diff --git a/accessible/base/nsAccessibilityService.h b/accessible/base/nsAccessibilityService.h
index eec49b0353dd..d60bd31c0768 100644
--- a/accessible/base/nsAccessibilityService.h
+++ b/accessible/base/nsAccessibilityService.h
@@ -106,7 +106,7 @@ public:
   bool HasAccessible(nsIDOMNode* aDOMNode);
 
   /**
-   * Get a string equivalent for an accessilbe role value.
+   * Get a string equivalent for an accessible role value.
    */
   void GetStringRole(uint32_t aRole, nsAString& aString);
 
diff --git a/accessible/generic/Accessible.cpp b/accessible/generic/Accessible.cpp
index e207816dce22..247e3e647064 100644
--- a/accessible/generic/Accessible.cpp
+++ b/accessible/generic/Accessible.cpp
@@ -2135,7 +2135,8 @@ Accessible::RemoveChild(Accessible* aChild)
   MOZ_DIAGNOSTIC_ASSERT(aChild->mParent, "No parent");
   MOZ_DIAGNOSTIC_ASSERT(aChild->mParent == this, "Wrong parent");
   MOZ_DIAGNOSTIC_ASSERT(aChild->mIndexInParent != -1, "Unbound child was given");
-  MOZ_DIAGNOSTIC_ASSERT((mStateFlags & eKidsMutating) || aChild->IsDefunct() || aChild->IsDoc(),
+  MOZ_DIAGNOSTIC_ASSERT((mStateFlags & eKidsMutating) || aChild->IsDefunct() ||
+                        aChild->IsDoc() || IsApplication(),
                         "Illicit children change");
 
   int32_t index = static_cast<uint32_t>(aChild->mIndexInParent);
diff --git a/accessible/jsat/EventManager.jsm b/accessible/jsat/EventManager.jsm
index 213e7f20d684..0a7116e5acd5 100644
--- a/accessible/jsat/EventManager.jsm
+++ b/accessible/jsat/EventManager.jsm
@@ -288,7 +288,7 @@ this.EventManager.prototype = {
       {
         let position = this.contentControl.vc.position;
         // Check if position is in the subtree of the DOCUMENT_LOAD_COMPLETE
-        // event's dialog accesible or accessible document
+        // event's dialog accessible or accessible document
         let subtreeRoot = aEvent.accessible.role === Roles.DIALOG ?
           aEvent.accessible : aEvent.accessibleDocument;
         if (aEvent.accessible === aEvent.accessibleDocument ||
diff --git a/accessible/tests/mochitest/attributes.js b/accessible/tests/mochitest/attributes.js
index b1c59000e10f..29136da8cf4f 100644
--- a/accessible/tests/mochitest/attributes.js
+++ b/accessible/tests/mochitest/attributes.js
@@ -133,7 +133,7 @@ function testTextAttrs(aID, aOffset, aAttrs, aDefAttrs,
   var startOffset = { value: -1 };
   var endOffset = { value: -1 };
 
-  // do not include attributes exposed on hyper text accessbile
+  // do not include attributes exposed on hyper text accessible
   var attrs = getTextAttributes(aID, accessible, false, aOffset,
                                 startOffset, endOffset);
 
@@ -147,7 +147,7 @@ function testTextAttrs(aID, aOffset, aAttrs, aDefAttrs,
 
   compareAttrs(errorMsg, attrs, aAttrs, aSkipUnexpectedAttrs);
 
-  // include attributes exposed on hyper text accessbile
+  // include attributes exposed on hyper text accessible
   var expectedAttrs = {};
   for (var name in aAttrs)
     expectedAttrs[name] = aAttrs[name];
diff --git a/accessible/tests/mochitest/name/markuprules.xml b/accessible/tests/mochitest/name/markuprules.xml
index 7f64ada3452d..80f8eab77e1d 100644
--- a/accessible/tests/mochitest/name/markuprules.xml
+++ b/accessible/tests/mochitest/name/markuprules.xml
@@ -72,7 +72,7 @@
   Initially 'markup' element holds markup for all rules specified by 'ruleset'
   attribute. This allows us to check if the sequence of name computation rules
   is correct. Here 'ruleset' element defines two rules. We get the first rule
-  which means accesible name is computed from value of 'aria-label' attribute.
+  which means accessible name is computed from value of 'aria-label' attribute.
   Then we check accessible name for the test element and remove 'aria-label'
   attribute. After we get the second rule which means we should get IDs from
   'aria-labelledby' attribute and compose accessible name from values of
diff --git a/accessible/tests/mochitest/states.js b/accessible/tests/mochitest/states.js
index 73ec126e3888..ad1f89943e87 100644
--- a/accessible/tests/mochitest/states.js
+++ b/accessible/tests/mochitest/states.js
@@ -162,7 +162,7 @@ function testStates(aAccOrElmOrID, aState, aExtraState, aAbsentState,
 }
 
 /**
- * Tests an acessible and its sub tree for the passed in state bits.
+ * Tests an accessible and its sub tree for the passed in state bits.
  * Used to make sure that states are propagated to descendants, for example the
  * STATE_UNAVAILABLE from a container to its children.
  *
diff --git a/addon-sdk/source/lib/sdk/event/core.js b/addon-sdk/source/lib/sdk/event/core.js
index a0a73a699312..8d2d5951d1cd 100644
--- a/addon-sdk/source/lib/sdk/event/core.js
+++ b/addon-sdk/source/lib/sdk/event/core.js
@@ -102,7 +102,7 @@ function emitOnObject(target, type, thisArg, ...args) {
   let count = listenerCount;
   for (let [listener, added] of listeners)
     try {
-      // Since our contract unfortuantely requires that we not dispatch to
+      // Since our contract unfortunately requires that we not dispatch to
       // this event to listeners that were either added or removed during this
       // dispatch, we need to check when each listener was added.
       if (added >= count)
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 5d1b66c11f38..3d6d62fb07b5 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1149,8 +1149,6 @@
             }
 
             if (!this._previewMode) {
-              this._recordTabAccess(this.mCurrentTab);
-
               this.mCurrentTab.updateLastAccessed();
               this.mCurrentTab.removeAttribute("unread");
               oldTab.updateLastAccessed();
@@ -1344,45 +1342,6 @@
         ]]></body>
       </method>
 
-      <!--
-        This function assumes we have an LRU cache of tabs (either
-        images of tab content or their layers). The goal is to find
-        out how far into the cache we need to look in order to find
-        aTab. We record this number in telemetry and also move aTab to
-        the front of the cache.
-
-        A newly created tab has position Infinity in the cache.
-        If a tab is closed, it has no effect on the position of other
-        tabs in the cache since we assume that closing a tab doesn't
-        cause us to load in any other tabs.
-
-        We ignore the effect of dragging tabs between windows.
-      -->
-      <method name="_recordTabAccess">
-        <parameter name="aTab"/>
-        <body><![CDATA[
-          if (!Services.telemetry.canRecordExtended) {
-            return;
-          }
-
-          let tabs = Array.from(this.visibleTabs);
-
-          let pos = aTab.cachePosition;
-          for (let i = 0; i < tabs.length; i++) {
-            // If aTab is moving to the front, everything that was
-            // previously in front of it is bumped up one position.
-            if (tabs[i].cachePosition < pos) {
-              tabs[i].cachePosition++;
-            }
-          }
-          aTab.cachePosition = 0;
-
-          if (isFinite(pos)) {
-            Services.telemetry.getHistogramById("TAB_SWITCH_CACHE_POSITION").add(pos);
-          }
-        ]]></body>
-      </method>
-
       <method name="_tabAttrModified">
         <parameter name="aTab"/>
         <parameter name="aChanged"/>
@@ -5198,7 +5157,6 @@
           this.mCurrentTab.permanentKey = this.mCurrentBrowser.permanentKey;
           this.mCurrentTab._tPos = 0;
           this.mCurrentTab._fullyOpen = true;
-          this.mCurrentTab.cachePosition = 0;
           this.mCurrentTab.linkedBrowser = this.mCurrentBrowser;
           this._tabForBrowser.set(this.mCurrentBrowser, this.mCurrentTab);
 
@@ -7256,8 +7214,6 @@
         ]]></body>
       </method>
 
-      <field name="cachePosition">Infinity</field>
-
       <property name="creationTime">
         <getter>
           return this._creationTime;
diff --git a/browser/base/content/test/captivePortal/browser_CaptivePortalWatcher.js b/browser/base/content/test/captivePortal/browser_CaptivePortalWatcher.js
index c37f3cb8d254..36e25e5b713d 100644
--- a/browser/base/content/test/captivePortal/browser_CaptivePortalWatcher.js
+++ b/browser/base/content/test/captivePortal/browser_CaptivePortalWatcher.js
@@ -28,7 +28,7 @@ let testCasesForBothSuccessAndAbort = [
 
   /**
    * A portal is detected when multiple browser windows are open but none
-   * have focus. A brower window is focused, then the portal is freed.
+   * have focus. A browser window is focused, then the portal is freed.
    * The portal tab should be added and focused when the window is
    * focused, and closed automatically when the success event is fired.
    * The captive portal notification should be shown in all windows upon
diff --git a/browser/base/content/test/webextensions/browser.ini b/browser/base/content/test/webextensions/browser.ini
index 1582e0189e4a..efe8f862cc7f 100644
--- a/browser/base/content/test/webextensions/browser.ini
+++ b/browser/base/content/test/webextensions/browser.ini
@@ -18,6 +18,7 @@ support-files =
 
 [browser_extension_sideloading.js]
 [browser_extension_update_background.js]
+[browser_extension_update_background_noprompt.js]
 [browser_permissions_addons_search.js]
 [browser_permissions_installTrigger.js]
 [browser_permissions_local_file.js]
diff --git a/browser/base/content/test/webextensions/browser_extension_update_background.js b/browser/base/content/test/webextensions/browser_extension_update_background.js
index 958e53bef212..65752fba86e5 100644
--- a/browser/base/content/test/webextensions/browser_extension_update_background.js
+++ b/browser/base/content/test/webextensions/browser_extension_update_background.js
@@ -186,55 +186,3 @@ function checkNonDefaultIcon(icon) {
 
 add_task(() => backgroundUpdateTest(`${BASE}/browser_webext_update_icon1.xpi`,
                                     ID_ICON, checkNonDefaultIcon));
-
-// Helper function to test an upgrade that should not show a prompt
-async function testNoPrompt(origUrl, id) {
-  await SpecialPowers.pushPrefEnv({set: [
-    // Turn on background updates
-    ["extensions.update.enabled", true],
-
-    // Point updates to the local mochitest server
-    ["extensions.update.background.url", `${BASE}/browser_webext_update.json`],
-  ]});
-
-  // Install version 1.0 of the test extension
-  let addon = await promiseInstallAddon(origUrl);
-
-  ok(addon, "Addon was installed");
-
-  let sawPopup = false;
-  PopupNotifications.panel.addEventListener("popupshown",
-                                            () => sawPopup = true,
-                                            {once: true});
-
-  // Trigger an update check and wait for the update to be applied.
-  let updatePromise = waitForUpdate(addon);
-  AddonManagerPrivate.backgroundUpdateCheck();
-  await updatePromise;
-
-  // There should be no notifications about the update
-  is(getBadgeStatus(), "", "Should not have addon alert badge");
-
-  await PanelUI.show();
-  let addons = document.getElementById("PanelUI-footer-addons");
-  is(addons.children.length, 0, "Have 0 updates in the PanelUI menu");
-  await PanelUI.hide();
-
-  ok(!sawPopup, "Should not have seen permissions notification");
-
-  addon = await AddonManager.getAddonByID(id);
-  is(addon.version, "2.0", "Update should have applied");
-
-  addon.uninstall();
-  await SpecialPowers.popPrefEnv();
-}
-
-// Test that an update that adds new non-promptable permissions is just
-// applied without showing a notification dialog.
-add_task(() => testNoPrompt(`${BASE}/browser_webext_update_perms1.xpi`,
-                            ID_PERMS));
-
-// Test that an update from a legacy extension to a webextension
-// doesn't show a prompt even when the webextension uses
-// promptable required permissions.
-add_task(() => testNoPrompt(`${BASE}/browser_legacy.xpi`, ID_LEGACY));
diff --git a/browser/base/content/test/webextensions/browser_extension_update_background_noprompt.js b/browser/base/content/test/webextensions/browser_extension_update_background_noprompt.js
new file mode 100644
index 000000000000..81f1145db89f
--- /dev/null
+++ b/browser/base/content/test/webextensions/browser_extension_update_background_noprompt.js
@@ -0,0 +1,83 @@
+const {AddonManagerPrivate} = Cu.import("resource://gre/modules/AddonManager.jsm", {});
+
+const ID_PERMS = "update_perms@tests.mozilla.org";
+const ID_LEGACY = "legacy_update@tests.mozilla.org";
+
+function getBadgeStatus() {
+  let menuButton = document.getElementById("PanelUI-menu-button");
+  return menuButton.getAttribute("badge-status");
+}
+
+// Set some prefs that apply to all the tests in this file
+add_task(function* setup() {
+  yield SpecialPowers.pushPrefEnv({set: [
+    // We don't have pre-pinned certificates for the local mochitest server
+    ["extensions.install.requireBuiltInCerts", false],
+    ["extensions.update.requireBuiltInCerts", false],
+  ]});
+
+  // Navigate away from the initial page so that about:addons always
+  // opens in a new tab during tests
+  gBrowser.selectedBrowser.loadURI("about:robots");
+  yield BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser);
+
+  registerCleanupFunction(function*() {
+    // Return to about:blank when we're done
+    gBrowser.selectedBrowser.loadURI("about:blank");
+    yield BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser);
+  });
+});
+
+hookExtensionsTelemetry();
+
+// Helper function to test an upgrade that should not show a prompt
+async function testNoPrompt(origUrl, id) {
+  await SpecialPowers.pushPrefEnv({set: [
+    // Turn on background updates
+    ["extensions.update.enabled", true],
+
+    // Point updates to the local mochitest server
+    ["extensions.update.background.url", `${BASE}/browser_webext_update.json`],
+  ]});
+
+  // Install version 1.0 of the test extension
+  let addon = await promiseInstallAddon(origUrl);
+
+  ok(addon, "Addon was installed");
+
+  let sawPopup = false;
+  PopupNotifications.panel.addEventListener("popupshown",
+                                            () => sawPopup = true,
+                                            {once: true});
+
+  // Trigger an update check and wait for the update to be applied.
+  let updatePromise = waitForUpdate(addon);
+  AddonManagerPrivate.backgroundUpdateCheck();
+  await updatePromise;
+
+  // There should be no notifications about the update
+  is(getBadgeStatus(), "", "Should not have addon alert badge");
+
+  await PanelUI.show();
+  let addons = document.getElementById("PanelUI-footer-addons");
+  is(addons.children.length, 0, "Have 0 updates in the PanelUI menu");
+  await PanelUI.hide();
+
+  ok(!sawPopup, "Should not have seen permissions notification");
+
+  addon = await AddonManager.getAddonByID(id);
+  is(addon.version, "2.0", "Update should have applied");
+
+  addon.uninstall();
+  await SpecialPowers.popPrefEnv();
+}
+
+// Test that an update that adds new non-promptable permissions is just
+// applied without showing a notification dialog.
+add_task(() => testNoPrompt(`${BASE}/browser_webext_update_perms1.xpi`,
+                            ID_PERMS));
+
+// Test that an update from a legacy extension to a webextension
+// doesn't show a prompt even when the webextension uses
+// promptable required permissions.
+add_task(() => testNoPrompt(`${BASE}/browser_legacy.xpi`, ID_LEGACY));
diff --git a/browser/extensions/flyweb/skin/flyweb-icon.svg b/browser/extensions/flyweb/skin/flyweb-icon.svg
index 1b247e6458bb..239bc40ba4d9 100644
--- a/browser/extensions/flyweb/skin/flyweb-icon.svg
+++ b/browser/extensions/flyweb/skin/flyweb-icon.svg
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
   width="64px" height="64px" viewBox="0 0 64 64" enable-background="new 0 0 64 64" xml:space="preserve">
 <circle fill="#797C80" cx="32" cy="52" r="6"/>
diff --git a/browser/extensions/shield-recipe-client/test/browser/browser_ClientEnvironment.js b/browser/extensions/shield-recipe-client/test/browser/browser_ClientEnvironment.js
index 97c96ea5b753..79c65b2e4892 100644
--- a/browser/extensions/shield-recipe-client/test/browser/browser_ClientEnvironment.js
+++ b/browser/extensions/shield-recipe-client/test/browser/browser_ClientEnvironment.js
@@ -15,7 +15,7 @@ add_task(function* testTelemetry() {
 
   // Test it can access telemetry
   const telemetry = yield environment.telemetry;
-  is(typeof telemetry, "object", "Telemetry is accesible");
+  is(typeof telemetry, "object", "Telemetry is accessible");
 
   // Test it reads different types of telemetry
   is(telemetry.testfoo.payload.foo, 1, "value 'foo' is in mock telemetry");
diff --git a/browser/themes/shared/tabbrowser/connecting.svg b/browser/themes/shared/tabbrowser/connecting.svg
index 6c5daf35fafe..e1154cae9595 100644
--- a/browser/themes/shared/tabbrowser/connecting.svg
+++ b/browser/themes/shared/tabbrowser/connecting.svg
@@ -1,5 +1,4 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16">
   <path d="M8,0A8,8,0,0,0,0,8a8,8,0,0,0,8,8,8,8,0,0,0,8-8A8,8,0,0,0,8,0ZM8,13A5,5,0,0,1,3,8,5,5,0,0,1,8,3a5,5,0,0,1,5,5A5,5,0,0,1,8,13Z" fill="context-fill" fill-opacity=".2"/>
   <circle cx="14.5" cy="8" r="1.5" fill="context-fill" fill-opacity=".8"/>
diff --git a/browser/themes/shared/tabbrowser/loading.svg b/browser/themes/shared/tabbrowser/loading.svg
index 7ad351c613fc..f4a5430b165c 100644
--- a/browser/themes/shared/tabbrowser/loading.svg
+++ b/browser/themes/shared/tabbrowser/loading.svg
@@ -1,5 +1,4 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16">
 
   <defs>
diff --git a/devtools/client/animationinspector/test/doc_frame_script.js b/devtools/client/animationinspector/test/doc_frame_script.js
index 6846c9b299b6..28c8ef53f97c 100644
--- a/devtools/client/animationinspector/test/doc_frame_script.js
+++ b/devtools/client/animationinspector/test/doc_frame_script.js
@@ -5,7 +5,7 @@
 
 "use strict";
 
-// A helper frame-script for brower/devtools/animationinspector tests.
+// A helper frame-script for browser/devtools/animationinspector tests.
 
 /**
  * Toggle (play or pause) one of the animation players of a given node.
diff --git a/devtools/client/inspector/rules/test/doc_frame_script.js b/devtools/client/inspector/rules/test/doc_frame_script.js
index 88da043f1dc8..11cacbd7fb68 100644
--- a/devtools/client/inspector/rules/test/doc_frame_script.js
+++ b/devtools/client/inspector/rules/test/doc_frame_script.js
@@ -5,7 +5,7 @@
 
 "use strict";
 
-// A helper frame-script for brower/devtools/styleinspector tests.
+// A helper frame-script for browser/devtools/styleinspector tests.
 //
 // Most listeners in the script expect "Test:"-namespaced messages from chrome,
 // then execute code upon receiving, and immediately send back a message.
diff --git a/devtools/client/inspector/shared/test/doc_frame_script.js b/devtools/client/inspector/shared/test/doc_frame_script.js
index aeb73a11527b..ff1a85a55b89 100644
--- a/devtools/client/inspector/shared/test/doc_frame_script.js
+++ b/devtools/client/inspector/shared/test/doc_frame_script.js
@@ -5,7 +5,7 @@
 
 "use strict";
 
-// A helper frame-script for brower/devtools/styleinspector tests.
+// A helper frame-script for browser/devtools/styleinspector tests.
 //
 // Most listeners in the script expect "Test:"-namespaced messages from chrome,
 // then execute code upon receiving, and immediately send back a message.
diff --git a/devtools/client/responsive.html/docs/browser-swap.md b/devtools/client/responsive.html/docs/browser-swap.md
index 75055ad4ef42..4b405c4a74ed 100644
--- a/devtools/client/responsive.html/docs/browser-swap.md
+++ b/devtools/client/responsive.html/docs/browser-swap.md
@@ -77,7 +77,6 @@ involved:
     * `gBrowser._callProgressListeners` with `onLocationChange`
     * `gBrowser._callProgressListeners` with `onSecurityChange`
     * `gBrowser._callProgressListeners` with `onUpdateCurrentBrowser`
-    * `gBrowser._recordTabAccess`
     * `gBrowser.updateTitlebar`
     * `gBrowser._callProgressListeners` with `onStateChange`
     * `gBrowser._setCloseKeyState`
diff --git a/docshell/base/nsIDocShell.idl b/docshell/base/nsIDocShell.idl
index 569d9a9b5276..9b6fd415b197 100644
--- a/docshell/base/nsIDocShell.idl
+++ b/docshell/base/nsIDocShell.idl
@@ -373,7 +373,7 @@ interface nsIDocShell : nsIDocShellTreeItem
 
   /*
    * The size, in CSS pixels, of the horizontal margins for the <body> of an
-   * HTML document in this docshel; used to implement the marginwidth attribute
+   * HTML document in this docshell; used to implement the marginwidth attribute
    * on HTML <frame>/<iframe> elements.  A value smaller than zero indicates
    * that the attribute was not set.
    */
@@ -381,7 +381,7 @@ interface nsIDocShell : nsIDocShellTreeItem
 
   /*
    * The size, in CSS pixels, of the vertical margins for the <body> of an HTML
-   * document in this docshel; used to implement the marginheight attribute on
+   * document in this docshell; used to implement the marginheight attribute on
    * HTML <frame>/<iframe> elements.  A value smaller than zero indicates that
    * the attribute was not set.
    */
diff --git a/docshell/base/timeline/readme.md b/docshell/base/timeline/readme.md
index 2af9ed3a2779..d2c3d5c215f1 100644
--- a/docshell/base/timeline/readme.md
+++ b/docshell/base/timeline/readme.md
@@ -33,11 +33,11 @@ Instances of `ObservedDocShell` accumulate markers that are *mostly* about a par
 
 Therefore, the following scenarios arise:
 
-- a). creating a marker on the main thread about a particular dochsell
+- a). creating a marker on the main thread about a particular docshell
 
 - b). creating a marker on the main thread without pinpointing to an affected docshell (unlikely, but allowed; in this case such a marker would have to be stored in all currently existing `ObservedDocShell` instances)
 
-- c). creating a marker off the main thread about a particular dochsell (impossible; docshells can't be referenced outside the main thread, in which case some other type of identification mechanism needs to be put in place).
+- c). creating a marker off the main thread about a particular docshell (impossible; docshells can't be referenced outside the main thread, in which case some other type of identification mechanism needs to be put in place).
 
 - d). creating a marker off the main thread without pinpointing to a particular docshell (same path as c. here, such a marker would have to be stored in all currently existing `ObservedDocShell` instances).
 
@@ -92,6 +92,6 @@ Example: `AutoTimelineMarker marker(aTargetNode->OwnerDoc()->GetDocShell(), "Par
 
 ### mozilla::AutoGlobalTimelineMarker`
 
-Similar to the previous RAII class, but doesn't expect a specific docshell, and the marker will be visible in all timeline consumers. This is useful for generic operations that don't involve a particular dochsell, or where a docshell isn't accessible. May also only be used on the main thread.
+Similar to the previous RAII class, but doesn't expect a specific docshell, and the marker will be visible in all timeline consumers. This is useful for generic operations that don't involve a particular docshell, or where a docshell isn't accessible. May also only be used on the main thread.
 
 Example: `AutoGlobalTimelineMarker marker("Some global operation");`
diff --git a/dom/base/Element.cpp b/dom/base/Element.cpp
index bfd176189370..283caa3b56d6 100644
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -1226,7 +1226,7 @@ Element::SetAttribute(const nsAString& aName,
   nsAutoString nameToUse;
   const nsAttrName* name = InternalGetAttrNameFromQName(aName, &nameToUse);
   if (!name) {
-    nsCOMPtr<nsIAtom> nameAtom = NS_Atomize(nameToUse);
+    nsCOMPtr<nsIAtom> nameAtom = NS_AtomizeMainThread(nameToUse);
     if (!nameAtom) {
       aError.Throw(NS_ERROR_OUT_OF_MEMORY);
       return;
@@ -1308,7 +1308,7 @@ Element::GetAttributeNS(const nsAString& aNamespaceURI,
     return;
   }
 
-  nsCOMPtr<nsIAtom> name = NS_Atomize(aLocalName);
+  nsCOMPtr<nsIAtom> name = NS_AtomizeMainThread(aLocalName);
   bool hasAttr = GetAttr(nsid, name, aReturn);
   if (!hasAttr) {
     SetDOMStringToNull(aReturn);
@@ -1340,7 +1340,7 @@ Element::RemoveAttributeNS(const nsAString& aNamespaceURI,
                            const nsAString& aLocalName,
                            ErrorResult& aError)
 {
-  nsCOMPtr<nsIAtom> name = NS_Atomize(aLocalName);
+  nsCOMPtr<nsIAtom> name = NS_AtomizeMainThread(aLocalName);
   int32_t nsid =
     nsContentUtils::NameSpaceManager()->GetNameSpaceID(aNamespaceURI,
                                                        nsContentUtils::IsChromeDoc(OwnerDoc()));
@@ -1413,7 +1413,7 @@ Element::HasAttributeNS(const nsAString& aNamespaceURI,
     return false;
   }
 
-  nsCOMPtr<nsIAtom> name = NS_Atomize(aLocalName);
+  nsCOMPtr<nsIAtom> name = NS_AtomizeMainThread(aLocalName);
   return HasAttr(nsid, name);
 }
 
diff --git a/dom/base/nsAttrValue.cpp b/dom/base/nsAttrValue.cpp
index 2358caa11dfb..720049ea32b4 100644
--- a/dom/base/nsAttrValue.cpp
+++ b/dom/base/nsAttrValue.cpp
@@ -750,7 +750,7 @@ nsAttrValue::GetAsAtom() const
 {
   switch (Type()) {
     case eString:
-      return NS_Atomize(GetStringValue());
+      return NS_AtomizeMainThread(GetStringValue());
 
     case eAtom:
       {
@@ -762,7 +762,7 @@ nsAttrValue::GetAsAtom() const
       {
         nsAutoString val;
         ToString(val);
-        return NS_Atomize(val);
+        return NS_AtomizeMainThread(val);
       }
   }
 }
@@ -1275,7 +1275,7 @@ nsAttrValue::ParseAtomArray(const nsAString& aValue)
     ++iter;
   } while (iter != end && !nsContentUtils::IsHTMLWhitespace(*iter));
 
-  nsCOMPtr<nsIAtom> classAtom = NS_Atomize(Substring(start, iter));
+  nsCOMPtr<nsIAtom> classAtom = NS_AtomizeMainThread(Substring(start, iter));
   if (!classAtom) {
     Reset();
     return;
@@ -1316,7 +1316,7 @@ nsAttrValue::ParseAtomArray(const nsAString& aValue)
       ++iter;
     } while (iter != end && !nsContentUtils::IsHTMLWhitespace(*iter));
 
-    classAtom = NS_Atomize(Substring(start, iter));
+    classAtom = NS_AtomizeMainThread(Substring(start, iter));
 
     if (!array->AppendElement(classAtom)) {
       Reset();
@@ -1767,7 +1767,7 @@ nsAttrValue::SetMiscAtomOrString(const nsAString* aValue)
                  "Empty string?");
     MiscContainer* cont = GetMiscContainer();
     if (len <= NS_ATTRVALUE_MAX_STRINGLENGTH_ATOM) {
-      nsCOMPtr<nsIAtom> atom = NS_Atomize(*aValue);
+      nsCOMPtr<nsIAtom> atom = NS_AtomizeMainThread(*aValue);
       if (atom) {
         cont->mStringBits =
           reinterpret_cast<uintptr_t>(atom.forget().take()) | eAtomBase;
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 21199be48e76..3e9d6480c734 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -44,6 +44,7 @@
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/FileSystemSecurity.h"
 #include "mozilla/dom/FileBlobImpl.h"
+#include "mozilla/dom/HTMLInputElement.h"
 #include "mozilla/dom/HTMLMediaElement.h"
 #include "mozilla/dom/HTMLTemplateElement.h"
 #include "mozilla/dom/HTMLContentElement.h"
@@ -1990,6 +1991,8 @@ nsContentUtils::Shutdown()
   sModifierSeparator = nullptr;
 
   NS_IF_RELEASE(sSameOriginChecker);
+
+  HTMLInputElement::Shutdown();
 }
 
 /**
@@ -3076,11 +3079,11 @@ nsContentUtils::SplitQName(const nsIContent* aNamespaceResolver,
     if (*aNamespace == kNameSpaceID_Unknown)
       return NS_ERROR_FAILURE;
 
-    *aLocalName = NS_Atomize(Substring(colon + 1, end)).take();
+    *aLocalName = NS_AtomizeMainThread(Substring(colon + 1, end)).take();
   }
   else {
     *aNamespace = kNameSpaceID_None;
-    *aLocalName = NS_Atomize(aQName).take();
+    *aLocalName = NS_AtomizeMainThread(aQName).take();
   }
   NS_ENSURE_TRUE(aLocalName, NS_ERROR_OUT_OF_MEMORY);
   return NS_OK;
@@ -3105,7 +3108,8 @@ nsContentUtils::GetNodeInfoFromQName(const nsAString& aNamespaceURI,
     const char16_t* end;
     qName.EndReading(end);
 
-    nsCOMPtr<nsIAtom> prefix = NS_Atomize(Substring(qName.get(), colon));
+    nsCOMPtr<nsIAtom> prefix =
+      NS_AtomizeMainThread(Substring(qName.get(), colon));
 
     rv = aNodeInfoManager->GetNodeInfo(Substring(colon + 1, end), prefix,
                                        nsID, aNodeType, aNodeInfo);
@@ -3165,7 +3169,7 @@ nsContentUtils::SplitExpatName(const char16_t *aExpatName, nsIAtom **aPrefix,
     nameStart = (uriEnd + 1);
     if (nameEnd)  {
       const char16_t *prefixStart = nameEnd + 1;
-      *aPrefix = NS_Atomize(Substring(prefixStart, pos)).take();
+      *aPrefix = NS_AtomizeMainThread(Substring(prefixStart, pos)).take();
     }
     else {
       nameEnd = pos;
@@ -3178,7 +3182,7 @@ nsContentUtils::SplitExpatName(const char16_t *aExpatName, nsIAtom **aPrefix,
     nameEnd = pos;
     *aPrefix = nullptr;
   }
-  *aLocalName = NS_Atomize(Substring(nameStart, nameEnd)).take();
+  *aLocalName = NS_AtomizeMainThread(Substring(nameStart, nameEnd)).take();
 }
 
 // static
@@ -4053,7 +4057,8 @@ nsContentUtils::GetEventMessageAndAtom(const nsAString& aName,
   }
 
