diff --git a/accessible/atk/AccessibleWrap.cpp b/accessible/atk/AccessibleWrap.cpp
index e379b371370e..4158da5d4863 100644
--- a/accessible/atk/AccessibleWrap.cpp
+++ b/accessible/atk/AccessibleWrap.cpp
@@ -1042,14 +1042,17 @@ refRelationSetCB(AtkObject *aAtkObj)
 AccessibleWrap*
 GetAccessibleWrap(AtkObject* aAtkObj)
 {
-  NS_ENSURE_TRUE(IS_MAI_OBJECT(aAtkObj), nullptr);
+  bool isMAIObject = IS_MAI_OBJECT(aAtkObj);
+  NS_ENSURE_TRUE(isMAIObject || MAI_IS_ATK_SOCKET(aAtkObj),
+                 nullptr);
 
-  // Make sure its native is an AccessibleWrap not a proxy.
-  if (MAI_ATK_OBJECT(aAtkObj)->accWrap & IS_PROXY)
+  uintptr_t accWrapPtr = isMAIObject ?
+    MAI_ATK_OBJECT(aAtkObj)->accWrap :
+    reinterpret_cast<uintptr_t>(MAI_ATK_SOCKET(aAtkObj)->accWrap);
+  if (accWrapPtr & IS_PROXY)
     return nullptr;
 
-    AccessibleWrap* accWrap =
-      reinterpret_cast<AccessibleWrap*>(MAI_ATK_OBJECT(aAtkObj)->accWrap);
+  AccessibleWrap* accWrap = reinterpret_cast<AccessibleWrap*>(accWrapPtr);
 
   // Check if the accessible was deconstructed.
   if (!accWrap)
@@ -1067,7 +1070,8 @@ GetAccessibleWrap(AtkObject* aAtkObj)
 ProxyAccessible*
 GetProxy(AtkObject* aObj)
 {
-  if (!aObj || !(MAI_ATK_OBJECT(aObj)->accWrap & IS_PROXY))
+  if (!aObj || !IS_MAI_OBJECT(aObj) ||
+      !(MAI_ATK_OBJECT(aObj)->accWrap & IS_PROXY))
     return nullptr;
 
   return reinterpret_cast<ProxyAccessible*>(MAI_ATK_OBJECT(aObj)->accWrap
diff --git a/accessible/atk/AtkSocketAccessible.cpp b/accessible/atk/AtkSocketAccessible.cpp
index 7c049b94ca3f..95c3075e8048 100644
--- a/accessible/atk/AtkSocketAccessible.cpp
+++ b/accessible/atk/AtkSocketAccessible.cpp
@@ -21,35 +21,6 @@ const char* AtkSocketAccessible::sATKSocketGetTypeSymbol = "atk_socket_get_type"
 bool AtkSocketAccessible::gCanEmbed = FALSE;
 
 extern "C" void mai_atk_component_iface_init(AtkComponentIface* aIface);
-extern "C" GType mai_atk_socket_get_type(void);
-
-/* MaiAtkSocket */
-
-#define MAI_TYPE_ATK_SOCKET              (mai_atk_socket_get_type ())
-#define MAI_ATK_SOCKET(obj)              (G_TYPE_CHECK_INSTANCE_CAST ((obj),\
-                                          MAI_TYPE_ATK_SOCKET, MaiAtkSocket))
-#define MAI_IS_ATK_SOCKET(obj)           (G_TYPE_CHECK_INSTANCE_TYPE ((obj),\
-                                          MAI_TYPE_ATK_SOCKET))
-#define MAI_ATK_SOCKET_CLASS(klass)      (G_TYPE_CHECK_CLASS_CAST ((klass),\
-                                          MAI_TYPE_ATK_SOCKET,\
-                                          MaiAtkSocketClass))
-#define MAI_IS_ATK_SOCKET_CLASS(klass)   (G_TYPE_CHECK_CLASS_TYPE ((klass),\
-                                          MAI_TYPE_ATK_SOCKET))
-#define MAI_ATK_SOCKET_GET_CLASS(obj)    (G_TYPE_INSTANCE_GET_CLASS ((obj),\
-                                          MAI_TYPE_ATK_SOCKET,\
-                                          MaiAtkSocketClass))
-
-typedef struct _MaiAtkSocket
-{
-  AtkSocket parent;
-
-  AccessibleWrap* accWrap;
-} MaiAtkSocket;
-
-typedef struct _MaiAtkSocketClass
-{
-  AtkSocketClass parent_class;
-} MaiAtkSocketClass;
 
 G_DEFINE_TYPE_EXTENDED(MaiAtkSocket, mai_atk_socket,
                        AtkSocketAccessible::g_atk_socket_type, 0,
@@ -86,7 +57,7 @@ RefAccessibleAtPoint(AtkComponent* aComponent, gint aX, gint aY,
 {
   NS_ENSURE_TRUE(MAI_IS_ATK_SOCKET(aComponent), nullptr);
 
-  return refAccessibleAtPointHelper(MAI_ATK_SOCKET(aComponent)->accWrap,
+  return refAccessibleAtPointHelper(ATK_OBJECT(MAI_ATK_SOCKET(aComponent)),
                                     aX, aY, aCoordType);
 }
 
@@ -99,7 +70,7 @@ GetExtents(AtkComponent* aComponent, gint* aX, gint* aY, gint* aWidth,
   if (!MAI_IS_ATK_SOCKET(aComponent))
     return;
 
-  getExtentsHelper(MAI_ATK_SOCKET(aComponent)->accWrap,
+  getExtentsHelper(ATK_OBJECT(MAI_ATK_SOCKET(aComponent)),
                    aX, aY, aWidth, aHeight, aCoordType);
 }
 }
diff --git a/accessible/atk/InterfaceInitFuncs.h b/accessible/atk/InterfaceInitFuncs.h
index 805001e8222d..4714018cc427 100644
--- a/accessible/atk/InterfaceInitFuncs.h
+++ b/accessible/atk/InterfaceInitFuncs.h
@@ -34,9 +34,9 @@ void valueInterfaceInitCB(AtkValueIface *aIface);
 /**
  * XXX these should live in a file of utils for atk.
  */
-AtkObject* refAccessibleAtPointHelper(mozilla::a11y::AccessibleWrap* aAccWrap,
+AtkObject* refAccessibleAtPointHelper(AtkObject* aAtkObj,
                                       gint aX, gint aY, AtkCoordType aCoordType);
-void getExtentsHelper(mozilla::a11y::AccessibleWrap* aAccWrap,
+void getExtentsHelper(AtkObject* aAtkObj,
                       gint* aX, gint* aY, gint* aWidth, gint* aHeight,
                       AtkCoordType aCoordType);
 
diff --git a/accessible/atk/nsMai.h b/accessible/atk/nsMai.h
index aba96a4b38c7..4618524f7cf1 100644
--- a/accessible/atk/nsMai.h
+++ b/accessible/atk/nsMai.h
@@ -34,6 +34,36 @@ class ProxyAccessible;
                                          MaiAtkObjectClass))
 GType mai_atk_object_get_type(void);
 GType mai_util_get_type();
+extern "C" GType mai_atk_socket_get_type(void);
+
+/* MaiAtkSocket */
+
+#define MAI_TYPE_ATK_SOCKET              (mai_atk_socket_get_type ())
+#define MAI_ATK_SOCKET(obj)              (G_TYPE_CHECK_INSTANCE_CAST ((obj),\
+                                          MAI_TYPE_ATK_SOCKET, MaiAtkSocket))
+#define MAI_IS_ATK_SOCKET(obj)           (G_TYPE_CHECK_INSTANCE_TYPE ((obj),\
+                                          MAI_TYPE_ATK_SOCKET))
+#define MAI_ATK_SOCKET_CLASS(klass)      (G_TYPE_CHECK_CLASS_CAST ((klass),\
+                                          MAI_TYPE_ATK_SOCKET,\
+                                          MaiAtkSocketClass))
+#define MAI_IS_ATK_SOCKET_CLASS(klass)   (G_TYPE_CHECK_CLASS_TYPE ((klass),\
+                                          MAI_TYPE_ATK_SOCKET))
+#define MAI_ATK_SOCKET_GET_CLASS(obj)    (G_TYPE_INSTANCE_GET_CLASS ((obj),\
+                                          MAI_TYPE_ATK_SOCKET,\
+                                          MaiAtkSocketClass))
+
+typedef struct _MaiAtkSocket
+{
+  AtkSocket parent;
+
+  mozilla::a11y::AccessibleWrap* accWrap;
+} MaiAtkSocket;
+
+typedef struct _MaiAtkSocketClass
+{
+  AtkSocketClass parent_class;
+} MaiAtkSocketClass;
+
 mozilla::a11y::AccessibleWrap* GetAccessibleWrap(AtkObject* aAtkObj);
 mozilla::a11y::ProxyAccessible* GetProxy(AtkObject* aAtkObj);
 AtkObject* GetWrapperFor(mozilla::a11y::ProxyAccessible* aProxy);
diff --git a/accessible/atk/nsMaiInterfaceComponent.cpp b/accessible/atk/nsMaiInterfaceComponent.cpp
index 6a925e70ddb9..efd8eb65cd2b 100644
--- a/accessible/atk/nsMaiInterfaceComponent.cpp
+++ b/accessible/atk/nsMaiInterfaceComponent.cpp
@@ -11,6 +11,7 @@
 #include "nsCoreUtils.h"
 #include "nsMai.h"
 #include "mozilla/Likely.h"
+#include "mozilla/a11y/ProxyAccessible.h"
 
 using namespace mozilla::a11y;
 
@@ -20,7 +21,7 @@ static AtkObject*
 refAccessibleAtPointCB(AtkComponent* aComponent, gint aAccX, gint aAccY,
                        AtkCoordType aCoordType)
 {
-  return refAccessibleAtPointHelper(GetAccessibleWrap(ATK_OBJECT(aComponent)),
+  return refAccessibleAtPointHelper(ATK_OBJECT(aComponent),
                                     aAccX, aAccY, aCoordType);
 }
 
@@ -28,73 +29,109 @@ static void
 getExtentsCB(AtkComponent* aComponent, gint* aX, gint* aY,
              gint* aWidth, gint* aHeight, AtkCoordType aCoordType)
 {
-  getExtentsHelper(GetAccessibleWrap(ATK_OBJECT(aComponent)),
+  getExtentsHelper(ATK_OBJECT(aComponent),
                    aX, aY, aWidth, aHeight, aCoordType);
 }
 
 static gboolean
 grabFocusCB(AtkComponent* aComponent)
 {
-  AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aComponent));
-  if (!accWrap)
-    return FALSE;
+  AtkObject* atkObject = ATK_OBJECT(aComponent);
+  AccessibleWrap* accWrap = GetAccessibleWrap(atkObject);
+  if (accWrap) {
+    accWrap->TakeFocus();
+    return TRUE;
+  }
 
-  accWrap->TakeFocus();
-  return TRUE;
+  ProxyAccessible* proxy = GetProxy(atkObject);
+  if (proxy) {
+    proxy->TakeFocus();
+    return TRUE;
+  }
+
+  return FALSE;
 }
 }
 
 AtkObject*
-refAccessibleAtPointHelper(AccessibleWrap* aAccWrap, gint aX, gint aY,
+refAccessibleAtPointHelper(AtkObject* aAtkObj, gint aX, gint aY,
                            AtkCoordType aCoordType)
 {
-  if (!aAccWrap || aAccWrap->IsDefunct() || nsAccUtils::MustPrune(aAccWrap))
-    return nullptr;
+  AccessibleWrap* accWrap = GetAccessibleWrap(aAtkObj);
+  if (accWrap) {
+    if (accWrap->IsDefunct() || nsAccUtils::MustPrune(accWrap)) {
+      return nullptr;
+    }
 
-  // Accessible::ChildAtPoint(x,y) is in screen pixels.
-  if (aCoordType == ATK_XY_WINDOW) {
-    nsIntPoint winCoords =
-      nsCoreUtils::GetScreenCoordsForWindow(aAccWrap->GetNode());
-    aX += winCoords.x;
-    aY += winCoords.y;
+    // Accessible::ChildAtPoint(x,y) is in screen pixels.
+    if (aCoordType == ATK_XY_WINDOW) {
+      nsIntPoint winCoords =
+        nsCoreUtils::GetScreenCoordsForWindow(accWrap->GetNode());
+      aX += winCoords.x;
+      aY += winCoords.y;
+    }
+
+    Accessible* accAtPoint = accWrap->ChildAtPoint(aX, aY,
+                                                   Accessible::eDirectChild);
+    if (!accAtPoint) {
+      return nullptr;
+    }
+
+    AtkObject* atkObj = AccessibleWrap::GetAtkObject(accAtPoint);
+    if (atkObj) {
+      g_object_ref(atkObj);
+    }
+
+    return atkObj;
   }
 
-  Accessible* accAtPoint = aAccWrap->ChildAtPoint(aX, aY,
-                                                  Accessible::eDirectChild);
-  if (!accAtPoint)
-    return nullptr;
+  if (ProxyAccessible* proxy = GetProxy(aAtkObj)) {
+    ProxyAccessible* result =
+      proxy->AccessibleAtPoint(aX, aY, aCoordType == ATK_XY_WINDOW);
+    AtkObject* atkObj = result ? GetWrapperFor(result) : nullptr;
+    if (atkObj) {
+      g_object_ref(atkObj);
+    }
+    return atkObj;
+  }
 
-  AtkObject* atkObj = AccessibleWrap::GetAtkObject(accAtPoint);
-  if (atkObj)
-    g_object_ref(atkObj);
-  return atkObj;
+  return nullptr;
 }
 
 void
-getExtentsHelper(AccessibleWrap* aAccWrap,
+getExtentsHelper(AtkObject* aAtkObj,
                  gint* aX, gint* aY, gint* aWidth, gint* aHeight,
                  AtkCoordType aCoordType)
 {
+  AccessibleWrap* accWrap = GetAccessibleWrap(aAtkObj);
   *aX = *aY = *aWidth = *aHeight = 0;
 
-  if (!aAccWrap || aAccWrap->IsDefunct())
-    return;
+  if (accWrap) {
+    if (accWrap->IsDefunct()) {
+      return;
+    }
 
-  nsIntRect screenRect = aAccWrap->Bounds();
-  if (screenRect.IsEmpty())
-    return;
+    nsIntRect screenRect = accWrap->Bounds();
+    if (screenRect.IsEmpty())
+      return;
 
-  if (aCoordType == ATK_XY_WINDOW) {
-    nsIntPoint winCoords =
-      nsCoreUtils::GetScreenCoordsForWindow(aAccWrap->GetNode());
-    screenRect.x -= winCoords.x;
-    screenRect.y -= winCoords.y;
+    if (aCoordType == ATK_XY_WINDOW) {
+      nsIntPoint winCoords =
+        nsCoreUtils::GetScreenCoordsForWindow(accWrap->GetNode());
+      screenRect.x -= winCoords.x;
+      screenRect.y -= winCoords.y;
+    }
+
+    *aX = screenRect.x;
+    *aY = screenRect.y;
+    *aWidth = screenRect.width;
+    *aHeight = screenRect.height;
+    return;
   }
 
-  *aX = screenRect.x;
-  *aY = screenRect.y;
-  *aWidth = screenRect.width;
-  *aHeight = screenRect.height;
+  if (ProxyAccessible* proxy = GetProxy(aAtkObj)) {
+    proxy->Extents(aCoordType == ATK_XY_WINDOW, aX, aY, aWidth, aHeight);
+  }
 }
 
 void
diff --git a/accessible/ipc/DocAccessibleChild.cpp b/accessible/ipc/DocAccessibleChild.cpp
index 98677f8085ae..0b1b010ef2f2 100644
--- a/accessible/ipc/DocAccessibleChild.cpp
+++ b/accessible/ipc/DocAccessibleChild.cpp
@@ -1792,42 +1792,6 @@ DocAccessibleChild::RecvFocusedChild(const uint64_t& aID,
   return true;
 }
 
-bool
-DocAccessibleChild::RecvChildAtPoint(const uint64_t& aID,
-                                     const int32_t& aX,
-                                     const int32_t& aY,
-                                     const uint32_t& aWhich,
-                                     uint64_t* aChild,
-                                     bool* aOk)
-{
-  *aChild = 0;
-  *aOk = false;
-  Accessible* acc = IdToAccessible(aID);
-  if (acc && !acc->IsDefunct() && !nsAccUtils::MustPrune(acc)) {
-    Accessible* child =
-      acc->ChildAtPoint(aX, aY,
-                        static_cast<Accessible::EWhichChildAtPoint>(aWhich));
-    if (child) {
-      *aChild = reinterpret_cast<uint64_t>(child->UniqueID());
-      *aOk = true;
-    }
-  }
-
-  return true;
-}
-
-bool
-DocAccessibleChild::RecvBounds(const uint64_t& aID,
-                               nsIntRect* aRect)
-{
-  Accessible* acc = IdToAccessible(aID);
-  if (acc && !acc->IsDefunct()) {
-    *aRect = acc->Bounds();
-  }
-
-  return false;
-}
-
 bool
 DocAccessibleChild::RecvLanguage(const uint64_t& aID,
                                  nsString* aLocale)
@@ -1906,5 +1870,71 @@ DocAccessibleChild::RecvURLDocTypeMimeType(const uint64_t& aID,
   return true;
 }
 
+bool
+DocAccessibleChild::RecvAccessibleAtPoint(const uint64_t& aID,
+                                          const int32_t& aX,
+                                          const int32_t& aY,
+                                          const bool& aNeedsScreenCoords,
+                                          const uint32_t& aWhich,
+                                          uint64_t* aResult,
+                                          bool* aOk)
+{
+  *aResult = 0;
+  *aOk = false;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc && !acc->IsDefunct() && !nsAccUtils::MustPrune(acc)) {
+    int32_t x = aX;
+    int32_t y = aY;
+    if (aNeedsScreenCoords) {
+      nsIntPoint winCoords =
+        nsCoreUtils::GetScreenCoordsForWindow(acc->GetNode());
+      x += winCoords.x;
+      y += winCoords.y;
+    }
+
+    Accessible* result =
+      acc->ChildAtPoint(x, y,
+                        static_cast<Accessible::EWhichChildAtPoint>(aWhich));
+    if (result) {
+      *aResult = reinterpret_cast<uint64_t>(result->UniqueID());
+      *aOk = true;
+    }
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvExtents(const uint64_t& aID,
+                                const bool& aNeedsScreenCoords,
+                                int32_t* aX,
+                                int32_t* aY,
+                                int32_t* aWidth,
+                                int32_t* aHeight)
+{
+  *aX = 0;
+  *aY = 0;
+  *aWidth = 0;
+  *aHeight = 0;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc && !acc->IsDefunct() && !nsAccUtils::MustPrune(acc)) {
+    nsIntRect screenRect = acc->Bounds();
+    if (!screenRect.IsEmpty()) {
+      if (aNeedsScreenCoords) {
+        nsIntPoint winCoords =
+          nsCoreUtils::GetScreenCoordsForWindow(acc->GetNode());
+        screenRect.x -= winCoords.x;
+        screenRect.y -= winCoords.y;
+      }
+
+      *aX = screenRect.x;
+      *aY = screenRect.y;
+      *aWidth = screenRect.width;
+      *aHeight = screenRect.height;
+    }
+  }
+  return true;
+}
+
 }
 }
diff --git a/accessible/ipc/DocAccessibleChild.h b/accessible/ipc/DocAccessibleChild.h
index 736195355cb3..b85c354892b0 100644
--- a/accessible/ipc/DocAccessibleChild.h
+++ b/accessible/ipc/DocAccessibleChild.h
@@ -448,15 +448,6 @@ public:
                                 uint64_t* aChild,
                                 bool* aOk) override;
 
-  virtual bool RecvChildAtPoint(const uint64_t& aID,
-                                const int32_t& aX,
-                                const int32_t& aY,
-                                const uint32_t& aWhich,
-                                uint64_t* aChild,
-                                bool* aOk) override;
-
-  virtual bool RecvBounds(const uint64_t& aID, nsIntRect* aRect) override;
-
   virtual bool RecvLanguage(const uint64_t& aID, nsString* aLocale) override;
   virtual bool RecvDocType(const uint64_t& aID, nsString* aType) override;
   virtual bool RecvTitle(const uint64_t& aID, nsString* aTitle) override;
@@ -466,6 +457,21 @@ public:
                                       nsString* aURL,
                                       nsString* aDocType,
                                       nsString* aMimeType) override;
+
+  virtual bool RecvAccessibleAtPoint(const uint64_t& aID,
+                                     const int32_t& aX,
+                                     const int32_t& aY,
+                                     const bool& aNeedsScreenCoords,
+                                     const uint32_t& aWhich,
+                                     uint64_t* aResult,
+                                     bool* aOk) override;
+
+  virtual bool RecvExtents(const uint64_t& aID,
+                           const bool& aNeedsScreenCoords,
+                           int32_t* aX,
+                           int32_t* aY,
+                           int32_t* aWidth,
+                           int32_t* aHeight) override;
 private:
 
   Accessible* IdToAccessible(const uint64_t& aID) const;
diff --git a/accessible/ipc/PDocAccessible.ipdl b/accessible/ipc/PDocAccessible.ipdl
index 9120366a543c..8938aa28038a 100644
--- a/accessible/ipc/PDocAccessible.ipdl
+++ b/accessible/ipc/PDocAccessible.ipdl
@@ -233,9 +233,6 @@ child:
     returns(uint64_t aChild);
   prio(high) sync FocusedChild(uint64_t aID)
     returns(uint64_t aChild, bool aOk);
-  prio(high) sync ChildAtPoint(uint64_t aID, int32_t aX, int32_t aY, uint32_t aWhich)
-    returns(uint64_t aChild, bool aOk);
-  prio(high) sync Bounds(uint64_t aID) returns(nsIntRect aRect);
 
   prio(high) sync Language(uint64_t aID) returns(nsString aLocale);
   prio(high) sync DocType(uint64_t aID) returns(nsString aType);
@@ -243,6 +240,12 @@ child:
   prio(high) sync URL(uint64_t aID) returns(nsString aURL);
   prio(high) sync MimeType(uint64_t aID) returns(nsString aMime);
   prio(high) sync URLDocTypeMimeType(uint64_t aID) returns(nsString aURL, nsString aDocType, nsString aMimeType);
+
+  prio(high) sync AccessibleAtPoint(uint64_t aID, int32_t aX, int32_t aY, bool aNeedsScreenCoords, uint32_t aWhich)
+    returns(uint64_t aResult, bool aOk);
+
+  prio(high) sync Extents(uint64_t aID, bool aNeedsScreenCoords)
+    returns(int32_t aX, int32_t aY, int32_t aWidth, int32_t aHeight);
 };
 
 }
diff --git a/accessible/ipc/ProxyAccessible.cpp b/accessible/ipc/ProxyAccessible.cpp
index 4171925cf1f0..8c7fd97a6031 100644
--- a/accessible/ipc/ProxyAccessible.cpp
+++ b/accessible/ipc/ProxyAccessible.cpp
@@ -1019,9 +1019,9 @@ ProxyAccessible::ChildAtPoint(int32_t aX, int32_t aY,
 {
   uint64_t childID = 0;
   bool ok = false;
-  unused << mDoc->SendChildAtPoint(mID, aX, aY,
-                                   static_cast<uint32_t>(aWhichChild),
-                                   &childID, &ok);
+  unused << mDoc->SendAccessibleAtPoint(mID, aX, aY, false,
+                                        static_cast<uint32_t>(aWhichChild),
+                                        &childID, &ok);
   return ok ? mDoc->GetAccessible(childID) : nullptr;
 }
 
@@ -1029,7 +1029,9 @@ nsIntRect
 ProxyAccessible::Bounds()
 {
   nsIntRect rect;
-  unused << mDoc->SendBounds(mID, &rect);
+  unused << mDoc->SendExtents(mID, false,
+                              &(rect.x), &(rect.y),
+                              &(rect.width), &(rect.height));
   return rect;
 }
 
@@ -1070,6 +1072,26 @@ ProxyAccessible::URLDocTypeMimeType(nsString& aURL, nsString& aDocType,
   unused << mDoc->SendURLDocTypeMimeType(mID, &aURL, &aDocType, &aMimeType);
 }
 
+ProxyAccessible*
+ProxyAccessible::AccessibleAtPoint(int32_t aX, int32_t aY,
+                                   bool aNeedsScreenCoords)
+{
+  uint64_t childID = 0;
+  bool ok = false;
+  unused <<
+    mDoc->SendAccessibleAtPoint(mID, aX, aY, aNeedsScreenCoords,
+                                static_cast<uint32_t>(Accessible::eDirectChild),
+                                &childID, &ok);
+  return ok ? mDoc->GetAccessible(childID) : nullptr;
+}
+
+void
+ProxyAccessible::Extents(bool aNeedsScreenCoords, int32_t* aX, int32_t* aY,
+                        int32_t* aWidth, int32_t* aHeight)
+{
+  unused << mDoc->SendExtents(mID, aNeedsScreenCoords, aX, aY, aWidth, aHeight);
+}
+
 Accessible*
 ProxyAccessible::OuterDocOfRemoteBrowser() const
 {
diff --git a/accessible/ipc/ProxyAccessible.h b/accessible/ipc/ProxyAccessible.h
index 4dc401360fe9..efd197417a6b 100644
--- a/accessible/ipc/ProxyAccessible.h
+++ b/accessible/ipc/ProxyAccessible.h
@@ -319,6 +319,12 @@ public:
   void URLDocTypeMimeType(nsString& aURL, nsString& aDocType,
                           nsString& aMimeType);
 
+  ProxyAccessible* AccessibleAtPoint(int32_t aX, int32_t aY,
+                                     bool aNeedsScreenCoords);
+
+  void Extents(bool aNeedsScreenCoords, int32_t* aX, int32_t* aY,
+               int32_t* aWidth, int32_t* aHeight);
+
   /**
    * Allow the platform to store a pointers worth of data on us.
    */
diff --git a/browser/base/content/browser-context.inc b/browser/base/content/browser-context.inc
index cd7b2ede3ae7..e3e0df56c231 100644
--- a/browser/base/content/browser-context.inc
+++ b/browser/base/content/browser-context.inc
@@ -419,9 +419,14 @@
                 oncommand="gContextMenu.switchPageDirection();"/>
       <menuseparator id="fill-login-separator" hidden="true"/>
       <menu id="fill-login"
-            label="&fillPasswordMenu.label;"
-            class="menu-iconic"
-            accesskey="&fillPasswordMenu.accesskey;"
+            label="&fillLoginMenu.label;"
+            label-login="&fillLoginMenu.label;"
+            label-password="&fillPasswordMenu.label;"
+            label-username="&fillUsernameMenu.label;"
+            accesskey="&fillLoginMenu.accesskey;"
+            accesskey-login="&fillLoginMenu.accesskey;"
+            accesskey-password="&fillPasswordMenu.accesskey;"
+            accesskey-username="&fillUsernameMenu.accesskey;"
             hidden="true">
         <menupopup id="fill-login-popup">
           <menuitem id="fill-login-no-logins"
diff --git a/browser/base/content/content.js b/browser/base/content/content.js
index cb39986905df..1f9b33f7de5b 100644
--- a/browser/base/content/content.js
+++ b/browser/base/content/content.js
@@ -107,6 +107,7 @@ let handleContentContextMenu = function (event) {
   let frameOuterWindowID = doc.defaultView.QueryInterface(Ci.nsIInterfaceRequestor)
                                           .getInterface(Ci.nsIDOMWindowUtils)
                                           .outerWindowID;
+  let loginFillInfo = LoginManagerContent.getFieldContext(event.target);
 
   // get referrer attribute from clicked link and parse it
   // if per element referrer is enabled, the element referrer overrules
@@ -168,7 +169,8 @@ let handleContentContextMenu = function (event) {
                    { editFlags, spellInfo, customMenuItems, addonInfo,
                      principal, docLocation, charSet, baseURI, referrer,
                      referrerPolicy, contentType, contentDisposition,
-                     frameOuterWindowID, selectionInfo, disableSetDesktopBg },
+                     frameOuterWindowID, selectionInfo, disableSetDesktopBg,
+                     loginFillInfo, },
                    { event, popupNode: event.target });
   }
   else {
@@ -190,6 +192,7 @@ let handleContentContextMenu = function (event) {
       contentDisposition: contentDisposition,
       selectionInfo: selectionInfo,
       disableSetDesktopBackground: disableSetDesktopBg,
+      loginFillInfo,
     };
   }
 }
diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index 71ba6f3fb991..0a09ecbd0954 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -506,13 +506,35 @@ nsContextMenu.prototype = {
   },
 
   initPasswordManagerItems: function() {
-    let showFillPassword = this.onPassword;
-    let disableFillPassword = !Services.logins.isLoggedIn || this.target.disabled || this.target.readOnly;
-    this.showItem("fill-login-separator", showFillPassword);
-    this.showItem("fill-login", showFillPassword);
-    this.setItemAttr("fill-login", "disabled", disableFillPassword);
+    let loginFillInfo = gContextMenuContentData && gContextMenuContentData.loginFillInfo;
 
-    if (!showFillPassword || disableFillPassword) {
+    // If we could not find a password field we
+    // don't want to show the form fill option.
+    let showFill = loginFillInfo && loginFillInfo.passwordField.found;
+
+    // Disable the fill option if the user has set a master password
+    // or if the password field or target field are disabled.
+    let disableFill = !loginFillInfo ||
+                      !Services.logins ||
+                      !Services.logins.isLoggedIn ||
+                      loginFillInfo.passwordField.disabled ||
+                      (!this.onPassword && loginFillInfo.usernameField.disabled);
+
+    this.showItem("fill-login-separator", showFill);
+    this.showItem("fill-login", showFill);
+    this.setItemAttr("fill-login", "disabled", disableFill);
+
+    // Set the correct label for the fill menu
+    let fillMenu = document.getElementById("fill-login");
+    if (this.onPassword) {
+      fillMenu.setAttribute("label", fillMenu.getAttribute("label-password"));
+      fillMenu.setAttribute("accesskey", fillMenu.getAttribute("accesskey-password"));
+    } else {
+      fillMenu.setAttribute("label", fillMenu.getAttribute("label-login"));
+      fillMenu.setAttribute("accesskey", fillMenu.getAttribute("accesskey-login"));
+    }
+
+    if (!showFill || disableFill) {
       return;
     }
     let documentURI = gContextMenuContentData.documentURIObject;
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index a6d1901cde85..46f54342429a 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -4056,6 +4056,7 @@
                                           frameOuterWindowID: aMessage.data.frameOuterWindowID,
                                           selectionInfo: aMessage.data.selectionInfo,
                                           disableSetDesktopBackground: aMessage.data.disableSetDesktopBg,
+                                          loginFillInfo: aMessage.data.loginFillInfo,
                                         };
               let popup = browser.ownerDocument.getElementById("contentAreaContextMenu");
               let event = gContextMenuContentData.event;
diff --git a/browser/base/content/test/general/test_contextmenu.html b/browser/base/content/test/general/test_contextmenu.html
index a99df13a4d18..e830da3032ac 100644
--- a/browser/base/content/test/general/test_contextmenu.html
+++ b/browser/base/content/test/general/test_contextmenu.html
@@ -80,7 +80,7 @@ function runTest(testNum) {
                     "context-inspect", true];
   }
 
-  var passwordFillItems = [
+  var loginFillItems = [
     "---", null,
     "fill-login", null,
       [
@@ -652,7 +652,8 @@ function runTest(testNum) {
                           "context-searchselect",true,
                           "---",                 null,
                           "spell-check-enabled", true
-                         ].concat(inspectItems));
+                         ].concat(loginFillItems)
+                          .concat(inspectItems));
         closeContextMenu();
         selectInputText(select_inputtext_password); // Select text prior to opening context menu.
         openContextMenuFor(select_inputtext_password); // Invoke context menu for next test.
@@ -675,7 +676,7 @@ function runTest(testNum) {
                               ["spell-check-dictionary-en-US", true,
                                "---",                          null,
                                "spell-add-dictionaries",       true], null
-                         ].concat(passwordFillItems)
+                         ].concat(loginFillItems)
                           .concat(inspectItems));
         closeContextMenu();
         subwindow.getSelection().removeAllRanges();
diff --git a/browser/base/content/urlbarBindings.xml b/browser/base/content/urlbarBindings.xml
index 9506e8c381db..7797335b3f13 100644
--- a/browser/base/content/urlbarBindings.xml
+++ b/browser/base/content/urlbarBindings.xml
@@ -193,8 +193,9 @@ file, You can obtain one at http://mozilla.org/MPL/2.0/.
             case KeyEvent.DOM_VK_LEFT:
             case KeyEvent.DOM_VK_RIGHT:
             case KeyEvent.DOM_VK_HOME:
-              this.popup.hidePopup();
-              return;
+              // Reset the selected index so that nsAutoCompleteController
+              // simply closes the popup without trying to fill anything.
+              this.popup.selectedIndex = -1;
               break;
           }
 
diff --git a/browser/devtools/debugger/debugger-view.js b/browser/devtools/debugger/debugger-view.js
index c117697f20fb..f5330ef8a992 100644
--- a/browser/devtools/debugger/debugger-view.js
+++ b/browser/devtools/debugger/debugger-view.js
@@ -14,6 +14,7 @@ const BREAKPOINT_LINE_TOOLTIP_MAX_LENGTH = 1000; // chars
 const BREAKPOINT_CONDITIONAL_POPUP_POSITION = "before_start";
 const BREAKPOINT_CONDITIONAL_POPUP_OFFSET_X = 7; // px
 const BREAKPOINT_CONDITIONAL_POPUP_OFFSET_Y = -3; // px
+const BREAKPOINT_SMALL_WINDOW_WIDTH = 850; // px
 const RESULTS_PANEL_POPUP_POSITION = "before_end";
 const RESULTS_PANEL_MAX_RESULTS = 10;
 const FILE_SEARCH_ACTION_MAX_DELAY = 300; // ms
@@ -30,6 +31,7 @@ const SEARCH_AUTOFILL = [SEARCH_GLOBAL_FLAG, SEARCH_FUNCTION_FLAG, SEARCH_TOKEN_
 const EDITOR_VARIABLE_HOVER_DELAY = 750; // ms
 const EDITOR_VARIABLE_POPUP_POSITION = "topcenter bottomleft";
 const TOOLBAR_ORDER_POPUP_POSITION = "topcenter bottomleft";
+const RESIZE_REFRESH_RATE = 50; // ms
 const PROMISE_DEBUGGER_URL =
   "chrome://browser/content/devtools/promisedebugger/promise-debugger.xhtml";
 
@@ -93,6 +95,8 @@ let DebuggerView = {
       return this._shutdown;
     }
 
+    window.removeEventListener("resize", this._onResize, false);
+
     let deferred = promise.defer();
     this._shutdown = deferred.promise;
 
@@ -141,10 +145,10 @@ let DebuggerView = {
     this._instrumentsPane.setAttribute("width", Prefs.instrumentsWidth);
     this.toggleInstrumentsPane({ visible: Prefs.panesVisibleOnStartup });
 
-    // Side hosts requires a different arrangement of the debugger widgets.
-    if (gHostType == "side") {
-      this.handleHostChanged(gHostType);
-    }
+    this.updateLayoutMode();
+
+    this._onResize = this._onResize.bind(this);
+    window.addEventListener("resize", this._onResize, false);
   },
 
   /**
@@ -214,6 +218,17 @@ let DebuggerView = {
   _initializePromiseDebugger: function() {
     let iframe = this._promiseDebuggerIframe = document.createElement("iframe");
     iframe.setAttribute("flex", 1);
+
+    let onLoad = (event) => {
+      iframe.removeEventListener("load", onLoad, true);
+
+      let doc = event.target;
+      let win = doc.defaultView;
+
+      win.setPanel(DebuggerController._toolbox);
+    };
+
+    iframe.addEventListener("load", onLoad, true);
     iframe.setAttribute("src", PROMISE_DEBUGGER_URL);
     this._promisePane.appendChild(iframe);
   },
@@ -223,6 +238,8 @@ let DebuggerView = {
    */
   _destroyPromiseDebugger: function() {
     if (this._promiseDebuggerIframe) {
+      this._promiseDebuggerIframe.contentWindow.destroy();
+
       this._promiseDebuggerIframe.parentNode.removeChild(
         this._promiseDebuggerIframe);
 
@@ -619,24 +636,64 @@ let DebuggerView = {
    * @param string aType
    *        The host type, either "bottom", "side" or "window".
    */
-  handleHostChanged: function(aType) {
-    let newLayout = "";
-
-    if (aType == "side") {
-      newLayout = "vertical";
-      this._enterVerticalLayout();
-    } else {
-      newLayout = "horizontal";
-      this._enterHorizontalLayout();
-    }
-
-    this._hostType = aType;
-    this._body.setAttribute("layout", newLayout);
-    window.emit(EVENTS.LAYOUT_CHANGED, newLayout);
+  handleHostChanged: function(hostType) {
+    this._hostType = hostType;
+    this.updateLayoutMode();
   },
 
   /**
-   * Switches the debugger widgets to a horizontal layout.
+   * Resize handler for this container's window.
+   */
+  _onResize: function (evt) {
+    // Allow requests to settle down first.
+    setNamedTimeout(
+      "resize-events", RESIZE_REFRESH_RATE, () => this.updateLayoutMode());
+  },
+
+  /**
+   * Set the layout to "vertical" or "horizontal" depending on the host type.
+   */
+  updateLayoutMode: function() {
+    if (this._isSmallWindowHost() || this._hostType == "side") {
+      this._setLayoutMode("vertical");
+    } else {
+      this._setLayoutMode("horizontal");
+    }
+  },
+
+  /**
+   * Check if the current host is in window mode and is
+   * too small for horizontal layout
+   */
+  _isSmallWindowHost: function() {
+    if (this._hostType != "window") {
+      return false;
+    }
+
+    return window.outerWidth <= BREAKPOINT_SMALL_WINDOW_WIDTH;
+  },
+
+  /**
+   * Enter the provided layoutMode. Do nothing if the layout is the same as the current one.
+   * @param {String} layoutMode new layout ("vertical" or "horizontal")
+   */
+  _setLayoutMode: function(layoutMode) {
+    if (this._body.getAttribute("layout") == layoutMode) {
+      return;
+    }
+
+    if (layoutMode == "vertical") {
+      this._enterVerticalLayout();
+    } else {
+      this._enterHorizontalLayout();
+    }
+
+    this._body.setAttribute("layout", layoutMode);
+    window.emit(EVENTS.LAYOUT_CHANGED, layoutMode);
+  },
+
+  /**
+   * Switches the debugger widgets to a vertical layout.
    */
   _enterVerticalLayout: function() {
     let vertContainer = document.getElementById("vertical-layout-panes-container");
@@ -653,7 +710,7 @@ let DebuggerView = {
   },
 
   /**
-   * Switches the debugger widgets to a vertical layout.
+   * Switches the debugger widgets to a horizontal layout.
    */
   _enterHorizontalLayout: function() {
     let normContainer = document.getElementById("debugger-widgets");
diff --git a/browser/devtools/debugger/panel.js b/browser/devtools/debugger/panel.js
index 879e1c10a7b0..369f91454c97 100644
--- a/browser/devtools/debugger/panel.js
+++ b/browser/devtools/debugger/panel.js
@@ -26,7 +26,7 @@ function DebuggerPanel(iframeWindow, toolbox) {
   this.unhighlightWhenResumed = this.unhighlightWhenResumed.bind(this);
 
   EventEmitter.decorate(this);
-};
+}
 
 exports.DebuggerPanel = DebuggerPanel;
 
diff --git a/browser/devtools/debugger/test/mochitest/browser_dbg_host-layout.js b/browser/devtools/debugger/test/mochitest/browser_dbg_host-layout.js
index 2f3ecd5952d2..e83143140e8a 100644
--- a/browser/devtools/debugger/test/mochitest/browser_dbg_host-layout.js
+++ b/browser/devtools/debugger/test/mochitest/browser_dbg_host-layout.js
@@ -6,15 +6,22 @@
  * host changes.
  */
 
+"use strict";
+
 let gDefaultHostType = Services.prefs.getCharPref("devtools.toolbox.host");
 
 function test() {
+  // test is too slow on some platforms due to the number of test cases
+  requestLongerTimeout(2);
+
   Task.spawn(function*() {
-    yield testHosts(["bottom", "side", "window"], ["horizontal", "vertical", "horizontal"]);
+    yield testHosts(["bottom", "side", "window:big"], ["horizontal", "vertical", "horizontal"]);
     yield testHosts(["side", "bottom", "side"], ["vertical", "horizontal", "vertical"]);
     yield testHosts(["bottom", "side", "bottom"], ["horizontal", "vertical", "horizontal"]);
-    yield testHosts(["side", "window", "side"], ["vertical", "horizontal", "vertical"]);
-    yield testHosts(["window", "side", "window"], ["horizontal", "vertical", "horizontal"]);
+    yield testHosts(["side", "window:big", "side"], ["vertical", "horizontal", "vertical"]);
+    yield testHosts(["window:big", "side", "window:big"], ["horizontal", "vertical", "horizontal"]);
+    yield testHosts(["window:small", "bottom", "side"], ["vertical", "horizontal", "vertical"]);
+    yield testHosts(["window:small", "window:big", "window:small"], ["vertical", "horizontal", "vertical"]);
     finish();
   });
 }
@@ -23,11 +30,15 @@ function testHosts(aHostTypes, aLayoutTypes) {
   let [firstHost, secondHost, thirdHost] = aHostTypes;
   let [firstLayout, secondLayout, thirdLayout] = aLayoutTypes;
 
-  Services.prefs.setCharPref("devtools.toolbox.host", firstHost);
+  Services.prefs.setCharPref("devtools.toolbox.host", getHost(firstHost));
 
   return Task.spawn(function*() {
     let [tab, debuggee, panel] = yield initDebugger("about:blank");
-    yield testHost(tab, panel, firstHost, firstLayout);
+    if (getHost(firstHost) === "window") {
+      yield resizeToolboxWindow(panel, firstHost);
+    }
+
+    yield testHost(panel, getHost(firstHost), firstLayout);
     yield switchAndTestHost(tab, panel, secondHost, secondLayout);
     yield switchAndTestHost(tab, panel, thirdHost, thirdLayout);
     yield teardown(panel);
@@ -39,26 +50,63 @@ function switchAndTestHost(aTab, aPanel, aHostType, aLayoutType) {
   let gDebugger = aPanel.panelWin;
 
   return Task.spawn(function*() {
-    let layoutChanged = once(gDebugger, gDebugger.EVENTS.LAYOUT_CHANGED);
-    let hostChanged = gToolbox.switchHost(aHostType);
+    let layoutChanged = waitEventOnce(gDebugger, gDebugger.EVENTS.LAYOUT_CHANGED);
+    let hostChanged = gToolbox.switchHost(getHost(aHostType));
 
     yield hostChanged;
-    ok(true, "The toolbox's host has changed.");
+    info("The toolbox's host has changed.");
+
+    if (getHost(aHostType) === "window") {
+      yield resizeToolboxWindow(aPanel, aHostType);
+    }
 
     yield layoutChanged;
-    ok(true, "The debugger's layout has changed.");
+    info("The debugger's layout has changed.");
 
-    yield testHost(aTab, aPanel, aHostType, aLayoutType);
+    yield testHost(aPanel, getHost(aHostType), aLayoutType);
   });
+}
 
-  function once(aTarget, aEvent) {
-    let deferred = promise.defer();
-    aTarget.once(aEvent, deferred.resolve);
-    return deferred.promise;
+function waitEventOnce(aTarget, aEvent) {
+  let deferred = promise.defer();
+  aTarget.once(aEvent, deferred.resolve);
+  return deferred.promise;
+}
+
+function getHost(host) {
+  if (host.indexOf("window") == 0) {
+    return "window";
+  }
+  return host;
+}
+
+function resizeToolboxWindow(panel, host) {
+  let sizeOption = host.split(":")[1];
+  let win = panel._toolbox._host._window;
+
+  // should be the same value as BREAKPOINT_SMALL_WINDOW_WIDTH in debugger-view.js
+  let breakpoint = 850;
+
+  if (sizeOption == "big" && win.outerWidth <= breakpoint) {
+    yield resizeAndWaitForLayoutChange(panel, breakpoint + 300);
+  } else if (sizeOption == "small" && win.outerWidth >= breakpoint) {
+    yield resizeAndWaitForLayoutChange(panel, breakpoint - 300);
+  } else {
+    info("Window resize unnecessary for host " + host);
   }
 }
 
-function testHost(aTab, aPanel, aHostType, aLayoutType) {
+function resizeAndWaitForLayoutChange(panel, width) {
+    info("Updating toolbox window width to " + width);
+
+    let win = panel._toolbox._host._window;
+    let gDebugger = panel.panelWin;
+
+    win.resizeTo(width, window.screen.availHeight);
+    yield waitEventOnce(gDebugger, gDebugger.EVENTS.LAYOUT_CHANGED);
+}
+
+function testHost(aPanel, aHostType, aLayoutType) {
   let gDebugger = aPanel.panelWin;
   let gView = gDebugger.DebuggerView;
 
diff --git a/browser/devtools/debugger/views/sources-view.js b/browser/devtools/debugger/views/sources-view.js
index 943cc8bef368..3cd565717bb8 100644
--- a/browser/devtools/debugger/views/sources-view.js
+++ b/browser/devtools/debugger/views/sources-view.js
@@ -621,7 +621,9 @@ SourcesView.prototype = Heritage.extend(WidgetMethods, {
       let promisePane = this.DebuggerView._promisePane;
       promisePane.hidden = !promisePane.hidden;
 
-      this.DebuggerView._initializePromiseDebugger();
+      if (!this.DebuggerView._promiseDebuggerIframe) {
+        this.DebuggerView._initializePromiseDebugger();
+      }
     }
   },
 
diff --git a/browser/devtools/jar.mn b/browser/devtools/jar.mn
index 5298034c1d7c..b29ea34f9120 100644
--- a/browser/devtools/jar.mn
+++ b/browser/devtools/jar.mn
@@ -110,7 +110,8 @@ browser.jar:
     content/browser/devtools/performance/views/details-memory-flamegraph.js (performance/views/details-memory-flamegraph.js)
     content/browser/devtools/performance/views/optimizations-list.js        (performance/views/optimizations-list.js)
     content/browser/devtools/performance/views/recordings.js           (performance/views/recordings.js)
-    content/browser/devtools/promisedebugger/promise-debugger.js       (promisedebugger/promise-debugger.js)
+    content/browser/devtools/promisedebugger/promise-controller.js     (promisedebugger/promise-controller.js)
+    content/browser/devtools/promisedebugger/promise-panel.js          (promisedebugger/promise-panel.js)
     content/browser/devtools/promisedebugger/promise-debugger.xhtml    (promisedebugger/promise-debugger.xhtml)
     content/browser/devtools/commandline.css                           (commandline/commandline.css)
     content/browser/devtools/commandlineoutput.xhtml                   (commandline/commandlineoutput.xhtml)
diff --git a/browser/devtools/markupview/markup-view.js b/browser/devtools/markupview/markup-view.js
index d912784ed7df..c299a9b0a5b2 100644
--- a/browser/devtools/markupview/markup-view.js
+++ b/browser/devtools/markupview/markup-view.js
@@ -259,17 +259,34 @@ MarkupView.prototype = {
   },
 
   _onMouseUp: function() {
-    if (this._lastDropTarget) {
-      this.indicateDropTarget(null);
-    }
-    if (this._lastDragTarget) {
-      this.indicateDragTarget(null);
-    }
+    this.indicateDropTarget(null);
+    this.indicateDragTarget(null);
     if (this._scrollInterval) {
       clearInterval(this._scrollInterval);
     }
   },
 
+  cancelDragging: function() {
+    if (!this.isDragging) {
+      return;
+    }
+
+    for (let [, container] of this._containers) {
+      if (container.isDragging) {
+        container.cancelDragging();
+        break;
+      }
+    }
+
+    this.indicateDropTarget(null);
+    this.indicateDragTarget(null);
+    if (this._scrollInterval) {
+      clearInterval(this._scrollInterval);
+    }
+  },
+
+
+
   _hoveredNode: null,
 
   /**
@@ -632,6 +649,12 @@ MarkupView.prototype = {
         this.beginEditingOuterHTML(this._selectedContainer.node);
         break;
       }
+      case Ci.nsIDOMKeyEvent.DOM_VK_ESCAPE: {
+        if (this.isDragging) {
+          this.cancelDragging();
+          break;
+        }
+      }
       default:
         handled = false;
     }
@@ -1927,6 +1950,18 @@ MarkupContainer.prototype = {
     return this._isDragging;
   },
 
+  /**
+   * Check if element is draggable
+   */
+  isDraggable: function(target) {
+    return this._isMouseDown &&
+           this.markup._dragStartEl === target &&
+           !this.node.isPseudoElement &&
+           !this.node.isAnonymous &&
+           this.win.getSelection().isCollapsed &&
+           this.node.parentNode().tagName !== null;
+  },
+
   _onMouseDown: function(event) {
     let target = event.target;
 
@@ -1964,9 +1999,7 @@ MarkupContainer.prototype = {
     this.markup._dragStartEl = target;
     setTimeout(() => {
       // Make sure the mouse is still down and on target.
-      if (!this._isMouseDown || this.markup._dragStartEl !== target ||
-          this.node.isPseudoElement || this.node.isAnonymous ||
-          !this.win.getSelection().isCollapsed) {
+      if (!this.isDraggable(target)) {
         return;
       }
       this.isDragging = true;
@@ -1990,8 +2023,7 @@ MarkupContainer.prototype = {
       return;
     }
 
-    this.isDragging = false;
-    this.elt.style.removeProperty("top");
+    this.cancelDragging();
 
     let dropTargetNodes = this.markup.dropTargetNodes;
 
@@ -2021,6 +2053,16 @@ MarkupContainer.prototype = {
     this.markup.indicateDropTarget(el);
   },
 
+  cancelDragging: function() {
+    if (!this.isDragging) {
+      return;
+    }
+
+    this._isMouseDown = false;
+    this.isDragging = false;
+    this.elt.style.removeProperty("top");
+  },
+
   /**
    * Temporarily flash the container to attract attention.
    * Used for markup mutations.
diff --git a/browser/devtools/markupview/test/browser.ini b/browser/devtools/markupview/test/browser.ini
index c5982429db39..f7a6327327bc 100644
--- a/browser/devtools/markupview/test/browser.ini
+++ b/browser/devtools/markupview/test/browser.ini
@@ -45,6 +45,8 @@ skip-if = e10s # scratchpad.xul is not loading in e10s window
 [browser_markupview_copy_image_data.js]
 [browser_markupview_css_completion_style_attribute.js]
 [browser_markupview_dragdrop_autoscroll.js]
+[browser_markupview_dragdrop_dragRootNode.js]
+[browser_markupview_dragdrop_escapeKeyPress.js]
 [browser_markupview_dragdrop_invalidNodes.js]
 [browser_markupview_dragdrop_isDragging.js]
 [browser_markupview_dragdrop_reorder.js]
diff --git a/browser/devtools/markupview/test/browser_markupview_dragdrop_dragRootNode.js b/browser/devtools/markupview/test/browser_markupview_dragdrop_dragRootNode.js
new file mode 100644
index 000000000000..8a758df449d4
--- /dev/null
+++ b/browser/devtools/markupview/test/browser_markupview_dragdrop_dragRootNode.js
@@ -0,0 +1,30 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+// Test if html root node is draggable
+
+const TEST_URL = TEST_URL_ROOT + "doc_markup_dragdrop.html";
+const GRAB_DELAY = 400;
+
+add_task(function*() {
+  let {inspector} = yield addTab(TEST_URL).then(openInspector);
+
+  let el = yield getContainerForSelector("html", inspector);
+  let rect = el.tagLine.getBoundingClientRect();
+
+  info("Simulating mouseDown on html root node");
+  el._onMouseDown({
+    target: el.tagLine,
+    pageX: rect.x,
+    pageY: rect.y,
+    stopPropagation: function() {},
+    preventDefault: function() {}
+  });
+
+  info("Waiting for a little bit more than the markup-view grab delay");
+  yield wait(GRAB_DELAY + 1);
+  is(el.isDragging, false, "isDragging is false");
+});
diff --git a/browser/devtools/markupview/test/browser_markupview_dragdrop_escapeKeyPress.js b/browser/devtools/markupview/test/browser_markupview_dragdrop_escapeKeyPress.js
new file mode 100644
index 000000000000..0d9d31c5ccc2
--- /dev/null
+++ b/browser/devtools/markupview/test/browser_markupview_dragdrop_escapeKeyPress.js
@@ -0,0 +1,34 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+// Test whether ESCAPE keypress cancels dragging of an element
+
+const TEST_URL = TEST_URL_ROOT + "doc_markup_dragdrop.html";
+const GRAB_DELAY = 400;
+
+add_task(function*() {
+  let {inspector} = yield addTab(TEST_URL).then(openInspector);
+
+  let el = yield getContainerForSelector("#test", inspector);
+  let rect = el.tagLine.getBoundingClientRect();
+
+  info("Simulating mouseDown on #test");
+  el._onMouseDown({
+    target: el.tagLine,
+    pageX: rect.x,
+    pageY: rect.y,
+    stopPropagation: function() {},
+    preventDefault: function() {}
+  });
+
+  info("Waiting for a little bit more than the markup-view grab delay");
+  yield wait(GRAB_DELAY + 1);
+  ok(el.isDragging, "isDragging true after mouseDown");
+
+  info("Simulating ESCAPE keypress");
+  EventUtils.sendKey("escape", inspector.panelWin);
+  is(el.isDragging, false, "isDragging false after ESCAPE keypress");
+});
diff --git a/browser/devtools/promisedebugger/components/moz.build b/browser/devtools/promisedebugger/components/moz.build
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/browser/devtools/promisedebugger/moz.build b/browser/devtools/promisedebugger/moz.build
index 581981a4c066..332bed30dace 100644
--- a/browser/devtools/promisedebugger/moz.build
+++ b/browser/devtools/promisedebugger/moz.build
@@ -7,5 +7,4 @@
 BROWSER_CHROME_MANIFESTS += ['test/browser.ini']
 
 EXTRA_JS_MODULES.devtools.promisedebugger += [
-    'promise-debugger.js'
 ]
diff --git a/browser/devtools/promisedebugger/promise-controller.js b/browser/devtools/promisedebugger/promise-controller.js
new file mode 100644
index 000000000000..f5e139fad65d
--- /dev/null
+++ b/browser/devtools/promisedebugger/promise-controller.js
@@ -0,0 +1,102 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* vim: set ft=javascript ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* global promise, PromisesPanel, PromisesFront, DevToolsUtils */
+
+"use strict";
+
+const { utils: Cu } = Components;
+const { loader, require } =
+  Cu.import("resource://gre/modules/devtools/Loader.jsm", {});
+
+const { Task } = require("resource://gre/modules/Task.jsm");
+
+loader.lazyRequireGetter(this, "promise");
+loader.lazyRequireGetter(this, "EventEmitter",
+  "devtools/toolkit/event-emitter");
+loader.lazyRequireGetter(this, "DevToolsUtils",
+  "devtools/toolkit/DevToolsUtils");
+loader.lazyRequireGetter(this, "PromisesFront",
+  "devtools/server/actors/promises", true);
+
+// Global toolbox, set when startup is called.
+let gToolbox;
+
+/**
+ * Initialize the promise debugger controller and view upon loading the iframe.
+ */
+let startup = Task.async(function*(toolbox) {
+  gToolbox = toolbox;
+
+  yield PromisesController.initialize(toolbox);
+  yield PromisesPanel.initialize();
+});
+
+/**
+ * Destroy the promise debugger controller and view when unloading the iframe.
+ */
+let shutdown = Task.async(function*() {
+  yield PromisesController.destroy();
+  yield PromisesPanel.destroy();
+
+  gToolbox = null;
+});
+
+function setPanel(toolbox) {
+  return startup(toolbox).catch(e =>
+    DevToolsUtils.reportException("setPanel", e));
+}
+
+function destroy() {
+  return shutdown().catch(e => DevToolsUtils.reportException("destroy", e));
+}
+
+/**
+ * The promisedebugger controller's job is to retrieve PromisesFronts from the
+ * server.
+ */
+let PromisesController = {
+  initialize: Task.async(function*() {
+    if (this.initialized) {
+      return this.initialized.promise;
+    }
+
+    this.initialized = promise.defer();
+
+    let target = gToolbox.target;
+    this.promisesFront = new PromisesFront(target.client, target.form);
+    yield this.promisesFront.attach();
+
+    if (this.destroyed) {
+      console.warn("Could not fully initialize the PromisesController");
+      return null;
+    }
+
+    this.initialized.resolve();
+  }),
+
+  destroy: Task.async(function*() {
+    if (!this.initialized) {
+      return null;
+    }
+
+    if (this.destroyed) {
+      return this.destroyed.promise;
+    }
+
+    this.destroyed = promise.defer();
+
+    if (this.promisesFront) {
+      yield this.promisesFront.detach();
+      this.promisesFront.destroy();
+      this.promisesFront = null;
+    }
+
+    this.destroyed.resolve();
+  }),
+};
+
+EventEmitter.decorate(PromisesController);
diff --git a/browser/devtools/promisedebugger/promise-debugger.js b/browser/devtools/promisedebugger/promise-debugger.js
deleted file mode 100644
index 12c56d5cc492..000000000000
--- a/browser/devtools/promisedebugger/promise-debugger.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* vim: set ft=javascript ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-"use strict";
diff --git a/browser/devtools/promisedebugger/promise-debugger.xhtml b/browser/devtools/promisedebugger/promise-debugger.xhtml
index 5e13f4394cab..0a06eda75d67 100644
--- a/browser/devtools/promisedebugger/promise-debugger.xhtml
+++ b/browser/devtools/promisedebugger/promise-debugger.xhtml
@@ -17,6 +17,7 @@
     <script type="application/javascript;version=1.8" src="chrome://browser/content/devtools/theme-switching.js"/>
   </head>
   <body class="devtools-monospace" role="application">
-    <script type="application/javascript;version=1.8" src="promise-debugger.js"></script>
+    <script type="application/javascript;version=1.8" src="promise-controller.js"></script>
+    <script type="application/javascript;version=1.8" src="promise-panel.js"></script>
   </body>
 </html>
diff --git a/browser/devtools/promisedebugger/promise-panel.js b/browser/devtools/promisedebugger/promise-panel.js
new file mode 100644
index 000000000000..ac530106cf46
--- /dev/null
+++ b/browser/devtools/promisedebugger/promise-panel.js
@@ -0,0 +1,44 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* vim: set ft=javascript ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* global PromisesController, promise */
+
+"use strict";
+
+/**
+ * The main promise debugger UI.
+ */
+let PromisesPanel = {
+  PANEL_INITIALIZED: "panel-initialized",
+
+  initialize: Task.async(function*() {
+    if (PromisesController.destroyed) {
+      return null;
+    }
+    if (this.initialized) {
+      return this.initialized.promise;
+    }
+    this.initialized = promise.defer();
+
+    this.initialized.resolve();
+
+    this.emit(this.PANEL_INITIALIZED);
+  }),
+
+  destroy: Task.async(function*() {
+    if (!this.initialized) {
+      return null;
+    }
+    if (this.destroyed) {
+      return this.destroyed.promise;
+    }
+    this.destroyed = promise.defer();
+
+    this.destroyed.resolve();
+  }),
+};
+
+EventEmitter.decorate(PromisesPanel);
diff --git a/browser/themes/shared/contextmenu.inc.css b/browser/themes/shared/contextmenu.inc.css
index 72ff27f0773e..2f84fde2a77c 100644
--- a/browser/themes/shared/contextmenu.inc.css
+++ b/browser/themes/shared/contextmenu.inc.css
@@ -95,13 +95,3 @@
 #context-media-eme-learnmore {
   list-style-image: url("chrome://browser/skin/drm-icon.svg#chains");
 }
-
-#fill-login {
-  list-style-image: url("chrome://mozapps/skin/passwordmgr/key-16.png");
-}
-
-@media (min-resolution: 1.1dppx) {
-  #fill-login {
-    list-style-image: url("chrome://mozapps/skin/passwordmgr/key-16@2x.png");
-  }
-}
diff --git a/build/clang-plugin/clang-plugin.cpp b/build/clang-plugin/clang-plugin.cpp
index 899497ffc095..46bdcafd5201 100644
--- a/build/clang-plugin/clang-plugin.cpp
+++ b/build/clang-plugin/clang-plugin.cpp
@@ -1019,13 +1019,7 @@ DiagnosticsMatcher::DiagnosticsMatcher() {
   // lambda, where the declaration they reference is not inside the lambda.
   // This excludes arguments and local variables, leaving only captured
   // variables.
-  astMatcher.addMatcher(
-      lambdaExpr(hasDescendant(
-                     declRefExpr(hasType(pointerType(pointee(isRefCounted()))),
-                                 to(decl().bind("decl")))
-                         .bind("declref")),
-                 unless(hasDescendant(decl(equalsBoundNode("decl"))))),
-      &refCountedInsideLambdaChecker);
+  astMatcher.addMatcher(lambdaExpr().bind("lambda"), &refCountedInsideLambdaChecker);
 
   // Older clang versions such as the ones used on the infra recognize these
   // conversions as 'operator _Bool', but newer clang versions recognize these
@@ -1252,11 +1246,19 @@ void DiagnosticsMatcher::RefCountedInsideLambdaChecker::run(
       "Refcounted variable %0 of type %1 cannot be captured by a lambda");
   unsigned noteID = Diag.getDiagnosticIDs()->getCustomDiagID(
       DiagnosticIDs::Note, "Please consider using a smart pointer");
-  const DeclRefExpr *declref = Result.Nodes.getNodeAs<DeclRefExpr>("declref");
+  const LambdaExpr *Lambda = Result.Nodes.getNodeAs<LambdaExpr>("lambda");
 
-  Diag.Report(declref->getLocStart(), errorID)
-      << declref->getFoundDecl() << declref->getType()->getPointeeType();
-  Diag.Report(declref->getLocStart(), noteID);
+  for (const LambdaCapture Capture : Lambda->captures()) {
+    if (Capture.capturesVariable()) {
+      QualType Pointee = Capture.getCapturedVar()->getType()->getPointeeType();
+
+      if (!Pointee.isNull() && isClassRefCounted(Pointee)) {
+        Diag.Report(Capture.getLocation(), errorID)
+          << Capture.getCapturedVar() << Pointee;
+        Diag.Report(Capture.getLocation(), noteID);
+      }
+    }
+  }
 }
 
 void DiagnosticsMatcher::ExplicitOperatorBoolChecker::run(
diff --git a/build/clang-plugin/tests/TestNoRefcountedInsideLambdas.cpp b/build/clang-plugin/tests/TestNoRefcountedInsideLambdas.cpp
index 20486bbcae87..35aac9dd6000 100644
--- a/build/clang-plugin/tests/TestNoRefcountedInsideLambdas.cpp
+++ b/build/clang-plugin/tests/TestNoRefcountedInsideLambdas.cpp
@@ -67,9 +67,9 @@ void foo() {
     take(argsp);
     take(localsp);
   });
-  take([ptr](R* argptr) {
+  take([ptr](R* argptr) { // expected-error{{Refcounted variable 'ptr' of type 'R' cannot be captured by a lambda}} expected-note{{Please consider using a smart pointer}}
     R* localptr;
-    ptr->method(); // expected-error{{Refcounted variable 'ptr' of type 'R' cannot be captured by a lambda}} expected-note{{Please consider using a smart pointer}}
+    ptr->method();
     argptr->method();
     localptr->method();
   });
@@ -79,9 +79,9 @@ void foo() {
     argsp->method();
     localsp->method();
   });
-  take([ptr](R* argptr) {
+  take([ptr](R* argptr) { // expected-error{{Refcounted variable 'ptr' of type 'R' cannot be captured by a lambda}} expected-note{{Please consider using a smart pointer}}
     R* localptr;
-    take(ptr); // expected-error{{Refcounted variable 'ptr' of type 'R' cannot be captured by a lambda}} expected-note{{Please consider using a smart pointer}}
+    take(ptr);
     take(argptr);
     take(localptr);
   });
diff --git a/dom/base/Element.cpp b/dom/base/Element.cpp
index 2669db2ea4e5..06f9ca5bc89d 100644
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -2852,7 +2852,7 @@ Element::CheckHandleEventForLinksPrecondition(EventChainVisitor& aVisitor,
       (!aVisitor.mEvent->mFlags.mIsTrusted &&
        (aVisitor.mEvent->mMessage != eMouseClick) &&
        (aVisitor.mEvent->mMessage != eKeyPress) &&
-       (aVisitor.mEvent->mMessage != NS_UI_ACTIVATE)) ||
+       (aVisitor.mEvent->mMessage != eLegacyDOMActivate)) ||
       !aVisitor.mPresContext ||
       aVisitor.mEvent->mFlags.mMultipleActionsPrevented) {
     return false;
@@ -2869,9 +2869,9 @@ Element::PreHandleEventForLinks(EventChainPreVisitor& aVisitor)
   // IMPORTANT: this switch and the switch below it must be kept in sync!
   switch (aVisitor.mEvent->mMessage) {
   case eMouseOver:
-  case NS_FOCUS_CONTENT:
+  case eFocus:
   case eMouseOut:
-  case NS_BLUR_CONTENT:
+  case eBlur:
     break;
   default:
     return NS_OK;
@@ -2892,7 +2892,7 @@ Element::PreHandleEventForLinks(EventChainPreVisitor& aVisitor)
   case eMouseOver:
     aVisitor.mEventStatus = nsEventStatus_eConsumeNoDefault;
     // FALL THROUGH
-  case NS_FOCUS_CONTENT: {
+  case eFocus: {
     InternalFocusEvent* focusEvent = aVisitor.mEvent->AsFocusEvent();
     if (!focusEvent || !focusEvent->isRefocus) {
       nsAutoString target;
@@ -2907,7 +2907,7 @@ Element::PreHandleEventForLinks(EventChainPreVisitor& aVisitor)
   case eMouseOut:
     aVisitor.mEventStatus = nsEventStatus_eConsumeNoDefault;
     // FALL THROUGH
-  case NS_BLUR_CONTENT:
+  case eBlur:
     rv = LeaveLink(aVisitor.mPresContext);
     if (NS_SUCCEEDED(rv)) {
       aVisitor.mEvent->mFlags.mMultipleActionsPrevented = true;
@@ -2931,7 +2931,7 @@ Element::PostHandleEventForLinks(EventChainPostVisitor& aVisitor)
   switch (aVisitor.mEvent->mMessage) {
   case eMouseDown:
   case eMouseClick:
-  case NS_UI_ACTIVATE:
+  case eLegacyDOMActivate:
   case eKeyPress:
     break;
   default:
@@ -2985,7 +2985,7 @@ Element::PostHandleEventForLinks(EventChainPostVisitor& aVisitor)
         nsEventStatus status = nsEventStatus_eIgnore;
         // DOMActive event should be trusted since the activation is actually
         // occurred even if the cause is an untrusted click event.
-        InternalUIEvent actEvent(true, NS_UI_ACTIVATE, mouseEvent);
+        InternalUIEvent actEvent(true, eLegacyDOMActivate, mouseEvent);
         actEvent.detail = 1;
 
         rv = shell->HandleDOMEventWithTarget(this, &actEvent, &status);
@@ -2996,7 +2996,7 @@ Element::PostHandleEventForLinks(EventChainPostVisitor& aVisitor)
     }
     break;
   }
-  case NS_UI_ACTIVATE:
+  case eLegacyDOMActivate:
     {
       if (aVisitor.mEvent->originalTarget == this) {
         nsAutoString target;
diff --git a/dom/base/EventSource.cpp b/dom/base/EventSource.cpp
index 3923693f5a16..1f1e1341e6ce 100644
--- a/dom/base/EventSource.cpp
+++ b/dom/base/EventSource.cpp
@@ -69,6 +69,7 @@ EventSource::EventSource(nsPIDOMWindow* aOwnerWindow) :
   mLastConvertionResult(NS_OK),
   mReadyState(CONNECTING),
   mScriptLine(0),
+  mScriptColumn(0),
   mInnerWindowID(0)
 {
 }
@@ -205,7 +206,8 @@ EventSource::Init(nsISupports* aOwner,
 
   // The conditional here is historical and not necessarily sane.
   if (JSContext *cx = nsContentUtils::GetCurrentJSContext()) {
-    nsJSUtils::GetCallingLocation(cx, mScriptFile, &mScriptLine);
+    nsJSUtils::GetCallingLocation(cx, mScriptFile, &mScriptLine,
+                                  &mScriptColumn);
     mInnerWindowID = nsJSUtils::GetCurrentlyRunningCodeInnerWindowID(cx);
   }
 
@@ -987,7 +989,7 @@ EventSource::PrintErrorOnConsole(const char *aBundleURI,
   rv = errObj->InitWithWindowID(message,
                                 mScriptFile,
                                 EmptyString(),
-                                mScriptLine, 0,
+                                mScriptLine, mScriptColumn,
                                 nsIScriptError::errorFlag,
                                 "Event Source", mInnerWindowID);
   NS_ENSURE_SUCCESS(rv, rv);
diff --git a/dom/base/EventSource.h b/dom/base/EventSource.h
index 8da821e20c2f..995ed47e1ea1 100644
--- a/dom/base/EventSource.h
+++ b/dom/base/EventSource.h
@@ -255,12 +255,14 @@ protected:
 
