browser.safebrowsing.enabled", true);
 pref("browser.safebrowsing.malware.enabled", true);

 // Non-enhanced mode (local url lists) URL list to check for updates
-pref("browser.safebrowsing.provider.0.updateURL", "http://safebrowsing.clients.google.com/safebrowsing/downloads?client={moz:client}&appver={moz:version}&pver=2.2");
+pref("browser.safebrowsing.provider.0.updateURL", "https://safebrowsing.google.com/safebrowsing/downloads?client={moz:client}&appver={moz:version}&pver=2.2&key=%GOOGLE_API_KEY%");

 pref("browser.safebrowsing.dataProvider", 0);

 // Does the provider name need to be localizable?
 pref("browser.safebrowsing.provider.0.name", "Google");
-pref("browser.safebrowsing.provider.0.keyURL", "https://sb-ssl.google.com/safebrowsing/newkey?client={moz:client}&appver={moz:version}&pver=2.2");
-pref("browser.safebrowsing.provider.0.reportURL", "http://safebrowsing.clients.google.com/safebrowsing/report?");
-pref("browser.safebrowsing.provider.0.gethashURL", "http://safebrowsing.clients.google.com/safebrowsing/gethash?client={moz:client}&appver={moz:version}&pver=2.2");
+pref("browser.safebrowsing.provider.0.reportURL", "https://safebrowsing.google.com/safebrowsing/report?");
+pref("browser.safebrowsing.provider.0.gethashURL", "https://safebrowsing.google.com/safebrowsing/gethash?client={moz:client}&appver={moz:version}&pver=2.2");

 // HTML report pages
 pref("browser.safebrowsing.provider.0.reportGenericURL", "http://{moz:locale}.phish-generic.mozilla.com/?hl={moz:locale}");
@ -616,7 +619,7 @@ pref("urlclassifier.max-complete-age", 2700);
 pref("urlclassifier.updatecachemax", 41943040);

 // URL for checking the reason for a malware warning.
-pref("browser.safebrowsing.malware.reportURL", "http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");
+pref("browser.safebrowsing.malware.reportURL", "https://safebrowsing.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");
 #endif

 // True if this is the first time we are showing about:firstrun
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@ -1489,7 +1489,7 @@ nsScriptSecurityManager::GetSubjectPrincipal(JSContext *cx,
 }

 NS_IMETHODIMP
-nsScriptSecurityManager::GetObjectPrincipal(const JS::Value &aObjectVal,
+nsScriptSecurityManager::GetObjectPrincipal(JS::Handle<JS::Value> aObjectVal,
                                            JSContext *aCx,
                                            nsIPrincipal **result)
 {
--- a/config/config.mk
+++ b/config/config.mk
@ -830,7 +830,7 @@ EXPAND_MKSHLIB = $(EXPAND_LIBS_EXEC) $(EXPAND_MKSHLIB_ARGS) -- $(MKSHLIB)

 ifneq (,$(MOZ_LIBSTDCXX_TARGET_VERSION)$(MOZ_LIBSTDCXX_HOST_VERSION))
 ifneq ($(OS_ARCH),Darwin)
-CHECK_STDCXX = objdump -p $(1) | grep -e 'GLIBCXX_3\.4\.\(9\|[1-9][0-9]\)' > /dev/null && echo 'TEST-UNEXPECTED-FAIL | | We do not want these libstdc++ symbols to be used:' && objdump -T $(1) | grep -e 'GLIBCXX_3\.4\.\(9\|[1-9][0-9]\)' && exit 1 || exit 0
+CHECK_STDCXX = @$(TOOLCHAIN_PREFIX)objdump -p $(1) | grep -e 'GLIBCXX_3\.4\.\(9\|[1-9][0-9]\)' > /dev/null && echo 'TEST-UNEXPECTED-FAIL | check_stdcxx | We do not want these libstdc++ symbols to be used:' && $(TOOLCHAIN_PREFIX)objdump -T $(1) | grep -e 'GLIBCXX_3\.4\.\(9\|[1-9][0-9]\)' && false || true
 endif

 ifdef MOZ_LIBSTDCXX_TARGET_VERSION
@ -841,6 +841,15 @@ HOST_EXTRA_LIBS += $(call EXPAND_LIBNAME_PATH,host_stdc++compat,$(DEPTH)/build/u
 endif
 endif

+ifeq (,$(filter $(OS_TARGET),WINNT Darwin OS2))
+CHECK_TEXTREL = @$(TOOLCHAIN_PREFIX)readelf -d $(1) | grep TEXTREL > /dev/null && echo 'TEST-UNEXPECTED-FAIL | check_textrel | We do not want text relocations in libraries and programs' || true
+endif
+
+define CHECK_BINARY
+$(call CHECK_STDCXX,$(1))
+$(call CHECK_TEXTREL,$(1))
+endef
+
 # autoconf.mk sets OBJ_SUFFIX to an error to avoid use before including
 # this file
 OBJ_SUFFIX := $(_OBJ_SUFFIX)
--- a/config/rules.mk
+++ b/config/rules.mk
@ -763,7 +763,7 @@ ifdef MOZ_PROFILE_GENERATE
 endif
 else # !WINNT || GNU_CC
 	$(EXPAND_CCC) -o $@ $(CXXFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(MOZ_GLUE_PROGRAM_LDFLAGS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(EXE_DEF_FILE) $(STLPORT_LIBS)
-	@$(call CHECK_STDCXX,$@)
+	$(call CHECK_BINARY,$@)
 endif # WINNT && !GNU_CC

 ifdef ENABLE_STRIP
@ -819,7 +819,7 @@ ifdef MSMANIFEST_TOOL
 endif	# MSVC with manifest tool
 else
 	$(EXPAND_CCC) $(CXXFLAGS) -o $@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(MOZ_GLUE_PROGRAM_LDFLAGS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(STLPORT_LIBS)
-	@$(call CHECK_STDCXX,$@)
+	$(call CHECK_BINARY,$@)
 endif # WINNT && !GNU_CC

 ifdef ENABLE_STRIP
@ -921,7 +921,7 @@ endif
 else # ! DTRACE_LIB_DEPENDENT
 	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(SUB_SHLOBJS) $(RESFILE) $(LDFLAGS) $(WRAP_LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(MOZ_GLUE_LDFLAGS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE) $(if $(LIB_IS_C_ONLY),,$(STLPORT_LIBS))
 endif # DTRACE_LIB_DEPENDENT
-	@$(call CHECK_STDCXX,$@)
+	$(call CHECK_BINARY,$@)

 ifeq (_WINNT,$(GNU_CC)_$(OS_ARCH))
 ifdef MSMANIFEST_TOOL
--- a/content/base/public/nsDOMFile.h
+++ b/content/base/public/nsDOMFile.h
@ -296,7 +296,7 @@ public:
  // Overrides
  NS_IMETHOD GetSize(uint64_t* aSize) MOZ_OVERRIDE;
  NS_IMETHOD GetType(nsAString& aType) MOZ_OVERRIDE;
-  NS_IMETHOD GetLastModifiedDate(JSContext* cx, JS::Value* aLastModifiedDate) MOZ_OVERRIDE;
+  NS_IMETHOD GetLastModifiedDate(JSContext* cx, JS::MutableHandle<JS::Value> aLastModifiedDate) MOZ_OVERRIDE;
  NS_IMETHOD GetMozLastModifiedDate(uint64_t* aLastModifiedDate) MOZ_OVERRIDE;
  NS_IMETHOD GetMozFullPathInternal(nsAString& aFullPath) MOZ_OVERRIDE;
  NS_IMETHOD GetInternalStream(nsIInputStream**) MOZ_OVERRIDE;
--- a/content/base/src/FileIOObject.h
+++ b/content/base/src/FileIOObject.h
@ -48,12 +48,12 @@ public:
    return mError;
  }

-  NS_METHOD GetOnabort(JSContext* aCx, JS::Value* aValue);
-  NS_METHOD SetOnabort(JSContext* aCx, const JS::Value& aValue);
-  NS_METHOD GetOnerror(JSContext* aCx, JS::Value* aValue);
-  NS_METHOD SetOnerror(JSContext* aCx, const JS::Value& aValue);
-  NS_METHOD GetOnprogress(JSContext* aCx, JS::Value* aValue);
-  NS_METHOD SetOnprogress(JSContext* aCx, const JS::Value& aValue);
+  NS_METHOD GetOnabort(JSContext* aCx, JS::MutableHandle<JS::Value> aValue);
+  NS_METHOD SetOnabort(JSContext* aCx, JS::Handle<JS::Value> aValue);
+  NS_METHOD GetOnerror(JSContext* aCx, JS::MutableHandle<JS::Value> aValue);
+  NS_METHOD SetOnerror(JSContext* aCx, JS::Handle<JS::Value> aValue);
+  NS_METHOD GetOnprogress(JSContext* aCx, JS::MutableHandle<JS::Value> aValue);
+  NS_METHOD SetOnprogress(JSContext* aCx, JS::Handle<JS::Value> aValue);

  IMPL_EVENT_HANDLER(abort)
  IMPL_EVENT_HANDLER(error)
--- a/content/base/src/nsContentSink.cpp
+++ b/content/base/src/nsContentSink.cpp
@ -200,7 +200,6 @@ nsContentSink::Init(nsIDocument* aDoc,

  if (sEnablePerfMode != 0) {
    mDynamicLowerValue = sEnablePerfMode == 1;
-    FavorPerformanceHint(!mDynamicLowerValue, 0);
  }

  return NS_OK;
@ -1376,15 +1375,6 @@ nsContentSink::DidProcessATokenImpl()

 //----------------------------------------------------------------------

-void
-nsContentSink::FavorPerformanceHint(bool perfOverStarvation, uint32_t starvationDelay)
-{
-  static NS_DEFINE_CID(kAppShellCID, NS_APPSHELL_CID);
-  nsCOMPtr<nsIAppShell> appShell = do_GetService(kAppShellCID);
-  if (appShell)
-    appShell->FavorPerformanceHint(perfOverStarvation, starvationDelay);
-}
-
 void
 nsContentSink::BeginUpdate(nsIDocument *aDocument, nsUpdateType aUpdateType)
 {
@ -1462,12 +1452,6 @@ nsContentSink::DropParserAndPerfHint(void)
  // reference.
  nsRefPtr<nsParserBase> kungFuDeathGrip(mParser.forget());

-  if (mDynamicLowerValue) {
-    // Reset the performance hint which was set to FALSE
-    // when mDynamicLowerValue was set.
-    FavorPerformanceHint(true, 0);
-  }
-
  if (!mRunsToCompletion) {
    mDocument->UnblockOnload(true);
  }
@ -1505,7 +1489,6 @@ nsContentSink::WillParseImpl(void)
       (currentTime - lastEventTime) < uint32_t(sInteractiveTime));
    
    if (mDynamicLowerValue != newDynLower) {
-      FavorPerformanceHint(!newDynLower, 0);
      mDynamicLowerValue = newDynLower;
    }
  }
--- a/content/base/src/nsContentSink.h
+++ b/content/base/src/nsContentSink.h
@ -237,9 +237,6 @@ public:
  static void NotifyDocElementCreated(nsIDocument* aDoc);

 protected:
-  void
-  FavorPerformanceHint(bool perfOverStarvation, uint32_t starvationDelay);
-
  inline int32_t GetNotificationInterval()
  {
    if (mDynamicLowerValue) {
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@ -5635,7 +5635,7 @@ nsContentUtils::WrapNative(JSContext *cx, JS::Handle<JSObject*> scope,
  nsresult rv = NS_OK;
  AutoPushJSContext context(cx);
  rv = sXPConnect->WrapNativeToJSVal(context, scope, native, cache, aIID,
-                                     aAllowWrapping, vp.address());
+                                     aAllowWrapping, vp);
  return rv;
 }

--- a/content/base/src/nsDOMFile.cpp
+++ b/content/base/src/nsDOMFile.cpp
@ -136,10 +136,13 @@ nsDOMFileBase::GetPath(nsAString &aPath)
 }

 NS_IMETHODIMP
-nsDOMFileBase::GetLastModifiedDate(JSContext* cx, JS::Value *aLastModifiedDate)
+nsDOMFileBase::GetLastModifiedDate(JSContext* cx, JS::MutableHandle<JS::Value> aLastModifiedDate)
 {
-  JSObject* date = JS_NewDateObjectMsec(cx, JS_Now() / PR_USEC_PER_MSEC);
-  aLastModifiedDate->setObject(*date);
+  JS::Rooted<JSObject*> date(cx, JS_NewDateObjectMsec(cx, JS_Now() / PR_USEC_PER_MSEC));
+  if (!date) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  aLastModifiedDate.setObject(*date);
  return NS_OK;
 }

@ -502,7 +505,7 @@ nsDOMFileFile::GetMozFullPathInternal(nsAString &aFilename)
 }

 NS_IMETHODIMP
-nsDOMFileFile::GetLastModifiedDate(JSContext* cx, JS::Value* aLastModifiedDate)
+nsDOMFileFile::GetLastModifiedDate(JSContext* cx, JS::MutableHandle<JS::Value> aLastModifiedDate)
 {
  NS_ASSERTION(mIsFile, "Should only be called on files");

@ -517,11 +520,11 @@ nsDOMFileFile::GetLastModifiedDate(JSContext* cx, JS::Value* aLastModifiedDate)

  JSObject* date = JS_NewDateObjectMsec(cx, msecs);
  if (date) {
-    aLastModifiedDate->setObject(*date);
+    aLastModifiedDate.setObject(*date);
  }
  else {
    date = JS_NewDateObjectMsec(cx, JS_Now() / PR_USEC_PER_MSEC);
-    aLastModifiedDate->setObject(*date);
+    aLastModifiedDate.setObject(*date);
  }

  return NS_OK;
--- a/content/base/src/nsDOMFileReader.cpp
+++ b/content/base/src/nsDOMFileReader.cpp
@ -184,12 +184,12 @@ JS::Value
 nsDOMFileReader::GetResult(JSContext* aCx, ErrorResult& aRv)
 {
  JS::Rooted<JS::Value> result(aCx);
-  aRv = GetResult(aCx, result.address());
+  aRv = GetResult(aCx, &result);
  return result;
 }

 NS_IMETHODIMP
-nsDOMFileReader::GetResult(JSContext* aCx, JS::Value* aResult)
+nsDOMFileReader::GetResult(JSContext* aCx, JS::MutableHandle<JS::Value> aResult)
 {
  JS::Rooted<JS::Value> result(aCx);
  if (mDataFormat == FILE_AS_ARRAYBUFFER) {
@ -201,15 +201,14 @@ nsDOMFileReader::GetResult(JSContext* aCx, JS::Value* aResult)
    if (!JS_WrapValue(aCx, &result)) {
      return NS_ERROR_FAILURE;
    }
-    *aResult = result;
+    aResult.set(result);
    return NS_OK;
  }

  nsString tmpResult = mResult;
-  if (!xpc::StringToJsval(aCx, tmpResult, &result)) {
+  if (!xpc::StringToJsval(aCx, tmpResult, aResult)) {
    return NS_ERROR_FAILURE;
  }
-  *aResult = result;
  return NS_OK;
 }

--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@ -2591,15 +2591,16 @@ nsDocument::InitCSP(nsIChannel* aChannel)
    cspROHeaderValue.Truncate();
  }

-  // If the old header is present, warn that it will be deprecated.
-  if (!cspOldHeaderValue.IsEmpty() || !cspOldROHeaderValue.IsEmpty()) {
-    mCSPWebConsoleErrorQueue.Add("OldCSPHeaderDeprecated");
+  // If both the new header AND the old header are present, warn that
+  // the old header will be ignored. Otherwise, if the old header is
+  // present, warn that it will be deprecated.
+  bool oldHeaderIsPresent = !cspOldHeaderValue.IsEmpty() || !cspOldROHeaderValue.IsEmpty();
+  bool newHeaderIsPresent = !cspHeaderValue.IsEmpty() || !cspROHeaderValue.IsEmpty();

-    // Also, if the new headers AND the old headers were present, warn
-    // that the old headers will be ignored.
-    if (!cspHeaderValue.IsEmpty() || !cspROHeaderValue.IsEmpty()) {
-      mCSPWebConsoleErrorQueue.Add("BothCSPHeadersPresent");
-    }
+  if (oldHeaderIsPresent && newHeaderIsPresent) {
+    mCSPWebConsoleErrorQueue.Add("BothCSPHeadersPresent");
+  } else if (oldHeaderIsPresent) {
+    mCSPWebConsoleErrorQueue.Add("OldCSPHeaderDeprecated");
  }

  // Figure out if we need to apply an app default CSP or a CSP from an app manifest
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@ -447,7 +447,7 @@ nsFrameMessageManager::RemoveDelayedFrameScript(const nsAString& aURL)
 }

 NS_IMETHODIMP
-nsFrameMessageManager::GetDelayedFrameScripts(JSContext* aCx, JS::Value* aList)
+nsFrameMessageManager::GetDelayedFrameScripts(JSContext* aCx, JS::MutableHandle<JS::Value> aList)
 {
  // Frame message managers may return an incomplete list because scripts
  // that were loaded after it was connected are not added to the list.
@ -478,8 +478,7 @@ nsFrameMessageManager::GetDelayedFrameScripts(JSContext* aCx, JS::Value* aList)
                   NS_ERROR_OUT_OF_MEMORY);
  }

-  *aList = JS::ObjectValue(*array);
-
+  aList.setObject(*array);
  return NS_OK;
 }

@ -527,12 +526,12 @@ static bool sSendingSyncMessage = false;

 NS_IMETHODIMP
 nsFrameMessageManager::SendSyncMessage(const nsAString& aMessageName,
-                                       const JS::Value& aJSON,
-                                       const JS::Value& aObjects,
+                                       JS::Handle<JS::Value> aJSON,
+                                       JS::Handle<JS::Value> aObjects,
                                       nsIPrincipal* aPrincipal,
                                       JSContext* aCx,
                                       uint8_t aArgc,
-                                       JS::Value* aRetval)
+                                       JS::MutableHandle<JS::Value> aRetval)
 {
  return SendMessage(aMessageName, aJSON, aObjects, aPrincipal, aCx, aArgc,
                     aRetval, true);
@ -540,12 +539,12 @@ nsFrameMessageManager::SendSyncMessage(const nsAString& aMessageName,

