Merge m-c to inbound.

2012-12-22 14:42:37 +01:00 · 2012-12-22 14:42:37 +01:00 · 1fb4804f99
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@ -333,7 +333,7 @@ pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
 // If an urlclassifier table has not been updated in this number of seconds,
 // a gethash request will be forced to check that the result is still in
 // the database.
-pref("urlclassifier.confirm-age", 2700);
+pref("urlclassifier.max-complete-age", 2700);

 // URL for checking the reason for a malware warning.
 pref("browser.safebrowsing.malware.reportURL", "http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@ -741,7 +741,7 @@ pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
 // If an urlclassifier table has not been updated in this number of seconds,
 // a gethash request will be forced to check that the result is still in
 // the database.
-pref("urlclassifier.confirm-age", 2700);
+pref("urlclassifier.max-complete-age", 2700);
 #endif

 pref("browser.geolocation.warning.infoURL", "http://www.mozilla.com/%LOCALE%/firefox/geolocation/");
--- a/build/Makefile.in
+++ b/build/Makefile.in
@ -45,10 +45,8 @@ endif
 endif

 ifdef LIBXUL_SDK
-GRE_MILESTONE = $(shell $(PYTHON) $(topsrcdir)/config/printconfigsetting.py $(LIBXUL_DIST)/bin/platform.ini Build Milestone)
 APP_INI_DEPS = $(LIBXUL_DIST)/bin/platform.ini
 else
-GRE_MILESTONE = $(shell tail -n 1 $(topsrcdir)/config/milestone.txt 2>/dev/null || tail -1 $(topsrcdir)/config/milestone.txt)
 APP_INI_DEPS = $(topsrcdir)/config/milestone.txt
 endif

--- a/config/rules.mk
+++ b/config/rules.mk
@ -1203,6 +1203,12 @@ PP_TARGETS += PREF_JS_EXPORTS
 endif
 endif

+# Set a flag that can be used in pref files to disable features if
+# we are not building for Aurora or Nightly.
+ifeq (,$(findstring a,$(GRE_MILESTONE)))
+PREF_PPFLAGS += -DRELEASE_BUILD
+endif
+
 ################################################################################
 # Copy each element of AUTOCFG_JS_EXPORTS to $(FINAL_TARGET)/defaults/autoconfig

--- a/configure.in
+++ b/configure.in
@ -3946,6 +3946,15 @@ else
    fi
 fi

+dnl set GRE_MILESTONE
+dnl ========================================================
+if test -n "$LIBXUL_SDK"; then
+    GRE_MILESTONE=`$PYTHON "$_topsrcdir"/config/printconfigsetting.py "$LIBXUL_DIST"/bin/platform.ini Build Milestone`
+else
+    GRE_MILESTONE=`tail -n 1 "$_topsrcdir"/config/milestone.txt 2>/dev/null || tail -1 "$_topsrcdir"/config/milestone.txt`
+fi
+AC_SUBST(GRE_MILESTONE)
+
 dnl system libevent Support
 dnl ========================================================
 MOZ_ARG_WITH_STRING(system-libevent,
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@ -354,10 +354,10 @@ public:
  /**
   * Checks whether two nodes come from the same origin.
   */
-  static nsresult CheckSameOrigin(nsINode* aTrustedNode,
+  static nsresult CheckSameOrigin(const nsINode* aTrustedNode,
                                  nsIDOMNode* aUnTrustedNode);
-  static nsresult CheckSameOrigin(nsINode* aTrustedNode,
-                                  nsINode* unTrustedNode);
+  static nsresult CheckSameOrigin(const nsINode* aTrustedNode,
+                                  const nsINode* unTrustedNode);

  // Check if the (JS) caller can access aNode.
  static bool CanCallerAccess(nsIDOMNode *aNode);
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@ -45,9 +45,15 @@ class nsIDocumentObserver;
 class nsIDOMDocument;
 class nsIDOMDocumentFragment;
 class nsIDOMDocumentType;
+class nsDOMDocumentType;
+class nsXMLProcessingInstruction;
 class nsIDOMElement;
 class nsIDOMEventTarget;
 class nsIDOMNodeList;
+class nsIDOMTouch;
+class nsIDOMTouchList;
+class nsIDOMXPathExpression;
+class nsIDOMXPathNSResolver;
 class nsILayoutHistoryState;
 class nsIObjectLoadingContent;
 class nsIObserver;
@ -61,27 +67,35 @@ class nsIURI;
 class nsIVariant;
 class nsIViewManager;
 class nsPresContext;
+class nsRange;
 class nsScriptLoader;
 class nsSMILAnimationController;
 class nsStyleSet;
+class nsTextNode;
 class nsWindowSizes;
 class nsSmallVoidArray;

 namespace mozilla {
+class ErrorResult;
+
 namespace css {
 class Loader;
 class ImageLoader;
 } // namespace css

 namespace dom {
-class Link;
+class Comment;
+class DocumentFragment;
+class DOMImplementation;
 class Element;
+class Link;
+template<typename> class Sequence;
 } // namespace dom
 } // namespace mozilla

 #define NS_IDOCUMENT_IID \
-{ 0x1517f31a, 0x0ef9, 0x4629, \
- { 0xb4, 0x7f, 0x56, 0x31, 0x0d, 0x80, 0x61, 0xaf } }
+{ 0xff03d72f, 0x87cd, 0x4d11, \
+ { 0x81, 0x8d, 0xa8, 0xb4, 0xf5, 0x98, 0x1a, 0x10 } }

 // Flag for AddStyleSheet().
 #define NS_STYLESHEET_FROM_CATALOG                (1 << 0)
@ -100,6 +114,13 @@ enum DocumentFlavor {
 // Window activation status
 #define NS_DOCUMENT_STATE_WINDOW_INACTIVE         NS_DEFINE_EVENT_STATE_MACRO(1)

+// Some function forward-declarations
+class nsContentList;
+
+already_AddRefed<nsContentList>
+NS_GetContentList(nsINode* aRootNode,
+                  int32_t aMatchNameSpaceId,
+                  const nsAString& aTagname);
 //----------------------------------------------------------------------

 // Document interface.  This is implemented by all document objects in
@ -531,7 +552,7 @@ public:
  /**
   * Return the doctype for this document.
   */
-  nsIContent* GetDocumentType() const;
+  nsDOMDocumentType* GetDoctype() const;

  /**
   * Return the root element for this document.
@ -714,7 +735,7 @@ public:
   * document is truly gone. Use this object when you're trying to find a
   * content wrapper in XPConnect.
   */
-  virtual nsIScriptGlobalObject* GetScopeObject() = 0;
+  virtual nsIScriptGlobalObject* GetScopeObject() const = 0;

  /**
   * Return the window containing the document (the outer window).
@ -870,7 +891,10 @@ public:

  enum ReadyState { READYSTATE_UNINITIALIZED = 0, READYSTATE_LOADING = 1, READYSTATE_INTERACTIVE = 3, READYSTATE_COMPLETE = 4};
  virtual void SetReadyStateInternal(ReadyState rs) = 0;
-  virtual ReadyState GetReadyStateEnum() = 0;
+  ReadyState GetReadyStateEnum()
+  {
+    return mReadyState;
+  }

  // notify that a content node changed state.  This must happen under
  // a scriptblocker but NOT within a begin/end update.
@ -1204,7 +1228,7 @@ public:
  /**
   * See GetAnonymousElementByAttribute on nsIDOMDocumentXBL.
   */
-  virtual nsIContent*
+  virtual Element*
    GetAnonymousElementByAttribute(nsIContent* aElement,
                                   nsIAtom* aAttrName,
                                   const nsAString& aAttrValue) const = 0;
@ -1215,10 +1239,9 @@ public:
   *
   * @see nsIDOMWindowUtils::elementFromPoint
   */
-  virtual nsresult ElementFromPointHelper(float aX, float aY,
+  virtual Element* ElementFromPointHelper(float aX, float aY,
                                          bool aIgnoreRootScrollFrame,
-                                          bool aFlushLayout,
-                                          nsIDOMElement** aReturn) = 0;
+                                          bool aFlushLayout) = 0;

  virtual nsresult NodesFromRectHelper(float aX, float aY,
                                       float aTopSize, float aRightSize,
@ -1702,7 +1725,7 @@ public:

  virtual void PostVisibilityUpdateEvent() = 0;
  
-  bool IsSyntheticDocument() { return mIsSyntheticDocument; }
+  bool IsSyntheticDocument() const { return mIsSyntheticDocument; }

  void SetNeedLayoutFlush() {
    mNeedLayoutFlush = true;
@ -1757,6 +1780,164 @@ public:
    return mCreatingStaticClone;
  }

+  // WebIDL API
+  nsIScriptGlobalObject* GetParentObject() const
+  {
+    return GetScopeObject();
+  }
+  static already_AddRefed<nsIDocument> Constructor(nsISupports* aGlobal,
+                                                   mozilla::ErrorResult& rv);
+  virtual mozilla::dom::DOMImplementation*
+    GetImplementation(mozilla::ErrorResult& rv) = 0;
+  void GetURL(nsString& retval) const;
+  void GetDocumentURI(nsString& retval) const;
+  void GetCompatMode(nsString& retval) const;
+  void GetCharacterSet(nsAString& retval) const;
+  // Skip GetContentType, because our NS_IMETHOD version above works fine here.
+  // GetDoctype defined above
+  Element* GetDocumentElement() const
+  {
+    return GetRootElement();
+  }
+  already_AddRefed<nsContentList>
+  GetElementsByTagName(const nsAString& aTagName)
+  {
+    return NS_GetContentList(this, kNameSpaceID_Unknown, aTagName);
+  }
+  already_AddRefed<nsContentList>
+    GetElementsByTagNameNS(const nsAString& aNamespaceURI,
+                           const nsAString& aLocalName);
+  already_AddRefed<nsContentList>
+    GetElementsByClassName(const nsAString& aClasses);
+  // GetElementById defined above
+  already_AddRefed<Element> CreateElement(const nsAString& aTagName,
+                                          mozilla::ErrorResult& rv);
+  already_AddRefed<Element> CreateElementNS(const nsAString& aNamespaceURI,
+                                            const nsAString& aQualifiedName,
+                                            mozilla::ErrorResult& rv);
+  already_AddRefed<mozilla::dom::DocumentFragment>
+    CreateDocumentFragment(mozilla::ErrorResult& rv) const;
+  already_AddRefed<nsTextNode> CreateTextNode(const nsAString& aData,
+                                              mozilla::ErrorResult& rv) const;
+  already_AddRefed<mozilla::dom::Comment>
+    CreateComment(const nsAString& aData, mozilla::ErrorResult& rv) const;
+  already_AddRefed<nsXMLProcessingInstruction>
+    CreateProcessingInstruction(const nsAString& target, const nsAString& data,
+                                mozilla::ErrorResult& rv) const;
+  already_AddRefed<nsINode>
+    ImportNode(nsINode& aNode, bool aDeep, mozilla::ErrorResult& rv) const;
+  nsINode* AdoptNode(nsINode& aNode, mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMEvent> CreateEvent(const nsAString& aEventType,
+                                            mozilla::ErrorResult& rv) const;
+  already_AddRefed<nsRange> CreateRange(mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMNodeIterator>
+    CreateNodeIterator(nsINode& aRoot, uint32_t aWhatToShow,
+                       nsIDOMNodeFilter* aFilter, mozilla::ErrorResult& rv) const;
+  already_AddRefed<nsIDOMTreeWalker>
+    CreateTreeWalker(nsINode& aRoot, uint32_t aWhatToShow,
+                     nsIDOMNodeFilter* aFilter, mozilla::ErrorResult& rv) const;
+
+  // Deprecated WebIDL bits
+  already_AddRefed<nsIDOMCDATASection>
+    CreateCDATASection(const nsAString& aData, mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMAttr>
+    CreateAttribute(const nsAString& aName, mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMAttr>
+    CreateAttributeNS(const nsAString& aNamespaceURI,
+                      const nsAString& aQualifiedName,
+                      mozilla::ErrorResult& rv);
+  void GetInputEncoding(nsAString& aInputEncoding);
+  already_AddRefed<nsIDOMLocation> GetLocation() const;
+  void GetReferrer(nsAString& aReferrer) const;
+  void GetLastModified(nsAString& aLastModified) const;
+  void GetReadyState(nsAString& aReadyState) const;
+  // Not const because otherwise the compiler can't figure out whether to call
+  // this GetTitle or the nsAString version from non-const methods, since
+  // neither is an exact match.
+  virtual void GetTitle(nsString& aTitle) = 0;
+  virtual void SetTitle(const nsAString& aTitle, mozilla::ErrorResult& rv) = 0;
+  void GetDir(nsAString& aDirection) const;
+  void SetDir(const nsAString& aDirection, mozilla::ErrorResult& rv);
+  nsIDOMWindow* GetDefaultView() const
+  {
+    return GetWindow();
+  }
+  Element* GetActiveElement();
+  bool HasFocus(mozilla::ErrorResult& rv) const;
+  // Event handlers are all on nsINode already
+  bool MozSyntheticDocument() const
+  {
+    return IsSyntheticDocument();
+  }
+  Element* GetCurrentScript();
+  void ReleaseCapture() const;
+  virtual void MozSetImageElement(const nsAString& aImageElementId,
+                                  Element* aElement) = 0;
+  // Not const because all the full-screen goop is not const
+  virtual bool MozFullScreenEnabled() = 0;
+  virtual Element* GetMozFullScreenElement(mozilla::ErrorResult& rv) = 0;
+  bool MozFullScreen()
+  {
+    return IsFullScreenDoc();
+  }
+  void MozCancelFullScreen();
+  Element* GetMozPointerLockElement();
+  void MozExitPointerLock()
+  {
+    UnlockPointer();
+  }
+  bool Hidden() const
+  {
+    return mVisibilityState != eVisible;
+  }
+  bool MozHidden() // Not const because of WarnOnceAbout
+  {
+    WarnOnceAbout(ePrefixedVisibilityAPI);
+    return Hidden();
+  }
+  void GetVisibilityState(nsAString& aState);
+  void GetMozVisibilityState(nsAString& aState);
+  virtual nsIDOMStyleSheetList* StyleSheets() = 0;
+  void GetSelectedStyleSheetSet(nsAString& aSheetSet);
+  virtual void SetSelectedStyleSheetSet(const nsAString& aSheetSet) = 0;
+  virtual void GetLastStyleSheetSet(nsString& aSheetSet) = 0;
+  void GetPreferredStyleSheetSet(nsAString& aSheetSet);
+  virtual nsIDOMDOMStringList* StyleSheetSets() = 0;
+  virtual void EnableStyleSheetsForSet(const nsAString& aSheetSet) = 0;
+  Element* ElementFromPoint(float aX, float aY);
+  // QuerySelector and QuerySelectorAll already defined on nsINode
+  nsINodeList* GetAnonymousNodes(Element& aElement);
+  Element* GetAnonymousElementByAttribute(Element& aElement,
+                                          const nsAString& aAttrName,
+                                          const nsAString& aAttrValue);
+  void AddBinding(Element& aElement, const nsAString& aURI,
+                  mozilla::ErrorResult& rv);
+  void RemoveBinding(Element& aElement, const nsAString& aURI,
+                     mozilla::ErrorResult& rv);
+  Element* GetBindingParent(nsINode& aNode);
+  void LoadBindingDocument(const nsAString& aURI, mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMXPathExpression>
+    CreateExpression(const nsAString& aExpression,
+                     nsIDOMXPathNSResolver* aResolver,
+                     mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMXPathNSResolver>
+    CreateNSResolver(nsINode* aNodeResolver, mozilla::ErrorResult& rv);
+  already_AddRefed<nsISupports>
+    Evaluate(const nsAString& aExpression, nsINode* aContextNode,
+             nsIDOMXPathNSResolver* aResolver, uint16_t aType,
+             nsISupports* aResult, mozilla::ErrorResult& rv);
+  // Touch event handlers already on nsINode
+  already_AddRefed<nsIDOMTouch>
+    CreateTouch(nsIDOMWindow* aView, nsISupports* aTarget,
+                int32_t aIdentifier, int32_t aPageX, int32_t aPageY,
+                int32_t aScreenX, int32_t aScreenY, int32_t aClientX,
+                int32_t aClientY, int32_t aRadiusX, int32_t aRadiusY,
+                float aRotationAngle, float aForce);
+  already_AddRefed<nsIDOMTouchList>
+    CreateTouchList(nsIDOMTouch* aTouch);
+  already_AddRefed<nsIDOMTouchList>
+    CreateTouchList(const mozilla::dom::Sequence<nsRefPtr<nsIDOMTouch> >& aTouches);
+
 private:
  uint64_t mWarnedAbout;

@ -1801,6 +1982,23 @@ protected:
    return mContentType;
  }

+  inline void
+  SetDocumentDirectionality(mozilla::Directionality aDir)
+  {
+    mDirectionality = aDir;
+  }
+
+  // This needs to stay in sync with the list in GetVisibilityState.
+  // XXXbz visibilityState needs to be an IDL enum.
+  enum VisibilityState {
+    eHidden = 0,
+    eVisible,
+    eVisibilityStateCount
+  };
+
+  nsCString mReferrer;
+  nsString mLastModified;
+
  nsCOMPtr<nsIURI> mDocumentURI;
  nsCOMPtr<nsIURI> mOriginalURI;
  nsCOMPtr<nsIURI> mDocumentBaseURI;
@ -1845,6 +2043,12 @@ protected:
  // Compatibility mode
  nsCompatibility mCompatMode;

+  // Our readyState
+  ReadyState mReadyState;
+
+  // Our visibility state
+  VisibilityState mVisibilityState;
+
  // True if BIDI is enabled.
  bool mBidiEnabled;
  // True if a MathML element has ever been owned by this document.
@ -1934,6 +2138,10 @@ protected:
  // True if DisallowBFCaching has been called on this document.
  bool mBFCacheDisallowed;

+  // If true, we have an input encoding.  If this is false, then the
+  // document was created entirely in memory
+  bool mHaveInputEncoding;
+
  // The document's script global object, the object from which the
  // document can get its script context and scope. This is the
  // *inner* window object.
--- a/content/base/src/Makefile.in
+++ b/content/base/src/Makefile.in
@ -186,6 +186,7 @@ LOCAL_INCLUDES += \
  -I$(topsrcdir)/caps/include \
  -I$(topsrcdir)/content/events/src \
  -I$(topsrcdir)/content/html/content/src \
+  -I$(topsrcdir)/content/html/document/src \
  -I$(topsrcdir)/content/xbl/src \
  -I$(topsrcdir)/content/xml/content/src \
  -I$(topsrcdir)/content/xml/document/src \
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@ -1506,7 +1506,7 @@ nsContentUtils::Shutdown()
 */
 // static
 nsresult
-nsContentUtils::CheckSameOrigin(nsINode *aTrustedNode,
+nsContentUtils::CheckSameOrigin(const nsINode *aTrustedNode,
                                nsIDOMNode *aUnTrustedNode)
 {
  MOZ_ASSERT(aTrustedNode);
@ -1518,8 +1518,8 @@ nsContentUtils::CheckSameOrigin(nsINode *aTrustedNode,
 }

 nsresult
-nsContentUtils::CheckSameOrigin(nsINode* aTrustedNode,
-                                nsINode* unTrustedNode)
+nsContentUtils::CheckSameOrigin(const nsINode* aTrustedNode,
+                                const nsINode* unTrustedNode)
 {
  MOZ_ASSERT(aTrustedNode);
  MOZ_ASSERT(unTrustedNode);
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@ -63,7 +63,7 @@
 #include "nsISecurityEventSink.h"
 #include "nsIChannelEventSink.h"
 #include "imgIRequest.h"
-#include "nsIDOMDOMImplementation.h"
+#include "mozilla/dom/DOMImplementation.h"
 #include "nsIDOMTouchEvent.h"
 #include "nsIInlineEventHandlers.h"
 #include "nsDataHashtable.h"
@ -477,6 +477,7 @@ class nsDocument : public nsIDocument,
 {
 public:
  typedef mozilla::dom::Element Element;
+  using nsIDocument::GetElementsByTagName;

  NS_DECL_CYCLE_COLLECTING_ISUPPORTS

@ -624,7 +625,7 @@ public:

  virtual void SetScriptHandlingObject(nsIScriptGlobalObject* aScriptObject);

-  virtual nsIScriptGlobalObject* GetScopeObject();
+  virtual nsIScriptGlobalObject* GetScopeObject() const;

  /**
   * Get the script loader for this document
@ -660,7 +661,6 @@ public:
  virtual void EndLoad();

  virtual void SetReadyStateInternal(ReadyState rs);
-  virtual ReadyState GetReadyStateEnum();

  virtual void ContentStateChanged(nsIContent* aContent,
                                   nsEventStates aStateMask);
@ -775,12 +775,6 @@ public:
                              int32_t aNamespaceID,
                              nsIContent **aResult);

-  nsresult CreateElement(const nsAString& aTagName,
-                         nsIContent** aReturn);
-  nsresult CreateElementNS(const nsAString& aNamespaceURI,
-                           const nsAString& aQualifiedName,
-                           nsIContent** aReturn);
-
  nsresult CreateTextNode(const nsAString& aData, nsIContent** aReturn);

  virtual NS_HIDDEN_(nsresult) Sanitize();
@ -806,15 +800,14 @@ public:
                                                   nsIDOMNodeList** aResult);
  virtual NS_HIDDEN_(nsresult) GetContentListFor(nsIContent* aContent,
                                                 nsIDOMNodeList** aResult);
-  virtual NS_HIDDEN_(nsIContent*)
+  virtual NS_HIDDEN_(Element*)
    GetAnonymousElementByAttribute(nsIContent* aElement,
                                   nsIAtom* aAttrName,
                                   const nsAString& aAttrValue) const;

-  virtual NS_HIDDEN_(nsresult) ElementFromPointHelper(float aX, float aY,
+  virtual NS_HIDDEN_(Element*) ElementFromPointHelper(float aX, float aY,
                                                      bool aIgnoreRootScrollFrame,
-                                                      bool aFlushLayout,
-                                                      nsIDOMElement** aReturn);
+                                                      bool aFlushLayout);

  virtual NS_HIDDEN_(nsresult) NodesFromRectHelper(float aX, float aY,
                                                   float aTopSize, float aRightSize,
@ -899,18 +892,12 @@ public:
  virtual void ResetScrolledToRefAlready();
  virtual void SetChangeScrollPosWhenScrollingToRef(bool aValue);

-  already_AddRefed<nsContentList>
-  GetElementsByTagName(const nsAString& aTagName) {
-    return NS_GetContentList(this, kNameSpaceID_Unknown, aTagName);
-  }
-  already_AddRefed<nsContentList>
-    GetElementsByTagNameNS(const nsAString& aNamespaceURI,
-                           const nsAString& aLocalName);
-
  virtual Element *GetElementById(const nsAString& aElementId);
  virtual const nsSmallVoidArray* GetAllElementsForId(const nsAString& aElementId) const;

  virtual Element *LookupImageElement(const nsAString& aElementId);
+  virtual void MozSetImageElement(const nsAString& aImageElementId,
+                                  Element* aElement);

  virtual NS_HIDDEN_(nsresult) AddImage(imgIRequest* aImage);
  virtual NS_HIDDEN_(nsresult) RemoveImage(imgIRequest* aImage, uint32_t aFlags);
@ -990,6 +977,10 @@ public:
  // Returns the top element from the full-screen stack.
  Element* FullScreenStackTop();

