Merge last green PGO from inbound to central

.gitignore

@@ -41,7 +41,7 @@ parser/html/java/htmlparser/
 parser/html/java/javaparser/
 
 # Ignore the files and directory that Eclipse IDE creates
-/.project
-/.cproject
-/.settings/
+.project
+.cproject
+.settings/
 

.hgignore

@@ -41,7 +41,7 @@ _OPT\.OBJ/
 \.svn/
 
 # Ignore the files and directory that Eclipse IDE creates
-^\.project$
-^\.cproject$
-^\.settings$
+\.project$
+\.cproject$
+\.settings/
 

accessible/public/nsIAccessibleEvent.idl

@@ -529,6 +529,25 @@ interface nsIAccessibleTextChangeEvent : nsISupports
   readonly attribute DOMString modifiedText;
 };
 
+[scriptable, uuid(a2bd2eca-3afa-489b-afb2-f93ef32ad99c)]
+interface nsIAccessibleHideEvent: nsISupports
+{
+  /**
+   * Return an accessible that was a parent of the target.
+   */
+  readonly attribute nsIAccessible targetParent;
+
+  /**
+   * Return an accessible that was a next sibling of the target
+   */
+  readonly attribute nsIAccessible targetNextSibling;
+
+  /**
+   * Return an accessible that was a parent of the target
+   */
+  readonly attribute nsIAccessible targetPrevSibling;
+};
+
 [scriptable, uuid(5675c486-a230-4d85-a4bd-33670826d5ff)]
 interface nsIAccessibleCaretMoveEvent: nsISupports
 {

accessible/src/base/AccEvent.cpp

@@ -291,6 +291,14 @@ AccHideEvent::
   mPrevSibling = mAccessible->PrevSibling();
 }
 
+already_AddRefed<nsAccEvent>
+AccHideEvent::CreateXPCOMObject()
+{
+  nsAccEvent* event = new nsAccHideEvent(this);
+  NS_ADDREF(event);
+  return event;
+}
+
 
 ////////////////////////////////////////////////////////////////////////////////
 // AccShowEvent

accessible/src/base/AccEvent.h

@@ -270,12 +270,19 @@ public:
   AccHideEvent(nsAccessible* aTarget, nsINode* aTargetNode);
 
   // Event
+  virtual already_AddRefed<nsAccEvent> CreateXPCOMObject();
+
   static const EventGroup kEventGroup = eHideEvent;
   virtual unsigned int GetEventGroups() const
   {
     return AccMutationEvent::GetEventGroups() | (1U << eHideEvent);
   }
 
+  // AccHideEvent
+  nsAccessible* TargetParent() const { return mParent; }
+  nsAccessible* TargetNextSibling() const { return mNextSibling; }
+  nsAccessible* TargetPrevSibling() const { return mPrevSibling; }
+
 protected:
   nsRefPtr<nsAccessible> mParent;
   nsRefPtr<nsAccessible> mNextSibling;

accessible/src/xpcom/nsAccEvent.cpp

@@ -173,6 +173,44 @@ nsAccTextChangeEvent::GetModifiedText(nsAString& aModifiedText)
 }
 
 
+////////////////////////////////////////////////////////////////////////////////
+// nsAccHideEvent
+////////////////////////////////////////////////////////////////////////////////
+
+NS_IMPL_ISUPPORTS_INHERITED1(nsAccHideEvent, nsAccEvent,
+                             nsIAccessibleHideEvent)
+
+NS_IMETHODIMP
+nsAccHideEvent::GetTargetParent(nsIAccessible** aAccessible)
+{
+  NS_ENSURE_ARG_POINTER(aAccessible);
+
+  NS_IF_ADDREF(*aAccessible =
+    static_cast<AccHideEvent*>(mEvent.get())->TargetParent());
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAccHideEvent::GetTargetNextSibling(nsIAccessible** aAccessible)
+{
+  NS_ENSURE_ARG_POINTER(aAccessible);
+
+  NS_IF_ADDREF(*aAccessible =
+    static_cast<AccHideEvent*>(mEvent.get())->TargetNextSibling());
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAccHideEvent::GetTargetPrevSibling(nsIAccessible** aAccessible)
+{
+  NS_ENSURE_ARG_POINTER(aAccessible);
+
+  NS_IF_ADDREF(*aAccessible =
+    static_cast<AccHideEvent*>(mEvent.get())->TargetPrevSibling());
+  return NS_OK;
+}
+
+
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccCaretMoveEvent
 ////////////////////////////////////////////////////////////////////////////////

accessible/src/xpcom/nsAccEvent.h

@@ -105,6 +105,26 @@ private:
 };
 
 
+/**
+ * Accessible hide event.
+ */
+class nsAccHideEvent : public nsAccEvent,
+                       public nsIAccessibleHideEvent
+{
+public:
+  nsAccHideEvent(AccHideEvent* aEvent) : nsAccEvent(aEvent) { }
+  virtual ~nsAccHideEvent() { }
+
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_NSIACCESSIBLEHIDEEVENT
+
+private:
+  nsAccHideEvent() MOZ_DELETE;
+  nsAccHideEvent(const nsAccHideEvent&) MOZ_DELETE;
+  nsAccHideEvent& operator =(const nsAccHideEvent&) MOZ_DELETE;
+};
+
+
 /**
  * Accessible caret move event.
  */

browser/app/profile/extensions/testpilot@labs.mozilla.com/tests/test_data_store.js

@@ -407,7 +407,7 @@ function clearAllPrefsForStudy(studyId) {
   dump("Looking for prefs to delete...\n");
   let prefService = Cc["@mozilla.org/preferences-service;1"]
                      .getService(Ci.nsIPrefService)
-                     .QueryInterface(Ci.nsIPrefBranch2);
+                     .QueryInterface(Ci.nsIPrefBranch);
   let prefStem = "extensions.testpilot";
   let prefNames = prefService.getChildList(prefStem);
   for each (let prefName in prefNames) {
@@ -783,4 +783,4 @@ function testSameGUIDs() {
 }
 
 // TODO test for continuity of GUID with recurring study (longitudinal) - i don't think this
-// has actually been working so far because a new GUID is generted every time the study starts up...
+// has actually been working so far because a new GUID is generted every time the study starts up...

browser/base/content/pageinfo/pageInfo.js

@@ -794,7 +794,7 @@ function selectSaveFolder()
   fp.init(window, titleText, nsIFilePicker.modeGetFolder);
   try {
     var prefs = Components.classes[PREFERENCES_CONTRACTID]
-                          .getService(Components.interfaces.nsIPrefBranch2);
+                          .getService(Components.interfaces.nsIPrefBranch);
 
     var initialDir = prefs.getComplexValue("browser.download.dir", nsILocalFile);
     if (initialDir)
@@ -1104,7 +1104,7 @@ function makeBlockImage(url)
   var permissionManager = Components.classes[PERMISSION_CONTRACTID]
                                     .getService(nsIPermissionManager);
   var prefs = Components.classes[PREFERENCES_CONTRACTID]
-                        .getService(Components.interfaces.nsIPrefBranch2);
+                        .getService(Components.interfaces.nsIPrefBranch);
 
   var checkbox = document.getElementById("blockImage");
   var imagePref = prefs.getIntPref("permissions.default.image");

browser/base/content/pageinfo/permissions.js

@@ -99,7 +99,7 @@ var permissionObserver = {
 function onLoadPermission()
 {
   gPrefs = Components.classes[PREFERENCES_CONTRACTID]
-                     .getService(Components.interfaces.nsIPrefBranch2);
+                     .getService(Components.interfaces.nsIPrefBranch);
 
   var uri = gDocument.documentURIObject;
   var permTab = document.getElementById("permTab");

browser/base/content/sanitize.js

@@ -233,7 +233,7 @@ Sanitizer.prototype = {
         
         // Clear last URL of the Open Web Location dialog
         var prefs = Components.classes["@mozilla.org/preferences-service;1"]
-                              .getService(Components.interfaces.nsIPrefBranch2);
+                              .getService(Components.interfaces.nsIPrefBranch);
         try {
           prefs.clearUserPref("general.open_location.last_url");
         }

browser/base/content/urlbarBindings.xml

@@ -82,8 +82,7 @@
       <constructor><![CDATA[
         this._prefs = Components.classes["@mozilla.org/preferences-service;1"]
                                 .getService(Components.interfaces.nsIPrefService)
-                                .getBranch("browser.urlbar.")
-                                .QueryInterface(Components.interfaces.nsIPrefBranch2);
+                                .getBranch("browser.urlbar.");
 
         this._prefs.addObserver("", this, false);
         this.clickSelectsAll = this._prefs.getBoolPref("clickSelectsAll");

browser/components/feeds/src/FeedWriter.js

@@ -1164,7 +1164,7 @@ FeedWriter.prototype = {
     // Set up the subscription UI
     this._initSubscriptionUI();
     var prefs = Cc["@mozilla.org/preferences-service;1"].
-                getService(Ci.nsIPrefBranch2);
+                getService(Ci.nsIPrefBranch);
     prefs.addObserver(PREF_SELECTED_ACTION, this, false);
     prefs.addObserver(PREF_SELECTED_READER, this, false);
     prefs.addObserver(PREF_SELECTED_WEB, this, false);
@@ -1207,7 +1207,7 @@ FeedWriter.prototype = {
     this._document = null;
     this._window = null;
     var prefs = Cc["@mozilla.org/preferences-service;1"].
-                getService(Ci.nsIPrefBranch2);
+                getService(Ci.nsIPrefBranch);
     prefs.removeObserver(PREF_SELECTED_ACTION, this);
     prefs.removeObserver(PREF_SELECTED_READER, this);
     prefs.removeObserver(PREF_SELECTED_WEB, this);

browser/components/preferences/applications.js

@@ -221,11 +221,8 @@ HandlerInfoWrapper.prototype = {
   _handlerSvc: Cc["@mozilla.org/uriloader/handler-service;1"].
                getService(Ci.nsIHandlerService),
 
-  // Retrieve this as nsIPrefBranch and then immediately QI to nsIPrefBranch2
-  // so both interfaces are available to callers.
   _prefSvc: Cc["@mozilla.org/preferences-service;1"].
-            getService(Ci.nsIPrefBranch).
-            QueryInterface(Ci.nsIPrefBranch2),
+            getService(Ci.nsIPrefBranch),
 
   _categoryMgr: Cc["@mozilla.org/categorymanager;1"].
                 getService(Ci.nsICategoryManager),
@@ -885,11 +882,8 @@ var gApplicationsPane = {
   _list           : null,
   _filter         : null,
 
-  // Retrieve this as nsIPrefBranch and then immediately QI to nsIPrefBranch2
-  // so both interfaces are available to callers.
   _prefSvc      : Cc["@mozilla.org/preferences-service;1"].
-                  getService(Ci.nsIPrefBranch).
-                  QueryInterface(Ci.nsIPrefBranch2),
+                  getService(Ci.nsIPrefBranch),
 
   _mimeSvc      : Cc["@mozilla.org/mime;1"].
                   getService(Ci.nsIMIMEService),

browser/components/preferences/privacy.js

@@ -80,7 +80,6 @@ var gPrivacyPane = {
    */
   prefsForDefault: [
     "places.history.enabled",
-    "browser.download.manager.retention",
     "browser.formfill.enable",
     "network.cookie.cookieBehavior",
     "network.cookie.lifetimePolicy",
@@ -96,7 +95,6 @@ var gPrivacyPane = {
    */
   dependentControls: [
     "rememberHistory",
-    "rememberDownloads",
     "rememberForms",
     "keepUntil",
     "keepCookiesUntil",
@@ -177,10 +175,6 @@ var gPrivacyPane = {
       if (!rememberHistoryCheckbox.checked)
         rememberHistoryCheckbox.checked = true;
 
