From e2bccc2b513de9bfac2ef4f56ff0a5b923787a8c Mon Sep 17 00:00:00 2001
From: Alexander Surkov <surkov.alexander@gmail.com>
Date: Tue, 16 Jul 2013 13:13:34 -0400
Subject: [PATCH 01/37] Bug 882602 - clean up getText* line boundary code,
 r=tbsaunde

---
 .../src/generic/HyperTextAccessible.cpp       | 200 ++++++++----------
 accessible/src/generic/HyperTextAccessible.h  |  35 ++-
 2 files changed, 118 insertions(+), 117 deletions(-)

diff --git a/accessible/src/generic/HyperTextAccessible.cpp b/accessible/src/generic/HyperTextAccessible.cpp
index ea130f3b2627..f929eddf4ded 100644
--- a/accessible/src/generic/HyperTextAccessible.cpp
+++ b/accessible/src/generic/HyperTextAccessible.cpp
@@ -772,9 +772,9 @@ HyperTextAccessible::GetRelativeOffset(nsIPresShell* aPresShell,
 }
 
 int32_t
-HyperTextAccessible::FindBoundary(int32_t aOffset, nsDirection aDirection,
-                                  nsSelectionAmount aAmount,
-                                  EWordMovementType aWordMovementType)
+HyperTextAccessible::FindOffset(int32_t aOffset, nsDirection aDirection,
+                                nsSelectionAmount aAmount,
+                                EWordMovementType aWordMovementType)
 {
   // Convert hypertext offset to frame-relative offset.
   int32_t offsetInFrame = aOffset, notUsedOffset = aOffset;
@@ -803,6 +803,81 @@ HyperTextAccessible::FindBoundary(int32_t aOffset, nsDirection aDirection,
                            aWordMovementType);
 }
 
+int32_t
+HyperTextAccessible::FindLineBoundary(int32_t aOffset,
+                                      EWhichLineBoundary aWhichLineBoundary)
+{
+  // Note: empty last line doesn't have own frame (a previous line contains '\n'
+  // character instead) thus when it makes a difference we need to process this
+  // case separately (otherwise operations are performed on previous line).
+  switch (aWhichLineBoundary) {
+    case ePrevLineBegin: {
+      // Fetch a previous line and move to its start (as arrow up and home keys
+      // were pressed).
+      if (IsEmptyLastLineOffset(aOffset))
+        return FindOffset(aOffset, eDirPrevious, eSelectBeginLine);
+
+      int32_t tmpOffset = FindOffset(aOffset, eDirPrevious, eSelectLine);
+      return FindOffset(tmpOffset, eDirPrevious, eSelectBeginLine);
+    }
+
+    case ePrevLineEnd: {
+      if (IsEmptyLastLineOffset(aOffset))
+        return aOffset - 1;
+
+      // If offset is at first line then return 0 (first line start).
+      int32_t tmpOffset = FindOffset(aOffset, eDirPrevious, eSelectBeginLine);
+      if (tmpOffset == 0)
+        return 0;
+
+      // Otherwise move to end of previous line (as arrow up and end keys were
+      // pressed).
+      tmpOffset = FindOffset(aOffset, eDirPrevious, eSelectLine);
+      return FindOffset(tmpOffset, eDirNext, eSelectEndLine);
+    }
+
+    case eThisLineBegin:
+      if (IsEmptyLastLineOffset(aOffset))
+        return aOffset;
+
+      // Move to begin of the current line (as home key was pressed).
+      return FindOffset(aOffset, eDirPrevious, eSelectBeginLine);
+
+    case eThisLineEnd:
+      if (IsEmptyLastLineOffset(aOffset))
+        return aOffset;
+
+      // Move to end of the current line (as end key was pressed).
+      return FindOffset(aOffset, eDirNext, eSelectEndLine);
+
+    case eNextLineBegin: {
+      if (IsEmptyLastLineOffset(aOffset))
+        return aOffset;
+
+      // Move to begin of the next line if any (arrow down and home keys),
+      // otherwise end of the current line (arrow down only).
+      int32_t tmpOffset = FindOffset(aOffset, eDirNext, eSelectLine);
+      if (tmpOffset == CharacterCount())
+        return tmpOffset;
+
+      return FindOffset(tmpOffset, eDirPrevious, eSelectBeginLine);
+    }
+
+    case eNextLineEnd: {
+      if (IsEmptyLastLineOffset(aOffset))
+        return aOffset;
+
+      // Move to next line end (as down arrow and end key were pressed).
+      int32_t tmpOffset = FindOffset(aOffset, eDirNext, eSelectLine);
+      if (tmpOffset != CharacterCount())
+        return FindOffset(tmpOffset, eDirNext, eSelectEndLine);
+      return tmpOffset;
+    }
+  }
+
+  return -1;
+}
+
 /*
 Gets the specified text relative to aBoundaryType, which means:
 BOUNDARY_CHAR             The character before/at/after the offset is returned.
@@ -1029,54 +1104,21 @@ HyperTextAccessible::GetTextBeforeOffset(int32_t aOffset,
       return GetText(*aStartOffset, *aEndOffset, aText);
     }
 
-    case BOUNDARY_LINE_START: {
+    case BOUNDARY_LINE_START:
       if (aOffset == nsIAccessibleText::TEXT_OFFSET_CARET)
         offset = AdjustCaretOffset(offset);
 
-      // If we are at last empty then home key and get the text (last empty line
-      // doesn't have own frame).
-      if (IsEmptyLastLineOffset(offset)) {
-        *aStartOffset = FindLineBoundary(offset, eDirPrevious, eSelectBeginLine);
-        *aEndOffset = offset;
-        return GetText(*aStartOffset, *aEndOffset, aText);
-      }
-
-      // Home key, up arrow, home key.
-      *aEndOffset = FindLineBoundary(offset, eDirPrevious, eSelectBeginLine);
-      *aStartOffset = FindLineBoundary(offset, eDirPrevious, eSelectLine);
-      *aStartOffset = FindLineBoundary(*aStartOffset, eDirPrevious, eSelectBeginLine);
-
+      *aStartOffset = FindLineBoundary(offset, ePrevLineBegin);
+      *aEndOffset = FindLineBoundary(offset, eThisLineBegin);
       return GetText(*aStartOffset, *aEndOffset, aText);
-    }
 
-    case BOUNDARY_LINE_END: {
+    case BOUNDARY_LINE_END:
       if (aOffset == nsIAccessibleText::TEXT_OFFSET_CARET)
         offset = AdjustCaretOffset(offset);
 
-      // Nothing if we are at first line.
-      int32_t tmpOffset = FindLineBoundary(offset, eDirPrevious, eSelectBeginLine);
-      if (tmpOffset == 0) {
-        *aStartOffset = *aEndOffset = 0;
-        return NS_OK;
-      }
-
-      // Up arrow, end key to find previous line endings.
-      if (IsEmptyLastLineOffset(offset)) { // no own frame for a last line
-        tmpOffset = FindLineBoundary(offset, eDirPrevious, eSelectLine);
-        *aStartOffset = FindLineBoundary(tmpOffset, eDirNext, eSelectEndLine);
-        *aEndOffset = offset - 1;
-        return GetText(*aStartOffset, *aEndOffset, aText);
-      }
-
-      tmpOffset = FindLineBoundary(offset, eDirPrevious, eSelectLine);
-      *aEndOffset = FindLineBoundary(tmpOffset, eDirNext, eSelectEndLine);
-      tmpOffset = FindLineBoundary(*aEndOffset, eDirPrevious, eSelectLine);
-      *aStartOffset = FindLineBoundary(tmpOffset, eDirNext, eSelectEndLine);
-      if (*aStartOffset == *aEndOffset) // we are at second line
-        *aStartOffset = 0;
-
+      *aEndOffset = FindLineBoundary(offset, ePrevLineEnd);
+      *aStartOffset = FindLineBoundary(*aEndOffset, ePrevLineEnd);
       return GetText(*aStartOffset, *aEndOffset, aText);
-    }
 
     case BOUNDARY_ATTRIBUTE_RANGE:
       return GetTextHelper(eGetBefore, aBoundaryType, aOffset,
@@ -1118,56 +1160,22 @@ HyperTextAccessible::GetTextAtOffset(int32_t aOffset,
       *aStartOffset = FindWordBoundary(*aEndOffset, eDirPrevious, eEndWord);
       return GetText(*aStartOffset, *aEndOffset, aText);
 
-    case BOUNDARY_LINE_START: {
-      // Empty last line doesn't have own frame (a previous line contains '\n'
-      // character instead) thus we can't operate on last line separately
-      // from previous line.
-      if (IsEmptyLastLineOffset(offset)) {
-        *aStartOffset = *aEndOffset = offset;
-        return NS_OK;
-      }
-
+    case BOUNDARY_LINE_START:
       if (aOffset == nsIAccessibleText::TEXT_OFFSET_CARET)
         offset = AdjustCaretOffset(offset);
 
-      // Start offset is begin of the current line (as the home key was
-      // pressed). End offset is begin of the next line if any (arrow down and
-      // home keys), otherwise end of the current line (arrow down only).
-      *aStartOffset = FindLineBoundary(offset, eDirPrevious, eSelectBeginLine);
-      *aEndOffset = FindLineBoundary(offset, eDirNext, eSelectLine);
-      int32_t tmpOffset = FindLineBoundary(*aEndOffset, eDirPrevious, eSelectBeginLine);
-      if (tmpOffset != *aStartOffset)
-        *aEndOffset = tmpOffset;
-
+      *aStartOffset = FindLineBoundary(offset, eThisLineBegin);
+      *aEndOffset = FindLineBoundary(offset, eNextLineBegin);
       return GetText(*aStartOffset, *aEndOffset, aText);
-    }
-
-    case BOUNDARY_LINE_END: {
-      // Empty last line doesn't have own frame (a previous line contains '\n'
-      // character instead) thus we can't operate on last line separately
-      // from the previous line.
-      if (IsEmptyLastLineOffset(offset)) {
-        *aStartOffset = offset - 1;
-        *aEndOffset = offset;
-        aText.AssignLiteral("\n");
-        return NS_OK;
-      }
 
+    case BOUNDARY_LINE_END:
       if (aOffset == nsIAccessibleText::TEXT_OFFSET_CARET)
         offset = AdjustCaretOffset(offset);
 
       // In contrast to word end boundary we follow the spec here.
-      // End offset is end of the current line (as the end key was pressed).
-      // Start offset is end of the previous line if any (up arrow and end keys),
-      // otherwise 0 offset (up arrow only).
-      *aEndOffset = FindLineBoundary(offset, eDirNext, eSelectEndLine);
-      int32_t tmpOffset = FindLineBoundary(offset, eDirPrevious, eSelectLine);
-      *aStartOffset = FindLineBoundary(tmpOffset, eDirNext, eSelectEndLine);
-      if (*aStartOffset == *aEndOffset)
-        *aStartOffset = 0;
-
+      *aStartOffset = FindLineBoundary(offset, ePrevLineEnd);
+      *aEndOffset = FindLineBoundary(offset, eThisLineEnd);
       return GetText(*aStartOffset, *aEndOffset, aText);
-    }
 
     case BOUNDARY_ATTRIBUTE_RANGE:
       return GetTextHelper(eGetAt, aBoundaryType, aOffset,
@@ -1223,36 +1231,16 @@ HyperTextAccessible::GetTextAfterOffset(int32_t aOffset,
       if (aOffset == nsIAccessibleText::TEXT_OFFSET_CARET)
         offset = AdjustCaretOffset(offset);
 
-      // Down arrow, home key, down arrow, home key.
-      *aStartOffset = FindLineBoundary(offset, eDirNext, eSelectLine);
-      if (*aStartOffset != CharacterCount()) {
-        *aStartOffset = FindLineBoundary(*aStartOffset, eDirPrevious, eSelectBeginLine);
-        *aEndOffset = FindLineBoundary(*aStartOffset, eDirNext, eSelectLine);
-        if (*aEndOffset != CharacterCount())
-          *aEndOffset = FindLineBoundary(*aEndOffset, eDirPrevious, eSelectBeginLine);
-      } else {
-        *aEndOffset = CharacterCount();
-      }
+      *aStartOffset = FindLineBoundary(offset, eNextLineBegin);
+      *aEndOffset = FindLineBoundary(*aStartOffset, eNextLineBegin);
       return GetText(*aStartOffset, *aEndOffset, aText);
 
     case BOUNDARY_LINE_END:
       if (aOffset == nsIAccessibleText::TEXT_OFFSET_CARET)
         offset = AdjustCaretOffset(offset);
 
-      // Empty last line doesn't have own frame (a previous line contains '\n'
-      // character instead) thus we can't operate on last line separately
-      // from the previous line.
-      if (IsEmptyLastLineOffset(offset)) {
-        *aStartOffset = *aEndOffset = offset;
-        return NS_OK;
-      }
-
-      // End key, down arrow, end key.
-      *aStartOffset = FindLineBoundary(offset, eDirNext, eSelectEndLine);
-      *aEndOffset = FindLineBoundary(*aStartOffset, eDirNext, eSelectLine);
-      if (*aEndOffset != CharacterCount())
-        *aEndOffset = FindLineBoundary(*aEndOffset, eDirNext, eSelectEndLine);
-
+      *aStartOffset = FindLineBoundary(offset, eThisLineEnd);
+      *aEndOffset = FindLineBoundary(offset, eNextLineEnd);
       return GetText(*aStartOffset, *aEndOffset, aText);
 
     case BOUNDARY_ATTRIBUTE_RANGE:
diff --git a/accessible/src/generic/HyperTextAccessible.h b/accessible/src/generic/HyperTextAccessible.h
index 5f3bcda301ef..ffa7fd1140ce 100644
--- a/accessible/src/generic/HyperTextAccessible.h
+++ b/accessible/src/generic/HyperTextAccessible.h
@@ -302,24 +302,37 @@ protected:
   int32_t FindWordBoundary(int32_t aOffset, nsDirection aDirection,
                            EWordMovementType aWordMovementType)
   {
-    return FindBoundary(aOffset, aDirection, eSelectWord, aWordMovementType);
+    return FindOffset(aOffset, aDirection, eSelectWord, aWordMovementType);
   }
 
   /**
-   * Return an offset of the found line boundary.
+   * Used to get begin/end of previous/this/next line. Note: end of line
+   * is an offset right before '\n' character if any, the offset is right after
+   * '\n' character is begin of line. In case of wrap word breaks these offsets
+   * are equal.
    */
-  int32_t FindLineBoundary(int32_t aOffset, nsDirection aDirection,
-                           nsSelectionAmount aAmount)
-  {
-    return FindBoundary(aOffset, aDirection, aAmount, eDefaultBehavior);
-  }
+  enum EWhichLineBoundary {
+    ePrevLineBegin,
+    ePrevLineEnd,
+    eThisLineBegin,
+    eThisLineEnd,
+    eNextLineBegin,
+    eNextLineEnd
+  };
 
   /**
-   * Return an offset of the found word or line boundary. Helper.
+   * Return an offset for requested line boundary. See constants above.
    */
-  int32_t FindBoundary(int32_t aOffset, nsDirection aDirection,
-                       nsSelectionAmount aAmount,
-                       EWordMovementType aWordMovementType = eDefaultBehavior);
+  int32_t FindLineBoundary(int32_t aOffset,
+                           EWhichLineBoundary aWhichLineBoundary);
+
+  /**
+   * Return an offset corresponding to the given direction and selection amount
+   * relative the given offset. A helper used to find word or line boundaries.
+   */
+  int32_t FindOffset(int32_t aOffset, nsDirection aDirection,
+                     nsSelectionAmount aAmount,
+                     EWordMovementType aWordMovementType = eDefaultBehavior);
 
   /*
    * This does the work for nsIAccessibleText::GetText[At|Before|After]Offset

From c7150bb8cc49b194c1f704332e999b540c2f10b9 Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Tue, 16 Jul 2013 13:33:38 -0400
Subject: [PATCH 02/37] Bug 893501 - Crashfix getting navigator.mozNotification
 from a stale navigator object. r=bz

---
 dom/src/notification/DesktopNotification.h    |  8 +++-
 dom/tests/mochitest/notification/Makefile.in  |  1 +
 .../notification/test_bug893501.html          | 47 +++++++++++++++++++
 3 files changed, 54 insertions(+), 2 deletions(-)
 create mode 100644 dom/tests/mochitest/notification/test_bug893501.html

diff --git a/dom/src/notification/DesktopNotification.h b/dom/src/notification/DesktopNotification.h
index f22d6abf787e..6b0029270a03 100644
--- a/dom/src/notification/DesktopNotification.h
+++ b/dom/src/notification/DesktopNotification.h
@@ -46,10 +46,14 @@ public:
 
   DesktopNotificationCenter(nsPIDOMWindow *aWindow)
   {
+    MOZ_ASSERT(aWindow);
     mOwner = aWindow;
 
-    // Grab the uri of the document
-    mPrincipal = mOwner->GetDoc()->NodePrincipal();
+    nsCOMPtr<nsIScriptObjectPrincipal> sop = do_QueryInterface(aWindow);
+    MOZ_ASSERT(sop);
+
+    mPrincipal = sop->GetPrincipal();
+    MOZ_ASSERT(mPrincipal);
 
     SetIsDOMBinding();
   }
diff --git a/dom/tests/mochitest/notification/Makefile.in b/dom/tests/mochitest/notification/Makefile.in
index 1992c32c3775..1759a603629b 100644
--- a/dom/tests/mochitest/notification/Makefile.in
+++ b/dom/tests/mochitest/notification/Makefile.in
@@ -22,6 +22,7 @@ MOCHITEST_FILES	= \
 		test_leak_windowClose.html \
 		create_notification.html \
 		notification_common.js \
+		test_bug893501.html \
 		$(NULL)
 
 include $(topsrcdir)/config/rules.mk
diff --git a/dom/tests/mochitest/notification/test_bug893501.html b/dom/tests/mochitest/notification/test_bug893501.html
new file mode 100644
index 000000000000..a91ad2c970a5
--- /dev/null
+++ b/dom/tests/mochitest/notification/test_bug893501.html
@@ -0,0 +1,47 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>bug893501 - crash test</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="notification_common.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<div id="foo"></div>
+</div>
+<pre id="test">
+<script type="application/javascript"><!--
+if (is_feature_enabled()) {
+  SimpleTest.waitForExplicitFinish();
+
+  function showNotifications() {
+    ok(navigator.mozNotification, "test for notification.");
+
+    var div = document.getElementById('foo');
+    var frame = document.createElement('iframe');
+    div.appendChild(frame);
+
+    var frameNavigator = frame.contentWindow.navigator;
+    frame.addEventListener("load", n, false);
+    frame.src = "data:text/html,hello world";
+
+    function n()
+    {
+      ok(frameNavigator.mozNotification, "Still alive!");
+      SimpleTest.finish();
+    }
+  }
+
+  setup_notifications(true, false, showNotifications);
+} else {
+  ok(true, "Desktop notifications not enabled.");
+}
+// -->
+</script>
+</pre>
+</body>
+</html>
+

From c58af80dce5ee714bc1821d0dcf34e005262ed76 Mon Sep 17 00:00:00 2001
From: Mihnea Dobrescu-Balaur <mihneadb@gmail.com>
Date: Tue, 16 Jul 2013 09:38:35 -0700
Subject: [PATCH 03/37] Bug 892021 - Add a do_get_tempdir function to head.js.
 r=ted, r=gbrown

---
 .../example/unit/test_do_get_tempdir.js       | 16 ++++
 testing/xpcshell/example/unit/xpcshell.ini    |  1 +
 testing/xpcshell/head.js                      | 17 ++++
 testing/xpcshell/remotexpcshelltests.py       | 12 +++
 testing/xpcshell/runxpcshelltests.py          | 83 +++++++++++--------
 5 files changed, 94 insertions(+), 35 deletions(-)
 create mode 100644 testing/xpcshell/example/unit/test_do_get_tempdir.js

diff --git a/testing/xpcshell/example/unit/test_do_get_tempdir.js b/testing/xpcshell/example/unit/test_do_get_tempdir.js
new file mode 100644
index 000000000000..506a80b2eaec
--- /dev/null
+++ b/testing/xpcshell/example/unit/test_do_get_tempdir.js
@@ -0,0 +1,16 @@
+/* -*- Mode: Java; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et: */
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/* This tests that do_get_tempdir returns a directory that we can write to. */
+
+const Ci = Components.interfaces;
+
+function run_test() {
+  let tmpd = do_get_tempdir();
+  do_check_true(tmpd.exists());
+  tmpd.append("testfile");
+  tmpd.create(Ci.nsIFile.NORMAL_FILE_TYPE, 600);
+  do_check_true(tmpd.exists());
+}
diff --git a/testing/xpcshell/example/unit/xpcshell.ini b/testing/xpcshell/example/unit/xpcshell.ini
index 6a51f336491d..edd2c0446795 100644
--- a/testing/xpcshell/example/unit/xpcshell.ini
+++ b/testing/xpcshell/example/unit/xpcshell.ini
@@ -6,6 +6,7 @@
 head =
 tail =
 
+[test_do_get_tempdir.js]
 [test_execute_soon.js]
 [test_get_file.js]
 [test_get_idle.js]
diff --git a/testing/xpcshell/head.js b/testing/xpcshell/head.js
index ed41443235bd..d0f4afd06a08 100644
--- a/testing/xpcshell/head.js
+++ b/testing/xpcshell/head.js
@@ -917,6 +917,23 @@ function do_register_cleanup(aFunction)
   _cleanupFunctions.push(aFunction);
 }
 
+/**
+ * Returns the directory for a temp dir, which is created by the
+ * test harness. Every test gets its own temp dir.
+ *
+ * @return nsILocalFile of the temporary directory
+ */
+function do_get_tempdir() {
+  let env = Components.classes["@mozilla.org/process/environment;1"]
+                      .getService(Components.interfaces.nsIEnvironment);
+  // the python harness sets this in the environment for us
+  let path = env.get("XPCSHELL_TEST_TEMP_DIR");
+  let file = Components.classes["@mozilla.org/file/local;1"]
+                       .createInstance(Components.interfaces.nsILocalFile);
+  file.initWithPath(path);
+  return file;
+}
+
 /**
  * Registers a directory with the profile service,
  * and return the directory as an nsILocalFile.
diff --git a/testing/xpcshell/remotexpcshelltests.py b/testing/xpcshell/remotexpcshelltests.py
index 2b02e3ed4f29..17267abfab85 100644
--- a/testing/xpcshell/remotexpcshelltests.py
+++ b/testing/xpcshell/remotexpcshelltests.py
@@ -248,6 +248,17 @@ class XPCShellRemote(xpcshell.XPCShellTests, object):
         return ['-e', 'const _TEST_FILE = ["%s"];' %
                  replaceBackSlashes(remoteName)]
 
