Merge the inbound to m-c.

accessible/src/msaa/ARIAGridAccessibleWrap.cpp

@@ -21,6 +21,12 @@ IMPL_IUNKNOWN_INHERITED1(ARIAGridAccessibleWrap,
                          AccessibleWrap,
                          ia2AccessibleTable)
 
+void
+ARIAGridAccessibleWrap::Shutdown()
+{
+  ia2AccessibleTable::mTable = nullptr;
+  ARIAGridAccessible::Shutdown();
+}
 
 ////////////////////////////////////////////////////////////////////////////////
 // ARIAGridCellAccessibleWrap
@@ -33,3 +39,9 @@ IMPL_IUNKNOWN_INHERITED1(ARIAGridCellAccessibleWrap,
                          HyperTextAccessibleWrap,
                          ia2AccessibleTableCell)
 
+void
+ARIAGridCellAccessibleWrap::Shutdown()
+{
+  ia2AccessibleTableCell::mTableCell = nullptr;
+  ARIAGridCellAccessible::Shutdown();
+}

accessible/src/msaa/ARIAGridAccessibleWrap.h

@@ -24,13 +24,15 @@ class ARIAGridAccessibleWrap : public ARIAGridAccessible,
 {
 public:
   ARIAGridAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
-    ARIAGridAccessible(aContent, aDoc) {}
+    ARIAGridAccessible(aContent, aDoc), ia2AccessibleTable(this) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+
+  virtual void Shutdown() MOZ_OVERRIDE;
 };
 
 /**
@@ -42,13 +44,15 @@ class ARIAGridCellAccessibleWrap : public ARIAGridCellAccessible,
 {
 public:
   ARIAGridCellAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
-    ARIAGridCellAccessible(aContent, aDoc) {}
+    ARIAGridCellAccessible(aContent, aDoc), ia2AccessibleTableCell(this) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+
+  virtual void Shutdown() MOZ_OVERRIDE;
 };
 
 } // namespace a11y

accessible/src/msaa/HTMLTableAccessibleWrap.cpp

@@ -20,6 +20,12 @@ IMPL_IUNKNOWN_INHERITED1(HTMLTableAccessibleWrap,
                          AccessibleWrap,
                          ia2AccessibleTable)
 
+void
+HTMLTableAccessibleWrap::Shutdown()
+{
+  ia2AccessibleTable::mTable = nullptr;
+  HTMLTableAccessible::Shutdown();
+}
 
 ////////////////////////////////////////////////////////////////////////////////
 // HTMLTableCellAccessibleWrap
@@ -32,6 +38,12 @@ IMPL_IUNKNOWN_INHERITED1(HTMLTableCellAccessibleWrap,
                          HyperTextAccessibleWrap,
                          ia2AccessibleTableCell)
 
+void
+HTMLTableCellAccessibleWrap::Shutdown()
+{
+  ia2AccessibleTableCell::mTableCell = nullptr;
+  HTMLTableCellAccessible::Shutdown();
+}
 
 ////////////////////////////////////////////////////////////////////////////////
 // HTMLTableCellAccessibleWrap
@@ -43,3 +55,10 @@ NS_IMPL_ISUPPORTS_INHERITED0(HTMLTableHeaderCellAccessibleWrap,
 IMPL_IUNKNOWN_INHERITED1(HTMLTableHeaderCellAccessibleWrap,
                          HyperTextAccessibleWrap,
                          ia2AccessibleTableCell)
+
+void
+HTMLTableHeaderCellAccessibleWrap::Shutdown()
+{
+  ia2AccessibleTableCell::mTableCell = nullptr;
+  HTMLTableHeaderCellAccessible::Shutdown();
+}

accessible/src/msaa/HTMLTableAccessibleWrap.h

@@ -25,13 +25,15 @@ class HTMLTableAccessibleWrap : public HTMLTableAccessible,
 {
 public:
   HTMLTableAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
-    HTMLTableAccessible(aContent, aDoc) {}
+    HTMLTableAccessible(aContent, aDoc), ia2AccessibleTable(this)  {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+
+  virtual void Shutdown() MOZ_OVERRIDE;
 };
 
 
@@ -44,13 +46,15 @@ class HTMLTableCellAccessibleWrap : public HTMLTableCellAccessible,
 {
 public:
   HTMLTableCellAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
-    HTMLTableCellAccessible(aContent, aDoc) {}
+    HTMLTableCellAccessible(aContent, aDoc), ia2AccessibleTableCell(this) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+
+  virtual void Shutdown() MOZ_OVERRIDE;
 };
 
 
@@ -64,13 +68,16 @@ class HTMLTableHeaderCellAccessibleWrap : public HTMLTableHeaderCellAccessible,
 public:
   HTMLTableHeaderCellAccessibleWrap(nsIContent* aContent,
                                     DocAccessible* aDoc) :
-    HTMLTableHeaderCellAccessible(aContent, aDoc) {}
+    HTMLTableHeaderCellAccessible(aContent, aDoc), ia2AccessibleTableCell(this)
+  {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+
+  virtual void Shutdown() MOZ_OVERRIDE;
 };
 
 } // namespace a11y

accessible/src/msaa/XULListboxAccessibleWrap.cpp

@@ -11,12 +11,6 @@ using namespace mozilla::a11y;
 // XULListboxAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
-XULListboxAccessibleWrap::
-  XULListboxAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
-  XULListboxAccessible(aContent, aDoc)
-{
-}
-
 NS_IMPL_ISUPPORTS_INHERITED0(XULListboxAccessibleWrap,
                              XULListboxAccessible)
 
@@ -25,20 +19,27 @@ IMPL_IUNKNOWN_QUERY_CLASS_COND(ia2AccessibleTable, IsMulticolumn());
 IMPL_IUNKNOWN_QUERY_CLASS(AccessibleWrap)
 IMPL_IUNKNOWN_QUERY_TAIL
 
+void
+XULListboxAccessibleWrap::Shutdown()
+{
+  ia2AccessibleTable::mTable = nullptr;
+  XULListboxAccessible::Shutdown();
+}
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULListCellAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
-XULListCellAccessibleWrap::
-  XULListCellAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
-  XULListCellAccessible(aContent, aDoc)
-{
-}
-
 NS_IMPL_ISUPPORTS_INHERITED0(XULListCellAccessibleWrap,
                              XULListCellAccessible)
 
 IMPL_IUNKNOWN_INHERITED1(XULListCellAccessibleWrap,
                          HyperTextAccessibleWrap,
                          ia2AccessibleTableCell)
+
+void
+XULListCellAccessibleWrap::Shutdown()
+{
+  ia2AccessibleTableCell::mTableCell = nullptr;
+  XULListCellAccessible::Shutdown();
+}

accessible/src/msaa/XULListboxAccessibleWrap.h

@@ -22,13 +22,16 @@ class XULListboxAccessibleWrap : public XULListboxAccessible,
                                  public ia2AccessibleTable
 {
 public:
-  XULListboxAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc);
+  XULListboxAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
+    XULListboxAccessible(aContent, aDoc), ia2AccessibleTable(this) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+
+  virtual void Shutdown() MOZ_OVERRIDE;
 };
 
 /**
@@ -39,13 +42,16 @@ class XULListCellAccessibleWrap : public XULListCellAccessible,
                                   public ia2AccessibleTableCell
 {
 public:
-  XULListCellAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc);
+  XULListCellAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
+    XULListCellAccessible(aContent, aDoc), ia2AccessibleTableCell(this) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+
+  virtual void Shutdown() MOZ_OVERRIDE;
 };
 
 } // namespace a11y

accessible/src/msaa/XULTreeGridAccessibleWrap.cpp

@@ -11,12 +11,6 @@ using namespace mozilla::a11y;
 // XULTreeGridAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
-XULTreeGridAccessibleWrap::
-  XULTreeGridAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
-  XULTreeGridAccessible(aContent, aDoc)
-{
-}
-
 NS_IMPL_ISUPPORTS_INHERITED0(XULTreeGridAccessibleWrap,
                              XULTreeGridAccessible)
 
@@ -24,26 +18,27 @@ IMPL_IUNKNOWN_INHERITED1(XULTreeGridAccessibleWrap,
                          AccessibleWrap,
                          ia2AccessibleTable)
 
+void
+XULTreeGridAccessibleWrap::Shutdown()
+{
+  ia2AccessibleTable::mTable = nullptr;
+  XULTreeGridAccessible::Shutdown();
+}
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULTreeGridCellAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
-XULTreeGridCellAccessibleWrap::
-  XULTreeGridCellAccessibleWrap(nsIContent* aContent,
-                                DocAccessible* aDoc,
-                                XULTreeGridRowAccessible* aRowAcc,
-                                nsITreeBoxObject* aTree,
-                                nsITreeView* aTreeView,
-                                int32_t aRow, nsITreeColumn* aColumn) :
-  XULTreeGridCellAccessible(aContent, aDoc, aRowAcc, aTree, aTreeView,
-                            aRow, aColumn)
-{
-}
-
 NS_IMPL_ISUPPORTS_INHERITED0(XULTreeGridCellAccessibleWrap,
                              XULTreeGridCellAccessible)
 
 IMPL_IUNKNOWN_INHERITED1(XULTreeGridCellAccessibleWrap,
                          AccessibleWrap,
                          ia2AccessibleTableCell)
+
+void
+XULTreeGridCellAccessibleWrap::Shutdown()
+{
+  ia2AccessibleTableCell::mTableCell = nullptr;
+  XULTreeGridCellAccessible::Shutdown();
+}

accessible/src/msaa/XULTreeGridAccessibleWrap.h

@@ -22,13 +22,16 @@ class XULTreeGridAccessibleWrap : public XULTreeGridAccessible,
                                   public ia2AccessibleTable
 {
 public:
-  XULTreeGridAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc);
+  XULTreeGridAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
+    XULTreeGridAccessible(aContent, aDoc), ia2AccessibleTable(this) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+
+  virtual void Shutdown() MOZ_OVERRIDE;
 };
 
 /**
@@ -44,13 +47,17 @@ public:
                                 XULTreeGridRowAccessible* aRowAcc,
                                 nsITreeBoxObject* aTree,
                                 nsITreeView* aTreeView,
-                                int32_t aRow, nsITreeColumn* aColumn);
+                                int32_t aRow, nsITreeColumn* aColumn) :
+    XULTreeGridCellAccessible(aContent, aDoc, aRowAcc, aTree, aTreeView, aRow,
+                              aColumn), ia2AccessibleTableCell(this) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+
+  virtual void Shutdown() MOZ_OVERRIDE;
 };
 
 } // namespace a11y

accessible/src/windows/ia2/ia2AccessibleTable.cpp

@@ -11,21 +11,15 @@
 #include "AccessibleTable_i.c"
 #include "AccessibleTable2_i.c"
 
-#include "nsIAccessible.h"
-#include "nsIAccessibleTable.h"
-#include "nsIWinAccessNode.h"
-#include "nsAccessNodeWrap.h"
-#include "nsWinUtils.h"
+#include "AccessibleWrap.h"
 #include "Statistics.h"
+#include "TableAccessible.h"
 
 #include "nsCOMPtr.h"
 #include "nsString.h"
 
 using namespace mozilla::a11y;
 
-#define CANT_QUERY_ASSERTION_MSG \
-"Subclass of ia2AccessibleTable doesn't implement nsIAccessibleTable"\
-
 // IUnknown
 
 STDMETHODIMP
@@ -53,36 +47,10 @@ ia2AccessibleTable::QueryInterface(REFIID iid, void** ppv)
 // IAccessibleTable
 
 STDMETHODIMP
-ia2AccessibleTable::get_accessibleAt(long aRow, long aColumn,
-                                   IUnknown **aAccessible)
+ia2AccessibleTable::get_accessibleAt(long aRowIdx, long aColIdx,
+                                     IUnknown** aAccessible)
 {
-  A11Y_TRYBLOCK_BEGIN
-
-  *aAccessible = NULL;
-
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
-
-  nsCOMPtr<nsIAccessible> cell;
-  nsresult rv = tableAcc->GetCellAt(aRow, aColumn, getter_AddRefs(cell));
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  nsCOMPtr<nsIWinAccessNode> winAccessNode(do_QueryInterface(cell));
-  if (!winAccessNode)
-    return E_FAIL;
-
-  void *instancePtr = NULL;
-  rv = winAccessNode->QueryNativeInterface(IID_IAccessible2, &instancePtr);
-  if (NS_FAILED(rv))
-    return E_FAIL;
-
-  *aAccessible = static_cast<IUnknown*>(instancePtr);
-  return S_OK;
-
-  A11Y_TRYBLOCK_END
+  return get_cellAt(aRowIdx, aColIdx, aAccessible);
 }
 
 STDMETHODIMP
@@ -91,76 +59,54 @@ ia2AccessibleTable::get_caption(IUnknown** aAccessible)
   A11Y_TRYBLOCK_BEGIN
 
   *aAccessible = NULL;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
-
-  nsCOMPtr<nsIAccessible> caption;
-  nsresult rv = tableAcc->GetCaption(getter_AddRefs(caption));
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
+  AccessibleWrap* caption = static_cast<AccessibleWrap*>(mTable->Caption());
   if (!caption)
     return S_FALSE;
 
-  nsCOMPtr<nsIWinAccessNode> winAccessNode(do_QueryInterface(caption));
-  if (!winAccessNode)
-    return E_FAIL;
-
-  void *instancePtr = NULL;
-  rv = winAccessNode->QueryNativeInterface(IID_IAccessible2, &instancePtr);
-  if (NS_FAILED(rv))
-    return E_FAIL;
-
-  *aAccessible = static_cast<IUnknown*>(instancePtr);
+  (*aAccessible = static_cast<IAccessible*>(caption))->AddRef();
   return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_childIndex(long aRowIndex, long aColumnIndex,
-                                   long* aChildIndex)
+ia2AccessibleTable::get_childIndex(long aRowIdx, long aColIdx,
+                                   long* aChildIdx)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aChildIndex = 0;
+  *aChildIdx = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (aRowIdx < 0 || aColIdx < 0 ||
+      static_cast<uint32_t>(aRowIdx) >= mTable->RowCount() ||
+      static_cast<uint32_t>(aColIdx) >= mTable->ColCount())
+    return E_INVALIDARG;
 
-  int32_t childIndex = 0;
-  nsresult rv = tableAcc->GetCellIndexAt(aRowIndex, aColumnIndex, &childIndex);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aChildIndex = childIndex;
+  *aChildIdx = mTable->CellIndexAt(aRowIdx, aColIdx);
   return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_columnDescription(long aColumn, BSTR* aDescription)
+ia2AccessibleTable::get_columnDescription(long aColIdx, BSTR* aDescription)
 {
   A11Y_TRYBLOCK_BEGIN
 
   *aDescription = NULL;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (aColIdx < 0 || static_cast<uint32_t>(aColIdx) >= mTable->ColCount())
+    return E_INVALIDARG;
 
   nsAutoString descr;
-  nsresult rv = tableAcc->GetColumnDescription (aColumn, descr);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
+  mTable->ColDescription(aColIdx, descr);
   if (descr.IsEmpty())
     return S_FALSE;
 
@@ -171,24 +117,21 @@ ia2AccessibleTable::get_columnDescription(long aColumn, BSTR* aDescription)
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_columnExtentAt(long aRow, long aColumn,
-                                      long* nColumnsSpanned)
+ia2AccessibleTable::get_columnExtentAt(long aRowIdx, long aColIdx,
+                                      long* aSpan)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *nColumnsSpanned = 0;
+  *aSpan = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (aRowIdx < 0 || aColIdx < 0 ||
+      static_cast<uint32_t>(aRowIdx) >= mTable->RowCount() ||
+      static_cast<uint32_t>(aColIdx) >= mTable->ColCount())
+    return E_INVALIDARG;
 
-  int32_t columnsSpanned = 0;
-  nsresult rv = tableAcc->GetColumnExtentAt(aRow, aColumn, &columnsSpanned);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *nColumnsSpanned = columnsSpanned;
+  *aSpan = mTable->ColExtentAt(aRowIdx, aColIdx);
   return S_OK;
 
   A11Y_TRYBLOCK_END
@@ -208,46 +151,34 @@ ia2AccessibleTable::get_columnHeader(IAccessibleTable** aAccessibleTable,
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_columnIndex(long aChildIndex, long* aColumnIndex)
+ia2AccessibleTable::get_columnIndex(long aCellIdx, long* aColIdx)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aColumnIndex = 0;
+  *aColIdx = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (aCellIdx < 0 ||
+      static_cast<uint32_t>(aCellIdx) >= mTable->ColCount() * mTable->RowCount())
+    return E_INVALIDARG;
 
-  int32_t columnIndex = 0;
-  nsresult rv = tableAcc->GetColumnIndexAt(aChildIndex, &columnIndex);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aColumnIndex = columnIndex;
+  *aColIdx = mTable->ColIndexAt(aCellIdx);
   return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_nColumns(long* aColumnCount)
+ia2AccessibleTable::get_nColumns(long* aColCount)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aColumnCount = 0;
+  *aColCount = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
-
-  int32_t columnCount = 0;
-  nsresult rv = tableAcc->GetColumnCount(&columnCount);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aColumnCount = columnCount;
+  *aColCount = mTable->ColCount();
   return S_OK;
 
   A11Y_TRYBLOCK_END
@@ -259,18 +190,10 @@ ia2AccessibleTable::get_nRows(long* aRowCount)
   A11Y_TRYBLOCK_BEGIN
 
   *aRowCount = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
-
-  int32_t rowCount = 0;
-  nsresult rv = tableAcc->GetRowCount(&rowCount);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aRowCount = rowCount;
+  *aRowCount = mTable->RowCount();
   return S_OK;
 
   A11Y_TRYBLOCK_END
@@ -279,44 +202,19 @@ ia2AccessibleTable::get_nRows(long* aRowCount)
 STDMETHODIMP
 ia2AccessibleTable::get_nSelectedChildren(long* aChildCount)
 {
-  A11Y_TRYBLOCK_BEGIN
-
-  *aChildCount = 0;
-
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
-
-  uint32_t count = 0;
-  nsresult rv = tableAcc->GetSelectedCellCount(&count);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aChildCount = count;
-  return S_OK;
-
-  A11Y_TRYBLOCK_END
+  return get_nSelectedCells(aChildCount);
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_nSelectedColumns(long* aColumnCount)
+ia2AccessibleTable::get_nSelectedColumns(long* aColCount)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aColumnCount = 0;
+  *aColCount = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
-
-  uint32_t count = 0;
-  nsresult rv = tableAcc->GetSelectedColumnCount(&count);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aColumnCount = count;
+  *aColCount = mTable->SelectedColCount();
   return S_OK;
 
   A11Y_TRYBLOCK_END
@@ -328,40 +226,30 @@ ia2AccessibleTable::get_nSelectedRows(long* aRowCount)
   A11Y_TRYBLOCK_BEGIN
 
   *aRowCount = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  *aRowCount = mTable->SelectedRowCount();
 
-  uint32_t count = 0;
-  nsresult rv = tableAcc->GetSelectedRowCount(&count);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aRowCount = count;
   return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_rowDescription(long aRow, BSTR* aDescription)
+ia2AccessibleTable::get_rowDescription(long aRowIdx, BSTR* aDescription)
 {
   A11Y_TRYBLOCK_BEGIN
 