-      // select the remember downloads option if needed
-      if (!document.getElementById("rememberDownloads").checked)
-        document.getElementById("browser.download.manager.retention").value = 2;
-
       // select the remember forms history option
       document.getElementById("browser.formfill.enable").value = true;
 
@@ -223,8 +217,6 @@ var gPrivacyPane = {
       // adjust the checked state of the remember history checkboxes
       document.getElementById("rememberHistory").checked = disabled ? false :
         document.getElementById("places.history.enabled").value;
-      document.getElementById("rememberDownloads").checked = disabled ? false :
-        this.readDownloadRetention();
       document.getElementById("rememberForms").checked = disabled ? false :
         document.getElementById("browser.formfill.enable").value;
 
@@ -244,7 +236,7 @@ var gPrivacyPane = {
   {
     let prefService = document.getElementById("privacyPreferences")
                               .service
-                              .QueryInterface(Components.interfaces.nsIPrefBranch2);
+                              .QueryInterface(Components.interfaces.nsIPrefBranch);
     prefService.addObserver("browser.privatebrowsing.autostart",
                             this.autoStartPrivateBrowsingObserver,
                             false);
@@ -257,7 +249,7 @@ var gPrivacyPane = {
   {
     let prefService = document.getElementById("privacyPreferences")
                               .service
-                              .QueryInterface(Components.interfaces.nsIPrefBranch2);
+                              .QueryInterface(Components.interfaces.nsIPrefBranch);
     prefService.removeObserver("browser.privatebrowsing.autostart",
                                this.autoStartPrivateBrowsingObserver);
   },
@@ -331,36 +323,8 @@ var gPrivacyPane = {
    * browser.formfill.enable
    * - true if entries in forms and the search bar should be saved, false
    *   otherwise
-   * browser.download.manager.retention
-   * - determines when downloads are automatically removed from the download
-   *   manager:
-   *
-   *     0 means remove downloads when they finish downloading
-   *     1 means downloads will be removed when the browser quits
-   *     2 means never remove downloads
    */
 
-  /**
-   * Converts the value of the browser.download.manager.retention preference
-   * into a Boolean value.  "remove on close" and "don't remember" both map
-   * to an unchecked checkbox, while "remember" maps to a checked checkbox.
-   */
-  readDownloadRetention: function ()
-  {
-    var pref = document.getElementById("browser.download.manager.retention");
-    return (pref.value == 2);
-  },
-
-  /**
-   * Returns the appropriate value of the browser.download.manager.retention
-   * preference for the current UI.
-   */
-  writeDownloadRetention: function ()
-  {
-    var checkbox = document.getElementById("rememberDownloads");
-    return checkbox.checked ? 2 : 0;
-  },
-
   // COOKIES
 
   /*

browser/components/preferences/privacy.xul

@@ -87,9 +87,6 @@
       <preference id="browser.formfill.enable"
                   name="browser.formfill.enable"
                   type="bool"/>
-      <preference id="browser.download.manager.retention"
-                  name="browser.download.manager.retention"
-                  type="int"/>
 
       <!-- Cookies -->
       <preference id="network.cookie.cookieBehavior"      name="network.cookie.cookieBehavior"      type="int"/>
@@ -194,15 +191,9 @@
           <vbox class="indent">
             <vbox class="indent">
               <checkbox id="rememberHistory"
-                        label="&rememberHistory.label;"
-                        accesskey="&rememberHistory.accesskey;"
+                        label="&rememberHistory2.label;"
+                        accesskey="&rememberHistory2.accesskey;"
                         preference="places.history.enabled"/>
-              <checkbox id="rememberDownloads"
-                        label="&rememberDownload.label;"
-                        accesskey="&rememberDownload.accesskey;"
-                        preference="browser.download.manager.retention"
-                        onsyncfrompreference="return gPrivacyPane.readDownloadRetention();"
-                        onsynctopreference="return gPrivacyPane.writeDownloadRetention();"/>
               <checkbox id="rememberForms"
                         label="&rememberSearchForm.label;"
                         accesskey="&rememberSearchForm.accesskey;"

browser/components/preferences/tests/browser_privacypane_3.js

@@ -49,8 +49,6 @@ function test() {
   run_test_subset([
     test_custom_retention("rememberHistory", "remember"),
     test_custom_retention("rememberHistory", "custom"),
-    test_custom_retention("rememberDownloads", "remember"),
-    test_custom_retention("rememberDownloads", "custom"),
     test_custom_retention("rememberForms", "remember"),
     test_custom_retention("rememberForms", "custom"),
     test_historymode_retention("remember", "remember"),

browser/components/preferences/tests/privacypane_tests.js

@@ -92,7 +92,6 @@ function test_dependent_elements(win) {
   ok(pbautostart, "the private browsing auto-start checkbox should exist");
   let controls = [
     win.document.getElementById("rememberHistory"),
-    win.document.getElementById("rememberDownloads"),
     win.document.getElementById("rememberForms"),
     win.document.getElementById("keepUntil"),
     win.document.getElementById("keepCookiesUntil"),
@@ -116,8 +115,6 @@ function test_dependent_elements(win) {
   ok(alwaysclear, "the clear data on close checkbox should exist");
   let rememberhistory = win.document.getElementById("rememberHistory");
   ok(rememberhistory, "the remember history checkbox should exist");
-  let rememberdownloads = win.document.getElementById("rememberDownloads");
-  ok(rememberdownloads, "the remember downloads checkbox should exist");
   let rememberforms = win.document.getElementById("rememberForms");
   ok(rememberforms, "the remember forms checkbox should exist");
   let alwaysclearsettings = win.document.getElementById("clearDataSettings");
@@ -135,8 +132,6 @@ function test_dependent_elements(win) {
         "the clear data on close checkbox value should be as expected");
      ok(!rememberhistory.checked,
         "the remember history checkbox value should be as expected");
-     ok(!rememberdownloads.checked,
-        "the remember downloads checkbox value should be as expected");
      ok(!rememberforms.checked,
         "the remember forms checkbox value should be as expected");
     }
@@ -302,7 +297,6 @@ function test_dependent_prefs(win) {
   ok(historymode, "history mode menulist should exist");
   let controls = [
     win.document.getElementById("rememberHistory"),
-    win.document.getElementById("rememberDownloads"),
     win.document.getElementById("rememberForms"),
     win.document.getElementById("acceptCookies"),
     win.document.getElementById("acceptThirdParty"),

browser/components/privatebrowsing/test/unit/test_geoClearCookie.js

@@ -41,7 +41,7 @@
 const accessToken = '{"location":{"latitude":51.5090332,"longitude":-0.1212726,"accuracy":150.0},"access_token":"2:jVhRZJ-j6PiRchH_:RGMrR0W1BiwdZs12"}'
 function run_test_on_service() {
   var prefBranch = Cc["@mozilla.org/preferences-service;1"].
-                   getService(Ci.nsIPrefBranch2);
+                   getService(Ci.nsIPrefBranch);
   var pb = Cc[PRIVATEBROWSING_CONTRACT_ID].
            getService(Ci.nsIPrivateBrowsingService);
   prefBranch.setCharPref("geo.wifi.access_token.test", accessToken);

browser/components/search/content/search.xml

@@ -539,9 +539,9 @@
       ]]></constructor>
 
       <destructor><![CDATA[
-          var ps2 = Components.classes["@mozilla.org/preferences-service;1"]
-                              .getService(Components.interfaces.nsIPrefBranch2);
-          ps2.removeObserver("browser.search.suggest.enabled", this);
+          var prefs = Components.classes["@mozilla.org/preferences-service;1"]
+                              .getService(Components.interfaces.nsIPrefBranch);
+          prefs.removeObserver("browser.search.suggest.enabled", this);
 
         // Because XBL and the customize toolbar code interacts poorly,
         // there may not be anything to remove here
@@ -635,9 +635,9 @@
           this.controllers.appendController(this.searchbarController);
 
           // Add observer for suggest preference
-          var ps2 = Components.classes["@mozilla.org/preferences-service;1"]
-                              .getService(Components.interfaces.nsIPrefBranch2);
-          ps2.addObserver("browser.search.suggest.enabled", this, false);
+          var prefs = Components.classes["@mozilla.org/preferences-service;1"]
+                              .getService(Components.interfaces.nsIPrefBranch);
+          prefs.addObserver("browser.search.suggest.enabled", this, false);
         ]]></body>
       </method>
 

browser/components/sessionstore/src/nsSessionStore.js

@@ -163,8 +163,7 @@ function debug(aMsg) {
 function SessionStoreService() {
   XPCOMUtils.defineLazyGetter(this, "_prefBranch", function () {
     return Cc["@mozilla.org/preferences-service;1"].
-           getService(Ci.nsIPrefService).getBranch("browser.").
-           QueryInterface(Ci.nsIPrefBranch2);
+           getService(Ci.nsIPrefService).getBranch("browser.");
   });
 
   // minimal interval between two save operations (in milliseconds)

browser/locales/en-US/chrome/browser/preferences/privacy.dtd

@@ -15,7 +15,6 @@
 <!ENTITY  locbar.bookmarks.label        "Bookmarks">
 <!ENTITY  locbar.nothing.label          "Nothing">
 
-
 <!ENTITY  acceptCookies.label           "Accept cookies from sites">
 <!ENTITY  acceptCookies.accesskey       "A">
 
@@ -64,11 +63,8 @@
 <!ENTITY  privateBrowsingPermanent2.label "Always use private browsing mode">
 <!ENTITY  privateBrowsingPermanent2.accesskey "p">
 
-<!ENTITY  rememberHistory.label      "Remember my browsing history">
-<!ENTITY  rememberHistory.accesskey  "b">
-
-<!ENTITY  rememberDownload.label         "Remember download history">
-<!ENTITY  rememberDownload.accesskey     "d">
+<!ENTITY  rememberHistory2.label      "Remember my browsing and download history">
+<!ENTITY  rememberHistory2.accesskey  "b">
 
 <!ENTITY  rememberSearchForm.label       "Remember search and form history">
 <!ENTITY  rememberSearchForm.accesskey   "f">

browser/modules/WindowsJumpLists.jsm

@@ -79,8 +79,7 @@ let EXPORTED_SYMBOLS = [
  */
 
 XPCOMUtils.defineLazyGetter(this, "_prefs", function() {
-  return Services.prefs.getBranch(PREF_TASKBAR_BRANCH)
-                       .QueryInterface(Ci.nsIPrefBranch2);
+  return Services.prefs.getBranch(PREF_TASKBAR_BRANCH);
 });
 
 XPCOMUtils.defineLazyGetter(this, "_stringBundle", function() {

browser/modules/WindowsPreviewPerTab.jsm

@@ -724,6 +724,6 @@ XPCOMUtils.defineLazyGetter(AeroPeek, "cacheTimer", function ()
 
 XPCOMUtils.defineLazyServiceGetter(AeroPeek, "prefs",
                                    "@mozilla.org/preferences-service;1",
-                                   "nsIPrefBranch2");
+                                   "nsIPrefBranch");
 
 AeroPeek.initialize();

chrome/src/nsChromeRegistryChrome.cpp

@@ -67,7 +67,7 @@
 #include "nsILocaleService.h"
 #include "nsILocalFile.h"
 #include "nsIObserverService.h"
-#include "nsIPrefBranch2.h"
+#include "nsIPrefBranch.h"
 #include "nsIPrefService.h"
 #include "nsIResProtocolHandler.h"
 #include "nsIScriptError.h"
@@ -190,12 +190,9 @@ nsChromeRegistryChrome::Init()
 
     SelectLocaleFromPref(prefs);
 