+    def setupTempDir(self):
+        # make sure the temp dir exists
+        if self.device.dirExists(self.remoteTmpDir):
+            self.device.removeDir(self.remoteTmpDir)
+        self.device.mkDir(self.remoteTmpDir)
+
+        self.env["XPCSHELL_TEST_TEMP_DIR"] = self.remoteTmpDir
+        if self.interactive:
+            self.log.info("TEST-INFO | temp dir is %s" % self.remoteTmpDir)
+        return self.remoteTmpDir
+
     def setupProfileDir(self):
         self.device.removeDir(self.profileDir)
         self.device.mkDir(self.profileDir)
@@ -299,6 +310,7 @@ class XPCShellRemote(xpcshell.XPCShellTests, object):
         self.env["XPCSHELL_TEST_PROFILE_DIR"]=self.profileDir
         self.env["TMPDIR"]=self.remoteTmpDir
         self.env["HOME"]=self.profileDir
+        self.setupTempDir()
         if self.options.setup:
             self.pushWrapper()
 
diff --git a/testing/xpcshell/runxpcshelltests.py b/testing/xpcshell/runxpcshelltests.py
index 43371aea6456..7ef2af471758 100644
--- a/testing/xpcshell/runxpcshelltests.py
+++ b/testing/xpcshell/runxpcshelltests.py
@@ -312,6 +312,13 @@ class XPCShellTests(object):
             self.log.info("TEST-INFO | profile dir is %s" % profileDir)
         return profileDir
 
+    def setupTempDir(self):
+        tempDir = mkdtemp()
+        self.env["XPCSHELL_TEST_TEMP_DIR"] = tempDir
+        if self.interactive:
+            self.log.info("TEST-INFO | temp dir is %s" % tempDir)
+        return tempDir
+
     def setupLeakLogging(self):
         """
           Enable leaks (only) detection to its own log file and set environment variables.
@@ -823,6 +830,39 @@ class XPCShellTests(object):
 
         return self.failCount == 0
 
+    def print_stdout(self, stdout):
+        """Print stdout line-by-line to avoid overflowing buffers."""
+        self.log.info(">>>>>>>")
+        if (stdout):
+            for line in stdout.splitlines():
+                self.log.info(line)
+        self.log.info("<<<<<<<")
+
+    def cleanupDir(self, directory, name, stdout, xunit_result):
+        try:
+            self.removeDir(directory)
+        except Exception:
+            self.log.info("TEST-INFO | Failed to remove directory: %s. Waiting." % directory)
+
+            # We suspect the filesystem may still be making changes. Wait a
+            # little bit and try again.
+            time.sleep(5)
+
+            try:
+                self.removeDir(directory)
+            except Exception:
+                message = "TEST-UNEXPECTED-FAIL | %s | Failed to clean up directory: %s" % (name, sys.exc_info()[1])
+                self.log.error(message)
+                self.print_stdout(stdout)
+                self.print_stdout(traceback.format_exc())
+
+                self.failCount += 1
+                xunit_result["passed"] = False
+                xunit_result["failure"] = {
+                    "type": "TEST-UNEXPECTED-FAIL",
+                    "message": message,
+                    "text": "%s\n%s" % (stdout, traceback.format_exc())
+                }
 
     def run_test(self, test, tests_root_dir=None, app_dir_key=None,
             interactive=False, verbose=False, pStdout=None, pStderr=None,
@@ -871,8 +911,10 @@ class XPCShellTests(object):
         head_files, tail_files = self.getHeadAndTailFiles(test)
         cmdH = self.buildCmdHead(head_files, tail_files, self.xpcsCmd)
 
-        # Create a temp dir that the JS harness can stick a profile in
+        # Create a profile and a temp dir that the JS harness can stick
+        # a profile and temporary data in
         self.profileDir = self.setupProfileDir()
+        self.tempDir = self.setupTempDir()
         self.leakLogFile = self.setupLeakLogging()
 
         # The test file will have to be loaded after the head files.
@@ -917,14 +959,6 @@ class XPCShellTests(object):
             if testTimer:
                 testTimer.cancel()
 
-            def print_stdout(stdout):
-                """Print stdout line-by-line to avoid overflowing buffers."""
-                self.log.info(">>>>>>>")
-                if (stdout):
-                    for line in stdout.splitlines():
-                        self.log.info(line)
-                self.log.info("<<<<<<<")
-
             result = not ((self.getReturnCode(proc) != 0) or
                           # if do_throw or do_check failed
                           (stdout and re.search("^((parent|child): )?TEST-UNEXPECTED-",
@@ -943,7 +977,7 @@ class XPCShellTests(object):
                 message = "%s | %s | test failed (with xpcshell return code: %d), see following log:" % (
                               failureType, name, self.getReturnCode(proc))
                 self.log.error(message)
-                print_stdout(stdout)
+                self.print_stdout(stdout)
                 self.failCount += 1
                 xunit_result["passed"] = False
 
@@ -958,7 +992,7 @@ class XPCShellTests(object):
                 xunit_result["time"] = now - startTime
                 self.log.info("TEST-%s | %s | test passed (time: %.3fms)" % ("PASS" if expected else "KNOWN-FAIL", name, timeTaken))
                 if verbose:
-                    print_stdout(stdout)
+                    self.print_stdout(stdout)
 
                 xunit_result["passed"] = True
 
@@ -996,7 +1030,7 @@ class XPCShellTests(object):
             if proc and self.poll(proc) is None:
                 message = "TEST-UNEXPECTED-FAIL | %s | Process still running after test!" % name
                 self.log.error(message)
-                print_stdout(stdout)
+                self.print_stdout(stdout)
                 self.failCount += 1
                 xunit_result["passed"] = False
                 xunit_result["failure"] = {
@@ -1010,30 +1044,9 @@ class XPCShellTests(object):
             # We don't want to delete the profile when running check-interactive
             # or check-one.
             if self.profileDir and not self.interactive and not self.singleFile:
-                try:
-                    self.removeDir(self.profileDir)
-                except Exception:
-                    self.log.info("TEST-INFO | Failed to remove profile directory. Waiting.")
+                self.cleanupDir(self.profileDir, name, stdout, xunit_result)
 
-                    # We suspect the filesystem may still be making changes. Wait a
-                    # little bit and try again.
-                    time.sleep(5)
-
-                    try:
-                        self.removeDir(self.profileDir)
-                    except Exception:
-                        message = "TEST-UNEXPECTED-FAIL | %s | Failed to clean up the test profile directory: %s" % (name, sys.exc_info()[1])
-                        self.log.error(message)
-                        print_stdout(stdout)
-                        print_stdout(traceback.format_exc())
-
-                        self.failCount += 1
-                        xunit_result["passed"] = False
-                        xunit_result["failure"] = {
-                            "type": "TEST-UNEXPECTED-FAIL",
-                            "message": message,
-                            "text": "%s\n%s" % (stdout, traceback.format_exc())
-                        }
+            self.cleanupDir(self.tempDir, name, stdout, xunit_result)
 
         if gotSIGINT:
             xunit_result["passed"] = False

From e4b77b101d81ade630f1d75cbf6d6a0aab80b88d Mon Sep 17 00:00:00 2001
From: Honza Bambas <honzab.moz@firemni.cz>
Date: Tue, 16 Jul 2013 19:38:15 +0200
Subject: [PATCH 04/37] Bug 892486 - Telemetry for appcache vs http cache page
 load, r=ehsan

---
 netwerk/protocol/http/nsHttpChannel.cpp      | 6 ++++++
 toolkit/components/telemetry/Histograms.json | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index 60af7a572ba6..f2c9f225e8d7 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -2548,6 +2548,12 @@ nsHttpChannel::OpenCacheEntry(bool usingSSL)
         }
     }
 
+    if (mLoadFlags & LOAD_INITIAL_DOCUMENT_URI) {
+        mozilla::Telemetry::Accumulate(
+            Telemetry::HTTP_OFFLINE_CACHE_DOCUMENT_LOAD,
+            !!mApplicationCache);
+    }
+
     nsCOMPtr<nsICacheSession> session;
 
     // If we have an application cache, we check it first.
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index d3518f3a663d..ae4ebee688ac 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -1067,6 +1067,10 @@
     "n_values": 5,
     "description": "HTTP Offline Cache Hit, Reval, Failed-Reval, Miss"
   },
+  "HTTP_OFFLINE_CACHE_DOCUMENT_LOAD": {
+    "kind": "boolean",
+    "description": "Rate of page load from offline cache"
+  },
   "CACHE_DEVICE_SEARCH_2": {
     "kind": "exponential",
     "high": "10000",

From a89a5df94fcbd61e970d94dfa34e69ffc0c508e1 Mon Sep 17 00:00:00 2001
From: Honza Bambas <honzab.moz@firemni.cz>
Date: Tue, 16 Jul 2013 19:38:16 +0200
Subject: [PATCH 05/37] Bug 892488 - Remove "allow cache offline" prompt and
 cache offline by default, r=mcmanus

---
 modules/libpref/src/init/all.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 09ce31833617..d2525d65cfc6 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -61,6 +61,8 @@ pref("browser.cache.disk_cache_ssl",        true);
 pref("browser.cache.check_doc_frequency",   3);
 
 pref("browser.cache.offline.enable",           true);
+// enable offline apps by default, disable prompt
+pref("offline-apps.allow_by_default",          true);
 
 // offline cache capacity in kilobytes
 pref("browser.cache.offline.capacity",         512000);

From f65a36ff8a7aba5d244b2a08dfff011dbff03bf7 Mon Sep 17 00:00:00 2001
From: Drew Willcoxon <adw@mozilla.com>
Date: Fri, 12 Jul 2013 21:03:15 -0700
Subject: [PATCH 06/37] Bug 891169 - Make BackgroundPageThumbs safer when there
 are private windows open. r=markh

---
 .../thumbnails/BackgroundPageThumbs.jsm       | 46 +++++++++++++------
 .../test/browser_thumbnails_background.js     | 38 ++++++++++++++-
 2 files changed, 69 insertions(+), 15 deletions(-)

diff --git a/toolkit/components/thumbnails/BackgroundPageThumbs.jsm b/toolkit/components/thumbnails/BackgroundPageThumbs.jsm
index fcfc3973925d..ff0d27e0ec7e 100644
--- a/toolkit/components/thumbnails/BackgroundPageThumbs.jsm
+++ b/toolkit/components/thumbnails/BackgroundPageThumbs.jsm
@@ -38,17 +38,6 @@ const BackgroundPageThumbs = {
    *                 the queue and started.  Defaults to 30000 (30 seconds).
    */
   capture: function (url, options={}) {
-    if (isPrivateBrowsingActive()) {
-      // There's only one, global private-browsing state shared by all private
-      // windows and the thumbnail browser.  Just as if you log into a site in
-      // one private window you're logged in in all private windows, you're also
-      // logged in in the thumbnail browser.  A crude way to avoid capturing
-      // sites in this situation is to refuse to capture at all when any private
-      // windows are open.  See bug 870179.
-      if (options.onDone)
-        Services.tm.mainThread.dispatch(options.onDone.bind(options, url), 0);
-      return;
-    }
     this._captureQueue = this._captureQueue || [];
     this._capturesByURL = this._capturesByURL || new Map();
     // We want to avoid duplicate captures for the same URL.  If there is an
@@ -239,11 +228,28 @@ Capture.prototype = {
    * @param messageManager  The nsIMessageSender of the thumbnail browser.
    */
   start: function (messageManager) {
-    let timeout = typeof(this.options.timeout) == "number" ? this.options.timeout :
+    // The thumbnail browser uses private browsing mode and therefore shares
+    // browsing state with private windows.  To avoid capturing sites that the
+    // user is logged into in private browsing windows, (1) observe window
+    // openings, and if a private window is opened during capture, discard the
+    // capture when it finishes, and (2) don't start the capture at all if a
+    // private window is open already.
+    Services.ww.registerNotification(this);
+    if (isPrivateBrowsingActive()) {
+      // Captures should always finish asyncly.
+      schedule(() => this._done(null));
+      return;
+    }
+
+    // timeout timer
+    let timeout = typeof(this.options.timeout) == "number" ?
+                  this.options.timeout :
                   DEFAULT_CAPTURE_TIMEOUT;
     this._timeoutTimer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
-    this._timeoutTimer.initWithCallback(this, timeout, Ci.nsITimer.TYPE_ONE_SHOT);
+    this._timeoutTimer.initWithCallback(this, timeout,
+                                        Ci.nsITimer.TYPE_ONE_SHOT);
 
+    // didCapture registration
     this._msgMan = messageManager;
     this._msgMan.sendAsyncMessage("BackgroundPageThumbs:capture",
                                   { id: this.id, url: this.url });
@@ -268,6 +274,7 @@ Capture.prototype = {
       delete this._msgMan;
     }
     delete this.captureCallback;
+    Services.ww.unregisterNotification(this);
   },
 
   // Called when the didCapture message is received.
@@ -283,6 +290,13 @@ Capture.prototype = {
     this._done(null);
   },
 
+  // Called when the window watcher notifies us.
+  observe: function (subj, topic, data) {
+    if (topic == "domwindowopened" &&
+        PrivateBrowsingUtils.isWindowPrivate(subj))
+      this._privateWinOpenedDuringCapture = true;
+  },
+
   _done: function (data) {
     // Note that _done will be called only once, by either receiveMessage or
     // notify, since it calls destroy, which cancels the timeout timer and
@@ -302,7 +316,7 @@ Capture.prototype = {
       }
     }.bind(this);
 
-    if (!data) {
+    if (!data || this._privateWinOpenedDuringCapture) {
       callOnDones();
       return;
     }
@@ -343,3 +357,7 @@ function isPrivateBrowsingActive() {
       return true;
   return false;
 }
+
+function schedule(callback) {
+  Services.tm.mainThread.dispatch(callback, Ci.nsIThread.DISPATCH_NORMAL);
+}
diff --git a/toolkit/components/thumbnails/test/browser_thumbnails_background.js b/toolkit/components/thumbnails/test/browser_thumbnails_background.js
index 8657033f012e..689b0c404b3c 100644
--- a/toolkit/components/thumbnails/test/browser_thumbnails_background.js
+++ b/toolkit/components/thumbnails/test/browser_thumbnails_background.js
@@ -164,6 +164,42 @@ let tests = [
     win.close();
   },
 
+  function openPrivateWindowDuringCapture() {
+    let url = "http://example.com/";
+    let file = fileForURL(url);
+    ok(!file.exists(), "Thumbnail file should not already exist.");
+
+    let deferred = imports.Promise.defer();
+
+    let waitCount = 0;
+    function maybeFinish() {
+      if (++waitCount == 2)
+        deferred.resolve();
+    }
+
+    imports.BackgroundPageThumbs.capture(url, {
+      onDone: function (capturedURL) {
+        is(capturedURL, url, "Captured URL should be URL passed to capture.");
+        ok(!file.exists(),
+           "Thumbnail file should not exist because a private window " +
+           "was opened during the capture.");
+        maybeFinish();
+      },
+    });
+
+    // Opening the private window at this point relies on a couple of
+    // implementation details: (1) The capture will start immediately and
+    // synchronously (since at this point in the test, the service is
+    // initialized and its queue is empty), and (2) when it starts the capture
+    // registers with the window watcher.
+    openPrivateWindow().then(function (win) {
+      win.close();
+      maybeFinish();
+    });
+
+    yield deferred.promise;
+  },
+
   function noCookies() {
     // Visit the test page in the browser and tell it to set a cookie.
     let url = testPageURL({ setGreenCookie: true });
@@ -263,7 +299,7 @@ let tests = [
     imports.BackgroundPageThumbs.capture(url, {onDone: doneCallback});
     imports.BackgroundPageThumbs.capture(url, {onDone: doneCallback});
     yield deferred.promise;
-  }
+  },
 ];
 
 function capture(url, options) {

From f5050ce1787b749475b63ee648e5a6c0bd1beaa1 Mon Sep 17 00:00:00 2001
From: Drew Willcoxon <adw@mozilla.com>
Date: Fri, 12 Jul 2013 21:03:18 -0700
Subject: [PATCH 07/37] Bug 870104 - Add telemetry to BackgroundPageThumbs.
 r=markh,froydnj

---
 toolkit/components/telemetry/Histograms.json  | 40 +++++++++++++++++++
 .../thumbnails/BackgroundPageThumbs.jsm       | 40 +++++++++++++++++++
 .../content/backgroundPageThumbsContent.js    |  8 ++++
 3 files changed, 88 insertions(+)

diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index ae4ebee688ac..f348ac6c6d1a 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -3712,5 +3712,45 @@
     "kind": "enumerated",
     "n_values": 4,
     "description": "Accumulates type of content (mixed, mixed passive, unmixed) per page load"
+  },
+  "FX_THUMBNAILS_BG_QUEUE_SIZE_ON_CAPTURE": {
+    "kind": "exponential",
+    "high": 100,
+    "n_buckets": 15,
+    "extended_statistics_ok": true,
+    "description": "BACKGROUND THUMBNAILS: Size of capture queue when a capture request is received"
+  },
+  "FX_THUMBNAILS_BG_CAPTURE_QUEUE_TIME_MS": {
+    "kind": "exponential",
+    "high": 300000,
+    "n_buckets": 20,
+    "extended_statistics_ok": true,
+    "description": "BACKGROUND THUMBNAILS: Time the capture request spent in the queue before being serviced (ms)"
+  },
+  "FX_THUMBNAILS_BG_CAPTURE_SERVICE_TIME_MS": {
+    "kind": "exponential",
+    "high": 30000,
+    "n_buckets": 20,
+    "extended_statistics_ok": true,
+    "description": "BACKGROUND THUMBNAILS: Time the capture took once it started and successfully completed (ms)"
+  },
+  "FX_THUMBNAILS_BG_CAPTURE_DONE_REASON": {
+    "kind": "enumerated",
+    "n_values": 4,
+    "description": "BACKGROUND THUMBNAILS: Reason the capture completed (see TEL_CAPTURE_DONE_* constants in BackgroundPageThumbs.jsm)"
+  },
+  "FX_THUMBNAILS_BG_CAPTURE_PAGE_LOAD_TIME_MS": {
+    "kind": "exponential",
+    "high": 60000,
+    "n_buckets": 20,
+    "extended_statistics_ok": true,
+    "description": "BACKGROUND THUMBNAILS: Time the capture's page load took (ms)"
+  },
+  "FX_THUMBNAILS_BG_CAPTURE_CANVAS_DRAW_TIME_MS": {
+    "kind": "exponential",
+    "high": 500,
+    "n_buckets": 15,
+    "extended_statistics_ok": true,
+    "description": "BACKGROUND THUMBNAILS: Time it took to draw the capture's window to canvas (ms)"
   }
 }
diff --git a/toolkit/components/thumbnails/BackgroundPageThumbs.jsm b/toolkit/components/thumbnails/BackgroundPageThumbs.jsm
index ff0d27e0ec7e..bb3266cb6a6a 100644
--- a/toolkit/components/thumbnails/BackgroundPageThumbs.jsm
+++ b/toolkit/components/thumbnails/BackgroundPageThumbs.jsm
@@ -10,6 +10,14 @@ const DEFAULT_CAPTURE_TIMEOUT = 30000; // ms
 const DESTROY_BROWSER_TIMEOUT = 60000; // ms
 const FRAME_SCRIPT_URL = "chrome://global/content/backgroundPageThumbsContent.js";
 
+const TELEMETRY_HISTOGRAM_ID_PREFIX = "FX_THUMBNAILS_BG_";
+
+// possible FX_THUMBNAILS_BG_CAPTURE_DONE_REASON telemetry values
+const TEL_CAPTURE_DONE_OK = 0;
+const TEL_CAPTURE_DONE_TIMEOUT = 1;
+const TEL_CAPTURE_DONE_PB_BEFORE_START = 2;
+const TEL_CAPTURE_DONE_PB_AFTER_START = 3;
+
 const XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
 const HTML_NS = "http://www.w3.org/1999/xhtml";
 
@@ -40,6 +48,9 @@ const BackgroundPageThumbs = {
   capture: function (url, options={}) {
     this._captureQueue = this._captureQueue || [];
     this._capturesByURL = this._capturesByURL || new Map();
+
+    tel("QUEUE_SIZE_ON_CAPTURE", this._captureQueue.length);
+
     // We want to avoid duplicate captures for the same URL.  If there is an
     // existing one, we just add the callback to that one and we are done.
     let existing = this._capturesByURL.get(url);
@@ -211,6 +222,7 @@ function Capture(url, captureCallback, options) {
   this.captureCallback = captureCallback;
   this.options = options;
   this.id = Capture.nextID++;
+  this.creationDate = new Date();
   this.doneCallbacks = [];
   if (options.onDone)
     this.doneCallbacks.push(options.onDone);
@@ -228,6 +240,9 @@ Capture.prototype = {
    * @param messageManager  The nsIMessageSender of the thumbnail browser.
    */
   start: function (messageManager) {
+    this.startDate = new Date();
+    tel("CAPTURE_QUEUE_TIME_MS", this.startDate - this.creationDate);
+
     // The thumbnail browser uses private browsing mode and therefore shares
     // browsing state with private windows.  To avoid capturing sites that the
     // user is logged into in private browsing windows, (1) observe window
@@ -236,6 +251,7 @@ Capture.prototype = {
     // private window is open already.
     Services.ww.registerNotification(this);
     if (isPrivateBrowsingActive()) {
+      tel("CAPTURE_DONE_REASON", TEL_CAPTURE_DONE_PB_BEFORE_START);
       // Captures should always finish asyncly.
       schedule(() => this._done(null));
       return;
@@ -279,6 +295,9 @@ Capture.prototype = {
 
