Merge m-i to m-c

2014-03-29 09:00:18 -07:00 · 2014-03-29 09:00:18 -07:00 · 73bdeac562
--- a/2
+++ b/2
@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.

-Bug 981166 - Disabling Metro was causing intermittent Windows l10n packaging issues.
+Bug 957865 - Non-clobbered ASAN builds were failing all mochitests after the clang upgrade
--- a/accessible/src/base/FocusManager.cpp
+++ b/accessible/src/base/FocusManager.cpp
@ -240,9 +240,11 @@ FocusManager::ProcessDOMFocus(nsINode* aTarget)

  DocAccessible* document =
    GetAccService()->GetDocAccessible(aTarget->OwnerDoc());
+  if (!document)
+    return;

  Accessible* target = document->GetAccessibleEvenIfNotInMapOrContainer(aTarget);
-  if (target && document) {
+  if (target) {
    // Check if still focused. Otherwise we can end up with storing the active
    // item for control that isn't focused anymore.
    nsINode* focusedNode = FocusedDOMNode();
--- a/browser/config/tooltool-manifests/linux64/asan.manifest
+++ b/browser/config/tooltool-manifests/linux64/asan.manifest
@ -1,6 +1,6 @@
 [
 {
-"clang_version": "r185949"
+"clang_version": "r200213"
 }, 
 {
 "size": 47, 
@ -9,8 +9,8 @@
 "filename": "setup.sh"
 }, 
 {
-"size": 73050713, 
-"digest": "2c5c26a44402f974c2a4ccffb07ea1ac2d01d84dc3e4281fef6e047a62606811a16534d034477dfd9be055a07d931b17ca4e883c8edcd1f8d3a8c91b150e2288", 
+"size": 71282740, 
+"digest": "ee9edb1ef3afd9ab29e39565145545ad57e8d8d2538be4d822d7dbd64038f4529b0b287cecf48bf83def52a26ac2c6faa331686c3ad5e8b4ba4c22686ee0808f", 
 "algorithm": "sha512", 
 "filename": "clang.tar.bz2"
 }
--- a/browser/config/tooltool-manifests/macosx64/asan.manifest
+++ b/browser/config/tooltool-manifests/macosx64/asan.manifest
@ -1,6 +1,6 @@
 [
 {
-"clang_version": "r185949"
+"clang_version": "r200213"
 }, 
 {
 "size": 47, 
@ -9,8 +9,8 @@
 "filename": "setup.sh"
 }, 
 {
-"size": 61779086, 
-"digest": "b2f2861da7583e859b4fb40e1304dd284df02466c909893684341b16e2f58c4c100891504938cf62f26ac82254b9e87135ba98f8196dd26e9b58d3242f1cf811", 
+"size": 58997296, 
+"digest": "9757d142142442c881b8d1eb31c2fe80e1979a858e6133473b5574a5a3b9cdaf9abed32b2e246b715c9f0eb0969103337918215fc491feae196219e8fb03f0b1", 
 "algorithm": "sha512", 
 "filename": "clang.tar.bz2"
 }
--- a/build/mozconfig.cache
+++ b/build/mozconfig.cache
@ -4,23 +4,35 @@

 # Setup for build cache

+read branch platform master <<EOF
+$(python2.7 -c 'import json; p = json.loads(open("'"$topsrcdir"'/../buildprops.json").read())["properties"]; print p["branch"], p["platform"], p["master"]' 2> /dev/null)
+EOF
+
 bucket=
-if test -z "$SCCACHE_DISABLE" -a -f "$topsrcdir/sccache/sccache.py"; then
-    case `hostname` in
-    try*spot*.use1.mozilla.com|try*ec2*.use1.mozilla.com)
+if test -z "$SCCACHE_DISABLE" -a -z "$no_tooltool"; then
+    case "${branch}_${master}" in
+    try_*use1.mozilla.com*)
        bucket=mozilla-releng-s3-cache-us-east-1-try
        ;;
-    try*spot*.usw2.mozilla.com|try*ec2*.usw2.mozilla.com)
+    try_*usw2.mozilla.com*)
        bucket=mozilla-releng-s3-cache-us-west-2-try
        ;;
    esac
 fi

 if test -z "$bucket"; then
-    ac_add_options --with-ccache
+    case "$platform" in
+    win*) : ;;
+    *)
+        ac_add_options --with-ccache
+    esac
 else
    mk_add_options "export SCCACHE_BUCKET=$bucket"
-    mk_add_options "export SCCACHE_NAMESERVER=169.254.169.253"
+    case "$master" in
+    *use1.mozilla.com*|*usw2.mozilla.com*)
+        mk_add_options "export SCCACHE_NAMESERVER=169.254.169.253"
+        ;;
+    esac
    ac_add_options "--with-compiler-wrapper=python2.7 $topsrcdir/sccache/sccache.py"
    mk_add_options MOZ_PREFLIGHT+=build/sccache.mk
    mk_add_options MOZ_POSTFLIGHT+=build/sccache.mk
--- a/build/unix/build-clang/build-clang.py
+++ b/build/unix/build-clang/build-clang.py
@ -38,7 +38,7 @@ def build_package(package_source_dir, package_build_dir, configure_args,
        os.mkdir(package_build_dir)
    run_in(package_build_dir,
           ["%s/configure" % package_source_dir] + configure_args)
-    run_in(package_build_dir, ["make", "-j8"] + make_args)
+    run_in(package_build_dir, ["make", "-j4"] + make_args)
    run_in(package_build_dir, ["make", "install"])


@ -59,9 +59,9 @@ def svn_co(url, directory, revision):
    check_run(["svn", "co", "-r", revision, url, directory])


-def build_one_stage(env, stage_dir, llvm_source_dir):
+def build_one_stage(env, stage_dir, llvm_source_dir, gcc_toolchain_dir):
    def f():
-        build_one_stage_aux(stage_dir, llvm_source_dir)
+        build_one_stage_aux(stage_dir, llvm_source_dir, gcc_toolchain_dir)
    with_env(env, f)


@ -99,7 +99,7 @@ def is_darwin():
    return platform.system() == "Darwin"


-def build_one_stage_aux(stage_dir, llvm_source_dir):
+def build_one_stage_aux(stage_dir, llvm_source_dir, gcc_toolchain_dir):
    os.mkdir(stage_dir)

    build_dir = stage_dir + "/build"
@ -117,7 +117,8 @@ def build_one_stage_aux(stage_dir, llvm_source_dir):
                      "--enable-targets=" + ",".join(targets),
                      "--disable-assertions",
                      "--prefix=%s" % inst_dir,
-                      "--with-gcc-toolchain=/tools/gcc-4.7.3-0moz1"]
+                      "--with-gcc-toolchain=%s" % gcc_toolchain_dir,
+                      "--disable-compiler-version-checks"]
    build_package(llvm_source_dir, build_dir, configure_opts, [])

 if __name__ == "__main__":
@ -134,6 +135,8 @@ if __name__ == "__main__":
    clang_source_dir = source_dir + "/clang"
    compiler_rt_source_dir = source_dir + "/compiler-rt"

+    gcc_dir = "/tools/gcc-4.7.3-0moz1"
+
    if is_darwin():
        os.environ['MACOSX_DEPLOYMENT_TARGET'] = '10.7'

@ -175,16 +178,21 @@ if __name__ == "__main__":
    else:
        extra_cflags = "-static-libgcc"
        extra_cxxflags = "-static-libgcc -static-libstdc++"
-        cc = "/usr/bin/gcc"
-        cxx = "/usr/bin/g++"
+        cc = gcc_dir + "/bin/gcc"
+        cxx = gcc_dir + "/bin/g++"

-    build_one_stage({"CC": cc, "CXX": cxx}, stage1_dir, llvm_source_dir)
+    if os.environ.has_key('LD_LIBRARY_PATH'):
+        os.environ['LD_LIBRARY_PATH'] = '%s/lib64/:%s' % (gcc_dir, os.environ['LD_LIBRARY_PATH']);
+    else:
+        os.environ['LD_LIBRARY_PATH'] = '%s/lib64/' % gcc_dir
+
+    build_one_stage({"CC": cc, "CXX": cxx}, stage1_dir, llvm_source_dir, gcc_dir)

    stage2_dir = build_dir + '/stage2'
    build_one_stage(
        {"CC": stage1_inst_dir + "/bin/clang %s" % extra_cflags,
         "CXX": stage1_inst_dir + "/bin/clang++ %s" % extra_cxxflags},
-        stage2_dir, llvm_source_dir)
+        stage2_dir, llvm_source_dir, gcc_dir)

    build_tar_package("tar", "clang.tar.bz2", stage2_dir, "clang")
    build_tooltool_manifest(llvm_revision)
--- a/build/unix/build-clang/clang-trunk.json
+++ b/build/unix/build-clang/clang-trunk.json
@ -1,11 +1,11 @@
 {
-    "llvm_revision": "185949",
+    "llvm_revision": "200213",
    "llvm_repo": "https://llvm.org/svn/llvm-project/llvm/trunk",
    "clang_repo": "https://llvm.org/svn/llvm-project/cfe/trunk",
    "compiler_repo": "https://llvm.org/svn/llvm-project/compiler-rt/trunk",
    "patches": {
        "macosx64": ["llvm-debug-frame.patch"],
-        "linux64": ["llvm-debug-frame.patch", "no-sse-on-linux.patch"],
-        "linux32": ["llvm-debug-frame.patch", "no-sse-on-linux.patch"]
+        "linux64": ["llvm-debug-frame.patch", "no-sse-on-linux-trunk.patch"],
+        "linux32": ["llvm-debug-frame.patch", "no-sse-on-linux-trunk.patch"]
    }
 }
--- a/build/unix/build-clang/no-sse-on-linux-trunk.patch
+++ b/build/unix/build-clang/no-sse-on-linux-trunk.patch
@ -0,0 +1,13 @@
+Index: lib/Driver/Tools.cpp
+===================================================================
+--- a/clang/lib/Driver/Tools.cpp	(revision 199443)
+++ b/clang/lib/Driver/Tools.cpp	(working copy)
+@@ -1226,7 +1226,7 @@
+   // All x86 devices running Android have core2 as their common
+   // denominator. This makes a better choice than pentium4.
+   if (Triple.getEnvironment() == llvm::Triple::Android)
+-    return "core2";
+    return "686";
+ 
+   // Everything else goes to x86-64 in 64-bit mode.
+   if (Is64Bit)
--- a/build/valgrind/i386-redhat-linux-gnu.sup
+++ b/build/valgrind/i386-redhat-linux-gnu.sup
@ -49,3 +49,15 @@
   obj:/lib/libgobject-2.0.so.0.2200.5
   ...
 }
+
+###################################
+#  Leaks in short lived precesses #
+###################################
+
+{
+   Bug 984196
+   Memcheck:Leak
+   ...
+   fun:glxtest
+   ...
+}
--- a/build/valgrind/x86_64-redhat-linux-gnu.sup
+++ b/build/valgrind/x86_64-redhat-linux-gnu.sup
@ -71,3 +71,15 @@
   fun:gdk_display_open
   ...
 }
+
+###################################
+#  Leaks in short lived precesses #
+###################################
+
+{
+   Bug 984196
+   Memcheck:Leak
+   ...
+   fun:glxtest
+   ...
+}
--- a/dom/activities/src/Activity.cpp
+++ b/dom/activities/src/Activity.cpp
@ -67,7 +67,7 @@ Activity::Initialize(nsPIDOMWindow* aWindow,
  NS_ENSURE_SUCCESS(rv, rv);

  JS::Rooted<JS::Value> optionsValue(aCx);
-  if (!aOptions.ToObject(aCx, JS::NullPtr(), &optionsValue)) {
+  if (!aOptions.ToObject(aCx, &optionsValue)) {
    return NS_ERROR_FAILURE;
  }

--- a/dom/base/Console.cpp
+++ b/dom/base/Console.cpp
@ -689,7 +689,7 @@ Console::ProfileMethod(JSContext* aCx, const nsAString& aAction,
  }

  JS::Rooted<JS::Value> eventValue(aCx);
-  if (!event.ToObject(aCx, JS::NullPtr(), &eventValue)) {
+  if (!event.ToObject(aCx, &eventValue)) {
    aRv.Throw(NS_ERROR_FAILURE);
    return;
  }
@ -1001,7 +1001,7 @@ Console::ProcessCallData(ConsoleCallData* aData)
  }

  JS::Rooted<JS::Value> eventValue(cx);
-  if (!event.ToObject(cx, JS::NullPtr(), &eventValue)) {
+  if (!event.ToObject(cx, &eventValue)) {
    Throw(cx, NS_ERROR_FAILURE);
    return;
  }
@ -1300,7 +1300,7 @@ Console::StartTimer(JSContext* aCx, const JS::Value& aName,
    RootedDictionary<ConsoleTimerError> error(aCx);

    JS::Rooted<JS::Value> value(aCx);
-    if (!error.ToObject(aCx, JS::NullPtr(), &value)) {
+    if (!error.ToObject(aCx, &value)) {
      return JS::UndefinedValue();
    }

@ -1332,7 +1332,7 @@ Console::StartTimer(JSContext* aCx, const JS::Value& aName,
  timer.mStarted = aTimestamp;

  JS::Rooted<JS::Value> value(aCx);
-  if (!timer.ToObject(aCx, JS::NullPtr(), &value)) {
+  if (!timer.ToObject(aCx, &value)) {
    return JS::UndefinedValue();
  }

@ -1366,7 +1366,7 @@ Console::StopTimer(JSContext* aCx, const JS::Value& aName,
  timer.mDuration = aTimestamp - entry;

  JS::Rooted<JS::Value> value(aCx);
-  if (!timer.ToObject(aCx, JS::NullPtr(), &value)) {
+  if (!timer.ToObject(aCx, &value)) {
    return JS::UndefinedValue();
  }

@ -1414,7 +1414,7 @@ Console::IncreaseCounter(JSContext* aCx, const ConsoleStackEntry& aFrame,
      RootedDictionary<ConsoleCounterError> error(aCx);

      JS::Rooted<JS::Value> value(aCx);
-      if (!error.ToObject(aCx, JS::NullPtr(), &value)) {
+      if (!error.ToObject(aCx, &value)) {
        return JS::UndefinedValue();
      }

@ -1430,7 +1430,7 @@ Console::IncreaseCounter(JSContext* aCx, const ConsoleStackEntry& aFrame,
  data.mCount = count;

  JS::Rooted<JS::Value> value(aCx);
-  if (!data.ToObject(aCx, JS::NullPtr(), &value)) {
+  if (!data.ToObject(aCx, &value)) {
    return JS::UndefinedValue();
  }

--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@ -5678,7 +5678,7 @@ nsGlobalWindow::DispatchResizeEvent(const nsIntSize& aSize)
  detail.mWidth = aSize.width;
  detail.mHeight = aSize.height;
  JS::Rooted<JS::Value> detailValue(cx);
-  if (!detail.ToObject(cx, JS::NullPtr(), &detailValue)) {
+  if (!detail.ToObject(cx, &detailValue)) {
    return false;
  }

--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@ -4672,7 +4672,7 @@ if (!returnArray) {
                False)

    if type.isDictionary():
-        return (wrapAndSetPtr("%s.ToObject(cx, ${obj}, ${jsvalHandle})" % result),
+        return (wrapAndSetPtr("%s.ToObject(cx, ${jsvalHandle})" % result),
                False)

    if type.isDate():
@ -9319,7 +9319,7 @@ if (!*reinterpret_cast<jsid**>(atomsCache) && !InitIds(cx, atomsCache)) {
        if self.dictionary.parent:
            body += (
                "// Per spec, we define the parent's members first\n"
-                "if (!%s::ToObject(cx, parentObject, rval)) {\n"
+                "if (!%s::ToObject(cx, rval)) {\n"
                "  return false;\n"
                "}\n"
                "JS::Rooted<JSObject*> obj(cx, &rval.toObject());\n"
@ -9339,7 +9339,6 @@ if (!*reinterpret_cast<jsid**>(atomsCache) && !InitIds(cx, atomsCache)) {

        return ClassMethod("ToObject", "bool", [
            Argument('JSContext*', 'cx'),
-            Argument('JS::Handle<JSObject*>', 'parentObject'),
            Argument('JS::MutableHandle<JS::Value>', 'rval'),
        ], const=True, body=body)

@ -9598,7 +9597,9 @@ if (""",
                'jsvalRef': "temp",
                'jsvalHandle': "&temp",
                'returnsNewObject': False,
-                'obj': "parentObject",
+                # 'obj' can just be allowed to be the string "obj", since that
+                # will be our dictionary object, which is presumably itself in
+                # the right scope.
                'typedArraysAreStructs': True
            })
        conversion = CGGeneric(innerTemplate)
--- a/dom/browser-element/BrowserElementParent.cpp
+++ b/dom/browser-element/BrowserElementParent.cpp
@ -160,7 +160,7 @@ BrowserElementParent::DispatchOpenWindowEvent(Element* aOpenerFrameElement,

