From e25a9a8bef0857829b2dfc5e9851725d750f1651 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 16:43:45 +1200
Subject: [PATCH 001/222] Bug 592941. Fix performance regression by ensuring we
 create a ThebesLayerInvalidRegionProperty for frames with new container
 layers. r=tnikkel,a=blocking

---
 layout/base/FrameLayerBuilder.cpp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 5dffc807b803..6effcdb88d4b 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -472,6 +472,8 @@ FrameLayerBuilder::UpdateDisplayItemDataForFrame(nsPtrHashKey<nsIFrame>* aEntry,
   if (newDisplayItems->HasContainerLayer()) {
     // Reset or create the invalid region now so we can start collecting
     // new dirty areas.
+    // Note that the NS_FRAME_HAS_CONTAINER_LAYER bit is set in
+    // BuildContainerLayerFor, so we don't need to set it here.
     nsRegion* invalidRegion = static_cast<nsRegion*>
       (props.Get(ThebesLayerInvalidRegionProperty()));
     if (invalidRegion) {
@@ -505,11 +507,12 @@ FrameLayerBuilder::StoreNewDisplayItemData(DisplayItemDataEntry* aEntry,
 {
   LayerManagerData* data = static_cast<LayerManagerData*>(aUserArg);
   nsIFrame* f = aEntry->GetKey();
+  FrameProperties props = f->Properties();
   // Remember that this frame has display items in retained layers
   NS_ASSERTION(!data->mFramesWithLayers.GetEntry(f),
                "We shouldn't get here if we're already in mFramesWithLayers");
   data->mFramesWithLayers.PutEntry(f);
-  NS_ASSERTION(!f->Properties().Get(DisplayItemDataProperty()),
+  NS_ASSERTION(!props.Get(DisplayItemDataProperty()),
                "mFramesWithLayers out of sync");
 
   void* propValue;
@@ -518,8 +521,11 @@ FrameLayerBuilder::StoreNewDisplayItemData(DisplayItemDataEntry* aEntry,
   // Steal the list of display item layers
   array->SwapElements(aEntry->mData);
   // Save it
-  f->Properties().Set(DisplayItemDataProperty(), propValue);
+  props.Set(DisplayItemDataProperty(), propValue);
 
+  if (f->GetStateBits() & NS_FRAME_HAS_CONTAINER_LAYER) {
+    props.Set(ThebesLayerInvalidRegionProperty(), new nsRegion());
+  }
   return PL_DHASH_REMOVE;
 }
 

From 43c2fbb41796bc9fe4b0725c6a88c7389306a9a5 Mon Sep 17 00:00:00 2001
From: "timeless@mozdev.org" <timeless@mozdev.org>
Date: Thu, 2 Sep 2010 16:46:53 +1200
Subject: [PATCH 002/222] Bug 587483 warning: comparison between signed and
 unsigned integer expressions in FrameLayerBuilder. r=roc,a=roc

---
 layout/base/FrameLayerBuilder.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 6effcdb88d4b..01c9797f776b 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -657,7 +657,7 @@ ContainerState::CreateOrRecycleThebesLayer(nsIFrame* aActiveScrolledRoot)
  * have a frame because only nsDisplayClip items don't have a frame,
  * and those items are flattened away by ProcessDisplayItems.
  */
-static PRUint32
+static PRInt32
 AppUnitsPerDevPixel(nsDisplayItem* aItem)
 {
   // The underlying frame for zoom items is the root frame of the subdocument.
@@ -1425,7 +1425,7 @@ FrameLayerBuilder::DrawThebesLayer(ThebesLayer* aLayer,
   nsIntPoint offset(PRInt32(transform.x0), PRInt32(transform.y0));
 
   nsPresContext* presContext = containerLayerFrame->PresContext();
-  nscoord appUnitsPerDevPixel = presContext->AppUnitsPerDevPixel();
+  PRInt32 appUnitsPerDevPixel = presContext->AppUnitsPerDevPixel();
   nsRect r = (aRegionToInvalidate.GetBounds() + offset).
     ToAppUnits(appUnitsPerDevPixel);
   containerLayerFrame->InvalidateWithFlags(r,

From 5eeb4518f0ebb2bc2e29f9b62f9598569902a2c3 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 16:47:12 +1200
Subject: [PATCH 003/222] Bug 580410. Hide reftest window title bar so the
 reftest window fits on our Mac test machines. test-only change, a=me.

---
 layout/tools/reftest/reftest.xul | 1 +
 1 file changed, 1 insertion(+)

diff --git a/layout/tools/reftest/reftest.xul b/layout/tools/reftest/reftest.xul
index 2e8a09ebcc04..66604f1030df 100644
--- a/layout/tools/reftest/reftest.xul
+++ b/layout/tools/reftest/reftest.xul
@@ -44,6 +44,7 @@
 
 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         id="reftest-window"
+        hidechrome="true"
         onload="OnRefTestLoad();"
         onunload="OnRefTestUnload();"
         style="background:white; overflow:hidden"

From e697011b605502a9df81fa5ccbe2dbace1d6d68c Mon Sep 17 00:00:00 2001
From: Ginn Chen <ginn.chen@sun.com>
Date: Thu, 2 Sep 2010 15:23:52 +0800
Subject: [PATCH 004/222] Bug 591216 Fix Gtk-WARNING gtk_window_set_wmclass:
 shouldn't set wmclass after window is realized r=roc a=roc

---
 widget/src/gtk2/nsWindow.cpp | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/widget/src/gtk2/nsWindow.cpp b/widget/src/gtk2/nsWindow.cpp
index 6d3bf5387aef..9ce6d5f7c8e9 100644
--- a/widget/src/gtk2/nsWindow.cpp
+++ b/widget/src/gtk2/nsWindow.cpp
@@ -3777,11 +3777,12 @@ nsWindow::Create(nsIWidget        *aParent,
                 // GTK_WINDOW_POPUP, which will use a Window with the
                 // override-redirect attribute (for temporary windows).
                 mShell = gtk_window_new(GTK_WINDOW_POPUP);
+                gtk_window_set_wmclass(GTK_WINDOW(mShell), "Popup", cBrand.get());
             } else {
                 // For long-lived windows, their stacking order is managed by
                 // the window manager, as indicated by GTK_WINDOW_TOPLEVEL ...
                 mShell = gtk_window_new(GTK_WINDOW_TOPLEVEL);
-                GtkWindow* gtkWin = GTK_WINDOW(mShell);
+                gtk_window_set_wmclass(GTK_WINDOW(mShell), "Popup", cBrand.get());
                 // ... but the window manager does not decorate this window,
                 // nor provide a separate taskbar icon.
                 if (mBorderStyle == eBorderStyle_default) {
@@ -3794,11 +3795,11 @@ nsWindow::Create(nsIWidget        *aParent,
                     gtk_window_set_deletable(GTK_WINDOW(mShell), mBorderStyle & eBorderStyle_close);
                   }
                 }
-                gtk_window_set_skip_taskbar_hint(gtkWin, TRUE);
+                gtk_window_set_skip_taskbar_hint(GTK_WINDOW(mShell), TRUE);
                 // Element focus is managed by the parent window so the
                 // WM_HINTS input field is set to False to tell the window
                 // manager not to set input focus to this window ...
-                gtk_window_set_accept_focus(gtkWin, FALSE);
+                gtk_window_set_accept_focus(GTK_WINDOW(mShell), FALSE);
 #ifdef MOZ_X11
                 // ... but when the window manager offers focus through
                 // WM_TAKE_FOCUS, focus is requested on the parent window.
@@ -3808,8 +3809,6 @@ nsWindow::Create(nsIWidget        *aParent,
 #endif
             }
 
-            gtk_window_set_wmclass(GTK_WINDOW(mShell), "Popup", cBrand.get());
-
             GdkWindowTypeHint gtkTypeHint;
             switch (aInitData->mPopupHint) {
                 case ePopupTypeMenu:

From bc14460ac4c69087b21a4d433aacf813545c53b5 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:39 +1200
Subject: [PATCH 005/222] Bug 579276. Part 1: Change layer/layermanager user
 data API to use keys and values. r=cjones,sr=vlad

---
 content/canvas/src/WebGLContext.cpp           |   4 +-
 .../canvas/src/nsCanvasRenderingContext2D.cpp |   4 +-
 gfx/layers/Layers.h                           | 113 ++++++++++++++++--
 layout/base/FrameLayerBuilder.cpp             |  59 +++++----
 4 files changed, 140 insertions(+), 40 deletions(-)

diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index 5b4f9dfbc177..9ac05fa7c7f6 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -508,7 +508,7 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
                              LayerManager *aManager)
 {
     if (!mResetLayer && aOldLayer &&
-        aOldLayer->GetUserData() == &gWebGLLayerUserData) {
+        aOldLayer->HasUserData(&gWebGLLayerUserData)) {
         NS_ADDREF(aOldLayer);
         if (mInvalidated) {
             aOldLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
@@ -522,7 +522,7 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
         NS_WARNING("CreateCanvasLayer returned null!");
         return nsnull;
     }
-    canvasLayer->SetUserData(&gWebGLLayerUserData);
+    canvasLayer->SetUserData(&gWebGLLayerUserData, nsnull);
 
     CanvasLayer::Data data;
 
diff --git a/content/canvas/src/nsCanvasRenderingContext2D.cpp b/content/canvas/src/nsCanvasRenderingContext2D.cpp
index c0a9f753d196..d76eee6f82e8 100644
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@@ -4154,7 +4154,7 @@ nsCanvasRenderingContext2D::GetCanvasLayer(CanvasLayer *aOldLayer,
         return nsnull;
 
     if (!mResetLayer && aOldLayer &&
-        aOldLayer->GetUserData() == &g2DContextLayerUserData) {
+        aOldLayer->HasUserData(&g2DContextLayerUserData)) {
         NS_ADDREF(aOldLayer);
         // XXX Need to just update the changed area here
         aOldLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
@@ -4166,7 +4166,7 @@ nsCanvasRenderingContext2D::GetCanvasLayer(CanvasLayer *aOldLayer,
         NS_WARNING("CreateCanvasLayer returned null!");
         return nsnull;
     }
-    canvasLayer->SetUserData(&g2DContextLayerUserData);
+    canvasLayer->SetUserData(&g2DContextLayerUserData, nsnull);
 
     CanvasLayer::Data data;
 
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 47a9baab9b75..6643d60f0062 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -83,6 +83,14 @@ class SpecificLayerAttributes;
   virtual const char* Name() const { return n; }            \
   virtual LayerType GetType() const { return e; }
 
+/**
+ * Base class for userdata objects attached to layers and layer managers.
+ */
+class THEBES_API LayerUserData {
+public:
+  virtual ~LayerUserData() {}
+};
+
 /*
  * Motivation: For truly smooth animation and video playback, we need to
  * be able to compose frames and render them on a dedicated thread (i.e.
@@ -109,6 +117,52 @@ class SpecificLayerAttributes;
  * BasicLayerManager for such an implementation.
  */
 
+/**
+ * Helper class to manage user data for layers and LayerManagers.
+ */
+class THEBES_API LayerUserDataSet {
+public:
+  LayerUserDataSet() : mKey(nsnull) {}
+
+  void Set(void* aKey, LayerUserData* aValue)
+  {
+    NS_ASSERTION(!mKey || mKey == aKey,
+                 "Multiple LayerUserData objects not supported");
+    mKey = aKey;
+    mValue = aValue;
+  }
+  /**
+   * This can be used anytime. Ownership passes to the caller!
+   */
+  LayerUserData* Remove(void* aKey)
+  {
+    if (mKey == aKey) {
+      mKey = nsnull;
+      LayerUserData* d = mValue.forget();
+      return d;
+    }
+    return nsnull;
+  }
+  /**
+   * This getter can be used anytime.
+   */
+  PRBool Has(void* aKey)
+  {
+    return mKey == aKey;
+  }
+  /**
+   * This getter can be used anytime. Ownership is retained by this object.
+   */
+  LayerUserData* Get(void* aKey)
+  {
+    return mKey == aKey ? mValue.get() : nsnull;
+  }
+
+private:
+  void* mKey;
+  nsAutoPtr<LayerUserData> mValue;
+};
+
 /**
  * A LayerManager controls a tree of layers. All layers in the tree
  * must use the same LayerManager.
@@ -142,7 +196,7 @@ public:
     LAYERS_D3D9
   };
 
-  LayerManager() : mUserData(nsnull), mDestroyed(PR_FALSE)
+  LayerManager() : mDestroyed(PR_FALSE)
   {
     InitLog();
   }
@@ -267,10 +321,28 @@ public:
    */
   virtual LayersBackend GetBackendType() = 0;
 
-  // This setter and getter can be used anytime. The user data is initially
-  // null.
-  void SetUserData(void* aData) { mUserData = aData; }
-  void* GetUserData() { return mUserData; }
+  /**
+   * This setter can be used anytime. The user data for all keys is
+   * initially null. Ownership pases to the layer manager.
+   */
+  void SetUserData(void* aKey, LayerUserData* aData)
+  { mUserData.Set(aKey, aData); }
+  /**
+   * This can be used anytime. Ownership passes to the caller!
+   */
+  nsAutoPtr<LayerUserData> RemoveUserData(void* aKey)
+  { nsAutoPtr<LayerUserData> d(mUserData.Remove(aKey)); return d; }
+  /**
+   * This getter can be used anytime.
+   */
+  PRBool HasUserData(void* aKey)
+  { return mUserData.Has(aKey); }
+  /**
+   * This getter can be used anytime. Ownership is retained by the layer
+   * manager.
+   */
+  LayerUserData* GetUserData(void* aKey)
+  { return mUserData.Get(aKey); }
 
   // We always declare the following logging symbols, because it's
   // extremely tricky to conditionally declare them.  However, for
@@ -305,7 +377,7 @@ public:
 
 protected:
   nsRefPtr<Layer> mRoot;
-  void* mUserData;
+  LayerUserDataSet mUserData;
   PRPackedBool mDestroyed;
 
   // Print interesting information about this into aTo.  Internally
@@ -460,10 +532,28 @@ public:
   // quality.
   PRBool CanUseOpaqueSurface();
 
-  // This setter and getter can be used anytime. The user data is initially
-  // null.
-  void SetUserData(void* aData) { mUserData = aData; }
-  void* GetUserData() { return mUserData; }
+  /**
+   * This setter can be used anytime. The user data for all keys is
+   * initially null. Ownership pases to the layer manager.
+   */
+  void SetUserData(void* aKey, LayerUserData* aData)
+  { mUserData.Set(aKey, aData); }
+  /**
+   * This can be used anytime. Ownership passes to the caller!
+   */
+  nsAutoPtr<LayerUserData> RemoveUserData(void* aKey)
+  { nsAutoPtr<LayerUserData> d(mUserData.Remove(aKey)); return d; }
+  /**
+   * This getter can be used anytime.
+   */
+  PRBool HasUserData(void* aKey)
+  { return mUserData.Has(aKey); }
+  /**
+   * This getter can be used anytime. Ownership is retained by the layer
+   * manager.
+   */
+  LayerUserData* GetUserData(void* aKey)
+  { return mUserData.Get(aKey); }
 
   /**
    * Dynamic downcast to a Thebes layer. Returns null if this is not
@@ -519,7 +609,6 @@ protected:
     mNextSibling(nsnull),
     mPrevSibling(nsnull),
     mImplData(aImplData),
-    mUserData(nsnull),
     mOpacity(1.0),
     mUseClipRect(PR_FALSE),
     mIsOpaqueContent(PR_FALSE)
@@ -539,7 +628,7 @@ protected:
   Layer* mNextSibling;
   Layer* mPrevSibling;
   void* mImplData;
-  void* mUserData;
+  LayerUserDataSet mUserData;
   nsIntRegion mVisibleRegion;
   gfx3DMatrix mTransform;
   float mOpacity;
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 01c9797f776b..df505c492ba5 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -57,14 +57,19 @@ namespace {
 /**
  * This is the userdata we associate with a layer manager.
  */
-class LayerManagerData {
+class LayerManagerData : public LayerUserData {
 public:
   LayerManagerData() :
     mInvalidateAllThebesContent(PR_FALSE),
     mInvalidateAllLayers(PR_FALSE)
   {
+    MOZ_COUNT_CTOR(LayerManagerData);
+
     mFramesWithLayers.Init();
   }
+  ~LayerManagerData() {
+    MOZ_COUNT_DTOR(LayerManagerData);
+  }
 
   /**
    * Tracks which frames have layers associated with them.
@@ -304,18 +309,26 @@ protected:
 