   // Called when the didCapture message is received.
   receiveMessage: function (msg) {
+    tel("CAPTURE_DONE_REASON", TEL_CAPTURE_DONE_OK);
+    tel("CAPTURE_SERVICE_TIME_MS", new Date() - this.startDate);
+
     // A different timed-out capture may have finally successfully completed, so
     // discard messages that aren't meant for this capture.
     if (msg.json.id == this.id)
@@ -287,6 +306,7 @@ Capture.prototype = {
 
   // Called when the timeout timer fires.
   notify: function () {
+    tel("CAPTURE_DONE_REASON", TEL_CAPTURE_DONE_TIMEOUT);
     this._done(null);
   },
 
@@ -305,6 +325,13 @@ Capture.prototype = {
     this.captureCallback(this);
     this.destroy();
 
+    if (data && data.telemetry) {
+      // Telemetry is currently disabled in the content process (bug 680508).
+      for (let id in data.telemetry) {
+        tel(id, data.telemetry[id]);
+      }
+    }
+
     let callOnDones = function callOnDonesFn() {
       for (let callback of this.doneCallbacks) {
         try {
@@ -317,6 +344,8 @@ Capture.prototype = {
     }.bind(this);
 
     if (!data || this._privateWinOpenedDuringCapture) {
+      if (this._privateWinOpenedDuringCapture)
+        tel("CAPTURE_DONE_REASON", TEL_CAPTURE_DONE_PB_AFTER_START);
       callOnDones();
       return;
     }
@@ -358,6 +387,17 @@ function isPrivateBrowsingActive() {
   return false;
 }
 
+/**
+ * Adds a value to one of this module's telemetry histograms.
+ *
+ * @param histogramID  This is prefixed with this module's ID.
+ * @param value        The value to add.
+ */
+function tel(histogramID, value) {
+  let id = TELEMETRY_HISTOGRAM_ID_PREFIX + histogramID;
+  Services.telemetry.getHistogramById(id).add(value);
+}
+
 function schedule(callback) {
   Services.tm.mainThread.dispatch(callback, Ci.nsIThread.DISPATCH_NORMAL);
 }
diff --git a/toolkit/components/thumbnails/content/backgroundPageThumbsContent.js b/toolkit/components/thumbnails/content/backgroundPageThumbsContent.js
index 7ef92e500c7a..c40b7316e7ed 100644
--- a/toolkit/components/thumbnails/content/backgroundPageThumbsContent.js
+++ b/toolkit/components/thumbnails/content/backgroundPageThumbsContent.js
@@ -43,11 +43,14 @@ const backgroundPageThumbsContent = {
     this._onLoad = function onLoad(event) {
       if (event.target != content.document)
         return;
+      let pageLoadTime = new Date() - loadDate;
       removeEventListener("load", this._onLoad, true);
       delete this._onLoad;
 
       let canvas = PageThumbs._createCanvas(content);
+      let captureDate = new Date();
       PageThumbs._captureToCanvas(content, canvas);
+      let captureTime = new Date() - captureDate;
 
       let finalURL = this._webNav.currentURI.spec;
       let fileReader = Cc["@mozilla.org/files/filereader;1"].
@@ -57,6 +60,10 @@ const backgroundPageThumbsContent = {
           id: msg.json.id,
           imageData: fileReader.result,
           finalURL: finalURL,
+          telemetry: {
+            CAPTURE_PAGE_LOAD_TIME_MS: pageLoadTime,
+            CAPTURE_CANVAS_DRAW_TIME_MS: captureTime,
+          },
         });
       };
       canvas.toBlob(blob => fileReader.readAsArrayBuffer(blob));
@@ -70,6 +77,7 @@ const backgroundPageThumbsContent = {
     addEventListener("load", this._onLoad, true);
     this._webNav.loadURI(msg.json.url, Ci.nsIWebNavigation.LOAD_FLAGS_NONE,
                          null, null, null);
+    let loadDate = new Date();
   },
 };
 

From 669388cd6b33c6bbd546beb4b8da2105462c7fd3 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 16 Jul 2013 13:42:03 -0400
Subject: [PATCH 08/37] Bug 894463.  Go back to deoptimizing vanilla objects
 and arrays more eagerly to unregress ss-tagcloud.  r=bhackett

---
 js/src/jsinferinlines.h | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index 37b34717b34d..ae0fa8adaf6b 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -970,9 +970,14 @@ TypeScript::MonitorAssign(JSContext *cx, HandleObject obj, jsid id)
         // But if we don't have too many properties yet, don't do anything.  The
         // idea here is that normal object initialization should not trigger
         // deoptimization in most cases, while actual usage as a hashmap should.
+        // Except for vanilla objects and arrays work around bug 894447 for now
+        // by deoptimizing more eagerly.  Since in those cases we often have a
+        // pc-keyed TypeObject, this is ok.
         TypeObject* type = obj->type();
-        if (type->getPropertyCount() < 8)
+        if (!obj->is<JSObject>() && !obj->is<ArrayObject>() &&
+            type->getPropertyCount() < 8) {
             return;
+        }
         MarkTypeObjectUnknownProperties(cx, type);
     }
 }

From c7f7461721539fcbbc0911669738020d4a7f461d Mon Sep 17 00:00:00 2001
From: Mihai Sucan <mihai.sucan@gmail.com>
Date: Tue, 16 Jul 2013 19:21:33 +0300
Subject: [PATCH 09/37] Bug 888407 - Fix for intermittent
 browser_console_iframe_messages.js | Test timed out, failed to match rule:
 iframe 1; r=me

---
 .../test/browser_console_iframe_messages.js   | 116 ++++++++++--------
 browser/devtools/webconsole/test/head.js      |  19 ++-
 2 files changed, 78 insertions(+), 57 deletions(-)

diff --git a/browser/devtools/webconsole/test/browser_console_iframe_messages.js b/browser/devtools/webconsole/test/browser_console_iframe_messages.js
index 3f6ed2db5c43..8131f928bf2c 100644
--- a/browser/devtools/webconsole/test/browser_console_iframe_messages.js
+++ b/browser/devtools/webconsole/test/browser_console_iframe_messages.js
@@ -8,16 +8,56 @@
 
 const TEST_URI = "http://example.com/browser/browser/devtools/webconsole/test/test-consoleiframes.html";
 
+let expectedMessages = [
+  {
+    text: "main file",
+    category: CATEGORY_WEBDEV,
+    severity: SEVERITY_LOG,
+  },
+  {
+    text: "blah",
+    category: CATEGORY_JS,
+    severity: SEVERITY_ERROR
+  },
+  {
+    text: "iframe 2",
+    category: CATEGORY_WEBDEV,
+    severity: SEVERITY_LOG
+  },
+  {
+    text: "iframe 3",
+    category: CATEGORY_WEBDEV,
+    severity: SEVERITY_LOG
+  }
+];
+
+// "iframe 1" console messages can be coalesced into one if they follow each
+// other in the sequence of messages (depending on timing). If they do not, then
+// they will be displayed in the console output independently, as separate
+// messages. This is why we need to match any of the following two rules.
+let expectedMessagesAny = [
+  {
+    name: "iframe 1 (count: 2)",
+    text: "iframe 1",
+    category: CATEGORY_WEBDEV,
+    severity: SEVERITY_LOG,
+    count: 2
+  },
+  {
+    name: "iframe 1 (repeats: 2)",
+    text: "iframe 1",
+    category: CATEGORY_WEBDEV,
+    severity: SEVERITY_LOG,
+    repeats: 2
+  },
+];
+
 function test()
 {
   expectUncaughtException();
   addTab(TEST_URI);
   browser.addEventListener("load", function onLoad() {
     browser.removeEventListener("load", onLoad, true);
-
-    // Test for cached nsIConsoleMessages.
-    Services.console.logStringMessage("test1 for bug859756");
-
     info("open web console");
     openConsole(null, consoleOpened);
   }, true);
@@ -29,31 +69,16 @@ function consoleOpened(hud)
 
   waitForMessages({
     webconsole: hud,
-    messages: [
-      {
-        text: "main file",
-        category: CATEGORY_WEBDEV,
-        severity: SEVERITY_LOG,
-      },
-      {
-        text: "blah",
-        category: CATEGORY_JS,
-        severity: SEVERITY_ERROR
-      },
-      {
-        text: "iframe 1",
-        category: CATEGORY_WEBDEV,
-        severity: SEVERITY_LOG,
-        count: 2
-      },
-      {
-        text: "iframe 2",
-        category: CATEGORY_WEBDEV,
-        severity: SEVERITY_LOG
-      }
-    ],
+    messages: expectedMessages,
   }).then(() => {
-    closeConsole(null, onWebConsoleClose);
+    info("first messages matched");
+    waitForMessages({
+      webconsole: hud,
+      messages: expectedMessagesAny,
+      matchCondition: "any",
+    }).then(() => {
+      closeConsole(null, onWebConsoleClose);
+    });
   });
 }
 
@@ -66,34 +91,17 @@ function onWebConsoleClose()
 function onBrowserConsoleOpen(hud)
 {
   ok(hud, "browser console opened");
-  Services.console.logStringMessage("test2 for bug859756");
-
   waitForMessages({
     webconsole: hud,
-    messages: [
-      {
-        text: "main file",
-        category: CATEGORY_WEBDEV,
-        severity: SEVERITY_LOG,
-      },      
-      {
-        text: "blah",
-        category: CATEGORY_JS,
-        severity: SEVERITY_ERROR
-      },
-      {
-        text: "iframe 1",
-        category: CATEGORY_WEBDEV,
-        severity: SEVERITY_LOG,
-        count: 2
-      },
-      {
-        text: "iframe 2",
-        category: CATEGORY_WEBDEV,
-        severity: SEVERITY_LOG
-      }
-    ],
+    messages: expectedMessages,
   }).then(() => {
-    closeConsole(null, finishTest);
+    info("first messages matched");
+    waitForMessages({
+      webconsole: hud,
+      messages: expectedMessagesAny,
+      matchCondition: "any",
+    }).then(() => {
+      closeConsole(null, finishTest);
+    });
   });
 }
diff --git a/browser/devtools/webconsole/test/head.js b/browser/devtools/webconsole/test/head.js
index b1f5d622ea19..b7f1f4ce2cdc 100644
--- a/browser/devtools/webconsole/test/head.js
+++ b/browser/devtools/webconsole/test/head.js
@@ -855,6 +855,12 @@ function getMessageElementText(aElement)
  * @param object aOptions
  *        Options for what you want to wait for:
  *        - webconsole: the webconsole instance you work with.
+ *        - matchCondition: "any" or "all". Default: "all". The promise
+ *        returned by this function resolves when all of the messages are
+ *        matched, if the |matchCondition| is "all". If you set the condition to
+ *        "any" then the promise is resolved by any message rule that matches,
+ *        irrespective of order - waiting for messages stops whenever any rule
+ *        matches.
  *        - messages: an array of objects that tells which messages to wait for.
  *        Properties:
  *            - text: string or RegExp to match the textContent of each new
@@ -905,6 +911,7 @@ function waitForMessages(aOptions)
   let rulesMatched = 0;
   let listenerAdded = false;
   let deferred = promise.defer();
+  aOptions.matchCondition = aOptions.matchCondition || "all";
 
   function checkText(aRule, aText)
   {
@@ -1154,9 +1161,15 @@ function waitForMessages(aOptions)
     }
   }
 
+  function allRulesMatched()
+  {
+    return aOptions.matchCondition == "all" && rulesMatched == rules.length ||
+           aOptions.matchCondition == "any" && rulesMatched > 0;
+  }
+
   function maybeDone()
   {
-    if (rulesMatched == rules.length) {
+    if (allRulesMatched()) {
       if (listenerAdded) {
         webconsole.ui.off("messages-added", onMessagesAdded);
         webconsole.ui.off("messages-updated", onMessagesAdded);
@@ -1169,7 +1182,7 @@ function waitForMessages(aOptions)
   }
 
   function testCleanup() {
-    if (rulesMatched == rules.length) {
+    if (allRulesMatched()) {
       return;
     }
 
@@ -1198,7 +1211,7 @@ function waitForMessages(aOptions)
 
   executeSoon(() => {
     onMessagesAdded("messages-added", webconsole.outputNode.childNodes);
-    if (rulesMatched != rules.length) {
+    if (!allRulesMatched()) {
       listenerAdded = true;
       registerCleanupFunction(testCleanup);
       webconsole.ui.on("messages-added", onMessagesAdded);

From 7400a62dd5d7a4508f08b7b41961e2747900784c Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Tue, 16 Jul 2013 13:52:01 -0400
Subject: [PATCH 10/37] Bug 877690 - Fix typo in test. DONTBUILD

---
 layout/inspector/tests/test_bug877690.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/inspector/tests/test_bug877690.html b/layout/inspector/tests/test_bug877690.html
index 773ea4f80a2a..6dc3f4b6ba9b 100644
--- a/layout/inspector/tests/test_bug877690.html
+++ b/layout/inspector/tests/test_bug877690.html
@@ -92,7 +92,7 @@ function do_test() {
       "repeat-x", "repeat-y", "fixed", "scroll", "center", "top", "bottom", "left", "right",
       "border-box", "padding-box", "content-box", "border-box", "padding-box", "content-box", "contain",
       "cover" ];
-  ok(testValues(values, expected), "Shorthand proprety values.");
+  ok(testValues(values, expected), "Shorthand property values.");
 
   // test keywords only
   var prop = "border-top";

From 23e86d44d019b306ebe3ee741155f05c4404f90e Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Tue, 16 Jul 2013 08:14:57 -0700
Subject: [PATCH 11/37] Bug 894172 - Eliminate DO_NEXT_OP(len) in favor of an
 unadorned goto the label in question.  This eliminates tautological |len ==
 len| compares that clang+ccache warns about, and it eliminates the previous
 apparent possibility that any value could be passed to DO_NEXT_OP, when in
 fact only |len| (or a value equal to it) could be passed.  r=terrence

--HG--
extra : rebase_source : 0e1561a7bcabc6811fea6b167251046c2871224d
---
 js/src/vm/Interpreter.cpp | 56 ++++++++++++++++++---------------------
 1 file changed, 26 insertions(+), 30 deletions(-)

diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 8746271f15bb..0b83f5a0dad3 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -1288,10 +1288,6 @@ Interpret(JSContext *cx, RunState &state)
     InterruptEnabler interrupts(&switchMask, -1);
 
 # define DO_OP()            goto do_op
-# define DO_NEXT_OP(n)      JS_BEGIN_MACRO                                    \
-                                JS_ASSERT((n) == len);                        \
-                                goto advance_pc;                              \
-                            JS_END_MACRO
 
 # define BEGIN_CASE(OP)     case OP:
 # define END_CASE(OP)       END_CASE_LEN(OP##_LENGTH)
@@ -1300,21 +1296,21 @@ Interpret(JSContext *cx, RunState &state)
 
 /*
  * To share the code for all len == 1 cases we use the specialized label with
- * code that falls through to advance_pc: .
+ * code that falls through to advanceAndDoOp: .
  */
 # define END_CASE_LEN1      goto advance_pc_by_one;
-# define END_CASE_LEN2      len = 2; goto advance_pc;
-# define END_CASE_LEN3      len = 3; goto advance_pc;
-# define END_CASE_LEN4      len = 4; goto advance_pc;
-# define END_CASE_LEN5      len = 5; goto advance_pc;
-# define END_CASE_LEN6      len = 6; goto advance_pc;
-# define END_CASE_LEN7      len = 7; goto advance_pc;
-# define END_CASE_LEN8      len = 8; goto advance_pc;
-# define END_CASE_LEN9      len = 9; goto advance_pc;
-# define END_CASE_LEN10     len = 10; goto advance_pc;
-# define END_CASE_LEN11     len = 11; goto advance_pc;
-# define END_CASE_LEN12     len = 12; goto advance_pc;
-# define END_VARLEN_CASE    goto advance_pc;
+# define END_CASE_LEN2      len = 2; goto advanceAndDoOp;
+# define END_CASE_LEN3      len = 3; goto advanceAndDoOp;
+# define END_CASE_LEN4      len = 4; goto advanceAndDoOp;
+# define END_CASE_LEN5      len = 5; goto advanceAndDoOp;
+# define END_CASE_LEN6      len = 6; goto advanceAndDoOp;
+# define END_CASE_LEN7      len = 7; goto advanceAndDoOp;
+# define END_CASE_LEN8      len = 8; goto advanceAndDoOp;
+# define END_CASE_LEN9      len = 9; goto advanceAndDoOp;
+# define END_CASE_LEN10     len = 10; goto advanceAndDoOp;
+# define END_CASE_LEN11     len = 11; goto advanceAndDoOp;
+# define END_CASE_LEN12     len = 12; goto advanceAndDoOp;
+# define END_VARLEN_CASE    goto advanceAndDoOp;
 # define ADD_EMPTY_CASE(OP) BEGIN_CASE(OP)
 # define END_EMPTY_CASES    goto advance_pc_by_one;
 
@@ -1443,8 +1439,8 @@ Interpret(JSContext *cx, RunState &state)
     /*
      * It is important that "op" be initialized before calling DO_OP because
      * it is possible for "op" to be specially assigned during the normal
-     * processing of an opcode while looping. We rely on DO_NEXT_OP to manage
-     * "op" correctly in all other cases.
+     * processing of an opcode while looping. We rely on |advanceAndDoOp:| to
+     * manage "op" correctly in all other cases.
      */
     JSOp op;
     int32_t len;
@@ -1453,13 +1449,13 @@ Interpret(JSContext *cx, RunState &state)
     if (rt->profilingScripts || cx->runtime()->debugHooks.interruptHook)
         interrupts.enable();
 
-    DO_NEXT_OP(len);
+    goto advanceAndDoOp;
 
     for (;;) {
       advance_pc_by_one:
         JS_ASSERT(js_CodeSpec[op].length == 1);
         len = 1;
-      advance_pc:
+      advanceAndDoOp:
         js::gc::MaybeVerifyBarriers(cx);
         regs.pc += len;
         op = (JSOp) *regs.pc;
@@ -1723,7 +1719,7 @@ BEGIN_CASE(JSOP_STOP)
             TypeScript::Monitor(cx, script, regs.pc, regs.sp[-1]);
 
             len = JSOP_CALL_LENGTH;
-            DO_NEXT_OP(len);
+            goto advanceAndDoOp;
         }
 
         /* Increment pc so that |sp - fp->slots == ReconstructStackDepth(pc)|. */
@@ -1773,7 +1769,7 @@ BEGIN_CASE(JSOP_OR)
     bool cond = ToBooleanOp(regs);
     if (cond == true) {
         len = GET_JUMP_OFFSET(regs.pc);
-        DO_NEXT_OP(len);
+        goto advanceAndDoOp;
     }
 }
 END_CASE(JSOP_OR)
@@ -1783,7 +1779,7 @@ BEGIN_CASE(JSOP_AND)
     bool cond = ToBooleanOp(regs);
     if (cond == false) {
         len = GET_JUMP_OFFSET(regs.pc);
-        DO_NEXT_OP(len);
+        goto advanceAndDoOp;
     }
 }
 END_CASE(JSOP_AND)
@@ -1806,7 +1802,7 @@ END_CASE(JSOP_AND)
                 BRANCH(len);                                                  \
             }                                                                 \
             len = 1 + JSOP_IFEQ_LENGTH;                                       \
-            DO_NEXT_OP(len);                                                  \
+            goto advanceAndDoOp;                                              \
         }                                                                     \
     JS_END_MACRO
 
@@ -2506,7 +2502,7 @@ BEGIN_CASE(JSOP_FUNCALL)
         TypeScript::Monitor(cx, script, regs.pc, newsp[-1]);
         regs.sp = newsp;
         len = JSOP_CALL_LENGTH;
-        DO_NEXT_OP(len);
+        goto advanceAndDoOp;
     }
 
     InitialFrameFlags initial = construct ? INITIAL_CONSTRUCT : INITIAL_NONE;
@@ -2719,7 +2715,7 @@ BEGIN_CASE(JSOP_TABLESWITCH)
         double d;
         /* Don't use mozilla::DoubleIsInt32; treat -0 (double) as 0. */
         if (!rref.isDouble() || (d = rref.toDouble()) != (i = int32_t(rref.toDouble())))
-            DO_NEXT_OP(len);
+            goto advanceAndDoOp;
     }
 
     pc2 += JUMP_OFFSET_LEN;
@@ -3249,7 +3245,7 @@ BEGIN_CASE(JSOP_LEAVEBLOCKEXPR)
     } else {
         /* Another op will pop; nothing to do here. */
         len = JSOP_LEAVEFORLETIN_LENGTH;
-        DO_NEXT_OP(len);
+        goto advanceAndDoOp;
     }
 }
 END_CASE(JSOP_LEAVEBLOCK)
@@ -3361,7 +3357,7 @@ END_CASE(JSOP_ARRAYPUSH)
                  * catch block.
                  */
                 len = 0;
-                DO_NEXT_OP(len);
+                goto advanceAndDoOp;
 
               case JSTRY_FINALLY:
                 /*
@@ -3372,7 +3368,7 @@ END_CASE(JSOP_ARRAYPUSH)
                 PUSH_COPY(cx->getPendingException());
                 cx->clearPendingException();
                 len = 0;
-                DO_NEXT_OP(len);
+                goto advanceAndDoOp;
 
               case JSTRY_ITER: {
                 /* This is similar to JSOP_ENDITER in the interpreter loop. */

From a3eb8d6dbc5556aeea6df05102c1f61153e05927 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Tue, 16 Jul 2013 08:14:57 -0700
Subject: [PATCH 12/37] Bug 894181 - Convert a bunch of SHAPE_* macros to
 inline functions to eliminate warnings, enhance debuggability.  r=terrence

--HG--
extra : rebase_source : 2b8a5ba43a3303470b99788b7637488c38050764
---
 js/src/vm/Shape.h | 64 ++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 50 insertions(+), 14 deletions(-)

diff --git a/js/src/vm/Shape.h b/js/src/vm/Shape.h
index b10a50f50d7a..d506c60470d5 100644
--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -1044,28 +1044,64 @@ struct StackShape
         SkipRoot skip;
         MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
     };
- };
+};
 
 } /* namespace js */
 
 /* js::Shape pointer tag bit indicating a collision. */
 #define SHAPE_COLLISION                 (uintptr_t(1))
-#define SHAPE_REMOVED                   ((Shape *) SHAPE_COLLISION)
+#define SHAPE_REMOVED                   ((js::Shape *) SHAPE_COLLISION)
 