+  // DOM-exposed fullscreen API
+  virtual bool MozFullScreenEnabled();
+  virtual Element* GetMozFullScreenElement(mozilla::ErrorResult& rv);
+
  void RequestPointerLock(Element* aElement);
  bool ShouldLockPointer(Element* aElement);
  bool SetPointerLock(Element* aElement, int aCursorStyle);
@ -1005,6 +996,16 @@ public:
  // DocSizeOfIncludingThis is inherited from nsIDocument.

  virtual nsIDOMNode* AsDOMNode() { return this; }
+
+  // WebIDL bits
+  virtual mozilla::dom::DOMImplementation*
+    GetImplementation(mozilla::ErrorResult& rv);
+  virtual nsIDOMStyleSheetList* StyleSheets();
+  virtual void SetSelectedStyleSheetSet(const nsAString& aSheetSet);
+  virtual void GetLastStyleSheetSet(nsString& aSheetSet);
+  virtual nsIDOMDOMStringList* StyleSheetSets();
+  virtual void EnableStyleSheetsForSet(const nsAString& aSheetSet);
+
 protected:
  friend class nsNodeUtils;

@ -1052,12 +1053,6 @@ protected:
  nsIContent* GetFirstBaseNodeWithHref();
  nsresult SetFirstBaseNodeWithHref(nsIContent *node);

-  inline void
-  SetDocumentDirectionality(mozilla::Directionality aDir)
-  {
-    mDirectionality = aDir;
-  }
-
  // Get the first <title> element with the given IsNodeOfType type, or
  // return null if there isn't one
  nsIContent* GetTitleContent(uint32_t aNodeType);
@ -1065,7 +1060,13 @@ protected:
  // append the concatenation of its text node children to aTitle. Do
  // nothing if there is no such element.
  void GetTitleFromElement(uint32_t aNodeType, nsAString& aTitle);
+public:
+  // Get our title
+  virtual void GetTitle(nsString& aTitle);
+  // Set our title
+  virtual void SetTitle(const nsAString& aTitle, mozilla::ErrorResult& rv);

+protected:
  nsresult doCreateShell(nsPresContext* aContext,
                         nsIViewManager* aViewManager, nsStyleSet* aStyleSet,
                         nsCompatibility aCompatMode,
@ -1101,9 +1102,6 @@ protected:

  void EnsureOnloadBlocker();

-  nsCString mReferrer;
-  nsString mLastModified;
-
  nsTArray<nsIObserver*> mCharSetObservers;

  PLDHashTable *mSubDocuments;
@ -1196,10 +1194,6 @@ protected:

  bool mSynchronousDOMContentLoaded:1;

-  // If true, we have an input encoding.  If this is false, then the
-  // document was created entirely in memory
-  bool mHaveInputEncoding:1;
-
  bool mInXBLUpdate:1;

  // Whether we're currently holding a lock on all of our images.
@ -1258,12 +1252,6 @@ protected:
  nsRefPtr<nsDOMNavigationTiming> mTiming;
 private:
  friend class nsUnblockOnloadEvent;
-  // This needs to stay in sync with the list in GetVisibilityState.
-  enum VisibilityState {
-    eHidden = 0,
-    eVisible,
-    eVisibilityStateCount
-  };
  // Recomputes the visibility state but doesn't set the new value.
  VisibilityState GetVisibilityState() const;

@ -1322,7 +1310,6 @@ private:
  // Onload blockers which haven't been activated yet
  uint32_t mAsyncOnloadBlockCount;
  nsCOMPtr<nsIRequest> mOnloadBlocker;
-  ReadyState mReadyState;

  // A hashtable of styled links keyed by address pointer.
  nsTHashtable<nsPtrHashKey<mozilla::dom::Link> > mStyledLinks;
@ -1348,7 +1335,7 @@ private:
  // All images in process of being preloaded
  nsCOMArray<imgIRequest> mPreloadingImages;

-  nsCOMPtr<nsIDOMDOMImplementation> mDOMImplementation;
+  nsRefPtr<mozilla::dom::DOMImplementation> mDOMImplementation;

  nsRefPtr<nsContentList> mImageMaps;

@ -1362,8 +1349,6 @@ private:
  // Tracking for plugins in the document.
  nsTHashtable< nsPtrHashKey<nsIObjectLoadingContent> > mPlugins;

-  VisibilityState mVisibilityState;
-
 #ifdef DEBUG
 protected:
  bool mWillReparent;
--- a/content/base/src/nsINode.cpp
+++ b/content/base/src/nsINode.cpp
@ -103,6 +103,7 @@
 #include "nsHTMLLegendElement.h"
 #include "nsWrapperCacheInlines.h"
 #include "WrapperFactory.h"
+#include "nsDOMDocumentType.h"

 using namespace mozilla;
 using namespace mozilla::dom;
@ -1443,7 +1444,7 @@ bool IsAllowedAsChild(nsIContent* aNewChild, nsINode* aParent,
        return true;
      }

-      nsIContent* docTypeContent = parentDocument->GetDocumentType();
+      nsIContent* docTypeContent = parentDocument->GetDoctype();
      if (!docTypeContent) {
        // It's all good.
        return true;
@ -1466,7 +1467,7 @@ bool IsAllowedAsChild(nsIContent* aNewChild, nsINode* aParent,
      }

      nsIDocument* parentDocument = static_cast<nsIDocument*>(aParent);
-      nsIContent* docTypeContent = parentDocument->GetDocumentType();
+      nsIContent* docTypeContent = parentDocument->GetDoctype();
      if (docTypeContent) {
        // Already have a doctype, so this is only OK if we're replacing it
        return aIsReplace && docTypeContent == aRefChild;
--- a/content/base/src/nsRange.h
+++ b/content/base/src/nsRange.h
@ -243,4 +243,16 @@ protected:
 #endif
 };

+inline nsISupports*
+ToCanonicalSupports(nsRange* aRange)
+{
+  return static_cast<nsIDOMRange*>(aRange);
+}
+
+inline nsISupports*
+ToSupports(nsRange* aRange)
+{
+  return static_cast<nsIDOMRange*>(aRange);
+}
+
 #endif /* nsRange_h___ */
--- a/content/events/src/nsContentEventHandler.cpp
+++ b/content/events/src/nsContentEventHandler.cpp
@ -26,6 +26,9 @@
 #include "nsLayoutUtils.h"
 #include "nsIMEStateManager.h"
 #include "nsIObjectFrame.h"
+#include "mozilla/dom/Element.h"
+
+using namespace mozilla::dom;

 /******************************************************************/
 /* nsContentEventHandler                                          */
@ -870,10 +873,8 @@ nsContentEventHandler::OnQueryDOMWidgetHittest(nsQueryContentEvent* aEvent)
  eventLoc.x -= docFrameRect.x;
  eventLoc.y -= docFrameRect.y;

-  nsCOMPtr<nsIDOMElement> elementUnderMouse;
-  doc->ElementFromPointHelper(eventLoc.x, eventLoc.y, false, false,
-                              getter_AddRefs(elementUnderMouse));
-  nsCOMPtr<nsIContent> contentUnderMouse = do_QueryInterface(elementUnderMouse);
+  Element* contentUnderMouse =
+    doc->ElementFromPointHelper(eventLoc.x, eventLoc.y, false, false);
  if (contentUnderMouse) {
    nsIWidget* targetWidget = nullptr;
    nsIFrame* targetFrame = contentUnderMouse->GetPrimaryFrame();
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@ -1025,7 +1025,7 @@ nsHTMLDocument::SetDomain(const nsAString& aDomain)
  return NodePrincipal()->SetDomain(newURI);
 }

-nsIContent*
+Element*
 nsHTMLDocument::GetBody()
 {
  Element* body = GetBodyElement();
@ -1040,7 +1040,7 @@ nsHTMLDocument::GetBody()
  nsRefPtr<nsContentList> nodeList =
    NS_GetContentList(this, kNameSpaceID_XHTML, NS_LITERAL_STRING("frameset"));

-  return nodeList->Item(0);
+  return nodeList->GetElementAt(0);
 }

 NS_IMETHODIMP
--- a/content/html/document/src/nsHTMLDocument.h
+++ b/content/html/document/src/nsHTMLDocument.h
@ -86,6 +86,14 @@ public:
  // nsIDOMDocument interface
  NS_FORWARD_NSIDOMDOCUMENT(nsDocument::)

+  // And explicitly import the things from nsDocument that we just shadowed
+  using nsDocument::GetImplementation;
+  using nsDocument::GetTitle;
+  using nsDocument::SetTitle;
+  using nsDocument::GetLastStyleSheetSet;
+  using nsDocument::MozSetImageElement;
+  using nsDocument::GetMozFullScreenElement;
+
  // nsIDOMNode interface
  NS_FORWARD_NSIDOMNODE_TO_NSINODE

@ -101,7 +109,7 @@ public:
                                    nsWrapperCache **aCache,
                                    nsresult *aResult);

-  nsIContent *GetBody();
+  Element *GetBody();
  Element *GetHead() { return GetHeadElement(); }
  already_AddRefed<nsContentList> GetElementsByName(const nsAString & aName)
  {
--- a/content/svg/content/test/bbox-helper.svg
+++ b/content/svg/content/test/bbox-helper.svg
@ -2,6 +2,7 @@
 <svg xmlns="http://www.w3.org/2000/svg">
  <g transform="scale(0.5)">
    <foreignObject id="fO" x="10" y="10" width="100" height="100"/>
+    <image id="i" x="10" y="10" width="100" height="100"/>
  </g>
  <text id="b" x="20" y="20">b</text>
  <text id="a" x="20" y="30">a</text>
--- a/content/svg/content/test/bounds-helper.svg
+++ b/content/svg/content/test/bounds-helper.svg
@ -21,6 +21,7 @@ text { font: 20px monospace; }
    <rect id="rect3" x="25" y="80" width="50" height="50" fill="green"/>
    <rect id="rect3a" x="25" y="80" width="50" height="50" fill="none" stroke-width="4" stroke="blue"/>
    <rect id="rect3b" vector-effect="non-scaling-stroke" x="100" y="100" width="25" height="25" fill="orange" stroke-width="4" stroke="yellow"/>
+    <image id="i" x="10" y="10" width="100" height="100"/>
  </g>
  <g transform="scale(2) rotate(45 175 75)">
    <rect id="rect4" x="150" y="50" width="50" height="50" fill="yellow"/>
--- a/content/svg/content/test/test_bbox.xhtml
+++ b/content/svg/content/test/test_bbox.xhtml
@ -48,6 +48,7 @@ function run()
  }

  checkBBox("fO", 10, 10, 100, 100);
+  checkBBox("i", 10, 10, 100, 100);
  compareBBoxHeight("a", "b");
  compareBBoxHeight("a", "y");
  compareBBox("b", "tspan");
--- a/content/svg/content/test/test_bounds.html
+++ b/content/svg/content/test/test_bounds.html
@ -134,6 +134,13 @@ function runTest()
  is(text2aBounds.left, text1aBounds.left + 100 - 3, "text2a.getBoundingClientRect().left");
  is(text2aBounds.width, text1aBounds.width + 6, "text2a.getBoundingClientRect().width");

+  var i = doc.getElementById("i");
+  var iBounds = i.getBoundingClientRect();
+  is(iBounds.left, 20, "i.getBoundingClientRect().left");
+  is(iBounds.top, 20, "i.getBoundingClientRect().top");
+  is(iBounds.width, 200, "i.getBoundingClientRect().width");
+  is(iBounds.height, 200, "i.getBoundingClientRect().height");
+
  SimpleTest.finish();
 }

--- a/content/svg/document/src/nsSVGDocument.h
+++ b/content/svg/document/src/nsSVGDocument.h
@ -20,6 +20,14 @@ public:

  NS_DECL_NSIDOMSVGDOCUMENT
  NS_FORWARD_NSIDOMDOCUMENT(nsXMLDocument::)
+  // And explicitly import the things from nsDocument that we just shadowed
+  using nsDocument::GetImplementation;
+  using nsDocument::GetTitle;
+  using nsDocument::SetTitle;
+  using nsDocument::GetLastStyleSheetSet;
+  using nsDocument::MozSetImageElement;
+  using nsDocument::GetMozFullScreenElement;
+
  NS_FORWARD_NSIDOMNODE_TO_NSINODE
  NS_DECL_ISUPPORTS_INHERITED
  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
--- a/content/xul/document/src/nsXULDocument.h
+++ b/content/xul/document/src/nsXULDocument.h
@ -140,6 +140,13 @@ public:

    // nsIDOMDocument interface
    NS_FORWARD_NSIDOMDOCUMENT(nsXMLDocument::)
+    // And explicitly import the things from nsDocument that we just shadowed
+    using nsDocument::GetImplementation;
+    using nsDocument::GetTitle;
+    using nsDocument::SetTitle;
+    using nsDocument::GetLastStyleSheetSet;
+    using nsDocument::MozSetImageElement;
+    using nsDocument::GetMozFullScreenElement;

    // nsDocument interface overrides
    virtual mozilla::dom::Element* GetElementById(const nsAString & elementId);
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@ -1215,8 +1215,11 @@ nsDOMWindowUtils::ElementFromPoint(float aX, float aY,
  nsCOMPtr<nsIDocument> doc(do_QueryInterface(window->GetExtantDocument()));
  NS_ENSURE_STATE(doc);

-  return doc->ElementFromPointHelper(aX, aY, aIgnoreRootScrollFrame, aFlushLayout,
-                                     aReturn);
+  Element* el =
+    doc->ElementFromPointHelper(aX, aY, aIgnoreRootScrollFrame, aFlushLayout);
+  nsCOMPtr<nsIDOMElement> retval = do_QueryInterface(el);
+  retval.forget(aReturn);
+  return NS_OK;
 }

 NS_IMETHODIMP
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@ -173,6 +173,14 @@ DOMInterfaces = {
 'Document': [
 {
    'nativeType': 'nsIDocument',
+    'resultNotAddRefed': [ 'implementation', 'doctype', 'documentElement',
+                           'getElementById', 'adoptNode', 'defaultView',
+                           'activeElement', 'currentScript',
+                           'mozFullScreenElement', 'mozPointerLockElement',
+                           'styleSheets', 'styleSheetSets', 'elementFromPoint',
+                           'querySelector', 'getAnonymousNodes',
+                           'getAnonymousElementByAtribute', 'getBindingParent'
+                           ]
 },
 {
    'nativeType': 'JSObject',
@ -330,6 +338,14 @@ DOMInterfaces = {
    'workers': True,
 }],

+'Location': {
+    # NOTE: Before you turn on codegen for Location, make sure all the
+    # Unforgeable stuff is dealt with.
+    'nativeType': 'nsIDOMLocation',
+    'skipGen': True,
+    'register': False
+},
+
 'MediaStreamList': {
    'headerFile': 'MediaStreamList.h',
    'wrapperCache': False,
@ -777,7 +793,7 @@ DOMInterfaces = {

 'TestExampleProxyInterface' : {
        'headerFile': 'TestExampleProxyInterface-example.h',
-	'register': False
+        'register': False
        }
 }

@ -813,34 +829,46 @@ addExternalHTMLElement('HTMLVideoElement')
 addExternalIface('Attr')
 addExternalIface('CanvasGradient', headerFile='nsIDOMCanvasRenderingContext2D.h')
 addExternalIface('CanvasPattern', headerFile='nsIDOMCanvasRenderingContext2D.h')
+addExternalIface('CDATASection')
 addExternalIface('ClientRect')
+addExternalIface('Comment', nativeType='mozilla::dom::Comment')
 addExternalIface("Counter")
 addExternalIface('CSSRule')
-addExternalIface('DocumentType', nativeType='nsIDOMDocumentType')
+addExternalIface('DocumentFragment', nativeType='mozilla::dom::DocumentFragment')
+addExternalIface('DocumentType', headerFile="nsDOMDocumentType.h")
 addExternalIface('DOMRequest')
-addExternalIface('DOMStringList', nativeType='nsDOMStringList',
-                 headerFile='nsDOMLists.h')
+addExternalIface('DOMStringList')
 addExternalIface('File')
 addExternalIface('HitRegionOptions', nativeType='nsISupports')
 addExternalIface('LockedFile')
 addExternalIface('MediaStream')
 addExternalIface('NamedNodeMap')
+addExternalIface('NodeIterator')
 addExternalIface('OutputStream', nativeType='nsIOutputStream',
                 notflattened=True)
 addExternalIface('Principal', nativeType='nsIPrincipal',
                 headerFile='nsIPrincipal.h', notflattened=True)
+addExternalIface('ProcessingInstruction', nativeType='nsXMLProcessingInstruction')
+addExternalIface('Range', nativeType='nsRange')
+addExternalIface("Rect")
+addExternalIface('StyleSheetList')
 addExternalIface('SVGLength')
 addExternalIface('SVGMatrix')
 addExternalIface('SVGNumber')
 addExternalIface('SVGPathSeg')
 addExternalIface('SVGPoint')
 addExternalIface('SVGTransform')
-addExternalIface("Rect")
+addExternalIface('Text', nativeType='nsTextNode')
 addExternalIface('TextMetrics', headerFile='nsIDOMCanvasRenderingContext2D.h')
+addExternalIface('TreeWalker')
 addExternalIface('Touch', headerFile='nsIDOMTouchEvent.h')
+addExternalIface('TouchList', headerFile='nsIDOMTouchEvent.h')
 addExternalIface('URI', nativeType='nsIURI', headerFile='nsIURI.h',
                 notflattened=True)
 addExternalIface('UserDataHandler')
 addExternalIface('Window')
+addExternalIface('WindowProxy', nativeType='nsIDOMWindow')
 addExternalIface('XPathResult', nativeType='nsISupports')
+addExternalIface('XPathExpression')
+addExternalIface('XPathNSResolver')
 addExternalIface('XULElement')
--- a/dom/bindings/Makefile.in
+++ b/dom/bindings/Makefile.in
@ -81,6 +81,7 @@ LOCAL_INCLUDES += -I$(topsrcdir)/js/xpconnect/src \
  -I$(topsrcdir)/dom/base \
  -I$(topsrcdir)/content/xslt/src/base \
  -I$(topsrcdir)/content/xslt/src/xpath \
+  -I$(topsrcdir)/content/xml/content/src \
  $(NULL)

 include $(topsrcdir)/config/rules.mk
--- a/dom/interfaces/core/nsIDOMDocument.idl
+++ b/dom/interfaces/core/nsIDOMDocument.idl
@ -201,6 +201,7 @@ interface nsIDOMDocument : nsIDOMNode
   *
   * @see <http://dev.w3.org/csswg/cssom/#dom-document-selectedStyleSheetSet>
   */
+  [binaryname(MozSelectedStyleSheetSet)]
  attribute DOMString selectedStyleSheetSet;

  /*
@ -241,6 +242,7 @@ interface nsIDOMDocument : nsIDOMNode
   *
   * @see <http://dev.w3.org/csswg/cssom/#dom-document-enableStyleSheetsForSet>
   */
+  [binaryname(MozEnableStyleSheetsForSet)]
  void enableStyleSheetsForSet(in DOMString name);


--- a/dom/media/Makefile.in
+++ b/dom/media/Makefile.in
@ -28,6 +28,7 @@ XPIDLSRCS = \
  nsIDOMMediaStream.idl \
  nsIDOMRTCPeerConnection.idl \
  nsIDOMNavigatorUserMedia.idl \
+  nsIMediaManager.idl \
  $(NULL)

 EXPORTS_NAMESPACE = mozilla
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@ -10,6 +10,7 @@
 #include "nsIUUIDGenerator.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIPopupWindowManager.h"
+#include "nsISupportsArray.h"

 // For PR_snprintf
 #include "prprf.h"
@ -690,9 +691,17 @@ private:
  already_AddRefed<nsIDOMGetUserMediaErrorCallback> mError;
 };

-nsRefPtr<MediaManager> MediaManager::sSingleton;
+NS_IMPL_THREADSAFE_ISUPPORTS2(MediaManager, nsIMediaManagerService, nsIObserver)

-NS_IMPL_THREADSAFE_ISUPPORTS1(MediaManager, nsIObserver)
+/* static */ StaticRefPtr<MediaManager> MediaManager::sSingleton;
+
+/* static */ already_AddRefed<MediaManager>
+MediaManager::GetInstance()
+{
+  // so we can have non-refcounted getters
+  nsRefPtr<MediaManager> service = MediaManager::Get();
+  return service.forget();
+}

 /**
 * The entry point for this file. A call from Navigator::mozGetUserMedia
@ -1050,4 +1059,38 @@ MediaManager::Observe(nsISupports* aSubject, const char* aTopic,
  return NS_OK;
 }

+static PLDHashOperator
+WindowsHashToArrayFunc (const uint64_t& aId,
+                        StreamListeners* aData,
+                        void *userArg)
+{
+    nsISupportsArray *array =
+        static_cast<nsISupportsArray *>(userArg);
+    nsPIDOMWindow *window = static_cast<nsPIDOMWindow*>
+      (nsGlobalWindow::GetInnerWindowWithId(aId));
+    (void) aData;
+
+    MOZ_ASSERT(window);
+    if (window) {
+      array->AppendElement(window);
+    }
+    return PL_DHASH_NEXT;
+}
+
+
+nsresult
+MediaManager::GetActiveMediaCaptureWindows(nsISupportsArray **aArray)
+{
+  MOZ_ASSERT(aArray);
+  nsISupportsArray *array;
+  nsresult rv = NS_NewISupportsArray(&array); // AddRefs
+  if (NS_FAILED(rv))
+    return rv;
+
+  mActiveWindows.EnumerateRead(WindowsHashToArrayFunc, array);
+
+  *aArray = array;
+  return NS_OK;
+}
+
 } // namespace mozilla
--- a/dom/media/MediaManager.h
+++ b/dom/media/MediaManager.h
@ -4,6 +4,7 @@

 #include "MediaEngine.h"
 #include "mozilla/Services.h"
+#include "nsIMediaManager.h"

 #include "nsHashKeys.h"
 #include "nsGlobalWindow.h"
@ -14,6 +15,7 @@
 #include "nsPIDOMWindow.h"
 #include "nsIDOMNavigatorUserMedia.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/StaticPtr.h"
 #include "prlog.h"

 namespace mozilla {
@ -272,9 +274,12 @@ private:
  nsRefPtr<MediaEngineSource> mSource;
 };

-class MediaManager MOZ_FINAL : public nsIObserver
+class MediaManager MOZ_FINAL : public nsIMediaManagerService,
+                               public nsIObserver
 {
 public:
+  static already_AddRefed<MediaManager> GetInstance();
+
  static MediaManager* Get() {
    if (!sSingleton) {
      sSingleton = new MediaManager();
@ -296,6 +301,7 @@ public:

  NS_DECL_ISUPPORTS
  NS_DECL_NSIOBSERVER
+  NS_DECL_NSIMEDIAMANAGERSERVICE

  MediaEngine* GetBackend();
  StreamListeners *GetWindowListeners(uint64_t aWindowId) {
@ -345,7 +351,7 @@ private:
  // protected with mMutex:
  MediaEngine* mBackend;