 /**
  * The address of gThebesDisplayItemLayerUserData is used as the user
- * data pointer for ThebesLayers created by FrameLayerBuilder.
+ * data key for ThebesLayers created by FrameLayerBuilder.
  * It identifies ThebesLayers used to draw non-layer content, which are
  * therefore eligible for recycling. We want display items to be able to
  * create their own dedicated ThebesLayers in BuildLayer, if necessary,
  * and we wouldn't want to accidentally recycle those.
+ * The user data is null.
  */
-static PRUint8 gThebesDisplayItemLayerUserData;
+PRUint8 gThebesDisplayItemLayerUserData;
 /**
  * The address of gColorLayerUserData is used as the user
- * data pointer for ColorLayers
+ * data key for ColorLayers created by FrameLayerBuilder.
+ * The user data is null.
  */
-static PRUint8 gColorLayerUserData;
+PRUint8 gColorLayerUserData;
+/**
+ * The address of gLayerManagerUserData is used as the user
+ * data key for retained LayerManagers managed by FrameLayerBuilder.
+ * The user data is a LayerManagerData.
+ */
+PRUint8 gLayerManagerUserData;
 
 } // anonymous namespace
 
@@ -342,12 +355,11 @@ FrameLayerBuilder::InternalDestroyDisplayItemData(nsIFrame* aFrame,
   if (aRemoveFromFramesWithLayers) {
     LayerManager* manager = array->ElementAt(0).mLayer->Manager();
     LayerManagerData* data = static_cast<LayerManagerData*>
-      (manager->GetUserData());
+      (manager->GetUserData(&gLayerManagerUserData));
     NS_ASSERTION(data, "Frame with layer should have been recorded");
     data->mFramesWithLayers.RemoveEntry(aFrame);
     if (data->mFramesWithLayers.Count() == 0) {
-      delete data;
-      manager->SetUserData(nsnull);
+      manager->RemoveUserData(&gLayerManagerUserData);
       // Consume the reference we added when we set the user data
       // in DidEndTransaction. But don't actually release until we've
       // released all the layers in the DisplayItemData array below!
@@ -371,7 +383,7 @@ FrameLayerBuilder::WillBeginRetainedLayerTransaction(LayerManager* aManager)
 {
   mRetainingManager = aManager;
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (aManager->GetUserData());
+    (aManager->GetUserData(&gLayerManagerUserData));
   if (data) {
     mInvalidateAllThebesContent = data->mInvalidateAllThebesContent;
     mInvalidateAllLayers = data->mInvalidateAllLayers;
@@ -420,13 +432,13 @@ FrameLayerBuilder::WillEndTransaction(LayerManager* aManager)
   // correctly and the NS_FRAME_HAS_CONTAINER_LAYER bits will be set
   // correctly.
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (mRetainingManager->GetUserData());
+    (mRetainingManager->GetUserData(&gLayerManagerUserData));
   if (data) {
     // Update all the frames that used to have layers.
     data->mFramesWithLayers.EnumerateEntries(UpdateDisplayItemDataForFrame, this);
   } else {
     data = new LayerManagerData();
-    mRetainingManager->SetUserData(data);
+    mRetainingManager->SetUserData(&gLayerManagerUserData, data);
     // Addref mRetainingManager. We'll release it when 'data' is
     // removed.
     NS_ADDREF(mRetainingManager);
@@ -595,7 +607,7 @@ ContainerState::CreateOrRecycleColorLayer()
     if (!layer)
       return nsnull;
     // Mark this layer as being used for Thebes-painting display items
-    layer->SetUserData(&gColorLayerUserData);
+    layer->SetUserData(&gColorLayerUserData, nsnull);
   }
   return layer.forget();
 }
@@ -637,7 +649,7 @@ ContainerState::CreateOrRecycleThebesLayer(nsIFrame* aActiveScrolledRoot)
     if (!layer)
       return nsnull;
     // Mark this layer as being used for Thebes-painting display items
-    layer->SetUserData(&gThebesDisplayItemLayerUserData);
+    layer->SetUserData(&gThebesDisplayItemLayerUserData, nsnull);
   }
 
   // Set up transform so that 0,0 in the Thebes layer corresponds to the
@@ -965,7 +977,7 @@ ContainerState::ProcessDisplayItems(const nsDisplayList& aList,
 
       // Update that layer's clip and visible rects.
       NS_ASSERTION(ownLayer->Manager() == mManager, "Wrong manager");
-      NS_ASSERTION(ownLayer->GetUserData() != &gThebesDisplayItemLayerUserData,
+      NS_ASSERTION(!ownLayer->HasUserData(&gLayerManagerUserData),
                    "We shouldn't have a FrameLayerBuilder-managed layer here!");
       // It has its own layer. Update that layer's clip and visible rects.
       if (aClipRect) {
@@ -1119,10 +1131,9 @@ ContainerState::CollectOldLayers()
 {
   for (Layer* layer = mContainerLayer->GetFirstChild(); layer;
        layer = layer->GetNextSibling()) {
-    void* data = layer->GetUserData();
-    if (data == &gColorLayerUserData) {
+    if (layer->HasUserData(&gColorLayerUserData)) {
       mRecycledColorLayers.AppendElement(static_cast<ColorLayer*>(layer));
-    } else if (data == &gThebesDisplayItemLayerUserData) {
+    } else if (layer->HasUserData(&gThebesDisplayItemLayerUserData)) {
       NS_ASSERTION(layer->AsThebesLayer(), "Wrong layer type");
       mRecycledThebesLayers.AppendElement(static_cast<ThebesLayer*>(layer));
     }
@@ -1203,7 +1214,7 @@ FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder* aBuilder,
     Layer* oldLayer = GetOldLayerFor(aContainerFrame, containerDisplayItemKey);
     if (oldLayer) {
       NS_ASSERTION(oldLayer->Manager() == aManager, "Wrong manager");
-      if (oldLayer->GetUserData() == &gThebesDisplayItemLayerUserData) {
+      if (oldLayer->HasUserData(&gThebesDisplayItemLayerUserData)) {
         // The old layer for this item is actually our ThebesLayer
         // because we rendered its layer into that ThebesLayer. So we
         // don't actually have a retained container layer.
@@ -1276,7 +1287,7 @@ FrameLayerBuilder::GetLeafLayerFor(nsDisplayListBuilder* aBuilder,
   Layer* layer = GetOldLayerFor(f, aItem->GetPerFrameKey());
   if (!layer)
     return nsnull;
-  if (layer->GetUserData() == &gThebesDisplayItemLayerUserData) {
+  if (layer->HasUserData(&gThebesDisplayItemLayerUserData)) {
     // This layer was created to render Thebes-rendered content for this
     // display item. The display item should not use it for its own
     // layer rendering.
@@ -1352,7 +1363,7 @@ FrameLayerBuilder::InvalidateThebesLayersInSubtree(nsIFrame* aFrame)
 FrameLayerBuilder::InvalidateAllThebesLayerContents(LayerManager* aManager)
 {
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (aManager->GetUserData());
+    (aManager->GetUserData(&gLayerManagerUserData));
   if (data) {
     data->mInvalidateAllThebesContent = PR_TRUE;
   }
@@ -1362,7 +1373,7 @@ FrameLayerBuilder::InvalidateAllThebesLayerContents(LayerManager* aManager)
 FrameLayerBuilder::InvalidateAllLayers(LayerManager* aManager)
 {
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (aManager->GetUserData());
+    (aManager->GetUserData(&gLayerManagerUserData));
   if (data) {
     data->mInvalidateAllLayers = PR_TRUE;
   }
@@ -1380,9 +1391,9 @@ FrameLayerBuilder::HasDedicatedLayer(nsIFrame* aFrame, PRUint32 aDisplayItemKey)
     (reinterpret_cast<nsTArray<DisplayItemData>*>(&propValue));
   for (PRUint32 i = 0; i < array->Length(); ++i) {
     if (array->ElementAt(i).mDisplayItemKey == aDisplayItemKey) {
-      void* layerUserData = array->ElementAt(i).mLayer->GetUserData();
-      if (layerUserData != &gColorLayerUserData &&
-          layerUserData != &gThebesDisplayItemLayerUserData)
+      Layer* layer = array->ElementAt(i).mLayer;
+      if (!layer->HasUserData(&gColorLayerUserData) &&
+          !layer->HasUserData(&gThebesDisplayItemLayerUserData))
         return PR_TRUE;
     }
   }

From 0cbed2f6567a7c7ad7cde47519f4bcf0281adefb Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:39 +1200
Subject: [PATCH 006/222] Bug 579276. Part 2: If a transparent layer is over a
 solid background color, hoist that color into the layer to make it opaque.
 r=tnikkel

---
 layout/base/FrameLayerBuilder.cpp | 148 ++++++++++++++++++++++++++----
 layout/base/FrameLayerBuilder.h   |  20 ++++
 2 files changed, 148 insertions(+), 20 deletions(-)

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index df505c492ba5..3949bef8d325 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -64,10 +64,13 @@ public:
     mInvalidateAllLayers(PR_FALSE)
   {
     MOZ_COUNT_CTOR(LayerManagerData);
-
     mFramesWithLayers.Init();
   }
   ~LayerManagerData() {
+    // Remove display item data properties now, since we won't be able
+    // to find these frames again without mFramesWithLayers.
+    mFramesWithLayers.EnumerateEntries(
+        FrameLayerBuilder::RemoveDisplayItemDataForFrame, nsnull);
     MOZ_COUNT_DTOR(LayerManagerData);
   }
 
@@ -250,6 +253,12 @@ protected:
    * aItem in that layer.
    */
   void InvalidateForLayerChange(nsDisplayItem* aItem, Layer* aNewLayer);
+  /**
+   * Try to determine whether the ThebesLayer at aThebesLayerIndex
+   * has an opaque single color covering the visible area behind it.
+   * If successful, return that color, otherwise return NS_RGBA(0,0,0,0).
+   */
+  nscolor FindOpaqueBackgroundColorFor(PRInt32 aThebesLayerIndex);
   /**
    * Indicate that we are done adding items to the ThebesLayer at the top of
    * mThebesLayerDataStack. Set the final visible region and opaque-content
@@ -307,6 +316,15 @@ protected:
   PRPackedBool                     mInvalidateAllThebesContent;
 };
 
+class ThebesDisplayItemLayerUserData : public LayerUserData
+{
+public:
+  ThebesDisplayItemLayerUserData() :
+    mForcedBackgroundColor(NS_RGBA(0,0,0,0)) {}
+
+  nscolor mForcedBackgroundColor;
+};
+
 /**
  * The address of gThebesDisplayItemLayerUserData is used as the user
  * data key for ThebesLayers created by FrameLayerBuilder.
@@ -314,7 +332,7 @@ protected:
  * therefore eligible for recycling. We want display items to be able to
  * create their own dedicated ThebesLayers in BuildLayer, if necessary,
  * and we wouldn't want to accidentally recycle those.
- * The user data is null.
+ * The user data is a ThebesDisplayItemLayerUserData.
  */
 PRUint8 gThebesDisplayItemLayerUserData;
 /**
@@ -462,7 +480,7 @@ FrameLayerBuilder::UpdateDisplayItemDataForFrame(nsPtrHashKey<nsIFrame>* aEntry,
   nsIFrame* f = aEntry->GetKey();
   FrameProperties props = f->Properties();
   DisplayItemDataEntry* newDisplayItems =
-    builder->mNewDisplayItemData.GetEntry(f);
+    builder ? builder->mNewDisplayItemData.GetEntry(f) : nsnull;
   if (!newDisplayItems) {
     // This frame was visible, but isn't anymore.
     PRBool found;
@@ -649,7 +667,8 @@ ContainerState::CreateOrRecycleThebesLayer(nsIFrame* aActiveScrolledRoot)
     if (!layer)
       return nsnull;
     // Mark this layer as being used for Thebes-painting display items
-    layer->SetUserData(&gThebesDisplayItemLayerUserData, nsnull);
+    layer->SetUserData(&gThebesDisplayItemLayerUserData,
+        new ThebesDisplayItemLayerUserData());
   }
 
   // Set up transform so that 0,0 in the Thebes layer corresponds to the
@@ -709,6 +728,39 @@ SetVisibleRectForLayer(Layer* aLayer, const nsIntRect& aRect)
   }
 }
 
+nscolor
+ContainerState::FindOpaqueBackgroundColorFor(PRInt32 aThebesLayerIndex)
+{
+  ThebesLayerData* target = mThebesLayerDataStack[aThebesLayerIndex];
+  for (PRInt32 i = aThebesLayerIndex - 1; i >= 0; --i) {
+    ThebesLayerData* candidate = mThebesLayerDataStack[i];
+    nsIntRegion visibleAboveIntersection;
+    visibleAboveIntersection.And(candidate->mVisibleAboveRegion, target->mVisibleRegion);
+    if (!visibleAboveIntersection.IsEmpty()) {
+      // Some non-Thebes content between target and candidate; this is
+      // hopeless
+      break;
+    }
+
+    nsIntRegion intersection;
+    intersection.And(candidate->mVisibleRegion, target->mVisibleRegion);
+    if (intersection.IsEmpty()) {
+      // The layer doesn't intersect our target, ignore it and move on
+      continue;
+    }
+ 
+    // The candidate intersects our target. If any layer has a solid-color
+    // area behind our target, this must be it. Scan its display items.
+    nsPresContext* presContext = mContainerFrame->PresContext();
+    nscoord appUnitsPerDevPixel = presContext->AppUnitsPerDevPixel();
+    nsRect rect =
+      target->mVisibleRegion.GetBounds().ToAppUnits(appUnitsPerDevPixel);
+    return mBuilder->LayerBuilder()->
+      FindOpaqueColorCovering(mBuilder, candidate->mLayer, rect);
+  }
+  return NS_RGBA(0,0,0,0);
+}
+
 void
 ContainerState::PopThebesLayerData()
 {
@@ -717,21 +769,6 @@ ContainerState::PopThebesLayerData()
   PRInt32 lastIndex = mThebesLayerDataStack.Length() - 1;
   ThebesLayerData* data = mThebesLayerDataStack[lastIndex];
 
-  if (lastIndex > 0) {
-    // Since we're going to pop off the last ThebesLayerData, the
-    // mVisibleAboveRegion of the second-to-last item will need to include
-    // the regions of the last item.
-    ThebesLayerData* nextData = mThebesLayerDataStack[lastIndex - 1];
-    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
-                                     data->mVisibleAboveRegion);
-    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
-                                     data->mVisibleRegion);
-    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
-                                     data->mDrawAboveRegion);
-    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
-                                     data->mDrawRegion);
-  }
-
   Layer* layer;
   if (data->mIsSolidColorInVisibleRegion) {
     nsRefPtr<ColorLayer> colorLayer = CreateOrRecycleColorLayer();
@@ -778,7 +815,47 @@ ContainerState::PopThebesLayerData()
 
   nsIntRegion transparentRegion;
   transparentRegion.Sub(data->mVisibleRegion, data->mOpaqueRegion);
-  layer->SetIsOpaqueContent(transparentRegion.IsEmpty());
+  PRBool isOpaque = transparentRegion.IsEmpty();
+  // For translucent ThebesLayers, try to find an opaque background
+  // color that covers the entire area beneath it so we can pull that
+  // color into this layer to make it opaque.
+  if (layer == data->mLayer) {
+    nscolor backgroundColor = NS_RGBA(0,0,0,0);
+    if (!isOpaque) {
+      backgroundColor = FindOpaqueBackgroundColorFor(lastIndex);
+      if (NS_GET_A(backgroundColor) == 255) {
+        isOpaque = PR_TRUE;
+      }
+    }
+
+    // Store the background color
+    ThebesDisplayItemLayerUserData* userData =
+      static_cast<ThebesDisplayItemLayerUserData*>
+        (data->mLayer->GetUserData(&gThebesDisplayItemLayerUserData));
+    NS_ASSERTION(userData, "where did our user data go?");
+    if (userData->mForcedBackgroundColor != backgroundColor) {
+      // Invalidate the entire target ThebesLayer since we're changing
+      // the background color
+      data->mLayer->InvalidateRegion(data->mLayer->GetValidRegion());
+    }
+    userData->mForcedBackgroundColor = backgroundColor;
+  }
+  layer->SetIsOpaqueContent(isOpaque);
+
+  if (lastIndex > 0) {
+    // Since we're going to pop off the last ThebesLayerData, the
+    // mVisibleAboveRegion of the second-to-last item will need to include
+    // the regions of the last item.
+    ThebesLayerData* nextData = mThebesLayerDataStack[lastIndex - 1];
+    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
+                                     data->mVisibleAboveRegion);
+    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
+                                     data->mVisibleRegion);
+    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
+                                     data->mDrawAboveRegion);
+    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
+                                     data->mDrawRegion);
+  }
 
   mThebesLayerDataStack.RemoveElementAt(lastIndex);
 }
@@ -1126,6 +1203,28 @@ FrameLayerBuilder::AddLayerDisplayItem(Layer* aLayer,
   }
 }
 