  JS::Rooted<JSObject*> global(cx, sgo->GetGlobalJSObject());
  JSAutoCompartment ac(cx, global);
-  if (!detail.ToObject(cx, global, &val)) {
+  if (!detail.ToObject(cx, &val)) {
    MOZ_CRASH("Failed to convert dictionary to JS::Value due to OOM.");
    return BrowserElementParent::OPEN_WINDOW_IGNORED;
  }
@ -332,9 +332,7 @@ NS_IMETHODIMP DispatchAsyncScrollEventRunnable::Run()
  JSAutoCompartment ac(cx, globalJSObject);
  JS::Rooted<JS::Value> val(cx);

-  // We can get away with a null global here because
-  // AsyncScrollEventDetail only contains numeric values.
-  if (!detail.ToObject(cx, JS::NullPtr(), &val)) {
+  if (!detail.ToObject(cx, &val)) {
    MOZ_CRASH("Failed to convert dictionary to JS::Value due to OOM.");
    return NS_ERROR_FAILURE;
  }
--- a/dom/camera/CameraCommon.h
+++ b/dom/camera/CameraCommon.h
@ -61,43 +61,4 @@ enum {
 #define DOM_CAMERA_LOGW( ... )      DOM_CAMERA_LOG( DOM_CAMERA_LOG_WARNING, __VA_ARGS__ )
 #define DOM_CAMERA_LOGE( ... )      DOM_CAMERA_LOG( DOM_CAMERA_LOG_ERROR, __VA_ARGS__ )

-#ifdef PR_LOGGING
-
-static inline void nsLogAddRefCamera(const char *file, uint32_t line, void* p, uint32_t count, const char *clazz, uint32_t size)
-{
-  if (count == 1) {
-    DOM_CAMERA_LOGR("++++++++++++++++++++++++++++++++++++++++");
-  }
-  DOM_CAMERA_LOGR("%s:%d : CAMREF-ADD(%s): this=%p, mRefCnt=%d\n", file, line, clazz, p, count);
-}
-
-static inline void nsLogReleaseCamera(const char *file, uint32_t line, void* p, uint32_t count, const char *clazz, bool abortOnDelete)
-{
-  DOM_CAMERA_LOGR("%s:%d : CAMREF-REL(%s): this=%p, mRefCnt=%d\n", file, line, clazz, p, count);
-  if (count == 0) {
-    if (!abortOnDelete) {
-      DOM_CAMERA_LOGR("----------------------------------------");
-    } else {
-      DOM_CAMERA_LOGR("---------- ABORTING ON DELETE ----------");
-      *((uint32_t *)0xdeadbeef) = 0x266230;
-    }
-  }
-}
-
-#ifdef NS_LOG_ADDREF
-#undef NS_LOG_ADDREF
-#endif
-#ifdef NS_LOG_RELEASE
-#undef NS_LOG_RELEASE
-#endif
-
-#define NS_LOG_ADDREF( p, n, c, s ) nsLogAddRefCamera(__FILE__, __LINE__, (p), (n), (c), (s))
-#ifdef DOM_CAMERA_DEBUG_REFS_ABORT_ON_DELETE
-#define NS_LOG_RELEASE( p, n, c )   nsLogReleaseCamera(__FILE__, __LINE__, (p), (n), (c), DOM_CAMERA_DEBUG_REFS_ABORT_ON_DELETE)
-#else
-#define NS_LOG_RELEASE( p, n, c )   nsLogReleaseCamera(__FILE__, __LINE__, (p), (n), (c), false)
-#endif
-
-#endif // PR_LOGGING
-
 #endif // DOM_CAMERA_CAMERACOMMON_H
--- a/dom/contacts/tests/test_migration_chrome.js
+++ b/dom/contacts/tests/test_migration_chrome.js
@ -14,7 +14,10 @@ Cu.import("resource://gre/modules/ContactService.jsm", imports);
 Cu.import("resource://gre/modules/Promise.jsm", imports);
 Cu.importGlobalProperties(["indexedDB"]);

-const {
+// |const| will not work because
+// it will make the Promise object immutable before assigning.
+// Using |let| and Object.freeze() instead.
+let {
  STORE_NAME,
  SAVED_GETALL_STORE_NAME,
  REVISION_STORE,
@ -22,6 +25,7 @@ const {
  ContactService,
  Promise
 } = imports;
+Object.freeze(imports);

 let DEBUG = false;
 function debug(str) {
--- a/dom/datastore/DataStoreService.js
+++ b/dom/datastore/DataStoreService.js
@ -378,7 +378,7 @@ DataStoreService.prototype = {
  },

  observe: function observe(aSubject, aTopic, aData) {
-    debug('getDataStores - aTopic: ' + aTopic);
+    debug('observe - aTopic: ' + aTopic);
    if (aTopic != 'webapps-clear-data') {
      return;
    }
@ -391,16 +391,35 @@ DataStoreService.prototype = {
      return;
    }

+    function isEmpty(aMap) {
+      for (var key in aMap) {
+        if (aMap.hasOwnProperty(key)) {
+          return false;
+        }
+      }
+      return true;
+    }
+
    for (let key in this.stores) {
      if (params.appId in this.stores[key]) {
        this.deleteDatabase(key, this.stores[key][params.appId].owner);
        delete this.stores[key][params.appId];
      }

-      if (!this.stores[key].length) {
+      if (isEmpty(this.stores[key])) {
        delete this.stores[key];
      }
    }
+
+    for (let key in this.accessStores) {
+      if (params.appId in this.accessStores[key]) {
+        delete this.accessStores[key][params.appId];
+      }
+
+      if (isEmpty(this.accessStores[key])) {
+        delete this.accessStores[key];
+      }
+    }
  },

  deleteDatabase: function(aName, aOwner) {
--- a/dom/datastore/tests/file_bug986056.html
+++ b/dom/datastore/tests/file_bug986056.html
@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for DataStore - bug 986056 app</title>
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+  <script type="application/javascript;version=1.7">
+
+  function cbError() {
+    alert('KO error');
+  }
+
+  navigator.getDataStores('foo').then(function(stores) {
+    alert("OK " + stores.length);
+  }, cbError);
+  </script>
+</pre>
+</body>
+</html>
+
--- a/dom/datastore/tests/file_bug986056.template.webapp
+++ b/dom/datastore/tests/file_bug986056.template.webapp
@ -0,0 +1,12 @@
+{
+  "name": "Really Rapid Release (hosted)",
+  "description": "Updated even faster than <a href='http://mozilla.org'>Firefox</a>, just to annoy slashdotters.",
+  "launch_path": "/tests/dom/datastore/tests/TESTTOKEN",
+  "icons": { "128": "default_icon" },
+  "datastores-owned" : {
+    "foo" : { "access": "readwrite", "description" : "This store is called foo" }
+  },
+  "datastores-access" : {
+    "foo" : { "readonly": false, "description" : "This store is called foo" }
+  }
+}
--- a/dom/datastore/tests/mochitest.ini
+++ b/dom/datastore/tests/mochitest.ini
@ -17,6 +17,8 @@ support-files =
  file_duplicate.html
  file_bug976311.html
  file_bug976311.template.webapp
+  file_bug986056.html
+  file_bug986056.template.webapp
  file_event_maker.html
  file_event_receiver.html

@ -38,4 +40,5 @@ skip-if = (toolkit == 'gonk' && debug) #debug-only failure; time out
 [test_keys.html]
 [test_duplicate.html]
 [test_bug976311.html]
+[test_bug986056.html]
 [test_oop_events.html]
--- a/dom/datastore/tests/test_bug986056.html
+++ b/dom/datastore/tests/test_bug986056.html
@ -0,0 +1,146 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for DataStore - bug 986056</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+  <script type="application/javascript;version=1.7">
+
+  var gHostedManifestURL = 'http://test/tests/dom/datastore/tests/file_app.sjs?testToken=file_bug986056.html&template=file_bug986056.template.webapp';
+  var gHostedManifestURL2 = 'http://example.com/tests/dom/datastore/tests/file_app.sjs?testToken=file_bug986056.html&template=file_bug986056.template.webapp';
+  var gApps = [];
+
+  function cbError() {
+    ok(false, "Error callback invoked");
+    finish();
+  }
+
+  function installApp(aApp) {
+    var request = navigator.mozApps.install(aApp);
+    request.onerror = cbError;
+    request.onsuccess = function() {
+      gApps.push(request.result);
+      runTest();
+    }
+  }
+
+  function uninstallApp(aApp) {
+    var request = navigator.mozApps.mgmt.uninstall(aApp);
+    request.onerror = cbError;
+    request.onsuccess = runTest;
+  }
+
+  function testApp(aCount) {
+    var ifr = document.createElement('iframe');
+    ifr.setAttribute('mozbrowser', 'true');
+    ifr.setAttribute('mozapp', gApps[0].manifestURL);
+    ifr.setAttribute('src', gApps[0].manifest.launch_path);
+    var domParent = document.getElementById('content');
+
+    // Set us up to listen for messages from the app.
+    var listener = function(e) {
+      var message = e.detail.message;
+      if (/KO/.exec(message)) {
+        ok(false, "Message from app: " + message);
+      } else if (/^OK/.exec(message)) {
+        is(message, "OK " + aCount, "Number of dataStore matches");
+        ifr.removeEventListener('mozbrowsershowmodalprompt', listener);
+        domParent.removeChild(ifr);
+        runTest();
+      }
+    }
+
+    // This event is triggered when the app calls "alert".
+    ifr.addEventListener('mozbrowsershowmodalprompt', listener, false);
+    domParent.appendChild(ifr);
+  }
+
+  var tests = [
+    // Permissions
+    function() {
+      SpecialPowers.pushPermissions(
+        [{ "type": "browser", "allow": 1, "context": document },
+         { "type": "embed-apps", "allow": 1, "context": document },
+         { "type": "webapps-manage", "allow": 1, "context": document }], runTest);
+    },
+
+    // Preferences
+    function() {
+      SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.testing.ignore_ipc_principal", true],
+                                         ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
+    },
+
+    // Enabling mozBrowser
+    function() {
+      SpecialPowers.setAllAppsLaunchable(true);
+      SpecialPowers.pushPrefEnv({"set": [["dom.mozBrowserFramesEnabled", true]]}, runTest);
+    },
+
+    // No confirmation needed when an app is installed
+    function() {
+      SpecialPowers.autoConfirmAppInstall(runTest);
+    },
+
+    // Installing the app1
+    function() { installApp(gHostedManifestURL); },
+
+    // Installing the app2
+    function() { installApp(gHostedManifestURL2); },
+
+    // Run tests in app. 2 apps are installed so we want to have 2 'foo'
+    // dataStore.
+    function() { testApp(2); },
+
+    // Uninstall the first app
+    function() { uninstallApp(gApps.shift()); },
+
+    // Run tests in app. 1 single apps is installed so we want to have 1 'foo'
+    // dataStore.
+    function() { testApp(1); },
+
+    // Installing the app1
+    function() { installApp(gHostedManifestURL); },
+
+    // Run tests in app. Back to 2 apps, 2 datastores.
+    function() { testApp(2); },
+
+    // Uninstall the first app
+    function() { uninstallApp(gApps.shift()); },
+
+    // Uninstall the second app
+    function() { uninstallApp(gApps.shift()); }
+  ];
+
+  function runTest() {
+    if (!tests.length) {
+      finish();
+      return;
+    }
+
+    var test = tests.shift();
+    test();
+  }
+
+  function finish() {
+    SimpleTest.finish();
+  }
+
+  if (SpecialPowers.isMainProcess()) {
+    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+  }
+
+  SimpleTest.waitForExplicitFinish();
+  runTest();
+  </script>
+</pre>
+</body>
+</html>
--- a/dom/events/test/mochitest.ini
+++ b/dom/events/test/mochitest.ini
@ -125,7 +125,7 @@ skip-if = buildapp == 'b2g' # b2g(failing when the test gets moved around, and o
 [test_bug930374-content.html]
 [test_bug944847.html]
 [test_bug967796.html]
-skip-if = toolkit == "gonk"
+skip-if = toolkit == "gonk" || e10s
 [test_bug944011.html]
 [test_bug946632.html]
 [test_clickevent_on_input.html]
--- a/dom/events/test/test_bug432698.html
+++ b/dom/events/test/test_bug432698.html
@ -131,6 +131,7 @@ function runTests() {
  sendMouseEvent("mousemove", outside);
  is(mouseleavecount, 7, "Unexpected mouseleave event count!");

+  checkRelatedTarget = false;
  SimpleTest.finish();
 }

--- a/dom/imptests/html/mochitest.ini
+++ b/dom/imptests/html/mochitest.ini
@ -298,7 +298,7 @@ skip-if = (toolkit == 'gonk' && debug) #b2g-debug(debug-only failure)
 [html/dom/documents/dta/doc.gEBN/test_document.getElementsByName-namespace.xhtml]
 skip-if = (toolkit == 'gonk' && debug) #b2g-debug(debug-only failure)
 [html/dom/documents/dta/doc.gEBN/test_document.getElementsByName-newelements.html]
-skip-if = (toolkit == 'gonk' && debug) #b2g-debug(debug-only failure)
+skip-if = (toolkit == 'gonk' && debug) || (e10s && debug) #b2g-debug(debug-only failure)
 [html/dom/documents/dta/doc.gEBN/test_document.getElementsByName-newelements.xhtml]
 skip-if = (toolkit == 'gonk' && debug) #b2g-debug(debug-only failure)
 [html/dom/documents/dta/doc.gEBN/test_document.getElementsByName-null-undef.html]
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@ -90,7 +90,7 @@ static nsresult CompareDictionaries(JSContext* aCx, JSObject *aA,
  JS::Rooted<JSObject*> a(aCx, aA);
  JSAutoCompartment ac(aCx, aA);
  JS::Rooted<JS::Value> bval(aCx);
-  aB.ToObject(aCx, JS::NullPtr(), &bval);
+  aB.ToObject(aCx, &bval);
  JS::Rooted<JSObject*> b(aCx, &bval.toObject());

  // Iterate over each property in A, and check if it is in B
--- a/dom/src/notification/DesktopNotification.cpp
+++ b/dom/src/notification/DesktopNotification.cpp
@ -101,7 +101,7 @@ DesktopNotification::PostDesktopNotification()
      ops.mTextClickable = true;
      ops.mManifestURL = manifestUrl;

-      if (!ops.ToObject(cx, JS::NullPtr(), &val)) {
+      if (!ops.ToObject(cx, &val)) {
        return NS_ERROR_FAILURE;
      }

--- a/dom/src/notification/Notification.cpp
+++ b/dom/src/notification/Notification.cpp
@ -583,7 +583,7 @@ Notification::ShowInternal()
        ops.mLang = mLang;
        ops.mTag = mTag;

-        if (!ops.ToObject(cx, JS::NullPtr(), &val)) {
+        if (!ops.ToObject(cx, &val)) {
          NS_WARNING("Converting dict to object failed!");
          return;
        }
--- a/dom/system/gonk/NetworkWorker.cpp
+++ b/dom/system/gonk/NetworkWorker.cpp
@ -208,7 +208,7 @@ NetworkWorker::DispatchNetworkResult(const NetworkResultOptions& aOptions)
  mozilla::AutoSafeJSContext cx;
  JS::RootedValue val(cx);

-  if (!aOptions.ToObject(cx, JS::NullPtr(), &val)) {
+  if (!aOptions.ToObject(cx, &val)) {
    return;
  }

--- a/dom/tests/mochitest/pointerlock/mochitest.ini
+++ b/dom/tests/mochitest/pointerlock/mochitest.ini
@ -25,4 +25,4 @@ support-files =
  iframe_differentDOM.html

 [test_pointerlock-api.html]
-skip-if = buildapp == 'b2g' || toolkit == 'android' #TIMED_OUT # b2g(window.open focus issues (using fullscreen)) b2g-debug(window.open focus issues (using fullscreen)) b2g-desktop(window.open focus issues (using fullscreen))
+skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s #TIMED_OUT # b2g(window.open focus issues (using fullscreen)) b2g-debug(window.open focus issues (using fullscreen)) b2g-desktop(window.open focus issues (using fullscreen))
--- a/dom/wifi/WifiProxyService.cpp
+++ b/dom/wifi/WifiProxyService.cpp
@ -281,7 +281,7 @@ WifiProxyService::DispatchWifiResult(const WifiResultOptions& aOptions, const ns
  mozilla::AutoSafeJSContext cx;
  JS::Rooted<JS::Value> val(cx);

-  if (!aOptions.ToObject(cx, JS::NullPtr(), &val)) {
+  if (!aOptions.ToObject(cx, &val)) {
    return;
  }

--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@ -563,6 +563,9 @@ BasicCompositor::BeginFrame(const nsIntRegion& aInvalidRegion,
  nsIntRegion invalidRegionSafe;
  invalidRegionSafe.And(aInvalidRegion, intRect);