-/* Macros to get and set shape pointer values and collision flags. */
-#define SHAPE_IS_FREE(shape)            ((shape) == NULL)
-#define SHAPE_IS_REMOVED(shape)         ((shape) == SHAPE_REMOVED)
-#define SHAPE_IS_LIVE(shape)            ((shape) > SHAPE_REMOVED)
-#define SHAPE_FLAG_COLLISION(spp,shape) (*(spp) = (Shape *)                  \
-                                         (uintptr_t(shape) | SHAPE_COLLISION))
-#define SHAPE_HAD_COLLISION(shape)      (uintptr_t(shape) & SHAPE_COLLISION)
-#define SHAPE_FETCH(spp)                SHAPE_CLEAR_COLLISION(*(spp))
+/* Functions to get and set shape pointer values and collision flags. */
 
-#define SHAPE_CLEAR_COLLISION(shape)                                          \
-    ((Shape *) (uintptr_t(shape) & ~SHAPE_COLLISION))
+inline bool
+SHAPE_IS_FREE(js::Shape *shape)
+{
+    return shape == NULL;
+}
 
-#define SHAPE_STORE_PRESERVING_COLLISION(spp, shape)                          \
-    (*(spp) = (Shape *) (uintptr_t(shape) | SHAPE_HAD_COLLISION(*(spp))))
+inline bool
+SHAPE_IS_REMOVED(js::Shape *shape)
+{
+    return shape == SHAPE_REMOVED;
+}
+
+inline bool
+SHAPE_IS_LIVE(js::Shape *shape)
+{
+    return shape > SHAPE_REMOVED;
+}
+
+inline void
+SHAPE_FLAG_COLLISION(js::Shape **spp, js::Shape *shape)
+{
+    *spp = reinterpret_cast<js::Shape*>(uintptr_t(shape) | SHAPE_COLLISION);
+}
+
+inline bool
+SHAPE_HAD_COLLISION(js::Shape *shape)
+{
+    return uintptr_t(shape) & SHAPE_COLLISION;
+}
+
+inline js::Shape *
+SHAPE_CLEAR_COLLISION(js::Shape *shape)
+{
+    return reinterpret_cast<js::Shape*>(uintptr_t(shape) & ~SHAPE_COLLISION);
+}
+
+inline js::Shape *
+SHAPE_FETCH(js::Shape **spp)
+{
+    return SHAPE_CLEAR_COLLISION(*spp);
+}
+
+inline void
+SHAPE_STORE_PRESERVING_COLLISION(js::Shape **spp, js::Shape *shape)
+{
+    *spp = reinterpret_cast<js::Shape*>(uintptr_t(shape) |
+                                        SHAPE_HAD_COLLISION(*spp));
+}
 
 namespace js {
 

From bbe05963080729efa1bbbd053fa40da69c0087d1 Mon Sep 17 00:00:00 2001
From: Norbert Lindenberg <mozilladev@lindenbergsoftware.com>
Date: Tue, 16 Jul 2013 10:39:56 -0700
Subject: [PATCH 13/37] Bug 853706 - Backported fix for formatting 0 with
 significant digits from ICU, and add a warning about this backported fix to
 update-icu.sh.  r=jwalden

--HG--
extra : rebase_source : e49fb499f2a193283533a10321a2b8c79edea8ba
---
 intl/icu/source/i18n/decimfmt.cpp | 8 ++++++++
 intl/update-icu.sh                | 9 +++++++++
 2 files changed, 17 insertions(+)

diff --git a/intl/icu/source/i18n/decimfmt.cpp b/intl/icu/source/i18n/decimfmt.cpp
index 8e1cb0b6dbaa..f1cac6ab7642 100644
--- a/intl/icu/source/i18n/decimfmt.cpp
+++ b/intl/icu/source/i18n/decimfmt.cpp
@@ -1714,6 +1714,14 @@ DecimalFormat::subformat(UnicodeString& appendTo,
                 appendTo.append(*grouping);
                 handler.addAttribute(kGroupingSeparatorField, currentLength, appendTo.length());
             }
+        } 
+
+        // This handles the special case of formatting 0. For zero only, we count the 
+        // zero to the left of the decimal point as one signficant digit. Ordinarily we 
+        // do not count any leading 0's as significant. If the number we are formatting 
+        // is not zero, then either sigCount or digits.getCount() will be non-zero. 
+        if (sigCount == 0 && digits.getCount() == 0) { 
+          sigCount = 1; 
         }
 
         // TODO(dlf): this looks like it was a bug, we marked the int field as ending
diff --git a/intl/update-icu.sh b/intl/update-icu.sh
index 5d0f54d79e8c..152a4172ae3d 100755
--- a/intl/update-icu.sh
+++ b/intl/update-icu.sh
@@ -14,6 +14,15 @@
 # and reapply it after running update-icu.sh (additional updates may be needed).
 # If the bug has been addressed, please delete this warning.
 
+# Warning
+# =======
+# The fix for ICU bug 10045 has been individually backported into this tree.
+# If you update ICU to a version that does not have this fix yet, obtain the
+# patch "Backported fix for formatting 0 with significant digits from ICU" from
+# https://bugzilla.mozilla.org/show_bug.cgi?id=853706
+# and reapply it after running update-icu.sh.
+# If you update ICU to a version that has the fix, please delete this warning.
+
 # Usage: update-icu.sh <URL of ICU SVN with release>
 # E.g., for ICU 50.1.1: update-icu.sh http://source.icu-project.org/repos/icu/icu/tags/release-50-1-1/
 

From 364fd0aa666ae576691ff31a6bc5e3c39d4eff7a Mon Sep 17 00:00:00 2001
From: Norbert Lindenberg <mozilladev@lindenbergsoftware.com>
Date: Tue, 16 Jul 2013 10:40:21 -0700
Subject: [PATCH 14/37] Bug 853706 - Enable previously failing conformance
 test.  r=jwalden

--HG--
extra : rebase_source : f855b031368b37a10d819a3913003f8520228a12
---
 js/src/tests/jstests.list | 1 -
 1 file changed, 1 deletion(-)

diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
index bd5eb8f030ae..5485bd6033e9 100644
--- a/js/src/tests/jstests.list
+++ b/js/src/tests/jstests.list
@@ -38,7 +38,6 @@ skip script test262/ch10/10.4/10.4.3/10.4.3-1-106.js # bug 603201
 
 skip script test262/intl402/ch10/10.1/10.1.1_13.js # bug 853704
 skip script test262/intl402/ch10/10.1/10.1.1_19_c.js # bug 853704
-skip script test262/intl402/ch11/11.3/11.3.2_TRP.js # bug 853706
 
 #######################################################################
 # Tests disabled due to jstest limitations wrt imported test262 tests #

From dff3bd52871bd8f421947fbc1f1778db2a77cf43 Mon Sep 17 00:00:00 2001
From: Norbert Lindenberg <mozilladev@lindenbergsoftware.com>
Date: Tue, 16 Jul 2013 10:40:33 -0700
Subject: [PATCH 15/37] Bug 853706 - Added new test case for formatting 0 with
 significant digits.  r=jwalden

--HG--
extra : rebase_source : 359a1afdbe2132ebf135809e3d1c121457c5b595
---
 .../NumberFormat/significantDigitsOfZero.js   | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 js/src/tests/Intl/NumberFormat/significantDigitsOfZero.js

diff --git a/js/src/tests/Intl/NumberFormat/significantDigitsOfZero.js b/js/src/tests/Intl/NumberFormat/significantDigitsOfZero.js
new file mode 100644
index 000000000000..401cb8ec12f0
--- /dev/null
+++ b/js/src/tests/Intl/NumberFormat/significantDigitsOfZero.js
@@ -0,0 +1,39 @@
+// |reftest| skip-if(!this.hasOwnProperty("Intl"))
+// -- test that NumberFormat correctly formats 0 with various numbers of significant digits
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+var testData = [
+    {minimumSignificantDigits: 1, maximumSignificantDigits: 1, expected: "0"},
+    {minimumSignificantDigits: 1, maximumSignificantDigits: 2, expected: "0"},
+    {minimumSignificantDigits: 1, maximumSignificantDigits: 3, expected: "0"},
+    {minimumSignificantDigits: 1, maximumSignificantDigits: 4, expected: "0"},
+    {minimumSignificantDigits: 1, maximumSignificantDigits: 5, expected: "0"},
+    {minimumSignificantDigits: 2, maximumSignificantDigits: 2, expected: "0.0"},
+    {minimumSignificantDigits: 2, maximumSignificantDigits: 3, expected: "0.0"},
+    {minimumSignificantDigits: 2, maximumSignificantDigits: 4, expected: "0.0"},
+    {minimumSignificantDigits: 2, maximumSignificantDigits: 5, expected: "0.0"},
+    {minimumSignificantDigits: 3, maximumSignificantDigits: 3, expected: "0.00"},
+    {minimumSignificantDigits: 3, maximumSignificantDigits: 4, expected: "0.00"},
+    {minimumSignificantDigits: 3, maximumSignificantDigits: 5, expected: "0.00"},
+];
+
+for (var i = 0; i < testData.length; i++) {
+    var min = testData[i].minimumSignificantDigits;
+    var max = testData[i].maximumSignificantDigits;
+    var options = {minimumSignificantDigits: min, maximumSignificantDigits: max};
+    var format = new Intl.NumberFormat("en-US", options);
+    var actual = format.format(0);
+    var expected = testData[i].expected;
+    if (actual !== expected) {
+        throw new Error("Wrong formatted string for 0 with " +
+                        "minimumSignificantDigits " + min +
+                        ", maximumSignificantDigits " + max +
+                        ": expected \"" + expected +
+                        "\", actual \"" + actual + "\"");
+    }
+}
+
+reportCompare(true, true);

From 8bde04eebd1b753f787986eec831f21c664b64dc Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Tue, 16 Jul 2013 11:09:56 -0700
Subject: [PATCH 16/37] Bug 853706 - Fix nits noted in review of a new test. 
 r=me

---
 .../Intl/NumberFormat/significantDigitsOfZero.js  | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/js/src/tests/Intl/NumberFormat/significantDigitsOfZero.js b/js/src/tests/Intl/NumberFormat/significantDigitsOfZero.js
index 401cb8ec12f0..f2cd77cda359 100644
--- a/js/src/tests/Intl/NumberFormat/significantDigitsOfZero.js
+++ b/js/src/tests/Intl/NumberFormat/significantDigitsOfZero.js
@@ -25,15 +25,12 @@ for (var i = 0; i < testData.length; i++) {
     var max = testData[i].maximumSignificantDigits;
     var options = {minimumSignificantDigits: min, maximumSignificantDigits: max};
     var format = new Intl.NumberFormat("en-US", options);
-    var actual = format.format(0);
-    var expected = testData[i].expected;
-    if (actual !== expected) {
-        throw new Error("Wrong formatted string for 0 with " +
-                        "minimumSignificantDigits " + min +
-                        ", maximumSignificantDigits " + max +
-                        ": expected \"" + expected +
-                        "\", actual \"" + actual + "\"");
-    }
+    assertEq(format.format(0), testData[i].expected,
+             "Wrong formatted string for 0 with " +
+             "minimumSignificantDigits " + min +
+             ", maximumSignificantDigits " + max +
+             ": expected \"" + expected +
+             "\", actual \"" + actual + "\"");
 }
 
 reportCompare(true, true);

From 8a5c98103a27f44fd6d170e9dfda6600dfafe913 Mon Sep 17 00:00:00 2001
From: Neil Rashbrook <neil@parkwaycc.co.uk>
Date: Tue, 16 Jul 2013 19:15:15 +0100
Subject: [PATCH 17/37] Bug 879838 dblclick event sometimes has incorrect
 explicitOriginalTarget r=smaug

---
 content/events/src/nsEventStateManager.cpp    |  7 ++--
 content/events/test/Makefile.in               |  1 +
 ...est_dblclick_explicit_original_target.html | 33 +++++++++++++++++++
 3 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 content/events/test/test_dblclick_explicit_original_target.html

diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
index 29d0b0d4ac9c..0ed1a4d8ab90 100644
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -4567,7 +4567,10 @@ nsEventStateManager::CheckForAndDispatchClick(nsPresContext* aPresContext,
       if (!mouseContent && !mCurrentTarget) {
         return NS_OK;
       }
-      ret = presShell->HandleEventWithTarget(&event, mCurrentTarget,
+
+      // HandleEvent clears out mCurrentTarget which we might need again
+      nsWeakFrame currentTarget = mCurrentTarget;
+      ret = presShell->HandleEventWithTarget(&event, currentTarget,
                                              mouseContent, aStatus);
       if (NS_SUCCEEDED(ret) && aEvent->clickCount == 2) {
         //fire double click
@@ -4581,7 +4584,7 @@ nsEventStateManager::CheckForAndDispatchClick(nsPresContext* aPresContext,
         event2.button = aEvent->button;
         event2.inputSource = aEvent->inputSource;
 
-        ret = presShell->HandleEventWithTarget(&event2, mCurrentTarget,
+        ret = presShell->HandleEventWithTarget(&event2, currentTarget,
                                                mouseContent, aStatus);
       }
     }
diff --git a/content/events/test/Makefile.in b/content/events/test/Makefile.in
index 66725c5bf3ab..f1fbc4f0cb62 100644
--- a/content/events/test/Makefile.in
+++ b/content/events/test/Makefile.in
@@ -104,6 +104,7 @@ MOCHITEST_FILES = \
 		test_focus_disabled.html \
 		test_bug847597.html \
 		test_bug855741.html \
+		test_dblclick_explicit_original_target.html \
 		$(NULL)
 
 ifeq (,$(filter gonk,$(MOZ_WIDGET_TOOLKIT)))
diff --git a/content/events/test/test_dblclick_explicit_original_target.html b/content/events/test/test_dblclick_explicit_original_target.html
new file mode 100644
index 000000000000..8aa5f5d4c794
--- /dev/null
+++ b/content/events/test/test_dblclick_explicit_original_target.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test explicit original target of dblclick event</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<p id="display">Test explicit original target of dblclick event</p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+SimpleTest.waitForExplicitFinish();
+SimpleTest.waitForFocus(runTests);
+
+function runTests()
+{
+  synthesizeMouse(document.getElementById("display"), 5, 5, { clickCount: 2 });
+}
+
+window.ondblclick = function(event) {
+  is(event.explicitOriginalTarget.nodeType, Node.TEXT_NODE, "explicitOriginalTarget is a text node");
+  SimpleTest.finish();
+}
+
+</script>
+</pre>
+</body>
+</html>

From fec370813924b6ceae69f775a76684f5b2492c7b Mon Sep 17 00:00:00 2001
From: Norbert Lindenberg <mozilladev@lindenbergsoftware.com>
Date: Tue, 16 Jul 2013 11:22:57 -0700
Subject: [PATCH 18/37] Bug 853706 - Fixed a test case that depended on
 incorrect number of significant digits for 0.  r=jwalden

--HG--
extra : rebase_source : a0789030f25b4541d7c3262200f840bda8f10e52
---
 js/src/tests/Intl/NumberFormat/format.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/tests/Intl/NumberFormat/format.js b/js/src/tests/Intl/NumberFormat/format.js
index 108adbb9dcec..32b51adc0edd 100644
--- a/js/src/tests/Intl/NumberFormat/format.js
+++ b/js/src/tests/Intl/NumberFormat/format.js
@@ -40,7 +40,7 @@ format = new Intl.NumberFormat("th-th-u-nu-thai",
                                {style: "percent",
                                 minimumSignificantDigits: 2,
                                 maximumSignificantDigits: 2});
-assertEq(format.format(0), "๐.๐๐%");
+assertEq(format.format(0), "๐.๐%");
 assertEq(format.format(-0.01), "-๑.๐%");
 assertEq(format.format(1.10), "๑๑๐%");
 

From d0cd3efbcf939ec8b93073441a51c093a61533b5 Mon Sep 17 00:00:00 2001
From: Randell Jesup <rjesup@jesup.org>
Date: Tue, 16 Jul 2013 14:33:37 -0400
Subject: [PATCH 19/37] Bug 892441: Actually use the new names for
 createDataChannel r=smaug

---
 dom/media/PeerConnection.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/dom/media/PeerConnection.js b/dom/media/PeerConnection.js
index d002e7eb1c38..8815c6576f42 100644
--- a/dom/media/PeerConnection.js
+++ b/dom/media/PeerConnection.js
@@ -849,8 +849,8 @@ RTCPeerConnection.prototype = {
     }
 
     if (dict.maxRetransmitTime != undefined &&
-        dict.maxRetransmitNum != undefined) {
-      throw new Components.Exception("Both maxRetransmitTime and maxRetransmitNum cannot be provided");
+        dict.maxRetransmits != undefined) {
+      throw new Components.Exception("Both maxRetransmitTime and maxRetransmits cannot be provided");
     }
     let protocol;
     if (dict.protocol == undefined) {
@@ -863,7 +863,7 @@ RTCPeerConnection.prototype = {
     let type;
     if (dict.maxRetransmitTime != undefined) {
       type = Ci.IPeerConnection.kDataChannelPartialReliableTimed;
-    } else if (dict.maxRetransmitNum != undefined) {
+    } else if (dict.maxRetransmits != undefined) {
       type = Ci.IPeerConnection.kDataChannelPartialReliableRexmit;
     } else {
       type = Ci.IPeerConnection.kDataChannelReliable;
@@ -871,9 +871,9 @@ RTCPeerConnection.prototype = {
 
     // Synchronous since it doesn't block.
     let channel = this._getPC().createDataChannel(
-      label, protocol, type, dict.outOfOrderAllowed, dict.maxRetransmitTime,
-      dict.maxRetransmitNum, dict.preset ? true : false,
-      dict.stream != undefined ? dict.stream : 0xFFFF
+      label, protocol, type, !dict.ordered, dict.maxRetransmitTime,
+      dict.maxRetransmits, dict.negotiated ? true : false,
+      dict.id != undefined ? dict.id : 0xFFFF
     );
     return channel;
   },

From 93dfb0d942b571eb7a835c61ff8f78767a6361cc Mon Sep 17 00:00:00 2001
From: Eitan Isaacson <eitan@monotonous.org>
Date: Tue, 16 Jul 2013 11:45:17 -0700
Subject: [PATCH 20/37] Bug 893153 - Virtual cursor control refactor, fixes
 navigating in hidden frames. r=davidb r=maxli

---
 accessible/src/jsat/AccessFu.jsm      |  31 ++--
 accessible/src/jsat/Utils.jsm         |   3 +-
 accessible/src/jsat/content-script.js | 218 +++++++++++++++-----------
 3 files changed, 150 insertions(+), 102 deletions(-)

diff --git a/accessible/src/jsat/AccessFu.jsm b/accessible/src/jsat/AccessFu.jsm
index a17283e1c989..10f740af2de2 100644
--- a/accessible/src/jsat/AccessFu.jsm
+++ b/accessible/src/jsat/AccessFu.jsm
@@ -274,9 +274,7 @@ this.AccessFu = {
       case 'Accessibility:Focus':
         this._focused = JSON.parse(aData);
         if (this._focused) {
-          let mm = Utils.getMessageManager(Utils.CurrentBrowser);
-          mm.sendAsyncMessage('AccessFu:VirtualCursor',
-                              {action: 'whereIsIt', move: true});
+          this.showCurrent(true);
         }
         break;
       case 'Accessibility:MoveCaret':
@@ -327,20 +325,24 @@ this.AccessFu = {
       case 'TabSelect':
       {
         if (this._focused) {
-          let mm = Utils.getMessageManager(Utils.CurrentBrowser);
           // We delay this for half a second so the awesomebar could close,
           // and we could use the current coordinates for the content item.
           // XXX TODO figure out how to avoid magic wait here.
           Utils.win.setTimeout(
             function () {
-              mm.sendAsyncMessage('AccessFu:VirtualCursor', {action: 'whereIsIt'});
-            }, 500);
+              this.showCurrent(false);
+            }.bind(this), 500);
         }
         break;
       }
     }
   },
 
+  showCurrent: function showCurrent(aMove) {
+    let mm = Utils.getMessageManager(Utils.CurrentBrowser);
+    mm.sendAsyncMessage('AccessFu:ShowCurrent', { move: aMove });
+  },
+
   announce: function announce(aAnnouncement) {
     this._output(Presentation.announce(aAnnouncement),
                  Utils.CurrentBrowser);
@@ -632,8 +634,7 @@ var Input = {
     switch (gestureName) {
       case 'dwell1':
       case 'explore1':
-        this.moveCursor('moveToPoint', 'SimpleTouch', 'gesture',
-                        aGesture.x, aGesture.y);
+        this.moveToPoint('SimpleTouch', aGesture.x, aGesture.y);
         break;
       case 'doubletap1':
         this.activateCurrent();
@@ -754,12 +755,18 @@ var Input = {
     aEvent.stopPropagation();
   },
 
-  moveCursor: function moveCursor(aAction, aRule, aInputType, aX, aY) {
+  moveToPoint: function moveToPoint(aRule, aX, aY) {
     let mm = Utils.getMessageManager(Utils.CurrentBrowser);
-    mm.sendAsyncMessage('AccessFu:VirtualCursor',
+    mm.sendAsyncMessage('AccessFu:MoveToPoint', {rule: aRule,
+                                                 x: aX, y: aY,
+                                                 origin: 'top'});
+  },
+
+  moveCursor: function moveCursor(aAction, aRule, aInputType) {
+    let mm = Utils.getMessageManager(Utils.CurrentBrowser);
+    mm.sendAsyncMessage('AccessFu:MoveCursor',
                         {action: aAction, rule: aRule,
-                         x: aX, y: aY, origin: 'top',
-                         inputType: aInputType});
+                         origin: 'top', inputType: aInputType});
   },
 
   moveCaret: function moveCaret(aDetails) {
diff --git a/accessible/src/jsat/Utils.jsm b/accessible/src/jsat/Utils.jsm
index 257a2e394c94..b9a924963dbe 100644
--- a/accessible/src/jsat/Utils.jsm
+++ b/accessible/src/jsat/Utils.jsm
@@ -234,7 +234,8 @@ this.Utils = {
 
   inHiddenSubtree: function inHiddenSubtree(aAccessible) {
     for (let acc=aAccessible; acc; acc=acc.parent) {
-      if (JSON.parse(Utils.getAttributes(acc).hidden)) {
+      let hidden = Utils.getAttributes(acc).hidden;
+      if (hidden && JSON.parse(hidden)) {
         return true;
       }
     }
diff --git a/accessible/src/jsat/content-script.js b/accessible/src/jsat/content-script.js
index 34f53f315957..f1bcf76e7d12 100644
--- a/accessible/src/jsat/content-script.js
+++ b/accessible/src/jsat/content-script.js
@@ -26,100 +26,136 @@ Logger.debug('content-script.js');
 
 let eventManager = null;
 