   *aEventMessage = eUnidentifiedEvent;
-  nsCOMPtr<nsIAtom> atom = NS_Atomize(NS_LITERAL_STRING("on") + aName);
+  nsCOMPtr<nsIAtom> atom =
+    NS_AtomizeMainThread(NS_LITERAL_STRING("on") + aName);
   sUserDefinedEvents->AppendObject(atom);
   mapping.mAtom = atom;
   mapping.mMessage = eUnidentifiedEvent;
@@ -4086,7 +4091,7 @@ nsContentUtils::GetEventMessageAndAtomForListener(const nsAString& aName,
     if (mapping.mMaybeSpecialSVGorSMILEvent) {
       // Try the atom version so that we should get the right message for
       // SVG/SMIL.
-      atom = NS_Atomize(NS_LITERAL_STRING("on") + aName);
+      atom = NS_AtomizeMainThread(NS_LITERAL_STRING("on") + aName);
       msg = GetEventMessage(atom);
     } else {
       atom = mapping.mAtom;
diff --git a/dom/html/HTMLInputElement.cpp b/dom/html/HTMLInputElement.cpp
index 9a95564416d5..8a99d8d95a15 100644
--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@@ -1048,6 +1048,28 @@ static nsresult FireEventForAccessibility(nsIDOMHTMLInputElement* aTarget,
                                           const nsAString& aEventType);
 #endif
 
+nsTextEditorState* HTMLInputElement::sCachedTextEditorState = nullptr;
+bool HTMLInputElement::sShutdown = false;
+
+/* static */ void
+HTMLInputElement::ReleaseTextEditorState(nsTextEditorState* aState)
+{
+  if (!sShutdown && !sCachedTextEditorState) {
+    aState->PrepareForReuse();
+    sCachedTextEditorState = aState;
+  } else {
+    delete aState;
+  }
+}
+
+/* static */ void
+HTMLInputElement::Shutdown()
+{
+  sShutdown = true;
+  delete sCachedTextEditorState;
+  sCachedTextEditorState = nullptr;
+}
+
 //
 // construction, destruction
 //
@@ -1079,7 +1101,8 @@ HTMLInputElement::HTMLInputElement(already_AddRefed<mozilla::dom::NodeInfo>& aNo
   , mSelectionCached(true)
 {
   // We are in a type=text so we now we currenty need a nsTextEditorState.
-  mInputData.mState = new nsTextEditorState(this);
+  mInputData.mState =
+    nsTextEditorState::Construct(this, &sCachedTextEditorState);
 
   if (!gUploadLastDir)
     HTMLInputElement::InitUploadLastDir();
@@ -1112,7 +1135,7 @@ HTMLInputElement::FreeData()
     mInputData.mValue = nullptr;
   } else {
     UnbindFromFrame(nullptr);
-    delete mInputData.mState;
+    ReleaseTextEditorState(mInputData.mState);
     mInputData.mState = nullptr;
   }
 }
@@ -5027,7 +5050,8 @@ HTMLInputElement::HandleTypeChange(uint8_t aNewType, bool aNotify)
 
   if (IsSingleLineTextControl()) {
 
-    mInputData.mState = new nsTextEditorState(this);
+    mInputData.mState =
+      nsTextEditorState::Construct(this, &sCachedTextEditorState);
     if (!sp.IsDefault()) {
       mInputData.mState->SetSelectionProperties(sp);
     }
diff --git a/dom/html/HTMLInputElement.h b/dom/html/HTMLInputElement.h
index 00b9cdebb823..094351356f60 100644
--- a/dom/html/HTMLInputElement.h
+++ b/dom/html/HTMLInputElement.h
@@ -858,6 +858,8 @@ public:
 
   void UpdateEntries(const nsTArray<OwningFileOrDirectory>& aFilesOrDirectories);
 
+  static void Shutdown();
+
 protected:
   virtual ~HTMLInputElement();
 
@@ -1771,6 +1773,11 @@ private:
     nsCOMPtr<nsIFilePicker> mFilePicker;
     RefPtr<HTMLInputElement> mInput;
   };
+
+  static void ReleaseTextEditorState(nsTextEditorState* aState);
+
+  static nsTextEditorState* sCachedTextEditorState;
+  static bool sShutdown;
 };
 
 } // namespace dom
diff --git a/dom/html/nsTextEditorState.cpp b/dom/html/nsTextEditorState.cpp
index 6966c7c94b90..db30d2f80aa5 100644
--- a/dom/html/nsTextEditorState.cpp
+++ b/dom/html/nsTextEditorState.cpp
@@ -1068,10 +1068,38 @@ nsTextEditorState::nsTextEditorState(nsITextControlElement* aOwningElement)
   , mSelectionRestoreEagerInit(false)
   , mPlaceholderVisibility(false)
   , mIsCommittingComposition(false)
+  // When adding more member variable initializations here, add the same
+  // also to ::Construct.
 {
   MOZ_COUNT_CTOR(nsTextEditorState);
 }
 
+nsTextEditorState*
+nsTextEditorState::Construct(nsITextControlElement* aOwningElement,
+                             nsTextEditorState** aReusedState)
+{
+  if (*aReusedState) {
+    nsTextEditorState* state = *aReusedState;
+    *aReusedState = nullptr;
+    state->mTextCtrlElement = aOwningElement;
+    state->mBoundFrame = nullptr;
+    state->mSelectionProperties = SelectionProperties();
+    state->mEverInited = false;
+    state->mEditorInitialized = false;
+    state->mInitializing = false;
+    state->mValueTransferInProgress = false;
+    state->mSelectionCached = true;
+    state->mSelectionRestoreEagerInit = false;
+    state->mPlaceholderVisibility = false;
+    state->mIsCommittingComposition = false;
+    // When adding more member variable initializations here, add the same
+    // also to the constructor.
+    return state;
+  }
+
+  return new nsTextEditorState(aOwningElement);
+}
+
 nsTextEditorState::~nsTextEditorState()
 {
   MOZ_COUNT_DTOR(nsTextEditorState);
diff --git a/dom/html/nsTextEditorState.h b/dom/html/nsTextEditorState.h
index e6a56e32c6f7..e6c8423d5134 100644
--- a/dom/html/nsTextEditorState.h
+++ b/dom/html/nsTextEditorState.h
@@ -135,11 +135,24 @@ class nsTextEditorState : public mozilla::SupportsWeakPtr<nsTextEditorState> {
 public:
   MOZ_DECLARE_WEAKREFERENCE_TYPENAME(nsTextEditorState)
   explicit nsTextEditorState(nsITextControlElement* aOwningElement);
+  static nsTextEditorState*
+  Construct(nsITextControlElement* aOwningElement,
+            nsTextEditorState** aReusedState);
   ~nsTextEditorState();
 
   void Traverse(nsCycleCollectionTraversalCallback& cb);
   void Unlink();
 
+  void PrepareForReuse()
+  {
+    Unlink();
+    mValue.reset();
+    mCachedValue.Truncate();
+    mValueBeingSet.Truncate();
+    mTextCtrlElement = nullptr;
+    MOZ_ASSERT(!mMutationObserver);
+  }
+
   nsIEditor* GetEditor();
   nsISelectionController* GetSelectionController() const;
   nsFrameSelection* GetConstFrameSelection();
@@ -401,7 +414,7 @@ private:
 
   // The text control element owns this object, and ensures that this object
   // has a smaller lifetime.
-  nsITextControlElement* const MOZ_NON_OWNING_REF mTextCtrlElement;
+  nsITextControlElement* MOZ_NON_OWNING_REF mTextCtrlElement;
   // mSelCon is non-null while we have an mBoundFrame.
   RefPtr<nsTextInputSelectionImpl> mSelCon;
   RefPtr<RestoreSelectionState> mRestoringSelection;
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index c77f8661cc94..810980e9c6c7 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -3982,7 +3982,7 @@ WorkerPrivateParent<Derived>::FlushReportsToSharedWorkers(
     reportErrorToBrowserConsole = false;
   }
 
-  // Finally report to broswer console if there is no any window or shared
+  // Finally report to browser console if there is no any window or shared
   // worker.
   if (reportErrorToBrowserConsole) {
     aReporter->FlushReportsToConsole(0);
diff --git a/gfx/ipc/GPUChild.cpp b/gfx/ipc/GPUChild.cpp
index c6b7dbc857e9..f529544b1cf9 100644
--- a/gfx/ipc/GPUChild.cpp
+++ b/gfx/ipc/GPUChild.cpp
@@ -18,6 +18,7 @@
 # include "mozilla/gfx/DeviceManagerDx.h"
 #endif
 #include "mozilla/ipc/CrashReporterHost.h"
+#include "mozilla/layers/LayerTreeOwnerTracker.h"
 #include "mozilla/Unused.h"
 #ifdef MOZ_GECKO_PROFILER
 #include "CrossProcessProfilerController.h"
@@ -26,6 +27,8 @@
 namespace mozilla {
 namespace gfx {
 
+using namespace layers;
+
 GPUChild::GPUChild(GPUProcessHost* aHost)
  : mHost(aHost),
    mGPUReady(false)
@@ -65,7 +68,12 @@ GPUChild::Init()
   devicePrefs.oglCompositing() = gfxConfig::GetValue(Feature::OPENGL_COMPOSITING);
   devicePrefs.useD2D1() = gfxConfig::GetValue(Feature::DIRECT2D);
 
-  SendInit(prefs, updates, devicePrefs);
+  nsTArray<LayerTreeIdMapping> mappings;
+  LayerTreeOwnerTracker::Get()->Iterate([&](uint64_t aLayersId, base::ProcessId aProcessId) {
+    mappings.AppendElement(LayerTreeIdMapping(aLayersId, aProcessId));
+  });
+
+  SendInit(prefs, updates, devicePrefs, mappings);
 
   gfxVars::AddReceiver(this);
 
diff --git a/gfx/ipc/GPUParent.cpp b/gfx/ipc/GPUParent.cpp
index 18025877e36e..1b1fd6ae0f27 100644
--- a/gfx/ipc/GPUParent.cpp
+++ b/gfx/ipc/GPUParent.cpp
@@ -147,7 +147,8 @@ GPUParent::NotifyDeviceReset()
 mozilla::ipc::IPCResult
 GPUParent::RecvInit(nsTArray<GfxPrefSetting>&& prefs,
                     nsTArray<GfxVarUpdate>&& vars,
-                    const DevicePrefs& devicePrefs)
+                    const DevicePrefs& devicePrefs,
+                    nsTArray<LayerTreeIdMapping>&& aMappings)
 {
   const nsTArray<gfxPrefs::Pref*>& globalPrefs = gfxPrefs::all();
   for (auto& setting : prefs) {
@@ -164,6 +165,10 @@ GPUParent::RecvInit(nsTArray<GfxPrefSetting>&& prefs,
   gfxConfig::Inherit(Feature::OPENGL_COMPOSITING, devicePrefs.oglCompositing());
   gfxConfig::Inherit(Feature::DIRECT2D, devicePrefs.useD2D1());
 
+  for (const LayerTreeIdMapping& map : aMappings) {
+    LayerTreeOwnerTracker::Get()->Map(map.layersId(), map.ownerId());
+  }
+
 #if defined(XP_WIN)
   if (gfxConfig::IsEnabled(Feature::D3D11_COMPOSITING)) {
     DeviceManagerDx::Get()->CreateCompositorDevices();
@@ -350,11 +355,9 @@ GPUParent::RecvNewContentVideoDecoderManager(Endpoint<PVideoDecoderManagerParent
 }
 
 mozilla::ipc::IPCResult
-GPUParent::RecvAddLayerTreeIdMapping(nsTArray<LayerTreeIdMapping>&& aMappings)
+GPUParent::RecvAddLayerTreeIdMapping(const LayerTreeIdMapping& aMapping)
 {
-  for (const LayerTreeIdMapping& map : aMappings) {
-    LayerTreeOwnerTracker::Get()->Map(map.layersId(), map.ownerId());
-  }
+  LayerTreeOwnerTracker::Get()->Map(aMapping.layersId(), aMapping.ownerId());
   return IPC_OK();
 }
 
diff --git a/gfx/ipc/GPUParent.h b/gfx/ipc/GPUParent.h
index 8facccc0a5ad..0f933843d444 100644
--- a/gfx/ipc/GPUParent.h
+++ b/gfx/ipc/GPUParent.h
@@ -32,7 +32,8 @@ public:
 
   mozilla::ipc::IPCResult RecvInit(nsTArray<GfxPrefSetting>&& prefs,
                                    nsTArray<GfxVarUpdate>&& vars,
-                                   const DevicePrefs& devicePrefs) override;
+                                   const DevicePrefs& devicePrefs,
+                                   nsTArray<LayerTreeIdMapping>&& mappings) override;
   mozilla::ipc::IPCResult RecvInitVsyncBridge(Endpoint<PVsyncBridgeParent>&& aVsyncEndpoint) override;
   mozilla::ipc::IPCResult RecvInitImageBridge(Endpoint<PImageBridgeParent>&& aEndpoint) override;
   mozilla::ipc::IPCResult RecvInitVRManager(Endpoint<PVRManagerParent>&& aEndpoint) override;
@@ -51,7 +52,7 @@ public:
   mozilla::ipc::IPCResult RecvNewContentVRManager(Endpoint<PVRManagerParent>&& aEndpoint) override;
   mozilla::ipc::IPCResult RecvNewContentVideoDecoderManager(Endpoint<PVideoDecoderManagerParent>&& aEndpoint) override;
   mozilla::ipc::IPCResult RecvGetDeviceStatus(GPUDeviceData* aOutStatus) override;
-  mozilla::ipc::IPCResult RecvAddLayerTreeIdMapping(nsTArray<LayerTreeIdMapping>&& aMappings) override;
+  mozilla::ipc::IPCResult RecvAddLayerTreeIdMapping(const LayerTreeIdMapping& aMapping) override;
   mozilla::ipc::IPCResult RecvRemoveLayerTreeIdMapping(const LayerTreeIdMapping& aMapping) override;
   mozilla::ipc::IPCResult RecvNotifyGpuObservers(const nsCString& aTopic) override;
   mozilla::ipc::IPCResult RecvStartProfiler(const ProfilerInitParams& params) override;
diff --git a/gfx/ipc/GPUProcessManager.cpp b/gfx/ipc/GPUProcessManager.cpp
index 0a98f741ba6a..eaa21a8f30dc 100644
--- a/gfx/ipc/GPUProcessManager.cpp
+++ b/gfx/ipc/GPUProcessManager.cpp
@@ -37,6 +37,10 @@
 #include "mozilla/dom/VideoDecoderManagerParent.h"
 #include "MediaPrefs.h"
 
+#ifdef MOZ_CRASHREPORTER
+# include "nsExceptionHandler.h"
+#endif
+
 #if defined(MOZ_WIDGET_ANDROID)
 #include "mozilla/widget/AndroidUiThread.h"
 #include "mozilla/layers/UiCompositorControllerChild.h"
@@ -302,11 +306,11 @@ GPUProcessManager::OnProcessLaunchComplete(GPUProcessHost* aHost)
   mVsyncBridge = VsyncBridgeChild::Create(mVsyncIOThread, mProcessToken, Move(vsyncChild));
   mGPUChild->SendInitVsyncBridge(Move(vsyncParent));
 
-  nsTArray<LayerTreeIdMapping> mappings;
-  LayerTreeOwnerTracker::Get()->Iterate([&](uint64_t aLayersId, base::ProcessId aProcessId) {
-    mappings.AppendElement(LayerTreeIdMapping(aLayersId, aProcessId));
-  });
-  mGPUChild->SendAddLayerTreeIdMapping(mappings);
+#ifdef MOZ_CRASHREPORTER
+  CrashReporter::AnnotateCrashReport(
+    NS_LITERAL_CSTRING("GPUProcessStatus"),
+    NS_LITERAL_CSTRING("Running"));
+#endif
 }
 
 static bool
@@ -530,6 +534,12 @@ GPUProcessManager::DestroyProcess()
 #if defined(MOZ_WIDGET_ANDROID)
   UiCompositorControllerChild::Shutdown();
 #endif // defined(MOZ_WIDGET_ANDROID)
+
+#ifdef MOZ_CRASHREPORTER
+  CrashReporter::AnnotateCrashReport(
+    NS_LITERAL_CSTRING("GPUProcessStatus"),
+    NS_LITERAL_CSTRING("Destroyed"));
+#endif
 }
 
 RefPtr<CompositorSession>
@@ -822,9 +832,7 @@ GPUProcessManager::MapLayerTreeId(uint64_t aLayersId, base::ProcessId aOwningId)
   LayerTreeOwnerTracker::Get()->Map(aLayersId, aOwningId);
 
   if (EnsureGPUReady()) {
-    AutoTArray<LayerTreeIdMapping, 1> mappings;
-    mappings.AppendElement(LayerTreeIdMapping(aLayersId, aOwningId));
-    mGPUChild->SendAddLayerTreeIdMapping(mappings);
+    mGPUChild->SendAddLayerTreeIdMapping(LayerTreeIdMapping(aLayersId, aOwningId));
   }
 }
 
@@ -853,6 +861,31 @@ GPUProcessManager::AllocateLayerTreeId()
   return ++mNextLayerTreeId;
 }
 
+bool
+GPUProcessManager::AllocateAndConnectLayerTreeId(PCompositorBridgeChild* aCompositorBridge,
+                                                 base::ProcessId aOtherPid,
+                                                 uint64_t* aOutLayersId)
+{
+  uint64_t layersId = AllocateLayerTreeId();
+  *aOutLayersId = layersId;
+
+  if (!mGPUChild || !aCompositorBridge) {
+    // If we're not remoting to another process, or there is no compositor,
+    // then we'll send at most one message. In this case we can just keep
+    // the old behavior of making sure the mapping occurs, and maybe sending
+    // a creation notification.
+    MapLayerTreeId(layersId, aOtherPid);
+    if (!aCompositorBridge) {
+      return false;
+    }
+    return aCompositorBridge->SendNotifyChildCreated(layersId);
+  }
+
+  // Use the combined message path.
+  LayerTreeOwnerTracker::Get()->Map(layersId, aOtherPid);
+  return aCompositorBridge->SendMapAndNotifyChildCreated(layersId, aOtherPid);
+}
+
 void
 GPUProcessManager::EnsureVsyncIOThread()
 {
diff --git a/gfx/ipc/GPUProcessManager.h b/gfx/ipc/GPUProcessManager.h
index 0b36d970307c..5978085d6618 100644
--- a/gfx/ipc/GPUProcessManager.h
+++ b/gfx/ipc/GPUProcessManager.h
@@ -116,9 +116,18 @@ public:
   // Allocate an ID that can be used to refer to a layer tree and
   // associated resources that live only on the compositor thread.
   //
-  // Must run on the content main thread.
+  // Must run on the browser main thread.
   uint64_t AllocateLayerTreeId();
 
+  // Allocate a layers ID and connect it to a compositor. If the compositor is null,
+  // the connect operation will not be performed, but an ID will still be allocated.
+  // This must be called from the browser main thread.
+  //
+  // Note that a layer tree id is always allocated, even if this returns false.
+  bool AllocateAndConnectLayerTreeId(
+    PCompositorBridgeChild* aCompositorBridge,
+    base::ProcessId aOtherPid,
+    uint64_t* aOutLayersId);
 
   void OnProcessLaunchComplete(GPUProcessHost* aHost) override;
   void OnProcessUnexpectedShutdown(GPUProcessHost* aHost) override;
diff --git a/gfx/ipc/PGPU.ipdl b/gfx/ipc/PGPU.ipdl
index a2adb9d36c66..7e17dc2713ff 100644
--- a/gfx/ipc/PGPU.ipdl
+++ b/gfx/ipc/PGPU.ipdl
@@ -52,7 +52,8 @@ parent:
   // Sent by the UI process to initiate core settings.
   async Init(GfxPrefSetting[] prefs,
              GfxVarUpdate[] vars,
-             DevicePrefs devicePrefs);
+             DevicePrefs devicePrefs,
+             LayerTreeIdMapping[] mapping);
 
   async InitVsyncBridge(Endpoint<PVsyncBridgeParent> endpoint);
   async InitImageBridge(Endpoint<PImageBridgeParent> endpoint);
@@ -78,7 +79,7 @@ parent:
   async NewContentVideoDecoderManager(Endpoint<PVideoDecoderManagerParent> endpoint);
 
   // Called to notify the GPU process of who owns a layersId.
-  sync AddLayerTreeIdMapping(LayerTreeIdMapping[] mapping);
+  sync AddLayerTreeIdMapping(LayerTreeIdMapping mapping);
   async RemoveLayerTreeIdMapping(LayerTreeIdMapping mapping);
 
   // Request the current DeviceStatus from the GPU process. This blocks until
diff --git a/gfx/layers/ipc/CompositorBridgeParent.cpp b/gfx/layers/ipc/CompositorBridgeParent.cpp
index eb59b7b95b4e..78267dbbfc24 100644
--- a/gfx/layers/ipc/CompositorBridgeParent.cpp
+++ b/gfx/layers/ipc/CompositorBridgeParent.cpp
@@ -1554,6 +1554,20 @@ CompositorBridgeParent::NotifyChildCreated(uint64_t aChild)
   sIndirectLayerTrees[aChild].mLayerManager = mLayerManager;
 }
 
+mozilla::ipc::IPCResult
+CompositorBridgeParent::RecvMapAndNotifyChildCreated(const uint64_t& aChild, const base::ProcessId& aOwnerPid)
+{
+  // We only use this message when the remote compositor is in the GPU process.
+  // It is harmless to call it, though.
+  MOZ_ASSERT(XRE_IsGPUProcess());
+
+  LayerTreeOwnerTracker::Get()->Map(aChild, aOwnerPid);
+
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
+  NotifyChildCreated(aChild);
+  return IPC_OK();
+}
+
 mozilla::ipc::IPCResult
 CompositorBridgeParent::RecvAdoptChild(const uint64_t& child)
 {
diff --git a/gfx/layers/ipc/CompositorBridgeParent.h b/gfx/layers/ipc/CompositorBridgeParent.h
index dbe7395f36d7..c7520ec9e7e8 100644
--- a/gfx/layers/ipc/CompositorBridgeParent.h
+++ b/gfx/layers/ipc/CompositorBridgeParent.h
@@ -189,6 +189,7 @@ public:
   virtual mozilla::ipc::IPCResult RecvPause() override;
   virtual mozilla::ipc::IPCResult RecvResume() override;
   virtual mozilla::ipc::IPCResult RecvNotifyChildCreated(const uint64_t& child) override;
+  virtual mozilla::ipc::IPCResult RecvMapAndNotifyChildCreated(const uint64_t& child, const base::ProcessId& pid) override;
   virtual mozilla::ipc::IPCResult RecvNotifyChildRecreated(const uint64_t& child) override;
   virtual mozilla::ipc::IPCResult RecvAdoptChild(const uint64_t& child) override;
   virtual mozilla::ipc::IPCResult RecvMakeSnapshot(const SurfaceDescriptor& aInSnapshot,
diff --git a/gfx/layers/ipc/CrossProcessCompositorBridgeParent.cpp b/gfx/layers/ipc/CrossProcessCompositorBridgeParent.cpp
index ca555f93958d..2e6d6a0887b2 100644
--- a/gfx/layers/ipc/CrossProcessCompositorBridgeParent.cpp
+++ b/gfx/layers/ipc/CrossProcessCompositorBridgeParent.cpp
@@ -264,6 +264,14 @@ CrossProcessCompositorBridgeParent::RecvNotifyChildCreated(const uint64_t& child
   return IPC_FAIL_NO_REASON(this);
 }
 
+mozilla::ipc::IPCResult
+CrossProcessCompositorBridgeParent::RecvMapAndNotifyChildCreated(const uint64_t& child, const base::ProcessId& pid)
+{
+  // This can only be called from the browser process, as the mapping
+  // ensures proper window ownership of layer trees.
+  return IPC_FAIL_NO_REASON(this);
+}
+
 void
 CrossProcessCompositorBridgeParent::ShadowLayersUpdated(
   LayerTransactionParent* aLayerTree,
diff --git a/gfx/layers/ipc/CrossProcessCompositorBridgeParent.h b/gfx/layers/ipc/CrossProcessCompositorBridgeParent.h
index 65157cf4b744..d9a889cab189 100644
--- a/gfx/layers/ipc/CrossProcessCompositorBridgeParent.h
+++ b/gfx/layers/ipc/CrossProcessCompositorBridgeParent.h
@@ -56,6 +56,7 @@ public:
   virtual mozilla::ipc::IPCResult RecvResume() override { return IPC_OK(); }
   virtual mozilla::ipc::IPCResult RecvForceIsFirstPaint() override { return IPC_OK(); }
   virtual mozilla::ipc::IPCResult RecvNotifyChildCreated(const uint64_t& child) override;
+  virtual mozilla::ipc::IPCResult RecvMapAndNotifyChildCreated(const uint64_t& child, const base::ProcessId& pid) override;
   virtual mozilla::ipc::IPCResult RecvNotifyChildRecreated(const uint64_t& child) override { return IPC_FAIL_NO_REASON(this); }
   virtual mozilla::ipc::IPCResult RecvAdoptChild(const uint64_t& child) override { return IPC_FAIL_NO_REASON(this); }
   virtual mozilla::ipc::IPCResult RecvMakeSnapshot(const SurfaceDescriptor& aInSnapshot,
diff --git a/gfx/layers/ipc/PCompositorBridge.ipdl b/gfx/layers/ipc/PCompositorBridge.ipdl
index 440ca9e8a012..a3b5c198324b 100644
--- a/gfx/layers/ipc/PCompositorBridge.ipdl
+++ b/gfx/layers/ipc/PCompositorBridge.ipdl
@@ -36,6 +36,7 @@ using class mozilla::layers::FrameUniformityData from "mozilla/layers/FrameUnifo
 using mozilla::layers::TextureFlags from "mozilla/layers/CompositorTypes.h";
 using mozilla::layers::CompositorOptions from "mozilla/layers/CompositorOptions.h";
 using mozilla::wr::PipelineId from "mozilla/webrender/WebRenderTypes.h";
+using base::ProcessId from "base/process.h";
 
 namespace mozilla {
 namespace layers {
@@ -175,6 +176,12 @@ parent:
   // there are ordering issues with SendPLayerTransactionConstructor.
   sync NotifyChildCreated(uint64_t id);
 
+  // This version of NotifyChildCreated also performs a layer tree mapping.
+  //
+  // See bug 1316632 comment #33 for why this has to be sync. Otherwise,
+  // there are ordering issues with SendPLayerTransactionConstructor.
+  sync MapAndNotifyChildCreated(uint64_t id, ProcessId owner);
+
   async AdoptChild(uint64_t id);
 
   // Same as NotifyChildCreated, but used when child processes need to
diff --git a/gfx/thebes/gfxFont.h b/gfx/thebes/gfxFont.h
index 2c114f0700d3..bb55c54b708f 100644
--- a/gfx/thebes/gfxFont.h
+++ b/gfx/thebes/gfxFont.h
@@ -89,7 +89,7 @@ struct gfxFontStyle {
     RefPtr<nsIAtom> language;
 
     // Features are composed of (1) features from style rules (2) features
-    // from feature setttings rules and (3) family-specific features.  (1) and
+    // from feature settings rules and (3) family-specific features.  (1) and
     // (3) are guaranteed to be mutually exclusive
 
     // custom opentype feature settings
diff --git a/ipc/ipdl/sync-messages.ini b/ipc/ipdl/sync-messages.ini
index 9502f445fe07..f12e99330403 100644
--- a/ipc/ipdl/sync-messages.ini
+++ b/ipc/ipdl/sync-messages.ini
@@ -992,6 +992,8 @@ description =
 description =
 [PCompositorBridge::NotifyChildCreated]
 description =
+[PCompositorBridge::MapAndNotifyChildCreated]
+description = bug 1350660
 [PCompositorBridge::NotifyChildRecreated]
 description =
 [PCompositorBridge::MakeSnapshot]
diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
index 33582ff20162..4359c3364e3d 100644
--- a/js/src/gc/GCRuntime.h
+++ b/js/src/gc/GCRuntime.h
@@ -508,7 +508,7 @@ class GCSchedulingTunables
  *      to complement MAYBEGC triggers. We track this by counting malloced
  *      bytes; the counter gets reset at every GC since we do not always have a
  *      size at the time we call free. Because of this, the malloc heuristic
- *      is, unfortunatly, not usefully able to augment our other GC heap
+ *      is, unfortunately, not usefully able to augment our other GC heap
  *      triggers and is limited to this singular heuristic.
  *
  *          Assumptions:
diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index 76a5fb08dad0..96008682088f 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -468,13 +468,18 @@ IsInlinableFallback(ICFallbackStub* icEntry)
 static inline void*
 GetStubReturnAddress(JSContext* cx, jsbytecode* pc)
 {
+    JitCompartment* jitComp = cx->compartment()->jitCompartment();
+
     if (IsGetPropPC(pc))
-        return cx->compartment()->jitCompartment()->baselineGetPropReturnAddr();
+        return jitComp->bailoutReturnAddr(BailoutReturnStub::GetProp);
     if (IsSetPropPC(pc))
-        return cx->compartment()->jitCompartment()->baselineSetPropReturnAddr();
+        return jitComp->bailoutReturnAddr(BailoutReturnStub::SetProp);
+
     // This should be a call op of some kind, now.
     MOZ_ASSERT(IsCallPC(pc) && !IsSpreadCallPC(pc));
-    return cx->compartment()->jitCompartment()->baselineCallReturnAddr(IsConstructorCallPC(pc));
+    if (IsConstructorCallPC(pc))
+        return jitComp->bailoutReturnAddr(BailoutReturnStub::New);
+    return jitComp->bailoutReturnAddr(BailoutReturnStub::Call);
 }
 
 static inline jsbytecode*
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 6a5fe313ed68..e6962472568c 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -1641,19 +1641,11 @@ ICSetProp_Fallback::Compiler::generateStubCode(MacroAssembler& masm)
     if (!tailCallVM(DoSetPropFallbackInfo, masm))
         return false;
 
-    // Even though the fallback frame doesn't enter a stub frame, the CallScripted
-    // frame that we are emulating does. Again, we lie.
-#ifdef DEBUG
-    EmitRepushTailCallReg(masm);
-    EmitStowICValues(masm, 1);
-    enterStubFrame(masm, R1.scratchReg());
-#else
-    inStubFrame_ = true;
-#endif
-
-    // What follows is bailout-only code for inlined script getters.
-    // The return address pointed to by the baseline stack points here.
-    returnOffset_ = masm.currentOffset();
+    // This is the resume point used when bailout rewrites call stack to undo
+    // Ion inlined frames. The return address pushed onto reconstructed stack
+    // will point here.
+    assumeStubFrame(masm);
+    bailoutReturnOffset_.bind(masm.currentOffset());
 
     leaveStubFrame(masm, true);
     EmitReturnFromIC(masm);
@@ -1664,7 +1656,9 @@ ICSetProp_Fallback::Compiler::generateStubCode(MacroAssembler& masm)
 void
 ICSetProp_Fallback::Compiler::postGenerateStubCode(MacroAssembler& masm, Handle<JitCode*> code)
 {
-    cx->compartment()->jitCompartment()->initBaselineSetPropReturnAddr(code->raw() + returnOffset_);
+    BailoutReturnStub kind = BailoutReturnStub::SetProp;
+    void* address = code->raw() + bailoutReturnOffset_.offset();
+    cx->compartment()->jitCompartment()->initBailoutReturnAddr(address, getKey(), kind);
 }
 
 //
@@ -1920,6 +1914,11 @@ GetTemplateObjectForNative(JSContext* cx, HandleFunction target, const CallArgs&
         return !!res;
     }
 
+    if (native == js::intrinsic_NewArrayIterator) {
+        res.set(NewArrayIteratorObject(cx, TenuredObject));
+        return !!res;
+    }
+
     if (JitSupportsSimd() && GetTemplateObjectForSimd(cx, target, res))
        return !!res;
 