+nscolor
+FrameLayerBuilder::FindOpaqueColorCovering(nsDisplayListBuilder* aBuilder,
+                                           ThebesLayer* aLayer,
+                                           const nsRect& aRect)
+{
+  ThebesLayerItemsEntry* entry = mThebesLayerItems.GetEntry(aLayer);
+  NS_ASSERTION(entry, "Must know about this layer!");
+  for (PRInt32 i = entry->mItems.Length() - 1; i >= 0; --i) {
+    nsDisplayItem* item = entry->mItems[i].mItem;
+    const nsRect& visible = item->GetVisibleRect();
+    if (!visible.Intersects(aRect))
+      continue;
+
+    nscolor color;
+    if (visible.Contains(aRect) && item->IsUniform(aBuilder, &color) &&
+        NS_GET_A(color) == 255)
+      return color;
+    break;
+  }
+  return NS_RGBA(0,0,0,0);
+}
+
 void
 ContainerState::CollectOldLayers()
 {
@@ -1422,6 +1521,15 @@ FrameLayerBuilder::DrawThebesLayer(ThebesLayer* aLayer,
     // so 'entry' could become invalid.
   }
 
+  ThebesDisplayItemLayerUserData* userData =
+    static_cast<ThebesDisplayItemLayerUserData*>
+      (aLayer->GetUserData(&gThebesDisplayItemLayerUserData));
+  NS_ASSERTION(userData, "where did our user data go?");
+  if (NS_GET_A(userData->mForcedBackgroundColor) > 0) {
+    aContext->SetColor(gfxRGBA(userData->mForcedBackgroundColor));
+    aContext->Paint();
+  }
+
   gfxMatrix transform;
   if (!aLayer->GetTransform().Is2D(&transform)) {
     NS_ERROR("non-2D transform in our Thebes layer!");
diff --git a/layout/base/FrameLayerBuilder.h b/layout/base/FrameLayerBuilder.h
index e3e082068994..4cce9ebbcb70 100644
--- a/layout/base/FrameLayerBuilder.h
+++ b/layout/base/FrameLayerBuilder.h
@@ -243,6 +243,26 @@ public:
    */
   Layer* GetOldLayerFor(nsIFrame* aFrame, PRUint32 aDisplayItemKey);
 
+  /**
+   * A useful hashtable iteration function that removes the
+   * DisplayItemData property for the frame, clears its
+   * NS_FRAME_HAS_CONTAINER_LAYER bit and returns PL_DHASH_REMOVE.
+   * aClosure is ignored.
+   */
+  static PLDHashOperator RemoveDisplayItemDataForFrame(nsPtrHashKey<nsIFrame>* aEntry,
+                                                       void* aClosure)
+  {
+    return UpdateDisplayItemDataForFrame(aEntry, nsnull);
+  }
+
+  /**
+   * Try to determine whether the ThebesLayer aLayer paints an opaque
+   * single color everywhere it's visible in aRect.
+   * If successful, return that color, otherwise return NS_RGBA(0,0,0,0).
+   */
+  nscolor FindOpaqueColorCovering(nsDisplayListBuilder* aBuilder,
+                                  ThebesLayer* aLayer, const nsRect& aRect);
+
 protected:
   /**
    * We store an array of these for each frame that is associated with

From 78d1a0aa883c03ef0829d0421aaafe098bdf2fd0 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:39 +1200
Subject: [PATCH 007/222] Bug 579276. Part 8: Bump scroll timeout up a lot.
 r=tnikkel

---
 layout/generic/nsGfxScrollFrame.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index df8ff01b4f95..364bf10385b5 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -1251,9 +1251,9 @@ IsSmoothScrollingEnabled()
 
 class ScrollFrameActivityTracker : public nsExpirationTracker<nsGfxScrollFrameInner,4> {
 public:
-  // Wait for 75-100ms between scrolls before we switch the appearance back to
-  // subpixel AA. That's 4 generations of 25ms each.
-  enum { TIMEOUT_MS = 25 };
+  // Wait for 3-4s between scrolls before we remove our layers.
+  // That's 4 generations of 1s each.
+  enum { TIMEOUT_MS = 1000 };
   ScrollFrameActivityTracker()
     : nsExpirationTracker<nsGfxScrollFrameInner,4>(TIMEOUT_MS) {}
   ~ScrollFrameActivityTracker() {

From 9558a29d0c231c74da83b70ceb1b1db8562ad92d Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:39 +1200
Subject: [PATCH 008/222] Bug 579276. Part 4: Move nsDisplayItem parameter down
 to ThebesLayerData::Accumulate. r=tnikkel

---
 layout/base/FrameLayerBuilder.cpp | 56 +++++++++++++------------------
 1 file changed, 24 insertions(+), 32 deletions(-)

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 3949bef8d325..1932ea1a5127 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -173,10 +173,10 @@ protected:
      * @param aSolidColor if non-null, the visible area of the item is
      * a constant color given by *aSolidColor
      */
-    void Accumulate(const nsIntRect& aVisibleRect,
-                    const nsIntRect& aDrawRect,
-                    const nsIntRect* aOpaqueRect,
-                    nscolor* aSolidColor);
+    void Accumulate(nsDisplayListBuilder* aBuilder,
+                    nsDisplayItem* aItem,
+                    const nsIntRect& aVisibleRect,
+                    const nsIntRect& aDrawRect);
     nsIFrame* GetActiveScrolledRoot() { return mActiveScrolledRoot; }
 
     /**
@@ -282,11 +282,10 @@ protected:
    * @param aSolidColor if non-null, indicates that every pixel in aVisibleRect
    * will be painted with aSolidColor by the item
    */
-  already_AddRefed<ThebesLayer> FindThebesLayerFor(const nsIntRect& aVisibleRect,
+  already_AddRefed<ThebesLayer> FindThebesLayerFor(nsDisplayItem* aItem,
+                                                   const nsIntRect& aVisibleRect,
                                                    const nsIntRect& aDrawRect,
-                                                   nsIFrame* aActiveScrolledRoot,
-                                                   const nsIntRect* aOpaqueRect,
-                                                   nscolor* aSolidColor);
+                                                   nsIFrame* aActiveScrolledRoot);
   ThebesLayerData* GetTopThebesLayerData()
   {
     return mThebesLayerDataStack.IsEmpty() ? nsnull
@@ -861,20 +860,21 @@ ContainerState::PopThebesLayerData()
 }
 
 void
-ContainerState::ThebesLayerData::Accumulate(const nsIntRect& aVisibleRect,
-                                            const nsIntRect& aDrawRect,
-                                            const nsIntRect* aOpaqueRect,
-                                            nscolor* aSolidColor)
+ContainerState::ThebesLayerData::Accumulate(nsDisplayListBuilder* aBuilder,
+                                            nsDisplayItem* aItem,
+                                            const nsIntRect& aVisibleRect,
+                                            const nsIntRect& aDrawRect)
 {
-  if (aSolidColor) {
+  nscolor uniformColor;
+  if (aItem->IsUniform(aBuilder, &uniformColor)) {
     if (mVisibleRegion.IsEmpty()) {
       // This color is all we have
-      mSolidColor = *aSolidColor;
+      mSolidColor = uniformColor;
       mIsSolidColorInVisibleRegion = PR_TRUE;
     } else if (mIsSolidColorInVisibleRegion &&
                mVisibleRegion.IsEqual(nsIntRegion(aVisibleRect))) {
       // we can just blend the colors together
-      mSolidColor = NS_ComposeColors(mSolidColor, *aSolidColor);
+      mSolidColor = NS_ComposeColors(mSolidColor, uniformColor);
     } else {
       mIsSolidColorInVisibleRegion = PR_FALSE;
     }
@@ -886,14 +886,15 @@ ContainerState::ThebesLayerData::Accumulate(const nsIntRect& aVisibleRect,
   mVisibleRegion.SimplifyOutward(4);
   mDrawRegion.Or(mDrawRegion, aDrawRect);
   mDrawRegion.SimplifyOutward(4);
-  if (aOpaqueRect) {
+
+  if (aItem->IsOpaque(aBuilder)) {
     // We don't use SimplifyInward here since it's not defined exactly
     // what it will discard. For our purposes the most important case
     // is a large opaque background at the bottom of z-order (e.g.,
     // a canvas background), so we need to make sure that the first rect
     // we see doesn't get discarded.
     nsIntRegion tmp;
-    tmp.Or(mOpaqueRegion, *aOpaqueRect);
+    tmp.Or(mOpaqueRegion, aDrawRect);
     if (tmp.GetNumRects() <= 4) {
       mOpaqueRegion = tmp;
     }
@@ -901,11 +902,10 @@ ContainerState::ThebesLayerData::Accumulate(const nsIntRect& aVisibleRect,
 }
 
 already_AddRefed<ThebesLayer>
-ContainerState::FindThebesLayerFor(const nsIntRect& aVisibleRect,
+ContainerState::FindThebesLayerFor(nsDisplayItem* aItem,
+                                   const nsIntRect& aVisibleRect,
                                    const nsIntRect& aDrawRect,
-                                   nsIFrame* aActiveScrolledRoot,
-                                   const nsIntRect* aOpaqueRect,
-                                   nscolor* aSolidColor)
+                                   nsIFrame* aActiveScrolledRoot)
 {
   PRInt32 i;
   PRInt32 lowestUsableLayerWithScrolledRoot = -1;
@@ -959,7 +959,7 @@ ContainerState::FindThebesLayerFor(const nsIntRect& aVisibleRect,
     layer = thebesLayerData->mLayer;
   }
 
-  thebesLayerData->Accumulate(aVisibleRect, aDrawRect, aOpaqueRect, aSolidColor);
+  thebesLayerData->Accumulate(mBuilder, aItem, aVisibleRect, aDrawRect);
   return layer.forget();
 }
 
@@ -1105,17 +1105,9 @@ ContainerState::ProcessDisplayItems(const nsDisplayList& aList,
           nsLayoutUtils::GetActiveScrolledRootFor(viewportFrame, mBuilder->ReferenceFrame());
       }
 
-      nscolor uniformColor;
-      PRBool isUniform = item->IsUniform(mBuilder, &uniformColor);
-      PRBool isOpaque = item->IsOpaque(mBuilder);
-      nsIntRect opaqueRect;
-      if (isOpaque) {
-        opaqueRect = item->GetBounds(mBuilder).ToNearestPixels(appUnitsPerDevPixel);
-      }
       nsRefPtr<ThebesLayer> thebesLayer =
-        FindThebesLayerFor(itemVisibleRect, itemDrawRect, activeScrolledRoot,
-                           isOpaque ? &opaqueRect : nsnull,
-                           isUniform ? &uniformColor : nsnull);
+        FindThebesLayerFor(item, itemVisibleRect, itemDrawRect,
+                           activeScrolledRoot);
 
       InvalidateForLayerChange(item, thebesLayer);
 

From 93076398d19c78cbe84db4ed7e6eaffbaebe52f7 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:40 +1200
Subject: [PATCH 009/222] Bug 579276. Part 3: Change Set/IsOpaqueContent API to
 a more generic Get/SetContentFlags API. r=cjones,sr=vlad

---
 content/canvas/src/WebGLContext.cpp           |  4 +-
 .../canvas/src/nsCanvasRenderingContext2D.cpp |  3 +-
 gfx/layers/Layers.cpp                         | 20 ++++++---
 gfx/layers/Layers.h                           | 41 ++++++++++++++-----
 gfx/layers/basic/BasicLayers.cpp              |  4 +-
 gfx/layers/d3d9/ThebesLayerD3D9.cpp           | 35 ++++------------
 gfx/layers/ipc/PLayers.ipdl                   |  2 +-
 gfx/layers/ipc/ShadowLayers.cpp               |  2 +-
 gfx/layers/ipc/ShadowLayersParent.cpp         |  2 +-
 layout/base/FrameLayerBuilder.cpp             |  6 ++-
 10 files changed, 67 insertions(+), 52 deletions(-)

diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index 9ac05fa7c7f6..071c3a3804fa 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -63,6 +63,7 @@
 
 using namespace mozilla;
 using namespace mozilla::gl;
+using namespace mozilla::layers;
 
 nsresult NS_NewCanvasRenderingContextWebGL(nsICanvasRenderingContextWebGL** aResult);
 
@@ -542,7 +543,8 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
     data.mGLBufferIsPremultiplied = PR_FALSE;
 
     canvasLayer->Initialize(data);
-    canvasLayer->SetIsOpaqueContent(gl->CreationFormat().alpha == 0 ? PR_TRUE : PR_FALSE);
+    PRUint32 flags = gl->CreationFormat().alpha == 0 ? Layer::CONTENT_OPAQUE : 0;
+    canvasLayer->SetContentFlags(flags);
     canvasLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
 
     mInvalidated = PR_FALSE;
diff --git a/content/canvas/src/nsCanvasRenderingContext2D.cpp b/content/canvas/src/nsCanvasRenderingContext2D.cpp
index d76eee6f82e8..49a9e52f909a 100644
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@@ -4174,7 +4174,8 @@ nsCanvasRenderingContext2D::GetCanvasLayer(CanvasLayer *aOldLayer,
     data.mSize = nsIntSize(mWidth, mHeight);
 
     canvasLayer->Initialize(data);
-    canvasLayer->SetIsOpaqueContent(mOpaque);
+    PRUint32 flags = mOpaque ? Layer::CONTENT_OPAQUE : 0;
+    canvasLayer->SetContentFlags(flags);
     canvasLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
 
     mResetLayer = PR_FALSE;
diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index cccbd3d76a4d..d622b01a5e9e 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -147,7 +147,7 @@ Layer::CanUseOpaqueSurface()
 {
   // If the visible content in the layer is opaque, there is no need
   // for an alpha channel.
-  if (IsOpaqueContent())
+  if (GetContentFlags() & CONTENT_OPAQUE)
     return PR_TRUE;
   // Also, if this layer is the bottommost layer in a container which
   // doesn't need an alpha channel, we can use an opaque surface for this
@@ -221,14 +221,24 @@ Layer::PrintInfo(nsACString& aTo, const char* aPrefix)
   if (mUseClipRect) {
     AppendToString(aTo, mClipRect, " [clip=", "]");
   }
-  if (!mTransform.IsIdentity())
+  if (!mTransform.IsIdentity()) {
     AppendToString(aTo, mTransform, " [transform=", "]");
-  if (!mVisibleRegion.IsEmpty())
+  }
+  if (!mVisibleRegion.IsEmpty()) {
     AppendToString(aTo, mVisibleRegion, " [visible=", "]");
-  if (1.0 != mOpacity)
+  }
+  if (1.0 != mOpacity) {
     aTo.AppendPrintf(" [opacity=%g]", mOpacity);
-  if (IsOpaqueContent())
+  }
+  if (GetContentFlags() & CONTENT_OPAQUE) {
     aTo += " [opaqueContent]";
+  }
+  if (GetContentFlags() & CONTENT_NO_TEXT) {
+    aTo += " [noText]";
+  }
+  if (GetContentFlags() & CONTENT_NO_TEXT_OVER_TRANSPARENT) {
+    aTo += " [noTextOverTransparent]";
+  }
 
   return aTo;
 }
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 6643d60f0062..66cd7798ecb9 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -416,17 +416,37 @@ public:
    */
   LayerManager* Manager() { return mManager; }
 