-function virtualCursorControl(aMessage) {
-  if (Logger.logLevel >= Logger.DEBUG)
-    Logger.debug(aMessage.name, JSON.stringify(aMessage.json));
+function moveCursor(aMessage) {
+  if (Logger.logLevel >= Logger.DEBUG) {
+    Logger.debug(aMessage.name, JSON.stringify(aMessage.json, null, ' '));
+  }
 
-  try {
-    let vc = Utils.getVirtualCursor(content.document);
-    let origin = aMessage.json.origin;
-    if (origin != 'child') {
-      if (forwardMessage(vc, aMessage))
-        return;
-    }
+  let vc = Utils.getVirtualCursor(content.document);
+  let origin = aMessage.json.origin;
+  let action = aMessage.json.action;
+  let rule = TraversalRules[aMessage.json.rule];
 
-    let details = aMessage.json;
-    let rule = TraversalRules[details.rule];
-    let moved = 0;
-    switch (details.action) {
-    case 'moveFirst':
-    case 'moveLast':
-      moved = vc[details.action](rule);
-      break;
-    case 'moveNext':
-    case 'movePrevious':
-      try {
-        if (origin == 'parent' && vc.position == null) {
-          if (details.action == 'moveNext')
-            moved = vc.moveFirst(rule);
-          else
-            moved = vc.moveLast(rule);
-        } else {
-          moved = vc[details.action](rule);
+  function moveCursorInner() {
+    try {
+      if (origin == 'parent' &&
+          !Utils.isAliveAndVisible(vc.position)) {
+        // We have a bad position in this frame, move vc to last or first item.
+        if (action == 'moveNext') {
+          return vc.moveFirst(rule);
+        } else if (action == 'movePrevious') {
+          return vc.moveLast(rule);
         }
-      } catch (x) {
+      }
+
+      return vc[action](rule);
+    } catch (x) {
+      if (action == 'moveNext' || action == 'movePrevious') {
+        // If we are trying to move next/prev put the vc on the focused item.
         let acc = Utils.AccRetrieval.
           getAccessibleFor(content.document.activeElement);
-        moved = vc.moveNext(rule, acc, true);
+        return vc.moveNext(rule, acc, true);
+      } else {
+        throw x;
       }
-      break;
-    case 'moveToPoint':
-      if (!this._ppcp) {
-        this._ppcp = Utils.getPixelsPerCSSPixel(content);
-      }
-      moved = vc.moveToPoint(rule,
-                             details.x * this._ppcp, details.y * this._ppcp,
-                             true);
-      break;
-    case 'whereIsIt':
-      if (!forwardMessage(vc, aMessage)) {
-        if (!vc.position && aMessage.json.move)
-          vc.moveFirst(TraversalRules.Simple);
-        else {
-          sendAsyncMessage('AccessFu:Present', Presentation.pivotChanged(
-            vc.position, null, Ci.nsIAccessiblePivot.REASON_NONE));
-        }
-      }
-
-      break;
-    default:
-      break;
     }
 
-    if (moved == true) {
-      forwardMessage(vc, aMessage);
-    } else if (moved == false && details.action != 'moveToPoint') {
+    return false;
+  }
+
+  try {
+    if (origin != 'child' &&
+        forwardToChild(aMessage, moveCursor, vc.position)) {
+      // We successfully forwarded the move to the child document.
+      return;
+    }
+
+    if (moveCursorInner()) {
+      // If we moved, try forwarding the message to the new position,
+      // it may be a frame with a vc of its own.
+      forwardToChild(aMessage, moveCursor, vc.position);
+    } else {
+      // If we did not move, we probably reached the end or start of the
+      // document, go back to parent content and move us out of the iframe.
       if (origin == 'parent') {
         vc.position = null;
       }
-      aMessage.json.origin = 'child';
-      sendAsyncMessage('AccessFu:VirtualCursor', aMessage.json);
+      forwardToParent(aMessage);
     }
   } catch (x) {
-    Logger.logException(x, 'Failed to move virtual cursor');
+    Logger.logException(x, 'Cursor move failed');
   }
 }
 
-function forwardMessage(aVirtualCursor, aMessage) {
-  try {
-    let acc = aVirtualCursor.position;
-    if (acc && acc.role == ROLE_INTERNAL_FRAME) {
-      let mm = Utils.getMessageManager(acc.DOMNode);
-      mm.addMessageListener(aMessage.name, virtualCursorControl);
-      aMessage.json.origin = 'parent';
-      if (Utils.isContentProcess) {
-        // XXX: OOP content's screen offset is 0,
-        // so we remove the real screen offset here.
-        aMessage.json.x -= content.mozInnerScreenX;
-        aMessage.json.y -= content.mozInnerScreenY;
-      }
-      mm.sendAsyncMessage(aMessage.name, aMessage.json);
-      return true;
-    }
-  } catch (x) {
-    // Frame may be hidden, we regard this case as false.
+function moveToPoint(aMessage) {
+  if (Logger.logLevel >= Logger.DEBUG) {
+    Logger.debug(aMessage.name, JSON.stringify(aMessage.json, null, ' '));
   }
-  return false;
+
+  let vc = Utils.getVirtualCursor(content.document);
+  let details = aMessage.json;
+  let rule = TraversalRules[details.rule];
+
+  try {
+    if (!this._ppcp) {
+      this._ppcp = Utils.getPixelsPerCSSPixel(content);
+    }
+    vc.moveToPoint(rule, details.x * this._ppcp, details.y * this._ppcp, true);
+    forwardToChild(aMessage, moveToPoint, vc.position);
+  } catch (x) {
+    Logger.logException(x, 'Failed move to point');
+  }
+}
+
+function showCurrent(aMessage) {
+  if (Logger.logLevel >= Logger.DEBUG) {
+    Logger.debug(aMessage.name, JSON.stringify(aMessage.json, null, ' '));
+  }
+
+  let vc = Utils.getVirtualCursor(content.document);
+
+  if (!forwardToChild(vc, showCurrent, aMessage)) {
+    if (!vc.position && aMessage.json.move) {
+      vc.moveFirst(TraversalRules.Simple);
+    } else {
+      sendAsyncMessage('AccessFu:Present', Presentation.pivotChanged(
+                         vc.position, null, Ci.nsIAccessiblePivot.REASON_NONE));
+    }
+  }
+}
+
+function forwardToParent(aMessage) {
+  // XXX: This is a silly way to make a deep copy
+  let newJSON = JSON.parse(JSON.stringify(aMessage.json));
+  newJSON.origin = 'child';
+  sendAsyncMessage(aMessage.name, newJSON);
+}
+
+function forwardToChild(aMessage, aListener, aVCPosition) {
+  let acc = aVCPosition || Utils.getVirtualCursor(content.document).position;
+
+  if (!Utils.isAliveAndVisible(acc) || acc.role != ROLE_INTERNAL_FRAME) {
+    return false;
+  }
+
+  if (Logger.logLevel >= Logger.DEBUG) {
+    Logger.debug('forwardToChild', Logger.accessibleToString(acc),
+                 aMessage.name, JSON.stringify(aMessage.json, null, '  '));
+  }
+
+  let mm = Utils.getMessageManager(acc.DOMNode);
+  mm.addMessageListener(aMessage.name, aListener);
+  // XXX: This is a silly way to make a deep copy
+  let newJSON = JSON.parse(JSON.stringify(aMessage.json));
+  newJSON.origin = 'parent';
+  if (Utils.isContentProcess) {
+    // XXX: OOP content's screen offset is 0,
+    // so we remove the real screen offset here.
+    newJSON.x -= content.mozInnerScreenX;
+    newJSON.y -= content.mozInnerScreenY;
+  }
+  mm.sendAsyncMessage(aMessage.name, newJSON);
+  return true;
 }
 
 function activateCurrent(aMessage) {
@@ -174,9 +210,10 @@ function activateCurrent(aMessage) {
     return;
   }
 
-  let vc = Utils.getVirtualCursor(content.document);
-  if (!forwardMessage(vc, aMessage))
-    activateAccessible(vc.position);
+  let position = Utils.getVirtualCursor(content.document).position;
+  if (!forwardToChild(aMessage, activateCurrent, position)) {
+    activateAccessible(position);
+  }
 }
 
 function activateContextMenu(aMessage) {
@@ -188,9 +225,9 @@ function activateContextMenu(aMessage) {
     sendAsyncMessage('AccessFu:ActivateContextMenu', {x: x, y: y});
   }
 
-  let vc = Utils.getVirtualCursor(content.document);
-  if (!forwardMessage(vc, aMessage))
+  if (!forwardToChild(aMessage, activateContextMenu, vc.position)) {
     sendContextMenuCoordinates(vc.position);
+  }
 }
 
 function moveCaret(aMessage) {
@@ -315,15 +352,14 @@ function scroll(aMessage) {
     return false;
   }
 
-  if (aMessage.json.origin != 'child') {
-    if (forwardMessage(vc, aMessage))
-      return;
+  if (aMessage.json.origin != 'child' &&
+      forwardToChild(aMessage, scroll, vc.position)) {
+    return;
   }
 
   if (!tryToScroll()) {
     // Failed to scroll anything in this document. Try in parent document.
-    aMessage.json.origin = 'child';
-    sendAsyncMessage('AccessFu:Scroll', aMessage.json);
+    forwardToParent(aMessage);
   }
 }
 
@@ -334,7 +370,9 @@ addMessageListener(
     if (m.json.buildApp)
       Utils.MozBuildApp = m.json.buildApp;
 
-    addMessageListener('AccessFu:VirtualCursor', virtualCursorControl);
+    addMessageListener('AccessFu:MoveToPoint', moveToPoint);
+    addMessageListener('AccessFu:MoveCursor', moveCursor);
+    addMessageListener('AccessFu:ShowCurrent', showCurrent);
     addMessageListener('AccessFu:Activate', activateCurrent);
     addMessageListener('AccessFu:ContextMenu', activateContextMenu);
     addMessageListener('AccessFu:Scroll', scroll);
@@ -351,7 +389,9 @@ addMessageListener(
   function(m) {
     Logger.debug('AccessFu:Stop');
 
-    removeMessageListener('AccessFu:VirtualCursor', virtualCursorControl);
+    removeMessageListener('AccessFu:MoveToPoint', moveToPoint);
+    removeMessageListener('AccessFu:MoveCursor', moveCursor);
+    removeMessageListener('AccessFu:ShowCurrent', showCurrent);
     removeMessageListener('AccessFu:Activate', activateCurrent);
     removeMessageListener('AccessFu:ContextMenu', activateContextMenu);
     removeMessageListener('AccessFu:Scroll', scroll);

From 5457dd1ce5e9f4a720d16c294370edba8162b569 Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Tue, 16 Jul 2013 15:15:19 -0400
Subject: [PATCH 21/37] Backed out changeset 6c89df01905f (bug 893501) for
 Android mochitest-7 orange.

---
 dom/src/notification/DesktopNotification.h    |  8 +---
 dom/tests/mochitest/notification/Makefile.in  |  1 -
 .../notification/test_bug893501.html          | 47 -------------------
 3 files changed, 2 insertions(+), 54 deletions(-)
 delete mode 100644 dom/tests/mochitest/notification/test_bug893501.html

diff --git a/dom/src/notification/DesktopNotification.h b/dom/src/notification/DesktopNotification.h
index 6b0029270a03..f22d6abf787e 100644
--- a/dom/src/notification/DesktopNotification.h
+++ b/dom/src/notification/DesktopNotification.h
@@ -46,14 +46,10 @@ public:
 
   DesktopNotificationCenter(nsPIDOMWindow *aWindow)
   {
-    MOZ_ASSERT(aWindow);
     mOwner = aWindow;
 
-    nsCOMPtr<nsIScriptObjectPrincipal> sop = do_QueryInterface(aWindow);
-    MOZ_ASSERT(sop);
-
-    mPrincipal = sop->GetPrincipal();
-    MOZ_ASSERT(mPrincipal);
+    // Grab the uri of the document
+    mPrincipal = mOwner->GetDoc()->NodePrincipal();
 
     SetIsDOMBinding();
   }
diff --git a/dom/tests/mochitest/notification/Makefile.in b/dom/tests/mochitest/notification/Makefile.in
index 1759a603629b..1992c32c3775 100644
--- a/dom/tests/mochitest/notification/Makefile.in
+++ b/dom/tests/mochitest/notification/Makefile.in
@@ -22,7 +22,6 @@ MOCHITEST_FILES	= \
 		test_leak_windowClose.html \
 		create_notification.html \
 		notification_common.js \
-		test_bug893501.html \
 		$(NULL)
 
 include $(topsrcdir)/config/rules.mk
diff --git a/dom/tests/mochitest/notification/test_bug893501.html b/dom/tests/mochitest/notification/test_bug893501.html
deleted file mode 100644
index a91ad2c970a5..000000000000
--- a/dom/tests/mochitest/notification/test_bug893501.html
+++ /dev/null
@@ -1,47 +0,0 @@
-<!--
-  Any copyright is dedicated to the Public Domain.
-  http://creativecommons.org/publicdomain/zero/1.0/
--->
-<html>
-<head>
-  <title>bug893501 - crash test</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="text/javascript" src="notification_common.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<div id="foo"></div>
-</div>
-<pre id="test">
-<script type="application/javascript"><!--
-if (is_feature_enabled()) {
-  SimpleTest.waitForExplicitFinish();
-
-  function showNotifications() {
-    ok(navigator.mozNotification, "test for notification.");
-
-    var div = document.getElementById('foo');
-    var frame = document.createElement('iframe');
-    div.appendChild(frame);
-
-    var frameNavigator = frame.contentWindow.navigator;
-    frame.addEventListener("load", n, false);
-    frame.src = "data:text/html,hello world";
-
-    function n()
-    {
-      ok(frameNavigator.mozNotification, "Still alive!");
-      SimpleTest.finish();
-    }
-  }
-
-  setup_notifications(true, false, showNotifications);
-} else {
-  ok(true, "Desktop notifications not enabled.");
-}
-// -->
-</script>
-</pre>
-</body>
-</html>
-

From d3c4f1adc3ec249e53eaa788e7e7a5093d30e782 Mon Sep 17 00:00:00 2001
From: Honza Bambas <honzab.moz@firemni.cz>
Date: Tue, 16 Jul 2013 21:16:49 +0200
Subject: [PATCH 22/37] Backout bug 892488 since there are tests that needs the
 prompt

---
 modules/libpref/src/init/all.js | 2 --
 1 file changed, 2 deletions(-)

diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index d2525d65cfc6..09ce31833617 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -61,8 +61,6 @@ pref("browser.cache.disk_cache_ssl",        true);
 pref("browser.cache.check_doc_frequency",   3);
 
 pref("browser.cache.offline.enable",           true);
-// enable offline apps by default, disable prompt
-pref("offline-apps.allow_by_default",          true);
 
 // offline cache capacity in kilobytes
 pref("browser.cache.offline.capacity",         512000);

From 6eaf1fae9e35b859373b9a739673715dfb6715be Mon Sep 17 00:00:00 2001
From: Till Schneidereit <till@tillschneidereit.net>
Date: Tue, 16 Jul 2013 20:42:44 +0200
Subject: [PATCH 23/37] Bug 827396 - rm TypeObject::CONTRIBUTION_LIMIT and
 TypeObject::contribution. r=bhackett

--HG--
extra : rebase_source : c564216435bafeea58c0bfb32bdae07a3587fa72
---
 js/src/jsinfer.cpp      |  6 ------
 js/src/jsinfer.h        | 20 +++++---------------
 js/src/jsinferinlines.h |  8 --------
 3 files changed, 5 insertions(+), 29 deletions(-)

diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 2d7d68bca6b5..c27cd21f7126 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -6288,12 +6288,6 @@ TypeObject::clearProperties()
 inline void
 TypeObject::sweep(FreeOp *fop)
 {
-    /*
-     * We may be regenerating existing type sets containing this object,
-     * so reset contributions on each GC to avoid tripping the limit.
-     */
-    contribution = 0;
-
     if (singleton) {
         JS_ASSERT(!newScript);
 
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 6a4bcdc84cb3..bdcbc96f161f 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -287,7 +287,7 @@ enum {
                           TYPE_FLAG_INT32 | TYPE_FLAG_DOUBLE | TYPE_FLAG_STRING,
 
     /* Mask/shift for the number of objects in objectSet */
-    TYPE_FLAG_OBJECT_COUNT_MASK   = 0xff00,
+    TYPE_FLAG_OBJECT_COUNT_MASK   = 0x1f00,
     TYPE_FLAG_OBJECT_COUNT_SHIFT  = 8,
     TYPE_FLAG_OBJECT_COUNT_LIMIT  =
         TYPE_FLAG_OBJECT_COUNT_MASK >> TYPE_FLAG_OBJECT_COUNT_SHIFT,
@@ -971,20 +971,6 @@ struct TypeObject : gc::Cell
 
     static inline size_t offsetOfFlags() { return offsetof(TypeObject, flags); }
 
-    /*
-     * Estimate of the contribution of this object to the type sets it appears in.
-     * This is the sum of the sizes of those sets at the point when the object
-     * was added.
-     *
-     * When the contribution exceeds the CONTRIBUTION_LIMIT, any type sets the
-     * object is added to are instead marked as unknown. If we get to this point
-     * we are probably not adding types which will let us do meaningful optimization
-     * later, and we want to ensure in such cases that our time/space complexity
-     * is linear, not worst-case cubic as it would otherwise be.
-     */
-    uint32_t contribution;
-    static const uint32_t CONTRIBUTION_LIMIT = 2000;
-
     /*
      * If non-NULL, objects of this type have always been constructed using
      * 'new' on the specified script, which adds some number of properties to
@@ -1027,6 +1013,10 @@ struct TypeObject : gc::Cell
     /* If this is an interpreted function, the function object. */
     HeapPtrFunction interpretedFunction;
 
+#if JS_BITS_PER_WORD == 32
+    uint32_t padding;
+#endif
+
     inline TypeObject(Class *clasp, TaggedProto proto, bool isFunction, bool unknown);
 
     bool isFunction() { return !!(flags & OBJECT_FLAG_FUNCTION); }
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index ae0fa8adaf6b..350410c1899e 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -1365,14 +1365,6 @@ TypeSet::addType(JSContext *cx, Type type)
             JS_ASSERT(!nobject->singleton);
             if (nobject->unknownProperties())
                 goto unknownObject;
-            if (objectCount > 1) {
-                nobject->contribution += (objectCount - 1) * (objectCount - 1);
-                if (nobject->contribution >= TypeObject::CONTRIBUTION_LIMIT) {
-                    InferSpew(ISpewOps, "limitUnknown: %sT%p%s",
-                              InferSpewColor(this), this, InferSpewColorReset());
-                    goto unknownObject;
-                }
-            }
         }
     }
 

From 870220a95f7848f82421bafa79bb49b1a2a7d0af Mon Sep 17 00:00:00 2001
From: Mihai Sucan <mihai.sucan@gmail.com>
Date: Tue, 16 Jul 2013 22:25:07 +0300
Subject: [PATCH 24/37] Bug 889847 - Fix for intermittent
 browser_webconsole_bug_613013_console_api_iframe.js | Timed out while waiting
 for: console.log() message; r=me

---
 ..._webconsole_bug_613013_console_api_iframe.js | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_613013_console_api_iframe.js b/browser/devtools/webconsole/test/browser_webconsole_bug_613013_console_api_iframe.js
index 978c15880319..7e0fe28e1d6a 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_613013_console_api_iframe.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_613013_console_api_iframe.js
@@ -35,15 +35,14 @@ function performTest() {
   Services.obs.removeObserver(TestObserver, "console-api-log-event");
   TestObserver = null;
 
-  waitForSuccess({
-    name: "console.log() message",
-    validatorFn: function()
-    {
-      return hud.outputNode.textContent.indexOf("foobarBug613013") > -1;
-    },
-    successFn: finishTest,
-    failureFn: finishTest,
-  });
+  waitForMessages({
+    webconsole: hud,
+    messages: [{
+      text: "foobarBug613013",
+      category: CATEGORY_WEBDEV,
+      severity: SEVERITY_LOG,
+    }],
+  }).then(finishTest);
 }
 
 function test() {

From 2eccb5dbc0de112c41b6fad506d104f66f35e333 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Tue, 16 Jul 2013 21:34:02 +0200
Subject: [PATCH 25/37] Bug 852421 - Remove MarkTypeObjectUnknownProperties
 call from Object.create. r=bhackett

--HG--
extra : rebase_source : efbc9855ea3b548838b7c2b74feac3db987814e5
---
 js/src/builtin/Object.cpp | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/js/src/builtin/Object.cpp b/js/src/builtin/Object.cpp
index 07f20e872670..82b55afd808e 100644
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -706,9 +706,6 @@ obj_create(JSContext *cx, unsigned argc, Value *vp)
     if (!obj)
         return false;
 
-    /* Don't track types or array-ness for objects created here. */
-    MarkTypeObjectUnknownProperties(cx, obj->type());
-
     /* 15.2.3.5 step 4. */
     if (args.hasDefined(1)) {
         if (args[1].isPrimitive()) {

From b397d69844f3ad148100346bf32cd92400aa3218 Mon Sep 17 00:00:00 2001
From: Jason Yeo <yshun@mozilla.com>
Date: Tue, 16 Jul 2013 15:39:11 -0400
Subject: [PATCH 26/37] bug 763903: regularly run mozconfig comparisons for
 firefox. r=ted/bhearsum