-    nsCOMPtr<nsIPrefBranch2> prefs2 (do_QueryInterface(prefs));
-    if (prefs2) {
-      rv = prefs2->AddObserver(MATCH_OS_LOCALE_PREF, this, true);
-      rv = prefs2->AddObserver(SELECTED_LOCALE_PREF, this, true);
-      rv = prefs2->AddObserver(SELECTED_SKIN_PREF, this, true);
-    }
+    rv = prefs->AddObserver(MATCH_OS_LOCALE_PREF, this, true);
+    rv = prefs->AddObserver(SELECTED_LOCALE_PREF, this, true);
+    rv = prefs->AddObserver(SELECTED_SKIN_PREF, this, true);
   }
 
   nsCOMPtr<nsIObserverService> obsService = mozilla::services::GetObserverService();
@@ -220,7 +217,7 @@ nsChromeRegistryChrome::CheckForOSAccessibility()
       RefreshSkins();
     }
 
-    nsCOMPtr<nsIPrefBranch2> prefs (do_GetService(NS_PREFSERVICE_CONTRACTID));
+    nsCOMPtr<nsIPrefBranch> prefs (do_GetService(NS_PREFSERVICE_CONTRACTID));
     if (prefs) {
       prefs->RemoveObserver(SELECTED_SKIN_PREF, this);
     }
@@ -387,7 +384,7 @@ nsChromeRegistryChrome::Observe(nsISupports *aSubject, const char *aTopic,
                                         false, uiLocale);
       if (NS_SUCCEEDED(rv) && !uiLocale.IsEmpty()) {
         CopyUTF16toUTF8(uiLocale, mSelectedLocale);
-        nsCOMPtr<nsIPrefBranch2> prefs (do_GetService(NS_PREFSERVICE_CONTRACTID));
+        nsCOMPtr<nsIPrefBranch> prefs (do_GetService(NS_PREFSERVICE_CONTRACTID));
         if (prefs) {
           prefs->RemoveObserver(SELECTED_LOCALE_PREF, this);
         }

content/base/public/nsContentUtils.h

@@ -950,6 +950,26 @@ public:
                                        bool aCanBubble,
                                        bool aCancelable,
                                        bool *aDefaultAction = nsnull);
+                                       
+  /**
+   * This method creates and dispatches a untrusted event.
+   * Works only with events which can be created by calling
+   * nsIDOMDocument::CreateEvent() with parameter "Events".
+   * @param aDoc           The document which will be used to create the event.
+   * @param aTarget        The target of the event, should be QIable to
+   *                       nsIDOMEventTarget.
+   * @param aEventName     The name of the event.
+   * @param aCanBubble     Whether the event can bubble.
+   * @param aCancelable    Is the event cancelable.
+   * @param aDefaultAction Set to true if default action should be taken,
+   *                       see nsIDOMEventTarget::DispatchEvent.
+   */
+  static nsresult DispatchUntrustedEvent(nsIDocument* aDoc,
+                                         nsISupports* aTarget,
+                                         const nsAString& aEventName,
+                                         bool aCanBubble,
+                                         bool aCancelable,
+                                         bool *aDefaultAction = nsnull);
 
   /**
    * This method creates and dispatches a trusted event to the chrome
@@ -1945,6 +1965,14 @@ private:
                              const nsIID* aIID, jsval *vp,
                              nsIXPConnectJSObjectHolder** aHolder,
                              bool aAllowWrapping);
+                            
+  static nsresult DispatchEvent(nsIDocument* aDoc,
+                                nsISupports* aTarget,
+                                const nsAString& aEventName,
+                                bool aCanBubble,
+                                bool aCancelable,
+                                bool aTrusted,
+                                bool *aDefaultAction = nsnull);
 
   static void InitializeModifierStrings();
 

content/base/src/CSPUtils.jsm

@@ -64,7 +64,6 @@ var gPrefObserver = {
     var prefSvc = Components.classes["@mozilla.org/preferences-service;1"]
                     .getService(Components.interfaces.nsIPrefService);
     this._branch = prefSvc.getBranch("security.csp.");
-    this._branch.QueryInterface(Components.interfaces.nsIPrefBranch2);
     this._branch.addObserver("", this, false);
     this._debugEnabled = this._branch.getBoolPref("debug");
   },

content/base/src/nsContentUtils.cpp

@@ -3072,7 +3072,7 @@ static
 nsresult GetEventAndTarget(nsIDocument* aDoc, nsISupports* aTarget,
                            const nsAString& aEventName,
                            bool aCanBubble, bool aCancelable,
-                           nsIDOMEvent** aEvent,
+                           bool aTrusted, nsIDOMEvent** aEvent,
                            nsIDOMEventTarget** aTargetOut)
 {
   nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(aDoc);
@@ -3090,7 +3090,7 @@ nsresult GetEventAndTarget(nsIDocument* aDoc, nsISupports* aTarget,
   rv = event->InitEvent(aEventName, aCanBubble, aCancelable);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = privateEvent->SetTrusted(true);
+  rv = privateEvent->SetTrusted(aTrusted);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = privateEvent->SetTarget(target);
@@ -3107,11 +3107,33 @@ nsContentUtils::DispatchTrustedEvent(nsIDocument* aDoc, nsISupports* aTarget,
                                      const nsAString& aEventName,
                                      bool aCanBubble, bool aCancelable,
                                      bool *aDefaultAction)
+{
+  return DispatchEvent(aDoc, aTarget, aEventName, aCanBubble, aCancelable,
+                       true, aDefaultAction);
+}
+
+// static
+nsresult
+nsContentUtils::DispatchUntrustedEvent(nsIDocument* aDoc, nsISupports* aTarget,
+                                       const nsAString& aEventName,
+                                       bool aCanBubble, bool aCancelable,
+                                       bool *aDefaultAction)
+{
+  return DispatchEvent(aDoc, aTarget, aEventName, aCanBubble, aCancelable,
+                       false, aDefaultAction);
+}
+
+// static
+nsresult
+nsContentUtils::DispatchEvent(nsIDocument* aDoc, nsISupports* aTarget,
+                              const nsAString& aEventName,
+                              bool aCanBubble, bool aCancelable,
+                              bool aTrusted, bool *aDefaultAction)
 {
   nsCOMPtr<nsIDOMEvent> event;
   nsCOMPtr<nsIDOMEventTarget> target;
   nsresult rv = GetEventAndTarget(aDoc, aTarget, aEventName, aCanBubble,
-                                  aCancelable, getter_AddRefs(event),
+                                  aCancelable, aTrusted, getter_AddRefs(event),
                                   getter_AddRefs(target));
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -3130,7 +3152,7 @@ nsContentUtils::DispatchChromeEvent(nsIDocument *aDoc,
   nsCOMPtr<nsIDOMEvent> event;
   nsCOMPtr<nsIDOMEventTarget> target;
   nsresult rv = GetEventAndTarget(aDoc, aTarget, aEventName, aCanBubble,
-                                  aCancelable, getter_AddRefs(event),
+                                  aCancelable, true, getter_AddRefs(event),
                                   getter_AddRefs(target));
   NS_ENSURE_SUCCESS(rv, rv);
 

content/base/src/nsCopySupport.cpp

@@ -81,6 +81,10 @@
 
 #include "mozilla/dom/Element.h"
 
+#include "mozilla/Preferences.h"
+
+using namespace mozilla;
+
 nsresult NS_NewDomSelection(nsISelection **aDomSelection);
 
 static NS_DEFINE_CID(kCClipboardCID,           NS_CLIPBOARD_CID);
@@ -727,14 +731,16 @@ nsCopySupport::FireClipboardEvent(PRInt32 aType, nsIPresShell* aPresShell, nsISe
     return false;
 
   // next, fire the cut or copy event
-  nsEventStatus status = nsEventStatus_eIgnore;
-  nsEvent evt(true, aType);
-  nsEventDispatcher::Dispatch(content, presShell->GetPresContext(), &evt, nsnull,
-                              &status);
-  // if the event was cancelled, don't do the clipboard operation
-  if (status == nsEventStatus_eConsumeNoDefault)
-    return false;
-
+  if (Preferences::GetBool("dom.event.clipboardevents.enabled", true)) {
+    nsEventStatus status = nsEventStatus_eIgnore;
+    nsEvent evt(true, aType);
+    nsEventDispatcher::Dispatch(content, presShell->GetPresContext(), &evt, nsnull,
+                                &status);
+    // if the event was cancelled, don't do the clipboard operation
+    if (status == nsEventStatus_eConsumeNoDefault)
+      return false;
+  }
+  
   if (presShell->IsDestroying())
     return false;
 

content/base/src/nsGenericDOMDataNode.cpp

@@ -752,6 +752,9 @@ nsGenericDOMDataNode::SplitData(PRUint32 aOffset, nsIContent** aReturn,
     return rv;
   }
 
+  nsIDocument* document = GetCurrentDoc();
+  mozAutoDocUpdate updateBatch(document, UPDATE_CONTENT_MODEL, true);
+
   // Use Clone for creating the new node so that the new node is of same class
   // as this node!
   nsCOMPtr<nsIContent> newContent = CloneDataNode(mNodeInfo, false);

content/base/test/Makefile.in

@@ -554,6 +554,7 @@ _TEST_FILES2 = \
 		file_bug717511.html^headers^ \
 		file_bug717511_2.html \
 		file_bug717511_2.html^headers^ \
+		test_bug726364.html \
 		$(NULL)
 
 _CHROME_FILES =	\

content/base/test/test_bug726364.html

@@ -0,0 +1,48 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=726364
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 726364</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=726364">Mozilla Bug 726364</a>
+<p id="display"><div id="v">ABC</div></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 726364 **/
+function boom()
+{
+  var v = document.getElementById("v");
+  var t = v.firstChild;
+  is(v.childNodes.length,1, "child count");
+
+  var f = function(event) {
+    window.removeEventListener("DOMCharacterDataModified", f, true);
+    is(v.childNodes[0],t, "first child is the same");
+    is(v.childNodes.length,2, "child count");
+    r.setEnd(v, 0);
+    SimpleTest.finish();
+  };
+  window.addEventListener("DOMCharacterDataModified", f, true);
+
+  var r = document.createRange();
+  r.setStart(t, 2);
+  t.splitText(1);
+}
+
+SimpleTest.waitForExplicitFinish();
+addLoadEvent(boom);
+
+</script>
+</pre>
+</body>
+</html>

content/base/test/test_websocket.html

@@ -74,8 +74,21 @@
 var first_test = 1;
 var last_test = 46;
 
-var current_test = first_test;
 
+// Set this to >1 if you want to run the suite multiple times to probe for
+// random orange failures. 
+// - Do NOT check into mozilla-central with a value != 1.
+// - Too large a count will wind up causing tryserver to timeout the test (which
+//   is ok, but means all testruns will be orange).  If I set first_test to >22
+//   (i.e don't run any of the tests that require waiting) I can get ~250-300
+//   iterations of the remaining tests w/o a timeout.
+var testsuite_iterations = 1;   
+
+
+var current_test = first_test;
+var testsuite_iteration = 1;
+
+var test_started = new Array(last_test);
 var all_ws = [];
 
 function shouldNotOpen(e)
@@ -176,16 +189,21 @@ function doTest(number)
     return;
   }
 
-  $("feedback").innerHTML = "executing test: " + number + " of " + last_test + " tests.";
+  if (testsuite_iteration > 1) {
+    $("feedback").innerHTML = "test suite iteration #" + testsuite_iteration + " of " + testsuite_iterations + 
+      ": executing test: " + number + " of " + last_test + " tests.";
+  } else {
+    $("feedback").innerHTML = "executing test: " + number + " of " + last_test + " tests.";
+  }
 
   var fnTest = eval("test" + number + "");
 
-  if (fnTest._started === true) {
+  if (test_started[number] === true) {
     doTest(number + 1);
     return;
   }
 
-  fnTest._started = true;
+  test_started[number] = true;
   fnTest();
 }
 doTest.timeoutId = null;
@@ -561,7 +579,7 @@ var status_test17 = "not started";
 
 var waitTest17 = false;
 
-window._test17 = function()
+var test17func = function()
 {
   waitTest17 = true;
 
