diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 7e6761bfe466..86070f44f2eb 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "f112883f55f9f23abd5aac107ca09f5471c37798", 
+    "revision": "fc5f583668adbaecbe060819db0c4ba96ec238d9", 
     "repo_path": "/integration/gaia-central"
 }
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index a7b821703ce8..accdbc777162 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -1096,7 +1096,6 @@
   <vbox id="browser-bottombox" layer="true">
     <notificationbox id="global-notificationbox"/>
     <toolbar id="developer-toolbar"
-             class="devtools-toolbar"
              hidden="true">
 #ifdef XP_MACOSX
           <toolbarbutton id="developer-toolbar-closebutton"
diff --git a/browser/components/customizableui/content/toolbar.xml b/browser/components/customizableui/content/toolbar.xml
index 39352b257c1f..f2596d032584 100644
--- a/browser/components/customizableui/content/toolbar.xml
+++ b/browser/components/customizableui/content/toolbar.xml
@@ -375,7 +375,7 @@
       <constructor><![CDATA[
           // Reading these immediately so nobody messes with them anymore:
           this._delegatingToolbar = this.getAttribute("toolbar-delegate");
-          this._wasCollapsed = this.getAttribute("collapsed");
+          this._wasCollapsed = this.getAttribute("collapsed") == "true";
           // Leaving those in here to unbreak some code:
           if (document.readyState == "complete") {
             this._init();
diff --git a/browser/components/customizableui/src/CustomizableUI.jsm b/browser/components/customizableui/src/CustomizableUI.jsm
index 87c705a0ac19..5025ba122509 100644
--- a/browser/components/customizableui/src/CustomizableUI.jsm
+++ b/browser/components/customizableui/src/CustomizableUI.jsm
@@ -1253,6 +1253,8 @@ let CustomizableUIInternal = {
   },
 
   getUnusedWidgets: function(aWindowPalette) {
+    let window = aWindowPalette.ownerDocument.defaultView;
+    let isWindowPrivate = PrivateBrowsingUtils.isWindowPrivate(window);
     // We use a Set because there can be overlap between the widgets in
     // gPalette and the items in the palette, especially after the first
     // customization, since programmatically generated widgets will remain
@@ -1264,7 +1266,9 @@ let CustomizableUIInternal = {
     // gPalette.
     for (let [id, widget] of gPalette) {
       if (!widget.currentArea) {
-        widgets.add(id);
+        if (widget.showInPrivateBrowsing || !isWindowPrivate) {
+          widgets.add(id);
+        }
       }
     }
 
diff --git a/browser/components/customizableui/test/browser.ini b/browser/components/customizableui/test/browser.ini
index 38ccb7a93a1a..8db2b457a2e4 100644
--- a/browser/components/customizableui/test/browser.ini
+++ b/browser/components/customizableui/test/browser.ini
@@ -45,5 +45,6 @@ skip-if = os == "mac"
 [browser_942581_unregisterArea_keeps_placements.js]
 [browser_943683_migration_test.js]
 [browser_944887_destroyWidget_should_destroy_in_palette.js]
+[browser_945739_showInPrivateBrowsing_customize_mode.js]
 [browser_947987_removable_default.js]
 [browser_panel_toggle.js]
diff --git a/browser/components/customizableui/test/browser_885530_showInPrivateBrowsing.js b/browser/components/customizableui/test/browser_885530_showInPrivateBrowsing.js
index 1203c2bf801a..e6d63f27552e 100644
--- a/browser/components/customizableui/test/browser_885530_showInPrivateBrowsing.js
+++ b/browser/components/customizableui/test/browser_885530_showInPrivateBrowsing.js
@@ -17,7 +17,7 @@ function assertWidgetExists(aWindow, aExists) {
 let gTests = [
   {
     desc: "A widget that is created with showInPrivateBrowsing undefined should " +
-          "have that value default to false.",
+          "have that value default to true.",
     run: function() {
       let wrapper = CustomizableUI.createWidget({
         id: kWidgetId
diff --git a/browser/components/customizableui/test/browser_945739_showInPrivateBrowsing_customize_mode.js b/browser/components/customizableui/test/browser_945739_showInPrivateBrowsing_customize_mode.js
new file mode 100644
index 000000000000..02ae187958a2
--- /dev/null
+++ b/browser/components/customizableui/test/browser_945739_showInPrivateBrowsing_customize_mode.js
@@ -0,0 +1,42 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const kWidgetId = "test-private-browsing-customize-mode-widget";
+
+let gTests = [
+  {
+    desc: "Add a widget via the API with showInPrivateBrowsing set to false " +
+          "and ensure it does not appear in the list of unused widgets in private windows",
+    run: function() {
+      CustomizableUI.createWidget({
+        id: kWidgetId,
+        showInPrivateBrowsing: false
+      });
+
+      let normalWidgetArray = CustomizableUI.getUnusedWidgets(gNavToolbox.palette);
+      normalWidgetArray = normalWidgetArray.map((w) => w.id);
+      ok(normalWidgetArray.indexOf(kWidgetId) > -1,
+         "Widget should appear as unused in non-private window");
+
+      let privateWindow = yield openAndLoadWindow({private: true});
+      let privateWidgetArray = CustomizableUI.getUnusedWidgets(privateWindow.gNavToolbox.palette);
+      privateWidgetArray = privateWidgetArray.map((w) => w.id);
+      is(privateWidgetArray.indexOf(kWidgetId), -1,
+         "Widget should not appear as unused in private window");
+      privateWindow.close();
+
+      CustomizableUI.destroyWidget(kWidgetId);
+    },
+  },
+];
+
+function asyncCleanup() {
+  yield resetCustomization();
+}
+
+function test() {
+  waitForExplicitFinish();
+  runTests(gTests, asyncCleanup);
+}
+
diff --git a/browser/devtools/responsivedesign/responsivedesign.jsm b/browser/devtools/responsivedesign/responsivedesign.jsm
index 9b36720ba282..5a3191bd866f 100644
--- a/browser/devtools/responsivedesign/responsivedesign.jsm
+++ b/browser/devtools/responsivedesign/responsivedesign.jsm
@@ -356,11 +356,11 @@ ResponsiveUI.prototype = {
    * Build the toolbar and the resizers.
    *
    * <vbox class="browserContainer"> From tabbrowser.xml
-   *  <toolbar class="devtools-toolbar devtools-responsiveui-toolbar">
-   *    <menulist class="devtools-menulist"/> // presets
-   *    <toolbarbutton tabindex="0" class="devtools-toolbarbutton" tooltiptext="rotate"/> // rotate
-   *    <toolbarbutton tabindex="0" class="devtools-toolbarbutton" tooltiptext="screenshot"/> // screenshot
-   *    <toolbarbutton tabindex="0" class="devtools-toolbarbutton" tooltiptext="Leave Responsive Design View"/> // close
+   *  <toolbar class="devtools-responsiveui-toolbar">
+   *    <menulist class="devtools-responsiveui-menulist"/> // presets
+   *    <toolbarbutton tabindex="0" class="devtools-responsiveui-toolbarbutton" tooltiptext="rotate"/> // rotate
+   *    <toolbarbutton tabindex="0" class="devtools-responsiveui-toolbarbutton" tooltiptext="screenshot"/> // screenshot
+   *    <toolbarbutton tabindex="0" class="devtools-responsiveui-toolbarbutton" tooltiptext="Leave Responsive Design View"/> // close
    *  </toolbar>
    *  <stack class="browserStack"> From tabbrowser.xml
    *    <browser/>
@@ -373,10 +373,10 @@ ResponsiveUI.prototype = {
   buildUI: function RUI_buildUI() {
     // Toolbar
     this.toolbar = this.chromeDoc.createElement("toolbar");
-    this.toolbar.className = "devtools-toolbar devtools-responsiveui-toolbar";
+    this.toolbar.className = "devtools-responsiveui-toolbar";
 
     this.menulist = this.chromeDoc.createElement("menulist");
-    this.menulist.className = "devtools-menulist";
+    this.menulist.className = "devtools-responsiveui-menulist";
 
     this.menulist.addEventListener("select", this.bound_presetSelected, true);
 
@@ -401,24 +401,24 @@ ResponsiveUI.prototype = {
     this.rotatebutton = this.chromeDoc.createElement("toolbarbutton");
     this.rotatebutton.setAttribute("tabindex", "0");
     this.rotatebutton.setAttribute("tooltiptext", this.strings.GetStringFromName("responsiveUI.rotate2"));
-    this.rotatebutton.className = "devtools-toolbarbutton devtools-responsiveui-rotate";
+    this.rotatebutton.className = "devtools-responsiveui-toolbarbutton devtools-responsiveui-rotate";
     this.rotatebutton.addEventListener("command", this.bound_rotate, true);
 
     this.screenshotbutton = this.chromeDoc.createElement("toolbarbutton");
     this.screenshotbutton.setAttribute("tabindex", "0");
     this.screenshotbutton.setAttribute("tooltiptext", this.strings.GetStringFromName("responsiveUI.screenshot"));
-    this.screenshotbutton.className = "devtools-toolbarbutton devtools-responsiveui-screenshot";
+    this.screenshotbutton.className = "devtools-responsiveui-toolbarbutton devtools-responsiveui-screenshot";
     this.screenshotbutton.addEventListener("command", this.bound_screenshot, true);
 
     this.touchbutton = this.chromeDoc.createElement("toolbarbutton");
     this.touchbutton.setAttribute("tabindex", "0");
     this.touchbutton.setAttribute("tooltiptext", this.strings.GetStringFromName("responsiveUI.touch"));
-    this.touchbutton.className = "devtools-toolbarbutton devtools-responsiveui-touch";
+    this.touchbutton.className = "devtools-responsiveui-toolbarbutton devtools-responsiveui-touch";
     this.touchbutton.addEventListener("command", this.bound_touch, true);
 
     this.closebutton = this.chromeDoc.createElement("toolbarbutton");
     this.closebutton.setAttribute("tabindex", "0");
-    this.closebutton.className = "devtools-toolbarbutton devtools-responsiveui-close";
+    this.closebutton.className = "devtools-responsiveui-toolbarbutton devtools-responsiveui-close";
     this.closebutton.setAttribute("tooltiptext", this.strings.GetStringFromName("responsiveUI.close"));
     this.closebutton.addEventListener("command", this.bound_close, true);
 
diff --git a/browser/devtools/styleinspector/test/browser_bug705707_is_content_stylesheet.js b/browser/devtools/styleinspector/test/browser_bug705707_is_content_stylesheet.js
index 13de2a1ffe64..c4a73f21b8bb 100644
--- a/browser/devtools/styleinspector/test/browser_bug705707_is_content_stylesheet.js
+++ b/browser/devtools/styleinspector/test/browser_bug705707_is_content_stylesheet.js
@@ -18,7 +18,7 @@ const XUL_PRINCIPAL =  Components.classes["@mozilla.org/scriptsecuritymanager;1"
                                  .getService(Ci.nsIScriptSecurityManager)
                                  .getNoAppCodebasePrincipal(XUL_URI);
 
-
+let inspector, ruleView;
 let {CssLogic} = devtools.require("devtools/styleinspector/css-logic");
 
 function test()
@@ -41,11 +41,47 @@ function testFromHTML()
 
   executeSoon(function() {
     checkSheets(target);
+    openRuleView((aInspector, aRuleView) => {
+      inspector = aInspector;
+      ruleView = aRuleView;
+      inspector.selection.setNode(target);
+      inspector.once("inspector-updated", testModifyRules);
+    });
+  });
+}
+
+function reselectElement(target, cb)
+{
+  inspector.selection.setNode(target.parentNode);
+  inspector.once("inspector-updated", ()=> {
+    inspector.selection.setNode(target);
+    inspector.once("inspector-updated", cb);
+  });
+}
+
+function testModifyRules()
+{
+  // Set a property on all rules, then refresh and make sure they are still
+  // there (and there wasn't an error on the server side)
+  for (let rule of ruleView._elementStyle.rules) {
+    rule.editor.addProperty("font-weight", "bold", "");
+  }
+
+  reselectElement(doc.querySelector("#target"), () => {
+
+    for (let rule of ruleView._elementStyle.rules) {
+      let lastRule = rule.textProps[rule.textProps.length - 1];
+
+      is (lastRule.name, "font-weight", "Last rule name is font-weight");
+      is (lastRule.value, "bold", "Last rule value is bold");
+    }
+
     gBrowser.removeCurrentTab();
     openXUL();
   });
 }
 
+
 function openXUL()
 {
   Cc["@mozilla.org/permissionmanager;1"].getService(Ci.nsIPermissionManager)
@@ -96,7 +132,7 @@ function finishUp()
   info("finishing up");
   Cc["@mozilla.org/permissionmanager;1"].getService(Ci.nsIPermissionManager)
     .addFromPrincipal(XUL_PRINCIPAL, 'allowXULXBL', Ci.nsIPermissionManager.DENY_ACTION);
-  doc = null;
+  doc = inspector = ruleView = null;
   gBrowser.removeCurrentTab();
   finish();
 }
diff --git a/browser/metro/base/content/apzc.js b/browser/metro/base/content/apzc.js
index 484ca0da764c..c7f736c3b32e 100644
--- a/browser/metro/base/content/apzc.js
+++ b/browser/metro/base/content/apzc.js
@@ -34,7 +34,6 @@ var APZCObserver = {
     window.addEventListener("SizeChanged", this, true);
     Elements.tabList.addEventListener("TabSelect", this, true);
     Elements.browsers.addEventListener("pageshow", this, true);
-    messageManager.addMessageListener("Browser:ContentScroll", this);
     messageManager.addMessageListener("Content:ZoomToRect", this);
   },
 