---
 build/compare-mozconfig/compare-mozconfigs-wrapper.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/build/compare-mozconfig/compare-mozconfigs-wrapper.py b/build/compare-mozconfig/compare-mozconfigs-wrapper.py
index 90a4018aeb71..8903c5efee23 100644
--- a/build/compare-mozconfig/compare-mozconfigs-wrapper.py
+++ b/build/compare-mozconfig/compare-mozconfigs-wrapper.py
@@ -51,3 +51,7 @@ def main():
                                     whitelist_path, '--no-download',
                                     platform + ',' + release_mozconfig_path +
                                     ',' + nightly_mozconfig_path])
+        sys.exit(ret_code)
+
+if __name__ == '__main__':
+    main()

From 8c58c3be0fa1db822683f924b3df2beb57f18b84 Mon Sep 17 00:00:00 2001
From: Seth Fowler <seth@mozilla.com>
Date: Tue, 16 Jul 2013 15:41:30 -0400
Subject: [PATCH 27/37] Bug 885939 (Part 1) - Scale SVG images using the
 graphics context matrix instead of the viewport. r=dholbert

---
 image/src/VectorImage.cpp | 43 +++++++++++++++++++--------------------
 1 file changed, 21 insertions(+), 22 deletions(-)

diff --git a/image/src/VectorImage.cpp b/image/src/VectorImage.cpp
index 63260e621e68..575032d3f3ab 100644
--- a/image/src/VectorImage.cpp
+++ b/image/src/VectorImage.cpp
@@ -230,9 +230,11 @@ class SVGDrawingCallback : public gfxDrawingCallback {
 public:
   SVGDrawingCallback(SVGDocumentWrapper* aSVGDocumentWrapper,
                      const nsIntRect& aViewport,
+                     const gfxSize& aScale,
                      uint32_t aImageFlags) :
     mSVGDocumentWrapper(aSVGDocumentWrapper),
     mViewport(aViewport),
+    mScale(aScale),
     mImageFlags(aImageFlags)
   {}
   virtual bool operator()(gfxContext* aContext,
@@ -242,6 +244,7 @@ public:
 private:
   nsRefPtr<SVGDocumentWrapper> mSVGDocumentWrapper;
   const nsIntRect mViewport;
+  const gfxSize   mScale;
   uint32_t        mImageFlags;
 };
 
@@ -271,6 +274,7 @@ SVGDrawingCallback::operator()(gfxContext* aContext,
 
   gfxContextMatrixAutoSaveRestore contextMatrixRestorer(aContext);
   aContext->Multiply(gfxMatrix(aTransform).Invert());
+  aContext->Scale(1.0 / mScale.width, 1.0 / mScale.height);
 
   nsPresContext* presContext = presShell->GetPresContext();
   MOZ_ASSERT(presContext, "pres shell w/out pres context");
@@ -698,18 +702,11 @@ VectorImage::Draw(gfxContext* aContext,
   // if we hit the tiling path. Unfortunately, the temporary surface isn't
   // created at the size at which we'll ultimately draw, causing fuzzy output.
   // To fix this we pre-apply the transform's scaling to the drawing parameters
-  // and then remove the scaling from the transform, so the fact that temporary
+  // and remove the scaling from the transform, so the fact that temporary
   // surfaces won't take the scaling into account doesn't matter. (Bug 600207.)
   gfxSize scale(aUserSpaceToImageSpace.ScaleFactors(true));
   gfxPoint translation(aUserSpaceToImageSpace.GetTranslation());
 
-  // Rescale everything.
-  nsIntSize scaledViewport(aViewportSize.width / scale.width,
-                           aViewportSize.height / scale.height);
-  gfxIntSize scaledViewportGfx(scaledViewport.width, scaledViewport.height);
-  nsIntRect scaledSubimage(aSubimage);
-  scaledSubimage.ScaleRoundOut(1.0 / scale.width, 1.0 / scale.height);
-
   // Remove the scaling from the transform.
   gfxMatrix unscale;
   unscale.Translate(gfxPoint(translation.x / scale.width,
@@ -718,28 +715,30 @@ VectorImage::Draw(gfxContext* aContext,
   unscale.Translate(-translation);
   gfxMatrix unscaledTransform(aUserSpaceToImageSpace * unscale);
 
-  mSVGDocumentWrapper->UpdateViewportBounds(scaledViewport);
+  mSVGDocumentWrapper->UpdateViewportBounds(aViewportSize);
   mSVGDocumentWrapper->FlushImageTransformInvalidation();
 
-  // Based on imgFrame::Draw
-  gfxRect sourceRect = unscaledTransform.Transform(aFill);
-  gfxRect imageRect(0, 0, scaledViewport.width, scaledViewport.height);
-  gfxRect subimage(scaledSubimage.x, scaledSubimage.y,
-                   scaledSubimage.width, scaledSubimage.height);
-
+  // Rescale drawing parameters.
+  gfxIntSize drawableSize(aViewportSize.width / scale.width,
+                          aViewportSize.height / scale.height);
+  gfxRect drawableSourceRect = unscaledTransform.Transform(aFill);
+  gfxRect drawableImageRect(0, 0, drawableSize.width, drawableSize.height);
+  gfxRect drawableSubimage(aSubimage.x, aSubimage.y,
+                           aSubimage.width, aSubimage.height);
+  drawableSubimage.ScaleRoundOut(1.0 / scale.width, 1.0 / scale.height);
 
   nsRefPtr<gfxDrawingCallback> cb =
     new SVGDrawingCallback(mSVGDocumentWrapper,
-                           nsIntRect(nsIntPoint(0, 0), scaledViewport),
+                           nsIntRect(nsIntPoint(0, 0), aViewportSize),
+                           scale,
                            aFlags);
 
-  nsRefPtr<gfxDrawable> drawable = new gfxCallbackDrawable(cb, scaledViewportGfx);
+  nsRefPtr<gfxDrawable> drawable = new gfxCallbackDrawable(cb, drawableSize);
 
-  gfxUtils::DrawPixelSnapped(aContext, drawable,
-                             unscaledTransform,
-                             subimage, sourceRect, imageRect, aFill,
-                             gfxASurface::ImageFormatARGB32, aFilter,
-                             aFlags);
+  gfxUtils::DrawPixelSnapped(aContext, drawable, unscaledTransform,
+                             drawableSubimage, drawableSourceRect,
+                             drawableImageRect, aFill,
+                             gfxASurface::ImageFormatARGB32, aFilter, aFlags);
 
   MOZ_ASSERT(mRenderingObserver, "Should have a rendering observer by now");
   mRenderingObserver->ResumeHonoringInvalidations();

From b44af38222c02ba4dce335160ec4107a5e8bd98e Mon Sep 17 00:00:00 2001
From: Seth Fowler <seth@mozilla.com>
Date: Tue, 16 Jul 2013 15:41:33 -0400
Subject: [PATCH 28/37] Bug 885939 (Part 2) - Add reftests for SVG image
 stretching and scaling. r=dholbert

---
 .../background-scale-no-viewbox-1-ref.html    | 21 +++++++++++
 .../background-scale-no-viewbox-1.html        | 22 +++++++++++
 .../background-scale-with-viewbox-1-ref.html  | 21 +++++++++++
 .../background-scale-with-viewbox-1.html      | 22 +++++++++++
 .../as-image/background-stretch-1-ref.html    | 37 +++++++++++++++++++
 .../svg/as-image/background-stretch-1.html    | 22 +++++++++++
 layout/reftests/svg/as-image/reftest.list     |  7 ++++
 .../svg/as-image/white-rect-no-viewbox.svg    |  8 ++++
 .../svg/as-image/white-rect-with-viewbox.svg  | 11 ++++++
 9 files changed, 171 insertions(+)
 create mode 100644 layout/reftests/svg/as-image/background-scale-no-viewbox-1-ref.html
 create mode 100644 layout/reftests/svg/as-image/background-scale-no-viewbox-1.html
 create mode 100644 layout/reftests/svg/as-image/background-scale-with-viewbox-1-ref.html
 create mode 100644 layout/reftests/svg/as-image/background-scale-with-viewbox-1.html
 create mode 100644 layout/reftests/svg/as-image/background-stretch-1-ref.html
 create mode 100644 layout/reftests/svg/as-image/background-stretch-1.html
 create mode 100644 layout/reftests/svg/as-image/white-rect-no-viewbox.svg
 create mode 100644 layout/reftests/svg/as-image/white-rect-with-viewbox.svg

diff --git a/layout/reftests/svg/as-image/background-scale-no-viewbox-1-ref.html b/layout/reftests/svg/as-image/background-scale-no-viewbox-1-ref.html
new file mode 100644
index 000000000000..e9ee74d29b10
--- /dev/null
+++ b/layout/reftests/svg/as-image/background-scale-no-viewbox-1-ref.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    div {
+      background-color: white;
+      width: 12px;
+      height: 60px;
+    }
+    body {
+      background-color: black;
+      margin:  0px;
+      padding: 0px;
+      border:  0px;
+    }
+  </style>
+</head>
+<body>
+  <div></div>
+</body>
+</html>
diff --git a/layout/reftests/svg/as-image/background-scale-no-viewbox-1.html b/layout/reftests/svg/as-image/background-scale-no-viewbox-1.html
new file mode 100644
index 000000000000..e8ea278bb61e
--- /dev/null
+++ b/layout/reftests/svg/as-image/background-scale-no-viewbox-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html reftest-zoom="2.0">
+<head>
+  <style>
+    div {
+      background-color: yellow;
+      background-image: url("white-rect-no-viewbox.svg");
+      width: 6px;
+      height: 30px;
+    }
+    body {
+      background-color: black;
+      margin:  0px;
+      padding: 0px;
+      border:  0px;
+    }
+  </style>
+</head>
+<body>
+  <div></div>
+</body>
+</html>
diff --git a/layout/reftests/svg/as-image/background-scale-with-viewbox-1-ref.html b/layout/reftests/svg/as-image/background-scale-with-viewbox-1-ref.html
new file mode 100644
index 000000000000..e9ee74d29b10
--- /dev/null
+++ b/layout/reftests/svg/as-image/background-scale-with-viewbox-1-ref.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    div {
+      background-color: white;
+      width: 12px;
+      height: 60px;
+    }
+    body {
+      background-color: black;
+      margin:  0px;
+      padding: 0px;
+      border:  0px;
+    }
+  </style>
+</head>
+<body>
+  <div></div>
+</body>
+</html>
diff --git a/layout/reftests/svg/as-image/background-scale-with-viewbox-1.html b/layout/reftests/svg/as-image/background-scale-with-viewbox-1.html
new file mode 100644
index 000000000000..295aedf52020
--- /dev/null
+++ b/layout/reftests/svg/as-image/background-scale-with-viewbox-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html reftest-zoom="2.0">
+<head>
+  <style>
+    div {
+      background-color: yellow;
+      background-image: url("white-rect-with-viewbox.svg");
+      width: 6px;
+      height: 30px;
+    }
+    body {
+      background-color: black;
+      margin:  0px;
+      padding: 0px;
+      border:  0px;
+    }
+  </style>
+</head>
+<body>
+  <div></div>
+</body>
+</html>
diff --git a/layout/reftests/svg/as-image/background-stretch-1-ref.html b/layout/reftests/svg/as-image/background-stretch-1-ref.html
new file mode 100644
index 000000000000..f84768e27c4b
--- /dev/null
+++ b/layout/reftests/svg/as-image/background-stretch-1-ref.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    div {
+      background-color: yellow;
+      height: 30px;
+    }
+    .container {
+      width: 100px;
+    }
+    .stretch {
+      width: 40px;
+      background-color: white;
+      display: inline-block;
+    }
+    .left-spacer {
+      width: 30px;
+      float: left;
+    }
+    .right-spacer {
+      width: 30px;
+      float: right;
+    }
+    body {
+      background-color: black;
+    }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="left-spacer"></div>
+    <div class="stretch"></div>
+    <div class="right-spacer"></div>
+  </div>
+</body>
+</html>
diff --git a/layout/reftests/svg/as-image/background-stretch-1.html b/layout/reftests/svg/as-image/background-stretch-1.html
new file mode 100644
index 000000000000..0931cf3ccce9
--- /dev/null
+++ b/layout/reftests/svg/as-image/background-stretch-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    div {
+      height: 30px;
+      width: 100px;
+      background-image: url("white-rect-with-viewbox.svg");
+      background-repeat: no-repeat;
+      background-position: 30px;
+      background-size: 40px 30px;
+      background-color: yellow;
+    }
+    body {
+      background-color: black;
+    }
+  </style>
+</head>
+<body>
+  <div></div>
+</body>
+</html>
diff --git a/layout/reftests/svg/as-image/reftest.list b/layout/reftests/svg/as-image/reftest.list
index 7e0195d0f87d..0ba21dd7503b 100644
--- a/layout/reftests/svg/as-image/reftest.list
+++ b/layout/reftests/svg/as-image/reftest.list
@@ -16,6 +16,13 @@ skip-if(B2G) == background-simple-1.html  lime100x100-ref.html # bug 773482
 == background-resize-3.html  lime100x100-ref.html
 == background-resize-4.html  lime100x100-ref.html
 
+# Test for stretching background images by different amounts in each dimension
+== background-stretch-1.html background-stretch-1-ref.html
+
+# Tests for scaling background images
+== background-scale-no-viewbox-1.html   background-scale-no-viewbox-1-ref.html
+== background-scale-with-viewbox-1.html background-scale-with-viewbox-1-ref.html
+
 # Tests with -moz-image-rect()
 skip-if(B2G) == background-image-rect-1svg.html  lime100x100-ref.html # bug 773482
 == background-image-rect-1png.html  lime100x100-ref.html
diff --git a/layout/reftests/svg/as-image/white-rect-no-viewbox.svg b/layout/reftests/svg/as-image/white-rect-no-viewbox.svg
new file mode 100644
index 000000000000..76a7efd3dc80
--- /dev/null
+++ b/layout/reftests/svg/as-image/white-rect-no-viewbox.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<svg version="1.1"
+     xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+	   
+  <rect width="6" height="30" style="fill:white;" />
+</svg>
diff --git a/layout/reftests/svg/as-image/white-rect-with-viewbox.svg b/layout/reftests/svg/as-image/white-rect-with-viewbox.svg
new file mode 100644
index 000000000000..6bb59d19a492
--- /dev/null
+++ b/layout/reftests/svg/as-image/white-rect-with-viewbox.svg
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<svg version="1.1"
+     xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     width="6px"
+     height="30px"
+     viewBox="0 0 6 30">
+	   
+  <rect width="6" height="30" style="fill:white;" />
+</svg>

From 48bacd080e5e9452fb372f1e50162fef184c7672 Mon Sep 17 00:00:00 2001
From: Seth Fowler <seth@mozilla.com>
Date: Tue, 16 Jul 2013 15:41:36 -0400
Subject: [PATCH 29/37] Bug 885939 (Part 3) - Disable SVG reftests involving
 extreme viewboxes that fail due to integer overflow. r=me

---
 layout/reftests/backgrounds/vector/empty/reftest.list | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/layout/reftests/backgrounds/vector/empty/reftest.list b/layout/reftests/backgrounds/vector/empty/reftest.list
index 1a7af876cdca..d83e5c1da69c 100644
--- a/layout/reftests/backgrounds/vector/empty/reftest.list
+++ b/layout/reftests/backgrounds/vector/empty/reftest.list
@@ -2,10 +2,12 @@
 == tall--contain--width.html ref-tall-empty.html
 == wide--contain--height.html ref-wide-empty.html
 == wide--contain--width.html ref-wide-empty.html
-== tall--cover--height.html ref-tall-lime.html
-== tall--cover--width.html ref-tall-lime.html
-== wide--cover--height.html ref-wide-lime.html
-== wide--cover--width.html ref-wide-lime.html
+
+# These tests fail because of integer overflow; see bug 894555.
+fails == tall--cover--height.html ref-tall-lime.html
+fails == tall--cover--width.html ref-tall-lime.html
+fails == wide--cover--height.html ref-wide-lime.html
+fails == wide--cover--width.html ref-wide-lime.html
 
 == zero-height-ratio-contain.html ref-tall-empty.html
 == zero-height-ratio-cover.html ref-tall-empty.html

From 468eeb751c8cb56223e45c06782cd33057e186fb Mon Sep 17 00:00:00 2001
From: Joey Armstrong <joey@mozilla.com>
Date: Tue, 16 Jul 2013 15:47:52 -0400
Subject: [PATCH 30/37] bug 870406: move CSRCS to mozbuild (file batch #3)
 r=mshal

---
 mozglue/build/Makefile.in            |  5 -----
 mozglue/build/moz.build              |  4 ++++
 security/manager/ssl/src/Makefile.in |  1 -
 security/manager/ssl/src/moz.build   |  5 ++++-
 tools/trace-malloc/Makefile.in       |  1 -
 tools/trace-malloc/lib/Makefile.in   |  4 ----
 tools/trace-malloc/lib/moz.build     |  3 +++
 tools/trace-malloc/moz.build         | 11 +++++++++++
 widget/gtk2/Makefile.in              | 14 --------------
 widget/gtk2/moz.build                | 14 +++++++++++++-
 widget/gtkxtbin/Makefile.in          |  6 ------
 widget/gtkxtbin/moz.build            |  5 +++++
 widget/shared/x11/Makefile.in        |  5 -----
 widget/shared/x11/moz.build          |  3 +++
 14 files changed, 43 insertions(+), 38 deletions(-)

diff --git a/mozglue/build/Makefile.in b/mozglue/build/Makefile.in
index 33c19d641415..92ab99b5d7d0 100644
--- a/mozglue/build/Makefile.in
+++ b/mozglue/build/Makefile.in
@@ -11,7 +11,6 @@ VPATH		= @srcdir@
 include $(DEPTH)/config/autoconf.mk
 
 DIST_INSTALL = 1
-
 # Build mozglue as a shared lib on Windows, OSX and Android.
 # If this is ever changed, update MOZ_SHARED_MOZGLUE in browser/installer/Makefile.in
 ifneq (,$(filter WINNT Darwin Android,$(OS_TARGET)))
@@ -95,10 +94,6 @@ SHARED_LIBRARY_LIBS += $(call EXPAND_LIBNAME_PATH,android,../android)
 EXTRA_DSO_LDOPTS += -Wl,--wrap=pthread_atfork
 endif
 
-ifeq (gonk, $(MOZ_WIDGET_TOOLKIT))
-CSRCS += cpuacct.c
-endif
-
 ifdef MOZ_LINKER
 # Add custom dynamic linker
 SHARED_LIBRARY_LIBS += $(call EXPAND_LIBNAME_PATH,linker,../linker)
diff --git a/mozglue/build/moz.build b/mozglue/build/moz.build
index 0671669107bf..f578d1fe0636 100644
--- a/mozglue/build/moz.build
+++ b/mozglue/build/moz.build
@@ -32,3 +32,7 @@ if CONFIG['OS_TARGET'] == 'Android':
 
 LIBRARY_NAME = 'mozglue'
 
+if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk':
+    CSRCS += [
+        'cpuacct.c',
+    ]
diff --git a/security/manager/ssl/src/Makefile.in b/security/manager/ssl/src/Makefile.in
index 2b578ee4f135..90522586ac26 100644
--- a/security/manager/ssl/src/Makefile.in
+++ b/security/manager/ssl/src/Makefile.in
@@ -13,7 +13,6 @@ include $(DEPTH)/config/autoconf.mk
 
 EXPORT_LIBRARY	= 1
 LIBXUL_LIBRARY	= 1
-CSRCS += md4.c
 
 DEFINES += \
   -DNSS_ENABLE_ECC \
diff --git a/security/manager/ssl/src/moz.build b/security/manager/ssl/src/moz.build
index 1e7954184c01..9400550c75e7 100644
--- a/security/manager/ssl/src/moz.build
+++ b/security/manager/ssl/src/moz.build
@@ -66,7 +66,7 @@ CPP_SOURCES += [
     'nsStreamCipher.cpp',
     'nsTLSSocketProvider.cpp',
     'nsUsageArrayHelper.cpp',
-	'PSMContentListener.cpp',
+    'PSMContentListener.cpp',
     'PSMRunnable.cpp',
     'SharedSSLState.cpp',
     'SSLServerCertVerification.cpp',
@@ -85,3 +85,6 @@ if CONFIG['MOZ_XUL']:
 
 LIBRARY_NAME = 'pipnss'
 
+CSRCS += [
+    'md4.c',
+]
diff --git a/tools/trace-malloc/Makefile.in b/tools/trace-malloc/Makefile.in
index 999b7763667e..1ac45d3279ad 100644
--- a/tools/trace-malloc/Makefile.in
+++ b/tools/trace-malloc/Makefile.in
@@ -40,7 +40,6 @@ PROGCSRCS = \
 PROGOBJS = $(PROGCSRCS:.c=.$(OBJ_SUFFIX))
 endif
 
-CSRCS = $(SIMPLECSRCS) $(EXTRACSRCS) $(PROGCSRCS)
 ifeq ($(OS_ARCH),WINNT)
 LOCAL_INCLUDES	+= -I$(topsrcdir)/config/os2
 endif
diff --git a/tools/trace-malloc/lib/Makefile.in b/tools/trace-malloc/lib/Makefile.in
index b46b484855da..afa8a2a139d2 100644
--- a/tools/trace-malloc/lib/Makefile.in
+++ b/tools/trace-malloc/lib/Makefile.in
@@ -17,10 +17,6 @@ LIBXUL_LIBRARY	= 1
 
 STL_FLAGS	=
 
-CSRCS		= \
-		nsTraceMalloc.c \
-		$(NULL)
-
 DEFINES		+= -DMOZ_NO_MOZALLOC
 
 ifdef WRAP_SYSTEM_INCLUDES
diff --git a/tools/trace-malloc/lib/moz.build b/tools/trace-malloc/lib/moz.build
index c4e57073c757..747fe542a4e2 100644
--- a/tools/trace-malloc/lib/moz.build
+++ b/tools/trace-malloc/lib/moz.build
@@ -22,3 +22,6 @@ if CONFIG['OS_ARCH'] == 'WINNT':
 
 LIBRARY_NAME = 'tracemalloc'
 
+CSRCS += [
+    'nsTraceMalloc.c',
+]
diff --git a/tools/trace-malloc/moz.build b/tools/trace-malloc/moz.build
index c4fc5e838155..c8211ebf4af0 100644
--- a/tools/trace-malloc/moz.build
+++ b/tools/trace-malloc/moz.build
@@ -6,8 +6,19 @@
 
 if not CONFIG['MOZ_PROFILE_GENERATE']:
     PROGRAM = 'spacetrace'
+    CSRCS += [
+        'formdata.c',
+        'spacecategory.c',
+        'spacetrace.c',
+    ]
 