@@ -2818,18 +2817,14 @@ ICCall_Fallback::Compiler::generateStubCode(MacroAssembler& masm)
     if (!callVM(DoCallFallbackInfo, masm))
         return false;
 
-    uint32_t framePushed = masm.framePushed();
     leaveStubFrame(masm);
     EmitReturnFromIC(masm);
 
-    // The following asmcode is only used when an Ion inlined frame bails out
-    // into into baseline jitcode. The return address pushed onto the
-    // reconstructed baseline stack points here.
-    returnOffset_ = masm.currentOffset();
-
-    // Here we are again in a stub frame. Marking as so.
-    inStubFrame_ = true;
-    masm.setFramePushed(framePushed);
+    // This is the resume point used when bailout rewrites call stack to undo
+    // Ion inlined frames. The return address pushed onto reconstructed stack
+    // will point here.
+    assumeStubFrame(masm);
+    bailoutReturnOffset_.bind(masm.currentOffset());
 
     // Load passed-in ThisV into R1 just in case it's needed.  Need to do this before
     // we leave the stub frame since that info will be lost.
@@ -2870,8 +2865,10 @@ ICCall_Fallback::Compiler::postGenerateStubCode(MacroAssembler& masm, Handle<Jit
     if (MOZ_UNLIKELY(isSpread_))
         return;
 
-    cx->compartment()->jitCompartment()->initBaselineCallReturnAddr(code->raw() + returnOffset_,
-                                                                    isConstructing_);
+    void* address = code->raw() + bailoutReturnOffset_.offset();
+    BailoutReturnStub kind = isConstructing_ ? BailoutReturnStub::New
+                                             : BailoutReturnStub::Call;
+    cx->compartment()->jitCompartment()->initBailoutReturnAddr(address, getKey(), kind);
 }
 
 typedef bool (*CreateThisFn)(JSContext* cx, HandleObject callee, HandleObject newTarget,
@@ -3153,8 +3150,8 @@ ICCallScriptedCompiler::generateStubCode(MacroAssembler& masm)
     EmitEnterTypeMonitorIC(masm);
 
     // Leave stub frame and restore argc for the next stub.
+    assumeStubFrame(masm);
     masm.bind(&failureLeaveStubFrame);
-    inStubFrame_ = true;
     leaveStubFrame(masm, false);
     if (argcReg != R0.scratchReg())
         masm.movePtr(argcReg, R0.scratchReg());
diff --git a/js/src/jit/BaselineIC.h b/js/src/jit/BaselineIC.h
index cc22a7003f60..95596dcd6d5c 100644
--- a/js/src/jit/BaselineIC.h
+++ b/js/src/jit/BaselineIC.h
@@ -628,13 +628,8 @@ class ICSetProp_Fallback : public ICFallbackStub
     }
 
     class Compiler : public ICStubCompiler {
-      public:
-        static const int32_t BASELINE_KEY =
-            (static_cast<int32_t>(Engine::Baseline)) |
-            (static_cast<int32_t>(ICStub::SetProp_Fallback) << 1);
-
       protected:
-        uint32_t returnOffset_;
+        CodeOffset bailoutReturnOffset_;
         MOZ_MUST_USE bool generateStubCode(MacroAssembler& masm);
         void postGenerateStubCode(MacroAssembler& masm, Handle<JitCode*> code);
 
@@ -725,22 +720,10 @@ class ICCall_Fallback : public ICMonitoredFallbackStub
 
     // Compiler for this stub kind.
     class Compiler : public ICCallStubCompiler {
-      public:
-        static const int32_t BASELINE_CALL_KEY =
-            (static_cast<int32_t>(Engine::Baseline)) |
-            (static_cast<int32_t>(ICStub::Call_Fallback) << 1) |
-            (0 << 17) | // spread
-            (0 << 18);  // constructing
-        static const int32_t BASELINE_CONSTRUCT_KEY =
-            (static_cast<int32_t>(Engine::Baseline)) |
-            (static_cast<int32_t>(ICStub::Call_Fallback) << 1) |
-            (0 << 17) | // spread
-            (1 << 18);  // constructing
-
       protected:
         bool isConstructing_;
         bool isSpread_;
-        uint32_t returnOffset_;
+        CodeOffset bailoutReturnOffset_;
         MOZ_MUST_USE bool generateStubCode(MacroAssembler& masm);
         void postGenerateStubCode(MacroAssembler& masm, Handle<JitCode*> code);
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index db658d1d1508..1222638ea976 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -5635,6 +5635,26 @@ CodeGenerator::visitNewArrayDynamicLength(LNewArrayDynamicLength* lir)
     masm.bind(ool->rejoin());
 }
 
+typedef ArrayIteratorObject* (*NewArrayIteratorObjectFn)(JSContext*, NewObjectKind);
+static const VMFunction NewArrayIteratorObjectInfo =
+    FunctionInfo<NewArrayIteratorObjectFn>(NewArrayIteratorObject, "NewArrayIteratorObject");
+
+void
+CodeGenerator::visitNewArrayIterator(LNewArrayIterator* lir)
+{
+    Register objReg = ToRegister(lir->output());
+    Register tempReg = ToRegister(lir->temp());
+    JSObject* templateObject = lir->mir()->templateObject();
+
+    OutOfLineCode* ool = oolCallVM(NewArrayIteratorObjectInfo, lir,
+                                   ArgList(Imm32(GenericObject)),
+                                   StoreRegisterTo(objReg));
+
+    masm.createGCObject(objReg, tempReg, templateObject, gc::DefaultHeap, ool->entry());
+
+    masm.bind(ool->rejoin());
+}
+
 typedef TypedArrayObject* (*TypedArrayConstructorOneArgFn)(JSContext*, HandleObject, int32_t length);
 static const VMFunction TypedArrayConstructorOneArgInfo =
     FunctionInfo<TypedArrayConstructorOneArgFn>(TypedArrayCreateWithTemplate,
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index f0f6fc0ab610..5c3cadd45586 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -198,6 +198,7 @@ class CodeGenerator final : public CodeGeneratorSpecific
     void visitOutOfLineNewArray(OutOfLineNewArray* ool);
     void visitNewArrayCopyOnWrite(LNewArrayCopyOnWrite* lir);
     void visitNewArrayDynamicLength(LNewArrayDynamicLength* lir);
+    void visitNewArrayIterator(LNewArrayIterator* lir);
     void visitNewTypedArray(LNewTypedArray* lir);
     void visitNewTypedArrayDynamicLength(LNewTypedArrayDynamicLength* lir);
     void visitNewObjectVMCall(LNewObject* lir);
diff --git a/js/src/jit/InlinableNatives.h b/js/src/jit/InlinableNatives.h
index 082bd6d009ec..200347327eee 100644
--- a/js/src/jit/InlinableNatives.h
+++ b/js/src/jit/InlinableNatives.h
@@ -129,6 +129,8 @@
                                     \
     _(IntrinsicGetNextSetEntryForIterator) \
                                     \
+    _(IntrinsicNewArrayIterator)    \
+                                    \
     _(IntrinsicArrayBufferByteLength) \
     _(IntrinsicPossiblyWrappedArrayBufferByteLength) \
                                     \
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 08b234e6ce8e..fad251168177 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -416,14 +416,11 @@ JitZoneGroup::JitZoneGroup(ZoneGroup* group)
 JitCompartment::JitCompartment()
   : stubCodes_(nullptr),
     cacheIRStubCodes_(nullptr),
-    baselineGetPropReturnAddr_(nullptr),
-    baselineSetPropReturnAddr_(nullptr),
     stringConcatStub_(nullptr),
     regExpMatcherStub_(nullptr),
     regExpSearcherStub_(nullptr),
     regExpTesterStub_(nullptr)
 {
-    baselineCallReturnAddrs_[0] = baselineCallReturnAddrs_[1] = nullptr;
 }
 
 JitCompartment::~JitCompartment()
@@ -647,17 +644,11 @@ JitCompartment::sweep(FreeOp* fop, JSCompartment* compartment)
     stubCodes_->sweep();
     cacheIRStubCodes_->sweep();
 
-    // If the sweep removed the ICCall_Fallback stub, nullptr the baselineCallReturnAddr_ field.
-    if (!stubCodes_->lookup(ICCall_Fallback::Compiler::BASELINE_CALL_KEY))
-        baselineCallReturnAddrs_[0] = nullptr;
-    if (!stubCodes_->lookup(ICCall_Fallback::Compiler::BASELINE_CONSTRUCT_KEY))
-        baselineCallReturnAddrs_[1] = nullptr;
-
-    // Similarly for the ICGetProp_Fallback stub.
-    if (!stubCodes_->lookup(ICGetProp_Fallback::Compiler::BASELINE_KEY))
-        baselineGetPropReturnAddr_ = nullptr;
-    if (!stubCodes_->lookup(ICSetProp_Fallback::Compiler::BASELINE_KEY))
-        baselineSetPropReturnAddr_ = nullptr;
+    // If the sweep removed a bailout Fallback stub, nullptr the corresponding return addr.
+    for (auto& it : bailoutReturnStubInfo_) {
+        if (!stubCodes_->lookup(it.key))
+           it = BailoutReturnStubInfo();
+    }
 
     JSRuntime* rt = fop->runtime();
     if (stringConcatStub_ && !IsMarkedUnbarriered(rt, &stringConcatStub_))
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index b8f2c2475265..5155b1cb7f37 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -632,6 +632,9 @@ class IonBuilder
     InliningResult inlineArraySlice(CallInfo& callInfo);
     InliningResult inlineArrayJoin(CallInfo& callInfo);
 
+    // Array intrinsics.
+    InliningResult inlineNewArrayIterator(CallInfo& callInfo);
+
     // Math natives.
     InliningResult inlineMathAbs(CallInfo& callInfo);
     InliningResult inlineMathFloor(CallInfo& callInfo);
diff --git a/js/src/jit/JitCompartment.h b/js/src/jit/JitCompartment.h
index d50567a39720..cedad72cca44 100644
--- a/js/src/jit/JitCompartment.h
+++ b/js/src/jit/JitCompartment.h
@@ -432,6 +432,14 @@ class JitZone
     }
 };
 
+enum class BailoutReturnStub {
+    GetProp,
+    SetProp,
+    Call,
+    New,
+    Count
+};
+
 class JitCompartment
 {
     friend class JitActivation;
@@ -461,9 +469,17 @@ class JitCompartment
 
     // Keep track of offset into various baseline stubs' code at return
     // point from called script.
-    void* baselineCallReturnAddrs_[2];
-    void* baselineGetPropReturnAddr_;
-    void* baselineSetPropReturnAddr_;
+    struct BailoutReturnStubInfo
+    {
+        void* addr;
+        uint32_t key;
+
+        BailoutReturnStubInfo() : addr(nullptr), key(0) { }
+        BailoutReturnStubInfo(void* addr_, uint32_t key_) : addr(addr_), key(key_) { }
+    };
+    mozilla::EnumeratedArray<BailoutReturnStub,
+                             BailoutReturnStub::Count,
+                             BailoutReturnStubInfo> bailoutReturnStubInfo_;
 
     // Stubs to concatenate two strings inline, or perform RegExp calls inline.
     // These bake in zone and compartment specific pointers and can't be stored
@@ -509,7 +525,7 @@ class JitCompartment
     }
 
     JitCode* getStubCode(uint32_t key) {
-        ICStubCodeMap::AddPtr p = stubCodes_->lookupForAdd(key);
+        ICStubCodeMap::Ptr p = stubCodes_->lookup(key);
         if (p)
             return p->value();
         return nullptr;
@@ -538,29 +554,13 @@ class JitCompartment
         MOZ_ASSERT(!p);
         return cacheIRStubCodes_->add(p, Move(key), stubCode);
     }
-    void initBaselineCallReturnAddr(void* addr, bool constructing) {
-        MOZ_ASSERT(baselineCallReturnAddrs_[constructing] == nullptr);
-        baselineCallReturnAddrs_[constructing] = addr;
+    void initBailoutReturnAddr(void* addr, uint32_t key, BailoutReturnStub kind) {
+        MOZ_ASSERT(bailoutReturnStubInfo_[kind].addr == nullptr);
+        bailoutReturnStubInfo_[kind] = BailoutReturnStubInfo { addr, key };
     }
-    void* baselineCallReturnAddr(bool constructing) {
-        MOZ_ASSERT(baselineCallReturnAddrs_[constructing] != nullptr);
-        return baselineCallReturnAddrs_[constructing];
-    }
-    void initBaselineGetPropReturnAddr(void* addr) {
-        MOZ_ASSERT(baselineGetPropReturnAddr_ == nullptr);
-        baselineGetPropReturnAddr_ = addr;
-    }
-    void* baselineGetPropReturnAddr() {
-        MOZ_ASSERT(baselineGetPropReturnAddr_ != nullptr);
-        return baselineGetPropReturnAddr_;
-    }
-    void initBaselineSetPropReturnAddr(void* addr) {
-        MOZ_ASSERT(baselineSetPropReturnAddr_ == nullptr);
-        baselineSetPropReturnAddr_ = addr;
-    }
-    void* baselineSetPropReturnAddr() {
-        MOZ_ASSERT(baselineSetPropReturnAddr_ != nullptr);
-        return baselineSetPropReturnAddr_;
+    void* bailoutReturnAddr(BailoutReturnStub kind) {
+        MOZ_ASSERT(bailoutReturnStubInfo_[kind].addr);
+        return bailoutReturnStubInfo_[kind].addr;
     }
 
     void toggleBarriers(bool enabled);
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 686d0ef537a3..0bdac9979d80 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -243,6 +243,14 @@ LIRGenerator::visitNewArrayDynamicLength(MNewArrayDynamicLength* ins)
     assignSafepoint(lir, ins);
 }
 
+void
+LIRGenerator::visitNewArrayIterator(MNewArrayIterator* ins)
+{
+    LNewArrayIterator* lir = new(alloc()) LNewArrayIterator(temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
 void
 LIRGenerator::visitNewTypedArray(MNewTypedArray* ins)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index c5cd456069ac..dc27c764558f 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -78,6 +78,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     void visitNewArray(MNewArray* ins);
     void visitNewArrayCopyOnWrite(MNewArrayCopyOnWrite* ins);
     void visitNewArrayDynamicLength(MNewArrayDynamicLength* ins);
+    void visitNewArrayIterator(MNewArrayIterator* ins);
     void visitNewTypedArray(MNewTypedArray* ins);
     void visitNewTypedArrayDynamicLength(MNewTypedArrayDynamicLength* ins);
     void visitNewObject(MNewObject* ins);
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index eafd0e866155..ca4bc8a06581 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -88,6 +88,10 @@ IonBuilder::inlineNativeCall(CallInfo& callInfo, JSFunction* target)
       case InlinableNative::ArraySlice:
         return inlineArraySlice(callInfo);
 
+      // Array intrinsics.
+      case InlinableNative::IntrinsicNewArrayIterator:
+        return inlineNewArrayIterator(callInfo);
+
       // Atomic natives.
       case InlinableNative::AtomicsCompareExchange:
         return inlineAtomicsCompareExchange(callInfo);
@@ -886,6 +890,32 @@ IonBuilder::inlineArraySlice(CallInfo& callInfo)
     return InliningStatus_Inlined;
 }
 
+IonBuilder::InliningResult
+IonBuilder::inlineNewArrayIterator(CallInfo& callInfo)
+{
+    if (callInfo.argc() != 0 || callInfo.constructing()) {
+        trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadForm);
+        return InliningStatus_NotInlined;
+    }
+
+    JSObject* templateObject = inspector->getTemplateObjectForNative(pc, js::intrinsic_NewArrayIterator);
+    if (!templateObject)
+        return InliningStatus_NotInlined;
+    MOZ_ASSERT(templateObject->is<ArrayIteratorObject>());
+
+    callInfo.setImplicitlyUsedUnchecked();
+
+    MConstant* templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject);
+    current->add(templateConst);
+
+    MNewArrayIterator* ins = MNewArrayIterator::New(alloc(), constraints(), templateConst);
+    current->add(ins);
+    current->push(ins);
+
+    MOZ_TRY(resumeAfter(ins));
+    return InliningStatus_Inlined;
+}
+
 IonBuilder::InliningResult
 IonBuilder::inlineMathAbs(CallInfo& callInfo)
 {
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 81f98bb12216..3849276a1791 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -3532,6 +3532,33 @@ class MNewObject
     }
 };
 
+
+class MNewArrayIterator
+  : public MUnaryInstruction,
+    public NoTypePolicy::Data
+{
+    explicit MNewArrayIterator(CompilerConstraintList* constraints, MConstant* templateConst)
+      : MUnaryInstruction(templateConst)
+    {
+        setResultType(MIRType::Object);
+        setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject()));
+        templateConst->setEmittedAtUses();
+    }
+
+  public:
+    INSTRUCTION_HEADER(NewArrayIterator)
+    TRIVIAL_NEW_WRAPPERS
+
+    JSObject* templateObject() {
+        return getOperand(0)->toConstant()->toObjectOrNull();
+    }
+
+    AliasSet getAliasSet() const override {
+        return AliasSet::None();
+    }
+};
+
+
 class MNewTypedObject : public MNullaryInstruction
 {
     CompilerGCPointer<InlineTypedObject*> templateObject_;
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index df2bddefd13a..f64293b0fda0 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -133,6 +133,7 @@ namespace jit {
     _(NewArray)                                                             \
     _(NewArrayCopyOnWrite)                                                  \
     _(NewArrayDynamicLength)                                                \
+    _(NewArrayIterator)                                                     \
     _(NewTypedArray)                                                        \
     _(NewTypedArrayDynamicLength)                                           \
     _(NewObject)                                                            \
diff --git a/js/src/jit/SharedIC.cpp b/js/src/jit/SharedIC.cpp
index 6d85b2ed4d82..14074d988684 100644
--- a/js/src/jit/SharedIC.cpp
+++ b/js/src/jit/SharedIC.cpp
@@ -580,6 +580,21 @@ ICStubCompiler::enterStubFrame(MacroAssembler& masm, Register scratch)
 #endif
 }
 
+void
+ICStubCompiler::assumeStubFrame(MacroAssembler& masm)
+{
+    MOZ_ASSERT(!inStubFrame_);
+    inStubFrame_ = true;
+
+#ifdef DEBUG
+    entersStubFrame_ = true;
+
+    // |framePushed| isn't tracked precisely in ICStubs, so simply assume it to
+    // be STUB_FRAME_SIZE so that assertions don't fail in leaveStubFrame.
+    framePushedAtEnterStubFrame_ = STUB_FRAME_SIZE;
+#endif
+}
+
 void
 ICStubCompiler::leaveStubFrame(MacroAssembler& masm, bool calledIntoIon)
 {
@@ -2077,18 +2092,11 @@ ICGetProp_Fallback::Compiler::generateStubCode(MacroAssembler& masm)
     if (!tailCallVM(DoGetPropFallbackInfo, masm))
         return false;
 
-    // Even though the fallback frame doesn't enter a stub frame, the CallScripted
-    // frame that we are emulating does. Again, we lie.
-#ifdef DEBUG
-    EmitRepushTailCallReg(masm);
-    enterStubFrame(masm, R0.scratchReg());
-#else
-    inStubFrame_ = true;
-#endif
-
-    // What follows is bailout for inlined scripted getters.
-    // The return address pointed to by the baseline stack points here.
-    returnOffset_ = masm.currentOffset();
+    // This is the resume point used when bailout rewrites call stack to undo
+    // Ion inlined frames. The return address pushed onto reconstructed stack
+    // will point here.
+    assumeStubFrame(masm);
+    bailoutReturnOffset_.bind(masm.currentOffset());
 
     leaveStubFrame(masm, true);
 
@@ -2106,8 +2114,9 @@ void
 ICGetProp_Fallback::Compiler::postGenerateStubCode(MacroAssembler& masm, Handle<JitCode*> code)
 {
     if (engine_ == Engine::Baseline) {
-        void* address = code->raw() + returnOffset_;
-        cx->compartment()->jitCompartment()->initBaselineGetPropReturnAddr(address);
+        BailoutReturnStub kind = BailoutReturnStub::GetProp;
+        void* address = code->raw() + bailoutReturnOffset_.offset();
+        cx->compartment()->jitCompartment()->initBailoutReturnAddr(address, getKey(), kind);
     }
 }
 
diff --git a/js/src/jit/SharedIC.h b/js/src/jit/SharedIC.h
index d384233acfca..3fba722913c0 100644
--- a/js/src/jit/SharedIC.h
+++ b/js/src/jit/SharedIC.h
@@ -1073,6 +1073,7 @@ class ICStubCompiler
     // performing a tail call. This is required for the return address
     // to pc mapping to work.
     void enterStubFrame(MacroAssembler& masm, Register scratch);
+    void assumeStubFrame(MacroAssembler& masm);
     void leaveStubFrame(MacroAssembler& masm, bool calledIntoIon = false);
 
     // Some stubs need to emit Gecko Profiler updates.  This emits the guarding
@@ -2346,13 +2347,8 @@ class ICGetProp_Fallback : public ICMonitoredFallbackStub
     }
 
     class Compiler : public ICStubCompiler {
-      public:
-        static const int32_t BASELINE_KEY =
-            (static_cast<int32_t>(Engine::Baseline)) |
-            (static_cast<int32_t>(ICStub::GetProp_Fallback) << 1);
-
       protected:
-        uint32_t returnOffset_;
+        CodeOffset bailoutReturnOffset_;
         MOZ_MUST_USE bool generateStubCode(MacroAssembler& masm);
         void postGenerateStubCode(MacroAssembler& masm, Handle<JitCode*> code);
 
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index c50683fc3561..30054310f3d7 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -282,6 +282,7 @@ template <> struct TypeToDataType<NamedLambdaObject*> { static const DataType re
 template <> struct TypeToDataType<LexicalEnvironmentObject*> { static const DataType result = Type_Object; };
 template <> struct TypeToDataType<ArrayObject*> { static const DataType result = Type_Object; };
 template <> struct TypeToDataType<TypedArrayObject*> { static const DataType result = Type_Object; };
+template <> struct TypeToDataType<ArrayIteratorObject*> { static const DataType result = Type_Object; };
 template <> struct TypeToDataType<JSString*> { static const DataType result = Type_Object; };
 template <> struct TypeToDataType<JSFlatString*> { static const DataType result = Type_Object; };
 template <> struct TypeToDataType<HandleObject> { static const DataType result = Type_Handle; };
diff --git a/js/src/jit/shared/LIR-shared.h b/js/src/jit/shared/LIR-shared.h
index 62e54ea1fed6..efab506281e8 100644
--- a/js/src/jit/shared/LIR-shared.h
+++ b/js/src/jit/shared/LIR-shared.h
@@ -1062,6 +1062,24 @@ class LNewArrayDynamicLength : public LInstructionHelper<1, 1, 1>
     }
 };
 
+class LNewArrayIterator : public LInstructionHelper<1, 0, 1>
+{
+  public:
+    LIR_HEADER(NewArrayIterator)
+
+    explicit LNewArrayIterator(const LDefinition& temp) {
+        setTemp(0, temp);
+    }
+
+    const LDefinition* temp() {
+        return getTemp(0);
+    }
+
+    MNewArrayIterator* mir() const {
+        return mir_->toNewArrayIterator();
+    }
+};
+
 class LNewTypedArray : public LInstructionHelper<1, 0, 2>
 {
   public:
diff --git a/js/src/jit/shared/LOpcodes-shared.h b/js/src/jit/shared/LOpcodes-shared.h
index c270335f34cc..74f340df3992 100644
--- a/js/src/jit/shared/LOpcodes-shared.h
+++ b/js/src/jit/shared/LOpcodes-shared.h
@@ -67,6 +67,7 @@
     _(NewArray)                     \
     _(NewArrayCopyOnWrite)          \
     _(NewArrayDynamicLength)        \
+    _(NewArrayIterator)             \
     _(NewTypedArray)                \
     _(NewTypedArrayDynamicLength)   \
     _(NewObject)                    \
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 74b56a8bd2b1..46b21460f4f8 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -1499,6 +1499,15 @@ JS_NewExternalString(JSContext* cx, const char16_t* chars, size_t length,
     return s;
 }
 
+JS_PUBLIC_API(JSString*)
+JS_NewMaybeExternalString(JSContext* cx, const char16_t* chars, size_t length,
+                          const JSStringFinalizer* fin, bool* isExternal)
+{
+    AssertHeapIsIdle();
+    CHECK_REQUEST(cx);
+    return NewMaybeExternalString(cx, chars, length, fin, isExternal);
+}
+
 extern JS_PUBLIC_API(bool)
 JS_IsExternalString(JSString* str)
 {
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 69be56f4be6e..6ecd50c31826 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -1854,6 +1854,17 @@ extern JS_PUBLIC_API(JSString*)
 JS_NewExternalString(JSContext* cx, const char16_t* chars, size_t length,
                      const JSStringFinalizer* fin);
 
+/**
+ * Create a new JSString whose chars member may refer to external memory.
+ * If the returned string refers to the external memory, |*isExternal| is set
+ * to true.  Otherwise the returned string is not an external string and
+ * |*isExternal| is set to false.  If |*isExternal| is false, |fin| won't be
+ * called.
+ */
+extern JS_PUBLIC_API(JSString*)
+JS_NewMaybeExternalString(JSContext* cx, const char16_t* chars, size_t length,
+                          const JSStringFinalizer* fin, bool* isExternal);
+
 /**
  * Return whether 'str' was created with JS_NewExternalString or
  * JS_NewExternalStringWithClosure.
diff --git a/js/src/jsiter.cpp b/js/src/jsiter.cpp
index b958bd992fb0..03c0b2555ecb 100644
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -1134,6 +1134,17 @@ const Class ArrayIteratorObject::class_ = {
     JSCLASS_HAS_RESERVED_SLOTS(ArrayIteratorSlotCount)
 };
 
+
+ArrayIteratorObject*
+js::NewArrayIteratorObject(JSContext* cx, NewObjectKind newKind)
+{
+    RootedObject proto(cx, GlobalObject::getOrCreateArrayIteratorPrototype(cx, cx->global()));
+    if (!proto)
+        return nullptr;
+
+    return NewObjectWithGivenProto<ArrayIteratorObject>(cx, proto, newKind);
+}
+
 static const JSFunctionSpec array_iterator_methods[] = {
     JS_SELF_HOSTED_FN("next", "ArrayIteratorNext", 0, 0),
     JS_FS_END
diff --git a/js/src/jsiter.h b/js/src/jsiter.h
index ada903dbb6d7..cf2c9c710804 100644
--- a/js/src/jsiter.h
+++ b/js/src/jsiter.h
@@ -145,6 +145,9 @@ class ArrayIteratorObject : public JSObject
     static const Class class_;
 };
 
+ArrayIteratorObject*
+NewArrayIteratorObject(JSContext* cx, NewObjectKind newKind = GenericObject);
+
 class StringIteratorObject : public JSObject
 {
   public:
diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
index 9f24c80f3cea..570674c14a26 100644
--- a/js/src/jsmath.cpp
+++ b/js/src/jsmath.cpp
@@ -68,6 +68,19 @@
 #  define GETRANDOM_NR 355
 # elif defined(__arm__)
 #  define GETRANDOM_NR 384
+// Added other architectures:
+# elif defined(__ppc64le__)
+#  define GETRANDOM_NR 359
+# elif defined(__PPC64LE__)
+#  define GETRANDOM_NR 359
+# elif defined(__ppc64__)
+#  define GETRANDOM_NR 359
+# elif defined(__PPC64__)
+#  define GETRANDOM_NR 359
+# elif defined(__s390x__)
+#  define GETRANDOM_NR 349
+# elif defined(__s390__)
+#  define GETRANDOM_NR 349
 # endif
 
 # if defined(SYS_getrandom)
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index 0d05e5784190..5c54e25b062b 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -18,6 +18,7 @@
 #include "jsfriendapi.h"
 #include "jsfun.h"
 #include "jshashutil.h"
+#include "jsiter.h"
 #include "jsstr.h"
 #include "jsweakmap.h"
 #include "jswrapper.h"
@@ -754,17 +755,13 @@ intrinsic_GetIteratorPrototype(JSContext* cx, unsigned argc, Value* vp)
     return true;
 }
 
-static bool
-intrinsic_NewArrayIterator(JSContext* cx, unsigned argc, Value* vp)
+bool
+js::intrinsic_NewArrayIterator(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     MOZ_ASSERT(args.length() == 0);
 
-    RootedObject proto(cx, GlobalObject::getOrCreateArrayIteratorPrototype(cx, cx->global()));
-    if (!proto)
-        return false;
-
-    JSObject* obj = NewObjectWithGivenProto(cx, &ArrayIteratorObject::class_, proto);
+    JSObject* obj = NewArrayIteratorObject(cx);
     if (!obj)
         return false;
 
@@ -2441,7 +2438,9 @@ static const JSFunctionSpec intrinsic_functions[] = {
 
     JS_FN("GetIteratorPrototype",    intrinsic_GetIteratorPrototype,    0,0),
 
-    JS_FN("NewArrayIterator",        intrinsic_NewArrayIterator,        0,0),
+    JS_INLINABLE_FN("NewArrayIterator", intrinsic_NewArrayIterator,     0,0,
+                    IntrinsicNewArrayIterator),
+
     JS_FN("CallArrayIteratorMethodIfWrapped",
           CallNonGenericSelfhostedMethod<Is<ArrayIteratorObject>>,      2,0),
 
diff --git a/js/src/vm/SelfHosting.h b/js/src/vm/SelfHosting.h
index f4f2a44473da..321297aca65d 100644
--- a/js/src/vm/SelfHosting.h
+++ b/js/src/vm/SelfHosting.h
@@ -47,6 +47,9 @@ CallSelfHostedFunction(JSContext* cx, HandlePropertyName name, HandleValue thisv
 bool
 intrinsic_StringSplitString(JSContext* cx, unsigned argc, JS::Value* vp);
 
+bool
+intrinsic_NewArrayIterator(JSContext* cx, unsigned argc, JS::Value* vp);
+
 } /* namespace js */
 
 #endif /* vm_SelfHosting_h_ */
diff --git a/js/src/vm/String.cpp b/js/src/vm/String.cpp
index 67ddee95ca01..dea67000199e 100644
--- a/js/src/vm/String.cpp
+++ b/js/src/vm/String.cpp
@@ -1413,6 +1413,19 @@ NewStringCopyUTF8N(JSContext* cx, const JS::UTF8Chars utf8)
 template JSFlatString*
 NewStringCopyUTF8N<CanGC>(JSContext* cx, const JS::UTF8Chars utf8);
 
+JSString*
+NewMaybeExternalString(JSContext* cx, const char16_t* s, size_t n, const JSStringFinalizer* fin,
+                       bool* isExternal)
+{
+    if (JSString* str = TryEmptyOrStaticString(cx, s, n)) {
+        *isExternal = false;
+        return str;
+    }
+
+    *isExternal = true;
+    return JSExternalString::new_(cx, s, n, fin);
+}
+
 } /* namespace js */
 
 #ifdef DEBUG
diff --git a/js/src/vm/String.h b/js/src/vm/String.h
index 0a529fcd4a37..490c16006994 100644
--- a/js/src/vm/String.h
+++ b/js/src/vm/String.h
@@ -1313,6 +1313,10 @@ NewStringCopyUTF8Z(JSContext* cx, const JS::ConstUTF8CharsZ utf8)
     return NewStringCopyUTF8N<allowGC>(cx, JS::UTF8Chars(utf8.c_str(), strlen(utf8.c_str())));
 }
 
