Merge from cvs-trunk-mirror.

--HG--
rename : js/src/js.c => js/src/js.cpp
rename : js/src/jsapi.c => js/src/jsapi.cpp
rename : js/src/jsarena.c => js/src/jsarena.cpp
rename : js/src/jscntxt.c => js/src/jscntxt.cpp
rename : js/src/jsopcode.c => js/src/jsopcode.cpp
rename : js/src/jsparse.c => js/src/jsparse.cpp
rename : js/src/jsregexp.c => js/src/jsregexp.cpp
rename : js/src/jsscope.c => js/src/jsscope.cpp

accessible/public/ia2/Makefile.in

@@ -99,8 +99,6 @@ MIDL_GENERATED_FILES = \
   $(MIDL_ENUMS:%.idl=%.h) \
   $(NULL)
 
-EMBED_MANIFEST_AT = 2
-
 include $(topsrcdir)/config/rules.mk
 
 OS_LIBS = \

accessible/public/msaa/Makefile.in

@@ -119,7 +119,5 @@ export:: done_gen
 register::
 	regsvr32 -s $(DIST)/bin/$(SHARED_LIBRARY)
 
-EMBED_MANIFEST_AT = 2
-
 include $(topsrcdir)/config/rules.mk
 

accessible/public/nsIAccessibleEvent.idl

@@ -553,6 +553,11 @@ interface nsIAccessibleTextChangeEvent : nsIAccessibleEvent
    * Returns true if text was inserted, otherwise false.
    */
   boolean isInserted();
+
+  /**
+   * The inserted or removed text
+   */
+  readonly attribute DOMString modifiedText;
 };
 
 [scriptable, uuid(b9076dce-4cd3-4e3d-a7f6-7f33a7f40c31)]

accessible/public/nsIAccessibleRelation.idl

@@ -57,6 +57,9 @@ interface nsIAccessibleRelation : nsISupports
    */
   const unsigned long RELATION_CONTROLLED_BY = 0x01;
 
+  // First relation
+  const unsigned long RELATION_FIRST = RELATION_CONTROLLED_BY;
+
   /**
    * This object is interactive and controls some attribute of a target object.
    */
@@ -135,6 +138,9 @@ interface nsIAccessibleRelation : nsISupports
    */
   const unsigned long RELATION_DESCRIPTION_FOR = 0x0f;
 
+  // Last relation that is standard to desktop accessibility APIs
+  const unsigned long RELATION_LAST = RELATION_DESCRIPTION_FOR;
+
   /**
    * Part of a form/dialog with a related default button. It is used for
    * MSAA only, no for IA2 nor ATK.

accessible/public/nsIAccessibleText.idl

@@ -45,7 +45,7 @@ typedef long nsAccessibleTextBoundary;
 
 interface nsIAccessible;
 
-[scriptable, uuid(17389a66-5cc5-4550-80e0-49e7b63990a4)]
+[scriptable, uuid(948419b2-53f6-4a74-bb69-1345faf3e8e8)]
 interface nsIAccessibleText : nsISupports
 {
   const nsAccessibleTextBoundary BOUNDARY_CHAR = 0;
@@ -167,6 +167,20 @@ interface nsIAccessibleText : nsISupports
   void addSelection (in long startOffset, in long endOffset);
 
   void removeSelection (in long selectionNum);
+
+
+  /**
+   * Makes a specific part of string visible on screen.
+   *
+   * @param aStartIndex - 0-based character offset.
+   * @param aEndIndex - 0-based character offset - the offset of the
+   *                        character just past the last character of the
+   *                        string.
+   * @param aScrollType - defines how to scroll (see nsIAccessibleScrollType for
+   *                      available constants).
+   */
+  void scrollSubstringTo(in long aStartIndex, in long aEndIndex,
+                         in unsigned long aScrollType);
 };
 
 /*

accessible/public/nsIAccessibleTypes.idl

@@ -80,6 +80,12 @@ interface nsIAccessibleScrollType : nsISupports
    * window (or as close as possible).
    */
   const unsigned long SCROLL_TYPE_RIGHT_EDGE = 0x05;
+
+  /**
+   * Scroll an object the minimum amount necessary in order for the entire
+   * frame to be visible (if possible).
+   */
+  const unsigned long SCROLL_TYPE_ANYWHERE = 0x06;
 };
 
 
@@ -106,3 +112,4 @@ interface nsIAccessibleCoordinateType : nsISupports
    */
   const unsigned long COORDTYPE_PARENT_RELATIVE = 0x02;
 };
+

accessible/src/atk/nsAccessibleWrap.cpp

@@ -792,7 +792,7 @@ GetAttributeSet(nsIAccessible* aAccessible)
     if (attributes) {
         // Deal with attributes that we only need to expose in ATK
         PRUint32 state, extraState;
-        aAccessible->GetFinalState(&state, &extraState);
+        aAccessible->GetFinalState(&state, nsnull);
         if (state & nsIAccessibleStates::STATE_HASPOPUP) {
           // There is no ATK state for haspopup, must use object attribute to expose the same info
           nsAutoString oldValueUnused;

accessible/src/base/nsAccessNode.cpp

@@ -426,35 +426,8 @@ nsAccessNode::ScrollTo(PRUint32 aScrollType)
   nsCOMPtr<nsIContent> content = frame->GetContent();
   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
 
-  PRInt32 vPercent, hPercent;
+  PRInt16 vPercent, hPercent;
-  switch (aScrollType)
+  nsAccUtils::ConvertScrollTypeToPercents(aScrollType, &vPercent, &hPercent);
-  {
-    case nsIAccessibleScrollType::SCROLL_TYPE_TOP_LEFT:
-      vPercent = NS_PRESSHELL_SCROLL_TOP;
-      hPercent = NS_PRESSHELL_SCROLL_LEFT;
-      break;
-    case nsIAccessibleScrollType::SCROLL_TYPE_BOTTOM_RIGHT:
-      vPercent = NS_PRESSHELL_SCROLL_BOTTOM;
-      hPercent = NS_PRESSHELL_SCROLL_RIGHT;
-      break;
-    case nsIAccessibleScrollType::SCROLL_TYPE_TOP_EDGE:
-      vPercent = NS_PRESSHELL_SCROLL_TOP;
-      hPercent = NS_PRESSHELL_SCROLL_ANYWHERE;
-      break;
-    case nsIAccessibleScrollType::SCROLL_TYPE_BOTTOM_EDGE:
-      vPercent = NS_PRESSHELL_SCROLL_BOTTOM;
-      hPercent = NS_PRESSHELL_SCROLL_ANYWHERE;
-      break;
-    case nsIAccessibleScrollType::SCROLL_TYPE_LEFT_EDGE:
-      vPercent = NS_PRESSHELL_SCROLL_ANYWHERE;
-      hPercent = NS_PRESSHELL_SCROLL_LEFT;
-      break;
-    case nsIAccessibleScrollType::SCROLL_TYPE_RIGHT_EDGE:
-      vPercent = NS_PRESSHELL_SCROLL_ANYWHERE;
-      hPercent = NS_PRESSHELL_SCROLL_RIGHT;
-      break;
-  }
-
   return shell->ScrollContentIntoView(content, vPercent, hPercent);
 }
 

accessible/src/base/nsAccessibilityService.cpp

@@ -1804,11 +1804,14 @@ NS_IMETHODIMP nsAccessibilityService::InvalidateSubtreeFor(nsIPresShell *aShell,
 {
   NS_ASSERTION(aEvent == nsIAccessibleEvent::EVENT_ASYNCH_SIGNIFICANT_CHANGE ||
                aEvent == nsIAccessibleEvent::EVENT_ASYNCH_SHOW ||
-               aEvent == nsIAccessibleEvent::EVENT_ASYNCH_HIDE,
+               aEvent == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
+               aEvent == nsIAccessibleEvent::EVENT_DOM_SIGNIFICANT_CHANGE ||
+               aEvent == nsIAccessibleEvent::EVENT_DOM_CREATE ||
+               aEvent == nsIAccessibleEvent::EVENT_DOM_DESTROY,
                "Incorrect aEvent passed in");
 
+  NS_ENSURE_ARG_POINTER(aShell);
   nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aShell));
-  NS_ASSERTION(aShell, "No pres shell in call to InvalidateSubtreeFor");
   nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
     nsAccessNode::GetDocAccessibleFor(weakShell);
   nsCOMPtr<nsPIAccessibleDocument> privateAccessibleDoc =

accessible/src/base/nsAccessibilityService.h

@@ -340,7 +340,8 @@ static const char kEventTypeNames[][40] = {
   "hypertext changed",                       // EVENT_HYPERTEXT_CHANGED
   "hypertext links count changed",           // EVENT_HYPERTEXT_NLINKS_CHANGED
   "object attribute changed",                // EVENT_OBJECT_ATTRIBUTE_CHANGED
-  "internal load"                            // EVENT_INTERNAL_LOAD
+  "internal load",                           // EVENT_INTERNAL_LOAD
+  "reorder"                                  // EVENT_REORDER
 };
 
 #endif /* __nsIAccessibilityService_h__ */

accessible/src/base/nsAccessibilityUtils.cpp

@@ -38,12 +38,24 @@
 
 #include "nsAccessibilityUtils.h"
 
+#include "nsIAccessibleTypes.h"
 #include "nsPIAccessible.h"
 #include "nsAccessibleEventData.h"
 
+#include "nsIDOMRange.h"
 #include "nsIDOMXULSelectCntrlEl.h"
 #include "nsIDOMXULSelectCntrlItemEl.h"
 #include "nsIEventListenerManager.h"
+#include "nsIPresShell.h"
+#include "nsPresContext.h"
+#include "nsIEventStateManager.h"
+#include "nsISelection2.h"
+#include "nsISelectionController.h"
+
+#include "nsContentCID.h"
+#include "nsComponentManagerUtils.h"
+
+static NS_DEFINE_IID(kRangeCID, NS_RANGE_CID);
 
 void
 nsAccUtils::GetAccAttr(nsIPersistentProperties *aAttributes, nsIAtom *aAttrName,
@@ -167,6 +179,39 @@ nsAccUtils::HasListener(nsIContent *aContent, const nsAString& aEventType)
   return listenerManager && listenerManager->HasListenersFor(aEventType);  
 }
 
+PRUint32
+nsAccUtils::GetAccessKeyFor(nsIContent *aContent)
+{
+  if (!aContent)
+    return 0;
+
+  // Accesskeys are registered by @accesskey attribute only. At first check
+  // whether it is presented on the given element to avoid the slow
+  // nsIEventStateManager::GetRegisteredAccessKey() method.
+  if (!aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::accesskey))
+    return 0;
+
+  nsCOMPtr<nsIDocument> doc = aContent->GetOwnerDoc();
+  if (!doc)
+    return 0;
+
+  nsCOMPtr<nsIPresShell> presShell = doc->GetPrimaryShell();
+  if (!presShell)
+    return 0;
+
+  nsPresContext *presContext = presShell->GetPresContext();
+  if (!presContext)
+    return 0;
+
+  nsIEventStateManager *esm = presContext->EventStateManager();
+  if (!esm)
+    return 0;
+
+  PRUint32 key = 0;
+  esm->GetRegisteredAccessKey(aContent, &key);
+  return key;
+}
+
 nsresult
 nsAccUtils::FireAccEvent(PRUint32 aEventType, nsIAccessible *aAccessible,
                          PRBool aIsAsynch)
@@ -223,3 +268,82 @@ nsAccUtils::GetAncestorWithRole(nsIAccessible *aDescendant, PRUint32 aRole)
   }
   return nsnull;
 }
+
+nsresult
+nsAccUtils::ScrollSubstringTo(nsIFrame *aFrame,
+                              nsIDOMNode *aStartNode, PRInt32 aStartIndex,
+                              nsIDOMNode *aEndNode, PRInt32 aEndIndex,
+                              PRUint32 aScrollType)
+{
+  if (!aFrame || !aStartNode || !aEndNode)
+    return NS_ERROR_FAILURE;
+
+  nsPresContext *presContext = aFrame->PresContext();
+
+  nsCOMPtr<nsIDOMRange> scrollToRange = do_CreateInstance(kRangeCID);
+  NS_ENSURE_TRUE(scrollToRange, NS_ERROR_FAILURE);
+
+  nsCOMPtr<nsISelectionController> selCon;
+  aFrame->GetSelectionController(presContext, getter_AddRefs(selCon));
+  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
+
+  scrollToRange->SetStart(aStartNode, aStartIndex);
+  scrollToRange->SetEnd(aEndNode, aEndIndex);
+
+  nsCOMPtr<nsISelection> selection1;
+  selCon->GetSelection(nsISelectionController::SELECTION_ACCESSIBILITY,
+                       getter_AddRefs(selection1));
+
+  nsCOMPtr<nsISelection2> selection(do_QueryInterface(selection1));
+  if (selection) {
+    selection->RemoveAllRanges();
+    selection->AddRange(scrollToRange);
+
+    PRInt16 vPercent, hPercent;
+    ConvertScrollTypeToPercents(aScrollType, &vPercent, &hPercent);
+    selection->ScrollIntoView(nsISelectionController::SELECTION_ANCHOR_REGION,
+                              PR_TRUE, vPercent, hPercent);
+
+    selection->CollapseToStart();
+  }
+
+  return NS_OK;
+}
+
+void
+nsAccUtils::ConvertScrollTypeToPercents(PRUint32 aScrollType,
+                                        PRInt16 *aVPercent,
+                                        PRInt16 *aHPercent)
+{
+  switch (aScrollType)
+  {
+    case nsIAccessibleScrollType::SCROLL_TYPE_TOP_LEFT:
+      *aVPercent = NS_PRESSHELL_SCROLL_TOP;
+      *aHPercent = NS_PRESSHELL_SCROLL_LEFT;
+      break;
+    case nsIAccessibleScrollType::SCROLL_TYPE_BOTTOM_RIGHT:
+      *aVPercent = NS_PRESSHELL_SCROLL_BOTTOM;
+      *aHPercent = NS_PRESSHELL_SCROLL_RIGHT;
+      break;
+    case nsIAccessibleScrollType::SCROLL_TYPE_TOP_EDGE:
+      *aVPercent = NS_PRESSHELL_SCROLL_TOP;
+      *aHPercent = NS_PRESSHELL_SCROLL_ANYWHERE;
+      break;
+    case nsIAccessibleScrollType::SCROLL_TYPE_BOTTOM_EDGE:
+      *aVPercent = NS_PRESSHELL_SCROLL_BOTTOM;
+      *aHPercent = NS_PRESSHELL_SCROLL_ANYWHERE;
+      break;
+    case nsIAccessibleScrollType::SCROLL_TYPE_LEFT_EDGE:
+      *aVPercent = NS_PRESSHELL_SCROLL_ANYWHERE;
+      *aHPercent = NS_PRESSHELL_SCROLL_LEFT;
+      break;
+    case nsIAccessibleScrollType::SCROLL_TYPE_RIGHT_EDGE:
+      *aVPercent = NS_PRESSHELL_SCROLL_ANYWHERE;
+      *aHPercent = NS_PRESSHELL_SCROLL_RIGHT;
+      break;
+    default:
+      *aVPercent = NS_PRESSHELL_SCROLL_ANYWHERE;
+      *aHPercent = NS_PRESSHELL_SCROLL_ANYWHERE;
+  }
+}
+

accessible/src/base/nsAccessibilityUtils.h

@@ -45,6 +45,7 @@
 #include "nsIDOMNode.h"
 #include "nsIPersistentProperties2.h"
 #include "nsIContent.h"
+#include "nsIFrame.h"
 
 class nsAccUtils
 {
@@ -108,6 +109,14 @@ public:
    */
   static PRBool HasListener(nsIContent *aContent, const nsAString& aEventType);
 
+  /**
+   * Return an accesskey registered on the given element by
+   * nsIEventStateManager or 0 if there is no registered accesskey.
+   *
+   * @param aContent - the given element.
+   */
+  static PRUint32 GetAccessKeyFor(nsIContent *aContent);
+
   /**
    * Fire accessible event of the given type for the given accessible.
    */
@@ -132,6 +141,31 @@ public:
     */
    static already_AddRefed<nsIAccessible>
      GetAncestorWithRole(nsIAccessible *aDescendant, PRUint32 aRole);
+
+  /**
+   * Helper method to scroll range into view, used for implementation of
+   * nsIAccessibleText::scrollSubstringTo().
+   *
+   * @param aFrame        the frame for accessible the range belongs to.
+   * @param aStartNode    start node of a range
+   * @param aStartOffset  an offset inside the start node
+   * @param aEndNode      end node of a range
+   * @param aEndOffset    an offset inside the end node
+   * @param aScrollType   the place a range should be scrolled to
+   */
+  static nsresult ScrollSubstringTo(nsIFrame *aFrame,
+                                    nsIDOMNode *aStartNode, PRInt32 aStartIndex,
+                                    nsIDOMNode *aEndNode, PRInt32 aEndIndex,
+                                    PRUint32 aScrollType);
+
+  /**
+   * Converts scroll type constant defined in nsIAccessibleScrollType to
+   * vertical and horizontal percents.
+   */
+  static void ConvertScrollTypeToPercents(PRUint32 aScrollType,
+                                          PRInt16 *aVPercent,
+                                          PRInt16 *aHPercent);
 };
 
 #endif
+

accessible/src/base/nsAccessible.cpp

@@ -349,7 +349,7 @@ NS_IMETHODIMP nsAccessible::GetDescription(nsAString& aDescription)
 // returns the accesskey modifier mask used in the given node's context
 // (i.e. chrome or content), or 0 if an error occurs
 static PRInt32
-GetAccessModifierMask(nsIDOMElement* aDOMNode)
+GetAccessModifierMask(nsIContent* aContent)
 {
   nsCOMPtr<nsIPrefBranch> prefBranch =
     do_GetService(NS_PREFSERVICE_CONTRACTID);
@@ -370,8 +370,7 @@ GetAccessModifierMask(nsIDOMElement* aDOMNode)
   }
 
   // get the docShell to this DOMNode, return 0 on failure
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
+  nsCOMPtr<nsIDocument> document = aContent->GetCurrentDoc();
-  nsCOMPtr<nsIDocument> document = content->GetCurrentDoc();
   if (!document)
     return 0;
   nsCOMPtr<nsISupports> container = document->GetContainer();
@@ -398,27 +397,30 @@ GetAccessModifierMask(nsIDOMElement* aDOMNode)
   return NS_SUCCEEDED(rv) ? accessModifierMask : 0;
 }
 
-NS_IMETHODIMP nsAccessible::GetKeyboardShortcut(nsAString& _retval)
+NS_IMETHODIMP
+nsAccessible::GetKeyboardShortcut(nsAString& aAccessKey)
 {
-  nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(mDOMNode));
+  aAccessKey.Truncate();
-  if (elt) {
+
-    nsAutoString accesskey;
+  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-    elt->GetAttribute(NS_LITERAL_STRING("accesskey"), accesskey);
+  if (!content)
-    if (accesskey.IsEmpty()) {
-      nsCOMPtr<nsIContent> content = do_QueryInterface(elt);
-      nsIContent *labelContent = GetLabelContent(content);
-      if (labelContent) {
-        labelContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::accesskey, accesskey);
-      }
-      if (accesskey.IsEmpty()) {
     return NS_ERROR_FAILURE;
-      }
+
+  PRUint32 key = nsAccUtils::GetAccessKeyFor(content);
+  if (!key) {
+    nsCOMPtr<nsIContent> labelContent(GetLabelContent(content));
+    if (labelContent)
+      key = nsAccUtils::GetAccessKeyFor(labelContent);
   }
 
-    // append the modifiers in reverse order
+  if (!key)
-    // (result: Control+Alt+Shift+Meta+<key>)
+    return NS_OK;
+
+  nsAutoString accesskey(key);
+
+  // Append the modifiers in reverse order, result: Control+Alt+Shift+Meta+<key>
   nsAutoString propertyKey;
-    PRInt32 modifierMask = GetAccessModifierMask(elt);
+  PRInt32 modifierMask = GetAccessModifierMask(content);
   if (modifierMask & NS_MODIFIER_META) {
     propertyKey.AssignLiteral("VK_META");
     nsAccessible::GetFullKeyName(propertyKey, accesskey, accesskey);
@@ -435,11 +437,10 @@ NS_IMETHODIMP nsAccessible::GetKeyboardShortcut(nsAString& _retval)
     propertyKey.AssignLiteral("VK_CONTROL");
     nsAccessible::GetFullKeyName(propertyKey, accesskey, accesskey);
   }
-    _retval= accesskey;
+
+  aAccessKey = accesskey;
   return NS_OK;
 }
-  return NS_ERROR_FAILURE;
-}
 
 NS_IMETHODIMP nsAccessible::SetParent(nsIAccessible *aParent)
 {
@@ -992,7 +993,7 @@ PRBool nsAccessible::IsVisible(PRBool *aIsOffscreen)
   return isVisible;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessible::GetState(PRUint32 *aState, PRUint32 *aExtraState)
 {
   *aState = 0;
@@ -1050,45 +1051,6 @@ nsAccessible::GetState(PRUint32 *aState, PRUint32 *aExtraState)
     *aState |= nsIAccessibleStates::STATE_OFFSCREEN;
   }
 