   *aDescription = NULL;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (aRowIdx < 0 || static_cast<uint32_t>(aRowIdx) >= mTable->RowCount())
+    return E_INVALIDARG;
 
   nsAutoString descr;
-  nsresult rv = tableAcc->GetRowDescription (aRow, descr);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
+  mTable->RowDescription(aRowIdx, descr);
   if (descr.IsEmpty())
     return S_FALSE;
 
@@ -372,24 +260,20 @@ ia2AccessibleTable::get_rowDescription(long aRow, BSTR* aDescription)
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_rowExtentAt(long aRow, long aColumn,
-                                    long* aNRowsSpanned)
+ia2AccessibleTable::get_rowExtentAt(long aRowIdx, long aColIdx, long* aSpan)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aNRowsSpanned = 0;
+  *aSpan = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (aRowIdx < 0 || aColIdx < 0 ||
+      static_cast<uint32_t>(aRowIdx) >= mTable->RowCount() ||
+      static_cast<uint32_t>(aColIdx) >= mTable->ColCount())
+    return E_INVALIDARG;
 
-  int32_t rowsSpanned = 0;
-  nsresult rv = tableAcc->GetRowExtentAt(aRow, aColumn, &rowsSpanned);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aNRowsSpanned = rowsSpanned;
+  *aSpan = mTable->RowExtentAt(aRowIdx, aColIdx);
   return S_OK;
 
   A11Y_TRYBLOCK_END
@@ -409,23 +293,19 @@ ia2AccessibleTable::get_rowHeader(IAccessibleTable** aAccessibleTable,
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_rowIndex(long aChildIndex, long* aRowIndex)
+ia2AccessibleTable::get_rowIndex(long aCellIdx, long* aRowIdx)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aRowIndex = 0;
+  *aRowIdx = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (aCellIdx < 0 ||
+      static_cast<uint32_t>(aCellIdx) >= mTable->ColCount() * mTable->RowCount())
+    return E_INVALIDARG;
 
-  int32_t rowIndex = 0;
-  nsresult rv = tableAcc->GetRowIndexAt(aChildIndex, &rowIndex);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aRowIndex = rowIndex;
+  *aRowIdx = mTable->RowIndexAt(aCellIdx);
   return S_OK;
 
   A11Y_TRYBLOCK_END
@@ -437,7 +317,24 @@ ia2AccessibleTable::get_selectedChildren(long aMaxChildren, long** aChildren,
 {
   A11Y_TRYBLOCK_BEGIN
 
-  return GetSelectedItems(aChildren, aNChildren, ITEMSTYPE_CELLS);
+  *aChildren = NULL;
+  *aNChildren = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
+
+  nsAutoTArray<uint32_t, 30> cellIndices;
+  mTable->SelectedCellIndices(&cellIndices);
+
+  uint32_t maxCells = cellIndices.Length();
+  if (maxCells == 0)
+    return S_FALSE;
+
+  *aChildren = static_cast<LONG*>(moz_xmalloc(sizeof(LONG) * maxCells));
+  *aNChildren = maxCells;
+  for (uint32_t i = 0; i < maxCells; i++)
+    (*aChildren)[i] = cellIndices[i];
+
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
@@ -448,7 +345,7 @@ ia2AccessibleTable::get_selectedColumns(long aMaxColumns, long** aColumns,
 {
   A11Y_TRYBLOCK_BEGIN
 
-  return GetSelectedItems(aColumns, aNColumns, ITEMSTYPE_COLUMNS);
+  return get_selectedColumns(aColumns, aNColumns);
 
   A11Y_TRYBLOCK_END
 }
@@ -458,7 +355,7 @@ ia2AccessibleTable::get_selectedRows(long aMaxRows, long** aRows, long* aNRows)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  return GetSelectedItems(aRows, aNRows, ITEMSTYPE_ROWS);
+  return get_selectedRows(aRows, aNRows);
 
   A11Y_TRYBLOCK_END
 }
@@ -480,182 +377,159 @@ ia2AccessibleTable::get_summary(IUnknown** aAccessible)
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_isColumnSelected(long aColumn, boolean* aIsSelected)
+ia2AccessibleTable::get_isColumnSelected(long aColIdx, boolean* aIsSelected)
 {
   A11Y_TRYBLOCK_BEGIN
 
   *aIsSelected = false;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (aColIdx < 0 || static_cast<uint32_t>(aColIdx) >= mTable->ColCount())
+    return E_INVALIDARG;
 
-  bool isSelected = false;
-  nsresult rv = tableAcc->IsColumnSelected(aColumn, &isSelected);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aIsSelected = isSelected;
+  *aIsSelected = mTable->IsColSelected(aColIdx);
   return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_isRowSelected(long aRow, boolean* aIsSelected)
+ia2AccessibleTable::get_isRowSelected(long aRowIdx, boolean* aIsSelected)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  *aIsSelected = false;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  bool isSelected = false;
-  nsresult rv = tableAcc->IsRowSelected(aRow, &isSelected);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
+  if (aRowIdx < 0 || static_cast<uint32_t>(aRowIdx) >= mTable->RowCount())
+    return E_INVALIDARG;
 
-  *aIsSelected = isSelected;
+  *aIsSelected = mTable->IsRowSelected(aRowIdx);
   return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_isSelected(long aRow, long aColumn,
+ia2AccessibleTable::get_isSelected(long aRowIdx, long aColIdx,
                                    boolean* aIsSelected)
 {
   A11Y_TRYBLOCK_BEGIN
 
   *aIsSelected = false;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (aRowIdx < 0 || aColIdx < 0 ||
+      static_cast<uint32_t>(aColIdx) >= mTable->ColCount() ||
+      static_cast<uint32_t>(aRowIdx) >= mTable->RowCount())
+    return E_INVALIDARG;
 
-  bool isSelected = false;
-  nsresult rv = tableAcc->IsCellSelected(aRow, aColumn, &isSelected);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aIsSelected = isSelected;
+  *aIsSelected = mTable->IsCellSelected(aRowIdx, aColIdx);
   return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::selectRow(long aRow)
+ia2AccessibleTable::selectRow(long aRowIdx)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsresult rv = tableAcc->SelectRow(aRow);
-  return GetHRESULT(rv);
+  if (aRowIdx < 0 || static_cast<uint32_t>(aRowIdx) >= mTable->RowCount())
+    return E_INVALIDARG;
+
+  mTable->SelectRow(aRowIdx);
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::selectColumn(long aColumn)
+ia2AccessibleTable::selectColumn(long aColIdx)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsresult rv = tableAcc->SelectColumn(aColumn);
-  return GetHRESULT(rv);
+  if (aColIdx < 0 || static_cast<uint32_t>(aColIdx) >= mTable->ColCount())
+    return E_INVALIDARG;
+
+  mTable->SelectCol(aColIdx);
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::unselectRow(long aRow)
+ia2AccessibleTable::unselectRow(long aRowIdx)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsresult rv = tableAcc->UnselectRow(aRow);
-  return GetHRESULT(rv);
+  if (aRowIdx < 0 || static_cast<uint32_t>(aRowIdx) >= mTable->RowCount())
+    return E_INVALIDARG;
+
+  mTable->UnselectRow(aRowIdx);
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::unselectColumn(long aColumn)
+ia2AccessibleTable::unselectColumn(long aColIdx)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsresult rv = tableAcc->UnselectColumn(aColumn);
-  return GetHRESULT(rv);
+  if (aColIdx < 0 || static_cast<uint32_t>(aColIdx) >= mTable->ColCount())
+    return E_INVALIDARG;
+
+  mTable->UnselectCol(aColIdx);
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTable::get_rowColumnExtentsAtIndex(long aIndex, long* aRow,
-                                                long* aColumn,
+ia2AccessibleTable::get_rowColumnExtentsAtIndex(long aCellIdx, long* aRowIdx,
+                                                long* aColIdx,
                                                 long* aRowExtents,
-                                                long* aColumnExtents,
+                                                long* aColExtents,
                                                 boolean* aIsSelected)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aRow = 0;
-  *aColumn = 0;
+  *aRowIdx = 0;
+  *aColIdx = 0;
   *aRowExtents = 0;
-  *aColumnExtents = 0;
+  *aColExtents = 0;
   *aIsSelected = false;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  if (aCellIdx < 0 ||
+      static_cast<uint32_t>(aCellIdx) >= mTable->ColCount() * mTable->RowCount())
+    return E_INVALIDARG;
 
-  int32_t rowIdx = -1, columnIdx = -1;
-  nsresult rv = tableAcc->GetRowAndColumnIndicesAt(aIndex, &rowIdx, &columnIdx);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
+  int32_t colIdx = 0, rowIdx = 0;
+  mTable->RowAndColIndicesAt(aCellIdx, &rowIdx, &colIdx);
+  *aRowIdx = rowIdx;
+  *aColIdx = colIdx;
+  *aRowExtents = mTable->RowExtentAt(rowIdx, colIdx);
+  *aColExtents = mTable->ColExtentAt(rowIdx, colIdx);
+  *aIsSelected = mTable->IsCellSelected(rowIdx, colIdx);
 
-  int32_t rowExtents = 0;
-  rv = tableAcc->GetRowExtentAt(rowIdx, columnIdx, &rowExtents);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  int32_t columnExtents = 0;
-  rv = tableAcc->GetColumnExtentAt(rowIdx, columnIdx, &columnExtents);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  bool isSelected = false;
-  rv = tableAcc->IsCellSelected(rowIdx, columnIdx, &isSelected);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aRow = rowIdx;
-  *aColumn = columnIdx;
-  *aRowExtents = rowExtents;
-  *aColumnExtents = columnExtents;
-  *aIsSelected = isSelected;
   return S_OK;
 
   A11Y_TRYBLOCK_END
@@ -671,15 +545,39 @@ ia2AccessibleTable::get_modelChange(IA2TableModelChange* aModelChange)
 // IAccessibleTable2
 
 STDMETHODIMP
-ia2AccessibleTable::get_cellAt(long aRow, long aColumn, IUnknown** aCell)
+ia2AccessibleTable::get_cellAt(long aRowIdx, long aColIdx, IUnknown** aCell)
 {
-  return get_accessibleAt(aRow, aColumn, aCell);
+  A11Y_TRYBLOCK_BEGIN
+
+  *aCell = NULL;
+
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
+
+  AccessibleWrap* cell =
+    static_cast<AccessibleWrap*>(mTable->CellAt(aRowIdx, aColIdx));
+  if (!cell)
+    return E_INVALIDARG;
+
+  (*aCell = static_cast<IAccessible*>(cell))->AddRef();
+  return S_OK;
+
+  A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
 ia2AccessibleTable::get_nSelectedCells(long* aCellCount)
 {
-  return get_nSelectedChildren(aCellCount);
+  A11Y_TRYBLOCK_BEGIN
+
+  *aCellCount = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
+
+  *aCellCount = mTable->SelectedCellCount();
+  return S_OK;
+
+  A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
@@ -687,17 +585,30 @@ ia2AccessibleTable::get_selectedCells(IUnknown*** aCells, long* aNSelectedCells)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
+  *aCells = NULL;
+  *aNSelectedCells = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIArray> geckoCells;
-  nsresult rv = tableAcc->GetSelectedCells(getter_AddRefs(geckoCells));
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
+  nsAutoTArray<Accessible*, 30> cells;
+  mTable->SelectedCells(&cells);
+  if (cells.IsEmpty())
+    return S_FALSE;
 
-  return nsWinUtils::ConvertToIA2Array(geckoCells, aCells, aNSelectedCells);
+  *aCells =
+    static_cast<IUnknown**>(::CoTaskMemAlloc(sizeof(IUnknown*) *
+                                             cells.Length()));
+  if (!*aCells)
+    return E_OUTOFMEMORY;
+
+  for (uint32_t i = 0; i < cells.Length(); i++) {
+    (*aCells)[i] =
+      static_cast<IAccessible*>(static_cast<AccessibleWrap*>(cells[i]));
+    ((*aCells)[i])->AddRef();
+  }
+
+  *aNSelectedCells = cells.Length();
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
@@ -707,7 +618,24 @@ ia2AccessibleTable::get_selectedColumns(long** aColumns, long* aNColumns)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  return GetSelectedItems(aColumns, aNColumns, ITEMSTYPE_COLUMNS);
+  *aColumns = NULL;
+  *aNColumns = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
+
+  nsAutoTArray<uint32_t, 30> colIndices;
+  mTable->SelectedColIndices(&colIndices);
+
+  uint32_t maxCols = colIndices.Length();
+  if (maxCols == 0)
+    return S_FALSE;
+
+  *aColumns = static_cast<LONG*>(moz_xmalloc(sizeof(LONG) * maxCols));
+  *aNColumns = maxCols;
+  for (uint32_t i = 0; i < maxCols; i++)
+    (*aColumns)[i] = colIndices[i];
+
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
@@ -717,58 +645,24 @@ ia2AccessibleTable::get_selectedRows(long** aRows, long* aNRows)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  return GetSelectedItems(aRows, aNRows, ITEMSTYPE_ROWS);
+  *aRows = NULL;
+  *aNRows = 0;
+  if (!mTable)
+    return CO_E_OBJNOTCONNECTED;
+
+  nsAutoTArray<uint32_t, 30> rowIndices;
+  mTable->SelectedRowIndices(&rowIndices);
+
+  uint32_t maxRows = rowIndices.Length();
+  if (maxRows == 0)
+    return S_FALSE;
+
+  *aRows = static_cast<LONG*>(moz_xmalloc(sizeof(LONG) * maxRows));
+  *aNRows = maxRows;
+  for (uint32_t i = 0; i < maxRows; i++)
+    (*aRows)[i] = rowIndices[i];
+
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
-
-////////////////////////////////////////////////////////////////////////////////
-// ia2AccessibleTable public
-
-HRESULT
-ia2AccessibleTable::GetSelectedItems(long** aItems, long* aItemsCount,
-                                     eItemsType aType)
-{
-  *aItemsCount = 0;
-
-  nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryObject(this));
-  NS_ASSERTION(tableAcc, CANT_QUERY_ASSERTION_MSG);
-  if (!tableAcc)
-    return E_FAIL;
-
-  uint32_t size = 0;
-  int32_t *items = nullptr;
-
-  nsresult rv = NS_OK;
-  switch (aType) {
-    case ITEMSTYPE_CELLS:
-      rv = tableAcc->GetSelectedCellIndices(&size, &items);
-      break;
-    case ITEMSTYPE_COLUMNS:
-      rv = tableAcc->GetSelectedColumnIndices(&size, &items);
-      break;
-    case ITEMSTYPE_ROWS:
-      rv = tableAcc->GetSelectedRowIndices(&size, &items);
-      break;
-    default:
-      return E_FAIL;
-  }
-
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  if (size == 0 || !items)
-    return S_FALSE;
-
-  *aItems = static_cast<long*>(nsMemory::Alloc((size) * sizeof(long)));
-  if (!*aItems)
-    return E_OUTOFMEMORY;
-
-  *aItemsCount = size;
-  for (uint32_t index = 0; index < size; ++index)
-    (*aItems)[index] = items[index];
-
-  nsMemory::Free(items);
-  return S_OK;
-}
-

accessible/src/windows/ia2/ia2AccessibleTable.h

@@ -8,11 +8,14 @@
 #ifndef _ACCESSIBLE_TABLE_H
 #define _ACCESSIBLE_TABLE_H
 
-#include "nsISupports.h"
-
 #include "AccessibleTable.h"
 #include "AccessibleTable2.h"
 
+namespace mozilla {
+namespace a11y {
+
+class TableAccessible;
+
 class ia2AccessibleTable : public IAccessibleTable,
                            public IAccessibleTable2
 {
@@ -161,17 +164,13 @@ public:
       /* [out, size_is(,*nRows)] */ long **selectedRows, 
       /* [out, retval] */ long *nRows);
 
-  // nsISupports
-  NS_IMETHOD QueryInterface(const nsIID& uuid, void** result) = 0;
+protected:
+  ia2AccessibleTable(TableAccessible* aTable) : mTable(aTable) {}
 
-private:
-  enum eItemsType {
-    ITEMSTYPE_CELLS,
-    ITEMSTYPE_COLUMNS,
-    ITEMSTYPE_ROWS
-  };
-
-  HRESULT GetSelectedItems(long **aItems, long *aItemsCount, eItemsType aType);
+  TableAccessible* mTable;
 };
 
+} // namespace a11y
+} // namespace mozilla
+
 #endif

accessible/src/windows/ia2/ia2AccessibleTableCell.cpp

@@ -11,20 +11,15 @@
 #include "AccessibleTable2_i.c"
 #include "AccessibleTableCell_i.c"
 
-#include "nsIAccessible.h"
-#include "nsIAccessibleTable.h"
-#include "nsIWinAccessNode.h"
-#include "nsAccessNodeWrap.h"
-#include "nsWinUtils.h"
+#include "AccessibleWrap.h"
+#include "TableAccessible.h"
+#include "TableCellAccessible.h"
 
 #include "nsCOMPtr.h"
 #include "nsString.h"
 
 using namespace mozilla::a11y;
 
-#define TABLECELL_INTERFACE_UNSUPPORTED_MSG \
-"Subclass of ia2AccessibleTableCell doesn't implement nsIAccessibleTableCell"\
-
 // IUnknown
 
 STDMETHODIMP
@@ -49,51 +44,34 @@ ia2AccessibleTableCell::get_table(IUnknown** aTable)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  nsCOMPtr<nsIAccessibleTableCell> tableCell(do_QueryObject(this));
-  NS_ASSERTION(tableCell, TABLECELL_INTERFACE_UNSUPPORTED_MSG);
-  if (!tableCell)
+  *aTable = NULL;
+  if (!mTableCell)
+    return CO_E_OBJNOTCONNECTED;
+
+  TableAccessible* table = mTableCell->Table();
+  if (!table)
     return E_FAIL;
 
-  nsCOMPtr<nsIAccessibleTable> geckoTable;
-  nsresult rv = tableCell->GetTable(getter_AddRefs(geckoTable));
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  nsCOMPtr<nsIWinAccessNode> winAccessNode = do_QueryInterface(geckoTable);
-  if (!winAccessNode)
-    return E_FAIL;
-
-  void *instancePtr = NULL;
-  rv = winAccessNode->QueryNativeInterface(IID_IUnknown, &instancePtr);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aTable = static_cast<IUnknown*>(instancePtr);
+  AccessibleWrap* wrap = static_cast<AccessibleWrap*>(table->AsAccessible());
+  *aTable = static_cast<IAccessible*>(wrap);
+  (*aTable)->AddRef();
   return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTableCell::get_columnExtent(long* aNColumnsSpanned)
+ia2AccessibleTableCell::get_columnExtent(long* aSpan)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aNColumnsSpanned = 0;
+  *aSpan = 0;
+  if (!mTableCell)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTableCell> tableCell(do_QueryObject(this));
-  NS_ASSERTION(tableCell, TABLECELL_INTERFACE_UNSUPPORTED_MSG);
-  if (!tableCell)
-    return E_FAIL;
+  *aSpan = mTableCell->ColExtent();
 
-  int32_t columnsSpanned = 0;
-  nsresult rv = tableCell->GetColumnExtent(&columnsSpanned);
-  if (NS_SUCCEEDED(rv)) {
-    *aNColumnsSpanned = columnsSpanned;
-    return S_OK;
-  }
-
-  return GetHRESULT(rv);
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
@@ -104,66 +82,59 @@ ia2AccessibleTableCell::get_columnHeaderCells(IUnknown*** aCellAccessibles,
 {
   A11Y_TRYBLOCK_BEGIN
 