+JSString*
+NewMaybeExternalString(JSContext* cx, const char16_t* s, size_t n, const JSStringFinalizer* fin,
+                       bool* isExternal);
+
 JS_STATIC_ASSERT(sizeof(HashNumber) == 4);
 
 } /* namespace js */
diff --git a/js/src/vtune/VTuneWrapper.cpp b/js/src/vtune/VTuneWrapper.cpp
index 366410512028..a06c843709ea 100644
--- a/js/src/vtune/VTuneWrapper.cpp
+++ b/js/src/vtune/VTuneWrapper.cpp
@@ -16,7 +16,6 @@
 #include "threading/Mutex.h"
 #include "vm/MutexIDs.h"
 #include "vm/Shape.h"
-#include "wasm/WasmCode.h"
 
 #ifdef MOZ_VTUNE
 
@@ -133,13 +132,13 @@ MarkScript(const js::jit::JitCode* code, const JSScript* script, const char* mod
 }
 
 void
-MarkWasm(const js::wasm::CodeSegment& cs, const char* name, void* start, uintptr_t size)
+MarkWasm(unsigned methodId, const char* name, void* start, uintptr_t size)
 {
     if (!IsProfilingActive())
         return;
 
     iJIT_Method_Load_V2 method = {0};
-    method.method_id = cs.vtune_method_id_;
+    method.method_id = methodId;
     method.method_name = const_cast<char*>(name);
     method.method_load_address = start;
     method.method_size = (unsigned)size;
diff --git a/js/src/vtune/VTuneWrapper.h b/js/src/vtune/VTuneWrapper.h
index 5b1217867271..d747952cf526 100644
--- a/js/src/vtune/VTuneWrapper.h
+++ b/js/src/vtune/VTuneWrapper.h
@@ -15,7 +15,6 @@
 #include "jsscript.h"
 
 #include "jit/IonCode.h"
-#include "wasm/WasmCode.h"
 
 namespace js {
 namespace vtune {
@@ -38,7 +37,7 @@ void MarkScript(const js::jit::JitCode* code,
                 const JSScript* script,
                 const char* module);
 
-void MarkWasm(const js::wasm::CodeSegment& cs,
+void MarkWasm(unsigned methodId,
               const char* name,
               void* start,
               uintptr_t size);
diff --git a/js/src/wasm/WasmCode.cpp b/js/src/wasm/WasmCode.cpp
index e1f6db8d6230..5551d1ec5247 100644
--- a/js/src/wasm/WasmCode.cpp
+++ b/js/src/wasm/WasmCode.cpp
@@ -159,10 +159,8 @@ SendCodeRangesToProfiler(CodeSegment& cs, const Bytes& bytecode, const Metadata&
         }
 #endif
 #ifdef MOZ_VTUNE
-        if (vtune::IsProfilingActive()) {
-            cs.vtune_method_id_ = vtune::GenerateUniqueMethodID();
-            vtune::MarkWasm(cs, name.begin(), (void*)start, size);
-        }
+        if (vtune::IsProfilingActive())
+            vtune::MarkWasm(vtune::GenerateUniqueMethodID(), name.begin(), (void*)start, size);
 #endif
     }
 
diff --git a/js/src/wasm/WasmCode.h b/js/src/wasm/WasmCode.h
index e8c8653572ed..75e8700eea25 100644
--- a/js/src/wasm/WasmCode.h
+++ b/js/src/wasm/WasmCode.h
@@ -57,11 +57,6 @@ class CodeSegment
     uint8_t* outOfBoundsCode_;
     uint8_t* unalignedAccessCode_;
 
-  public:
-#ifdef MOZ_VTUNE
-    unsigned vtune_method_id_; // Zero if unset.
-#endif
-
   protected:
     CodeSegment() { PodZero(this); }
     template <class> friend struct js::MallocProvider;
diff --git a/js/xpconnect/src/XPCString.cpp b/js/xpconnect/src/XPCString.cpp
index 42a57744ea51..006ebe120576 100644
--- a/js/xpconnect/src/XPCString.cpp
+++ b/js/xpconnect/src/XPCString.cpp
@@ -96,9 +96,10 @@ XPCStringConvert::ReadableToJSVal(JSContext* cx,
     uint32_t length = readable.Length();
 
     if (readable.IsLiteral()) {
-        JSString* str = JS_NewExternalString(cx,
-                                             static_cast<const char16_t*>(readable.BeginReading()),
-                                             length, &sLiteralFinalizer);
+        bool ignored;
+        JSString* str = JS_NewMaybeExternalString(cx,
+                                                  static_cast<const char16_t*>(readable.BeginReading()),
+                                                  length, &sLiteralFinalizer, &ignored);
         if (!str)
             return false;
         vp.setString(str);
diff --git a/js/xpconnect/src/xpcpublic.h b/js/xpconnect/src/xpcpublic.h
index 5115b7ea198f..46fc230f30c7 100644
--- a/js/xpconnect/src/xpcpublic.h
+++ b/js/xpconnect/src/xpcpublic.h
@@ -267,13 +267,22 @@ public:
             return true;
         }
 
-        JSString* str = JS_NewExternalString(cx,
-                                             static_cast<char16_t*>(buf->Data()),
-                                             length, &sDOMStringFinalizer);
+        bool isExternal;
+        JSString* str = JS_NewMaybeExternalString(cx,
+                                                  static_cast<char16_t*>(buf->Data()),
+                                                  length, &sDOMStringFinalizer, &isExternal);
         if (!str) {
             return false;
         }
         rval.setString(str);
+
+        // If JS_NewMaybeExternalString returns non-external string, finalizer
+        // won't be called.  Do not store it to cache.
+        if (!isExternal) {
+            *sharedBuffer = false;
+            return true;
+        }
+
         if (!cache) {
             cache = new ZoneStringCache();
             JS_SetZoneUserData(zone, cache);
diff --git a/layout/base/nsRefreshDriver.cpp b/layout/base/nsRefreshDriver.cpp
index c4deb3b286f9..701664db63b5 100644
--- a/layout/base/nsRefreshDriver.cpp
+++ b/layout/base/nsRefreshDriver.cpp
@@ -936,12 +936,6 @@ NS_IMPL_ISUPPORTS(VsyncChildCreateCallback, nsIIPCBackgroundChildCreateCallback)
 static RefreshDriverTimer* sRegularRateTimer;
 static InactiveRefreshDriverTimer* sThrottledRateTimer;
 
-#ifdef XP_WIN
-static int32_t sHighPrecisionTimerRequests = 0;
-// a bare pointer to avoid introducing a static constructor
-static nsITimer *sDisableHighPrecisionTimersTimer = nullptr;
-#endif
-
 static void
 CreateContentVsyncRefreshTimer(void*)
 {
@@ -1021,16 +1015,6 @@ nsRefreshDriver::Shutdown()
 
   sRegularRateTimer = nullptr;
   sThrottledRateTimer = nullptr;
-
-#ifdef XP_WIN
-  if (sDisableHighPrecisionTimersTimer) {
-    sDisableHighPrecisionTimersTimer->Cancel();
-    NS_RELEASE(sDisableHighPrecisionTimersTimer);
-    timeEndPeriod(1);
-  } else if (sHighPrecisionTimerRequests) {
-    timeEndPeriod(1);
-  }
-#endif
 }
 
 /* static */ int32_t
@@ -1134,7 +1118,6 @@ nsRefreshDriver::nsRefreshDriver(nsPresContext* aPresContext)
     mNeedToRecomputeVisibility(false),
     mTestControllingRefreshes(false),
     mViewManagerFlushIsPending(false),
-    mRequestedHighPrecision(false),
     mInRefresh(false),
     mWaitingForTransaction(false),
     mSkippedPaints(false),
@@ -1374,89 +1357,6 @@ nsRefreshDriver::StopTimer()
 
   mActiveTimer->RemoveRefreshDriver(this);
   mActiveTimer = nullptr;
-
-  if (mRequestedHighPrecision) {
-    SetHighPrecisionTimersEnabled(false);
-  }
-}
-
-#ifdef XP_WIN
-static void
-DisableHighPrecisionTimersCallback(nsITimer *aTimer, void *aClosure)
-{
-  timeEndPeriod(1);
-  NS_RELEASE(sDisableHighPrecisionTimersTimer);
-}
-#endif
-
-void
-nsRefreshDriver::ConfigureHighPrecision()
-{
-  bool haveUnthrottledFrameRequestCallbacks =
-    mFrameRequestCallbackDocs.Length() > 0;
-
-  // if the only change that's needed is that we need high precision,
-  // then just set that
-  if (!mThrottled && !mRequestedHighPrecision &&
-      haveUnthrottledFrameRequestCallbacks) {
-    SetHighPrecisionTimersEnabled(true);
-  } else if (mRequestedHighPrecision && !haveUnthrottledFrameRequestCallbacks) {
-    SetHighPrecisionTimersEnabled(false);
-  }
-}
-
-void
-nsRefreshDriver::SetHighPrecisionTimersEnabled(bool aEnable)
-{
-  LOG("[%p] SetHighPrecisionTimersEnabled (%s)", this, aEnable ? "true" : "false");
-
-  if (aEnable) {
-    NS_ASSERTION(!mRequestedHighPrecision, "SetHighPrecisionTimersEnabled(true) called when already requested!");
-#ifdef XP_WIN
-    if (++sHighPrecisionTimerRequests == 1) {
-      // If we had a timer scheduled to disable it, that means that it's already
-      // enabled; just cancel the timer.  Otherwise, really enable it.
-      if (sDisableHighPrecisionTimersTimer) {
-        sDisableHighPrecisionTimersTimer->Cancel();
-        NS_RELEASE(sDisableHighPrecisionTimersTimer);
-      } else {
-        timeBeginPeriod(1);
-      }
-    }
-#endif
-    mRequestedHighPrecision = true;
-  } else {
-    NS_ASSERTION(mRequestedHighPrecision, "SetHighPrecisionTimersEnabled(false) called when not requested!");
-#ifdef XP_WIN
-    if (--sHighPrecisionTimerRequests == 0) {
-      // Don't jerk us around between high precision and low precision
-      // timers; instead, only allow leaving high precision timers
-      // after 90 seconds.  This is arbitrary, but hopefully good
-      // enough.
-      NS_ASSERTION(!sDisableHighPrecisionTimersTimer, "We shouldn't have an outstanding disable-high-precision timer !");
-
-      nsCOMPtr<nsITimer> timer = do_CreateInstance(NS_TIMER_CONTRACTID);
-      if (timer) {
-        if (nsPresContext* pc = GetPresContext()) {
-          timer->SetTarget(
-              pc->Document()->EventTargetFor(TaskCategory::Other));
-        }
-        timer.forget(&sDisableHighPrecisionTimersTimer);
-        sDisableHighPrecisionTimersTimer->
-          InitWithNamedFuncCallback(DisableHighPrecisionTimersCallback,
-                                    nullptr,
-                                    90 * 1000,
-                                    nsITimer::TYPE_ONE_SHOT,
-                                    "DisableHighPrecisionTimersCallback");
-      } else {
-        // might happen if we're shutting down XPCOM; just drop the time period down
-        // immediately
-        timeEndPeriod(1);
-      }
-    }
-#endif
-    mRequestedHighPrecision = false;
-  }
 }
 
 uint32_t
@@ -2058,8 +1958,6 @@ nsRefreshDriver::Tick(int64_t aNowEpoch, TimeStamp aNowTime)
     observer->DidRefresh();
   }
 
-  ConfigureHighPrecision();
-
   NS_ASSERTION(mInRefresh, "Still in refresh");
 
   if (mPresContext->IsRoot() && XRE_IsContentProcess() && gfxPrefs::AlwaysPaint()) {
@@ -2335,7 +2233,6 @@ nsRefreshDriver::ScheduleFrameRequestCallbacks(nsIDocument* aDocument)
   }
 
   // make sure that the timer is running
-  ConfigureHighPrecision();
   EnsureTimerStarted();
 }
 
@@ -2344,7 +2241,6 @@ nsRefreshDriver::RevokeFrameRequestCallbacks(nsIDocument* aDocument)
 {
   mFrameRequestCallbackDocs.RemoveElement(aDocument);
   mThrottledFrameRequestCallbackDocs.RemoveElement(aDocument);
-  ConfigureHighPrecision();
   // No need to worry about restarting our timer in slack mode if it's already
   // running; that will happen automatically when it fires.
 }
diff --git a/layout/base/nsRefreshDriver.h b/layout/base/nsRefreshDriver.h
index bab403d0457f..7ef4ecf4fec2 100644
--- a/layout/base/nsRefreshDriver.h
+++ b/layout/base/nsRefreshDriver.h
@@ -438,7 +438,6 @@ private:
   bool mNeedToRecomputeVisibility;
   bool mTestControllingRefreshes;
   bool mViewManagerFlushIsPending;
-  bool mRequestedHighPrecision;
   bool mInRefresh;
 
   // True if the refresh driver is suspended waiting for transaction
@@ -488,10 +487,6 @@ private:
 
   friend class mozilla::RefreshDriverTimer;
 
-  // turn on or turn off high precision based on various factors
-  void ConfigureHighPrecision();
-  void SetHighPrecisionTimersEnabled(bool aEnable);
-
   static void Shutdown();
 
   // `true` if we are currently in jank-critical mode.
diff --git a/layout/ipc/RenderFrameParent.cpp b/layout/ipc/RenderFrameParent.cpp
index feb90742e8b8..5e81e426fceb 100644
--- a/layout/ipc/RenderFrameParent.cpp
+++ b/layout/ipc/RenderFrameParent.cpp
@@ -114,12 +114,18 @@ RenderFrameParent::Init(nsFrameLoader* aFrameLoader)
 
   TabParent* browser = TabParent::GetFrom(mFrameLoader);
   if (XRE_IsParentProcess()) {
+    PCompositorBridgeChild* compositor = nullptr;
+    if (lm) {
+      compositor = lm->GetCompositorBridgeChild();
+    }
+
     // Our remote frame will push layers updates to the compositor,
     // and we'll keep an indirect reference to that tree.
-    browser->Manager()->AsContentParent()->AllocateLayerTreeId(browser, &mLayersId);
-    if (lm && lm->GetCompositorBridgeChild()) {
-      mLayersConnected = lm->GetCompositorBridgeChild()->SendNotifyChildCreated(mLayersId);
-    }
+    GPUProcessManager* gpm = GPUProcessManager::Get();
+    mLayersConnected = gpm->AllocateAndConnectLayerTreeId(
+      compositor,
+      browser->Manager()->AsContentParent()->OtherPid(),
+      &mLayersId);
   } else if (XRE_IsContentProcess()) {
     ContentChild::GetSingleton()->SendAllocateLayerTreeId(browser->Manager()->ChildID(), browser->GetTabId(), &mLayersId);
     mLayersConnected = CompositorBridgeChild::Get()->SendNotifyChildCreated(mLayersId);
diff --git a/media/libcubeb/README_MOZILLA b/media/libcubeb/README_MOZILLA
index 2d0187765714..5b7de80cda91 100644
--- a/media/libcubeb/README_MOZILLA
+++ b/media/libcubeb/README_MOZILLA
@@ -5,4 +5,4 @@ Makefile.in build files for the Mozilla build system.
 
 The cubeb git repository is: git://github.com/kinetiknz/cubeb.git
 
-The git commit ID used was 4ab4577699fb42931f0fbd39826fa085dace4589 (2017-03-15 13:48:03 +0100)
+The git commit ID used was 04826edb13c23a2b53732d63b09b24e05ca83d87 (2017-03-31 09:05:07 -0700)
diff --git a/media/libcubeb/gtest/test_overload_callback.cpp b/media/libcubeb/gtest/test_overload_callback.cpp
index a4ec1b2c1a51..fa2322269652 100644
--- a/media/libcubeb/gtest/test_overload_callback.cpp
+++ b/media/libcubeb/gtest/test_overload_callback.cpp
@@ -28,28 +28,28 @@ std::atomic<bool> load_callback{ false };
 long data_cb(cubeb_stream * stream, void * user, const void * inputbuffer, void * outputbuffer, long nframes)
 {
   if (load_callback) {
-    printf("Sleeping...\n");
+    fprintf(stderr, "Sleeping...\n");
     delay(100000);
-    printf("Sleeping done\n");
+    fprintf(stderr, "Sleeping done\n");
   }
   return nframes;
 }
 
 void state_cb(cubeb_stream * stream, void * /*user*/, cubeb_state state)
 {
-  assert(stream);
+  ASSERT_TRUE(!!stream);
 
   switch (state) {
   case CUBEB_STATE_STARTED:
-    printf("stream started\n"); break;
+    fprintf(stderr, "stream started\n"); break;
   case CUBEB_STATE_STOPPED:
-    printf("stream stopped\n"); break;
+    fprintf(stderr, "stream stopped\n"); break;
   case CUBEB_STATE_DRAINED:
-    assert(false && "this test is not supposed to drain"); break;
+    FAIL() << "this test is not supposed to drain"; break;
   case CUBEB_STATE_ERROR:
-    printf("stream error\n"); break;
+    fprintf(stderr, "stream error\n"); break;
   default:
-    assert(false && "this test is not supposed to have a weird state"); break;
+    FAIL() << "this test is not supposed to have a weird state"; break;
   }
 }
 
diff --git a/media/libcubeb/src/cubeb.c b/media/libcubeb/src/cubeb.c
index d29e518dbb6d..23aadaac7619 100644
--- a/media/libcubeb/src/cubeb.c
+++ b/media/libcubeb/src/cubeb.c
@@ -25,6 +25,9 @@ struct cubeb_stream {
 #if defined(USE_PULSE)
 int pulse_init(cubeb ** context, char const * context_name);
 #endif
+#if defined(USE_PULSE_RUST)
+int pulse_rust_init(cubeb ** contet, char const * context_name);
+#endif
 #if defined(USE_JACK)
 int jack_init (cubeb ** context, char const * context_name);
 #endif
@@ -111,6 +114,10 @@ cubeb_init(cubeb ** context, char const * context_name, char const * backend_nam
     if (!strcmp(backend_name, "pulse")) {
 #if defined(USE_PULSE)
       init_oneshot = pulse_init;
+#endif
+    } else if (!strcmp(backend_name, "pulse-rust")) {
+#if defined(USE_PULSE_RUST)
+      init_oneshot = pulse_rust_init;
 #endif
     } else if (!strcmp(backend_name, "jack")) {
 #if defined(USE_JACK)
diff --git a/media/libcubeb/src/cubeb_audiounit.cpp b/media/libcubeb/src/cubeb_audiounit.cpp
index 6cbea65db990..d741f9c3ad4e 100644
--- a/media/libcubeb/src/cubeb_audiounit.cpp
+++ b/media/libcubeb/src/cubeb_audiounit.cpp
@@ -158,9 +158,9 @@ struct mixing_wrapper {
 template <typename T>
 struct mixing_impl : public mixing_wrapper {
 
-  typedef std::function<void(T * const, long, T *,
-                             unsigned int, unsigned int,
-                             cubeb_channel_layout, cubeb_channel_layout)> downmix_func;
+  typedef void (*downmix_func)(T * const, long, T *,
+                               unsigned int, unsigned int,
+                               cubeb_channel_layout, cubeb_channel_layout);
 
   mixing_impl(downmix_func dmfunc) {
     downmix_wrapper = dmfunc;
@@ -1224,12 +1224,13 @@ audiounit_get_preferred_channel_layout(cubeb * ctx, cubeb_channel_layout * layou
     // If we already have at least one cubeb stream, then the current channel
     // layout must be updated. We can return it directly.
     if (ctx->active_streams) {
-      return ctx->layout;
+      *layout = ctx->layout;
+      return CUBEB_OK;
     }
 
     // If there is no existed stream, then we create a default ouput unit and
     // use it to get the current used channel layout.
-    AudioUnit output_unit;
+    AudioUnit output_unit = nullptr;
     audiounit_create_unit(&output_unit, OUTPUT, 0);
     *layout = audiounit_get_current_channel_layout(output_unit);
   }
@@ -1823,11 +1824,10 @@ audiounit_create_unit(AudioUnit * unit, io_side side, AudioDeviceID device)
   OSStatus rv;
   int r;
 
-  if (*unit == nullptr) {
-    int r = audiounit_new_unit_instance(unit, side, device);
-    if (r != CUBEB_OK) {
-      return r;
-    }
+  assert(*unit == nullptr);
+  r = audiounit_new_unit_instance(unit, side, device);
+  if (r != CUBEB_OK) {
+    return r;
   }
   assert(*unit);
 
diff --git a/media/libcubeb/src/cubeb_log.cpp b/media/libcubeb/src/cubeb_log.cpp
index 1c5d713fa754..52ceab6bfe79 100644
--- a/media/libcubeb/src/cubeb_log.cpp
+++ b/media/libcubeb/src/cubeb_log.cpp
@@ -47,7 +47,7 @@ public:
       return;
     }
     PodCopy(storage, str, length);
-    storage[length + 1] = '\0';
+    storage[length] = '\0';
   }
   char const * get() {
     return storage;
diff --git a/media/libcubeb/src/cubeb_pulse.c b/media/libcubeb/src/cubeb_pulse.c
index 69dd7e2b193a..7fa9a00b198e 100644
--- a/media/libcubeb/src/cubeb_pulse.c
+++ b/media/libcubeb/src/cubeb_pulse.c
@@ -142,7 +142,11 @@ sink_info_callback(pa_context * context, const pa_sink_info * info, int eol, voi
 static void
 server_info_callback(pa_context * context, const pa_server_info * info, void * u)
 {
-  WRAP(pa_context_get_sink_info_by_name)(context, info->default_sink_name, sink_info_callback, u);
+  pa_operation * o;
+  o = WRAP(pa_context_get_sink_info_by_name)(context, info->default_sink_name, sink_info_callback, u);
+  if (o) {
+    WRAP(pa_operation_unref)(o);
+  }
 }
 
 static void
@@ -576,6 +580,7 @@ pulse_init(cubeb ** context, char const * context_name)
 {
   void * libpulse = NULL;
   cubeb * ctx;
+  pa_operation * o;
 
   *context = NULL;
 
@@ -614,9 +619,17 @@ pulse_init(cubeb ** context, char const * context_name)
     return CUBEB_ERROR;
   }
 
+  /* server_info_callback performs a second async query, which is
+     responsible for initializing default_sink_info and signalling the
+     mainloop to end the wait. */
   WRAP(pa_threaded_mainloop_lock)(ctx->mainloop);
-  WRAP(pa_context_get_server_info)(ctx->context, server_info_callback, ctx);
+  o = WRAP(pa_context_get_server_info)(ctx->context, server_info_callback, ctx);
+  if (o) {
+    operation_wait(ctx, NULL, o);
+    WRAP(pa_operation_unref)(o);
+  }
   WRAP(pa_threaded_mainloop_unlock)(ctx->mainloop);
+  assert(ctx->default_sink_info);
 
   *context = ctx;
 
@@ -636,12 +649,6 @@ pulse_get_max_channel_count(cubeb * ctx, uint32_t * max_channels)
   (void)ctx;
   assert(ctx && max_channels);
 
-  WRAP(pa_threaded_mainloop_lock)(ctx->mainloop);
-  while (!ctx->default_sink_info) {
-    WRAP(pa_threaded_mainloop_wait)(ctx->mainloop);
-  }
-  WRAP(pa_threaded_mainloop_unlock)(ctx->mainloop);
-
   *max_channels = ctx->default_sink_info->channel_map.channels;
 
   return CUBEB_OK;
@@ -653,12 +660,6 @@ pulse_get_preferred_sample_rate(cubeb * ctx, uint32_t * rate)
   assert(ctx && rate);
   (void)ctx;
 
-  WRAP(pa_threaded_mainloop_lock)(ctx->mainloop);
-  while (!ctx->default_sink_info) {
-    WRAP(pa_threaded_mainloop_wait)(ctx->mainloop);
-  }
-  WRAP(pa_threaded_mainloop_unlock)(ctx->mainloop);
-
   *rate = ctx->default_sink_info->sample_spec.rate;
 
   return CUBEB_OK;
@@ -670,12 +671,6 @@ pulse_get_preferred_channel_layout(cubeb * ctx, cubeb_channel_layout * layout)
   assert(ctx && layout);
   (void)ctx;
 
-  WRAP(pa_threaded_mainloop_lock)(ctx->mainloop);
-  while (!ctx->default_sink_info) {
-    WRAP(pa_threaded_mainloop_wait)(ctx->mainloop);
-  }
-  WRAP(pa_threaded_mainloop_unlock)(ctx->mainloop);
-
   *layout = channel_map_to_layout(&ctx->default_sink_info->channel_map);
 
   return CUBEB_OK;
@@ -711,9 +706,7 @@ pulse_context_destroy(cubeb * ctx)
 static void
 pulse_destroy(cubeb * ctx)
 {
-  if (ctx->context_name) {
-    free(ctx->context_name);
-  }
+  free(ctx->context_name);
   if (ctx->context) {
     pulse_context_destroy(ctx);
   }
@@ -726,9 +719,7 @@ pulse_destroy(cubeb * ctx)
   if (ctx->libpulse) {
     dlclose(ctx->libpulse);
   }
-  if (ctx->default_sink_info) {
-    free(ctx->default_sink_info);
-  }
+  free(ctx->default_sink_info);
   free(ctx);
 }
 
@@ -1059,10 +1050,6 @@ pulse_stream_set_volume(cubeb_stream * stm, float volume)
 
   WRAP(pa_threaded_mainloop_lock)(stm->context->mainloop);
 
-  while (!stm->context->default_sink_info) {
-    WRAP(pa_threaded_mainloop_wait)(stm->context->mainloop);
-  }
-
   /* if the pulse daemon is configured to use flat volumes,
    * apply our own gain instead of changing the input volume on the sink. */
   if (stm->context->default_sink_info->flags & PA_SINK_FLAT_VOLUME) {
diff --git a/media/libcubeb/src/cubeb_ringbuffer.h b/media/libcubeb/src/cubeb_ringbuffer.h
index b40293bc463b..ac5bf8c68bfd 100644
--- a/media/libcubeb/src/cubeb_ringbuffer.h
+++ b/media/libcubeb/src/cubeb_ringbuffer.h
@@ -15,40 +15,6 @@
 #include <memory>
 #include <thread>
 
-/* This enum allows choosing the behaviour of the queue. */
-enum ThreadSafety
-{
-  /* No attempt to synchronize the queue is made. The queue is only safe when
-   * used on a single thread. */
-  Unsafe,
-  /** Atomics are used to synchronize read and write. The queue is safe when
-   * used from two thread: one producer, one consumer. */
-  Safe
-};
-
-/** Policy to enable thread safety on the queue. */
-template<ThreadSafety>
-struct ThreadSafePolicy;
-
-typedef int RingBufferIndex;
-
-/** Policy for thread-safe internal index for the queue. */
-template<>
-struct ThreadSafePolicy<Safe>
-{
-  typedef std::atomic<RingBufferIndex> IndexType;
-};
-
-/**
- * This is the version with a simple `int` for index, for use when only a single
- * thread is producing and releasing data.
- */
-template<>
-struct ThreadSafePolicy<Unsafe>
-{
-  typedef RingBufferIndex IndexType;
-};
-
 /**
  * Single producer single consumer lock-free and wait-free ring buffer.
  *
@@ -82,8 +48,7 @@ struct ThreadSafePolicy<Unsafe>
  *   providing an external buffer to copy into is an easy way to have linear
  *   data for further processing.
  */
-template <typename T,
-          ThreadSafety Safety = ThreadSafety::Safe>
+template <typename T>
 class ring_buffer_base
 {
 public:
@@ -95,12 +60,12 @@ public:
    *
    * @param capacity The maximum number of element this ring buffer will hold.
    */
-  ring_buffer_base(RingBufferIndex capacity)
+  ring_buffer_base(int capacity)
     /* One more element to distinguish from empty and full buffer. */
     : capacity_(capacity + 1)
   {
     assert(storage_capacity() <
-           std::numeric_limits<RingBufferIndex>::max() / 2 &&
+           std::numeric_limits<int>::max() / 2 &&
            "buffer too large for the type of index used.");
     assert(capacity_ > 0);
 
@@ -119,7 +84,7 @@ public:
    * @param count The number of elements to enqueue.
    * @return The number of element enqueued.
    */
-  RingBufferIndex enqueue_default(RingBufferIndex count)
+  int enqueue_default(int count)
   {
     return enqueue(nullptr, count);
   }
@@ -132,7 +97,7 @@ public:
    *
    * @return 1 if the element was inserted, 0 otherwise.
    */
-  RingBufferIndex enqueue(T& element)
+  int enqueue(T& element)
   {
     return enqueue(&element, 1);
   }
@@ -147,27 +112,27 @@ public:
    * @return The number of elements successfully coped from `elements` and inserted
    * into the ring buffer.
    */
-  RingBufferIndex enqueue(T * elements, RingBufferIndex count)
+  int enqueue(T * elements, int count)
   {
 #ifndef NDEBUG
     assert_correct_thread(producer_id);
 #endif
 
-    RingBufferIndex rd_idx = read_index_;
-    RingBufferIndex wr_idx = write_index_;
+    int rd_idx = read_index_.load(std::memory_order::memory_order_relaxed);
+    int wr_idx = write_index_.load(std::memory_order::memory_order_relaxed);
 
     if (full_internal(rd_idx, wr_idx)) {
       return 0;
     }
 
-    RingBufferIndex to_write =
+    int to_write =
       std::min(available_write_internal(rd_idx, wr_idx), count);
 
     /* First part, from the write index to the end of the array. */
-    RingBufferIndex first_part = std::min(storage_capacity() - wr_idx,
+    int first_part = std::min(storage_capacity() - wr_idx,
                                           to_write);
     /* Second part, from the beginning of the array */
-    RingBufferIndex second_part = to_write - first_part;
+    int second_part = to_write - first_part;
 
     if (elements) {
       Copy(data_.get() + wr_idx, elements, first_part);
@@ -177,7 +142,7 @@ public:
       ConstructDefault(data_.get(), second_part);
     }
 
-    write_index_ = increment_index(wr_idx, to_write);
+    write_index_.store(increment_index(wr_idx, to_write), std::memory_order::memory_order_release);
 
     return to_write;
   }
@@ -192,31 +157,31 @@ public:
    * @param count The maximum number of elements to dequeue.
    * @return The number of elements written to `elements`.
    */
-  RingBufferIndex dequeue(T * elements, RingBufferIndex count)
+  int dequeue(T * elements, int count)
   {
 #ifndef NDEBUG
     assert_correct_thread(consumer_id);
 #endif
 
-    RingBufferIndex  wr_idx = write_index_;
-    RingBufferIndex  rd_idx = read_index_;
+    int wr_idx = write_index_.load(std::memory_order::memory_order_acquire);
+    int rd_idx = read_index_.load(std::memory_order::memory_order_relaxed);
 
     if (empty_internal(rd_idx, wr_idx)) {
       return 0;
     }
 
-    RingBufferIndex to_read =
+    int to_read =
       std::min(available_read_internal(rd_idx, wr_idx), count);
 
-    RingBufferIndex first_part = std::min(storage_capacity() - rd_idx, to_read);
-    RingBufferIndex second_part = to_read - first_part;
+    int first_part = std::min(storage_capacity() - rd_idx, to_read);
+    int second_part = to_read - first_part;
 
     if (elements) {
       Copy(elements, data_.get() + rd_idx, first_part);
       Copy(elements + first_part, data_.get(), second_part);
     }
 