-  if (!aExtraState)
-    return NS_OK;
-
-  PRUint32 state = *aState;
-  nsresult rv = GetARIAState(&state);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsIFrame *frame = GetFrame();
-  if (frame) {
-    const nsStyleDisplay* display = frame->GetStyleDisplay();
-    if (display && display->mOpacity == 1.0f &&
-        !(state & nsIAccessibleStates::STATE_INVISIBLE)) {
-      *aExtraState |= nsIAccessibleStates::EXT_STATE_OPAQUE;
-    }
-
-    const nsStyleXUL *xulStyle = frame->GetStyleXUL();
-    if (xulStyle) {
-      // In XUL all boxes are either vertical or horizontal
-      if (xulStyle->mBoxOrient == NS_STYLE_BOX_ORIENT_VERTICAL) {
-        *aExtraState |= nsIAccessibleStates::EXT_STATE_VERTICAL;
-      }
-      else {
-        *aExtraState |= nsIAccessibleStates::EXT_STATE_HORIZONTAL;
-      }
-    }
-  }
-
-  // XXX We can remove this hack once we support RDF-based role & state maps
-  if (mRoleMapEntry && (mRoleMapEntry->role == nsIAccessibleRole::ROLE_ENTRY ||
-      mRoleMapEntry->role == nsIAccessibleRole::ROLE_PASSWORD_TEXT)) {
-    if (content->AttrValueIs(kNameSpaceID_WAIProperties , nsAccessibilityAtoms::multiline,
-                             nsAccessibilityAtoms::_true, eCaseMatters)) {
-      *aExtraState |= nsIAccessibleStates::EXT_STATE_MULTI_LINE;
-    }
-    else {
-      *aExtraState |= nsIAccessibleStates::EXT_STATE_SINGLE_LINE;
-    }
-  }
-
   return NS_OK;
 }
 
@@ -2282,8 +2244,7 @@ nsAccessible::GetFinalState(PRUint32 *aState, PRUint32 *aExtraState)
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Apply ARIA states to be sure accessible states will be overriden.
-  rv = GetARIAState(aState);
+  *aState |= GetARIAState();
-  NS_ENSURE_SUCCESS(rv, rv);
 
   // Set additional states which presence depends on another states.
   if (aExtraState) {
@@ -2305,53 +2266,85 @@ nsAccessible::GetFinalState(PRUint32 *aState, PRUint32 *aExtraState)
         *aExtraState &= ~nsIAccessibleStates::STATE_COLLAPSED;
       } 
     }
+    nsIFrame *frame = GetFrame();
+    if (frame) {
+      const nsStyleDisplay* display = frame->GetStyleDisplay();
+      if (display && display->mOpacity == 1.0f &&
+          !(*aState & nsIAccessibleStates::STATE_INVISIBLE)) {
+        *aExtraState |= nsIAccessibleStates::EXT_STATE_OPAQUE;
+      }
+
+      const nsStyleXUL *xulStyle = frame->GetStyleXUL();
+      if (xulStyle) {
+        // In XUL all boxes are either vertical or horizontal
+        if (xulStyle->mBoxOrient == NS_STYLE_BOX_ORIENT_VERTICAL) {
+          *aExtraState |= nsIAccessibleStates::EXT_STATE_VERTICAL;
+        }
+        else {
+          *aExtraState |= nsIAccessibleStates::EXT_STATE_HORIZONTAL;
+        }
+      }
+    }
+
+    // XXX We can remove this hack once we support RDF-based role & state maps
+    if (mRoleMapEntry && (mRoleMapEntry->role == nsIAccessibleRole::ROLE_ENTRY ||
+        mRoleMapEntry->role == nsIAccessibleRole::ROLE_PASSWORD_TEXT)) {
+      nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
+      NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
+      if (content->AttrValueIs(kNameSpaceID_WAIProperties, nsAccessibilityAtoms::multiline,
+                               nsAccessibilityAtoms::_true, eCaseMatters)) {
+        *aExtraState |= nsIAccessibleStates::EXT_STATE_MULTI_LINE;
+      }
+      else {
+        *aExtraState |= nsIAccessibleStates::EXT_STATE_SINGLE_LINE;
+      }
+    }
   }
 
   return NS_OK;
 }
 
-nsresult
+PRUint32
-nsAccessible::GetARIAState(PRUint32 *aState)
+nsAccessible::GetARIAState()
 {
-  if (!mDOMNode) {
-    return NS_ERROR_FAILURE; // Node already shut down
-  }
-
   // Test for universal states first
   nsIContent *content = GetRoleContent(mDOMNode);
-  NS_ENSURE_TRUE(content, NS_ERROR_FAILURE); // Node already shut down
+  if (!content) {
+    return 0;
+  }
 
+  PRUint32 ariaState = 0;
   PRUint32 index = 0;
   while (nsARIAMap::gWAIUnivStateMap[index].attributeName != nsnull) {
-    MappedAttrState(content, aState, &nsARIAMap::gWAIUnivStateMap[index]);
+    MappedAttrState(content, &ariaState, &nsARIAMap::gWAIUnivStateMap[index]);
     ++ index;
   }
 
   if (!mRoleMapEntry)
-    return NS_OK;
+    return ariaState;
 
   // Once DHTML role is used, we're only readonly if DHTML readonly used
-  (*aState) &= ~nsIAccessibleStates::STATE_READONLY;
+  ariaState &= ~nsIAccessibleStates::STATE_READONLY;
 
-  if ((*aState) & nsIAccessibleStates::STATE_UNAVAILABLE) {
+  if (ariaState & nsIAccessibleStates::STATE_UNAVAILABLE) {
     // Disabled elements are not selectable or focusable, even if disabled
     // via DHTML accessibility disabled property
-    (*aState) &= ~(nsIAccessibleStates::STATE_SELECTABLE |
+    ariaState &= ~(nsIAccessibleStates::STATE_SELECTABLE |
                    nsIAccessibleStates::STATE_FOCUSABLE);
   }
 
-  (*aState) |= mRoleMapEntry->state;
+  ariaState |= mRoleMapEntry->state;
-  if (MappedAttrState(content, aState, &mRoleMapEntry->attributeMap1) &&
+  if (MappedAttrState(content, &ariaState, &mRoleMapEntry->attributeMap1) &&
-      MappedAttrState(content, aState, &mRoleMapEntry->attributeMap2) &&
+      MappedAttrState(content, &ariaState, &mRoleMapEntry->attributeMap2) &&
-      MappedAttrState(content, aState, &mRoleMapEntry->attributeMap3) &&
+      MappedAttrState(content, &ariaState, &mRoleMapEntry->attributeMap3) &&
-      MappedAttrState(content, aState, &mRoleMapEntry->attributeMap4) &&
+      MappedAttrState(content, &ariaState, &mRoleMapEntry->attributeMap4) &&
-      MappedAttrState(content, aState, &mRoleMapEntry->attributeMap5) &&
+      MappedAttrState(content, &ariaState, &mRoleMapEntry->attributeMap5) &&
-      MappedAttrState(content, aState, &mRoleMapEntry->attributeMap6) &&
+      MappedAttrState(content, &ariaState, &mRoleMapEntry->attributeMap6) &&
-      MappedAttrState(content, aState, &mRoleMapEntry->attributeMap7)) {
+      MappedAttrState(content, &ariaState, &mRoleMapEntry->attributeMap7)) {
-    MappedAttrState(content, aState, &mRoleMapEntry->attributeMap8);
+    MappedAttrState(content, &ariaState, &mRoleMapEntry->attributeMap8);
   }
 
-  return NS_OK;
+  return ariaState;
 }
 
 // Not implemented by this class
@@ -2793,11 +2786,11 @@ nsAccessible::GetRelations(nsIArray **aRelations)
   nsCOMPtr<nsIMutableArray> relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
   NS_ENSURE_TRUE(relations, NS_ERROR_OUT_OF_MEMORY);
 
-  // Latest nsIAccessibleRelation is RELATION_DESCRIPTION_FOR (0xof)
+  for (PRUint32 relType = nsIAccessibleRelation::RELATION_FIRST;
-  for (PRUint32 relType = 0; relType < 0x0f; ++relType) {
+       relType < nsIAccessibleRelation::RELATION_LAST;
+       ++relType) {
     nsCOMPtr<nsIAccessible> accessible;
-    nsresult rv = GetAccessibleRelated(relType, getter_AddRefs(accessible));
+    GetAccessibleRelated(relType, getter_AddRefs(accessible));
-    NS_ENSURE_SUCCESS(rv, rv);
 
     if (accessible) {
       nsCOMPtr<nsIAccessibleRelation> relation =

accessible/src/base/nsAccessible.h

@@ -136,12 +136,7 @@ public:
    * argument should hold states for accessible before you pass it into this
    * method.
    */
-  nsresult GetARIAState(PRUint32 *aState);
+  PRUint32 GetARIAState();
-
-#ifdef MOZ_ACCESSIBILITY_ATK
-  static PRBool FindTextFrame(PRInt32 &index, nsPresContext *aPresContext, nsIFrame *aCurFrame, 
-                                   nsIFrame **aFirstTextFrame, const nsIFrame *aTextFrame);
-#endif
 
 #ifdef DEBUG_A11Y
   static PRBool IsTextInterfaceSupportCorrect(nsIAccessible *aAccessible);

accessible/src/base/nsAccessibleEventData.cpp

@@ -359,7 +359,7 @@ nsAccStateChangeEvent::
   nsCOMPtr<nsIAccessible> accessible(GetAccessibleByNode());
   if (accessible) {
     PRUint32 state = 0, extraState = 0;
-    accessible->GetFinalState(&state, &extraState);
+    accessible->GetFinalState(&state, mIsExtraState ? &extraState : nsnull);
     mIsEnabled = ((mIsExtraState ? extraState : state) & mState) != 0;
   } else {
     mIsEnabled = PR_FALSE;
@@ -394,11 +394,16 @@ NS_IMPL_ISUPPORTS_INHERITED1(nsAccTextChangeEvent, nsAccEvent,
 
 nsAccTextChangeEvent::
   nsAccTextChangeEvent(nsIAccessible *aAccessible,
-                       PRInt32 aStart, PRUint32 aLength, PRBool aIsInserted):
+                       PRInt32 aStart, PRUint32 aLength, PRBool aIsInserted, PRBool aIsAsynch):
   nsAccEvent(aIsInserted ? nsIAccessibleEvent::EVENT_TEXT_INSERTED : nsIAccessibleEvent::EVENT_TEXT_REMOVED,
-             aAccessible, nsnull),
+             aAccessible, nsnull, aIsAsynch),
   mStart(aStart), mLength(aLength), mIsInserted(aIsInserted)
 {
+  nsCOMPtr<nsIAccessibleText> textAccessible = do_QueryInterface(aAccessible);
+  NS_ASSERTION(textAccessible, "Should not be firing test change event for non-text accessible!!!");
+  if (textAccessible) {
+    textAccessible->GetText(aStart, aStart + aLength, mModifiedText);
+  }
 }
 
 NS_IMETHODIMP
@@ -422,6 +427,13 @@ nsAccTextChangeEvent::IsInserted(PRBool *aIsInserted)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsAccTextChangeEvent::GetModifiedText(nsAString& aModifiedText)
+{
+  aModifiedText = mModifiedText;
+  return NS_OK;
+}
+
 // nsAccCaretMoveEvent
 NS_IMPL_ISUPPORTS_INHERITED1(nsAccCaretMoveEvent, nsAccEvent,
                              nsIAccessibleCaretMoveEvent)

accessible/src/base/nsAccessibleEventData.h

@@ -46,6 +46,8 @@
 #include "nsIAccessible.h"
 #include "nsIAccessibleDocument.h"
 #include "nsIDOMNode.h"
+#include "nsString.h"
+
 class nsIPresShell;
 
 class nsAccEvent: public nsIAccessibleEvent
@@ -128,8 +130,8 @@ class nsAccTextChangeEvent: public nsAccEvent,
                             public nsIAccessibleTextChangeEvent
 {
 public:
-  nsAccTextChangeEvent(nsIAccessible *aAccessible,
+  nsAccTextChangeEvent(nsIAccessible *aAccessible, PRInt32 aStart, PRUint32 aLength,
-                       PRInt32 aStart, PRUint32 aLength, PRBool aIsInserted);
+                       PRBool aIsInserted, PRBool aIsAsynch = PR_FALSE);
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_FORWARD_NSIACCESSIBLEEVENT(nsAccEvent::)
@@ -139,6 +141,7 @@ private:
   PRInt32 mStart;
   PRUint32 mLength;
   PRBool mIsInserted;
+  nsString mModifiedText;
 };
 
 class nsAccCaretMoveEvent: public nsAccEvent,

accessible/src/base/nsDocAccessible.cpp

@@ -1138,20 +1138,15 @@ void nsDocAccessible::ContentAppended(nsIDocument *aDocument,
                                       nsIContent* aContainer,
                                       PRInt32 aNewIndexInContainer)
 {
-  if (!mIsContentLoaded || !mDocument) {
+  if ((!mIsContentLoaded || !mDocument) && mAccessNodeCache.Count() <= 1) {
-    if (mAccessNodeCache.Count() <= 1) {
     // See comments in nsDocAccessible::InvalidateCacheSubtree
     InvalidateChildren();
-    }
     return;
   }
 
   PRUint32 childCount = aContainer->GetChildCount();
   for (PRUint32 index = aNewIndexInContainer; index < childCount; index ++) {
     nsCOMPtr<nsIContent> child(aContainer->GetChildAt(index));
-
-    FireTextChangedEventOnDOMNodeInserted(child, aContainer, index);
-
     // InvalidateCacheSubtree will not fire the EVENT_SHOW for the new node
     // unless an accessible can be created for the passed in node, which it
     // can't do unless the node is visible. The right thing happens there so
@@ -1184,8 +1179,6 @@ void
 nsDocAccessible::ContentInserted(nsIDocument *aDocument, nsIContent* aContainer,
                                  nsIContent* aChild, PRInt32 aIndexInContainer)
 {
-  FireTextChangedEventOnDOMNodeInserted(aChild, aContainer, aIndexInContainer);
-
   // InvalidateCacheSubtree will not fire the EVENT_SHOW for the new node
   // unless an accessible can be created for the passed in node, which it
   // can't do unless the node is visible. The right thing happens there so
@@ -1197,10 +1190,11 @@ void
 nsDocAccessible::ContentRemoved(nsIDocument *aDocument, nsIContent* aContainer,
                                 nsIContent* aChild, PRInt32 aIndexInContainer)
 {
-  FireTextChangedEventOnDOMNodeRemoved(aChild, aContainer, aIndexInContainer);
-
   // Invalidate the subtree of the removed element.
-  InvalidateCacheSubtree(aChild, nsIAccessibleEvent::EVENT_DOM_DESTROY);
+  // InvalidateCacheSubtree(aChild, nsIAccessibleEvent::EVENT_DOM_DESTROY);
+  // This is no longer needed, we get our notifications directly from content
+  // *before* the frame for the content is destroyed, or any other side effects occur.
+  // That allows us to correctly calculate the TEXT_REMOVED event if there is one.
 }
 
 void
@@ -1256,120 +1250,80 @@ nsDocAccessible::FireTextChangedEventOnDOMCharacterDataModified(nsIContent *aCon
   }
 }
 
-void
+already_AddRefed<nsIAccessibleTextChangeEvent>
-nsDocAccessible::FireTextChangedEventOnDOMNodeInserted(nsIContent *aChild,
+nsDocAccessible::CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
-                                                       nsIContent *aContainer,
+                                              nsIDOMNode *aChangeNode,
-                                                       PRInt32 aIndexInContainer)
+                                              nsIAccessible *aAccessibleForChangeNode,
+                                              PRBool aIsInserting,
+                                              PRBool aIsAsynch)
 {
-  if (!mIsContentLoaded || !mDocument) {
+  nsRefPtr<nsHyperTextAccessible> textAccessible;
-    return;
+  aContainerAccessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
+                                       getter_AddRefs(textAccessible));
+  if (!textAccessible) {
+    return nsnull;
   }
 
-  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(aChild));
+  PRInt32 offset;
-  if (!node)
+  PRInt32 length = 0;
-    return;
+  nsCOMPtr<nsIAccessible> changeAccessible;
+  nsresult rv = textAccessible->DOMPointToHypertextOffset(aChangeNode, -1, &offset,
+                                                          getter_AddRefs(changeAccessible));
+  NS_ENSURE_SUCCESS(rv, nsnull);
 
-  nsCOMPtr<nsIAccessible> accessible;
+  if (!aAccessibleForChangeNode) {
-  nsresult rv = GetAccessibleInParentChain(node, getter_AddRefs(accessible));
+    // A span-level object or something else without an accessible is being removed, where
-  if (NS_FAILED(rv) || !accessible)
+    // it has no accessible but it has descendant content which is aggregated as text
-    return;
+    // into the parent hypertext.
-
+    // In this case, accessibleToBeRemoved may just be the first
-  nsRefPtr<nsHyperTextAccessible> textAccessible;
+    // accessible that is removed, which affects the text in the hypertext container
-  rv = accessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
+    if (!changeAccessible) {
-                                  getter_AddRefs(textAccessible));
+      return nsnull; // No descendant content that represents any text in the hypertext parent
-  if (NS_FAILED(rv) || !textAccessible)
+    }
-    return;
+    nsCOMPtr<nsIAccessible> child = changeAccessible;
-
+    while (PR_TRUE) {
-  PRUint32 length = 1;
+      nsCOMPtr<nsIAccessNode> childAccessNode =
-  if (aChild && aChild->IsNodeOfType(nsINode::eTEXT)) {
+        do_QueryInterface(changeAccessible);
-    length = aChild->TextLength();
+      nsCOMPtr<nsIDOMNode> childNode;
-    if (!length)
+      childAccessNode->GetDOMNode(getter_AddRefs(childNode));
-      return;
+      if (!nsAccUtils::IsAncestorOf(aChangeNode, childNode)) {
-  } else {
+        break;  // We only want accessibles with DOM nodes as children of this node
+      }
+      length += TextLength(child);
+      child->GetNextSibling(getter_AddRefs(changeAccessible));
+      if (!changeAccessible) {
+        break;
+      }
+      child.swap(changeAccessible);
+    }
+  }
+  else {
+    NS_ASSERTION(changeAccessible == aAccessibleForChangeNode,
+                 "Hypertext is reporting a different accessible for this node");
+    length = TextLength(aAccessibleForChangeNode);
+    if (Role(aAccessibleForChangeNode) == nsIAccessibleRole::ROLE_WHITESPACE) {  // newline
       // Don't fire event for the first html:br in an editor.
       nsCOMPtr<nsIEditor> editor;
       textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
       if (editor) {
         PRBool isEmpty = PR_FALSE;
         editor->GetDocumentIsEmpty(&isEmpty);
-      if (isEmpty)
+        if (isEmpty) {
-        return;
+          return nsnull;
+        }
+      }
     }
   }
 
-  nsCOMPtr<nsIDOMNode> parentNode(do_QueryInterface(aContainer));
+  if (length <= 0) {
-  if (!parentNode)
+    return nsnull;
-    return;
-
-  PRInt32 offset = 0;
-  rv = textAccessible->DOMPointToHypertextOffset(parentNode, aIndexInContainer, &offset);
-  if (NS_FAILED(rv))
-    return;
-
-  nsCOMPtr<nsIAccessibleTextChangeEvent> event =
-    new nsAccTextChangeEvent(accessible, offset, length, PR_TRUE);
-  if (!event)
-    return;
-
-  textAccessible->FireAccessibleEvent(event);
   }
 
-void
+  nsIAccessibleTextChangeEvent *event =
-nsDocAccessible::FireTextChangedEventOnDOMNodeRemoved(nsIContent *aChild,
+    new nsAccTextChangeEvent(aContainerAccessible, offset, length, aIsInserting, aIsAsynch);
-                                                      nsIContent *aContainer,
+  NS_IF_ADDREF(event);
-                                                      PRInt32 aIndexInContainer)
-{
-  if (!mIsContentLoaded || !mDocument) {
-    return;
-  }
 