-  static nsRefPtr<MediaManager> sSingleton;
+  static StaticRefPtr<MediaManager> sSingleton;
 };

 } // namespace mozilla
--- a/dom/media/PeerConnection.js
+++ b/dom/media/PeerConnection.js
@ -210,6 +210,7 @@ function PeerConnection() {
  this.onstatechange = null;
  this.ongatheringchange = null;
  this.onicechange = null;
+  this.localDescription = null;
  this.remoteDescription = null;

  // Data channel.
@ -441,6 +442,11 @@ PeerConnection.prototype = {
        break;
    }

+    this.localDescription = {
+      type: desc.type, sdp: desc.sdp,
+      __exposedProps__: { type: "rw", sdp: "rw"}
+    };
+
    this.remoteDescription = {
      type: desc.type, sdp: desc.sdp,
      __exposedProps__: { type: "rw", sdp: "rw" }
--- a/dom/media/nsIMediaManager.idl
+++ b/dom/media/nsIMediaManager.idl
@ -0,0 +1,18 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsISupportsArray;
+
+%{C++
+#define NS_MEDIAMANAGERSERVICE_CID {0xabc622ea, 0x9655, 0x4123, {0x80, 0xd9, 0x22, 0x62, 0x1b, 0xdd, 0x54, 0x65}}
+#define MEDIAMANAGERSERVICE_CONTRACTID "@mozilla.org/mediaManagerService;1"
+%}
+
+[scriptable, builtinclass, uuid(afe82ff1-2caa-4304-85da-0158a5dee56b)]
+interface nsIMediaManagerService : nsISupports
+{
+  readonly attribute nsISupportsArray activeMediaCaptureWindows;
+};
--- a/dom/plugins/base/nsPluginsDirDarwin.cpp
+++ b/dom/plugins/base/nsPluginsDirDarwin.cpp
@ -380,10 +380,15 @@ static bool IsCompatibleArch(nsIFile *file)
        return false;
      }

-      uint32_t containerArchitectures = mozilla::ipc::GeckoChildProcessHost::GetSupportedArchitecturesForProcessType(GeckoProcessType_Plugin);
+      uint32_t supportedArchitectures =
+#ifdef __LP64__
+          mozilla::ipc::GeckoChildProcessHost::GetSupportedArchitecturesForProcessType(GeckoProcessType_Plugin);
+#else
+          base::GetCurrentProcessArchitecture();
+#endif

      // Consider the plugin architecture valid if there is any overlap in the masks.
-      isPluginFile = !!(containerArchitectures & pluginLibArchitectures);
+      isPluginFile = !!(supportedArchitectures & pluginLibArchitectures);
    }
    ::CFRelease(pluginBundle);
  }
--- a/dom/webidl/Document.webidl
+++ b/dom/webidl/Document.webidl
@ -3,14 +3,36 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this file,
 * You can obtain one at http://mozilla.org/MPL/2.0/.
 *
- * The origin of this IDL file is
- * http://www.w3.org/TR/2012/WD-dom-20120105/
+ * The origin of this IDL file is:
+ * http://dom.spec.whatwg.org/#interface-document
+ * http://www.whatwg.org/specs/web-apps/current-work/#the-document-object
+ * http://dvcs.w3.org/hg/fullscreen/raw-file/tip/Overview.html#api
+ * http://dvcs.w3.org/hg/pointerlock/raw-file/default/index.html#extensions-to-the-document-interface
+ * http://dvcs.w3.org/hg/webperf/raw-file/tip/specs/PageVisibility/Overview.html#sec-document-interface
+ * http://dev.w3.org/csswg/cssom/#extensions-to-the-document-interface
+ * http://dev.w3.org/csswg/cssom-view/#extensions-to-the-document-interface
 *
- * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
- * liability, trademark and document use rules apply.
+ * http://mxr.mozilla.org/mozilla-central/source/dom/interfaces/core/nsIDOMDocument.idl
 */

+interface Attr;
+interface CDATASection;
+interface DocumentFragment;
+interface Comment;
+interface NodeIterator;
+interface ProcessingInstruction;
+interface Range;
+interface StyleSheetList;
+interface Text;
+interface Touch;
+interface TouchList;
+interface TreeWalker;
+interface WindowProxy;
+
+/* http://dom.spec.whatwg.org/#interface-document */
+[Constructor]
 interface Document : Node {
+  [Throws, Constant]
  readonly attribute DOMImplementation implementation;
  readonly attribute DOMString URL;
  readonly attribute DOMString documentURI;
@ -20,31 +42,408 @@ interface Document : Node {

  readonly attribute DocumentType? doctype;
  readonly attribute Element? documentElement;
-  NodeList getElementsByTagName(DOMString qualifiedName);
-  NodeList getElementsByTagNameNS(DOMString? namespace, DOMString localName);
-  NodeList getElementsByClassName(DOMString classNames);
+  HTMLCollection getElementsByTagName(DOMString localName);
+  HTMLCollection getElementsByTagNameNS(DOMString? namespace, DOMString localName);
+  HTMLCollection getElementsByClassName(DOMString classNames);
  Element? getElementById(DOMString elementId);

+  [Creator, Throws]
  Element createElement(DOMString localName);
+  [Creator, Throws]
  Element createElementNS(DOMString? namespace, DOMString qualifiedName);
+  [Creator, Throws]
  DocumentFragment createDocumentFragment();
+  [Creator, Throws]
  Text createTextNode(DOMString data);
+  [Creator, Throws]
  Comment createComment(DOMString data);
+  [Creator, Throws]
  ProcessingInstruction createProcessingInstruction(DOMString target, DOMString data);

-  Node importNode(Node node, optional boolean deep);
+  [Throws]
+  Node importNode(Node node, optional boolean deep = true);
+  [Throws]
  Node adoptNode(Node node);

-  Event createEvent(DOMString eventInterfaceName);
+  [Creator, Throws]
+  Event createEvent(DOMString interface);

+  [Creator, Throws]
  Range createRange();

-  NodeIterator createNodeIterator(Node root, optional unsigned long whatToShow, optional NodeFilter? filter);
-  TreeWalker createTreeWalker(Node root, optional unsigned long whatToShow, optional NodeFilter? filter);
+  // NodeFilter.SHOW_ALL = 0xFFFFFFFF
+  [Creator, Throws]
+  NodeIterator createNodeIterator(Node root, optional unsigned long whatToShow = 0xFFFFFFFF, optional NodeFilter? filter = null);
+  [Creator, Throws]
+  TreeWalker createTreeWalker(Node root, optional unsigned long whatToShow = 0xFFFFFFFF, optional NodeFilter? filter = null);

  // NEW
-  void prepend((Node or DOMString)... nodes);
-  void append((Node or DOMString)... nodes);
+  // No support for prepend/append yet
+  // void prepend((Node or DOMString)... nodes);
+  // void append((Node or DOMString)... nodes);
+
+  // These are not in the spec, but leave them for now for backwards compat.
+  // So sort of like Gecko extensions
+  [Creator, Throws]
+  CDATASection createCDATASection(DOMString data);
+  [Creator, Throws]
+  Attr createAttribute(DOMString name);
+  [Creator, Throws]
+  Attr createAttributeNS(DOMString? namespace, DOMString name);
+  readonly attribute DOMString? inputEncoding;
+/*
 };

-interface XMLDocument : Document {};
+http://www.whatwg.org/specs/web-apps/current-work/#the-document-object
+partial interface Document {
+*/
+  [PutForwards=href, Unforgeable] readonly attribute Location? location;
+  //(HTML only)         attribute DOMString domain;
+  readonly attribute DOMString referrer;
+  //(HTML only)         attribute DOMString cookie;
+  readonly attribute DOMString lastModified;
+  readonly attribute DOMString readyState;
+
+  // DOM tree accessors
+  //(Not proxy yet)getter object (DOMString name);
+           [SetterThrows]
+           attribute DOMString title;
+           [SetterThrows]
+           attribute DOMString dir;
+  //(HTML only)         attribute HTMLElement? body;
+  //(HTML only)readonly attribute HTMLHeadElement? head;
+  //(HTML only)readonly attribute HTMLCollection images;
+  //(HTML only)readonly attribute HTMLCollection embeds;
+  //(HTML only)readonly attribute HTMLCollection plugins;
+  //(HTML only)readonly attribute HTMLCollection links;
+  //(HTML only)readonly attribute HTMLCollection forms;
+  //(HTML only)readonly attribute HTMLCollection scripts;
+  //(HTML only)NodeList getElementsByName(DOMString elementName);
+  //(HTML only)NodeList getItems(optional DOMString typeNames); // microdata
+  //(Not implemented)readonly attribute DOMElementMap cssElementMap;
+
+  // dynamic markup insertion
+  //(HTML only)Document open(optional DOMString type, optional DOMString replace);
+  //(HTML only)WindowProxy open(DOMString url, DOMString name, DOMString features, optional boolean replace);
+  //(HTML only)void close();
+  //(HTML only)void write(DOMString... text);
+  //(HTML only)void writeln(DOMString... text);
+
+  // user interaction
+  readonly attribute WindowProxy? defaultView;
+  readonly attribute Element? activeElement;
+  [Throws]
+  boolean hasFocus();
+  //(HTML only)         attribute DOMString designMode;
+  //(HTML only)boolean execCommand(DOMString commandId);
+  //(HTML only)boolean execCommand(DOMString commandId, boolean showUI);
+  //(HTML only)boolean execCommand(DOMString commandId, boolean showUI, DOMString value);
+  //(HTML only)boolean queryCommandEnabled(DOMString commandId);
+  //(HTML only)boolean queryCommandIndeterm(DOMString commandId);
+  //(HTML only)boolean queryCommandState(DOMString commandId);
+  //(HTML only)boolean queryCommandSupported(DOMString commandId);
+  //(HTML only)DOMString queryCommandValue(DOMString commandId);
+  //(Not implemented)readonly attribute HTMLCollection commands;
+
+  // event handler IDL attributes
+           [SetterThrows]
+           attribute EventHandler onabort;
+           [SetterThrows]
+           attribute EventHandler onblur;
+  //(Not implemented)         attribute EventHandler oncancel;
+           [SetterThrows]
+           attribute EventHandler oncanplay;
+           [SetterThrows]
+           attribute EventHandler oncanplaythrough;
+           [SetterThrows]
+           attribute EventHandler onchange;
+           [SetterThrows]
+           attribute EventHandler onclick;
+  //(Not implemented)         attribute EventHandler onclose;
+           [SetterThrows]
+           attribute EventHandler oncontextmenu;
+  //(Not implemented)         attribute EventHandler oncuechange;
+           [SetterThrows]
+           attribute EventHandler ondblclick;
+           [SetterThrows]
+           attribute EventHandler ondrag;
+           [SetterThrows]
+           attribute EventHandler ondragend;
+           [SetterThrows]
+           attribute EventHandler ondragenter;
+           [SetterThrows]
+           attribute EventHandler ondragleave;
+           [SetterThrows]
+           attribute EventHandler ondragover;
+           [SetterThrows]
+           attribute EventHandler ondragstart;
+           [SetterThrows]
+           attribute EventHandler ondrop;
+           [SetterThrows]
+           attribute EventHandler ondurationchange;
+           [SetterThrows]
+           attribute EventHandler onemptied;
+           [SetterThrows]
+           attribute EventHandler onended;
+           [SetterThrows]
+           attribute EventHandler onerror;
+           [SetterThrows]
+           attribute EventHandler onfocus;
+           [SetterThrows]
+           attribute EventHandler oninput;
+           [SetterThrows]
+           attribute EventHandler oninvalid;
+           [SetterThrows]
+           attribute EventHandler onkeydown;
+           [SetterThrows]
+           attribute EventHandler onkeypress;
+           [SetterThrows]
+           attribute EventHandler onkeyup;
+           [SetterThrows]
+           attribute EventHandler onload;
+           [SetterThrows]
+           attribute EventHandler onloadeddata;
+           [SetterThrows]
+           attribute EventHandler onloadedmetadata;
+           [SetterThrows]
+           attribute EventHandler onloadstart;
+           [SetterThrows]
+           attribute EventHandler onmousedown;
+           [SetterThrows]
+           attribute EventHandler onmousemove;
+           [SetterThrows]
+           attribute EventHandler onmouseout;
+           [SetterThrows]
+           attribute EventHandler onmouseover;
+           [SetterThrows]
+           attribute EventHandler onmouseup;
+  //(Not implemented)         attribute EventHandler onmousewheel;
+           [SetterThrows]
+           attribute EventHandler onpause;
+           [SetterThrows]
+           attribute EventHandler onplay;
+           [SetterThrows]
+           attribute EventHandler onplaying;
+           [SetterThrows]
+           attribute EventHandler onprogress;
+           [SetterThrows]
+           attribute EventHandler onratechange;
+           [SetterThrows]
+           attribute EventHandler onreset;
+           [SetterThrows]
+           attribute EventHandler onscroll;
+           [SetterThrows]
+           attribute EventHandler onseeked;
+           [SetterThrows]
+           attribute EventHandler onseeking;
+           [SetterThrows]
+           attribute EventHandler onselect;
+           [SetterThrows]
+           attribute EventHandler onshow;
+           [SetterThrows]
+           attribute EventHandler onstalled;
+           [SetterThrows]
+           attribute EventHandler onsubmit;
+           [SetterThrows]
+           attribute EventHandler onsuspend;
+           [SetterThrows]
+           attribute EventHandler ontimeupdate;
+           [SetterThrows]
+           attribute EventHandler onvolumechange;
+           [SetterThrows]
+           attribute EventHandler onwaiting;
+
+  // special event handler IDL attributes that only apply to Document objects
+  [LenientThis, SetterThrows] attribute EventHandler onreadystatechange;
+
+  // Gecko extensions?
+  [LenientThis, SetterThrows] attribute EventHandler onmouseenter;
+  [LenientThis, SetterThrows] attribute EventHandler onmouseleave;
+  [SetterThrows] attribute EventHandler onmozfullscreenchange;
+  [SetterThrows] attribute EventHandler onmozfullscreenerror;
+  [SetterThrows] attribute EventHandler onmozpointerlockchange;
+  [SetterThrows] attribute EventHandler onmozpointerlockerror;
+  [SetterThrows] attribute EventHandler onwheel;
+  [SetterThrows] attribute EventHandler oncopy;
+  [SetterThrows] attribute EventHandler oncut;
+  [SetterThrows] attribute EventHandler onpaste;
+  [SetterThrows] attribute EventHandler onbeforescriptexecute;
+  [SetterThrows] attribute EventHandler onafterscriptexecute;
+  /**
+   * True if this document is synthetic : stand alone image, video, audio file,
+   * etc.
+   */
+  [ChromeOnly] readonly attribute boolean mozSyntheticDocument;
+  /**
+   * Returns the script element whose script is currently being processed.
+   *
+   * @see <https://developer.mozilla.org/en/DOM/document.currentScript>
+   */
+  readonly attribute Element? currentScript;
+  /**
+   * Release the current mouse capture if it is on an element within this
+   * document.
+   *
+   * @see <https://developer.mozilla.org/en/DOM/document.releaseCapture>
+   */
+  void releaseCapture();
+  /**
+   * Use the given DOM element as the source image of target |-moz-element()|.
+   *
+   * This function introduces a new special ID (called "image element ID"),
+   * which is only used by |-moz-element()|, and associates it with the given
+   * DOM element.  Image elements ID's have the higher precedence than general
+   * HTML id's, so if |document.mozSetImageElement(<id>, <element>)| is called,
+   * |-moz-element(#<id>)| uses |<element>| as the source image even if there
+   * is another element with id attribute = |<id>|.  To unregister an image
+   * element ID |<id>|, call |document.mozSetImageElement(<id>, null)|.
+   *
+   * Example:
+   * <script>
+   *   canvas = document.createElement("canvas");
+   *   canvas.setAttribute("width", 100);
+   *   canvas.setAttribute("height", 100);
+   *   // draw to canvas
+   *   document.mozSetImageElement("canvasbg", canvas);
+   * </script>
+   * <div style="background-image: -moz-element(#canvasbg);"></div>
+   *
+   * @param aImageElementId an image element ID to associate with
+   * |aImageElement|
+   * @param aImageElement a DOM element to be used as the source image of
+   * |-moz-element(#aImageElementId)|. If this is null, the function will
+   * unregister the image element ID |aImageElementId|.
+   *
+   * @see <https://developer.mozilla.org/en/DOM/document.mozSetImageElement>
+   */
+  void mozSetImageElement(DOMString aImageElementId,
+                          Element? aImageElement);
+
+/*
+};
+
+http://dvcs.w3.org/hg/fullscreen/raw-file/tip/Overview.html#api
+partial interface Document {
+*/
+  // Note: Per spec the 'S' in these two is lowercase, but the "Moz"
+  // versions hve it uppercase.
+  readonly attribute boolean mozFullScreenEnabled;
+  [Throws]
+  readonly attribute Element? mozFullScreenElement;
+
+  //(Renamed?)void exitFullscreen();
+
+  // Gecko-specific fullscreen bits
+  readonly attribute boolean mozFullScreen;
+  void mozCancelFullScreen();
+/*
+};
+
+http://dvcs.w3.org/hg/pointerlock/raw-file/default/index.html#extensions-to-the-document-interface
+partial interface Document {
+*/
+    readonly attribute Element? mozPointerLockElement;
+    void mozExitPointerLock ();
+/*
+};
+
+http://dvcs.w3.org/hg/webperf/raw-file/tip/specs/PageVisibility/Overview.html#sec-document-interface
+partial interface Document {
+*/
+  readonly attribute boolean hidden;
+  readonly attribute boolean mozHidden;
+  readonly attribute DOMString visibilityState;
+  readonly attribute DOMString mozVisibilityState;
+  // "hidden", "visible", "prerender", "unloaded"
+/*
+};
+
+http://dev.w3.org/csswg/cssom/#extensions-to-the-document-interface
+partial interface Document {
+*/
+    [Constant]
+    readonly attribute StyleSheetList styleSheets;
+    attribute DOMString? selectedStyleSheetSet;
+    readonly attribute DOMString? lastStyleSheetSet;
+    readonly attribute DOMString? preferredStyleSheetSet;
+    [Constant]
+    readonly attribute DOMStringList styleSheetSets;
+    void enableStyleSheetsForSet (DOMString? name);
+/*
+};
+
+http://dev.w3.org/csswg/cssom-view/#extensions-to-the-document-interface
+partial interface Document {
+*/
+    Element? elementFromPoint (float x, float y);
+    //(Not implemented)CaretPosition? caretPositionFromPoint (float x, float y);
+/*};
+
+http://dev.w3.org/2006/webapi/selectors-api2/#interface-definitions
+partial interface Document {
+*/
+  [Throws]
+  Element?  querySelector(DOMString selectors);
+  [Throws]
+  NodeList  querySelectorAll(DOMString selectors);
+
+  //(Not implemented)Element?  find(DOMString selectors, optional (Element or sequence<Node>)? refNodes);
+  //(Not implemented)NodeList  findAll(DOMString selectors, optional (Element or sequence<Node>)? refNodes);
+/*};
+
+  Mozilla extensions of various sorts
+*/
+
+  // nsIDOMDocumentXBL.  Wish we could make these [ChromeOnly], but
+  // that would likely break bindings running with the page principal.
+  NodeList? getAnonymousNodes(Element elt);
+  Element? getAnonymousElementByAttribute(Element elt, DOMString attrName,
+                                          DOMString attrValue);
+  [Throws]
+  void addBinding(Element elt, DOMString bindingURL);
+  [Throws]
+  void removeBinding(Element elt, DOMString bindingURL);
+  Element? getBindingParent(Node node);
+  [Throws]
+  void loadBindingDocument(DOMString documentURL);
+
+  // nsIDOMDocumentTouch
+  // XXXbz I can't find the sane spec for this stuff, so just cribbing
+  // from our xpidl for now.
+  [SetterThrows, Pref="dom.w3c_touch_events.expose"]
+  attribute EventHandler ontouchstart;
+  [SetterThrows, Pref="dom.w3c_touch_events.expose"]
+  attribute EventHandler ontouchend;
+  [SetterThrows, Pref="dom.w3c_touch_events.expose"]
+  attribute EventHandler ontouchmove;
+  [SetterThrows, Pref="dom.w3c_touch_events.expose"]
+  attribute EventHandler ontouchenter;
+  [SetterThrows, Pref="dom.w3c_touch_events.expose"]
+  attribute EventHandler ontouchleave;
+  [SetterThrows, Pref="dom.w3c_touch_events.expose"]
+  attribute EventHandler ontouchcancel;
+  [Creator, Pref="dom.w3c_touch_events.expose"]
+  Touch createTouch(optional Window? view = null,
+                    // Nasty hack, because we can't do EventTarget arguments yet
+                    // (they would need to be non-castable, but trying to do
+                    // XPConnect unwrapping with nsDOMEventTargetHelper fails).
+                    // optional EventTarget? target = null,
+                    optional nsISupports? target = null,
+                    optional long identifier = 0,
+                    optional long pageX = 0,
+                    optional long pageY = 0,
+                    optional long screenX = 0,
+                    optional long screenY = 0,
+                    optional long clientX = 0,
+                    optional long clientY = 0,
+                    optional long radiusX = 0,
+                    optional long radiusY = 0,
+                    optional float rotationAngle = 0,
+                    optional float force = 0);
+  [Creator, Pref="dom.w3c_touch_events.expose"]
+  TouchList createTouchList(Touch touch);
+  [Creator, Pref="dom.w3c_touch_events.expose"]
+  TouchList createTouchList(sequence<Touch> touches);
+};
+
+Document implements XPathEvaluator;
--- a/dom/webidl/Location.webidl
+++ b/dom/webidl/Location.webidl
@ -0,0 +1,28 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.whatwg.org/specs/web-apps/current-work/#the-location-interface
+ *
+ * © Copyright 2004-2011 Apple Computer, Inc., Mozilla Foundation, and
+ * Opera Software ASA. You are granted a license to use, reproduce
+ * and create derivative works of this document.
+ */
+
+[Unforgeable] interface Location {
+  stringifier attribute DOMString href;
+  void assign(DOMString url);
+  void replace(DOMString url);
+  void reload();
+
+  // URL decomposition IDL attributes 
+           attribute DOMString protocol;
+           attribute DOMString host;
+           attribute DOMString hostname;
+           attribute DOMString port;
+           attribute DOMString pathname;
+           attribute DOMString search;
+           attribute DOMString hash;
+};
--- a/dom/webidl/WebIDL.mk
+++ b/dom/webidl/WebIDL.mk
@ -50,6 +50,7 @@ webidl_files = \
  HTMLOptionsCollection.webidl \
  HTMLPropertiesCollection.webidl \
  ImageData.webidl \
+  Location.webidl \
  MutationObserver.webidl \
  Node.webidl \
  NodeFilter.webidl \
--- a/js/src/config/rules.mk
+++ b/js/src/config/rules.mk
@ -1203,6 +1203,12 @@ PP_TARGETS += PREF_JS_EXPORTS
 endif
 endif