+  enum {
+    /**
+     * If this is set, the caller is promising that by the end of this
+     * transaction the entire visible region (as specified by
+     * SetVisibleRegion) will be filled with opaque content.
+     */
+    CONTENT_OPAQUE = 0x01,
+    /**
+     * ThebesLayers only!
+     * If this is set, the caller is promising that the visible region
+     * contains no text at all. If this is set,
+     * CONTENT_NO_TEXT_OVER_TRANSPARENT will also be set.
+     */
+    CONTENT_NO_TEXT = 0x02,
+    /**
+     * ThebesLayers only!
+     * If this is set, the caller is promising that the visible region
+     * contains no text over transparent pixels (any text, if present,
+     * is over fully opaque pixels).
+     */
+    CONTENT_NO_TEXT_OVER_TRANSPARENT = 0x04
+  };
   /**
    * CONSTRUCTION PHASE ONLY
-   * If this is called with aOpaque set to true, the caller is promising
-   * that by the end of this transaction the entire visible region
-   * (as specified by SetVisibleRegion) will be filled with opaque
-   * content. This enables some internal quality and performance
-   * optimizations.
+   * This lets layout make some promises about what will be drawn into the
+   * visible region of the ThebesLayer. This enables internal quality
+   * and performance optimizations.
    */
-  void SetIsOpaqueContent(PRBool aOpaque)
+  void SetContentFlags(PRUint32 aFlags)
   {
-    mIsOpaqueContent = aOpaque;
+    mContentFlags = aFlags;
     Mutated();
   }
   /**
@@ -509,7 +529,7 @@ public:
   // These getters can be used anytime.
   float GetOpacity() { return mOpacity; }
   const nsIntRect* GetClipRect() { return mUseClipRect ? &mClipRect : nsnull; }
-  PRBool IsOpaqueContent() { return mIsOpaqueContent; }
+  PRUint32 GetContentFlags() { return mContentFlags; }
   const nsIntRegion& GetVisibleRegion() { return mVisibleRegion; }
   ContainerLayer* GetParent() { return mParent; }
   Layer* GetNextSibling() { return mNextSibling; }
@@ -611,7 +631,8 @@ protected:
     mImplData(aImplData),
     mOpacity(1.0),
     mUseClipRect(PR_FALSE),
-    mIsOpaqueContent(PR_FALSE)
+    mContentFlags(0),
+    mUseClipRect(PR_FALSE)
     {}
 
   void Mutated() { mManager->Mutated(this); }
@@ -633,8 +654,8 @@ protected:
   gfx3DMatrix mTransform;
   float mOpacity;
   nsIntRect mClipRect;
+  PRUint32 mContentFlags;
   PRPackedBool mUseClipRect;
-  PRPackedBool mIsOpaqueContent;
 };
 
 /**
diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 217ad5926375..1cbac945e8a8 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -682,7 +682,7 @@ BasicCanvasLayer::Updated(const nsIntRect& aRect)
   if (mGLContext) {
     nsRefPtr<gfxImageSurface> isurf =
       new gfxImageSurface(gfxIntSize(mBounds.width, mBounds.height),
-                          IsOpaqueContent()
+                          (GetContentFlags() & CONTENT_OPAQUE)
                             ? gfxASurface::ImageFormatRGB24
                             : gfxASurface::ImageFormatARGB32);
     if (!isurf || isurf->CairoStatus() != 0) {
@@ -793,7 +793,7 @@ MayHaveOverlappingOrTransparentLayers(Layer* aLayer,
                                       const nsIntRect& aBounds,
                                       nsIntRegion* aDirtyVisibleRegionInContainer)
 {
-  if (!aLayer->IsOpaqueContent()) {
+  if (!(aLayer->GetContentFlags() & Layer::CONTENT_OPAQUE)) {
     return PR_TRUE;
   }
 
diff --git a/gfx/layers/d3d9/ThebesLayerD3D9.cpp b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
index 2c567b987577..a4147715fb40 100644
--- a/gfx/layers/d3d9/ThebesLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
@@ -46,27 +46,6 @@
 namespace mozilla {
 namespace layers {
 
-// Returns true if it's OK to save the contents of aLayer in an
-// opaque surface (a surface without an alpha channel).
-// If we can use a surface without an alpha channel, we should, because
-// it will often make painting of antialiased text faster and higher
-// quality.
-static PRBool
-UseOpaqueSurface(Layer* aLayer)
-{
-  // If the visible content in the layer is opaque, there is no need
-  // for an alpha channel.
-  if (aLayer->IsOpaqueContent())
-    return PR_TRUE;
-  // Also, if this layer is the bottommost layer in a container which
-  // doesn't need an alpha channel, we can use an opaque surface for this
-  // layer too. Any transparent areas must be covered by something else
-  // in the container.
-  ContainerLayer* parent = aLayer->GetParent();
-  return parent && parent->GetFirstChild() == aLayer &&
-         UseOpaqueSurface(parent);
-}
-
 ThebesLayerD3D9::ThebesLayerD3D9(LayerManagerD3D9 *aManager)
   : ThebesLayer(aManager, NULL)
   , LayerD3D9(aManager)
@@ -104,7 +83,7 @@ ThebesLayerD3D9::SetVisibleRegion(const nsIntRegion &aRegion)
     return;
   }
 
-  D3DFORMAT fmt = (UseOpaqueSurface(this) && !mD2DSurface) ?
+  D3DFORMAT fmt = (CanUseOpaqueSurface() && !mD2DSurface) ?
                     D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
 
   D3DSURFACE_DESC desc;
@@ -198,7 +177,7 @@ ThebesLayerD3D9::RenderLayer()
 
   // We differentiate between these formats since D3D9 will only allow us to
   // call GetDC on an opaque surface.
-  D3DFORMAT fmt = (UseOpaqueSurface(this) && !mD2DSurface) ?
+  D3DFORMAT fmt = (CanUseOpaqueSurface() && !mD2DSurface) ?
                     D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
 
   if (mTexture) {
@@ -314,7 +293,7 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
   }
 #endif
 
-  D3DFORMAT fmt = UseOpaqueSurface(this) ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
+  D3DFORMAT fmt = CanUseOpaqueSurface() ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
   nsIntRect bounds = aRegion.GetBounds();
 
   gfxASurface::gfxImageFormat imageFormat = gfxASurface::ImageFormatARGB32;
@@ -327,7 +306,7 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
 
   nsRefPtr<IDirect3DSurface9> surf;
   HDC dc;
-  if (UseOpaqueSurface(this)) {
+  if (CanUseOpaqueSurface()) {
     hr = tmpTexture->GetSurfaceLevel(0, getter_AddRefs(surf));
 
     if (FAILED(hr)) {
@@ -360,7 +339,7 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
   LayerManagerD3D9::CallbackInfo cbInfo = mD3DManager->GetCallbackInfo();
   cbInfo.Callback(this, context, aRegion, nsIntRegion(), cbInfo.CallbackData);
 
-  if (UseOpaqueSurface(this)) {
+  if (CanUseOpaqueSurface()) {
     surf->ReleaseDC(dc);
   } else {
     D3DLOCKED_RECT r;
@@ -423,7 +402,7 @@ ThebesLayerD3D9::CreateNewTexture(const gfxIntSize &aSize)
                                   D3DUSAGE_RENDERTARGET, D3DFMT_A8R8G8B8,
                                   D3DPOOL_DEFAULT, getter_AddRefs(mTexture), &sharedHandle);
 
-          mD2DSurface = new gfxD2DSurface(sharedHandle, UseOpaqueSurface(this) ?
+          mD2DSurface = new gfxD2DSurface(sharedHandle, CanUseOpaqueSurface() ?
             gfxASurface::CONTENT_COLOR : gfxASurface::CONTENT_COLOR_ALPHA);
 
           // If there's an error, go on and do what we always do.
@@ -436,7 +415,7 @@ ThebesLayerD3D9::CreateNewTexture(const gfxIntSize &aSize)
 #endif
   if (!mTexture) {
     device()->CreateTexture(aSize.width, aSize.height, 1,
-                            D3DUSAGE_RENDERTARGET, UseOpaqueSurface(this) ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8,
+                            D3DUSAGE_RENDERTARGET, CanUseOpaqueSurface() ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8,
                             D3DPOOL_DEFAULT, getter_AddRefs(mTexture), NULL);
   }
 }
diff --git a/gfx/layers/ipc/PLayers.ipdl b/gfx/layers/ipc/PLayers.ipdl
index 7f90abff46c9..fdde16ca6893 100644
--- a/gfx/layers/ipc/PLayers.ipdl
+++ b/gfx/layers/ipc/PLayers.ipdl
@@ -93,7 +93,7 @@ struct OpCreateImageBuffer {
 struct CommonLayerAttributes {
   nsIntRegion visibleRegion;
   gfx3DMatrix transform;
-  bool isOpaqueContent;
+  PRUint32 contentFlags;
   float opacity;
   bool useClipRect;
   nsIntRect clipRect;
diff --git a/gfx/layers/ipc/ShadowLayers.cpp b/gfx/layers/ipc/ShadowLayers.cpp
index f0222eb63c08..dc6b1ea6de32 100644
--- a/gfx/layers/ipc/ShadowLayers.cpp
+++ b/gfx/layers/ipc/ShadowLayers.cpp
@@ -271,7 +271,7 @@ ShadowLayerForwarder::EndTransaction(nsTArray<EditReply>* aReplies)
     CommonLayerAttributes& common = attrs.common();
     common.visibleRegion() = mutant->GetVisibleRegion();
     common.transform() = mutant->GetTransform();
-    common.isOpaqueContent() = mutant->IsOpaqueContent();
+    common.contentFlags() = mutant->GetContentFlags();
     common.opacity() = mutant->GetOpacity();
     common.useClipRect() = !!mutant->GetClipRect();
     common.clipRect() = (common.useClipRect() ?
diff --git a/gfx/layers/ipc/ShadowLayersParent.cpp b/gfx/layers/ipc/ShadowLayersParent.cpp
index 9b4b71428132..e61d886bce39 100644
--- a/gfx/layers/ipc/ShadowLayersParent.cpp
+++ b/gfx/layers/ipc/ShadowLayersParent.cpp
@@ -229,7 +229,7 @@ ShadowLayersParent::RecvUpdate(const nsTArray<Edit>& cset,
 
       const CommonLayerAttributes& common = attrs.common();
       layer->SetVisibleRegion(common.visibleRegion());
-      layer->SetIsOpaqueContent(common.isOpaqueContent());
+      layer->SetContentFlags(common.contentFlags());
       layer->SetOpacity(common.opacity());
       layer->SetClipRect(common.useClipRect() ? &common.clipRect() : NULL);
       layer->SetTransform(common.transform());
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 1932ea1a5127..d35fa352770d 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -839,7 +839,8 @@ ContainerState::PopThebesLayerData()
     }
     userData->mForcedBackgroundColor = backgroundColor;
   }
-  layer->SetIsOpaqueContent(isOpaque);
+  PRUint32 flags = isOpaque ? Layer::CONTENT_OPAQUE : 0;
+  layer->SetContentFlags(flags);
 
   if (lastIndex > 0) {
     // Since we're going to pop off the last ThebesLayerData, the
@@ -1361,7 +1362,8 @@ FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder* aBuilder,
   state.ProcessDisplayItems(aChildren, nsnull);
   state.Finish();
 
-  containerLayer->SetIsOpaqueContent(aChildren.IsOpaque());
+  PRUint32 flags = aChildren.IsOpaque() ? Layer::CONTENT_OPAQUE : 0;
+  containerLayer->SetContentFlags(flags);
   return containerLayer.forget();
 }
 

From 396aec34d835b116ece14ff5ba6a9f22217dbbef Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:40 +1200
Subject: [PATCH 010/222] Bug 579276. Part 5: Set CONTENT_NO_TEXT and
 CONTENT_NO_TEXT_OVER_TRANSPARENT flags. r=tnikkel

---
 layout/base/FrameLayerBuilder.cpp | 38 +++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index d35fa352770d..b0dcb3c1bcec 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -159,7 +159,8 @@ protected:
   public:
     ThebesLayerData() :
       mActiveScrolledRoot(nsnull), mLayer(nsnull),
-      mIsSolidColorInVisibleRegion(PR_FALSE) {}
+      mIsSolidColorInVisibleRegion(PR_FALSE),
+      mHasText(PR_FALSE), mHasTextOverTransparent(PR_FALSE) {}
     /**
      * Record that an item has been added to the ThebesLayer, so we
      * need to update our regions.
@@ -228,6 +229,15 @@ protected:
      * True if every pixel in mVisibleRegion will have color mSolidColor.
      */
     PRPackedBool mIsSolidColorInVisibleRegion;
+    /**
+     * True if there is any text visible in the layer.
+     */
+    PRPackedBool mHasText;
+    /**
+     * True if there is any text visible in the layer that's over
+     * transparent pixels in the layer.
+     */
+    PRPackedBool mHasTextOverTransparent;
   };
 
   /**
@@ -839,7 +849,10 @@ ContainerState::PopThebesLayerData()
     }
     userData->mForcedBackgroundColor = backgroundColor;
   }
-  PRUint32 flags = isOpaque ? Layer::CONTENT_OPAQUE : 0;
+  PRUint32 flags =
+    (isOpaque ? Layer::CONTENT_OPAQUE : 0) |
+    (data->mHasText ? 0 : Layer::CONTENT_NO_TEXT) |
+    (data->mHasTextOverTransparent ? 0 : Layer::CONTENT_NO_TEXT_OVER_TRANSPARENT);
   layer->SetContentFlags(flags);
 
   if (lastIndex > 0) {
@@ -860,6 +873,22 @@ ContainerState::PopThebesLayerData()
   mThebesLayerDataStack.RemoveElementAt(lastIndex);
 }
 
+static PRBool
+IsText(nsDisplayItem* aItem) {
+  switch (aItem->GetType()) {
+  case nsDisplayItem::TYPE_TEXT:
+  case nsDisplayItem::TYPE_BULLET:
+  case nsDisplayItem::TYPE_HEADER_FOOTER:
+  case nsDisplayItem::TYPE_MATHML_CHAR_FOREGROUND:
+#ifdef MOZ_XUL
+  case nsDisplayItem::TYPE_XUL_TEXT_BOX:
+#endif
+    return PR_TRUE;
+  default:
+    return PR_FALSE;
+  }
+}
+
 void
 ContainerState::ThebesLayerData::Accumulate(nsDisplayListBuilder* aBuilder,
                                             nsDisplayItem* aItem,
@@ -899,6 +928,11 @@ ContainerState::ThebesLayerData::Accumulate(nsDisplayListBuilder* aBuilder,
     if (tmp.GetNumRects() <= 4) {
       mOpaqueRegion = tmp;
     }
+  } else if (IsText(aItem)) {
+    mHasText = PR_TRUE;
+    if (!mOpaqueRegion.Contains(aVisibleRect)) {
+      mHasTextOverTransparent = PR_TRUE;
+    }
   }
 }
 

From 359694e23433cfa051d66091d8742ea124cf4490 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:41 +1200
Subject: [PATCH 011/222] Bug 579276. Part 6: Add
 gfxASurface::GetTextQualityInTransparentSurfaces API. r=jrmuizel,sr=vlad

---
 gfx/thebes/gfxASurface.h       | 35 +++++++++++++++++++++++++++++++++-
 gfx/thebes/gfxD2DSurface.h     |  6 ++++++
 gfx/thebes/gfxQuartzSurface.h  |  4 ++++
 gfx/thebes/gfxWindowsSurface.h |  5 +++++
 gfx/thebes/gfxXlibSurface.h    |  5 +++++
 5 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/gfx/thebes/gfxASurface.h b/gfx/thebes/gfxASurface.h
index 9ee195608ad0..4a746f717d2b 100644
--- a/gfx/thebes/gfxASurface.h
+++ b/gfx/thebes/gfxASurface.h
@@ -153,7 +153,40 @@ public:
      */
     virtual PRBool AreSimilarSurfacesSensitiveToContentType()
     {
-      return PR_TRUE;
+        return PR_TRUE;
+    }
+
+    enum TextQuality {
+        /**
+         * TEXT_QUALITY_OK means that text is always rendered to a
+         * transparent surface just as well as it would be rendered to an
+         * opaque surface. This would normally only be true if
+         * subpixel antialiasing is disabled or if the platform's
+         * transparent surfaces support component alpha.
+         */
+        TEXT_QUALITY_OK,
+        /**
+         * TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS means that text is rendered
+         * to a transparent surface just as well as it would be rendered to an
+         * opaque surface, but only if all the pixels the text is drawn
+         * over already have opaque alpha values.
+         */
+        TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS,
+        /**
+         * TEXT_QUALITY_BAD means that text is rendered
+         * to a transparent surface worse than it would be rendered to an
+         * opaque surface, even if all the pixels the text is drawn
+         * over already have opaque alpha values.
+         */
+        TEXT_QUALITY_BAD
+    };
+    /**
+     * Determine how well text would be rendered in transparent surfaces that
+     * are similar to this surface.
+     */
+    virtual TextQuality GetTextQualityInTransparentSurfaces()
+    {
+        return TEXT_QUALITY_BAD;
     }
 
     int CairoStatus();
diff --git a/gfx/thebes/gfxD2DSurface.h b/gfx/thebes/gfxD2DSurface.h
index 1a3d641fdc57..3a08ffc5e103 100644
--- a/gfx/thebes/gfxD2DSurface.h
+++ b/gfx/thebes/gfxD2DSurface.h
@@ -57,6 +57,12 @@ public:
 
     virtual ~gfxD2DSurface();
 