+  // FIXME: Redraw the whole screen in every frame to work around bug 972728.
+  invalidRegionSafe = intRect;
+
  nsIntRect invalidRect = invalidRegionSafe.GetBounds();
  mInvalidRect = IntRect(invalidRect.x, invalidRect.y, invalidRect.width, invalidRect.height);
  mInvalidRegion = invalidRegionSafe;
--- a/gfx/tests/gtest/TestAsyncPanZoomController.cpp
+++ b/gfx/tests/gtest/TestAsyncPanZoomController.cpp
@ -861,6 +861,7 @@ TEST_F(AsyncPanZoomControllerTester, LongPressPreventDefault) {
  status = apzc->ReceiveInputEvent(mti);
  EXPECT_EQ(status, nsEventStatus_eIgnore);

+  EXPECT_CALL(*mcc, HandleLongTapUp(CSSPoint(touchX, touchEndY), 0, apzc->GetGuid())).Times(1);
  status = ApzcUp(apzc, touchX, touchEndY, time);
  EXPECT_EQ(nsEventStatus_eIgnore, status);

--- a/ipc/chromium/src/base/message_pump_default.cc
+++ b/ipc/chromium/src/base/message_pump_default.cc
@ -54,13 +54,19 @@ void MessagePumpDefault::Run(Delegate* delegate) {
    if (delayed_work_time_.is_null()) {
      hangMonitor.NotifyWait();
      PROFILER_LABEL("MessagePump", "Wait");
-      event_.Wait();
+      {
+        GeckoProfilerSleepRAII profiler_sleep;
+        event_.Wait();
+      }
    } else {
      TimeDelta delay = delayed_work_time_ - TimeTicks::Now();
      if (delay > TimeDelta()) {
        hangMonitor.NotifyWait();
        PROFILER_LABEL("MessagePump", "Wait");
-        event_.TimedWait(delay);
+        {
+          GeckoProfilerSleepRAII profiler_sleep;
+          event_.TimedWait(delay);
+        }
      } else {
        // It looks like delayed_work_time_ indicates a time in the past, so we
        // need to call DoDelayedWork now.
--- a/js/src/jit-test/tests/asm.js/testBug989166.js
+++ b/js/src/jit-test/tests/asm.js/testBug989166.js
@ -0,0 +1,8 @@
+(function(stdlib) {
+    "use asm";
+    var pow = stdlib.Math.pow
+    function f() {
+        return +pow(.0, .0)
+    }
+    return f
+})(this, {}, ArrayBuffer)()
--- a/js/src/jit-test/tests/auto-regress/bug782083.js
+++ b/js/src/jit-test/tests/auto-regress/bug782083.js
@ -11,6 +11,6 @@ function randomFloat () {\
    if (r < 0.25)\
        fac = 10000000;\
 }\
-for (var i = 0; i < 100000; i++)\
+for (var i = 0; i < 2000; i++)\
    randomFloat();\
 ");
--- a/js/src/jit-test/tests/debug/Memory-01.js
+++ b/js/src/jit-test/tests/debug/Memory-01.js
@ -0,0 +1,6 @@
+assertEq(typeof Debugger.Memory, "function");
+let dbg = new Debugger;
+assertEq(dbg.memory instanceof Debugger.Memory, true);
+
+load(libdir + "asserts.js");
+assertThrowsInstanceOf(() => new Debugger.Memory, TypeError);
--- a/js/src/jit-test/tests/ion/bug958432.js
+++ b/js/src/jit-test/tests/ion/bug958432.js
@ -0,0 +1,27 @@
+function h(i, i) {
+    i = ([Infinity([])])(1 ? l : arguments)
+}
+for (var j = 0; j < 2; ++j) {
+    try {
+        h(-Number, -Number)
+    } catch (e) {}
+}
+
+function f() {
+    function f(i0, i1) {
+        i0 = i0 | 0;
+        i = i1 | 0;
+        switch (1) {
+            case -3:
+                switch (f) {}
+        } {
+            return 0
+        }(arguments)
+    }
+    return f
+};
+for (var j = 0; j < 5; ++j) {
+    (function(x) {
+        f()(f()(x, f()()))
+    })()
+}
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@ -3918,8 +3918,10 @@ IonBuilder::inlineScriptedCall(CallInfo &callInfo, JSFunction *target)
    {
        types::StackTypeSet *types = types::TypeScript::ThisTypes(calleeScript);
        if (!types->unknown()) {
-            MTypeBarrier *barrier =
-                MTypeBarrier::New(alloc(), callInfo.thisArg(), types->clone(alloc_->lifoAlloc()));
+            types::TemporaryTypeSet *clonedTypes = types->clone(alloc_->lifoAlloc());
+            if (!clonedTypes)
+                return oom();
+            MTypeBarrier *barrier = MTypeBarrier::New(alloc(), callInfo.thisArg(), clonedTypes);
            current->add(barrier);
            callInfo.setThis(barrier);
        }
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@ -844,6 +844,11 @@ class IonBuilder : public MIRGenerator
    }
    IonBuilder *callerBuilder_;

+    bool oom() {
+        abortReason_ = AbortReason_Alloc;
+        return false;
+    }
+
    struct LoopHeader {
        jsbytecode *pc;
        MBasicBlock *header;
--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@ -49,9 +49,6 @@ enum BailoutKind
    Bailout_BaselineInfo
 };

-static const uint32_t BAILOUT_KIND_BITS = 3;
-static const uint32_t BAILOUT_RESUME_BITS = 1;
-
 inline const char *
 BailoutKindString(BailoutKind kind)
 {
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@ -870,7 +870,6 @@ class LToIdV : public LInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 1>
 {
  public:
    LIR_HEADER(ToIdV)
-    BOX_OUTPUT_ACCESSORS()

    LToIdV(const LDefinition &temp)
    {
@ -2808,7 +2807,6 @@ class LBinaryV : public LCallInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 0>

  public:
    LIR_HEADER(BinaryV)
-    BOX_OUTPUT_ACCESSORS()

    LBinaryV(JSOp jsop)
      : jsop_(jsop)
@ -3510,7 +3508,6 @@ class LImplicitThis : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
  public:
    LIR_HEADER(ImplicitThis)
-    BOX_OUTPUT_ACCESSORS()

    LImplicitThis(const LAllocation &callee) {
        setOperand(0, callee);
@ -3800,7 +3797,6 @@ class LLoadElementV : public LInstructionHelper<BOX_PIECES, 2, 0>
 {
  public:
    LIR_HEADER(LoadElementV)
-    BOX_OUTPUT_ACCESSORS()

    LLoadElementV(const LAllocation &elements, const LAllocation &index) {
        setOperand(0, elements);
@ -3858,7 +3854,6 @@ class LLoadElementHole : public LInstructionHelper<BOX_PIECES, 3, 0>
 {
  public:
    LIR_HEADER(LoadElementHole)
-    BOX_OUTPUT_ACCESSORS()

    LLoadElementHole(const LAllocation &elements, const LAllocation &index, const LAllocation &initLength) {
        setOperand(0, elements);
@ -4200,7 +4195,6 @@ class LLoadTypedArrayElementHole : public LInstructionHelper<BOX_PIECES, 2, 0>
 {
  public:
    LIR_HEADER(LoadTypedArrayElementHole)
-    BOX_OUTPUT_ACCESSORS()

    LLoadTypedArrayElementHole(const LAllocation &object, const LAllocation &index) {
        setOperand(0, object);
@ -4373,7 +4367,6 @@ class LLoadFixedSlotV : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
  public:
    LIR_HEADER(LoadFixedSlotV)
-    BOX_OUTPUT_ACCESSORS()

    LLoadFixedSlotV(const LAllocation &object) {
        setOperand(0, object);
@ -4444,7 +4437,6 @@ class LGetNameCache : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
  public:
    LIR_HEADER(GetNameCache)
-    BOX_OUTPUT_ACCESSORS()

    LGetNameCache(const LAllocation &scopeObj) {
        setOperand(0, scopeObj);
@ -4461,7 +4453,6 @@ class LCallGetIntrinsicValue : public LCallInstructionHelper<BOX_PIECES, 0, 0>
 {
  public:
    LIR_HEADER(CallGetIntrinsicValue)
-    BOX_OUTPUT_ACCESSORS()

    const MCallGetIntrinsicValue *mir() const {
        return mir_->toCallGetIntrinsicValue();
@ -4490,7 +4481,6 @@ class LGetPropertyCacheV : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
  public:
    LIR_HEADER(GetPropertyCacheV)
-    BOX_OUTPUT_ACCESSORS()

    LGetPropertyCacheV(const LAllocation &object) {
        setOperand(0, object);
@ -4525,7 +4515,6 @@ class LGetPropertyPolymorphicV : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
  public:
    LIR_HEADER(GetPropertyPolymorphicV)
-    BOX_OUTPUT_ACCESSORS()

    LGetPropertyPolymorphicV(const LAllocation &obj) {
        setOperand(0, obj);
@ -4627,7 +4616,6 @@ class LGetElementCacheV : public LInstructionHelper<BOX_PIECES, 1 + BOX_PIECES,
 {
  public:
    LIR_HEADER(GetElementCacheV)
-    BOX_OUTPUT_ACCESSORS()

    static const size_t Index = 1;

@ -4691,7 +4679,6 @@ class LLoadSlotV : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
  public:
    LIR_HEADER(LoadSlotV)
-    BOX_OUTPUT_ACCESSORS()

    LLoadSlotV(const LAllocation &in) {
        setOperand(0, in);
@ -4915,7 +4902,6 @@ class LCallGetElement : public LCallInstructionHelper<BOX_PIECES, 2 * BOX_PIECES
 {
  public:
    LIR_HEADER(CallGetElement)
-    BOX_OUTPUT_ACCESSORS()

    static const size_t LhsInput = 0;
    static const size_t RhsInput = BOX_PIECES;
@ -4930,7 +4916,6 @@ class LCallSetElement : public LCallInstructionHelper<0, 1 + 2 * BOX_PIECES, 0>
 {
  public:
    LIR_HEADER(CallSetElement)
-    BOX_OUTPUT_ACCESSORS()

    static const size_t Index = 1;
    static const size_t Value = 1 + BOX_PIECES;
@ -5171,7 +5156,6 @@ class LIteratorNext : public LInstructionHelper<BOX_PIECES, 1, 1>
 {
  public:
    LIR_HEADER(IteratorNext)
-    BOX_OUTPUT_ACCESSORS()

    LIteratorNext(const LAllocation &iterator, const LDefinition &temp) {
        setOperand(0, iterator);
@ -5249,7 +5233,6 @@ class LGetFrameArgument : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
  public:
    LIR_HEADER(GetFrameArgument)
-    BOX_OUTPUT_ACCESSORS()

    LGetFrameArgument(const LAllocation &index) {
        setOperand(0, index);
@ -5300,7 +5283,6 @@ class LSetFrameArgumentV : public LInstructionHelper<0, BOX_PIECES, 0>
 {
  public:
    LIR_HEADER(SetFrameArgumentV)
-    BOX_OUTPUT_ACCESSORS()

    LSetFrameArgumentV() {}

--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@ -1539,21 +1539,6 @@ LAllocation::toRegister() const
        return visitor->visit##opcode(this);                                \
    }

-#if defined(JS_NUNBOX32)
-# define BOX_OUTPUT_ACCESSORS()                                             \
-    const LDefinition *outputType() {                                       \
-        return getDef(TYPE_INDEX);                                          \
-    }                                                                       \
-    const LDefinition *outputPayload() {                                    \
-        return getDef(PAYLOAD_INDEX);                                       \
-    }
-#elif defined(JS_PUNBOX64)
-# define BOX_OUTPUT_ACCESSORS()                                             \
-    const LDefinition *outputValue() {                                      \
-        return getDef(0);                                                   \
-    }
-#endif
-
 #include "jit/LIR-Common.h"
 #if defined(JS_CODEGEN_X86) || defined(JS_CODEGEN_X64)
 # if defined(JS_CODEGEN_X86)
--- a/js/src/jit/Snapshots.cpp
+++ b/js/src/jit/Snapshots.cpp
@ -20,8 +20,9 @@ using namespace js::jit;

 // Snapshot header:
 //
-//   [vwu] bits (n-31]: frame count
-//         bits [0,n):  bailout kind (n = BAILOUT_KIND_BITS)
+//   [vwu] bits ((n+1)-31]: frame count
+//         bit n+1: resume after
+//         bits [0,n): bailout kind (n = SNAPSHOT_BAILOUTKIND_BITS)
 //
 // Snapshot body, repeated "frame count" times, from oldest frame to newest frame.
 // Note that the first frame doesn't have the "parent PC" field.
@ -463,20 +464,32 @@ SnapshotReader::SnapshotReader(const uint8_t *snapshots, uint32_t offset,
    readSnapshotHeader();
 }

-static const uint32_t BAILOUT_KIND_SHIFT = 0;
-static const uint32_t BAILOUT_KIND_MASK = (1 << BAILOUT_KIND_BITS) - 1;
-static const uint32_t BAILOUT_RESUME_SHIFT = BAILOUT_KIND_SHIFT + BAILOUT_KIND_BITS;
-static const uint32_t BAILOUT_FRAMECOUNT_SHIFT = BAILOUT_KIND_BITS + BAILOUT_RESUME_BITS;
-static const uint32_t BAILOUT_FRAMECOUNT_BITS = (8 * sizeof(uint32_t)) - BAILOUT_FRAMECOUNT_SHIFT;
+#define COMPUTE_SHIFT_AFTER_(name) (name ## _BITS + name ##_SHIFT)
+#define COMPUTE_MASK_(name) (((1 << name ## _BITS) - 1) << name ##_SHIFT)
+
+static const uint32_t SNAPSHOT_BAILOUTKIND_SHIFT = 0;
+static const uint32_t SNAPSHOT_BAILOUTKIND_BITS = 3;
+static const uint32_t SNAPSHOT_BAILOUTKIND_MASK = COMPUTE_MASK_(SNAPSHOT_BAILOUTKIND);
+
+static const uint32_t SNAPSHOT_RESUMEAFTER_SHIFT = COMPUTE_SHIFT_AFTER_(SNAPSHOT_BAILOUTKIND);
+static const uint32_t SNAPSHOT_RESUMEAFTER_BITS = 1;
+static const uint32_t SNAPSHOT_RESUMEAFTER_MASK = COMPUTE_MASK_(SNAPSHOT_RESUMEAFTER);
+
+static const uint32_t SNAPSHOT_FRAMECOUNT_SHIFT = COMPUTE_SHIFT_AFTER_(SNAPSHOT_RESUMEAFTER);
+static const uint32_t SNAPSHOT_FRAMECOUNT_BITS = 32 - 4;
+static const uint32_t SNAPSHOT_FRAMECOUNT_MASK = COMPUTE_MASK_(SNAPSHOT_FRAMECOUNT);
+
+#undef COMPUTE_MASK_
+#undef COMPUTE_SHIFT_AFTER_

 void
 SnapshotReader::readSnapshotHeader()
 {
    uint32_t bits = reader_.readUnsigned();
-    frameCount_ = bits >> BAILOUT_FRAMECOUNT_SHIFT;
+    frameCount_ = bits >> SNAPSHOT_FRAMECOUNT_SHIFT;
    JS_ASSERT(frameCount_ > 0);
-    bailoutKind_ = BailoutKind((bits >> BAILOUT_KIND_SHIFT) & BAILOUT_KIND_MASK);
-    resumeAfter_ = !!(bits & (1 << BAILOUT_RESUME_SHIFT));
+    bailoutKind_ = BailoutKind((bits & SNAPSHOT_BAILOUTKIND_MASK) >> SNAPSHOT_BAILOUTKIND_SHIFT);
+    resumeAfter_ = !!(bits & (1 << SNAPSHOT_RESUMEAFTER_SHIFT));

 #ifdef TRACK_SNAPSHOTS
    pcOpcode_  = reader_.readUnsigned();
@ -559,13 +572,13 @@ SnapshotWriter::startSnapshot(uint32_t frameCount, BailoutKind kind, bool resume
    IonSpew(IonSpew_Snapshots, "starting snapshot with frameCount %u, bailout kind %u",
            frameCount, kind);
    JS_ASSERT(frameCount > 0);
-    JS_ASSERT(frameCount < (1 << BAILOUT_FRAMECOUNT_BITS));
-    JS_ASSERT(uint32_t(kind) < (1 << BAILOUT_KIND_BITS));
+    JS_ASSERT(frameCount < (1 << SNAPSHOT_FRAMECOUNT_BITS));
+    JS_ASSERT(uint32_t(kind) < (1 << SNAPSHOT_BAILOUTKIND_BITS));