-  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(aChild));
+  return event;
-  if (!node)
-    return;
-
-  nsCOMPtr<nsIAccessible> accessible;
-  nsresult rv = GetAccessibleInParentChain(node, getter_AddRefs(accessible));
-  if (NS_FAILED(rv) || !accessible)
-    return;
-
-  nsRefPtr<nsHyperTextAccessible> textAccessible;
-  rv = accessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
-                                  getter_AddRefs(textAccessible));
-  if (NS_FAILED(rv) || !textAccessible)
-    return;
-
-  PRUint32 length = 1;
-  if (aChild && aChild->IsNodeOfType(nsINode::eTEXT)) {
-    length = aChild->TextLength();
-    if (!length)
-      return;
-  } else {
-    // Don't fire event for the last html:br in an editor.
-    nsCOMPtr<nsIEditor> editor;
-    textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
-    if (editor) {
-      PRBool isEmpty = PR_FALSE;
-      editor->GetDocumentIsEmpty(&isEmpty);
-      if (isEmpty)
-        return;
-    }
-  }
-
-  nsCOMPtr<nsIDOMNode> parentNode(do_QueryInterface(aContainer));
-  if (!parentNode)
-    return;
-
-  PRInt32 offset = 0;
-  rv = textAccessible->DOMPointToHypertextOffset(parentNode, aIndexInContainer, &offset);
-  if (NS_FAILED(rv))
-    return;
-
-  nsCOMPtr<nsIAccessibleTextChangeEvent> event =
-    new nsAccTextChangeEvent(accessible, offset, length, PR_FALSE);
-  if (!event)
-    return;
-
-  textAccessible->FireAccessibleEvent(event);
 }
   
 nsresult nsDocAccessible::FireDelayedToolkitEvent(PRUint32 aEvent,
@@ -1492,9 +1446,38 @@ NS_IMETHODIMP nsDocAccessible::FlushPendingEvents()
 
     nsCOMPtr<nsIAccessible> accessible;
     accessibleEvent->GetAccessible(getter_AddRefs(accessible));
-    if (accessible) {
+
     PRUint32 eventType;
     accessibleEvent->GetEventType(&eventType);
+    if (eventType == nsIAccessibleEvent::EVENT_DOM_CREATE || 
+        eventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW) {
+      // Also fire text changes if the node being created could affect the text in an nsIAccessibleText parent.
+      // When a node is being made visible or is inserted, the text in an ancestor hyper text will gain characters
+      // At this point we now have the frame and accessible for this node if there is one. That is why we
+      // wait to fire this here, instead of in InvalidateCacheSubtree(), where we wouldn't be able to calculate
+      // the offset, length and text for the text change.
+      nsCOMPtr<nsIDOMNode> domNode;
+      accessibleEvent->GetDOMNode(getter_AddRefs(domNode));
+      if (domNode && domNode != mDOMNode) {
+        nsCOMPtr<nsIAccessible> containerAccessible;
+        GetAccessibleInParentChain(domNode, getter_AddRefs(containerAccessible));
+        nsCOMPtr<nsIAccessibleTextChangeEvent> textChangeEvent =
+          CreateTextChangeEventForNode(containerAccessible, domNode, accessible, PR_TRUE, PR_TRUE);
+        if (textChangeEvent) {
+          PRBool isFromUserInput;
+          accessibleEvent->GetIsFromUserInput(&isFromUserInput);
+          nsCOMPtr<nsIDOMNode> hyperTextNode;
+          textChangeEvent->GetDOMNode(getter_AddRefs(hyperTextNode));
+          nsAccEvent::PrepareForEvent(hyperTextNode, isFromUserInput);
+          // XXX Queue them up and merge the text change events
+          // XXX We need a way to ignore SplitNode and JoinNode() when they
+          // do not affect the text within the hypertext
+          FireAccessibleEvent(textChangeEvent);
+        }
+      }
+    }
+
+    if (accessible) {
       if (eventType == nsIAccessibleEvent::EVENT_INTERNAL_LOAD) {
         nsCOMPtr<nsPIAccessibleDocument> docAccessible =
           do_QueryInterface(accessible);
@@ -1534,6 +1517,14 @@ NS_IMETHODIMP nsDocAccessible::FlushPendingEvents()
         // Post event processing
         if (eventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
             eventType == nsIAccessibleEvent::EVENT_DOM_DESTROY) {
+          // Invalidate children
+          nsCOMPtr<nsIAccessible> containerAccessible;
+          accessible->GetParent(getter_AddRefs(containerAccessible));
+          nsCOMPtr<nsPIAccessible> privateContainerAccessible =
+            do_QueryInterface(containerAccessible);
+          if (privateContainerAccessible) {
+            privateContainerAccessible->InvalidateChildren();
+          }
           // Shutdown nsIAccessNode's or nsIAccessibles for any DOM nodes in this subtree
           nsCOMPtr<nsIDOMNode> hidingNode;
           accessibleEvent->GetDOMNode(getter_AddRefs(hidingNode));
@@ -1702,6 +1693,12 @@ NS_IMETHODIMP nsDocAccessible::InvalidateCacheSubtree(nsIContent *aChild,
   }
 #endif
 
+  nsCOMPtr<nsIAccessible> containerAccessible;
+  GetAccessibleInParentChain(childNode, getter_AddRefs(containerAccessible));
+  if (!containerAccessible) {
+    containerAccessible = this;
+  }
+
   if (!isShowing) {
     // Fire EVENT_ASYNCH_HIDE or EVENT_DOM_DESTROY if previous accessible existed for node being hidden.
     // Fire this before the accessible goes away.
@@ -1713,6 +1710,19 @@ NS_IMETHODIMP nsDocAccessible::InvalidateCacheSubtree(nsIContent *aChild,
       NS_ENSURE_TRUE(removalEvent, NS_ERROR_OUT_OF_MEMORY);
       FireDelayedAccessibleEvent(removalEvent, eCoalesceFromSameSubtree, isAsynch);
     }
+    if (childNode != mDOMNode) { // Fire text change unless the node being removed is for this doc
+      // When a node is hidden or removed, the text in an ancestor hyper text will lose characters
+      // At this point we still have the frame and accessible for this node if there was one
+      // XXX Collate events when a range is deleted
+      // XXX We need a way to ignore SplitNode and JoinNode() when they
+      // do not affect the text within the hypertext
+      nsCOMPtr<nsIAccessibleTextChangeEvent> textChangeEvent =
+        CreateTextChangeEventForNode(containerAccessible, childNode, childAccessible,
+                                     PR_FALSE, isAsynch);
+      if (textChangeEvent) {
+        FireAccessibleEvent(textChangeEvent);
+      }
+    }
   }
 
   // We need to get an accessible for the mutation event's container node
@@ -1722,18 +1732,12 @@ NS_IMETHODIMP nsDocAccessible::InvalidateCacheSubtree(nsIContent *aChild,
   // We're guaranteed success, because we will eventually end up at the doc accessible,
   // and there is always one of those.
 
-  nsCOMPtr<nsIAccessible> containerAccessible;
+  if (aChild && !isHiding) {
-  GetAccessibleInParentChain(childNode, getter_AddRefs(containerAccessible));
-  if (!containerAccessible) {
-    containerAccessible = this;
-  }
     nsCOMPtr<nsPIAccessible> privateContainerAccessible =
       do_QueryInterface(containerAccessible);
     if (privateContainerAccessible) {
       privateContainerAccessible->InvalidateChildren();
     }
-
-  if (aChild && !isHiding) {
     // Fire EVENT_SHOW, EVENT_MENUPOPUP_START for newly visible content.
     // Fire after a short timer, because we want to make sure the view has been
     // updated to make this accessible content visible. If we don't wait,

accessible/src/base/nsDocAccessible.h

@@ -107,7 +107,7 @@ class nsDocAccessible : public nsHyperTextAccessibleWrap,
     /**
       * Non-virtual method to fire a delayed event after a 0 length timeout
       *
-      * @param aEvent - the nsIAccessibleEvent event ype
+      * @param aEvent - the nsIAccessibleEvent event type
       * @param aDOMNode - DOM node the accesible event should be fired for
       * @param aData - any additional data for the event
       * @param aAllowDupes - eAllowDupes: more than one event of the same type is allowed. 
@@ -161,21 +161,20 @@ class nsDocAccessible : public nsHyperTextAccessibleWrap,
      */
     void FireTextChangedEventOnDOMCharacterDataModified(nsIContent *aContent,
                                                         CharacterDataChangeInfo* aInfo);
-    /**
-     * Fire text changed event for the inserted element if it is inside a text
-     * accessible.
-     */
-    void FireTextChangedEventOnDOMNodeInserted(nsIContent *aChild,
-                                               nsIContent *aContainer,
-                                               PRInt32 aIndexInContainer);
 
     /**
-     * Fire text changed event for the removed element if it is inside a text
+     * Create a text change event for a changed node
-     * accessible.
+     * @param aContainerAccessible, the first accessible in the container
+     * @param aChangeNode, the node that is being inserted or removed, or shown/hidden
+     * @param aAccessibleForChangeNode, the accessible for that node, or nsnull if none exists
+     * @param aIsInserting, is aChangeNode being created or shown (vs. removed or hidden)
      */
-    void FireTextChangedEventOnDOMNodeRemoved(nsIContent *aChild,
+    already_AddRefed<nsIAccessibleTextChangeEvent>
-                                              nsIContent *aContainer,
+    CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
-                                              PRInt32 aIndexInContainer);
+                                 nsIDOMNode *aChangeNode,
+                                 nsIAccessible *aAccessibleForNode,
+                                 PRBool aIsInserting,
+                                 PRBool aIsAsynch);
 
     nsAccessNodeHashtable mAccessNodeCache;
     void *mWnd;

accessible/src/base/nsRootAccessible.cpp

@@ -469,6 +469,9 @@ PRBool nsRootAccessible::FireAccessibleFocusEvent(nsIAccessible *aAccessible,
       // For activedescendant, the ARIA spec does not require that the user agent
       // checks whether finalFocusNode is actually a descendant of the element with
       // the activedescendant attribute.
+      if (!finalFocusAccessible) {
+        return PR_FALSE;
+      }
     }
   }
 
@@ -936,6 +939,9 @@ nsRootAccessible::GetContentDocShell(nsIDocShellTreeItem *aStart)
       }
       nsCOMPtr<nsIAccessible> ancestor;
       accessible->GetParent(getter_AddRefs(ancestor));
+      if (ancestor == this) {
+        break; // Don't check past original root accessible we started with
+      }
       accessible.swap(ancestor);
     }
 

accessible/src/html/nsHTMLTextAccessible.cpp

@@ -62,9 +62,9 @@ NS_IMETHODIMP nsHTMLTextAccessible::GetName(nsAString& aName)
 NS_IMETHODIMP nsHTMLTextAccessible::GetRole(PRUint32 *aRole)
 {
   nsIFrame *frame = GetFrame();
-  NS_ENSURE_TRUE(frame, NS_ERROR_NULL_POINTER);
+  // Don't return on null frame -- we still return a role
-
+  // after accessible is shutdown/DEFUNCT
-  if (frame->IsGeneratedContentFrame()) {
+  if (frame && frame->IsGeneratedContentFrame()) {
     *aRole = nsIAccessibleRole::ROLE_STATICTEXT;
     return NS_OK;
   }

accessible/src/html/nsHyperTextAccessible.cpp

@@ -315,7 +315,9 @@ nsIntRect nsHyperTextAccessible::GetBoundsForString(nsIFrame *aFrame, PRUint32 a
 nsIFrame*
 nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
                                      nsAString *aText, nsIFrame **aEndFrame,
-                                     nsIntRect *aBoundsRect)
+                                     nsIntRect *aBoundsRect,
+                                     nsIAccessible **aStartAcc,
+                                     nsIAccessible **aEndAcc)
 {
   PRInt32 startOffset = aStartOffset;
   PRInt32 endOffset = aEndOffset;
@@ -339,6 +341,10 @@ nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
   if (aBoundsRect) {
     aBoundsRect->Empty();
   }
+  if (aStartAcc)
+    *aStartAcc = nsnull;
+  if (aEndAcc)
+    *aEndAcc = nsnull;
 
   nsIntRect unionRect;
   nsCOMPtr<nsIAccessible> accessible;
@@ -385,6 +391,8 @@ nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
                                                &outStartLineUnused, &frame);
           if (aEndFrame) {
             *aEndFrame = frame; // We ended in the current frame
+            if (aEndAcc)
+              NS_ADDREF(*aEndAcc = accessible);
           }
           if (substringEndOffset > endOffset) {
             // Need to stop before the end of the available text
@@ -405,6 +413,8 @@ nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
         if (!startFrame) {
           startFrame = frame;
           aStartOffset = startOffset;
+          if (aStartAcc)
+            NS_ADDREF(*aStartAcc = accessible);
         }
         // We already started copying in this accessible's string,
         // for the next accessible we'll start at offset 0
@@ -438,6 +448,8 @@ nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
         if (!startFrame) {
           startFrame = frame;
           aStartOffset = 0;
+          if (aStartAcc)
+            NS_ADDREF(*aStartAcc = accessible);
         }
       }
       -- endOffset;
@@ -449,6 +461,8 @@ nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
 
   if (aEndFrame && !*aEndFrame) {
     *aEndFrame = startFrame;
+    if (aStartAcc && aEndAcc)
+      NS_ADDREF(*aEndAcc = *aStartAcc);
   }
 
   return startFrame;
@@ -512,7 +526,6 @@ nsresult nsHyperTextAccessible::DOMPointToHypertextOffset(nsIDOMNode* aNode, PRI
   NS_ENSURE_ARG_POINTER(aHyperTextOffset);
   *aHyperTextOffset = 0;
   NS_ENSURE_ARG_POINTER(aNode);
-  NS_ENSURE_TRUE(aNodeOffset >= 0, NS_ERROR_INVALID_ARG);
   if (aFinalAccessible) {
     *aFinalAccessible = nsnull;
   }
@@ -522,7 +535,10 @@ nsresult nsHyperTextAccessible::DOMPointToHypertextOffset(nsIDOMNode* aNode, PRI
 
   unsigned short nodeType;
   aNode->GetNodeType(&nodeType);
-  if (nodeType == nsIDOMNode::TEXT_NODE) {
+  if (aNodeOffset == -1) {
+    findNode = aNode;
+  }
+  else if (nodeType == nsIDOMNode::TEXT_NODE) {
     // For text nodes, aNodeOffset comes in as a character offset
     // Text offset will be added at the end, if we find the offset in this hypertext
     // We want the "skipped" offset into the text (rendered text without the extra whitespace)
@@ -604,11 +620,18 @@ nsresult nsHyperTextAccessible::DOMPointToHypertextOffset(nsIDOMNode* aNode, PRI
       NS_ADDREF(*aFinalAccessible = childAccessible);
     }
   }
+
   return NS_OK;
 }
 
-PRInt32 nsHyperTextAccessible::GetRelativeOffset(nsIPresShell *aPresShell, nsIFrame *aFromFrame, PRInt32 aFromOffset,
+PRInt32
-                                                 nsSelectionAmount aAmount, nsDirection aDirection, PRBool aNeedsStart)
+nsHyperTextAccessible::GetRelativeOffset(nsIPresShell *aPresShell,
+                                         nsIFrame *aFromFrame,
+                                         PRInt32 aFromOffset,
+                                         nsIAccessible *aFromAccessible,
+                                         nsSelectionAmount aAmount,
+                                         nsDirection aDirection,
+                                         PRBool aNeedsStart)
 {
   const PRBool kIsJumpLinesOk = PR_TRUE;          // okay to jump lines
   const PRBool kIsScrollViewAStop = PR_FALSE;     // do not stop at scroll views
@@ -623,9 +646,18 @@ PRInt32 nsHyperTextAccessible::GetRelativeOffset(nsIPresShell *aPresShell, nsIFr
   // Ask layout for the new node and offset, after moving the appropriate amount
   nsPeekOffsetStruct pos;
 
-  PRInt32 contentOffset;
+  nsresult rv;
-  nsresult rv = RenderedToContentOffset(aFromFrame, aFromOffset, &contentOffset);
+  PRInt32 contentOffset = aFromOffset;
+  if (IsText(aFromAccessible)) {
+    nsCOMPtr<nsPIAccessNode> accessNode(do_QueryInterface(aFromAccessible));
+    NS_ASSERTION(accessNode, "nsIAccessible doesn't support nsPIAccessNode");
+
+    nsIFrame *frame = accessNode->GetFrame();
+    NS_ENSURE_TRUE(frame, -1);
+
+    rv = RenderedToContentOffset(frame, aFromOffset, &contentOffset);
     NS_ENSURE_SUCCESS(rv, -1);
+  }
 
   pos.SetData(aAmount, aDirection, contentOffset,
               0, kIsJumpLinesOk, kIsScrollViewAStop, kIsKeyboardSelect, kIsVisualBidi,
@@ -723,7 +755,10 @@ nsresult nsHyperTextAccessible::GetTextHelper(EGetTextType aType, nsAccessibleTe
     ++ endOffset;
   }
   // Convert offsets to frame-relative
-  nsIFrame *startFrame = GetPosAndText(startOffset, endOffset);
+  nsCOMPtr<nsIAccessible> startAcc;
+  nsIFrame *startFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
+                                       nsnull, getter_AddRefs(startAcc));
+
   if (!startFrame) {
     PRInt32 textLength;
     GetCharacterCount(&textLength);
@@ -793,7 +828,8 @@ nsresult nsHyperTextAccessible::GetTextHelper(EGetTextType aType, nsAccessibleTe
   }
   else {
     finalStartOffset = GetRelativeOffset(presShell, startFrame, startOffset,
-                                         amount, eDirPrevious, needsStart);
+                                         startAcc, amount, eDirPrevious,
+                                         needsStart);
     NS_ENSURE_TRUE(finalStartOffset >= 0, NS_ERROR_FAILURE);
   }
 
@@ -805,12 +841,14 @@ nsresult nsHyperTextAccessible::GetTextHelper(EGetTextType aType, nsAccessibleTe
     // 2 words/lines if the offset occured on whitespace boundary
     // Careful, startOffset and endOffset are passed by reference to GetPosAndText() and changed
     startOffset = endOffset = finalStartOffset;
-    nsIFrame *endFrame = GetPosAndText(startOffset, endOffset);
+    nsCOMPtr<nsIAccessible> endAcc;
+    nsIFrame *endFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
+                                       nsnull, getter_AddRefs(endAcc));
     if (!endFrame) {
       return NS_ERROR_FAILURE;
     }
-    finalEndOffset = GetRelativeOffset(presShell, endFrame, endOffset, amount,
+    finalEndOffset = GetRelativeOffset(presShell, endFrame, endOffset, endAcc,
-                                       eDirNext, needsStart);
+                                       amount, eDirNext, needsStart);
     NS_ENSURE_TRUE(endOffset >= 0, NS_ERROR_FAILURE);
     if (finalEndOffset == aOffset) {
       // This happens sometimes when current character at finalStartOffset 
@@ -1509,6 +1547,58 @@ NS_IMETHODIMP nsHyperTextAccessible::RemoveSelection(PRInt32 aSelectionNum)
   return domSel->RemoveRange(range);
 }
 
+NS_IMETHODIMP
+nsHyperTextAccessible::ScrollSubstringTo(PRInt32 aStartIndex, PRInt32 aEndIndex,
+                                         PRUint32 aScrollType)
+{
+  PRInt32 startOffset = aStartIndex, endOffset = aEndIndex;
+  nsIFrame *startFrame = nsnull, *endFrame = nsnull;
+  nsCOMPtr<nsIAccessible> startAcc, endAcc;
+
+  startFrame = GetPosAndText(startOffset, endOffset,
+                             nsnull, &endFrame, nsnull,
+                             getter_AddRefs(startAcc), getter_AddRefs(endAcc));
+  if (!startFrame || !endFrame)
+    return NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsIDOMNode> startNode;
+  nsCOMPtr<nsIContent> startContent(startFrame->GetContent());
+
+  PRBool isStartAccText = IsText(startAcc);
+  if (isStartAccText) {
+    nsresult rv = RenderedToContentOffset(startFrame, startOffset,
+                                          &startOffset);
+    NS_ENSURE_SUCCESS(rv, rv);
+    startNode = do_QueryInterface(startContent);
+  } else {
+    nsCOMPtr<nsIContent> startParent(startContent->GetParent());
+    NS_ENSURE_STATE(startParent);
+    startOffset = startParent->IndexOf(startContent);
+    startNode = do_QueryInterface(startParent);
+  }
+  NS_ENSURE_STATE(startNode);
+
+  nsCOMPtr<nsIDOMNode> endNode;
+  nsCOMPtr<nsIContent> endContent(endFrame->GetContent());
+
+  PRBool isEndAccText = IsText(endAcc);
+  if (isEndAccText) {
+    nsresult rv = RenderedToContentOffset(endFrame, endOffset,
+                                          &endOffset);
+    NS_ENSURE_SUCCESS(rv, rv);
+    endNode = do_QueryInterface(endContent);
+  } else {
+    nsCOMPtr<nsIContent> endParent(endContent->GetParent());
+    NS_ENSURE_STATE(endParent);
+    endOffset = endParent->IndexOf(endContent);
+    endNode = do_QueryInterface(endParent);
+  }
+  NS_ENSURE_STATE(endNode);
+
+  return nsAccUtils::ScrollSubstringTo(GetFrame(), startNode, startOffset,
+                                       endNode, endOffset, aScrollType);
+}
+
 nsresult nsHyperTextAccessible::ContentToRenderedOffset(nsIFrame *aFrame, PRInt32 aContentOffset,
                                                         PRUint32 *aRenderedOffset)
 {

accessible/src/html/nsHyperTextAccessible.h

@@ -101,6 +101,9 @@ public:
     *
     * @param aNode - the node to look for
     * @param aNodeOffset - the offset to look for
+    *                      if -1 just look directly for the node
+    *                      if >=0 and aNode is text, this represents a char offset
+    *                      if >=0 and aNode is not text, this represents a child node offset
     * @param aResultOffset - the character offset into the current
     *                        nsHyperTextAccessible
     * @param aFinalAccessible [optional] - returns the accessible child which
@@ -128,31 +131,55 @@ protected:
                          nsAString & aText);
 