-    read_index_ = increment_index(rd_idx, to_read);
+    read_index_.store(increment_index(rd_idx, to_read), std::memory_order::memory_order_relaxed);
 
     return to_read;
   }
@@ -227,12 +192,13 @@ public:
    *
    * @return The number of available elements for reading.
    */
-  RingBufferIndex available_read() const
+  int available_read() const
   {
 #ifndef NDEBUG
     assert_correct_thread(consumer_id);
 #endif
-    return available_read_internal(read_index_, write_index_);
+    return available_read_internal(read_index_.load(std::memory_order::memory_order_relaxed),
+                                   write_index_.load(std::memory_order::memory_order_relaxed));
   }
   /**
    * Get the number of available elements for consuming.
@@ -241,12 +207,13 @@ public:
    *
    * @return The number of empty slots in the buffer, available for writing.
    */
-  RingBufferIndex available_write() const
+  int available_write() const
   {
 #ifndef NDEBUG
     assert_correct_thread(producer_id);
 #endif
-    return available_write_internal(read_index_, write_index_);
+    return available_write_internal(read_index_.load(std::memory_order::memory_order_relaxed),
+                                    write_index_.load(std::memory_order::memory_order_relaxed));
   }
   /**
    * Get the total capacity, for this ring buffer.
@@ -255,7 +222,7 @@ public:
    *
    * @return The maximum capacity of this ring buffer.
    */
-  RingBufferIndex capacity() const
+  int capacity() const
   {
     return storage_capacity() - 1;
   }
@@ -266,8 +233,8 @@ private:
    * @param write_index the write index to consider
    * @return true if the ring buffer is empty, false otherwise.
    **/
-  bool empty_internal(RingBufferIndex read_index,
-                      RingBufferIndex write_index) const
+  bool empty_internal(int read_index,
+                      int write_index) const
   {
     return write_index == read_index;
   }
@@ -280,8 +247,8 @@ private:
    * @param write_index the write index to consider
    * @return true if the ring buffer is full, false otherwise.
    **/
-  bool full_internal(RingBufferIndex read_index,
-                     RingBufferIndex write_index) const
+  bool full_internal(int read_index,
+                     int write_index) const
   {
     return (write_index + 1) % storage_capacity() == read_index;
   }
@@ -300,9 +267,9 @@ private:
    *
    * @return the number of available elements for reading.
    */
-  RingBufferIndex
-  available_read_internal(RingBufferIndex read_index,
-                          RingBufferIndex write_index) const
+  int
+  available_read_internal(int read_index,
+                          int write_index) const
   {
     if (write_index >= read_index) {
       return write_index - read_index;
@@ -315,9 +282,9 @@ private:
    *
    * @return the number of elements that can be written into the array.
    */
-  RingBufferIndex
-  available_write_internal(RingBufferIndex read_index,
-                           RingBufferIndex write_index) const
+  int
+  available_write_internal(int read_index,
+                           int write_index) const
   {
     /* We substract one element here to always keep at least one sample
      * free in the buffer, to distinguish between full and empty array. */
@@ -334,8 +301,8 @@ private:
    * @param increment the number by which `index` is incremented.
    * @return the new index.
    */
-  RingBufferIndex
-  increment_index(RingBufferIndex index, RingBufferIndex increment) const
+  int
+  increment_index(int index, int increment) const
   {
     assert(increment >= 0);
     return (index + increment) % storage_capacity();
@@ -357,10 +324,10 @@ private:
   }
 #endif
   /** Index at which the oldest element is at, in samples. */
-  typename ThreadSafePolicy<Safety>::IndexType read_index_;
+  std::atomic<int> read_index_;
   /** Index at which to write new elements. `write_index` is always at
    * least one element ahead of `read_index_`. */
-  typename ThreadSafePolicy<Safety>::IndexType write_index_;
+  std::atomic<int> write_index_;
   /** Maximum number of elements that can be stored in the ring buffer. */
   const int capacity_;
   /** Data storage */
@@ -376,8 +343,7 @@ private:
 /**
  * Adapter for `ring_buffer_base` that exposes an interface in frames.
  */
-template <typename T,
-          ThreadSafety Safety = ThreadSafety::Safe>
+template <typename T>
 class audio_ring_buffer_base
 {
 public:
@@ -407,7 +373,7 @@ public:
   }
   /**
    * @brief Enqueue `frames_count` frames of audio.
-   * 
+   *
    * Only safely called from the producer thread.
    *
    * @param [in] frames If non-null, the frames to enqueue.
@@ -497,7 +463,7 @@ private:
   /** Number of channels of audio that will stream through this ring buffer. */
   int channel_count;
   /** The underlying ring buffer that is used to store the data. */
-  ring_buffer_base<T, Safety> ring_buffer;
+  ring_buffer_base<T> ring_buffer;
 };
 
 /**
@@ -506,27 +472,13 @@ private:
  * without explicit synchronization.
  */
 template<typename T>
-using lock_free_queue = ring_buffer_base<T, Safe>;
-/**
- * An instantiation of the `ring_buffer_base` type, to be used on a single
- * thread: it is not safe to use from multiple threads without explicit external
- * synchronization.
- */
-template<typename T>
-using queue = ring_buffer_base<T, Unsafe>;
+using lock_free_queue = ring_buffer_base<T>;
 /**
  * Lock-free instantiation of the `audio_ring_buffer` type. This is safe to use
  * from two threads, one producer, one consumer (that never change role),
  * without explicit synchronization.
  */
 template<typename T>
-using lock_free_audio_ring_buffer = audio_ring_buffer_base<T, Safe>;
-/**
- * An instantiation of the `audio_ring_buffer` type, to be used on a single
- * thread: it is not safe to use from multiple threads without explicit external
- * synchronization.
- */
-template<typename T>
-using audio_ring_buffer = audio_ring_buffer_base<T, Unsafe>;
+using lock_free_audio_ring_buffer = audio_ring_buffer_base<T>;
 
 #endif // CUBEB_RING_BUFFER_H
diff --git a/media/libcubeb/src/cubeb_wasapi.cpp b/media/libcubeb/src/cubeb_wasapi.cpp
index 7df5b4a28692..9aebbc0713be 100644
--- a/media/libcubeb/src/cubeb_wasapi.cpp
+++ b/media/libcubeb/src/cubeb_wasapi.cpp
@@ -757,7 +757,7 @@ refill_callback_duplex(cubeb_stream * stm)
 bool
 refill_callback_input(cubeb_stream * stm)
 {
-  bool rv, consumed_all_buffer;
+  bool rv;
 
   XASSERT(has_input(stm) && !has_output(stm));
 
@@ -780,11 +780,10 @@ refill_callback_input(cubeb_stream * stm)
                      0);
 
   XASSERT(read >= 0);
-  consumed_all_buffer = (unsigned long) read == stm->linear_input_buffer.length();
 
   stm->linear_input_buffer.clear();
 
-  return consumed_all_buffer;
+  return !stm->draining;
 }
 
 bool
diff --git a/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc b/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc
index 440b472a88db..cd814555e02e 100644
--- a/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc
+++ b/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc
@@ -87,20 +87,9 @@ AudioRecordJni::AudioRecordJni(AudioManager* audio_manager)
   ALOGD("ctor%s", GetThreadInfo().c_str());
   RTC_DCHECK(audio_parameters_.is_valid());
   RTC_CHECK(j_environment_);
-  JNINativeMethod native_methods[] = {
-      {"nativeCacheDirectBufferAddress", "(Ljava/nio/ByteBuffer;J)V",
-      reinterpret_cast<void*>(
-          &webrtc::AudioRecordJni::CacheDirectBufferAddress)},
-      {"nativeDataIsRecorded", "(IJ)V",
-      reinterpret_cast<void*>(&webrtc::AudioRecordJni::DataIsRecorded)}};
-  j_native_registration_ = j_environment_->RegisterNatives(
-      "org/webrtc/voiceengine/WebRtcAudioRecord",
-      native_methods, arraysize(native_methods));
-  j_audio_record_.reset(new JavaAudioRecord(
-      j_native_registration_.get(),
-      j_native_registration_->NewObject(
-          "<init>", "(Landroid/content/Context;J)V",
-          JVM::GetInstance()->context(), PointerTojlong(this))));
+  // Defer creation of the j_audio_record object so we can defer native registration.
+  // See Mozilla bug 1349581
+
   // Detach from this thread since we want to use the checker to verify calls
   // from the Java based audio thread.
   thread_checker_java_.DetachFromThread();
@@ -112,6 +101,28 @@ AudioRecordJni::~AudioRecordJni() {
   Terminate();
 }
 
+void
+AudioRecordJni::EnsureRecordObject()
+{
+  if (!j_audio_record_.get()) {
+    RTC_DCHECK(!j_native_registration_.get());
+    JNINativeMethod native_methods[] = {
+      {"nativeCacheDirectBufferAddress", "(Ljava/nio/ByteBuffer;J)V",
+      reinterpret_cast<void*>(
+          &webrtc::AudioRecordJni::CacheDirectBufferAddress)},
+      {"nativeDataIsRecorded", "(IJ)V",
+      reinterpret_cast<void*>(&webrtc::AudioRecordJni::DataIsRecorded)}};
+    j_native_registration_ = j_environment_->RegisterNatives(
+      "org/webrtc/voiceengine/WebRtcAudioRecord",
+      native_methods, arraysize(native_methods));
+    j_audio_record_.reset(new JavaAudioRecord(
+      j_native_registration_.get(),
+      j_native_registration_->NewObject(
+      "<init>", "(Landroid/content/Context;J)V",
+      JVM::GetInstance()->context(), PointerTojlong(this))));
+  }
+}
+
 int32_t AudioRecordJni::Init() {
   ALOGD("Init%s", GetThreadInfo().c_str());
   RTC_DCHECK(thread_checker_.CalledOnValidThread());
@@ -130,6 +141,7 @@ int32_t AudioRecordJni::InitRecording() {
   RTC_DCHECK(thread_checker_.CalledOnValidThread());
   RTC_DCHECK(!initialized_);
   RTC_DCHECK(!recording_);
+  EnsureRecordObject();
   int frames_per_buffer = j_audio_record_->InitRecording(
       audio_parameters_.sample_rate(), audio_parameters_.channels());
   if (frames_per_buffer < 0) {
@@ -150,6 +162,7 @@ int32_t AudioRecordJni::StartRecording() {
   RTC_DCHECK(thread_checker_.CalledOnValidThread());
   RTC_DCHECK(initialized_);
   RTC_DCHECK(!recording_);
+  RTC_DCHECK(j_audio_record_.get());
   if (!j_audio_record_->StartRecording()) {
     ALOGE("StartRecording failed!");
     return -1;
@@ -164,6 +177,7 @@ int32_t AudioRecordJni::StopRecording() {
   if (!initialized_ || !recording_) {
     return 0;
   }
+  RTC_DCHECK(j_audio_record_.get());
   if (!j_audio_record_->StopRecording()) {
     ALOGE("StopRecording failed!");
     return -1;
@@ -197,18 +211,21 @@ void AudioRecordJni::AttachAudioBuffer(AudioDeviceBuffer* audioBuffer) {
 int32_t AudioRecordJni::EnableBuiltInAEC(bool enable) {
   ALOGD("EnableBuiltInAEC%s", GetThreadInfo().c_str());
   RTC_DCHECK(thread_checker_.CalledOnValidThread());
+  RTC_DCHECK(j_audio_record_.get());
   return j_audio_record_->EnableBuiltInAEC(enable) ? 0 : -1;
 }
 
 int32_t AudioRecordJni::EnableBuiltInAGC(bool enable) {
   ALOGD("EnableBuiltInAGC%s", GetThreadInfo().c_str());
   RTC_DCHECK(thread_checker_.CalledOnValidThread());
+  RTC_DCHECK(j_audio_record_.get());
   return j_audio_record_->EnableBuiltInAGC(enable) ? 0 : -1;
 }
 
 int32_t AudioRecordJni::EnableBuiltInNS(bool enable) {
   ALOGD("EnableBuiltInNS%s", GetThreadInfo().c_str());
   RTC_DCHECK(thread_checker_.CalledOnValidThread());
+  RTC_DCHECK(j_audio_record_.get());
   return j_audio_record_->EnableBuiltInNS(enable) ? 0 : -1;
 }
 
diff --git a/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.h b/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.h
index 8d431d33983c..815bf265e278 100644
--- a/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.h
+++ b/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.h
@@ -69,6 +69,8 @@ class AudioRecordJni {
   explicit AudioRecordJni(AudioManager* audio_manager);
   ~AudioRecordJni();
 
+  void EnsureRecordObject();
+
   int32_t Init();
   int32_t Terminate();
 
diff --git a/netwerk/cache2/CacheEntry.cpp b/netwerk/cache2/CacheEntry.cpp
index 62810db67dc9..cfd8a00c2737 100644
--- a/netwerk/cache2/CacheEntry.cpp
+++ b/netwerk/cache2/CacheEntry.cpp
@@ -585,7 +585,7 @@ void CacheEntry::TransferCallbacks(CacheEntry & aFromEntry)
 
   uint32_t callbacksLength = mCallbacks.Length();
   if (callbacksLength) {
-    // Carry the entry reference (unfortunatelly, needs to be done manually...)
+    // Carry the entry reference (unfortunately, needs to be done manually...)
     for (uint32_t i = 0; i < callbacksLength; ++i)
       mCallbacks[i].ExchangeEntry(this);
 
@@ -1934,7 +1934,7 @@ size_t CacheEntry::SizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const
   // mDoomCallback is an arbitrary class that is probably reported elsewhere.
   // mOutputStream is reported in mFile.
   // mWriter is one of many handles we create, but (intentionally) not keep
-  // any reference to, so those unfortunatelly cannot be reported.  Handles are
+  // any reference to, so those unfortunately cannot be reported.  Handles are
   // small, though.
   // mSecurityInfo doesn't impl nsISizeOf.
 
diff --git a/netwerk/cache2/CacheFileOutputStream.cpp b/netwerk/cache2/CacheFileOutputStream.cpp
index 99d506bd5321..0a46a19937cd 100644
--- a/netwerk/cache2/CacheFileOutputStream.cpp
+++ b/netwerk/cache2/CacheFileOutputStream.cpp
@@ -107,7 +107,7 @@ CacheFileOutputStream::Write(const char * aBuf, uint32_t aCount,
     return NS_ERROR_FILE_TOO_BIG;
   }
 
-  // We use 64-bit offset when accessing the file, unfortunatelly we use 32-bit
+  // We use 64-bit offset when accessing the file, unfortunately we use 32-bit
   // metadata offset, so we cannot handle data bigger than 4GB.
   if (mPos + aCount > PR_UINT32_MAX) {
     LOG(("CacheFileOutputStream::Write() - Entry's size exceeds 4GB while it "
diff --git a/netwerk/cache2/CacheStorageService.cpp b/netwerk/cache2/CacheStorageService.cpp
index 8a81e5146f41..06e67accc159 100644
--- a/netwerk/cache2/CacheStorageService.cpp
+++ b/netwerk/cache2/CacheStorageService.cpp
@@ -591,7 +591,7 @@ private:
 bool CleaupCacheDirectoriesRunnable::Post(uint32_t aVersion, uint32_t aActive)
 {
   // CleaupCacheDirectories is called regardless what cache version is set up to use.
-  // To obtain the cache1 directory we must unfortunatelly instantiate the old cache
+  // To obtain the cache1 directory we must unfortunately instantiate the old cache
   // service despite it may not be used at all...  This also initialize nsDeleteDir.
   nsCOMPtr<nsICacheService> service = do_GetService(NS_CACHESERVICE_CONTRACTID);
   if (!service)
diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp
index 27df3baaa8d3..4626e0a3bde3 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.cpp
+++ b/netwerk/protocol/websocket/WebSocketChannel.cpp
@@ -1551,6 +1551,14 @@ WebSocketChannel::ProcessInput(uint8_t *buffer, uint32_t count)
         break;
 
       payloadLength64 = mFramePtr[2] << 8 | mFramePtr[3];
+
+      if(payloadLength64 < 126){
+        // Section 5.2 says that the minimal number of bytes MUST
+        // be used to encode the length in all cases
+        LOG(("WebSocketChannel:: non-minimal-encoded payload length"));
+        return NS_ERROR_ILLEGAL_VALUE;
+      }
+
     } else {
       // 64 bit length
       framingLength += 8;
@@ -1566,6 +1574,14 @@ WebSocketChannel::ProcessInput(uint8_t *buffer, uint32_t count)
 
       // copy this in case it is unaligned
       payloadLength64 = NetworkEndian::readInt64(mFramePtr + 2);
+
+      if(payloadLength64 <= 0xffff){
+        // Section 5.2 says that the minimal number of bytes MUST
+        // be used to encode the length in all cases
+        LOG(("WebSocketChannel:: non-minimal-encoded payload length"));
+        return NS_ERROR_ILLEGAL_VALUE;
+      }
+
     }
 
     payload = mFramePtr + framingLength;
diff --git a/parser/html/nsHtml5TreeOperation.h b/parser/html/nsHtml5TreeOperation.h
index 6465bc48e1b5..592fc91a8a2c 100644
--- a/parser/html/nsHtml5TreeOperation.h
+++ b/parser/html/nsHtml5TreeOperation.h
@@ -107,7 +107,7 @@ class nsHtml5TreeOperation {
       }
       nsAutoString str;
       aAtom->ToString(str);
-      return NS_Atomize(str);
+      return NS_AtomizeMainThread(str);
     }
 
     static nsresult AppendTextToTextNode(const char16_t* aBuffer,
diff --git a/python/mozbuild/mozbuild/action/unpack_dmg.py b/python/mozbuild/mozbuild/action/unpack_dmg.py
new file mode 100644
index 000000000000..5f66d98cf940
--- /dev/null
+++ b/python/mozbuild/mozbuild/action/unpack_dmg.py
@@ -0,0 +1,35 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import print_function
+
+from mozpack import dmg
+
+import argparse
+import sys
+
+
+def main(args):
+    parser = argparse.ArgumentParser(
+        description='Explode a DMG into its relevant files')
+
+    parser.add_argument('--dsstore', help='DSStore file from')
+    parser.add_argument('--background', help='Background file from')
+    parser.add_argument('--icon', help='Icon file from')
+
+    parser.add_argument('dmgfile', metavar='DMG_IN',
+                        help='DMG File to Unpack')
+    parser.add_argument('outpath', metavar='PATH_OUT',
+                        help='Location to put unpacked files')
+
+    options = parser.parse_args(args)
+
+    dmg.extract_dmg(dmgfile=options.dmgfile, output=options.outpath,
+                    dsstore=options.dsstore, background=options.background,
+                    icon=options.icon)
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))
diff --git a/python/mozbuild/mozpack/dmg.py b/python/mozbuild/mozpack/dmg.py
index 168f6d8d2b34..769fe91c8106 100644
--- a/python/mozbuild/mozpack/dmg.py
+++ b/python/mozbuild/mozpack/dmg.py
@@ -9,6 +9,7 @@ import os
 import platform
 import shutil
 import subprocess
+import sys
 
 from mozbuild.util import ensureParentDir
 
@@ -31,8 +32,8 @@ def chmod(dir):
 
 def rsync(source, dest):
     'rsync the contents of directory source into directory dest'
-    # Ensure a trailing slash so rsync copies the *contents* of source.
-    if not source.endswith('/'):
+    # Ensure a trailing slash on directories so rsync copies the *contents* of source.
+    if not source.endswith('/') and os.path.isdir(source):
         source += '/'
     subprocess.check_call(['rsync', '-a', '--copy-unsafe-links',
                            source, dest])
@@ -156,3 +157,53 @@ def create_dmg(source_directory, output_dmg, volume_name, extra_files):
         set_folder_icon(stagedir, tmpdir)
         chmod(stagedir)
         create_dmg_from_staged(stagedir, output_dmg, tmpdir, volume_name)
+
+
+def extract_dmg_contents(dmgfile, destdir):
+    import buildconfig
+    if is_linux:
+        with mozfile.TemporaryDirectory() as tmpdir:
+            hfs_file = os.path.join(tmpdir, 'firefox.hfs')
+            subprocess.check_call([
+                    buildconfig.substs['DMG_TOOL'],
+                    'extract',
+                    dmgfile,
+                    hfs_file
+                ],
+                # dmg is seriously chatty
+                stdout=open(os.devnull, 'wb'))
+            subprocess.check_call([
+                buildconfig.substs['HFS_TOOL'], hfs_file, 'extractall', '/', destdir])
+    else:
+        unpack_diskimage = os.path.join(buildconfig.topsrcdir, 'build', 'package',
+                                        'mac_osx', 'unpack-diskimage')
+        unpack_mountpoint = os.path.join(
+            '/tmp', '{}-unpack'.format(buildconfig.substs['MOZ_APP_NAME']))
+        subprocess.check_call([unpack_diskimage, dmgfile, unpack_mountpoint,
+                               destdir])
+
+
+def extract_dmg(dmgfile, output, dsstore=None, icon=None, background=None):
+    if platform.system() not in ('Darwin', 'Linux'):
+        raise Exception("Don't know how to extract a DMG on '%s'" % platform.system())
+
+    if is_linux:
+        check_tools('DMG_TOOL', 'MKFSHFS', 'HFS_TOOL')
+
+    with mozfile.TemporaryDirectory() as tmpdir:
+        extract_dmg_contents(dmgfile, tmpdir)
+        if os.path.islink(os.path.join(tmpdir, ' ')):
+            # Rsync will fail on the presence of this symlink
+            os.remove(os.path.join(tmpdir, ' '))
+        rsync(tmpdir, output)
+
+        if dsstore:
+            mkdir(os.path.dirname(dsstore))
+            rsync(os.path.join(tmpdir, '.DS_Store'), dsstore)
+        if background:
+            mkdir(os.path.dirname(background))
+            rsync(os.path.join(tmpdir, '.background', os.path.basename(background)),
+                  background)
+        if icon:
+            mkdir(os.path.dirname(icon))
+            rsync(os.path.join(tmpdir, '.VolumeIcon.icns'), icon)
diff --git a/services/crypto/component/IdentityCryptoService.cpp b/services/crypto/component/IdentityCryptoService.cpp
index 5ad3fd19c9d4..113f6bc09648 100644
--- a/services/crypto/component/IdentityCryptoService.cpp
+++ b/services/crypto/component/IdentityCryptoService.cpp
@@ -53,7 +53,8 @@ public:
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIIDENTITYKEYPAIR
 
-  KeyPair(SECKEYPrivateKey* aPrivateKey, SECKEYPublicKey* aPublicKey);
+  KeyPair(SECKEYPrivateKey* aPrivateKey, SECKEYPublicKey* aPublicKey,
+          nsIEventTarget* aOperationThread);
 
 private:
   ~KeyPair() override
@@ -81,6 +82,7 @@ private:
 
   SECKEYPrivateKey * mPrivateKey;
   SECKEYPublicKey * mPublicKey;
+  nsCOMPtr<nsIEventTarget> mThread;
 
   KeyPair(const KeyPair &) = delete;
   void operator=(const KeyPair &) = delete;
@@ -93,7 +95,8 @@ class KeyGenRunnable : public Runnable, public nsNSSShutDownObject
 public:
   NS_DECL_NSIRUNNABLE
 
-  KeyGenRunnable(KeyType keyType, nsIIdentityKeyGenCallback * aCallback);
+  KeyGenRunnable(KeyType keyType, nsIIdentityKeyGenCallback * aCallback,
+                 nsIEventTarget* aOperationThread);
 
 private:
   ~KeyGenRunnable() override
@@ -119,6 +122,7 @@ private:
   nsMainThreadPtrHandle<nsIIdentityKeyGenCallback> mCallback; // in
   nsresult mRv; // out
   nsCOMPtr<nsIIdentityKeyPair> mKeyPair; // out
+  nsCOMPtr<nsIEventTarget> mThread;
 
   KeyGenRunnable(const KeyGenRunnable &) = delete;
   void operator=(const KeyGenRunnable &) = delete;
@@ -179,6 +183,12 @@ public:
       = do_GetService("@mozilla.org/psm;1", &rv);
     NS_ENSURE_SUCCESS(rv, rv);
 
+    nsCOMPtr<nsIThread> thread;
+    rv = NS_NewNamedThread("IdentityCrypto", getter_AddRefs(thread));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    mThread = thread.forget();
+
     return NS_OK;
   }
 
@@ -186,6 +196,8 @@ private:
   ~IdentityCryptoService() = default;
   IdentityCryptoService(const KeyPair &) = delete;
   void operator=(const IdentityCryptoService &) = delete;
+
+  nsCOMPtr<nsIEventTarget> mThread;
 };
 
 NS_IMPL_ISUPPORTS(IdentityCryptoService, nsIIdentityCryptoService)
@@ -203,10 +215,8 @@ IdentityCryptoService::GenerateKeyPair(
     return NS_ERROR_UNEXPECTED;
   }
 
-  nsCOMPtr<nsIRunnable> r = new KeyGenRunnable(keyType, callback);
-  nsCOMPtr<nsIThread> thread;
-  nsresult rv = NS_NewNamedThread("GenerateKeyPair", getter_AddRefs(thread),
-                                  r);
+  nsCOMPtr<nsIRunnable> r = new KeyGenRunnable(keyType, callback, mThread);
+  nsresult rv = mThread->Dispatch(r.forget(), NS_DISPATCH_NORMAL);
   NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_OK;
@@ -221,9 +231,11 @@ IdentityCryptoService::Base64UrlEncode(const nsACString & utf8Input,
     Base64URLEncodePaddingPolicy::Include, result);
 }
 
-KeyPair::KeyPair(SECKEYPrivateKey * privateKey, SECKEYPublicKey * publicKey)
+KeyPair::KeyPair(SECKEYPrivateKey * privateKey, SECKEYPublicKey * publicKey,
+                 nsIEventTarget* operationThread)
   : mPrivateKey(privateKey)
   , mPublicKey(publicKey)
+  , mThread(operationThread)
 {
   MOZ_ASSERT(!NS_IsMainThread());
 }
@@ -309,16 +321,16 @@ KeyPair::Sign(const nsACString & textToSign,
   nsCOMPtr<nsIRunnable> r = new SignRunnable(textToSign, mPrivateKey,
                                              callback);
 
-  nsCOMPtr<nsIThread> thread;
-  nsresult rv = NS_NewNamedThread("KeyPair Sign", getter_AddRefs(thread), r);
-  return rv;
+  return mThread->Dispatch(r, NS_DISPATCH_NORMAL);
 }
 
 KeyGenRunnable::KeyGenRunnable(KeyType keyType,
-                               nsIIdentityKeyGenCallback * callback)
+                               nsIIdentityKeyGenCallback * callback,
+                               nsIEventTarget* operationThread)
   : mKeyType(keyType)
   , mCallback(new nsMainThreadPtrHolder<nsIIdentityKeyGenCallback>(callback))
   , mRv(NS_ERROR_NOT_INITIALIZED)
+  , mThread(operationThread)
 {
 }
 
@@ -457,7 +469,7 @@ KeyGenRunnable::Run()
           MOZ_ASSERT(privk);
           MOZ_ASSERT(pubk);
 		  // mKeyPair will take over ownership of privk and pubk
-          mKeyPair = new KeyPair(privk, pubk);
+          mKeyPair = new KeyPair(privk, pubk, mThread);
         }
       }
     }
diff --git a/taskcluster/ci/test/tests.yml b/taskcluster/ci/test/tests.yml
index 61d14c34723e..013e28042200 100644
--- a/taskcluster/ci/test/tests.yml
+++ b/taskcluster/ci/test/tests.yml
@@ -479,8 +479,8 @@ mochitest-browser-chrome:
     chunks:
         by-test-platform:
             linux64-jsdcov/opt: 35
-            linux64/debug: 12
-            linux32/debug: 12
+            linux64/debug: 16
+            linux32/debug: 16
             linux64-asan/opt: 10
             default: 7
     e10s:
diff --git a/taskcluster/docs/parameters.rst b/taskcluster/docs/parameters.rst
index f32443bd9d3f..b71abb024195 100644
--- a/taskcluster/docs/parameters.rst
+++ b/taskcluster/docs/parameters.rst
@@ -99,7 +99,7 @@ syntax or reading a project-specific configuration file).
 
 ``target_tasks_method``
     The method to use to determine the target task set.  This is the suffix of
-    one of the functions in ``tascluster/taskgraph/target_tasks.py``.
+    one of the functions in ``taskcluster/taskgraph/target_tasks.py``.
 