@@ -611,6 +629,7 @@ window._test17 = function()
 
 function test17()
 {
+  window._test17 = test17func;
   window._test17();
 }
 
@@ -644,7 +663,7 @@ function test19()
 
 var waitTest20 = false;
 
-window._test20 = function()
+var test20func = function()
 {
   waitTest20 = true;
 
@@ -674,12 +693,13 @@ window._test20 = function()
 
 function test20()
 {
+  window._test20 = test20func;
   window._test20();
 }
 
 var waitTest21 = false;
 
-window._test21 = function()
+test21func = function()
 {
   waitTest21 = true;
 
@@ -727,6 +747,7 @@ window._test21 = function()
 
 function test21()
 {
+  window._test21 = test21func;
   window._test21();
 }
 
@@ -1422,7 +1443,15 @@ function maybeFinished()
     }
   }
 
-  SimpleTest.finish();
+  if (testsuite_iteration++ < testsuite_iterations) {
+    // play it again, Sam...
+    ok(1, "starting testsuite iteration " + testsuite_iteration);
+    test_started = new Array(last_test);
+    doTest(current_test = first_test);
+  } else {
+    // all done
+    SimpleTest.finish();
+  }
 }
 
 function testWebSocket ()

content/events/test/test_bug350471.xul

@@ -222,7 +222,7 @@ function initPrefs()
 {
   netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
   var prefSvc = Components.classes["@mozilla.org/preferences-service;1"].
-                  getService(Components.interfaces.nsIPrefBranch2);
+                  getService(Components.interfaces.nsIPrefBranch);
   // Disables the app level scroll acceleration
   prefSvc.setIntPref("mousewheel.acceleration.start", -1);
   prefSvc.setBoolPref("mousewheel.system_scroll_override_on_root_content.enabled", false);
@@ -233,7 +233,7 @@ function clearPrefs()
 {
   netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
   var prefSvc = Components.classes["@mozilla.org/preferences-service;1"].
-                  getService(Components.interfaces.nsIPrefBranch2);
+                  getService(Components.interfaces.nsIPrefBranch);
 
   prefSvc.clearUserPref("mousewheel.acceleration.start");
   prefSvc.clearUserPref("mousewheel.system_scroll_override_on_root_content.enabled");

content/events/test/test_bug607464.html

@@ -70,7 +70,7 @@ function initPrefs()
 {
   netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
   var prefSvc = Components.classes["@mozilla.org/preferences-service;1"].
-                  getService(Components.interfaces.nsIPrefBranch2);
+                  getService(Components.interfaces.nsIPrefBranch);
   // Disables the app level scroll acceleration
   prefSvc.setIntPref("mousewheel.acceleration.start", -1);
   prefSvc.setBoolPref("mousewheel.system_scroll_override_on_root_content.enabled", false);
@@ -83,7 +83,7 @@ function clearPrefs()
 {
   netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
   var prefSvc = Components.classes["@mozilla.org/preferences-service;1"].
-                  getService(Components.interfaces.nsIPrefBranch2);
+                  getService(Components.interfaces.nsIPrefBranch);
 
   if (prefSvc.prefHasUserValue("mousewheel.acceleration.start"))
     prefSvc.clearUserPref("mousewheel.acceleration.start");

content/events/test/test_clickevent_on_input.html

@@ -45,7 +45,7 @@ function isEnabledMiddleClickPaste()
   netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
 
   var prefs = Components.classes["@mozilla.org/preferences-service;1"].
-                         getService(Components.interfaces.nsIPrefBranch2);
+                         getService(Components.interfaces.nsIPrefBranch);
   try {
     return prefs.getBoolPref("middlemouse.paste");
   } catch (e) {

content/html/content/src/nsHTMLLegendElement.cpp

@@ -188,7 +188,8 @@ nsHTMLLegendElement::Focus()
     return NS_OK;
 
   nsCOMPtr<nsIDOMElement> result;
-  return fm->MoveFocus(nsnull, this, nsIFocusManager::MOVEFOCUS_FORWARD, 0,
+  return fm->MoveFocus(nsnull, this, nsIFocusManager::MOVEFOCUS_FORWARD,
+                       nsIFocusManager::FLAG_NOPARENTFRAME,
                        getter_AddRefs(result));
 }
 

content/smil/nsSMILAnimationFunction.cpp

@@ -755,7 +755,7 @@ nsSMILAnimationFunction::ParseAttr(nsIAtom* aAttName,
 {
   nsAutoString attValue;
   if (GetAttr(aAttName, attValue)) {
-    bool preventCachingOfSandwich;
+    bool preventCachingOfSandwich = false;
     nsresult rv = aSMILAttr.ValueFromString(attValue, mAnimationElement,
                                             aResult, preventCachingOfSandwich);
     if (NS_FAILED(rv))
@@ -796,7 +796,7 @@ nsSMILAnimationFunction::GetValues(const nsISMILAttr& aSMILAttr,
   if (HasAttr(nsGkAtoms::values)) {
     nsAutoString attValue;
     GetAttr(nsGkAtoms::values, attValue);
-    bool preventCachingOfSandwich;
+    bool preventCachingOfSandwich = false;
     nsresult rv = nsSMILParserUtils::ParseValues(attValue, mAnimationElement,
                                                  aSMILAttr, result,
                                                  preventCachingOfSandwich);

content/smil/nsSMILCSSProperty.cpp

@@ -169,14 +169,17 @@ nsSMILCSSProperty::ValueFromString(const nsAString& aStr,
   nsSMILCSSValueType::ValueFromString(mPropID, mElement, aStr, aValue,
       &aPreventCachingOfSandwich);
 
+  if (aValue.IsNull()) {
+    return NS_ERROR_FAILURE;
+  }
+
   // XXX Due to bug 536660 (or at least that seems to be the most likely
   // culprit), when we have animation setting display:none on a <use> element,
   // if we DON'T set the property every sample, chaos ensues.
   if (!aPreventCachingOfSandwich && mPropID == eCSSProperty_display) {
     aPreventCachingOfSandwich = true;
   }
-
-  return aValue.IsNull() ? NS_ERROR_FAILURE : NS_OK;
+  return NS_OK;
 }
 
 nsresult

content/smil/nsSMILParserUtils.cpp

@@ -564,7 +564,7 @@ public:
 
   virtual nsresult Parse(const nsAString& aValueStr) {
     nsSMILValue newValue;
-    bool tmpPreventCachingOfSandwich;
+    bool tmpPreventCachingOfSandwich = false;
     nsresult rv = mSMILAttr->ValueFromString(aValueStr, mSrcElement, newValue,
                                              tmpPreventCachingOfSandwich);
     if (NS_FAILED(rv))

content/svg/content/src/nsSVGFilters.cpp

@@ -4957,6 +4957,15 @@ GenerateNormal(float *N, const PRUint8 *data, PRInt32 stride,
       { 1.0 / 3.0, 1.0 / 4.0, 1.0 / 3.0 },
       { 2.0 / 3.0, 1.0 / 2.0, 2.0 / 3.0 } };
 
+  // degenerate cases
+  if (surfaceWidth == 1 || surfaceHeight == 1) {
+    // just return a unit vector pointing towards the viewer
+    N[0] = 0;
+    N[1] = 0;
+    N[2] = 255;
+    return;
+  }
+
   PRInt8 xflag, yflag;
   if (x == 0) {
     xflag = 0;

content/xbl/src/nsXBLProtoImplMethod.cpp

@@ -289,13 +289,17 @@ nsresult
 nsXBLProtoImplMethod::Write(nsIScriptContext* aContext,
                             nsIObjectOutputStream* aStream)
 {
-  nsresult rv = aStream->Write8(XBLBinding_Serialize_Method);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (mJSMethodObject) {
+    nsresult rv = aStream->Write8(XBLBinding_Serialize_Method);
+    NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = aStream->WriteWStringZ(mName);
-  NS_ENSURE_SUCCESS(rv, rv);
+    rv = aStream->WriteWStringZ(mName);
+    NS_ENSURE_SUCCESS(rv, rv);
 
-  return XBL_SerializeFunction(aContext, aStream, mJSMethodObject);
+    return XBL_SerializeFunction(aContext, aStream, mJSMethodObject);
+  }
+
+  return NS_OK;
 }
 
 nsresult

content/xbl/src/nsXBLPrototypeHandler.cpp

@@ -1074,7 +1074,7 @@ nsXBLPrototypeHandler::Write(nsIScriptContext* aContext, nsIObjectOutputStream*
 {
   // Make sure we don't write out NS_HANDLER_TYPE_XUL types, as they are used
   // for <keyset> elements.
-  if (mType & NS_HANDLER_TYPE_XUL)
+  if ((mType & NS_HANDLER_TYPE_XUL) || !mEventName)
     return NS_OK;
 
   XBLBindingSerializeDetails type = XBLBinding_Serialize_Handler;

content/xbl/test/Makefile.in

@@ -79,6 +79,8 @@ _CHROME_FILES = \
 		test_bug378518.xul \
 		test_bug398135.xul \
 		test_bug398492.xul \
+		test_bug721452.xul \
+		test_bug723676.xul \
 		$(NULL)
 
 libs:: $(_TEST_FILES)

content/xbl/test/test_bug721452.xul

@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>      
+
+<script>
+ok(true, "Handler with empty action didn't crash")
+</script>
+
+<body xmlns="http://www.w3.org/1999/xhtml"/>
+
+<box style="-moz-binding: url(#binding)"/>
+
+<xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl">
+  <xbl:binding id="binding">
+    <xbl:content/>
+    <xbl:handlers>
+      <xbl:handler nt="action" action=""/>
+    </xbl:handlers>
+  </xbl:binding>
+</xbl:bindings>
+
+</window>

content/xbl/test/test_bug723676.xul

@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>      
+
+<script>
+ok(true, "Method with empty body didn't crash");
+</script>
+
+<body xmlns="http://www.w3.org/1999/xhtml"/>
+
+<box style="-moz-binding: url(#binding)"/>
+
+<xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl">
+  <xbl:binding id="binding">
+    <xbl:implementation>
+      <xbl:method name="init"/>
+    </xbl:implementation>
+  </xbl:binding>
+</xbl:bindings>
+
+
+</window>

docshell/base/nsDSURIContentListener.cpp

@@ -67,7 +67,7 @@ nsDSURIContentListener::nsDSURIContentListener(nsDocShell* aDocShell)
   // Set up a pref cache for sIgnoreXFrameOptions, if we haven't already.
   if (NS_UNLIKELY(!initializedPrefCache)) {
     // Lock the pref so that the user's changes to it, if any, are ignored.
-    nsIPrefBranch2 *root = Preferences::GetRootBranch();
+    nsIPrefBranch *root = Preferences::GetRootBranch();
     root->LockPref("b2g.ignoreXFrameOptions");
 
     Preferences::AddBoolVarCache(&sIgnoreXFrameOptions, "b2g.ignoreXFrameOptions");

dom/base/nsFocusManager.cpp

@@ -527,8 +527,9 @@ nsFocusManager::MoveFocus(nsIDOMWindow* aWindow, nsIDOMElement* aStartElement,
 
   NS_ENSURE_TRUE(window, NS_ERROR_FAILURE);
 
+  bool noParentTraversal = aFlags & FLAG_NOPARENTFRAME;
   nsCOMPtr<nsIContent> newFocus;
-  nsresult rv = DetermineElementToMoveFocus(window, startContent, aType,
+  nsresult rv = DetermineElementToMoveFocus(window, startContent, aType, noParentTraversal,
                                             getter_AddRefs(newFocus));
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -2332,7 +2333,7 @@ nsFocusManager::GetSelectionLocation(nsIDocument* aDocument,
 nsresult
 nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindow* aWindow,
                                             nsIContent* aStartContent,
-                                            PRInt32 aType,
+                                            PRInt32 aType, bool aNoParentTraversal,
                                             nsIContent** aNextContent)
 {
   *aNextContent = nsnull;
@@ -2562,6 +2563,12 @@ nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindow* aWindow,
     skipOriginalContentCheck = false;
     ignoreTabIndex = false;
 