   /**
-    * Used by GetPosAndText to move backward/forward from a given point by word/line/etc.
+    * Used by GetTextHelper() to move backward/forward from a given point
-    * @param aPresShell, the current presshell we're moving in
+    * by word/line/etc.
-    * @param aFromFrame, the starting frame we're moving from
+    *
-    * @param aFromOffset, the starting offset we're moving from
+    * @param  aPresShell       the current presshell we're moving in
-    * @param aAmount, how much are we moving (word/line/etc.) ?
+    * @param  aFromFrame       the starting frame we're moving from
-    * @param aDirection, forward or backward?
+    * @param  aFromOffset      the starting offset we're moving from
-    * @param aNeedsStart, for word and line cases, are we basing this on the start or end?
+    * @param  aFromAccessible  the starting accessible we're moving from
-    * @return, the resulting offset into this hypertext
+    * @param  aAmount          how much are we moving (word/line/etc.) ?
+    * @param  aDirection       forward or backward?
+    * @param  aNeedsStart      for word and line cases, are we basing this on
+    *                          the start or end?
+    * @return                  the resulting offset into this hypertext
     */
-  PRInt32 GetRelativeOffset(nsIPresShell *aPresShell, nsIFrame *aFromFrame, PRInt32 aFromOffset,
+  PRInt32 GetRelativeOffset(nsIPresShell *aPresShell, nsIFrame *aFromFrame,
-                            nsSelectionAmount aAmount, nsDirection aDirection, PRBool aNeedsStart);
+                            PRInt32 aFromOffset, nsIAccessible *aFromAccessible,
+                            nsSelectionAmount aAmount, nsDirection aDirection,
+                            PRBool aNeedsStart);
+
   /**
-    * Given a start offset and end offset, get substring information. Different info is returned depending
+    * Provides information for substring that is defined by the given start
-    * on what optional paramters are provided.
+    * and end offsets for this hyper text.
-    * @param aStartOffset, the start offset into the hyper text. This is also an out parameter used to return
+    *
-    *                      the offset into the start frame's rendered text content (start frame is the @return)
+    * @param  aStartOffset  [inout] the start offset into the hyper text. This
-    * @param aEndHyperOffset, the endoffset into the hyper text. This is also an out parameter used to return
+    *                       is also an out parameter used to return the offset
-    *                    the offset into the end frame's rendered text content
+    *                       into the start frame's rendered text content
-    * @param aText (optional), return the substring's text
+    *                       (start frame is the @return)
-    * @param aEndFrame (optional), return the end frame for this substring
+    *
-    * @param aBoundsRect (optional), return the bounds rectangle for this substring
+    * @param  aEndOffset    [inout] the end offset into the hyper text. This is
+    *                       also an out parameter used to return
+    *                       the offset into the end frame's rendered
+    *                       text content.
+    *
+    * @param  aText         [out, optional] return the substring's text
+    * @param  aEndFrame     [out, optional] return the end frame for this
+    *                       substring
+    * @param  aBoundsRect   [out, optional] return the bounds rectangle for this
+    *                       substring
+    * @param  aStartAcc     [out, optional] return the start accessible for this
+    *                       substring
+    * @param  aEndAcc       [out, optional] return the end accessible for this
+    *                       substring
     * @return               the start frame for this substring
     */
-  nsIFrame* GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset, nsAString *aText = nsnull,
+  nsIFrame* GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
-                          nsIFrame **aEndFrame = nsnull, nsIntRect *aBoundsRect = nsnull);
+                          nsAString *aText = nsnull,
+                          nsIFrame **aEndFrame = nsnull,
+                          nsIntRect *aBoundsRect = nsnull,
+                          nsIAccessible **aStartAcc = nsnull,
+                          nsIAccessible **aEndAcc = nsnull);
 
   nsIntRect GetBoundsForString(nsIFrame *aFrame, PRUint32 aStartRenderedOffset, PRUint32 aEndRenderedOffset);
 

accessible/src/msaa/CAccessibleAction.cpp

@@ -110,8 +110,10 @@ CAccessibleAction::get_description(long aActionIndex, BSTR *aDescription)
     return E_FAIL;
 
   if (!description.IsVoid()) {
-    return ::SysReAllocStringLen(aDescription, description.get(),
+    INT result = ::SysReAllocStringLen(aDescription, description.get(),
                                        description.Length());
+    if (!result)
+      return E_OUTOFMEMORY;
   }
 
   return S_OK;
@@ -152,10 +154,10 @@ CAccessibleAction::get_keyBinding(long aActionIndex, long aNumMaxBinding,
   for (PRUint32 i = 0; i < numBinding; i++) {
     nsAutoString key;
     keys->Item(i, key);
-    HRESULT hr = ::SysReAllocStringLen(aKeyBinding[i], key.get(),
+    INT result = ::SysReAllocStringLen(aKeyBinding[i], key.get(),
                                        key.Length());
-    if (FAILED(hr))
+    if (!result)
-      return hr;
+      return E_OUTOFMEMORY;
   }
 
   return S_OK;
@@ -175,8 +177,11 @@ CAccessibleAction::get_name(long aActionIndex, BSTR *aName)
   if (NS_FAILED(acc->GetActionName(index, name)))
     return E_FAIL;
 
-  if (!name.IsVoid())
+  if (!name.IsVoid()) {
-    return ::SysReAllocStringLen(aName, name.get(), name.Length());
+    INT result = ::SysReAllocStringLen(aName, name.get(), name.Length());
+    if (!result)
+      return E_OUTOFMEMORY;
+  }
 
   return S_OK;
 }

accessible/src/msaa/CAccessibleComponent.cpp

@@ -88,8 +88,8 @@ CAccessibleComponent::get_locationInParent(long *aX, long *aY)
     return E_FAIL;
 
   // If the object is not on any screen the returned position is (0,0).
-  PRUint32 states = 0, extraStates = 0;
+  PRUint32 states = 0;
-  nsresult rv = acc->GetFinalState(&states, &extraStates);
+  nsresult rv = acc->GetFinalState(&states, nsnull);
   if (NS_FAILED(rv))
     return E_FAIL;
 

accessible/src/msaa/CAccessibleHyperlink.cpp

@@ -135,8 +135,9 @@ CAccessibleHyperlink::get_anchorTarget(long aIndex, VARIANT *aAnchorTarget)
   AppendUTF8toUTF16(path, stringURI);
 
   aAnchorTarget->vt = VT_BSTR;
-  return ::SysReAllocStringLen(&aAnchorTarget->bstrVal, stringURI.get(),
+  INT result = ::SysReAllocStringLen(&aAnchorTarget->bstrVal, stringURI.get(),
                                      stringURI.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 STDMETHODIMP

accessible/src/msaa/CAccessibleImage.cpp

@@ -82,8 +82,9 @@ CAccessibleImage::get_description(BSTR *aDescription)
   if (NS_FAILED(rv))
     return E_FAIL;
 
-  return ::SysReAllocStringLen(aDescription, description.get(),
+  INT result = ::SysReAllocStringLen(aDescription, description.get(),
                                      description.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 STDMETHODIMP

accessible/src/msaa/CAccessibleTable.cpp

@@ -159,7 +159,8 @@ CAccessibleTable::get_columnDescription(long aColumn, BSTR *aDescription)
   if (NS_FAILED(rv))
     return E_FAIL;
 
-  return ::SysReAllocStringLen(aDescription, descr.get(), descr.Length());
+  INT result = ::SysReAllocStringLen(aDescription, descr.get(), descr.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 STDMETHODIMP
@@ -329,7 +330,8 @@ CAccessibleTable::get_rowDescription(long aRow, BSTR *aDescription)
   if (NS_FAILED(rv))
     return E_FAIL;
 
-  return ::SysReAllocStringLen(aDescription, descr.get(), descr.Length());
+  INT result = ::SysReAllocStringLen(aDescription, descr.get(), descr.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 STDMETHODIMP

accessible/src/msaa/CAccessibleText.cpp

@@ -211,7 +211,8 @@ CAccessibleText::get_text(long aStartOffset, long aEndOffset, BSTR *aText)
   if (NS_FAILED(rv))
     return E_FAIL;
 
-  return ::SysReAllocStringLen(aText, text.get(), text.Length());
+  INT result = ::SysReAllocStringLen(aText, text.get(), text.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 STDMETHODIMP
@@ -244,7 +245,8 @@ CAccessibleText::get_textBeforeOffset(long aOffset,
   *aStartOffset = startOffset;
   *aEndOffset = endOffset;
 
-  return ::SysReAllocStringLen(aText, text.get(), text.Length());
+  INT result = ::SysReAllocStringLen(aText, text.get(), text.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 STDMETHODIMP
@@ -277,7 +279,8 @@ CAccessibleText::get_textAfterOffset(long aOffset,
   *aStartOffset = startOffset;
   *aEndOffset = endOffset;
 
-  return ::SysReAllocStringLen(aText, text.get(), text.Length());
+  INT result = ::SysReAllocStringLen(aText, text.get(), text.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 STDMETHODIMP
@@ -310,7 +313,8 @@ CAccessibleText::get_textAtOffset(long aOffset,
   *aStartOffset = startOffset;
   *aEndOffset = endOffset;
 
-  return ::SysReAllocStringLen(aText, text.get(), text.Length());
+  INT result = ::SysReAllocStringLen(aText, text.get(), text.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 STDMETHODIMP
@@ -360,29 +364,8 @@ CAccessibleText::scrollSubstringTo(long aStartIndex, long aEndIndex,
 {
   GET_NSIACCESSIBLETEXT
 
-  nsCOMPtr<nsIAccessible> accessible;
+  nsresult rv = textAcc->ScrollSubstringTo(aStartIndex, aEndIndex, aScrollType);
-  PRInt32 startOffset = 0, endOffset = 0;
+  return NS_FAILED(rv) ? E_FAIL : S_OK;
-
-  // XXX: aEndIndex isn't used.
-  textAcc->GetAttributeRange(aStartIndex, &startOffset, &endOffset,
-                             getter_AddRefs(accessible));
-  if (!accessible)
-    return E_FAIL;
-
-  nsCOMPtr<nsIWinAccessNode> winAccessNode(do_QueryInterface(accessible));
-  if (!winAccessNode)
-    return E_FAIL;
-
-  void **instancePtr = 0;
-  winAccessNode->QueryNativeInterface(IID_IAccessible2, instancePtr);
-  if (!instancePtr)
-    return E_FAIL;
-
-  IAccessible2 *pAccessible2 = static_cast<IAccessible2*>(*instancePtr);
-  HRESULT hr = pAccessible2->scrollTo(aScrollType);
-  pAccessible2->Release();
-
-  return hr;
 }
 
 STDMETHODIMP
@@ -446,7 +429,8 @@ CAccessibleText::GetModifiedText(PRBool aGetInsertedText,
   aText->start = startOffset;
   aText->end = endOffset;
 
-  return ::SysReAllocStringLen(&(aText->text), text.get(), text.Length());
+  INT result = ::SysReAllocStringLen(&(aText->text), text.get(), text.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 nsAccessibleTextBoundary

accessible/src/msaa/nsAccessibleWrap.cpp

@@ -498,8 +498,8 @@ STDMETHODIMP nsAccessibleWrap::get_accState(
   if (!xpAccessible)
     return E_FAIL;
 
-  PRUint32 state = 0, extraState;
+  PRUint32 state = 0;
-  if (NS_FAILED(xpAccessible->GetFinalState(&state, &extraState)))
+  if (NS_FAILED(xpAccessible->GetFinalState(&state, nsnull)))
     return E_FAIL;
 
   pvarState->lVal = state;

accessible/src/msaa/nsApplicationAccessibleWrap.cpp

@@ -81,7 +81,8 @@ nsApplicationAccessibleWrap::get_appName(BSTR *aName)
     return E_FAIL;
 
   NS_ConvertUTF8toUTF16 name(cname);
-  return ::SysReAllocStringLen(aName, name.get(), name.Length());
+  INT result = ::SysReAllocStringLen(aName, name.get(), name.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 STDMETHODIMP
@@ -97,7 +98,8 @@ nsApplicationAccessibleWrap::get_appVersion(BSTR *aVersion)
     return E_FAIL;
 
   NS_ConvertUTF8toUTF16 version(cversion);
-  return ::SysReAllocStringLen(aVersion, version.get(), version.Length());
+  INT result = ::SysReAllocStringLen(aVersion, version.get(), version.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 STDMETHODIMP
@@ -119,7 +121,8 @@ nsApplicationAccessibleWrap::get_toolkitVersion(BSTR *aVersion)
     return E_FAIL;
 
   NS_ConvertUTF8toUTF16 version(cversion);
-  return ::SysReAllocStringLen(aVersion, version.get(), version.Length());
+  INT result = ::SysReAllocStringLen(aVersion, version.get(), version.Length());
+  return result ? NS_OK : E_OUTOFMEMORY;
 }
 
 // nsApplicationAccessibleWrap

accessible/src/msaa/nsHyperTextAccessibleWrap.cpp

@@ -90,27 +90,23 @@ nsHyperTextAccessibleWrap::GetModifiedText(PRBool aGetInsertedText,
   if (!gTextEvent)
     return NS_OK;
     
+  PRBool isInserted;
+  gTextEvent->IsInserted(&isInserted);
+  if (aGetInsertedText != isInserted)
+    return NS_OK;
+
   nsCOMPtr<nsIAccessible> targetAcc;
   gTextEvent->GetAccessible(getter_AddRefs(targetAcc));
   if (targetAcc != this)
     return NS_OK;
 
-  PRBool isInserted;
-  gTextEvent->IsInserted(&isInserted);
-
-  if (aGetInsertedText != isInserted)
-    return NS_OK;
-
-  nsAutoString text;
   PRInt32 offset;
   PRUint32 length;
 
   gTextEvent->GetStart(&offset);
   gTextEvent->GetLength(&length);
-  GetText(offset, offset + length, aText);
   *aStartOffset = offset;
   *aEndOffset = offset + length;
-
+  return gTextEvent->GetModifiedText(aText);
-  return NS_OK;
 }
 

accessible/src/msaa/nsTextAccessibleWrap.cpp

@@ -39,21 +39,15 @@
 // NOTE: alphabetically ordered
 #include "nsTextAccessibleWrap.h"
 #include "ISimpleDOMText_i.c"
-#include "nsContentCID.h"
 #include "nsIAccessibleDocument.h"
-#include "nsIDOMRange.h"
 #include "nsIFontMetrics.h"
 #include "nsIFrame.h"
 #include "nsPresContext.h"
 #include "nsIPresShell.h"
 #include "nsIRenderingContext.h"
-#include "nsISelection.h"
-#include "nsISelectionController.h"
 #include "nsIWidget.h"
 #include "nsIComponentManager.h"
 
-static NS_DEFINE_IID(kRangeCID, NS_RANGE_CID);
-
 // --------------------------------------------------------
 // nsTextAccessibleWrap Accessible
 // --------------------------------------------------------
@@ -162,37 +156,10 @@ STDMETHODIMP nsTextAccessibleWrap::scrollToSubstring(
     /* [in] */ unsigned int aStartIndex,
     /* [in] */ unsigned int aEndIndex)
 {
-  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
+  nsresult rv = nsAccUtils::ScrollSubstringTo(GetFrame(), mDOMNode, aStartIndex,
-  nsIFrame *frame = GetFrame();
+                                              mDOMNode, aEndIndex,
-
+                                              nsIAccessibleScrollType::SCROLL_TYPE_ANYWHERE);
-  if (!frame || !presShell) {
+  return NS_FAILED(rv) ? E_FAIL : S_OK;
-    return E_FAIL;  // This accessible has been shut down
-  }
-
-  nsPresContext *presContext = presShell->GetPresContext();
-  nsCOMPtr<nsIDOMRange> scrollToRange = do_CreateInstance(kRangeCID);
-  nsCOMPtr<nsISelectionController> selCon;
-  frame->GetSelectionController(presContext, getter_AddRefs(selCon));
-  if (!presContext || !scrollToRange || !selCon) {
-    return E_FAIL;
-  }
-
-  scrollToRange->SetStart(mDOMNode, aStartIndex);
-  scrollToRange->SetEnd(mDOMNode, aEndIndex);
-  nsCOMPtr<nsISelection> domSel;
-  selCon->GetSelection(nsISelectionController::SELECTION_ACCESSIBILITY, 
-                       getter_AddRefs(domSel));
-  if (domSel) {
-    domSel->RemoveAllRanges();
-    domSel->AddRange(scrollToRange);
-
-    selCon->ScrollSelectionIntoView(nsISelectionController::SELECTION_ACCESSIBILITY, 
-      nsISelectionController::SELECTION_ANCHOR_REGION, PR_TRUE);
-
-    domSel->CollapseToStart();
-  }
-
-  return S_OK;
 }
 
 nsIFrame* nsTextAccessibleWrap::GetPointFromOffset(nsIFrame *aContainingFrame, 

accessible/src/xul/nsXULMenuAccessible.cpp

@@ -391,13 +391,18 @@ NS_IMETHODIMP nsXULMenuitemAccessible::GetDescription(nsAString& aDescription)
 }
 
 //return menu accesskey: N or Alt+F
-NS_IMETHODIMP nsXULMenuitemAccessible::GetKeyboardShortcut(nsAString& _retval)
+NS_IMETHODIMP
+nsXULMenuitemAccessible::GetKeyboardShortcut(nsAString& aAccessKey)
 {
+  aAccessKey.Truncate();
+
   static PRInt32 gMenuAccesskeyModifier = -1;  // magic value of -1 indicates unitialized state
 
   nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(mDOMNode));
   if (elt) {
     nsAutoString accesskey;
+    // We do not use nsAccUtils::GetAccesskeyFor() because accesskeys for
+    // menu are't registered by nsIEventStateManager.
     elt->GetAttribute(NS_LITERAL_STRING("accesskey"), accesskey);
     if (accesskey.IsEmpty())
       return NS_OK;
@@ -423,11 +428,11 @@ NS_IMETHODIMP nsXULMenuitemAccessible::GetKeyboardShortcut(nsAString& _retval)
           case nsIDOMKeyEvent::DOM_VK_META: propertyKey.AssignLiteral("VK_META"); break;
         }
         if (!propertyKey.IsEmpty())
-          nsAccessible::GetFullKeyName(propertyKey, accesskey, _retval);
+          nsAccessible::GetFullKeyName(propertyKey, accesskey, aAccessKey);
       }
     }
-    if (_retval.IsEmpty())
+    if (aAccessKey.IsEmpty())
-      _retval = accesskey;
+      aAccessKey = accesskey;
     return NS_OK;
   }
   return NS_ERROR_FAILURE;
@@ -612,7 +617,8 @@ nsXULMenupopupAccessible::GetState(PRUint32 *aState, PRUint32 *aExtraState)
 
   if (!isActive)
     *aState |= (nsIAccessibleStates::STATE_OFFSCREEN |
-                nsIAccessibleStates::STATE_INVISIBLE);
+                nsIAccessibleStates::STATE_INVISIBLE |
+                nsIAccessibleStates::STATE_COLLAPSED);
 
   return NS_OK;
 }

browser/base/content/browser-places.js

@@ -53,12 +53,48 @@ var PlacesCommandHook = {
     return document.getElementById("editBookmarkPanel");
   },
 
+  // list of command elements (by id) to disable when the panel is opened
+  _blockedCommands: ["cmd_close", "cmd_closeWindow"],
+
+  _blockCommands: function PCH__blockCommands() {
+    for each(var key in this._blockedCommands) {
+      var elt = document.getElementById(key);
+      if (elt.getAttribute("disabled") == "true")
+        elt.setAttribute("wasDisabled", "true");
+      else {
+        elt.setAttribute("wasDisabled", "false");
+        elt.setAttribute("disabled", "true");
+      }
+    }
+  },
+
+  _restoreCommandsState: function PCH__restoreCommandsState() {
+    for each(var key in this._blockedCommands) {
+      var elt = document.getElementById(key);
+      if (elt.getAttribute("wasDisabled") != "true")
+        elt.removeAttribute("disabled");
+      elt.removeAttribute("wasDisabled");
+    }
+  },
+
   // nsIDOMEventListener
   handleEvent: function PCH_handleEvent(aEvent) {
-    if (aEvent.originalTarget != this.panel)
+    switch (aEvent.type) {
-      return;
+      case "popuphiding":
-
+        if (aEvent.originalTarget == this.panel) {
           gEditItemOverlay.uninitPanel(true);
+          this._restoreCommandsState();
+        }
+        break;
+      case "keypress":
+        if (aEvent.keyCode == KeyEvent.DOM_VK_ESCAPE ||
+            aEvent.keyCode == KeyEvent.DOM_VK_RETURN) {
+          // focus the content area and hide the panel
+          window.content.focus();
+          this.panel.hidePopup();
+        }
+        break;
+    }
   },
 
   _overlayLoaded: false,
@@ -98,17 +134,27 @@ var PlacesCommandHook = {
 
   _doShowEditBookmarkPanel:
   function PCH__doShowEditBookmarkPanel(aItemId, aAnchorElement, aPosition) {
+    this.panel.addEventListener("keypress", this, true);
+    this._blockCommands(); // un-done in the popuphiding handler
     this.panel.openPopup(aAnchorElement, aPosition, -1, -1);
 
     gEditItemOverlay.initPanel(aItemId,
                                { hiddenRows: ["description", "location"] });
+    setTimeout(function() {
+                 var namePicker = document.getElementById("editBMPanel_namePicker");
+                 namePicker.focus();
+                 namePicker.editor.selectAll();
+              }, 0);
   },
 