-    uint32_t bits = (uint32_t(kind) << BAILOUT_KIND_SHIFT) |
-                    (frameCount << BAILOUT_FRAMECOUNT_SHIFT);
+    uint32_t bits = (uint32_t(kind) << SNAPSHOT_BAILOUTKIND_SHIFT) |
+                    (frameCount << SNAPSHOT_FRAMECOUNT_SHIFT);
    if (resumeAfter)
-        bits |= (1 << BAILOUT_RESUME_SHIFT);
+        bits |= (1 << SNAPSHOT_RESUMEAFTER_SHIFT);

    writer_.writeUnsigned(bits);
    return lastStart_;
--- a/js/src/jit/x64/CodeGenerator-x64.cpp
+++ b/js/src/jit/x64/CodeGenerator-x64.cpp
@ -136,11 +136,11 @@ CodeGeneratorX64::visitUnbox(LUnbox *unbox)
 bool
 CodeGeneratorX64::visitLoadSlotV(LLoadSlotV *load)
 {
-    Register dest = ToRegister(load->outputValue());
+    ValueOperand dest = ToOutValue(load);
    Register base = ToRegister(load->input());
    int32_t offset = load->mir()->slot() * sizeof(js::Value);

-    masm.loadPtr(Address(base, offset), dest);
+    masm.loadValue(Address(base, offset), dest);
    return true;
 }

--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@ -687,13 +687,17 @@ CodeGeneratorX86::postAsmJSCall(LAsmJSCall *lir)
        return;

    if (mir->type() == MIRType_Float32) {
-        Operand op(esp, -sizeof(float));
+        masm.reserveStack(sizeof(float));
+        Operand op(esp, 0);
        masm.fstp32(op);
        masm.loadFloat32(op, ReturnFloatReg);
+        masm.freeStack(sizeof(float));
    } else {
-        Operand op(esp, -sizeof(double));
+        masm.reserveStack(sizeof(double));
+        Operand op(esp, 0);
        masm.fstp(op);
        masm.loadDouble(op, ReturnFloatReg);
+        masm.freeStack(sizeof(double));
    }
 }

--- a/js/src/moz.build
+++ b/js/src/moz.build
@ -163,6 +163,7 @@ UNIFIED_SOURCES += [
    'vm/Compression.cpp',
    'vm/DateTime.cpp',
    'vm/Debugger.cpp',
+    'vm/DebuggerMemory.cpp',
    'vm/ErrorObject.cpp',
    'vm/ForkJoin.cpp',
    'vm/GlobalObject.cpp',
--- a/js/src/tests/js1_5/extensions/regress-406572.js
+++ b/js/src/tests/js1_5/extensions/regress-406572.js
@ -14,19 +14,26 @@ printStatus (summary);

 if (typeof window != 'undefined')
 {
-  var s = self;
+  try {
+    actual = "FAIL: Unexpected exception thrown";

-  document.writeln(uneval(self));
-  self = 1;
-  document.writeln(uneval(self));
+    var win = window;
+    var windowString = String(window);
+    window = 1;
+    reportCompare(windowString, String(window), "window should be readonly");

-  if (1)
-    function self() { return 1; }
+    actual = ""; // We should reach this line, and throw an exception after it

-  document.writeln(uneval(self));
+    if (1)
+      function window() { return 1; }

-  // The test harness might rely on self having its original value: restore it.
-  self = s;
+    actual = "FAIL: this line should never be reached";
+
+    // The test harness might rely on window having its original value:
+    // restore it.
+    window = win;
+  } catch (e) {
+  }
 }
 else
 {
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@ -12,19 +12,17 @@
 #include "jsnum.h"
 #include "jsobj.h"
 #include "jswrapper.h"
-
 #include "frontend/BytecodeCompiler.h"
 #include "gc/Marking.h"
 #include "jit/BaselineJIT.h"
 #include "js/Vector.h"
 #include "vm/ArgumentsObject.h"
+#include "vm/DebuggerMemory.h"
 #include "vm/WrapperObject.h"
-
 #include "jsgcinlines.h"
 #include "jsobjinlines.h"
 #include "jsopcodeinlines.h"
 #include "jsscriptinlines.h"
-
 #include "vm/ObjectImpl-inl.h"
 #include "vm/Stack-inl.h"

@ -1929,11 +1927,17 @@ Debugger::setUncaughtExceptionHook(JSContext *cx, unsigned argc, Value *vp)
                             "uncaughtExceptionHook");
        return false;
    }
-
    dbg->uncaughtExceptionHook = args[0].toObjectOrNull();
    args.rval().setUndefined();
    return true;
 }
+bool
+Debugger::getMemory(JSContext *cx, unsigned argc, Value *vp)
+{
+    THIS_DEBUGGER(cx, argc, vp, "get memory", args, dbg);
+    args.rval().set(dbg->object->getReservedSlot(JSSLOT_DEBUG_MEMORY_INSTANCE));
+    return true;
+}

 GlobalObject *
 Debugger::unwrapDebuggeeArgument(JSContext *cx, const Value &v)
@ -2135,17 +2139,24 @@ Debugger::construct(JSContext *cx, unsigned argc, Value *vp)
        return false;
    RootedObject proto(cx, &v.toObject());
    JS_ASSERT(proto->getClass() == &Debugger::jsclass);
-
    /*
     * Make the new Debugger object. Each one has a reference to
-     * Debugger.{Frame,Object,Script}.prototype in reserved slots. The rest of
-     * the reserved slots are for hooks; they default to undefined.
+     * Debugger.{Frame,Object,Script,Memory}.prototype in reserved slots. The
+     * rest of the reserved slots are for hooks; they default to undefined.
     */
    RootedObject obj(cx, NewObjectWithGivenProto(cx, &Debugger::jsclass, proto, nullptr));
    if (!obj)
        return false;
    for (unsigned slot = JSSLOT_DEBUG_PROTO_START; slot < JSSLOT_DEBUG_PROTO_STOP; slot++)
        obj->setReservedSlot(slot, proto->getReservedSlot(slot));
+    /* Create the Debugger.Memory instance accessible by the
+     * |Debugger.prototype.memory| getter. */
+    Value memoryProto = obj->getReservedSlot(JSSLOT_DEBUG_MEMORY_PROTO);
+    RootedObject memory(cx, NewObjectWithGivenProto(cx, &DebuggerMemory::class_,
+                                                    &memoryProto.toObject(), nullptr));
+    if (!memory)
+        return false;
+    obj->setReservedSlot(JSSLOT_DEBUG_MEMORY_INSTANCE, ObjectValue(*memory));

    /* Construct the underlying C++ object. */
    Debugger *dbg = cx->new_<Debugger>(cx, obj.get());
@ -2814,9 +2825,9 @@ const JSPropertySpec Debugger::properties[] = {
    JS_PSGS("onNewGlobalObject", Debugger::getOnNewGlobalObject, Debugger::setOnNewGlobalObject, 0),
    JS_PSGS("uncaughtExceptionHook", Debugger::getUncaughtExceptionHook,
            Debugger::setUncaughtExceptionHook, 0),
+    JS_PSG("memory", Debugger::getMemory, 0),
    JS_PS_END
 };
-
 const JSFunctionSpec Debugger::methods[] = {
    JS_FN("addDebuggee", Debugger::addDebuggee, 1, 0),
    JS_FN("addAllGlobalsAsDebuggees", Debugger::addAllGlobalsAsDebuggees, 0, 0),
@ -5905,13 +5916,11 @@ JS_DefineDebuggerObject(JSContext *cx, HandleObject obj)
        scriptProto(cx),
        sourceProto(cx),
        objectProto(cx),
-        envProto(cx);
-
+        envProto(cx),
+        memoryProto(cx);
    objProto = obj->as<GlobalObject>().getOrCreateObjectPrototype(cx);
    if (!objProto)
        return false;
-
-
    debugProto = js_InitClass(cx, obj,
                              objProto, &Debugger::jsclass, Debugger::construct,
                              1, Debugger::properties, Debugger::methods, nullptr, nullptr,
@ -5946,18 +5955,23 @@ JS_DefineDebuggerObject(JSContext *cx, HandleObject obj)
                               nullptr, nullptr);
    if (!objectProto)
        return false;
-
    envProto = js_InitClass(cx, debugCtor, objProto, &DebuggerEnv_class,
                                      DebuggerEnv_construct, 0,
                                      DebuggerEnv_properties, DebuggerEnv_methods,
                                      nullptr, nullptr);
    if (!envProto)
        return false;
+    memoryProto = js_InitClass(cx, debugCtor, objProto, &DebuggerMemory::class_,
+                               DebuggerMemory::construct, 0, DebuggerMemory::properties,
+                               DebuggerMemory::methods, nullptr, nullptr);
+    if (!memoryProto)
+        return false;

    debugProto->setReservedSlot(Debugger::JSSLOT_DEBUG_FRAME_PROTO, ObjectValue(*frameProto));
    debugProto->setReservedSlot(Debugger::JSSLOT_DEBUG_OBJECT_PROTO, ObjectValue(*objectProto));
    debugProto->setReservedSlot(Debugger::JSSLOT_DEBUG_SCRIPT_PROTO, ObjectValue(*scriptProto));
    debugProto->setReservedSlot(Debugger::JSSLOT_DEBUG_SOURCE_PROTO, ObjectValue(*sourceProto));
    debugProto->setReservedSlot(Debugger::JSSLOT_DEBUG_ENV_PROTO, ObjectValue(*envProto));
+    debugProto->setReservedSlot(Debugger::JSSLOT_DEBUG_MEMORY_PROTO, ObjectValue(*memoryProto));
    return true;
 }
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@ -170,7 +170,6 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
        OnNewGlobalObject,
        HookCount
    };
-
    enum {
        JSSLOT_DEBUG_PROTO_START,
        JSSLOT_DEBUG_FRAME_PROTO = JSSLOT_DEBUG_PROTO_START,
@ -178,12 +177,13 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
        JSSLOT_DEBUG_OBJECT_PROTO,
        JSSLOT_DEBUG_SCRIPT_PROTO,
        JSSLOT_DEBUG_SOURCE_PROTO,
+        JSSLOT_DEBUG_MEMORY_PROTO,
        JSSLOT_DEBUG_PROTO_STOP,
        JSSLOT_DEBUG_HOOK_START = JSSLOT_DEBUG_PROTO_STOP,
        JSSLOT_DEBUG_HOOK_STOP = JSSLOT_DEBUG_HOOK_START + HookCount,
-        JSSLOT_DEBUG_COUNT = JSSLOT_DEBUG_HOOK_STOP
+        JSSLOT_DEBUG_MEMORY_INSTANCE = JSSLOT_DEBUG_HOOK_STOP,
+        JSSLOT_DEBUG_COUNT
    };
-
  private:
    HeapPtrObject object;               /* The Debugger object. Strong reference. */
    GlobalObjectSet debuggees;          /* Debuggee globals. Cross-compartment weak references. */
@ -321,6 +321,7 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
    static bool setOnNewGlobalObject(JSContext *cx, unsigned argc, Value *vp);
    static bool getUncaughtExceptionHook(JSContext *cx, unsigned argc, Value *vp);
    static bool setUncaughtExceptionHook(JSContext *cx, unsigned argc, Value *vp);
+    static bool getMemory(JSContext *cx, unsigned argc, Value *vp);
    static bool addDebuggee(JSContext *cx, unsigned argc, Value *vp);
    static bool addAllGlobalsAsDebuggees(JSContext *cx, unsigned argc, Value *vp);
    static bool removeDebuggee(JSContext *cx, unsigned argc, Value *vp);
--- a/js/src/vm/DebuggerMemory.cpp
+++ b/js/src/vm/DebuggerMemory.cpp
@ -0,0 +1,47 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "vm/DebuggerMemory.h"
+
+namespace js {
+
+/* static */ bool
+DebuggerMemory::construct(JSContext *cx, unsigned argc, Value *vp)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_NO_CONSTRUCTOR,
+                         "Debugger.Memory");
+    return false;
+}
+
+/* static */ const Class DebuggerMemory::class_ = {
+    "Memory",
+    JSCLASS_HAS_PRIVATE | JSCLASS_IMPLEMENTS_BARRIERS |
+    JSCLASS_HAS_RESERVED_SLOTS(JSSLOT_DEBUGGER_MEMORY_COUNT),
+
+    JS_PropertyStub,       // addProperty
+    JS_DeletePropertyStub, // delProperty
+    JS_PropertyStub,       // getProperty
+    JS_StrictPropertyStub, // setProperty
+    JS_EnumerateStub,      // enumerate
+    JS_ResolveStub,        // resolve
+    JS_ConvertStub,        // convert
+
+    nullptr, // finalize
+    nullptr, // call
+    nullptr, // hasInstance
+    nullptr, // construct
+    nullptr  // trace
+};
+
+/* static */ const JSPropertySpec DebuggerMemory::properties[] = {
+    JS_PS_END
+};
+
+/* static */ const JSFunctionSpec DebuggerMemory::methods[] = {
+    JS_FS_END
+};
+
+} /* namespace js */
--- a/js/src/vm/DebuggerMemory.h
+++ b/js/src/vm/DebuggerMemory.h
@ -0,0 +1,34 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef vm_DebuggerMemory_h
+#define vm_DebuggerMemory_h
+
+#include "jsapi.h"
+#include "jscntxt.h"
+#include "jsobj.h"
+#include "js/Class.h"
+#include "js/Value.h"
+
+namespace js {
+
+class DebuggerMemory : public JSObject {
+    enum {
+        JSSLOT_DEBUGGER_MEMORY_COUNT
+    };
+
+public:
+
+    static bool construct(JSContext *cx, unsigned argc, Value *vp);
+
+    static const Class          class_;
+    static const JSPropertySpec properties[];
+    static const JSFunctionSpec methods[];
+};
+
+} /* namespace js */
+
+#endif /* vm_DebuggerMemory_h */
--- a/js/xpconnect/src/Sandbox.cpp
+++ b/js/xpconnect/src/Sandbox.cpp
@ -31,6 +31,7 @@
 #include "XrayWrapper.h"
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/indexedDB/IndexedDatabaseManager.h"
+#include "mozilla/dom/PromiseBinding.h"
 #include "mozilla/dom/TextDecoderBinding.h"
 #include "mozilla/dom/TextEncoderBinding.h"
 #include "mozilla/dom/URLBinding.h"
@ -974,6 +975,7 @@ xpc::GlobalProperties::Parse(JSContext *cx, JS::HandleObject obj)
    uint32_t length;
    bool ok = JS_GetArrayLength(cx, obj, &length);
    NS_ENSURE_TRUE(ok, false);
+    bool promise = Promise;
    for (uint32_t i = 0; i < length; i++) {
        RootedValue nameValue(cx);
        ok = JS_GetElement(cx, obj, i, &nameValue);
@ -984,7 +986,9 @@ xpc::GlobalProperties::Parse(JSContext *cx, JS::HandleObject obj)
        }
        JSAutoByteString name(cx, nameValue.toString());
        NS_ENSURE_TRUE(name, false);
-        if (!strcmp(name.ptr(), "indexedDB")) {
+        if (promise && !strcmp(name.ptr(), "-Promise")) {
+            Promise = false;
+        } else if (!strcmp(name.ptr(), "indexedDB")) {
            indexedDB = true;
        } else if (!strcmp(name.ptr(), "XMLHttpRequest")) {
            XMLHttpRequest = true;
@ -1009,6 +1013,9 @@ xpc::GlobalProperties::Parse(JSContext *cx, JS::HandleObject obj)
 bool
 xpc::GlobalProperties::Define(JSContext *cx, JS::HandleObject obj)
 {
+    if (Promise && !dom::PromiseBinding::GetConstructorObject(cx, obj))
+        return false;
+
    if (indexedDB && AccessCheck::isChrome(obj) &&
        !IndexedDatabaseManager::DefineIndexedDB(cx, obj))
        return false;
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@ -2756,7 +2756,7 @@ nsXPCComponents_Utils::ImportGlobalProperties(HandleValue aPropertyList,
 {
    RootedObject global(cx, CurrentGlobalOrNull(cx));
    MOZ_ASSERT(global);
-    GlobalProperties options;
+    GlobalProperties options(false);
    NS_ENSURE_TRUE(aPropertyList.isObject(), NS_ERROR_INVALID_ARG);
    RootedObject propertyList(cx, &aPropertyList.toObject());
    NS_ENSURE_TRUE(JS_IsArrayObject(cx, propertyList), NS_ERROR_INVALID_ARG);
--- a/js/xpconnect/src/nsXPConnect.cpp
+++ b/js/xpconnect/src/nsXPConnect.cpp
@ -30,7 +30,7 @@

 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/Exceptions.h"
-#include "mozilla/dom/indexedDB/IndexedDatabaseManager.h"
+#include "mozilla/dom/PromiseBinding.h"
 #include "mozilla/dom/TextDecoderBinding.h"
 #include "mozilla/dom/TextEncoderBinding.h"
 #include "mozilla/dom/DOMErrorBinding.h"
@ -47,8 +47,6 @@ using namespace mozilla::dom;
 using namespace xpc;
 using namespace JS;