-  nsCOMPtr<nsIAccessibleTableCell> tableCell(do_QueryObject(this));
-  NS_ASSERTION(tableCell, TABLECELL_INTERFACE_UNSUPPORTED_MSG);
-  if (!tableCell)
-    return E_FAIL;
+  *aCellAccessibles = NULL;
+  *aNColumnHeaderCells = 0;
+  if (!mTableCell)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIArray> headerCells;
-  nsresult rv = tableCell->GetColumnHeaderCells(getter_AddRefs(headerCells));  
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
+  nsAutoTArray<Accessible*, 10> cells;
+  mTableCell->ColHeaderCells(&cells);
 
-  return nsWinUtils::ConvertToIA2Array(headerCells, aCellAccessibles,
-                                       aNColumnHeaderCells);
+  *aNColumnHeaderCells = cells.Length();
+  *aCellAccessibles =
+    static_cast<IUnknown**>(::CoTaskMemAlloc(sizeof(IUnknown*) *
+                                             cells.Length()));
+
+  if (!*aCellAccessibles)
+    return E_OUTOFMEMORY;
+
+  for (uint32_t i = 0; i < cells.Length(); i++) {
+    AccessibleWrap* cell = static_cast<AccessibleWrap*>(cells[i]);
+    (*aCellAccessibles)[i] = static_cast<IAccessible*>(cell);
+    (*aCellAccessibles)[i]->AddRef();
+  }
+
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTableCell::get_columnIndex(long* aColumnIndex)
+ia2AccessibleTableCell::get_columnIndex(long* aColIdx)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aColumnIndex = -1;
+  *aColIdx = -1;
+  if (!mTableCell)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTableCell> tableCell(do_QueryObject(this));
-  NS_ASSERTION(tableCell, TABLECELL_INTERFACE_UNSUPPORTED_MSG);
-  if (!tableCell)
-    return E_FAIL;
-
-  int32_t colIdx = -1;
-  nsresult rv = tableCell->GetColumnIndex(&colIdx);
-  if (NS_SUCCEEDED(rv)) {
-    *aColumnIndex = colIdx;
-    return S_OK;
-  }
-
-  return GetHRESULT(rv);
+  *aColIdx = mTableCell->ColIdx();
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTableCell::get_rowExtent(long* aNRowsSpanned)
+ia2AccessibleTableCell::get_rowExtent(long* aSpan)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aNRowsSpanned = 0;
+  *aSpan = 0;
+  if (!mTableCell)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTableCell> tableCell(do_QueryObject(this));
-  NS_ASSERTION(tableCell, TABLECELL_INTERFACE_UNSUPPORTED_MSG);
-  if (!tableCell)
-    return E_FAIL;
-
-  int32_t rowsSpanned = 0;
-  nsresult rv = tableCell->GetRowExtent(&rowsSpanned);
-  if (NS_SUCCEEDED(rv)) {
-    *aNRowsSpanned = rowsSpanned;
-    return S_OK;
-  }
-
-  return GetHRESULT(rv);
+  *aSpan = mTableCell->RowExtent();
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
@@ -174,95 +145,66 @@ ia2AccessibleTableCell::get_rowHeaderCells(IUnknown*** aCellAccessibles,
 {
   A11Y_TRYBLOCK_BEGIN
 
-  nsCOMPtr<nsIAccessibleTableCell> tableCell(do_QueryObject(this));
-  NS_ASSERTION(tableCell, TABLECELL_INTERFACE_UNSUPPORTED_MSG);
-  if (!tableCell)
-    return E_FAIL;
+  *aCellAccessibles = NULL;
+  *aNRowHeaderCells = 0;
+  if (!mTableCell)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIArray> headerCells;
-  nsresult rv = tableCell->GetRowHeaderCells(getter_AddRefs(headerCells));  
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
+  nsAutoTArray<Accessible*, 10> cells;
+  mTableCell->RowHeaderCells(&cells);
 
-  return nsWinUtils::ConvertToIA2Array(headerCells, aCellAccessibles,
-                                       aNRowHeaderCells);
+  *aNRowHeaderCells = cells.Length();
+  *aCellAccessibles =
+    static_cast<IUnknown**>(::CoTaskMemAlloc(sizeof(IUnknown*) *
+                                             cells.Length()));
+  if (!*aCellAccessibles)
+    return E_OUTOFMEMORY;
+
+  for (uint32_t i = 0; i < cells.Length(); i++) {
+    AccessibleWrap* cell = static_cast<AccessibleWrap*>(cells[i]);
+    (*aCellAccessibles)[i] = static_cast<IAccessible*>(cell);
+    (*aCellAccessibles)[i]->AddRef();
+  }
+
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTableCell::get_rowIndex(long* aRowIndex)
+ia2AccessibleTableCell::get_rowIndex(long* aRowIdx)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aRowIndex = -1;
+  *aRowIdx = -1;
+  if (!mTableCell)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTableCell> tableCell(do_QueryObject(this));
-  NS_ASSERTION(tableCell, TABLECELL_INTERFACE_UNSUPPORTED_MSG);
-  if (!tableCell)
-    return E_FAIL;
-
-  int32_t rowIdx = -1;
-  nsresult rv = tableCell->GetRowIndex(&rowIdx);
-  if (NS_SUCCEEDED(rv)) {
-    *aRowIndex = rowIdx;
-    return S_OK;
-  }
-
-  return GetHRESULT(rv);
+  *aRowIdx = mTableCell->RowIdx();
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
 STDMETHODIMP
-ia2AccessibleTableCell::get_rowColumnExtents(long* aRow, long* aColumn,
+ia2AccessibleTableCell::get_rowColumnExtents(long* aRowIdx, long* aColIdx,
                                              long* aRowExtents,
-                                             long* aColumnExtents,
+                                             long* aColExtents,
                                              boolean* aIsSelected)
 {
   A11Y_TRYBLOCK_BEGIN
 
-  *aRow = 0;
-  *aRow = 0;
-  *aRow = 0;
-  *aColumnExtents = 0;
+  *aRowIdx = *aColIdx = *aRowExtents = *aColExtents = 0;
   *aIsSelected = false;
+  if (!mTableCell)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTableCell> tableCell(do_QueryObject(this));
-  NS_ASSERTION(tableCell, TABLECELL_INTERFACE_UNSUPPORTED_MSG);
-  if (!tableCell)
-    return E_FAIL;
+  *aRowIdx = mTableCell->RowIdx();
+  *aColIdx = mTableCell->ColIdx();
+  *aRowExtents = mTableCell->RowExtent();
+  *aColExtents = mTableCell->ColExtent();
+  *aIsSelected = mTableCell->Selected();
 
-  int32_t rowIdx = -1;
-  nsresult rv = tableCell->GetRowIndex(&rowIdx);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  int32_t columnIdx = -1;
-  rv = tableCell->GetColumnIndex(&columnIdx);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  int32_t spannedRows = 0;
-  rv = tableCell->GetRowExtent(&spannedRows);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  int32_t spannedColumns = 0;
-  rv = tableCell->GetColumnExtent(&spannedColumns);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  bool isSel = false;
-  rv = tableCell->IsSelected(&isSel);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aRow = rowIdx;
-  *aColumn = columnIdx;
-  *aRowExtents = spannedRows;
-  *aColumnExtents = spannedColumns;
-  *aIsSelected = isSel;
   return S_OK;
 
   A11Y_TRYBLOCK_END
@@ -274,20 +216,11 @@ ia2AccessibleTableCell::get_isSelected(boolean* aIsSelected)
   A11Y_TRYBLOCK_BEGIN
 
   *aIsSelected = false;
+  if (!mTableCell)
+    return CO_E_OBJNOTCONNECTED;
 
-  nsCOMPtr<nsIAccessibleTableCell> tableCell(do_QueryObject(this));
-  NS_ASSERTION(tableCell, TABLECELL_INTERFACE_UNSUPPORTED_MSG);
-  if (!tableCell)
-    return E_FAIL;
-
-  bool isSel = false;
-  nsresult rv = tableCell->IsSelected(&isSel);
-  if (NS_SUCCEEDED(rv)) {
-    *aIsSelected = isSel;
-    return S_OK;
-  }
-
-  return GetHRESULT(rv);
+  *aIsSelected = mTableCell->Selected();
+  return S_OK;
 
   A11Y_TRYBLOCK_END
 }

accessible/src/windows/ia2/ia2AccessibleTableCell.h

@@ -8,10 +8,12 @@
 #ifndef _ACCESSIBLE_TABLECELL_H
 #define _ACCESSIBLE_TABLECELL_H
 
-#include "nsISupports.h"
-
 #include "AccessibleTableCell.h"
 
+namespace mozilla {
+namespace a11y {
+class TableCellAccessible;
+
 class ia2AccessibleTableCell : public IAccessibleTableCell
 {
 public:
@@ -54,8 +56,14 @@ public:
   virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_isSelected(
       /* [out, retval] */ boolean *isSelected);
 
-  // nsISupports
-  NS_IMETHOD QueryInterface(const nsIID& uuid, void** result) = 0;
+protected:
+  ia2AccessibleTableCell(TableCellAccessible* aTableCell) :
+    mTableCell(aTableCell) {}
+
+  TableCellAccessible* mTableCell;
 };
 
+} // namespace a11y
+} // namespace mozilla
+
 #endif

b2g/chrome/content/forms.js

@@ -237,12 +237,20 @@ let FormAssistant = {
 
     switch (evt.type) {
       case "focus":
-        if (target && isContentEditable(target)) {
+        if (!target) {
+          break;
+        }
+
+        if (target instanceof HTMLDocument || target == content) {
+          break;
+        }
+
+        if (isContentEditable(target)) {
           this.showKeyboard(this.getTopLevelEditable(target));
           break;
         }
 
-        if (target && this.isFocusableElement(target))
+        if (this.isFocusableElement(target))
           this.showKeyboard(target);
         break;
 

browser/base/content/browser-context.inc

@@ -236,7 +236,7 @@
                 oncommand="AddKeywordForSearchField();"/>
       <menuitem id="context-searchselect"
                 oncommand="BrowserSearch.loadSearch(getBrowserSelection(), true,
-                                                    'application/x-moz-contextsearch');"/>
+                                                    'contextmenu');"/>
       <menuseparator id="frame-sep"/>
       <menu id="frame" label="&thisFrameMenu.label;" accesskey="&thisFrameMenu.accesskey;">
         <menupopup>

browser/base/content/browser-tabPreviews.js

@@ -294,21 +294,20 @@ var ctrlTab = {
   },
 
   advanceFocus: function ctrlTab_advanceFocus(aForward) {
+    let selectedIndex = Array.indexOf(this.previews, this.selected);
+    do {
+      selectedIndex += aForward ? 1 : -1;
+      if (selectedIndex < 0)
+        selectedIndex = this.previews.length - 1;
+      else if (selectedIndex >= this.previews.length)
+        selectedIndex = 0;
+    } while (this.previews[selectedIndex].hidden);
+
     if (this._selectedIndex == -1) {
-      // No virtual selectedIndex, focus must be in the panel already.
-      if (aForward)
-        document.commandDispatcher.advanceFocus();
-      else
-        document.commandDispatcher.rewindFocus();
+      // Focus is already in the panel.
+      this.previews[selectedIndex].focus();
     } else {
-      // Focus isn't in the panel yet, so we maintain a virtual selectedIndex.
-      do {
-        this._selectedIndex += aForward ? 1 : -1;
-        if (this._selectedIndex < 0)
-          this._selectedIndex = this.previews.length - 1;
-        else if (this._selectedIndex >= this.previews.length)
-          this._selectedIndex = 0;
-      } while (this.selected.hidden);
+      this._selectedIndex = selectedIndex;
     }
 
     if (this._timer) {

browser/base/content/browser.js

@@ -3461,12 +3461,12 @@ const BrowserSearch = {
    *        Boolean indicating whether or not the search should load in a new
    *        tab.
    *
-   * @param responseType [optional]
-   *        The MIME type that we'd like to receive in response
-   *        to this submission.  If null or the the response type is not supported
-   *        for the search engine, will fallback to "text/html".
+   * @param purpose [optional]
+   *        A string meant to indicate the context of the search request. This
+   *        allows the search service to provide a different nsISearchSubmission
+   *        depending on e.g. where the search is triggered in the UI.
    */
-  loadSearch: function BrowserSearch_search(searchText, useNewTab, responseType) {
+  loadSearch: function BrowserSearch_search(searchText, useNewTab, purpose) {
     var engine;
 
     // If the search bar is visible, use the current engine, otherwise, fall
@@ -3476,12 +3476,7 @@ const BrowserSearch = {
     else
       engine = Services.search.defaultEngine;
 
-    var submission = engine.getSubmission(searchText, responseType);
-
-    // If a response type was specified and getSubmission returned null,
-    // fallback to the default response type.
-    if (!submission && responseType)
-      submission = engine.getSubmission(searchText);
+    var submission = engine.getSubmission(searchText, null, purpose); // HTML response
 
     // getSubmission can return null if the engine doesn't have a URL
     // with a text/html response type.  This is unlikely (since

browser/base/content/test/browser_canonizeURL.js

@@ -17,7 +17,7 @@ var pairs = [
   ["1.1.1.1", "http://1.1.1.1/"],
   ["ftp://example", "ftp://example/"],
   ["ftp.example.bar", "ftp://ftp.example.bar/"],
-  ["ex ample", Services.search.originalDefaultEngine.getSubmission("ex ample", "application/x-moz-keywordsearch").uri.spec],
+  ["ex ample", Services.search.originalDefaultEngine.getSubmission("ex ample", null, "keyword").uri.spec],
 ];
 
 function testNext() {

browser/base/content/test/browser_keywordSearch.js

@@ -7,12 +7,12 @@ var gTests = [
   {
     name: "normal search (search service)",
     testText: "test search",
-    searchURL: Services.search.originalDefaultEngine.getSubmission("test search", "application/x-moz-keywordsearch").uri.spec
+    searchURL: Services.search.originalDefaultEngine.getSubmission("test search", null, "keyword").uri.spec
   },
   {
     name: "?-prefixed search (search service)",
     testText: "?   foo  ",
-    searchURL: Services.search.originalDefaultEngine.getSubmission("foo", "application/x-moz-keywordsearch").uri.spec
+    searchURL: Services.search.originalDefaultEngine.getSubmission("foo", null, "keyword").uri.spec
   },
   {
     name: "normal search (keyword.url)",

browser/base/content/test/browser_popupNotification.js

@@ -18,8 +18,11 @@ function cleanUp() {
     Services.obs.removeObserver(gActiveObservers[topic], topic);
   for (var eventName in gActiveListeners)
     PopupNotifications.panel.removeEventListener(eventName, gActiveListeners[eventName], false);
+  PopupNotifications.buttonDelay = PREF_SECURITY_DELAY_INITIAL;
 }
 
+const PREF_SECURITY_DELAY_INITIAL = Services.prefs.getIntPref("security.notification_enable_delay");
+
 var gActiveListeners = {};
 var gActiveObservers = {};
 var gShownState = {};
@@ -675,6 +678,52 @@ var tests = [
         this.notificationOld.remove();
       }
     ]
+  },
+  { // Test #23 - test security delay - too early
+    run: function () {
+      // Set the security delay to 100s
+      PopupNotifications.buttonDelay = 100000;
+
+      this.notifyObj = new basicNotification();
+      showNotification(this.notifyObj);
+    },
+    onShown: function (popup) {
+      checkPopup(popup, this.notifyObj);
+      triggerMainCommand(popup);
+
+      // Wait to see if the main command worked
+      executeSoon(function delayedDismissal() {
+        dismissNotification(popup);
+      });
+
+    },
+    onHidden: function (popup) {
+      ok(!this.notifyObj.mainActionClicked, "mainAction was not clicked because it was too soon");
+      ok(this.notifyObj.dismissalCallbackTriggered, "dismissal callback was triggered");
+    },
+  },
+  { // Test #24  - test security delay - after delay
+    run: function () {
+      // Set the security delay to 10ms
+      PopupNotifications.buttonDelay = 10;
+
+      this.notifyObj = new basicNotification();
+      showNotification(this.notifyObj);
+    },
+    onShown: function (popup) {
+      checkPopup(popup, this.notifyObj);
+
+      // Wait until after the delay to trigger the main action
+      setTimeout(function delayedDismissal() {
+        triggerMainCommand(popup);
+      }, 500);
+
+    },
+    onHidden: function (popup) {
+      ok(this.notifyObj.mainActionClicked, "mainAction was clicked after the delay");
+      ok(!this.notifyObj.dismissalCallbackTriggered, "dismissal callback was not triggered");
+      PopupNotifications.buttonDelay = PREF_SECURITY_DELAY_INITIAL;
+    },
   }
 ];
 

browser/components/preferences/sync.js

@@ -116,8 +116,9 @@ let gSyncPane = {
                                   null, null, null, {});
 
       // If the user selects cancel, just bail
-      if (buttonChoice == 1)
+      if (buttonChoice == 1) {
         return;
+      }
     }
 
     Weave.Service.startOver();
@@ -125,22 +126,24 @@ let gSyncPane = {
   },
 
   updatePass: function () {
-    if (Weave.Status.login == Weave.LOGIN_FAILED_LOGIN_REJECTED)
+    if (Weave.Status.login == Weave.LOGIN_FAILED_LOGIN_REJECTED) {
       gSyncUtils.changePassword();
-    else
+    } else {
       gSyncUtils.updatePassphrase();
+    }
   },
 
   resetPass: function () {
-    if (Weave.Status.login == Weave.LOGIN_FAILED_LOGIN_REJECTED)
+    if (Weave.Status.login == Weave.LOGIN_FAILED_LOGIN_REJECTED) {
       gSyncUtils.resetPassword();
-    else
+    } else {
       gSyncUtils.resetPassphrase();
+    }
   },
 
   /**
    * Invoke the Sync setup wizard.
-   * 
+   *
    * @param wizardType
    *        Indicates type of wizard to launch:
    *          null    -- regular set up wizard
@@ -149,9 +152,9 @@ let gSyncPane = {
    */
   openSetup: function (wizardType) {
     let win = Services.wm.getMostRecentWindow("Weave:AccountSetup");
-    if (win)
+    if (win) {
       win.focus();
-    else {
+    } else {
       window.openDialog("chrome://browser/content/sync/setup.xul",
                         "weaveSetup", "centerscreen,chrome,resizable=no",
                         wizardType);
@@ -160,23 +163,26 @@ let gSyncPane = {
 
   openQuotaDialog: function () {
     let win = Services.wm.getMostRecentWindow("Sync:ViewQuota");
-    if (win)
+    if (win) {
       win.focus();
-    else 
+    } else {
       window.openDialog("chrome://browser/content/sync/quota.xul", "",
                         "centerscreen,chrome,dialog,modal");
+    }
   },
 
   openAddDevice: function () {
-    if (!Weave.Utils.ensureMPUnlocked())
+    if (!Weave.Utils.ensureMPUnlocked()) {
       return;
-    
+    }
+
     let win = Services.wm.getMostRecentWindow("Sync:AddDevice");
-    if (win)
+    if (win) {
       win.focus();
-    else 
+    } else {
       window.openDialog("chrome://browser/content/sync/addDevice.xul",
                         "syncAddDevice", "centerscreen,chrome,resizable=no");
+    }
   },
 
   resetSync: function () {

browser/components/search/test/Makefile.in

@@ -6,11 +6,12 @@ DEPTH		= @DEPTH@
 topsrcdir	= @top_srcdir@
 srcdir		= @srcdir@
 VPATH		= @srcdir@
-relativesrcdir  =  @relativesrcdir@
+relativesrcdir  = @relativesrcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
 MOCHITEST_BROWSER_FILES = \
+  head.js \
   browser_405664.js \
   browser_addEngine.js \
   browser_contextmenu.js \
@@ -26,4 +27,13 @@ MOCHITEST_BROWSER_FILES = \
   test.html \
   $(NULL)
 
