From 7e1725735947b7dbdbed08e9c8831e4f21f5c7c1 Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Sun, 16 Jun 2013 11:15:17 -0400
Subject: [PATCH 01/75] Bug 883314 part 1: simplify code, r=jmaher

--HG--
extra : transplant_source : J%AA%8D%F0%3B%AFi%00%18i%ABY%A0%24E%C6Ok%E4T
---
 testing/mochitest/browser-harness.xul |  2 +-
 testing/mochitest/chrome-harness.js   | 25 +++++++++++--------------
 testing/mochitest/harness-overlay.xul |  2 +-
 3 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/testing/mochitest/browser-harness.xul b/testing/mochitest/browser-harness.xul
index 0583cf33cb0a..6948cc43d016 100644
--- a/testing/mochitest/browser-harness.xul
+++ b/testing/mochitest/browser-harness.xul
@@ -164,7 +164,7 @@
 
     // Returns an array of browserTest objects for all the selected tests
     function listTests() {
-      [links, singleTestPath] = getTestList();
+      var links = getTestList();
       if (!links)
         return [];
 
diff --git a/testing/mochitest/chrome-harness.js b/testing/mochitest/chrome-harness.js
index 11cc61928fe9..6e94b7bbd48e 100644
--- a/testing/mochitest/chrome-harness.js
+++ b/testing/mochitest/chrome-harness.js
@@ -82,7 +82,6 @@ function getMochitestJarListing(aBasePath, aTestPath, aDir)
 
   var base = "content/" + aDir + "/";
 
-  var singleTestPath;
   if (aTestPath) {
     var extraPath = aTestPath;
     var pathToCheck = base + aTestPath;
@@ -91,21 +90,21 @@ function getMochitestJarListing(aBasePath, aTestPath, aDir)
       if (pathEntry.isDirectory) {
         base = pathToCheck;
       } else {
-        singleTestPath = basePath + '/' + base + aTestPath;
+        var singleTestPath = basePath + '/' + base + aTestPath;
         var singleObject = {};
         singleObject[singleTestPath] = true;
-        return [singleObject, singleTestPath];
+        return singleObject;
       }
     }
     else if (zReader.hasEntry(pathToCheck + "/")) {
       base = pathToCheck + "/";
     }
     else {
-      return [];
+      return null;
     }
   }
   var [links, count] = zList(base, zReader, basePath, true);
-  return [links, null];
+  return links;
 }
 
 /*
@@ -172,7 +171,6 @@ function getFileListing(basePath, testPath, dir, srvScope)
   var testsDir = ioSvc.newURI(testPath, null, testsDirURI)
                   .QueryInterface(Components.interfaces.nsIFileURL).file;
 
-  var singleTestPath;
   if (testPath != undefined) {
     var extraPath = testPath;
     
@@ -180,24 +178,24 @@ function getFileListing(basePath, testPath, dir, srvScope)
 
     // Invalid testPath...
     if (!testsDir.exists())
-      return [];
+      return null;
 
     if (testsDir.isFile()) {
       if (fileNameRegexp.test(testsDir.leafName))
         var singlePath = basePath + '/' + testPath;
         var links = {};
         links[singlePath] = true;
-        return [links, null];
+        return links;
 
       // We were passed a file that's not a test...
-      return [];
+      return null;
     }
 
     // otherwise, we were passed a directory of tests
     basePath += "/" + testPath;
   }
   var [links, count] = srvScope.list(basePath, testsDir, true);
-  return [links, null];
+  return links;
 }
 
 
@@ -379,13 +377,12 @@ function getTestList() {
   var srvScope = {};
   scriptLoader.loadSubScript('chrome://mochikit/content/server.js',
                              srvScope);
-  var singleTestPath;
   var links;
 
   if (getResolvedURI(baseurl).JARFile) {
-    [links, singleTestPath] = getMochitestJarListing(baseurl, params.testPath, params.testRoot);
+    links = getMochitestJarListing(baseurl, params.testPath, params.testRoot);
   } else {
-    [links, singleTestPath] = getFileListing(baseurl, params.testPath, params.testRoot, srvScope);
+    links = getFileListing(baseurl, params.testPath, params.testRoot, srvScope);
   }
-  return [links, singleTestPath];
+  return links;
 }
diff --git a/testing/mochitest/harness-overlay.xul b/testing/mochitest/harness-overlay.xul
index d2c7e20ec21b..dce17443c31d 100644
--- a/testing/mochitest/harness-overlay.xul
+++ b/testing/mochitest/harness-overlay.xul
@@ -35,7 +35,7 @@ if (Cc === undefined) {
 function loadTests()
 {
   window.removeEventListener("load", loadTests, false);
-  [links, singleTestPath] = getTestList();
+  links = getTestList();
  
   // load server.js in so we can share template functions
   var scriptLoader = Cc["@mozilla.org/moz/jssubscript-loader;1"].

From 30fa51a97b50cf91ac2f935f4fd2497970cc5195 Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Sun, 16 Jun 2013 11:19:47 -0400
Subject: [PATCH 02/75] Bug 883314 part 2: refactor mochitest chunking code to
 be re-used for mochitest-browser-chrome, r=jmaher

--HG--
extra : transplant_source : %0A%C3%7F%B7%CFL%AD%2C%A2Y%5D51%AF%19%C1%C8%C5%5B%07
---
 testing/mochitest/Makefile.in               |  1 +
 testing/mochitest/chunkifyTests.js          | 59 +++++++++++++++++++++
 testing/mochitest/jar.mn                    |  1 +
 testing/mochitest/server.js                 |  2 +
 testing/mochitest/tests/SimpleTest/setup.js | 50 +----------------
 5 files changed, 65 insertions(+), 48 deletions(-)
 create mode 100644 testing/mochitest/chunkifyTests.js

diff --git a/testing/mochitest/Makefile.in b/testing/mochitest/Makefile.in
index 5eae31211809..6a8f7690a96c 100644
--- a/testing/mochitest/Makefile.in
+++ b/testing/mochitest/Makefile.in
@@ -48,6 +48,7 @@ _SERV_FILES = 	\
 		$(topsrcdir)/build/mobile/b2gautomation.py \
 		gen_template.pl \
 		server.js \
+		chunkifyTests.js \
 		harness-overlay.xul \
 		harness.xul \
 		browser-test-overlay.xul \
diff --git a/testing/mochitest/chunkifyTests.js b/testing/mochitest/chunkifyTests.js
new file mode 100644
index 000000000000..ad1171a5ed68
--- /dev/null
+++ b/testing/mochitest/chunkifyTests.js
@@ -0,0 +1,59 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+function chunkifyTests(tests, totalChunks, thisChunk, chunkByDir, logger) {
+  var total_chunks = parseInt(totalChunks);
+  // this_chunk is in the range [1,total_chunks]
+  var this_chunk = parseInt(thisChunk);
+  var returnTests;
+
+  // We want to split the tests up into chunks according to which directory
+  // they're in
+  if (chunkByDir) {
+    chunkByDir = parseInt(chunkByDir);
+    var tests_by_dir = {};
+    var test_dirs = []
+    for (var i = 0; i < tests.length; ++i) {
+      var test_path = tests[i];
+      if (test_path[0] == '/') {
+        test_path = test_path.substr(1);
+      }
+      var dir = test_path.split("/");
+      // We want the first chunkByDir+1 components, or everything but the
+      // last component, whichever is less.
+      // we add 1 to chunkByDir since 'tests' is always part of the path, and
+      // want to ignore the last component since it's the test filename.
+      dir = dir.slice(0, Math.min(chunkByDir+1, dir.length-1));
+      // reconstruct a directory name
+      dir = dir.join("/");
+      if (!(dir in tests_by_dir)) {
+        tests_by_dir[dir] = [tests[i]];
+        test_dirs.push(dir);
+      } else {
+        tests_by_dir[dir].push(tests[i]);
+      }
+    }
+    var tests_per_chunk = test_dirs.length / total_chunks;
+    var start = Math.round((this_chunk-1) * tests_per_chunk);
+    var end = Math.round(this_chunk * tests_per_chunk);
+    returnTests = [];
+    var dirs = []
+    for (var i = start; i < end; ++i) {
+      var dir = test_dirs[i];
+      dirs.push(dir);
+      returnTests = returnTests.concat(tests_by_dir[dir]);
+    }
+    if (logger)
+      logger.log("Running tests in " + dirs.join(", "));
+  } else {
+    var tests_per_chunk = tests.length / total_chunks;
+    var start = Math.round((this_chunk-1) * tests_per_chunk);
+    var end = Math.round(this_chunk * tests_per_chunk);
+    returnTests = tests.slice(start, end);
+    if (logger)
+      logger.log("Running tests " + (start+1) + "-" + end + "/" + tests.length);
+  }
+
+  return returnTests;
+}
diff --git a/testing/mochitest/jar.mn b/testing/mochitest/jar.mn
index 742c04d483da..794762eb1c8c 100644
--- a/testing/mochitest/jar.mn
+++ b/testing/mochitest/jar.mn
@@ -9,6 +9,7 @@ mochikit.jar:
   content/harness.xul (harness.xul)
   content/redirect.html (redirect.html)
   content/server.js (server.js)
+  content/chunkifyTests.js (chunkifyTests.js)
   content/dynamic/getMyDirectory.sjs (dynamic/getMyDirectory.sjs)
   content/static/harness.css (static/harness.css)
   content/tests/SimpleTest/ChromePowers.js (tests/SimpleTest/ChromePowers.js)
diff --git a/testing/mochitest/server.js b/testing/mochitest/server.js
index c935a7b8c2b1..2f2b33e8dcf7 100644
--- a/testing/mochitest/server.js
+++ b/testing/mochitest/server.js
@@ -604,6 +604,8 @@ function testListing(metadata, response)
                  src: "/tests/SimpleTest/TestRunner.js"}),
         SCRIPT({type: "text/javascript",
                  src: "/tests/SimpleTest/MozillaLogger.js"}),
+        SCRIPT({type: "text/javascript",
+                 src: "/chunkifyTests.js"}),
         SCRIPT({type: "text/javascript",
                  src: "/tests/SimpleTest/setup.js"}),
         SCRIPT({type: "text/javascript"},
diff --git a/testing/mochitest/tests/SimpleTest/setup.js b/testing/mochitest/tests/SimpleTest/setup.js
index 2057c3900f08..543f36a30622 100644
--- a/testing/mochitest/tests/SimpleTest/setup.js
+++ b/testing/mochitest/tests/SimpleTest/setup.js
@@ -125,55 +125,9 @@ RunSet.runall = function(e) {
   var my_tests = gTestList;
 
   if (params.totalChunks && params.thisChunk) {
-    var total_chunks = parseInt(params.totalChunks);
-    // this_chunk is in the range [1,total_chunks]
-    var this_chunk = parseInt(params.thisChunk);
-
-    // We want to split the tests up into chunks according to which directory
-    // they're in
-    if (params.chunkByDir) {
-      var chunkByDir = parseInt(params.chunkByDir);
-      var tests_by_dir = {};
-      var test_dirs = []
-      for (var i = 0; i < gTestList.length; ++i) {
-        var test_path = gTestList[i];
-        if (test_path[0] == '/') {
-          test_path = test_path.substr(1);
-        }
-        var dir = test_path.split("/");
-        // We want the first chunkByDir+1 components, or everything but the
-        // last component, whichever is less.
-        // we add 1 to chunkByDir since 'tests' is always part of the path, and
-        // want to ignore the last component since it's the test filename.
-        dir = dir.slice(0, Math.min(chunkByDir+1, dir.length-1));
-        // reconstruct a directory name
-        dir = dir.join("/");
-        if (!(dir in tests_by_dir)) {
-          tests_by_dir[dir] = [gTestList[i]];
-          test_dirs.push(dir);
-        } else {
-          tests_by_dir[dir].push(gTestList[i]);
-        }
-      }
-      var tests_per_chunk = test_dirs.length / total_chunks;
-      var start = Math.round((this_chunk-1) * tests_per_chunk);
-      var end = Math.round(this_chunk * tests_per_chunk);
-      my_tests = [];
-      var dirs = []
-      for (var i = start; i < end; ++i) {
-        var dir = test_dirs[i];
-        dirs.push(dir);
-        my_tests = my_tests.concat(tests_by_dir[dir]);
-      }
-      TestRunner.logger.log("Running tests in " + dirs.join(", "));
-    } else {
-      var tests_per_chunk = gTestList.length / total_chunks;
-      var start = Math.round((this_chunk-1) * tests_per_chunk);
-      var end = Math.round(this_chunk * tests_per_chunk);
-      my_tests = gTestList.slice(start, end);
-      TestRunner.logger.log("Running tests " + (start+1) + "-" + end + "/" + gTestList.length);
-    }
+    my_tests = chunkifyTests(my_tests, params.totalChunks, params.thisChunk, params.chunkByDir, TestRunner.logger);
   }
+
   if (params.shuffle) {
     for (var i = my_tests.length-1; i > 0; --i) {
       var j = Math.floor(Math.random() * i);

From 102d8be2b6a0dfed109d29f75e8a9debeb55cc74 Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Sun, 16 Jun 2013 11:22:48 -0400
Subject: [PATCH 03/75] Bug 883314 part 3: adjust refactored chunking code to
 deal with mochitest-browser-chrome and mochitest-chrome file paths, r=jmaher

--HG--
extra : transplant_source : %ED%E7%ED%EEs%C5.%A0%FE%3ECEI60%A4h%C2%11Y
---
 testing/mochitest/chunkifyTests.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/testing/mochitest/chunkifyTests.js b/testing/mochitest/chunkifyTests.js
index ad1171a5ed68..5a36a068a8bf 100644
--- a/testing/mochitest/chunkifyTests.js
+++ b/testing/mochitest/chunkifyTests.js
@@ -19,6 +19,12 @@ function chunkifyTests(tests, totalChunks, thisChunk, chunkByDir, logger) {
       if (test_path[0] == '/') {
         test_path = test_path.substr(1);
       }
+      // mochitest-chrome and mochitest-browser-chrome pass an array of chrome://
+      // URIs
+      var protocolRegexp = /^[a-zA-Z]+:\/\//;
+      if (protocolRegexp.test(test_path)) {
+        test_path = test_path.replace(protocolRegexp, "");
+      }
       var dir = test_path.split("/");
       // We want the first chunkByDir+1 components, or everything but the
       // last component, whichever is less.

From 8495f67a0d7e4c88a13aeeda0c66a32f4410e7ad Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Sun, 16 Jun 2013 11:26:31 -0400
Subject: [PATCH 04/75] Bug 883314 part 4: use the chunking code for
 mochitest-browser-chrome, r=jmaher

--HG--
extra : transplant_source : E%26%86p%E0%14%99Jb%19%A8%A8%D9%23%7E%9EiH%DBf
---
 testing/mochitest/browser-harness.xul | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/testing/mochitest/browser-harness.xul b/testing/mochitest/browser-harness.xul
index 6948cc43d016..7ad1a3f7bd4f 100644
--- a/testing/mochitest/browser-harness.xul
+++ b/testing/mochitest/browser-harness.xul
@@ -12,6 +12,7 @@
   <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/MozillaLogger.js"/>
   <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/LogController.js"/>
   <script type="application/javascript" src="chrome://mochikit/content/chrome-harness.js"/>
+  <script type="application/javascript" src="chrome://mochikit/content/chunkifyTests.js"/>
   <style xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
     #results {
       margin: 5px;
@@ -178,6 +179,12 @@
       var fileNames = [];
       var fileNameRegexp = /browser_.+\.js$/;
       srvScope.arrayOfTestFiles(links, fileNames, fileNameRegexp);
+
+      if (gConfig.totalChunks && gConfig.thisChunk) {
+        fileNames = chunkifyTests(fileNames, gConfig.totalChunks,
+                                  gConfig.thisChunk, gConfig.chunkByDir);
+      }
+
       return fileNames.map(function (f) new browserTest(f));
     }
 

From b0ad5f2d4f1167b0d11c44b7a78f781bb954e009 Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Mon, 17 Jun 2013 14:00:10 -0400
Subject: [PATCH 05/75] Bug 883634: merge harness-overlay.xul into overlay.xul,
 r=jmaher

--HG--
extra : transplant_source : SO%03%F2n%FD%91%1C%1E%05%0C%BE%284%EE%1E%93%91%E5%7B
---
 testing/mochitest/Makefile.in         |   1 -
 testing/mochitest/harness-overlay.xul | 116 --------------------------
 testing/mochitest/harness.xul         | 105 ++++++++++++++++++++++-
 testing/mochitest/jar.mn              |   1 -
 4 files changed, 103 insertions(+), 120 deletions(-)
 delete mode 100644 testing/mochitest/harness-overlay.xul

diff --git a/testing/mochitest/Makefile.in b/testing/mochitest/Makefile.in
index 6a8f7690a96c..93546f1f3c1e 100644
--- a/testing/mochitest/Makefile.in
+++ b/testing/mochitest/Makefile.in
@@ -49,7 +49,6 @@ _SERV_FILES = 	\
 		gen_template.pl \
 		server.js \
 		chunkifyTests.js \
-		harness-overlay.xul \
 		harness.xul \
 		browser-test-overlay.xul \
 		browser-test.js \
diff --git a/testing/mochitest/harness-overlay.xul b/testing/mochitest/harness-overlay.xul
deleted file mode 100644
index dce17443c31d..000000000000
--- a/testing/mochitest/harness-overlay.xul
+++ /dev/null
@@ -1,116 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-<?xml-stylesheet href="chrome://mochikit/content/static/harness.css" 
-                 type="text/css"?>
-
-<overlay id="chromeTestOverlay"
-         xmlns:html="http://www.w3.org/1999/xhtml"
-         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-         xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-<window>
-  <script type="text/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/LogController.js"/>
-  <script type="text/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/specialpowersAPI.js"/>
-  <script type="text/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/SpecialPowersObserverAPI.js"/>
-  <script type="text/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/ChromePowers.js"/>
-  <script type="text/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/TestRunner.js"/>
-  <script type="text/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/MozillaLogger.js"/>
-  <script type="application/javascript"
-          src="chrome://mochikit/content/chrome-harness.js" />
-  <script type="text/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/setup.js" />
-  <script type="application/javascript;version=1.7"><![CDATA[
-
-if (Cc === undefined) {
-  var Cc = Components.classes;
-  var Ci = Components.interfaces;
-}
-
-function loadTests()
-{
-  window.removeEventListener("load", loadTests, false);
-  links = getTestList();
- 
-  // load server.js in so we can share template functions
-  var scriptLoader = Cc["@mozilla.org/moz/jssubscript-loader;1"].
-                       getService(Ci.mozIJSSubScriptLoader);
-  var srvScope = {};
-  scriptLoader.loadSubScript('chrome://mochikit/content/server.js',
-                             srvScope);
-
-  // generate our test list
-  srvScope.makeTags();
-  var tableContent = srvScope.linksToTableRows(links, 0);
-
-  function populate() {
-    document.getElementById("test-table").innerHTML += tableContent;
-  }
-  gTestList = eval(srvScope.jsonArrayOfTestFiles(links));
-  populate();
-
-  hookup();
-}
-
-    window.addEventListener("load", loadTests, false);
-  ]]>
-  </script>
-
-  <vbox>   
-    <button label="Run Chrome Tests" id="runtests" flex="1"/>
-
-    <body xmlns="http://www.w3.org/1999/xhtml" id="xulharness">
-      <!--TODO: this should be separated into a file that both this file and server.js uses-->
-      <div class="container">
-        <p style="float:right;">
-          <small>Based on the MochiKit unit tests.</small>
-        </p>
-        <div class="status">
-          <h1 id="indicator">Status</h1>
-          <h2 id="pass">Passed: <span id="pass-count">0</span></h2>
-          <h2 id="fail">Failed: <span id="fail-count">0</span></h2>
-          <h2 id="fail">Todo: <span id="todo-count">0</span></h2>
-        </div>
-        <div class="clear"></div>
-        <div id="current-test">
-          <b>Currently Executing: <span id="current-test-path">_</span></b>
-        </div>
-        <div class="clear"></div>
-        <div class="frameholder">
-          <iframe type="content" scrolling="no" id="testframe" width="550" height="350"></iframe>
-        </div>
-        <div class="clear"></div>
-        <div class="toggle">
-          <a href="#" id="toggleNonTests">Show Non-Tests</a>
-          <br />
-        </div>
-        <div id="wrapper">
-          <table cellpadding="0" cellspacing="0">
-          <!-- tbody needed to avoid bug 494546 causing performance problems -->
-            <tbody id="test-table">
-              <tr>
-                <td>Passed</td>
-                <td>Failed</td>
-                <td>Todo</td>
-                <td>Test Files</td>
-              </tr>
-            </tbody>
-          </table>
-          <br/>
-          <table cellpadding="0" cellspacing="0" border="1" bordercolor="red">
-          <!-- tbody needed to avoid bug 494546 causing performance problems -->
-            <tbody id="fail-table">
-            </tbody>
-          </table>
-        </div>
-      </div>
-    </body>
-  </vbox>
-</window>
-
-</overlay>
diff --git a/testing/mochitest/harness.xul b/testing/mochitest/harness.xul
index 891d3a65314b..ba45f47eb88d 100644
--- a/testing/mochitest/harness.xul
+++ b/testing/mochitest/harness.xul
@@ -3,9 +3,110 @@
 <?xml-stylesheet href="chrome://mochikit/content/static/harness.css" 
                  type="text/css"?>
 
-<?xul-overlay href="chrome://mochikit/content/harness-overlay.xul"?>
-
 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         title="Chrome Test Harness"
         directory="chrome">
+
+  <script type="text/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/LogController.js"/>
+  <script type="text/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/specialpowersAPI.js"/>
+  <script type="text/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SpecialPowersObserverAPI.js"/>
+  <script type="text/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/ChromePowers.js"/>
+  <script type="text/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/TestRunner.js"/>
+  <script type="text/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/MozillaLogger.js"/>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/chrome-harness.js" />
+  <script type="text/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/setup.js" />
+  <script type="application/javascript;version=1.7"><![CDATA[
+
+if (Cc === undefined) {
+  var Cc = Components.classes;
+  var Ci = Components.interfaces;
+}
+
+function loadTests()
+{
+  window.removeEventListener("load", loadTests, false);
+  links = getTestList();
+ 
+  // load server.js in so we can share template functions
+  var scriptLoader = Cc["@mozilla.org/moz/jssubscript-loader;1"].
+                       getService(Ci.mozIJSSubScriptLoader);
+  var srvScope = {};
+  scriptLoader.loadSubScript('chrome://mochikit/content/server.js',
+                             srvScope);
+
+  // generate our test list
+  srvScope.makeTags();
+  var tableContent = srvScope.linksToTableRows(links, 0);
+
+  function populate() {
+    document.getElementById("test-table").innerHTML += tableContent;
+  }
+  gTestList = eval(srvScope.jsonArrayOfTestFiles(links));
+  populate();
+
+  hookup();
+}
+
+    window.addEventListener("load", loadTests, false);
+  ]]>
+  </script>
+
+  <vbox>   
+    <button label="Run Chrome Tests" id="runtests" flex="1"/>
+
+    <body xmlns="http://www.w3.org/1999/xhtml" id="xulharness">
+      <!--TODO: this should be separated into a file that both this file and server.js uses-->
+      <div class="container">
+        <p style="float:right;">
+          <small>Based on the MochiKit unit tests.</small>
+        </p>
+        <div class="status">
+          <h1 id="indicator">Status</h1>
+          <h2 id="pass">Passed: <span id="pass-count">0</span></h2>
+          <h2 id="fail">Failed: <span id="fail-count">0</span></h2>
+          <h2 id="fail">Todo: <span id="todo-count">0</span></h2>
+        </div>
+        <div class="clear"></div>
+        <div id="current-test">
+          <b>Currently Executing: <span id="current-test-path">_</span></b>
+        </div>
+        <div class="clear"></div>
+        <div class="frameholder">
+          <iframe type="content" scrolling="no" id="testframe" width="550" height="350"></iframe>
+        </div>
+        <div class="clear"></div>
+        <div class="toggle">
+          <a href="#" id="toggleNonTests">Show Non-Tests</a>
+          <br />
+        </div>
+        <div id="wrapper">
+          <table cellpadding="0" cellspacing="0">
+          <!-- tbody needed to avoid bug 494546 causing performance problems -->
+            <tbody id="test-table">
+              <tr>
+                <td>Passed</td>
+                <td>Failed</td>
+                <td>Todo</td>
+                <td>Test Files</td>
+              </tr>
+            </tbody>
+          </table>
+          <br/>
+          <table cellpadding="0" cellspacing="0" border="1" bordercolor="red">
+          <!-- tbody needed to avoid bug 494546 causing performance problems -->
+            <tbody id="fail-table">
+            </tbody>
+          </table>
+        </div>
+      </div>
+    </body>
+  </vbox>
 </window>
diff --git a/testing/mochitest/jar.mn b/testing/mochitest/jar.mn
index 794762eb1c8c..a85d662f060d 100644
--- a/testing/mochitest/jar.mn
+++ b/testing/mochitest/jar.mn
@@ -5,7 +5,6 @@ mochikit.jar:
   content/browser-test-overlay.xul (browser-test-overlay.xul)
   content/cc-analyzer.js (cc-analyzer.js)
   content/chrome-harness.js (chrome-harness.js)
-  content/harness-overlay.xul (harness-overlay.xul)
   content/harness.xul (harness.xul)
   content/redirect.html (redirect.html)
   content/server.js (server.js)

From b937c2b0db1f4d2575761dc272bfd1a4e14869ac Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Mon, 17 Jun 2013 14:00:10 -0400
Subject: [PATCH 06/75] Bug 880101: fix intermittent orange in
 browser_locationBarCommand.js, r=margaret

--HG--
extra : transplant_source : Y%B2%A3%D5i%2C%8F%CB%FA%82%B1%83%A2%BB%96%99q%C8%B7%FA
---
 .../content/test/browser_locationBarCommand.js  | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/browser/base/content/test/browser_locationBarCommand.js b/browser/base/content/test/browser_locationBarCommand.js
index 147b7a51de04..386f34d2465a 100644
--- a/browser/base/content/test/browser_locationBarCommand.js
+++ b/browser/base/content/test/browser_locationBarCommand.js
@@ -34,7 +34,7 @@ function runAltLeftClickTest() {
 function runShiftLeftClickTest() {
   let listener = new WindowListener(getBrowserURL(), function(aWindow) {
     Services.wm.removeListener(listener);
-    addPageShowListener(aWindow.gBrowser, function() {
+    addPageShowListener(aWindow.gBrowser.selectedBrowser, function() {
       info("URL should be loaded in a new window");
       is(gURLBar.value, "", "Urlbar reverted to original value");       
       is(gFocusManager.focusedElement, null, "There should be no focused element");
@@ -43,7 +43,7 @@ function runShiftLeftClickTest() {
 
       aWindow.close();
       runNextTest();
-    });
+    }, "http://example.com/");
   });
   Services.wm.addListener(listener);
 
@@ -61,7 +61,7 @@ function runNextTest() {
   info("Running test: " + test.desc);
   // Tab will be blank if test.startValue is null
   let tab = gBrowser.selectedTab = gBrowser.addTab(test.startValue);
-  addPageShowListener(gBrowser, function() {
+  addPageShowListener(gBrowser.selectedBrowser, function() {
     triggerCommand(test.click, test.event);
     test.check(tab);
 
@@ -163,10 +163,13 @@ function checkNewTab(aTab) {
   isnot(gBrowser.selectedTab, aTab, "New URL was loaded in a new tab");
 }
 
-function addPageShowListener(aBrowser, aFunc) {
-  aBrowser.selectedBrowser.addEventListener("pageshow", function loadListener() {
-    aBrowser.selectedBrowser.removeEventListener("pageshow", loadListener, false);
-    aFunc();
+function addPageShowListener(browser, cb, expectedURL) {
+  browser.addEventListener("pageshow", function pageShowListener() {
+    info("pageshow: " + browser.currentURI.spec);
+    if (expectedURL && browser.currentURI.spec != expectedURL)
+      return; // ignore pageshows for non-expected URLs
+    browser.removeEventListener("pageshow", pageShowListener, false);
+    cb();
   });
 }
 

From 83084f62a26faf7468720ed375f8eac779a6eab1 Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Fri, 7 Jun 2013 18:08:50 -0700
Subject: [PATCH 07/75] Bug 879658: avoiding exposing localStorage to
 non-whitelisted social providers, r=mixedpuppy

--HG--
extra : transplant_source : %15%905%E6%D9%A2%B5%85%D9%1C%01%A1%9F%18%9C%9F%28%93%7D%1A
---
 toolkit/components/social/FrameWorker.jsm     | 15 +++-
 toolkit/components/social/SocialService.jsm   | 83 ++++++++++---------
 .../test/browser/browser_frameworker.js       | 26 +++++-
 3 files changed, 82 insertions(+), 42 deletions(-)

diff --git a/toolkit/components/social/FrameWorker.jsm b/toolkit/components/social/FrameWorker.jsm
index 77bbb7a1140c..771e4a8f1591 100644
--- a/toolkit/components/social/FrameWorker.jsm
+++ b/toolkit/components/social/FrameWorker.jsm
@@ -30,7 +30,7 @@ var _nextPortId = 1;
 // Retrieves a reference to a WorkerHandle associated with a FrameWorker and a
 // new ClientPort.
 this.getFrameWorkerHandle =
- function getFrameWorkerHandle(url, clientWindow, name, origin) {
+ function getFrameWorkerHandle(url, clientWindow, name, origin, exposeLocalStorage = false) {
   // first create the client port we are going to use.  Later we will
   // message the worker to create the worker port.
   let portid = _nextPortId++;
@@ -39,7 +39,7 @@ this.getFrameWorkerHandle =
   let existingWorker = workerCache[url];
   if (!existingWorker) {
     // setup the worker and add this connection to the pending queue
-    let worker = new FrameWorker(url, name, origin);
+    let worker = new FrameWorker(url, name, origin, exposeLocalStorage);
     worker.pendingPorts.push(clientPort);
     existingWorker = workerCache[url] = worker;
   } else {
@@ -69,7 +69,7 @@ this.getFrameWorkerHandle =
  * the script does not have a full DOM but is instead run in a sandbox
  * that has a select set of methods cloned from the URL's domain.
  */
-function FrameWorker(url, name, origin) {
+function FrameWorker(url, name, origin, exposeLocalStorage) {
   this.url = url;
   this.name = name || url;
   this.ports = new Map();
@@ -78,6 +78,7 @@ function FrameWorker(url, name, origin) {
   this.reloading = false;
   this.origin = origin;
   this._injectController = null;
+  this.exposeLocalStorage = exposeLocalStorage;
 
   this.frame = makeHiddenFrame();
   this.load();
@@ -133,11 +134,17 @@ FrameWorker.prototype = {
     // copy the window apis onto the sandbox namespace only functions or
     // objects that are naturally a part of an iframe, I'm assuming they are
     // safe to import this way
-    let workerAPI = ['WebSocket', 'localStorage', 'atob', 'btoa',
+    let workerAPI = ['WebSocket', 'atob', 'btoa',
                      'clearInterval', 'clearTimeout', 'dump',
                      'setInterval', 'setTimeout', 'XMLHttpRequest',
                      'FileReader', 'Blob', 'EventSource', 'indexedDB',
                      'location'];
+
+    // Only expose localStorage if the caller opted-in
+    if (this.exposeLocalStorage) {
+      workerAPI.push('localStorage');
+    }
+
     // Bug 798660 - XHR and WebSocket have issues in a sandbox and need
     // to be unwrapped to work
     let needsWaive = ['XMLHttpRequest', 'WebSocket'];
diff --git a/toolkit/components/social/SocialService.jsm b/toolkit/components/social/SocialService.jsm
index c8e28bc9001c..a22d14613000 100644
--- a/toolkit/components/social/SocialService.jsm
+++ b/toolkit/components/social/SocialService.jsm
@@ -137,6 +137,42 @@ let SocialServiceInternal = {
   }
 };
 
+XPCOMUtils.defineLazyGetter(SocialServiceInternal, "providers", function () {
+  initService();
+  let providers = {};
+  for (let manifest of this.manifests) {
+    try {
+      if (ActiveProviders.has(manifest.origin)) {
+        let activationType = getOriginActivationType(manifest.origin);
+        let blessed = activationType == "builtin" ||
+                      activationType == "whitelist";
+        let provider = new SocialProvider(manifest, blessed);
+        providers[provider.origin] = provider;
+      }
+    } catch (err) {
+      Cu.reportError("SocialService: failed to load provider: " + manifest.origin +
+                     ", exception: " + err);
+    }
+  }
+  return providers;
+});
+
+function getOriginActivationType(origin) {
+  let prefname = SocialServiceInternal.getManifestPrefname(origin);
+  if (Services.prefs.getDefaultBranch("social.manifest.").getPrefType(prefname) == Services.prefs.PREF_STRING)
+    return 'builtin';
+
+  let whitelist = Services.prefs.getCharPref("social.whitelist").split(',');
+  if (whitelist.indexOf(origin) >= 0)
+    return 'whitelist';
+
+  let directories = Services.prefs.getCharPref("social.directories").split(',');
+  if (directories.indexOf(origin) >= 0)
+    return 'directory';
+
+  return 'foreign';
+}
+
 let ActiveProviders = {
   get _providers() {
     delete this._providers;
@@ -304,23 +340,6 @@ function initService() {
     MozSocialAPI.enabled = true;
 }
 
-XPCOMUtils.defineLazyGetter(SocialServiceInternal, "providers", function () {
-  initService();
-  let providers = {};
-  for (let manifest of this.manifests) {
-    try {
-      if (ActiveProviders.has(manifest.origin)) {
-        let provider = new SocialProvider(manifest);
-        providers[provider.origin] = provider;
-      }
-    } catch (err) {
-      Cu.reportError("SocialService: failed to load provider: " + manifest.origin +
-                     ", exception: " + err);
-    }
-  }
-  return providers;
-});
-
 function schedule(callback) {
   Services.tm.mainThread.dispatch(callback, Ci.nsIThread.DISPATCH_NORMAL);
 }
@@ -444,22 +463,6 @@ this.SocialService = {
     SocialServiceInternal.orderedProviders(onDone);
   },
 
-  getOriginActivationType: function(origin) {
-    let prefname = SocialServiceInternal.getManifestPrefname(origin);
-    if (Services.prefs.getDefaultBranch("social.manifest.").getPrefType(prefname) == Services.prefs.PREF_STRING)
-      return 'builtin';
-
-    let whitelist = Services.prefs.getCharPref("social.whitelist").split(',');
-    if (whitelist.indexOf(origin) >= 0)
-      return 'whitelist';
-
-    let directories = Services.prefs.getCharPref("social.directories").split(',');
-    if (directories.indexOf(origin) >= 0)
-      return 'directory';
-
-    return 'foreign';
-  },
-
   _providerListeners: new Map(),
   registerProviderListener: function registerProviderListener(listener) {
     this._providerListeners.set(listener, 1);
@@ -585,7 +588,7 @@ this.SocialService = {
     let sourceURI = aDOMDocument.location.href;
     let installOrigin = aDOMDocument.nodePrincipal.origin;
 
-    let installType = this.getOriginActivationType(installOrigin);
+    let installType = getOriginActivationType(installOrigin);
     let manifest;
     if (data) {
       // if we get data, we MUST have a valid manifest generated from the data
@@ -649,8 +652,9 @@ this.SocialService = {
  *
  * @constructor
  * @param {jsobj} object representing the manifest file describing this provider
+ * @param {bool} boolean indicating whether this provider is "built in"
  */
-function SocialProvider(input) {
+function SocialProvider(input, blessed = false) {
   if (!input.name)
     throw new Error("SocialProvider must be passed a name");
   if (!input.origin)
@@ -674,6 +678,7 @@ function SocialProvider(input) {
   this.ambientNotificationIcons = {};
   this.errorState = null;
   this.frecency = 0;
+  this.blessed = blessed;
   try {
     this.domain = etld.getBaseDomainFromHost(originUri.host);
   } catch(e) {
@@ -869,8 +874,12 @@ SocialProvider.prototype = {
   getWorkerPort: function getWorkerPort(window) {
     if (!this.workerURL || !this.enabled)
       return null;
-    return getFrameWorkerHandle(this.workerURL, window,
-                                "SocialProvider:" + this.origin, this.origin).port;
+    // Only allow localStorage in the frameworker for blessed providers
+    let allowLocalStorage = this.blessed;
+    let handle = getFrameWorkerHandle(this.workerURL, window,
+                                      "SocialProvider:" + this.origin, this.origin,
+                                      allowLocalStorage);
+    return handle.port;
   },
 
   /**
diff --git a/toolkit/components/social/test/browser/browser_frameworker.js b/toolkit/components/social/test/browser/browser_frameworker.js
index 0f2c18404e84..361527fb3dde 100644
--- a/toolkit/components/social/test/browser/browser_frameworker.js
+++ b/toolkit/components/social/test/browser/browser_frameworker.js
@@ -241,7 +241,7 @@ let tests = {
         port.postMessage({topic: "done", result: "ok"});
       }
     }
-    let worker = getFrameWorkerHandle(makeWorkerUrl(run), undefined, "testLocalStorage");
+    let worker = getFrameWorkerHandle(makeWorkerUrl(run), undefined, "testLocalStorage", null, true);
     worker.port.onmessage = function(e) {
       if (e.data.topic == "done") {
         is(e.data.result, "ok", "check the localStorage test worked");
@@ -251,6 +251,30 @@ let tests = {
     }
   },
 
+  testNoLocalStorage: function(cbnext) {
+    let run = function() {
+      onconnect = function(e) {
+        let port = e.ports[0];
+        try {
+          localStorage.setItem("foo", "1");
+        } catch(e) {
+          port.postMessage({topic: "done", result: "ok"});
+          return;
+        }
+
+        port.postMessage({topic: "done", result: "FAILED because localStorage was exposed" });
+      }
+    }
+    let worker = getFrameWorkerHandle(makeWorkerUrl(run), undefined, "testNoLocalStorage");
+    worker.port.onmessage = function(e) {
+      if (e.data.topic == "done") {
+        is(e.data.result, "ok", "check that retrieving localStorage fails by default");
+        worker.terminate();
+        cbnext();
+      }
+    }
+  },
+
   testBase64: function (cbnext) {
     let run = function() {
       onconnect = function(e) {

From c2547136e0d9fb81758cdb4b648784f12bf5db62 Mon Sep 17 00:00:00 2001
From: Mike de Boer <mdeboer@mozilla.com>
Date: Mon, 27 May 2013 17:21:47 +0200
Subject: [PATCH 08/75] Bug 860560: make sure that defaultEngine and
 currentEngine stay in sync, r=gavin

--HG--
extra : transplant_source : %83%A6%F6%02%C5a6%08%09/%3C%D4p%23%0BI%EF%EE%C0%16
---
 browser/components/nsBrowserGlue.js           |  19 +++
 toolkit/components/search/nsSearchService.js  |  72 +++++++++-
 .../tests/xpcshell/test_engineselect.js       |  17 +--
 .../tests/xpcshell/test_notifications.js      |  83 +++++++++++
 .../search/tests/xpcshell/test_prefSync.js    | 129 ++++++++++++++++++
 .../search/tests/xpcshell/xpcshell.ini        |   2 +
 6 files changed, 305 insertions(+), 17 deletions(-)
 create mode 100644 toolkit/components/search/tests/xpcshell/test_notifications.js
 create mode 100644 toolkit/components/search/tests/xpcshell/test_prefSync.js

diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js
index 27ed8b36b81e..97252c8bda2b 100644
--- a/browser/components/nsBrowserGlue.js
+++ b/browser/components/nsBrowserGlue.js
@@ -317,6 +317,23 @@ BrowserGlue.prototype = {
         });
         break;
 #endif
+      case "browser-search-engine-modified":
+        if (data != "engine-default" && data != "engine-current") {
+          break;
+        }
+        // Enforce that the search service's defaultEngine is always equal to
+        // its currentEngine. The search service will notify us any time either
+        // of them are changed (either by directly setting the relevant prefs,
+        // i.e. if add-ons try to change this directly, or if the
+        // nsIBrowserSearchService setters are called).
+        let ss = Services.search;
+        if (ss.currentEngine.name == ss.defaultEngine.name)
+          return;
+        if (data == "engine-current")
+          ss.defaultEngine = ss.currentEngine;
+        else
+          ss.currentEngine = ss.defaultEngine;
+        break;
     }
   },
 
@@ -351,6 +368,7 @@ BrowserGlue.prototype = {
 #ifdef MOZ_SERVICES_HEALTHREPORT
     os.addObserver(this, "keyword-search", false);
 #endif
+    os.addObserver(this, "browser-search-engine-modified", false);
   },
 
   // cleanup (called on application shutdown)
@@ -384,6 +402,7 @@ BrowserGlue.prototype = {
 #ifdef MOZ_SERVICES_HEALTHREPORT
     os.removeObserver(this, "keyword-search");
 #endif
+    os.removeObserver(this, "browser-search-engine-modified");
   },
 
   _onAppDefaults: function BG__onAppDefaults() {
diff --git a/toolkit/components/search/nsSearchService.js b/toolkit/components/search/nsSearchService.js
index 6b4419f5ebc7..32b5a6e77c0c 100644
--- a/toolkit/components/search/nsSearchService.js
+++ b/toolkit/components/search/nsSearchService.js
@@ -2654,6 +2654,15 @@ SearchService.prototype = {
     return this.__sortedEngines;
   },
 
+  // Get the original Engine object that belongs to the defaultenginename pref
+  // of the default branch.
+  get _originalDefaultEngine() {
+    let defaultPrefB = Services.prefs.getDefaultBranch(BROWSER_SEARCH_PREF);
+    let nsIPLS = Ci.nsIPrefLocalizedString;
+    let defaultEngine = defaultPrefB.getComplexValue("defaultenginename", nsIPLS).data;
+    return this.getEngineByName(defaultEngine);
+  },
+
   _buildCache: function SRCH_SVC__buildCache() {
     if (!getBoolPref(BROWSER_SEARCH_PREF + "cache.enabled", true))
       return;
@@ -3168,6 +3177,15 @@ SearchService.prototype = {
                                       });
   },
 
+  _setEngineByPref: function SRCH_SVC_setEngineByPref(aEngineType, aPref) {
+    this._ensureInitialized();
+    let newEngine = this.getEngineByName(getLocalizedPref(aPref, ""));
+    if (!newEngine)
+      FAIL("Can't find engine in store!", Cr.NS_ERROR_UNEXPECTED);
+
+    this[aEngineType] = newEngine;
+  },
+
   // nsIBrowserSearchService
   init: function SRCH_SVC_init(observer) {
     LOG("SearchService.init");
@@ -3354,10 +3372,9 @@ SearchService.prototype = {
     if (engineToRemove == this.currentEngine) {
       this._currentEngine = null;
     }
-    
+
     if (engineToRemove == this.defaultEngine) {
       this._defaultEngine = null;
-      Services.prefs.clearUserPref(BROWSER_SEARCH_PREF + "defaultenginename");
     }
 
     if (engineToRemove._readOnly) {
@@ -3465,7 +3482,10 @@ SearchService.prototype = {
 
   set defaultEngine(val) {
     this._ensureInitialized();
-    if (!(val instanceof Ci.nsISearchEngine))
+    // Sometimes we get wrapped nsISearchEngine objects (external XPCOM callers),
+    // and sometimes we get raw Engine JS objects (callers in this file), so
+    // handle both.
+    if (!(val instanceof Ci.nsISearchEngine) && !(val instanceof Engine))
       FAIL("Invalid argument passed to defaultEngine setter");
 
     let newDefaultEngine = this.getEngineByName(val.name);
@@ -3477,8 +3497,22 @@ SearchService.prototype = {
 
     this._defaultEngine = newDefaultEngine;
 
+    // Set a flag to keep track that this setter was called properly, not by
+    // setting the pref alone.
+    this._changingDefaultEngine = true;
     let defPref = BROWSER_SEARCH_PREF + "defaultenginename";
-    setLocalizedPref(defPref, this._defaultEngine.name);
+    // If we change the default engine in the future, that change should impact
+    // users who have switched away from and then back to the build's "default"
+    // engine. So clear the user pref when the defaultEngine is set to the
+    // build's default engine, so that the defaultEngine getter falls back to
+    // whatever the default is.
+    if (this._defaultEngine == this._originalDefaultEngine) {
+      Services.prefs.clearUserPref(defPref);
+    }
+    else {
+      setLocalizedPref(defPref, this._defaultEngine.name);
+    }
+    this._changingDefaultEngine = false;
 
     notifyAction(this._defaultEngine, SEARCH_ENGINE_DEFAULT);
   },
@@ -3498,7 +3532,10 @@ SearchService.prototype = {
 
   set currentEngine(val) {
     this._ensureInitialized();
-    if (!(val instanceof Ci.nsISearchEngine))
+    // Sometimes we get wrapped nsISearchEngine objects (external XPCOM callers),
+    // and sometimes we get raw Engine JS objects (callers in this file), so
+    // handle both.
+    if (!(val instanceof Ci.nsISearchEngine) && !(val instanceof Engine))
       FAIL("Invalid argument passed to currentEngine setter");
 
     var newCurrentEngine = this.getEngineByName(val.name);
@@ -3512,12 +3549,21 @@ SearchService.prototype = {
 
     var currentEnginePref = BROWSER_SEARCH_PREF + "selectedEngine";
 
-    if (this._currentEngine == this.defaultEngine) {
+    // Set a flag to keep track that this setter was called properly, not by
+    // setting the pref alone.
+    this._changingCurrentEngine = true;
+    // If we change the default engine in the future, that change should impact
+    // users who have switched away from and then back to the build's "default"
+    // engine. So clear the user pref when the currentEngine is set to the
+    // build's default engine, so that the currentEngine getter falls back to
+    // whatever the default is.
+    if (this._currentEngine == this._originalDefaultEngine) {
       Services.prefs.clearUserPref(currentEnginePref);
     }
     else {
       setLocalizedPref(currentEnginePref, this._currentEngine.name);
     }
+    this._changingCurrentEngine = false;
 
     notifyAction(this._currentEngine, SEARCH_ENGINE_CURRENT);
   },
@@ -3554,6 +3600,16 @@ SearchService.prototype = {
         }
         engineMetadataService.flush();
         break;
+
+      case "nsPref:changed":
+        let currPref = BROWSER_SEARCH_PREF + "selectedEngine";
+        let defPref = BROWSER_SEARCH_PREF + "defaultenginename";
+        if (aVerb == currPref && !this._changingCurrentEngine) {
+          this._setEngineByPref("currentEngine", currPref);
+        } else if (aVerb == defPref && !this._changingDefaultEngine) {
+          this._setEngineByPref("defaultEngine", defPref);
+        }
+        break;
     }
   },
 
@@ -3599,11 +3655,15 @@ SearchService.prototype = {
   _addObservers: function SRCH_SVC_addObservers() {
     Services.obs.addObserver(this, SEARCH_ENGINE_TOPIC, false);
     Services.obs.addObserver(this, QUIT_APPLICATION_TOPIC, false);
+    Services.prefs.addObserver(BROWSER_SEARCH_PREF + "defaultenginename", this, false);
+    Services.prefs.addObserver(BROWSER_SEARCH_PREF + "selectedEngine", this, false);
   },
 
   _removeObservers: function SRCH_SVC_removeObservers() {
     Services.obs.removeObserver(this, SEARCH_ENGINE_TOPIC);
     Services.obs.removeObserver(this, QUIT_APPLICATION_TOPIC);
+    Services.prefs.removeObserver(BROWSER_SEARCH_PREF + "defaultenginename", this);
+    Services.prefs.removeObserver(BROWSER_SEARCH_PREF + "selectedEngine", this);
   },
 
   QueryInterface: function SRCH_SVC_QI(aIID) {
diff --git a/toolkit/components/search/tests/xpcshell/test_engineselect.js b/toolkit/components/search/tests/xpcshell/test_engineselect.js
index 6514d509f6af..86796ba393d9 100644
--- a/toolkit/components/search/tests/xpcshell/test_engineselect.js
+++ b/toolkit/components/search/tests/xpcshell/test_engineselect.js
@@ -43,29 +43,24 @@ function search_observer(aSubject, aTopic, aData) {
   let engine2 = search.getEngineByName("A second test engine");
 
   search.defaultEngine = engine1;
-  do_check_eq(search.defaultEngine.name, "Test search engine");
-  do_check_eq(search.defaultEngine.searchForm, "http://www.google.com/");
+  do_check_eq(search.defaultEngine, engine1);
   
   // Tests search defaultEngine when it changes
   search.defaultEngine = engine2
-  do_check_eq(search.defaultEngine.name, "A second test engine");
-  do_check_eq(search.defaultEngine.searchForm, "https://duckduckgo.com");
+  do_check_eq(search.defaultEngine, engine2);
 
   // Test search defaultEngine again when we change back
   search.defaultEngine = engine1;
-  do_check_eq(search.defaultEngine.name, "Test search engine");
-  do_check_eq(search.defaultEngine.searchForm, "http://www.google.com/");
+  do_check_eq(search.defaultEngine, engine1);
 
   // Test search defaultEngine when the current default is hidden
-  search.moveEngine(engine2, 0)
+  search.moveEngine(engine2, 0);
   engine1.hidden = true;
-  do_check_eq(search.defaultEngine.name, "A second test engine");
-  do_check_eq(search.defaultEngine.searchForm, "https://duckduckgo.com");
+  do_check_eq(search.defaultEngine, engine2);
   
   // Test search defaultEngine when it is set to a hidden engine
   search.defaultEngine = engine1;
-  do_check_eq(search.defaultEngine.name, "A second test engine");
-  do_check_eq(search.defaultEngine.searchForm, "https://duckduckgo.com");
+  do_check_eq(search.defaultEngine, engine2);
 
   do_test_finished();
 }
diff --git a/toolkit/components/search/tests/xpcshell/test_notifications.js b/toolkit/components/search/tests/xpcshell/test_notifications.js
new file mode 100644
index 000000000000..a75a77d60671
--- /dev/null
+++ b/toolkit/components/search/tests/xpcshell/test_notifications.js
@@ -0,0 +1,83 @@
+/* Any copyright is dedicated to the Public Domain.
+ *    http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+const Ci = Components.interfaces;
+
+Components.utils.import("resource://testing-common/httpd.js");
+
+let gTestLog = [];
+
+/**
+ * The order of notifications expected for this test is:
+ *  - engine-changed (while we're installing the engine, we modify it, which notifies - bug 606886)
+ *  - engine-added (engine was added to the store by the search service)
+ *   -> our search observer is called, which sets:
+ *    - .defaultEngine, triggering engine-default
+ *    - .currentEngine, triggering engine-current (after bug 493051 - for now the search service sets this after engine-added)
+ *   ...and then schedules a removal
+ *  - engine-loaded (the search service's observer is garanteed to fire first, which is what causes engine-added to fire)
+ *  - engine-removed (due to the removal schedule above)
+ */
+let expectedLog = [
+  "engine-changed", // XXX bug 606886
+  "engine-added",
+  "engine-default",
+  "engine-current",
+  "engine-loaded",
+  "engine-removed"
+];
+
+function search_observer(subject, topic, data) {
+  let engine = subject.QueryInterface(Ci.nsISearchEngine);
+  gTestLog.push(data + " for " + engine.name);
+
+  do_print("Observer: " + data + " for " + engine.name);
+
+  switch (data) {
+    case "engine-added":
+      let retrievedEngine = Services.search.getEngineByName("Test search engine");
+      do_check_eq(engine, retrievedEngine);
+      Services.search.defaultEngine = engine;
+      // XXX bug 493051
+      // Services.search.currentEngine = engine;
+      do_execute_soon(function () {
+        Services.search.removeEngine(engine);
+      });
+      break;
+    case "engine-removed":
+      let engineNameOutput = " for Test search engine";
+      expectedLog = expectedLog.map(logLine => logLine + engineNameOutput);
+      do_print("expectedLog:\n" + expectedLog.join("\n"))
+      do_print("gTestLog:\n" + gTestLog.join("\n"))
+      for (let i = 0; i < expectedLog.length; i++) {
+        do_check_eq(gTestLog[i], expectedLog[i]);
+      }
+      do_check_eq(gTestLog.length, expectedLog.length);
+      do_test_finished();
+      break;
+  }
+}
+
+function run_test() {
+  removeMetadata();
+  updateAppInfo();
+
+  let httpServer = new HttpServer();
+  httpServer.start(4444);
+  httpServer.registerDirectory("/", do_get_cwd());
+
+  do_register_cleanup(function cleanup() {
+    httpServer.stop(function() {});
+    Services.obs.removeObserver(search_observer, "browser-search-engine-modified");
+  });
+
+  do_test_pending();
+
+  Services.obs.addObserver(search_observer, "browser-search-engine-modified", false);
+
+  Services.search.addEngine("http://localhost:4444/data/engine.xml",
+                            Ci.nsISearchEngine.DATA_XML,
+                            null, false);
+}
diff --git a/toolkit/components/search/tests/xpcshell/test_prefSync.js b/toolkit/components/search/tests/xpcshell/test_prefSync.js
new file mode 100644
index 000000000000..29b386ca6af7
--- /dev/null
+++ b/toolkit/components/search/tests/xpcshell/test_prefSync.js
@@ -0,0 +1,129 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/*
+ * Test that currentEngine and defaultEngine properties are updated when the
+ * prefs are set independently.
+ */
+
+"use strict";
+
+const { classes: Cc, interfaces: Ci, utils: Cu, results: Cr } = Components;
+
+Cu.import("resource://testing-common/httpd.js");
+
+let waitForEngines = {
+  "Test search engine": 1,
+  "A second test engine": 1
+};
+
+const PREF_BRANCH = "browser.search.";
+
+/**
+ * Wrapper for nsIPrefBranch::setComplexValue.
+ * @param aPrefName
+ *        The name of the pref to set.
+ */
+function setLocalizedPref(aPrefName, aValue) {
+  let nsIPLS = Ci.nsIPrefLocalizedString;
+  let branch = Services.prefs.getBranch(PREF_BRANCH);
+  try {
+    var pls = Cc["@mozilla.org/pref-localizedstring;1"].
+              createInstance(Ci.nsIPrefLocalizedString);
+    pls.data = aValue;
+    branch.setComplexValue(aPrefName, nsIPLS, pls);
+  } catch (ex) {}
+}
+
+function search_observer(aSubject, aTopic, aData) {
+  let engine = aSubject.QueryInterface(Ci.nsISearchEngine);
+  do_print("Observer: " + aData + " for " + engine.name);
+
+  if (aData != "engine-added") {
+    return;
+  }
+
+  // If the engine is defined in `waitForEngines`, remove it from the list
+  if (waitForEngines[engine.name]) {
+    delete waitForEngines[engine.name];
+  } else {
+    // This engine is not one we're waiting for, so bail out early.
+    return;
+  }
+
+  // Only continue when both engines have been loaded.
+  if (Object.keys(waitForEngines).length) {
+    return;
+  }
+
+  let search = Services.search;
+
+  let engine1Name = "Test search engine";
+  let engine2Name = "A second test engine";
+  let engine1 = search.getEngineByName(engine1Name);
+  let engine2 = search.getEngineByName(engine2Name);
+
+  // Initial sanity check:
+  search.defaultEngine = engine1;
+  do_check_eq(search.defaultEngine, engine1);
+  search.currentEngine = engine1;
+  do_check_eq(search.currentEngine, engine1);
+
+  setLocalizedPref("defaultenginename", engine2Name);
+  // Default engine should be synced with the pref
+  do_check_eq(search.defaultEngine, engine2);
+  // Current engine should've stayed the same
+  do_check_eq(search.currentEngine, engine1);
+  
+  setLocalizedPref("selectedEngine", engine2Name);
+  // Default engine should've stayed the same
+  do_check_eq(search.defaultEngine, engine2);
+  // Current engine should've been updated
+  do_check_eq(search.currentEngine, engine2);
+
+  // Test that setting the currentEngine to the original default engine clears
+  // the selectedEngine pref, rather than setting it. To do this we need to
+  // set the value of defaultenginename on the default branch.
+  let defaultBranch = Services.prefs.getDefaultBranch("");
+  let prefName = PREF_BRANCH + "defaultenginename";
+  let prefVal = "data:text/plain," + prefName + "=" + engine1Name;
+  defaultBranch.setCharPref(prefName, prefVal, true);
+  search.currentEngine = engine1;
+  // Current engine should've been updated
+  do_check_eq(search.currentEngine, engine1);
+  do_check_false(Services.prefs.prefHasUserValue("browser.search.selectedEngine"));
+
+  // Test that setting the defaultEngine to the original default engine clears
+  // the defaultenginename pref, rather than setting it.
+  do_check_true(Services.prefs.prefHasUserValue("browser.search.defaultenginename"));
+  search.defaultEngine = engine1;
+  do_check_eq(search.defaultEngine, engine1);
+  do_check_false(Services.prefs.prefHasUserValue("browser.search.defaultenginename"));
+
+  do_test_finished();
+}
+
+function run_test() {
+  removeMetadata();
+  updateAppInfo();
+
+  let httpServer = new HttpServer();
+  httpServer.start(4444);
+  httpServer.registerDirectory("/", do_get_cwd());
+
+  do_register_cleanup(function cleanup() {
+    httpServer.stop(function() {});
+    Services.obs.removeObserver(search_observer, "browser-search-engine-modified");
+  });
+
+  do_test_pending();
+
+  Services.obs.addObserver(search_observer, "browser-search-engine-modified", false);
+
+  Services.search.addEngine("http://localhost:4444/data/engine.xml",
+                   Ci.nsISearchEngine.DATA_XML,
+                   null, false);
+  Services.search.addEngine("http://localhost:4444/data/engine2.xml",
+                   Ci.nsISearchEngine.DATA_XML,
+                   null, false);
+}
diff --git a/toolkit/components/search/tests/xpcshell/xpcshell.ini b/toolkit/components/search/tests/xpcshell/xpcshell.ini
index dc5d8b91dcf7..858f03793c6b 100644
--- a/toolkit/components/search/tests/xpcshell/xpcshell.ini
+++ b/toolkit/components/search/tests/xpcshell/xpcshell.ini
@@ -17,4 +17,6 @@ skip-if = debug && os == "linux"
 [test_save_sorted_engines.js]
 [test_purpose.js]
 [test_engineselect.js]
+[test_prefSync.js]
+[test_notifications.js]
 

From 72bebb943c028580a0398050ee77f848b20d9f68 Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Wed, 17 Apr 2013 17:51:25 -0700
Subject: [PATCH 09/75] Bug 493051: avoid having addEngine select the engine by
 default, by adding an optional callback to let callers observe the successful
 addition of the engine, r=MattN

--HG--
extra : transplant_source : M%40%CB%E5%8F%D9RMc%BA%23%20%C7%EC%9A%84H%DB%1B%81
---
 browser/components/search/content/search.xml  | 13 ++-
 .../components/search/test/browser_426329.js  |  3 +-
 .../search/test/browser_contextmenu.js        |  3 +-
 .../browser_private_search_perwindowpb.js     | 24 +++--
 .../base/public/nsIBrowserSearchService.idl   | 34 ++++++-
 toolkit/components/search/nsSearchService.js  | 71 +++++++++++----
 .../search/tests/xpcshell/head_search.js      |  2 +-
 .../tests/xpcshell/test_addEngine_callback.js | 89 +++++++++++++++++++
 .../tests/xpcshell/test_notifications.js      |  3 +-
 .../search/tests/xpcshell/xpcshell.ini        |  2 +-
 10 files changed, 198 insertions(+), 46 deletions(-)
 create mode 100644 toolkit/components/search/tests/xpcshell/test_addEngine_callback.js

diff --git a/browser/components/search/content/search.xml b/browser/components/search/content/search.xml
index e105f527f8df..0a1dcaf18384 100644
--- a/browser/components/search/content/search.xml
+++ b/browser/components/search/content/search.xml
@@ -488,17 +488,22 @@
     <handlers>
       <handler event="command"><![CDATA[
         const target = event.originalTarget;
-        if (target.classList.contains("addengine-item")) {
+        if (target.engine) {
+          this.currentEngine = target.engine;
+        } else if (target.classList.contains("addengine-item")) {
           var searchService =
             Components.classes["@mozilla.org/browser/search-service;1"]
                       .getService(Components.interfaces.nsIBrowserSearchService);
           // We only detect OpenSearch files
           var type = Components.interfaces.nsISearchEngine.DATA_XML;
+          // Select the installed engine if the installation succeeds
+          var installCallback = {
+            onSuccess: engine => this.currentEngine = engine
+          }
           searchService.addEngine(target.getAttribute("uri"), type,
-                                  target.getAttribute("src"), false);
+                                  target.getAttribute("src"), false,
+                                  installCallback);
         }
-        else if (target.engine)
-          this.currentEngine = target.engine;
         else
           return;
 
diff --git a/browser/components/search/test/browser_426329.js b/browser/components/search/test/browser_426329.js
index 585da8e6bc4d..4b2310cd5a3b 100644
--- a/browser/components/search/test/browser_426329.js
+++ b/browser/components/search/test/browser_426329.js
@@ -30,8 +30,7 @@ function test() {
       case "engine-added":
         var engine = ss.getEngineByName("Bug 426329");
         ok(engine, "Engine was added.");
-        //XXX Bug 493051
-        //ss.currentEngine = engine;
+        ss.currentEngine = engine;
         break;
       case "engine-current":
         ok(ss.currentEngine.name == "Bug 426329", "currentEngine set");
diff --git a/browser/components/search/test/browser_contextmenu.js b/browser/components/search/test/browser_contextmenu.js
index 3ac69dbbaa3c..f34bbc60bb6e 100644
--- a/browser/components/search/test/browser_contextmenu.js
+++ b/browser/components/search/test/browser_contextmenu.js
@@ -16,8 +16,7 @@ function test() {
       case "engine-added":
         var engine = ss.getEngineByName(ENGINE_NAME);
         ok(engine, "Engine was added.");
-        //XXX Bug 493051
-        //ss.currentEngine = engine;
+        ss.currentEngine = engine;
         break;
       case "engine-current":
         is(ss.currentEngine.name, ENGINE_NAME, "currentEngine set");
diff --git a/browser/components/search/test/browser_private_search_perwindowpb.js b/browser/components/search/test/browser_private_search_perwindowpb.js
index 2dc911bd3ace..24c733e5e615 100644
--- a/browser/components/search/test/browser_private_search_perwindowpb.js
+++ b/browser/components/search/test/browser_private_search_perwindowpb.js
@@ -42,20 +42,18 @@ function test() {
   }
 
   function addEngine(aCallback) {
-    function observer(aSub, aTopic, aData) {
-      switch (aData) {
-        case "engine-current":
-          ok(Services.search.currentEngine.name == "Bug 426329",
-             "currentEngine set");
-          aCallback();
-          break;
+    let installCallback = {
+      onSuccess: function (engine) {
+        Services.search.currentEngine = engine;
+        aCallback();
+      },
+      onError: function (errorCode) {
+        ok(false, "failed to install engine: " + errorCode);
       }
-    }
-
-    Services.obs.addObserver(observer, "browser-search-engine-modified", false);
-    Services.search.addEngine(
-      engineURL + "426329.xml", Ci.nsISearchEngine.DATA_XML,
-      "data:image/x-icon,%00", false);
+    };
+    Services.search.addEngine(engineURL + "426329.xml",
+                              Ci.nsISearchEngine.DATA_XML,
+                              "data:image/x-icon,%00", false, installCallback);
   }
 
   function testOnWindow(aIsPrivate, aCallback) {
diff --git a/netwerk/base/public/nsIBrowserSearchService.idl b/netwerk/base/public/nsIBrowserSearchService.idl
index b441050a72df..726a64a0333d 100644
--- a/netwerk/base/public/nsIBrowserSearchService.idl
+++ b/netwerk/base/public/nsIBrowserSearchService.idl
@@ -140,6 +140,30 @@ interface nsISearchEngine : nsISupports
 
 };
 
+[scriptable, uuid(9fc39136-f08b-46d3-b232-96f4b7b0e235)]
+interface nsISearchInstallCallback : nsISupports
+{
+  const unsigned long ERROR_UNKNOWN_FAILURE = 0x1;
+  const unsigned long ERROR_DUPLICATE_ENGINE = 0x2;
+
+  /**
+   * Called to indicate that the engine addition process succeeded.
+   *
+   * @param engine
+   *        The nsISearchEngine object that was added (will not be null).
+   */
+  void onSuccess(in nsISearchEngine engine);
+
+  /**
+   * Called to indicate that the engine addition process failed.
+   *
+   * @param errorCode
+   *        One of the ERROR_* values described above indicating the cause of
+   *        the failure.
+   */
+  void onError(in unsigned long errorCode);
+};
+
 /**
  * Callback for asynchronous initialization of nsIBrowserSearchService
  */
@@ -186,8 +210,7 @@ interface nsIBrowserSearchService : nsISupports
    * Adds a new search engine from the file at the supplied URI, optionally
    * asking the user for confirmation first.  If a confirmation dialog is
    * shown, it will offer the option to begin using the newly added engine
-   * right away; if no confirmation dialog is shown, the new engine will be
-   * used right away automatically.
+   * right away.
    *
    * @param engineURL
    *        The URL to the search engine's description file.
@@ -207,11 +230,16 @@ interface nsIBrowserSearchService : nsISupports
    *        value is false, the engine will be added to the list upon successful
    *        load, but it will not be selected as the current engine.
    *
+   * @param callback
+   *        A nsISearchInstallCallback that will be notified when the
+   *        addition is complete, or if the addition fails. It will not be
+   *        called if addEngine throws an exception.
+   *
    * @throws NS_ERROR_FAILURE if the type is invalid, or if the description
    *         file cannot be successfully loaded.
    */
   void addEngine(in AString engineURL, in long dataType, in AString iconURL,
-                 in boolean confirm);
+                 in boolean confirm, [optional] in nsISearchInstallCallback callback);
 
   /**
    * Adds a new search engine, without asking the user for confirmation and
diff --git a/toolkit/components/search/nsSearchService.js b/toolkit/components/search/nsSearchService.js
index 32b5a6e77c0c..c6586c6efad3 100644
--- a/toolkit/components/search/nsSearchService.js
+++ b/toolkit/components/search/nsSearchService.js
@@ -5,6 +5,7 @@
 const Ci = Components.interfaces;
 const Cc = Components.classes;
 const Cr = Components.results;
+const Cu = Components.utils;
 
 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 Components.utils.import("resource://gre/modules/Services.jsm");
@@ -1150,7 +1151,10 @@ Engine.prototype = {
   _confirm: false,
   // Whether to set this as the current engine as soon as it is loaded.  This
   // is only used when the engine is first added to the list.
-  _useNow: true,
+  _useNow: false,
+  // A function to be invoked when this engine object's addition completes (or
+  // fails). Only used for installation via addEngine.
+  _installCallback: null,
   // Where the engine was loaded from. Can be one of: SEARCH_APP_DIR,
   // SEARCH_PROFILE_DIR, SEARCH_IN_EXTENSION.
   __installLocation: null,
@@ -1304,10 +1308,19 @@ Engine.prototype = {
    */
   _onLoad: function SRCH_ENG_onLoad(aBytes, aEngine) {
     /**
-     * Handle an error during the load of an engine by prompting the user to
-     * notify him that the load failed.
+     * Handle an error during the load of an engine by notifying the engine's
+     * error callback, if any.
      */
-    function onError(aErrorString, aTitleString) {
+    function onError(errorCode = Ci.nsISearchInstallCallback.ERROR_UNKNOWN_FAILURE) {
+      // Notify the callback of the failure
+      if (aEngine._installCallback) {
+        aEngine._installCallback(errorCode);
+      }
+    }
+
+    function promptError(strings = {}, error = undefined) {
+      onError(error);
+
       if (aEngine._engineToUpdate) {
         // We're in an update, so just fail quietly
         LOG("updating " + aEngine._engineToUpdate.name + " failed");
@@ -1317,8 +1330,8 @@ Engine.prototype = {
       var brandName = brandBundle.GetStringFromName("brandShortName");
 
       var searchBundle = Services.strings.createBundle(SEARCH_BUNDLE);
-      var msgStringName = aErrorString || "error_loading_engine_msg2";
-      var titleStringName = aTitleString || "error_loading_engine_title";
+      var msgStringName = strings.error || "error_loading_engine_msg2";
+      var titleStringName = strings.title || "error_loading_engine_title";
       var title = searchBundle.GetStringFromName(titleStringName);
       var text = searchBundle.formatStringFromName(msgStringName,
                                                    [brandName, aEngine._location],
@@ -1328,7 +1341,7 @@ Engine.prototype = {
     }
 
     if (!aBytes) {
-      onError();
+      promptError();
       return;
     }
 
@@ -1351,7 +1364,7 @@ Engine.prototype = {
         aEngine._data = aBytes;
         break;
       default:
-        onError();
+        promptError();
         LOG("_onLoad: Bogus engine _dataType: \"" + this._dataType + "\"");
         return;
     }
@@ -1362,7 +1375,7 @@ Engine.prototype = {
     } catch (ex) {
       LOG("_onLoad: Failed to init engine!\n" + ex);
       // Report an error to the user
-      onError();
+      promptError();
       return;
     }
 
@@ -1371,9 +1384,9 @@ Engine.prototype = {
     // otherwise we fail silently.
     if (!engineToUpdate) {
       if (Services.search.getEngineByName(aEngine.name)) {
-        if (aEngine._confirm)
-          onError("error_duplicate_engine_msg", "error_invalid_engine_title");
-
+        promptError({ error: "error_duplicate_engine_msg",
+                      title: "error_invalid_engine_title"
+                    }, Ci.nsISearchInstallCallback.ERROR_DUPLICATE_ENGINE);
         LOG("_onLoad: duplicate engine found, bailing");
         return;
       }
@@ -1386,8 +1399,10 @@ Engine.prototype = {
       var confirmation = aEngine._confirmAddEngine();
       LOG("_onLoad: confirm is " + confirmation.confirmed +
           "; useNow is " + confirmation.useNow);
-      if (!confirmation.confirmed)
+      if (!confirmation.confirmed) {
+        onError();
         return;
+      }
       aEngine._useNow = confirmation.useNow;
     }
 
@@ -1414,6 +1429,7 @@ Engine.prototype = {
           if (!newSelfURL || !newSelfURL._hasRelation("self")) {
             LOG("_onLoad: updateURL missing in updated engine for " +
                 aEngine.name + " aborted");
+            onError();
             return;
           }
           newUpdateURL = newSelfURL.template;
@@ -1421,6 +1437,7 @@ Engine.prototype = {
 
         if (oldUpdateURL != newUpdateURL) {
           LOG("_onLoad: updateURLs do not match! Update of " + aEngine.name + " aborted");
+          onError();
           return;
         }
       }
@@ -1428,10 +1445,6 @@ Engine.prototype = {
       // Set the new engine's icon, if it doesn't yet have one.
       if (!aEngine._iconURI && engineToUpdate._iconURI)
         aEngine._iconURI = engineToUpdate._iconURI;
-
-      // Clear the "use now" flag since we don't want to be changing the
-      // current engine for an update.
-      aEngine._useNow = false;
     }
 
     // Write the engine to file. For readOnly engines, they'll be stored in the
@@ -1442,6 +1455,11 @@ Engine.prototype = {
     // Notify the search service of the successful load. It will deal with
     // updates by checking aEngine._engineToUpdate.
     notifyAction(aEngine, SEARCH_ENGINE_LOADED);
+
+    // Notify the callback if needed
+    if (aEngine._installCallback) {
+      aEngine._installCallback();
+    }
   },
 
   /**
@@ -3341,14 +3359,31 @@ SearchService.prototype = {
   },
 
   addEngine: function SRCH_SVC_addEngine(aEngineURL, aDataType, aIconURL,
-                                         aConfirm) {
+                                         aConfirm, aCallback) {
     LOG("addEngine: Adding \"" + aEngineURL + "\".");
     this._ensureInitialized();
     try {
       var uri = makeURI(aEngineURL);
       var engine = new Engine(uri, aDataType, false);
+      if (aCallback) {
+        engine._installCallback = function (errorCode) {
+          try {
+            if (errorCode == null)
+              aCallback.onSuccess(engine);
+            else
+              aCallback.onError(errorCode);
+          } catch (ex) {
+            Cu.reportError("Error invoking addEngine install callback: " + ex);
+          }
+          // Clear the reference to the callback now that it's been invoked.
+          engine._installCallback = null;
+        };
+      }
       engine._initFromURI();
     } catch (ex) {
+      // Drop the reference to the callback, if set
+      if (engine)
+        engine._installCallback = null;
       FAIL("addEngine: Error adding engine:\n" + ex, Cr.NS_ERROR_FAILURE);
     }
     engine._setIcon(aIconURL, false);
diff --git a/toolkit/components/search/tests/xpcshell/head_search.js b/toolkit/components/search/tests/xpcshell/head_search.js
index 4775ae4a0177..4eb221642fa7 100644
--- a/toolkit/components/search/tests/xpcshell/head_search.js
+++ b/toolkit/components/search/tests/xpcshell/head_search.js
@@ -97,7 +97,7 @@ function afterCache(callback)
   Services.obs.addObserver(obs, "browser-search-service", false);
 }
 
-function  parseJsonFromStream(aInputStream) {
+function parseJsonFromStream(aInputStream) {
   const json = Cc["@mozilla.org/dom/json;1"].createInstance(Components.interfaces.nsIJSON);
   const data = json.decodeFromStream(aInputStream, aInputStream.available());
   return data;
diff --git a/toolkit/components/search/tests/xpcshell/test_addEngine_callback.js b/toolkit/components/search/tests/xpcshell/test_addEngine_callback.js
new file mode 100644
index 000000000000..7e5446f7b42b
--- /dev/null
+++ b/toolkit/components/search/tests/xpcshell/test_addEngine_callback.js
@@ -0,0 +1,89 @@
+/* Any copyright is dedicated to the Public Domain.
+ *    http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/*
+ * Tests covering nsIBrowserSearchService::addEngine's optional callback.
+ */
+
+"use strict";
+
+const Ci = Components.interfaces;
+
+Components.utils.import("resource://testing-common/httpd.js");
+
+// First test inits the search service
+add_test(function init_search_service() {
+  Services.search.init(function (status) {
+    if (!Components.isSuccessCode(status))
+      do_throw("Failed to initialize search service");
+
+    run_next_test();
+  });
+});
+
+// Simple test of the search callback
+add_test(function simple_callback_test() {
+  let searchCallback = {
+    onSuccess: function (engine) {
+      do_check_true(!!engine);
+      do_check_neq(engine.name, Services.search.defaultEngine.name);
+      run_next_test();
+    },
+    onError: function (errorCode) {
+      do_throw("search callback returned error: " + errorCode);
+    }
+  }
+  Services.search.addEngine("http://localhost:4444/data/engine.xml",
+                            Ci.nsISearchEngine.DATA_XML,
+                            null, false, searchCallback);
+});
+
+// Test of the search callback on duplicate engine failures
+add_test(function duplicate_failure_test() {
+  let searchCallback = {
+    onSuccess: function (engine) {
+      do_throw("this addition should not have succeeded");
+    },
+    onError: function (errorCode) {
+      do_check_true(!!errorCode);
+      do_check_eq(errorCode, Ci.nsISearchInstallCallback.ERROR_DUPLICATE_ENGINE);
+      run_next_test();
+    }
+  }
+  // Re-add the same engine added in the previous test
+  Services.search.addEngine("http://localhost:4444/data/engine.xml",
+                            Ci.nsISearchEngine.DATA_XML,
+                            null, false, searchCallback);
+});
+
+// Test of the search callback on failure to load the engine failures
+add_test(function load_failure_test() {
+  let searchCallback = {
+    onSuccess: function (engine) {
+      do_throw("this addition should not have succeeded");
+    },
+    onError: function (errorCode) {
+      do_check_true(!!errorCode);
+      do_check_eq(errorCode, Ci.nsISearchInstallCallback.ERROR_UNKNOWN_FAILURE);
+      run_next_test();
+    }
+  }
+  // Try adding an engine that doesn't exist
+  Services.search.addEngine("http://invalid/data/engine.xml",
+                            Ci.nsISearchEngine.DATA_XML,
+                            null, false, searchCallback);
+});
+
+function run_test() {
+  updateAppInfo();
+
+  let httpServer = new HttpServer();
+  httpServer.start(4444);
+  httpServer.registerDirectory("/", do_get_cwd());
+
+  do_register_cleanup(function cleanup() {
+    httpServer.stop(function() {});
+  });
+
+  run_next_test();
+}
diff --git a/toolkit/components/search/tests/xpcshell/test_notifications.js b/toolkit/components/search/tests/xpcshell/test_notifications.js
index a75a77d60671..485ed0e6e136 100644
--- a/toolkit/components/search/tests/xpcshell/test_notifications.js
+++ b/toolkit/components/search/tests/xpcshell/test_notifications.js
@@ -40,8 +40,7 @@ function search_observer(subject, topic, data) {
       let retrievedEngine = Services.search.getEngineByName("Test search engine");
       do_check_eq(engine, retrievedEngine);
       Services.search.defaultEngine = engine;
-      // XXX bug 493051
-      // Services.search.currentEngine = engine;
+      Services.search.currentEngine = engine;
       do_execute_soon(function () {
         Services.search.removeEngine(engine);
       });
diff --git a/toolkit/components/search/tests/xpcshell/xpcshell.ini b/toolkit/components/search/tests/xpcshell/xpcshell.ini
index 858f03793c6b..0284535f3738 100644
--- a/toolkit/components/search/tests/xpcshell/xpcshell.ini
+++ b/toolkit/components/search/tests/xpcshell/xpcshell.ini
@@ -19,4 +19,4 @@ skip-if = debug && os == "linux"
 [test_engineselect.js]
 [test_prefSync.js]
 [test_notifications.js]
-
+[test_addEngine_callback.js]

From 659a01fbc0d6b53a79da0de217007430f5ca501c Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Mon, 17 Jun 2013 14:00:11 -0400
Subject: [PATCH 10/75] Bug 867108: hiding and then restoring the default
 search engine leads to the wrong engine being returned from
 searchService.defaultEngine until a restart, r=mikedeboer

--HG--
rename : toolkit/components/search/tests/xpcshell/test_engineselect.js => toolkit/components/search/tests/xpcshell/test_defaultEngine.js
extra : transplant_source : %2C%EE2%EF%EA%8Ak%D8%18%21%BB%98%18%14%BE%E9t%82%7C%BF
---
 toolkit/components/search/nsSearchService.js  |  6 +++--
 ..._engineselect.js => test_defaultEngine.js} | 23 ++++++++++++-------
 .../search/tests/xpcshell/xpcshell.ini        |  2 +-
 3 files changed, 20 insertions(+), 11 deletions(-)
 rename toolkit/components/search/tests/xpcshell/{test_engineselect.js => test_defaultEngine.js} (79%)

diff --git a/toolkit/components/search/nsSearchService.js b/toolkit/components/search/nsSearchService.js
index c6586c6efad3..8a154c15a86e 100644
--- a/toolkit/components/search/nsSearchService.js
+++ b/toolkit/components/search/nsSearchService.js
@@ -3505,13 +3505,15 @@ SearchService.prototype = {
 
   get defaultEngine() {
     this._ensureInitialized();
-    if (!this._defaultEngine || this._defaultEngine.hidden) {
+    if (!this._defaultEngine) {
       let defPref = BROWSER_SEARCH_PREF + "defaultenginename";
       let defaultEngine = this.getEngineByName(getLocalizedPref(defPref, ""))
-      if (!defaultEngine || defaultEngine.hidden)
+      if (!defaultEngine)
         defaultEngine = this._getSortedEngines(false)[0] || null;
       this._defaultEngine = defaultEngine;
     }
+    if (this._defaultEngine.hidden)
+      return this._getSortedEngines(false)[0];
     return this._defaultEngine;
   },
 
diff --git a/toolkit/components/search/tests/xpcshell/test_engineselect.js b/toolkit/components/search/tests/xpcshell/test_defaultEngine.js
similarity index 79%
rename from toolkit/components/search/tests/xpcshell/test_engineselect.js
rename to toolkit/components/search/tests/xpcshell/test_defaultEngine.js
index 86796ba393d9..7c35e8fcb662 100644
--- a/toolkit/components/search/tests/xpcshell/test_engineselect.js
+++ b/toolkit/components/search/tests/xpcshell/test_defaultEngine.js
@@ -44,22 +44,29 @@ function search_observer(aSubject, aTopic, aData) {
 
   search.defaultEngine = engine1;
   do_check_eq(search.defaultEngine, engine1);
-  
-  // Tests search defaultEngine when it changes
   search.defaultEngine = engine2
   do_check_eq(search.defaultEngine, engine2);
-
-  // Test search defaultEngine again when we change back
   search.defaultEngine = engine1;
   do_check_eq(search.defaultEngine, engine1);
 
-  // Test search defaultEngine when the current default is hidden
+  // Test that hiding the currently-default engine affects the defaultEngine getter
+  // (when the default is hidden, we fall back to the first in the list, so move
+  // our second engine to that position)
   search.moveEngine(engine2, 0);
   engine1.hidden = true;
   do_check_eq(search.defaultEngine, engine2);
-  
-  // Test search defaultEngine when it is set to a hidden engine
-  search.defaultEngine = engine1;
+
+  // Test that the default engine is restored when it is unhidden
+  engine1.hidden = false;
+  do_check_eq(search.defaultEngine, engine1);
+
+  // Test that setting defaultEngine to an already-hidden engine works, but
+  // doesn't change the return value of the getter
+  engine2.hidden = true;
+  search.moveEngine(engine1, 0)
+  search.defaultEngine = engine2;
+  do_check_eq(search.defaultEngine, engine1);
+  engine2.hidden = false;
   do_check_eq(search.defaultEngine, engine2);
 
   do_test_finished();
diff --git a/toolkit/components/search/tests/xpcshell/xpcshell.ini b/toolkit/components/search/tests/xpcshell/xpcshell.ini
index 0284535f3738..282d2ba9a068 100644
--- a/toolkit/components/search/tests/xpcshell/xpcshell.ini
+++ b/toolkit/components/search/tests/xpcshell/xpcshell.ini
@@ -16,7 +16,7 @@ skip-if = debug && os == "linux"
 [test_nodb_pluschanges.js]
 [test_save_sorted_engines.js]
 [test_purpose.js]
-[test_engineselect.js]
+[test_defaultEngine.js]
 [test_prefSync.js]
 [test_notifications.js]
 [test_addEngine_callback.js]

From f301f745e32f538cb304ff7c66de535fe7c63f95 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Mon, 17 Jun 2013 15:40:22 -0400
Subject: [PATCH 11/75] Bug 883992 - Correctly compare the host string against
 an empty string in the gtk crash reporter app; r=ted

---
 toolkit/crashreporter/client/crashreporter_gtk_common.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/toolkit/crashreporter/client/crashreporter_gtk_common.cpp b/toolkit/crashreporter/client/crashreporter_gtk_common.cpp
index b9efaf750a3f..218d4dba4ccf 100644
--- a/toolkit/crashreporter/client/crashreporter_gtk_common.cpp
+++ b/toolkit/crashreporter/client/crashreporter_gtk_common.cpp
@@ -145,7 +145,7 @@ void LoadProxyinfo()
     host = gconf_client_get_string(conf, HTTP_PROXY_DIR "/host", NULL);
     port = gconf_client_get_int(conf, HTTP_PROXY_DIR "/port", NULL);
 
-    if (port && host && host != '\0') {
+    if (port && host && *host != '\0') {
       httpproxy = g_strdup_printf("http://%s:%d/", host, port);
       gHttpProxy = httpproxy;
     }

From 6182bc668844441ad57411205919eaf55c5b7fa3 Mon Sep 17 00:00:00 2001
From: Mike Habicher <mikeh@mozilla.com>
Date: Mon, 17 Jun 2013 11:59:53 -0400
Subject: [PATCH 12/75] Bug 882328 - remove off-Main Thread JS callback
 addrefs, r=jdm

---
 dom/camera/DOMCameraControl.cpp  | 19 +++++++++++++------
 dom/camera/DOMCameraControl.h    |  6 +++++-
 dom/camera/GonkCameraControl.cpp |  8 ++++----
 3 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/dom/camera/DOMCameraControl.cpp b/dom/camera/DOMCameraControl.cpp
index fb423979bbcb..235c9a33391d 100644
--- a/dom/camera/DOMCameraControl.cpp
+++ b/dom/camera/DOMCameraControl.cpp
@@ -400,7 +400,11 @@ nsDOMCameraControl::ReleaseHardware(nsICameraReleaseCallback* onSuccess, nsICame
 class GetCameraResult : public nsRunnable
 {
 public:
-  GetCameraResult(nsDOMCameraControl* aDOMCameraControl, nsresult aResult, nsICameraGetCameraCallback* onSuccess, nsICameraErrorCallback* onError, uint64_t aWindowId)
+  GetCameraResult(nsDOMCameraControl* aDOMCameraControl,
+    nsresult aResult,
+    const nsMainThreadPtrHandle<nsICameraGetCameraCallback>& onSuccess,
+    const nsMainThreadPtrHandle<nsICameraErrorCallback>& onError,
+    uint64_t aWindowId)
     : mDOMCameraControl(aDOMCameraControl)
     , mResult(aResult)
     , mOnSuccessCb(onSuccess)
@@ -415,11 +419,11 @@ public:
     if (nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
       DOM_CAMERA_LOGT("%s : this=%p -- BEFORE CALLBACK\n", __func__, this);
       if (NS_FAILED(mResult)) {
-        if (mOnErrorCb) {
+        if (mOnErrorCb.get()) {
           mOnErrorCb->HandleEvent(NS_LITERAL_STRING("FAILURE"));
         }
       } else {
-        if (mOnSuccessCb) {
+        if (mOnSuccessCb.get()) {
           mOnSuccessCb->HandleEvent(mDOMCameraControl);
         }
       }
@@ -442,13 +446,16 @@ protected:
    */
   nsDOMCameraControl* mDOMCameraControl;
   nsresult mResult;
-  nsCOMPtr<nsICameraGetCameraCallback> mOnSuccessCb;
-  nsCOMPtr<nsICameraErrorCallback> mOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraGetCameraCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback> mOnErrorCb;
   uint64_t mWindowId;
 };
 
 nsresult
-nsDOMCameraControl::Result(nsresult aResult, nsICameraGetCameraCallback* onSuccess, nsICameraErrorCallback* onError, uint64_t aWindowId)
+nsDOMCameraControl::Result(nsresult aResult,
+                           const nsMainThreadPtrHandle<nsICameraGetCameraCallback>& onSuccess,
+                           const nsMainThreadPtrHandle<nsICameraErrorCallback>& onError,
+                           uint64_t aWindowId)
 {
   nsCOMPtr<GetCameraResult> getCameraResult = new GetCameraResult(this, aResult, onSuccess, onError, aWindowId);
   return NS_DispatchToMainThread(getCameraResult);
diff --git a/dom/camera/DOMCameraControl.h b/dom/camera/DOMCameraControl.h
index 4e0015a3b496..ab0a0a82babc 100644
--- a/dom/camera/DOMCameraControl.h
+++ b/dom/camera/DOMCameraControl.h
@@ -14,6 +14,7 @@
 #include "nsIDOMCameraManager.h"
 #include "CameraCommon.h"
 #include "AudioChannelAgent.h"
+#include "nsProxyRelease.h"
 
 namespace mozilla {
 
@@ -28,7 +29,10 @@ public:
   nsDOMCameraControl(uint32_t aCameraId, nsIThread* aCameraThread,
                      nsICameraGetCameraCallback* onSuccess,
                      nsICameraErrorCallback* onError, uint64_t aWindowId);
-  nsresult Result(nsresult aResult, nsICameraGetCameraCallback* onSuccess, nsICameraErrorCallback* onError, uint64_t aWindowId);
+  nsresult Result(nsresult aResult,
+                  const nsMainThreadPtrHandle<nsICameraGetCameraCallback>& onSuccess,
+                  const nsMainThreadPtrHandle<nsICameraErrorCallback>& onError,
+                  uint64_t aWindowId);
   nsRefPtr<ICameraControl> GetNativeCameraControl();
 
   void Shutdown();
diff --git a/dom/camera/GonkCameraControl.cpp b/dom/camera/GonkCameraControl.cpp
index 57588112f4dc..4ef81bbfba8f 100644
--- a/dom/camera/GonkCameraControl.cpp
+++ b/dom/camera/GonkCameraControl.cpp
@@ -174,8 +174,8 @@ public:
   InitGonkCameraControl(nsGonkCameraControl* aCameraControl, nsDOMCameraControl* aDOMCameraControl, nsICameraGetCameraCallback* onSuccess, nsICameraErrorCallback* onError, uint64_t aWindowId)
     : mCameraControl(aCameraControl)
     , mDOMCameraControl(aDOMCameraControl)
-    , mOnSuccessCb(onSuccess)
-    , mOnErrorCb(onError)
+    , mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraGetCameraCallback>(onSuccess))
+    , mOnErrorCb(new nsMainThreadPtrHolder<nsICameraErrorCallback>(onError))
     , mWindowId(aWindowId)
   {
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
@@ -195,8 +195,8 @@ public:
   nsRefPtr<nsGonkCameraControl> mCameraControl;
   // Raw pointer to DOM-facing camera control--it must NS_ADDREF itself for us
   nsDOMCameraControl* mDOMCameraControl;
-  nsCOMPtr<nsICameraGetCameraCallback> mOnSuccessCb;
-  nsCOMPtr<nsICameraErrorCallback> mOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraGetCameraCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback> mOnErrorCb;
   uint64_t mWindowId;
 };
 

From adb213ed89e55c6a77fe11acb8e67544a712937b Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Mon, 17 Jun 2013 15:44:07 -0400
Subject: [PATCH 13/75] Backed out 4 changesets (bug 497003) for intermittent
 OSX crashes.