@@ -49,7 +48,6 @@ var APZCObserver = {
     window.removeEventListener("SizeChanged", this, true);
     Elements.tabList.removeEventListener("TabSelect", this, true);
     Elements.browsers.removeEventListener("pageshow", this, true);
-    messageManager.removeMessageListener("Browser:ContentScroll", this);
     messageManager.removeMessageListener("Content:ZoomToRect", this);
   },
 
@@ -85,16 +83,6 @@ var APZCObserver = {
     let json = aMessage.json;
     let browser = aMessage.target;
     switch (aMessage.name) {
-       // Content notifies us here (syncronously) if it has scrolled
-       // independent of the apz. This can happen in a lot of
-       // cases: keyboard shortcuts, scroll wheel, or content script.
-       // Let the apz know about this change so that it can update
-       // its scroll offset data.
-      case "Browser:ContentScroll": {
-        let data = json.viewId + " " + json.presShellId + " (" + json.scrollOffset.x + ", " + json.scrollOffset.y + ")";
-        Services.obs.notifyObservers(null, "apzc-scroll-offset-changed", data);
-        break;
-      }
       case "Content:ZoomToRect": {
         let { presShellId, viewId } = json;
         let rect = Rect.fromRect(json.rect);
diff --git a/browser/metro/base/content/bindings/browser.js b/browser/metro/base/content/bindings/browser.js
index 56017ef960bc..a7af6e1524bd 100644
--- a/browser/metro/base/content/bindings/browser.js
+++ b/browser/metro/base/content/bindings/browser.js
@@ -563,9 +563,6 @@ let ContentScroll =  {
   init: function() {
     addMessageListener("Content:SetWindowSize", this);
 
-    if (Services.prefs.getBoolPref("layers.async-pan-zoom.enabled")) {
-      addEventListener("scroll", this, true);
-    }
     addEventListener("pagehide", this, false);
     addEventListener("MozScrolledAreaChanged", this, false);
   },
@@ -601,11 +598,6 @@ let ContentScroll =  {
         this._scrollOffset = { x: 0, y: 0 };
         break;
 
-      case "scroll": {
-        this.notifyChromeAboutContentScroll(aEvent.target);
-        break;
-      }
-
       case "MozScrolledAreaChanged": {
         let doc = aEvent.originalTarget;
         if (content != doc.defaultView) // We are only interested in root scroll pane changes
@@ -627,47 +619,6 @@ let ContentScroll =  {
         break;
       }
     }
-  },
-
-  /*
-  * DOM scroll handler - if we receive this, content or the dom scrolled
-  * content without going through the apz. This can happen in a lot of
-  * cases, keyboard shortcuts, scroll wheel, or content script. Messages
-  * chrome via a sync call which messages the apz about the update.
-  */
-  notifyChromeAboutContentScroll: function (target) {
-    let isRoot = false;
-    if (target instanceof Ci.nsIDOMDocument) {
-      var window = target.defaultView;
-      var scrollOffset = this.getScrollOffset(window);
-      var element = target.documentElement;
-
-      if (target == content.document) {
-        if (this._scrollOffset.x == scrollOffset.x && this._scrollOffset.y == scrollOffset.y) {
-          // Don't send a scroll message back to APZC if it's the same as the
-          // last one.
-          return;
-        }
-        this._scrollOffset = scrollOffset;
-        isRoot = true;
-      }
-    } else {
-      var window = target.ownerDocument.defaultView;
-      var scrollOffset = this.getScrollOffsetForElement(target);
-      var element = target;
-    }
-
-    let utils = window.QueryInterface(Ci.nsIInterfaceRequestor).getInterface(Ci.nsIDOMWindowUtils);
-    let presShellId = {};
-    utils.getPresShellId(presShellId);
-    let viewId = utils.getViewId(element);
-    // Must be synchronous to prevent redraw getting out of sync from
-    // composition.
-    sendSyncMessage("Browser:ContentScroll",
-      { presShellId: presShellId.value,
-        viewId: viewId,
-        scrollOffset: scrollOffset,
-        isRoot: isRoot });
   }
 };
 
diff --git a/browser/metro/base/content/bindings/circularprogress.xml b/browser/metro/base/content/bindings/circularprogress.xml
index 7e71ee23b20b..fc078a86b563 100644
--- a/browser/metro/base/content/bindings/circularprogress.xml
+++ b/browser/metro/base/content/bindings/circularprogress.xml
@@ -67,7 +67,9 @@
               ctx.clip();
 
               // Draw circle image.
-              ctx.drawImage(this._img, 0, 0);
+              ctx.translate(center, center);
+              ctx.rotate(endAngle);
+              ctx.drawImage(this._img, -center, -center);
 
               ctx.restore();
             } else {
diff --git a/browser/metro/base/tests/mochitest/browser_prompt.js b/browser/metro/base/tests/mochitest/browser_prompt.js
new file mode 100644
index 000000000000..3a6607db8b36
--- /dev/null
+++ b/browser/metro/base/tests/mochitest/browser_prompt.js
@@ -0,0 +1,39 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+function test() {
+  waitForExplicitFinish();
+  runTests();
+}
+
+gTests.push({
+  desc: "Test getPrompt with null domWindow (bug 949333)",
+  run: function () {
+    let factory = Cc["@mozilla.org/prompter;1"].getService(Ci.nsIPromptFactory);
+    let prompter = factory.getPrompt(null, Ci.nsIPrompt);
+
+    let browser = getBrowser();
+    let dialogOpened = false;
+
+    Task.spawn(function() {
+      yield waitForEvent(browser, "DOMWillOpenModalDialog");
+      dialogOpened = true;
+
+      yield waitForMs(0);
+      let stack = browser.parentNode;
+      let dialogs = stack.getElementsByTagNameNS(XUL_NS, "tabmodalprompt");
+      is(dialogs.length, 1, "one tab-modal dialog showing");
+
+      let dialog = dialogs[0];
+      let okButton = dialog.ui.button0;
+      okButton.click();
+    });
+
+    prompter.alert("Test", "test");
+
+    ok(dialogOpened, "Dialog was opened");
+  }
+});
diff --git a/browser/metro/base/tests/mochitest/metro.ini b/browser/metro/base/tests/mochitest/metro.ini
index f3d3825d3003..744e546f8620 100644
--- a/browser/metro/base/tests/mochitest/metro.ini
+++ b/browser/metro/base/tests/mochitest/metro.ini
@@ -47,6 +47,7 @@ support-files =
 [browser_link_click.js]
 [browser_onscreen_keyboard.js]
 [browser_prefs_ui.js]
+[browser_prompt.js]
 [browser_remotetabs.js]
 [browser_snappedState.js]
 [browser_tabs.js]
diff --git a/browser/metro/components/PromptService.js b/browser/metro/components/PromptService.js
index 343d907dc8ff..964d66fb2f63 100644
--- a/browser/metro/components/PromptService.js
+++ b/browser/metro/components/PromptService.js
@@ -22,6 +22,16 @@ PromptService.prototype = {
   /* ----------  nsIPromptFactory  ---------- */
 
   getPrompt: function getPrompt(domWin, iid) {
+    if (!domWin) {
+      let chromeWin = Services.wm.getMostRecentWindow("navigator:browser");
+      if (!chromeWin) {
+        let msg = "PromptService.js: Attempted create a prompt but no DOM Window specified and failed to find one";
+        Cu.reportError(msg);
+        throw(msg);
+      }
+      domWin = chromeWin.getBrowser().contentWindow;
+    }
+
     let factory =
           Components.classesByID["{1c978d25-b37f-43a8-a2d6-0c7a239ead87}"]
                     .createInstance(Ci.nsIPromptFactory);
@@ -39,16 +49,6 @@ PromptService.prototype = {
 
   callProxy: function(aName, aArgs) {
     let domWin = aArgs[0];
-    if (!domWin) {
-      let chromeWin = Services.wm.getMostRecentWindow("navigator:browser");
-      if (!chromeWin) {
-        let msg = "PromptService.js: Attempted create a prompt but no DOM Window specified and failed to find one";
-        Cu.reportError(msg);
-        throw(msg);
-      }
-      domWin = chromeWin.getBrowser().contentWindow;
-    }
-
     let prompt = this.getPrompt(domWin, Ci.nsIPrompt);
     if (aName == 'promptAuth' || aName == 'promptAuthAsync') {
       let adapterFactory =
diff --git a/browser/metro/modules/View.jsm b/browser/metro/modules/View.jsm
index cd60b89181fc..b99cf66a0e73 100644
--- a/browser/metro/modules/View.jsm
+++ b/browser/metro/modules/View.jsm
@@ -85,10 +85,10 @@ View.prototype = {
     if ("string" == typeof aIconUri) {
       aIconUri = makeURI(aIconUri);
     }
-    aItem.iconSrc = aIconUri.spec;
     let faviconURL = (PlacesUtils.favicons.getFaviconLinkForIcon(aIconUri)).spec;
-    let xpFaviconURI = makeURI(faviconURL.replace("moz-anno:favicon:",""));
+    aItem.iconSrc = faviconURL;
 
+    let xpFaviconURI = makeURI(faviconURL.replace("moz-anno:favicon:",""));
     Task.spawn(function() {
       let colorInfo = yield ColorUtils.getForegroundAndBackgroundIconColors(xpFaviconURI);
       if (!(colorInfo && colorInfo.background && colorInfo.foreground)) {
diff --git a/browser/metro/theme/defines.inc b/browser/metro/theme/defines.inc
index d255036d515f..e9681751b408 100644
--- a/browser/metro/theme/defines.inc
+++ b/browser/metro/theme/defines.inc
@@ -102,9 +102,12 @@
 %define metro_animation_duration 550ms
 %define metro_animation_easing cubic-bezier(0.1, 0.9, 0.2, 1)
 
-% this is meant to be slower than the system keyboard such
-% that the bars slide up after the keyboard is in place.
-%define appbar_keyboard_slideup_duration 750ms
+% duration and easing function to approximately match system keyboard
+% as animation cant be in lock-step with system OSK animation, some mismatch is inevitable
+% so we match velocity/cadence but delay to bring appbars in a tad after OSK
+%define appbar_keyboard_slideup_duration 420ms
+%define appbar_keyboard_slideup_delay 90ms
+%define appbar_keyboard_slideup_easing cubic-bezier(0, 1, 0.4, 0.96)
 
 % minimum resolution cutoffs for displaying 1.4x and 1.8x versions of icons
 % XXX currently, there's some weirdness with the dppx unit, as documented in
diff --git a/browser/metro/theme/images/progresscircle.png b/browser/metro/theme/images/progresscircle.png
index fe2af4660b8e..3f74cdf6f76a 100644
Binary files a/browser/metro/theme/images/progresscircle.png and b/browser/metro/theme/images/progresscircle.png differ
diff --git a/browser/metro/theme/platform.css b/browser/metro/theme/platform.css
index cce646eb466b..77cd38c3372b 100644
--- a/browser/metro/theme/platform.css
+++ b/browser/metro/theme/platform.css
@@ -751,7 +751,7 @@ appbar[visible] {
   /* Slow the bottom up transition since it's impossible to match the system's
      soft keyboard movement. */
   transition: transform @metro_animation_duration@ @metro_animation_easing@,
-              bottom @appbar_keyboard_slideup_duration@ @metro_animation_easing@;
+              bottom @appbar_keyboard_slideup_duration@ @appbar_keyboard_slideup_easing@ @appbar_keyboard_slideup_delay@;
 }
 
 
diff --git a/browser/modules/BrowserUITelemetry.jsm b/browser/modules/BrowserUITelemetry.jsm
index d1469418b0e9..a419e56b1cdc 100644
--- a/browser/modules/BrowserUITelemetry.jsm
+++ b/browser/modules/BrowserUITelemetry.jsm
@@ -102,7 +102,9 @@ this.BrowserUITelemetry = {
 
     for (let areaID of CustomizableUI.areas) {
       let areaNode = document.getElementById(areaID);
-      (areaNode.customizationTarget || areaNode).addEventListener("mouseup", this);
+      if (areaNode) {
+        (areaNode.customizationTarget || areaNode).addEventListener("mouseup", this);
+      }
     }
   },
 
@@ -112,7 +114,9 @@ this.BrowserUITelemetry = {
 
     for (let areaID of CustomizableUI.areas) {
       let areaNode = document.getElementById(areaID);
-      (areaNode.customizationTarget || areaNode).removeEventListener("mouseup", this);
+      if (areaNode) {
+        (areaNode.customizationTarget || areaNode).removeEventListener("mouseup", this);
+      }
     }
   },
 
diff --git a/browser/themes/shared/devtools/commandline.inc.css b/browser/themes/shared/devtools/commandline.inc.css
index 4ee7bebecc3f..ec177019fc34 100644
--- a/browser/themes/shared/devtools/commandline.inc.css
+++ b/browser/themes/shared/devtools/commandline.inc.css
@@ -7,6 +7,7 @@
 /* Developer toolbar */
 