+    if (aNoParentTraversal) {
+      startContent = rootContent;
+      tabIndex = forward ? 1 : 0;
+      continue;
+    }
+
     // reached the beginning or end of the document. Traverse up to the parent
     // document and try again.
     nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(docShell);

dom/base/nsFocusManager.h

@@ -347,11 +347,13 @@ protected:
    * the element to start navigation from. For tab key navigation,
    * this should be the currently focused element.
    *
-   * aType is the type passed to MoveFocus.
+   * aType is the type passed to MoveFocus. If aNoParentTraversal is set,
+   * navigation is not done to parent documents and iteration returns to the
+   * beginning (or end) of the starting document.
    */
   nsresult DetermineElementToMoveFocus(nsPIDOMWindow* aWindow,
                                        nsIContent* aStart,
-                                       PRInt32 aType,
+                                       PRInt32 aType, bool aNoParentTraversal,
                                        nsIContent** aNextContent);
 
   /**

dom/interfaces/base/nsIFocusManager.idl

@@ -190,6 +190,14 @@ interface nsIFocusManager : nsISupports
    */
   const unsigned long FLAG_NOSWITCHFRAME = 4;
 
+  /**
+   * This flag is only used when passed to moveFocus. If set, focus is never
+   * moved to the parent frame of the starting element's document, instead
+   * iterating around to the beginning of that document again. Child frames
+   * are navigated as normal.
+   */
+  const unsigned long FLAG_NOPARENTFRAME = 8;
+
   /**
    * Focus is changing due to a mouse operation, for instance the mouse was
    * clicked on an element.

dom/ipc/ContentParent.cpp

@@ -50,7 +50,6 @@
 #include "nsIWindowWatcher.h"
 #include "nsIDOMWindow.h"
 #include "nsIPrefBranch.h"
-#include "nsIPrefBranch2.h"
 #include "nsIPrefLocalizedString.h"
 #include "nsIObserverService.h"
 #include "nsContentUtils.h"
@@ -218,7 +217,7 @@ ContentParent::Init()
         obs->AddObserver(this, "a11y-init-or-shutdown", false);
 #endif
     }
-    nsCOMPtr<nsIPrefBranch2> prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
+    nsCOMPtr<nsIPrefBranch> prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
     if (prefs) {
         prefs->AddObserver("", this, false);
     }
@@ -331,7 +330,7 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
     SetChildMemoryReporters(empty);
 
     // remove the global remote preferences observers
-    nsCOMPtr<nsIPrefBranch2> prefs 
+    nsCOMPtr<nsIPrefBranch> prefs 
             (do_GetService(NS_PREFSERVICE_CONTRACTID));
     if (prefs) { 
         prefs->RemoveObserver("", this);
@@ -1117,7 +1116,7 @@ ContentParent::RecvLoadURIExternal(const IPC::URI& uri)
 /* void onDispatchedEvent (in nsIThreadInternal thread); */
 NS_IMETHODIMP
 ContentParent::OnDispatchedEvent(nsIThreadInternal *thread)
-{
+{
    NS_NOTREACHED("OnDispatchedEvent unimplemented");
    return NS_ERROR_NOT_IMPLEMENTED;
 }

dom/plugins/base/nsPluginHost.cpp

@@ -80,7 +80,7 @@
 #include "nsHashtable.h"
 #include "nsIProxyInfo.h"
 #include "nsPluginLogging.h"
-#include "nsIPrefBranch2.h"
+#include "nsIPrefBranch.h"
 #include "nsIScriptChannel.h"
 #include "nsIBlocklistService.h"
 #include "nsVersionComparator.h"

dom/plugins/base/nsPluginTags.cpp

@@ -230,6 +230,7 @@ nsPluginTag::~nsPluginTag()
 
 NS_IMPL_ISUPPORTS1(nsPluginTag, nsIPluginTag)
 
+#if !defined(XP_WIN) && !defined(XP_MACOSX)
 static nsresult ConvertToUTF8(nsIUnicodeDecoder *aUnicodeDecoder,
                               nsAFlatCString& aString)
 {
@@ -249,6 +250,7 @@ static nsresult ConvertToUTF8(nsIUnicodeDecoder *aUnicodeDecoder,
   
   return NS_OK;
 }
+#endif
 
 nsresult nsPluginTag::EnsureMembersAreUTF8()
 {
@@ -529,10 +531,4 @@ void nsPluginTag::TryUnloadPlugin()
   // again so the calling code should not be fooled and reload
   // the library fresh
   mLibrary = nsnull;
-  
-  // Remove mime types added to the category manager
-  // only if we were made 'active' by setting the host
-  if (mPluginHost) {
-    RegisterWithCategoryManager(false, nsPluginTag::ePluginUnregister);
-  }
 }

dom/plugins/base/nsPluginTags.h

@@ -87,7 +87,7 @@ public:
               PRInt64 aLastModifiedTime = 0,
               bool aCanUnload = true,
               bool aArgsAreUTF8 = false);
-  ~nsPluginTag();
+  virtual ~nsPluginTag();
   
   void SetHost(nsPluginHost * aHost);
   void TryUnloadPlugin();

dom/src/geolocation/nsGeolocation.cpp

@@ -67,7 +67,7 @@
 #include "nsIPermissionManager.h"
 #include "nsIObserverService.h"
 #include "nsIPrefService.h"
-#include "nsIPrefBranch2.h"
+#include "nsIPrefBranch.h"
 #include "nsIJSContextStack.h"
 #include "nsThreadUtils.h"
 #include "mozilla/Services.h"

dom/src/storage/nsDOMStoragePersistentDB.cpp

@@ -188,7 +188,8 @@ nsDOMStoragePersistentDB::Init(const nsString& aDatabaseName)
          "key TEXT, "
          "value TEXT, "
          "secure INTEGER, "
-         "owner TEXT)"));
+         "owner TEXT, "
+         "modified INTEGER DEFAULT 0)"));
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = mConnection->ExecuteSimpleSQL(NS_LITERAL_CSTRING(
@@ -199,9 +200,9 @@ nsDOMStoragePersistentDB::Init(const nsString& aDatabaseName)
 
   rv = mConnection->ExecuteSimpleSQL(NS_LITERAL_CSTRING(
         "CREATE TEMPORARY VIEW webappsstore2_view AS "
-        "SELECT * FROM webappsstore2_temp "
+        "SELECT scope, key, value, secure, owner FROM webappsstore2_temp "
         "UNION ALL "
-        "SELECT * FROM webappsstore2 "
+        "SELECT scope, key, value, secure, owner FROM webappsstore2 "
           "WHERE NOT EXISTS ("
             "SELECT scope, key FROM webappsstore2_temp "
             "WHERE scope = webappsstore2.scope AND key = webappsstore2.key)"));
@@ -302,8 +303,8 @@ nsDOMStoragePersistentDB::EnsureLoadTemporaryTableForStorage(DOMStorageImpl* aSt
     NS_ENSURE_SUCCESS(rv, rv);
 
     nsCOMPtr<mozIStorageStatement> stmt = mStatements.GetCachedStatement(
-      "INSERT INTO webappsstore2_temp "
-        "SELECT * FROM webappsstore2 "
+      "INSERT INTO webappsstore2_temp (scope, key, value, secure, owner) "
+        "SELECT scope, key, value, secure, owner FROM webappsstore2 "
         "WHERE scope = :scope "
           "AND NOT EXISTS ( "
             "SELECT scope, key FROM webappsstore2_temp "
@@ -344,8 +345,8 @@ nsDOMStoragePersistentDB::FlushTemporaryTable(nsCStringHashKey::KeyType aKey,
     nsCOMPtr<mozIStorageStatement> stmt =
       data->mDB->mStatements.GetCachedStatement(
         "INSERT OR REPLACE INTO webappsstore2 "
-         "SELECT * FROM webappsstore2_temp "
-         "WHERE scope = :scope "
+         "SELECT scope, key, value, secure, owner FROM webappsstore2_temp "
+         "WHERE scope = :scope AND modified = 1"
       );
     NS_ENSURE_TRUE(stmt, PL_DHASH_STOP);
     mozStorageStatementScoper scope(stmt);
@@ -539,8 +540,8 @@ nsDOMStoragePersistentDB::SetKey(DOMStorageImpl* aStorage,
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<mozIStorageStatement> stmt = mStatements.GetCachedStatement(
-    "INSERT OR REPLACE INTO webappsstore2_temp (scope, key, value, secure) "
-    "VALUES (:scope, :key, :value, :secure) "
+    "INSERT OR REPLACE INTO webappsstore2_temp (scope, key, value, secure, modified) "
+    "VALUES (:scope, :key, :value, :secure, 1) "
   );
   NS_ENSURE_STATE(stmt);
   mozStorageStatementScoper scopeinsert(stmt);
@@ -588,7 +589,7 @@ nsDOMStoragePersistentDB::SetSecure(DOMStorageImpl* aStorage,
 
   nsCOMPtr<mozIStorageStatement> stmt = mStatements.GetCachedStatement(
     "UPDATE webappsstore2_temp "
-    "SET secure = :secure "
+    "SET secure = :secure, modified = 1 "
     "WHERE scope = :scope "
       "AND key = :key "
   );

dom/tests/mochitest/general/Makefile.in

@@ -80,6 +80,7 @@ _TEST_FILES = \
 		test_browserFrame5.html \
 		test_browserFrame6.html \
 		test_for_of.html \
+		test_focus_legend_noparent.html \
 		$(NULL)
 
 _CHROME_FILES = \

dom/tests/mochitest/general/test_focus_legend_noparent.html

@@ -0,0 +1,34 @@
+<html>
+<head>
+<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css">
+<script type="text/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+function runTest()
+{
+    window.focus();
+    var g = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");
+    document.body.appendChild(g);
+    setTimeout(g.focus.bind(g), 0);
+    setTimeout(done, 10);
+}
+
+function done()
+{
+  ok(document.hasFocus(), "document is still focused");
+  is(document.activeElement, document.body, "document has no focused element")
+  SimpleTest.finish();
+}
+
+SimpleTest.waitForFocus(runTest);
+</script>
+</head>
+
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+
+<body onblur="dump('blurred window!\n')"></body>
+</html>

extensions/cookie/nsCookiePermission.cpp

@@ -51,7 +51,6 @@
 #include "nsIURI.h"
 #include "nsIPrefService.h"
 #include "nsIPrefBranch.h"
-#include "nsIPrefBranch2.h"
 #include "nsIChannel.h"
 #include "nsIHttpChannelInternal.h"
 #include "nsIDOMWindow.h"
@@ -105,7 +104,7 @@ nsCookiePermission::Init()
   if (NS_FAILED(rv)) return false;
 
   // failure to access the pref service is non-fatal...
-  nsCOMPtr<nsIPrefBranch2> prefBranch =
+  nsCOMPtr<nsIPrefBranch> prefBranch =
       do_GetService(NS_PREFSERVICE_CONTRACTID);
   if (prefBranch) {
     prefBranch->AddObserver(kCookiesLifetimePolicy, this, false);

extensions/cookie/nsPopupWindowManager.cpp

@@ -41,7 +41,6 @@
 #include "nsIServiceManager.h"
 #include "nsIPrefService.h"
 #include "nsIPrefBranch.h"
-#include "nsIPrefBranch2.h"
 
 /**
  * The Popup Window Manager maintains popup window permissions by website.
@@ -73,7 +72,7 @@ nsPopupWindowManager::Init()
   nsresult rv;
   mPermissionManager = do_GetService(NS_PERMISSIONMANAGER_CONTRACTID);
 