+    virtual TextQuality GetTextQualityInTransparentSurfaces()
+    {
+      // D2D always draws text in transparent surfaces with grayscale-AA,
+      // even if the text is over opaque pixels.
+      return TEXT_QUALITY_BAD;
+    }
 
     void Present();
     void Scroll(const nsIntPoint &aDelta, const nsIntRect &aClip);
diff --git a/gfx/thebes/gfxQuartzSurface.h b/gfx/thebes/gfxQuartzSurface.h
index 5fbbe4040865..1fd5fd773175 100644
--- a/gfx/thebes/gfxQuartzSurface.h
+++ b/gfx/thebes/gfxQuartzSurface.h
@@ -60,6 +60,10 @@ public:
     {
       return PR_FALSE;
     }
+    virtual TextQuality GetTextQualityInTransparentSurfaces()
+    {
+      return TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS;
+    }
 
     const gfxSize& GetSize() const { return mSize; }
 
diff --git a/gfx/thebes/gfxWindowsSurface.h b/gfx/thebes/gfxWindowsSurface.h
index 20230ec799b6..0da4fe3d1f77 100644
--- a/gfx/thebes/gfxWindowsSurface.h
+++ b/gfx/thebes/gfxWindowsSurface.h
@@ -81,6 +81,11 @@ public:
                                                       const gfxIntSize& size,
                                                       gfxImageFormat format);
 
+    virtual TextQuality GetTextQualityInTransparentSurfaces()
+    {
+      return TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS;
+    }
+
     nsresult BeginPrinting(const nsAString& aTitle, const nsAString& aPrintToFileName);
     nsresult EndPrinting();
     nsresult AbortPrinting();
diff --git a/gfx/thebes/gfxXlibSurface.h b/gfx/thebes/gfxXlibSurface.h
index ad07f74d1efe..e3b1d1f0b613 100644
--- a/gfx/thebes/gfxXlibSurface.h
+++ b/gfx/thebes/gfxXlibSurface.h
@@ -77,6 +77,11 @@ public:
     virtual already_AddRefed<gfxASurface>
     CreateSimilarSurface(gfxContentType aType, const gfxIntSize& aSize);
 
+    virtual TextQuality GetTextQualityInTransparentSurfaces()
+    {
+      return TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS;
+    }
+
     const gfxIntSize& GetSize() { return mSize; }
 
     Display* XDisplay() { return mDisplay; }

From 2fb2fc7212c953d52a05a873bb38abfa3d0fff82 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:41 +1200
Subject: [PATCH 012/222] Bug 579276. Part 7: Don't retain transparent layers
 that would hurt text rendering. r=cjones

---
 gfx/layers/basic/BasicLayers.cpp | 41 +++++++++++++++++++++++---------
 1 file changed, 30 insertions(+), 11 deletions(-)

diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 1cbac945e8a8..1bb1a8e539a9 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -367,6 +367,23 @@ InheritContextFlags(gfxContext* aSource, gfxContext* aDest)
   }
 }
 
+static PRBool
+ShouldRetainTransparentSurface(PRUint32 aContentFlags,
+                               gfxASurface* aTargetSurface)
+{
+  if (aContentFlags & Layer::CONTENT_NO_TEXT)
+    return PR_TRUE;
+
+  switch (aTargetSurface->GetTextQualityInTransparentSurfaces()) {
+  case gfxASurface::TEXT_QUALITY_OK:
+    return PR_TRUE;
+  case gfxASurface::TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS:
+    return (aContentFlags & Layer::CONTENT_NO_TEXT_OVER_TRANSPARENT) != 0;
+  default:
+    return PR_FALSE;
+  }
+}
+
 void
 BasicThebesLayer::Paint(gfxContext* aContext,
                         LayerManager::DrawThebesLayerCallback aCallback,
@@ -377,15 +394,20 @@ BasicThebesLayer::Paint(gfxContext* aContext,
                "Can only draw in drawing phase");
   gfxContext* target = BasicManager()->GetTarget();
   NS_ASSERTION(target, "We shouldn't be called if there's no target");
+  nsRefPtr<gfxASurface> targetSurface = aContext->CurrentSurface();
+
+  PRBool canUseOpaqueSurface = CanUseOpaqueSurface();
+  if (!BasicManager()->IsRetained() ||
+      (aOpacity == 1.0 && !canUseOpaqueSurface &&
+       !ShouldRetainTransparentSurface(mContentFlags, targetSurface))) {
+    mValidRegion.SetEmpty();
+    mBuffer.Clear();
 
-  if (!BasicManager()->IsRetained()) {
     if (aOpacity != 1.0) {
       target->Save();
       ClipToContain(target, mVisibleRegion.GetBounds());
       target->PushGroup(gfxASurface::CONTENT_COLOR_ALPHA);
     }
-    mValidRegion.SetEmpty();
-    mBuffer.Clear();
     aCallback(this, target, mVisibleRegion, nsIntRegion(), aCallbackData);
     if (aOpacity != 1.0) {
       target->PopGroupToSource();
@@ -395,15 +417,12 @@ BasicThebesLayer::Paint(gfxContext* aContext,
     return;
   }
 
-  nsRefPtr<gfxASurface> targetSurface = aContext->CurrentSurface();
-  PRBool isOpaqueContent =
-    (targetSurface->AreSimilarSurfacesSensitiveToContentType() &&
-     aOpacity == 1.0 &&
-     CanUseOpaqueSurface());
   {
+    PRBool opaqueBuffer = canUseOpaqueSurface &&
+      targetSurface->AreSimilarSurfacesSensitiveToContentType();
     Buffer::ContentType contentType =
-      isOpaqueContent ? gfxASurface::CONTENT_COLOR :
-                        gfxASurface::CONTENT_COLOR_ALPHA;
+      opaqueBuffer ? gfxASurface::CONTENT_COLOR :
+                     gfxASurface::CONTENT_COLOR_ALPHA;
     Buffer::PaintState state = mBuffer.BeginPaint(this, contentType);
     mValidRegion.Sub(mValidRegion, state.mRegionToInvalidate);
 
@@ -425,7 +444,7 @@ BasicThebesLayer::Paint(gfxContext* aContext,
     }
   }
 
-  mBuffer.DrawTo(this, isOpaqueContent, target, aOpacity);
+  mBuffer.DrawTo(this, canUseOpaqueSurface, target, aOpacity);
 }
 
 void

From 7cf896283abf3df90f74ef21070e0fd0d9dd36dd Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:41 +1200
Subject: [PATCH 013/222] Bug 579276. Part 9: Backout 4d1dc2ea47fd since we no
 longer need those test changes

---
 layout/reftests/bidi/logicalmarquee.html  | 2 +-
 layout/reftests/bidi/marquee-ref.html     | 2 +-
 layout/reftests/bidi/visualmarquee.html   | 2 +-
 layout/reftests/marquee/413027-4-ref.html | 2 +-
 layout/reftests/marquee/413027-4.html     | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/layout/reftests/bidi/logicalmarquee.html b/layout/reftests/bidi/logicalmarquee.html
index 9ba9d6306cf4..cb13827dec7b 100644
--- a/layout/reftests/bidi/logicalmarquee.html
+++ b/layout/reftests/bidi/logicalmarquee.html
@@ -6,6 +6,6 @@
   </head>
 
   <body>
-    <marquee scrollamount="0" behavior="alternate" direction="right" style="opacity:0.9">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</marquee>
+    <marquee scrollamount="0" behavior="alternate" direction="right">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</marquee>
  </body>
 </html>
diff --git a/layout/reftests/bidi/marquee-ref.html b/layout/reftests/bidi/marquee-ref.html
index 724e4f8559d2..d8778dc88063 100644
--- a/layout/reftests/bidi/marquee-ref.html
+++ b/layout/reftests/bidi/marquee-ref.html
@@ -6,6 +6,6 @@
   </head>
 
   <body>
-    <div dir="rtl" align="left" style="opacity:0.9">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</div>
+    <div dir="rtl" align="left">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</div>
  </body>
 </html>
diff --git a/layout/reftests/bidi/visualmarquee.html b/layout/reftests/bidi/visualmarquee.html
index 51a559469124..932fd775a191 100644
--- a/layout/reftests/bidi/visualmarquee.html
+++ b/layout/reftests/bidi/visualmarquee.html
@@ -6,6 +6,6 @@
   </head>
 
   <body>
-    <marquee scrollamount="0" behavior="alternate" direction="right" style="opacity:0.9">&#x05DD;&#x05D9;&#x05DC;&#x05D9;&#x05DC;&#x05E6;&#x05D4; &#x05D5;&#x05E1;&#x05E0;&#x05D5; &#x05DD;&#x05D5;&#x05D9;&#x05D4; &#x05D7;&#x05D5;&#x05E4;&#x05D9;&#x05E9; &#x05D3;&#x05E2;</marquee>
+    <marquee scrollamount="0" behavior="alternate" direction="right">&#x05DD;&#x05D9;&#x05DC;&#x05D9;&#x05DC;&#x05E6;&#x05D4; &#x05D5;&#x05E1;&#x05E0;&#x05D5; &#x05DD;&#x05D5;&#x05D9;&#x05D4; &#x05D7;&#x05D5;&#x05E4;&#x05D9;&#x05E9; &#x05D3;&#x05E2;</marquee>
  </body>
 </html>
diff --git a/layout/reftests/marquee/413027-4-ref.html b/layout/reftests/marquee/413027-4-ref.html
index fbe705e414da..22fdd42e6016 100644
--- a/layout/reftests/marquee/413027-4-ref.html
+++ b/layout/reftests/marquee/413027-4-ref.html
@@ -4,7 +4,7 @@
 <body>
 
 <div style="background-color: lime; width: 600px; float:left;">
-  <div style="margin: 100px 0px; padding-left: 2px; opacity:0.9;">text</div>
+  <div style="margin: 100px 0px; padding-left: 2px;">text</div>
 </div>
       
 </body></html>
diff --git a/layout/reftests/marquee/413027-4.html b/layout/reftests/marquee/413027-4.html
index beb15e6f752a..d57f2f121517 100644
--- a/layout/reftests/marquee/413027-4.html
+++ b/layout/reftests/marquee/413027-4.html
@@ -8,7 +8,7 @@
 <!-- padding-left used to avoid risk of an antialiasing pixel that may
      project to the left of the origin, causing a spurious test failure
      (see bugs 476927, 475968) -->
-  <div style="margin: 100px 0px; padding-left: 2px; opacity:0.9;">text</div>
+  <div style="margin: 100px 0px; padding-left: 2px;">text</div>
 </div>
 </marquee>
       

From 83b82d6db1dd2c5a4fbd582937fa0c471d0d2aab Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:19:24 +1200
Subject: [PATCH 014/222] Bug 579276. Part 10: add a couple of scrolling tests
 to ensure that text looks good when scrolled in an overflow:auto div.
 a=blocking

---
 layout/reftests/scrolling/fixed-text-1.html |  7 +++++++
 layout/reftests/scrolling/reftest.list      |  2 ++
 layout/reftests/scrolling/text-1.html       | 10 ++++++++++
 3 files changed, 19 insertions(+)
 create mode 100644 layout/reftests/scrolling/fixed-text-1.html
 create mode 100644 layout/reftests/scrolling/text-1.html

diff --git a/layout/reftests/scrolling/fixed-text-1.html b/layout/reftests/scrolling/fixed-text-1.html
new file mode 100644
index 000000000000..d470a7c6415d
--- /dev/null
+++ b/layout/reftests/scrolling/fixed-text-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE HTML>
+<html>
+<body style="height:2000px; overflow:hidden; background:url(repeatable-diagonal-gradient.png) fixed;">
+<script src="scrolling.js"></script>
+<p>Hello Kitty
+</body>
+</html>
diff --git a/layout/reftests/scrolling/reftest.list b/layout/reftests/scrolling/reftest.list
index bfdc32a7ad77..e227cefd356b 100644
--- a/layout/reftests/scrolling/reftest.list
+++ b/layout/reftests/scrolling/reftest.list
@@ -1,5 +1,7 @@
 HTTP == fixed-1.html fixed-1.html?ref
+HTTP == fixed-text-1.html fixed-text-1.html?ref
 HTTP == opacity-mixed-scrolling-1.html opacity-mixed-scrolling-1.html?ref
 HTTP == simple-1.html simple-1.html?ref
+HTTP == text-1.html text-1.html?ref
 == uncovering-1.html uncovering-1-ref.html
 == uncovering-2.html uncovering-2-ref.html
diff --git a/layout/reftests/scrolling/text-1.html b/layout/reftests/scrolling/text-1.html
new file mode 100644
index 000000000000..0ede92a6fa28
--- /dev/null
+++ b/layout/reftests/scrolling/text-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<script src="scrolling.js"></script>
+<div class="scrollTop" style="height:100px; overflow:auto;">
+  <div style="margin-top:30px;">Hello Kitty</div>
+  <div style="height:400px;"></div>
+</div>
+</body>
+</html>

From df7ddc69f934b510816948e190674e00c338e8c8 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 22:15:17 +1200
Subject: [PATCH 015/222] Fixing bustage, a=me

---
 gfx/layers/Layers.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 66cd7798ecb9..fe1e996f2979 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -630,7 +630,6 @@ protected:
     mPrevSibling(nsnull),
     mImplData(aImplData),
     mOpacity(1.0),
-    mUseClipRect(PR_FALSE),
     mContentFlags(0),
     mUseClipRect(PR_FALSE)
     {}

From cfb7f48514d4f9338fa55ecbbd1e9ccf1bcd1c65 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 23:14:25 +1200
Subject: [PATCH 016/222] Backing out bug 579276. a=me

---
 content/canvas/src/WebGLContext.cpp           |   8 +-
 .../canvas/src/nsCanvasRenderingContext2D.cpp |   7 +-
 gfx/layers/Layers.cpp                         |  20 +-
 gfx/layers/Layers.h                           | 155 ++-------
 gfx/layers/basic/BasicLayers.cpp              |  45 +--
 gfx/layers/d3d9/ThebesLayerD3D9.cpp           |  35 ++-
 gfx/layers/ipc/PLayers.ipdl                   |   2 +-
 gfx/layers/ipc/ShadowLayers.cpp               |   2 +-
 gfx/layers/ipc/ShadowLayersParent.cpp         |   2 +-
 gfx/thebes/gfxASurface.h                      |  35 +--
 gfx/thebes/gfxD2DSurface.h                    |   6 -
 gfx/thebes/gfxQuartzSurface.h                 |   4 -
 gfx/thebes/gfxWindowsSurface.h                |   5 -
 gfx/thebes/gfxXlibSurface.h                   |   5 -
 layout/base/FrameLayerBuilder.cpp             | 297 +++++-------------
 layout/base/FrameLayerBuilder.h               |  20 --
 layout/generic/nsGfxScrollFrame.cpp           |   6 +-
 layout/reftests/bidi/logicalmarquee.html      |   2 +-
 layout/reftests/bidi/marquee-ref.html         |   2 +-
 layout/reftests/bidi/visualmarquee.html       |   2 +-
 layout/reftests/marquee/413027-4-ref.html     |   2 +-
 layout/reftests/marquee/413027-4.html         |   2 +-
 layout/reftests/scrolling/fixed-text-1.html   |   7 -
 layout/reftests/scrolling/reftest.list        |   2 -
 layout/reftests/scrolling/text-1.html         |  10 -
 25 files changed, 162 insertions(+), 521 deletions(-)
 delete mode 100644 layout/reftests/scrolling/fixed-text-1.html
 delete mode 100644 layout/reftests/scrolling/text-1.html

diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index 071c3a3804fa..5b4f9dfbc177 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -63,7 +63,6 @@
 
 using namespace mozilla;
 using namespace mozilla::gl;
-using namespace mozilla::layers;
 
 nsresult NS_NewCanvasRenderingContextWebGL(nsICanvasRenderingContextWebGL** aResult);
 
@@ -509,7 +508,7 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
                              LayerManager *aManager)
 {
     if (!mResetLayer && aOldLayer &&
-        aOldLayer->HasUserData(&gWebGLLayerUserData)) {
+        aOldLayer->GetUserData() == &gWebGLLayerUserData) {
         NS_ADDREF(aOldLayer);
         if (mInvalidated) {
             aOldLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
@@ -523,7 +522,7 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
         NS_WARNING("CreateCanvasLayer returned null!");
         return nsnull;
     }
-    canvasLayer->SetUserData(&gWebGLLayerUserData, nsnull);
+    canvasLayer->SetUserData(&gWebGLLayerUserData);
 
     CanvasLayer::Data data;
 