Backed out changeset 43223a927976 (bug 497003)
Backed out changeset 26c1d80edf1f (bug 497003)
Backed out changeset 841ed173ba2b (bug 497003)
Backed out changeset f70770fc6dce (bug 497003)
---
 netwerk/base/public/moz.build                 |   2 -
 netwerk/base/public/nsIInputStreamPump.idl    |   7 +-
 .../public/nsIThreadRetargetableRequest.idl   |  34 ----
 .../nsIThreadRetargetableStreamListener.idl   |  34 ----
 netwerk/base/public/nsStreamListenerWrapper.h |   3 -
 netwerk/base/src/nsInputStreamPump.cpp        |  71 +-------
 netwerk/base/src/nsInputStreamPump.h          |   6 +-
 netwerk/base/src/nsStreamListenerTee.cpp      |  32 +---
 netwerk/base/src/nsStreamListenerTee.h        |   3 -
 netwerk/base/src/nsStreamListenerWrapper.cpp  |  18 +-
 netwerk/protocol/http/nsHttpChannel.cpp       | 151 +----------------
 netwerk/protocol/http/nsHttpChannel.h         |   8 -
 netwerk/test/mochitests/Makefile.in           |  21 ---
 netwerk/test/mochitests/moz.build             |   7 -
 netwerk/test/mochitests/partial_content.sjs   | 154 ------------------
 .../test_partially_cached_content.html        |  90 ----------
 netwerk/test/moz.build                        |   2 +-
 parser/html/nsHtml5StreamParser.cpp           | 110 +++----------
 parser/html/nsHtml5StreamParser.h             |  13 +-
 parser/html/nsHtml5TreeOpExecutor.h           |   1 +
 uriloader/base/nsURILoader.cpp                |  61 ++-----
 xpcom/glue/nsProxyRelease.h                   |   2 -
 22 files changed, 59 insertions(+), 771 deletions(-)
 delete mode 100644 netwerk/base/public/nsIThreadRetargetableRequest.idl
 delete mode 100644 netwerk/base/public/nsIThreadRetargetableStreamListener.idl
 delete mode 100644 netwerk/test/mochitests/Makefile.in
 delete mode 100644 netwerk/test/mochitests/moz.build
 delete mode 100644 netwerk/test/mochitests/partial_content.sjs
 delete mode 100644 netwerk/test/mochitests/test_partially_cached_content.html

diff --git a/netwerk/base/public/moz.build b/netwerk/base/public/moz.build
index cfc90acab7b9..767670975a4f 100644
--- a/netwerk/base/public/moz.build
+++ b/netwerk/base/public/moz.build
@@ -95,8 +95,6 @@ XPIDL_SOURCES += [
     'nsIStrictTransportSecurityService.idl',
     'nsISyncStreamListener.idl',
     'nsISystemProxySettings.idl',
-    'nsIThreadRetargetableRequest.idl',
-    'nsIThreadRetargetableStreamListener.idl',
     'nsITimedChannel.idl',
     'nsITraceableChannel.idl',
     'nsITransport.idl',
diff --git a/netwerk/base/public/nsIInputStreamPump.idl b/netwerk/base/public/nsIInputStreamPump.idl
index 83c29cdbb5b5..823fac5d86d6 100644
--- a/netwerk/base/public/nsIInputStreamPump.idl
+++ b/netwerk/base/public/nsIInputStreamPump.idl
@@ -11,11 +11,10 @@ interface nsIStreamListener;
  * nsIInputStreamPump
  *
  * This interface provides a means to configure and use a input stream pump
- * instance.  The input stream pump will asynchronously read from an input
- * stream, and push data to an nsIStreamListener instance.  It utilizes the
+ * instance.  The input stream pump will asynchronously read from a input
+ * stream, and push data to a nsIStreamListener instance.  It utilizes the
  * current thread's nsIEventTarget in order to make reading from the stream
- * asynchronous. A different thread can be used if the pump also implements
- * nsIThreadRetargetableRequest.
+ * asynchronous.
  *
  * If the given stream supports nsIAsyncInputStream, then the stream pump will
  * call the stream's AsyncWait method to drive the stream listener.  Otherwise,
diff --git a/netwerk/base/public/nsIThreadRetargetableRequest.idl b/netwerk/base/public/nsIThreadRetargetableRequest.idl
deleted file mode 100644
index a36291b07ad2..000000000000
--- a/netwerk/base/public/nsIThreadRetargetableRequest.idl
+++ /dev/null
@@ -1,34 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsISupports.idl"
-#include "nsIEventTarget.idl"
-
-/**
- * nsIThreadRetargetableRequest
- *
- * Should be implemented by requests that support retargeting delivery of
- * OnDataAvailable and OnStopRequest off the main thread.
- */
-[uuid(27b84c48-5a73-4ba4-a8a4-8b5e649a145e)]
-interface nsIThreadRetargetableRequest : nsISupports
-{
-  /**
-   * Called to retarget delivery of OnDataAvailable and OnStopRequest to
-   * another thread. Should only be called within the context of OnStartRequest
-   * on the main thread.
-   *
-   * @param aNewTarget New event target, e.g. thread or threadpool.
-   *
-   * Note: no return value is given. If the retargeting cannot be handled,
-   * normal delivery to the main thread will continue. As such, listeners
-   * should be ready to deal with OnDataAvailable and OnStopRequest on
-   * either the main thread or the new target thread.
-   */
-  void retargetDeliveryTo(in nsIEventTarget aNewTarget);
-};
-
-
diff --git a/netwerk/base/public/nsIThreadRetargetableStreamListener.idl b/netwerk/base/public/nsIThreadRetargetableStreamListener.idl
deleted file mode 100644
index 4f1f9fa17046..000000000000
--- a/netwerk/base/public/nsIThreadRetargetableStreamListener.idl
+++ /dev/null
@@ -1,34 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsISupports.idl"
-
-/**
- * nsIThreadRetargetableListener
- *
- * To be used by classes which implement nsIStreamListener and whose
- * OnDataAvailable and OnStopRequest may be retargeted for delivery off the
- * main thread.
- */
-[uuid(fb2304b8-f82f-4433-af68-d874a2ebbdc1)]
-interface nsIThreadRetargetableStreamListener : nsISupports
-{
-  /**
-   * Checks this listener and any next listeners it may have to verify that
-   * they can receive OnDataAvailable and OnStopRequest off the main thread.
-   * It is the responsibility of the implementing class to decide on the
-   * criteria to determine if retargeted delivery of these methods is
-   * possible, but it must check any and all nsIStreamListener objects that
-   * might be called in the listener chain.
-   *
-   * An exception should be thrown if a listener in the chain does not
-   * support retargeted delivery, i.e. if the next listener does not implement
-   * nsIThreadRetargetableStreamListener, or a call to its checkListenerChain()
-   * fails.
-   */
-  void checkListenerChain();
-};
-
diff --git a/netwerk/base/public/nsStreamListenerWrapper.h b/netwerk/base/public/nsStreamListenerWrapper.h
index af9bd2bcedca..38957d43aa1e 100644
--- a/netwerk/base/public/nsStreamListenerWrapper.h
+++ b/netwerk/base/public/nsStreamListenerWrapper.h
@@ -8,13 +8,11 @@
 #include "nsCOMPtr.h"
 #include "nsIStreamListener.h"
 #include "nsIRequestObserver.h"
-#include "nsIThreadRetargetableStreamListener.h"
 #include "mozilla/Attributes.h"
 
 // Wrapper class to make replacement of nsHttpChannel's listener
 // from JavaScript possible. It is workaround for bug 433711 and 682305.
 class nsStreamListenerWrapper MOZ_FINAL : public nsIStreamListener
-                                        , public nsIThreadRetargetableStreamListener
 {
 public:
   nsStreamListenerWrapper(nsIStreamListener *listener)
@@ -26,7 +24,6 @@ public:
   NS_DECL_ISUPPORTS
   NS_FORWARD_NSIREQUESTOBSERVER(mListener->)
   NS_FORWARD_NSISTREAMLISTENER(mListener->)
-  NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER
 
 private:
   ~nsStreamListenerWrapper() {}
diff --git a/netwerk/base/src/nsInputStreamPump.cpp b/netwerk/base/src/nsInputStreamPump.cpp
index deafbadee7aa..aff5fb79a5dd 100644
--- a/netwerk/base/src/nsInputStreamPump.cpp
+++ b/netwerk/base/src/nsInputStreamPump.cpp
@@ -11,13 +11,10 @@
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsISeekableStream.h"
 #include "nsITransport.h"
-#include "nsIThreadRetargetableStreamListener.h"
-#include "nsStreamUtils.h"
 #include "nsNetUtil.h"
 #include "nsThreadUtils.h"
 #include "nsCOMPtr.h"
 #include "prlog.h"
-#include "nsPrintfCString.h"
 #include "GeckoProfiler.h"
 #include <algorithm>
 
@@ -44,7 +41,6 @@ nsInputStreamPump::nsInputStreamPump()
     , mLoadFlags(LOAD_NORMAL)
     , mWaiting(false)
     , mCloseWhenDone(false)
-    , mRetargeting(false)
 {
 #if defined(PR_LOGGING)
     if (!gStreamPumpLog)
@@ -123,18 +119,14 @@ nsresult
 nsInputStreamPump::EnsureWaiting()
 {
     // no need to worry about multiple threads... an input stream pump lives
-    // on only one thread at a time.
-    MOZ_ASSERT(mAsyncStream);
+    // on only one thread.
+
     if (!mWaiting) {
-        MOZ_ASSERT(mTargetThread);
         nsresult rv = mAsyncStream->AsyncWait(this, 0, 0, mTargetThread);
         if (NS_FAILED(rv)) {
             NS_ERROR("AsyncWait failed");
             return rv;
         }
-        // Any retargeting during STATE_START or START_TRANSFER is complete
-        // after the call to AsyncWait; next callback wil be on mTargetThread.
-        mRetargeting = false;
         mWaiting = true;
     }
     return NS_OK;
@@ -147,9 +139,8 @@ nsInputStreamPump::EnsureWaiting()
 // although this class can only be accessed from one thread at a time, we do
 // allow its ownership to move from thread to thread, assuming the consumer
 // understands the limitations of this.
-NS_IMPL_THREADSAFE_ISUPPORTS4(nsInputStreamPump,
+NS_IMPL_THREADSAFE_ISUPPORTS3(nsInputStreamPump,
                               nsIRequest,
-                              nsIThreadRetargetableRequest,
                               nsIInputStreamCallback,
                               nsIInputStreamPump)
 
@@ -389,30 +380,15 @@ nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *stream)
             return NS_ERROR_UNEXPECTED;
         }
 
-        bool stillTransferring = (mState == STATE_TRANSFER &&
-                                  nextState == STATE_TRANSFER);
-        if (stillTransferring) {
-            NS_ASSERTION(NS_SUCCEEDED(mStatus),
-                         "Should not have failed status for ongoing transfer");
-        } else {
-            NS_ASSERTION(mState != nextState,
-                         "Only OnStateTransfer can be called more than once.");
-        }
-        if (mRetargeting) {
-            NS_ASSERTION(mState != STATE_STOP,
-                         "Retargeting should not happen during OnStateStop.");
-        }
+        if (mState == nextState && !mSuspendCount) {
+            NS_ASSERTION(mState == STATE_TRANSFER, "unexpected state");
+            NS_ASSERTION(NS_SUCCEEDED(mStatus), "unexpected status");
 
-        // Wait asynchronously if there is still data to transfer, or if
-        // delivery of data has been requested on another thread.
-        if (!mSuspendCount && (stillTransferring || mRetargeting)) {
-            mState = nextState;
             mWaiting = false;
             mStatus = EnsureWaiting();
             if (NS_SUCCEEDED(mStatus))
                 break;
             
-            // Failure to start asynchronous wait: stop transfer.
             nextState = STATE_STOP;
         }
 
@@ -575,7 +551,6 @@ nsInputStreamPump::OnStateStop()
     mAsyncStream = 0;
     mTargetThread = 0;
     mIsPending = false;
-    mRetargeting = false;
 
     mListener->OnStopRequest(this, mListenerContext, mStatus);
     mListener = 0;
@@ -586,37 +561,3 @@ nsInputStreamPump::OnStateStop()
 
     return STATE_IDLE;
 }
-
-//-----------------------------------------------------------------------------
-// nsIThreadRetargetableRequest
-//-----------------------------------------------------------------------------
-
-NS_IMETHODIMP
-nsInputStreamPump::RetargetDeliveryTo(nsIEventTarget* aNewTarget)
-{
-    NS_ENSURE_ARG(aNewTarget);
-    if (aNewTarget == mTargetThread) {
-        NS_WARNING("Retargeting delivery to same thread");
-        return NS_OK;
-    }
-    NS_ENSURE_TRUE(mState == STATE_START || mState == STATE_TRANSFER,
-                   NS_ERROR_UNEXPECTED);
-
-    // Ensure that |mListener| and any subsequent listeners can be retargeted
-    // to another thread.
-    nsresult rv = NS_OK;
-    nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
-        do_QueryInterface(mListener, &rv);
-    if (NS_SUCCEEDED(rv) && retargetableListener) {
-        rv = retargetableListener->CheckListenerChain();
-        if (NS_SUCCEEDED(rv)) {
-            mTargetThread = aNewTarget;
-            mRetargeting = true;
-        }
-    }
-    LOG(("nsInputStreamPump::RetargetDeliveryTo [this=%x aNewTarget=%p] "
-         "%s listener [%p] rv[%x]",
-         this, aNewTarget, (mTargetThread == aNewTarget ? "success" : "failure"),
-         (nsIStreamListener*)mListener, rv));
-    return rv;
-}
diff --git a/netwerk/base/src/nsInputStreamPump.h b/netwerk/base/src/nsInputStreamPump.h
index c9c2e440ea8c..ee72b0b8c0e0 100644
--- a/netwerk/base/src/nsInputStreamPump.h
+++ b/netwerk/base/src/nsInputStreamPump.h
@@ -15,20 +15,17 @@
 #include "nsIProgressEventSink.h"
 #include "nsIAsyncInputStream.h"
 #include "nsIThread.h"
-#include "nsIThreadRetargetableRequest.h"
 #include "nsCOMPtr.h"
 #include "mozilla/Attributes.h"
 
 class nsInputStreamPump MOZ_FINAL : public nsIInputStreamPump
                                   , public nsIInputStreamCallback
-                                  , public nsIThreadRetargetableRequest
 {
 public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSIREQUEST
     NS_DECL_NSIINPUTSTREAMPUMP
     NS_DECL_NSIINPUTSTREAMCALLBACK
-    NS_DECL_NSITHREADRETARGETABLEREQUEST
 
     nsInputStreamPump(); 
     ~nsInputStreamPump();
@@ -74,7 +71,7 @@ protected:
     nsCOMPtr<nsILoadGroup>        mLoadGroup;
     nsCOMPtr<nsIStreamListener>   mListener;
     nsCOMPtr<nsISupports>         mListenerContext;
-    nsCOMPtr<nsIEventTarget>      mTargetThread;
+    nsCOMPtr<nsIThread>           mTargetThread;
     nsCOMPtr<nsIInputStream>      mStream;
     nsCOMPtr<nsIAsyncInputStream> mAsyncStream;
     uint64_t                      mStreamOffset;
@@ -87,7 +84,6 @@ protected:
     bool                          mIsPending;
     bool                          mWaiting; // true if waiting on async source
     bool                          mCloseWhenDone;
-    bool                          mRetargeting;
 };
 
 #endif // !nsInputStreamChannel_h__
diff --git a/netwerk/base/src/nsStreamListenerTee.cpp b/netwerk/base/src/nsStreamListenerTee.cpp
index 625cd75efa71..51d7b47d16b0 100644
--- a/netwerk/base/src/nsStreamListenerTee.cpp
+++ b/netwerk/base/src/nsStreamListenerTee.cpp
@@ -5,11 +5,10 @@
 #include "nsStreamListenerTee.h"
 #include "nsProxyRelease.h"
 
-NS_IMPL_THREADSAFE_ISUPPORTS4(nsStreamListenerTee,
-                              nsIStreamListener,
-                              nsIRequestObserver,
-                              nsIStreamListenerTee,
-                              nsIThreadRetargetableStreamListener)
+NS_IMPL_ISUPPORTS3(nsStreamListenerTee,
+                   nsIStreamListener,
+                   nsIRequestObserver,
+                   nsIStreamListenerTee)
 
 NS_IMETHODIMP
 nsStreamListenerTee::OnStartRequest(nsIRequest *request,
@@ -93,29 +92,6 @@ nsStreamListenerTee::OnDataAvailable(nsIRequest *request,
     return mListener->OnDataAvailable(request, context, tee, offset, count);
 }
 
-NS_IMETHODIMP
-nsStreamListenerTee::CheckListenerChain()
-{
-    NS_ASSERTION(NS_IsMainThread(), "Should be on main thread!");
-    nsresult rv = NS_OK;
-    nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
-        do_QueryInterface(mListener, &rv);
-    if (retargetableListener) {
-        rv = retargetableListener->CheckListenerChain();
-    }
-    if (NS_FAILED(rv)) {
-      return rv;
-    }
-    if (!mObserver) {
-      return rv;
-    }
-    retargetableListener = do_QueryInterface(mObserver, &rv);
-    if (retargetableListener) {
-        rv = retargetableListener->CheckListenerChain();
-    }
-    return rv;
-}
-
 NS_IMETHODIMP
 nsStreamListenerTee::Init(nsIStreamListener *listener,
                           nsIOutputStream *sink,
diff --git a/netwerk/base/src/nsStreamListenerTee.h b/netwerk/base/src/nsStreamListenerTee.h
index 601f3b5e9ad9..133aba33fe05 100644
--- a/netwerk/base/src/nsStreamListenerTee.h
+++ b/netwerk/base/src/nsStreamListenerTee.h
@@ -6,20 +6,17 @@
 #define nsStreamListenerTee_h__
 
 #include "nsIStreamListenerTee.h"
-#include "nsIThreadRetargetableStreamListener.h"
 #include "nsIInputStreamTee.h"
 #include "nsIOutputStream.h"
 #include "nsCOMPtr.h"
 #include "nsIEventTarget.h"
 
 class nsStreamListenerTee : public nsIStreamListenerTee
-                          , public nsIThreadRetargetableStreamListener
 {
 public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSIREQUESTOBSERVER
     NS_DECL_NSISTREAMLISTENER
-    NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER
     NS_DECL_NSISTREAMLISTENERTEE
 
     nsStreamListenerTee() { }
diff --git a/netwerk/base/src/nsStreamListenerWrapper.cpp b/netwerk/base/src/nsStreamListenerWrapper.cpp
index ada9a1d4890e..0b2cd7b3dc7c 100644
--- a/netwerk/base/src/nsStreamListenerWrapper.cpp
+++ b/netwerk/base/src/nsStreamListenerWrapper.cpp
@@ -3,22 +3,8 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsStreamListenerWrapper.h"
-#include "nsThreadUtils.h"
 
-NS_IMPL_ISUPPORTS3(nsStreamListenerWrapper,
+NS_IMPL_ISUPPORTS2(nsStreamListenerWrapper,
                    nsIStreamListener,
-                   nsIRequestObserver,
-                   nsIThreadRetargetableStreamListener)
+                   nsIRequestObserver)
 
-NS_IMETHODIMP
-nsStreamListenerWrapper::CheckListenerChain()
-{
-    NS_ASSERTION(NS_IsMainThread(), "Should be on main thread!");
-    nsresult rv = NS_OK;
-    nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
-        do_QueryInterface(mListener, &rv);
-    if (retargetableListener) {
-        rv = retargetableListener->CheckListenerChain();
-    }
-    return rv;
-}
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index a009c3e02ea8..9d31f08bad11 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -29,7 +29,6 @@
 #include "nsIRedirectResultListener.h"
 #include "mozilla/TimeStamp.h"
 #include "nsError.h"
-#include "nsPrintfCString.h"
 #include "nsAlgorithm.h"
 #include "GeckoProfiler.h"
 #include "nsIConsoleService.h"
@@ -4253,8 +4252,6 @@ NS_INTERFACE_MAP_BEGIN(nsHttpChannel)
     NS_INTERFACE_MAP_ENTRY(nsIApplicationCacheChannel)
     NS_INTERFACE_MAP_ENTRY(nsIAsyncVerifyRedirectCallback)
     NS_INTERFACE_MAP_ENTRY(nsITimedChannel)
-    NS_INTERFACE_MAP_ENTRY(nsIThreadRetargetableRequest)
-    NS_INTERFACE_MAP_ENTRY(nsIThreadRetargetableStreamListener)
 NS_INTERFACE_MAP_END_INHERITING(HttpBaseChannel)
 
 //-----------------------------------------------------------------------------
@@ -4946,42 +4943,6 @@ nsHttpChannel::ContinueOnStartRequest3(nsresult result)
     return CallOnStartRequest();
 }
 
-class OnStopRequestCleanupEvent : public nsRunnable
-{
-public:
-    OnStopRequestCleanupEvent(nsHttpChannel *aHttpChannel,
-                              nsresult aStatus)
-    : mHttpChannel(aHttpChannel)
-    , mStatus(aStatus)
-    {
-        MOZ_ASSERT(!NS_IsMainThread(), "Shouldn't be created on main thread");
-        NS_ASSERTION(aHttpChannel, "aHttpChannel should not be null");
-    }
-
-    NS_IMETHOD Run()
-    {
-        MOZ_ASSERT(NS_IsMainThread(), "Should run on main thread");
-        if (mHttpChannel) {
-            mHttpChannel->OnStopRequestCleanup(mStatus);
-        }
-        return NS_OK;
-    }
-private:
-    nsRefPtr<nsHttpChannel> mHttpChannel;
-    nsresult mStatus;
-};
-
-nsresult
-nsHttpChannel::OnStopRequestCleanup(nsresult aStatus)
-{
-    NS_ASSERTION(NS_IsMainThread(), "Should be on main thread");
-    if (mLoadGroup) {
-        mLoadGroup->RemoveRequest(this, nullptr, aStatus);
-    }
-    ReleaseListeners();
-    return NS_OK;
-}
-
 NS_IMETHODIMP
 nsHttpChannel::OnStopRequest(nsIRequest *request, nsISupports *ctxt, nsresult status)
 {
@@ -5111,17 +5072,14 @@ nsHttpChannel::OnStopRequest(nsIRequest *request, nsISupports *ctxt, nsresult st
     if (mOfflineCacheEntry)
         CloseOfflineCacheEntry();
 
-    if (NS_IsMainThread()) {
-        OnStopRequestCleanup(status);
-    } else {
-        nsresult rv = NS_DispatchToMainThread(
-            new OnStopRequestCleanupEvent(this, status));
-        NS_ENSURE_SUCCESS(rv, rv);
-    }
+    if (mLoadGroup)
+        mLoadGroup->RemoveRequest(this, nullptr, status);
 
     // We don't need this info anymore
     CleanRedirectCacheChainIfNecessary();
 
+    ReleaseListeners();
+
     return NS_OK;
 }
 
@@ -5129,37 +5087,6 @@ nsHttpChannel::OnStopRequest(nsIRequest *request, nsISupports *ctxt, nsresult st
 // nsHttpChannel::nsIStreamListener
 //-----------------------------------------------------------------------------
 
-class OnTransportStatusAsyncEvent : public nsRunnable
-{
-public:
-    OnTransportStatusAsyncEvent(nsITransportEventSink* aEventSink,
-                                nsresult aTransportStatus,
-                                uint64_t aProgress,
-                                uint64_t aProgressMax)
-    : mEventSink(aEventSink)
-    , mTransportStatus(aTransportStatus)
-    , mProgress(aProgress)
-    , mProgressMax(aProgressMax)
-    {
-        MOZ_ASSERT(!NS_IsMainThread(), "Shouldn't be created on main thread");
-    }
-
-    NS_IMETHOD Run()
-    {
-        MOZ_ASSERT(NS_IsMainThread(), "Should run on main thread");
-        if (mEventSink) {
-            mEventSink->OnTransportStatus(nullptr, mTransportStatus,
-                                          mProgress, mProgressMax);
-        }
-        return NS_OK;
-    }
-private:
-    nsCOMPtr<nsITransportEventSink> mEventSink;
-    nsresult mTransportStatus;
-    uint64_t mProgress;
-    uint64_t mProgressMax;
-};
-
 NS_IMETHODIMP
 nsHttpChannel::OnDataAvailable(nsIRequest *request, nsISupports *ctxt,
                                nsIInputStream *input,
@@ -5204,14 +5131,7 @@ nsHttpChannel::OnDataAvailable(nsIRequest *request, nsISupports *ctxt,
         uint64_t progress = mLogicalOffset + uint64_t(count);
         MOZ_ASSERT(progress <= progressMax, "unexpected progress values");
 
-        if (NS_IsMainThread()) {
-            OnTransportStatus(nullptr, transportStatus, progress, progressMax);
-        } else {
-            nsresult rv = NS_DispatchToMainThread(
-                new OnTransportStatusAsyncEvent(this, transportStatus,
-                                                progress, progressMax));
-            NS_ENSURE_SUCCESS(rv, rv);
-        }
+        OnTransportStatus(nullptr, transportStatus, progress, progressMax);
 
         //
         // we have to manually keep the logical offset of the stream up-to-date.
@@ -5235,67 +5155,6 @@ nsHttpChannel::OnDataAvailable(nsIRequest *request, nsISupports *ctxt,
     return NS_ERROR_ABORT;
 }
 
-//-----------------------------------------------------------------------------
-// nsHttpChannel::nsIThreadRetargetableRequest
-//-----------------------------------------------------------------------------
-
-NS_IMETHODIMP
-nsHttpChannel::RetargetDeliveryTo(nsIEventTarget* aNewTarget)
-{
-    MOZ_ASSERT(NS_IsMainThread(), "Should be called on main thread only");
-
-    NS_ENSURE_ARG(aNewTarget);
-    if (aNewTarget == NS_GetCurrentThread()) {
-        NS_WARNING("Retargeting delivery to same thread");
-        return NS_OK;
-    }
-    NS_ENSURE_TRUE(mTransactionPump || mCachePump, NS_ERROR_NOT_AVAILABLE);
-
-    nsresult rv = NS_OK;
-    // If both cache pump and transaction pump exist, we're probably dealing
-    // with partially cached content. So, we must be able to retarget both.
-    nsCOMPtr<nsIThreadRetargetableRequest> retargetableCachePump;
-    nsCOMPtr<nsIThreadRetargetableRequest> retargetableTransactionPump;
-    if (mCachePump) {
-        retargetableCachePump = do_QueryObject(mCachePump);
-        // nsInputStreamPump should implement this interface.
-        MOZ_ASSERT(retargetableCachePump);
-        rv = retargetableCachePump->RetargetDeliveryTo(aNewTarget);
-    }
-    if (NS_SUCCEEDED(rv) && mTransactionPump) {
-        retargetableTransactionPump = do_QueryObject(mTransactionPump);
-        // nsInputStreamPump should implement this interface.
-        MOZ_ASSERT(retargetableTransactionPump);
-        rv = retargetableTransactionPump->RetargetDeliveryTo(aNewTarget);
-
-        // If retarget fails for transaction pump, we must restore mCachePump.
-        if (NS_FAILED(rv) && retargetableCachePump) {
-            nsCOMPtr<nsIThread> mainThread;
-            rv = NS_GetMainThread(getter_AddRefs(mainThread));
-            NS_ENSURE_SUCCESS(rv, rv);
-            rv = retargetableCachePump->RetargetDeliveryTo(mainThread);
-        }
-    }
-    return rv;
-}
-
-//-----------------------------------------------------------------------------
-// nsHttpChannel::nsThreadRetargetableStreamListener
-//-----------------------------------------------------------------------------
-
-NS_IMETHODIMP
-nsHttpChannel::CheckListenerChain()
-{
-    NS_ASSERTION(NS_IsMainThread(), "Should be on main thread!");
-    nsresult rv = NS_OK;
-    nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
-        do_QueryInterface(mListener, &rv);
-    if (retargetableListener) {
-        rv = retargetableListener->CheckListenerChain();
-    }
-    return rv;
-}
-
 //-----------------------------------------------------------------------------
 // nsHttpChannel::nsITransportEventSink
 //-----------------------------------------------------------------------------
diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h
index be1838f53fd2..3fd347bb06f6 100644
--- a/netwerk/protocol/http/nsHttpChannel.h
+++ b/netwerk/protocol/http/nsHttpChannel.h
@@ -28,8 +28,6 @@
 #include "nsIAsyncVerifyRedirectCallback.h"
 #include "nsITimedChannel.h"
 #include "nsIFile.h"
-#include "nsIThreadRetargetableRequest.h"
-#include "nsIThreadRetargetableStreamListener.h"
 #include "nsDNSPrefetch.h"
 #include "TimingStruct.h"
 #include "AutoClose.h"
@@ -56,14 +54,11 @@ class nsHttpChannel : public HttpBaseChannel
                     , public nsIApplicationCacheChannel
                     , public nsIAsyncVerifyRedirectCallback
                     , public nsITimedChannel
-                    , public nsIThreadRetargetableRequest
-                    , public nsIThreadRetargetableStreamListener
 {
 public:
     NS_DECL_ISUPPORTS_INHERITED
     NS_DECL_NSIREQUESTOBSERVER
     NS_DECL_NSISTREAMLISTENER
-    NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER
     NS_DECL_NSICACHEINFOCHANNEL
     NS_DECL_NSICACHINGCHANNEL
     NS_DECL_NSICACHELISTENER
@@ -74,7 +69,6 @@ public:
     NS_DECL_NSIAPPLICATIONCACHECHANNEL
     NS_DECL_NSIASYNCVERIFYREDIRECTCALLBACK
     NS_DECL_NSITIMEDCHANNEL
-    NS_DECL_NSITHREADRETARGETABLEREQUEST
 
     // nsIHttpAuthenticableChannel. We can't use
     // NS_DECL_NSIHTTPAUTHENTICABLECHANNEL because it duplicates cancel() and
@@ -156,8 +150,6 @@ public: /* internal necko use only */
 
     OfflineCacheEntryAsForeignMarker* GetOfflineCacheEntryAsForeignMarker();
 
-    nsresult OnStopRequestCleanup(nsresult aStatus);
-
 private:
     typedef nsresult (nsHttpChannel::*nsContinueRedirectionFunc)(nsresult result);
 
diff --git a/netwerk/test/mochitests/Makefile.in b/netwerk/test/mochitests/Makefile.in
deleted file mode 100644
index e1dd425ddb42..000000000000
--- a/netwerk/test/mochitests/Makefile.in
+++ /dev/null
@@ -1,21 +0,0 @@
-# -*- Mode: Makefile; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
-# vim: set ts=8 sts=2 et sw=2 tw=80:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-DEPTH		= @DEPTH@
-topsrcdir	= @top_srcdir@
-srcdir		= @srcdir@
-VPATH		= @srcdir@
-relativesrcdir	= @relativesrcdir@
-FAIL_ON_WARNINGS := 1
-
-include $(DEPTH)/config/autoconf.mk
-
-MOCHITEST_FILES = \
-  partial_content.sjs \
-  test_partially_cached_content.html \
-  $(NULL)
-
-include $(topsrcdir)/config/rules.mk
diff --git a/netwerk/test/mochitests/moz.build b/netwerk/test/mochitests/moz.build
deleted file mode 100644
index a6f020189e93..000000000000
--- a/netwerk/test/mochitests/moz.build
+++ /dev/null
@@ -1,7 +0,0 @@
-# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-MODULE = 'test_necko'
diff --git a/netwerk/test/mochitests/partial_content.sjs b/netwerk/test/mochitests/partial_content.sjs
deleted file mode 100644
index d6c82039c499..000000000000
--- a/netwerk/test/mochitests/partial_content.sjs
+++ /dev/null
@@ -1,154 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/* Debug and Error wrapper functions for dump().
- */
-function ERR(response, responseCode, responseCodeStr, msg)
-{
-  // Reset state var.
-  setState("expectedRequestType", "");
-  // Dump to console log and send to client in response.
-  dump("SERVER ERROR: " + msg + "\n");
-  response.write("HTTP/1.1" + responseCode + responseCodeStr + "\r\n");
-  response.write("Content-Type: text/html; charset=UTF-8\r\n");
-  response.write("Content-Length: " + msg.length + "\r\n");
-  response.write("\r\n");
-  response.write(msg);
-}
-
-function DBG(msg)
-{
-  // enable when you want to debug
-  if (0) {
-    // Dump to console only.
-    dump("SERVER DEBUG: " + msg + "\n");
-  }
-}
-
-/* Delivers content in parts to test partially cached content: requires two
- * requests for the same resource.
- *
- * First call will respond with partial content, but a 200 header and
- * Content-Length equal to the full content length. No Range or If-Range
- * headers are allowed in the request.
- *
- * Second call will require Range and If-Range in the request headers, and
- * will respond with the range requested.
- */
-function handleRequest(request, response)
-{
-  DBG("Trying to seize power");
-  response.seizePower();
-
-  DBG("About to check state vars");
-  // Get state var to determine if this is the first or second request.
-  var expectedRequestType;
-  var lastModified;
-  if (getState("expectedRequestType") === "") {
-    DBG("First call: Should be requesting full content.");
-    expectedRequestType = "fullRequest";
-    // Set state var for second request.
-    setState("expectedRequestType", "partialRequest");
-    // Create lastModified variable for responses.
-    lastModified = (new Date()).toUTCString();
-    setState("lastModified", lastModified);
-  } else if (getState("expectedRequestType") === "partialRequest") {
-    DBG("Second call: Should be requesting undelivered content.");
-    expectedRequestType = "partialRequest";
-    // Reset state var for first request.
-    setState("expectedRequestType", "");
-    // Get last modified date and reset state var.
-    lastModified = getState("lastModified");
-  } else {
-    ERR(response, 500, "Internal Server Error",
-        "Invalid expectedRequestType \"" + expectedRequestType + "\"in " +
-        "server state db.");
-    return;
-  }
-
-  // Look for Range and If-Range
-  var range = request.hasHeader("Range") ? request.getHeader("Range") : "";
-  var ifRange = request.hasHeader("If-Range") ? request.getHeader("If-Range") : "";
-
-  if (expectedRequestType === "fullRequest") {
-    // Should not have Range or If-Range in first request.
-    if (range && range.length > 0) {
-      ERR(response, 400, "Bad Request",
-          "Should not receive \"Range: " + range + "\" for first, full request.");
-      return;
-    }
-    if (ifRange && ifRange.length > 0) {
-      ERR(response, 400, "Bad Request",
-          "Should not receive \"Range: " + range + "\" for first, full request.");
-      return;
-    }
-  } else if (expectedRequestType === "partialRequest") {
-    // Range AND If-Range should both be present in second request.
-    if (!range) {
-      ERR(response, 400, "Bad Request",
-          "Should receive \"Range: \" for second, partial request.");
-      return;
-    }
-    if (!ifRange) {
-      ERR(response, 400, "Bad Request",
-          "Should receive \"If-Range: \" for second, partial request.");
-      return;
-    }
-  } else {
-    // Somewhat redundant, but a check for errors in this test code.
-    ERR(response, 500, "Internal Server Error",
-        "expectedRequestType not set correctly: \"" + expectedRequestType + "\"");
-    return;
-  }
-
-  // Prepare content in two parts for responses.
-  var partialContent = "<html><head></head><body><p id=\"firstResponse\">" +
-                       "First response</p>";
-  var remainderContent = "<p id=\"secondResponse\">Second response</p>" +
-                         "</body></html>";
-  var totalLength = partialContent.length + remainderContent.length;
-
-  DBG("totalLength: " + totalLength);
-
-  // Prepare common headers for the two responses.
-  date = new Date();
-  DBG("Date: " + date.toUTCString() + ", Last-Modified: " + lastModified);
-  var commonHeaders = "Date: " + date.toUTCString() + "\r\n" +
-                      "Last-Modified: " + lastModified + "\r\n" +
-                      "Content-Type: text/html; charset=UTF-8\r\n" +
-                      "ETag: abcd0123\r\n" +
-                      "Accept-Ranges: bytes\r\n";
-
-
-  // Prepare specific headers and content for first and second responses.
-  if (expectedRequestType === "fullRequest") {
-    DBG("First response: Sending partial content with a full header");
-    response.write("HTTP/1.1 200 OK\r\n");
-    response.write(commonHeaders);
-    // Set Content-Length to full length of resource.
-    response.write("Content-Length: " + totalLength + "\r\n");
-    response.write("\r\n");
-    response.write(partialContent);
-  } else if (expectedRequestType === "partialRequest") {
-    DBG("Second response: Sending remaining content with a range header");
-    response.write("HTTP/1.1 206 Partial Content\r\n");
-    response.write(commonHeaders);
-    // Set Content-Length to length of bytes transmitted.
-    response.write("Content-Length: " + remainderContent.length + "\r\n");
-    response.write("Content-Range: bytes " + partialContent.length + "-" +
-                   (totalLength - 1) + "/" + totalLength + "\r\n");
-    response.write("\r\n");
-    response.write(remainderContent);
-  } else {
-    // Somewhat redundant, but a check for errors in this test code.
-    ERR(response, 500, "Internal Server Error",
-       "Something very bad happened here: expectedRequestType is invalid " +
-       "towards the end of handleRequest! - \"" + expectedRequestType + "\"");
-    return;
-  }
-
-  response.finish();
-}
diff --git a/netwerk/test/mochitests/test_partially_cached_content.html b/netwerk/test/mochitests/test_partially_cached_content.html
deleted file mode 100644
index 05a8bca69e24..000000000000
--- a/netwerk/test/mochitests/test_partially_cached_content.html
+++ /dev/null
@@ -1,90 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-  https://bugzilla.mozilla.org/show_bug.cgi?id=497003
-
-  This test verifies that partially cached content is read from the cache first
-  and then from the network. It is written in the mochitest framework to take
-  thread retargeting into consideration of nsIStreamListener callbacks (inc.
-  nsIRequestObserver). E.g. HTML5 Stream Parser requesting retargeting of
-  nsIStreamListener callbacks to the parser thread.
--->
-<head>
-  <meta charset="UTF-8">
-  <title>Test for Bug 497003: support sending OnDataAvailable() to other threads</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-  <p><a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=497003">Mozilla Bug 497003: support sending OnDataAvailable() to other threads</a></p>
-  <p><iframe id="contentFrame" src="partial_content.sjs"></iframe></p>
-
-<pre id="test">
-<script>
-
-
-
-/* Check that the iframe has initial content only after the first load.
- */
-function expectInitialContent(e) {
-  info("expectInitialContent",
-       "First response received: should have partial content");
-  var frameWindow = document.getElementById('contentFrame').contentWindow;
-
-  // Expect "First response" in received HTML.
-  var firstResponse = frameWindow.document.getElementById('firstResponse');
-  ok(firstResponse, "First response should exist");
-  if (firstResponse) {
-    is(firstResponse.innerHTML, "First response",
-       "First response should be correct");
-  }
-
-  // Expect NOT to get any second response element.
-  var secondResponse = frameWindow.document.getElementById('secondResponse');
-  ok(!secondResponse, "Should not get text for second response in first.");
-
-  // Set up listener for second load.
-  e.target.removeEventListener("load", expectInitialContent, false);
-  e.target.addEventListener("load", expectFullContent, false);
-
-  // Reload.
-  e.target.src="partial_content.sjs";
-}
-
-/* Check that the iframe has all the content after the second load.
- */
-function expectFullContent(e)
-{
-  info("expectFullContent",
-       "Second response received: should complete content from first load");
-  var frameWindow = document.getElementById('contentFrame').contentWindow;
-
-  // Expect "First response" to still be there
-  var firstResponse = frameWindow.document.getElementById('firstResponse');
-  ok(firstResponse, "First response should exist");
-  if (firstResponse) {
-    is(firstResponse.innerHTML, "First response",
-       "First response should be correct");
-  }
-
-  // Expect "Second response" to be there also.
-  var secondResponse = frameWindow.document.getElementById('secondResponse');
-  ok(secondResponse, "Second response should exist");
-  if (secondResponse) {
-    is(secondResponse.innerHTML, "Second response",
-       "Second response should be correct");
-  }
-
-  SimpleTest.finish();
-}
-
-// Set listener for first load to expect partial content.
-document.getElementById('contentFrame')
-  .addEventListener("load", expectInitialContent, false);
-
-SimpleTest.waitForExplicitFinish();
-
-</script>
-</pre>
-</body>
-</html>
diff --git a/netwerk/test/moz.build b/netwerk/test/moz.build
index 5fa67702c16e..1a9a164b938a 100644
--- a/netwerk/test/moz.build
+++ b/netwerk/test/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-TEST_DIRS += ['httpserver', 'browser', 'mochitests']
+TEST_DIRS += ['httpserver', 'browser']
 
 MODULE = 'test_necko'
 
diff --git a/parser/html/nsHtml5StreamParser.cpp b/parser/html/nsHtml5StreamParser.cpp
index 6f00f1c85bff..13400c66a68c 100644
--- a/parser/html/nsHtml5StreamParser.cpp
+++ b/parser/html/nsHtml5StreamParser.cpp
@@ -26,8 +26,6 @@
 #include "nsINestedURI.h"
 #include "nsCharsetSource.h"
 #include "nsIWyciwygChannel.h"
-#include "nsIThreadRetargetableRequest.h"
-#include "nsPrintfCString.h"
 
 #include "mozilla/dom/EncodingUtils.h"
 
@@ -75,10 +73,9 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(nsHtml5StreamParser)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsHtml5StreamParser)
 
 NS_INTERFACE_TABLE_HEAD(nsHtml5StreamParser)
-  NS_INTERFACE_TABLE3(nsHtml5StreamParser,
+  NS_INTERFACE_TABLE2(nsHtml5StreamParser, 
                       nsIStreamListener, 
-                      nsICharsetDetectionObserver,
-                      nsIThreadRetargetableStreamListener)
+                      nsICharsetDetectionObserver)
   NS_INTERFACE_TABLE_TO_MAP_SEGUE_CYCLE_COLLECTION(nsHtml5StreamParser)
 NS_INTERFACE_MAP_END
 
@@ -929,14 +926,6 @@ nsHtml5StreamParser::OnStartRequest(nsIRequest* aRequest, nsISupports* aContext)
       mReparseForbidden = true;
       mFeedChardet = false; // can't restart anyway
     }
-
-    // Attempt to retarget delivery of data (via OnDataAvailable) to the parser
-    // thread, rather than through the main thread.
-    nsCOMPtr<nsIThreadRetargetableRequest> threadRetargetableRequest =
-      do_QueryInterface(mRequest);
-    if (threadRetargetableRequest) {
-      threadRetargetableRequest->RetargetDeliveryTo(mThread);
-    }
   }
 
   if (mCharsetSource == kCharsetFromParentFrame) {
@@ -971,22 +960,6 @@ nsHtml5StreamParser::OnStartRequest(nsIRequest* aRequest, nsISupports* aContext)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsHtml5StreamParser::CheckListenerChain()
-{
-  NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
-  if (!mObserver) {
-    return NS_OK;
-  }
-  nsresult rv;
-  nsCOMPtr<nsIThreadRetargetableStreamListener> retargetable =
-    do_QueryInterface(mObserver, &rv);
-  if (NS_SUCCEEDED(rv) && retargetable) {
-    rv = retargetable->CheckListenerChain();
-  }
-  return rv;
-}
-
 void
 nsHtml5StreamParser::DoStopRequest()
 {
@@ -1040,24 +1013,19 @@ nsHtml5StreamParser::OnStopRequest(nsIRequest* aRequest,
                              nsresult status)
 {
   NS_ASSERTION(mRequest == aRequest, "Got Stop on wrong stream.");
-  NS_ASSERTION(NS_IsMainThread() || IsParserThread(), "Wrong thread!");
+  NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
   if (mObserver) {
     mObserver->OnStopRequest(aRequest, aContext, status);
   }
-  if (NS_IsMainThread()) {
-    nsCOMPtr<nsIRunnable> stopper = new nsHtml5RequestStopper(this);
-    if (NS_FAILED(mThread->Dispatch(stopper, nsIThread::DISPATCH_NORMAL))) {
-      NS_WARNING("Dispatching StopRequest event failed.");
-    }
-  } else {
-    mozilla::MutexAutoLock autoLock(mTokenizerMutex);
-    DoStopRequest();
+  nsCOMPtr<nsIRunnable> stopper = new nsHtml5RequestStopper(this);
+  if (NS_FAILED(mThread->Dispatch(stopper, nsIThread::DISPATCH_NORMAL))) {
+    NS_WARNING("Dispatching StopRequest event failed.");
   }
   return NS_OK;
 }
 
 void
-nsHtml5StreamParser::DoDataAvailable(const uint8_t* aBuffer, uint32_t aLength)
+nsHtml5StreamParser::DoDataAvailable(uint8_t* aBuffer, uint32_t aLength)
 {
   NS_ASSERTION(IsParserThread(), "Wrong thread!");
   NS_PRECONDITION(STREAM_BEING_READ == mStreamState,
@@ -1142,58 +1110,24 @@ nsHtml5StreamParser::OnDataAvailable(nsIRequest* aRequest,
 
   NS_ASSERTION(mRequest == aRequest, "Got data on wrong stream.");
   uint32_t totalRead;
-  // Main thread to parser thread dispatch requires copying to buffer first.
-  if (NS_IsMainThread()) {
-    const mozilla::fallible_t fallible = mozilla::fallible_t();
-    nsAutoArrayPtr<uint8_t> data(new (fallible) uint8_t[aLength]);
-    if (!data) {
-      return mExecutor->MarkAsBroken(NS_ERROR_OUT_OF_MEMORY);
-    }
-    rv = aInStream->Read(reinterpret_cast<char*>(data.get()),
-                         aLength, &totalRead);
-    NS_ENSURE_SUCCESS(rv, rv);
-    NS_ASSERTION(totalRead <= aLength, "Read more bytes than were available?");
-    
-    nsCOMPtr<nsIRunnable> dataAvailable = new nsHtml5DataAvailable(this,
-                                                                   data.forget(),
-                                                                   totalRead);
-    if (NS_FAILED(mThread->Dispatch(dataAvailable, nsIThread::DISPATCH_NORMAL))) {
-      NS_WARNING("Dispatching DataAvailable event failed.");
-    }
-    return rv;
-  } else {
-    NS_ASSERTION(IsParserThread(), "Wrong thread!");
-    mozilla::MutexAutoLock autoLock(mTokenizerMutex);
-
-    // Read directly from response buffer.
-    rv = aInStream->ReadSegments(CopySegmentsToParser, this, aLength,
-                                 &totalRead);
-    if (NS_FAILED(rv)) {
-      NS_WARNING("Failed reading response data to parser");
-      return rv;
-    }
-    return NS_OK;
+  const mozilla::fallible_t fallible = mozilla::fallible_t();
+  nsAutoArrayPtr<uint8_t> data(new (fallible) uint8_t[aLength]);
+  if (!data) {
+    return mExecutor->MarkAsBroken(NS_ERROR_OUT_OF_MEMORY);
   }
+  rv = aInStream->Read(reinterpret_cast<char*>(data.get()),
+  aLength, &totalRead);
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ASSERTION(totalRead <= aLength, "Read more bytes than were available?");
+  nsCOMPtr<nsIRunnable> dataAvailable = new nsHtml5DataAvailable(this,
+                                                                 data.forget(),
+                                                                totalRead);
+  if (NS_FAILED(mThread->Dispatch(dataAvailable, nsIThread::DISPATCH_NORMAL))) {
+    NS_WARNING("Dispatching DataAvailable event failed.");
+  }
+  return rv;
 }
 
-/* static */
-NS_METHOD
-nsHtml5StreamParser::CopySegmentsToParser(nsIInputStream *aInStream,
-                                          void *aClosure,
-                                          const char *aFromSegment,
-                                          uint32_t aToOffset,
-                                          uint32_t aCount,
-                                          uint32_t *aWriteCount)
-{
-  nsHtml5StreamParser* parser = static_cast<nsHtml5StreamParser*>(aClosure);
-
-  parser->DoDataAvailable((const uint8_t*)aFromSegment, aCount);
-  // Assume DoDataAvailable consumed all available bytes.
-  *aWriteCount = aCount;
-  return NS_OK;
-}
-
-
 bool
 nsHtml5StreamParser::PreferredForInternalEncodingDecl(nsACString& aEncoding)
 {
diff --git a/parser/html/nsHtml5StreamParser.h b/parser/html/nsHtml5StreamParser.h
index c7dc36981531..a0776de5c626 100644
--- a/parser/html/nsHtml5StreamParser.h
+++ b/parser/html/nsHtml5StreamParser.h
@@ -20,7 +20,6 @@
 #include "nsHtml5Speculation.h"
 #include "nsITimer.h"
 #include "nsICharsetDetector.h"
-#include "nsIThreadRetargetableStreamListener.h"
 
 class nsHtml5Parser;
 
@@ -102,7 +101,6 @@ enum eHtml5StreamState {
 };
 
 class nsHtml5StreamParser : public nsIStreamListener,
-                            public nsIThreadRetargetableStreamListener,
                             public nsICharsetDetectionObserver {
 
   friend class nsHtml5RequestStopper;
@@ -127,8 +125,6 @@ class nsHtml5StreamParser : public nsIStreamListener,
     NS_DECL_NSIREQUESTOBSERVER
     // nsIStreamListener methods:
     NS_DECL_NSISTREAMLISTENER
-    // nsIThreadRetargetableStreamListener methods:
-    NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER
     
     // nsICharsetDetectionObserver
     /**
@@ -243,14 +239,7 @@ class nsHtml5StreamParser : public nsIStreamListener,
     
     void DoStopRequest();
     
-    void DoDataAvailable(const uint8_t* aBuffer, uint32_t aLength);
-
-    static NS_METHOD CopySegmentsToParser(nsIInputStream *aInStream,
-                                          void *aClosure,
-                                          const char *aFromSegment,
-                                          uint32_t aToOffset,
-                                          uint32_t aCount,
-                                          uint32_t *aWriteCount);
+    void DoDataAvailable(uint8_t* aBuffer, uint32_t aLength);
 
     bool IsTerminatedOrInterrupted() {
       mozilla::MutexAutoLock autoLock(mTerminatedMutex);
diff --git a/parser/html/nsHtml5TreeOpExecutor.h b/parser/html/nsHtml5TreeOpExecutor.h
index dce1a088d6e2..c01d802901b6 100644
--- a/parser/html/nsHtml5TreeOpExecutor.h
+++ b/parser/html/nsHtml5TreeOpExecutor.h
@@ -228,6 +228,7 @@ class nsHtml5TreeOpExecutor : public nsContentSink,
      * value if broken.
      */
     inline nsresult IsBroken() {
+      NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
       return mBroken;
     }
 
diff --git a/uriloader/base/nsURILoader.cpp b/uriloader/base/nsURILoader.cpp
index ebbbf7f16a74..a03930dcb48f 100644
--- a/uriloader/base/nsURILoader.cpp
+++ b/uriloader/base/nsURILoader.cpp
@@ -6,7 +6,6 @@
 
 #include "nsURILoader.h"
 #include "nsAutoPtr.h"
-#include "nsProxyRelease.h"
 #include "nsIURIContentListener.h"
 #include "nsIContentHandler.h"
 #include "nsILoadGroup.h"
@@ -31,12 +30,10 @@
 #include "nsIDocShell.h"
 #include "nsIDocShellTreeItem.h"
 #include "nsIDocShellTreeOwner.h"
-#include "nsIThreadRetargetableStreamListener.h"
 
 #include "nsXPIDLString.h"
 #include "nsString.h"
 #include "nsNetUtil.h"
-#include "nsThreadUtils.h"
 #include "nsReadableUtils.h"
 #include "nsError.h"
 
@@ -66,7 +63,6 @@ PRLogModuleInfo* nsURILoader::mLog = nullptr;
  * (or aborted).
  */
 class nsDocumentOpenInfo MOZ_FINAL : public nsIStreamListener
-                                   , public nsIThreadRetargetableStreamListener
 {
 public:
   // Needed for nsCOMPtr to work right... Don't call this!
@@ -114,8 +110,6 @@ public:
   // nsIStreamListener methods:
   NS_DECL_NSISTREAMLISTENER
 
-  // nsIThreadRetargetableStreamListener
-  NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER
 protected:
   ~nsDocumentOpenInfo();
 
@@ -130,7 +124,7 @@ protected:
    * The stream listener to forward nsIStreamListener notifications
    * to.  This is set once the load is dispatched.
    */
-  nsMainThreadPtrHandle<nsIStreamListener> m_targetStreamListener;
+  nsCOMPtr<nsIStreamListener> m_targetStreamListener;
 
   /**
    * A pointer to the entity that originated the load. We depend on getting
@@ -165,7 +159,6 @@ NS_INTERFACE_MAP_BEGIN(nsDocumentOpenInfo)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIRequestObserver)
   NS_INTERFACE_MAP_ENTRY(nsIRequestObserver)
   NS_INTERFACE_MAP_ENTRY(nsIStreamListener)
-  NS_INTERFACE_MAP_ENTRY(nsIThreadRetargetableStreamListener)
 NS_INTERFACE_MAP_END_THREADSAFE
 
 nsDocumentOpenInfo::nsDocumentOpenInfo()
@@ -273,22 +266,6 @@ NS_IMETHODIMP nsDocumentOpenInfo::OnStartRequest(nsIRequest *request, nsISupport
   return rv;
 }
 
-NS_IMETHODIMP
-nsDocumentOpenInfo::CheckListenerChain()
-{
-  NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
-    do_QueryInterface(m_targetStreamListener, &rv);
-  if (retargetableListener) {
-    rv = retargetableListener->CheckListenerChain();
-  }
-  LOG(("[0x%p] nsDocumentOpenInfo::CheckListenerChain %s listener %p rv %x",
-       this, (NS_SUCCEEDED(rv) ? "success" : "failure"),
-       (nsIStreamListener*)m_targetStreamListener, rv));
-  return rv;
-}
-
 NS_IMETHODIMP
 nsDocumentOpenInfo::OnDataAvailable(nsIRequest *request, nsISupports * aCtxt,
                                     nsIInputStream * inStr,
@@ -311,7 +288,7 @@ NS_IMETHODIMP nsDocumentOpenInfo::OnStopRequest(nsIRequest *request, nsISupports
   
   if ( m_targetStreamListener)
   {
-    nsMainThreadPtrHandle<nsIStreamListener> listener = m_targetStreamListener;
+    nsCOMPtr<nsIStreamListener> listener(m_targetStreamListener);
 
     // If this is a multipart stream, we could get another
     // OnStartRequest after this... reset state.
@@ -537,15 +514,11 @@ nsresult nsDocumentOpenInfo::DispatchContent(nsIRequest *request, nsISupports *
       aChannel->SetContentType(NS_LITERAL_CSTRING(APPLICATION_GUESS_FROM_EXT));
     }
 
-    nsCOMPtr<nsIStreamListener> listener;
     rv = helperAppService->DoContent(mContentType,
                                      request,
                                      m_originalContext,
                                      false,
-                                     getter_AddRefs(listener));
-    // Passing false here to allow off main thread use.
-    m_targetStreamListener
-      = new nsMainThreadPtrHolder<nsIStreamListener>(listener, false);
+                                     getter_AddRefs(m_targetStreamListener));
     if (NS_FAILED(rv)) {
       request->SetLoadFlags(loadFlags);
       m_targetStreamListener = nullptr;
@@ -585,7 +558,7 @@ nsDocumentOpenInfo::ConvertData(nsIRequest *request,
   // stream is split up into multiple destination streams.  This
   // intermediate instance is used to target these "decoded" streams...
   //
-  nsRefPtr<nsDocumentOpenInfo> nextLink =
+  nsCOMPtr<nsDocumentOpenInfo> nextLink =
     new nsDocumentOpenInfo(m_originalContext, mFlags, mURILoader);
   if (!nextLink) return NS_ERROR_OUT_OF_MEMORY;
 
@@ -608,16 +581,11 @@ nsDocumentOpenInfo::ConvertData(nsIRequest *request,
   // stream converter and sets the output end of the stream converter to
   // nextLink.  As we pump data into m_targetStreamListener the stream
   // converter will convert it and pass the converted data to nextLink.
-  nsCOMPtr<nsIStreamListener> listener;
-  rv = StreamConvService->AsyncConvertData(PromiseFlatCString(aSrcContentType).get(),
-                                           PromiseFlatCString(aOutContentType).get(),
-                                           nextLink,
-                                           request,
-                                           getter_AddRefs(listener));
-  // Passing false here to allow off main thread use.
-  m_targetStreamListener
-    = new nsMainThreadPtrHolder<nsIStreamListener>(listener, false);
-  return rv;
+  return StreamConvService->AsyncConvertData(PromiseFlatCString(aSrcContentType).get(), 
+                                             PromiseFlatCString(aOutContentType).get(), 
+                                             nextLink, 
+                                             request,
+                                             getter_AddRefs(m_targetStreamListener));
 }
 
 bool
@@ -662,7 +630,7 @@ nsDocumentOpenInfo::TryContentListener(nsIURIContentListener* aListener,
     // m_targetStreamListener is now the input end of the converter, and we can
     // just pump the data in there, if it exists.  If it does not, we need to
     // try other nsIURIContentListeners.
-    return m_targetStreamListener.get() != nullptr;
+    return m_targetStreamListener != nullptr;
   }
 
   // At this point, aListener wants data of type mContentType.  Let 'em have
@@ -684,15 +652,12 @@ nsDocumentOpenInfo::TryContentListener(nsIURIContentListener* aListener,
   
   bool abort = false;
   bool isPreferred = (mFlags & nsIURILoader::IS_CONTENT_PREFERRED) != 0;
-  nsCOMPtr<nsIStreamListener> listener;
   nsresult rv = aListener->DoContent(mContentType.get(),
                                      isPreferred,
                                      aChannel,
-                                     getter_AddRefs(listener),
+                                     getter_AddRefs(m_targetStreamListener),
                                      &abort);
-  // Passing false here to allow off main thread use.
-  m_targetStreamListener
-    = new nsMainThreadPtrHolder<nsIStreamListener>(listener, false);
+    
   if (NS_FAILED(rv)) {
     LOG_ERROR(("  DoContent failed"));
     
@@ -847,7 +812,7 @@ nsresult nsURILoader::OpenChannel(nsIChannel* channel,
 
   // we need to create a DocumentOpenInfo object which will go ahead and open
   // the url and discover the content type....
-  nsRefPtr<nsDocumentOpenInfo> loader =
+  nsCOMPtr<nsDocumentOpenInfo> loader =
     new nsDocumentOpenInfo(aWindowContext, aFlags, this);
 
   if (!loader) return NS_ERROR_OUT_OF_MEMORY;
diff --git a/xpcom/glue/nsProxyRelease.h b/xpcom/glue/nsProxyRelease.h
index 3ba9faab256f..b1ce72fe2661 100644
--- a/xpcom/glue/nsProxyRelease.h
+++ b/xpcom/glue/nsProxyRelease.h
@@ -203,8 +203,6 @@ class nsMainThreadPtrHandle
   operator T*() { return get(); }
   T* operator->() { return get(); }
 
-  operator bool() { return get(); }
-
   // These are safe to call on other threads with appropriate external locking.
   bool operator==(const nsMainThreadPtrHandle<T>& aOther) const {
     if (!mPtr || !aOther.mPtr)

From 622a7331ecabed36f37fc2beece2addc03694130 Mon Sep 17 00:00:00 2001
From: Julien Wajsberg <jwajsberg@mozilla.com>
Date: Fri, 14 Jun 2013 23:22:17 +0200
Subject: [PATCH 14/75] Bug 814090 - [classList] Implement the second force
 argument for toggle. r=bz

---
 content/base/src/nsDOMTokenList.cpp   | 24 ++++++++++++++-----
 content/base/src/nsDOMTokenList.h     |  5 +++-
 content/base/test/test_classList.html | 34 ++++++++++++++++++++-------
 dom/webidl/DOMTokenList.webidl        |  2 +-
 4 files changed, 49 insertions(+), 16 deletions(-)

diff --git a/content/base/src/nsDOMTokenList.cpp b/content/base/src/nsDOMTokenList.cpp
index 48b08db93479..424f1df041da 100644
--- a/content/base/src/nsDOMTokenList.cpp
+++ b/content/base/src/nsDOMTokenList.cpp
@@ -231,7 +231,9 @@ nsDOMTokenList::Remove(const nsAString& aToken, ErrorResult& aError)
 }
 
 bool
-nsDOMTokenList::Toggle(const nsAString& aToken, ErrorResult& aError)
+nsDOMTokenList::Toggle(const nsAString& aToken,
+                       const Optional<bool>& aForce,
+                       ErrorResult& aError)
 {
   aError = CheckToken(aToken);
   if (aError.Failed()) {
@@ -239,14 +241,24 @@ nsDOMTokenList::Toggle(const nsAString& aToken, ErrorResult& aError)
   }
 
   const nsAttrValue* attr = GetParsedAttr();
+  const bool forceOn = aForce.WasPassed() && aForce.Value();
+  const bool forceOff = aForce.WasPassed() && !aForce.Value();
 
-  if (attr && attr->Contains(aToken)) {
-    RemoveInternal(attr, aToken);
-    return false;
+  bool isPresent = attr && attr->Contains(aToken);
+
+  if (isPresent) {
+    if (!forceOn) {
+      RemoveInternal(attr, aToken);
+      isPresent = false;
+    }
+  } else {
+    if (!forceOff) {
+      AddInternal(attr, aToken);
+      isPresent = true;
+    }
   }
 
-  AddInternal(attr, aToken);
-  return true;
+  return isPresent;
 }
 
 void
diff --git a/content/base/src/nsDOMTokenList.h b/content/base/src/nsDOMTokenList.h
index 214f4caf8220..05dd49128640 100644
--- a/content/base/src/nsDOMTokenList.h
+++ b/content/base/src/nsDOMTokenList.h
@@ -13,6 +13,7 @@
 #include "nsDOMString.h"
 #include "nsWrapperCache.h"
 #include "mozilla/dom/Element.h"
+#include "mozilla/dom/BindingDeclarations.h"
 
 namespace mozilla {
 class ErrorResult;
@@ -59,7 +60,9 @@ public:
   bool Contains(const nsAString& aToken, mozilla::ErrorResult& aError);
   void Add(const nsAString& aToken, mozilla::ErrorResult& aError);
   void Remove(const nsAString& aToken, mozilla::ErrorResult& aError);
-  bool Toggle(const nsAString& aToken, mozilla::ErrorResult& aError);
+  bool Toggle(const nsAString& aToken,
+              const mozilla::dom::Optional<bool>& force,
+              mozilla::ErrorResult& aError);
   void Stringify(nsAString& aResult);
 
 protected:
diff --git a/content/base/test/test_classList.html b/content/base/test/test_classList.html
index d04cdab7509e..468e372975b3 100644
--- a/content/base/test/test_classList.html
+++ b/content/base/test/test_classList.html
@@ -35,7 +35,7 @@ function onAttrModified(event) {
   });
 }
 
-function checkModification(e, funcName, argument, expectedRes, before, after, expectedException) {
+function checkModification(e, funcName, args, expectedRes, before, after, expectedException) {
   var shouldThrow = typeof(expectedException) === "string";
   if (shouldThrow) {
     // If an exception is thrown, the class attribute shouldn't change.
@@ -46,14 +46,15 @@ function checkModification(e, funcName, argument, expectedRes, before, after, ex
   else
     e.setAttribute("class", before);
 
-  var contextMsg = "(checkModification: funcName=" + funcName + ",argument=" +
-                   argument + ",expectedRes=" + expectedRes + ",before=" +
-                   before + ",after=" + after + ")";
+  var contextMsg = "(checkModification: funcName=" + funcName + ",args=" +
+                   JSON.stringify(args) + ",expectedRes=" + expectedRes +
+                   ",before=" + before + ",after=" + after + ")";
 
   gMutationEvents = [];
   e.addEventListener("DOMAttrModified", onAttrModified, false);
   try {
-    var res = e.classList[funcName](argument);
+    var list = e.classList;
+    var res = list[funcName].apply(list, args);
     if (shouldThrow)
       ok(false, "classList modification didn't throw " + contextMsg);
   } catch (e) {
@@ -258,7 +259,7 @@ function testClassList(e) {
   // add() method
 
   function checkAdd(before, argument, after, expectedException) {
-    checkModification(e, "add", argument, null, before, after, expectedException);
+    checkModification(e, "add", [argument], null, before, after, expectedException);
   }
 
   checkAdd(null, "", null, "SyntaxError");
@@ -284,7 +285,7 @@ function testClassList(e) {
   // remove() method
 
   function checkRemove(before, argument, after, expectedException) {
-    checkModification(e, "remove", argument, null, before, after, expectedException);
+    checkModification(e, "remove", [argument], null, before, after, expectedException);
   }
 
   checkRemove(null, "", null, "SyntaxError");
@@ -323,7 +324,7 @@ function testClassList(e) {
   // toggle() method
 
   function checkToggle(before, argument, expectedRes, after, expectedException) {
-    checkModification(e, "toggle", argument, expectedRes, before, after, expectedException);
+    checkModification(e, "toggle", [argument], expectedRes, before, after, expectedException);
   }
 
   checkToggle(null, "", null, null, "SyntaxError");
@@ -351,7 +352,24 @@ function testClassList(e) {
   checkToggle("", null, true, "null");
   checkToggle("undefined", undefined, false, "");
   checkToggle("", undefined, true, "undefined");
+
+
+  // tests for the force argument handling
+  
+  function checkForceToggle(before, argument, force, expectedRes, after, expectedException) {
+    checkModification(e, "toggle", [argument, force], expectedRes, before, after, expectedException);
+  }
+
+  checkForceToggle("", "a", true, true, "a");
+  checkForceToggle("a", "a", true, true, "a");
+  checkForceToggle("a", "b", true, true, "a b");
+  checkForceToggle("a b", "b", true, true, "a b");
+  checkForceToggle("", "a", false, false, "");
+  checkForceToggle("a", "a", false, false, "");
+  checkForceToggle("a", "b", false, false, "a");
+  checkForceToggle("a b", "b", false, false, "a");
 }
+
 var content = document.getElementById("content");
 
 var htmlNode = document.createElement("div");
diff --git a/dom/webidl/DOMTokenList.webidl b/dom/webidl/DOMTokenList.webidl
index f399b974111f..ac8be65a3dfa 100644
--- a/dom/webidl/DOMTokenList.webidl
+++ b/dom/webidl/DOMTokenList.webidl
@@ -20,6 +20,6 @@ interface DOMTokenList {
   [Throws]
   void remove(DOMString token);
   [Throws]
-  boolean toggle(DOMString token);
+  boolean toggle(DOMString token, optional boolean force);
   stringifier DOMString ();
 };

From 8dcf9cd3b2008d7fa3d14f937d468fafc8a89136 Mon Sep 17 00:00:00 2001
From: Jan Horak <jhorak@redhat.com>
Date: Mon, 17 Jun 2013 16:06:00 -0400
Subject: [PATCH 15/75] Bug 831688 - Enable MOZ_SERVICES_HEATLHREPORT in
 xulrunner. r=gps

---
 xulrunner/confvars.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/xulrunner/confvars.sh b/xulrunner/confvars.sh
index ae7ab5ca62e0..06c38a6f8259 100755
--- a/xulrunner/confvars.sh
+++ b/xulrunner/confvars.sh
@@ -20,3 +20,4 @@ MOZ_MEDIA_NAVIGATOR=1
 if test "$OS_TARGET" = "WINNT" -o "$OS_TARGET" = "Darwin"; then
   MOZ_FOLD_LIBS=1
 fi
+MOZ_SERVICES_HEALTHREPORT=1

From 6f4021edcf088b4e590b7572921a1d9f15e4a7c2 Mon Sep 17 00:00:00 2001
From: Catalin Suciu <catalin.suciu@softvisioninc.eu>
Date: Mon, 17 Jun 2013 11:49:17 +0300
Subject: [PATCH 16/75] Bug 846340 - Add test for 'Clear Site Settings'.
 r=jmaher

---
 .../base/tests/testClearPrivateData.java.in   | 41 +++++++++++++++++--
 1 file changed, 37 insertions(+), 4 deletions(-)

diff --git a/mobile/android/base/tests/testClearPrivateData.java.in b/mobile/android/base/tests/testClearPrivateData.java.in
index eaec399b8221..4d3e2b4b9179 100644
--- a/mobile/android/base/tests/testClearPrivateData.java.in
+++ b/mobile/android/base/tests/testClearPrivateData.java.in
@@ -4,7 +4,7 @@ package @ANDROID_PACKAGE_NAME@.tests;
 import @ANDROID_PACKAGE_NAME@.*;
 import android.widget.ListView;
 
-public class testClearPrivateData extends PixelTest  {
+public class testClearPrivateData extends PixelTest {
 
     @Override
     protected int getTestType() {
@@ -14,10 +14,11 @@ public class testClearPrivateData extends PixelTest  {
     public void testClearPrivateData() {
         blockForGeckoReady();
         clearHistory();
+        clearSiteSettings();
     }
 
     private void clearHistory() {
-        // Loading a page so we are sure that there is at least one history entry
+        // Loading a page so we are sure that there is at leats one history entry
         String url = getAbsoluteUrl("/robocop/robocop_blank_01.html");
         loadAndPaint(url);
 
@@ -31,13 +32,45 @@ public class testClearPrivateData extends PixelTest  {
 
         // Clearing private data
         selectSettingsItem("Privacy & Security", "Clear private data");
+        Actions.EventExpecter ClearDataEventExpecter = mActions.expectGeckoEvent("Sanitize:Finished");
         mAsserter.ok(mSolo.searchButton("Clear data"),"checking clear button","clear button exists");
         mSolo.clickOnButton("Clear data");
-        // TODO: extra long wait here for bug 837274
-        mAsserter.is(mSolo.waitForText("Private data cleared", 0, 60000),true,"private data cleared successfully");
+        ClearDataEventExpecter.blockForEvent();
+        mActions.sendSpecialKey(Actions.SpecialKey.BACK);
 
         // Checking that history list is empty
         hList = getHistoryList("History", 0);
         mAsserter.ok(hList != null,"checking history is cleared ","history is cleared");
     }
+
+    public void clearSiteSettings() {
+        String url = getAbsoluteUrl("/robocop/robocop_geolocation.html");
+        // Loading geolocation page
+        loadAndPaint(url);
+        mSolo.waitForText("Share your location");
+        mAsserter.is(mSolo.searchText("Share your location"), true, "Geolocation doorhanger has been displayed");
+
+        // Pressing "Share" button
+        mSolo.clickOnButton("Share");
+        mAsserter.is(mSolo.searchText("Share your location"), false, "Geolocation doorhanger has been hidden");
+
+        // Re-loading geolocation page
+        loadAndPaint(url);
+        mSolo.waitForText("Share your location");
+        mAsserter.is(mSolo.searchText("Share your location"), false, "Geolocation doorhanger has been displayed");
+
+        // Clearing private data
+        selectSettingsItem("Privacy & Security", "Clear private data");
+        Actions.EventExpecter ClearDataEventExpecter = mActions.expectGeckoEvent("Sanitize:Finished");
+        mAsserter.ok(mSolo.searchButton("Clear data"),"checking clear button","clear button exists");
+        mSolo.clickOnButton("Clear data");
+        ClearDataEventExpecter.blockForEvent();
+        mActions.sendSpecialKey(Actions.SpecialKey.BACK);
+
+        // Re-trigger geolocation notification in new tab
+        addTab(url); // Using addTab(url) because loadAndPaint(url) seems to fail at this step
+        mSolo.waitForText("Share your location");
+        mAsserter.is(mSolo.searchText("Share your location"), true, "Geolocation doorhanger has been displayed");
+        mActions.sendSpecialKey(Actions.SpecialKey.BACK);
+    }
 }

From 9775b80620847dce044bfbb32c4d5baa11cbb5dd Mon Sep 17 00:00:00 2001
From: Martijn Wargers <mwargers@mozilla.com>
Date: Sat, 15 Jun 2013 01:21:57 +0200
Subject: [PATCH 17/75] Bug 880310 - Add some pushPrefEnv tests. r=jmaher

---
 testing/mochitest/tests/Makefile.in           |   1 +
 .../tests/test_SpecialPowersPushPrefEnv.html  | 211 ++++++++++++++++++
 2 files changed, 212 insertions(+)
 create mode 100644 testing/mochitest/tests/test_SpecialPowersPushPrefEnv.html

diff --git a/testing/mochitest/tests/Makefile.in b/testing/mochitest/tests/Makefile.in
index 58340af69c13..29f3570af136 100644
--- a/testing/mochitest/tests/Makefile.in
+++ b/testing/mochitest/tests/Makefile.in
@@ -21,6 +21,7 @@ _TEST_FILES = \
   test_SpecialPowersExtension.html \
   test_SpecialPowersExtension2.html \
   test_SpecialPowersPushPermissions.html \
+  test_SpecialPowersPushPrefEnv.html \
   file_SpecialPowersFrame1.html \
   test_bug816847.html \
   test_sanity_cleanup.html \
diff --git a/testing/mochitest/tests/test_SpecialPowersPushPrefEnv.html b/testing/mochitest/tests/test_SpecialPowersPushPrefEnv.html
new file mode 100644
index 000000000000..e06b7bb2a3aa
--- /dev/null
+++ b/testing/mochitest/tests/test_SpecialPowersPushPrefEnv.html
@@ -0,0 +1,211 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test for SpecialPowers extension</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body onload="starttest();">
+
+<pre id="test">
+<script class="testbody" type="text/javascript">
+function starttest() {
+  try {
+    SpecialPowers.setBoolPref("test.bool", 1);
+  } catch(e) {
+    SpecialPowers.setBoolPref("test.bool", true);
+  }
+  try {
+    SpecialPowers.setIntPref("test.int", true);
+  } catch(e) {
+    SpecialPowers.setIntPref("test.int", 1);
+  }
+  SpecialPowers.setCharPref("test.char", 'test');
+
+  setTimeout(test1, 0, 0);
+}
+
+SimpleTest.waitForExplicitFinish();
+
+function test1(aCount) {
+  if (aCount >= 20) {
+    ok(false, "Too many times attempting to set pref, aborting");
+    SimpleTest.finish();
+    return;
+  }
+
+  try {
+    is(SpecialPowers.getBoolPref('test.bool'), true, 'test.bool should be true');
+  } catch(e) {
+    setTimeout(test1, 0, ++aCount);
+    return;
+  }
+
+  try {
+    is(SpecialPowers.getIntPref('test.int'), 1, 'test.int should be 1');
+  } catch(e) {
+    setTimeout(test1, 0, ++aCount);
+    return;
+  }
+
+  try {
+    is(SpecialPowers.getCharPref('test.char'), 'test', 'test.char should be test');
+  } catch(e) {
+    setTimeout(test1, 0, ++aCount);
+    return;
+  }
+
+  test2();
+}
+
+function test2() {
+  // test non-changing values
+  SpecialPowers.pushPrefEnv({"set": [["test.bool", true], ["test.int", 1], ["test.char", "test"]]}, test3);
+}
+
+function test3() {
+  // test changing char pref
+  is(SpecialPowers.getBoolPref('test.bool'), true, 'test.bool should be true');
+  is(SpecialPowers.getIntPref('test.int'), 1, 'test.int should be 1');
+  is(SpecialPowers.getCharPref('test.char'), 'test', 'test.char should be test');
+  SpecialPowers.pushPrefEnv({"set": [["test.bool", true], ["test.int", 1], ["test.char", "test2"]]}, test4);
+}
+
+function test4() {
+  // test changing all values and adding test.char2 pref
+  is(SpecialPowers.getCharPref('test.char'), 'test2', 'test.char should be test2');
+  SpecialPowers.pushPrefEnv({"set": [["test.bool", false], ["test.int", 10], ["test.char", "test2"], ["test.char2", "test"]]}, test5);
+}
+
+function test5() {
+  // test flushPrefEnv
+  is(SpecialPowers.getBoolPref('test.bool'), false, 'test.bool should be false');
+  is(SpecialPowers.getIntPref('test.int'), 10, 'test.int should be 10');
+  is(SpecialPowers.getCharPref('test.char'), 'test2', 'test.char should be test2');
+  is(SpecialPowers.getCharPref('test.char2'), 'test', 'test.char2 should be test');
+  SpecialPowers.flushPrefEnv(test6);
+}
+
+function test6() {
+  // test clearing prefs
+  is(SpecialPowers.getBoolPref('test.bool'), true, 'test.bool should be true');
+  is(typeof SpecialPowers.getBoolPref('test.bool'), typeof true, 'test.bool should be boolean');
+  is(SpecialPowers.getIntPref('test.int'), 1, 'test.int should be 1');
+  is(typeof SpecialPowers.getIntPref('test.int'), typeof 1, 'test.int should be integer');
+  is(SpecialPowers.getCharPref('test.char'), 'test', 'test.char should be test');
+  is(typeof SpecialPowers.getCharPref('test.char'), typeof 'test', 'test.char should be String');
+  try {
+    SpecialPowers.getCharPref('test.char2');
+    ok(false, 'This ok should not be reached!');
+  } catch(e) {
+    ok(true, 'getCharPref("test.char2") should throw');
+  }
+  SpecialPowers.pushPrefEnv({"clear": [["test.bool"], ["test.int"], ["test.char"], ["test.char2"]]}, test6b);
+}
+
+function test6b() {
+  // test if clearing another time doesn't cause issues
+  SpecialPowers.pushPrefEnv({"clear": [["test.bool"], ["test.int"], ["test.char"], ["test.char2"]]}, test7);
+}
+
+function test7() {
+  try {
+    SpecialPowers.getBoolPref('test.bool');
+    ok(false, 'This ok should not be reached!');
+  } catch(e) {
+    ok(true, 'getBoolPref("test.bool") should throw');
+  }
+
+  try {
+    SpecialPowers.getIntPref('test.int');
+    ok(false, 'This ok should not be reached!');
+  } catch(e) {
+    ok(true, 'getIntPref("test.int") should throw');
+  }
+
+  try {
+    SpecialPowers.getCharPref('test.char');
+    ok(false, 'This ok should not be reached!');
+  } catch(e) {
+    ok(true, 'getCharPref("test.char") should throw');
+  }
+
+  try {
+    SpecialPowers.getCharPref('test.char2');
+    ok(false, 'This ok should not be reached!');
+  } catch(e) {
+    ok(true, 'getCharPref("test.char2") should throw');
+  }
+
+  SpecialPowers.flushPrefEnv(test8);
+}
+
+function test8() {
+  is(SpecialPowers.getBoolPref('test.bool'), true, 'test.bool should be true');
+  is(typeof SpecialPowers.getBoolPref('test.bool'), typeof true, 'test.bool should be boolean');
+  is(SpecialPowers.getIntPref('test.int'), 1, 'test.int should be 1');
+  is(typeof SpecialPowers.getIntPref('test.int'), typeof 1, 'test.int should be integer');
+  is(SpecialPowers.getCharPref('test.char'), 'test', 'test.char should be test');
+  is(typeof SpecialPowers.getCharPref('test.char'), typeof 'test', 'test.char should be String');
+  try {
+    SpecialPowers.getCharPref('test.char2');
+    ok(false, 'This ok should not be reached!');
+  } catch(e) {
+    ok(true, 'getCharPref("test.char2") should throw');
+  }
+  SpecialPowers.clearUserPref("test.bool");
+  SpecialPowers.clearUserPref("test.int");
+  SpecialPowers.clearUserPref("test.char");
+  setTimeout(test9, 0, 0);
+}
+
+function test9(aCount) {
+  if (aCount >= 20) {
+    ok(false, "Too many times attempting to set pref, aborting");
+    SimpleTest.finish();
+    return;
+  }
+
+  try {
+    SpecialPowers.getBoolPref('test.bool');
+    setTimeout(test9, 0, ++aCount);
+  } catch(e) {
+    test10(0);
+  }
+}
+
+function test10(aCount) {
+  if (aCount >= 20) {
+    ok(false, "Too many times attempting to set pref, aborting");
+    SimpleTest.finish();
+    return;
+  }
+
+  try {
+    SpecialPowers.getIntPref('test.int');
+    setTimeout(test10, 0, ++aCount);
+  } catch(e) {
+    test11(0);
+  }
+}
+
+function test11(aCount) {
+  if (aCount >= 20) {
+    ok(false, "Too many times attempting to set pref, aborting");
+    SimpleTest.finish();
+    return;
+  }
+
+  try {
+    SpecialPowers.getCharPref('test.char');
+    setTimeout(test11, 0, ++aCount);
+  } catch(e) {
+    SimpleTest.finish();
+  }
+}
+// todo - test non-changing values, test complex values, test mixing of pushprefEnv 'set' and 'clear'
+// When bug 776424 gets fixed, getPref doesn't throw anymore, so this test would have to be changed accordingly
+</script>
+</pre>
+</body>
+</html>

From 6a6df20b468e33c61fec5e09116b141c44b45de6 Mon Sep 17 00:00:00 2001
From: James King <james@agentultra.com>
Date: Mon, 17 Jun 2013 16:17:59 -0400
Subject: [PATCH 18/75] Bug 738869 - Implement OES_vertex_array_object.
 r=jgilbert

---
 gfx/gl/GLContext.cpp      | 22 ++++++++++++++++++++++
 gfx/gl/GLContext.h        | 35 +++++++++++++++++++++++++++++++++++
 gfx/gl/GLContextSymbols.h |  8 ++++++++
 3 files changed, 65 insertions(+)

diff --git a/gfx/gl/GLContext.cpp b/gfx/gl/GLContext.cpp
index 596430334b8a..d9af25f7f932 100644
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -86,6 +86,8 @@ static const char *sExtensionNames[] = {
     "GL_OES_EGL_image_external",
     "GL_EXT_packed_depth_stencil",
     "GL_OES_element_index_uint",
+    "GL_OES_vertex_array_object",
+    "GL_ARB_vertex_array_object",
     nullptr
 };
 
@@ -548,6 +550,26 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
             }
         }
 
+        if (IsExtensionSupported(OES_vertex_array_object)) {
+            SymLoadStruct vaoSymbols[] = {
+                { (PRFuncPtr*) &mSymbols.fIsVertexArray, { "IsVertexArray", "IsVertexArrayOES", nullptr } },
+                { (PRFuncPtr*) &mSymbols.fGenVertexArrays, { "GenVertexArrays", "GenVertexArraysOES", nullptr } },
+                { (PRFuncPtr*) &mSymbols.fBindVertexArray, { "BindVertexArrays", "BindVertexArrayOES", nullptr } },
+                { (PRFuncPtr*) &mSymbols.fDeleteVertexArrays, { "DeleteVertexArrays", "DeleteVertexArraysOES", nullptr } },
+                { nullptr, { nullptr } },
+            };
+
+            if (!LoadSymbols(&vaoSymbols[0], trygl, prefix)) {
+                NS_ERROR("GL supports Vertex Array Object without supplying its functions.");
+
+                MarkExtensionUnsupported(OES_vertex_array_object);
+                mSymbols.fIsVertexArray = nullptr;
+                mSymbols.fGenVertexArrays = nullptr;
+                mSymbols.fBindVertexArray = nullptr;
+                mSymbols.fDeleteVertexArrays = nullptr;
+            }
+        }
+
         // Load developer symbols, don't fail if we can't find them.
         SymLoadStruct auxSymbols[] = {
                 { (PRFuncPtr*) &mSymbols.fGetTexImage, { "GetTexImage", nullptr } },
diff --git a/gfx/gl/GLContext.h b/gfx/gl/GLContext.h
index 0e28b6493dc6..bb382f5acc2e 100644
--- a/gfx/gl/GLContext.h
+++ b/gfx/gl/GLContext.h
@@ -1024,6 +1024,8 @@ public:
         OES_EGL_image_external,
         EXT_packed_depth_stencil,
         OES_element_index_uint,
+        OES_vertex_array_object,
+        ARB_vertex_array_object,
         Extensions_Max
     };
 
@@ -2870,6 +2872,39 @@ public:
         AFTER_GL_CALL;
     }
 
+    void GLAPIENTRY fBindVertexArray(GLuint array)
+    {
+        BEFORE_GL_CALL;
+        ASSERT_SYMBOL_PRESENT(fBindVertexArray);
+        mSymbols.fBindVertexArray(array);
+        AFTER_GL_CALL;
+    }
+
+    void GLAPIENTRY fDeleteVertexArrays(GLsizei n, const GLuint *arrays)
+    {
+        BEFORE_GL_CALL;
+        ASSERT_SYMBOL_PRESENT(fDeleteVertexArrays);
+        mSymbols.fDeleteVertexArrays(n, arrays);
+        AFTER_GL_CALL;
+    }
+
+    void GLAPIENTRY fGenVertexArrays(GLsizei n, GLuint *arrays)
+    {
+        BEFORE_GL_CALL;
+        ASSERT_SYMBOL_PRESENT(fGenVertexArrays);
+        mSymbols.fGenVertexArrays(n, arrays);
+        AFTER_GL_CALL;
+    }
+
+    realGLboolean GLAPIENTRY fIsVertexArray(GLuint array)
+    {
+        BEFORE_GL_CALL;
+        ASSERT_SYMBOL_PRESENT(fIsVertexArray);
+        realGLboolean ret = mSymbols.fIsVertexArray(array);
+        AFTER_GL_CALL;
+        return ret;
+    }
+
 #undef ASSERT_SYMBOL_PRESENT
 
 #ifdef DEBUG
diff --git a/gfx/gl/GLContextSymbols.h b/gfx/gl/GLContextSymbols.h
index a7568c0abe8c..0e0e52f106da 100644
--- a/gfx/gl/GLContextSymbols.h
+++ b/gfx/gl/GLContextSymbols.h
@@ -47,6 +47,8 @@ struct GLContextSymbols
     PFNGLBINDBUFFERPROC fBindBuffer;
     typedef void (GLAPIENTRY * PFNGLBINDTEXTUREPROC) (GLenum target, GLuint texture);
     PFNGLBINDTEXTUREPROC fBindTexture;
+    typedef void (GLAPIENTRY * PFNGLBINDVERTEXARRAYPROC) (GLuint array);
+    PFNGLBINDVERTEXARRAYPROC fBindVertexArray;
     typedef void (GLAPIENTRY * PFNGLBLENDCOLORPROC) (GLclampf red, GLclampf green, GLclampf blue, GLclampf alpha);
     PFNGLBLENDCOLORPROC fBlendColor;
     typedef void (GLAPIENTRY * PFNGLBLENDEQUATIONPROC) (GLenum mode);
@@ -302,6 +304,8 @@ struct GLContextSymbols
     PFNGLISFRAMEBUFFER fIsFramebuffer;
     typedef realGLboolean (GLAPIENTRY * PFNGLISRENDERBUFFER) (GLuint renderbuffer);
     PFNGLISRENDERBUFFER fIsRenderbuffer;
+    typedef realGLboolean (GLAPIENTRY * PFNGLISVERTEXARRAY) (GLuint array);
+    PFNGLISVERTEXARRAY fIsVertexArray;
     typedef void (GLAPIENTRY * PFNGLRENDERBUFFERSTORAGE) (GLenum target, GLenum internalFormat, GLsizei width, GLsizei height);
     PFNGLRENDERBUFFERSTORAGE fRenderbufferStorage;
 
@@ -354,6 +358,8 @@ struct GLContextSymbols
     PFNGLGENFRAMEBUFFERS fGenFramebuffers;
     typedef void (GLAPIENTRY * PFNGLGENRENDERBUFFERS) (GLsizei n, GLuint* ids);
     PFNGLGENRENDERBUFFERS fGenRenderbuffers;
+    typedef void (GLAPIENTRY * PFNGLGENVERTEXARRAYS) (GLsizei n, GLuint* arrays);
+    PFNGLGENVERTEXARRAYS fGenVertexArrays;
 
     typedef void (GLAPIENTRY * PFNGLDELETEPROGRAMPROC) (GLuint program);
     PFNGLDELETEPROGRAMPROC fDeleteProgram;
@@ -369,6 +375,8 @@ struct GLContextSymbols
     PFNGLDELETEFRAMEBUFFERS fDeleteFramebuffers;
     typedef void (GLAPIENTRY * PFNGLDELETERENDERBUFFERS) (GLsizei n, const GLuint* ids);
     PFNGLDELETERENDERBUFFERS fDeleteRenderbuffers;
+    typedef void (GLAPIENTRY * PFNGLDELETEVERTEXARRAYS) (GLsizei n, const GLuint* arrays);
+    PFNGLDELETEVERTEXARRAYS fDeleteVertexArrays;
 
     typedef void* (GLAPIENTRY * PFNGLMAPBUFFER) (GLenum target, GLenum access);
     PFNGLMAPBUFFER fMapBuffer;

From b7727e7b553ebf7ac2a37c99b40de38e9a230e59 Mon Sep 17 00:00:00 2001
From: Andrew Halberstadt <ahalberstadt@mozilla.com>
Date: Mon, 17 Jun 2013 13:22:39 -0700
Subject: [PATCH 19/75] Bug 882461 - add mozbase packages to sys.path in
 automation, r=jhammel

---
 build/automation.py.in               | 17 ++++++-----------
 testing/xpcshell/runxpcshelltests.py | 19 ++++++-------------
 2 files changed, 12 insertions(+), 24 deletions(-)

diff --git a/build/automation.py.in b/build/automation.py.in
index 29a57daeeb72..f3d75590cbed 100644
--- a/build/automation.py.in
+++ b/build/automation.py.in
@@ -30,17 +30,12 @@ import automationutils
 here = os.path.dirname(__file__)
 mozbase = os.path.realpath(os.path.join(os.path.dirname(here), 'mozbase'))
 
-try:
-    import mozcrash
-except:
-    deps = ['mozcrash',
-            'mozfile',
-            'mozlog']
-    for dep in deps:
-        module = os.path.join(mozbase, dep)
-        if module not in sys.path:
-            sys.path.append(module)
-    import mozcrash
+if os.path.isdir(mozbase):
+    for package in os.listdir(mozbase):
+        sys.path.append(os.path.join(mozbase, package))
+
+import mozcrash
+
 # ---------------------------------------------------------------
 
 _DEFAULT_PREFERENCE_FILE = os.path.join(SCRIPT_DIR, 'prefs_general.js')
diff --git a/testing/xpcshell/runxpcshelltests.py b/testing/xpcshell/runxpcshelltests.py
index 80b7f74e55dc..43371aea6456 100644
--- a/testing/xpcshell/runxpcshelltests.py
+++ b/testing/xpcshell/runxpcshelltests.py
@@ -11,7 +11,6 @@ from optparse import OptionParser
 from subprocess import Popen, PIPE, STDOUT
 from tempfile import mkdtemp, gettempdir
 from threading import Timer
-import mozinfo
 import random
 import socket
 import time
@@ -27,19 +26,13 @@ HARNESS_TIMEOUT = 5 * 60
 here = os.path.dirname(__file__)
 mozbase = os.path.realpath(os.path.join(os.path.dirname(here), 'mozbase'))
 
-# hand enumerate our own deps
-modules = [('mozcrash', ['mozcrash', 'mozfile', 'mozlog']),
-           ('manifestparser', ['manifestdestiny'])]
+if os.path.isdir(mozbase):
+    for package in os.listdir(mozbase):
+        sys.path.append(os.path.join(mozbase, package))
 
-for module, deps in modules:
-    try:
-        globals()[module] = __import__(module)
-    except ImportError:
-        for dep in deps:
-            module_path = os.path.join(mozbase, dep)
-            if module_path not in sys.path:
-                sys.path.append(module_path)
-        globals()[module] = __import__(module)
+import manifestparser
+import mozcrash
+import mozinfo
 
 # ---------------------------------------------------------------
 #TODO: replace this with json.loads when Python 2.6 is required.