   // Event Source owner information:
   // - the script file name
-  // - source code line number where the Event Source object was constructed.
+  // - source code line number and column number where the Event Source object
+  //   was constructed.
   // - the ID of the inner window where the script lives. Note that this may not
   //   be the same as the Event Source owner window.
   // These attributes are used for error reporting.
   nsString mScriptFile;
   uint32_t mScriptLine;
+  uint32_t mScriptColumn;
   uint64_t mInnerWindowID;
 
 private:
diff --git a/dom/base/FragmentOrElement.cpp b/dom/base/FragmentOrElement.cpp
index 1cb8b5115d1f..84710ccf643c 100644
--- a/dom/base/FragmentOrElement.cpp
+++ b/dom/base/FragmentOrElement.cpp
@@ -806,12 +806,12 @@ nsIContent::PreHandleEvent(EventChainPreVisitor& aVisitor)
     //   selectstart
     bool stopEvent = false;
     switch (aVisitor.mEvent->mMessage) {
-      case NS_IMAGE_ABORT:
-      case NS_LOAD_ERROR:
-      case NS_FORM_SELECTED:
-      case NS_FORM_CHANGE:
-      case NS_LOAD:
-      case NS_FORM_RESET:
+      case eImageAbort:
+      case eLoadError:
+      case eFormSelect:
+      case eFormChange:
+      case eLoad:
+      case eFormReset:
       case eResize:
       case eScroll:
         stopEvent = true;
@@ -843,7 +843,7 @@ nsIContent::PreHandleEvent(EventChainPreVisitor& aVisitor)
       // The load event is special in that we don't ever propagate it
       // to chrome.
       nsCOMPtr<nsPIDOMWindow> win = OwnerDoc()->GetWindow();
-      EventTarget* parentTarget = win && aVisitor.mEvent->mMessage != NS_LOAD
+      EventTarget* parentTarget = win && aVisitor.mEvent->mMessage != eLoad
         ? win->GetParentTarget() : nullptr;
 
       aVisitor.mParentTarget = parentTarget;
diff --git a/dom/base/WebSocket.cpp b/dom/base/WebSocket.cpp
index 6dc59b3953e5..6a44ec5394c7 100644
--- a/dom/base/WebSocket.cpp
+++ b/dom/base/WebSocket.cpp
@@ -92,6 +92,7 @@ public:
   , mCloseEventWasClean(false)
   , mCloseEventCode(nsIWebSocketChannel::CLOSE_ABNORMAL)
   , mScriptLine(0)
+  , mScriptColumn(0)
   , mInnerWindowID(0)
   , mWorkerPrivate(nullptr)
 #ifdef DEBUG
@@ -121,6 +122,7 @@ public:
             nsTArray<nsString>& aProtocolArray,
             const nsACString& aScriptFile,
             uint32_t aScriptLine,
+            uint32_t aScriptColumn,
             ErrorResult& aRv,
             bool* aConnectionFailed);
 
@@ -197,12 +199,14 @@ public:
 
   // Web Socket owner information:
   // - the script file name, UTF8 encoded.
-  // - source code line number where the Web Socket object was constructed.
+  // - source code line number and column number where the Web Socket object
+  //   was constructed.
   // - the ID of the inner window where the script lives. Note that this may not
   //   be the same as the Web Socket owner window.
   // These attributes are used for error reporting.
   nsCString mScriptFile;
   uint32_t mScriptLine;
+  uint32_t mScriptColumn;
   uint64_t mInnerWindowID;
 
   WorkerPrivate* mWorkerPrivate;
@@ -370,13 +374,14 @@ WebSocketImpl::PrintErrorOnConsole(const char *aBundleURI,
   if (mInnerWindowID) {
     rv = errorObject->InitWithWindowID(message,
                                        NS_ConvertUTF8toUTF16(mScriptFile),
-                                       EmptyString(), mScriptLine, 0,
+                                       EmptyString(), mScriptLine,
+                                       mScriptColumn,
                                        nsIScriptError::errorFlag, "Web Socket",
                                        mInnerWindowID);
   } else {
     rv = errorObject->Init(message,
                            NS_ConvertUTF8toUTF16(mScriptFile),
-                           EmptyString(), mScriptLine, 0,
+                           EmptyString(), mScriptLine, mScriptColumn,
                            nsIScriptError::errorFlag, "Web Socket");
   }
 
@@ -1036,6 +1041,7 @@ public:
   InitRunnable(WebSocketImpl* aImpl, const nsAString& aURL,
                nsTArray<nsString>& aProtocolArray,
                const nsACString& aScriptFile, uint32_t aScriptLine,
+               uint32_t aScriptColumn,
                ErrorResult& aRv, bool* aConnectionFailed)
     : WebSocketMainThreadRunnable(aImpl->mWorkerPrivate)
     , mImpl(aImpl)
@@ -1043,6 +1049,7 @@ public:
     , mProtocolArray(aProtocolArray)
     , mScriptFile(aScriptFile)
     , mScriptLine(aScriptLine)
+    , mScriptColumn(aScriptColumn)
     , mRv(aRv)
     , mConnectionFailed(aConnectionFailed)
   {
@@ -1074,7 +1081,7 @@ protected:
     }
 
     mImpl->Init(jsapi.cx(), principal, mURL, mProtocolArray, mScriptFile,
-                mScriptLine, mRv, mConnectionFailed);
+                mScriptLine, mScriptColumn, mRv, mConnectionFailed);
     return true;
   }
 
@@ -1084,7 +1091,7 @@ protected:
     MOZ_ASSERT(aTopLevelWorkerPrivate && !aTopLevelWorkerPrivate->GetWindow());
 
     mImpl->Init(nullptr, aTopLevelWorkerPrivate->GetPrincipal(), mURL,
-                mProtocolArray, mScriptFile, mScriptLine, mRv,
+                mProtocolArray, mScriptFile, mScriptLine, mScriptColumn, mRv,
                 mConnectionFailed);
     return true;
   }
@@ -1096,6 +1103,7 @@ protected:
   nsTArray<nsString>& mProtocolArray;
   nsCString mScriptFile;
   uint32_t mScriptLine;
+  uint32_t mScriptColumn;
   ErrorResult& mRv;
   bool* mConnectionFailed;
 };
@@ -1217,7 +1225,7 @@ WebSocket::Constructor(const GlobalObject& aGlobal,
 
   if (NS_IsMainThread()) {
     webSocket->mImpl->Init(aGlobal.Context(), principal, aUrl, protocolArray,
-                           EmptyCString(), 0, aRv, &connectionFailed);
+                           EmptyCString(), 0, 0, aRv, &connectionFailed);
   } else {
     // In workers we have to keep the worker alive using a feature in order to
     // dispatch messages correctly.
@@ -1226,15 +1234,16 @@ WebSocket::Constructor(const GlobalObject& aGlobal,
       return nullptr;
     }
 
-    unsigned lineno;
+    unsigned lineno, column;
     JS::AutoFilename file;
-    if (!JS::DescribeScriptedCaller(aGlobal.Context(), &file, &lineno)) {
+    if (!JS::DescribeScriptedCaller(aGlobal.Context(), &file, &lineno,
+                                    &column)) {
       NS_WARNING("Failed to get line number and filename in workers.");
     }
 
     nsRefPtr<InitRunnable> runnable =
       new InitRunnable(webSocket->mImpl, aUrl, protocolArray,
-                       nsAutoCString(file.get()), lineno, aRv,
+                       nsAutoCString(file.get()), lineno, column, aRv,
                        &connectionFailed);
     runnable->Dispatch(aGlobal.Context());
   }
@@ -1395,6 +1404,7 @@ WebSocketImpl::Init(JSContext* aCx,
                     nsTArray<nsString>& aProtocolArray,
                     const nsACString& aScriptFile,
                     uint32_t aScriptLine,
+                    uint32_t aScriptColumn,
                     ErrorResult& aRv,
                     bool* aConnectionFailed)
 {
@@ -1434,14 +1444,16 @@ WebSocketImpl::Init(JSContext* aCx,
   if (mWorkerPrivate) {
     mScriptFile = aScriptFile;
     mScriptLine = aScriptLine;
+    mScriptColumn = aScriptColumn;
   } else {
     MOZ_ASSERT(aCx);
 
-    unsigned lineno;
+    unsigned lineno, column;
     JS::AutoFilename file;
-    if (JS::DescribeScriptedCaller(aCx, &file, &lineno)) {
+    if (JS::DescribeScriptedCaller(aCx, &file, &lineno, &column)) {
       mScriptFile = file.get();
       mScriptLine = lineno;
+      mScriptColumn = column;
     }
   }
 
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index a71c84ff93e8..2b4f30c91b35 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -3502,7 +3502,7 @@ nsContentUtils::ReportToConsoleNonLocalized(const nsAString& aErrorText,
   if (!aLineNumber) {
     JSContext *cx = GetCurrentJSContext();
     if (cx) {
-      nsJSUtils::GetCallingLocation(cx, spec, &aLineNumber);
+      nsJSUtils::GetCallingLocation(cx, spec, &aLineNumber, &aColumnNumber);
     }
   }
   if (spec.IsEmpty() && aURI)
@@ -5464,8 +5464,8 @@ nsContentUtils::SetDataTransferInEvent(WidgetDragEvent* aDragEvent)
   // For draggesture and dragstart events, the data transfer object is
   // created before the event fires, so it should already be set. For other
   // drag events, get the object from the drag session.
-  NS_ASSERTION(aDragEvent->mMessage != NS_DRAGDROP_GESTURE &&
-               aDragEvent->mMessage != NS_DRAGDROP_START,
+  NS_ASSERTION(aDragEvent->mMessage != eLegacyDragGesture &&
+               aDragEvent->mMessage != eDragStart,
                "draggesture event created without a dataTransfer");
 
   nsCOMPtr<nsIDragSession> dragSession = GetDragSession();
@@ -5492,8 +5492,8 @@ nsContentUtils::SetDataTransferInEvent(WidgetDragEvent* aDragEvent)
   }
 
   bool isCrossDomainSubFrameDrop = false;
-  if (aDragEvent->mMessage == NS_DRAGDROP_DROP ||
-      aDragEvent->mMessage == NS_DRAGDROP_DRAGDROP) {
+  if (aDragEvent->mMessage == eDrop ||
+      aDragEvent->mMessage == eLegacyDragDrop) {
     isCrossDomainSubFrameDrop = CheckForSubFrameDrop(dragSession, aDragEvent);
   }
 
@@ -5507,16 +5507,15 @@ nsContentUtils::SetDataTransferInEvent(WidgetDragEvent* aDragEvent)
   // for the dragenter and dragover events, initialize the drop effect
   // from the drop action, which platform specific widget code sets before
   // the event is fired based on the keyboard state.
-  if (aDragEvent->mMessage == NS_DRAGDROP_ENTER ||
-      aDragEvent->mMessage == NS_DRAGDROP_OVER) {
+  if (aDragEvent->mMessage == eDragEnter || aDragEvent->mMessage == eDragOver) {
     uint32_t action, effectAllowed;
     dragSession->GetDragAction(&action);
     aDragEvent->dataTransfer->GetEffectAllowedInt(&effectAllowed);
     aDragEvent->dataTransfer->SetDropEffectInt(FilterDropEffect(action, effectAllowed));
   }
-  else if (aDragEvent->mMessage == NS_DRAGDROP_DROP ||
-           aDragEvent->mMessage == NS_DRAGDROP_DRAGDROP ||
-           aDragEvent->mMessage == NS_DRAGDROP_END) {
+  else if (aDragEvent->mMessage == eDrop ||
+           aDragEvent->mMessage == eLegacyDragDrop ||
+           aDragEvent->mMessage == eDragEnd) {
     // For the drop and dragend events, set the drop effect based on the
     // last value that the dropEffect had. This will have been set in
     // EventStateManager::PostHandleEvent for the last dragenter or
diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index bc65e3039b6d..bc6834627b6d 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -299,25 +299,6 @@ nsDOMWindowUtils::UpdateLayerTree()
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsDOMWindowUtils::SetCSSViewport(float aWidthPx, float aHeightPx)
-{
-  MOZ_RELEASE_ASSERT(nsContentUtils::IsCallerChrome());
-
-  if (!(aWidthPx >= 0.0 && aHeightPx >= 0.0)) {
-    return NS_ERROR_ILLEGAL_VALUE;
-  }
-
-  nsIPresShell* presShell = GetPresShell();
-  if (!presShell) {
-    return NS_ERROR_FAILURE;
-  }
-
-  nsLayoutUtils::SetCSSViewport(presShell, CSSSize(aWidthPx, aHeightPx));
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsDOMWindowUtils::GetViewportInfo(uint32_t aDisplayWidth,
                                   uint32_t aDisplayHeight,
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 583ae57b3881..eeb7f2e0d61f 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -8146,7 +8146,7 @@ nsDocument::PreHandleEvent(EventChainPreVisitor& aVisitor)
   aVisitor.mForceContentDispatch = true;
 
   // Load events must not propagate to |window| object, see bug 335251.
-  if (aVisitor.mEvent->mMessage != NS_LOAD) {
+  if (aVisitor.mEvent->mMessage != eLoad) {
     nsGlobalWindow* window = static_cast<nsGlobalWindow*>(GetWindow());
     aVisitor.mParentTarget =
       window ? window->GetTargetForEventTargetChain() : nullptr;
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index e725ef31d96a..743abe646395 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -966,7 +966,7 @@ nsFocusManager::WindowHidden(nsIDOMWindow* aWindow)
     window->UpdateCommands(NS_LITERAL_STRING("focus"), nullptr, 0);
 
     if (presShell) {
-      SendFocusOrBlurEvent(NS_BLUR_CONTENT, presShell,
+      SendFocusOrBlurEvent(eBlur, presShell,
                            oldFocusedContent->GetComposedDoc(),
                            oldFocusedContent, 1, false);
     }
@@ -1682,7 +1682,7 @@ nsFocusManager::Blur(nsPIDOMWindow* aWindowToClear,
     if (mActiveWindow)
       window->UpdateCommands(NS_LITERAL_STRING("focus"), nullptr, 0);
 
-    SendFocusOrBlurEvent(NS_BLUR_CONTENT, presShell,
+    SendFocusOrBlurEvent(eBlur, presShell,
                          content->GetComposedDoc(), content, 1, false);
   }
 
@@ -1729,9 +1729,9 @@ nsFocusManager::Blur(nsPIDOMWindow* aWindowToClear,
     // the document isn't null in case someone closed it during the blur above
     nsIDocument* doc = window->GetExtantDoc();
     if (doc)
-      SendFocusOrBlurEvent(NS_BLUR_CONTENT, presShell, doc, doc, 1, false);
+      SendFocusOrBlurEvent(eBlur, presShell, doc, doc, 1, false);
     if (mFocusedWindow == nullptr)
-      SendFocusOrBlurEvent(NS_BLUR_CONTENT, presShell, doc, window, 1, false);
+      SendFocusOrBlurEvent(eBlur, presShell, doc, window, 1, false);
 
     // check if a different window was focused
     result = (mFocusedWindow == nullptr && mActiveWindow);
@@ -1857,10 +1857,10 @@ nsFocusManager::Focus(nsPIDOMWindow* aWindow,
                                      GetFocusMoveActionCause(aFlags));
     }
     if (doc)
-      SendFocusOrBlurEvent(NS_FOCUS_CONTENT, presShell, doc,
+      SendFocusOrBlurEvent(eFocus, presShell, doc,
                            doc, aFlags & FOCUSMETHOD_MASK, aWindowRaised);
     if (mFocusedWindow == aWindow && mFocusedContent == nullptr)
-      SendFocusOrBlurEvent(NS_FOCUS_CONTENT, presShell, doc,
+      SendFocusOrBlurEvent(eFocus, presShell, doc,
                            aWindow, aFlags & FOCUSMETHOD_MASK, aWindowRaised);
   }
 
@@ -1908,7 +1908,7 @@ nsFocusManager::Focus(nsPIDOMWindow* aWindow,
       if (!aWindowRaised)
         aWindow->UpdateCommands(NS_LITERAL_STRING("focus"), nullptr, 0);
 
-      SendFocusOrBlurEvent(NS_FOCUS_CONTENT, presShell,
+      SendFocusOrBlurEvent(eFocus, presShell,
                            aContent->GetComposedDoc(),
                            aContent, aFlags & FOCUSMETHOD_MASK,
                            aWindowRaised, isRefocus);
@@ -2001,8 +2001,7 @@ nsFocusManager::SendFocusOrBlurEvent(EventMessage aEventMessage,
                                      bool aWindowRaised,
                                      bool aIsRefocus)
 {
-  NS_ASSERTION(aEventMessage == NS_FOCUS_CONTENT ||
-               aEventMessage == NS_BLUR_CONTENT,
+  NS_ASSERTION(aEventMessage == eFocus || aEventMessage == eBlur,
                "Wrong event type for SendFocusOrBlurEvent");
 
   nsCOMPtr<EventTarget> eventTarget = do_QueryInterface(aTarget);
@@ -2042,7 +2041,7 @@ nsFocusManager::SendFocusOrBlurEvent(EventMessage aEventMessage,
 #ifdef ACCESSIBILITY
   nsAccessibilityService* accService = GetAccService();
   if (accService) {
-    if (aEventMessage == NS_FOCUS_CONTENT) {
+    if (aEventMessage == eFocus) {
       accService->NotifyOfDOMFocus(aTarget);
     } else {
       accService->NotifyOfDOMBlur(aTarget);
diff --git a/dom/base/nsFocusManager.h b/dom/base/nsFocusManager.h
index 73fa2e9cf025..a2aad11dcebb 100644
--- a/dom/base/nsFocusManager.h
+++ b/dom/base/nsFocusManager.h
@@ -280,7 +280,7 @@ protected:
   /**
    * Fires a focus or blur event at aTarget.
    *
-   * aEventMessage should be either NS_FOCUS_CONTENT or NS_BLUR_CONTENT.
+   * aEventMessage should be either eFocus or eBlur.
    * For blur events, aFocusMethod should normally be non-zero.
    *
    * aWindowRaised should only be true if called from WindowRaised.
diff --git a/dom/base/nsFrameLoader.cpp b/dom/base/nsFrameLoader.cpp
index 7265c4df0276..7a507ab13ec5 100644
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@@ -157,7 +157,6 @@ nsFrameLoader::nsFrameLoader(Element* aOwner, bool aNetworkCreated)
   , mObservingOwnerContent(false)
   , mVisible(true)
 {
-  ResetPermissionManagerStatus();
   mRemoteFrame = ShouldUseRemoteProcess();
 }
 
@@ -409,6 +408,9 @@ nsFrameLoader::ReallyStartLoadingInternal()
   mURIToLoad = nullptr;
   NS_ENSURE_SUCCESS(rv, rv);
 
+  // Track the appId's reference count if this frame is in-process
+  ResetPermissionManagerStatus();
+
   return NS_OK;
 }
 
@@ -2705,7 +2707,9 @@ nsFrameLoader::ResetPermissionManagerStatus()
 {
   // The resetting of the permissions status can run only
   // in the main process.
-  if (XRE_IsContentProcess()) {
+  // only in-main-process && in-process frame is handled here and all other
+  // cases are handled by ContentParent.
+  if (XRE_IsContentProcess() || mRemoteFrame) {
     return;
   }
 
diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager.cpp
index 747d864871c2..1b58112be0de 100644
--- a/dom/base/nsFrameMessageManager.cpp
+++ b/dom/base/nsFrameMessageManager.cpp
@@ -663,12 +663,12 @@ GetParamsForMessage(JSContext* aCx,
   nsCOMPtr<nsIConsoleService> console(do_GetService(NS_CONSOLESERVICE_CONTRACTID));
   if (console) {
     nsAutoString filename;
-    uint32_t lineno = 0;
-    nsJSUtils::GetCallingLocation(aCx, filename, &lineno);
+    uint32_t lineno = 0, column = 0;
+    nsJSUtils::GetCallingLocation(aCx, filename, &lineno, &column);
     nsCOMPtr<nsIScriptError> error(do_CreateInstance(NS_SCRIPTERROR_CONTRACTID));
     error->Init(NS_LITERAL_STRING("Sending message that cannot be cloned. Are you trying to send an XPCOM object?"),
-                filename, EmptyString(),
-                lineno, 0, nsIScriptError::warningFlag, "chrome javascript");
+                filename, EmptyString(), lineno, column,
+                nsIScriptError::warningFlag, "chrome javascript");
     console->LogMessage(error);
   }
 
diff --git a/dom/base/nsGenConImageContent.cpp b/dom/base/nsGenConImageContent.cpp
index 98fcae28fde3..792126e908c8 100644
--- a/dom/base/nsGenConImageContent.cpp
+++ b/dom/base/nsGenConImageContent.cpp
@@ -49,8 +49,8 @@ public:
   virtual nsresult PreHandleEvent(EventChainPreVisitor& aVisitor) override
   {
     MOZ_ASSERT(IsInNativeAnonymousSubtree());
-    if (aVisitor.mEvent->mMessage == NS_LOAD ||
-        aVisitor.mEvent->mMessage == NS_LOAD_ERROR) {
+    if (aVisitor.mEvent->mMessage == eLoad ||
+        aVisitor.mEvent->mMessage == eLoadError) {
       // Don't propagate the events to the parent.
       return NS_OK;
     }
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index d0901337aaa6..54047d6aedc8 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -3086,7 +3086,7 @@ nsGlobalWindow::PreHandleEvent(EventChainPreVisitor& aVisitor)
     }
   } else if (msg == eMouseDown && aVisitor.mEvent->mFlags.mIsTrusted) {
     gMouseDown = true;
-  } else if ((msg == eMouseUp || msg == NS_DRAGDROP_END) &&
+  } else if ((msg == eMouseUp || msg == eDragEnd) &&
              aVisitor.mEvent->mFlags.mIsTrusted) {
     gMouseDown = false;
     if (gDragServiceDisabled) {
@@ -3265,8 +3265,8 @@ nsGlobalWindow::PostHandleEvent(EventChainPostVisitor& aVisitor)
   // Return early if there is nothing to do.
   switch (aVisitor.mEvent->mMessage) {
     case eResize:
-    case NS_PAGE_UNLOAD:
-    case NS_LOAD:
+    case eUnload:
+    case eLoad:
       break;
     default:
       return NS_OK;
@@ -3280,7 +3280,7 @@ nsGlobalWindow::PostHandleEvent(EventChainPostVisitor& aVisitor)
 
   if (aVisitor.mEvent->mMessage == eResize) {
     mIsHandlingResizeEvent = false;
-  } else if (aVisitor.mEvent->mMessage == NS_PAGE_UNLOAD &&
+  } else if (aVisitor.mEvent->mMessage == eUnload &&
              aVisitor.mEvent->mFlags.mIsTrusted) {
     // Execute bindingdetached handlers before we tear ourselves
     // down.
@@ -3288,7 +3288,7 @@ nsGlobalWindow::PostHandleEvent(EventChainPostVisitor& aVisitor)
       mDoc->BindingManager()->ExecuteDetachedHandlers();
     }
     mIsDocumentLoaded = false;
-  } else if (aVisitor.mEvent->mMessage == NS_LOAD &&
+  } else if (aVisitor.mEvent->mMessage == eLoad &&
              aVisitor.mEvent->mFlags.mIsTrusted) {
     // This is page load event since load events don't propagate to |window|.
     // @see nsDocument::PreHandleEvent.
@@ -3302,7 +3302,7 @@ nsGlobalWindow::PostHandleEvent(EventChainPostVisitor& aVisitor)
       // onload event for the frame element.
 
       nsEventStatus status = nsEventStatus_eIgnore;
-      WidgetEvent event(aVisitor.mEvent->mFlags.mIsTrusted, NS_LOAD);
+      WidgetEvent event(aVisitor.mEvent->mFlags.mIsTrusted, eLoad);
       event.mFlags.mBubbles = false;
 
       // Most of the time we could get a pres context to pass in here,
diff --git a/dom/base/nsJSUtils.cpp b/dom/base/nsJSUtils.cpp
index 8c1829b3d9ba..ea2ad69a0567 100644
--- a/dom/base/nsJSUtils.cpp
+++ b/dom/base/nsJSUtils.cpp
@@ -35,10 +35,10 @@ using namespace mozilla::dom;
 
 bool
 nsJSUtils::GetCallingLocation(JSContext* aContext, nsACString& aFilename,
-                              uint32_t* aLineno)
+                              uint32_t* aLineno, uint32_t* aColumn)
 {
   JS::AutoFilename filename;
-  if (!JS::DescribeScriptedCaller(aContext, &filename, aLineno)) {
+  if (!JS::DescribeScriptedCaller(aContext, &filename, aLineno, aColumn)) {
     return false;
   }
 
@@ -48,10 +48,10 @@ nsJSUtils::GetCallingLocation(JSContext* aContext, nsACString& aFilename,
 
 bool
 nsJSUtils::GetCallingLocation(JSContext* aContext, nsAString& aFilename,
-                              uint32_t* aLineno)
+                              uint32_t* aLineno, uint32_t* aColumn)
 {
   JS::AutoFilename filename;
-  if (!JS::DescribeScriptedCaller(aContext, &filename, aLineno)) {
+  if (!JS::DescribeScriptedCaller(aContext, &filename, aLineno, aColumn)) {
     return false;
   }
 
diff --git a/dom/base/nsJSUtils.h b/dom/base/nsJSUtils.h
index e1a1956b3083..c0fc22d6179d 100644
--- a/dom/base/nsJSUtils.h
+++ b/dom/base/nsJSUtils.h
@@ -35,9 +35,11 @@ class nsJSUtils
 {
 public:
   static bool GetCallingLocation(JSContext* aContext, nsACString& aFilename,
-                                 uint32_t* aLineno);
+                                 uint32_t* aLineno = nullptr,
+                                 uint32_t* aColumn = nullptr);
   static bool GetCallingLocation(JSContext* aContext, nsAString& aFilename,
-                                 uint32_t* aLineno);
+                                 uint32_t* aLineno = nullptr,
+                                 uint32_t* aColumn = nullptr);
 
   static nsIScriptGlobalObject *GetStaticScriptGlobal(JSObject* aObj);
 
diff --git a/dom/base/nsScriptElement.cpp b/dom/base/nsScriptElement.cpp
index ef7ec836f0c7..a63557151ed8 100644
--- a/dom/base/nsScriptElement.cpp
+++ b/dom/base/nsScriptElement.cpp
@@ -59,10 +59,10 @@ nsScriptElement::ScriptEvaluated(nsresult aResult,
       nsContentUtils::GetContextForContent(cont);
 
     nsEventStatus status = nsEventStatus_eIgnore;
-    EventMessage message = NS_SUCCEEDED(aResult) ? NS_LOAD : NS_LOAD_ERROR;
+    EventMessage message = NS_SUCCEEDED(aResult) ? eLoad : eLoadError;
     WidgetEvent event(true, message);
     // Load event doesn't bubble.
-    event.mFlags.mBubbles = (message != NS_LOAD);
+    event.mFlags.mBubbles = (message != eLoad);
 
     EventDispatcher::Dispatch(cont, presContext, &event, nullptr, &status);
   }
diff --git a/dom/canvas/moz.build b/dom/canvas/moz.build
index 461847306cf8..39288fe6be89 100644
--- a/dom/canvas/moz.build
+++ b/dom/canvas/moz.build
@@ -139,7 +139,6 @@ UNIFIED_SOURCES += [
 ]
 
 LOCAL_INCLUDES += [
-    '../..', # Support `#include "mfbt/RefPtr.h"`
     '/js/xpconnect/wrappers',
 ]
 
diff --git a/dom/events/DataTransfer.cpp b/dom/events/DataTransfer.cpp
index e54ab7be9503..5e8843343546 100644
--- a/dom/events/DataTransfer.cpp
+++ b/dom/events/DataTransfer.cpp
@@ -68,40 +68,41 @@ const char DataTransfer::sEffects[8][9] = {
   "none", "copy", "move", "copyMove", "link", "copyLink", "linkMove", "all"
 };
 
-DataTransfer::DataTransfer(nsISupports* aParent, uint32_t aEventType,
+DataTransfer::DataTransfer(nsISupports* aParent, EventMessage aEventMessage,
                            bool aIsExternal, int32_t aClipboardType)
-  : mParent(aParent),
-    mEventType(aEventType),
-    mDropEffect(nsIDragService::DRAGDROP_ACTION_NONE),
-    mEffectAllowed(nsIDragService::DRAGDROP_ACTION_UNINITIALIZED),
-    mCursorState(false),
-    mReadOnly(true),
-    mIsExternal(aIsExternal),
-    mUserCancelled(false),
-    mIsCrossDomainSubFrameDrop(false),
-    mClipboardType(aClipboardType),
-    mDragImageX(0),
-    mDragImageY(0)
+  : mParent(aParent)
+  , mDropEffect(nsIDragService::DRAGDROP_ACTION_NONE)
+  , mEffectAllowed(nsIDragService::DRAGDROP_ACTION_UNINITIALIZED)
+  , mEventMessage(aEventMessage)
+  , mCursorState(false)
+  , mReadOnly(true)
+  , mIsExternal(aIsExternal)
+  , mUserCancelled(false)
+  , mIsCrossDomainSubFrameDrop(false)
+  , mClipboardType(aClipboardType)
+  , mDragImageX(0)
+  , mDragImageY(0)
 {
   // For these events, we want to be able to add data to the data transfer, so
   // clear the readonly state. Otherwise, the data is already present. For
   // external usage, cache the data from the native clipboard or drag.
-  if (aEventType == NS_CUT ||
-      aEventType == NS_COPY ||
-      aEventType == NS_DRAGDROP_START ||
-      aEventType == NS_DRAGDROP_GESTURE) {
+  if (aEventMessage == NS_CUT ||
+      aEventMessage == NS_COPY ||
+      aEventMessage == eDragStart ||
+      aEventMessage == eLegacyDragGesture) {
     mReadOnly = false;
   } else if (mIsExternal) {
-    if (aEventType == NS_PASTE) {
+    if (aEventMessage == NS_PASTE) {
       CacheExternalClipboardFormats();
-    } else if (aEventType >= NS_DRAGDROP_EVENT_START && aEventType <= NS_DRAGDROP_LEAVE) {
+    } else if (aEventMessage >= eDragDropEventFirst &&
+               aEventMessage <= eDragDropEventLast) {
       CacheExternalDragFormats();
     }
   }
 }
 
 DataTransfer::DataTransfer(nsISupports* aParent,
-                           uint32_t aEventType,
+                           EventMessage aEventMessage,
                            const uint32_t aEffectAllowed,
                            bool aCursorState,
                            bool aIsExternal,
@@ -112,20 +113,20 @@ DataTransfer::DataTransfer(nsISupports* aParent,
                            Element* aDragImage,
                            uint32_t aDragImageX,
                            uint32_t aDragImageY)
-  : mParent(aParent),
-    mEventType(aEventType),
-    mDropEffect(nsIDragService::DRAGDROP_ACTION_NONE),
-    mEffectAllowed(aEffectAllowed),
-    mCursorState(aCursorState),
-    mReadOnly(true),
-    mIsExternal(aIsExternal),
-    mUserCancelled(aUserCancelled),
-    mIsCrossDomainSubFrameDrop(aIsCrossDomainSubFrameDrop),
-    mClipboardType(aClipboardType),
-    mItems(aItems),
-    mDragImage(aDragImage),
-    mDragImageX(aDragImageX),
-    mDragImageY(aDragImageY)
+  : mParent(aParent)
+  , mDropEffect(nsIDragService::DRAGDROP_ACTION_NONE)
+  , mEffectAllowed(aEffectAllowed)
+  , mEventMessage(aEventMessage)
+  , mCursorState(aCursorState)
+  , mReadOnly(true)
+  , mIsExternal(aIsExternal)
+  , mUserCancelled(aUserCancelled)
+  , mIsCrossDomainSubFrameDrop(aIsCrossDomainSubFrameDrop)
+  , mClipboardType(aClipboardType)
+  , mItems(aItems)
+  , mDragImage(aDragImage)
+  , mDragImageX(aDragImageX)
+  , mDragImageY(aDragImageY)
 {
   MOZ_ASSERT(mParent);
   // The items are copied from aItems into mItems. There is no need to copy
@@ -133,8 +134,8 @@ DataTransfer::DataTransfer(nsISupports* aParent,
   // draggesture and dragstart events are the only times when items are
   // modifiable, but those events should have been using the first constructor
   // above.
-  NS_ASSERTION(aEventType != NS_DRAGDROP_GESTURE &&
-               aEventType != NS_DRAGDROP_START,
+  NS_ASSERTION(aEventMessage != eLegacyDragGesture &&
+               aEventMessage != eDragStart,
                "invalid event type for DataTransfer constructor");
 }
 
@@ -268,8 +269,9 @@ DataTransfer::GetMozUserCancelled(bool* aUserCancelled)
 FileList*
 DataTransfer::GetFiles(ErrorResult& aRv)
 {
-  if (mEventType != NS_DRAGDROP_DROP && mEventType != NS_DRAGDROP_DRAGDROP &&
-      mEventType != NS_PASTE) {
+  if (mEventMessage != eDrop &&
+      mEventMessage != eLegacyDragDrop &&
+      mEventMessage != NS_PASTE) {
     return nullptr;
   }
 
@@ -541,7 +543,8 @@ DataTransfer::MozTypesAt(uint32_t aIndex, ErrorResult& aRv)
 {
   // Only the first item is valid for clipboard events
   if (aIndex > 0 &&
-      (mEventType == NS_CUT || mEventType == NS_COPY || mEventType == NS_PASTE)) {
+      (mEventMessage == NS_CUT || mEventMessage == NS_COPY ||
+       mEventMessage == NS_PASTE)) {
     aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return nullptr;
   }
@@ -581,7 +584,8 @@ DataTransfer::MozGetDataAt(const nsAString& aFormat, uint32_t aIndex,
 
   // Only the first item is valid for clipboard events
   if (aIndex > 0 &&
-      (mEventType == NS_CUT || mEventType == NS_COPY || mEventType == NS_PASTE)) {
+      (mEventMessage == NS_CUT || mEventMessage == NS_COPY ||
+       mEventMessage == NS_PASTE)) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
@@ -599,8 +603,8 @@ DataTransfer::MozGetDataAt(const nsAString& aFormat, uint32_t aIndex,
   // only allow access to the data with the same principal.
   nsIPrincipal* principal = nullptr;
   if (mIsCrossDomainSubFrameDrop ||
-      (mEventType != NS_DRAGDROP_DROP && mEventType != NS_DRAGDROP_DRAGDROP &&
-       mEventType != NS_PASTE &&
+      (mEventMessage != eDrop && mEventMessage != eLegacyDragDrop &&
+       mEventMessage != NS_PASTE &&
        !nsContentUtils::IsCallerChrome())) {
     principal = nsContentUtils::SubjectPrincipal();
   }
@@ -692,7 +696,8 @@ DataTransfer::MozSetDataAt(const nsAString& aFormat, nsIVariant* aData,
 
   // Only the first item is valid for clipboard events
   if (aIndex > 0 &&
-      (mEventType == NS_CUT || mEventType == NS_COPY || mEventType == NS_PASTE)) {
+      (mEventMessage == NS_CUT || mEventMessage == NS_COPY ||
+       mEventMessage == NS_PASTE)) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
@@ -737,7 +742,8 @@ DataTransfer::MozClearDataAt(const nsAString& aFormat, uint32_t aIndex,
 
   // Only the first item is valid for clipboard events
   if (aIndex > 0 &&
-      (mEventType == NS_CUT || mEventType == NS_COPY || mEventType == NS_PASTE)) {
+      (mEventMessage == NS_CUT || mEventMessage == NS_COPY ||
+       mEventMessage == NS_PASTE)) {
     aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return;
   }
@@ -752,8 +758,8 @@ DataTransfer::MozClearDataAtHelper(const nsAString& aFormat, uint32_t aIndex,
   MOZ_ASSERT(!mReadOnly);
   MOZ_ASSERT(aIndex < mItems.Length());
   MOZ_ASSERT(aIndex == 0 ||
-             (mEventType != NS_CUT && mEventType != NS_COPY &&
-              mEventType != NS_PASTE));
+             (mEventMessage != NS_CUT && mEventMessage != NS_COPY &&
+              mEventMessage != NS_PASTE));
 
   nsAutoString format;
   GetRealFormat(aFormat, format);
@@ -938,12 +944,12 @@ DataTransfer::AddElement(nsIDOMElement* aElement)
 }
 
 nsresult
-DataTransfer::Clone(nsISupports* aParent, uint32_t aEventType,
+DataTransfer::Clone(nsISupports* aParent, EventMessage aEventMessage,
                     bool aUserCancelled, bool aIsCrossDomainSubFrameDrop,
                     DataTransfer** aNewDataTransfer)
 {
   DataTransfer* newDataTransfer =
-    new DataTransfer(aParent, aEventType, mEffectAllowed, mCursorState,
+    new DataTransfer(aParent, aEventMessage, mEffectAllowed, mCursorState,
                      mIsExternal, aUserCancelled, aIsCrossDomainSubFrameDrop,
                      mClipboardType, mItems, mDragImage, mDragImageX,
                      mDragImageY);
@@ -1252,7 +1258,8 @@ DataTransfer::CacheExternalDragFormats()
 void
 DataTransfer::CacheExternalClipboardFormats()
 {
-  NS_ASSERTION(mEventType == NS_PASTE, "caching clipboard data for invalid event");
+  NS_ASSERTION(mEventMessage == NS_PASTE,
+               "caching clipboard data for invalid event");
 
   // Called during the constructor for paste events to cache the formats
   // available on the clipboard. As with CacheExternalDragFormats, the
@@ -1293,7 +1300,7 @@ DataTransfer::FillInExternalData(TransferItem& aItem, uint32_t aIndex)
   }
 
   // only drag and paste events should be calling FillInExternalData
-  NS_ASSERTION(mEventType != NS_CUT && mEventType != NS_COPY,
+  NS_ASSERTION(mEventMessage != NS_CUT && mEventMessage != NS_COPY,
                "clipboard event with empty data");
 
     NS_ConvertUTF16toUTF8 utf8format(aItem.mFormat);
@@ -1311,7 +1318,7 @@ DataTransfer::FillInExternalData(TransferItem& aItem, uint32_t aIndex)
   trans->Init(nullptr);
   trans->AddDataFlavor(format);
 
-  if (mEventType == NS_PASTE) {
+  if (mEventMessage == NS_PASTE) {
     MOZ_ASSERT(aIndex == 0, "index in clipboard must be 0");
 
     nsCOMPtr<nsIClipboard> clipboard = do_GetService("@mozilla.org/widget/clipboard;1");
diff --git a/dom/events/DataTransfer.h b/dom/events/DataTransfer.h
index 4fd5ff7d155a..1d03896b2ccd 100644
--- a/dom/events/DataTransfer.h
+++ b/dom/events/DataTransfer.h
@@ -18,6 +18,7 @@
 
 #include "nsAutoPtr.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/EventForwards.h"
 #include "mozilla/dom/File.h"
 #include "mozilla/dom/Promise.h"
 
@@ -75,7 +76,7 @@ protected:
   // this constructor is used only by the Clone method to copy the fields as
   // needed to a new data transfer.
   DataTransfer(nsISupports* aParent,
-               uint32_t aEventType,
+               EventMessage aEventMessage,
                const uint32_t aEffectAllowed,
                bool aCursorState,
                bool aIsExternal,
@@ -95,8 +96,6 @@ public:
 
   // Constructor for DataTransfer.
   //
-  // aEventType is an event constant (such as NS_DRAGDROP_START)
-  //
   // aIsExternal must only be true when used to create a dataTransfer for a
   // paste or a drag that was started without using a data transfer. The
   // latter will occur when an external drag occurs, that is, a drag where the
@@ -104,8 +103,8 @@ public:
   // service directly. For clipboard operations, aClipboardType indicates
   // which clipboard to use, from nsIClipboard, or -1 for non-clipboard operations,
   // or if access to the system clipboard should not be allowed.
-  DataTransfer(nsISupports* aParent, uint32_t aEventType, bool aIsExternal,
-               int32_t aClipboardType);
+  DataTransfer(nsISupports* aParent, EventMessage aEventMessage,
+               bool aIsExternal, int32_t aClipboardType);
 
   virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
   nsISupports* GetParentObject()
@@ -222,8 +221,9 @@ public:
     return mDragImage;
   }
 
-  nsresult Clone(nsISupports* aParent, uint32_t aEventType, bool aUserCancelled,
-                 bool aIsCrossDomainSubFrameDrop, DataTransfer** aResult);
+  nsresult Clone(nsISupports* aParent, EventMessage aEventMessage,
+                 bool aUserCancelled, bool aIsCrossDomainSubFrameDrop,
+                 DataTransfer** aResult);
 
 protected:
 
@@ -254,14 +254,15 @@ protected:
 
   nsCOMPtr<nsISupports> mParent;
 
-  // the event type this data transfer is for. This will correspond to an
-  // event->mMessage value.
-  uint32_t mEventType;
 
   // the drop effect and effect allowed
   uint32_t mDropEffect;
   uint32_t mEffectAllowed;
 
+  // the event message this data transfer is for. This will correspond to an
+  // event->mMessage value.
+  EventMessage mEventMessage;
+
   // Indicates the behavior of the cursor during drag operations
   bool mCursorState;
 
diff --git a/dom/events/Event.cpp b/dom/events/Event.cpp
index 000b59e5f963..2c9258efb92c 100644
--- a/dom/events/Event.cpp
+++ b/dom/events/Event.cpp
@@ -716,12 +716,12 @@ Event::GetEventPopupControlState(WidgetEvent* aEvent, nsIDOMEvent* aDOMEvent)
     // nsPresShell::HandleEventInternal() for details.
     if (EventStateManager::IsHandlingUserInput()) {
       switch(aEvent->mMessage) {
-      case NS_FORM_SELECTED :
+      case eFormSelect:
         if (PopupAllowedForEvent("select")) {
           abuse = openControlled;
         }
         break;
-      case NS_FORM_CHANGE :
+      case eFormChange:
         if (PopupAllowedForEvent("change")) {
           abuse = openControlled;
         }
@@ -753,7 +753,7 @@ Event::GetEventPopupControlState(WidgetEvent* aEvent, nsIDOMEvent* aDOMEvent)
     // nsPresShell::HandleEventInternal() for details.
     if (EventStateManager::IsHandlingUserInput()) {
       switch(aEvent->mMessage) {
-      case NS_FORM_CHANGE :
+      case eFormChange:
         if (PopupAllowedForEvent("change")) {
           abuse = openControlled;
         }
@@ -853,12 +853,12 @@ Event::GetEventPopupControlState(WidgetEvent* aEvent, nsIDOMEvent* aDOMEvent)
     // nsPresShell::HandleEventInternal() for details.
     if (EventStateManager::IsHandlingUserInput()) {
       switch(aEvent->mMessage) {
-      case NS_FORM_SUBMIT :
+      case eFormSubmit:
         if (PopupAllowedForEvent("submit")) {
           abuse = openControlled;
         }
         break;
-      case NS_FORM_RESET :
+      case eFormReset:
         if (PopupAllowedForEvent("reset")) {
           abuse = openControlled;
         }
diff --git a/dom/events/EventListenerManager.cpp b/dom/events/EventListenerManager.cpp
index 1b2d23bca6c7..2fec0314ff5b 100644
--- a/dom/events/EventListenerManager.cpp
+++ b/dom/events/EventListenerManager.cpp
@@ -1339,8 +1339,8 @@ EventListenerManager::HasUnloadListeners()
   uint32_t count = mListeners.Length();
   for (uint32_t i = 0; i < count; ++i) {
     Listener* listener = &mListeners.ElementAt(i);
-    if (listener->mEventMessage == NS_PAGE_UNLOAD ||
-        listener->mEventMessage == NS_BEFORE_PAGE_UNLOAD) {
+    if (listener->mEventMessage == eUnload ||
+        listener->mEventMessage == eBeforeUnload) {
       return true;
     }
   }
diff --git a/dom/events/EventNameList.h b/dom/events/EventNameList.h
index f9cffff795ca..368f97b16ac3 100644
--- a/dom/events/EventNameList.h
+++ b/dom/events/EventNameList.h
@@ -149,7 +149,7 @@
 #endif /* BEFOREUNLOAD_EVENT */
 
 EVENT(abort,
-      NS_IMAGE_ABORT,
+      eImageAbort,
       EventNameType_All,
       eBasicEventClass)
 EVENT(canplay,
@@ -161,7 +161,7 @@ EVENT(canplaythrough,
       EventNameType_HTML,
       eBasicEventClass)
 EVENT(change,
-      NS_FORM_CHANGE,
+      eFormChange,
       EventNameType_HTMLXUL,
       eBasicEventClass)
 EVENT(click,
@@ -179,31 +179,31 @@ EVENT(dblclick,
       EventNameType_HTMLXUL,
       eMouseEventClass)
 EVENT(drag,
-      NS_DRAGDROP_DRAG,
+      eDrag,
       EventNameType_HTMLXUL,
       eDragEventClass)
 EVENT(dragend,
-      NS_DRAGDROP_END,
+      eDragEnd,
       EventNameType_HTMLXUL,
       eDragEventClass)
 EVENT(dragenter,
-      NS_DRAGDROP_ENTER,
+      eDragEnter,
       EventNameType_HTMLXUL,
       eDragEventClass)
 EVENT(dragleave,
-      NS_DRAGDROP_LEAVE,
+      eDragLeave,
       EventNameType_HTMLXUL,
       eDragEventClass)
 EVENT(dragover,
-      NS_DRAGDROP_OVER,
+      eDragOver,
       EventNameType_HTMLXUL,
       eDragEventClass)
 EVENT(dragstart,
-      NS_DRAGDROP_START,
+      eDragStart,
       EventNameType_HTMLXUL,
       eDragEventClass)
 EVENT(drop,
-      NS_DRAGDROP_DROP,
+      eDrop,
       EventNameType_HTMLXUL,
       eDragEventClass)
 EVENT(durationchange,
@@ -223,7 +223,7 @@ EVENT(input,
       EventNameType_HTMLXUL,
       eEditorInputEventClass)
 EVENT(invalid,
-      NS_FORM_INVALID,
+      eFormInvalid,
       EventNameType_HTMLXUL,
       eBasicEventClass)
 EVENT(keydown,
@@ -374,7 +374,7 @@ EVENT(ratechange,
       EventNameType_HTML,
       eBasicEventClass)
 EVENT(reset,
-      NS_FORM_RESET,
+      eFormReset,
       EventNameType_HTMLXUL,
       eBasicEventClass)
 EVENT(seeked,
@@ -386,7 +386,7 @@ EVENT(seeking,
       EventNameType_HTML,
       eBasicEventClass)
 EVENT(select,
-      NS_FORM_SELECTED,
+      eFormSelect,
       EventNameType_HTMLXUL,
       eBasicEventClass)
 EVENT(show,
@@ -398,7 +398,7 @@ EVENT(stalled,
       EventNameType_HTML,
       eBasicEventClass)
 EVENT(submit,
-      NS_FORM_SUBMIT,
+      eFormSubmit,
       EventNameType_HTMLXUL,
       eBasicEventClass)
 EVENT(suspend,
@@ -444,19 +444,19 @@ EVENT(afterscriptexecute,
       eBasicEventClass)
 
 FORWARDED_EVENT(blur,
-                NS_BLUR_CONTENT,
+                eBlur,
                 EventNameType_HTMLXUL,
                 eFocusEventClass)
 ERROR_EVENT(error,
-            NS_LOAD_ERROR,
+            eLoadError,
             EventNameType_All,
             eBasicEventClass)
 FORWARDED_EVENT(focus,
-                NS_FOCUS_CONTENT,
+                eFocus,
                 EventNameType_HTMLXUL,
                 eFocusEventClass)
 FORWARDED_EVENT(load,
-                NS_LOAD,
+                eLoad,
                 EventNameType_All,
                 eBasicEventClass)
 FORWARDED_EVENT(resize,
@@ -477,11 +477,11 @@ WINDOW_EVENT(beforeprint,
              EventNameType_XUL | EventNameType_HTMLBodyOrFramesetOnly,
              eBasicEventClass)
 BEFOREUNLOAD_EVENT(beforeunload,
-                   NS_BEFORE_PAGE_UNLOAD,
+                   eBeforeUnload,
                    EventNameType_XUL | EventNameType_HTMLBodyOrFramesetOnly,
                    eBasicEventClass)
 WINDOW_EVENT(hashchange,
-             NS_HASHCHANGE,
+             eHashChange,
              EventNameType_XUL | EventNameType_HTMLBodyOrFramesetOnly,
              eBasicEventClass)
 WINDOW_EVENT(languagechange,
@@ -512,7 +512,7 @@ WINDOW_EVENT(pageshow,
              EventNameType_HTMLBodyOrFramesetOnly,
              eBasicEventClass)
 WINDOW_EVENT(popstate,
-             NS_POPSTATE,
+             ePopState,
              EventNameType_XUL | EventNameType_HTMLBodyOrFramesetOnly,
              eBasicEventClass)
 // Not supported yet
@@ -522,7 +522,7 @@ WINDOW_EVENT(popstate,
 // Not supported yet
 // WINDOW_EVENT(undo)
 WINDOW_EVENT(unload,
-             NS_PAGE_UNLOAD,
+             eUnload,
              (EventNameType_XUL | EventNameType_SVGSVG |
               EventNameType_HTMLBodyOrFramesetOnly),
              eBasicEventClass)
@@ -581,7 +581,7 @@ TOUCH_EVENT(touchcancel,
             eTouchEventClass)
 
 DOCUMENT_ONLY_EVENT(readystatechange,
-                    NS_READYSTATECHANGE,
+                    eReadyStateChange,
                     EventNameType_HTMLXUL,
                     eBasicEventClass)
 
@@ -620,15 +620,15 @@ NON_IDL_EVENT(DOMSubtreeModified,
               eMutationEventClass)
 
 NON_IDL_EVENT(DOMActivate,
-              NS_UI_ACTIVATE,
+              eLegacyDOMActivate,
               EventNameType_HTMLXUL,
               eUIEventClass)
 NON_IDL_EVENT(DOMFocusIn,
-              NS_UI_FOCUSIN,
+              eLegacyDOMFocusIn,
               EventNameType_HTMLXUL,
               eUIEventClass)
 NON_IDL_EVENT(DOMFocusOut,
-              NS_UI_FOCUSOUT,
+              eLegacyDOMFocusOut,
               EventNameType_HTMLXUL,
               eUIEventClass)
                                   
@@ -720,15 +720,15 @@ NON_IDL_EVENT(commandupdate,
               EventNameType_XUL,
               eBasicEventClass)
 NON_IDL_EVENT(dragexit,
-              NS_DRAGDROP_EXIT,
+              eDragExit,
               EventNameType_XUL,
               eDragEventClass)
 NON_IDL_EVENT(dragdrop,
-              NS_DRAGDROP_DRAGDROP,
+              eLegacyDragDrop,
               EventNameType_XUL,
               eDragEventClass)
 NON_IDL_EVENT(draggesture,
-              NS_DRAGDROP_GESTURE,
+              eLegacyDragGesture,
               EventNameType_XUL,
               eDragEventClass)
 NON_IDL_EVENT(overflow,
diff --git a/dom/events/EventStateManager.cpp b/dom/events/EventStateManager.cpp
index 5a860c9a24aa..61147b7d26b5 100644
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -646,16 +646,16 @@ EventStateManager::PreHandleEvent(nsPresContext* aPresContext,
     FlushPendingEvents(aPresContext);
     break;
   }
-  case NS_DRAGDROP_GESTURE:
+  case eLegacyDragGesture:
     if (Prefs::ClickHoldContextMenu()) {
       // an external drag gesture event came in, not generated internally
       // by Gecko. Make sure we get rid of the click-hold timer.
       KillClickHoldTimer();
     }
     break;
-  case NS_DRAGDROP_OVER:
-    // NS_DRAGDROP_DROP is fired before NS_DRAGDROP_DRAGDROP so send
-    // the enter/exit events before NS_DRAGDROP_DROP.
+  case eDragOver:
+    // eDrop is fired before eLegacyDragDrop so send the enter/exit events
+    // before eDrop.
     GenerateDragDropEnterExit(aPresContext, aEvent->AsDragEvent());
     break;
 
@@ -1193,9 +1193,9 @@ CrossProcessSafeEvent(const WidgetEvent& aEvent)
     }
   case eDragEventClass:
     switch (aEvent.mMessage) {
-    case NS_DRAGDROP_OVER:
-    case NS_DRAGDROP_EXIT:
-    case NS_DRAGDROP_DROP:
+    case eDragOver:
+    case eDragExit:
+    case eDrop:
       return true;
     default:
       break;
@@ -1637,7 +1637,7 @@ EventStateManager::GenerateDragGesture(nsPresContext* aPresContext,
         return;
 
       nsRefPtr<DataTransfer> dataTransfer =
-        new DataTransfer(window, NS_DRAGDROP_START, false, -1);
+        new DataTransfer(window, eDragStart, false, -1);
 
       nsCOMPtr<nsISelection> selection;
       nsCOMPtr<nsIContent> eventContent, targetContent;
@@ -1663,11 +1663,11 @@ EventStateManager::GenerateDragGesture(nsPresContext* aPresContext,
 
       // get the widget from the target frame
       WidgetDragEvent startEvent(aEvent->mFlags.mIsTrusted,
-                                 NS_DRAGDROP_START, widget);
+                                 eDragStart, widget);
       FillInEventFromGestureDown(&startEvent);
 
       WidgetDragEvent gestureEvent(aEvent->mFlags.mIsTrusted,
-                                   NS_DRAGDROP_GESTURE, widget);
+                                   eLegacyDragGesture, widget);
       FillInEventFromGestureDown(&gestureEvent);
 
       startEvent.dataTransfer = gestureEvent.dataTransfer = dataTransfer;
@@ -1726,7 +1726,7 @@ EventStateManager::GenerateDragGesture(nsPresContext* aPresContext,
         }
       }
 
-      // Note that frame event handling doesn't care about NS_DRAGDROP_GESTURE,
+      // Note that frame event handling doesn't care about eLegacyDragGesture,
       // which is just as well since we don't really know which frame to
       // send it to
 
@@ -3171,8 +3171,8 @@ EventStateManager::PostHandleEvent(nsPresContext* aPresContext,
     }
     break;
 
-  case NS_DRAGDROP_ENTER:
-  case NS_DRAGDROP_OVER:
+  case eDragEnter:
+  case eDragOver:
     {
       NS_ASSERTION(aEvent->mClass == eDragEventClass, "Expected a drag event");
 
@@ -3261,13 +3261,13 @@ EventStateManager::PostHandleEvent(nsPresContext* aPresContext,
 
         // For now, do this only for dragover.
         //XXXsmaug dragenter needs some more work.
-        if (aEvent->mMessage == NS_DRAGDROP_OVER && !isChromeDoc) {
+        if (aEvent->mMessage == eDragOver && !isChromeDoc) {
           // Someone has called preventDefault(), check whether is was on
           // content or chrome.
           dragSession->SetOnlyChromeDrop(
             !dragEvent->mDefaultPreventedOnContent);
         }
-      } else if (aEvent->mMessage == NS_DRAGDROP_OVER && !isChromeDoc) {
+      } else if (aEvent->mMessage == eDragOver && !isChromeDoc) {
         // No one called preventDefault(), so handle drop only in chrome.
         dragSession->SetOnlyChromeDrop(true);
       }
@@ -3286,7 +3286,7 @@ EventStateManager::PostHandleEvent(nsPresContext* aPresContext,
     }
     break;
 
-  case NS_DRAGDROP_DROP:
+  case eDrop:
     {
       // now fire the dragdrop event, for compatibility with XUL
       if (mCurrentTarget && nsEventStatus_eConsumeNoDefault != *aStatus) {
@@ -3296,7 +3296,7 @@ EventStateManager::PostHandleEvent(nsPresContext* aPresContext,
 
         nsCOMPtr<nsIWidget> widget = mCurrentTarget->GetNearestWidget();
         WidgetDragEvent event(aEvent->mFlags.mIsTrusted,
-                              NS_DRAGDROP_DRAGDROP, widget);
+                              eLegacyDragDrop, widget);
 
         WidgetMouseEvent* mouseEvent = aEvent->AsMouseEvent();
         event.refPoint = mouseEvent->refPoint;
@@ -3319,9 +3319,9 @@ EventStateManager::PostHandleEvent(nsPresContext* aPresContext,
       ClearGlobalActiveContent(this);
       break;
     }
-  case NS_DRAGDROP_EXIT:
+  case eDragExit:
      // make sure to fire the enter and exit_synth events after the
-     // NS_DRAGDROP_EXIT event, otherwise we'll clean up too early
+     // eDragExit event, otherwise we'll clean up too early
     GenerateDragDropEnterExit(presContext, aEvent->AsDragEvent());
     break;
 
@@ -4299,7 +4299,7 @@ EventStateManager::GenerateDragDropEnterExit(nsPresContext* aPresContext,
   nsCOMPtr<nsIContent> targetBeforeEvent = mCurrentTargetContent;
 
   switch(aDragEvent->mMessage) {
-  case NS_DRAGDROP_OVER:
+  case eDragOver:
     {
       // when dragging from one frame to another, events are fired in the
       // order: dragexit, dragenter, dragleave
@@ -4316,16 +4316,16 @@ EventStateManager::GenerateDragDropEnterExit(nsPresContext* aPresContext,
                                                  getter_AddRefs(lastContent));
 
           FireDragEnterOrExit(sLastDragOverFrame->PresContext(),
-                              aDragEvent, NS_DRAGDROP_EXIT,
+                              aDragEvent, eDragExit,
                               targetContent, lastContent, sLastDragOverFrame);
         }
 
-        FireDragEnterOrExit(aPresContext, aDragEvent, NS_DRAGDROP_ENTER,
+        FireDragEnterOrExit(aPresContext, aDragEvent, eDragEnter,
                             lastContent, targetContent, mCurrentTarget);
 
         if (sLastDragOverFrame) {
           FireDragEnterOrExit(sLastDragOverFrame->PresContext(),
-                              aDragEvent, NS_DRAGDROP_LEAVE,
+                              aDragEvent, eDragLeave,
                               targetContent, lastContent, sLastDragOverFrame);
         }
 
@@ -4334,7 +4334,7 @@ EventStateManager::GenerateDragDropEnterExit(nsPresContext* aPresContext,
     }
     break;
 
-  case NS_DRAGDROP_EXIT:
+  case eDragExit:
     {
       //This is actually the window mouse exit event.
       if (sLastDragOverFrame) {
@@ -4344,10 +4344,10 @@ EventStateManager::GenerateDragDropEnterExit(nsPresContext* aPresContext,
 
         nsRefPtr<nsPresContext> lastDragOverFramePresContext = sLastDragOverFrame->PresContext();
         FireDragEnterOrExit(lastDragOverFramePresContext,
-                            aDragEvent, NS_DRAGDROP_EXIT,
+                            aDragEvent, eDragExit,
                             nullptr, lastContent, sLastDragOverFrame);
         FireDragEnterOrExit(lastDragOverFramePresContext,
-                            aDragEvent, NS_DRAGDROP_LEAVE,
+                            aDragEvent, eDragLeave,
                             nullptr, lastContent, sLastDragOverFrame);
 
         sLastDragOverFrame = nullptr;
@@ -4393,17 +4393,15 @@ EventStateManager::FireDragEnterOrExit(nsPresContext* aPresContext,
     }
 
     // adjust the drag hover if the dragenter event was cancelled or this is a drag exit
-    if (status == nsEventStatus_eConsumeNoDefault ||
-        aMessage == NS_DRAGDROP_EXIT) {
-      SetContentState((aMessage == NS_DRAGDROP_ENTER) ?
-                        aTargetContent : nullptr,
+    if (status == nsEventStatus_eConsumeNoDefault || aMessage == eDragExit) {
+      SetContentState((aMessage == eDragEnter) ? aTargetContent : nullptr,
                       NS_EVENT_STATE_DRAGOVER);
     }
 
     // collect any changes to moz cursor settings stored in the event's
     // data transfer.
-    if (aMessage == NS_DRAGDROP_LEAVE || aMessage == NS_DRAGDROP_EXIT ||
-        aMessage == NS_DRAGDROP_ENTER) {
+    if (aMessage == eDragLeave || aMessage == eDragExit ||
+        aMessage == eDragEnter) {
       UpdateDragDataTransfer(&event);
     }
   }
@@ -4610,8 +4608,7 @@ already_AddRefed<nsIContent>
 EventStateManager::GetEventTargetContent(WidgetEvent* aEvent)
 {
   if (aEvent &&
-      (aEvent->mMessage == NS_FOCUS_CONTENT ||
-       aEvent->mMessage == NS_BLUR_CONTENT)) {
+      (aEvent->mMessage == eFocus || aEvent->mMessage == eBlur)) {
     nsCOMPtr<nsIContent> content = GetFocusedContent();
     return content.forget();
   }
diff --git a/dom/events/FocusEvent.cpp b/dom/events/FocusEvent.cpp
index 4f3732dcac4d..61b1166fed99 100644
--- a/dom/events/FocusEvent.cpp
+++ b/dom/events/FocusEvent.cpp
@@ -17,7 +17,7 @@ FocusEvent::FocusEvent(EventTarget* aOwner,
                        nsPresContext* aPresContext,
                        InternalFocusEvent* aEvent)
   : UIEvent(aOwner, aPresContext,
-            aEvent ? aEvent : new InternalFocusEvent(false, NS_FOCUS_CONTENT))
+            aEvent ? aEvent : new InternalFocusEvent(false, eFocus))
 {
   if (aEvent) {
     mEventIsInternal = false;
diff --git a/dom/events/WheelHandlingHelper.cpp b/dom/events/WheelHandlingHelper.cpp
index 09010b6bbb28..79bb04503ecb 100644
--- a/dom/events/WheelHandlingHelper.cpp
+++ b/dom/events/WheelHandlingHelper.cpp
@@ -185,7 +185,7 @@ WheelTransaction::OnEvent(WidgetEvent* aEvent)
       }
       return;
     case eMouseMove:
-    case NS_DRAGDROP_OVER: {
+    case eDragOver: {
       WidgetMouseEvent* mouseEvent = aEvent->AsMouseEvent();
       if (mouseEvent->IsReal()) {
         // If the cursor is moving to be outside the frame,
@@ -215,7 +215,7 @@ WheelTransaction::OnEvent(WidgetEvent* aEvent)
     case eMouseDoubleClick:
     case eMouseClick:
     case eContextMenu:
-    case NS_DRAGDROP_DROP:
+    case eDrop:
       EndTransaction();
       return;
     default:
diff --git a/dom/html/HTMLButtonElement.cpp b/dom/html/HTMLButtonElement.cpp
index 0ed8e3442a51..c0b381d7db16 100644
--- a/dom/html/HTMLButtonElement.cpp
+++ b/dom/html/HTMLButtonElement.cpp
@@ -222,7 +222,7 @@ HTMLButtonElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
   WidgetMouseEvent* mouseEvent = aVisitor.mEvent->AsMouseEvent();
   bool outerActivateEvent =
     ((mouseEvent && mouseEvent->IsLeftClickEvent()) ||
-     (aVisitor.mEvent->mMessage == NS_UI_ACTIVATE &&
+     (aVisitor.mEvent->mMessage == eLegacyDOMActivate &&
       !mInInternalActivate));
 
   if (outerActivateEvent) {
@@ -252,7 +252,7 @@ HTMLButtonElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
     if (mouseEvent && mouseEvent->IsLeftClickEvent()) {
       // DOMActive event should be trusted since the activation is actually
       // occurred even if the cause is an untrusted click event.
-      InternalUIEvent actEvent(true, NS_UI_ACTIVATE, mouseEvent);
+      InternalUIEvent actEvent(true, eLegacyDOMActivate, mouseEvent);
       actEvent.detail = 1;
 
       nsCOMPtr<nsIPresShell> shell = aVisitor.mPresContext->GetPresShell();
@@ -370,7 +370,7 @@ HTMLButtonElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
       if (mForm && (mType == NS_FORM_BUTTON_SUBMIT ||
                     mType == NS_FORM_BUTTON_RESET)) {
         InternalFormEvent event(true,
-          (mType == NS_FORM_BUTTON_RESET) ? NS_FORM_RESET : NS_FORM_SUBMIT);
+          (mType == NS_FORM_BUTTON_RESET) ? eFormReset : eFormSubmit);
         event.originator     = this;
         nsEventStatus status = nsEventStatus_eIgnore;
 
@@ -382,7 +382,7 @@ HTMLButtonElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
         //
         // Using presShell to dispatch the event. It makes sure that
         // event is not handled if the window is being destroyed.
-        if (presShell && (event.mMessage != NS_FORM_SUBMIT ||
+        if (presShell && (event.mMessage != eFormSubmit ||
                           mForm->HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate) ||
                           // We know the element is a submit control, if this check is moved,
                           // make sure formnovalidate is used only if it's a submit control.
diff --git a/dom/html/HTMLFormElement.cpp b/dom/html/HTMLFormElement.cpp
index 7e969ac6d35c..50f0582c456e 100644
--- a/dom/html/HTMLFormElement.cpp
+++ b/dom/html/HTMLFormElement.cpp
@@ -256,7 +256,7 @@ HTMLFormElement::Submit(ErrorResult& aRv)
     mPendingSubmission = nullptr;
   }
 
-  aRv = DoSubmitOrReset(nullptr, NS_FORM_SUBMIT);
+  aRv = DoSubmitOrReset(nullptr, eFormSubmit);
 }
 
 NS_IMETHODIMP
@@ -270,7 +270,7 @@ HTMLFormElement::Submit()
 NS_IMETHODIMP
 HTMLFormElement::Reset()
 {
-  InternalFormEvent event(true, NS_FORM_RESET);
+  InternalFormEvent event(true, eFormReset);
   EventDispatcher::Dispatch(static_cast<nsIContent*>(this), nullptr, &event);
   return NS_OK;
 }
@@ -493,7 +493,7 @@ HTMLFormElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
   aVisitor.mWantsWillHandleEvent = true;
   if (aVisitor.mEvent->originalTarget == static_cast<nsIContent*>(this)) {
     uint32_t msg = aVisitor.mEvent->mMessage;
-    if (msg == NS_FORM_SUBMIT) {
+    if (msg == eFormSubmit) {
       if (mGeneratingSubmit) {
         aVisitor.mCanHandle = false;
         return NS_OK;
@@ -504,8 +504,7 @@ HTMLFormElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
       // that means that if there are scripted submissions, the
       // latest one will be deferred until after the exit point of the handler.
       mDeferSubmission = true;
-    }
-    else if (msg == NS_FORM_RESET) {
+    } else if (msg == eFormReset) {
       if (mGeneratingReset) {
         aVisitor.mCanHandle = false;
         return NS_OK;
@@ -522,8 +521,8 @@ HTMLFormElement::WillHandleEvent(EventChainPostVisitor& aVisitor)
   // If this is the bubble stage and there is a nested form below us which
   // received a submit event we do *not* want to handle the submit event
   // for this form too.
-  if ((aVisitor.mEvent->mMessage == NS_FORM_SUBMIT ||
-       aVisitor.mEvent->mMessage == NS_FORM_RESET) &&
+  if ((aVisitor.mEvent->mMessage == eFormSubmit ||
+       aVisitor.mEvent->mMessage == eFormReset) &&
       aVisitor.mEvent->mFlags.mInBubblingPhase &&
       aVisitor.mEvent->originalTarget != static_cast<nsIContent*>(this)) {
     aVisitor.mEvent->mFlags.mPropagationStopped = true;
@@ -536,17 +535,16 @@ HTMLFormElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
 {
   if (aVisitor.mEvent->originalTarget == static_cast<nsIContent*>(this)) {
     EventMessage msg = aVisitor.mEvent->mMessage;
-    if (msg == NS_FORM_SUBMIT) {
+    if (msg == eFormSubmit) {
       // let the form know not to defer subsequent submissions
       mDeferSubmission = false;
     }
 
     if (aVisitor.mEventStatus == nsEventStatus_eIgnore) {
       switch (msg) {
-        case NS_FORM_RESET:
-        case NS_FORM_SUBMIT:
-        {
-          if (mPendingSubmission && msg == NS_FORM_SUBMIT) {
+        case eFormReset:
+        case eFormSubmit: {
+          if (mPendingSubmission && msg == eFormSubmit) {
             // tell the form to forget a possible pending submission.
             // the reason is that the script returned true (the event was
             // ignored) so if there is a stored submission, it will miss
@@ -561,7 +559,7 @@ HTMLFormElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
           break;
       }
     } else {
-      if (msg == NS_FORM_SUBMIT) {
+      if (msg == eFormSubmit) {
         // tell the form to flush a possible pending submission.
         // the reason is that the script returned false (the event was
         // not ignored) so if there is a stored submission, it needs to
@@ -570,10 +568,9 @@ HTMLFormElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
       }
     }
 
-    if (msg == NS_FORM_SUBMIT) {
+    if (msg == eFormSubmit) {
       mGeneratingSubmit = false;
-    }
-    else if (msg == NS_FORM_RESET) {
+    } else if (msg == eFormReset) {
       mGeneratingReset = false;
     }
   }
@@ -582,7 +579,7 @@ HTMLFormElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
 
 nsresult
 HTMLFormElement::DoSubmitOrReset(WidgetEvent* aEvent,
-                                 int32_t aMessage)
+                                 EventMessage aMessage)
 {
   // Make sure the presentation is up-to-date
   nsIDocument* doc = GetComposedDoc();
@@ -593,11 +590,11 @@ HTMLFormElement::DoSubmitOrReset(WidgetEvent* aEvent,
   // JBK Don't get form frames anymore - bug 34297
 
   // Submit or Reset the form
-  if (NS_FORM_RESET == aMessage) {
+  if (eFormReset == aMessage) {
     return DoReset();
   }
 
-  if (NS_FORM_SUBMIT == aMessage) {
+  if (eFormSubmit == aMessage) {
     // Don't submit if we're not in a document or if we're in
     // a sandboxed frame and form submit is disabled.
     if (!doc || (doc->GetSandboxFlags() & SANDBOXED_FORMS)) {
diff --git a/dom/html/HTMLFormElement.h b/dom/html/HTMLFormElement.h
index 26b688d029b0..f577b11bba29 100644
--- a/dom/html/HTMLFormElement.h
+++ b/dom/html/HTMLFormElement.h
@@ -452,7 +452,7 @@ protected:
   };
 
   nsresult DoSubmitOrReset(WidgetEvent* aEvent,
-                           int32_t aMessage);
+                           EventMessage aMessage);
   nsresult DoReset();
 
   // Async callback to handle removal of our default submit
diff --git a/dom/html/HTMLInputElement.cpp b/dom/html/HTMLInputElement.cpp
index abdecafc293c..c936867041e5 100644
--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@@ -2817,7 +2817,7 @@ HTMLInputElement::MaybeSubmitForm(nsPresContext* aPresContext)
     // If there's only one text control, just submit the form
     // Hold strong ref across the event
     nsRefPtr<mozilla::dom::HTMLFormElement> form = mForm;
-    InternalFormEvent event(true, NS_FORM_SUBMIT);
+    InternalFormEvent event(true, eFormSubmit);
     nsEventStatus status = nsEventStatus_eIgnore;
     shell->HandleDOMEventWithTarget(mForm, &event, &status);
   }
@@ -2987,7 +2987,7 @@ HTMLInputElement::DispatchSelectEvent(nsPresContext* aPresContext)
 