 #developer-toolbar {
+  -moz-appearance: none;
   padding: 0;
   min-height: 32px;
   background-image: url(devtools/background-noise-toolbar.png), linear-gradient(#303840, #2d3640);
@@ -14,7 +15,7 @@
   box-shadow: 0 1px 0 hsla(204,45%,98%,.05) inset, 0 -1px 0 hsla(206,37%,4%,.1) inset;
 }
 
-.developer-toolbar-button {
+#developer-toolbar > toolbarbutton {
   -moz-appearance: none;
   border: none;
   background: transparent;
@@ -48,6 +49,34 @@
   -moz-image-region: rect(0px, 64px, 16px, 48px);
 }
 
+#developer-toolbar-closebutton {
+  list-style-image: url("chrome://browser/skin/devtools/close.png");
+  -moz-appearance: none;
+  border: none;
+  margin: 0 4px;
+  min-width: 16px;
+  width: 16px;
+  opacity: 0.6;
+}
+
+#developer-toolbar-closebutton > .toolbarbutton-icon {
+  /* XXX Buttons have padding in widget/ that we don't want here but can't override with good CSS, so we must
+     use evil CSS to give the impression of smaller content */
+  margin: -4px;
+}
+
+#developer-toolbar-closebutton > .toolbarbutton-text {
+  display: none;
+}
+
+#developer-toolbar-closebutton:hover {
+  opacity: 0.8;
+}
+
+#developer-toolbar-closebutton:hover:active {
+  opacity: 1;
+}
+
 /* GCLI */
 
 html|*#gcli-tooltip-frame,
diff --git a/browser/themes/shared/devtools/responsivedesign.inc.css b/browser/themes/shared/devtools/responsivedesign.inc.css
index 3b3691c0327c..d46c3422f560 100644
--- a/browser/themes/shared/devtools/responsivedesign.inc.css
+++ b/browser/themes/shared/devtools/responsivedesign.inc.css
@@ -16,6 +16,7 @@
 }
 
 .devtools-responsiveui-toolbar {
+  -moz-appearance: none;
   background: transparent;
   /* text color is textColor from dark theme, since no theme is applied to
    * the responsive toolbar.
@@ -27,10 +28,98 @@
   border-bottom-width: 0;
 }
 
-.devtools-responsiveui-toolbar > menulist,
-.devtools-responsiveui-toolbar > toolbarbutton {
-  min-width: 22px;
+.devtools-responsiveui-menulist,
+.devtools-responsiveui-toolbarbutton {
+  -moz-appearance: none;
+  -moz-box-align: center;
+  min-width: 32px;
+  min-height: 22px;
+  text-shadow: 0 -1px 0 hsla(210,8%,5%,.45);
+  border: 1px solid hsla(210,8%,5%,.45);
   border-radius: 0;
+  background: linear-gradient(hsla(212,7%,57%,.35), hsla(212,7%,57%,.1)) padding-box;
+  box-shadow: 0 1px 0 hsla(210,16%,76%,.15) inset, 0 0 0 1px hsla(210,16%,76%,.15) inset, 0 1px 0 hsla(210,16%,76%,.15);
+  margin: 0 3px;
+  color: inherit;
+}
+
+.devtools-responsiveui-toolbarbutton > .toolbarbutton-menubutton-button {
+  -moz-box-orient: horizontal;
+}
+
+.devtools-responsiveui-menulist:-moz-focusring,
+.devtools-responsiveui-toolbarbutton:-moz-focusring {
+  outline: 1px dotted hsla(210,30%,85%,0.7);
+  outline-offset: -4px;
+}
+
+.devtools-responsiveui-toolbarbutton:not([label]) > .toolbarbutton-text {
+  display: none;
+}
+
+.devtools-responsiveui-toolbarbutton:not([checked=true]):hover:active {
+  border-color: hsla(210,8%,5%,.6);
+  background: linear-gradient(hsla(220,6%,10%,.3), hsla(212,7%,57%,.15) 65%, hsla(212,7%,57%,.3));
+  box-shadow: 0 0 3px hsla(210,8%,5%,.25) inset, 0 1px 3px hsla(210,8%,5%,.25) inset, 0 1px 0 hsla(210,16%,76%,.15);
+}
+
+.devtools-responsiveui-menulist[open=true],
+.devtools-responsiveui-toolbarbutton[open=true],
+.devtools-responsiveui-toolbarbutton[checked=true] {
+  border-color: hsla(210,8%,5%,.6) !important;
+  background: linear-gradient(hsla(220,6%,10%,.6), hsla(210,11%,18%,.45) 75%, hsla(210,11%,30%,.4));
+  box-shadow: 0 1px 3px hsla(210,8%,5%,.25) inset, 0 1px 3px hsla(210,8%,5%,.25) inset, 0 1px 0 hsla(210,16%,76%,.15);
+}
+
+.devtools-responsiveui-toolbarbutton[checked=true] {
+  color: hsl(208,100%,60%);
+}
+
+.devtools-responsiveui-toolbarbutton[checked=true]:hover {
+  background-color: transparent !important;
+}
+
+.devtools-responsiveui-toolbarbutton[checked=true]:hover:active {
+  background-color: hsla(210,8%,5%,.2) !important;
+}
+
+.devtools-responsiveui-menulist > .menulist-label-box {
+  text-align: center;
+}
+
+.devtools-responsiveui-menulist > .menulist-dropmarker {
+  -moz-appearance: none;
+  display: -moz-box;
+  background-color: transparent;
+  list-style-image: url("chrome://browser/skin/devtools/dropmarker.png");
+  -moz-box-align: center;
+  border-width: 0;
+  min-width: 16px;
+}
+
+.devtools-responsiveui-toolbarbutton[type=menu-button] > .toolbarbutton-menubutton-button {
+  -moz-appearance: none;
+  color: inherit;
+  border-width: 0;
+  -moz-border-end: 1px solid hsla(210,8%,5%,.45);
+  box-shadow: -1px 0 0 hsla(210,16%,76%,.15) inset, 1px 0 0 hsla(210,16%,76%,.15);
+}
+
+.devtools-responsiveui-toolbarbutton[type=menu-button]:-moz-locale-dir(rtl) > .toolbarbutton-menubutton-button {
+  box-shadow: 1px 0 0 hsla(210,16%,76%,.15) inset, -1px 0 0 hsla(210,16%,76%,.15);
+}
+
+.devtools-responsiveui-toolbarbutton[type=menu-button] {
+  padding: 0 1px;
+  -moz-box-align: stretch;
+}
+
+.devtools-responsiveui-toolbarbutton[type=menu] > .toolbarbutton-menu-dropmarker,
+.devtools-responsiveui-toolbarbutton[type=menu-button] > .toolbarbutton-menubutton-dropmarker {
+  -moz-appearance: none !important;
+  list-style-image: url("chrome://browser/skin/devtools/dropmarker.png");
+  -moz-box-align: center;
+  padding: 0 3px;
 }
 
 .devtools-responsiveui-toolbar:-moz-locale-dir(ltr) > *:first-child,
diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index a5b346cd1bf7..aba761157604 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -87,6 +87,7 @@ GK_ATOM(applet, "applet")
 GK_ATOM(applyImports, "apply-imports")
 GK_ATOM(applyTemplates, "apply-templates")
 GK_ATOM(mozapptype, "mozapptype")
+GK_ATOM(apz, "apz")
 GK_ATOM(archive, "archive")
 GK_ATOM(area, "area")
 GK_ATOM(arrow, "arrow")
diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 2ba41b97318a..25c8b0db5d3a 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -1636,23 +1636,6 @@ nsDOMWindowUtils::GetScrollXY(bool aFlushLayout, int32_t* aScrollX, int32_t* aSc
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsDOMWindowUtils::ScrollToCSSPixelsApproximate(float aX, float aY, bool* aRetVal)
-{
-  nsCOMPtr<nsPIDOMWindow> window = do_QueryReferent(mWindow);
-  NS_ENSURE_STATE(window);
-
-  nsIScrollableFrame* sf = static_cast<nsGlobalWindow*>(window.get())->GetScrollFrame();
-  if (sf) {
-    sf->ScrollToCSSPixelsApproximate(CSSPoint(aX, aY));
-  }
-  if (aRetVal) {
-    *aRetVal = (sf != nullptr);
-  }
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsDOMWindowUtils::GetScrollXYFloat(bool aFlushLayout, float* aScrollX, float* aScrollY)
 {
diff --git a/dom/bluetooth/BluetoothRilListener.cpp b/dom/bluetooth/BluetoothRilListener.cpp
index c779c0e54457..e3d6c9b13c3e 100644
--- a/dom/bluetooth/BluetoothRilListener.cpp
+++ b/dom/bluetooth/BluetoothRilListener.cpp
@@ -184,7 +184,7 @@ TelephonyListener::CallStateChanged(uint32_t aServiceId,
   NS_ENSURE_TRUE(hfp, NS_ERROR_FAILURE);
 
   hfp->HandleCallStateChanged(aCallIndex, aCallState, EmptyString(), aNumber,
-                              aIsOutgoing, true);
+                              aIsOutgoing, aIsConference, true);
   return NS_OK;
 }
 
@@ -202,7 +202,7 @@ TelephonyListener::EnumerateCallState(uint32_t aServiceId,
   NS_ENSURE_TRUE(hfp, NS_ERROR_FAILURE);
 
   hfp->HandleCallStateChanged(aCallIndex, aCallState, EmptyString(), aNumber,
-                              aIsOutgoing, false);
+                              aIsOutgoing, aIsConference, false);
   return NS_OK;
 }
 
@@ -222,7 +222,7 @@ TelephonyListener::NotifyError(uint32_t aServiceId,
     // via setting CALL_STATE_DISCONNECTED
     hfp->HandleCallStateChanged(aCallIndex,
                                 nsITelephonyProvider::CALL_STATE_DISCONNECTED,
-                                aError, EmptyString(), false, true);
+                                aError, EmptyString(), false, false, true);
     BT_WARNING("Reset the call state due to call transition ends abnormally");
   }
 
diff --git a/dom/bluetooth/bluedroid/BluetoothHfpManager.cpp b/dom/bluetooth/bluedroid/BluetoothHfpManager.cpp
index e9088459c800..90f671c6610f 100644
--- a/dom/bluetooth/bluedroid/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothHfpManager.cpp
@@ -1047,6 +1047,7 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
                                             const nsAString& aError,
                                             const nsAString& aNumber,
                                             const bool aIsOutgoing,
+                                            const bool aIsConference,
                                             bool aSend)
 {
   if (!IsConnected()) {
diff --git a/dom/bluetooth/bluedroid/BluetoothHfpManager.h b/dom/bluetooth/bluedroid/BluetoothHfpManager.h
index a0178559b286..d4ce85d9e54c 100644
--- a/dom/bluetooth/bluedroid/BluetoothHfpManager.h
+++ b/dom/bluetooth/bluedroid/BluetoothHfpManager.h
@@ -95,7 +95,8 @@ public:
    */
   void HandleCallStateChanged(uint32_t aCallIndex, uint16_t aCallState,
                               const nsAString& aError, const nsAString& aNumber,
-                              const bool aIsOutgoing, bool aSend);
+                              const bool aIsOutgoing, const bool aIsConference,
+                              bool aSend);
   void HandleIccInfoChanged(uint32_t aClientId);
   void HandleVoiceConnectionChanged(uint32_t aClientId);
 
diff --git a/dom/bluetooth/bluez/BluetoothHfpManager.cpp b/dom/bluetooth/bluez/BluetoothHfpManager.cpp
index 26a979738d8c..bda21d158a78 100644
--- a/dom/bluetooth/bluez/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/bluez/BluetoothHfpManager.cpp
@@ -327,6 +327,7 @@ Call::Reset()
 {
   mState = nsITelephonyProvider::CALL_STATE_DISCONNECTED;
   mDirection = false;
+  mIsConference = false;
   mNumber.Truncate();
   mType = TOA_UNKNOWN;
 }
@@ -753,7 +754,7 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
 
     // If we get internal request for SCO connection,
     // setup SCO after Service Level Connection established.
-    if(mConnectScoRequest) {
+    if (mConnectScoRequest) {
       mConnectScoRequest = false;
       ConnectSco();
     }
@@ -832,7 +833,7 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
     mCurrentVgm = vgm;
 #ifdef MOZ_B2G_RIL
   } else if (msg.Find("AT+CHLD=?") != -1) {
-    SendLine("+CHLD: (0,1,2)");
+    SendLine("+CHLD: (0,1,2,3)");
   } else if (msg.Find("AT+CHLD=") != -1) {
     ParseAtCommand(msg, 8, atCommandValues);
 