+ifdef ENABLE_TESTS
+pp_mochitest_browser_files := \
+  browser_google.js \
+  $(NULL)
+pp_mochitest_browser_files_PATH := $(DEPTH)/_tests/testing/mochitest/browser/$(relativesrcdir)
+pp_mochitest_browser_files_FLAGS := -DMOZ_DISTRIBUTION_ID=$(MOZ_DISTRIBUTION_ID)
+PP_TARGETS += pp_mochitest_browser_files
+endif # ENABLE_TESTS
+
 include $(topsrcdir)/config/rules.mk

browser/components/search/test/browser_google.js

@@ -0,0 +1,176 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/*
+ * Test Google search plugin URLs
+ */
+
+"use strict";
+
+const BROWSER_SEARCH_PREF      = "browser.search.";
+
+const MOZ_PARAM_LOCALE         = /\{moz:locale\}/g;
+const MOZ_PARAM_DIST_ID        = /\{moz:distributionID\}/g;
+const MOZ_PARAM_OFFICIAL       = /\{moz:official\}/g;
+
+// Custom search parameters
+#ifdef MOZ_OFFICIAL_BRANDING
+const MOZ_OFFICIAL = "official";
+#else
+const MOZ_OFFICIAL = "unofficial";
+#endif
+
+#if MOZ_UPDATE_CHANNEL == beta
+const GOOGLE_CLIENT = "firefox-beta";
+#elif MOZ_UPDATE_CHANNEL == aurora
+const GOOGLE_CLIENT = "firefox-aurora";
+#elif MOZ_UPDATE_CHANNEL == nightly
+const GOOGLE_CLIENT = "firefox-nightly";
+#else
+const GOOGLE_CLIENT = "firefox-a";
+#endif
+
+#expand const MOZ_DISTRIBUTION_ID = __MOZ_DISTRIBUTION_ID__;
+
+function getLocale() {
+  const localePref = "general.useragent.locale";
+  return getLocalizedPref(localePref, Services.prefs.getCharPref(localePref));
+}
+
+/**
+ * Wrapper for nsIPrefBranch::getComplexValue.
+ * @param aPrefName
+ *        The name of the pref to get.
+ * @returns aDefault if the requested pref doesn't exist.
+ */
+function getLocalizedPref(aPrefName, aDefault) {
+  try {
+    return Services.prefs.getComplexValue(aPrefName, Ci.nsIPrefLocalizedString).data;
+  } catch (ex) {
+    return aDefault;
+  }
+
+  return aDefault;
+}
+
+function test() {
+  let engine = Services.search.getEngineByName("Google");
+  ok(engine, "Google");
+
+  is(Services.search.originalDefaultEngine, engine, "Check that Google is the default search engine");
+
+  let distributionID;
+  try {
+    distributionID = Services.prefs.getCharPref(BROWSER_SEARCH_PREF + "distributionID");
+  } catch (ex) {
+    distributionID = MOZ_DISTRIBUTION_ID;
+  }
+
+  let base = "https://www.google.com/search?q=foo&ie=utf-8&oe=utf-8&aq=t&rls={moz:distributionID}:{moz:locale}:{moz:official}&client=" + GOOGLE_CLIENT;
+  base = base.replace(MOZ_PARAM_LOCALE, getLocale());
+  base = base.replace(MOZ_PARAM_DIST_ID, distributionID);
+  base = base.replace(MOZ_PARAM_OFFICIAL, MOZ_OFFICIAL);
+
+  let url;
+
+  // Test search URLs (including purposes).
+  url = engine.getSubmission("foo").uri.spec;
+  is(url, base, "Check search URL for 'foo'");
+  url = engine.getSubmission("foo", null, "contextmenu").uri.spec;
+  is(url, base + "&channel=rcs", "Check context menu search URL for 'foo'");
+  url = engine.getSubmission("foo", null, "keyword").uri.spec;
+  is(url, base + "&channel=fflb", "Check keyword search URL for 'foo'");
+
+  // Check search suggestion URL.
+  url = engine.getSubmission("foo", "application/x-suggestions+json").uri.spec;
+  is(url, "https://www.google.com/complete/search?client=firefox&q=foo", "Check search suggestion URL for 'foo'");
+
+  // Check all other engine properties.
+  const EXPECTED_ENGINE = {
+    name: "Google",
+    alias: null,
+    description: "Google Search",
+    searchForm: "https://www.google.com/",
+    type: Ci.nsISearchEngine.TYPE_MOZSEARCH,
+    hidden: false,
+    wrappedJSObject: {
+      "_iconURL": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAABUUlEQVR42pWTzUsCYRCH9y9zu3SooCCkjhIRRLeIykXokiWCJ7PvDpZRlz6si1lIQZ3SQxQdOhREpgSm0JeQvfu0+i6I7LKLh4F5h5nnnRl+o6jTdHn8omAYbVqhXqvYFXcEBKFDwcoZZB8B4LkEB9cwGGmFKHb01A1EU9JXzfdvDYZi1lwLwBcVAIwsNWPesIwls7gDtB2Z7N9ujVe+IX2LO2AgItB1OL9vJqsmILDrOoK02IkBAdYy4FsQJC5h+VQCHQDWTqYSgo8fuHuRxS4Ae3stQ7UGE5ttAHqCUgfxC7m4ryrowOyeO6CxqHwZxtYFqtYc5+kNan/gDTsAeueEIRj7n/rmRQMwueUAGF0VAAT3rQBTC0Y3DoDOGbm00icML4oWHYSTgo0MFqjlmPpDgqMcFCuQf4erBzjOwXjcriu9qHg0uutO2+es6fl67T9ptebvFRjBVgAAAABJRU5ErkJggg==",
+      _urls : [
+        {
+          type: "application/x-suggestions+json",
+          method: "GET",
+          template: "https://www.google.com/complete/search?client=firefox&q={searchTerms}",
+          params: "",
+        },
+        {
+          type: "text/html",
+          method: "GET",
+          template: "https://www.google.com/search",
+          params: [
+            {
+              "name": "q",
+              "value": "{searchTerms}",
+              "purpose": undefined,
+            },
+            {
+              "name": "ie",
+              "value": "utf-8",
+              "purpose": undefined,
+            },
+            {
+              "name": "oe",
+              "value": "utf-8",
+              "purpose": undefined,
+            },
+            {
+              "name": "aq",
+              "value": "t",
+              "purpose": undefined,
+            },
+            {
+              "name": "rls",
+              "value": "{moz:distributionID}:{moz:locale}:{moz:official}",
+              "purpose": undefined,
+            },
+            {
+              "name": "client",
+              "value": GOOGLE_CLIENT,
+              "purpose": undefined,
+            },
+            {
+              "name": "channel",
+              "value": "rcs",
+              "purpose": "contextmenu",
+            },
+            {
+              "name": "channel",
+              "value": "fflb",
+              "purpose": "keyword",
+            },
+            {
+              "name": "channel",
+              "value": "np",
+              "purpose": "homepage",
+            },
+            {
+              "name": "source",
+              "value": "hp",
+              "purpose": "homepage",
+            },
+          ],
+          mozparams: {
+            "client": {
+              "name": "client",
+              "falseValue": "firefox",
+              "trueValue": GOOGLE_CLIENT,
+              "condition": "defaultEngine",
+              "mozparam": true,
+            },
+          },
+        },
+      ],
+    },
+  };
+
+  isSubObjectOf(EXPECTED_ENGINE, engine, "Google");
+}

browser/components/search/test/head.js

@@ -0,0 +1,19 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Recursively compare two objects and check that every property of expectedObj has the same value
+ * on actualObj.
+ */
+function isSubObjectOf(expectedObj, actualObj, name) {
+  for (let prop in expectedObj) {
+    if (typeof expectedObj[prop] == 'function')
+      continue;
+    if (expectedObj[prop] instanceof Object) {
+      is(actualObj[prop].length, expectedObj[prop].length, name + "[" + prop + "]");
+      isSubObjectOf(expectedObj[prop], actualObj[prop], name + "[" + prop + "]");
+    } else {
+      is(actualObj[prop], expectedObj[prop], name + "[" + prop + "]");
+    }
+  }
+}

browser/components/search/test/testEngine_mozsearch.xml

@@ -8,18 +8,8 @@
     <Param name="test" value="{searchTerms}"/>
     <Param name="ie" value="utf-8"/>
     <MozParam name="client" condition="defaultEngine" trueValue="app-default" falseValue="app"/>
-  </Url>
-  <Url type="application/x-moz-keywordsearch" method="GET" template="http://mochi.test:8888/browser/browser/components/search/test/">
-    <Param name="test" value="{searchTerms}"/>
-    <Param name="ie" value="utf-8"/>
-    <MozParam name="client" condition="defaultEngine" trueValue="app-default" falseValue="app"/>
-    <Param name="channel" value="keywordsearch"/>
-  </Url>
-  <Url type="application/x-moz-contextsearch" method="GET" template="http://mochi.test:8888/browser/browser/components/search/test/">
-    <Param name="test" value="{searchTerms}"/>
-    <Param name="ie" value="utf-8"/>
-    <MozParam name="client" condition="defaultEngine" trueValue="app-default" falseValue="app"/>
-    <Param name="channel" value="contextsearch"/>
+    <MozParam name="channel" condition="purpose" purpose="keyword" value="keywordsearch"/>
+    <MozParam name="channel" condition="purpose" purpose="contextmenu" value="contextsearch"/>
   </Url>
   <SearchForm>http://mochi.test:8888/browser/browser/components/search/test/</SearchForm>
 </SearchPlugin>

browser/locales/en-US/searchplugins/bing.xml

@@ -13,13 +13,9 @@
     </Url>
     <Url type="text/html" method="GET" template="http://www.bing.com/search">
         <Param name="q" value="{searchTerms}"/>
-        <Param name="form" value="MOZSBR"/>
-        <MozParam name="pc" condition="pref" pref="ms-pc"/>
-    </Url>
-    <Url type="application/x-moz-keywordsearch" method="GET" template="http://www.bing.com/search">
-        <Param name="q" value="{searchTerms}"/>
-        <Param name="form" value="MOZLBR"/>
         <MozParam name="pc" condition="pref" pref="ms-pc"/>
+        <MozParam name="form" condition="purpose" purpose="" value="MOZSBR"/>
+        <MozParam name="form" condition="purpose" purpose="keyword" value="MOZLBR"/>
     </Url>
     <SearchForm>http://www.bing.com/search</SearchForm>
 </SearchPlugin>

browser/locales/en-US/searchplugins/google.xml

@@ -2,16 +2,6 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-#define GOOGLE_PARAMS <Param name="q" value="{searchTerms}"/><Param name="ie" value="utf-8"/><Param name="oe" value="utf-8"/><Param name="aq" value="t"/><Param name="rls" value="{moz:distributionID}:{moz:locale}:{moz:official}"/>
-#if MOZ_UPDATE_CHANNEL == beta
-#define GOOGLE_CLIENT_PARAM <MozParam name="client" condition="defaultEngine" trueValue="firefox-beta" falseValue="firefox"/>
-#elif MOZ_UPDATE_CHANNEL == aurora
-#define GOOGLE_CLIENT_PARAM <MozParam name="client" condition="defaultEngine" trueValue="firefox-aurora" falseValue="firefox"/>
-#elif MOZ_UPDATE_CHANNEL == nightly
-#define GOOGLE_CLIENT_PARAM <MozParam name="client" condition="defaultEngine" trueValue="firefox-nightly" falseValue="firefox"/>
-#else
-#define GOOGLE_CLIENT_PARAM <MozParam name="client" condition="defaultEngine" trueValue="firefox-a" falseValue="firefox"/>
-#endif
 <SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">
 <ShortName>Google</ShortName>
 <Description>Google Search</Description>
@@ -19,20 +9,24 @@
 <Image width="16" height="16">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAABUUlEQVR42pWTzUsCYRCH9y9zu3SooCCkjhIRRLeIykXokiWCJ7PvDpZRlz6si1lIQZ3SQxQdOhREpgSm0JeQvfu0+i6I7LKLh4F5h5nnnRl+o6jTdHn8omAYbVqhXqvYFXcEBKFDwcoZZB8B4LkEB9cwGGmFKHb01A1EU9JXzfdvDYZi1lwLwBcVAIwsNWPesIwls7gDtB2Z7N9ujVe+IX2LO2AgItB1OL9vJqsmILDrOoK02IkBAdYy4FsQJC5h+VQCHQDWTqYSgo8fuHuRxS4Ae3stQ7UGE5ttAHqCUgfxC7m4ryrowOyeO6CxqHwZxtYFqtYc5+kNan/gDTsAeueEIRj7n/rmRQMwueUAGF0VAAT3rQBTC0Y3DoDOGbm00icML4oWHYSTgo0MFqjlmPpDgqMcFCuQf4erBzjOwXjcriu9qHg0uutO2+es6fl67T9ptebvFRjBVgAAAABJRU5ErkJggg==</Image>
 <Url type="application/x-suggestions+json" method="GET" template="https://www.google.com/complete/search?client=firefox&amp;q={searchTerms}"/>
 <Url type="text/html" method="GET" template="https://www.google.com/search">
-#expand   __GOOGLE_PARAMS__
-#expand   __GOOGLE_CLIENT_PARAM__
-</Url>
-<!-- Keyword search URL is the same as the default, but with an additional parameter -->
-<Url type="application/x-moz-keywordsearch" method="GET" template="https://www.google.com/search">
-#expand   __GOOGLE_PARAMS__
-#expand   __GOOGLE_CLIENT_PARAM__
-  <Param name="channel" value="fflb"/>
-</Url>
-<!-- Context/Right-click search URL is the same as the default, but with an additional parameter -->
-<Url type="application/x-moz-contextsearch" method="GET" template="https://www.google.com/search">
-#expand   __GOOGLE_PARAMS__
-#expand   __GOOGLE_CLIENT_PARAM__
-  <Param name="channel" value="rcs"/>
+  <Param name="q" value="{searchTerms}"/>
+  <Param name="ie" value="utf-8"/>
+  <Param name="oe" value="utf-8"/>
+  <Param name="aq" value="t"/>
+  <Param name="rls" value="{moz:distributionID}:{moz:locale}:{moz:official}"/>
+#if MOZ_UPDATE_CHANNEL == beta
+  <MozParam name="client" condition="defaultEngine" trueValue="firefox-beta" falseValue="firefox"/>
+#elif MOZ_UPDATE_CHANNEL == aurora
+  <MozParam name="client" condition="defaultEngine" trueValue="firefox-aurora" falseValue="firefox"/>
+#elif MOZ_UPDATE_CHANNEL == nightly
+  <MozParam name="client" condition="defaultEngine" trueValue="firefox-nightly" falseValue="firefox"/>
+#else
+  <MozParam name="client" condition="defaultEngine" trueValue="firefox-a" falseValue="firefox"/>
+#endif
+  <MozParam name="channel" condition="purpose" purpose="contextmenu" value="rcs"/>
+  <MozParam name="channel" condition="purpose" purpose="keyword" value="fflb"/>
+  <MozParam name="channel" condition="purpose" purpose="homepage" value="np"/>
+  <MozParam name="source" condition="purpose" purpose="homepage" value="hp"/>
 </Url>
 <SearchForm>https://www.google.com/</SearchForm>
 </SearchPlugin>

browser/modules/AboutHomeUtils.jsm

@@ -23,7 +23,7 @@ this.AboutHomeUtils = new Object();
  */
 XPCOMUtils.defineLazyGetter(AboutHomeUtils, "defaultSearchEngine", function() {
   let defaultEngine = Services.search.originalDefaultEngine;
-  let submission = defaultEngine.getSubmission("_searchTerms_");
+  let submission = defaultEngine.getSubmission("_searchTerms_", null, "homepage");
   if (submission.postData) {
     throw new Error("Home page does not support POST search engines.");
   }

build/automation.py.in

@@ -521,6 +521,9 @@ user_pref("extensions.getAddons.search.url", "http://%(server)s/extensions-dummy
 // Make sure that opening the plugins check page won't hit the network
 user_pref("plugins.update.url", "http://%(server)s/plugins-dummy/updateCheckURL");
 
+// Existing tests don't wait for the notification button security delay
+user_pref("security.notification_enable_delay", 0);
+
 // Make enablePrivilege continue to work for test code. :-(
 user_pref("security.turn_off_all_security_so_that_viruses_can_take_over_this_computer", true);
 

content/base/src/nsDOMDataChannel.cpp

@@ -54,6 +54,14 @@ public:
     , mBinaryType(DC_BINARY_TYPE_BLOB)
   {}
 
+  ~nsDOMDataChannel()
+  {
+    // Don't call us anymore!  Likely isn't an issue (or maybe just less of
+    // one) once we block GC until all the (appropriate) onXxxx handlers
+    // are dropped. (See WebRTC spec)
+    mDataChannel->SetListener(nullptr, nullptr);
+  }
+
   nsresult Init(nsPIDOMWindow* aDOMWindow);
 
   NS_DECL_ISUPPORTS_INHERITED

content/events/public/nsVKList.h

@@ -155,6 +155,12 @@ DEFINE_VK_INTERNAL(_F24),
 DEFINE_VK_INTERNAL(_NUM_LOCK),
 DEFINE_VK_INTERNAL(_SCROLL_LOCK),
 
+DEFINE_VK_INTERNAL(_WIN_OEM_FJ_JISHO),
+DEFINE_VK_INTERNAL(_WIN_OEM_FJ_MASSHOU),
+DEFINE_VK_INTERNAL(_WIN_OEM_FJ_TOUROKU),
+DEFINE_VK_INTERNAL(_WIN_OEM_FJ_LOYA),
+DEFINE_VK_INTERNAL(_WIN_OEM_FJ_ROYA),
+
 DEFINE_VK_INTERNAL(_CIRCUMFLEX),
 DEFINE_VK_INTERNAL(_EXCLAMATION),
 DEFINE_VK_INTERNAL(_DOUBLE_QUOTE),
@@ -189,7 +195,33 @@ DEFINE_VK_INTERNAL(_CLOSE_BRACKET),
 DEFINE_VK_INTERNAL(_QUOTE),
 
 DEFINE_VK_INTERNAL(_META),
-DEFINE_VK_INTERNAL(_ALTGR)
+DEFINE_VK_INTERNAL(_ALTGR),
+
+DEFINE_VK_INTERNAL(_WIN_ICO_HELP),
+DEFINE_VK_INTERNAL(_WIN_ICO_00),
+DEFINE_VK_INTERNAL(_WIN_ICO_CLEAR),
+DEFINE_VK_INTERNAL(_WIN_OEM_RESET),
+DEFINE_VK_INTERNAL(_WIN_OEM_JUMP),
+DEFINE_VK_INTERNAL(_WIN_OEM_PA1),
+DEFINE_VK_INTERNAL(_WIN_OEM_PA2),
+DEFINE_VK_INTERNAL(_WIN_OEM_PA3),
+DEFINE_VK_INTERNAL(_WIN_OEM_WSCTRL),
+DEFINE_VK_INTERNAL(_WIN_OEM_CUSEL),
+DEFINE_VK_INTERNAL(_WIN_OEM_ATTN),
+DEFINE_VK_INTERNAL(_WIN_OEM_FINISH),
+DEFINE_VK_INTERNAL(_WIN_OEM_COPY),
+DEFINE_VK_INTERNAL(_WIN_OEM_AUTO),
+DEFINE_VK_INTERNAL(_WIN_OEM_ENLW),
+DEFINE_VK_INTERNAL(_WIN_OEM_BACKTAB),
+
+DEFINE_VK_INTERNAL(_ATTN),
+DEFINE_VK_INTERNAL(_CRSEL),
+DEFINE_VK_INTERNAL(_EXSEL),
+DEFINE_VK_INTERNAL(_EREOF),
+DEFINE_VK_INTERNAL(_PLAY),
+DEFINE_VK_INTERNAL(_ZOOM),
+DEFINE_VK_INTERNAL(_PA1),
+DEFINE_VK_INTERNAL(_WIN_OEM_CLEAR)
 