   // If already handling select event, don't dispatch a second.
   if (!mHandlingSelectEvent) {
-    WidgetEvent event(nsContentUtils::IsCallerChrome(), NS_FORM_SELECTED);
+    WidgetEvent event(nsContentUtils::IsCallerChrome(), eFormSelect);
 
     mHandlingSelectEvent = true;
     EventDispatcher::Dispatch(static_cast<nsIContent*>(this),
@@ -3087,7 +3087,7 @@ HTMLInputElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
   WidgetMouseEvent* mouseEvent = aVisitor.mEvent->AsMouseEvent();
   bool outerActivateEvent =
     ((mouseEvent && mouseEvent->IsLeftClickEvent()) ||
-     (aVisitor.mEvent->mMessage == NS_UI_ACTIVATE && !mInInternalActivate));
+     (aVisitor.mEvent->mMessage == eLegacyDOMActivate && !mInInternalActivate));
 
   if (outerActivateEvent) {
     aVisitor.mItemFlags |= NS_OUTER_ACTIVATE_EVENT;
@@ -3162,7 +3162,7 @@ HTMLInputElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
   aVisitor.mItemFlags |= mType;
 
   // Fire onchange (if necessary), before we do the blur, bug 357684.
-  if (aVisitor.mEvent->mMessage == NS_BLUR_CONTENT) {
+  if (aVisitor.mEvent->mMessage == eBlur) {
     // Experimental mobile types rely on the system UI to prevent users to not
     // set invalid values but we have to be extra-careful. Especially if the
     // option has been enabled on desktop.
@@ -3177,8 +3177,8 @@ HTMLInputElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
   }
 
   if (mType == NS_FORM_INPUT_RANGE &&
-      (aVisitor.mEvent->mMessage == NS_FOCUS_CONTENT ||
-       aVisitor.mEvent->mMessage == NS_BLUR_CONTENT)) {
+      (aVisitor.mEvent->mMessage == eFocus ||
+       aVisitor.mEvent->mMessage == eBlur)) {
     // Just as nsGenericHTMLFormElementWithState::PreHandleEvent calls
     // nsIFormControlFrame::SetFocus, we handle focus here.
     nsIFrame* frame = GetPrimaryFrame();
@@ -3231,9 +3231,9 @@ HTMLInputElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
         StopNumberControlSpinnerSpin();
       }
     }
-    if (aVisitor.mEvent->mMessage == NS_FOCUS_CONTENT ||
-        aVisitor.mEvent->mMessage == NS_BLUR_CONTENT) {
-      if (aVisitor.mEvent->mMessage == NS_FOCUS_CONTENT) {
+    if (aVisitor.mEvent->mMessage == eFocus ||
+        aVisitor.mEvent->mMessage == eBlur) {
+      if (aVisitor.mEvent->mMessage == eFocus) {
         // Tell our frame it's getting focus so that it can make sure focus
         // is moved to our anonymous text control.
         nsNumberControlFrame* numberControlFrame =
@@ -3299,7 +3299,7 @@ HTMLInputElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
           numberControlFrame->HandlingInputEvent(false);
         }
       }
-      else if (aVisitor.mEvent->mMessage == NS_FORM_CHANGE) {
+      else if (aVisitor.mEvent->mMessage == eFormChange) {
         // We cancel the DOM 'change' event that is fired for any change to our
         // anonymous text control since we fire our own 'change' events and
         // content shouldn't be seeing two 'change' events. Besides that we
@@ -3587,15 +3587,15 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
     return MaybeInitPickers(aVisitor);
   }
 
-  if (aVisitor.mEvent->mMessage == NS_FOCUS_CONTENT ||
-      aVisitor.mEvent->mMessage == NS_BLUR_CONTENT) {
-    if (aVisitor.mEvent->mMessage == NS_FOCUS_CONTENT &&
+  if (aVisitor.mEvent->mMessage == eFocus ||
+      aVisitor.mEvent->mMessage == eBlur) {
+    if (aVisitor.mEvent->mMessage == eFocus &&
         MayFireChangeOnBlur() &&
         !mIsDraggingRange) { // StartRangeThumbDrag already set mFocusedValue
       GetValue(mFocusedValue);
     }
 
-    if (aVisitor.mEvent->mMessage == NS_BLUR_CONTENT) {
+    if (aVisitor.mEvent->mMessage == eBlur) {
       if (mIsDraggingRange) {
         FinishRangeThumbDrag();
       } else if (mNumberControlSpinnerIsSpinning) {
@@ -3603,7 +3603,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
       }
     }
 
-    UpdateValidityUIBits(aVisitor.mEvent->mMessage == NS_FOCUS_CONTENT);
+    UpdateValidityUIBits(aVisitor.mEvent->mMessage == eFocus);
 
     UpdateState(true);
   }
@@ -3630,7 +3630,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
         !ShouldPreventDOMActivateDispatch(aVisitor.mEvent->originalTarget)) {
       // DOMActive event should be trusted since the activation is actually
       // occurred even if the cause is an untrusted click event.
-      InternalUIEvent actEvent(true, NS_UI_ACTIVATE, mouseEvent);
+      InternalUIEvent actEvent(true, eLegacyDOMActivate, mouseEvent);
       actEvent.detail = 1;
 
       nsCOMPtr<nsIPresShell> shell = aVisitor.mPresContext->GetPresShell();
@@ -3745,9 +3745,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
       }
     } else if (nsEventStatus_eIgnore == aVisitor.mEventStatus) {
       switch (aVisitor.mEvent->mMessage) {
-
-        case NS_FOCUS_CONTENT:
-        {
+        case eFocus: {
           // see if we should select the contents of the textbox. This happens
           // for text and password fields when the field was focused by the
           // keyboard or a navigation, the platform allows it, and it wasn't
@@ -4015,7 +4013,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
         case NS_FORM_INPUT_IMAGE:
           if (mForm) {
             InternalFormEvent event(true,
-              (mType == NS_FORM_INPUT_RESET) ? NS_FORM_RESET : NS_FORM_SUBMIT);
+              (mType == NS_FORM_INPUT_RESET) ? eFormReset : eFormSubmit);
             event.originator      = this;
             nsEventStatus status  = nsEventStatus_eIgnore;
 
@@ -4027,7 +4025,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
             // pres shell.  See bug 125624.
             // TODO: removing this code and have the submit event sent by the
             // form, see bug 592124.
-            if (presShell && (event.mMessage != NS_FORM_SUBMIT ||
+            if (presShell && (event.mMessage != eFormSubmit ||
                               mForm->HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate) ||
                               // We know the element is a submit control, if this check is moved,
                               // make sure formnovalidate is used only if it's a submit control.
diff --git a/dom/html/HTMLObjectElement.cpp b/dom/html/HTMLObjectElement.cpp
index 93da5551fe3d..f03ed323c9d8 100644
--- a/dom/html/HTMLObjectElement.cpp
+++ b/dom/html/HTMLObjectElement.cpp
@@ -216,11 +216,11 @@ HTMLObjectElement::HandleFocusBlurPlugin(Element* aElement,
     return;
   }
   switch (aEvent->mMessage) {
-    case NS_FOCUS_CONTENT: {
+    case eFocus: {
       OnFocusBlurPlugin(aElement, true);
       break;
     }
-    case NS_BLUR_CONTENT: {
+    case eBlur: {
       OnFocusBlurPlugin(aElement, false);
       break;
     }
@@ -292,7 +292,7 @@ HTMLObjectElement::UnbindFromTree(bool aDeep,
 {
 #ifdef XP_MACOSX
   // When a page is reloaded (when an nsIDocument's content is removed), the
-  // focused element isn't necessarily sent an NS_BLUR_CONTENT event. See
+  // focused element isn't necessarily sent an eBlur event. See
   // nsFocusManager::ContentRemoved(). This means that a widget may think it
   // still contains a focused plugin when it doesn't -- which in turn can
   // disable text input in the browser window. See bug 1137229.
diff --git a/dom/html/HTMLSelectElement.cpp b/dom/html/HTMLSelectElement.cpp
index e075dcdc8612..188a6ba3908e 100644
--- a/dom/html/HTMLSelectElement.cpp
+++ b/dom/html/HTMLSelectElement.cpp
@@ -1511,7 +1511,7 @@ HTMLSelectElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
 nsresult
 HTMLSelectElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
 {
-  if (aVisitor.mEvent->mMessage == NS_FOCUS_CONTENT) {
+  if (aVisitor.mEvent->mMessage == eFocus) {
     // If the invalid UI is shown, we should show it while focused and
     // update the invalid/valid UI.
     mCanShowInvalidUI = !IsValid() && ShouldShowValidityUI();
@@ -1522,7 +1522,7 @@ HTMLSelectElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
 
     // We don't have to update NS_EVENT_STATE_MOZ_UI_INVALID nor
     // NS_EVENT_STATE_MOZ_UI_VALID given that the states should not change.
-  } else if (aVisitor.mEvent->mMessage == NS_BLUR_CONTENT) {
+  } else if (aVisitor.mEvent->mMessage == eBlur) {
     mCanShowInvalidUI = true;
     mCanShowValidUI = true;
 
diff --git a/dom/html/HTMLSharedObjectElement.cpp b/dom/html/HTMLSharedObjectElement.cpp
index 7317746df37b..cf954be6150e 100644
--- a/dom/html/HTMLSharedObjectElement.cpp
+++ b/dom/html/HTMLSharedObjectElement.cpp
@@ -164,7 +164,7 @@ HTMLSharedObjectElement::UnbindFromTree(bool aDeep,
 {
 #ifdef XP_MACOSX
   // When a page is reloaded (when an nsIDocument's content is removed), the
-  // focused element isn't necessarily sent an NS_BLUR_CONTENT event. See
+  // focused element isn't necessarily sent an eBlur event. See
   // nsFocusManager::ContentRemoved(). This means that a widget may think it
   // still contains a focused plugin when it doesn't -- which in turn can
   // disable text input in the browser window. See bug 1137229.
diff --git a/dom/html/HTMLTextAreaElement.cpp b/dom/html/HTMLTextAreaElement.cpp
index 897da388c862..6f936b14a722 100644
--- a/dom/html/HTMLTextAreaElement.cpp
+++ b/dom/html/HTMLTextAreaElement.cpp
@@ -137,7 +137,7 @@ HTMLTextAreaElement::Select()
   }
 
   nsEventStatus status = nsEventStatus_eIgnore;
-  WidgetGUIEvent event(true, NS_FORM_SELECTED, nullptr);
+  WidgetGUIEvent event(true, eFormSelect, nullptr);
   // XXXbz HTMLInputElement guards against this reentering; shouldn't we?
   EventDispatcher::Dispatch(static_cast<nsIContent*>(this), presContext,
                             &event, nullptr, &status);
@@ -486,7 +486,7 @@ HTMLTextAreaElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
 
   // Don't dispatch a second select event if we are already handling
   // one.
-  if (aVisitor.mEvent->mMessage == NS_FORM_SELECTED) {
+  if (aVisitor.mEvent->mMessage == eFormSelect) {
     if (mHandlingSelect) {
       return NS_OK;
     }
@@ -506,7 +506,7 @@ HTMLTextAreaElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
   }
 
   // Fire onchange (if necessary), before we do the blur, bug 370521.
-  if (aVisitor.mEvent->mMessage == NS_BLUR_CONTENT) {
+  if (aVisitor.mEvent->mMessage == eBlur) {
     FireChangeEventIfNeeded();
   }
 
@@ -534,13 +534,13 @@ HTMLTextAreaElement::FireChangeEventIfNeeded()
 nsresult
 HTMLTextAreaElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
 {
-  if (aVisitor.mEvent->mMessage == NS_FORM_SELECTED) {
+  if (aVisitor.mEvent->mMessage == eFormSelect) {
     mHandlingSelect = false;
   }
 
-  if (aVisitor.mEvent->mMessage == NS_FOCUS_CONTENT ||
-      aVisitor.mEvent->mMessage == NS_BLUR_CONTENT) {
-    if (aVisitor.mEvent->mMessage == NS_FOCUS_CONTENT) {
+  if (aVisitor.mEvent->mMessage == eFocus ||
+      aVisitor.mEvent->mMessage == eBlur) {
+    if (aVisitor.mEvent->mMessage == eFocus) {
       // If the invalid UI is shown, we should show it while focusing (and
       // update). Otherwise, we should not.
       GetValueInternal(mFocusedValue, true);
@@ -549,7 +549,7 @@ HTMLTextAreaElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
       // If neither invalid UI nor valid UI is shown, we shouldn't show the valid
       // UI while typing.
       mCanShowValidUI = ShouldShowValidityUI();
-    } else { // NS_BLUR_CONTENT
+    } else { // eBlur
       mCanShowInvalidUI = true;
       mCanShowValidUI = true;
     }
diff --git a/dom/html/nsGenericHTMLElement.cpp b/dom/html/nsGenericHTMLElement.cpp
index 60e58b10b527..c6f24fa7b10d 100644
--- a/dom/html/nsGenericHTMLElement.cpp
+++ b/dom/html/nsGenericHTMLElement.cpp
@@ -2251,8 +2251,7 @@ nsGenericHTMLFormElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
 {
   if (aVisitor.mEvent->mFlags.mIsTrusted) {
     switch (aVisitor.mEvent->mMessage) {
-      case NS_FOCUS_CONTENT:
-      {
+      case eFocus: {
         // Check to see if focus has bubbled up from a form control's
         // child textfield or button.  If that's the case, don't focus
         // this parent file control -- leave focus on the child.
@@ -2262,8 +2261,7 @@ nsGenericHTMLFormElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
           formControlFrame->SetFocus(true, true);
         break;
       }
-      case NS_BLUR_CONTENT:
-      {
+      case eBlur: {
         nsIFormControlFrame* formControlFrame = GetFormControlFrame(true);
         if (formControlFrame)
           formControlFrame->SetFocus(false, false);
diff --git a/dom/html/nsTextEditorState.cpp b/dom/html/nsTextEditorState.cpp
index 189c08aad574..8e3fe8696c63 100644
--- a/dom/html/nsTextEditorState.cpp
+++ b/dom/html/nsTextEditorState.cpp
@@ -819,7 +819,7 @@ nsTextInputListener::NotifySelectionChanged(nsIDOMDocument* aDoc, nsISelection*
         if (presShell) 
         {
           nsEventStatus status = nsEventStatus_eIgnore;
-          WidgetEvent event(true, NS_FORM_SELECTED);
+          WidgetEvent event(true, eFormSelect);
 
           presShell->HandleEventWithTarget(&event, mFrame, content, &status);
         }
diff --git a/dom/indexedDB/IDBDatabase.cpp b/dom/indexedDB/IDBDatabase.cpp
index 375a295543da..7beb2579ff31 100644
--- a/dom/indexedDB/IDBDatabase.cpp
+++ b/dom/indexedDB/IDBDatabase.cpp
@@ -187,6 +187,7 @@ class IDBDatabase::LogWarningRunnable final
   nsCString mMessageName;
   nsString mFilename;
   uint32_t mLineNumber;
+  uint32_t mColumnNumber;
   uint64_t mInnerWindowID;
   bool mIsChrome;
 
@@ -194,11 +195,13 @@ public:
   LogWarningRunnable(const char* aMessageName,
                      const nsAString& aFilename,
                      uint32_t aLineNumber,
+                     uint32_t aColumnNumber,
                      bool aIsChrome,
                      uint64_t aInnerWindowID)
     : mMessageName(aMessageName)
     , mFilename(aFilename)
     , mLineNumber(aLineNumber)
+    , mColumnNumber(aColumnNumber)
     , mInnerWindowID(aInnerWindowID)
     , mIsChrome(aIsChrome)
   {
@@ -209,6 +212,7 @@ public:
   LogWarning(const char* aMessageName,
              const nsAString& aFilename,
              uint32_t aLineNumber,
+             uint32_t aColumnNumber,
              bool aIsChrome,
              uint64_t aInnerWindowID);
 
@@ -959,10 +963,10 @@ IDBDatabase::AbortTransactions(bool aShouldWarn)
         MOZ_ASSERT(transaction);
 
         nsString filename;
-        uint32_t lineNo;
-        transaction->GetCallerLocation(filename, &lineNo);
+        uint32_t lineNo, column;
+        transaction->GetCallerLocation(filename, &lineNo, &column);
 
-        aDatabase->LogWarning(kWarningMessage, filename, lineNo);
+        aDatabase->LogWarning(kWarningMessage, filename, lineNo, column);
       }
     }
   };
@@ -1337,7 +1341,8 @@ IDBDatabase::Invalidate()
 void
 IDBDatabase::LogWarning(const char* aMessageName,
                         const nsAString& aFilename,
-                        uint32_t aLineNumber)
+                        uint32_t aLineNumber,
+                        uint32_t aColumnNumber)
 {
   AssertIsOnOwningThread();
   MOZ_ASSERT(aMessageName);
@@ -1346,6 +1351,7 @@ IDBDatabase::LogWarning(const char* aMessageName,
     LogWarningRunnable::LogWarning(aMessageName,
                                    aFilename,
                                    aLineNumber,
+                                   aColumnNumber,
                                    mFactory->IsChrome(),
                                    mFactory->InnerWindowID());
   } else {
@@ -1353,6 +1359,7 @@ IDBDatabase::LogWarning(const char* aMessageName,
       new LogWarningRunnable(aMessageName,
                              aFilename,
                              aLineNumber,
+                             aColumnNumber,
                              mFactory->IsChrome(),
                              mFactory->InnerWindowID());
     MOZ_ALWAYS_TRUE(NS_SUCCEEDED(NS_DispatchToMainThread(runnable)));
@@ -1628,6 +1635,7 @@ IDBDatabase::
 LogWarningRunnable::LogWarning(const char* aMessageName,
                                const nsAString& aFilename,
                                uint32_t aLineNumber,
+                               uint32_t aColumnNumber,
                                bool aIsChrome,
                                uint64_t aInnerWindowID)
 {
@@ -1664,7 +1672,7 @@ LogWarningRunnable::LogWarning(const char* aMessageName,
                                     aFilename,
                                     /* aSourceLine */ EmptyString(),
                                     aLineNumber,
-                                    /* aColumnNumber */ 0,
+                                    aColumnNumber,
                                     nsIScriptError::warningFlag,
                                     category,
                                     aInnerWindowID)));
@@ -1674,7 +1682,7 @@ LogWarningRunnable::LogWarning(const char* aMessageName,
                         aFilename,
                         /* aSourceLine */ EmptyString(),
                         aLineNumber,
-                        /* aColumnNumber */ 0,
+                        aColumnNumber,
                         nsIScriptError::warningFlag,
                         category.get())));
   }
@@ -1693,6 +1701,7 @@ LogWarningRunnable::Run()
   LogWarning(mMessageName.get(),
              mFilename,
              mLineNumber,
+             mColumnNumber,
              mIsChrome,
              mInnerWindowID);
 
diff --git a/dom/indexedDB/IDBDatabase.h b/dom/indexedDB/IDBDatabase.h
index 4aed0e3ea4bb..7a71c53104ab 100644
--- a/dom/indexedDB/IDBDatabase.h
+++ b/dom/indexedDB/IDBDatabase.h
@@ -313,7 +313,8 @@ private:
   void
   LogWarning(const char* aMessageName,
              const nsAString& aFilename,
-             uint32_t aLineNumber);
+             uint32_t aLineNumber,
+             uint32_t aColumnNumber);
 };
 
 } // namespace indexedDB
diff --git a/dom/indexedDB/IDBRequest.cpp b/dom/indexedDB/IDBRequest.cpp
index 193e90cd24d9..272900a91db6 100644
--- a/dom/indexedDB/IDBRequest.cpp
+++ b/dom/indexedDB/IDBRequest.cpp
@@ -92,6 +92,7 @@ IDBRequest::InitMembers()
   mLoggingSerialNumber = NextSerialNumber();
   mErrorCode = NS_OK;
   mLineNo = 0;
+  mColumn = 0;
   mHaveResultOrErrorCode = false;
 }
 
@@ -104,7 +105,7 @@ IDBRequest::Create(IDBDatabase* aDatabase,
   aDatabase->AssertIsOnOwningThread();
 
   nsRefPtr<IDBRequest> request = new IDBRequest(aDatabase);
-  CaptureCaller(request->mFilename, &request->mLineNo);
+  CaptureCaller(request->mFilename, &request->mLineNo, &request->mColumn);
 
   request->mTransaction = aTransaction;
   request->SetScriptOwner(aDatabase->GetScriptOwner());
@@ -168,13 +169,15 @@ IDBRequest::SetLoggingSerialNumber(uint64_t aLoggingSerialNumber)
 }
 
 void
-IDBRequest::CaptureCaller(nsAString& aFilename, uint32_t* aLineNo)
+IDBRequest::CaptureCaller(nsAString& aFilename, uint32_t* aLineNo,
+                          uint32_t* aColumn)
 {
   MOZ_ASSERT(aFilename.IsEmpty());
   MOZ_ASSERT(aLineNo);
+  MOZ_ASSERT(aColumn);
 
   ThreadsafeAutoJSContext cx;
-  nsJSUtils::GetCallingLocation(cx, aFilename, aLineNo);
+  nsJSUtils::GetCallingLocation(cx, aFilename, aLineNo, aColumn);
 }
 
 void
@@ -271,13 +274,16 @@ IDBRequest::GetErrorAfterResult() const
 #endif // DEBUG
 
 void
-IDBRequest::GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const
+IDBRequest::GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo,
+                              uint32_t* aColumn) const
 {
   AssertIsOnOwningThread();
   MOZ_ASSERT(aLineNo);
+  MOZ_ASSERT(aColumn);
 
   aFilename = mFilename;
   *aLineNo = mLineNo;
+  *aColumn = mColumn;
 }
 
 IDBRequestReadyState
@@ -516,7 +522,7 @@ IDBOpenDBRequest::CreateForWindow(IDBFactory* aFactory,
   MOZ_ASSERT(aScriptOwner);
 
   nsRefPtr<IDBOpenDBRequest> request = new IDBOpenDBRequest(aFactory, aOwner);
-  CaptureCaller(request->mFilename, &request->mLineNo);
+  CaptureCaller(request->mFilename, &request->mLineNo, &request->mColumn);
 
   request->SetScriptOwner(aScriptOwner);
 
@@ -533,7 +539,7 @@ IDBOpenDBRequest::CreateForJS(IDBFactory* aFactory,
   MOZ_ASSERT(aScriptOwner);
 
   nsRefPtr<IDBOpenDBRequest> request = new IDBOpenDBRequest(aFactory, nullptr);
-  CaptureCaller(request->mFilename, &request->mLineNo);
+  CaptureCaller(request->mFilename, &request->mLineNo, &request->mColumn);
 
   request->SetScriptOwner(aScriptOwner);
 
diff --git a/dom/indexedDB/IDBRequest.h b/dom/indexedDB/IDBRequest.h
index 7c3a5e6d6741..3e3c95eec18c 100644
--- a/dom/indexedDB/IDBRequest.h
+++ b/dom/indexedDB/IDBRequest.h
@@ -63,6 +63,7 @@ protected:
   uint64_t mLoggingSerialNumber;
   nsresult mErrorCode;
   uint32_t mLineNo;
+  uint32_t mColumn;
   bool mHaveResultOrErrorCode;
 
 public:
@@ -82,7 +83,7 @@ public:
          IDBTransaction* aTransaction);
 
   static void
-  CaptureCaller(nsAString& aFilename, uint32_t* aLineNo);
+  CaptureCaller(nsAString& aFilename, uint32_t* aLineNo, uint32_t* aColumn);
 
   static uint64_t
   NextSerialNumber();
@@ -130,7 +131,8 @@ public:
   GetError(ErrorResult& aRv);
 
   void
-  GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const;
+  GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo,
+                    uint32_t* aColumn) const;
 
   bool
   IsPending() const
diff --git a/dom/indexedDB/IDBTransaction.cpp b/dom/indexedDB/IDBTransaction.cpp
index 8cf6f14adb72..b9cf53be9b03 100644
--- a/dom/indexedDB/IDBTransaction.cpp
+++ b/dom/indexedDB/IDBTransaction.cpp
@@ -82,6 +82,7 @@ IDBTransaction::IDBTransaction(IDBDatabase* aDatabase,
   , mAbortCode(NS_OK)
   , mPendingRequestCount(0)
   , mLineNo(0)
+  , mColumn(0)
   , mReadyState(IDBTransaction::INITIAL)
   , mMode(aMode)
   , mCreating(false)
@@ -186,7 +187,7 @@ IDBTransaction::CreateVersionChange(
                        emptyObjectStoreNames,
                        VERSION_CHANGE);
   aOpenRequest->GetCallerLocation(transaction->mFilename,
-                                  &transaction->mLineNo);
+                                  &transaction->mLineNo, &transaction->mColumn);
 
   transaction->SetScriptOwner(aDatabase->GetScriptOwner());
 
@@ -219,7 +220,8 @@ IDBTransaction::Create(IDBDatabase* aDatabase,
 
   nsRefPtr<IDBTransaction> transaction =
     new IDBTransaction(aDatabase, aObjectStoreNames, aMode);
-  IDBRequest::CaptureCaller(transaction->mFilename, &transaction->mLineNo);
+  IDBRequest::CaptureCaller(transaction->mFilename, &transaction->mLineNo,
+                            &transaction->mColumn);
 
   transaction->SetScriptOwner(aDatabase->GetScriptOwner());
 
@@ -492,13 +494,16 @@ IDBTransaction::IsOpen() const
 }
 
 void
-IDBTransaction::GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const
+IDBTransaction::GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo,
+                                  uint32_t* aColumn) const
 {
   AssertIsOnOwningThread();
   MOZ_ASSERT(aLineNo);
+  MOZ_ASSERT(aColumn);
 
   aFilename = mFilename;
   *aLineNo = mLineNo;
+  *aColumn = mColumn;
 }
 
 already_AddRefed<IDBObjectStore>
diff --git a/dom/indexedDB/IDBTransaction.h b/dom/indexedDB/IDBTransaction.h
index d017685f9f09..d8f2eedfdce1 100644
--- a/dom/indexedDB/IDBTransaction.h
+++ b/dom/indexedDB/IDBTransaction.h
@@ -100,6 +100,7 @@ private:
 
   nsString mFilename;
   uint32_t mLineNo;
+  uint32_t mColumn;
 
   ReadyState mReadyState;
   Mode mMode;
@@ -205,7 +206,8 @@ public:
   }
 
   void
-  GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const;
+  GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo,
+                    uint32_t* aColumn) const;
 
   // 'Get' prefix is to avoid name collisions with the enum
   Mode
diff --git a/dom/indexedDB/IndexedDatabaseManager.cpp b/dom/indexedDB/IndexedDatabaseManager.cpp
index 58b4c8f95ce1..da05d55329fa 100644
--- a/dom/indexedDB/IndexedDatabaseManager.cpp
+++ b/dom/indexedDB/IndexedDatabaseManager.cpp
@@ -480,7 +480,7 @@ IndexedDatabaseManager::CommonPostHandleEvent(EventChainPostVisitor& aVisitor,
 
   ThreadsafeAutoJSContext cx;
   RootedDictionary<ErrorEventInit> init(cx);
-  request->GetCallerLocation(init.mFilename, &init.mLineno);
+  request->GetCallerLocation(init.mFilename, &init.mLineno, &init.mColno);
 
   init.mMessage = errorName;
   init.mCancelable = true;
@@ -556,7 +556,7 @@ IndexedDatabaseManager::CommonPostHandleEvent(EventChainPostVisitor& aVisitor,
                                     init.mFilename,
                                     /* aSourceLine */ EmptyString(),
                                     init.mLineno,
-                                    /* aColumnNumber */ 0,
+                                    init.mColno,
                                     nsIScriptError::errorFlag,
                                     category,
                                     innerWindowID)));
@@ -566,7 +566,7 @@ IndexedDatabaseManager::CommonPostHandleEvent(EventChainPostVisitor& aVisitor,
                         init.mFilename,
                         /* aSourceLine */ EmptyString(),
                         init.mLineno,
-                        /* aColumnNumber */ 0,
+                        init.mColno,
                         nsIScriptError::errorFlag,
                         category.get())));
   }
diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index d0f8489ce5e6..9b16b12bfe8e 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -49,7 +49,7 @@ interface nsIJSRAIIHelper;
 interface nsIContentPermissionRequest;
 interface nsIObserver;
 
-[scriptable, uuid(6ddc9a79-18cd-4dbc-9975-68928e6c9857)]
+[scriptable, uuid(a30a95ac-3b95-4251-88dc-8efa89ba9f9c)]
 interface nsIDOMWindowUtils : nsISupports {
 
   /**
@@ -106,15 +106,6 @@ interface nsIDOMWindowUtils : nsISupports {
    */
   void updateLayerTree();
 
-  /**
-   * Set the CSS viewport to be |widthPx| x |heightPx| in units of CSS
-   * pixels, regardless of the size of the enclosing widget/view.
-   * This will trigger reflow.
-   *
-   * The caller of this method must have chrome privileges.
-   */
-  void setCSSViewport(in float aWidthPx, in float aHeightPx);
-
   /**
    * Information retrieved from the <meta name="viewport"> tag.
    * See nsContentUtils::GetViewportInfo for more information.
diff --git a/dom/ipc/ContentBridgeChild.cpp b/dom/ipc/ContentBridgeChild.cpp
index 0c8dce8614f3..fc72ea5097be 100644
--- a/dom/ipc/ContentBridgeChild.cpp
+++ b/dom/ipc/ContentBridgeChild.cpp
@@ -12,7 +12,6 @@
 #include "mozilla/dom/ipc/BlobChild.h"
 #include "mozilla/jsipc/CrossProcessObjectWrappers.h"
 #include "mozilla/ipc/InputStreamUtils.h"
-#include "nsIObserverService.h"
 
 using namespace mozilla::ipc;
 using namespace mozilla::jsipc;
@@ -21,8 +20,7 @@ namespace mozilla {
 namespace dom {
 
 NS_IMPL_ISUPPORTS(ContentBridgeChild,
-                  nsIContentChild,
-                  nsIObserver)
+                  nsIContentChild)
 
 ContentBridgeChild::ContentBridgeChild(Transport* aTransport)
   : mTransport(aTransport)
@@ -36,10 +34,6 @@ ContentBridgeChild::~ContentBridgeChild()
 void
 ContentBridgeChild::ActorDestroy(ActorDestroyReason aWhy)
 {
-  nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
-  if (os) {
-    os->RemoveObserver(this, "content-child-shutdown");
-  }
   MessageLoop::current()->PostTask(
     FROM_HERE,
     NewRunnableMethod(this, &ContentBridgeChild::DeferredDestroy));
@@ -55,11 +49,6 @@ ContentBridgeChild::Create(Transport* aTransport, ProcessId aOtherPid)
   DebugOnly<bool> ok = bridge->Open(aTransport, aOtherPid, XRE_GetIOMessageLoop());
   MOZ_ASSERT(ok);
 
-  nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
-  if (os) {
-    os->AddObserver(bridge, "content-child-shutdown", false);
-  }
-
   return bridge;
 }
 
@@ -180,16 +169,5 @@ ContentBridgeChild::DeallocPBlobChild(PBlobChild* aActor)
   return nsIContentChild::DeallocPBlobChild(aActor);
 }
 
-NS_IMETHODIMP
-ContentBridgeChild::Observe(nsISupports* aSubject,
-                             const char* aTopic,
-                             const char16_t* aData)
-{
-  if (!strcmp(aTopic, "content-child-shutdown")) {
-    Close();
-  }
-  return NS_OK;
-}
-
 } // namespace dom
 } // namespace mozilla
diff --git a/dom/ipc/ContentBridgeChild.h b/dom/ipc/ContentBridgeChild.h
index b04c2f137cfb..44a198193919 100644
--- a/dom/ipc/ContentBridgeChild.h
+++ b/dom/ipc/ContentBridgeChild.h
@@ -9,20 +9,17 @@
 
 #include "mozilla/dom/PContentBridgeChild.h"
 #include "mozilla/dom/nsIContentChild.h"
-#include "nsIObserver.h"
 
 namespace mozilla {
 namespace dom {
 
 class ContentBridgeChild final : public PContentBridgeChild
                                , public nsIContentChild
-                               , public nsIObserver
 {
 public:
   explicit ContentBridgeChild(Transport* aTransport);
 
   NS_DECL_ISUPPORTS
-  NS_DECL_NSIOBSERVER
 
   static ContentBridgeChild*
   Create(Transport* aTransport, ProcessId aOtherProcess);
diff --git a/dom/ipc/ContentBridgeParent.cpp b/dom/ipc/ContentBridgeParent.cpp
index c21a8e4c0651..b269928b60ce 100644
--- a/dom/ipc/ContentBridgeParent.cpp
+++ b/dom/ipc/ContentBridgeParent.cpp
@@ -163,6 +163,17 @@ ContentBridgeParent::DeallocPBrowserParent(PBrowserParent* aParent)
   return nsIContentParent::DeallocPBrowserParent(aParent);
 }
 
+void
+ContentBridgeParent::NotifyTabDestroyed()
+{
+  int32_t numLiveTabs = ManagedPBrowserParent().Length();
+  if (numLiveTabs == 1) {
+    MessageLoop::current()->PostTask(
+      FROM_HERE,
+      NewRunnableMethod(this, &ContentBridgeParent::Close));
+  }
+}
+
 // This implementation is identical to ContentParent::GetCPOWManager but we can't
 // move it to nsIContentParent because it calls ManagedPJavaScriptParent() which
 // only exists in PContentParent and PContentBridgeParent.
diff --git a/dom/ipc/ContentBridgeParent.h b/dom/ipc/ContentBridgeParent.h
index af2fbc1acd1e..3b2c0e3807c2 100644
--- a/dom/ipc/ContentBridgeParent.h
+++ b/dom/ipc/ContentBridgeParent.h
@@ -28,6 +28,8 @@ public:
 
   virtual void ActorDestroy(ActorDestroyReason aWhy) override;
   void DeferredDestroy();
+  virtual bool IsContentBridgeParent() override { return true; }
+  void NotifyTabDestroyed();
 
   static ContentBridgeParent*
   Create(Transport* aTransport, ProcessId aOtherProcess);
diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index 964e7c14f82d..c8c0fb79f39d 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -2809,7 +2809,7 @@ ContentChild::RecvInvokeDragSession(nsTArray<IPCDataTransfer>&& aTransfers,
     if (session) {
       session->SetDragAction(aAction);
       nsCOMPtr<DataTransfer> dataTransfer =
-        new DataTransfer(nullptr, NS_DRAGDROP_START, false, -1);
+        new DataTransfer(nullptr, eDragStart, false, -1);
       for (uint32_t i = 0; i < aTransfers.Length(); ++i) {
         auto& items = aTransfers[i].items();
         for (uint32_t j = 0; j < items.Length(); ++j) {
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 38a3416eb737..c0c28953450c 100755
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -1468,7 +1468,9 @@ ContentParent::Init()
     }
     Preferences::AddStrongObserver(this, "");
     if (obs) {
-        obs->NotifyObservers(static_cast<nsIObserver*>(this), "ipc:content-created", nullptr);
+        nsAutoString cpId;
+        cpId.AppendInt(static_cast<uint64_t>(this->ChildID()));
+        obs->NotifyObservers(static_cast<nsIObserver*>(this), "ipc:content-created", cpId.get());
     }
 
 #ifdef ACCESSIBILITY
@@ -1843,11 +1845,12 @@ ContentParent::OnBeginSyncTransaction() {
         if (!sDisableUnsafeCPOWWarnings) {
             if (console && cx) {
                 nsAutoString filename;
-                uint32_t lineno = 0;
-                nsJSUtils::GetCallingLocation(cx, filename, &lineno);
+                uint32_t lineno = 0, column = 0;
+                nsJSUtils::GetCallingLocation(cx, filename, &lineno, &column);
                 nsCOMPtr<nsIScriptError> error(do_CreateInstance(NS_SCRIPTERROR_CONTRACTID));
-                error->Init(NS_LITERAL_STRING("unsafe CPOW usage"), filename, EmptyString(),
-                            lineno, 0, nsIScriptError::warningFlag, "chrome javascript");
+                error->Init(NS_LITERAL_STRING("unsafe CPOW usage"), filename,
+                            EmptyString(), lineno, column,
+                            nsIScriptError::warningFlag, "chrome javascript");
                 console->LogMessage(error);
             } else {
                 NS_WARNING("Unsafe synchronous IPC message");
@@ -2057,7 +2060,9 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
             }
 #endif
         }
-        obs->NotifyObservers((nsIPropertyBag2*) props, "ipc:content-shutdown", nullptr);
+        nsAutoString cpId;
+        cpId.AppendInt(static_cast<uint64_t>(this->ChildID()));
+        obs->NotifyObservers((nsIPropertyBag2*) props, "ipc:content-shutdown", cpId.get());
     }
 
     // Remove any and all idle listeners.
@@ -2085,10 +2090,35 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
     // least until after the current task finishes running.
     NS_DispatchToCurrentThread(new DelayedDeleteContentParentTask(this));
 
-    // Destroy any processes created by this ContentParent
-    ContentProcessManager *cpm = ContentProcessManager::GetSingleton();
+    // Release the appId's reference count of any processes
+    // created by this ContentParent and the frame opened by this ContentParent
+    // if this ContentParent crashes.
+    ContentProcessManager* cpm = ContentProcessManager::GetSingleton();
     nsTArray<ContentParentId> childIDArray =
         cpm->GetAllChildProcessById(this->ChildID());
+    if (why == AbnormalShutdown) {
+      nsCOMPtr<nsIPermissionManager> permMgr = services::GetPermissionManager();
+      if(permMgr) {
+        // Release the appId's reference count of its child-processes
+        for (uint32_t i = 0; i < childIDArray.Length(); i++) {
+          nsTArray<TabContext> tabCtxs = cpm->GetTabContextByContentProcess(childIDArray[i]);
+          for (uint32_t j = 0 ; j < tabCtxs.Length() ; j++) {
+            if (tabCtxs[j].OwnOrContainingAppId() != nsIScriptSecurityManager::NO_APP_ID) {
+              permMgr->ReleaseAppId(tabCtxs[j].OwnOrContainingAppId());
+            }
+          }
+        }
+        // Release the appId's reference count belong to itself
+        nsTArray<TabContext> tabCtxs = cpm->GetTabContextByContentProcess(mChildID);
+        for (uint32_t i = 0; i < tabCtxs.Length() ; i++) {
+          if (tabCtxs[i].OwnOrContainingAppId()!= nsIScriptSecurityManager::NO_APP_ID) {
+            permMgr->ReleaseAppId(tabCtxs[i].OwnOrContainingAppId());
+          }
+        }
+      }
+    }
+
+    // Destroy any processes created by this ContentParent
     for(uint32_t i = 0; i < childIDArray.Length(); i++) {
         ContentParent* cp = cpm->GetContentProcessById(childIDArray[i]);
         MessageLoop::current()->PostTask(
@@ -2104,23 +2134,33 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
 }
 
 void
-ContentParent::NotifyTabDestroying(PBrowserParent* aTab)
+ContentParent::NotifyTabDestroying(const TabId& aTabId,
+                                   const ContentParentId& aCpId)
 {
+  if (XRE_IsParentProcess()) {
     // There can be more than one PBrowser for a given app process
     // because of popup windows.  PBrowsers can also destroy
     // concurrently.  When all the PBrowsers are destroying, kick off
     // another task to ensure the child process *really* shuts down,
     // even if the PBrowsers themselves never finish destroying.
-    int32_t numLiveTabs = ManagedPBrowserParent().Length();
-    ++mNumDestroyingTabs;
-    if (mNumDestroyingTabs != numLiveTabs) {
+    ContentProcessManager* cpm = ContentProcessManager::GetSingleton();
+    ContentParent* cp = cpm->GetContentProcessById(aCpId);
+    if (!cp) {
+        return;
+    }
+    ++cp->mNumDestroyingTabs;
+    nsTArray<TabId> tabIds = cpm->GetTabParentsByProcessId(aCpId);
+    if (static_cast<size_t>(cp->mNumDestroyingTabs) != tabIds.Length()) {
         return;
     }
 
     // We're dying now, so prevent this content process from being
     // recycled during its shutdown procedure.
-    MarkAsDead();
-    StartForceKillTimer();
+    cp->MarkAsDead();
+    cp->StartForceKillTimer();
+  } else {
+    ContentChild::GetSingleton()->SendNotifyTabDestroying(aTabId, aCpId);
+  }
 }
 
 void
@@ -2142,16 +2182,15 @@ ContentParent::StartForceKillTimer()
 }
 
 void
-ContentParent::NotifyTabDestroyed(PBrowserParent* aTab,
+ContentParent::NotifyTabDestroyed(const TabId& aTabId,
                                   bool aNotifiedDestroying)
 {
     if (aNotifiedDestroying) {
         --mNumDestroyingTabs;
     }
 
-    TabId id = static_cast<TabParent*>(aTab)->GetTabId();
     nsTArray<PContentPermissionRequestParent*> parentArray =
-        nsContentPermissionUtils::GetContentPermissionRequestParentById(id);
+        nsContentPermissionUtils::GetContentPermissionRequestParentById(aTabId);
 
     // Need to close undeleted ContentPermissionRequestParents before tab is closed.
     for (auto& permissionRequestParent : parentArray) {
@@ -2164,7 +2203,9 @@ ContentParent::NotifyTabDestroyed(PBrowserParent* aTab,
     // There can be more than one PBrowser for a given app process
     // because of popup windows.  When the last one closes, shut
     // us down.
-    if (ManagedPBrowserParent().Length() == 1) {
+    ContentProcessManager* cpm = ContentProcessManager::GetSingleton();
+    nsTArray<TabId> tabIds = cpm->GetTabParentsByProcessId(this->ChildID());
+    if (tabIds.Length() == 1) {
         // In the case of normal shutdown, send a shutdown message to child to
         // allow it to perform shutdown tasks.
         MessageLoop::current()->PostTask(
@@ -4899,8 +4940,12 @@ ContentParent::AllocateTabId(const TabId& aOpenerTabId,
 {
     TabId tabId;
     if (XRE_IsParentProcess()) {
-        ContentProcessManager *cpm = ContentProcessManager::GetSingleton();
+        ContentProcessManager* cpm = ContentProcessManager::GetSingleton();
         tabId = cpm->AllocateTabId(aOpenerTabId, aContext, aCpId);
+        // Add appId's reference count in oop case
+        if (tabId) {
+          PermissionManagerAddref(aCpId, tabId);
+        }
     }
     else {
         ContentChild::GetSingleton()->SendAllocateTabId(aOpenerTabId,
@@ -4913,14 +4958,27 @@ ContentParent::AllocateTabId(const TabId& aOpenerTabId,
 
 /*static*/ void
 ContentParent::DeallocateTabId(const TabId& aTabId,
-                               const ContentParentId& aCpId)
+                               const ContentParentId& aCpId,
+                               bool aMarkedDestroying)
 {
     if (XRE_IsParentProcess()) {
+        // Release appId's reference count in oop case
+        if (aTabId) {
+          PermissionManagerRelease(aCpId, aTabId);
+        }
+
+        ContentProcessManager* cpm = ContentProcessManager::GetSingleton();
+        ContentParent* cp = cpm->GetContentProcessById(aCpId);
+
+        cp->NotifyTabDestroyed(aTabId, aMarkedDestroying);
+
         ContentProcessManager::GetSingleton()->DeallocateTabId(aCpId,
                                                                aTabId);
     }
     else {
-        ContentChild::GetSingleton()->SendDeallocateTabId(aTabId);
+        ContentChild::GetSingleton()->SendDeallocateTabId(aTabId,
+                                                          aCpId,
+                                                          aMarkedDestroying);
     }
 }
 
@@ -4938,9 +4996,19 @@ ContentParent::RecvAllocateTabId(const TabId& aOpenerTabId,
 }
 
 bool
-ContentParent::RecvDeallocateTabId(const TabId& aTabId)
+ContentParent::RecvDeallocateTabId(const TabId& aTabId,
+                                   const ContentParentId& aCpId,
+                                   const bool& aMarkedDestroying)
 {
-    DeallocateTabId(aTabId, this->ChildID());
+    DeallocateTabId(aTabId, aCpId, aMarkedDestroying);
+    return true;
+}
+
+bool
+ContentParent::RecvNotifyTabDestroying(const TabId& aTabId,
+                                       const ContentParentId& aCpId)
+{
+    NotifyTabDestroying(aTabId, aCpId);
     return true;
 }
 
@@ -5044,9 +5112,9 @@ ContentParent::MaybeInvokeDragSession(TabParent* aParent)
       session->GetDataTransfer(getter_AddRefs(domTransfer));
       nsCOMPtr<DataTransfer> transfer = do_QueryInterface(domTransfer);
       if (!transfer) {
-        // Pass NS_DRAGDROP_DROP to get DataTransfer with external
+        // Pass eDrop to get DataTransfer with external
         // drag formats cached.
-        transfer = new DataTransfer(nullptr, NS_DRAGDROP_DROP, true, -1);
+        transfer = new DataTransfer(nullptr, eDrop, true, -1);
         session->SetDataTransfer(transfer);
       }
       // Note, even though this fills the DataTransfer object with
@@ -5111,6 +5179,38 @@ ContentParent::DeallocPContentPermissionRequestParent(PContentPermissionRequestP
     return true;
 }
 
+/* static */ bool
+ContentParent::PermissionManagerAddref(const ContentParentId& aCpId,
+                                       const TabId& aTabId)
+{
+  MOZ_ASSERT(XRE_IsParentProcess(),
+             "Call PermissionManagerAddref in content process!");
+  ContentProcessManager* cpm = ContentProcessManager::GetSingleton();
+  uint32_t appId = cpm->GetAppIdByProcessAndTabId(aCpId, aTabId);
+  nsCOMPtr<nsIPermissionManager> permMgr = services::GetPermissionManager();
+  if (appId != nsIScriptSecurityManager::NO_APP_ID && permMgr) {
+    permMgr->AddrefAppId(appId);
+    return true;
+  }
+  return false;
+}
+
+/* static */ bool
+ContentParent::PermissionManagerRelease(const ContentParentId& aCpId,
+                                        const TabId& aTabId)
+{
+  MOZ_ASSERT(XRE_IsParentProcess(),
+             "Call PermissionManagerRelease in content process!");
+  ContentProcessManager* cpm = ContentProcessManager::GetSingleton();
+  uint32_t appId = cpm->GetAppIdByProcessAndTabId(aCpId, aTabId);
+  nsCOMPtr<nsIPermissionManager> permMgr = services::GetPermissionManager();
+  if (appId != nsIScriptSecurityManager::NO_APP_ID && permMgr) {
+    permMgr->ReleaseAppId(appId);
+    return true;
+  }
+  return false;
+}
+
 bool
 ContentParent::RecvGetBrowserConfiguration(const nsCString& aURI, BrowserConfiguration* aConfig)
 {
diff --git a/dom/ipc/ContentParent.h b/dom/ipc/ContentParent.h
index ff0525fec03d..4021b0608ab4 100644
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -212,9 +212,10 @@ public:
     virtual bool KillChild() override;
 
     /** Notify that a tab is beginning its destruction sequence. */
-    void NotifyTabDestroying(PBrowserParent* aTab);
+    static void NotifyTabDestroying(const TabId& aTabId,
+                                    const ContentParentId& aCpId);
     /** Notify that a tab was destroyed during normal operation. */
-    void NotifyTabDestroyed(PBrowserParent* aTab,
+    void NotifyTabDestroyed(const TabId& aTabId,
                             bool aNotifiedDestroying);
 
     TestShellParent* CreateTestShell();
@@ -227,7 +228,21 @@ public:
                   const IPCTabContext& aContext,
                   const ContentParentId& aCpId);
     static void
-    DeallocateTabId(const TabId& aTabId, const ContentParentId& aCpId);
+    DeallocateTabId(const TabId& aTabId,
+                    const ContentParentId& aCpId,
+                    bool aMarkedDestroying);
+
+    /*
+     * Add the appId's reference count by the given ContentParentId and TabId
+     */
+    static bool
+    PermissionManagerAddref(const ContentParentId& aCpId, const TabId& aTabId);
+
+    /*
+     * Release the appId's reference count by the given ContentParentId and TabId
+     */
+    static bool
+    PermissionManagerRelease(const ContentParentId& aCpId, const TabId& aTabId);
 
     static bool
     GetBrowserConfiguration(const nsCString& aURI, BrowserConfiguration& aConfig);
@@ -356,7 +371,12 @@ public:
                                    const ContentParentId& aCpId,
                                    TabId* aTabId) override;
 
-    virtual bool RecvDeallocateTabId(const TabId& aTabId) override;
+    virtual bool RecvDeallocateTabId(const TabId& aTabId,
+                                     const ContentParentId& aCpId,
+                                     const bool& aMarkedDestroying) override;
+
+    virtual bool RecvNotifyTabDestroying(const TabId& aTabId,
+                                         const ContentParentId& aCpId) override;
 
     nsTArray<TabContext> GetManagedTabContext();
 
diff --git a/dom/ipc/ContentProcessManager.cpp b/dom/ipc/ContentProcessManager.cpp
index 51c3588c0855..8937c777fdd6 100644
--- a/dom/ipc/ContentProcessManager.cpp
+++ b/dom/ipc/ContentProcessManager.cpp
@@ -12,6 +12,7 @@
 #include "mozilla/ClearOnShutdown.h"
 
 #include "nsPrintfCString.h"
+#include "nsIScriptSecurityManager.h"
 
 // XXX need another bug to move this to a common header.
 #ifdef DISABLE_ASSERTS_FOR_FUZZING
@@ -334,5 +335,40 @@ ContentProcessManager::GetTopLevelTabParentByProcessAndTabId(const ContentParent
   return GetTabParentByProcessAndTabId(currentCpId, currentTabId);
 }
 
+nsTArray<TabId>
+ContentProcessManager::GetTabParentsByProcessId(const ContentParentId& aChildCpId)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsTArray<TabId> tabIdList;
+  auto iter = mContentParentMap.find(aChildCpId);
+  if (NS_WARN_IF(iter == mContentParentMap.end())) {
+    ASSERT_UNLESS_FUZZING();
+    return Move(tabIdList);
+  }
+
+  for (auto remoteFrameIter = iter->second.mRemoteFrames.begin();
+      remoteFrameIter != iter->second.mRemoteFrames.end();
+      ++remoteFrameIter) {
+    tabIdList.AppendElement(remoteFrameIter->first);
+  }
+
+  return Move(tabIdList);
+}
+
+uint32_t
+ContentProcessManager::GetAppIdByProcessAndTabId(const ContentParentId& aChildCpId,
+                                                 const TabId& aChildTabId)
+{
+  uint32_t appId = nsIScriptSecurityManager::NO_APP_ID;
+  if (aChildCpId && aChildTabId) {
+    TabContext tabContext;
+    if (GetTabContextByProcessAndTabId(aChildCpId, aChildTabId, &tabContext)) {
+      appId = tabContext.OwnOrContainingAppId();
+    }
+  }
+  return appId;
+}
+
 } // namespace dom
 } // namespace mozilla
diff --git a/dom/ipc/ContentProcessManager.h b/dom/ipc/ContentProcessManager.h
index ea5b36e96e9b..4821af50f979 100644
--- a/dom/ipc/ContentProcessManager.h
+++ b/dom/ipc/ContentProcessManager.h
@@ -110,6 +110,13 @@ public:
                                  const TabId& aChildTabId,
                                  /*out*/ TabId* aOpenerTabId);
 
+  /**
+   * Get all TabParents' Ids managed by the givent content process.
+   * Return empty array when TabParent couldn't be found via aChildCpId
+   */
+  nsTArray<TabId>
+  GetTabParentsByProcessId(const ContentParentId& aChildCpId);
+
   /**
    * Get the TabParent by the given content process and tab id.
    * Return nullptr when TabParent couldn't be found via aChildCpId
@@ -135,6 +142,15 @@ public:
   GetTopLevelTabParentByProcessAndTabId(const ContentParentId& aChildCpId,
                                         const TabId& aChildTabId);
 
+  /**
+   * Return appId by given TabId and ContentParentId.
+   * It will return nsIScriptSecurityManager::NO_APP_ID
+   * if the given tab is not an app.
+   */
+  uint32_t
+  GetAppIdByProcessAndTabId(const ContentParentId& aChildCpId,
+                            const TabId& aChildTabId);
+
 private:
   static StaticAutoPtr<ContentProcessManager> sSingleton;
   TabId mUniqueId;
diff --git a/dom/ipc/PContent.ipdl b/dom/ipc/PContent.ipdl
index 080385f4341c..451090bc76b1 100644
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -991,8 +991,15 @@ parent:
      */
     sync AllocateTabId(TabId openerTabId, IPCTabContext context, ContentParentId cpId)
         returns (TabId tabId);
-    async DeallocateTabId(TabId tabId);
+    async DeallocateTabId(TabId tabId,
+                          ContentParentId cpId,
+                          bool aMarkedDestroying);
 
+    /**
+     * Tell the chrome process there is a destruction of PBrowser(Tab)
+     */
+    async NotifyTabDestroying(TabId tabId,
+                              ContentParentId cpId);
     /**
      * Starts an offline application cache update.
      * @param manifestURI
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 01c995017e3f..1d90862f23df 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -2183,19 +2183,19 @@ TabChild::RecvRealDragEvent(const WidgetDragEvent& aEvent,
     }
   }
 
-  if (aEvent.mMessage == NS_DRAGDROP_DROP) {
+  if (aEvent.mMessage == eDrop) {
     bool canDrop = true;
     if (!dragSession || NS_FAILED(dragSession->GetCanDrop(&canDrop)) ||
         !canDrop) {
-      localEvent.mMessage = NS_DRAGDROP_EXIT;
+      localEvent.mMessage = eDragExit;
     }
-  } else if (aEvent.mMessage == NS_DRAGDROP_OVER) {
+  } else if (aEvent.mMessage == eDragOver) {
     nsCOMPtr<nsIDragService> dragService =
       do_GetService("@mozilla.org/widget/dragservice;1");
     if (dragService) {
       // This will dispatch 'drag' event at the source if the
       // drag transaction started in this process.
-      dragService->FireDragEventAtSource(NS_DRAGDROP_DRAG);
+      dragService->FireDragEventAtSource(eDrag);
     }
   }
 
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index c4c82df953da..233c71b846d7 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -436,12 +436,8 @@ TabParent::IsVisible()
 }
 
 void
-TabParent::Destroy()
+TabParent::DestroyInternal()
 {
-  if (mIsDestroyed) {
-    return;
-  }
-
   IMEStateManager::OnTabParentDestroying(this);
 
   RemoveWindowListeners();
@@ -455,11 +451,6 @@ TabParent::Destroy()
     RemoveTabParentFromTable(frame->GetLayersId());
     frame->Destroy();
   }
-  mIsDestroyed = true;
-
-  if (XRE_IsParentProcess()) {
-    Manager()->AsContentParent()->NotifyTabDestroying(this);
-  }
 
   // Let all PluginWidgets know we are tearing down. Prevents
   // these objects from sending async events after the child side
@@ -468,6 +459,24 @@ TabParent::Destroy()
   for (uint32_t idx = 0; idx < kids.Length(); ++idx) {
       static_cast<mozilla::plugins::PluginWidgetParent*>(kids[idx])->ParentDestroy();
   }
+}
+
+void
+TabParent::Destroy()
+{
+  if (mIsDestroyed) {
+    return;
+  }
+
+  DestroyInternal();
+
+  mIsDestroyed = true;
+
+  if (XRE_IsParentProcess()) {
+    ContentParent::NotifyTabDestroying(this->GetTabId(), Manager()->AsContentParent()->ChildID());
+  } else {
+    ContentParent::NotifyTabDestroying(this->GetTabId(), Manager()->ChildID());
+  }
 
   mMarkedDestroying = true;
 }
@@ -476,12 +485,15 @@ bool
 TabParent::Recv__delete__()
 {
   if (XRE_IsParentProcess()) {
-    Manager()->AsContentParent()->NotifyTabDestroyed(this, mMarkedDestroying);
     ContentParent::DeallocateTabId(mTabId,
-                                   Manager()->AsContentParent()->ChildID());
+                                   Manager()->AsContentParent()->ChildID(),
+                                   mMarkedDestroying);
   }
   else {
-    ContentParent::DeallocateTabId(mTabId, ContentParentId(0));
+    Manager()->AsContentBridgeParent()->NotifyTabDestroyed();
+    ContentParent::DeallocateTabId(mTabId,
+                                   Manager()->ChildID(),
+                                   mMarkedDestroying);
   }
 
   return true;
@@ -494,6 +506,22 @@ TabParent::ActorDestroy(ActorDestroyReason why)
   // case of a crash.
   IMEStateManager::OnTabParentDestroying(this);
 
+  // Prevent executing ContentParent::NotifyTabDestroying in
+  // TabParent::Destroy() called by frameLoader->DestroyComplete() below
+  // when tab crashes in contentprocess because ContentParent::ActorDestroy()
+  // in main process will be triggered before this function
+  // and remove the process information that
+  // ContentParent::NotifyTabDestroying need from mContentParentMap.
+
+  // When tab crashes in content process,
+  // there is no need to call ContentParent::NotifyTabDestroying
+  // because the jobs in ContentParent::NotifyTabDestroying
+  // will be done by ContentParent::ActorDestroy.
+  if (XRE_IsContentProcess() && why == AbnormalShutdown && !mIsDestroyed) {
+    DestroyInternal();
+    mIsDestroyed = true;
+  }
+
   nsRefPtr<nsFrameLoader> frameLoader = GetFrameLoader(true);
   nsCOMPtr<nsIObserverService> os = services::GetObserverService();
   if (frameLoader) {
diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h
index c8b61d1cbefa..67d2b7dab8ec 100644
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -491,6 +491,7 @@ protected:
     LayoutDeviceIntPoint mChromeOffset;
 
 private:
+    void DestroyInternal();
     already_AddRefed<nsFrameLoader> GetFrameLoader(bool aUseCachedFrameLoaderAfterDestroy = false) const;
     nsRefPtr<nsIContentParent> mManager;
     void TryCacheDPIAndScale();
diff --git a/dom/ipc/nsIContentParent.cpp b/dom/ipc/nsIContentParent.cpp
index 1ec21a1fb410..71b4cdc747a8 100644
--- a/dom/ipc/nsIContentParent.cpp
+++ b/dom/ipc/nsIContentParent.cpp
@@ -10,6 +10,7 @@
 #include "mozilla/Preferences.h"
 #include "mozilla/dom/File.h"
 #include "mozilla/dom/ContentParent.h"
+#include "mozilla/dom/ContentBridgeParent.h"
 #include "mozilla/dom/PTabContext.h"
 #include "mozilla/dom/PermissionMessageUtils.h"
 #include "mozilla/dom/StructuredCloneUtils.h"
@@ -46,6 +47,13 @@ nsIContentParent::AsContentParent()
   return static_cast<ContentParent*>(this);
 }
 
+ContentBridgeParent*
+nsIContentParent::AsContentBridgeParent()
+{
+  MOZ_ASSERT(IsContentBridgeParent());
+  return static_cast<ContentBridgeParent*>(this);
+}
+
 PJavaScriptParent*
 nsIContentParent::AllocPJavaScriptParent()
 {
diff --git a/dom/ipc/nsIContentParent.h b/dom/ipc/nsIContentParent.h
index 758f8efdf425..29a50f25d172 100644
--- a/dom/ipc/nsIContentParent.h
+++ b/dom/ipc/nsIContentParent.h
@@ -38,6 +38,7 @@ class BlobConstructorParams;
 class BlobImpl;
 class BlobParent;
 class ContentParent;
+class ContentBridgeParent;
 class IPCTabContext;
 class PBlobParent;
 class PBrowserParent;
@@ -77,6 +78,8 @@ public:
 
   virtual bool IsContentParent() { return false; }
   ContentParent* AsContentParent();
+  virtual bool IsContentBridgeParent() { return false; }
+  ContentBridgeParent* AsContentBridgeParent();
 