-using mozilla::dom::indexedDB::IndexedDatabaseManager;
-
 NS_IMPL_ISUPPORTS4(nsXPConnect,
                   nsIXPConnect,
                   nsISupportsWeakReference,
@ -453,7 +451,8 @@ nsXPConnect::InitClassesWithNewWrappedGlobal(JSContext * aJSContext,
    //
    // XXX Please do not add any additional classes here without the approval of
    //     the XPConnect module owner.
-    if (!TextDecoderBinding::GetConstructorObject(aJSContext, global) ||
+    if (!PromiseBinding::GetConstructorObject(aJSContext, global) ||
+        !TextDecoderBinding::GetConstructorObject(aJSContext, global) ||
        !TextEncoderBinding::GetConstructorObject(aJSContext, global) ||
        !DOMErrorBinding::GetConstructorObject(aJSContext, global)) {
        return UnexpectedFailure(NS_ERROR_FAILURE);
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@ -3289,9 +3289,13 @@ nsresult
 ThrowAndFail(nsresult errNum, JSContext *cx, bool *retval);

 struct GlobalProperties {
-    GlobalProperties() { mozilla::PodZero(this); }
+    GlobalProperties(bool aPromise) {
+      mozilla::PodZero(this);
+      Promise = true;
+    }
    bool Parse(JSContext *cx, JS::HandleObject obj);
    bool Define(JSContext *cx, JS::HandleObject obj);
+    bool Promise : 1;
    bool indexedDB : 1;
    bool XMLHttpRequest : 1;
    bool TextDecoder : 1;
@ -3342,6 +3346,7 @@ public:
        , proto(cx)
        , sameZoneAs(cx)
        , invisibleToDebugger(false)
+        , globalProperties(true)
        , metadata(cx)
    { }

--- a/js/xpconnect/tests/unit/test_promise.js
+++ b/js/xpconnect/tests/unit/test_promise.js
@ -0,0 +1,12 @@
+function run_test() {
+  var Cu = Components.utils;
+  sb = new Cu.Sandbox('http://www.example.com');
+  sb.do_check_eq = do_check_eq;
+  Cu.evalInSandbox('do_check_eq(typeof new Promise(function(resolve){resolve();}), "object");',
+                   sb);
+  sb = new Cu.Sandbox('http://www.example.com',
+                      { wantGlobalProperties: ["-Promise"] });
+  sb.do_check_eq = do_check_eq;
+  Cu.evalInSandbox('do_check_eq(typeof Promise, "undefined");', sb);
+  do_check_eq(typeof new Promise(function(resolve){resolve();}), "object");
+}
--- a/js/xpconnect/tests/unit/xpcshell.ini
+++ b/js/xpconnect/tests/unit/xpcshell.ini
@ -70,6 +70,7 @@ fail-if = os == "android"
 [test_nuke_sandbox.js]
 [test_sandbox_metadata.js]
 [test_exportFunction.js]
+[test_promise.js]
 [test_textDecoder.js]
 [test_url.js]
 [test_sandbox_atob.js]
--- a/layout/base/tests/mochitest.ini
+++ b/layout/base/tests/mochitest.ini
@ -53,6 +53,7 @@ support-files =

 [test_preserve3d_sorting_hit_testing.html]
 [test_after_paint_pref.html]
+skip-if = e10s
 [test_border_radius_hit_testing.html]
 [test_bug66619.html]
 [test_bug93077-1.html]
@ -453,7 +454,7 @@ skip-if = (buildapp == 'b2g' && toolkit != 'gonk') || toolkit == "win" #times ou
 [test_bug570378-persian-5g.html]
 skip-if = (buildapp == 'b2g' && toolkit != 'gonk') || toolkit == "win" #times out
 [test_bug749186.html]
-skip-if = toolkit == "win"
+skip-if = toolkit == "win" || e10s
 [test_bug644768.html]
 skip-if = toolkit == "win"
 [test_flush_on_paint.html]
--- a/layout/inspector/inDOMUtils.cpp
+++ b/layout/inspector/inDOMUtils.cpp
@ -641,7 +641,7 @@ inDOMUtils::ColorNameToRGB(const nsAString& aColorName, JSContext* aCx,
  triple.mG = NS_GET_G(color);
  triple.mB = NS_GET_B(color);

-  if (!triple.ToObject(aCx, JS::NullPtr(), aValue)) {
+  if (!triple.ToObject(aCx, aValue)) {
    return NS_ERROR_FAILURE;
  }

--- a/layout/reftests/reftest.list
+++ b/layout/reftests/reftest.list
@ -357,7 +357,7 @@ include ../../editor/reftests/reftest.list
 include box-sizing/reftest.list

 # invalidation - only run on B2G
-skip-if(!B2G) include invalidation/reftest.list
+include invalidation/reftest.list

 # encodings
 include ../../dom/encoding/test/reftest/reftest.list
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1a.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1a.xhtml
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1b.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1b.xhtml
@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!-- Testcase for behavior of the 'baseline' value for align-items (and
+     align-self, implicitly). This test baseline-aligns various types of
+     content, and the flexbox's vertical size depends on the aggregate
+     post-alignment height of its children. This test also uses
+     "flex-wrap: wrap-reverse" to make the cross-axis bottom-to-top instead
+     of top-to-bottom.
+-->
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self' in a wrap-reverse flex container</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
+    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="match" href="flexbox-align-self-baseline-horiz-1-ref.xhtml"/>
+    <style>
+      .flexbox {
+        display: flex;
+        align-items: baseline;
+        flex-wrap: wrap-reverse;
+        border: 1px dashed blue;
+        font: 14px sans-serif;
+      }
+
+      .big {
+        height: 100px;
+        font: 24px sans-serif;
+        margin-top: 20px;
+      }
+      .super {
+        vertical-align: super;
+        font-size: 12px;
+      }
+      .sub {
+        vertical-align: sub;
+        font-size: 12px;
+      }
+
+      .lime   { background: lime;   }
+      .yellow { background: yellow; }
+      .orange { background: orange; }
+      .pink   { background: pink;   }
+      .aqua   { background: aqua;   }
+      .tan    { background: tan;    }
+   </style>
+  </head>
+  <body>
+    <div class="flexbox">
+      <div class="lime">blk_1line</div>
+      <div class="yellow">blk<br/>2lines</div>
+      <div class="orange"><span class="super">super</span></div>
+      <div class="pink"><span class="sub">sub</span></div>
+      <div class="aqua big">big<br/>text<br/>3lines</div>
+      <i class="tan">ital<br/>ic</i>
+    </div>
+  </body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2-ref.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2-ref.xhtml
@ -3,54 +3,80 @@
     Any copyright is dedicated to the Public Domain.
     http://creativecommons.org/publicdomain/zero/1.0/
 -->
-<!-- Reference case for behavior of the 'baseline' value for align-items and
-     align-self, in a multi-line flex container.
-
-     This reference case just consists of three single-line flex containers,
-     to match the testcase's one flex container with three flex lines.
-->
 <html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <title>CSS Reftest Reference</title>
    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
    <style>
      .flexbox {
-        display: flex;
-        align-items: baseline;
-        width: 90px;
+        width: 40px;
+        height: 40px;
+        border: 1px solid gray;
+        margin: 5px; /* just for visual separation */
+        float: left;
      }

      .flexbox > * {
-        width: 28px;
        background: yellow;
        border: 1px solid black;
+        height: 20px;
      }
-
-      .big    { font: 24px sans-serif; }
-      .medium { font: 14px sans-serif; }
-      .small  { font: 8px sans-serif;  }
-
   </style>
  </head>
  <body>
+    <!-- ZEROTH ROW: NO MARGINS -->
+    <!-- No margins on flex item: -->
    <div class="flexbox">
-      <!-- First flex line: Just 3 different sizes of text -->
-      <div class="big">a</div>
-      <div class="small">b</div>
-      <div class="medium">c</div>
+      <div>a</div>
    </div>
+
+
+    <!-- FIRST ROW: SETTING MARGIN-TOP: -->
+    <br style="clear: both"/>
+
+    <!-- auto: -->
    <div class="flexbox">
-      <!-- Second flex line: different margin/padding amounts on each item,
-           and one non-baseline-aligned item.-->
-      <div class="medium" style="padding-top: 10px">d</div>
-      <div class="medium" style="margin-bottom: 8px">e</div>
-      <div class="medium" style="align-self: stretch">f</div>
+      <div style="margin-top: 18px">a</div>
    </div>
+
+    <!-- Negative: -->
    <div class="flexbox">
-      <!-- Third flex line: other margin/padding amounts on each item -->
-      <div class="small" style="margin-top: 20px">g</div>
-      <div class="big">h</div>
-      <div class="medium" style="padding-bottom: 6px">i</div>
+      <div style="margin-top: -4px">a</div>
    </div>
+
+    <!-- Small: -->
+    <div class="flexbox">
+      <div style="margin-top: 4px">a</div>
+    </div>
+
+    <!-- Large (pushing us out of container): -->
+    <div class="flexbox">
+      <div style="margin-top: 25px">a</div>
+    </div>
+
+
+    <!-- SECOND ROW: SETTING MARGIN-BOTTOM: -->
+    <br style="clear: both"/>
+
+    <!-- auto: -->
+    <div class="flexbox">
+      <div>a</div>
+    </div>
+
+    <!-- Negative: -->
+    <div class="flexbox">
+      <div>a</div>
+    </div>
+
+    <!-- Small: -->
+    <div class="flexbox">
+      <div>a</div>
+    </div>
+
+    <!-- Large: -->
+    <div class="flexbox">
+      <div>a</div>
+    </div>
+
  </body>
 </html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2.xhtml
@ -3,54 +3,88 @@
     Any copyright is dedicated to the Public Domain.
     http://creativecommons.org/publicdomain/zero/1.0/
 -->
-<!-- Testcase for behavior of the 'baseline' value for align-items (and
-     align-self, implicitly), in a multi-line flex container.
-     This test baseline-aligns variously-sized flex items, and the container's
-     vertical size depends on the aggregate post-alignment height of its items.
+<!-- Testcase for how a baseline-aligned flex item's position is impacted by
+     cross-axis margins, in a fixed-size flex container.
  -->
 <html xmlns="http://www.w3.org/1999/xhtml">
  <head>
-    <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self' in a multi-line flex container</title>
+    <title>CSS Test: Baseline alignment of flex items in fixed-size single-line flex container</title>
    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
    <link rel="match" href="flexbox-align-self-baseline-horiz-2-ref.xhtml"/>
    <style>
      .flexbox {
        display: flex;
-        flex-wrap: wrap;
        align-items: baseline;
-        width: 90px;
+        width: 40px;
+        height: 40px;
+        border: 1px solid gray;
+        margin: 5px; /* just for visual separation */
+        float: left;
      }

      .flexbox > * {
-        width: 28px; /* 3 items per Flex Line */
        background: yellow;
        border: 1px solid black;
+        height: 20px;
+        flex: 1;
      }
-
-      .big    { font: 24px sans-serif; }
-      .medium { font: 14px sans-serif; }
-      .small  { font: 8px sans-serif;  }
-
   </style>
  </head>
  <body>
+    <!-- ZEROTH ROW: NO MARGINS -->
+    <!-- No margins on flex item: -->
    <div class="flexbox">
-      <!-- First flex line: Just 3 different sizes of text -->
-      <div class="big">a</div>
-      <div class="small">b</div>
-      <div class="medium">c</div>
-
-      <!-- Second flex line: different margin/padding amounts on each item,
-           and one non-baseline-aligned item.-->
-      <div class="medium" style="padding-top: 10px">d</div>
-      <div class="medium" style="margin-bottom: 8px">e</div>
-      <div class="medium" style="align-self: stretch">f</div>
-
-      <!-- Third flex line: other margin/padding amounts on each item -->
-      <div class="small" style="margin-top: 20px">g</div>
-      <div class="big">h</div>
-      <div class="medium" style="padding-bottom: 6px">i</div>
+      <div>a</div>
    </div>
+
+
+    <!-- FIRST ROW: SETTING MARGIN-TOP: -->
+    <br style="clear: both"/>
+
+    <!-- auto: -->
+    <div class="flexbox">
+      <div style="margin-top: auto">a</div>
+    </div>
+
+    <!-- Negative: -->
+    <div class="flexbox">
+      <div style="margin-top: -4px">a</div>
+    </div>
+
+    <!-- Small: -->
+    <div class="flexbox">
+      <div style="margin-top: 4px">a</div>
+    </div>
+
+    <!-- Large (pushing us out of container): -->
+    <div class="flexbox">
+      <div style="margin-top: 25px">a</div>
+    </div>
+
+
+    <!-- SECOND ROW: SETTING MARGIN-BOTTOM: -->
+    <br style="clear: both"/>
+
+    <!-- auto: -->
+    <div class="flexbox">
+      <div style="margin-bottom: auto">a</div>
+    </div>
+
+    <!-- Negative: -->
+    <div class="flexbox">
+      <div style="margin-bottom: -4px">a</div>
+    </div>
+
+    <!-- Small: -->
+    <div class="flexbox">
+      <div style="margin-bottom: 4px">a</div>
+    </div>
+
+    <!-- Large: -->
+    <div class="flexbox">
+      <div style="margin-bottom: 25px">a</div>
+    </div>
+
  </body>
 </html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3-ref.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3-ref.xhtml
@ -3,56 +3,80 @@
     Any copyright is dedicated to the Public Domain.
     http://creativecommons.org/publicdomain/zero/1.0/
 -->
-<!-- Reference case for behavior of the 'baseline' value for align-items and
-     align-self, in a multi-line flex container.
-
-     This reference case just consists of three single-line flex containers,
-     to match the testcase's one flex container with three flex lines.
-->
 <html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <title>CSS Reftest Reference</title>
    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
    <style>
      .flexbox {
-        display: flex;
-        align-items: baseline;
-        width: 90px;
+        width: 40px;
+        height: 40px;
+        border: 1px solid gray;
+        margin: 5px; /* just for visual separation */
+        float: left;
      }

      .flexbox > * {
-        width: 28px;
        background: yellow;
        border: 1px solid black;
+        height: 20px;
      }
-
-      .big    { font: 24px sans-serif; }
-      .medium { font: 14px sans-serif; }
-      .small  { font: 8px sans-serif;  }
-
   </style>
  </head>
  <body>
-    <!-- Note: The lines are reversed here with respect to the testcase,
-         due to the testcase's "wrap-reverse". -->
+    <!-- ZEROTH ROW: NO MARGINS -->
+    <!-- No margins on flex item: -->
    <div class="flexbox">
-      <!-- Third flex line: other margin/padding amounts on each item -->
-      <div class="small" style="margin-top: 20px">g</div>
-      <div class="big">h</div>
-      <div class="medium" style="padding-bottom: 6px">i</div>
+      <div style="margin-top: 18px">a</div>
    </div>
+
+
+    <!-- FIRST ROW: SETTING MARGIN-TOP: -->
+    <br style="clear: both"/>
+
+    <!-- auto: -->
    <div class="flexbox">
-      <!-- Second flex line: different margin/padding amounts on each item,
-           and one non-baseline-aligned item.-->
-      <div class="medium" style="padding-top: 10px">d</div>
-      <div class="medium" style="margin-bottom: 8px">e</div>
-      <div class="medium" style="align-self: stretch">f</div>
+      <div style="margin-top: 18px">a</div>
    </div>
+
+    <!-- Negative: -->
    <div class="flexbox">
-      <!-- First flex line: Just 3 different sizes of text -->
-      <div class="big">a</div>
-      <div class="small">b</div>
-      <div class="medium">c</div>
+      <div style="margin-top: 18px">a</div>
    </div>
+
+    <!-- Small: -->
+    <div class="flexbox">
+      <div style="margin-top: 18px">a</div>
+    </div>
+
+    <!-- Large (pushing us out of container): -->
+    <div class="flexbox">
+      <div style="margin-top: 18px">a</div>
+    </div>
+
+
+    <!-- SECOND ROW: SETTING MARGIN-BOTTOM: -->
+    <br style="clear: both"/>
+
+    <!-- auto: -->
+    <div class="flexbox">
+      <div>a</div>
+    </div>
+
+    <!-- Negative: -->
+    <div class="flexbox">
+      <div style="margin-top: 22px">a</div>
+    </div>
+
+    <!-- Small: -->
+    <div class="flexbox">
+      <div style="margin-top: 14px">a</div>
+    </div>
+
+    <!-- Large: -->
+    <div class="flexbox">
+      <div style="margin-top: -7px">a</div>
+    </div>
+
  </body>
 </html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3.xhtml
@ -3,54 +3,90 @@
     Any copyright is dedicated to the Public Domain.
     http://creativecommons.org/publicdomain/zero/1.0/
 -->
-<!-- Testcase for behavior of the 'baseline' value for align-items (and
-     align-self, implicitly), in a wrap-reverse multi-line flex container.
-     This test baseline-aligns variously-sized flex items, and the container's
-     vertical size depends on the aggregate post-alignment height of its items.
+<!-- Testcase for how a baseline-aligned flex item's position is impacted by
+     cross-axis margins, in a fixed-size flex container with the cross axis
+     reversed via "flex-wrap: wrap-reverse".
  -->
 <html xmlns="http://www.w3.org/1999/xhtml">
  <head>
-    <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self' in a multi-line flex container</title>
+    <title>CSS Test: Baseline alignment of flex items in fixed-size single-line flex container, with cross axis reversed</title>
    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
    <link rel="match" href="flexbox-align-self-baseline-horiz-3-ref.xhtml"/>
    <style>
      .flexbox {
        display: flex;
-        flex-wrap: wrap-reverse;
        align-items: baseline;
-        width: 90px;
+        flex-wrap: wrap-reverse; /* Just to flip cross-axis */
+        width: 40px;
+        height: 40px;
+        border: 1px solid gray;
+        margin: 5px; /* just for visual separation */
+        float: left;
      }