 NS_IMETHODIMP
 nsFrameMessageManager::SendRpcMessage(const nsAString& aMessageName,
-                                      const JS::Value& aJSON,
-                                      const JS::Value& aObjects,
+                                      JS::Handle<JS::Value> aJSON,
+                                      JS::Handle<JS::Value> aObjects,
                                      nsIPrincipal* aPrincipal,
                                      JSContext* aCx,
                                      uint8_t aArgc,
-                                      JS::Value* aRetval)
+                                      JS::MutableHandle<JS::Value> aRetval)
 {
  return SendMessage(aMessageName, aJSON, aObjects, aPrincipal, aCx, aArgc,
                     aRetval, false);
@ -553,19 +552,19 @@ nsFrameMessageManager::SendRpcMessage(const nsAString& aMessageName,

 nsresult
 nsFrameMessageManager::SendMessage(const nsAString& aMessageName,
-                                   const JS::Value& aJSON,
-                                   const JS::Value& aObjects,
+                                   JS::Handle<JS::Value> aJSON,
+                                   JS::Handle<JS::Value> aObjects,
                                   nsIPrincipal* aPrincipal,
                                   JSContext* aCx,
                                   uint8_t aArgc,
-                                   JS::Value* aRetval,
+                                   JS::MutableHandle<JS::Value> aRetval,
                                   bool aIsSync)
 {
  NS_ASSERTION(!IsGlobal(), "Should not call SendSyncMessage in chrome");
  NS_ASSERTION(!IsWindowLevel(), "Should not call SendSyncMessage in chrome");
  NS_ASSERTION(!mParentManager, "Should not have parent manager in content!");

-  *aRetval = JSVAL_VOID;
+  aRetval.setUndefined();
  NS_ENSURE_TRUE(mCallback, NS_ERROR_NOT_INITIALIZED);

  if (sSendingSyncMessage && aIsSync) {
@ -618,7 +617,7 @@ nsFrameMessageManager::SendMessage(const nsAString& aMessageName,
                   NS_ERROR_OUT_OF_MEMORY);
  }

-  *aRetval = OBJECT_TO_JSVAL(dataArray);
+  aRetval.setObject(*dataArray);
  return NS_OK;
 }

@ -678,8 +677,8 @@ nsFrameMessageManager::DispatchAsyncMessage(const nsAString& aMessageName,

 NS_IMETHODIMP
 nsFrameMessageManager::SendAsyncMessage(const nsAString& aMessageName,
-                                        const JS::Value& aJSON,
-                                        const JS::Value& aObjects,
+                                        JS::Handle<JS::Value> aJSON,
+                                        JS::Handle<JS::Value> aObjects,
                                        nsIPrincipal* aPrincipal,
                                        JSContext* aCx,
                                        uint8_t aArgc)
@ -693,8 +692,8 @@ nsFrameMessageManager::SendAsyncMessage(const nsAString& aMessageName,

 NS_IMETHODIMP
 nsFrameMessageManager::BroadcastAsyncMessage(const nsAString& aMessageName,
-                                             const JS::Value& aJSON,
-                                             const JS::Value& aObjects,
+                                             JS::Handle<JS::Value> aJSON,
+                                             JS::Handle<JS::Value> aObjects,
                                             JSContext* aCx,
                                             uint8_t aArgc)
 {
--- a/content/base/src/nsFrameMessageManager.h
+++ b/content/base/src/nsFrameMessageManager.h
@ -271,12 +271,12 @@ public:
  }
 private:
  nsresult SendMessage(const nsAString& aMessageName,
-                       const JS::Value& aJSON,
-                       const JS::Value& aObjects,
+                       JS::Handle<JS::Value> aJSON,
+                       JS::Handle<JS::Value> aObjects,
                       nsIPrincipal* aPrincipal,
                       JSContext* aCx,
                       uint8_t aArgc,
-                       JS::Value* aRetval,
+                       JS::MutableHandle<JS::Value> aRetval,
                       bool aIsSync);
 protected:
  friend class MMListenerRemover;
--- a/content/base/src/nsHostObjectProtocolHandler.cpp
+++ b/content/base/src/nsHostObjectProtocolHandler.cpp
@ -14,6 +14,7 @@
 #include "nsIDOMMediaStream.h"
 #include "mozilla/dom/MediaSource.h"
 #include "nsIMemoryReporter.h"
+#include "mozilla/Preferences.h"

 // -----------------------------------------------------------------------
 // Hash table
@ -22,6 +23,7 @@ struct DataInfo
  // mObject is expected to be an nsIDOMBlob, nsIDOMMediaStream, or MediaSource
  nsCOMPtr<nsISupports> mObject;
  nsCOMPtr<nsIPrincipal> mPrincipal;
+  nsCString mStack;
 };

 static nsClassHashtable<nsCStringHashKey, DataInfo>* gDataTable;
@ -47,6 +49,190 @@ class HostObjectURLsReporter MOZ_FINAL : public nsIMemoryReporter

 NS_IMPL_ISUPPORTS1(HostObjectURLsReporter, nsIMemoryReporter)

+class BlobURLsReporter MOZ_FINAL : public nsIMemoryReporter
+{
+ public:
+  NS_DECL_ISUPPORTS
+
+  NS_IMETHOD CollectReports(nsIHandleReportCallback* aCallback,
+                            nsISupports* aData)
+  {
+    EnumArg env;
+    env.mCallback = aCallback;
+    env.mData = aData;
+
+    if (gDataTable) {
+      gDataTable->EnumerateRead(CountCallback, &env);
+      gDataTable->EnumerateRead(ReportCallback, &env);
+    }
+    return NS_OK;
+  }
+
+  // Initialize info->mStack to record JS stack info, if enabled.
+  // The string generated here is used in ReportCallback, below.
+  static void GetJSStackForBlob(DataInfo* aInfo)
+  {
+    nsCString& stack = aInfo->mStack;
+    MOZ_ASSERT(stack.IsEmpty());
+    const uint32_t maxFrames = Preferences::GetUint("memory.blob_report.stack_frames");
+
+    if (maxFrames == 0) {
+      return;
+    }
+
+    nsresult rv;
+    nsIXPConnect* xpc = nsContentUtils::XPConnect();
+    nsCOMPtr<nsIStackFrame> frame;
+    rv = xpc->GetCurrentJSStack(getter_AddRefs(frame));
+    NS_ENSURE_SUCCESS_VOID(rv);
+
+    nsAutoCString origin;
+    nsCOMPtr<nsIURI> principalURI;
+    if (NS_SUCCEEDED(aInfo->mPrincipal->GetURI(getter_AddRefs(principalURI)))
+        && principalURI) {
+      principalURI->GetPrePath(origin);
+    }
+
+    for (uint32_t i = 0; i < maxFrames && frame; ++i) {
+      nsAutoCString fileNameEscaped;
+      char* fileName = nullptr;
+      int32_t lineNumber = 0;
+
+      frame->GetFilename(&fileName);
+      frame->GetLineNumber(&lineNumber);
+
+      if (fileName != nullptr && fileName[0] != '\0') {
+        stack += "js(";
+        fileNameEscaped = fileName;
+        if (!origin.IsEmpty()) {
+          // Make the file name root-relative for conciseness if possible.
+          const char* originData;
+          uint32_t originLen;
+
+          originLen = origin.GetData(&originData);
+          // If fileName starts with origin + "/", cut up to that "/".
+          if (strlen(fileName) >= originLen + 1 &&
+              memcmp(fileName, originData, originLen) == 0 &&
+              fileName[originLen] == '/') {
+            fileNameEscaped.Cut(0, originLen);
+          }
+        }
+        fileNameEscaped.ReplaceChar('/', '\\');
+        stack += fileNameEscaped;
+        if (lineNumber > 0) {
+          stack += ", line=";
+          stack.AppendInt(lineNumber);
+        }
+        stack += ")/";
+      }
+
+      rv = frame->GetCaller(getter_AddRefs(frame));
+      NS_ENSURE_SUCCESS_VOID(rv);
+    }
+  }
+
+ private:
+  struct EnumArg {
+    nsIHandleReportCallback* mCallback;
+    nsISupports* mData;
+    nsDataHashtable<nsPtrHashKey<nsIDOMBlob>, uint32_t> mRefCounts;
+  };
+
+  // Determine number of URLs per blob, to handle the case where it's > 1.
+  static PLDHashOperator CountCallback(nsCStringHashKey::KeyType aKey,
+                                       DataInfo* aInfo,
+                                       void* aUserArg)
+  {
+    EnumArg* envp = static_cast<EnumArg*>(aUserArg);
+    nsCOMPtr<nsIDOMBlob> blob;
+
+    blob = do_QueryInterface(aInfo->mObject);
+    if (blob) {
+      envp->mRefCounts.Put(blob, envp->mRefCounts.Get(blob) + 1);
+    }
+    return PL_DHASH_NEXT;
+  }
+
+  static PLDHashOperator ReportCallback(nsCStringHashKey::KeyType aKey,
+                                        DataInfo* aInfo,
+                                        void* aUserArg)
+  {
+    EnumArg* envp = static_cast<EnumArg*>(aUserArg);
+    nsCOMPtr<nsIDOMBlob> blob;
+
+    blob = do_QueryInterface(aInfo->mObject);
+    if (blob) {
+      NS_NAMED_LITERAL_CSTRING
+        (desc, "A blob URL allocated with URL.createObjectURL; the referenced "
+         "blob cannot be freed until all URLs for it have been explicitly "
+         "invalidated with URL.revokeObjectURL.");
+      nsAutoCString path, url, owner, specialDesc;
+      nsCOMPtr<nsIURI> principalURI;
+      uint64_t size;
+      uint32_t refCount = 1;
+      DebugOnly<bool> blobWasCounted;
+
+      blobWasCounted = envp->mRefCounts.Get(blob, &refCount);
+      MOZ_ASSERT(blobWasCounted);
+      MOZ_ASSERT(refCount > 0);
+
+      if (NS_FAILED(blob->GetSize(&size))) {
+        size = 0;
+      }
+
+      path = "blob-urls/";
+      if (NS_SUCCEEDED(aInfo->mPrincipal->GetURI(getter_AddRefs(principalURI))) &&
+          principalURI != nullptr &&
+          NS_SUCCEEDED(principalURI->GetSpec(owner)) &&
+          !owner.IsEmpty()) {
+        owner.ReplaceChar('/', '\\');
+        path += "owner(";
+        path += owner;
+        path += ")";
+      } else {
+        path += "owner unknown";
+      }
+      path += "/";
+      path += aInfo->mStack;
+      url = aKey;
+      url.ReplaceChar('/', '\\');
+      path += url;
+      if (refCount > 1) {
+        nsAutoCString addrStr;
+
+        addrStr = "0x";
+        addrStr.AppendInt((uint64_t)(nsIDOMBlob*)blob, 16);
+
+        path += " ";
+        path.AppendInt(refCount);
+        path += "@";
+        path += addrStr;
+
+        specialDesc = desc;
+        specialDesc += "\n\nNOTE: This blob (address ";
+        specialDesc += addrStr;
+        specialDesc += ") has ";
+        specialDesc.AppendInt(refCount);
+        specialDesc += " URLs; its size is divided ";
+        specialDesc += refCount > 2 ? "among" : "between";
+        specialDesc += " them in this report.";
+      }
+      envp->mCallback->Callback(EmptyCString(),
+                                path,
+                                KIND_OTHER,
+                                UNITS_BYTES,
+                                size / refCount,
+                                (specialDesc.IsEmpty()
+                                 ? static_cast<const nsACString&>(desc)
+                                 : static_cast<const nsACString&>(specialDesc)),
+                                envp->mData);
+    }
+    return PL_DHASH_NEXT;
+  }
+};
+
+NS_IMPL_ISUPPORTS1(BlobURLsReporter, nsIMemoryReporter)
+
 }

 nsHostObjectProtocolHandler::nsHostObjectProtocolHandler()
@ -56,9 +242,11 @@ nsHostObjectProtocolHandler::nsHostObjectProtocolHandler()
  if (!initialized) {
    initialized = true;
    RegisterStrongMemoryReporter(new mozilla::HostObjectURLsReporter());
+    RegisterStrongMemoryReporter(new mozilla::BlobURLsReporter());
  }
 }

+
 nsresult
 nsHostObjectProtocolHandler::AddDataEntry(const nsACString& aScheme,
                                          nsISupports* aObject,
@ -76,6 +264,7 @@ nsHostObjectProtocolHandler::AddDataEntry(const nsACString& aScheme,

  info->mObject = aObject;
  info->mPrincipal = aPrincipal;
+  mozilla::BlobURLsReporter::GetJSStackForBlob(info);

  gDataTable->Put(aUri, info);
  return NS_OK;
--- a/content/base/src/nsINode.cpp
+++ b/content/base/src/nsINode.cpp
@ -704,8 +704,7 @@ nsINode::SetUserData(JSContext* aCx, const nsAString& aKey,
 {
  nsCOMPtr<nsIVariant> data;
  JS::Rooted<JS::Value> dataVal(aCx, aData);
-  aError = nsContentUtils::XPConnect()->JSValToVariant(aCx, dataVal.address(),
-                                                       getter_AddRefs(data));
+  aError = nsContentUtils::XPConnect()->JSValToVariant(aCx, dataVal, getter_AddRefs(data));
  if (aError.Failed()) {
    return JS::UndefinedValue();
  }
@ -723,7 +722,7 @@ nsINode::SetUserData(JSContext* aCx, const nsAString& aKey,
  JS::Rooted<JS::Value> result(aCx);
  JSAutoCompartment ac(aCx, GetWrapper());
  aError = nsContentUtils::XPConnect()->VariantToJS(aCx, GetWrapper(), oldData,
-                                                    result.address());
+                                                    &result);
  return result;
 }

@ -750,7 +749,7 @@ nsINode::GetUserData(JSContext* aCx, const nsAString& aKey, ErrorResult& aError)
  JS::Rooted<JS::Value> result(aCx);
  JSAutoCompartment ac(aCx, GetWrapper());
  aError = nsContentUtils::XPConnect()->VariantToJS(aCx, GetWrapper(), data,
-                                                    result.address());
+                                                    &result);
  return result;
 }

--- a/content/base/src/nsInProcessTabChildGlobal.h
+++ b/content/base/src/nsInProcessTabChildGlobal.h
@ -41,12 +41,12 @@ public:
  NS_FORWARD_SAFE_NSIMESSAGELISTENERMANAGER(mMessageManager)
  NS_FORWARD_SAFE_NSIMESSAGESENDER(mMessageManager)
  NS_IMETHOD SendSyncMessage(const nsAString& aMessageName,
-                             const JS::Value& aObject,
-                             const JS::Value& aRemote,
+                             JS::Handle<JS::Value> aObject,
+                             JS::Handle<JS::Value> aRemote,
                             nsIPrincipal* aPrincipal,
                             JSContext* aCx,
                             uint8_t aArgc,
-                             JS::Value* aRetval)
+                             JS::MutableHandle<JS::Value> aRetval)
  {
    return mMessageManager
      ? mMessageManager->SendSyncMessage(aMessageName, aObject, aRemote,
@ -54,12 +54,12 @@ public:
      : NS_ERROR_NULL_POINTER;
  }
  NS_IMETHOD SendRpcMessage(const nsAString& aMessageName,
-                            const JS::Value& aObject,
-                            const JS::Value& aRemote,
+                            JS::Handle<JS::Value> aObject,
+                            JS::Handle<JS::Value> aRemote,
                            nsIPrincipal* aPrincipal,
                            JSContext* aCx,
                            uint8_t aArgc,
-                            JS::Value* aRetval)
+                            JS::MutableHandle<JS::Value> aRetval)
  {
    return mMessageManager
      ? mMessageManager->SendRpcMessage(aMessageName, aObject, aRemote,
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@ -921,10 +921,10 @@ nsXMLHttpRequest::SetResponseType(nsXMLHttpRequest::ResponseTypeEnum aResponseTy

 /* readonly attribute jsval response; */
 NS_IMETHODIMP
-nsXMLHttpRequest::GetResponse(JSContext *aCx, JS::Value *aResult)
+nsXMLHttpRequest::GetResponse(JSContext *aCx, JS::MutableHandle<JS::Value> aResult)
 {
  ErrorResult rv;
-  *aResult = GetResponse(aCx, rv);
+  aResult.set(GetResponse(aCx, rv));
  return rv.ErrorCode();
 }

@ -2407,7 +2407,7 @@ GetRequestBody(nsIVariant* aBody, nsIInputStream** aResult, uint64_t* aContentLe
    AutoSafeJSContext cx;
    JS::Rooted<JS::Value> realVal(cx);

-    nsresult rv = aBody->GetAsJSVal(realVal.address());
+    nsresult rv = aBody->GetAsJSVal(&realVal);
    if (NS_SUCCEEDED(rv) && !JSVAL_IS_PRIMITIVE(realVal)) {
      JS::Rooted<JSObject*> obj(cx, JSVAL_TO_OBJECT(realVal));
      if (JS_IsArrayBufferObject(obj)) {
--- a/content/base/test/csp/file_dual_headers_warning.html
+++ b/content/base/test/csp/file_dual_headers_warning.html
--- a/content/base/test/csp/file_dual_headers_warning.html^headers^
+++ b/content/base/test/csp/file_dual_headers_warning.html^headers^
@ -0,0 +1,2 @@
+Content-Security-Policy: default-src 'self' 'unsafe-inline';
+X-Content-Security-Policy: allow 'self' 'inline-script';
--- a/content/base/test/csp/mochitest.ini
+++ b/content/base/test/csp/mochitest.ini
@ -104,6 +104,8 @@ support-files =
  file_CSP_bug941404_xhr.html^headers^
  file_hash_source.html
  file_hash_source.html^headers^
+  file_dual_headers_warning.html
+  file_dual_headers_warning.html^headers^