+# Set a flag that can be used in pref files to disable features if
+# we are not building for Aurora or Nightly.
+ifeq (,$(findstring a,$(GRE_MILESTONE)))
+PREF_PPFLAGS += -DRELEASE_BUILD
+endif
+
 ################################################################################
 # Copy each element of AUTOCFG_JS_EXPORTS to $(FINAL_TARGET)/defaults/autoconfig

--- a/js/xpconnect/src/dom_quickstubs.qsconf
+++ b/js/xpconnect/src/dom_quickstubs.qsconf
@ -523,18 +523,20 @@ customMethodCalls = {
    'nsIDOMDocument_GetElementsByTagNameNS': {
        'thisType': 'nsDocument',
        'code': '    nsRefPtr<nsContentList> result ='
-                'self->GetElementsByTagNameNS(arg0, arg1);',
+                'self->nsIDocument::GetElementsByTagNameNS(arg0, arg1);',
        'canFail': False
        },
    'nsIDOMDocument_CreateElement': {
        'thisType': 'nsDocument',
-        'code': '    nsCOMPtr<nsIContent> result;\n'
-                '    rv = self->CreateElement(arg0, getter_AddRefs(result));'
+        'code': '    mozilla::ErrorResult error;\n'
+                '    nsCOMPtr<mozilla::dom::Element> result = self->nsIDocument::CreateElement(arg0, error);\n'
+                '    rv = error.ErrorCode();'
    },
    'nsIDOMDocument_CreateElementNS': {
        'thisType': 'nsDocument',
-        'code': '    nsCOMPtr<nsIContent> result;\n'
-                '    rv = self->CreateElementNS(arg0, arg1, getter_AddRefs(result));'
+        'code': '    mozilla::ErrorResult error;\n'
+                '    nsCOMPtr<mozilla::dom::Element> result = self->nsIDocument::CreateElementNS(arg0, arg1, error);\n'
+                '    rv = error.ErrorCode();'
    },
    'nsIDOMDocument_CreateTextNode': {
        'thisType': 'nsDocument',
@ -565,6 +567,12 @@ customMethodCalls = {
        'thisType' : 'nsDocument',
        'unwrapThisFailureFatal' : False
        },
+    'nsIDOMDocument_GetTitle' : {
+        'thisType' : 'nsDocument',
+        'code': '    nsString result;\n'
+                '    self->GetTitle(result);',
+        'canFail': False
+        },
    'nsIDOMWindow_GetOnmouseenter' : {
        'thisType' : 'nsIDOMWindow',
        'unwrapThisFailureFatal' : False
--- a/layout/build/Makefile.in
+++ b/layout/build/Makefile.in
@ -302,6 +302,7 @@ LOCAL_INCLUDES	+= -I$(srcdir)/../base \
 		   -I$(topsrcdir)/dom/settings \
 		   -I$(topsrcdir)/dom/permission \
 		   -I$(topsrcdir)/dom/telephony \
+		   -I$(topsrcdir)/dom/media \
 		   -I. \
 		   -I$(topsrcdir)/editor/libeditor/base \
 		   -I$(topsrcdir)/editor/libeditor/text \
--- a/layout/build/nsLayoutModule.cpp
+++ b/layout/build/nsLayoutModule.cpp
@ -233,6 +233,7 @@ static void Shutdown();
 #include "mozilla/dom/sms/SmsServicesFactory.h"
 #include "nsIPowerManagerService.h"
 #include "nsIAlarmHalService.h"
+#include "nsIMediaManager.h"
 #include "nsMixedContentBlocker.h"

 #include "AudioChannelService.h"
@ -244,6 +245,7 @@ static void Shutdown();
 #ifdef MOZ_WIDGET_GONK
 #include "GonkGPSGeolocationProvider.h"
 #endif
+#include "MediaManager.h"

 using namespace mozilla;
 using namespace mozilla::dom;
@ -326,6 +328,8 @@ NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(nsITimeService,
 NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(nsIGeolocationProvider,
                                         GonkGPSGeolocationProvider::GetSingleton)
 #endif
+NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(nsIMediaManagerService,
+                                         MediaManager::GetInstance)

 //-----------------------------------------------------------------------------

@ -840,6 +844,7 @@ NS_DEFINE_NAMED_CID(NS_TIMESERVICE_CID);
 #ifdef MOZ_WIDGET_GONK
 NS_DEFINE_NAMED_CID(GONK_GPS_GEOLOCATION_PROVIDER_CID);
 #endif
+NS_DEFINE_NAMED_CID(NS_MEDIAMANAGERSERVICE_CID);

 static nsresult
 CreateWindowCommandTableConstructor(nsISupports *aOuter,
@ -1119,6 +1124,7 @@ static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
 #ifdef MOZ_WIDGET_GONK
  { &kGONK_GPS_GEOLOCATION_PROVIDER_CID, false, NULL, nsIGeolocationProviderConstructor },
 #endif
+  { &kNS_MEDIAMANAGERSERVICE_CID, false, NULL, nsIMediaManagerServiceConstructor },
  { NULL }
 };

@ -1262,6 +1268,7 @@ static const mozilla::Module::ContractIDEntry kLayoutContracts[] = {
 #ifdef MOZ_WIDGET_GONK
  { GONK_GPS_GEOLOCATION_PROVIDER_CONTRACTID, &kGONK_GPS_GEOLOCATION_PROVIDER_CID },
 #endif
+  { MEDIAMANAGERSERVICE_CONTRACTID, &kNS_MEDIAMANAGERSERVICE_CID },
  { NULL }
 };

--- a/layout/style/crashtests/822766-1.html
+++ b/layout/style/crashtests/822766-1.html
@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+@-moz-keyframes togreen {
+    100% {
+        color: green;
+    }
+}
+
+.a:after {
+    animation-name: togreen;
+    animation-duration: 10s;
+}
+
+</style>
+<script>
+
+function boom()
+{
+  document.documentElement.setAttribute("class", "a");
+  document.documentElement.offsetHeight;
+  document.documentElement.appendChild(document.createElement("span"));
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@ -83,3 +83,4 @@ load 788836.html
 load 806310-1.html
 load 812824.html
 load 822842.html
+load 822766-1.html
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@ -233,6 +233,12 @@ protected:
  class nsAutoParseCompoundProperty;
  friend class nsAutoParseCompoundProperty;

+  class nsAutoParseCompoundProperty;
+  friend class nsAutoParseCompoundProperty;
+
+  class nsAutoSuppressErrors;
+  friend class nsAutoSuppressErrors;
+
  void AppendRule(css::Rule* aRule);
  friend void AppendRuleToSheet(css::Rule*, void*); // calls AppendRule

@ -258,6 +264,58 @@ protected:
      CSSParserImpl* mParser;
  };

+  /**
+   * This helper class conditionally sets mInFailingSupportsRule to
+   * true if aCondition = false, and resets it to its original value in its
+   * destructor.  If we are already somewhere within a failing @supports
+   * rule, passing in aCondition = true does not change mInFailingSupportsRule.
+   */
+  class nsAutoFailingSupportsRule {
+    public:
+      nsAutoFailingSupportsRule(CSSParserImpl* aParser,
+                                bool aCondition)
+        : mParser(aParser),
+          mOriginalValue(aParser->mInFailingSupportsRule)
+      {
+        if (!aCondition) {
+          mParser->mInFailingSupportsRule = true;
+        }
+      }
+
+      ~nsAutoFailingSupportsRule()
+      {
+        mParser->mInFailingSupportsRule = mOriginalValue;
+      }
+
+    private:
+      CSSParserImpl* mParser;
+      bool mOriginalValue;
+  };
+
+  /**
+   * Auto class to set aParser->mSuppressErrors to the specified value
+   * and restore it to its original value later.
+   */
+  class nsAutoSuppressErrors {
+    public:
+      nsAutoSuppressErrors(CSSParserImpl* aParser,
+                           bool aSuppressErrors)
+        : mParser(aParser),
+          mOriginalValue(aParser->mSuppressErrors)
+      {
+        mParser->mSuppressErrors = aSuppressErrors;
+      }
+
+      ~nsAutoSuppressErrors()
+      {
+        mParser->mSuppressErrors = mOriginalValue;
+      }
+
+    private:
+      CSSParserImpl* mParser;
+      bool mOriginalValue;
+  };
+
  // the caller must hold on to aString until parsing is done
  void InitScanner(nsCSSScanner& aScanner,
                   css::ErrorReporter& aReporter,
@ -689,6 +747,15 @@ protected:
  // some quirks during shorthand parsing
  bool          mParsingCompoundProperty : 1;

+  // True if we are somewhere within a @supports rule whose condition is
+  // false.
+  bool mInFailingSupportsRule : 1;
+
+  // True if we will suppress all parse errors (except unexpected EOFs).
+  // This is used to prevent errors for declarations inside a failing
+  // @supports rule.
+  bool mSuppressErrors : 1;
+
  // Stack of rule groups; used for @media and such.
  InfallibleTArray<nsRefPtr<css::GroupRule> > mGroupStack;

@ -719,16 +786,16 @@ static void AppendRuleToSheet(css::Rule* aRule, void* aParser)
 }

 #define REPORT_UNEXPECTED(msg_) \
-  mReporter->ReportUnexpected(#msg_)
+  { if (!mSuppressErrors) mReporter->ReportUnexpected(#msg_); }

 #define REPORT_UNEXPECTED_P(msg_, param_) \
-  mReporter->ReportUnexpected(#msg_, param_)
+  { if (!mSuppressErrors) mReporter->ReportUnexpected(#msg_, param_); }

 #define REPORT_UNEXPECTED_TOKEN(msg_) \
-  mReporter->ReportUnexpected(#msg_, mToken)
+  { if (!mSuppressErrors) mReporter->ReportUnexpected(#msg_, mToken); }

 #define REPORT_UNEXPECTED_TOKEN_CHAR(msg_, ch_) \
-  mReporter->ReportUnexpected(#msg_, mToken, ch_)
+  { if (!mSuppressErrors) mReporter->ReportUnexpected(#msg_, mToken, ch_); }

 #define REPORT_UNEXPECTED_EOF(lf_) \
  mReporter->ReportUnexpectedEOF(#lf_)
@ -756,6 +823,8 @@ CSSParserImpl::CSSParserImpl()
    mUnsafeRulesEnabled(false),
    mHTMLMediaMode(false),
    mParsingCompoundProperty(false),
+    mInFailingSupportsRule(false),
+    mSuppressErrors(false),
    mNextFree(nullptr)
 {
 }
@ -2375,6 +2444,10 @@ CSSParserImpl::ParseSupportsRule(RuleAppendFunc aAppendFunc, void* aProcessData)
  // Remove spaces from the start and end of the recorded supports condition.
  condition.Trim(" ", true, true, false);

+  // Record whether we are in a failing @supports, so that property parse
+  // errors don't get reported.
+  nsAutoFailingSupportsRule failing(this, conditionMet);
+
  nsRefPtr<css::GroupRule> rule = new CSSSupportsRule(conditionMet, condition);
  return ParseGroupRule(rule, aAppendFunc, aProcessData);
 }
@ -4309,6 +4382,10 @@ CSSParserImpl::ParseDeclaration(css::Declaration* aDeclaration,
    return false;
  }

+  // Don't report property parse errors if we're inside a failing @supports
+  // rule.
+  nsAutoSuppressErrors suppressErrors(this, mInFailingSupportsRule);
+
  // Map property name to its ID and then parse the property
  nsCSSProperty propID = nsCSSProps::LookupProperty(propertyName,
                                                    nsCSSProps::eEnabled);
--- a/layout/style/nsStyleSet.cpp
+++ b/layout/style/nsStyleSet.cpp
@ -516,7 +516,8 @@ ReplaceAnimationRule(nsRuleNode *aOldRuleNode,
  }

  NS_ABORT_IF_FALSE(!IsMoreSpecificThanAnimation(n) &&
-                    n->GetLevel() != nsStyleSet::eAnimationSheet,
+                    (n->IsRoot() ||
+                     n->GetLevel() != nsStyleSet::eAnimationSheet),
                    "wrong level");

  if (aNewAnimRule) {
--- a/layout/svg/nsSVGImageFrame.cpp
+++ b/layout/svg/nsSVGImageFrame.cpp
@ -485,8 +485,10 @@ nsSVGImageFrame::ReflowSVG()
  gfxMatrix scaling;
  if (applyScaling) {
    scaling.Scale(scaleFactors.width, scaleFactors.height);
-  } 
+  }
+  tmpCtx.Save();
  GeneratePath(&tmpCtx, scaling);
+  tmpCtx.Restore();
  gfxRect extent = tmpCtx.GetUserPathExtent();
  if (applyScaling) {
    extent.Scale(1 / scaleFactors.width, 1 / scaleFactors.height);
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
@ -186,6 +186,12 @@ public:
          }
          break;
        }
+
+      case UPDATELOCALDESC:
+      case UPDATEREMOTEDESC:
+        /* No action necessary */
+        break;
+
      default:
        CSFLogDebugS(logTag, ": **** UNHANDLED CALL STATE : " << mStateStr);
        break;
@ -502,6 +508,9 @@ PeerConnectionImpl::CreateDataChannel(const nsACString& aLabel,

  CSFLogDebugS(logTag, __FUNCTION__ << ": making DOMDataChannel");

+  // TODO -- need something like "mCall->addStream(stream_id, 0, DATA);" so
+  // the SDP can be generated correctly
+
  return NS_NewDOMDataChannel(dataChannel.forget(), mWindow, aRetval);
 #else
  return NS_OK;
@ -896,6 +905,8 @@ PeerConnectionImpl::CheckApiState(bool assert_ice_ready) const

  if (mReadyState == kClosed)
    return NS_ERROR_FAILURE;
+  if (!mMedia)
+    return NS_ERROR_FAILURE;
  return NS_OK;
 }

@ -978,11 +989,15 @@ PeerConnectionImpl::onCallEvent(ccapi_call_event_e aCallEvent,

  switch (event) {
    case SETLOCALDESC:
-      mLocalSDP = mLocalRequestedSDP;
+    case UPDATELOCALDESC:
+      mLocalSDP = aInfo->getSDP();
      break;
+
    case SETREMOTEDESC:
-      mRemoteSDP = mRemoteRequestedSDP;
+    case UPDATEREMOTEDESC:
+      mRemoteSDP = aInfo->getSDP();
      break;
+
    case CONNECTED:
      CSFLogDebugS(logTag, "Setting PeerConnnection state to kActive");
      ChangeReadyState(kActive);
@ -1045,17 +1060,19 @@ PeerConnectionImpl::GetHandle()
 void
 PeerConnectionImpl::IceGatheringCompleted(NrIceCtx *aCtx)
 {
+  // Do an async call here to unwind the stack. refptr keeps the PC alive.
+  nsRefPtr<PeerConnectionImpl> pc(this);
  RUN_ON_THREAD(mThread,
-                WrapRunnable(this,
+                WrapRunnable(pc,
                             &PeerConnectionImpl::IceGatheringCompleted_m,
                             aCtx),
-                NS_DISPATCH_SYNC);
+                NS_DISPATCH_NORMAL);
 }

-void
+nsresult
 PeerConnectionImpl::IceGatheringCompleted_m(NrIceCtx *aCtx)
 {
-  PC_AUTO_ENTER_API_CALL_NO_CHECK();
+  PC_AUTO_ENTER_API_CALL(false);
  MOZ_ASSERT(aCtx);

  CSFLogDebugS(logTag, __FUNCTION__ << ": ctx: " << static_cast<void*>(aCtx));
@ -1072,22 +1089,25 @@ PeerConnectionImpl::IceGatheringCompleted_m(NrIceCtx *aCtx)
                  NS_DISPATCH_NORMAL);
  }
 #endif
+  return NS_OK;
 }

 void
 PeerConnectionImpl::IceCompleted(NrIceCtx *aCtx)
 {
+  // Do an async call here to unwind the stack. refptr keeps the PC alive.
+  nsRefPtr<PeerConnectionImpl> pc(this);
  RUN_ON_THREAD(mThread,
-                WrapRunnable(this,
+                WrapRunnable(pc,
                             &PeerConnectionImpl::IceCompleted_m,
                             aCtx),
-                NS_DISPATCH_SYNC);
+                NS_DISPATCH_NORMAL);
 }

-void
+nsresult
 PeerConnectionImpl::IceCompleted_m(NrIceCtx *aCtx)
 {
-  PC_AUTO_ENTER_API_CALL_NO_CHECK();
+  PC_AUTO_ENTER_API_CALL(false);
  MOZ_ASSERT(aCtx);

  CSFLogDebugS(logTag, __FUNCTION__ << ": ctx: " << static_cast<void*>(aCtx));
@ -1104,6 +1124,7 @@ PeerConnectionImpl::IceCompleted_m(NrIceCtx *aCtx)
                  NS_DISPATCH_NORMAL);
  }
 #endif
+  return NS_OK;
 }

 void
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
@ -217,8 +217,8 @@ private:
  void ShutdownMedia(bool isSynchronous);

  // ICE callbacks run on the right thread.
-  void IceGatheringCompleted_m(NrIceCtx *aCtx);
-  void IceCompleted_m(NrIceCtx *aCtx);
+  nsresult IceGatheringCompleted_m(NrIceCtx *aCtx);
+  nsresult IceCompleted_m(NrIceCtx *aCtx);

  // The role we are adopting
  Role mRole;
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
@ -245,6 +245,8 @@ PeerConnectionMedia::DisconnectMediaStreams()
 void
 PeerConnectionMedia::ShutdownMediaTransport()
 {
+  mIceCtx->SignalCompleted.disconnect(this);
+  mIceCtx->SignalGatheringCompleted.disconnect(this);
  mTransportFlows.clear();
  mIceStreams.clear();
  mIceCtx = NULL;
--- a/media/webrtc/signaling/src/sipcc/core/ccapp/ccprovider.c
+++ b/media/webrtc/signaling/src/sipcc/core/ccapp/ccprovider.c
@ -983,6 +983,7 @@ session_data_t * getDeepCopyOfSessionData(session_data_t *data)
           newData->plcd_name =  strlib_copy(data->plcd_name);
           newData->plcd_number =  strlib_copy(data->plcd_number);
           newData->status =  strlib_copy(data->status);
+           newData->sdp = strlib_copy(data->sdp);
           calllogger_copy_call_log(&newData->call_log, &data->call_log);
       } else {
           newData->ref_count = 1;
@ -1001,6 +1002,7 @@ session_data_t * getDeepCopyOfSessionData(session_data_t *data)
           newData->plcd_name =  strlib_empty();
           newData->plcd_number =  strlib_empty();
           newData->status = strlib_empty();
+           newData->sdp = strlib_empty();
           calllogger_init_call_log(&newData->call_log);
       }

@ -1045,6 +1047,8 @@ void cleanSessionData(session_data_t *data)
        data->plcd_number = strlib_empty();
 	strlib_free(data->status);
        data->status = strlib_empty();
+	strlib_free(data->sdp);
+        data->sdp = strlib_empty();
        calllogger_free_call_log(&data->call_log);
    }
 }
@ -1296,7 +1300,11 @@ cc_call_handle_t ccappGetConnectedCall(){
 static void ccappUpdateSessionData (session_update_t *sessUpd)
 {
    static const char fname[] = "ccappUpdateSessionData";
-	session_data_t * data = (session_data_t *)findhash(sessUpd->sessionID), *sess_data_p;
+    /* TODO -- I don't think the hash handling is synchronized; we could
+       end up with data integrity issues here if we end up in a race.
+       <adam@nostrum.com> */
+    session_data_t *data = (session_data_t *)findhash(sessUpd->sessionID);
+    session_data_t *sess_data_p;
    boolean createdSessionData = TRUE;
    cc_deviceinfo_ref_t  handle = 0;
    boolean previouslyInConference = FALSE;
@ -1304,11 +1312,16 @@ static void ccappUpdateSessionData (session_update_t *sessUpd)
    if ( data == NULL ) {
        cc_call_state_t call_state = sessUpd->update.ccSessionUpd.data.state_data.state;

-        if ( ( sessUpd->eventID == CALL_INFORMATION ) ||
-                ( sessUpd->eventID == CALL_STATE || sessUpd->eventID == CALL_NEWCALL
-                || sessUpd->eventID == CREATE_OFFER || sessUpd->eventID == CREATE_ANSWER
-                || sessUpd->eventID == SET_LOCAL_DESC  || sessUpd->eventID == SET_REMOTE_DESC
-                || sessUpd->eventID == REMOTE_STREAM_ADD)) {
+        if ( sessUpd->eventID == CALL_INFORMATION ||
+             sessUpd->eventID == CALL_STATE ||
+             sessUpd->eventID == CALL_NEWCALL ||
+             sessUpd->eventID == CREATE_OFFER ||
+             sessUpd->eventID == CREATE_ANSWER ||
+             sessUpd->eventID == SET_LOCAL_DESC  ||
+             sessUpd->eventID == SET_REMOTE_DESC ||
+             sessUpd->eventID == UPDATE_LOCAL_DESC  ||
+             sessUpd->eventID == UPDATE_REMOTE_DESC ||
+             sessUpd->eventID == REMOTE_STREAM_ADD ) {

            CCAPP_DEBUG(DEB_F_PREFIX"CALL_SESSION_CREATED for session id 0x%x event is 0x%x \n",
                    DEB_F_PREFIX_ARGS(SIP_CC_PROV, fname), sessUpd->sessionID,
@ -1343,9 +1356,14 @@ static void ccappUpdateSessionData (session_update_t *sessUpd)
        data->sess_id = sessUpd->sessionID;
 				data->state = call_state;
        data->line = sessUpd->update.ccSessionUpd.data.state_data.line_id;
-        if (sessUpd->eventID == CALL_NEWCALL || sessUpd->eventID == CREATE_OFFER ||
-            sessUpd->eventID == CREATE_ANSWER || sessUpd->eventID == SET_LOCAL_DESC ||
-            sessUpd->eventID == SET_REMOTE_DESC || sessUpd->eventID == REMOTE_STREAM_ADD ) {
+        if (sessUpd->eventID == CALL_NEWCALL ||
+            sessUpd->eventID == CREATE_OFFER ||
+            sessUpd->eventID == CREATE_ANSWER ||
+            sessUpd->eventID == SET_LOCAL_DESC ||
+            sessUpd->eventID == SET_REMOTE_DESC ||
+            sessUpd->eventID == UPDATE_LOCAL_DESC ||
+            sessUpd->eventID == UPDATE_REMOTE_DESC ||
+            sessUpd->eventID == REMOTE_STREAM_ADD ) {
            data->attr = sessUpd->update.ccSessionUpd.data.state_data.attr;
            data->inst = sessUpd->update.ccSessionUpd.data.state_data.inst;
        }
@ -1365,15 +1383,28 @@ static void ccappUpdateSessionData (session_update_t *sessUpd)
        data->gci[0] = 0;
 	data->vid_dir = SDP_DIRECTION_INACTIVE;
        data->callref = 0;
+        data->sdp = strlib_empty();
        calllogger_init_call_log(&data->call_log);