 #undef DEFINE_VK_INTERNAL
 #undef DEFINE_VK_INTERNAL2

content/html/content/src/nsHTMLInputElement.cpp

@@ -583,6 +583,7 @@ nsHTMLInputElement::nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
   , mCanShowInvalidUI(true)
   , mHasRange(false)
 {
+  // We are in a type=text so we now we currenty need a nsTextEditorState.
   mInputData.mState = new nsTextEditorState(this);
 
   if (!gUploadLastDir)
@@ -627,8 +628,8 @@ nsHTMLInputElement::GetEditorState() const
     return nullptr;
   }
 
-  NS_ASSERTION(mInputData.mState,
-    "Single line text controls need to have a state associated with them");
+  MOZ_ASSERT(mInputData.mState, "Single line text controls need to have a state"
+                                " associated with them");
 
   return mInputData.mState;
 }
@@ -1023,7 +1024,11 @@ nsHTMLInputElement::GetValueInternal(nsAString& aValue) const
 {
   switch (GetValueMode()) {
     case VALUE_MODE_VALUE:
-      mInputData.mState->GetValue(aValue, true);
+      if (IsSingleLineTextControl(false)) {
+        mInputData.mState->GetValue(aValue, true);
+      } else {
+        aValue.Assign(mInputData.mValue);
+      }
       return NS_OK;
 
     case VALUE_MODE_FILENAME:
@@ -1959,7 +1964,15 @@ nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
         SetValueChanged(true);
       }
 
-      mInputData.mState->SetValue(value, aUserInput, aSetValueChanged);
+      if (IsSingleLineTextControl(false)) {
+        mInputData.mState->SetValue(value, aUserInput, aSetValueChanged);
+      } else {
+        mInputData.mValue = ToNewUnicode(value);
+        if (aSetValueChanged) {
+          SetValueChanged(true);
+        }
+        OnValueChanged(!mParserCreating);
+      }
 
       return NS_OK;
     }
@@ -2965,69 +2978,67 @@ void
 nsHTMLInputElement::HandleTypeChange(uint8_t aNewType)
 {
   ValueModeType aOldValueMode = GetValueMode();
+  uint8_t oldType = mType;
   nsAutoString aOldValue;
 
-  if (aOldValueMode == VALUE_MODE_VALUE && !mParserCreating) {
+  if (aOldValueMode == VALUE_MODE_VALUE) {
     GetValue(aOldValue);
   }
 
-  // Only single line text inputs have a text editor state.
-  bool isNewTypeSingleLine = IsSingleLineTextControl(false, aNewType);
-  bool isCurrentTypeSingleLine = IsSingleLineTextControl(false, mType);
-
-  if (isNewTypeSingleLine && !isCurrentTypeSingleLine) {
-    FreeData();
-    mInputData.mState = new nsTextEditorState(this);
-  } else if (isCurrentTypeSingleLine && !isNewTypeSingleLine) {
-    FreeData();
-  }
-
+  // We already have a copy of the value, lets free it and changes the type.
+  FreeData();
   mType = aNewType;
 
-  if (!mParserCreating) {
-    /**
-     * The following code is trying to reproduce the algorithm described here:
-     * http://www.whatwg.org/specs/web-apps/current-work/complete.html#input-type-change
-     */
-    switch (GetValueMode()) {
-      case VALUE_MODE_DEFAULT:
-      case VALUE_MODE_DEFAULT_ON:
-        // If the previous value mode was value, we need to set the value content
-        // attribute to the previous value.
-        // There is no value sanitizing algorithm for elements in this mode.
-        if (aOldValueMode == VALUE_MODE_VALUE && !aOldValue.IsEmpty()) {
-          SetAttr(kNameSpaceID_None, nsGkAtoms::value, aOldValue, true);
+  if (IsSingleLineTextControl()) {
+    mInputData.mState = new nsTextEditorState(this);
+  }
+
+  /**
+   * The following code is trying to reproduce the algorithm described here:
+   * http://www.whatwg.org/specs/web-apps/current-work/complete.html#input-type-change
+   */
+  switch (GetValueMode()) {
+    case VALUE_MODE_DEFAULT:
+    case VALUE_MODE_DEFAULT_ON:
+      // If the previous value mode was value, we need to set the value content
+      // attribute to the previous value.
+      // There is no value sanitizing algorithm for elements in this mode.
+      if (aOldValueMode == VALUE_MODE_VALUE && !aOldValue.IsEmpty()) {
+        SetAttr(kNameSpaceID_None, nsGkAtoms::value, aOldValue, true);
+      }
+      break;
+    case VALUE_MODE_VALUE:
+      // If the previous value mode wasn't value, we have to set the value to
+      // the value content attribute.
+      // SetValueInternal is going to sanitize the value.
+      {
+        nsAutoString value;
+        if (aOldValueMode != VALUE_MODE_VALUE) {
+          GetAttr(kNameSpaceID_None, nsGkAtoms::value, value);
+        } else {
+          value = aOldValue;
         }
-        break;
-      case VALUE_MODE_VALUE:
-        // If the previous value mode wasn't value, we have to set the value to
-        // the value content attribute.
-        // SetValueInternal is going to sanitize the value.
-        {
-          nsAutoString value;
-          if (aOldValueMode != VALUE_MODE_VALUE) {
-            GetAttr(kNameSpaceID_None, nsGkAtoms::value, value);
-          } else {
-            // We get the current value so we can sanitize it.
-            GetValue(value);
-          }
-          SetValueInternal(value, false, false);
-        }
-        break;
-      case VALUE_MODE_FILENAME:
-      default:
-        // We don't care about the value.
-        // There is no value sanitizing algorithm for elements in this mode.
-        break;
-    }
-    
-    //Updating mFocusedValue in consequence.
-    if (isNewTypeSingleLine && !isCurrentTypeSingleLine) {
-      GetValueInternal(mFocusedValue);
-    }
-    else if (!isNewTypeSingleLine && isCurrentTypeSingleLine) {
-      mFocusedValue.Truncate();
-    } 
+        SetValueInternal(value, false, false);
+      }
+      break;
+    case VALUE_MODE_FILENAME:
+    default:
+      // We don't care about the value.
+      // There is no value sanitizing algorithm for elements in this mode.
+      break;
+  }
+
+  // Updating mFocusedValue in consequence:
+  // If the new type is a single line text control but the previous wasn't, we
+  // should set mFocusedValue to the current value.
+  // Otherwise, if the new type isn't a text control but the previous was, we
+  // should clear out mFocusedValue.
+  if (IsSingleLineTextControl(mType, false) &&
+      !IsSingleLineTextControl(oldType, false)) {
+    GetValueInternal(mFocusedValue);
+  } else if (!IsSingleLineTextControl(mType, false) &&
+             IsSingleLineTextControl(oldType, false)) {
+    mFocusedValue.Truncate();
   }
 
   UpdateHasRange();

content/html/content/src/nsHTMLInputElement.h

@@ -740,7 +740,7 @@ protected:
     /**
      * The current value of the input if it has been changed from the default
      */
-    char*                    mValue;
+    PRUnichar*               mValue;
     /**
      * The state of the text editor associated with the text/password input
      */

docshell/base/nsDefaultURIFixup.cpp

@@ -367,22 +367,12 @@ NS_IMETHODIMP nsDefaultURIFixup::KeywordToURI(const nsACString& aKeyword,
         searchSvc->GetOriginalDefaultEngine(getter_AddRefs(defaultEngine));
         if (defaultEngine) {
             nsCOMPtr<nsISearchSubmission> submission;
-            // We want to allow default search plugins to specify alternate
-            // parameters that are specific to keyword searches. For the moment,
-            // do this by first looking for a magic
-            // "application/x-moz-keywordsearch" submission type. In the future,
-            // we should instead use a solution that relies on bug 587780.
+            // We allow default search plugins to specify alternate
+            // parameters that are specific to keyword searches.
             defaultEngine->GetSubmission(NS_ConvertUTF8toUTF16(keyword),
-                                         NS_LITERAL_STRING("application/x-moz-keywordsearch"),
+                                         EmptyString(),
+                                         NS_LITERAL_STRING("keyword"),
                                          getter_AddRefs(submission));
-            // If getting the special x-moz-keywordsearch submission type failed,
-            // fall back to the default response type.
-            if (!submission) {
-                defaultEngine->GetSubmission(NS_ConvertUTF8toUTF16(keyword),
-                                             EmptyString(),
-                                             getter_AddRefs(submission));
-            }
-
             if (submission) {
                 // The submission depends on POST data (i.e. the search engine's
                 // "method" is POST), we can't use this engine for keyword

dom/apps/src/Webapps.jsm

@@ -524,14 +524,22 @@ this.DOMApplicationRegistry = {
         continue;
       }
 
+      // Make a copy of the description object since we don't want to modify
+      // the manifest itself, but need to register with a resolved URI.
+      let newDesc = {};
+      for (let prop in description) {
+        newDesc[prop] = description[prop];
+      }
+      newDesc.href = href;
+
       debug('_createActivitiesToRegister: ' + aApp.manifestURL + ', activity ' +
-          activity + ', description.href is ' + href);
+          activity + ', description.href is ' + newDesc.href);
 
       if (aRunUpdate) {
         activitiesToRegister.push({ "manifest": aApp.manifestURL,
                                     "name": activity,
                                     "icon": manifest.iconURLForSize(128),
-                                    "description": description });
+                                    "description": newDesc });
       }
 
       let launchPath = Services.io.newURI(href, null, null);

dom/interfaces/events/nsIDOMKeyEvent.idl

@@ -146,6 +146,14 @@ interface nsIDOMKeyEvent : nsIDOMUIEvent
   const unsigned long DOM_VK_NUM_LOCK       = 0x90;
   const unsigned long DOM_VK_SCROLL_LOCK    = 0x91;
 
+  // OEM specific virtual keyCode of Windows should pass through DOM keyCode
+  // for compatibility with the other web browsers on Windows.
+  const unsigned long DOM_VK_WIN_OEM_FJ_JISHO   = 0x92;
+  const unsigned long DOM_VK_WIN_OEM_FJ_MASSHOU = 0x93;
+  const unsigned long DOM_VK_WIN_OEM_FJ_TOUROKU = 0x94;
+  const unsigned long DOM_VK_WIN_OEM_FJ_LOYA    = 0x95;
+  const unsigned long DOM_VK_WIN_OEM_FJ_ROYA    = 0x96;
+
   const unsigned long DOM_VK_CIRCUMFLEX     = 0xA0;
   const unsigned long DOM_VK_EXCLAMATION    = 0xA1;
   const unsigned long DOM_VK_DOUBLE_QUOTE   = 0xA2;
@@ -182,6 +190,39 @@ interface nsIDOMKeyEvent : nsIDOMUIEvent
   const unsigned long DOM_VK_META           = 0xE0;
   const unsigned long DOM_VK_ALTGR          = 0xE1;
 
+  // OEM specific virtual keyCode of Windows should pass through DOM keyCode
+  // for compatibility with the other web browsers on Windows.
+  const unsigned long DOM_VK_WIN_ICO_HELP    = 0xE3;
+  const unsigned long DOM_VK_WIN_ICO_00      = 0xE4;
+  const unsigned long DOM_VK_WIN_ICO_CLEAR   = 0xE6;
+  const unsigned long DOM_VK_WIN_OEM_RESET   = 0xE9;
+  const unsigned long DOM_VK_WIN_OEM_JUMP    = 0xEA;
+  const unsigned long DOM_VK_WIN_OEM_PA1     = 0xEB;
+  const unsigned long DOM_VK_WIN_OEM_PA2     = 0xEC;
+  const unsigned long DOM_VK_WIN_OEM_PA3     = 0xED;
+  const unsigned long DOM_VK_WIN_OEM_WSCTRL  = 0xEE;
+  const unsigned long DOM_VK_WIN_OEM_CUSEL   = 0xEF;
+  const unsigned long DOM_VK_WIN_OEM_ATTN    = 0xF0;
+  const unsigned long DOM_VK_WIN_OEM_FINISH  = 0xF1;
+  const unsigned long DOM_VK_WIN_OEM_COPY    = 0xF2;
+  const unsigned long DOM_VK_WIN_OEM_AUTO    = 0xF3;
+  const unsigned long DOM_VK_WIN_OEM_ENLW    = 0xF4;
+  const unsigned long DOM_VK_WIN_OEM_BACKTAB = 0xF5;
+
+  // Following keys are not used on most keyboards.  However, for compatibility
+  // with other browsers on Windows, we should define them.
+  const unsigned long DOM_VK_ATTN           = 0xF6;
+  const unsigned long DOM_VK_CRSEL          = 0xF7;
+  const unsigned long DOM_VK_EXSEL          = 0xF8;
+  const unsigned long DOM_VK_EREOF          = 0xF9;
+  const unsigned long DOM_VK_PLAY           = 0xFA;
+  const unsigned long DOM_VK_ZOOM           = 0xFB;
+  const unsigned long DOM_VK_PA1            = 0xFD;
+
+  // OEM specific virtual keyCode of Windows should pass through DOM keyCode
+  // for compatibility with the other web browsers on Windows.
+  const unsigned long DOM_VK_WIN_OEM_CLEAR  = 0xFE;
+
   readonly attribute unsigned long    charCode;
   readonly attribute unsigned long    keyCode;
 

dom/media/tests/crashtests/837324.html

@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=837324
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Bug 837324</title>
+  <script type="application/javascript">
+    function start() {
+      var o0 = mozRTCPeerConnection();
+      var o1 = new mozRTCIceCandidate({"candidate":"0 -65535 IP 0 stun.sipgate.net 3227326073 type ::ffff:192.0.2.128 host 2302600701","sdpMid":"video 3907077665 RTP/SAVPF 5000","sdpMLineIndex":7});
+      o0.addIceCandidate(o1);
+    }
+  </script>
+</head>
+
+<body onload="start();"></body>
+</html>

dom/media/tests/crashtests/crashtests.list

@@ -10,4 +10,5 @@ load 802982.html
 load 812785.html
 load 822197.html
 load 834100.html
+load 837324.html
 load 837421.html

dom/plugins/base/nsPluginHost.cpp

@@ -132,6 +132,10 @@
 #define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
 #endif
 
+#if MOZ_CRASHREPORTER
+#include "nsExceptionHandler.h"
+#endif
+
 using namespace mozilla;
 using mozilla::TimeStamp;
 
@@ -1049,6 +1053,12 @@ nsPluginHost::TrySetUpPluginInstance(const char *aMimeType,
   nsPluginTag* pluginTag = FindPluginForType(aMimeType, true);
   NS_ASSERTION(pluginTag, "Must have plugin tag here!");
 
+#if defined(MOZ_WIDGET_ANDROID) && defined(MOZ_CRASHREPORTER)
+  if (pluginTag->mIsFlashPlugin) {
+    CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("FlashVersion"), pluginTag->mVersion);
+  }
+#endif
+
   nsRefPtr<nsNPAPIPlugin> plugin;
   GetPlugin(aMimeType, getter_AddRefs(plugin));
   if (!plugin) {

gfx/2d/DrawTargetCG.cpp

@@ -122,7 +122,7 @@ CGBlendMode ToBlendMode(CompositionOp op)
 
 
 
-DrawTargetCG::DrawTargetCG() : mSnapshot(nullptr), mCg(nullptr)
+DrawTargetCG::DrawTargetCG() : mCg(nullptr), mSnapshot(nullptr)
 {
 }
 
@@ -1029,8 +1029,8 @@ DrawTargetCG::CreatePathBuilder(FillRule aFillRule) const
 void*
 DrawTargetCG::GetNativeSurface(NativeSurfaceType aType)
 {
-  if (aType == NATIVE_SURFACE_CGCONTEXT && GetContextType(mCg) == CG_CONTEXT_TYPE_BITMAP ||
-      aType == NATIVE_SURFACE_CGCONTEXT_ACCELERATED && GetContextType(mCg) == CG_CONTEXT_TYPE_IOSURFACE) {
+  if ((aType == NATIVE_SURFACE_CGCONTEXT && GetContextType(mCg) == CG_CONTEXT_TYPE_BITMAP) ||
+      (aType == NATIVE_SURFACE_CGCONTEXT_ACCELERATED && GetContextType(mCg) == CG_CONTEXT_TYPE_IOSURFACE)) {
     return mCg;
   } else {
     return nullptr;

gfx/2d/DrawTargetCG.h

@@ -151,8 +151,6 @@ private:
   CGColorSpaceRef mColorSpace;
   CGContextRef mCg;
 
-  GLuint mIOSurfaceTexture;
-
   /**
    * A pointer to the image buffer if the buffer is owned by this class (set to
    * nullptr otherwise).

gfx/layers/Layers.h

@@ -861,6 +861,8 @@ public:
   gfxPoint GetFixedPositionAnchor() { return mAnchor; }
   Layer* GetMaskLayer() { return mMaskLayer; }
 
+  // Note that all lengths in animation data are either in CSS pixels or app
+  // units and must be converted to device pixels by the compositor.
   AnimationArray& GetAnimations() { return mAnimations; }
   InfallibleTArray<AnimData>& GetAnimationData() { return mAnimationData; }
 

gfx/layers/basic/BasicThebesLayer.cpp

@@ -397,6 +397,10 @@ BasicShadowableThebesLayer::PaintBuffer(gfxContext* aContext,
                                         LayerManager::DrawThebesLayerCallback aCallback,
                                         void* aCallbackData)
 {
+  // NB: this just throws away the entire valid region if there are
+  // too many rects.
+  mValidRegion.SimplifyInward(8);
+
   Base::PaintBuffer(aContext,
                     aRegionToDraw, aExtendedRegionToDraw, aRegionToInvalidate,
                     aDidSelfCopy,

gfx/layers/ipc/CompositorParent.cpp

@@ -718,21 +718,30 @@ SampleValue(float aPortion, Animation& aAnimation, nsStyleAnimation::Value& aSta
 