 [test_CSP.html]
 [test_CSP_bug663567.html]
@ -126,3 +128,4 @@ support-files =
 [test_nonce_source.html]
 [test_CSP_bug941404.html]
 [test_hash_source.html]
+[test_dual_headers_warning.html]
--- a/content/base/test/csp/test_dual_headers_warning.html
+++ b/content/base/test/csp/test_dual_headers_warning.html
@ -0,0 +1,59 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=918397
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 918397</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=918397">Mozilla Bug 918397</a>
+<p id="display"></p>
+
+<iframe id="cspframe"></iframe>
+
+<pre id="test">
+<script class="testbody" type="text/javascript">
+// Load locale strings during mochitest
+var stringBundleService = SpecialPowers.Cc["@mozilla.org/intl/stringbundle;1"]
+                          .getService(SpecialPowers.Ci.nsIStringBundleService);
+var localizer = stringBundleService.createBundle("chrome://global/locale/security/security.properties");
+var depreHeadersMsg = localizer.GetStringFromName("OldCSPHeaderDeprecated", 0)
+var dualHeadersMsg = localizer.GetStringFromName("BothCSPHeadersPresent", 0)
+
+function cleanup() {
+  SpecialPowers.postConsoleSentinel();
+  SimpleTest.finish();
+}
+
+// listen on the console before loading the iframe
+SpecialPowers.registerConsoleListener(function ConsoleMsgListener(aMsg) {
+  // Note: We do not want to see the deprecation warning appear in the console.
+  // This test can only be sure that the deprecation warning does not appear
+  // iff the deprecation warning appears before the dual header warning appears
+  // in the console.
+  if (aMsg.message.indexOf(depreHeadersMsg) > -1) {
+    ok(false, "Deprecated CSP header warning should not be present.");
+    return;
+  } else if (aMsg.message.indexOf(dualHeadersMsg) > -1) {
+    ok(true, "Dual CSP header warning present.");
+    SimpleTest.executeSoon(cleanup);
+  } else {
+    // if some other console message is present, we wait
+    return;
+  }
+});
+
+// get ready and test
+SimpleTest.waitForExplicitFinish();
+SpecialPowers.pushPrefEnv(
+  {'set': [["security.csp.speccompliant", true]]},
+  function() {
+    document.getElementById('cspframe').src = 'file_dual_headers_warning.html';
+});
+</script>
+</body>
+</html>
--- a/content/canvas/test/reftest/reftest.list
+++ b/content/canvas/test/reftest/reftest.list
@ -191,4 +191,4 @@ skip-if(!winWidget) pref(webgl.prefer-native-gl,true) pref(webgl.prefer-16bpp,tr

 # focus rings
 pref(canvas.focusring.enabled,true) skip-if(B2G) skip-if(Android&&AndroidVersion<15,8,500) skip-if(winWidget) needs-focus == drawFocusIfNeeded.html drawFocusIfNeeded-ref.html
-pref(canvas.focusring.enabled,true) skip-if(B2G) skip-if(Android&&AndroidVersion<15,8,500) skip-if(winWidget) needs-focus == drawCustomFocusRing.html drawCustomFocusRing-ref.html
+pref(canvas.customfocusring.enabled,true) skip-if(B2G) skip-if(Android&&AndroidVersion<15,8,500) skip-if(winWidget) needs-focus == drawCustomFocusRing.html drawCustomFocusRing-ref.html
--- a/content/canvas/test/test_canvas_focusring.html
+++ b/content/canvas/test/test_canvas_focusring.html
@ -9,6 +9,7 @@ SimpleTest.waitForExplicitFinish();
 const Cc = SpecialPowers.Cc;
 const Cr = SpecialPowers.Cr;
 SpecialPowers.setBoolPref("canvas.focusring.enabled", true);
+SpecialPowers.setBoolPref("canvas.customfocusring.enabled", true);
 </script>

 <p>Canvas test: drawCustomFocusRing</p>
@ -90,6 +91,7 @@ function runTests() {
 }

 SpecialPowers.setBoolPref("canvas.focusring.enabled", false);
+ SpecialPowers.setBoolPref("canvas.customfocusring.enabled", false);
 SimpleTest.finish();
 }

--- a/content/html/content/src/HTMLCanvasElement.cpp
+++ b/content/html/content/src/HTMLCanvasElement.cpp
@ -327,7 +327,7 @@ HTMLCanvasElement::ParseAttribute(int32_t aNamespaceID,
 // HTMLCanvasElement::toDataURL

 NS_IMETHODIMP
-HTMLCanvasElement::ToDataURL(const nsAString& aType, const JS::Value& aParams,
+HTMLCanvasElement::ToDataURL(const nsAString& aType, JS::Handle<JS::Value> aParams,
                             JSContext* aCx, nsAString& aDataURL)
 {
  // do a trust check if this is a write-only canvas
--- a/content/html/content/src/HTMLMediaElement.cpp
+++ b/content/html/content/src/HTMLMediaElement.cpp
@ -1642,14 +1642,14 @@ HTMLMediaElement::MozGetMetadata(JSContext* cx, ErrorResult& aRv)
 }

 NS_IMETHODIMP
-HTMLMediaElement::MozGetMetadata(JSContext* cx, JS::Value* aValue)
+HTMLMediaElement::MozGetMetadata(JSContext* cx, JS::MutableHandle<JS::Value> aValue)
 {
  ErrorResult rv;

  JSObject* obj = MozGetMetadata(cx, rv);
  if (!rv.Failed()) {
    MOZ_ASSERT(obj);
-    *aValue = JS::ObjectValue(*obj);
+    aValue.setObject(*obj);
  }

  return rv.ErrorCode();
--- a/content/media/TextTrack.cpp
+++ b/content/media/TextTrack.cpp
@ -93,7 +93,9 @@ void
 TextTrack::AddCue(TextTrackCue& aCue)
 {
  mCueList->AddCue(aCue);
-  mMediaElement->AddCue(aCue);
+  if (mMediaElement) {
+    mMediaElement->AddCue(aCue);
+  }
  SetDirty();
 }

--- a/content/media/TextTrackCue.cpp
+++ b/content/media/TextTrackCue.cpp
@ -8,9 +8,6 @@
 #include "nsComponentManagerUtils.h"
 #include "mozilla/ClearOnShutdown.h"

-// Alternate value for the 'auto' keyword.
-#define WEBVTT_AUTO -1
-
 namespace mozilla {
 namespace dom {

@ -38,7 +35,7 @@ TextTrackCue::SetDefaultCueSettings()
  mSize = 100;
  mPauseOnExit = false;
  mSnapToLines = true;
-  mLine = WEBVTT_AUTO;
+  mLineIsAutoKeyword = true;
  mAlign = AlignSetting::Middle;
  mLineAlign = AlignSetting::Start;
  mVertical = DirectionSetting::_empty;
--- a/content/media/TextTrackCue.h
+++ b/content/media/TextTrackCue.h
@ -15,6 +15,7 @@
 #include "mozilla/StaticPtr.h"
 #include "nsIDocument.h"
 #include "mozilla/dom/HTMLDivElement.h"
+#include "mozilla/dom/UnionTypes.h"

 namespace mozilla {
 namespace dom {
@ -168,16 +169,30 @@ public:
    CueChanged();
  }

-  double Line() const
+  void GetLine(OwningLongOrAutoKeyword& aLine) const
  {
-    return mLine;
+    if (mLineIsAutoKeyword) {
+      aLine.SetAsAutoKeyword() = AutoKeyword::Auto;
+      return;
+    }
+    aLine.SetAsLong() = mLineLong;
  }

-  void SetLine(double aLine)
+  void SetLine(const LongOrAutoKeyword& aLine)
  {
-    //XXX: TODO Line position can be a keyword auto. bug882299
-    mReset = true;
-    mLine = aLine;
+    if (aLine.IsLong() &&
+        (mLineIsAutoKeyword || (aLine.GetAsLong() != mLineLong))) {
+      mLineIsAutoKeyword = false;
+      mLineLong = aLine.GetAsLong();
+      CueChanged();
+      mReset = true;
+      return;
+    }
+    if (aLine.IsAutoKeyword() && !mLineIsAutoKeyword) {
+      mLineIsAutoKeyword = true;
+      CueChanged();
+      mReset = true;
+    }
  }

  AlignSetting LineAlign() const
@ -355,7 +370,8 @@ private:
  bool mSnapToLines;
  nsString mRegionId;
  DirectionSetting mVertical;
-  int mLine;
+  bool mLineIsAutoKeyword;
+  long mLineLong;
  AlignSetting mAlign;
  AlignSetting mLineAlign;

--- a/content/media/WebVTTListener.cpp
+++ b/content/media/WebVTTListener.cpp
@ -155,7 +155,7 @@ WebVTTListener::OnDataAvailable(nsIRequest* aRequest,
 }

 NS_IMETHODIMP
-WebVTTListener::OnCue(const JS::Value &aCue, JSContext* aCx)
+WebVTTListener::OnCue(JS::Handle<JS::Value> aCue, JSContext* aCx)
 {
  if (!aCue.isObject()) {
    return NS_ERROR_FAILURE;
@ -173,7 +173,7 @@ WebVTTListener::OnCue(const JS::Value &aCue, JSContext* aCx)


 NS_IMETHODIMP
-WebVTTListener::OnRegion(const JS::Value &aRegion, JSContext* aCx)
+WebVTTListener::OnRegion(JS::Handle<JS::Value> aRegion, JSContext* aCx)
 {
  if (!aRegion.isObject()) {
    return NS_ERROR_FAILURE;
--- a/content/media/test/mochitest.ini
+++ b/content/media/test/mochitest.ini
@ -196,6 +196,7 @@ support-files =
 [test_bug895305.html]
 [test_bug895091.html]
 [test_bug919265.html]
+[test_bug957847.html]
 [test_can_play_type.html]
 [test_can_play_type_mpeg.html]
 [test_closing_connections.html]
--- a/content/media/test/test_bug957847.html
+++ b/content/media/test/test_bug957847.html
@ -0,0 +1,32 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=957847
+-->
+<head>
+  <meta charset='utf-8'>
+  <title>Regression test for bug 957847 - Crash on TextTrack::AddCue </title>
+  <script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+SimpleTest.waitForExplicitFinish();
+SpecialPowers.pushPrefEnv({"set": [["media.webvtt.enabled", true]]},
+  function() {
+    var trackElement = document.createElement('track');
+    trackElement.track.addCue(new VTTCue(0, 1, "A"));
+    // We need to assert something for Mochitest to be happy.
+    ok(true);
+    SimpleTest.finish();
+  }
+);
+</script>
+</pre>
+</body>
+</html>
--- a/content/media/test/test_texttrackcue.html
+++ b/content/media/test/test_texttrackcue.html
@ -130,6 +130,13 @@ SpecialPowers.pushPrefEnv({"set": [["media.webvtt.enabled", true]]},
      cue.positionAlign = "end";
      is(cue.positionAlign, "end", "Cue's position align should be end.");

+      // Check cue.line
+      is(cue.line, "auto", "Cue's line value should initially be auto.");
+      cue.line = 12410
+      is(cue.line, 12410, "Cue's line value should now be 12410.");
+      cue.line = "auto";
+      is(cue.line, "auto", "Cue's line value should now be auto.");
+
      // Check that we can create and add new VTTCues
      var vttCue = new VTTCue(3.999, 4, "foo");
      trackElement.track.addCue(vttCue);
--- a/content/media/webspeech/synth/ipc/SpeechSynthesisChild.cpp
+++ b/content/media/webspeech/synth/ipc/SpeechSynthesisChild.cpp
@ -152,7 +152,7 @@ SpeechTaskChild::Setup(nsISpeechTaskCallback* aCallback,
 }

 NS_IMETHODIMP
-SpeechTaskChild::SendAudio(const JS::Value& aData, const JS::Value& aLandmarks,
+SpeechTaskChild::SendAudio(JS::Handle<JS::Value> aData, JS::Handle<JS::Value> aLandmarks,
                           JSContext* aCx)
 {
  MOZ_CRASH("Should never be called from child");
--- a/content/media/webspeech/synth/ipc/SpeechSynthesisChild.h
+++ b/content/media/webspeech/synth/ipc/SpeechSynthesisChild.h
@ -79,7 +79,7 @@ public:
  NS_IMETHOD Setup(nsISpeechTaskCallback* aCallback,
                   uint32_t aChannels, uint32_t aRate, uint8_t argc) MOZ_OVERRIDE;

-  NS_IMETHOD SendAudio(const JS::Value& aData, const JS::Value& aLandmarks,
+  NS_IMETHOD SendAudio(JS::Handle<JS::Value> aData, JS::Handle<JS::Value> aLandmarks,
                       JSContext* aCx) MOZ_OVERRIDE;

  NS_IMETHOD SendAudioNative(int16_t* aData, uint32_t aDataLen) MOZ_OVERRIDE;
--- a/content/media/webspeech/synth/nsSpeechTask.cpp
+++ b/content/media/webspeech/synth/nsSpeechTask.cpp
@ -156,7 +156,7 @@ nsSpeechTask::Setup(nsISpeechTaskCallback* aCallback,
 }

 NS_IMETHODIMP
-nsSpeechTask::SendAudio(const JS::Value& aData, const JS::Value& aLandmarks,
+nsSpeechTask::SendAudio(JS::Handle<JS::Value> aData, JS::Handle<JS::Value> aLandmarks,
                        JSContext* aCx)
 {
  MOZ_ASSERT(XRE_GetProcessType() == GeckoProcessType_Default);
--- a/docshell/base/nsAboutRedirector.cpp
+++ b/docshell/base/nsAboutRedirector.cpp
@ -65,6 +65,8 @@ static RedirEntry kRedirMap[] = {
      nsIAboutModule::ALLOW_SCRIPT },
    { "networking", "chrome://global/content/aboutNetworking.xhtml",
       nsIAboutModule::ALLOW_SCRIPT },
+    { "webrtc", "chrome://global/content/aboutWebrtc.xhtml",
+       nsIAboutModule::ALLOW_SCRIPT },
    // about:srcdoc is unresolvable by specification.  It is included here
    // because the security manager would disallow srcdoc iframes otherwise.
    { "srcdoc", "about:blank",
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@ -211,9 +211,6 @@ static bool gAddedPreferencesVarCache = false;

 bool nsDocShell::sUseErrorPages = false;

-// Number of documents currently loading
-static int32_t gNumberOfDocumentsLoading = 0;
-
 // Global count of existing docshells.
 static int32_t gDocShellCount = 0;

@ -244,17 +241,6 @@ static PRLogModuleInfo* gDocShellLeakLog;
 const char kBrandBundleURL[]      = "chrome://branding/locale/brand.properties";
 const char kAppstringsBundleURL[] = "chrome://global/locale/appstrings.properties";

-static void
-FavorPerformanceHint(bool perfOverStarvation)
-{
-    nsCOMPtr<nsIAppShell> appShell = do_GetService(kAppShellCID);
-    if (appShell) {
-        appShell->FavorPerformanceHint(perfOverStarvation,
-                                       Preferences::GetUint("docshell.event_starvation_delay_hint",
-                                                            NS_EVENT_STARVATION_DELAY_HINT));
-    }
-}
-
 //*****************************************************************************
 // <a ping> support
 //*****************************************************************************
@ -4146,7 +4132,16 @@ nsDocShell::IsPrintingOrPP(bool aDisplayErrorDialog)
 bool
 nsDocShell::IsNavigationAllowed(bool aDisplayPrintErrorDialog)
 {
-    return !IsPrintingOrPP(aDisplayPrintErrorDialog) && !mFiredUnloadEvent;
+  bool isAllowed = !IsPrintingOrPP(aDisplayPrintErrorDialog) && !mFiredUnloadEvent;
+  if (!isAllowed) {
+    return false;
+  }
+  if (!mContentViewer) {
+    return true;
+  }
+  bool firingBeforeUnload;
+  mContentViewer->GetBeforeUnloadFiring(&firingBeforeUnload);
+  return !firingBeforeUnload;
 }

 //*****************************************************************************
@ -6865,14 +6860,6 @@ nsDocShell::EndPageLoad(nsIWebProgress * aProgress,
        mIsExecutingOnLoadHandler = false;

        mEODForCurrentDocument = true;
-
-        // If all documents have completed their loading
-        // favor native event dispatch priorities
-        // over performance
-        if (--gNumberOfDocumentsLoading == 0) {
-          // Hint to use normal native event dispatch priorities 
-          FavorPerformanceHint(false);
-        }
    }
    /* Check if the httpChannel has any cache-control related response headers,
     * like no-store, no-cache. If so, update SHEntry so that 
@ -7876,12 +7863,6 @@ nsDocShell::RestoreFromHistory()
    mSavingOldViewer = false;
    mEODForCurrentDocument = false;

-    // Tell the event loop to favor plevents over user events, see comments
-    // in CreateContentViewer.
-    if (++gNumberOfDocumentsLoading == 1)
-        FavorPerformanceHint(true);
-
-
    if (oldMUDV && newMUDV) {
        newMUDV->SetMinFontSize(minFontSize);
        newMUDV->SetTextZoom(textZoom);
@ -8278,16 +8259,6 @@ nsDocShell::CreateContentViewer(const char *aContentType,
      }
    }

-    // Give hint to native plevent dispatch mechanism. If a document
-    // is loading the native plevent dispatch mechanism should favor
-    // performance over normal native event dispatch priorities.
-    if (++gNumberOfDocumentsLoading == 1) {
-      // Hint to favor performance for the plevent notification mechanism.
-      // We want the pages to load as fast as possible even if its means 
-      // native messages might be starved.
-      FavorPerformanceHint(true);
-    }
-
    if (onLocationChangeNeeded) {
      FireOnLocationChange(this, request, mCurrentURI, 0);
    }
@ -10455,7 +10426,7 @@ nsDocShell::SetReferrerURI(nsIURI * aURI)
 //*****************************************************************************

 NS_IMETHODIMP
-nsDocShell::AddState(const JS::Value &aData, const nsAString& aTitle,
+nsDocShell::AddState(JS::Handle<JS::Value> aData, const nsAString& aTitle,
                     const nsAString& aURL, bool aReplace, JSContext* aCx)
 {
    // Implements History.pushState and History.replaceState
--- a/docshell/base/nsIContentViewer.idl
+++ b/docshell/base/nsIContentViewer.idl
@ -28,7 +28,7 @@ class nsDOMNavigationTiming;
 [ptr] native nsViewPtr(nsView);
 [ptr] native nsDOMNavigationTimingPtr(nsDOMNavigationTiming);

-[scriptable, builtinclass, uuid(1b22be51-efe8-42ac-a9a0-06f50f39beee)]
+[scriptable, builtinclass, uuid(a73d693a-6260-468a-ae64-d64237f0858c)]
 interface nsIContentViewer : nsISupports
 {

@ -58,6 +58,12 @@ interface nsIContentViewer : nsISupports
  [noscript,nostdcall] boolean permitUnloadInternal(in boolean aCallerClosesWindow,
                                                    inout boolean aShouldPrompt);