-        if ( sessUpd->eventID == CREATE_OFFER || sessUpd->eventID == CREATE_ANSWER
-            || sessUpd->eventID == SET_LOCAL_DESC  || sessUpd->eventID == SET_REMOTE_DESC
-            || sessUpd->eventID == REMOTE_STREAM_ADD) {
-        	data->sdp = sessUpd->update.ccSessionUpd.data.state_data.sdp;
-        	data->cause = sessUpd->update.ccSessionUpd.data.state_data.cause;
-            data->media_stream_track_id = sessUpd->update.ccSessionUpd.data.state_data.media_stream_track_id;
-            data->media_stream_id = sessUpd->update.ccSessionUpd.data.state_data.media_stream_id;
+        switch (sessUpd->eventID) {
+            case CREATE_OFFER:
+            case CREATE_ANSWER:
+            case SET_LOCAL_DESC:
+            case SET_REMOTE_DESC:
+            case UPDATE_LOCAL_DESC:
+            case UPDATE_REMOTE_DESC:
+                data->sdp = sessUpd->update.ccSessionUpd.data.state_data.sdp;
+                /* Fall through to the next case... */
+            case REMOTE_STREAM_ADD:
+                data->cause =
+                    sessUpd->update.ccSessionUpd.data.state_data.cause;
+                data->media_stream_track_id = sessUpd->update.ccSessionUpd.data.
+                    state_data.media_stream_track_id;
+                data->media_stream_id = sessUpd->update.ccSessionUpd.data.
+                    state_data.media_stream_id;
+                break;
+            default:
+                break;
        }

        /*
@ -1697,8 +1728,11 @@ static void ccappUpdateSessionData (session_update_t *sessUpd)
    case CREATE_ANSWER:
    case SET_LOCAL_DESC:
    case SET_REMOTE_DESC:
-    case REMOTE_STREAM_ADD:
+    case UPDATE_LOCAL_DESC:
+    case UPDATE_REMOTE_DESC:
        data->sdp = sessUpd->update.ccSessionUpd.data.state_data.sdp;
+        /* Fall through to the next case... */
+    case REMOTE_STREAM_ADD:
        data->cause = sessUpd->update.ccSessionUpd.data.state_data.cause;
        data->state = sessUpd->update.ccSessionUpd.data.state_data.state;
        data->media_stream_track_id = sessUpd->update.ccSessionUpd.data.state_data.media_stream_track_id;
--- a/media/webrtc/signaling/src/sipcc/core/common/ui.c
+++ b/media/webrtc/signaling/src/sipcc/core/common/ui.c
@ -25,6 +25,7 @@
 #include "platform_api.h"
 #include "vcm.h"
 #include "ccapp_task.h"
+#include "peer_connection_types.h"

 /*
 * Note: Do not include "msprovider.h" here unless the dependencies on
@ -95,6 +96,7 @@ void
 ui_call_state (call_events event, line_t nLine, callid_t nCallID, cc_causes_t cause)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"event=%d \n", DEB_L_C_F_PREFIX_ARGS(UI_API, nLine, nCallID, __FUNCTION__),
              event);
@ -131,6 +133,7 @@ ui_new_call (call_events event, line_t nLine, callid_t nCallID,
             int call_attr, uint16_t call_instance_id, boolean dialed_digits)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"state=%d attr=%d call_instance=%d, dialed_digits=%s\n",
              DEB_L_C_F_PREFIX_ARGS(UI_API, nLine, nCallID, __FUNCTION__), event, call_attr, call_instance_id, (dialed_digits)? "true" : "false");
@ -172,6 +175,7 @@ void
 ui_set_call_attr (line_t line_id, callid_t call_id, call_attr_t attr)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"attr=%d\n", DEB_L_C_F_PREFIX_ARGS(UI_API, line_id, call_id, __FUNCTION__), attr);

@ -202,6 +206,7 @@ void
 ui_update_callref (line_t line, callid_t call_id, unsigned int callref)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"callref = %d\n", DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__), callref);

@ -237,6 +242,7 @@ void
 ui_update_gcid (line_t line, callid_t call_id, char *gcid)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"gcid = %s\n", DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__), gcid);

@ -270,6 +276,7 @@ void
 ui_update_video_avail (line_t line, callid_t call_id, int avail)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX, DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__));

@ -291,6 +298,7 @@ ui_update_video_avail (line_t line, callid_t call_id, int avail)

 void ui_update_media_interface_change(line_t line, callid_t call_id, group_call_event_t event) {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    if (event != MEDIA_INTERFACE_UPDATE_BEGIN &&
        event != MEDIA_INTERFACE_UPDATE_SUCCESSFUL &&
@ -324,6 +332,7 @@ void
 ui_call_stop_ringer (line_t line, callid_t call_id)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX, DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__));

@ -348,6 +357,7 @@ void
 ui_call_start_ringer (vcm_ring_mode_t ringMode, short once, line_t line, callid_t call_id)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX, DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__));

@ -381,6 +391,7 @@ void
 ui_update_video_offered (line_t line, callid_t call_id, int avail)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX, DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__));

@ -447,6 +458,8 @@ ui_call_info (string_t pCallingPartyNameStr,
    char       lineName[MAX_LINE_NAME_SIZE];
    char       lineNumber[MAX_LINE_NAME_SIZE];

+    memset( &msg, 0, sizeof(session_update_t));
+

    TNP_DEBUG(DEB_L_C_F_PREFIX"call instance=%d callednum=%s calledname=%s clngnum=%s clngname = %s\n",
        DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__), call_instance_id, pCalledPartyNumberStr,
@ -531,6 +544,7 @@ void
 ui_cc_capability (line_t line, callid_t call_id, string_t recv_info_list)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"recv_info_list:%s\n",
        DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__),
@ -592,6 +606,7 @@ static void
 ui_set_call_status_display (string_t status, line_t line, callid_t callID, int timeout, char priority)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"the stat string =%s, timeout= %d, priority=%d\n", DEB_L_C_F_PREFIX_ARGS(UI_API, line, callID, __FUNCTION__),
              status,
@ -1036,6 +1051,7 @@ ui_update_placed_call_info (line_t line, callid_t call_id, string_t cldName,
                            string_t cldNumber)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"calledName:calledNumber %s:%s\n",
              DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__), cldName, cldNumber);
@ -1077,6 +1093,7 @@ void
 ui_delete_last_digit (line_t line_id, callid_t call_id)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"called\n", DEB_L_C_F_PREFIX_ARGS(UI_API, line_id, call_id, __FUNCTION__));

@ -1106,6 +1123,7 @@ void
 ui_control_featurekey_bksp (line_t line_id, callid_t call_id, boolean enable)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"enable=%d\n", DEB_L_C_F_PREFIX_ARGS(UI_API, line_id, call_id, __FUNCTION__),
              enable);
@ -1134,6 +1152,7 @@ void
 ui_call_selected (line_t line_id, callid_t call_id, int selected)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"selected=%d\n",
              DEB_L_C_F_PREFIX_ARGS(UI_API, line_id, call_id, __FUNCTION__), selected);
@ -1221,6 +1240,7 @@ ui_select_feature_key_set (line_t line_id, callid_t call_id, char *set_name,
 {
    int i;
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"called\n", DEB_L_C_F_PREFIX_ARGS(UI_API, line_id, call_id, __FUNCTION__));

@ -1234,8 +1254,6 @@ ui_select_feature_key_set (line_t line_id, callid_t call_id, char *set_name,
        return;
    }

-    memset( &msg, 0, sizeof(session_update_t));
-
    msg.sessionID = createSessionId(line_id, call_id);
    msg.eventID = CALL_SELECT_FEATURE_SET;

@ -1299,6 +1317,7 @@ ui_update_call_security (line_t line, callid_t call_id,
                        cc_security_e call_security)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"security=%d\n", DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__),
              call_security);
@ -1338,6 +1357,7 @@ ui_terminate_feature (line_t line, callid_t call_id,
                        callid_t target_call_id)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    TNP_DEBUG(DEB_L_C_F_PREFIX"target_call_id=%d\n", DEB_L_C_F_PREFIX_ARGS(UI_API, line, call_id, __FUNCTION__),
              target_call_id);
@ -1486,6 +1506,7 @@ void ui_log_disposition (callid_t call_id, int logdisp)
 {
    session_update_t msg;
    fsmdef_dcb_t *dcb = fsmdef_get_dcb_by_call_id(call_id);
+    memset( &msg, 0, sizeof(session_update_t));


    if (call_id == CC_NO_CALL_ID || dcb == NULL) {
@ -1532,10 +1553,11 @@ static void post_message_helper(
    line_t nLine,
    callid_t nCallId,
    uint16_t call_instance_id,
-    char *sdp,
+    string_t sdp,
    cc_int32_t status)
 {
    session_update_t msg;
+    memset( &msg, 0, sizeof(session_update_t));

    if (nCallId == CC_NO_CALL_ID) {
        /* no operation when no call ID */
@ -1567,7 +1589,7 @@ static void post_message_helper(
 *  @return none
 */
 void ui_create_offer(call_events event, line_t nLine, callid_t nCallID,
-                 	 uint16_t call_instance_id, char* sdp)
+                 	 uint16_t call_instance_id, string_t sdp)
 {
    TNP_DEBUG(DEB_L_C_F_PREFIX"state=%d attr=%d call_instance=%d\n",
              DEB_L_C_F_PREFIX_ARGS(UI_API, nLine, nCallID, __FUNCTION__), event, call_instance_id);
@ -1584,7 +1606,7 @@ void ui_create_offer(call_events event, line_t nLine, callid_t nCallID,
 *  @return none
 */
 void ui_create_answer(call_events event, line_t nLine, callid_t nCallID,
-                 	 uint16_t call_instance_id, char* sdp)
+                 	 uint16_t call_instance_id, string_t sdp)
 {
    TNP_DEBUG(DEB_L_C_F_PREFIX"state=%d call_instance=%d\n",
              DEB_L_C_F_PREFIX_ARGS(UI_API, nLine, nCallID, __FUNCTION__), event, call_instance_id);
@ -1601,7 +1623,7 @@ void ui_create_answer(call_events event, line_t nLine, callid_t nCallID,
 */

 void ui_set_local_description(call_events event, line_t nLine, callid_t nCallID,
-                 	 uint16_t call_instance_id, char* sdp, cc_int32_t status)
+                 	 uint16_t call_instance_id, string_t sdp, cc_int32_t status)
 {
    TNP_DEBUG(DEB_L_C_F_PREFIX"state=%d call_instance=%d\n",
              DEB_L_C_F_PREFIX_ARGS(UI_API, nLine, nCallID, __FUNCTION__), event, call_instance_id);
@ -1618,7 +1640,7 @@ void ui_set_local_description(call_events event, line_t nLine, callid_t nCallID,
 */

 void ui_set_remote_description(call_events event, line_t nLine, callid_t nCallID,
-                 	 uint16_t call_instance_id, char* sdp, cc_int32_t status)
+                 	 uint16_t call_instance_id, string_t sdp, cc_int32_t status)
 {
    TNP_DEBUG(DEB_L_C_F_PREFIX"state=%d call_instance=%d\n",
              DEB_L_C_F_PREFIX_ARGS(UI_API, nLine, nCallID, __FUNCTION__), event, call_instance_id);
@ -1628,6 +1650,44 @@ void ui_set_remote_description(call_events event, line_t nLine, callid_t nCallID
    return;
 }

+/**
+ *  Let PeerConnection know about an updated local session description
+ *
+ *  @return none
+ */
+
+void ui_update_local_description(call_events event, line_t nLine, callid_t nCallID,
+                 	 uint16_t call_instance_id, string_t sdp)
+{
+    TNP_DEBUG(DEB_L_C_F_PREFIX"state=%d call_instance=%d\n",
+              DEB_L_C_F_PREFIX_ARGS(UI_API, nLine, nCallID, __FUNCTION__),
+              event, call_instance_id);
+
+    post_message_helper(UPDATE_LOCAL_DESC, event, nLine, nCallID, call_instance_id,
+                        sdp, PC_OK);
+
+    return;
+}
+
+/**
+ *  Let PeerConnection know about an updated remote session description
+ *
+ *  @return none
+ */
+
+void ui_update_remote_description(call_events event, line_t nLine, callid_t nCallID,
+                 	 uint16_t call_instance_id, string_t sdp)
+{
+    TNP_DEBUG(DEB_L_C_F_PREFIX"state=%d call_instance=%d\n",
+              DEB_L_C_F_PREFIX_ARGS(UI_API, nLine, nCallID, __FUNCTION__),
+              event, call_instance_id);
+
+    post_message_helper(UPDATE_REMOTE_DESC, event, nLine, nCallID,
+                        call_instance_id, sdp, PC_OK);
+
+    return;
+}
+

 /**
 *  Send Remote Stream data to the UI
@ -1639,6 +1699,7 @@ void ui_on_remote_stream_added(call_events event, line_t nLine, callid_t nCallID
 {
    session_update_t msg;
    fsmdef_dcb_t *dcb = fsmdef_get_dcb_by_call_id(nCallID);
+    memset( &msg, 0, sizeof(session_update_t));

    if (nCallID == CC_NO_CALL_ID || dcb == NULL) {
        /* no operation when no call ID */
--- a/media/webrtc/signaling/src/sipcc/core/gsm/fsmdef.c
+++ b/media/webrtc/signaling/src/sipcc/core/gsm/fsmdef.c
@ -2905,7 +2905,8 @@ fsmdef_ev_createoffer (sm_event_t *event) {

    vcmGetIceParams(dcb->peerconnection, &ufrag, &ice_pwd);
    if (!ufrag || !ice_pwd) {
-      ui_create_offer(evCreateOfferError, line, call_id, dcb->caller_id.call_instance_id, NULL);
+      ui_create_offer(evCreateOfferError, line, call_id,
+          dcb->caller_id.call_instance_id, strlib_empty());
      return (fsmdef_release(fcb, cause, FALSE));
    }

@ -2935,20 +2936,26 @@ fsmdef_ev_createoffer (sm_event_t *event) {

    cause = gsmsdp_create_local_sdp(dcb, FALSE, TRUE, TRUE, TRUE, TRUE);
    if (cause != CC_CAUSE_OK) {
-        ui_create_offer(evCreateOfferError, line, call_id, dcb->caller_id.call_instance_id, NULL);
+        ui_create_offer(evCreateOfferError, line, call_id,
+            dcb->caller_id.call_instance_id, strlib_empty());
        FSM_DEBUG_SM(get_debug_string(FSM_DBG_SDP_BUILD_ERR));
        return (fsmdef_release(fcb, cause, FALSE));
    }

    cause = gsmsdp_encode_sdp_and_update_version(dcb, &msg_body);
    if (cause != CC_CAUSE_OK) {
-        ui_create_offer(evCreateOfferError, line, call_id, dcb->caller_id.call_instance_id, NULL);
+        cc_free_msg_body_parts(&msg_body);
+        ui_create_offer(evCreateOfferError, line, call_id,
+            dcb->caller_id.call_instance_id, strlib_empty());
        FSM_DEBUG_SM(get_debug_string(FSM_DBG_SDP_BUILD_ERR));
        return (fsmdef_release(fcb, cause, FALSE));
    }

    /* Pass offer SDP back to UI */
-    ui_create_offer(evCreateOffer, line, call_id, dcb->caller_id.call_instance_id, msg_body.parts[0].body);
+    ui_create_offer(evCreateOffer, line, call_id,
+        dcb->caller_id.call_instance_id,
+        strlib_malloc(msg_body.parts[0].body, -1));
+    cc_free_msg_body_parts(&msg_body);

    return (SM_RC_END);
 }
@ -3012,7 +3019,8 @@ fsmdef_ev_createanswer (sm_event_t *event) {

    vcmGetIceParams(dcb->peerconnection, &ufrag, &ice_pwd);
    if (!ufrag || !ice_pwd) {
-      ui_create_offer(evCreateAnswerError, line, call_id, dcb->caller_id.call_instance_id, NULL);
+      ui_create_offer(evCreateAnswerError, line, call_id,
+          dcb->caller_id.call_instance_id, strlib_empty());
      return (fsmdef_release(fcb, cause, FALSE));
    }

@ -3050,9 +3058,10 @@ fsmdef_ev_createanswer (sm_event_t *event) {
     * The sdp member of the dcb has local and remote sdp
     * this next function fills in the local part
     */
-    cause = gsmsdp_create_local_sdp(dcb, FALSE, has_audio, has_video, has_data, FALSE);
+    cause = gsmsdp_create_local_sdp(dcb, TRUE, has_audio, has_video, has_data, FALSE);
    if (cause != CC_CAUSE_OK) {
-        ui_create_answer(evCreateAnswerError, line, call_id, dcb->caller_id.call_instance_id, NULL);
+        ui_create_answer(evCreateAnswerError, line, call_id,
+            dcb->caller_id.call_instance_id, strlib_empty());
        FSM_DEBUG_SM(get_debug_string(FSM_DBG_SDP_BUILD_ERR));
        // Force clean up call without sending release
        return (fsmdef_release(fcb, cause, FALSE));
@ -3061,22 +3070,32 @@ fsmdef_ev_createanswer (sm_event_t *event) {
    /* TODO(ekr@rtfm.com): The second true is because we are acting as if we are
       processing an offer. The first, however, is for an initial offer and we may
       want to set that conditionally. */
-    cause = gsmsdp_negotiate_media_lines(fcb, dcb->sdp, TRUE, TRUE, FALSE, TRUE);
+    cause = gsmsdp_negotiate_media_lines(fcb, dcb->sdp,
+            /* initial_offer */       TRUE,
+            /* offer */               TRUE,
+            /* notify_stream_added */ FALSE,
+            /* create_answer */       TRUE);

    if (cause != CC_CAUSE_OK) {
-        ui_create_answer(evCreateAnswerError, line, call_id, dcb->caller_id.call_instance_id, NULL);
+        ui_create_answer(evCreateAnswerError, line, call_id,
+            dcb->caller_id.call_instance_id, strlib_empty());
        return (fsmdef_release(fcb, cause, FALSE));
    }

    cause = gsmsdp_encode_sdp_and_update_version(dcb, &msg_body);
    if (cause != CC_CAUSE_OK) {
-        ui_create_answer(evCreateAnswerError, line, call_id, dcb->caller_id.call_instance_id, NULL);
+        cc_free_msg_body_parts(&msg_body);
+        ui_create_answer(evCreateAnswerError, line, call_id,
+            dcb->caller_id.call_instance_id, strlib_empty());
        FSM_DEBUG_SM(get_debug_string(FSM_DBG_SDP_BUILD_ERR));
        return (fsmdef_release(fcb, cause, FALSE));
    }

    /* Pass SDP back to UI */
-    ui_create_answer(evCreateAnswer, line, call_id, dcb->caller_id.call_instance_id, msg_body.parts[0].body);
+    ui_create_answer(evCreateAnswer, line, call_id,
+        dcb->caller_id.call_instance_id,
+        strlib_malloc(msg_body.parts[0].body, -1));
+    cc_free_msg_body_parts(&msg_body);

    return (SM_RC_END);
 }
@ -3099,12 +3118,16 @@ fsmdef_ev_setlocaldesc(sm_event_t *event) {
    callid_t            call_id = msg->call_id;
    line_t              line = msg->line;
    cc_causes_t         lsm_rc;
+    char                *local_sdp = 0;
+    uint32_t            local_sdp_len = 0;

    FSM_DEBUG_SM(DEB_F_PREFIX"Entered.\n", DEB_F_PREFIX_ARGS(FSM, __FUNCTION__));

    config_get_value(CFGID_SDPMODE, &sdpmode, sizeof(sdpmode));
    if (!sdpmode) {
-        ui_set_local_description(evSetLocalDescError, line, call_id, dcb->caller_id.call_instance_id, NULL, PC_SETLOCALDESCERROR);
+        ui_set_local_description(evSetLocalDescError, line, call_id,
+            dcb->caller_id.call_instance_id, strlib_empty(),
+            PC_SETLOCALDESCERROR);
        return (SM_RC_END);
    }

@ -3116,15 +3139,20 @@ fsmdef_ev_setlocaldesc(sm_event_t *event) {
    if (JSEP_OFFER == action) {
        cause = gsmsdp_encode_sdp(dcb->sdp, &msg_body);
        if (cause != CC_CAUSE_OK) {
+            cc_free_msg_body_parts(&msg_body);
            FSM_DEBUG_SM(get_debug_string(FSM_DBG_SDP_BUILD_ERR));
-            ui_set_local_description(evSetLocalDescError, line, call_id, dcb->caller_id.call_instance_id, NULL, PC_SETLOCALDESCERROR);
+            ui_set_local_description(evSetLocalDescError, line, call_id,
+                dcb->caller_id.call_instance_id, strlib_empty(),
+                PC_SETLOCALDESCERROR);
            return (SM_RC_END);
        }

        /* compare and fail if different:
         * anant: Why? The JS should be able to modify the SDP. Commenting out for now (same for answer)
        if (strcmp(msg_body.parts[0].body, sdp) != 0) {
-            ui_set_local_description(evSetLocalDescError, line, call_id, dcb->caller_id.call_instance_id, NULL, PC_SDPCHANGED);
+            ui_set_local_description(evSetLocalDescError, line, call_id,
+                dcb->caller_id.call_instance_id, strlib_empty(), PC_SDPCHANGED);
+            cc_free_msg_body_parts(&msg_body);
            return (SM_RC_END);
        }
        */
@ -3136,14 +3164,19 @@ fsmdef_ev_setlocaldesc(sm_event_t *event) {
        /* compare SDP generated from CreateAnswer */
        cause = gsmsdp_encode_sdp(dcb->sdp, &msg_body);
        if (cause != CC_CAUSE_OK) {
+            cc_free_msg_body_parts(&msg_body);
            FSM_DEBUG_SM(get_debug_string(FSM_DBG_SDP_BUILD_ERR));
-            ui_set_local_description(evSetLocalDescError, line, call_id, dcb->caller_id.call_instance_id, NULL, PC_SETLOCALDESCERROR);
+            ui_set_local_description(evSetLocalDescError, line, call_id,
+                dcb->caller_id.call_instance_id, strlib_empty(),
+                PC_SETLOCALDESCERROR);
            return (SM_RC_END);
        }

        /* compare and fail if different
        if (strcmp(msg_body.parts[0].body, sdp) != 0) {
-            ui_set_local_description(evSetLocalDescError, line, call_id, dcb->caller_id.call_instance_id, NULL, PC_SDPCHANGED);
+            cc_free_msg_body_parts(&msg_body);
+            ui_set_local_description(evSetLocalDescError, line, call_id,
+                dcb->caller_id.call_instance_id, strlib_empty(), PC_SDPCHANGED);
            return (SM_RC_END);
        }*/

@ -3161,7 +3194,8 @@ fsmdef_ev_setlocaldesc(sm_event_t *event) {
         */
        cause = gsmsdp_install_peer_ice_attributes(fcb);
        if (cause != CC_CAUSE_OK) {
-            ui_set_local_description(evSetLocalDescError, line, call_id, dcb->caller_id.call_instance_id, NULL, PC_SDPCHANGED);
+            ui_set_local_description(evSetLocalDescError, line, call_id,
+                dcb->caller_id.call_instance_id, strlib_empty(), PC_SDPCHANGED);
            return (SM_RC_END);
        }