      .flexbox > * {
-        width: 28px; /* 3 items per Flex Line */
        background: yellow;
        border: 1px solid black;
+        height: 20px;
+        flex: 1;
      }
-
-      .big    { font: 24px sans-serif; }
-      .medium { font: 14px sans-serif; }
-      .small  { font: 8px sans-serif;  }
-
   </style>
  </head>
  <body>
+    <!-- ZEROTH ROW: NO MARGINS -->
+    <!-- No margins on flex item: -->
    <div class="flexbox">
-      <!-- First flex line: Just 3 different sizes of text -->
-      <div class="big">a</div>
-      <div class="small">b</div>
-      <div class="medium">c</div>
-
-      <!-- Second flex line: different margin/padding amounts on each item,
-           and one non-baseline-aligned item.-->
-      <div class="medium" style="padding-top: 10px">d</div>
-      <div class="medium" style="margin-bottom: 8px">e</div>
-      <div class="medium" style="align-self: stretch">f</div>
-
-      <!-- Third flex line: other margin/padding amounts on each item -->
-      <div class="small" style="margin-top: 20px">g</div>
-      <div class="big">h</div>
-      <div class="medium" style="padding-bottom: 6px">i</div>
+      <div>a</div>
    </div>
+
+
+    <!-- FIRST ROW: SETTING MARGIN-TOP: -->
+    <br style="clear: both"/>
+
+    <!-- auto: -->
+    <div class="flexbox">
+      <div style="margin-top: auto">a</div>
+    </div>
+
+    <!-- Negative: -->
+    <div class="flexbox">
+      <div style="margin-top: -4px">a</div>
+    </div>
+
+    <!-- Small: -->
+    <div class="flexbox">
+      <div style="margin-top: 4px">a</div>
+    </div>
+
+    <!-- Large (pushing us out of container): -->
+    <div class="flexbox">
+      <div style="margin-top: 25px">a</div>
+    </div>
+
+
+    <!-- SECOND ROW: SETTING MARGIN-BOTTOM: -->
+    <br style="clear: both"/>
+
+    <!-- auto: -->
+    <div class="flexbox">
+      <div style="margin-bottom: auto">a</div>
+    </div>
+
+    <!-- Negative: -->
+    <div class="flexbox">
+      <div style="margin-bottom: -4px">a</div>
+    </div>
+
+    <!-- Small: -->
+    <div class="flexbox">
+      <div style="margin-bottom: 4px">a</div>
+    </div>
+
+    <!-- Large: -->
+    <div class="flexbox">
+      <div style="margin-bottom: 25px">a</div>
+    </div>
+
  </body>
 </html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-4-ref.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-4-ref.xhtml
@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!-- Reference case for behavior of the 'baseline' value for align-items and
+     align-self, in a multi-line flex container.
+
+     This reference case just consists of three single-line flex containers,
+     to match the testcase's one flex container with three flex lines.
+-->
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
+    <style>
+      .flexbox {
+        display: flex;
+        align-items: baseline;
+        width: 90px;
+      }
+
+      .flexbox > * {
+        width: 28px;
+        background: yellow;
+        border: 1px solid black;
+      }
+
+      .big    { font: 24px sans-serif; }
+      .medium { font: 14px sans-serif; }
+      .small  { font: 8px sans-serif;  }
+
+   </style>
+  </head>
+  <body>
+    <div class="flexbox">
+      <!-- First flex line: Just 3 different sizes of text -->
+      <div class="big">a</div>
+      <div class="small">b</div>
+      <div class="medium">c</div>
+    </div>
+    <div class="flexbox">
+      <!-- Second flex line: different margin/padding amounts on each item,
+           and one non-baseline-aligned item.-->
+      <div class="medium" style="padding-top: 10px">d</div>
+      <div class="medium" style="margin-bottom: 8px">e</div>
+      <div class="medium" style="align-self: stretch">f</div>
+    </div>
+    <div class="flexbox">
+      <!-- Third flex line: other margin/padding amounts on each item -->
+      <div class="small" style="margin-top: 20px">g</div>
+      <div class="big">h</div>
+      <div class="medium" style="padding-bottom: 6px">i</div>
+    </div>
+  </body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-4.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-4.xhtml
@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!-- Testcase for behavior of the 'baseline' value for align-items (and
+     align-self, implicitly), in a multi-line flex container.
+     This test baseline-aligns variously-sized flex items, and the container's
+     vertical size depends on the aggregate post-alignment height of its items.
+  -->
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self' in a multi-line flex container</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
+    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="match" href="flexbox-align-self-baseline-horiz-4-ref.xhtml"/>
+    <style>
+      .flexbox {
+        display: flex;
+        flex-wrap: wrap;
+        align-items: baseline;
+        width: 90px;
+      }
+
+      .flexbox > * {
+        width: 28px; /* 3 items per Flex Line */
+        background: yellow;
+        border: 1px solid black;
+      }
+
+      .big    { font: 24px sans-serif; }
+      .medium { font: 14px sans-serif; }
+      .small  { font: 8px sans-serif;  }
+
+   </style>
+  </head>
+  <body>
+    <div class="flexbox">
+      <!-- First flex line: Just 3 different sizes of text -->
+      <div class="big">a</div>
+      <div class="small">b</div>
+      <div class="medium">c</div>
+
+      <!-- Second flex line: different margin/padding amounts on each item,
+           and one non-baseline-aligned item.-->
+      <div class="medium" style="padding-top: 10px">d</div>
+      <div class="medium" style="margin-bottom: 8px">e</div>
+      <div class="medium" style="align-self: stretch">f</div>
+
+      <!-- Third flex line: other margin/padding amounts on each item -->
+      <div class="small" style="margin-top: 20px">g</div>
+      <div class="big">h</div>
+      <div class="medium" style="padding-bottom: 6px">i</div>
+    </div>
+  </body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-5-ref.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-5-ref.xhtml
@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!-- Reference case for behavior of the 'baseline' value for align-items and
+     align-self, in a multi-line flex container.
+
+     This reference case just consists of three single-line flex containers,
+     to match the testcase's one flex container with three flex lines.
+-->
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
+    <style>
+      .flexbox {
+        display: flex;
+        align-items: baseline;
+        width: 90px;
+      }
+
+      .flexbox > * {
+        width: 28px;
+        background: yellow;
+        border: 1px solid black;
+      }
+
+      .big    { font: 24px sans-serif; }
+      .medium { font: 14px sans-serif; }
+      .small  { font: 8px sans-serif;  }
+
+   </style>
+  </head>
+  <body>
+    <!-- Note: The lines are reversed here with respect to the testcase,
+         due to the testcase's "wrap-reverse". -->
+    <div class="flexbox">
+      <!-- Third flex line: other margin/padding amounts on each item -->
+      <div class="small" style="margin-top: 20px">g</div>
+      <div class="big">h</div>
+      <div class="medium" style="padding-bottom: 6px">i</div>
+    </div>
+    <div class="flexbox">
+      <!-- Second flex line: different margin/padding amounts on each item,
+           and one non-baseline-aligned item.-->
+      <div class="medium" style="padding-top: 10px">d</div>
+      <div class="medium" style="margin-bottom: 8px">e</div>
+      <div class="medium" style="align-self: stretch">f</div>
+    </div>
+    <div class="flexbox">
+      <!-- First flex line: Just 3 different sizes of text -->
+      <div class="big">a</div>
+      <div class="small">b</div>
+      <div class="medium">c</div>
+    </div>
+  </body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-5.xhtml
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-5.xhtml
@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!-- Testcase for behavior of the 'baseline' value for align-items (and
+     align-self, implicitly), in a wrap-reverse multi-line flex container.
+     This test baseline-aligns variously-sized flex items, and the container's
+     vertical size depends on the aggregate post-alignment height of its items.
+  -->
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self' in a multi-line flex container</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
+    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="match" href="flexbox-align-self-baseline-horiz-5-ref.xhtml"/>
+    <style>
+      .flexbox {
+        display: flex;
+        flex-wrap: wrap-reverse;
+        align-items: baseline;
+        width: 90px;
+      }
+
+      .flexbox > * {
+        width: 28px; /* 3 items per Flex Line */
+        background: yellow;
+        border: 1px solid black;
+      }
+
+      .big    { font: 24px sans-serif; }
+      .medium { font: 14px sans-serif; }
+      .small  { font: 8px sans-serif;  }
+
+   </style>
+  </head>
+  <body>
+    <div class="flexbox">
+      <!-- First flex line: Just 3 different sizes of text -->
+      <div class="big">a</div>
+      <div class="small">b</div>
+      <div class="medium">c</div>
+
+      <!-- Second flex line: different margin/padding amounts on each item,
+           and one non-baseline-aligned item.-->
+      <div class="medium" style="padding-top: 10px">d</div>
+      <div class="medium" style="margin-bottom: 8px">e</div>
+      <div class="medium" style="align-self: stretch">f</div>
+
+      <!-- Third flex line: other margin/padding amounts on each item -->
+      <div class="small" style="margin-top: 20px">g</div>
+      <div class="big">h</div>
+      <div class="medium" style="padding-bottom: 6px">i</div>
+    </div>
+  </body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-1.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-1.html
@ -5,7 +5,7 @@
 -->
 <html>
 <head>
-  <title>CSS Test: Testing all the values of the "flex-flow" shorthand property</title>
+  <title>CSS Test: Testing all the values of the "flex-flow" shorthand property, with 4 flex items in each container</title>
  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-flow-property">
  <link rel="match" href="flexbox-flex-flow-1-ref.html">
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-2-ref.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-2-ref.html
@ -0,0 +1,133 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      height: 60px;
+      width: 60px;
+      font: 10px sans-serif;
+      background: yellow;
+      float: left;
+      border: 1px solid black;
+    }
+    .flexContainer > * {
+      border: 1px dotted gray;
+      width: 28px;
+      height: 28px;
+      float: left;
+    }
+
+    /* The single-line flex containers' flex items are shrunk in main axis: */
+    .singleLineHoriz > * {
+      width: 18px;
+    }
+    .singleLineVert  > * {
+      height: 18px;
+      float: none;
+    }
+    .hidden {
+      /* We use this to hide the "4" box in each of the multi-line chunks.
+         The testcase has 3 flex items in each flex container, but it's easier
+         to write this reference case w/ a hidden 4th box as a space-filler. */
+      visibility: hidden;
+    }
+  </style>
+</head>
+<body>
+  <!-- single-line (flex-wrap unspecified): -->
+  <div class="flexContainer singleLineHoriz"><!-- flex-flow: row -->
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer singleLineHoriz"><!-- flex-flow: row-reverse -->
+    <div>3</div><div>2</div><div>1</div>
+  </div>
+  <div class="flexContainer singleLineVert"><!-- flex-flow: column -->
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer singleLineVert"><!-- flex-flow: column-reverse -->
+    <div>3</div><div>2</div><div>1</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap", after flex-direction: -->
+  <div class="flexContainer"><!-- flex-flow: row wrap -->
+    <div>1</div><div>2</div><div>3</div><div class="hidden">4</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: row-reverse wrap -->
+    <div>2</div><div>1</div><div class="hidden">4</div><div>3</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: column wrap -->
+    <div>1</div><div>3</div><div>2</div><div class="hidden">4</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: column-reverse wrap -->
+    <div>2</div><div class="hidden">4</div><div>1</div><div>3</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap", before flex-direction: -->
+  <div class="flexContainer"><!-- flex-flow: wrap row -->
+    <div>1</div><div>2</div><div>3</div><div class="hidden">4</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap row-reverse -->
+    <div>2</div><div>1</div><div class="hidden">4</div><div>3</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap column -->
+    <div>1</div><div>3</div><div>2</div><div class="hidden">4</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap column-reverse -->
+    <div>2</div><div class="hidden">4</div><div>1</div><div>3</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap-reverse", after flex-direction: -->
+  <div class="flexContainer"><!-- flex-flow: row wrap-reverse -->
+    <div>3</div><div class="hidden">4</div><div>1</div><div>2</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: row-reverse wrap-reverse -->
+    <div class="hidden">4</div><div>3</div><div>2</div><div>1</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: column wrap-reverse -->
+    <div>3</div><div>1</div><div class="hidden">4</div><div>2</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: column-reverse wrap-reverse -->
+    <div class="hidden">4</div><div>2</div><div>3</div><div>1</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap-reverse", before flex-direction: -->
+  <div class="flexContainer"><!-- flex-flow: wrap-reverse row -->
+    <div>3</div><div class="hidden">4</div><div>1</div><div>2</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap-reverse row-reverse -->
+    <div class="hidden">4</div><div>3</div><div>2</div><div>1</div>
+  </div>
+  <div class="flexContainer"> <!-- flex-flow: wrap-reverse column -->
+    <div>3</div><div>1</div><div class="hidden">4</div><div>2</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap-reverse column-reverse -->
+    <div class="hidden">4</div><div>2</div><div>3</div><div>1</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now just specifying flex-wrap (no flex-direction) -->
+  <div class="flexContainer"><!-- flex-flow: wrap -->
+    <div>1</div><div>2</div><div>3</div><div class="hidden">4</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap-reverse -->
+    <div>3</div><div class="hidden">4</div><div>1</div><div>2</div>
+  </div>
+
+</body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-2.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-2.html
@ -0,0 +1,120 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Test: Testing all the values of the "flex-flow" shorthand property, with 3 flex items in each container</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-flow-property">
+  <link rel="match" href="flexbox-flex-flow-2-ref.html">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      display: flex;
+      height: 60px;
+      width: 60px;
+      font: 10px sans-serif;
+      background: yellow;
+      float: left;
+      border: 1px solid black;
+    }
+    .flexContainer > * {
+      border: 1px dotted gray;
+      width: 28px;
+      height: 28px;
+    }
+  </style>
+</head>
+<body>
+  <!-- single-line (flex-wrap unspecified): -->
+  <div class="flexContainer" style="flex-flow: row">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: row-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap", after flex-direction: -->
+  <div class="flexContainer" style="flex-flow: row wrap">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: row-reverse wrap">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column wrap">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column-reverse wrap">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap", before flex-direction: -->
+  <div class="flexContainer" style="flex-flow: wrap row">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap row-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap column">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap column-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap-reverse", after flex-direction: -->
+  <div class="flexContainer" style="flex-flow: row wrap-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: row-reverse wrap-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column wrap-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column-reverse wrap-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap-reverse", before flex-direction: -->
+  <div class="flexContainer" style="flex-flow: wrap-reverse row">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap-reverse row-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap-reverse column">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap-reverse column-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now just specifying flex-wrap (no flex-direction) -->
+  <div class="flexContainer" style="flex-flow: wrap">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap-reverse">
+    <div>1</div><div>2</div><div>3</div>
+  </div>
+
+</body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/reftest.list
+++ b/layout/reftests/w3c-css/submitted/flexbox/reftest.list
@ -12,9 +12,12 @@
 == flexbox-align-content-vert-1b.xhtml  flexbox-align-content-vert-1-ref.xhtml

 # Tests for cross-axis alignment (align-self / align-items properties)
-== flexbox-align-self-baseline-horiz-1.xhtml flexbox-align-self-baseline-horiz-1-ref.xhtml
+== flexbox-align-self-baseline-horiz-1a.xhtml flexbox-align-self-baseline-horiz-1-ref.xhtml
+== flexbox-align-self-baseline-horiz-1b.xhtml flexbox-align-self-baseline-horiz-1-ref.xhtml
 == flexbox-align-self-baseline-horiz-2.xhtml flexbox-align-self-baseline-horiz-2-ref.xhtml
 == flexbox-align-self-baseline-horiz-3.xhtml flexbox-align-self-baseline-horiz-3-ref.xhtml
+== flexbox-align-self-baseline-horiz-4.xhtml flexbox-align-self-baseline-horiz-4-ref.xhtml
+== flexbox-align-self-baseline-horiz-5.xhtml flexbox-align-self-baseline-horiz-5-ref.xhtml

 == flexbox-align-self-stretch-vert-1.html flexbox-align-self-stretch-vert-1-ref.html