   TransformData& data = aAnimation.data().get_TransformData();
   nsPoint origin = data.origin();
-  int32_t auPerCSSPixel = nsDeviceContext::AppUnitsPerCSSPixel();
+  // we expect all our transform data to arrive in css pixels, so here we must
+  // adjust to dev pixels.
+  double cssPerDev = double(nsDeviceContext::AppUnitsPerCSSPixel())
+                     / double(data.appUnitsPerDevPixel());
+  gfxPoint3D mozOrigin = data.mozOrigin();
+  mozOrigin.x = mozOrigin.x * cssPerDev;
+  mozOrigin.y = mozOrigin.y * cssPerDev;
+  gfxPoint3D perspectiveOrigin = data.perspectiveOrigin();
+  perspectiveOrigin.x = perspectiveOrigin.x * cssPerDev;
+  perspectiveOrigin.y = perspectiveOrigin.y * cssPerDev;
   nsDisplayTransform::FrameTransformProperties props(interpolatedList,
-                                                     data.mozOrigin(),
-                                                     data.perspectiveOrigin(),
+                                                     mozOrigin,
+                                                     perspectiveOrigin,
                                                      data.perspective());
   gfx3DMatrix transform =
-    nsDisplayTransform::GetResultingTransformMatrix(props, data.origin(),
-                                                    nsDeviceContext::AppUnitsPerCSSPixel(),
+    nsDisplayTransform::GetResultingTransformMatrix(props, origin,
+                                                    data.appUnitsPerDevPixel(),
                                                     &data.bounds());
-  // NB: See nsDisplayTransform::GetTransform().
-  gfxPoint3D newOrigin =
-    gfxPoint3D(NS_round(NSAppUnitsToFloatPixels(origin.x, auPerCSSPixel)),
-               NS_round(NSAppUnitsToFloatPixels(origin.y, auPerCSSPixel)),
+  gfxPoint3D scaledOrigin =
+    gfxPoint3D(NS_round(NSAppUnitsToFloatPixels(origin.x, data.appUnitsPerDevPixel())),
+               NS_round(NSAppUnitsToFloatPixels(origin.y, data.appUnitsPerDevPixel())),
                0.0f);
-  transform.Translate(newOrigin);
+
+  transform.Translate(scaledOrigin);
 
   InfallibleTArray<TransformFunction> functions;
   functions.AppendElement(TransformMatrix(transform));

gfx/layers/ipc/PLayers.ipdl

@@ -139,11 +139,15 @@ struct AnimationSegment {
 // Transforms need extra information to correctly convert the list of transform
 // functions to a gfx3DMatrix that can be applied directly to the layer.
 struct TransformData {
+  // the origin of the frame being transformed in app units
   nsPoint origin;
+  // the -moz-transform-origin property for the transform in css pixels
   gfxPoint3D mozOrigin;
+  // the -moz-perspective-origin property for the transform in css pixels
   gfxPoint3D perspectiveOrigin;
   nsRect bounds;
   nscoord perspective;
+  int32_t appUnitsPerDevPixel;
 };
 
 union AnimationData {

gfx/layers/opengl/ThebesLayerOGL.cpp

@@ -733,25 +733,29 @@ BasicBufferOGL::BeginPaint(ContentType aContentType,
     nsIntRegion drawRegionCopy = result.mRegionToDraw;
     gfxASurface *onBlack = mTexImage->BeginUpdate(drawRegionCopy);
     gfxASurface *onWhite = mTexImageOnWhite->BeginUpdate(result.mRegionToDraw);
-    NS_ASSERTION(result.mRegionToDraw == drawRegionCopy,
-                 "BeginUpdate should always modify the draw region in the same way!");
-    FillSurface(onBlack, result.mRegionToDraw, nsIntPoint(0,0), gfxRGBA(0.0, 0.0, 0.0, 1.0));
-    FillSurface(onWhite, result.mRegionToDraw, nsIntPoint(0,0), gfxRGBA(1.0, 1.0, 1.0, 1.0));
-    gfxASurface* surfaces[2] = { onBlack, onWhite };
-    nsRefPtr<gfxTeeSurface> surf = new gfxTeeSurface(surfaces, ArrayLength(surfaces));
+    if (onBlack && onWhite) {
+      NS_ASSERTION(result.mRegionToDraw == drawRegionCopy,
+          "BeginUpdate should always modify the draw region in the same way!");
+      FillSurface(onBlack, result.mRegionToDraw, nsIntPoint(0,0), gfxRGBA(0.0, 0.0, 0.0, 1.0));
+      FillSurface(onWhite, result.mRegionToDraw, nsIntPoint(0,0), gfxRGBA(1.0, 1.0, 1.0, 1.0));
+      gfxASurface* surfaces[2] = { onBlack, onWhite };
+      nsRefPtr<gfxTeeSurface> surf = new gfxTeeSurface(surfaces, ArrayLength(surfaces));
 
-    // XXX If the device offset is set on the individual surfaces instead of on
-    // the tee surface, we render in the wrong place. Why?
-    gfxPoint deviceOffset = onBlack->GetDeviceOffset();
-    onBlack->SetDeviceOffset(gfxPoint(0, 0));
-    onWhite->SetDeviceOffset(gfxPoint(0, 0));
-    surf->SetDeviceOffset(deviceOffset);
+      // XXX If the device offset is set on the individual surfaces instead of on
+      // the tee surface, we render in the wrong place. Why?
+      gfxPoint deviceOffset = onBlack->GetDeviceOffset();
+      onBlack->SetDeviceOffset(gfxPoint(0, 0));
+      onWhite->SetDeviceOffset(gfxPoint(0, 0));
+      surf->SetDeviceOffset(deviceOffset);
 
-    // Using this surface as a source will likely go horribly wrong, since
-    // only the onBlack surface will really be used, so alpha information will
-    // be incorrect.
-    surf->SetAllowUseAsSource(false);
-    result.mContext = new gfxContext(surf);
+      // Using this surface as a source will likely go horribly wrong, since
+      // only the onBlack surface will really be used, so alpha information will
+      // be incorrect.
+      surf->SetAllowUseAsSource(false);
+      result.mContext = new gfxContext(surf);
+    } else {
+      result.mContext = nullptr;
+    }
   } else {
     result.mContext = new gfxContext(mTexImage->BeginUpdate(result.mRegionToDraw));
     if (mTexImage->GetContentType() == gfxASurface::CONTENT_COLOR_ALPHA) {

js/public/Utility.h

@@ -60,6 +60,14 @@ using namespace JS;
 # define JS_THREADSAFE_ASSERT(expr) ((void) 0)
 #endif
 
+#if defined(DEBUG)
+# define JS_DIAGNOSTICS_ASSERT(expr) MOZ_ASSERT(expr)
+#elif defined(JS_CRASH_DIAGNOSTICS)
+# define JS_DIAGNOSTICS_ASSERT(expr) do { if (!(expr)) MOZ_CRASH(); } while(0)
+#else
+# define JS_DIAGNOSTICS_ASSERT(expr) ((void) 0)
+#endif
+
 #define JS_STATIC_ASSERT(cond)           MOZ_STATIC_ASSERT(cond, "JS_STATIC_ASSERT")
 #define JS_STATIC_ASSERT_IF(cond, expr)  MOZ_STATIC_ASSERT_IF(cond, expr, "JS_STATIC_ASSERT_IF")
 

js/src/builtin/Eval.cpp

@@ -25,10 +25,10 @@ static void
 AssertInnerizedScopeChain(JSContext *cx, JSObject &scopeobj)
 {
 #ifdef DEBUG
-    for (JSObject *o = &scopeobj; o; o = o->enclosingScope()) {
-        if (JSObjectOp op = o->getClass()->ext.innerObject) {
-            Rooted<JSObject*> obj(cx, o);
-            JS_ASSERT(op(cx, obj) == o);
+    RootedObject obj(cx);
+    for (obj = &scopeobj; obj; obj = obj->enclosingScope()) {
+        if (JSObjectOp op = obj->getClass()->ext.innerObject) {
+            JS_ASSERT(op(cx, obj) == obj);
         }
     }
 #endif

js/src/frontend/Parser.cpp

@@ -62,6 +62,11 @@ using namespace js;
 using namespace js::gc;
 using namespace js::frontend;
 
+typedef Rooted<StaticBlockObject*> RootedStaticBlockObject;
+typedef Handle<StaticBlockObject*> HandleStaticBlockObject;
+
+typedef MutableHandle<PropertyName*> MutableHandlePropertyName;
+
 /*
  * Insist that the next token be of type tt, or report errno and return null.
  * NB: this macro uses cx and ts from its lexical environment.
@@ -102,7 +107,7 @@ PushStatementPC(ParseContext *pc, StmtInfoPC *stmt, StmtType type)
 
 // See comment on member function declaration.
 bool
-ParseContext::define(JSContext *cx, PropertyName *name, ParseNode *pn, Definition::Kind kind)
+ParseContext::define(JSContext *cx, HandlePropertyName name, ParseNode *pn, Definition::Kind kind)
 {
     JS_ASSERT(!pn->isUsed());
     JS_ASSERT_IF(pn->isDefn(), pn->isPlaceholder());
@@ -784,7 +789,7 @@ Parser::functionBody(FunctionBodyType type)
     }
 
     /* Time to implement the odd semantics of 'arguments'. */
-    Handle<PropertyName*> arguments = context->names().arguments;
+    HandlePropertyName arguments = context->names().arguments;
 
     /*
      * Non-top-level functions use JSOP_DEFFUN which is a dynamic scope
@@ -1046,7 +1051,7 @@ struct frontend::BindData {
     struct LetData {
         LetData(JSContext *cx) : blockObj(cx) {}
         VarContext varContext;
-        Rooted<StaticBlockObject*> blockObj;
+        RootedStaticBlockObject blockObj;
         unsigned   overflow;
     } let;
 
@@ -1140,7 +1145,7 @@ DeoptimizeUsesWithin(Definition *dn, const TokenPos &pos)
  * parsing, use Parser::functionBody.
  */
 static bool
-LeaveFunction(ParseNode *fn, Parser *parser, PropertyName *funName = NULL,
+LeaveFunction(ParseNode *fn, Parser *parser, HandlePropertyName funName,
               FunctionSyntaxKind kind = Expression)
 {
     JSContext *cx = parser->context;
@@ -2003,16 +2008,16 @@ Parser::condition()
 }
 
 static bool
-MatchLabel(JSContext *cx, TokenStream *ts, PropertyName **label)
+MatchLabel(JSContext *cx, TokenStream *ts, MutableHandlePropertyName label)
 {
     TokenKind tt = ts->peekTokenSameLine(TSF_OPERAND);
     if (tt == TOK_ERROR)
         return false;
     if (tt == TOK_NAME) {
         (void) ts->getToken();
-        *label = ts->currentToken().name();
+        label.set(ts->currentToken().name());
     } else {
-        *label = NULL;
+        label.set(NULL);
     }
     return true;
 }
@@ -2093,9 +2098,10 @@ BindLet(JSContext *cx, BindData *data, HandlePropertyName name, Parser *parser)
 
 template <class Op>
 static inline bool
-ForEachLetDef(JSContext *cx, ParseContext *pc, StaticBlockObject &blockObj, Op op)
+ForEachLetDef(JSContext *cx, ParseContext *pc, HandleStaticBlockObject blockObj, Op op)
 {
-    for (Shape::Range r = blockObj.lastProperty()->all(); !r.empty(); r.popFront()) {
+    for (Shape::Range r = blockObj->lastProperty()->all(); !r.empty(); r.popFront()) {
+        Shape::Range::AutoRooter rooter(cx, &r);
         Shape &shape = r.front();
 
         /* Beware the destructuring dummy slots. */
@@ -2109,7 +2115,9 @@ ForEachLetDef(JSContext *cx, ParseContext *pc, StaticBlockObject &blockObj, Op o
 }
 
 struct PopLetDecl {
-    bool operator()(JSContext *, ParseContext *pc, StaticBlockObject &, const Shape &, JSAtom *atom) {
+    bool operator()(JSContext *, ParseContext *pc, HandleStaticBlockObject, const Shape &,
+                    JSAtom *atom)
+    {
         pc->popLetDecl(atom);
         return true;
     }
@@ -2118,14 +2126,14 @@ struct PopLetDecl {
 static void
 PopStatementPC(JSContext *cx, ParseContext *pc)
 {
-    StaticBlockObject *blockObj = pc->topStmt->blockObj;
+    RootedStaticBlockObject blockObj(cx, pc->topStmt->blockObj);
     JS_ASSERT(!!blockObj == (pc->topStmt->isBlockScope));
 
     FinishPopStatement(pc);
 
     if (blockObj) {
         JS_ASSERT(!blockObj->inDictionaryMode());
-        ForEachLetDef(cx, pc, *blockObj, PopLetDecl());
+        ForEachLetDef(cx, pc, blockObj, PopLetDecl());
         blockObj->resetPrevBlockChainFromParser();
     }
 }
@@ -2597,21 +2605,23 @@ Parser::returnOrYield(bool useAssignExpr)
 }
 
 static ParseNode *
-PushLexicalScope(JSContext *cx, Parser *parser, StaticBlockObject &blockObj, StmtInfoPC *stmt)
+PushLexicalScope(JSContext *cx, Parser *parser, HandleStaticBlockObject blockObj, StmtInfoPC *stmt)
 {
+    JS_ASSERT(blockObj);
+
     ParseNode *pn = LexicalScopeNode::create(PNK_LEXICALSCOPE, parser);
     if (!pn)
         return NULL;
 
-    ObjectBox *blockbox = parser->newObjectBox(&blockObj);
+    ObjectBox *blockbox = parser->newObjectBox(blockObj);
     if (!blockbox)
         return NULL;
 
     ParseContext *pc = parser->pc;
 
     PushStatementPC(pc, stmt, STMT_BLOCK);
-    blockObj.initPrevBlockChainFromParser(pc->blockChain);
-    FinishPushBlockScope(pc, stmt, blockObj);
+    blockObj->initPrevBlockChainFromParser(pc->blockChain);
+    FinishPushBlockScope(pc, stmt, *blockObj.get());
 
     pn->setOp(JSOP_LEAVEBLOCK);
     pn->pn_objbox = blockbox;
@@ -2626,11 +2636,11 @@ PushLexicalScope(JSContext *cx, Parser *parser, StaticBlockObject &blockObj, Stm
 static ParseNode *
 PushLexicalScope(JSContext *cx, Parser *parser, StmtInfoPC *stmt)
 {
-    StaticBlockObject *blockObj = StaticBlockObject::create(cx);
+    RootedStaticBlockObject blockObj(cx, StaticBlockObject::create(cx));
     if (!blockObj)
         return NULL;
 
-    return PushLexicalScope(cx, parser, *blockObj, stmt);
+    return PushLexicalScope(cx, parser, blockObj, stmt);
 }
 
 #if JS_HAS_BLOCK_SCOPE
@@ -2641,17 +2651,20 @@ struct AddLetDecl
 
     AddLetDecl(uint32_t blockid) : blockid(blockid) {}
 
-    bool operator()(JSContext *cx, ParseContext *pc, StaticBlockObject &blockObj, const Shape &shape, JSAtom *)
-    {
-        ParseNode *def = (ParseNode *) blockObj.getSlot(shape.slot()).toPrivate();
+    bool operator()(JSContext *cx, ParseContext *pc, HandleStaticBlockObject blockObj,
+                    const Shape &shape, JSAtom *)
+        {
+        ParseNode *def = (ParseNode *) blockObj->getSlot(shape.slot()).toPrivate();
         def->pn_blockid = blockid;
-        return pc->define(cx, def->name(), def, Definition::LET);
+        RootedPropertyName name(cx, def->name());
+        return pc->define(cx, name, def, Definition::LET);
     }
 };
 
 static ParseNode *
-PushLetScope(JSContext *cx, Parser *parser, StaticBlockObject &blockObj, StmtInfoPC *stmt)
+PushLetScope(JSContext *cx, Parser *parser, HandleStaticBlockObject blockObj, StmtInfoPC *stmt)
 {
+    JS_ASSERT(blockObj);
     ParseNode *pn = PushLexicalScope(cx, parser, blockObj, stmt);
     if (!pn)
         return NULL;
@@ -2680,7 +2693,7 @@ Parser::letBlock(LetContext letContext)
     if (!pnlet)
         return NULL;
 
-    Rooted<StaticBlockObject*> blockObj(context, StaticBlockObject::create(context));
+    RootedStaticBlockObject blockObj(context, StaticBlockObject::create(context));
     if (!blockObj)
         return NULL;
 
@@ -2693,7 +2706,7 @@ Parser::letBlock(LetContext letContext)
     MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_LET);
 
     StmtInfoPC stmtInfo(context);
-    ParseNode *block = PushLetScope(context, this, *blockObj, &stmtInfo);
+    ParseNode *block = PushLetScope(context, this, blockObj, &stmtInfo);
     if (!block)
         return NULL;
 
@@ -3003,7 +3016,7 @@ Parser::forStatement()
     bool forDecl = false;
 
     /* Non-null when forDecl is true for a 'for (let ...)' statement. */
-    Rooted<StaticBlockObject*> blockObj(context);
+    RootedStaticBlockObject blockObj(context);
 
     /* Set to 'x' in 'for (x ;... ;...)' or 'for (x in ...)'. */
     ParseNode *pn1;
@@ -3185,7 +3198,7 @@ Parser::forStatement()
              * created by PushLetScope around the for's initializer. This also
              * serves to indicate the let-decl to the emitter.
              */
-            ParseNode *block = PushLetScope(context, this, *blockObj, &letStmt);
+            ParseNode *block = PushLetScope(context, this, blockObj, &letStmt);
             if (!block)
                 return NULL;
             letStmt.isForLetBlock = true;
@@ -3241,7 +3254,7 @@ Parser::forStatement()
              * Desugar 'for (let A; B; C) D' into 'let (A) { for (; B; C) D }'
              * to induce the correct scoping for A.
              */
-            ParseNode *block = PushLetScope(context, this, *blockObj, &letStmt);
+            ParseNode *block = PushLetScope(context, this, blockObj, &letStmt);
             if (!block)
                 return NULL;
             letStmt.isForLetBlock = true;
@@ -3670,7 +3683,7 @@ Parser::expressionStatement()
             reportError(NULL, JSMSG_BAD_LABEL);
             return NULL;
         }
-        JSAtom *label = pn2->pn_atom;
+        RootedAtom label(context, pn2->pn_atom);
         for (StmtInfoPC *stmt = pc->topStmt; stmt; stmt = stmt->down) {
             if (stmt->type == STMT_LABEL && stmt->label == label) {
                 reportError(NULL, JSMSG_DUPLICATE_LABEL);
@@ -3854,11 +3867,11 @@ Parser::statement()
       case TOK_BREAK:
       {
         TokenPtr begin = tokenStream.currentToken().pos.begin;
-        PropertyName *label;
+        RootedPropertyName label(context);
         if (!MatchLabel(context, &tokenStream, &label))
             return NULL;
         TokenPtr end = tokenStream.currentToken().pos.end;
-        pn = new_<BreakStatement>(label, begin, end);
+        pn = new_<BreakStatement>(label.get(), begin, end);
         if (!pn)
             return NULL;
         StmtInfoPC *stmt = pc->topStmt;
@@ -3887,11 +3900,11 @@ Parser::statement()
       case TOK_CONTINUE:
       {
         TokenPtr begin = tokenStream.currentToken().pos.begin;
-        PropertyName *label;
+        RootedPropertyName label(context);
         if (!MatchLabel(context, &tokenStream, &label))
             return NULL;
         TokenPtr end = tokenStream.currentToken().pos.begin;
-        pn = new_<ContinueStatement>(label, begin, end);
+        pn = new_<ContinueStatement>(label.get(), begin, end);
         if (!pn)
             return NULL;
         StmtInfoPC *stmt = pc->topStmt;
@@ -5284,7 +5297,8 @@ Parser::generatorExpr(ParseNode *kid)
             return NULL;
         }
 
-        if (!LeaveFunction(genfn, this))
+        RootedPropertyName funName(context);
+        if (!LeaveFunction(genfn, this, funName))
             return NULL;
     }
 

js/src/frontend/Parser.h

@@ -116,7 +116,7 @@ struct ParseContext                 /* tree context for semantic checks */
      *    'pn' if they are in the scope of 'pn'.
      *  + Pre-existing placeholders in the scope of 'pn' have been removed.
      */
-    bool define(JSContext *cx, PropertyName *name, ParseNode *pn, Definition::Kind);
+    bool define(JSContext *cx, HandlePropertyName name, ParseNode *pn, Definition::Kind);
 