From 8a0915646bcc68447c7e34a526cbbd6b6369d2ee Mon Sep 17 00:00:00 2001
From: Jeff Hammel <jhammel@mozilla.com>
Date: Mon, 17 Jun 2013 13:23:38 -0700
Subject: [PATCH 20/75] Bug 877733 - bump mozinfo, mozprocess, mozdevice,
 mozinstall version and mirror to m-c;r=jmaher

---
 testing/mozbase/generate_diff.py              |  9 ++-
 .../mozdevice/mozdevice/devicemanagerADB.py   |  7 ++-
 .../mozdevice/mozdevice/devicemanagerSUT.py   |  3 +
 testing/mozbase/mozdevice/mozdevice/dmcli.py  | 20 ++++--
 testing/mozbase/mozdevice/setup.py            |  2 +-
 testing/mozbase/mozdevice/sut_tests/dmunit.py | 12 ++--
 .../mozbase/mozdevice/sut_tests/runtests.py   |  7 ++-
 testing/mozbase/mozdevice/tests/sut.py        | 17 ++++-
 testing/mozbase/mozdevice/tests/sut_basic.py  |  1 +
 testing/mozbase/mozinfo/README.md             | 62 -------------------
 testing/mozbase/mozinfo/mozinfo/__init__.py   | 49 +++++++++++++++
 testing/mozbase/mozinfo/mozinfo/mozinfo.py    | 46 +++++++-------
 testing/mozbase/mozinfo/setup.py              | 17 ++---
 testing/mozbase/mozinstall/README.md          | 60 ------------------
 testing/mozbase/mozinstall/setup.py           | 13 ++--
 testing/mozbase/mozprocess/setup.py           |  2 +-
 .../mozprocess/tests/iniparser/Makefile       |  2 +-
 testing/mozbase/mozprocess/tests/manifest.ini |  2 +-
 18 files changed, 142 insertions(+), 189 deletions(-)
 delete mode 100644 testing/mozbase/mozinfo/README.md
 delete mode 100644 testing/mozbase/mozinstall/README.md

diff --git a/testing/mozbase/generate_diff.py b/testing/mozbase/generate_diff.py
index e986f79d0a2d..3020d9a93dfb 100755
--- a/testing/mozbase/generate_diff.py
+++ b/testing/mozbase/generate_diff.py
@@ -147,7 +147,9 @@ def parse_versions(*args):
     return retval
 
 def version_tag(directory, version):
-    return '%s-%s' % (directory, version)
+    """return a version tag string given the directory name of the package"""
+    package = current_package_info[directory]['name']
+    return '%s-%s' % (package, version)
 
 def setup(**kwargs):
     """monkey-patch function for setuptools.setup"""
@@ -321,7 +323,7 @@ def main(args=sys.argv[1:]):
 
             tag = version_tag(directory, version)
             if tag not in _tags:
-                error("Tag for '%s' -- %s -- not in tags")
+                error("Tag for '%s' -- %s -- not in tags:\n%s" % (directory, version, '\n'.join(sorted(_tags))))
 
         # ensure that the versions to mirror are compatible with what is in m-c
         old_package_info = current_package_info.copy()
@@ -376,7 +378,8 @@ def main(args=sys.argv[1:]):
 
     finally:
         # cleanup
-        revert(hg_root, untracked)
+        if options.check:
+            revert(hg_root, untracked)
         shutil.rmtree(tempdir)
 
     print "Diff at %s" % output
diff --git a/testing/mozbase/mozdevice/mozdevice/devicemanagerADB.py b/testing/mozbase/mozdevice/mozdevice/devicemanagerADB.py
index f1821e93d76d..b4f96e2c238d 100644
--- a/testing/mozbase/mozdevice/mozdevice/devicemanagerADB.py
+++ b/testing/mozbase/mozdevice/mozdevice/devicemanagerADB.py
@@ -171,6 +171,8 @@ class DeviceManagerADB(DeviceManager):
         if self.dirExists(destname):
             raise DMError("Attempted to push a file (%s) to a directory (%s)!" %
                           (localname, destname))
+        if not os.access(localname, os.F_OK):
+            raise DMError("File not found: %s" % localname)
 
         if self._useRunAs:
             remoteTmpFile = self.getTempDir() + "/" + os.path.basename(localname)
@@ -233,8 +235,9 @@ class DeviceManagerADB(DeviceManager):
     def fileExists(self, filepath):
         p = self._runCmd(["shell", "ls", "-a", filepath])
         data = p.stdout.readlines()
-        if (len(data) == 1):
-            if (data[0].rstrip() == filepath):
+        if len(data) == 1:
+            foundpath = data[0].decode('utf-8').rstrip()
+            if foundpath == filepath:
                 return True
         return False
 
diff --git a/testing/mozbase/mozdevice/mozdevice/devicemanagerSUT.py b/testing/mozbase/mozdevice/mozdevice/devicemanagerSUT.py
index e3c005dd3651..653a1fe4ad81 100644
--- a/testing/mozbase/mozdevice/mozdevice/devicemanagerSUT.py
+++ b/testing/mozbase/mozdevice/mozdevice/devicemanagerSUT.py
@@ -496,6 +496,9 @@ class DeviceManagerSUT(DeviceManager):
             self._logger.warn("launchProcess called without command to run")
             return None
 
+        if cmd[0] == 'am' and hasattr(self, '_getExtraAmStartArgs'):
+            cmd = cmd[:2] + self._getExtraAmStartArgs() + cmd[2:] 
+
         cmdline = subprocess.list2cmdline(cmd)
         if (outputFile == "process.txt" or outputFile == None):
             outputFile = self.getDeviceRoot();
diff --git a/testing/mozbase/mozdevice/mozdevice/dmcli.py b/testing/mozbase/mozdevice/mozdevice/dmcli.py
index 2d84b2a5b10e..6255f80d42e0 100644
--- a/testing/mozbase/mozdevice/mozdevice/dmcli.py
+++ b/testing/mozbase/mozdevice/mozdevice/dmcli.py
@@ -50,7 +50,9 @@ class DMCli(object):
                                               { 'name': 'remote_file', 'nargs': '?' } ],
                                     'help': 'copy file/dir from device' },
                           'shell': { 'function': self.shell,
-                                    'args': [ { 'name': 'command', 'nargs': argparse.REMAINDER } ],
+                                    'args': [ { 'name': 'command', 'nargs': argparse.REMAINDER },
+                                              { 'name': '--root', 'action': 'store_true',
+                                                'help': 'Run command as root' }],
                                     'help': 'run shell command on device' },
                           'info': { 'function': self.getinfo,
                                     'args': [ { 'name': 'directive', 'nargs': '?' } ],
@@ -107,7 +109,8 @@ class DMCli(object):
                                                         'default': 'android.intent.action.VIEW' },
                                                       { 'name': '--url', 'action': 'store' },
                                                       { 'name': '--extra-args', 'action': 'store' },
-                                                      { 'name': '--mozenv', 'action': 'store' },
+                                                      { 'name': '--mozenv', 'action': 'store',
+                                                        'help': 'Gecko environment variables to set in "KEY1=VAL1 KEY2=VAL2" format' },
                                                       { 'name': '--no-fail-if-running',
                                                         'action': 'store_true',
                                                         'help': 'Don\'t fail if application is already running' }
@@ -249,9 +252,9 @@ class DMCli(object):
         for name in args.process_name:
             self.dm.killProcess(name)
 
-    def shell(self, args, root=False):
+    def shell(self, args):
         buf = StringIO.StringIO()
-        self.dm.shell(args.command, buf, root=root)
+        self.dm.shell(args.command, buf, root=args.root)
         print str(buf.getvalue()[0:-1]).rstrip()
 
     def getinfo(self, args):
@@ -321,8 +324,15 @@ class DMCli(object):
         return errno.ENOENT
 
     def launchfennec(self, args):
+        mozEnv = None
+        if args.mozenv:
+            mozEnv = {}
+            keyvals = args.mozenv.split()
+            for keyval in keyvals:
+                (key, _, val) = keyval.partition("=")
+                mozEnv[key] = val
         self.dm.launchFennec(args.appname, intent=args.intent,
-                             mozEnv=args.mozenv,
+                             mozEnv=mozEnv,
                              extraArgs=args.extra_args, url=args.url,
                              failIfRunning=(not args.no_fail_if_running))
 
diff --git a/testing/mozbase/mozdevice/setup.py b/testing/mozbase/mozdevice/setup.py
index 88381ba75ca7..70f16060cbb2 100644
--- a/testing/mozbase/mozdevice/setup.py
+++ b/testing/mozbase/mozdevice/setup.py
@@ -4,7 +4,7 @@
 
 from setuptools import setup
 
-PACKAGE_VERSION = '0.25'
+PACKAGE_VERSION = '0.26'
 
 setup(name='mozdevice',
       version=PACKAGE_VERSION,
diff --git a/testing/mozbase/mozdevice/sut_tests/dmunit.py b/testing/mozbase/mozdevice/sut_tests/dmunit.py
index 23b3c9b8a2fd..87e268e80b15 100644
--- a/testing/mozbase/mozdevice/sut_tests/dmunit.py
+++ b/testing/mozbase/mozdevice/sut_tests/dmunit.py
@@ -2,15 +2,18 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-from mozdevice import devicemanager
-from mozdevice import devicemanagerSUT
 import types
 import unittest
 
+import mozlog
+
+from mozdevice import devicemanager
+from mozdevice import devicemanagerSUT
+
 ip = ''
 port = 0
 heartbeat_port = 0
-
+log_level = mozlog.ERROR
 
 class DeviceManagerTestCase(unittest.TestCase):
     """DeviceManager tests should subclass this.
@@ -26,7 +29,8 @@ class DeviceManagerTestCase(unittest.TestCase):
         return
 
     def setUp(self):
-        self.dm = devicemanagerSUT.DeviceManagerSUT(host=ip, port=port)
+        self.dm = devicemanagerSUT.DeviceManagerSUT(host=ip, port=port,
+                                                    logLevel=log_level)
         self.dmerror = devicemanager.DMError
         self.nettools = devicemanager.NetworkTools
         self._setUp()
diff --git a/testing/mozbase/mozdevice/sut_tests/runtests.py b/testing/mozbase/mozdevice/sut_tests/runtests.py
index 5a092f4991d9..2be668f11d56 100644
--- a/testing/mozbase/mozdevice/sut_tests/runtests.py
+++ b/testing/mozbase/mozdevice/sut_tests/runtests.py
@@ -5,8 +5,10 @@
 from optparse import OptionParser
 import os
 import re
-import unittest
 import sys
+import unittest
+
+import mozlog
 
 import dmunit
 import genfiles
@@ -17,8 +19,7 @@ def main(ip, port, heartbeat_port, scripts, directory, isTestDevice, verbose):
     dmunit.port = port
     dmunit.heartbeat_port = heartbeat_port
     if verbose:
-        from mozdevice.devicemanagerSUT import DeviceManagerSUT
-        DeviceManagerSUT.debug = 4
+        dmunit.log_level = mozlog.DEBUG
 
     suite = unittest.TestSuite()
 
diff --git a/testing/mozbase/mozdevice/tests/sut.py b/testing/mozbase/mozdevice/tests/sut.py
index 3a52074af2c5..473d5172816e 100644
--- a/testing/mozbase/mozdevice/tests/sut.py
+++ b/testing/mozbase/mozdevice/tests/sut.py
@@ -26,6 +26,8 @@ class MockAgent(object):
         self.thread = Thread(target=self._serve_thread)
         self.thread.start()
 
+        self.should_stop = False
+
     @property
     def port(self):
         return self._sock.getsockname()[1]
@@ -42,12 +44,21 @@ class MockAgent(object):
             # send response and prompt separately to test for bug 789496
             # FIXME: Improve the mock agent, since overloading the meaning
             # of 'response' is getting confusing.
-            if response is None:
+            if response is None: # code for "shut down"
                 conn.shutdown(socket.SHUT_RDWR)
                 conn.close()
                 conn = None
-            elif type(response) is int:
-                time.sleep(response)
+            elif type(response) is int: # code for "time out"
+                max_timeout = 15.0
+                timeout = 0.0
+                interval = 0.1
+                while not self.should_stop and timeout < max_timeout:
+                    time.sleep(interval)
+                    timeout += interval
+                if timeout >= max_timeout:
+                    raise Exception("Maximum timeout reached! This should not "
+                                    "happen")
+                return
             else:
                 # pull is handled specially, as we just pass back the full
                 # command line
diff --git a/testing/mozbase/mozdevice/tests/sut_basic.py b/testing/mozbase/mozdevice/tests/sut_basic.py
index 5b03cd0a0b70..e7134aa0c64f 100644
--- a/testing/mozbase/mozdevice/tests/sut_basic.py
+++ b/testing/mozbase/mozdevice/tests/sut_basic.py
@@ -50,6 +50,7 @@ class BasicTest(unittest.TestCase):
         except mozdevice.DMError:
             exceptionThrown = True
         self.assertEqual(exceptionThrown, True)
+        a.should_stop = True
         a.wait()
 
     def test_shell(self):
diff --git a/testing/mozbase/mozinfo/README.md b/testing/mozbase/mozinfo/README.md
deleted file mode 100644
index ab3803521d7d..000000000000
--- a/testing/mozbase/mozinfo/README.md
+++ /dev/null
@@ -1,62 +0,0 @@
-Throughout [mozmill](https://developer.mozilla.org/en/Mozmill)
-and other Mozilla python code, checking the underlying
-platform is done in many different ways.  The various checks needed
-lead to a lot of copy+pasting, leaving the reader to wonder....is this
-specific check necessary for (e.g.) an operating system?  Because
-information is not consolidated, checks are not done consistently, nor
-is it defined what we are checking for.
-
-[MozInfo](https://github.com/mozilla/mozbase/tree/master/mozinfo)
-proposes to solve this problem.  MozInfo is a bridge interface,
-making the underlying (complex) plethora of OS and architecture
-combinations conform to a subset of values of relavence to 
-Mozilla software. The current implementation exposes relavent key,
-values: `os`, `version`, `bits`, and `processor`.  Additionally, the
-service pack in use is available on the windows platform.
-
-
-# API Usage
-
-MozInfo is a python package.  Downloading the software and running
-`python setup.py develop` will allow you to do `import mozinfo`
-from python.  
-[mozinfo.py](https://github.com/mozilla/mozbase/blob/master/mozinfo/mozinfo.py)
-is the only file contained is this package,
-so if you need a single-file solution, you can just download or call
-this file through the web.
-
-The top level attributes (`os`, `version`, `bits`, `processor`) are
-available as module globals:
-
-    if mozinfo.os == 'win': ...
-
-In addition, mozinfo exports a dictionary, `mozinfo.info`, that
-contain these values.  mozinfo also exports:
-
-- `choices`: a dictionary of possible values for os, bits, and
-  processor
-- `main`: the console_script entry point for mozinfo
-- `unknown`: a singleton denoting a value that cannot be determined
-
-`unknown` has the string representation `"UNKNOWN"`. unknown will evaluate
-as `False` in python:
-
-    if not mozinfo.os: ... # unknown!
-
-
-# Command Line Usage
-
-MozInfo comes with a command line, `mozinfo` which may be used to
-diagnose one's current system.
-
-Example output:
-
-    os: linux
-    version: Ubuntu 10.10
-    bits: 32
-    processor: x86
-
-Three of these fields, os, bits, and processor, have a finite set of
-choices.  You may display the value of these choices using 
-`mozinfo --os`, `mozinfo --bits`, and `mozinfo --processor`. 
-`mozinfo --help` documents command-line usage.
diff --git a/testing/mozbase/mozinfo/mozinfo/__init__.py b/testing/mozbase/mozinfo/mozinfo/__init__.py
index 8549fba31461..8d293c128ee8 100644
--- a/testing/mozbase/mozinfo/mozinfo/__init__.py
+++ b/testing/mozbase/mozinfo/mozinfo/__init__.py
@@ -2,4 +2,53 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
+"""
+interface to transform introspected system information to a format palatable to
+Mozilla
+
+Module variables:
+
+.. attribute:: bits
+
+   32 or 64
+
+.. attribute:: isBsd
+
+   Returns ``True`` if the operating system is BSD
+
+.. attribute:: isLinux
+
+   Returns ``True`` if the operating system is Linux
+
+.. attribute:: isMac
+
+   Returns ``True`` if the operating system is Mac
+
+.. attribute:: isWin
+
+   Returns ``True`` if the operating system is Windows
+
+.. attribute:: os
+
+   Operating system [``'win'``, ``'mac'``, ``'linux'``, ...]
+
+.. attribute:: processor
+
+   Processor architecture [``'x86'``, ``'x86_64'``, ``'ppc'``, ...]
+
+.. attribute:: version
+
+   Operating system version string. For windows, the service pack information is also included
+
+.. attribute:: info
+
+   Returns information identifying the current system.
+
+   * :attr:`bits`
+   * :attr:`os`
+   * :attr:`processor`
+   * :attr:`version`
+
+"""
+
 from mozinfo import *
diff --git a/testing/mozbase/mozinfo/mozinfo/mozinfo.py b/testing/mozbase/mozinfo/mozinfo/mozinfo.py
index 87402f1c0e12..e77cebfb6527 100755
--- a/testing/mozbase/mozinfo/mozinfo/mozinfo.py
+++ b/testing/mozbase/mozinfo/mozinfo/mozinfo.py
@@ -4,19 +4,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
-"""
-file for interface to transform introspected system information to a format
-pallatable to Mozilla
-
-Information:
-- os : what operating system ['win', 'mac', 'linux', ...]
-- bits : 32 or 64
-- processor : processor architecture ['x86', 'x86_64', 'ppc', ...]
-- version : operating system version string
-
-For windows, the service pack information is also included
-"""
-
 # TODO: it might be a good idea of adding a system name (e.g. 'Ubuntu' for
 # linux) to the information; I certainly wouldn't want anyone parsing this
 # information and having behaviour depend on it
@@ -26,6 +13,13 @@ import platform
 import re
 import sys
 
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+import mozfile
+
 # keep a copy of the os module since updating globals overrides this
 _os = os
 
@@ -58,7 +52,10 @@ if system in ["Microsoft", "Windows"]:
         service_pack = os.sys.getwindowsversion()[4]
         info['service_pack'] = service_pack
 elif system == "Linux":
-    (distro, version, codename) = platform.dist()
+    if hasattr(platform, "linux_distribution"):
+        (distro, version, codename) = platform.linux_distribution()
+    else:
+        (distro, version, codename) = platform.dist()
     version = "%s %s" % (distro, version)
     if not processor:
         processor = machine
@@ -111,7 +108,15 @@ def sanitize(info):
 
 # method for updating information
 def update(new_info):
-    """update the info"""
+    """Update the info.
+    new_info can either be a dict or a path/url
+    to a json file containing a dict."""
+
+    if isinstance(new_info, basestring):
+        f = mozfile.load(new_info)
+        new_info = json.loads(f.read())
+        f.close()
+
     info.update(new_info)
     sanitize(info)
     globals().update(info)
@@ -144,21 +149,12 @@ def main(args=None):
 
     # args are JSON blobs to override info
     if args:
-        try:
-            from json import loads
-        except ImportError:
-            try:
-                from simplejson import loads
-            except ImportError:
-                def loads(string):
-                    """*really* simple json; will not work with unicode"""
-                    return eval(string, {'true': True, 'false': False, 'null': None})
         for arg in args:
             if _os.path.exists(arg):
                 string = file(arg).read()
             else:
                 string = arg
-            update(loads(string))
+            update(json.loads(string))
 
     # print out choices if requested
     flag = False
diff --git a/testing/mozbase/mozinfo/setup.py b/testing/mozbase/mozinfo/setup.py
index 16ae2913d5ce..0080ee059a76 100644
--- a/testing/mozbase/mozinfo/setup.py
+++ b/testing/mozbase/mozinfo/setup.py
@@ -2,21 +2,12 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
-
-import os
 from setuptools import setup
 
-PACKAGE_VERSION = '0.4'
-
-# get documentation from the README
-try:
-    here = os.path.dirname(os.path.abspath(__file__))
-    description = file(os.path.join(here, 'README.md')).read()
-except (OSError, IOError):
-    description = ''
+PACKAGE_VERSION = '0.5'
 
 # dependencies
-deps = []
+deps = ['mozfile >= 0.6']
 try:
     import json
 except ImportError:
@@ -24,8 +15,8 @@ except ImportError:
 
 setup(name='mozinfo',
       version=PACKAGE_VERSION,
-      description="file for interface to transform introspected system information to a format pallatable to Mozilla",
-      long_description=description,
+      description="Library to get system information for use in Mozilla testing",
+      long_description="see http://mozbase.readthedocs.org",
       classifiers=[], # Get strings from http://pypi.python.org/pypi?%3Aaction=list_classifiers
       keywords='mozilla',
       author='Mozilla Automation and Testing Team',
diff --git a/testing/mozbase/mozinstall/README.md b/testing/mozbase/mozinstall/README.md
deleted file mode 100644
index bc034c6a1a1b..000000000000
--- a/testing/mozbase/mozinstall/README.md
+++ /dev/null
@@ -1,60 +0,0 @@
-[Mozinstall](https://github.com/mozilla/mozbase/tree/master/mozinstall) is a
-python package for installing and uninstalling Mozilla applications on
-various platforms.
-
-For example, depending on the platform, Firefox can be distributed as a
-zip, tar.bz2, exe, or dmg file or cloned from a repository. Mozinstall takes
-the hassle out of extracting and/or running these files and for convenience
-returns the full path to the install directory. In the case that mozinstall
-is invoked from the command line, the binary path will be printed to stdout.
-
-To remove an installed application the uninstaller can be used. It requires
-the installation path of the application and will remove all the installed
-files. On Windows the uninstaller will be tried first.
-
-# Usage
-Mozinstall can be used as API or via the CLI commands.
-
-## API
-An application can be installed by running the commands below. The install
-method will return the installation path of the application.
-
-    import mozinstall
-    path = mozinstall.install(%installer%, %install_folder%)
-
-To retrieve the real binary call get_binary with the path and
-the application name as arguments:
-
-    mozinstall.get_binary(path, 'firefox')
-
-If the application is not needed anymore the uninstaller will remove all
-traces from the system:
-
-    mozinstall.uninstall(path)
-
-## CLI
-The installer can also be used as a command line tool:
-
-    $ mozinstall -d firefox %installer%
-
-Whereby the directory option is optional and will default to the current
-working directory. If the installation was successful the path to the
-binary will be printed to stdout.
-
-Also the uninstaller can be called via the command line:
-
-    $ mozuninstall %install_path%
-
-# Error Handling
-
-Mozinstall throws different types of exceptions:
-
-- mozinstall.InstallError is thrown when the installation fails for any reason. A traceback is provided.
-- mozinstall.InvalidBinary is thrown when the binary cannot be found.
-- mozinstall.InvalidSource is thrown when the source is not a recognized file type (zip, exe, tar.bz2, tar.gz, dmg).
-
-
-# Dependencies
-
-Mozinstall depends on the [mozinfo](https://github.com/mozilla/mozbase/tree/master/mozinfo) 
-package which is also found in the mozbase repository.
diff --git a/testing/mozbase/mozinstall/setup.py b/testing/mozbase/mozinstall/setup.py
index 13fa8c5b1670..9c14f033c7f4 100644
--- a/testing/mozbase/mozinstall/setup.py
+++ b/testing/mozbase/mozinstall/setup.py
@@ -11,17 +11,16 @@ try:
 except IOError:
     description = None
 
-PACKAGE_VERSION = '1.4'
+PACKAGE_VERSION = '1.6'
 
-deps = ['mozinfo == 0.4',
+deps = ['mozinfo >= 0.4',
         'mozfile'
        ]
 
 setup(name='mozInstall',
       version=PACKAGE_VERSION,
-      description="This is a utility package for installing and uninstalling "
-                  "Mozilla applications on various platforms.",
-      long_description=description,
+      description="package for installing and uninstalling Mozilla applications",
+      long_description="see http://mozbase.readthedocs.org/",
       # Get strings from http://pypi.python.org/pypi?%3Aaction=list_classifiers
       classifiers=['Environment :: Console',
                    'Intended Audience :: Developers',
@@ -40,10 +39,14 @@ setup(name='mozInstall',
       include_package_data=True,
       zip_safe=False,
       install_requires=deps,
+      # we have to generate two more executables for those systems that cannot run as Administrator
+      # and the filename containing "install" triggers the UAC
       entry_points="""
       # -*- Entry points: -*-
       [console_scripts]
       mozinstall = mozinstall:install_cli
       mozuninstall = mozinstall:uninstall_cli
+      moz_add_to_system = mozinstall:install_cli
+      moz_remove_from_system = mozinstall:uninstall_cli
       """,
       )
diff --git a/testing/mozbase/mozprocess/setup.py b/testing/mozbase/mozprocess/setup.py
index 83de82b0ed47..e284fa154ad4 100644
--- a/testing/mozbase/mozprocess/setup.py
+++ b/testing/mozbase/mozprocess/setup.py
@@ -4,7 +4,7 @@
 
 from setuptools import setup
 
-PACKAGE_VERSION = '0.10'
+PACKAGE_VERSION = '0.11'
 
 setup(name='mozprocess',
       version=PACKAGE_VERSION,
diff --git a/testing/mozbase/mozprocess/tests/iniparser/Makefile b/testing/mozbase/mozprocess/tests/iniparser/Makefile
index a6b443c8cfd8..48c86f9d6afe 100644
--- a/testing/mozbase/mozprocess/tests/iniparser/Makefile
+++ b/testing/mozbase/mozprocess/tests/iniparser/Makefile
@@ -27,7 +27,7 @@ ifeq ($(UNAME), Darwin)
     AR	    = ar
     ARFLAGS = rcv
     SHLD = libtool
-    CFLAGS  = -v -arch i386 -isysroot /Developer/SDKs/MacOSX10.6.sdk -fPIC -Wall -ansi -pedantic
+    CFLAGS  = -v -arch i386 -fPIC -Wall -ansi -pedantic
     LDFLAGS = -arch_only i386
 endif
 ifeq ($(WIN32), 1)
diff --git a/testing/mozbase/mozprocess/tests/manifest.ini b/testing/mozbase/mozprocess/tests/manifest.ini
index 3fdadf47567e..1a086edeb96b 100644
--- a/testing/mozbase/mozprocess/tests/manifest.ini
+++ b/testing/mozbase/mozprocess/tests/manifest.ini
@@ -2,4 +2,4 @@
 # see https://bugzilla.mozilla.org/show_bug.cgi?id=790765#c51
 
 [test_mozprocess.py]
-skip-if = os == 'win'
\ No newline at end of file
+disabled = bug 877864

From b1208ea2a622a4426200ebb6b96ed8e8d956e322 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 17 Jun 2013 16:31:03 -0400
Subject: [PATCH 21/75] Bug 874758.  Make DOMStringMap use [OverrideBuiltins]. 
 r=peterv

---
 content/html/content/src/nsDOMStringMap.cpp   | 25 +++++++++++++++
 content/html/content/src/nsDOMStringMap.h     |  7 ++++-
 content/html/content/test/Makefile.in         |  1 +
 content/html/content/test/test_bug874758.html | 31 +++++++++++++++++++
 dom/webidl/DOMStringMap.webidl                |  1 +
 5 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 content/html/content/test/test_bug874758.html

diff --git a/content/html/content/src/nsDOMStringMap.cpp b/content/html/content/src/nsDOMStringMap.cpp
index f11641fe9109..32f91846642f 100644
--- a/content/html/content/src/nsDOMStringMap.cpp
+++ b/content/html/content/src/nsDOMStringMap.cpp
@@ -10,6 +10,7 @@
 #include "nsGenericHTMLElement.h"
 #include "nsContentUtils.h"
 #include "mozilla/dom/DOMStringMapBinding.h"
+#include "nsIDOMMutationEvent.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -24,16 +25,23 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDOMStringMap)
   if (tmp->mElement) {
     // Call back to element to null out weak reference to this object.
     tmp->mElement->ClearDataset();
+    tmp->mElement->RemoveMutationObserver(tmp);
     tmp->mElement = nullptr;
   }
+  ++tmp->mExpandoAndGeneration.generation;
+  tmp->mExpandoAndGeneration.expando = JS::UndefinedValue();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsDOMStringMap)
   NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
+  if (tmp->PreservingWrapper()) {
+    NS_IMPL_CYCLE_COLLECTION_TRACE_JSVAL_MEMBER_CALLBACK(mExpandoAndGeneration.expando);
+  }
 NS_IMPL_CYCLE_COLLECTION_TRACE_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMStringMap)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(nsIMutationObserver)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
@@ -45,6 +53,8 @@ nsDOMStringMap::nsDOMStringMap(nsGenericHTMLElement* aElement)
     mRemovingProp(false)
 {
   SetIsDOMBinding();
+
+  mElement->AddMutationObserver(this);
 }
 
 nsDOMStringMap::~nsDOMStringMap()
@@ -53,6 +63,7 @@ nsDOMStringMap::~nsDOMStringMap()
   if (mElement) {
     // Call back to element to null out weak reference to this object.
     mElement->ClearDataset();
+    mElement->RemoveMutationObserver(this);
   }
 }
 
@@ -235,3 +246,17 @@ bool nsDOMStringMap::AttrToDataProp(const nsAString& aAttr,
 
   return true;
 }
+
+void
+nsDOMStringMap::AttributeChanged(nsIDocument *aDocument, Element* aElement,
+                                 int32_t aNameSpaceID, nsIAtom* aAttribute,
+                                 int32_t aModType)
+{
+  if ((aModType == nsIDOMMutationEvent::ADDITION ||
+       aModType == nsIDOMMutationEvent::REMOVAL) &&
+      aNameSpaceID == kNameSpaceID_None &&
+      StringBeginsWith(nsDependentAtomString(aAttribute),
+                       NS_LITERAL_STRING("data-"))) {
+    ++mExpandoAndGeneration.generation;
+  }
+}
diff --git a/content/html/content/src/nsDOMStringMap.h b/content/html/content/src/nsDOMStringMap.h
index 1fddd1bbc0f9..fefeedbc68f7 100644
--- a/content/html/content/src/nsDOMStringMap.h
+++ b/content/html/content/src/nsDOMStringMap.h
@@ -13,18 +13,21 @@
 #include "nsString.h"
 #include "nsWrapperCache.h"
 #include "nsGenericHTMLElement.h"
+#include "jsfriendapi.h"
 
 namespace mozilla {
 class ErrorResult;
 }
 
-class nsDOMStringMap : public nsISupports,
+class nsDOMStringMap : public nsStubMutationObserver,
                        public nsWrapperCache
 {
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsDOMStringMap)
 
+  NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
+
   nsINode* GetParentObject()
   {
     return mElement;
@@ -42,6 +45,8 @@ public:
   void NamedDeleter(const nsAString& aProp, bool &found);
   void GetSupportedNames(nsTArray<nsString>& aNames);
 
+  js::ExpandoAndGeneration mExpandoAndGeneration;
+
 private:
   virtual ~nsDOMStringMap();
 
diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index aab783c5825c..8e777f7f7b4d 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -358,6 +358,7 @@ MOCHITEST_FILES = \
 		wakelock.ogv \
 		test_bug869040.html \
 		allowMedia.sjs \
+		test_bug874758.html \
 		$(NULL)
 
 MOCHITEST_CHROME_FILES = \
diff --git a/content/html/content/test/test_bug874758.html b/content/html/content/test/test_bug874758.html
new file mode 100644
index 000000000000..b8bfe40f390f
--- /dev/null
+++ b/content/html/content/test/test_bug874758.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html data-expando-prop="xyz">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=874758
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 874758</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 874758 **/
+  Object.prototype.expandoProp = 5;
+  is({}.expandoProp, 5, "Should see this on random objects");
+
+  is(document.head.dataset.expandoProp, 5, "Should see this on dataset too");
+  is(document.documentElement.dataset.expandoProp, "xyz",
+     "But if the dataset has it, we should get it from there");
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=874758">Mozilla Bug 874758</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>
diff --git a/dom/webidl/DOMStringMap.webidl b/dom/webidl/DOMStringMap.webidl
index f6982633ac96..0ed98e148a39 100644
--- a/dom/webidl/DOMStringMap.webidl
+++ b/dom/webidl/DOMStringMap.webidl
@@ -11,6 +11,7 @@
  * and create derivative works of this document.
  */
 
+[OverrideBuiltins]
 interface DOMStringMap {
   getter DOMString (DOMString name);
   [Throws]

From 0b60b2f7765f62adefa2faa606159ffeeb9ccb94 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 17 Jun 2013 16:31:04 -0400
Subject: [PATCH 22/75] Bug 883358 part 1.  When creating getter/setter
 functions for the JSPROP_NATIVE_ACCESSORS case in
 JS_DefineProperties/JS_DefineProperty, give them the name of the property. 
 r=till

---
 js/src/jsapi.cpp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index ceacf8e29e24..a5fd8d579410 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3853,10 +3853,15 @@ DefinePropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue val
      */
     if (attrs & JSPROP_NATIVE_ACCESSORS) {
         JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
+        JSFunction::Flags zeroFlags = JSAPIToJSFunctionFlags(0);
+        // We can't just use JS_NewFunctionById here because it
+        // assumes a string id.
+        RootedAtom atom(cx, JSID_IS_ATOM(id) ? JSID_TO_ATOM(id) : nullptr);
         attrs &= ~JSPROP_NATIVE_ACCESSORS;
         if (getter) {
             RootedObject global(cx, (JSObject*) &obj->global());
-            JSFunction *getobj = JS_NewFunction(cx, (Native) getter, 0, 0, global, NULL);
+            JSFunction *getobj = NewFunction(cx, NullPtr(), (Native) getter, 0,
+                                             zeroFlags, global, atom);
             if (!getobj)
                 return false;
 
@@ -3870,7 +3875,8 @@ DefinePropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue val
             // Root just the getter, since the setter is not yet a JSObject.
             AutoRooterGetterSetter getRoot(cx, JSPROP_GETTER, &getter, NULL);
             RootedObject global(cx, (JSObject*) &obj->global());
-            JSFunction *setobj = JS_NewFunction(cx, (Native) setter, 1, 0, global, NULL);
+            JSFunction *setobj = NewFunction(cx, NullPtr(), (Native) setter, 1,
+                                             zeroFlags, global, atom);
             if (!setobj)
                 return false;
 

From 4fea0995d355a0e3e8870fe48cbe9d9646f205a8 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 17 Jun 2013 16:31:13 -0400
Subject: [PATCH 23/75] Bug 883358 part 2.  Use the new information in bindings
 error reporting.  r=smaug

---
 dom/bindings/BindingUtils.cpp                 | 37 ++-------
 dom/bindings/BindingUtils.h                   |  9 +-
 dom/bindings/Codegen.py                       |  6 +-
 dom/bindings/Errors.msg                       |  6 +-
 dom/bindings/test/Makefile.in                 |  1 +
 .../test/test_exception_messages.html         | 82 +++++++++++++++++++
 6 files changed, 100 insertions(+), 41 deletions(-)
 create mode 100644 dom/bindings/test/test_exception_messages.html

diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index d2b16cf403e6..260d8f44fff4 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -60,47 +60,26 @@ ThrowErrorMessage(JSContext* aCx, const ErrNum aErrorNumber, ...)
 }
 
 bool
-ThrowInvalidMethodThis(JSContext* aCx, const JS::CallArgs& aArgs,
-                       const char* aInterfaceName)
+ThrowInvalidThis(JSContext* aCx, const JS::CallArgs& aArgs,
+                 const ErrNum aErrorNumber,
+                 const char* aInterfaceName)
 {
   NS_ConvertASCIItoUTF16 ifaceName(aInterfaceName);
-  // This should only be called for DOM methods, which are JSNative-backed
-  // functions, so we can assume that JS_ValueToFunction and
-  // JS_GetFunctionDisplayId will both return non-null and that
-  // JS_GetStringCharsZ returns non-null.
+  // This should only be called for DOM methods/getters/setters, which
+  // are JSNative-backed functions, so we can assume that
+  // JS_ValueToFunction and JS_GetFunctionDisplayId will both return
+  // non-null and that JS_GetStringCharsZ returns non-null.
   JS::Rooted<JSFunction*> func(aCx, JS_ValueToFunction(aCx, aArgs.calleev()));
   MOZ_ASSERT(func);
   JS::Rooted<JSString*> funcName(aCx, JS_GetFunctionDisplayId(func));
   MOZ_ASSERT(funcName);
   JS_ReportErrorNumberUC(aCx, GetErrorMessage, nullptr,
-                         static_cast<const unsigned>(MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE),
+                         static_cast<const unsigned>(aErrorNumber),
                          JS_GetStringCharsZ(aCx, funcName),
                          ifaceName.get());
   return false;
 }
 
-bool
-ThrowInvalidGetterThis(JSContext* aCx, const char* aInterfaceName)
-{
-  // Sadly for getters we have no way to get the name of the property.
-  NS_ConvertASCIItoUTF16 ifaceName(aInterfaceName);
-  JS_ReportErrorNumberUC(aCx, GetErrorMessage, nullptr,
-                         static_cast<const unsigned>(MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE),
-                         ifaceName.get());
-  return false;
-}
-
-bool
-ThrowInvalidSetterThis(JSContext* aCx, const char* aInterfaceName)
-{
-  // Sadly for setters we have no way to get the name of the property.
-  NS_ConvertASCIItoUTF16 ifaceName(aInterfaceName);
-  JS_ReportErrorNumberUC(aCx, GetErrorMessage, nullptr,
-                         static_cast<const unsigned>(MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE),
-                         ifaceName.get());
-  return false;
-}
-
 } // namespace dom
 
 struct ErrorResult::Message {
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index 0042c1e97c7d..558fd89421a6 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -60,12 +60,9 @@ UnwrapArg(JSContext* cx, jsval v, Interface** ppArg,
 bool
 ThrowErrorMessage(JSContext* aCx, const ErrNum aErrorNumber, ...);
 bool
-ThrowInvalidMethodThis(JSContext* aCx, const JS::CallArgs& aArgs,
-                       const char* aInterfaceName);
-bool
-ThrowInvalidGetterThis(JSContext* aCx, const char* aInterfaceName);
-bool
-ThrowInvalidSetterThis(JSContext* aCx, const char* aInterfaceName);
+ThrowInvalidThis(JSContext* aCx, const JS::CallArgs& aArgs,
+                 const ErrNum aErrorNumber,
+                 const char* aInterfaceName);
 
 template<bool mainThread>
 inline bool
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index c144b0bf6852..f0e25fd11346 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -5185,7 +5185,7 @@ class CGGenericMethod(CGAbstractBindingMethod):
         args = [Argument('JSContext*', 'cx'), Argument('unsigned', 'argc'),
                 Argument('JS::Value*', 'vp')]
         unwrapFailureCode = (
-            'return ThrowInvalidMethodThis(cx, args, \"%s\");' %
+            'return ThrowInvalidThis(cx, args, MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE, \"%s\");' %
             descriptor.interface.identifier.name)
         CGAbstractBindingMethod.__init__(self, descriptor, 'genericMethod',
                                          args,
@@ -5322,7 +5322,7 @@ class CGGenericGetter(CGAbstractBindingMethod):
         else:
             name = "genericGetter"
             unwrapFailureCode = (
-                'return ThrowInvalidGetterThis(cx, "%s");' %
+                'return ThrowInvalidThis(cx, args, MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, "%s");' %
                 descriptor.interface.identifier.name)
         CGAbstractBindingMethod.__init__(self, descriptor, name, args,
                                          unwrapFailureCode)
@@ -5402,7 +5402,7 @@ class CGGenericSetter(CGAbstractBindingMethod):
         else:
             name = "genericSetter"
             unwrapFailureCode = (
-                'return ThrowInvalidSetterThis(cx, "%s");' %
+                'return ThrowInvalidThis(cx, args, MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, "%s");' %
                 descriptor.interface.identifier.name)
 
         CGAbstractBindingMethod.__init__(self, descriptor, name, args,
diff --git a/dom/bindings/Errors.msg b/dom/bindings/Errors.msg
index a705918f4f7e..68fb8762d767 100644
--- a/dom/bindings/Errors.msg
+++ b/dom/bindings/Errors.msg
@@ -24,9 +24,9 @@ MSG_DEF(MSG_MISSING_ARGUMENTS, 1, "Not enough arguments to {0}.")
 MSG_DEF(MSG_NOT_OBJECT, 1, "{0} is not an object.")
 MSG_DEF(MSG_NOT_CALLABLE, 1, "{0} is not callable.")
 MSG_DEF(MSG_DOES_NOT_IMPLEMENT_INTERFACE, 2, "{0} does not implement interface {1}.")
-MSG_DEF(MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "{0} called on an object that does not implement interface {1}.")
-MSG_DEF(MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 1, "getter called on an object that does not implement interface {0}.")
-MSG_DEF(MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 1, "setter called on an object that does not implement interface {0}.")
+MSG_DEF(MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "'{0}' called on an object that does not implement interface {1}.")
+MSG_DEF(MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "'{0}' getter called on an object that does not implement interface {1}.")
+MSG_DEF(MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "'{0}' setter called on an object that does not implement interface {1}.")
 MSG_DEF(MSG_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 1, "\"this\" object does not implement interface {0}.")
 MSG_DEF(MSG_NOT_IN_UNION, 2, "{0} could not be converted to any of: {1}.")
 MSG_DEF(MSG_ILLEGAL_CONSTRUCTOR, 0, "Illegal constructor.")
diff --git a/dom/bindings/test/Makefile.in b/dom/bindings/test/Makefile.in
index d28a87683401..2aacb59de809 100644
--- a/dom/bindings/test/Makefile.in
+++ b/dom/bindings/test/Makefile.in
@@ -75,6 +75,7 @@ MOCHITEST_FILES := \
   test_bug560072.html \
   test_lenientThis.html \
   test_ByteString.html \
+  test_exception_messages.html \
   $(NULL)
 
 MOCHITEST_CHROME_FILES = \
diff --git a/dom/bindings/test/test_exception_messages.html b/dom/bindings/test/test_exception_messages.html
new file mode 100644
index 000000000000..fd1bd949c812
--- /dev/null
+++ b/dom/bindings/test/test_exception_messages.html
@@ -0,0 +1,82 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=882653
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 882653</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 882653 **/
+  // Each test is a string to eval, the expected exception message, and the
+  // test description.
+  var tests = [
+      [ 'document.documentElement.appendChild.call({}, new Image())',
+	"'appendChild' called on an object that does not implement interface Node.",
+	"bogus method this object" ],
+      [ 'Object.getOwnPropertyDescriptor(Document.prototype, "documentElement").get.call({})',
+	"'documentElement' getter called on an object that does not implement interface Document.",
+	"bogus getter this object" ],
+      [ 'Object.getOwnPropertyDescriptor(Element.prototype, "innerHTML").set.call({})',
+	"'innerHTML' setter called on an object that does not implement interface Element.",
+	"bogus setter this object" ],
+      [ 'document.documentElement.appendChild(5)',
+	"Argument 1 of Node.appendChild is not an object.",
+	"bogus interface argument" ],
+      [ 'document.documentElement.appendChild(null)',
+	"Argument 1 of Node.appendChild is not an object.",
+	"null interface argument" ],
+      [ 'document.createTreeWalker(document).currentNode = 5',
+	"Value being assigned to TreeWalker.currentNode is not an object.",
+	"interface setter call" ],
+      [ 'document.documentElement.appendChild({})',
+	"Argument 1 of Node.appendChild does not implement interface Node.",
+	"wrong interface argument" ],
+      [ 'document.createTreeWalker(document).currentNode = {}',
+	"Value being assigned to TreeWalker.currentNode does not implement interface Node.",
+	"wrong interface setter call" ],
+      [ 'document.createElement("canvas").getContext("2d").fill("bogus")',
+	"Argument 1 of CanvasRenderingContext2D.fill 'bogus' is not a valid value for enumeration CanvasWindingRule.",
+	"bogus enum value" ],
+      [ 'document.createTreeWalker(document, 0xFFFFFFFF, { acceptNode: 5 }).nextNode()',
+	"Property 'acceptNode' is not callable.",
+	"non-callable callback interface operation property" ],
+      [ '(new TextEncoder).encode("", new RegExp())',
+	"Argument 2 of TextEncoder.encode can't be converted to a dictionary.",
+	"regexp passed for a dictionary" ],
+      [ 'document.createElement("canvas").getContext("webgl").uniform1fv(null, new RegExp())',
+	"Argument 2 is not valid for any of the 2-argument overloads of WebGLRenderingContext.uniform1fv.",
+	"regexp passed for a sequence" ],
+      [ 'document.createElement("select").add({})',
+	"Argument 1 of HTMLSelectElement.add could not be converted to any of: HTMLOptionElement, HTMLOptGroupElement.",
+	"invalid value passed for union" ],
+      [ 'document.createElement("canvas").getContext("2d").createLinearGradient(0, 1, 0, 1).addColorStop(NaN, "")',
+	"Argument 1 of CanvasGradient.addColorStop is not a finite floating-point value.",
+	"invalid float" ]
+  ];
+
+  for (var i = 0; i < tests.length; ++i) {
+      msg = "Correct exception should be thrown for " + tests[i][2];
+      try {
+	  eval(tests[i][0]);
+	  ok(false, msg);
+      } catch (e) {
+	  is(e.message, tests[i][1], msg);
+      }
+  }
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=882653">Mozilla Bug 882653</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>

From e6082d520c28263ed861d5398ac42e023229f0f7 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Fri, 14 Jun 2013 14:28:26 -0700
Subject: [PATCH 24/75] Bug 883383 - Fix some more static root analysis
 failures in SpiderMonkey; r=sfink

--HG--
extra : rebase_source : b43a23b00233c0f53f8506eef300f941093f113d
---
 js/src/builtin/TestingFunctions.cpp | 4 ++--
 js/src/ion/BaselineIC.cpp           | 6 +++---
 js/src/ion/BaselineIC.h             | 2 +-
 js/src/ion/Ion.cpp                  | 4 +---
 js/src/ion/Ion.h                    | 2 +-
 js/src/jsstr.cpp                    | 5 +++--
 6 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 1dbd5eef2292..eb1b2b0d7e9b 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -914,8 +914,8 @@ ShellObjectMetadataCallback(JSContext *cx)
 {
     Value thisv = UndefinedValue();
 
-    Value rval;
-    if (!Invoke(cx, thisv, ObjectValue(*objectMetadataFunction), 0, NULL, &rval)) {
+    RootedValue rval(cx);
+    if (!Invoke(cx, thisv, ObjectValue(*objectMetadataFunction), 0, NULL, rval.address())) {
         cx->clearPendingException();
         return NULL;
     }
diff --git a/js/src/ion/BaselineIC.cpp b/js/src/ion/BaselineIC.cpp
index 491e3ceedb53..1c5f34747a9f 100644
--- a/js/src/ion/BaselineIC.cpp
+++ b/js/src/ion/BaselineIC.cpp
@@ -1316,7 +1316,7 @@ ICTypeMonitor_TypeObject::Compiler::generateStubCode(MacroAssembler &masm)
 
 bool
 ICUpdatedStub::addUpdateStubForValue(JSContext *cx, HandleScript script, HandleObject obj,
-                                     jsid id, HandleValue val)
+                                     HandleId id, HandleValue val)
 {
     if (numOptimizedStubs_ >= MAX_OPTIMIZED_STUBS) {
         // TODO: if the TypeSet becomes unknown or has the AnyObject type,
@@ -4215,7 +4215,7 @@ DoSetElemFallback(JSContext *cx, BaselineFrame *frame, ICSetElem_Fallback *stub,
                 ICUpdatedStub *denseStub = compiler.getStub(compiler.getStubSpace(script));
                 if (!denseStub)
                     return false;
-                if (!denseStub->addUpdateStubForValue(cx, script, obj, JSID_VOID, rhs))
+                if (!denseStub->addUpdateStubForValue(cx, script, obj, JS::JSID_VOIDHANDLE, rhs))
                     return false;
 
                 stub->addNewStub(denseStub);
@@ -4229,7 +4229,7 @@ DoSetElemFallback(JSContext *cx, BaselineFrame *frame, ICSetElem_Fallback *stub,
                 ICUpdatedStub *denseStub = compiler.getStub(compiler.getStubSpace(script));
                 if (!denseStub)
                     return false;
-                if (!denseStub->addUpdateStubForValue(cx, script, obj, JSID_VOID, rhs))
+                if (!denseStub->addUpdateStubForValue(cx, script, obj, JS::JSID_VOIDHANDLE, rhs))
                     return false;
 
                 stub->addNewStub(denseStub);
diff --git a/js/src/ion/BaselineIC.h b/js/src/ion/BaselineIC.h
index 6afd51f216b9..87536cc44e76 100644
--- a/js/src/ion/BaselineIC.h
+++ b/js/src/ion/BaselineIC.h
@@ -925,7 +925,7 @@ class ICUpdatedStub : public ICStub
   public:
     bool initUpdatingChain(JSContext *cx, ICStubSpace *space);
 
-    bool addUpdateStubForValue(JSContext *cx, HandleScript script, HandleObject obj, jsid id,
+    bool addUpdateStubForValue(JSContext *cx, HandleScript script, HandleObject obj, HandleId id,
                                HandleValue val);
 
     void addOptimizedUpdateStub(ICStub *stub) {
diff --git a/js/src/ion/Ion.cpp b/js/src/ion/Ion.cpp
index 3f30a358b125..aa9f138ad04c 100644
--- a/js/src/ion/Ion.cpp
+++ b/js/src/ion/Ion.cpp
@@ -1655,7 +1655,7 @@ ion::CanEnterAtBranch(JSContext *cx, JSScript *script, AbstractFramePtr fp,
 }
 
 MethodStatus
-ion::CanEnter(JSContext *cx, JSScript *script, AbstractFramePtr fp, bool isConstructing)
+ion::CanEnter(JSContext *cx, HandleScript script, AbstractFramePtr fp, bool isConstructing)
 {
     JS_ASSERT(ion::IsEnabled(cx));
 
@@ -1675,13 +1675,11 @@ ion::CanEnter(JSContext *cx, JSScript *script, AbstractFramePtr fp, bool isConst
     // Creating |this| is done before building Ion because it may change the
     // type information and invalidate compilation results.
     if (isConstructing && fp.thisValue().isPrimitive()) {
-        RootedScript scriptRoot(cx, script);
         RootedObject callee(cx, fp.callee());
         RootedObject obj(cx, CreateThisForFunction(cx, callee, fp.useNewType()));
         if (!obj || !ion::IsEnabled(cx)) // Note: OOM under CreateThis can disable TI.
             return Method_Skipped;
         fp.thisValue().setObject(*obj);
-        script = scriptRoot;
     }
 
     // Mark as forbidden if frame can't be handled.
diff --git a/js/src/ion/Ion.h b/js/src/ion/Ion.h
index 9cbadd814883..ccf550b7f470 100644
--- a/js/src/ion/Ion.h
+++ b/js/src/ion/Ion.h
@@ -275,7 +275,7 @@ bool CanIonCompileScript(JSContext *cx, HandleScript script, bool osr);
 
 MethodStatus CanEnterAtBranch(JSContext *cx, JSScript *script,
                               AbstractFramePtr fp, jsbytecode *pc, bool isConstructing);
-MethodStatus CanEnter(JSContext *cx, JSScript *script, AbstractFramePtr fp, bool isConstructing);
+MethodStatus CanEnter(JSContext *cx, HandleScript script, AbstractFramePtr fp, bool isConstructing);
 MethodStatus CompileFunctionForBaseline(JSContext *cx, HandleScript script, AbstractFramePtr fp,
                                         bool isConstructing);
 MethodStatus CanEnterUsingFastInvoke(JSContext *cx, HandleScript script, uint32_t numActualArgs);
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index f0753ce1ae89..2839d15ba1b5 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -606,12 +606,13 @@ DoSubstr(JSContext *cx, JSString *str, size_t begin, size_t len)
         size_t lhsLength = rope->leftChild()->length() - begin;
         size_t rhsLength = begin + len - rope->leftChild()->length();
 
-        RootedString lhs(cx, js_NewDependentString(cx, rope->leftChild(),
+        Rooted<JSRope *> ropeRoot(cx, rope);
+        RootedString lhs(cx, js_NewDependentString(cx, ropeRoot->leftChild(),
                                                    begin, lhsLength));
         if (!lhs)
             return NULL;
 
-        RootedString rhs(cx, js_NewDependentString(cx, rope->rightChild(), 0, rhsLength));
+        RootedString rhs(cx, js_NewDependentString(cx, ropeRoot->rightChild(), 0, rhsLength));
         if (!rhs)
             return NULL;
 

From aff9b97c87e5d1faaef6b67645a1d3798882b9f3 Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Mon, 17 Jun 2013 16:54:06 -0400
Subject: [PATCH 25/75] Back out 423d565f5637 (bug 493051) for xpcshell bustage

---
 browser/components/search/content/search.xml  | 13 +--
 .../components/search/test/browser_426329.js  |  3 +-
 .../search/test/browser_contextmenu.js        |  3 +-
 .../browser_private_search_perwindowpb.js     | 24 ++---
 .../base/public/nsIBrowserSearchService.idl   | 34 +------
 toolkit/components/search/nsSearchService.js  | 71 ++++-----------
 .../search/tests/xpcshell/head_search.js      |  2 +-
 .../tests/xpcshell/test_addEngine_callback.js | 89 -------------------
 .../tests/xpcshell/test_notifications.js      |  3 +-
 .../search/tests/xpcshell/xpcshell.ini        |  2 +-
 10 files changed, 46 insertions(+), 198 deletions(-)
 delete mode 100644 toolkit/components/search/tests/xpcshell/test_addEngine_callback.js

diff --git a/browser/components/search/content/search.xml b/browser/components/search/content/search.xml
index 0a1dcaf18384..e105f527f8df 100644
--- a/browser/components/search/content/search.xml
+++ b/browser/components/search/content/search.xml
@@ -488,22 +488,17 @@
     <handlers>
       <handler event="command"><![CDATA[
         const target = event.originalTarget;
-        if (target.engine) {
-          this.currentEngine = target.engine;
-        } else if (target.classList.contains("addengine-item")) {
+        if (target.classList.contains("addengine-item")) {
           var searchService =
             Components.classes["@mozilla.org/browser/search-service;1"]
                       .getService(Components.interfaces.nsIBrowserSearchService);
           // We only detect OpenSearch files
           var type = Components.interfaces.nsISearchEngine.DATA_XML;
-          // Select the installed engine if the installation succeeds
-          var installCallback = {
-            onSuccess: engine => this.currentEngine = engine
-          }
           searchService.addEngine(target.getAttribute("uri"), type,
-                                  target.getAttribute("src"), false,
-                                  installCallback);
+                                  target.getAttribute("src"), false);
         }
+        else if (target.engine)
+          this.currentEngine = target.engine;
         else
           return;
 
diff --git a/browser/components/search/test/browser_426329.js b/browser/components/search/test/browser_426329.js
index 4b2310cd5a3b..585da8e6bc4d 100644
--- a/browser/components/search/test/browser_426329.js
+++ b/browser/components/search/test/browser_426329.js
@@ -30,7 +30,8 @@ function test() {
       case "engine-added":
         var engine = ss.getEngineByName("Bug 426329");
         ok(engine, "Engine was added.");
-        ss.currentEngine = engine;
+        //XXX Bug 493051
+        //ss.currentEngine = engine;
         break;
       case "engine-current":
         ok(ss.currentEngine.name == "Bug 426329", "currentEngine set");
diff --git a/browser/components/search/test/browser_contextmenu.js b/browser/components/search/test/browser_contextmenu.js
index f34bbc60bb6e..3ac69dbbaa3c 100644
--- a/browser/components/search/test/browser_contextmenu.js
+++ b/browser/components/search/test/browser_contextmenu.js
@@ -16,7 +16,8 @@ function test() {
       case "engine-added":
         var engine = ss.getEngineByName(ENGINE_NAME);
         ok(engine, "Engine was added.");
-        ss.currentEngine = engine;
+        //XXX Bug 493051
+        //ss.currentEngine = engine;
         break;
       case "engine-current":
         is(ss.currentEngine.name, ENGINE_NAME, "currentEngine set");
diff --git a/browser/components/search/test/browser_private_search_perwindowpb.js b/browser/components/search/test/browser_private_search_perwindowpb.js
index 24c733e5e615..2dc911bd3ace 100644
--- a/browser/components/search/test/browser_private_search_perwindowpb.js
+++ b/browser/components/search/test/browser_private_search_perwindowpb.js
@@ -42,18 +42,20 @@ function test() {
   }
 
   function addEngine(aCallback) {
-    let installCallback = {
-      onSuccess: function (engine) {
-        Services.search.currentEngine = engine;
-        aCallback();
-      },
-      onError: function (errorCode) {
-        ok(false, "failed to install engine: " + errorCode);
+    function observer(aSub, aTopic, aData) {
+      switch (aData) {
+        case "engine-current":
+          ok(Services.search.currentEngine.name == "Bug 426329",
+             "currentEngine set");
+          aCallback();
+          break;
       }
-    };
-    Services.search.addEngine(engineURL + "426329.xml",
-                              Ci.nsISearchEngine.DATA_XML,
-                              "data:image/x-icon,%00", false, installCallback);
+    }
+
+    Services.obs.addObserver(observer, "browser-search-engine-modified", false);
+    Services.search.addEngine(
+      engineURL + "426329.xml", Ci.nsISearchEngine.DATA_XML,
+      "data:image/x-icon,%00", false);
   }
 
   function testOnWindow(aIsPrivate, aCallback) {
diff --git a/netwerk/base/public/nsIBrowserSearchService.idl b/netwerk/base/public/nsIBrowserSearchService.idl
index 726a64a0333d..b441050a72df 100644
--- a/netwerk/base/public/nsIBrowserSearchService.idl
+++ b/netwerk/base/public/nsIBrowserSearchService.idl
@@ -140,30 +140,6 @@ interface nsISearchEngine : nsISupports
 
 };
 
-[scriptable, uuid(9fc39136-f08b-46d3-b232-96f4b7b0e235)]
-interface nsISearchInstallCallback : nsISupports
-{
-  const unsigned long ERROR_UNKNOWN_FAILURE = 0x1;
-  const unsigned long ERROR_DUPLICATE_ENGINE = 0x2;
-
-  /**
-   * Called to indicate that the engine addition process succeeded.
-   *
-   * @param engine
-   *        The nsISearchEngine object that was added (will not be null).
-   */
-  void onSuccess(in nsISearchEngine engine);
-
-  /**
-   * Called to indicate that the engine addition process failed.
-   *
-   * @param errorCode
-   *        One of the ERROR_* values described above indicating the cause of
-   *        the failure.
-   */
-  void onError(in unsigned long errorCode);
-};
-
 /**
  * Callback for asynchronous initialization of nsIBrowserSearchService
  */
@@ -210,7 +186,8 @@ interface nsIBrowserSearchService : nsISupports
    * Adds a new search engine from the file at the supplied URI, optionally
    * asking the user for confirmation first.  If a confirmation dialog is
    * shown, it will offer the option to begin using the newly added engine
-   * right away.
+   * right away; if no confirmation dialog is shown, the new engine will be
+   * used right away automatically.
    *
    * @param engineURL
    *        The URL to the search engine's description file.
@@ -230,16 +207,11 @@ interface nsIBrowserSearchService : nsISupports
    *        value is false, the engine will be added to the list upon successful
    *        load, but it will not be selected as the current engine.
    *
-   * @param callback
-   *        A nsISearchInstallCallback that will be notified when the
-   *        addition is complete, or if the addition fails. It will not be
-   *        called if addEngine throws an exception.
-   *
    * @throws NS_ERROR_FAILURE if the type is invalid, or if the description
    *         file cannot be successfully loaded.
    */
   void addEngine(in AString engineURL, in long dataType, in AString iconURL,
-                 in boolean confirm, [optional] in nsISearchInstallCallback callback);
+                 in boolean confirm);
 
   /**
    * Adds a new search engine, without asking the user for confirmation and
diff --git a/toolkit/components/search/nsSearchService.js b/toolkit/components/search/nsSearchService.js
index 8a154c15a86e..27436ea1e077 100644
--- a/toolkit/components/search/nsSearchService.js
+++ b/toolkit/components/search/nsSearchService.js
@@ -5,7 +5,6 @@
 const Ci = Components.interfaces;
 const Cc = Components.classes;
 const Cr = Components.results;
-const Cu = Components.utils;
 
 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 Components.utils.import("resource://gre/modules/Services.jsm");
@@ -1151,10 +1150,7 @@ Engine.prototype = {
   _confirm: false,
   // Whether to set this as the current engine as soon as it is loaded.  This
   // is only used when the engine is first added to the list.
-  _useNow: false,
-  // A function to be invoked when this engine object's addition completes (or
-  // fails). Only used for installation via addEngine.
-  _installCallback: null,
+  _useNow: true,
   // Where the engine was loaded from. Can be one of: SEARCH_APP_DIR,
   // SEARCH_PROFILE_DIR, SEARCH_IN_EXTENSION.
   __installLocation: null,
@@ -1308,19 +1304,10 @@ Engine.prototype = {
    */
   _onLoad: function SRCH_ENG_onLoad(aBytes, aEngine) {
     /**
-     * Handle an error during the load of an engine by notifying the engine's
-     * error callback, if any.
+     * Handle an error during the load of an engine by prompting the user to
+     * notify him that the load failed.
      */
-    function onError(errorCode = Ci.nsISearchInstallCallback.ERROR_UNKNOWN_FAILURE) {
-      // Notify the callback of the failure
-      if (aEngine._installCallback) {
-        aEngine._installCallback(errorCode);
-      }
-    }
-
-    function promptError(strings = {}, error = undefined) {
-      onError(error);
-
+    function onError(aErrorString, aTitleString) {
       if (aEngine._engineToUpdate) {
         // We're in an update, so just fail quietly
         LOG("updating " + aEngine._engineToUpdate.name + " failed");
@@ -1330,8 +1317,8 @@ Engine.prototype = {
       var brandName = brandBundle.GetStringFromName("brandShortName");
 
       var searchBundle = Services.strings.createBundle(SEARCH_BUNDLE);
-      var msgStringName = strings.error || "error_loading_engine_msg2";
-      var titleStringName = strings.title || "error_loading_engine_title";
+      var msgStringName = aErrorString || "error_loading_engine_msg2";
+      var titleStringName = aTitleString || "error_loading_engine_title";
       var title = searchBundle.GetStringFromName(titleStringName);
       var text = searchBundle.formatStringFromName(msgStringName,
                                                    [brandName, aEngine._location],
@@ -1341,7 +1328,7 @@ Engine.prototype = {
     }
 
     if (!aBytes) {
-      promptError();
+      onError();
       return;
     }
 
@@ -1364,7 +1351,7 @@ Engine.prototype = {
         aEngine._data = aBytes;
         break;
       default:
-        promptError();
+        onError();
         LOG("_onLoad: Bogus engine _dataType: \"" + this._dataType + "\"");
         return;
     }
@@ -1375,7 +1362,7 @@ Engine.prototype = {
     } catch (ex) {
       LOG("_onLoad: Failed to init engine!\n" + ex);
       // Report an error to the user
-      promptError();
+      onError();
       return;
     }
 
@@ -1384,9 +1371,9 @@ Engine.prototype = {
     // otherwise we fail silently.
     if (!engineToUpdate) {
       if (Services.search.getEngineByName(aEngine.name)) {
-        promptError({ error: "error_duplicate_engine_msg",
-                      title: "error_invalid_engine_title"
-                    }, Ci.nsISearchInstallCallback.ERROR_DUPLICATE_ENGINE);
+        if (aEngine._confirm)
+          onError("error_duplicate_engine_msg", "error_invalid_engine_title");
+
         LOG("_onLoad: duplicate engine found, bailing");
         return;
       }
@@ -1399,10 +1386,8 @@ Engine.prototype = {
       var confirmation = aEngine._confirmAddEngine();
       LOG("_onLoad: confirm is " + confirmation.confirmed +
           "; useNow is " + confirmation.useNow);
-      if (!confirmation.confirmed) {
-        onError();
+      if (!confirmation.confirmed)
         return;
-      }
       aEngine._useNow = confirmation.useNow;
     }
 
@@ -1429,7 +1414,6 @@ Engine.prototype = {
           if (!newSelfURL || !newSelfURL._hasRelation("self")) {
             LOG("_onLoad: updateURL missing in updated engine for " +
                 aEngine.name + " aborted");
-            onError();
             return;
           }
           newUpdateURL = newSelfURL.template;
@@ -1437,7 +1421,6 @@ Engine.prototype = {
 
         if (oldUpdateURL != newUpdateURL) {
           LOG("_onLoad: updateURLs do not match! Update of " + aEngine.name + " aborted");
-          onError();
           return;
         }
       }
@@ -1445,6 +1428,10 @@ Engine.prototype = {
       // Set the new engine's icon, if it doesn't yet have one.
       if (!aEngine._iconURI && engineToUpdate._iconURI)
         aEngine._iconURI = engineToUpdate._iconURI;
+
+      // Clear the "use now" flag since we don't want to be changing the
+      // current engine for an update.
+      aEngine._useNow = false;
     }
 
     // Write the engine to file. For readOnly engines, they'll be stored in the
@@ -1455,11 +1442,6 @@ Engine.prototype = {
     // Notify the search service of the successful load. It will deal with
     // updates by checking aEngine._engineToUpdate.
     notifyAction(aEngine, SEARCH_ENGINE_LOADED);
-
-    // Notify the callback if needed
-    if (aEngine._installCallback) {
-      aEngine._installCallback();
-    }
   },
 
   /**
@@ -3359,31 +3341,14 @@ SearchService.prototype = {
   },
 
   addEngine: function SRCH_SVC_addEngine(aEngineURL, aDataType, aIconURL,
-                                         aConfirm, aCallback) {
+                                         aConfirm) {
     LOG("addEngine: Adding \"" + aEngineURL + "\".");
     this._ensureInitialized();
     try {
       var uri = makeURI(aEngineURL);
       var engine = new Engine(uri, aDataType, false);
-      if (aCallback) {
-        engine._installCallback = function (errorCode) {
-          try {
-            if (errorCode == null)
-              aCallback.onSuccess(engine);
-            else
-              aCallback.onError(errorCode);
-          } catch (ex) {
-            Cu.reportError("Error invoking addEngine install callback: " + ex);
-          }
-          // Clear the reference to the callback now that it's been invoked.
-          engine._installCallback = null;
-        };
-      }
       engine._initFromURI();
     } catch (ex) {
-      // Drop the reference to the callback, if set
-      if (engine)
-        engine._installCallback = null;
       FAIL("addEngine: Error adding engine:\n" + ex, Cr.NS_ERROR_FAILURE);
     }
     engine._setIcon(aIconURL, false);
diff --git a/toolkit/components/search/tests/xpcshell/head_search.js b/toolkit/components/search/tests/xpcshell/head_search.js
index 4eb221642fa7..4775ae4a0177 100644
--- a/toolkit/components/search/tests/xpcshell/head_search.js
+++ b/toolkit/components/search/tests/xpcshell/head_search.js
@@ -97,7 +97,7 @@ function afterCache(callback)
   Services.obs.addObserver(obs, "browser-search-service", false);
 }
 
-function parseJsonFromStream(aInputStream) {
+function  parseJsonFromStream(aInputStream) {
   const json = Cc["@mozilla.org/dom/json;1"].createInstance(Components.interfaces.nsIJSON);
   const data = json.decodeFromStream(aInputStream, aInputStream.available());
   return data;
diff --git a/toolkit/components/search/tests/xpcshell/test_addEngine_callback.js b/toolkit/components/search/tests/xpcshell/test_addEngine_callback.js
deleted file mode 100644
index 7e5446f7b42b..000000000000
--- a/toolkit/components/search/tests/xpcshell/test_addEngine_callback.js
+++ /dev/null
@@ -1,89 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
- *    http://creativecommons.org/publicdomain/zero/1.0/ */
-
-/*
- * Tests covering nsIBrowserSearchService::addEngine's optional callback.
- */
-
-"use strict";
-
-const Ci = Components.interfaces;
-
-Components.utils.import("resource://testing-common/httpd.js");
-
-// First test inits the search service
-add_test(function init_search_service() {
-  Services.search.init(function (status) {
-    if (!Components.isSuccessCode(status))
-      do_throw("Failed to initialize search service");
-
-    run_next_test();
-  });
-});
-
-// Simple test of the search callback
-add_test(function simple_callback_test() {
-  let searchCallback = {
-    onSuccess: function (engine) {
-      do_check_true(!!engine);
-      do_check_neq(engine.name, Services.search.defaultEngine.name);
-      run_next_test();
-    },
-    onError: function (errorCode) {
-      do_throw("search callback returned error: " + errorCode);
-    }
-  }
-  Services.search.addEngine("http://localhost:4444/data/engine.xml",
-                            Ci.nsISearchEngine.DATA_XML,
-                            null, false, searchCallback);
-});
-
-// Test of the search callback on duplicate engine failures
-add_test(function duplicate_failure_test() {
-  let searchCallback = {
-    onSuccess: function (engine) {
-      do_throw("this addition should not have succeeded");
-    },
-    onError: function (errorCode) {
-      do_check_true(!!errorCode);
-      do_check_eq(errorCode, Ci.nsISearchInstallCallback.ERROR_DUPLICATE_ENGINE);
-      run_next_test();
-    }
-  }
-  // Re-add the same engine added in the previous test
-  Services.search.addEngine("http://localhost:4444/data/engine.xml",
-                            Ci.nsISearchEngine.DATA_XML,
-                            null, false, searchCallback);
-});
-
-// Test of the search callback on failure to load the engine failures
-add_test(function load_failure_test() {
-  let searchCallback = {
-    onSuccess: function (engine) {
-      do_throw("this addition should not have succeeded");
-    },
-    onError: function (errorCode) {
-      do_check_true(!!errorCode);
-      do_check_eq(errorCode, Ci.nsISearchInstallCallback.ERROR_UNKNOWN_FAILURE);
-      run_next_test();
-    }
-  }
-  // Try adding an engine that doesn't exist
-  Services.search.addEngine("http://invalid/data/engine.xml",
-                            Ci.nsISearchEngine.DATA_XML,
-                            null, false, searchCallback);
-});
-
-function run_test() {
-  updateAppInfo();
-
-  let httpServer = new HttpServer();
-  httpServer.start(4444);
-  httpServer.registerDirectory("/", do_get_cwd());
-
-  do_register_cleanup(function cleanup() {
-    httpServer.stop(function() {});
-  });
-
-  run_next_test();
-}
diff --git a/toolkit/components/search/tests/xpcshell/test_notifications.js b/toolkit/components/search/tests/xpcshell/test_notifications.js
index 485ed0e6e136..a75a77d60671 100644
--- a/toolkit/components/search/tests/xpcshell/test_notifications.js
+++ b/toolkit/components/search/tests/xpcshell/test_notifications.js
@@ -40,7 +40,8 @@ function search_observer(subject, topic, data) {
       let retrievedEngine = Services.search.getEngineByName("Test search engine");
       do_check_eq(engine, retrievedEngine);
       Services.search.defaultEngine = engine;
-      Services.search.currentEngine = engine;
+      // XXX bug 493051
+      // Services.search.currentEngine = engine;
       do_execute_soon(function () {
         Services.search.removeEngine(engine);
       });
diff --git a/toolkit/components/search/tests/xpcshell/xpcshell.ini b/toolkit/components/search/tests/xpcshell/xpcshell.ini
index 282d2ba9a068..c76336be658b 100644
--- a/toolkit/components/search/tests/xpcshell/xpcshell.ini
+++ b/toolkit/components/search/tests/xpcshell/xpcshell.ini
@@ -19,4 +19,4 @@ skip-if = debug && os == "linux"
 [test_defaultEngine.js]
 [test_prefSync.js]
 [test_notifications.js]
-[test_addEngine_callback.js]
+

From 215edf65906f6a6c10ff290a896883928148098f Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Mon, 17 Jun 2013 22:58:21 +0200
Subject: [PATCH 26/75] Bug 883490: OdinMonkey: FFI call should look to the
 return value for ion errors, r=luke

---
 js/src/ion/AsmJS.cpp                   |  7 ++++++
 js/src/ion/x86/MacroAssembler-x86.h    |  2 +-
 js/src/jit-test/tests/ion/bug883490.js | 32 ++++++++++++++++++++++++++
 3 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/ion/bug883490.js

diff --git a/js/src/ion/AsmJS.cpp b/js/src/ion/AsmJS.cpp
index 6a1a15927fd8..97ad2356585c 100644
--- a/js/src/ion/AsmJS.cpp
+++ b/js/src/ion/AsmJS.cpp
@@ -5830,6 +5830,13 @@ GenerateFFIIonExit(ModuleCompiler &m, const ModuleCompiler::ExitDescriptor &exit
     masm.pop(JSReturnReg_Data);
     masm.pop(JSReturnReg_Type);
 
+#ifdef DEBUG
+    masm.branchTestMagicValue(Assembler::Equal, JSReturnOperand, JS_ION_ERROR, throwLabel);
+    masm.branchTestMagic(Assembler::Equal, JSReturnOperand, &ionFailed);
+#else
+    masm.branchTestMagic(Assembler::Equal, JSReturnOperand, throwLabel);
+#endif
+
     switch (exit.use().which()) {
       case Use::NoCoercion:
         break;
diff --git a/js/src/ion/x86/MacroAssembler-x86.h b/js/src/ion/x86/MacroAssembler-x86.h
index 364e5fb3e5a5..718869cc5611 100644
--- a/js/src/ion/x86/MacroAssembler-x86.h
+++ b/js/src/ion/x86/MacroAssembler-x86.h
@@ -665,7 +665,7 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
             Condition testCond = testMagic(Equal, val);
             j(InvertCondition(testCond), &notmagic);
             // Test magic value
-            branch32(NotEqual, val.payloadReg(), Imm32(static_cast<int32_t>(why)), label);
+            branch32(Equal, val.payloadReg(), Imm32(static_cast<int32_t>(why)), label);
             bind(&notmagic);
         } else {
             Condition testCond = testMagic(NotEqual, val);
diff --git a/js/src/jit-test/tests/ion/bug883490.js b/js/src/jit-test/tests/ion/bug883490.js
new file mode 100644
index 000000000000..f06d8c98724c
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug883490.js
@@ -0,0 +1,32 @@
+function coerceForeign(stdlib, foreign)
+{
+    "use asm";
+
+    var g = foreign.g;
+    var h = foreign.h;
+
+    function f() {
+        +g(0);
+        +g(1);
+        +g(2);
+        +h(2);
+        +h(3);
+    }
+
+    return f;
+}
+function blaat() {
+
+}
+
+var t = coerceForeign(undefined, {
+  g: function(a) {
+    if (a == 2)
+      var blaat = new blaat();
+  },
+  h: function(b) {
+    print(b);
+  }
+})
+
+t();

From abc25d8d70eb56727753c0e00d83935fa566c0a7 Mon Sep 17 00:00:00 2001
From: Nick Alexander <nalexander@mozilla.com>
Date: Mon, 17 Jun 2013 13:57:04 -0700
Subject: [PATCH 27/75] Bug 883921 - Make testFindInPage close PaintedSurface.
 r=gbrown

--HG--
extra : rebase_source : 9531f3c74e01edb1fad635f9ced333362daed527
---
 mobile/android/base/tests/testFindInPage.java.in | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/mobile/android/base/tests/testFindInPage.java.in b/mobile/android/base/tests/testFindInPage.java.in
index 1d17b9cd51ca..26e63a676bad 100644
--- a/mobile/android/base/tests/testFindInPage.java.in
+++ b/mobile/android/base/tests/testFindInPage.java.in
@@ -27,14 +27,22 @@ public class testFindInPage extends PixelTest {
         findText("Robocoop", 3); // This will be close enough to existing text to test that search finds just what it should
         PaintedSurface painted = waitForPaint(paintExpecter);
         paintExpecter.unregisterListener();
-        mAsserter.ispixel(painted.getPixelAt(width,height), 255, 0, 0, "Pixel at " + String.valueOf(width) + "," + String.valueOf(height));
+        try {
+            mAsserter.ispixel(painted.getPixelAt(width,height), 255, 0, 0, "Pixel at " + String.valueOf(width) + "," + String.valueOf(height));
+        } finally {
+            painted.close();
+        }
 
         // Search that finds matches and therefor pans the page
         paintExpecter = mActions.expectPaint();
         findText("Robocop", 3);
         painted = waitForPaint(paintExpecter);
         paintExpecter.unregisterListener();
-        mAsserter.isnotpixel(painted.getPixelAt(width,height), 255, 0, 0, "Pixel at " + String.valueOf(width) + "," + String.valueOf(height));
+        try {
+            mAsserter.isnotpixel(painted.getPixelAt(width,height), 255, 0, 0, "Pixel at " + String.valueOf(width) + "," + String.valueOf(height));
+        } finally {
+            painted.close();
+        }
     }
 
     public void findText(String text, int nrOfMatches){

From bf0cb535365c8ce78eec095e4e27dccaf2f0e193 Mon Sep 17 00:00:00 2001
From: Brad Lassey <blassey@mozilla.com>
Date: Sat, 15 Jun 2013 17:40:27 -0400
Subject: [PATCH 28/75] bug 882196 - Android crash in nsXPCWrappedJS::AddRef,
 remove nsAppShell::CallObservers r=snorp

---
 mobile/android/base/GeckoAppShell.java |  4 ++-
 mobile/android/base/GeckoEvent.java    | 12 +++++++-
 mozglue/android/jni-stubs.inc          | 19 -------------
 widget/android/AndroidJNI.cpp          | 13 ---------
 widget/android/AndroidJavaWrappers.cpp | 23 +++++++++++++++
 widget/android/AndroidJavaWrappers.h   |  6 +++-
 widget/android/nsAppShell.cpp          | 39 ++++----------------------
 7 files changed, 48 insertions(+), 68 deletions(-)

diff --git a/mobile/android/base/GeckoAppShell.java b/mobile/android/base/GeckoAppShell.java
index e3d23e1a33b3..5fdcb9bfb1e1 100644
--- a/mobile/android/base/GeckoAppShell.java
+++ b/mobile/android/base/GeckoAppShell.java
@@ -172,7 +172,9 @@ public class GeckoAppShell
     public static native void setLayerClient(GeckoLayerClient client);
     public static native void onResume();
     public static native void onLowMemory();
-    public static native void callObserver(String observerKey, String topic, String data);
+    public static void callObserver(String observerKey, String topic, String data) {
+        sendEventToGecko(GeckoEvent.createCallObserverEvent(observerKey, topic, data));
+    }
     public static native void removeObserver(String observerKey);
     public static native void onChangeNetworkLinkStatus(String status);
     public static native Message getNextMessageFromQueue(MessageQueue queue);
diff --git a/mobile/android/base/GeckoEvent.java b/mobile/android/base/GeckoEvent.java
index eab01ce840ef..66fc3155f62f 100644
--- a/mobile/android/base/GeckoEvent.java
+++ b/mobile/android/base/GeckoEvent.java
@@ -62,7 +62,8 @@ public class GeckoEvent {
         COMPOSITOR_PAUSE(29),
         COMPOSITOR_RESUME(30),
         NATIVE_GESTURE_EVENT(31),
-        IME_KEY_EVENT(32);
+        IME_KEY_EVENT(32),
+        CALL_OBSERVER(33);
 
         public final int value;
 
@@ -155,6 +156,7 @@ public class GeckoEvent {
     private int mEnd;
     private String mCharacters;
     private String mCharactersExtra;
+    private String mData;
     private int mRangeType;
     private int mRangeStyles;
     private int mRangeLineStyle;
@@ -657,6 +659,14 @@ public class GeckoEvent {
         return event;
     }
 
+    public static GeckoEvent createCallObserverEvent(String observerKey, String topic, String data) {
+        GeckoEvent event = new GeckoEvent(NativeGeckoEvent.CALL_OBSERVER);
+        event.mCharacters = observerKey;
+        event.mCharactersExtra = topic;
+        event.mData = data;
+        return event;
+    }
+
     public void setAckNeeded(boolean ackNeeded) {
         mAckNeeded = ackNeeded;
     }
diff --git a/mozglue/android/jni-stubs.inc b/mozglue/android/jni-stubs.inc
index 2fb938265258..14b7a92791dc 100644
--- a/mozglue/android/jni-stubs.inc
+++ b/mozglue/android/jni-stubs.inc
@@ -77,25 +77,6 @@ Java_org_mozilla_gecko_GeckoAppShell_onLowMemory(JNIEnv * arg0, jclass arg1) {
 