@ -85,6 +88,7 @@ fuzzy-if(Android,158,32) == flexbox-align-self-vert-rtl-1.xhtml  flexbox-align-s

 # Tests for flex-flow shorthand property
 == flexbox-flex-flow-1.html flexbox-flex-flow-1-ref.html
+== flexbox-flex-flow-2.html flexbox-flex-flow-2-ref.html

 # Tests for flex-wrap property
 == flexbox-flex-wrap-horiz-1.html flexbox-flex-wrap-horiz-1-ref.html
--- a/layout/tools/reftest/Makefile.in
+++ b/layout/tools/reftest/Makefile.in
@ -23,30 +23,13 @@ else
 EXTRA_COMPONENTS += reftest-cmdline.manifest
 endif

-include $(topsrcdir)/config/rules.mk
-
-# We're installing to _tests/reftest
-TARGET_DEPTH = ../..
-include $(topsrcdir)/build/automation-build.mk
-
 _DEST_DIR = $(DEPTH)/_tests/reftest

-# We want to get an extension-packaged version of reftest as well, 
-# so this seems to be the simplest way to make that happen.
-ifndef XPI_NAME
-make-xpi:
-	+$(MAKE) -C $(DEPTH)/netwerk/test/httpserver libs XPI_NAME=reftest
-	+$(MAKE) libs XPI_NAME=reftest
-copy-harness: make-xpi
-libs:: copy-harness
-endif
-
 _HARNESS_FILES = \
  $(srcdir)/runreftest.py \
  $(srcdir)/remotereftest.py \
  $(srcdir)/runreftestb2g.py \
  $(srcdir)/b2g_desktop.py \
-  $(srcdir)/b2g_start_script.js \
  automation.py \
  $(topsrcdir)/testing/mozbase/mozdevice/mozdevice/devicemanager.py \
  $(topsrcdir)/testing/mozbase/mozdevice/mozdevice/devicemanagerADB.py \
@ -60,13 +43,35 @@ _HARNESS_FILES = \
  $(topsrcdir)/build/pgo/server-locations.txt \
  $(NULL)

+_HARNESS_PP_FILES = \
+  b2g_start_script.js \
+  $(NULL)
+_HARNESS_PP_FILES_PATH = $(_DEST_DIR)
+PP_TARGETS += _HARNESS_PP_FILES
+
+include $(topsrcdir)/config/rules.mk
+
+# We're installing to _tests/reftest
+TARGET_DEPTH = ../..
+include $(topsrcdir)/build/automation-build.mk
+
+# We want to get an extension-packaged version of reftest as well, 
+# so this seems to be the simplest way to make that happen.
+ifndef XPI_NAME
+make-xpi:
+	+$(MAKE) -C $(DEPTH)/netwerk/test/httpserver libs XPI_NAME=reftest
+	+$(MAKE) libs XPI_NAME=reftest
+copy-harness: make-xpi
+libs:: copy-harness
+endif
+
 $(_DEST_DIR):
 	$(NSINSTALL) -D $@

 $(_HARNESS_FILES): $(_DEST_DIR)

 # copy harness and the reftest extension bits to $(_DEST_DIR)
-copy-harness: $(_HARNESS_FILES)
+copy-harness: $(_HARNESS_FILES) $(addprefix $(_DEST_DIR)/,$(_HARNESS_PP_FILES))
 	$(INSTALL) $(_HARNESS_FILES) $(_DEST_DIR)
 	(cd $(DIST)/xpi-stage && tar $(TAR_CREATE_FLAGS) - reftest) | (cd $(_DEST_DIR) && tar -xf -)

--- a/layout/tools/reftest/b2g_start_script.js
+++ b/layout/tools/reftest/b2g_start_script.js
@ -3,52 +3,12 @@
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 function setDefaultPrefs() {
-    // This code sets the preferences for extension-based reftest; for
-    // command-line based reftest they are set in function handler_handle in
-    // reftest-cmdline.js.  These two locations should stay in sync.
-    //
-    // FIXME: These should be in only one place.
+    // This code sets the preferences for extension-based reftest.
    var prefs = Cc["@mozilla.org/preferences-service;1"].
                getService(Ci.nsIPrefService);
    var branch = prefs.getDefaultBranch("");
-    branch.setBoolPref("dom.use_xbl_scopes_for_remote_xul", false);
-    branch.setBoolPref("gfx.color_management.force_srgb", true);
-    branch.setBoolPref("browser.dom.window.dump.enabled", true);
-    branch.setIntPref("ui.caretBlinkTime", -1);
-    branch.setBoolPref("dom.send_after_paint_to_content", true);
-    // no slow script dialogs
-    branch.setIntPref("dom.max_script_run_time", 0);
-    branch.setIntPref("dom.max_chrome_script_run_time", 0);
-    branch.setIntPref("hangmonitor.timeout", 0);
-    // Ensure autoplay is enabled for all platforms.
-    branch.setBoolPref("media.autoplay.enabled", true);
-    // Disable updates
-    branch.setBoolPref("app.update.enabled", false);
-    // Disable addon updates and prefetching so we don't leak them
-    branch.setBoolPref("extensions.update.enabled", false);
-    branch.setBoolPref("extensions.getAddons.cache.enabled", false);
-    // Disable blocklist updates so we don't have them reported as leaks
-    branch.setBoolPref("extensions.blocklist.enabled", false);
-    // Make url-classifier updates so rare that they won't affect tests
-    branch.setIntPref("urlclassifier.updateinterval", 172800);
-    // Disable high-quality downscaling, since it makes reftests more difficult.
-    branch.setBoolPref("image.high_quality_downscaling.enabled", false);
-    // Checking whether two files are the same is slow on Windows.
-    // Setting this pref makes tests run much faster there.
-    branch.setBoolPref("security.fileuri.strict_origin_policy", false);
-    // Disable the thumbnailing service
-    branch.setBoolPref("browser.pagethumbnails.capturing_disabled", true);
-    // Enable APZC so we can test it
-    branch.setBoolPref("layers.async-pan-zoom.enabled", true);
-    // Since our tests are 800px wide, set the assume-designed-for width of all
-    // pages to be 800px (instead of the default of 980px). This ensures that
-    // in our 800px window we don't zoom out by default to try to fit the
-    // assumed 980px content.
-    branch.setIntPref("browser.viewport.desktopWidth", 800);
-    // Disable the fade out (over time) of overlay scrollbars, since we
-    // can't guarantee taking both reftest snapshots at the same point
-    // during the fade.
-    branch.setBoolPref("layout.testing.overlay-scrollbars.always-visible", true);
+
+#include reftest-preferences.js
 }

 function setPermissions() {
--- a/layout/tools/reftest/bootstrap.js
+++ b/layout/tools/reftest/bootstrap.js
@ -4,56 +4,12 @@ function loadIntoWindow(window) {}
 function unloadFromWindow(window) {}

 function setDefaultPrefs() {
-    // This code sets the preferences for extension-based reftest; for
-    // command-line based reftest they are set in function handler_handle in
-    // reftest-cmdline.js.  These two locations should stay in sync.
-    //
-    // FIXME: These should be in only one place.
+    // This code sets the preferences for extension-based reftest.
    var prefs = Components.classes["@mozilla.org/preferences-service;1"].
                getService(Components.interfaces.nsIPrefService);
    var branch = prefs.getDefaultBranch("");
-    // For mochitests, we're more interested in testing the behavior of in-
-    // content XBL bindings, so we set this pref to true. In reftests, we're
-    // more interested in testing the behavior of XBL as it works in chrome,
-    // so we want this pref to be false.
-    branch.setBoolPref("dom.use_xbl_scopes_for_remote_xul", false);
-    branch.setBoolPref("gfx.color_management.force_srgb", true);
-    branch.setBoolPref("browser.dom.window.dump.enabled", true);
-    branch.setIntPref("ui.caretBlinkTime", -1);
-    branch.setBoolPref("dom.send_after_paint_to_content", true);
-    // no slow script dialogs
-    branch.setIntPref("dom.max_script_run_time", 0);
-    branch.setIntPref("dom.max_chrome_script_run_time", 0);
-    branch.setIntPref("hangmonitor.timeout", 0);
-    // Ensure autoplay is enabled for all platforms.
-    branch.setBoolPref("media.autoplay.enabled", true);
-    // Disable updates
-    branch.setBoolPref("app.update.enabled", false);
-    // Disable addon updates and prefetching so we don't leak them
-    branch.setBoolPref("extensions.update.enabled", false);
-    branch.setBoolPref("extensions.getAddons.cache.enabled", false);
-    // Disable blocklist updates so we don't have them reported as leaks
-    branch.setBoolPref("extensions.blocklist.enabled", false);
-    // Make url-classifier updates so rare that they won't affect tests
-    branch.setIntPref("urlclassifier.updateinterval", 172800);
-    // Disable high-quality downscaling, since it makes reftests more difficult.
-    branch.setBoolPref("image.high_quality_downscaling.enabled", false);
-    // Checking whether two files are the same is slow on Windows.
-    // Setting this pref makes tests run much faster there.
-    branch.setBoolPref("security.fileuri.strict_origin_policy", false);
-    // Disable the thumbnailing service
-    branch.setBoolPref("browser.pagethumbnails.capturing_disabled", true);
-    // Enable APZC so we can test it
-    branch.setBoolPref("layers.async-pan-zoom.enabled", true);
-    // Since our tests are 800px wide, set the assume-designed-for width of all
-    // pages to be 800px (instead of the default of 980px). This ensures that
-    // in our 800px window we don't zoom out by default to try to fit the
-    // assumed 980px content.
-    branch.setIntPref("browser.viewport.desktopWidth", 800);
-    // Disable the fade out (over time) of overlay scrollbars, since we
-    // can't guarantee taking both reftest snapshots at the same point
-    // during the fade.
-    branch.setBoolPref("layout.testing.overlay-scrollbars.always-visible", true);
+
+#include reftest-preferences.js
 }

 var windowListener = {
--- a/layout/tools/reftest/mach_commands.py
+++ b/layout/tools/reftest/mach_commands.py
@ -206,7 +206,7 @@ class ReftestRunner(MozbuildObject):
        return reftest.run_remote_reftests(parser, options, args)

    def run_desktop_test(self, test_file=None, filter=None, suite=None,
-            debugger=None, parallel=False):
+            debugger=None, parallel=False, e10s=False):
        """Runs a reftest.

        test_file is a path to a test file. It can be a relative path from the
@ -248,6 +248,9 @@ class ReftestRunner(MozbuildObject):
        if parallel:
            extra_args.append('--run-tests-in-parallel')

+        if e10s:
+            extra_args.append('--e10s')
+
        if extra_args:
            args = [os.environ.get(b'EXTRA_TEST_ARGS', '')]
            args.extend(extra_args)
@ -279,6 +282,10 @@ def ReftestCommand(func):
        help='Run tests in parallel.')
    func = parallel(func)

+    e10s = CommandArgument('--e10s', action='store_true',
+                           help='Use content processes.')
+    func = e10s(func)
+
    return func

 def B2GCommand(func):
--- a/layout/tools/reftest/moz.build
+++ b/layout/tools/reftest/moz.build
@ -4,8 +4,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-EXTRA_COMPONENTS += [
+EXTRA_PP_COMPONENTS += [
    'reftest-cmdline.js',
 ]

-JAR_MANIFESTS += ['jar.mn']
+JAR_MANIFESTS += ['jar.mn']
--- a/layout/tools/reftest/reftest-cmdline.js
+++ b/layout/tools/reftest/reftest-cmdline.js
@ -66,58 +66,12 @@ RefTestCmdLineHandler.prototype =
     * We want to do this here rather than in reftest.js because it's
     * important to force sRGB as an output profile for color management
     * before we load a window.
-     *
-     * If you change these, please adjust them in the bootstrap.js function 
-     * setDefaultPrefs().  These are duplicated there so we can have a 
-     * restartless addon for reftest on native Android.
-     *
-     * FIXME: These should be in only one place. 
     */
    var prefs = Components.classes["@mozilla.org/preferences-service;1"].
                getService(Components.interfaces.nsIPrefService);
    var branch = prefs.getDefaultBranch("");
-    // For mochitests, we're more interested in testing the behavior of in-
-    // content XBL bindings, so we set this pref to true. In reftests, we're
-    // more interested in testing the behavior of XBL as it works in chrome,
-    // so we want this pref to be false.
-    branch.setBoolPref("dom.use_xbl_scopes_for_remote_xul", false);
-    branch.setBoolPref("gfx.color_management.force_srgb", true);
-    branch.setBoolPref("browser.dom.window.dump.enabled", true);
-    branch.setIntPref("ui.caretBlinkTime", -1);
-    branch.setBoolPref("dom.send_after_paint_to_content", true);
-    // no slow script dialogs
-    branch.setIntPref("dom.max_script_run_time", 0);
-    branch.setIntPref("dom.max_chrome_script_run_time", 0);
-    branch.setIntPref("hangmonitor.timeout", 0);
-    // Ensure autoplay is enabled for all platforms.
-    branch.setBoolPref("media.autoplay.enabled", true);
-    // Disable updates
-    branch.setBoolPref("app.update.enabled", false);
-    // Disable addon updates and prefetching so we don't leak them
-    branch.setBoolPref("extensions.update.enabled", false);
-    branch.setBoolPref("extensions.getAddons.cache.enabled", false);
-    // Disable blocklist updates so we don't have them reported as leaks
-    branch.setBoolPref("extensions.blocklist.enabled", false);
-    // Make url-classifier updates so rare that they won't affect tests
-    branch.setIntPref("urlclassifier.updateinterval", 172800);
-    // Disable high-quality downscaling, since it makes reftests more difficult.
-    branch.setBoolPref("image.high_quality_downscaling.enabled", false);
-    // Checking whether two files are the same is slow on Windows.
-    // Setting this pref makes tests run much faster there.
-    branch.setBoolPref("security.fileuri.strict_origin_policy", false);
-    // Disable the thumbnailing service
-    branch.setBoolPref("browser.pagethumbnails.capturing_disabled", true);
-    // Enable APZC so we can test it
-    branch.setBoolPref("layers.async-pan-zoom.enabled", true);
-    // Since our tests are 800px wide, set the assume-designed-for width of all
-    // pages to be 800px (instead of the default of 980px). This ensures that
-    // in our 800px window we don't zoom out by default to try to fit the
-    // assumed 980px content.
-    branch.setIntPref("browser.viewport.desktopWidth", 800);
-    // Disable the fade out (over time) of overlay scrollbars, since we
-    // can't guarantee taking both reftest snapshots at the same point
-    // during the fade.
-    branch.setBoolPref("layout.testing.overlay-scrollbars.always-visible", true);
+
+#include reftest-preferences.js

    var wwatch = Components.classes["@mozilla.org/embedcomp/window-watcher;1"]
                           .getService(nsIWindowWatcher);
--- a/layout/tools/reftest/reftest-preferences.js
+++ b/layout/tools/reftest/reftest-preferences.js
@ -0,0 +1,43 @@
+    // For mochitests, we're more interested in testing the behavior of in-
+    // content XBL bindings, so we set this pref to true. In reftests, we're
+    // more interested in testing the behavior of XBL as it works in chrome,
+    // so we want this pref to be false.
+    branch.setBoolPref("dom.use_xbl_scopes_for_remote_xul", false);
+    branch.setBoolPref("gfx.color_management.force_srgb", true);
+    branch.setBoolPref("browser.dom.window.dump.enabled", true);
+    branch.setIntPref("ui.caretBlinkTime", -1);
+    branch.setBoolPref("dom.send_after_paint_to_content", true);
+    // no slow script dialogs
+    branch.setIntPref("dom.max_script_run_time", 0);
+    branch.setIntPref("dom.max_chrome_script_run_time", 0);
+    branch.setIntPref("hangmonitor.timeout", 0);
+    // Ensure autoplay is enabled for all platforms.
+    branch.setBoolPref("media.autoplay.enabled", true);
+    // Disable updates
+    branch.setBoolPref("app.update.enabled", false);
+    // Disable addon updates and prefetching so we don't leak them
+    branch.setBoolPref("extensions.update.enabled", false);
+    branch.setBoolPref("extensions.getAddons.cache.enabled", false);
+    // Disable blocklist updates so we don't have them reported as leaks
+    branch.setBoolPref("extensions.blocklist.enabled", false);
+    // Make url-classifier updates so rare that they won't affect tests
+    branch.setIntPref("urlclassifier.updateinterval", 172800);
+    // Disable high-quality downscaling, since it makes reftests more difficult.
+    branch.setBoolPref("image.high_quality_downscaling.enabled", false);
+    // Checking whether two files are the same is slow on Windows.
+    // Setting this pref makes tests run much faster there.
+    branch.setBoolPref("security.fileuri.strict_origin_policy", false);
+    // Disable the thumbnailing service
+    branch.setBoolPref("browser.pagethumbnails.capturing_disabled", true);
+    // Enable APZC so we can test it
+    branch.setBoolPref("layers.async-pan-zoom.enabled", true);
+    // Since our tests are 800px wide, set the assume-designed-for width of all
+    // pages to be 800px (instead of the default of 980px). This ensures that
+    // in our 800px window we don't zoom out by default to try to fit the
+    // assumed 980px content.
+    branch.setIntPref("browser.viewport.desktopWidth", 800);
+    // Disable the fade out (over time) of overlay scrollbars, since we
+    // can't guarantee taking both reftest snapshots at the same point
+    // during the fade.
+    branch.setBoolPref("layout.testing.overlay-scrollbars.always-visible", true);
+
--- a/layout/tools/reftest/runreftest.py
+++ b/layout/tools/reftest/runreftest.py
@ -163,6 +163,9 @@ class RefTest(object):
      prefs['reftest.filter'] = options.filter
    prefs['reftest.focusFilterMode'] = options.focusFilterMode