+  /**
+   * Exposes whether we're in the process of firing the beforeunload event.
+   * In this case, the corresponding docshell will not allow navigation.
+   */
+  readonly attribute boolean beforeUnloadFiring;
+
  /**
   * Works in tandem with permitUnload, if the caller decides not to close the
   * window it indicated it will, it is the caller's responsibility to reset
--- a/docshell/build/nsDocShellModule.cpp
+++ b/docshell/build/nsDocShellModule.cpp
@ -182,6 +182,7 @@ const mozilla::Module::ContractIDEntry kDocShellContracts[] = {
  { NS_ABOUT_MODULE_CONTRACTID_PREFIX "support", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
  { NS_ABOUT_MODULE_CONTRACTID_PREFIX "telemetry", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
  { NS_ABOUT_MODULE_CONTRACTID_PREFIX "networking", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
+  { NS_ABOUT_MODULE_CONTRACTID_PREFIX "webrtc", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
  { NS_ABOUT_MODULE_CONTRACTID_PREFIX "srcdoc", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
  { NS_URI_LOADER_CONTRACTID, &kNS_URI_LOADER_CID },
  { NS_DOCUMENTLOADER_SERVICE_CONTRACTID, &kNS_DOCUMENTLOADER_SERVICE_CID },
--- a/dom/base/DOMRequest.cpp
+++ b/dom/base/DOMRequest.cpp
@ -80,9 +80,9 @@ DOMRequest::GetReadyState(nsAString& aReadyState)
 }

 NS_IMETHODIMP
-DOMRequest::GetResult(JS::Value* aResult)
+DOMRequest::GetResult(JS::MutableHandle<JS::Value> aResult)
 {
-  *aResult = Result();
+  aResult.set(Result());
  return NS_OK;
 }

@ -202,11 +202,10 @@ DOMRequestService::CreateCursor(nsIDOMWindow* aWindow,

 NS_IMETHODIMP
 DOMRequestService::FireSuccess(nsIDOMDOMRequest* aRequest,
-                               const JS::Value& aResult)
+                               JS::Handle<JS::Value> aResult)
 {
  NS_ENSURE_STATE(aRequest);
-  static_cast<DOMRequest*>(aRequest)->
-    FireSuccess(JS::Handle<JS::Value>::fromMarkedLocation(&aResult));
+  static_cast<DOMRequest*>(aRequest)->FireSuccess(aResult);

  return NS_OK;
 }
@ -316,7 +315,7 @@ private:

 NS_IMETHODIMP
 DOMRequestService::FireSuccessAsync(nsIDOMDOMRequest* aRequest,
-                                    const JS::Value& aResult)
+                                    JS::Handle<JS::Value> aResult)
 {
  NS_ENSURE_STATE(aRequest);
  return FireSuccessAsyncTask::Dispatch(static_cast<DOMRequest*>(aRequest), aResult);
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@ -1265,13 +1265,14 @@ Navigator::GetGamepads(nsTArray<nsRefPtr<Gamepad> >& aGamepads,
 //*****************************************************************************

 NS_IMETHODIMP
-Navigator::GetMozConnection(nsIDOMMozConnection** aConnection)
+Navigator::GetMozConnection(nsISupports** aConnection)
 {
-  NS_IF_ADDREF(*aConnection = GetMozConnection());
+  nsCOMPtr<nsINetworkProperties> properties = GetMozConnection();
+  properties.forget(aConnection);
  return NS_OK;
 }

-nsIDOMMozConnection*
+network::Connection*
 Navigator::GetMozConnection()
 {
  if (!mConnection) {
@ -1321,7 +1322,7 @@ Navigator::EnsureMessagesManager()
  // We don't do anything with the return value.
  AutoJSContext cx;
  JS::Rooted<JS::Value> prop_val(cx);
-  rv = gpi->Init(mWindow, prop_val.address());
+  rv = gpi->Init(mWindow, &prop_val);
  NS_ENSURE_SUCCESS(rv, rv);

  mMessagesManager = messageManager.forget();
@ -1578,7 +1579,7 @@ Navigator::DoNewResolve(JSContext* aCx, JS::Handle<JSObject*> aObject,
      return Throw(aCx, NS_ERROR_UNEXPECTED);
    }

-    rv = gpi->Init(mWindow, prop_val.address());
+    rv = gpi->Init(mWindow, &prop_val);
    if (NS_FAILED(rv)) {
      return Throw(aCx, rv);
    }
--- a/dom/base/Navigator.h
+++ b/dom/base/Navigator.h
@ -195,7 +195,7 @@ public:
                             ErrorResult& aRv);
  nsIDOMMozMobileMessageManager* GetMozMobileMessage();
  Telephony* GetMozTelephony(ErrorResult& aRv);
-  nsIDOMMozConnection* GetMozConnection();
+  network::Connection* GetMozConnection();
  nsDOMCameraManager* GetMozCameras(ErrorResult& aRv);
  void MozSetMessageHandler(const nsAString& aType,
                            systemMessageCallback* aCallback,
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@ -154,7 +154,6 @@
 #include "nsIDOMSmsFilter.h"
 #include "nsIDOMSmsSegmentInfo.h"
 #include "nsIDOMMozMobileMessageThread.h"
-#include "nsIDOMConnection.h"

 #ifdef MOZ_B2G_RIL
 #include "nsIDOMIccManager.h"
@ -453,9 +452,6 @@ static nsDOMClassInfoData sClassInfoData[] = {
  NS_DEFINE_CLASSINFO_DATA(MozMobileMessageThread, nsDOMGenericSH,
                           DOM_DEFAULT_SCRIPTABLE_FLAGS)

-  NS_DEFINE_CLASSINFO_DATA(MozConnection, nsDOMGenericSH,
-                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
-
 #ifdef MOZ_B2G_RIL
  NS_DEFINE_CLASSINFO_DATA(MozMobileConnection, nsDOMGenericSH,
                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
@ -617,7 +613,7 @@ WrapNative(JSContext *cx, JSObject *scope, nsISupports *native,

  return nsDOMClassInfo::XPConnect()->WrapNativeToJSVal(cx, scope, native,
                                                        cache, aIID,
-                                                        aAllowWrapping, vp.address());
+                                                        aAllowWrapping, vp);
 }

 static inline nsresult
@ -1147,11 +1143,6 @@ nsDOMClassInfo::Init()
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMMozMobileMessageThread)
  DOM_CLASSINFO_MAP_END

-  DOM_CLASSINFO_MAP_BEGIN(MozConnection, nsIDOMMozConnection)
-     DOM_CLASSINFO_MAP_ENTRY(nsIDOMMozConnection)
-     DOM_CLASSINFO_MAP_ENTRY(nsIDOMEventTarget)
-  DOM_CLASSINFO_MAP_END
-
 #ifdef MOZ_B2G_RIL
  DOM_CLASSINFO_MAP_BEGIN(MozMobileConnection, nsIDOMMozMobileConnection)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMMozMobileConnection)
@ -1662,7 +1653,7 @@ nsDOMClassInfo::Construct(nsIXPConnectWrappedNative *wrapper, JSContext *cx,

 NS_IMETHODIMP
 nsDOMClassInfo::HasInstance(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                            JSObject *obj, const jsval &val, bool *bp,
+                            JSObject *obj, JS::Handle<JS::Value> val, bool *bp,
                            bool *_retval)
 {
  NS_WARNING("nsDOMClassInfo::HasInstance Don't call me!");
@ -3134,7 +3125,7 @@ nsWindowSH::GlobalResolve(nsGlobalWindow *aWin, JSContext *cx,

    nsCOMPtr<nsIDOMGlobalPropertyInitializer> gpi(do_QueryInterface(native));
    if (gpi) {
-      rv = gpi->Init(aWin, prop_val.address());
+      rv = gpi->Init(aWin, &prop_val);
      NS_ENSURE_SUCCESS(rv, rv);
    }

@ -4508,7 +4499,7 @@ nsDOMConstructorSH::Construct(nsIXPConnectWrappedNative *wrapper, JSContext *cx,

 NS_IMETHODIMP
 nsDOMConstructorSH::HasInstance(nsIXPConnectWrappedNative *wrapper,
-                                JSContext *cx, JSObject *aObj, const jsval &val,
+                                JSContext *cx, JSObject *aObj, JS::Handle<JS::Value> val,
                                bool *bp, bool *_retval)
 {
  JS::Rooted<JSObject*> obj(cx, aObj);
--- a/dom/base/nsDOMClassInfo.h
+++ b/dom/base/nsDOMClassInfo.h
@ -574,7 +574,7 @@ public:
                       JSObject *obj, const JS::CallArgs &args, bool *_retval) MOZ_OVERRIDE;

  NS_IMETHOD HasInstance(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, const JS::Value &val, bool *bp,
+                         JSObject *obj, JS::Handle<JS::Value> val, bool *bp,
                         bool *_retval);

  static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
--- a/dom/base/nsDOMClassInfoClasses.h
+++ b/dom/base/nsDOMClassInfoClasses.h
@ -84,7 +84,6 @@ DOMCI_CLASS(MozSmsFilter)
 DOMCI_CLASS(MozSmsSegmentInfo)
 DOMCI_CLASS(MozMobileMessageThread)

-DOMCI_CLASS(MozConnection)
 #ifdef MOZ_B2G_RIL
 DOMCI_CLASS(MozMobileConnection)
 #endif
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@ -2135,7 +2135,8 @@ nsDOMWindowUtils::SendContentCommandEvent(const nsAString& aType,
 }

 NS_IMETHODIMP
-nsDOMWindowUtils::GetClassName(const JS::Value& aObject, JSContext* aCx, char** aName)
+nsDOMWindowUtils::GetClassName(JS::Handle<JS::Value> aObject, JSContext* aCx,
+                               char** aName)
 {
  if (!nsContentUtils::IsCallerChrome()) {
    return NS_ERROR_DOM_SECURITY_ERR;
@ -2220,29 +2221,29 @@ nsDOMWindowUtils::IsInModalState(bool *retval)
 }

 NS_IMETHODIMP
-nsDOMWindowUtils::GetParent(const JS::Value& aObject,
+nsDOMWindowUtils::GetParent(JS::Handle<JS::Value> aObject,
                            JSContext* aCx,
-                            JS::Value* aParent)
+                            JS::MutableHandle<JS::Value> aParent)
 {
  if (!nsContentUtils::IsCallerChrome()) {
    return NS_ERROR_DOM_SECURITY_ERR;
  }

  // First argument must be an object.
-  if (JSVAL_IS_PRIMITIVE(aObject)) {
+  if (aObject.isPrimitive()) {
    return NS_ERROR_XPC_BAD_CONVERT_JS;
  }

-  JS::Rooted<JSObject*> parent(aCx, JS_GetParent(JSVAL_TO_OBJECT(aObject)));
-  *aParent = OBJECT_TO_JSVAL(parent);
+  JS::Rooted<JSObject*> parent(aCx, JS_GetParent(&aObject.toObject()));

  // Outerize if necessary.
  if (parent) {
    if (JSObjectOp outerize = js::GetObjectClass(parent)->ext.outerObject) {
-      *aParent = OBJECT_TO_JSVAL(outerize(aCx, parent));
+      parent = outerize(aCx, parent);
    }
  }

+  aParent.setObject(*parent);
  return NS_OK;
 }

@ -2867,8 +2868,8 @@ GetFileOrBlob(const nsAString& aName, const JS::Value& aBlobParts,
 }

 NS_IMETHODIMP
-nsDOMWindowUtils::GetFile(const nsAString& aName, const JS::Value& aBlobParts,
-                          const JS::Value& aParameters, JSContext* aCx,
+nsDOMWindowUtils::GetFile(const nsAString& aName, JS::Handle<JS::Value> aBlobParts,
+                          JS::Handle<JS::Value> aParameters, JSContext* aCx,
                          uint8_t aOptionalArgCount, nsIDOMFile** aResult)
 {
  if (!nsContentUtils::IsCallerChrome()) {
@ -2887,8 +2888,8 @@ nsDOMWindowUtils::GetFile(const nsAString& aName, const JS::Value& aBlobParts,
 }

 NS_IMETHODIMP
-nsDOMWindowUtils::GetBlob(const JS::Value& aBlobParts,
-                          const JS::Value& aParameters, JSContext* aCx,
+nsDOMWindowUtils::GetBlob(JS::Handle<JS::Value> aBlobParts,
+                          JS::Handle<JS::Value> aParameters, JSContext* aCx,
                          uint8_t aOptionalArgCount, nsIDOMBlob** aResult)
 {
  if (!nsContentUtils::IsCallerChrome()) {
@ -2907,7 +2908,7 @@ nsDOMWindowUtils::GetBlob(const JS::Value& aBlobParts,
 }

 NS_IMETHODIMP
-nsDOMWindowUtils::GetFileId(const JS::Value& aFile, JSContext* aCx,
+nsDOMWindowUtils::GetFileId(JS::Handle<JS::Value> aFile, JSContext* aCx,
                            int64_t* aResult)
 {
  if (!nsContentUtils::IsCallerChrome()) {
@ -2939,7 +2940,7 @@ nsDOMWindowUtils::GetFileId(const JS::Value& aFile, JSContext* aCx,

 NS_IMETHODIMP
 nsDOMWindowUtils::GetFileReferences(const nsAString& aDatabaseName, int64_t aId,
-                                    const jsval& aOptions,
+                                    JS::Handle<JS::Value> aOptions,
                                    int32_t* aRefCnt, int32_t* aDBRefCnt,
                                    int32_t* aSliceRefCnt, JSContext* aCx,
                                    bool* aResult)
@ -3097,7 +3098,7 @@ nsDOMWindowUtils::GetPaintingSuppressed(bool *aPaintingSuppressed)
 }

 NS_IMETHODIMP
-nsDOMWindowUtils::GetPlugins(JSContext* cx, JS::Value* aPlugins)
+nsDOMWindowUtils::GetPlugins(JSContext* cx, JS::MutableHandle<JS::Value> aPlugins)
 {
  if (!nsContentUtils::IsCallerChrome()) {
    return NS_ERROR_DOM_SECURITY_ERR;
@ -3115,7 +3116,7 @@ nsDOMWindowUtils::GetPlugins(JSContext* cx, JS::Value* aPlugins)
  nsresult rv = nsTArrayToJSArray(cx, plugins, jsPlugins.address());
  NS_ENSURE_SUCCESS(rv, rv);

-  *aPlugins = OBJECT_TO_JSVAL(jsPlugins);
+  aPlugins.setObject(*jsPlugins);
  return NS_OK;
 }

--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@ -3752,7 +3752,7 @@ nsGlobalWindow::GetContent(JSContext* aCx, ErrorResult& aError)
  }

  JS::Rooted<JS::Value> val(aCx, JS::NullValue());
-  aError = treeOwner->GetContentWindow(aCx, val.address());
+  aError = treeOwner->GetContentWindow(aCx, &val);
  if (aError.Failed()) {
    return nullptr;
  }
@ -3818,12 +3818,12 @@ nsGlobalWindow::GetContent(nsIDOMWindow** aContent)
 }

 NS_IMETHODIMP
-nsGlobalWindow::GetScriptableContent(JSContext* aCx, JS::Value* aVal)
+nsGlobalWindow::GetScriptableContent(JSContext* aCx, JS::MutableHandle<JS::Value> aVal)
 {
  ErrorResult rv;
  JS::Rooted<JSObject*> content(aCx, GetContent(aCx, rv));
  if (!rv.Failed()) {
-    *aVal = JS::ObjectOrNullValue(content);
+    aVal.setObjectOrNull(content);
  }

  return rv.ErrorCode();
@ -4955,7 +4955,7 @@ nsGlobalWindow::RequestAnimationFrame(const nsIDocument::FrameRequestCallbackHol
 }

 NS_IMETHODIMP
-nsGlobalWindow::RequestAnimationFrame(const JS::Value& aCallback,
+nsGlobalWindow::RequestAnimationFrame(JS::Handle<JS::Value> aCallback,
                                      JSContext* cx,
                                      int32_t* aHandle)
 {
@ -7950,15 +7950,13 @@ nsGlobalWindow::PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
 }

 NS_IMETHODIMP
-nsGlobalWindow::PostMessageMoz(const JS::Value& aMessage,
+nsGlobalWindow::PostMessageMoz(JS::Handle<JS::Value> aMessage,
                               const nsAString& aOrigin,
-                               const JS::Value& aTransfer,
+                               JS::Handle<JS::Value> aTransfer,
                               JSContext* aCx)
 {
-  JS::Rooted<JS::Value> message(aCx, aMessage);
-  JS::Rooted<JS::Value> transfer(aCx, aTransfer);
  ErrorResult rv;
-  PostMessageMoz(aCx, message, aOrigin, transfer, rv);
+  PostMessageMoz(aCx, aMessage, aOrigin, aTransfer, rv);

  return rv.ErrorCode();
 }
@ -8783,7 +8781,7 @@ nsGlobalWindow::ShowModalDialog(JSContext* aCx, const nsAString& aUrl,
  nsCOMPtr<nsIVariant> args;
  if (aArgument.WasPassed()) {
    aError = nsContentUtils::XPConnect()->JSToVariant(aCx,
-                                                      aArgument.Value().get(),
+                                                      aArgument.Value(),
                                                      getter_AddRefs(args));
  } else {
    args = CreateVoidVariant();
@ -8798,7 +8796,7 @@ nsGlobalWindow::ShowModalDialog(JSContext* aCx, const nsAString& aUrl,
  if (retVal) {
    aError = nsContentUtils::XPConnect()->VariantToJS(aCx,
                                                      FastGetGlobalJSObject(),
-                                                      retVal, result.address());
+                                                      retVal, &result);
  } else {
    result = JS::NullValue();
  }
@ -13279,13 +13277,13 @@ nsGlobalWindow::DisableNetworkEvent(uint32_t aType)