 ``optimize_target_tasks``
    If true, then target tasks are eligible for optimization.
diff --git a/taskcluster/docs/taskgraph.rst b/taskcluster/docs/taskgraph.rst
index 18cc18885169..7e0644e4fd60 100644
--- a/taskcluster/docs/taskgraph.rst
+++ b/taskcluster/docs/taskgraph.rst
@@ -154,7 +154,7 @@ Mach commands
 -------------
 
 A number of mach subcommands are available aside from ``mach taskgraph
-decision`` to make this complex system more accesssible to those trying to
+decision`` to make this complex system more accessible to those trying to
 understand or modify it.  They allow you to run portions of the
 graph-generation process and output the results.
 
diff --git a/taskcluster/taskgraph/decision.py b/taskcluster/taskgraph/decision.py
index 2f6e0f220238..67c34a3d7f77 100644
--- a/taskcluster/taskgraph/decision.py
+++ b/taskcluster/taskgraph/decision.py
@@ -164,6 +164,7 @@ def get_decision_parameters(options):
     # Define default filter list, as most configurations shouldn't need
     # custom filters.
     parameters['filters'] = [
+        'check_servo',
         'target_tasks_method',
     ]
 
diff --git a/taskcluster/taskgraph/filter_tasks.py b/taskcluster/taskgraph/filter_tasks.py
index db28eb570dd1..5d034829b042 100644
--- a/taskcluster/taskgraph/filter_tasks.py
+++ b/taskcluster/taskgraph/filter_tasks.py
@@ -33,3 +33,21 @@ def filter_target_tasks(graph, parameters):
     attr = parameters.get('target_tasks_method', 'all_tasks')
     fn = target_tasks.get_method(attr)
     return fn(graph, parameters)
+
+
+@filter_task('check_servo')
+def filter_servo(graph, parameters):
+    """bug 1339542 When Servo vcs sync service lands Servo commits in
+    autoland repo, run linux64-stylo tests but skip other
+    platforms (to  reduce test load)."""
+
+    SERVO_PLATFORMS = {
+        'linux64-stylo',
+    }
+
+    def fltr(task):
+        if parameters.get('owner') != "servo-vcs-sync@mozilla.com":
+            return True
+        return task.attributes.get('build_platform') in SERVO_PLATFORMS
+
+    return [l for l, t in graph.tasks.iteritems() if fltr(t)]
diff --git a/taskcluster/taskgraph/transforms/balrog.py b/taskcluster/taskgraph/transforms/balrog.py
index 49b7f3ea79dd..4acc381e7bbc 100644
--- a/taskcluster/taskgraph/transforms/balrog.py
+++ b/taskcluster/taskgraph/transforms/balrog.py
@@ -9,7 +9,8 @@ from __future__ import absolute_import, print_function, unicode_literals
 
 from taskgraph.transforms.base import TransformSequence
 from taskgraph.util.schema import validate_schema, Schema
-from taskgraph.util.scriptworker import get_balrog_server_scope
+from taskgraph.util.scriptworker import (get_balrog_server_scope,
+                                         get_balrog_channel_scopes)
 from taskgraph.transforms.task import task_description_schema
 from voluptuous import Any, Required, Optional
 
@@ -92,6 +93,8 @@ def make_task_description(config, jobs):
         }]
 
         server_scope = get_balrog_server_scope(config)
+        channel_scopes = get_balrog_channel_scopes(config)
+
         task = {
             'label': label,
             'description': "{} Balrog".format(
@@ -102,7 +105,7 @@ def make_task_description(config, jobs):
                 'implementation': 'balrog',
                 'upstream-artifacts': upstream_artifacts,
             },
-            'scopes': [server_scope],
+            'scopes': [server_scope] + channel_scopes,
             'dependencies': {'beetmover': dep_job.label},
             'attributes': attributes,
             'run-on-projects': dep_job.attributes.get('run_on_projects'),
diff --git a/taskcluster/taskgraph/util/scriptworker.py b/taskcluster/taskgraph/util/scriptworker.py
index cb93d7b861b8..c1f3bc2bb20c 100644
--- a/taskcluster/taskgraph/util/scriptworker.py
+++ b/taskcluster/taskgraph/util/scriptworker.py
@@ -131,16 +131,60 @@ BALROG_SCOPE_ALIAS_TO_PROJECT = [[
     'release', set([
         'mozilla-release',
     ])
+], [
+    'esr', set([
+        'mozilla-esr52',
+    ])
 ]]
 
 """Map the balrog scope aliases to the actual scopes.
 """
 BALROG_SERVER_SCOPES = {
-    'nightly': 'project:releng:balrog:nightly',
-    'aurora': 'project:releng:balrog:nightly',
-    'beta': 'project:releng:balrog:nightly',
-    'release': 'project:releng:balrog:nightly',
-    'default': 'project:releng:balrog:nightly',
+    'nightly': 'project:releng:balrog:server:nightly',
+    'aurora': 'project:releng:balrog:server:aurora',
+    'beta': 'project:releng:balrog:server:beta',
+    'release': 'project:releng:balrog:server:release',
+    'esr': 'project:releng:balrog:server:esr',
+    'default': 'project:releng:balrog:server:dep',
+}
+
+"""Map the balrog scope aliases to the actual channel scopes.
+"""
+BALROG_CHANNEL_SCOPES = {
+    'nightly': [
+        'project:releng:balrog:channel:nightly'
+    ],
+    'aurora': [
+        'project:releng:balrog:channel:aurora'
+    ],
+    'beta': [
+        'project:releng:balrog:channel:beta',
+        'project:releng:balrog:channel:beta-localtest',
+        'project:releng:balrog:channel:beta-cdntest'
+    ],
+    'release': [
+        'project:releng:balrog:channel:release',
+        'project:releng:balrog:channel:release-localtest',
+        'project:releng:balrog:channel:release-cdntest'
+    ],
+    'esr': [
+        'project:releng:balrog:channel:esr',
+        'project:releng:balrog:channel:esr-localtest',
+        'project:releng:balrog:channel:esr-cdntest'
+    ],
+    'default': [
+        'project:releng:balrog:channel:nightly'
+        'project:releng:balrog:channel:aurora'
+        'project:releng:balrog:channel:beta',
+        'project:releng:balrog:channel:beta-localtest',
+        'project:releng:balrog:channel:beta-cdntest'
+        'project:releng:balrog:channel:release',
+        'project:releng:balrog:channel:release-localtest',
+        'project:releng:balrog:channel:release-cdntest'
+        'project:releng:balrog:channel:esr',
+        'project:releng:balrog:channel:esr-localtest',
+        'project:releng:balrog:channel:esr-cdntest'
+    ]
 }
 
 
@@ -236,6 +280,12 @@ get_balrog_server_scope = functools.partial(
     BALROG_SERVER_SCOPES
 )
 
+get_balrog_channel_scopes = functools.partial(
+    get_scope_from_project,
+    BALROG_SCOPE_ALIAS_TO_PROJECT,
+    BALROG_CHANNEL_SCOPES
+)
+
 
 # release_config {{{1
 def get_release_config(config):
diff --git a/taskcluster/taskgraph/util/seta.py b/taskcluster/taskgraph/util/seta.py
index b7b9a492c0ad..7b1ee64073f3 100644
--- a/taskcluster/taskgraph/util/seta.py
+++ b/taskcluster/taskgraph/util/seta.py
@@ -49,7 +49,7 @@ class SETA(object):
         low_value_tasks = []
 
         if not bbb:
-            # we want to get low priority tasklcuster jobs
+            # we want to get low priority taskcluster jobs
             url = SETA_ENDPOINT % (project, 'taskcluster')
         else:
             # we want low priority buildbot jobs
diff --git a/testing/marionette/accessibility.js b/testing/marionette/accessibility.js
index e3938d2e698c..e0ab4d6f3dec 100644
--- a/testing/marionette/accessibility.js
+++ b/testing/marionette/accessibility.js
@@ -227,7 +227,7 @@ accessibility.Checks = class {
    *     Accessible object.
    *
    * @return {boolean}
-   *     True if the accesible object has a {@code hidden} attribute,
+   *     True if the accessible object has a {@code hidden} attribute,
    *     false otherwise.
    */
   hasHiddenAttribute(accessible) {
diff --git a/testing/marionette/harness/marionette_harness/tests/unit/test_accessibility.py b/testing/marionette/harness/marionette_harness/tests/unit/test_accessibility.py
index 0d8d9dca5206..bb9f73787ab0 100644
--- a/testing/marionette/harness/marionette_harness/tests/unit/test_accessibility.py
+++ b/testing/marionette/harness/marionette_harness/tests/unit/test_accessibility.py
@@ -47,7 +47,7 @@ class TestAccessibility(MarionetteTestCase):
         # Button5 does not have a correct accessibility role and may not be
         # manipulated via the accessibility API
         "button5",
-        # Button6 is missing an accesible name
+        # Button6 is missing an accessible name
         "button6",
         # Button7 is not currently visible via the accessibility API and may
         # not be manipulated by it
diff --git a/toolkit/components/addoncompat/RemoteAddonsParent.jsm b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
index 384def8ad64f..4d22218e45a6 100644
--- a/toolkit/components/addoncompat/RemoteAddonsParent.jsm
+++ b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
@@ -834,7 +834,7 @@ ContentDocumentInterposition.methods.importNode =
   };
 
 // This interposition ensures that calling browser.docShell from an
-// add-on returns a CPOW around the dochell.
+// add-on returns a CPOW around the docshell.
 var RemoteBrowserElementInterposition = new Interposition("RemoteBrowserElementInterposition",
                                                           EventTargetInterposition);
 
diff --git a/toolkit/components/find/nsWebBrowserFind.cpp b/toolkit/components/find/nsWebBrowserFind.cpp
index a8e27a9bbc02..b9b57b3d24a1 100644
--- a/toolkit/components/find/nsWebBrowserFind.cpp
+++ b/toolkit/components/find/nsWebBrowserFind.cpp
@@ -698,7 +698,7 @@ nsWebBrowserFind::SearchInFrame(nsPIDOMWindowOuter* aWindow, bool aWrapping,
   *aDidFind = false;
 
   // Do security check, to ensure that the frame we're searching is
-  // acccessible from the frame where the Find is being run.
+  // accessible from the frame where the Find is being run.
 
   // get a uri for the window
   nsCOMPtr<nsIDocument> theDoc = aWindow->GetDoc();
diff --git a/toolkit/components/startup/StartupTimeline.h b/toolkit/components/startup/StartupTimeline.h
index 864753616a2b..f5280eda101c 100644
--- a/toolkit/components/startup/StartupTimeline.h
+++ b/toolkit/components/startup/StartupTimeline.h
@@ -94,8 +94,8 @@ public:
   }
 
 private:
-  static NS_EXTERNAL_VIS_(TimeStamp) sStartupTimeline[MAX_EVENT_ID];
-  static NS_EXTERNAL_VIS_(const char *) sStartupTimelineDesc[MAX_EVENT_ID];
+  static TimeStamp sStartupTimeline[MAX_EVENT_ID];
+  static const char* sStartupTimelineDesc[MAX_EVENT_ID];
 };
 
 } // namespace mozilla
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index c4e196178046..6ae8263d1a64 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -10692,14 +10692,6 @@
     "bug_numbers": [1238433],
     "description": "Percentage of frames decoded frames dropped in an HTMLVideoElement"
   },
-  "TAB_SWITCH_CACHE_POSITION": {
-    "expires_in_version": "55",
-    "bug_numbers": [1242013],
-    "kind": "linear",
-    "high": 100,
-    "n_buckets": 50,
-    "description": "Position in (theoretical) tab cache of tab being switched to"
-  },
   "REMOTE_JAR_PROTOCOL_USED": {
     "alert_emails": ["dev-platform@lists.mozilla.org"],
     "expires_in_version": "55",
diff --git a/toolkit/components/telemetry/histogram-whitelists.json b/toolkit/components/telemetry/histogram-whitelists.json
index b0e92b8ae464..4be140aecd54 100644
--- a/toolkit/components/telemetry/histogram-whitelists.json
+++ b/toolkit/components/telemetry/histogram-whitelists.json
@@ -632,7 +632,6 @@
     "SYSTEM_FONT_FALLBACK",
     "SYSTEM_FONT_FALLBACK_FIRST",
     "SYSTEM_FONT_FALLBACK_SCRIPT",
-    "TAB_SWITCH_CACHE_POSITION",
     "TAP_TO_LOAD_ENABLED",
     "TAP_TO_LOAD_IMAGE_SIZE",
     "THUNDERBIRD_CONVERSATIONS_TIME_TO_2ND_GLODA_QUERY_MS",
diff --git a/toolkit/content/TopLevelVideoDocument.js b/toolkit/content/TopLevelVideoDocument.js
index 5a2b8a857c44..d8762ed4857c 100644
--- a/toolkit/content/TopLevelVideoDocument.js
+++ b/toolkit/content/TopLevelVideoDocument.js
@@ -24,7 +24,7 @@ document.addEventListener("keypress", ev => {
       return;
     }
 
-    // If we're not in broser fullscreen mode, prevent entering into that,
+    // If we're not in browser fullscreen mode, prevent entering into that,
     // so we don't end up there after pressing Esc.
     ev.preventDefault();
     ev.stopPropagation();
diff --git a/toolkit/modules/subprocess/Subprocess.jsm b/toolkit/modules/subprocess/Subprocess.jsm
index 6d0d27d7775f..89a3ed4d07fd 100644
--- a/toolkit/modules/subprocess/Subprocess.jsm
+++ b/toolkit/modules/subprocess/Subprocess.jsm
@@ -18,6 +18,8 @@ let EXPORTED_SYMBOLS = ["Subprocess"];
 
 var {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
 
+Cu.importGlobalProperties(["TextEncoder"]);
+
 Cu.import("resource://gre/modules/AppConstants.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/subprocess/subprocess_common.jsm");
@@ -30,6 +32,19 @@ if (AppConstants.platform == "win") {
                                     "resource://gre/modules/subprocess/subprocess_unix.jsm");
 }
 
+function encodeEnvVar(name, value) {
+  if (typeof name === "string" && typeof value === "string") {
+    return `${name}=${value}`;
+  }
+
+  let encoder = new TextEncoder("utf-8");
+  function encode(val) {
+    return typeof val === "string" ? encoder.encode(val) : val;
+  }
+
+  return Uint8Array.of(...encode(name), ...encode("="), ...encode(value), 0);
+}
+
 /**
  * Allows for creation of and communication with OS-level sub-processes.
  * @namespace
@@ -102,8 +117,8 @@ var Subprocess = {
       Object.assign(environment, options.environment);
     }
 
-    options.environment = Object.keys(environment)
-                                .map(key => `${key}=${environment[key]}`);
+    options.environment = Object.entries(environment)
+                                .map(([key, val]) => encodeEnvVar(key, val));
 
     options.arguments = Array.from(options.arguments || []);
 
diff --git a/toolkit/modules/subprocess/subprocess_shared_unix.js b/toolkit/modules/subprocess/subprocess_shared_unix.js
index 534c4be2c367..4d54debe27a7 100644
--- a/toolkit/modules/subprocess/subprocess_shared_unix.js
+++ b/toolkit/modules/subprocess/subprocess_shared_unix.js
@@ -41,6 +41,14 @@ var libc = new Library("libc", LIBC_CHOICES, {
     ctypes.char.ptr.ptr.ptr,
   ],
 
+  setenv: [
+    ctypes.default_abi,
+    ctypes.int,
+    ctypes.char.ptr,
+    ctypes.char.ptr,
+    ctypes.int,
+  ],
+
   chdir: [
     ctypes.default_abi,
     ctypes.int,
diff --git a/toolkit/modules/subprocess/subprocess_unix.jsm b/toolkit/modules/subprocess/subprocess_unix.jsm
index 47ce667d26cf..aef15238f4a0 100644
--- a/toolkit/modules/subprocess/subprocess_unix.jsm
+++ b/toolkit/modules/subprocess/subprocess_unix.jsm
@@ -13,6 +13,8 @@
 
 var {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
 
+Cu.importGlobalProperties(["TextDecoder"]);
+
 var EXPORTED_SYMBOLS = ["SubprocessImpl"];
 
 Cu.import("resource://gre/modules/ctypes.jsm");
@@ -76,6 +78,21 @@ class Process extends BaseProcess {
   }
 }
 
+// Convert a null-terminated char pointer into a sized char array, and then
+// convert that into a JS typed array.
+// The resulting array will not be null-terminated.
+function ptrToUint8Array(input) {
+  let {cast, uint8_t} = ctypes;
+
+  let len = 0;
+  for (let ptr = cast(input, uint8_t.ptr); ptr.contents; ptr = ptr.increment()) {
+    len++;
+  }
+
+  let aryPtr = cast(input, uint8_t.array(len).ptr);
+  return new Uint8Array(aryPtr.contents);
+}
+
 var SubprocessUnix = {
   Process,
 
@@ -91,13 +108,26 @@ var SubprocessUnix = {
       environ = libc.environ;
     }
 
-    for (let envp = environ; !envp.contents.isNull(); envp = envp.increment()) {
-      let str = envp.contents.readString();
+    const EQUAL = "=".charCodeAt(0);
+    let decoder = new TextDecoder("utf-8", {fatal: true});
 
-      let idx = str.indexOf("=");
-      if (idx >= 0) {
-        yield [str.slice(0, idx),
-               str.slice(idx + 1)];
+    function decode(array) {
+      try {
+        return decoder.decode(array);
+      } catch (e) {
+        return array;
+      }
+    }
+
+    for (let envp = environ; !envp.contents.isNull(); envp = envp.increment()) {
+      let buf = ptrToUint8Array(envp.contents);
+
+      for (let i = 0; i < buf.length; i++) {
+        if (buf[i] == EQUAL) {
+          yield [decode(buf.subarray(0, i)),
+                 decode(buf.subarray(i + 1))];
+          break;
+        }
       }
     }
   },
@@ -146,7 +176,7 @@ var SubprocessUnix = {
     }
 
     let dirs = [];
-    if (environment.PATH) {
+    if (typeof environment.PATH === "string") {
       dirs = environment.PATH.split(":");
     }
 
diff --git a/toolkit/modules/subprocess/test/xpcshell/test_subprocess.js b/toolkit/modules/subprocess/test/xpcshell/test_subprocess.js
index 2119ab9fba25..99420acde660 100644
--- a/toolkit/modules/subprocess/test/xpcshell/test_subprocess.js
+++ b/toolkit/modules/subprocess/test/xpcshell/test_subprocess.js
@@ -716,6 +716,33 @@ add_task(function* test_subprocess_environmentAppend() {
   equal(exitCode, 0, "Got expected exit code");
 });
 
+if (AppConstants.platform !== "win") {
+  add_task(function* test_subprocess_nonASCII() {
+    const {libc} = Cu.import("resource://gre/modules/subprocess/subprocess_unix.jsm", {});
+
+    // Use TextDecoder rather than a string with a \xff escape, since
+    // the latter will automatically be normalized to valid UTF-8.
+    let val = new TextDecoder().decode(Uint8Array.of(1, 255));
+
+    libc.setenv("FOO", Uint8Array.from(val + "\0", c => c.charCodeAt(0)), 1);
+
+    let proc = yield Subprocess.call({
+      command: PYTHON,
+      arguments: ["-u", TEST_SCRIPT, "env", "FOO"],
+    });
+
+    let foo = yield read(proc.stdout);
+
+    equal(foo, val, "Got expected $FOO value");
+
+    env.set("FOO", "");
+
+    let {exitCode} = yield proc.wait();
+
+    equal(exitCode, 0, "Got expected exit code");
+  });
+}
+
 
 add_task(function* test_bad_executable() {
   // Test with a non-executable file.
diff --git a/toolkit/mozapps/installer/upload-files.mk b/toolkit/mozapps/installer/upload-files.mk
index 5545ed9c28cd..cafffb42fb8b 100644
--- a/toolkit/mozapps/installer/upload-files.mk
+++ b/toolkit/mozapps/installer/upload-files.mk
@@ -210,30 +210,12 @@ ifeq ($(MOZ_PKG_FORMAT),DMG)
   PKG_DMG_SOURCE = $(MOZ_PKG_DIR)
   INNER_MAKE_PACKAGE	= $(call py_action,make_dmg,'$(PKG_DMG_SOURCE)' '$(PACKAGE)')
   INNER_UNMAKE_PACKAGE	= \
-    set -ex; \
-    rm -rf $(ABS_DIST)/unpack.tmp; \
-    mkdir -p $(ABS_DIST)/unpack.tmp; \
-    $(_ABS_MOZSRCDIR)/build/package/mac_osx/unpack-diskimage $(UNPACKAGE) /tmp/$(MOZ_PKG_APPNAME)-unpack $(ABS_DIST)/unpack.tmp; \
-    rsync -a '$(ABS_DIST)/unpack.tmp/$(_APPNAME)' $(MOZ_PKG_DIR); \
-    if test -n '$(MOZ_PKG_MAC_DSSTORE)' ; then \
-      mkdir -p '$(dir $(MOZ_PKG_MAC_DSSTORE))'; \
-      rsync -a '$(ABS_DIST)/unpack.tmp/.DS_Store' '$(MOZ_PKG_MAC_DSSTORE)'; \
-    fi; \
-    if test -n '$(MOZ_PKG_MAC_BACKGROUND)' ; then \
-      mkdir -p '$(dir $(MOZ_PKG_MAC_BACKGROUND))'; \
-      rsync -a '$(ABS_DIST)/unpack.tmp/.background/$(notdir $(MOZ_PKG_MAC_BACKGROUND))' '$(MOZ_PKG_MAC_BACKGROUND)'; \
-    fi; \
-    if test -n '$(MOZ_PKG_MAC_ICON)' ; then \
-      mkdir -p '$(dir $(MOZ_PKG_MAC_ICON))'; \
-      rsync -a '$(ABS_DIST)/unpack.tmp/.VolumeIcon.icns' '$(MOZ_PKG_MAC_ICON)'; \
-    fi; \
-    rm -rf $(ABS_DIST)/unpack.tmp; \
-    if test -n '$(MOZ_PKG_MAC_RSRC)' ; then \
-      cp $(UNPACKAGE) $(MOZ_PKG_APPNAME).tmp.dmg && \
-      hdiutil unflatten $(MOZ_PKG_APPNAME).tmp.dmg && \
-      { /Developer/Tools/DeRez -skip plst -skip blkx $(MOZ_PKG_APPNAME).tmp.dmg > '$(MOZ_PKG_MAC_RSRC)' || { rm -f $(MOZ_PKG_APPNAME).tmp.dmg && false; }; } && \
-      rm -f $(MOZ_PKG_APPNAME).tmp.dmg; \
-    fi
+    $(call py_action,unpack_dmg, \
+        $(if $(MOZ_PKG_MAC_DSSTORE),--dsstore '$(MOZ_PKG_MAC_DSSTORE)') \
+        $(if $(MOZ_PKG_MAC_BACKGROUND),--background '$(MOZ_PKG_MAC_BACKGROUND)') \
+        $(if $(MOZ_PKG_MAC_ICON),--icon '$(MOZ_PKG_MAC_ICON)') \
+        '$(UNPACKAGE)' '$(MOZ_PKG_DIR)' \
+        )
 endif
 
 ifdef MOZ_INTERNAL_SIGNING_FORMAT
diff --git a/toolkit/themes/shared/reader/RM-Content-Width-Minus-42x16.svg b/toolkit/themes/shared/reader/RM-Content-Width-Minus-42x16.svg
index 48bbb9e89042..482a392fb611 100644
--- a/toolkit/themes/shared/reader/RM-Content-Width-Minus-42x16.svg
+++ b/toolkit/themes/shared/reader/RM-Content-Width-Minus-42x16.svg
@@ -1,13 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<svg version="1.1"
-     xmlns="http://www.w3.org/2000/svg"
-     xmlns:xlink="http://www.w3.org/1999/xlink"
+<svg xmlns="http://www.w3.org/2000/svg"
      width="42"
      height="16"
      viewBox="0 0 42 16"
diff --git a/toolkit/themes/shared/reader/RM-Content-Width-Plus-44x16.svg b/toolkit/themes/shared/reader/RM-Content-Width-Plus-44x16.svg
index bcdcbe8ad441..da02e608f6eb 100644
--- a/toolkit/themes/shared/reader/RM-Content-Width-Plus-44x16.svg
+++ b/toolkit/themes/shared/reader/RM-Content-Width-Plus-44x16.svg
@@ -1,13 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<svg version="1.1"
-     xmlns="http://www.w3.org/2000/svg"
-     xmlns:xlink="http://www.w3.org/1999/xlink"
+<svg xmlns="http://www.w3.org/2000/svg"
      width="44"
      height="16"
      viewBox="0 0 44 16"
diff --git a/toolkit/themes/shared/reader/RM-Line-Height-Minus-38x14.svg b/toolkit/themes/shared/reader/RM-Line-Height-Minus-38x14.svg
index 05d52828a1eb..59517c24613f 100644
--- a/toolkit/themes/shared/reader/RM-Line-Height-Minus-38x14.svg
+++ b/toolkit/themes/shared/reader/RM-Line-Height-Minus-38x14.svg
@@ -1,13 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<svg version="1.1"
-     xmlns="http://www.w3.org/2000/svg"
-     xmlns:xlink="http://www.w3.org/1999/xlink"
+<svg xmlns="http://www.w3.org/2000/svg"
      width="38"
      height="14"
      viewBox="0 0 38 14"
diff --git a/toolkit/themes/shared/reader/RM-Line-Height-Plus-38x24.svg b/toolkit/themes/shared/reader/RM-Line-Height-Plus-38x24.svg
index 0a5ee0dccfbc..ba50c5a52e28 100644
--- a/toolkit/themes/shared/reader/RM-Line-Height-Plus-38x24.svg
+++ b/toolkit/themes/shared/reader/RM-Line-Height-Plus-38x24.svg
@@ -1,13 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<svg version="1.1"
-     xmlns="http://www.w3.org/2000/svg"
-     xmlns:xlink="http://www.w3.org/1999/xlink"
+<svg xmlns="http://www.w3.org/2000/svg"
      width="38"
      height="24"
      viewBox="0 0 38 24"
diff --git a/toolkit/xre/nsUpdateDriver.cpp b/toolkit/xre/nsUpdateDriver.cpp
index e702f7a28ed5..fcbdcb9e08ad 100644
--- a/toolkit/xre/nsUpdateDriver.cpp
+++ b/toolkit/xre/nsUpdateDriver.cpp
@@ -50,15 +50,8 @@
 
 using namespace mozilla;
 
-static PRLogModuleInfo *
-GetUpdateLog()
-{
-  static PRLogModuleInfo *sUpdateLog;
-  if (!sUpdateLog)
-    sUpdateLog = PR_NewLogModule("updatedriver");
-  return sUpdateLog;
-}
-#define LOG(args) MOZ_LOG(GetUpdateLog(), mozilla::LogLevel::Debug, args)
+static LazyLogModule sUpdateLog("updatedriver");
+#define LOG(args) MOZ_LOG(sUpdateLog, mozilla::LogLevel::Debug, args)
 
 #ifdef XP_WIN
 #define UPDATER_BIN "updater.exe"
diff --git a/tools/profiler/core/ProfileBuffer.cpp b/tools/profiler/core/ProfileBuffer.cpp
index 72604efddeb3..43df07344edf 100644
--- a/tools/profiler/core/ProfileBuffer.cpp
+++ b/tools/profiler/core/ProfileBuffer.cpp
@@ -1,4 +1,5 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -39,12 +40,14 @@ void ProfileBuffer::addTag(const ProfileBufferEntry& aTag)
   }
 }
 
-void ProfileBuffer::addTagThreadId(LastSample& aLS)
+void ProfileBuffer::addTagThreadId(int aThreadId, LastSample* aLS)
 {
-  // This is the start of a sample, so make a note of its location in |aLS|.
-  aLS.mGeneration = mGeneration;
-  aLS.mPos = mWritePos;
-  addTag(ProfileBufferEntry::ThreadId(aLS.mThreadId));
+  if (aLS) {
+    // This is the start of a sample, so make a note of its location in |aLS|.
+    aLS->mGeneration = mGeneration;
+    aLS->mPos = mWritePos;
+  }
+  addTag(ProfileBufferEntry::ThreadId(aThreadId));
 }
 
 void ProfileBuffer::addStoredMarker(ProfilerMarker *aStoredMarker) {
diff --git a/tools/profiler/core/ProfileBuffer.h b/tools/profiler/core/ProfileBuffer.h
index 56445c0d4ef4..6e4b11d4b0fb 100644
--- a/tools/profiler/core/ProfileBuffer.h
+++ b/tools/profiler/core/ProfileBuffer.h
@@ -20,16 +20,14 @@ public:
   ~ProfileBuffer();
 
   // LastSample is used to record the buffer location of the most recent
-  // sample for each thread.
+  // sample for each thread. It is used for periodic samples stored in the
+  // global ProfileBuffer, but *not* for synchronous samples.
   struct LastSample {
-    explicit LastSample(int aThreadId)
-      : mThreadId(aThreadId)
-      , mGeneration(0)
+    LastSample()
+      : mGeneration(0)
       , mPos(-1)
     {}
 
-    // The thread to which this LastSample pertains.
-    const int mThreadId;
     // The profiler-buffer generation number at which the sample was created.
     uint32_t mGeneration;
     // And its position in the buffer, or -1 meaning "invalid".
@@ -39,9 +37,9 @@ public:
   // Add |aTag| to the buffer, ignoring what kind of entry it is.
   void addTag(const ProfileBufferEntry& aTag);
 
-  // Add to the buffer, a sample start (ThreadId) entry, for the thread that
-  // |aLS| belongs to, and record the resulting generation and index in |aLS|.
-  void addTagThreadId(LastSample& aLS);
+  // Add to the buffer a sample start (ThreadId) entry for aThreadId. Also,
+  // record the resulting generation and index in |aLS| if it's non-null.
+  void addTagThreadId(int aThreadId, LastSample* aLS);
 
   void StreamSamplesToJSON(SpliceableJSONWriter& aWriter, int aThreadId, double aSinceTime,
                            JSContext* cx, UniqueStacks& aUniqueStacks);
@@ -50,9 +48,9 @@ public:
                            double aSinceTime,
                            UniqueStacks& aUniqueStacks);
 
-  // Find the most recent sample for the thread denoted by |aLS| and clone it,
-  // patching in |aStartTime| as appropriate.
-  bool DuplicateLastSample(const mozilla::TimeStamp& aStartTime,
+  // Find (via |aLS|) the most recent sample for the thread denoted by
+  // |aThreadId| and clone it, patching in |aStartTime| as appropriate.
+  bool DuplicateLastSample(int aThreadId, const mozilla::TimeStamp& aStartTime,
                            LastSample& aLS);
 
   void addStoredMarker(ProfilerMarker* aStoredMarker);
@@ -65,7 +63,7 @@ public:
 
 protected:
   char* processDynamicTag(int readPos, int* tagsConsumed, char* tagBuff);
-  int FindLastSampleOfThread(const LastSample& aLS);
+  int FindLastSampleOfThread(int aThreadId, const LastSample& aLS);
 
 public:
   // Circular buffer 'Keep One Slot Open' implementation for simplicity
diff --git a/tools/profiler/core/ProfileBufferEntry.cpp b/tools/profiler/core/ProfileBufferEntry.cpp
index 747f9119bb9e..fb443faedb93 100644
--- a/tools/profiler/core/ProfileBufferEntry.cpp
+++ b/tools/profiler/core/ProfileBufferEntry.cpp
@@ -693,6 +693,7 @@ void ProfileBuffer::StreamSamplesToJSON(SpliceableJSONWriter& aWriter, int aThre
               unsigned depth = aUniqueStacks.LookupJITFrameDepth(pc);
               if (depth == 0) {
                 StreamJSFramesOp framesOp(pc, stack);
+                MOZ_RELEASE_ASSERT(aContext);
                 JS::ForEachProfiledFrame(aContext, pc, framesOp);
                 aUniqueStacks.AddJITFrameDepth(pc, framesOp.depth());
               } else {
@@ -743,7 +744,7 @@ ProfileBuffer::StreamMarkersToJSON(SpliceableJSONWriter& aWriter,
 }
 
 int
-ProfileBuffer::FindLastSampleOfThread(const LastSample& aLS)
+ProfileBuffer::FindLastSampleOfThread(int aThreadId, const LastSample& aLS)
 {
   // |aLS| has a valid generation number if either it matches the buffer's
   // generation, or is one behind the buffer's generation, since the buffer's
@@ -763,7 +764,7 @@ ProfileBuffer::FindLastSampleOfThread(const LastSample& aLS)
     // is still valid.
     MOZ_RELEASE_ASSERT(0 <= ix && ix < mEntrySize);
     ProfileBufferEntry& entry = mEntries[ix];
-    bool isStillValid = entry.isThreadId() && entry.mTagInt == aLS.mThreadId;
+    bool isStillValid = entry.isThreadId() && entry.mTagInt == aThreadId;
     return isStillValid ? ix : -1;
   }
 
@@ -774,17 +775,18 @@ ProfileBuffer::FindLastSampleOfThread(const LastSample& aLS)
 }
 
 bool
-ProfileBuffer::DuplicateLastSample(const TimeStamp& aStartTime, LastSample& aLS)
+ProfileBuffer::DuplicateLastSample(int aThreadId, const TimeStamp& aStartTime,
+                                   LastSample& aLS)
 {
-  int lastSampleStartPos = FindLastSampleOfThread(aLS);
+  int lastSampleStartPos = FindLastSampleOfThread(aThreadId, aLS);
   if (lastSampleStartPos == -1) {
     return false;
   }
 
   MOZ_ASSERT(mEntries[lastSampleStartPos].isThreadId() &&
-             mEntries[lastSampleStartPos].mTagInt == aLS.mThreadId);
+             mEntries[lastSampleStartPos].mTagInt == aThreadId);
 
-  addTagThreadId(aLS);
+  addTagThreadId(aThreadId, &aLS);
 
   // Go through the whole entry and duplicate it, until we find the next one.
   for (int readPos = (lastSampleStartPos + 1) % mEntrySize;
diff --git a/tools/profiler/core/ProfilerBacktrace.cpp b/tools/profiler/core/ProfilerBacktrace.cpp
index 90bee794538c..0a8fc6cbb897 100644
--- a/tools/profiler/core/ProfilerBacktrace.cpp
+++ b/tools/profiler/core/ProfilerBacktrace.cpp
@@ -9,20 +9,19 @@
 #include "ProfileJSONWriter.h"
 #include "ThreadInfo.h"
 
-ProfilerBacktrace::ProfilerBacktrace(ProfileBuffer* aBuffer,
-                                     ThreadInfo* aThreadInfo)
-  : mBuffer(aBuffer)
-  , mThreadInfo(aThreadInfo)
+ProfilerBacktrace::ProfilerBacktrace(const char* aName, int aThreadId,
+                                     ProfileBuffer* aBuffer)
+  : mName(strdup(aName))
+  , mThreadId(aThreadId)
+  , mBuffer(aBuffer)
 {
   MOZ_COUNT_CTOR(ProfilerBacktrace);
-  MOZ_ASSERT(aThreadInfo && aThreadInfo->HasProfile());
 }
 