 CPP_SOURCES += [
     '$(EXTRACPPSRCS)',
     '$(SIMPLECPPSRCS)',
 ]
+
+CSRCS += [
+    'leakstats.c',
+    'tmreader.c',
+    'tmstats.c',
+]        
diff --git a/widget/gtk2/Makefile.in b/widget/gtk2/Makefile.in
index 903286d02c92..6840d505a7dc 100644
--- a/widget/gtk2/Makefile.in
+++ b/widget/gtk2/Makefile.in
@@ -21,25 +21,11 @@ LIBXUL_LIBRARY = 1
 
 NATIVE_THEME_SUPPORT = 1
 
-
-
-CSRCS		= \
-		mozcontainer.c \
-		$(NULL)
-
-ifdef ACCESSIBILITY
-CSRCS += maiRedundantObjectFactory.c
-endif
 # build our subdirs, too
 
 SHARED_LIBRARY_LIBS = ../xpwidgets/libxpwidgets_s.a
 
 ifdef NATIVE_THEME_SUPPORT
-ifdef MOZ_ENABLE_GTK2
-CSRCS		+= gtk2drawing.c
-else
-CSRCS		+= gtk3drawing.c
-endif
 DEFINES		+= -DNATIVE_THEME_SUPPORT
 endif
 
diff --git a/widget/gtk2/moz.build b/widget/gtk2/moz.build
index 6a7fea1d577c..09fc648710e9 100644
--- a/widget/gtk2/moz.build
+++ b/widget/gtk2/moz.build
@@ -53,5 +53,17 @@ if CONFIG['MOZ_X11']:
         'nsDragService.cpp',
     ]
 
-CPP_SOURCES += [
+CSRCS += [
+    'mozcontainer.c',
 ]
+
+if CONFIG['ACCESSIBILITY']:
+    CSRCS += [
+        'maiRedundantObjectFactory.c',
+    ]
+
+if CONFIG['MOZ_ENABLE_GTK2']:
+    CSRCS += [
+        'gtk2drawing.c',
+        'gtk3drawing.c',
+    ]
diff --git a/widget/gtkxtbin/Makefile.in b/widget/gtkxtbin/Makefile.in
index a1ba37e3a37f..66cca4104a62 100644
--- a/widget/gtkxtbin/Makefile.in
+++ b/widget/gtkxtbin/Makefile.in
@@ -14,12 +14,6 @@ include $(DEPTH)/config/autoconf.mk
 EXPORT_LIBRARY = 1
 LIBXUL_LIBRARY = 1
 
-ifdef MOZ_ENABLE_GTK2
-CSRCS		= \
-		gtk2xtbin.c \
-		$(NULL)
-endif
-
 include $(topsrcdir)/config/rules.mk
 
 ifdef MOZ_ENABLE_GTK2
diff --git a/widget/gtkxtbin/moz.build b/widget/gtkxtbin/moz.build
index 5e9a3c87c1a8..6004ca683f88 100644
--- a/widget/gtkxtbin/moz.build
+++ b/widget/gtkxtbin/moz.build
@@ -12,3 +12,8 @@ EXPORTS += [
 
 LIBRARY_NAME = 'gtkxtbin'
 
+
+if CONFIG['MOZ_ENABLE_GTK2']:
+    CSRCS += [
+        'gtk2xtbin.c',
+    ]
diff --git a/widget/shared/x11/Makefile.in b/widget/shared/x11/Makefile.in
index 819b6fc06f30..a96382d4b857 100644
--- a/widget/shared/x11/Makefile.in
+++ b/widget/shared/x11/Makefile.in
@@ -13,11 +13,6 @@ include $(DEPTH)/config/autoconf.mk
 LIBRARY_NAME   = widget_shared_x11
 LIBXUL_LIBRARY  = 1
 
-
-CSRCS      = \
-       keysym2ucs.c \
-       $(NULL)
-
 include $(topsrcdir)/config/rules.mk
 
 CXXFLAGS   += $(TK_CFLAGS)
diff --git a/widget/shared/x11/moz.build b/widget/shared/x11/moz.build
index 41a76827ca6f..493294822e15 100644
--- a/widget/shared/x11/moz.build
+++ b/widget/shared/x11/moz.build
@@ -6,3 +6,6 @@
 
 MODULE = 'widget'
 
+CSRCS += [
+    'keysym2ucs.c',
+]

From a1b046b961ceb0825624852411725ccb3d250923 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Tue, 16 Jul 2013 15:56:10 -0400
Subject: [PATCH 31/37] Bug 886667 - Just assert rather than aborting when our
 framebuffer is invalid. r=jrmuizel

---
 gfx/layers/opengl/CompositingRenderTargetOGL.h | 6 +++---
 gfx/layers/opengl/CompositorOGL.cpp            | 7 +++++++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/gfx/layers/opengl/CompositingRenderTargetOGL.h b/gfx/layers/opengl/CompositingRenderTargetOGL.h
index ee41ad3d3e04..904fb79328ed 100644
--- a/gfx/layers/opengl/CompositingRenderTargetOGL.h
+++ b/gfx/layers/opengl/CompositingRenderTargetOGL.h
@@ -185,9 +185,9 @@ private:
     GLenum result = mGL->fCheckFramebufferStatus(LOCAL_GL_FRAMEBUFFER);
     if (result != LOCAL_GL_FRAMEBUFFER_COMPLETE) {
       nsAutoCString msg;
-      msg.AppendPrintf("Framebuffer not complete -- error 0x%x, aFBOTextureTarget 0x%x, aRect.width %d, aRect.height %d",
-                       result, mInitParams.mFBOTextureTarget, mInitParams.mSize.width, mInitParams.mSize.height);
-      NS_RUNTIMEABORT(msg.get());
+      msg.AppendPrintf("Framebuffer not complete -- error 0x%x, aFBOTextureTarget 0x%x, mFBO %d, mTextureHandle %d, aRect.width %d, aRect.height %d",
+                       result, mInitParams.mFBOTextureTarget, mFBO, mTextureHandle, mInitParams.mSize.width, mInitParams.mSize.height);
+      NS_ERROR(msg.get());
     }
 
     mCompositor->PrepareViewport(mInitParams.mSize, mTransform);
diff --git a/gfx/layers/opengl/CompositorOGL.cpp b/gfx/layers/opengl/CompositorOGL.cpp
index a7de1dbf94bc..3ce748fdf421 100644
--- a/gfx/layers/opengl/CompositorOGL.cpp
+++ b/gfx/layers/opengl/CompositorOGL.cpp
@@ -896,6 +896,13 @@ CompositorOGL::CreateFBOWithTexture(const IntRect& aRect, SurfaceInitMode aInit,
                               LOCAL_GL_UNSIGNED_BYTE,
                               buf);
     }
+    GLenum error = mGLContext->GetAndClearError();
+    if (error != LOCAL_GL_NO_ERROR) {
+      nsAutoCString msg;
+      msg.AppendPrintf("Texture initialization failed! -- error 0x%x, Source %d, Source format %d,  RGBA Compat %d",
+                       error, aSourceFrameBuffer, format, isFormatCompatibleWithRGBA);
+      NS_ERROR(msg.get());
+    }
   } else {
     mGLContext->fTexImage2D(mFBOTextureTarget,
                             0,

From 7b9085b4533fb5733edae4f026ae54089d06a9d0 Mon Sep 17 00:00:00 2001
From: David Zbarsky <dzbarsky@gmail.com>
Date: Tue, 16 Jul 2013 13:07:09 -0700
Subject: [PATCH 32/37] Bug 879475 - Make PBlob manually keep track of its
 manager r=jlebar

---
 dom/ipc/Blob.cpp          | 22 ++++++++++++++--------
 dom/ipc/Blob.h            | 18 +++++++++++++-----
 dom/ipc/ContentChild.cpp  |  4 ++--
 dom/ipc/ContentParent.cpp |  4 ++--
 4 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/dom/ipc/Blob.cpp b/dom/ipc/Blob.cpp
index 59093416ce29..399c508ced01 100644
--- a/dom/ipc/Blob.cpp
+++ b/dom/ipc/Blob.cpp
@@ -840,7 +840,7 @@ private:
       typename ActorType::ConstructorParamsType params;
       ActorType::BaseType::SetBlobConstructorParams(params, normalParams);
 
-      ActorType* newActor = ActorType::Create(params);
+      ActorType* newActor = ActorType::Create(mActor->Manager(), params);
       MOZ_ASSERT(newActor);
 
       SlicedBlobConstructorParams slicedParams;
@@ -1011,11 +1011,13 @@ RemoteBlob<Child>::GetInternalStream(nsIInputStream** aStream)
 }
 
 template <ActorFlavorEnum ActorFlavor>
-Blob<ActorFlavor>::Blob(nsIDOMBlob* aBlob)
-: mBlob(aBlob), mRemoteBlob(nullptr), mOwnsBlob(true), mBlobIsFile(false)
+Blob<ActorFlavor>::Blob(ContentManager* aManager, nsIDOMBlob* aBlob)
+: mBlob(aBlob), mRemoteBlob(nullptr), mOwnsBlob(true)
+, mBlobIsFile(false), mManager(aManager)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aBlob);
+  MOZ_ASSERT(aManager);
   aBlob->AddRef();
 
   nsCOMPtr<nsIDOMFile> file = do_QueryInterface(aBlob);
@@ -1023,10 +1025,13 @@ Blob<ActorFlavor>::Blob(nsIDOMBlob* aBlob)
 }
 
 template <ActorFlavorEnum ActorFlavor>
-Blob<ActorFlavor>::Blob(const ConstructorParamsType& aParams)
-: mBlob(nullptr), mRemoteBlob(nullptr), mOwnsBlob(false), mBlobIsFile(false)
+Blob<ActorFlavor>::Blob(ContentManager* aManager,
+                        const ConstructorParamsType& aParams)
+: mBlob(nullptr), mRemoteBlob(nullptr), mOwnsBlob(false)
+, mBlobIsFile(false), mManager(aManager)
 {
   MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(aManager);
 
   ChildBlobConstructorParams::Type paramType =
     BaseType::GetBlobConstructorParams(aParams).type();
@@ -1048,7 +1053,8 @@ Blob<ActorFlavor>::Blob(const ConstructorParamsType& aParams)
 
 template <ActorFlavorEnum ActorFlavor>
 Blob<ActorFlavor>*
-Blob<ActorFlavor>::Create(const ConstructorParamsType& aParams)
+Blob<ActorFlavor>::Create(ContentManager* aManager,
+                          const ConstructorParamsType& aParams)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
@@ -1059,7 +1065,7 @@ Blob<ActorFlavor>::Create(const ConstructorParamsType& aParams)
     case ChildBlobConstructorParams::TNormalBlobConstructorParams:
     case ChildBlobConstructorParams::TFileBlobConstructorParams:
     case ChildBlobConstructorParams::TMysteryBlobConstructorParams:
-      return new Blob<ActorFlavor>(aParams);
+      return new Blob<ActorFlavor>(aManager, aParams);
 
     case ChildBlobConstructorParams::TSlicedBlobConstructorParams: {
       const SlicedBlobConstructorParams& params =
@@ -1074,7 +1080,7 @@ Blob<ActorFlavor>::Create(const ConstructorParamsType& aParams)
                       getter_AddRefs(slice));
       NS_ENSURE_SUCCESS(rv, nullptr);
 
-      return new Blob<ActorFlavor>(slice);
+      return new Blob<ActorFlavor>(aManager, slice);
     }
 
     default:
diff --git a/dom/ipc/Blob.h b/dom/ipc/Blob.h
index 460ddd345327..78fa76c86cce 100644
--- a/dom/ipc/Blob.h
+++ b/dom/ipc/Blob.h
@@ -162,6 +162,7 @@ class Blob : public BlobTraits<ActorFlavor>::BaseType
   friend class RemoteBlob<ActorFlavor>;
 
 public:
+  typedef typename BlobTraits<ActorFlavor>::ConcreteContentManagerType ContentManager;
   typedef typename BlobTraits<ActorFlavor>::ProtocolType ProtocolType;
   typedef typename BlobTraits<ActorFlavor>::StreamType StreamType;
   typedef typename BlobTraits<ActorFlavor>::ConstructorParamsType
@@ -183,14 +184,14 @@ protected:
 public:
   // This create function is called on the sending side.
   static Blob*
-  Create(nsIDOMBlob* aBlob)
+  Create(ContentManager* aManager, nsIDOMBlob* aBlob)
   {
-    return new Blob(aBlob);
+    return new Blob(aManager, aBlob);
   }
 
   // This create function is called on the receiving side.
   static Blob*
-  Create(const ConstructorParamsType& aParams);
+  Create(ContentManager* aManager, const ConstructorParamsType& aParams);
 
   // Get the blob associated with this actor. This may always be called on the
   // sending side. It may also be called on the receiving side unless this is a
@@ -207,12 +208,17 @@ public:
   bool
   SetMysteryBlobInfo(const nsString& aContentType, uint64_t aLength);
 
+  ContentManager* Manager()
+  {
+    return mManager;
+  }
+
 private:
   // This constructor is called on the sending side.
-  Blob(nsIDOMBlob* aBlob);
+  Blob(ContentManager* aManager, nsIDOMBlob* aBlob);
 
   // This constructor is called on the receiving side.
-  Blob(const ConstructorParamsType& aParams);
+  Blob(ContentManager* aManager, const ConstructorParamsType& aParams);
 
   static already_AddRefed<RemoteBlobType>
   CreateRemoteBlob(const ConstructorParamsType& aParams);
@@ -229,6 +235,8 @@ private:
 
   virtual bool
   RecvPBlobStreamConstructor(StreamType* aActor) MOZ_OVERRIDE;
+
+  nsRefPtr<ContentManager> mManager;
 };
 
 } // namespace ipc
diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index 0464ddffca3a..08062664fd17 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -636,7 +636,7 @@ ContentChild::DeallocPBrowserChild(PBrowserChild* iframe)
 PBlobChild*
 ContentChild::AllocPBlobChild(const BlobConstructorParams& aParams)
 {
-  return BlobChild::Create(aParams);
+  return BlobChild::Create(this, aParams);
 }
 
 bool
@@ -723,7 +723,7 @@ ContentChild::GetOrCreateActorForBlob(nsIDOMBlob* aBlob)
     }
     }
 
-  BlobChild* actor = BlobChild::Create(aBlob);
+  BlobChild* actor = BlobChild::Create(this, aBlob);
   NS_ENSURE_TRUE(actor, nullptr);
 
   if (!SendPBlobConstructor(actor, params)) {
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index caefdcbdbc98..dad5ca324610 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -1692,7 +1692,7 @@ ContentParent::DeallocPDeviceStorageRequestParent(PDeviceStorageRequestParent* d
 PBlobParent*
 ContentParent::AllocPBlobParent(const BlobConstructorParams& aParams)
 {
-  return BlobParent::Create(aParams);
+  return BlobParent::Create(this, aParams);
 }
 
 bool
@@ -1772,7 +1772,7 @@ ContentParent::GetOrCreateActorForBlob(nsIDOMBlob* aBlob)
     }
       }
 
-  BlobParent* actor = BlobParent::Create(aBlob);
+  BlobParent* actor = BlobParent::Create(this, aBlob);
   NS_ENSURE_TRUE(actor, nullptr);
 
   if (!SendPBlobConstructor(actor, params)) {

From f2fc4df65ead168882ec2007d71e6a4fc2177c5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Tue, 16 Jul 2013 22:12:48 +0200
Subject: [PATCH 33/37] Bug 894349 - Sort permissions in the site identity
 panel and the page info window alphabetically. r=jaws

---
 browser/modules/SitePermissions.jsm | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/browser/modules/SitePermissions.jsm b/browser/modules/SitePermissions.jsm
index 583be1897069..d26163a1405b 100644
--- a/browser/modules/SitePermissions.jsm
+++ b/browser/modules/SitePermissions.jsm
@@ -27,7 +27,11 @@ this.SitePermissions = {
   /* Returns an array of all permission IDs.
    */
   listPermissions: function () {
-    return Object.keys(gPermissionObject);
+    let array = Object.keys(gPermissionObject);
+    array.sort((a, b) => {
+      return this.getPermissionLabel(a).localeCompare(this.getPermissionLabel(b));
+    });
+    return array;
   },
 
   /* Returns an array of permission states to be exposed to the user for a

From b8f7e382f3ac85b0c339bd5bf8ac4f3118b2476f Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Tue, 16 Jul 2013 16:41:38 -0400
Subject: [PATCH 34/37] Backed out changeset 5fe88df5c376 (bug 892094) for
 Android 2.2 robocop-2 failures.

--HG--
rename : mobile/android/base/resources/xml/preferences_customize.xml.in => mobile/android/base/resources/xml/preferences_customize.xml
---
 mobile/android/base/Makefile.in               |  5 +-
 .../base/locales/en-US/android_strings.dtd    |  2 -
 .../preferences/SearchPreferenceCategory.java | 89 -------------------
 .../android/base/resources/values/dimens.xml  |  1 -
 .../xml-v11/preferences_customize_tablet.xml  | 14 +--
 .../preferences_customize.xml                 | 11 ++-
 .../xml/preferences_customize.xml.in          | 42 ---------
 .../base/resources/xml/preferences_search.xml | 18 ----
 mobile/android/base/strings.xml.in            |  2 -
 9 files changed, 10 insertions(+), 174 deletions(-)
 delete mode 100644 mobile/android/base/preferences/SearchPreferenceCategory.java
 rename mobile/android/base/resources/{xml-v11 => xml}/preferences_customize.xml (85%)
 delete mode 100644 mobile/android/base/resources/xml/preferences_customize.xml.in
 delete mode 100644 mobile/android/base/resources/xml/preferences_search.xml

diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index 94b2f7db233e..d575b02da9bd 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -234,7 +234,6 @@ FENNEC_JAVA_FILES = \
   menu/MenuItemDefault.java \
   menu/MenuPanel.java \
   menu/MenuPopup.java \
-  preferences/SearchPreferenceCategory.java \
   widget/AboutHome.java \
   widget/AboutHomeView.java \
   widget/AboutHomeSection.java \
@@ -311,7 +310,6 @@ FENNEC_PP_JAVA_FILES = \
 
 FENNEC_PP_XML_FILES = \
   res/xml/preferences.xml \
-  res/xml/preferences_customize.xml \
   res/xml/searchable.xml \
   $(NULL)
 
@@ -575,15 +573,14 @@ RES_VALUES_V14 = \
   $(NULL)
 
 RES_XML = \
+  res/xml/preferences_customize.xml \
   res/xml/preferences_display.xml \
-  res/xml/preferences_search.xml \
   res/xml/preferences_privacy.xml \
   res/xml/preferences_vendor.xml \
   $(SYNC_RES_XML) \
   $(NULL)
 
 RES_XML_V11 = \
-  res/xml-v11/preferences_customize.xml \
   res/xml-v11/preference_headers.xml \
   res/xml-v11/preferences_customize_tablet.xml \
   res/xml-v11/preferences.xml \
diff --git a/mobile/android/base/locales/en-US/android_strings.dtd b/mobile/android/base/locales/en-US/android_strings.dtd
index aeadc707ebf2..de7b3db80474 100644
--- a/mobile/android/base/locales/en-US/android_strings.dtd
+++ b/mobile/android/base/locales/en-US/android_strings.dtd
@@ -68,12 +68,10 @@
 <!ENTITY settings "Settings">
 <!ENTITY settings_title "Settings">
 <!ENTITY pref_category_customize "Customize">
-<!ENTITY pref_category_search "Search">
 <!ENTITY pref_category_display "Display">
 <!ENTITY pref_category_privacy_short "Privacy">
 <!ENTITY pref_category_vendor "&vendorShortName;">
 <!ENTITY pref_category_datareporting "Data choices">
-<!ENTITY pref_category_installed_search_engines "Installed search engines">
 