 #define EVENT(name_, id_, type_, struct_)                                    \
  NS_IMETHODIMP nsGlobalWindow::GetOn##name_(JSContext *cx,                  \
-                                             JS::Value *vp) {                \
+                                             JS::MutableHandle<JS::Value> vp) { \
    EventHandlerNonNull* h = GetOn##name_();                                 \
-    vp->setObjectOrNull(h ? h->Callable().get() : nullptr);                  \
+    vp.setObjectOrNull(h ? h->Callable().get() : nullptr);                   \
    return NS_OK;                                                            \
  }                                                                          \
  NS_IMETHODIMP nsGlobalWindow::SetOn##name_(JSContext *cx,                  \
-                                             const JS::Value &v) {           \
+                                             JS::Handle<JS::Value> v) {      \
    nsRefPtr<EventHandlerNonNull> handler;                                   \
    JS::Rooted<JSObject*> callable(cx);                                      \
    if (v.isObject() &&                                                      \
@ -13297,20 +13295,20 @@ nsGlobalWindow::DisableNetworkEvent(uint32_t aType)
  }
 #define ERROR_EVENT(name_, id_, type_, struct_)                              \
  NS_IMETHODIMP nsGlobalWindow::GetOn##name_(JSContext *cx,                  \
-                                             JS::Value *vp) {                \
+                                             JS::MutableHandle<JS::Value> vp) { \
    nsEventListenerManager *elm = GetExistingListenerManager();              \
    if (elm) {                                                               \
      OnErrorEventHandlerNonNull* h = elm->GetOnErrorEventHandler();         \
      if (h) {                                                               \
-        *vp = JS::ObjectValue(*h->Callable());                               \
+        vp.setObject(*h->Callable());                                        \
        return NS_OK;                                                        \
      }                                                                      \
    }                                                                        \
-    *vp = JSVAL_NULL;                                                        \
+    vp.setNull();                                                            \
    return NS_OK;                                                            \
  }                                                                          \
  NS_IMETHODIMP nsGlobalWindow::SetOn##name_(JSContext *cx,                  \
-                                             const JS::Value &v) {           \
+                                             JS::Handle<JS::Value> v) {      \
    nsEventListenerManager *elm = GetOrCreateListenerManager();              \
    if (!elm) {                                                              \
      return NS_ERROR_OUT_OF_MEMORY;                                         \
@ -13327,21 +13325,21 @@ nsGlobalWindow::DisableNetworkEvent(uint32_t aType)
  }
 #define BEFOREUNLOAD_EVENT(name_, id_, type_, struct_)                       \
  NS_IMETHODIMP nsGlobalWindow::GetOn##name_(JSContext *cx,                  \
-                                             JS::Value *vp) {                \
+                                             JS::MutableHandle<JS::Value> vp) { \
    nsEventListenerManager *elm = GetExistingListenerManager();              \
    if (elm) {                                                               \
      OnBeforeUnloadEventHandlerNonNull* h =                                 \
        elm->GetOnBeforeUnloadEventHandler();                                \
      if (h) {                                                               \
-        *vp = JS::ObjectValue(*h->Callable());                               \
+        vp.setObject(*h->Callable());                                        \
        return NS_OK;                                                        \
      }                                                                      \
    }                                                                        \
-    *vp = JSVAL_NULL;                                                        \
+    vp.setNull();                                                            \
    return NS_OK;                                                            \
  }                                                                          \
  NS_IMETHODIMP nsGlobalWindow::SetOn##name_(JSContext *cx,                  \
-                                             const JS::Value &v) {           \
+                                             JS::Handle<JS::Value> v) {      \
    nsEventListenerManager *elm = GetOrCreateListenerManager();              \
    if (!elm) {                                                              \
      return NS_ERROR_OUT_OF_MEMORY;                                         \
--- a/dom/base/nsHistory.cpp
+++ b/dom/base/nsHistory.cpp
@ -125,7 +125,7 @@ nsHistory::GetState(JSContext* aCx, ErrorResult& aRv) const

  if (variant) {
    JS::Rooted<JS::Value> jsData(aCx);
-    aRv = variant->GetAsJSVal(jsData.address());
+    aRv = variant->GetAsJSVal(&jsData);

    if (aRv.Failed()) {
      return JS::UndefinedValue();
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@ -1256,7 +1256,9 @@ nsJSContext::ConvertSupportsTojsvals(nsISupports *aArgs,
      }
      nsCOMPtr<nsIVariant> variant(do_QueryInterface(arg));
      if (variant != nullptr) {
-        rv = xpc->VariantToJS(cx, aScope, variant, thisval);
+        JS::Rooted<JS::Value> temp(cx);
+        rv = xpc->VariantToJS(cx, aScope, variant, &temp);
+        *thisval = temp.get();
      } else {
        // And finally, support the nsISupportsPrimitives supplied
        // by the AppShell.  It generally will pass only strings, but
@ -1283,7 +1285,9 @@ nsJSContext::ConvertSupportsTojsvals(nsISupports *aArgs,
  } else {
    nsCOMPtr<nsIVariant> variant = do_QueryInterface(aArgs);
    if (variant) {
-      rv = xpc->VariantToJS(cx, aScope, variant, argv);
+      JS::Rooted<JS::Value> temp(cx);
+      rv = xpc->VariantToJS(cx, aScope, variant, &temp);
+      *argv = temp.get();
    } else {
      NS_ERROR("Not an array, not an interface?");
      rv = NS_ERROR_UNEXPECTED;
@ -3305,7 +3309,9 @@ NS_IMETHODIMP nsJSArgArray::QueryElementAt(uint32_t index, const nsIID & uuid, v
    return NS_ERROR_INVALID_ARG;

  if (uuid.Equals(NS_GET_IID(nsIVariant)) || uuid.Equals(NS_GET_IID(nsISupports))) {
-    return nsContentUtils::XPConnect()->JSToVariant(mContext, mArgv[index],
+    // Have to copy a Heap into a Rooted to work with it.
+    JS::Rooted<JS::Value> val(mContext, mArgv[index]);
+    return nsContentUtils::XPConnect()->JSToVariant(mContext, val,
                                                    (nsIVariant **)result);
  }
  NS_WARNING("nsJSArgArray only handles nsIVariant");
--- a/dom/base/nsScreen.cpp
+++ b/dom/base/nsScreen.cpp
@ -238,11 +238,9 @@ nsScreen::GetLockOrientationPermission() const
 }

 NS_IMETHODIMP
-nsScreen::MozLockOrientation(const JS::Value& aOrientation_, JSContext* aCx,
+nsScreen::MozLockOrientation(JS::Handle<JS::Value> aOrientation, JSContext* aCx,
                             bool* aReturn)
 {
-  JS::Rooted<JS::Value> aOrientation(aCx, aOrientation_);
-
  if (aOrientation.isObject()) {
    JS::Rooted<JSObject*> seq(aCx, &aOrientation.toObject());
    if (IsArrayLike(aCx, seq)) {
--- a/dom/base/nsStructuredCloneContainer.cpp
+++ b/dom/base/nsStructuredCloneContainer.cpp
@ -39,7 +39,7 @@ nsStructuredCloneContainer::~nsStructuredCloneContainer()
 }

 nsresult
-nsStructuredCloneContainer::InitFromJSVal(const JS::Value & aData,
+nsStructuredCloneContainer::InitFromJSVal(JS::Handle<JS::Value> aData,
                                          JSContext* aCx)
 {
  NS_ENSURE_STATE(!mData);
@ -124,8 +124,7 @@ nsStructuredCloneContainer::DeserializeToVariant(JSContext *aCx,
  nsCOMPtr<nsIVariant> varStateObj;
  nsCOMPtr<nsIXPConnect> xpconnect = do_GetService(nsIXPConnect::GetCID());
  NS_ENSURE_STATE(xpconnect);
-  xpconnect->JSValToVariant(aCx, jsStateObj.address(),
-                            getter_AddRefs(varStateObj));
+  xpconnect->JSValToVariant(aCx, jsStateObj, getter_AddRefs(varStateObj));
  NS_ENSURE_STATE(varStateObj);

  NS_ADDREF(*aData = varStateObj);
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@ -2034,7 +2034,7 @@ ConstructJSImplementation(JSContext* aCx, const char* aContractId,
      do_QueryInterface(implISupports);
    if (gpi) {
      JS::Rooted<JS::Value> initReturn(aCx);
-      nsresult rv = gpi->Init(window, initReturn.address());
+      nsresult rv = gpi->Init(window, &initReturn);
      if (NS_FAILED(rv)) {
        aRv.Throw(rv);
        return nullptr;
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@ -800,6 +800,10 @@ DOMInterfaces = {
    'nativeType': 'mozilla::dom::CellBroadcast',
 },

+'MozConnection': {
+    'nativeType': 'mozilla::dom::network::Connection',
+},
+
 'MozIcc': {
    'nativeType': 'mozilla::dom::Icc',
 },
@ -1882,7 +1886,6 @@ addExternalIface('imgIRequest', nativeType='imgIRequest', notflattened=True)
 addExternalIface('LockedFile')
 addExternalIface('MenuBuilder', nativeType='nsIMenuBuilder', notflattened=True)
 addExternalIface('MozBoxObject', nativeType='nsIBoxObject')
-addExternalIface('MozConnection', headerFile='nsIDOMConnection.h')
 addExternalIface('MozControllers', nativeType='nsIControllers')
 addExternalIface('MozFrameLoader', nativeType='nsIFrameLoader', notflattened=True)
 addExternalIface('MozFrameRequestCallback', nativeType='nsIFrameRequestCallback',
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@ -840,7 +840,9 @@ def UnionTypes(descriptors, dictionaries, callbacks, config):
                    if typeNeedsRooting(f):
                        headers.add("mozilla/dom/RootedDictionary.h")
                elif f.isEnum():
-                    headers.add(CGHeaders.getDeclarationFilename(f))
+                    # Need to see the actual definition of the enum,
+                    # unfortunately.
+                    headers.add(CGHeaders.getDeclarationFilename(f.inner))

    map(addInfoForType, getAllTypes(descriptors, dictionaries, callbacks))

--- a/dom/bluetooth/BluetoothPropertyContainer.cpp
+++ b/dom/bluetooth/BluetoothPropertyContainer.cpp
@ -12,6 +12,8 @@
 #include "mozilla/dom/bluetooth/BluetoothTypes.h"
 #include "nsServiceManagerUtils.h"

+#include "js/Value.h"
+
 USING_BLUETOOTH_NAMESPACE

 already_AddRefed<mozilla::dom::DOMRequest>
@ -26,7 +28,7 @@ BluetoothPropertyContainer::FirePropertyAlreadySet(nsPIDOMWindow* aOwner,
  }

  nsRefPtr<mozilla::dom::DOMRequest> request = new DOMRequest(aOwner);
-  rs->FireSuccess(request, JS::UndefinedValue());
+  rs->FireSuccess(request, JS::UndefinedHandleValue);

  return request.forget();
 }
--- a/dom/bluetooth/BluetoothService.cpp
+++ b/dom/bluetooth/BluetoothService.cpp
@ -246,7 +246,7 @@ class BluetoothService::StartupTask : public nsISettingsServiceCallback
 public:
  NS_DECL_ISUPPORTS

-  NS_IMETHOD Handle(const nsAString& aName, const JS::Value& aResult)
+  NS_IMETHOD Handle(const nsAString& aName, JS::Handle<JS::Value> aResult)
  {
    MOZ_ASSERT(NS_IsMainThread());

@ -857,7 +857,7 @@ BluetoothService::Notify(const BluetoothSignal& aData)
    do_GetService("@mozilla.org/system-message-internal;1");
  NS_ENSURE_TRUE_VOID(systemMessenger);

-  systemMessenger->BroadcastMessage(type,
-                                    OBJECT_TO_JSVAL(obj),
-                                    JS::UndefinedValue());
+  JS::Rooted<JS::Value> value(cx, JS::ObjectValue(*obj));
+  systemMessenger->BroadcastMessage(type, value,
+                                    JS::UndefinedHandleValue);
 }
--- a/dom/bluetooth/bluedroid/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothHfpManager.cpp
@ -205,7 +205,7 @@ public:
  NS_DECL_ISUPPORTS

  NS_IMETHOD
-  Handle(const nsAString& aName, const JS::Value& aResult)
+  Handle(const nsAString& aName, JS::Handle<JS::Value> aResult)
  {
    MOZ_ASSERT(NS_IsMainThread());

@ -852,7 +852,9 @@ BluetoothHfpManager::HandleVoiceConnectionChanged(uint32_t aClientId)
  mService = (regState.EqualsLiteral("registered")) ? 1 : 0;

  // Signal
-  JS::Value value;
+  JSContext* cx = nsContentUtils::GetSafeJSContext();
+  NS_ENSURE_TRUE_VOID(cx);
+  JS::Rooted<JS::Value> value(cx);
  voiceInfo->GetRelSignalStrength(&value);
  NS_ENSURE_TRUE_VOID(value.isNumber());
  mSignal = (int)ceil(value.toNumber() / 20.0);
--- a/dom/bluetooth/bluedroid/BluetoothUtils.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothUtils.cpp
@ -128,9 +128,9 @@ BroadcastSystemMessage(const nsAString& aType,
    do_GetService("@mozilla.org/system-message-internal;1");
  NS_ENSURE_TRUE(systemMessenger, false);

-  systemMessenger->BroadcastMessage(aType,
-                                    OBJECT_TO_JSVAL(obj),
-                                    JS::UndefinedValue());
+  JS::Rooted<JS::Value> value(cx, JS::ObjectValue(*obj));
+  systemMessenger->BroadcastMessage(aType, value,
+                                    JS::UndefinedHandleValue);

  return true;
 }
--- a/dom/bluetooth/bluez/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/bluez/BluetoothHfpManager.cpp
@ -162,7 +162,7 @@ public:
  NS_DECL_ISUPPORTS

  NS_IMETHOD
-  Handle(const nsAString& aName, const JS::Value& aResult)
+  Handle(const nsAString& aName, JS::Handle<JS::Value> aResult)
  {
    MOZ_ASSERT(NS_IsMainThread());

@ -620,7 +620,9 @@ BluetoothHfpManager::HandleVoiceConnectionChanged(uint32_t aClientId)
  }
  UpdateCIND(CINDType::SERVICE, service);

-  JS::Value value;
+  JSContext* cx = nsContentUtils::GetSafeJSContext();
+  NS_ENSURE_TRUE_VOID(cx);
+  JS::Rooted<JS::Value> value(cx);
  voiceInfo->GetRelSignalStrength(&value);
  NS_ENSURE_TRUE_VOID(value.isNumber());
  uint8_t signal = ceil(value.toNumber() / 20.0);
--- a/dom/bluetooth/bluez/BluetoothUtils.cpp
+++ b/dom/bluetooth/bluez/BluetoothUtils.cpp
@ -126,9 +126,9 @@ BroadcastSystemMessage(const nsAString& aType,
    do_GetService("@mozilla.org/system-message-internal;1");
  NS_ENSURE_TRUE(systemMessenger, false);

-  systemMessenger->BroadcastMessage(aType,
-                                    OBJECT_TO_JSVAL(obj),
-                                    JS::UndefinedValue());
+  JS::Rooted<JS::Value> value(cx, JS::ObjectValue(*obj));
+  systemMessenger->BroadcastMessage(aType, value,
+                                    JS::UndefinedHandleValue);

  return true;
 }
--- a/dom/camera/DOMCameraCapabilities.cpp
+++ b/dom/camera/DOMCameraCapabilities.cpp
@ -161,89 +161,101 @@ DOMCameraCapabilities::ParameterListToNewArray(JSContext* aCx,
 }

 nsresult
-DOMCameraCapabilities::StringListToNewObject(JSContext* aCx, JS::Value* aArray, uint32_t aKey)
+DOMCameraCapabilities::StringListToNewObject(JSContext* aCx,
+                                             JS::MutableHandle<JS::Value> aArray,
+                                             uint32_t aKey)
 {
  JS::Rooted<JSObject*> array(aCx);

  nsresult rv = ParameterListToNewArray(aCx, &array, aKey, ParseStringItemAndAdd);
  NS_ENSURE_SUCCESS(rv, rv);

-  *aArray = OBJECT_TO_JSVAL(array);
+  aArray.setObjectOrNull(array);
  return NS_OK;
 }

 nsresult
-DOMCameraCapabilities::DimensionListToNewObject(JSContext* aCx, JS::Value* aArray, uint32_t aKey)
+DOMCameraCapabilities::DimensionListToNewObject(JSContext* aCx,
+                                                JS::MutableHandle<JS::Value> aArray,
+                                                uint32_t aKey)
 {
  JS::Rooted<JSObject*> array(aCx);
-  nsresult rv;

-  rv = ParameterListToNewArray(aCx, &array, aKey, ParseDimensionItemAndAdd);
+  nsresult rv = ParameterListToNewArray(aCx, &array, aKey, ParseDimensionItemAndAdd);
  NS_ENSURE_SUCCESS(rv, rv);

-  *aArray = OBJECT_TO_JSVAL(array);
+  aArray.setObjectOrNull(array);
  return NS_OK;
 }

 /* readonly attribute jsval previewSizes; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetPreviewSizes(JSContext* cx, JS::Value* aPreviewSizes)
+DOMCameraCapabilities::GetPreviewSizes(JSContext* cx,
+                                       JS::MutableHandle<JS::Value> aPreviewSizes)
 {
  return DimensionListToNewObject(cx, aPreviewSizes, CAMERA_PARAM_SUPPORTED_PREVIEWSIZES);
 }

 /* readonly attribute jsval pictureSizes; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetPictureSizes(JSContext* cx, JS::Value* aPictureSizes)
+DOMCameraCapabilities::GetPictureSizes(JSContext* cx,
+                                       JS::MutableHandle<JS::Value> aPictureSizes)
 {
  return DimensionListToNewObject(cx, aPictureSizes, CAMERA_PARAM_SUPPORTED_PICTURESIZES);
 }

 /* readonly attribute jsval thumbnailSizes; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetThumbnailSizes(JSContext* cx, JS::Value* aThumbnailSizes)
+DOMCameraCapabilities::GetThumbnailSizes(JSContext* cx,
+                                         JS::MutableHandle<JS::Value> aThumbnailSizes)
 {
  return DimensionListToNewObject(cx, aThumbnailSizes, CAMERA_PARAM_SUPPORTED_JPEG_THUMBNAIL_SIZES);
 }

 /* readonly attribute jsval fileFormats; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetFileFormats(JSContext* cx, JS::Value* aFileFormats)
+DOMCameraCapabilities::GetFileFormats(JSContext* cx,
+                                      JS::MutableHandle<JS::Value> aFileFormats)
 {
  return StringListToNewObject(cx, aFileFormats, CAMERA_PARAM_SUPPORTED_PICTUREFORMATS);
 }

 /* readonly attribute jsval whiteBalanceModes; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetWhiteBalanceModes(JSContext* cx, JS::Value* aWhiteBalanceModes)
+DOMCameraCapabilities::GetWhiteBalanceModes(JSContext* cx,
+                                            JS::MutableHandle<JS::Value> aWhiteBalanceModes)
 {
  return StringListToNewObject(cx, aWhiteBalanceModes, CAMERA_PARAM_SUPPORTED_WHITEBALANCES);
 }