 ProfilerBacktrace::~ProfilerBacktrace()
 {
   MOZ_COUNT_DTOR(ProfilerBacktrace);
   delete mBuffer;
-  delete mThreadInfo;
 }
 
 void
@@ -30,6 +29,14 @@ ProfilerBacktrace::StreamJSON(SpliceableJSONWriter& aWriter,
                               const TimeStamp& aStartTime,
                               UniqueStacks& aUniqueStacks)
 {
-  mThreadInfo->StreamSamplesAndMarkers(mBuffer, aWriter, aStartTime,
-                                       /* aSinceTime */ 0, aUniqueStacks);
+  // This call to StreamSamplesAndMarkers() can safely pass in a non-null
+  // JSContext. That's because StreamSamplesAndMarkers() only accesses the
+  // JSContext when streaming JitReturnAddress entries, and such entries
+  // never appear in synchronous samples.
+  StreamSamplesAndMarkers(mName.get(), mThreadId,
+                          mBuffer, aWriter, aStartTime,
+                          /* aSinceTime */ 0, /* aContext */ nullptr,
+                          /* aSavedStreamedSamples */ nullptr,
+                          /* aSavedStreamedMarkers */ nullptr,
+                          aUniqueStacks);
 }
diff --git a/tools/profiler/core/ProfilerBacktrace.h b/tools/profiler/core/ProfilerBacktrace.h
index ee8eeb7d85be..53129bb0e751 100644
--- a/tools/profiler/core/ProfilerBacktrace.h
+++ b/tools/profiler/core/ProfilerBacktrace.h
@@ -7,15 +7,18 @@
 #ifndef __PROFILER_BACKTRACE_H
 #define __PROFILER_BACKTRACE_H
 
+#include "mozilla/UniquePtrExtensions.h"
+
 class ProfileBuffer;
 class SpliceableJSONWriter;
 class ThreadInfo;
 class UniqueStacks;
 
+// ProfilerBacktrace encapsulates a synchronous sample.
 class ProfilerBacktrace
 {
 public:
-  explicit ProfilerBacktrace(ProfileBuffer* aBuffer, ThreadInfo* aThreadInfo);
+  ProfilerBacktrace(const char* aName, int aThreadId, ProfileBuffer* aBuffer);
   ~ProfilerBacktrace();
 
   // ProfilerBacktraces' stacks are deduplicated in the context of the
@@ -32,8 +35,9 @@ private:
   ProfilerBacktrace(const ProfilerBacktrace&);
   ProfilerBacktrace& operator=(const ProfilerBacktrace&);
 
+  mozilla::UniqueFreePtr<char> mName;
+  int mThreadId;
   ProfileBuffer* mBuffer;
-  ThreadInfo* mThreadInfo;
 };
 
 #endif // __PROFILER_BACKTRACE_H
diff --git a/tools/profiler/core/ThreadInfo.cpp b/tools/profiler/core/ThreadInfo.cpp
index 90db68d473aa..4ab2fba224a8 100644
--- a/tools/profiler/core/ThreadInfo.cpp
+++ b/tools/profiler/core/ThreadInfo.cpp
@@ -30,7 +30,7 @@ ThreadInfo::ThreadInfo(const char* aName, int aThreadId, bool aIsMainThread,
   , mStackTop(aStackTop)
   , mPendingDelete(false)
   , mHasProfile(false)
-  , mLastSample(aThreadId)
+  , mLastSample()
 {
   MOZ_COUNT_CTOR(ThreadInfo);
   mThread = NS_GetCurrentThread();
@@ -50,9 +50,7 @@ ThreadInfo::~ThreadInfo()
 {
   MOZ_COUNT_DTOR(ThreadInfo);
 
-  if (mPendingDelete) {
-    delete mPseudoStack;
-  }
+  delete mPseudoStack;
 }
 
 void
@@ -72,8 +70,12 @@ ThreadInfo::StreamJSON(ProfileBuffer* aBuffer, SpliceableJSONWriter& aWriter,
 
   aWriter.Start(SpliceableJSONWriter::SingleLineStyle);
   {
-    StreamSamplesAndMarkers(aBuffer, aWriter, aStartTime, aSinceTime,
-                            *mUniqueStacks);
+    StreamSamplesAndMarkers(Name(), ThreadId(), aBuffer, aWriter, aStartTime,
+                            aSinceTime, mPseudoStack->mContext,
+                            mSavedStreamedSamples.get(),
+                            mSavedStreamedMarkers.get(), *mUniqueStacks);
+    mSavedStreamedSamples.reset();
+    mSavedStreamedMarkers.reset();
 
     aWriter.StartObjectProperty("stackTable");
     {
@@ -122,17 +124,22 @@ ThreadInfo::StreamJSON(ProfileBuffer* aBuffer, SpliceableJSONWriter& aWriter,
 }
 
 void
-ThreadInfo::StreamSamplesAndMarkers(ProfileBuffer* aBuffer,
-                                    SpliceableJSONWriter& aWriter,
-                                    const TimeStamp& aStartTime,
-                                    double aSinceTime,
-                                    UniqueStacks& aUniqueStacks)
+StreamSamplesAndMarkers(const char* aName,
+                        int aThreadId,
+                        ProfileBuffer* aBuffer,
+                        SpliceableJSONWriter& aWriter,
+                        const TimeStamp& aStartTime,
+                        double aSinceTime,
+                        JSContext* aContext,
+                        char* aSavedStreamedSamples,
+                        char* aSavedStreamedMarkers,
+                        UniqueStacks& aUniqueStacks)
 {
   aWriter.StringProperty("processType",
                          XRE_ChildProcessTypeToString(XRE_GetProcessType()));
 
-  aWriter.StringProperty("name", Name());
-  aWriter.IntProperty("tid", static_cast<int64_t>(mThreadId));
+  aWriter.StringProperty("name", aName);
+  aWriter.IntProperty("tid", static_cast<int64_t>(aThreadId));
   aWriter.IntProperty("pid", static_cast<int64_t>(getpid()));
 
   aWriter.StartObjectProperty("samples");
@@ -149,16 +156,15 @@ ThreadInfo::StreamSamplesAndMarkers(ProfileBuffer* aBuffer,
 
     aWriter.StartArrayProperty("data");
     {
-      if (mSavedStreamedSamples) {
+      if (aSavedStreamedSamples) {
         // We would only have saved streamed samples during shutdown
         // streaming, which cares about dumping the entire buffer, and thus
         // should have passed in 0 for aSinceTime.
         MOZ_ASSERT(aSinceTime == 0);
-        aWriter.Splice(mSavedStreamedSamples.get());
-        mSavedStreamedSamples.reset();
+        aWriter.Splice(aSavedStreamedSamples);
       }
-      aBuffer->StreamSamplesToJSON(aWriter, mThreadId, aSinceTime,
-                                   mPseudoStack->mContext, aUniqueStacks);
+      aBuffer->StreamSamplesToJSON(aWriter, aThreadId, aSinceTime, aContext,
+                                   aUniqueStacks);
     }
     aWriter.EndArray();
   }
@@ -175,12 +181,11 @@ ThreadInfo::StreamSamplesAndMarkers(ProfileBuffer* aBuffer,
 
     aWriter.StartArrayProperty("data");
     {
-      if (mSavedStreamedMarkers) {
+      if (aSavedStreamedMarkers) {
         MOZ_ASSERT(aSinceTime == 0);
-        aWriter.Splice(mSavedStreamedMarkers.get());
-        mSavedStreamedMarkers.reset();
+        aWriter.Splice(aSavedStreamedMarkers);
       }
-      aBuffer->StreamMarkersToJSON(aWriter, mThreadId, aStartTime, aSinceTime,
+      aBuffer->StreamMarkersToJSON(aWriter, aThreadId, aStartTime, aSinceTime,
                                    aUniqueStacks);
     }
     aWriter.EndArray();
@@ -236,11 +241,7 @@ size_t
 ThreadInfo::SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const
 {
   size_t n = aMallocSizeOf(this);
-
   n += aMallocSizeOf(mName.get());
-
-  // We measure the PseudoStack whether mPendingDelete is set or not, because
-  // the memory reporter doesn't measure through tlsPseudoStack.
   n += mPseudoStack->SizeOfIncludingThis(aMallocSizeOf);
 
   // Measurement of the following members may be added later if DMD finds it
diff --git a/tools/profiler/core/ThreadInfo.h b/tools/profiler/core/ThreadInfo.h
index d651d45e2548..e7ba75ab353a 100644
--- a/tools/profiler/core/ThreadInfo.h
+++ b/tools/profiler/core/ThreadInfo.h
@@ -44,8 +44,7 @@ private:
   int mThreadId;
   const bool mIsMainThread;
 
-  // The thread's PseudoStack. This is an owning pointer iff mIsPendingDelete
-  // is set.
+  // The thread's PseudoStack. This is an owning pointer.
   mozilla::NotNull<PseudoStack*> mPseudoStack;
 
   UniquePlatformData mPlatformData;
@@ -56,7 +55,7 @@ private:
 
   // When a thread dies while the profiler is active we keep its ThreadInfo
   // (and its PseudoStack) around for a while, and put it in a "pending delete"
-  // state. In this state, mPseudoStack is an owning pointer.
+  // state.
   bool mPendingDelete;
 
   //
@@ -81,12 +80,6 @@ public:
     mRespInfo.Update(mIsMainThread, mThread);
   }
 
-  void StreamSamplesAndMarkers(ProfileBuffer* aBuffer,
-                               SpliceableJSONWriter& aWriter,
-                               const mozilla::TimeStamp& aStartTime,
-                               double aSinceTime,
-                               UniqueStacks& aUniqueStacks);
-
 private:
   bool mHasProfile;
 
@@ -100,11 +93,20 @@ private:
 
   ThreadResponsiveness mRespInfo;
 
-  // When sampling, this holds the generation number and offset in the
-  // ProfileBuffer of the most recent sample for this thread.
-  // mLastSample.mThreadId duplicates mThreadId in this structure, which
-  // simplifies some uses of mLastSample.
+  // When sampling, this holds the generation number and offset in
+  // ProfilerState::mBuffer of the most recent sample for this thread.
   ProfileBuffer::LastSample mLastSample;
 };
 
+void
+StreamSamplesAndMarkers(const char* aName, int aThreadId,
+                        ProfileBuffer* aBuffer,
+                        SpliceableJSONWriter& aWriter,
+                        const mozilla::TimeStamp& aStartTime,
+                        double aSinceTime,
+                        JSContext* aContext,
+                        char* aSavedStreamedSamples,
+                        char* aSavedStreamedMarkers,
+                        UniqueStacks& aUniqueStacks);
+
 #endif
diff --git a/tools/profiler/core/platform-linux-android.cpp b/tools/profiler/core/platform-linux-android.cpp
index 4daf248969fe..8a5182697022 100644
--- a/tools/profiler/core/platform-linux-android.cpp
+++ b/tools/profiler/core/platform-linux-android.cpp
@@ -77,22 +77,25 @@ Thread::GetCurrentId()
 }
 
 static void
-SetSampleContext(TickSample* sample, mcontext_t& mcontext)
+FillInSample(TickSample* aSample, ucontext_t* aContext)
 {
+  aSample->mContext = aContext;
+  mcontext_t& mcontext = aContext->uc_mcontext;
+
   // Extracting the sample from the context is extremely machine dependent.
 #if defined(GP_ARCH_x86)
-  sample->mPC = reinterpret_cast<Address>(mcontext.gregs[REG_EIP]);
-  sample->mSP = reinterpret_cast<Address>(mcontext.gregs[REG_ESP]);
-  sample->mFP = reinterpret_cast<Address>(mcontext.gregs[REG_EBP]);
+  aSample->mPC = reinterpret_cast<Address>(mcontext.gregs[REG_EIP]);
+  aSample->mSP = reinterpret_cast<Address>(mcontext.gregs[REG_ESP]);
+  aSample->mFP = reinterpret_cast<Address>(mcontext.gregs[REG_EBP]);
 #elif defined(GP_ARCH_amd64)
-  sample->mPC = reinterpret_cast<Address>(mcontext.gregs[REG_RIP]);
-  sample->mSP = reinterpret_cast<Address>(mcontext.gregs[REG_RSP]);
-  sample->mFP = reinterpret_cast<Address>(mcontext.gregs[REG_RBP]);
+  aSample->mPC = reinterpret_cast<Address>(mcontext.gregs[REG_RIP]);
+  aSample->mSP = reinterpret_cast<Address>(mcontext.gregs[REG_RSP]);
+  aSample->mFP = reinterpret_cast<Address>(mcontext.gregs[REG_RBP]);
 #elif defined(GP_ARCH_arm)
-  sample->mPC = reinterpret_cast<Address>(mcontext.arm_pc);
-  sample->mSP = reinterpret_cast<Address>(mcontext.arm_sp);
-  sample->mFP = reinterpret_cast<Address>(mcontext.arm_fp);
-  sample->mLR = reinterpret_cast<Address>(mcontext.arm_lr);
+  aSample->mPC = reinterpret_cast<Address>(mcontext.arm_pc);
+  aSample->mSP = reinterpret_cast<Address>(mcontext.arm_sp);
+  aSample->mFP = reinterpret_cast<Address>(mcontext.arm_fp);
+  aSample->mLR = reinterpret_cast<Address>(mcontext.arm_lr);
 #else
 # error "bad platform"
 #endif
@@ -360,7 +363,7 @@ SamplerThread::SuspendAndSampleAndResumeThread(PS::LockRef aLock,
   // complete control over |sSigHandlerCoordinator|.
   MOZ_ASSERT(!sSigHandlerCoordinator);
 
-  int sampleeTid = aSample->mThreadInfo->ThreadId();
+  int sampleeTid = aSample->mThreadId;
   MOZ_RELEASE_ASSERT(sampleeTid != mSamplerTid);
 
   //----------------------------------------------------------------//
@@ -403,11 +406,8 @@ SamplerThread::SuspendAndSampleAndResumeThread(PS::LockRef aLock,
   // The samplee thread is now frozen and sSigHandlerCoordinator->mUContext is
   // valid.  We can poke around in it and unwind its stack as we like.
 
-  aSample->mContext = &sSigHandlerCoordinator->mUContext;
-
-  // Extract the current pc and sp.
-  SetSampleContext(aSample,
-                   sSigHandlerCoordinator->mUContext.uc_mcontext);
+  // Extract the current PC and sp.
+  FillInSample(aSample, &sSigHandlerCoordinator->mUContext);
 
   Tick(aLock, gPS->Buffer(aLock), aSample);
 
@@ -505,10 +505,11 @@ PlatformInit(PS::LockRef aLock)
 void
 TickSample::PopulateContext(ucontext_t* aContext)
 {
+  MOZ_ASSERT(mIsSynchronous);
   MOZ_ASSERT(aContext);
+
   if (!getcontext(aContext)) {
-    mContext = aContext;
-    SetSampleContext(this, aContext->uc_mcontext);
+    FillInSample(this, aContext);
   }
 }
 
diff --git a/tools/profiler/core/platform-macos.cpp b/tools/profiler/core/platform-macos.cpp
index 4a9e276a66b8..ae8f968c08e3 100644
--- a/tools/profiler/core/platform-macos.cpp
+++ b/tools/profiler/core/platform-macos.cpp
@@ -130,8 +130,7 @@ void
 SamplerThread::SuspendAndSampleAndResumeThread(PS::LockRef aLock,
                                                TickSample* aSample)
 {
-  thread_act_t samplee_thread =
-    aSample->mThreadInfo->GetPlatformData()->profiled_thread();
+  thread_act_t samplee_thread = aSample->mPlatformData->profiled_thread();
 
   //----------------------------------------------------------------//
   // Suspend the samplee thread and get its context.
@@ -212,7 +211,9 @@ PlatformInit(PS::LockRef aLock)
 void
 TickSample::PopulateContext(void* aContext)
 {
+  MOZ_ASSERT(mIsSynchronous);
   MOZ_ASSERT(!aContext);
+
   // Note that this asm changes if PopulateContext's parameter list is altered
 #if defined(GP_ARCH_amd64)
   asm (
diff --git a/tools/profiler/core/platform-win32.cpp b/tools/profiler/core/platform-win32.cpp
index 6c8fd37f1af8..8766116064bb 100644
--- a/tools/profiler/core/platform-win32.cpp
+++ b/tools/profiler/core/platform-win32.cpp
@@ -160,7 +160,7 @@ void
 SamplerThread::SuspendAndSampleAndResumeThread(PS::LockRef aLock,
                                                TickSample* aSample)
 {
-  uintptr_t thread = GetThreadHandle(aSample->mThreadInfo->GetPlatformData());
+  uintptr_t thread = GetThreadHandle(aSample->mPlatformData);
   HANDLE profiled_thread = reinterpret_cast<HANDLE>(thread);
   if (profiled_thread == nullptr)
     return;
@@ -237,7 +237,9 @@ PlatformInit(PS::LockRef aLock)
 void
 TickSample::PopulateContext(CONTEXT* aContext)
 {
+  MOZ_ASSERT(mIsSynchronous);
   MOZ_ASSERT(aContext);
+
   mContext = aContext;
   RtlCaptureContext(aContext);
 
diff --git a/tools/profiler/core/platform.cpp b/tools/profiler/core/platform.cpp
index 4dd3d09f7f29..301689bdc5f6 100644
--- a/tools/profiler/core/platform.cpp
+++ b/tools/profiler/core/platform.cpp
@@ -359,35 +359,92 @@ CanNotifyObservers()
 ////////////////////////////////////////////////////////////////////////
 // BEGIN tick/unwinding code
 
-// TickSample captures the information collected for each sample.
+// TickSample contains all the information needed by Tick(). Some of it is
+// pointers to long-lived things, and some of it is sampled just before the
+// call to Tick().
 class TickSample {
 public:
-  explicit TickSample(ThreadInfo* aThreadInfo)
-    : mPC(nullptr)
+  // This constructor is for periodic samples, i.e. those performed in response
+  // to a timer firing. Periodic samples are performed off-thread, i.e. the
+  // SamplerThread samples the thread in question.
+  TickSample(ThreadInfo* aThreadInfo, int64_t aRSSMemory, int64_t aUSSMemory)
+    : mIsSynchronous(false)
+    , mTimeStamp(mozilla::TimeStamp::Now())
+    , mThreadId(aThreadInfo->ThreadId())
+    , mPseudoStack(aThreadInfo->Stack())
+    , mStackTop(aThreadInfo->StackTop())
+    , mLastSample(&aThreadInfo->LastSample())
+    , mPlatformData(aThreadInfo->GetPlatformData())
+    , mRespInfo(aThreadInfo->GetThreadResponsiveness())
+    , mRSSMemory(aRSSMemory)    // may be zero
+    , mUSSMemory(aUSSMemory)    // may be zero
+#if !defined(GP_OS_darwin)
+    , mContext(nullptr)
+#endif
+    , mPC(nullptr)
     , mSP(nullptr)
     , mFP(nullptr)
     , mLR(nullptr)
-    , mContext(nullptr)
-    , mIsSamplingCurrentThread(false)
-    , mThreadInfo(aThreadInfo)
-    , mTimeStamp(mozilla::TimeStamp::Now())
-    , mRSSMemory(0)
-    , mUSSMemory(0)
   {}
 
+  // This constructor is for synchronous samples, i.e. those performed in
+  // response to an explicit sampling request via the API. Synchronous samples
+  // are performed on-thread, i.e. the thread samples itself.
+  TickSample(NotNull<PseudoStack*> aPseudoStack, PlatformData* aPlatformData)
+    : mIsSynchronous(true)
+    , mTimeStamp(mozilla::TimeStamp::Now())
+    , mThreadId(Thread::GetCurrentId())
+    , mPseudoStack(aPseudoStack)
+    , mStackTop(nullptr)
+    , mLastSample(nullptr)
+    , mPlatformData(aPlatformData)
+    , mRespInfo(nullptr)
+    , mRSSMemory(0)
+    , mUSSMemory(0)
+#if !defined(GP_OS_darwin)
+    , mContext(nullptr)
+#endif
+    , mPC(nullptr)
+    , mSP(nullptr)
+    , mFP(nullptr)
+    , mLR(nullptr)
+  {}
+
+  // Fills in mContext, mPC, mSP, mFP, and mLR for a synchronous sample.
   void PopulateContext(tick_context_t* aContext);
 
+  // False for periodic samples, true for synchronous samples.
+  const bool mIsSynchronous;
+
+  const mozilla::TimeStamp mTimeStamp;
+
+  const int mThreadId;
+
+  const NotNull<PseudoStack*> mPseudoStack;
+
+  void* const mStackTop;
+
+  ProfileBuffer::LastSample* const mLastSample;   // may be null
+
+  PlatformData* const mPlatformData;
+
+  ThreadResponsiveness* const mRespInfo;          // may be null
+
+  const int64_t mRSSMemory;                       // may be zero
+  const int64_t mUSSMemory;                       // may be zero
+
+  // The remaining fields are filled in, after construction, by
+  // SamplerThread::SuspendAndSampleAndResume() for periodic samples, and
+  // PopulateContext() for synchronous samples. They are filled in separately
+  // from the other fields in this class because the code that fills them in is
+  // platform-specific.
+#if !defined(GP_OS_darwin)
+  void* mContext; // The context from the signal handler.
+#endif
   Address mPC;    // Instruction pointer.
   Address mSP;    // Stack pointer.
   Address mFP;    // Frame pointer.
   Address mLR;    // ARM link register.
-  void* mContext; // The context from the signal handler, if available. On
-                  // Win32 this may contain the windows thread context.
-  bool mIsSamplingCurrentThread;
-  ThreadInfo* mThreadInfo;
-  mozilla::TimeStamp mTimeStamp;
-  int64_t mRSSMemory;
-  int64_t mUSSMemory;
 };
 
 static void
@@ -519,7 +576,7 @@ static void
 MergeStacksIntoProfile(PS::LockRef aLock, ProfileBuffer* aBuffer,
                        TickSample* aSample, NativeStack& aNativeStack)
 {
-  NotNull<PseudoStack*> pseudoStack = aSample->mThreadInfo->Stack();
+  NotNull<PseudoStack*> pseudoStack = aSample->mPseudoStack;
   volatile js::ProfileEntry* pseudoFrames = pseudoStack->mStack;
   uint32_t pseudoCount = pseudoStack->stackSize();
 
@@ -532,7 +589,7 @@ MergeStacksIntoProfile(PS::LockRef aLock, ProfileBuffer* aBuffer,
   // sampled JIT entries inside the JS engine. See note below concerning 'J'
   // entries.
   uint32_t startBufferGen;
-  startBufferGen = aSample->mIsSamplingCurrentThread
+  startBufferGen = aSample->mIsSynchronous
                  ? UINT32_MAX
                  : aBuffer->mGeneration;
   uint32_t jsCount = 0;
@@ -556,7 +613,7 @@ MergeStacksIntoProfile(PS::LockRef aLock, ProfileBuffer* aBuffer,
                                         startBufferGen);
       for (; jsCount < maxFrames && !jsIter.done(); ++jsIter) {
         // See note below regarding 'J' entries.
-        if (aSample->mIsSamplingCurrentThread || jsIter.isWasm()) {
+        if (aSample->mIsSynchronous || jsIter.isWasm()) {
           uint32_t extracted =
             jsIter.extractStack(jsFrames, jsCount, maxFrames);
           jsCount += extracted;
@@ -671,7 +728,7 @@ MergeStacksIntoProfile(PS::LockRef aLock, ProfileBuffer* aBuffer,
       // JIT code. This means that if we inserted such OptInfoAddr entries into
       // the buffer, nsRefreshDriver would now be holding on to a backtrace
       // with stale JIT code return addresses.
-      if (aSample->mIsSamplingCurrentThread ||
+      if (aSample->mIsSynchronous ||
           jsFrame.kind == JS::ProfilingFrameIterator::Frame_Wasm) {
         AddDynamicCodeLocationTag(aBuffer, jsFrame.label);
       } else {
@@ -699,9 +756,9 @@ MergeStacksIntoProfile(PS::LockRef aLock, ProfileBuffer* aBuffer,
 
   // Update the JS context with the current profile sample buffer generation.
   //
-  // Do not do this for synchronous sampling, which create their own
-  // ProfileBuffers.
-  if (!aSample->mIsSamplingCurrentThread && pseudoStack->mContext) {
+  // Do not do this for synchronous samples, which use their own
+  // ProfileBuffers instead of the global one in ProfilerState.
+  if (!aSample->mIsSynchronous && pseudoStack->mContext) {
     MOZ_ASSERT(aBuffer->mGeneration >= startBufferGen);
     uint32_t lapCount = aBuffer->mGeneration - startBufferGen;
     JS::UpdateJSContextProfilerSampleBufferGen(pseudoStack->mContext,
@@ -747,7 +804,7 @@ DoNativeBacktrace(PS::LockRef aLock, ProfileBuffer* aBuffer,
   uint32_t maxFrames = uint32_t(nativeStack.size - nativeStack.count);
 
 #if defined(GP_OS_darwin) || (defined(GP_PLAT_x86_windows))
-  void* stackEnd = aSample->mThreadInfo->StackTop();
+  void* stackEnd = aSample->mStackTop;
   if (aSample->mFP >= aSample->mSP && aSample->mFP <= stackEnd) {
     FramePointerStackWalk(StackWalkCallback, /* skipFrames */ 0, maxFrames,
                           &nativeStack, reinterpret_cast<void**>(aSample->mFP),
@@ -756,7 +813,7 @@ DoNativeBacktrace(PS::LockRef aLock, ProfileBuffer* aBuffer,
 #else
   // Win64 always omits frame pointers so for it we use the slower
   // MozStackWalk().
-  uintptr_t thread = GetThreadHandle(aSample->mThreadInfo->GetPlatformData());
+  uintptr_t thread = GetThreadHandle(aSample->mPlatformData);
   MOZ_ASSERT(thread);
   MozStackWalk(StackWalkCallback, /* skipFrames */ 0, maxFrames, &nativeStack,
                thread, /* platformData */ nullptr);
@@ -783,7 +840,7 @@ DoNativeBacktrace(PS::LockRef aLock, ProfileBuffer* aBuffer,
   const mcontext_t* mcontext =
     &reinterpret_cast<ucontext_t*>(aSample->mContext)->uc_mcontext;
   mcontext_t savedContext;
-  NotNull<PseudoStack*> pseudoStack = aSample->mThreadInfo->Stack();
+  NotNull<PseudoStack*> pseudoStack = aSample->mPseudoStack;
 
   // The pseudostack contains an "EnterJIT" frame whenever we enter
   // JIT code with profiling enabled; the stack pointer value points
@@ -827,7 +884,7 @@ DoNativeBacktrace(PS::LockRef aLock, ProfileBuffer* aBuffer,
   // Now unwind whatever's left (starting from either the last EnterJIT frame
   // or, if no EnterJIT was found, the original registers).
   nativeStack.count += EHABIStackWalk(*mcontext,
-                                      aSample->mThreadInfo->StackTop(),
+                                      aSample->mStackTop,
                                       sp_array + nativeStack.count,
                                       pc_array + nativeStack.count,
                                       nativeStack.size - nativeStack.count);
@@ -905,7 +962,7 @@ DoNativeBacktrace(PS::LockRef aLock, ProfileBuffer* aBuffer,
 #else
 #   error "Unknown plat"
 #endif
-    uintptr_t end = reinterpret_cast<uintptr_t>(aSample->mThreadInfo->StackTop());
+    uintptr_t end = reinterpret_cast<uintptr_t>(aSample->mStackTop);
     uintptr_t ws  = sizeof(void*);
     start &= ~(ws-1);
     end   &= ~(ws-1);
@@ -992,15 +1049,12 @@ DoSampleStackTrace(PS::LockRef aLock, ProfileBuffer* aBuffer,
 static void
 Tick(PS::LockRef aLock, ProfileBuffer* aBuffer, TickSample* aSample)
 {
-  ThreadInfo& threadInfo = *aSample->mThreadInfo;
-
-  MOZ_ASSERT(threadInfo.LastSample().mThreadId == threadInfo.ThreadId());
-  aBuffer->addTagThreadId(threadInfo.LastSample());
+  aBuffer->addTagThreadId(aSample->mThreadId, aSample->mLastSample);
 
   mozilla::TimeDuration delta = aSample->mTimeStamp - gPS->StartTime(aLock);
   aBuffer->addTag(ProfileBufferEntry::Time(delta.ToMilliseconds()));
 
-  NotNull<PseudoStack*> stack = threadInfo.Stack();
+  NotNull<PseudoStack*> pseudoStack = aSample->mPseudoStack;
 
 #if defined(HAVE_NATIVE_UNWIND)
   if (gPS->FeatureStackWalk(aLock)) {
@@ -1011,10 +1065,11 @@ Tick(PS::LockRef aLock, ProfileBuffer* aBuffer, TickSample* aSample)
     DoSampleStackTrace(aLock, aBuffer, aSample);
   }
 
-  // Don't process the PeudoStack's markers if we're synchronously sampling the
-  // current thread.
-  if (!aSample->mIsSamplingCurrentThread) {
-    ProfilerMarkerLinkedList* pendingMarkersList = stack->getPendingMarkers();
+  // Don't process the PseudoStack's markers if we're synchronously sampling
+  // the current thread.
+  if (!aSample->mIsSynchronous) {
+    ProfilerMarkerLinkedList* pendingMarkersList =
+      pseudoStack->getPendingMarkers();
     while (pendingMarkersList && pendingMarkersList->peek()) {
       ProfilerMarker* marker = pendingMarkersList->popHead();
       aBuffer->addStoredMarker(marker);
@@ -1022,10 +1077,9 @@ Tick(PS::LockRef aLock, ProfileBuffer* aBuffer, TickSample* aSample)
     }
   }
 
-  if (threadInfo.GetThreadResponsiveness()->HasData()) {
+  if (aSample->mRespInfo && aSample->mRespInfo->HasData()) {
     mozilla::TimeDuration delta =
-      threadInfo.GetThreadResponsiveness()->GetUnresponsiveDuration(
-        aSample->mTimeStamp);
+      aSample->mRespInfo->GetUnresponsiveDuration(aSample->mTimeStamp);
     aBuffer->addTag(ProfileBufferEntry::Responsiveness(delta.ToMilliseconds()));
   }
 
@@ -1621,7 +1675,8 @@ SamplerThread::Run()
           // cheaper than taking a new sample.
           if (info->Stack()->CanDuplicateLastSampleDueToSleep()) {
             bool dup_ok =
-              gPS->Buffer(lock)->DuplicateLastSample(gPS->StartTime(lock),
+              gPS->Buffer(lock)->DuplicateLastSample(info->ThreadId(),
+                                                     gPS->StartTime(lock),
                                                      info->LastSample());
             if (dup_ok) {
               continue;
@@ -1630,16 +1685,18 @@ SamplerThread::Run()
 
           info->UpdateThreadResponsiveness();
 
-          TickSample sample(info);
-
           // We only get the memory measurements once for all threads.
+          int64_t rssMemory = 0;
+          int64_t ussMemory = 0;
           if (i == 0 && gPS->FeatureMemory(lock)) {
-            sample.mRSSMemory = nsMemoryReporterManager::ResidentFast();
+            rssMemory = nsMemoryReporterManager::ResidentFast();
 #if defined(GP_OS_linux) || defined(GP_OS_android)
-            sample.mUSSMemory = nsMemoryReporterManager::ResidentUnique();
+            ussMemory = nsMemoryReporterManager::ResidentUnique();
 #endif
           }
 
+          TickSample sample(info, rssMemory, ussMemory);
+
           SuspendAndSampleAndResumeThread(lock, &sample);
         }
 
@@ -1807,6 +1864,27 @@ MaybeSetProfile(PS::LockRef aLock, ThreadInfo* aInfo)
   }
 }
 
+// Find the ThreadInfo for the current thread. On success, *aIndexOut is set to
+// the index if it is non-null.
+static ThreadInfo*
+FindThreadInfo(PS::LockRef aLock, int* aIndexOut = nullptr)
+{
+  // This function runs both on and off the main thread.
+
+  Thread::tid_t id = Thread::GetCurrentId();
+  const PS::ThreadVector& threads = gPS->Threads(aLock);
+  for (uint32_t i = 0; i < threads.size(); i++) {
+    ThreadInfo* info = threads.at(i);
+    if (info->ThreadId() == id && !info->IsPendingDelete()) {
+      if (aIndexOut) {
+        *aIndexOut = i;
+      }
+      return info;
+    }
+  }
+  return nullptr;
+}
+
 static void
 locked_register_thread(PS::LockRef aLock, const char* aName, void* stackTop)
 {
@@ -1814,17 +1892,7 @@ locked_register_thread(PS::LockRef aLock, const char* aName, void* stackTop)
 
   MOZ_RELEASE_ASSERT(gPS);
 
-  PS::ThreadVector& threads = gPS->Threads(aLock);
-  Thread::tid_t id = Thread::GetCurrentId();
-  for (uint32_t i = 0; i < threads.size(); i++) {
-    ThreadInfo* info = threads.at(i);
-    if (info->ThreadId() == id && !info->IsPendingDelete()) {
-      // Thread already registered. This means the first unregister will be
-      // too early.
-      MOZ_ASSERT(false);
-      return;
-    }
-  }
+  MOZ_RELEASE_ASSERT(!FindThreadInfo(aLock));
 
   if (!tlsPseudoStack.init()) {
     return;
@@ -1832,8 +1900,8 @@ locked_register_thread(PS::LockRef aLock, const char* aName, void* stackTop)
   NotNull<PseudoStack*> stack = WrapNotNull(new PseudoStack());
   tlsPseudoStack.set(stack);
 
-  ThreadInfo* info =
-    new ThreadInfo(aName, id, NS_IsMainThread(), stack, stackTop);
+  ThreadInfo* info = new ThreadInfo(aName, Thread::GetCurrentId(),
+                                    NS_IsMainThread(), stack, stackTop);
 
   MaybeSetProfile(aLock, info);
 
@@ -1845,7 +1913,7 @@ locked_register_thread(PS::LockRef aLock, const char* aName, void* stackTop)
     stack->pollJSSampling();
   }
 
-  threads.push_back(info);
+  gPS->Threads(aLock).push_back(info);
 }
 
 static void
@@ -2045,11 +2113,8 @@ profiler_shutdown()
     delete gPS;
     gPS = nullptr;
 
-    // We just destroyed gPS and the ThreadInfos it contains, so it is safe to
-    // delete the PseudoStack. tlsPseudoStack is certain to still be the owner
-    // of its PseudoStack because the main thread is never put in a "pending
-    // delete" state.
-    delete tlsPseudoStack.get();
+    // We just destroyed gPS and the ThreadInfos (and PseudoStacks) it
+    // contains, so we can clear this thread's tlsPseudoStack.
     tlsPseudoStack.set(nullptr);
 
 #ifdef MOZ_TASK_TRACER
@@ -2785,37 +2850,39 @@ profiler_unregister_thread()
 
   PS::AutoLock lock(gPSMutex);
 
-  Thread::tid_t id = Thread::GetCurrentId();
-
-  bool wasPseudoStackTransferred = false;
-
-  PS::ThreadVector& threads = gPS->Threads(lock);
-  for (uint32_t i = 0; i < threads.size(); i++) {
-    ThreadInfo* info = threads.at(i);
-    if (info->ThreadId() == id && !info->IsPendingDelete()) {
-      DEBUG_LOG("profiler_unregister_thread: %s", info->Name());
-      if (gPS->IsActive(lock)) {
-        // We still want to show the results of this thread if you save the
-        // profile shortly after a thread is terminated, which requires
-        // transferring ownership of the PseudoStack to |info|. For now we will
-        // defer the delete to profile stop.
-        info->SetPendingDelete();
-        wasPseudoStackTransferred = true;
-      } else {
-        delete info;
-        threads.erase(threads.begin() + i);
-      }
-      break;
-    }
-  }
-
   // We don't call PseudoStack::stopJSSampling() here; there's no point doing
   // that for a JS thread that is in the process of disappearing.
 