@@ -543,8 +542,7 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
     data.mGLBufferIsPremultiplied = PR_FALSE;
 
     canvasLayer->Initialize(data);
-    PRUint32 flags = gl->CreationFormat().alpha == 0 ? Layer::CONTENT_OPAQUE : 0;
-    canvasLayer->SetContentFlags(flags);
+    canvasLayer->SetIsOpaqueContent(gl->CreationFormat().alpha == 0 ? PR_TRUE : PR_FALSE);
     canvasLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
 
     mInvalidated = PR_FALSE;
diff --git a/content/canvas/src/nsCanvasRenderingContext2D.cpp b/content/canvas/src/nsCanvasRenderingContext2D.cpp
index 49a9e52f909a..c0a9f753d196 100644
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@@ -4154,7 +4154,7 @@ nsCanvasRenderingContext2D::GetCanvasLayer(CanvasLayer *aOldLayer,
         return nsnull;
 
     if (!mResetLayer && aOldLayer &&
-        aOldLayer->HasUserData(&g2DContextLayerUserData)) {
+        aOldLayer->GetUserData() == &g2DContextLayerUserData) {
         NS_ADDREF(aOldLayer);
         // XXX Need to just update the changed area here
         aOldLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
@@ -4166,7 +4166,7 @@ nsCanvasRenderingContext2D::GetCanvasLayer(CanvasLayer *aOldLayer,
         NS_WARNING("CreateCanvasLayer returned null!");
         return nsnull;
     }
-    canvasLayer->SetUserData(&g2DContextLayerUserData, nsnull);
+    canvasLayer->SetUserData(&g2DContextLayerUserData);
 
     CanvasLayer::Data data;
 
@@ -4174,8 +4174,7 @@ nsCanvasRenderingContext2D::GetCanvasLayer(CanvasLayer *aOldLayer,
     data.mSize = nsIntSize(mWidth, mHeight);
 
     canvasLayer->Initialize(data);
-    PRUint32 flags = mOpaque ? Layer::CONTENT_OPAQUE : 0;
-    canvasLayer->SetContentFlags(flags);
+    canvasLayer->SetIsOpaqueContent(mOpaque);
     canvasLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
 
     mResetLayer = PR_FALSE;
diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index d622b01a5e9e..cccbd3d76a4d 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -147,7 +147,7 @@ Layer::CanUseOpaqueSurface()
 {
   // If the visible content in the layer is opaque, there is no need
   // for an alpha channel.
-  if (GetContentFlags() & CONTENT_OPAQUE)
+  if (IsOpaqueContent())
     return PR_TRUE;
   // Also, if this layer is the bottommost layer in a container which
   // doesn't need an alpha channel, we can use an opaque surface for this
@@ -221,24 +221,14 @@ Layer::PrintInfo(nsACString& aTo, const char* aPrefix)
   if (mUseClipRect) {
     AppendToString(aTo, mClipRect, " [clip=", "]");
   }
-  if (!mTransform.IsIdentity()) {
+  if (!mTransform.IsIdentity())
     AppendToString(aTo, mTransform, " [transform=", "]");
-  }
-  if (!mVisibleRegion.IsEmpty()) {
+  if (!mVisibleRegion.IsEmpty())
     AppendToString(aTo, mVisibleRegion, " [visible=", "]");
-  }
-  if (1.0 != mOpacity) {
+  if (1.0 != mOpacity)
     aTo.AppendPrintf(" [opacity=%g]", mOpacity);
-  }
-  if (GetContentFlags() & CONTENT_OPAQUE) {
+  if (IsOpaqueContent())
     aTo += " [opaqueContent]";
-  }
-  if (GetContentFlags() & CONTENT_NO_TEXT) {
-    aTo += " [noText]";
-  }
-  if (GetContentFlags() & CONTENT_NO_TEXT_OVER_TRANSPARENT) {
-    aTo += " [noTextOverTransparent]";
-  }
 
   return aTo;
 }
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index fe1e996f2979..47a9baab9b75 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -83,14 +83,6 @@ class SpecificLayerAttributes;
   virtual const char* Name() const { return n; }            \
   virtual LayerType GetType() const { return e; }
 
-/**
- * Base class for userdata objects attached to layers and layer managers.
- */
-class THEBES_API LayerUserData {
-public:
-  virtual ~LayerUserData() {}
-};
-
 /*
  * Motivation: For truly smooth animation and video playback, we need to
  * be able to compose frames and render them on a dedicated thread (i.e.
@@ -117,52 +109,6 @@ public:
  * BasicLayerManager for such an implementation.
  */
 
-/**
- * Helper class to manage user data for layers and LayerManagers.
- */
-class THEBES_API LayerUserDataSet {
-public:
-  LayerUserDataSet() : mKey(nsnull) {}
-
-  void Set(void* aKey, LayerUserData* aValue)
-  {
-    NS_ASSERTION(!mKey || mKey == aKey,
-                 "Multiple LayerUserData objects not supported");
-    mKey = aKey;
-    mValue = aValue;
-  }
-  /**
-   * This can be used anytime. Ownership passes to the caller!
-   */
-  LayerUserData* Remove(void* aKey)
-  {
-    if (mKey == aKey) {
-      mKey = nsnull;
-      LayerUserData* d = mValue.forget();
-      return d;
-    }
-    return nsnull;
-  }
-  /**
-   * This getter can be used anytime.
-   */
-  PRBool Has(void* aKey)
-  {
-    return mKey == aKey;
-  }
-  /**
-   * This getter can be used anytime. Ownership is retained by this object.
-   */
-  LayerUserData* Get(void* aKey)
-  {
-    return mKey == aKey ? mValue.get() : nsnull;
-  }
-
-private:
-  void* mKey;
-  nsAutoPtr<LayerUserData> mValue;
-};
-
 /**
  * A LayerManager controls a tree of layers. All layers in the tree
  * must use the same LayerManager.
@@ -196,7 +142,7 @@ public:
     LAYERS_D3D9
   };
 
-  LayerManager() : mDestroyed(PR_FALSE)
+  LayerManager() : mUserData(nsnull), mDestroyed(PR_FALSE)
   {
     InitLog();
   }
@@ -321,28 +267,10 @@ public:
    */
   virtual LayersBackend GetBackendType() = 0;
 
-  /**
-   * This setter can be used anytime. The user data for all keys is
-   * initially null. Ownership pases to the layer manager.
-   */
-  void SetUserData(void* aKey, LayerUserData* aData)
-  { mUserData.Set(aKey, aData); }
-  /**
-   * This can be used anytime. Ownership passes to the caller!
-   */
-  nsAutoPtr<LayerUserData> RemoveUserData(void* aKey)
-  { nsAutoPtr<LayerUserData> d(mUserData.Remove(aKey)); return d; }
-  /**
-   * This getter can be used anytime.
-   */
-  PRBool HasUserData(void* aKey)
-  { return mUserData.Has(aKey); }
-  /**
-   * This getter can be used anytime. Ownership is retained by the layer
-   * manager.
-   */
-  LayerUserData* GetUserData(void* aKey)
-  { return mUserData.Get(aKey); }
+  // This setter and getter can be used anytime. The user data is initially
+  // null.
+  void SetUserData(void* aData) { mUserData = aData; }
+  void* GetUserData() { return mUserData; }
 
   // We always declare the following logging symbols, because it's
   // extremely tricky to conditionally declare them.  However, for
@@ -377,7 +305,7 @@ public:
 
 protected:
   nsRefPtr<Layer> mRoot;
-  LayerUserDataSet mUserData;
+  void* mUserData;
   PRPackedBool mDestroyed;
 
   // Print interesting information about this into aTo.  Internally
@@ -416,37 +344,17 @@ public:
    */
   LayerManager* Manager() { return mManager; }
 
-  enum {
-    /**
-     * If this is set, the caller is promising that by the end of this
-     * transaction the entire visible region (as specified by
-     * SetVisibleRegion) will be filled with opaque content.
-     */
-    CONTENT_OPAQUE = 0x01,
-    /**
-     * ThebesLayers only!
-     * If this is set, the caller is promising that the visible region
-     * contains no text at all. If this is set,
-     * CONTENT_NO_TEXT_OVER_TRANSPARENT will also be set.
-     */
-    CONTENT_NO_TEXT = 0x02,
-    /**
-     * ThebesLayers only!
-     * If this is set, the caller is promising that the visible region
-     * contains no text over transparent pixels (any text, if present,
-     * is over fully opaque pixels).
-     */
-    CONTENT_NO_TEXT_OVER_TRANSPARENT = 0x04
-  };
   /**
    * CONSTRUCTION PHASE ONLY
-   * This lets layout make some promises about what will be drawn into the
-   * visible region of the ThebesLayer. This enables internal quality
-   * and performance optimizations.
+   * If this is called with aOpaque set to true, the caller is promising
+   * that by the end of this transaction the entire visible region
+   * (as specified by SetVisibleRegion) will be filled with opaque
+   * content. This enables some internal quality and performance
+   * optimizations.
    */
-  void SetContentFlags(PRUint32 aFlags)
+  void SetIsOpaqueContent(PRBool aOpaque)
   {
-    mContentFlags = aFlags;
+    mIsOpaqueContent = aOpaque;
     Mutated();
   }
   /**
@@ -529,7 +437,7 @@ public:
   // These getters can be used anytime.
   float GetOpacity() { return mOpacity; }
   const nsIntRect* GetClipRect() { return mUseClipRect ? &mClipRect : nsnull; }
-  PRUint32 GetContentFlags() { return mContentFlags; }
+  PRBool IsOpaqueContent() { return mIsOpaqueContent; }
   const nsIntRegion& GetVisibleRegion() { return mVisibleRegion; }
   ContainerLayer* GetParent() { return mParent; }
   Layer* GetNextSibling() { return mNextSibling; }
@@ -552,28 +460,10 @@ public:
   // quality.
   PRBool CanUseOpaqueSurface();
 
-  /**
-   * This setter can be used anytime. The user data for all keys is
-   * initially null. Ownership pases to the layer manager.
-   */
-  void SetUserData(void* aKey, LayerUserData* aData)
-  { mUserData.Set(aKey, aData); }
-  /**
-   * This can be used anytime. Ownership passes to the caller!
-   */
-  nsAutoPtr<LayerUserData> RemoveUserData(void* aKey)
-  { nsAutoPtr<LayerUserData> d(mUserData.Remove(aKey)); return d; }
-  /**
-   * This getter can be used anytime.
-   */
-  PRBool HasUserData(void* aKey)
-  { return mUserData.Has(aKey); }
-  /**
-   * This getter can be used anytime. Ownership is retained by the layer
-   * manager.
-   */
-  LayerUserData* GetUserData(void* aKey)
-  { return mUserData.Get(aKey); }
+  // This setter and getter can be used anytime. The user data is initially
+  // null.
+  void SetUserData(void* aData) { mUserData = aData; }
+  void* GetUserData() { return mUserData; }
 
   /**
    * Dynamic downcast to a Thebes layer. Returns null if this is not
@@ -629,9 +519,10 @@ protected:
     mNextSibling(nsnull),
     mPrevSibling(nsnull),
     mImplData(aImplData),
+    mUserData(nsnull),
     mOpacity(1.0),
-    mContentFlags(0),
-    mUseClipRect(PR_FALSE)
+    mUseClipRect(PR_FALSE),
+    mIsOpaqueContent(PR_FALSE)
     {}
 
   void Mutated() { mManager->Mutated(this); }
@@ -648,13 +539,13 @@ protected:
   Layer* mNextSibling;
   Layer* mPrevSibling;
   void* mImplData;
-  LayerUserDataSet mUserData;
+  void* mUserData;
   nsIntRegion mVisibleRegion;
   gfx3DMatrix mTransform;
   float mOpacity;
   nsIntRect mClipRect;
-  PRUint32 mContentFlags;
   PRPackedBool mUseClipRect;
+  PRPackedBool mIsOpaqueContent;
 };
 
 /**
diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 1bb1a8e539a9..217ad5926375 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -367,23 +367,6 @@ InheritContextFlags(gfxContext* aSource, gfxContext* aDest)
   }
 }
 
-static PRBool
-ShouldRetainTransparentSurface(PRUint32 aContentFlags,
-                               gfxASurface* aTargetSurface)
-{
-  if (aContentFlags & Layer::CONTENT_NO_TEXT)
-    return PR_TRUE;
-
-  switch (aTargetSurface->GetTextQualityInTransparentSurfaces()) {
-  case gfxASurface::TEXT_QUALITY_OK:
-    return PR_TRUE;
-  case gfxASurface::TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS:
-    return (aContentFlags & Layer::CONTENT_NO_TEXT_OVER_TRANSPARENT) != 0;
-  default:
-    return PR_FALSE;
-  }
-}
-
 void
 BasicThebesLayer::Paint(gfxContext* aContext,
                         LayerManager::DrawThebesLayerCallback aCallback,
@@ -394,20 +377,15 @@ BasicThebesLayer::Paint(gfxContext* aContext,
                "Can only draw in drawing phase");
   gfxContext* target = BasicManager()->GetTarget();
   NS_ASSERTION(target, "We shouldn't be called if there's no target");
-  nsRefPtr<gfxASurface> targetSurface = aContext->CurrentSurface();
-
-  PRBool canUseOpaqueSurface = CanUseOpaqueSurface();
-  if (!BasicManager()->IsRetained() ||
-      (aOpacity == 1.0 && !canUseOpaqueSurface &&
-       !ShouldRetainTransparentSurface(mContentFlags, targetSurface))) {
-    mValidRegion.SetEmpty();
-    mBuffer.Clear();
 
+  if (!BasicManager()->IsRetained()) {
     if (aOpacity != 1.0) {
       target->Save();
       ClipToContain(target, mVisibleRegion.GetBounds());
       target->PushGroup(gfxASurface::CONTENT_COLOR_ALPHA);
     }
+    mValidRegion.SetEmpty();
+    mBuffer.Clear();
     aCallback(this, target, mVisibleRegion, nsIntRegion(), aCallbackData);
     if (aOpacity != 1.0) {
       target->PopGroupToSource();
@@ -417,12 +395,15 @@ BasicThebesLayer::Paint(gfxContext* aContext,
     return;
   }
 
+  nsRefPtr<gfxASurface> targetSurface = aContext->CurrentSurface();
+  PRBool isOpaqueContent =
+    (targetSurface->AreSimilarSurfacesSensitiveToContentType() &&
+     aOpacity == 1.0 &&
+     CanUseOpaqueSurface());
   {
-    PRBool opaqueBuffer = canUseOpaqueSurface &&
-      targetSurface->AreSimilarSurfacesSensitiveToContentType();
     Buffer::ContentType contentType =
-      opaqueBuffer ? gfxASurface::CONTENT_COLOR :
-                     gfxASurface::CONTENT_COLOR_ALPHA;
+      isOpaqueContent ? gfxASurface::CONTENT_COLOR :
+                        gfxASurface::CONTENT_COLOR_ALPHA;
     Buffer::PaintState state = mBuffer.BeginPaint(this, contentType);
     mValidRegion.Sub(mValidRegion, state.mRegionToInvalidate);
 
@@ -444,7 +425,7 @@ BasicThebesLayer::Paint(gfxContext* aContext,
     }
   }
 
-  mBuffer.DrawTo(this, canUseOpaqueSurface, target, aOpacity);
+  mBuffer.DrawTo(this, isOpaqueContent, target, aOpacity);
 }
 
 void
@@ -701,7 +682,7 @@ BasicCanvasLayer::Updated(const nsIntRect& aRect)
   if (mGLContext) {
     nsRefPtr<gfxImageSurface> isurf =
       new gfxImageSurface(gfxIntSize(mBounds.width, mBounds.height),
-                          (GetContentFlags() & CONTENT_OPAQUE)
+                          IsOpaqueContent()
                             ? gfxASurface::ImageFormatRGB24
                             : gfxASurface::ImageFormatARGB32);
     if (!isurf || isurf->CairoStatus() != 0) {
@@ -812,7 +793,7 @@ MayHaveOverlappingOrTransparentLayers(Layer* aLayer,
                                       const nsIntRect& aBounds,
                                       nsIntRegion* aDirtyVisibleRegionInContainer)
 {
-  if (!(aLayer->GetContentFlags() & Layer::CONTENT_OPAQUE)) {
+  if (!aLayer->IsOpaqueContent()) {
     return PR_TRUE;
   }
 
diff --git a/gfx/layers/d3d9/ThebesLayerD3D9.cpp b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
index a4147715fb40..2c567b987577 100644
--- a/gfx/layers/d3d9/ThebesLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
@@ -46,6 +46,27 @@
 namespace mozilla {
 namespace layers {
 