 <!-- collected old strings - remove after determining final strings
      as part of Bug 877791 -->
diff --git a/mobile/android/base/preferences/SearchPreferenceCategory.java b/mobile/android/base/preferences/SearchPreferenceCategory.java
deleted file mode 100644
index 313787485912..000000000000
--- a/mobile/android/base/preferences/SearchPreferenceCategory.java
+++ /dev/null
@@ -1,89 +0,0 @@
-package org.mozilla.gecko.preferences;
-
-import android.content.Context;
-import android.graphics.Bitmap;
-import android.graphics.drawable.BitmapDrawable;
-import android.os.Build;
-import android.preference.Preference;
-import android.preference.PreferenceCategory;
-import android.util.AttributeSet;
-import android.util.Log;
-import org.json.JSONArray;
-import org.json.JSONException;
-import org.json.JSONObject;
-import org.mozilla.gecko.GeckoAppShell;
-import org.mozilla.gecko.GeckoEvent;
-import org.mozilla.gecko.R;
-import org.mozilla.gecko.gfx.BitmapUtils;
-import org.mozilla.gecko.util.GeckoEventListener;
-
-public class SearchPreferenceCategory extends PreferenceCategory implements GeckoEventListener {
-    public static final String LOGTAG = "SearchPrefCategory";
-
-    private static int sIconSize;
-
-    public SearchPreferenceCategory(Context context, AttributeSet attrs, int defStyle) {
-        super(context, attrs, defStyle);
-        init();
-    }
-    public SearchPreferenceCategory(Context context, AttributeSet attrs) {
-        super(context, attrs);
-        init();
-    }
-
-    public SearchPreferenceCategory(Context context) {
-        super(context);
-        init();
-    }
-
-    private void init() {
-        sIconSize = getContext().getResources().getDimensionPixelSize(R.dimen.searchpreferences_icon_size);
-    }
-
-    @Override
-    protected void onAttachedToActivity() {
-        super.onAttachedToActivity();
-
-        // Request list of search engines from Gecko
-        GeckoAppShell.registerEventListener("SearchEngines:Data", this);
-        GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("SearchEngines:Get", null));
-    }
-
-    @Override
-    public void handleMessage(String event, final JSONObject data) {
-        if (event.equals("SearchEngines:Data")) {
-            JSONArray engines;
-            try {
-                engines = data.getJSONArray("searchEngines");
-            } catch (JSONException e) {
-                Log.e(LOGTAG, "Unable to decode search engine data from Gecko.", e);
-                return;
-            }
-
-            // Create an element in this PreferenceCategory for each engine.
-            for (int i = 0; i < engines.length(); i++) {
-                try {
-                    JSONObject engineJSON = engines.getJSONObject(i);
-                    final String engineName = engineJSON.getString("name");
-
-                    Preference engine = new Preference(getContext());
-                    engine.setTitle(engineName);
-                    engine.setKey(engineName);
-
-                    // The setIcon feature is not available prior to API 11.
-                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.HONEYCOMB) {
-                        String iconURI = engineJSON.getString("iconURI");
-                        Bitmap iconBitmap = BitmapUtils.getBitmapFromDataURI(iconURI);
-                        Bitmap scaledIconBitmap = Bitmap.createScaledBitmap(iconBitmap, sIconSize, sIconSize, false);
-                        BitmapDrawable drawable = new BitmapDrawable(scaledIconBitmap);
-                        engine.setIcon(drawable);
-                    }
-                    addPreference(engine);
-                    // TODO: Bug 892113 - Add event listener here for tapping on each element. Produce a dialog to provide options.
-                } catch (JSONException e) {
-                    Log.e(LOGTAG, "JSONException parsing engine at index " + i, e);
-                }
-            }
-        }
-    }
-}
diff --git a/mobile/android/base/resources/values/dimens.xml b/mobile/android/base/resources/values/dimens.xml
index 8d9670aa1b40..592d6278a904 100644
--- a/mobile/android/base/resources/values/dimens.xml
+++ b/mobile/android/base/resources/values/dimens.xml
@@ -61,7 +61,6 @@
     <dimen name="prompt_service_min_list_item_height">48dp</dimen>
     <dimen name="remote_tab_child_row_height">64dp</dimen>
     <dimen name="remote_tab_group_row_height">26dp</dimen>
-    <dimen name="searchpreferences_icon_size">32dp</dimen>
     <dimen name="tab_thumbnail_height">90dp</dimen>
     <dimen name="tab_thumbnail_width">160dp</dimen>
     <dimen name="tabs_counter_size">22sp</dimen>
diff --git a/mobile/android/base/resources/xml-v11/preferences_customize_tablet.xml b/mobile/android/base/resources/xml-v11/preferences_customize_tablet.xml
index 48f10bdf1768..40977f940932 100644
--- a/mobile/android/base/resources/xml-v11/preferences_customize_tablet.xml
+++ b/mobile/android/base/resources/xml-v11/preferences_customize_tablet.xml
@@ -14,12 +14,6 @@
     <org.mozilla.gecko.SyncPreference android:title="@string/pref_sync"
                                       android:persistent="false" />
 
-    <PreferenceScreen android:title="@string/pref_category_search"
-                      android:fragment="org.mozilla.gecko.GeckoPreferenceFragment" >
-        <extra android:name="resource"
-               android:value="preferences_search"/>
-    </PreferenceScreen>
-
     <org.mozilla.gecko.AndroidImportPreference
             android:key="android.not_a_preference.import_android"
             gecko:entries="@array/pref_import_android_entries"
@@ -30,10 +24,10 @@
             android:negativeButtonText="@string/button_cancel"
             android:persistent="false" />
 
-    <CheckBoxPreference android:key="android.not_a_preference.restoreSession"
-                        android:title="@string/pref_restore_session"
-                        android:defaultValue="false"
-                        android:persistent="true" />
+    <CheckBoxPreference android:key="browser.search.suggest.enabled"
+                        android:title="@string/pref_search_suggestions"
+                        android:defaultValue="true"
+                        android:persistent="false" />
 
     <ListPreference android:key="app.update.autodownload"
                     android:title="@string/pref_update_autodownload"
diff --git a/mobile/android/base/resources/xml-v11/preferences_customize.xml b/mobile/android/base/resources/xml/preferences_customize.xml
similarity index 85%
rename from mobile/android/base/resources/xml-v11/preferences_customize.xml
rename to mobile/android/base/resources/xml/preferences_customize.xml
index 3898b575ba7e..a1494da03d12 100644
--- a/mobile/android/base/resources/xml-v11/preferences_customize.xml
+++ b/mobile/android/base/resources/xml/preferences_customize.xml
@@ -7,12 +7,6 @@
                   xmlns:gecko="http://schemas.android.com/apk/res-auto"
                   android:enabled="false">
 
-     <PreferenceScreen android:title="@string/pref_category_search"
-                       android:fragment="org.mozilla.gecko.GeckoPreferenceFragment" >
-         <extra android:name="resource"
-                android:value="preferences_search"/>
-     </PreferenceScreen>
-
     <org.mozilla.gecko.AndroidImportPreference
                   android:key="android.not_a_preference.import_android"
                   gecko:entries="@array/pref_import_android_entries"
@@ -23,6 +17,11 @@
                   android:negativeButtonText="@string/button_cancel"
                   android:persistent="false" />
 
+    <CheckBoxPreference android:key="browser.search.suggest.enabled"
+                        android:title="@string/pref_search_suggestions"
+                        android:defaultValue="true"
+                        android:persistent="false" />
+
     <CheckBoxPreference android:key="android.not_a_preference.restoreSession"
                         android:title="@string/pref_restore_session"
                         android:defaultValue="false"
diff --git a/mobile/android/base/resources/xml/preferences_customize.xml.in b/mobile/android/base/resources/xml/preferences_customize.xml.in
deleted file mode 100644
index be69d7b3ad2c..000000000000
--- a/mobile/android/base/resources/xml/preferences_customize.xml.in
+++ /dev/null
@@ -1,42 +0,0 @@
-#filter substitution
-<?xml version="1.0" encoding="utf-8"?>
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
-   - License, v. 2.0. If a copy of the MPL was not distributed with this
-   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-
-<PreferenceScreen xmlns:android="http://schemas.android.com/apk/res/android"
-                  xmlns:gecko="http://schemas.android.com/apk/res-auto"
-                  android:enabled="false">
-    <PreferenceScreen android:title="@string/pref_category_search" >
-        <intent android:action="android.intent.action.VIEW"
-                android:targetPackage="@ANDROID_PACKAGE_NAME@"
-                android:targetClass="org.mozilla.gecko.GeckoPreferences" >
-            <extra
-                android:name="resource"
-                android:value="preferences_search" />
-        </intent>
-    </PreferenceScreen>
-
-    <org.mozilla.gecko.AndroidImportPreference
-                  android:key="android.not_a_preference.import_android"
-                  gecko:entries="@array/pref_import_android_entries"
-                  gecko:entryKeys="@array/pref_import_android_keys"
-                  gecko:initialValues="@array/pref_import_android_values"
-                  android:title="@string/pref_import_android"
-                  android:positiveButtonText="@string/bookmarkhistory_button_import"
-                  android:negativeButtonText="@string/button_cancel"
-                  android:persistent="false" />
-
-    <CheckBoxPreference android:key="android.not_a_preference.restoreSession"
-                        android:title="@string/pref_restore_session"
-                        android:defaultValue="false"
-                        android:persistent="true" />
-
-   <ListPreference android:key="app.update.autodownload"
-                   android:title="@string/pref_update_autodownload"
-                   android:entries="@array/pref_update_autodownload_entries"
-                   android:entryValues="@array/pref_update_autodownload_values"
-                   android:persistent="false" />
-
-</PreferenceScreen>
-
diff --git a/mobile/android/base/resources/xml/preferences_search.xml b/mobile/android/base/resources/xml/preferences_search.xml
deleted file mode 100644
index 721aefbfda00..000000000000
--- a/mobile/android/base/resources/xml/preferences_search.xml
+++ /dev/null
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
-   - License, v. 2.0. If a copy of the MPL was not distributed with this
-   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-
-<PreferenceScreen xmlns:android="http://schemas.android.com/apk/res/android"
-                  xmlns:gecko="http://schemas.android.com/apk/res-auto"
-                  android:title="@string/pref_category_search"
-                  android:enabled="false">
-
-    <CheckBoxPreference android:key="browser.search.suggest.enabled"
-                        android:title="@string/pref_search_suggestions"
-                        android:defaultValue="false"
-                        android:persistent="false" />
-
-    <org.mozilla.gecko.preferences.SearchPreferenceCategory
-                        android:title="@string/pref_category_installed_search_engines"/>
-</PreferenceScreen>
diff --git a/mobile/android/base/strings.xml.in b/mobile/android/base/strings.xml.in
index 428dc4e223ec..efa1ec131cfb 100644
--- a/mobile/android/base/strings.xml.in
+++ b/mobile/android/base/strings.xml.in
@@ -80,12 +80,10 @@
   <string name="settings">&settings;</string>
   <string name="settings_title">&settings_title;</string>
   <string name="pref_category_customize">&pref_category_customize;</string>
-  <string name="pref_category_search">&pref_category_search;</string>
   <string name="pref_category_display">&pref_category_display;</string>
   <string name="pref_category_privacy_short">&pref_category_privacy_short;</string>
   <string name="pref_category_vendor">&pref_category_vendor;</string>
   <string name="pref_category_datareporting">&pref_category_datareporting;</string>
-  <string name="pref_category_installed_search_engines">&pref_category_installed_search_engines;</string>
 
   <string name="pref_header_customize">&pref_header_customize;</string>
   <string name="pref_header_display">&pref_header_display;</string>

From c02b487588b5a97f6aa263b99f518dd7a2677ee4 Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Tue, 16 Jul 2013 16:54:10 -0400
Subject: [PATCH 35/37] Backed out changeset 8bbd27688a89 (bug 870406) for
 Linux bustage.

---
 mozglue/build/Makefile.in            |  5 +++++
 mozglue/build/moz.build              |  4 ----
 security/manager/ssl/src/Makefile.in |  1 +
 security/manager/ssl/src/moz.build   |  5 +----
 tools/trace-malloc/Makefile.in       |  1 +
 tools/trace-malloc/lib/Makefile.in   |  4 ++++
 tools/trace-malloc/lib/moz.build     |  3 ---
 tools/trace-malloc/moz.build         | 11 -----------
 widget/gtk2/Makefile.in              | 14 ++++++++++++++
 widget/gtk2/moz.build                | 14 +-------------
 widget/gtkxtbin/Makefile.in          |  6 ++++++
 widget/gtkxtbin/moz.build            |  5 -----
 widget/shared/x11/Makefile.in        |  5 +++++
 widget/shared/x11/moz.build          |  3 ---
 14 files changed, 38 insertions(+), 43 deletions(-)

diff --git a/mozglue/build/Makefile.in b/mozglue/build/Makefile.in
index 92ab99b5d7d0..33c19d641415 100644
--- a/mozglue/build/Makefile.in
+++ b/mozglue/build/Makefile.in
@@ -11,6 +11,7 @@ VPATH		= @srcdir@
 include $(DEPTH)/config/autoconf.mk
 
 DIST_INSTALL = 1
+
 # Build mozglue as a shared lib on Windows, OSX and Android.
 # If this is ever changed, update MOZ_SHARED_MOZGLUE in browser/installer/Makefile.in
 ifneq (,$(filter WINNT Darwin Android,$(OS_TARGET)))
@@ -94,6 +95,10 @@ SHARED_LIBRARY_LIBS += $(call EXPAND_LIBNAME_PATH,android,../android)
 EXTRA_DSO_LDOPTS += -Wl,--wrap=pthread_atfork
 endif
 
+ifeq (gonk, $(MOZ_WIDGET_TOOLKIT))
+CSRCS += cpuacct.c
+endif
+
 ifdef MOZ_LINKER
 # Add custom dynamic linker
 SHARED_LIBRARY_LIBS += $(call EXPAND_LIBNAME_PATH,linker,../linker)
diff --git a/mozglue/build/moz.build b/mozglue/build/moz.build
index f578d1fe0636..0671669107bf 100644
--- a/mozglue/build/moz.build
+++ b/mozglue/build/moz.build
@@ -32,7 +32,3 @@ if CONFIG['OS_TARGET'] == 'Android':
 
 LIBRARY_NAME = 'mozglue'
 
-if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk':
-    CSRCS += [
-        'cpuacct.c',
-    ]
diff --git a/security/manager/ssl/src/Makefile.in b/security/manager/ssl/src/Makefile.in
index 90522586ac26..2b578ee4f135 100644
--- a/security/manager/ssl/src/Makefile.in
+++ b/security/manager/ssl/src/Makefile.in
@@ -13,6 +13,7 @@ include $(DEPTH)/config/autoconf.mk
 
 EXPORT_LIBRARY	= 1
 LIBXUL_LIBRARY	= 1
+CSRCS += md4.c
 
 DEFINES += \
   -DNSS_ENABLE_ECC \
diff --git a/security/manager/ssl/src/moz.build b/security/manager/ssl/src/moz.build
index 9400550c75e7..1e7954184c01 100644
--- a/security/manager/ssl/src/moz.build
+++ b/security/manager/ssl/src/moz.build
@@ -66,7 +66,7 @@ CPP_SOURCES += [
     'nsStreamCipher.cpp',
     'nsTLSSocketProvider.cpp',
     'nsUsageArrayHelper.cpp',
-    'PSMContentListener.cpp',
+	'PSMContentListener.cpp',
     'PSMRunnable.cpp',
     'SharedSSLState.cpp',
     'SSLServerCertVerification.cpp',
@@ -85,6 +85,3 @@ if CONFIG['MOZ_XUL']:
 
 LIBRARY_NAME = 'pipnss'
 
-CSRCS += [
-    'md4.c',
-]
diff --git a/tools/trace-malloc/Makefile.in b/tools/trace-malloc/Makefile.in
index 1ac45d3279ad..999b7763667e 100644
--- a/tools/trace-malloc/Makefile.in
+++ b/tools/trace-malloc/Makefile.in
@@ -40,6 +40,7 @@ PROGCSRCS = \
 PROGOBJS = $(PROGCSRCS:.c=.$(OBJ_SUFFIX))
 endif
 
+CSRCS = $(SIMPLECSRCS) $(EXTRACSRCS) $(PROGCSRCS)
 ifeq ($(OS_ARCH),WINNT)
 LOCAL_INCLUDES	+= -I$(topsrcdir)/config/os2
 endif
diff --git a/tools/trace-malloc/lib/Makefile.in b/tools/trace-malloc/lib/Makefile.in
index afa8a2a139d2..b46b484855da 100644
--- a/tools/trace-malloc/lib/Makefile.in
+++ b/tools/trace-malloc/lib/Makefile.in
@@ -17,6 +17,10 @@ LIBXUL_LIBRARY	= 1
 
 STL_FLAGS	=
 
+CSRCS		= \
+		nsTraceMalloc.c \
+		$(NULL)
+
 DEFINES		+= -DMOZ_NO_MOZALLOC
 
 ifdef WRAP_SYSTEM_INCLUDES
diff --git a/tools/trace-malloc/lib/moz.build b/tools/trace-malloc/lib/moz.build
index 747fe542a4e2..c4e57073c757 100644
--- a/tools/trace-malloc/lib/moz.build
+++ b/tools/trace-malloc/lib/moz.build
@@ -22,6 +22,3 @@ if CONFIG['OS_ARCH'] == 'WINNT':
 
 LIBRARY_NAME = 'tracemalloc'
 
-CSRCS += [
-    'nsTraceMalloc.c',
-]
diff --git a/tools/trace-malloc/moz.build b/tools/trace-malloc/moz.build
index c8211ebf4af0..c4fc5e838155 100644
--- a/tools/trace-malloc/moz.build
+++ b/tools/trace-malloc/moz.build
@@ -6,19 +6,8 @@
 
 if not CONFIG['MOZ_PROFILE_GENERATE']:
     PROGRAM = 'spacetrace'
-    CSRCS += [
-        'formdata.c',
-        'spacecategory.c',
-        'spacetrace.c',
-    ]
 
 CPP_SOURCES += [
     '$(EXTRACPPSRCS)',
     '$(SIMPLECPPSRCS)',
 ]
-
-CSRCS += [
-    'leakstats.c',
-    'tmreader.c',
-    'tmstats.c',
-]        
diff --git a/widget/gtk2/Makefile.in b/widget/gtk2/Makefile.in
index 6840d505a7dc..903286d02c92 100644
--- a/widget/gtk2/Makefile.in
+++ b/widget/gtk2/Makefile.in
@@ -21,11 +21,25 @@ LIBXUL_LIBRARY = 1
 
 NATIVE_THEME_SUPPORT = 1
 
+
+
+CSRCS		= \
+		mozcontainer.c \
+		$(NULL)
+
+ifdef ACCESSIBILITY
+CSRCS += maiRedundantObjectFactory.c
+endif
 # build our subdirs, too
 
 SHARED_LIBRARY_LIBS = ../xpwidgets/libxpwidgets_s.a
 
 ifdef NATIVE_THEME_SUPPORT
+ifdef MOZ_ENABLE_GTK2
+CSRCS		+= gtk2drawing.c
+else
+CSRCS		+= gtk3drawing.c
+endif
 DEFINES		+= -DNATIVE_THEME_SUPPORT
 endif
 
diff --git a/widget/gtk2/moz.build b/widget/gtk2/moz.build
index 09fc648710e9..6a7fea1d577c 100644
--- a/widget/gtk2/moz.build
+++ b/widget/gtk2/moz.build
@@ -53,17 +53,5 @@ if CONFIG['MOZ_X11']:
         'nsDragService.cpp',
     ]
 
-CSRCS += [
-    'mozcontainer.c',
+CPP_SOURCES += [
 ]
-
-if CONFIG['ACCESSIBILITY']:
-    CSRCS += [
-        'maiRedundantObjectFactory.c',
-    ]
-
-if CONFIG['MOZ_ENABLE_GTK2']:
-    CSRCS += [
-        'gtk2drawing.c',
-        'gtk3drawing.c',
-    ]
diff --git a/widget/gtkxtbin/Makefile.in b/widget/gtkxtbin/Makefile.in
index 66cca4104a62..a1ba37e3a37f 100644
--- a/widget/gtkxtbin/Makefile.in
+++ b/widget/gtkxtbin/Makefile.in
@@ -14,6 +14,12 @@ include $(DEPTH)/config/autoconf.mk
 EXPORT_LIBRARY = 1
 LIBXUL_LIBRARY = 1
 
+ifdef MOZ_ENABLE_GTK2
+CSRCS		= \
+		gtk2xtbin.c \
+		$(NULL)
+endif
+
 include $(topsrcdir)/config/rules.mk
 
 ifdef MOZ_ENABLE_GTK2
diff --git a/widget/gtkxtbin/moz.build b/widget/gtkxtbin/moz.build
index 6004ca683f88..5e9a3c87c1a8 100644
--- a/widget/gtkxtbin/moz.build
+++ b/widget/gtkxtbin/moz.build
@@ -12,8 +12,3 @@ EXPORTS += [
 
 LIBRARY_NAME = 'gtkxtbin'
 
-
-if CONFIG['MOZ_ENABLE_GTK2']:
-    CSRCS += [
-        'gtk2xtbin.c',
-    ]
diff --git a/widget/shared/x11/Makefile.in b/widget/shared/x11/Makefile.in
index a96382d4b857..819b6fc06f30 100644
--- a/widget/shared/x11/Makefile.in
+++ b/widget/shared/x11/Makefile.in
@@ -13,6 +13,11 @@ include $(DEPTH)/config/autoconf.mk
 LIBRARY_NAME   = widget_shared_x11
 LIBXUL_LIBRARY  = 1
 
+
+CSRCS      = \
+       keysym2ucs.c \
+       $(NULL)
+
 include $(topsrcdir)/config/rules.mk
 
 CXXFLAGS   += $(TK_CFLAGS)
diff --git a/widget/shared/x11/moz.build b/widget/shared/x11/moz.build
index 493294822e15..41a76827ca6f 100644
--- a/widget/shared/x11/moz.build
+++ b/widget/shared/x11/moz.build
@@ -6,6 +6,3 @@
 
 MODULE = 'widget'
 
-CSRCS += [
-    'keysym2ucs.c',
-]

From 8eafa906d7f9fdbcddfdc2547a3e9def4803dc93 Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Tue, 16 Jul 2013 17:18:15 -0400
Subject: [PATCH 36/37] Backed out changeset 71233da022ea (bug 763903) for
 checktest orange on a CLOSED TREE.

---
 build/compare-mozconfig/compare-mozconfigs-wrapper.py | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/build/compare-mozconfig/compare-mozconfigs-wrapper.py b/build/compare-mozconfig/compare-mozconfigs-wrapper.py
index 8903c5efee23..90a4018aeb71 100644
--- a/build/compare-mozconfig/compare-mozconfigs-wrapper.py
+++ b/build/compare-mozconfig/compare-mozconfigs-wrapper.py
@@ -51,7 +51,3 @@ def main():
                                     whitelist_path, '--no-download',
                                     platform + ',' + release_mozconfig_path +
                                     ',' + nightly_mozconfig_path])
-        sys.exit(ret_code)
-
-if __name__ == '__main__':
-    main()

From 8699441f2ffef7e89a6d5555ad925d978dcf5585 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Tue, 16 Jul 2013 17:04:36 -0700
Subject: [PATCH 37/37] Bug 878607 - Backout aeb89583349d (bug 887814) for
 breaking bootstrap on MacPorts; r=jwatt

DONTBUILD (NPOTB)
---
 python/mozboot/mozboot/osx.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/mozboot/mozboot/osx.py b/python/mozboot/mozboot/osx.py
index a4c917d32da6..8aa2d26b70b4 100644
--- a/python/mozboot/mozboot/osx.py
+++ b/python/mozboot/mozboot/osx.py
@@ -240,7 +240,7 @@ class OSXBootstrapper(BaseBootstrapper):
             self.run_as_root([self.port, '-v', 'install', MACPORTS_CLANG_PACKAGE])
 
         self.run_as_root([self.port, 'select', '--set', 'python', 'python27'])
-        self.run_as_root([self.port, 'select', '--set', 'clang', MACPORTS_CLANG_PACKAGE])
+        self.run_as_root([self.port, 'select', '--set', 'clang', 'mp-' + MACPORTS_CLANG_PACKAGE])
 
     def ensure_package_manager(self):
         '''