     /*
      * Let definitions may shadow same-named definitions in enclosing scopes.

js/src/gc/Marking.cpp

@@ -873,9 +873,10 @@ static void
 ScanRope(GCMarker *gcmarker, JSRope *rope)
 {
     ptrdiff_t savedPos = gcmarker->stack.position();
+    JS_DIAGNOSTICS_ASSERT(GetGCThingTraceKind(rope) == JSTRACE_STRING);
     for (;;) {
-        JS_ASSERT(GetGCThingTraceKind(rope) == JSTRACE_STRING);
-        JS_ASSERT(rope->JSString::isRope());
+        JS_DIAGNOSTICS_ASSERT(GetGCThingTraceKind(rope) == JSTRACE_STRING);
+        JS_DIAGNOSTICS_ASSERT(rope->JSString::isRope());
         JS_COMPARTMENT_ASSERT_STR(gcmarker->runtime, rope);
         JS_ASSERT(rope->isMarked());
         JSRope *next = NULL;

js/src/jsapi.cpp

@@ -4671,7 +4671,7 @@ JS_IsArrayObject(JSContext *cx, JSObject *objArg)
 {
     RootedObject obj(cx, objArg);
     assertSameCompartment(cx, obj);
-    return ObjectClassIs(*obj, ESClass_Array, cx);
+    return ObjectClassIs(obj, ESClass_Array, cx);
 }
 
 JS_PUBLIC_API(JSBool)

js/src/jsarray.cpp

@@ -2052,7 +2052,7 @@ js::array_concat(JSContext *cx, unsigned argc, Value *vp)
         HandleValue v = HandleValue::fromMarkedLocation(&p[i]);
         if (v.isObject()) {
             RootedObject obj(cx, &v.toObject());
-            if (ObjectClassIs(*obj, ESClass_Array, cx)) {
+            if (ObjectClassIs(obj, ESClass_Array, cx)) {
                 uint32_t alength;
                 if (!GetLengthProperty(cx, obj, &alength))
                     return false;

js/src/jsatom.cpp

@@ -513,7 +513,7 @@ js::XDRAtom(XDRState<mode> *xdr, MutableHandleAtom atomp)
     }
 
     JS_ALWAYS_TRUE(xdr->codeChars(chars, nchars));
-    atom = AtomizeChars(cx, chars, nchars);
+    atom = AtomizeChars<CanGC>(cx, chars, nchars);
     if (chars != stackChars)
         js_free(chars);
 #endif /* !IS_LITTLE_ENDIAN */

js/src/jsfriendapi.cpp

@@ -30,6 +30,9 @@ JS_STATIC_ASSERT(offsetof(JSRuntime, mainThread) ==
 PerThreadDataFriendFields::PerThreadDataFriendFields()
   : nativeStackLimit(0)
 {
+#if defined(JSGC_ROOT_ANALYSIS) || defined(JSGC_USE_EXACT_ROOTING)
+    PodArrayZero(thingGCRooters);
+#endif
 #if defined(DEBUG) && defined(JS_GC_ZEAL) && defined(JSGC_ROOT_ANALYSIS) && !defined(JS_THREADSAFE)
     skipGCRooters = NULL;
 #endif

js/src/jsfun.cpp

@@ -1482,7 +1482,7 @@ js::CloneFunctionObject(JSContext *cx, HandleFunction fun, HandleObject parent,
                                                  allocKind, newKind);
     if (!cloneobj)
         return NULL;
-    JSFunction *clone = cloneobj->toFunction();
+    RootedFunction clone(cx, cloneobj->toFunction());
 
     clone->nargs = fun->nargs;
     clone->flags = fun->flags & ~JSFunction::EXTENDED;

js/src/jsinterp.cpp

@@ -266,7 +266,7 @@ bool
 js::RunScript(JSContext *cx, StackFrame *fp)
 {
     JS_ASSERT(fp == cx->fp());
-    JSScript *script = fp->script();
+    RootedScript script(cx, fp->script());
 
     JS_ASSERT_IF(!fp->isGeneratorFrame(), cx->regs().pc == script->code);
     JS_ASSERT_IF(fp->isEvalFrame(), script->isActiveEval);
@@ -430,7 +430,7 @@ js::InvokeConstructorKernel(JSContext *cx, CallArgs args)
 
     JSObject &callee = args.callee();
     if (callee.isFunction()) {
-        JSFunction *fun = callee.toFunction();
+        RootedFunction fun(cx, callee.toFunction());
 
         if (fun->isNativeConstructor()) {
             Probes::calloutBegin(cx, fun);

js/src/jsobj.cpp

@@ -2904,7 +2904,7 @@ js_GetClassObject(JSContext *cx, RawObject obj, JSProtoKey key, MutableHandleObj
         return true;
     }
 
-    JSObject *cobj = NULL;
+    RootedObject cobj(cx, NULL);
     if (JSClassInitializerOp init = lazy_prototype_init[key]) {
         if (!init(cx, global))
             return false;

js/src/jsobjinlines.h

@@ -1769,18 +1769,18 @@ DefineConstructorAndPrototype(JSContext *cx, Handle<GlobalObject*> global,
 }
 
 inline bool
-ObjectClassIs(JSObject &obj, ESClassValue classValue, JSContext *cx)
+ObjectClassIs(HandleObject obj, ESClassValue classValue, JSContext *cx)
 {
-    if (JS_UNLIKELY(obj.isProxy()))
-        return Proxy::objectClassIs(&obj, classValue, cx);
+    if (JS_UNLIKELY(obj->isProxy()))
+        return Proxy::objectClassIs(obj, classValue, cx);
 
     switch (classValue) {
-      case ESClass_Array: return obj.isArray();
-      case ESClass_Number: return obj.isNumber();
-      case ESClass_String: return obj.isString();
-      case ESClass_Boolean: return obj.isBoolean();
-      case ESClass_RegExp: return obj.isRegExp();
-      case ESClass_ArrayBuffer: return obj.isArrayBuffer();
+      case ESClass_Array: return obj->isArray();
+      case ESClass_Number: return obj->isNumber();
+      case ESClass_String: return obj->isString();
+      case ESClass_Boolean: return obj->isBoolean();
+      case ESClass_RegExp: return obj->isRegExp();
+      case ESClass_ArrayBuffer: return obj->isArrayBuffer();
     }
     JS_NOT_REACHED("bad classValue");
     return false;
@@ -1791,7 +1791,8 @@ IsObjectWithClass(const Value &v, ESClassValue classValue, JSContext *cx)
 {
     if (!v.isObject())
         return false;
-    return ObjectClassIs(v.toObject(), classValue, cx);
+    js::RootedObject obj(cx, &v.toObject());
+    return ObjectClassIs(obj, classValue, cx);
 }
 
 static JS_ALWAYS_INLINE bool

js/src/json.cpp

@@ -327,7 +327,7 @@ PreprocessValue(JSContext *cx, HandleObject holder, KeyType key, MutableHandleVa
 
     /* Step 4. */
     if (vp.get().isObject()) {
-        JSObject &obj = vp.get().toObject();
+        RootedObject obj(cx, &vp.get().toObject());
         if (ObjectClassIs(obj, ESClass_Number, cx)) {
             double d;
             if (!ToNumber(cx, vp, &d))
@@ -339,8 +339,7 @@ PreprocessValue(JSContext *cx, HandleObject holder, KeyType key, MutableHandleVa
                 return false;
             vp.set(StringValue(str));
         } else if (ObjectClassIs(obj, ESClass_Boolean, cx)) {
-            RootedObject nobj(cx, &obj);
-            if (!BooleanGetPrimitiveValue(cx, nobj, vp.address()))
+            if (!BooleanGetPrimitiveValue(cx, obj, vp.address()))
                 return false;
             JS_ASSERT(vp.get().isBoolean());
         }
@@ -572,7 +571,7 @@ Str(JSContext *cx, const Value &v, StringifyContext *scx)
 
     scx->depth++;
     JSBool ok;
-    if (ObjectClassIs(v.toObject(), ESClass_Array, cx))
+    if (ObjectClassIs(obj, ESClass_Array, cx))
         ok = JA(cx, obj, scx);
     else
         ok = JO(cx, obj, scx);
@@ -595,7 +594,7 @@ js_Stringify(JSContext *cx, MutableHandleValue vp, JSObject *replacer_, Value sp
     if (replacer) {
         if (replacer->isCallable()) {
             /* Step 4a(i): use replacer to transform values.  */
-        } else if (ObjectClassIs(*replacer, ESClass_Array, cx)) {
+        } else if (ObjectClassIs(replacer, ESClass_Array, cx)) {
             /*
              * Step 4b: The spec algorithm is unhelpfully vague about the exact
              * steps taken when the replacer is an array, regarding the exact
@@ -655,9 +654,8 @@ js_Stringify(JSContext *cx, MutableHandleValue vp, JSObject *replacer_, Value sp
                             return false;
                     }
                 } else if (v.isString() ||
-                           (v.isObject() &&
-                            (ObjectClassIs(v.toObject(), ESClass_String, cx) ||
-                             ObjectClassIs(v.toObject(), ESClass_Number, cx))))
+                           IsObjectWithClass(v, ESClass_String, cx) ||
+                           IsObjectWithClass(v, ESClass_Number, cx))
                 {
                     /* Step 4b(iv)(3), 4b(iv)(5). */
                     if (!ValueToId<CanGC>(cx, v, &id))
@@ -682,12 +680,12 @@ js_Stringify(JSContext *cx, MutableHandleValue vp, JSObject *replacer_, Value sp
     /* Step 5. */
     if (space.isObject()) {
         RootedObject spaceObj(cx, &space.toObject());
-        if (ObjectClassIs(*spaceObj, ESClass_Number, cx)) {
+        if (ObjectClassIs(spaceObj, ESClass_Number, cx)) {
             double d;
             if (!ToNumber(cx, space, &d))
                 return false;
             space = NumberValue(d);
-        } else if (ObjectClassIs(*spaceObj, ESClass_String, cx)) {
+        } else if (ObjectClassIs(spaceObj, ESClass_String, cx)) {
             JSString *str = ToStringSlow<CanGC>(cx, space);
             if (!str)
                 return false;

js/src/jsproxy.cpp

@@ -476,7 +476,8 @@ bool
 DirectProxyHandler::objectClassIs(JSObject *proxy, ESClassValue classValue,
                                   JSContext *cx)
 {
-    return ObjectClassIs(*GetProxyTargetObject(proxy), classValue, cx);
+    RootedObject obj(cx, GetProxyTargetObject(proxy));
+    return ObjectClassIs(obj, classValue, cx);
 }
 
 JSString *

js/src/jsstr.cpp

@@ -3689,14 +3689,14 @@ js::ValueToSource(JSContext *cx, const Value &v)
         return ToString<CanGC>(cx, v);
     }
 
-    Value rval = NullValue();
+    RootedValue rval(cx, NullValue());
     RootedValue fval(cx);
     RootedId id(cx, NameToId(cx->names().toSource));
     Rooted<JSObject*> obj(cx, &v.toObject());
     if (!GetMethod(cx, obj, id, 0, &fval))
         return NULL;
     if (js_IsCallable(fval)) {
-        if (!Invoke(cx, ObjectValue(*obj), fval, 0, NULL, &rval))
+        if (!Invoke(cx, ObjectValue(*obj), fval, 0, NULL, rval.address()))
             return NULL;
     }
 

js/src/jstypedarray.cpp

@@ -1949,7 +1949,7 @@ class TypedArrayTemplate
     fromBuffer(JSContext *cx, HandleObject bufobj, int32_t byteOffsetInt, int32_t lengthInt,
                HandleObject proto)
     {
-        if (!ObjectClassIs(*bufobj, ESClass_ArrayBuffer, cx)) {
+        if (!ObjectClassIs(bufobj, ESClass_ArrayBuffer, cx)) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_TYPED_ARRAY_BAD_ARGS);
             return NULL; // must be arrayBuffer
         }

js/src/shell/js.cpp

@@ -519,7 +519,7 @@ Process(JSContext *cx, JSObject *obj_, const char *filename, bool forceTTY)
 {
     bool ok, hitEOF;
     RootedScript script(cx);
-    jsval result;
+    RootedValue result(cx);
     RootedString str(cx);
     char *buffer;
     size_t size;
@@ -676,7 +676,7 @@ Process(JSContext *cx, JSObject *obj_, const char *filename, bool forceTTY)
         JS_ASSERT_IF(!script, gGotError);
 
         if (script && !compileOnly) {
-            ok = JS_ExecuteScript(cx, obj, script, &result);
+            ok = JS_ExecuteScript(cx, obj, script, result.address());
             if (ok && !JSVAL_IS_VOID(result)) {
                 str = JS_ValueToSource(cx, result);
                 ok = !!str;
@@ -938,9 +938,9 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
 
     if (argc == 2) {
         RootedObject options(cx, &args[1].toObject());
-        jsval v;
+        RootedValue v(cx);
 
-        if (!JS_GetProperty(cx, options, "newContext", &v))
+        if (!JS_GetProperty(cx, options, "newContext", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
@@ -949,7 +949,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
             newContext = b;
         }
 
-        if (!JS_GetProperty(cx, options, "compileAndGo", &v))
+        if (!JS_GetProperty(cx, options, "compileAndGo", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
@@ -958,7 +958,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
             compileAndGo = b;
         }
 
-        if (!JS_GetProperty(cx, options, "noScriptRval", &v))
+        if (!JS_GetProperty(cx, options, "noScriptRval", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
@@ -967,7 +967,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
             noScriptRval = b;
         }
 
-        if (!JS_GetProperty(cx, options, "fileName", &v))
+        if (!JS_GetProperty(cx, options, "fileName", v.address()))
             return false;
         if (JSVAL_IS_NULL(v)) {
             fileName = NULL;
@@ -980,7 +980,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
                 return false;
         }
 
-        if (!JS_GetProperty(cx, options, "sourceMapURL", &v))
+        if (!JS_GetProperty(cx, options, "sourceMapURL", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSString *s = JS_ValueToString(cx, v);
@@ -992,7 +992,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
             sourceMapURL = js_strdup(cx, smurl);
         }
 
-        if (!JS_GetProperty(cx, options, "lineNumber", &v))
+        if (!JS_GetProperty(cx, options, "lineNumber", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             uint32_t u;
@@ -1001,7 +1001,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
             lineNumber = u;
         }
 
-        if (!JS_GetProperty(cx, options, "global", &v))
+        if (!JS_GetProperty(cx, options, "global", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             global = JSVAL_IS_PRIMITIVE(v) ? NULL : JSVAL_TO_OBJECT(v);
@@ -1017,7 +1017,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
             }
         }
 
-        if (!JS_GetProperty(cx, options, "catchTermination", &v))
+        if (!JS_GetProperty(cx, options, "catchTermination", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
@@ -1076,7 +1076,7 @@ static JSString *
 FileAsString(JSContext *cx, const char *pathname)
 {
     FILE *file;
-    JSString *str = NULL;
+    RootedString str(cx);
     size_t len, cc;
     char *buf;
 
@@ -1134,7 +1134,7 @@ FileAsTypedArray(JSContext *cx, const char *pathname)
         return NULL;
     }
 
-    JSObject *obj = NULL;
+    RootedObject obj(cx);
     if (fseek(file, 0, SEEK_END) != 0) {
         JS_ReportError(cx, "can't seek end of %s", pathname);
     } else {
@@ -1538,7 +1538,6 @@ TrapHandler(JSContext *cx, RawScript, jsbytecode *pc, jsval *rval,
 static JSBool
 Trap(JSContext *cx, unsigned argc, jsval *vp)
 {
-    JSString *str;
     RootedScript script(cx);
     int32_t i;
 
@@ -1548,7 +1547,7 @@ Trap(JSContext *cx, unsigned argc, jsval *vp)
         return false;
     }
     argc--;
-    str = JS_ValueToString(cx, argv[argc]);
+    RootedString str(cx, JS_ValueToString(cx, argv[argc]));
     if (!str)
         return false;
     argv[argc] = STRING_TO_JSVAL(str);
@@ -1931,8 +1930,8 @@ DisassembleToSprinter(JSContext *cx, unsigned argc, jsval *vp, Sprinter *sprinte
         }
     } else {
         for (unsigned i = 0; i < p.argc; i++) {
-            JSFunction *fun;
-            RootedScript script (cx, ValueToScript(cx, p.argv[i], &fun));
+            RootedFunction fun(cx);
+            RootedScript script (cx, ValueToScript(cx, p.argv[i], fun.address()));
             if (!script)
                 return false;
             if (!DisassembleScript(cx, script, fun, p.lines, p.recursive, sprinter))
@@ -2224,8 +2223,8 @@ DumpHeap(JSContext *cx, unsigned argc, jsval *vp)
 static JSBool
 DumpObject(JSContext *cx, unsigned argc, jsval *vp)
 {
-    JSObject *arg0 = NULL;
-    if (!JS_ConvertArguments(cx, argc, JS_ARGV(cx, vp), "o", &arg0))
+    RootedObject arg0(cx);
+    if (!JS_ConvertArguments(cx, argc, JS_ARGV(cx, vp), "o", arg0.address()))
         return false;
 
     js_DumpObject(arg0);
@@ -2414,10 +2413,10 @@ typedef struct ComplexObject {
 static JSBool
 sandbox_enumerate(JSContext *cx, HandleObject obj)
 {
-    jsval v;
+    RootedValue v(cx);
     JSBool b;
 
-    if (!JS_GetProperty(cx, obj, "lazy", &v))
+    if (!JS_GetProperty(cx, obj, "lazy", v.address()))
         return false;
 
     JS_ValueToBoolean(cx, v, &b);
@@ -2428,10 +2427,10 @@ static JSBool
 sandbox_resolve(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
                 MutableHandleObject objp)
 {
-    jsval v;
+    RootedValue v(cx);
     JSBool b, resolved;
 
-    if (!JS_GetProperty(cx, obj, "lazy", &v))
+    if (!JS_GetProperty(cx, obj, "lazy", v.address()))
         return false;
 
     JS_ValueToBoolean(cx, v, &b);
@@ -2560,7 +2559,7 @@ EvalInFrame(JSContext *cx, unsigned argc, jsval *vp)
     }
 
     uint32_t upCount = JSVAL_TO_INT(argv[0]);
-    JSString *str = JSVAL_TO_STRING(argv[1]);
+    RootedString str(cx, JSVAL_TO_STRING(argv[1]));
 
     bool saveCurrent = (argc >= 3 && JSVAL_IS_BOOLEAN(argv[2]))
                         ? !!(JSVAL_TO_BOOLEAN(argv[2]))
@@ -2628,7 +2627,7 @@ CopyProperty(JSContext *cx, HandleObject obj, HandleObject referent, HandleId id
              unsigned lookupFlags, MutableHandleObject objp)
 {
     RootedShape shape(cx);
-    PropertyDescriptor desc;
+    AutoPropertyDescriptorRooter desc(cx);
     unsigned propFlags = 0;
     RootedObject obj2(cx);
 