+// Returns true if it's OK to save the contents of aLayer in an
+// opaque surface (a surface without an alpha channel).
+// If we can use a surface without an alpha channel, we should, because
+// it will often make painting of antialiased text faster and higher
+// quality.
+static PRBool
+UseOpaqueSurface(Layer* aLayer)
+{
+  // If the visible content in the layer is opaque, there is no need
+  // for an alpha channel.
+  if (aLayer->IsOpaqueContent())
+    return PR_TRUE;
+  // Also, if this layer is the bottommost layer in a container which
+  // doesn't need an alpha channel, we can use an opaque surface for this
+  // layer too. Any transparent areas must be covered by something else
+  // in the container.
+  ContainerLayer* parent = aLayer->GetParent();
+  return parent && parent->GetFirstChild() == aLayer &&
+         UseOpaqueSurface(parent);
+}
+
 ThebesLayerD3D9::ThebesLayerD3D9(LayerManagerD3D9 *aManager)
   : ThebesLayer(aManager, NULL)
   , LayerD3D9(aManager)
@@ -83,7 +104,7 @@ ThebesLayerD3D9::SetVisibleRegion(const nsIntRegion &aRegion)
     return;
   }
 
-  D3DFORMAT fmt = (CanUseOpaqueSurface() && !mD2DSurface) ?
+  D3DFORMAT fmt = (UseOpaqueSurface(this) && !mD2DSurface) ?
                     D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
 
   D3DSURFACE_DESC desc;
@@ -177,7 +198,7 @@ ThebesLayerD3D9::RenderLayer()
 
   // We differentiate between these formats since D3D9 will only allow us to
   // call GetDC on an opaque surface.
-  D3DFORMAT fmt = (CanUseOpaqueSurface() && !mD2DSurface) ?
+  D3DFORMAT fmt = (UseOpaqueSurface(this) && !mD2DSurface) ?
                     D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
 
   if (mTexture) {
@@ -293,7 +314,7 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
   }
 #endif
 
-  D3DFORMAT fmt = CanUseOpaqueSurface() ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
+  D3DFORMAT fmt = UseOpaqueSurface(this) ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
   nsIntRect bounds = aRegion.GetBounds();
 
   gfxASurface::gfxImageFormat imageFormat = gfxASurface::ImageFormatARGB32;
@@ -306,7 +327,7 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
 
   nsRefPtr<IDirect3DSurface9> surf;
   HDC dc;
-  if (CanUseOpaqueSurface()) {
+  if (UseOpaqueSurface(this)) {
     hr = tmpTexture->GetSurfaceLevel(0, getter_AddRefs(surf));
 
     if (FAILED(hr)) {
@@ -339,7 +360,7 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
   LayerManagerD3D9::CallbackInfo cbInfo = mD3DManager->GetCallbackInfo();
   cbInfo.Callback(this, context, aRegion, nsIntRegion(), cbInfo.CallbackData);
 
-  if (CanUseOpaqueSurface()) {
+  if (UseOpaqueSurface(this)) {
     surf->ReleaseDC(dc);
   } else {
     D3DLOCKED_RECT r;
@@ -402,7 +423,7 @@ ThebesLayerD3D9::CreateNewTexture(const gfxIntSize &aSize)
                                   D3DUSAGE_RENDERTARGET, D3DFMT_A8R8G8B8,
                                   D3DPOOL_DEFAULT, getter_AddRefs(mTexture), &sharedHandle);
 
-          mD2DSurface = new gfxD2DSurface(sharedHandle, CanUseOpaqueSurface() ?
+          mD2DSurface = new gfxD2DSurface(sharedHandle, UseOpaqueSurface(this) ?
             gfxASurface::CONTENT_COLOR : gfxASurface::CONTENT_COLOR_ALPHA);
 
           // If there's an error, go on and do what we always do.
@@ -415,7 +436,7 @@ ThebesLayerD3D9::CreateNewTexture(const gfxIntSize &aSize)
 #endif
   if (!mTexture) {
     device()->CreateTexture(aSize.width, aSize.height, 1,
-                            D3DUSAGE_RENDERTARGET, CanUseOpaqueSurface() ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8,
+                            D3DUSAGE_RENDERTARGET, UseOpaqueSurface(this) ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8,
                             D3DPOOL_DEFAULT, getter_AddRefs(mTexture), NULL);
   }
 }
diff --git a/gfx/layers/ipc/PLayers.ipdl b/gfx/layers/ipc/PLayers.ipdl
index fdde16ca6893..7f90abff46c9 100644
--- a/gfx/layers/ipc/PLayers.ipdl
+++ b/gfx/layers/ipc/PLayers.ipdl
@@ -93,7 +93,7 @@ struct OpCreateImageBuffer {
 struct CommonLayerAttributes {
   nsIntRegion visibleRegion;
   gfx3DMatrix transform;
-  PRUint32 contentFlags;
+  bool isOpaqueContent;
   float opacity;
   bool useClipRect;
   nsIntRect clipRect;
diff --git a/gfx/layers/ipc/ShadowLayers.cpp b/gfx/layers/ipc/ShadowLayers.cpp
index dc6b1ea6de32..f0222eb63c08 100644
--- a/gfx/layers/ipc/ShadowLayers.cpp
+++ b/gfx/layers/ipc/ShadowLayers.cpp
@@ -271,7 +271,7 @@ ShadowLayerForwarder::EndTransaction(nsTArray<EditReply>* aReplies)
     CommonLayerAttributes& common = attrs.common();
     common.visibleRegion() = mutant->GetVisibleRegion();
     common.transform() = mutant->GetTransform();
-    common.contentFlags() = mutant->GetContentFlags();
+    common.isOpaqueContent() = mutant->IsOpaqueContent();
     common.opacity() = mutant->GetOpacity();
     common.useClipRect() = !!mutant->GetClipRect();
     common.clipRect() = (common.useClipRect() ?
diff --git a/gfx/layers/ipc/ShadowLayersParent.cpp b/gfx/layers/ipc/ShadowLayersParent.cpp
index e61d886bce39..9b4b71428132 100644
--- a/gfx/layers/ipc/ShadowLayersParent.cpp
+++ b/gfx/layers/ipc/ShadowLayersParent.cpp
@@ -229,7 +229,7 @@ ShadowLayersParent::RecvUpdate(const nsTArray<Edit>& cset,
 
       const CommonLayerAttributes& common = attrs.common();
       layer->SetVisibleRegion(common.visibleRegion());
-      layer->SetContentFlags(common.contentFlags());
+      layer->SetIsOpaqueContent(common.isOpaqueContent());
       layer->SetOpacity(common.opacity());
       layer->SetClipRect(common.useClipRect() ? &common.clipRect() : NULL);
       layer->SetTransform(common.transform());
diff --git a/gfx/thebes/gfxASurface.h b/gfx/thebes/gfxASurface.h
index 4a746f717d2b..9ee195608ad0 100644
--- a/gfx/thebes/gfxASurface.h
+++ b/gfx/thebes/gfxASurface.h
@@ -153,40 +153,7 @@ public:
      */
     virtual PRBool AreSimilarSurfacesSensitiveToContentType()
     {
-        return PR_TRUE;
-    }
-
-    enum TextQuality {
-        /**
-         * TEXT_QUALITY_OK means that text is always rendered to a
-         * transparent surface just as well as it would be rendered to an
-         * opaque surface. This would normally only be true if
-         * subpixel antialiasing is disabled or if the platform's
-         * transparent surfaces support component alpha.
-         */
-        TEXT_QUALITY_OK,
-        /**
-         * TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS means that text is rendered
-         * to a transparent surface just as well as it would be rendered to an
-         * opaque surface, but only if all the pixels the text is drawn
-         * over already have opaque alpha values.
-         */
-        TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS,
-        /**
-         * TEXT_QUALITY_BAD means that text is rendered
-         * to a transparent surface worse than it would be rendered to an
-         * opaque surface, even if all the pixels the text is drawn
-         * over already have opaque alpha values.
-         */
-        TEXT_QUALITY_BAD
-    };
-    /**
-     * Determine how well text would be rendered in transparent surfaces that
-     * are similar to this surface.
-     */
-    virtual TextQuality GetTextQualityInTransparentSurfaces()
-    {
-        return TEXT_QUALITY_BAD;
+      return PR_TRUE;
     }
 
     int CairoStatus();
diff --git a/gfx/thebes/gfxD2DSurface.h b/gfx/thebes/gfxD2DSurface.h
index 3a08ffc5e103..1a3d641fdc57 100644
--- a/gfx/thebes/gfxD2DSurface.h
+++ b/gfx/thebes/gfxD2DSurface.h
@@ -57,12 +57,6 @@ public:
 
     virtual ~gfxD2DSurface();
 
-    virtual TextQuality GetTextQualityInTransparentSurfaces()
-    {
-      // D2D always draws text in transparent surfaces with grayscale-AA,
-      // even if the text is over opaque pixels.
-      return TEXT_QUALITY_BAD;
-    }
 
     void Present();
     void Scroll(const nsIntPoint &aDelta, const nsIntRect &aClip);
diff --git a/gfx/thebes/gfxQuartzSurface.h b/gfx/thebes/gfxQuartzSurface.h
index 1fd5fd773175..5fbbe4040865 100644
--- a/gfx/thebes/gfxQuartzSurface.h
+++ b/gfx/thebes/gfxQuartzSurface.h
@@ -60,10 +60,6 @@ public:
     {
       return PR_FALSE;
     }
-    virtual TextQuality GetTextQualityInTransparentSurfaces()
-    {
-      return TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS;
-    }
 
     const gfxSize& GetSize() const { return mSize; }
 
diff --git a/gfx/thebes/gfxWindowsSurface.h b/gfx/thebes/gfxWindowsSurface.h
index 0da4fe3d1f77..20230ec799b6 100644
--- a/gfx/thebes/gfxWindowsSurface.h
+++ b/gfx/thebes/gfxWindowsSurface.h
@@ -81,11 +81,6 @@ public:
                                                       const gfxIntSize& size,
                                                       gfxImageFormat format);
 
-    virtual TextQuality GetTextQualityInTransparentSurfaces()
-    {
-      return TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS;
-    }
-
     nsresult BeginPrinting(const nsAString& aTitle, const nsAString& aPrintToFileName);
     nsresult EndPrinting();
     nsresult AbortPrinting();
diff --git a/gfx/thebes/gfxXlibSurface.h b/gfx/thebes/gfxXlibSurface.h
index e3b1d1f0b613..ad07f74d1efe 100644
--- a/gfx/thebes/gfxXlibSurface.h
+++ b/gfx/thebes/gfxXlibSurface.h
@@ -77,11 +77,6 @@ public:
     virtual already_AddRefed<gfxASurface>
     CreateSimilarSurface(gfxContentType aType, const gfxIntSize& aSize);
 
-    virtual TextQuality GetTextQualityInTransparentSurfaces()
-    {
-      return TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS;
-    }
-
     const gfxIntSize& GetSize() { return mSize; }
 
     Display* XDisplay() { return mDisplay; }
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index b0dcb3c1bcec..01c9797f776b 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -57,22 +57,14 @@ namespace {
 /**
  * This is the userdata we associate with a layer manager.
  */
-class LayerManagerData : public LayerUserData {
+class LayerManagerData {
 public:
   LayerManagerData() :
     mInvalidateAllThebesContent(PR_FALSE),
     mInvalidateAllLayers(PR_FALSE)
   {
-    MOZ_COUNT_CTOR(LayerManagerData);
     mFramesWithLayers.Init();
   }
-  ~LayerManagerData() {
-    // Remove display item data properties now, since we won't be able
-    // to find these frames again without mFramesWithLayers.
-    mFramesWithLayers.EnumerateEntries(
-        FrameLayerBuilder::RemoveDisplayItemDataForFrame, nsnull);
-    MOZ_COUNT_DTOR(LayerManagerData);
-  }
 
   /**
    * Tracks which frames have layers associated with them.
@@ -159,8 +151,7 @@ protected:
   public:
     ThebesLayerData() :
       mActiveScrolledRoot(nsnull), mLayer(nsnull),
-      mIsSolidColorInVisibleRegion(PR_FALSE),
-      mHasText(PR_FALSE), mHasTextOverTransparent(PR_FALSE) {}
+      mIsSolidColorInVisibleRegion(PR_FALSE) {}
     /**
      * Record that an item has been added to the ThebesLayer, so we
      * need to update our regions.
@@ -174,10 +165,10 @@ protected:
      * @param aSolidColor if non-null, the visible area of the item is
      * a constant color given by *aSolidColor
      */
-    void Accumulate(nsDisplayListBuilder* aBuilder,
-                    nsDisplayItem* aItem,
-                    const nsIntRect& aVisibleRect,
-                    const nsIntRect& aDrawRect);
+    void Accumulate(const nsIntRect& aVisibleRect,
+                    const nsIntRect& aDrawRect,
+                    const nsIntRect* aOpaqueRect,
+                    nscolor* aSolidColor);
     nsIFrame* GetActiveScrolledRoot() { return mActiveScrolledRoot; }
 
     /**
@@ -229,15 +220,6 @@ protected:
      * True if every pixel in mVisibleRegion will have color mSolidColor.
      */
     PRPackedBool mIsSolidColorInVisibleRegion;
-    /**
-     * True if there is any text visible in the layer.
-     */
-    PRPackedBool mHasText;
-    /**
-     * True if there is any text visible in the layer that's over
-     * transparent pixels in the layer.
-     */
-    PRPackedBool mHasTextOverTransparent;
   };
 
   /**
@@ -263,12 +245,6 @@ protected:
    * aItem in that layer.
    */
   void InvalidateForLayerChange(nsDisplayItem* aItem, Layer* aNewLayer);
-  /**
-   * Try to determine whether the ThebesLayer at aThebesLayerIndex
-   * has an opaque single color covering the visible area behind it.
-   * If successful, return that color, otherwise return NS_RGBA(0,0,0,0).
-   */
-  nscolor FindOpaqueBackgroundColorFor(PRInt32 aThebesLayerIndex);
   /**
    * Indicate that we are done adding items to the ThebesLayer at the top of
    * mThebesLayerDataStack. Set the final visible region and opaque-content
@@ -292,10 +268,11 @@ protected:
    * @param aSolidColor if non-null, indicates that every pixel in aVisibleRect
    * will be painted with aSolidColor by the item
    */
-  already_AddRefed<ThebesLayer> FindThebesLayerFor(nsDisplayItem* aItem,
-                                                   const nsIntRect& aVisibleRect,
+  already_AddRefed<ThebesLayer> FindThebesLayerFor(const nsIntRect& aVisibleRect,
                                                    const nsIntRect& aDrawRect,
-                                                   nsIFrame* aActiveScrolledRoot);
+                                                   nsIFrame* aActiveScrolledRoot,
+                                                   const nsIntRect* aOpaqueRect,
+                                                   nscolor* aSolidColor);
   ThebesLayerData* GetTopThebesLayerData()
   {
     return mThebesLayerDataStack.IsEmpty() ? nsnull
@@ -325,37 +302,20 @@ protected:
   PRPackedBool                     mInvalidateAllThebesContent;
 };
 
-class ThebesDisplayItemLayerUserData : public LayerUserData
-{
-public:
-  ThebesDisplayItemLayerUserData() :
-    mForcedBackgroundColor(NS_RGBA(0,0,0,0)) {}
-
-  nscolor mForcedBackgroundColor;
-};
-
 /**
  * The address of gThebesDisplayItemLayerUserData is used as the user
- * data key for ThebesLayers created by FrameLayerBuilder.
+ * data pointer for ThebesLayers created by FrameLayerBuilder.
  * It identifies ThebesLayers used to draw non-layer content, which are
  * therefore eligible for recycling. We want display items to be able to
  * create their own dedicated ThebesLayers in BuildLayer, if necessary,
  * and we wouldn't want to accidentally recycle those.
- * The user data is a ThebesDisplayItemLayerUserData.
  */
-PRUint8 gThebesDisplayItemLayerUserData;
+static PRUint8 gThebesDisplayItemLayerUserData;
 /**
  * The address of gColorLayerUserData is used as the user
- * data key for ColorLayers created by FrameLayerBuilder.
- * The user data is null.
+ * data pointer for ColorLayers
  */
-PRUint8 gColorLayerUserData;
-/**
- * The address of gLayerManagerUserData is used as the user
- * data key for retained LayerManagers managed by FrameLayerBuilder.
- * The user data is a LayerManagerData.
- */
-PRUint8 gLayerManagerUserData;
+static PRUint8 gColorLayerUserData;
 