@ -3183,8 +3217,20 @@ fsmdef_ev_setlocaldesc(sm_event_t *event) {
        fsm_change_state(fcb, __LINE__, FSMDEF_S_CONNECTED);

    }
+    /* We're done with the msg_body contents -- free them.*/
+    cc_free_msg_body_parts(&msg_body);

-    ui_set_local_description(evSetLocalDesc, line, call_id, dcb->caller_id.call_instance_id, NULL, PC_OK);
+    /* Encode the current local SDP structure into a char buffer */
+    local_sdp = sipsdp_write_to_buf(dcb->sdp->src_sdp, &local_sdp_len);
+    if (!local_sdp) {
+        ui_set_local_description(evSetLocalDescError, line, call_id,
+            dcb->caller_id.call_instance_id, strlib_empty(),
+            PC_SETLOCALDESCERROR);
+        return (SM_RC_END);
+    }
+    ui_set_local_description(evSetLocalDesc, line, call_id,
+        dcb->caller_id.call_instance_id, strlib_malloc(local_sdp,-1), PC_OK);
+    free(local_sdp);

    return (SM_RC_END);
 }
@ -3211,13 +3257,16 @@ fsmdef_ev_setremotedesc(sm_event_t *event) {
    boolean             has_audio;
    boolean             has_video;
    boolean             has_data;
+    char                *remote_sdp = 0;
+    uint32_t            remote_sdp_len = 0;

    FSM_DEBUG_SM(DEB_F_PREFIX"Entered.\n", DEB_F_PREFIX_ARGS(FSM, __FUNCTION__));

    config_get_value(CFGID_SDPMODE, &sdpmode, sizeof(sdpmode));
    if (!sdpmode) {
        ui_set_remote_description(evSetRemoteDescError, line, call_id,
-            dcb->caller_id.call_instance_id, NULL, PC_SETREMOTEDESCERROR);
+            dcb->caller_id.call_instance_id, strlib_empty(),
+            PC_SETREMOTEDESCERROR);
        return (SM_RC_END);
    }

@ -3228,6 +3277,13 @@ fsmdef_ev_setremotedesc(sm_event_t *event) {

    cc_initialize_msg_body_parts_info(&msg_body);

+    /* !!! NOTE !!! The following code sets up the pointers inside
+       msg_body.parts[0] to point directly to the buffers from the
+       event->msg structure. While this is more efficient than
+       copying them, we must take exceptional care not to call
+       cc_free_msg_body_parts() on this particular msg_body, since
+       doing so would result in the buffers being freed twice. */
+
    msg_body.num_parts = 1;
    msg_body.content_type = cc_content_type_SDP;
    part = &msg_body.parts[0];
@ -3244,7 +3300,8 @@ fsmdef_ev_setremotedesc(sm_event_t *event) {
        cause = gsmsdp_process_offer_sdp(fcb, &msg_body, TRUE);
        if (cause != CC_CAUSE_OK) {
            ui_set_remote_description(evSetRemoteDescError, line, call_id,
-                dcb->caller_id.call_instance_id, NULL, PC_SETREMOTEDESCERROR);
+                dcb->caller_id.call_instance_id, strlib_empty(),
+                PC_SETREMOTEDESCERROR);
            return (SM_RC_END);
        }

@ -3260,8 +3317,9 @@ fsmdef_ev_setremotedesc(sm_event_t *event) {
         */
        cause = gsmsdp_create_local_sdp(dcb, TRUE, has_audio, has_video, has_data, FALSE);
        if (cause != CC_CAUSE_OK) {
-            ui_set_remote_description(evSetRemoteDescError, line, call_id, dcb->caller_id.call_instance_id,
-                NULL, PC_SETREMOTEDESCERROR);
+            ui_set_remote_description(evSetRemoteDescError, line, call_id,
+              dcb->caller_id.call_instance_id, strlib_empty(),
+              PC_SETREMOTEDESCERROR);
            FSM_DEBUG_SM(get_debug_string(FSM_DBG_SDP_BUILD_ERR));
            // Force clean up call without sending release
            return (fsmdef_release(fcb, cause, FALSE));
@ -3269,8 +3327,9 @@ fsmdef_ev_setremotedesc(sm_event_t *event) {

        cause = gsmsdp_negotiate_media_lines(fcb, dcb->sdp, TRUE, TRUE, TRUE, FALSE);
        if (cause != CC_CAUSE_OK) {
-            ui_set_remote_description(evSetRemoteDescError, line, call_id, dcb->caller_id.call_instance_id,
-                NULL, PC_SETREMOTEDESCERROR);
+            ui_set_remote_description(evSetRemoteDescError, line, call_id,
+              dcb->caller_id.call_instance_id, strlib_empty(),
+              PC_SETREMOTEDESCERROR);
            return (fsmdef_release(fcb, cause, FALSE));
        }

@ -3282,8 +3341,9 @@ fsmdef_ev_setremotedesc(sm_event_t *event) {

        cause = gsmsdp_negotiate_answer_sdp(fcb, &msg_body);
        if (cause != CC_CAUSE_OK) {
-            ui_set_remote_description(evSetRemoteDescError, line, call_id, dcb->caller_id.call_instance_id,
-                NULL, PC_SETREMOTEDESCERROR);
+            ui_set_remote_description(evSetRemoteDescError, line, call_id,
+                dcb->caller_id.call_instance_id, strlib_empty(),
+                PC_SETREMOTEDESCERROR);
            return (SM_RC_END);
        }

@ -3293,8 +3353,9 @@ fsmdef_ev_setremotedesc(sm_event_t *event) {
         */
        cause = gsmsdp_install_peer_ice_attributes(fcb);
        if (cause != CC_CAUSE_OK) {
-            ui_set_remote_description(evSetRemoteDescError, line, call_id, dcb->caller_id.call_instance_id,
-                NULL, PC_SETREMOTEDESCERROR);
+            ui_set_remote_description(evSetRemoteDescError, line, call_id,
+                dcb->caller_id.call_instance_id, strlib_empty(),
+                PC_SETREMOTEDESCERROR);
            return (SM_RC_END);
        }

@ -3309,12 +3370,31 @@ fsmdef_ev_setremotedesc(sm_event_t *event) {
        fsm_change_state(fcb, __LINE__, FSMDEF_S_CONNECTED);
    }

-    ui_set_remote_description(evSetRemoteDesc, line, call_id, dcb->caller_id.call_instance_id, NULL, PC_OK);
+    /* For the sake of accuracy, we regenerate the SDP text from our parsed
+       version: if we have any local variation in how we've interpreted the
+       received SDP, then localDescription will reflect that variation. In
+       practice, this shouldn't happen; but, if it does, at least this will
+       allow the WebRTC application to figure out what's going on. */
+
+    remote_sdp = sipsdp_write_to_buf(dcb->sdp->dest_sdp, &remote_sdp_len);
+
+    if (!remote_sdp) {
+        ui_set_remote_description(evSetRemoteDescError, line, call_id,
+            dcb->caller_id.call_instance_id, strlib_empty(),
+            PC_SETREMOTEDESCERROR);
+        return (SM_RC_END);
+    }
+
+    ui_set_remote_description(evSetRemoteDesc, line, call_id,
+        dcb->caller_id.call_instance_id, strlib_malloc(remote_sdp,-1),
+        PC_OK);
+
+    free(remote_sdp);

    return (SM_RC_END);
 }

-
+/* TODO -- remove me. See bug 821066. */
 static sm_rcs_t
 fsmdef_ev_localdesc(sm_event_t *event) {
    fsm_fcb_t           *fcb = (fsm_fcb_t *) event->data;
@ -3342,6 +3422,7 @@ fsmdef_ev_localdesc(sm_event_t *event) {
    return (SM_RC_END);
 }

+/* TODO -- remove me. See bug 821066. */
 static sm_rcs_t
 fsmdef_ev_remotedesc(sm_event_t *event) {
    fsm_fcb_t           *fcb = (fsm_fcb_t *) event->data;
@ -3517,6 +3598,10 @@ fsmdef_ev_addcandidate(sm_event_t *event) {
    int                 sdpmode = 0;
    short               vcm_res;
    uint16_t            level;
+    line_t              line = msg->line;
+    callid_t            call_id = msg->call_id;
+    char                *remote_sdp = 0;
+    uint32_t            remote_sdp_len = 0;


    FSM_DEBUG_SM(DEB_F_PREFIX"Entered.\n", DEB_F_PREFIX_ARGS(FSM, __FUNCTION__));
@ -3532,19 +3617,35 @@ fsmdef_ev_addcandidate(sm_event_t *event) {
        return SM_RC_CLEANUP;
    }

-
    /* Perform level lookup based on mid value */
    /* comment until mid is properly updated
    cause = gsmsdp_find_level_from_mid(dcb, (const char *)msg->data.candidate.mid, &level);
    */

+    /* Update remote SDP with new candidate information */
+    level = msg->data.candidate.level;
+    gsmsdp_set_ice_attribute (SDP_ATTR_ICE_CANDIDATE, level,
+      dcb->sdp->dest_sdp, (char *)msg->data.candidate.candidate);
+
    vcm_res = vcmSetIceCandidate(dcb->peerconnection, (char *)msg->data.candidate.candidate, msg->data.candidate.level);
    if(vcm_res) {
        FSM_DEBUG_SM(DEB_F_PREFIX"failure setting ice candidate.\n", DEB_F_PREFIX_ARGS(FSM, __FUNCTION__));
    }

+    /* Serialize the updated SDP and inform the PeerConnection of the
+       new SDP contents. */

-	return (SM_RC_END);
+    remote_sdp = sipsdp_write_to_buf(dcb->sdp->dest_sdp, &remote_sdp_len);
+
+    if (!remote_sdp) {
+        return (SM_RC_END);
+    }
+
+    ui_update_remote_description(evUpdateRemoteDesc, line, call_id,
+        dcb->caller_id.call_instance_id, strlib_malloc(remote_sdp,-1));
+
+    free(remote_sdp);
+    return (SM_RC_END);
 }

 static void
--- a/media/webrtc/signaling/src/sipcc/core/gsm/gsm_sdp.c
+++ b/media/webrtc/signaling/src/sipcc/core/gsm/gsm_sdp.c
@ -122,15 +122,33 @@ static const cc_media_cap_table_t *gsmsdp_get_media_capability (fsmdef_dcb_t *dc

    *(dcb_p->media_cap_tbl) = g_media_table;

-    /*
-     * Turn off two default streams, this is temporary
-     * until we can handle multiple streams properly
-     */
    if (sdpmode) {
-        dcb_p->media_cap_tbl->cap[CC_AUDIO_1].enabled = TRUE;
-        dcb_p->media_cap_tbl->cap[CC_VIDEO_1].enabled = TRUE;
-        dcb_p->media_cap_tbl->cap[CC_AUDIO_1].support_direction = SDP_DIRECTION_RECVONLY;
-        dcb_p->media_cap_tbl->cap[CC_VIDEO_1].support_direction = SDP_DIRECTION_RECVONLY;
+        /* This needs to change when we handle more than one stream
+           of each media type at a time. */
+
+        dcb_p->media_cap_tbl->cap[CC_AUDIO_1].enabled = FALSE;
+        dcb_p->media_cap_tbl->cap[CC_VIDEO_1].enabled = FALSE;
+
+        /* We initialize as RECVONLY to allow the application to
+           display incoming media streams, even if it doesn't
+           plan to send media for those streams. This will be
+           upgraded to SENDRECV when and if a stream is added. */
+
+        dcb_p->media_cap_tbl->cap[CC_AUDIO_1].support_direction =
+          SDP_DIRECTION_RECVONLY;
+
+        dcb_p->media_cap_tbl->cap[CC_VIDEO_1].support_direction =
+          SDP_DIRECTION_RECVONLY;
+
+        /*
+         * This really should be set to FALSE unless we have added
+         * a data channel using createDataChannel(). Right now,
+         * though, those operations are not queued (and, in fact,
+         * the W3C hasn't specified the proper behavior here anyway, so
+         * we would only be implementing speculatively) -- so we'll
+         * always offer data channels until the standard is
+         * a bit more set.
+         */
        dcb_p->media_cap_tbl->cap[CC_DATACHANNEL_1].enabled = TRUE;
    } else {
        dcb_p->media_cap_tbl->cap[CC_DATACHANNEL_1].enabled = FALSE;
@ -1562,7 +1580,7 @@ gsmsdp_get_ice_attributes (sdp_attr_e sdp_attr, uint16_t level, void *sdp_p, cha
 }

 /*
- * gsmsdp_set_attributes
+ * gsmsdp_set_ice_attribute
 *
 * Description:
 *
@ -1575,7 +1593,7 @@ gsmsdp_get_ice_attributes (sdp_attr_e sdp_attr, uint16_t level, void *sdp_p, cha
 * sdp_p        - Pointer to the SDP to set the ice candidate attribute against.
 * ice_attrib   - ice attribute to set
 */
-static void
+void
 gsmsdp_set_ice_attribute (sdp_attr_e sdp_attr, uint16_t level, void *sdp_p, char *ice_attrib)
 {
    uint16_t      a_instance = 0;
@ -5882,12 +5900,12 @@ gsmsdp_encode_sdp (cc_sdp_t *sdp_p, cc_msgbody_info_t *msg_body)
    cc_msgbody_t   *part;
    uint32_t        body_length;

-    if (msg_body == NULL) {
+    if (!msg_body || !sdp_p) {
        return CC_CAUSE_ERROR;
    }

    /* Support single SDP encoding for now */
-    sdp_body = sipsdp_write_to_buf(sdp_p, &body_length);
+    sdp_body = sipsdp_write_to_buf(sdp_p->src_sdp, &body_length);

    if (sdp_body == NULL) {
        return CC_CAUSE_ERROR;
--- a/media/webrtc/signaling/src/sipcc/core/gsm/h/gsm_sdp.h
+++ b/media/webrtc/signaling/src/sipcc/core/gsm/h/gsm_sdp.h
@ -135,5 +135,9 @@ void gsmsdp_process_cap_constraints(fsmdef_dcb_t *dcb, const cc_media_constraint
 cc_causes_t
 gsmsdp_get_offered_media_types (fsm_fcb_t *fcb_p, cc_sdp_t *sdp_p, boolean *has_audio, boolean *has_video, boolean *has_data);
 fsmdef_media_t* gsmsdp_find_media_by_media_type(fsmdef_dcb_t *dcb, sdp_media_e 	media_type);
+
+extern void gsmsdp_set_ice_attribute (sdp_attr_e sdp_attr, uint16_t level,
+                                      void *sdp_p, char *ice_attrib);
+
 #endif

--- a/media/webrtc/signaling/src/sipcc/core/gsm/lsm.c
+++ b/media/webrtc/signaling/src/sipcc/core/gsm/lsm.c
@ -975,17 +975,24 @@ lsm_rx_start (lsm_lcb_t *lcb, const char *fname, fsmdef_media_t *media)
                    media->src_port = open_rcv.port;
                }

-                /* TODO(ekr@rtfm.com): Needs changing for when we have > 2 streams */
+                /* TODO(ekr@rtfm.com): Needs changing for when we
+                   have > 2 streams. (adam@nostrum.com): For now,
+                   we know that the stream IDs are assigned in the
+                   same order as things appear in the media objects.
+                   The "level" in the media objects are indexed
+                   starting from one, while pc_stream_id is
+                   zero-indexed.  This means that the stream ID
+                   will (for now) be equal to media->level-1. */
                if ( media->cap_index == CC_VIDEO_1 ) {
                    attrs.video.opaque = media->video;
-                    pc_stream_id = 1;
+                    pc_stream_id = media->level - 1;
                } else {
                    attrs.audio.packetization_period = media->packetization_period;
                    attrs.audio.max_packetization_period = media->max_packetization_period;
                    attrs.audio.avt_payload_type = media->avt_payload_type;
                    attrs.audio.mixing_mode = mix_mode;
                    attrs.audio.mixing_party = mix_party;
-                    pc_stream_id = 0;
+                    pc_stream_id = media->level - 1;
                }
                pc_track_id = 0;
                dcb->cur_video_avail &= ~CC_ATTRIB_CAST;
--- a/media/webrtc/signaling/src/sipcc/core/includes/sessionConstants.h
+++ b/media/webrtc/signaling/src/sipcc/core/includes/sessionConstants.h
@ -220,6 +220,8 @@ typedef enum {
    CREATE_ANSWER,
    SET_LOCAL_DESC,
    SET_REMOTE_DESC,
+    UPDATE_LOCAL_DESC,
+    UPDATE_REMOTE_DESC,
    REMOTE_STREAM_ADD
 } group_call_event_t;

--- a/media/webrtc/signaling/src/sipcc/core/includes/uiapi.h
+++ b/media/webrtc/signaling/src/sipcc/core/includes/uiapi.h
@ -37,6 +37,8 @@ typedef enum {
    evCreateAnswerError = CREATEANSWERERROR,
    evSetLocalDesc = SETLOCALDESC,
    evSetRemoteDesc = SETREMOTEDESC,
+    evUpdateLocalDesc = UPDATELOCALDESC,
+    evUpdateRemoteDesc = UPDATEREMOTEDESC,
    evSetLocalDescError = SETLOCALDESCERROR,
    evSetRemoteDescError = SETREMOTEDESCERROR,
    evOnRemoteStreamAdd = REMOTESTREAMADD,
@ -150,13 +152,19 @@ void ui_call_start_ringer(vcm_ring_mode_t ringMode, short once, line_t line, cal
 void ui_BLF_notification (int request_id, cc_blf_state_t blf_state, int app_id);
 void ui_update_media_interface_change(line_t line, callid_t call_id, group_call_event_t event);
 void ui_create_offer(call_events event, line_t nLine, callid_t nCallID,
-                 	 uint16_t call_instance_id, char* sdp);
+                 	 uint16_t call_instance_id, string_t sdp);
 void ui_create_answer(call_events event, line_t nLine, callid_t nCallID,
-                 	 uint16_t call_instance_id, char* sdp);
+                 	 uint16_t call_instance_id, string_t sdp);
 void ui_set_local_description(call_events event, line_t nLine, callid_t nCallID,
-                 	 uint16_t call_instance_id, char* sdp, cc_int32_t status);
+                 	 uint16_t call_instance_id, string_t sdp, cc_int32_t status);
 void ui_set_remote_description(call_events event, line_t nLine, callid_t nCallID,
-                 	 uint16_t call_instance_id, char* sdp, cc_int32_t status);
+                 	 uint16_t call_instance_id, string_t sdp, cc_int32_t status);
+
+void ui_update_local_description(call_events event, line_t nLine, callid_t nCallID,
+                 	 uint16_t call_instance_id, string_t sdp);
+void ui_update_remote_description(call_events event, line_t nLine, callid_t nCallID,
+                 	 uint16_t call_instance_id, string_t sdp);
+
 void ui_on_remote_stream_added(call_events event, line_t nLine, callid_t nCallID,
                     uint16_t call_instance_id, cc_media_remote_track_table_t media_tracks);

--- a/media/webrtc/signaling/src/sipcc/core/sdp/sdp_attr.c
+++ b/media/webrtc/signaling/src/sipcc/core/sdp/sdp_attr.c
@ -517,6 +517,8 @@ sdp_result_e sdp_parse_attr_fmtp (sdp_t *sdp_p, sdp_attr_t *attr_p,
    /* END */
    /* Once we move to RFC compliant video codec implementations, the above
    *  patch should be removed */
+
+    src_ptr = temp_ptr;
    while (!done) {
      fmtp_ptr = sdp_getnextstrtok(fmtp_ptr, tmp, sizeof(tmp), "= \t", &result1);
      if (result1 == SDP_SUCCESS) {
@ -1026,7 +1028,7 @@ sdp_result_e sdp_parse_attr_fmtp (sdp_t *sdp_p, sdp_attr_t *attr_p,
 	    fmtp_p->fmtp_format = SDP_FMTP_CODEC_INFO;
            fmtp_p->level = (short) strtoul_result;
 	    codec_info_found = TRUE;
-        } if (cpr_strncasecmp(tmp,sdp_fmtp_codec_param[16].name,
+        } else if (cpr_strncasecmp(tmp,sdp_fmtp_codec_param[16].name,
                               sdp_fmtp_codec_param[16].strlen) == 0) {
 	    fmtp_p->fmtp_format = SDP_FMTP_CODEC_INFO;
            fmtp_p->is_interlace = TRUE;
--- a/media/webrtc/signaling/src/sipcc/core/sipstack/ccsip_sdp.c
+++ b/media/webrtc/signaling/src/sipcc/core/sipstack/ccsip_sdp.c
@ -322,7 +322,7 @@ sipsdp_src_dest_create (const char *peerconnection,
 *                              and by examining SDP library error counters.
 */
 char *
-sipsdp_write_to_buf (cc_sdp_t *sdp_info, uint32_t *retbytes)
+sipsdp_write_to_buf (sdp_t *sdp_info, uint32_t *retbytes)
 {
    flex_string fs;
    uint32_t sdp_len;
@ -330,12 +330,12 @@ sipsdp_write_to_buf (cc_sdp_t *sdp_info, uint32_t *retbytes)

    flex_string_init(&fs);

-    if (!sdp_info || !sdp_info->src_sdp) {
+    if (!sdp_info) {
        CCSIP_DEBUG_ERROR(SIP_F_PREFIX"NULL sdp_info or src_sdp\n", __FUNCTION__);
        return (NULL);
    }

-    if ((rc = sdp_build(sdp_info->src_sdp, &fs))
+    if ((rc = sdp_build(sdp_info, &fs))
        != SDP_SUCCESS) {
        CCSIP_DEBUG_TASK(DEB_F_PREFIX"sdp_build rc=%s\n", DEB_F_PREFIX_ARGS(SIP_SDP, __FUNCTION__),
                         sdp_get_result_name(rc));
--- a/media/webrtc/signaling/src/sipcc/core/sipstack/h/ccsip_sdp.h
+++ b/media/webrtc/signaling/src/sipcc/core/sipstack/h/ccsip_sdp.h
@ -142,7 +142,7 @@ PMH_EXTERN void sipsdp_free(cc_sdp_t **sip_sdp);
 * Memory is allocated and should be freed by the user when done
 * Returns NULL on failure.
 */
-PMH_EXTERN char *sipsdp_write_to_buf(cc_sdp_t *, uint32_t *);
+PMH_EXTERN char *sipsdp_write_to_buf(sdp_t *, uint32_t *);

 #define SIPSDP_FREE(x) \
 if (x) \
--- a/media/webrtc/signaling/src/sipcc/cpr/include/cpr_types.h
+++ b/media/webrtc/signaling/src/sipcc/cpr/include/cpr_types.h
@ -102,6 +102,16 @@ extern const cpr_ip_addr_t ip_addr_invalid;

 #define CPR_IP_ADDR_INIT(a) a.type = CPR_IP_ADDR_INVALID;

+/*
+ * !!! NOTE !!!
+ *
+ * The strings of type string_t are actually very special blocks
+ * of memory that have a "hidden" header block immediately preceding
+ * the pointer. You MUST use the functions in string_lib.c to
+ * create, manipulate, destroy, copy, or otherwise work with these
+ * strings.
+ */
+
 typedef const char *string_t;