 #ifdef JNI_STUBS
 
-typedef void (*Java_org_mozilla_gecko_GeckoAppShell_callObserver_t)(JNIEnv *, jclass, jstring, jstring, jstring);
-static Java_org_mozilla_gecko_GeckoAppShell_callObserver_t f_Java_org_mozilla_gecko_GeckoAppShell_callObserver;
-extern "C" NS_EXPORT void JNICALL
-Java_org_mozilla_gecko_GeckoAppShell_callObserver(JNIEnv * arg0, jclass arg1, jstring arg2, jstring arg3, jstring arg4) {
-    if (!f_Java_org_mozilla_gecko_GeckoAppShell_callObserver) {
-        arg0->ThrowNew(arg0->FindClass("java/lang/UnsupportedOperationException"),
-                       "JNI Function called before it was loaded");
-        return ;
-    }
-     f_Java_org_mozilla_gecko_GeckoAppShell_callObserver(arg0, arg1, arg2, arg3, arg4);
-}
-#endif
-
-#ifdef JNI_BINDINGS
-  xul_dlsym("Java_org_mozilla_gecko_GeckoAppShell_callObserver", &f_Java_org_mozilla_gecko_GeckoAppShell_callObserver);
-#endif
-
-#ifdef JNI_STUBS
-
 typedef void (*Java_org_mozilla_gecko_GeckoAppShell_removeObserver_t)(JNIEnv *, jclass, jstring);
 static Java_org_mozilla_gecko_GeckoAppShell_removeObserver_t f_Java_org_mozilla_gecko_GeckoAppShell_removeObserver;
 extern "C" NS_EXPORT void JNICALL
diff --git a/widget/android/AndroidJNI.cpp b/widget/android/AndroidJNI.cpp
index 2ff9061db5c8..a0c089ac8161 100644
--- a/widget/android/AndroidJNI.cpp
+++ b/widget/android/AndroidJNI.cpp
@@ -101,19 +101,6 @@ Java_org_mozilla_gecko_GeckoAppShell_onResume(JNIEnv *jenv, jclass jc)
         nsAppShell::gAppShell->OnResume();
 }
 
-NS_EXPORT void JNICALL
-Java_org_mozilla_gecko_GeckoAppShell_callObserver(JNIEnv *jenv, jclass, jstring jObserverKey, jstring jTopic, jstring jData)
-{
-    if (!nsAppShell::gAppShell)
-        return;
-
-    nsJNIString sObserverKey(jObserverKey, jenv);
-    nsJNIString sTopic(jTopic, jenv);
-    nsJNIString sData(jData, jenv);
-
-    nsAppShell::gAppShell->CallObserver(sObserverKey, sTopic, sData);
-}
-
 NS_EXPORT void JNICALL
 Java_org_mozilla_gecko_GeckoAppShell_removeObserver(JNIEnv *jenv, jclass, jstring jObserverKey)
 {
diff --git a/widget/android/AndroidJavaWrappers.cpp b/widget/android/AndroidJavaWrappers.cpp
index e52e3047f147..20b182bef806 100644
--- a/widget/android/AndroidJavaWrappers.cpp
+++ b/widget/android/AndroidJavaWrappers.cpp
@@ -32,6 +32,7 @@ jfieldID AndroidGeckoEvent::jNativeWindowField = 0;
 
 jfieldID AndroidGeckoEvent::jCharactersField = 0;
 jfieldID AndroidGeckoEvent::jCharactersExtraField = 0;
+jfieldID AndroidGeckoEvent::jDataField = 0;
 jfieldID AndroidGeckoEvent::jKeyCodeField = 0;
 jfieldID AndroidGeckoEvent::jMetaStateField = 0;
 jfieldID AndroidGeckoEvent::jDomKeyLocationField = 0;
@@ -235,6 +236,7 @@ AndroidGeckoEvent::InitGeckoEventClass(JNIEnv *jEnv)
 
     jCharactersField = getField("mCharacters", "Ljava/lang/String;");
     jCharactersExtraField = getField("mCharactersExtra", "Ljava/lang/String;");
+    jDataField = getField("mData", "Ljava/lang/String;");
     jKeyCodeField = getField("mKeyCode", "I");
     jMetaStateField = getField("mMetaState", "I");
     jDomKeyLocationField = getField("mDomKeyLocation", "Lorg/mozilla/gecko/GeckoEvent$DomKeyLocation;");
@@ -511,6 +513,20 @@ AndroidGeckoEvent::ReadCharactersExtraField(JNIEnv *jenv)
     jenv->GetStringRegion(s, 0, len, mCharactersExtra.BeginWriting());
 }
 
+void
+AndroidGeckoEvent::ReadDataField(JNIEnv *jenv)
+{
+    jstring s = (jstring) jenv->GetObjectField(wrapped_obj, jDataField);
+    if (!s) {
+        mData.SetIsVoid(true);
+        return;
+    }
+
+    int len = jenv->GetStringLength(s);
+    mData.SetLength(len);
+    jenv->GetStringRegion(s, 0, len, mData.BeginWriting());
+}
+
 void
 AndroidGeckoEvent::UnionRect(nsIntRect const& aRect)
 {
@@ -667,6 +683,13 @@ AndroidGeckoEvent::Init(JNIEnv *jenv, jobject jobj)
             break;
         }
 
+        case CALL_OBSERVER: {
+            ReadCharactersField(jenv);
+            ReadCharactersExtraField(jenv);
+            ReadDataField(jenv);
+            break;
+        }
+
         default:
             break;
     }
diff --git a/widget/android/AndroidJavaWrappers.h b/widget/android/AndroidJavaWrappers.h
index 576192f1bcb5..daee5c53eaad 100644
--- a/widget/android/AndroidJavaWrappers.h
+++ b/widget/android/AndroidJavaWrappers.h
@@ -545,6 +545,7 @@ public:
     const nsIntRect& Rect() { return mRect; }
     nsAString& Characters() { return mCharacters; }
     nsAString& CharactersExtra() { return mCharactersExtra; }
+    nsAString& Data() { return mData; }
     int KeyCode() { return mKeyCode; }
     int MetaState() { return mMetaState; }
     uint32_t DomKeyLocation() { return mDomKeyLocation; }
@@ -600,7 +601,7 @@ protected:
     int mRangeForeColor, mRangeBackColor, mRangeLineColor;
     double mX, mY, mZ;
     int mPointerIndex;
-    nsString mCharacters, mCharactersExtra;
+    nsString mCharacters, mCharactersExtra, mData;
     nsRefPtr<nsGeoPosition> mGeoPosition;
     double mBandwidth;
     bool mCanBeMetered;
@@ -623,6 +624,7 @@ protected:
     void ReadRectField(JNIEnv *jenv);
     void ReadCharactersField(JNIEnv *jenv);
     void ReadCharactersExtraField(JNIEnv *jenv);
+    void ReadDataField(JNIEnv *jenv);
 
     uint32_t ReadDomKeyLocation(JNIEnv* jenv, jobject jGeckoEventObj);
 
@@ -645,6 +647,7 @@ protected:
 
     static jfieldID jCharactersField;
     static jfieldID jCharactersExtraField;
+    static jfieldID jDataField;
     static jfieldID jKeyCodeField;
     static jfieldID jMetaStateField;
     static jfieldID jDomKeyLocationField;
@@ -703,6 +706,7 @@ public:
         COMPOSITOR_RESUME = 30,
         NATIVE_GESTURE_EVENT = 31,
         IME_KEY_EVENT = 32,
+        CALL_OBSERVER = 33,
         dummy_java_enum_list_end
     };
 
diff --git a/widget/android/nsAppShell.cpp b/widget/android/nsAppShell.cpp
index 3c294a78491b..37325235fe3f 100644
--- a/widget/android/nsAppShell.cpp
+++ b/widget/android/nsAppShell.cpp
@@ -518,6 +518,10 @@ nsAppShell::ProcessNextNativeEvent(bool mayWait)
         break;
     }
 
+    case AndroidGeckoEvent::CALL_OBSERVER:
+        CallObserver(curEvent->Characters(), curEvent->CharactersExtra(), curEvent->Data());
+        break;
+
     case AndroidGeckoEvent::NOOP:
         break;
 
@@ -708,29 +712,6 @@ nsAppShell::AddObserver(const nsAString &aObserverKey, nsIObserver *aObserver)
     return NS_OK;
 }
 
-/**
- * The XPCOM event that will call the observer on the main thread.
- */
-class ObserverCaller : public nsRunnable {
-public:
-    ObserverCaller(nsIObserver *aObserver, const char *aTopic, const PRUnichar *aData) :
-        mObserver(aObserver), mTopic(aTopic), mData(aData) {
-        NS_ASSERTION(aObserver != nullptr, "ObserverCaller: aObserver is null!");
-    }
-
-    NS_IMETHOD Run() {
-        ALOG("ObserverCaller::Run: observer = %p, topic = '%s')",
-             (nsIObserver*)mObserver, mTopic.get());
-        mObserver->Observe(nullptr, mTopic.get(), mData.get());
-        return NS_OK;
-    }
-
-private:
-    nsCOMPtr<nsIObserver> mObserver;
-    nsCString mTopic;
-    nsString mData;
-};
-
 void
 nsAppShell::CallObserver(const nsAString &aObserverKey, const nsAString &aTopic, const nsAString &aData)
 {
@@ -745,16 +726,8 @@ nsAppShell::CallObserver(const nsAString &aObserverKey, const nsAString &aTopic,
     const NS_ConvertUTF16toUTF8 sTopic(aTopic);
     const nsPromiseFlatString& sData = PromiseFlatString(aData);
 
-    if (NS_IsMainThread()) {
-        // This branch will unlikely be hit, have it just in case
-        observer->Observe(nullptr, sTopic.get(), sData.get());
-    } else {
-        // Java is not running on main thread, so we have to use NS_DispatchToMainThread
-        nsCOMPtr<nsIRunnable> observerCaller = new ObserverCaller(observer, sTopic.get(), sData.get());
-        nsresult rv = NS_DispatchToMainThread(observerCaller);
-        ALOG("NS_DispatchToMainThread result: %d", rv);
-        unused << rv;
-    }
+    MOZ_ASSERT(NS_IsMainThread());
+    observer->Observe(nullptr, sTopic.get(), sData.get());
 }
 
 void

From c08786522e3fefdae91b6090d4ef132318872d72 Mon Sep 17 00:00:00 2001
From: Brad Lassey <blassey@mozilla.com>
Date: Mon, 17 Jun 2013 17:09:09 -0400
Subject: [PATCH 29/75] bug 882196 - Android crash in nsXPCWrappedJS::AddRef,
 remove nsAppShell::NotifyObservers r=kats

---
 mobile/android/base/GeckoAppShell.java        |  2 -
 .../base/GeckoConnectivityReceiver.java       |  2 +-
 mobile/android/base/GeckoEvent.java           | 16 ++++-
 mobile/android/base/MemoryMonitor.java        |  4 +-
 mozglue/android/jni-stubs.inc                 | 38 ------------
 widget/android/AndroidJNI.cpp                 | 24 --------
 widget/android/AndroidJavaWrappers.cpp        | 10 ++++
 widget/android/AndroidJavaWrappers.h          | 11 ++++
 widget/android/nsAppShell.cpp                 | 58 ++++++++-----------
 widget/android/nsAppShell.h                   |  1 -
 10 files changed, 64 insertions(+), 102 deletions(-)

diff --git a/mobile/android/base/GeckoAppShell.java b/mobile/android/base/GeckoAppShell.java
index 5fdcb9bfb1e1..2a5e2335688b 100644
--- a/mobile/android/base/GeckoAppShell.java
+++ b/mobile/android/base/GeckoAppShell.java
@@ -171,12 +171,10 @@ public class GeckoAppShell
     //    public static native void setSurfaceView(GeckoSurfaceView sv);
     public static native void setLayerClient(GeckoLayerClient client);
     public static native void onResume();
-    public static native void onLowMemory();
     public static void callObserver(String observerKey, String topic, String data) {
         sendEventToGecko(GeckoEvent.createCallObserverEvent(observerKey, topic, data));
     }
     public static native void removeObserver(String observerKey);
-    public static native void onChangeNetworkLinkStatus(String status);
     public static native Message getNextMessageFromQueue(MessageQueue queue);
     public static native void onSurfaceTextureFrameAvailable(Object surfaceTexture, int id);
 
diff --git a/mobile/android/base/GeckoConnectivityReceiver.java b/mobile/android/base/GeckoConnectivityReceiver.java
index 24f37c7a57c9..8c9d1b19ca1a 100644
--- a/mobile/android/base/GeckoConnectivityReceiver.java
+++ b/mobile/android/base/GeckoConnectivityReceiver.java
@@ -76,7 +76,7 @@ public class GeckoConnectivityReceiver extends BroadcastReceiver {
         }
 
         if (GeckoThread.checkLaunchState(GeckoThread.LaunchState.GeckoRunning)) {
-            GeckoAppShell.onChangeNetworkLinkStatus(status);
+            GeckoAppShell.sendEventToGecko(GeckoEvent.createNetworkLinkChangeEvent(status));
         }
     }
 }
diff --git a/mobile/android/base/GeckoEvent.java b/mobile/android/base/GeckoEvent.java
index 66fc3155f62f..710a6e9ce051 100644
--- a/mobile/android/base/GeckoEvent.java
+++ b/mobile/android/base/GeckoEvent.java
@@ -63,7 +63,9 @@ public class GeckoEvent {
         COMPOSITOR_RESUME(30),
         NATIVE_GESTURE_EVENT(31),
         IME_KEY_EVENT(32),
-        CALL_OBSERVER(33);
+        CALL_OBSERVER(33),
+        LOW_MEMORY(34),
+        NETWORK_LINK_CHANGE(35);
 
         public final int value;
 
@@ -667,6 +669,18 @@ public class GeckoEvent {
         return event;
     }
 
+    public static GeckoEvent createLowMemoryEvent(int level) {
+        GeckoEvent event = new GeckoEvent(NativeGeckoEvent.LOW_MEMORY);
+        event.mMetaState = level;
+        return event;
+    }
+
+    public static GeckoEvent createNetworkLinkChangeEvent(String status) {
+        GeckoEvent event = new GeckoEvent(NativeGeckoEvent.NETWORK_LINK_CHANGE);
+        event.mCharacters = status;
+        return event;
+    }
+
     public void setAckNeeded(boolean ackNeeded) {
         mAckNeeded = ackNeeded;
     }
diff --git a/mobile/android/base/MemoryMonitor.java b/mobile/android/base/MemoryMonitor.java
index 313832c915ce..e728ac716261 100644
--- a/mobile/android/base/MemoryMonitor.java
+++ b/mobile/android/base/MemoryMonitor.java
@@ -39,6 +39,7 @@ class MemoryMonitor extends BroadcastReceiver {
     private static final String ACTION_MEMORY_DUMP = "org.mozilla.gecko.MEMORY_DUMP";
     private static final String ACTION_FORCE_PRESSURE = "org.mozilla.gecko.FORCE_MEMORY_PRESSURE";
 
+    // Memory pressue levels, keep in sync with those in AndroidJavaWrappers.h
     private static final int MEMORY_PRESSURE_NONE = 0;
     private static final int MEMORY_PRESSURE_CLEANUP = 1;
     private static final int MEMORY_PRESSURE_LOW = 2;
@@ -148,8 +149,9 @@ class MemoryMonitor extends BroadcastReceiver {
 
         // TODO hook in memory-reduction stuff for different levels here
         if (level >= MEMORY_PRESSURE_MEDIUM) {
+            //Only send medium or higher events because that's all that is used right now
             if (GeckoThread.checkLaunchState(GeckoThread.LaunchState.GeckoRunning)) {
-                GeckoAppShell.onLowMemory();
+                GeckoAppShell.sendEventToGecko(GeckoEvent.createLowMemoryEvent(level));
             }
 
             Favicons.getInstance().clearMemCache();
diff --git a/mozglue/android/jni-stubs.inc b/mozglue/android/jni-stubs.inc
index 14b7a92791dc..b425e6dfd5e2 100644
--- a/mozglue/android/jni-stubs.inc
+++ b/mozglue/android/jni-stubs.inc
@@ -58,25 +58,6 @@ Java_org_mozilla_gecko_GeckoAppShell_onResume(JNIEnv * arg0, jclass arg1) {
 
 #ifdef JNI_STUBS
 
-typedef void (*Java_org_mozilla_gecko_GeckoAppShell_onLowMemory_t)(JNIEnv *, jclass);
-static Java_org_mozilla_gecko_GeckoAppShell_onLowMemory_t f_Java_org_mozilla_gecko_GeckoAppShell_onLowMemory;
-extern "C" NS_EXPORT void JNICALL
-Java_org_mozilla_gecko_GeckoAppShell_onLowMemory(JNIEnv * arg0, jclass arg1) {
-    if (!f_Java_org_mozilla_gecko_GeckoAppShell_onLowMemory) {
-        arg0->ThrowNew(arg0->FindClass("java/lang/UnsupportedOperationException"),
-                       "JNI Function called before it was loaded");
-        return ;
-    }
-     f_Java_org_mozilla_gecko_GeckoAppShell_onLowMemory(arg0, arg1);
-}
-#endif
-
-#ifdef JNI_BINDINGS
-  xul_dlsym("Java_org_mozilla_gecko_GeckoAppShell_onLowMemory", &f_Java_org_mozilla_gecko_GeckoAppShell_onLowMemory);
-#endif
-
-#ifdef JNI_STUBS
-
 typedef void (*Java_org_mozilla_gecko_GeckoAppShell_removeObserver_t)(JNIEnv *, jclass, jstring);
 static Java_org_mozilla_gecko_GeckoAppShell_removeObserver_t f_Java_org_mozilla_gecko_GeckoAppShell_removeObserver;
 extern "C" NS_EXPORT void JNICALL
@@ -96,25 +77,6 @@ Java_org_mozilla_gecko_GeckoAppShell_removeObserver(JNIEnv * arg0, jclass arg1,
 
 #ifdef JNI_STUBS
 
-typedef void (*Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus_t)(JNIEnv *, jclass, jstring);
-static Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus_t f_Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus;
-extern "C" NS_EXPORT void JNICALL
-Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv * arg0, jclass arg1, jstring arg2) {
-    if (!f_Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus) {
-        arg0->ThrowNew(arg0->FindClass("java/lang/UnsupportedOperationException"),
-                       "JNI Function called before it was loaded");
-        return ;
-    }
-     f_Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(arg0, arg1, arg2);
-}
-#endif
-
-#ifdef JNI_BINDINGS
-  xul_dlsym("Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus", &f_Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus);
-#endif
-
-#ifdef JNI_STUBS
-
 typedef jobject (*Java_org_mozilla_gecko_GeckoAppShell_getNextMessageFromQueue_t)(JNIEnv *, jclass, jobject);
 static Java_org_mozilla_gecko_GeckoAppShell_getNextMessageFromQueue_t f_Java_org_mozilla_gecko_GeckoAppShell_getNextMessageFromQueue;
 extern "C" NS_EXPORT jobject JNICALL
diff --git a/widget/android/AndroidJNI.cpp b/widget/android/AndroidJNI.cpp
index a0c089ac8161..ccf3c26895fc 100644
--- a/widget/android/AndroidJNI.cpp
+++ b/widget/android/AndroidJNI.cpp
@@ -22,7 +22,6 @@
 #include <android/log.h>
 #include "nsIObserverService.h"
 #include "mozilla/Services.h"
-#include "nsINetworkLinkService.h"
 
 #ifdef MOZ_CRASHREPORTER
 #include "nsICrashReporter.h"
@@ -84,16 +83,6 @@ Java_org_mozilla_gecko_GeckoAppShell_setLayerClient(JNIEnv *jenv, jclass, jobjec
     AndroidBridge::Bridge()->SetLayerClient(jenv, obj);
 }
 
-NS_EXPORT void JNICALL
-Java_org_mozilla_gecko_GeckoAppShell_onLowMemory(JNIEnv *jenv, jclass jc)
-{
-    if (nsAppShell::gAppShell) {
-        nsAppShell::gAppShell->NotifyObservers(nullptr,
-                                               "memory-pressure",
-                                               NS_LITERAL_STRING("low-memory").get());
-    }
-}
-
 NS_EXPORT void JNICALL
 Java_org_mozilla_gecko_GeckoAppShell_onResume(JNIEnv *jenv, jclass jc)
 {
@@ -115,19 +104,6 @@ Java_org_mozilla_gecko_GeckoAppShell_removeObserver(JNIEnv *jenv, jclass, jstrin
     nsAppShell::gAppShell->RemoveObserver(sObserverKey);
 }
 
-NS_EXPORT void JNICALL
-Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv *jenv, jclass, jstring jStatus)
-{
-    if (!nsAppShell::gAppShell)
-        return;
-
-    nsJNIString sStatus(jStatus, jenv);
-
-    nsAppShell::gAppShell->NotifyObservers(nullptr,
-                                           NS_NETWORK_LINK_TOPIC,
-                                           sStatus.get());
-}
-
 NS_EXPORT void JNICALL
 Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash(JNIEnv *jenv, jclass, jstring jStackTrace)
 {
diff --git a/widget/android/AndroidJavaWrappers.cpp b/widget/android/AndroidJavaWrappers.cpp
index 20b182bef806..40276ced372c 100644
--- a/widget/android/AndroidJavaWrappers.cpp
+++ b/widget/android/AndroidJavaWrappers.cpp
@@ -690,6 +690,16 @@ AndroidGeckoEvent::Init(JNIEnv *jenv, jobject jobj)
             break;
         }
 
+        case LOW_MEMORY: {
+            mMetaState = jenv->GetIntField(jobj, jMetaStateField);
+            break;
+        }
+
+        case NETWORK_LINK_CHANGE: {
+            ReadCharactersField(jenv);
+            break;
+        }
+
         default:
             break;
     }
diff --git a/widget/android/AndroidJavaWrappers.h b/widget/android/AndroidJavaWrappers.h
index daee5c53eaad..751182f44dd6 100644
--- a/widget/android/AndroidJavaWrappers.h
+++ b/widget/android/AndroidJavaWrappers.h
@@ -707,9 +707,20 @@ public:
         NATIVE_GESTURE_EVENT = 31,
         IME_KEY_EVENT = 32,
         CALL_OBSERVER = 33,
+        LOW_MEMORY = 34,
+        NETWORK_LINK_CHANGE = 35,
         dummy_java_enum_list_end
     };
 
+    enum {
+        // Memory pressue levels, keep in sync with those in MemoryMonitor.java
+        MEMORY_PRESSURE_NONE = 0,
+        MEMORY_PRESSURE_CLEANUP = 1,
+        MEMORY_PRESSURE_LOW = 2,
+        MEMORY_PRESSURE_MEDIUM = 3,
+        MEMORY_PRESSURE_HIGH = 4
+    };
+
     enum {
         // Internal Gecko events
         IME_FLUSH_CHANGES = -2,
diff --git a/widget/android/nsAppShell.cpp b/widget/android/nsAppShell.cpp
index 37325235fe3f..6e088feee411 100644
--- a/widget/android/nsAppShell.cpp
+++ b/widget/android/nsAppShell.cpp
@@ -25,6 +25,7 @@
 #include "nsIDOMWakeLockListener.h"
 #include "nsIPowerManagerService.h"
 #include "nsFrameManager.h"
+#include "nsINetworkLinkService.h"
 
 #include "mozilla/Services.h"
 #include "mozilla/unused.h"
@@ -522,6 +523,29 @@ nsAppShell::ProcessNextNativeEvent(bool mayWait)
         CallObserver(curEvent->Characters(), curEvent->CharactersExtra(), curEvent->Data());
         break;
 
+    case AndroidGeckoEvent::LOW_MEMORY:
+        // TODO hook in memory-reduction stuff for different levels here
+        if (curEvent->MetaState() >= AndroidGeckoEvent::MEMORY_PRESSURE_MEDIUM) {
+            nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
+            if (os) {
+                os->NotifyObservers(nullptr,
+                                    "memory-pressure",
+                                    NS_LITERAL_STRING("low-memory").get());
+            }
+        }
+        break;
+
+    case AndroidGeckoEvent::NETWORK_LINK_CHANGE:
+    {
+        nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
+        if (os) {
+            os->NotifyObservers(nullptr,
+                                NS_NETWORK_LINK_TOPIC,
+                                nsString(curEvent->Characters()).get());
+        }
+        break;
+    }
+
     case AndroidGeckoEvent::NOOP:
         break;
 
@@ -736,40 +760,6 @@ nsAppShell::RemoveObserver(const nsAString &aObserverKey)
     mObserversHash.Remove(aObserverKey);
 }
 
-// NotifyObservers support.  NotifyObservers only works on main thread.
-
-class NotifyObserversCaller : public nsRunnable {
-public:
-    NotifyObserversCaller(nsISupports *aSupports,
-                          const char *aTopic, const PRUnichar *aData) :
-        mSupports(aSupports), mTopic(aTopic), mData(aData) {
-    }
-
-    NS_IMETHOD Run() {
-        nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
-        if (os)
-            os->NotifyObservers(mSupports, mTopic.get(), mData.get());
-
-        return NS_OK;
-    }
-
-private:
-    nsCOMPtr<nsISupports> mSupports;
-    nsCString mTopic;
-    nsString mData;
-};
-
-void
-nsAppShell::NotifyObservers(nsISupports *aSupports,
-                            const char *aTopic,
-                            const PRUnichar *aData)
-{
-    // This isn't main thread, so post this to main thread
-    nsCOMPtr<nsIRunnable> caller =
-        new NotifyObserversCaller(aSupports, aTopic, aData);
-    NS_DispatchToMainThread(caller);
-}
-
 // Used by IPC code
 namespace mozilla {
 
diff --git a/widget/android/nsAppShell.h b/widget/android/nsAppShell.h
index d944e605f3cd..11451c690ab3 100644
--- a/widget/android/nsAppShell.h
+++ b/widget/android/nsAppShell.h
@@ -49,7 +49,6 @@ public:
     nsresult AddObserver(const nsAString &aObserverKey, nsIObserver *aObserver);
     void CallObserver(const nsAString &aObserverKey, const nsAString &aTopic, const nsAString &aData);
     void RemoveObserver(const nsAString &aObserverKey);
-    void NotifyObservers(nsISupports *aSupports, const char *aTopic, const PRUnichar *aData);
     void ResendLastResizeEvent(nsWindow* aDest);
 
     void SetBrowserApp(nsIAndroidBrowserApp* aBrowserApp) {

From 710edc3621fc11247ca3c01e731892f903453edd Mon Sep 17 00:00:00 2001
From: Bob Owen <bobowencode@gmail.com>
Date: Wed, 24 Apr 2013 18:13:25 +0100
Subject: [PATCH 30/75] Fix for bug 838692 - Navigating named targets from
 sandboxed iframes (r=smaug)

---
 docshell/base/nsDocShell.cpp | 41 ++++++++++++++++++++++--------------
 docshell/base/nsDocShell.h   |  7 ++++++
 2 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index ce2b95452b20..5df9a12d5620 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -3087,14 +3087,18 @@ nsDocShell::FindItemWithName(const PRUnichar * aName,
     if (!*aName)
         return NS_OK;
 
-    if (!aRequestor)
-    {
-        nsCOMPtr<nsIDocShellTreeItem> foundItem;
+    if (aRequestor) {
+        // If aRequestor is not null we don't need to check special names, so
+        // just hand straight off to the search by actual name function.
+        return DoFindItemWithName(aName, aRequestor, aOriginalRequestor,
+                                  _retval);
+    } else {
 
         // This is the entry point into the target-finding algorithm.  Check
         // for special names.  This should only be done once, hence the check
         // for a null aRequestor.
 
+        nsCOMPtr<nsIDocShellTreeItem> foundItem;
         nsDependentString name(aName);
         if (name.LowerCaseEqualsLiteral("_self")) {
             foundItem = this;
@@ -3143,16 +3147,19 @@ nsDocShell::FindItemWithName(const PRUnichar * aName,
                 // a new window?
             }
 #endif
+        } else {
+            // Do the search for item by an actual name.
+            DoFindItemWithName(aName, aRequestor, aOriginalRequestor,
+                               getter_AddRefs(foundItem));
         }
 
         if (foundItem && !CanAccessItem(foundItem, aOriginalRequestor)) {
             foundItem = nullptr;
         }
 
+        // DoFindItemWithName only returns active items and we don't check if
+        // the item is active for the special cases.
         if (foundItem) {
-            // We return foundItem here even if it's not an active
-            // item since all the names we've dealt with so far are
-            // special cases that we won't bother looking for further.
 
             // If our document is sandboxed, we need to do some extra checks.
             uint32_t sandboxFlags = 0;
@@ -3174,17 +3181,14 @@ nsDocShell::FindItemWithName(const PRUnichar * aName,
                     bool isAncestor = false;
 
                     nsCOMPtr<nsIDocShellTreeItem> parentAsItem;
-                    GetSameTypeParent(getter_AddRefs(parentAsItem));
-
+                    foundItem->GetSameTypeParent(getter_AddRefs(parentAsItem));
                     while (parentAsItem) {
-                        nsCOMPtr<nsIDocShellTreeItem> tmp;
-                        parentAsItem->GetParent(getter_AddRefs(tmp));
-
-                        if (tmp && tmp == selfAsItem) {
+                        if (parentAsItem == selfAsItem) {
                             isAncestor = true;
                             break;
                         }
-                        parentAsItem = tmp;
+                        nsCOMPtr<nsIDocShellTreeItem> tmp = parentAsItem;
+                        tmp->GetSameTypeParent(getter_AddRefs(parentAsItem));
                     }
 
                     if (!isAncestor) {
@@ -3212,12 +3216,17 @@ nsDocShell::FindItemWithName(const PRUnichar * aName,
             }
 
             foundItem.swap(*_retval);
-            return NS_OK;
         }
+        return NS_OK;
     }
+}
 
-    // Keep looking
-        
+nsresult
+nsDocShell::DoFindItemWithName(const PRUnichar* aName,
+                               nsISupports* aRequestor,
+                               nsIDocShellTreeItem* aOriginalRequestor,
+                               nsIDocShellTreeItem** _retval)
+{
     // First we check our name.
     if (mName.Equals(aName) && ItemIsActive(this) &&
         CanAccessItem(this, aOriginalRequestor)) {
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index 4a85e32e5d9a..a0df92252f31 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -874,6 +874,13 @@ private:
     int32_t           mParentCharsetSource;
     nsCString         mOriginalUriString;
 
+    // Separate function to do the actual name (i.e. not _top, _self etc.)
+    // searching for FindItemWithName.
+    nsresult DoFindItemWithName(const PRUnichar* aName,
+                                nsISupports* aRequestor,
+                                nsIDocShellTreeItem* aOriginalRequestor,
+                                nsIDocShellTreeItem** _retval);
+
 #ifdef DEBUG
     // We're counting the number of |nsDocShells| to help find leaks
     static unsigned long gNumberOfDocShells;

From 5060bed3d9fb44e9649ce269cc2283d5395e3fe1 Mon Sep 17 00:00:00 2001
From: Bob Owen <bobowencode@gmail.com>
Date: Mon, 29 Apr 2013 19:26:43 +0100
Subject: [PATCH 31/75] Tests for bug 838692 - Navigating named targets from
 sandboxed iframes. (r=imelven)

---
 content/html/content/test/Makefile.in         |  21 +
 .../test/file_iframe_sandbox_d_if1.html       |   2 +-
 .../test/file_iframe_sandbox_d_if14.html      |  35 ++
 .../test/file_iframe_sandbox_d_if15.html      |  14 +
 .../test/file_iframe_sandbox_d_if16.html      |  22 +
 .../test/file_iframe_sandbox_d_if17.html      |  24 +
 .../test/file_iframe_sandbox_d_if18.html      |  33 ++
 .../test/file_iframe_sandbox_d_if19.html      |  13 +
 .../test/file_iframe_sandbox_d_if2.html       |   6 +-
 .../test/file_iframe_sandbox_d_if20.html      |  25 +
 .../test/file_iframe_sandbox_d_if21.html      |  14 +
 .../test/file_iframe_sandbox_d_if22.html      |  25 +
 .../test/file_iframe_sandbox_d_if4.html       |   1 +
 .../test/file_iframe_sandbox_d_if5.html       |   3 +-
 .../test/file_iframe_sandbox_d_if7.html       |  36 +-
 .../test/file_iframe_sandbox_d_if8.html       |  40 +-
 .../test/file_iframe_sandbox_e_if1.html       |  44 +-
 .../test/file_iframe_sandbox_e_if10.html      |  19 +
 .../test/file_iframe_sandbox_e_if11.html      |  24 +
 .../test/file_iframe_sandbox_e_if12.html      |  19 +
 .../test/file_iframe_sandbox_e_if13.html      |  19 +
 .../test/file_iframe_sandbox_e_if14.html      |  24 +
 .../test/file_iframe_sandbox_e_if15.html      |  17 +
 .../test/file_iframe_sandbox_e_if16.html      |  27 +
 .../test/file_iframe_sandbox_e_if2.html       |  34 +-
 .../test/file_iframe_sandbox_e_if6.html       |  46 +-
 .../test/file_iframe_sandbox_e_if7.html       |  17 +
 .../test/file_iframe_sandbox_e_if8.html       |  23 +
 .../test/file_iframe_sandbox_e_if9.html       |  19 +
 .../file_iframe_sandbox_navigation_fail.html  |  33 +-
 .../file_iframe_sandbox_navigation_pass.html  |  33 +-
 ...le_iframe_sandbox_top_navigation_fail.html |  35 +-
 ...le_iframe_sandbox_top_navigation_pass.html |  35 +-
 ...iframe_sandbox_window_navigation_fail.html |  20 +
 .../test/test_iframe_sandbox_navigation.html  | 505 ++++++++++--------
 .../test/test_iframe_sandbox_navigation2.html | 187 +++++++
 testing/mochitest/b2g.json                    |   1 +
 37 files changed, 1088 insertions(+), 407 deletions(-)
 create mode 100644 content/html/content/test/file_iframe_sandbox_d_if14.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_d_if15.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_d_if16.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_d_if17.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_d_if18.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_d_if19.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_d_if20.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_d_if21.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_d_if22.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_e_if10.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_e_if11.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_e_if12.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_e_if13.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_e_if14.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_e_if15.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_e_if16.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_e_if7.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_e_if8.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_e_if9.html
 create mode 100644 content/html/content/test/file_iframe_sandbox_window_navigation_fail.html
 create mode 100644 content/html/content/test/test_iframe_sandbox_navigation2.html

diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index 8e777f7f7b4d..3b9e2b6a9349 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -307,6 +307,7 @@ MOCHITEST_FILES = \
 		file_iframe_sandbox_pass.js \
 		file_iframe_sandbox_fail.js \
 		test_iframe_sandbox_navigation.html \
+		test_iframe_sandbox_navigation2.html \
 		file_iframe_sandbox_d_if1.html \
 		file_iframe_sandbox_d_if2.html \
 		file_iframe_sandbox_d_if3.html \
@@ -320,6 +321,15 @@ MOCHITEST_FILES = \
 		file_iframe_sandbox_d_if11.html \
 		file_iframe_sandbox_d_if12.html \
 		file_iframe_sandbox_d_if13.html \
+		file_iframe_sandbox_d_if14.html \
+		file_iframe_sandbox_d_if15.html \
+		file_iframe_sandbox_d_if16.html \
+		file_iframe_sandbox_d_if17.html \
+		file_iframe_sandbox_d_if18.html \
+		file_iframe_sandbox_d_if19.html \
+		file_iframe_sandbox_d_if20.html \
+		file_iframe_sandbox_d_if21.html \
+		file_iframe_sandbox_d_if22.html \
 		file_iframe_sandbox_navigation_start.html \
 		file_iframe_sandbox_navigation_pass.html \
 		file_iframe_sandbox_navigation_fail.html \
@@ -329,8 +339,19 @@ MOCHITEST_FILES = \
 		file_iframe_sandbox_e_if4.html \
 		file_iframe_sandbox_e_if5.html \
 		file_iframe_sandbox_e_if6.html \
+		file_iframe_sandbox_e_if7.html \
+		file_iframe_sandbox_e_if8.html \
+		file_iframe_sandbox_e_if9.html \
+		file_iframe_sandbox_e_if10.html \
+		file_iframe_sandbox_e_if11.html \
+		file_iframe_sandbox_e_if12.html \
+		file_iframe_sandbox_e_if13.html \
+		file_iframe_sandbox_e_if14.html \
+		file_iframe_sandbox_e_if15.html \
+		file_iframe_sandbox_e_if16.html \
 		file_iframe_sandbox_top_navigation_pass.html \
 		file_iframe_sandbox_top_navigation_fail.html \
+		file_iframe_sandbox_window_navigation_fail.html \
 		test_iframe_sandbox_plugins.html \
 		file_iframe_sandbox_f_if1.html \
 		file_iframe_sandbox_f_if2.html \
diff --git a/content/html/content/test/file_iframe_sandbox_d_if1.html b/content/html/content/test/file_iframe_sandbox_d_if1.html
index 8af6c6b11244..054edbfe148e 100644
--- a/content/html/content/test/file_iframe_sandbox_d_if1.html
+++ b/content/html/content/test/file_iframe_sandbox_d_if1.html
@@ -14,6 +14,6 @@ function doTest() {
 <body onload="doTest()">
   I am sandboxed with 'allow-scripts'
 
-  <a href="file_iframe_sandbox_navigation_pass.html?if_1" target="_self" id='anchor'>
+  <a href="file_iframe_sandbox_navigation_pass.html?Test 1:%20" target="_self" id='anchor'>
 </body>
 </html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if14.html b/content/html/content/test/file_iframe_sandbox_d_if14.html
new file mode 100644
index 000000000000..3041fc448cf4
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_d_if14.html
@@ -0,0 +1,35 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Tests for Bug 838692</title>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script type="text/javascript">
+  var test20Context = "Test 20: Navigate another window (not opened by us): ";
+
+  function doTest() {
+    // Try to navigate auxiliary browsing context (window) not opened by us.
+    // We should not be able to do this as we are sandboxed.
+    sendMouseEvent({type:'click'}, 'navigate_window');
+    window.parent.postMessage("test attempted", "*");
+
+    // Try to navigate auxiliary browsing context (window) not opened by us, using window.open().
+    // We should not be able to do this as we are sandboxed.
+    try {
+      window.open("file_iframe_sandbox_window_navigation_fail.html?" + escape(test20Context), "window_to_navigate2");
+      window.parent.postMessage("test attempted", "*");
+    } catch(error) {
+      window.parent.postMessage({ok: true, desc: test20Context + "as expected, error thrown during window.open(..., \"window_to_navigate2\")"}, "*");
+    }
+  }
+</script>
+
+<body onload="doTest()">
+  I am sandboxed but with "allow-scripts allow-same-origin allow-top-navigation".
+
+  <a href="file_iframe_sandbox_window_navigation_fail.html?Test 14: Navigate another window (not opened by us):%20" target="window_to_navigate" id="navigate_window">navigate window</a>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if15.html b/content/html/content/test/file_iframe_sandbox_d_if15.html
new file mode 100644
index 000000000000..6c969c8fe1de
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_d_if15.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<body>
+  I am an unsandboxed iframe.
+
+  <iframe sandbox="allow-same-origin allow-scripts" id="if_16" src="file_iframe_sandbox_d_if16.html" height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if16.html b/content/html/content/test/file_iframe_sandbox_d_if16.html
new file mode 100644
index 000000000000..a27e098801b8
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_d_if16.html
@@ -0,0 +1,22 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+</head>
+
+<script type="application/javascript">
+function doTest() {
+  window.parent.parent.postMessage("test attempted", "*");
+  sendMouseEvent({type:'click'}, 'anchor');
+}
+</script>
+
+<body onload="doTest()">
+  I am sandboxed with 'allow-same-origin allow-scripts'
+
+  <a href="file_iframe_sandbox_navigation_fail.html?Test 16: Navigate parent/ancestor by name:%20" target='if_parent' id='anchor'>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if17.html b/content/html/content/test/file_iframe_sandbox_d_if17.html
new file mode 100644
index 000000000000..047a08137d96
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_d_if17.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script type="application/javascript">
+  var testContext = "Test 17: navigate _self with window.open(): ";
+
+  function doTest() {
+    try {
+      window.open("file_iframe_sandbox_navigation_pass.html?" + escape(testContext), "_self");
+    } catch(error) {
+      window.parent.postMessage({ok: false, desc: testContext + "error thrown during window.open(..., \"_self\")"}, "*");
+    }
+  }
+</script>
+
+<body onload="doTest()">
+  I am sandboxed with 'allow-scripts'
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if18.html b/content/html/content/test/file_iframe_sandbox_d_if18.html
new file mode 100644
index 000000000000..03aa0aa9bd86
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_d_if18.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+</head>
+
+<script type="application/javascript">
+  window.addEventListener("message", receiveMessage, false);
+
+  function receiveMessage(event) {
+    window.parent.postMessage(event.data, "*");
+  }
+
+  var testContext = "Test 18: navigate child with window.open(): ";
+
+  function doTest() {
+    try {
+      window.open("file_iframe_sandbox_navigation_pass.html?" + escape(testContext), "foo");
+    } catch(error) {
+      window.parent.postMessage({ok: false, desc: testContext + " error thrown during window.open(..., \"foo\")"}, "*");
+    }
+  }
+</script>
+
+<body onload="doTest()">
+  I am sandboxed with 'allow-scripts'
+
+  <iframe name="foo" height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if19.html b/content/html/content/test/file_iframe_sandbox_d_if19.html
new file mode 100644
index 000000000000..d766d2649200
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_d_if19.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+  I am sandboxed with 'allow-scripts'
+
+  <iframe sandbox="allow-scripts" id="if_20" src="file_iframe_sandbox_d_if20.html" height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if2.html b/content/html/content/test/file_iframe_sandbox_d_if2.html
index 5e51075a073f..763585c62220 100644
--- a/content/html/content/test/file_iframe_sandbox_d_if2.html
+++ b/content/html/content/test/file_iframe_sandbox_d_if2.html
@@ -10,8 +10,8 @@
 // needed to forward the message to the main test page
 window.addEventListener("message", receiveMessage, false);
 
-function receiveMessage(event) { 
-  window.parent.postMessage({ok: event.data.ok, desc: event.data.desc}, "*");
+function receiveMessage(event) {
+  window.parent.postMessage(event.data, "*");
 }
 
 function doTest() {
@@ -23,6 +23,6 @@ function doTest() {
 
   <iframe name="foo" src="file_iframe_sandbox_navigation_start.html" height="10" width="10"></iframe>
 
-  <a href="file_iframe_sandbox_navigation_pass.html?if2" target='foo' id='anchor'>
+  <a href="file_iframe_sandbox_navigation_pass.html?Test 2:%20" target='foo' id='anchor'>
 </body>
 </html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if20.html b/content/html/content/test/file_iframe_sandbox_d_if20.html
new file mode 100644
index 000000000000..49d6d6a44c4f
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_d_if20.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script type="application/javascript">
+  var testContext = "Test 19: navigate _parent with window.open(): ";
+
+  function doTest() {
+    try {
+      window.open("file_iframe_sandbox_navigation_fail.html?" + escape(testContext), "_parent");
+      window.parent.parent.postMessage("test attempted", "*");
+    } catch(error) {
+      window.parent.parent.postMessage({ok: true, desc: testContext + "as expected, error thrown during window.open(..., \"_parent\")"}, "*");
+    }
+  }
+</script>
+
+<body onload="doTest()">
+  I am sandboxed with 'allow-scripts'
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if21.html b/content/html/content/test/file_iframe_sandbox_d_if21.html
new file mode 100644
index 000000000000..6d0ab232e0e7
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_d_if21.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<body>
+  I am an unsandboxed iframe.
+
+  <iframe sandbox="allow-same-origin allow-scripts" id="if_22" src="file_iframe_sandbox_d_if22.html" height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if22.html b/content/html/content/test/file_iframe_sandbox_d_if22.html
new file mode 100644
index 000000000000..4edb24d1443c
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_d_if22.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script type="application/javascript">
+  var testContext = "Test 21: navigate parent by name with window.open(): ";
+
+  function doTest() {
+    try {
+      window.open("file_iframe_sandbox_navigation_fail.html?" + escape(testContext), "if_parent2");
+      window.parent.parent.postMessage("test attempted", "*");
+    } catch(error) {
+      window.parent.parent.postMessage({ok: true, desc: testContext + "as expected, error thrown during window.open(..., \"if_parent2\")"}, "*");
+    }
+  }
+</script>
+
+<body onload="doTest()">
+  I am sandboxed with 'allow-same-origin allow-scripts'
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if4.html b/content/html/content/test/file_iframe_sandbox_d_if4.html
index 8138d14f00d7..692391b17c7b 100644
--- a/content/html/content/test/file_iframe_sandbox_d_if4.html
+++ b/content/html/content/test/file_iframe_sandbox_d_if4.html
@@ -8,6 +8,7 @@
 </head>
 <script type="application/javascript">
 function doTest() {
+  window.parent.parent.postMessage("test attempted", "*");
   sendMouseEvent({type:'click'}, 'anchor');
 }
 </script>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if5.html b/content/html/content/test/file_iframe_sandbox_d_if5.html
index 5191bd46fb85..f4845e21f8e6 100644
--- a/content/html/content/test/file_iframe_sandbox_d_if5.html
+++ b/content/html/content/test/file_iframe_sandbox_d_if5.html
@@ -9,11 +9,12 @@
 <script type="application/javascript">
 function doTest() {
   sendMouseEvent({type:'click'}, 'anchor');
+  window.parent.postMessage("test attempted", "*");
 }
 </script>
 <body onload="doTest()">
   I am sandboxed with 'allow-scripts allow-same-origin'
 
-  <a href="file_iframe_sandbox_navigation_fail.html" target='sibling' id='anchor'>
+  <a href="file_iframe_sandbox_navigation_fail.html?Test 4: Navigate sibling iframe by name:%20" target='if_sibling' id='anchor'>
 </body>
 </html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if7.html b/content/html/content/test/file_iframe_sandbox_d_if7.html
index 4b8062eb7152..5023ee02946e 100644
--- a/content/html/content/test/file_iframe_sandbox_d_if7.html
+++ b/content/html/content/test/file_iframe_sandbox_d_if7.html
@@ -1,16 +1,20 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 341604</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<script type="application/javascript">
-function doTest() {
-  window.parent.ok_wrapper(false, "a sandboxed document when navigated should still NOT be same-origin with its parent");
-}
-</script>
-<body onload="doTest()">
-  I am sandboxed with 'allow-scripts'
-</body>
-</html>
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<script type="application/javascript">
+function doTest() {
+  try {
+    window.parent.ok_wrapper(false, "a sandboxed document when navigated should still NOT be same-origin with its parent");
+  } catch(error) {
+    window.parent.postMessage({ok: true, desc: "sandboxed document's attempt to access parent after navigation blocked, as not same-origin."}, "*");
+  }
+}
+</script>
+<body onload="doTest()">
+  I am sandboxed with 'allow-scripts'
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_d_if8.html b/content/html/content/test/file_iframe_sandbox_d_if8.html
index ded19cff55b3..2f8618329ac0 100644
--- a/content/html/content/test/file_iframe_sandbox_d_if8.html
+++ b/content/html/content/test/file_iframe_sandbox_d_if8.html
@@ -1,16 +1,24 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 341604</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<script type="application/javascript">
-function doTest() {
-  window.parent.modify_if_8();
-}
-</script>
-<body onload="doTest()">
-  I am sandboxed with 'allow-scripts' and 'allow-same-origin' the first time I am loaded, and with 'allow-scripts' the second time
-</body>
-</html>
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<script type="application/javascript">
+function doTest() {
+  if (location.search == "?onreload") {
+    try {
+      window.parent.modify_if_8();
+    } catch (error) {
+      window.parent.postMessage({ok: true, desc: "allow-same-origin is no longer in effect after reload - parent access blocked."}, "*");
+    }
+  } else {
+    window.parent.modify_if_8();
+  }
+}
+</script>
+<body onload="doTest()">
+  I am sandboxed with 'allow-scripts' and 'allow-same-origin' the first time I am loaded, and with 'allow-scripts' the second time
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if1.html b/content/html/content/test/file_iframe_sandbox_e_if1.html
index 08ba5b70fc1e..69f827ce4982 100644
--- a/content/html/content/test/file_iframe_sandbox_e_if1.html
+++ b/content/html/content/test/file_iframe_sandbox_e_if1.html
@@ -1,24 +1,20 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 341604</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-</head>
-<body>
-  <script>
-    window.addEventListener("message", receiveMessage, false);
-
-    function receiveMessage(event)
-    {
-      window.parent.postMessage("close", "*");
-
-      SimpleTest.executeSoon(function() {
-        window.close();
-      }); 
-    }
-  </script>
-  <iframe sandbox='allow-scripts allow-same-origin' id='if_6' src="file_iframe_sandbox_e_if6.html" height="10" width="10"></iframe>
-</body>
-</html>
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+</head>
+
+<script>
+  function doTest() {
+    var testContext = location.search == "" ? "?Test 10: Navigate _top:%20" : location.search;
+    document.getElementById("if_6").src = "file_iframe_sandbox_e_if6.html" + testContext;
+  }
+</script>
+
+<body onload="doTest()">
+  <iframe sandbox='allow-scripts' id='if_6' height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if10.html b/content/html/content/test/file_iframe_sandbox_e_if10.html
new file mode 100644
index 000000000000..2484b8f34283
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_e_if10.html
@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script>
+  function doTest() {
+    var testContext = "?Test 23: Nested navigate _top with window.open():%20";
+    document.getElementById("if_9").src = "file_iframe_sandbox_e_if9.html" + testContext;
+  }
+</script>
+
+<body onload="doTest()">
+  <iframe sandbox='allow-scripts allow-top-navigation' id='if_9' height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if11.html b/content/html/content/test/file_iframe_sandbox_e_if11.html
new file mode 100644
index 000000000000..42c28021a041
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_e_if11.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<script>
+  function doTest() {
+    var testContext = location.search.substring(1);
+    try {
+      var topsOpener = window.top.opener;
+      window.open("file_iframe_sandbox_top_navigation_pass.html?" + testContext, "_top");
+      topsOpener.postMessage({ok: true, desc: unescape(testContext) + "top navigation should be allowed by a document sandboxed with 'allow-top-navigation.'"}, "*");
+    } catch(error) {
+      window.top.opener.postMessage({ok: false, desc: unescape(testContext) + "error thrown during window.open(..., \"_top\")"}, "*");
+      window.top.close();
+    }
+  }
+</script>
+<body onload="doTest()">
+  I am sandboxed with 'allow-scripts and allow-top-navigation'
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if12.html b/content/html/content/test/file_iframe_sandbox_e_if12.html
new file mode 100644
index 000000000000..0b1b87e09beb
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_e_if12.html
@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script>
+  function doTest() {
+    var testContext = location.search == "" ? "?Test 24: Navigate _top with window.open():%20" : location.search;
+    document.getElementById("if_14").src = "file_iframe_sandbox_e_if14.html" + testContext;
+  }
+</script>
+
+<body onload="doTest()">
+  <iframe sandbox='allow-scripts' id='if_14' height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if13.html b/content/html/content/test/file_iframe_sandbox_e_if13.html
new file mode 100644
index 000000000000..f5cf912f6796
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_e_if13.html
@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script>
+  function doTest() {
+    var testContext = "?Test 25: Nested navigate _top with window.open():%20";
+    document.getElementById("if_12").src = "file_iframe_sandbox_e_if12.html" + testContext;
+  }
+</script>
+
+<body onload="doTest()">
+  <iframe sandbox='allow-scripts allow-top-navigation' id='if_12' height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if14.html b/content/html/content/test/file_iframe_sandbox_e_if14.html
new file mode 100644
index 000000000000..76d97870203d
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_e_if14.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<script>
+  function doTest() {
+    var testContext = location.search.substring(1);
+    try {
+      var topsOpener = window.top.opener;
+      window.open("file_iframe_sandbox_top_navigation_fail.html?" + testContext, "_top");
+      topsOpener.postMessage({ok: false, desc: unescape(testContext) + "top navigation should NOT be allowed by a document sandboxed without 'allow-top-navigation.'"}, "*");
+    } catch(error) {
+      window.top.opener.postMessage({ok: true, desc: unescape(testContext) + "as expected error thrown during window.open(..., \"_top\")"}, "*");
+      window.top.close();
+    }
+  }
+</script>
+<body onload="doTest()">
+  I am sandboxed with 'allow-scripts'
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if15.html b/content/html/content/test/file_iframe_sandbox_e_if15.html
new file mode 100644
index 000000000000..bf4138e1d690
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_e_if15.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script>
+  // Set our name, to allow an attempt to navigate us by name.
+  window.name = "e_if15";
+</script>
+
+<body>
+  <iframe sandbox='allow-scripts' id='if_16' src="file_iframe_sandbox_e_if16.html" height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if16.html b/content/html/content/test/file_iframe_sandbox_e_if16.html
new file mode 100644
index 000000000000..06c8bf8714f4
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_e_if16.html
@@ -0,0 +1,27 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Tests for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script>
+  var testContext = "Test 26: navigate top by name with window.open(): ";
+
+  function doTest() {
+    try {
+      var topsOpener = window.top.opener;
+      window.open("file_iframe_sandbox_top_navigation_fail.html?" + escape(testContext), "e_if15");
+      topsOpener.postMessage({ok: false, desc: unescape(testContext) + "top navigation should NOT be allowed by a document sandboxed without 'allow-top-navigation.'"}, "*");
+    } catch(error) {
+      window.top.opener.postMessage({ok: true, desc: testContext + "as expected, error thrown during window.open(..., \"e_if15\")"}, "*");
+      window.top.close();
+    }
+  }
+</script>
+
+<body onload="doTest()">
+  I am sandboxed but with "allow-scripts"
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if2.html b/content/html/content/test/file_iframe_sandbox_e_if2.html
index 17b51dfd82b0..47251d6dc8ff 100644
--- a/content/html/content/test/file_iframe_sandbox_e_if2.html
+++ b/content/html/content/test/file_iframe_sandbox_e_if2.html
@@ -1,22 +1,12 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 341604</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-</head>
-<body>
-  <script>
-    window.addEventListener("message", receiveMessage, false);
-
-    function receiveMessage(event)
-    {
-      SimpleTest.executeSoon(function() {
-        window.close();
-      });
-    }
-  </script>
-  <iframe sandbox='allow-scripts allow-top-navigation allow-same-origin' id='if_1' src="file_iframe_sandbox_e_if1.html" height="10" width="10"></iframe>
-</body>
-</html>
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+</head>
+<body>
+  <iframe sandbox='allow-scripts allow-top-navigation allow-same-origin' id='if_1' src="file_iframe_sandbox_e_if1.html?Test 11: Nested navigate _top:%20" height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if6.html b/content/html/content/test/file_iframe_sandbox_e_if6.html
index 4b74c34dd79e..365d83227946 100644
--- a/content/html/content/test/file_iframe_sandbox_e_if6.html
+++ b/content/html/content/test/file_iframe_sandbox_e_if6.html
@@ -1,24 +1,22 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 341604</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-</head>
-<script type="application/javascript">
-function doTest() {
-  sendMouseEvent({type:'click'}, 'anchor');
-
-   SimpleTest.executeSoon(function() {
-     window.parent.postMessage("close", "*");
-   });
-}
-</script>
-<body onload="doTest()">
-  I am sandboxed with 'allow-scripts'
-
-  <a href="file_iframe_sandbox_top_navigation_fail.html" target='_top' id='anchor'>
-</body>
-</html>
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+</head>
+<script type="application/javascript">
+function doTest() {
+  document.getElementById('anchor').href = "file_iframe_sandbox_top_navigation_fail.html" + location.search;
+  window.top.opener.postMessage("test attempted", "*");
+  sendMouseEvent({type:'click'}, 'anchor');
+}
+</script>
+<body onload="doTest()">
+  I am sandboxed with 'allow-scripts'
+
+  <a target='_top' id='anchor'>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if7.html b/content/html/content/test/file_iframe_sandbox_e_if7.html
new file mode 100644
index 000000000000..9d60ed2dbc1f
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_e_if7.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script>
+  // Set our name, to allow an attempt to navigate us by name.
+  window.name = "e_if7";
+</script>
+
+<body>
+  <iframe sandbox='allow-scripts' id='if_8' src="file_iframe_sandbox_e_if8.html" height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if8.html b/content/html/content/test/file_iframe_sandbox_e_if8.html
new file mode 100644
index 000000000000..62d6178b134d
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_e_if8.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Tests for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+</head>
+
+<script>
+  function doTest() {
+    // Try to navigate top using its name (e_if7).  We should not be able to do this as allow-top-navigation is not specified.
+    window.top.opener.postMessage("test attempted", "*");
+    sendMouseEvent({type:'click'}, 'navigate_top');
+  }
+</script>
+
+<body onload="doTest()">
+  I am sandboxed but with "allow-scripts"
+
+  <a href="file_iframe_sandbox_top_navigation_fail.html?Test 15: Navigate top by name:%20" target="e_if7" id="navigate_top">navigate top</a>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_e_if9.html b/content/html/content/test/file_iframe_sandbox_e_if9.html
new file mode 100644
index 000000000000..f18a16dba607
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_e_if9.html
@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script>
+  function doTest() {
+    var testContext = location.search == "" ? "?Test 22: Navigate _top with window.open():%20" : location.search;
+    document.getElementById("if_11").src = "file_iframe_sandbox_e_if11.html" + testContext;
+  }
+</script>
+
+<body onload="doTest()">
+  <iframe sandbox='allow-scripts allow-top-navigation' id='if_11' height="10" width="10"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_navigation_fail.html b/content/html/content/test/file_iframe_sandbox_navigation_fail.html
index 151cf50765a2..bae5276bd11e 100644
--- a/content/html/content/test/file_iframe_sandbox_navigation_fail.html
+++ b/content/html/content/test/file_iframe_sandbox_navigation_fail.html
@@ -1,16 +1,17 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 341604</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body onLoad="doStuff()">
-FAIL
-</body>
-<script>
-  function doStuff() {
-    window.parent.postMessage({ok: false, desc: "this navigation should NOT be allowed by a sandboxed document"}, "*");
-  }
-</script>
-</html>
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body onLoad="doStuff()">
+FAIL
+</body>
+<script>
+  function doStuff() {
+    var testContext = unescape(location.search.substring(1));
+    window.parent.postMessage({ok: false, desc: testContext + "this navigation should NOT be allowed by a sandboxed document", addToAttempted: false}, "*");
+  }
+</script>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_navigation_pass.html b/content/html/content/test/file_iframe_sandbox_navigation_pass.html
index 9f8ec967208e..e07248247b0a 100644
--- a/content/html/content/test/file_iframe_sandbox_navigation_pass.html
+++ b/content/html/content/test/file_iframe_sandbox_navigation_pass.html
@@ -1,16 +1,17 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 341604</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<script>
-function doStuff() {
-  window.parent.postMessage({ok: true, desc: "this navigation should be allowed by a sandboxed document"}, "*");
-}
-</script>
-<body onLoad="doStuff()">
-PASS
-</body>
-</html>
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<script>
+function doStuff() {
+  var testContext = unescape(location.search.substring(1));
+  window.parent.postMessage({ok: true, desc: testContext + "this navigation should be allowed by a sandboxed document"}, "*");
+}
+</script>
+<body onLoad="doStuff()">
+PASS
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_top_navigation_fail.html b/content/html/content/test/file_iframe_sandbox_top_navigation_fail.html
index 9158dce65ce0..dad6b2c006fa 100644
--- a/content/html/content/test/file_iframe_sandbox_top_navigation_fail.html
+++ b/content/html/content/test/file_iframe_sandbox_top_navigation_fail.html
@@ -1,17 +1,18 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 341604</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<script>
-function doStuff() {
-	window.opener.postMessage({ok: false, desc:  "top navigation should NOT be allowed by a document sandboxed without 'allow-top-navigation'"}, "*");
-	window.close();
-}
-</script>
-<body onLoad="doStuff()">
-FAIL\
-</body>
-</html>
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<script>
+function doStuff() {
+  var testContext = unescape(location.search.substring(1));
+  window.opener.postMessage({ok: false, desc: testContext + "top navigation should NOT be allowed by a document sandboxed without 'allow-top-navigation'", addToAttempted: false}, "*");
+  window.close();
+}
+</script>
+<body onLoad="doStuff()">
+FAIL\
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_top_navigation_pass.html b/content/html/content/test/file_iframe_sandbox_top_navigation_pass.html
index 13b3acc596d8..fe016ab23757 100644
--- a/content/html/content/test/file_iframe_sandbox_top_navigation_pass.html
+++ b/content/html/content/test/file_iframe_sandbox_top_navigation_pass.html
@@ -1,17 +1,18 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 341604</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<script>
-function doStuff() {
-	window.opener.postMessage({ok: true, desc:  "top navigation should be allowed by a document sandboxed with 'allow-top-navigation'"}, "*");
-	window.close();
-}
-</script>
-<body onLoad="doStuff()">
-PASS
-</body>
-</html>
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<script>
+function doStuff() {
+  var testContext = unescape(location.search.substring(1));
+  window.opener.postMessage({ok: true, desc: testContext + "top navigation should be allowed by a document sandboxed with 'allow-top-navigation'"}, "*");
+  window.close();
+}
+</script>
+<body onLoad="doStuff()">
+PASS
+</body>
+</html>
diff --git a/content/html/content/test/file_iframe_sandbox_window_navigation_fail.html b/content/html/content/test/file_iframe_sandbox_window_navigation_fail.html
new file mode 100644
index 000000000000..f8e3c83ce810
--- /dev/null
+++ b/content/html/content/test/file_iframe_sandbox_window_navigation_fail.html
@@ -0,0 +1,20 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 838692</title>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<script>
+function doStuff() {
+  var testContext = unescape(location.search.substring(1));
+  window.opener.postMessage({ok: false, desc: testContext + "a sandboxed document should not be able to navigate a window it hasn't opened.", addToAttempted: false}, "*");
+  window.close();
+}
+</script>
+
+<body onLoad="doStuff()">
+FAIL
+</body>
+</html>
diff --git a/content/html/content/test/test_iframe_sandbox_navigation.html b/content/html/content/test/test_iframe_sandbox_navigation.html
index 7bfc6cdbb893..32793ce3e928 100644
--- a/content/html/content/test/test_iframe_sandbox_navigation.html
+++ b/content/html/content/test/test_iframe_sandbox_navigation.html
@@ -1,234 +1,271 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=341604

-Implement HTML5 sandbox attribute for IFRAMEs
--->
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 341604 - navigation</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-	<script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<script type="application/javascript">
-
-SimpleTest.expectAssertions(1, 2);
-
-/** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs **/
-/** Navigation tests **/
-
-SimpleTest.waitForExplicitFinish();
-// a postMessage handler that is used by sandboxed iframes without
-// 'allow-same-origin'/other windows to communicate pass/fail back to this main page.
-// it expects to be called with an object like {ok: true/false, desc:
-// <description of the test> which it then forwards to ok()
-window.addEventListener("message", receiveMessage, false);
-
-var testPassesReceived = 0;
-
-function receiveMessage(event) {
-  // this message is part of if_10's test
-  if (event.data.test == 'if_10') {
-    doIf10TestPart2();
-    return;
-  }
-
-  ok_wrapper(event.data.ok, event.data.desc);
-}
-
-var completedTests = 0;
-var passedTests = 0;
-
-function ok_wrapper(result, desc) {
-  ok(result, desc);
-
-  completedTests++;
-
-  if (result) {
-    passedTests++;
-  }
-
-  if (completedTests == 6) {
-    is(passedTests, 6, "There are 6 navigation tests that should pass");
-
-    SimpleTest.finish();
-  }
-}
-
-function doTest() {
-  // passes if good
-  // 1) A sandboxed iframe is allowed to navigate itself
-  // (done by file_iframe_sandbox_d_if1.html which has 'allow-scripts' and navigates to
-  // file_iframe_sandbox_navigation_pass.html).
-
-  // passes if good
-  // 2) A sandboxed iframe is allowed to navigate its children, even if they are sandboxed
-  // (done by file_iframe_sandbox_d_if2.html which has 'allow-scripts', it navigates a child
-  // iframe containing file_iframe_sandbox_navigation_start.html to file_iframe_sandbox_navigation_pass.html).
-
-  // fails if bad
-  // 3) A sandboxed iframe is not allowed to navigate its ancestor
-  // (done by file_iframe_sandbox_d_if4.html contained within file_iframe_sandbox_d_if3.html,
-  // it attempts to navigate file_iframe_sandbox_d_if3.html to file_iframe_sandbox_navigation_fail.html).
-
-  // fails if bad
-  // 4) A sandboxed iframe is not allowed to navigate its sibling
-  // (done by file_iframe_sandbox_d_if5.html which has 'allow scripts allow-same-origin'
-  // and attempts to navigate file_iframe_navigation_start.html contained in if_sibling on this
-  // page to file_iframe_sandbox_navigation_fail.html).
-
-  // fails if bad
-  // 5) When a link is clicked in a sandboxed iframe, the document navigated to is sandboxed
-  // the same as the original document and is not same origin with parent document
-  // (done by file_iframe_sandbox_d_if6.html which simulates a link click and navigates
-  // to file_iframe_sandbox_d_if7.html which attempts to call back into its parent).
-
-  // fails if bad
-  // 6) An iframe (if_8) has sandbox="allow-same-origin allow-scripts", the sandboxed document
-  // (file_iframe_sandbox_d_if_8.html) that it contains accesses its parent (this file) and removes
-  // 'allow-same-origin' and then triggers a reload.
-  // The document should not be able to access its parent (this file).
-
-  // fails if bad
-  // 7) An iframe (if_9) has sandbox="allow-same-origin allow-scripts", the sandboxed document
-  // (file_iframe_sandbox_d_if_9.html) that it contains accesses its parent (this file) and removes
-  // 'allow-scripts' and then triggers a reload.
-  // The document should not be able to run a script and access its parent (this file).
-
-  // passes if good
-  // 8) a document in an iframe with sandbox='allow-scripts' should have a different null
-  // principal in its original document than a document to which it navigates itself
-  // file_iframe_sandbox_d_if_10.html does this, co-ordinating with this page via postMessage
-  
-  // passes if good
-  // 9) a document (file_iframe_sandbox_d_if11.html in an iframe (if_11) with sandbox='allow-scripts'
-  // is navigated to file_iframe_sandbox_d_if12.html - when that document loads
-  // a message is sent back to this document, which adds 'allow-same-origin' to if_11 and then
-  // calls .back on it - file_iframe_sandbox_if12.html should be able to call back into this
-  // document - this is all contained in file_iframe_sandbox_d_if13.html which is opened in another
-  // tab so it has its own isolated session history
-  window.open("file_iframe_sandbox_d_if13.html");
-  
-  // open up the top navigation tests
-
-  // fails if bad
-  // 10) iframe with sandbox='allow-scripts' can NOT navigate top
-  // file_iframe_sandbox_e_if1.html contains file_iframe_sandbox_e_if6.html which
-  // attempts to navigate top
-  window.open("file_iframe_sandbox_e_if1.html");
-
-  // fails if bad
-  // 11) iframe with sandbox='allow-scripts' nested inside iframe with
-  // 'allow-top-navigation allow-scripts' can NOT navigate top
-  // file_iframe_sandbox_e_if2.html contains file_iframe_sandbox_e_if1.html which
-  // contains file_iframe_sandbox_e_if6.html which attempts to navigate top
-  window.open("file_iframe_sandbox_e_if2.html");
-
-  // passes if good
-  // 12) iframe with sandbox='allow-top-navigation allow-scripts' can navigate top
-  // file_iframe_sandbox_e_if3.html contains file_iframe_sandbox_e_if5.html which navigates top
-  window.open("file_iframe_sandbox_e_if3.html");
-
-  // passes if good
-  // 131) iframe with sandbox='allow-top-navigation allow-scripts' nested inside an iframe with
-  // 'allow-top-navigation allow-scripts' can navigate top
-  // file_iframe_sandbox_e_if4.html contains file_iframe_sandbox_e_if3.html which contains
-  // file_iframe_sandbox_e_if5.html which navigates top
-  window.open("file_iframe_sandbox_e_if4.html");
-}
-
-addLoadEvent(doTest);
-
-window.modified_if_8 = false;
-
-function reload_if_8() {
-  var if_8 = document.getElementById('if_8');
-  if_8.src = 'file_iframe_sandbox_d_if8.html';
-}
-
-function modify_if_8() {
-  // If this is the second time this has been called
-  // that's a failed test (allow-same-origin was removed
-  // the first time).
-  if (window.modified_if_8) {
-    ok_wrapper(false, "an sandboxed iframe from which 'allow-same-origin' was removed should not be able to access its parent");
-
-    // need to return here since we end up in an infinite loop otherwise
-    return;
-  }
-
-  var if_8 = document.getElementById('if_8');
-  window.modified_if_8 = true;
-
-  if_8.sandbox = 'allow-scripts';
-  sendMouseEvent({type:'click'}, 'a_button');
-}
-
-window.modified_if_9 = false;
-
-function reload_if_9() {
-  var if_9 = document.getElementById('if_9');
-  if_9.src = 'file_iframe_sandbox_d_if9.html';
-}
-
-function modify_if_9() {
-  // If this is the second time this has been called
-  // that's a failed test (allow-scripts was removed
-  // the first time).
-  if (window.modified_if_9) {
-    ok_wrapper(false, "an sandboxed iframe from which 'allow-scripts' should be removed should not be able to access its parent via a script");
-
-    // need to return here since we end up in an infinite loop otherwise
-    return;
-  }
-
-  var if_9 = document.getElementById('if_9');
-  window.modified_if_9 = true;
-
-  if_9.sandbox = 'allow-same-origin';
-
-  sendMouseEvent({type:'click'}, 'a_button2');
-}
-
-var firstPrincipal = "";
-var secondPrincipal;
-
-function doIf10TestPart1() {
-  if (firstPrincipal != "")
-    return;
-
-  // use SpecialPowers to get the principal of if_10.
-  // NB: We stringify here and below because special-powers wrapping doesn't
-  // preserve identity.
-  var if_10 = document.getElementById('if_10');
-  firstPrincipal = SpecialPowers.wrap(if_10).contentDocument.nodePrincipal.origin;
-  if_10.src = 'file_iframe_sandbox_d_if10.html';
-
-}
-function doIf10TestPart2() {
-  var if_10 = document.getElementById('if_10');
-  // use SpecialPowers to get the principal of if_10
-  secondPrincipal = SpecialPowers.wrap(if_10).contentDocument.nodePrincipal.origin;
-  ok_wrapper(firstPrincipal != secondPrincipal, "documents should NOT have the same principal if they are sandboxed without" +
-    " allow-same-origin and the first document is navigated to the second");
-}
-</script>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=341604">Mozilla Bug 341604</a> - Implement HTML5 sandbox attribute for IFRAMEs
-<p id="display"></p>
-<div id="content">
-<iframe sandbox="allow-scripts" id="if_1" src="file_iframe_sandbox_d_if1.html" height="10" width="10"></iframe>
-<iframe sandbox="allow-scripts" id="if_2" src="file_iframe_sandbox_d_if2.html" height="10" width="10"></iframe>
-<iframe sandbox="allow-scripts" id="if_3" src="file_iframe_sandbox_d_if3.html" height="10" width="10"></iframe>
-<iframe sandbox="allow_scripts allow-same-origin" id="if_5" src="file_iframe_sandbox_d_if5.html" height="10" width="10"></iframe>
-<iframe id="if_sibling" src="file_iframe_sandbox_navigation_start.html" height="10" width="10"></iframe>
-<iframe sandbox="allow_scripts" id="if_6" src="file_iframe_sandbox_d_if6.html" height="10" width="10"></iframe>
-<iframe sandbox="allow-same-origin allow-scripts" id="if_8" src="file_iframe_sandbox_d_if8.html" height="10" width="10"></iframe>
-<iframe sandbox="allow-same-origin allow-scripts" id="if_9" src="file_iframe_sandbox_d_if9.html" height="10" width="10"></iframe>
-<iframe sandbox="allow-scripts" id="if_10" src="file_iframe_sandbox_navigation_start.html" onload='doIf10TestPart1()' height="10" width="10"></iframe>
-</div>
-<input type='button' id="a_button" onclick='reload_if_8()'>
-<input type='button' id="a_button2" onclick='reload_if_9()'>
-</body>
-</html>
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=341604
+Implement HTML5 sandbox attribute for IFRAMEs
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604 - navigation</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<script type="application/javascript">
+/** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs **/
+/** Navigation tests Part 1**/
+
+SimpleTest.expectAssertions(1, 3);
+SimpleTest.waitForExplicitFinish();
+// a postMessage handler that is used by sandboxed iframes without
+// 'allow-same-origin'/other windows to communicate pass/fail back to this main page.
+// it expects to be called with an object like {ok: true/false, desc:
+// <description of the test> which it then forwards to ok()
+window.addEventListener("message", receiveMessage, false);
+
+var testPassesReceived = 0;
+
+function receiveMessage(event) {
+  // this message is part of if_10's test
+  if (event.data.test == 'if_10') {
+    doIf10TestPart2();
+  } else if (event.data == "test attempted") {
+    testAttempted();
+  } else {
+    ok_wrapper(event.data.ok, event.data.desc, event.data.addToAttempted);
+  }
+}
+
+// Open windows for tests to attempt to navigate later.
+var windowsToClose = new Array();
+windowsToClose.push(window.open("about:blank", "window_to_navigate"));
+windowsToClose.push(window.open("about:blank", "window_to_navigate2"));
+
+var attemptedTests = 0;
+var passedTests = 0;
+var totalTestsToPass = 8;
+var totalTestsToAttempt = 13;
+
+function ok_wrapper(result, desc, addToAttempted = true) {
+  ok(result, desc);
+
+  if (result) {
+    passedTests++;
+  }
+
+  if (addToAttempted) {
+    testAttempted();
+  }
+}
+
+// Added so that tests that don't register unless they fail,
+// can at least notify that they've attempted to run.
+function testAttempted() {
+  attemptedTests++;
+  if (attemptedTests == totalTestsToAttempt) {
+    // Make sure all tests have had a chance to complete.
+    setTimeout(function() {finish();}, 1000);
+  }
+}
+
+var finishCalled = false;
+
+function finish() {
+  if (!finishCalled) {
+    finishCalled = true;
+    is(passedTests, totalTestsToPass, "There are " + totalTestsToPass + " navigation tests that should pass");
+
+    for (var i = 0; i < windowsToClose.length; i++) {
+      windowsToClose[i].close();
+    }
+
+    SimpleTest.finish();
+  }
+}
+
+function checkTestsFinished() {
+  // If our own finish() has not been called, probably failed due to a timeout, so close remaining windows.
+  if (!finishCalled) {
+    for (var i = 0; i < windowsToClose.length; i++) {
+      windowsToClose[i].close();
+    }
+  }
+}
+
+function doTest() {
+  // passes if good
+  // 1) A sandboxed iframe is allowed to navigate itself
+  // (done by file_iframe_sandbox_d_if1.html which has 'allow-scripts' and navigates to
+  // file_iframe_sandbox_navigation_pass.html).
+
+  // passes if good
+  // 2) A sandboxed iframe is allowed to navigate its children, even if they are sandboxed
+  // (done by file_iframe_sandbox_d_if2.html which has 'allow-scripts', it navigates a child
+  // iframe containing file_iframe_sandbox_navigation_start.html to file_iframe_sandbox_navigation_pass.html).
+
+  // fails if bad
+  // 3) A sandboxed iframe is not allowed to navigate its ancestor
+  // (done by file_iframe_sandbox_d_if4.html contained within file_iframe_sandbox_d_if3.html,
+  // it attempts to navigate file_iframe_sandbox_d_if3.html to file_iframe_sandbox_navigation_fail.html).
+
+  // fails if bad
+  // 4) A sandboxed iframe is not allowed to navigate its sibling
+  // (done by file_iframe_sandbox_d_if5.html which has 'allow scripts allow-same-origin'
+  // and attempts to navigate file_iframe_navigation_start.html contained in if_sibling on this
+  // page to file_iframe_sandbox_navigation_fail.html).
+
+  // passes if good, fails if bad
+  // 5) When a link is clicked in a sandboxed iframe, the document navigated to is sandboxed
+  // the same as the original document and is not same origin with parent document
+  // (done by file_iframe_sandbox_d_if6.html which simulates a link click and navigates
+  // to file_iframe_sandbox_d_if7.html which attempts to call back into its parent).
+
+  // passes if good, fails if bad
+  // 6) An iframe (if_8) has sandbox="allow-same-origin allow-scripts", the sandboxed document
+  // (file_iframe_sandbox_d_if_8.html) that it contains accesses its parent (this file) and removes
+  // 'allow-same-origin' and then triggers a reload.
+  // The document should not be able to access its parent (this file).
+
+  // fails if bad
+  // 7) An iframe (if_9) has sandbox="allow-same-origin allow-scripts", the sandboxed document
+  // (file_iframe_sandbox_d_if_9.html) that it contains accesses its parent (this file) and removes
+  // 'allow-scripts' and then triggers a reload.
+  // The document should not be able to run a script and access its parent (this file).
+
+  // passes if good
+  // 8) a document in an iframe with sandbox='allow-scripts' should have a different null
+  // principal in its original document than a document to which it navigates itself
+  // file_iframe_sandbox_d_if_10.html does this, co-ordinating with this page via postMessage
+
+  // passes if good
+  // 9) a document (file_iframe_sandbox_d_if11.html in an iframe (if_11) with sandbox='allow-scripts'
+  // is navigated to file_iframe_sandbox_d_if12.html - when that document loads
+  // a message is sent back to this document, which adds 'allow-same-origin' to if_11 and then
+  // calls .back on it - file_iframe_sandbox_if12.html should be able to call back into this
+  // document - this is all contained in file_iframe_sandbox_d_if13.html which is opened in another
+  // tab so it has its own isolated session history
+  window.open("file_iframe_sandbox_d_if13.html");
+
+  // open up the top navigation tests
+
+  // fails if bad
+  // 10) iframe with sandbox='allow-scripts' can NOT navigate top
+  // file_iframe_sandbox_e_if1.html contains file_iframe_sandbox_e_if6.html which
+  // attempts to navigate top
+  windowsToClose.push(window.open("file_iframe_sandbox_e_if1.html"));
+
+  // fails if bad
+  // 11) iframe with sandbox='allow-scripts' nested inside iframe with
+  // 'allow-top-navigation allow-scripts' can NOT navigate top
+  // file_iframe_sandbox_e_if2.html contains file_iframe_sandbox_e_if1.html which
+  // contains file_iframe_sandbox_e_if6.html which attempts to navigate top
+  windowsToClose.push(window.open("file_iframe_sandbox_e_if2.html"));
+
+  // passes if good
+  // 12) iframe with sandbox='allow-top-navigation allow-scripts' can navigate top
+  // file_iframe_sandbox_e_if3.html contains file_iframe_sandbox_e_if5.html which navigates top
+  window.open("file_iframe_sandbox_e_if3.html");
+
+  // passes if good
+  // 13) iframe with sandbox='allow-top-navigation allow-scripts' nested inside an iframe with
+  // 'allow-top-navigation allow-scripts' can navigate top
+  // file_iframe_sandbox_e_if4.html contains file_iframe_sandbox_e_if3.html which contains
+  // file_iframe_sandbox_e_if5.html which navigates top
+  window.open("file_iframe_sandbox_e_if4.html");
+}
+
+addLoadEvent(doTest);
+
+window.modified_if_8 = false;
+
+function reload_if_8() {
+  var if_8 = document.getElementById('if_8');
+  if_8.src = 'file_iframe_sandbox_d_if8.html?onreload';
+}
+
+function modify_if_8() {
+  // If this is the second time this has been called
+  // that's a failed test (allow-same-origin was removed
+  // the first time).
+  if (window.modified_if_8) {
+    ok_wrapper(false, "an sandboxed iframe from which 'allow-same-origin' was removed should not be able to access its parent");
+
+    // need to return here since we end up in an infinite loop otherwise
+    return;
+  }
+
+  var if_8 = document.getElementById('if_8');
+  window.modified_if_8 = true;
+
+  if_8.sandbox = 'allow-scripts';
+  sendMouseEvent({type:'click'}, 'a_button');
+}
+
+window.modified_if_9 = false;
+
+function reload_if_9() {
+  var if_9 = document.getElementById('if_9');
+  if_9.src = 'file_iframe_sandbox_d_if9.html';
+}
+
+function modify_if_9() {
+  // If this is the second time this has been called
+  // that's a failed test (allow-scripts was removed
+  // the first time).
+  if (window.modified_if_9) {
+    ok_wrapper(false, "an sandboxed iframe from which 'allow-scripts' should be removed should not be able to access its parent via a script", false);
+
+    // need to return here since we end up in an infinite loop otherwise
+    return;
+  }
+
+  var if_9 = document.getElementById('if_9');
+  window.modified_if_9 = true;
+
+  if_9.sandbox = 'allow-same-origin';
+
+  sendMouseEvent({type:'click'}, 'a_button2');
+  testAttempted();
+}
+
+var firstPrincipal = "";
+var secondPrincipal;
+
+function doIf10TestPart1() {
+  if (firstPrincipal != "")
+    return;
+
+  // use SpecialPowers to get the principal of if_10.
+  // NB: We stringify here and below because special-powers wrapping doesn't
+  // preserve identity.
+  var if_10 = document.getElementById('if_10');
+  firstPrincipal = SpecialPowers.wrap(if_10).contentDocument.nodePrincipal.origin;
+  if_10.src = 'file_iframe_sandbox_d_if10.html';
+}
+
+function doIf10TestPart2() {
+  var if_10 = document.getElementById('if_10');
+  // use SpecialPowers to get the principal of if_10
+  secondPrincipal = SpecialPowers.wrap(if_10).contentDocument.nodePrincipal.origin;
+  ok_wrapper(firstPrincipal != secondPrincipal, "documents should NOT have the same principal if they are sandboxed without" +
+    " allow-same-origin and the first document is navigated to the second");
+}
+</script>
+<body onunload="checkTestsFinished()">
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=341604">Mozilla Bug 341604</a> - Implement HTML5 sandbox attribute for IFRAMEs
+<p id="display"></p>
+<div id="content">
+<iframe sandbox="allow-scripts" id="if_1" src="file_iframe_sandbox_d_if1.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts" id="if_2" src="file_iframe_sandbox_d_if2.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts" id="if_3" src="file_iframe_sandbox_d_if3.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts allow-same-origin" id="if_5" src="file_iframe_sandbox_d_if5.html" height="10" width="10"></iframe>
+<iframe id="if_sibling" name="if_sibling" src="file_iframe_sandbox_navigation_start.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts" id="if_6" src="file_iframe_sandbox_d_if6.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-same-origin allow-scripts" id="if_8" src="file_iframe_sandbox_d_if8.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-same-origin allow-scripts" id="if_9" src="file_iframe_sandbox_d_if9.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts" id="if_10" src="file_iframe_sandbox_navigation_start.html" onload='doIf10TestPart1()' height="10" width="10"></iframe>
+</div>
+<input type='button' id="a_button" onclick='reload_if_8()'>
+<input type='button' id="a_button2" onclick='reload_if_9()'>
+</body>
+</html>
diff --git a/content/html/content/test/test_iframe_sandbox_navigation2.html b/content/html/content/test/test_iframe_sandbox_navigation2.html
new file mode 100644
index 000000000000..a4b2a4d8a384
--- /dev/null
+++ b/content/html/content/test/test_iframe_sandbox_navigation2.html
@@ -0,0 +1,187 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=341604
+Implement HTML5 sandbox attribute for IFRAMEs
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 341604 - navigation</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<script type="application/javascript">
+/** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs **/
+/** Navigation tests Part 2**/
+
+SimpleTest.expectAssertions(0);
+SimpleTest.waitForExplicitFinish();
+// a postMessage handler that is used by sandboxed iframes without
+// 'allow-same-origin'/other windows to communicate pass/fail back to this main page.
+// it expects to be called with an object like {ok: true/false, desc:
+// <description of the test> which it then forwards to ok()
+window.addEventListener("message", receiveMessage, false);
+
+var testPassesReceived = 0;
+
+function receiveMessage(event) {
+  if (event.data == "test attempted") {
+    testAttempted();
+  } else {
+    ok_wrapper(event.data.ok, event.data.desc, event.data.addToAttempted);
+  }
+}
+
+// Open windows for tests to attempt to navigate later.
+var windowsToClose = new Array();
+windowsToClose.push(window.open("about:blank", "window_to_navigate"));
+windowsToClose.push(window.open("about:blank", "window_to_navigate2"));
+
+var attemptedTests = 0;
+var passedTests = 0;
+var totalTestsToPass = 10;
+var totalTestsToAttempt = 13;
+
+function ok_wrapper(result, desc, addToAttempted = true) {
+  ok(result, desc);
+
+  if (result) {
+    passedTests++;
+  }
+
+  if (addToAttempted) {
+    testAttempted();
+  }
+}
+
+// Added so that tests that don't register unless they fail,
+// can at least notify that they've attempted to run.
+function testAttempted() {
+  attemptedTests++;
+  if (attemptedTests == totalTestsToAttempt) {
+    // Make sure all tests have had a chance to complete.
+    setTimeout(function() {finish();}, 1000);
+  }
+}
+
+var finishCalled = false;
+
+function finish() {
+  if (!finishCalled) {
+    finishCalled = true;
+    is(passedTests, totalTestsToPass, "There are " + totalTestsToPass + " navigation tests that should pass");
+
+    for (var i = 0; i < windowsToClose.length; i++) {
+      windowsToClose[i].close();
+    }
+
+    SimpleTest.finish();
+  }
+}
+
+function checkTestsFinished() {
+  // If our own finish() has not been called, probably failed due to a timeout, so close remaining windows.
+  if (!finishCalled) {
+    for (var i = 0; i < windowsToClose.length; i++) {
+      windowsToClose[i].close();
+    }
+  }
+}
+
+function doTest() {
+  // fails if bad
+  // 14) iframe with sandbox='allow-same-origin allow-scripts allow-top-navigation' should not
+  // be able to navigate another window (opened by another browsing context) using its name.
+  // file_iframe_sandbox_d_if14.html in if_14 attempts to navigate "window_to_navigate",
+  // which has been opened in preparation.
+
+  // fails if bad
+  // 15) iframe with sandbox='allow-scripts' should not be able to navigate top using its
+  // real name (instead of _top) as allow-top-navigation is not specified.
+  // file_iframe_sandbox_e_if7.html contains file_iframe_sandbox_e_if8.html, which
+  // attempts to navigate top by name.
+  windowsToClose.push(window.open("file_iframe_sandbox_e_if7.html"));
+
+  // fails if bad
+  // 16) iframe with sandbox='allow-same-origin allow-scripts allow-top-navigation' should not
+  // be able to use its parent's name (instead of _parent) to navigate it, when it is not top.
+  // (Note: this would apply to other ancestors that are not top as well.)
+  // file_iframe_sandbox_d_if15.html in if_15 contains file_iframe_sandbox_d_if16.html, which
+  // tries to navigate if_15 by its name (if_parent).
+
+  // passes if good, fails if bad
+  // 17) A sandboxed iframe is allowed to navigate itself using window.open().
+  // (Done by file_iframe_sandbox_d_if17.html which has 'allow-scripts' and navigates to
+  // file_iframe_sandbox_navigation_pass.html).
+
+  // passes if good, fails if bad
+  // 18) A sandboxed iframe is allowed to navigate its children with window.open(), even if
+  // they are sandboxed.  (Done by file_iframe_sandbox_d_if18.html which has 'allow-scripts',
+  // it navigates a child iframe to file_iframe_sandbox_navigation_pass.html).
+
+  // passes if good, fails if bad
+  // 19) A sandboxed iframe is not allowed to navigate its ancestor with window.open().
+  // (Done by file_iframe_sandbox_d_if20.html contained within file_iframe_sandbox_d_if19.html,
+  // it attempts to navigate file_iframe_sandbox_d_if19.html to file_iframe_sandbox_navigation_fail.html).
+
+  // passes if good, fails if bad
+  // 20) iframe with sandbox='allow-same-origin allow-scripts allow-top-navigation' should not
+  // be able to navigate another window (opened by another browsing context) using window.open(..., "<name>").
+  // file_iframe_sandbox_d_if14.html in if_14 attempts to navigate "window_to_navigate2",
+  // which has been opened in preparation, using window.open(..., "window_to_navigate2").
+
+  // passes if good, fails if bad
+  // 21) iframe with sandbox='allow-same-origin allow-scripts allow-top-navigation' should not
+  // be able to use its parent's name (not _parent) to navigate it using window.open(), when it is not top.
+  // (Note: this would apply to other ancestors that are not top as well.)
+  // file_iframe_sandbox_d_if21.html in if_21 contains file_iframe_sandbox_d_if22.html, which
+  // tries to navigate if_21 by its name (if_parent2).
+
+  // passes if good, fails if bad
+  // 22) iframe with sandbox='allow-top-navigation allow-scripts' can navigate top with window.open().
+  // file_iframe_sandbox_e_if9.html contains file_iframe_sandbox_e_if11.html which navigates top.
+  window.open("file_iframe_sandbox_e_if9.html");
+
+  // passes if good, fails if bad
+  // 23) iframe with sandbox='allow-top-navigation allow-scripts' nested inside an iframe with
+  // 'allow-top-navigation allow-scripts' can navigate top, with window.open().
+  // file_iframe_sandbox_e_if10.html contains file_iframe_sandbox_e_if9.html which contains
+  // file_iframe_sandbox_e_if11.html which navigates top.
+  window.open("file_iframe_sandbox_e_if10.html");
+
+  // passes if good, fails if bad
+  // 24) iframe with sandbox='allow-scripts' can NOT navigate top with window.open().
+  // file_iframe_sandbox_e_if12.html contains file_iframe_sandbox_e_if14.html which navigates top.
+  window.open("file_iframe_sandbox_e_if12.html");
+
+  // passes if good, fails if bad
+  // 25) iframe with sandbox='allow-scripts' nested inside an iframe with
+  // 'allow-top-navigation allow-scripts' can NOT navigate top, with window.open(..., "_top").
+  // file_iframe_sandbox_e_if13.html contains file_iframe_sandbox_e_if12.html which contains
+  // file_iframe_sandbox_e_if14.html which navigates top.
+  window.open("file_iframe_sandbox_e_if13.html");
+
+  // passes if good, fails if bad
+  // 26) iframe with sandbox='allow-scripts' should not be able to navigate top using its real name
+  // (not with _top e.g. window.open(..., "topname")) as allow-top-navigation is not specified.
+  // file_iframe_sandbox_e_if15.html contains file_iframe_sandbox_e_if16.html, which
+  // attempts to navigate top by name using window.open().
+  window.open("file_iframe_sandbox_e_if15.html");
+}
+
+addLoadEvent(doTest);
+</script>
+<body onunload="checkTestsFinished()">
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=341604">Mozilla Bug 341604</a> - Implement HTML5 sandbox attribute for IFRAMEs
+<p id="display"></p>
+<div id="content">
+<iframe sandbox="allow-same-origin allow-scripts allow-top-navigation" id="if_14" src="file_iframe_sandbox_d_if14.html" height="10" width="10"></iframe>
+<iframe id="if_15" name="if_parent" src="file_iframe_sandbox_d_if15.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts" id="if_17" src="file_iframe_sandbox_d_if17.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts" id="if_18" src="file_iframe_sandbox_d_if18.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts" id="if_19" src="file_iframe_sandbox_d_if19.html" height="10" width="10"></iframe>
+<iframe id="if_21" name="if_parent2" src="file_iframe_sandbox_d_if21.html" height="10" width="10"></iframe>
+</div>
+</body>
+</html>
diff --git a/testing/mochitest/b2g.json b/testing/mochitest/b2g.json
index dc801515ac37..4363d7a9f0b9 100644
--- a/testing/mochitest/b2g.json
+++ b/testing/mochitest/b2g.json
@@ -75,6 +75,7 @@
     "content/html/content/test/test_fullscreen-api.html":"",
     "content/html/content/test/test_iframe_sandbox_inheritance.html":"",
     "content/html/content/test/test_iframe_sandbox_navigation.html":"",
+    "content/html/content/test/test_iframe_sandbox_navigation2.html":"multiple concurrent window.open()s fail on B2G",
     "content/html/content/test/test_formSubmission.html":"",
     "content/html/content/test/test_iframe_sandbox_plugins.html":"",
     "content/html/content/test/test_object_plugin_nav.html":"",