@@ -849,9 +850,10 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
      *             waiting) call
      * AT+CHLD=2 - Places active calls on hold and accepts the other (held
      *             or waiting) call
+     * AT+CHLD=3 - Adds a held call to the conversation.
      *
      * The following cases are NOT supported yet:
-     * AT+CHLD=1<idx>, AT+CHLD=2<idx>, AT+CHLD=3, AT+CHLD=4
+     * AT+CHLD=1<idx>, AT+CHLD=2<idx>, AT+CHLD=4
      * Please see 4.33.2 in Bluetooth hands-free profile 1.6 for more
      * information.
      */
@@ -860,7 +862,7 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
     if (atCommandValues[0].Length() > 1) {
       BT_WARNING("No index should be included in command [AT+CHLD]");
       valid = false;
-    } else if (chld == '3' || chld == '4') {
+    } else if (chld == '4') {
       BT_WARNING("The value of command [AT+CHLD] is not supported");
       valid = false;
     } else if (chld == '0') {
@@ -872,6 +874,8 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
       NotifyDialer(NS_LITERAL_STRING("CHLD=1"));
     } else if (chld == '2') {
       NotifyDialer(NS_LITERAL_STRING("CHLD=2"));
+    } else if (chld == '3') {
+      NotifyDialer(NS_LITERAL_STRING("CHLD=3"));
     } else {
       BT_WARNING("Wrong value of command [AT+CHLD]");
       valid = false;
@@ -1368,6 +1372,7 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
                                             const nsAString& aError,
                                             const nsAString& aNumber,
                                             const bool aIsOutgoing,
+                                            const bool aIsConference,
                                             bool aSend)
 {
   if (!IsConnected()) {
@@ -1384,6 +1389,9 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
   mCurrentCallArray[aCallIndex].mState = aCallState;
   mCurrentCallArray[aCallIndex].mDirection = !aIsOutgoing;
 
+  bool prevCallIsConference = mCurrentCallArray[aCallIndex].mIsConference;
+  mCurrentCallArray[aCallIndex].mIsConference = aIsConference;
+
   // Same logic as implementation in ril_worker.js
   if (aNumber.Length() && aNumber[0] == '+') {
     mCurrentCallArray[aCallIndex].mType = TOA_INTERNATIONAL;
@@ -1395,12 +1403,16 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
 
   switch (aCallState) {
     case nsITelephonyProvider::CALL_STATE_HELD:
-      if (!FindFirstCall(nsITelephonyProvider::CALL_STATE_CONNECTED)) {
-        sCINDItems[CINDType::CALLHELD].value = CallHeldState::ONHOLD_NOACTIVE;
-      } else {
-        sCINDItems[CINDType::CALLHELD].value = CallHeldState::ONHOLD_ACTIVE;
+      if (prevCallState == nsITelephonyProvider::CALL_STATE_CONNECTED) {
+        if (mCurrentCallArray.Length() == 1) {
+          // A single active call is put on hold (+CIEV, callheld=2)
+          sCINDItems[CINDType::CALLHELD].value = CallHeldState::ONHOLD_NOACTIVE;
+        } else {
+          // Releases all active calls and accepts the other (+CIEV, callheld=1)
+          sCINDItems[CINDType::CALLHELD].value = CallHeldState::ONHOLD_ACTIVE;
+        }
+        SendCommand("+CIEV: ", CINDType::CALLHELD);
       }
-      SendCommand("+CIEV: ", CINDType::CALLHELD);
       break;
     case nsITelephonyProvider::CALL_STATE_INCOMING:
       if (FindFirstCall(nsITelephonyProvider::CALL_STATE_CONNECTED)) {
@@ -1458,27 +1470,29 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
           UpdateCIND(CINDType::CALL, CallState::IN_PROGRESS, aSend);
           UpdateCIND(CINDType::CALLSETUP, CallSetupState::NO_CALLSETUP, aSend);
           break;
+        // User wants to add a held call to the conversation.
+        // The original connected call become a conference call here.
+        case nsITelephonyProvider::CALL_STATE_CONNECTED:
+          if (aIsConference) {
+            UpdateCIND(CINDType::CALLHELD, CallHeldState::NO_CALLHELD, aSend);
+          }
+          break;
+        case nsITelephonyProvider::CALL_STATE_HELD:
+          if (!FindFirstCall(nsITelephonyProvider::CALL_STATE_HELD)) {
+            if (aIsConference && !prevCallIsConference) {
+              // The held call was merged and become a conference call.
+              UpdateCIND(CINDType::CALLHELD, CallHeldState::NO_CALLHELD, aSend);
+            } else if (sCINDItems[CINDType::CALLHELD].value ==
+                       CallHeldState::ONHOLD_NOACTIVE) {
+              // The held call(s) become connected call(s).
+              UpdateCIND(CINDType::CALLHELD, CallHeldState::NO_CALLHELD, aSend);
+            }
+          }
+          break;
+
         default:
           BT_WARNING("Not handling state changed");
       }
-
-      // = Handle callheld separately =
-      // Besides checking if there is still held calls, another thing we
-      // need to consider is the state change when receiving AT+CHLD=2.
-      // Assume that there is one active call(c1) and one call on hold(c2).
-      // We got AT+CHLD=2, which swaps active/held position. The first
-      // action would be c2 -> ACTIVE, then c1 -> HELD. When we get the
-      // CallStateChanged event of c2 becoming ACTIVE, we enter here.
-      // However we can't send callheld=0 at this time because we should
-      // see c2 -> ACTIVE + c1 -> HELD as one operation. That's the reason
-      // why I added the GetNumberOfCalls() condition check.
-      if (GetNumberOfCalls(nsITelephonyProvider::CALL_STATE_CONNECTED) == 1) {
-        if (FindFirstCall(nsITelephonyProvider::CALL_STATE_HELD)) {
-          UpdateCIND(CINDType::CALLHELD, CallHeldState::ONHOLD_ACTIVE, aSend);
-        } else if (prevCallState == nsITelephonyProvider::CALL_STATE_HELD) {
-          UpdateCIND(CINDType::CALLHELD, CallHeldState::NO_CALLHELD, aSend);
-        }
-      }
       break;
     case nsITelephonyProvider::CALL_STATE_DISCONNECTED:
       switch (prevCallState) {
diff --git a/dom/bluetooth/bluez/BluetoothHfpManager.h b/dom/bluetooth/bluez/BluetoothHfpManager.h
index f44cb194634d..eaff1eb9cd79 100644
--- a/dom/bluetooth/bluez/BluetoothHfpManager.h
+++ b/dom/bluetooth/bluez/BluetoothHfpManager.h
@@ -68,6 +68,7 @@ public:
 
   uint16_t mState;
   bool mDirection; // true: incoming call; false: outgoing call
+  bool mIsConference;
   nsString mNumber;
   int mType;
 };
@@ -121,7 +122,8 @@ public:
    */
   void HandleCallStateChanged(uint32_t aCallIndex, uint16_t aCallState,
                               const nsAString& aError, const nsAString& aNumber,
-                              const bool aIsOutgoing, bool aSend);
+                              const bool aIsOutgoing, const bool aIsConference,
+                              bool aSend);
   void HandleIccInfoChanged(uint32_t aClientId);
   void HandleVoiceConnectionChanged(uint32_t aClientId);
 
diff --git a/dom/browser-element/mochitest/browserElementTestHelpers.js b/dom/browser-element/mochitest/browserElementTestHelpers.js
index 64568b81d17a..18e1907d68a7 100644
--- a/dom/browser-element/mochitest/browserElementTestHelpers.js
+++ b/dom/browser-element/mochitest/browserElementTestHelpers.js
@@ -212,10 +212,8 @@ function expectPriorityWithBackgroundLRUSet(childID, expectedBackgroundLRU) {
     'process-priority-with-background-LRU-set',
     function(subject, topic, data) {
 
-      dump("browserElementTestHelpers got notify: topic "+ topic + ", data " + data +"\n");
       var [id, priority, cpuPriority, backgroundLRU] = data.split(":");
       if (id != childID) {
-        dump("id(" + id + ") != childID(" + childID + ")\n");
         return;
       }
 
diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index 57b23a4e7283..e6b8180114f6 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -43,7 +43,7 @@ interface nsIDOMEventTarget;
 interface nsIRunnable;
 interface nsICompositionStringSynthesizer;
 
-[scriptable, uuid(38740b7e-095e-4198-a012-cf5f9e102a6a)]
+[scriptable, uuid(c6efd629-7282-4f0d-9db8-0fa59c191dd5)]
 interface nsIDOMWindowUtils : nsISupports {
 
   /**
@@ -750,13 +750,6 @@ interface nsIDOMWindowUtils : nsISupports {
    */
   void getScrollXYFloat(in boolean aFlushLayout, out float aScrollX, out float aScrollY);
 
-  /**
-   * Sets the scroll position of the root scroll frame of the window.
-   * Returns true on success, false on error (if the window didn't have a root
-   * scroll frame).
-   */
-  boolean scrollToCSSPixelsApproximate(in float aX, in float aY);
-
   /**
    * Returns the scrollbar width of the window's scroll frame.
    *
diff --git a/dom/ipc/PBrowser.ipdl b/dom/ipc/PBrowser.ipdl
index 7a83c5b3de2c..fef3a2e95680 100644
--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@@ -296,13 +296,6 @@ parent:
     UpdateZoomConstraints(uint32_t aPresShellId, ViewID aViewId, bool aIsRoot,
                           bool aAllowZoom, CSSToScreenScale aMinZoom, CSSToScreenScale aMaxZoom);
 
-    /**
-     * Notifies the parent about a scroll event. The pres shell ID and
-     * view ID identify which scrollable (sub-)frame was scrolled, and
-     * the new scroll offset for that frame is sent.
-     */
-    UpdateScrollOffset(uint32_t aPresShellId, ViewID aViewId, CSSIntPoint aScrollOffset);
-
     __delete__();
 
 child:
diff --git a/dom/ipc/ProcessPriorityManager.cpp b/dom/ipc/ProcessPriorityManager.cpp
index d6bb96cd352c..35c6489e7ccd 100644
--- a/dom/ipc/ProcessPriorityManager.cpp
+++ b/dom/ipc/ProcessPriorityManager.cpp
@@ -43,9 +43,7 @@
 //
 // (Wow, our logging story is a huge mess.)
 
-#ifndef HAVE_64BIT_OS
-#define ENABLE_LOGGING 1
-#endif
+// #define ENABLE_LOGGING 1
 
 #if defined(ANDROID) && defined(ENABLE_LOGGING)
 #  include <android/log.h>
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 8306641297ff..296adef20119 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -299,53 +299,6 @@ TabChild::HandleEvent(nsIDOMEvent* aEvent)
     // This meta data may or may not have been a meta viewport tag. If it was,
     // we should handle it immediately.
     HandlePossibleViewportChange();
-  } else if (eventType.EqualsLiteral("scroll")) {
-    nsCOMPtr<nsIDOMEventTarget> target;
-    aEvent->GetTarget(getter_AddRefs(target));
-
-    ViewID viewId;
-    uint32_t presShellId;
-
-    nsCOMPtr<nsIContent> content;
-    if (nsCOMPtr<nsIDocument> doc = do_QueryInterface(target))
-      content = doc->GetDocumentElement();
-    else
-      content = do_QueryInterface(target);
-
-    nsCOMPtr<nsIDOMWindowUtils> utils = APZCCallbackHelper::GetDOMWindowUtils(content);
-    utils->GetPresShellId(&presShellId);
-
-    if (!nsLayoutUtils::FindIDFor(content, &viewId))
-      return NS_ERROR_UNEXPECTED;
-
-    nsIScrollableFrame* scrollFrame = nsLayoutUtils::FindScrollableFrameFor(viewId);
-    if (!scrollFrame)
-      return NS_OK;
-
-    CSSIntPoint scrollOffset = scrollFrame->GetScrollPositionCSSPixels();
-
-    if (viewId == mLastRootMetrics.mScrollId) {
-      // We store the last metrics that was sent via the TabParent (This is
-      // updated in ProcessUpdateFrame and RecvUpdateFrame).
-      // We use this here to avoid sending APZC back a scroll event that
-      // originally came from APZC (besides being unnecessary, the event might
-      // be slightly out of date by the time it reaches APZC).
-      if (RoundedToInt(mLastRootMetrics.mScrollOffset) == scrollOffset) {
-        return NS_OK;
-      }
-
-      // Update the last scroll offset now, otherwise RecvUpdateDimensions()
-      // might trigger a scroll to the old offset before RecvUpdateFrame()
-      // gets a chance to update it.
-      mLastRootMetrics.mScrollOffset = scrollOffset;
-    } else if (viewId == mLastSubFrameMetrics.mScrollId) {
-      if (RoundedToInt(mLastSubFrameMetrics.mScrollOffset) == scrollOffset) {
-        return NS_OK;
-      }
-      mLastSubFrameMetrics.mScrollOffset = scrollOffset;
-    }
-
-    SendUpdateScrollOffset(presShellId, viewId, scrollOffset);
   }
 
   return NS_OK;
@@ -522,6 +475,31 @@ TabChild::SetCSSViewport(const CSSSize& aSize)
   }
 }
 
+static CSSSize
+GetPageSize(nsCOMPtr<nsIDocument> aDocument, const CSSSize& aViewport)
+{
+  nsCOMPtr<Element> htmlDOMElement = aDocument->GetHtmlElement();
+  HTMLBodyElement* bodyDOMElement = aDocument->GetBodyElement();
+
+  if (!htmlDOMElement && !bodyDOMElement) {
+    // For non-HTML content (e.g. SVG), just assume page size == viewport size.
+    return aViewport;
+  }
+
+  int32_t htmlWidth = 0, htmlHeight = 0;
+  if (htmlDOMElement) {
+    htmlWidth = htmlDOMElement->ScrollWidth();
+    htmlHeight = htmlDOMElement->ScrollHeight();
+  }
+  int32_t bodyWidth = 0, bodyHeight = 0;
+  if (bodyDOMElement) {
+    bodyWidth = bodyDOMElement->ScrollWidth();
+    bodyHeight = bodyDOMElement->ScrollHeight();
+  }
+  return CSSSize(std::max(htmlWidth, bodyWidth),
+                 std::max(htmlHeight, bodyHeight));
+}
+
 void
 TabChild::HandlePossibleViewportChange()
 {
@@ -579,33 +557,6 @@ TabChild::HandlePossibleViewportChange()
     return;
   }
 