 /* readonly attribute jsval sceneModes; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetSceneModes(JSContext* cx, JS::Value* aSceneModes)
+DOMCameraCapabilities::GetSceneModes(JSContext* cx,
+                                     JS::MutableHandle<JS::Value> aSceneModes)
 {
  return StringListToNewObject(cx, aSceneModes, CAMERA_PARAM_SUPPORTED_SCENEMODES);
 }

 /* readonly attribute jsval effects; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetEffects(JSContext* cx, JS::Value* aEffects)
+DOMCameraCapabilities::GetEffects(JSContext* cx,
+                                  JS::MutableHandle<JS::Value> aEffects)
 {
  return StringListToNewObject(cx, aEffects, CAMERA_PARAM_SUPPORTED_EFFECTS);
 }

 /* readonly attribute jsval flashModes; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetFlashModes(JSContext* cx, JS::Value* aFlashModes)
+DOMCameraCapabilities::GetFlashModes(JSContext* cx,
+                                     JS::MutableHandle<JS::Value> aFlashModes)
 {
  return StringListToNewObject(cx, aFlashModes, CAMERA_PARAM_SUPPORTED_FLASHMODES);
 }

 /* readonly attribute jsval focusModes; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetFocusModes(JSContext* cx, JS::Value* aFocusModes)
+DOMCameraCapabilities::GetFocusModes(JSContext* cx,
+                                     JS::MutableHandle<JS::Value> aFocusModes)
 {
  return StringListToNewObject(cx, aFocusModes, CAMERA_PARAM_SUPPORTED_FOCUSMODES);
 }
@ -335,14 +347,14 @@ DOMCameraCapabilities::GetMaxMeteringAreas(JSContext* cx, int32_t* aMaxMeteringA

 /* readonly attribute jsval zoomRatios; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetZoomRatios(JSContext* cx, JS::Value* aZoomRatios)
+DOMCameraCapabilities::GetZoomRatios(JSContext* cx, JS::MutableHandle<JS::Value> aZoomRatios)
 {
  NS_ENSURE_TRUE(mCamera, NS_ERROR_NOT_AVAILABLE);

  const char* value = mCamera->GetParameterConstChar(CAMERA_PARAM_SUPPORTED_ZOOM);
  if (!value || strcmp(value, "true") != 0) {
    // if zoom is not supported, return a null object
-    *aZoomRatios = JSVAL_NULL;
+    aZoomRatios.setNull();
    return NS_OK;
  }

@ -351,13 +363,13 @@ DOMCameraCapabilities::GetZoomRatios(JSContext* cx, JS::Value* aZoomRatios)
  nsresult rv = ParameterListToNewArray(cx, &array, CAMERA_PARAM_SUPPORTED_ZOOMRATIOS, ParseZoomRatioItemAndAdd);
  NS_ENSURE_SUCCESS(rv, rv);

-  *aZoomRatios = OBJECT_TO_JSVAL(array);
+  aZoomRatios.setObjectOrNull(array);
  return NS_OK;
 }

 /* readonly attribute jsval videoSizes; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetVideoSizes(JSContext* cx, JS::Value* aVideoSizes)
+DOMCameraCapabilities::GetVideoSizes(JSContext* cx, JS::MutableHandle<JS::Value> aVideoSizes)
 {
  NS_ENSURE_TRUE(mCamera, NS_ERROR_NOT_AVAILABLE);

@ -365,8 +377,8 @@ DOMCameraCapabilities::GetVideoSizes(JSContext* cx, JS::Value* aVideoSizes)
  nsresult rv = mCamera->GetVideoSizes(sizes);
  NS_ENSURE_SUCCESS(rv, rv);
  if (sizes.Length() == 0) {
-    // video recording not supported, return a null object
-    *aVideoSizes = JSVAL_NULL;
+    // video recording not supported, return null
+    aVideoSizes.setNull();
    return NS_OK;
  }

@ -392,19 +404,19 @@ DOMCameraCapabilities::GetVideoSizes(JSContext* cx, JS::Value* aVideoSizes)
    }
  }

-  *aVideoSizes = OBJECT_TO_JSVAL(array);
+  aVideoSizes.setObject(*array);
  return NS_OK;
 }

 /* readonly attribute jsval recorderProfiles; */
 NS_IMETHODIMP
-DOMCameraCapabilities::GetRecorderProfiles(JSContext* cx, JS::Value* aRecorderProfiles)
+DOMCameraCapabilities::GetRecorderProfiles(JSContext* cx, JS::MutableHandle<JS::Value> aRecorderProfiles)
 {
  NS_ENSURE_TRUE(mCamera, NS_ERROR_NOT_AVAILABLE);

  nsRefPtr<RecorderProfileManager> profileMgr = mCamera->GetRecorderProfileManager();
  if (!profileMgr) {
-    *aRecorderProfiles = JSVAL_NULL;
+    aRecorderProfiles.setNull();
    return NS_OK;
  }

@ -412,6 +424,6 @@ DOMCameraCapabilities::GetRecorderProfiles(JSContext* cx, JS::Value* aRecorderPr
  nsresult rv = profileMgr->GetJsObject(cx, o.address());
  NS_ENSURE_SUCCESS(rv, rv);

-  *aRecorderProfiles = OBJECT_TO_JSVAL(o);
+  aRecorderProfiles.setObject(*o);
  return NS_OK;
 }
--- a/dom/camera/DOMCameraCapabilities.h
+++ b/dom/camera/DOMCameraCapabilities.h
@ -32,8 +32,12 @@ public:
    uint32_t aKey,
    ParseItemAndAddFunc aParseItemAndAdd
  );
-  nsresult StringListToNewObject(JSContext* aCx, JS::Value* aArray, uint32_t aKey);
-  nsresult DimensionListToNewObject(JSContext* aCx, JS::Value* aArray, uint32_t aKey);
+  nsresult StringListToNewObject(JSContext* aCx,
+                                 JS::MutableHandle<JS::Value> aArray,
+                                 uint32_t aKey);
+  nsresult DimensionListToNewObject(JSContext* aCx,
+                                    JS::MutableHandle<JS::Value> aArray,
+                                    uint32_t aKey);

 private:
  DOMCameraCapabilities(const DOMCameraCapabilities&) MOZ_DELETE;
--- a/dom/events/TextComposition.cpp
+++ b/dom/events/TextComposition.cpp
@ -26,6 +26,7 @@ TextComposition::TextComposition(nsPresContext* aPresContext,
                                 WidgetGUIEvent* aEvent) :
  mPresContext(aPresContext), mNode(aNode),
  mNativeContext(aEvent->widget->GetInputContext().mNativeIMEContext),
+  mCompositionStartOffset(0), mCompositionTargetOffset(0),
  mIsSynthesizedForTests(aEvent->mFlags.mIsSynthesizedForTests)
 {
 }
@ -36,6 +37,8 @@ TextComposition::TextComposition(const TextComposition& aOther)
  mPresContext = aOther.mPresContext;
  mNode = aOther.mNode;
  mLastData = aOther.mLastData;
+  mCompositionStartOffset = aOther.mCompositionStartOffset;
+  mCompositionTargetOffset = aOther.mCompositionTargetOffset;
  mIsSynthesizedForTests = aOther.mIsSynthesizedForTests;
 }

@ -56,6 +59,51 @@ TextComposition::DispatchEvent(WidgetGUIEvent* aEvent,

  nsEventDispatcher::Dispatch(mNode, mPresContext,
                              aEvent, nullptr, aStatus, aCallBack);
+
+  // Notify composition update to widget if possible
+  NotityUpdateComposition(aEvent);
+}
+
+void
+TextComposition::NotityUpdateComposition(WidgetGUIEvent* aEvent)
+{
+  nsEventStatus status;
+
+  // When compositon start, notify the rect of first offset character.
+  // When not compositon start, notify the rect of selected composition
+  // string if text event.
+  if (aEvent->message == NS_COMPOSITION_START) {
+    nsCOMPtr<nsIWidget> widget = mPresContext->GetRootWidget();
+    // Update composition start offset
+    WidgetQueryContentEvent selectedTextEvent(true,
+                                              NS_QUERY_SELECTED_TEXT,
+                                              widget);
+    widget->DispatchEvent(&selectedTextEvent, status);
+    if (selectedTextEvent.mSucceeded) {
+      mCompositionStartOffset = selectedTextEvent.mReply.mOffset;
+    } else {
+      // Unknown offset
+      NS_WARNING("Cannot get start offset of IME composition");
+      mCompositionStartOffset = 0;
+    }
+    mCompositionTargetOffset = mCompositionStartOffset;
+  } else if (aEvent->eventStructType != NS_TEXT_EVENT) {
+    return;
+  } else {
+    WidgetTextEvent* textEvent = aEvent->AsTextEvent();
+    mCompositionTargetOffset = mCompositionStartOffset;
+
+    for (uint32_t i = 0; i < textEvent->rangeCount; i++) {
+      TextRange& range = textEvent->rangeArray[i];
+      if (range.mRangeType == NS_TEXTRANGE_SELECTEDRAWTEXT ||
+          range.mRangeType == NS_TEXTRANGE_SELECTEDCONVERTEDTEXT) {
+        mCompositionTargetOffset += range.mStartOffset;
+        break;
+      }
+    }
+  }
+
+  NotifyIME(widget::NotificationToIME::NOTIFY_IME_OF_COMPOSITION_UPDATE);
 }

 void
--- a/dom/events/TextComposition.h
+++ b/dom/events/TextComposition.h
@ -12,6 +12,7 @@
 #include "nsIWidget.h"
 #include "nsTArray.h"
 #include "nsThreadUtils.h"
+#include "nsPresContext.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/EventForwards.h"

@ -66,6 +67,11 @@ public:
   */
  nsresult NotifyIME(widget::NotificationToIME aNotification);

+  /**
+   * the offset of first selected clause or start of of compositon
+   */
+  uint32_t OffsetOfTargetClause() const { return mCompositionTargetOffset; }
+
 private:
  // This class holds nsPresContext weak.  This instance shouldn't block
  // destroying it.  When the presContext is being destroyed, it's notified to
@ -82,6 +88,12 @@ private:
  // the compositionstart event).
  nsString mLastData;

+  // Offset of the composition string from start of the editor
+  uint32_t mCompositionStartOffset;
+  // Offset of the selected clause of the composition string from start of the
+  // editor
+  uint32_t mCompositionTargetOffset;
+
  // See the comment for IsSynthesizedForTests().
  bool mIsSynthesizedForTests;

@ -96,6 +108,11 @@ private:
                     nsEventStatus* aStatus,
                     nsDispatchingCallback* aCallBack);

+  /**
+   * Calculate composition offset then notify composition update to widget
+   */
+  void NotityUpdateComposition(WidgetGUIEvent* aEvent);
+
  /**
   * CompositionEventDispatcher dispatches the specified composition (or text)
   * event.
--- a/dom/events/nsDOMEventTargetHelper.h
+++ b/dom/events/nsDOMEventTargetHelper.h
@ -172,24 +172,26 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsDOMEventTargetHelper,

 // XPIDL event handlers
 #define NS_IMPL_EVENT_HANDLER(_class, _event)                                 \
-    NS_IMETHODIMP _class::GetOn##_event(JSContext* aCx, JS::Value* aValue)    \
+    NS_IMETHODIMP _class::GetOn##_event(JSContext* aCx,                       \
+                                        JS::MutableHandle<JS::Value> aValue)  \
    {                                                                         \
-      GetEventHandler(nsGkAtoms::on##_event, aCx, aValue);                    \
+      GetEventHandler(nsGkAtoms::on##_event, aCx, aValue.address());          \
      return NS_OK;                                                           \
    }                                                                         \
    NS_IMETHODIMP _class::SetOn##_event(JSContext* aCx,                       \
-                                        const JS::Value& aValue)              \
+                                        JS::Handle<JS::Value> aValue)         \
    {                                                                         \
      return SetEventHandler(nsGkAtoms::on##_event, aCx, aValue);             \
    }

 #define NS_IMPL_FORWARD_EVENT_HANDLER(_class, _event, _baseclass)             \
-    NS_IMETHODIMP _class::GetOn##_event(JSContext* aCx, JS::Value* aValue)    \
+    NS_IMETHODIMP _class::GetOn##_event(JSContext* aCx,                       \
+                                        JS::MutableHandle<JS::Value> aValue)  \
    {                                                                         \
      return _baseclass::GetOn##_event(aCx, aValue);                          \
    }                                                                         \
    NS_IMETHODIMP _class::SetOn##_event(JSContext* aCx,                       \
-                                        const JS::Value& aValue)              \
+                                        JS::Handle<JS::Value> aValue)         \
    {                                                                         \
      return _baseclass::SetOn##_event(aCx, aValue);                          \
    }
--- a/dom/events/nsDOMMessageEvent.cpp
+++ b/dom/events/nsDOMMessageEvent.cpp
@ -63,10 +63,10 @@ nsDOMMessageEvent::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope)
 }

 NS_IMETHODIMP
-nsDOMMessageEvent::GetData(JSContext* aCx, JS::Value* aData)
+nsDOMMessageEvent::GetData(JSContext* aCx, JS::MutableHandle<JS::Value> aData)
 {
  ErrorResult rv;
-  *aData = GetData(aCx, rv);
+  aData.set(GetData(aCx, rv));
  return rv.ErrorCode();
 }

@ -171,7 +171,7 @@ NS_IMETHODIMP
 nsDOMMessageEvent::InitMessageEvent(const nsAString& aType,
                                    bool aCanBubble,
                                    bool aCancelable,
-                                    const JS::Value& aData,
+                                    JS::Handle<JS::Value> aData,
                                    const nsAString& aOrigin,
                                    const nsAString& aLastEventId,
                                    nsIDOMWindow* aSource)
--- a/dom/events/nsDOMNotifyAudioAvailableEvent.cpp
+++ b/dom/events/nsDOMNotifyAudioAvailableEvent.cpp
@ -66,7 +66,7 @@ nsDOMNotifyAudioAvailableEvent::~nsDOMNotifyAudioAvailableEvent()
 }

 NS_IMETHODIMP
-nsDOMNotifyAudioAvailableEvent::GetFrameBuffer(JSContext* aCx, JS::Value* aResult)
+nsDOMNotifyAudioAvailableEvent::GetFrameBuffer(JSContext* aCx, JS::MutableHandle<JS::Value> aResult)
 {
  if (!mAllowAudioData) {
    // Media is not same-origin, don't allow the data out.
@ -74,7 +74,7 @@ nsDOMNotifyAudioAvailableEvent::GetFrameBuffer(JSContext* aCx, JS::Value* aResul
  }

  if (mCachedArray) {
-    *aResult = OBJECT_TO_JSVAL(mCachedArray);
+    aResult.setObject(*mCachedArray);
    return NS_OK;
  }

@ -88,7 +88,7 @@ nsDOMNotifyAudioAvailableEvent::GetFrameBuffer(JSContext* aCx, JS::Value* aResul
  }
  memcpy(JS_GetFloat32ArrayData(mCachedArray), mFrameBuffer.get(), mFrameBufferLength * sizeof(float));

-  *aResult = OBJECT_TO_JSVAL(mCachedArray);
+  aResult.setObject(*mCachedArray);
  return NS_OK;
 }

--- a/dom/events/nsDOMNotifyAudioAvailableEvent.h
+++ b/dom/events/nsDOMNotifyAudioAvailableEvent.h
@ -51,7 +51,7 @@ public:
  JSObject* GetFrameBuffer(JSContext* aCx, mozilla::ErrorResult& aRv)
  {
    JS::Rooted<JS::Value> dummy(aCx);
-    aRv = GetFrameBuffer(aCx, dummy.address());
+    aRv = GetFrameBuffer(aCx, &dummy);
    return mCachedArray;
  }

--- a/dom/events/nsEventListenerService.cpp
+++ b/dom/events/nsEventListenerService.cpp
@ -65,10 +65,11 @@ nsEventListenerInfo::GetInSystemEventGroup(bool* aInSystemEventGroup)
 }

 NS_IMETHODIMP
-nsEventListenerInfo::GetListenerObject(JSContext* aCx, JS::Value* aObject)
+nsEventListenerInfo::GetListenerObject(JSContext* aCx,
+                                       JS::MutableHandle<JS::Value> aObject)
 {
  mozilla::Maybe<JSAutoCompartment> ac;
-  GetJSVal(aCx, ac, aObject);
+  GetJSVal(aCx, ac, aObject.address());
  return NS_OK;
 }

--- a/dom/events/nsEventStateManager.cpp
+++ b/dom/events/nsEventStateManager.cpp
@ -1214,14 +1214,18 @@ nsEventStateManager::PreHandleEvent(nsPresContext* aPresContext,
    break;
  case NS_QUERY_CARET_RECT:
    {
-      // XXX remote event
+      if (RemoteQueryContentEvent(aEvent)) {
+        break;
+      }
      nsContentEventHandler handler(mPresContext);
      handler.OnQueryCaretRect(aEvent->AsQueryContentEvent());
    }
    break;
  case NS_QUERY_TEXT_RECT:
    {
-      // XXX remote event
+      if (RemoteQueryContentEvent(aEvent)) {
+        break;
+      }
      nsContentEventHandler handler(mPresContext);
      handler.OnQueryTextRect(aEvent->AsQueryContentEvent());
    }
--- a/dom/events/nsIMEStateManager.cpp
+++ b/dom/events/nsIMEStateManager.cpp
@ -598,6 +598,7 @@ nsIMEStateManager::NotifyIME(NotificationToIME aNotification,
        return aWidget->NotifyIME(aNotification);
      case REQUEST_TO_COMMIT_COMPOSITION:
      case REQUEST_TO_CANCEL_COMPOSITION:
+      case NOTIFY_IME_OF_COMPOSITION_UPDATE:
        return composition ? aWidget->NotifyIME(aNotification) : NS_OK;
      default:
        MOZ_CRASH("Unsupported notification");
@ -1125,3 +1126,9 @@ nsIMEStateManager::GetFocusSelectionAndRoot(nsISelection** aSel,
  NS_ADDREF(*aRoot = sTextStateObserver->mRootContent);
  return NS_OK;
 }
+
+TextComposition*
+nsIMEStateManager::GetTextComposition(nsIWidget* aWidget)
+{
+  return sTextCompositions->GetCompositionFor(aWidget);
+}
--- a/dom/events/nsIMEStateManager.h
+++ b/dom/events/nsIMEStateManager.h
@ -20,6 +20,7 @@ class nsISelection;

 namespace mozilla {
 class TextCompositionArray;
+class TextComposition;
 } // namespace mozilla