From 23bd07e68871c961a550db6437e9750996f9185c Mon Sep 17 00:00:00 2001
From: Gavin Sharp <gavin@gavinsharp.com>
Date: Mon, 17 Jun 2013 17:21:20 -0400
Subject: [PATCH 32/75] backout f370e521f004 (bug 879658) for b-c bustage

--HG--
extra : rebase_source : faa6901a5da3f65feb7db0c12c8657d7704bbbc5
---
 toolkit/components/social/FrameWorker.jsm     | 15 +---
 toolkit/components/social/SocialService.jsm   | 83 +++++++++----------
 .../test/browser/browser_frameworker.js       | 26 +-----
 3 files changed, 42 insertions(+), 82 deletions(-)

diff --git a/toolkit/components/social/FrameWorker.jsm b/toolkit/components/social/FrameWorker.jsm
index 771e4a8f1591..77bbb7a1140c 100644
--- a/toolkit/components/social/FrameWorker.jsm
+++ b/toolkit/components/social/FrameWorker.jsm
@@ -30,7 +30,7 @@ var _nextPortId = 1;
 // Retrieves a reference to a WorkerHandle associated with a FrameWorker and a
 // new ClientPort.
 this.getFrameWorkerHandle =
- function getFrameWorkerHandle(url, clientWindow, name, origin, exposeLocalStorage = false) {
+ function getFrameWorkerHandle(url, clientWindow, name, origin) {
   // first create the client port we are going to use.  Later we will
   // message the worker to create the worker port.
   let portid = _nextPortId++;
@@ -39,7 +39,7 @@ this.getFrameWorkerHandle =
   let existingWorker = workerCache[url];
   if (!existingWorker) {
     // setup the worker and add this connection to the pending queue
-    let worker = new FrameWorker(url, name, origin, exposeLocalStorage);
+    let worker = new FrameWorker(url, name, origin);
     worker.pendingPorts.push(clientPort);
     existingWorker = workerCache[url] = worker;
   } else {
@@ -69,7 +69,7 @@ this.getFrameWorkerHandle =
  * the script does not have a full DOM but is instead run in a sandbox
  * that has a select set of methods cloned from the URL's domain.
  */
-function FrameWorker(url, name, origin, exposeLocalStorage) {
+function FrameWorker(url, name, origin) {
   this.url = url;
   this.name = name || url;
   this.ports = new Map();
@@ -78,7 +78,6 @@ function FrameWorker(url, name, origin, exposeLocalStorage) {
   this.reloading = false;
   this.origin = origin;
   this._injectController = null;
-  this.exposeLocalStorage = exposeLocalStorage;
 
   this.frame = makeHiddenFrame();
   this.load();
@@ -134,17 +133,11 @@ FrameWorker.prototype = {
     // copy the window apis onto the sandbox namespace only functions or
     // objects that are naturally a part of an iframe, I'm assuming they are
     // safe to import this way
-    let workerAPI = ['WebSocket', 'atob', 'btoa',
+    let workerAPI = ['WebSocket', 'localStorage', 'atob', 'btoa',
                      'clearInterval', 'clearTimeout', 'dump',
                      'setInterval', 'setTimeout', 'XMLHttpRequest',
                      'FileReader', 'Blob', 'EventSource', 'indexedDB',
                      'location'];
-
-    // Only expose localStorage if the caller opted-in
-    if (this.exposeLocalStorage) {
-      workerAPI.push('localStorage');
-    }
-
     // Bug 798660 - XHR and WebSocket have issues in a sandbox and need
     // to be unwrapped to work
     let needsWaive = ['XMLHttpRequest', 'WebSocket'];
diff --git a/toolkit/components/social/SocialService.jsm b/toolkit/components/social/SocialService.jsm
index a22d14613000..c8e28bc9001c 100644
--- a/toolkit/components/social/SocialService.jsm
+++ b/toolkit/components/social/SocialService.jsm
@@ -137,42 +137,6 @@ let SocialServiceInternal = {
   }
 };
 
-XPCOMUtils.defineLazyGetter(SocialServiceInternal, "providers", function () {
-  initService();
-  let providers = {};
-  for (let manifest of this.manifests) {
-    try {
-      if (ActiveProviders.has(manifest.origin)) {
-        let activationType = getOriginActivationType(manifest.origin);
-        let blessed = activationType == "builtin" ||
-                      activationType == "whitelist";
-        let provider = new SocialProvider(manifest, blessed);
-        providers[provider.origin] = provider;
-      }
-    } catch (err) {
-      Cu.reportError("SocialService: failed to load provider: " + manifest.origin +
-                     ", exception: " + err);
-    }
-  }
-  return providers;
-});
-
-function getOriginActivationType(origin) {
-  let prefname = SocialServiceInternal.getManifestPrefname(origin);
-  if (Services.prefs.getDefaultBranch("social.manifest.").getPrefType(prefname) == Services.prefs.PREF_STRING)
-    return 'builtin';
-
-  let whitelist = Services.prefs.getCharPref("social.whitelist").split(',');
-  if (whitelist.indexOf(origin) >= 0)
-    return 'whitelist';
-
-  let directories = Services.prefs.getCharPref("social.directories").split(',');
-  if (directories.indexOf(origin) >= 0)
-    return 'directory';
-
-  return 'foreign';
-}
-
 let ActiveProviders = {
   get _providers() {
     delete this._providers;
@@ -340,6 +304,23 @@ function initService() {
     MozSocialAPI.enabled = true;
 }
 
+XPCOMUtils.defineLazyGetter(SocialServiceInternal, "providers", function () {
+  initService();
+  let providers = {};
+  for (let manifest of this.manifests) {
+    try {
+      if (ActiveProviders.has(manifest.origin)) {
+        let provider = new SocialProvider(manifest);
+        providers[provider.origin] = provider;
+      }
+    } catch (err) {
+      Cu.reportError("SocialService: failed to load provider: " + manifest.origin +
+                     ", exception: " + err);
+    }
+  }
+  return providers;
+});
+
 function schedule(callback) {
   Services.tm.mainThread.dispatch(callback, Ci.nsIThread.DISPATCH_NORMAL);
 }
@@ -463,6 +444,22 @@ this.SocialService = {
     SocialServiceInternal.orderedProviders(onDone);
   },
 
+  getOriginActivationType: function(origin) {
+    let prefname = SocialServiceInternal.getManifestPrefname(origin);
+    if (Services.prefs.getDefaultBranch("social.manifest.").getPrefType(prefname) == Services.prefs.PREF_STRING)
+      return 'builtin';
+
+    let whitelist = Services.prefs.getCharPref("social.whitelist").split(',');
+    if (whitelist.indexOf(origin) >= 0)
+      return 'whitelist';
+
+    let directories = Services.prefs.getCharPref("social.directories").split(',');
+    if (directories.indexOf(origin) >= 0)
+      return 'directory';
+
+    return 'foreign';
+  },
+
   _providerListeners: new Map(),
   registerProviderListener: function registerProviderListener(listener) {
     this._providerListeners.set(listener, 1);
@@ -588,7 +585,7 @@ this.SocialService = {
     let sourceURI = aDOMDocument.location.href;
     let installOrigin = aDOMDocument.nodePrincipal.origin;
 
-    let installType = getOriginActivationType(installOrigin);
+    let installType = this.getOriginActivationType(installOrigin);
     let manifest;
     if (data) {
       // if we get data, we MUST have a valid manifest generated from the data
@@ -652,9 +649,8 @@ this.SocialService = {
  *
  * @constructor
  * @param {jsobj} object representing the manifest file describing this provider
- * @param {bool} boolean indicating whether this provider is "built in"
  */
-function SocialProvider(input, blessed = false) {
+function SocialProvider(input) {
   if (!input.name)
     throw new Error("SocialProvider must be passed a name");
   if (!input.origin)
@@ -678,7 +674,6 @@ function SocialProvider(input, blessed = false) {
   this.ambientNotificationIcons = {};
   this.errorState = null;
   this.frecency = 0;
-  this.blessed = blessed;
   try {
     this.domain = etld.getBaseDomainFromHost(originUri.host);
   } catch(e) {
@@ -874,12 +869,8 @@ SocialProvider.prototype = {
   getWorkerPort: function getWorkerPort(window) {
     if (!this.workerURL || !this.enabled)
       return null;
-    // Only allow localStorage in the frameworker for blessed providers
-    let allowLocalStorage = this.blessed;
-    let handle = getFrameWorkerHandle(this.workerURL, window,
-                                      "SocialProvider:" + this.origin, this.origin,
-                                      allowLocalStorage);
-    return handle.port;
+    return getFrameWorkerHandle(this.workerURL, window,
+                                "SocialProvider:" + this.origin, this.origin).port;
   },
 
   /**
diff --git a/toolkit/components/social/test/browser/browser_frameworker.js b/toolkit/components/social/test/browser/browser_frameworker.js
index 361527fb3dde..0f2c18404e84 100644
--- a/toolkit/components/social/test/browser/browser_frameworker.js
+++ b/toolkit/components/social/test/browser/browser_frameworker.js
@@ -241,7 +241,7 @@ let tests = {
         port.postMessage({topic: "done", result: "ok"});
       }
     }
-    let worker = getFrameWorkerHandle(makeWorkerUrl(run), undefined, "testLocalStorage", null, true);
+    let worker = getFrameWorkerHandle(makeWorkerUrl(run), undefined, "testLocalStorage");
     worker.port.onmessage = function(e) {
       if (e.data.topic == "done") {
         is(e.data.result, "ok", "check the localStorage test worked");
@@ -251,30 +251,6 @@ let tests = {
     }
   },
 
-  testNoLocalStorage: function(cbnext) {
-    let run = function() {
-      onconnect = function(e) {
-        let port = e.ports[0];
-        try {
-          localStorage.setItem("foo", "1");
-        } catch(e) {
-          port.postMessage({topic: "done", result: "ok"});
-          return;
-        }
-
-        port.postMessage({topic: "done", result: "FAILED because localStorage was exposed" });
-      }
-    }
-    let worker = getFrameWorkerHandle(makeWorkerUrl(run), undefined, "testNoLocalStorage");
-    worker.port.onmessage = function(e) {
-      if (e.data.topic == "done") {
-        is(e.data.result, "ok", "check that retrieving localStorage fails by default");
-        worker.terminate();
-        cbnext();
-      }
-    }
-  },
-
   testBase64: function (cbnext) {
     let run = function() {
       onconnect = function(e) {

From 4cb93c7005ec8d77977655a222d7f407003c4a57 Mon Sep 17 00:00:00 2001
From: "L. David Baron" <dbaron@dbaron.org>
Date: Mon, 17 Jun 2013 14:26:08 -0700
Subject: [PATCH 33/75] Bug 757554:  Reject uses of reserved 'not', 'only',
 'and', and 'or' as a media type.  r=heycam

---
 .../en-US/chrome/layout/css.properties        |  1 +
 layout/style/nsCSSParser.cpp                  | 21 ++++++++----
 layout/style/test/test_media_queries.html     | 33 +++++++++++++++++++
 3 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/dom/locales/en-US/chrome/layout/css.properties b/dom/locales/en-US/chrome/layout/css.properties
index 463acdae6818..8a476f87d974 100644
--- a/dom/locales/en-US/chrome/layout/css.properties
+++ b/dom/locales/en-US/chrome/layout/css.properties
@@ -20,6 +20,7 @@ PECharsetRuleNotString=Expected charset string but found '%1$S'.
 PEGatherMediaEOF=end of media list in @import or @media rule
 PEGatherMediaNotComma=Expected ',' in media list but found '%1$S'.
 PEGatherMediaNotIdent=Expected identifier in media list but found '%1$S'.
+PEGatherMediaReservedMediaType=Found reserved keyword '%1$S' when looking for media type.
 PEImportNotURI=Expected URI in @import rule but found '%1$S'.
 PEImportBadURI=Invalid URI in @import rule: '%1$S'.
 PEImportUnexpected=Found unexpected '%1$S' within @import.
diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp
index 3ffd9375abf4..2c5c518a3182 100644
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@@ -1789,14 +1789,23 @@ CSSParserImpl::ParseMediaQuery(bool aInAtRule,
       if (!mediaType) {
         NS_RUNTIMEABORT("do_GetAtom failed - out of memory?");
       }
-      if (gotNotOrOnly ||
-          (mediaType != nsGkAtoms::_not && mediaType != nsGkAtoms::only))
-        break;
-      gotNotOrOnly = true;
-      if (mediaType == nsGkAtoms::_not)
+      if (!gotNotOrOnly && mediaType == nsGkAtoms::_not) {
+        gotNotOrOnly = true;
         query->SetNegated();
-      else
+      } else if (!gotNotOrOnly && mediaType == nsGkAtoms::only) {
+        gotNotOrOnly = true;
         query->SetHasOnly();
+      } else if (mediaType == nsGkAtoms::_not ||
+                 mediaType == nsGkAtoms::only ||
+                 mediaType == nsGkAtoms::_and ||
+                 mediaType == nsGkAtoms::_or) {
+        REPORT_UNEXPECTED_TOKEN(PEGatherMediaReservedMediaType);
+        UngetToken();
+        return false;
+      } else {
+        // valid media type
+        break;
+      }
     }
     query->SetType(mediaType);
   }
diff --git a/layout/style/test/test_media_queries.html b/layout/style/test/test_media_queries.html
index 6fd0172e1c8f..d49e3e5a4a48 100644
--- a/layout/style/test/test_media_queries.html
+++ b/layout/style/test/test_media_queries.html
@@ -171,6 +171,39 @@ function run() {
   query_should_be_parseable("not all and (-moz-device-orientation)");
   query_should_be_parseable("only all and (-moz-device-orientation)");
 
+  // Test that the 'not', 'only', 'and', and 'or' keywords are not
+  // allowed as media types.
+  query_should_not_be_parseable("not");
+  query_should_not_be_parseable("and");
+  query_should_not_be_parseable("or");
+  query_should_not_be_parseable("only");
+  query_should_be_parseable("unknowntype");
+  query_should_not_be_parseable("not not");
+  query_should_not_be_parseable("not and");
+  query_should_not_be_parseable("not or");
+  query_should_not_be_parseable("not only");
+  query_should_be_parseable("not unknowntype");
+  query_should_not_be_parseable("only not");
+  query_should_not_be_parseable("only and");
+  query_should_not_be_parseable("only or");
+  query_should_not_be_parseable("only only");
+  query_should_be_parseable("only unknowntype");
+  query_should_not_be_parseable("not and (width)");
+  query_should_not_be_parseable("and and (width)");
+  query_should_not_be_parseable("or and (width)");
+  query_should_not_be_parseable("only and (width)");
+  query_should_be_parseable("unknowntype and (width)");
+  query_should_not_be_parseable("not not and (width)");
+  query_should_not_be_parseable("not and and (width)");
+  query_should_not_be_parseable("not or and (width)");
+  query_should_not_be_parseable("not only and (width)");
+  query_should_be_parseable("not unknowntype and (width)");
+  query_should_not_be_parseable("only not and (width)");
+  query_should_not_be_parseable("only and and (width)");
+  query_should_not_be_parseable("only or and (width)");
+  query_should_not_be_parseable("only only and (width)");
+  query_should_be_parseable("only unknowntype and (width)");
+
   var features = [ "width", "height", "device-width", "device-height" ];
   var feature;
   var i;

From 815faf1b41bb4d08a1b300bc591c1a4ef2633a08 Mon Sep 17 00:00:00 2001
From: David Zbarsky <dzbarsky@gmail.com>
Date: Mon, 17 Jun 2013 14:28:11 -0700
Subject: [PATCH 34/75] Fix a typo, no bug

---
 js/jsd/jsd_lock.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/jsd/jsd_lock.cpp b/js/jsd/jsd_lock.cpp
index 628d2fd621e7..6a0a6ea91558 100644
--- a/js/jsd/jsd_lock.cpp
+++ b/js/jsd/jsd_lock.cpp
@@ -9,7 +9,7 @@
  */
 
 /*                                                                           
-* ifdef JSD_USE_NSPR_LOCKS then you musat build and run against NSPR2.       
+* ifdef JSD_USE_NSPR_LOCKS then you must build and run against NSPR2.       
 * Otherwise, there are stubs that can be filled in with your own locking     
 * code. Also, note that these stubs include a jsd_CurrentThread()            
 * implementation that only works on Win32 - this is needed for the inprocess 

From e86571ca22b173511903aa4c105af975ed3060e9 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Mon, 17 Jun 2013 23:30:37 +0200
Subject: [PATCH 35/75] Bug 883490: Add annotation to testfile it returns a
 type error, r=philor

---
 js/src/jit-test/tests/ion/bug883490.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/js/src/jit-test/tests/ion/bug883490.js b/js/src/jit-test/tests/ion/bug883490.js
index f06d8c98724c..2fb27fda52c8 100644
--- a/js/src/jit-test/tests/ion/bug883490.js
+++ b/js/src/jit-test/tests/ion/bug883490.js
@@ -1,3 +1,4 @@
+//|jit-test| error: TypeError
 function coerceForeign(stdlib, foreign)
 {
     "use asm";

From a4c9c172caae54bf64525a1deac61d1da312bc59 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 17 Jun 2013 18:24:04 -0400
Subject: [PATCH 36/75] Fix test fallout from bug 883358 so we can stop having
 a CLOSED TREE.  No review.

---
 dom/bindings/BindingUtils.cpp                  |  8 ++++----
 dom/bindings/test/test_exception_messages.html | 16 +++++++++++++---
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index 260d8f44fff4..d6e5db56676d 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -829,8 +829,8 @@ XrayResolveAttribute(JSContext* cx, JS::Handle<JSObject*> wrapper,
           // They all have getters, so we can just make it.
           JS::Rooted<JSObject*> global(cx, JS_GetGlobalForObject(cx, wrapper));
           JS::Rooted<JSFunction*> fun(cx,
-                                      JS_NewFunction(cx, (JSNative)attrSpec.getter.op,
-                                                     0, 0, global, nullptr));
+                                      JS_NewFunctionById(cx, (JSNative)attrSpec.getter.op,
+                                                         0, 0, global, id));
           if (!fun)
             return false;
           SET_JITINFO(fun, attrSpec.getter.info);
@@ -839,8 +839,8 @@ XrayResolveAttribute(JSContext* cx, JS::Handle<JSObject*> wrapper,
           desc->attrs |= JSPROP_GETTER;
           if (attrSpec.setter.op) {
             // We have a setter! Make it.
-            fun = JS_NewFunction(cx, (JSNative)attrSpec.setter.op, 1, 0,
-                                 global, nullptr);
+            fun = JS_NewFunctionById(cx, (JSNative)attrSpec.setter.op, 1, 0,
+                                     global, id);
             if (!fun)
               return false;
             SET_JITINFO(fun, attrSpec.setter.info);
diff --git a/dom/bindings/test/test_exception_messages.html b/dom/bindings/test/test_exception_messages.html
index fd1bd949c812..0e80fc063dac 100644
--- a/dom/bindings/test/test_exception_messages.html
+++ b/dom/bindings/test/test_exception_messages.html
@@ -47,9 +47,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=882653
       [ '(new TextEncoder).encode("", new RegExp())',
 	"Argument 2 of TextEncoder.encode can't be converted to a dictionary.",
 	"regexp passed for a dictionary" ],
-      [ 'document.createElement("canvas").getContext("webgl").uniform1fv(null, new RegExp())',
-	"Argument 2 is not valid for any of the 2-argument overloads of WebGLRenderingContext.uniform1fv.",
-	"regexp passed for a sequence" ],
       [ 'document.createElement("select").add({})',
 	"Argument 1 of HTMLSelectElement.add could not be converted to any of: HTMLOptionElement, HTMLOptGroupElement.",
 	"invalid value passed for union" ],
@@ -58,6 +55,19 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=882653
 	"invalid float" ]
   ];
 
+  try {
+    document.createElement("canvas").getContext("webgl");
+    // If that didn't throw, our WebGL-using test should be safe
+    tests.push(
+        [ 'document.createElement("canvas").getContext("webgl").uniform1fv(null, new RegExp())',
+	"Argument 2 is not valid for any of the 2-argument overloads of WebGLRenderingContext.uniform1fv.",
+	"regexp passed for a sequence" ]
+    );
+  } catch (e) {
+    // No WebGL in some cases, apparently
+    todo(false, "No WebGL here?");
+  }
+
   for (var i = 0; i < tests.length; ++i) {
       msg = "Correct exception should be thrown for " + tests[i][2];
       try {

From 7fbacac80243c812bb6de7206ff181774d1f4a9c Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Mon, 17 Jun 2013 19:18:37 -0400
Subject: [PATCH 37/75] Backed out changeset ec7bccd33fc0 (bug 846340) for
 frequent failures. CLOSED TREE

---
 .../base/tests/testClearPrivateData.java.in   | 41 ++-----------------
 1 file changed, 4 insertions(+), 37 deletions(-)

diff --git a/mobile/android/base/tests/testClearPrivateData.java.in b/mobile/android/base/tests/testClearPrivateData.java.in
index 4d3e2b4b9179..eaec399b8221 100644
--- a/mobile/android/base/tests/testClearPrivateData.java.in
+++ b/mobile/android/base/tests/testClearPrivateData.java.in
@@ -4,7 +4,7 @@ package @ANDROID_PACKAGE_NAME@.tests;
 import @ANDROID_PACKAGE_NAME@.*;
 import android.widget.ListView;
 
-public class testClearPrivateData extends PixelTest {
+public class testClearPrivateData extends PixelTest  {
 
     @Override
     protected int getTestType() {
@@ -14,11 +14,10 @@ public class testClearPrivateData extends PixelTest {
     public void testClearPrivateData() {
         blockForGeckoReady();
         clearHistory();
-        clearSiteSettings();
     }
 
     private void clearHistory() {
-        // Loading a page so we are sure that there is at leats one history entry
+        // Loading a page so we are sure that there is at least one history entry
         String url = getAbsoluteUrl("/robocop/robocop_blank_01.html");
         loadAndPaint(url);
 
@@ -32,45 +31,13 @@ public class testClearPrivateData extends PixelTest {
 
         // Clearing private data
         selectSettingsItem("Privacy & Security", "Clear private data");
-        Actions.EventExpecter ClearDataEventExpecter = mActions.expectGeckoEvent("Sanitize:Finished");
         mAsserter.ok(mSolo.searchButton("Clear data"),"checking clear button","clear button exists");
         mSolo.clickOnButton("Clear data");
-        ClearDataEventExpecter.blockForEvent();
-        mActions.sendSpecialKey(Actions.SpecialKey.BACK);
+        // TODO: extra long wait here for bug 837274
+        mAsserter.is(mSolo.waitForText("Private data cleared", 0, 60000),true,"private data cleared successfully");
 
         // Checking that history list is empty
         hList = getHistoryList("History", 0);
         mAsserter.ok(hList != null,"checking history is cleared ","history is cleared");
     }
-
-    public void clearSiteSettings() {
-        String url = getAbsoluteUrl("/robocop/robocop_geolocation.html");
-        // Loading geolocation page
-        loadAndPaint(url);
-        mSolo.waitForText("Share your location");
-        mAsserter.is(mSolo.searchText("Share your location"), true, "Geolocation doorhanger has been displayed");
-
-        // Pressing "Share" button
-        mSolo.clickOnButton("Share");
-        mAsserter.is(mSolo.searchText("Share your location"), false, "Geolocation doorhanger has been hidden");
-
-        // Re-loading geolocation page
-        loadAndPaint(url);
-        mSolo.waitForText("Share your location");
-        mAsserter.is(mSolo.searchText("Share your location"), false, "Geolocation doorhanger has been displayed");
-
-        // Clearing private data
-        selectSettingsItem("Privacy & Security", "Clear private data");
-        Actions.EventExpecter ClearDataEventExpecter = mActions.expectGeckoEvent("Sanitize:Finished");
-        mAsserter.ok(mSolo.searchButton("Clear data"),"checking clear button","clear button exists");
-        mSolo.clickOnButton("Clear data");
-        ClearDataEventExpecter.blockForEvent();
-        mActions.sendSpecialKey(Actions.SpecialKey.BACK);
-
-        // Re-trigger geolocation notification in new tab
-        addTab(url); // Using addTab(url) because loadAndPaint(url) seems to fail at this step
-        mSolo.waitForText("Share your location");
-        mAsserter.is(mSolo.searchText("Share your location"), true, "Geolocation doorhanger has been displayed");
-        mActions.sendSpecialKey(Actions.SpecialKey.BACK);
-    }
 }

From 71c98537124df315d066b7c60613051b223b323d Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Mon, 17 Jun 2013 19:51:12 -0400
Subject: [PATCH 38/75] Backed out 3 changesets (bug 883358) for Android
 mochitest-3 failures on a CLOSED TREE.

Backed out changeset 84b35dd1879d (bug 883358)
Backed out changeset b5e6522257cb (bug 883358)
Backed out changeset 757a3f2e5de6 (bug 883358)
---
 dom/bindings/BindingUtils.cpp                 | 45 ++++++---
 dom/bindings/BindingUtils.h                   |  9 +-
 dom/bindings/Codegen.py                       |  6 +-
 dom/bindings/Errors.msg                       |  6 +-
 dom/bindings/test/Makefile.in                 |  1 -
 .../test/test_exception_messages.html         | 92 -------------------
 js/src/jsapi.cpp                              | 10 +-
 7 files changed, 47 insertions(+), 122 deletions(-)
 delete mode 100644 dom/bindings/test/test_exception_messages.html

diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index d6e5db56676d..d2b16cf403e6 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -60,26 +60,47 @@ ThrowErrorMessage(JSContext* aCx, const ErrNum aErrorNumber, ...)
 }
 
 bool
-ThrowInvalidThis(JSContext* aCx, const JS::CallArgs& aArgs,
-                 const ErrNum aErrorNumber,
-                 const char* aInterfaceName)
+ThrowInvalidMethodThis(JSContext* aCx, const JS::CallArgs& aArgs,
+                       const char* aInterfaceName)
 {
   NS_ConvertASCIItoUTF16 ifaceName(aInterfaceName);
-  // This should only be called for DOM methods/getters/setters, which
-  // are JSNative-backed functions, so we can assume that
-  // JS_ValueToFunction and JS_GetFunctionDisplayId will both return
-  // non-null and that JS_GetStringCharsZ returns non-null.
+  // This should only be called for DOM methods, which are JSNative-backed
+  // functions, so we can assume that JS_ValueToFunction and
+  // JS_GetFunctionDisplayId will both return non-null and that
+  // JS_GetStringCharsZ returns non-null.
   JS::Rooted<JSFunction*> func(aCx, JS_ValueToFunction(aCx, aArgs.calleev()));
   MOZ_ASSERT(func);
   JS::Rooted<JSString*> funcName(aCx, JS_GetFunctionDisplayId(func));
   MOZ_ASSERT(funcName);
   JS_ReportErrorNumberUC(aCx, GetErrorMessage, nullptr,
-                         static_cast<const unsigned>(aErrorNumber),
+                         static_cast<const unsigned>(MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE),
                          JS_GetStringCharsZ(aCx, funcName),
                          ifaceName.get());
   return false;
 }
 
+bool
+ThrowInvalidGetterThis(JSContext* aCx, const char* aInterfaceName)
+{
+  // Sadly for getters we have no way to get the name of the property.
+  NS_ConvertASCIItoUTF16 ifaceName(aInterfaceName);
+  JS_ReportErrorNumberUC(aCx, GetErrorMessage, nullptr,
+                         static_cast<const unsigned>(MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE),
+                         ifaceName.get());
+  return false;
+}
+
+bool
+ThrowInvalidSetterThis(JSContext* aCx, const char* aInterfaceName)
+{
+  // Sadly for setters we have no way to get the name of the property.
+  NS_ConvertASCIItoUTF16 ifaceName(aInterfaceName);
+  JS_ReportErrorNumberUC(aCx, GetErrorMessage, nullptr,
+                         static_cast<const unsigned>(MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE),
+                         ifaceName.get());
+  return false;
+}
+
 } // namespace dom
 
 struct ErrorResult::Message {
@@ -829,8 +850,8 @@ XrayResolveAttribute(JSContext* cx, JS::Handle<JSObject*> wrapper,
           // They all have getters, so we can just make it.
           JS::Rooted<JSObject*> global(cx, JS_GetGlobalForObject(cx, wrapper));
           JS::Rooted<JSFunction*> fun(cx,
-                                      JS_NewFunctionById(cx, (JSNative)attrSpec.getter.op,
-                                                         0, 0, global, id));
+                                      JS_NewFunction(cx, (JSNative)attrSpec.getter.op,
+                                                     0, 0, global, nullptr));
           if (!fun)
             return false;
           SET_JITINFO(fun, attrSpec.getter.info);
@@ -839,8 +860,8 @@ XrayResolveAttribute(JSContext* cx, JS::Handle<JSObject*> wrapper,
           desc->attrs |= JSPROP_GETTER;
           if (attrSpec.setter.op) {
             // We have a setter! Make it.
-            fun = JS_NewFunctionById(cx, (JSNative)attrSpec.setter.op, 1, 0,
-                                     global, id);
+            fun = JS_NewFunction(cx, (JSNative)attrSpec.setter.op, 1, 0,
+                                 global, nullptr);
             if (!fun)
               return false;
             SET_JITINFO(fun, attrSpec.setter.info);
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index 558fd89421a6..0042c1e97c7d 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -60,9 +60,12 @@ UnwrapArg(JSContext* cx, jsval v, Interface** ppArg,
 bool
 ThrowErrorMessage(JSContext* aCx, const ErrNum aErrorNumber, ...);
 bool
-ThrowInvalidThis(JSContext* aCx, const JS::CallArgs& aArgs,
-                 const ErrNum aErrorNumber,
-                 const char* aInterfaceName);
+ThrowInvalidMethodThis(JSContext* aCx, const JS::CallArgs& aArgs,
+                       const char* aInterfaceName);
+bool
+ThrowInvalidGetterThis(JSContext* aCx, const char* aInterfaceName);
+bool
+ThrowInvalidSetterThis(JSContext* aCx, const char* aInterfaceName);
 
 template<bool mainThread>
 inline bool
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index f0e25fd11346..c144b0bf6852 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -5185,7 +5185,7 @@ class CGGenericMethod(CGAbstractBindingMethod):
         args = [Argument('JSContext*', 'cx'), Argument('unsigned', 'argc'),
                 Argument('JS::Value*', 'vp')]
         unwrapFailureCode = (
-            'return ThrowInvalidThis(cx, args, MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE, \"%s\");' %
+            'return ThrowInvalidMethodThis(cx, args, \"%s\");' %
             descriptor.interface.identifier.name)
         CGAbstractBindingMethod.__init__(self, descriptor, 'genericMethod',
                                          args,
@@ -5322,7 +5322,7 @@ class CGGenericGetter(CGAbstractBindingMethod):
         else:
             name = "genericGetter"
             unwrapFailureCode = (
-                'return ThrowInvalidThis(cx, args, MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, "%s");' %
+                'return ThrowInvalidGetterThis(cx, "%s");' %
                 descriptor.interface.identifier.name)
         CGAbstractBindingMethod.__init__(self, descriptor, name, args,
                                          unwrapFailureCode)
@@ -5402,7 +5402,7 @@ class CGGenericSetter(CGAbstractBindingMethod):
         else:
             name = "genericSetter"
             unwrapFailureCode = (
-                'return ThrowInvalidThis(cx, args, MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, "%s");' %
+                'return ThrowInvalidSetterThis(cx, "%s");' %
                 descriptor.interface.identifier.name)
 
         CGAbstractBindingMethod.__init__(self, descriptor, name, args,
diff --git a/dom/bindings/Errors.msg b/dom/bindings/Errors.msg
index 68fb8762d767..a705918f4f7e 100644
--- a/dom/bindings/Errors.msg
+++ b/dom/bindings/Errors.msg
@@ -24,9 +24,9 @@ MSG_DEF(MSG_MISSING_ARGUMENTS, 1, "Not enough arguments to {0}.")
 MSG_DEF(MSG_NOT_OBJECT, 1, "{0} is not an object.")
 MSG_DEF(MSG_NOT_CALLABLE, 1, "{0} is not callable.")
 MSG_DEF(MSG_DOES_NOT_IMPLEMENT_INTERFACE, 2, "{0} does not implement interface {1}.")
-MSG_DEF(MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "'{0}' called on an object that does not implement interface {1}.")
-MSG_DEF(MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "'{0}' getter called on an object that does not implement interface {1}.")
-MSG_DEF(MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "'{0}' setter called on an object that does not implement interface {1}.")
+MSG_DEF(MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "{0} called on an object that does not implement interface {1}.")
+MSG_DEF(MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 1, "getter called on an object that does not implement interface {0}.")
+MSG_DEF(MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 1, "setter called on an object that does not implement interface {0}.")
 MSG_DEF(MSG_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 1, "\"this\" object does not implement interface {0}.")
 MSG_DEF(MSG_NOT_IN_UNION, 2, "{0} could not be converted to any of: {1}.")
 MSG_DEF(MSG_ILLEGAL_CONSTRUCTOR, 0, "Illegal constructor.")
diff --git a/dom/bindings/test/Makefile.in b/dom/bindings/test/Makefile.in
index 2aacb59de809..d28a87683401 100644
--- a/dom/bindings/test/Makefile.in
+++ b/dom/bindings/test/Makefile.in
@@ -75,7 +75,6 @@ MOCHITEST_FILES := \
   test_bug560072.html \
   test_lenientThis.html \
   test_ByteString.html \
-  test_exception_messages.html \
   $(NULL)
 
 MOCHITEST_CHROME_FILES = \
diff --git a/dom/bindings/test/test_exception_messages.html b/dom/bindings/test/test_exception_messages.html
deleted file mode 100644
index 0e80fc063dac..000000000000
--- a/dom/bindings/test/test_exception_messages.html
+++ /dev/null
@@ -1,92 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=882653
--->
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 882653</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-  <script type="application/javascript">
-
-  /** Test for Bug 882653 **/
-  // Each test is a string to eval, the expected exception message, and the
-  // test description.
-  var tests = [
-      [ 'document.documentElement.appendChild.call({}, new Image())',
-	"'appendChild' called on an object that does not implement interface Node.",
-	"bogus method this object" ],
-      [ 'Object.getOwnPropertyDescriptor(Document.prototype, "documentElement").get.call({})',
-	"'documentElement' getter called on an object that does not implement interface Document.",
-	"bogus getter this object" ],
-      [ 'Object.getOwnPropertyDescriptor(Element.prototype, "innerHTML").set.call({})',
-	"'innerHTML' setter called on an object that does not implement interface Element.",
-	"bogus setter this object" ],
-      [ 'document.documentElement.appendChild(5)',
-	"Argument 1 of Node.appendChild is not an object.",
-	"bogus interface argument" ],
-      [ 'document.documentElement.appendChild(null)',
-	"Argument 1 of Node.appendChild is not an object.",
-	"null interface argument" ],
-      [ 'document.createTreeWalker(document).currentNode = 5',
-	"Value being assigned to TreeWalker.currentNode is not an object.",
-	"interface setter call" ],
-      [ 'document.documentElement.appendChild({})',
-	"Argument 1 of Node.appendChild does not implement interface Node.",
-	"wrong interface argument" ],
-      [ 'document.createTreeWalker(document).currentNode = {}',
-	"Value being assigned to TreeWalker.currentNode does not implement interface Node.",
-	"wrong interface setter call" ],
-      [ 'document.createElement("canvas").getContext("2d").fill("bogus")',
-	"Argument 1 of CanvasRenderingContext2D.fill 'bogus' is not a valid value for enumeration CanvasWindingRule.",
-	"bogus enum value" ],
-      [ 'document.createTreeWalker(document, 0xFFFFFFFF, { acceptNode: 5 }).nextNode()',
-	"Property 'acceptNode' is not callable.",
-	"non-callable callback interface operation property" ],
-      [ '(new TextEncoder).encode("", new RegExp())',
-	"Argument 2 of TextEncoder.encode can't be converted to a dictionary.",
-	"regexp passed for a dictionary" ],
-      [ 'document.createElement("select").add({})',
-	"Argument 1 of HTMLSelectElement.add could not be converted to any of: HTMLOptionElement, HTMLOptGroupElement.",
-	"invalid value passed for union" ],
-      [ 'document.createElement("canvas").getContext("2d").createLinearGradient(0, 1, 0, 1).addColorStop(NaN, "")',
-	"Argument 1 of CanvasGradient.addColorStop is not a finite floating-point value.",
-	"invalid float" ]
-  ];
-
-  try {
-    document.createElement("canvas").getContext("webgl");
-    // If that didn't throw, our WebGL-using test should be safe
-    tests.push(
-        [ 'document.createElement("canvas").getContext("webgl").uniform1fv(null, new RegExp())',
-	"Argument 2 is not valid for any of the 2-argument overloads of WebGLRenderingContext.uniform1fv.",
-	"regexp passed for a sequence" ]
-    );
-  } catch (e) {
-    // No WebGL in some cases, apparently
-    todo(false, "No WebGL here?");
-  }
-
-  for (var i = 0; i < tests.length; ++i) {
-      msg = "Correct exception should be thrown for " + tests[i][2];
-      try {
-	  eval(tests[i][0]);
-	  ok(false, msg);
-      } catch (e) {
-	  is(e.message, tests[i][1], msg);
-      }
-  }
-
-  </script>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=882653">Mozilla Bug 882653</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-
-</div>
-<pre id="test">
-</pre>
-</body>
-</html>
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index a5fd8d579410..ceacf8e29e24 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3853,15 +3853,10 @@ DefinePropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue val
      */
     if (attrs & JSPROP_NATIVE_ACCESSORS) {
         JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
-        JSFunction::Flags zeroFlags = JSAPIToJSFunctionFlags(0);
-        // We can't just use JS_NewFunctionById here because it
-        // assumes a string id.
-        RootedAtom atom(cx, JSID_IS_ATOM(id) ? JSID_TO_ATOM(id) : nullptr);
         attrs &= ~JSPROP_NATIVE_ACCESSORS;
         if (getter) {
             RootedObject global(cx, (JSObject*) &obj->global());
-            JSFunction *getobj = NewFunction(cx, NullPtr(), (Native) getter, 0,
-                                             zeroFlags, global, atom);
+            JSFunction *getobj = JS_NewFunction(cx, (Native) getter, 0, 0, global, NULL);
             if (!getobj)
                 return false;
 
@@ -3875,8 +3870,7 @@ DefinePropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue val
             // Root just the getter, since the setter is not yet a JSObject.
             AutoRooterGetterSetter getRoot(cx, JSPROP_GETTER, &getter, NULL);
             RootedObject global(cx, (JSObject*) &obj->global());
-            JSFunction *setobj = NewFunction(cx, NullPtr(), (Native) setter, 1,
-                                             zeroFlags, global, atom);
+            JSFunction *setobj = JS_NewFunction(cx, (Native) setter, 1, 0, global, NULL);
             if (!setobj)
                 return false;
 

From 024645e262a36dd400e81a62537c7c3112710b55 Mon Sep 17 00:00:00 2001
From: Tim Abraldes <tabraldes@mozilla.com>
Date: Mon, 17 Jun 2013 14:56:23 -0700
Subject: [PATCH 39/75] bug 837293. Don't send keyPress events for characters
 that were pressed at the same time as the altGr button. When our
 CharacterReceived handler fires, don't send modifier key information if it
 includes the altGr button. r=bbondy

---
 widget/windows/winrt/MetroInput.cpp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/widget/windows/winrt/MetroInput.cpp b/widget/windows/winrt/MetroInput.cpp
index da0087dd3336..d1e159143ec7 100644
--- a/widget/windows/winrt/MetroInput.cpp
+++ b/widget/windows/winrt/MetroInput.cpp
@@ -576,6 +576,11 @@ MetroInput::OnCharacterReceived(uint32_t aCharCode,
 
   nsKeyEvent keyEvent(true, NS_KEY_PRESS, mWidget.Get());
   mModifierKeyState.Update();
+  if (mModifierKeyState.IsAltGr()) {
+    mModifierKeyState.Unset(MODIFIER_CONTROL
+                          | MODIFIER_ALT
+                          | MODIFIER_ALTGRAPH);
+  }
   mModifierKeyState.InitInputEvent(keyEvent);
   keyEvent.time = ::GetMessageTime();
   keyEvent.isChar = true;
@@ -662,7 +667,8 @@ MetroInput::OnKeyDown(uint32_t aVKey,
   keyEvent.charCode = MapVirtualKey(aVKey, MAPVK_VK_TO_CHAR);
   keyEvent.isChar = !IsControlCharacter(keyEvent.charCode);
   if (!keyEvent.isChar
-   || mModifierKeyState.IsControl()) {
+   || (mModifierKeyState.IsControl()
+    && !mModifierKeyState.IsAltGr())) {
     // We don't want to send another message to our plugin,
     // so reset keyEvent.pluginEvent
     keyEvent.pluginEvent = nullptr;

From 880674cc92d8bc76f6dda26ff5553915441394eb Mon Sep 17 00:00:00 2001
From: Tim Abraldes <tabraldes@mozilla.com>
Date: Mon, 17 Jun 2013 14:56:23 -0700
Subject: [PATCH 40/75] bug 879382. Remove support for windowless plugin input
 from metro widget. r=jimm

---
 .../metro/base/tests/mochitest/Makefile.in    |   5 -
 .../tests/mochitest/browser_plugin_input.html |   8 -
 .../browser_plugin_input_keyboard.js          |  55 -----
 .../mochitest/browser_plugin_input_mouse.js   |  71 ------
 widget/windows/winrt/MetroInput.cpp           | 215 +-----------------
 widget/windows/winrt/MetroInput.h             |  11 +-
 6 files changed, 9 insertions(+), 356 deletions(-)
 delete mode 100644 browser/metro/base/tests/mochitest/browser_plugin_input.html
 delete mode 100644 browser/metro/base/tests/mochitest/browser_plugin_input_keyboard.js
 delete mode 100644 browser/metro/base/tests/mochitest/browser_plugin_input_mouse.js

diff --git a/browser/metro/base/tests/mochitest/Makefile.in b/browser/metro/base/tests/mochitest/Makefile.in
index 8402efea5888..528177974839 100644
--- a/browser/metro/base/tests/mochitest/Makefile.in
+++ b/browser/metro/base/tests/mochitest/Makefile.in
@@ -34,11 +34,6 @@ BROWSER_TESTS = \
   browser_form_auto_complete.html \
   $(NULL)
 
-# disabled due to timeouts and lack of plugin support.
-#  browser_plugin_input.html \
-#  browser_plugin_input_mouse.js \
-#  browser_plugin_input_keyboard.js \
-
 ifndef MOZ_DEBUG
 BROWSER_TESTS += \
   browser_selection_basic.js \
diff --git a/browser/metro/base/tests/mochitest/browser_plugin_input.html b/browser/metro/base/tests/mochitest/browser_plugin_input.html
deleted file mode 100644
index 80b5cd109179..000000000000
--- a/browser/metro/base/tests/mochitest/browser_plugin_input.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<html>
-<head>
-  <title>Test Plugin Input</title>
-</head>
-<body>
-  <embed id="plugin1" type="application/x-test" width="200" height="200"></embed>
-</body>
-</html>
diff --git a/browser/metro/base/tests/mochitest/browser_plugin_input_keyboard.js b/browser/metro/base/tests/mochitest/browser_plugin_input_keyboard.js
deleted file mode 100644
index 1b592ec91085..000000000000
--- a/browser/metro/base/tests/mochitest/browser_plugin_input_keyboard.js
+++ /dev/null
@@ -1,55 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-function test() {
-  runTests();
-}
-
-gTests.push({
-  desc: "Plugin keyboard input",
-  run: function() {
-    Services.prefs.setBoolPref("plugin.disable", false);
-    Services.prefs.setBoolPref("plugins.click_to_play", false);
-    registerCleanupFunction(Services.prefs.clearUserPref.bind(null, "plugin.disable"));
-    registerCleanupFunction(Services.prefs.clearUserPref.bind(null, "plugins.click_to_play"));
-
-    let tab = yield addTab(chromeRoot + "browser_plugin_input.html");
-
-    yield hideContextUI();
-
-    let doc = tab.browser.contentDocument;
-    let plugin = doc.getElementById("plugin1");
-    let objLoadingContent = plugin.QueryInterface(Ci.nsIObjectLoadingContent);
-    ok(objLoadingContent.activated, "Plugin activated");
-    plugin.focus();
-
-    try {
-      is(plugin.getLastKeyText(), "", "Plugin should not have received "
-                                    + "any character events yet.");
-    } catch(e) {
-      ok(false, "plugin.getLastKeyText should not throw: " + e);
-    }
-
-    let keys = [{ kbLayout: arSpanish,
-                  keyCode: 65,
-                  modifiers: 0,
-                  expectedChar: 'a' }];
-
-    /* XXX: Re-enable this once bug 837293 is fixed
-                { kbLayout: arSpanish,
-                  keyCode: 65,
-                  modifiers: rightAlt,
-                  expectedChar: "á" }];
-    */
-
-    while (keys.length > 0) {
-      let key = keys.shift();
-      info("Sending keypress: " + key.expectedChar);
-      synthesizeNativeKey(key.kbLayout, key.keyCode, key.modifiers);
-      let success = yield waitForCondition(function() plugin.getLastKeyText() == key.expectedChar);
-      ok(success && !(success instanceof Error),
-         "Plugin received char: " + key.expectedChar);
-    }
-  }
-});
diff --git a/browser/metro/base/tests/mochitest/browser_plugin_input_mouse.js b/browser/metro/base/tests/mochitest/browser_plugin_input_mouse.js
deleted file mode 100644
index b97ff15834af..000000000000
--- a/browser/metro/base/tests/mochitest/browser_plugin_input_mouse.js
+++ /dev/null
@@ -1,71 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-function test() {
-  runTests();
-}
-
-gTests.push({
-  desc: "Plugin mouse input",
-  run: function() {
-    // This test needs "Switch primary and secondary buttons" disabled.
-    let origValue = MetroUtils.swapMouseButton(false);
-    registerCleanupFunction(function() MetroUtils.swapMouseButton(origValue));
-
-    Services.prefs.setBoolPref("plugin.disable", false);
-    Services.prefs.setBoolPref("plugins.click_to_play", false);
-    registerCleanupFunction(Services.prefs.clearUserPref.bind(null, "plugin.disable"));
-    registerCleanupFunction(Services.prefs.clearUserPref.bind(null, "plugins.click_to_play"));
-
-    let tab = yield addTab(chromeRoot + "browser_plugin_input.html");
-
-    yield hideContextUI();
-
-    let doc = tab.browser.contentDocument;
-    let plugin = doc.getElementById("plugin1");
-    let objLoadingContent = plugin.QueryInterface(Ci.nsIObjectLoadingContent);
-    ok(objLoadingContent.activated, "Plugin activated");
-
-    // XXX: This shouldn't be necessary, but removing it causes the first click to
-    //      sometimes not register
-    let wait = yield waitForMs(0);
-    ok(wait, "Initial wait");
-
-    try {
-      is(plugin.getMouseUpEventCount(), 0, "Plugin should not have received "
-                                         + "any mouse up events yet.");
-    } catch(e) {
-      ok(false, "plugin.getMouseUpEventCount should not throw: " + e);
-    }
-
-    let bottom = plugin.getBoundingClientRect().height - 1;
-    let right = plugin.getBoundingClientRect().width - 1;
-    let middleX = right / 2;
-    let middleY = bottom / 2;
-    let left = 1;
-    let top = 1;
-
-    let clicks = [{ x: left, y: top},          // left top corner
-                  { x: left, y: middleY},      // left middle
-                  { x: left, y: bottom},       // left bottom corner
-                  { x: middleX, y: bottom},    // bottom middle
-                  { x: right, y: bottom},      // right bottom corner
-                  { x: right, y: middleY},     // right middle
-                  { x: right, y: top},         // right top corner
-                  { x: middleX, y: top},       // top middle
-                  { x: middleX, y: middleY}];  // middle
-
-    let curClicks = 0;
-    while (clicks.length > 0) {
-      let click = clicks.shift();
-      curClicks++;
-      info("Sending click " + curClicks + " { x: " + click.x + ", y: " + click.y + "}");
-      synthesizeNativeMouseLDown(plugin, click.x, click.y);
-      synthesizeNativeMouseLUp(plugin, click.x, click.y);
-      let success = yield waitForCondition(function() plugin.getMouseUpEventCount() == curClicks);
-      ok(success && !(success instanceof Error),
-         "Plugin received click " + curClicks);
-    }
-  }
-});
diff --git a/widget/windows/winrt/MetroInput.cpp b/widget/windows/winrt/MetroInput.cpp
index d1e159143ec7..f590690e3f22 100644
--- a/widget/windows/winrt/MetroInput.cpp
+++ b/widget/windows/winrt/MetroInput.cpp
@@ -8,7 +8,6 @@
 // Moz headers (alphabetical)
 #include "MetroUtils.h" // Logging, POINT_CEIL_*, ActivateGenericInstance, etc
 #include "MetroWidget.h" // MetroInput::mWidget
-#include "npapi.h" // NPEvent
 #include "mozilla/dom/Touch.h"  // Touch
 #include "nsTArray.h" // Touch lists
 #include "nsIDOMSimpleGestureEvent.h" // Constants for gesture events
@@ -154,118 +153,6 @@ namespace {
     aData->mChanged = false;
     return PL_DHASH_NEXT;
   }
-
-  // In response to keyboard events, we create an `NPEvent` and point the
-  // `pluginEvent` member of our `nsInputEvent` to it.  We must set the
-  // `wParam` and `lParam` members of our `NPEvent` according to what
-  // Windows would have sent for this particular WM_* message.  See the
-  // following documentation for descriptions of what these values should
-  // be for the various keyboard events.
-  //
-  // This union is used when setting up the lParam for keyboard events.
-  union LParamForKeyEvents {
-    uintptr_t lParam;
-    struct {
-      // bits 0-15    Repeat count, always 1 for WM_KEYUP
-      uint16_t repeatCount;
-      // bits 16-23   Scan code
-      uint8_t scanCode;
-      // See LParamFlagsForKeyEvents
-      uint8_t flags;
-    } parts;
-  };
-  // The high-order byte of the lParam for keyboard events is a set of bit
-  // flags that specifies information about the key being pressed/released.
-  enum LParamFlagsForKeyEvents {
-    // bit 24       1 if the key is an extended key, 0 otherwise
-    isExtendedKey = 1,
-    // bits 25-28   Reserved; do not use
-    // bit 29       1 if ALT is held down while key was pressed
-    //              Always 0 for WM_KEYDOWN
-    //              Always 0 for WM_KEYUP
-    isMenuKeyDown = 1<<5,
-    // bit 30       Previous key state. 1 if key was down before this message.
-    //              Always 1 for WM_KEYUP
-    wasKeyDown = 1<<6,
-    // bit 31       1 if key is being released, 0 if key is being pressed.
-    //              Always 0 for WM_KEYDOWN
-    //              Always 1 for WM_KEYUP
-    isKeyReleased = 1<<7
-  };
-  // This helper function sets up the lParam for plugin events that we create
-  // in response to keyboard events.
-  void
-  InitPluginKeyEventLParamFromKeyStatus(
-                      uintptr_t& aLParam,
-                      UI::Core::CorePhysicalKeyStatus const& aKeyStatus) {
-    LParamForKeyEvents lParam;
-
-    lParam.parts.repeatCount = aKeyStatus.RepeatCount;
-    lParam.parts.scanCode = aKeyStatus.ScanCode;
-    if (aKeyStatus.IsExtendedKey) {
-      lParam.parts.flags |= LParamFlagsForKeyEvents::isExtendedKey;
-    }
-    if (aKeyStatus.IsMenuKeyDown) {
-      lParam.parts.flags |= LParamFlagsForKeyEvents::isMenuKeyDown;
-    }
-    if (aKeyStatus.WasKeyDown) {
-      lParam.parts.flags |= LParamFlagsForKeyEvents::wasKeyDown;
-    }
-    if (aKeyStatus.IsKeyReleased) {
-      lParam.parts.flags |= LParamFlagsForKeyEvents::isKeyReleased;
-    }
-
-    aLParam = lParam.lParam;
-  }
-
-  // In response to mouse events, we create an `NPEvent` and point the
-  // `pluginEvent` member of our `nsInputEvent` to it.  We must set the
-  // `wParam` and `lParam` members of our `NPEvent` according to what
-  // Windows would have sent for this particular WM_* message.  See the
-  // following documentation for descriptions of what these values should
-  // be for the various mouse events.
-  //
-  // This union is used when setting up the lParam for mouse events.
-  union LParamForMouseEvents {
-    uintptr_t lParam;
-    // lParam is the position at which the event occurred.
-    struct lParamDeconstruction {
-      // The low-order word is the x-coordinate
-      uint16_t x;
-      // The high-order word is the y-coordinate
-      uint16_t y;
-    } parts;
-  };
-  // This helper function sets up the wParam and lParam for plugin events
-  // that we create in response to mouse events.
-  void
-  InitPluginMouseEventParams(nsInputEvent const& aEvent,
-                             uintptr_t& aWParam,
-                             uintptr_t& aLParam) {
-    // wParam is a mask indicating whether certain virtual keys are down.
-    aWParam = 0;
-    if (IS_VK_DOWN(VK_LBUTTON)) {
-      aWParam |= MK_LBUTTON;
-    }
-    if (IS_VK_DOWN(VK_MBUTTON)) {
-      aWParam |= MK_MBUTTON;
-    }
-    if (IS_VK_DOWN(VK_RBUTTON)) {
-      aWParam |= MK_RBUTTON;
-    }
-    if (aEvent.IsControl()) {
-      aWParam |= MK_CONTROL;
-    }
-    if (aEvent.IsShift()) {
-      aWParam |= MK_SHIFT;
-    }
-
-    Foundation::Point logPoint = MetroUtils::PhysToLog(aEvent.refPoint);
-    LParamForMouseEvents lParam;
-    lParam.parts.x = static_cast<uint16_t>(NS_round(logPoint.X));
-    lParam.parts.y = static_cast<uint16_t>(NS_round(logPoint.Y));
-    aLParam = lParam.lParam;
-  }
 }
 
 namespace mozilla {
@@ -337,11 +224,9 @@ MetroInput::OnAcceleratorKeyActivated(UI::Core::ICoreDispatcher* sender,
                                       UI::Core::IAcceleratorKeyEventArgs* aArgs) {
   UI::Core::CoreAcceleratorKeyEventType type;
   System::VirtualKey vkey;
-  UI::Core::CorePhysicalKeyStatus keyStatus;
 
   aArgs->get_EventType(&type);
   aArgs->get_VirtualKey(&vkey);
-  aArgs->get_KeyStatus(&keyStatus);
 
 #ifdef DEBUG_INPUT
   LogFunction();
@@ -351,16 +236,16 @@ MetroInput::OnAcceleratorKeyActivated(UI::Core::ICoreDispatcher* sender,
   switch(type) {
     case UI::Core::CoreAcceleratorKeyEventType_KeyUp:
     case UI::Core::CoreAcceleratorKeyEventType_SystemKeyUp:
-      OnKeyUp(vkey, keyStatus);
+      OnKeyUp(vkey);
       break;
     case UI::Core::CoreAcceleratorKeyEventType_KeyDown:
     case UI::Core::CoreAcceleratorKeyEventType_SystemKeyDown:
-      OnKeyDown(vkey, keyStatus);
+      OnKeyDown(vkey);
       break;
     case UI::Core::CoreAcceleratorKeyEventType_Character:
     case UI::Core::CoreAcceleratorKeyEventType_SystemCharacter:
     case UI::Core::CoreAcceleratorKeyEventType_UnicodeCharacter:
-      OnCharacterReceived(vkey, keyStatus);
+      OnCharacterReceived(vkey);
       break;
   }
 
@@ -528,30 +413,6 @@ MetroInput::OnPointerWheelChanged(UI::Core::ICoreWindow* aSender,
     previousVertLeftOverDelta %= WHEEL_DELTA;
   }
 
-  NPEvent pluginEvent;
-  pluginEvent.event = horzEvent ? WM_MOUSEHWHEEL : WM_MOUSEWHEEL;
-
-  union {
-    uintptr_t wParam;
-    uint16_t parts[2];
-  } wParam;
-
-  // This sets lParam and the low-order word of wParam
-  InitPluginMouseEventParams(wheelEvent,
-                             wParam.wParam,
-                             pluginEvent.lParam);
-
-  // The high-order word of wParam is the number of detents the wheel has
-  // traveled. Positive values mean the wheel was rotated forward or to the
-  // right.  Negative values mean the wheel was rotated backward (toward the
-  // user) or to the left.
-  wParam.parts[1] = horzEvent
-                  ? wheelEvent.lineOrPageDeltaX
-                  : wheelEvent.lineOrPageDeltaY * -1;
-
-  pluginEvent.wParam = wParam.wParam;
-
-  wheelEvent.pluginEvent = static_cast<void*>(&pluginEvent);
   DispatchEventIgnoreStatus(&wheelEvent);
 
   WRL::ComPtr<UI::Input::IPointerPoint> point;
@@ -566,8 +427,7 @@ MetroInput::OnPointerWheelChanged(UI::Core::ICoreWindow* aSender,
 // app.  This function is responsible for sending an appropriate gecko
 // event in response to the character entered.
 void
-MetroInput::OnCharacterReceived(uint32_t aCharCode,
-                                UI::Core::CorePhysicalKeyStatus const& aKeyStatus)
+MetroInput::OnCharacterReceived(uint32_t aCharCode)
 {
   // We only send NS_KEY_PRESS events for printable characters
   if (IsControlCharacter(aCharCode)) {
@@ -587,35 +447,13 @@ MetroInput::OnCharacterReceived(uint32_t aCharCode,
   keyEvent.charCode = aCharCode;
   keyEvent.mKeyNameIndex = KEY_NAME_INDEX_PrintableKey;
 
-  NPEvent pluginEvent;
-  pluginEvent.event = WM_CHAR;
-  InitPluginKeyEventLParamFromKeyStatus(pluginEvent.lParam,
-                                        aKeyStatus);
-  // The wParam of WM_CHAR messages is a single utf-16 character.
-  // If charCode cannot be represented in a single utf-16 character,
-  // then we must send two WM_CHAR messages; one with a high surrogate
-  // and one with a low surrogate.
-  if (IS_IN_BMP(aCharCode)) {
-    pluginEvent.wParam = aCharCode;
-  } else {
-    pluginEvent.wParam = H_SURROGATE(aCharCode);
-    nsPluginEvent surrogateEvent(true, NS_PLUGIN_INPUT_EVENT, mWidget.Get());
-    surrogateEvent.time = ::GetMessageTime();
-    surrogateEvent.pluginEvent = static_cast<void*>(&pluginEvent);
-    DispatchEventIgnoreStatus(&surrogateEvent);
-    pluginEvent.wParam = L_SURROGATE(aCharCode);
-  }
-
-  keyEvent.pluginEvent = static_cast<void*>(&pluginEvent);
-
   DispatchEventIgnoreStatus(&keyEvent);
 }
 
 // This helper function is responsible for sending an appropriate gecko
 // event in response to a keyboard key being pressed down.
 void
-MetroInput::OnKeyDown(uint32_t aVKey,
-                      UI::Core::CorePhysicalKeyStatus const& aKeyStatus)
+MetroInput::OnKeyDown(uint32_t aVKey)
 {
   // We can only send a gecko event if there is a gecko virtual key code that
   // corresponds to the Windows virtual key code
@@ -630,15 +468,6 @@ MetroInput::OnKeyDown(uint32_t aVKey,
   keyEvent.time = ::GetMessageTime();
   keyEvent.keyCode = mozKey;
   keyEvent.mKeyNameIndex = GetDOMKeyNameIndex(aVKey);
-
-  NPEvent pluginEvent;
-  pluginEvent.event = WM_KEYDOWN;
-  InitPluginKeyEventLParamFromKeyStatus(pluginEvent.lParam,
-                                        aKeyStatus);
-  // wParam is the virtual key code
-  pluginEvent.wParam = aVKey;
-
-  keyEvent.pluginEvent = static_cast<void*>(&pluginEvent);
   DispatchEventIgnoreStatus(&keyEvent);
 
   // If the key being pressed is not a printable character (e.g.
@@ -669,9 +498,6 @@ MetroInput::OnKeyDown(uint32_t aVKey,
   if (!keyEvent.isChar
    || (mModifierKeyState.IsControl()
     && !mModifierKeyState.IsAltGr())) {
-    // We don't want to send another message to our plugin,
-    // so reset keyEvent.pluginEvent
-    keyEvent.pluginEvent = nullptr;
     keyEvent.message = NS_KEY_PRESS;
     DispatchEventIgnoreStatus(&keyEvent);
   }
@@ -680,8 +506,7 @@ MetroInput::OnKeyDown(uint32_t aVKey,
 // This helper function is responsible for sending an appropriate gecko
 // event in response to a keyboard key being released.
 void
-MetroInput::OnKeyUp(uint32_t aVKey,
-                    UI::Core::CorePhysicalKeyStatus const& aKeyStatus)
+MetroInput::OnKeyUp(uint32_t aVKey)
 {
   uint32_t mozKey = GetMozKeyCode(aVKey);
   if (!mozKey) {
@@ -694,15 +519,6 @@ MetroInput::OnKeyUp(uint32_t aVKey,
   keyEvent.time = ::GetMessageTime();
   keyEvent.keyCode = mozKey;
   keyEvent.mKeyNameIndex = GetDOMKeyNameIndex(aVKey);
-
-  NPEvent pluginEvent;
-  pluginEvent.event = WM_KEYUP;
-  InitPluginKeyEventLParamFromKeyStatus(pluginEvent.lParam,
-                                        aKeyStatus);
-  // wParam is the virtual key code
-  pluginEvent.wParam = aVKey;
-
-  keyEvent.pluginEvent = static_cast<void*>(&pluginEvent);
   DispatchEventIgnoreStatus(&keyEvent);
 }
 
@@ -719,11 +535,9 @@ void
 MetroInput::OnPointerNonTouch(UI::Input::IPointerPoint* aPoint) {
   WRL::ComPtr<UI::Input::IPointerPointProperties> props;
   UI::Input::PointerUpdateKind pointerUpdateKind;
-  boolean canBeDoubleTap;
 
   aPoint->get_Properties(props.GetAddressOf());
   props->get_PointerUpdateKind(&pointerUpdateKind);
-  mGestureRecognizer->CanBeDoubleTap(aPoint, &canBeDoubleTap);
 
   nsMouseEvent mouseEvent(true,
                           NS_MOUSE_MOVE,
@@ -731,52 +545,35 @@ MetroInput::OnPointerNonTouch(UI::Input::IPointerPoint* aPoint) {
                           nsMouseEvent::eReal,
                           nsMouseEvent::eNormal);
 
-  NPEvent pluginEvent;
-  pluginEvent.event = WM_MOUSEMOVE;
-
   switch (pointerUpdateKind) {
     case UI::Input::PointerUpdateKind::PointerUpdateKind_LeftButtonPressed:
       // We don't bother setting mouseEvent.button because it is already
       // set to nsMouseEvent::buttonType::eLeftButton whose value is 0.
       mouseEvent.message = NS_MOUSE_BUTTON_DOWN;
-      pluginEvent.event = (canBeDoubleTap
-                        ? WM_LBUTTONDBLCLK
-                        : WM_LBUTTONDOWN);
       break;
     case UI::Input::PointerUpdateKind::PointerUpdateKind_MiddleButtonPressed:
       mouseEvent.button = nsMouseEvent::buttonType::eMiddleButton;
       mouseEvent.message = NS_MOUSE_BUTTON_DOWN;
-      pluginEvent.event = (canBeDoubleTap
-                        ? WM_MBUTTONDBLCLK
-                        : WM_MBUTTONDOWN);
       break;
     case UI::Input::PointerUpdateKind::PointerUpdateKind_RightButtonPressed:
       mouseEvent.button = nsMouseEvent::buttonType::eRightButton;
       mouseEvent.message = NS_MOUSE_BUTTON_DOWN;
-      pluginEvent.event = (canBeDoubleTap
-                        ? WM_RBUTTONDBLCLK
-                        : WM_RBUTTONDOWN);
       break;
     case UI::Input::PointerUpdateKind::PointerUpdateKind_LeftButtonReleased:
       // We don't bother setting mouseEvent.button because it is already
       // set to nsMouseEvent::buttonType::eLeftButton whose value is 0.
       mouseEvent.message = NS_MOUSE_BUTTON_UP;
-      pluginEvent.event = WM_LBUTTONUP;
       break;
     case UI::Input::PointerUpdateKind::PointerUpdateKind_MiddleButtonReleased:
       mouseEvent.button = nsMouseEvent::buttonType::eMiddleButton;
       mouseEvent.message = NS_MOUSE_BUTTON_UP;
-      pluginEvent.event = WM_MBUTTONUP;
       break;
     case UI::Input::PointerUpdateKind::PointerUpdateKind_RightButtonReleased:
       mouseEvent.button = nsMouseEvent::buttonType::eRightButton;
       mouseEvent.message = NS_MOUSE_BUTTON_UP;
-      pluginEvent.event = WM_RBUTTONUP;
       break;
   }
   InitGeckoMouseEventFromPointerPoint(mouseEvent, aPoint);
-
-  mouseEvent.pluginEvent = static_cast<void*>(&pluginEvent);
   DispatchEventIgnoreStatus(&mouseEvent);
   return;
 }
diff --git a/widget/windows/winrt/MetroInput.h b/widget/windows/winrt/MetroInput.h
index fed4985e8493..37d4377b8b5e 100644
--- a/widget/windows/winrt/MetroInput.h
+++ b/widget/windows/winrt/MetroInput.h
@@ -43,7 +43,6 @@ namespace ABI {
     };
     namespace UI {
       namespace Core {
-        struct CorePhysicalKeyStatus;
         struct ICoreWindow;
         struct ICoreDispatcher;
         struct IAcceleratorKeyEventArgs;
@@ -82,7 +81,6 @@ private:
   typedef ABI::Windows::Foundation::Point Point;
 
   // UI::Core
-  typedef ABI::Windows::UI::Core::CorePhysicalKeyStatus CorePhysicalKeyStatus;
   typedef ABI::Windows::UI::Core::ICoreWindow ICoreWindow;
   typedef ABI::Windows::UI::Core::IAcceleratorKeyEventArgs \
                                   IAcceleratorKeyEventArgs;
@@ -172,12 +170,9 @@ private:
   void UnregisterInputEvents();
 
   // Event processing helpers.  See function definitions for more info.
-  void OnKeyDown(uint32_t aVKey,
-                 CorePhysicalKeyStatus const& aKeyStatus);
-  void OnKeyUp(uint32_t aVKey,
-               CorePhysicalKeyStatus const& aKeyStatus);
-  void OnCharacterReceived(uint32_t aVKey,
-                           CorePhysicalKeyStatus const& aKeyStatus);
+  void OnKeyDown(uint32_t aVKey);
+  void OnKeyUp(uint32_t aVKey);
+  void OnCharacterReceived(uint32_t aVKey);
   void OnPointerNonTouch(IPointerPoint* aPoint);
   void InitGeckoMouseEventFromPointerPoint(nsMouseEvent& aEvent,
                                            IPointerPoint* aPoint);

From 662fdc4e1bc61c5716dfa2b21dcafd53018dea7f Mon Sep 17 00:00:00 2001
From: Jonathan Griffin <jgriffin@mozilla.com>
Date: Mon, 10 Jun 2013 11:21:33 -0700
Subject: [PATCH 41/75] bug 873542 - Remove ENABLE_MARIONETTE from debug FF
 configs, r=dburns

---
 browser/config/mozconfigs/linux32/debug  | 1 -
 browser/config/mozconfigs/linux64/debug  | 1 -
 browser/config/mozconfigs/macosx64/debug | 1 -
 browser/config/mozconfigs/win32/debug    | 2 --
 browser/config/mozconfigs/win64/debug    | 1 -
 5 files changed, 6 deletions(-)

diff --git a/browser/config/mozconfigs/linux32/debug b/browser/config/mozconfigs/linux32/debug
index b95976e5c2d1..232836744a6b 100644
--- a/browser/config/mozconfigs/linux32/debug
+++ b/browser/config/mozconfigs/linux32/debug
@@ -1,7 +1,6 @@
 ac_add_options --enable-debug
 ac_add_options --enable-trace-malloc
 ac_add_options --enable-signmar
-ENABLE_MARIONETTE=1
 
 . $topsrcdir/build/unix/mozconfig.linux32
 
diff --git a/browser/config/mozconfigs/linux64/debug b/browser/config/mozconfigs/linux64/debug
index 3ce1ddd55e8d..c917660e08d5 100644
--- a/browser/config/mozconfigs/linux64/debug
+++ b/browser/config/mozconfigs/linux64/debug
@@ -1,7 +1,6 @@
 ac_add_options --enable-debug
 ac_add_options --enable-trace-malloc
 ac_add_options --enable-signmar
-ENABLE_MARIONETTE=1
 
 . $topsrcdir/build/unix/mozconfig.linux
 
diff --git a/browser/config/mozconfigs/macosx64/debug b/browser/config/mozconfigs/macosx64/debug
index d57a85485b60..ebf8099456b9 100644
--- a/browser/config/mozconfigs/macosx64/debug
+++ b/browser/config/mozconfigs/macosx64/debug
@@ -4,7 +4,6 @@ ac_add_options --enable-debug
 ac_add_options --enable-trace-malloc
 ac_add_options --enable-accessibility
 ac_add_options --enable-signmar
-ENABLE_MARIONETTE=1
 
 # Needed to enable breakpad in application.ini
 export MOZILLA_OFFICIAL=1
diff --git a/browser/config/mozconfigs/win32/debug b/browser/config/mozconfigs/win32/debug
index 3d2d22b9e38b..ad878ede5d2b 100644
--- a/browser/config/mozconfigs/win32/debug
+++ b/browser/config/mozconfigs/win32/debug
@@ -5,8 +5,6 @@ ac_add_options --enable-trace-malloc
 ac_add_options --enable-signmar
 ac_add_options --enable-metro
 
-ENABLE_MARIONETTE=1
-
 # Needed to enable breakpad in application.ini
 export MOZILLA_OFFICIAL=1
 
diff --git a/browser/config/mozconfigs/win64/debug b/browser/config/mozconfigs/win64/debug
index 0d7d4443f386..a907b9e9037a 100644
--- a/browser/config/mozconfigs/win64/debug
+++ b/browser/config/mozconfigs/win64/debug
@@ -7,7 +7,6 @@ ac_add_options --enable-debug
 ac_add_options --enable-trace-malloc
 ac_add_options --enable-signmar
 ac_add_options --enable-metro
-ENABLE_MARIONETTE=1
 
 # Needed to enable breakpad in application.ini
 export MOZILLA_OFFICIAL=1

From 256cba59c58548fae0c3c6cc4fab7b800b9df0f3 Mon Sep 17 00:00:00 2001
From: Chris Peterson <cpeterson@mozilla.com>
Date: Tue, 11 Jun 2013 10:09:57 -0700
Subject: [PATCH 42/75] Bug 827407 - Back out Flash fullscreen video bug 809055
 to test whether FlashPaintSurface crashes are correlated. r=snorp

---
 dom/plugins/base/nsPluginInstanceOwner.cpp | 2 --
 1 file changed, 2 deletions(-)

diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index 077ca1ca2d9b..e891965c7619 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -3298,8 +3298,6 @@ nsPluginInstanceOwner::UpdateDocumentActiveState(bool aIsActive)
   if (mInstance) {
     if (!mPluginDocumentActiveState)
       RemovePluginView();
-    else if (mPluginDocumentActiveState && mFullScreen)
-      AddPluginView();
 
     mInstance->NotifyOnScreen(mPluginDocumentActiveState);
 

From d452b85408508b92c3ab013b14ef44ffde5f0d34 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Mon, 17 Jun 2013 11:46:50 -0700
Subject: [PATCH 43/75] Bug 883466 - Fix build failure in GGC caused by
 jsobjinlines.h reorganization; r=njn

--HG--
extra : rebase_source : 7fe3ba7e1d7efbd650d6b88f9bc8cea46f8dadac
---
 js/src/gc/Nursery.cpp         |  1 +
 js/src/gc/Zone.cpp            | 12 ++++++++++++
 js/src/gc/Zone.h              |  4 ++--
 js/src/jscntxt.cpp            |  9 +++++++++
 js/src/jscntxt.h              |  2 +-
 js/src/jscntxtinlines.h       |  9 ---------
 js/src/jscompartmentinlines.h | 12 ------------
 js/src/jsgc.h                 | 16 ++++++++++++++++
 js/src/jsobjinlines.h         | 15 ---------------
 9 files changed, 41 insertions(+), 39 deletions(-)

diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
index 3d667eeadfed..a62953210bdf 100644
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -9,6 +9,7 @@
 
 #include "jscompartment.h"
 #include "jsgc.h"
+#include "jstypedarray.h"
 #include "jsutil.h"
 
 #include "gc/GCInternals.h"
diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
index ff75dac9846f..ca02c9d77363 100644
--- a/js/src/gc/Zone.cpp
+++ b/js/src/gc/Zone.cpp
@@ -24,6 +24,18 @@
 using namespace js;
 using namespace js::gc;
 
+void *
+js::Allocator::onOutOfMemory(void *p, size_t nbytes)
+{
+    return zone->rt->onOutOfMemory(p, nbytes);
+}
+
+void
+js::Allocator::reportAllocationOverflow()
+{
+    js_ReportAllocationOverflow(NULL);
+}
+
 JS::Zone::Zone(JSRuntime *rt)
   : rt(rt),
     allocator(this),
diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
index 567361b82239..4e1eb3d5c429 100644
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -45,9 +45,9 @@ class Allocator : public MallocProvider<Allocator>
 
     inline void *parallelNewGCThing(gc::AllocKind thingKind, size_t thingSize);
 
-    inline void *onOutOfMemory(void *p, size_t nbytes);
+    void *onOutOfMemory(void *p, size_t nbytes);
     inline void updateMallocCounter(size_t nbytes);
-    inline void reportAllocationOverflow();
+    void reportAllocationOverflow();
 };
 
 typedef Vector<JSCompartment *, 1, SystemAllocPolicy> CompartmentVector;
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 03fff82cd175..e4d78302987a 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -98,6 +98,15 @@ js::TraceCycleDetectionSet(JSTracer *trc, js::ObjectSet &set)
     }
 }
 
+void
+NewObjectCache::clearNurseryObjects(JSRuntime *rt)
+{
+    for (unsigned i = 0; i < mozilla::ArrayLength(entries); ++i) {
+        if (IsInsideNursery(rt, entries[i].key))
+            mozilla::PodZero(&entries[i]);
+    }
+}
+
 void
 JSRuntime::sizeOfIncludingThis(JSMallocSizeOfFun mallocSizeOf, JS::RuntimeSizes *rtSizes)
 {
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 4c915aa09d26..ed300223b897 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -341,7 +341,7 @@ class NewObjectCache
     void purge() { mozilla::PodZero(this); }
 
     /* Remove any cached items keyed on moved objects. */
-    inline void clearNurseryObjects(JSRuntime *rt);
+    void clearNurseryObjects(JSRuntime *rt);
 
     /*
      * Get the entry index for the given lookup, return whether there was a hit
diff --git a/js/src/jscntxtinlines.h b/js/src/jscntxtinlines.h
index 6713e4464a57..b7a8a0bc7a9e 100644
--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -31,15 +31,6 @@ NewObjectCache::staticAsserts()
     JS_STATIC_ASSERT(gc::FINALIZE_OBJECT_LAST == gc::FINALIZE_OBJECT16_BACKGROUND);
 }
 
-inline void
-NewObjectCache::clearNurseryObjects(JSRuntime *rt)
-{
-    for (unsigned i = 0; i < mozilla::ArrayLength(entries); ++i) {
-        if (IsInsideNursery(rt, entries[i].key))
-            mozilla::PodZero(&entries[i]);
-    }
-}
-
 inline bool
 NewObjectCache::lookup(Class *clasp, gc::Cell *key, gc::AllocKind kind, EntryIndex *pentry)
 {
diff --git a/js/src/jscompartmentinlines.h b/js/src/jscompartmentinlines.h
index 0cd9475eab7c..53ac7dfd02ca 100644
--- a/js/src/jscompartmentinlines.h
+++ b/js/src/jscompartmentinlines.h
@@ -38,24 +38,12 @@ js::AutoCompartment::~AutoCompartment()
     cx_->leaveCompartment(origin_);
 }
 
-void *
-js::Allocator::onOutOfMemory(void *p, size_t nbytes)
-{
-    return zone->rt->onOutOfMemory(p, nbytes);
-}
-
 void
 js::Allocator::updateMallocCounter(size_t nbytes)
 {
     zone->rt->updateMallocCounter(zone, nbytes);
 }
 
-void
-js::Allocator::reportAllocationOverflow()
-{
-    js_ReportAllocationOverflow(NULL);
-}
-
 inline void *
 js::Allocator::parallelNewGCThing(gc::AllocKind thingKind, size_t thingSize)
 {
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 8eb84af8de3f..8840098d8242 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -15,6 +15,7 @@
 #include "mozilla/Util.h"
 
 #include "jsalloc.h"
+#include "jsclass.h"
 #include "jstypes.h"
 #include "jsprvtd.h"
 #include "jspubtd.h"
@@ -217,6 +218,21 @@ IsBackgroundFinalized(AllocKind kind)
     return map[kind];
 }
 
+static inline bool
+CanBeFinalizedInBackground(gc::AllocKind kind, Class *clasp)
+{
+    JS_ASSERT(kind <= gc::FINALIZE_OBJECT_LAST);
+    /* If the class has no finalizer or a finalizer that is safe to call on
+     * a different thread, we change the finalize kind. For example,
+     * FINALIZE_OBJECT0 calls the finalizer on the main thread,
+     * FINALIZE_OBJECT0_BACKGROUND calls the finalizer on the gcHelperThread.
+     * IsBackgroundFinalized is called to prevent recursively incrementing
+     * the finalize kind; kind may already be a background finalize kind.
+     */
+    return (!gc::IsBackgroundFinalized(kind) &&
+            (!clasp->finalize || (clasp->flags & JSCLASS_BACKGROUND_FINALIZE)));
+}
+
 inline JSGCTraceKind
 GetGCThingTraceKind(const void *thing);
 
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 2dc3f074b5da..a0825a5b455d 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1460,21 +1460,6 @@ class AutoPropertyDescriptorRooter : private AutoGCRooter, public PropertyDescri
     friend void AutoGCRooter::trace(JSTracer *trc);
 };
 
-static inline bool
-CanBeFinalizedInBackground(gc::AllocKind kind, Class *clasp)
-{
-    JS_ASSERT(kind <= gc::FINALIZE_OBJECT_LAST);
-    /* If the class has no finalizer or a finalizer that is safe to call on
-     * a different thread, we change the finalize kind. For example,
-     * FINALIZE_OBJECT0 calls the finalizer on the main thread,
-     * FINALIZE_OBJECT0_BACKGROUND calls the finalizer on the gcHelperThread.
-     * IsBackgroundFinalized is called to prevent recursively incrementing
-     * the finalize kind; kind may already be a background finalize kind.
-     */
-    return (!gc::IsBackgroundFinalized(kind) &&
-            (!clasp->finalize || (clasp->flags & JSCLASS_BACKGROUND_FINALIZE)));
-}
-
 /*
  * Make an object with the specified prototype. If parent is null, it will
  * default to the prototype's global if the prototype is non-null.