-  if (!wasPseudoStackTransferred) {
-    delete tlsPseudoStack.get();
+  int i;
+  ThreadInfo* info = FindThreadInfo(lock, &i);
+  if (info) {
+    DEBUG_LOG("profiler_unregister_thread: %s", info->Name());
+    if (gPS->IsActive(lock)) {
+      // We still want to show the results of this thread if you save the
+      // profile shortly after a thread is terminated. We defer the delete to
+      // profile stop.
+      info->SetPendingDelete();
+    } else {
+      delete info;
+      PS::ThreadVector& threads = gPS->Threads(lock);
+      threads.erase(threads.begin() + i);
+    }
+
+    // Whether or not we just destroyed the PseudoStack (via its owning
+    // ThreadInfo), we no longer need to access it via TLS.
+    tlsPseudoStack.set(nullptr);
+
+  } else {
+    // There are two ways FindThreadInfo() can fail.
+    //
+    // - tlsPseudoStack.init() failed in locked_register_thread().
+    //
+    // - We've already called profiler_unregister_thread() for this thread.
+    //   (Whether or not it should, this does happen in practice.)
+    //
+    // Either way, tlsPseudoStack should be empty.
+    MOZ_RELEASE_ASSERT(!tlsPseudoStack.get());
   }
-  tlsPseudoStack.set(nullptr);
 }
 
 void
@@ -2906,16 +2973,14 @@ profiler_get_backtrace()
     MOZ_ASSERT(stack);
     return nullptr;
   }
+
   Thread::tid_t tid = Thread::GetCurrentId();
 
   ProfileBuffer* buffer = new ProfileBuffer(GET_BACKTRACE_DEFAULT_ENTRIES);
-  ThreadInfo* threadInfo =
-    new ThreadInfo("SyncProfile", tid, NS_IsMainThread(), WrapNotNull(stack),
-                   /* stackTop */ nullptr);
-  threadInfo->SetHasProfile();
 
-  TickSample sample(threadInfo);
-  sample.mIsSamplingCurrentThread = true;
+  UniquePlatformData platformData = AllocPlatformData(tid);
+
+  TickSample sample(WrapNotNull(stack), platformData.get());
 
 #if defined(HAVE_NATIVE_UNWIND)
 #if defined(GP_OS_windows) || defined(GP_OS_linux) || defined(GP_OS_android)
@@ -2930,7 +2995,8 @@ profiler_get_backtrace()
 
   Tick(lock, buffer, &sample);
 
-  return UniqueProfilerBacktrace(new ProfilerBacktrace(buffer, threadInfo));
+  return UniqueProfilerBacktrace(
+    new ProfilerBacktrace("SyncProfile", tid, buffer));
 }
 
 void
@@ -3122,15 +3188,11 @@ profiler_clear_js_context()
   if (gPS->IsActive(lock)) {
     gPS->SetIsPaused(lock, true);
 
-    // Find the ThreadInfo corresponding to this thread, if there is one, and
-    // flush it.
-    const PS::ThreadVector& threads = gPS->Threads(lock);
-    for (size_t i = 0; i < threads.size(); i++) {
-      ThreadInfo* info = threads.at(i);
-      if (info->HasProfile() && !info->IsPendingDelete() &&
-          info->Stack() == stack) {
-        info->FlushSamplesAndMarkers(gPS->Buffer(lock), gPS->StartTime(lock));
-      }
+    // Flush this thread's ThreadInfo, if it is being profiled.
+    ThreadInfo* info = FindThreadInfo(lock);
+    MOZ_RELEASE_ASSERT(info);
+    if (info->HasProfile()) {
+      info->FlushSamplesAndMarkers(gPS->Buffer(lock), gPS->StartTime(lock));
     }
 
     gPS->SetIsPaused(lock, false);
diff --git a/tools/profiler/public/GeckoProfiler.h b/tools/profiler/public/GeckoProfiler.h
index 1acf4f40cbac..12c432e7bf9e 100644
--- a/tools/profiler/public/GeckoProfiler.h
+++ b/tools/profiler/public/GeckoProfiler.h
@@ -9,7 +9,9 @@
 // generic cross-platform way without requiring custom tools or kernel support.
 //
 // Samples are collected to form a timeline with optional timeline event
-// (markers) used for filtering.
+// (markers) used for filtering. Both "periodic" (in response to a timer) and
+// "synchronous" (in response to an explicit sampling request via the API)
+// samples are supported.
 //
 // The profiler collects samples that include native stacks and
 // platform-independent "pseudostacks".
@@ -317,11 +319,10 @@ PROFILER_FUNC_VOID(profiler_log(const char *str))
 class nsISupports;
 class ProfilerMarkerPayload;
 
-// Each thread gets its own PseudoStack on thread creation. tlsPseudoStack is
-// the owning reference; ThreadInfo has a non-owning reference. On thread
-// destruction, either (a) the PseudoStack and the ThreadInfo are both
-// destroyed, or (b) neither is destroyed and ownership of PseudoStack is
-// transferred to the ThreadInfo. Either way, tlsPseudoStack is cleared.
+// Each thread gets its own PseudoStack on thread creation. ThreadInfo has the
+// owning reference; tlsPseudoStack is a non-owning reference. On thread
+// destruction, tlsPseudoStack is cleared, and the ThreadInfo (along with its
+// PseudoStack) may or may not be destroyed.
 //
 // Non-owning PseudoStack references are also temporarily used by
 // profiler_call_{enter,exit}() pairs. RAII classes ensure these calls are
diff --git a/tools/profiler/tests/gtest/ThreadProfileTest.cpp b/tools/profiler/tests/gtest/ThreadProfileTest.cpp
index 1d0dc00d59d7..0e7235bba2bd 100644
--- a/tools/profiler/tests/gtest/ThreadProfileTest.cpp
+++ b/tools/profiler/tests/gtest/ThreadProfileTest.cpp
@@ -13,17 +13,17 @@ using mozilla::WrapNotNull;
 
 // Make sure we can initialize our thread profile
 TEST(ThreadProfile, Initialization) {
-  NotNull<PseudoStack*> stack = WrapNotNull(new PseudoStack());
   Thread::tid_t tid = 1000;
-  ThreadInfo info("testThread", tid, true, stack, nullptr);
+  ThreadInfo info("testThread", tid, true, WrapNotNull(new PseudoStack()),
+                  nullptr);
   info.SetHasProfile();
 }
 
 // Make sure we can record one tag and read it
 TEST(ThreadProfile, InsertOneTag) {
-  NotNull<PseudoStack*> stack = WrapNotNull(new PseudoStack());
   Thread::tid_t tid = 1000;
-  ThreadInfo info("testThread", tid, true, stack, nullptr);
+  ThreadInfo info("testThread", tid, true, WrapNotNull(new PseudoStack()),
+                  nullptr);
   ProfileBuffer* pb = new ProfileBuffer(10);
   pb->addTag(ProfileBufferEntry::Time(123.1));
   ASSERT_TRUE(pb->mEntries != nullptr);
@@ -34,9 +34,9 @@ TEST(ThreadProfile, InsertOneTag) {
 
 // See if we can insert some tags
 TEST(ThreadProfile, InsertTagsNoWrap) {
-  NotNull<PseudoStack*> stack = WrapNotNull(new PseudoStack());
   Thread::tid_t tid = 1000;
-  ThreadInfo info("testThread", tid, true, stack, nullptr);
+  ThreadInfo info("testThread", tid, true, WrapNotNull(new PseudoStack()),
+                  nullptr);
   ProfileBuffer* pb = new ProfileBuffer(100);
   int test_size = 50;
   for (int i = 0; i < test_size; i++) {
@@ -54,12 +54,12 @@ TEST(ThreadProfile, InsertTagsNoWrap) {
 
 // See if wrapping works as it should in the basic case
 TEST(ThreadProfile, InsertTagsWrap) {
-  NotNull<PseudoStack*> stack = WrapNotNull(new PseudoStack());
   Thread::tid_t tid = 1000;
   // we can fit only 24 tags in this buffer because of the empty slot
   int tags = 24;
   int buffer_size = tags + 1;
-  ThreadInfo info("testThread", tid, true, stack, nullptr);
+  ThreadInfo info("testThread", tid, true, WrapNotNull(new PseudoStack()),
+                  nullptr);
   ProfileBuffer* pb = new ProfileBuffer(buffer_size);
   int test_size = 43;
   for (int i = 0; i < test_size; i++) {
diff --git a/widget/cocoa/NativeKeyBindings.mm b/widget/cocoa/NativeKeyBindings.mm
index 34af931c87ce..739b5a899f48 100644
--- a/widget/cocoa/NativeKeyBindings.mm
+++ b/widget/cocoa/NativeKeyBindings.mm
@@ -14,7 +14,7 @@
 namespace mozilla {
 namespace widget {
 
-PRLogModuleInfo* gNativeKeyBindingsLog = nullptr;
+static LazyLogModule gNativeKeyBindingsLog("NativeKeyBindings");
 
 NativeKeyBindings* NativeKeyBindings::sInstanceForSingleLineEditor = nullptr;
 NativeKeyBindings* NativeKeyBindings::sInstanceForMultiLineEditor = nullptr;
@@ -64,10 +64,6 @@ NativeKeyBindings::NativeKeyBindings()
 void
 NativeKeyBindings::Init(NativeKeyBindingsType aType)
 {
-  if (!gNativeKeyBindingsLog) {
-    gNativeKeyBindingsLog = PR_NewLogModule("NativeKeyBindings");
-  }
-
   MOZ_LOG(gNativeKeyBindingsLog, LogLevel::Info,
     ("%p NativeKeyBindings::Init", this));
 
diff --git a/widget/cocoa/nsChildView.mm b/widget/cocoa/nsChildView.mm
index 5332aa635fb6..4172d7adf930 100644
--- a/widget/cocoa/nsChildView.mm
+++ b/widget/cocoa/nsChildView.mm
@@ -116,7 +116,7 @@ using mozilla::gfx::Matrix4x4;
 // out to the bounding-box if there are more
 #define MAX_RECTS_IN_REGION 100
 
-PRLogModuleInfo* sCocoaLog = nullptr;
+LazyLogModule sCocoaLog("nsCocoaWidgets");
 
 extern "C" {
   CG_EXTERN void CGContextResetCTM(CGContextRef);
@@ -264,9 +264,6 @@ FlipCocoaScreenCoordinate(NSPoint &inPoint)
 
 void EnsureLogInitialized()
 {
-  if (!sCocoaLog) {
-    sCocoaLog = PR_NewLogModule("nsCocoaWidgets");
-  }
 }
 
 namespace {
diff --git a/widget/cocoa/nsClipboard.mm b/widget/cocoa/nsClipboard.mm
index 48f9ff8f835f..61858ba306db 100644
--- a/widget/cocoa/nsClipboard.mm
+++ b/widget/cocoa/nsClipboard.mm
@@ -33,7 +33,7 @@ using mozilla::LogLevel;
                                NSPasteboardTypePNG, \
                                nil
 
-extern PRLogModuleInfo* sCocoaLog;
+extern mozilla::LazyLogModule sCocoaLog;
 
 extern void EnsureLogInitialized();
 
diff --git a/widget/cocoa/nsDragService.mm b/widget/cocoa/nsDragService.mm
index 28b931dd378b..ca76a5550bcd 100644
--- a/widget/cocoa/nsDragService.mm
+++ b/widget/cocoa/nsDragService.mm
@@ -34,7 +34,7 @@
 using namespace mozilla;
 using namespace mozilla::gfx;
 
-extern PRLogModuleInfo* sCocoaLog;
+extern mozilla::LazyLogModule sCocoaLog;
 
 extern void EnsureLogInitialized();
 
diff --git a/widget/gtk/nsAppShell.cpp b/widget/gtk/nsAppShell.cpp
index 324f356756a0..b32e08b9e33d 100644
--- a/widget/gtk/nsAppShell.cpp
+++ b/widget/gtk/nsAppShell.cpp
@@ -27,13 +27,14 @@
 using mozilla::Unused;
 using mozilla::widget::ScreenHelperGTK;
 using mozilla::widget::ScreenManager;
+using mozilla::LazyLogModule;
 
 #define NOTIFY_TOKEN 0xFA
 
-PRLogModuleInfo *gWidgetLog = nullptr;
-PRLogModuleInfo *gWidgetFocusLog = nullptr;
-PRLogModuleInfo *gWidgetDragLog = nullptr;
-PRLogModuleInfo *gWidgetDrawLog = nullptr;
+LazyLogModule gWidgetLog("Widget");
+LazyLogModule gWidgetFocusLog("WidgetFocus");
+LazyLogModule gWidgetDragLog("WidgetDrag");
+LazyLogModule gWidgetDrawLog("WidgetDraw");
 
 static GPollFunc sPollFunc;
 
@@ -143,15 +144,6 @@ nsAppShell::Init()
     // is a no-op.
     g_type_init();
 
-    if (!gWidgetLog)
-        gWidgetLog = PR_NewLogModule("Widget");
-    if (!gWidgetFocusLog)
-        gWidgetFocusLog = PR_NewLogModule("WidgetFocus");
-    if (!gWidgetDragLog)
-        gWidgetDragLog = PR_NewLogModule("WidgetDrag");
-    if (!gWidgetDrawLog)
-        gWidgetDrawLog = PR_NewLogModule("WidgetDraw");
-
 #ifdef MOZ_ENABLE_DBUS
     nsCOMPtr<nsIPowerManagerService> powerManagerService =
       do_GetService(POWERMANAGERSERVICE_CONTRACTID);
diff --git a/widget/gtk/nsDeviceContextSpecG.cpp b/widget/gtk/nsDeviceContextSpecG.cpp
index fbae30211d94..294c7dd52d98 100644
--- a/widget/gtk/nsDeviceContextSpecG.cpp
+++ b/widget/gtk/nsDeviceContextSpecG.cpp
@@ -41,16 +41,9 @@ using mozilla::gfx::PrintTarget;
 using mozilla::gfx::PrintTargetPDF;
 using mozilla::gfx::PrintTargetPS;
 
-static PRLogModuleInfo *
-GetDeviceContextSpecGTKLog()
-{
-  static PRLogModuleInfo *sLog;
-  if (!sLog)
-    sLog = PR_NewLogModule("DeviceContextSpecGTK");
-  return sLog;
-}
+static LazyLogModule sDeviceContextSpecGTKLog("DeviceContextSpecGTK");
 /* Macro to make lines shorter */
-#define DO_PR_DEBUG_LOG(x) MOZ_LOG(GetDeviceContextSpecGTKLog(), mozilla::LogLevel::Debug, x)
+#define DO_PR_DEBUG_LOG(x) MOZ_LOG(sDeviceContextSpecGTKLog, mozilla::LogLevel::Debug, x)
 
 //----------------------------------------------------------------------------------
 // The printer data is shared between the PrinterEnumerator and the nsDeviceContextSpecGTK
diff --git a/widget/gtk/nsDragService.cpp b/widget/gtk/nsDragService.cpp
index c6d34bca71e1..f795f0e89ac0 100644
--- a/widget/gtk/nsDragService.cpp
+++ b/widget/gtk/nsDragService.cpp
@@ -58,7 +58,7 @@ enum {
   MOZ_GTK_DRAG_RESULT_NO_TARGET
 };
 
-static PRLogModuleInfo *sDragLm = nullptr;
+static LazyLogModule sDragLm("nsDragService");
 
 // data used for synthetic periodic motion events sent to the source widget
 // grabbing real events for the drag.
@@ -134,8 +134,6 @@ nsDragService::nsDragService()
     }
 
     // set up our logging module
-    if (!sDragLm)
-        sDragLm = PR_NewLogModule("nsDragService");
     MOZ_LOG(sDragLm, LogLevel::Debug, ("nsDragService::nsDragService"));
     mCanDrop = false;
     mTargetDragDataReceived = false;
diff --git a/widget/gtk/nsIdleServiceGTK.cpp b/widget/gtk/nsIdleServiceGTK.cpp
index 6b6832c82204..7bae70ddace3 100644
--- a/widget/gtk/nsIdleServiceGTK.cpp
+++ b/widget/gtk/nsIdleServiceGTK.cpp
@@ -15,7 +15,7 @@
 
 using mozilla::LogLevel;
 
-static PRLogModuleInfo* sIdleLog = nullptr;
+static mozilla::LazyLogModule sIdleLog("nsIIdleService");
 
 typedef bool (*_XScreenSaverQueryExtension_fn)(Display* dpy, int* event_base,
                                                  int* error_base);
@@ -65,9 +65,6 @@ static void Initialize()
 nsIdleServiceGTK::nsIdleServiceGTK()
     : mXssInfo(nullptr)
 {
-    if (!sIdleLog)
-        sIdleLog = PR_NewLogModule("nsIIdleService");
-
     Initialize();
 }
 
diff --git a/widget/gtk/nsWindow.h b/widget/gtk/nsWindow.h
index e1069e0622e0..615b84661035 100644
--- a/widget/gtk/nsWindow.h
+++ b/widget/gtk/nsWindow.h
@@ -42,10 +42,10 @@
 #include "nsTArray.h"
 #include "Units.h"
 
-extern PRLogModuleInfo *gWidgetLog;
-extern PRLogModuleInfo *gWidgetFocusLog;
-extern PRLogModuleInfo *gWidgetDragLog;
-extern PRLogModuleInfo *gWidgetDrawLog;
+extern mozilla::LazyLogModule gWidgetLog;
+extern mozilla::LazyLogModule gWidgetFocusLog;
+extern mozilla::LazyLogModule gWidgetDragLog;
+extern mozilla::LazyLogModule gWidgetDrawLog;
 
 #define LOG(args) MOZ_LOG(gWidgetLog, mozilla::LogLevel::Debug, args)
 #define LOGFOCUS(args) MOZ_LOG(gWidgetFocusLog, mozilla::LogLevel::Debug, args)
diff --git a/widget/nsIdleService.cpp b/widget/nsIdleService.cpp
index 866b62fc9ce1..80392322a029 100644
--- a/widget/nsIdleService.cpp
+++ b/widget/nsIdleService.cpp
@@ -46,7 +46,7 @@ using namespace mozilla;
 // Number of seconds in a day.
 #define SECONDS_PER_DAY 86400
 
-static PRLogModuleInfo *sLog = nullptr;
+static LazyLogModule sLog("idleService");
 
 #define LOG_TAG "GeckoIdleService"
 #define LOG_LEVEL ANDROID_LOG_DEBUG
@@ -394,8 +394,6 @@ nsIdleService::nsIdleService() : mCurrentlySetToTimeoutAt(TimeStamp()),
                                  mDeltaToNextIdleSwitchInS(UINT32_MAX),
                                  mLastUserInteraction(TimeStamp::Now())
 {
-  if (sLog == nullptr)
-    sLog = PR_NewLogModule("idleService");
   MOZ_ASSERT(!gIdleService);
   gIdleService = this;
   if (XRE_IsParentProcess()) {
diff --git a/widget/windows/nsAppShell.cpp b/widget/windows/nsAppShell.cpp
index 5ff6450856bc..b183e01308e7 100644
--- a/widget/windows/nsAppShell.cpp
+++ b/widget/windows/nsAppShell.cpp
@@ -36,14 +36,8 @@
 using namespace mozilla;
 using namespace mozilla::widget;
 
-#define WAKE_LOCK_LOG(...) MOZ_LOG(GetWinWakeLockLog(), mozilla::LogLevel::Debug, (__VA_ARGS__))
-PRLogModuleInfo* GetWinWakeLockLog() {
-  static PRLogModuleInfo* log = nullptr;
-  if (!log) {
-    log = PR_NewLogModule("WinWakeLock");
-  }
-  return log;
-}
+#define WAKE_LOCK_LOG(...) MOZ_LOG(gWinWakeLockLog, mozilla::LogLevel::Debug, (__VA_ARGS__))
+static mozilla::LazyLogModule gWinWakeLockLog("WinWakeLock");
 
 // A wake lock listener that disables screen saver when requested by
 // Gecko. For example when we're playing video in a foreground tab we
diff --git a/widget/windows/nsClipboard.cpp b/widget/windows/nsClipboard.cpp
index 95092f462d54..bc15deccef34 100644
--- a/widget/windows/nsClipboard.cpp
+++ b/widget/windows/nsClipboard.cpp
@@ -39,7 +39,7 @@
 
 using mozilla::LogLevel;
 
-PRLogModuleInfo* gWin32ClipboardLog = nullptr;
+static mozilla::LazyLogModule gWin32ClipboardLog("nsClipboard");
 
 // oddly, this isn't in the MSVC headers anywhere.
 UINT nsClipboard::CF_HTML = ::RegisterClipboardFormatW(L"HTML Format");
@@ -53,10 +53,6 @@ UINT nsClipboard::CF_CUSTOMTYPES = ::RegisterClipboardFormatW(L"application/x-mo
 //-------------------------------------------------------------------------
 nsClipboard::nsClipboard() : nsBaseClipboard()
 {
-  if (!gWin32ClipboardLog) {
-    gWin32ClipboardLog = PR_NewLogModule("nsClipboard");
-  }
-
   mIgnoreEmptyNotification = false;
   mWindow         = nullptr;
 
diff --git a/widget/windows/nsSound.cpp b/widget/windows/nsSound.cpp
index b4b6fcef4e8c..04baa490a361 100644
--- a/widget/windows/nsSound.cpp
+++ b/widget/windows/nsSound.cpp
@@ -29,7 +29,7 @@
 
 using mozilla::LogLevel;
 
-PRLogModuleInfo* gWin32SoundLog = nullptr;
+static mozilla::LazyLogModule gWin32SoundLog("nsSound");
 
 class nsSoundPlayer: public mozilla::Runnable {
 public:
@@ -108,10 +108,6 @@ NS_IMPL_ISUPPORTS(nsSound, nsISound, nsIStreamLoaderObserver)
 
 nsSound::nsSound()
 {
-    if (!gWin32SoundLog) {
-      gWin32SoundLog = PR_NewLogModule("nsSound");
-    }
-
     mLastSound = nullptr;
 }
 
diff --git a/widget/xremoteclient/XRemoteClient.cpp b/widget/xremoteclient/XRemoteClient.cpp
index 473cdcb67b17..a7fc83e0a261 100644
--- a/widget/xremoteclient/XRemoteClient.cpp
+++ b/widget/xremoteclient/XRemoteClient.cpp
@@ -52,7 +52,7 @@
 
 using mozilla::LogLevel;
 
-static PRLogModuleInfo *sRemoteLm = nullptr;
+static mozilla::LazyLogModule sRemoteLm("XRemoteClient");
 
 static int (*sOldHandler)(Display *, XErrorEvent *);
 static bool sGotBadWindow;
@@ -70,8 +70,6 @@ XRemoteClient::XRemoteClient()
   mMozProfileAtom = 0;
   mMozProgramAtom = 0;
   mLockData = 0;
-  if (!sRemoteLm)
-    sRemoteLm = PR_NewLogModule("XRemoteClient");
   MOZ_LOG(sRemoteLm, LogLevel::Debug, ("XRemoteClient::XRemoteClient"));
 }
 
diff --git a/xpcom/ds/nsAtomTable.cpp b/xpcom/ds/nsAtomTable.cpp
index d274c5aaac69..205714f30203 100644
--- a/xpcom/ds/nsAtomTable.cpp
+++ b/xpcom/ds/nsAtomTable.cpp
@@ -358,17 +358,28 @@ static const PLDHashTableOps AtomTableOps = {
 
 //----------------------------------------------------------------------
 
+#define RECENTLY_USED_MAIN_THREAD_ATOM_CACHE_SIZE 31
+static nsIAtom*
+  sRecentlyUsedMainThreadAtoms[RECENTLY_USED_MAIN_THREAD_ATOM_CACHE_SIZE] = {};
+
 void
 DynamicAtom::GCAtomTable()
 {
-  MutexAutoLock lock(*gAtomTableLock);
-  GCAtomTableLocked(lock, GCKind::RegularOperation);
+  if (NS_IsMainThread()) {
+    MutexAutoLock lock(*gAtomTableLock);
+    GCAtomTableLocked(lock, GCKind::RegularOperation);
+  }
 }
 
 void
 DynamicAtom::GCAtomTableLocked(const MutexAutoLock& aProofOfLock,
                                GCKind aKind)
 {
+  MOZ_ASSERT(NS_IsMainThread());
+  for (uint32_t i = 0; i < RECENTLY_USED_MAIN_THREAD_ATOM_CACHE_SIZE; ++i) {
+    sRecentlyUsedMainThreadAtoms[i] = nullptr;
+  }
+
   uint32_t removedCount = 0; // Use a non-atomic temporary for cheaper increments.
   nsAutoCString nonZeroRefcountAtoms;
   uint32_t nonZeroRefcountAtomsCount = 0;
@@ -719,6 +730,40 @@ NS_Atomize(const nsAString& aUTF16String)
   return atom.forget();
 }
 
+already_AddRefed<nsIAtom>
+NS_AtomizeMainThread(const nsAString& aUTF16String)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  nsCOMPtr<nsIAtom> retVal;
+  uint32_t hash;
+  AtomTableKey key(aUTF16String.Data(), aUTF16String.Length(), &hash);
+  uint32_t index = hash % RECENTLY_USED_MAIN_THREAD_ATOM_CACHE_SIZE;
+  nsIAtom* atom =
+    sRecentlyUsedMainThreadAtoms[index];
+  if (atom) {
+    uint32_t length = atom->GetLength();
+    if (length == key.mLength &&
+        (memcmp(atom->GetUTF16String(),
+                key.mUTF16String, length * sizeof(char16_t)) == 0)) {
+      retVal = atom;
+      return retVal.forget();
+    }
+  }
+
+  MutexAutoLock lock(*gAtomTableLock);
+  AtomTableEntry* he = static_cast<AtomTableEntry*>(gAtomTable->Add(&key));
+
+  if (he->mAtom) {
+    retVal = he->mAtom;
+  } else {
+    retVal = DynamicAtom::Create(aUTF16String, hash);
+    he->mAtom = retVal;
+  }
+
+  sRecentlyUsedMainThreadAtoms[index] = retVal;
+  return retVal.forget();
+}
+
 nsrefcnt
 NS_GetNumberOfAtoms(void)
 {
diff --git a/xpcom/ds/nsIAtom.idl b/xpcom/ds/nsIAtom.idl
index 83dc939efe36..f1085089bbc1 100644
--- a/xpcom/ds/nsIAtom.idl
+++ b/xpcom/ds/nsIAtom.idl
@@ -125,6 +125,11 @@ extern already_AddRefed<nsIAtom> NS_Atomize(const char16_t* aUTF16String);
  */
 extern already_AddRefed<nsIAtom> NS_Atomize(const nsAString& aUTF16String);
 
+/**
+ * An optimized version of the method above for the main thread.
+ */
+extern already_AddRefed<nsIAtom> NS_AtomizeMainThread(const nsAString& aUTF16String);
+
 /**
  * Return a count of the total number of atoms currently
  * alive in the system.