+    if options.e10s:
+      prefs['browser.tabs.remote.autostart'] = True
+
    for v in options.extraPrefs:
      thispref = v.split('=')
      if len(thispref) < 2:
@ -445,6 +448,12 @@ class ReftestOptions(OptionParser):
                           "Defaults to `all'.")
    defaults["focusFilterMode"] = "all"

+    self.add_option("--e10s",
+                    action = "store_true",
+                    dest = "e10s",
+                    help = "enables content processes")
+    defaults["e10s"] = False
+
    self.set_defaults(**defaults)

  def verifyCommonOptions(self, options, reftest):
--- a/layout/xul/nsMenuPopupFrame.cpp
+++ b/layout/xul/nsMenuPopupFrame.cpp
@ -1334,14 +1334,15 @@ nsMenuPopupFrame::SetPopupPosition(nsIFrame* aAnchorFrame, bool aIsMove, bool aS
                 "Popup is offscreen");
  }

+  // snap the popup's position in screen coordinates to device pixels,
+  // see bug 622507, bug 961431
+  screenPoint.x = presContext->RoundAppUnitsToNearestDevPixels(screenPoint.x);
+  screenPoint.y = presContext->RoundAppUnitsToNearestDevPixels(screenPoint.y);
+
  // determine the x and y position of the view by subtracting the desired
  // screen position from the screen position of the root frame.
  nsPoint viewPoint = screenPoint - rootScreenRect.TopLeft();

-  // snap the view's position to device pixels, see bug 622507
-  viewPoint.x = presContext->RoundAppUnitsToNearestDevPixels(viewPoint.x);
-  viewPoint.y = presContext->RoundAppUnitsToNearestDevPixels(viewPoint.y);
-
  nsView* view = GetView();
  NS_ASSERTION(view, "popup with no view");

--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
@ -134,7 +134,6 @@ namespace mozilla {

 class nsIDOMDataChannel;

-static const int DTLS_FINGERPRINT_LENGTH = 64;
 static const int MEDIA_STREAM_MUTE = 0x80;

 PRLogModuleInfo *signalingLogInfo() {
--- a/memory/mozjemalloc/jemalloc.c
+++ b/memory/mozjemalloc/jemalloc.c
@ -7018,15 +7018,15 @@ ozone_free_definite_size(malloc_zone_t *zone, void *ptr, size_t size)
 static void
 ozone_force_lock(malloc_zone_t *zone)
 {
-	/* jemalloc locking is taken care of by the normal jemalloc zone. */
+	_malloc_prefork();
 	szone->introspect->force_lock(zone);
 }

 static void
 ozone_force_unlock(malloc_zone_t *zone)
 {
-	/* jemalloc locking is taken care of by the normal jemalloc zone. */
 	szone->introspect->force_unlock(zone);
+        _malloc_postfork();
 }

 static size_t
--- a/mobile/android/base/tests/BaseTest.java
+++ b/mobile/android/base/tests/BaseTest.java
@ -181,10 +181,8 @@ abstract class BaseTest extends BaseRobocopTest {
                EditText urlEditText = (EditText) mSolo.getView(R.id.url_edit_text);
                if (urlEditText.isInputMethodTarget()) {
                    return true;
-                } else {
-                    mSolo.clickOnView(urlEditText);
-                    return false;
                }
+                return false;
            }
        }, MAX_WAIT_ENABLED_TEXT_MS);

--- a/mobile/android/base/webapp/WebappImpl.java
+++ b/mobile/android/base/webapp/WebappImpl.java
@ -51,7 +51,10 @@ public class WebappImpl extends GeckoApp implements InstallCallback {

    private View mSplashscreen;

+    private boolean mIsApk = true;
    private ApkResources mApkResources;
+    private String mManifestUrl;
+    private String mAppName;

    protected int getIndex() { return 0; }

@ -79,18 +82,36 @@ public class WebappImpl extends GeckoApp implements InstallCallback {
        String packageName = extras.getString("packageName");

        if (packageName == null) {
-            // TODO Migration path!
-            Log.w(LOGTAG, "Can't find package name for webapp");
-            setResult(RESULT_CANCELED);
-            finish();
-        }
+            Log.w(LOGTAG, "no package name; treating as legacy shortcut");

-        try {
-            mApkResources = new ApkResources(this, packageName);
-        } catch (NameNotFoundException e) {
-            Log.e(LOGTAG, "Can't find package for webapp " + packageName, e);
-            setResult(RESULT_CANCELED);
-            finish();
+            mIsApk = false;
+
+            // Shortcut apps are already installed.
+            isInstalled = true;
+
+            Uri data = getIntent().getData();
+            if (data == null) {
+                Log.wtf(LOGTAG, "can't get manifest URL from shortcut data");
+                setResult(RESULT_CANCELED);
+                finish();
+                return;
+            }
+            mManifestUrl = data.toString();
+
+            String shortcutName = extras.getString(Intent.EXTRA_SHORTCUT_NAME);
+            mAppName = shortcutName != null ? shortcutName : "Web App";
+        } else {
+            try {
+                mApkResources = new ApkResources(this, packageName);
+            } catch (NameNotFoundException e) {
+                Log.e(LOGTAG, "Can't find package for webapp " + packageName, e);
+                setResult(RESULT_CANCELED);
+                finish();
+                return;
+            }
+
+            mManifestUrl = mApkResources.getManifestUrl();
+            mAppName = mApkResources.getAppName();
        }

        // start Gecko.
@ -113,7 +134,7 @@ public class WebappImpl extends GeckoApp implements InstallCallback {
        if (!GeckoThread.checkLaunchState(GeckoThread.LaunchState.GeckoRunning) || !isInstalled || isInstallCompleting) {
            // Show the splash screen if we need to start Gecko, or we need to install this.
            overridePendingTransition(R.anim.grow_fade_in_center, android.R.anim.fade_out);
-            showSplash(true);
+            showSplash();
        } else {
            mSplashscreen.setVisibility(View.GONE);
        }
@ -134,10 +155,10 @@ public class WebappImpl extends GeckoApp implements InstallCallback {
            }
            return;
        } else {
-            launchWebapp(origin, mApkResources.getManifestUrl(), mApkResources.getAppName());
+            launchWebapp(origin);
        }

-        setTitle(mApkResources.getAppName());
+        setTitle(mAppName);
    }

    @Override
@ -150,7 +171,15 @@ public class WebappImpl extends GeckoApp implements InstallCallback {
        // the synthesized APK.

        // TODO Translate AndroidIntents into WebActivities here.
-        return mApkResources.getManifestUrl();
+        if (mIsApk) {
+            return mApkResources.getManifestUrl();
+        }
+
+        // If this is a legacy shortcut, then we should have been able to get
+        // the URI from the intent data.  Otherwise, we should have been able
+        // to get it from the APK resources.  So we should never get here.
+        Log.wtf(LOGTAG, "Couldn't get URI from intent nor APK resources");
+        return null;
    }

    @Override
@ -158,7 +187,7 @@ public class WebappImpl extends GeckoApp implements InstallCallback {
        // NOP
    }

-    private void showSplash(boolean isApk) {
+    private void showSplash() {

        // get the favicon dominant color, stored when the app was installed
        int dominantColor = Allocator.getInstance().getColor(getIndex());
@ -168,7 +197,7 @@ public class WebappImpl extends GeckoApp implements InstallCallback {
        ImageView image = (ImageView)findViewById(R.id.splashscreen_icon);
        Drawable d = null;

-        if (isApk) {
+        if (mIsApk) {
            Uri uri = mApkResources.getAppIconUri();
            image.setImageURI(uri);
            d = image.getDrawable();
@ -299,7 +328,7 @@ public class WebappImpl extends GeckoApp implements InstallCallback {

        if (event.equals("Webapps:Postinstall")) {
            String origin = message.optString("origin");
-            launchWebapp(origin, mApkResources.getManifestUrl(), mApkResources.getAppName());
+            launchWebapp(origin);
        }
    }

@ -308,30 +337,37 @@ public class WebappImpl extends GeckoApp implements InstallCallback {
        Log.e(LOGTAG, "Install errored", exception);
    }

-    public void launchWebapp(String origin, String manifestUrl, String name) {
+    private void setOrigin(String origin) {
        try {
            mOrigin = new URL(origin);
        } catch (java.net.MalformedURLException ex) {
-            // If we can't parse the this is an app protocol, just settle for not having an origin
+            // If this isn't an app: URL, just settle for not having an origin.
            if (!origin.startsWith("app://")) {
                return;
            }

-            // If that failed fall back to the origin stored in the shortcut
-            Log.i(LOGTAG, "Webapp is not registered with allocator");
-            Uri data = getIntent().getData();
-            if (data != null) {
-                try {
-                    mOrigin = new URL(data.toString());
-                } catch (java.net.MalformedURLException ex2) {
-                    Log.e(LOGTAG, "Unable to parse intent url: ", ex);
+            // If that failed fall back to the origin stored in the shortcut.
+            if (!mIsApk) {
+                Log.i(LOGTAG, "Origin is app: URL; falling back to intent URL");
+                Uri data = getIntent().getData();
+                if (data != null) {
+                    try {
+                        mOrigin = new URL(data.toString());
+                    } catch (java.net.MalformedURLException ex2) {
+                        Log.e(LOGTAG, "Unable to parse intent URL: ", ex);
+                    }
                }
            }
        }
+    }
+
+    public void launchWebapp(String origin) {
+        setOrigin(origin);
+
        try {
            JSONObject launchObject = new JSONObject();
-            launchObject.putOpt("url", manifestUrl);
-            launchObject.putOpt("name", mApkResources.getAppName());
+            launchObject.putOpt("url", mManifestUrl);
+            launchObject.putOpt("name", mAppName);
            Log.i(LOGTAG, "Trying to launch: " + launchObject);
            GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("Webapps:Load", launchObject.toString()));
        } catch (JSONException e) {
@ -341,6 +377,12 @@ public class WebappImpl extends GeckoApp implements InstallCallback {

    @Override
    protected boolean getIsDebuggable() {
-        return mApkResources.isDebuggable();
+        if (mIsApk) {
+            return mApkResources.isDebuggable();
+        }
+
+        // This is a legacy shortcut, which didn't provide a way to determine
+        // that the app is debuggable, so we say the app is not debuggable.
+        return false;
    }
 }
--- a/netwerk/base/public/nsIThreadRetargetableRequest.idl
+++ b/netwerk/base/public/nsIThreadRetargetableRequest.idl
@ -12,16 +12,17 @@ interface nsIEventTarget;
 * nsIThreadRetargetableRequest
 *
 * Should be implemented by requests that support retargeting delivery of
- * OnDataAvailable off the main thread. Note, OnStopRequest will be delivered
- * back on the main thread.
+ * data off the main thread.
 */
 [uuid(27b84c48-5a73-4ba4-a8a4-8b5e649a145e)]
 interface nsIThreadRetargetableRequest : nsISupports
 {
  /**
   * Called to retarget delivery of OnDataAvailable to another thread. Should
-   * only be called within the context of OnStartRequest on the main thread.
-   * OnStopRequest will be delivered back on the main thread.
+   * only be called before AsyncOpen for nsIWebsocketChannels, or during
+   * OnStartRequest for nsIHttpChannels.
+   * Note: For nsIHttpChannels, OnStartRequest and OnStopRequest will still be
+   * delivered on the main thread.
   *
   * @param aNewTarget New event target, e.g. thread or threadpool.
   *
--- a/netwerk/base/src/Dashboard.cpp
+++ b/netwerk/base/src/Dashboard.cpp
@ -317,7 +317,7 @@ LookupHelper::ConstructAnswer(LookupArgument *aArgument)
    }

    JS::RootedValue val(cx);
-    if (!dict.ToObject(cx, JS::NullPtr(), &val)) {
+    if (!dict.ToObject(cx, &val)) {
        return NS_ERROR_FAILURE;
    }

@ -400,7 +400,7 @@ Dashboard::GetSockets(SocketData *aSocketData)
    dict.mSent += socketData->mTotalSent;
    dict.mReceived += socketData->mTotalRecv;
    JS::RootedValue val(cx);
-    if (!dict.ToObject(cx, JS::NullPtr(), &val))
+    if (!dict.ToObject(cx, &val))
        return NS_ERROR_FAILURE;
    socketData->mCallback->OnDashboardDataAvailable(val);

@ -503,7 +503,7 @@ Dashboard::GetHttpConnections(HttpData *aHttpData)
    }

    JS::RootedValue val(cx);
-    if (!dict.ToObject(cx, JS::NullPtr(), &val)) {
+    if (!dict.ToObject(cx, &val)) {
        return NS_ERROR_FAILURE;
    }

@ -630,7 +630,7 @@ Dashboard::GetWebSocketConnections(WebSocketRequest *aWsRequest)
    }

    JS::RootedValue val(cx);
-    if (!dict.ToObject(cx, JS::NullPtr(), &val)) {
+    if (!dict.ToObject(cx, &val)) {
        return NS_ERROR_FAILURE;
    }
    wsRequest->mCallback->OnDashboardDataAvailable(val);
@ -717,7 +717,7 @@ Dashboard::GetDNSCacheEntries(DnsData *dnsData)
    }

    JS::RootedValue val(cx);
-    if (!dict.ToObject(cx, JS::NullPtr(), &val)) {
+    if (!dict.ToObject(cx, &val)) {
        return NS_ERROR_FAILURE;
    }
    dnsData->mCallback->OnDashboardDataAvailable(val);
@ -819,7 +819,7 @@ Dashboard::GetConnectionStatus(ConnectionData *aConnectionData)
    dict.mStatus = connectionData->mStatus;

    JS::RootedValue val(cx);
-    if (!dict.ToObject(cx, JS::NullPtr(), &val))
+    if (!dict.ToObject(cx, &val))
        return NS_ERROR_FAILURE;

    connectionData->mCallback->OnDashboardDataAvailable(val);
--- a/netwerk/streamconv/converters/nsIndexedToHTML.cpp
+++ b/netwerk/streamconv/converters/nsIndexedToHTML.cpp
@ -733,6 +733,10 @@ nsIndexedToHTML::OnIndexAvailable(nsIRequest *aRequest,

    pushBuffer.AppendLiteral("\" href=\"");

+    nsXPIDLCString encoding;
+    rv = mParser->GetEncoding(getter_Copies(encoding));
+    if (NS_FAILED(rv)) return rv;
+
    // need to escape links
    nsAutoCString locEscaped;

@ -764,6 +768,12 @@ nsIndexedToHTML::OnIndexAvailable(nsIRequest *aRequest,
    // contains semicolons we need to manually escape them.
    // This replacement should be removed in bug #473280
    locEscaped.ReplaceSubstring(";", "%3b");
+    if (!encoding.EqualsLiteral("UTF-8")) {
+        // Escape all non-ASCII bytes to preserve the raw value.
+        nsAutoCString outstr;
+        NS_EscapeURL(locEscaped, esc_AlwaysCopy | esc_OnlyNonASCII, outstr);
+        locEscaped = outstr;
+    }
    nsAdoptingCString htmlEscapedURL(nsEscapeHTML(locEscaped.get()));
    pushBuffer.Append(htmlEscapedURL);

--- a/security/manager/ssl/tests/unit/test_cert_eku.js
+++ b/security/manager/ssl/tests/unit/test_cert_eku.js
--- a/security/manager/ssl/tests/unit/test_cert_eku/ca.der
+++ b/security/manager/ssl/tests/unit/test_cert_eku/ca.der
--- a/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA.der
+++ b/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA.der
--- a/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_EP.der
+++ b/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_EP.der
--- a/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_EP_NS_OS_SA.der
+++ b/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_EP_NS_OS_SA.der
--- a/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_EP_NS_OS_SA_TS.der
+++ b/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_EP_NS_OS_SA_TS.der
--- a/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_NS.der
+++ b/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_NS.der
--- a/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_OS.der
+++ b/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_OS.der
--- a/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_SA.der
+++ b/security/manager/ssl/tests/unit/test_cert_eku/ee-EKU-CA-int-EKU-CA_SA.der
--- a/Показать больше
+++ b/Показать больше