From e6d07dc1fbfc5dbd9792149decf25e77d6869d65 Mon Sep 17 00:00:00 2001
From: Sriram Ramasubramanian <sriram@mozilla.com>
Date: Mon, 17 Jun 2013 12:55:01 -0700
Subject: [PATCH 44/75] Bug 884004: DexClassLoader should use context's class
 loader. [r=kats]

--HG--
extra : rebase_source : ef88af9ee62fb357528c4116247a7f57bae70cf3
---
 mobile/android/base/JavaAddonManager.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/android/base/JavaAddonManager.java b/mobile/android/base/JavaAddonManager.java
index 9ab2906a0016..fa59760d6d5d 100644
--- a/mobile/android/base/JavaAddonManager.java
+++ b/mobile/android/base/JavaAddonManager.java
@@ -90,7 +90,7 @@ class JavaAddonManager implements GeckoEventListener {
                 Log.d(LOGTAG, "Attempting to load classes.dex file from " + zipFile + " and instantiate " + implClass);
                 try {
                     File tmpDir = mApplicationContext.getDir("dex", 0);
-                    DexClassLoader loader = new DexClassLoader(zipFile, tmpDir.getAbsolutePath(), null, ClassLoader.getSystemClassLoader());
+                    DexClassLoader loader = new DexClassLoader(zipFile, tmpDir.getAbsolutePath(), null, mApplicationContext.getClassLoader());
                     Class<?> c = loader.loadClass(implClass);
                     try {
                         Constructor<?> constructor = c.getDeclaredConstructor(Map.class);

From 90bd660c6e23f7f27516bb0be91dbdb7eca0849e Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Mon, 17 Jun 2013 17:24:13 -0700
Subject: [PATCH 45/75] Bug 882975: Fix typo (s/max-height/min-height/) in
 flexbox-sizing-*-1 reftests, and fix reference cases accordingly. (test-only)

---
 .../submitted/flexbox/flexbox-sizing-horiz-1-ref.xhtml     | 7 ++++++-
 .../w3c-css/submitted/flexbox/flexbox-sizing-horiz-1.xhtml | 2 +-
 .../submitted/flexbox/flexbox-sizing-vert-1-ref.xhtml      | 1 +
 .../w3c-css/submitted/flexbox/flexbox-sizing-vert-1.xhtml  | 2 +-
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-horiz-1-ref.xhtml b/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-horiz-1-ref.xhtml
index d62c8fdd2473..2d95cdea866e 100644
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-horiz-1-ref.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-horiz-1-ref.xhtml
@@ -56,7 +56,12 @@
     </div>
 
     <div class="flexbox" style="width: 20px">
-      <div class="b"/>
+      <!-- We add an extra layer of <div> wrapping in this chunk, with a
+           fixed width, to keep the overflowing children from wrapping. -->
+      <div style="width: 50px">
+        <div class="b"/>
+        <div class="c" style="width: 10px"/>
+      </div>
     </div>
 
     <div class="flexbox" style="width: 58px">
diff --git a/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-horiz-1.xhtml b/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-horiz-1.xhtml
index ce09fa32d3e9..6187080293e7 100644
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-horiz-1.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-horiz-1.xhtml
@@ -34,7 +34,7 @@
       }
       div.c {
         flex: 1 40px;
-        max-width: 10px;
+        min-width: 10px;
         max-width: 60px;
         background: orange;
       }
diff --git a/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-vert-1-ref.xhtml b/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-vert-1-ref.xhtml
index ee2ef3965c52..07d4075d8ef2 100644
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-vert-1-ref.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-vert-1-ref.xhtml
@@ -63,6 +63,7 @@
 
     <div class="flexbox" style="height: 20px">
       <div class="b"/>
+      <div class="c" style="height: 10px"/>
     </div>
 
     <div class="flexbox">
diff --git a/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-vert-1.xhtml b/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-vert-1.xhtml
index 217b418bc4ca..003a68673710 100644
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-vert-1.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-sizing-vert-1.xhtml
@@ -36,7 +36,7 @@
       }
       div.c {
         flex: 1 40px;
-        max-height: 10px;
+        min-height: 10px;
         max-height: 60px;
         background: orange;
       }

From 7de7004013ac6b0d48e7f753eb9d18434daf83c2 Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Mon, 17 Jun 2013 17:18:40 -0400
Subject: [PATCH 46/75] Bug 884022 - fix clang warnings about pointer-to-int
 comparisons in test_AsXXX_helpers.cpp; r=dholbert

---
 storage/test/test_AsXXX_helpers.cpp | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/storage/test/test_AsXXX_helpers.cpp b/storage/test/test_AsXXX_helpers.cpp
index acf154f73f8f..f778911a5ff8 100644
--- a/storage/test/test_AsXXX_helpers.cpp
+++ b/storage/test/test_AsXXX_helpers.cpp
@@ -36,13 +36,13 @@ Spinner::HandleResult(mozIStorageResultSet *aResultSet)
   do_check_eq(row->AsDouble(0), 0.0);
 
   uint32_t len = 100;
-  do_check_eq(row->AsSharedUTF8String(0, &len), '\0');
+  do_check_eq(row->AsSharedUTF8String(0, &len), (const char*)nullptr);
   do_check_eq(len, 0);
   len = 100;
-  do_check_eq(row->AsSharedWString(0, &len), '\0');
+  do_check_eq(row->AsSharedWString(0, &len), (const PRUnichar*)nullptr);
   do_check_eq(len, 0);
   len = 100;
-  do_check_eq(row->AsSharedBlob(0, &len), '\0');
+  do_check_eq(row->AsSharedBlob(0, &len), (const uint8_t*)nullptr);
   do_check_eq(len, 0);
 
   do_check_eq(row->IsNull(0), true);
@@ -69,13 +69,13 @@ test_NULLFallback()
   do_check_eq(stmt->AsInt64(0), 0);
   do_check_eq(stmt->AsDouble(0), 0.0);
   uint32_t len = 100;
-  do_check_eq(stmt->AsSharedUTF8String(0, &len), '\0');
+  do_check_eq(stmt->AsSharedUTF8String(0, &len), (const char*)nullptr);
   do_check_eq(len, 0);
   len = 100;
-  do_check_eq(stmt->AsSharedWString(0, &len), '\0');
+  do_check_eq(stmt->AsSharedWString(0, &len), (const PRUnichar*)nullptr);
   do_check_eq(len, 0);
   len = 100;
-  do_check_eq(stmt->AsSharedBlob(0, &len), '\0');
+  do_check_eq(stmt->AsSharedBlob(0, &len), (const uint8_t*)nullptr);
   do_check_eq(len, 0);
   do_check_eq(stmt->IsNull(0), true);
 
@@ -83,13 +83,13 @@ test_NULLFallback()
   do_check_eq(valueArray->AsInt64(0), 0);
   do_check_eq(valueArray->AsDouble(0), 0.0);
   len = 100;
-  do_check_eq(valueArray->AsSharedUTF8String(0, &len), '\0');
+  do_check_eq(valueArray->AsSharedUTF8String(0, &len), (const char*)nullptr);
   do_check_eq(len, 0);
   len = 100;
-  do_check_eq(valueArray->AsSharedWString(0, &len), '\0');
+  do_check_eq(valueArray->AsSharedWString(0, &len), (const PRUnichar*)nullptr);
   do_check_eq(len, 0);
   len = 100;
-  do_check_eq(valueArray->AsSharedBlob(0, &len), '\0');
+  do_check_eq(valueArray->AsSharedBlob(0, &len), (const uint8_t*)nullptr);
   do_check_eq(len, 0);
   do_check_eq(valueArray->IsNull(0), true);
 }

From 0495cf2f72d16bcb6d38f7926634699109394810 Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Mon, 17 Jun 2013 14:58:56 -0400
Subject: [PATCH 47/75] Bug 883981 - correctly reflect the server's port in
 httpd.js; r=ted

---
 netwerk/test/httpserver/httpd.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/netwerk/test/httpserver/httpd.js b/netwerk/test/httpserver/httpd.js
index 5a40cc4fa584..3277a5e395d8 100644
--- a/netwerk/test/httpserver/httpd.js
+++ b/netwerk/test/httpserver/httpd.js
@@ -535,7 +535,8 @@ nsHttpServer.prototype =
       dumpn(">>> listening on port " + socket.port + ", " + maxConnections +
             " pending connections");
       socket.asyncListen(this);
-      this._identity._initialize(port, host, true);
+      this._port = socket.port;
+      this._identity._initialize(socket.port, host, true);
       this._socket = socket;
     }
     catch (e)

From 8d11919b787400f72e09d918b2cc9caa1c25b36f Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Mon, 17 Jun 2013 14:59:52 -0400
Subject: [PATCH 48/75] Bug 883983 - let the httpd server choose its port in
 reftests; r=ted

---
 layout/tools/reftest/reftest.js | 25 ++++++-------------------
 1 file changed, 6 insertions(+), 19 deletions(-)

diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index 6f04b0f70ed3..d464f62e92e0 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -133,8 +133,7 @@ var gPrefsToRestore = [];
 const gProtocolRE = /^\w+:/;
 const gPrefItemRE = /^(|test-|ref-)pref\((.+?),(.*)\)$/;
 
-var HTTP_SERVER_PORT = 4444;
-const HTTP_SERVER_PORTS_TO_TRY = 50;
+var gHttpServerPort = -1;
 
 // whether to run slow tests or not
 var gRunSlowTests = true;
@@ -380,19 +379,8 @@ function InitAndStartRefTests()
 function StartHTTPServer()
 {
     gServer.registerContentType("sjs", "sjs");
-    // We want to try different ports in case the port we want
-    // is being used.
-    var tries = HTTP_SERVER_PORTS_TO_TRY;
-    do {
-        try {
-            gServer.start(HTTP_SERVER_PORT);
-            return;
-        } catch (ex) {
-            ++HTTP_SERVER_PORT;
-            if (--tries == 0)
-                throw ex;
-        }
-    } while (true);
+    gServer.start(-1);
+    gHttpServerPort = gServer.identity.primaryPort;
 }
 
 function StartTests()
@@ -431,7 +419,7 @@ function StartTests()
     }
 #else
     try {
-        // Need to read the manifest once we have the final HTTP_SERVER_PORT.
+        // Need to read the manifest once we have gHttpServerPort..
         var args = window.arguments[0].wrappedJSObject;
 
         if ("nocache" in args && args["nocache"])
@@ -1081,9 +1069,8 @@ function ServeFiles(manifestPrincipal, depth, aURL, files)
     var secMan = CC[NS_SCRIPTSECURITYMANAGER_CONTRACTID]
                      .getService(CI.nsIScriptSecurityManager);
 
-    var testbase = gIOService.newURI("http://localhost:" + HTTP_SERVER_PORT +
-                                         path + dirPath,
-                                     null, null);
+    var testbase = gIOService.newURI("http://localhost:" + gHttpServerPort +
+                                     path + dirPath, null, null);
 
     function FileToURI(file)
     {

From 4491ff5d2045fa8da114ee2bc64c2c74ffa15196 Mon Sep 17 00:00:00 2001
From: Benoit Girard <b56girard@gmail.com>
Date: Thu, 16 May 2013 16:31:50 -0400
Subject: [PATCH 49/75] Bug 873914 - Allow selecting profiled thread. r=snorp

--HG--
extra : rebase_source : 011e3481e6bf3792805e054370c89709847a0f06
---
 tools/profiler/GeckoProfiler.h     |  3 +-
 tools/profiler/GeckoProfilerFunc.h |  5 ++-
 tools/profiler/GeckoProfilerImpl.h |  5 ++-
 tools/profiler/TableTicker.h       | 64 ++++++++++++++++++++++++------
 tools/profiler/nsIProfiler.idl     |  6 ++-
 tools/profiler/nsProfiler.cpp      |  7 +++-
 tools/profiler/platform-linux.cc   | 19 ++-------
 tools/profiler/platform-macos.cc   | 16 +-------
 tools/profiler/platform-win32.cc   | 16 +-------
 tools/profiler/platform.cpp        | 11 +++--
 10 files changed, 84 insertions(+), 68 deletions(-)

diff --git a/tools/profiler/GeckoProfiler.h b/tools/profiler/GeckoProfiler.h
index e18e81e71288..d5d28ad2c97a 100644
--- a/tools/profiler/GeckoProfiler.h
+++ b/tools/profiler/GeckoProfiler.h
@@ -95,7 +95,8 @@ static inline void profiler_shutdown() {};
 //       best to sample at this interval. The profiler visualization
 //       should represent the actual sampling accuracy.
 static inline void profiler_start(int aProfileEntries, int aInterval,
-                              const char** aFeatures, uint32_t aFeatureCount) {}
+                              const char** aFeatures, uint32_t aFeatureCount,
+                              const char** aThreadNameFilters, uint32_t aFilterCount) {}
 
 // Stop the profiler and discard the profile. Call 'profiler_save' before this
 // to retrieve the profile.
diff --git a/tools/profiler/GeckoProfilerFunc.h b/tools/profiler/GeckoProfilerFunc.h
index 97f401eff260..831520f1d643 100644
--- a/tools/profiler/GeckoProfilerFunc.h
+++ b/tools/profiler/GeckoProfilerFunc.h
@@ -21,8 +21,9 @@ inline void* mozilla_sampler_call_enter(const char *aInfo, void *aFrameAddress =
 inline void  mozilla_sampler_call_exit(void* handle);
 inline void  mozilla_sampler_add_marker(const char *aInfo);
 
-void mozilla_sampler_start(int aEntries, int aInterval, const char** aFeatures,
-                            uint32_t aFeatureCount);
+void mozilla_sampler_start(int aEntries, int aInterval,
+                           const char** aFeatures, uint32_t aFeatureCount,
+                           const char** aThreadNameFilters, uint32_t aFilterCount);
 
 void mozilla_sampler_stop();
 
diff --git a/tools/profiler/GeckoProfilerImpl.h b/tools/profiler/GeckoProfilerImpl.h
index 484f4a8b55ff..02e53ba8b493 100644
--- a/tools/profiler/GeckoProfilerImpl.h
+++ b/tools/profiler/GeckoProfilerImpl.h
@@ -65,9 +65,10 @@ void profiler_shutdown()
 
 static inline
 void profiler_start(int aProfileEntries, int aInterval,
-                       const char** aFeatures, uint32_t aFeatureCount)
+                       const char** aFeatures, uint32_t aFeatureCount,
+                       const char** aThreadNameFilters, uint32_t aFilterCount)
 {
-  mozilla_sampler_start(aProfileEntries, aInterval, aFeatures, aFeatureCount);
+  mozilla_sampler_start(aProfileEntries, aInterval, aFeatures, aFeatureCount, aThreadNameFilters, aFilterCount);
 }
 
 static inline
diff --git a/tools/profiler/TableTicker.h b/tools/profiler/TableTicker.h
index bb3b84c99874..0684a2c5aa39 100644
--- a/tools/profiler/TableTicker.h
+++ b/tools/profiler/TableTicker.h
@@ -16,6 +16,22 @@ hasFeature(const char** aFeatures, uint32_t aFeatureCount, const char* aFeature)
   return false;
 }
 
+static bool
+threadSelected(ThreadInfo* aInfo, char** aThreadNameFilters, uint32_t aFeatureCount) {
+  if (aFeatureCount == 0) {
+    return true;
+  }
+
+  for (uint32_t i = 0; i < aFeatureCount; ++i) {
+    const char* filterPrefix = aThreadNameFilters[i];
+    if (strncmp(aInfo->Name(), filterPrefix, strlen(filterPrefix)) == 0) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
 extern TimeStamp sLastTracerEvent;
 extern int sFrameNumber;
 extern int sLastFrameNumber;
@@ -27,11 +43,13 @@ class BreakpadSampler;
 class TableTicker: public Sampler {
  public:
   TableTicker(int aInterval, int aEntrySize,
-              const char** aFeatures, uint32_t aFeatureCount)
+              const char** aFeatures, uint32_t aFeatureCount,
+              const char** aThreadNameFilters, uint32_t aFilterCount)
     : Sampler(aInterval, true, aEntrySize)
     , mPrimaryThreadProfile(nullptr)
     , mSaveRequested(false)
     , mUnwinderThread(false)
+    , mFilterCount(aFilterCount)
   {
     mUseStackWalk = hasFeature(aFeatures, aFeatureCount, "stackwalk");
 
@@ -45,6 +63,12 @@ class TableTicker: public Sampler {
     mPrivacyMode = hasFeature(aFeatures, aFeatureCount, "privacy");
     mAddMainThreadIO = hasFeature(aFeatures, aFeatureCount, "mainthreadio");
 
+    // Deep copy aThreadNameFilters
+    mThreadNameFilters = new char*[aFilterCount];
+    for (uint32_t i = 0; i < aFilterCount; ++i) {
+      mThreadNameFilters[i] = strdup(aThreadNameFilters[i]);
+    }
+
     sStartTime = TimeStamp::Now();
 
     {
@@ -54,18 +78,7 @@ class TableTicker: public Sampler {
       for (uint32_t i = 0; i < sRegisteredThreads->size(); i++) {
         ThreadInfo* info = sRegisteredThreads->at(i);
 
-        if (!info->IsMainThread() && !mProfileThreads)
-          continue;
-
-        ThreadProfile* profile = new ThreadProfile(info->Name(),
-                                                   aEntrySize,
-                                                   info->Stack(),
-                                                   info->ThreadId(),
-                                                   info->GetPlatformData(),
-                                                   info->IsMainThread());
-        profile->addTag(ProfileEntry('m', "Start"));
-
-        info->SetProfile(profile);
+        RegisterThread(info);
       }
 
       SetActiveSampler(this);
@@ -93,6 +106,26 @@ class TableTicker: public Sampler {
     }
   }
 
+  void RegisterThread(ThreadInfo* aInfo) {
+    if (!aInfo->IsMainThread() && !mProfileThreads) {
+      return;
+    }
+
+    if (!threadSelected(aInfo, mThreadNameFilters, mFilterCount)) {
+      return;
+    }
+
+    ThreadProfile* profile = new ThreadProfile(aInfo->Name(),
+                                               EntrySize(),
+                                               aInfo->Stack(),
+                                               aInfo->ThreadId(),
+                                               aInfo->GetPlatformData(),
+                                               aInfo->IsMainThread());
+    profile->addTag(ProfileEntry('m', "Start"));
+
+    aInfo->SetProfile(profile);
+  }
+
   // Called within a signal. This function must be reentrant
   virtual void Tick(TickSample* sample);
 
@@ -154,6 +187,11 @@ protected:
   bool mProfileThreads;
   bool mUnwinderThread;
   bool mProfileJava;
+
+  // Keep the thread filter to check against new thread that
+  // are started while profiling
+  char** mThreadNameFilters;
+  uint32_t mFilterCount;
   bool mPrivacyMode;
   bool mAddMainThreadIO;
 };
diff --git a/tools/profiler/nsIProfiler.idl b/tools/profiler/nsIProfiler.idl
index acf2813fc548..e7ec6526467b 100644
--- a/tools/profiler/nsIProfiler.idl
+++ b/tools/profiler/nsIProfiler.idl
@@ -5,12 +5,14 @@
  
 #include "nsISupports.idl"
 
-[scriptable, uuid(c94651cf-082f-45e2-9481-33a1a700b46a)]
+[scriptable, uuid(eb77a9b0-285f-472c-93b0-04db5e9e3e7e)]
 interface nsIProfiler : nsISupports
 {
   void StartProfiler(in uint32_t aEntries, in uint32_t aInterval,
                       [array, size_is(aFeatureCount)] in string aFeatures,
-                      in uint32_t aFeatureCount);
+                      in uint32_t aFeatureCount,
+                      [array, size_is(aFilterCount), optional] in string aThreadNameFilters,
+                      [optional] in uint32_t aFilterCount);
   void StopProfiler();
   void AddMarker(in string aMarker);
   string GetProfile();
diff --git a/tools/profiler/nsProfiler.cpp b/tools/profiler/nsProfiler.cpp
index c075ce2cddb0..73016f332e5a 100644
--- a/tools/profiler/nsProfiler.cpp
+++ b/tools/profiler/nsProfiler.cpp
@@ -71,13 +71,16 @@ nsProfiler::Observe(nsISupports *aSubject,
 
 NS_IMETHODIMP
 nsProfiler::StartProfiler(uint32_t aEntries, uint32_t aInterval,
-                          const char** aFeatures, uint32_t aFeatureCount)
+                          const char** aFeatures, uint32_t aFeatureCount,
+                          const char** aThreadNameFilters, uint32_t aFilterCount)
 {
   if (mLockedForPrivateBrowsing) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  profiler_start(aEntries, aInterval, aFeatures, aFeatureCount);
+  profiler_start(aEntries, aInterval,
+                 aFeatures, aFeatureCount,
+                 aThreadNameFilters, aFilterCount);
 #ifdef MOZ_INSTRUMENT_EVENT_LOOP
   bool printToConsole = false;
   mozilla::InitEventTracing(printToConsole);
diff --git a/tools/profiler/platform-linux.cc b/tools/profiler/platform-linux.cc
index 8676e573dac8..ef0f68b1bb9f 100644
--- a/tools/profiler/platform-linux.cc
+++ b/tools/profiler/platform-linux.cc
@@ -371,20 +371,8 @@ bool Sampler::RegisterCurrentThread(const char* aName,
   ThreadInfo* info = new ThreadInfo(aName, gettid(),
     aIsMainThread, aPseudoStack);
 
-  bool profileThread = sActiveSampler &&
-    (aIsMainThread || sActiveSampler->ProfileThreads());
-
-  if (profileThread) {
-    // We need to create the ThreadProfile now
-    info->SetProfile(new ThreadProfile(info->Name(),
-                                       sActiveSampler->EntrySize(),
-                                       info->Stack(),
-                                       info->ThreadId(),
-                                       info->GetPlatformData(),
-                                       aIsMainThread));
-    if (sActiveSampler->ProfileJS()) {
-      info->Profile()->GetPseudoStack()->enableJSSampling();
-    }
+  if (sActiveSampler) {
+    sActiveSampler->RegisterThread(info);
   }
 
   sRegisteredThreads->push_back(info);
@@ -420,7 +408,8 @@ const int SIGSTART = SIGUSR1;
 
 static void StartSignalHandler(int signal, siginfo_t* info, void* context) {
   profiler_start(PROFILE_DEFAULT_ENTRY, PROFILE_DEFAULT_INTERVAL,
-                 PROFILE_DEFAULT_FEATURES, PROFILE_DEFAULT_FEATURE_COUNT);
+                 PROFILE_DEFAULT_FEATURES, PROFILE_DEFAULT_FEATURE_COUNT,
+                 NULL, 0);
 }
 
 void OS::RegisterStartHandler()
diff --git a/tools/profiler/platform-macos.cc b/tools/profiler/platform-macos.cc
index 8630f7c9b3e3..78c6425c641e 100644
--- a/tools/profiler/platform-macos.cc
+++ b/tools/profiler/platform-macos.cc
@@ -353,20 +353,8 @@ bool Sampler::RegisterCurrentThread(const char* aName,
   ThreadInfo* info = new ThreadInfo(aName, gettid(),
     aIsMainThread, aPseudoStack);
 
-  bool profileThread = sActiveSampler &&
-    (aIsMainThread || sActiveSampler->ProfileThreads());
-
-  if (profileThread) {
-    // We need to create the ThreadProfile now
-    info->SetProfile(new ThreadProfile(info->Name(),
-                                       sActiveSampler->EntrySize(),
-                                       info->Stack(),
-                                       info->ThreadId(),
-                                       info->GetPlatformData(),
-                                       aIsMainThread));
-    if (sActiveSampler->ProfileJS()) {
-      info->Profile()->GetPseudoStack()->enableJSSampling();
-    }
+  if (sActiveSampler) {
+    sActiveSampler->RegisterThread(info);
   }
 
   sRegisteredThreads->push_back(info);
diff --git a/tools/profiler/platform-win32.cc b/tools/profiler/platform-win32.cc
index 00e5ff15c22f..11184626e225 100644
--- a/tools/profiler/platform-win32.cc
+++ b/tools/profiler/platform-win32.cc
@@ -274,20 +274,8 @@ bool Sampler::RegisterCurrentThread(const char* aName,
   ThreadInfo* info = new ThreadInfo(aName, GetCurrentThreadId(),
     aIsMainThread, aPseudoStack);
 
-  bool profileThread = sActiveSampler &&
-    (aIsMainThread || sActiveSampler->ProfileThreads());
-
-  if (profileThread) {
-    // We need to create the ThreadProfile now
-    info->SetProfile(new ThreadProfile(info->Name(),
-                                       sActiveSampler->EntrySize(),
-                                       info->Stack(),
-                                       GetCurrentThreadId(),
-                                       info->GetPlatformData(),
-                                       aIsMainThread));
-    if (sActiveSampler->ProfileJS()) {
-      info->Profile()->GetPseudoStack()->enableJSSampling();
-    }
+  if (sActiveSampler) {
+    sActiveSampler->RegisterThread(info);
   }
 
   sRegisteredThreads->push_back(info);
diff --git a/tools/profiler/platform.cpp b/tools/profiler/platform.cpp
index 259cb33c6f02..7ea2fe8105c7 100644
--- a/tools/profiler/platform.cpp
+++ b/tools/profiler/platform.cpp
@@ -303,7 +303,9 @@ void mozilla_sampler_init(void* stackTop)
 #endif
                          };
   profiler_start(PROFILE_DEFAULT_ENTRY, PROFILE_DEFAULT_INTERVAL,
-                         features, sizeof(features)/sizeof(const char*));
+                         features, sizeof(features)/sizeof(const char*),
+                         // TODO Add env variable to select threads
+                         NULL, 0);
   LOG("END   mozilla_sampler_init");
 }
 
@@ -414,7 +416,9 @@ const char** mozilla_sampler_get_features()
 
 // Values are only honored on the first start
 void mozilla_sampler_start(int aProfileEntries, int aInterval,
-                           const char** aFeatures, uint32_t aFeatureCount)
+                           const char** aFeatures, uint32_t aFeatureCount,
+                           const char** aThreadNameFilters, uint32_t aFilterCount)
+
 {
   if (!stack_key_initialized)
     profiler_init(NULL);
@@ -430,7 +434,8 @@ void mozilla_sampler_start(int aProfileEntries, int aInterval,
   TableTicker* t;
   t = new TableTicker(aInterval ? aInterval : PROFILE_DEFAULT_INTERVAL,
                       aProfileEntries ? aProfileEntries : PROFILE_DEFAULT_ENTRY,
-                      aFeatures, aFeatureCount);
+                      aFeatures, aFeatureCount,
+                      aThreadNameFilters, aFilterCount);
   if (t->HasUnwinderThread()) {
     // Create the unwinder thread.  ATM there is only one.
     uwt__init();

From 86a703d64bc2070a0b71237a0da2d4c4f90ecace Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Mon, 17 Jun 2013 18:51:38 -0600
Subject: [PATCH 50/75] Bug 883973 - Try disabling PGO around
 InlineFrameIteratorMaybeGC::findNextFrame, r=djvj.

---
 js/src/ion/IonFrames.cpp | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/js/src/ion/IonFrames.cpp b/js/src/ion/IonFrames.cpp
index 310e1870303d..3a4f6f68453b 100644
--- a/js/src/ion/IonFrames.cpp
+++ b/js/src/ion/IonFrames.cpp
@@ -1225,6 +1225,11 @@ InlineFrameIteratorMaybeGC<allowGC>::resetOn(const IonFrameIterator *iter)
 template void InlineFrameIteratorMaybeGC<NoGC>::resetOn(const IonFrameIterator *iter);
 template void InlineFrameIteratorMaybeGC<CanGC>::resetOn(const IonFrameIterator *iter);
 
+// Disable PGO.
+#if defined(_MSC_VER)
+# pragma optimize("g", off)
+#endif
+
 template <AllowGC allowGC>
 void
 InlineFrameIteratorMaybeGC<allowGC>::findNextFrame()
@@ -1281,6 +1286,11 @@ InlineFrameIteratorMaybeGC<allowGC>::findNextFrame()
 template void InlineFrameIteratorMaybeGC<NoGC>::findNextFrame();
 template void InlineFrameIteratorMaybeGC<CanGC>::findNextFrame();
 
+// Reenable default optimization flags.
+#if defined(_MSC_VER)
+# pragma optimize("", on)
+#endif
+
 template <AllowGC allowGC>
 bool
 InlineFrameIteratorMaybeGC<allowGC>::isFunctionFrame() const

From 8f4e494194bfa058c2bb56369891e7d205e57c43 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Mon, 17 Jun 2013 17:54:55 -0700
Subject: [PATCH 51/75] Bug 883466 - Followup fix for failure on TBPL that does
 not reproduce locally; r=njn

--HG--
extra : rebase_source : bb2f18dd6acee248070a05998bdc541e7eeedbab
---
 js/src/gc/Nursery.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
index a62953210bdf..79640889e102 100644
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -16,6 +16,8 @@
 #include "gc/Memory.h"
 #include "vm/Debugger.h"
 
+#include "jscompartmentinlines.h"
+
 #include "gc/Barrier-inl.h"
 #include "gc/Nursery-inl.h"
 

From 486d201e1a64111e78fc528ea5870e525faaa2bd Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Mon, 17 Jun 2013 19:22:38 -0400
Subject: [PATCH 52/75] Bug 884020 - Don't use the register keyword in SVG code
 in order to fix the build with recent clangs; r=dholbert

---
 content/svg/content/src/SVGFETurbulenceElement.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/svg/content/src/SVGFETurbulenceElement.cpp b/content/svg/content/src/SVGFETurbulenceElement.cpp
index 098e4c0c9346..6b8e9f8d4bcd 100644
--- a/content/svg/content/src/SVGFETurbulenceElement.cpp
+++ b/content/svg/content/src/SVGFETurbulenceElement.cpp
@@ -264,7 +264,7 @@ SVGFETurbulenceElement::Noise2(int aColorChannel, double aVec[2],
 {
   int bx0, bx1, by0, by1, b00, b10, b01, b11;
   double rx0, rx1, ry0, ry1, *q, sx, sy, a, b, t, u, v;
-  register long i, j;
+  long i, j;
   t = aVec[0] + sPerlinN;
   bx0 = (int) t;
   bx1 = bx0 + 1;

From a8c66f4e83f076f9d7272f333de0966eb6a96c64 Mon Sep 17 00:00:00 2001
From: Aryeh Gregor <ayg@aryeh.name>
Date: Mon, 17 Jun 2013 21:23:53 -0400
Subject: [PATCH 53/75] Bug 674927 part 1 - Add reftests for spellcheck in
 contenteditable; r=ehsan

---
 editor/reftests/reftest.list                   | 17 +++++++++++++++++
 ...k-contenteditable-attr-dynamic-inherit.html | 11 +++++++++++
 ...editable-attr-dynamic-override-inherit.html | 11 +++++++++++
 ...-contenteditable-attr-dynamic-override.html | 11 +++++++++++
 ...pellcheck-contenteditable-attr-dynamic.html | 11 +++++++++++
 ...pellcheck-contenteditable-attr-inherit.html |  6 ++++++
 .../spellcheck-contenteditable-attr.html       |  6 ++++++
 ...k-contenteditable-disabled-partial-ref.html | 12 ++++++++++++
 ...check-contenteditable-disabled-partial.html | 11 +++++++++++
 ...pellcheck-contenteditable-disabled-ref.html |  6 ++++++
 .../spellcheck-contenteditable-disabled.html   | 11 +++++++++++
 ...lcheck-contenteditable-focused-reframe.html | 18 ++++++++++++++++++
 .../spellcheck-contenteditable-focused.html    | 13 +++++++++++++
 ...spellcheck-contenteditable-nofocus-ref.html |  6 ++++++
 .../spellcheck-contenteditable-nofocus.html    |  6 ++++++
 ...ntenteditable-property-dynamic-inherit.html | 11 +++++++++++
 ...able-property-dynamic-override-inherit.html | 11 +++++++++++
 ...tenteditable-property-dynamic-override.html | 11 +++++++++++
 ...check-contenteditable-property-dynamic.html | 11 +++++++++++
 .../spellcheck-contenteditable-ref.html        | 11 +++++++++++
 20 files changed, 211 insertions(+)
 create mode 100644 editor/reftests/spellcheck-contenteditable-attr-dynamic-inherit.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-attr-dynamic-override-inherit.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-attr-dynamic-override.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-attr-dynamic.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-attr-inherit.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-attr.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-disabled-partial-ref.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-disabled-partial.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-disabled-ref.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-disabled.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-focused-reframe.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-focused.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-nofocus-ref.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-nofocus.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-property-dynamic-inherit.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-property-dynamic-override-inherit.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-property-dynamic-override.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-property-dynamic.html
 create mode 100644 editor/reftests/spellcheck-contenteditable-ref.html

diff --git a/editor/reftests/reftest.list b/editor/reftests/reftest.list
index ae4fd7b18d15..0c2428858974 100644
--- a/editor/reftests/reftest.list
+++ b/editor/reftests/reftest.list
@@ -108,3 +108,20 @@ needs-focus != 824080-4.html 824080-5.html
 needs-focus == 824080-6.html 824080-6-ref.html
 needs-focus == 824080-7.html 824080-7-ref.html
 needs-focus != 824080-6.html 824080-7.html
+# Bug 674927: copy spellcheck-textarea tests to contenteditable
+== spellcheck-contenteditable-attr.html spellcheck-contenteditable-nofocus-ref.html
+fails-if(Android) != spellcheck-contenteditable-attr.html spellcheck-contenteditable-ref.html
+needs-focus == spellcheck-contenteditable-focused.html spellcheck-contenteditable-ref.html
+needs-focus == spellcheck-contenteditable-focused-reframe.html spellcheck-contenteditable-ref.html
+== spellcheck-contenteditable-nofocus.html spellcheck-contenteditable-disabled-ref.html
+fails == spellcheck-contenteditable-disabled.html spellcheck-contenteditable-disabled-ref.html
+fails == spellcheck-contenteditable-disabled-partial.html spellcheck-contenteditable-disabled-partial-ref.html
+== spellcheck-contenteditable-attr-inherit.html spellcheck-contenteditable-disabled-ref.html
+== spellcheck-contenteditable-attr-dynamic.html spellcheck-contenteditable-disabled-ref.html
+== spellcheck-contenteditable-attr-dynamic-inherit.html spellcheck-contenteditable-disabled-ref.html
+== spellcheck-contenteditable-property-dynamic.html spellcheck-contenteditable-disabled-ref.html
+== spellcheck-contenteditable-property-dynamic-inherit.html spellcheck-contenteditable-disabled-ref.html
+== spellcheck-contenteditable-attr-dynamic-override.html spellcheck-contenteditable-disabled-ref.html
+== spellcheck-contenteditable-attr-dynamic-override-inherit.html spellcheck-contenteditable-disabled-ref.html
+== spellcheck-contenteditable-property-dynamic-override.html spellcheck-contenteditable-disabled-ref.html
+== spellcheck-contenteditable-property-dynamic-override-inherit.html spellcheck-contenteditable-disabled-ref.html
diff --git a/editor/reftests/spellcheck-contenteditable-attr-dynamic-inherit.html b/editor/reftests/spellcheck-contenteditable-attr-dynamic-inherit.html
new file mode 100644
index 000000000000..aa4e47c2ca9a
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-attr-dynamic-inherit.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body onload="init()">
+    <div contenteditable>blahblahblah</div>
+    <script>
+      function init() {
+        document.body.setAttribute("spellcheck", "false");
+      }
+    </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-attr-dynamic-override-inherit.html b/editor/reftests/spellcheck-contenteditable-attr-dynamic-override-inherit.html
new file mode 100644
index 000000000000..1b4a0ab3b933
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-attr-dynamic-override-inherit.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body onload="init()" spellcheck="true">
+    <div contenteditable>blahblahblah</div>
+    <script>
+      function init() {
+        document.body.setAttribute("spellcheck", "false");
+      }
+    </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-attr-dynamic-override.html b/editor/reftests/spellcheck-contenteditable-attr-dynamic-override.html
new file mode 100644
index 000000000000..e3a4d9077212
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-attr-dynamic-override.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body onload="init()">
+    <div contenteditable spellcheck="true">blahblahblah</div>
+    <script>
+      function init() {
+        document.querySelector("div").setAttribute("spellcheck", "false");
+      }
+    </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-attr-dynamic.html b/editor/reftests/spellcheck-contenteditable-attr-dynamic.html
new file mode 100644
index 000000000000..37ba9f651498
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-attr-dynamic.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body onload="init()">
+    <div contenteditable>blahblahblah</div>
+    <script>
+      function init() {
+        document.querySelector("div").setAttribute("spellcheck", "false");
+      }
+    </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-attr-inherit.html b/editor/reftests/spellcheck-contenteditable-attr-inherit.html
new file mode 100644
index 000000000000..6cbfcb3da3b7
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-attr-inherit.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <span spellcheck="false"><div contenteditable>blahblahblah</div></span>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-attr.html b/editor/reftests/spellcheck-contenteditable-attr.html
new file mode 100644
index 000000000000..df119a997577
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-attr.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <div contenteditable>blahblahblah</div>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-disabled-partial-ref.html b/editor/reftests/spellcheck-contenteditable-disabled-partial-ref.html
new file mode 100644
index 000000000000..30fe7a6bf9f6
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-disabled-partial-ref.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <span contenteditable>sakde</span> kreid <span contenteditable>slodv</span>
+  <script>
+    // Adding focus to the textbox should trigger a spellcheck
+    document.querySelector("span").focus();
+    document.querySelector("span + span").focus();
+    document.querySelector("span + span").blur();
+  </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-disabled-partial.html b/editor/reftests/spellcheck-contenteditable-disabled-partial.html
new file mode 100644
index 000000000000..c7b6c427c408
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-disabled-partial.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <div contenteditable>sakde <span spellcheck=false>kreid</span> slodv</div>
+  <script>
+    // Adding focus to the textbox should trigger a spellcheck
+    document.querySelector("div").focus();
+    document.querySelector("div").blur();
+  </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-disabled-ref.html b/editor/reftests/spellcheck-contenteditable-disabled-ref.html
new file mode 100644
index 000000000000..23571fa5e835
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-disabled-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <div>blahblahblah</div>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-disabled.html b/editor/reftests/spellcheck-contenteditable-disabled.html
new file mode 100644
index 000000000000..3794f5767cf6
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-disabled.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <div contenteditable spellcheck="false">blahblahblah</div>
+  <script>
+    // Adding focus to the textbox should trigger a spellcheck
+    document.querySelector("div").focus();
+    document.querySelector("div").blur();
+  </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-focused-reframe.html b/editor/reftests/spellcheck-contenteditable-focused-reframe.html
new file mode 100644
index 000000000000..733ee05bb361
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-focused-reframe.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+  <div contenteditable id="testBox" onfocus="reframe(this);">blahblahblah</div>
+  <script type="text/javascript">
+    function reframe(textbox) {
+      textbox.style.display = "none";
+      textbox.style.display = "";
+      textbox.clientWidth;
+    }
+    //Adding focus to the textbox should trigger a spellcheck
+    document.getElementById("testBox").focus();
+    document.getElementById("testBox").blur();
+  </script>
+  
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-focused.html b/editor/reftests/spellcheck-contenteditable-focused.html
new file mode 100644
index 000000000000..80866739974d
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-focused.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+  <div contenteditable id="testBox">blahblahblah</div>
+  <script type="text/javascript">
+    //Adding focus to the textbox should trigger a spellcheck
+    document.getElementById("testBox").focus();
+    document.getElementById("testBox").blur();
+  </script>
+  
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-nofocus-ref.html b/editor/reftests/spellcheck-contenteditable-nofocus-ref.html
new file mode 100644
index 000000000000..67241fb7f12b
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-nofocus-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <div contenteditable spellcheck="true">blahblahblah</div>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-nofocus.html b/editor/reftests/spellcheck-contenteditable-nofocus.html
new file mode 100644
index 000000000000..7e88dc3e1879
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-nofocus.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <div contenteditable>blahblahblah</div>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-property-dynamic-inherit.html b/editor/reftests/spellcheck-contenteditable-property-dynamic-inherit.html
new file mode 100644
index 000000000000..feb623dbb6e6
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-property-dynamic-inherit.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body onload="init()">
+    <div contenteditable>blahblahblah</div>
+    <script>
+      function init() {
+        document.body.spellcheck = false;
+      }
+    </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-property-dynamic-override-inherit.html b/editor/reftests/spellcheck-contenteditable-property-dynamic-override-inherit.html
new file mode 100644
index 000000000000..26c5a4223685
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-property-dynamic-override-inherit.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body onload="init()" spellcheck="true">
+    <div contenteditable>blahblahblah</div>
+    <script>
+      function init() {
+        document.body.spellcheck = false;
+      }
+    </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-property-dynamic-override.html b/editor/reftests/spellcheck-contenteditable-property-dynamic-override.html
new file mode 100644
index 000000000000..dd16894b8968
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-property-dynamic-override.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body onload="init()">
+    <div contenteditable spellcheck="true">blahblahblah</div>
+    <script>
+      function init() {
+        document.querySelector("div").spellcheck = false;
+      }
+    </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-property-dynamic.html b/editor/reftests/spellcheck-contenteditable-property-dynamic.html
new file mode 100644
index 000000000000..eaf2db29a63d
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-property-dynamic.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body onload="init()">
+    <div contenteditable>blahblahblah</div>
+    <script>
+      function init() {
+        document.querySelector("div").spellcheck = false;
+      }
+    </script>
+</body>
+</html>
diff --git a/editor/reftests/spellcheck-contenteditable-ref.html b/editor/reftests/spellcheck-contenteditable-ref.html
new file mode 100644
index 000000000000..d28dbcf96b6c
--- /dev/null
+++ b/editor/reftests/spellcheck-contenteditable-ref.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <div contenteditable spellcheck="true">blahblahblah</div>
+  <script type="text/javascript">
+    var box = document.getElementsByTagName("div")[0];
+    box.focus(); //Bring the textbox into focus, triggering a spellcheck
+    box.blur(); //Blur in order to make things similar to other tests otherwise
+  </script>
+</body>
+</html>

From 0549f6979330fd3819b54ccf63e9a354b575c53b Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Mon, 17 Jun 2013 18:43:01 -0700
Subject: [PATCH 54/75] Back out 090ebbb90a7f (bug 873914) for Android build
 bustage CLOSED TREE

---
 tools/profiler/GeckoProfiler.h     |  3 +-
 tools/profiler/GeckoProfilerFunc.h |  5 +--
 tools/profiler/GeckoProfilerImpl.h |  5 +--
 tools/profiler/TableTicker.h       | 64 ++++++------------------------
 tools/profiler/nsIProfiler.idl     |  6 +--
 tools/profiler/nsProfiler.cpp      |  7 +---
 tools/profiler/platform-linux.cc   | 19 +++++++--
 tools/profiler/platform-macos.cc   | 16 +++++++-
 tools/profiler/platform-win32.cc   | 16 +++++++-
 tools/profiler/platform.cpp        | 11 ++---
 10 files changed, 68 insertions(+), 84 deletions(-)

diff --git a/tools/profiler/GeckoProfiler.h b/tools/profiler/GeckoProfiler.h
index d5d28ad2c97a..e18e81e71288 100644
--- a/tools/profiler/GeckoProfiler.h
+++ b/tools/profiler/GeckoProfiler.h
@@ -95,8 +95,7 @@ static inline void profiler_shutdown() {};
 //       best to sample at this interval. The profiler visualization
 //       should represent the actual sampling accuracy.
 static inline void profiler_start(int aProfileEntries, int aInterval,
-                              const char** aFeatures, uint32_t aFeatureCount,
-                              const char** aThreadNameFilters, uint32_t aFilterCount) {}
+                              const char** aFeatures, uint32_t aFeatureCount) {}
 
 // Stop the profiler and discard the profile. Call 'profiler_save' before this
 // to retrieve the profile.
diff --git a/tools/profiler/GeckoProfilerFunc.h b/tools/profiler/GeckoProfilerFunc.h
index 831520f1d643..97f401eff260 100644
--- a/tools/profiler/GeckoProfilerFunc.h
+++ b/tools/profiler/GeckoProfilerFunc.h
@@ -21,9 +21,8 @@ inline void* mozilla_sampler_call_enter(const char *aInfo, void *aFrameAddress =
 inline void  mozilla_sampler_call_exit(void* handle);
 inline void  mozilla_sampler_add_marker(const char *aInfo);
 
-void mozilla_sampler_start(int aEntries, int aInterval,
-                           const char** aFeatures, uint32_t aFeatureCount,
-                           const char** aThreadNameFilters, uint32_t aFilterCount);
+void mozilla_sampler_start(int aEntries, int aInterval, const char** aFeatures,
+                            uint32_t aFeatureCount);
 
 void mozilla_sampler_stop();
 
diff --git a/tools/profiler/GeckoProfilerImpl.h b/tools/profiler/GeckoProfilerImpl.h
index 02e53ba8b493..484f4a8b55ff 100644
--- a/tools/profiler/GeckoProfilerImpl.h
+++ b/tools/profiler/GeckoProfilerImpl.h
@@ -65,10 +65,9 @@ void profiler_shutdown()
 
 static inline
 void profiler_start(int aProfileEntries, int aInterval,
-                       const char** aFeatures, uint32_t aFeatureCount,
-                       const char** aThreadNameFilters, uint32_t aFilterCount)
+                       const char** aFeatures, uint32_t aFeatureCount)
 {
-  mozilla_sampler_start(aProfileEntries, aInterval, aFeatures, aFeatureCount, aThreadNameFilters, aFilterCount);
+  mozilla_sampler_start(aProfileEntries, aInterval, aFeatures, aFeatureCount);
 }
 
 static inline
diff --git a/tools/profiler/TableTicker.h b/tools/profiler/TableTicker.h
index 0684a2c5aa39..bb3b84c99874 100644
--- a/tools/profiler/TableTicker.h
+++ b/tools/profiler/TableTicker.h
@@ -16,22 +16,6 @@ hasFeature(const char** aFeatures, uint32_t aFeatureCount, const char* aFeature)
   return false;
 }
 
-static bool
-threadSelected(ThreadInfo* aInfo, char** aThreadNameFilters, uint32_t aFeatureCount) {
-  if (aFeatureCount == 0) {
-    return true;
-  }
-
-  for (uint32_t i = 0; i < aFeatureCount; ++i) {
-    const char* filterPrefix = aThreadNameFilters[i];
-    if (strncmp(aInfo->Name(), filterPrefix, strlen(filterPrefix)) == 0) {
-      return true;
-    }
-  }
-
-  return false;
-}
-
 extern TimeStamp sLastTracerEvent;
 extern int sFrameNumber;
 extern int sLastFrameNumber;
@@ -43,13 +27,11 @@ class BreakpadSampler;
 class TableTicker: public Sampler {
  public:
   TableTicker(int aInterval, int aEntrySize,
-              const char** aFeatures, uint32_t aFeatureCount,
-              const char** aThreadNameFilters, uint32_t aFilterCount)
+              const char** aFeatures, uint32_t aFeatureCount)
     : Sampler(aInterval, true, aEntrySize)
     , mPrimaryThreadProfile(nullptr)
     , mSaveRequested(false)
     , mUnwinderThread(false)
-    , mFilterCount(aFilterCount)
   {
     mUseStackWalk = hasFeature(aFeatures, aFeatureCount, "stackwalk");
 
@@ -63,12 +45,6 @@ class TableTicker: public Sampler {
     mPrivacyMode = hasFeature(aFeatures, aFeatureCount, "privacy");
     mAddMainThreadIO = hasFeature(aFeatures, aFeatureCount, "mainthreadio");
 
-    // Deep copy aThreadNameFilters
-    mThreadNameFilters = new char*[aFilterCount];
-    for (uint32_t i = 0; i < aFilterCount; ++i) {
-      mThreadNameFilters[i] = strdup(aThreadNameFilters[i]);
-    }
-
     sStartTime = TimeStamp::Now();
 
     {
@@ -78,7 +54,18 @@ class TableTicker: public Sampler {
       for (uint32_t i = 0; i < sRegisteredThreads->size(); i++) {
         ThreadInfo* info = sRegisteredThreads->at(i);
 
-        RegisterThread(info);
+        if (!info->IsMainThread() && !mProfileThreads)
+          continue;
+
+        ThreadProfile* profile = new ThreadProfile(info->Name(),
+                                                   aEntrySize,
+                                                   info->Stack(),
+                                                   info->ThreadId(),
+                                                   info->GetPlatformData(),
+                                                   info->IsMainThread());
+        profile->addTag(ProfileEntry('m', "Start"));
+
+        info->SetProfile(profile);
       }
 
       SetActiveSampler(this);
@@ -106,26 +93,6 @@ class TableTicker: public Sampler {
     }
   }
 
-  void RegisterThread(ThreadInfo* aInfo) {
-    if (!aInfo->IsMainThread() && !mProfileThreads) {
-      return;
-    }
-
-    if (!threadSelected(aInfo, mThreadNameFilters, mFilterCount)) {
-      return;
-    }
-
-    ThreadProfile* profile = new ThreadProfile(aInfo->Name(),
-                                               EntrySize(),
-                                               aInfo->Stack(),
-                                               aInfo->ThreadId(),
-                                               aInfo->GetPlatformData(),
-                                               aInfo->IsMainThread());
-    profile->addTag(ProfileEntry('m', "Start"));
-
-    aInfo->SetProfile(profile);
-  }
-
   // Called within a signal. This function must be reentrant
   virtual void Tick(TickSample* sample);
 
@@ -187,11 +154,6 @@ protected:
   bool mProfileThreads;
   bool mUnwinderThread;
   bool mProfileJava;
-
-  // Keep the thread filter to check against new thread that
-  // are started while profiling
-  char** mThreadNameFilters;
-  uint32_t mFilterCount;
   bool mPrivacyMode;
   bool mAddMainThreadIO;
 };
diff --git a/tools/profiler/nsIProfiler.idl b/tools/profiler/nsIProfiler.idl
index e7ec6526467b..acf2813fc548 100644
--- a/tools/profiler/nsIProfiler.idl
+++ b/tools/profiler/nsIProfiler.idl
@@ -5,14 +5,12 @@
  
 #include "nsISupports.idl"
 
-[scriptable, uuid(eb77a9b0-285f-472c-93b0-04db5e9e3e7e)]
+[scriptable, uuid(c94651cf-082f-45e2-9481-33a1a700b46a)]
 interface nsIProfiler : nsISupports
 {
   void StartProfiler(in uint32_t aEntries, in uint32_t aInterval,
                       [array, size_is(aFeatureCount)] in string aFeatures,
-                      in uint32_t aFeatureCount,
-                      [array, size_is(aFilterCount), optional] in string aThreadNameFilters,
-                      [optional] in uint32_t aFilterCount);
+                      in uint32_t aFeatureCount);
   void StopProfiler();
   void AddMarker(in string aMarker);
   string GetProfile();
diff --git a/tools/profiler/nsProfiler.cpp b/tools/profiler/nsProfiler.cpp
index 73016f332e5a..c075ce2cddb0 100644
--- a/tools/profiler/nsProfiler.cpp
+++ b/tools/profiler/nsProfiler.cpp
@@ -71,16 +71,13 @@ nsProfiler::Observe(nsISupports *aSubject,
 
 NS_IMETHODIMP
 nsProfiler::StartProfiler(uint32_t aEntries, uint32_t aInterval,
-                          const char** aFeatures, uint32_t aFeatureCount,
-                          const char** aThreadNameFilters, uint32_t aFilterCount)
+                          const char** aFeatures, uint32_t aFeatureCount)
 {
   if (mLockedForPrivateBrowsing) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  profiler_start(aEntries, aInterval,
-                 aFeatures, aFeatureCount,
-                 aThreadNameFilters, aFilterCount);
+  profiler_start(aEntries, aInterval, aFeatures, aFeatureCount);
 #ifdef MOZ_INSTRUMENT_EVENT_LOOP
   bool printToConsole = false;
   mozilla::InitEventTracing(printToConsole);
diff --git a/tools/profiler/platform-linux.cc b/tools/profiler/platform-linux.cc
index ef0f68b1bb9f..8676e573dac8 100644
--- a/tools/profiler/platform-linux.cc
+++ b/tools/profiler/platform-linux.cc
@@ -371,8 +371,20 @@ bool Sampler::RegisterCurrentThread(const char* aName,
   ThreadInfo* info = new ThreadInfo(aName, gettid(),
     aIsMainThread, aPseudoStack);
 
-  if (sActiveSampler) {
-    sActiveSampler->RegisterThread(info);
+  bool profileThread = sActiveSampler &&
+    (aIsMainThread || sActiveSampler->ProfileThreads());
+
+  if (profileThread) {
+    // We need to create the ThreadProfile now
+    info->SetProfile(new ThreadProfile(info->Name(),
+                                       sActiveSampler->EntrySize(),
+                                       info->Stack(),
+                                       info->ThreadId(),
+                                       info->GetPlatformData(),
+                                       aIsMainThread));
+    if (sActiveSampler->ProfileJS()) {
+      info->Profile()->GetPseudoStack()->enableJSSampling();
+    }
   }
 
   sRegisteredThreads->push_back(info);
@@ -408,8 +420,7 @@ const int SIGSTART = SIGUSR1;
 
 static void StartSignalHandler(int signal, siginfo_t* info, void* context) {
   profiler_start(PROFILE_DEFAULT_ENTRY, PROFILE_DEFAULT_INTERVAL,
-                 PROFILE_DEFAULT_FEATURES, PROFILE_DEFAULT_FEATURE_COUNT,
-                 NULL, 0);
+                 PROFILE_DEFAULT_FEATURES, PROFILE_DEFAULT_FEATURE_COUNT);
 }
 
 void OS::RegisterStartHandler()
diff --git a/tools/profiler/platform-macos.cc b/tools/profiler/platform-macos.cc
index 78c6425c641e..8630f7c9b3e3 100644
--- a/tools/profiler/platform-macos.cc
+++ b/tools/profiler/platform-macos.cc
@@ -353,8 +353,20 @@ bool Sampler::RegisterCurrentThread(const char* aName,
   ThreadInfo* info = new ThreadInfo(aName, gettid(),
     aIsMainThread, aPseudoStack);
 
-  if (sActiveSampler) {
-    sActiveSampler->RegisterThread(info);
+  bool profileThread = sActiveSampler &&
+    (aIsMainThread || sActiveSampler->ProfileThreads());
+
+  if (profileThread) {
+    // We need to create the ThreadProfile now
+    info->SetProfile(new ThreadProfile(info->Name(),
+                                       sActiveSampler->EntrySize(),
+                                       info->Stack(),
+                                       info->ThreadId(),
+                                       info->GetPlatformData(),
+                                       aIsMainThread));
+    if (sActiveSampler->ProfileJS()) {
+      info->Profile()->GetPseudoStack()->enableJSSampling();
+    }
   }
 
   sRegisteredThreads->push_back(info);
diff --git a/tools/profiler/platform-win32.cc b/tools/profiler/platform-win32.cc
index 11184626e225..00e5ff15c22f 100644
--- a/tools/profiler/platform-win32.cc
+++ b/tools/profiler/platform-win32.cc
@@ -274,8 +274,20 @@ bool Sampler::RegisterCurrentThread(const char* aName,
   ThreadInfo* info = new ThreadInfo(aName, GetCurrentThreadId(),
     aIsMainThread, aPseudoStack);
 
-  if (sActiveSampler) {
-    sActiveSampler->RegisterThread(info);
+  bool profileThread = sActiveSampler &&
+    (aIsMainThread || sActiveSampler->ProfileThreads());
+
+  if (profileThread) {
+    // We need to create the ThreadProfile now
+    info->SetProfile(new ThreadProfile(info->Name(),
+                                       sActiveSampler->EntrySize(),
+                                       info->Stack(),
+                                       GetCurrentThreadId(),
+                                       info->GetPlatformData(),
+                                       aIsMainThread));
+    if (sActiveSampler->ProfileJS()) {
+      info->Profile()->GetPseudoStack()->enableJSSampling();
+    }
   }
 
   sRegisteredThreads->push_back(info);
diff --git a/tools/profiler/platform.cpp b/tools/profiler/platform.cpp
index 7ea2fe8105c7..259cb33c6f02 100644
--- a/tools/profiler/platform.cpp
+++ b/tools/profiler/platform.cpp
@@ -303,9 +303,7 @@ void mozilla_sampler_init(void* stackTop)
 #endif
                          };
   profiler_start(PROFILE_DEFAULT_ENTRY, PROFILE_DEFAULT_INTERVAL,
-                         features, sizeof(features)/sizeof(const char*),
-                         // TODO Add env variable to select threads
-                         NULL, 0);
+                         features, sizeof(features)/sizeof(const char*));
   LOG("END   mozilla_sampler_init");
 }
 
@@ -416,9 +414,7 @@ const char** mozilla_sampler_get_features()
 
 // Values are only honored on the first start
 void mozilla_sampler_start(int aProfileEntries, int aInterval,
-                           const char** aFeatures, uint32_t aFeatureCount,
-                           const char** aThreadNameFilters, uint32_t aFilterCount)
-
+                           const char** aFeatures, uint32_t aFeatureCount)
 {
   if (!stack_key_initialized)
     profiler_init(NULL);
@@ -434,8 +430,7 @@ void mozilla_sampler_start(int aProfileEntries, int aInterval,
   TableTicker* t;
   t = new TableTicker(aInterval ? aInterval : PROFILE_DEFAULT_INTERVAL,
                       aProfileEntries ? aProfileEntries : PROFILE_DEFAULT_ENTRY,
-                      aFeatures, aFeatureCount,
-                      aThreadNameFilters, aFilterCount);
+                      aFeatures, aFeatureCount);
   if (t->HasUnwinderThread()) {
     // Create the unwinder thread.  ATM there is only one.
     uwt__init();

From 0f4f7601bd57efedbc3efc5e42d12ef09beaad0e Mon Sep 17 00:00:00 2001
From: Nicholas Cameron <ncameron@mozilla.com>
Date: Tue, 18 Jun 2013 14:18:55 +1200
Subject: [PATCH 55/75] Bug 883687; fix typo in 'Found unexpected crash dump'
 message . r=heycam

---
 layout/tools/reftest/reftest.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index d464f62e92e0..9d0763e0a398 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -1647,7 +1647,7 @@ function FindUnexpectedCrashDumpFiles()
                 gDumpLog("REFTEST TEST-UNEXPECTED-FAIL | " + gCurrentURL +
                          " | This test left crash dumps behind, but we weren't expecting it to!\n");
             }
-            gDumpLog("REFTEST INFO | Found unexpected crash dump file" + path +
+            gDumpLog("REFTEST INFO | Found unexpected crash dump file " + path +
                      ".\n");
             gUnexpectedCrashDumpFiles[path] = true;
         }

From 19c033f85593a72d65a7db18bb3d3b990a0ef1a2 Mon Sep 17 00:00:00 2001
From: Nicholas Cameron <ncameron@mozilla.com>
Date: Tue, 18 Jun 2013 14:18:55 +1200
Subject: [PATCH 56/75] Bug 849399. Adjust test timeouts to account for newly
 correct behaviour in nsTransitionManager.cpp. r=dbaron

---
 .../content/tests/chrome/bug451286_window.xul | 27 ++++++++++++++++---
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/toolkit/content/tests/chrome/bug451286_window.xul b/toolkit/content/tests/chrome/bug451286_window.xul
index 644f9cf94ae5..3f12061213d9 100644
--- a/toolkit/content/tests/chrome/bug451286_window.xul
+++ b/toolkit/content/tests/chrome/bug451286_window.xul
@@ -22,6 +22,10 @@
 
     var gFindBar = null;
     var gBrowser;
+    var gWin;
+
+    var noHighlightSnapshot;
+    var findSnapshot;
 
     var imports = ["SimpleTest", "ok", "snapshotWindow", "compareSnapshots",
                    "parentFinish"];
@@ -60,8 +64,8 @@
 
       // First, take a snapshot of the window without highlighting
       // to be used later to test the unhighlighting case
-      var gWin = gBrowser.contentWindow;
-      var noHighlightSnapshot = snapshotWindow(gWin);
+      gWin = gBrowser.contentWindow;
+      noHighlightSnapshot = snapshotWindow(gWin);
 
       gFindBar.open();
       gFindBar._findField.value = SEARCH_TEXT;
@@ -72,15 +76,30 @@
       // Turn on highlighting
       gFindBar.toggleHighlight(true);
       gFindBar.close();
-    
+      gFindBar.addEventListener('transitionend', part2);
+    }
+
+    function part2(aEvent) {
+      if (aEvent.propertyName != 'visibility') {
+        return;
+      }
+      gFindBar.removeEventListener('transitionend', part2);
       // Take snapshot of highlighing
-      var findSnapshot = snapshotWindow(gWin);
+      findSnapshot = snapshotWindow(gWin);
 
       // Now, remove the highlighting, and take a snapshot to compare
       // to our original state
       gFindBar.open();
       gFindBar.toggleHighlight(false);
       gFindBar.close();
+      gFindBar.addEventListener('transitionend', part3);
+    }
+
+    function part3(aEvent) {
+      if (aEvent.propertyName != 'visibility') {
+        return;
+      }
+      gFindBar.removeEventListener('transitionend', part3);
       var unhighlightSnapshot = snapshotWindow(gWin);
 
       // Select the matches that should have been highlighted manually

From d7baaf3e11c0370f1b8283935f350e69f531bca2 Mon Sep 17 00:00:00 2001
From: Nicholas Cameron <ncameron@mozilla.com>
Date: Tue, 18 Jun 2013 14:18:55 +1200
Subject: [PATCH 57/75] Bug 849399. Change reftest 598726-1 to only transition
 on transform; r=dbaron

---
 layout/reftests/bugs/598726-1.html | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/layout/reftests/bugs/598726-1.html b/layout/reftests/bugs/598726-1.html
index 08e228772ec9..c2c22365222a 100644
--- a/layout/reftests/bugs/598726-1.html
+++ b/layout/reftests/bugs/598726-1.html
@@ -3,26 +3,32 @@
   <head>
     <style type="text/css">
       input {
-          -webkit-transition: all 200ms ease-in-out;
-          -moz-transition: all 200ms ease-in-out;
-          transition: all 200ms ease-in-out;
+          -webkit-transition: -webkit-transform 200ms ease-in-out;
+          transition: transform 200ms ease-in-out;
       }
       input:focus {
           -webkit-transform: scale(1.05);
-          -moz-transform: scale(1.05);
           transform: scale(1.05);
       }
     </style>
     <script>
       function boom() {
         var i = document.querySelector("input");
-        i.addEventListener("transitionend", function() {
+        i.addEventListener("transitionend", function(aEvent) {
+          if (aEvent.propertyName != 'transform' &&
+              aEvent.propertyName != '-webkit-transform') {
+            return;
+          }
           i.removeEventListener("transitionend", arguments.callee, true);
           i.value = "test";
           i.getClientRects();
           i.value = "";
           i.getClientRects();
-          i.addEventListener("transitionend", function() {
+          i.addEventListener("transitionend", function(aEvent) {
+            if (aEvent.propertyName != 'transform' &&
+                aEvent.propertyName != '-webkit-transform') {
+              return;
+            }
             i.removeEventListener("transitionend", arguments.callee, true);
             i.getClientRects();
             document.documentElement.removeAttribute("class");

From a14102618aed55f1771da5ab5822e994d7a032d3 Mon Sep 17 00:00:00 2001
From: Nicholas Cameron <ncameron@mozilla.com>
Date: Tue, 18 Jun 2013 14:18:55 +1200
Subject: [PATCH 58/75] Bug 849399. Invalidate existing style rule if we start
 a transition. r=dbaron

---
 layout/style/nsTransitionManager.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/layout/style/nsTransitionManager.cpp b/layout/style/nsTransitionManager.cpp
index b35357e72307..7bb62d30e8fc 100644
--- a/layout/style/nsTransitionManager.cpp
+++ b/layout/style/nsTransitionManager.cpp
@@ -641,6 +641,8 @@ nsTransitionManager::StyleContextChanged(dom::Element *aElement,
     }
   }
 
+  et->mStyleRule = nullptr;
+
   return coverRule.forget();
 }
 

From 053882c4b73de52625f342172a274b730efb77fb Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Mon, 17 Jun 2013 14:00:50 -0700
Subject: [PATCH 59/75] Bug 883569 - X86 assembly spew fixes r=sstangl

---
 js/src/assembler/assembler/X86Assembler.h | 34 ++++++++++++-----------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/js/src/assembler/assembler/X86Assembler.h b/js/src/assembler/assembler/X86Assembler.h
index cb4f8c19632c..f2ba08226fcf 100644
--- a/js/src/assembler/assembler/X86Assembler.h
+++ b/js/src/assembler/assembler/X86Assembler.h
@@ -426,7 +426,7 @@ public:
 
     void push_i32(int imm)
     {
-        spew("pushl      %s$0x%x",
+        spew("push       %s$0x%x",
              PRETTY_PRINT_OFFSET(imm));
         m_formatter.oneByteOp(OP_PUSH_Iz);
         m_formatter.immediate32(imm);
@@ -447,13 +447,13 @@ public:
 
     void push_flags()
     {
-        spew("push flags register");
+        spew("pushf");
         m_formatter.oneByteOp(OP_PUSHFLAGS);
     }
 
     void pop_flags()
     {
-        spew("pop flags register");
+        spew("popf");
         m_formatter.oneByteOp(OP_POPFLAGS);
     }
 
@@ -799,7 +799,7 @@ public:
 
     void subl_mr(int offset, RegisterID base, RegisterID dst)
     {
-        spew("subl        %s0x%x(%s), %s",
+        spew("subl       %s0x%x(%s), %s",
              PRETTY_PRINT_OFFSET(offset), nameIReg(4,base), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_SUB_GvEv, dst, base, offset);
     }
@@ -1035,13 +1035,13 @@ public:
 
     void imull_rr(RegisterID src, RegisterID dst)
     {
-        spew("imull       %s, %s", nameIReg(4,src), nameIReg(4, dst));
+        spew("imull      %s, %s", nameIReg(4,src), nameIReg(4, dst));
         m_formatter.twoByteOp(OP2_IMUL_GvEv, dst, src);
     }
 
     void imull_mr(int offset, RegisterID base, RegisterID dst)
     {
-        spew("imull       %s0x%x(%s), %s",
+        spew("imull      %s0x%x(%s), %s",
              PRETTY_PRINT_OFFSET(offset), nameIReg(4,base), nameIReg(4,dst));
         m_formatter.twoByteOp(OP2_IMUL_GvEv, dst, base, offset);
     }
@@ -1307,12 +1307,14 @@ public:
 
     void testb_im(int imm, int offset, RegisterID base)
     {
+        FIXME_INSN_PRINTING;
         m_formatter.oneByteOp(OP_GROUP3_EbIb, GROUP3_OP_TEST, base, offset);
         m_formatter.immediate8(imm);
     }
 
     void testb_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
     {
+        FIXME_INSN_PRINTING;
         m_formatter.oneByteOp(OP_GROUP3_EbIb, GROUP3_OP_TEST, base, index, scale, offset);
         m_formatter.immediate8(imm);
     }
@@ -1410,7 +1412,7 @@ public:
 
     void cdq()
     {
-        spew("cdq              ");
+        spew("cdq        ");
         m_formatter.oneByteOp(OP_CDQ);
     }
 
@@ -1524,7 +1526,7 @@ public:
     void movl_i32r(int imm, RegisterID dst)
     {
         spew("movl       $0x%x, %s",
-             imm, nameIReg(dst));
+             imm, nameIReg(4, dst));
         m_formatter.oneByteOp(OP_MOV_EAXIv, dst);
         m_formatter.immediate32(imm);
     }
@@ -1857,7 +1859,7 @@ public:
         // In 64-bit, this may cause an unnecessary REX to be planted (if the dst register
         // is in the range ESP-EDI, and the src would not have required a REX).  Unneeded
         // REX prefixes are defined to be silently ignored by the processor.
-        spew("movzbl      %s, %s",
+        spew("movzbl     %s, %s",
              nameIReg(1,src), nameIReg(4,dst));
         m_formatter.twoByteOp8(OP2_MOVZX_GvEb, dst, src);
     }
@@ -2212,7 +2214,7 @@ public:
 
     void psrldq_ir(int shift, XMMRegisterID dest)
     {
-        spew("psrldq      $%d, %s",
+        spew("psrldq     $%d, %s",
              shift, nameFPReg(dest));
         m_formatter.prefix(PRE_SSE_66);
         m_formatter.twoByteOp(OP2_PSRLDQ_Vd, (RegisterID)3, (RegisterID)dest);
@@ -2328,7 +2330,7 @@ public:
 
     void movsd_rm(XMMRegisterID src, int offset, RegisterID base, RegisterID index, int scale)
     {
-        spew("movsd       %s, %d(%s,%s,%d)",
+        spew("movsd      %s, %d(%s,%s,%d)",
              nameFPReg(src), offset, nameIReg(base), nameIReg(index), 1<<scale);
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteOp(OP2_MOVSD_WsdVsd, (RegisterID)src, base, index, scale, offset);
@@ -2336,7 +2338,7 @@ public:
 
     void movss_rm(XMMRegisterID src, int offset, RegisterID base, RegisterID index, int scale)
     {
-        spew("movss       %s, %d(%s,%s,%d)",
+        spew("movss      %s, %d(%s,%s,%d)",
              nameFPReg(src), offset, nameIReg(base), nameIReg(index), 1<<scale);
         m_formatter.prefix(PRE_SSE_F3);
         m_formatter.twoByteOp(OP2_MOVSD_WsdVsd, (RegisterID)src, base, index, scale, offset);
@@ -2401,7 +2403,7 @@ public:
 #else
     JmpSrc movsd_ripr(XMMRegisterID dst)
     {
-        spew("movsd     \?(%%rip), %s",
+        spew("movsd      \?(%%rip), %s",
              nameFPReg(dst));
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteRipOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, 0);
@@ -2409,7 +2411,7 @@ public:
     }
     JmpSrc movsd_rrip(XMMRegisterID src)
     {
-        spew("movsd     %s, \?(%%rip)",
+        spew("movsd      %s, \?(%%rip)",
              nameFPReg(src));
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteRipOp(OP2_MOVSD_WsdVsd, (RegisterID)src, 0);
@@ -2427,7 +2429,7 @@ public:
 
     void movdqa_rm(XMMRegisterID src, int offset, RegisterID base, RegisterID index, int scale)
     {
-        spew("movdqa      %s, %d(%s,%s,%d)",
+        spew("movdqa     %s, %d(%s,%s,%d)",
              nameFPReg(src), offset, nameIReg(base), nameIReg(index), 1<<scale);
         m_formatter.prefix(PRE_SSE_66);
         m_formatter.twoByteOp(OP2_MOVDQA_WsdVsd, (RegisterID)src, base, index, scale, offset);
@@ -2555,7 +2557,7 @@ public:
 
     void roundsd_rr(XMMRegisterID src, XMMRegisterID dst, RoundingMode mode)
     {
-        spew("roundsd     %s, %s, %d",
+        spew("roundsd    %s, %s, %d",
              nameFPReg(src), nameFPReg(dst), (int)mode);
         m_formatter.prefix(PRE_SSE_66);
         m_formatter.threeByteOp(OP3_ROUNDSD_VsdWsd, ESCAPE_ROUNDSD, (RegisterID)dst, (RegisterID)src);

From edcdfc8b7dc5fabc2ae1dc0dd248c7109ac2f358 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Mon, 17 Jun 2013 18:31:47 -0700
Subject: [PATCH 60/75] Bug 883574 - Add const qualifiers to variables and
 pointers in the JS tree. r=evilpies

---
 js/jsd/jsd_text.cpp                           |  2 +-
 js/src/TraceLogging.cpp                       |  2 +-
 js/src/TraceLogging.h                         |  2 +-
 js/src/assembler/assembler/ARMAssembler.h     |  8 +--
 .../assembler/AbstractMacroAssembler.h        |  8 +--
 .../assembler/assembler/MacroAssemblerARM.h   |  2 +-
 .../assembler/assembler/MacroAssemblerARMv7.h |  2 +-
 .../assembler/MacroAssemblerCodeRef.h         |  2 +-
 .../assembler/assembler/MacroAssemblerMIPS.h  |  2 +-
 .../assembler/assembler/MacroAssemblerSparc.h |  2 +-
 .../assembler/MacroAssemblerX86_64.h          |  6 +--
 js/src/assembler/assembler/SparcAssembler.h   |  8 +--
 js/src/assembler/assembler/X86Assembler.h     | 50 +++++++++----------
 js/src/builtin/embedjs.py                     |  2 +-
 js/src/frontend/BytecodeEmitter.cpp           |  4 +-
 js/src/frontend/ParseNode.cpp                 |  4 +-
 js/src/frontend/SourceNotes.h                 |  2 +-
 js/src/gc/Statistics.cpp                      |  2 +-
 js/src/ion/IonCaches.cpp                      |  2 +-
 js/src/ion/IonSpewer.cpp                      |  2 +-
 js/src/ion/LIR.cpp                            |  4 +-
 js/src/ion/LiveRangeAllocator.h               |  4 +-
 js/src/ion/MIR.cpp                            |  2 +-
 js/src/ion/RegisterAllocator.h                | 12 ++---
 js/src/ion/VMFunctions.cpp                    |  2 +-
 js/src/ion/arm/Architecture-arm.h             |  8 +--
 js/src/ion/x64/Architecture-x64.h             | 16 +++---
 js/src/ion/x86/Architecture-x86.h             |  8 +--
 js/src/jsapi-tests/testArgumentsObject.cpp    |  2 +-
 js/src/jsapi.cpp                              | 16 +++---
 js/src/jsapi.h                                |  6 +--
 js/src/jsatom.cpp                             |  2 +-
 js/src/jsatom.h                               |  2 +-
 js/src/jsdate.cpp                             | 10 ++--
 js/src/jsexn.cpp                              |  2 +-
 js/src/jsgc.cpp                               |  6 +--
 js/src/jsgcinlines.h                          |  6 +--
 js/src/jsinfer.cpp                            | 12 ++---
 js/src/jsmath.cpp                             |  2 +-
 js/src/jsopcode.cpp                           | 19 +++----
 js/src/jsopcode.h                             |  6 +--
 js/src/jsreflect.cpp                          | 10 ++--
 js/src/jsreflect.h                            |  8 +--
 js/src/jsstr.cpp                              |  4 +-
 js/src/jsstr.h                                |  4 +-
 js/src/shell/js.cpp                           |  6 +--
 js/src/shell/jsoptparse.cpp                   |  8 +--
 js/src/yarr/YarrCanonicalizeUCS2.cpp          | 36 ++++++-------
 js/src/yarr/YarrCanonicalizeUCS2.h            | 18 +++----
 js/src/yarr/YarrPattern.cpp                   | 12 ++---
 js/xpconnect/src/XPCComponents.cpp            | 18 +++----
 js/xpconnect/src/XPCException.cpp             | 10 ++--
 js/xpconnect/src/XPCJSID.cpp                  |  4 +-
 js/xpconnect/src/XPCWrappedNative.cpp         |  2 +-
 js/xpconnect/src/xpcprivate.h                 | 10 ++--
 55 files changed, 204 insertions(+), 207 deletions(-)

diff --git a/js/jsd/jsd_text.cpp b/js/jsd/jsd_text.cpp
index ab11e82eac8b..cd6f58d9ae99 100644
--- a/js/jsd/jsd_text.cpp
+++ b/js/jsd/jsd_text.cpp
@@ -172,7 +172,7 @@ strncasecomp (const char* one, const char * two, int n)
     }
 }
 
-static char file_url_prefix[]    = "file:";
+static const char file_url_prefix[] = "file:";
 #define FILE_URL_PREFIX_LEN     (sizeof file_url_prefix - 1)
 
 char*
diff --git a/js/src/TraceLogging.cpp b/js/src/TraceLogging.cpp
index 1c64a67fd68d..7d6f8b09dd1d 100644
--- a/js/src/TraceLogging.cpp
+++ b/js/src/TraceLogging.cpp
@@ -61,7 +61,7 @@ js::rdtsc(void)
 }
 #endif
 
-const char* TraceLogging::type_name[] = {
+const char* const TraceLogging::type_name[] = {
     "start,ion_compile",
     "stop,ion_compile",
     "start,ion_cannon",
diff --git a/js/src/TraceLogging.h b/js/src/TraceLogging.h
index 2e6d5ba9ac38..e6e88943ce2c 100644
--- a/js/src/TraceLogging.h
+++ b/js/src/TraceLogging.h
@@ -61,7 +61,7 @@ class TraceLogging
     int fileno;
     FILE *out;
 
-    const static char *type_name[];
+    static const char * const type_name[];
     static TraceLogging* _defaultLogger;
   public:
     TraceLogging();
diff --git a/js/src/assembler/assembler/ARMAssembler.h b/js/src/assembler/assembler/ARMAssembler.h
index 2c1d712158d8..5edf0706b1b8 100644
--- a/js/src/assembler/assembler/ARMAssembler.h
+++ b/js/src/assembler/assembler/ARMAssembler.h
@@ -1203,7 +1203,7 @@ namespace JSC {
         {
             ASSERT(reg <= 16);
             ASSERT(reg >= 0);
-            static char const * names[] = {
+            static char const * const names[] = {
                 "r0", "r1", "r2", "r3",
                 "r4", "r5", "r6", "r7",
                 "r8", "r9", "r10", "r11",
@@ -1216,7 +1216,7 @@ namespace JSC {
         {
             ASSERT(reg <= 31);
             ASSERT(reg >= 0);
-            static char const * names[] = {
+            static char const * const names[] = {
                  "d0",   "d1",   "d2",   "d3",
                  "d4",   "d5",   "d6",   "d7",
                  "d8",   "d9",  "d10",  "d11",
@@ -1232,7 +1232,7 @@ namespace JSC {
         {
             ASSERT(reg <= 31);
             ASSERT(reg >= 0);
-            static char const * names[] = {
+            static char const * const names[] = {
                  "s0",   "s1",   "s2",   "s3",
                  "s4",   "s5",   "s6",   "s7",
                  "s8",   "s9",  "s10",  "s11",
@@ -1251,7 +1251,7 @@ namespace JSC {
             ASSERT((cc & 0x0fffffff) == 0);
 
             uint32_t    ccIndex = cc >> 28;
-            static char const * names[] = {
+            static char const * const names[] = {
                 "eq", "ne",
                 "cs", "cc",
                 "mi", "pl",
diff --git a/js/src/assembler/assembler/AbstractMacroAssembler.h b/js/src/assembler/assembler/AbstractMacroAssembler.h
index 2bfb275b6884..db42cdb9f3d9 100644
--- a/js/src/assembler/assembler/AbstractMacroAssembler.h
+++ b/js/src/assembler/assembler/AbstractMacroAssembler.h
@@ -157,12 +157,12 @@ public:
     // Describes an memory operand given by a pointer.  For regular load & store
     // operations an unwrapped void* will be used, rather than using this.
     struct AbsoluteAddress {
-        explicit AbsoluteAddress(void* ptr)
+        explicit AbsoluteAddress(const void* ptr)
             : m_ptr(ptr)
         {
         }
 
-        void* m_ptr;
+        const void* m_ptr;
     };
 
     // TrustedImmPtr:
@@ -408,12 +408,12 @@ public:
         {
         }
         
-        void link(AbstractMacroAssembler<AssemblerType>* masm)
+        void link(AbstractMacroAssembler<AssemblerType>* masm) const
         {
             masm->m_assembler.linkJump(m_jmp, masm->m_assembler.label());
         }
         
-        void linkTo(Label label, AbstractMacroAssembler<AssemblerType>* masm)
+        void linkTo(Label label, AbstractMacroAssembler<AssemblerType>* masm) const
         {
             masm->m_assembler.linkJump(m_jmp, label.m_label);
         }
diff --git a/js/src/assembler/assembler/MacroAssemblerARM.h b/js/src/assembler/assembler/MacroAssemblerARM.h
index 6e18c54b84dc..e3573ac05221 100644
--- a/js/src/assembler/assembler/MacroAssemblerARM.h
+++ b/js/src/assembler/assembler/MacroAssemblerARM.h
@@ -1029,7 +1029,7 @@ public:
         m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
-    void load32(void* address, RegisterID dest)
+    void load32(const void* address, RegisterID dest)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
         m_assembler.dtr_u(true, dest, ARMRegisters::S0, 0);
diff --git a/js/src/assembler/assembler/MacroAssemblerARMv7.h b/js/src/assembler/assembler/MacroAssemblerARMv7.h
index 0abeb2b31de0..0d13901d4d80 100644
--- a/js/src/assembler/assembler/MacroAssemblerARMv7.h
+++ b/js/src/assembler/assembler/MacroAssemblerARMv7.h
@@ -433,7 +433,7 @@ public:
         load32(setupArmAddress(address), dest);
     }
 
-    void load32(void* address, RegisterID dest)
+    void load32(const void* address, RegisterID dest)
     {
         move(ImmPtr(address), addressTempRegister);
         m_assembler.ldr(dest, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
diff --git a/js/src/assembler/assembler/MacroAssemblerCodeRef.h b/js/src/assembler/assembler/MacroAssemblerCodeRef.h
index bcf3903f9b13..41d42c698734 100644
--- a/js/src/assembler/assembler/MacroAssemblerCodeRef.h
+++ b/js/src/assembler/assembler/MacroAssemblerCodeRef.h
@@ -156,7 +156,7 @@ public:
     void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return m_value; }
 #endif
 
-    bool operator!()
+    bool operator!() const
     {
         return !m_value;
     }
diff --git a/js/src/assembler/assembler/MacroAssemblerMIPS.h b/js/src/assembler/assembler/MacroAssemblerMIPS.h
index 385606e17243..352489b5b2bb 100644
--- a/js/src/assembler/assembler/MacroAssemblerMIPS.h
+++ b/js/src/assembler/assembler/MacroAssemblerMIPS.h
@@ -861,7 +861,7 @@ public:
         }
     }
 
-    void load32(void* address, RegisterID dest)
+    void load32(const void* address, RegisterID dest)
     {
         /*
             li  addrTemp, address
diff --git a/js/src/assembler/assembler/MacroAssemblerSparc.h b/js/src/assembler/assembler/MacroAssemblerSparc.h
index 3692b3e0b272..919e4c8b5d07 100644
--- a/js/src/assembler/assembler/MacroAssemblerSparc.h
+++ b/js/src/assembler/assembler/MacroAssemblerSparc.h
@@ -1024,7 +1024,7 @@ namespace JSC {
             store32(SparcRegisters::g2, address.m_ptr);
         }
 
-        void load32(void* address, RegisterID dest)
+        void load32(const void* address, RegisterID dest)
         {
             m_assembler.move_nocheck((int)address, SparcRegisters::g3);
             m_assembler.lduw_r(SparcRegisters::g3, SparcRegisters::g0, dest);
diff --git a/js/src/assembler/assembler/MacroAssemblerX86_64.h b/js/src/assembler/assembler/MacroAssemblerX86_64.h
index c3be4145695a..b828755b4b31 100644
--- a/js/src/assembler/assembler/MacroAssemblerX86_64.h
+++ b/js/src/assembler/assembler/MacroAssemblerX86_64.h
@@ -86,7 +86,7 @@ public:
         sub32(imm, Address(scratchRegister));
     }
 
-    void load32(void* address, RegisterID dest)
+    void load32(const void* address, RegisterID dest)
     {
         if (dest == X86Registers::eax)
             m_assembler.movl_mEAX(address);
@@ -105,7 +105,7 @@ public:
 
     void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
     {
-        move(Imm32(*static_cast<int32_t*>(src.m_ptr)), scratchRegister);
+        move(Imm32(*static_cast<const int32_t*>(src.m_ptr)), scratchRegister);
         m_assembler.cvtsi2sd_rr(scratchRegister, dest);
     }
 
@@ -297,7 +297,7 @@ public:
         m_assembler.movq_mr(address.offset, address.base, address.index, address.scale, dest);
     }
 
-    void loadPtr(void* address, RegisterID dest)
+    void loadPtr(const void* address, RegisterID dest)
     {
         if (dest == X86Registers::eax)
             m_assembler.movq_mEAX(address);
diff --git a/js/src/assembler/assembler/SparcAssembler.h b/js/src/assembler/assembler/SparcAssembler.h
index 19217a7cafd0..dc8def96107b 100644
--- a/js/src/assembler/assembler/SparcAssembler.h
+++ b/js/src/assembler/assembler/SparcAssembler.h
@@ -1140,7 +1140,7 @@ namespace JSC {
         {
             ASSERT(reg <= 31);
             ASSERT(reg >= 0);
-            static char const * names[] = {
+            static char const * const names[] = {
                 "%g0", "%g1", "%g2", "%g3",
                 "%g4", "%g5", "%g6", "%g7",
                 "%o0", "%o1", "%o2", "%o3",
@@ -1157,7 +1157,7 @@ namespace JSC {
         {
             ASSERT(reg <= 31);
             ASSERT(reg >= 0);
-            static char const * names[] = {
+            static char const * const names[] = {
                 "%f0",   "%f1",   "%f2",   "%f3",
                 "%f4",   "%f5",   "%f6",   "%f7",
                 "%f8",   "%f9",  "%f10",  "%f11",
@@ -1176,7 +1176,7 @@ namespace JSC {
             ASSERT(cc >= 0);
 
             uint32_t    ccIndex = cc;
-            static char const * inames[] = {
+            static char const * const inames[] = {
                 "   ", "e  ",
                 "le ", "l  ",
                 "leu", "cs ",
@@ -1195,7 +1195,7 @@ namespace JSC {
             ASSERT(cc >= 0);
 
             uint32_t    ccIndex = cc;
-            static char const * fnames[] = {
+            static char const * const fnames[] = {
                 "   ", "ne ",
                 "   ", "ul ",
                 "l  ", "ug ",
diff --git a/js/src/assembler/assembler/X86Assembler.h b/js/src/assembler/assembler/X86Assembler.h
index f2ba08226fcf..b1a9e432bfaa 100644
--- a/js/src/assembler/assembler/X86Assembler.h
+++ b/js/src/assembler/assembler/X86Assembler.h
@@ -94,7 +94,7 @@ namespace X86Registers {
 
     static const char* nameFPReg(XMMRegisterID fpreg)
     {
-        static const char* xmmnames[16]
+        static const char* const xmmnames[16]
           = { "%xmm0", "%xmm1", "%xmm2", "%xmm3",
               "%xmm4", "%xmm5", "%xmm6", "%xmm7",
               "%xmm8", "%xmm9", "%xmm10", "%xmm11",
@@ -105,20 +105,20 @@ namespace X86Registers {
 
     static const char* nameIReg(int szB, RegisterID reg)
     {
-        static const char* r64names[16]
+        static const char* const r64names[16]
           = { "%rax", "%rcx", "%rdx", "%rbx", "%rsp", "%rbp", "%rsi", "%rdi",
               "%r8", "%r9", "%r10", "%r11", "%r12", "%r13", "%r14", "%r15" };
-        static const char* r32names[16]
+        static const char* const r32names[16]
           = { "%eax", "%ecx", "%edx", "%ebx", "%esp", "%ebp", "%esi", "%edi",
               "%r8d", "%r9d", "%r10d", "%r11d", "%r12d", "%r13d", "%r14d", "%r15d" };
-        static const char* r16names[16]
+        static const char* const r16names[16]
           = { "%ax", "%cx", "%dx", "%bx", "%sp", "%bp", "%si", "%di",
               "%r8w", "%r9w", "%r10w", "%r11w", "%r12w", "%r13w", "%r14w", "%r15w" };
-        static const char* r8names[16]
+        static const char* const r8names[16]
           = { "%al", "%cl", "%dl", "%bl", "%ah/spl", "%ch/bpl", "%dh/sil", "%bh/dil",
               "%r8b", "%r9b", "%r10b", "%r11b", "%r12b", "%r13b", "%r14b", "%r15b" };
         int          off = (RegisterID)reg - (RegisterID)eax;
-        const char** tab = r64names;
+        const char* const* tab = r64names;
         switch (szB) {
             case 1: tab = r8names; break;
             case 2: tab = r16names; break;
@@ -169,7 +169,7 @@ public:
 
     static const char* nameCC(Condition cc)
     {
-        static const char* names[16]
+        static const char* const names[16]
           = { "o ", "no", "b ", "ae", "e ", "ne", "be", "a ",
               "s ", "ns", "p ", "np", "l ", "ge", "le", "g " };
         int ix = (int)cc;
@@ -460,7 +460,7 @@ public:
     // Arithmetic operations:
 
 #if !WTF_CPU_X86_64
-    void adcl_im(int imm, void* addr)
+    void adcl_im(int imm, const void* addr)
     {
         FIXME_INSN_PRINTING;
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -558,7 +558,7 @@ public:
         }
     }
 #else
-    void addl_im(int imm, void* addr)
+    void addl_im(int imm, const void* addr)
     {
         FIXME_INSN_PRINTING;
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -649,7 +649,7 @@ public:
         }
     }
 #else
-    void andl_im(int imm, void* addr)
+    void andl_im(int imm, const void* addr)
     {
         FIXME_INSN_PRINTING;
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -777,7 +777,7 @@ public:
         m_formatter.oneByteOp64(OP_GROUP3_Ev, GROUP3_OP_NOT, dst);
     }
 #else
-    void orl_im(int imm, void* addr)
+    void orl_im(int imm, const void* addr)
     {
         FIXME_INSN_PRINTING;
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -862,7 +862,7 @@ public:
         }
     }
 #else
-    void subl_im(int imm, void* addr)
+    void subl_im(int imm, const void* addr)
     {
         FIXME_INSN_PRINTING;
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -1226,13 +1226,13 @@ public:
         }
     }
 #else
-    void cmpl_rm(RegisterID reg, void* addr)
+    void cmpl_rm(RegisterID reg, const void* addr)
     {
         FIXME_INSN_PRINTING;
         m_formatter.oneByteOp(OP_CMP_EvGv, reg, addr);
     }
 
-    void cmpl_im(int imm, void* addr)
+    void cmpl_im(int imm, const void* addr)
     {
         spew("cmpl       $0x%x, 0x%p", imm, addr);
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -1483,7 +1483,7 @@ public:
         m_formatter.oneByteOp(OP_MOV_EvGv, src, base, index, scale, offset);
     }
 
-    void movl_mEAX(void* addr)
+    void movl_mEAX(const void* addr)
     {
         FIXME_INSN_PRINTING;
         m_formatter.oneByteOp(OP_MOV_EAXOv);
@@ -1508,7 +1508,7 @@ public:
     }
 
 #if WTF_CPU_X86
-    void movl_mr(void* base, RegisterID index, int scale, RegisterID dst)
+    void movl_mr(const void* base, RegisterID index, int scale, RegisterID dst)
     {
         spew("movl       %d(%s,%d), %s",
              int(base), nameIReg(index), scale, nameIReg(dst));
@@ -1581,7 +1581,7 @@ public:
         m_formatter.immediate32(imm);
     }
 