   /**
-   * Adds a bookmark to the page loaded in the given browser
+   * Adds a bookmark to the page loaded in the given browser.
    *
    * @param aBrowser
-   *        a <browser> element
+   *        a <browser> element.
+   * @param [optional] aParent
+   *        The folder in which to create a new bookmark if the page loaded in
+   *        aBrowser isn't bookmarked yet, defaults to the places root.
    * @param [optional] aShowEditUI
    *        whether or not to show the edit-bookmark UI for the bookmark item
    * @param [optional] aAnchorElement
@@ -116,10 +162,9 @@ var PlacesCommandHook = {
    * @param [optional] aPosition
    *        required if aShowEditUI is set, see popup's openPopup.
    */  
-  bookmarkPage: function PCH_bookmarkPage(aBrowser, aShowEditUI,
+  bookmarkPage: function PCH_bookmarkPage(aBrowser, aParent, aShowEditUI,
                                           aAnchorElement, aPosition) {
     var uri = aBrowser.currentURI;
-
     var itemId = PlacesUtils.getMostRecentBookmarkForURI(uri);
     if (itemId == -1) {
       // Copied over from addBookmarkForBrowser:
@@ -138,8 +183,9 @@ var PlacesCommandHook = {
       }
       catch (e) { }
 
+      var parent = aParent != undefined ? aParent : PlacesUtils.placesRootId;
       var descAnno = { name: DESCRIPTION_ANNO, value: description };
-      var txn = PlacesUtils.ptm.createItem(uri, PlacesUtils.placesRootId, -1,
+      var txn = PlacesUtils.ptm.createItem(uri, parent, -1,
                                            title, null, [descAnno]);
       PlacesUtils.ptm.commitTransaction(txn);
       if (aShowEditUI)
@@ -153,33 +199,36 @@ var PlacesCommandHook = {
   /**
    * Adds a bookmark to the page loaded in the current tab. 
    */
-  bookmarkCurrentPage: function PCH_bookmarkCurrentPage(aShowEditUI) {
+  bookmarkCurrentPage: function PCH_bookmarkCurrentPage(aShowEditUI, aParent) {
     // dock the panel to the star icon if it is visible, otherwise dock
     // it to the content area
-    var starIcon = document.getElementById("star-icon");
+    var starIcon = document.getElementById("star-button");
     if (starIcon && isElementVisible(starIcon)) {
-      this.bookmarkPage(getBrowser().selectedBrowser, aShowEditUI, starIcon,
+      var dockTo = document.getElementById("go-button-bottom");
-                        "after_end");
+      this.bookmarkPage(getBrowser().selectedBrowser, aParent, aShowEditUI,
+                        dockTo, "after_start");
     }
     else {
-      this.bookmarkPage(getBrowser().selectedBrowser, aShowEditUI, getBrowser(),
+      this.bookmarkPage(getBrowser().selectedBrowser, aParent, aShowEditUI,
-                        "overlap");
+                        getBrowser(), "overlap");
     }
   },
 
   /**
    * Adds a bookmark to the page targeted by a link.
-   * @param   url
+   * @param aParent
-   *          The address of the link target
+   *        The folder in which to create a new bookmark if aURL isn't
-   * @param   title
+   *        bookmarked.
+   * @param aURL (string)
+   *        the address of the link target
+   * @param aTitle
    *        The link text
    */
-  bookmarkLink: function PCH_bookmarkLink(url, title) {
+  bookmarkLink: function PCH_bookmarkLink(aParent, aURL, aTitle) {
-    var linkURI = IO.newURI(url)
+    var linkURI = IO.newURI(aURL)
     var itemId = PlacesUtils.getMostRecentBookmarkForURI(linkURI);
     if (itemId == -1) {
-      var txn = PlacesUtils.ptm.createItem(linkURI, PlacesUtils.placesRootId, -1,
+      var txn = PlacesUtils.ptm.createItem(linkURI, aParent, -1, aTitle);
-                                           title);
       PlacesUtils.ptm.commitTransaction(txn);
       itemId = PlacesUtils.getMostRecentBookmarkForURI(linkURI);
     }
@@ -553,18 +602,6 @@ var BookmarksMenuDropHandler = {
  * Toolbar and Bookmarks Menu.
  */
 var PlacesMenuDNDController = {
-  
-  /**
-   * Attach a special context menu hiding listener that ensures that popups 
-   * are properly closed after a context menu is hidden. See bug 332845 for 
-   * why we have to do this.
-   */
-  init: function PMDC_init() {
-    var placesContext = document.getElementById("placesContext");
-    var self = this;
-    placesContext.addEventListener("popuphidden", function () { self._closePopups() }, false);
-  },
-
   _springLoadDelay: 350, // milliseconds
 
   /**
@@ -728,12 +765,12 @@ var PlacesStarButton = {
   _batching: false,
 
   updateState: function PSB_updateState() {
-    var starIcon = document.getElementById("star-icon");
+    var starIcon = document.getElementById("star-button");
     if (!starIcon)
       return;
 
     var uri = getBrowser().currentURI;
-    this._starred = uri && PlacesUtils.bookmarks.isBookmarked(uri);
+    this._starred = uri && (PlacesUtils.getMostRecentBookmarkForURI(uri) != -1);
     if (this._starred)
       starIcon.setAttribute("starred", "true");
     else

browser/base/content/browser-sets.inc

@@ -88,7 +88,7 @@
              observes="isImage"/>
     <!-- work-around bug 392512 -->
     <command id="Browser:AddBookmarkAs" 
-             oncommand="setTimeout(function() { PlacesCommandHook.bookmarkCurrentPage(true); }, 0);"/>
+             oncommand="PlacesCommandHook.bookmarkCurrentPage(true, PlacesUtils.bookmarksRootId);"/>
     <!-- The command is disabled for the hidden window. Otherwise its enabled
          state is handled by the BookmarkAllTabsHandler object. -->
     <command id="Browser:BookmarkAllTabs"

browser/base/content/browser.js

@@ -284,10 +284,9 @@ function BookmarkThisTab()
   if (tab.localName != "tab")
     tab = getBrowser().mCurrentTab;
 
-  setTimeout(function() { // workaround bug 392512
+  PlacesCommandHook.bookmarkPage(tab.linkedBrowser,
-    PlacesCommandHook.bookmarkPage(tab.linkedBrowser, true, getBrowser(),
+                                 PlacesUtils.bookmarksRootId,
-                                   "overlap")
+                                 true, getBrowser(), "overlap");
-  }, 0);
 }
 
 /**
@@ -663,13 +662,16 @@ const gXPInstallObserver = {
   {
     var brandBundle = document.getElementById("bundle_brand");
     var browserBundle = document.getElementById("bundle_browser");
-    var browser, webNav, wm;
     switch (aTopic) {
     case "xpinstall-install-blocked":
-      var shell = aSubject.QueryInterface(Components.interfaces.nsIDocShell);
+      var installInfo = aSubject.QueryInterface(Components.interfaces.nsIXPIInstallInfo);
-      browser = this._getBrowser(shell);
+      var win = installInfo.originatingWindow;
+      var shell = win.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
+                     .getInterface(Components.interfaces.nsIWebNavigation)
+                     .QueryInterface(Components.interfaces.nsIDocShell);
+      var browser = this._getBrowser(shell);
       if (browser) {
-        var host = aData;
+        var host = installInfo.originatingURI.host;
         var brandShortName = brandBundle.getString("brandShortName");
         var notificationName, messageString, buttons;
         if (!gPrefService.getBoolPref("xpinstall.enabled")) {
@@ -699,10 +701,15 @@ const gXPInstallObserver = {
                                                            [brandShortName, host]);
 
           buttons = [{
-            label: browserBundle.getString("xpinstallPromptWarningButton"),
+            label: browserBundle.getString("xpinstallPromptAllowButton"),
-            accessKey: browserBundle.getString("xpinstallPromptWarningButton.accesskey"),
+            accessKey: browserBundle.getString("xpinstallPromptAllowButton.accesskey"),
             popup: null,
-            callback: function() { return xpinstallEditPermissions(shell, host); }
+            callback: function() {
+              var mgr = Components.classes["@mozilla.org/xpinstall/install-manager;1"]
+                                  .createInstance(Components.interfaces.nsIXPInstallManager);
+              mgr.initManagerWithInstallInfo(installInfo);
+              return false;
+            }
           }];
         }
 
@@ -719,34 +726,6 @@ const gXPInstallObserver = {
   }
 };
 
-function xpinstallEditPermissions(aDocShell, aHost)
-{
-  var browser = gXPInstallObserver._getBrowser(aDocShell);
-  if (browser) {
-    var bundlePreferences = document.getElementById("bundle_preferences");
-    var params = { blockVisible   : false,
-                   sessionVisible : false,
-                   allowVisible   : true,
-                   prefilledHost  : aHost,
-                   permissionType : "install",
-                   windowTitle    : bundlePreferences.getString("addons_permissions_title"),
-                   introText      : bundlePreferences.getString("addonspermissionstext") };
-    var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"]
-                   .getService(Components.interfaces.nsIWindowMediator);
-    var existingWindow = wm.getMostRecentWindow("Browser:Permissions");
-    if (existingWindow) {
-      existingWindow.initWithParams(params);
-      existingWindow.focus();
-    }
-    else
-      window.openDialog("chrome://browser/content/preferences/permissions.xul",
-                        "_blank", "resizable,dialog=no,centerscreen", params);
-    return false;
-  }
-
-  return true;
-}
-
 function BrowserStartup()
 {
   gBrowser = document.getElementById("content");
@@ -1013,8 +992,6 @@ function delayedStartup()
   // add bookmark options to context menu for tabs
   addBookmarkMenuitems();
 
-  PlacesMenuDNDController.init();
-
   initBookmarksToolbar();
   PlacesUtils.bookmarks.addObserver(gBookmarksObserver, false);
   PlacesStarButton.init();
@@ -1226,8 +1203,9 @@ function BrowserShutdown()
 }
 
 #ifdef XP_MACOSX
-// nonBrowserWindowStartup() and nonBrowserWindowDelayedStartup() are used for
+// nonBrowserWindowStartup(), nonBrowserWindowDelayedStartup(), and
-// non-browser windows in macBrowserOverlay
+// nonBrowserWindowShutdown() are used for non-browser windows in
+// macBrowserOverlay
 function nonBrowserWindowStartup()
 {
   // Disable inappropriate commands / submenus
@@ -1276,6 +1254,12 @@ function nonBrowserWindowDelayedStartup()
   // Set up Sanitize Item
   gSanitizeListener = new SanitizeListener();
 }
+
+function nonBrowserWindowShutdown()
+{
+  if (gSanitizeListener)
+    gSanitizeListener.shutdown();
+}
 #endif
 
 function AutoHideTabbarPrefListener()

browser/base/content/browser.xul

@@ -224,6 +224,7 @@
                      completeselectedindex="true"
                      tabscrolling="true"
                      showcommentcolumn="true"
+                     showimagecolumn="true" 
                      enablehistory="true"
                      maxrows="10"
                      newlines="stripsurroundingwhitespace"
@@ -261,7 +262,6 @@
                        level="safe"
                        onclick="goDoCommand('safebrowsing-show-warning')" />
 #endif
-                <image id="star-icon" onclick="if (event.button == 0) PlacesStarButton.onClick(event);"/>
               </hbox>
             </textbox>
             <stack id="go-button-stack">
@@ -284,8 +284,9 @@
                        chromedir="&locale.dir;" />
               </vbox>
 							
+              <hbox>
+                <toolbarbutton id="star-button" onclick="if (event.button == 0) PlacesStarButton.onClick(event);"/>
                 <toolbarbutton id="go-button"
-                           flex="1"
                                chromedir="&locale.dir;"
                                label="&goEndCap.label;"
                                onclick="handleURLBarCommand(event);"
@@ -293,6 +294,7 @@
                                ondragdrop="nsDragAndDrop.drop(event, goButtonObserver);"
                                ondragexit="nsDragAndDrop.dragExit(event, goButtonObserver);"
                                tooltiptext="&goEndCap.tooltip;"/>
+              </hbox>
           </stack>
         </hbox>
       </toolbaritem>

browser/base/content/macBrowserOverlay.xul

@@ -62,6 +62,7 @@
 
 <script type="application/x-javascript">
   addEventListener("load", nonBrowserWindowStartup, false);
+  addEventListener("unload", nonBrowserWindowShutdown, false);
 </script>
 
 # All sets except for popupsets (commands, keys, stringbundles and broadcasters) *must* go into the 

browser/base/content/nsContextMenu.js

@@ -627,8 +627,10 @@ nsContextMenu.prototype = {
 
   // Open frame in a new tab.
   openFrameInTab: function() {
-    openNewTabWith(this.target.ownerDocument.location.href,
+    var doc = this.target.ownerDocument;
-                   null, null, null, false);
+    var frameURL = doc.documentURIObject.spec;
+
+    openNewTabWith(frameURL, null, null, null, false, makeURI(doc.referrer));
   },
 
   // Reload clicked-in frame.
@@ -638,19 +640,20 @@ nsContextMenu.prototype = {
 
   // Open clicked-in frame in its own window.
   openFrame: function() {
-    openNewWindowWith(this.target.ownerDocument.location.href,
+    var doc = this.target.ownerDocument;
-                      null, null, false);
+    var frameURL = doc.documentURIObject.spec;
+
+    openNewWindowWith(frameURL, null, null, false, makeURI(doc.referrer));
   },
 
   // Open clicked-in frame in the same window.
   showOnlyThisFrame: function() {
-    var frameURL = this.target.ownerDocument.location.href;
+    var doc = this.target.ownerDocument;
+    var frameURL = doc.documentURIObject.spec;
 
-    try {
     urlSecurityCheck(frameURL, this.browser.contentPrincipal,
                      Ci.nsIScriptSecurityManager.DISALLOW_SCRIPT);
-      this.browser.loadURI(frameURL);
+    this.browser.loadURI(frameURL, makeURI(doc.referrer));
-    } catch(e) {}
   },
 
   // View Partial Source
@@ -1120,17 +1123,13 @@ nsContextMenu.prototype = {
   },
 
   bookmarkThisPage: function CM_bookmarkThisPage() {
-    // workaround bug 392512
+    PlacesCommandHook.bookmarkPage(this.browser, PlacesUtils.bookmarksRootId,
-    setTimeout(function(aSelf) {
+                                   true, this.browser, "overlap");
-      PlacesCommandHook.bookmarkPage(aSelf.browser, true, aSelf.browser,
-                                     "overlap"); }, 0, this);
   },
 
   bookmarkLink: function CM_bookmarkLink() {
-    // workaround bug 392512
+    PlacesCommandHook.bookmarkLink(PlacesUtils.bookmarksRootId, this.linkURL,
-    setTimeout(function(aSelf) {
+                                   this.linkText());
-      PlacesCommandHook.bookmarkLink(aSelf.linkURL, aSelf.linkText());
-    }, 0, this);
   },
 
   addBookmarkForFrame: function CM_addBookmarkForFrame() {
@@ -1143,16 +1142,13 @@ nsContextMenu.prototype = {
       var description = PlacesUtils.getDescriptionFromDocument(doc);
 
       var descAnno = { name: DESCRIPTION_ANNO, value: description };
-      var txn = PlacesUtils.ptm.createItem(uri, PlacesUtils.placesRootId, -1,
+      var txn = PlacesUtils.ptm.createItem(uri, PlacesUtils.bookmarksRootId, -1,
                                            title, null, [descAnno]);
       PlacesUtils.ptm.commitTransaction(txn);
       itemId = PlacesUtils.getMostRecentBookmarkForURI(uri);
     }
 
-    // workaround bug 392512
+    PlacesCommandHook.showEditBookmarkPopup(itemId, this.browser, "overlap");
-    setTimeout(function(aSelf) {
-      PlacesCommandHook.showEditBookmarkPopup(itemId, aSelf.browser, "overlap");
-    }, 0, this);
   },
 
   savePageAs: function CM_savePageAs() {

browser/base/content/tabbrowser.xml

@@ -2500,9 +2500,11 @@
       <xul:toolbarbutton class="scrollbutton-up" collapsed="true"
                          xbl:inherits="orient"
                          anonid="scrollbutton-up"
+                         onclick="_distanceScroll(event);"
                          onmousedown="_startScroll(-1);"
+                         onmouseover="_continueScroll(-1);"
                          onmouseup="_stopScroll();"
-                         onmouseout="_stopScroll();"
+                         onmouseout="_pauseScroll();"
                          chromedir="&locale.dir;"/>
       <xul:scrollbox xbl:inherits="orient,align,pack,dir" flex="1" anonid="scrollbox">
         <children/>
@@ -2515,9 +2517,11 @@
         <xul:toolbarbutton class="scrollbutton-down" collapsed="true"
                            xbl:inherits="orient"
                            anonid="scrollbutton-down"
+                           onclick="_distanceScroll(event);"
                            onmousedown="_startScroll(1);"
+                           onmouseover="_continueScroll(1);"
                            onmouseup="_stopScroll();"
-                           onmouseout="_stopScroll();"
+                           onmouseout="_pauseScroll();"
                            chromedir="&locale.dir;"/>
       </xul:stack>
     </content>
@@ -2597,7 +2601,8 @@
                          position="after_end"/>
         </xul:toolbarbutton>
       </xul:stack>
-      <xul:hbox class="tabs-closebutton-box" align="center" pack="end" anonid="tabstrip-closebutton">
+      <xul:hbox anonid="tabstrip-closebutton" class="tabs-closebutton-box"
+                align="center" pack="end" chromedir="&locale.dir;">
         <xul:toolbarbutton class="close-button tabs-closebutton"/>
       </xul:hbox>
     </content>

browser/base/content/urlbarBindings.xml

@@ -221,14 +221,20 @@
 
           this._protocol.setAttribute("value", this._uri.scheme + "://");
           this._protocolHidden = this._hideProtocols.indexOf(this._uri.scheme) > -1;
-          this._subDomain.removeAttribute("value");
-          this._port.removeAttribute("value");
 
           var host = this._uri.host;
           if (host) {
-            //XXX Bug 386727: Disabled for now due to perf/leak regressions
+            var subdomain;
-            //XXX workaround for bug 364129
+            var port = (this._uri.port > -1) ? ":" + this._uri.port : "";
-            if (0 && !/^[.0-9]+$/.test(host)) {
+            if (this._uri.hostPort[0] == "[") {
+              // IPv6 address
+              subdomain = "[";
+              port = "]" + port;
+            }
+            else if (0 && !/^[.0-9]+$/.test(host)) {
+              //XXX subdomain detection disabled (bug 386727)
+              //XXX subdomain detection disabled for IP addresses (bug 364129)
+
               // getEffectiveTLDLength might convert our host and return a misleading length.
               // To avoid this, pass the ASCII host, count the dots of its effective TLD
               // and use that number to operate on our actual host.
@@ -241,16 +247,19 @@
                                         .split(".").length - 1;
               if (cSubdomain > 0) {
                 host = domainSegments;
-                var subdomain = host.splice(0, cSubdomain);
+                subdomain = host.splice(0, cSubdomain).join(".") + ".";
-                this._subDomain.setAttribute("value", subdomain.join(".") + ".");
                 host = host.join(".");
               }
-            }
-            this._domain.setAttribute("value", host);
-            if (this._uri.port > -1)
-              this._port.setAttribute("value", ":" + this._uri.port);
             } else {
+              subdomain = "";
+            }
+            this._subDomain.setAttribute("value", subdomain);
+            this._domain.setAttribute("value", host);
+            this._port.setAttribute("value", port);
+          } else {
+            this._subDomain.removeAttribute("value");
             this._domain.removeAttribute("value");
+            this._port.removeAttribute("value");
           }
 
           var path = this._uri.path;
@@ -429,7 +438,7 @@
           if (aEvent.type == "mousedown" &&
               aEvent.button == 0 && aEvent.detail == 2 &&
               this.doubleClickSelectsAll) {
-            this.inputField.select();
+            this.editor.selectAll();
             aEvent.preventDefault();
           }
         ]]></body>

browser/base/content/utilityOverlay.js

@@ -525,9 +525,12 @@ function getBrowserFromContentWindow(aContentWindow)
  *        If true, then we allow the URL text to be sent to third party services
  *        (e.g., Google's I Feel Lucky) for interpretation. This parameter may
  *        be undefined in which case it is treated as false.
+ * @param [optional] aReferrer
+ *        If aDocument is null, then this will be used as the referrer.
+ *        There will be no security check.
  */ 
 function openNewTabWith(aURL, aDocument, aPostData, aEvent,
-                        aAllowThirdPartyFixup)
+                        aAllowThirdPartyFixup, aReferrer)
 {
   if (aDocument)
     urlSecurityCheck(aURL, aDocument.nodePrincipal);
@@ -555,13 +558,14 @@ function openNewTabWith(aURL, aDocument, aPostData, aEvent,
     originCharset = window.content.document.characterSet;
 
   // open link in new tab
-  var referrerURI = aDocument ? aDocument.documentURIObject : null;
+  var referrerURI = aDocument ? aDocument.documentURIObject : aReferrer;
   var browser = top.document.getElementById("content");
   browser.loadOneTab(aURL, referrerURI, originCharset, aPostData,
                      loadInBackground, aAllowThirdPartyFixup || false);
 }
 
-function openNewWindowWith(aURL, aDocument, aPostData, aAllowThirdPartyFixup)
+function openNewWindowWith(aURL, aDocument, aPostData, aAllowThirdPartyFixup,
+                           aReferrer)
 {
   if (aDocument)
     urlSecurityCheck(aURL, aDocument.nodePrincipal);
@@ -575,7 +579,7 @@ function openNewWindowWith(aURL, aDocument, aPostData, aAllowThirdPartyFixup)
   if (wintype == "navigator:browser")
     charsetArg = "charset=" + window.content.document.characterSet;
 