-  nsCOMPtr<Element> htmlDOMElement = document->GetHtmlElement();
-  HTMLBodyElement* bodyDOMElement = document->GetBodyElement();
-
-  int32_t htmlWidth = 0, htmlHeight = 0;
-  if (htmlDOMElement) {
-    htmlWidth = htmlDOMElement->ScrollWidth();
-    htmlHeight = htmlDOMElement->ScrollHeight();
-  }
-  int32_t bodyWidth = 0, bodyHeight = 0;
-  if (bodyDOMElement) {
-    bodyWidth = bodyDOMElement->ScrollWidth();
-    bodyHeight = bodyDOMElement->ScrollHeight();
-  }
-
-  CSSSize pageSize;
-  if (htmlDOMElement || bodyDOMElement) {
-    pageSize = CSSSize(std::max(htmlWidth, bodyWidth),
-                       std::max(htmlHeight, bodyHeight));
-  } else {
-    // For non-HTML content (e.g. SVG), just assume page size == viewport size.
-    pageSize = viewport;
-  }
-  if (!pageSize.width) {
-    // Return early rather than divide by 0.
-    return;
-  }
-
   float oldScreenWidth = mLastRootMetrics.mCompositionBounds.width;
   if (!oldScreenWidth) {
     oldScreenWidth = mInnerSize.width;
@@ -613,7 +564,6 @@ TabChild::HandlePossibleViewportChange()
 
   FrameMetrics metrics(mLastRootMetrics);
   metrics.mViewport = CSSRect(CSSPoint(), viewport);
-  metrics.mScrollableRect = CSSRect(CSSPoint(), pageSize);
   metrics.mCompositionBounds = ScreenIntRect(ScreenIntPoint(), mInnerSize);
 
   // This change to the zoom accounts for all types of changes I can conceive:
@@ -663,6 +613,20 @@ TabChild::HandlePossibleViewportChange()
   metrics.mResolution = metrics.mCumulativeResolution / LayoutDeviceToParentLayerScale(1);
   utils->SetResolution(metrics.mResolution.scale, metrics.mResolution.scale);
 
+  CSSSize scrollPort = metrics.CalculateCompositedRectInCssPixels().Size();
+  utils->SetScrollPositionClampingScrollPortSize(scrollPort.width, scrollPort.height);
+
+  // The call to GetPageSize forces a resize event to content, so we need to
+  // make sure that we have the right CSS viewport and
+  // scrollPositionClampingScrollPortSize set up before that happens.
+
+  CSSSize pageSize = GetPageSize(document, viewport);
+  if (!pageSize.width) {
+    // Return early rather than divide by 0.
+    return;
+  }
+  metrics.mScrollableRect = CSSRect(CSSPoint(), pageSize);
+
   // Force a repaint with these metrics. This, among other things, sets the
   // displayport, so we start with async painting.
   ProcessUpdateFrame(metrics);
@@ -1538,7 +1502,6 @@ TabChild::RecvUpdateFrame(const FrameMetrics& aFrameMetrics)
     if (content) {
       FrameMetrics newSubFrameMetrics(aFrameMetrics);
       APZCCallbackHelper::UpdateSubFrame(content, newSubFrameMetrics);
-      mLastSubFrameMetrics = newSubFrameMetrics;
       return true;
     }
   }
@@ -2233,7 +2196,6 @@ TabChild::InitTabChildGlobal(FrameScriptLoading aScriptLoading)
     root->SetParentTarget(scope);
 
     chromeHandler->AddEventListener(NS_LITERAL_STRING("DOMMetaAdded"), this, false);
-    chromeHandler->AddEventListener(NS_LITERAL_STRING("scroll"), this, true);
   }
 
   if (aScriptLoading != DONT_LOAD_SCRIPTS && !mTriedBrowserInit) {
diff --git a/dom/ipc/TabChild.h b/dom/ipc/TabChild.h
index 7323dce45383..993593c35b40 100644
--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@@ -469,7 +469,6 @@ private:
     nsCOMPtr<nsIWidget> mWidget;
     nsCOMPtr<nsIURI> mLastURI;
     FrameMetrics mLastRootMetrics;
-    FrameMetrics mLastSubFrameMetrics;
     RenderFrameChild* mRemoteFrame;
     nsRefPtr<ContentChild> mManager;
     nsRefPtr<TabChildGlobal> mTabChildGlobal;
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index 0a6f9aeac4fc..62a2df2ff7bd 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -1721,17 +1721,6 @@ TabParent::RecvUpdateZoomConstraints(const uint32_t& aPresShellId,
   return true;
 }
 
-bool
-TabParent::RecvUpdateScrollOffset(const uint32_t& aPresShellId,
-                                  const ViewID& aViewId,
-                                  const CSSIntPoint& aScrollOffset)
-{
-  if (RenderFrameParent* rfp = GetRenderFrame()) {
-    rfp->UpdateScrollOffset(aPresShellId, aViewId, aScrollOffset);
-  }
-  return true;
-}
-
 bool
 TabParent::RecvContentReceivedTouch(const ScrollableLayerGuid& aGuid,
                                     const bool& aPreventDefault)
diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h
index 1688c14e33c5..5daae4dea509 100644
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -171,7 +171,6 @@ public:
                                            const bool& aAllowZoom,
                                            const CSSToScreenScale& aMinZoom,
                                            const CSSToScreenScale& aMaxZoom);
-    virtual bool RecvUpdateScrollOffset(const uint32_t& aPresShellId, const ViewID& aViewId, const CSSIntPoint& aScrollOffset);
     virtual bool RecvContentReceivedTouch(const ScrollableLayerGuid& aGuid,
                                           const bool& aPreventDefault);
     virtual PContentDialogParent* AllocPContentDialogParent(const uint32_t& aType,
diff --git a/gfx/ipc/GfxMessageUtils.h b/gfx/ipc/GfxMessageUtils.h
index 9cdd4c008a28..8f441cf077b9 100644
--- a/gfx/ipc/GfxMessageUtils.h
+++ b/gfx/ipc/GfxMessageUtils.h
@@ -585,6 +585,7 @@ struct ParamTraits<mozilla::layers::FrameMetrics>
     WriteParam(aMsg, aParam.mPresShellId);
     WriteParam(aMsg, aParam.mIsRoot);
     WriteParam(aMsg, aParam.mHasScrollgrab);
+    WriteParam(aMsg, aParam.mUpdateScrollOffset);
   }
 
   static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
@@ -603,7 +604,8 @@ struct ParamTraits<mozilla::layers::FrameMetrics>
             ReadParam(aMsg, aIter, &aResult->mMayHaveTouchListeners) &&
             ReadParam(aMsg, aIter, &aResult->mPresShellId) &&
             ReadParam(aMsg, aIter, &aResult->mIsRoot) &&
-            ReadParam(aMsg, aIter, &aResult->mHasScrollgrab));
+            ReadParam(aMsg, aIter, &aResult->mHasScrollgrab) &&
+            ReadParam(aMsg, aIter, &aResult->mUpdateScrollOffset));
   }
 };
 
diff --git a/gfx/layers/FrameMetrics.h b/gfx/layers/FrameMetrics.h
index 51d442070124..f813f8626d78 100644
--- a/gfx/layers/FrameMetrics.h
+++ b/gfx/layers/FrameMetrics.h
@@ -55,6 +55,7 @@ public:
     , mPresShellId(-1)
     , mIsRoot(false)
     , mHasScrollgrab(false)
+    , mUpdateScrollOffset(false)
   {}
 
   // Default copy ctor and operator= are fine
@@ -73,7 +74,8 @@ public:
            mDevPixelsPerCSSPixel == aOther.mDevPixelsPerCSSPixel &&
            mMayHaveTouchListeners == aOther.mMayHaveTouchListeners &&
            mPresShellId == aOther.mPresShellId &&
-           mIsRoot == aOther.mIsRoot;
+           mIsRoot == aOther.mIsRoot &&
+           mUpdateScrollOffset == aOther.mUpdateScrollOffset;
   }
   bool operator!=(const FrameMetrics& aOther) const
   {
@@ -284,6 +286,10 @@ public:
 
   // Whether or not this frame is for an element marked 'scrollgrab'.
   bool mHasScrollgrab;
+
+  // Whether mScrollOffset was updated by something other than the APZ code, and
+  // if the APZC receiving this metrics should update its local copy.
+  bool mUpdateScrollOffset;
 };
 
 /**
diff --git a/gfx/layers/composite/APZCTreeManager.cpp b/gfx/layers/composite/APZCTreeManager.cpp
index b1eaa499a4e0..1cef51806230 100644
--- a/gfx/layers/composite/APZCTreeManager.cpp
+++ b/gfx/layers/composite/APZCTreeManager.cpp
@@ -619,16 +619,6 @@ APZCTreeManager::UpdateZoomConstraintsRecursively(AsyncPanZoomController* aApzc,
   }
 }
 
-void
-APZCTreeManager::UpdateScrollOffset(const ScrollableLayerGuid& aGuid,
-                                    const CSSPoint& aScrollOffset)
-{
-  nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(aGuid);
-  if (apzc) {
-    apzc->UpdateScrollOffset(aScrollOffset);
-  }
-}
-
 void
 APZCTreeManager::CancelAnimation(const ScrollableLayerGuid &aGuid)
 {
diff --git a/gfx/layers/composite/APZCTreeManager.h b/gfx/layers/composite/APZCTreeManager.h
index 1d14c516c405..fc37810baf96 100644
--- a/gfx/layers/composite/APZCTreeManager.h
+++ b/gfx/layers/composite/APZCTreeManager.h
@@ -172,14 +172,6 @@ public:
                              const CSSToScreenScale& aMinScale,
                              const CSSToScreenScale& aMaxScale);
 
-  /**
-   * Update mFrameMetrics.mScrollOffset to the given offset.
-   * This is necessary in cases where a scroll is not caused by user
-   * input (for example, a content scrollTo()).
-   */
-  void UpdateScrollOffset(const ScrollableLayerGuid& aGuid,
-                          const CSSPoint& aScrollOffset);
-
   /**
    * Cancels any currently running animation. Note that all this does is set the
    * state of the AsyncPanZoomController back to NOTHING, but it is the
diff --git a/gfx/layers/ipc/AsyncPanZoomController.cpp b/gfx/layers/ipc/AsyncPanZoomController.cpp
index 7bffe9adae9d..bd0a4c608a86 100644
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -61,7 +61,7 @@
 #define APZC_LOG_FM(fm, prefix, ...) \
   APZC_LOG(prefix ":" \
            " i=(%ld %lld) cb=(%d %d %d %d) dp=(%.3f %.3f %.3f %.3f) v=(%.3f %.3f %.3f %.3f) " \
-           "s=(%.3f %.3f) sr=(%.3f %.3f %.3f %.3f) z=(%.3f %.3f %.3f %.3f)\n", \
+           "s=(%.3f %.3f) sr=(%.3f %.3f %.3f %.3f) z=(%.3f %.3f %.3f %.3f) %d\n", \
            __VA_ARGS__, \
            fm.mPresShellId, fm.mScrollId, \
            fm.mCompositionBounds.x, fm.mCompositionBounds.y, fm.mCompositionBounds.width, fm.mCompositionBounds.height, \
@@ -69,7 +69,8 @@
            fm.mViewport.x, fm.mViewport.y, fm.mViewport.width, fm.mViewport.height, \
            fm.mScrollOffset.x, fm.mScrollOffset.y, \
            fm.mScrollableRect.x, fm.mScrollableRect.y, fm.mScrollableRect.width, fm.mScrollableRect.height, \
-           fm.mDevPixelsPerCSSPixel.scale, fm.mResolution.scale, fm.mCumulativeResolution.scale, fm.mZoom.scale); \
+           fm.mDevPixelsPerCSSPixel.scale, fm.mResolution.scale, fm.mCumulativeResolution.scale, fm.mZoom.scale, \
+           fm.mUpdateScrollOffset); \
 
 // Static helper functions
 namespace {
@@ -1475,6 +1476,16 @@ void AsyncPanZoomController::NotifyLayersUpdated(const FrameMetrics& aLayerMetri
     mFrameMetrics.mZoom.scale *= parentResolutionChange;
     mFrameMetrics.mResolution = aLayerMetrics.mResolution;
     mFrameMetrics.mCumulativeResolution = aLayerMetrics.mCumulativeResolution;
+
+    // If the layers update was not triggered by our own repaint request, then
+    // we want to take the new scroll offset.
+    if (aLayerMetrics.mUpdateScrollOffset) {
+      APZC_LOG("Updating scroll offset from (%f, %f) to (%f, %f)\n",
+        mFrameMetrics.mScrollOffset.x, mFrameMetrics.mScrollOffset.y,
+        aLayerMetrics.mScrollOffset.x, aLayerMetrics.mScrollOffset.y);
+
+      mFrameMetrics.mScrollOffset = aLayerMetrics.mScrollOffset;
+    }
   }
 
   if (needContentRepaint) {
@@ -1717,16 +1728,6 @@ void AsyncPanZoomController::SendAsyncScrollEvent() {
   controller->SendAsyncScrollDOMEvent(isRoot, contentRect, scrollableSize);
 }
 