 /*
@ -94,6 +95,11 @@ public:
                                       nsEventStatus* aStatus,
                                       nsDispatchingCallback* aCallBack);

+  /**
+   * Get TextComposition from widget.
+   */
+  static mozilla::TextComposition* GetTextComposition(nsIWidget* aWidget);
+
  /**
   * Send a notification to IME.  It depends on the IME or platform spec what
   * will occur (or not occur).
--- a/dom/file/LockedFile.cpp
+++ b/dom/file/LockedFile.cpp
@ -491,34 +491,33 @@ LockedFile::GetActive(bool* aActive)

 NS_IMETHODIMP
 LockedFile::GetLocation(JSContext* aCx,
-                        JS::Value* aLocation)
+                        JS::MutableHandle<JS::Value> aLocation)
 {
  NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");

  if (mLocation == UINT64_MAX) {
-    *aLocation = JSVAL_NULL;
+    aLocation.setNull();
  }
  else {
-    *aLocation = JS_NumberValue(double(mLocation));
+    aLocation.setDouble(double(mLocation));
  }
  return NS_OK;
 }

 NS_IMETHODIMP
 LockedFile::SetLocation(JSContext* aCx,
-                        const JS::Value& aLocation)
+                        JS::Handle<JS::Value> aLocation)
 {
  NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");

  // Null means the end-of-file.
-  if (JSVAL_IS_NULL(aLocation)) {
+  if (aLocation.isNull()) {
    mLocation = UINT64_MAX;
    return NS_OK;
  }

  uint64_t location;
-  JS::Rooted<JS::Value> value(aCx, aLocation);
-  if (!JS::ToUint64(aCx, value, &location)) {
+  if (!JS::ToUint64(aCx, aLocation, &location)) {
    return NS_ERROR_TYPE_ERR;
  }

@ -527,7 +526,7 @@ LockedFile::SetLocation(JSContext* aCx,
 }

 NS_IMETHODIMP
-LockedFile::GetMetadata(const JS::Value& aParameters,
+LockedFile::GetMetadata(JS::Handle<JS::Value> aParameters,
                        JSContext* aCx,
                        nsISupports** _retval)
 {
@ -546,7 +545,7 @@ LockedFile::GetMetadata(const JS::Value& aParameters,

  // Get optional arguments.
  if (!JSVAL_IS_VOID(aParameters) && !JSVAL_IS_NULL(aParameters)) {
-    nsresult rv = params->Init(aCx, &aParameters);
+    nsresult rv = params->Init(aCx, aParameters);
    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_FILEHANDLE_UNKNOWN_ERR);

    if (!params->IsConfigured()) {
@ -658,7 +657,7 @@ LockedFile::ReadAsText(uint64_t aSize,
 }

 NS_IMETHODIMP
-LockedFile::Write(const JS::Value& aValue,
+LockedFile::Write(JS::Handle<JS::Value> aValue,
                  JSContext* aCx,
                  nsISupports** _retval)
 {
@ -668,7 +667,7 @@ LockedFile::Write(const JS::Value& aValue,
 }

 NS_IMETHODIMP
-LockedFile::Append(const JS::Value& aValue,
+LockedFile::Append(JS::Handle<JS::Value> aValue,
                   JSContext* aCx,
                   nsISupports** _retval)
 {
--- a/dom/file/MetadataHelper.h
+++ b/dom/file/MetadataHelper.h
@ -31,9 +31,9 @@ public:
  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(MetadataParameters)

  nsresult
-  Init(JSContext* aCx, const JS::Value* aVal)
+  Init(JSContext* aCx, JS::Handle<JS::Value> aVal)
  {
-    return mConfig.Init(aCx, aVal);
+    return mConfig.Init(aCx, aVal.address());
  }

  void
--- a/dom/fmradio/FMRadioService.cpp
+++ b/dom/fmradio/FMRadioService.cpp
@ -137,7 +137,7 @@ public:
    : mPendingRequest(aPendingRequest) { }

  NS_IMETHOD
-  Handle(const nsAString& aName, const JS::Value& aResult)
+  Handle(const nsAString& aName, JS::Handle<JS::Value> aResult)
  {
    FMRadioService* fmRadioService = FMRadioService::Singleton();
    MOZ_ASSERT(mPendingRequest == fmRadioService->mPendingRequest);
--- a/dom/icc/src/Icc.cpp
+++ b/dom/icc/src/Icc.cpp
@ -56,7 +56,7 @@ Icc::NotifyStkEvent(const nsAString& aName, const nsAString& aMessage)

  if (!aMessage.IsEmpty()) {
    nsCOMPtr<nsIJSON> json(new nsJSON());
-    nsresult rv = json->DecodeToJSVal(aMessage, cx, value.address());
+    nsresult rv = json->DecodeToJSVal(aMessage, cx, &value);
    NS_ENSURE_SUCCESS(rv, rv);
  } else {
    value = JS::NullValue();
@ -115,8 +115,8 @@ Icc::GetCardState(nsString& aCardState) const
 }

 void
-Icc::SendStkResponse(const JSContext* aCx, const JS::Value& aCommand,
-                     const JS::Value& aResponse, ErrorResult& aRv)
+Icc::SendStkResponse(const JSContext* aCx, JS::Handle<JS::Value> aCommand,
+                     JS::Handle<JS::Value> aResponse, ErrorResult& aRv)
 {
  if (!mProvider) {
    aRv.Throw(NS_ERROR_FAILURE);
@ -149,7 +149,7 @@ Icc::SendStkMenuSelection(uint16_t aItemIdentifier, bool aHelpRequested,
 }

 void
-Icc::SendStkTimerExpiration(const JSContext* aCx, const JS::Value& aTimer,
+Icc::SendStkTimerExpiration(const JSContext* aCx, JS::Handle<JS::Value> aTimer,
                            ErrorResult& aRv)
 {
  if (!mProvider) {
@ -165,7 +165,7 @@ Icc::SendStkTimerExpiration(const JSContext* aCx, const JS::Value& aTimer,
 }

 void
-Icc::SendStkEventDownload(const JSContext* aCx, const JS::Value& aEvent,
+Icc::SendStkEventDownload(const JSContext* aCx, JS::Handle<JS::Value> aEvent,
                          ErrorResult& aRv)
 {
  if (!mProvider) {
@ -199,7 +199,7 @@ Icc::GetCardLock(const nsAString& aLockType, ErrorResult& aRv)
 }

 already_AddRefed<nsISupports>
-Icc::UnlockCardLock(const JSContext* aCx, const JS::Value& aInfo,
+Icc::UnlockCardLock(const JSContext* aCx, JS::Handle<JS::Value> aInfo,
                    ErrorResult& aRv)
 {
  if (!mProvider) {
@ -219,7 +219,8 @@ Icc::UnlockCardLock(const JSContext* aCx, const JS::Value& aInfo,
 }

 already_AddRefed<nsISupports>
-Icc::SetCardLock(const JSContext* aCx, const JS::Value& aInfo, ErrorResult& aRv)
+Icc::SetCardLock(const JSContext* aCx, JS::Handle<JS::Value> aInfo,
+                 ErrorResult& aRv)
 {
  if (!mProvider) {
    aRv.Throw(NS_ERROR_FAILURE);
@ -279,7 +280,7 @@ Icc::ReadContacts(const nsAString& aContactType, ErrorResult& aRv)

 already_AddRefed<nsISupports>
 Icc::UpdateContact(const JSContext* aCx, const nsAString& aContactType,
-                   const JS::Value& aContact, const nsAString& aPin2,
+                   JS::Handle<JS::Value> aContact, const nsAString& aPin2,
                   ErrorResult& aRv)
 {
  if (!mProvider) {
@ -319,8 +320,8 @@ Icc::IccOpenChannel(const nsAString& aAid, ErrorResult& aRv)
 }

 already_AddRefed<nsISupports>
-Icc::IccExchangeAPDU(const JSContext* aCx, int32_t aChannel, const jsval& aApdu,
-                     ErrorResult& aRv)
+Icc::IccExchangeAPDU(const JSContext* aCx, int32_t aChannel,
+                     JS::Handle<JS::Value> aApdu, ErrorResult& aRv)
 {
  if (!mProvider) {
    aRv.Throw(NS_ERROR_FAILURE);
--- a/dom/icc/src/Icc.h
+++ b/dom/icc/src/Icc.h
@ -51,30 +51,31 @@ public:
  GetCardState(nsString& aCardState) const;

  void
-  SendStkResponse(const JSContext* aCx, const JS::Value& aCommand,
-                  const JS::Value& aResponse, ErrorResult& aRv);
+  SendStkResponse(const JSContext* aCx, JS::Handle<JS::Value> aCommand,
+                  JS::Handle<JS::Value> aResponse, ErrorResult& aRv);

  void
  SendStkMenuSelection(uint16_t aItemIdentifier, bool aHelpRequested,
                       ErrorResult& aRv);

  void
-  SendStkTimerExpiration(const JSContext* aCx, const JS::Value& aTimer,
+  SendStkTimerExpiration(const JSContext* aCx, JS::Handle<JS::Value> aTimer,
                         ErrorResult& aRv);

  void
-  SendStkEventDownload(const JSContext* aCx, const JS::Value& aEvent,
+  SendStkEventDownload(const JSContext* aCx, JS::Handle<JS::Value> aEvent,
                       ErrorResult& aRv);

  already_AddRefed<nsISupports>
  GetCardLock(const nsAString& aLockType, ErrorResult& aRv);

  already_AddRefed<nsISupports>
-  UnlockCardLock(const JSContext* aCx, const JS::Value& aInfo,
+  UnlockCardLock(const JSContext* aCx, JS::Handle<JS::Value> aInfo,
                 ErrorResult& aRv);

  already_AddRefed<nsISupports>
-  SetCardLock(const JSContext* aCx, const JS::Value& aInfo, ErrorResult& aRv);
+  SetCardLock(const JSContext* aCx, JS::Handle<JS::Value> aInfo,
+              ErrorResult& aRv);

  already_AddRefed<nsISupports>
  GetCardLockRetryCount(const nsAString& aLockType, ErrorResult& aRv);
@ -84,15 +85,15 @@ public:

  already_AddRefed<nsISupports>
  UpdateContact(const JSContext* aCx, const nsAString& aContactType,
-                const JS::Value& aContact, const nsAString& aPin2,
+                JS::Handle<JS::Value> aContact, const nsAString& aPin2,
                ErrorResult& aRv);

  already_AddRefed<nsISupports>
  IccOpenChannel(const nsAString& aAid, ErrorResult& aRv);

  already_AddRefed<nsISupports>
-  IccExchangeAPDU(const JSContext* aCx, int32_t aChannel, const jsval& aApdu,
-                  ErrorResult& aRv);
+  IccExchangeAPDU(const JSContext* aCx, int32_t aChannel,
+                  JS::Handle<JS::Value> aApdu, ErrorResult& aRv);

  already_AddRefed<nsISupports>
  IccCloseChannel(int32_t aChannel, ErrorResult& aRv);
--- a/dom/icc/src/IccManager.cpp
+++ b/dom/icc/src/IccManager.cpp
@ -130,7 +130,7 @@ IccManager::Unroot()
 // nsIDOMMozIccManager

 NS_IMETHODIMP
-IccManager::GetIccIds(JS::Value* aIccIds)
+IccManager::GetIccIds(JS::MutableHandle<JS::Value> aIccIds)
 {
  if (!mJsIccIds) {
    nsTArray<nsString> iccIds;
@ -154,7 +154,7 @@ IccManager::GetIccIds(JS::Value* aIccIds)
    Root();
  }

-  aIccIds->setObject(*mJsIccIds);
+  aIccIds.setObject(*mJsIccIds);
  return NS_OK;
 }

--- a/dom/indexedDB/IndexedDatabaseManager.cpp
+++ b/dom/indexedDB/IndexedDatabaseManager.cpp
@ -646,7 +646,7 @@ NS_IMPL_QUERY_INTERFACE2(IndexedDatabaseManager, nsIIndexedDatabaseManager,
                                                 nsIObserver)

 NS_IMETHODIMP
-IndexedDatabaseManager::InitWindowless(const jsval& aGlobal, JSContext* aCx)
+IndexedDatabaseManager::InitWindowless(JS::Handle<JS::Value> aGlobal, JSContext* aCx)
 {
  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome(), NS_ERROR_NOT_AVAILABLE);

--- a/dom/ipc/Blob.cpp
+++ b/dom/ipc/Blob.cpp
@ -1053,16 +1053,17 @@ public:
  }

  NS_IMETHOD
-  GetLastModifiedDate(JSContext* cx, JS::Value* aLastModifiedDate) MOZ_OVERRIDE
+  GetLastModifiedDate(JSContext* cx,
+                      JS::MutableHandle<JS::Value> aLastModifiedDate) MOZ_OVERRIDE
  {
    if (IsDateUnknown()) {
-      aLastModifiedDate->setNull();
+      aLastModifiedDate.setNull();
    } else {
      JSObject* date = JS_NewDateObjectMsec(cx, mLastModificationDate);
      if (!date) {
        return NS_ERROR_OUT_OF_MEMORY;
      }
-      aLastModifiedDate->setObject(*date);
+      aLastModifiedDate.setObject(*date);
    }
    return NS_OK;
  }
--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@ -131,6 +131,15 @@ parent:
     */
    NotifyIMETextChange(uint32_t offset, uint32_t end, uint32_t newEnd);

+    /**
+     * Notifies chrome that there is a IME compostion rect updated
+     *
+     *  offset       The starting offset of this rect
+     *  rect         The rect of first character of selected IME composition
+     *  caretRect    The rect of IME caret
+     */
+    NotifyIMESelectedCompositionRect(uint32_t offset, nsIntRect rect, nsIntRect caretRect);
+
    /**
     * Notifies chrome that there has been a change in selection
     * Only called when NotifyIMEFocus returns PR_TRUE for mWantUpdates
@ -227,9 +236,12 @@ parent:
     * Create a layout frame (encapsulating a remote layer tree) for
     * the page that is currently loaded in the <browser>.
     */
-    sync PRenderFrame()
+    sync PRenderFrame();
+
+    sync InitRenderFrame(PRenderFrame aFrame)
        returns (ScrollingBehavior scrolling,
-                 TextureFactoryIdentifier textureFactoryIdentifier, uint64_t layersId);
+                 TextureFactoryIdentifier textureFactoryIdentifier, uint64_t layersId,
+                 bool success);

    /** 
     * Starts an offline application cache update.
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@ -2195,9 +2195,7 @@ TabChild::RecvSetUpdateHitRegion(const bool& aEnabled)
 }

 PRenderFrameChild*
-TabChild::AllocPRenderFrameChild(ScrollingBehavior* aScrolling,
-                            TextureFactoryIdentifier* aTextureFactoryIdentifier,
-                            uint64_t* aLayersId)
+TabChild::AllocPRenderFrameChild()
 {
    return new RenderFrameChild();
 }
@ -2254,12 +2252,18 @@ TabChild::InitRenderingState()
    static_cast<PuppetWidget*>(mWidget.get())->InitIMEState();

    uint64_t id;
+    bool success;
    RenderFrameChild* remoteFrame =
-        static_cast<RenderFrameChild*>(SendPRenderFrameConstructor(
-                                         &mScrolling, &mTextureFactoryIdentifier, &id));
+        static_cast<RenderFrameChild*>(SendPRenderFrameConstructor());
    if (!remoteFrame) {
-      NS_WARNING("failed to construct RenderFrame");
-      return false;
+        NS_WARNING("failed to construct RenderFrame");
+        return false;
+    }
+    SendInitRenderFrame(remoteFrame, &mScrolling, &mTextureFactoryIdentifier, &id, &success);
+    if (!success) {
+        NS_WARNING("failed to construct RenderFrame");
+        PRenderFrameChild::Send__delete__(remoteFrame);
+        return false;
    }

    PLayerTransactionChild* shadowManager = nullptr;
--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@ -62,12 +62,12 @@ public:
  NS_FORWARD_SAFE_NSIMESSAGELISTENERMANAGER(mMessageManager)
  NS_FORWARD_SAFE_NSIMESSAGESENDER(mMessageManager)
  NS_IMETHOD SendSyncMessage(const nsAString& aMessageName,
-                             const JS::Value& aObject,
-                             const JS::Value& aRemote,
+                             JS::Handle<JS::Value> aObject,
+                             JS::Handle<JS::Value> aRemote,
                             nsIPrincipal* aPrincipal,
                             JSContext* aCx,
                             uint8_t aArgc,
-                             JS::Value* aRetval)
+                             JS::MutableHandle<JS::Value> aRetval)
  {
    return mMessageManager
      ? mMessageManager->SendSyncMessage(aMessageName, aObject, aRemote,
@ -75,12 +75,12 @@ public:
      : NS_ERROR_NULL_POINTER;
  }
  NS_IMETHOD SendRpcMessage(const nsAString& aMessageName,
-                            const JS::Value& aObject,
-                            const JS::Value& aRemote,
+                            JS::Handle<JS::Value> aObject,
+                            JS::Handle<JS::Value> aRemote,
                            nsIPrincipal* aPrincipal,
                            JSContext* aCx,
                            uint8_t aArgc,
-                            JS::Value* aRetval)
+                            JS::MutableHandle<JS::Value> aRetval)
  {
    return mMessageManager
      ? mMessageManager->SendRpcMessage(aMessageName, aObject, aRemote,
@ -367,9 +367,7 @@ public:
    }

 protected:
-    virtual PRenderFrameChild* AllocPRenderFrameChild(ScrollingBehavior* aScrolling,
-                                                      TextureFactoryIdentifier* aTextureFactoryIdentifier,
-                                                      uint64_t* aLayersId) MOZ_OVERRIDE;
+    virtual PRenderFrameChild* AllocPRenderFrameChild() MOZ_OVERRIDE;
    virtual bool DeallocPRenderFrameChild(PRenderFrameChild* aFrame) MOZ_OVERRIDE;
    virtual bool RecvDestroy() MOZ_OVERRIDE;
    virtual bool RecvSetUpdateHitRegion(const bool& aEnabled) MOZ_OVERRIDE;
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@ -207,6 +207,7 @@ TabParent::TabParent(ContentParent* aManager, const TabContext& aContext, uint32
  , mIMECompositionEnding(false)
  , mIMECompositionStart(0)
  , mIMESeqno(0)
+  , mIMECompositionRectOffset(0)
  , mEventCaptureDepth(0)
  , mRect(0, 0, 0, 0)
  , mDimensions(0, 0)
@ -996,6 +997,24 @@ TabParent::RecvNotifyIMETextChange(const uint32_t& aStart,
  return true;
 }