 protected: // methods
   bool CanOpenBrowser(const IPCTabContext& aContext);
diff --git a/dom/ipc/tests/file_app.sjs b/dom/ipc/tests/file_app.sjs
new file mode 100644
index 000000000000..45c002d99ebc
--- /dev/null
+++ b/dom/ipc/tests/file_app.sjs
@@ -0,0 +1,55 @@
+var gBasePath = "tests/dom/ipc/tests/";
+
+function handleRequest(request, response) {
+  var query = getQuery(request);
+
+  var testToken = '';
+  if ('testToken' in query) {
+    testToken = query.testToken;
+  }
+
+  var template = '';
+  if ('template' in query) {
+    template = query.template;
+  }
+  var template = gBasePath + template;
+  response.setHeader("Content-Type", "application/x-web-app-manifest+json", false);
+  response.write(readTemplate(template).replace(/TESTTOKEN/g, testToken));
+}
+
+// Copy-pasted incantations. There ought to be a better way to synchronously read
+// a file into a string, but I guess we're trying to discourage that.
+function readTemplate(path) {
+  var file = Components.classes["@mozilla.org/file/directory_service;1"].
+                        getService(Components.interfaces.nsIProperties).
+                        get("CurWorkD", Components.interfaces.nsILocalFile);
+  var fis  = Components.classes['@mozilla.org/network/file-input-stream;1'].
+                        createInstance(Components.interfaces.nsIFileInputStream);
+  var cis = Components.classes["@mozilla.org/intl/converter-input-stream;1"].
+                       createInstance(Components.interfaces.nsIConverterInputStream);
+  var split = path.split("/");
+  for(var i = 0; i < split.length; ++i) {
+    file.append(split[i]);
+  }
+  fis.init(file, -1, -1, false);
+  cis.init(fis, "UTF-8", 0, 0);
+
+  var data = "";
+  let str = {};
+  let read = 0;
+  do {
+    read = cis.readString(0xffffffff, str); // read as much as we can and put it in str.value
+    data += str.value;
+  } while (read != 0);
+  cis.close();
+  return data;
+}
+
+function getQuery(request) {
+  var query = {};
+  request.queryString.split('&').forEach(function (val) {
+    var [name, value] = val.split('=');
+    query[name] = unescape(value);
+  });
+  return query;
+}
diff --git a/dom/ipc/tests/file_app.template.webapp b/dom/ipc/tests/file_app.template.webapp
new file mode 100644
index 000000000000..8e7ae0750bd4
--- /dev/null
+++ b/dom/ipc/tests/file_app.template.webapp
@@ -0,0 +1,6 @@
+{
+  "name": "Nested-OOP",
+  "description": "Nested-OOP test app used for mochitest.",
+  "launch_path": "/tests/dom/ipc/tests/TESTTOKEN",
+  "icons": { "128": "default_icon" }
+}
diff --git a/dom/ipc/tests/mochitest.ini b/dom/ipc/tests/mochitest.ini
index ee25c1b09ae7..b2aec1bc0378 100644
--- a/dom/ipc/tests/mochitest.ini
+++ b/dom/ipc/tests/mochitest.ini
@@ -21,3 +21,39 @@ skip-if = true # bug 1166923
 skip-if = toolkit == 'cocoa' # disabled due to hangs, see changeset 6852e7c47edf
 [test_CrashService_crash.html]
 skip-if = !(crashreporter && !e10s && (toolkit == 'gtk2' || toolkit == 'gtk3' || toolkit == 'cocoa' || toolkit == 'windows') && (buildapp != 'b2g' || toolkit == 'gonk') && (buildapp != 'mulet')) # TC: Bug 1144079 - Re-enable Mulet mochitests and reftests taskcluster-specific disables.
+[test_permission_for_in_process_app.html]
+skip-if = e10s || os == "android" || toolkit == "gonk" # embed-apps doesn't work in mochitest app
+support-files =
+  test_permission_helper.js
+[test_permission_for_oop_app.html]
+skip-if = buildapp == 'mulet' || os == "android" || toolkit == "gonk" # embed-apps doesn't work in mochitest app
+support-files =
+  file_app.sjs
+  file_app.template.webapp
+  test_permission_helper.js
+  test_permission_embed.html
+  test_permission_framescript.js
+[test_permission_for_nested_oop_app.html]
+skip-if = buildapp == 'mulet' || os == "android" || toolkit == "gonk" # embed-apps doesn't work in mochitest app
+support-files =
+  file_app.sjs
+  file_app.template.webapp
+  test_permission_helper.js
+  test_permission_embed.html
+  test_permission_framescript.js
+[test_permission_for_two_oop_apps.html]
+skip-if = buildapp == 'mulet' || os == "android" || toolkit == "gonk" # embed-apps doesn't work in mochitest app
+support-files =
+  file_app.sjs
+  file_app.template.webapp
+  test_permission_helper.js
+  test_permission_embed.html
+  test_permission_framescript.js
+[test_permission_when_oop_app_crashes.html]
+skip-if = buildapp == 'mulet' || os == "android" || toolkit == "gonk" # embed-apps doesn't work in mochitest app
+support-files =
+  file_app.sjs
+  file_app.template.webapp
+  test_permission_helper.js
+  test_permission_embed.html
+  test_permission_framescript.js
diff --git a/dom/ipc/tests/test_permission_embed.html b/dom/ipc/tests/test_permission_embed.html
new file mode 100644
index 000000000000..88c0051d6f1c
--- /dev/null
+++ b/dom/ipc/tests/test_permission_embed.html
@@ -0,0 +1,51 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>oop-test apps</title>
+  <script type="application/javascript">
+    "use strict";
+
+    var queryString = decodeURIComponent(window.location.hash.substring(1));
+
+    // test-target-app
+    var APP_URL = "http://example.org";
+    var APP_MANIFEST = "http://example.org/manifest.webapp";
+    var APP_IFRAME_ID = "test-target";
+
+    function removeAppFrame(){
+      var ifr = document.getElementById(APP_IFRAME_ID);
+      ifr.remove();
+    }
+
+    function allocateAppFrame(source, manifestURL, useRemote) {
+      var ifr = document.createElement('iframe');
+      ifr.setAttribute('id', APP_IFRAME_ID);
+      ifr.setAttribute('remote', useRemote? "true" : "false");
+      ifr.setAttribute('mozbrowser', 'true');
+      ifr.setAttribute('mozapp', manifestURL);
+      ifr.setAttribute('src', source);
+
+      ifr.addEventListener('mozbrowserloadend', function () {
+        if (queryString == "crash") {
+          // Send a crash request to parent-process
+          sendMessgeToParent('crash');
+        } else {
+          removeAppFrame();
+        }
+      });
+
+      document.body.appendChild(ifr);
+    }
+
+    function sendMessgeToParent(msg) {
+      window.alert(msg);
+    }
+  </script>
+</head>
+<body>
+  <script>
+    allocateAppFrame(APP_URL, APP_MANIFEST, true);
+  </script>
+</body>
+</html>
diff --git a/dom/ipc/tests/test_permission_for_in_process_app.html b/dom/ipc/tests/test_permission_for_in_process_app.html
new file mode 100644
index 000000000000..7112efc6114b
--- /dev/null
+++ b/dom/ipc/tests/test_permission_for_in_process_app.html
@@ -0,0 +1,43 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1114507
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1114507</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank"
+  href="https://bugzilla.mozilla.org/show_bug.cgi?id=1114507">Mozilla Bug1114507</a>
+<p id="display"></p>
+<div id="container" style="display: none"></div>
+<script type="text/javascript" src="test_permission_helper.js"></script>
+<script type="application/javascript">
+// Put all the tests in order
+var tests = [
+  // Setup preferences and permissions
+  setupPrefsAndPermissions,
+
+  // +-------------------------------------------+
+  // | Test 1: Open and close a in-process       |
+  // |         test-target-app in chrome-process |
+  // +-------------------------------------------+
+  //
+  // level
+  //    1   chrome process <-- app is here
+
+  // Add permission to app
+  function () {
+    addPermissionToApp(APP_URL, APP_MANIFEST);
+  },
+
+  test1
+];
+
+runTests();
+</script>
+</body>
+</html>
diff --git a/dom/ipc/tests/test_permission_for_nested_oop_app.html b/dom/ipc/tests/test_permission_for_nested_oop_app.html
new file mode 100644
index 000000000000..461ddd16ee41
--- /dev/null
+++ b/dom/ipc/tests/test_permission_for_nested_oop_app.html
@@ -0,0 +1,75 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1114507
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1114507</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank"
+  href="https://bugzilla.mozilla.org/show_bug.cgi?id=1114507">Mozilla Bug1114507</a>
+<p id="display"></p>
+<div id="container" style="display: none"></div>
+<script type="text/javascript" src="test_permission_helper.js"></script>
+<script type="application/javascript">
+// Put all the tests in order
+var tests = [
+  // Setup preferences and permissions
+  setupPrefsAndPermissions,
+
+  // ****************************************************
+  // Setup the enviroment for testing nested-oop cases: *
+  // test 3,4,5                                         *
+  // ****************************************************
+
+  // Install the app
+  installApp,
+
+  // Allow permission for embedApp to open mozbrowser and mozapp
+  function() {
+    var appId = gAppsService.getAppLocalIdByManifestURL(embedAppHostedManifestURL);
+    var context = { url: embedApp.origin,
+                    appId: appId,
+                    isInBrowserElement: false };
+    setupOpenAppPermission(context, runTests);
+  },
+
+  // +-------------------------------------------+
+  // | Test 3: Open a test-target-app on 3rd     |
+  // |         level child-process then close it |
+  // +-------------------------------------------+
+  //
+  // level
+  //    1   chrome process
+  //              |
+  //    2   child process
+  //              |
+  //    3   child process <-- app is here
+
+  // Add permission to app
+  function() {
+    addPermissionToApp(APP_URL, APP_MANIFEST);
+  },
+
+  test3,
+
+  // Remove the child-process on 2nd level
+  function() {
+    var afterShutdown = function() {
+      runTests();
+    };
+    afterContentShutdown(1, afterShutdown);
+    removeAppFrame(APP_IFRAME_ID);
+  },
+
+  uninstallApp
+];
+
+runTests();
+</script>
+</body>
+</html>
diff --git a/dom/ipc/tests/test_permission_for_oop_app.html b/dom/ipc/tests/test_permission_for_oop_app.html
new file mode 100644
index 000000000000..781715aa5907
--- /dev/null
+++ b/dom/ipc/tests/test_permission_for_oop_app.html
@@ -0,0 +1,45 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1114507
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1114507</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank"
+  href="https://bugzilla.mozilla.org/show_bug.cgi?id=1114507">Mozilla Bug1114507</a>
+<p id="display"></p>
+<div id="container" style="display: none"></div>
+<script type="text/javascript" src="test_permission_helper.js"></script>
+<script type="application/javascript">
+// Put all the tests in order
+var tests = [
+  // Setup preferences and permissions
+  setupPrefsAndPermissions,
+
+  // +------------------------------------------+
+  // | Test 2: Open and close a test-target-app |
+  // |         on 2nd level child-process       |
+  // +------------------------------------------+
+  //
+  // level
+  //    1   chrome process
+  //              |
+  //    2   child process <-- app is here
+
+  // Add permission to app
+  function() {
+    addPermissionToApp(APP_URL, APP_MANIFEST);
+  },
+
+  test2,
+];
+
+runTests();
+</script>
+</body>
+</html>
diff --git a/dom/ipc/tests/test_permission_for_two_oop_apps.html b/dom/ipc/tests/test_permission_for_two_oop_apps.html
new file mode 100644
index 000000000000..9e2182515f28
--- /dev/null
+++ b/dom/ipc/tests/test_permission_for_two_oop_apps.html
@@ -0,0 +1,88 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1114507
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1114507</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank"
+  href="https://bugzilla.mozilla.org/show_bug.cgi?id=1114507">Mozilla Bug1114507</a>
+<p id="display"></p>
+<div id="container" style="display: none"></div>
+<script type="text/javascript" src="test_permission_helper.js"></script>
+<script type="application/javascript">
+// Put all the tests in order
+var tests = [
+  // Setup preferences and permissions
+  setupPrefsAndPermissions,
+
+  // ****************************************************
+  // Setup the enviroment for testing nested-oop cases: *
+  // test 3,4,5                                         *
+  // ****************************************************
+
+  // Install the app
+  installApp,
+
+  // Allow permission for embedApp to open mozbrowser and mozapp
+  function() {
+    var appId = gAppsService.getAppLocalIdByManifestURL(embedAppHostedManifestURL);
+    var context = { url: embedApp.origin,
+                    appId: appId,
+                    isInBrowserElement: false };
+    setupOpenAppPermission(context, runTests);
+  },
+
+  // +---------------------------------------------------------+
+  // | Test 4: Open two test-target-app on 2nd and 3rd level   |
+  // |         child-processes then close the one on 3rd level |
+  // +---------------------------------------------------------+
+  //
+  // level
+  //    1           chrome process
+  //                /             \
+  //    2       child process   child process <-- app is here
+  //              /
+  //    3     child process <-- app is here
+
+  // Add permission to app
+  function() {
+    addPermissionToApp(APP_URL, APP_MANIFEST);
+  },
+
+  test4,
+
+  // Remove another test-target-app on 2nd level process
+  function() {
+    var afterShutdown = function() {
+      // We expect there is no permission for the test-target-app now
+      runNextIfAppHasPermission(4, false, APP_URL, APP_MANIFEST);
+    };
+    // Test permission after test-target-app
+    // on 2nd level process is killed
+    afterContentShutdown(1, afterShutdown);
+
+    removeAppFrame(APP_IFRAME_ID2);
+  },
+
+  // Remove the last child-process on 2nd level
+  function() {
+    var afterShutdown = function() {
+      runTests();
+    };
+    afterContentShutdown(1, afterShutdown);
+    removeAppFrame(APP_IFRAME_ID);
+  },
+
+  uninstallApp
+];
+
+runTests();
+</script>
+</body>
+</html>
diff --git a/dom/ipc/tests/test_permission_framescript.js b/dom/ipc/tests/test_permission_framescript.js
new file mode 100644
index 000000000000..d2bd63b84644
--- /dev/null
+++ b/dom/ipc/tests/test_permission_framescript.js
@@ -0,0 +1,31 @@
+Components.utils.import("resource://gre/modules/Services.jsm");
+let cm = Services.crashmanager;
+var cpIdList = [];
+
+var shutdownObs = {
+  observe: function(subject, topic, data) {
+    if (topic == 'ipc:content-shutdown') {
+      var index = cpIdList.indexOf(parseInt(data));
+      if (index  > -1) {
+        cpIdList.splice(index, 1);
+        sendAsyncMessage('content-shutdown', '');
+      }
+    }
+  }
+};
+
+var createdObs = {
+  observe: function(subject, topic, data) {
+    if (topic == 'ipc:content-created') {
+      cpIdList.push(parseInt(data));
+      sendAsyncMessage('content-created', '');
+    }
+  }
+};
+
+addMessageListener('crashreporter-status', function(message) {
+  sendAsyncMessage('crashreporter-enable', !!cm);
+});
+
+Services.obs.addObserver(shutdownObs, 'ipc:content-shutdown', false);
+Services.obs.addObserver(createdObs, 'ipc:content-created', false);
diff --git a/dom/ipc/tests/test_permission_helper.js b/dom/ipc/tests/test_permission_helper.js
new file mode 100644
index 000000000000..125da9139035
--- /dev/null
+++ b/dom/ipc/tests/test_permission_helper.js
@@ -0,0 +1,362 @@
+"use strict";
+
+// Used to access the DOM node in this test
+const DOM_PARENT_ID = "container";
+const DOM_PARENT = document.getElementById(DOM_PARENT_ID);
+const APP_IFRAME_ID = "appFrame";
+const APP_IFRAME_ID2 = "appFrame2";
+
+// Settings for testing the permission
+const SESSION_PERSIST_MINUTES = 10;
+const PERMISSION_TYPE = "geolocation";
+const permManager = SpecialPowers.Cc["@mozilla.org/permissionmanager;1"]
+                    .getService(SpecialPowers.Ci.nsIPermissionManager);
+
+// Used to access App's information like appId
+const gAppsService = SpecialPowers.Cc["@mozilla.org/AppsService;1"]
+                    .getService(SpecialPowers.Ci.nsIAppsService);
+
+// Target-app for this testing
+const APP_URL = "http://example.org";
+const APP_MANIFEST = "http://example.org/manifest.webapp";
+
+// Used to embed a remote app that open the test-target-app above
+const embedAppHostedManifestURL = window.location.origin +
+      '/tests/dom/ipc/tests/file_app.sjs?testToken=test_permission_embed.html&template=file_app.template.webapp';
+var embedApp;
+
+// Used to add listener for ipc:content-shutdown that
+// will be triggered after ContentParent::DeallocateTabId
+var gScript = SpecialPowers.loadChromeScript(SimpleTest.getTestFileURL('test_permission_framescript.js'));
+
+// Delay reporting a result until after finish() got called
+SimpleTest.waitForExplicitFinish();
+// Allow tests to disable the per platform app validity checks
+SpecialPowers.setAllAppsLaunchable(true);
+
+// Run tests in order
+function runTests() {
+  if (!tests.length) {
+    ok(true, "pass all tests!");
+    SimpleTest.finish();
+    return;
+  }
+
+  var test = tests.shift();
+  test();
+}
+
+function test1() {
+  allocateAppFrame(APP_IFRAME_ID, DOM_PARENT, APP_URL, APP_MANIFEST);
+
+  var appId = gAppsService.getAppLocalIdByManifestURL(APP_MANIFEST);
+
+  if (!SpecialPowers.hasPermission( PERMISSION_TYPE,
+                                    { url: APP_URL,
+                                      appId: appId,
+                                      isInBrowserElement: false })) {
+    errorHandler('[test 1] App should have permission: ' + PERMISSION_TYPE);
+  }
+
+  removeAppFrame(APP_IFRAME_ID);
+
+  // We expect there is no permission for the test-target-app
+  // after removing the in-process iframe embedding this app
+  runNextIfAppHasPermission(1, false, APP_URL, APP_MANIFEST);
+}
+
+function test2() {
+  var afterShutdown = function () {
+    // We expect there is no permission for the test-target-app
+    // after removing the remote iframe embedding this app
+    runNextIfAppHasPermission(2, false, APP_URL, APP_MANIFEST);
+  };
+
+  // Test permission after the child-process containing
+  // test-target-app is killed
+  afterContentShutdown(1, afterShutdown);
+
+  allocateAppFrame(APP_IFRAME_ID, DOM_PARENT, APP_URL, APP_MANIFEST, true);
+
+  var appId = gAppsService.getAppLocalIdByManifestURL(APP_MANIFEST);
+
+  if (!SpecialPowers.hasPermission( PERMISSION_TYPE,
+                                    { url: APP_URL,
+                                      appId: appId,
+                                      isInBrowserElement: false })) {
+    errorHandler('[test 2] App should have permission: ' + PERMISSION_TYPE);
+  }
+
+  removeAppFrame(APP_IFRAME_ID);
+}
+
+function test3() {
+  var afterGrandchildShutdown = function () {
+    // We expect there is no permission for the test-target-app
+    // after removing the remote iframe embedding this app
+    runNextIfAppHasPermission(3, false, APP_URL, APP_MANIFEST);
+  };
+
+  // Test permission after the grandchild-process
+  // containing test-target-app is killed
+  afterContentShutdown(1, afterGrandchildShutdown);
+
+  allocateAppFrame(APP_IFRAME_ID,
+                   DOM_PARENT,
+                   embedApp.manifest.launch_path,
+                   embedApp.manifestURL,
+                   true);
+
+  var appId = gAppsService.getAppLocalIdByManifestURL(APP_MANIFEST);
+
+  if (!SpecialPowers.hasPermission(PERMISSION_TYPE,
+                                   { url: APP_URL,
+                                     appId: appId,
+                                     isInBrowserElement: false })) {
+    errorHandler('[test 3] App should have permission: ' + PERMISSION_TYPE);
+  }
+}
+
+function test4() {
+  var afterGrandchildShutdown = function () {
+    // We expect there is still a permission for the test-target-app
+    // after killing test-target-app on 3rd-level process
+    runNextIfAppHasPermission(4, true, APP_URL, APP_MANIFEST);
+  };
+
+  // Test permission after the grandchild-process
+  // containing test-target-app is killed
+  afterContentShutdown(1, afterGrandchildShutdown);
+
+  // Open a child process(2nd level) and a grandchild process(3rd level)
+  // that contains a test-target-app
+  allocateAppFrame(APP_IFRAME_ID,
+                   DOM_PARENT,
+                   embedApp.manifest.launch_path,
+                   embedApp.manifestURL,
+                   true);
+
+  // Open another child process that contains
+  // another test-target-app(2nd level)
+  allocateAppFrame(APP_IFRAME_ID2,
+                   DOM_PARENT,
+                   APP_URL,
+                   APP_MANIFEST,
+                   true);
+
+  var appId = gAppsService.getAppLocalIdByManifestURL(APP_MANIFEST);
+
+  if (!SpecialPowers.hasPermission(PERMISSION_TYPE,
+                                   { url: APP_URL,
+                                     appId: appId,
+                                     isInBrowserElement: false })) {
+    errorHandler('[test 4] App should have permission: ' + PERMISSION_TYPE);
+  }
+}
+
+function test5() {
+  var afterShutdown = function () {
+    // We expect there is no permission for the test-target-app
+    // after crashing its parent-process
+    runNextIfAppHasPermission(5, false, APP_URL, APP_MANIFEST);
+  };
+
+  // Test permission after the parent-process of test-target-app is crashed.
+  afterContentShutdown(2, afterShutdown);
+
+  allocateAppFrame(APP_IFRAME_ID,
+                   DOM_PARENT,
+                   embedApp.manifest.launch_path + '#' + encodeURIComponent('crash'),
+                   embedApp.manifestURL,
+                   true);
+
+  var appId = gAppsService.getAppLocalIdByManifestURL(APP_MANIFEST);
+
+  if (!SpecialPowers.hasPermission( PERMISSION_TYPE,
+                                    { url: APP_URL,
+                                      appId: appId,
+                                      isInBrowserElement: false })) {
+    errorHandler('[test 5] App should have permission: ' + PERMISSION_TYPE);
+  }
+
+  // Crash the child-process on 2nd level after
+  // the grandchild process on 3rd is allocated
+  var handler = {'crash': function() {
+      gScript.sendAsyncMessage("crashreporter-status", {});
+
+      getCrashReporterStatus(function(enable) {
+        if (enable) {
+          SimpleTest.expectChildProcessCrash();
+        }
+        crashChildProcess(APP_IFRAME_ID);
+      });
+    }
+  };
+
+  receiveMessageFromChildFrame(APP_IFRAME_ID, handler);
+}
+
+// Setup the prefrences and permissions.
+// This function should be called before any tests
+function setupPrefsAndPermissions() {
+  SpecialPowers.pushPrefEnv({"set": [
+    ["dom.mozBrowserFramesEnabled", true],
+    ["dom.ipc.tabs.nested.enabled", true],
+    ["dom.ipc.tabs.disabled", false]]},
+    function() {
+      var autoManageApp = function () {
+        SpecialPowers.setAllAppsLaunchable(true);
+        // No confirmation needed when an app is installed and uninstalled.
+        SpecialPowers.autoConfirmAppInstall(() => {
+          // This callback should trigger the first test
+          SpecialPowers.autoConfirmAppUninstall(runTests);
+        });
+      };
+
+      setupOpenAppPermission(document, autoManageApp);
+    }
+  );
+}
+
+function setupOpenAppPermission(ctx, callback) {
+  SpecialPowers.pushPermissions([
+    { "type": "browser", "allow": true, "context": ctx}, // for mozbrowser
+    { "type": "embed-apps", "allow": true, "context": ctx }, // for mozapp
+    { "type": "webapps-manage", "allow": true, "context": ctx }], // for (un)installing apps
+    function checkPermissions() {
+      if (SpecialPowers.hasPermission("browser", ctx) &&
+          SpecialPowers.hasPermission("embed-apps", ctx) &&
+          SpecialPowers.hasPermission("webapps-manage", ctx)) {
+        callback();
+      } else {
+        errorHandler(">> At least one of required permissions to open app is disallowed!\n");
+      }
+    });
+}
+
+function installApp() {
+  // Install App from manifest
+  var request = navigator.mozApps.install(embedAppHostedManifestURL);
+  request.onerror = cbError;
+  request.onsuccess = function() {
+    // Get installed app
+    embedApp = request.result; // Assign to global variable
+    runTests();
+  }
+}
+
+function uninstallApp() {
+  var request = navigator.mozApps.mgmt.uninstall(embedApp);
+  request.onerror = cbError;
+  request.onsuccess = function() {
+    info("uninstall app susseccfully!");
+    runTests();
+  }
+}
+
+function removeAppFrame(id) {
+  var ifr  = document.getElementById(id);
+  ifr.remove();
+}
+
+function allocateAppFrame(id, parentNode, appSRC, manifestURL, useRemote = false) {
+  var ifr = document.createElement('iframe');
+  ifr.setAttribute('id', id);
+  ifr.setAttribute('remote', useRemote? "true" : "false");
+  ifr.setAttribute('mozbrowser', 'true');
+  ifr.setAttribute('mozapp', manifestURL);
+  ifr.setAttribute('src', appSRC);
+  parentNode.appendChild(ifr);
+}
+
+function receiveMessageFromChildFrame(id, handlers) {
+  var ifr = document.getElementById(id);
+  ifr.addEventListener('mozbrowsershowmodalprompt', function (recvMsg) {
+    var msg = recvMsg.detail.message;
+    handlers[msg]();
+  });
+}
+
+function addPermissionToApp(appURL, manifestURL) {
+  var appId = gAppsService.getAppLocalIdByManifestURL(manifestURL);
+
+  // Get the time now. This is used for permission manager's expire_time
+  var now = Number(Date.now());
+
+  // Add app's permission asynchronously
+  SpecialPowers.pushPermissions([
+      { "type":PERMISSION_TYPE,
+        "allow": 1,
+        "expireType":permManager.EXPIRE_SESSION,
+        "expireTime":now + SESSION_PERSIST_MINUTES*60*1000,
+        "context": { url: appURL,
+                     appId: appId,
+                     isInBrowserElement:false }
+      }
+    ], function() {
+      runTests();
+    });
+}
+
+function runNextIfAppHasPermission(round, expect, appURL, manifestURL) {
+  var appId = gAppsService.getAppLocalIdByManifestURL(manifestURL);
+
+  var hasPerm = SpecialPowers.hasPermission(PERMISSION_TYPE,
+                                            { url: appURL,
+                                              appId: appId,
+                                              isInBrowserElement: false });
+  var result = (expect==hasPerm);
+  if (result) {
+    runTests();
+  } else {
+    errorHandler( '[test ' + round + '] App should ' + ((expect)? '':'NOT ') +
+                  'have permission: ' + PERMISSION_TYPE);
+  }
+}
+
+function afterContentShutdown(times, callback) {
+  // handle the message from test_permission_framescript.js
+  var num = 0;
+  gScript.addMessageListener('content-shutdown', function onShutdown(data) {
+    num += 1;
+    if (num >= times) {
+      gScript.removeMessageListener('content-shutdown', onShutdown);
+      callback();
+    }
+  });
+}
+
+function getCrashReporterStatus(callback) {
+  gScript.addMessageListener('crashreporter-enable', function getStatus(data) {
+    gScript.removeMessageListener('crashreporter-enable', getStatus);
+    callback(data);
+  });
+}
+
+// Inject a frame script that crashes the content process
+function crashChildProcess(frameId) {
+  var child = document.getElementById(frameId);
+  var mm = SpecialPowers.getBrowserFrameMessageManager(child);
+  var childFrameScriptStr =
+    'function ContentScriptScope() {' +
+      'var Cu = Components.utils;' +
+      'Cu.import("resource://gre/modules/ctypes.jsm");' +
+      'var crash = function() {' +
+        'var zero = new ctypes.intptr_t(8);' +
+        'var badptr = ctypes.cast(zero, ctypes.PointerType(ctypes.int32_t));' +
+        'badptr.contents;' +
+      '};' +
+      'privateNoteIntentionalCrash();' +
+      'crash();' +
+    '}';
+  mm.loadFrameScript('data:,new ' + childFrameScriptStr, false);
+}
+
+function errorHandler(errMsg) {
+  ok(false, errMsg);
+  SimpleTest.finish();
+}
+
+function cbError(e) {
+  errorHandler("Error callback invoked: " + this.error.name);
+}
diff --git a/dom/ipc/tests/test_permission_when_oop_app_crashes.html b/dom/ipc/tests/test_permission_when_oop_app_crashes.html
new file mode 100644
index 000000000000..f1f5dd52bb4f
--- /dev/null
+++ b/dom/ipc/tests/test_permission_when_oop_app_crashes.html
@@ -0,0 +1,67 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1114507
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1114507</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank"
+  href="https://bugzilla.mozilla.org/show_bug.cgi?id=1114507">Mozilla Bug1114507</a>
+<p id="display"></p>
+<div id="container" style="display: none"></div>
+<script type="text/javascript" src="test_permission_helper.js"></script>
+<script type="application/javascript">
+// Put all the tests in order
+var tests = [
+  // Setup preferences and permissions
+  setupPrefsAndPermissions,
+
+  // ****************************************************
+  // Setup the enviroment for testing nested-oop cases: *
+  // test 3,4,5                                         *
+  // ****************************************************
+
+  // Install the app
+  installApp,
+
+  // Allow permission for embedApp to open mozbrowser and mozapp
+  function() {
+    var appId = gAppsService.getAppLocalIdByManifestURL(embedAppHostedManifestURL);
+    var context = { url: embedApp.origin,
+                    appId: appId,
+                    isInBrowserElement: false };
+    setupOpenAppPermission(context, runTests);
+  },
+
+  // +-----------------------------------------------+
+  // | Test 5: Open a test-target-app on 3rd level   |
+  // |         process then crash its parent-process |
+  // +-----------------------------------------------+
+  //
+  // level
+  //    1   chrome process
+  //              |
+  //    2   child process <-- crash this process
+  //              |
+  //    3   child process <-- app is here
+
+  // Add permission to app
+  function() {
+    addPermissionToApp(APP_URL, APP_MANIFEST);
+  },
+
+  test5,
+
+  uninstallApp
+
+];
+
+runTests();
+</script>
+</body>
+</html>
diff --git a/dom/media/tests/mochitest/templates.js b/dom/media/tests/mochitest/templates.js
index 6a5dc7dbfda6..0331b7cc14b2 100644
--- a/dom/media/tests/mochitest/templates.js
+++ b/dom/media/tests/mochitest/templates.js
@@ -137,7 +137,7 @@ var checkAllTrackStats = pc => {
 // renegotiation test.
 var commandsPeerConnectionInitial = [
   function PC_SETUP_SIGNALING_CLIENT(test) {
-    if (test.steeplechase) {
+    if (test.testOptions.steeplechase) {
       test.setupSignalingClient();
       test.registerSignalingCallback("ice_candidate", function (message) {
         var pc = test.pcRemote ? test.pcRemote : test.pcLocal;
@@ -215,21 +215,21 @@ var commandsPeerConnectionOfferAnswer = [
   },
 
   function PC_LOCAL_STEEPLECHASE_SIGNAL_EXPECTED_LOCAL_TRACKS(test) {
-    if (test.steeplechase) {
+    if (test.testOptions.steeplechase) {
       send_message({"type": "local_expected_tracks",
                     "expected_tracks": test.pcLocal.expectedLocalTrackInfoById});
     }
   },
 
   function PC_REMOTE_STEEPLECHASE_SIGNAL_EXPECTED_LOCAL_TRACKS(test) {
-    if (test.steeplechase) {
+    if (test.testOptions.steeplechase) {
       send_message({"type": "remote_expected_tracks",
                     "expected_tracks": test.pcRemote.expectedLocalTrackInfoById});
     }
   },
 
   function PC_LOCAL_GET_EXPECTED_REMOTE_TRACKS(test) {
-    if (test.steeplechase) {
+    if (test.testOptions.steeplechase) {
       return test.getSignalingMessage("remote_expected_tracks").then(
           message => {
             test.pcLocal.expectedRemoteTrackInfoById = message.expected_tracks;
@@ -242,7 +242,7 @@ var commandsPeerConnectionOfferAnswer = [
   },
 
   function PC_REMOTE_GET_EXPECTED_REMOTE_TRACKS(test) {
-    if (test.steeplechase) {
+    if (test.testOptions.steeplechase) {
       return test.getSignalingMessage("local_expected_tracks").then(
           message => {
             test.pcRemote.expectedRemoteTrackInfoById = message.expected_tracks;
@@ -262,7 +262,7 @@ var commandsPeerConnectionOfferAnswer = [
   },
 
   function PC_LOCAL_STEEPLECHASE_SIGNAL_OFFER(test) {
-    if (test.steeplechase) {
+    if (test.testOptions.steeplechase) {
       send_message({"type": "offer",
                     "offer": test.originalOffer,
                     "offer_constraints": test.pcLocal.constraints,
@@ -282,7 +282,7 @@ var commandsPeerConnectionOfferAnswer = [
   },
 
   function PC_REMOTE_GET_OFFER(test) {
-    if (!test.steeplechase) {
+    if (!test.testOptions.steeplechase) {
       test._local_offer = test.originalOffer;
       test._offer_constraints = test.pcLocal.constraints;
       test._offer_options = test.pcLocal.offerOptions;
@@ -324,7 +324,7 @@ var commandsPeerConnectionOfferAnswer = [
       .then(answer => {
         is(test.pcRemote.signalingState, HAVE_REMOTE_OFFER,
            "Remote createAnswer does not change signaling state");
-        if (test.steeplechase) {
+        if (test.testOptions.steeplechase) {
           send_message({"type": "answer",
                         "answer": test.originalAnswer,
                         "answer_constraints": test.pcRemote.constraints});
@@ -343,7 +343,7 @@ var commandsPeerConnectionOfferAnswer = [
   },
 
   function PC_LOCAL_GET_ANSWER(test) {
-    if (!test.steeplechase) {
+    if (!test.testOptions.steeplechase) {
       test._remote_answer = test.originalAnswer;
       test._answer_constraints = test.pcRemote.constraints;
       return Promise.resolve();
@@ -410,13 +410,13 @@ var commandsPeerConnectionOfferAnswer = [
 
   function PC_LOCAL_CHECK_STATS(test) {
     return test.pcLocal.getStats().then(stats => {
-      test.pcLocal.checkStats(stats, test.steeplechase);
+      test.pcLocal.checkStats(stats, test.testOptions.steeplechase);
     });
   },
 
   function PC_REMOTE_CHECK_STATS(test) {
     return test.pcRemote.getStats().then(stats => {
-      test.pcRemote.checkStats(stats, test.steeplechase);
+      test.pcRemote.checkStats(stats, test.testOptions.steeplechase);
     });
   },
 
diff --git a/dom/media/tests/mochitest/test_peerConnection_localReofferRollback.html b/dom/media/tests/mochitest/test_peerConnection_localReofferRollback.html
index 6dc9189305e6..9209fae45674 100644
--- a/dom/media/tests/mochitest/test_peerConnection_localReofferRollback.html
+++ b/dom/media/tests/mochitest/test_peerConnection_localReofferRollback.html
@@ -23,7 +23,7 @@
 
         function PC_REMOTE_SETUP_ICE_HANDLER(test) {
           test.pcRemote.setupIceCandidateHandler(test);
-          if (test.steeplechase) {
+          if (test.testOptions.steeplechase) {
             test.pcRemote.endOfTrickleIce.then(() => {
               send_message({"type": "end_of_trickle_ice"});
             });
diff --git a/dom/media/tests/mochitest/test_peerConnection_localRollback.html b/dom/media/tests/mochitest/test_peerConnection_localRollback.html
index 77eaf87d1aea..9271787087ec 100644
--- a/dom/media/tests/mochitest/test_peerConnection_localRollback.html
+++ b/dom/media/tests/mochitest/test_peerConnection_localRollback.html
@@ -36,7 +36,7 @@
 
         function PC_REMOTE_SETUP_ICE_HANDLER(test) {
           test.pcRemote.setupIceCandidateHandler(test);
-          if (test.steeplechase) {
+          if (test.testOptions.steeplechase) {
             test.pcRemote.endOfTrickleIce.then(() => {
               send_message({"type": "end_of_trickle_ice"});
               });
diff --git a/dom/media/tests/mochitest/test_peerConnection_remoteReofferRollback.html b/dom/media/tests/mochitest/test_peerConnection_remoteReofferRollback.html
index e1bea4adceef..d33e462062a5 100644
--- a/dom/media/tests/mochitest/test_peerConnection_remoteReofferRollback.html
+++ b/dom/media/tests/mochitest/test_peerConnection_remoteReofferRollback.html
@@ -27,7 +27,7 @@
       [
         function PC_LOCAL_SETUP_ICE_HANDLER(test) {
           test.pcLocal.setupIceCandidateHandler(test);
-          if (test.steeplechase) {
+          if (test.testOptions.steeplechase) {
             test.pcLocal.endOfTrickleIce.then(() => {
               send_message({"type": "end_of_trickle_ice"});
             });
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index 6fcfcc83bf52..bbe133e167b3 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -1706,7 +1706,7 @@ nsPluginInstanceOwner::HandleEvent(nsIDOMEvent* aEvent)
   }
   if (eventType.EqualsLiteral("MozPerformDelayedBlur")) {
     if (mShouldBlurOnActivate) {
-      WidgetGUIEvent blurEvent(true, NS_BLUR_CONTENT, nullptr);
+      WidgetGUIEvent blurEvent(true, eBlur, nullptr);
       ProcessEvent(blurEvent);
       mShouldBlurOnActivate = false;
     }
@@ -1749,8 +1749,7 @@ nsPluginInstanceOwner::HandleEvent(nsIDOMEvent* aEvent)
   if (dragEvent && mInstance) {
     WidgetEvent* ievent = aEvent->GetInternalNSEvent();
     if (ievent && ievent->mFlags.mIsTrusted &&
-        ievent->mMessage != NS_DRAGDROP_ENTER &&
-        ievent->mMessage != NS_DRAGDROP_OVER) {
+        ievent->mMessage != eDragEnter && ievent->mMessage != eDragOver) {
       aEvent->PreventDefault();
     }
 
@@ -1830,8 +1829,8 @@ CocoaEventTypeForEvent(const WidgetGUIEvent& anEvent, nsIFrame* aObjectFrame)
       return NPCocoaEventKeyDown;
     case eKeyUp:
       return NPCocoaEventKeyUp;
-    case NS_FOCUS_CONTENT:
-    case NS_BLUR_CONTENT:
+    case eFocus:
+    case eBlur:
       return NPCocoaEventFocusChanged;
     case NS_MOUSE_SCROLL:
       return NPCocoaEventScrollWheel;
@@ -1935,9 +1934,9 @@ TranslateToNPCocoaEvent(WidgetGUIEvent* anEvent, nsIFrame* aObjectFrame)
       }
       break;
     }
-    case NS_FOCUS_CONTENT:
-    case NS_BLUR_CONTENT:
-      cocoaEvent.data.focus.hasFocus = (anEvent->mMessage == NS_FOCUS_CONTENT);
+    case eFocus:
+    case eBlur:
+      cocoaEvent.data.focus.hasFocus = (anEvent->mMessage == eFocus);
       break;
     default:
       break;
@@ -1975,8 +1974,7 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
   // focus unless it lost focus within the window. For example, ignore a blur
   // event if it's coming due to the plugin's window deactivating.
   nsCOMPtr<nsIContent> content = do_QueryReferent(mContent);
-  if (anEvent.mMessage == NS_BLUR_CONTENT &&
-      ContentIsFocusedWithinWindow(content)) {
+  if (anEvent.mMessage == eBlur && ContentIsFocusedWithinWindow(content)) {
     mShouldBlurOnActivate = true;
     return nsEventStatus_eIgnore;
   }
@@ -1985,8 +1983,7 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
   // it focus. This might happen if it has focus, its window is blurred, then the
   // window is made active again. The plugin never lost in-window focus, so it
   // shouldn't get a focus event again.
-  if (anEvent.mMessage == NS_FOCUS_CONTENT &&
-      mLastContentFocused == true) {
+  if (anEvent.mMessage == eFocus && mLastContentFocused == true) {
     mShouldBlurOnActivate = false;
     return nsEventStatus_eIgnore;
   }
@@ -1994,9 +1991,8 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
   // Now, if we're going to send a focus event, update mLastContentFocused and
   // tell any plugins in our window that we have taken focus, so they should
   // perform any delayed blurs.
-  if (anEvent.mMessage == NS_FOCUS_CONTENT ||
-      anEvent.mMessage == NS_BLUR_CONTENT) {
-    mLastContentFocused = (anEvent.mMessage == NS_FOCUS_CONTENT);
+  if (anEvent.mMessage == eFocus || anEvent.mMessage == eBlur) {
+    mLastContentFocused = (anEvent.mMessage == eFocus);
     mShouldBlurOnActivate = false;
     PerformDelayedBlurs();
   }
@@ -2123,13 +2119,13 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
   }
   else if (!pPluginEvent) {
     switch (anEvent.mMessage) {
-      case NS_FOCUS_CONTENT:
+      case eFocus:
         pluginEvent.event = WM_SETFOCUS;
         pluginEvent.wParam = 0;
         pluginEvent.lParam = 0;
         pPluginEvent = &pluginEvent;
         break;
-      case NS_BLUR_CONTENT:
+      case eBlur:
         pluginEvent.event = WM_KILLFOCUS;
         pluginEvent.wParam = 0;
         pluginEvent.lParam = 0;
@@ -2322,12 +2318,11 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
 
     default:
       switch (anEvent.mMessage) {
-        case NS_FOCUS_CONTENT:
-        case NS_BLUR_CONTENT:
+        case eFocus:
+        case eBlur:
           {
             XFocusChangeEvent &event = pluginEvent.xfocus;
-            event.type =
-              anEvent.mMessage == NS_FOCUS_CONTENT ? FocusIn : FocusOut;
+            event.type = anEvent.mMessage == eFocus ? FocusIn : FocusOut;
             // information lost:
             event.mode = -1;
             event.detail = NotifyDetailNone;
diff --git a/dom/tests/mochitest/dom-level0/innerWidthHeight_script.html b/dom/tests/mochitest/dom-level0/innerWidthHeight_script.html
index df29c2ea4e5b..7406086ad77e 100644
--- a/dom/tests/mochitest/dom-level0/innerWidthHeight_script.html
+++ b/dom/tests/mochitest/dom-level0/innerWidthHeight_script.html
@@ -6,11 +6,6 @@
   <script class="testbody" type="text/javascript">
   function runSubTest()
   {
-    // Firefox doesn't support the metaviewport tag on desktop, so we force
-    // css viewport here using nsIDomWindowUtils
-    var cwu = SpecialPowers.getDOMWindowUtils(window);
-    cwu.setCSSViewport(320, 320);
-
     var oldWidth = window.innerWidth;
     var oldHeight = window.innerHeight;
 
diff --git a/dom/tests/mochitest/dom-level0/test_innerWidthHeight_script.html b/dom/tests/mochitest/dom-level0/test_innerWidthHeight_script.html
index 7d93ef070fcb..55b38b527085 100644
--- a/dom/tests/mochitest/dom-level0/test_innerWidthHeight_script.html
+++ b/dom/tests/mochitest/dom-level0/test_innerWidthHeight_script.html
@@ -23,7 +23,8 @@
   }
 
   function startTest() {
-    SpecialPowers.pushPrefEnv({"set": [["dom.disable_window_move_resize", false]]}, runTest);
+    SpecialPowers.pushPrefEnv({"set": [["dom.disable_window_move_resize", false],
+                                       ["dom.meta-viewport.enabled",      true ]]}, runTest);
   }
   </script>
 </body>
diff --git a/dom/xml/XMLDocument.cpp b/dom/xml/XMLDocument.cpp
index fed039bc4cf5..747414fff596 100644
--- a/dom/xml/XMLDocument.cpp
+++ b/dom/xml/XMLDocument.cpp
@@ -567,7 +567,7 @@ XMLDocument::EndLoad()
     // Generate a document load event for the case when an XML
     // document was loaded as pure data without any presentation
     // attached to it.
-    WidgetEvent event(true, NS_LOAD);
+    WidgetEvent event(true, eLoad);
     EventDispatcher::Dispatch(static_cast<nsIDocument*>(this), nullptr, &event);
   }
 }
diff --git a/dom/xul/nsXULElement.cpp b/dom/xul/nsXULElement.cpp
index 7ae3278012fa..3729c0185b8a 100644
--- a/dom/xul/nsXULElement.cpp
+++ b/dom/xul/nsXULElement.cpp
@@ -1269,8 +1269,8 @@ nsXULElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
          aVisitor.mEvent->mMessage == eMouseDoubleClick ||
          aVisitor.mEvent->mMessage == NS_XUL_COMMAND ||
          aVisitor.mEvent->mMessage == eContextMenu ||
-         aVisitor.mEvent->mMessage == NS_DRAGDROP_START ||
-         aVisitor.mEvent->mMessage == NS_DRAGDROP_GESTURE)) {
+         aVisitor.mEvent->mMessage == eDragStart ||
+         aVisitor.mEvent->mMessage == eLegacyDragGesture)) {
         // Don't propagate these events from native anonymous scrollbar.
         aVisitor.mCanHandle = true;
         aVisitor.mParentTarget = nullptr;
diff --git a/editor/libeditor/nsEditorEventListener.cpp b/editor/libeditor/nsEditorEventListener.cpp
index cc989f677ad3..d5a997101d2b 100644
--- a/editor/libeditor/nsEditorEventListener.cpp
+++ b/editor/libeditor/nsEditorEventListener.cpp
@@ -371,22 +371,22 @@ nsEditorEventListener::HandleEvent(nsIDOMEvent* aEvent)
   //       you don't need to check if the QI succeeded before each call.
   switch (internalEvent->mMessage) {
     // dragenter
-    case NS_DRAGDROP_ENTER: {
+    case eDragEnter: {
       nsCOMPtr<nsIDOMDragEvent> dragEvent = do_QueryInterface(aEvent);
       return DragEnter(dragEvent);
     }
     // dragover
-    case NS_DRAGDROP_OVER: {
+    case eDragOver: {
       nsCOMPtr<nsIDOMDragEvent> dragEvent = do_QueryInterface(aEvent);
       return DragOver(dragEvent);
     }
     // dragexit
-    case NS_DRAGDROP_EXIT: {
+    case eDragExit: {
       nsCOMPtr<nsIDOMDragEvent> dragEvent = do_QueryInterface(aEvent);
       return DragExit(dragEvent);
     }
     // drop
-    case NS_DRAGDROP_DROP: {
+    case eDrop: {
       nsCOMPtr<nsIDOMDragEvent> dragEvent = do_QueryInterface(aEvent);
       return Drop(dragEvent);
     }
@@ -454,10 +454,10 @@ nsEditorEventListener::HandleEvent(nsIDOMEvent* aEvent)
       return MouseClick(mouseEvent);
     }
     // focus
-    case NS_FOCUS_CONTENT:
+    case eFocus:
       return Focus(aEvent);
     // blur
-    case NS_BLUR_CONTENT:
+    case eBlur:
       return Blur(aEvent);
     // text
     case NS_COMPOSITION_CHANGE:
diff --git a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
index 2230531285e8..08f5b3882946 100644
--- a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
+++ b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
@@ -25775,7 +25775,7 @@ dialectic/SM
 dialectical
 dialectics/M
 dialing/S
-dialog/DG
+dialog/DGS
 dialogue/DRSMG
 dialyses
 dialysis/M
diff --git a/gfx/2d/Coord.h b/gfx/2d/Coord.h
index 90bbcbc8a291..201f59ce50b0 100644
--- a/gfx/2d/Coord.h
+++ b/gfx/2d/Coord.h
@@ -7,6 +7,7 @@
 #define MOZILLA_GFX_COORD_H_
 
 #include "mozilla/Attributes.h"
+#include "mozilla/TypeTraits.h" // For IsSame
 #include "Types.h"
 #include "BaseCoord.h"
 
@@ -19,7 +20,7 @@ template <typename> struct IsPixel;
 namespace gfx {
 
 template <class units> struct IntCoordTyped;
-template <class units> struct CoordTyped;
+template <class units, class F = Float> struct CoordTyped;
 
 // CommonType<coord, primitive> is a metafunction that returns the type of the
 // result of an arithmetic operation on the underlying type of a strongly-typed
@@ -37,9 +38,9 @@ struct CommonType<IntCoordTyped<units>, primitive> {
     typedef decltype(int32_t() + primitive()) type;
 };
 
-template <class units, class primitive>
-struct CommonType<CoordTyped<units>, primitive> {
-    typedef decltype(Float() + primitive()) type;
+template <class units, class F, class primitive>
+struct CommonType<CoordTyped<units, F>, primitive> {
+    typedef decltype(F() + primitive()) type;
 };
 
 // This is a base class that provides mixed-type operator overloads between
@@ -48,8 +49,15 @@ struct CommonType<CoordTyped<units>, primitive> {
 // convertible to their underlying value type. As we transition more of our code
 // to strongly-typed classes, we may be able to remove some or all of these
 // overloads.
-template <class coord, class primitive>
+
+template <bool B, class coord, class primitive>
 struct CoordOperatorsHelper {
+  // Using SFINAE (Substitution Failure Is Not An Error) to suppress redundant
+  // operators
+};
+
+template <class coord, class primitive>
+struct CoordOperatorsHelper<true, coord, primitive> {
   friend bool operator==(coord aA, primitive aB) {
     return aA.value == aB;
   }
@@ -95,8 +103,8 @@ struct CoordOperatorsHelper {
 template<class units>
 struct IntCoordTyped :
   public BaseCoord< int32_t, IntCoordTyped<units> >,
-  public CoordOperatorsHelper< IntCoordTyped<units>, float >,
-  public CoordOperatorsHelper< IntCoordTyped<units>, double > {
+  public CoordOperatorsHelper< true, IntCoordTyped<units>, float >,
+  public CoordOperatorsHelper< true, IntCoordTyped<units>, double > {
   static_assert(IsPixel<units>::value,
                 "'units' must be a coordinate system tag");
 
@@ -106,20 +114,21 @@ struct IntCoordTyped :
   MOZ_CONSTEXPR MOZ_IMPLICIT IntCoordTyped(int32_t aValue) : Super(aValue) {}
 };
 
-template<class units>
+template<class units, class F>
 struct CoordTyped :
-  public BaseCoord< Float, CoordTyped<units> >,
-  public CoordOperatorsHelper< CoordTyped<units>, int32_t >,
-  public CoordOperatorsHelper< CoordTyped<units>, uint32_t >,
-  public CoordOperatorsHelper< CoordTyped<units>, double > {
+  public BaseCoord< F, CoordTyped<units, F> >,
+  public CoordOperatorsHelper< !IsSame<F, int32_t>::value, CoordTyped<units, F>, int32_t >,
+  public CoordOperatorsHelper< !IsSame<F, uint32_t>::value, CoordTyped<units, F>, uint32_t >,
+  public CoordOperatorsHelper< !IsSame<F, double>::value, CoordTyped<units, F>, double >,
+  public CoordOperatorsHelper< !IsSame<F, float>::value, CoordTyped<units, F>, float > {
   static_assert(IsPixel<units>::value,
                 "'units' must be a coordinate system tag");
 
-  typedef BaseCoord< Float, CoordTyped<units> > Super;
+  typedef BaseCoord< F, CoordTyped<units, F> > Super;
 
   MOZ_CONSTEXPR CoordTyped() : Super() {}
-  MOZ_CONSTEXPR MOZ_IMPLICIT CoordTyped(Float aValue) : Super(aValue) {}
-  explicit MOZ_CONSTEXPR CoordTyped(const IntCoordTyped<units>& aCoord) : Super(float(aCoord.value)) {}
+  MOZ_CONSTEXPR MOZ_IMPLICIT CoordTyped(F aValue) : Super(aValue) {}
+  explicit MOZ_CONSTEXPR CoordTyped(const IntCoordTyped<units>& aCoord) : Super(F(aCoord.value)) {}
 
   void Round() {
     this->value = floor(this->value + 0.5);
diff --git a/gfx/2d/Matrix.cpp b/gfx/2d/Matrix.cpp
index fcfdef029d92..dc319bedcf86 100644
--- a/gfx/2d/Matrix.cpp
+++ b/gfx/2d/Matrix.cpp
@@ -144,12 +144,19 @@ Matrix::NudgeToIntegers()
   return *this;
 }
 
-Rect
-Matrix4x4::TransformBounds(const Rect& aRect) const
+template<class F>
+RectTyped<UnknownUnits, F>
+Matrix4x4::TransformBounds(const RectTyped<UnknownUnits, F>& aRect) const
 {
-  Point quad[4];
-  Float min_x, max_x;
-  Float min_y, max_y;
+  Point4DTyped<UnknownUnits, F> verts[4];
+  verts[0] = *this * Point4DTyped<UnknownUnits, F>(aRect.x, aRect.y, 0.0, 1.0);
+  verts[1] = *this * Point4DTyped<UnknownUnits, F>(aRect.XMost(), aRect.y, 0.0, 1.0);
+  verts[2] = *this * Point4DTyped<UnknownUnits, F>(aRect.XMost(), aRect.YMost(), 0.0, 1.0);
+  verts[3] = *this * Point4DTyped<UnknownUnits, F>(aRect.x, aRect.YMost(), 0.0, 1.0);
+
+  PointTyped<UnknownUnits, F> quad[4];
+  F min_x, max_x;
+  F min_y, max_y;
 
   quad[0] = *this * aRect.TopLeft();
   quad[1] = *this * aRect.TopRight();
@@ -175,7 +182,7 @@ Matrix4x4::TransformBounds(const Rect& aRect) const
     }
   }
 
-  return Rect(min_x, min_y, max_x - min_x, max_y - min_y);
+  return RectTyped<UnknownUnits, F>(min_x, min_y, max_x - min_x, max_y - min_y);
 }
 
 Point4D ComputePerspectivePlaneIntercept(const Point4D& aFirst,
@@ -272,26 +279,28 @@ Rect Matrix4x4::ProjectRectBounds(const Rect& aRect, const Rect &aClip) const
   return Rect(min_x, min_y, max_x - min_x, max_y - min_y);
 }
 
+template<class F>
 size_t
-Matrix4x4::TransformAndClipRect(const Rect& aRect, const Rect& aClip,
-                                Point* aVerts) const
+Matrix4x4::TransformAndClipRect(const RectTyped<UnknownUnits, F>& aRect,
+                                const RectTyped<UnknownUnits, F>& aClip,
+                                PointTyped<UnknownUnits, F>* aVerts) const
 {
   // Initialize a double-buffered array of points in homogenous space with
   // the input rectangle, aRect.
-  Point4D points[2][kTransformAndClipRectMaxVerts];
-  Point4D* dstPoint = points[0];
-  *dstPoint++ = *this * Point4D(aRect.x, aRect.y, 0, 1);
-  *dstPoint++ = *this * Point4D(aRect.XMost(), aRect.y, 0, 1);
-  *dstPoint++ = *this * Point4D(aRect.XMost(), aRect.YMost(), 0, 1);
-  *dstPoint++ = *this * Point4D(aRect.x, aRect.YMost(), 0, 1);
+  Point4DTyped<UnknownUnits, F> points[2][kTransformAndClipRectMaxVerts];
+  Point4DTyped<UnknownUnits, F>* dstPoint = points[0];
+  *dstPoint++ = *this * Point4DTyped<UnknownUnits, F>(aRect.x, aRect.y, 0, 1);
+  *dstPoint++ = *this * Point4DTyped<UnknownUnits, F>(aRect.XMost(), aRect.y, 0, 1);
+  *dstPoint++ = *this * Point4DTyped<UnknownUnits, F>(aRect.XMost(), aRect.YMost(), 0, 1);
+  *dstPoint++ = *this * Point4DTyped<UnknownUnits, F>(aRect.x, aRect.YMost(), 0, 1);
 
   // View frustum clipping planes are described as normals originating from
   // the 0,0,0,0 origin.
-  Point4D planeNormals[4];
-  planeNormals[0] = Point4D(1.0, 0.0, 0.0, -aClip.x);
-  planeNormals[1] = Point4D(-1.0, 0.0, 0.0, aClip.XMost());
-  planeNormals[2] = Point4D(0.0, 1.0, 0.0, -aClip.y);
-  planeNormals[3] = Point4D(0.0, -1.0, 0.0, aClip.YMost());
+  Point4DTyped<UnknownUnits, F> planeNormals[4];
+  planeNormals[0] = Point4DTyped<UnknownUnits, F>(1.0, 0.0, 0.0, -aClip.x);
+  planeNormals[1] = Point4DTyped<UnknownUnits, F>(-1.0, 0.0, 0.0, aClip.XMost());
+  planeNormals[2] = Point4DTyped<UnknownUnits, F>(0.0, 1.0, 0.0, -aClip.y);
+  planeNormals[3] = Point4DTyped<UnknownUnits, F>(0.0, -1.0, 0.0, aClip.YMost());
 
   // Iterate through each clipping plane and clip the polygon.
   // In each pass, we double buffer, alternating between points[0] and
@@ -299,19 +308,19 @@ Matrix4x4::TransformAndClipRect(const Rect& aRect, const Rect& aClip,
   for (int plane=0; plane < 4; plane++) {
     planeNormals[plane].Normalize();
 
-    Point4D* srcPoint = points[plane & 1];
-    Point4D* srcPointEnd = dstPoint;
+    Point4DTyped<UnknownUnits, F>* srcPoint = points[plane & 1];
+    Point4DTyped<UnknownUnits, F>* srcPointEnd = dstPoint;
     dstPoint = points[~plane & 1];
 
-    Point4D* prevPoint = srcPointEnd - 1;
-    float prevDot = planeNormals[plane].DotProduct(*prevPoint);
+    Point4DTyped<UnknownUnits, F>* prevPoint = srcPointEnd - 1;
+    F prevDot = planeNormals[plane].DotProduct(*prevPoint);
     while (srcPoint < srcPointEnd) {
-      float nextDot = planeNormals[plane].DotProduct(*srcPoint);
+      F nextDot = planeNormals[plane].DotProduct(*srcPoint);
 
       if ((nextDot >= 0.0) != (prevDot >= 0.0)) {
         // An intersection with the clipping plane has been detected.
         // Interpolate to find the intersecting point and emit it.
-        float t = -prevDot / (nextDot - prevDot);
+        F t = -prevDot / (nextDot - prevDot);
         *dstPoint++ = *srcPoint * t + *prevPoint * (1.0 - t);
       }
 
@@ -328,13 +337,13 @@ Matrix4x4::TransformAndClipRect(const Rect& aRect, const Rect& aClip,
 
   size_t dstPointCount = 0;
   size_t srcPointCount = dstPoint - points[0];
-  for (Point4D* srcPoint = points[0]; srcPoint < points[0] + srcPointCount; srcPoint++) {
+  for (Point4DTyped<UnknownUnits, F>* srcPoint = points[0]; srcPoint < points[0] + srcPointCount; srcPoint++) {
 
-    Point p;
+    PointTyped<UnknownUnits, F> p;
     if (srcPoint->w == 0.0) {
       // If a point lies on the intersection of the clipping planes at
       // (0,0,0,0), we must avoid a division by zero w component.
-      p = Point(0.0, 0.0);
+      p = PointTyped<UnknownUnits, F>(0.0, 0.0);
     } else {
       p = srcPoint->As2DPoint();
     }
@@ -571,5 +580,62 @@ Matrix4x4::GetNormalVector() const
   return ac.CrossProduct(ab);
 }
 
+template<class F>
+RectTyped<UnknownUnits, F>
+Matrix4x4::TransformAndClipBounds(const RectTyped<UnknownUnits, F>& aRect,
+                                  const RectTyped<UnknownUnits, F>& aClip) const
+{
+  PointTyped<UnknownUnits, F> verts[kTransformAndClipRectMaxVerts];
+  size_t vertCount = TransformAndClipRect(aRect, aClip, verts);
+
+  F min_x = std::numeric_limits<F>::max();
+  F min_y = std::numeric_limits<F>::max();
+  F max_x = -std::numeric_limits<F>::max();
+  F max_y = -std::numeric_limits<F>::max();
+  for (size_t i=0; i < vertCount; i++) {
+    min_x = std::min(min_x, verts[i].x);
+    max_x = std::max(max_x, verts[i].x);
+    min_y = std::min(min_y, verts[i].y);
+    max_y = std::max(max_y, verts[i].y);
+  }
+
+  if (max_x < min_x || max_y < min_y) {
+    return RectTyped<UnknownUnits, F>(0, 0, 0, 0);
+  }
+
+  return RectTyped<UnknownUnits, F>(min_x, min_y, max_x - min_x, max_y - min_y);
+
+}
+
+// Explicit template instantiation for float and double precision
+template
+size_t
+Matrix4x4::TransformAndClipRect(const Rect& aRect, const Rect& aClip,
+                                Point* aVerts) const;
+
+template
+size_t
+Matrix4x4::TransformAndClipRect(const RectDouble& aRect,
+                                const RectDouble& aClip,
+                                PointDouble* aVerts) const;
+
+template
+Rect
+Matrix4x4::TransformAndClipBounds(const Rect& aRect,
+                                  const Rect& aClip) const;
+
+template
+RectDouble
+Matrix4x4::TransformAndClipBounds(const RectDouble& aRect,
+                                  const RectDouble& aClip) const;
+
+template
+Rect
+Matrix4x4::TransformBounds(const Rect& aRect) const;
+
+template
+RectDouble
+Matrix4x4::TransformBounds(const RectDouble& aRect) const;
+
 } // namespace gfx
 } // namespace mozilla
diff --git a/gfx/2d/Matrix.h b/gfx/2d/Matrix.h
index 44f58702d6d2..c0decefd51f9 100644
--- a/gfx/2d/Matrix.h
+++ b/gfx/2d/Matrix.h
@@ -379,11 +379,18 @@ public:
   /**
    * Returns true if the matrix has any transform other
    * than a translation or scale; this is, if there is
-   * no rotation.
+   * rotation.
    */
   bool HasNonAxisAlignedTransform() const {
       return !FuzzyEqual(_21, 0.0) || !FuzzyEqual(_12, 0.0);
   }
+
+  /**
+   * Returns true if the matrix has negative scaling (i.e. flip).
+   */
+  bool HasNegativeScaling() const {
+      return (_11 < 0.0) || (_22 < 0.0);
+  }
 };
 
 class Matrix4x4
@@ -508,6 +515,13 @@ public:
 
   Rect ProjectRectBounds(const Rect& aRect, const Rect &aClip) const;
 
+  /**
+   * TransformAndClipBounds transforms aRect as a bounding box, while clipping
+   * the transformed bounds to the extents of aClip.
+   */
+  template<class F>
+  RectTyped<UnknownUnits, F> TransformAndClipBounds(const RectTyped<UnknownUnits, F>& aRect, const RectTyped<UnknownUnits, F>& aClip) const;
+
   /**
    * TransformAndClipRect projects a rectangle and clips against view frustum
    * clipping planes in homogenous space so that its projected vertices are
@@ -518,7 +532,10 @@ public:
    * emit fewer that 3 vertices, indicating that aRect will not be visible
    * within aClip.
    */
-  size_t TransformAndClipRect(const Rect& aRect, const Rect& aClip, Point* aVerts) const;
+  template<class F>
+  size_t TransformAndClipRect(const RectTyped<UnknownUnits, F>& aRect,
+                              const RectTyped<UnknownUnits, F>& aClip,
+                              PointTyped<UnknownUnits, F>* aVerts) const;
   static const size_t kTransformAndClipRectMaxVerts = 32;
 
   static Matrix4x4 From2D(const Matrix &aMatrix) {
@@ -547,9 +564,10 @@ public:
       return Point4D(x, y, z, w);
   }
 
-  Point4D operator *(const Point4D& aPoint) const
+  template<class F>
+  Point4DTyped<UnknownUnits, F> operator *(const Point4DTyped<UnknownUnits, F>& aPoint) const
   {
-    Point4D retPoint;
+    Point4DTyped<UnknownUnits, F> retPoint;
 
     retPoint.x = aPoint.x * _11 + aPoint.y * _21 + aPoint.z * _31 + _41;
     retPoint.y = aPoint.x * _12 + aPoint.y * _22 + aPoint.z * _32 + _42;
@@ -559,28 +577,30 @@ public:
     return retPoint;
   }
 
-  Point3D operator *(const Point3D& aPoint) const
+  template<class F>
+  Point3DTyped<UnknownUnits, F> operator *(const Point3DTyped<UnknownUnits, F>& aPoint) const
   {
-    Point4D temp(aPoint.x, aPoint.y, aPoint.z, 1);
+    Point4DTyped<UnknownUnits, F> temp(aPoint.x, aPoint.y, aPoint.z, 1);
 
     temp = *this * temp;
     temp /= temp.w;
 
-    return Point3D(temp.x, temp.y, temp.z);
+    return Point3DTyped<UnknownUnits, F>(temp.x, temp.y, temp.z);
   }
 
-  Point operator *(const Point &aPoint) const
+  template<class F>
+  PointTyped<UnknownUnits, F> operator *(const PointTyped<UnknownUnits, F> &aPoint) const
   {
-    Point4D temp(aPoint.x, aPoint.y, 0, 1);
+    Point4DTyped<UnknownUnits, F> temp(aPoint.x, aPoint.y, 0, 1);
 
     temp = *this * temp;
     temp /= temp.w;
 
-    return Point(temp.x, temp.y);
+    return PointTyped<UnknownUnits, F>(temp.x, temp.y);
   }
 
-  GFX2D_API Rect TransformBounds(const Rect& rect) const;
-
+  template<class F>
+  GFX2D_API RectTyped<UnknownUnits, F> TransformBounds(const RectTyped<UnknownUnits, F>& aRect) const;
 
   static Matrix4x4 Translation(Float aX, Float aY, Float aZ)
   {
diff --git a/gfx/2d/Point.h b/gfx/2d/Point.h
index 029b7f9cc8a5..6aacdf837b31 100644
--- a/gfx/2d/Point.h
+++ b/gfx/2d/Point.h
@@ -64,37 +64,38 @@ struct IntPointTyped :
 };
 typedef IntPointTyped<UnknownUnits> IntPoint;
 
-template<class units>
+template<class units, class F = Float>
 struct PointTyped :
-  public BasePoint< Float, PointTyped<units>, CoordTyped<units> >,
+  public BasePoint< F, PointTyped<units, F>, CoordTyped<units, F> >,
   public units {
   static_assert(IsPixel<units>::value,
                 "'units' must be a coordinate system tag");
 
-  typedef CoordTyped<units> Coord;
-  typedef BasePoint< Float, PointTyped<units>, CoordTyped<units> > Super;
+  typedef CoordTyped<units, F> Coord;
+  typedef BasePoint< F, PointTyped<units, F>, CoordTyped<units, F> > Super;
 
   MOZ_CONSTEXPR PointTyped() : Super() {}
-  MOZ_CONSTEXPR PointTyped(Float aX, Float aY) : Super(Coord(aX), Coord(aY)) {}
+  MOZ_CONSTEXPR PointTyped(F aX, F aY) : Super(Coord(aX), Coord(aY)) {}
   // The mixed-type constructors (Float, Coord) and (Coord, Float) are needed to
   // avoid ambiguities because Coord is implicitly convertible to Float.
-  MOZ_CONSTEXPR PointTyped(Float aX, Coord aY) : Super(Coord(aX), aY) {}
-  MOZ_CONSTEXPR PointTyped(Coord aX, Float aY) : Super(aX, Coord(aY)) {}
+  MOZ_CONSTEXPR PointTyped(F aX, Coord aY) : Super(Coord(aX), aY) {}
+  MOZ_CONSTEXPR PointTyped(Coord aX, F aY) : Super(aX, Coord(aY)) {}
   MOZ_CONSTEXPR PointTyped(Coord aX, Coord aY) : Super(aX.value, aY.value) {}
-  MOZ_CONSTEXPR MOZ_IMPLICIT PointTyped(const IntPointTyped<units>& point) : Super(float(point.x), float(point.y)) {}
+  MOZ_CONSTEXPR MOZ_IMPLICIT PointTyped(const IntPointTyped<units>& point) : Super(F(point.x), F(point.y)) {}
 
   // XXX When all of the code is ported, the following functions to convert to and from
   // unknown types should be removed.
 
-  static PointTyped<units> FromUnknownPoint(const PointTyped<UnknownUnits>& aPoint) {
-    return PointTyped<units>(aPoint.x, aPoint.y);
+  static PointTyped<units, F> FromUnknownPoint(const PointTyped<UnknownUnits, F>& aPoint) {
+    return PointTyped<units, F>(aPoint.x, aPoint.y);
   }
 
-  PointTyped<UnknownUnits> ToUnknownPoint() const {
-    return PointTyped<UnknownUnits>(this->x, this->y);
+  PointTyped<UnknownUnits, F> ToUnknownPoint() const {
+    return PointTyped<UnknownUnits, F>(this->x, this->y);
   }
 };
 typedef PointTyped<UnknownUnits> Point;
+typedef PointTyped<UnknownUnits, double> PointDouble;
 
 template<class units>
 IntPointTyped<units> RoundedToInt(const PointTyped<units>& aPoint) {
@@ -108,57 +109,59 @@ IntPointTyped<units> TruncatedToInt(const PointTyped<units>& aPoint) {
                               int32_t(aPoint.y));
 }
 
-template<class units>
+template<class units, class F = Float>
 struct Point3DTyped :
-  public BasePoint3D< Float, Point3DTyped<units> > {
+  public BasePoint3D< F, Point3DTyped<units, F> > {
   static_assert(IsPixel<units>::value,
                 "'units' must be a coordinate system tag");
 
-  typedef BasePoint3D< Float, Point3DTyped<units> > Super;
+  typedef BasePoint3D< F, Point3DTyped<units, F> > Super;
 
   Point3DTyped() : Super() {}
-  Point3DTyped(Float aX, Float aY, Float aZ) : Super(aX, aY, aZ) {}
+  Point3DTyped(F aX, F aY, F aZ) : Super(aX, aY, aZ) {}
 
   // XXX When all of the code is ported, the following functions to convert to and from
   // unknown types should be removed.
 
-  static Point3DTyped<units> FromUnknownPoint(const Point3DTyped<UnknownUnits>& aPoint) {
-    return Point3DTyped<units>(aPoint.x, aPoint.y, aPoint.z);
+  static Point3DTyped<units, F> FromUnknownPoint(const Point3DTyped<UnknownUnits, F>& aPoint) {
+    return Point3DTyped<units, F>(aPoint.x, aPoint.y, aPoint.z);
   }
 
-  Point3DTyped<UnknownUnits> ToUnknownPoint() const {
-    return Point3DTyped<UnknownUnits>(this->x, this->y, this->z);
+  Point3DTyped<UnknownUnits, F> ToUnknownPoint() const {
+    return Point3DTyped<UnknownUnits, F>(this->x, this->y, this->z);
   }
 };
 typedef Point3DTyped<UnknownUnits> Point3D;
+typedef Point3DTyped<UnknownUnits, double> PointDouble3D;
 
-template<class units>
+template<class units, class F = Float>
 struct Point4DTyped :
-  public BasePoint4D< Float, Point4DTyped<units> > {
+  public BasePoint4D< F, Point4DTyped<units, F> > {
   static_assert(IsPixel<units>::value,
                 "'units' must be a coordinate system tag");
 
-  typedef BasePoint4D< Float, Point4DTyped<units> > Super;
+  typedef BasePoint4D< F, Point4DTyped<units, F> > Super;
 
   Point4DTyped() : Super() {}
-  Point4DTyped(Float aX, Float aY, Float aZ, Float aW) : Super(aX, aY, aZ, aW) {}
+  Point4DTyped(F aX, F aY, F aZ, F aW) : Super(aX, aY, aZ, aW) {}
 
   // XXX When all of the code is ported, the following functions to convert to and from
   // unknown types should be removed.
 
-  static Point4DTyped<units> FromUnknownPoint(const Point4DTyped<UnknownUnits>& aPoint) {
-    return Point4DTyped<units>(aPoint.x, aPoint.y, aPoint.z, aPoint.w);
+  static Point4DTyped<units, F> FromUnknownPoint(const Point4DTyped<UnknownUnits, F>& aPoint) {
+    return Point4DTyped<units, F>(aPoint.x, aPoint.y, aPoint.z, aPoint.w);
   }
 
-  Point4DTyped<UnknownUnits> ToUnknownPoint() const {
-    return Point4DTyped<UnknownUnits>(this->x, this->y, this->z, this->w);
+  Point4DTyped<UnknownUnits, F> ToUnknownPoint() const {
+    return Point4DTyped<UnknownUnits, F>(this->x, this->y, this->z, this->w);
   }
 
-  PointTyped<units> As2DPoint() {
-    return PointTyped<units>(this->x / this->w, this->y / this->w);
+  PointTyped<units, F> As2DPoint() {
+    return PointTyped<units, F>(this->x / this->w, this->y / this->w);
   }
 };
 typedef Point4DTyped<UnknownUnits> Point4D;
+typedef Point4DTyped<UnknownUnits, double> PointDouble4D;
 
 template<class units>
 struct IntSizeTyped :
@@ -185,32 +188,33 @@ struct IntSizeTyped :
 };
 typedef IntSizeTyped<UnknownUnits> IntSize;
 
-template<class units>
+template<class units, class F = Float>
 struct SizeTyped :
-  public BaseSize< Float, SizeTyped<units> >,
+  public BaseSize< F, SizeTyped<units> >,
   public units {
   static_assert(IsPixel<units>::value,
                 "'units' must be a coordinate system tag");
 
-  typedef BaseSize< Float, SizeTyped<units> > Super;
+  typedef BaseSize< F, SizeTyped<units, F> > Super;
 
   MOZ_CONSTEXPR SizeTyped() : Super() {}
-  MOZ_CONSTEXPR SizeTyped(Float aWidth, Float aHeight) : Super(aWidth, aHeight) {}
+  MOZ_CONSTEXPR SizeTyped(F aWidth, F aHeight) : Super(aWidth, aHeight) {}
   explicit SizeTyped(const IntSizeTyped<units>& size) :
-    Super(float(size.width), float(size.height)) {}
+    Super(F(size.width), F(size.height)) {}
 
   // XXX When all of the code is ported, the following functions to convert to and from
   // unknown types should be removed.
 
-  static SizeTyped<units> FromUnknownSize(const SizeTyped<UnknownUnits>& aSize) {
-    return SizeTyped<units>(aSize.width, aSize.height);
+  static SizeTyped<units, F> FromUnknownSize(const SizeTyped<UnknownUnits, F>& aSize) {
+    return SizeTyped<units, F>(aSize.width, aSize.height);
   }
 
-  SizeTyped<UnknownUnits> ToUnknownSize() const {
-    return SizeTyped<UnknownUnits>(this->width, this->height);
+  SizeTyped<UnknownUnits, F> ToUnknownSize() const {
+    return SizeTyped<UnknownUnits, F>(this->width, this->height);
   }
 };
 typedef SizeTyped<UnknownUnits> Size;
+typedef SizeTyped<UnknownUnits, double> SizeDouble;
 
 template<class units>
 IntSizeTyped<units> RoundedToInt(const SizeTyped<units>& aSize) {
diff --git a/gfx/2d/Rect.h b/gfx/2d/Rect.h
index 6bce59ce559a..2cce1655f994 100644
--- a/gfx/2d/Rect.h
+++ b/gfx/2d/Rect.h
@@ -35,23 +35,24 @@ struct IntMarginTyped:
 };
 typedef IntMarginTyped<UnknownUnits> IntMargin;
 
-template<class units>
+template<class units, class F = Float>
 struct MarginTyped:
-    public BaseMargin<Float, MarginTyped<units> >,
+    public BaseMargin<F, MarginTyped<units> >,
     public units {
     static_assert(IsPixel<units>::value,
                   "'units' must be a coordinate system tag");
 
-    typedef BaseMargin<Float, MarginTyped<units> > Super;
+    typedef BaseMargin<F, MarginTyped<units, F> > Super;
 
     MarginTyped() : Super() {}
-    MarginTyped(Float aTop, Float aRight, Float aBottom, Float aLeft) :
+    MarginTyped(F aTop, F aRight, F aBottom, F aLeft) :
         Super(aTop, aRight, aBottom, aLeft) {}
     explicit MarginTyped(const IntMarginTyped<units>& aMargin) :
-        Super(float(aMargin.top), float(aMargin.right),
-              float(aMargin.bottom), float(aMargin.left)) {}
+        Super(F(aMargin.top), F(aMargin.right),
+              F(aMargin.bottom), F(aMargin.left)) {}
 };
 typedef MarginTyped<UnknownUnits> Margin;
+typedef MarginTyped<UnknownUnits, double> MarginDouble;
 
 template<class units>
 IntMarginTyped<units> RoundedToInt(const MarginTyped<units>& aMargin)
@@ -124,23 +125,39 @@ struct IntRectTyped :
 };
 typedef IntRectTyped<UnknownUnits> IntRect;
 
-template<class units>
+template<class units, class F = Float>
 struct RectTyped :
-    public BaseRect<Float, RectTyped<units>, PointTyped<units>, SizeTyped<units>, MarginTyped<units> >,
+    public BaseRect<F, RectTyped<units, F>, PointTyped<units, F>, SizeTyped<units, F>, MarginTyped<units, F> >,
     public units {
     static_assert(IsPixel<units>::value,
                   "'units' must be a coordinate system tag");
 
-    typedef BaseRect<Float, RectTyped<units>, PointTyped<units>, SizeTyped<units>, MarginTyped<units> > Super;
+    typedef BaseRect<F, RectTyped<units, F>, PointTyped<units, F>, SizeTyped<units, F>, MarginTyped<units, F> > Super;
 
     RectTyped() : Super() {}
-    RectTyped(const PointTyped<units>& aPos, const SizeTyped<units>& aSize) :
+    RectTyped(const PointTyped<units, F>& aPos, const SizeTyped<units, F>& aSize) :
         Super(aPos, aSize) {}
-    RectTyped(Float _x, Float _y, Float _width, Float _height) :
+    RectTyped(F _x, F _y, F _width, F _height) :
         Super(_x, _y, _width, _height) {}
     explicit RectTyped(const IntRectTyped<units>& rect) :
-        Super(float(rect.x), float(rect.y),
-              float(rect.width), float(rect.height)) {}
+        Super(F(rect.x), F(rect.y),
+              F(rect.width), F(rect.height)) {}
+
+    // Returns the largest rectangle that can be represented with 32-bit
+    // signed integers, centered around a point at 0,0.  As BaseRect's represent
+    // the dimensions as a top-left point with a width and height, the width
+    // and height will be the largest positive 32-bit value.  The top-left
+    // position coordinate is divided by two to center the rectangle around a
+    // point at 0,0.
+    static RectTyped<units, F> MaxIntRect()
+    {
+      return RectTyped<units, F>(
+        -std::numeric_limits<int32_t>::max() * 0.5,
+        -std::numeric_limits<int32_t>::max() * 0.5,
+        std::numeric_limits<int32_t>::max(),
+        std::numeric_limits<int32_t>::max()
+      );
+    };
 
     void NudgeToIntegers()
     {
@@ -154,29 +171,30 @@ struct RectTyped :
     {
       *aOut = IntRectTyped<units>(int32_t(this->X()), int32_t(this->Y()),
                                   int32_t(this->Width()), int32_t(this->Height()));
-      return RectTyped<units>(Float(aOut->x), Float(aOut->y), 
-                              Float(aOut->width), Float(aOut->height))
+      return RectTyped<units>(F(aOut->x), F(aOut->y),
+                              F(aOut->width), F(aOut->height))
              .IsEqualEdges(*this);
     }
 
     // XXX When all of the code is ported, the following functions to convert to and from
     // unknown types should be removed.
 