-  var referrerURI = aDocument ? aDocument.documentURIObject : null;
+  var referrerURI = aDocument ? aDocument.documentURIObject : aReferrer;
   window.openDialog(getBrowserURL(), "_blank", "chrome,all,dialog=no",
                     aURL, charsetArg, referrerURI, aPostData,
                     aAllowThirdPartyFixup);

browser/components/migration/src/nsBrowserProfileMigratorUtils.cpp

@@ -59,6 +59,8 @@
 
 #define MIGRATION_BUNDLE "chrome://browser/locale/migration/migration.properties"
 
+#define BOOKMARKS_FILE_NAME NS_LITERAL_STRING("bookmarks.html")
+
 void SetUnicharPref(const char* aPref, const nsAString& aValue,
                     nsIPrefBranch* aPrefs)
 {
@@ -217,11 +219,25 @@ AnnotatePersonalToolbarFolder(nsIFile* aSourceBookmarksFile,
 
 nsresult
 ImportBookmarksHTML(nsIFile* aBookmarksFile, 
+                    PRBool aImportIntoRoot,
+                    PRBool aOverwriteDefaults,
                     const PRUnichar* aImportSourceNameKey)
 {
   nsresult rv;
 
-  // Look for the localized name of the bookmarks toolbar
+  nsCOMPtr<nsILocalFile> localFile(do_QueryInterface(aBookmarksFile));
+  NS_ENSURE_TRUE(localFile, NS_ERROR_FAILURE);
+  nsCOMPtr<nsIPlacesImportExportService> importer = do_GetService(NS_PLACESIMPORTEXPORTSERVICE_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Import file directly into the bookmarks root folder.
+  if (aImportIntoRoot) {
+    rv = importer->ImportHTMLFromFile(localFile, aOverwriteDefaults);
+    NS_ENSURE_SUCCESS(rv, rv);
+    return NS_OK;
+  }
+
+  // Get the source application name.
   nsCOMPtr<nsIStringBundleService> bundleService =
     do_GetService(NS_STRINGBUNDLE_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -239,7 +255,7 @@ ImportBookmarksHTML(nsIFile* aBookmarksFile,
                                sourceNameStrings, 1, 
                                getter_Copies(importedBookmarksTitle));
 
-  // Get the bookmarks service
+  // Get the bookmarks service.
   nsCOMPtr<nsINavBookmarksService> bms =
     do_GetService(NS_NAVBOOKMARKSSERVICE_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -254,9 +270,17 @@ ImportBookmarksHTML(nsIFile* aBookmarksFile,
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Import the bookmarks into the folder.
-  nsCOMPtr<nsILocalFile> localFile(do_QueryInterface(aBookmarksFile));
-  NS_ENSURE_TRUE(localFile, NS_ERROR_FAILURE);
-  nsCOMPtr<nsIPlacesImportExportService> importer = do_GetService(NS_PLACESIMPORTEXPORTSERVICE_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
   return importer->ImportHTMLFromFileToFolder(localFile, folder, PR_FALSE);
 }
+
+nsresult
+InitializeBookmarks(nsIFile* aTargetProfile)
+{
+  nsCOMPtr<nsIFile> bookmarksFile;
+  aTargetProfile->Clone(getter_AddRefs(bookmarksFile));
+  bookmarksFile->Append(BOOKMARKS_FILE_NAME);
+  
+  nsresult rv = ImportBookmarksHTML(bookmarksFile, PR_TRUE, PR_TRUE, EmptyString().get());
+  NS_ENSURE_SUCCESS(rv, rv);
+  return NS_OK;
+}

browser/components/migration/src/nsBrowserProfileMigratorUtils.h

@@ -101,11 +101,18 @@ nsresult AnnotatePersonalToolbarFolder(nsIFile* aSourceBookmarksFile,
                                        nsIFile* aTargetBookmarksFile,
                                        const char* aToolbarFolderName);
 
-// In-place import from aBookmarksFile into a folder in the user's bookmarks
+// In-place import from aBookmarksFile into a folder in the user's bookmarks.
-// with the name "From (STR:aImportSourceNameKey)" (aImportSourceNameKey
+// If the importIntoRoot parameter has a value of true, the bookmarks will be
-// is a key into migration.properties with the pretty name of the application.
+// imported into the bookmarks root folder. Otherwise, they'll be imported into
+// a new folder with the name "From (STR:aImportSourceNameKey)".
+// aImportSourceNameKey is a key into migration.properties with the pretty name
+// of the application.
 nsresult ImportBookmarksHTML(nsIFile* aBookmarksFile, 
+                             PRBool aImportIntoRoot,
+                             PRBool aOverwriteDefaults,
                              const PRUnichar* aImportSourceNameKey);
 
+nsresult InitializeBookmarks(nsIFile* aTargetProfile);
+
 #endif
 

browser/components/migration/src/nsDogbertProfileMigrator.cpp

@@ -622,8 +622,11 @@ nsresult
 nsDogbertProfileMigrator::CopyBookmarks(PRBool aReplace)
 {
   // If we're blowing away existing content, just copy the file, don't do fancy importing.
-  if (aReplace)
+  if (aReplace) {
+    nsresult rv = InitializeBookmarks(mTargetProfile);
+    NS_ENSURE_SUCCESS(rv, rv);
     return MigrateDogbertBookmarks();
+  }
 
   return ImportNetscapeBookmarks(BOOKMARKS_FILE_NAME_IN_4x, 
                                  NS_LITERAL_STRING("sourceNameDogbert").get());

browser/components/migration/src/nsIEProfileMigrator.cpp

@@ -1199,6 +1199,12 @@ nsIEProfileMigrator::CopyFavorites(PRBool aReplace) {
     bms->CreateFolder(root, importedIEFavsTitle, -1, &folder);
   }
   else {
+    // Initialize the default bookmarks
+    nsCOMPtr<nsIFile> profile;
+    GetProfilePath(nsnull, profile);
+    rv = InitializeBookmarks(profile);
+    NS_ENSURE_SUCCESS(rv, rv);
+
     // Locate the Links toolbar folder, we want to replace the Personal Toolbar content with 
     // Favorites in this folder. 
     nsCOMPtr<nsIWindowsRegKey> regKey = 
@@ -1419,9 +1425,6 @@ nsIEProfileMigrator::ParseFavoritesFolder(nsIFile* aDirectory,
       PRInt64 folder;
       if (bookmarkName.Equals(aPersonalToolbarFolderName)) {
         aBookmarksService->GetToolbarFolder(&folder);
-        // If we're here, it means the user's doing a _replace_ import which means
-        // clear out the content of this folder, and replace it with the new content
-        aBookmarksService->RemoveFolderChildren(folder);
       }
       else {
         rv = aBookmarksService->CreateFolder(aParentFolder,

browser/components/migration/src/nsMacIEProfileMigrator.cpp

@@ -51,7 +51,7 @@
 
 #define MACIE_BOOKMARKS_FILE_NAME NS_LITERAL_STRING("Favorites.html")
 #define MACIE_PREFERENCES_FOLDER_NAME NS_LITERAL_STRING("Explorer")
-#define FIREFOX_BOOKMARKS_FILE_NAME NS_LITERAL_STRING("bookmarks.html")
+#define TEMP_BOOKMARKS_FILE_NAME NS_LITERAL_STRING("bookmarks_tmp.html")
 
 #define MIGRATION_BUNDLE "chrome://browser/locale/migration/migration.properties"
 
@@ -172,6 +172,7 @@ nsMacIEProfileMigrator::GetSourceHomePageURL(nsACString& aResult)
 nsresult
 nsMacIEProfileMigrator::CopyBookmarks(PRBool aReplace)
 {
+  nsresult rv;
   nsCOMPtr<nsIFile> sourceFile;
   mSourceProfile->Clone(getter_AddRefs(sourceFile));
 
@@ -181,14 +182,22 @@ nsMacIEProfileMigrator::CopyBookmarks(PRBool aReplace)
   if (!exists)
     return NS_OK;
 
-  nsCOMPtr<nsIFile> targetFile;
+  // it's an import
-  mTargetProfile->Clone(getter_AddRefs(targetFile));
+  if (!aReplace)
-  targetFile->Append(FIREFOX_BOOKMARKS_FILE_NAME);
+    return ImportBookmarksHTML(sourceFile,
+                               PR_FALSE,
+                               PR_FALSE,
+                               NS_LITERAL_STRING("sourceNameIE").get());
+
+  // Initialize the default bookmarks
+  rv = InitializeBookmarks(mTargetProfile);
+  NS_ENSURE_SUCCESS(rv, rv);
 
   // If we're blowing away existing content, annotate the Personal Toolbar and
-  // then just copy the file. 
+  // then import the file. 
-  if (aReplace) {
+  nsCOMPtr<nsIFile> tempFile;
-    nsresult rv;
+  mTargetProfile->Clone(getter_AddRefs(tempFile));
+  tempFile->Append(TEMP_BOOKMARKS_FILE_NAME);
 
   // Look for the localized name of the IE Favorites Bar
   nsCOMPtr<nsIStringBundleService> bundleService =
@@ -205,22 +214,20 @@ nsMacIEProfileMigrator::CopyBookmarks(PRBool aReplace)
   nsCAutoString ctoolbarFolderNameMacIE;
   CopyUTF16toUTF8(toolbarFolderNameMacIE, ctoolbarFolderNameMacIE);
 
-    // If we can't find it for some reason, just copy the file. 
-    if (NS_FAILED(rv)) {
-      targetFile->Exists(&exists);
-      if (exists)
-        targetFile->Remove(PR_FALSE);
-
-      return sourceFile->CopyTo(mTargetProfile, FIREFOX_BOOKMARKS_FILE_NAME);
-    }
-
   // Now read the 4.x bookmarks file, correcting the Personal Toolbar Folder 
-    // line and writing to the new location.
+  // line and writing to the temporary file.
-    return AnnotatePersonalToolbarFolder(sourceFile,
+  rv = AnnotatePersonalToolbarFolder(sourceFile,
-                                         targetFile,
+                                     tempFile,
                                      ctoolbarFolderNameMacIE.get());
-  }
+  NS_ENSURE_SUCCESS(rv, rv);
 
-  return ImportBookmarksHTML(sourceFile,
+  // import the temp file
-                             NS_LITERAL_STRING("sourceNameIE").get());
+  rv = ImportBookmarksHTML(tempFile,
+                           PR_TRUE,
+                           PR_FALSE,
+                           EmptyString().get());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // remove the temp file
+  return tempFile->Remove(PR_FALSE);
 }

browser/components/migration/src/nsNetscapeProfileMigratorBase.cpp

@@ -318,7 +318,7 @@ nsNetscapeProfileMigratorBase::ImportNetscapeBookmarks(const nsAString& aBookmar
   mSourceProfile->Clone(getter_AddRefs(bookmarksFile));
   bookmarksFile->Append(aBookmarksFileName);
   
-  return ImportBookmarksHTML(bookmarksFile, aImportSourceNameKey);
+  return ImportBookmarksHTML(bookmarksFile, PR_FALSE, PR_FALSE, aImportSourceNameKey);
 }
 
 nsresult

browser/components/migration/src/nsOperaProfileMigrator.cpp

@@ -1052,7 +1052,7 @@ nsOperaProfileMigrator::CopyBookmarks(PRBool aReplace)
   PRInt64 root;
   rv = bms->GetBookmarksRoot(&root);
   NS_ENSURE_SUCCESS(rv, rv);
-  PRInt64 parentFolder;
+  PRInt64 parentFolder = root;
 
   nsCOMPtr<nsIStringBundleService> bundleService(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
   nsCOMPtr<nsIStringBundle> bundle;
@@ -1071,8 +1071,12 @@ nsOperaProfileMigrator::CopyBookmarks(PRBool aReplace)
     bms->CreateFolder(parentFolder, importedOperaHotlistTitle,
                       nsINavBookmarksService::DEFAULT_INDEX, &parentFolder);
   }
-  else
+  else {
-    parentFolder = root;
+    nsCOMPtr<nsIFile> profile;
+    GetProfilePath(nsnull, profile);
+    rv = InitializeBookmarks(profile);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
 
 #if defined(XP_WIN) || (defined(XP_UNIX) && !defined(XP_MACOSX))
   printf("*** about to copy smart keywords\n");

browser/components/migration/src/nsPhoenixProfileMigrator.cpp

@@ -423,6 +423,7 @@ nsPhoenixProfileMigrator::CopyPasswords(PRBool aReplace)
 nsresult
 nsPhoenixProfileMigrator::CopyBookmarks(PRBool aReplace)
 {
+  // This overwrites the defaults. This might be ok in this instance.
   return aReplace ? CopyFile(FILE_NAME_BOOKMARKS, FILE_NAME_BOOKMARKS) : NS_OK;
 }
 

browser/components/migration/src/nsSafariProfileMigrator.cpp

@@ -899,7 +899,7 @@ nsresult
 nsSafariProfileMigrator::CopyBookmarks(PRBool aReplace)
 {
   // If "aReplace" is true, merge into the root level of bookmarks. Otherwise, create
-  // a folder called "Imported IE Favorites" and place all the Bookmarks there.
+  // a folder called "Imported Safari Favorites" and place all the Bookmarks there.
   nsresult rv;
 
   nsCOMPtr<nsINavBookmarksService> bms(do_GetService(NS_NAVBOOKMARKSSERVICE_CONTRACTID, &rv));
@@ -930,7 +930,11 @@ nsSafariProfileMigrator::CopyBookmarks(PRBool aReplace)
                       &folder);
   }
   else {
-    // In non-replace mode we are merging at the top level.
+    nsCOMPtr<nsIFile> profile;
+    GetProfilePath(nsnull, profile);
+    rv = InitializeBookmarks(profile);
+    NS_ENSURE_SUCCESS(rv, rv);
+    // In replace mode we are merging at the top level.
     folder = root;
   }
 

browser/components/migration/src/nsSeamonkeyProfileMigrator.cpp

@@ -723,8 +723,11 @@ nsSeamonkeyProfileMigrator::CopyPasswords(PRBool aReplace)
 nsresult
 nsSeamonkeyProfileMigrator::CopyBookmarks(PRBool aReplace)
 {
-  if (aReplace)
+  if (aReplace) {
+    nsresult rv = InitializeBookmarks(mTargetProfile);
+    NS_ENSURE_SUCCESS(rv, rv);
     return CopyFile(FILE_NAME_BOOKMARKS, FILE_NAME_BOOKMARKS);
+  }
   return ImportNetscapeBookmarks(FILE_NAME_BOOKMARKS, 
                                  NS_LITERAL_STRING("sourceNameSeamonkey").get());
 }

browser/components/nsBrowserContentHandler.js

@@ -822,6 +822,13 @@ var Module = {
   },
     
   registerSelf: function mod_regself(compMgr, fileSpec, location, type) {
+    // Don't register these if Firefox is launching a XULRunner application
+    const FIREFOX_UID = "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}";
+    var appInfo = Components.classes["@mozilla.org/xre/app-info;1"]
+                            .getService(Components.interfaces.nsIXULAppInfo);
+    if (appInfo.ID != FIREFOX_UID)
+      return;
+
     var compReg =
       compMgr.QueryInterface( Components.interfaces.nsIComponentRegistrar );
 

browser/components/places/content/controller.js

@@ -445,6 +445,7 @@ PlacesController.prototype = {
    * rules:
    *    "link"              node is a URI
    *    "bookmark"          node is a bookamrk
+   *    "livemarkChild"     node is a child of a livemark
    *    "folder"            node is a folder
    *    "query"             node is a query
    *    "dynamiccontainer"  node is a dynamic container
@@ -506,6 +507,9 @@ PlacesController.prototype = {
             var mss = PlacesUtils.microsummaries;
             if (mss.hasMicrosummary(node.itemId))
               nodeData["microsummary"] = true;
+            else if (node.parent &&
+                     PlacesUtils.nodeIsLivemarkContainer(node.parent))
+              nodeData["livemarkChild"] = true;
           }
           break;
         case Ci.nsINavHistoryResultNode.RESULT_TYPE_DAY:

browser/components/places/content/editBookmarkOverlay.js

@@ -348,7 +348,7 @@ var gEditItemOverlay = {
       // hide the tag selector if it was previously visible
       var tagsSelector = this._element("tagsSelector");
       if (!tagsSelector.collapsed)
-        tagsSelector.collapsed = true;
+        this._toggleTagsSelector();
     }
 
     if (this._observersAdded) {
@@ -547,7 +547,7 @@ var gEditItemOverlay = {
     // Update folder-tree selection
     if (isElementVisible(this._folderTree)) {
       var selectedNode = this._folderTree.selectedNode;
-      if (selectedNode.itemId != container)
+      if (!selectedNode || selectedNode.itemId != container)
         this._folderTree.selectFolders([container]);
     }
   },
@@ -558,13 +558,7 @@ var gEditItemOverlay = {
       return;
 
     var folderId = selectedNode.itemId;
-    // Don't set the selected item if the static item for the folder is
+    if (this._getFolderIdFromMenuList() == folderId)
-    // already selected
-    var oldSelectedItem = this._folderMenuList.selectedItem;
-    if ((oldSelectedItem.id == "editBMPanel_toolbarFolderItem" &&
-         folderId == PlacesUtils.toolbarFolderId) ||
-        (oldSelectedItem.id == "editBMPanel_bmRootItem" &&
-         folderId == PlacesUtils.bookmarksRootId))
       return;
 
     var folderItem = this._getFolderMenuItem(folderId, false);
@@ -605,9 +599,9 @@ var gEditItemOverlay = {
     var tagsSelector = this._element("tagsSelector");
     var expander = this._element("tagsSelectorExpander");
     if (!isElementVisible(tagsSelector)) {
-      expander.className = "expander-down";
+      expander.className = "expander-up";
       expander.setAttribute("tooltiptext",
-                            expander.getAttribute("tooltiptextdown"));
+                            expander.getAttribute("tooltiptextup"));
 
       this._rebuildTagsSelectorList();
 

browser/components/places/content/editBookmarkOverlay.xul

@@ -74,12 +74,14 @@
             </menupopup>
           </menulist>
         </row>
+
         <row align="center" id="editBMPanel_locationRow">
           <label value="&editBookmarkOverlay.location.label;"
                  contorl="editBMPanel_locationField"/>
           <textbox id="editBMPanel_locationField"
                    onblur="gEditItemOverlay.onLocationFieldBlur();"/>
         </row>
+
         <row align="center" id="editBMPanel_folderRow">
           <label value="&editBookmarkOverlay.folder.label;"
                  control="editBMPanel_folderMenuList"/>
@@ -107,6 +109,7 @@
                   tooltiptextup="&editBookmarkOverlay.expanderUp.tooltip;"
                   oncommand="gEditItemOverlay.toggleFolderTreeVisibility();"/>
         </row>
+
         <tree id="editBMPanel_folderTree"
               class="placesTree"
               type="places"
@@ -121,6 +124,7 @@
           </treecols>
           <treechildren flex="1"/>
         </tree>
+
         <row align="center" id="editBMPanel_tagsRow">
           <label value="&editBookmarkOverlay.tags.label;"
                  control="tagsField"/>
@@ -134,10 +138,7 @@
                   oncommand="gEditItemOverlay.toggleTagsSelector();"/>
         </row>
 
-        <!-- XXX: Temporary workaround -->
-        </rows></grid>
         <listbox id="editBMPanel_tagsSelector" height="150" collapsed="true"/>
-        <grid flex="1"><columns><column/><column flex="1"/></columns><rows>
 