-  nsCOMPtr<nsIPrefBranch2> prefBranch =
+  nsCOMPtr<nsIPrefBranch> prefBranch =
     do_GetService(NS_PREFSERVICE_CONTRACTID, &rv);
   if (NS_SUCCEEDED(rv)) {
     bool permission;

extensions/gio/nsGIOProtocolHandler.cpp

@@ -43,7 +43,7 @@
 */
 #include "mozilla/ModuleUtils.h"
 #include "nsIPrefService.h"
-#include "nsIPrefBranch2.h"
+#include "nsIPrefBranch.h"
 #include "nsIObserver.h"
 #include "nsThreadUtils.h"
 #include "nsProxyRelease.h"
@@ -944,7 +944,7 @@ nsGIOProtocolHandler::Init()
   sGIOLog = PR_NewLogModule("gio");
 #endif
 
-  nsCOMPtr<nsIPrefBranch2> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
+  nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
   if (prefs)
   {
     InitSupportedProtocolsPref(prefs);

extensions/gnomevfs/nsGnomeVFSProtocolHandler.cpp

@@ -47,7 +47,7 @@ extern "C" {
 #include "mozilla/ModuleUtils.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIPrefService.h"
-#include "nsIPrefBranch2.h"
+#include "nsIPrefBranch.h"
 #include "nsIObserver.h"
 #include "nsThreadUtils.h"
 #include "nsProxyRelease.h"
@@ -799,7 +799,7 @@ nsGnomeVFSProtocolHandler::Init()
     }
   }
 
-  nsCOMPtr<nsIPrefBranch2> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
+  nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
   if (prefs)
   {
     InitSupportedProtocolsPref(prefs);

extensions/permissions/nsContentBlocker.h

@@ -40,7 +40,7 @@
 #include "nsIObserver.h"
 #include "nsWeakReference.h"
 #include "nsIPermissionManager.h"
-#include "nsIPrefBranch2.h"
+#include "nsIPrefBranch.h"
 
 class nsIPrefBranch;
 
@@ -71,7 +71,7 @@ private:
                           bool *aFromPrefs);
 
   nsCOMPtr<nsIPermissionManager> mPermissionManager;
-  nsCOMPtr<nsIPrefBranch2> mPrefBranchInternal;
+  nsCOMPtr<nsIPrefBranch> mPrefBranchInternal;
   static PRUint8 mBehaviorPref[];
 };
 

extensions/spellcheck/src/mozPersonalDictionary.cpp

@@ -45,7 +45,6 @@
 #include "nsIObserverService.h"
 #include "nsIPrefService.h"
 #include "nsIPrefBranch.h"
-#include "nsIPrefBranch2.h"
 #include "nsIWeakReference.h"
 #include "nsCRT.h"
 #include "nsNetUtil.h"

gfx/2d/Factory.cpp

@@ -45,6 +45,7 @@
 #ifdef USE_SKIA
 #include "DrawTargetSkia.h"
 #include "ScaledFontBase.h"
+#include "ScaledFontFreetype.h"
 #endif
 
 #ifdef WIN32
@@ -156,7 +157,7 @@ Factory::CreateScaledFontForNativeFont(const NativeFont &aNativeFont, Float aSiz
 #endif
   case NATIVE_FONT_SKIA_FONT_FACE:
     {
-      return new ScaledFontBase(static_cast<gfxFont*>(aNativeFont.mFont), aSize);
+      return new ScaledFontFreetype(static_cast<gfxFont*>(aNativeFont.mFont), aSize);
     }
 #endif
 #ifdef USE_CAIRO

gfx/2d/Makefile.in

@@ -90,6 +90,7 @@ CPPSRCS	+= \
         SourceSurfaceSkia.cpp \
         DrawTargetSkia.cpp \
         PathSkia.cpp \
+        ScaledFontFreetype.cpp
         $(NULL)
 
 DEFINES += -DUSE_SKIA

gfx/2d/ScaledFontBase.cpp

@@ -57,32 +57,6 @@ using namespace std;
 namespace mozilla {
 namespace gfx {
 
-#ifdef USE_SKIA
-static SkTypeface::Style
-gfxFontStyleToSkia(const gfxFontStyle* aStyle)
-{
-  if (aStyle->style == NS_FONT_STYLE_ITALIC) {
-    if (aStyle->weight == NS_FONT_WEIGHT_BOLD) {
-      return SkTypeface::kBoldItalic;
-    }
-    return SkTypeface::kItalic;
-  }
-  if (aStyle->weight == NS_FONT_WEIGHT_BOLD) {
-    return SkTypeface::kBold;
-  }
-  return SkTypeface::kNormal;
-}
-#endif
-
-#ifdef USE_SKIA
-ScaledFontBase::ScaledFontBase(gfxFont* aFont, Float aSize)
-  : mSize(aSize)
-{
-  NS_LossyConvertUTF16toASCII name(aFont->GetName());
-  mTypeface = SkTypeface::CreateFromName(name.get(), gfxFontStyleToSkia(aFont->GetStyle()));
-}
-#endif
-
 ScaledFontBase::~ScaledFontBase()
 {
 #ifdef USE_SKIA

gfx/2d/ScaledFontBase.h

@@ -60,7 +60,6 @@ public:
 
   virtual TemporaryRef<Path> GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aTarget);
 #ifdef USE_SKIA
-  ScaledFontBase(gfxFont* aFont, Float aSize);
   virtual SkTypeface* GetSkTypeface() { return mTypeface; }
 #endif
 

gfx/2d/ScaledFontFreetype.cpp

@@ -0,0 +1,80 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Corporation code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   George Wright <george@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "ScaledFontFreetype.h"
+
+#include "gfxFont.h"
+
+#ifdef USE_SKIA
+#include "skia/SkTypeface.h"
+#endif
+
+using namespace std;
+
+namespace mozilla {
+namespace gfx {
+
+#ifdef USE_SKIA
+static SkTypeface::Style
+gfxFontStyleToSkia(const gfxFontStyle* aStyle)
+{
+  if (aStyle->style == NS_FONT_STYLE_ITALIC) {
+    if (aStyle->weight == NS_FONT_WEIGHT_BOLD) {
+      return SkTypeface::kBoldItalic;
+    }
+    return SkTypeface::kItalic;
+  }
+  if (aStyle->weight == NS_FONT_WEIGHT_BOLD) {
+    return SkTypeface::kBold;
+  }
+  return SkTypeface::kNormal;
+}
+#endif
+
+// Ideally we want to use FT_Face here but as there is currently no way to get
+// an SkTypeface from an FT_Face we do this.
+ScaledFontFreetype::ScaledFontFreetype(gfxFont* aFont, Float aSize)
+  : ScaledFontBase(aSize)
+{
+#ifdef USE_SKIA
+  NS_LossyConvertUTF16toASCII name(aFont->GetName());
+  mTypeface = SkTypeface::CreateFromName(name.get(), gfxFontStyleToSkia(aFont->GetStyle()));
+#endif
+}
+
+}
+}

gfx/2d/ScaledFontFreetype.h

@@ -0,0 +1,56 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Corporation code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Matt Woodrow <mwoodrow@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef MOZILLA_GFX_SCALEDFONTFREETYPE_H_
+#define MOZILLA_GFX_SCALEDFONTFREETYPE_H_
+
+#include "ScaledFontBase.h"
+
+namespace mozilla {
+namespace gfx {
+
+class ScaledFontFreetype : public ScaledFontBase
+{
+public:
+
+  ScaledFontFreetype(gfxFont* aFont, Float aSize);
+};
+
+}
+}
+
+#endif /* MOZILLA_GFX_SCALEDFONTFREETYPE_H_ */

image/src/imgLoader.cpp

@@ -2204,7 +2204,7 @@ NS_IMETHODIMP imgCacheValidator::OnStartRequest(nsIRequest *aRequest, nsISupport
   // We use originalURI here to fulfil the imgIRequest contract on GetURI.
   nsCOMPtr<nsIURI> originalURI;
   channel->GetOriginalURI(getter_AddRefs(originalURI));
-  mNewRequest->Init(originalURI, uri, channel, channel, mNewEntry,
+  mNewRequest->Init(originalURI, uri, aRequest, channel, mNewEntry,
                     mContext, loadingPrincipal,
                     corsmode);
 

js/src/jsiter.cpp

@@ -1384,9 +1384,11 @@ MarkGenerator(JSTracer *trc, JSGenerator *gen)
      * plan is to eventually mjit generators, it makes sense to future-proof
      * this code and save someone an hour later.
      */
-    MarkStackRangeConservatively(trc, gen->floatingStack, fp->formalArgsEnd());
+    MarkValueRange(trc, (HeapValue *)fp->formalArgsEnd() - gen->floatingStack,
+                   gen->floatingStack, "Generator Floating Args");
     fp->mark(trc);
-    MarkStackRangeConservatively(trc, fp->slots(), gen->regs.sp);
+    MarkValueRange(trc, gen->regs.sp - fp->slots(),
+                   (HeapValue *)fp->slots(), "Generator Floating Stack");
 }
 
 static void
@@ -1475,14 +1477,18 @@ js_NewGenerator(JSContext *cx)
                    (-1 + /* one Value included in JSGenerator */
                     vplen +
                     VALUES_PER_STACK_FRAME +
-                    stackfp->numSlots()) * sizeof(Value);
+                    stackfp->numSlots()) * sizeof(HeapValue);
+
+    JS_ASSERT(nbytes % sizeof(Value) == 0);
+    JS_STATIC_ASSERT(sizeof(StackFrame) % sizeof(HeapValue) == 0);
 
     JSGenerator *gen = (JSGenerator *) cx->malloc_(nbytes);
     if (!gen)
         return NULL;
+    SetValueRangeToUndefined((Value *)gen, nbytes / sizeof(Value));
 
     /* Cut up floatingStack space. */
-    Value *genvp = gen->floatingStack;
+    HeapValue *genvp = gen->floatingStack;
     StackFrame *genfp = reinterpret_cast<StackFrame *>(genvp + vplen);
 
     /* Initialize JSGenerator. */
@@ -1493,7 +1499,8 @@ js_NewGenerator(JSContext *cx)
 
     /* Copy from the stack to the generator's floating frame. */
     gen->regs.rebaseFromTo(stackRegs, *genfp);
-    genfp->stealFrameAndSlots(genvp, stackfp, stackvp, stackRegs.sp);
+    genfp->stealFrameAndSlots<HeapValue, Value, StackFrame::DoPostBarrier>(
+                              genfp, genvp, stackfp, stackvp, stackRegs.sp);
     genfp->initFloatingGenerator();
 
     obj->setPrivate(gen);

js/src/jsiter.h

@@ -237,7 +237,7 @@ struct JSGenerator {
     js::FrameRegs       regs;
     JSObject            *enumerators;
     js::StackFrame      *floating;
-    js::Value           floatingStack[1];
+    js::HeapValue       floatingStack[1];
 
     js::StackFrame *floatingFrame() {
         return floating;

js/src/methodjit/MethodJIT.cpp

@@ -253,7 +253,7 @@ JS_STATIC_ASSERT(offsetof(FrameRegs, sp) == 0);
 #if defined(__GNUC__) && !defined(_WIN64)
 
 /* If this assert fails, you need to realign VMFrame to 16 bytes. */
-#if defined(JS_CPU_ARM) || defined(JS_CPU_MIPS)
+#if defined(JS_CPU_ARM) || defined(JS_CPU_MIPS) || defined(JS_CPU_SPARC)
 JS_STATIC_ASSERT(sizeof(VMFrame) % 8 == 0);
 #else
 JS_STATIC_ASSERT(sizeof(VMFrame) % 16 == 0);

js/src/vm/Stack.cpp

@@ -38,6 +38,7 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+#include "jscntxt.h"
 #include "jsgcmark.h"
 #include "methodjit/MethodJIT.h"
 #include "Stack.h"
@@ -125,21 +126,31 @@ StackFrame::initDummyFrame(JSContext *cx, JSObject &chain)
     setScopeChainNoCallObj(chain);
 }
 