-void AsyncPanZoomController::UpdateScrollOffset(const CSSPoint& aScrollOffset)
-{
-  APZC_LOG("Updating scroll offset from (%f, %f) to (%f, %f)\n",
-    mFrameMetrics.mScrollOffset.x, mFrameMetrics.mScrollOffset.y,
-    aScrollOffset.x, aScrollOffset.y);
-
-  ReentrantMonitorAutoEnter lock(mMonitor);
-  mFrameMetrics.mScrollOffset = aScrollOffset;
-}
-
 bool AsyncPanZoomController::Matches(const ScrollableLayerGuid& aGuid)
 {
   return aGuid == ScrollableLayerGuid(mLayersId, mFrameMetrics);
diff --git a/gfx/layers/ipc/AsyncPanZoomController.h b/gfx/layers/ipc/AsyncPanZoomController.h
index 19de1504252f..97de0f27da3b 100644
--- a/gfx/layers/ipc/AsyncPanZoomController.h
+++ b/gfx/layers/ipc/AsyncPanZoomController.h
@@ -260,13 +260,6 @@ public:
    */
   static void SetFrameTime(const TimeStamp& aMilliseconds);
 
-  /**
-   * Update mFrameMetrics.mScrollOffset to the given offset.
-   * This is necessary in cases where a scroll is not caused by user
-   * input (for example, a content scrollTo()).
-   */
-  void UpdateScrollOffset(const CSSPoint& aScrollOffset);
-
   void StartAnimation(AsyncPanZoomAnimation* aAnimation);
 
   /**
diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index 259b896e76f9..22e5ff2c5690 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -630,6 +630,13 @@ static void RecordFrameMetrics(nsIFrame* aForFrame,
     metrics.mScrollableRect = CSSRect::FromAppUnits(contentBounds);
     nsPoint scrollPosition = scrollableFrame->GetScrollPosition();
     metrics.mScrollOffset = CSSPoint::FromAppUnits(scrollPosition);
+
+    // If the frame was scrolled since the last layers update, and by
+    // something other than the APZ code, we want to tell the APZ to update
+    // its scroll offset.
+    nsIAtom* originOfLastScroll = scrollableFrame->OriginOfLastScroll();
+    metrics.mUpdateScrollOffset = (originOfLastScroll && originOfLastScroll != nsGkAtoms::apz);
+    scrollableFrame->ResetOriginOfLastScroll();
   }
   else {
     nsRect contentBounds = aForFrame->GetRect();
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index b6e9ec413a17..96bbd6de2a73 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -4892,7 +4892,13 @@ nsIFrame::InvalidateLayer(uint32_t aDisplayItemKey,
     // Plugins can transition from not rendering anything to rendering,
     // and still only call this. So always invalidate, with specifying
     // the display item type just in case.
-    if (aDisplayItemKey == nsDisplayItem::TYPE_PLUGIN) {
+    //
+    // In the bug 930056, dialer app startup but not shown on the
+    // screen because sometimes we don't have any retainned data
+    // for remote type displayitem and thus Repaint event is not
+    // triggered. So, always invalidate here as well.
+    if (aDisplayItemKey == nsDisplayItem::TYPE_PLUGIN ||
+        aDisplayItemKey == nsDisplayItem::TYPE_REMOTE) {
       InvalidateFrame();
     } else {
       InvalidateFrame(aDisplayItemKey);
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index 2712405a1861..d053119a48b8 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -1537,6 +1537,7 @@ ScrollFrameHelper::ScrollFrameHelper(nsContainerFrame* aOuter,
   , mResizerBox(nullptr)
   , mOuter(aOuter)
   , mAsyncScroll(nullptr)
+  , mOriginOfLastScroll(nullptr)
   , mDestination(0, 0)
   , mScrollPosAtLastPaint(0, 0)
   , mRestorePos(-1, -1)
@@ -1652,12 +1653,13 @@ ScrollFrameHelper::ScrollToCSSPixels(const CSSIntPoint& aScrollPosition)
 }
 
 void
-ScrollFrameHelper::ScrollToCSSPixelsApproximate(const CSSPoint& aScrollPosition)
+ScrollFrameHelper::ScrollToCSSPixelsApproximate(const CSSPoint& aScrollPosition,
+                                                nsIAtom *aOrigin)
 {
   nsPoint pt = CSSPoint::ToAppUnits(aScrollPosition);
   nscoord halfRange = nsPresContext::CSSPixelsToAppUnits(1000);
   nsRect range(pt.x - halfRange, pt.y - halfRange, 2*halfRange - 1, 2*halfRange - 1);
-  ScrollTo(pt, nsIScrollableFrame::INSTANT, &range);
+  ScrollToWithOrigin(pt, nsIScrollableFrame::INSTANT, aOrigin, &range);
   // 'this' might be destroyed here
 }
 
@@ -1687,7 +1689,7 @@ ScrollFrameHelper::ScrollToWithOrigin(nsPoint aScrollPosition,
     // async-scrolling process and do an instant scroll.
     mAsyncScroll = nullptr;
     nsWeakFrame weakFrame(mOuter);
-    ScrollToImpl(mDestination, range);
+    ScrollToImpl(mDestination, range, aOrigin);
     if (!weakFrame.IsAlive()) {
       return;
     }
@@ -1707,7 +1709,7 @@ ScrollFrameHelper::ScrollToWithOrigin(nsPoint aScrollPosition,
       mAsyncScroll = nullptr;
       // Observer setup failed. Scroll the normal way.
       nsWeakFrame weakFrame(mOuter);
-      ScrollToImpl(mDestination, range);
+      ScrollToImpl(mDestination, range, aOrigin);
       if (!weakFrame.IsAlive()) {
         return;
       }
@@ -1982,8 +1984,15 @@ ScrollFrameHelper::ScheduleSyntheticMouseMove()
 }
 
 void
-ScrollFrameHelper::ScrollToImpl(nsPoint aPt, const nsRect& aRange)
+ScrollFrameHelper::ScrollToImpl(nsPoint aPt, const nsRect& aRange, nsIAtom* aOrigin)
 {
+  if (aOrigin == nullptr) {
+    // If no origin was specified, we still want to set it to something that's
+    // non-null, so that we can use nullness to distinguish if the frame was scrolled
+    // at all. Default it to some generic placeholder.
+    aOrigin = nsGkAtoms::other;
+  }
+
   nsPresContext* presContext = mOuter->PresContext();
   nscoord appUnitsPerDevPixel = presContext->AppUnitsPerDevPixel();
   // 'scale' is our estimate of the scale factor that will be applied
@@ -2038,6 +2047,7 @@ ScrollFrameHelper::ScrollToImpl(nsPoint aPt, const nsRect& aRange)
   nsPoint oldScrollFramePos = mScrolledFrame->GetPosition();
   // Update frame position for scrolling
   mScrolledFrame->SetPosition(mScrollPort.TopLeft() - pt);
+  mOriginOfLastScroll = aOrigin;
 
   // We pass in the amount to move visually
   ScrollVisual(oldScrollFramePos);
diff --git a/layout/generic/nsGfxScrollFrame.h b/layout/generic/nsGfxScrollFrame.h
index a6934b49a3f8..8351c9be07dd 100644
--- a/layout/generic/nsGfxScrollFrame.h
+++ b/layout/generic/nsGfxScrollFrame.h
@@ -191,13 +191,14 @@ public:
   /**
    * @note This method might destroy the frame, pres shell and other objects.
    */
-  void ScrollToCSSPixelsApproximate(const mozilla::CSSPoint& aScrollPosition);
+  void ScrollToCSSPixelsApproximate(const mozilla::CSSPoint& aScrollPosition,
+                                    nsIAtom* aOrigin = nullptr);
 
   CSSIntPoint GetScrollPositionCSSPixels();
   /**
    * @note This method might destroy the frame, pres shell and other objects.
    */
-  void ScrollToImpl(nsPoint aScrollPosition, const nsRect& aRange);
+  void ScrollToImpl(nsPoint aScrollPosition, const nsRect& aRange, nsIAtom* aOrigin = nullptr);
   void ScrollVisual(nsPoint aOldScrolledFramePosition);
   /**
    * @note This method might destroy the frame, pres shell and other objects.
@@ -305,6 +306,9 @@ public:
 
   void HandleScrollbarStyleSwitching();
 
+  nsIAtom* OriginOfLastScroll() const { return mOriginOfLastScroll; }
+  void ResetOriginOfLastScroll() { mOriginOfLastScroll = nullptr; }
+
   // owning references to the nsIAnonymousContentCreator-built content
   nsCOMPtr<nsIContent> mHScrollbarContent;
   nsCOMPtr<nsIContent> mVScrollbarContent;
@@ -323,6 +327,7 @@ public:
   nsRefPtr<AsyncScroll> mAsyncScroll;
   nsRefPtr<ScrollbarActivity> mScrollbarActivity;
   nsTArray<nsIScrollPositionListener*> mListeners;
+  nsIAtom* mOriginOfLastScroll;
   nsRect mScrollPort;
   // Where we're currently scrolling to, if we're scrolling asynchronously.
   // If we're not in the middle of an asynchronous scroll then this is
@@ -589,8 +594,9 @@ public:
   virtual void ScrollToCSSPixels(const CSSIntPoint& aScrollPosition) MOZ_OVERRIDE {
     mHelper.ScrollToCSSPixels(aScrollPosition);
   }
-  virtual void ScrollToCSSPixelsApproximate(const mozilla::CSSPoint& aScrollPosition) MOZ_OVERRIDE {
-    mHelper.ScrollToCSSPixelsApproximate(aScrollPosition);
+  virtual void ScrollToCSSPixelsApproximate(const mozilla::CSSPoint& aScrollPosition,
+                                            nsIAtom* aOrigin = nullptr) MOZ_OVERRIDE {
+    mHelper.ScrollToCSSPixelsApproximate(aScrollPosition, aOrigin);
   }
   /**
    * @note This method might destroy the frame, pres shell and other objects.
@@ -642,6 +648,12 @@ public:
   virtual bool IsRectNearlyVisible(const nsRect& aRect) MOZ_OVERRIDE {
     return mHelper.IsRectNearlyVisible(aRect);
   }
+  virtual nsIAtom* OriginOfLastScroll() MOZ_OVERRIDE {
+    return mHelper.OriginOfLastScroll();
+  }
+  virtual void ResetOriginOfLastScroll() MOZ_OVERRIDE {
+    mHelper.ResetOriginOfLastScroll();
+  }
 
   // nsIStatefulFrame
   NS_IMETHOD SaveState(nsPresState** aState) MOZ_OVERRIDE {
@@ -883,8 +895,9 @@ public:
   virtual void ScrollToCSSPixels(const CSSIntPoint& aScrollPosition) MOZ_OVERRIDE {
     mHelper.ScrollToCSSPixels(aScrollPosition);
   }
-  virtual void ScrollToCSSPixelsApproximate(const mozilla::CSSPoint& aScrollPosition) MOZ_OVERRIDE {
-    mHelper.ScrollToCSSPixelsApproximate(aScrollPosition);
+  virtual void ScrollToCSSPixelsApproximate(const mozilla::CSSPoint& aScrollPosition,
+                                            nsIAtom* aOrigin = nullptr) MOZ_OVERRIDE {
+    mHelper.ScrollToCSSPixelsApproximate(aScrollPosition, aOrigin);
   }
   virtual CSSIntPoint GetScrollPositionCSSPixels() MOZ_OVERRIDE {
     return mHelper.GetScrollPositionCSSPixels();
@@ -893,7 +906,7 @@ public:
    * @note This method might destroy the frame, pres shell and other objects.
    */
   virtual void ScrollBy(nsIntPoint aDelta, ScrollUnit aUnit, ScrollMode aMode,
-                        nsIntPoint* aOverflow, nsIAtom *aOrigin = nullptr) MOZ_OVERRIDE {
+                        nsIntPoint* aOverflow, nsIAtom* aOrigin = nullptr) MOZ_OVERRIDE {
     mHelper.ScrollBy(aDelta, aUnit, aMode, aOverflow, aOrigin);
   }
   /**
@@ -933,6 +946,12 @@ public:
   virtual bool IsRectNearlyVisible(const nsRect& aRect) MOZ_OVERRIDE {
     return mHelper.IsRectNearlyVisible(aRect);
   }
+  virtual nsIAtom* OriginOfLastScroll() MOZ_OVERRIDE {
+    return mHelper.OriginOfLastScroll();
+  }
+  virtual void ResetOriginOfLastScroll() MOZ_OVERRIDE {
+    mHelper.ResetOriginOfLastScroll();
+  }
 
   // nsIStatefulFrame
   NS_IMETHOD SaveState(nsPresState** aState) MOZ_OVERRIDE {
diff --git a/layout/generic/nsIScrollableFrame.h b/layout/generic/nsIScrollableFrame.h
index 62b4f2099090..ff05fa66de36 100644
--- a/layout/generic/nsIScrollableFrame.h
+++ b/layout/generic/nsIScrollableFrame.h
@@ -25,6 +25,7 @@ class nsIFrame;
 class nsPresContext;
 class nsIContent;
 class nsRenderingContext;
+class nsIAtom;
 