-    static RectTyped<units> FromUnknownRect(const RectTyped<UnknownUnits>& rect) {
-        return RectTyped<units>(rect.x, rect.y, rect.width, rect.height);
+    static RectTyped<units, F> FromUnknownRect(const RectTyped<UnknownUnits, F>& rect) {
+        return RectTyped<units, F>(rect.x, rect.y, rect.width, rect.height);
     }
 
-    RectTyped<UnknownUnits> ToUnknownRect() const {
-        return RectTyped<UnknownUnits>(this->x, this->y, this->width, this->height);
+    RectTyped<UnknownUnits, F> ToUnknownRect() const {
+        return RectTyped<UnknownUnits, F>(this->x, this->y, this->width, this->height);
     }
 
     // This is here only to keep IPDL-generated code happy. DO NOT USE.
-    bool operator==(const RectTyped<units>& aRect) const
+    bool operator==(const RectTyped<units, F>& aRect) const
     {
-      return RectTyped<units>::IsEqualEdges(aRect);
+      return RectTyped<units, F>::IsEqualEdges(aRect);
     }
 };
 typedef RectTyped<UnknownUnits> Rect;
+typedef RectTyped<UnknownUnits, double> RectDouble;
 
 template<class units>
 IntRectTyped<units> RoundedToInt(const RectTyped<units>& aRect)
diff --git a/gfx/ipc/GfxMessageUtils.h b/gfx/ipc/GfxMessageUtils.h
index 9a5a0dbaaf12..79c7e47074c3 100644
--- a/gfx/ipc/GfxMessageUtils.h
+++ b/gfx/ipc/GfxMessageUtils.h
@@ -527,10 +527,10 @@ struct ParamTraits< mozilla::gfx::PointTyped<T> >
   }
 };
 
-template<class T>
-struct ParamTraits< mozilla::gfx::Point3DTyped<T> >
+template<class F, class T>
+struct ParamTraits< mozilla::gfx::Point3DTyped<F, T> >
 {
-  typedef mozilla::gfx::Point3DTyped<T> paramType;
+  typedef mozilla::gfx::Point3DTyped<F, T> paramType;
 
   static void Write(Message* msg, const paramType& param)
   {
diff --git a/gfx/layers/LayerTreeInvalidation.cpp b/gfx/layers/LayerTreeInvalidation.cpp
index b0d5cc6d593f..d7d59dadf9a9 100644
--- a/gfx/layers/LayerTreeInvalidation.cpp
+++ b/gfx/layers/LayerTreeInvalidation.cpp
@@ -43,7 +43,7 @@ TransformRect(const IntRect& aRect, const Matrix4x4& aTransform)
   }
 
   Rect rect(aRect.x, aRect.y, aRect.width, aRect.height);
-  rect = aTransform.TransformBounds(rect);
+  rect = aTransform.TransformAndClipBounds(rect, Rect::MaxIntRect());
   rect.RoundOut();
 
   IntRect intRect;
diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index 1ca4cd452a07..27f691c084f7 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -165,12 +165,12 @@ LayerManager::CreatePersistentBufferProvider(const mozilla::gfx::IntSize &aSize,
                                              mozilla::gfx::SurfaceFormat aFormat)
 {
   RefPtr<PersistentBufferProviderBasic> bufferProvider =
-    new PersistentBufferProviderBasic(this, aSize, aFormat,
+    new PersistentBufferProviderBasic(aSize, aFormat,
                                       gfxPlatform::GetPlatform()->GetPreferredCanvasBackend());
 
   if (!bufferProvider->IsValid()) {
     bufferProvider =
-      new PersistentBufferProviderBasic(this, aSize, aFormat,
+      new PersistentBufferProviderBasic(aSize, aFormat,
                                         gfxPlatform::GetPlatform()->GetFallbackCanvasBackend());
   }
 
@@ -1224,12 +1224,30 @@ ContainerLayer::DefaultComputeEffectiveTransforms(const Matrix4x4& aTransformToS
     } else {
       useIntermediateSurface = false;
       gfx::Matrix contTransform;
-      if (!mEffectiveTransform.Is2D(&contTransform) ||
+      bool checkClipRect = false;
+      bool checkMaskLayers = false;
+
+      if (!mEffectiveTransform.Is2D(&contTransform)) {
+        // In 3D case, always check if we should use IntermediateSurface.
+        checkClipRect = true;
+        checkMaskLayers = true;
+      } else {
 #ifdef MOZ_GFX_OPTIMIZE_MOBILE
-        !contTransform.PreservesAxisAlignedRectangles()) {
+        if (!contTransform.PreservesAxisAlignedRectangles()) {
 #else
-        gfx::ThebesMatrix(contTransform).HasNonIntegerTranslation()) {
+        if (gfx::ThebesMatrix(contTransform).HasNonIntegerTranslation()) {
 #endif
+          checkClipRect = true;
+        }
+        /* In 2D case, only translation and/or positive scaling can be done w/o using IntermediateSurface.
+         * Otherwise, when rotation or flip happen, we should check whether to use IntermediateSurface.
+         */
+        if (contTransform.HasNonAxisAlignedTransform() || contTransform.HasNegativeScaling()) {
+          checkMaskLayers = true;
+        }
+      }
+
+      if (checkClipRect || checkMaskLayers) {
         for (Layer* child = GetFirstChild(); child; child = child->GetNextSibling()) {
           const Maybe<ParentLayerIntRect>& clipRect = child->GetEffectiveClipRect();
           /* We can't (easily) forward our transform to children with a non-empty clip
@@ -1237,8 +1255,11 @@ ContainerLayer::DefaultComputeEffectiveTransforms(const Matrix4x4& aTransformToS
            * the calculations performed by CalculateScissorRect above.
            * Nor for a child with a mask layer.
            */
-          if ((clipRect && !clipRect->IsEmpty() && !child->GetVisibleRegion().IsEmpty()) ||
-              child->HasMaskLayers()) {
+          if (checkClipRect && (clipRect && !clipRect->IsEmpty() && !child->GetVisibleRegion().IsEmpty())) {
+            useIntermediateSurface = true;
+            break;
+          }
+          if (checkMaskLayers && child->HasMaskLayers()) {
             useIntermediateSurface = true;
             break;
           }
diff --git a/gfx/layers/LayersLogging.h b/gfx/layers/LayersLogging.h
index 1e621e46139d..1904876384e0 100644
--- a/gfx/layers/LayersLogging.h
+++ b/gfx/layers/LayersLogging.h
@@ -21,7 +21,7 @@ struct gfxRGBA;
 namespace mozilla {
 namespace gfx {
 class Matrix4x4;
-template <class units> struct RectTyped;
+template <class units, class F> struct RectTyped;
 } // namespace gfx
 
 enum class ImageFormat;
diff --git a/gfx/layers/PersistentBufferProvider.cpp b/gfx/layers/PersistentBufferProvider.cpp
index 368921bf07ac..ec3e0600c247 100644
--- a/gfx/layers/PersistentBufferProvider.cpp
+++ b/gfx/layers/PersistentBufferProvider.cpp
@@ -16,8 +16,8 @@ using namespace gfx;
 
 namespace layers {
 
-PersistentBufferProviderBasic::PersistentBufferProviderBasic(LayerManager* aManager, gfx::IntSize aSize,
-                                                             gfx::SurfaceFormat aFormat, gfx::BackendType aBackend)
+PersistentBufferProviderBasic::PersistentBufferProviderBasic(gfx::IntSize aSize, gfx::SurfaceFormat aFormat,
+                                                             gfx::BackendType aBackend)
 {
   mDrawTarget = gfxPlatform::GetPlatform()->CreateDrawTargetForBackend(aBackend, aSize, aFormat);
 }
diff --git a/gfx/layers/PersistentBufferProvider.h b/gfx/layers/PersistentBufferProvider.h
index 97f0e4257dac..35835b7e9459 100644
--- a/gfx/layers/PersistentBufferProvider.h
+++ b/gfx/layers/PersistentBufferProvider.h
@@ -57,8 +57,8 @@ class PersistentBufferProviderBasic : public PersistentBufferProvider
 public:
   MOZ_DECLARE_REFCOUNTED_VIRTUAL_TYPENAME(PersistentBufferProviderBasic)
 
-  PersistentBufferProviderBasic(LayerManager* aManager, gfx::IntSize aSize,
-                                gfx::SurfaceFormat aFormat, gfx::BackendType aBackend);
+  PersistentBufferProviderBasic(gfx::IntSize aSize, gfx::SurfaceFormat aFormat,
+                                gfx::BackendType aBackend);
   explicit PersistentBufferProviderBasic(gfx::DrawTarget* aTarget) : mDrawTarget(aTarget) {}
 
   bool IsValid() { return !!mDrawTarget; }
diff --git a/gfx/layers/apz/src/APZCTreeManager.cpp b/gfx/layers/apz/src/APZCTreeManager.cpp
index 7c54322fc1be..9834710f8ead 100644
--- a/gfx/layers/apz/src/APZCTreeManager.cpp
+++ b/gfx/layers/apz/src/APZCTreeManager.cpp
@@ -875,7 +875,7 @@ APZCTreeManager::UpdateWheelTransaction(WidgetInputEvent& aEvent)
 
   switch (aEvent.mMessage) {
    case eMouseMove:
-   case NS_DRAGDROP_OVER: {
+   case eDragOver: {
      WidgetMouseEvent* mouseEvent = aEvent.AsMouseEvent();
      if (!mouseEvent->IsReal()) {
        return;
@@ -894,7 +894,7 @@ APZCTreeManager::UpdateWheelTransaction(WidgetInputEvent& aEvent)
    case eMouseDoubleClick:
    case eMouseClick:
    case eContextMenu:
-   case NS_DRAGDROP_DROP:
+   case eDrop:
      txn->EndTransaction();
      return;
    default:
diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index c327763a5754..e37c5e09a876 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -358,12 +358,7 @@ BasicCompositor::DrawQuad(const gfx::Rect& aRect,
     dest->SetTransform(Matrix::Translation(-aRect.x, -aRect.y));
 
     // Get the bounds post-transform.
-    new3DTransform = aTransform;
-    gfxRect bounds = ThebesRect(aRect);
-    bounds.TransformBounds(new3DTransform);
-    bounds.IntersectRect(bounds, gfxRect(offset.x, offset.y, buffer->GetSize().width, buffer->GetSize().height));
-
-    transformBounds = ToRect(bounds);
+    transformBounds = aTransform.TransformAndClipBounds(aRect, Rect(offset.x, offset.y, buffer->GetSize().width, buffer->GetSize().height));
     transformBounds.RoundOut();
 
     // Propagate the coordinate offset to our 2D draw target.
@@ -371,7 +366,7 @@ BasicCompositor::DrawQuad(const gfx::Rect& aRect,
 
     // When we apply the 3D transformation, we do it against a temporary
     // surface, so undo the coordinate offset.
-    new3DTransform = Matrix4x4::Translation(aRect.x, aRect.y, 0) * new3DTransform;
+    new3DTransform = Matrix4x4::Translation(aRect.x, aRect.y, 0) * aTransform;
   }
 
   newTransform.PostTranslate(-offset.x, -offset.y);
diff --git a/gfx/layers/basic/BasicLayerManager.cpp b/gfx/layers/basic/BasicLayerManager.cpp
index 6aaf2f85b4e1..0341da8bff88 100644
--- a/gfx/layers/basic/BasicLayerManager.cpp
+++ b/gfx/layers/basic/BasicLayerManager.cpp
@@ -761,14 +761,12 @@ Transform3D(RefPtr<SourceSurface> aSource,
             const Matrix4x4& aTransform,
             gfxRect& aDestRect)
 {
-  // Find the transformed rectangle of our layer.
-  gfxRect offsetRect = aBounds;
-  offsetRect.TransformBounds(aTransform);
-
-  // Intersect the transformed layer with the destination rectangle.
+  // Find the transformed rectangle of our layer, intersected with the
+  // destination rectangle.
   // This is in device space since we have an identity transform set on aTarget.
-  aDestRect = aDest->GetClipExtents();
-  aDestRect.IntersectRect(aDestRect, offsetRect);
+  aDestRect = ThebesRect(aTransform.TransformAndClipBounds(
+                ToRectDouble(aBounds),
+                ToRectDouble(aDest->GetClipExtents())));
   aDestRect.RoundOut();
 
   // Create a surface the size of the transformed object.
diff --git a/gfx/layers/composite/LayerManagerComposite.cpp b/gfx/layers/composite/LayerManagerComposite.cpp
index f218bf2969b5..34032824b0b8 100644
--- a/gfx/layers/composite/LayerManagerComposite.cpp
+++ b/gfx/layers/composite/LayerManagerComposite.cpp
@@ -1019,7 +1019,8 @@ SubtractTransformedRegion(nsIntRegion& aRegion,
   // subtract it from the screen region.
   nsIntRegionRectIterator it(aRegionToSubtract);
   while (const IntRect* rect = it.Next()) {
-    Rect incompleteRect = aTransform.TransformBounds(ToRect(*rect));
+    Rect incompleteRect = aTransform.TransformAndClipBounds(ToRect(*rect),
+                                                            Rect::MaxIntRect());
     aRegion.Sub(aRegion, IntRect(incompleteRect.x,
                                    incompleteRect.y,
                                    incompleteRect.width,
diff --git a/gfx/layers/composite/LayerManagerComposite.h b/gfx/layers/composite/LayerManagerComposite.h
index 98c19bb200e8..ca83ff2e0f3d 100644
--- a/gfx/layers/composite/LayerManagerComposite.h
+++ b/gfx/layers/composite/LayerManagerComposite.h
@@ -554,7 +554,7 @@ RenderWithAllMasks(Layer* aLayer, Compositor* aCompositor,
   gfx::Matrix4x4 transform = aLayer->GetEffectiveTransform();
   // TODO: Use RenderTargetIntRect and TransformTo<...> here
   gfx::IntRect surfaceRect =
-    RoundedOut(transform.TransformBounds(visibleRect)).Intersect(aClipRect);
+    RoundedOut(transform.TransformAndClipBounds(visibleRect, gfx::Rect(aClipRect)));
   if (surfaceRect.IsEmpty()) {
     return;
   }
diff --git a/gfx/layers/opengl/CompositorOGL.cpp b/gfx/layers/opengl/CompositorOGL.cpp
index c74556f539cf..eb5c01d4734f 100644
--- a/gfx/layers/opengl/CompositorOGL.cpp
+++ b/gfx/layers/opengl/CompositorOGL.cpp
@@ -987,7 +987,7 @@ CompositorOGL::DrawQuad(const Rect& aRect,
 
   // XXX: This doesn't handle 3D transforms. It also doesn't handled rotated
   //      quads. Fix me.
-  Rect destRect = aTransform.TransformBounds(aRect);
+  Rect destRect = aTransform.TransformAndClipBounds(aRect, aClipRect);
   mPixelsFilled += destRect.width * destRect.height;
 
   IntPoint offset = mCurrentRenderTarget->GetOrigin();
diff --git a/gfx/src/nsRegion.cpp b/gfx/src/nsRegion.cpp
index 08b788319416..7006094bced0 100644
--- a/gfx/src/nsRegion.cpp
+++ b/gfx/src/nsRegion.cpp
@@ -612,12 +612,12 @@ TransformRect(const mozilla::gfx::IntRect& aRect, const mozilla::gfx::Matrix4x4&
         return mozilla::gfx::IntRect();
     }
 
-    gfxRect rect(aRect.x, aRect.y, aRect.width, aRect.height);
-    rect.TransformBounds(aTransform);
+    mozilla::gfx::RectDouble rect(aRect.x, aRect.y, aRect.width, aRect.height);
+    rect = aTransform.TransformAndClipBounds(rect, mozilla::gfx::RectDouble::MaxIntRect());
     rect.RoundOut();
 
     mozilla::gfx::IntRect intRect;
-    if (!gfxUtils::GfxRectToIntRect(rect, &intRect)) {
+    if (!gfxUtils::GfxRectToIntRect(ThebesRect(rect), &intRect)) {
         return mozilla::gfx::IntRect();
     }
 
diff --git a/gfx/tests/reftest/1149923-ref.html b/gfx/tests/reftest/1149923-ref.html
new file mode 100644
index 000000000000..46625a786da2
--- /dev/null
+++ b/gfx/tests/reftest/1149923-ref.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+
+  <head>
+    <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1">
+    <meta charset="utf-8">
+    <title>Testcase for bug 1149923</title>
+    <style>
+      #outer {
+        width: 64px;
+        height: 64px;
+        background-color: #00f;
+        opacity: 1.0;
+        transform: rotate(90deg);
+      }
+      #inner {
+        width: 100%;
+        height: 100%;
+        background-color: #f00;
+        border-top-left-radius: 10%;
+        border-bottom-left-radius: 10%;
+      }
+    </style>
+  </head>
+  <body>
+    <div id='outer'><div id='inner'></div></div>
+  </body>
+</html>
diff --git a/gfx/tests/reftest/1149923.html b/gfx/tests/reftest/1149923.html
new file mode 100644
index 000000000000..ec5f777ad340
--- /dev/null
+++ b/gfx/tests/reftest/1149923.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+
+  <head>
+    <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1">
+    <meta charset="utf-8">
+    <title>Testcase for bug 1149923</title>
+    <style>
+      #outer {
+        width: 64px;
+        height: 64px;
+        background-color: #00f;
+        opacity: 1.0;
+        transform: rotate(90deg);
+      }
+      #inner {
+        width: 100%;
+        height: 100%;
+        background-color: #f00;
+        will-change: transform;
+        border-top-left-radius: 10%;
+        border-bottom-left-radius: 10%;
+      }
+    </style>
+  </head>
+  <body>
+    <div id='outer'><div id='inner'></div></div>
+  </body>
+</html>
diff --git a/gfx/tests/reftest/reftest.list b/gfx/tests/reftest/reftest.list
index 836f23f156ab..9ef61564b23b 100644
--- a/gfx/tests/reftest/reftest.list
+++ b/gfx/tests/reftest/reftest.list
@@ -5,3 +5,4 @@ skip-if(B2G) fuzzy-if(Android&&AndroidVersion>=15,8,1000) == 709477-1.html 70947
 skip-if(!asyncPan) == 1086723.html 1086723-ref.html
 == 853889-1.html 853889-1-ref.html
 == 1143303-1.svg pass.svg
+fuzzy(30,30) == 1149923.html 1149923-ref.html # use fuzzy due to few distorted pixels caused by border-radius
\ No newline at end of file
diff --git a/gfx/thebes/gfx2DGlue.h b/gfx/thebes/gfx2DGlue.h
index 7d8e68dfe653..0654aa2cb6d8 100644
--- a/gfx/thebes/gfx2DGlue.h
+++ b/gfx/thebes/gfx2DGlue.h
@@ -24,6 +24,11 @@ inline Rect ToRect(const gfxRect &aRect)
               Float(aRect.width), Float(aRect.height));
 }
 
+inline RectDouble ToRectDouble(const gfxRect &aRect)
+{
+  return RectDouble(aRect.x, aRect.y, aRect.width, aRect.height);
+}
+
 inline Rect ToRect(const IntRect &aRect)
 {
   return Rect(aRect.x, aRect.y, aRect.width, aRect.height);
@@ -143,6 +148,11 @@ inline gfxRect ThebesRect(const Rect &aRect)
   return gfxRect(aRect.x, aRect.y, aRect.width, aRect.height);
 }
 
+inline gfxRect ThebesRect(const RectDouble &aRect)
+{
+  return gfxRect(aRect.x, aRect.y, aRect.width, aRect.height);
+}
+
 inline gfxRGBA ThebesRGBA(const Color &aColor)
 {
   return gfxRGBA(aColor.r, aColor.g, aColor.b, aColor.a);
diff --git a/gfx/thebes/gfxFontEntry.cpp b/gfx/thebes/gfxFontEntry.cpp
index 4b4155546680..7f734e9c34aa 100644
--- a/gfx/thebes/gfxFontEntry.cpp
+++ b/gfx/thebes/gfxFontEntry.cpp
@@ -1338,9 +1338,9 @@ gfxFontFamily::FindAllFontsForStyle(const gfxFontStyle& aFontStyle,
 
     uint32_t minDistance = 0xffffffff;
     gfxFontEntry* matched = nullptr;
-    // iterate in reverse order so that the last-defined font is the first one
-    // in the fontlist used for matching, as per CSS Fonts spec
-    for (int32_t i = count - 1; i >= 0; i--) {
+    // iterate in forward order so that faces like 'Bold' are matched before
+    // matching style distance faces such as 'Bold Outline' (see bug 1185812)
+    for (uint32_t i = 0; i < count; i++) {
         fe = mAvailableFonts[i];
         uint32_t distance =
             WeightDistance(aFontStyle.weight, fe->Weight()) +
diff --git a/gfx/thebes/gfxFontInfoLoader.cpp b/gfx/thebes/gfxFontInfoLoader.cpp
index 3b33725495c0..90d18f6f1c20 100644
--- a/gfx/thebes/gfxFontInfoLoader.cpp
+++ b/gfx/thebes/gfxFontInfoLoader.cpp
@@ -26,7 +26,14 @@ FontInfoData::Load()
     uint32_t i, n = mFontFamiliesToLoad.Length();
     mLoadStats.families = n;
     for (i = 0; i < n; i++) {
-        LoadFontFamilyData(mFontFamiliesToLoad[i]);
+        // font file memory mapping sometimes causes exceptions - bug 1100949
+        MOZ_SEH_TRY {
+            LoadFontFamilyData(mFontFamiliesToLoad[i]);
+        } MOZ_SEH_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {
+            gfxCriticalError() <<
+                "Exception occurred reading font data for " <<
+                NS_ConvertUTF16toUTF8(mFontFamiliesToLoad[i]).get();
+        }
     }
 
     mLoadTime = TimeStamp::Now() - start;
diff --git a/gfx/thebes/gfxRect.cpp b/gfx/thebes/gfxRect.cpp
index a3b39fc6f2aa..a418f394e913 100644
--- a/gfx/thebes/gfxRect.cpp
+++ b/gfx/thebes/gfxRect.cpp
@@ -30,36 +30,6 @@ gfxRect::TransformToQuad(const mozilla::gfx::Matrix4x4 &aMatrix) const
   return gfxQuad(points[0], points[1], points[2], points[3]);
 }
 
-void
-gfxRect::TransformBounds(const mozilla::gfx::Matrix4x4 &aMatrix)
-{
-  gfxPoint quad[4];
-
-  quad[0] = TopLeft();
-  quad[1] = TopRight();
-  quad[2] = BottomLeft();
-  quad[3] = BottomRight();
-
-  quad[0].Transform(aMatrix);
-  double min_x = quad[0].x;
-  double max_x = quad[0].x;
-  double min_y = quad[0].y;
-  double max_y = quad[0].y;
-
-  for (int i=1; i<4; i++) {
-    quad[i].Transform(aMatrix);
-    min_x = std::min(quad[i].x, min_x);
-    max_x = std::max(quad[i].x, max_x);
-    min_y = std::min(quad[i].y, min_y);
-    max_y = std::max(quad[i].y, max_y);
-  }
-
-  x = min_x;
-  y = min_y;
-  width = max_x - min_x;
-  height = max_y - min_y;
-}
-
 static bool
 WithinEpsilonOfInteger(gfxFloat aX, gfxFloat aEpsilon)
 {
diff --git a/gfx/thebes/gfxRect.h b/gfx/thebes/gfxRect.h
index 78f0998768e2..d5045c51ec4c 100644
--- a/gfx/thebes/gfxRect.h
+++ b/gfx/thebes/gfxRect.h
@@ -150,11 +150,6 @@ struct gfxRect :
      * Transform this rectangle with aMatrix, resulting in a gfxQuad.
      */
     gfxQuad TransformToQuad(const mozilla::gfx::Matrix4x4 &aMatrix) const;
-
-    /*
-     * Transform this rectangle with aMatrix, as an axis-aligned bounding box
-     */
-    void TransformBounds(const mozilla::gfx::Matrix4x4 &aMatrix);
 };
 
 #endif /* GFX_RECT_H */
diff --git a/gfx/thebes/gfxUserFontSet.h b/gfx/thebes/gfxUserFontSet.h
index 3ae4872c0f1a..a090edecbb5c 100644
--- a/gfx/thebes/gfxUserFontSet.h
+++ b/gfx/thebes/gfxUserFontSet.h
@@ -140,7 +140,9 @@ public:
         nsRefPtr<gfxFontEntry> fe = aFontEntry;
         // remove existing entry, if already present
         mAvailableFonts.RemoveElement(aFontEntry);
-        mAvailableFonts.AppendElement(aFontEntry);
+        // insert at the beginning so that the last-defined font is the first
+        // one in the fontlist used for matching, as per CSS Fonts spec
+        mAvailableFonts.InsertElementAt(0, aFontEntry);
 
         if (aFontEntry->mFamilyName.IsEmpty()) {
             aFontEntry->mFamilyName = Name();
diff --git a/image/ImageFactory.cpp b/image/ImageFactory.cpp
index 92ff7b674274..75a51eadd4c9 100644
--- a/image/ImageFactory.cpp
+++ b/image/ImageFactory.cpp
@@ -35,9 +35,8 @@ ImageFactory::Initialize()
 static bool
 ShouldDownscaleDuringDecode(const nsCString& aMimeType)
 {
-  return aMimeType.EqualsLiteral(IMAGE_JPEG) ||
-         aMimeType.EqualsLiteral(IMAGE_JPG) ||
-         aMimeType.EqualsLiteral(IMAGE_PJPEG);
+  DecoderType type = DecoderFactory::GetDecoderType(aMimeType.get());
+  return type == DecoderType::JPEG || type == DecoderType::PNG;
 }
 
 static uint32_t
diff --git a/image/ProgressTracker.cpp b/image/ProgressTracker.cpp
index b0a76a762ece..65e8d39435dc 100644
--- a/image/ProgressTracker.cpp
+++ b/image/ProgressTracker.cpp
@@ -441,13 +441,14 @@ void
 ProgressTracker::AddObserver(IProgressObserver* aObserver)
 {
   MOZ_ASSERT(NS_IsMainThread());
+  nsRefPtr<IProgressObserver> observer = aObserver;
 
   mObservers.Write([=](ObserverTable* aTable) {
-    MOZ_ASSERT(!aTable->Get(aObserver, nullptr),
+    MOZ_ASSERT(!aTable->Get(observer, nullptr),
                "Adding duplicate entry for image observer");
 
-    WeakPtr<IProgressObserver> weakPtr = aObserver;
-    aTable->Put(aObserver, weakPtr);
+    WeakPtr<IProgressObserver> weakPtr = observer.get();
+    aTable->Put(observer, weakPtr);
   });
 }
 
@@ -455,11 +456,12 @@ bool
 ProgressTracker::RemoveObserver(IProgressObserver* aObserver)
 {
   MOZ_ASSERT(NS_IsMainThread());
+  nsRefPtr<IProgressObserver> observer = aObserver;
 
   // Remove the observer from the list.
   bool removed = mObservers.Write([=](ObserverTable* aTable) {
-    bool removed = aTable->Get(aObserver, nullptr);
-    aTable->Remove(aObserver);
+    bool removed = aTable->Get(observer, nullptr);
+    aTable->Remove(observer);
     return removed;
   });
 
diff --git a/image/RasterImage.cpp b/image/RasterImage.cpp
index b10238bfb062..f8e67dbd0c18 100644
--- a/image/RasterImage.cpp
+++ b/image/RasterImage.cpp
@@ -1601,6 +1601,7 @@ RasterImage::CanDownscaleDuringDecode(const IntSize& aSize, uint32_t aFlags)
   // image, we have all the source data and know our size, the flags allow us to
   // do it, and a 'good' filter is being used.
   if (!mDownscaleDuringDecode || !mHasSize ||
+      !gfxPrefs::ImageHQDownscalingEnabled() ||
       !(aFlags & imgIContainer::FLAG_HIGH_QUALITY_SCALING)) {
     return false;
   }
diff --git a/image/decoders/nsPNGDecoder.cpp b/image/decoders/nsPNGDecoder.cpp
index 47412d937677..caf7c2025373 100644
--- a/image/decoders/nsPNGDecoder.cpp
+++ b/image/decoders/nsPNGDecoder.cpp
@@ -141,6 +141,20 @@ nsPNGDecoder::~nsPNGDecoder()
   }
 }
 
+nsresult
+nsPNGDecoder::SetTargetSize(const nsIntSize& aSize)
+{
+  // Make sure the size is reasonable.
+  if (MOZ_UNLIKELY(aSize.width <= 0 || aSize.height <= 0)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  // Create a downscaler that we'll filter our output through.
+  mDownscaler.emplace(aSize);
+
+  return NS_OK;
+}
+
 void
 nsPNGDecoder::CheckForTransparency(SurfaceFormat aFormat,
                                    const IntRect& aFrameRect)
@@ -174,7 +188,16 @@ nsPNGDecoder::CreateFrame(png_uint_32 aXOffset, png_uint_32 aYOffset,
     format = gfx::SurfaceFormat::B8G8R8A8;
   }
 
-  nsresult rv = AllocateFrame(mNumFrames, GetSize(), frameRect, format);
+  // Make sure there's no animation or padding if we're downscaling.
+  MOZ_ASSERT_IF(mDownscaler, !GetImageMetadata().HasAnimation());
+  MOZ_ASSERT_IF(mDownscaler,
+                IntRect(IntPoint(), GetSize()).IsEqualEdges(frameRect));
+
+  IntSize targetSize = mDownscaler ? mDownscaler->TargetSize()
+                                   : GetSize();
+  IntRect targetFrameRect = mDownscaler ? IntRect(IntPoint(), targetSize)
+                                        : frameRect;
+  nsresult rv = AllocateFrame(mNumFrames, targetSize, targetFrameRect, format);
   if (NS_FAILED(rv)) {
     return rv;
   }
@@ -198,6 +221,14 @@ nsPNGDecoder::CreateFrame(png_uint_32 aXOffset, png_uint_32 aYOffset,
   }
 #endif
 
+  if (mDownscaler) {
+    bool hasAlpha = aFormat != SurfaceFormat::B8G8R8X8;
+    rv = mDownscaler->BeginFrame(frameRect.Size(), mImageData, hasAlpha);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+  }
+
   return NS_OK;
 }
 
@@ -593,6 +624,12 @@ nsPNGDecoder::info_callback(png_structp png_ptr, png_infop info_ptr)
   bool isAnimated = png_get_valid(png_ptr, info_ptr, PNG_INFO_acTL);
   if (isAnimated) {
     decoder->PostIsAnimated(GetNextFrameDelay(png_ptr, info_ptr));
+
+    if (decoder->mDownscaler && !decoder->IsFirstFrameDecode()) {
+      MOZ_ASSERT_UNREACHABLE("Doing downscale-during-decode "
+                             "for an animated image?");
+      decoder->mDownscaler.reset();
+    }
   }
 #endif
 
@@ -645,6 +682,33 @@ nsPNGDecoder::info_callback(png_structp png_ptr, png_infop info_ptr)
   }
 }
 
+void
+nsPNGDecoder::PostPartialInvalidation(const IntRect& aInvalidRegion)
+{
+  if (!mDownscaler) {
+    PostInvalidation(aInvalidRegion);
+    return;
+  }
+
+  if (!mDownscaler->HasInvalidation()) {
+    return;
+  }
+
+  DownscalerInvalidRect invalidRect = mDownscaler->TakeInvalidRect();
+  PostInvalidation(invalidRect.mOriginalSizeRect,
+                   Some(invalidRect.mTargetSizeRect));
+}
+
+void
+nsPNGDecoder::PostFullInvalidation()
+{
+  PostInvalidation(mFrameRect);
+
+  if (mDownscaler) {
+    mDownscaler->ResetForNextProgressivePass();
+  }
+}
+
 void
 nsPNGDecoder::row_callback(png_structp png_ptr, png_bytep new_row,
                            png_uint_32 row_num, int pass)
@@ -688,7 +752,12 @@ nsPNGDecoder::row_callback(png_structp png_ptr, png_bytep new_row,
     return;
   }
 
-  if (new_row) {
+  // If |new_row| is null, that indicates that this is an interlaced image and
+  // |row_callback| is being called for a row that hasn't changed.  Ordinarily
+  // we don't need to do anything in this case, but if we're downscaling, the
+  // downscaler doesn't store the rows from previous passes, so we still need to
+  // process the row.
+  if (new_row || decoder->mDownscaler) {
     int32_t width = decoder->mFrameRect.width;
     uint32_t iwidth = decoder->mFrameRect.width;
 
@@ -699,7 +768,9 @@ nsPNGDecoder::row_callback(png_structp png_ptr, png_bytep new_row,
     }
 
     uint32_t bpr = width * sizeof(uint32_t);
-    uint32_t* cptr32 = (uint32_t*)(decoder->mImageData + (row_num*bpr));
+    uint32_t* cptr32 = decoder->mDownscaler
+      ? reinterpret_cast<uint32_t*>(decoder->mDownscaler->RowBuffer())
+      : reinterpret_cast<uint32_t*>(decoder->mImageData + (row_num*bpr));
 
     if (decoder->mTransform) {
       if (decoder->mCMSLine) {
@@ -763,14 +834,17 @@ nsPNGDecoder::row_callback(png_structp png_ptr, png_bytep new_row,
         png_longjmp(decoder->mPNG, 1);
     }
 
+    if (decoder->mDownscaler) {
+      decoder->mDownscaler->CommitRow();
+    }
+
     if (!decoder->interlacebuf) {
-      // Do line-by-line partial invalidations for non-interlaced images
-      decoder->PostInvalidation(IntRect(0, row_num, width, 1));
+      // Do line-by-line partial invalidations for non-interlaced images.
+      decoder->PostPartialInvalidation(IntRect(0, row_num, width, 1));
     } else if (row_num ==
                static_cast<png_uint_32>(decoder->mFrameRect.height - 1)) {
-      // Do only one full image invalidation for each pass (Bug 1187569)
-      decoder->PostInvalidation(IntRect(0, 0, width,
-                                decoder->mFrameRect.height));
+      // Do only one full image invalidation for each pass. (Bug 1187569)
+      decoder->PostFullInvalidation();
     }
   }
 }
diff --git a/image/decoders/nsPNGDecoder.h b/image/decoders/nsPNGDecoder.h
index fce64d1f1eed..c2b46dd4b9f1 100644
--- a/image/decoders/nsPNGDecoder.h
+++ b/image/decoders/nsPNGDecoder.h
@@ -8,6 +8,7 @@
 #define mozilla_image_decoders_nsPNGDecoder_h
 
 #include "Decoder.h"
+#include "Downscaler.h"
 
 #include "gfxTypes.h"
 
@@ -26,6 +27,8 @@ class nsPNGDecoder : public Decoder
 public:
   virtual ~nsPNGDecoder();
 
+  virtual nsresult SetTargetSize(const nsIntSize& aSize) override;
+
   virtual void InitInternal() override;
   virtual void WriteInternal(const char* aBuffer, uint32_t aCount) override;
   virtual Telemetry::ID SpeedHistogram() override;
@@ -77,8 +80,12 @@ private:
   // XXX(seth): nsICODecoder is temporarily an exception to this rule.
   explicit nsPNGDecoder(RasterImage* aImage);
 
+  void PostPartialInvalidation(const IntRect& aInvalidRegion);
+  void PostFullInvalidation();
+
 public:
   png_structp mPNG;
+  Maybe<Downscaler> mDownscaler;
   png_infop mInfo;
   nsIntRect mFrameRect;
   uint8_t* mCMSLine;
diff --git a/image/test/reftest/downscaling/downscale-png.html b/image/test/reftest/downscaling/downscale-png.html
new file mode 100644
index 000000000000..4752b2155a0b
--- /dev/null
+++ b/image/test/reftest/downscaling/downscale-png.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html reftest-zoom="1.0" class="reftest-wait">
+<head>
+  <script>
+    function snapshot() {
+      document.documentElement.removeAttribute('class');
+    }
+  </script>
+</head>
+<!-- NOTE: Using setTimeout to wait for high-quality downscaled version of
+     image to be ready, because there's nothing better we can do. If we fix
+     Bug 1006883, we can do away with this setTimeout.
+
+     For now, the setTimeout is just here to increase the likelihood that we
+     actually test the high-quality downscaled version of the image. If the
+     setTimeout happens to fire before the high-quality downscaled rendering is
+     ready, then this the test will pass without testing what it's trying to
+     test, which is fine as long as that's rare.  -->
+<body style="margin: 0px" onload="setTimeout(snapshot, 50)">
+  <script>
+    var args = location.search.substring(1).split(',');
+    var image = document.createElement('img');
+    image.width = args[0];
+    image.height = args[1];
+    image.src = 'png-' + args[2] + '.png';
+    document.body.appendChild(image);
+  </script>
+</body>
+</html>
diff --git a/image/test/reftest/downscaling/png-interlaced.png b/image/test/reftest/downscaling/png-interlaced.png
new file mode 100644
index 000000000000..a938d0bd6a93
Binary files /dev/null and b/image/test/reftest/downscaling/png-interlaced.png differ
diff --git a/image/test/reftest/downscaling/png-normal.png b/image/test/reftest/downscaling/png-normal.png
new file mode 100644
index 000000000000..c2780fdd9374
Binary files /dev/null and b/image/test/reftest/downscaling/png-normal.png differ
diff --git a/image/test/reftest/downscaling/reftest.list b/image/test/reftest/downscaling/reftest.list
index 9ae235e4443a..e241985a6f21 100644
--- a/image/test/reftest/downscaling/reftest.list
+++ b/image/test/reftest/downscaling/reftest.list
@@ -87,6 +87,9 @@ fuzzy(20,999) != downscale-2c.html?205,53,bottom about:blank
 fuzzy(20,999) != downscale-2d.html?205,53,bottom about:blank
 fuzzy(20,999) fails-if(OSX>=1008) != downscale-2e.html?205,53,bottom about:blank
 
+== downscale-png.html?16,16,interlaced downscale-png.html?16,16,normal
+== downscale-png.html?24,24,interlaced downscale-png.html?24,24,normal
+
 # RUN TESTS WITH HIGH QUALITY DOWNSCALING ENABLED:
 # ================================================
 # High-quality downscaling enabled:
@@ -149,3 +152,6 @@ fuzzy(20,999) != downscale-2c.html?205,53,bottom about:blank
 fuzzy(20,999) != downscale-2d.html?205,53,bottom about:blank
 fuzzy(20,999) != downscale-2e.html?205,53,bottom about:blank
 fuzzy(20,999) != downscale-2f.html?205,53,bottom about:blank
+
+== downscale-png.html?16,16,interlaced downscale-png.html?16,16,normal
+== downscale-png.html?24,24,interlaced downscale-png.html?24,24,normal
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index b9baf8af705f..f8711d381ddd 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -6208,6 +6208,52 @@ Parser<ParseHandler>::debuggerStatement()
     return handler.newDebuggerStatement(p);
 }
 
+static JSOp
+JSOpFromPropertyType(PropertyType propType)
+{
+    switch (propType) {
+      case PropertyType::Getter:
+        return JSOP_INITPROP_GETTER;
+      case PropertyType::Setter:
+        return JSOP_INITPROP_SETTER;
+      case PropertyType::Normal:
+      case PropertyType::Method:
+      case PropertyType::GeneratorMethod:
+      case PropertyType::Constructor:
+      case PropertyType::DerivedConstructor:
+        return JSOP_INITPROP;
+      default:
+        MOZ_CRASH("unexpected property type");
+    }
+}
+
+static FunctionSyntaxKind
+FunctionSyntaxKindFromPropertyType(PropertyType propType)
+{
+    switch (propType) {
+      case PropertyType::Getter:
+        return Getter;
+      case PropertyType::Setter:
+        return Setter;
+      case PropertyType::Method:
+        return Method;
+      case PropertyType::GeneratorMethod:
+        return Method;
+      case PropertyType::Constructor:
+        return ClassConstructor;
+      case PropertyType::DerivedConstructor:
+        return DerivedClassConstructor;
+      default:
+        MOZ_CRASH("unexpected property type");
+    }
+}
+
+static GeneratorKind
+GeneratorKindFromPropertyType(PropertyType propType)
+{
+    return propType == PropertyType::GeneratorMethod ? StarGenerator : NotGenerator;
+}
+
 template <>
 ParseNode*
 Parser<FullParseHandler>::classDefinition(YieldHandling yieldHandling,
@@ -6251,6 +6297,8 @@ Parser<FullParseHandler>::classDefinition(YieldHandling yieldHandling,
 
     ParseNode* classBlock = null();
 
+    RootedAtom propAtom(context);
+
     // A named class creates a new lexical scope with a const binding of the
     // class name.
     Maybe<AutoPushStmtInfoPC> classStmt;
@@ -6280,10 +6328,94 @@ Parser<FullParseHandler>::classDefinition(YieldHandling yieldHandling,
 
     MUST_MATCH_TOKEN(TOK_LC, JSMSG_CURLY_BEFORE_CLASS);
 
-    ParseNode* classMethods = propertyList(yieldHandling,
-                                           hasHeritage ? DerivedClassBody : ClassBody);
-    if (!classMethods)
+    ParseNode* classMethods = handler.newClassMethodList(pos().begin);
+
+    bool seenConstructor = false;
+    for (;;) {
+        TokenKind tt;
+        if (!tokenStream.getToken(&tt, TokenStream::KeywordIsName))
+            return null();
+        if (tt == TOK_RC)
+            break;
+
+        if (tt == TOK_SEMI)
+            continue;
+
+        bool isStatic = false;
+        if (tt == TOK_NAME && tokenStream.currentName() == context->names().static_) {
+            if (!tokenStream.peekToken(&tt, TokenStream::KeywordIsName))
+                return null();
+            if (tt != TOK_LP) {
+                isStatic = true;
+            } else {
+                tokenStream.addModifierException(TokenStream::NoneIsKeywordIsName);
+                tokenStream.ungetToken();
+            }
+        } else {
+            tokenStream.ungetToken();
+        }
+
+        PropertyType propType;
+        ParseNode* propName = propertyName(yieldHandling, classMethods, &propType, &propAtom);
+        if (!propName)
+            return null();
+
+        if (propType != PropertyType::Getter && propType != PropertyType::Setter &&
+            propType != PropertyType::Method && propType != PropertyType::GeneratorMethod &&
+            propType != PropertyType::Constructor && propType != PropertyType::DerivedConstructor)
+        {
+            report(ParseError, false, null(), JSMSG_BAD_METHOD_DEF);
+            return null();
+        }
+
+        if (!isStatic && propAtom == context->names().constructor) {
+            if (propType != PropertyType::Method) {
+                report(ParseError, false, propName, JSMSG_BAD_METHOD_DEF);
+                return null();
+            }
+            if (seenConstructor) {
+                report(ParseError, false, propName, JSMSG_DUPLICATE_PROPERTY, "constructor");
+                return null();
+            }
+            seenConstructor = true;
+            propType = hasHeritage ? PropertyType::DerivedConstructor : PropertyType::Constructor;
+        } else if (isStatic && propAtom == context->names().prototype) {
+            report(ParseError, false, propName, JSMSG_BAD_METHOD_DEF);
+            return null();
+        }
+
+        // FIXME: Implement ES6 function "name" property semantics
+        // (bug 883377).
+        RootedPropertyName funName(context);
+        switch (propType) {
+          case PropertyType::Getter:
+          case PropertyType::Setter:
+            funName = nullptr;
+            break;
+          case PropertyType::Constructor:
+          case PropertyType::DerivedConstructor:
+            funName = name;
+            break;
+          default:
+            if (tokenStream.isCurrentTokenType(TOK_NAME))
+                funName = tokenStream.currentName();
+            else
+                funName = nullptr;
+        }
+        ParseNode* fn = methodDefinition(yieldHandling, propType, funName);
+        if (!fn)
+            return null();
+
+        JSOp op = JSOpFromPropertyType(propType);
+        if (!handler.addClassMethodDefinition(classMethods, propName, fn, op, isStatic))
+            return null();
+    }
+
+    // Default constructors not yet implemented. See bug 1105463
+    if (!seenConstructor) {
+        report(ParseError, false, null(), JSMSG_NO_CLASS_CONSTRUCTOR);
         return null();
+    }
 
     ParseNode* nameNode = null();
     ParseNode* methodsOrBlock = classMethods;
@@ -8523,6 +8655,151 @@ DoubleToAtom(ExclusiveContext* cx, double value)
     return ToAtom<CanGC>(cx, HandleValue::fromMarkedLocation(&tmp));
 }
 
+template <typename ParseHandler>
+typename ParseHandler::Node
+Parser<ParseHandler>::propertyName(YieldHandling yieldHandling, Node propList,
+                                   PropertyType* propType, MutableHandleAtom propAtom)
+{
+    TokenKind ltok;
+    if (!tokenStream.getToken(&ltok, TokenStream::KeywordIsName))
+        return null();
+
+    // TOK_RC should be handled in caller.
+    MOZ_ASSERT(ltok != TOK_RC);
+
+    bool isGenerator = false;
+    if (ltok == TOK_MUL) {
+        isGenerator = true;
+        if (!tokenStream.getToken(&ltok, TokenStream::KeywordIsName))
+            return null();
+    }
+
+    propAtom.set(nullptr);
+    Node propName;
+    switch (ltok) {
+      case TOK_NUMBER:
+        propAtom.set(DoubleToAtom(context, tokenStream.currentToken().number()));
+        if (!propAtom.get())
+            return null();
+        propName = newNumber(tokenStream.currentToken());
+        if (!propName)
+            return null();
+        break;
+
+      case TOK_LB:
+        propName = computedPropertyName(yieldHandling, propList);
+        if (!propName)
+            return null();
+        break;
+
+      case TOK_NAME: {
+        propAtom.set(tokenStream.currentName());
+        // Do not look for accessor syntax on generators
+        if (isGenerator ||
+            !(propAtom.get() == context->names().get ||
+              propAtom.get() == context->names().set))
+        {
+            propName = handler.newObjectLiteralPropertyName(propAtom, pos());
+            if (!propName)
+                return null();
+            break;
+        }
+
+        *propType = propAtom.get() == context->names().get ? PropertyType::Getter
+                                                           : PropertyType::Setter;
+
+        // We have parsed |get| or |set|. Look for an accessor property
+        // name next.
+        TokenKind tt;
+        if (!tokenStream.getToken(&tt, TokenStream::KeywordIsName))
+            return null();
+        if (tt == TOK_NAME) {
+            propAtom.set(tokenStream.currentName());
+            return handler.newObjectLiteralPropertyName(propAtom, pos());
+        }
+        if (tt == TOK_STRING) {
+            propAtom.set(tokenStream.currentToken().atom());
+
+            uint32_t index;
+            if (propAtom->isIndex(&index)) {
+                propAtom.set(DoubleToAtom(context, index));
+                if (!propAtom.get())
+                    return null();
+                return handler.newNumber(index, NoDecimal, pos());
+            }
+            return stringLiteral();
+        }
+        if (tt == TOK_NUMBER) {
+            propAtom.set(DoubleToAtom(context, tokenStream.currentToken().number()));
+            if (!propAtom.get())
+                return null();
+            return newNumber(tokenStream.currentToken());
+        }
+        if (tt == TOK_LB)
+            return computedPropertyName(yieldHandling, propList);
+
+        // Not an accessor property after all.
+        tokenStream.ungetToken();
+        propName = handler.newObjectLiteralPropertyName(propAtom.get(), pos());
+        if (!propName)
+            return null();
+        tokenStream.addModifierException(TokenStream::NoneIsKeywordIsName);
+        break;
+      }
+
+      case TOK_STRING: {
+        propAtom.set(tokenStream.currentToken().atom());
+        uint32_t index;
+        if (propAtom->isIndex(&index)) {
+            propName = handler.newNumber(index, NoDecimal, pos());
+            if (!propName)
+                return null();
+            break;
+        }
+        propName = stringLiteral();
+        if (!propName)
+            return null();
+        break;
+      }
+
+      default:
+        report(ParseError, false, null(), JSMSG_BAD_PROP_ID);
+        return null();
+    }
+
+    TokenKind tt;
+    if (!tokenStream.getToken(&tt))
+        return null();
+
+    if (tt == TOK_COLON) {
+        if (isGenerator) {
+            report(ParseError, false, null(), JSMSG_BAD_PROP_ID);
+            return null();
+        }
+        *propType = PropertyType::Normal;
+        return propName;
+    }
+
+    if (ltok == TOK_NAME && (tt == TOK_COMMA || tt == TOK_RC)) {
+        if (isGenerator) {
+            report(ParseError, false, null(), JSMSG_BAD_PROP_ID);
+            return null();
+        }
+        tokenStream.ungetToken();
+        *propType = PropertyType::Shorthand;
+        return propName;
+    }
+
+    if (tt == TOK_LP) {
+        tokenStream.ungetToken();
+        *propType = isGenerator ? PropertyType::GeneratorMethod : PropertyType::Method;
+        return propName;
+    }
+
+    report(ParseError, false, null(), JSMSG_COLON_AFTER_ID);
+    return null();
+}
+
 template <typename ParseHandler>
 typename ParseHandler::Node
 Parser<ParseHandler>::computedPropertyName(YieldHandling yieldHandling, Node literal)
@@ -8550,335 +8827,119 @@ Parser<ParseHandler>::computedPropertyName(YieldHandling yieldHandling, Node lit
 
 template <typename ParseHandler>
 typename ParseHandler::Node
-Parser<ParseHandler>::newPropertyListNode(PropListType type)
+Parser<ParseHandler>::objectLiteral(YieldHandling yieldHandling)
 {
-    if (IsClassBody(type))
-        return handler.newClassMethodList(pos().begin);
+    MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_LC));
 
-    MOZ_ASSERT(type == ObjectLiteral);
-    return handler.newObjectLiteral(pos().begin);
+    Node literal = handler.newObjectLiteral(pos().begin);
+    if (!literal)
+        return null();
+
+    bool seenPrototypeMutation = false;
+    RootedAtom propAtom(context);
+    for (;;) {
+        TokenKind tt;
+        if (!tokenStream.getToken(&tt, TokenStream::KeywordIsName))
+            return null();
+        if (tt == TOK_RC)
+            break;
+
+        tokenStream.ungetToken();
+
+        PropertyType propType;
+        Node propName = propertyName(yieldHandling, literal, &propType, &propAtom);
+        if (!propName)
+            return null();
+
+        if (propType == PropertyType::Normal) {
+            Node propExpr = assignExpr(InAllowed, yieldHandling);
+            if (!propExpr)
+                return null();
+
+            if (foldConstants && !FoldConstants(context, &propExpr, this))
+                return null();
+
+            if (propAtom == context->names().proto) {
+                if (seenPrototypeMutation) {
+                    report(ParseError, false, propName, JSMSG_DUPLICATE_PROPERTY, "__proto__");
+                    return null();
+                }
+                seenPrototypeMutation = true;
+
+                // Note: this occurs *only* if we observe TOK_COLON!  Only
+                // __proto__: v mutates [[Prototype]].  Getters, setters,
+                // method/generator definitions, computed property name
+                // versions of all of these, and shorthands do not.
+                uint32_t begin = handler.getPosition(propName).begin;
+                if (!handler.addPrototypeMutation(literal, begin, propExpr))
+                    return null();
+            } else {
+                if (!handler.isConstant(propExpr))
+                    handler.setListFlag(literal, PNX_NONCONST);
+
+                if (!handler.addPropertyDefinition(literal, propName, propExpr))
+                    return null();
+            }
+        } else if (propType == PropertyType::Shorthand) {
+            /*
+             * Support, e.g., |var {x, y} = o| as destructuring shorthand
+             * for |var {x: x, y: y} = o|, per proposed JS2/ES4 for JS1.8.
+             */
+            if (!tokenStream.checkForKeyword(propAtom, nullptr))
+                return null();
+
+            Node nameExpr = identifierName(yieldHandling);
+            if (!nameExpr)
+                return null();
+
+            if (!handler.addShorthand(literal, propName, nameExpr))
+                return null();
+        } else {
+            // FIXME: Implement ES6 function "name" property semantics
+            // (bug 883377).
+            RootedPropertyName funName(context);
+            switch (propType) {
+              case PropertyType::Getter:
+              case PropertyType::Setter:
+                funName = nullptr;
+                break;
+              default:
+                if (tokenStream.isCurrentTokenType(TOK_NAME))
+                    funName = tokenStream.currentName();
+                else
+                    funName = nullptr;
+            }
+            Node fn = methodDefinition(yieldHandling, propType, funName);
+            if (!fn)
+                return null();
+
+            JSOp op = JSOpFromPropertyType(propType);
+            if (!handler.addObjectMethodDefinition(literal, propName, fn, op))
+                return null();
+        }
+
+        if (!tokenStream.getToken(&tt))
+            return null();
+        if (tt == TOK_RC)
+            break;
+        if (tt != TOK_COMMA) {
+            report(ParseError, false, null(), JSMSG_CURLY_AFTER_LIST);
+            return null();
+        }
+    }
+
+    handler.setEndPosition(literal, pos().end);
+    return literal;
 }
 
 template <typename ParseHandler>
 typename ParseHandler::Node
-Parser<ParseHandler>::propertyList(YieldHandling yieldHandling, PropListType type)
+Parser<ParseHandler>::methodDefinition(YieldHandling yieldHandling, PropertyType propType,
+                                       HandlePropertyName funName)
 {
-    MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_LC));
-
-    Node propList = newPropertyListNode(type);
-    if (!propList)
-        return null();
-
-    bool seenPrototypeMutation = false;
-    bool seenConstructor = false;
-    RootedAtom atom(context);
-    for (;;) {
-        TokenKind ltok;
-        if (!tokenStream.getToken(&ltok, TokenStream::KeywordIsName))
-            return null();
-        if (ltok == TOK_RC)
-            break;
-
-        bool isStatic = false;
-        if (IsClassBody(type)) {
-            if (ltok == TOK_SEMI)
-                continue;
-
-            if (ltok == TOK_NAME &&
-                tokenStream.currentName() == context->names().static_)
-            {
-                isStatic = true;
-                if (!tokenStream.getToken(&ltok, TokenStream::KeywordIsName))
-                    return null();
-            }
-        }
-
-        bool isGenerator = false;
-        if (ltok == TOK_MUL) {
-            isGenerator = true;
-            if (!tokenStream.getToken(&ltok, TokenStream::KeywordIsName))
-                return null();
-        }
-
-        atom = nullptr;
-
-        JSOp op = JSOP_INITPROP;
-        Node propname;
-        bool isConstructor = false;
-        switch (ltok) {
-          case TOK_NUMBER:
-            atom = DoubleToAtom(context, tokenStream.currentToken().number());
-            if (!atom)
-                return null();
-            propname = newNumber(tokenStream.currentToken());
-            if (!propname)
-                return null();
-            break;
-
-          case TOK_LB: {
-              propname = computedPropertyName(yieldHandling, propList);
-              if (!propname)
-                  return null();
-              break;
-          }
-
-          case TOK_NAME: {
-            atom = tokenStream.currentName();
-            // Do not look for accessor syntax on generators
-            if (!isGenerator &&
-                (atom == context->names().get ||
-                 atom == context->names().set))
-            {
-                op = atom == context->names().get ? JSOP_INITPROP_GETTER
-                                                  : JSOP_INITPROP_SETTER;
-            } else {
-                propname = handler.newObjectLiteralPropertyName(atom, pos());
-                if (!propname)
-                    return null();
-                break;
-            }
-
-            // We have parsed |get| or |set|. Look for an accessor property
-            // name next.
-            TokenKind tt;
-            if (!tokenStream.getToken(&tt, TokenStream::KeywordIsName))
-                return null();
-            if (tt == TOK_NAME) {
-                atom = tokenStream.currentName();
-                propname = handler.newObjectLiteralPropertyName(atom, pos());
-                if (!propname)
-                    return null();
-            } else if (tt == TOK_STRING) {
-                atom = tokenStream.currentToken().atom();
-
-                uint32_t index;
-                if (atom->isIndex(&index)) {
-                    propname = handler.newNumber(index, NoDecimal, pos());
-                    if (!propname)
-                        return null();
-                    atom = DoubleToAtom(context, index);
-                    if (!atom)
-                        return null();
-                } else {
-                    propname = stringLiteral();
-                    if (!propname)
-                        return null();
-                }
-            } else if (tt == TOK_NUMBER) {
-                atom = DoubleToAtom(context, tokenStream.currentToken().number());
-                if (!atom)
-                    return null();
-                propname = newNumber(tokenStream.currentToken());
-                if (!propname)
-                    return null();
-            } else if (tt == TOK_LB) {
-                propname = computedPropertyName(yieldHandling, propList);
-                if (!propname)
-                    return null();
-            } else {
-                // Not an accessor property after all.
-                tokenStream.ungetToken();
-                propname = handler.newObjectLiteralPropertyName(atom, pos());
-                if (!propname)
-                    return null();
-                tokenStream.addModifierException(TokenStream::NoneIsKeywordIsName);
-                op = JSOP_INITPROP;
-                break;
-            }
-
-            MOZ_ASSERT(op == JSOP_INITPROP_GETTER || op == JSOP_INITPROP_SETTER);
-            break;
-          }
-
-          case TOK_STRING: {
-            atom = tokenStream.currentToken().atom();
-            uint32_t index;
-            if (atom->isIndex(&index)) {
-                propname = handler.newNumber(index, NoDecimal, pos());
-                if (!propname)
-                    return null();
-            } else {
-                propname = stringLiteral();
-                if (!propname)
-                    return null();
-            }
-            break;
-          }
-
-          default:
-            // There is never a case in which |static *(| can make a meaningful method definition.
-            if (isStatic && !isGenerator) {
-                // Turns out it wasn't static. Put it back and pretend it was a name all along.
-                tokenStream.ungetToken();
-                if (isStatic)
-                    tokenStream.addModifierException(TokenStream::NoneIsKeywordIsName);
-                isStatic = false;
-                atom = tokenStream.currentName();
-                propname = handler.newObjectLiteralPropertyName(atom->asPropertyName(), pos());
-                if (!propname)
-                    return null();
-            } else {
-                report(ParseError, false, null(), JSMSG_BAD_PROP_ID);
-                return null();
-            }
-        }
-
-        if (IsClassBody(type)) {
-            if (!isStatic && atom == context->names().constructor) {
-                if (isGenerator || op != JSOP_INITPROP) {
-                    report(ParseError, false, propname, JSMSG_BAD_METHOD_DEF);
-                    return null();
-                }
-                if (seenConstructor) {
-                    report(ParseError, false, propname, JSMSG_DUPLICATE_PROPERTY, "constructor");
-                    return null();
-                }
-                seenConstructor = true;
-                isConstructor = true;
-            } else if (isStatic && atom == context->names().prototype) {
-                report(ParseError, false, propname, JSMSG_BAD_METHOD_DEF);
-                return null();
-            }
-        }
-
-        if (op == JSOP_INITPROP) {
-            TokenKind tt;
-            if (!tokenStream.getToken(&tt))
-                return null();
-
-            if (tt == TOK_COLON) {
-                if (IsClassBody(type)) {
-                    report(ParseError, false, null(), JSMSG_BAD_METHOD_DEF);
-                    return null();
-                }
-                if (isGenerator) {
-                    report(ParseError, false, null(), JSMSG_BAD_PROP_ID);
-                    return null();
-                }
-
-                Node propexpr = assignExpr(InAllowed, yieldHandling);
-                if (!propexpr)
-                    return null();
-
-                if (foldConstants && !FoldConstants(context, &propexpr, this))
-                    return null();
-
-                if (atom == context->names().proto) {
-                    if (seenPrototypeMutation) {
-                        report(ParseError, false, propname, JSMSG_DUPLICATE_PROPERTY, "__proto__");
-                        return null();
-                    }
-                    seenPrototypeMutation = true;
-
-                    // Note: this occurs *only* if we observe TOK_COLON!  Only
-                    // __proto__: v mutates [[Prototype]].  Getters, setters,
-                    // method/generator definitions, computed property name
-                    // versions of all of these, and shorthands do not.
-                    uint32_t begin = handler.getPosition(propname).begin;
-                    if (!handler.addPrototypeMutation(propList, begin, propexpr))
-                        return null();
-                } else {
-                    if (!handler.isConstant(propexpr))
-                        handler.setListFlag(propList, PNX_NONCONST);
-
-                    if (!handler.addPropertyDefinition(propList, propname, propexpr))
-                        return null();
-                }
-            } else if (ltok == TOK_NAME && (tt == TOK_COMMA || tt == TOK_RC)) {
-                /*
-                 * Support, e.g., |var {x, y} = o| as destructuring shorthand
-                 * for |var {x: x, y: y} = o|, per proposed JS2/ES4 for JS1.8.
-                 */
-                if (IsClassBody(type)) {
-                    report(ParseError, false, null(), JSMSG_BAD_METHOD_DEF);
-                    return null();
-                }
-                if (isGenerator) {
-                    report(ParseError, false, null(), JSMSG_BAD_PROP_ID);
-                    return null();
-                }
-
-                tokenStream.ungetToken();
-                if (!tokenStream.checkForKeyword(atom, nullptr))
-                    return null();
-
-                Node nameExpr = identifierName(yieldHandling);
-                if (!nameExpr)
-                    return null();
-
-                if (!handler.addShorthand(propList, propname, nameExpr))
-                    return null();
-            } else if (tt == TOK_LP) {
-                tokenStream.ungetToken();
-                if (!methodDefinition(yieldHandling, type, propList, propname,
-                                      isConstructor ? type == DerivedClassBody ? DerivedClassConstructor
-                                                                               : ClassConstructor
-                                                    : Method,
-                                      isGenerator ? StarGenerator : NotGenerator, isStatic, op))
-                {
-                    return null();
-                }
-            } else {
-                report(ParseError, false, null(), JSMSG_COLON_AFTER_ID);
-                return null();
-            }
-        } else {
-            if (!methodDefinition(yieldHandling, type, propList, propname,
-                                  op == JSOP_INITPROP_GETTER ? Getter : Setter, NotGenerator,
-                                  isStatic, op))
-            {
-                return null();
-            }
-        }
-
-        if (type == ObjectLiteral) {
-            TokenKind tt;
-            if (!tokenStream.getToken(&tt))
-                return null();
-            if (tt == TOK_RC)
-                break;
-            if (tt != TOK_COMMA) {
-                report(ParseError, false, null(), JSMSG_CURLY_AFTER_LIST);
-                return null();
-            }
-        }
-    }
-
-    // Default constructors not yet implemented. See bug 1105463
-    if (IsClassBody(type) && !seenConstructor) {
-        report(ParseError, false, null(), JSMSG_NO_CLASS_CONSTRUCTOR);
-        return null();
-    }
-
-    handler.setEndPosition(propList, pos().end);
-    return propList;
-}
-
-template <typename ParseHandler>
-bool
-Parser<ParseHandler>::methodDefinition(YieldHandling yieldHandling, PropListType listType,
-                                       Node propList, Node propname, FunctionSyntaxKind kind,
-                                       GeneratorKind generatorKind, bool isStatic, JSOp op)
-{
-    MOZ_ASSERT(kind == Method || kind == ClassConstructor || kind == DerivedClassConstructor ||
-               kind == Getter || kind == Setter);
-    /* NB: Getter function in { get x(){} } is unnamed. */
-    RootedPropertyName funName(context);
-    if ((kind == Method || IsConstructorKind(kind)) && tokenStream.isCurrentTokenType(TOK_NAME)) {
-        funName = tokenStream.currentName();
-    } else {
-        funName = nullptr;
-    }
-
-    Node fn = functionDef(InAllowed, yieldHandling, funName, kind, generatorKind);
-    if (!fn)
-        return false;
-
-    if (IsClassBody(listType))
-        return handler.addClassMethodDefinition(propList, propname, fn, op, isStatic);
-
-    MOZ_ASSERT(listType == ObjectLiteral);
-    return handler.addObjectMethodDefinition(propList, propname, fn, op);
+    FunctionSyntaxKind kind = FunctionSyntaxKindFromPropertyType(propType);
+    GeneratorKind generatorKind = GeneratorKindFromPropertyType(propType);
+    return functionDef(InAllowed, yieldHandling, funName, kind, generatorKind);
 }
 
 template <typename ParseHandler>
@@ -8936,7 +8997,7 @@ Parser<ParseHandler>::primaryExpr(YieldHandling yieldHandling, TokenKind tt,
         return arrayInitializer(yieldHandling);
 
       case TOK_LC:
-        return propertyList(yieldHandling, ObjectLiteral);
+        return objectLiteral(yieldHandling);
 
       case TOK_LP: {
         TokenKind next;
diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h
index b2c2457577fc..45cc79fa2605 100644
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -355,12 +355,16 @@ class CompExprTransplanter;
 
 enum VarContext { HoistVars, DontHoistVars };
 enum PropListType { ObjectLiteral, ClassBody, DerivedClassBody };
-
-inline bool
-IsClassBody(PropListType type)
-{
-    return type == ClassBody || type == DerivedClassBody;
-}
+enum class PropertyType {
+    Normal,
+    Shorthand,
+    Getter,
+    Setter,
+    Method,
+    GeneratorMethod,
+    Constructor,
+    DerivedConstructor
+};
 
 // Specify a value for an ES6 grammar parametrization.  We have no enum for
 // [Return] because its behavior is exactly equivalent to checking whether
@@ -691,9 +695,8 @@ class Parser : private JS::AutoGCRooter, public StrictModeGetter
     bool tryNewTarget(Node& newTarget);
     bool checkAndMarkSuperScope();
 
-    bool methodDefinition(YieldHandling yieldHandling, PropListType listType, Node propList,
-                          Node propname, FunctionSyntaxKind kind, GeneratorKind generatorKind,
-                          bool isStatic, JSOp Op);
+    Node methodDefinition(YieldHandling yieldHandling, PropertyType propType,
+                          HandlePropertyName funName);
 
     /*
      * Additional JS parsers.
@@ -798,12 +801,13 @@ class Parser : private JS::AutoGCRooter, public StrictModeGetter
     Node pushLexicalScope(Handle<StaticBlockObject*> blockObj, AutoPushStmtInfoPC& stmt);
     Node pushLetScope(Handle<StaticBlockObject*> blockObj, AutoPushStmtInfoPC& stmt);
     bool noteNameUse(HandlePropertyName name, Node pn);
+    Node propertyName(YieldHandling yieldHandling, Node propList,
+                      PropertyType* propType, MutableHandleAtom propAtom);
     Node computedPropertyName(YieldHandling yieldHandling, Node literal);
     Node arrayInitializer(YieldHandling yieldHandling);
     Node newRegExp();
 
-    Node propertyList(YieldHandling yieldHandling, PropListType type);
-    Node newPropertyListNode(PropListType type);
+    Node objectLiteral(YieldHandling yieldHandling);
 
     bool checkAndPrepareLexical(bool isConst, const TokenPos& errorPos);
     Node makeInitializedLexicalBinding(HandlePropertyName name, bool isConst, const TokenPos& pos);
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 0b9884f57e62..2f078d187e40 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1019,7 +1019,33 @@ js::GCMarker::eagerlyMarkChildren(JSRope* rope)
     // types.
     ptrdiff_t savedPos = stack.position();
     JS_DIAGNOSTICS_ASSERT(rope->getTraceKind() == JS::TraceKind::String);
+#ifdef JS_DEBUG
+    static const size_t DEEP_ROPE_THRESHOLD = 100000;
+    static const size_t ROPE_CYCLE_HISTORY = 100;
+    DebugOnly<size_t> ropeDepth = 0;
+    JSRope* history[ROPE_CYCLE_HISTORY];
+#endif
     while (true) {
+#ifdef JS_DEBUG
+        if (++ropeDepth >= DEEP_ROPE_THRESHOLD) {
+            // Bug 1011786 comment 294 - detect cyclic ropes. There are some
+            // legitimate deep ropes, at least in tests. So if we hit a deep
+            // rope, start recording the nodes we visit and check whether we
+            // repeat. But do it on a finite window size W so that we're not
+            // scanning the full history for every node. And only check every
+            // Wth push, to add only constant overhead per node. This will only
+            // catch cycles of size up to W (but it seems most likely that any
+            // cycles will be size 1 or maybe 2.)
+            if ((ropeDepth > DEEP_ROPE_THRESHOLD + ROPE_CYCLE_HISTORY) &&
+                (ropeDepth % ROPE_CYCLE_HISTORY) == 0)
+            {
+                for (size_t i = 0; i < ROPE_CYCLE_HISTORY; i++)
+                    MOZ_ASSERT(history[i] != rope, "cycle detected in rope");
+            }
+            history[ropeDepth % ROPE_CYCLE_HISTORY] = rope;
+        }
+#endif
+
         JS_DIAGNOSTICS_ASSERT(rope->getTraceKind() == JS::TraceKind::String);
         JS_DIAGNOSTICS_ASSERT(rope->JSString::isRope());
         AssertZoneIsMarking(rope);
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 390799217142..1a025e3e998a 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -6064,10 +6064,13 @@ AutoFilename::get() const
 }
 
 JS_PUBLIC_API(bool)
-DescribeScriptedCaller(JSContext* cx, AutoFilename* filename, unsigned* lineno)
+DescribeScriptedCaller(JSContext* cx, AutoFilename* filename, unsigned* lineno,
+                       unsigned* column)
 {
     if (lineno)
         *lineno = 0;
+    if (column)
+        *column = 0;
 
     NonBuiltinFrameIter i(cx);
     if (i.done())
@@ -6080,8 +6083,12 @@ DescribeScriptedCaller(JSContext* cx, AutoFilename* filename, unsigned* lineno)
 
     if (filename)
         filename->reset(i.scriptSource());
+
     if (lineno)
-        *lineno = i.computeLine();
+        *lineno = i.computeLine(column);
+    else if (column)
+        i.computeLine(column);
+
     return true;
 }
 
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 0aa794c4fc04..c40494d98c4b 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -5000,15 +5000,16 @@ class MOZ_STACK_CLASS JS_PUBLIC_API(AutoFilename)
 };
 