+template <class T, class U, StackFrame::TriggerPostBarriers doPostBarrier>
 void
-StackFrame::stealFrameAndSlots(Value *vp, StackFrame *otherfp,
-                               Value *othervp, Value *othersp)
+StackFrame::stealFrameAndSlots(StackFrame *fp, T *vp, StackFrame *otherfp, U *othervp,
+                               Value *othersp)
 {
-    JS_ASSERT(vp == (Value *)this - ((Value *)otherfp - othervp));
-    JS_ASSERT(othervp == otherfp->actualArgs() - 2);
+    JS_ASSERT((U *)vp == (U *)this - ((U *)otherfp - othervp));
+    JS_ASSERT((Value *)othervp == otherfp->actualArgs() - 2);
     JS_ASSERT(othersp >= otherfp->slots());
     JS_ASSERT(othersp <= otherfp->base() + otherfp->numSlots());
+    JS_ASSERT((T *)fp - vp == (U *)otherfp - othervp);
 
-    PodCopy(vp, othervp, othersp - othervp);
-    JS_ASSERT(vp == this->actualArgs() - 2);
+    /* Copy args, StackFrame, and slots. */
+    U *srcend = (U *)otherfp->formalArgsEnd();
+    T *dst = vp;
+    for (U *src = othervp; src < srcend; src++, dst++)
+        *dst = *src;
 
-    /* Catch bad-touching of non-canonical args (e.g., generator_trace). */
-    if (otherfp->hasOverflowArgs())
-        Debug_SetValueRangeToCrashOnTouch(othervp, othervp + 2 + otherfp->numFormalArgs());
+    *fp = *otherfp;
+    if (doPostBarrier)
+        fp->writeBarrierPost();
+
+    srcend = (U *)othersp;
+    dst = (T *)fp->slots();
+    for (U *src = (U *)otherfp->slots(); src < srcend; src++, dst++)
+        *dst = *src;
 
     /*
      * Repoint Call, Arguments, Block and With objects to the new live frame.
@@ -166,6 +177,37 @@ StackFrame::stealFrameAndSlots(Value *vp, StackFrame *otherfp,
     }
 }
 
+/* Note: explicit instantiation for js_NewGenerator located in jsiter.cpp. */
+template void StackFrame::stealFrameAndSlots<Value, HeapValue, StackFrame::NoPostBarrier>(
+                                             StackFrame *, Value *,
+                                             StackFrame *, HeapValue *, Value *);
+template void StackFrame::stealFrameAndSlots<HeapValue, Value, StackFrame::DoPostBarrier>(
+                                             StackFrame *, HeapValue *,
+                                             StackFrame *, Value *, Value *);
+
+void
+StackFrame::writeBarrierPost()
+{
+    /* This needs to follow the same rules as in js_TraceStackFrame. */
+    if (scopeChain_)
+        JSObject::writeBarrierPost(scopeChain_, (void *)&scopeChain_);
+    if (isDummyFrame())
+        return;
+    if (hasArgsObj())
+        JSObject::writeBarrierPost(argsObj_, (void *)&argsObj_);
+    if (isScriptFrame()) {
+        if (isFunctionFrame()) {
+            JSFunction::writeBarrierPost((JSObject *)exec.fun, (void *)&exec.fun);
+            if (isEvalFrame())
+                JSScript::writeBarrierPost(u.evalScript, (void *)&u.evalScript);
+        } else {
+            JSScript::writeBarrierPost(exec.script, (void *)&exec.script);
+        }
+    }
+    if (hasReturnValue())
+        HeapValue::writeBarrierPost(rval_, &rval_);
+}
+
 #ifdef DEBUG
 JSObject *const StackFrame::sInvalidScopeChain = (JSObject *)0xbeef;
 #endif
@@ -831,8 +873,8 @@ bool
 ContextStack::pushGeneratorFrame(JSContext *cx, JSGenerator *gen, GeneratorFrameGuard *gfg)
 {
     StackFrame *genfp = gen->floatingFrame();
-    Value *genvp = gen->floatingStack;
-    uintN vplen = (Value *)genfp - genvp;
+    HeapValue *genvp = gen->floatingStack;
+    uintN vplen = (HeapValue *)genfp - genvp;
 
     uintN nvars = vplen + VALUES_PER_STACK_FRAME + genfp->numSlots();
     Value *firstUnused = ensureOnTop(cx, REPORT_ERROR, nvars, CAN_EXTEND, &gfg->pushedSeg_);
@@ -858,7 +900,8 @@ ContextStack::pushGeneratorFrame(JSContext *cx, JSGenerator *gen, GeneratorFrame
     JSObject::writeBarrierPre(genobj);
 
     /* Copy from the generator's floating frame to the stack. */
-    stackfp->stealFrameAndSlots(stackvp, genfp, genvp, gen->regs.sp);
+    stackfp->stealFrameAndSlots<Value, HeapValue, StackFrame::NoPostBarrier>(
+                                stackfp, stackvp, genfp, genvp, gen->regs.sp);
     stackfp->resetGeneratorPrev(cx);
     stackfp->unsetFloatingGenerator();
     gfg->regs_.rebaseFromTo(gen->regs, *stackfp);
@@ -874,7 +917,7 @@ ContextStack::popGeneratorFrame(const GeneratorFrameGuard &gfg)
 {
     JSGenerator *gen = gfg.gen_;
     StackFrame *genfp = gen->floatingFrame();
-    Value *genvp = gen->floatingStack;
+    HeapValue *genvp = gen->floatingStack;
 
     const FrameRegs &stackRegs = gfg.regs_;
     StackFrame *stackfp = stackRegs.fp();
@@ -882,7 +925,8 @@ ContextStack::popGeneratorFrame(const GeneratorFrameGuard &gfg)
 
     /* Copy from the stack to the generator's floating frame. */
     gen->regs.rebaseFromTo(stackRegs, *genfp);
-    genfp->stealFrameAndSlots(genvp, stackfp, stackvp, stackRegs.sp);
+    genfp->stealFrameAndSlots<HeapValue, Value, StackFrame::DoPostBarrier>(
+                              genfp, genvp, stackfp, stackvp, stackRegs.sp);
     genfp->setFloatingGenerator();
 
     /* ~FrameGuard/popFrame will finish the popping. */

js/src/vm/Stack.h

@@ -430,7 +430,14 @@ class StackFrame
                           const Value &thisv, JSObject &scopeChain, ExecuteType type);
 
     /* Used when activating generators. */
-    void stealFrameAndSlots(Value *vp, StackFrame *otherfp, Value *othervp, Value *othersp);
+    enum TriggerPostBarriers {
+        DoPostBarrier = true,
+        NoPostBarrier = false
+    };
+    template <class T, class U, TriggerPostBarriers doPostBarrier>
+    void stealFrameAndSlots(StackFrame *fp, T *vp, StackFrame *otherfp, U *othervp,
+                            Value *othersp);
+    void writeBarrierPost();
 
     /* Perhaps one fine day we will remove dummy frames. */
     void initDummyFrame(JSContext *cx, JSObject &chain);
@@ -988,6 +995,10 @@ class StackFrame
 
     /* Return value */
 
+    bool hasReturnValue() const {
+        return !!(flags_ & HAS_RVAL);
+    }
+
     const Value &returnValue() {
         if (!(flags_ & HAS_RVAL))
             rval_.setUndefined();

layout/base/crashtests/725535.html

@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html style="-moz-transform-style: preserve-3d">
+<body>
+<script>
+document.addEventListener("MozReftestInvalidate", function() {document.documentElement.style.MozTransform = 'rotate(0)';}, false);
+</script>
+</body>
+</html>

layout/base/crashtests/crashtests.list

@@ -349,3 +349,4 @@ load 698335.html
 needs-focus pref(accessibility.browsewithcaret,true) load 699353-1.html
 load 707098.html
 load 722137.html
+load 725535.html

layout/base/nsCSSFrameConstructor.cpp

@@ -7674,9 +7674,6 @@ DoApplyRenderingChangeToTree(nsIFrame* aFrame,
                   "should only be called within ApplyRenderingChangeToTree");
 
   for ( ; aFrame; aFrame = nsLayoutUtils::GetNextContinuationOrSpecialSibling(aFrame)) {
-    NS_ASSERTION(!(aChange & nsChangeHint_UpdateTransformLayer) || aFrame->IsTransformed(),
-                 "Only transformed frames should have UpdateTransformLayer hint");
-
     // Get view if this frame has one and trigger an update. If the
     // frame doesn't have a view, find the nearest containing view
     // (adjusting r's coordinate system to reflect the nesting) and
@@ -7718,6 +7715,9 @@ ApplyRenderingChangeToTree(nsPresContext* aPresContext,
                            nsIFrame* aFrame,
                            nsChangeHint aChange)
 {
+  NS_ASSERTION(!(aChange & nsChangeHint_UpdateTransformLayer) || aFrame->IsTransformed(),
+               "Only transformed frames should have UpdateTransformLayer hint");
+
   nsIPresShell *shell = aPresContext->PresShell();
   if (shell->IsPaintingSuppressed()) {
     // Don't allow synchronous rendering changes when painting is turned off.

layout/generic/nsColumnSetFrame.cpp

@@ -364,6 +364,22 @@ nsColumnSetFrame::ChooseColumnStrategy(const nsHTMLReflowState& aReflowState)
   nscoord colGap = GetColumnGap(this, colStyle);
   PRInt32 numColumns = colStyle->mColumnCount;
 
+  bool isBalancing = colStyle->mColumnFill == NS_STYLE_COLUMN_FILL_BALANCE;
+  if (isBalancing) {
+    const PRUint32 MAX_NESTED_COLUMN_BALANCING = 5;
+    PRUint32 cnt = 1;
+    for (const nsHTMLReflowState* rs = aReflowState.parentReflowState;
+         rs && cnt < MAX_NESTED_COLUMN_BALANCING;
+         rs = rs->parentReflowState) {
+      if (rs->mFlags.mIsColumnBalancing) {
+        ++cnt;
+      }
+    }
+    if (cnt == MAX_NESTED_COLUMN_BALANCING) {
+      numColumns = 1;
+    }
+  }
+
   nscoord colWidth;
   if (colStyle->mColumnWidth.GetUnit() == eStyleUnit_Coord) {
     colWidth = colStyle->mColumnWidth.GetCoordValue();
@@ -417,7 +433,7 @@ nsColumnSetFrame::ChooseColumnStrategy(const nsHTMLReflowState& aReflowState)
   }
 
   // If column-fill is set to 'balance', then we want to balance the columns.
-  if (colStyle->mColumnFill == NS_STYLE_COLUMN_FILL_BALANCE) {
+  if (isBalancing) {
     // Balancing!
 
     if (numColumns <= 0) {
@@ -657,6 +673,7 @@ nsColumnSetFrame::ReflowChildren(nsHTMLReflowMetrics&     aDesiredSize,
                                        aReflowState.ComputedHeight());
       kidReflowState.mFlags.mIsTopOfPage = true;
       kidReflowState.mFlags.mTableIsSplittable = false;
+      kidReflowState.mFlags.mIsColumnBalancing = aConfig.mBalanceColCount < PR_INT32_MAX;
           