+bool
+TabParent::RecvNotifyIMESelectedCompositionRect(const uint32_t& aOffset,
+                                                const nsIntRect& aRect,
+                                                const nsIntRect& aCaretRect)
+{
+  // add rect to cache for another query
+  mIMECompositionRectOffset = aOffset;
+  mIMECompositionRect = aRect;
+  mIMECaretRect = aCaretRect;
+
+  nsCOMPtr<nsIWidget> widget = GetWidget();
+  if (!widget) {
+    return true;
+  }
+  widget->NotifyIME(NOTIFY_IME_OF_COMPOSITION_UPDATE);
+  return true;
+}
+
 bool
 TabParent::RecvNotifyIMESelection(const uint32_t& aSeqno,
                                  const uint32_t& aAnchor,
@ -1043,6 +1062,35 @@ TabParent::RecvRequestFocus(const bool& aCanRaise)
  return true;
 }

+nsIntPoint
+TabParent::GetChildProcessOffset()
+{
+  // The "toplevel widget" in child processes is always at position
+  // 0,0.  Map the event coordinates to match that.
+
+  nsIntPoint offset(0, 0);
+  nsRefPtr<nsFrameLoader> frameLoader = GetFrameLoader();
+  if (!frameLoader) {
+    return offset;
+  }
+  nsIFrame* targetFrame = frameLoader->GetPrimaryFrameOfOwningContent();
+  if (!targetFrame) {
+    return offset;
+  }
+
+  // Find out how far we're offset from the nearest widget.
+  nsCOMPtr<nsIWidget> widget = GetWidget();
+  if (!widget) {
+    return offset;
+  }
+  nsPoint pt = nsLayoutUtils::GetEventCoordinatesRelativeTo(widget,
+                                                            nsIntPoint(0, 0),
+                                                            targetFrame);
+
+  return LayoutDeviceIntPoint::ToUntyped(LayoutDeviceIntPoint::FromAppUnitsToNearest(
+           pt, targetFrame->PresContext()->AppUnitsPerDevPixel()));
+}
+
 /**
 * Try to answer query event using cached text.
 *
@ -1056,6 +1104,11 @@ TabParent::RecvRequestFocus(const bool& aCanRaise)
 *  have out-of-bounds offsets, so that widget can request content without
 *  knowing the exact length of text. It's up to widget to handle cases when
 *  the returned offset/length are different from the queried offset/length.
+ *
+ * For NS_QUERY_TEXT_RECT, fail if cached offset/length aren't equals to input.
+ *   Cocoa widget always queries selected offset, so it works on it.
+ *
+ * For NS_QUERY_CARET_RECT, fail if cached offset isn't equals to input
 */
 bool
 TabParent::HandleQueryContentEvent(WidgetQueryContentEvent& aEvent)
@ -1106,6 +1159,29 @@ TabParent::HandleQueryContentEvent(WidgetQueryContentEvent& aEvent)
      aEvent.mSucceeded = true;
    }
    break;
+  case NS_QUERY_TEXT_RECT:
+    {
+      if (aEvent.mInput.mOffset != mIMECompositionRectOffset ||
+          aEvent.mInput.mLength != 1) {
+        break;
+      }
+
+      aEvent.mReply.mOffset = mIMECompositionRectOffset;
+      aEvent.mReply.mRect = mIMECompositionRect - GetChildProcessOffset();
+      aEvent.mSucceeded = true;
+    }
+    break;
+  case NS_QUERY_CARET_RECT:
+    {
+      if (aEvent.mInput.mOffset != mIMECompositionRectOffset) {
+        break;
+      }
+
+      aEvent.mReply.mOffset = mIMECompositionRectOffset;
+      aEvent.mReply.mRect = mIMECaretRect - GetChildProcessOffset();
+      aEvent.mSucceeded = true;
+    }
+    break;
  }
  return true;
 }
@ -1529,23 +1605,36 @@ TabParent::HandleDelayedDialogs()
  }
 }

-PRenderFrameParent*
-TabParent::AllocPRenderFrameParent(ScrollingBehavior* aScrolling,
-                                   TextureFactoryIdentifier* aTextureFactoryIdentifier,
-                                   uint64_t* aLayersId)
+bool
+TabParent::RecvInitRenderFrame(PRenderFrameParent* aFrame,
+                               ScrollingBehavior* aScrolling,
+                               TextureFactoryIdentifier* aTextureFactoryIdentifier,
+                               uint64_t* aLayersId,
+                               bool *aSuccess)
 {
-  MOZ_ASSERT(ManagedPRenderFrameParent().IsEmpty());
+  *aScrolling = UseAsyncPanZoom() ? ASYNC_PAN_ZOOM : DEFAULT_SCROLLING;
+  *aTextureFactoryIdentifier = TextureFactoryIdentifier();
+  *aLayersId = 0;

  nsRefPtr<nsFrameLoader> frameLoader = GetFrameLoader();
  if (!frameLoader) {
-    NS_WARNING("Can't allocate graphics resources, aborting subprocess");
-    return nullptr;
+    NS_WARNING("Can't allocate graphics resources. May already be shutting down.");
+    *aSuccess = false;
+    return true;
  }

-  *aScrolling = UseAsyncPanZoom() ? ASYNC_PAN_ZOOM : DEFAULT_SCROLLING;
-  return new RenderFrameParent(frameLoader,
-                               *aScrolling,
-                               aTextureFactoryIdentifier, aLayersId);
+  static_cast<RenderFrameParent*>(aFrame)->Init(frameLoader, *aScrolling,
+                                                aTextureFactoryIdentifier, aLayersId);
+
+  *aSuccess = true;
+  return true;
+}
+
+PRenderFrameParent*
+TabParent::AllocPRenderFrameParent()
+{
+  MOZ_ASSERT(ManagedPRenderFrameParent().IsEmpty());
+  return new RenderFrameParent();
 }

 bool
@ -1696,10 +1785,7 @@ TabParent::RecvBrowserFrameOpenWindow(PBrowserParent* aOpener,
 }

 bool
-TabParent::RecvPRenderFrameConstructor(PRenderFrameParent* actor,
-                                       ScrollingBehavior* scrolling,
-                                       TextureFactoryIdentifier* factoryIdentifier,
-                                       uint64_t* layersId)
+TabParent::RecvPRenderFrameConstructor(PRenderFrameParent* actor)
 {
  return true;
 }
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@ -112,10 +112,12 @@ public:

    virtual bool RecvMoveFocus(const bool& aForward);
    virtual bool RecvEvent(const RemoteDOMEvent& aEvent);
-    virtual bool RecvPRenderFrameConstructor(PRenderFrameParent* actor,
-                                             ScrollingBehavior* scrolling,
-                                             TextureFactoryIdentifier* identifier,
-                                             uint64_t* layersId);
+    virtual bool RecvPRenderFrameConstructor(PRenderFrameParent* actor);
+    virtual bool RecvInitRenderFrame(PRenderFrameParent* aFrame,
+                                     ScrollingBehavior* scrolling,
+                                     TextureFactoryIdentifier* identifier,
+                                     uint64_t* layersId,
+                                     bool *aSuccess);
    virtual bool RecvBrowserFrameOpenWindow(PBrowserParent* aOpener,
                                            const nsString& aURL,
                                            const nsString& aName,
@ -142,6 +144,9 @@ public:
    virtual bool RecvNotifyIMETextChange(const uint32_t& aStart,
                                         const uint32_t& aEnd,
                                         const uint32_t& aNewEnd);
+    virtual bool RecvNotifyIMESelectedCompositionRect(const uint32_t& aOffset,
+                                                      const nsIntRect& aRect,
+                                                      const nsIntRect& aCaretRect) MOZ_OVERRIDE;
    virtual bool RecvNotifyIMESelection(const uint32_t& aSeqno,
                                        const uint32_t& aAnchor,
                                        const uint32_t& aFocus);
@ -311,10 +316,9 @@ protected:

    bool ShouldDelayDialogs();
    bool AllowContentIME();
+    nsIntPoint GetChildProcessOffset();

-    virtual PRenderFrameParent* AllocPRenderFrameParent(ScrollingBehavior* aScrolling,
-                                                        TextureFactoryIdentifier* aTextureFactoryIdentifier,
-                                                        uint64_t* aLayersId) MOZ_OVERRIDE;
+    virtual PRenderFrameParent* AllocPRenderFrameParent() MOZ_OVERRIDE;
    virtual bool DeallocPRenderFrameParent(PRenderFrameParent* aFrame) MOZ_OVERRIDE;

    // IME
@ -330,6 +334,10 @@ protected:
    uint32_t mIMECompositionStart;
    uint32_t mIMESeqno;

+    uint32_t mIMECompositionRectOffset;
+    nsIntRect mIMECompositionRect;
+    nsIntRect mIMECaretRect;
+
    // The number of event series we're currently capturing.
    int32_t mEventCaptureDepth;

--- a/dom/media/PeerConnection.js
+++ b/dom/media/PeerConnection.js
@ -171,14 +171,17 @@ WebrtcGlobalInformation.prototype = {
    }
  },

-  getCandPairLogs: function(candPairId, callback, errorCallback) {
-    let pattern = 'CAND-PAIR(' + candPairId + ')';
+  getLogs: function(pattern, callback, errorCallback) {
    if (_globalPCList) {
      _globalPCList.getLoggingFromFirstPC(pattern, callback, errorCallback);
    } else {
      errorCallback("No global PeerConnection list");
    }
  },
+
+  getCandPairLogs: function(candPairId, callback, errorCallback) {
+    this.getLogs('CAND-PAIR(' + candPairId + ')', callback, errorCallback);
+  },
 };

 function RTCIceCandidate() {
--- a/dom/mobilemessage/src/MmsMessage.cpp
+++ b/dom/mobilemessage/src/MmsMessage.cpp
@ -471,14 +471,14 @@ MmsMessage::GetDelivery(nsAString& aDelivery)
 }

 NS_IMETHODIMP
-MmsMessage::GetDeliveryInfo(JSContext* aCx, JS::Value* aDeliveryInfo)
+MmsMessage::GetDeliveryInfo(JSContext* aCx, JS::MutableHandle<JS::Value> aDeliveryInfo)
 {
  // TODO Bug 850525 It'd be better to depend on the delivery of MmsMessage
  // to return a more correct value. Ex, if .delivery = 'received', we should
  // also make .deliveryInfo = null, since the .deliveryInfo is useless.
  uint32_t length = mDeliveryInfo.Length();
  if (length == 0) {
-    *aDeliveryInfo = JSVAL_NULL;
+    aDeliveryInfo.setNull();
    return NS_OK;
  }

@ -552,7 +552,7 @@ MmsMessage::GetDeliveryInfo(JSContext* aCx, JS::Value* aDeliveryInfo)
    }
  }

-  aDeliveryInfo->setObject(*deliveryInfo);
+  aDeliveryInfo.setObject(*deliveryInfo);
  return NS_OK;
 }

@ -564,13 +564,13 @@ MmsMessage::GetSender(nsAString& aSender)
 }

 NS_IMETHODIMP
-MmsMessage::GetReceivers(JSContext* aCx, JS::Value* aReceivers)
+MmsMessage::GetReceivers(JSContext* aCx, JS::MutableHandle<JS::Value> aReceivers)
 {
  JS::Rooted<JSObject*> reveiversObj(aCx);
  nsresult rv = nsTArrayToJSArray(aCx, mReceivers, reveiversObj.address());
  NS_ENSURE_SUCCESS(rv, rv);

-  aReceivers->setObject(*reveiversObj);
+  aReceivers.setObject(*reveiversObj);
  return NS_OK;
 }

@ -610,7 +610,7 @@ MmsMessage::GetSmil(nsAString& aSmil)
 }

 NS_IMETHODIMP
-MmsMessage::GetAttachments(JSContext* aCx, JS::Value* aAttachments)
+MmsMessage::GetAttachments(JSContext* aCx, JS::MutableHandle<JS::Value> aAttachments)
 {
  uint32_t length = mAttachments.Length();

@ -672,7 +672,7 @@ MmsMessage::GetAttachments(JSContext* aCx, JS::Value* aAttachments)
    }
  }

-  aAttachments->setObject(*attachments);
+  aAttachments.setObject(*attachments);
  return NS_OK;
 }

--- a/dom/mobilemessage/src/MobileMessageManager.cpp
+++ b/dom/mobilemessage/src/MobileMessageManager.cpp
@ -163,14 +163,13 @@ MobileMessageManager::Send(JSContext* aCx, JS::Handle<JSObject*> aGlobal,
 }

 NS_IMETHODIMP
-MobileMessageManager::Send(const JS::Value& aNumber_,
+MobileMessageManager::Send(JS::Handle<JS::Value> aNumber,
                           const nsAString& aMessage,
-                           const JS::Value& aSendParams,
+                           JS::Handle<JS::Value> aSendParams,
                           JSContext* aCx,
                           uint8_t aArgc,
-                           JS::Value* aReturn)
+                           JS::MutableHandle<JS::Value> aReturn)
 {
-  JS::Rooted<JS::Value> aNumber(aCx, aNumber_);
  if (!aNumber.isString() &&
      !(aNumber.isObject() && JS_IsArrayObject(aCx, &aNumber.toObject()))) {
    return NS_ERROR_INVALID_ARG;
@ -210,7 +209,7 @@ MobileMessageManager::Send(const JS::Value& aNumber_,

  if (aNumber.isString()) {
    JS::Rooted<JSString*> str(aCx, aNumber.toString());
-    return Send(aCx, global, serviceId, str, aMessage, aReturn);
+    return Send(aCx, global, serviceId, str, aMessage, aReturn.address());
  }

  // Must be an array then.
@ -248,13 +247,13 @@ MobileMessageManager::Send(const JS::Value& aNumber_,
    return NS_ERROR_FAILURE;
  }

-  aReturn->setObject(*obj);
+  aReturn.setObject(*obj);
  return NS_OK;
 }

 NS_IMETHODIMP
-MobileMessageManager::SendMMS(const JS::Value& aParams,
-                              const JS::Value& aSendParams,
+MobileMessageManager::SendMMS(JS::Handle<JS::Value> aParams,
+                              JS::Handle<JS::Value> aSendParams,
                              JSContext* aCx,
                              uint8_t aArgc,
                              nsIDOMDOMRequest** aRequest)
@ -323,7 +322,7 @@ MobileMessageManager::GetMessageId(JSContext* aCx,
 }

 NS_IMETHODIMP
-MobileMessageManager::Delete(const JS::Value& aParam, JSContext* aCx,
+MobileMessageManager::Delete(JS::Handle<JS::Value> aParam, JSContext* aCx,
                             nsIDOMDOMRequest** aRequest)
 {
  // We expect Int32, SmsMessage, MmsMessage, Int32[], SmsMessage[], MmsMessage[]
--- a/dom/mobilemessage/src/MobileMessageService.cpp
+++ b/dom/mobilemessage/src/MobileMessageService.cpp
@ -38,9 +38,9 @@ MobileMessageService::CreateSmsMessage(int32_t aId,
                                       const nsAString& aReceiver,
                                       const nsAString& aBody,
                                       const nsAString& aMessageClass,
-                                       const JS::Value& aTimestamp,
-                                       const JS::Value& aSentTimestamp,
-                                       const JS::Value& aDeliveryTimestamp,
+                                       JS::Handle<JS::Value> aTimestamp,
+                                       JS::Handle<JS::Value> aSentTimestamp,
+                                       JS::Handle<JS::Value> aDeliveryTimestamp,
                                       const bool aRead,
                                       JSContext* aCx,
                                       nsIDOMMozSmsMessage** aMessage)
@ -67,16 +67,16 @@ MobileMessageService::CreateMmsMessage(int32_t               aId,
                                       uint64_t              aThreadId,
                                       const nsAString&      aIccId,
                                       const nsAString&      aDelivery,
-                                       const JS::Value&      aDeliveryInfo,
+                                       JS::Handle<JS::Value> aDeliveryInfo,
                                       const nsAString&      aSender,
-                                       const JS::Value&      aReceivers,
-                                       const JS::Value&      aTimestamp,
-                                       const JS::Value&      aSentTimestamp,
+                                       JS::Handle<JS::Value> aReceivers,
+                                       JS::Handle<JS::Value> aTimestamp,
+                                       JS::Handle<JS::Value> aSentTimestamp,
                                       bool                  aRead,
                                       const nsAString&      aSubject,
                                       const nsAString&      aSmil,
-                                       const JS::Value&      aAttachments,
-                                       const JS::Value&      aExpiryDate,
+                                       JS::Handle<JS::Value> aAttachments,
+                                       JS::Handle<JS::Value> aExpiryDate,
                                       bool                  aReadReportRequested,
                                       JSContext*            aCx,
                                       nsIDOMMozMmsMessage** aMessage)
@ -114,8 +114,8 @@ MobileMessageService::CreateSmsSegmentInfo(int32_t aSegments,

 NS_IMETHODIMP
 MobileMessageService::CreateThread(uint64_t aId,
-                                   const JS::Value& aParticipants,
-                                   const JS::Value& aTimestamp,
+                                   JS::Handle<JS::Value> aParticipants,
+                                   JS::Handle<JS::Value> aTimestamp,
                                   const nsAString& aLastMessageSubject,
                                   const nsAString& aBody,
                                   uint64_t aUnreadCount,
--- a/dom/mobilemessage/src/MobileMessageThread.cpp
+++ b/dom/mobilemessage/src/MobileMessageThread.cpp
@ -162,14 +162,14 @@ MobileMessageThread::GetUnreadCount(uint64_t* aUnreadCount)

 NS_IMETHODIMP
 MobileMessageThread::GetParticipants(JSContext* aCx,
-                                     JS::Value* aParticipants)
+                                     JS::MutableHandle<JS::Value> aParticipants)
 {
  JS::Rooted<JSObject*> obj(aCx);

  nsresult rv = nsTArrayToJSArray(aCx, mData.participants(), obj.address());
  NS_ENSURE_SUCCESS(rv, rv);

-  aParticipants->setObject(*obj);
+  aParticipants.setObject(*obj);
  return NS_OK;
 }

--- a/Показать больше
+++ b/Показать больше