-    void movl_EAXm(void* addr)
+    void movl_EAXm(const void* addr)
     {
         FIXME_INSN_PRINTING;
         m_formatter.oneByteOp(OP_MOV_OvEAX);
@@ -1620,14 +1620,14 @@ public:
         m_formatter.oneByteOp64(OP_MOV_EvGv, src, base, index, scale, offset);
     }
 
-    void movq_mEAX(void* addr)
+    void movq_mEAX(const void* addr)
     {
         FIXME_INSN_PRINTING;
         m_formatter.oneByteOp64(OP_MOV_EAXOv);
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
     }
 
-    void movq_EAXm(void* addr)
+    void movq_EAXm(const void* addr)
     {
         FIXME_INSN_PRINTING;
         m_formatter.oneByteOp64(OP_MOV_OvEAX);
@@ -1721,7 +1721,7 @@ public:
         return JmpSrc(m_formatter.size());
     }
 #else
-    void movl_rm(RegisterID src, void* addr)
+    void movl_rm(RegisterID src, const void* addr)
     {
         spew("movl       %s, 0(%p)",
              nameIReg(4, src), addr);
@@ -1731,7 +1731,7 @@ public:
             m_formatter.oneByteOp(OP_MOV_EvGv, src, addr);
     }
 
-    void movl_mr(void* addr, RegisterID dst)
+    void movl_mr(const void* addr, RegisterID dst)
     {
         spew("movl       0(%p), %s",
              addr, nameIReg(4, dst));
@@ -1741,7 +1741,7 @@ public:
             m_formatter.oneByteOp(OP_MOV_GvEv, dst, addr);
     }
 
-    void movl_i32m(int imm, void* addr)
+    void movl_i32m(int imm, const void* addr)
     {
         FIXME_INSN_PRINTING;
         m_formatter.oneByteOp(OP_GROUP11_EvIz, GROUP11_MOV, addr);
@@ -2170,7 +2170,7 @@ public:
     }
 
 #if !WTF_CPU_X86_64
-    void cvtsi2sd_mr(void* address, XMMRegisterID dst)
+    void cvtsi2sd_mr(const void* address, XMMRegisterID dst)
     {
         spew("cvtsi2sd   %p, %s",
              address, nameFPReg(dst));
@@ -2771,7 +2771,7 @@ public:
         setInt32(where, value);
     }
 
-    static void repatchPointer(void* where, void* value)
+    static void repatchPointer(void* where, const void* value)
     {
         staticSpew("##repatchPtr ((where=%p)) ((value=%p))",
                    where, value);
@@ -2977,7 +2977,7 @@ private:
         }
 
 #if !WTF_CPU_X86_64
-        void oneByteOp(OneByteOpcodeID opcode, int reg, void* address)
+        void oneByteOp(OneByteOpcodeID opcode, int reg, const void* address)
         {
             m_buffer.ensureSpace(maxInstructionSize);
             m_buffer.putByteUnchecked(opcode);
diff --git a/js/src/builtin/embedjs.py b/js/src/builtin/embedjs.py
index 6dd3d5454779..926ab891ab96 100644
--- a/js/src/builtin/embedjs.py
+++ b/js/src/builtin/embedjs.py
@@ -64,7 +64,7 @@ namespace js {
 namespace selfhosted {
     static const %(sources_type)s data[] = { %(sources_data)s };
 
-    static const %(sources_type)s *%(sources_name)s = reinterpret_cast<const %(sources_type)s *>(data);
+    static const %(sources_type)s * const %(sources_name)s = reinterpret_cast<const %(sources_type)s *>(data);
 
     uint32_t GetCompressedSize() {
         return %(compressed_total_length)i;
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index dc3522c1aac7..96b85132cbd4 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -286,7 +286,7 @@ const char js_with_statement_str[] = "with statement";
 const char js_finally_block_str[]  = "finally block";
 const char js_script_str[]         = "script";
 
-static const char *statementName[] = {
+static const char * const statementName[] = {
     "label statement",       /* LABEL */
     "if statement",          /* IF */
     "else statement",        /* ELSE */
@@ -6426,7 +6426,7 @@ CGConstList::finish(ConstArray *array)
  * We should try to get rid of offsetBias (always 0 or 1, where 1 is
  * JSOP_{NOP,POP}_LENGTH), which is used only by SRC_FOR.
  */
-JS_FRIEND_DATA(JSSrcNoteSpec) js_SrcNoteSpec[] = {
+JS_FRIEND_DATA(const JSSrcNoteSpec) js_SrcNoteSpec[] = {
 /*  0 */ {"null",           0},
 
 /*  1 */ {"if",             0},
diff --git a/js/src/frontend/ParseNode.cpp b/js/src/frontend/ParseNode.cpp
index 7c6381dbef0f..2089ec7fd4c4 100644
--- a/js/src/frontend/ParseNode.cpp
+++ b/js/src/frontend/ParseNode.cpp
@@ -374,7 +374,7 @@ NameNode::create(ParseNodeKind kind, JSAtom *atom, FullParseHandler *handler,
 const char *
 Definition::kindString(Kind kind)
 {
-    static const char *table[] = {
+    static const char * const table[] = {
         "", js_var_str, js_const_str, js_let_str, js_function_str, "argument", "unknown"
     };
 
@@ -575,7 +575,7 @@ Parser<FullParseHandler>::cloneLeftHandSide(ParseNode *opn)
 
 #ifdef DEBUG
 
-static const char *parseNodeNames[] = {
+static const char * const parseNodeNames[] = {
 #define STRINGIFY(name) #name,
     FOR_EACH_PARSE_NODE_KIND(STRINGIFY)
 #undef STRINGIFY
diff --git a/js/src/frontend/SourceNotes.h b/js/src/frontend/SourceNotes.h
index 01b72bba7b28..022f48d0d814 100644
--- a/js/src/frontend/SourceNotes.h
+++ b/js/src/frontend/SourceNotes.h
@@ -150,7 +150,7 @@ struct JSSrcNoteSpec {
     int8_t          arity;      /* number of offset operands */
 };
 
-extern JS_FRIEND_DATA(JSSrcNoteSpec)  js_SrcNoteSpec[];
+extern JS_FRIEND_DATA(const JSSrcNoteSpec) js_SrcNoteSpec[];
 extern JS_FRIEND_API(unsigned)         js_SrcNoteLength(jssrcnote *sn);
 
 /*
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index c00bbfbc7514..95ff99e35b76 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -278,7 +278,7 @@ struct PhaseInfo
 
 static const Phase PHASE_NO_PARENT = PHASE_LIMIT;
 
-static PhaseInfo phases[] = {
+static const PhaseInfo phases[] = {
     { PHASE_GC_BEGIN, "Begin Callback", PHASE_NO_PARENT },
     { PHASE_WAIT_BACKGROUND_THREAD, "Wait Background Thread", PHASE_NO_PARENT },
     { PHASE_MARK_DISCARD_CODE, "Mark Discard Code", PHASE_NO_PARENT },
diff --git a/js/src/ion/IonCaches.cpp b/js/src/ion/IonCaches.cpp
index 856d831f2f74..f9d75deebe71 100644
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -84,7 +84,7 @@ CodeOffsetJump::fixup(MacroAssembler *masm)
 const char *
 IonCache::CacheName(IonCache::Kind kind)
 {
-    static const char *names[] =
+    static const char * const names[] =
     {
 #define NAME(x) #x,
         IONCACHE_KIND_LIST(NAME)
diff --git a/js/src/ion/IonSpewer.cpp b/js/src/ion/IonSpewer.cpp
index a2b7f88dce59..98c6468641a7 100644
--- a/js/src/ion/IonSpewer.cpp
+++ b/js/src/ion/IonSpewer.cpp
@@ -31,7 +31,7 @@ static bool LoggingChecked = false;
 static uint32_t LoggingBits = 0;
 static uint32_t filteredOutCompilations = 0;
 
-static const char *ChannelNames[] =
+static const char * const ChannelNames[] =
 {
 #define IONSPEW_CHANNEL(name) #name,
     IONSPEW_CHANNEL_LIST(IONSPEW_CHANNEL)
diff --git a/js/src/ion/LIR.cpp b/js/src/ion/LIR.cpp
index 3ccd0dabd251..5705156dd6a9 100644
--- a/js/src/ion/LIR.cpp
+++ b/js/src/ion/LIR.cpp
@@ -170,7 +170,7 @@ LPhi::New(MIRGenerator *gen, MPhi *ins)
 void
 LInstruction::printName(FILE *fp, Opcode op)
 {
-    static const char *names[] =
+    static const char * const names[] =
     {
 #define LIROP(x) #x,
         LIR_OPCODE_LIST(LIROP)
@@ -188,7 +188,7 @@ LInstruction::printName(FILE *fp)
     printName(fp, op());
 }
 
-static const char *TypeChars[] =
+static const char * const TypeChars[] =
 {
     "i",            // INTEGER
     "o",            // OBJECT
diff --git a/js/src/ion/LiveRangeAllocator.h b/js/src/ion/LiveRangeAllocator.h
index 3c81bc90903a..2987b99f9df7 100644
--- a/js/src/ion/LiveRangeAllocator.h
+++ b/js/src/ion/LiveRangeAllocator.h
@@ -378,7 +378,7 @@ class VirtualRegister
             return false;
         return intervals_.append(initial);
     }
-    uint32_t id() {
+    uint32_t id() const {
         return id_;
     }
     LBlock *block() {
@@ -634,7 +634,7 @@ class LiveRangeAllocator : public RegisterAllocator
     }
 
     // Finds the first safepoint that is within range of an interval.
-    size_t findFirstSafepoint(LiveInterval *interval, size_t startFrom)
+    size_t findFirstSafepoint(const LiveInterval *interval, size_t startFrom) const
     {
         size_t i = startFrom;
         for (; i < graph.numSafepoints(); i++) {
diff --git a/js/src/ion/MIR.cpp b/js/src/ion/MIR.cpp
index a286633a1053..7786dd532a9f 100644
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -28,7 +28,7 @@ using mozilla::BitwiseCast;
 void
 MDefinition::PrintOpcodeName(FILE *fp, MDefinition::Opcode op)
 {
-    static const char *names[] =
+    static const char * const names[] =
     {
 #define NAME(x) #x,
         MIR_OPCODE_LIST(NAME)
diff --git a/js/src/ion/RegisterAllocator.h b/js/src/ion/RegisterAllocator.h
index 751479175827..20ea5bee662c 100644
--- a/js/src/ion/RegisterAllocator.h
+++ b/js/src/ion/RegisterAllocator.h
@@ -325,16 +325,16 @@ class RegisterAllocator
   protected:
     bool init();
 
-    CodePosition outputOf(uint32_t pos) {
+    CodePosition outputOf(uint32_t pos) const {
         return CodePosition(pos, CodePosition::OUTPUT);
     }
-    CodePosition outputOf(LInstruction *ins) {
+    CodePosition outputOf(const LInstruction *ins) const {
         return CodePosition(ins->id(), CodePosition::OUTPUT);
     }
-    CodePosition inputOf(uint32_t pos) {
+    CodePosition inputOf(uint32_t pos) const {
         return CodePosition(pos, CodePosition::INPUT);
     }
-    CodePosition inputOf(LInstruction *ins) {
+    CodePosition inputOf(const LInstruction *ins) const {
         return CodePosition(ins->id(), CodePosition::INPUT);
     }
 
@@ -348,11 +348,11 @@ class RegisterAllocator
         return getMoveGroupAfter(pos.ins());
     }
 
-    size_t findFirstNonCallSafepoint(CodePosition from)
+    size_t findFirstNonCallSafepoint(CodePosition from) const
     {
         size_t i = 0;
         for (; i < graph.numNonCallSafepoints(); i++) {
-            LInstruction *ins = graph.getNonCallSafepoint(i);
+            const LInstruction *ins = graph.getNonCallSafepoint(i);
             if (from <= inputOf(ins))
                 break;
         }
diff --git a/js/src/ion/VMFunctions.cpp b/js/src/ion/VMFunctions.cpp
index 6b86529daf94..2b1a5f9af5ec 100644
--- a/js/src/ion/VMFunctions.cpp
+++ b/js/src/ion/VMFunctions.cpp
@@ -562,7 +562,7 @@ FilterArguments(JSContext *cx, JSString *str)
     if (!chars)
         return false;
 
-    static jschar arguments[] = {'a', 'r', 'g', 'u', 'm', 'e', 'n', 't', 's'};
+    static const jschar arguments[] = {'a', 'r', 'g', 'u', 'm', 'e', 'n', 't', 's'};
     return !StringHasPattern(chars, str->length(), arguments, mozilla::ArrayLength(arguments));
 }
 
diff --git a/js/src/ion/arm/Architecture-arm.h b/js/src/ion/arm/Architecture-arm.h
index 0471efb88357..caab4b776391 100644
--- a/js/src/ion/arm/Architecture-arm.h
+++ b/js/src/ion/arm/Architecture-arm.h
@@ -75,8 +75,8 @@ class Registers
     typedef RegisterID Code;
 
     static const char *GetName(Code code) {
-        static const char *Names[] = { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
-                                       "r8", "r9", "r10", "r11", "r12", "sp", "r14", "pc"};
+        static const char * const Names[] = { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
+                                              "r8", "r9", "r10", "r11", "r12", "sp", "r14", "pc"};
         return Names[code];
     }
 
@@ -181,8 +181,8 @@ class FloatRegisters
     typedef FPRegisterID Code;
 
     static const char *GetName(Code code) {
-        static const char *Names[] = { "d0", "d1", "d2", "d3", "d4", "d5", "d6", "d7",
-                                       "d8", "d9", "d10", "d11", "d12", "d13", "d14", "d15"};
+        static const char * const Names[] = { "d0", "d1", "d2", "d3", "d4", "d5", "d6", "d7",
+                                              "d8", "d9", "d10", "d11", "d12", "d13", "d14", "d15"};
         return Names[code];
     }
 
diff --git a/js/src/ion/x64/Architecture-x64.h b/js/src/ion/x64/Architecture-x64.h
index 3a832c95df18..b17a9eadc9cd 100644
--- a/js/src/ion/x64/Architecture-x64.h
+++ b/js/src/ion/x64/Architecture-x64.h
@@ -36,10 +36,10 @@ class Registers {
     typedef JSC::X86Registers::RegisterID Code;
 
     static const char *GetName(Code code) {
-        static const char *Names[] = { "rax", "rcx", "rdx", "rbx",
-                                       "rsp", "rbp", "rsi", "rdi",
-                                       "r8",  "r9",  "r10", "r11",
-                                       "r12", "r13", "r14", "r15" };
+        static const char * const Names[] = { "rax", "rcx", "rdx", "rbx",
+                                              "rsp", "rbp", "rsi", "rdi",
+                                              "r8",  "r9",  "r10", "r11",
+                                              "r12", "r13", "r14", "r15" };
         return Names[code];
     }
 
@@ -118,10 +118,10 @@ class FloatRegisters {
     typedef JSC::X86Registers::XMMRegisterID Code;
 
     static const char *GetName(Code code) {
-        static const char *Names[] = { "xmm0",  "xmm1",  "xmm2",  "xmm3",
-                                       "xmm4",  "xmm5",  "xmm6",  "xmm7",
-                                       "xmm8",  "xmm9",  "xmm10", "xmm11",
-                                       "xmm12", "xmm13", "xmm14", "xmm15" };
+        static const char * const Names[] = { "xmm0",  "xmm1",  "xmm2",  "xmm3",
+                                              "xmm4",  "xmm5",  "xmm6",  "xmm7",
+                                              "xmm8",  "xmm9",  "xmm10", "xmm11",
+                                              "xmm12", "xmm13", "xmm14", "xmm15" };
         return Names[code];
     }
 
diff --git a/js/src/ion/x86/Architecture-x86.h b/js/src/ion/x86/Architecture-x86.h
index 61ffbdd3f787..5a6a583733f8 100644
--- a/js/src/ion/x86/Architecture-x86.h
+++ b/js/src/ion/x86/Architecture-x86.h
@@ -43,8 +43,8 @@ class Registers {
     typedef JSC::X86Registers::RegisterID Code;
 
     static const char *GetName(Code code) {
-        static const char *Names[] = { "eax", "ecx", "edx", "ebx",
-                                       "esp", "ebp", "esi", "edi" };
+        static const char * const Names[] = { "eax", "ecx", "edx", "ebx",
+                                              "esp", "ebp", "esi", "edi" };
         return Names[code];
     }
 
@@ -107,8 +107,8 @@ class FloatRegisters {
     typedef JSC::X86Registers::XMMRegisterID Code;
 
     static const char *GetName(Code code) {
-        static const char *Names[] = { "xmm0", "xmm1", "xmm2", "xmm3",
-                                       "xmm4", "xmm5", "xmm6", "xmm7" };
+        static const char * const Names[] = { "xmm0", "xmm1", "xmm2", "xmm3",
+                                              "xmm4", "xmm5", "xmm6", "xmm7" };
         return Names[code];
     }
 
diff --git a/js/src/jsapi-tests/testArgumentsObject.cpp b/js/src/jsapi-tests/testArgumentsObject.cpp
index 0ded03bc5474..e1f85f5d2453 100644
--- a/js/src/jsapi-tests/testArgumentsObject.cpp
+++ b/js/src/jsapi-tests/testArgumentsObject.cpp
@@ -30,7 +30,7 @@ static const char STRICT_TWO[] =
 static const char STRICT_THREE[] =
     "function f() { 'use strict'; return arguments; }";
 
-static const char *CALL_CODES[] =
+static const char * const CALL_CODES[] =
     { "f()", "f(0)", "f(0, 1)", "f(0, 1, 2)", "f(0, 1, 2, 3)", "f(0, 1, 2, 3, 4)" };
 
 static const size_t MAX_ELEMS = 6;
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index ceacf8e29e24..f4102f447a67 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -169,8 +169,8 @@ class AutoVersionAPI
 #endif
 
 #ifdef JS_USE_JSID_STRUCT_TYPES
-jsid JSID_VOID  = { size_t(JSID_TYPE_VOID) };
-jsid JSID_EMPTY = { size_t(JSID_TYPE_OBJECT) };
+const jsid JSID_VOID  = { size_t(JSID_TYPE_VOID) };
+const jsid JSID_EMPTY = { size_t(JSID_TYPE_OBJECT) };
 #endif
 
 const jsval JSVAL_NULL  = IMPL_TO_JSVAL(BUILD_JSVAL(JSVAL_TAG_NULL,      0));
@@ -1806,7 +1806,7 @@ typedef struct JSStdName {
 } JSStdName;
 
 static Handle<PropertyName*>
-StdNameToPropertyName(JSContext *cx, JSStdName *stdn)
+StdNameToPropertyName(JSContext *cx, const JSStdName *stdn)
 {
     return OFFSET_TO_NAME(cx->runtime(), stdn->atomOffset);
 }
@@ -1815,7 +1815,7 @@ StdNameToPropertyName(JSContext *cx, JSStdName *stdn)
  * Table of class initializers and their atom offsets in rt->atomState.
  * If you add a "standard" class, remember to update this table.
  */
-static JSStdName standard_class_atoms[] = {
+static const JSStdName standard_class_atoms[] = {
     {js_InitFunctionClass,              EAGER_ATOM_AND_CLASP(Function)},
     {js_InitObjectClass,                EAGER_ATOM_AND_CLASP(Object)},
     {js_InitArrayClass,                 EAGER_ATOM_AND_CLASP(Array)},
@@ -1849,7 +1849,7 @@ static JSStdName standard_class_atoms[] = {
  * If you add a "standard" global function or property, remember to update
  * this table.
  */
-static JSStdName standard_class_names[] = {
+static const JSStdName standard_class_names[] = {
     {js_InitObjectClass,        EAGER_ATOM(eval), CLASP(Object)},
 
     /* Global properties and functions defined by the Number class. */
@@ -1900,7 +1900,7 @@ static JSStdName standard_class_names[] = {
     {NULL,                      0, NULL}
 };
 
-static JSStdName object_prototype_names[] = {
+static const JSStdName object_prototype_names[] = {
     /* Object.prototype properties (global delegates to Object.prototype). */
     {js_InitObjectClass,        EAGER_ATOM(proto), CLASP(Object)},
 #if JS_HAS_TOSOURCE
@@ -1932,7 +1932,7 @@ JS_ResolveStandardClass(JSContext *cx, JSObject *objArg, jsid id, JSBool *resolv
     RootedObject obj(cx, objArg);
     JSRuntime *rt;
     JSAtom *atom;
-    JSStdName *stdnm;
+    const JSStdName *stdnm;
     unsigned i;
 
     AssertHeapIsIdle(cx);
@@ -4047,7 +4047,7 @@ JS_DefineObject(JSContext *cx, JSObject *objArg, const char *name, JSClass *jscl
 }
 
 JS_PUBLIC_API(JSBool)
-JS_DefineConstDoubles(JSContext *cx, JSObject *objArg, JSConstDoubleSpec *cds)
+JS_DefineConstDoubles(JSContext *cx, JSObject *objArg, const JSConstDoubleSpec *cds)
 {
     RootedObject obj(cx, objArg);
     JSBool ok;
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index f3c62a1d825d..3c5c678abc28 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -1309,8 +1309,8 @@ JSID_IS_EMPTY(const jsid id)
 #undef id
 
 #ifdef JS_USE_JSID_STRUCT_TYPES
-extern JS_PUBLIC_DATA(jsid) JSID_VOID;
-extern JS_PUBLIC_DATA(jsid) JSID_EMPTY;
+extern JS_PUBLIC_DATA(const jsid) JSID_VOID;
+extern JS_PUBLIC_DATA(const jsid) JSID_EMPTY;
 #else
 # define JSID_VOID ((jsid)JSID_TYPE_VOID)
 # define JSID_EMPTY ((jsid)JSID_TYPE_OBJECT)
@@ -3193,7 +3193,7 @@ JS_DefineObject(JSContext *cx, JSObject *obj, const char *name, JSClass *clasp,
                 JSObject *proto, unsigned attrs);
 
 extern JS_PUBLIC_API(JSBool)
-JS_DefineConstDoubles(JSContext *cx, JSObject *obj, JSConstDoubleSpec *cds);
+JS_DefineConstDoubles(JSContext *cx, JSObject *obj, const JSConstDoubleSpec *cds);
 
 extern JS_PUBLIC_API(JSBool)
 JS_DefineProperties(JSContext *cx, JSObject *obj, const JSPropertySpec *ps);
diff --git a/js/src/jsatom.cpp b/js/src/jsatom.cpp
index 10c10b07457b..164f9b38197c 100644
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -43,7 +43,7 @@ js_AtomToPrintableString(JSContext *cx, JSAtom *atom, JSAutoByteString *bytes)
     return js_ValueToPrintable(cx, StringValue(atom), bytes);
 }
 
-const char * js::TypeStrings[] = {
+const char * const js::TypeStrings[] = {
     js_undefined_str,
     js_object_str,
     js_function_str,
diff --git a/js/src/jsatom.h b/js/src/jsatom.h
index 7271ab0148b7..c53e8588bc5b 100644
--- a/js/src/jsatom.h
+++ b/js/src/jsatom.h
@@ -181,7 +181,7 @@ extern const char   js_send_str[];
 
 namespace js {
 
-extern const char * TypeStrings[];
+extern const char * const TypeStrings[];
 
 /*
  * Initialize atom state. Return true on success, false on failure to allocate
diff --git a/js/src/jsdate.cpp b/js/src/jsdate.cpp
index 44c434ca6730..6cccc6b197af 100644
--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -543,7 +543,7 @@ Class js::DateClass = {
 
 /* for use by date_parse */
 
-static const char* wtb[] = {
+static const char* const wtb[] = {
     "am", "pm",
     "monday", "tuesday", "wednesday", "thursday", "friday",
     "saturday", "sunday",
@@ -557,7 +557,7 @@ static const char* wtb[] = {
     /* time zone table needs to be expanded */
 };
 
-static int ttb[] = {
+static const int ttb[] = {
     -1, -2, 0, 0, 0, 0, 0, 0, 0,       /* AM/PM */
     2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
     10000 + 0, 10000 + 0, 10000 + 0,   /* GMT/UT/UTC */
@@ -2459,12 +2459,12 @@ date_setYear(JSContext *cx, unsigned argc, Value *vp)
 }
 
 /* constants for toString, toUTCString */
-static char js_NaN_date_str[] = "Invalid Date";
-static const char* days[] =
+static const char js_NaN_date_str[] = "Invalid Date";
+static const char * const days[] =
 {
    "Sun","Mon","Tue","Wed","Thu","Fri","Sat"
 };
-static const char* months[] =
+static const char * const months[] =
 {
    "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
 };
diff --git a/js/src/jsexn.cpp b/js/src/jsexn.cpp
index 0f75034a5497..74b424d87b0b 100644
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -892,7 +892,7 @@ js::GetErrorTypeName(JSContext* cx, int16_t exnType)
 
 #if defined ( DEBUG_mccabe ) && defined ( PRINTNAMES )
 /* For use below... get character strings for error name and exception name */
-static struct exnname { char *name; char *exception; } errortoexnname[] = {
+static const struct exnname { char *name; char *exception; } errortoexnname[] = {
 #define MSG_DEF(name, number, count, exception, format) \
     {#name, #exception},
 #include "js.msg"
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 3b1e1e6e6d08..8cc91ad87785 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -97,7 +97,7 @@ static const uint64_t GC_IDLE_FULL_SPAN = 20 * 1000 * 1000;
 static const int IGC_MARK_SLICE_MULTIPLIER = 2;
 
 /* This array should be const, but that doesn't link right under GCC. */
-AllocKind gc::slotsToThingKind[] = {
+const AllocKind gc::slotsToThingKind[] = {
     /* 0 */  FINALIZE_OBJECT0,  FINALIZE_OBJECT2,  FINALIZE_OBJECT2,  FINALIZE_OBJECT4,
     /* 4 */  FINALIZE_OBJECT4,  FINALIZE_OBJECT8,  FINALIZE_OBJECT8,  FINALIZE_OBJECT8,
     /* 8 */  FINALIZE_OBJECT8,  FINALIZE_OBJECT12, FINALIZE_OBJECT12, FINALIZE_OBJECT12,
@@ -176,7 +176,7 @@ static const AllocKind FinalizePhaseIonCode[] = {
     FINALIZE_IONCODE
 };
 
-static const AllocKind* FinalizePhases[] = {
+static const AllocKind * const FinalizePhases[] = {
     FinalizePhaseStrings,
     FinalizePhaseScripts,
     FinalizePhaseIonCode
@@ -219,7 +219,7 @@ static const AllocKind BackgroundPhaseShapes[] = {
     FINALIZE_TYPE_OBJECT
 };
 
-static const AllocKind* BackgroundPhases[] = {
+static const AllocKind * const BackgroundPhases[] = {
     BackgroundPhaseObjects,
     BackgroundPhaseStrings,
     BackgroundPhaseShapes
diff --git a/js/src/jsgcinlines.h b/js/src/jsgcinlines.h
index 6d75a27ff215..b94e03259758 100644
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -51,7 +51,7 @@ namespace gc {
 /* Capacity for slotsToThingKind */
 const size_t SLOTS_TO_THING_KIND_LIMIT = 17;
 
-extern AllocKind slotsToThingKind[];
+extern const AllocKind slotsToThingKind[];
 
 /* Get the best kind to use when making an object with the given slot count. */
 static inline AllocKind
@@ -77,8 +77,6 @@ GetGCObjectKind(Class *clasp)
 static inline AllocKind
 GetGCArrayKind(size_t numSlots)
 {
-    extern AllocKind slotsToThingKind[];
-
     /*
      * Dense arrays can use their fixed slots to hold their elements array
      * (less two Values worth of ObjectElements header), but if more than the
@@ -94,8 +92,6 @@ GetGCArrayKind(size_t numSlots)
 static inline AllocKind
 GetGCObjectFixedSlotsKind(size_t numFixedSlots)
 {
-    extern AllocKind slotsToThingKind[];
-
     JS_ASSERT(numFixedSlots < SLOTS_TO_THING_KIND_LIMIT);
     return slotsToThingKind[numFixedSlots];
 }
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 057154f4a1fd..bd082e4aaa60 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -149,9 +149,9 @@ const char *
 types::InferSpewColor(TypeConstraint *constraint)
 {
     /* Type constraints are printed out using foreground colors. */
-    static const char *colors[] = { "\x1b[31m", "\x1b[32m", "\x1b[33m",
-                                    "\x1b[34m", "\x1b[35m", "\x1b[36m",
-                                    "\x1b[37m" };
+    static const char * const colors[] = { "\x1b[31m", "\x1b[32m", "\x1b[33m",
+                                           "\x1b[34m", "\x1b[35m", "\x1b[36m",
+                                           "\x1b[37m" };
     if (!InferSpewColorable())
         return "";
     return colors[DefaultHasher<TypeConstraint *>::hash(constraint) % 7];
@@ -161,9 +161,9 @@ const char *
 types::InferSpewColor(TypeSet *types)
 {
     /* Type sets are printed out using bold colors. */
-    static const char *colors[] = { "\x1b[1;31m", "\x1b[1;32m", "\x1b[1;33m",
-                                    "\x1b[1;34m", "\x1b[1;35m", "\x1b[1;36m",
-                                    "\x1b[1;37m" };
+    static const char * const colors[] = { "\x1b[1;31m", "\x1b[1;32m", "\x1b[1;33m",
+                                           "\x1b[1;34m", "\x1b[1;35m", "\x1b[1;36m",
+                                           "\x1b[1;37m" };
     if (!InferSpewColorable())
         return "";
     return colors[DefaultHasher<TypeSet *>::hash(types) % 7];
diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
index ab47afd3c425..ac6f48b2ec66 100644
--- a/js/src/jsmath.cpp
+++ b/js/src/jsmath.cpp
@@ -73,7 +73,7 @@ using mozilla::SpecificNaN;
 #define M_SQRT1_2       0.70710678118654752440
 #endif
 
-static JSConstDoubleSpec math_constants[] = {
+static const JSConstDoubleSpec math_constants[] = {
     {M_E,       "E",            0, {0,0,0}},
     {M_LOG2E,   "LOG2E",        0, {0,0,0}},
     {M_LOG10E,  "LOG10E",       0, {0,0,0}},
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index f7fb8cd934bb..b2049772a4b9 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -73,13 +73,13 @@ const JSCodeSpec js_CodeSpec[] = {
 #undef OPDEF
 };
 
-unsigned js_NumCodeSpecs = JS_ARRAY_LENGTH(js_CodeSpec);
+const unsigned js_NumCodeSpecs = JS_ARRAY_LENGTH(js_CodeSpec);
 
 /*
  * Each element of the array is either a source literal associated with JS
  * bytecode or null.
  */
-static const char *CodeToken[] = {
+static const char * const CodeToken[] = {
 #define OPDEF(op,val,name,token,length,nuses,ndefs,format) \
     token,
 #include "jsopcode.tbl"
@@ -90,7 +90,7 @@ static const char *CodeToken[] = {
  * Array of JS bytecode names used by PC count JSON, DEBUG-only js_Disassemble
  * and JIT debug spew.
  */
-const char *js_CodeName[] = {
+const char * const js_CodeName[] = {
 #define OPDEF(op,val,name,token,length,nuses,ndefs,format) \
     name,
 #include "jsopcode.tbl"
@@ -172,7 +172,7 @@ js::StackDefs(JSScript *script, jsbytecode *pc)
     return op == JSOP_ENTERLET1 ? n + 1 : n;
 }
 
-static const char * countBaseNames[] = {
+static const char * const countBaseNames[] = {
     "interp",
     "mjit",
     "mjit_calls",
@@ -182,7 +182,7 @@ static const char * countBaseNames[] = {
 
 JS_STATIC_ASSERT(JS_ARRAY_LENGTH(countBaseNames) == PCCounts::BASE_LIMIT);
 
-static const char * countAccessNames[] = {
+static const char * const countAccessNames[] = {
     "infer_mono",
     "infer_di",
     "infer_poly",
@@ -200,7 +200,7 @@ static const char * countAccessNames[] = {
 JS_STATIC_ASSERT(JS_ARRAY_LENGTH(countBaseNames) +
                  JS_ARRAY_LENGTH(countAccessNames) == PCCounts::ACCESS_LIMIT);
 
-static const char * countElementNames[] = {
+static const char * const countElementNames[] = {
     "id_int",
     "id_double",
     "id_other",
@@ -215,7 +215,7 @@ JS_STATIC_ASSERT(JS_ARRAY_LENGTH(countBaseNames) +
                  JS_ARRAY_LENGTH(countAccessNames) +
                  JS_ARRAY_LENGTH(countElementNames) == PCCounts::ELEM_LIMIT);
 
-static const char * countPropertyNames[] = {
+static const char * const countPropertyNames[] = {
     "prop_static",
     "prop_definite",
     "prop_other"
@@ -225,7 +225,7 @@ JS_STATIC_ASSERT(JS_ARRAY_LENGTH(countBaseNames) +
                  JS_ARRAY_LENGTH(countAccessNames) +
                  JS_ARRAY_LENGTH(countPropertyNames) == PCCounts::PROP_LIMIT);
 
-static const char * countArithNames[] = {
+static const char * const countArithNames[] = {
     "arith_int",
     "arith_double",
     "arith_other",
@@ -2086,7 +2086,8 @@ AppendJSONProperty(StringBuffer &buf, const char *name, MaybeComma comma = COMMA
 
 static void
 AppendArrayJSONProperties(JSContext *cx, StringBuffer &buf,
-                          double *values, const char **names, unsigned count, MaybeComma &comma)
+                          double *values, const char * const *names, unsigned count,
+                          MaybeComma &comma)
 {
     for (unsigned i = 0; i < count; i++) {
         if (values[i]) {
diff --git a/js/src/jsopcode.h b/js/src/jsopcode.h
index 7220fe0d1a3a..8da36091e4d5 100644
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -215,8 +215,8 @@ struct JSCodeSpec {
 };
 
 extern const JSCodeSpec js_CodeSpec[];
-extern unsigned            js_NumCodeSpecs;
-extern const char       *js_CodeName[];
+extern const unsigned   js_NumCodeSpecs;
+extern const char       * const js_CodeName[];
 extern const char       js_EscapeMap[];
 
 /* Silence unreferenced formal parameter warnings */
@@ -652,7 +652,7 @@ class PCCounts
 
     static const char *countName(JSOp op, size_t which);
 
-    double *rawCounts() { return counts; }
+    double *rawCounts() const { return counts; }
 
     double& get(size_t which) {
         JS_ASSERT(which < capacity);
diff --git a/js/src/jsreflect.cpp b/js/src/jsreflect.cpp
index b4f36b7398ed..5f95ed94383c 100644
--- a/js/src/jsreflect.cpp
+++ b/js/src/jsreflect.cpp
@@ -32,7 +32,7 @@ using namespace js::frontend;
 using mozilla::ArrayLength;
 using mozilla::DebugOnly;
 
-char const *js::aopNames[] = {
+char const * const js::aopNames[] = {
     "=",    /* AOP_ASSIGN */
     "+=",   /* AOP_PLUS */
     "-=",   /* AOP_MINUS */
@@ -47,7 +47,7 @@ char const *js::aopNames[] = {
     "&="    /* AOP_BITAND */
 };
 
-char const *js::binopNames[] = {
+char const * const js::binopNames[] = {
     "==",         /* BINOP_EQ */
     "!=",         /* BINOP_NE */
     "===",        /* BINOP_STRICTEQ */
@@ -71,7 +71,7 @@ char const *js::binopNames[] = {
     "instanceof", /* BINOP_INSTANCEOF */
 };
 
-char const *js::unopNames[] = {
+char const * const js::unopNames[] = {
     "delete",  /* UNOP_DELETE */
     "-",       /* UNOP_NEG */
     "+",       /* UNOP_POS */
@@ -81,14 +81,14 @@ char const *js::unopNames[] = {
     "void"     /* UNOP_VOID */
 };
 
-char const *js::nodeTypeNames[] = {
+char const * const js::nodeTypeNames[] = {
 #define ASTDEF(ast, str, method) str,
 #include "jsast.tbl"
 #undef ASTDEF
     NULL
 };
 
-static char const *callbackNames[] = {
+static char const * const callbackNames[] = {
 #define ASTDEF(ast, str, method) method,
 #include "jsast.tbl"
 #undef ASTDEF
diff --git a/js/src/jsreflect.h b/js/src/jsreflect.h
index be973527970c..5cbcdf279ed4 100644
--- a/js/src/jsreflect.h
+++ b/js/src/jsreflect.h
@@ -88,10 +88,10 @@ enum PropKind {
     PROP_LIMIT
 };
 
-extern char const *aopNames[];
-extern char const *binopNames[];
-extern char const *unopNames[];
-extern char const *nodeTypeNames[];
+extern char const * const aopNames[];
+extern char const * const binopNames[];
+extern char const * const unopNames[];
+extern char const * const nodeTypeNames[];
 
 } /* namespace js */
 
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index 2839d15ba1b5..b6727b877d06 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -365,8 +365,8 @@ static const JSFunctionSpec string_functions[] = {
     JS_FS_END
 };
 
-jschar      js_empty_ucstr[]  = {0};
-JSSubString js_EmptySubString = {0, js_empty_ucstr};
+const jschar      js_empty_ucstr[]  = {0};
+const JSSubString js_EmptySubString = {0, js_empty_ucstr};
 
 static const unsigned STRING_ELEMENT_ATTRS = JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT;
 
diff --git a/js/src/jsstr.h b/js/src/jsstr.h
index 028b990a7218..9ec9187a2420 100644
--- a/js/src/jsstr.h
+++ b/js/src/jsstr.h
@@ -60,8 +60,8 @@ struct JSSubString {
     const jschar    *chars;
 };
 
-extern jschar      js_empty_ucstr[];
-extern JSSubString js_EmptySubString;
+extern const jschar js_empty_ucstr[];
+extern const JSSubString js_EmptySubString;
 
 /*
  * Shorthands for ASCII (7-bit) decimal and hex conversion.
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index e6d447b3e576..6888f3f1e824 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -2062,7 +2062,7 @@ DisassWithSrc(JSContext *cx, unsigned argc, jsval *vp)
     FILE *file;
     char linebuf[LINE_BUF_LEN];
     jsbytecode *pc, *end;
-    static char sep[] = ";-------------------------";
+    static const char sep[] = ";-------------------------";
 
     bool ok = true;
     RootedScript script(cx);
@@ -3564,7 +3564,7 @@ GetSelfHostedValue(JSContext *cx, unsigned argc, jsval *vp)
     return cx->runtime()->cloneSelfHostedValue(cx, srcName, args.rval());
 }
 
-static JSFunctionSpecWithHelp shell_functions[] = {
+static const JSFunctionSpecWithHelp shell_functions[] = {
     JS_FN_HELP("version", Version, 0, 0,
 "version([number])",
 "  Get or force a script compilation version number."),
@@ -3887,7 +3887,7 @@ static JSFunctionSpecWithHelp shell_functions[] = {
     JS_FS_HELP_END
 };
 
-static JSFunctionSpecWithHelp self_hosting_functions[] = {
+static const JSFunctionSpecWithHelp self_hosting_functions[] = {
     JS_FN_HELP("getSelfHostedValue", GetSelfHostedValue, 1, 0,
 "getSelfHostedValue()",
 "  Get a self-hosted value by its name. Note that these values don't get \n"
diff --git a/js/src/shell/jsoptparse.cpp b/js/src/shell/jsoptparse.cpp
index aec92fb5292b..204efa1860f1 100644
--- a/js/src/shell/jsoptparse.cpp
+++ b/js/src/shell/jsoptparse.cpp
@@ -143,10 +143,10 @@ PrintParagraph(const char *text, unsigned startColno, const unsigned limitColno,
 static const char *
 OptionFlagsToFormatInfo(char shortflag, bool isValued, size_t *length)
 {
-    static const char *fmt[4] = { "  -%c --%s ",
-                                  "  --%s ",
-                                  "  -%c --%s=%s ",
-                                  "  --%s=%s " };
+    static const char * const fmt[4] = { "  -%c --%s ",
+                                         "  --%s ",
+                                         "  -%c --%s=%s ",
+                                         "  --%s=%s " };
 
     /* How mny chars w/o longflag? */
     size_t lengths[4] = { strlen(fmt[0]) - 3,
diff --git a/js/src/yarr/YarrCanonicalizeUCS2.cpp b/js/src/yarr/YarrCanonicalizeUCS2.cpp
index e6d334212fd3..f4fdbe83c3ab 100644
--- a/js/src/yarr/YarrCanonicalizeUCS2.cpp
+++ b/js/src/yarr/YarrCanonicalizeUCS2.cpp
@@ -34,24 +34,24 @@ namespace JSC { namespace Yarr {
 #include <stddef.h>
 #include "mozilla/StandardInteger.h"
 
-uint16_t ucs2CharacterSet0[] = { 0x01c4u, 0x01c5u, 0x01c6u, 0 };
-uint16_t ucs2CharacterSet1[] = { 0x01c7u, 0x01c8u, 0x01c9u, 0 };
-uint16_t ucs2CharacterSet2[] = { 0x01cau, 0x01cbu, 0x01ccu, 0 };
-uint16_t ucs2CharacterSet3[] = { 0x01f1u, 0x01f2u, 0x01f3u, 0 };
-uint16_t ucs2CharacterSet4[] = { 0x0392u, 0x03b2u, 0x03d0u, 0 };
-uint16_t ucs2CharacterSet5[] = { 0x0395u, 0x03b5u, 0x03f5u, 0 };
-uint16_t ucs2CharacterSet6[] = { 0x0398u, 0x03b8u, 0x03d1u, 0 };
-uint16_t ucs2CharacterSet7[] = { 0x0345u, 0x0399u, 0x03b9u, 0x1fbeu, 0 };
-uint16_t ucs2CharacterSet8[] = { 0x039au, 0x03bau, 0x03f0u, 0 };
-uint16_t ucs2CharacterSet9[] = { 0x00b5u, 0x039cu, 0x03bcu, 0 };
-uint16_t ucs2CharacterSet10[] = { 0x03a0u, 0x03c0u, 0x03d6u, 0 };
-uint16_t ucs2CharacterSet11[] = { 0x03a1u, 0x03c1u, 0x03f1u, 0 };
-uint16_t ucs2CharacterSet12[] = { 0x03a3u, 0x03c2u, 0x03c3u, 0 };
-uint16_t ucs2CharacterSet13[] = { 0x03a6u, 0x03c6u, 0x03d5u, 0 };
-uint16_t ucs2CharacterSet14[] = { 0x1e60u, 0x1e61u, 0x1e9bu, 0 };
+const uint16_t ucs2CharacterSet0[] = { 0x01c4u, 0x01c5u, 0x01c6u, 0 };
+const uint16_t ucs2CharacterSet1[] = { 0x01c7u, 0x01c8u, 0x01c9u, 0 };
+const uint16_t ucs2CharacterSet2[] = { 0x01cau, 0x01cbu, 0x01ccu, 0 };
+const uint16_t ucs2CharacterSet3[] = { 0x01f1u, 0x01f2u, 0x01f3u, 0 };
+const uint16_t ucs2CharacterSet4[] = { 0x0392u, 0x03b2u, 0x03d0u, 0 };
+const uint16_t ucs2CharacterSet5[] = { 0x0395u, 0x03b5u, 0x03f5u, 0 };
+const uint16_t ucs2CharacterSet6[] = { 0x0398u, 0x03b8u, 0x03d1u, 0 };
+const uint16_t ucs2CharacterSet7[] = { 0x0345u, 0x0399u, 0x03b9u, 0x1fbeu, 0 };
+const uint16_t ucs2CharacterSet8[] = { 0x039au, 0x03bau, 0x03f0u, 0 };
+const uint16_t ucs2CharacterSet9[] = { 0x00b5u, 0x039cu, 0x03bcu, 0 };
+const uint16_t ucs2CharacterSet10[] = { 0x03a0u, 0x03c0u, 0x03d6u, 0 };
+const uint16_t ucs2CharacterSet11[] = { 0x03a1u, 0x03c1u, 0x03f1u, 0 };
+const uint16_t ucs2CharacterSet12[] = { 0x03a3u, 0x03c2u, 0x03c3u, 0 };
+const uint16_t ucs2CharacterSet13[] = { 0x03a6u, 0x03c6u, 0x03d5u, 0 };
+const uint16_t ucs2CharacterSet14[] = { 0x1e60u, 0x1e61u, 0x1e9bu, 0 };
 
 static const size_t UCS2_CANONICALIZATION_SETS = 15;
-uint16_t* characterSetInfo[UCS2_CANONICALIZATION_SETS] = {
+const uint16_t* const characterSetInfo[UCS2_CANONICALIZATION_SETS] = {
     ucs2CharacterSet0,
     ucs2CharacterSet1,
     ucs2CharacterSet2,
@@ -70,7 +70,7 @@ uint16_t* characterSetInfo[UCS2_CANONICALIZATION_SETS] = {
 };
 
 const size_t UCS2_CANONICALIZATION_RANGES = 364;
-UCS2CanonicalizationRange rangeInfo[UCS2_CANONICALIZATION_RANGES] = {
+const UCS2CanonicalizationRange rangeInfo[UCS2_CANONICALIZATION_RANGES] = {
     { 0x0000u, 0x0040u, 0x0000u, CanonicalizeUnique },
     { 0x0041u, 0x005au, 0x0020u, CanonicalizeRangeLo },
     { 0x005bu, 0x0060u, 0x0000u, CanonicalizeUnique },
@@ -438,7 +438,7 @@ UCS2CanonicalizationRange rangeInfo[UCS2_CANONICALIZATION_RANGES] = {
 };
 
 const size_t LATIN_CANONICALIZATION_RANGES = 20;
-LatinCanonicalizationRange latinRangeInfo[LATIN_CANONICALIZATION_RANGES] = {
+const LatinCanonicalizationRange latinRangeInfo[LATIN_CANONICALIZATION_RANGES] = {
     { 0x0000u, 0x0040u, 0x0000u, CanonicalizeLatinSelf },
     { 0x0041u, 0x005au, 0x0000u, CanonicalizeLatinMask0x20 },
     { 0x005bu, 0x0060u, 0x0000u, CanonicalizeLatinSelf },
diff --git a/js/src/yarr/YarrCanonicalizeUCS2.h b/js/src/yarr/YarrCanonicalizeUCS2.h
index 874af40e8693..8bfaf67879b3 100644
--- a/js/src/yarr/YarrCanonicalizeUCS2.h
+++ b/js/src/yarr/YarrCanonicalizeUCS2.h
@@ -47,8 +47,8 @@ enum UCS2CanonicalizationType {
 };
 struct UCS2CanonicalizationRange { uint16_t begin, end, value, type; };
 extern const size_t UCS2_CANONICALIZATION_RANGES;
-extern uint16_t* characterSetInfo[];
-extern UCS2CanonicalizationRange rangeInfo[];
+extern const uint16_t* const characterSetInfo[];
+extern const UCS2CanonicalizationRange rangeInfo[];
 
 // This table is similar to the full rangeInfo table, however this maps from UCS2 codepoints to
 // the set of Latin1 codepoints that could match.
@@ -60,17 +60,17 @@ enum LatinCanonicalizationType {
 };
 struct LatinCanonicalizationRange { uint16_t begin, end, value, type; };
 extern const size_t LATIN_CANONICALIZATION_RANGES;
-extern LatinCanonicalizationRange latinRangeInfo[];
+extern const LatinCanonicalizationRange latinRangeInfo[];
 
 // This searches in log2 time over ~364 entries, so should typically result in 8 compares.
-inline UCS2CanonicalizationRange* rangeInfoFor(UChar ch)
+inline const UCS2CanonicalizationRange* rangeInfoFor(UChar ch)
 {
-    UCS2CanonicalizationRange* info = rangeInfo;
+    const UCS2CanonicalizationRange* info = rangeInfo;
     size_t entries = UCS2_CANONICALIZATION_RANGES;
 
     while (true) {
         size_t candidate = entries >> 1;
-        UCS2CanonicalizationRange* candidateInfo = info + candidate;
+        const UCS2CanonicalizationRange* candidateInfo = info + candidate;
         if (ch < candidateInfo->begin)
             entries = candidate;
         else if (ch <= candidateInfo->end)
@@ -83,7 +83,7 @@ inline UCS2CanonicalizationRange* rangeInfoFor(UChar ch)
 }
 
 // Should only be called for characters that have one canonically matching value.
-inline UChar getCanonicalPair(UCS2CanonicalizationRange* info, UChar ch)
+inline UChar getCanonicalPair(const UCS2CanonicalizationRange* info, UChar ch)
 {
     ASSERT(ch >= info->begin && ch <= info->end);
     switch (info->type) {
@@ -111,12 +111,12 @@ inline bool isCanonicallyUnique(UChar ch)
 // Returns true if values are equal, under the canonicalization rules.
 inline bool areCanonicallyEquivalent(UChar a, UChar b)
 {
-    UCS2CanonicalizationRange* info = rangeInfoFor(a);
+    const UCS2CanonicalizationRange* info = rangeInfoFor(a);
     switch (info->type) {
     case CanonicalizeUnique:
         return a == b;
     case CanonicalizeSet: {
-        for (uint16_t* set = characterSetInfo[info->value]; (a = *set); ++set) {
+        for (const uint16_t* set = characterSetInfo[info->value]; (a = *set); ++set) {
             if (a == b)
                 return true;
         }
diff --git a/js/src/yarr/YarrPattern.cpp b/js/src/yarr/YarrPattern.cpp
index 3de728032c18..658d4eaa4983 100644
--- a/js/src/yarr/YarrPattern.cpp
+++ b/js/src/yarr/YarrPattern.cpp
@@ -90,21 +90,21 @@ public:
         }
 
         // Add multiple matches, if necessary.
-        UCS2CanonicalizationRange* info = rangeInfoFor(ch);
+        const UCS2CanonicalizationRange* info = rangeInfoFor(ch);
         if (info->type == CanonicalizeUnique)
             addSorted(m_matchesUnicode, ch);
         else
             putUnicodeIgnoreCase(ch, info);
     }
 
-    void putUnicodeIgnoreCase(UChar ch, UCS2CanonicalizationRange* info)
+    void putUnicodeIgnoreCase(UChar ch, const UCS2CanonicalizationRange* info)
     {
         ASSERT(m_isCaseInsensitive);
         ASSERT(ch > 0x7f);
         ASSERT(ch >= info->begin && ch <= info->end);
         ASSERT(info->type != CanonicalizeUnique);
         if (info->type == CanonicalizeSet) {
-            for (uint16_t* set = characterSetInfo[info->value]; (ch = *set); ++set)
+            for (const uint16_t* set = characterSetInfo[info->value]; (ch = *set); ++set)
                 addSorted(m_matchesUnicode, ch);
         } else {
             addSorted(m_matchesUnicode, ch);
@@ -135,7 +135,7 @@ public:
         if (!m_isCaseInsensitive)
             return;
 
-        UCS2CanonicalizationRange* info = rangeInfoFor(lo);
+        const UCS2CanonicalizationRange* info = rangeInfoFor(lo);
         while (true) {
             // Handle the range [lo .. end]
             UChar end = std::min<UChar>(info->end, hi);
@@ -146,7 +146,7 @@ public:
                 break;
             case CanonicalizeSet: {
                 UChar ch;
-                for (uint16_t* set = characterSetInfo[info->value]; (ch = *set); ++set)
+                for (const uint16_t* set = characterSetInfo[info->value]; (ch = *set); ++set)
                     addSorted(m_matchesUnicode, ch);
                 break;
             }
@@ -326,7 +326,7 @@ public:
             return;
         }
 
-        UCS2CanonicalizationRange* info = rangeInfoFor(ch);
+        const UCS2CanonicalizationRange* info = rangeInfoFor(ch);
         if (info->type == CanonicalizeUnique) {
             m_alternative->m_terms.append(PatternTerm(ch));
             return;
diff --git a/js/xpconnect/src/XPCComponents.cpp b/js/xpconnect/src/XPCComponents.cpp
index 21a477a64624..c847c83c6885 100644
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -82,12 +82,12 @@ char* xpc_CloneAllAccess()
     return (char*)nsMemory::Clone(allAccess, sizeof(allAccess));
 }
 
-char * xpc_CheckAccessList(const PRUnichar* wideName, const char* list[])
+char * xpc_CheckAccessList(const PRUnichar* wideName, const char* const list[])
 {
     nsAutoCString asciiName;
     CopyUTF16toUTF8(nsDependentString(wideName), asciiName);
 
-    for (const char** p = list; *p; p++)
+    for (const char* const* p = list; *p; p++)
         if (!strcmp(*p, asciiName.get()))
             return xpc_CloneAllAccess();
 
@@ -1329,7 +1329,7 @@ nsXPCComponents_Results::NewEnumerate(nsIXPConnectWrappedNative *wrapper,
                                       uint32_t enum_op, jsval * statep,
                                       jsid * idp, bool *_retval)
 {
-    void** iter;
+    const void** iter;
 
     switch (enum_op) {
         case JSENUMERATE_INIT:
@@ -1346,7 +1346,7 @@ nsXPCComponents_Results::NewEnumerate(nsIXPConnectWrappedNative *wrapper,
         case JSENUMERATE_NEXT:
         {
             const char* name;
-            iter = (void**) JSVAL_TO_PRIVATE(*statep);
+            iter = (const void**) JSVAL_TO_PRIVATE(*statep);
             if (nsXPCException::IterateNSResults(nullptr, &name, nullptr, iter)) {
                 JSString* idstr = JS_NewStringCopyZ(cx, name);
                 if (idstr && JS_ValueToId(cx, STRING_TO_JSVAL(idstr), idp))
@@ -1357,7 +1357,7 @@ nsXPCComponents_Results::NewEnumerate(nsIXPConnectWrappedNative *wrapper,
 
         case JSENUMERATE_DESTROY:
         default:
-            iter = (void**) JSVAL_TO_PRIVATE(*statep);
+            iter = (const void**) JSVAL_TO_PRIVATE(*statep);
             delete [] (char*) iter;
             *statep = JSVAL_NULL;
             return NS_OK;
@@ -1378,7 +1378,7 @@ nsXPCComponents_Results::NewResolve(nsIXPConnectWrappedNative *wrapper,
 
     if (JSID_IS_STRING(id) && name.encodeLatin1(cx, JSID_TO_STRING(id))) {
         const char* rv_name;
-        void* iter = nullptr;
+        const void* iter = nullptr;
         nsresult rv;
         while (nsXPCException::IterateNSResults(&rv, &rv_name, nullptr, &iter)) {
             if (!strcmp(name.ptr(), rv_name)) {
@@ -4395,7 +4395,7 @@ nsXPCComponents_Utils::CanCreateWrapper(const nsIID * iid, char **_retval)
 NS_IMETHODIMP
 nsXPCComponents_Utils::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval)
 {
-    static const char* allowed[] = { "lookupMethod", "evalInSandbox", nullptr };
+    static const char* const allowed[] = { "lookupMethod", "evalInSandbox", nullptr };
     *_retval = xpc_CheckAccessList(methodName, allowed);
     return NS_OK;
 }
@@ -4917,7 +4917,7 @@ nsXPCComponents::CanCreateWrapper(const nsIID * iid, char **_retval)
 NS_IMETHODIMP
 nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval)
 {
-    static const char* allowed[] = { "isSuccessCode", "lookupMethod", nullptr };
+    static const char* const allowed[] = { "isSuccessCode", "lookupMethod", nullptr };
     *_retval = xpc_CheckAccessList(methodName, allowed);
     if (*_retval &&
         methodName[0] == 'l' &&
@@ -4932,7 +4932,7 @@ nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, c
 NS_IMETHODIMP
 nsXPCComponents::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
 {
-    static const char* allowed[] = { "interfaces", "interfacesByID", "results", nullptr};
+    static const char* const allowed[] = { "interfaces", "interfacesByID", "results", nullptr};
     *_retval = xpc_CheckAccessList(propertyName, allowed);
     if (*_retval &&
         propertyName[0] == 'i' &&
diff --git a/js/xpconnect/src/XPCException.cpp b/js/xpconnect/src/XPCException.cpp
index e01d9de53f94..a0b48c20ff1e 100644
--- a/js/xpconnect/src/XPCException.cpp
+++ b/js/xpconnect/src/XPCException.cpp
@@ -19,7 +19,7 @@
 *  in some more global way at runtime.
 */
 
-static struct ResultMap
+static const struct ResultMap
 {nsresult rv; const char* name; const char* format;} map[] = {
 #define XPC_MSG_DEF(val, format) \
     {(val), #val, format},
@@ -37,7 +37,7 @@ nsXPCException::NameAndFormatForNSResult(nsresult rv,
                                          const char** format)
 {
 
-    for (ResultMap* p = map; p->name; p++) {
+    for (const ResultMap* p = map; p->name; p++) {
         if (rv == p->rv) {
             if (name) *name = p->name;
             if (format) *format = p->format;
@@ -48,13 +48,13 @@ nsXPCException::NameAndFormatForNSResult(nsresult rv,
 }
 
 // static
-void*
+const void*
 nsXPCException::IterateNSResults(nsresult* rv,
                                  const char** name,
                                  const char** format,
-                                 void** iterp)
+                                 const void** iterp)
 {
-    ResultMap* p = (ResultMap*) *iterp;
+    const ResultMap* p = (const ResultMap*) *iterp;
     if (!p)
         p = map;
     else
diff --git a/js/xpconnect/src/XPCJSID.cpp b/js/xpconnect/src/XPCJSID.cpp
index 8c7d59807fda..217fa953d00f 100644
--- a/js/xpconnect/src/XPCJSID.cpp
+++ b/js/xpconnect/src/XPCJSID.cpp
@@ -565,7 +565,7 @@ nsJSIID::CanCreateWrapper(const nsIID * iid, char **_retval)
 NS_IMETHODIMP
 nsJSIID::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval)
 {
-    static const char* allowed[] = {"equals", "toString", nullptr};
+    static const char* const allowed[] = {"equals", "toString", nullptr};
 
     *_retval = xpc_CheckAccessList(methodName, allowed);
     return NS_OK;
@@ -575,7 +575,7 @@ nsJSIID::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_r
 NS_IMETHODIMP
 nsJSIID::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
 {
-    static const char* allowed[] = {"name", "number", "valid", nullptr};
+    static const char* const allowed[] = {"name", "number", "valid", nullptr};
     *_retval = xpc_CheckAccessList(propertyName, allowed);
     return NS_OK;
 }
diff --git a/js/xpconnect/src/XPCWrappedNative.cpp b/js/xpconnect/src/XPCWrappedNative.cpp
index 4b60dd7c8677..3a88c8e61b1f 100644
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -3275,7 +3275,7 @@ void DEBUG_ReportShadowedMembers(XPCNativeSet* set,
     // We just want to skip some classes...
     if (si) {
         // Add any classnames to skip to this (null terminated) array...
-        static const char* skipClasses[] = {
+        static const char* const skipClasses[] = {
             "Window",
             "HTMLDocument",
             "HTMLCollection",
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 242454da958b..c241b40402d8 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -3100,10 +3100,10 @@ public:
                                            const char** name,
                                            const char** format);
 
-    static void* IterateNSResults(nsresult* rv,
-                                  const char** name,
-                                  const char** format,
-                                  void** iterp);
+    static const void* IterateNSResults(nsresult* rv,
+                                        const char** name,
+                                        const char** format,
+                                        const void** iterp);
 
     static uint32_t GetNSResultCount();
 
@@ -3589,7 +3589,7 @@ extern char* xpc_CloneAllAccess();
 /***************************************************************************/
 // Returns access if wideName is in list
 
-extern char * xpc_CheckAccessList(const PRUnichar* wideName, const char* list[]);
+extern char * xpc_CheckAccessList(const PRUnichar* wideName, const char* const list[]);
 
 /***************************************************************************/
 // in xpcvariant.cpp...

From b1d555080c5b3fc34a7effae59ed9d50c719bf52 Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Mon, 17 Jun 2013 19:44:09 -0700
Subject: [PATCH 61/75] Bug 403297: Skip "Unable to test style tree integrity"
 warning for viewport frames. r=bz

---
 layout/base/nsCSSFrameConstructor.cpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index b5dcef67aa78..c69da49c6d3c 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -8246,8 +8246,10 @@ nsCSSFrameConstructor::ProcessRestyledFrames(nsStyleChangeList& aChangeList)
           DebugVerifyStyleTree(frame);
         }
       }
-    } else {
-      NS_WARNING("Unable to test style tree integrity -- no content node");
+    } else if (!changeData->mFrame ||
+               changeData->mFrame->GetType() != nsGkAtoms::viewportFrame) {
+      NS_WARNING("Unable to test style tree integrity -- no content node "
+                 "(and not a viewport frame)");
     }
 #endif
   }

From 848f38f7dc2b9e533be2d3ba9d25ec7a1ccddd25 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Mon, 17 Jun 2013 19:47:39 -0700
Subject: [PATCH 62/75] Back out b5854baf067d (bug 884004) for Android
 mochitest failures

---
 mobile/android/base/JavaAddonManager.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/android/base/JavaAddonManager.java b/mobile/android/base/JavaAddonManager.java
index fa59760d6d5d..9ab2906a0016 100644
--- a/mobile/android/base/JavaAddonManager.java
+++ b/mobile/android/base/JavaAddonManager.java
@@ -90,7 +90,7 @@ class JavaAddonManager implements GeckoEventListener {
                 Log.d(LOGTAG, "Attempting to load classes.dex file from " + zipFile + " and instantiate " + implClass);
                 try {
                     File tmpDir = mApplicationContext.getDir("dex", 0);
-                    DexClassLoader loader = new DexClassLoader(zipFile, tmpDir.getAbsolutePath(), null, mApplicationContext.getClassLoader());
+                    DexClassLoader loader = new DexClassLoader(zipFile, tmpDir.getAbsolutePath(), null, ClassLoader.getSystemClassLoader());
                     Class<?> c = loader.loadClass(implClass);
                     try {
                         Constructor<?> constructor = c.getDeclaredConstructor(Map.class);

From 1f65138696d5a0f908d1fb2178e37aa396a0c03f Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Mon, 17 Jun 2013 23:09:52 -0400
Subject: [PATCH 63/75] Follow-up to bug 674927 part 1: Mark the failing
 reftests as passing on Android since spell checking is completely disabled
 there

---
 editor/reftests/reftest.list | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/editor/reftests/reftest.list b/editor/reftests/reftest.list
index 0c2428858974..1f64c60886a6 100644
--- a/editor/reftests/reftest.list
+++ b/editor/reftests/reftest.list
@@ -114,8 +114,8 @@ fails-if(Android) != spellcheck-contenteditable-attr.html spellcheck-contentedit
 needs-focus == spellcheck-contenteditable-focused.html spellcheck-contenteditable-ref.html
 needs-focus == spellcheck-contenteditable-focused-reframe.html spellcheck-contenteditable-ref.html
 == spellcheck-contenteditable-nofocus.html spellcheck-contenteditable-disabled-ref.html
-fails == spellcheck-contenteditable-disabled.html spellcheck-contenteditable-disabled-ref.html
-fails == spellcheck-contenteditable-disabled-partial.html spellcheck-contenteditable-disabled-partial-ref.html
+fails-if(!Android) == spellcheck-contenteditable-disabled.html spellcheck-contenteditable-disabled-ref.html
+fails-if(!Android) == spellcheck-contenteditable-disabled-partial.html spellcheck-contenteditable-disabled-partial-ref.html
 == spellcheck-contenteditable-attr-inherit.html spellcheck-contenteditable-disabled-ref.html
 == spellcheck-contenteditable-attr-dynamic.html spellcheck-contenteditable-disabled-ref.html
 == spellcheck-contenteditable-attr-dynamic-inherit.html spellcheck-contenteditable-disabled-ref.html

From 1afac1f4387753befb04a4bcccba95888e24e880 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 17 Jun 2013 16:31:04 -0400
Subject: [PATCH 64/75] Bug 883358 part 1.  When creating getter/setter
 functions for the JSPROP_NATIVE_ACCESSORS case in
 JS_DefineProperties/JS_DefineProperty, give them the name of the property. 
 r=till

---
 js/src/jsapi.cpp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index f4102f447a67..92c30ecbdf45 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3853,10 +3853,15 @@ DefinePropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue val
      */
     if (attrs & JSPROP_NATIVE_ACCESSORS) {
         JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
+        JSFunction::Flags zeroFlags = JSAPIToJSFunctionFlags(0);
+        // We can't just use JS_NewFunctionById here because it
+        // assumes a string id.
+        RootedAtom atom(cx, JSID_IS_ATOM(id) ? JSID_TO_ATOM(id) : nullptr);
         attrs &= ~JSPROP_NATIVE_ACCESSORS;
         if (getter) {
             RootedObject global(cx, (JSObject*) &obj->global());
-            JSFunction *getobj = JS_NewFunction(cx, (Native) getter, 0, 0, global, NULL);
+            JSFunction *getobj = NewFunction(cx, NullPtr(), (Native) getter, 0,
+                                             zeroFlags, global, atom);
             if (!getobj)
                 return false;
 
@@ -3870,7 +3875,8 @@ DefinePropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue val
             // Root just the getter, since the setter is not yet a JSObject.
             AutoRooterGetterSetter getRoot(cx, JSPROP_GETTER, &getter, NULL);
             RootedObject global(cx, (JSObject*) &obj->global());
-            JSFunction *setobj = JS_NewFunction(cx, (Native) setter, 1, 0, global, NULL);
+            JSFunction *setobj = NewFunction(cx, NullPtr(), (Native) setter, 1,
+                                             zeroFlags, global, atom);
             if (!setobj)
                 return false;
 

From c23542725a82257bb8f039a9b6283cbba61f9e53 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 17 Jun 2013 16:31:13 -0400
Subject: [PATCH 65/75] Bug 883358 part 2.  Use the new information in bindings
 error reporting.  r=smaug

---
 dom/bindings/BindingUtils.cpp                 | 45 +++-------
 dom/bindings/BindingUtils.h                   |  9 +-
 dom/bindings/Codegen.py                       |  6 +-
 dom/bindings/Errors.msg                       |  6 +-
 dom/bindings/test/Makefile.in                 |  1 +
 .../test/test_exception_messages.html         | 82 +++++++++++++++++++
 6 files changed, 104 insertions(+), 45 deletions(-)
 create mode 100644 dom/bindings/test/test_exception_messages.html

diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index d2b16cf403e6..d6e5db56676d 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -60,47 +60,26 @@ ThrowErrorMessage(JSContext* aCx, const ErrNum aErrorNumber, ...)
 }
 
 bool
-ThrowInvalidMethodThis(JSContext* aCx, const JS::CallArgs& aArgs,
-                       const char* aInterfaceName)
+ThrowInvalidThis(JSContext* aCx, const JS::CallArgs& aArgs,
+                 const ErrNum aErrorNumber,
+                 const char* aInterfaceName)
 {
   NS_ConvertASCIItoUTF16 ifaceName(aInterfaceName);
-  // This should only be called for DOM methods, which are JSNative-backed
-  // functions, so we can assume that JS_ValueToFunction and
-  // JS_GetFunctionDisplayId will both return non-null and that
-  // JS_GetStringCharsZ returns non-null.
+  // This should only be called for DOM methods/getters/setters, which
+  // are JSNative-backed functions, so we can assume that
+  // JS_ValueToFunction and JS_GetFunctionDisplayId will both return
+  // non-null and that JS_GetStringCharsZ returns non-null.
   JS::Rooted<JSFunction*> func(aCx, JS_ValueToFunction(aCx, aArgs.calleev()));
   MOZ_ASSERT(func);
   JS::Rooted<JSString*> funcName(aCx, JS_GetFunctionDisplayId(func));
   MOZ_ASSERT(funcName);
   JS_ReportErrorNumberUC(aCx, GetErrorMessage, nullptr,
-                         static_cast<const unsigned>(MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE),
+                         static_cast<const unsigned>(aErrorNumber),
                          JS_GetStringCharsZ(aCx, funcName),
                          ifaceName.get());
   return false;
 }
 
-bool
-ThrowInvalidGetterThis(JSContext* aCx, const char* aInterfaceName)
-{
-  // Sadly for getters we have no way to get the name of the property.
-  NS_ConvertASCIItoUTF16 ifaceName(aInterfaceName);
-  JS_ReportErrorNumberUC(aCx, GetErrorMessage, nullptr,
-                         static_cast<const unsigned>(MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE),
-                         ifaceName.get());
-  return false;
-}
-
-bool
-ThrowInvalidSetterThis(JSContext* aCx, const char* aInterfaceName)
-{
-  // Sadly for setters we have no way to get the name of the property.
-  NS_ConvertASCIItoUTF16 ifaceName(aInterfaceName);
-  JS_ReportErrorNumberUC(aCx, GetErrorMessage, nullptr,
-                         static_cast<const unsigned>(MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE),
-                         ifaceName.get());
-  return false;
-}
-
 } // namespace dom
 
 struct ErrorResult::Message {
@@ -850,8 +829,8 @@ XrayResolveAttribute(JSContext* cx, JS::Handle<JSObject*> wrapper,
           // They all have getters, so we can just make it.
           JS::Rooted<JSObject*> global(cx, JS_GetGlobalForObject(cx, wrapper));
           JS::Rooted<JSFunction*> fun(cx,
-                                      JS_NewFunction(cx, (JSNative)attrSpec.getter.op,
-                                                     0, 0, global, nullptr));
+                                      JS_NewFunctionById(cx, (JSNative)attrSpec.getter.op,
+                                                         0, 0, global, id));
           if (!fun)
             return false;
           SET_JITINFO(fun, attrSpec.getter.info);
@@ -860,8 +839,8 @@ XrayResolveAttribute(JSContext* cx, JS::Handle<JSObject*> wrapper,
           desc->attrs |= JSPROP_GETTER;
           if (attrSpec.setter.op) {
             // We have a setter! Make it.
-            fun = JS_NewFunction(cx, (JSNative)attrSpec.setter.op, 1, 0,
-                                 global, nullptr);
+            fun = JS_NewFunctionById(cx, (JSNative)attrSpec.setter.op, 1, 0,
+                                     global, id);
             if (!fun)
               return false;
             SET_JITINFO(fun, attrSpec.setter.info);
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index 0042c1e97c7d..558fd89421a6 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -60,12 +60,9 @@ UnwrapArg(JSContext* cx, jsval v, Interface** ppArg,
 bool
 ThrowErrorMessage(JSContext* aCx, const ErrNum aErrorNumber, ...);
 bool
-ThrowInvalidMethodThis(JSContext* aCx, const JS::CallArgs& aArgs,
-                       const char* aInterfaceName);
-bool
-ThrowInvalidGetterThis(JSContext* aCx, const char* aInterfaceName);
-bool
-ThrowInvalidSetterThis(JSContext* aCx, const char* aInterfaceName);
+ThrowInvalidThis(JSContext* aCx, const JS::CallArgs& aArgs,
+                 const ErrNum aErrorNumber,
+                 const char* aInterfaceName);
 
 template<bool mainThread>
 inline bool
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index c144b0bf6852..f0e25fd11346 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -5185,7 +5185,7 @@ class CGGenericMethod(CGAbstractBindingMethod):
         args = [Argument('JSContext*', 'cx'), Argument('unsigned', 'argc'),
                 Argument('JS::Value*', 'vp')]
         unwrapFailureCode = (
-            'return ThrowInvalidMethodThis(cx, args, \"%s\");' %
+            'return ThrowInvalidThis(cx, args, MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE, \"%s\");' %
             descriptor.interface.identifier.name)
         CGAbstractBindingMethod.__init__(self, descriptor, 'genericMethod',
                                          args,
@@ -5322,7 +5322,7 @@ class CGGenericGetter(CGAbstractBindingMethod):
         else:
             name = "genericGetter"
             unwrapFailureCode = (
-                'return ThrowInvalidGetterThis(cx, "%s");' %
+                'return ThrowInvalidThis(cx, args, MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, "%s");' %
                 descriptor.interface.identifier.name)
         CGAbstractBindingMethod.__init__(self, descriptor, name, args,
                                          unwrapFailureCode)
@@ -5402,7 +5402,7 @@ class CGGenericSetter(CGAbstractBindingMethod):
         else:
             name = "genericSetter"
             unwrapFailureCode = (
-                'return ThrowInvalidSetterThis(cx, "%s");' %
+                'return ThrowInvalidThis(cx, args, MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, "%s");' %
                 descriptor.interface.identifier.name)
 
         CGAbstractBindingMethod.__init__(self, descriptor, name, args,
diff --git a/dom/bindings/Errors.msg b/dom/bindings/Errors.msg
index a705918f4f7e..68fb8762d767 100644
--- a/dom/bindings/Errors.msg
+++ b/dom/bindings/Errors.msg
@@ -24,9 +24,9 @@ MSG_DEF(MSG_MISSING_ARGUMENTS, 1, "Not enough arguments to {0}.")
 MSG_DEF(MSG_NOT_OBJECT, 1, "{0} is not an object.")
 MSG_DEF(MSG_NOT_CALLABLE, 1, "{0} is not callable.")
 MSG_DEF(MSG_DOES_NOT_IMPLEMENT_INTERFACE, 2, "{0} does not implement interface {1}.")
-MSG_DEF(MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "{0} called on an object that does not implement interface {1}.")
-MSG_DEF(MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 1, "getter called on an object that does not implement interface {0}.")
-MSG_DEF(MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 1, "setter called on an object that does not implement interface {0}.")
+MSG_DEF(MSG_METHOD_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "'{0}' called on an object that does not implement interface {1}.")
+MSG_DEF(MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "'{0}' getter called on an object that does not implement interface {1}.")
+MSG_DEF(MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 2, "'{0}' setter called on an object that does not implement interface {1}.")
 MSG_DEF(MSG_THIS_DOES_NOT_IMPLEMENT_INTERFACE, 1, "\"this\" object does not implement interface {0}.")
 MSG_DEF(MSG_NOT_IN_UNION, 2, "{0} could not be converted to any of: {1}.")
 MSG_DEF(MSG_ILLEGAL_CONSTRUCTOR, 0, "Illegal constructor.")
diff --git a/dom/bindings/test/Makefile.in b/dom/bindings/test/Makefile.in
index d28a87683401..2aacb59de809 100644
--- a/dom/bindings/test/Makefile.in
+++ b/dom/bindings/test/Makefile.in
@@ -75,6 +75,7 @@ MOCHITEST_FILES := \
   test_bug560072.html \
   test_lenientThis.html \
   test_ByteString.html \
+  test_exception_messages.html \
   $(NULL)
 
 MOCHITEST_CHROME_FILES = \
diff --git a/dom/bindings/test/test_exception_messages.html b/dom/bindings/test/test_exception_messages.html
new file mode 100644
index 000000000000..356cff93f631
--- /dev/null
+++ b/dom/bindings/test/test_exception_messages.html
@@ -0,0 +1,82 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=882653
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 882653</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 882653 **/
+  // Each test is a string to eval, the expected exception message, and the
+  // test description.
+  var tests = [
+      [ 'document.documentElement.appendChild.call({}, new Image())',
+        "'appendChild' called on an object that does not implement interface Node.",
+        "bogus method this object" ],
+      [ 'Object.getOwnPropertyDescriptor(Document.prototype, "documentElement").get.call({})',
+        "'documentElement' getter called on an object that does not implement interface Document.",
+        "bogus getter this object" ],
+      [ 'Object.getOwnPropertyDescriptor(Element.prototype, "innerHTML").set.call({})',
+        "'innerHTML' setter called on an object that does not implement interface Element.",
+        "bogus setter this object" ],
+      [ 'document.documentElement.appendChild(5)',
+        "Argument 1 of Node.appendChild is not an object.",
+        "bogus interface argument" ],
+      [ 'document.documentElement.appendChild(null)',
+        "Argument 1 of Node.appendChild is not an object.",
+        "null interface argument" ],
+      [ 'document.createTreeWalker(document).currentNode = 5',
+        "Value being assigned to TreeWalker.currentNode is not an object.",
+        "interface setter call" ],
+      [ 'document.documentElement.appendChild({})',
+        "Argument 1 of Node.appendChild does not implement interface Node.",
+        "wrong interface argument" ],
+      [ 'document.createTreeWalker(document).currentNode = {}',
+        "Value being assigned to TreeWalker.currentNode does not implement interface Node.",
+        "wrong interface setter call" ],
+      [ 'document.createElement("canvas").getContext("2d").fill("bogus")',
+        "Argument 1 of CanvasRenderingContext2D.fill 'bogus' is not a valid value for enumeration CanvasWindingRule.",
+        "bogus enum value" ],
+      [ 'document.createTreeWalker(document, 0xFFFFFFFF, { acceptNode: 5 }).nextNode()',
+        "Property 'acceptNode' is not callable.",
+        "non-callable callback interface operation property" ],
+      [ '(new TextEncoder).encode("", new RegExp())',
+        "Argument 2 of TextEncoder.encode can't be converted to a dictionary.",
+        "regexp passed for a dictionary" ],
+      [ 'URL.createObjectURL(null, null)',
+        "Argument 1 is not valid for any of the 2-argument overloads of URL.createObjectURL.",
+        "overload resolution failure" ],
+      [ 'document.createElement("select").add({})',
+        "Argument 1 of HTMLSelectElement.add could not be converted to any of: HTMLOptionElement, HTMLOptGroupElement.",
+        "invalid value passed for union" ],
+      [ 'document.createElement("canvas").getContext("2d").createLinearGradient(0, 1, 0, 1).addColorStop(NaN, "")',
+        "Argument 1 of CanvasGradient.addColorStop is not a finite floating-point value.",
+        "invalid float" ]
+  ];
+
+  for (var i = 0; i < tests.length; ++i) {
+      msg = "Correct exception should be thrown for " + tests[i][2];
+      try {
+          eval(tests[i][0]);
+          ok(false, msg);
+      } catch (e) {
+          is(e.message, tests[i][1], msg);
+      }
+  }
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=882653">Mozilla Bug 882653</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>

From c82376944c79b2d001e093c837f2632f724afde8 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Thu, 6 Jun 2013 21:35:53 -0700
Subject: [PATCH 66/75] Bug 634839 (part 2) - Remove more unnecessary #includes
 from SpiderMonkey.  r=jorendorff.