 /*
- * Return the current filename and line number of the most currently running
- * frame. Returns true if a scripted frame was found, false otherwise.
+ * Return the current filename, line number and column number of the most
+ * currently running frame. Returns true if a scripted frame was found, false
+ * otherwise.
  *
  * If a the embedding has hidden the scripted caller for the topmost activation
  * record, this will also return false.
  */
 extern JS_PUBLIC_API(bool)
 DescribeScriptedCaller(JSContext* cx, AutoFilename* filename = nullptr,
-                       unsigned* lineno = nullptr);
+                       unsigned* lineno = nullptr, unsigned* column = nullptr);
 
 extern JS_PUBLIC_API(JSObject*)
 GetScriptedCallerGlobal(JSContext* cx);
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 2ccd7d872c59..02187646a6be 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -3693,7 +3693,7 @@ JSScript::traceChildren(JSTracer* trc)
 
     if (hasRegexps()) {
         ObjectArray* objarray = regexps();
-        TraceRange(trc, objarray->length, objarray->vector, "objects");
+        TraceRange(trc, objarray->length, objarray->vector, "regexps");
     }
 
     if (hasConsts()) {
diff --git a/js/src/tests/ecma_6/Class/className.js b/js/src/tests/ecma_6/Class/className.js
new file mode 100644
index 000000000000..6d47f790c243
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/className.js
@@ -0,0 +1,246 @@
+function testName(C, name, hasValue, hasGetter, hasSetter, isFunction=false) {
+    if (isFunction) {
+        assertEq(typeof C.name, "function");
+    } else {
+        assertEq(C.name, name);
+    }
+
+    var desc = Object.getOwnPropertyDescriptor(C, "name");
+    if (!hasValue && !hasGetter && !hasSetter) {
+        assertEq(desc, undefined);
+        return;
+    }
+
+    if (hasValue) {
+        assertEq("value" in desc, true);
+        if (isFunction) {
+            assertEq(typeof desc.value, "function");
+        } else {
+            assertEq(desc.value, name);
+        }
+        // FIXME: Methods defined in classes should not be enumerable
+        // (bug 1144630).
+        // assertEq(desc.enumerable, false);
+        assertEq(desc.configurable, true);
+
+        assertEq("get" in desc, false);
+        assertEq("set" in desc, false);
+
+        return;
+    }
+
+    assertEq("value" in desc, false);
+
+    if (hasGetter) {
+        assertEq("get" in desc, true);
+        assertEq(desc.get(), name);
+        // assertEq(desc.enumerable, false);
+        assertEq(desc.configurable, true);
+    } else {
+        assertEq("get" in desc, true);
+        assertEq(desc.get, undefined);
+        // assertEq(desc.enumerable, false);
+        assertEq(desc.configurable, true);
+    }
+
+    if (hasSetter) {
+        assertEq("set" in desc, true);
+        assertEq(typeof desc.set, "function");
+        // assertEq(desc.enumerable, false);
+        assertEq(desc.configurable, true);
+    } else {
+        assertEq("set" in desc, true);
+        assertEq(desc.set, undefined);
+        // assertEq(desc.enumerable, false);
+        assertEq(desc.configurable, true);
+    }
+}
+
+var test = `
+// ---- declaration ---
+
+class Decl {
+    constructor() {}
+}
+testName(Decl, "Decl", true, false, false);
+
+class DeclWithFunc {
+    constructor() {}
+    static name() {}
+}
+testName(DeclWithFunc, "DeclWithFunc", true, false, false, true);
+
+class DeclWithGetter {
+    constructor() {}
+    static get name() { return "base"; }
+}
+testName(DeclWithGetter, "base", false, true, false);
+
+class DeclWithSetter {
+    constructor() {}
+    static set name(v) {}
+}
+testName(DeclWithSetter, undefined, false, false, true);
+
+class DeclWithGetterSetter {
+    constructor() {}
+    static get name() { return "base"; }
+    static set name(v) {}
+}
+testName(DeclWithGetterSetter, "base", false, true, true);
+
+function prop() {
+  return "name";
+}
+class DeclWithComputed {
+    constructor() {}
+    static get [prop()]() { return "base"; }
+}
+testName(DeclWithGetterSetter, "base", false, true, true);
+
+class ExtendedDecl1 extends Decl {
+    constructor() {}
+}
+testName(ExtendedDecl1, "ExtendedDecl1", true, false, false);
+delete ExtendedDecl1.name;
+testName(ExtendedDecl1, "Decl", false, false, false);
+
+class ExtendedDecl2 extends DeclWithGetterSetter {
+    constructor() {}
+    static get name() { return "extend"; }
+}
+testName(ExtendedDecl2, "extend", false, true, false);
+delete ExtendedDecl2.name;
+testName(ExtendedDecl2, "base", false, false, false);
+
+class ExtendedDecl3 extends DeclWithGetterSetter {
+    constructor() {}
+    static set name(v) {}
+}
+testName(ExtendedDecl3, undefined, false, false, true);
+delete ExtendedDecl3.name;
+testName(ExtendedDecl3, "base", false, false, false);
+
+// ---- expression ---
+
+let Expr = class Expr {
+    constructor() {}
+};
+testName(Expr, "Expr", true, false, false);
+
+let ExprWithGetter = class ExprWithGetter {
+    constructor() {}
+    static get name() { return "base"; }
+};
+testName(ExprWithGetter, "base", false, true, false);
+
+let ExprWithSetter = class ExprWithSetter {
+    constructor() {}
+    static set name(v) {}
+};
+testName(ExprWithSetter, undefined, false, false, true);
+
+let ExprWithGetterSetter = class ExprWithGetterSetter {
+    constructor() {}
+    static get name() { return "base"; }
+    static set name(v) {}
+};
+testName(ExprWithGetterSetter, "base", false, true, true);
+
+
+let ExtendedExpr1 = class ExtendedExpr1 extends Expr {
+    constructor() {}
+};
+testName(ExtendedExpr1, "ExtendedExpr1", true, false, false);
+delete ExtendedExpr1.name;
+testName(ExtendedExpr1, "Expr", false, false, false);
+
+let ExtendedExpr2 = class ExtendedExpr2 extends ExprWithGetterSetter {
+    constructor() {}
+    static get name() { return "extend"; }
+};
+testName(ExtendedExpr2, "extend", false, true, false);
+delete ExtendedExpr2.name;
+testName(ExtendedExpr2, "base", false, false, false);
+
+let ExtendedExpr3 = class ExtendedExpr3 extends ExprWithGetterSetter {
+    constructor() {}
+    static set name(v) {}
+};
+testName(ExtendedExpr3, undefined, false, false, true);
+delete ExtendedExpr3.name;
+testName(ExtendedExpr3, "base", false, false, false);
+
+// ---- anonymous ----
+
+let Anon = class {
+    constructor() {}
+};
+testName(Anon, "", true, false, false);
+
+let AnonWithGetter = class {
+    constructor() {}
+    static get name() { return "base"; }
+};
+testName(AnonWithGetter, "base", false, true, false);
+
+let AnonWithSetter = class {
+    constructor() {}
+    static set name(v) {}
+};
+testName(AnonWithSetter, undefined, false, false, true);
+
+let AnonWithGetterSetter = class {
+    constructor() {}
+    static get name() { return "base"; }
+    static set name(v) {}
+};
+testName(AnonWithGetterSetter, "base", false, true, true);
+
+
+let ExtendedAnon1 = class extends Anon {
+    constructor() {}
+};
+testName(ExtendedAnon1, "", true, false, false);
+delete ExtendedAnon1.name;
+testName(ExtendedAnon1, "", false, false, false);
+
+let ExtendedAnon2 = class extends AnonWithGetterSetter {
+    constructor() {}
+    static get name() { return "extend"; }
+};
+testName(ExtendedAnon2, "extend", false, true, false);
+delete ExtendedAnon2.name;
+testName(ExtendedAnon2, "base", false, false, false);
+
+let ExtendedAnon3 = class extends AnonWithGetterSetter {
+    constructor() {}
+    static set name(v) {}
+};
+testName(ExtendedAnon3, undefined, false, false, true);
+delete ExtendedAnon3.name;
+testName(ExtendedAnon3, "base", false, false, false);
+
+// ---- mixed ----
+
+let ExtendedExpr4 = class ExtendedExpr4 extends Anon {
+    constructor() {}
+}
+testName(ExtendedExpr4, "ExtendedExpr4", true, false, false);
+delete ExtendedExpr4.name;
+testName(ExtendedExpr4, "", false, false, false);
+
+let ExtendedExpr5 = class ExtendedExpr5 extends AnonWithGetterSetter {
+    constructor() {}
+    static get name() { return "extend"; }
+}
+testName(ExtendedExpr5, "extend", false, true, false);
+delete ExtendedExpr5.name;
+testName(ExtendedExpr5, "base", false, false, false);
+`;
+
+if (classesEnabled())
+    eval(test);
+
+if (typeof reportCompare === "function")
+    reportCompare(0, 0, "OK");
diff --git a/js/src/tests/js1_8_5/reflect-parse/classes.js b/js/src/tests/js1_8_5/reflect-parse/classes.js
index 6544ceb2de7d..371819b2d55c 100644
--- a/js/src/tests/js1_8_5/reflect-parse/classes.js
+++ b/js/src/tests/js1_8_5/reflect-parse/classes.js
@@ -24,6 +24,11 @@ function testClasses() {
                            methodFun(id, kind, generator, args),
                            kind, isStatic);
     }
+    function ctorWithName(id) {
+        return classMethod(ident("constructor"),
+                           methodFun(id, "method", false, []),
+                           "method", false);
+    }
     function emptyCPNMethod(id, isStatic) {
         return classMethod(computedName(lit(id)),
                            funExpr(null, [], blockStmt([])),
@@ -34,9 +39,16 @@ function testClasses() {
         let template = classExpr(name, heritage, methods);
         assertExpr("(" + str + ")", template);
     }
+    // FunctionExpression of constructor has class name as its id.
+    // FIXME: Implement ES6 function "name" property semantics (bug 883377).
+    let ctorPlaceholder = {};
     function assertClass(str, methods, heritage=null) {
         let namelessStr = str.replace("NAME", "");
         let namedStr = str.replace("NAME", "Foo");
+        let namedCtor = ctorWithName("NAME");
+        let namelessCtor = ctorWithName(null);
+        let namelessMethods = methods.map(x => x == ctorPlaceholder ? namedCtor : x);
+        let namedMethods = methods.map(x => x == ctorPlaceholder ? namedCtor : x);
         assertClassExpr(namelessStr, methods, heritage);
         assertClassExpr(namedStr, methods, heritage, ident("Foo"));
 
@@ -52,13 +64,11 @@ function testClasses() {
         assertError("(" + str.replace("NAME", "") + ")", error);
     }
 
-    let simpleConstructor = simpleMethod("constructor", "method", false);
-
     /* Trivial classes */
     // Unnamed class statements are forbidden, but unnamed class expressions are
     // just fine.
     assertError("class { constructor() { } }", SyntaxError);
-    assertClass("class NAME { constructor() { } }", [simpleConstructor]);
+    assertClass("class NAME { constructor() { } }", [ctorPlaceholder]);
 
     // A class name must actually be a name
     assertNamedClassError("class x.y { constructor() {} }", SyntaxError);
@@ -68,13 +78,13 @@ function testClasses() {
 
     // Allow methods and accessors
     assertClass("class NAME { constructor() { } method() { } }",
-                [simpleConstructor, simpleMethod("method", "method", false)]);
+                [ctorPlaceholder, simpleMethod("method", "method", false)]);
 
     assertClass("class NAME { constructor() { } get method() { } }",
-                [simpleConstructor, simpleMethod("method", "get", false)]);
+                [ctorPlaceholder, simpleMethod("method", "get", false)]);
 
     assertClass("class NAME { constructor() { } set method(x) { } }",
-                [simpleConstructor, simpleMethod("method", "set", false, ["x"])]);
+                [ctorPlaceholder, simpleMethod("method", "set", false, ["x"])]);
 
     /* Static */
     assertClass(`class NAME {
@@ -84,7 +94,7 @@ function testClasses() {
                    static get getter() { };
                    static set setter(x) { }
                  }`,
-                [simpleConstructor,
+                [ctorPlaceholder,
                  simpleMethod("method", "method", false, [], true),
                  simpleMethod("methodGen", "method", true, [], true),
                  simpleMethod("getter", "get", false, [], true),
@@ -92,13 +102,13 @@ function testClasses() {
 
     // It's not an error to have a method named static, static, or not.
     assertClass("class NAME { constructor() { } static() { } }",
-                [simpleConstructor, simpleMethod("static", "method", false)]);
+                [ctorPlaceholder, simpleMethod("static", "method", false)]);
     assertClass("class NAME { static static() { }; constructor() { } }",
-                [simpleMethod("static", "method", false, [], true), simpleConstructor]);
+                [simpleMethod("static", "method", false, [], true), ctorPlaceholder]);
     assertClass("class NAME { static get static() { }; constructor() { } }",
-                [simpleMethod("static", "get", false, [], true), simpleConstructor]);
+                [simpleMethod("static", "get", false, [], true), ctorPlaceholder]);
     assertClass("class NAME { constructor() { }; static set static(x) { } }",
-                [simpleConstructor, simpleMethod("static", "set", false, ["x"], true)]);
+                [ctorPlaceholder, simpleMethod("static", "set", false, ["x"], true)]);
 
     // You do, however, have to put static in the right spot
     assertClassError("class NAME { constructor() { }; get static foo() { } }", SyntaxError);
@@ -112,7 +122,7 @@ function testClasses() {
 
     // You are, however, allowed to have a CPN called prototype as a static
     assertClass("class NAME { constructor() { }; static [\"prototype\"]() { } }",
-                [simpleConstructor, emptyCPNMethod("prototype", true)]);
+                [ctorPlaceholder, emptyCPNMethod("prototype", true)]);
 
     /* Constructor */
     // Currently, we do not allow default constructors
@@ -141,14 +151,14 @@ function testClasses() {
             let str = "class NAME { constructor() { } " +
                        methods[i][0] + " " + methods[j][0] +
                        " }";
-            assertClass(str, [simpleConstructor, methods[i][1], methods[j][1]]);
+            assertClass(str, [ctorPlaceholder, methods[i][1], methods[j][1]]);
         }
     }
 
     // It is, however, not an error to have a constructor, and a method with a
     // computed property name 'constructor'
     assertClass("class NAME { constructor () { } [\"constructor\"] () { } }",
-                [simpleConstructor, emptyCPNMethod("constructor", false)]);
+                [ctorPlaceholder, emptyCPNMethod("constructor", false)]);
 
     // It is an error to have a generator or accessor named constructor
     assertClassError("class NAME { *constructor() { } }", SyntaxError);
@@ -157,14 +167,14 @@ function testClasses() {
 
     /* Semicolons */
     // Allow Semicolons in Class Definitions
-    assertClass("class NAME { constructor() { }; }", [simpleConstructor]);
+    assertClass("class NAME { constructor() { }; }", [ctorPlaceholder]);
 
     // Allow more than one semicolon, even in otherwise trivial classses
-    assertClass("class NAME { ;;; constructor() { } }", [simpleConstructor]);
+    assertClass("class NAME { ;;; constructor() { } }", [ctorPlaceholder]);
 
     // Semicolons are optional, even if the methods share a line
     assertClass("class NAME { method() { } constructor() { } }",
-                [simpleMethod("method", "method", false), simpleConstructor]);
+                [simpleMethod("method", "method", false), ctorPlaceholder]);
 
     /* Generators */
     // No yield as a class name inside a generator
@@ -184,7 +194,7 @@ function testClasses() {
     assertClassError("class NAME { constructor() { } *set foo() { } }", SyntaxError);
 
     assertClass("class NAME { *method() { } constructor() { } }",
-                [simpleMethod("method", "method", true), simpleConstructor]);
+                [simpleMethod("method", "method", true), ctorPlaceholder]);
 
     /* Strictness */
     // yield is a strict-mode keyword, and class definitions are always strict.
@@ -197,14 +207,15 @@ function testClasses() {
     /* Bindings */
     // Class statements bind lexically, so they should collide with other
     // in-block lexical bindings, but class expressions don't.
+    let FooCtor = ctorWithName("Foo");
     assertError("{ let Foo; class Foo { constructor() { } } }", TypeError);
     assertStmt("{ let Foo; (class Foo { constructor() { } }) }",
                blockStmt([letDecl([{id: ident("Foo"), init: null}]),
-                          exprStmt(classExpr(ident("Foo"), null, [simpleConstructor]))]));
+                          exprStmt(classExpr(ident("Foo"), null, [FooCtor]))]));
     assertError("{ const Foo = 0; class Foo { constructor() { } } }", TypeError);
     assertStmt("{ const Foo = 0; (class Foo { constructor() { } }) }",
                blockStmt([constDecl([{id: ident("Foo"), init: lit(0)}]),
-                          exprStmt(classExpr(ident("Foo"), null, [simpleConstructor]))]));
+                          exprStmt(classExpr(ident("Foo"), null, [FooCtor]))]));
     assertError("{ class Foo { constructor() { } } class Foo { constructor() { } } }", TypeError);
     assertStmt(`{
                     (class Foo {
@@ -214,16 +225,16 @@ function testClasses() {
                         constructor() { }
                      });
                 }`,
-               blockStmt([exprStmt(seqExpr([classExpr(ident("Foo"), null, [simpleConstructor]),
-                                            classExpr(ident("Foo"), null, [simpleConstructor])]))]));
+               blockStmt([exprStmt(seqExpr([classExpr(ident("Foo"), null, [FooCtor]),
+                                            classExpr(ident("Foo"), null, [FooCtor])]))]));
     assertStmt(`{
                     var x = class Foo { constructor() { } };
                     class Foo { constructor() { } }
                 }`,
                blockStmt([varDecl([{ id: ident("x"),
-                                     init: classExpr(ident("Foo"), null, [simpleConstructor])
+                                     init: classExpr(ident("Foo"), null, [FooCtor])
                                    }]),
-                          classStmt(ident("Foo"), null, [simpleConstructor])]));
+                          classStmt(ident("Foo"), null, [FooCtor])]));
 
 
     // Can't make a lexical binding without a block.
@@ -242,36 +253,36 @@ function testClasses() {
 
     // "extends" is still a valid name for a method
     assertClass("class NAME { constructor() { }; extends() { } }",
-                [simpleConstructor, simpleMethod("extends", "method", false)]);
+                [ctorPlaceholder, simpleMethod("extends", "method", false)]);
 
     // Immediate expression
     assertClass("class NAME extends null { constructor() { } }",
-                [simpleConstructor], lit(null));
+                [ctorPlaceholder], lit(null));
 
     // Sequence expresson
     assertClass("class NAME extends (undefined, undefined) { constructor() { } }",
-                [simpleConstructor], seqExpr([ident("undefined"), ident("undefined")]));
+                [ctorPlaceholder], seqExpr([ident("undefined"), ident("undefined")]));
 
     // Function expression
     let emptyFunction = funExpr(null, [], blockStmt([]));
     assertClass("class NAME extends function(){ } { constructor() { } }",
-                [simpleConstructor], emptyFunction);
+                [ctorPlaceholder], emptyFunction);
 
     // New expression
     assertClass("class NAME extends new function(){ }() { constructor() { } }",
-                [simpleConstructor], newExpr(emptyFunction, []));
+                [ctorPlaceholder], newExpr(emptyFunction, []));
 
     // Call expression
     assertClass("class NAME extends function(){ }() { constructor() { } }",
-                [simpleConstructor], callExpr(emptyFunction, []));
+                [ctorPlaceholder], callExpr(emptyFunction, []));
 
     // Dot expression
     assertClass("class NAME extends {}.foo { constructor() { } }",
-                [simpleConstructor], dotExpr(objExpr([]), ident("foo")));
+                [ctorPlaceholder], dotExpr(objExpr([]), ident("foo")));
 
     // Member expression
     assertClass("class NAME extends {}[foo] { constructor() { } }",
-                [simpleConstructor], memExpr(objExpr([]), ident("foo")));
+                [ctorPlaceholder], memExpr(objExpr([]), ident("foo")));
 
     /* SuperProperty */
     // NOTE: Some of these tests involve object literals, as SuperProperty is a
@@ -367,7 +378,7 @@ function testClasses() {
     function makeClassSuperPropExpr(fun, type, static) {
         // We are going right into assertClass, so we don't have to build the
         // entire statement.
-        return [simpleConstructor,
+        return [ctorPlaceholder,
                 classMethod(ident("method"), fun, type, static)];
     }
     function doClassSuperPropAssert(str, expr, extending) {
diff --git a/js/xpconnect/src/XPCWrappedNativeInfo.cpp b/js/xpconnect/src/XPCWrappedNativeInfo.cpp
index ee8aeb60efe4..14e886d6067a 100644
--- a/js/xpconnect/src/XPCWrappedNativeInfo.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeInfo.cpp
@@ -244,12 +244,12 @@ XPCNativeInterface::NewInstance(nsIInterfaceInfo* aInfo)
             nsPrintfCString errorMsg("Use of %s in content process is deprecated.", intfNameChars);
 
             nsAutoString filename;
-            uint32_t lineno = 0;
-            nsJSUtils::GetCallingLocation(cx, filename, &lineno);
+            uint32_t lineno = 0, column = 0;
+            nsJSUtils::GetCallingLocation(cx, filename, &lineno, &column);
             nsCOMPtr<nsIScriptError> error(do_CreateInstance(NS_SCRIPTERROR_CONTRACTID));
             error->Init(NS_ConvertUTF8toUTF16(errorMsg),
                         filename, EmptyString(),
-                        lineno, 0, nsIScriptError::warningFlag, "chrome javascript");
+                        lineno, column, nsIScriptError::warningFlag, "chrome javascript");
             console->LogMessage(error);
         }
     }
diff --git a/js/xpconnect/wrappers/XrayWrapper.cpp b/js/xpconnect/wrappers/XrayWrapper.cpp
index 3d9b7e4a8e9e..9b4d6df2abce 100644
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -199,13 +199,13 @@ ReportWrapperDenial(JSContext* cx, HandleId id, WrapperDenialType type, const ch
     if (!propertyName.init(cx, id))
         return false;
     AutoFilename filename;
-    unsigned line = 0;
-    DescribeScriptedCaller(cx, &filename, &line);
+    unsigned line = 0, column = 0;
+    DescribeScriptedCaller(cx, &filename, &line, &column);
 
     // Warn to the terminal for the logs.
-    NS_WARNING(nsPrintfCString("Silently denied access to property |%s|: %s (@%s:%u)",
+    NS_WARNING(nsPrintfCString("Silently denied access to property |%s|: %s (@%s:%u:%u)",
                                NS_LossyConvertUTF16toASCII(propertyName).get(), reason,
-                               filename.get(), line).get());
+                               filename.get(), line, column).get());
 
     // If this isn't the first warning on this topic for this global, we've
     // already bailed out in opt builds. Now that the NS_WARNING is done, bail
@@ -252,7 +252,7 @@ ReportWrapperDenial(JSContext* cx, HandleId id, WrapperDenialType type, const ch
     nsresult rv = errorObject->InitWithWindowID(NS_ConvertASCIItoUTF16(errorMessage.ref()),
                                                 filenameStr,
                                                 EmptyString(),
-                                                line, 0,
+                                                line, column,
                                                 nsIScriptError::warningFlag,
                                                 "XPConnect",
                                                 windowId);
diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index 3cec0a340f55..8a111567ce35 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -948,7 +948,7 @@ nsDocumentViewer::LoadComplete(nsresult aStatus)
   if(window &&
      (NS_SUCCEEDED(aStatus) || aStatus == NS_ERROR_PARSED_DATA_CACHED)) {
     nsEventStatus status = nsEventStatus_eIgnore;
-    WidgetEvent event(true, NS_LOAD);
+    WidgetEvent event(true, eLoad);
     event.mFlags.mBubbles = false;
     event.mFlags.mCancelable = false;
      // XXX Dispatching to |window|, but using |document| as the target.
@@ -1331,7 +1331,7 @@ nsDocumentViewer::PageHide(bool aIsUnload)
 
     // Now, fire an Unload event to the document...
     nsEventStatus status = nsEventStatus_eIgnore;
-    WidgetEvent event(true, NS_PAGE_UNLOAD);
+    WidgetEvent event(true, eUnload);
     event.mFlags.mBubbles = false;
     // XXX Dispatching to |window|, but using |document| as the target.
     event.target = mDocument;
diff --git a/layout/base/nsIPresShell.h b/layout/base/nsIPresShell.h
index 653bd411c7ad..bb088e0bae02 100644
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -139,10 +139,10 @@ typedef struct CapturingContentInfo {
   mozilla::StaticRefPtr<nsIContent> mContent;
 } CapturingContentInfo;
 
-// 4f512d0b-c58c-4fc9-ae42-8aa6d992e7ae
+// b07c5323-3061-4ca9-95ed-84cccbffadac
 #define NS_IPRESSHELL_IID \
-{ 0x4f512d0b, 0xc58c, 0x4fc9, \
-  { 0xae, 0x42, 0x8a, 0xa6, 0xd9, 0x92, 0xe7, 0xae } }
+{ 0xb07c5323, 0x3061, 0x4ca9, \
+  { 0x95, 0xed, 0x84, 0xcc, 0xcb, 0xff, 0xad, 0xac } }
 
 // debug VerifyReflow flags
 #define VERIFY_REFLOW_ON                    0x01
@@ -404,12 +404,6 @@ public:
    * coordinates for aWidth and aHeight must be in standard nscoord's.
    */
   virtual nsresult ResizeReflow(nscoord aWidth, nscoord aHeight) = 0;
-  /**
-   * Reflow, and also change presshell state so as to only permit
-   * reflowing off calls to ResizeReflowOverride() in the future.
-   * ResizeReflow() calls are ignored after ResizeReflowOverride().
-   */
-  virtual nsresult ResizeReflowOverride(nscoord aWidth, nscoord aHeight) = 0;
   /**
    * Do the same thing as ResizeReflow but even if ResizeReflowOverride was
    * called previously.
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index cec4d749275f..5b3ec57c08c8 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -2328,22 +2328,34 @@ nsLayoutUtils::MatrixTransformRectOut(const nsRect &aBounds,
 {
   nsRect outside = aBounds;
   outside.ScaleRoundOut(1/aFactor);
-  gfxRect image = gfxRect(outside.x, outside.y, outside.width, outside.height);
-  image.TransformBounds(aMatrix);
-  return RoundGfxRectToAppRect(image, aFactor);
+  RectDouble image = RectDouble(outside.x, outside.y,
+                                outside.width, outside.height);
+
+  RectDouble maxBounds = RectDouble(double(nscoord_MIN) / aFactor * 0.5,
+                                    double(nscoord_MIN) / aFactor * 0.5,
+                                    double(nscoord_MAX) / aFactor,
+                                    double(nscoord_MAX) / aFactor);
+  image = aMatrix.TransformAndClipBounds(image, maxBounds);
+  return RoundGfxRectToAppRect(ThebesRect(image), aFactor);
 }
 
 nsRect
 nsLayoutUtils::MatrixTransformRect(const nsRect &aBounds,
                                    const Matrix4x4 &aMatrix, float aFactor)
 {
-  gfxRect image = gfxRect(NSAppUnitsToDoublePixels(aBounds.x, aFactor),
-                          NSAppUnitsToDoublePixels(aBounds.y, aFactor),
-                          NSAppUnitsToDoublePixels(aBounds.width, aFactor),
-                          NSAppUnitsToDoublePixels(aBounds.height, aFactor));
-  image.TransformBounds(aMatrix);
+  RectDouble image = RectDouble(NSAppUnitsToDoublePixels(aBounds.x, aFactor),
+                                NSAppUnitsToDoublePixels(aBounds.y, aFactor),
+                                NSAppUnitsToDoublePixels(aBounds.width, aFactor),
+                                NSAppUnitsToDoublePixels(aBounds.height, aFactor));
 
-  return RoundGfxRectToAppRect(image, aFactor);
+  RectDouble maxBounds = RectDouble(double(nscoord_MIN) / aFactor * 0.5,
+                                    double(nscoord_MIN) / aFactor * 0.5,
+                                    double(nscoord_MAX) / aFactor,
+                                    double(nscoord_MAX) / aFactor);
+
+  image = aMatrix.TransformAndClipBounds(image, maxBounds);
+
+  return RoundGfxRectToAppRect(ThebesRect(image), aFactor);
 }
 
 nsPoint
@@ -2687,7 +2699,11 @@ TransformGfxRectToAncestor(nsIFrame *aFrame,
     *aPreservesAxisAlignedRectangles =
       ctm.Is2D(&matrix2d) && matrix2d.PreservesAxisAlignedRectangles();
   }
-  return ctm.TransformBounds(aRect);
+  Rect maxBounds = Rect(-std::numeric_limits<float>::max() * 0.5,
+                        -std::numeric_limits<float>::max() * 0.5,
+                        std::numeric_limits<float>::max(),
+                        std::numeric_limits<float>::max());
+  return ctm.TransformAndClipBounds(aRect, maxBounds);
 }
 
 static SVGTextFrame*
@@ -8267,17 +8283,6 @@ nsLayoutUtils::SetScrollPositionClampingScrollPortSize(nsIPresShell* aPresShell,
   MaybeReflowForInflationScreenSizeChange(presContext);
 }
 
-/* static */ void
-nsLayoutUtils::SetCSSViewport(nsIPresShell* aPresShell, CSSSize aSize)
-{
-  MOZ_ASSERT(aSize.width >= 0.0 && aSize.height >= 0.0);
-
-  nscoord width = nsPresContext::CSSPixelsToAppUnits(aSize.width);
-  nscoord height = nsPresContext::CSSPixelsToAppUnits(aSize.height);
-
-  aPresShell->ResizeReflowOverride(width, height);
-}
-
 /* static */ FrameMetrics
 nsLayoutUtils::ComputeFrameMetrics(nsIFrame* aForFrame,
                                    nsIFrame* aScrollFrame,
diff --git a/layout/base/nsLayoutUtils.h b/layout/base/nsLayoutUtils.h
index d7737cccb2d0..7de27debd5df 100644
--- a/layout/base/nsLayoutUtils.h
+++ b/layout/base/nsLayoutUtils.h
@@ -123,6 +123,7 @@ class nsLayoutUtils
   typedef mozilla::gfx::Float Float;
   typedef mozilla::gfx::Point Point;
   typedef mozilla::gfx::Rect Rect;
+  typedef mozilla::gfx::RectDouble RectDouble;
   typedef mozilla::gfx::Matrix4x4 Matrix4x4;
   typedef mozilla::gfx::RectCornerRadii RectCornerRadii;
   typedef mozilla::gfx::StrokeOptions StrokeOptions;
@@ -2680,12 +2681,6 @@ public:
   static void SetScrollPositionClampingScrollPortSize(nsIPresShell* aPresShell,
                                                       CSSSize aSize);
 
-  /**
-   * Set the CSS viewport to the given size
-   * (see nsIDOMWindowUtils.setCSSViewport).
-   */
-  static void SetCSSViewport(nsIPresShell* aPresShell, CSSSize aSize);
-
   static FrameMetrics ComputeFrameMetrics(nsIFrame* aForFrame,
                                           nsIFrame* aScrollFrame,
                                           nsIContent* aContent,
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index f24711f0dc68..0bdd4651092f 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -784,7 +784,6 @@ PresShell::PresShell()
 #endif
   mRenderFlags = 0;
   mResolution = 1.0;
-  mViewportOverridden = false;
 
   mScrollPositionClampingScrollPortSizeSet = false;
 
@@ -1766,35 +1765,9 @@ PresShell::AsyncResizeEventCallback(nsITimer* aTimer, void* aPresShell)
   static_cast<PresShell*>(aPresShell)->FireResizeEvent();
 }
 
-nsresult
-PresShell::ResizeReflowOverride(nscoord aWidth, nscoord aHeight)
-{
-  mViewportOverridden = true;
-
-  if (mMobileViewportManager) {
-    // Once the viewport is explicitly overridden, we don't need the
-    // MobileViewportManager any more (in this presShell at least). Destroying
-    // it simplifies things because then it can maintain an invariant that any
-    // time it gets a meta-viewport change (for example) it knows it must
-    // recompute the CSS viewport and do a reflow. If we didn't destroy it here
-    // then there would be times where a meta-viewport change would have no
-    // effect.
-    mMobileViewportManager->Destroy();
-    mMobileViewportManager = nullptr;
-  }
-
-  return ResizeReflowIgnoreOverride(aWidth, aHeight);
-}
-
 nsresult
 PresShell::ResizeReflow(nscoord aWidth, nscoord aHeight)
 {
-  if (mViewportOverridden) {
-    // The viewport has been overridden, and this reflow request
-    // didn't ask to ignore the override.  Pretend it didn't happen.
-    return NS_OK;
-  }
-
   if (mZoomConstraintsClient) {
     // If we have a ZoomConstraintsClient and the available screen area
     // changed, then we might need to disable double-tap-to-zoom, so notify
@@ -7891,7 +7864,7 @@ PresShell::HandleEventInternal(WidgetEvent* aEvent, nsEventStatus* aStatus)
         isHandlingUserInput = true;
         break;
 
-      case NS_DRAGDROP_DROP: {
+      case eDrop: {
         nsCOMPtr<nsIDragSession> session = nsContentUtils::GetDragSession();
         if (session) {
           bool onlyChromeDrop = false;
diff --git a/layout/base/nsPresShell.h b/layout/base/nsPresShell.h
index ed032a2c9a6c..afbb0bcb2bb1 100644
--- a/layout/base/nsPresShell.h
+++ b/layout/base/nsPresShell.h
@@ -105,7 +105,6 @@ public:
   virtual void EndObservingDocument() override;
   virtual nsresult Initialize(nscoord aWidth, nscoord aHeight) override;
   virtual nsresult ResizeReflow(nscoord aWidth, nscoord aHeight) override;
-  virtual nsresult ResizeReflowOverride(nscoord aWidth, nscoord aHeight) override;
   virtual nsresult ResizeReflowIgnoreOverride(nscoord aWidth, nscoord aHeight) override;
   virtual nsIPageSequenceFrame* GetPageSequenceFrame() const override;
   virtual nsCanvasFrame* GetCanvasFrame() const override;
@@ -359,7 +358,7 @@ public:
   virtual nsresult SetIsActive(bool aIsActive) override;
 
   virtual bool GetIsViewportOverridden() override {
-    return mViewportOverridden || (mMobileViewportManager != nullptr);
+    return (mMobileViewportManager != nullptr);
   }
 
   virtual bool IsLayoutFlushObserver() override
@@ -861,7 +860,6 @@ protected:
   bool                      mDocumentLoading : 1;
   bool                      mIgnoreFrameDestruction : 1;
   bool                      mHaveShutDown : 1;
-  bool                      mViewportOverridden : 1;
   bool                      mLastRootReflowHadUnconstrainedBSize : 1;
   bool                      mNoDelayedMouseEvents : 1;
   bool                      mNoDelayedKeyEvents : 1;
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index fd578d5d0060..b4170e995fef 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -367,10 +367,10 @@ asserts-if(winWidget,0-3) load 499885-1.xhtml
 load 501535-1.html
 load 503961-1.xhtml
 load 503961-2.html
-asserts-if(gtkWidget&&browserIsRemote,1) load 505912-1.html # Bug 1195472
 load 508168-1.html
 load 508816-1.xul
 load 508908-1.html
+load 505912-1.html
 load 509749-1.html
 load 511482.html
 load 512724-1.html
diff --git a/layout/generic/nsPluginFrame.cpp b/layout/generic/nsPluginFrame.cpp
index 9d295e595c58..8c32bfb0d234 100644
--- a/layout/generic/nsPluginFrame.cpp
+++ b/layout/generic/nsPluginFrame.cpp
@@ -306,8 +306,8 @@ nsPluginFrame::PrepForDrawing(nsIWidget *aWidget)
     viewMan->InsertChild(view, mInnerView, nullptr, true);
 
     mWidget->SetParent(parentWidget);
-    mWidget->Show(true);
     mWidget->Enable(true);
+    mWidget->Show(true);
 
     // Set the plugin window to have an empty clip region until we know
     // what our true position, size and clip region are. These
diff --git a/layout/inspector/inIDOMUtils.idl b/layout/inspector/inIDOMUtils.idl
index 1488f219b716..daaff3a98eb3 100644
--- a/layout/inspector/inIDOMUtils.idl
+++ b/layout/inspector/inIDOMUtils.idl
@@ -25,7 +25,21 @@ interface inIDOMUtils : nsISupports
                           [optional] out unsigned long aLength,
                           [array, size_is (aLength), retval] out nsISupports aSheets);
   nsISupportsArray getCSSStyleRules(in nsIDOMElement aElement, [optional] in DOMString aPseudo);
+
+  /**
+   * Get the line number of a rule.
+   *
+   * @param nsIDOMCSSRule aRule The rule.
+   * @return The rule's line number.  Line numbers are 1-based.
+   */
   unsigned long getRuleLine(in nsIDOMCSSRule aRule);
+
+  /**
+   * Get the column number of a rule.
+   *
+   * @param nsIDOMCSSRule aRule The rule.
+   * @return The rule's column number.  Column numbers are 1-based.
+   */
   unsigned long getRuleColumn(in nsIDOMCSSRule aRule);
 
   /**
diff --git a/layout/reftests/bugs/593243-1.html b/layout/reftests/bugs/593243-1.html
index bb217438a1cd..c54d10b6fd49 100644
--- a/layout/reftests/bugs/593243-1.html
+++ b/layout/reftests/bugs/593243-1.html
@@ -1,10 +1,10 @@
 <!DOCTYPE HTML>
 <html class="reftest-wait"
-      reftest-viewport-w="600" reftest-viewport-h="400"
       reftest-scrollport-w="800" reftest-scrollport-h="1000"
       reftest-displayport-w="800" reftest-displayport-h="1000"
       reftest-no-sync-layers>
 <head>
+  <meta name="viewport" content="width=600; height=400; initial-scale=1.0">
   <title></title>
 <script type="text/javascript">
 function initialPaint() {
diff --git a/layout/reftests/bugs/593243-2.html b/layout/reftests/bugs/593243-2.html
index 3641d3463452..4ca4f3fa415e 100644
--- a/layout/reftests/bugs/593243-2.html
+++ b/layout/reftests/bugs/593243-2.html
@@ -1,10 +1,10 @@
 <!DOCTYPE HTML>
 <html class="reftest-wait"
-      reftest-viewport-w="600" reftest-viewport-h="400"
       reftest-scrollport-w="800" reftest-scrollport-h="1000"
       reftest-displayport-w="800" reftest-displayport-h="1000"
       reftest-no-sync-layers>
 <head>
+  <meta name="viewport" content="width=600; height=400; initial-scale=1.0">
   <title></title>
 <script type="text/javascript">
 function initialPaint() {
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 94f2b8388f54..27a186d7d9b2 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1594,8 +1594,8 @@ skip-if(B2G||Mulet) fuzzy-if(d2d,52,1051) fuzzy-if(OSX==1008,129,1068) == 586683
 == 589615-1b.html 589615-1-ref.html
 == 589672-1.html 589672-1-ref.html
 != 589682-1.html 589682-1-notref.html
-skip-if(Android) == 593243-1.html 593243-1-ref.html # bug 593168
-skip-if(Android) == 593243-2.html 593243-2-ref.html # bug 593168
+pref(dom.meta-viewport.enabled,true) skip-if(Android) == 593243-1.html 593243-1-ref.html # bug 593168
+pref(dom.meta-viewport.enabled,true) skip-if(Android) == 593243-2.html 593243-2-ref.html # bug 593168
 == 593544-1.html 593544-1-ref.html
 random-if(Android) == 594333-1.html 594333-1-ref.html
 fuzzy-if(B2G,1,40000) == 594624-1.html 594624-1-ref.html
diff --git a/layout/reftests/reftest-sanity/reftest.list b/layout/reftests/reftest-sanity/reftest.list
index b12073ef9949..ecf354d21d87 100644
--- a/layout/reftests/reftest-sanity/reftest.list
+++ b/layout/reftests/reftest-sanity/reftest.list
@@ -90,16 +90,16 @@ fails == data:text/plain,HELLO about:blank
 needs-focus == data:text/plain, about:blank
 
 # Sanity check of viewport+displayport overrides
-skip-if(!browserIsRemote) != test-displayport-2.html test-displayport-ref.html # bug 593168
+pref(dom.meta-viewport.enabled,true) skip-if(!browserIsRemote) != test-displayport-2.html test-displayport-ref.html # bug 593168
 skip-if(!browserIsRemote) fails-if(OSX&&layersGPUAccelerated) fuzzy-if(layersOMTC,1,1390) random-if(Android&&AndroidVersion<15) random-if(B2G||B2GDT||Mulet) random-if(transparentScrollbars) == 647192-1.html 647192-1-ref.html # Initial mulet triage: parity with B2G/B2G Desktop
 skip-if(!browserIsRemote||((B2G&&browserIsRemote)||Mulet)) == 656041-1.html 656041-1-ref.html # Initial mulet triage: parity with B2G/B2G Desktop
-skip-if(!browserIsRemote||layersOMTC) == test-displayport-bg.html test-displayport-ref.html # bug 694706
+pref(dom.meta-viewport.enabled,true) skip-if(!browserIsRemote||layersOMTC) == test-displayport-bg.html test-displayport-ref.html # bug 694706
 
 # IPC Position-fixed frames/layers test
 # Fixed layers are temporarily disabled (bug 656167).
-#skip-if(!browserIsRemote) == test-pos-fixed.html test-pos-fixed-ref.html
-#skip-if(!browserIsRemote) == test-bg-attachment-fixed.html test-bg-attachment-fixed-ref.html
-skip-if(!browserIsRemote) == test-pos-fixed-transform.html test-pos-fixed-transform-ref.html
+#pref(dom.meta-viewport.enabled,true) skip-if(!browserIsRemote) == test-pos-fixed.html test-pos-fixed-ref.html
+#pref(dom.meta-viewport.enabled,true) skip-if(!browserIsRemote) == test-bg-attachment-fixed.html test-bg-attachment-fixed-ref.html
+pref(dom.meta-viewport.enabled,true) skip-if(!browserIsRemote) == test-pos-fixed-transform.html test-pos-fixed-transform-ref.html
 
 # reftest syntax: require-or
 require-or(unrecognizedCondition,skip) script scripttest-fail.html
diff --git a/layout/reftests/reftest-sanity/test-bg-attachment-fixed-ref.html b/layout/reftests/reftest-sanity/test-bg-attachment-fixed-ref.html
index bf2abc0488e4..f336883097ec 100644
--- a/layout/reftests/reftest-sanity/test-bg-attachment-fixed-ref.html
+++ b/layout/reftests/reftest-sanity/test-bg-attachment-fixed-ref.html
@@ -1,6 +1,6 @@
-<html reftest-viewport-w="800" reftest-viewport-h="1000"
-      reftest-displayport-w="800" reftest-displayport-h="1000">
+<html reftest-displayport-w="800" reftest-displayport-h="1000">
 <head>
+<meta name="viewport" content="width=800; height=1000; initial-scale=1.0">
 <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
 <style type="text/css">
 body
diff --git a/layout/reftests/reftest-sanity/test-bg-attachment-fixed.html b/layout/reftests/reftest-sanity/test-bg-attachment-fixed.html
index cfd2d5514ecb..12ca1c2c5152 100644
--- a/layout/reftests/reftest-sanity/test-bg-attachment-fixed.html
+++ b/layout/reftests/reftest-sanity/test-bg-attachment-fixed.html
@@ -1,7 +1,7 @@
 <html style="overflow:hidden"
-      reftest-viewport-w="800" reftest-viewport-h="1000"
       reftest-displayport-w="800" reftest-displayport-h="1000">
 <head>
+<meta name="viewport" content="width=800; height=1000; initial-scale=1.0">
 <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
 <script>
   function run() {
diff --git a/layout/reftests/reftest-sanity/test-displayport-2.html b/layout/reftests/reftest-sanity/test-displayport-2.html
index b8b1fefd4829..6772732d76d7 100644
--- a/layout/reftests/reftest-sanity/test-displayport-2.html
+++ b/layout/reftests/reftest-sanity/test-displayport-2.html
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML>
-<html reftest-viewport-w="100" reftest-viewport-h="100"
-      reftest-displayport-w="200" reftest-displayport-h="200">
+<html reftest-displayport-w="200" reftest-displayport-h="200">
+<meta name="viewport" content="width=100; height=100; initial-scale=1.0">
 <body>
   <div style="position: absolute; left:0px; top:0px;width:800px; height:1000px; background:green;"></div>
 </body>
diff --git a/layout/reftests/reftest-sanity/test-displayport-bg.html b/layout/reftests/reftest-sanity/test-displayport-bg.html
index cdc9e2399c49..6044de36f2c9 100644
--- a/layout/reftests/reftest-sanity/test-displayport-bg.html
+++ b/layout/reftests/reftest-sanity/test-displayport-bg.html
@@ -1,7 +1,7 @@
 <!DOCTYPE HTML>
-<html reftest-viewport-w="100" reftest-viewport-h="100"
-      reftest-displayport-w="400" reftest-displayport-h="500"
+<html reftest-displayport-w="400" reftest-displayport-h="500"
       reftest-async-scroll>
+<meta name="viewport" content="width=100; height=100; initial-scale=1.0">
 <body bgcolor=green style="position: absolute; left:0px; top:0px;width:800px; height:1000px;"></body>
 </html>
 
diff --git a/layout/reftests/reftest-sanity/test-pos-fixed-ref.html b/layout/reftests/reftest-sanity/test-pos-fixed-ref.html
index 3f566d4c6b84..864e6418cdba 100644
--- a/layout/reftests/reftest-sanity/test-pos-fixed-ref.html
+++ b/layout/reftests/reftest-sanity/test-pos-fixed-ref.html
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML>
-<html reftest-viewport-w="200" reftest-viewport-h="100"
-      reftest-displayport-w="200" reftest-displayport-h="100"
+<html reftest-displayport-w="200" reftest-displayport-h="100"
+<meta name="viewport" content="width=200; height=100; initial-scale=1.0">
 <body>
 <div style="position:fixed;top:0px;width:100%;height:10px;background-color:green;"></div>
 </body>
diff --git a/layout/reftests/reftest-sanity/test-pos-fixed-transform-ref.html b/layout/reftests/reftest-sanity/test-pos-fixed-transform-ref.html
index 358ad4bf91ce..0b2870ff558f 100644
--- a/layout/reftests/reftest-sanity/test-pos-fixed-transform-ref.html
+++ b/layout/reftests/reftest-sanity/test-pos-fixed-transform-ref.html
@@ -1,5 +1,6 @@
 <!DOCTYPE HTML>
-<html reftest-viewport-w="800" reftest-viewport-h="1000">
+<html>
+<meta name="viewport" content="width=800; height=1000; initial-scale=1.0">
 <body>
 <div style="position: fixed; background: lightblue; top: 0; left: 0; width:100px; height:100px; -moz-transform: translate(360px,0px);"/>
 </body>
diff --git a/layout/reftests/reftest-sanity/test-pos-fixed-transform.html b/layout/reftests/reftest-sanity/test-pos-fixed-transform.html
index 4518e03d8917..d15b64614935 100644
--- a/layout/reftests/reftest-sanity/test-pos-fixed-transform.html
+++ b/layout/reftests/reftest-sanity/test-pos-fixed-transform.html
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML>
-<html reftest-viewport-w="800" reftest-viewport-h="1000"
-      reftest-displayport-w="800" reftest-displayport-h="1000">
+<html reftest-displayport-w="800" reftest-displayport-h="1000">
+<meta name="viewport" content="width=800; height=1000; initial-scale=1.0">
 <body>
 <div style="position: fixed; background: lightblue; top: 0; left: 0; width:100px; height:100px; -moz-transform: translate(360px,0px);"/>
 </body>
diff --git a/layout/reftests/reftest-sanity/test-pos-fixed.html b/layout/reftests/reftest-sanity/test-pos-fixed.html
index 28d9022a9942..7c792cf22468 100644
--- a/layout/reftests/reftest-sanity/test-pos-fixed.html
+++ b/layout/reftests/reftest-sanity/test-pos-fixed.html
@@ -1,7 +1,7 @@
 <!DOCTYPE HTML>
-<html reftest-viewport-w="200" reftest-viewport-h="100"
-      reftest-displayport-w="200" reftest-displayport-h="100"
+<html reftest-displayport-w="200" reftest-displayport-h="100"
       reftest-displayport-x="0" reftest-displayport-y="10">
+<meta name="viewport" content="width=200; height=100; initial-scale=1.0">
 <body>
 <div style="position:fixed;top:0px;width:100%;height:10px;background-color:green;">&nbsp;</div>
 </body>
diff --git a/layout/reftests/transform-3d/1157984-1.html b/layout/reftests/transform-3d/1157984-1.html
new file mode 100644
index 000000000000..be0f6526aa43
--- /dev/null
+++ b/layout/reftests/transform-3d/1157984-1.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html lang="en-US" reftest-zoom="1.0">
+<head>
+  <title>Testcase, bug 1157984</title>
+  <meta charset=UTF-8>
+  <style type="text/css">
+
+  #outer {
+    position:absolute;
+    width: 60px;
+    height: 60px;
+    perspective-origin: 300px 300px;
+    perspective: 300px;
+    overflow: hidden;
+  }
+
+  #inner {
+    position:absolute;
+    background-color: green;
+    width: 600px;
+    height: 600px;
+    transform-origin: 300px 300px 0px;
+    transform: translateZ(300px) rotateY(-2rad) translateZ(300px);
+  }
+  </style>
+</head>
+<body>
+  <div id="outer">
+    <div id="inner"></div>
+  </div>
+</body>
+</html>
diff --git a/layout/reftests/transform-3d/reftest.list b/layout/reftests/transform-3d/reftest.list
index 3703ff67c6d2..80cfa1159059 100644
--- a/layout/reftests/transform-3d/reftest.list
+++ b/layout/reftests/transform-3d/reftest.list
@@ -57,6 +57,7 @@ pref(layout.css.will-change.enabled,true) != willchange-containing-block.html?wi
 fuzzy-if(winWidget&&!layersGPUAccelerated,1,606) == scroll-perspective-1.html scroll-perspective-1-ref.html
 # Bugs
 fails-if(!layersGPUAccelerated) == 1035611-1.html 1035611-1-ref.html # Bug 1072898 for !layersGPUAccelerated failures
+!= 1157984-1.html about:blank # Bug 1157984
 fuzzy(3,99) == animate-cube-radians.html animate-cube-radians-ref.html # subpixel AA
 fuzzy(3,99) fuzzy-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)&&!layersGPUAccelerated,16,6) fuzzy-if(Mulet,16,9) == animate-cube-radians-zoom.html animate-cube-radians-zoom-ref.html
 != animate-cube-radians-ref.html animate-cube-radians-zoom-ref.html
diff --git a/layout/style/test/chrome/bug418986-2.js b/layout/style/test/chrome/bug418986-2.js
index d3fc28096b59..a8a214019b66 100644
--- a/layout/style/test/chrome/bug418986-2.js
+++ b/layout/style/test/chrome/bug418986-2.js
@@ -4,8 +4,6 @@
 /* jshint loopfunc:true */
 /* global window, screen, ok, SpecialPowers, matchMedia */
 
-SimpleTest.waitForExplicitFinish();
-
 // Expected values. Format: [name, pref_off_value, pref_on_value]
 // If pref_*_value is an array with two values, then we will match
 // any value in between those two values. If a value is null, then
@@ -166,19 +164,22 @@ let cssLine = function (query, clazz, id, color) {
          " { background-color: " + color + "; } }\n";
 };
 
+// __constructQuery(key, val)__.
+// Creates a CSS media query from key and val. If key is an array of
+// two elements, constructs a range query (using min- and max-).
+let constructQuery = function (key, val) {
+  return Array.isArray(val) ?
+    "(min-" + key + ": " + val[0] + ") and (max-" +  key + ": " + val[1] + ")" :
+    "(" + key + ": " + val + ")";
+};
+
 // __mediaQueryCSSLine(key, val, color)__.
 // Creates a line containing a CSS media query and a CSS expression.
 let mediaQueryCSSLine = function (key, val, color) {
   if (val === null) {
     return "";
   }
-  let query;
-  if (Array.isArray(val)) {
-    query = "(min-" + key + ": " + val[0] + ") and (max-" +  key + ": " + val[1] + ")";
-  } else {
-    query = "(" + key + ": " + val + ")";
-  }
-  return cssLine(query, "spoof", key, color);
+  return cssLine(constructQuery(key, val), "spoof", key, color);
 };
 
 // __suppressedMediaQueryCSSLine(key, color)__.
@@ -248,33 +249,67 @@ let testOSXFontSmoothing = function (resisting) {
                "-moz-osx-font-smoothing");
 };
 
-// An iterator yielding pref values for two consecutive tests.
-let prefVals = (for (prefVal of [false, true]) prefVal);
+// __sleep(timeoutMs)__.
+// Returns a promise that resolves after the given timeout.
+let sleep = function (timeoutMs) {
+  return new Promise(function(resolve, reject) {
+    window.setTimeout(resolve);
+  });
+};
+
+// __testMediaQueriesInPictureElements(resisting)__.
+// Test to see if media queries are properly spoofed in picture elements
+// when we are resisting fingerprinting. A generator function
+// to be used with SpawnTask.js.
+let testMediaQueriesInPictureElements = function* (resisting) {
+  let lines = "";
+  for (let [key, offVal, onVal] of expected_values) {
+    let expected = resisting ? onVal : offVal;
+    if (expected) {
+      let query = constructQuery(key, expected);
+      lines += "<picture>\n";
+      lines += " <source srcset='/tests/layout/style/test/chrome/match.png' media='" + query + "' />\n";
+      lines += " <img title='" + key + ":" + expected + "' class='testImage' src='/tests/layout/style/test/chrome/mismatch.png' alt='" + key + "' />\n";
+      lines += "</picture><br/>\n";
+    }
+  }
+  document.getElementById("pictures").innerHTML = lines;
+  var testImages = document.getElementsByClassName("testImage");
+  yield sleep(0);
+  for (let testImage of testImages) {
+    ok(testImage.currentSrc.endsWith("/match.png"), "Media query '" + testImage.title + "' in picture should match.");
+  }
+};
+
+// __pushPref(key, value)__.
+// Set a pref value asynchronously, returning a promise that resolves
+// when it succeeds.
+let pushPref = function (key, value) {
+  return new Promise(function(resolve, reject) {
+    SpecialPowers.pushPrefEnv({"set": [[key, value]]}, resolve);
+  });
+};
 
 // __test(isContent)__.
-// Run all tests.
-let test = function(isContent) {
-  let {value: prefValue, done} = prefVals.next();
-  if (done) {
-    SimpleTest.finish();
-    return;
+// Run all tests. A generator function to be used
+// with SpawnTask.js.
+let test = function* (isContent) {
+  for (prefValue of [false, true]) {
+    yield pushPref("privacy.resistFingerprinting", prefValue);
+    let resisting = prefValue && isContent;
+    expected_values.forEach(
+      function ([key, offVal, onVal]) {
+        testMatch(key, resisting ? onVal : offVal);
+      });
+    testToggles(resisting);
+    if (OS === "WINNT") {
+      testWindowsSpecific(resisting, "-moz-os-version", windows_versions);
+      testWindowsSpecific(resisting, "-moz-windows-theme", windows_themes);
+    }
+    testCSS(resisting);
+    if (OS === "Darwin") {
+      testOSXFontSmoothing(resisting);
+    }
+    yield testMediaQueriesInPictureElements(resisting);
   }
-  SpecialPowers.pushPrefEnv({set: [["privacy.resistFingerprinting", prefValue]]},
-    function () {
-      let resisting = prefValue && isContent;
-      expected_values.forEach(
-        function ([key, offVal, onVal]) {
-          testMatch(key, resisting ? onVal : offVal);
-        });
-      testToggles(resisting);
-      if (OS === "WINNT") {
-        testWindowsSpecific(resisting, "-moz-os-version", windows_versions);
-        testWindowsSpecific(resisting, "-moz-windows-theme", windows_themes);
-      }
-      testCSS(resisting);
-      if (OS === "Darwin") {
-        testOSXFontSmoothing(resisting);
-      }
-      test(isContent);
-    });
 };
diff --git a/layout/style/test/chrome/chrome.ini b/layout/style/test/chrome/chrome.ini
index e84b98339216..6064cce12b28 100644
--- a/layout/style/test/chrome/chrome.ini
+++ b/layout/style/test/chrome/chrome.ini
@@ -6,6 +6,8 @@ support-files =
   bug535806-html.html
   bug535806-xul.xul
   hover_helper.html
+  match.png
+  mismatch.png
 
 [test_addSheet.html]
 [test_additional_sheets.html]
diff --git a/layout/style/test/chrome/match.png b/layout/style/test/chrome/match.png
new file mode 100644
index 000000000000..d3f299bf5824
Binary files /dev/null and b/layout/style/test/chrome/match.png differ
diff --git a/layout/style/test/chrome/mismatch.png b/layout/style/test/chrome/mismatch.png
new file mode 100644
index 000000000000..8f9da3f00ff9
Binary files /dev/null and b/layout/style/test/chrome/mismatch.png differ
diff --git a/layout/style/test/chrome/test_bug418986-2.xul b/layout/style/test/chrome/test_bug418986-2.xul
index 8424e15ac108..2e5f8e6879e2 100644
--- a/layout/style/test/chrome/test_bug418986-2.xul
+++ b/layout/style/test/chrome/test_bug418986-2.xul
@@ -7,13 +7,14 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=418986
 <window title="Mozilla Bug 418986"
         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
   <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SpawnTask.js"/>
   <!-- test results are displayed in the html:body -->
   <body xmlns="http://www.w3.org/1999/xhtml">
   <style id="test-css" scoped="true"></style>
   <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=418986"
      target="_blank">Mozilla Bug 418986</a>
   <p id="display"></p>
-
+  <p id="pictures"></p>
   </body>
 
   <script type="text/javascript;version=1.7" src="bug418986-2.js"></script>
@@ -21,7 +22,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=418986
   <script type="text/javascript;version=1.7">
     // Run all tests now.
     window.onload = function () {
-      test(false);
+      add_task(function* () {
+        yield test(false);
+      });
     };
   </script>
 </window>
diff --git a/layout/style/test/mochitest.ini b/layout/style/test/mochitest.ini
index 97a0b067cb53..15fec346d291 100644
--- a/layout/style/test/mochitest.ini
+++ b/layout/style/test/mochitest.ini
@@ -6,6 +6,8 @@ support-files =
   ccd-standards.html
   css_properties.js
   chrome/bug418986-2.js
+  chrome/match.png
+  chrome/mismatch.png
   descriptor_database.js
   empty.html
   media_queries_dynamic_xbl_binding.xml
diff --git a/layout/style/test/test_bug418986-2.html b/layout/style/test/test_bug418986-2.html
index 15d7c71ce44e..aa9ff8af1f29 100644
--- a/layout/style/test/test_bug418986-2.html
+++ b/layout/style/test/test_bug418986-2.html
@@ -7,13 +7,16 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=418986
   <meta charset="utf-8">
   <title>Test 2/3 for Bug #418986: Resist fingerprinting by preventing exposure of screen and system info</title>
   <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SpawnTask.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
   <style id="test-css"></style>
   <script type="text/javascript;version=1.7" src="chrome/bug418986-2.js"></script>
   <script type="text/javascript;version=1.7">
     // Run all tests now.
     window.onload = function () {
-      test(true);
+      add_task(function* () {
+        yield test(true);
+      });
     };
   </script>
 </head>
@@ -23,6 +26,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=418986
 <div id="content" style="display: none">
 
 </div>
+<p id="pictures"></p>
 <pre id="test">
 </pre>
 </body>
diff --git a/layout/tools/reftest/README.txt b/layout/tools/reftest/README.txt
index e8d50a0dfe9a..cb0b7e62d6db 100644
--- a/layout/tools/reftest/README.txt
+++ b/layout/tools/reftest/README.txt
@@ -512,13 +512,6 @@ are 800/zoom and 1000/zoom. For best results therefore, choose zoom factors
 that do not require rounding when we calculate the number of appunits per
 device pixel; i.e. the zoom factor should divide 60, so 60/zoom is an integer.
 
-Setting Viewport Size: reftest-viewport-w/h="<int>"
-===================================================
-
-If either of the "reftest-viewport-w" and "reftest-viewport-h" attributes on
-the root element are non-zero, sets the CSS viewport to the given size in
-CSS pixels. This does not affect the size of the snapshot that is taken.
-
 Setting Scrollport Size: reftest-scrollport-w/h="<int>"
 =======================================================
 
diff --git a/layout/tools/reftest/reftest-content.js b/layout/tools/reftest/reftest-content.js
index 2495e0212284..db8642d3a82c 100644
--- a/layout/tools/reftest/reftest-content.js
+++ b/layout/tools/reftest/reftest-content.js
@@ -196,13 +196,6 @@ function setupViewport(contentRootElement) {
         return;
     }
 
-    var vw = attrOrDefault(contentRootElement, "reftest-viewport-w", 0);
-    var vh = attrOrDefault(contentRootElement, "reftest-viewport-h", 0);
-    if (vw !== 0 || vh !== 0) {
-        LogInfo("Setting viewport to <w="+ vw +", h="+ vh +">");
-        windowUtils().setCSSViewport(vw, vh);
-    }
-
     var sw = attrOrDefault(contentRootElement, "reftest-scrollport-w", 0);
     var sh = attrOrDefault(contentRootElement, "reftest-scrollport-h", 0);
     if (sw !== 0 || sh !== 0) {
diff --git a/layout/xul/nsImageBoxFrame.cpp b/layout/xul/nsImageBoxFrame.cpp
index 1df621fc5e82..83d8c69032da 100644
--- a/layout/xul/nsImageBoxFrame.cpp
+++ b/layout/xul/nsImageBoxFrame.cpp
@@ -105,7 +105,7 @@ nsImageBoxFrameEvent::Run()
 void
 FireImageDOMEvent(nsIContent* aContent, EventMessage aMessage)
 {
-  NS_ASSERTION(aMessage == NS_LOAD || aMessage == NS_LOAD_ERROR,
+  NS_ASSERTION(aMessage == eLoad || aMessage == eLoadError,
                "invalid message");
 
   nsCOMPtr<nsIRunnable> event = new nsImageBoxFrameEvent(aContent, aMessage);
@@ -780,13 +780,13 @@ nsImageBoxFrame::OnLoadComplete(imgIRequest* aRequest, nsresult aStatus)
 {
   if (NS_SUCCEEDED(aStatus)) {
     // Fire an onload DOM event.
-    FireImageDOMEvent(mContent, NS_LOAD);
+    FireImageDOMEvent(mContent, eLoad);
   } else {
     // Fire an onerror DOM event.
     mIntrinsicSize.SizeTo(0, 0);
     PresContext()->PresShell()->
       FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
-    FireImageDOMEvent(mContent, NS_LOAD_ERROR);
+    FireImageDOMEvent(mContent, eLoadError);
   }
 
   return NS_OK;
diff --git a/layout/xul/tree/nsTreeBodyFrame.cpp b/layout/xul/tree/nsTreeBodyFrame.cpp
index 10780395b684..62fed77ae5dd 100644
--- a/layout/xul/tree/nsTreeBodyFrame.cpp
+++ b/layout/xul/tree/nsTreeBodyFrame.cpp
@@ -2581,7 +2581,7 @@ nsTreeBodyFrame::HandleEvent(nsPresContext* aPresContext,
       InvalidateRow(mMouseOverRow);
       mMouseOverRow = -1;
     }
-  } else if (aEvent->mMessage == NS_DRAGDROP_ENTER) {
+  } else if (aEvent->mMessage == eDragEnter) {
     if (!mSlots)
       mSlots = new Slots();
 
@@ -2598,7 +2598,7 @@ nsTreeBodyFrame::HandleEvent(nsPresContext* aPresContext,
     mSlots->mDropRow = -1;
     mSlots->mDropOrient = -1;
     mSlots->mDragAction = GetDropEffect(aEvent);
-  } else if (aEvent->mMessage == NS_DRAGDROP_OVER) {
+  } else if (aEvent->mMessage == eDragOver) {
     // The mouse is hovering over this tree. If we determine things are
     // different from the last time, invalidate the drop feedback at the old
     // position, query the view to see if the current location is droppable,
@@ -2707,7 +2707,7 @@ nsTreeBodyFrame::HandleEvent(nsPresContext* aPresContext,
     // Indicate that the drop is allowed by preventing the default behaviour.
     if (mSlots->mDropAllowed)
       *aEventStatus = nsEventStatus_eConsumeNoDefault;
-  } else if (aEvent->mMessage == NS_DRAGDROP_DROP) {
+  } else if (aEvent->mMessage == eDrop) {
      // this event was meant for another frame, so ignore it
      if (!mSlots)
        return NS_OK;
@@ -2731,7 +2731,7 @@ nsTreeBodyFrame::HandleEvent(nsPresContext* aPresContext,
     mSlots->mDropOrient = -1;
     mSlots->mIsDragging = false;
     *aEventStatus = nsEventStatus_eConsumeNoDefault; // already handled the drop
-  } else if (aEvent->mMessage == NS_DRAGDROP_EXIT) {
+  } else if (aEvent->mMessage == eDragExit) {
     // this event was meant for another frame, so ignore it
     if (!mSlots)
       return NS_OK;
diff --git a/media/mtransport/nricectx.cpp b/media/mtransport/nricectx.cpp
index 98b2c2b7bb99..99f3e6014123 100644
--- a/media/mtransport/nricectx.cpp
+++ b/media/mtransport/nricectx.cpp
@@ -468,8 +468,6 @@ RefPtr<NrIceCtx> NrIceCtx::Create(const std::string& name,
                      ice_trickle_grace_period);
     NR_reg_set_int4((char *)NR_ICE_REG_ICE_TCP_SO_SOCK_COUNT,
                      ice_tcp_so_sock_count);
-    NR_reg_set_int4((char *)NR_ICE_REG_ICE_TCP_SO_SOCK_COUNT,
-                     ice_tcp_so_sock_count);
     NR_reg_set_int4((char *)NR_ICE_REG_ICE_TCP_LISTEN_BACKLOG,
                      ice_tcp_listen_backlog);
 
diff --git a/memory/mozjemalloc/jemalloc.c b/memory/mozjemalloc/jemalloc.c
index f746347f3c39..7e64ff5d72b8 100644
--- a/memory/mozjemalloc/jemalloc.c
+++ b/memory/mozjemalloc/jemalloc.c
@@ -4227,7 +4227,7 @@ arena_malloc_small(arena_t *arena, size_t size, bool zero)
 	if (zero == false) {
 #ifdef MALLOC_FILL
 		if (opt_junk)
-			memset(ret, 0xa5, size);
+			memset(ret, 0xe4, size);
 		else if (opt_zero)
 			memset(ret, 0, size);
 #endif
@@ -4263,7 +4263,7 @@ arena_malloc_large(arena_t *arena, size_t size, bool zero)
 	if (zero == false) {
 #ifdef MALLOC_FILL
 		if (opt_junk)
-			memset(ret, 0xa5, size);
+			memset(ret, 0xe4, size);
 		else if (opt_zero)
 			memset(ret, 0, size);
 #endif
@@ -4365,7 +4365,7 @@ arena_palloc(arena_t *arena, size_t alignment, size_t size, size_t alloc_size)
 
 #ifdef MALLOC_FILL
 	if (opt_junk)
-		memset(ret, 0xa5, size);
+		memset(ret, 0xe4, size);
 	else if (opt_zero)
 		memset(ret, 0, size);
 #endif
@@ -4586,7 +4586,7 @@ arena_dalloc_small(arena_t *arena, arena_chunk_t *chunk, void *ptr,
 
 #ifdef MALLOC_FILL
 	if (opt_poison)
-		memset(ptr, 0x5a, size);
+		memset(ptr, 0xe5, size);
 #endif
 
 	arena_run_reg_dalloc(run, bin, ptr, size);
@@ -4679,7 +4679,7 @@ arena_dalloc_large(arena_t *arena, arena_chunk_t *chunk, void *ptr)
 #ifdef MALLOC_STATS
 		if (opt_poison)
 #endif
-			memset(ptr, 0x5a, size);
+			memset(ptr, 0xe5, size);
 #endif
 #ifdef MALLOC_STATS
 		arena->stats.allocated_large -= size;
@@ -4818,7 +4818,7 @@ arena_ralloc_large(void *ptr, size_t size, size_t oldsize)
 		/* Same size class. */
 #ifdef MALLOC_FILL
 		if (opt_poison && size < oldsize) {
-			memset((void *)((uintptr_t)ptr + size), 0x5a, oldsize -
+			memset((void *)((uintptr_t)ptr + size), 0xe5, oldsize -
 			    size);
 		}
 #endif
@@ -4835,7 +4835,7 @@ arena_ralloc_large(void *ptr, size_t size, size_t oldsize)
 #ifdef MALLOC_FILL
 			/* Fill before shrinking in order avoid a race. */
 			if (opt_poison) {
-				memset((void *)((uintptr_t)ptr + size), 0x5a,
+				memset((void *)((uintptr_t)ptr + size), 0xe5,
 				    oldsize - size);
 			}
 #endif
@@ -4905,7 +4905,7 @@ arena_ralloc(void *ptr, size_t size, size_t oldsize)
 IN_PLACE:
 #ifdef MALLOC_FILL
 	if (opt_poison && size < oldsize)
-		memset((void *)((uintptr_t)ptr + size), 0x5a, oldsize - size);
+		memset((void *)((uintptr_t)ptr + size), 0xe5, oldsize - size);
 	else if (opt_zero && size > oldsize)
 		memset((void *)((uintptr_t)ptr + oldsize), 0, size - oldsize);
 #endif
@@ -5125,9 +5125,9 @@ huge_palloc(size_t size, size_t alignment, bool zero)
 	if (zero == false) {
 		if (opt_junk)
 #  ifdef MALLOC_DECOMMIT
-			memset(ret, 0xa5, psize);
+			memset(ret, 0xe4, psize);
 #  else
-			memset(ret, 0xa5, csize);
+			memset(ret, 0xe4, csize);
 #  endif
 		else if (opt_zero)
 #  ifdef MALLOC_DECOMMIT
@@ -5154,7 +5154,7 @@ huge_ralloc(void *ptr, size_t size, size_t oldsize)
 		size_t psize = PAGE_CEILING(size);
 #ifdef MALLOC_FILL
 		if (opt_poison && size < oldsize) {
-			memset((void *)((uintptr_t)ptr + size), 0x5a, oldsize
+			memset((void *)((uintptr_t)ptr + size), 0xe5, oldsize
 			    - size);
 		}
 #endif
diff --git a/memory/mozjemalloc/jemalloc_types.h b/memory/mozjemalloc/jemalloc_types.h
index 57afd03594ca..ae8dc4414dfb 100644
--- a/memory/mozjemalloc/jemalloc_types.h
+++ b/memory/mozjemalloc/jemalloc_types.h
@@ -55,8 +55,8 @@ typedef struct {
 	 * Run-time configuration settings.
 	 */
 	jemalloc_bool	opt_abort;	/* abort(3) on error? */
-	jemalloc_bool	opt_junk;	/* Fill allocated memory with 0xa5/0x5a? */
-	jemalloc_bool	opt_poison;	/* Fill free memory with 0xa5/0x5a? */
+	jemalloc_bool	opt_junk;	/* Fill allocated memory with 0xe4? */
+	jemalloc_bool	opt_poison;	/* Fill free memory with 0xe5? */
 	jemalloc_bool	opt_utrace;	/* Trace all allocation events? */
 	jemalloc_bool	opt_sysv;	/* SysV semantics? */
 	jemalloc_bool	opt_xmalloc;	/* abort(3) on OOM? */
diff --git a/mobile/android/base/db/BrowserContract.java b/mobile/android/base/db/BrowserContract.java
index 11c1bdf0523a..09f133d90bde 100644
--- a/mobile/android/base/db/BrowserContract.java
+++ b/mobile/android/base/db/BrowserContract.java
@@ -475,6 +475,7 @@ public class BrowserContract {
 
         public static final String CONTENT_TYPE = "vnd.android.cursor.dir/searchhistory";
         public static final String QUERY = "query";
+        public static final String DATE = "date";
         public static final String TABLE_NAME = "searchhistory";
 
         public static final Uri CONTENT_URI = Uri.withAppendedPath(SEARCH_HISTORY_AUTHORITY_URI, "searchhistory");
diff --git a/mobile/android/base/home/BrowserSearch.java b/mobile/android/base/home/BrowserSearch.java
index 7b898053b869..7ed9fc8990fb 100644
--- a/mobile/android/base/home/BrowserSearch.java
+++ b/mobile/android/base/home/BrowserSearch.java
@@ -911,7 +911,7 @@ public class BrowserSearch extends HomeFragment
 
                 final SearchEngine engine = mSearchEngines.get(position);
                 final boolean animate = (mAnimateSuggestions && engine.hasSuggestions());
-                row.updateFromSearchEngine(engine, animate);
+                row.updateSuggestions(mSuggestionsEnabled, engine, mSearchTerm, animate);
                 if (animate) {
                     // Only animate suggestions the first time they are shown
                     mAnimateSuggestions = false;
diff --git a/mobile/android/base/home/SearchEngineRow.java b/mobile/android/base/home/SearchEngineRow.java
index 667ab7902b32..c315557f227c 100644
--- a/mobile/android/base/home/SearchEngineRow.java
+++ b/mobile/android/base/home/SearchEngineRow.java
@@ -5,6 +5,7 @@
 
 package org.mozilla.gecko.home;
 