 /**
  * Interface for frames that are scrollable. This interface exposes
@@ -186,7 +187,8 @@ public:
    * number of layer pixels (so the operation is fast and looks clean).
    * The scroll mode is INSTANT.
    */
-  virtual void ScrollToCSSPixelsApproximate(const mozilla::CSSPoint& aScrollPosition) = 0;
+  virtual void ScrollToCSSPixelsApproximate(const mozilla::CSSPoint& aScrollPosition,
+                                            nsIAtom *aOrigin = nullptr) = 0;
 
   /**
    * Returns the scroll position in integer CSS pixels, rounded to the nearest
@@ -268,6 +270,15 @@ public:
    * visibility heuristics for how close it is to the visible scrollport.
    */
   virtual bool IsRectNearlyVisible(const nsRect& aRect) = 0;
+  /**
+   * Returns the origin passed in to the last ScrollToImpl call that took
+   * effect.
+   */
+  virtual nsIAtom* OriginOfLastScroll() = 0;
+  /**
+   * Clears the "origin of last scroll" property stored in this frame.
+   */
+  virtual void ResetOriginOfLastScroll() = 0;
 };
 
 #endif
diff --git a/layout/ipc/RenderFrameParent.cpp b/layout/ipc/RenderFrameParent.cpp
index ee407a9dd29c..9ccf806b7c38 100644
--- a/layout/ipc/RenderFrameParent.cpp
+++ b/layout/ipc/RenderFrameParent.cpp
@@ -1115,15 +1115,6 @@ RenderFrameParent::UpdateZoomConstraints(uint32_t aPresShellId,
   }
 }
 
-void
-RenderFrameParent::UpdateScrollOffset(uint32_t aPresShellId, ViewID aViewId, const CSSIntPoint& aScrollOffset)
-{
-  if (GetApzcTreeManager()) {
-    GetApzcTreeManager()->UpdateScrollOffset(ScrollableLayerGuid(mLayersId, aPresShellId, aViewId),
-                                             aScrollOffset);
-  }
-}
-
 bool
 RenderFrameParent::HitTest(const nsRect& aRect)
 {
diff --git a/layout/ipc/RenderFrameParent.h b/layout/ipc/RenderFrameParent.h
index b2914dfdea53..dfe07768f4d5 100644
--- a/layout/ipc/RenderFrameParent.h
+++ b/layout/ipc/RenderFrameParent.h
@@ -124,10 +124,6 @@ public:
                              const CSSToScreenScale& aMinZoom,
                              const CSSToScreenScale& aMaxZoom);
 
-  void UpdateScrollOffset(uint32_t aPresShellId,
-                          ViewID aViewId,
-                          const CSSIntPoint& aScrollOffset);
-
   bool HitTest(const nsRect& aRect);
 
 protected:
diff --git a/mobile/android/base/gfx/GeckoLayerClient.java b/mobile/android/base/gfx/GeckoLayerClient.java
index f7976c2be5be..a13fe9be37dc 100644
--- a/mobile/android/base/gfx/GeckoLayerClient.java
+++ b/mobile/android/base/gfx/GeckoLayerClient.java
@@ -383,9 +383,6 @@ public class GeckoLayerClient implements LayerView.Listener, PanZoomTarget
                 if (!oldMetrics.fuzzyEquals(newMetrics)) {
                     abortPanZoomAnimation();
                 }
-                mPanZoomController.updateScrollOffset(
-                		messageMetrics.viewportRectLeft / messageMetrics.zoomFactor,
-                		messageMetrics.viewportRectTop / messageMetrics.zoomFactor);
                 break;
             case PAGE_SIZE:
                 // adjust the page dimensions to account for differences in zoom
diff --git a/mobile/android/base/gfx/JavaPanZoomController.java b/mobile/android/base/gfx/JavaPanZoomController.java
index a2380d2ec025..f233516034eb 100644
--- a/mobile/android/base/gfx/JavaPanZoomController.java
+++ b/mobile/android/base/gfx/JavaPanZoomController.java
@@ -1457,11 +1457,6 @@ class JavaPanZoomController
         return mX.getOverScrollMode();
     }
 
-    @Override
-    public void updateScrollOffset(float cssX, float cssY) {
-        // Nothing to update, this class doesn't store the scroll offset locally.
-    }
-
     @Override
     public void setOverscrollHandler(final Overscroll handler) {
         mOverscroll = handler;
diff --git a/mobile/android/base/gfx/NativePanZoomController.java b/mobile/android/base/gfx/NativePanZoomController.java
index 22da11f5fa69..b85c27b9e66d 100644
--- a/mobile/android/base/gfx/NativePanZoomController.java
+++ b/mobile/android/base/gfx/NativePanZoomController.java
@@ -103,8 +103,6 @@ class NativePanZoomController implements PanZoomController, GeckoEventListener {
         }
     }
 
-    public native void updateScrollOffset(float cssX, float cssY);
-
     public void setOverscrollHandler(final Overscroll listener) {
     }
 }
diff --git a/mobile/android/base/gfx/PanZoomController.java b/mobile/android/base/gfx/PanZoomController.java
index d34aef33ef87..5257c7e38f96 100644
--- a/mobile/android/base/gfx/PanZoomController.java
+++ b/mobile/android/base/gfx/PanZoomController.java
@@ -44,7 +44,5 @@ public interface PanZoomController {
     public void setOverScrollMode(int overscrollMode);
     public int getOverScrollMode();
 
-    public void updateScrollOffset(float cssX, float cssY);
-
     public void setOverscrollHandler(final Overscroll controller);
 }
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index 0cac8da20f10..a12975b033e0 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -3131,29 +3131,20 @@ Tab.prototype = {
     let screenWidth = gScreenWidth;
     let screenHeight = gScreenHeight;
 
-    let [pageWidth, pageHeight] = this.getPageSize(this.browser.contentDocument,
-                                                   viewportWidth, viewportHeight);
-
-    // Check if the page would fit into either of the viewport dimensions minus
-    // the margins and shrink the screen size accordingly so that the aspect
-    // ratio calculation below works correctly in these situations.
-    // We take away the margin size over two to account for rounding errors,
-    // as the browser size set in updateViewportSize doesn't allow for any
-    // size between these two values (and thus anything between them is
-    // attributable to rounding error).
-    if ((pageHeight * zoom) < gScreenHeight - (gViewportMargins.top + gViewportMargins.bottom) / 2) {
+    // Shrink the viewport appropriately if the margins are excluded
+    if (this.viewportExcludesVerticalMargins) {
       screenHeight = gScreenHeight - gViewportMargins.top - gViewportMargins.bottom;
       viewportHeight = screenHeight / zoom;
     }
-    if ((pageWidth * zoom) < gScreenWidth - (gViewportMargins.left + gViewportMargins.right) / 2) {
+    if (this.viewportExcludesHorizontalMargins) {
       screenWidth = gScreenWidth - gViewportMargins.left - gViewportMargins.right;
       viewportWidth = screenWidth / zoom;
     }
 
     // Make sure the aspect ratio of the screen is maintained when setting
     // the clamping scroll-port size.
-    let factor = Math.min(viewportWidth / screenWidth, pageWidth / screenWidth,
-                          viewportHeight / screenHeight, pageHeight / screenHeight);
+    let factor = Math.min(viewportWidth / screenWidth,
+                          viewportHeight / screenHeight);
     let scrollPortWidth = screenWidth * factor;
     let scrollPortHeight = screenHeight * factor;
 
@@ -3971,8 +3962,6 @@ Tab.prototype = {
     let screenW = gScreenWidth - gViewportMargins.left - gViewportMargins.right;
     let screenH = gScreenHeight - gViewportMargins.top - gViewportMargins.bottom;
     let viewportW, viewportH;
-    this.viewportExcludesHorizontalMargins = true;
-    this.viewportExcludesVerticalMargins = true;
 
     let metadata = this.metadata;
     if (metadata.autoSize) {
@@ -4006,6 +3995,23 @@ Tab.prototype = {
     let oldBrowserWidth = this.browserWidth;
     this.setBrowserSize(viewportW, viewportH);
 
+    // This change to the zoom accounts for all types of changes I can conceive:
+    // 1. screen size changes, CSS viewport does not (pages with no meta viewport
+    //    or a fixed size viewport)
+    // 2. screen size changes, CSS viewport also does (pages with a device-width
+    //    viewport)
+    // 3. screen size remains constant, but CSS viewport changes (meta viewport
+    //    tag is added or removed)
+    // 4. neither screen size nor CSS viewport changes
+    //
+    // In all of these cases, we maintain how much actual content is visible
+    // within the screen width. Note that "actual content" may be different
+    // with respect to CSS pixels because of the CSS viewport size changing.
+    let zoomScale = (screenW * oldBrowserWidth) / (aOldScreenWidth * viewportW);
+    let zoom = (aInitialLoad && metadata.defaultZoom) ? metadata.defaultZoom : this.clampZoom(this._zoom * zoomScale);
+    this.setResolution(zoom, false);
+    this.setScrollClampingSize(zoom);
+
     // if this page has not been painted yet, then this must be getting run
     // because a meta-viewport element was added (via the DOMMetaAdded handler).
     // in this case, we should not do anything that forces a reflow (see bug 759678)
@@ -4018,6 +4024,8 @@ Tab.prototype = {
       return;
     }
 
+    this.viewportExcludesHorizontalMargins = true;
+    this.viewportExcludesVerticalMargins = true;
     let minScale = 1.0;
     if (this.browser.contentDocument) {
       // this may get run during a Viewport:Change message while the document
@@ -4040,29 +4048,20 @@ Tab.prototype = {
     }
     minScale = this.clampZoom(minScale);
     viewportH = Math.max(viewportH, screenH / minScale);
+
+    // In general we want to keep calls to setBrowserSize and setScrollClampingSize
+    // together because setBrowserSize could mark the viewport size as dirty, creating
+    // a pending resize event for content. If that resize gets dispatched (which happens
+    // on the next reflow) without setScrollClampingSize having being called, then
+    // content might be exposed to incorrect innerWidth/innerHeight values.
     this.setBrowserSize(viewportW, viewportH);
+    this.setScrollClampingSize(zoom);
 
     // Avoid having the scroll position jump around after device rotation.
     let win = this.browser.contentWindow;
     this.userScrollPos.x = win.scrollX;
     this.userScrollPos.y = win.scrollY;
 
-    // This change to the zoom accounts for all types of changes I can conceive:
-    // 1. screen size changes, CSS viewport does not (pages with no meta viewport
-    //    or a fixed size viewport)
-    // 2. screen size changes, CSS viewport also does (pages with a device-width
-    //    viewport)
-    // 3. screen size remains constant, but CSS viewport changes (meta viewport
-    //    tag is added or removed)
-    // 4. neither screen size nor CSS viewport changes
-    //
-    // In all of these cases, we maintain how much actual content is visible
-    // within the screen width. Note that "actual content" may be different
-    // with respect to CSS pixels because of the CSS viewport size changing.
-    let zoomScale = (screenW * oldBrowserWidth) / (aOldScreenWidth * viewportW);
-    let zoom = (aInitialLoad && metadata.defaultZoom) ? metadata.defaultZoom : this.clampZoom(this._zoom * zoomScale);
-    this.setResolution(zoom, false);
-    this.setScrollClampingSize(zoom);
     this.sendViewportUpdate();
 
     // Store the page size that was used to calculate the viewport so that we
diff --git a/mozglue/android/jni-stubs.inc b/mozglue/android/jni-stubs.inc
index 019a15f583b7..ea1533ca5b1a 100644
--- a/mozglue/android/jni-stubs.inc
+++ b/mozglue/android/jni-stubs.inc
@@ -533,25 +533,6 @@ Java_org_mozilla_gecko_gfx_NativePanZoomController_getOverScrollMode(JNIEnv * ar
 