--HG--
extra : rebase_source : 32a4ee649fe206ddb966527eb0f6275c076cbea2
---
 js/src/assembler/jit/ExecutableAllocator.cpp  |  2 --
 js/src/assembler/jit/ExecutableAllocator.h    |  4 +---
 .../jit/ExecutableAllocatorPosix.cpp          |  6 +++--
 js/src/builtin/Eval.cpp                       |  6 +++--
 js/src/builtin/Intl.cpp                       |  3 ++-
 js/src/builtin/Intl.h                         |  2 ++
 js/src/builtin/MapObject.cpp                  |  1 -
 js/src/builtin/MapObject.h                    |  3 ---
 js/src/builtin/Object.cpp                     |  4 ++--
 js/src/builtin/ParallelArray.cpp              |  6 ++---
 js/src/builtin/Profilers.cpp                  | 13 ++++-------
 js/src/builtin/Profilers.h                    |  2 +-
 js/src/ds/LifoAlloc.h                         |  5 -----
 js/src/frontend/BytecodeCompiler.cpp          |  3 ---
 js/src/frontend/BytecodeCompiler.h            |  8 ++++++-
 js/src/frontend/BytecodeEmitter.cpp           | 10 ---------
 js/src/frontend/FoldConstants.cpp             |  8 ++-----
 js/src/frontend/NameFunctions.cpp             |  1 -
 js/src/frontend/ParseMaps-inl.h               |  1 -
 js/src/frontend/ParseMaps.cpp                 |  1 -
 js/src/frontend/ParseNode.cpp                 |  4 ----
 js/src/frontend/Parser.cpp                    | 13 -----------
 js/src/frontend/Parser.h                      |  4 ----
 js/src/gc/Iteration.cpp                       |  1 -
 js/src/gc/Marking.cpp                         |  7 ++----
 js/src/gc/Memory.cpp                          |  7 +-----
 js/src/jscntxtinlines.h                       |  2 ++
 js/src/jskwgen.cpp                            |  7 ++----
 js/src/vm/ArgumentsObject-inl.h               |  4 ++--
 js/src/vm/ArgumentsObject.cpp                 |  6 ++---
 js/src/vm/ArgumentsObject.h                   |  6 +++++
 js/src/vm/CharacterEncoding.cpp               |  3 ---
 js/src/vm/DateTime.h                          |  2 --
 js/src/vm/Debugger.cpp                        |  3 ---
 js/src/vm/Debugger.h                          |  4 ----
 js/src/vm/ForkJoin.cpp                        | 22 ++++++-------------
 js/src/vm/GlobalObject.cpp                    |  1 -
 js/src/vm/GlobalObject.h                      |  5 +----
 js/src/vm/Interpreter.cpp                     |  2 --
 js/src/vm/Interpreter.h                       |  1 -
 js/src/vm/Monitor.h                           |  5 -----
 js/src/vm/ObjectImpl.cpp                      |  6 -----
 js/src/vm/Probes-inl.h                        |  4 ----
 js/src/vm/Probes.cpp                          |  3 ---
 js/src/vm/PropertyKey.cpp                     |  6 ++---
 js/src/yarr/PageBlock.h                       |  3 +--
 46 files changed, 60 insertions(+), 160 deletions(-)

diff --git a/js/src/assembler/jit/ExecutableAllocator.cpp b/js/src/assembler/jit/ExecutableAllocator.cpp
index 737f6d3667eb..b8ba1eae05ac 100644
--- a/js/src/assembler/jit/ExecutableAllocator.cpp
+++ b/js/src/assembler/jit/ExecutableAllocator.cpp
@@ -31,8 +31,6 @@
 
 #if ENABLE_ASSEMBLER
 
-#include "prmjtime.h"
-
 namespace JSC {
 
 size_t ExecutableAllocator::pageSize = 0;
diff --git a/js/src/assembler/jit/ExecutableAllocator.h b/js/src/assembler/jit/ExecutableAllocator.h
index 3a756496066c..e3b9026b892e 100644
--- a/js/src/assembler/jit/ExecutableAllocator.h
+++ b/js/src/assembler/jit/ExecutableAllocator.h
@@ -30,10 +30,8 @@
 #include <limits>
 
 #include "jsalloc.h"
-#include "jsapi.h"
-#include "jsprvtd.h"
 
-#include "assembler/wtf/Assertions.h"
+#include "assembler/wtf/Platform.h"
 #include "js/HashTable.h"
 #include "js/Vector.h"
 
diff --git a/js/src/assembler/jit/ExecutableAllocatorPosix.cpp b/js/src/assembler/jit/ExecutableAllocatorPosix.cpp
index e334626ccc2f..e92ec809d368 100644
--- a/js/src/assembler/jit/ExecutableAllocatorPosix.cpp
+++ b/js/src/assembler/jit/ExecutableAllocatorPosix.cpp
@@ -23,13 +23,15 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "ExecutableAllocator.h"
+#include "assembler/jit/ExecutableAllocator.h"
 
 #if ENABLE_ASSEMBLER && WTF_OS_UNIX && !WTF_OS_SYMBIAN
 
 #include <sys/mman.h>
 #include <unistd.h>
-#include <wtf/VMTags.h>
+
+#include "assembler/wtf/Assertions.h"
+#include "assembler/wtf/VMTags.h"
 
 namespace JSC {
 
diff --git a/js/src/builtin/Eval.cpp b/js/src/builtin/Eval.cpp
index 2d8a26f2571d..f1d653fb6ac5 100644
--- a/js/src/builtin/Eval.cpp
+++ b/js/src/builtin/Eval.cpp
@@ -4,12 +4,14 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "builtin/Eval.h"
+
+#include "mozilla/HashFunctions.h"
+
 #include "jscntxt.h"
 #include "jsonparser.h"
 
-#include "builtin/Eval.h"
 #include "frontend/BytecodeCompiler.h"
-#include "mozilla/HashFunctions.h"
 #include "vm/GlobalObject.h"
 
 #include "vm/Interpreter-inl.h"
diff --git a/js/src/builtin/Intl.cpp b/js/src/builtin/Intl.cpp
index b3046461643d..343821f331dd 100644
--- a/js/src/builtin/Intl.cpp
+++ b/js/src/builtin/Intl.cpp
@@ -9,6 +9,8 @@
  * ECMAScript Internationalization API Specification.
  */
 
+#include "builtin/Intl.h"
+
 #include <string.h>
 
 #include "jsapi.h"
@@ -16,7 +18,6 @@
 #include "jscntxt.h"
 #include "jsobj.h"
 
-#include "builtin/Intl.h"
 #include "vm/DateTime.h"
 #include "vm/GlobalObject.h"
 #include "vm/Interpreter.h"
diff --git a/js/src/builtin/Intl.h b/js/src/builtin/Intl.h
index eefec5dbcaaa..d1c8279628b7 100644
--- a/js/src/builtin/Intl.h
+++ b/js/src/builtin/Intl.h
@@ -7,6 +7,8 @@
 #ifndef Intl_h___
 #define Intl_h___
 
+#include "jsapi.h"
+
 #include "js/RootingAPI.h"
 
 struct JSContext;
diff --git a/js/src/builtin/MapObject.cpp b/js/src/builtin/MapObject.cpp
index 43911619f274..d8266a0c3788 100644
--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@@ -14,7 +14,6 @@
 #include "js/Utility.h"
 #include "vm/GlobalObject.h"
 #include "vm/Interpreter.h"
-#include "vm/Stack.h"
 
 #include "jsobjinlines.h"
 
diff --git a/js/src/builtin/MapObject.h b/js/src/builtin/MapObject.h
index 4e58975f61b5..d89fb13449d3 100644
--- a/js/src/builtin/MapObject.h
+++ b/js/src/builtin/MapObject.h
@@ -7,9 +7,6 @@
 #ifndef MapObject_h__
 #define MapObject_h__
 
-#include "mozilla/FloatingPoint.h"
-#include "mozilla/GuardObjects.h"
-
 #include "jsapi.h"
 #include "jscntxt.h"
 #include "jsobj.h"
diff --git a/js/src/builtin/Object.cpp b/js/src/builtin/Object.cpp
index 0cb470a5c156..566f4bd1705c 100644
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -4,16 +4,16 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "builtin/Object.h"
+
 #include "mozilla/Util.h"
 
 #include "jscntxt.h"
 #include "jsobj.h"
 
-#include "builtin/Object.h"
 #include "frontend/BytecodeCompiler.h"
 #include "vm/StringBuffer.h"
 
-#include "jsfuninlines.h"
 #include "jsobjinlines.h"
 
 using namespace js;
diff --git a/js/src/builtin/ParallelArray.cpp b/js/src/builtin/ParallelArray.cpp
index fb0dab4b58f8..5066bcbc4419 100644
--- a/js/src/builtin/ParallelArray.cpp
+++ b/js/src/builtin/ParallelArray.cpp
@@ -6,16 +6,14 @@
 
 #include "jsapi.h"
 #include "jsobj.h"
-#include "jsarray.h"
 
 #include "builtin/ParallelArray.h"
 
-#include "vm/ForkJoin.h"
 #include "vm/GlobalObject.h"
 #include "vm/String.h"
-#include "vm/ThreadPool.h"
 
-#include "vm/Interpreter-inl.h"
+#include "jsgcinlines.h"
+#include "jsobjinlines.h"
 
 using namespace js;
 
diff --git a/js/src/builtin/Profilers.cpp b/js/src/builtin/Profilers.cpp
index 60c02ec90305..5c061657337e 100644
--- a/js/src/builtin/Profilers.cpp
+++ b/js/src/builtin/Profilers.cpp
@@ -6,16 +6,10 @@
 
 /* Profiling-related API */
 
+#include "builtin/Profilers.h"
+
 #include <stdarg.h>
 
-#include "Profilers.h"
-#include "jsapi.h"
-#include "jscntxt.h"
-
-#include "jscntxtinlines.h"
-#include "vm/Probes-inl.h"
-#include "vm/Stack-inl.h"
-
 #ifdef MOZ_CALLGRIND
 #include <valgrind/callgrind.h>
 #endif
@@ -25,6 +19,8 @@
 #include "devtools/Instruments.h"
 #endif
 
+#include "jscntxtinlines.h"
+
 using namespace js;
 
 using mozilla::ArrayLength;
@@ -449,7 +445,6 @@ js_DumpCallgrind(const char *outfile)
  * MOZ_PROFILE_PERF_FLAGS="-e 'foo bar'").
  */
 
-#include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
 #include <signal.h>
diff --git a/js/src/builtin/Profilers.h b/js/src/builtin/Profilers.h
index 59c4e992024d..5839ba7c61e7 100644
--- a/js/src/builtin/Profilers.h
+++ b/js/src/builtin/Profilers.h
@@ -11,7 +11,7 @@
 #ifndef Profilers_h___
 #define Profilers_h___
 
-#include "jsapi.h"
+#include "jstypes.h"
 
 /**
  * Start any profilers that are available and have been configured on for this
diff --git a/js/src/ds/LifoAlloc.h b/js/src/ds/LifoAlloc.h
index d2a8da9731b5..8b0471df2794 100644
--- a/js/src/ds/LifoAlloc.h
+++ b/js/src/ds/LifoAlloc.h
@@ -7,10 +7,7 @@
 #ifndef LifoAlloc_h__
 #define LifoAlloc_h__
 
-#include "mozilla/Assertions.h"
-#include "mozilla/Attributes.h"
 #include "mozilla/DebugOnly.h"
-#include "mozilla/GuardObjects.h"
 #include "mozilla/MemoryChecking.h"
 #include "mozilla/PodOperations.h"
 #include "mozilla/TypeTraits.h"
@@ -22,8 +19,6 @@
 
 #include "jsutil.h"
 
-#include "js/TemplateLib.h"
-
 namespace js {
 
 namespace detail {
diff --git a/js/src/frontend/BytecodeCompiler.cpp b/js/src/frontend/BytecodeCompiler.cpp
index 6abaf1cca6b1..fd042416185b 100644
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -13,14 +13,11 @@
 #include "ion/AsmJS.h"
 #include "vm/GlobalObject.h"
 
-#include "jsinferinlines.h"
 #include "jsobjinlines.h"
 
 #include "frontend/ParseMaps-inl.h"
-#include "frontend/ParseNode-inl.h"
 #include "frontend/Parser-inl.h"
 #include "frontend/SharedContext-inl.h"
-#include "vm/Probes-inl.h"
 
 using namespace js;
 using namespace js::frontend;
diff --git a/js/src/frontend/BytecodeCompiler.h b/js/src/frontend/BytecodeCompiler.h
index 35448cee16ec..8db4fea37014 100644
--- a/js/src/frontend/BytecodeCompiler.h
+++ b/js/src/frontend/BytecodeCompiler.h
@@ -8,9 +8,15 @@
 #define BytecodeCompiler_h__
 
 #include "jsapi.h"
-#include "jsprvtd.h"
+
+class JSLinearString;
 
 namespace js {
+
+class AutoNameVector;
+class LazyScript;
+struct SourceCompressionToken;
+
 namespace frontend {
 
 JSScript *
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 96b85132cbd4..81862a85aaae 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -14,31 +14,22 @@
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/PodOperations.h"
 
-#ifdef HAVE_MEMORY_H
-#include <memory.h>
-#endif
 #include <string.h>
 
 #include "jstypes.h"
 #include "jsutil.h"
-#include "jsprf.h"
 #include "jsapi.h"
 #include "jsatom.h"
 #include "jscntxt.h"
-#include "jsversion.h"
 #include "jsfun.h"
 #include "jsnum.h"
 #include "jsopcode.h"
 #include "jsscript.h"
-#include "jsautooplen.h"        // generated headers last
 
-#include "ds/LifoAlloc.h"
 #include "frontend/Parser.h"
 #include "frontend/TokenStream.h"
 #include "ion/AsmJS.h"
 #include "vm/Debugger.h"
-#include "vm/RegExpObject.h"
-#include "vm/Shape.h"
 
 #include "jsatominlines.h"
 #include "jsobjinlines.h"
@@ -47,7 +38,6 @@
 #include "frontend/ParseMaps-inl.h"
 #include "frontend/ParseNode-inl.h"
 #include "frontend/SharedContext-inl.h"
-#include "vm/Shape-inl.h"
 
 using namespace js;
 using namespace js::gc;
diff --git a/js/src/frontend/FoldConstants.cpp b/js/src/frontend/FoldConstants.cpp
index ea4e1419e9ba..650a739cfc74 100644
--- a/js/src/frontend/FoldConstants.cpp
+++ b/js/src/frontend/FoldConstants.cpp
@@ -4,20 +4,16 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "frontend/FoldConstants.h"
+
 #include "mozilla/FloatingPoint.h"
 
 #include "jslibmath.h"
 
-#include "frontend/FoldConstants.h"
 #include "frontend/ParseNode.h"
 #include "frontend/Parser.h"
 #include "vm/NumericConversions.h"
 
-#include "jsatominlines.h"
-
-#include "frontend/Parser-inl.h"
-#include "vm/String-inl.h"
-
 using namespace js;
 using namespace js::frontend;
 
diff --git a/js/src/frontend/NameFunctions.cpp b/js/src/frontend/NameFunctions.cpp
index 9f079059237b..9cca6922514c 100644
--- a/js/src/frontend/NameFunctions.cpp
+++ b/js/src/frontend/NameFunctions.cpp
@@ -15,7 +15,6 @@
 
 #include "jsfuninlines.h"
 
-#include "vm/String-inl.h"
 #include "vm/StringBuffer.h"
 
 using namespace js;
diff --git a/js/src/frontend/ParseMaps-inl.h b/js/src/frontend/ParseMaps-inl.h
index 035620b5ffda..406de83de820 100644
--- a/js/src/frontend/ParseMaps-inl.h
+++ b/js/src/frontend/ParseMaps-inl.h
@@ -9,7 +9,6 @@
 
 #include "jscntxt.h"
 
-#include "frontend/ParseNode.h" /* Need sizeof(js::Definition). */
 #include "frontend/ParseMaps.h"
 
 namespace js {
diff --git a/js/src/frontend/ParseMaps.cpp b/js/src/frontend/ParseMaps.cpp
index e7ffef5462ad..332927be4764 100644
--- a/js/src/frontend/ParseMaps.cpp
+++ b/js/src/frontend/ParseMaps.cpp
@@ -5,7 +5,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "jscntxt.h"
-#include "jscompartment.h"
 #include "FullParseHandler.h"
 #include "SyntaxParseHandler.h"
 
diff --git a/js/src/frontend/ParseNode.cpp b/js/src/frontend/ParseNode.cpp
index 2089ec7fd4c4..7319f945f8b4 100644
--- a/js/src/frontend/ParseNode.cpp
+++ b/js/src/frontend/ParseNode.cpp
@@ -8,10 +8,6 @@
 #include "frontend/ParseNode.h"
 #include "frontend/Parser.h"
 
-#include "jsscriptinlines.h"
-
-#include "frontend/ParseMaps-inl.h"
-#include "frontend/ParseNode-inl.h"
 #include "frontend/Parser-inl.h"
 
 using namespace js;
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 32b07164672e..06e4bbcb23d2 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -19,32 +19,20 @@
 
 #include "frontend/Parser.h"
 
-#include <stdlib.h>
-#include <string.h>
-
 #include "jstypes.h"
-#include "jsutil.h"
 #include "jsapi.h"
-#include "jsarray.h"
 #include "jsatom.h"
 #include "jscntxt.h"
 #include "jsversion.h"
 #include "jsfun.h"
-#include "jsgc.h"
-#include "jsiter.h"
-#include "jslock.h"
-#include "jsnum.h"
 #include "jsobj.h"
 #include "jsopcode.h"
 #include "jsscript.h"
-#include "jsstr.h"
 
 #include "frontend/BytecodeCompiler.h"
 #include "frontend/FoldConstants.h"
 #include "frontend/ParseMaps.h"
 #include "frontend/TokenStream.h"
-#include "gc/Marking.h"
-#include "vm/Interpreter.h"
 #include "vm/Shape.h"
 
 #include "jsatominlines.h"
@@ -57,7 +45,6 @@
 #include "frontend/SharedContext-inl.h"
 
 #include "vm/NumericConversions.h"
-#include "vm/RegExpObject-inl.h"
 #include "vm/RegExpStatics-inl.h"
 
 using namespace js;
diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h
index 4f7f361984c2..bd4d8a600bd6 100644
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -10,12 +10,8 @@
 /*
  * JS parser definitions.
  */
-#include "jsversion.h"
 #include "jsprvtd.h"
 #include "jspubtd.h"
-#include "jsatom.h"
-#include "jsscript.h"
-#include "jswin.h"
 
 #include "frontend/BytecodeCompiler.h"
 #include "frontend/FullParseHandler.h"
diff --git a/js/src/gc/Iteration.cpp b/js/src/gc/Iteration.cpp
index 9421fd9f8882..b69058d63d04 100644
--- a/js/src/gc/Iteration.cpp
+++ b/js/src/gc/Iteration.cpp
@@ -7,7 +7,6 @@
 #include "jsapi.h"
 #include "jscntxt.h"
 #include "jsgc.h"
-#include "jsprf.h"
 
 #include "js/HashTable.h"
 #include "gc/GCInternals.h"
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index de6ba90068aa..39535157e87d 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -4,18 +4,15 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "gc/Marking.h"
+
 #include "mozilla/DebugOnly.h"
 
-#include "jsprf.h"
-#include "jsstr.h"
-
-#include "gc/Marking.h"
 #include "ion/IonCode.h"
 #include "vm/Shape.h"
 
 #include "jscompartmentinlines.h"
 
-#include "gc/Nursery-inl.h"
 #include "vm/Shape-inl.h"
 #include "vm/String-inl.h"
 
diff --git a/js/src/gc/Memory.cpp b/js/src/gc/Memory.cpp
index 399177771718..c121f52f5db9 100644
--- a/js/src/gc/Memory.cpp
+++ b/js/src/gc/Memory.cpp
@@ -4,13 +4,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/Assertions.h"
-
-#include "jsapi.h"
+#include "gc/Memory.h"
 
 #include "js/HeapAPI.h"
-#include "js/Utility.h"
-#include "gc/Memory.h"
 
 using namespace js;
 using namespace js::gc;
@@ -307,7 +303,6 @@ gc::GetPageFaultCount()
 #elif defined(XP_UNIX) || defined(XP_MACOSX) || defined(DARWIN)
 
 #include <sys/mman.h>
-#include <sys/time.h>
 #include <sys/resource.h>
 #include <unistd.h>
 
diff --git a/js/src/jscntxtinlines.h b/js/src/jscntxtinlines.h
index b7a8a0bc7a9e..0d70eade0b08 100644
--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -12,6 +12,8 @@
 #include "jscompartment.h"
 #include "jsfriendapi.h"
 #include "jsgc.h"
+#include "jsiter.h"
+
 #include "builtin/Object.h" // For js::obj_construct
 #include "frontend/ParseMaps.h"
 #include "vm/Interpreter.h"
diff --git a/js/src/jskwgen.cpp b/js/src/jskwgen.cpp
index c5e66707fb98..19d1cd1d7e1e 100644
--- a/js/src/jskwgen.cpp
+++ b/js/src/jskwgen.cpp
@@ -4,15 +4,12 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include <stddef.h>
 #include <assert.h>
+#include <ctype.h>
+#include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <stdarg.h>
-#include <ctype.h>
-
-#include "jsversion.h"
 
 #include "vm/Keywords.h"
 
diff --git a/js/src/vm/ArgumentsObject-inl.h b/js/src/vm/ArgumentsObject-inl.h
index 9a9bd505a761..82880151cd5e 100644
--- a/js/src/vm/ArgumentsObject-inl.h
+++ b/js/src/vm/ArgumentsObject-inl.h
@@ -7,9 +7,9 @@
 #ifndef ArgumentsObject_inl_h___
 #define ArgumentsObject_inl_h___
 
-#include "ArgumentsObject.h"
+#include "vm/ArgumentsObject.h"
 
-#include "ScopeObject-inl.h"
+#include "vm/ScopeObject.h"
 
 namespace js {
 
diff --git a/js/src/vm/ArgumentsObject.cpp b/js/src/vm/ArgumentsObject.cpp
index 57e16941b96b..e9163cf22f89 100644
--- a/js/src/vm/ArgumentsObject.cpp
+++ b/js/src/vm/ArgumentsObject.cpp
@@ -4,19 +4,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "jsgc.h"
+#include "vm/ArgumentsObject-inl.h"
+
 #include "jsinfer.h"
 
 #include "vm/GlobalObject.h"
-#include "vm/Interpreter.h"
 #include "vm/Stack.h"
-#include "vm/Xdr.h"
 
 #include "jsobjinlines.h"
 
 #include "gc/Barrier-inl.h"
 #include "vm/Stack-inl.h"
-#include "vm/ArgumentsObject-inl.h"
 
 #if defined(JS_ION)
 #include "ion/IonFrames.h"
diff --git a/js/src/vm/ArgumentsObject.h b/js/src/vm/ArgumentsObject.h
index 79d0cfbc935c..81dc51b61f99 100644
--- a/js/src/vm/ArgumentsObject.h
+++ b/js/src/vm/ArgumentsObject.h
@@ -11,6 +11,12 @@
 
 namespace js {
 
+class AbstractFramePtr;
+
+namespace ion {
+class IonJSFrameLayout;
+}
+
 /*
  * ArgumentsData stores the initial indexed arguments provided to the
  * corresponding and that function itself.  It is used to store arguments[i]
diff --git a/js/src/vm/CharacterEncoding.cpp b/js/src/vm/CharacterEncoding.cpp
index 79266f4fd4db..bc067de24010 100644
--- a/js/src/vm/CharacterEncoding.cpp
+++ b/js/src/vm/CharacterEncoding.cpp
@@ -8,9 +8,6 @@
 
 #include "js/CharacterEncoding.h"
 
-#include "jscntxtinlines.h"
-#include "jsscriptinlines.h"
-
 using namespace JS;
 
 Latin1CharsZ
diff --git a/js/src/vm/DateTime.h b/js/src/vm/DateTime.h
index b0c2a9af8144..965cf2b5eaa4 100644
--- a/js/src/vm/DateTime.h
+++ b/js/src/vm/DateTime.h
@@ -11,8 +11,6 @@
 #include "mozilla/MathAlgorithms.h"
 #include "mozilla/StandardInteger.h"
 
-#include <math.h>
-
 #include "NumericConversions.h"
 
 namespace js {
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 7c88df9dd075..9cc7c4d42b1c 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -6,8 +6,6 @@
 
 #include "vm/Debugger.h"
 
-#include <limits.h>
-
 #include "jsapi.h"
 #include "jscntxt.h"
 #include "jscompartment.h"
@@ -24,7 +22,6 @@
 #include "jsopcodeinlines.h"
 
 #include "gc/FindSCCs-inl.h"
-#include "vm/Interpreter-inl.h"
 #include "vm/Stack-inl.h"
 
 using namespace js;
diff --git a/js/src/vm/Debugger.h b/js/src/vm/Debugger.h
index dc63a22b6fa1..c7f9927d94c4 100644
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -7,19 +7,15 @@
 #ifndef Debugger_h__
 #define Debugger_h__
 
-#include "mozilla/Attributes.h"
 #include "mozilla/LinkedList.h"
 
 #include "jsapi.h"
 #include "jsclist.h"
 #include "jscntxt.h"
 #include "jscompartment.h"
-#include "jsgc.h"
 #include "jsweakmap.h"
-#include "jswrapper.h"
 
 #include "gc/Barrier.h"
-#include "gc/FindSCCs.h"
 #include "js/HashTable.h"
 #include "vm/GlobalObject.h"
 
diff --git a/js/src/vm/ForkJoin.cpp b/js/src/vm/ForkJoin.cpp
index 5d2f6888872f..d7f62403e923 100644
--- a/js/src/vm/ForkJoin.cpp
+++ b/js/src/vm/ForkJoin.cpp
@@ -5,22 +5,19 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "jscntxt.h"
-#include "jscompartment.h"
-
-#include "vm/ForkJoin.h"
-#include "vm/Monitor.h"
-#include "gc/Marking.h"
-#include "ion/BaselineJIT.h"
-
-#ifdef JS_ION
-#  include "ion/ParallelArrayAnalysis.h"
-#endif
 
 #ifdef JS_THREADSAFE
 #  include "prthread.h"
 #  include "prprf.h"
 #endif
 
+#include "vm/ForkJoin.h"
+
+#if defined(JS_THREADSAFE)
+#include "ion/BaselineJIT.h"
+#include "vm/Monitor.h"
+#endif
+
 #if defined(DEBUG) && defined(JS_THREADSAFE) && defined(JS_ION)
 #  include "ion/Ion.h"
 #  include "ion/MIR.h"
@@ -28,11 +25,6 @@
 #  include "ion/IonCompartment.h"
 #endif // DEBUG && THREADSAFE && ION
 
-// For extracting stack extent for each thread.
-#include "jsnativestack.h"
-
-#include "jsinferinlines.h"
-
 #include "vm/Interpreter-inl.h"
 
 using namespace js;
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index 9e9f6a20c355..71e17c86c22a 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -24,7 +24,6 @@
 #include "jsobjinlines.h"
 
 #include "vm/GlobalObject-inl.h"
-#include "vm/RegExpObject-inl.h"
 #include "vm/RegExpStatics-inl.h"
 
 using namespace js;
diff --git a/js/src/vm/GlobalObject.h b/js/src/vm/GlobalObject.h
index 1fa90af1e530..4e490aa0a272 100644
--- a/js/src/vm/GlobalObject.h
+++ b/js/src/vm/GlobalObject.h
@@ -7,19 +7,16 @@
 #ifndef GlobalObject_h___
 #define GlobalObject_h___
 
-#include "mozilla/Attributes.h"
 #include "mozilla/DebugOnly.h"
 
 #include "jsarray.h"
 #include "jsbool.h"
 #include "jsexn.h"
 #include "jsfun.h"
-#include "jsiter.h"
 #include "jsnum.h"
 
-#include "js/Vector.h"
-
 #include "builtin/RegExp.h"
+#include "js/Vector.h"
 
 extern JSObject *
 js_InitObjectClass(JSContext *cx, js::HandleObject obj);
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index ba75d1728e1f..0f9091b019f1 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -14,7 +14,6 @@
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/PodOperations.h"
 
-#include <stdio.h>
 #include <string.h>
 
 #include "jsapi.h"
@@ -32,7 +31,6 @@
 #include "jspropertycache.h"
 #include "jsscript.h"
 #include "jsstr.h"
-#include "jsversion.h"
 #include "builtin/Eval.h"
 #include "ion/BaselineJIT.h"
 #include "ion/Ion.h"
diff --git a/js/src/vm/Interpreter.h b/js/src/vm/Interpreter.h
index f46b63d048ac..c7161c4ceef4 100644
--- a/js/src/vm/Interpreter.h
+++ b/js/src/vm/Interpreter.h
@@ -11,7 +11,6 @@
  */
 #include "jsprvtd.h"
 #include "jspubtd.h"
-#include "jsopcode.h"
 
 #include "vm/Stack.h"
 
diff --git a/js/src/vm/Monitor.h b/js/src/vm/Monitor.h
index 9b0144586bde..af31537bc935 100644
--- a/js/src/vm/Monitor.h
+++ b/js/src/vm/Monitor.h
@@ -7,11 +7,6 @@
 #ifndef Monitor_h__
 #define Monitor_h__
 
-#include <stdlib.h>
-
-#include "mozilla/DebugOnly.h"
-
-#include "js/Utility.h"
 #include "jslock.h"
 
 namespace js {
diff --git a/js/src/vm/ObjectImpl.cpp b/js/src/vm/ObjectImpl.cpp
index 8633d5b31140..b937c62d65c0 100644
--- a/js/src/vm/ObjectImpl.cpp
+++ b/js/src/vm/ObjectImpl.cpp
@@ -4,21 +4,15 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/Assertions.h"
-#include "mozilla/Attributes.h"
-
-#include "js/TemplateLib.h"
 #include "js/Value.h"
 #include "vm/Debugger.h"
 #include "vm/ObjectImpl.h"
 
-#include "jsatominlines.h"
 #include "jsobjinlines.h"
 
 #include "gc/Barrier-inl.h"
 #include "gc/Marking.h"
 #include "vm/ObjectImpl-inl.h"
-#include "vm/Shape-inl.h"
 
 using namespace js;
 
diff --git a/js/src/vm/Probes-inl.h b/js/src/vm/Probes-inl.h
index 827247065954..eec9d15b40c7 100644
--- a/js/src/vm/Probes-inl.h
+++ b/js/src/vm/Probes-inl.h
@@ -10,10 +10,6 @@
 #include "vm/Probes.h"
 
 #include "jscntxt.h"
-#include "jsobj.h"
-#include "jsscript.h"
-
-#include "vm/Stack-inl.h"
 
 namespace js {
 
diff --git a/js/src/vm/Probes.cpp b/js/src/vm/Probes.cpp
index 2d42597eff67..68d56c519c25 100644
--- a/js/src/vm/Probes.cpp
+++ b/js/src/vm/Probes.cpp
@@ -7,14 +7,11 @@
 #include "Probes-inl.h"
 
 #include "jscntxt.h"
-#include "jsscript.h"
 
 #ifdef INCLUDE_MOZILLA_DTRACE
 #include "jsscriptinlines.h" 
 #endif
 
-#include "vm/Stack-inl.h"
-
 #define TYPEOF(cx,v)    (JSVAL_IS_NULL(v) ? JSTYPE_NULL : JS_TypeOfValue(cx,v))
 
 using namespace js;
diff --git a/js/src/vm/PropertyKey.cpp b/js/src/vm/PropertyKey.cpp
index 0935cd377c8b..02e33eb3b273 100644
--- a/js/src/vm/PropertyKey.cpp
+++ b/js/src/vm/PropertyKey.cpp
@@ -6,16 +6,16 @@
 
 /* PropertyKey implementation details. */
 
-#include "mozilla/Assertions.h"
-
 #include "js/PropertyKey.h"
+
 #include "js/RootingAPI.h"
 #include "js/Value.h"
 #include "vm/String.h"
 
-#include "jsinferinlines.h"
 #include "jsatominlines.h"
 
+#include "vm/String-inl.h"
+
 using namespace js;
 
 bool
diff --git a/js/src/yarr/PageBlock.h b/js/src/yarr/PageBlock.h
index ea98f42f2237..2d58b2ded155 100644
--- a/js/src/yarr/PageBlock.h
+++ b/js/src/yarr/PageBlock.h
@@ -32,8 +32,7 @@
 
 #include "mozilla/StandardInteger.h"
 
-#include <stdlib.h>
-#include "assembler/wtf/Platform.h"
+#include <stddef.h>
 
 namespace WTF {
 

From 67e00e01590fee42dcd6f70a488f82b9e3b44170 Mon Sep 17 00:00:00 2001
From: Nikhil Marathe <nsm.nikhil@gmail.com>
Date: Mon, 17 Jun 2013 11:36:58 -0700
Subject: [PATCH 67/75] Bug 863660 - Add pref to enable/disable SimplePush
 WebSocket. r=dougt

This pref should be used in UX to enable/disable push notifications
when the user wants to conserve battery life or save data usage.

--HG--
extra : rebase_source : a75b089082a4d44170890cae228c62114633f790
---
 b2g/app/b2g.js               |  3 +++
 dom/push/src/Push.js         |  7 ++++++
 dom/push/src/PushService.jsm | 43 +++++++++++++++++++++---------------
 3 files changed, 35 insertions(+), 18 deletions(-)

diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index d795973b260c..da73e43d6181 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -398,6 +398,9 @@ pref("dom.mozAlarms.enabled", true);
 
 // SimplePush
 pref("services.push.enabled", true);
+// Is the network connection allowed to be up?
+// This preference should be used in UX to enable/disable push.
+pref("services.push.connection.enabled", true);
 // serverURL to be assigned by services team
 pref("services.push.serverURL", "");
 pref("services.push.userAgentID", "");
diff --git a/dom/push/src/Push.js b/dom/push/src/Push.js
index d22fea401ade..3ae2a6ac573a 100644
--- a/dom/push/src/Push.js
+++ b/dom/push/src/Push.js
@@ -121,6 +121,13 @@ Push.prototype = {
   register: function() {
     debug("register()");
     var req = this.createRequest();
+    if (!Services.prefs.getBoolPref("services.push.connection.enabled")) {
+      // If push socket is disabled by the user, immediately error rather than
+      // timing out.
+      Services.DOMRequest.fireErrorAsync(req, "NetworkError");
+      return req;
+    }
+
     this._cpmm.sendAsyncMessage("Push:Register", {
                                   pageURL: this._pageURL.spec,
                                   manifestURL: this._manifestURL,
diff --git a/dom/push/src/PushService.jsm b/dom/push/src/PushService.jsm
index e161cb39a638..4f9b20f348c6 100644
--- a/dom/push/src/PushService.jsm
+++ b/dom/push/src/PushService.jsm
@@ -307,12 +307,7 @@ this.PushService = {
         // Try to connect if network-active-changed or the offline-status
         // changed to online.
         if (aTopic === "network-active-changed" || aData === "online") {
-          // Check to see if we need to do anything.
-          this._db.getAllChannelIDs(function(channelIDs) {
-            if (channelIDs.length > 0) {
-              this._beginWSSetup();
-            }
-          }.bind(this));
+          this._startListeningIfChannelsPresent();
         }
         break;
       case "nsPref:changed":
@@ -320,6 +315,12 @@ this.PushService = {
           debug("services.push.serverURL changed! websocket. new value " +
                 prefs.get("serverURL"));
           this._shutdownWS();
+        } else if (aData == "services.push.connection.enabled") {
+          if (prefs.get("connection.enabled")) {
+            this._startListeningIfChannelsPresent();
+          } else {
+            this._shutdownWS();
+          }
         }
         break;
       case "timer-callback":
@@ -429,18 +430,7 @@ this.PushService = {
 
     this._udpPort = prefs.get("udp.port");
 
-    this._db.getAllChannelIDs(
-      function(channelIDs) {
-        if (channelIDs.length > 0) {
-          debug("Found registered channelIDs. Starting WebSocket");
-          this._beginWSSetup();
-        }
-      }.bind(this),
-
-      function(error) {
-        debug("db error " + error);
-      }
-    );
+    this._startListeningIfChannelsPresent();
 
     Services.obs.addObserver(this, "xpcom-shutdown", false);
     Services.obs.addObserver(this, "webapps-uninstall", false);
@@ -468,6 +458,8 @@ this.PushService = {
     // This is only used for testing. Different tests require connecting to
     // slightly different URLs.
     prefs.observe("serverURL", this);
+    // Used to monitor if the user wishes to disable Push.
+    prefs.observe("connection.enabled", this);
   },
 
   _shutdownWS: function() {
@@ -492,6 +484,7 @@ this.PushService = {
 
     debug("uninit()");
 
+    prefs.ignore("connection.enabled", this);
     prefs.ignore("serverURL", this);
     Services.obs.removeObserver(this, this._getNetworkStateChangeEventName());
     Services.obs.removeObserver(this, "webapps-uninstall", false);
@@ -562,6 +555,11 @@ this.PushService = {
       return;
     }
 
+    if (!prefs.get("connection.enabled")) {
+      debug("_beginWSSetup: connection.enabled is not set to true. Aborting.");
+      return;
+    }
+
     // Stop any pending reconnects scheduled for the near future.
     this._stopAlarm();
 
@@ -606,6 +604,15 @@ this.PushService = {
     this._currentState = STATE_WAITING_FOR_WS_START;
   },
 
+  _startListeningIfChannelsPresent: function() {
+    // Check to see if we need to do anything.
+    this._db.getAllChannelIDs(function(channelIDs) {
+      if (channelIDs.length > 0) {
+        this._beginWSSetup();
+      }
+    }.bind(this));
+  },
+
   /** |delay| should be in milliseconds. */
   _setAlarm: function(delay) {
     // Stop any existing alarm.

From f5c75311d166e3345dc61d8254b22785f0d3b307 Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jkew@mozilla.com>
Date: Tue, 18 Jun 2013 07:50:02 +0100
Subject: [PATCH 68/75] bug 877203 - consistently use pixel-rounded values for
 maxAscent/Descent in the FT2 font metrics. r=roc

---
 gfx/thebes/gfxFT2Utils.cpp | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/gfx/thebes/gfxFT2Utils.cpp b/gfx/thebes/gfxFT2Utils.cpp
index 5cbd1fdae895..25efc2795483 100644
--- a/gfx/thebes/gfxFT2Utils.cpp
+++ b/gfx/thebes/gfxFT2Utils.cpp
@@ -117,10 +117,12 @@ gfxFT2LockedFace::GetMetrics(gfxFont::Metrics* aMetrics,
 
         // maxAscent/maxDescent get used for frame heights, and some fonts
         // don't have the HHEA table ascent/descent set (bug 279032).
-        if (aMetrics->emAscent > aMetrics->maxAscent)
-            aMetrics->maxAscent = aMetrics->emAscent;
-        if (aMetrics->emDescent > aMetrics->maxDescent)
-            aMetrics->maxDescent = aMetrics->emDescent;
+        // We use NS_round here to parallel the pixel-rounded values that
+        // freetype gives us for ftMetrics.ascender/descender.
+        aMetrics->maxAscent =
+            std::max(aMetrics->maxAscent, NS_round(aMetrics->emAscent));
+        aMetrics->maxDescent =
+            std::max(aMetrics->maxDescent, NS_round(aMetrics->emDescent));
     } else {
         aMetrics->emAscent = aMetrics->maxAscent;
         aMetrics->emDescent = aMetrics->maxDescent;

From d8a5222e3e958be70ce6a9f4c944b36d76b606ef Mon Sep 17 00:00:00 2001
From: Max Li <maxli@maxli.ca>
Date: Mon, 17 Jun 2013 16:25:24 -0400
Subject: [PATCH 69/75] Bug 756690 - Add option to not land on images with no
 alt text. r=eeejay

---
 accessible/src/jsat/TraversalRules.jsm | 18 ++++++++++++++++--
 b2g/app/b2g.js                         |  2 ++
 mobile/android/app/mobile.js           |  2 ++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/accessible/src/jsat/TraversalRules.jsm b/accessible/src/jsat/TraversalRules.jsm
index 6cb47ec5ce21..4631d9ee3e54 100644
--- a/accessible/src/jsat/TraversalRules.jsm
+++ b/accessible/src/jsat/TraversalRules.jsm
@@ -14,6 +14,8 @@ this.EXPORTED_SYMBOLS = ['TraversalRules'];
 Cu.import('resource://gre/modules/accessibility/Utils.jsm');
 Cu.import('resource://gre/modules/XPCOMUtils.jsm');
 
+let gSkipEmptyImages = new PrefCache('accessibility.accessfu.skip_empty_images');
+
 function BaseTraversalRule(aRoles, aMatchFunc) {
   this._matchRoles = aRoles;
   this._matchFunc = aMatchFunc;
@@ -103,6 +105,8 @@ this.TraversalRules = {
 
           return Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
         }
+      case Ci.nsIAccessibleRole.ROLE_GRAPHIC:
+        return TraversalRules._shouldSkipImage(aAccessible);
       default:
         // Ignore the subtree, if there is one. So that we don't land on
         // the same content that was already presented by its parent.
@@ -168,7 +172,10 @@ this.TraversalRules = {
      Ci.nsIAccessibleRole.ROLE_CHECK_MENU_ITEM]),
 
   Graphic: new BaseTraversalRule(
-    [Ci.nsIAccessibleRole.ROLE_GRAPHIC]),
+    [Ci.nsIAccessibleRole.ROLE_GRAPHIC],
+    function Graphic_match(aAccessible) {
+      return TraversalRules._shouldSkipImage(aAccessible);
+    }),
 
   Heading: new BaseTraversalRule(
     [Ci.nsIAccessibleRole.ROLE_HEADING]),
@@ -211,5 +218,12 @@ this.TraversalRules = {
 
   Checkbox: new BaseTraversalRule(
     [Ci.nsIAccessibleRole.ROLE_CHECKBUTTON,
-     Ci.nsIAccessibleRole.ROLE_CHECK_MENU_ITEM])
+     Ci.nsIAccessibleRole.ROLE_CHECK_MENU_ITEM]),
+
+  _shouldSkipImage: function _shouldSkipImage(aAccessible) {
+    if (gSkipEmptyImages.value && aAccessible.name === '') {
+      return Ci.nsIAccessibleTraversalRule.FILTER_IGNORE;
+    }
+    return Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
+  }
 };
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index d795973b260c..3b9269c1328a 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -641,6 +641,8 @@ pref("dom.disable_window_open_dialog_feature", true);
 
 // Screen reader support
 pref("accessibility.accessfu.activate", 2);
+// Whether to skip images with empty alt text
+pref("accessibility.accessfu.skip_empty_images", true);
 
 // Enable hit-target fluffing
 pref("ui.touch.radius.enabled", false);
diff --git a/mobile/android/app/mobile.js b/mobile/android/app/mobile.js
index 4414365f9cef..0a4a191458c4 100644
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@@ -649,6 +649,8 @@ pref("accessibility.accessfu.activate", 2);
 pref("accessibility.accessfu.quicknav_modes", "Link,Heading,FormElement,ListItem");
 // Setting for an utterance order (0 - description first, 1 - description last).
 pref("accessibility.accessfu.utterance", 0);
+// Whether to skip images with empty alt text
+pref("accessibility.accessfu.skip_empty_images", true);
 
 // Mobile manages state by autodetection
 pref("network.manage-offline-status", true);

From d6036e944c12d4908ba68e631312132e6492ec1e Mon Sep 17 00:00:00 2001
From: Siddartha P <psiddh@gmail.com>
Date: Mon, 17 Jun 2013 15:33:48 -0700
Subject: [PATCH 70/75] Bug 879821 - NFC B2G IPC Implementation Using
 UnixSockets; r=qdot

---
 ipc/nfc/Makefile.in |  22 +++++
 ipc/nfc/Nfc.cpp     | 220 ++++++++++++++++++++++++++++++++++++++++++++
 ipc/nfc/Nfc.h       |  37 ++++++++
 ipc/nfc/moz.build   |  13 +++
 4 files changed, 292 insertions(+)
 create mode 100644 ipc/nfc/Makefile.in
 create mode 100644 ipc/nfc/Nfc.cpp
 create mode 100644 ipc/nfc/Nfc.h
 create mode 100644 ipc/nfc/moz.build

diff --git a/ipc/nfc/Makefile.in b/ipc/nfc/Makefile.in
new file mode 100644
index 000000000000..86fb1b77e84b
--- /dev/null
+++ b/ipc/nfc/Makefile.in
@@ -0,0 +1,22 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+DEPTH = @DEPTH@
+topsrcdir = @top_srcdir@
+srcdir = @srcdir@
+VPATH = @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+LIBRARY_NAME = moznfc_s
+FORCE_STATIC_LIB = 1
+LIBXUL_LIBRARY = 1
+EXPORT_LIBRARY = 1
+
+EXPORTS_NAMESPACES = mozilla/ipc
+
+include $(topsrcdir)/config/config.mk
+include $(topsrcdir)/ipc/chromium/chromium-config.mk
+
+include $(topsrcdir)/config/rules.mk
diff --git a/ipc/nfc/Nfc.cpp b/ipc/nfc/Nfc.cpp
new file mode 100644
index 000000000000..d0c583c3f2f4
--- /dev/null
+++ b/ipc/nfc/Nfc.cpp
@@ -0,0 +1,220 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* vim: set sw=4 ts=8 et ft=cpp: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <fcntl.h>
+#include <limits.h>
+#include <errno.h>
+
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#undef LOG
+#if defined(MOZ_WIDGET_GONK)
+#include <android/log.h>
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "Gonk", args)
+#else
+#define LOG(args...)  printf(args);
+#endif
+
+#include "jsfriendapi.h"
+#include "nsThreadUtils.h" // For NS_IsMainThread.
+#include "Nfc.h"
+
+USING_WORKERS_NAMESPACE
+using namespace mozilla::ipc;
+
+namespace {
+
+const char* NFC_SOCKET_NAME = "/dev/socket/nfcd";
+
+// Network port to connect to for adb forwarded sockets when doing
+// desktop development.
+const uint32_t NFCD_TEST_PORT = 6400;
+
+class DispatchNfcEvent : public WorkerTask
+{
+public:
+    DispatchNfcEvent(UnixSocketRawData* aMessage)
+      : mMessage(aMessage)
+    { }
+
+    virtual bool RunTask(JSContext *aCx);
+
+private:
+    nsAutoPtr<UnixSocketRawData> mMessage;
+};
+
+bool
+DispatchNfcEvent::RunTask(JSContext *aCx)
+{
+    MOZ_ASSERT(NS_IsMainThread(), "DispatchNfcEvent on main thread");
+    MOZ_ASSERT(aCx);
+
+    JSObject *obj = JS_GetGlobalForScopeChain(aCx);
+    JSObject *array = JS_NewUint8Array(aCx, mMessage->mSize);
+    if (!array) {
+        return false;
+    }
+    memcpy(JS_GetArrayBufferViewData(array), mMessage->mData, mMessage->mSize);
+    jsval argv[] = { OBJECT_TO_JSVAL(array) };
+    return JS_CallFunctionName(aCx, obj, "onNfcMessage", NS_ARRAY_LENGTH(argv),
+                               argv, argv);
+}
+
+class NfcConnector : public mozilla::ipc::UnixSocketConnector
+{
+public:
+    NfcConnector() {}
+    virtual ~NfcConnector()
+    {}
+
+    virtual int Create();
+    virtual bool CreateAddr(bool aIsServer,
+                            socklen_t& aAddrSize,
+                            sockaddr_any& aAddr,
+                            const char* aAddress);
+    virtual bool SetUp(int aFd);
+    virtual void GetSocketAddr(const sockaddr_any& aAddr,
+                               nsAString& aAddrStr);
+};
+
+int
+NfcConnector::Create()
+{
+    MOZ_ASSERT(!NS_IsMainThread());
+
+    int fd = -1;
+
+#if defined(MOZ_WIDGET_GONK)
+    fd = socket(AF_LOCAL, SOCK_STREAM, 0);
+#else
+    // If we can't hit a local loopback, fail later in connect.
+    fd = socket(AF_INET, SOCK_STREAM, 0);
+#endif
+
+    if (fd < 0) {
+        NS_WARNING("Could not open Nfc socket!");
+        return -1;
+    }
+
+    if (!SetUp(fd)) {
+        NS_WARNING("Could not set up socket!");
+    }
+    return fd;
+}
+
+bool
+NfcConnector::CreateAddr(bool aIsServer,
+                         socklen_t& aAddrSize,
+                         sockaddr_any& aAddr,
+                         const char* aAddress)
+{
+    // We never open nfc socket as server.
+    MOZ_ASSERT(!aIsServer);
+    uint32_t af;
+#if defined(MOZ_WIDGET_GONK)
+    af = AF_LOCAL;
+#else
+    af = AF_INET;
+#endif
+    switch (af) {
+    case AF_LOCAL:
+        aAddr.un.sun_family = af;
+        if(strlen(aAddress) > sizeof(aAddr.un.sun_path)) {
+            NS_WARNING("Address too long for socket struct!");
+            return false;
+        }
+        strcpy((char*)&aAddr.un.sun_path, aAddress);
+        aAddrSize = strlen(aAddress) + offsetof(struct sockaddr_un, sun_path) + 1;
+        break;
+    case AF_INET:
+        aAddr.in.sin_family = af;
+        aAddr.in.sin_port = htons(NFCD_TEST_PORT);
+        aAddr.in.sin_addr.s_addr = htons(INADDR_LOOPBACK);
+        aAddrSize = sizeof(sockaddr_in);
+        break;
+    default:
+        NS_WARNING("Socket type not handled by connector!");
+        return false;
+    }
+    return true;
+
+}
+
+bool
+NfcConnector::SetUp(int aFd)
+{
+    // Nothing to do here.
+    return true;
+}
+
+void
+NfcConnector::GetSocketAddr(const sockaddr_any& aAddr,
+                            nsAString& aAddrStr)
+{
+    MOZ_NOT_REACHED("This should never be called!");
+}
+
+} // anonymous namespace
+
+
+namespace mozilla {
+namespace ipc {
+
+NfcConsumer::NfcConsumer(WorkerCrossThreadDispatcher* aDispatcher)
+    : mDispatcher(aDispatcher)
+    , mShutdown(false)
+{
+    ConnectSocket(new NfcConnector(), NFC_SOCKET_NAME);
+}
+
+void
+NfcConsumer::Shutdown()
+{
+    mShutdown = true;
+    CloseSocket();
+}
+
+void
+NfcConsumer::ReceiveSocketData(nsAutoPtr<UnixSocketRawData>& aMessage)
+{
+    MOZ_ASSERT(NS_IsMainThread());
+#ifdef DEBUG
+    LOG("ReceiveSocketData\n");
+#endif
+    nsRefPtr<DispatchNfcEvent> dre(new DispatchNfcEvent(aMessage.forget()));
+    mDispatcher->PostTask(dre);
+}
+
+void
+NfcConsumer::OnConnectSuccess()
+{
+    // Nothing to do here.
+    LOG("Socket open for Nfc\n");
+}
+
+void
+NfcConsumer::OnConnectError()
+{
+#ifdef DEBUG
+    LOG("%s\n", __FUNCTION__);
+#endif
+    CloseSocket();
+}
+
+void
+NfcConsumer::OnDisconnect()
+{
+#ifdef DEBUG
+    LOG("%s\n", __FUNCTION__);
+#endif
+    if (!mShutdown) {
+        ConnectSocket(new NfcConnector(), NFC_SOCKET_NAME, 1000);
+    }
+}
+
+} // namespace ipc
+} // namespace mozilla
diff --git a/ipc/nfc/Nfc.h b/ipc/nfc/Nfc.h
new file mode 100644
index 000000000000..1662a7bf6fe9
--- /dev/null
+++ b/ipc/nfc/Nfc.h
@@ -0,0 +1,37 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set sw=2 ts=8 et ft=cpp: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_ipc_Nfc_h
+#define mozilla_ipc_Nfc_h 1
+
+#include <mozilla/dom/workers/Workers.h>
+#include <mozilla/ipc/UnixSocket.h>
+
+namespace mozilla {
+namespace ipc {
+
+class NfcConsumer : public mozilla::ipc::UnixSocketConsumer
+{
+public:
+    NfcConsumer(mozilla::dom::workers::WorkerCrossThreadDispatcher* aDispatcher);
+    virtual ~NfcConsumer() { }
+    void Shutdown();
+private:
+    virtual void ReceiveSocketData(nsAutoPtr<UnixSocketRawData>& aMessage);
+
+    virtual void OnConnectSuccess();
+    virtual void OnConnectError();
+    virtual void OnDisconnect();
+
+private:
+    nsRefPtr<mozilla::dom::workers::WorkerCrossThreadDispatcher> mDispatcher;
+    bool mShutdown;
+};
+
+} // namespace ipc
+} // namepsace mozilla
+
+#endif // mozilla_ipc_Nfc_h
diff --git a/ipc/nfc/moz.build b/ipc/nfc/moz.build
new file mode 100644
index 000000000000..1273f1052513
--- /dev/null
+++ b/ipc/nfc/moz.build
@@ -0,0 +1,13 @@
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+if CONFIG['MOZ_B2G_NFC']:
+    MODULE = 'ipc'
+    EXPORTS.mozilla.ipc += [
+        'Nfc.h',
+    ]
+    CPP_SOURCES += [
+        'Nfc.cpp',
+    ]

From 482dddeb98cee5f79892b315f7b8583433e59658 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 17 Jun 2013 17:01:25 -0700
Subject: [PATCH 71/75] Bumping gaia.json for 2 gaia-central revision(s)

========

https://hg.mozilla.org/integration/gaia-central/rev/ff5a8ffa3017
Author: Dale  Harvey <dale@arandomurl.com>
Desc: Merge pull request #10405 from daleharvey/882175

Bug 882175 - Fix cellbroadcast settings UI to not display opposite of actual value. r=kaze

========

https://hg.mozilla.org/integration/gaia-central/rev/fe5e6a3e4d2e
Author: Dale Harvey <dale@arandomurl.com>
Desc: Bug 882175 - Fix cellbroadcast settings UI to not display opposite of actual value
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 80adaa22d9e1..6db9e0f69c89 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "36f36185e7c0710689452688aff4d79cfee99f22", 
+    "revision": "ff5a8ffa301723fef4ac6cfbf8dc3672ade65e7d", 
     "repo_path": "/integration/gaia-central"
 }

From a5c4bdd4b97e40bda512f53005fed56ded7d3aab Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 17 Jun 2013 19:16:21 -0700
Subject: [PATCH 72/75] Bumping gaia.json for 2 gaia-central revision(s)

========

https://hg.mozilla.org/integration/gaia-central/rev/9f37d18ae352
Author: huchengtw-moz <johu@mozilla.com>
Desc: Merge pull request #10365 from huchengtw-moz/video/Bug_881474_spinner_shows_forever

Bug 881474 - [video] with youtube video paused, dragging slider makes sp..., r=@djf, a=leo+

========

https://hg.mozilla.org/integration/gaia-central/rev/4b036c915881
Author: John Hu <johu@mozilla.com>
Desc: Bug 881474 - [video] with youtube video paused, dragging slider makes spinner go forever.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 6db9e0f69c89..590ae0a48b27 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "ff5a8ffa301723fef4ac6cfbf8dc3672ade65e7d", 
+    "revision": "9f37d18ae3525b1a2bf1bf9115835001a237b1bb", 
     "repo_path": "/integration/gaia-central"
 }

From 1ae6c1ead5cc5f1348652082123d114e0fd52de5 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 17 Jun 2013 19:46:22 -0700
Subject: [PATCH 73/75] Bumping gaia.json for 2 gaia-central revision(s)

========

https://hg.mozilla.org/integration/gaia-central/rev/123a4b7418cf
Author: Alive.Kuo <alegnadise@gmail.com>
Desc: Merge pull request #10449 from alivedise/bugzilla/828965_master

Bug 828965 - Move permission screen z-index on lockscreen camera, r=timdream, a=leo+

========

https://hg.mozilla.org/integration/gaia-central/rev/b698acaadf03
Author: Alive Kuo <alegnadise@gmail.com>
Desc: Bug 828965 - Move permission screen z-index on lockscreen camera
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 590ae0a48b27..d35396dd2430 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "9f37d18ae3525b1a2bf1bf9115835001a237b1bb", 
+    "revision": "123a4b7418cf70cee6862cc407572ab97ae570fd", 
     "repo_path": "/integration/gaia-central"
 }

From fb8cbdd709b088cee070dea7236d845ed5c5bca6 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Tue, 18 Jun 2013 09:16:57 +0200
Subject: [PATCH 74/75] Bug 704356 - Remove the JS property cache. r=njn,
 sr=luke

--HG--
extra : rebase_source : 67079f154c13fd401388792ec1410adb04157092
---
 js/src/jscntxt.h                |   4 -
 js/src/jsgc.cpp                 |   1 -
 js/src/jsobj.cpp                |  14 +-
 js/src/jsobj.h                  |  10 +-
 js/src/jsopcode.h               |  14 --
 js/src/jsopcodeinlines.h        |  16 --
 js/src/jspropertycache.cpp      | 277 --------------------------------
 js/src/jspropertycache.h        | 191 ----------------------
 js/src/jspropertycacheinlines.h |  86 ----------
 js/src/moz.build                |   1 -
 js/src/vm/Interpreter-inl.h     | 135 ----------------
 js/src/vm/Interpreter.cpp       |  98 ++++++++---
 12 files changed, 77 insertions(+), 770 deletions(-)
 delete mode 100644 js/src/jspropertycache.cpp
 delete mode 100644 js/src/jspropertycache.h
 delete mode 100644 js/src/jspropertycacheinlines.h

diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index ed300223b897..e6043ee5c524 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -22,7 +22,6 @@
 #include "jsatom.h"
 #include "jsclist.h"
 #include "jsgc.h"
-#include "jspropertycache.h"
 #include "jspropertytree.h"
 #include "jsprototypes.h"
 #include "jsutil.h"
@@ -1262,7 +1261,6 @@ struct JSRuntime : public JS::shadow::Runtime,
     }
 
     js::GSNCache        gsnCache;
-    js::PropertyCache   propertyCache;
     js::NewObjectCache  newObjectCache;
     js::NativeIterCache nativeIterCache;
     js::SourceDataCache sourceDataCache;
@@ -1724,8 +1722,6 @@ struct JSContext : js::ContextFriendFields,
 
     inline js::PropertyTree &propertyTree();
 
-    js::PropertyCache &propertyCache() { return runtime()->propertyCache; }
-
 #ifdef JS_THREADSAFE
     unsigned            outstandingRequests;/* number of JS_BeginRequest calls
                                                without the corresponding
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 8cc91ad87785..84fd19f47e97 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2571,7 +2571,6 @@ PurgeRuntime(JSRuntime *rt)
     rt->freeLifoAlloc.transferUnusedFrom(&rt->tempLifoAlloc);
 
     rt->gsnCache.purge();
-    rt->propertyCache.purge(rt);
     rt->newObjectCache.purge();
     rt->nativeIterCache.purge();
     rt->sourceDataCache.purge();
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index fd1b1f28bc16..47f752bb996d 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -3408,8 +3408,7 @@ js::DefineNativeProperty(JSContext *cx, HandleObject obj, HandleId id, HandleVal
                          PropertyOp getter, StrictPropertyOp setter, unsigned attrs,
                          unsigned flags, int shortid, unsigned defineHow /* = 0 */)
 {
-    JS_ASSERT((defineHow & ~(DNP_CACHE_RESULT | DNP_DONT_PURGE |
-                             DNP_SKIP_TYPE)) == 0);
+    JS_ASSERT((defineHow & ~(DNP_DONT_PURGE | DNP_SKIP_TYPE)) == 0);
     JS_ASSERT(!(attrs & JSPROP_NATIVE_ACCESSORS));
 
     AutoRooterGetterSetter gsRoot(cx, attrs, &getter, &setter);
@@ -4003,9 +4002,6 @@ GetPropertyHelperInline(JSContext *cx,
         return true;
     }
 
-    if (getHow & JSGET_CACHE_RESULT)
-        cx->propertyCache().fill(cx, obj, obj2, shape);
-
     /* This call site is hot -- use the always-inlined variant of js_NativeGet(). */
     if (!NativeGetInline<allowGC>(cx, obj, receiver, obj2, shape, getHow, vp))
         return JS_FALSE;
@@ -4272,7 +4268,7 @@ JSBool
 baseops::SetPropertyHelper(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
                            unsigned defineHow, MutableHandleValue vp, JSBool strict)
 {
-    JS_ASSERT((defineHow & ~(DNP_CACHE_RESULT | DNP_UNQUALIFIED)) == 0);
+    JS_ASSERT((defineHow & ~DNP_UNQUALIFIED) == 0);
 
     if (JS_UNLIKELY(obj->watched())) {
         /* Fire watchpoints, if any. */
@@ -4360,9 +4356,6 @@ baseops::SetPropertyHelper(JSContext *cx, HandleObject obj, HandleObject receive
              * We found id in a prototype object: prepare to share or shadow.
              */
             if (!shape->shadowable()) {
-                if (defineHow & DNP_CACHE_RESULT)
-                    cx->propertyCache().fill(cx, obj, pobj, shape);
-
                 if (shape->hasDefaultSetter() && !shape->hasGetterValue())
                     return JS_TRUE;
 
@@ -4441,9 +4434,6 @@ baseops::SetPropertyHelper(JSContext *cx, HandleObject obj, HandleObject receive
                                        attrs, flags, shortid, vp, true, strict);
     }
 
-    if (defineHow & DNP_CACHE_RESULT)
-        cx->propertyCache().fill(cx, obj, obj, shape);
-
     return js_NativeSet(cx, obj, receiver, shape, strict, vp);
 }
 
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index e287191abbe4..f8840f11af11 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -1200,12 +1200,11 @@ CloneObject(JSContext *cx, HandleObject obj, Handle<js::TaggedProto> proto, Hand
 /*
  * Flags for the defineHow parameter of js_DefineNativeProperty.
  */
-const unsigned DNP_CACHE_RESULT = 1;   /* an interpreter call from JSOP_INITPROP */
-const unsigned DNP_DONT_PURGE   = 2;   /* suppress js_PurgeScopeChain */
-const unsigned DNP_UNQUALIFIED  = 4;   /* Unqualified property set.  Only used in
+const unsigned DNP_DONT_PURGE   = 1;   /* suppress js_PurgeScopeChain */
+const unsigned DNP_UNQUALIFIED  = 2;   /* Unqualified property set.  Only used in
                                        the defineHow argument of
                                        js_SetPropertyHelper. */
-const unsigned DNP_SKIP_TYPE    = 8;   /* Don't update type information */
+const unsigned DNP_SKIP_TYPE    = 4;   /* Don't update type information */
 
 /*
  * Return successfully added or changed shape or NULL on error.
@@ -1292,9 +1291,6 @@ LookupNameWithGlobalDefault(JSContext *cx, HandlePropertyName name, HandleObject
 extern JSObject *
 js_FindVariableScope(JSContext *cx, JSFunction **funp);
 
-/* JSGET_CACHE_RESULT is the analogue of DNP_CACHE_RESULT. */
-const unsigned JSGET_CACHE_RESULT = 1; // from a caching interpreter opcode
-
 /*
  * NB: js_NativeGet and js_NativeSet are called with the scope containing shape
  * (pobj's scope for Get, obj's for Set) locked, and on successful return, that
diff --git a/js/src/jsopcode.h b/js/src/jsopcode.h
index 8da36091e4d5..7be6b76c162d 100644
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -233,20 +233,6 @@ extern const char       js_EscapeMap[];
 extern JSString *
 js_QuoteString(JSContext *cx, JSString *str, jschar quote);
 
-#define GET_ATOM_FROM_BYTECODE(script, pc, pcoff, atom)                       \
-    JS_BEGIN_MACRO                                                            \
-        JS_ASSERT(js_CodeSpec[*(pc)].format & JOF_ATOM);                      \
-        (atom) = (script)->getAtom(GET_UINT32_INDEX((pc) + (pcoff)));         \
-    JS_END_MACRO
-
-#define GET_NAME_FROM_BYTECODE(script, pc, pcoff, name)                       \
-    JS_BEGIN_MACRO                                                            \
-        JSAtom *atom_;                                                        \
-        GET_ATOM_FROM_BYTECODE(script, pc, pcoff, atom_);                     \
-        JS_ASSERT(js_CodeSpec[*(pc)].format & (JOF_NAME | JOF_PROP));         \
-        (name) = atom_->asPropertyName();                                     \
-    JS_END_MACRO
-
 namespace js {
 
 extern unsigned
diff --git a/js/src/jsopcodeinlines.h b/js/src/jsopcodeinlines.h
index 52a1c4fbccae..4055933a8292 100644
--- a/js/src/jsopcodeinlines.h
+++ b/js/src/jsopcodeinlines.h
@@ -85,22 +85,6 @@ BytecodeFallsThrough(JSOp op)
     }
 }
 
-static inline PropertyName *
-GetNameFromBytecode(JSContext *cx, JSScript *script, jsbytecode *pc, JSOp op)
-{
-    if (op == JSOP_LENGTH)
-        return cx->names().length;
-
-    // The method JIT's implementation of instanceof contains an internal lookup
-    // of the prototype property.
-    if (op == JSOP_INSTANCEOF)
-        return cx->names().classPrototype;
-
-    PropertyName *name;
-    GET_NAME_FROM_BYTECODE(script, pc, 0, name);
-    return name;
-}
-
 class BytecodeRange {
   public:
     BytecodeRange(JSContext *cx, JSScript *script)
diff --git a/js/src/jspropertycache.cpp b/js/src/jspropertycache.cpp
deleted file mode 100644
index 57779ab78ca7..000000000000
--- a/js/src/jspropertycache.cpp
+++ /dev/null
@@ -1,277 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "jspropertycache.h"
-
-#include "mozilla/PodOperations.h"
-
-#include "jscntxt.h"
-
-#include "jsobjinlines.h"
-#include "jsopcodeinlines.h"
-
-using namespace js;
-
-using mozilla::PodArrayZero;
-
-PropertyCacheEntry *
-PropertyCache::fill(JSContext *cx, JSObject *obj, JSObject *pobj, Shape *shape)
-{
-    JS_ASSERT(this == &cx->propertyCache());
-    JS_ASSERT(!cx->runtime()->isHeapBusy());
-
-    /*
-     * Don't cache entries on indexed properties. Indexes can be added or
-     * deleted from the dense elements of objects along the prototype chain
-     * wihout any shape changes.
-     */
-    if (JSID_IS_INT(shape->propid()))
-        return JS_NO_PROP_CACHE_FILL;
-
-    /*
-     * Check for overdeep scope and prototype chain. Because resolve, getter,
-     * and setter hooks can change the prototype chain using JS_SetPrototype
-     * after LookupPropertyWithFlags has returned, we calculate the protoIndex
-     * here and not in LookupPropertyWithFlags.
-     */
-
-    JSObject *tmp = obj;
-    unsigned protoIndex = 0;
-    while (tmp != pobj) {
-        /*
-         * Don't cache entries across prototype lookups which can mutate in
-         * arbitrary ways without a shape change.
-         */
-        if (tmp->hasUncacheableProto()) {
-            PCMETER(noprotos++);
-            return JS_NO_PROP_CACHE_FILL;
-        }
-
-        tmp = tmp->getProto();
-
-        /*
-         * We cannot cache properties coming from native objects behind
-         * non-native ones on the prototype chain. The non-natives can
-         * mutate in arbitrary way without changing any shapes.
-         */
-        if (!tmp || !tmp->isNative()) {
-            PCMETER(noprotos++);
-            return JS_NO_PROP_CACHE_FILL;
-        }
-        ++protoIndex;
-    }
-
-    typedef PropertyCacheEntry Entry;
-    if (protoIndex > Entry::MaxProtoIndex) {
-        PCMETER(longchains++);
-        return JS_NO_PROP_CACHE_FILL;
-    }
-
-    /*
-     * Optimize the cached vword based on our parameters and the current pc's
-     * opcode format flags.
-     */
-    jsbytecode *pc;
-    (void) cx->stack.currentScript(&pc);
-    JSOp op = JSOp(*pc);
-    const JSCodeSpec *cs = &js_CodeSpec[op];
-
-    if ((cs->format & JOF_SET) && obj->watched())
-        return JS_NO_PROP_CACHE_FILL;
-
-    if (obj == pobj) {
-        JS_ASSERT(protoIndex == 0);
-    } else {
-        JS_ASSERT(protoIndex != 0);
-        JS_ASSERT((protoIndex == 1) == (obj->getProto() == pobj));
-
-        if (protoIndex != 1) {
-            /*
-             * Make sure that a later shadowing assignment will enter
-             * PurgeProtoChain and invalidate this entry, bug 479198.
-             */
-            if (!obj->isDelegate())
-                return JS_NO_PROP_CACHE_FILL;
-        }
-    }
-
-    PropertyCacheEntry *entry = &table[hash(pc, obj->lastProperty())];
-    PCMETER(entry->vword.isNull() || recycles++);
-    entry->assign(pc, obj->lastProperty(), pobj->lastProperty(), shape, protoIndex);
-
-    empty = false;
-    PCMETER(fills++);
-
-    /*
-     * The modfills counter is not exact. It increases if a getter or setter
-     * recurse into the interpreter.
-     */
-    PCMETER(entry == pctestentry || modfills++);
-    PCMETER(pctestentry = NULL);
-    return entry;
-}
-
-PropertyName *
-PropertyCache::fullTest(JSContext *cx, jsbytecode *pc, JSObject **objp, JSObject **pobjp,
-                        PropertyCacheEntry *entry)
-{
-    JSObject *obj, *pobj;
-    RootedScript script(cx, cx->stack.currentScript());
-
-    JS_ASSERT(this == &cx->propertyCache());
-    JS_ASSERT(uint32_t(pc - script->code) < script->length);
-
-    JSOp op = JSOp(*pc);
-
-    obj = *objp;
-
-    if (entry->kpc != pc) {
-        PCMETER(kpcmisses++);
-
-        PropertyName *name = GetNameFromBytecode(cx, script, pc, op);
-#ifdef DEBUG_notme
-        JSAutoByteString printable;
-        fprintf(stderr,
-                "id miss for %s from %s:%u"
-                " (pc %u, kpc %u, kshape %p, shape %p)\n",
-                js_AtomToPrintableString(cx, name, &printable),
-                script->filename,
-                js_PCToLineNumber(cx, script, pc),
-                pc - script->code,
-                entry->kpc - script->code,
-                entry->kshape,
-                obj->lastProperty());
-                js_Disassemble1(cx, script, pc,
-                                pc - script->code,
-                                JS_FALSE, stderr);
-#endif
-
-        return name;
-    }
-
-    if (entry->kshape != obj->lastProperty()) {
-        PCMETER(kshapemisses++);
-        return GetNameFromBytecode(cx, script, pc, op);
-    }
-
-    /*
-     * PropertyCache::test handles only the direct and immediate-prototype hit
-     * cases. All others go here.
-     */
-    pobj = obj;
-
-    uint8_t protoIndex = entry->protoIndex;
-    while (protoIndex > 0) {
-        JSObject *tmp = pobj->getProto();
-        if (!tmp || !tmp->isNative())
-            break;
-        pobj = tmp;
-        protoIndex--;
-    }
-
-    if (pobj->lastProperty() == entry->pshape) {
-#ifdef DEBUG
-        Rooted<PropertyName*> name(cx, GetNameFromBytecode(cx, script, pc, op));
-        JS_ASSERT(pobj->nativeContains(cx, name));
-#endif
-        *pobjp = pobj;
-        return NULL;
-    }
-
-    PCMETER(vcapmisses++);
-    return GetNameFromBytecode(cx, script, pc, op);
-}
-
-#ifdef DEBUG
-void
-PropertyCache::assertEmpty()
-{
-    JS_ASSERT(empty);
-    for (unsigned i = 0; i < SIZE; i++) {
-        JS_ASSERT(!table[i].kpc);
-        JS_ASSERT(!table[i].kshape);
-        JS_ASSERT(!table[i].pshape);
-        JS_ASSERT(!table[i].prop);
-        JS_ASSERT(!table[i].protoIndex);
-    }
-}
-#endif
-
-void
-PropertyCache::purge(JSRuntime *rt)
-{
-    if (empty) {
-        assertEmpty();
-        return;
-    }
-
-    PodArrayZero(table);
-    empty = true;
-
-#ifdef JS_PROPERTY_CACHE_METERING
-  { static FILE *fp;
-    if (!fp)
-        fp = fopen("/tmp/propcache.stats", "w");
-    if (fp) {
-        fputs("Property cache stats for ", fp);
-        fprintf(fp, "GC %lu\n", (unsigned long)rt->gcNumber);
-
-# define P(mem) fprintf(fp, "%11s %10lu\n", #mem, (unsigned long)mem)
-        P(fills);
-        P(nofills);
-        P(rofills);
-        P(disfills);
-        P(oddfills);
-        P(add2dictfills);
-        P(modfills);
-        P(brandfills);
-        P(noprotos);
-        P(longchains);
-        P(recycles);
-        P(tests);
-        P(pchits);
-        P(protopchits);
-        P(initests);
-        P(inipchits);
-        P(inipcmisses);
-        P(settests);
-        P(addpchits);
-        P(setpchits);
-        P(setpcmisses);
-        P(setmisses);
-        P(kpcmisses);
-        P(kshapemisses);
-        P(vcapmisses);
-        P(misses);
-        P(flushes);
-        P(pcpurges);
-# undef P
-
-        fprintf(fp, "hit rates: pc %g%% (proto %g%%), set %g%%, ini %g%%, full %g%%\n",
-                (100. * pchits) / tests,
-                (100. * protopchits) / tests,
-                (100. * (addpchits + setpchits))
-                / settests,
-                (100. * inipchits) / initests,
-                (100. * (tests - misses)) / tests);
-        fflush(fp);
-    }
-  }
-#endif
-
-    PCMETER(flushes++);
-}
-
-void
-PropertyCache::restore(PropertyCacheEntry *entry)
-{
-    PropertyCacheEntry *entry2;
-
-    empty = false;
-
-    entry2 = &table[hash(entry->kpc, entry->kshape)];
-    *entry2 = *entry;
-}
diff --git a/js/src/jspropertycache.h b/js/src/jspropertycache.h
deleted file mode 100644
index ce0acab2c78f..000000000000
--- a/js/src/jspropertycache.h
+++ /dev/null
@@ -1,191 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef jspropertycache_h___
-#define jspropertycache_h___
-
-#include "mozilla/PodOperations.h"
-
-#include "jsapi.h"
-#include "jsprvtd.h"
-#include "jstypes.h"
-
-#include "vm/String.h"
-
-namespace js {
-
-/*
- * Property cache with structurally typed capabilities for invalidation, for
- * polymorphic callsite method/get/set speedups.  For details, see
- * <https://developer.mozilla.org/en/SpiderMonkey/Internals/Property_cache>.
- */
-class PropertyCache;
-
-struct PropertyCacheEntry
-{
-    jsbytecode    *kpc;           /* pc of cache-testing bytecode */
-    Shape         *kshape;        /* shape of direct (key) object */
-    Shape         *pshape;        /* shape of owning object */
-    Shape         *prop;          /* shape of accessed property */
-
-    friend class PropertyCache;
-
-  private:
-    /* Index into the prototype chain from the object for this entry. */
-    uint8_t       protoIndex;
-
-  public:
-    static const size_t MaxProtoIndex = 15;
-
-    /*
-     * True iff the property lookup will find an own property on the object if
-     * the entry matches.
-     *
-     * This test is applicable only to property lookups, not to identifier
-     * lookups.  It is meaningless to ask this question of an entry for an
-     * identifier lookup.
-     */
-    bool isOwnPropertyHit() const { return protoIndex == 0; }
-
-    /*
-     * True iff the property lookup will find the property on the prototype of
-     * the object if the entry matches.
-     *
-     * This test is applicable only to property lookups, not to identifier
-     * lookups.  It is meaningless to ask this question of an entry for an
-     * identifier lookup.
-     */
-    bool isPrototypePropertyHit() const { return protoIndex == 1; }
-
-    void assign(jsbytecode *kpc, Shape *kshape, Shape *pshape, Shape *prop, unsigned protoIndex) {
-        JS_ASSERT(protoIndex <= MaxProtoIndex);
-
-        this->kpc = kpc;
-        this->kshape = kshape;
-        this->pshape = pshape;
-        this->prop = prop;
-        this->protoIndex = uint8_t(protoIndex);
-    }
-};
-
-/*
- * Special value for functions returning PropertyCacheEntry * to distinguish
- * between failure and no no-cache-fill cases.
- */
-#define JS_NO_PROP_CACHE_FILL ((js::PropertyCacheEntry *) NULL + 1)
-
-#if defined DEBUG_brendan || defined DEBUG_brendaneich
-#define JS_PROPERTY_CACHE_METERING 1
-#endif
-
-class PropertyCache
-{
-  private:
-    enum {
-        SIZE_LOG2 = 8,
-        SIZE = JS_BIT(SIZE_LOG2),
-        MASK = JS_BITMASK(SIZE_LOG2)
-    };
-
-    PropertyCacheEntry  table[SIZE];
-    JSBool              empty;
-
-  public:
-#ifdef JS_PROPERTY_CACHE_METERING
-    PropertyCacheEntry  *pctestentry;   /* entry of the last PC-based test */
-    uint32_t            fills;          /* number of cache entry fills */
-    uint32_t            nofills;        /* couldn't fill (e.g. default get) */
-    uint32_t            rofills;        /* set on read-only prop can't fill */
-    uint32_t            disfills;       /* fill attempts on disabled cache */
-    uint32_t            oddfills;       /* fill attempt after setter deleted */
-    uint32_t            add2dictfills;  /* fill attempt on dictionary object */
-    uint32_t            modfills;       /* fill that rehashed to a new entry */
-    uint32_t            brandfills;     /* scope brandings to type structural
-                                           method fills */
-    uint32_t            noprotos;       /* resolve-returned non-proto pobj */
-    uint32_t            longchains;     /* overlong scope and/or proto chain */
-    uint32_t            recycles;       /* cache entries recycled by fills */
-    uint32_t            tests;          /* cache probes */
-    uint32_t            pchits;         /* fast-path polymorphic op hits */
-    uint32_t            protopchits;    /* pchits hitting immediate prototype */
-    uint32_t            initests;       /* cache probes from JSOP_INITPROP */
-    uint32_t            inipchits;      /* init'ing next property pchit case */
-    uint32_t            inipcmisses;    /* init'ing next property pc misses */
-    uint32_t            settests;       /* cache probes from JOF_SET opcodes */
-    uint32_t            addpchits;      /* adding next property pchit case */
-    uint32_t            setpchits;      /* setting existing property pchit */
-    uint32_t            setpcmisses;    /* setting/adding property pc misses */
-    uint32_t            setmisses;      /* JSOP_SET{NAME,PROP} total misses */
-    uint32_t            kpcmisses;      /* slow-path key id == atom misses */
-    uint32_t            kshapemisses;   /* slow-path key object misses */
-    uint32_t            vcapmisses;     /* value capability misses */
-    uint32_t            misses;         /* cache misses */
-    uint32_t            flushes;        /* cache flushes */
-    uint32_t            pcpurges;       /* shadowing purges on proto chain */
-
-# define PCMETER(x)     x
-#else
-# define PCMETER(x)     ((void)0)
-#endif
-
-    PropertyCache() {
-        mozilla::PodZero(this);
-    }
-
-  private:
-    static inline uintptr_t
-    hash(jsbytecode *pc, const Shape *kshape)
-    {
-        return (((uintptr_t(pc) >> SIZE_LOG2) ^ uintptr_t(pc) ^ ((uintptr_t)kshape >> 3)) & MASK);
-    }
-
-    static inline bool matchShape(JSContext *cx, JSObject *obj, uint32_t shape);
-
-    PropertyName *
-    fullTest(JSContext *cx, jsbytecode *pc, JSObject **objp,
-             JSObject **pobjp, PropertyCacheEntry *entry);
-
-#ifdef DEBUG
-    void assertEmpty();
-#else
-    inline void assertEmpty() {}
-#endif
-
-  public:
-    JS_ALWAYS_INLINE void test(JSContext *cx, jsbytecode *pc,
-                               JSObject **obj, JSObject **pobj,
-                               PropertyCacheEntry **entry, PropertyName **name);
-
-    /*
-     * Test for cached information about a property set on *objp at pc.
-     *
-     * On a hit, set *entryp to the entry and return true.
-     *
-     * On a miss, set *namep to the name of the property being set and return false.
-     */
-    JS_ALWAYS_INLINE bool testForSet(JSContext *cx, jsbytecode *pc, JSObject *obj,
-                                     PropertyCacheEntry **entryp, JSObject **obj2p,
-                                     PropertyName **namep);
-
-    /*
-     * Fill property cache entry for key cx->fp->pc, optimized value word
-     * computed from obj and shape, and entry capability forged from
-     * obj->shape() and an 8-bit protoIndex.
-     *
-     * Return the filled cache entry or JS_NO_PROP_CACHE_FILL if caching was
-     * not possible.
-     */
-    PropertyCacheEntry *fill(JSContext *cx, JSObject *obj, JSObject *pobj, js::Shape *shape);
-
-    void purge(JSRuntime *rt);
-
-    /* Restore an entry that may have been purged during a GC. */
-    void restore(PropertyCacheEntry *entry);
-};
-
-} /* namespace js */
-
-#endif /* jspropertycache_h___ */
diff --git a/js/src/jspropertycacheinlines.h b/js/src/jspropertycacheinlines.h
deleted file mode 100644
index 00015fb39084..000000000000
--- a/js/src/jspropertycacheinlines.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef jspropertycacheinlines_h___
-#define jspropertycacheinlines_h___
-
-#include "jslock.h"
-#include "jspropertycache.h"
-
-#include "vm/Shape.h"
-
-/*
- * This method is designed to inline the fast path in js_Interpret, so it makes
- * "just-so" restrictions on parameters, e.g. pobj and obj should not be the
- * same variable, since for JOF_PROP-mode opcodes, obj must not be changed
- * because of a cache miss.
- *
- * On return, if name is null then obj points to the scope chain element in
- * which the property was found, pobj is locked, and entry is valid. If name is
- * non-null then no object is locked but entry is still set correctly for use,
- * e.g., by PropertyCache::fill and name should be used as the id to find.
- *
- * We must lock pobj on a hit in order to close races with threads that might
- * be deleting a property from its scope, or otherwise invalidating property
- * caches (on all threads) by re-generating JSObject::shape().
- */
-JS_ALWAYS_INLINE void
-js::PropertyCache::test(JSContext *cx, jsbytecode *pc, JSObject **obj,
-                        JSObject **pobj, PropertyCacheEntry **entry, PropertyName **name)
-{
-    JS_ASSERT(this == &cx->propertyCache());
-
-    Shape *kshape = (*obj)->lastProperty();
-    *entry = &table[hash(pc, kshape)];
-    PCMETER(pctestentry = *entry);
-    PCMETER(tests++);
-    JS_ASSERT(obj != pobj);
-    if ((*entry)->kpc == pc && (*entry)->kshape == kshape) {
-        JSObject *tmp;
-        *pobj = *obj;
-        if ((*entry)->isPrototypePropertyHit() &&
-            (tmp = (*pobj)->getProto()) != NULL) {
-            *pobj = tmp;
-        }
-
-        if ((*pobj)->lastProperty() == (*entry)->pshape) {
-            PCMETER(pchits++);
-            PCMETER((*entry)->isOwnPropertyHit() || protopchits++);
-            *name = NULL;
-            return;
-        }
-    }
-    *name = fullTest(cx, pc, obj, pobj, *entry);
-    if (!*name)
-        PCMETER(misses++);
-}
-
-JS_ALWAYS_INLINE bool
-js::PropertyCache::testForSet(JSContext *cx, jsbytecode *pc, JSObject *obj,
-                              PropertyCacheEntry **entryp, JSObject **obj2p, PropertyName **namep)
-{
-    JS_ASSERT(this == &cx->propertyCache());
-
-    Shape *kshape = obj->lastProperty();
-    PropertyCacheEntry *entry = &table[hash(pc, kshape)];
-    *entryp = entry;
-    PCMETER(pctestentry = entry);
-    PCMETER(tests++);
-    PCMETER(settests++);
-    if (entry->kpc == pc && entry->kshape == kshape)
-        return true;
-
-    PropertyName *name = fullTest(cx, pc, &obj, obj2p, entry);
-    JS_ASSERT(name);
-
-    PCMETER(misses++);
-    PCMETER(setmisses++);
-
-    *namep = name;
-    return false;
-}
-
-#endif /* jspropertycacheinlines_h___ */
diff --git a/js/src/moz.build b/js/src/moz.build
index 8f1da709dfe4..7fdef025e0e5 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -167,7 +167,6 @@ CPP_SOURCES += [
     'jsopcode.cpp',
     'jsperf.cpp',
     'jsprf.cpp',
-    'jspropertycache.cpp',
     'jspropertytree.cpp',
     'jsproxy.cpp',
     'jsreflect.cpp',
diff --git a/js/src/vm/Interpreter-inl.h b/js/src/vm/Interpreter-inl.h
index 958681776da1..768d22b10cc7 100644
--- a/js/src/vm/Interpreter-inl.h
+++ b/js/src/vm/Interpreter-inl.h
@@ -23,7 +23,6 @@
 #include "jsfuninlines.h"
 #include "jsinferinlines.h"
 #include "jsopcodeinlines.h"
-#include "jspropertycacheinlines.h"
 #include "jstypedarrayinlines.h"
 #include "vm/GlobalObject-inl.h"
 #include "vm/Stack-inl.h"
@@ -200,17 +199,6 @@ NativeGet(JSContext *cx, JSObject *objArg, JSObject *pobjArg, Shape *shapeArg,
     return true;
 }
 
-#if defined(DEBUG) && !defined(JS_THREADSAFE) && !defined(JSGC_ROOT_ANALYSIS)
-extern void
-AssertValidPropertyCacheHit(JSContext *cx, JSObject *start, JSObject *found,
-                            PropertyCacheEntry *entry);
-#else
-inline void
-AssertValidPropertyCacheHit(JSContext *cx, JSObject *start, JSObject *found,
-                            PropertyCacheEntry *entry)
-{}
-#endif
-
 inline bool
 GetLengthProperty(const Value &lval, MutableHandleValue vp)
 {
@@ -246,129 +234,6 @@ GetLengthProperty(const Value &lval, MutableHandleValue vp)
     return false;
 }
 
-inline bool
-GetPropertyOperation(JSContext *cx, JSScript *script, jsbytecode *pc, MutableHandleValue lval,
-                     MutableHandleValue vp)
-{
-    JSOp op = JSOp(*pc);
-
-    if (op == JSOP_LENGTH) {
-        if (IsOptimizedArguments(cx->fp(), lval.address())) {
-            vp.setInt32(cx->fp()->numActualArgs());
-            return true;
-        }
-
-        if (GetLengthProperty(lval, vp))
-            return true;
-    }
-
-    JSObject *obj = ToObjectFromStack(cx, lval);
-    if (!obj)
-        return false;
-
-    PropertyCacheEntry *entry;
-    JSObject *pobj;
-    PropertyName *name;
-    cx->propertyCache().test(cx, pc, &obj, &pobj, &entry, &name);
-    if (!name) {
-        AssertValidPropertyCacheHit(cx, obj, pobj, entry);
-        return NativeGet(cx, obj, pobj, entry->prop, JSGET_CACHE_RESULT, vp);
-    }
-
-    bool wasObject = lval.isObject();
-
-    RootedId id(cx, NameToId(name));
-    RootedObject nobj(cx, obj);
-
-    if (obj->getOps()->getProperty) {
-        if (!JSObject::getGeneric(cx, nobj, nobj, id, vp))
-            return false;
-    } else {
-        if (!GetPropertyHelper(cx, nobj, id, JSGET_CACHE_RESULT, vp))
-            return false;
-    }
-
-#if JS_HAS_NO_SUCH_METHOD
-    if (op == JSOP_CALLPROP &&
-        JS_UNLIKELY(vp.isPrimitive()) &&
-        wasObject)
-    {
-        if (!OnUnknownMethod(cx, nobj, IdToValue(id), vp))
-            return false;
-    }
-#endif
-
-    return true;
-}
-
-inline bool
-SetPropertyOperation(JSContext *cx, jsbytecode *pc, HandleValue lval, HandleValue rval)
-{
-    JS_ASSERT(*pc == JSOP_SETPROP);
-
-    RootedObject obj(cx, ToObjectFromStack(cx, lval));
-    if (!obj)
-        return false;
-
-    PropertyCacheEntry *entry;
-    JSObject *obj2;
-    PropertyName *name;
-    if (cx->propertyCache().testForSet(cx, pc, obj, &entry, &obj2, &name)) {
-        /*
-         * Property cache hit, only partially confirmed by testForSet. We
-         * know that the entry applies to regs.pc and that obj's shape
-         * matches.
-         *
-         * The entry predicts a set either an existing "own" property, or
-         * on a prototype property that has a setter.
-         */
-        RootedShape shape(cx, entry->prop);
-        JS_ASSERT_IF(shape->isDataDescriptor(), shape->writable());
-        JS_ASSERT_IF(shape->hasSlot(), entry->isOwnPropertyHit());
-
-        if (entry->isOwnPropertyHit() ||
-            ((obj2 = obj->getProto()) && obj2->lastProperty() == entry->pshape)) {
-#ifdef DEBUG
-            if (entry->isOwnPropertyHit()) {
-                JS_ASSERT(obj->nativeLookup(cx, shape->propid()) == shape);
-            } else {
-                JS_ASSERT(obj2->nativeLookup(cx, shape->propid()) == shape);
-                JS_ASSERT(entry->isPrototypePropertyHit());
-                JS_ASSERT(entry->kshape != entry->pshape);
-                JS_ASSERT(!shape->hasSlot());
-            }
-#endif
-
-            if (shape->hasDefaultSetter() && shape->hasSlot()) {
-                /* Fast path for, e.g., plain Object instance properties. */
-                JSObject::nativeSetSlotWithType(cx, obj, shape, rval);
-            } else {
-                RootedValue rref(cx, rval);
-                bool strict = cx->stack.currentScript()->strict;
-                if (!js_NativeSet(cx, obj, obj, shape, strict, &rref))
-                    return false;
-            }
-            return true;
-        }
-
-        GET_NAME_FROM_BYTECODE(cx->stack.currentScript(), pc, 0, name);
-    }
-
-    bool strict = cx->stack.currentScript()->strict;
-    RootedValue rref(cx, rval);
-
-    RootedId id(cx, NameToId(name));
-    if (JS_LIKELY(!obj->getOps()->setProperty)) {
-        if (!baseops::SetPropertyHelper(cx, obj, obj, id, DNP_CACHE_RESULT, &rref, strict))
-            return false;
-    } else {
-        if (!JSObject::setGeneric(cx, obj, obj, id, &rref, strict))
-            return false;
-    }
-
-    return true;
-}
-
 template <bool TypeOf> inline bool
 FetchName(JSContext *cx, HandleObject obj, HandleObject obj2, HandlePropertyName name,
           HandleShape shape, MutableHandleValue vp)
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 0f9091b019f1..83e3fb2e99d4 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -28,7 +28,6 @@
 #include "jsobj.h"
 #include "jsopcode.h"
 #include "jsprf.h"
-#include "jspropertycache.h"
 #include "jsscript.h"
 #include "jsstr.h"
 #include "builtin/Eval.h"
@@ -254,6 +253,76 @@ NoSuchMethod(JSContext *cx, unsigned argc, Value *vp)
 
 #endif /* JS_HAS_NO_SUCH_METHOD */
 
+inline bool
+GetPropertyOperation(JSContext *cx, HandleScript script, jsbytecode *pc, MutableHandleValue lval,
+                     MutableHandleValue vp)
+{
+    JSOp op = JSOp(*pc);
+
+    if (op == JSOP_LENGTH) {
+        if (IsOptimizedArguments(cx->fp(), lval.address())) {
+            vp.setInt32(cx->fp()->numActualArgs());
+            return true;
+        }
+
+        if (GetLengthProperty(lval, vp))
+            return true;
+    }
+
+    JSObject *obj = ToObjectFromStack(cx, lval);
+    if (!obj)
+        return false;
+
+    bool wasObject = lval.isObject();
+
+    RootedId id(cx, NameToId(script->getName(pc)));
+    RootedObject nobj(cx, obj);
+
+    if (obj->getOps()->getProperty) {
+        if (!JSObject::getGeneric(cx, nobj, nobj, id, vp))
+            return false;
+    } else {
+        if (!GetPropertyHelper(cx, nobj, id, 0, vp))
+            return false;
+    }
+
+#if JS_HAS_NO_SUCH_METHOD
+    if (op == JSOP_CALLPROP &&
+        JS_UNLIKELY(vp.isPrimitive()) &&
+        wasObject)
+    {
+        if (!OnUnknownMethod(cx, nobj, IdToValue(id), vp))
+            return false;
+    }
+#endif
+
+    return true;
+}
+
+inline bool
+SetPropertyOperation(JSContext *cx, HandleScript script, jsbytecode *pc, HandleValue lval,
+                     HandleValue rval)
+{
+    JS_ASSERT(*pc == JSOP_SETPROP);
+
+    RootedObject obj(cx, ToObjectFromStack(cx, lval));
+    if (!obj)
+        return false;
+
+    RootedValue rref(cx, rval);
+
+    RootedId id(cx, NameToId(script->getName(pc)));
+    if (JS_LIKELY(!obj->getOps()->setProperty)) {
+        if (!baseops::SetPropertyHelper(cx, obj, obj, id, 0, &rref, script->strict))
+            return false;
+    } else {
+        if (!JSObject::setGeneric(cx, obj, obj, id, &rref, script->strict))
+            return false;
+    }
+
+    return true;
+}
+
 bool
 js::ReportIsNotFunction(JSContext *cx, const Value &v, int numToSkip, MaybeConstruct construct)
 {
@@ -909,31 +978,8 @@ inline InterpreterFrames::~InterpreterFrames()
     context->runtime()->interpreterFrames = older;
 }
 
-#if defined(DEBUG) && !defined(JS_THREADSAFE) && !defined(JSGC_ROOT_ANALYSIS)
-void
-js::AssertValidPropertyCacheHit(JSContext *cx, JSObject *start,
-                                JSObject *found, PropertyCacheEntry *entry)
-{
-    jsbytecode *pc;
-    JSScript *script = cx->stack.currentScript(&pc);
-
-    uint64_t sample = cx->runtime()->gcNumber;
-
-    PropertyName *name = GetNameFromBytecode(cx, script, pc, JSOp(*pc));
-    JSObject *pobj;
-    Shape *prop;
-    if (baseops::LookupProperty<NoGC>(cx, start, NameToId(name), &pobj, &prop)) {
-        JS_ASSERT(prop);
-        JS_ASSERT(pobj == found);
-        JS_ASSERT(entry->prop == prop);
-    }
-
-    JS_ASSERT(cx->runtime()->gcNumber == sample);
-}
-#endif /* DEBUG && !JS_THREADSAFE */
-
 /*
- * Ensure that the intrepreter switch can close call-bytecode cases in the
+ * Ensure that the interpreter switch can close call-bytecode cases in the
  * same way as non-call bytecodes.
  */
 JS_STATIC_ASSERT(JSOP_NAME_LENGTH == JSOP_CALLNAME_LENGTH);
@@ -2081,7 +2127,7 @@ BEGIN_CASE(JSOP_SETPROP)
     HandleValue lval = HandleValue::fromMarkedLocation(&regs.sp[-2]);
     HandleValue rval = HandleValue::fromMarkedLocation(&regs.sp[-1]);
 
-    if (!SetPropertyOperation(cx, regs.pc, lval, rval))
+    if (!SetPropertyOperation(cx, script, regs.pc, lval, rval))
         goto error;
 
     regs.sp[-2] = regs.sp[-1];

From af797088b01cde684743bc0e1ca79eb3ff865d07 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Tue, 18 Jun 2013 09:41:08 +0200
Subject: [PATCH 75/75] Bug 704356 - Touch CLOBBER for jspropertycache.cpp
 removal.

---
 CLOBBER | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/CLOBBER b/CLOBBER
index f37a76e82ae7..e13b4758de5f 100644
--- a/CLOBBER
+++ b/CLOBBER
@@ -17,5 +17,4 @@
 #
 # Modifying this file will now automatically clobber the buildbot machines \o/
 #
-Bug 879831 needed to clobber for the removal of jsprobes.cpp
-bug 882904:  move LIBS to moz.build (logic).
+Bug 704356 needed to clobber for the removal of jspropertycache.cpp