@@ -2655,7 +2654,6 @@ CopyProperty(JSContext *cx, HandleObject obj, HandleObject referent, HandleId id
         desc.shortid = shape->shortid();
         propFlags = shape->getFlags();
     } else if (IsProxy(referent)) {
-        PropertyDescriptor desc;
         if (!Proxy::getOwnPropertyDescriptor(cx, referent, id, &desc, 0))
             return false;
         if (!desc.obj)
@@ -3939,8 +3937,8 @@ Help(JSContext *cx, unsigned argc, jsval *vp)
             return false;
 
         for (size_t i = 0; i < ida.length(); i++) {
-            jsval v;
-            if (!JS_LookupPropertyById(cx, global, ida[i], &v))
+            RootedValue v(cx);
+            if (!JS_LookupPropertyById(cx, global, ida[i], v.address()))
                 return false;
             if (JSVAL_IS_PRIMITIVE(v)) {
                 JS_ReportError(cx, "primitive arg");

js/src/vm/ObjectImpl.cpp

@@ -532,11 +532,8 @@ js::GetOwnProperty(JSContext *cx, Handle<ObjectImpl*> obj, PropertyId pid_, unsi
         return false;
     }
 
-    /* |shape| is always set /after/ a GC. */
-    UnrootedShape shape = obj->nativeLookup(cx, pid);
+    RootedShape shape(cx, obj->nativeLookup(cx, pid));
     if (!shape) {
-        DropUnrooted(shape);
-
         /* Not found: attempt to resolve it. */
         Class *clasp = obj->getClass();
         JSResolveOp resolve = clasp->resolve;
@@ -689,6 +686,7 @@ js::GetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> recei
 
     Rooted<ObjectImpl*> current(cx, obj);
 
+    RootedValue getter(cx);
     do {
         MOZ_ASSERT(current);
 
@@ -719,8 +717,8 @@ js::GetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> recei
 
         /* If it's an accessor property, call its [[Get]] with the receiver. */
         if (desc.isAccessorDescriptor()) {
-            Value get = desc.getterValue();
-            if (get.isUndefined()) {
+            getter = desc.getterValue();
+            if (getter.isUndefined()) {
                 vp->setUndefined();
                 return true;
             }
@@ -729,8 +727,8 @@ js::GetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> recei
             if (!cx->stack.pushInvokeArgs(cx, 0, &args))
                 return false;
 
-            /* Push get, receiver, and no args. */
-            args.setCallee(get);
+            /* Push getter, receiver, and no args. */
+            args.setCallee(getter);
             args.setThis(ObjectValue(*current));
 
             bool ok = Invoke(cx, args);
@@ -920,6 +918,7 @@ js::SetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> recei
     NEW_OBJECT_REPRESENTATION_ONLY();
 
     Rooted<ObjectImpl*> current(cx, obj);
+    RootedValue setter(cx);
 
     MOZ_ASSERT(receiver);
 
@@ -953,7 +952,7 @@ js::SetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> recei
             }
 
             if (ownDesc.isAccessorDescriptor()) {
-                Value setter = ownDesc.setterValue();
+                setter = ownDesc.setterValue();
                 if (setter.isUndefined()) {
                     *succeeded = false;
                     return true;

js/src/vm/ScopeObject.cpp

@@ -1410,23 +1410,22 @@ class DebugScopeProxy : public BaseProxyHandler
 
     bool getScopePropertyNames(JSContext *cx, JSObject *proxy, AutoIdVector &props, unsigned flags)
     {
-        ScopeObject &scope = proxy->asDebugScope().scope();
+        Rooted<ScopeObject*> scope(cx, &proxy->asDebugScope().scope());
 
-        if (isMissingArgumentsBinding(scope)) {
+        if (isMissingArgumentsBinding(*scope)) {
             if (!props.append(NameToId(cx->names().arguments)))
                 return false;
         }
 
-        RootedObject rootedScope(cx, &scope);
-        if (!GetPropertyNames(cx, rootedScope, flags, &props))
+        if (!GetPropertyNames(cx, scope, flags, &props))
             return false;
 
         /*
          * Function scopes are optimized to not contain unaliased variables so
          * they must be manually appended here.
          */
-        if (scope.isCall() && !scope.asCall().isForEval()) {
-            RootedScript script(cx, scope.asCall().callee().nonLazyScript());
+        if (scope->isCall() && !scope->asCall().isForEval()) {
+            RootedScript script(cx, scope->asCall().callee().nonLazyScript());
             for (BindingIter bi(script); bi; bi++) {
                 if (!bi->aliased() && !props.append(NameToId(bi->name())))
                     return false;

js/src/vm/Shape.cpp

@@ -514,14 +514,14 @@ JSObject::addPropertyInternal(JSContext *cx, HandleObject obj, HandleId id,
     JS_ASSERT(!!table == !!spp);
 
     /* Find or create a property tree node labeled by our arguments. */
-    UnrootedShape shape;
+    RootedShape shape(cx);
     {
         RootedShape last(cx, obj->lastProperty());
 
         uint32_t index;
         bool indexed = js_IdIsIndex(id, &index);
 
-        UnrootedUnownedBaseShape nbase;
+        Rooted<UnownedBaseShape*> nbase(cx);
         if (last->base()->matchesGetterSetter(getter, setter) && !indexed) {
             nbase = last->base()->unowned();
         } else {
@@ -534,7 +534,7 @@ JSObject::addPropertyInternal(JSContext *cx, HandleObject obj, HandleId id,
                 return UnrootedShape(NULL);
         }
 
-        StackShape child(DropUnrooted(nbase), id, slot, obj->numFixedSlots(), attrs, flags, shortid);
+        StackShape child(nbase, id, slot, obj->numFixedSlots(), attrs, flags, shortid);
         shape = getChildProperty(cx, obj, last, child);
     }
 

layout/base/nsDisplayList.cpp

@@ -300,7 +300,8 @@ AddAnimationsForProperty(nsIFrame* aFrame, nsCSSProperty aProperty,
   nsStyleContext* styleContext = aFrame->GetStyleContext();
   nsPresContext* presContext = aFrame->PresContext();
   nsRect bounds = nsDisplayTransform::GetFrameBoundsForTransform(aFrame);
-  float scale = presContext->AppUnitsPerDevPixel();
+  // all data passed directly to the compositor should be in css pixels
+  float scale = nsDeviceContext::AppUnitsPerCSSPixel();
 
   TimeStamp startTime = ea->mStartTime + ea->mDelay;
   TimeDuration duration = ea->mIterationDuration;
@@ -379,6 +380,7 @@ AddAnimationsAndTransitionsToLayer(Layer* aLayer, nsDisplayListBuilder* aBuilder
   AnimationData data;
   if (aProperty == eCSSProperty_transform) {
     nsRect bounds = nsDisplayTransform::GetFrameBoundsForTransform(frame);
+    // all data passed directly to the compositor should be in css pixels
     float scale = nsDeviceContext::AppUnitsPerCSSPixel();
     gfxPoint3D offsetToTransformOrigin =
       nsDisplayTransform::GetDeltaToMozTransformOrigin(frame, scale, &bounds);
@@ -395,7 +397,8 @@ AddAnimationsAndTransitionsToLayer(Layer* aLayer, nsDisplayListBuilder* aBuilder
     nsPoint origin = aItem->ToReferenceFrame();
 
     data = TransformData(origin, offsetToTransformOrigin,
-                         offsetToPerspectiveOrigin, bounds, perspective);
+                         offsetToPerspectiveOrigin, bounds, perspective,
+                         frame->PresContext()->AppUnitsPerDevPixel());
   } else if (aProperty == eCSSProperty_opacity) {
     data = null_t();
   }

layout/base/nsPresArena.cpp

@@ -405,8 +405,7 @@ struct nsPresArena::State {
   size_t SizeOfIncludingThisFromMalloc(nsMallocSizeOfFun aMallocSizeOf) const
   {
     size_t n = aMallocSizeOf(this);
-    n += PL_SizeOfArenaPoolExcludingPool(&mPool,
-                                         aMallocSizeOf);
+    n += PL_SizeOfArenaPoolExcludingPool(&mPool, aMallocSizeOf);
     n += mFreeLists.SizeOfExcludingThis(SizeOfFreeListEntryExcludingThis,
                                         aMallocSizeOf);
     return n;

layout/reftests/svg/smil/motion/animateMotion-mpath-pathLength-1.svg

@@ -2,12 +2,12 @@
      xmlns:xlink="http://www.w3.org/1999/xlink" class="reftest-wait">
   <title>Test that pathLength of paths has no effect in animation</title>
   <defs>
-    <path id="path" pathLength="100" d="M-200,0 h400" />
+    <path id="path" pathLength="100" d="M0,0 h400" />
   </defs>
   <script xlink:href="../smil-util.js" type="text/javascript"/>
   <script type="text/javascript">
     function doTest() {
-      setTimeAndSnapshot(0.5, true);
+      setTimeAndSnapshot(100.5, true);
     }
     window.addEventListener("MozReftestInvalidate", doTest, false);
   </script>
@@ -15,16 +15,16 @@
 
   <!-- calcMode="linear" -->
   <rect x="10" y="10" width="100" height="100" fill="red"/>
-  <rect x="10" y="10" width="100" height="100" fill="lime">
-    <animateMotion dur="1s" keyPoints="0;1" keyTimes="0;1" calcMode="linear">
+  <rect x="-190" y="10" width="100" height="100" fill="lime">
+    <animateMotion begin="100s" dur="1s" keyPoints="0;1" keyTimes="0;1" calcMode="linear">
       <mpath xlink:href="#path" />
     </animateMotion>
   </rect>
 
   <!-- calcMode="paced" -->
   <rect x="10" y="110" width="100" height="100" fill="red"/>
-  <rect x="10" y="110" width="100" height="100" fill="lime">
-    <animateMotion dur="1s">
+  <rect x="-190" y="110" width="100" height="100" fill="lime">
+    <animateMotion begin="100s" dur="1s">
       <mpath xlink:href="#path" />
     </animateMotion>
   </rect>

media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp

@@ -248,6 +248,7 @@ PeerConnectionImpl::PeerConnectionImpl()
 
 PeerConnectionImpl::~PeerConnectionImpl()
 {
+  // This aborts if not on main thread (in Debug builds)
   PC_AUTO_ENTER_API_CALL_NO_CHECK();
   if (PeerConnectionCtx::isActive()) {
     PeerConnectionCtx::GetInstance()->mPeerConnections.erase(mHandle);

media/webrtc/trunk/webrtc/modules/video_capture/mac/video_capture_mac.mm

@@ -30,8 +30,8 @@
 #include "QuickTime/video_capture_quick_time.h"
 #include "QuickTime/video_capture_quick_time_info.h"
 #else
-#include "QTKit/video_capture_qtkit.h"
-#include "QTKit/video_capture_qtkit_info.h"
+#include "qtkit/video_capture_qtkit.h"
+#include "qtkit/video_capture_qtkit_info.h"
 #endif
 
 namespace webrtc

mobile/android/base/AboutHomeContent.java

@@ -790,13 +790,8 @@ public class AboutHomeContent extends ScrollView
         }
 
         public int getColumnWidth(int width) {
-            int s = -1;
-            if (android.os.Build.VERSION.SDK_INT >= 16)
-                s= super.getColumnWidth();
-            else
-                s = (width - getPaddingLeft() - getPaddingRight()) / mNumberOfCols;
-
-            return s;
+            // super.getColumnWidth() doesn't always return the correct value.
+            return (width - getPaddingLeft() - getPaddingRight()) / mNumberOfCols;
         }
 
         @Override

mobile/android/base/Makefile.in

@@ -881,8 +881,6 @@ RES_DRAWABLE_LAND_V14 = \
   $(NULL)
 
 RES_DRAWABLE_LAND_MDPI_V14 = \
-  res/drawable-land-mdpi-v14/ic_awesomebar_go.png \
-  res/drawable-land-mdpi-v14/ic_awesomebar_search.png \
   res/drawable-land-mdpi-v14/address_bar_texture_land.png \
   res/drawable-land-mdpi-v14/address_bar_texture_land_pb.png \
   res/drawable-land-mdpi-v14/address_bar_url_default.9.png \
@@ -892,15 +890,9 @@ RES_DRAWABLE_LAND_MDPI_V14 = \
   res/drawable-land-mdpi-v14/remote_tabs_off.png \
   res/drawable-land-mdpi-v14/remote_tabs_on.png \
   res/drawable-land-mdpi-v14/tabs_carat.png \
-  res/drawable-land-mdpi-v14/urlbar_stop.png \
-  res/drawable-land-mdpi-v14/reader.png \
-  res/drawable-land-mdpi-v14/site_security_identified.png \
-  res/drawable-land-mdpi-v14/site_security_verified.png \
   $(NULL)
 
 RES_DRAWABLE_LAND_HDPI_V14 = \
-  res/drawable-land-hdpi-v14/ic_awesomebar_go.png \
-  res/drawable-land-hdpi-v14/ic_awesomebar_search.png \
   res/drawable-land-hdpi-v14/address_bar_texture_land.png \
   res/drawable-land-hdpi-v14/address_bar_texture_land_pb.png \
   res/drawable-land-hdpi-v14/address_bar_url_default.9.png \
@@ -910,15 +902,9 @@ RES_DRAWABLE_LAND_HDPI_V14 = \
   res/drawable-land-hdpi-v14/remote_tabs_off.png \
   res/drawable-land-hdpi-v14/remote_tabs_on.png \
   res/drawable-land-hdpi-v14/tabs_carat.png \
-  res/drawable-land-hdpi-v14/urlbar_stop.png \
-  res/drawable-land-hdpi-v14/reader.png \
-  res/drawable-land-hdpi-v14/site_security_identified.png \
-  res/drawable-land-hdpi-v14/site_security_verified.png \
   $(NULL)
 
 RES_DRAWABLE_LAND_XHDPI_V14 = \
-  res/drawable-land-xhdpi-v14/ic_awesomebar_go.png \
-  res/drawable-land-xhdpi-v14/ic_awesomebar_search.png \
   res/drawable-land-xhdpi-v14/address_bar_texture_land.png \
   res/drawable-land-xhdpi-v14/address_bar_texture_land_pb.png \
   res/drawable-land-xhdpi-v14/address_bar_url_default.9.png \
@@ -928,10 +914,6 @@ RES_DRAWABLE_LAND_XHDPI_V14 = \
   res/drawable-land-xhdpi-v14/remote_tabs_off.png \
   res/drawable-land-xhdpi-v14/remote_tabs_on.png \
   res/drawable-land-xhdpi-v14/tabs_carat.png \
-  res/drawable-land-xhdpi-v14/urlbar_stop.png \
-  res/drawable-land-xhdpi-v14/reader.png \
-  res/drawable-land-xhdpi-v14/site_security_identified.png \
-  res/drawable-land-xhdpi-v14/site_security_verified.png \
   $(NULL)
 
 RES_DRAWABLE_LARGE_MDPI_V11 = \
@@ -943,16 +925,10 @@ RES_DRAWABLE_LARGE_MDPI_V11 = \
   res/drawable-large-mdpi-v11/address_bar_url_default_pb.9.png \
   res/drawable-large-mdpi-v11/address_bar_url_pressed.9.png \
   res/drawable-large-mdpi-v11/address_bar_url_pressed_pb.9.png \
-  res/drawable-large-mdpi-v11/ic_awesomebar_go.png \
-  res/drawable-large-mdpi-v11/ic_awesomebar_search.png \
   res/drawable-large-mdpi-v11/ic_menu_reload.png \
   res/drawable-large-mdpi-v11/ic_menu_forward.png \
   res/drawable-large-mdpi-v11/remote_tabs_off.png \
   res/drawable-large-mdpi-v11/remote_tabs_on.png \
-  res/drawable-large-mdpi-v11/urlbar_stop.png \
-  res/drawable-large-mdpi-v11/reader.png \
-  res/drawable-large-mdpi-v11/site_security_identified.png \
-  res/drawable-large-mdpi-v11/site_security_verified.png \
   res/drawable-large-mdpi-v11/tabs_carat.png \
   $(NULL)
 
@@ -963,16 +939,10 @@ RES_DRAWABLE_LARGE_HDPI_V11 = \
   res/drawable-large-hdpi-v11/address_bar_url_default_pb.9.png \
   res/drawable-large-hdpi-v11/address_bar_url_pressed.9.png \
   res/drawable-large-hdpi-v11/address_bar_url_pressed_pb.9.png \
-  res/drawable-large-hdpi-v11/ic_awesomebar_go.png \
-  res/drawable-large-hdpi-v11/ic_awesomebar_search.png \
   res/drawable-large-hdpi-v11/ic_menu_reload.png \
   res/drawable-large-hdpi-v11/ic_menu_forward.png \
   res/drawable-large-hdpi-v11/remote_tabs_off.png \
   res/drawable-large-hdpi-v11/remote_tabs_on.png \
-  res/drawable-large-hdpi-v11/urlbar_stop.png \
-  res/drawable-large-hdpi-v11/reader.png \
-  res/drawable-large-hdpi-v11/site_security_identified.png \
-  res/drawable-large-hdpi-v11/site_security_verified.png \
   res/drawable-large-hdpi-v11/tabs_carat.png \
   $(NULL)
 
@@ -983,16 +953,10 @@ RES_DRAWABLE_LARGE_XHDPI_V11 = \
   res/drawable-large-xhdpi-v11/address_bar_url_default_pb.9.png \
   res/drawable-large-xhdpi-v11/address_bar_url_pressed.9.png \
   res/drawable-large-xhdpi-v11/address_bar_url_pressed_pb.9.png \
-  res/drawable-large-xhdpi-v11/ic_awesomebar_go.png \
-  res/drawable-large-xhdpi-v11/ic_awesomebar_search.png \
   res/drawable-large-xhdpi-v11/ic_menu_reload.png \
   res/drawable-large-xhdpi-v11/ic_menu_forward.png \
   res/drawable-large-xhdpi-v11/remote_tabs_on.png \
   res/drawable-large-xhdpi-v11/remote_tabs_off.png \
-  res/drawable-large-xhdpi-v11/urlbar_stop.png \
-  res/drawable-large-xhdpi-v11/reader.png \
-  res/drawable-large-xhdpi-v11/site_security_identified.png \
-  res/drawable-large-xhdpi-v11/site_security_verified.png \
   res/drawable-large-xhdpi-v11/tabs_carat.png \
   $(NULL)
 

mobile/android/base/RemoteTabs.java

@@ -88,10 +88,8 @@ public class RemoteTabs extends ExpandableListView
     @Override
     public void onQueryTabsComplete(List<TabsAccessor.RemoteTab> remoteTabsList) {
         ArrayList<TabsAccessor.RemoteTab> remoteTabs = new ArrayList<TabsAccessor.RemoteTab> (remoteTabsList);
-        if (remoteTabs == null || remoteTabs.size() == 0) {
-            autoHidePanel();
+        if (remoteTabs == null || remoteTabs.size() == 0)
             return;
-        }
         
         ArrayList <HashMap <String, String>> clients = new ArrayList <HashMap <String, String>>();
 

mobile/android/base/Tabs.java

@@ -286,9 +286,14 @@ public class Tabs implements GeckoEventListener {
                 int id = message.getInt("tabID");
                 Tab tab = null;
 
-                if (mTabs.containsKey(id)) {
-                    tab = mTabs.get(id);
-                    tab.updateURL(url);
+                if (message.getBoolean("stub")) {
+                    if (mTabs.containsKey(id)) {
+                        tab = mTabs.get(id);
+                        tab.updateURL(url);
+                    } else {
+                        // Tab was already closed; abort
+                        return;
+                    }
                 } else {
                     tab = addTab(id, url, message.getBoolean("external"),
                                           message.getInt("parentId"),