+import org.mozilla.gecko.db.BrowserContract.SearchHistory;
 import org.mozilla.gecko.R;
 import org.mozilla.gecko.Telemetry;
 import org.mozilla.gecko.TelemetryContract;
@@ -16,6 +17,8 @@ import org.mozilla.gecko.widget.AnimatedHeightLayout;
 import org.mozilla.gecko.widget.FaviconView;
 import org.mozilla.gecko.widget.FlowLayout;
 
+import android.database.Cursor;
+import android.content.ContentResolver;
 import android.content.Context;
 import android.util.AttributeSet;
 import android.view.KeyEvent;
@@ -133,7 +136,10 @@ class SearchEngineRow extends AnimatedHeightLayout {
         return suggestionText.getText().toString();
     }
 
-    private void setSuggestionOnView(View v, String suggestion) {
+    private void setSuggestionOnView(View v, String suggestion, boolean isUserSavedSearch) {
+        final ImageView historyIcon = (ImageView) v.findViewById(R.id.suggestion_item_icon);
+        historyIcon.setVisibility(isUserSavedSearch ? View.VISIBLE: View.GONE);
+
         final TextView suggestionText = (TextView) v.findViewById(R.id.suggestion_text);
         suggestionText.setText(suggestion);
         setDescriptionOnSuggestion(suggestionText, suggestion);
@@ -172,7 +178,76 @@ class SearchEngineRow extends AnimatedHeightLayout {
         mEditSuggestionListener = listener;
     }
 
-    public void updateFromSearchEngine(SearchEngine searchEngine, boolean animate) {
+    private void bindSuggestionView(String suggestion, boolean animate, int recycledSuggestionCount, Integer previousSuggestionChildIndex, boolean isUserSavedSearch){
+        final View suggestionItem;
+
+        // Reuse suggestion views from recycled view, if possible.
+        if (previousSuggestionChildIndex + 1 < recycledSuggestionCount) {
+            suggestionItem = mSuggestionView.getChildAt(previousSuggestionChildIndex + 1);
+            suggestionItem.setVisibility(View.VISIBLE);
+        } else {
+            suggestionItem = mInflater.inflate(R.layout.suggestion_item, null);
+
+            suggestionItem.setOnClickListener(mClickListener);
+            suggestionItem.setOnLongClickListener(mLongClickListener);
+
+            // Store the position of the suggestion for telemetry.
+            suggestionItem.setTag(String.valueOf(previousSuggestionChildIndex));
+
+            mSuggestionView.addView(suggestionItem);
+        }
+
+        setSuggestionOnView(suggestionItem, suggestion, isUserSavedSearch);
+
+        if (animate) {
+            AlphaAnimation anim = new AlphaAnimation(0, 1);
+            anim.setDuration(ANIMATION_DURATION);
+            anim.setStartOffset(previousSuggestionChildIndex * ANIMATION_DURATION);
+            suggestionItem.startAnimation(anim);
+        }
+    }
+
+    private void hideRecycledSuggestions(int lastVisibleChildIndex, int recycledSuggestionCount) {
+        // Hide extra suggestions that have been recycled.
+        for (int i = lastVisibleChildIndex + 1; i < recycledSuggestionCount; ++i) {
+            mSuggestionView.getChildAt(i).setVisibility(View.GONE);
+        }
+    }
+
+    private void updateFromSavedSearches(String searchTerm, boolean animate, int suggestionCounter, int recycledSuggestionCount) {
+        final ContentResolver cr = getContext().getContentResolver();
+
+        String[] columns = new String[] { SearchHistory.QUERY };
+        String sortOrderAndLimit = SearchHistory.DATE + " DESC";
+
+        final Cursor c = cr.query(SearchHistory.CONTENT_URI, columns, null, null, sortOrderAndLimit);
+        if (c == null) {
+            return;
+        }
+        try {
+            if (c.moveToFirst()) {
+                int counter = 0;
+                final int searchColumn = c.getColumnIndexOrThrow(SearchHistory.QUERY);
+                do {
+                    final String savedSearch = c.getString(searchColumn);
+                    if (counter == 4) {
+                        break;
+                    }
+                    // Bug 1200371 will move the filtering/matching and limit into the sql query
+                    if (savedSearch.startsWith(searchTerm)) {
+                        bindSuggestionView(savedSearch, animate, recycledSuggestionCount, suggestionCounter, true);
+                        ++suggestionCounter;
+                        ++counter;
+                    }
+                } while (c.moveToNext());
+            }
+        } finally {
+            c.close();
+        }
+        hideRecycledSuggestions(suggestionCounter, recycledSuggestionCount);
+    }
+
+    private int updateFromSearchEngine(SearchEngine searchEngine, boolean animate, int recycledSuggestionCount) {
         // Update search engine reference.
         mSearchEngine = searchEngine;
 
@@ -182,54 +257,30 @@ class SearchEngineRow extends AnimatedHeightLayout {
         // Set the initial content description.
         setDescriptionOnSuggestion(mUserEnteredTextView, mUserEnteredTextView.getText().toString());
 
-        // Add additional suggestions given by this engine.
-        final int recycledSuggestionCount = mSuggestionView.getChildCount();
-
         int suggestionCounter = 0;
+        // Apply Search Engine's suggestions
         for (String suggestion : mSearchEngine.getSuggestions()) {
-            final View suggestionItem;
-
-            // Reuse suggestion views from recycled view, if possible.
-            if (suggestionCounter + 1 < recycledSuggestionCount) {
-                suggestionItem = mSuggestionView.getChildAt(suggestionCounter + 1);
-                suggestionItem.setVisibility(View.VISIBLE);
-            } else {
-                suggestionItem = mInflater.inflate(R.layout.suggestion_item, null);
-
-                suggestionItem.setOnClickListener(mClickListener);
-                suggestionItem.setOnLongClickListener(mLongClickListener);
-
-                // Store the position of the suggestion for telemetry.
-                suggestionItem.setTag(String.valueOf(suggestionCounter));
-
-                final ImageView magnifier =
-                        (ImageView) suggestionItem.findViewById(R.id.suggestion_magnifier);
-                magnifier.setVisibility(View.GONE);
-
-                mSuggestionView.addView(suggestionItem);
-            }
-
-            setSuggestionOnView(suggestionItem, suggestion);
-
-            if (animate) {
-                AlphaAnimation anim = new AlphaAnimation(0, 1);
-                anim.setDuration(ANIMATION_DURATION);
-                anim.setStartOffset(suggestionCounter * ANIMATION_DURATION);
-                suggestionItem.startAnimation(anim);
-            }
-
+            bindSuggestionView(suggestion, animate, recycledSuggestionCount, suggestionCounter, false);
             ++suggestionCounter;
         }
 
-        // Hide extra suggestions that have been recycled.
-        for (int i = suggestionCounter + 1; i < recycledSuggestionCount; ++i) {
-            mSuggestionView.getChildAt(i).setVisibility(View.GONE);
-        }
+        hideRecycledSuggestions(suggestionCounter, recycledSuggestionCount);
 
         // Make sure mSelectedView is still valid.
         if (mSelectedView >= mSuggestionView.getChildCount()) {
             mSelectedView = mSuggestionView.getChildCount() - 1;
         }
+
+        return suggestionCounter;
+    }
+
+    public void updateSuggestions(boolean suggestionsEnabled, SearchEngine searchEngine, String searchTerm, boolean animate) {
+        // This can be called before the opt-in permission prompt is shown or set. Check first.
+        if (suggestionsEnabled) {
+            final int recycledSuggestionCount = mSuggestionView.getChildCount();
+            final int suggestionViewCount = updateFromSearchEngine(searchEngine, animate, recycledSuggestionCount);
+            updateFromSavedSearches(searchTerm, animate, suggestionViewCount, recycledSuggestionCount);
+        }
     }
 
     @Override
diff --git a/mobile/android/base/locales/Makefile.in b/mobile/android/base/locales/Makefile.in
index 7851f5ad89e0..e94e52a7a153 100644
--- a/mobile/android/base/locales/Makefile.in
+++ b/mobile/android/base/locales/Makefile.in
@@ -44,18 +44,6 @@ chrome-%::
 	  $(dir-res-raw)-$(AB_rCD)/browsersearch.json \
 	  AB_CD=$*
 
-# setup the path to bookmarks.inc. copied and tweaked version of MERGE_FILE from config/config.mk
-MOBILE_LOCALE_SRCDIR = $(if $(filter en-US,$(AB_CD)),$(topsrcdir)/mobile/locales/en-US,$(or $(realpath $(L10NBASEDIR)),$(abspath $(L10NBASEDIR)))/$(AB_CD)/mobile)
-
-ifdef LOCALE_MERGEDIR
-BOOKMARKSPATH = $(firstword \
-  $(wildcard $(LOCALE_MERGEDIR)/mobile/profile/bookmarks.inc ) \
-  $(wildcard $(MOBILE_LOCALE_SRCDIR)/profile/bookmarks.inc ) \
-  $(topsrcdir)/mobile/locales/en-US/profile/bookmarks.inc )
-else
-BOOKMARKSPATH = $(abspath $(MOBILE_LOCALE_SRCDIR)/profile/bookmarks.inc)
-endif
-
 # Determine the ../res/values[-*]/ path
 strings-xml-bypath  = $(filter %/strings.xml,$(MAKECMDGOALS))
 ifeq (,$(strip $(strings-xml-bypath)))
@@ -69,7 +57,6 @@ strings-xml-preqs =\
   $(STRINGSPATH) \
   $(SEARCHSTRINGSPATH) \
   $(SYNCSTRINGSPATH) \
-  $(BOOKMARKSPATH) \
   $(if $(IS_LANGUAGE_REPACK),FORCE) \
   $(NULL)
 
@@ -80,7 +67,6 @@ $(dir-strings-xml)/strings.xml: $(strings-xml-preqs)
 	$(call py_action,preprocessor, \
       $(DEFINES) \
 	  -DANDROID_PACKAGE_NAME=$(ANDROID_PACKAGE_NAME) \
-	  -DBOOKMARKSPATH='$(BOOKMARKSPATH)' \
 	  -DBRANDPATH='$(BRANDPATH)' \
 	  -DMOZ_ANDROID_SHARED_ACCOUNT_TYPE=$(MOZ_ANDROID_SHARED_ACCOUNT_TYPE) \
 	  -DMOZ_ANDROID_SHARED_FXACCOUNT_TYPE=$(MOZ_ANDROID_SHARED_FXACCOUNT_TYPE) \
diff --git a/mobile/android/base/locales/en-US/android_strings.dtd b/mobile/android/base/locales/en-US/android_strings.dtd
index 69d669dcac3b..f58764daab61 100644
--- a/mobile/android/base/locales/en-US/android_strings.dtd
+++ b/mobile/android/base/locales/en-US/android_strings.dtd
@@ -703,3 +703,18 @@ just addresses the organization to follow, e.g. "This site is run by " -->
 <!ENTITY restriction_disallow_master_password_title2 "Disable master password">
 <!ENTITY restriction_disallow_guest_browsing_title2 "Disable Guest Browsing">
 
+<!-- Default Bookmarks titles-->
+<!-- LOCALIZATION NOTE (bookmarks_title): title for the folder that will contains the default bookmarks -->
+<!ENTITY bookmarks_title "Mobile">
+<!-- LOCALIZATION NOTE (bookmarks_about_browser): link title for about:fennec -->
+<!ENTITY bookmarks_about_browser "Firefox: About your browser">
+<!-- LOCALIZATION NOTE (bookmarks_addons): link title for https://addons.mozilla.org/en-US/mobile -->
+<!ENTITY bookmarks_addons "Firefox: Customize with add-ons">
+<!-- LOCALIZATION NOTE (bookmarks_support): link title for https://support.mozilla.org/ -->
+<!ENTITY bookmarks_support "Firefox: Support">
+<!--LOCALIZATION NOTE (bookmarks_marketplace):link title for https://marketplace.firefox.com -->
+<!ENTITY bookmarks_marketplace "Firefox Marketplace">
+<!-- LOCALIZATION NOTE (bookmarks_restricted_support): link title for https://support.mozilla.org/kb/kids -->
+<!ENTITY bookmarks_restricted_support "Firefox Help and Support for a simplified kid-friendly version of Firefox">
+<!-- LOCALIZATION NOTE (bookmarks_restricted_webmaker):link title for https://webmaker.org -->
+<!ENTITY bookmarks_restricted_webmaker "Learn the Web: Mozilla Webmaker">
diff --git a/mobile/android/base/resources/layout/suggestion_item.xml b/mobile/android/base/resources/layout/suggestion_item.xml
index 49dbeaf44d2e..8118ef042d23 100644
--- a/mobile/android/base/resources/layout/suggestion_item.xml
+++ b/mobile/android/base/resources/layout/suggestion_item.xml
@@ -12,11 +12,12 @@
               android:clickable="true"
               android:padding="7dp">
 
-    <ImageView android:id="@+id/suggestion_magnifier"
-               android:src="@drawable/search_icon_inactive"
+    <ImageView android:id="@+id/suggestion_item_icon"
+               android:src="@drawable/icon_most_recent_empty"
                android:layout_marginRight="3dip"
-               android:layout_width="16dip"
-               android:layout_height="16dip"/>
+               android:layout_width="18dip"
+               android:layout_height="18dip"
+               android:visibility="gone"/>
 
     <TextView android:id="@+id/suggestion_text"
               android:layout_width="wrap_content"
diff --git a/mobile/android/base/strings.xml.in b/mobile/android/base/strings.xml.in
index e88fb35d6a67..05d730d96ef1 100644
--- a/mobile/android/base/strings.xml.in
+++ b/mobile/android/base/strings.xml.in
@@ -19,7 +19,6 @@
 <!ENTITY formatD "&#037;d">
 ]>
 
-#includesubst @BOOKMARKSPATH@
 <resources>
   <string name="moz_app_displayname">@MOZ_APP_DISPLAYNAME@</string>
   <string name="android_package_name">@ANDROID_PACKAGE_NAME@</string>
@@ -453,25 +452,25 @@
 
   <!-- Default bookmarks. We used to use bookmark titles shared with XUL from mobile's
        profile/bookmarks.inc (see bug 964946). Don't expose the URLs to L10N. -->
-  <string name="bookmarkdefaults_title_aboutfirefox">@bookmarks_aboutBrowser@</string>
+  <string name="bookmarkdefaults_title_aboutfirefox">&bookmarks_about_browser;</string>
   <string name="bookmarkdefaults_url_aboutfirefox">about:firefox</string>
 
   <!-- Icon is automatically generated from R.drawable.bookmarkdefaults_favicon_addons -->
-  <string name="bookmarkdefaults_title_addons">@bookmarks_addons@</string>
+  <string name="bookmarkdefaults_title_addons">&bookmarks_addons;</string>
   <string name="bookmarkdefaults_url_addons">https://addons.mozilla.org/android/</string>
 
   <!-- Icon is automatically generated from R.drawable.bookmarkdefaults_favicon_support -->
-  <string name="bookmarkdefaults_title_support">@bookmarks_support@</string>
+  <string name="bookmarkdefaults_title_support">&bookmarks_support;</string>
   <string name="bookmarkdefaults_url_support">https://support.mozilla.org/products/mobile</string>
 
   <!-- Icon is automatically generated from R.drawable.bookmarkdefaults_favicon_marketplace -->
-  <string name="bookmarkdefaults_title_marketplace">@bookmarks_marketplace@</string>
+  <string name="bookmarkdefaults_title_marketplace">&bookmarks_marketplace;</string>
   <string name="bookmarkdefaults_url_marketplace">https://marketplace.firefox.com/</string>
 
-  <string name="bookmarkdefaults_title_restricted_webmaker">@bookmarks_restricted_webmaker@</string>
+  <string name="bookmarkdefaults_title_restricted_webmaker">&bookmarks_restricted_webmaker;</string>
   <string name="bookmarkdefaults_url_restricted_webmaker">https://webmaker.org/</string>
 
-  <string name="bookmarkdefaults_title_restricted_support">@bookmarks_restricted_support@</string>
+  <string name="bookmarkdefaults_title_restricted_support">&bookmarks_restricted_support;</string>
   <string name="bookmarkdefaults_url_restricted_support">https://support.mozilla.org/kb/kids</string>
 
   <!-- Site identity popup -->
diff --git a/mobile/android/mach_commands.py b/mobile/android/mach_commands.py
index b06fa1e75b11..e5055e2db852 100644
--- a/mobile/android/mach_commands.py
+++ b/mobile/android/mach_commands.py
@@ -265,3 +265,73 @@ class PackageFrontend(MachCommandBase):
         artifacts = self._make_artifacts(tree=tree, job=job)
         artifacts.clear_cache()
         return 0
+
+@CommandProvider
+class AndroidEmulatorCommands(MachCommandBase):
+    """
+       Run the Android emulator with one of the AVDs used in the Mozilla
+       automated test environment. If necessary, the AVD is fetched from
+       the tooltool server and installed.
+    """
+    @Command('android-emulator', category='devenv',
+        conditions=[],
+        description='Run the Android emulator with an AVD from test automation.')
+    @CommandArgument('--version', metavar='VERSION', choices=['2.3', '4.3', 'x86'],
+        help='Specify Android version to run in emulator. One of "2.3", "4.3", or "x86".',
+        default='4.3')
+    @CommandArgument('--wait', action='store_true',
+        help='Wait for emulator to be closed.')
+    @CommandArgument('--force-update', action='store_true',
+        help='Update AVD definition even when AVD is already installed.')
+    @CommandArgument('--verbose', action='store_true',
+        help='Log informative status messages.')
+    def emulator(self, version, wait=False, force_update=False, verbose=False):
+        from mozrunner.devices.android_device import AndroidEmulator
+
+        emulator = AndroidEmulator(version, verbose, substs=self.substs)
+        if emulator.is_running():
+            # It is possible to run multiple emulators simultaneously, but:
+            #  - if more than one emulator is using the same avd, errors may
+            #    occur due to locked resources;
+            #  - additional parameters must be specified when running tests,
+            #    to select a specific device.
+            # To avoid these complications, allow just one emulator at a time.
+            self.log(logging.ERROR, "emulator", {},
+                     "An Android emulator is already running.\n"
+                     "Close the existing emulator and re-run this command.")
+            return 1
+
+        if not emulator.is_available():
+            self.log(logging.WARN, "emulator", {},
+                     "Emulator binary not found.\n"
+                     "Install the Android SDK and make sure 'emulator' is in your PATH.")
+            return 2
+
+        if not emulator.check_avd(force_update):
+            self.log(logging.INFO, "emulator", {},
+                     "Fetching and installing AVD. This may take a few minutes...")
+            emulator.update_avd(force_update)
+
+        self.log(logging.INFO, "emulator", {},
+                 "Starting Android emulator running %s..." %
+                 emulator.get_avd_description())
+        emulator.start()
+        if emulator.wait_for_start():
+            self.log(logging.INFO, "emulator", {},
+                     "Android emulator is running.")
+        else:
+            # This is unusual but the emulator may still function.
+            self.log(logging.WARN, "emulator", {},
+                     "Unable to verify that emulator is running.")
+
+        if wait:
+            self.log(logging.INFO, "emulator", {},
+                     "Waiting for Android emulator to close...")
+            rc = emulator.wait()
+            if rc is not None:
+                self.log(logging.INFO, "emulator", {},
+                         "Android emulator completed with return code %d." % rc)
+            else:
+                self.log(logging.WARN, "emulator", {},
+                         "Unable to retrieve Android emulator return code.")
+        return 0
diff --git a/mobile/locales/Makefile.in b/mobile/locales/Makefile.in
index 3b71ee64f361..ecf96301f706 100644
--- a/mobile/locales/Makefile.in
+++ b/mobile/locales/Makefile.in
@@ -44,17 +44,6 @@ search-jar-default: search-jar
 
 
 ###########################################################################
-bookmarks     = bookmarks.json
-bookmarks-ts  = $(tgt-gendir)/$(bookmarks)
-src-bookmarks = $(srcdir)/generic/profile/$(bookmarks).in
-
-GARBAGE += $(bookmarks) $(bookmarks-ts)
-# ---------------------------------------------------------------------------
-# Note: Always symlink bookmarks.json to pickup the current build for a
-#       locale.  Phase 2 edits should remove the common/symlink file and
-#       provide a user function able to derive the path.
-###########################################################################
-
 ## Searchlist plugin config
 plugin-file-array = \
   $(wildcard $(LOCALE_SRCDIR)/searchplugins/list.txt) \
@@ -144,7 +133,6 @@ libs-%: $(libs-preqs)
 	$(display-deps)
 	@$(MAKE) -C $(DEPTH)/toolkit/locales libs-$*
 	@$(MAKE) -C $(DEPTH)/intl/locales AB_CD=$* XPI_NAME=locale-$*
-	@$(MAKE) -B $(bookmarks) AB_CD=$*
 	@$(MAKE) -B searchplugins AB_CD=$* XPI_NAME=locale-$*
 	@$(MAKE) libs AB_CD=$* XPI_NAME=locale-$* PREF_DIR=defaults/pref
 	@$(MAKE) -C $(DEPTH)/$(MOZ_BRANDING_DIRECTORY)/locales AB_CD=$* XPI_NAME=locale-$*
@@ -152,7 +140,6 @@ libs-%: $(libs-preqs)
 # Tailored target to just add the chrome processing for multi-locale builds
 chrome-%:
 	$(display-deps)
-	@$(MAKE) -B $(bookmarks) AB_CD=$*
 	@$(MAKE) -B searchplugins AB_CD=$*
 	@$(MAKE) chrome AB_CD=$*
 	@$(MAKE) -C $(DEPTH)/$(MOZ_BRANDING_DIRECTORY)/locales chrome AB_CD=$*
@@ -160,37 +147,4 @@ chrome-%:
 NO_JA_JP_MAC_AB_CD := $(if $(filter ja-JP-mac, $(AB_CD)),ja,$(AB_CD))
 
 
-# emulate vpath to gather deps with a path
-has-mergedir = $(if $(strip $(LOCALE_MERGEDIR)),1)
-bookmarks-inc-array = \
-  $(wildcard \
-    $(if $(has_mergedir),$(LOCALE_MERGEDIR)/mobile/profile/bookmarks.inc) \
-    $(LOCALE_SRCDIR)/profile/bookmarks.inc \
-    $(if $(has-mergedir),$(srcdir)/en-US/profile/bookmarks.inc) \
-  )
-bookmarks-inc = $(firstword $(bookmarks-inc-array))
-
-bookmarks-preqs = \
-  $(bookmarks-inc) \
-  $(src-bookmarks) \
-  generic/profile/$(bookmarks).in \
-  $(if $(IS_LANGUAGE_REPACK),FORCE) \
-  $(GLOBAL_DEPS) \
-  $(NULL)
-
-$(bookmarks-ts): $(bookmarks-preqs)
-	$(display_deps)
-	$(call py_action,preprocessor, \
-      -I $< \
-      -DAB_CD=$(NO_JA_JP_MAC_AB_CD) \
-      $(src-bookmarks) \
-      -o $@)
-
-.PHONY: bookmarks $(bookmarks)
-bookmarks: $(bookmarks)
-$(bookmarks): $(bookmarks-ts)
-	@echo '\nGenerating: $@'
-	ln -fn $< .
-
-
-export:: searchplugins bookmarks
+export:: searchplugins
diff --git a/mobile/locales/en-US/profile/bookmarks.inc b/mobile/locales/en-US/profile/bookmarks.inc
deleted file mode 100644
index dd25ad102997..000000000000
--- a/mobile/locales/en-US/profile/bookmarks.inc
+++ /dev/null
@@ -1,41 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#filter emptyLines
-
-# LOCALIZATION NOTE: The 'en-US' strings in the URLs will be replaced with
-# your locale code, and link to your translated pages as soon as they're 
-# live.
-
-# LOCALIZATION NOTE: Some of these URLs are currently 404s, but should be coming
-# online shortly.
-
-# LOCALIZATION NOTE (bookmarks_title):
-# title for the folder that will contains the default bookmarks
-#define bookmarks_title Mobile
-
-# LOCALIZATION NOTE (bookmarks_aboutBrowser):
-# link title for about:fennec
-#define bookmarks_aboutBrowser Firefox: About your browser
-
-# LOCALIZATION NOTE (bookmarks_addons):
-# link title for https://addons.mozilla.org/en-US/mobile
-#define bookmarks_addons Firefox: Customize with add-ons
-
-# LOCALIZATION NOTE (bookmarks_support):
-# link title for https://support.mozilla.org/
-#define bookmarks_support Firefox: Support
-
-# LOCALIZATION NOTE (bookmarks_marketplace):
-# link title for https://marketplace.firefox.com
-#define bookmarks_marketplace Firefox Marketplace
-
-# LOCALIZATION NOTE (bookmarks_restricted_support):
-# link title for https://support.mozilla.org/kb/kids
-#define bookmarks_restricted_support Firefox Help and Support for a simplified kid-friendly version of Firefox
-
-# LOCALIZATION NOTE (bookmarks_restricted_webmaker):
-# link title for https://webmaker.org
-#define bookmarks_restricted_webmaker Learn the Web: Mozilla Webmaker
-
-#unfilter emptyLines
diff --git a/mobile/locales/generic/profile/bookmarks.json.in b/mobile/locales/generic/profile/bookmarks.json.in
deleted file mode 100644
index 0c1dfc798a9f..000000000000
--- a/mobile/locales/generic/profile/bookmarks.json.in
+++ /dev/null
@@ -1,8 +0,0 @@
-#filter substitution
-{"type":"text/x-moz-place-container","root":"placesRoot","children":
-  [{"type":"text/x-moz-place-container","title":"@bookmarks_title@","annos":[{"name":"mobile/bookmarksRoot","expires":4,"type":1,"value":1}],
-# Bug 921433: this is empty, because bookmarks are now added via resource 
-# strings: see LocalBrowserDB.addDefaultBookmarks.
-    "children": []
-  }]
-}
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 728530ec174d..4770a37172ff 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -397,6 +397,7 @@ pref("media.navigator.permission.disabled", false);
 pref("media.peerconnection.default_iceservers", "[]");
 pref("media.peerconnection.ice.loopback", false); // Set only for testing in offline environments.
 pref("media.peerconnection.ice.tcp", false);
+pref("media.peerconnection.ice.tcp_so_sock_count", 0); // Disable SO gathering
 pref("media.peerconnection.ice.link_local", false); // Set only for testing IPV6 in networks that don't assign IPV6 addresses
 pref("media.peerconnection.ice.force_interface", ""); // Limit to only a single interface
 pref("media.peerconnection.ice.relay_only", false); // Limit candidates to TURN
@@ -1251,9 +1252,6 @@ pref("network.http.proxy.version", "1.1");    // default
 // pref("network.http.proxy.version", "1.0"); // uncomment this out in case of problems
                                               // (required if using junkbuster proxy)
 
-// enable caching of http documents
-pref("network.http.use-cache", true);
-
 // this preference can be set to override the socket type used for normal
 // HTTP traffic.  an empty value indicates the normal TCP/IP socket type.
 pref("network.http.default-socket-type", "");
@@ -4288,10 +4286,6 @@ pref("layers.offmainthreadcomposition.frame-rate", -1);
 pref("layers.async-pan-zoom.enabled", true);
 #endif
 
-#ifdef MOZ_WIDGET_UIKIT
-pref("layers.async-pan-zoom.enabled", true);
-#endif
-
 #ifdef XP_MACOSX
 pref("layers.enable-tiles", true);
 pref("layers.tile-width", 512);
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index 86c0105012af..2635e31a977f 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -416,10 +416,6 @@ nsHttpChannel::Connect()
         return NS_ERROR_DOCUMENT_NOT_CACHED;
     }
 
-    if (!gHttpHandler->UseCache()) {
-        return ContinueConnect();
-    }
-
     // open a cache entry for this channel...
     rv = OpenCacheEntry(isHttps);
 
diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.cpp b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
index 81a07bf45458..d34ee12b522d 100644
--- a/netwerk/protocol/http/nsHttpConnectionMgr.cpp
+++ b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
@@ -1816,6 +1816,7 @@ nsHttpConnectionMgr::TryDispatchTransaction(nsConnectionEntry *ent,
     if (!attemptedOptimisticPipeline &&
         (classification == nsHttpTransaction::CLASS_REVALIDATION ||
          classification == nsHttpTransaction::CLASS_SCRIPT)) {
+        // Assignation kept here for documentation purpose; Never read after
         attemptedOptimisticPipeline = true;
         if (AddToShortestPipeline(ent, trans,
                                   classification,
diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp
index 81f7f1297800..2c966817e094 100644
--- a/netwerk/protocol/http/nsHttpHandler.cpp
+++ b/netwerk/protocol/http/nsHttpHandler.cpp
@@ -174,7 +174,6 @@ nsHttpHandler::nsHttpHandler()
     , mProduct("Gecko")
     , mCompatFirefoxEnabled(false)
     , mUserAgentIsDirty(true)
-    , mUseCache(true)
     , mPromptTempRedirect(true)
     , mSendSecureXSiteReferrer(true)
     , mEnablePersistentHttpsCaching(false)
@@ -1154,13 +1153,6 @@ nsHttpHandler::PrefsChanged(nsIPrefBranch *prefs, const char *pref)
             SetAcceptEncodings(acceptEncodings);
     }
 
-    if (PREF_CHANGED(HTTP_PREF("use-cache"))) {
-        rv = prefs->GetBoolPref(HTTP_PREF("use-cache"), &cVar);
-        if (NS_SUCCEEDED(rv)) {
-            mUseCache = cVar;
-        }
-    }
-
     if (PREF_CHANGED(HTTP_PREF("default-socket-type"))) {
         nsXPIDLCString sval;
         rv = prefs->GetCharPref(HTTP_PREF("default-socket-type"),
diff --git a/netwerk/protocol/http/nsHttpHandler.h b/netwerk/protocol/http/nsHttpHandler.h
index d60f05fd11d7..c4f49ab49bd6 100644
--- a/netwerk/protocol/http/nsHttpHandler.h
+++ b/netwerk/protocol/http/nsHttpHandler.h
@@ -167,7 +167,6 @@ public:
     nsHttpConnectionMgr *ConnMgr()   { return mConnMgr; }
 
     // cache support
-    bool UseCache() const { return mUseCache; }
     uint32_t GenerateUniqueID() { return ++mLastUniqueID; }
     uint32_t SessionStartTime() { return mSessionStartTime; }
 
@@ -458,7 +457,6 @@ private:
     nsXPIDLCString mUserAgentOverride;
     bool           mUserAgentIsDirty; // true if mUserAgent should be rebuilt
 
-    bool           mUseCache;
 
     bool           mPromptTempRedirect;
     // mSendSecureXSiteReferrer: default is false,
diff --git a/python/mozbuild/mozbuild/mach_commands.py b/python/mozbuild/mozbuild/mach_commands.py
index 432dc45d3555..21f262d18938 100644
--- a/python/mozbuild/mozbuild/mach_commands.py
+++ b/python/mozbuild/mozbuild/mach_commands.py
@@ -26,6 +26,7 @@ from mach.mixin.logging import LoggingMixin
 
 from mozbuild.base import (
     MachCommandBase,
+    MachCommandConditions as conditions,
     MozbuildObject,
     MozconfigFindException,
     MozconfigLoadException,
@@ -963,6 +964,9 @@ class Install(MachCommandBase):
     @Command('install', category='post-build',
         description='Install the package on the machine, or on a device.')
     def install(self):
+        if conditions.is_android(self):
+            from mozrunner.devices.android_device import verify_android_device
+            verify_android_device(self)
         ret = self._run_make(directory=".", target='install', ensure_exit_code=False)
         if ret == 0:
             self.notify('Install complete')
diff --git a/security/manager/ssl/IntolerantFallbackList.inc b/security/manager/ssl/IntolerantFallbackList.inc
index e13b64df81c3..796d06592708 100644
--- a/security/manager/ssl/IntolerantFallbackList.inc
+++ b/security/manager/ssl/IntolerantFallbackList.inc
@@ -42,7 +42,6 @@ static const char* const kIntolerantFallbackList[] =
   "americanairlines.ie", // bug 1141604
   "americanairlines.in", // bug 1141604
   "americanairlines.jp", // bug 1141604
-  "amss.mobilicity.ca",
   "ap.meitetsuunyu.co.jp",
   "apply.hkbn.net", // bug 1138451
   "apps.amerch.com",
@@ -50,12 +49,10 @@ static const char* const kIntolerantFallbackList[] =
   "apps.state.or.us", // bug 1130472
   "appsrv.restat.com",
   "arcgames.com", // bug 1182932
-  "ascii.jp",
   "asko.fi", // bug 1158584
   "b2b.feib.com.tw",
   "baybloorradio.com", // bug 1173661
   "beehive.miit.ru",
-  "bettertrades.com",
   "bgw.wangyin.com", // bug 1145521
   "bianmin.chinapay.com", // bug 1137983
   "bigflix.com",
@@ -64,12 +61,10 @@ static const char* const kIntolerantFallbackList[] =
   "blogwatcher.co.jp",
   "bonds.euronext.com", // bug 1136091
   "books.wwnorton.com", // bug 1116891
-  "bredbandsbolaget.se", // bug 1158755
   "bursar.ou.edu",
   "buttons.verticalresponse.com",
   "c2g.jupiter.fl.us",
   "canadaca.geotrust.com", // bug 1137677
-  "car2go.com", // bug 1185080
   "cbsfnotes1.blood.org.tw",
   "central.acadiau.ca", // bug 1152377
   "cherry.de", // bug 1141521
@@ -78,12 +73,9 @@ static const char* const kIntolerantFallbackList[] =
   "club.guosen.com.cn",
   "coagov.aurora-il.org",
   "codem.codemasters.com",
-  "commerce.cashnet.com", // bug 1164009
   "comune.milano.it",
   "corporbank.nbcb.com.cn",
   "crm.et2008.com",
-  "crossroads.schneider.com",
-  "cs.tokai-tv.com",
   "cualerts.dupaco.com", // bug 1116892
   "customers.logistafrance.fr", // bug 1153951
   "cwu.edu",
@@ -100,7 +92,6 @@ static const char* const kIntolerantFallbackList[] =
   "ebank.hxb.com.cn",
   "ebank.hzbank.com.cn",
   "ebank.rcbcy.com", // bug 1146755
-  "ebanking.ocbcwhhk.com", // bug 1141746
   "ebill2.virginmedia.com", // bug 1129887
   "ebpp.airtel.lk",
   "ebspay.boc.cn", // bug 1155567
@@ -114,7 +105,6 @@ static const char* const kIntolerantFallbackList[] =
   "epicreg.com",
   "eremit.sbising.com",
   "eservices.palomar.edu",
-  "essentialsupplies.com",
   "event.kasite.net",
   "extranet.eurocontrol.int",
   "ez.cityofchesapeake.net",
@@ -133,19 +123,17 @@ static const char* const kIntolerantFallbackList[] =
   "giftcertificates.com",
   "hercle.com",
   "hpshop.gr",
-  "ibusiness.shacombank.com.hk", // bug 1141989
   "identity.virginmedia.com", // bug 1129887
   "ifund.allianzglobalinvestors.com.tw",
   "ig1.i-grasp.com", // bug 1167894
   "ig4.i-grasp.com", // bug 1167894
   "ihr.suburbanpropane.com",
-  "images.bankofthewest.com", // bug 1127204
   "inside.i-med.ac.at",
   "its.bocmacau.com",
   "jbclick.jaxbchfl.net", // bug 1158465
-  "jifenpay.com",
   "jst.doded.mil", // bug 1152627
   "keirin.jp",
+  "king-solarman.com", // bug 1190706
   "kjp.keinet.ne.jp",
   "kjp.oo.kawai-juku.ac.jp",
   "lewisham.gov.uk",
@@ -153,47 +141,35 @@ static const char* const kIntolerantFallbackList[] =
   "login.chicagopolice.org",
   "login.ermis.gov.gr",
   "m.e-hon.ne.jp",
-  "m.safari.cwu.edu", // bug 1143035
   "mail.izhnet.ru",
   "map.infonavit.org.mx",
   "mchrono.com",
-  "mecsumai.com",
   "member.edenredticket.com",
   "merchant.edenredticket.com",
   "meta-ehealth.com",
   "mobile.aa.com", // bug 1141604
   "mobile.dream-prize.com",
   "mon-ulb.ulb.ac.be",
-  "my-csprd.ea.cwu.edu", // bug 1143035
-  "my-csrenprd.ea.cwu.edu", // bug 1143035
-  "my-fsprd.ea.cwu.edu", // bug 1143035
-  "my-fsrenprd.ea.cwu.edu", // bug 1143035
-  "my-fsrpt.ea.cwu.edu", // bug 1143035
-  "my-hrprd.ea.cwu.edu", // bug 1143035
-  "my-hrrenprd.ea.cwu.edu", // bug 1143035
-  "my.cwu.edu", // bug 1143035
   "my.if.com", // bug 1173592
   "my.kyivstar.ua",
   "my.miit.ru",
   "myaccount.allstate.com", // bug 1143031
-  "myaccount3.westnet.com.au", // bug 1157139
   "mybank.nbcb.com.cn",
   "myhancock.hancockcollege.edu",
-  "myuws.uws.edu.au",
   "mywebreservations.com",
   "na.aiononline.com", // bug 1139782
   "national.virginmedia.com", // bug 1129887
   "nbank.hxb.com.cn",
   "netbanking.yesbank.co.in", // bug 1146090
-  "niche.endsleigh.co.uk",
+  "new.fibi-online.co.il", // bug 1187242
   "nmsmp.alsok.co.jp",
   "no1.nipponrentacar.co.jp",
   "obos1.obos.no",
   "officials.fhsaa.org",
+  "online.bankotsar.co.il", // bug 1187242
   "online.newindia.co.in",
   "online.sainsburysbank.co.uk",
   "openwebosproject.org", // bug 1151990
-  "opus.pinellascounty.org",
   "owa.byui.edu",
   "ozone.ou.edu",
   "parents.ou.edu",
@@ -201,31 +177,25 @@ static const char* const kIntolerantFallbackList[] =
   "payment.condor.com", // bug 1152347
   "payment.safepass.cn",
   "payments.virginmedia.com", // bug 1129887
-  "poezd.rw.by",
   "portal.eztec.com.br",
   "portal.questonline.gr",
   "portal.uem.es",
   "profiles.uthscsa.edu",
-  "publicacionesoficiales.boe.es",
   "publicjobs.ie",
   "publicrecords.com",
   "racenet.codemasters.com", // bug 1163716
-  "rapidscansecure.com", // bug 1177212
   "recoup.com",
   "registration.o2.co.uk",
-  "regonline.com", // bug 1139783
   "renewals.cipd.co.uk",
   "repair.kuroneko-kadendr.jp", // bug 1128366
   "repairmb.kuroneko-kadendr.jp", // bug 1128366
   "reputation.com",
-  "research-report.uws.edu.au",
   "reservations.usairways.com", // bug 1165400
   "rietumu.lv",
   "roxyaffiliates.com",
   "sales.newchinalife.com",
   "sbank.hxb.com.cn",
   "sboseweb.mcpsweb.org",
-  "secure-checkout.t-mobile.com", // bug 1133648
   "secure.bg-mania.jp",
   "secure.crbonline.gov.uk", // bug 1166644
   "secure.fortisbc.com",
@@ -241,27 +211,19 @@ static const char* const kIntolerantFallbackList[] =
   "shop.wildstar-online.com", // bug 1139782
   "slovanet.sk",
   "smartcart.com",
-  "socialclub.rockstargames.com", // bug 1138673
   "soeasy.sodexo.be", // bug 1117157
-  "ss2.sfcollege.edu",
   "ss5.sfcollege.edu",
   "ssb.okbu.edu", // for port 8910, bug 1153749
   "sso.acadiau.ca", // bug 1152377
-  "starbucks.com", // bug 1167190
   "stenhouse.com",
-  "store.moxa.com",
-  "svrch13.sugarlandtx.gov",
   "swdownloads.blackberry.com", // bug 1182997
   "syzygy.co.uk",
   "tarjetacencosud.cl",
   "tele2.hr",
-  "tienda.boe.es",
   "tiendas.mediamarkt.es",
   "uralsg.megafon.ru", // bug 1153168
   "usacycling.org", // bug 1163791
-  "userdoor.com",
   "utradehub.or.kr",
-  "vod.skyperfectv.co.jp",
   "watch.sportsnet.ca", // bug 1144769
   "web.asta.org",
   "webapps.ou.edu",
@@ -280,8 +242,6 @@ static const char* const kIntolerantFallbackList[] =
   "www.aa.com.ve", // bug 1141604
   "www.aavacations.com", // bug 1141604
   "www.accessingram.com",
-  "www.acgov.org",
-  "www.acteonline.org",
   "www.aeroplan.com", // bug 1137543
   "www.allbankonline.in", // bug 1156441
   "www.allinpay.com",
@@ -319,21 +279,17 @@ static const char* const kIntolerantFallbackList[] =
   "www.bauschonline.com",
   "www.baybloorradio.com", // bug 1173661
   "www.bbsfonline.com",
-  "www.bettertrades.com",
   "www.bigflix.com",
   "www.blastam.com",
   "www.blogwatcher.co.jp",
   "www.blueprintonline.co.za",
-  "www.boe.es",
   "www.boostmobilesales.com", // bug 1112178
   "www.borsaitaliana.it",
   "www.bottegaverde.es",
   "www.bottegaverde.it",
   "www.bottegaverde.pt",
-  "www.bredbandsbolaget.se", // bug 1158755
   "www.businessdirect.bt.com",
   "www.cafedumonde.jp",
-  "www.car2go.com", // bug 1185080
   "www.careers.asio.gov.au",
   "www.cherry.de", // bug 1141521
   "www.chinapay.com", // bug 1137983
@@ -347,7 +303,7 @@ static const char* const kIntolerantFallbackList[] =
   "www.creditagricole.info",
   "www.css-club.net",
   "www.ctfeshop.com.cn",
-  "www.cwu.edu",
+  "www.cwu.edu", // bug 1143035
   "www.dabs.com",
   "www.dabs.ie",
   "www.dabs4work.ie",
@@ -364,21 +320,17 @@ static const char* const kIntolerantFallbackList[] =
   "www.ermis.gov.gr",
   "www.esadealumni.net",
   "www.esavingsaccount.co.uk",
-  "www.escrowrefills.com",
-  "www.essentialsupplies.com",
   "www.everyd.com",
   "www.ezpay.com.tw",
   "www.fhsaa.org",
   "www.fibi-online.co.il", // bug 1165580
   "www.fj96336.com",
-  "www.fontainebleau.com",
   "www.foundersc.com",
   "www.fubar.com",
   "www.gamers-onlineshop.jp", // bug 1126654
   "www.gbe-bund.de",
   "www.giftcertificates.com",
   "www.gtja.com",
-  "www.haynes.co.uk",
   "www.hercle.com",
   "www.hn.10086.cn",
   "www.hpshop.gr",
@@ -388,20 +340,18 @@ static const char* const kIntolerantFallbackList[] =
   "www.interpark.com",
   "www.isracard.co.il", // bug 1165582
   "www.jaf.or.jp",
-  "www.jifenpay.com",
   "www.kasite.net",
   "www.khan.co.kr",
+  "www.king-solarman.com", // bug 1190706
   "www.kredodirect.com.ua", // bug 1095507
   "www.law888.com.tw",
   "www.lewisham.gov.uk",
-  "www.lib.cwu.edu",
   "www.libraryvideo.com",
   "www.lm-order.de",
   "www.londonstockexchange.com",
   "www.matkahuolto.info",
   "www.matrics.or.jp",
   "www.mchrono.com",
-  "www.mecsumai.com",
   "www.meta-ehealth.com",
   "www.misterdonut.jp",
   "www.mp2.aeroport.fr",
@@ -409,12 +359,10 @@ static const char* const kIntolerantFallbackList[] =
   "www.mtsindia.in", // RC4
   "www.my.airdo.jp", // bug 1129773
   "www.myagent.gov.ab.ca", // bug 1152827
-  "www.mynpcdata.net",
   "www.mywebreservations.com",
   "www.ncsoft.com", // bug 1139782
   "www.nec-nexs.com",
   "www.newchinalife.com",
-  "www.nishi.or.jp",
   "www.ocbcwhhk.com", // bug 1141746
   "www.openwebosproject.org", // bug 1151990
   "www.pen-kanagawa.ed.jp",
@@ -422,15 +370,12 @@ static const char* const kIntolerantFallbackList[] =
   "www.publicjobs.ie",
   "www.publicrecords.com",
   "www.pwcrecruiting.com",
-  "www.rapidscansecure.com", // bug 1177212
   "www.razorgator.com",
   "www.recoup.com",
-  "www.regonline.com", // bug 1139783
   "www.renaultcredit.com.ar",
   "www.reputation.com",
   "www.rietumu.lv",
   "www.rimac.com.pe",
-  "www.riversendtrading.com",
   "www.roxyaffiliates.com",
   "www.s-book.net",
   "www.safepass.cn",
@@ -439,9 +384,7 @@ static const char* const kIntolerantFallbackList[] =
   "www.shop.bt.com",
   "www.slovanet.sk",
   "www.smartcart.com",
-  "www.smartoffice.jp",
   "www.sokamocka.com",
-  "www.starbucks.com", // bug 1167190
   "www.stenhouse.com",
   "www.sunderland.gov.uk",
   "www.syzygy.co.uk",
@@ -455,7 +398,6 @@ static const char* const kIntolerantFallbackList[] =
   "www.ur-net.go.jp",
   "www.usacycling.org", // bug 1163791
   "www.usairways.com", // bug 1142703
-  "www.userdoor.com",
   "www.utradehub.or.kr",
   "www.virgin.net",
   "www.wavecable.com",
@@ -471,7 +413,6 @@ static const char* const kIntolerantFallbackList[] =
   "www3.ibac.co.jp",
   "www3.taiheiyo-ferry.co.jp",
   "www4.aeroplan.com", // bug 1137543
-  "wwws.kadokawa.co.jp",
   "xyk.cebbank.com", // bug 1145524
   "zenfolio.com",
   "zoominfo.com",
diff --git a/security/manager/ssl/nsNSSIOLayer.cpp b/security/manager/ssl/nsNSSIOLayer.cpp
index 7b45843eb16d..4779b7c579e6 100644
--- a/security/manager/ssl/nsNSSIOLayer.cpp
+++ b/security/manager/ssl/nsNSSIOLayer.cpp
@@ -1723,6 +1723,7 @@ private:
 
 static const char* const kFallbackWildcardList[] =
 {
+  ".eur.xerox.com", // bug 1187215
   ".kuronekoyamato.co.jp", // bug 1128366
   ".wildcard.test",
 };
diff --git a/testing/mochitest/mach_commands.py b/testing/mochitest/mach_commands.py
index eb417591dea7..38fa3bb264f9 100644
--- a/testing/mochitest/mach_commands.py
+++ b/testing/mochitest/mach_commands.py
@@ -420,6 +420,14 @@ def setup_argument_parser():
 
         from mochitest_options import MochitestArgumentParser
 
+    if conditions.is_android(build_obj):
+        # On Android, check for a connected device (and offer to start an
+        # emulator if appropriate) before running tests. This check must
+        # be done in this admittedly awkward place because
+        # MochitestArgumentParser initialization fails if no device is found.
+        from mozrunner.devices.android_device import verify_android_device
+        verify_android_device(build_obj, install=True)
+
     return MochitestArgumentParser()
 
 
diff --git a/testing/mozbase/mozrunner/mozrunner/devices/android_device.py b/testing/mozbase/mozrunner/mozrunner/devices/android_device.py
new file mode 100644
index 000000000000..1a88e525988d
--- /dev/null
+++ b/testing/mozbase/mozrunner/mozrunner/devices/android_device.py
@@ -0,0 +1,522 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import os
+import psutil
+import re
+import shutil
+import signal
+import telnetlib
+import time
+import urllib2
+from distutils.spawn import find_executable
+
+from mozdevice import DeviceManagerADB, DMError
+from mozprocess import ProcessHandler
+
+EMULATOR_HOME_DIR = os.path.join(os.path.expanduser('~'), '.mozbuild', 'android-device')
+
+TOOLTOOL_URL = 'https://raw.githubusercontent.com/mozilla/build-tooltool/master/tooltool.py'
+
+class AvdInfo(object):
+    """
+       Simple class to contain an AVD description.
+    """
+    def __init__(self, description, name, tooltool_manifest, extra_args,
+                 port, uses_sut, sut_port, sut_port2):
+        self.description = description
+        self.name = name
+        self.tooltool_manifest = tooltool_manifest
+        self.extra_args = extra_args
+        self.port = port
+        self.uses_sut = uses_sut
+        self.sut_port = sut_port
+        self.sut_port2 = sut_port2
+
+
+"""
+   A dictionary to map an AVD type to a description of that type of AVD.
+
+   There is one entry for each type of AVD used in Mozilla automated tests
+   and the parameters for each reflect those used in mozharness.
+"""
+AVD_DICT = {
+    '2.3': AvdInfo('Android 2.3',
+                   'mozemulator-2.3',
+                   'testing/config/tooltool-manifests/androidarm/releng.manifest',
+                   ['-debug',
+                    'init,console,gles,memcheck,adbserver,adbclient,adb,avd_config,socket',
+                    '-qemu', '-m', '1024', '-cpu', 'cortex-a9'],
+                   5554,
+                   True,
+                   20701, 20700),
+    '4.3': AvdInfo('Android 4.3',
+                   'mozemulator-4.3',
+                   'testing/config/tooltool-manifests/androidarm_4_3/releng.manifest',
+                   ['-show-kernel', '-debug',
+                    'init,console,gles,memcheck,adbserver,adbclient,adb,avd_config,socket'],
+                   5554,
+                   False,
+                   0, 0),
+    'x86': AvdInfo('Android 4.2 x86',
+                   'mozemulator-x86',
+                   'testing/config/tooltool-manifests/androidx86/releng.manifest',
+                   ['-debug',
+                    'init,console,gles,memcheck,adbserver,adbclient,adb,avd_config,socket',
+                    '-qemu', '-m', '1024', '-enable-kvm'],
+                   5554,
+                   True,
+                   20701, 20700)
+}
+
+def verify_android_device(build_obj, install=False):
+    """
+       Determine if any Android device is connected via adb.
+       If no device is found, prompt to start an emulator.
+       If a device is found or an emulator started and 'install' is
+       specified, also check whether Firefox is installed on the
+       device; if not, prompt to install Firefox.
+       Returns True if the emulator was started or another device was
+       already connected.
+    """
+    device_verified = False
+    emulator = AndroidEmulator('*', substs=build_obj.substs)
+    devices = emulator.dm.devices()
+    if len(devices) > 0:
+        device_verified = True
+    elif emulator.is_available():
+        response = raw_input(
+            "No Android devices connected. Start an emulator? (Y/n) ").strip()
+        if response.lower().startswith('y') or response == '':
+            if not emulator.check_avd():
+                print("Fetching AVD. This may take a while...")
+                emulator.update_avd()
+            print("Starting emulator running %s..." %
+                emulator.get_avd_description())
+            emulator.start()
+            emulator.wait_for_start()
+            device_verified = True
+
+    if device_verified and install:
+        # Determine if Firefox is installed on the device; if not,
+        # prompt to install. This feature allows a test command to
+        # launch an emulator, install Firefox, and proceed with testing
+        # in one operation. It is also a basic safeguard against other
+        # cases where testing is requested but Firefox installation has
+        # been forgotten.
+        # If Firefox is installed, there is no way to determine whether
+        # the current build is installed, and certainly no way to
+        # determine if the installed build is the desired build.
+        # Installing every time is problematic because:
+        #  - it prevents testing against other builds (downloaded apk)
+        #  - installation may take a couple of minutes.
+        installed = emulator.dm.shellCheckOutput(['pm', 'list',
+            'packages', 'org.mozilla.'])
+        if not 'fennec' in installed and not 'firefox' in installed:
+            response = raw_input(
+                "It looks like Firefox is not installed on this device.\n"
+                "Install Firefox? (Y/n) ").strip()
+            if response.lower().startswith('y') or response == '':
+                print("Installing Firefox. This may take a while...")
+                build_obj._run_make(directory=".", target='install',
+                    ensure_exit_code=False)
+    return device_verified
+
+
+class AndroidEmulator(object):
+
+    """
+        Support running the Android emulator with an AVD from Mozilla
+        test automation.
+
+        Example usage:
+            emulator = AndroidEmulator()
+            if not emulator.is_running() and emulator.is_available():
+                if not emulator.check_avd():
+                    warn("this may take a while...")
+                    emulator.update_avd()
+                emulator.start()
+                emulator.wait_for_start()
+                emulator.wait()
+    """
+
+    def __init__(self, avd_type='4.3', verbose=False, substs=None):
+        self.emulator_log = None
+        self.emulator_path = 'emulator'
+        self.verbose = verbose
+        self.substs = substs
+        self.avd_type = self._get_avd_type(avd_type)
+        self.avd_info = AVD_DICT[self.avd_type]
+        adb_path = self._find_sdk_exe('adb', False)
+        if not adb_path:
+            adb_path = 'adb'
+        self.dm = DeviceManagerADB(autoconnect=False, adbPath=adb_path, retryLimit=1)
+        self.dm.default_timeout = 10
+        self._log_debug("Emulator created with type %s" % self.avd_type)
+
+    def __del__(self):
+        if self.emulator_log:
+            self.emulator_log.close()
+
+    def is_running(self):
+        """
+           Returns True if the Android emulator is running.
+        """
+        for proc in psutil.process_iter():
+            name = proc.name()
+            # On some platforms, "emulator" may start an emulator with
+            # process name "emulator64-arm" or similar.
+            if name and name.startswith('emulator'):
+                return True
+        return False
+
+    def is_available(self):
+        """
+           Returns True if an emulator executable is found.
+        """
+        found = False
+        emulator_path = self._find_sdk_exe('emulator', True)
+        if emulator_path:
+            self.emulator_path = emulator_path
+            found = True
+        return found
+
+    def check_avd(self, force=False):
+        """
+           Determine if the AVD is already installed locally.
+           (This is usually used to determine if update_avd() is likely
+           to require a download; it is a convenient way of determining
+           whether a 'this may take a while' warning is warranted.)
+
+           Returns True if the AVD is installed.
+        """
+        avd = os.path.join(
+            EMULATOR_HOME_DIR, 'avd', self.avd_info.name + '.avd')
+        if force and os.path.exists(avd):
+            shutil.rmtree(avd)
+        if os.path.exists(avd):
+            self._log_debug("AVD found at %s" % avd)
+            return True
+        return False
+
+    def update_avd(self, force=False):
+        """
+           If required, update the AVD via tooltool.
+
+           If the AVD directory is not found, or "force" is requested,
+           download the tooltool manifest associated with the AVD and then
+           invoke tooltool.py on the manifest. tooltool.py will download the
+           required archive (unless already present in the local tooltool
+           cache) and install the AVD.
+        """
+        avd = os.path.join(
+            EMULATOR_HOME_DIR, 'avd', self.avd_info.name + '.avd')
+        if force and os.path.exists(avd):
+            shutil.rmtree(avd)
+        if not os.path.exists(avd):
+            self._fetch_tooltool()
+            self._fetch_tooltool_manifest()
+            self._tooltool_fetch()
+            self._update_avd_paths()
+
+    def start(self):
+        """
+           Launch the emulator.
+        """
+        def outputHandler(line):
+            self.emulator_log.write("<%s>\n" % line)
+        env = os.environ
+        env['ANDROID_AVD_HOME'] = os.path.join(EMULATOR_HOME_DIR, "avd")
+        command = [self.emulator_path, "-avd",
+                   self.avd_info.name, "-port", "5554"]
+        if self.avd_info.extra_args:
+            command += self.avd_info.extra_args
+        log_path = os.path.join(EMULATOR_HOME_DIR, 'emulator.log')
+        self.emulator_log = open(log_path, 'w')
+        self._log_debug("Starting the emulator with this command: %s" %
+                        ' '.join(command))
+        self._log_debug("Emulator output will be written to '%s'" %
+                        log_path)
+        self.proc = ProcessHandler(
+            command, storeOutput=False, processOutputLine=outputHandler,
+            env=env)
+        self.proc.run()
+        self._log_debug("Emulator started with pid %d" %
+                        int(self.proc.proc.pid))
+
+    def wait_for_start(self):
+        """
+           Verify that the emulator is running, the emulator device is visible
+           to adb, and Android has booted.
+        """
+        if not self.proc:
+            self._log_warning("Emulator not started!")
+            return False
+        if self.proc.proc.poll() is not None:
+            self._log_warning("Emulator has already completed!")
+            return False
+        self._log_debug("Waiting for device status...")
+        while(('emulator-5554', 'device') not in self.dm.devices()):
+            time.sleep(10)
+            if self.proc.proc.poll() is not None:
+                self._log_warning("Emulator has already completed!")
+                return False
+        self._log_debug("Device status verified.")
+
+        self._log_debug("Checking that Android has booted...")
+        complete = False
+        while(not complete):
+            output = ''
+            try:
+                output = self.dm.shellCheckOutput(
+                    ['getprop', 'sys.boot_completed'], timeout=5)
+            except DMError:
+                # adb not yet responding...keep trying
+                pass
+            if output.strip() == '1':
+                complete = True
+            else:
+                time.sleep(10)
+                if self.proc.proc.poll() is not None:
+                    self._log_warning("Emulator has already completed!")
+                    return False
+        self._log_debug("Android boot status verified.")
+
+        if not self._verify_emulator():
+            return False
+        if self.avd_info.uses_sut:
+            if not self._verify_sut():
+                return False
+        return True
+
+    def wait(self):
+        """
+           Wait for the emulator to close. If interrupted, close the emulator.
+        """
+        try:
+            self.proc.wait()
+        except:
+            if self.proc.poll() is None:
+                self.cleanup()
+        return self.proc.poll()
+
+    def cleanup(self):
+        """
+           Close the emulator.
+        """
+        self.proc.kill(signal.SIGTERM)
+
+    def get_avd_description(self):
+        """
+           Return the human-friendly description of this AVD.
+        """
+        return self.avd_info.description
+
+    def _log_debug(self, text):
+        if self.verbose:
+            print "DEBUG: %s" % text
+
+    def _log_warning(self, text):
+        print "WARNING: %s" % text
+
+    def _fetch_tooltool(self):
+        self._download_file(TOOLTOOL_URL, 'tooltool.py', EMULATOR_HOME_DIR)
+
+    def _fetch_tooltool_manifest(self):
+        url = 'https://hg.mozilla.org/%s/raw-file/%s/%s' % (
+            "try", "default", self.avd_info.tooltool_manifest)
+        self._download_file(url, 'releng.manifest', EMULATOR_HOME_DIR)
+
+    def _tooltool_fetch(self):
+        def outputHandler(line):
+            self._log_debug(line)
+        command = ['python', 'tooltool.py', 'fetch', '-m', 'releng.manifest']
+        proc = ProcessHandler(
+            command, processOutputLine=outputHandler, storeOutput=False,
+            cwd=EMULATOR_HOME_DIR)
+        proc.run()
+        try:
+            proc.wait()
+        except:
+            if proc.poll() is None:
+                proc.kill(signal.SIGTERM)
+
+    def _update_avd_paths(self):
+        avd_path = os.path.join(EMULATOR_HOME_DIR, "avd")
+        ini_file = os.path.join(avd_path, "test-1.ini")
+        ini_file_new = os.path.join(avd_path, self.avd_info.name + ".ini")
+        os.rename(ini_file, ini_file_new)
+        avd_dir = os.path.join(avd_path, "test-1.avd")
+        avd_dir_new = os.path.join(avd_path, self.avd_info.name + ".avd")
+        os.rename(avd_dir, avd_dir_new)
+        self._replace_ini_contents(ini_file_new)
+
+    def _download_file(self, url, filename, path):
+        f = urllib2.urlopen(url)
+        if not os.path.isdir(path):
+            try:
+                os.makedirs(path)
+            except Exception, e:
+                self._log_warning(str(e))
+                return False
+        local_file = open(os.path.join(path, filename), 'wb')
+        local_file.write(f.read())
+        local_file.close()
+        self._log_debug("Downloaded %s to %s/%s" % (url, path, filename))
+        return True
+
+    def _replace_ini_contents(self, path):
+        with open(path, "r") as f:
+            lines = f.readlines()
+        with open(path, "w") as f:
+            for line in lines:
+                if line.startswith('path='):
+                    avd_path = os.path.join(EMULATOR_HOME_DIR, "avd")
+                    f.write('path=%s/%s.avd\n' %
+                            (avd_path, self.avd_info.name))
+                elif line.startswith('path.rel='):
+                    f.write('path.rel=avd/%s.avd\n' % self.avd_info.name)
+                else:
+                    f.write(line)
+
+    def _telnet_cmd(self, telnet, command):
+        self._log_debug(">>> " + command)
+        telnet.write('%s\n' % command)
+        result = telnet.read_until('OK', 10)
+        self._log_debug("<<< " + result)
+        return result
+
+    def _verify_emulator(self):
+        telnet_ok = False
+        tn = None
+        while(not telnet_ok):
+            try:
+                tn = telnetlib.Telnet('localhost', self.avd_info.port, 10)
+                if tn is not None:
+                    res = tn.read_until('OK', 10)
+                    self._telnet_cmd(tn, 'avd status')
+                    if self.avd_info.uses_sut:
+                        cmd = 'redir add tcp:%s:%s' % \
+                           (str(self.avd_info.sut_port),
+                            str(self.avd_info.sut_port))
+                        self._telnet_cmd(tn, cmd)
+                        cmd = 'redir add tcp:%s:%s' % \
+                            (str(self.avd_info.sut_port2),
+                             str(self.avd_info.sut_port2))
+                        self._telnet_cmd(tn, cmd)
+                    self._telnet_cmd(tn, 'redir list')
+                    self._telnet_cmd(tn, 'network status')
+                    tn.write('quit\n')
+                    tn.read_all()
+                    telnet_ok = True
+                else:
+                    self._log_warning("Unable to connect to port %d" % port)
+            except:
+                self._log_warning("Trying again after unexpected exception")
+            finally:
+                if tn is not None:
+                    tn.close()
+            if not telnet_ok:
+                time.sleep(10)
+                if self.proc.proc.poll() is not None:
+                    self._log_warning("Emulator has already completed!")
+                    return False
+        return telnet_ok
+
+    def _verify_sut(self):
+        sut_ok = False
+        while(not sut_ok):
+            try:
+                tn = telnetlib.Telnet('localhost', self.avd_info.sut_port, 10)
+                if tn is not None:
+                    self._log_debug(
+                        "Connected to port %d" % self.avd_info.sut_port)
+                    res = tn.read_until('$>', 10)
+                    if res.find('$>') == -1:
+                        self._log_debug("Unexpected SUT response: %s" % res)
+                    else:
+                        self._log_debug("SUT response: %s" % res)
+                        sut_ok = True
+                    tn.write('quit\n')
+                    tn.read_all()
+            except:
+                self._log_debug("Caught exception while verifying sutagent")
+            finally:
+                if tn is not None:
+                    tn.close()
+            if not sut_ok:
+                time.sleep(10)
+                if self.proc.proc.poll() is not None:
+                    self._log_warning("Emulator has already completed!")
+                    return False
+        return sut_ok
+
+    def _get_avd_type(self, requested):
+        if requested in AVD_DICT.keys():
+            return requested
+        if self.substs:
+            if not self.substs['TARGET_CPU'].startswith('arm'):
+                return 'x86'
+            if self.substs['MOZ_ANDROID_MIN_SDK_VERSION'] == '9':
+                return '2.3'
+        return '4.3'
+
+    def _find_sdk_exe(self, exe, tools):
+        if tools:
+            subdir = 'tools'
+            var = 'ANDROID_TOOLS'
+        else:
+            subdir = 'platform-tools'
+            var = 'ANDROID_PLATFORM_TOOLS'
+
+        found = False
+        # Is exe on PATH?
+        exe_path = find_executable(exe)
+        if exe_path:
+            found = True
+        else:
+            self._log_debug("Unable to find executable on PATH")
+
+        if not found:
+            # Can exe be found in the Android SDK?
+            try:
+                android_sdk_root = os.environ['ANDROID_SDK_ROOT']
+                exe_path = os.path.join(
+                    android_sdk_root, subdir, exe)
+                if os.path.exists(exe_path):
+                    found = True
+                else:
+                    self._log_debug(
+                        "Unable to find executable at %s" % exe_path)
+            except KeyError:
+                self._log_debug("ANDROID_SDK_ROOT not set")
+
+        if not found and self.substs:
+            # Can exe be found in ANDROID_TOOLS/ANDROID_PLATFORM_TOOLS?
+            try:
+                exe_path = os.path.join(
+                    self.substs[var], exe)
+                if os.path.exists(exe_path):
+                    found = True
+                else:
+                    self._log_debug(
+                        "Unable to find executable at %s" % exe_path)
+            except KeyError:
+                self._log_debug("%s not set" % var)
+
+        if not found:
+            # Can exe be found in the default bootstrap location?
+            exe_path = os.path.join(
+                '~', '.mozbuild', 'android-sdk-linux', subdir, exe)
+            if os.path.exists(exe_path):
+                found = True
+            else:
+                self._log_debug(
+                    "Unable to find executable at %s" % exe_path)
+
+        if found:
+            self._log_debug("%s found at %s" % (exe, exe_path))
+        else:
+            exe_path = None
+        return exe_path
diff --git a/testing/xpcshell/mach_commands.py b/testing/xpcshell/mach_commands.py
index 5582d73b2ba3..ddae82919283 100644
--- a/testing/xpcshell/mach_commands.py
+++ b/testing/xpcshell/mach_commands.py
@@ -483,6 +483,8 @@ class MachCommands(MachCommandBase):
                                                              {"verbose": True})
 
         if conditions.is_android(self):
+            from mozrunner.devices.android_device import verify_android_device
+            verify_android_device(self)
             xpcshell = self._spawn(AndroidXPCShellRunner)
         elif conditions.is_b2g(self):
             xpcshell = self._spawn(B2GXPCShellRunner)
diff --git a/toolkit/components/passwordmgr/LoginManagerContent.jsm b/toolkit/components/passwordmgr/LoginManagerContent.jsm
index 1e2689bfc81a..1b099f374ee0 100644
--- a/toolkit/components/passwordmgr/LoginManagerContent.jsm
+++ b/toolkit/components/passwordmgr/LoginManagerContent.jsm
@@ -476,7 +476,9 @@ var LoginManagerContent = {
     // If we have a target input, fills it's form.
     if (inputElement) {
       form = FormLikeFactory.createFromField(inputElement);
-      clobberUsername = false;
+      if (inputElement.type == "password") {
+        clobberUsername = false;
+      }
     }
     this._fillForm(form, true, clobberUsername, true, true, loginsFound, recipes, options);
   },
@@ -812,8 +814,11 @@ var LoginManagerContent = {
    *
    * @param {HTMLFormElement} form
    * @param {bool} autofillForm denotes if we should fill the form in automatically
-   * @param {bool} clobberUsername controls if an existing username can be
-   *                               overwritten
+   * @param {bool} clobberUsername controls if an existing username can be overwritten.
+   *                               If this is false and an inputElement of type password
+   *                               is also passed, the username field will be ignored.
+   *                               If this is false and no inputElement is passed, if the username
+   *                               field value is not found in foundLogins, it will not fill the password.
    * @param {bool} clobberPassword controls if an existing password value can be
    *                               overwritten
    * @param {bool} userTriggered is an indication of whether this filling was triggered by
@@ -867,11 +872,16 @@ var LoginManagerContent = {
       // the same as the one heuristically found, use the parameter
       // one instead.
       if (inputElement) {
-        if (inputElement.type != "password") {
+        if (inputElement.type == "password") {
+          passwordField = inputElement;
+          if (!clobberUsername) {
+            usernameField = null;
+          }
+        } else if (LoginHelper.isUsernameFieldType(inputElement)) {
+          usernameField = inputElement;
+        } else {
           throw new Error("Unexpected input element type.");
         }
-        passwordField = inputElement;
-        usernameField = null;
       }
 
       // Need a valid password field to do anything.
@@ -1031,6 +1041,53 @@ var LoginManagerContent = {
     }
   },
 