 #ifdef DEBUG_roc
       printf("*** Reflowing child #%d %p: availHeight=%d\n",

layout/generic/nsHTMLReflowState.cpp

@@ -103,13 +103,7 @@ nsHTMLReflowState::nsHTMLReflowState(nsPresContext*       aPresContext,
   availableHeight = aAvailableSpace.height;
   mFloatManager = nsnull;
   mLineLayout = nsnull;
-  mFlags.mSpecialHeightReflow = false;
-  mFlags.mIsTopOfPage = false;
-  mFlags.mTableIsSplittable = false;
-  mFlags.mNextInFlowUntouched = false;
-  mFlags.mAssumingHScrollbar = mFlags.mAssumingVScrollbar = false;
-  mFlags.mHasClearance = false;
-  mFlags.mHeightDependsOnAncestorCell = false;
+  memset(&mFlags, 0, sizeof(mFlags));
   mDiscoveredClearance = nsnull;
   mPercentHeightObserver = nsnull;
   Init(aPresContext);
@@ -174,6 +168,7 @@ nsHTMLReflowState::nsHTMLReflowState(nsPresContext*           aPresContext,
     CheckNextInFlowParenthood(aFrame, aParentReflowState.frame);
   mFlags.mAssumingHScrollbar = mFlags.mAssumingVScrollbar = false;
   mFlags.mHasClearance = false;
+  mFlags.mIsColumnBalancing = false;
 
   mDiscoveredClearance = nsnull;
   mPercentHeightObserver = (aParentReflowState.mPercentHeightObserver && 

layout/generic/nsHTMLReflowState.h

@@ -367,7 +367,7 @@ public:
                                      // and never insider a column frame
     PRUint16 mHeightDependsOnAncestorCell:1;   // Does frame height depend on
                                                // an ancestor table-cell?
-    
+    PRUint16 mIsColumnBalancing:1;   // nsColumnSetFrame is balancing columns
   } mFlags;
 
 private:

layout/reftests/reftest.list

@@ -26,6 +26,9 @@ skip-if(Android) include border-image/reftest.list
 # border-radius/
 include border-radius/reftest.list
 
+# -moz-box tests
+include box/reftest.list
+
 # box-ordinal/
 include box-ordinal/reftest.list
 
@@ -140,9 +143,6 @@ skip-if(Android) include first-letter/reftest.list
 # first-line/
 include first-line/reftest.list
 
-# flexbox/
-include flexbox/reftest.list
-
 # floats/
 include floats/reftest.list
 

layout/tools/reftest/reftest.js

@@ -244,7 +244,7 @@ function OnRefTestLoad(win)
     gVerbose = !!env.get("MOZ_REFTEST_VERBOSE");
 
     var prefs = Components.classes["@mozilla.org/preferences-service;1"].
-                getService(Components.interfaces.nsIPrefBranch2);
+                getService(Components.interfaces.nsIPrefBranch);
     try {
         gBrowserIsRemote = prefs.getBoolPref("browser.tabs.remote");
     } catch (e) {
@@ -288,7 +288,7 @@ function InitAndStartRefTests()
     /* These prefs are optional, so we don't need to spit an error to the log */
     try {
         var prefs = Components.classes["@mozilla.org/preferences-service;1"].
-                    getService(Components.interfaces.nsIPrefBranch2);
+                    getService(Components.interfaces.nsIPrefBranch);
     } catch(e) {
         gDumpLog("REFTEST TEST-UNEXPECTED-FAIL | | EXCEPTION: " + e + "\n");
     }
@@ -401,7 +401,7 @@ function StartTests()
     /* These prefs are optional, so we don't need to spit an error to the log */
     try {
         var prefs = Components.classes["@mozilla.org/preferences-service;1"].
-                    getService(Components.interfaces.nsIPrefBranch2);
+                    getService(Components.interfaces.nsIPrefBranch);
     } catch(e) {
         gDumpLog("REFTEST TEST-UNEXPECTED-FAIL | | EXCEPTION: " + e + "\n");
     }
@@ -563,7 +563,7 @@ function BuildConditionSandbox(aURL) {
     gContainingWindow.document.documentElement.removeChild(box);
 
     var prefs = CC["@mozilla.org/preferences-service;1"].
-                getService(CI.nsIPrefBranch2);
+                getService(CI.nsIPrefBranch);
     try {
         sandbox.nativeThemePref = !prefs.getBoolPref("mozilla.widget.disable-native-theme");
     } catch (e) {
@@ -1036,7 +1036,7 @@ function StartCurrentTest()
             gURLs.shift();
         } else if (gURLs[0].prefSettings.length > 0) {
             var prefs = Components.classes["@mozilla.org/preferences-service;1"].
-                        getService(Components.interfaces.nsIPrefBranch2);
+                        getService(Components.interfaces.nsIPrefBranch);
             var badPref = undefined;
             try {
                 gURLs[0].prefSettings.forEach(function(ps) {
@@ -1612,7 +1612,7 @@ function RestoreChangedPreferences()
 {
     if (gPrefsToRestore.length > 0) {
         var prefs = Components.classes["@mozilla.org/preferences-service;1"].
-                    getService(Components.interfaces.nsIPrefBranch2);
+                    getService(Components.interfaces.nsIPrefBranch);
         gPrefsToRestore.forEach(function(ps) {
             var value = ps.value;
             if (ps.type == PREF_BOOLEAN) {

layout/xul/base/src/nsMenuBarListener.cpp

@@ -344,21 +344,34 @@ nsMenuBarListener::KeyDown(nsIDOMEvent* aKeyEvent)
     PRUint32 theChar;
     keyEvent->GetKeyCode(&theChar);
 
-    if (!mAccessKeyDownCanceled && theChar == (PRUint32)mAccessKey &&
-        (GetModifiers(keyEvent) & ~mAccessKeyMask) == 0) {
-      // No other modifiers can be down.
-      // Especially CTRL.  CTRL+ALT == AltGR, and
-      // we'll fuck up on non-US enhanced 102-key
-      // keyboards if we don't check this.
-      mAccessKeyDown = true;
-    }
-    else {
-      // Some key other than the access key just went down,
-      // so we won't activate the menu bar when the access
-      // key is released.
+    // No other modifiers can be down.
+    // Especially CTRL.  CTRL+ALT == AltGR, and we'll fuck up on non-US
+    // enhanced 102-key keyboards if we don't check this.
+    bool isAccessKeyDownEvent =
+      ((theChar == (PRUint32)mAccessKey) &&
+       (GetModifiers(keyEvent) & ~mAccessKeyMask) == 0);
 
-      mAccessKeyDownCanceled = true;
+    if (!mAccessKeyDown) {
+      // If accesskey isn't being pressed and the key isn't the accesskey,
+      // ignore the event.
+      if (!isAccessKeyDownEvent) {
+        return NS_OK;
+      }
+
+      // Otherwise, accept the accesskey state.
+      mAccessKeyDown = true;
+      mAccessKeyDownCanceled = false;
+      return NS_OK;
     }
+
+    // If the pressed accesskey was canceled already, ignore the event.
+    if (mAccessKeyDownCanceled) {
+      return NS_OK;
+    }
+
+    // Some key other than the access key just went down,
+    // so we won't activate the menu bar when the access key is released.
+    mAccessKeyDownCanceled = !isAccessKeyDownEvent;
   }
 
   return NS_OK; // means I am NOT consuming event
@@ -371,9 +384,11 @@ nsMenuBarListener::Blur(nsIDOMEvent* aEvent)
 {
   if (!mMenuBarFrame->IsMenuOpen() && mMenuBarFrame->IsActive()) {
     ToggleMenuActiveState();
-    mAccessKeyDown = false;
-    mAccessKeyDownCanceled = false;
   }
+  // Reset the accesskey state because we cannot receive the keyup event for
+  // the pressing accesskey.
+  mAccessKeyDown = false;
+  mAccessKeyDownCanceled = false;
   return NS_OK; // means I am NOT consuming event
 }
   

layout/xul/base/src/nsXULPopupManager.cpp

@@ -1618,10 +1618,9 @@ nsXULPopupManager::SetCaptureState(nsIContent* aOldPopup)
 
   if (item) {
     nsMenuPopupFrame* popup = item->Frame();
-    nsCOMPtr<nsIWidget> widget = popup->GetWidget();
-    if (widget) {
-      widget->CaptureRollupEvents(this, true, popup->ConsumeOutsideClicks());
-      mWidget = widget;
+    mWidget = popup->GetWidget();
+    if (mWidget) {
+      mWidget->CaptureRollupEvents(this, true, popup->ConsumeOutsideClicks());
       popup->AttachedDismissalListener();
     }
   }

media/libvorbis/bug722924.patch

@@ -0,0 +1,22 @@
+diff --git a/media/libvorbis/lib/vorbis_codebook.c b/media/libvorbis/lib/vorbis_codebook.c
+--- a/media/libvorbis/lib/vorbis_codebook.c
++++ b/media/libvorbis/lib/vorbis_codebook.c
+@@ -442,17 +442,17 @@ long vorbis_book_decodev_set(codebook *b
+       t     = book->valuelist+entry*book->dim;
+       for (j=0;j<book->dim;)
+         a[i++]=t[j++];
+     }
+   }else{
+     int i,j;
+ 
+     for(i=0;i<n;){
+-      for (j=0;j<book->dim;)
++      for (j=0;j<book->dim;j++)
+         a[i++]=0.f;
+     }
+   }
+   return(0);
+ }
+ 
+ long vorbis_book_decodevv_add(codebook *book,float **a,long offset,int ch,
+                               oggpack_buffer *b,int n){

media/libvorbis/lib/vorbis_codebook.c

@@ -447,7 +447,7 @@ long vorbis_book_decodev_set(codebook *book,float *a,oggpack_buffer *b,int n){
     int i,j;
 
     for(i=0;i<n;){
-      for (j=0;j<book->dim;)
+      for (j=0;j<book->dim;j++)
         a[i++]=0.f;
     }
   }

media/libvorbis/update.sh

@@ -48,3 +48,4 @@ cp $1/README ./README
 cp $1/AUTHORS ./AUTHORS
 patch -p3 < ./alloca.diff
 patch -p3 < ./bug719612.patch
+patch -p3 < ./bug722924.patch

mobile/android/base/AndroidManifest.xml.in

@@ -56,7 +56,7 @@
                   android:configChanges="keyboard|keyboardHidden|mcc|mnc|orientation"
                   android:windowSoftInputMode="stateUnspecified|adjustResize"
                   android:launchMode="singleTask"
-                  android:theme="@style/Gecko">
+                  android:theme="@style/Gecko.App">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />
@@ -146,16 +146,16 @@
         -->
 
         <activity android:name="org.mozilla.gecko.AwesomeBar"
-                  android:theme="@style/Gecko.Light"
+                  android:theme="@style/Gecko.Light.AwesomeBar"
                   android:configChanges="orientation"
                   android:windowSoftInputMode="stateAlwaysVisible|adjustResize"/>
 
         <activity android:name="org.mozilla.gecko.TabsTray"
-                  android:theme="@style/Gecko.Translucent"
+                  android:theme="@style/Gecko.Translucent.TabsTray"
                   android:launchMode="singleTask"/>
 
         <activity android:name="org.mozilla.gecko.GeckoPreferences"
-                  android:theme="@style/Gecko.TitleBar"
+                  android:theme="@style/Gecko.TitleBar.Preferences"
                   android:label="@string/settings_title"
                   android:excludeFromRecents="true"/>
 

mobile/android/base/AutoCompletePopup.java

@@ -84,7 +84,7 @@ public class AutoCompletePopup extends ListView {
         setOnItemClickListener(new OnItemClickListener() {
             public void onItemClick(AdapterView<?> parentView, View view, int position, long id) {
                 String value = ((TextView) view).getText().toString();
-                GeckoAppShell.sendEventToGecko(new GeckoEvent("FormAssist:AutoComplete", value));
+                GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("FormAssist:AutoComplete", value));
                 hide();
             }
         });
@@ -182,7 +182,7 @@ public class AutoCompletePopup extends ListView {
     public void hide() {
         if (isShown()) {
             setVisibility(View.GONE);
-            GeckoAppShell.sendEventToGecko(new GeckoEvent("FormAssist:Closed", null));
+            GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("FormAssist:Closed", null));
         }
     }
 }