         <row id="editBMPanel_descriptionRow" align="center">
           <label value="&editBookmarkOverlay.description.label;"

browser/components/places/content/places.js

@@ -1036,7 +1036,10 @@ var ViewMenu = {
       menuitem.setAttribute("column", column.id);
       var label = column.getAttribute("label");
       if (propertyPrefix) {
-        var menuitemPrefix = propertyPrefix + column.id;
+        var menuitemPrefix = propertyPrefix;
+        // for string properties, use "name" as the id, instead of "title"
+        // see bug #386287 for details
+        menuitemPrefix += (column.id == "title" ? "name" : column.id);
         label = PlacesUtils.getString(menuitemPrefix + ".label");
         var accesskey = PlacesUtils.getString(menuitemPrefix + ".accesskey");
         menuitem.setAttribute("accesskey", accesskey);
@@ -1054,7 +1057,7 @@ var ViewMenu = {
       else if (type == "checkbox") {
         menuitem.setAttribute("type", "checkbox");
         // Cannot uncheck the primary column.
-        if (column.primary)
+        if (column.getAttribute("primary") == "true")
           menuitem.setAttribute("disabled", "true");
         // Items for visible columns are checked. 
         if (!column.hidden)

browser/components/places/content/places.xul

@@ -378,7 +378,7 @@
                 onclick="PlacesOrganizer.onTreeClick(event);"
                 onselect="PlacesOrganizer.updateStatusBarForView(this);">
             <treecols id="placeContentColumns">
-              <treecol label="&col.title.label;" id="title" flex="5" primary="true" 
+              <treecol label="&col.name.label;" id="title" flex="5" primary="true" 
                        persist="width hidden ordinal sortActive sortDirection"/>
               <splitter class="tree-splitter"/>
               <treecol label="&col.tags.label;" id="tags" flex="2"

browser/components/places/content/placesOverlay.xul

@@ -148,6 +148,7 @@
               command="placesCmd_new:separator"
               label="&cmd.new_separator.label;"
               accesskey="&cmd.new_separator.accesskey;"
+              closemenu="single"
               selection="mutable"/>
     <menuseparator id="placesContext_newSeparator"/>
     <menuitem id="placesContext_cut"
@@ -155,7 +156,7 @@
               label="&cutCmd.label;"
               accesskey="&cutCmd.accesskey;" 
               selection="separator|link|folder|mixed"
-               forcehideselection="livemark/bookmarkFeedURI"/>
+              forcehideselection="livemarkChild"/>
     <menuitem id="placesContext_copy"
               command="cmd_copy"
               label="&copyCmd.label;"
@@ -171,23 +172,27 @@
               command="cmd_delete"
               label="&deleteCmd.label;"
               accesskey="&deleteCmd.accesskey;"
+              closemenu="single"
               selection="host|separator|link|folder|day"
-              forcehideselection="livemark/bookmarkFeedURI"/>
+              forcehideselection="livemarkChild"/>
     <menuseparator id="placesContext_deleteSeparator"/>
     <menuitem id="placesContext_reload"
               command="placesCmd_reload"
               label="&cmd.reloadLivebookmark.label;"
               accesskey="&cmd.reloadLivebookmark.accesskey;"
+              closemenu="single"
               selection="livemark/feedURI|allLivemarks"/>
     <menuitem id="placesContext_reloadMicrosummary"
               command="placesCmd_reloadMicrosummary"
               label="&cmd.reloadMicrosummary.label;"
               accesskey="&cmd.reloadMicrosummary.accesskey;"
+              closemenu="single"
               selection="microsummary"/>
     <menuitem id="placesContext_sortBy:name"
               command="placesCmd_sortBy:name"
               label="&cmd.sortby_name.label;"
               accesskey="&cmd.context_sortby_name.accesskey;"
+              closemenu="single"
               selection="mutable"/>
     <menuseparator id="placesContext_sortSeparator"/>
     <menuitem id="placesContext_show:info"
@@ -195,7 +200,7 @@
               label="&cmd.properties.label;" 
               accesskey="&cmd.properties.accesskey;"
               selection="bookmark|folder"
-              forcehideselection="livemark/bookmarkFeedURI"/>
+              forcehideselection="livemarkChild"/>
   </popup>
 
 </overlay>

browser/components/places/content/utils.js

@@ -390,10 +390,10 @@ var PlacesUtils = {
   },
 
  /**
-  * Determines whether a ResultNode is a remote container registered by the
+  * Determines whether a result node is a remote container registered by the
   * livemark service.
   * @param aNode
-  *        A NavHistory Result Node
+  *        A result Node
   * @returns true if the node is a livemark container item
   */
   nodeIsLivemarkContainer: function PU_nodeIsLivemarkContainer(aNode) {
@@ -402,19 +402,13 @@ var PlacesUtils = {
   },
 
  /**
-  * Determines whether a ResultNode is a live-bookmark item
+  * Determines whether a result node is a live-bookmark item
   * @param aNode
-  *        A NavHistory Result Node
+  *        A result node
   * @returns true if the node is a livemark container item
   */
   nodeIsLivemarkItem: function PU_nodeIsLivemarkItem(aNode) {
-    if (this.nodeIsBookmark(aNode)) {
+    return aNode.parent && this.nodeIsLivemarkContainer(aNode.parent);
-      if (this.annotations
-              .itemHasAnnotation(aNode.itemId, "livemark/bookmarkFeedURI"))
-        return true;
-    }
-
-    return false;
   },
 
   /**
@@ -1501,7 +1495,7 @@ var PlacesUtils = {
 
   /**
    * Get the most recently added/modified bookmark for a URL, excluding items
-   * under tag containers. -1 is returned if no item is found.
+   * under tag or livemark containers. -1 is returned if no item is found.
    */
   getMostRecentBookmarkForURI:
   function PU_getMostRecentBookmarkForURI(aURI) {
@@ -1509,10 +1503,12 @@ var PlacesUtils = {
     for each (var bk in bmkIds) {
       // Find the first folder which isn't a tag container
       var folder = this.bookmarks.getFolderIdForItem(bk);
-      if (folder == this.placesRootId ||
+      if (folder == this.placesRootId)
-        this.bookmarks.getFolderIdForItem(folder) != this.tagRootId) {
+        return bk;
+      var parent = this.bookmarks.getFolderIdForItem(folder)
+      if (parent != this.tagRootId &&
+          !this.annotations.itemHasAnnotation(parent, "livemark/feedURI"))
         return bk;
-      }
     }
     return -1;
   }

browser/components/preferences/main.js

@@ -180,11 +180,11 @@ var gMainPane = {
    * browser.download.useDownloadDir - bool
    *   True if downloads are saved with no save-as UI shown, false if
    *   the user should always be asked where to save a file.
-   * browser.download.dir - str path
+   * browser.download.dir - local file handle
-   *   A local path the user may have selected for downloaded files to be
+   *   A local folder the user may have selected for downloaded files to be
    *   saved. Migration of other browser settings may also set this path.
-   *   This path is enabled when folderList is equals 2.
+   *   This folder is enabled when folderList equals 2.
-   * browser.download.lastDir - str path
+   * browser.download.lastDir - local file handle
    *   May contain the last folder path accessed when the user browsed
    *   via the file save-as dialog. (see contentAreaUtils.js)
    * browser.download.folderList - int
@@ -444,6 +444,25 @@ var gMainPane = {
         return 0;
       break;
     }
+  },
+
+  /**
+   * Displays the Add-ons Manager.
+   */
+  showAddonsMgr: function ()
+  {
+    const EMTYPE = "Extension:Manager";
+    var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"]
+                       .getService(Components.interfaces.nsIWindowMediator);
+    var theEM = wm.getMostRecentWindow(EMTYPE);
+    if (theEM) {
+      theEM.focus();
+      return;
+    }
+
+    const EMURL = "chrome://mozapps/content/extensions/extensions.xul";
+    const EMFEATURES = "chrome,menubar,extra-chrome,toolbar,dialog=no,resizable";
+    window.openDialog(EMURL, "", EMFEATURES);
   }
 
 #ifdef HAVE_SHELL_SERVICE

browser/components/preferences/main.xul

@@ -90,7 +90,7 @@
       <preference id="browser.download.dir"
                   name="browser.download.dir"
                   type="file"
-                  onchange="gMainPane.readDownloadDirPref();"/>
+                  onchange="gMainPane.displayDownloadDirPref();"/>
       <preference id="browser.download.folderList"        name="browser.download.folderList"        type="int"/>
 
       <!-- SYSTEM DEFAULTS -->
@@ -162,7 +162,7 @@
                 accesskey="&closeWhenDone.accesskey;" class="indent"
                 preference="browser.download.manager.closeWhenDone"/>
 
-      <separator/>
+      <separator class="thin"/>
 
       <radiogroup id="saveWhere"
                   preference="browser.download.useDownloadDir"
@@ -203,7 +203,7 @@
       <hbox id="checkDefaultBox" align="center" flex="1">      
         <checkbox id="alwaysCheckDefault" preference="browser.shell.checkDefaultBrowser"
                   label="&alwaysCheckDefault.label;" accesskey="&alwaysCheckDefault.accesskey;"
-                  flex="1" style="height: &alwaysCheckDefault.height;"/>
+                  flex="1"/>
         <button id="checkDefaultButton"
                 label="&checkNow.label;" accesskey="&checkNow.accesskey;"
                 oncommand="gMainPane.checkNow()"
@@ -211,6 +211,21 @@
       </hbox>
     </groupbox>
 #endif
+    <hbox class="bottomBox">
+      <groupbox id="addonsMgrGroup" orient="horizontal" flex="1">
+        <caption label="&addonsMgr.label;"/>
+
+        <description control="manageAddons"
+#ifdef XP_WIN
+                     flex="1">&manageAddonsDesc.label;</description>
+#else
+                     flex="1">&manageAddonsDescUnix.label;</description>
+#endif
+        <button id="manageAddons" label="&manageAddons.label;"
+                accesskey="&manageAddons.accesskey;"
+                oncommand="gMainPane.showAddonsMgr();"/>
+      </groupbox>
+    </hbox>
 
   </prefpane>
 

browser/components/preferences/security.xul

@@ -163,18 +163,17 @@
     </groupbox>
 
     <!-- Warning Messages -->
-    <groupbox id="warningMessagesGroup">
+    <hbox class="bottomBox">
+      <groupbox id="warningMessagesGroup" orient="horizontal" flex="1">
         <caption label="&warnings.label;"/>
 
-      <hbox id="chooseWarningsBox" align="center">
         <description control="warningSettings" flex="1">&chooseWarnings.label;</description>
         <button id="warningSettings"
                 label="&warningSettings.label;"
                 accesskey="&warningSettings.accesskey;"
                 oncommand="gSecurityPane.showWarningMessageSettings();"/>
-      </hbox>
-      <separator/>
       </groupbox>
+    </hbox>
 
   </prefpane>
 

browser/components/sessionstore/src/nsSessionStore.js

@@ -100,9 +100,6 @@ const CAPABILITIES = [
   "Subframes", "Plugins", "Javascript", "MetaRedirects", "Images"
 ];
 
-// sandbox to evaluate JavaScript code from non-trustable sources
-var EVAL_SANDBOX = new Cu.Sandbox("about:blank");
-
 // module for JSON conversion (needed for the nsISessionStore API)
 Cu.import("resource://gre/modules/JSON.jsm");
 
@@ -1630,41 +1627,9 @@ SessionStoreService.prototype = {
    * Restart incomplete downloads
    */
   retryDownloads: function sss_retryDownloads() {
-    var ioService = Cc["@mozilla.org/network/io-service;1"].
+    // The download manager cleans up after itself when it is created.
-                    getService(Ci.nsIIOService);
     var dlManager = Cc["@mozilla.org/download-manager;1"].
                     getService(Ci.nsIDownloadManager);
-    
-    function AsyncDownloadRetrier(aDlId) {
-      this._dlId = aDlId;
-      this._dlManager = dlManager;
-    }
-    AsyncDownloadRetrier.prototype = {
-      onStartRequest: function(aRequest, aContext) { },
-      onStopRequest: function(aRequest, aContext, aStatus) {
-        if (Components.isSuccessCode(aStatus))
-          this._dlManager.retryDownload(this._dlId);
-      }
-    };
-    
-    var stmt = dlManager.DBConnection.
-                         createStatement("SELECT id, source " +
-                                         "FROM moz_downloads " +
-                                         "WHERE state = ?1");
-    stmt.bindInt32Parameter(0, Ci.nsIDownloadManager.DOWNLOAD_DOWNLOADING);
-
-    // restart all downloads that were in progress before the crash
-    // and which are currently available through the network
-    while (stmt.executeStep()) {
-      var dlId = stmt.getInt64(0);
-      var url = stmt.getUTF8String(1);
-      
-      var linkChecker = Cc["@mozilla.org/network/urichecker;1"].
-                        createInstance(Ci.nsIURIChecker);
-      linkChecker.init(ioService.newURI(url, null, null));
-      linkChecker.loadFlags = Ci.nsIRequest.LOAD_BACKGROUND;
-      linkChecker.asyncCheck(new AsyncDownloadRetrier(dlId), null);
-    }
   },
 
 /* ........ Disk Access .............. */
@@ -1913,7 +1878,7 @@ SessionStoreService.prototype = {
    * safe eval'ing
    */
   _safeEval: function sss_safeEval(aStr) {
-    return Cu.evalInSandbox(aStr, EVAL_SANDBOX);
+    return Cu.evalInSandbox(aStr, new Cu.Sandbox("about:blank"));
   },
 
   /**

browser/components/shell/src/Makefile.in

@@ -83,17 +83,13 @@ ifdef CPPSRCS
 LIBRARY_NAME = shellservice_s
 endif
 
+EXTRA_COMPONENTS = nsSetDefaultBrowser.js
+
 include $(topsrcdir)/config/rules.mk
 
 DEFINES += -DMOZ_APP_NAME=\"$(MOZ_APP_NAME)\"
 
-JS_SET_BROWSER_COMPONENT = nsSetDefaultBrowser.js
-
 CXXFLAGS += $(TK_CFLAGS)
 
-libs::
-	$(INSTALL) $(srcdir)/$(JS_SET_BROWSER_COMPONENT) $(DIST)/bin/components
-
 clobber::
 	rm -f $(DIST)/lib/$(LIBRARY_NAME).lib
-	rm -f $(DIST)/bin/components/$(JS_SET_BROWSER_COMPONENT)

browser/components/shell/src/nsSetDefaultBrowser.js

@@ -35,107 +35,38 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-/* This file implements the nsICommandLineHandler interface.
+/* 
- *
+ * -setDefaultBrowser commandline handler
- * This component handles the startup command line argument of the form:
+ * Makes the current executable the "default browser".
- *   -setDefaultBrowser
- * by making the current executable the "default browser."
  */
 
-function nsSetDefaultBrowser() {
+const Cc = Components.classes;
-}
+const Ci = Components.interfaces;
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
+function nsSetDefaultBrowser() {}
 
 nsSetDefaultBrowser.prototype = {
-  /* nsISupports */
+  handle: function nsSetDefault_handle(aCmdline) {
-  QueryInterface: function nsSetDefault_QI(iid) {
+    if (aCmdline.handleFlag("setDefaultBrowser", false)) {
-    if (!iid.equals(Components.interfaces.nsICommandLineHandler) &&
+      var shell = Cc["@mozilla.org/browser/shell-service;1"].
-        !iid.equals(Components.interfaces.nsISupports))
+                  getService(Ci.nsIShellService);
-      throw Components.results.NS_ERROR_NO_INTERFACE;
-
-    return this;
-  },
-
-  /* nsICommandLineHandler */
-  handle : function nsSetDefault_handle(cmdline) {
-    if (cmdline.handleFlag("setDefaultBrowser", false)) {
-      var shell = Components.classes["@mozilla.org/browser/shell-service;1"]
-                            .getService(Components.interfaces.nsIShellService);
       shell.setDefaultBrowser(true, true);
     }
   },
 
-  helpInfo : "  -setDefaultBrowser   Set this app as the default browser.\n"
+  helpInfo: "  -setDefaultBrowser   Set this app as the default browser.\n",
+
+  classDescription: "Default Browser Cmdline Handler",
+  contractID: "@mozilla.org/browser/default-browser-clh;1",
+  classID: Components.ID("{F57899D0-4E2C-4ac6-9E29-50C736103B0C}"),
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsICommandLineHandler]),
+  _xpcom_categories: [{
+    category: "command-line-handler",
+    entry: "m-setdefaultbrowser"
+  }]
 }
 
-// This Component's module and factory implementation.
-
-const contractID = "@mozilla.org/browser/default-browser-clh;1";
-const CID = Components.ID("{F57899D0-4E2C-4ac6-9E29-50C736103B0C}");
-
-var ModuleAndFactory = {
-  /* nsISupports */
-  QueryInterface: function nsSetDefault_QI(iid) {
-    if (!iid.equals(Components.interfaces.nsIModule) &&
-        !iid.equals(Components.interfaces.nsIFactory) &&
-        !iid.equals(Components.interfaces.nsISupports))
-      throw Components.results.NS_ERROR_NO_INTERFACE;
-
-    return this;
-  },
-
-  /* nsIModule */
-  getClassObject: function (compMgr, cid, iid) {
-    if (!cid.equals(CID))
-      throw Components.results.NS_ERROR_NO_INTERFACE;
-    
-    return this.QueryInterface(iid);
-  },
-    
-  registerSelf: function mod_regself(compMgr, fileSpec, location, type) {
-    var compReg =
-      compMgr.QueryInterface( Components.interfaces.nsIComponentRegistrar );
-
-    compReg.registerFactoryLocation( CID,
-                                     "Default Browser Cmdline Handler",
-                                     contractID,
-                                     fileSpec,
-                                     location,
-                                     type );
-
-    var catMan = Components.classes["@mozilla.org/categorymanager;1"]
-                           .getService(Components.interfaces.nsICategoryManager);
-
-    catMan.addCategoryEntry("command-line-handler",
-                            "m-setdefaultbrowser",
-                            contractID, true, true);
-  },
-    
-  unregisterSelf : function mod_unregself(compMgr, location, type) {
-    var catMan = Components.classes["@mozilla.org/categorymanager;1"]
-                           .getService(Components.interfaces.nsICategoryManager);
-
-    catMan.deleteCategoryEntry("command-line-handler",
-                               "m-setdefaultbrowser", true);
-  },
-
-  canUnload: function(compMgr) {
-    return true;
-  },
-
-  /* nsIFactory */
-  createInstance: function mod_CI(outer, iid) {
-    if (outer != null)
-      throw Components.results.NS_ERROR_NO_AGGREGATION;
-  
-    return new nsSetDefaultBrowser().QueryInterface(iid);
-  },
-    
-  lockFactory : function mod_lock(lock) {
-    /* no-op */
-  }
-}
-
-// NSGetModule: Return the nsIModule object.
 function NSGetModule(compMgr, fileSpec) {
-  return ModuleAndFactory;
+  return XPCOMUtils.generateModule([nsSetDefaultBrowser]);
 }

browser/fuel/src/fuelApplication.js

@@ -527,10 +527,7 @@ Extensions.prototype = {
   },
   
   has : function exts_has(aId) {
-    // getItemForID never returns null for a non-existent id, so we
+    return this._extmgr.getItemForID(aId) != null;
-    // check the type of the returned update item, which should be
-    // greater than 1 for a valid extension.
-    return !!(this._extmgr.getItemForID(aId).type);
   },
   
   get : function exts_get(aId) {
@@ -1105,10 +1102,24 @@ BookmarkFolder.prototype = {
   QueryInterface : XPCOMUtils.generateQI([Ci.fuelIBookmarkFolder, Ci.nsINavBookmarkObserver])
 };
 
+//=================================================
+// Factory - Treat Application as a singleton
+// XXX This is required, because we're registered for the 'JavaScript global
+// privileged property' category, whose handler always calls createInstance.
+// See bug 386535.
+var gSingleton = null;
+var ApplicationFactory = {
+  createInstance: function af_ci(aOuter, aIID) {
+    if (aOuter != null)
+      throw Components.results.NS_ERROR_NO_AGGREGATION;
 
-const CLASS_ID = Components.ID("fe74cf80-aa2d-11db-abbd-0800200c9a66");
+    if (gSingleton == null) {
-const CLASS_NAME = "Application wrapper";
+      gSingleton = new Application();
-const CONTRACT_ID = "@mozilla.org/fuel/application;1";
+    }
+
+    return gSingleton.QueryInterface(aIID);
+  }
+};
 
 //=================================================
 // Application constructor
@@ -1135,6 +1146,23 @@ function Application() {
 //=================================================
 // Application implementation
 Application.prototype = {
+  // for nsIClassInfo + XPCOMUtils
+  classDescription: "Application",
+  classID:          Components.ID("fe74cf80-aa2d-11db-abbd-0800200c9a66"),
+  contractID:       "@mozilla.org/fuel/application;1",
+
+  // redefine the default factory for XPCOMUtils
+  _xpcom_factory: ApplicationFactory,
+
+  // get this contractID registered for certain categories via XPCOMUtils
+  _xpcom_categories: [
+    // make Application a startup observer
+    { category: "app-startup", service: true },
+
+    // add Application as a global property for easy access
+    { category: "JavaScript global privileged property" }
+  ],
+
   get id() {
     return this._info.ID;
   },
@@ -1194,9 +1222,6 @@ Application.prototype = {
   },
 
   // for nsIClassInfo
-  classDescription : "Application",
-  classID : CLASS_ID,
-  contractID : CONTRACT_ID,
   flags : Ci.nsIClassInfo.SINGLETON,
   implementationLanguage : Ci.nsIProgrammingLanguage.JAVASCRIPT,
 
@@ -1267,61 +1292,7 @@ Application.prototype = {
   }
 };
 