+  /**
+   * Verify if a field is a valid login form field and
+   * returns some information about it's FormLike.
+   *
+   * @param {Element} aField
+   *                  A form field we want to verify.
+   *
+   * @returns {Object} an object with information about the
+   *                   FormLike username and password field
+   *                   or null if the passed field is invalid.
+   */
+  getFieldContext(aField) {
+    // If the element is not a proper form field, return null.
+    if (!(aField instanceof Ci.nsIDOMHTMLInputElement) ||
+        (aField.type != "password" && !LoginHelper.isUsernameFieldType(aField)) ||
+        !aField.ownerDocument) {
+      return null;
+    }
+    let form = FormLikeFactory.createFromField(aField);
+
+    let doc = aField.ownerDocument;
+    let messageManager = messageManagerFromWindow(doc.defaultView);
+    let recipes = messageManager.sendSyncMessage("RemoteLogins:findRecipes", {
+      formOrigin: LoginUtils._getPasswordOrigin(doc.documentURI),
+    })[0];
+
+    let [usernameField, newPasswordField, oldPasswordField] =
+          this._getFormFields(form, false, recipes);
+
+    // If we are not verifying a password field, we want
+    // to use aField as the username field.
+    if (aField.type != "password") {
+      usernameField = aField;
+    }
+
+    return {
+      usernameField: {
+        found: !!usernameField,
+        disabled: usernameField && (usernameField.disabled || usernameField.readOnly),
+      },
+      passwordField: {
+        found: !!newPasswordField,
+        disabled: newPasswordField && (newPasswordField.disabled || newPasswordField.readOnly),
+      },
+    };
+  },
+
 };
 
 var LoginUtils = {
diff --git a/toolkit/components/passwordmgr/LoginManagerContextMenu.jsm b/toolkit/components/passwordmgr/LoginManagerContextMenu.jsm
index f51888cc5d23..b4ce369d9aec 100644
--- a/toolkit/components/passwordmgr/LoginManagerContextMenu.jsm
+++ b/toolkit/components/passwordmgr/LoginManagerContextMenu.jsm
@@ -60,7 +60,7 @@ let LoginManagerContextMenu = {
 
         // login is bound so we can keep the reference to each object.
         item.addEventListener("command", function(login, event) {
-          this._fillPassword(login, inputElement, browser, documentURI);
+          this._fillTargetField(login, inputElement, browser, documentURI);
         }.bind(this, login));
 
         fragment.appendChild(item);
@@ -151,7 +151,7 @@ let LoginManagerContextMenu = {
    *        This isn't the same as the browser's top-level
    *        document URI when subframes are involved.
    */
-  _fillPassword(login, inputElement, browser, documentURI) {
+  _fillTargetField(login, inputElement, browser, documentURI) {
     LoginManagerParent.fillForm({
       browser: browser,
       loginFormOrigin: documentURI.prePath,
diff --git a/toolkit/components/passwordmgr/test/browser/browser_context_menu.js b/toolkit/components/passwordmgr/test/browser/browser_context_menu.js
index ef8135c63a8d..aa082ef9f9c9 100644
--- a/toolkit/components/passwordmgr/test/browser/browser_context_menu.js
+++ b/toolkit/components/passwordmgr/test/browser/browser_context_menu.js
@@ -8,6 +8,7 @@ Cu.import("resource://testing-common/LoginTestUtils.jsm", this);
 
 // The hostname for the test URIs.
 const TEST_HOSTNAME = "https://example.com";
+const MULTIPLE_FORMS_PAGE_PATH = "/browser/toolkit/components/passwordmgr/test/browser/multiple_forms.html";
 
 /**
  * Initialize logins needed for the tests and disable autofill
@@ -28,13 +29,35 @@ add_task(function* test_initialize() {
  * Check if the context menu is populated with the right
  * menuitems for the target password input field.
  */
-add_task(function* test_context_menu_populate() {
+add_task(function* test_context_menu_populate_password() {
+  yield BrowserTestUtils.withNewTab({
+    gBrowser,
+    url: TEST_HOSTNAME + MULTIPLE_FORMS_PAGE_PATH,
+  }, function* (browser) {
+    let passwordInput = browser.contentWindow.document.getElementById("test-password-1");
+
+    yield openPasswordContextMenu(browser, passwordInput);
+
+    // Check the content of the password manager popup
+    let popupMenu = document.getElementById("fill-login-popup");
+    checkMenu(popupMenu);
+
+    let contextMenu = document.getElementById("contentAreaContextMenu");
+    contextMenu.hidePopup();
+  });
+});
+
+/**
+ * Check if the context menu is populated with the right menuitems
+ * for the target username field with a password field present.
+ */
+add_task(function* test_context_menu_populate_username_with_password() {
   yield BrowserTestUtils.withNewTab({
     gBrowser,
     url: TEST_HOSTNAME + "/browser/toolkit/components/" +
          "passwordmgr/test/browser/multiple_forms.html",
   }, function* (browser) {
-    let passwordInput = browser.contentWindow.document.getElementById("test-password-1");
+    let passwordInput = browser.contentWindow.document.getElementById("test-username-2");
 
     yield openPasswordContextMenu(browser, passwordInput);
 
@@ -52,87 +75,104 @@ add_task(function* test_context_menu_populate() {
  * login menuitem is clicked.
  */
 add_task(function* test_context_menu_password_fill() {
-  // Set of element ids to check.
-  let testSet = [
-    {
-      passwordInput: "test-password-1",
-      unchangedFields: null,
-    },
-    {
-      passwordInput: "test-password-2",
-      unchangedFields: ["test-username-2"],
-    },
-    {
-      passwordInput: "test-password-3",
-      unchangedFields: ["test-username-3"],
-    },
-    {
-      passwordInput: "test-password-4",
-      unchangedFields: ["test-username-4"],
-    },
-    {
-      passwordInput: "test-password-5",
-      unchangedFields: ["test-username-5", "test-password2-5"],
-    },
-    {
-      passwordInput: "test-password2-5",
-      unchangedFields: ["test-username-5", "test-password-5"],
-    },
-    {
-      passwordInput: "test-password-6",
-      unchangedFields: ["test-username-6", "test-password2-6"],
-    },
-    {
-      passwordInput: "test-password2-6",
-      unchangedFields: ["test-username-6", "test-password-6"],
-    },
-    {
-      passwordInput: "test-password-7",
-      unchangedFields: null,
-    },
-  ];
-
   yield BrowserTestUtils.withNewTab({
     gBrowser,
-    url: TEST_HOSTNAME + "/browser/toolkit/components/" +
-         "passwordmgr/test/browser/multiple_forms.html",
+    url: TEST_HOSTNAME + MULTIPLE_FORMS_PAGE_PATH,
   }, function* (browser) {
-    for (let testCase of testSet) {
-      let passwordInput = browser.contentWindow.document.getElementById(testCase.passwordInput);
 
-      yield openPasswordContextMenu(browser, passwordInput);
+    let testForms = browser.contentWindow.document.getElementsByClassName("test-form");
+    for (let form of testForms) {
+      let usernameInputList = form.querySelectorAll("input[type='password']");
+      info("Testing form: " + form.getAttribute("description"));
 
-      let popupMenu = document.getElementById("fill-login-popup");
+      for (let passwordField of usernameInputList) {
+        info("Testing password field: " + passwordField.id);
 
-      // Store the values of fields that should remain unchanged.
-      let unchangedFieldsValues = null;
-      if (testCase.unchangedFields) {
-        unchangedFieldsValues = [];
-        for (let fieldId of testCase.unchangedFields) {
-          unchangedFieldsValues[fieldId] = browser.contentWindow.document.getElementById(fieldId).value;
+        let contextMenu = document.getElementById("contentAreaContextMenu");
+        let menuItemStatus = form.getAttribute("menuitemStatus");
+
+        // Synthesize a right mouse click over the username input element.
+        yield openPasswordContextMenu(browser, passwordField, ()=> {
+          let popupHeader = document.getElementById("fill-login");
+
+          // If the password field is disabled or read-only, we want to see
+          // the disabled Fill Password popup header.
+          if (passwordField.disabled || passwordField.readOnly) {
+            Assert.ok(!popupHeader.hidden, "Popup menu is not hidden.");
+            Assert.ok(popupHeader.disabled, "Popup menu is disabled.");
+            contextMenu.hidePopup();
+            return false;
+          }
+          return true;
+        });
+
+        if (contextMenu.state != "open") {
+          continue;
         }
+
+        // The only field affected by the password fill
+        // should be the target password field itself.
+        let unchangedFields = form.querySelectorAll('input:not(#' + passwordField.id + ')');
+        yield assertContextMenuFill(form, null, passwordField, unchangedFields);
+        contextMenu.hidePopup();
       }
+    }
+  });
+});
 
-      // Execute the default command of the first login menuitem found at the context menu.
-      let firstLoginItem = popupMenu.getElementsByClassName("context-login-item")[0];
-      firstLoginItem.doCommand();
+/**
+ * Check if the form is correctly filled when one
+ * username context menu login menuitem is clicked.
+ */
+add_task(function* test_context_menu_username_login_fill() {
+  yield BrowserTestUtils.withNewTab({
+    gBrowser,
+    url: TEST_HOSTNAME + MULTIPLE_FORMS_PAGE_PATH,
+  }, function* (browser) {
 
-      yield BrowserTestUtils.waitForEvent(passwordInput, "input", "Password input value changed");
+    let testForms = browser.contentWindow.document.getElementsByClassName("test-form");
+    for (let form of testForms) {
+      let usernameInputList = form.querySelectorAll("input[type='text']");
+      info("Testing form: " + form.getAttribute("description"));
 
-      // Find the used login by it's username (Use only unique usernames in this test).
-      let login = getLoginFromUsername(firstLoginItem.label);
+      for (let usernameField of usernameInputList) {
+        info("Testing username field: " + usernameField.id);
 
-      Assert.equal(login.password, passwordInput.value, "Password filled and correct.");
+        // We always want to check if the first password field is filled,
+        // since this is the current behavior from the _fillForm function.
+        let passwordField = form.querySelector("input[type='password']");
 
-      // Check that the fields that should remain unchanged didn't got modified.
-      if (testCase.unchangedFields) {
-        Assert.ok(testCase.unchangedFields.every(fieldId => {
-          return unchangedFieldsValues[fieldId] == browser.contentWindow.document.getElementById(fieldId).value;
-        }), "Other fields were not changed.");
+        let contextMenu = document.getElementById("contentAreaContextMenu");
+        let menuItemStatus = form.getAttribute("menuitemStatus");
+
+        // Synthesize a right mouse click over the username input element.
+        yield openPasswordContextMenu(browser, usernameField, ()=> {
+          let popupHeader = document.getElementById("fill-login");
+
+          // If we don't want to see the actual popup menu,
+          // check if the popup is hidden or disabled.
+          if (!passwordField || usernameField.disabled || usernameField.readOnly ||
+              passwordField.disabled || passwordField.readOnly) {
+            if (!passwordField) {
+              Assert.ok(popupHeader.hidden, "Popup menu is hidden.");
+            } else {
+              Assert.ok(!popupHeader.hidden, "Popup menu is not hidden.");
+              Assert.ok(popupHeader.disabled, "Popup menu is disabled.");
+            }
+            contextMenu.hidePopup();
+            return false;
+          }
+          return true;
+        });
+
+        if (contextMenu.state != "open") {
+          continue;
+        }
+        // We shouldn't change any field that's not the target username field or the first password field
+        let unchangedFields = form.querySelectorAll('input:not(#' + usernameField.id + '):not(#' + passwordField.id + ')');
+        yield assertContextMenuFill(form, usernameField, passwordField, unchangedFields);
+        contextMenu.hidePopup();
       }
-
-      let contextMenu = document.getElementById("contentAreaContextMenu");
-      contextMenu.hidePopup();
     }
   });
 });
@@ -143,8 +183,7 @@ add_task(function* test_context_menu_password_fill() {
 add_task(function* test_context_menu_iframe_fill() {
   yield BrowserTestUtils.withNewTab({
     gBrowser,
-    url: TEST_HOSTNAME + "/browser/toolkit/components/" +
-         "passwordmgr/test/browser/multiple_forms.html",
+    url: TEST_HOSTNAME + MULTIPLE_FORMS_PAGE_PATH,
   }, function* (browser) {
     let iframe = browser.contentWindow.document.getElementById("test-iframe");
     let passwordInput = iframe.contentDocument.getElementById("form-basic-password");
@@ -199,14 +238,22 @@ add_task(function* test_context_menu_iframe_fill() {
 /**
  * Synthesize mouse clicks to open the password manager context menu popup
  * for a target password input element.
+ *
+ * assertCallback should return true if we should continue or else false.
  */
-function* openPasswordContextMenu(browser, passwordInput) {
+function* openPasswordContextMenu(browser, passwordInput, assertCallback = null) {
   // Synthesize a right mouse click over the password input element.
   let contextMenuShownPromise = BrowserTestUtils.waitForEvent(window, "popupshown");
   let eventDetails = {type: "contextmenu", button: 2};
   BrowserTestUtils.synthesizeMouseAtCenter(passwordInput, eventDetails, browser);
   yield contextMenuShownPromise;
 
+  if (assertCallback) {
+    if (!assertCallback.call()) {
+      return;
+    }
+  }
+
   // Synthesize a mouse click over the fill login menu header.
   let popupHeader = document.getElementById("fill-login");
   let popupShownPromise = BrowserTestUtils.waitForEvent(popupHeader, "popupshown");
@@ -214,6 +261,51 @@ function* openPasswordContextMenu(browser, passwordInput) {
   yield popupShownPromise;
 }
 
+/**
+ * Verify that only the expected form fields are filled.
+ */
+function* assertContextMenuFill(form, usernameField, passwordField, unchangedFields){
+  let popupMenu = document.getElementById("fill-login-popup");
+
+  // Store the value of fields that should remain unchanged.
+  if (unchangedFields.length) {
+    for (let field of unchangedFields) {
+      field.setAttribute("original-value", field.value);
+    }
+  }
+
+  // Execute the default command of the first login menuitem found at the context menu.
+  let firstLoginItem = popupMenu.getElementsByClassName("context-login-item")[0];
+  firstLoginItem.doCommand();
+
+  yield BrowserTestUtils.waitForEvent(form, "input", "Username input value changed");
+
+  // Find the used login by it's username (Use only unique usernames in this test).
+  let login = getLoginFromUsername(firstLoginItem.label);
+
+  // If we have an username field, check if it's correctly filled
+  if (usernameField && usernameField.getAttribute("expectedFail") == null) {
+    Assert.equal(login.username, usernameField.value, "Username filled and correct.");
+  }
+
+  // If we have a password field, check if it's correctly filled
+  if (passwordField && passwordField.getAttribute("expectedFail") == null) {
+    Assert.equal(passwordField.value, login.password, "Password filled and correct.");
+  }
+
+  // Check that all fields that should not change have the same value as before.
+  if (unchangedFields.length) {
+    Assert.ok(()=> {
+      for (let field of unchangedFields) {
+        if (field.value != field.getAttribute("original-value")) {
+          return false;
+        }
+      }
+      return true;
+    }, "Other fields were not changed.");
+  }
+}
+
 /**
  * Check if every login that matches the page hostname are available at the context menu.
  */
diff --git a/toolkit/components/passwordmgr/test/browser/multiple_forms.html b/toolkit/components/passwordmgr/test/browser/multiple_forms.html
index 48db41a85ce2..3f64f89930ba 100644
--- a/toolkit/components/passwordmgr/test/browser/multiple_forms.html
+++ b/toolkit/components/passwordmgr/test/browser/multiple_forms.html
@@ -2,54 +2,126 @@
 <!-- Any copyright is dedicated to the Public Domain.
    - http://creativecommons.org/publicdomain/zero/1.0/ -->
 
-<!-- Password only form -->
-<form id='form-1'>
+
+<form class="test-form"
+      description="Password only form">
     <input id='test-password-1' type='password' name='pname' value=''>
     <input type='submit'>Submit</input>
 </form>
 
-<!-- Simple username and password blank form -->
-<form id='form-2'>
+
+<form class="test-form"
+      description="Username only form">
+    <input id='test-username-1' type='text' name='uname' value=''>
+    <input type='submit'>Submit</input>
+</form>
+
+
+<form class="test-form"
+      description="Simple username and password blank form">
     <input id='test-username-2' type='text'     name='uname' value=''>
     <input id='test-password-2' type='password' name='pname' value=''>
     <button type='submit'>Submit</button>
 </form>
 
-<!-- Simple username and password form, prefilled username -->
-<form id='form-3'>
+
+<form class="test-form"
+      description="Simple username and password form, prefilled username">
     <input id='test-username-3' type='text'     name='uname' value='testuser'>
     <input id='test-password-3' type='password' name='pname' value=''>
     <button type='submit'>Submit</button>
 </form>
 
-<!-- Simple username and password form, prefilled username and password -->
-<form id='form-4'>
+
+<form class="test-form"
+      description="Simple username and password form, prefilled username and password">
     <input id='test-username-4' type='text'     name='uname' value='testuser'>
     <input id='test-password-4' type='password' name='pname' value='testpass'>
     <button type='submit'>Submit</button>
 </form>
 
-<!-- One username and two passwords empty form -->
-<form id='form-5'>
+
+<form class="test-form"
+      description="One username and two passwords empty form">
     <input id='test-username-5'  type='text'     name='uname'>
     <input id='test-password-5'  type='password' name='pname'>
     <input id='test-password2-5' type='password' name='pname2'>
     <button type='submit'>Submit</button>
 </form>
 
-<!-- One username and two passwords form, fields prefiled -->
-<form id='form-6'>
+
+<form class="test-form"
+      description="One username and two passwords form, fields prefiled">
     <input id='test-username-6'  type='text'     name='uname' value="testuser">
     <input id='test-password-6'  type='password' name='pname' value="testpass">
     <input id='test-password2-6' type='password' name='pname2' value="testpass">
     <button type='submit'>Submit</button>
 </form>
 
-<!-- Password field with no form -->
-<div id='form-7'>
+
+<div class="test-form"
+     description="Username and password fields with no form">
+    <input id='test-username-7' type='text'     name='uname' value="testuser">
     <input id='test-password-7' type='password' name='pname' value="testpass">
 </div>
 
+
+<form class="test-form"
+      description="Simple username and password blank form, with disabled password">
+    <input id='test-username-8' type='text'     name='uname' value=''>
+    <input id='test-password-8' type='password' name='pname' value='' disabled>
+    <button type='submit'>Submit</button>
+</form>
+
+
+<form class="test-form"
+      description="Simple username and password blank form, with disabled username">
+    <input id='test-username-9' type='text'     name='uname' value='' disabled>
+    <input id='test-password-9' type='password' name='pname' value=''>
+    <button type='submit'>Submit</button>
+</form>
+
+
+<form class="test-form"
+      description="Simple username and password blank form, with readonly password">
+    <input id='test-username-10' type='text'     name='uname' value=''>
+    <input id='test-password-10' type='password' name='pname' value='' readonly>
+    <button type='submit'>Submit</button>
+</form>
+
+
+<form class="test-form"
+      description="Simple username and password blank form, with readonly username">
+    <input id='test-username-11' type='text'     name='uname' value='' readonly>
+    <input id='test-password-11' type='password' name='pname' value=''>
+    <button type='submit'>Submit</button>
+</form>
+
+
+<form class="test-form"
+      description="Two username and one passwords form, fields prefiled">
+    <input id='test-username-12'  type='text'     name='uname'  value="testuser">
+    <input id='test-username2-12' type='text'     name='uname2' value="testuser">
+    <input id='test-password-12'  type='password' name='pname'  value="testpass">
+    <button type='submit'>Submit</button>
+</form>
+
+
+<form class="test-form"
+      description="Two username and one passwords form, one disabled username field">
+    <input id='test-username-13'  type='text'     name='uname'>
+    <input id='test-username2-13' type='text'     name='uname2' disabled>
+    <input id='test-password-13'  type='password' name='pname'>
+    <button type='submit'>Submit</button>
+</form>
+
+
+<div class="test-form"
+     description="Second username and password fields with no form">
+    <input id='test-username-14' type='text'     name='uname'>
+    <input id='test-password-14' type='password' name='pname' expectedFail>
+</div>
+
 <!-- Form in an iframe -->
 <iframe src="https://example.org/browser/toolkit/components/passwordmgr/test/browser/form_basic.html" id="test-iframe"></iframe>
 
diff --git a/toolkit/components/perfmonitoring/AddonWatcher.jsm b/toolkit/components/perfmonitoring/AddonWatcher.jsm
index 42baa6489729..aa55b2fb8843 100644
--- a/toolkit/components/perfmonitoring/AddonWatcher.jsm
+++ b/toolkit/components/perfmonitoring/AddonWatcher.jsm
@@ -24,12 +24,14 @@ XPCOMUtils.defineLazyServiceGetter(this, "Telemetry",
                                   Ci.nsITelemetry);
 XPCOMUtils.defineLazyModuleGetter(this, "Services",
                                   "resource://gre/modules/Services.jsm");
-
 const FILTERS = [
   {probe: "jank", field: "longestDuration"},
   {probe: "cpow", field: "totalCPOWTime"},
 ];
 
+const WAKEUP_IS_SURPRISINGLY_SLOW_FACTOR = 2;
+const THREAD_TAKES_LOTS_OF_CPU_FACTOR = .75;
+
 let AddonWatcher = {
   _previousPerformanceIndicators: {},
 
@@ -52,6 +54,15 @@ let AddonWatcher = {
    */
   _interval: 15000,
   _ignoreList: null,
+
+  /**
+   * The date of the latest wakeup, in milliseconds since an arbitrary
+   * epoch.
+   *
+   * @type {number}
+   */
+  _latestWakeup: Date.now(),
+
   /**
    * Initialize and launch the AddonWatcher.
    *
@@ -130,6 +141,49 @@ let AddonWatcher = {
   },
   _isPaused: true,
 
+  /**
+   * @return {true} If any measure we have for this wakeup is invalid
+   * because the system is very busy and/or coming backup from hibernation.
+   */
+  _isSystemTooBusy: function(deltaT, currentSnapshot, previousSnapshot) {
+    if (deltaT <= WAKEUP_IS_SURPRISINGLY_SLOW_FACTOR * this._interval) {
+      // The wakeup was reasonably accurate.
+      return false;
+    }
+
+    // There has been a strangely long delay between two successive
+    // wakeups. This can mean one of the following things:
+    // 1. we're in the process of initializing the app;
+    // 2. the system is not responsive, either because it is very busy
+    //   or because it has gone to sleep;
+    // 3. the main loop of the application is so clogged that it could
+    //   not process timer events.
+    //
+    // In cases 1. or 2., any alert here is a false positive.
+    // In case 3., the application (hopefully an add-on) is misbehaving and we need
+    // to identify what's wrong.
+
+    if (!previousSnapshot) {
+      // We're initializing, skip.
+      return true;
+    }
+
+    let diff = snapshot.processData.subtract(previousSnapshot.processData);
+    if (diff.totalCPUTime >= deltaT * THREAD_TAKES_LOTS_OF_CPU_FACTOR ) {
+      // The main thread itself is using lots of CPU, perhaps because of
+      // an add-on. We need to investigate.
+      //
+      // Note that any measurement based on wallclock time may
+      // be affected by the lack of responsiveness of the main event loop,
+      // so we may end up with false positives along the way.
+      return false;
+    }
+
+    // The application is apparently behaving correctly, so the issue must
+    // be somehow due to the system.
+    return true;
+  },
+
   /**
    * Check the performance of add-ons during the latest slice of time.
    *
@@ -139,9 +193,14 @@ let AddonWatcher = {
    * slice.
    */
   _checkAddons: function() {
+    let previousWakeup = this._latestWakeup;
+    let currentWakeup = this._latestWakeup = Date.now();
+
     return Task.spawn(function*() {
       try {
-        let snapshot = yield this._monitor.promiseSnapshot();
+        let previousSnapshot = this._latestSnapshot; // FIXME: Implement
+        let snapshot = this._latestSnapshot = yield this._monitor.promiseSnapshot();
+        let isSystemTooBusy = this._isSystemTooBusy(currentWakeup - previousWakeup, snapshot, previousSnapshot);
 
         let limits = {
           // By default, warn if we have a total time of 1s of CPOW per 15 seconds
@@ -173,12 +232,18 @@ let AddonWatcher = {
 
           if (!previous) {
             // This is the first time we see the addon, so we are probably
-            // executed right during/after startup. Performance is always
+            // executed right during/just after its startup. Performance is always
             // weird during startup, with the JIT warming up, competition
             // in disk access, etc. so we do not take this as a reason to
             // display the slow addon warning.
             continue;
           }
+          if (isSystemTooBusy) {
+            // The main event loop is behaving weirdly, most likely because of
+            // the system being busy or asleep, so results are not trustworthy.
+            // Ignore.
+            continue;
+          }
 
           // Report misbehaviors to Telemetry
 
diff --git a/toolkit/devtools/css-color.js b/toolkit/devtools/css-color.js
index 996b8773901f..bed9779d0cf4 100644
--- a/toolkit/devtools/css-color.js
+++ b/toolkit/devtools/css-color.js
@@ -57,7 +57,8 @@ function CssColor(colorValue) {
 module.exports.colorUtils = {
   CssColor: CssColor,
   rgbToHsl: rgbToHsl,
-  setAlpha: setAlpha
+  setAlpha: setAlpha,
+  classifyColor: classifyColor
 };
 
 /**
@@ -74,7 +75,10 @@ CssColor.COLORUNIT = {
 CssColor.prototype = {
   _colorUnit: null,
 
+  // The value as-authored.
   authored: null,
+  // A lower-cased copy of |authored|.
+  lowerCased: null,
 
   get colorUnit() {
     if (this._colorUnit === null) {
@@ -112,7 +116,7 @@ CssColor.prototype = {
   },
 
   get specialValue() {
-    return SPECIALVALUES.has(this.authored) ? this.authored : null;
+    return SPECIALVALUES.has(this.lowerCased) ? this.authored : null;
   },
 
   get name() {
@@ -171,8 +175,8 @@ CssColor.prototype = {
       return invalidOrSpecialValue;
     }
     if (!this.hasAlpha) {
-      if (this.authored.startsWith("rgb(")) {
-        // The color is valid and begins with rgb(. Return the authored value.
+      if (this.lowerCased.startsWith("rgb(")) {
+        // The color is valid and begins with rgb(.
         return this.authored;
       }
       let tuple = this._getRGBATuple();
@@ -186,8 +190,8 @@ CssColor.prototype = {
     if (invalidOrSpecialValue !== false) {
       return invalidOrSpecialValue;
     }
-    if (this.authored.startsWith("rgba(")) {
-      // The color is valid and begins with rgba(. Return the authored value.
+    if (this.lowerCased.startsWith("rgba(")) {
+      // The color is valid and begins with rgba(.
         return this.authored;
     }
     let components = this._getRGBATuple();
@@ -202,8 +206,8 @@ CssColor.prototype = {
     if (invalidOrSpecialValue !== false) {
       return invalidOrSpecialValue;
     }
-    if (this.authored.startsWith("hsl(")) {
-      // The color is valid and begins with hsl(. Return the authored value.
+    if (this.lowerCased.startsWith("hsl(")) {
+      // The color is valid and begins with hsl(.
       return this.authored;
     }
     if (this.hasAlpha) {
@@ -217,8 +221,8 @@ CssColor.prototype = {
     if (invalidOrSpecialValue !== false) {
       return invalidOrSpecialValue;
     }
-    if (this.authored.startsWith("hsla(")) {
-      // The color is valid and begins with hsla(. Return the authored value.
+    if (this.lowerCased.startsWith("hsla(")) {
+      // The color is valid and begins with hsla(.
       return this.authored;
     }
     if (this.hasAlpha) {
@@ -256,7 +260,11 @@ CssColor.prototype = {
    *         Any valid color string
    */
   newColor: function(color) {
-    this.authored = color.toLowerCase();
+    // Store a lower-cased version of the color to help with format
+    // testing.  The original text is kept as well so it can be
+    // returned when needed.
+    this.lowerCased = color.toLowerCase();
+    this.authored = color;
     return this;
   },
 
@@ -319,7 +327,7 @@ CssColor.prototype = {
   },
 
   _hsl: function(maybeAlpha) {
-    if (this.authored.startsWith("hsl(") && maybeAlpha === undefined) {
+    if (this.lowerCased.startsWith("hsl(") && maybeAlpha === undefined) {
       // We can use it as-is.
       return this.authored;
     }
@@ -415,6 +423,27 @@ function setAlpha(colorValue, alpha) {
   return "rgba(" + r + ", " + g + ", " + b + ", " + alpha + ")";
 }
 
+/**
+ * Given a color, classify its type as one of the possible color
+ * units, as known by |CssColor.colorUnit|.
+ *
+ * @param  {String} value
+ *         The color, in any form accepted by CSS.
+ * @return {String}
+ *         The color classification, one of "rgb", "hsl", "hex", or "name".
+ */
+function classifyColor(value) {
+  value = value.toLowerCase();
+  if (value.startsWith("rgb(") || value.startsWith("rgba(")) {
+    return CssColor.COLORUNIT.rgb;
+  } else if (value.startsWith("hsl(") || value.startsWith("hsla(")) {
+    return CssColor.COLORUNIT.hsl;
+  } else if (/^#[0-9a-f]+$/.exec(value)) {
+    return CssColor.COLORUNIT.hex;
+  }
+  return CssColor.COLORUNIT.name;
+}
+
 loader.lazyGetter(this, "DOMUtils", function () {
   return Cc["@mozilla.org/inspector/dom-utils;1"].getService(Ci.inIDOMUtils);
 });
diff --git a/toolkit/devtools/server/actors/promises.js b/toolkit/devtools/server/actors/promises.js
index 02352d39e2e7..de1a39ac6691 100644
--- a/toolkit/devtools/server/actors/promises.js
+++ b/toolkit/devtools/server/actors/promises.js
@@ -241,5 +241,9 @@ exports.PromisesFront = protocol.FrontClass(PromisesActor, {
     protocol.Front.prototype.initialize.call(this, client, form);
     this.actorID = form.promisesActor;
     this.manage(this);
+  },
+
+  destroy: function() {
+    protocol.Front.prototype.destroy.call(this);
   }
 });
diff --git a/toolkit/devtools/tests/unit/test_cssColor.js b/toolkit/devtools/tests/unit/test_cssColor.js
new file mode 100644
index 000000000000..3db665673c80
--- /dev/null
+++ b/toolkit/devtools/tests/unit/test_cssColor.js
@@ -0,0 +1,29 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// Test classifyColor.
+
+"use strict";
+
+const {colorUtils} = require("devtools/css-color");
+
+const CLASSIFY_TESTS = [
+  { input: "rgb(255,0,192)", output: "rgb" },
+  { input: "RGB(255,0,192)", output: "rgb" },
+  { input: "rgba(255,0,192, 0.25)", output: "rgb" },
+  { input: "hsl(5, 5, 5)", output: "hsl" },
+  { input: "hsla(5, 5, 5, 0.25)", output: "hsl" },
+  { input: "hSlA(5, 5, 5, 0.25)", output: "hsl" },
+  { input: "#f0c", output: "hex" },
+  { input: "#fe01cb", output: "hex" },
+  { input: "#FE01CB", output: "hex" },
+  { input: "blue", output: "name" },
+  { input: "orange", output: "name" }
+];
+
+function run_test() {
+  for (let test of CLASSIFY_TESTS) {
+    let result = colorUtils.classifyColor(test.input);
+    equal(result, test.output, "test classifyColor(" + test.input + ")");
+  }
+}
diff --git a/toolkit/devtools/tests/unit/xpcshell.ini b/toolkit/devtools/tests/unit/xpcshell.ini
index 94340145804d..9a1eafa729e8 100644
--- a/toolkit/devtools/tests/unit/xpcshell.ini
+++ b/toolkit/devtools/tests/unit/xpcshell.ini
@@ -16,6 +16,7 @@ support-files =
 [test_defineLazyPrototypeGetter.js]
 [test_async-utils.js]
 [test_consoleID.js]
+[test_cssColor.js]
 [test_prettifyCSS.js]
 [test_require_lazy.js]
 [test_require.js]
diff --git a/tools/mercurial/hgsetup/config.py b/tools/mercurial/hgsetup/config.py
index eed57363d71e..ff3152b49a77 100644
--- a/tools/mercurial/hgsetup/config.py
+++ b/tools/mercurial/hgsetup/config.py
@@ -12,7 +12,7 @@ import os
 
 HOST_FINGERPRINTS = {
     'bitbucket.org': '46:de:34:e7:9b:18:cd:7f:ae:fd:8b:e3:bc:f4:1a:5e:38:d7:ac:24',
-    'bugzilla.mozilla.org': '47:13:a2:14:0c:46:45:53:12:0d:e5:36:16:a5:60:26:3e:da:3a:60',
+    'bugzilla.mozilla.org': 'f9:7e:62:42:4e:38:79:96:ca:87:71:2a:f8:51:38:c8:16:92:5c:a7',
     'hg.mozilla.org': 'af:27:b9:34:47:4e:e5:98:01:f6:83:2b:51:c9:aa:d8:df:fb:1a:27',
 }
 
diff --git a/widget/EventMessageList.h b/widget/EventMessageList.h
index 9a6434cf624a..4163cf84782f 100644
--- a/widget/EventMessageList.h
+++ b/widget/EventMessageList.h
@@ -79,40 +79,40 @@ NS_EVENT_MESSAGE(ePointerEventLast,     ePointerLostCapture)
 NS_EVENT_MESSAGE(eContextMenuFirst,     500)
 NS_EVENT_MESSAGE(eContextMenu,          eContextMenuFirst)
 
-NS_EVENT_MESSAGE(NS_STREAM_EVENT_START, 1100)
-NS_EVENT_MESSAGE(NS_LOAD,               NS_STREAM_EVENT_START)
-NS_EVENT_MESSAGE(NS_PAGE_UNLOAD,        NS_STREAM_EVENT_START + 1)
-NS_EVENT_MESSAGE(NS_HASHCHANGE,         NS_STREAM_EVENT_START + 2)
-NS_EVENT_MESSAGE(NS_IMAGE_ABORT,        NS_STREAM_EVENT_START + 3)
-NS_EVENT_MESSAGE(NS_LOAD_ERROR,         NS_STREAM_EVENT_START + 4)
-NS_EVENT_MESSAGE(NS_POPSTATE,           NS_STREAM_EVENT_START + 5)
-NS_EVENT_MESSAGE(NS_BEFORE_PAGE_UNLOAD, NS_STREAM_EVENT_START + 6)
-NS_EVENT_MESSAGE(NS_PAGE_RESTORE,       NS_STREAM_EVENT_START + 7)
-NS_EVENT_MESSAGE(NS_READYSTATECHANGE,   NS_STREAM_EVENT_START + 8)
+NS_EVENT_MESSAGE(eStreamEventFirst,     1100)
+NS_EVENT_MESSAGE(eLoad,                 eStreamEventFirst)
+NS_EVENT_MESSAGE(eUnload,               eStreamEventFirst + 1)
+NS_EVENT_MESSAGE(eHashChange,           eStreamEventFirst + 2)
+NS_EVENT_MESSAGE(eImageAbort,           eStreamEventFirst + 3)
+NS_EVENT_MESSAGE(eLoadError,            eStreamEventFirst + 4)
+NS_EVENT_MESSAGE(ePopState,             eStreamEventFirst + 5)
+NS_EVENT_MESSAGE(eBeforeUnload,         eStreamEventFirst + 6)
+NS_EVENT_MESSAGE(eReadyStateChange,     eStreamEventFirst + 8)
  
-NS_EVENT_MESSAGE(NS_FORM_EVENT_START,   1200)
-NS_EVENT_MESSAGE(NS_FORM_SUBMIT,        NS_FORM_EVENT_START)
-NS_EVENT_MESSAGE(NS_FORM_RESET,         NS_FORM_EVENT_START + 1)
-NS_EVENT_MESSAGE(NS_FORM_CHANGE,        NS_FORM_EVENT_START + 2)
-NS_EVENT_MESSAGE(NS_FORM_SELECTED,      NS_FORM_EVENT_START + 3)
-NS_EVENT_MESSAGE(NS_FORM_INVALID,       NS_FORM_EVENT_START + 4)
+NS_EVENT_MESSAGE(eFormEventFirst,       1200)
+NS_EVENT_MESSAGE(eFormSubmit,           eFormEventFirst)
+NS_EVENT_MESSAGE(eFormReset,            eFormEventFirst + 1)
+NS_EVENT_MESSAGE(eFormChange,           eFormEventFirst + 2)
+NS_EVENT_MESSAGE(eFormSelect,           eFormEventFirst + 3)
+NS_EVENT_MESSAGE(eFormInvalid,          eFormEventFirst + 4)
 
 //Need separate focus/blur notifications for non-native widgets
-NS_EVENT_MESSAGE(NS_FOCUS_EVENT_START,  1300)
-NS_EVENT_MESSAGE(NS_FOCUS_CONTENT,      NS_FOCUS_EVENT_START)
-NS_EVENT_MESSAGE(NS_BLUR_CONTENT,       NS_FOCUS_EVENT_START + 1)
+NS_EVENT_MESSAGE(eFocusEventFirst,      1300)
+NS_EVENT_MESSAGE(eFocus,                eFocusEventFirst)
+NS_EVENT_MESSAGE(eBlur,                 eFocusEventFirst + 1)
 
-NS_EVENT_MESSAGE(NS_DRAGDROP_EVENT_START, 1400)
-NS_EVENT_MESSAGE(NS_DRAGDROP_ENTER,     NS_DRAGDROP_EVENT_START)
-NS_EVENT_MESSAGE(NS_DRAGDROP_OVER,      NS_DRAGDROP_EVENT_START + 1)
-NS_EVENT_MESSAGE(NS_DRAGDROP_EXIT,      NS_DRAGDROP_EVENT_START + 2)
-NS_EVENT_MESSAGE(NS_DRAGDROP_DRAGDROP,  NS_DRAGDROP_EVENT_START + 3)
-NS_EVENT_MESSAGE(NS_DRAGDROP_GESTURE,   NS_DRAGDROP_EVENT_START + 4)
-NS_EVENT_MESSAGE(NS_DRAGDROP_DRAG,      NS_DRAGDROP_EVENT_START + 5)
-NS_EVENT_MESSAGE(NS_DRAGDROP_END,       NS_DRAGDROP_EVENT_START + 6)
-NS_EVENT_MESSAGE(NS_DRAGDROP_START,     NS_DRAGDROP_EVENT_START + 7)
-NS_EVENT_MESSAGE(NS_DRAGDROP_DROP,      NS_DRAGDROP_EVENT_START + 8)
-NS_EVENT_MESSAGE(NS_DRAGDROP_LEAVE,     NS_DRAGDROP_EVENT_START + 9)
+NS_EVENT_MESSAGE(eDragDropEventFirst,   1400)
+NS_EVENT_MESSAGE(eDragEnter,            eDragDropEventFirst)
+NS_EVENT_MESSAGE(eDragOver,             eDragDropEventFirst + 1)
+NS_EVENT_MESSAGE(eDragExit,             eDragDropEventFirst + 2)
+NS_EVENT_MESSAGE(eLegacyDragDrop,       eDragDropEventFirst + 3)
+NS_EVENT_MESSAGE(eLegacyDragGesture,    eDragDropEventFirst + 4)
+NS_EVENT_MESSAGE(eDrag,                 eDragDropEventFirst + 5)
+NS_EVENT_MESSAGE(eDragEnd,              eDragDropEventFirst + 6)
+NS_EVENT_MESSAGE(eDragStart,            eDragDropEventFirst + 7)
+NS_EVENT_MESSAGE(eDrop,                 eDragDropEventFirst + 8)
+NS_EVENT_MESSAGE(eDragLeave,            eDragDropEventFirst + 9)
+NS_EVENT_MESSAGE(eDragDropEventLast,    eDragLeave)
 
 // Events for popups
 NS_EVENT_MESSAGE(NS_XUL_EVENT_START,    1500)
@@ -176,12 +176,15 @@ NS_EVENT_MESSAGE(NS_COMPOSITION_COMMIT_AS_IS, NS_COMPOSITION_EVENT_START + 4)
 // Its mRanges should be nullptr.
 NS_EVENT_MESSAGE(NS_COMPOSITION_COMMIT,       NS_COMPOSITION_EVENT_START + 5)
 
-// UI events
-NS_EVENT_MESSAGE(NS_UI_EVENT_START,     2500)
-// this is not to be confused with NS_ACTIVATE!
-NS_EVENT_MESSAGE(NS_UI_ACTIVATE,        NS_UI_EVENT_START)
-NS_EVENT_MESSAGE(NS_UI_FOCUSIN,         NS_UI_EVENT_START + 1)
-NS_EVENT_MESSAGE(NS_UI_FOCUSOUT,        NS_UI_EVENT_START + 2)
+// Following events are defined for deprecated DOM events which are using
+// InternalUIEvent class.
+NS_EVENT_MESSAGE(eLegacyUIEventFirst,   2500)
+// DOMActivate (mapped with the DOM event and used internally)
+NS_EVENT_MESSAGE(eLegacyDOMActivate,    eLegacyUIEventFirst)
+// DOMFocusIn (only mapped with the DOM event)
+NS_EVENT_MESSAGE(eLegacyDOMFocusIn,     eLegacyUIEventFirst + 1)
+// DOMFocusOut (only mapped with the DOM event)
+NS_EVENT_MESSAGE(eLegacyDOMFocusOut,    eLegacyUIEventFirst + 2)
 
 // pagetransition events
 NS_EVENT_MESSAGE(NS_PAGETRANSITION_START, 2700)
diff --git a/widget/MouseEvents.h b/widget/MouseEvents.h
index f9c5e6f8a0fd..8961b151799a 100644
--- a/widget/MouseEvents.h
+++ b/widget/MouseEvents.h
@@ -322,9 +322,7 @@ public:
     , mDefaultPreventedOnContent(false)
   {
     mFlags.mCancelable =
-      (aMessage != NS_DRAGDROP_EXIT &&
-       aMessage != NS_DRAGDROP_LEAVE &&
-       aMessage != NS_DRAGDROP_END);
+      (aMessage != eDragExit && aMessage != eDragLeave && aMessage != eDragEnd);
   }
 
   virtual WidgetEvent* Duplicate() const override
diff --git a/widget/WidgetEventImpl.cpp b/widget/WidgetEventImpl.cpp
index ed9a958b9f42..b309a86622ee 100644
--- a/widget/WidgetEventImpl.cpp
+++ b/widget/WidgetEventImpl.cpp
@@ -99,16 +99,16 @@ bool
 WidgetEvent::HasDragEventMessage() const
 {
   switch (mMessage) {
-    case NS_DRAGDROP_ENTER:
-    case NS_DRAGDROP_OVER:
-    case NS_DRAGDROP_EXIT:
-    case NS_DRAGDROP_DRAGDROP:
-    case NS_DRAGDROP_GESTURE:
-    case NS_DRAGDROP_DRAG:
-    case NS_DRAGDROP_END:
-    case NS_DRAGDROP_START:
-    case NS_DRAGDROP_DROP:
-    case NS_DRAGDROP_LEAVE:
+    case eDragEnter:
+    case eDragOver:
+    case eDragExit:
+    case eLegacyDragDrop:
+    case eLegacyDragGesture:
+    case eDrag:
+    case eDragEnd:
+    case eDragStart:
+    case eDrop:
+    case eDragLeave:
       return true;
     default:
       return false;
diff --git a/widget/cocoa/nsChildView.mm b/widget/cocoa/nsChildView.mm
index 600bac13e454..3d3a1acea1a9 100644
--- a/widget/cocoa/nsChildView.mm
+++ b/widget/cocoa/nsChildView.mm
@@ -5735,24 +5735,24 @@ PanGestureTypeForEvent(NSEvent* aEvent)
       return NSDragOperationNone;
   }
 
-  if (aMessage == NS_DRAGDROP_ENTER)
+  if (aMessage == eDragEnter) {
     mDragService->StartDragSession();
+  }
 
   nsCOMPtr<nsIDragSession> dragSession;
   mDragService->GetCurrentSession(getter_AddRefs(dragSession));
   if (dragSession) {
-    if (aMessage == NS_DRAGDROP_OVER) {
+    if (aMessage == eDragOver) {
       // fire the drag event at the source. Just ignore whether it was
       // cancelled or not as there isn't actually a means to stop the drag
-      mDragService->FireDragEventAtSource(NS_DRAGDROP_DRAG);
+      mDragService->FireDragEventAtSource(eDrag);
       dragSession->SetCanDrop(false);
-    }
-    else if (aMessage == NS_DRAGDROP_DROP) {
+    } else if (aMessage == eDrop) {
       // We make the assumption that the dragOver handlers have correctly set
       // the |canDrop| property of the Drag Session.
       bool canDrop = false;
       if (!NS_SUCCEEDED(dragSession->GetCanDrop(&canDrop)) || !canDrop) {
-        [self doDragAction:NS_DRAGDROP_EXIT sender:aSender];
+        [self doDragAction:eDragExit sender:aSender];
 
         nsCOMPtr<nsIDOMNode> sourceNode;
         dragSession->GetSourceNode(getter_AddRefs(sourceNode));
@@ -5793,9 +5793,8 @@ PanGestureTypeForEvent(NSEvent* aEvent)
 
   if (dragSession) {
     switch (aMessage) {
-      case NS_DRAGDROP_ENTER:
-      case NS_DRAGDROP_OVER:
-      {
+      case eDragEnter:
+      case eDragOver: {
         uint32_t dragAction;
         dragSession->GetDragAction(&dragAction);
 
@@ -5811,8 +5810,8 @@ PanGestureTypeForEvent(NSEvent* aEvent)
 
         return [self dragOperationFromDragAction:dragAction];
       }
-      case NS_DRAGDROP_EXIT:
-      case NS_DRAGDROP_DROP: {
+      case eDragExit:
+      case eDrop: {
         nsCOMPtr<nsIDOMNode> sourceNode;
         dragSession->GetSourceNode(getter_AddRefs(sourceNode));
         if (!sourceNode) {
@@ -5849,7 +5848,7 @@ PanGestureTypeForEvent(NSEvent* aEvent)
   globalDragPboard =
     [[NSPasteboardWrapper alloc] initWithPasteboard:[sender draggingPasteboard]];
 
-  return [self doDragAction:NS_DRAGDROP_ENTER sender:sender];
+  return [self doDragAction:eDragEnter sender:sender];
 
   NS_OBJC_END_TRY_ABORT_BLOCK_RETURN(NSDragOperationNone);
 }
@@ -5858,7 +5857,7 @@ PanGestureTypeForEvent(NSEvent* aEvent)
 {
   MOZ_LOG(sCocoaLog, LogLevel::Info, ("ChildView draggingUpdated: entered\n"));
 
-  return [self doDragAction:NS_DRAGDROP_OVER sender:sender];
+  return [self doDragAction:eDragOver sender:sender];
 }
 
 - (void)draggingExited:(id <NSDraggingInfo>)sender
@@ -5866,14 +5865,14 @@ PanGestureTypeForEvent(NSEvent* aEvent)
   MOZ_LOG(sCocoaLog, LogLevel::Info, ("ChildView draggingExited: entered\n"));
 
   nsAutoRetainCocoaObject kungFuDeathGrip(self);
-  [self doDragAction:NS_DRAGDROP_EXIT sender:sender];
+  [self doDragAction:eDragExit sender:sender];
   NS_IF_RELEASE(mDragService);
 }
 
 - (BOOL)performDragOperation:(id <NSDraggingInfo>)sender
 {
   nsAutoRetainCocoaObject kungFuDeathGrip(self);
-  BOOL handled = [self doDragAction:NS_DRAGDROP_DROP sender:sender] != NSDragOperationNone;
+  BOOL handled = [self doDragAction:eDrop sender:sender] != NSDragOperationNone;
   NS_IF_RELEASE(mDragService);
   return handled;
 }
diff --git a/widget/gtk/mozgtk/mozgtk.c b/widget/gtk/mozgtk/mozgtk.c
index dfa6667c8412..79ebcb075df5 100644
--- a/widget/gtk/mozgtk/mozgtk.c
+++ b/widget/gtk/mozgtk/mozgtk.c
@@ -562,6 +562,12 @@ STUB(gtk_app_chooser_get_type)
 STUB(gtk_app_chooser_get_app_info)
 STUB(gtk_app_chooser_dialog_get_type)
 STUB(gtk_app_chooser_dialog_set_heading)
+STUB(gtk_color_chooser_dialog_new)
+STUB(gtk_color_chooser_dialog_get_type)
+STUB(gtk_color_chooser_get_type)
+STUB(gtk_color_chooser_set_rgba)
+STUB(gtk_color_chooser_get_rgba)
+STUB(gtk_color_chooser_set_use_alpha)
 #endif
 
 #ifdef GTK2_SYMBOLS
diff --git a/widget/gtk/nsColorPicker.cpp b/widget/gtk/nsColorPicker.cpp
index 06a21e3cc34f..639bc4b501d7 100644
--- a/widget/gtk/nsColorPicker.cpp
+++ b/widget/gtk/nsColorPicker.cpp
@@ -13,6 +13,25 @@
 
 NS_IMPL_ISUPPORTS(nsColorPicker, nsIColorPicker)
 
+#if GTK_CHECK_VERSION(3,4,0)
+int nsColorPicker::convertGdkRgbaComponent(gdouble color_component) {
+  // GdkRGBA value is in range [0.0..1.0]. We need something in range [0..255]
+  return color_component * 255 + 0.5;
+}
+
+gdouble nsColorPicker::convertToGdkRgbaComponent(int color_component) { 
+  return color_component / 255.0;
+}  
+
+GdkRGBA nsColorPicker::convertToRgbaColor(nscolor color) {
+  GdkRGBA result = { convertToGdkRgbaComponent(NS_GET_R(color)),
+                     convertToGdkRgbaComponent(NS_GET_G(color)),
+                     convertToGdkRgbaComponent(NS_GET_B(color)),
+                     convertToGdkRgbaComponent(NS_GET_A(color)) };
+       
+  return result;
+}
+#else
 int nsColorPicker::convertGdkColorComponent(guint16 color_component) {
   // GdkColor value is in range [0..65535]. We need something in range [0..255]
   return (color_component * 255 + 127) / 65535;
@@ -36,6 +55,7 @@ GtkColorSelection* nsColorPicker::WidgetGetColorSelection(GtkWidget* widget)
   return GTK_COLOR_SELECTION(gtk_color_selection_dialog_get_color_selection(
                              GTK_COLOR_SELECTION_DIALOG(widget)));
 }
+#endif
 
 NS_IMETHODIMP nsColorPicker::Init(nsIDOMWindow *parent,
                                   const nsAString& title,
@@ -63,8 +83,6 @@ NS_IMETHODIMP nsColorPicker::Open(nsIColorPickerShownCallback *aColorPickerShown
     return NS_ERROR_FAILURE;
   }
 
-  GdkColor color_gdk = convertToGdkColor(color);
-
   if (mCallback) {
     // It means Open has already been called: this is not allowed
     NS_WARNING("mCallback is already set. Open called twice?");
@@ -74,21 +92,41 @@ NS_IMETHODIMP nsColorPicker::Open(nsIColorPickerShownCallback *aColorPickerShown
 
   nsXPIDLCString title;
   title.Adopt(ToNewUTF8String(mTitle));
-  GtkWidget *color_chooser = gtk_color_selection_dialog_new(title);
-
   GtkWindow *parent_window = GTK_WINDOW(mParentWidget->GetNativeData(NS_NATIVE_SHELLWIDGET));
+  
+#if GTK_CHECK_VERSION(3,4,0)
+  GtkWidget* color_chooser = gtk_color_chooser_dialog_new(title, parent_window);
+    
+  if (parent_window) {
+      gtk_window_set_destroy_with_parent(GTK_WINDOW(color_chooser), TRUE);
+  }
+  
+  gtk_color_chooser_set_use_alpha(GTK_COLOR_CHOOSER(color_chooser), FALSE);
+  GdkRGBA color_rgba = convertToRgbaColor(color);    
+  gtk_color_chooser_set_rgba(GTK_COLOR_CHOOSER(color_chooser),
+                             &color_rgba);
+  
+  g_signal_connect(GTK_COLOR_CHOOSER(color_chooser), "color-activated",
+                   G_CALLBACK(OnColorChanged), this);
+#else
+  GtkWidget *color_chooser = gtk_color_selection_dialog_new(title);
+  
   if (parent_window) {
     GtkWindow *window = GTK_WINDOW(color_chooser);
     gtk_window_set_transient_for(window, parent_window);
     gtk_window_set_destroy_with_parent(window, TRUE);
   }
 
+  GdkColor color_gdk = convertToGdkColor(color);
   gtk_color_selection_set_current_color(WidgetGetColorSelection(color_chooser),
                                         &color_gdk);
-
-  NS_ADDREF_THIS();
+  
   g_signal_connect(WidgetGetColorSelection(color_chooser), "color-changed",
                    G_CALLBACK(OnColorChanged), this);
+#endif
+
+  NS_ADDREF_THIS();
+  
   g_signal_connect(color_chooser, "response", G_CALLBACK(OnResponse), this);
   g_signal_connect(color_chooser, "destroy", G_CALLBACK(OnDestroy), this);
   gtk_widget_show(color_chooser);
@@ -96,6 +134,31 @@ NS_IMETHODIMP nsColorPicker::Open(nsIColorPickerShownCallback *aColorPickerShown
   return NS_OK;
 }
 
+#if GTK_CHECK_VERSION(3,4,0)
+/* static */ void
+nsColorPicker::OnColorChanged(GtkColorChooser* color_chooser, GdkRGBA* color,
+                              gpointer user_data)
+{
+  static_cast<nsColorPicker*>(user_data)->Update(color);
+}
+
+void
+nsColorPicker::Update(GdkRGBA* color)
+{
+  SetColor(color);
+  if (mCallback) {
+    mCallback->Update(mColor);
+  }
+}
+
+void nsColorPicker::SetColor(const GdkRGBA* color)
+{
+  mColor.Assign('#');
+  mColor += ToHexString(convertGdkRgbaComponent(color->red));
+  mColor += ToHexString(convertGdkRgbaComponent(color->green));
+  mColor += ToHexString(convertGdkRgbaComponent(color->blue));
+}
+#else
 /* static */ void
 nsColorPicker::OnColorChanged(GtkColorSelection* colorselection,
                               gpointer user_data)
@@ -103,6 +166,27 @@ nsColorPicker::OnColorChanged(GtkColorSelection* colorselection,
   static_cast<nsColorPicker*>(user_data)->Update(colorselection);
 }
 
+void
+nsColorPicker::Update(GtkColorSelection* colorselection)
+{
+  ReadValueFromColorSelection(colorselection);
+  if (mCallback) {
+    mCallback->Update(mColor);
+  }
+}
+
+void nsColorPicker::ReadValueFromColorSelection(GtkColorSelection* colorselection)
+{
+  GdkColor rgba;
+  gtk_color_selection_get_current_color(colorselection, &rgba);
+
+  mColor.Assign('#');
+  mColor += ToHexString(convertGdkColorComponent(rgba.red));
+  mColor += ToHexString(convertGdkColorComponent(rgba.green));
+  mColor += ToHexString(convertGdkColorComponent(rgba.blue));
+}
+#endif
+
 /* static */ void
 nsColorPicker::OnResponse(GtkWidget* color_chooser, gint response_id,
                           gpointer user_data)
@@ -118,22 +202,19 @@ nsColorPicker::OnDestroy(GtkWidget* color_chooser, gpointer user_data)
     Done(color_chooser, GTK_RESPONSE_CANCEL);
 }
 
-void
-nsColorPicker::Update(GtkColorSelection* colorselection)
-{
-  ReadValueFromColorSelection(colorselection);
-  if (mCallback) {
-    mCallback->Update(mColor);
-  }
-}
-
 void
 nsColorPicker::Done(GtkWidget* color_chooser, gint response)
 {
   switch (response) {
     case GTK_RESPONSE_OK:
     case GTK_RESPONSE_ACCEPT:
+#if GTK_CHECK_VERSION(3,4,0)
+      GdkRGBA color;
+      gtk_color_chooser_get_rgba(GTK_COLOR_CHOOSER(color_chooser), &color);
+      SetColor(&color);
+#else
       ReadValueFromColorSelection(WidgetGetColorSelection(color_chooser));
+#endif
       break;
     case GTK_RESPONSE_CANCEL:
     case GTK_RESPONSE_CLOSE:
@@ -167,14 +248,3 @@ nsString nsColorPicker::ToHexString(int n)
   result.AppendInt(n, 16);
   return result;
 }
-
-void nsColorPicker::ReadValueFromColorSelection(GtkColorSelection* colorselection)
-{
-  GdkColor rgba;
-  gtk_color_selection_get_current_color(colorselection, &rgba);
-
-  mColor.Assign('#');
-  mColor += ToHexString(convertGdkColorComponent(rgba.red));
-  mColor += ToHexString(convertGdkColorComponent(rgba.green));
-  mColor += ToHexString(convertGdkColorComponent(rgba.blue));
-}
diff --git a/widget/gtk/nsColorPicker.h b/widget/gtk/nsColorPicker.h
index 2c947246da65..3783dd958606 100644
--- a/widget/gtk/nsColorPicker.h
+++ b/widget/gtk/nsColorPicker.h
@@ -25,23 +25,38 @@ public:
 private:
   ~nsColorPicker() {};
 
-  static void OnColorChanged(GtkColorSelection* colorselection,
-                             gpointer user_data);
+  static nsString ToHexString(int n);
+  
   static void OnResponse(GtkWidget* dialog, gint response_id,
                          gpointer user_data);
   static void OnDestroy(GtkWidget* dialog, gpointer user_data);
+  
+#if GTK_CHECK_VERSION(3,4,0)
+  static void OnColorChanged(GtkColorChooser* color_chooser, GdkRGBA* color,
+                             gpointer user_data);
+                             
+  static int convertGdkRgbaComponent(gdouble color_component);
+  static gdouble convertToGdkRgbaComponent(int color_component);
+  static GdkRGBA convertToRgbaColor(nscolor color);
+  
+  void Update(GdkRGBA* color);
+  void SetColor(const GdkRGBA* color);
+#else
+  static void OnColorChanged(GtkColorSelection* colorselection,
+                             gpointer user_data);
 
   // Conversion functions for color
   static int convertGdkColorComponent(guint16 color_component);
   static guint16 convertToGdkColorComponent(int color_component);
-  static GdkColor convertToGdkColor(nscolor color);
-  static nsString ToHexString(int n);
+  static GdkColor convertToGdkColor(nscolor color);  
 
   static GtkColorSelection* WidgetGetColorSelection(GtkWidget* widget);
-
-  void Done(GtkWidget* dialog, gint response_id);
+  
   void Update(GtkColorSelection* colorselection);
   void ReadValueFromColorSelection(GtkColorSelection* colorselection);
+#endif
+
+  void Done(GtkWidget* dialog, gint response_id);
 
   nsCOMPtr<nsIWidget> mParentWidget;
   nsCOMPtr<nsIColorPickerShownCallback> mCallback;
diff --git a/widget/gtk/nsDragService.cpp b/widget/gtk/nsDragService.cpp
index 9d1a10a612ae..264d2c05619b 100644
--- a/widget/gtk/nsDragService.cpp
+++ b/widget/gtk/nsDragService.cpp
@@ -235,7 +235,7 @@ OnSourceGrabEventAfter(GtkWidget *widget, GdkEvent *event, gpointer user_data)
         sMotionEvent = gdk_event_copy(event);
 
         // Update the cursor position.  The last of these recorded gets used for
-        // the NS_DRAGDROP_END event.
+        // the eDragEnd event.
         nsDragService *dragService = static_cast<nsDragService*>(user_data);
         dragService->SetDragEndPoint(nsIntPoint(event->motion.x_root,
                                                 event->motion.y_root));
@@ -1864,8 +1864,7 @@ nsDragService::RunScheduledTask()
         MOZ_LOG(sDragLm, LogLevel::Debug,
                ("nsDragService: dispatch drag leave (%p)\n",
                 mTargetWindow.get()));
-        mTargetWindow->
-            DispatchDragEvent(NS_DRAGDROP_EXIT, mTargetWindowPoint, 0);
+        mTargetWindow->DispatchDragEvent(eDragExit, mTargetWindowPoint, 0);
 
         if (!mSourceNode) {
             // The drag that was initiated in a different app. End the drag
@@ -2036,10 +2035,10 @@ nsDragService::DispatchMotionEvents()
 {
     mCanDrop = false;
 
-    FireDragEventAtSource(NS_DRAGDROP_DRAG);
+    FireDragEventAtSource(eDrag);
 
-    mTargetWindow->
-        DispatchDragEvent(NS_DRAGDROP_OVER, mTargetWindowPoint, mTargetTime);
+    mTargetWindow->DispatchDragEvent(eDragOver, mTargetWindowPoint,
+                                     mTargetTime);
 }
 
 // Returns true if the drop was successful
@@ -2052,7 +2051,7 @@ nsDragService::DispatchDropEvent()
     if (mTargetWindow->IsDestroyed())
         return FALSE;
 
-    EventMessage msg = mCanDrop ? NS_DRAGDROP_DROP : NS_DRAGDROP_EXIT;
+    EventMessage msg = mCanDrop ? eDrop : eDragExit;
 
     mTargetWindow->DispatchDragEvent(msg, mTargetWindowPoint, mTargetTime);
 
diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
index c5491a6581f9..52bf3b1b8f9e 100644
--- a/widget/gtk/nsWindow.cpp
+++ b/widget/gtk/nsWindow.cpp
@@ -3332,7 +3332,7 @@ nsWindow::DispatchDragEvent(EventMessage aMsg, const nsIntPoint& aRefPoint,
 {
     WidgetDragEvent event(true, aMsg, this);
 
-    if (aMsg == NS_DRAGDROP_OVER) {
+    if (aMsg == eDragOver) {
         InitDragEvent(event);
     }
 
diff --git a/widget/nsBaseDragService.cpp b/widget/nsBaseDragService.cpp
index 85d7cbb5b45c..cfa7a009ee7b 100644
--- a/widget/nsBaseDragService.cpp
+++ b/widget/nsBaseDragService.cpp
@@ -356,8 +356,9 @@ nsBaseDragService::EndDragSession(bool aDoneDrag)
     return NS_ERROR_FAILURE;
   }
 
-  if (aDoneDrag && !mSuppressLevel)
-    FireDragEventAtSource(NS_DRAGDROP_END);
+  if (aDoneDrag && !mSuppressLevel) {
+    FireDragEventAtSource(eDragEnd);
+  }
 
   if (mDragPopup) {
     nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
@@ -405,7 +406,7 @@ nsBaseDragService::FireDragEventAtSource(uint32_t aMsg)
         nsEventStatus status = nsEventStatus_eIgnore;
         WidgetDragEvent event(true, static_cast<EventMessage>(aMsg), nullptr);
         event.inputSource = mInputSource;
-        if (aMsg == NS_DRAGDROP_END) {
+        if (aMsg == eDragEnd) {
           event.refPoint.x = mEndDragPoint.x;
           event.refPoint.y = mEndDragPoint.y;
           event.userCancelled = mUserCancelled;
diff --git a/widget/nsBaseWidget.cpp b/widget/nsBaseWidget.cpp
index baea3d12e018..8dcfbfbef6c1 100644
--- a/widget/nsBaseWidget.cpp
+++ b/widget/nsBaseWidget.cpp
@@ -2631,20 +2631,20 @@ case _value: eventName.AssignLiteral(_name) ; break
 
   switch(aGuiEvent->mMessage)
   {
-    _ASSIGN_eventName(NS_BLUR_CONTENT,"NS_BLUR_CONTENT");
-    _ASSIGN_eventName(NS_DRAGDROP_GESTURE,"NS_DND_GESTURE");
-    _ASSIGN_eventName(NS_DRAGDROP_DROP,"NS_DND_DROP");
-    _ASSIGN_eventName(NS_DRAGDROP_ENTER,"NS_DND_ENTER");
-    _ASSIGN_eventName(NS_DRAGDROP_EXIT,"NS_DND_EXIT");
-    _ASSIGN_eventName(NS_DRAGDROP_OVER,"NS_DND_OVER");
+    _ASSIGN_eventName(eBlur,"eBlur");
+    _ASSIGN_eventName(eLegacyDragGesture,"eLegacyDragGesture");
+    _ASSIGN_eventName(eDrop,"eDrop");
+    _ASSIGN_eventName(eDragEnter,"eDragEnter");
+    _ASSIGN_eventName(eDragExit,"eDragExit");
+    _ASSIGN_eventName(eDragOver,"eDragOver");
     _ASSIGN_eventName(NS_EDITOR_INPUT,"NS_EDITOR_INPUT");
-    _ASSIGN_eventName(NS_FOCUS_CONTENT,"NS_FOCUS_CONTENT");
-    _ASSIGN_eventName(NS_FORM_SELECTED,"NS_FORM_SELECTED");
-    _ASSIGN_eventName(NS_FORM_CHANGE,"NS_FORM_CHANGE");
-    _ASSIGN_eventName(NS_FORM_RESET,"NS_FORM_RESET");
-    _ASSIGN_eventName(NS_FORM_SUBMIT,"NS_FORM_SUBMIT");
-    _ASSIGN_eventName(NS_IMAGE_ABORT,"NS_IMAGE_ABORT");
-    _ASSIGN_eventName(NS_LOAD_ERROR,"NS_LOAD_ERROR");
+    _ASSIGN_eventName(eFocus,"eFocus");
+    _ASSIGN_eventName(eFormSelect,"eFormSelect");
+    _ASSIGN_eventName(eFormChange,"eFormChange");
+    _ASSIGN_eventName(eFormReset,"eFormReset");
+    _ASSIGN_eventName(eFormSubmit,"eFormSubmit");
+    _ASSIGN_eventName(eImageAbort,"eImageAbort");
+    _ASSIGN_eventName(eLoadError,"eLoadError");
     _ASSIGN_eventName(eKeyDown,"eKeyDown");
     _ASSIGN_eventName(eKeyPress,"eKeyPress");
     _ASSIGN_eventName(eKeyUp,"eKeyUp");
@@ -2655,13 +2655,13 @@ case _value: eventName.AssignLiteral(_name) ; break
     _ASSIGN_eventName(eMouseClick,"eMouseClick");
     _ASSIGN_eventName(eMouseDoubleClick,"eMouseDoubleClick");
     _ASSIGN_eventName(eMouseMove,"eMouseMove");
-    _ASSIGN_eventName(NS_LOAD,"NS_LOAD");
-    _ASSIGN_eventName(NS_POPSTATE,"NS_POPSTATE");
+    _ASSIGN_eventName(eLoad,"eLoad");
+    _ASSIGN_eventName(ePopState,"ePopState");
     _ASSIGN_eventName(NS_BEFORE_SCRIPT_EXECUTE,"NS_BEFORE_SCRIPT_EXECUTE");
     _ASSIGN_eventName(NS_AFTER_SCRIPT_EXECUTE,"NS_AFTER_SCRIPT_EXECUTE");
-    _ASSIGN_eventName(NS_PAGE_UNLOAD,"NS_PAGE_UNLOAD");
-    _ASSIGN_eventName(NS_HASHCHANGE,"NS_HASHCHANGE");
-    _ASSIGN_eventName(NS_READYSTATECHANGE,"NS_READYSTATECHANGE");
+    _ASSIGN_eventName(eUnload,"eUnload");
+    _ASSIGN_eventName(eHashChange,"eHashChange");
+    _ASSIGN_eventName(eReadyStateChange,"eReadyStateChange");
     _ASSIGN_eventName(NS_XUL_BROADCAST, "NS_XUL_BROADCAST");
     _ASSIGN_eventName(NS_XUL_COMMAND_UPDATE, "NS_XUL_COMMAND_UPDATE");
 
diff --git a/widget/windows/nsNativeDragTarget.cpp b/widget/windows/nsNativeDragTarget.cpp
index ffab0c402b5b..eacfee405324 100644
--- a/widget/windows/nsNativeDragTarget.cpp
+++ b/widget/windows/nsNativeDragTarget.cpp
@@ -229,7 +229,7 @@ nsNativeDragTarget::ProcessDrag(EventMessage aEventMessage,
     *pdwEffect = DROPEFFECT_NONE;
   }
 
-  if (aEventMessage != NS_DRAGDROP_DROP) {
+  if (aEventMessage != eDrop) {
     // Get the cached drag effect from the drag service, the data member should
     // have been set by whoever handled the WidgetGUIEvent or nsIDOMEvent on
     // drags.
@@ -295,7 +295,7 @@ nsNativeDragTarget::DragEnter(LPDATAOBJECT pIDataSource,
   winDragService->SetIDataObject(pIDataSource);
 
   // Now process the native drag state and then dispatch the event
-  ProcessDrag(NS_DRAGDROP_ENTER, grfKeyState, ptl, pdwEffect);
+  ProcessDrag(eDragEnter, grfKeyState, ptl, pdwEffect);
 
   return S_OK;
 }
@@ -340,9 +340,9 @@ nsNativeDragTarget::DragOver(DWORD   grfKeyState,
     GetDropTargetHelper()->DragOver(&pt, *pdwEffect);
   }
 
-  mDragService->FireDragEventAtSource(NS_DRAGDROP_DRAG);
+  mDragService->FireDragEventAtSource(eDrag);
   // Now process the native drag state and then dispatch the event
-  ProcessDrag(NS_DRAGDROP_OVER, grfKeyState, ptl, pdwEffect);
+  ProcessDrag(eDragOver, grfKeyState, ptl, pdwEffect);
 
   this->Release();
 
@@ -362,7 +362,7 @@ nsNativeDragTarget::DragLeave()
   }
 
   // dispatch the event into Gecko
-  DispatchDragDropEvent(NS_DRAGDROP_EXIT, gDragLastPoint);
+  DispatchDragDropEvent(eDragExit, gDragLastPoint);
 
   nsCOMPtr<nsIDragSession> currentDragSession;
   mDragService->GetCurrentSession(getter_AddRefs(currentDragSession));
@@ -439,7 +439,7 @@ nsNativeDragTarget::Drop(LPDATAOBJECT pData,
   nsCOMPtr<nsIDragService> serv = mDragService;
 
   // Now process the native drag state and then dispatch the event
-  ProcessDrag(NS_DRAGDROP_DROP, grfKeyState, aPT, pdwEffect);
+  ProcessDrag(eDrop, grfKeyState, aPT, pdwEffect);
 
   nsCOMPtr<nsIDragSession> currentDragSession;
   serv->GetCurrentSession(getter_AddRefs(currentDragSession));