 #ifdef JNI_STUBS
 
-typedef void (*Java_org_mozilla_gecko_gfx_NativePanZoomController_updateScrollOffset_t)(JNIEnv *, jobject, jfloat, jfloat);
-static Java_org_mozilla_gecko_gfx_NativePanZoomController_updateScrollOffset_t f_Java_org_mozilla_gecko_gfx_NativePanZoomController_updateScrollOffset;
-extern "C" NS_EXPORT void JNICALL
-Java_org_mozilla_gecko_gfx_NativePanZoomController_updateScrollOffset(JNIEnv * arg0, jobject arg1, jfloat arg2, jfloat arg3) {
-    if (!f_Java_org_mozilla_gecko_gfx_NativePanZoomController_updateScrollOffset) {
-        arg0->ThrowNew(arg0->FindClass("java/lang/UnsupportedOperationException"),
-                       "JNI Function called before it was loaded");
-        return ;
-    }
-     f_Java_org_mozilla_gecko_gfx_NativePanZoomController_updateScrollOffset(arg0, arg1, arg2, arg3);
-}
-#endif
-
-#ifdef JNI_BINDINGS
-  xul_dlsym("Java_org_mozilla_gecko_gfx_NativePanZoomController_updateScrollOffset", &f_Java_org_mozilla_gecko_gfx_NativePanZoomController_updateScrollOffset);
-#endif
-
-#ifdef JNI_STUBS
-
 typedef jboolean (*Java_org_mozilla_gecko_ANRReporter_requestNativeStack_t)(JNIEnv *, jclass);
 static Java_org_mozilla_gecko_ANRReporter_requestNativeStack_t f_Java_org_mozilla_gecko_ANRReporter_requestNativeStack;
 extern "C" NS_EXPORT jboolean JNICALL
diff --git a/toolkit/devtools/server/actors/styles.js b/toolkit/devtools/server/actors/styles.js
index a6494852e9f1..fa2223da04f3 100644
--- a/toolkit/devtools/server/actors/styles.js
+++ b/toolkit/devtools/server/actors/styles.js
@@ -666,10 +666,16 @@ var StyleRuleActor = protocol.ActorClass({
     if (this.rawNode) {
       document = this.rawNode.ownerDocument;
     } else {
-      if (this.rawRule.parentStyleSheet.ownerNode instanceof Ci.nsIDOMHTMLDocument) {
-        document = this.rawRule.parentStyleSheet.ownerNode;
+      let parentStyleSheet = this.rawRule.parentStyleSheet;
+      while (parentStyleSheet.ownerRule &&
+          parentStyleSheet.ownerRule instanceof Ci.nsIDOMCSSImportRule) {
+        parentStyleSheet = parentStyleSheet.ownerRule.parentStyleSheet;
+      }
+
+      if (parentStyleSheet.ownerNode instanceof Ci.nsIDOMHTMLDocument) {
+        document = parentStyleSheet.ownerNode;
       } else {
-        document = this.rawRule.parentStyleSheet.ownerNode.ownerDocument;
+        document = parentStyleSheet.ownerNode.ownerDocument;
       }
     }
 
diff --git a/widget/android/AndroidJNI.cpp b/widget/android/AndroidJNI.cpp
index ab67fc14d822..77db5c20a7a2 100644
--- a/widget/android/AndroidJNI.cpp
+++ b/widget/android/AndroidJNI.cpp
@@ -949,16 +949,6 @@ Java_org_mozilla_gecko_gfx_NativePanZoomController_getOverScrollMode(JNIEnv* env
     return 0;
 }
 
-NS_EXPORT void JNICALL
-Java_org_mozilla_gecko_gfx_NativePanZoomController_updateScrollOffset(JNIEnv* env, jobject instance, jfloat cssX, jfloat cssY)
-{
-    APZCTreeManager *controller = nsWindow::GetAPZCTreeManager();
-    if (controller) {
-        // TODO: Pass in correct values for presShellId and viewId.
-        controller->UpdateScrollOffset(ScrollableLayerGuid(nsWindow::RootLayerTreeId(), 0, 0), CSSPoint(cssX, cssY));
-    }
-}
-
 NS_EXPORT jboolean JNICALL
 Java_org_mozilla_gecko_ANRReporter_requestNativeStack(JNIEnv*, jclass)
 {
diff --git a/widget/windows/winrt/APZController.cpp b/widget/windows/winrt/APZController.cpp
index f50dcd3c662a..bda3d791cbc1 100644
--- a/widget/windows/winrt/APZController.cpp
+++ b/widget/windows/winrt/APZController.cpp
@@ -83,17 +83,12 @@ GetDOMTargets(uint64_t aScrollId,
 class RequestContentRepaintEvent : public nsRunnable
 {
   typedef mozilla::layers::FrameMetrics FrameMetrics;
-  typedef mozilla::layers::ScrollableLayerGuid ScrollableLayerGuid;
 
 public:
   RequestContentRepaintEvent(const FrameMetrics& aFrameMetrics,
-                             nsIWidgetListener* aListener,
-                             CSSIntPoint* aLastOffsetOut,
-                             ScrollableLayerGuid* aLastScrollId) :
+                             nsIWidgetListener* aListener) :
     mFrameMetrics(aFrameMetrics),
-    mWidgetListener(aListener),
-    mLastOffsetOut(aLastOffsetOut),
-    mLastScrollIdOut(aLastScrollId)
+    mWidgetListener(aListener)
   {
   }
 
@@ -135,16 +130,6 @@ public:
       if (utils) {
         APZCCallbackHelper::UpdateRootFrame(utils, mFrameMetrics);
 
-        // Return the actual scroll value so we can use it to filter
-        // out scroll messages triggered by setting the display port.
-        if (mLastOffsetOut) {
-          *mLastOffsetOut = mozilla::gfx::RoundedToInt(mFrameMetrics.mScrollOffset);
-        }
-        if (mLastScrollIdOut) {
-          mLastScrollIdOut->mScrollId = mFrameMetrics.mScrollId;
-          mLastScrollIdOut->mPresShellId = mFrameMetrics.mPresShellId;
-        }
-
 #ifdef DEBUG_CONTROLLER
         WinUtils::Log("APZController: %I64d mDisplayPort: %0.2f %0.2f %0.2f %0.2f",
           mFrameMetrics.mScrollId,
@@ -160,8 +145,6 @@ public:
 protected:
   FrameMetrics mFrameMetrics;
   nsIWidgetListener* mWidgetListener;
-  CSSIntPoint* mLastOffsetOut;
-  ScrollableLayerGuid* mLastScrollIdOut;
 };
 
 void
@@ -241,9 +224,7 @@ APZController::RequestContentRepaint(const FrameMetrics& aFrameMetrics)
     aFrameMetrics.mScrollId);
 #endif
   nsCOMPtr<nsIRunnable> r1 = new RequestContentRepaintEvent(aFrameMetrics,
-                                                            mWidgetListener,
-                                                            &mLastScrollOffset,
-                                                            &mLastScrollLayerGuid);
+                                                            mWidgetListener);
   if (!NS_IsMainThread()) {
     NS_DispatchToMainThread(r1);
   } else {
@@ -251,33 +232,6 @@ APZController::RequestContentRepaint(const FrameMetrics& aFrameMetrics)
   }
 }
 
-// Content send us this when it detect content has scrolled via
-// a dom scroll event. Note we get these in response to dom scroll
-// events and as a result of apzc scrolling which we filter out.
-void
-APZController::UpdateScrollOffset(const mozilla::layers::ScrollableLayerGuid& aScrollLayerId,
-                                  CSSIntPoint& aScrollOffset)
-{
-#ifdef DEBUG_CONTROLLER
-  WinUtils::Log("APZController::UpdateScrollOffset: scrollid:%I64d == %I64d offsets: %d,%d == %d,%d",
-    aScrollLayerId.mScrollId, aScrollLayerId.mScrollId,
-    aScrollOffset.x, aScrollOffset.y,
-    mLastScrollOffset.x, mLastScrollOffset.y);
-#endif
-
-  // Bail if this the same scroll guid the apzc just scrolled and the offsets
-  // equal the offset the apzc set.
-  if (!sAPZC || (mLastScrollLayerGuid.mScrollId == aScrollLayerId.mScrollId &&
-                 mLastScrollLayerGuid.mPresShellId == aScrollLayerId.mPresShellId &&
-                 mLastScrollOffset == aScrollOffset)) {
-#ifdef DEBUG_CONTROLLER
-    WinUtils::Log("Skipping UpdateScrollOffset");
-#endif
-    return;
-  }
-  sAPZC->UpdateScrollOffset(aScrollLayerId, aScrollOffset);
-}
-
 void
 APZController::HandleDoubleTap(const CSSIntPoint& aPoint, int32_t aModifiers)
 {
diff --git a/widget/windows/winrt/APZController.h b/widget/windows/winrt/APZController.h
index f6c36bb635b8..418e251db8cf 100644
--- a/widget/windows/winrt/APZController.h
+++ b/widget/windows/winrt/APZController.h
@@ -42,7 +42,6 @@ public:
   virtual void NotifyTransformEnd(const ScrollableLayerGuid& aGuid);
   
   void SetWidgetListener(nsIWidgetListener* aWidgetListener);
-  void UpdateScrollOffset(const mozilla::layers::ScrollableLayerGuid& aScrollLayerId, CSSIntPoint& aScrollOffset);
 
   bool HitTestAPZC(mozilla::ScreenIntPoint& aPoint);
   void TransformCoordinateToGecko(const mozilla::ScreenIntPoint& aPoint,
@@ -60,8 +59,6 @@ public:
 
 private:
   nsIWidgetListener* mWidgetListener;
-  ScrollableLayerGuid mLastScrollLayerGuid;
-  CSSIntPoint mLastScrollOffset;
 };
 
 } } }
diff --git a/widget/windows/winrt/MetroWidget.cpp b/widget/windows/winrt/MetroWidget.cpp
index deeb3f7a02d9..409a54ea63e6 100644
--- a/widget/windows/winrt/MetroWidget.cpp
+++ b/widget/windows/winrt/MetroWidget.cpp
@@ -1589,27 +1589,7 @@ NS_IMETHODIMP
 MetroWidget::Observe(nsISupports *subject, const char *topic, const PRUnichar *data)
 {
   NS_ENSURE_ARG_POINTER(topic);
-  if (!strcmp(topic, "apzc-scroll-offset-changed")) {
-    uint64_t scrollId;
-    int32_t presShellId;
-    CSSIntPoint scrollOffset;
-    int matched = sscanf(NS_LossyConvertUTF16toASCII(data).get(),
-                         "%llu %d (%d, %d)",
-                         &scrollId,
-                         &presShellId,
-                         &scrollOffset.x,
-                         &scrollOffset.y);
-    if (matched != 4) {
-      NS_WARNING("Malformed scroll-offset-changed message");
-      return NS_ERROR_UNEXPECTED;
-    }
-    if (!mController) {
-      return NS_ERROR_UNEXPECTED;
-    }
-    mController->UpdateScrollOffset(ScrollableLayerGuid(mRootLayerTreeId, presShellId, scrollId),
-                                    scrollOffset);
-  }
-  else if (!strcmp(topic, "apzc-zoom-to-rect")) {
+  if (!strcmp(topic, "apzc-zoom-to-rect")) {
     CSSRect rect = CSSRect();
     uint64_t viewId = 0;
     int32_t presShellId = 0;
diff --git a/widget/xpwidgets/APZCCallbackHelper.cpp b/widget/xpwidgets/APZCCallbackHelper.cpp
index 3ea68570101c..112fab6e637e 100644
--- a/widget/xpwidgets/APZCCallbackHelper.cpp
+++ b/widget/xpwidgets/APZCCallbackHelper.cpp
@@ -84,6 +84,25 @@ MaybeAlignAndClampDisplayPort(mozilla::layers::FrameMetrics& aFrameMetrics,
     - aActualScrollOffset;
 }
 
+static CSSPoint
+ScrollFrameTo(nsIScrollableFrame* aFrame, const CSSPoint& aPoint)
+{
+  if (!aFrame) {
+    return CSSPoint();
+  }
+
+  // If the scrollable frame got a scroll request from something other than us
+  // since the last layers update, then we don't want to push our scroll request
+  // because we'll clobber that one, which is bad.
+  if (!aFrame->OriginOfLastScroll() || aFrame->OriginOfLastScroll() == nsGkAtoms::apz) {
+    aFrame->ScrollToCSSPixelsApproximate(aPoint, nsGkAtoms::apz);
+  }
+  // Return the final scroll position after setting it so that anything that relies
+  // on it can have an accurate value. Note that even if we set it above re-querying it
+  // is a good idea because it may have gotten clamped or rounded.
+  return CSSPoint::FromAppUnits(aFrame->GetScrollPosition());
+}
+
 void
 APZCCallbackHelper::UpdateRootFrame(nsIDOMWindowUtils* aUtils,
                                     FrameMetrics& aMetrics)
@@ -105,12 +124,8 @@ APZCCallbackHelper::UpdateRootFrame(nsIDOMWindowUtils* aUtils,
     aUtils->SetScrollPositionClampingScrollPortSize(scrollPort.width, scrollPort.height);
 
     // Scroll the window to the desired spot
-    aUtils->ScrollToCSSPixelsApproximate(aMetrics.mScrollOffset.x, aMetrics.mScrollOffset.y, nullptr);
-
-    // Re-query the scroll position after setting it so that anything that relies on it
-    // can have an accurate value.
-    CSSPoint actualScrollOffset;
-    aUtils->GetScrollXYFloat(false, &actualScrollOffset.x, &actualScrollOffset.y);
+    nsIScrollableFrame* sf = nsLayoutUtils::FindScrollableFrameFor(aMetrics.mScrollId);
+    CSSPoint actualScrollOffset = ScrollFrameTo(sf, aMetrics.mScrollOffset);
 
     // Correct the display port due to the difference between mScrollOffset and the
     // actual scroll offset, possibly align it to tile boundaries (if tiled layers are
@@ -167,12 +182,8 @@ APZCCallbackHelper::UpdateSubFrame(nsIContent* aContent,
     // We currently do not support zooming arbitrary subframes. They can only
     // be scrolled, so here we only have to set the scroll position and displayport.
 
-    CSSPoint actualScrollOffset;
     nsIScrollableFrame* sf = nsLayoutUtils::FindScrollableFrameFor(aMetrics.mScrollId);
-    if (sf) {
-        sf->ScrollToCSSPixelsApproximate(aMetrics.mScrollOffset);
-        actualScrollOffset = CSSPoint::FromAppUnits(sf->GetScrollPosition());
-    }
+    CSSPoint actualScrollOffset = ScrollFrameTo(sf, aMetrics.mScrollOffset);
 
     nsCOMPtr<nsIDOMElement> element = do_QueryInterface(aContent);
     if (element) {