 __END_DECLS
--- a/media/webrtc/signaling/src/sipcc/cpr/win32/cpr_win_stdio.c
+++ b/media/webrtc/signaling/src/sipcc/cpr/win32/cpr_win_stdio.c
@ -67,3 +67,14 @@ buginf (const char *_format, ...)
  return (0);
 }

+int
+cpr_win_snprintf(char *buffer, size_t n, const char *format, ...)
+{
+  va_list argp;
+  int ret;
+  va_start(argp, format);
+  ret = _vscprintf(format, argp);
+  vsnprintf_s(buffer, n, _TRUNCATE, format, argp);
+  va_end(argp);
+  return ret;
+}
--- a/media/webrtc/signaling/src/sipcc/cpr/win32/cpr_win_stdio.h
+++ b/media/webrtc/signaling/src/sipcc/cpr/win32/cpr_win_stdio.h
@ -9,6 +9,7 @@
 #include <stdio.h>


-#define snprintf _snprintf
+#define snprintf cpr_win_snprintf
+int cpr_win_snprintf(char *buffer, size_t n, const char *format, ...);

 #endif
--- a/media/webrtc/signaling/src/sipcc/include/cc_constants.h
+++ b/media/webrtc/signaling/src/sipcc/include/cc_constants.h
@ -274,7 +274,7 @@ typedef enum {
 	REMINUSE,
 	HOLDREVERT,
 	WHISPER,
-    PRESERVATION,
+	PRESERVATION,
 	WAITINGFORDIGITS = 21,
 	CREATEOFFER,
 	CREATEANSWER,
@ -282,6 +282,8 @@ typedef enum {
 	CREATEANSWERERROR,
 	SETLOCALDESC,
 	SETREMOTEDESC,
+	UPDATELOCALDESC,
+	UPDATEREMOTEDESC,
 	SETLOCALDESCERROR,
 	SETREMOTEDESCERROR,
 	REMOTESTREAMADD,
--- a/media/webrtc/signaling/src/softphonewrapper/CC_SIPCCCallInfo.cpp
+++ b/media/webrtc/signaling/src/softphonewrapper/CC_SIPCCCallInfo.cpp
@ -135,6 +135,12 @@ std::string CC_SIPCCCallInfo::callStateToString (cc_call_state_t state)
      case SETREMOTEDESC:
        statestr = "SETREMOTEDESC";
        break;
+      case UPDATELOCALDESC:
+        statestr = "UPDATELOCALDESC";
+        break;
+      case UPDATEREMOTEDESC:
+        statestr = "UPDATEREMOTEDESC";
+        break;
      case SETLOCALDESCERROR:
        statestr = "SETLOCALDESCERROR";
        break;
@ -418,7 +424,7 @@ bool CC_SIPCCCallInfo::isVideoMuted()

 string CC_SIPCCCallInfo::getSDP()
 {
-	return CCAPI_CallInfo_getSDP(callinfo_ref);
+    return CCAPI_CallInfo_getSDP(callinfo_ref);
 }

 cc_int32_t CC_SIPCCCallInfo::getStatusCode()
--- a/media/webrtc/signaling/test/signaling_unittests.cpp
+++ b/media/webrtc/signaling/test/signaling_unittests.cpp
@ -77,12 +77,15 @@ enum sdpTestFlags
  SHOULD_RECV_AUDIO     = (1<<1),
  SHOULD_INACTIVE_AUDIO = (1<<2),
  SHOULD_REJECT_AUDIO   = (1<<3),
-  SHOULD_SEND_VIDEO     = (1<<4),
-  SHOULD_RECV_VIDEO     = (1<<5),
-  SHOULD_INACTIVE_VIDEO = (1<<6),
-  SHOULD_REJECT_VIDEO   = (1<<7),
-  DONT_CHECK_AUDIO      = (1<<8),
-  DONT_CHECK_VIDEO      = (1<<9),
+  SHOULD_OMIT_AUDIO     = (1<<4),
+  DONT_CHECK_AUDIO      = (1<<5),
+
+  SHOULD_SEND_VIDEO     = (1<<8),
+  SHOULD_RECV_VIDEO     = (1<<9),
+  SHOULD_INACTIVE_VIDEO = (1<<10),
+  SHOULD_REJECT_VIDEO   = (1<<11),
+  SHOULD_OMIT_VIDEO     = (1<<12),
+  DONT_CHECK_VIDEO      = (1<<13),

  SHOULD_SENDRECV_AUDIO = SHOULD_SEND_AUDIO | SHOULD_RECV_AUDIO,
  SHOULD_SENDRECV_VIDEO = SHOULD_SEND_VIDEO | SHOULD_RECV_VIDEO,
@ -90,11 +93,11 @@ enum sdpTestFlags

  AUDIO_FLAGS = SHOULD_SEND_AUDIO | SHOULD_RECV_AUDIO
                | SHOULD_INACTIVE_AUDIO | SHOULD_REJECT_AUDIO
-                | DONT_CHECK_AUDIO,
+                | DONT_CHECK_AUDIO | SHOULD_OMIT_AUDIO,

  VIDEO_FLAGS = SHOULD_SEND_VIDEO | SHOULD_RECV_VIDEO
                | SHOULD_INACTIVE_VIDEO | SHOULD_REJECT_VIDEO
-                | DONT_CHECK_VIDEO
+                | DONT_CHECK_VIDEO | SHOULD_OMIT_VIDEO
 };

 enum offerAnswerFlags
@ -533,6 +536,24 @@ class SignalingAgent {
  char* offer() const { return offer_; }
  char* answer() const { return answer_; }

+  std::string getLocalDescription() const {
+    char *sdp = nullptr;
+    pc->GetLocalDescription(&sdp);
+    if (!sdp) {
+      return "";
+    }
+    return sdp;
+  }
+
+  std::string getRemoteDescription() const {
+    char *sdp = 0;
+    pc->GetRemoteDescription(&sdp);
+    if (!sdp) {
+      return "";
+    }
+    return sdp;
+  }
+
  void CreateOffer(sipcc::MediaConstraints& constraints,
                   uint32_t offerFlags, uint32_t sdpCheck) {

@ -712,21 +733,26 @@ private:
    ASSERT_NE(sdp.find("c=IN IP4"), std::string::npos);
    ASSERT_NE(sdp.find("a=fingerprint:sha-256"), std::string::npos);

-    cout << "SDPSanityCheck flags = " << std::hex << std::showbase
+    cout << "SDPSanityCheck flags for "
+         << (offer ? "offer" : "answer")
+         << " = " << std::hex << std::showbase
         << flags << std::dec
+
         << ((flags & SHOULD_SEND_AUDIO)?" SHOULD_SEND_AUDIO":"")
         << ((flags & SHOULD_RECV_AUDIO)?" SHOULD_RECV_AUDIO":"")
         << ((flags & SHOULD_INACTIVE_AUDIO)?" SHOULD_INACTIVE_AUDIO":"")
         << ((flags & SHOULD_REJECT_AUDIO)?" SHOULD_REJECT_AUDIO":"")
+         << ((flags & SHOULD_OMIT_AUDIO)?" SHOULD_OMIT_AUDIO":"")
+         << ((flags & DONT_CHECK_AUDIO)?" DONT_CHECK_AUDIO":"")
+
         << ((flags & SHOULD_SEND_VIDEO)?" SHOULD_SEND_VIDEO":"")
         << ((flags & SHOULD_RECV_VIDEO)?" SHOULD_RECV_VIDEO":"")
         << ((flags & SHOULD_INACTIVE_VIDEO)?" SHOULD_INACTIVE_VIDEO":"")
         << ((flags & SHOULD_REJECT_VIDEO)?" SHOULD_REJECT_VIDEO":"")
-         << endl;
+         << ((flags & SHOULD_OMIT_VIDEO)?" SHOULD_OMIT_VIDEO":"")
+         << ((flags & DONT_CHECK_VIDEO)?" DONT_CHECK_VIDEO":"")

-    if ((flags & AUDIO_FLAGS) && offer) {
-      ASSERT_NE(sdp.find("a=rtpmap:0 PCMU/8000"), std::string::npos);
-    }
+         << endl;

    switch(flags & AUDIO_FLAGS) {
      case 0:
@ -735,14 +761,23 @@ private:
      case SHOULD_SEND_AUDIO:
            ASSERT_NE(sdp.find("a=rtpmap:109 opus/48000"), std::string::npos);
            ASSERT_NE(sdp.find(" 0-15\r\na=sendonly"), std::string::npos);
+            if (offer) {
+              ASSERT_NE(sdp.find("a=rtpmap:0 PCMU/8000"), std::string::npos);
+            }
        break;
      case SHOULD_RECV_AUDIO:
            ASSERT_NE(sdp.find("a=rtpmap:109 opus/48000"), std::string::npos);
            ASSERT_NE(sdp.find(" 0-15\r\na=recvonly"), std::string::npos);
+            if (offer) {
+              ASSERT_NE(sdp.find("a=rtpmap:0 PCMU/8000"), std::string::npos);
+            }
        break;
      case SHOULD_SENDRECV_AUDIO:
            ASSERT_NE(sdp.find("a=rtpmap:109 opus/48000"), std::string::npos);
            ASSERT_NE(sdp.find(" 0-15\r\na=sendrecv"), std::string::npos);
+            if (offer) {
+              ASSERT_NE(sdp.find("a=rtpmap:0 PCMU/8000"), std::string::npos);
+            }
        break;
      case SHOULD_INACTIVE_AUDIO:
            ASSERT_NE(sdp.find("a=rtpmap:109 opus/48000"), std::string::npos);
@ -752,6 +787,9 @@ private:
            ASSERT_EQ(sdp.find("a=rtpmap:109 opus/48000"), std::string::npos);
            ASSERT_NE(sdp.find("m=audio 0 "), std::string::npos);
        break;
+      case SHOULD_OMIT_AUDIO:
+            ASSERT_EQ(sdp.find("m=audio"), std::string::npos);
+        break;
      case DONT_CHECK_AUDIO:
        break;
      default:
@ -781,6 +819,9 @@ private:
      case SHOULD_REJECT_VIDEO:
            ASSERT_NE(sdp.find("m=video 0 "), std::string::npos);
        break;
+      case SHOULD_OMIT_VIDEO:
+            ASSERT_EQ(sdp.find("m=video"), std::string::npos);
+        break;
      case DONT_CHECK_VIDEO:
        break;
      default:
@ -934,7 +975,7 @@ TEST_F(SignalingTest, CreateOfferNoVideoStream)
  constraints.setBooleanConstraint("OfferToReceiveAudio", true, false);
  constraints.setBooleanConstraint("OfferToReceiveVideo", true, false);
  CreateOffer(constraints, OFFER_AUDIO,
-              SHOULD_SENDRECV_AUDIO | SHOULD_RECV_VIDEO);
+              SHOULD_SENDRECV_AUDIO | SHOULD_OMIT_VIDEO);
 }

 TEST_F(SignalingTest, CreateOfferNoAudioStream)
@ -943,7 +984,7 @@ TEST_F(SignalingTest, CreateOfferNoAudioStream)
  constraints.setBooleanConstraint("OfferToReceiveAudio", true, false);
  constraints.setBooleanConstraint("OfferToReceiveVideo", true, false);
  CreateOffer(constraints, OFFER_VIDEO,
-              SHOULD_RECV_AUDIO | SHOULD_SENDRECV_VIDEO);
+              SHOULD_OMIT_AUDIO | SHOULD_SENDRECV_VIDEO);
 }

 TEST_F(SignalingTest, CreateOfferDontReceiveAudio)
@ -1060,8 +1101,8 @@ TEST_F(SignalingTest, OfferAnswerDontAddAudioStreamOnOffer)
  answerconstraints.setBooleanConstraint("OfferToReceiveAudio", true, false);
  answerconstraints.setBooleanConstraint("OfferToReceiveVideo", true, false);
  OfferAnswer(offerconstraints, answerconstraints, OFFER_VIDEO | ANSWER_AV,
-              false, SHOULD_RECV_AUDIO | SHOULD_SENDRECV_VIDEO,
-              SHOULD_SEND_AUDIO | SHOULD_SENDRECV_VIDEO);
+              false, SHOULD_OMIT_AUDIO | SHOULD_SENDRECV_VIDEO,
+              SHOULD_OMIT_AUDIO | SHOULD_SENDRECV_VIDEO);
 }

 TEST_F(SignalingTest, OfferAnswerDontAddVideoStreamOnOffer)
@ -1073,8 +1114,8 @@ TEST_F(SignalingTest, OfferAnswerDontAddVideoStreamOnOffer)
  answerconstraints.setBooleanConstraint("OfferToReceiveAudio", true, false);
  answerconstraints.setBooleanConstraint("OfferToReceiveVideo", true, false);
  OfferAnswer(offerconstraints, answerconstraints, OFFER_AUDIO | ANSWER_AV,
-              false, SHOULD_SENDRECV_AUDIO | SHOULD_RECV_VIDEO,
-              SHOULD_SENDRECV_AUDIO | SHOULD_SEND_VIDEO);
+              false, SHOULD_SENDRECV_AUDIO | SHOULD_OMIT_VIDEO,
+              SHOULD_SENDRECV_AUDIO | SHOULD_OMIT_VIDEO);
 }

 TEST_F(SignalingTest, OfferAnswerDontAddAudioStreamOnAnswer)
@ -1149,7 +1190,8 @@ TEST_F(SignalingTest, OfferAnswerDontAddVideoStreamOnOfferDontReceiveVideoOnOffe
  answerconstraints.setBooleanConstraint("OfferToReceiveAudio", true, false);
  answerconstraints.setBooleanConstraint("OfferToReceiveVideo", true, false);
  OfferAnswer(offerconstraints, answerconstraints, OFFER_AUDIO | ANSWER_AV,
-              false, SHOULD_SENDRECV_AUDIO, SHOULD_SENDRECV_AUDIO);
+              false, SHOULD_SENDRECV_AUDIO | SHOULD_OMIT_VIDEO,
+              SHOULD_SENDRECV_AUDIO | SHOULD_OMIT_VIDEO);
 }

 TEST_F(SignalingTest, OfferAnswerDontReceiveAudioNoAudioStreamOnOfferDontReceiveVideoOnAnswer)
@ -1224,16 +1266,6 @@ TEST_F(SignalingTest, OfferAnswerDontAddAudioVideoStreamsOnAnswerNoConstraints)
              SHOULD_RECV_AUDIO | SHOULD_RECV_VIDEO);
 }

-TEST_F(SignalingTest, OfferModifiedAnswer)
-{
-  sipcc::MediaConstraints constraints;
-  OfferModifiedAnswer(constraints, constraints, SHOULD_SENDRECV_AV,
-                      SHOULD_SENDRECV_AV);
-  PR_Sleep(kDefaultTimeout * 2); // Wait for completion
-  a1_.CloseSendStreams();
-  a2_.CloseReceiveStreams();
-}
-
 TEST_F(SignalingTest, FullCall)
 {
  sipcc::MediaConstraints constraints;
@ -1251,6 +1283,55 @@ TEST_F(SignalingTest, FullCall)
  ASSERT_GE(a2_.GetPacketsReceived(0), 40);
 }

+TEST_F(SignalingTest, FullCallAudioOnly)
+{
+  sipcc::MediaConstraints constraints;
+  OfferAnswer(constraints, constraints, OFFER_AUDIO | ANSWER_AUDIO,
+              true, SHOULD_SENDRECV_AUDIO, SHOULD_SENDRECV_AUDIO);
+
+  PR_Sleep(kDefaultTimeout * 2); // Wait for some data to get written
+
+  a1_.CloseSendStreams();
+  a2_.CloseReceiveStreams();
+  // Check that we wrote a bunch of data
+  ASSERT_GE(a1_.GetPacketsSent(0), 40);
+  //ASSERT_GE(a2_.GetPacketsSent(0), 40);
+  //ASSERT_GE(a1_.GetPacketsReceived(0), 40);
+  ASSERT_GE(a2_.GetPacketsReceived(0), 40);
+}
+
+TEST_F(SignalingTest, FullCallVideoOnly)
+{
+  sipcc::MediaConstraints constraints;
+  OfferAnswer(constraints, constraints, OFFER_VIDEO | ANSWER_VIDEO,
+              true, SHOULD_SENDRECV_VIDEO, SHOULD_SENDRECV_VIDEO);
+
+  PR_Sleep(kDefaultTimeout * 2); // Wait for some data to get written
+
+  a1_.CloseSendStreams();
+  a2_.CloseReceiveStreams();
+
+  // FIXME -- Ideally we would check that packets were sent
+  // and received; however, the test driver setup does not
+  // currently support sending/receiving with Fake_VideoStreamSource.
+  //
+  // Check that we wrote a bunch of data
+  // ASSERT_GE(a1_.GetPacketsSent(0), 40);
+  //ASSERT_GE(a2_.GetPacketsSent(0), 40);
+  //ASSERT_GE(a1_.GetPacketsReceived(0), 40);
+  // ASSERT_GE(a2_.GetPacketsReceived(0), 40);
+}
+
+TEST_F(SignalingTest, OfferModifiedAnswer)
+{
+  sipcc::MediaConstraints constraints;
+  OfferModifiedAnswer(constraints, constraints, SHOULD_SENDRECV_AV,
+                      SHOULD_SENDRECV_AV);
+  PR_Sleep(kDefaultTimeout * 2); // Wait for completion
+  a1_.CloseSendStreams();
+  a2_.CloseReceiveStreams();
+}
+
 TEST_F(SignalingTest, FullCallTrickle)
 {
  sipcc::MediaConstraints constraints;
@ -1432,6 +1513,53 @@ TEST_F(SignalingTest, OfferAllDynamicTypes)

 }

+TEST_F(SignalingTest, OfferAnswerCheckDescriptions)
+{
+  sipcc::MediaConstraints constraints;
+  OfferAnswer(constraints, constraints, OFFER_AV | ANSWER_AV, true,
+              SHOULD_SENDRECV_AV, SHOULD_SENDRECV_AV);
+
+  std::cout << "Caller's LocalDescription: " << std::endl <<
+    a1_.getLocalDescription() << std::endl << std::endl;
+  std::cout << "Caller's Remote Description: " << std::endl <<
+    a1_.getRemoteDescription() << std::endl << std::endl;
+  std::cout << "Callee's LocalDescription: " << std::endl <<
+    a2_.getLocalDescription() << std::endl << std::endl;
+  std::cout << "Callee's Remote Description: " << std::endl <<
+    a2_.getRemoteDescription() << std::endl << std::endl;
+
+  ASSERT_EQ(a1_.getLocalDescription(),a2_.getRemoteDescription());
+  ASSERT_EQ(a2_.getLocalDescription(),a1_.getRemoteDescription());
+}
+
+TEST_F(SignalingTest, CheckTrickleSdpChange)
+{
+  sipcc::MediaConstraints constraints;
+  OfferAnswerTrickle(constraints, constraints,
+                     SHOULD_SENDRECV_AV, SHOULD_SENDRECV_AV);
+  std::cerr << "ICE handshake completed" << std::endl;
+
+  PR_Sleep(kDefaultTimeout * 2); // Wait for some data to get written
+  a1_.CloseSendStreams();
+  a2_.CloseReceiveStreams();
+
+  std::cout << "Caller's LocalDescription: " << std::endl <<
+    a1_.getLocalDescription() << std::endl << std::endl;
+  std::cout << "Caller's Remote Description: " << std::endl <<
+    a1_.getRemoteDescription() << std::endl << std::endl;
+  std::cout << "Callee's LocalDescription: " << std::endl <<
+    a2_.getLocalDescription() << std::endl << std::endl;
+  std::cout << "Callee's Remote Description: " << std::endl <<
+    a2_.getRemoteDescription() << std::endl << std::endl;
+
+  ASSERT_NE(a1_.getLocalDescription().find("\r\na=candidate"), string::npos);
+  ASSERT_NE(a1_.getRemoteDescription().find("\r\na=candidate"), string::npos);
+  ASSERT_NE(a2_.getLocalDescription().find("\r\na=candidate"), string::npos);
+  ASSERT_NE(a2_.getRemoteDescription().find("\r\na=candidate"), string::npos);
+  ASSERT_EQ(a1_.getLocalDescription(),a2_.getRemoteDescription());
+  ASSERT_EQ(a2_.getLocalDescription(),a1_.getRemoteDescription());
+}
+
 } // End namespace test.

 int main(int argc, char **argv) {
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@ -584,7 +584,7 @@ pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
 // If an urlclassifier table has not been updated in this number of seconds,
 // a gethash request will be forced to check that the result is still in
 // the database.
-pref("urlclassifier.confirm-age", 2700);
+pref("urlclassifier.max-complete-age", 2700);
 #endif

 // True if this is the first time we are showing about:firstrun
--- a/mobile/android/base/Favicons.java
+++ b/mobile/android/base/Favicons.java
@ -6,6 +6,7 @@
 package org.mozilla.gecko;

 import org.mozilla.gecko.db.BrowserDB;
+import org.mozilla.gecko.util.GeckoBackgroundThread;
 import org.mozilla.gecko.util.GeckoJarReader;

 import org.apache.http.HttpEntity;
@ -205,17 +206,20 @@ public class Favicons {
        }

        // Runs in background thread
-        private void saveFaviconToDb(Bitmap favicon) {
+        private void saveFaviconToDb(final Bitmap favicon) {
            if (!mPersist) {
                return;
            }

-            // since the Async task can run this on any number of threads in the
-            // pool, we need to protect against inserting the same url twice
-            synchronized(Favicons.this) {
-                ContentResolver resolver = mContext.getContentResolver();
-                BrowserDB.updateFaviconForUrl(resolver, mPageUrl, favicon, mFaviconUrl);
-            }
+            // Even though this code is in a background thread, all DB writes
+            // should happen in GeckoBackgroundThread or we could get locked
+            // databases.
+            GeckoBackgroundThread.post(new Runnable() {
+                public void run() {
+                    ContentResolver resolver = mContext.getContentResolver();
+                    BrowserDB.updateFaviconForUrl(resolver, mPageUrl, favicon, mFaviconUrl);
+                }
+            });
        }

        // Runs in background thread
--- a/mobile/xul/app/mobile.js
+++ b/mobile/xul/app/mobile.js
@ -625,7 +625,7 @@ pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
 // If an urlclassifier table has not been updated in this number of seconds,
 // a gethash request will be forced to check that the result is still in
 // the database.
-pref("urlclassifier.confirm-age", 2700);
+pref("urlclassifier.max-complete-age", 2700);

 // URL for checking the reason for a malware warning.
 pref("browser.safebrowsing.malware.reportURL", "http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");
--- a/netwerk/mime/nsMIMEHeaderParamImpl.cpp
+++ b/netwerk/mime/nsMIMEHeaderParamImpl.cpp
@ -1091,6 +1091,43 @@ void CopyRawHeader(const char *aInput, uint32_t aLen,
  }
 }