-//=================================================
-// Factory - Treat Application as a singleton
-var gSingleton = null;
-var ApplicationFactory = {
-  createInstance: function af_ci(aOuter, aIID) {
-    if (aOuter != null)
-      throw Components.results.NS_ERROR_NO_AGGREGATION;
-      
-    if (gSingleton == null) {
-      gSingleton = new Application();
-    }
-
-    return gSingleton.QueryInterface(aIID);
-  }
-};
-
-//=================================================
-// Module
-var ApplicationModule = {
-  registerSelf: function am_rs(aCompMgr, aFileSpec, aLocation, aType) {
-    aCompMgr = aCompMgr.QueryInterface(Ci.nsIComponentRegistrar);
-    aCompMgr.registerFactoryLocation(CLASS_ID, CLASS_NAME, CONTRACT_ID, aFileSpec, aLocation, aType);
-    
-    var categoryManager = Components.classes["@mozilla.org/categorymanager;1"]
-                                    .getService(Ci.nsICategoryManager);
-    // make Application a startup observer
-    categoryManager.addCategoryEntry("app-startup", CLASS_NAME, "service," + CONTRACT_ID, true, true);
-
-    // add Application as a global property for easy access
-    categoryManager.addCategoryEntry("JavaScript global privileged property", "Application", CONTRACT_ID, true, true);
-  },
-
-  unregisterSelf: function am_us(aCompMgr, aLocation, aType) {
-    aCompMgr = aCompMgr.QueryInterface(Ci.nsIComponentRegistrar);
-    aCompMgr.unregisterFactoryLocation(CLASS_ID, aLocation);        
-
-    // cleanup categories
-    var categoryManager = Components.classes["@mozilla.org/categorymanager;1"]
-                                    .getService(Ci.nsICategoryManager);
-    categoryManager.deleteCategoryEntry("app-startup", "service," + CONTRACT_ID, true);
-    categoryManager.deleteCategoryEntry("JavaScript global property", CONTRACT_ID, true);
-  },
-  
-  getClassObject: function am_gco(aCompMgr, aCID, aIID) {
-    if (!aIID.equals(Ci.nsIFactory))
-      throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
-
-    if (aCID.equals(CLASS_ID))
-      return ApplicationFactory;
-
-    throw Components.results.NS_ERROR_NO_INTERFACE;
-  },
-
-  canUnload: function am_cu(aCompMgr) { return true; }
-};
-
 //module initialization
-function NSGetModule(aCompMgr, aFileSpec) { return ApplicationModule; }
+function NSGetModule(aCompMgr, aFileSpec) {
+  return XPCOMUtils.generateModule([Application]);
+}

browser/installer/unix/packages-static

@@ -211,6 +211,7 @@ bin/components/nsTryToClose.js
 bin/components/nsDictionary.js
 bin/components/nsFilePicker.js
 bin/components/nsHelperAppDlg.js
+bin/components/nsDownloadManagerUI.js
 bin/components/nsInterfaceInfoToIDL.js
 ; bin/components/nsProgressDialog.js   not needed for firefox
 bin/components/nsProxyAutoConfig.js

browser/installer/windows/packages-static

@@ -205,6 +205,7 @@ bin\components\nsSetDefaultBrowser.js
 bin\components\nsTryToClose.js
 bin\components\nsDictionary.js
 bin\components\nsHelperAppDlg.js
+bin\components\nsDownloadManagerUI.js
 bin\components\nsProxyAutoConfig.js
 bin\components\nsSearchService.js
 bin\components\nsSearchSuggestions.js

browser/locales/en-US/chrome/browser/browser.properties

@@ -28,11 +28,11 @@ bookmarkCurTab_accesskey=B
 bookmarkAllTabsDefault=[Folder Name]
 
 xpinstallPromptWarning=%S prevented this site (%S) from asking you to install software on your computer.
-xpinstallPromptWarningButton=Edit Options...
+xpinstallPromptAllowButton=Allow
 # Accessibility Note:
 # Be sure you do not choose an accesskey that is used elsewhere in the active context (e.g. main menu bar, submenu of the warning popup button)
 # See http://www.mozilla.org/access/keyboard/accesskey for details
-xpinstallPromptWarningButton.accesskey=O
+xpinstallPromptAllowButton.accesskey=A
 xpinstallDisabledMessageLocked=Software installation has been disabled by your system administrator.
 xpinstallDisabledMessage=Software installation is currently disabled. Click Enable and try again.
 xpinstallDisabledButton=Enable

browser/locales/en-US/chrome/browser/places/places.dtd

@@ -195,7 +195,7 @@
 <!ENTITY cmd.personalToolbarFolder.menuAccesskey
          "b">
 
-<!ENTITY col.title.label
+<!ENTITY col.name.label
   "Name">
 <!ENTITY col.tags.label
   "Tags">

browser/locales/en-US/chrome/browser/places/places.properties

@@ -45,8 +45,8 @@ livemarkReloadOne=Reload %S
 
 sortByName=Sort '%S' by Name
 sortByNameGeneric=Sort by Name
-view.sortBy.title.label=Sort by Name
+view.sortBy.name.label=Sort by Name
-view.sortBy.title.accesskey=T
+view.sortBy.name.accesskey=N
 view.sortBy.url.label=Sort by Location
 view.sortBy.url.accesskey=L
 view.sortBy.date.label=Sort by Visit Date
@@ -61,6 +61,8 @@ view.sortBy.dateAdded.label=Sort by Added
 view.sortBy.dateAdded.accesskey=A
 view.sortBy.lastModified.label=Sort by Last Modified
 view.sortBy.lastModified.accesskey=M
+view.sortBy.tags.label=Sort by Tags
+view.sortBy.tags.accesskey=T
 
 searchByDefault=Search in Bookmarks
 searchCurrentDefault=Search in '%S'

browser/locales/en-US/chrome/browser/preferences/advanced.dtd

@@ -1,5 +1,5 @@
 <!-- Note: due to bug 143065, the only remaining accesskeys available to be used
-     in the Advanced pane are: "b", "j", "q", "z" -->
+     in the Advanced pane are: "j", "q", "z" -->
 
 <!ENTITY generalTab.label                "General">
 
@@ -10,7 +10,7 @@
 <!ENTITY searchStartTyping.label         "Search for text when I start typing">
 <!ENTITY searchStartTyping.accesskey     "x">
 <!ENTITY blockAutoRefresh.label          "Warn me when web sites try to redirect or reload the page">
-<!ENTITY blockAutoRefresh.accesskey      "r">
+<!ENTITY blockAutoRefresh.accesskey      "b">
 
 <!ENTITY browsing.label                  "Browsing">
 

browser/locales/en-US/chrome/browser/preferences/main.dtd

@@ -36,12 +36,11 @@
 <!ENTITY alwaysCheckDefault.label      "Always check to see if &brandShortName; is the default browser on startup"><!--XXX-->
 <!ENTITY alwaysCheckDefault.accesskey  "y">
 
-<!-- LOCALIZATION NOTE (alwaysCheckDefault.height):
-  There's some sort of bug which makes wrapping checkboxes not properly reflow,
-  causing the bottom border of the groupbox to be cut off; set this
-  appropriately if your localization causes this checkbox to wrap.
--->
-<!ENTITY alwaysCheckDefault.height  "3em">
-
 <!ENTITY checkNow.label             "Check Now">
 <!ENTITY checkNow.accesskey         "N">
+
+<!ENTITY addonsMgr.label            "Add-ons">
+<!ENTITY manageAddonsDesc.label     "Change options for your add-ons.">
+<!ENTITY manageAddonsDescUnix.label "Change preferences for your add-ons.">
+<!ENTITY manageAddons.label         "Manage Add-ons...">
+<!ENTITY manageAddons.accesskey     "M">

browser/locales/en-US/chrome/browser/preferences/preferences.dtd

@@ -1,7 +1,9 @@
 
 <!ENTITY  prefWindow.titleWin     "Options">
 <!ENTITY  prefWindow.titleGNOME   "&brandShortName; Preferences">
-<!ENTITY  prefWindow.styleWin     "width: 42em; height: 40em;">
+<!-- When making changes to prefWindow.styleWin test both Windows Classic and
+     Luna since widget heights are different based on the OS theme -->
+<!ENTITY  prefWindow.styleWin     "width: 42em; height: 44em;">
 <!ENTITY  prefWindow.styleMac     "width: 47em;">
 <!ENTITY  prefWindow.styleGNOME   "width: 42em; height: 38.5em;">
 

browser/locales/en-US/chrome/browser/quitDialog.properties

@@ -4,7 +4,7 @@ restartDialogTitle=Restart %S
 quitTitle=&Quit
 restartTitle=&Restart
 cancelTitle=&Cancel
-saveTitle=&Save and quit
+saveTitle=&Save and Quit
 neverAsk=Do not ask next time
 message=Do you want %S to save your tabs and windows for the next time it starts?
 messageNoWindows=Do you want %S to save your tabs for the next time it starts?

browser/themes/pinstripe/browser/browser.css

@@ -977,6 +977,23 @@ statusbarpanel#statusbar-display {
   height: 16px;
 }
 
+#treecolAutoCompleteImage {
+ max-width : 36px; 
+ padding-end: 18px;
+}
+
+.autocomplete-treebody::-moz-tree-image(favicon, treecolAutoCompleteImage) {
+  list-style-image: url("chrome://browser/skin/places/starPage.png");
+  width: 16px;
+  height: 16px;
+}
+
+.autocomplete-treebody::-moz-tree-image(bookmark, treecolAutoCompleteImage) {
+  list-style-image: url("chrome://browser/skin/places/pageStarred.png");
+  width: 16px;
+  height: 16px;
+}
+
 .autocomplete-treebody::-moz-tree-cell-text(treecolAutoCompleteComment) {
   color: #555566;
 }
@@ -1037,6 +1054,26 @@ toolbarpaletteitem:not([place="toolbar"]) .search-go-button {
   padding: 0px;
 }
 
+/* STAR BUTTON */
+#star-button {
+  list-style-image: url("chrome://browser/skin/places/starPage.png");
+  margin: 0;
+  padding: 0;
+  max-width: 0;
+  height: 24px;
+}
+
+#star-button > .toolbarbutton-icon {
+  padding: 2px 2px 2px 0;
+  border: 1px solid #A3A3A3;
+  border-left: 0;
+  background: url("chrome://global/skin/10pct_transparent_grey.png") repeat;
+}
+
+#star-button[starred="true"] {
+  list-style-image: url("chrome://browser/skin/places/pageStarred.png");
+}
+
 /* ----- SIDEBAR ELEMENTS ----- */
 
 sidebarheader {
@@ -1247,6 +1284,10 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
   -moz-user-focus: normal;
 }
 
+.tabbrowser-tab[selected="true"] > .tab-image-middle > .tab-icon {
+  cursor: -moz-grab;
+}
+
 .tabbrowser-tab > .tab-image-middle > .tab-text {
   border: 1.4pt solid transparent;
 }
@@ -1662,13 +1703,3 @@ toolbarbutton.bookmark-item[dragover="true"][open="true"] {
   -moz-border-left-colors: ThreeDLightShadow ThreeDHighlight !important;
 }
 
-/* star icon */
-#star-icon {
-  list-style-image: url("chrome://browser/skin/places/starPage.png");
-  width: 16px;
-  height: 16px;
-}
-
-#star-icon[starred="true"] {
-  list-style-image: url("chrome://browser/skin/places/pageStarred.png");
-}

browser/themes/winstripe/browser/browser.css

@@ -970,6 +970,23 @@ statusbarpanel#statusbar-display {
   height: 16px;
 }
 
+#treecolAutoCompleteImage {
+ max-width : 36px; 
+ padding-end: 18px;
+}
+
+.autocomplete-treebody::-moz-tree-image(favicon, treecolAutoCompleteImage) {
+  list-style-image: url("chrome://browser/skin/places/starPage.png");
+  width: 16px;
+  height: 16px;
+}
+
+.autocomplete-treebody::-moz-tree-image(bookmark, treecolAutoCompleteImage) {
+  list-style-image: url("chrome://browser/skin/places/pageStarred.png");
+  width: 16px;
+  height: 16px;
+}
+
 .autocomplete-treebody::-moz-tree-cell-text(treecolAutoCompleteComment) {
   color: #555566;
 }
@@ -1025,6 +1042,20 @@ toolbar:not([mode="text"]) #go-button,
   padding: 0;
 }
 
+/* star button */
+toolbar:not([mode="text"]) #star-button,
+#palette-box #star-button {
+  -moz-appearance: none;
+  list-style-image: url("chrome://browser/skin/places/starPage.png");
+  padding: 0;
+  border: none;
+}
+
+toolbar:not([mode="text"]) #star-button[starred="true"],
+#palette-box #star-button[starred="true"] {
+  list-style-image: url("chrome://browser/skin/places/pageStarred.png");
+}
+
 #go-button[chromedir="rtl"] {
   list-style-image: url("chrome://browser/skin/Go-arrow-rtl.png");
 }
@@ -1271,69 +1302,66 @@ toolbar[mode="text"] #navigator-throbber[busy="true"] {
   font-weight: bold;
 }
 
-.tabbrowser-tab[selected="true"] > .tab-image-middle > .tab-text {
+.tabbrowser-tab[selected="true"] > * {
-  opacity: 1.0 !important;
+  background-color: -moz-dialog;
+}
+
+.tabbrowser-tab[selected="true"] > .tab-image-middle > .tab-icon {
+  cursor: -moz-grab;
 }
 
 .tabbrowser-tab > .tab-image-left {
   width: 8px;
   height: 24px;
-  background: url("chrome://browser/skin/tabbrowser/tab-left.png") no-repeat;
+  background-image: url("chrome://browser/skin/tabbrowser/tab-left.png");
-  background-color: -moz-dialog;
+  background-repeat: no-repeat;
   -moz-border-radius-topleft: 4px;
 }
 
 .tabbrowser-tab[chromedir="rtl"] > .tab-image-left {
-  background: url("chrome://browser/skin/tabbrowser/tab-right.png") no-repeat;
+  background-image: url("chrome://browser/skin/tabbrowser/tab-right.png");
-  background-color: -moz-dialog;
   -moz-border-radius-topleft: 0px;
   -moz-border-radius-topright: 4px;
 }
 
 .tabbrowser-tab:not([selected="true"]):not(:hover) > .tab-image-left {
-  background: url("chrome://browser/skin/tabbrowser/tab-left-bkgnd.png") no-repeat;
+  background-image: url("chrome://browser/skin/tabbrowser/tab-left-bkgnd.png");
-  background-color: -moz-dialog;
 }
 
 .tabbrowser-tab[chromedir="rtl"]:not([selected="true"]):not(:hover) > .tab-image-left {
-  background: url("chrome://browser/skin/tabbrowser/tab-right-bkgnd.png") no-repeat;
+  background-image: url("chrome://browser/skin/tabbrowser/tab-right-bkgnd.png");
-  background-color: -moz-dialog;
 }
 
 .tabbrowser-tab > .tab-image-middle {
   height: 24px;
-  background: url("chrome://browser/skin/tabbrowser/tab-middle.png") repeat-x;
+  background-image: url("chrome://browser/skin/tabbrowser/tab-middle.png");
-  background-color: -moz-dialog;
+  background-repeat: repeat-x;
 }
 
 .tabbrowser-tab:not([selected="true"]):not(:hover) > .tab-image-middle {
-  background: url("chrome://browser/skin/tabbrowser/tab-middle-bkgnd.png") repeat-x;
+  background-image: url("chrome://browser/skin/tabbrowser/tab-middle-bkgnd.png");
-  background-color: -moz-dialog;
 }
 
 .tabbrowser-tab > .tab-image-right {
   width: 8px;
   height: 24px;
-  background: url("chrome://browser/skin/tabbrowser/tab-right.png") no-repeat;
+  background-image: url("chrome://browser/skin/tabbrowser/tab-right.png");
-  background-color: -moz-dialog;
+  background-repeat: no-repeat;
   -moz-border-radius-topright: 4px;
 }
 
 .tabbrowser-tab[chromedir="rtl"] > .tab-image-right {
-  background: url("chrome://browser/skin/tabbrowser/tab-left.png") no-repeat;
+  background-image: url("chrome://browser/skin/tabbrowser/tab-left.png");
-  background-color: -moz-dialog;
   -moz-border-radius-topleft: 4px;
   -moz-border-radius-topright: 0px;
 }
 
 .tabbrowser-tab:not([selected="true"]):not(:hover) > .tab-image-right {
-  background: url("chrome://browser/skin/tabbrowser/tab-right-bkgnd.png") no-repeat;
+  background-image: url("chrome://browser/skin/tabbrowser/tab-right-bkgnd.png");
-  background-color: -moz-dialog;
 }
 
 .tabbrowser-tab[chromedir="rtl"]:not([selected="true"]):not(:hover) > .tab-image-right {
-  background: url("chrome://browser/skin/tabbrowser/tab-left-bkgnd.png") no-repeat;
+  background-image: url("chrome://browser/skin/tabbrowser/tab-left-bkgnd.png");
-  background-color: -moz-dialog;
 }
 
 .tabbrowser-tab:not([selected="true"]) > .tab-image-left,
@@ -1432,18 +1460,15 @@ tabpanels {
 .tab-close-button:hover,
 .tabbrowser-tab[selected="true"] > .tab-close-button:hover {
   -moz-image-region: rect(0px, 32px, 16px, 16px);
-  opacity: 1.0;
 }
 
 .tab-close-button:hover:active,
 .tabbrowser-tab[selected="true"] > .tab-close-button:hover:active {
   -moz-image-region: rect(0px, 48px, 16px, 32px);
-  opacity: 1.0;
 }
 
 .tabbrowser-tab > .tab-close-button {
   background-image: url("chrome://browser/skin/tabbrowser/tab-middle-bkgnd.png");
-  background-color: -moz-dialog;
 }
 
 .tabbrowser-tab:hover > .tab-close-button {
@@ -1462,6 +1487,24 @@ tabpanels {
   outline: none !important;
 }
 
+/**
+ * Tabstrip close button
+ */
+
+.tabs-closebutton-box > .tabs-closebutton {
+  padding-top: 5px;
+  -moz-padding-end: 1px;
+  padding-bottom: 3px;
+  -moz-padding-start: 2px;
+  background-image: url("chrome://browser/skin/tabbrowser/close-bkgnd.png");
+  background-color: -moz-dialog;
+}
+
+.tabs-closebutton-box[chromedir="rtl"] > .tabs-closebutton {
+  background-image: url("chrome://browser/skin/tabbrowser/close-bkgnd-rtl.png");
+  background-position: top right;
+}
+
 /**
  * Tab Scrollbox Arrow Buttons
  */
@@ -1484,7 +1527,6 @@ tabpanels {
   -moz-image-region: rect(0, 11px, 14px, 0);
   background-repeat: no-repeat;
   background-image: url("chrome://browser/skin/tabbrowser/tab-arrow-start-bkgnd-enabled.png");
-  background-color: -moz-dialog;
   -moz-border-radius-topright: 4px;
 }
 
@@ -1533,7 +1575,6 @@ tabpanels {
   width: 18px;
   background-image: url("chrome://browser/skin/tabbrowser/tab-arrow-end-bkgnd-enabled.png");
   background-repeat: no-repeat;
-  background-color: -moz-dialog;
   -moz-border-radius-topleft: 4px;
 }
 
@@ -1609,7 +1650,6 @@ tabpanels {
   height: 23px !important;
   background-image: url("chrome://browser/skin/tabbrowser/tab-arrow-end-bkgnd-enabled.png");
   background-repeat: no-repeat;
-  background-color: -moz-dialog; 
   -moz-border-radius-topleft: 4px;
 }
 
@@ -1919,14 +1959,3 @@ toolbarbutton.bookmark-item[dragover="true"][open="true"] {
 .bookmark-item[dragover-bottom="true"] {
   -moz-border-bottom-colors: #000000;
 }
-
-/* star icon */
-#star-icon {
-  list-style-image: url("chrome://browser/skin/places/starPage.png");
-  width: 16px;
-  height: 16px;
-}
-
-#star-icon[starred="true"] {
-  list-style-image: url("chrome://browser/skin/places/pageStarred.png");
-}

browser/themes/winstripe/browser/jar.mn

@@ -71,6 +71,8 @@ classic.jar:
         skin/classic/browser/tabbrowser/alltabs-box-overflow-start-bkgnd.png         (tabbrowser/alltabs-box-overflow-start-bkgnd.png)
         skin/classic/browser/tabbrowser/alltabs-box-overflow-start-bkgnd-animate.png (tabbrowser/alltabs-box-overflow-start-bkgnd-animate.png)        
         skin/classic/browser/tabbrowser/alltabs-box-overflow-start-bkgnd-hover.png   (tabbrowser/alltabs-box-overflow-start-bkgnd-hover.png)
+        skin/classic/browser/tabbrowser/close-bkgnd.png                    (tabbrowser/close-bkgnd.png)
+        skin/classic/browser/tabbrowser/close-bkgnd-rtl.png                (tabbrowser/close-bkgnd-rtl.png)
         skin/classic/browser/tabbrowser/tab-arrow-end.png                  (tabbrowser/tab-arrow-end.png)
         skin/classic/browser/tabbrowser/tab-arrow-end-bkgnd-animate.png    (tabbrowser/tab-arrow-end-bkgnd-animate.png)
         skin/classic/browser/tabbrowser/tab-arrow-end-bkgnd-disabled.png   (tabbrowser/tab-arrow-end-bkgnd-disabled.png)

browser/themes/winstripe/browser/preferences/preferences.css

@@ -264,3 +264,9 @@ filefield[disabled="true"] .fileFieldIcon {
 #chooseClientAppCell {
   -moz-padding-end: 12px;
 }
+
+/* bottom-most box containing a groupbox in a prefpane. Prevents the bottom
+   of the groupbox from being cutoff */
+.bottomBox {
+  padding-bottom: 2px;
+}

browser/themes/winstripe/browser/tabbrowser/tabbrowserBindings.xml

@@ -62,7 +62,8 @@
                                anonid="alltabs-popup" position="after_end"/>
               </xul:toolbarbutton>
             </xul:stack>
-            <xul:hbox class="tabs-closebutton-box" align="center" pack="end" anonid="tabstrip-closebutton">
+            <xul:hbox anonid="tabstrip-closebutton" class="tabs-closebutton-box"
+                      align="center" pack="end" chromedir="&locale.dir;">
               <xul:toolbarbutton class="close-button tabs-closebutton"/>
             </xul:hbox>
           </xul:hbox>

client.py

@@ -1,6 +1,6 @@
 #!/usr/bin/python
 
-NSPR_CO_TAG = 'NSPR_HEAD_20070713'
+NSPR_CO_TAG = 'NSPR_HEAD_20070820'
 NSS_CO_TAG  = 'NSS_3_12_ALPHA1B'
 
 NSPR_DIRS = ('nsprpub',)