+nsresult DecodeQOrBase64Str(const char *aEncoded, size_t aLen, char aQOrBase64,
+                            const char *aCharset, nsACString &aResult)
+{
+  char *decodedText;
+  NS_ASSERTION(aQOrBase64 == 'Q' || aQOrBase64 == 'B', "Should be 'Q' or 'B'");
+  if(aQOrBase64 == 'Q')
+    decodedText = DecodeQ(aEncoded, aLen);
+  else if (aQOrBase64 == 'B') {
+    decodedText = PL_Base64Decode(aEncoded, aLen, nullptr);
+  } else {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  if (!decodedText) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  nsresult rv;
+  nsCOMPtr<nsIUTF8ConverterService>
+    cvtUTF8(do_GetService(NS_UTF8CONVERTERSERVICE_CONTRACTID, &rv));
+  nsAutoCString utf8Text;
+  if (NS_SUCCEEDED(rv)) {
+    // skip ASCIIness/UTF8ness test if aCharset is 7bit non-ascii charset.
+    rv = cvtUTF8->ConvertStringToUTF8(nsDependentCString(decodedText),
+                                      aCharset,
+                                      IS_7BIT_NON_ASCII_CHARSET(aCharset),
+                                      true, 1, utf8Text);
+  }
+  PR_Free(decodedText);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  aResult.Append(utf8Text);
+
+  return NS_OK;
+}
+
 static const char especials[] = "()<>@,;:\\\"/[]?.=";

 // |decode_mime_part2_str| taken from comi18n.c
@ -1103,14 +1140,13 @@ nsresult DecodeRFC2047Str(const char *aHeader, const char *aDefaultCharset,
                          bool aOverrideCharset, nsACString &aResult)
 {
  const char *p, *q = nullptr, *r;
-  char *decodedText;
  const char *begin; // tracking pointer for where we are in the input buffer
  int32_t isLastEncodedWord = 0;
  const char *charsetStart, *charsetEnd;
-  char charset[80];
-
-  // initialize charset name to an empty string
-  charset[0] = '\0';
+  nsAutoCString prevCharset, curCharset;
+  nsAutoCString encodedText;
+  char prevEncoding = '\0', curEncoding;
+  nsresult rv;

  begin = aHeader;

@ -1155,15 +1191,9 @@ nsresult DecodeRFC2047Str(const char *aHeader, const char *aDefaultCharset,
      charsetEnd = q;
    }

-    // Check for too-long charset name
-    if (uint32_t(charsetEnd - charsetStart) >= sizeof(charset)) 
-      goto badsyntax;
-    
-    memcpy(charset, charsetStart, charsetEnd - charsetStart);
-    charset[charsetEnd - charsetStart] = 0;
-
    q++;
-    if (*q != 'Q' && *q != 'q' && *q != 'B' && *q != 'b')
+    curEncoding = nsCRT::ToUpper(*q);
+    if (curEncoding != 'Q' && curEncoding != 'B')
      goto badsyntax;

    if (q[1] != '?')
@ -1182,55 +1212,88 @@ nsresult DecodeRFC2047Str(const char *aHeader, const char *aDefaultCharset,
        continue;
    }

-    if(*q == 'Q' || *q == 'q')
-      decodedText = DecodeQ(q + 2, r - (q + 2));
-    else {
+    curCharset.Assign(charsetStart, charsetEnd - charsetStart);
+    // Override charset if requested.  Never override labeled UTF-8.
+    // Use default charset instead of UNKNOWN-8BIT
+    if ((aOverrideCharset && 0 != nsCRT::strcasecmp(curCharset.get(), "UTF-8"))
+    || (aDefaultCharset && 0 == nsCRT::strcasecmp(curCharset.get(), "UNKNOWN-8BIT"))
+    ) {
+      curCharset = aDefaultCharset;
+    }
+
+    const char *R;
+    R = r;
+    if (curEncoding == 'B') {
      // bug 227290. ignore an extraneous '=' at the end.
      // (# of characters in B-encoded part has to be a multiple of 4)
      int32_t n = r - (q + 2);
-      n -= (n % 4 == 1 && !PL_strncmp(r - 3, "===", 3)) ? 1 : 0;
-      decodedText = PL_Base64Decode(q + 2, n, nullptr);
+      R -= (n % 4 == 1 && !PL_strncmp(r - 3, "===", 3)) ? 1 : 0;
+    }
+    // Bug 493544. Don't decode the encoded text until it ends
+    if (R[-1] != '='
+      && (prevCharset.IsEmpty()
+        || (curCharset == prevCharset && curEncoding == prevEncoding))
+    ) {
+      encodedText.Append(q + 2, R - (q + 2));
+      prevCharset = curCharset;
+      prevEncoding = curEncoding;
+
+      begin = r + 2;
+      isLastEncodedWord = 1;
+      continue;
    }

-    if (decodedText == nullptr)
-      goto badsyntax;
-
-    // Override charset if requested.  Never override labeled UTF-8.
-    // Use default charset instead of UNKNOWN-8BIT
-    if ((aOverrideCharset && 0 != nsCRT::strcasecmp(charset, "UTF-8")) ||
-        (aDefaultCharset && 0 == nsCRT::strcasecmp(charset, "UNKNOWN-8BIT"))) {
-      PL_strncpy(charset, aDefaultCharset, sizeof(charset) - 1);
-      charset[sizeof(charset) - 1] = '\0';
+    bool bDecoded; // If the current line has been decoded.
+    bDecoded = false;
+    if (!encodedText.IsEmpty()) {
+      if (curCharset == prevCharset && curEncoding == prevEncoding) {
+        encodedText.Append(q + 2, R - (q + 2));
+        bDecoded = true;
+      }
+      rv = DecodeQOrBase64Str(encodedText.get(), encodedText.Length(),
+                              prevEncoding, prevCharset.get(), aResult);
+      if (NS_FAILED(rv)) {
+        aResult.Append(encodedText);
+      }
+      encodedText.Truncate();
+      prevCharset.Truncate();
    }
-
-    {
-      nsCOMPtr<nsIUTF8ConverterService> 
-        cvtUTF8(do_GetService(NS_UTF8CONVERTERSERVICE_CONTRACTID));
-      nsAutoCString utf8Text;
-      // skip ASCIIness/UTF8ness test if aCharset is 7bit non-ascii charset.
-      if (cvtUTF8 &&
-          NS_SUCCEEDED(
-            cvtUTF8->ConvertStringToUTF8(nsDependentCString(decodedText),
-                                         charset,
-                                         IS_7BIT_NON_ASCII_CHARSET(charset),
-                                         true, 1, utf8Text))) {
-        aResult.Append(utf8Text);
-      } else {
-        aResult.Append(REPLACEMENT_CHAR);
+    if (!bDecoded) {
+      rv = DecodeQOrBase64Str(q + 2, R - (q + 2), curEncoding,
+                              curCharset.get(), aResult);
+      if (NS_FAILED(rv)) {
+        aResult.Append(encodedText);
      }
    }
-    PR_Free(decodedText);
+
    begin = r + 2;
    isLastEncodedWord = 1;
    continue;

  badsyntax:
+    if (!encodedText.IsEmpty()) {
+      rv = DecodeQOrBase64Str(encodedText.get(), encodedText.Length(),
+                              prevEncoding, prevCharset.get(), aResult);
+      if (NS_FAILED(rv)) {
+        aResult.Append(encodedText);
+      }
+      encodedText.Truncate();
+      prevCharset.Truncate();
+    }
    // copy the part before the encoded-word
    aResult.Append(begin, p - begin);
    begin = p;
    isLastEncodedWord = 0;
  }

+  if (!encodedText.IsEmpty()) {
+    rv = DecodeQOrBase64Str(encodedText.get(), encodedText.Length(),
+                            prevEncoding, prevCharset.get(), aResult);
+    if (NS_FAILED(rv)) {
+      aResult.Append(encodedText);
+    }
+  }
+
  // put the tail back
  CopyRawHeader(begin, strlen(begin), aDefaultCharset, aResult);

--- a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
@ -70,7 +70,7 @@ PRLogModuleInfo *gUrlClassifierDbServiceLog = nullptr;

 #define GETHASH_TABLES_PREF     "urlclassifier.gethashtables"

-#define CONFIRM_AGE_PREF        "urlclassifier.confirm-age"
+#define CONFIRM_AGE_PREF        "urlclassifier.max-complete-age"
 #define CONFIRM_AGE_DEFAULT_SEC (45 * 60)

 class nsUrlClassifierDBServiceWorker;
--- a/toolkit/components/url-classifier/tests/unit/test_partial.js
+++ b/toolkit/components/url-classifier/tests/unit/test_partial.js
@ -743,7 +743,7 @@ function testStaleList()
  };

  // Consider a match stale after one second.
-  prefBranch.setIntPref("urlclassifier.confirm-age", 1);
+  prefBranch.setIntPref("urlclassifier.max-complete-age", 1);

  // Apply the update.
  doStreamUpdate(update, function() {
@ -752,7 +752,7 @@ function testStaleList()
      new Timer(3000, function() {
          // Now the lists should be marked stale.  Check assertions.
          checkAssertions(assertions, function() {
-              prefBranch.setIntPref("urlclassifier.confirm-age", 2700);
+              prefBranch.setIntPref("urlclassifier.max-complete-age", 2700);
              runNextTest();
            });
        }, updateError);
@ -783,7 +783,7 @@ function testStaleListEmpty()
  };

  // Consider a match stale after one second.
-  prefBranch.setIntPref("urlclassifier.confirm-age", 1);
+  prefBranch.setIntPref("urlclassifier.max-complete-age", 1);

  // Apply the update.
  doStreamUpdate(update, function() {
@ -792,7 +792,7 @@ function testStaleListEmpty()
      new Timer(3000, function() {
          // Now the lists should be marked stale.  Check assertions.
          checkAssertions(assertions, function() {
-              prefBranch.setIntPref("urlclassifier.confirm-age", 2700);
+              prefBranch.setIntPref("urlclassifier.max-complete-age", 2700);
              runNextTest();
            });
        }, updateError);
--- a/tools/trace-malloc/leaksoup.cpp
+++ b/tools/trace-malloc/leaksoup.cpp
@ -7,10 +7,12 @@
 #include <stdio.h>
 #include "plhash.h"

-#include "nsVoidArray.h"
+#include "nsTArray.h"
 #include "nsQuickSort.h"
 #include "nsXPCOM.h"

+const uint32_t kPointersDefaultSize = 8;
+
 /*
 * Read in an allocation dump, presumably one taken at shutdown (using
 * the --shutdown-leaks=file option, which must be used along with
@ -25,10 +27,10 @@ struct AllocationNode {

    // Other |AllocationNode| objects whose memory has a pointer to
    // this object.
-    nsAutoVoidArray pointers_to;
+    nsAutoTArray<AllocationNode*, kPointersDefaultSize> pointers_to;

    // The reverse.
-    nsAutoVoidArray pointers_from;
+    nsAutoTArray<AllocationNode*, kPointersDefaultSize> pointers_from;

    // Early on in the algorithm, the pre-order index from a DFS.
    // Later on, set to the index of the strongly connected component to
@ -165,7 +167,7 @@ int main(int argc, char **argv)
    // |pointers_to|) and assign the post-order index to |index|.
    {
        uint32_t dfs_index = 0;
-        nsVoidArray stack;
+        nsTArray<AllocationNode*> stack;

        for (AllocationNode *n = nodes, *n_end = nodes+count; n != n_end; ++n) {
            if (n->reached) {
@ -174,9 +176,8 @@ int main(int argc, char **argv)
            stack.AppendElement(n);

            do {
-                uint32_t pos = stack.Count() - 1;
-                AllocationNode *n =
-                    static_cast<AllocationNode*>(stack[pos]);
+                uint32_t pos = stack.Length() - 1;
+                AllocationNode *n = stack[pos];
                if (n->reached) {
                    n->index = dfs_index++;
                    stack.RemoveElementAt(pos);
@ -185,14 +186,14 @@ int main(int argc, char **argv)

                    // When doing post-order processing, we have to be
                    // careful not to put reached nodes into the stack.
-                    nsVoidArray &pt = n->pointers_to;
-                    for (int32_t i = pt.Count() - 1; i >= 0; --i) {
-                        if (!static_cast<AllocationNode*>(pt[i])->reached) {
-                            stack.AppendElement(pt[i]);
+                    for (int32_t i = n->pointers_to.Length() - 1; i >= 0; --i) {
+                        AllocationNode* e = n->pointers_to[i];
+                        if (!e->reached) {
+                            stack.AppendElement(e);
                        }
                    }
                }
-            } while (stack.Count() > 0);
+            } while (stack.Length() > 0);
        }
    }

@ -218,7 +219,7 @@ int main(int argc, char **argv)
        for (size_t i = 0; i < count; ++i) {
            nodes[i].reached = false;
        }
-        nsVoidArray stack;
+        nsTArray<AllocationNode*> stack;
        for (AllocationNode **sn = sorted_nodes,
                        **sn_end = sorted_nodes + count; sn != sn_end; ++sn) {
            if ((*sn)->reached) {
@ -228,9 +229,8 @@ int main(int argc, char **argv)
            // We found a new strongly connected index.
            stack.AppendElement(*sn);
            do {
-                uint32_t pos = stack.Count() - 1;
-                AllocationNode *n =
-                    static_cast<AllocationNode*>(stack[pos]);
+                uint32_t pos = stack.Length() - 1;
+                AllocationNode *n = stack[pos];
                stack.RemoveElementAt(pos);

                if (!n->reached) {
@ -238,7 +238,7 @@ int main(int argc, char **argv)
                    n->index = num_sccs;
                    stack.AppendElements(n->pointers_from);
                }
-            } while (stack.Count() > 0);
+            } while (stack.Length() > 0);
            ++num_sccs;
        }
    }
@ -251,7 +251,7 @@ int main(int argc, char **argv)
            nodes[i].is_root = true;
        }

-        nsVoidArray stack;
+        nsTArray<AllocationNode*> stack;
        for (AllocationNode *n = nodes, *n_end = nodes+count; n != n_end; ++n) {
            if (!n->is_root) {
                continue;
@ -259,18 +259,16 @@ int main(int argc, char **argv)

            // Loop through pointers_to, and add any that are in a
            // different SCC to stack:
-            for (int i = n->pointers_to.Count() - 1; i >= 0; --i) {
-                AllocationNode *target =
-                    static_cast<AllocationNode*>(n->pointers_to[i]);
+            for (int i = n->pointers_to.Length() - 1; i >= 0; --i) {
+                AllocationNode *target = n->pointers_to[i];
                if (n->index != target->index) {
                    stack.AppendElement(target);
                }
            }

-            while (stack.Count() > 0) {
-                uint32_t pos = stack.Count() - 1;
-                AllocationNode *n =
-                    static_cast<AllocationNode*>(stack[pos]);
+            while (stack.Length() > 0) {
+                uint32_t pos = stack.Length() - 1;
+                AllocationNode *n = stack[pos];
                stack.RemoveElementAt(pos);

                if (n->is_root) {
@ -368,12 +366,11 @@ int main(int argc, char **argv)
                    }
                }

-                if (n->pointers_from.Count()) {
+                if (n->pointers_from.Length()) {
                    printf("\nPointers from:\n");
-                    for (uint32_t i = 0, i_end = n->pointers_from.Count();
+                    for (uint32_t i = 0, i_end = n->pointers_from.Length();
                         i != i_end; ++i) {
-                        AllocationNode *t = static_cast<AllocationNode*>
-                                                       (n->pointers_from[i]);
+                        AllocationNode *t = n->pointers_from[i];
                        const ADLog::Entry *te = t->entry;
                        printf("    <a href=\"#o%d\">%s</a> (Object %d, ",
                               t - nodes, te->type, t - nodes);
--- a/xpcom/glue/nsVoidArray.cpp
+++ b/xpcom/glue/nsVoidArray.cpp
@ -107,16 +107,13 @@ VoidStats gVoidStats;
 #endif

 void
-nsVoidArray::SetArray(Impl *newImpl, int32_t aSize, int32_t aCount,
-                      bool aOwner, bool aHasAuto)
+nsVoidArray::SetArray(Impl *newImpl, int32_t aSize, int32_t aCount)
 {
  // old mImpl has been realloced and so we don't free/delete it
  NS_PRECONDITION(newImpl, "can't set size");
  mImpl = newImpl;
  mImpl->mCount = aCount;
-  mImpl->mBits = static_cast<uint32_t>(aSize & kArraySizeMask) |
-                 (aOwner ? kArrayOwnerMask : 0) |
-                 (aHasAuto ? kArrayHasAutoBufferMask : 0);
+  mImpl->mSize = aSize;
 }

 // This does all allocation/reallocation of the array.
@ -125,8 +122,6 @@ nsVoidArray::SetArray(Impl *newImpl, int32_t aSize, int32_t aCount,
 bool nsVoidArray::SizeTo(int32_t aSize)
 {
  uint32_t oldsize = GetArraySize();
-  bool isOwner = IsArrayOwner();
-  bool hasAuto = HasAutoBuffer();

  if (aSize == (int32_t) oldsize)
    return true; // no change
@ -136,25 +131,13 @@ bool nsVoidArray::SizeTo(int32_t aSize)
    // free the array if allocated
    if (mImpl)
    {
-      if (isOwner)
-      {
-        free(reinterpret_cast<char *>(mImpl));
-        if (hasAuto) {
-          static_cast<nsAutoVoidArray*>(this)->ResetToAutoBuffer();
-        }
-        else {
-          mImpl = nullptr;
-        }
-      }
-      else
-      {
-        mImpl->mCount = 0; // nsAutoVoidArray
-      }
+      free(reinterpret_cast<char *>(mImpl));
+      mImpl = nullptr;
    }
    return true;
  }

-  if (mImpl && isOwner)
+  if (mImpl)
  {
    // We currently own an array impl. Resize it appropriately.
    if (aSize < mImpl->mCount)
@ -185,7 +168,7 @@ bool nsVoidArray::SizeTo(int32_t aSize)
      }
    }
 #endif
-    SetArray(newImpl, aSize, newImpl->mCount, true, hasAuto);
+    SetArray(newImpl, aSize, newImpl->mCount);
    return true;
  }

@ -225,7 +208,7 @@ bool nsVoidArray::SizeTo(int32_t aSize)
                  mImpl->mCount * sizeof(mImpl->mArray[0]));
  }

-  SetArray(newImpl, aSize, mImpl ? mImpl->mCount : 0, true, hasAuto);
+  SetArray(newImpl, aSize, mImpl ? mImpl->mCount : 0);
  // no memset; handled later in ReplaceElementAt if needed
  return true;
 }
@ -340,7 +323,7 @@ nsVoidArray& nsVoidArray::operator=(const nsVoidArray& other)
 nsVoidArray::~nsVoidArray()
 {
  MOZ_COUNT_DTOR(nsVoidArray);
-  if (mImpl && IsArrayOwner())
+  if (mImpl)
    free(reinterpret_cast<char*>(mImpl));
 }

@ -623,12 +606,6 @@ void nsVoidArray::Clear()
  if (mImpl)
  {
    mImpl->mCount = 0;
-    // We don't have to free on Clear, but if we have a built-in buffer,
-    // it's worth considering.
-    if (HasAutoBuffer() && IsArrayOwner() &&
-        GetArraySize() > kAutoClearCompactSizeFactor * kAutoBufSize) {
-      SizeTo(0);
-    }
  }
 }

@ -639,15 +616,7 @@ void nsVoidArray::Compact()
    // XXX NOTE: this is quite inefficient in many cases if we're only
    // compacting by a little, but some callers care more about memory use.
    int32_t count = Count();
-    if (HasAutoBuffer() && count <= kAutoBufSize)
-    {
-      Impl* oldImpl = mImpl;
-      static_cast<nsAutoVoidArray*>(this)->ResetToAutoBuffer();
-      memcpy(mImpl->mArray, oldImpl->mArray,
-             count * sizeof(mImpl->mArray[0]));
-      free(reinterpret_cast<char *>(oldImpl));
-    }
-    else if (GetArraySize() > count)
+    if (GetArraySize() > count)
    {
      SizeTo(Count());
    }
@ -758,21 +727,6 @@ nsVoidArray::SizeOfExcludingThis(
  return n;
 }

-//----------------------------------------------------------------
-// nsAutoVoidArray
-
-nsAutoVoidArray::nsAutoVoidArray()
-  : nsVoidArray()
-{
-  // Don't need to clear it.  Some users just call ReplaceElementAt(),
-  // but we'll clear it at that time if needed to save CPU cycles.
-#if DEBUG_VOIDARRAY
-  mIsAuto = true;
-  ADD_TO_STATS(MaxAuto,0);
-#endif
-  ResetToAutoBuffer();
-}
-
 //----------------------------------------------------------------------
 // NOTE: nsSmallVoidArray elements MUST all have the low bit as 0.
 // This means that normally it's only used for pointers, and in particular
--- a/xpcom/glue/nsVoidArray.h
+++ b/xpcom/glue/nsVoidArray.h
@ -40,7 +40,7 @@ public:
  bool SetCount(int32_t aNewCount);
  // returns the max number that can be held without allocating
  inline int32_t GetArraySize() const {
-    return mImpl ? (int32_t(mImpl->mBits) & kArraySizeMask) : 0;
+    return mImpl ? mImpl->mSize : 0;
  }

  void* FastElementAt(int32_t aIndex) const
@ -118,12 +118,9 @@ protected:

  struct Impl {
    /**
-     * Packed bits. The low 30 bits are the array's size.
-     * The two highest bits indicate whether or not we "own" mImpl and
-     * must free() it when destroyed, and whether we have a preallocated
-     * nsAutoVoidArray buffer.
+     * The actual array size.
     */
-    uint32_t mBits;
+    int32_t mSize;

    /**
     * The number of elements in the array
@ -143,53 +140,14 @@ protected:
  bool    mIsAuto;
 #endif

-  enum {
-    kArrayOwnerMask = 1 << 31,
-    kArrayHasAutoBufferMask = 1 << 30,
-    kArraySizeMask = ~(kArrayOwnerMask | kArrayHasAutoBufferMask)
-  };
-  enum { kAutoBufSize = 8 };
-
-
  // bit twiddlers
-  void SetArray(Impl *newImpl, int32_t aSize, int32_t aCount, bool aOwner,
-                bool aHasAuto);
-  inline bool IsArrayOwner() const {
-    return mImpl && (mImpl->mBits & kArrayOwnerMask);
-  }
-  inline bool HasAutoBuffer() const {
-    return mImpl && (mImpl->mBits & kArrayHasAutoBufferMask);
-  }
+  void SetArray(Impl *newImpl, int32_t aSize, int32_t aCount);

 private:
  /// Copy constructors are not allowed
  nsVoidArray(const nsVoidArray& other);
 };

-
-// A zero-based array with a bit of automatic internal storage
-class NS_COM_GLUE nsAutoVoidArray : public nsVoidArray {
-public:
-  nsAutoVoidArray();
-
-  void ResetToAutoBuffer()
-  {
-    SetArray(reinterpret_cast<Impl*>(mAutoBuf), kAutoBufSize, 0, false,
-             true);
-  }
-
-  nsAutoVoidArray& operator=(const nsVoidArray& other)
-  {
-    nsVoidArray::operator=(other);
-    return *this;
-  }
-  
-protected:
-  // The internal storage
-  char mAutoBuf[sizeof(Impl) + (kAutoBufSize - 1) * sizeof(void*)];
-};
-
-
 //===================================================================
 //  nsSmallVoidArray is not a general-purpose replacement for
 //  ns(Auto)VoidArray because there is (some) extra CPU overhead for arrays