 } // anonymous namespace
 
@@ -382,11 +342,12 @@ FrameLayerBuilder::InternalDestroyDisplayItemData(nsIFrame* aFrame,
   if (aRemoveFromFramesWithLayers) {
     LayerManager* manager = array->ElementAt(0).mLayer->Manager();
     LayerManagerData* data = static_cast<LayerManagerData*>
-      (manager->GetUserData(&gLayerManagerUserData));
+      (manager->GetUserData());
     NS_ASSERTION(data, "Frame with layer should have been recorded");
     data->mFramesWithLayers.RemoveEntry(aFrame);
     if (data->mFramesWithLayers.Count() == 0) {
-      manager->RemoveUserData(&gLayerManagerUserData);
+      delete data;
+      manager->SetUserData(nsnull);
       // Consume the reference we added when we set the user data
       // in DidEndTransaction. But don't actually release until we've
       // released all the layers in the DisplayItemData array below!
@@ -410,7 +371,7 @@ FrameLayerBuilder::WillBeginRetainedLayerTransaction(LayerManager* aManager)
 {
   mRetainingManager = aManager;
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (aManager->GetUserData(&gLayerManagerUserData));
+    (aManager->GetUserData());
   if (data) {
     mInvalidateAllThebesContent = data->mInvalidateAllThebesContent;
     mInvalidateAllLayers = data->mInvalidateAllLayers;
@@ -459,13 +420,13 @@ FrameLayerBuilder::WillEndTransaction(LayerManager* aManager)
   // correctly and the NS_FRAME_HAS_CONTAINER_LAYER bits will be set
   // correctly.
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (mRetainingManager->GetUserData(&gLayerManagerUserData));
+    (mRetainingManager->GetUserData());
   if (data) {
     // Update all the frames that used to have layers.
     data->mFramesWithLayers.EnumerateEntries(UpdateDisplayItemDataForFrame, this);
   } else {
     data = new LayerManagerData();
-    mRetainingManager->SetUserData(&gLayerManagerUserData, data);
+    mRetainingManager->SetUserData(data);
     // Addref mRetainingManager. We'll release it when 'data' is
     // removed.
     NS_ADDREF(mRetainingManager);
@@ -489,7 +450,7 @@ FrameLayerBuilder::UpdateDisplayItemDataForFrame(nsPtrHashKey<nsIFrame>* aEntry,
   nsIFrame* f = aEntry->GetKey();
   FrameProperties props = f->Properties();
   DisplayItemDataEntry* newDisplayItems =
-    builder ? builder->mNewDisplayItemData.GetEntry(f) : nsnull;
+    builder->mNewDisplayItemData.GetEntry(f);
   if (!newDisplayItems) {
     // This frame was visible, but isn't anymore.
     PRBool found;
@@ -634,7 +595,7 @@ ContainerState::CreateOrRecycleColorLayer()
     if (!layer)
       return nsnull;
     // Mark this layer as being used for Thebes-painting display items
-    layer->SetUserData(&gColorLayerUserData, nsnull);
+    layer->SetUserData(&gColorLayerUserData);
   }
   return layer.forget();
 }
@@ -676,8 +637,7 @@ ContainerState::CreateOrRecycleThebesLayer(nsIFrame* aActiveScrolledRoot)
     if (!layer)
       return nsnull;
     // Mark this layer as being used for Thebes-painting display items
-    layer->SetUserData(&gThebesDisplayItemLayerUserData,
-        new ThebesDisplayItemLayerUserData());
+    layer->SetUserData(&gThebesDisplayItemLayerUserData);
   }
 
   // Set up transform so that 0,0 in the Thebes layer corresponds to the
@@ -737,39 +697,6 @@ SetVisibleRectForLayer(Layer* aLayer, const nsIntRect& aRect)
   }
 }
 
-nscolor
-ContainerState::FindOpaqueBackgroundColorFor(PRInt32 aThebesLayerIndex)
-{
-  ThebesLayerData* target = mThebesLayerDataStack[aThebesLayerIndex];
-  for (PRInt32 i = aThebesLayerIndex - 1; i >= 0; --i) {
-    ThebesLayerData* candidate = mThebesLayerDataStack[i];
-    nsIntRegion visibleAboveIntersection;
-    visibleAboveIntersection.And(candidate->mVisibleAboveRegion, target->mVisibleRegion);
-    if (!visibleAboveIntersection.IsEmpty()) {
-      // Some non-Thebes content between target and candidate; this is
-      // hopeless
-      break;
-    }
-
-    nsIntRegion intersection;
-    intersection.And(candidate->mVisibleRegion, target->mVisibleRegion);
-    if (intersection.IsEmpty()) {
-      // The layer doesn't intersect our target, ignore it and move on
-      continue;
-    }
- 
-    // The candidate intersects our target. If any layer has a solid-color
-    // area behind our target, this must be it. Scan its display items.
-    nsPresContext* presContext = mContainerFrame->PresContext();
-    nscoord appUnitsPerDevPixel = presContext->AppUnitsPerDevPixel();
-    nsRect rect =
-      target->mVisibleRegion.GetBounds().ToAppUnits(appUnitsPerDevPixel);
-    return mBuilder->LayerBuilder()->
-      FindOpaqueColorCovering(mBuilder, candidate->mLayer, rect);
-  }
-  return NS_RGBA(0,0,0,0);
-}
-
 void
 ContainerState::PopThebesLayerData()
 {
@@ -778,6 +705,21 @@ ContainerState::PopThebesLayerData()
   PRInt32 lastIndex = mThebesLayerDataStack.Length() - 1;
   ThebesLayerData* data = mThebesLayerDataStack[lastIndex];
 
+  if (lastIndex > 0) {
+    // Since we're going to pop off the last ThebesLayerData, the
+    // mVisibleAboveRegion of the second-to-last item will need to include
+    // the regions of the last item.
+    ThebesLayerData* nextData = mThebesLayerDataStack[lastIndex - 1];
+    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
+                                     data->mVisibleAboveRegion);
+    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
+                                     data->mVisibleRegion);
+    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
+                                     data->mDrawAboveRegion);
+    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
+                                     data->mDrawRegion);
+  }
+
   Layer* layer;
   if (data->mIsSolidColorInVisibleRegion) {
     nsRefPtr<ColorLayer> colorLayer = CreateOrRecycleColorLayer();
@@ -824,87 +766,26 @@ ContainerState::PopThebesLayerData()
 
   nsIntRegion transparentRegion;
   transparentRegion.Sub(data->mVisibleRegion, data->mOpaqueRegion);
-  PRBool isOpaque = transparentRegion.IsEmpty();
-  // For translucent ThebesLayers, try to find an opaque background
-  // color that covers the entire area beneath it so we can pull that
-  // color into this layer to make it opaque.
-  if (layer == data->mLayer) {
-    nscolor backgroundColor = NS_RGBA(0,0,0,0);
-    if (!isOpaque) {
-      backgroundColor = FindOpaqueBackgroundColorFor(lastIndex);
-      if (NS_GET_A(backgroundColor) == 255) {
-        isOpaque = PR_TRUE;
-      }
-    }
-
-    // Store the background color
-    ThebesDisplayItemLayerUserData* userData =
-      static_cast<ThebesDisplayItemLayerUserData*>
-        (data->mLayer->GetUserData(&gThebesDisplayItemLayerUserData));
-    NS_ASSERTION(userData, "where did our user data go?");
-    if (userData->mForcedBackgroundColor != backgroundColor) {
-      // Invalidate the entire target ThebesLayer since we're changing
-      // the background color
-      data->mLayer->InvalidateRegion(data->mLayer->GetValidRegion());
-    }
-    userData->mForcedBackgroundColor = backgroundColor;
-  }
-  PRUint32 flags =
-    (isOpaque ? Layer::CONTENT_OPAQUE : 0) |
-    (data->mHasText ? 0 : Layer::CONTENT_NO_TEXT) |
-    (data->mHasTextOverTransparent ? 0 : Layer::CONTENT_NO_TEXT_OVER_TRANSPARENT);
-  layer->SetContentFlags(flags);
-
-  if (lastIndex > 0) {
-    // Since we're going to pop off the last ThebesLayerData, the
-    // mVisibleAboveRegion of the second-to-last item will need to include
-    // the regions of the last item.
-    ThebesLayerData* nextData = mThebesLayerDataStack[lastIndex - 1];
-    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
-                                     data->mVisibleAboveRegion);
-    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
-                                     data->mVisibleRegion);
-    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
-                                     data->mDrawAboveRegion);
-    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
-                                     data->mDrawRegion);
-  }
+  layer->SetIsOpaqueContent(transparentRegion.IsEmpty());
 
   mThebesLayerDataStack.RemoveElementAt(lastIndex);
 }
 
-static PRBool
-IsText(nsDisplayItem* aItem) {
-  switch (aItem->GetType()) {
-  case nsDisplayItem::TYPE_TEXT:
-  case nsDisplayItem::TYPE_BULLET:
-  case nsDisplayItem::TYPE_HEADER_FOOTER:
-  case nsDisplayItem::TYPE_MATHML_CHAR_FOREGROUND:
-#ifdef MOZ_XUL
-  case nsDisplayItem::TYPE_XUL_TEXT_BOX:
-#endif
-    return PR_TRUE;
-  default:
-    return PR_FALSE;
-  }
-}
-
 void
-ContainerState::ThebesLayerData::Accumulate(nsDisplayListBuilder* aBuilder,
-                                            nsDisplayItem* aItem,
-                                            const nsIntRect& aVisibleRect,
-                                            const nsIntRect& aDrawRect)
+ContainerState::ThebesLayerData::Accumulate(const nsIntRect& aVisibleRect,
+                                            const nsIntRect& aDrawRect,
+                                            const nsIntRect* aOpaqueRect,
+                                            nscolor* aSolidColor)
 {
-  nscolor uniformColor;
-  if (aItem->IsUniform(aBuilder, &uniformColor)) {
+  if (aSolidColor) {
     if (mVisibleRegion.IsEmpty()) {
       // This color is all we have
-      mSolidColor = uniformColor;
+      mSolidColor = *aSolidColor;
       mIsSolidColorInVisibleRegion = PR_TRUE;
     } else if (mIsSolidColorInVisibleRegion &&
                mVisibleRegion.IsEqual(nsIntRegion(aVisibleRect))) {
       // we can just blend the colors together
-      mSolidColor = NS_ComposeColors(mSolidColor, uniformColor);
+      mSolidColor = NS_ComposeColors(mSolidColor, *aSolidColor);
     } else {
       mIsSolidColorInVisibleRegion = PR_FALSE;
     }
@@ -916,31 +797,26 @@ ContainerState::ThebesLayerData::Accumulate(nsDisplayListBuilder* aBuilder,
   mVisibleRegion.SimplifyOutward(4);
   mDrawRegion.Or(mDrawRegion, aDrawRect);
   mDrawRegion.SimplifyOutward(4);
-
-  if (aItem->IsOpaque(aBuilder)) {
+  if (aOpaqueRect) {
     // We don't use SimplifyInward here since it's not defined exactly
     // what it will discard. For our purposes the most important case
     // is a large opaque background at the bottom of z-order (e.g.,
     // a canvas background), so we need to make sure that the first rect
     // we see doesn't get discarded.
     nsIntRegion tmp;
-    tmp.Or(mOpaqueRegion, aDrawRect);
+    tmp.Or(mOpaqueRegion, *aOpaqueRect);
     if (tmp.GetNumRects() <= 4) {
       mOpaqueRegion = tmp;
     }
-  } else if (IsText(aItem)) {
-    mHasText = PR_TRUE;
-    if (!mOpaqueRegion.Contains(aVisibleRect)) {
-      mHasTextOverTransparent = PR_TRUE;
-    }
   }
 }
 
 already_AddRefed<ThebesLayer>
-ContainerState::FindThebesLayerFor(nsDisplayItem* aItem,
-                                   const nsIntRect& aVisibleRect,
+ContainerState::FindThebesLayerFor(const nsIntRect& aVisibleRect,
                                    const nsIntRect& aDrawRect,
-                                   nsIFrame* aActiveScrolledRoot)
+                                   nsIFrame* aActiveScrolledRoot,
+                                   const nsIntRect* aOpaqueRect,
+                                   nscolor* aSolidColor)
 {
   PRInt32 i;
   PRInt32 lowestUsableLayerWithScrolledRoot = -1;
@@ -994,7 +870,7 @@ ContainerState::FindThebesLayerFor(nsDisplayItem* aItem,
     layer = thebesLayerData->mLayer;
   }
 
-  thebesLayerData->Accumulate(mBuilder, aItem, aVisibleRect, aDrawRect);
+  thebesLayerData->Accumulate(aVisibleRect, aDrawRect, aOpaqueRect, aSolidColor);
   return layer.forget();
 }
 
@@ -1089,7 +965,7 @@ ContainerState::ProcessDisplayItems(const nsDisplayList& aList,
 
       // Update that layer's clip and visible rects.
       NS_ASSERTION(ownLayer->Manager() == mManager, "Wrong manager");
-      NS_ASSERTION(!ownLayer->HasUserData(&gLayerManagerUserData),
+      NS_ASSERTION(ownLayer->GetUserData() != &gThebesDisplayItemLayerUserData,
                    "We shouldn't have a FrameLayerBuilder-managed layer here!");
       // It has its own layer. Update that layer's clip and visible rects.
       if (aClipRect) {
@@ -1140,9 +1016,17 @@ ContainerState::ProcessDisplayItems(const nsDisplayList& aList,
           nsLayoutUtils::GetActiveScrolledRootFor(viewportFrame, mBuilder->ReferenceFrame());
       }
 
+      nscolor uniformColor;
+      PRBool isUniform = item->IsUniform(mBuilder, &uniformColor);
+      PRBool isOpaque = item->IsOpaque(mBuilder);
+      nsIntRect opaqueRect;
+      if (isOpaque) {
+        opaqueRect = item->GetBounds(mBuilder).ToNearestPixels(appUnitsPerDevPixel);
+      }
       nsRefPtr<ThebesLayer> thebesLayer =
-        FindThebesLayerFor(item, itemVisibleRect, itemDrawRect,
-                           activeScrolledRoot);
+        FindThebesLayerFor(itemVisibleRect, itemDrawRect, activeScrolledRoot,
+                           isOpaque ? &opaqueRect : nsnull,
+                           isUniform ? &uniformColor : nsnull);
 
       InvalidateForLayerChange(item, thebesLayer);
 
@@ -1230,36 +1114,15 @@ FrameLayerBuilder::AddLayerDisplayItem(Layer* aLayer,
   }
 }
 
-nscolor
-FrameLayerBuilder::FindOpaqueColorCovering(nsDisplayListBuilder* aBuilder,
-                                           ThebesLayer* aLayer,
-                                           const nsRect& aRect)
-{
-  ThebesLayerItemsEntry* entry = mThebesLayerItems.GetEntry(aLayer);
-  NS_ASSERTION(entry, "Must know about this layer!");
-  for (PRInt32 i = entry->mItems.Length() - 1; i >= 0; --i) {
-    nsDisplayItem* item = entry->mItems[i].mItem;
-    const nsRect& visible = item->GetVisibleRect();
-    if (!visible.Intersects(aRect))
-      continue;
-
-    nscolor color;
-    if (visible.Contains(aRect) && item->IsUniform(aBuilder, &color) &&
-        NS_GET_A(color) == 255)
-      return color;
-    break;
-  }
-  return NS_RGBA(0,0,0,0);
-}
-
 void
 ContainerState::CollectOldLayers()
 {
   for (Layer* layer = mContainerLayer->GetFirstChild(); layer;
        layer = layer->GetNextSibling()) {
-    if (layer->HasUserData(&gColorLayerUserData)) {
+    void* data = layer->GetUserData();
+    if (data == &gColorLayerUserData) {
       mRecycledColorLayers.AppendElement(static_cast<ColorLayer*>(layer));
-    } else if (layer->HasUserData(&gThebesDisplayItemLayerUserData)) {
+    } else if (data == &gThebesDisplayItemLayerUserData) {
       NS_ASSERTION(layer->AsThebesLayer(), "Wrong layer type");
       mRecycledThebesLayers.AppendElement(static_cast<ThebesLayer*>(layer));
     }
@@ -1340,7 +1203,7 @@ FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder* aBuilder,
     Layer* oldLayer = GetOldLayerFor(aContainerFrame, containerDisplayItemKey);
     if (oldLayer) {
       NS_ASSERTION(oldLayer->Manager() == aManager, "Wrong manager");
-      if (oldLayer->HasUserData(&gThebesDisplayItemLayerUserData)) {
+      if (oldLayer->GetUserData() == &gThebesDisplayItemLayerUserData) {
         // The old layer for this item is actually our ThebesLayer
         // because we rendered its layer into that ThebesLayer. So we
         // don't actually have a retained container layer.
@@ -1396,8 +1259,7 @@ FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder* aBuilder,
   state.ProcessDisplayItems(aChildren, nsnull);
   state.Finish();
 
-  PRUint32 flags = aChildren.IsOpaque() ? Layer::CONTENT_OPAQUE : 0;
-  containerLayer->SetContentFlags(flags);
+  containerLayer->SetIsOpaqueContent(aChildren.IsOpaque());
   return containerLayer.forget();
 }
 
@@ -1414,7 +1276,7 @@ FrameLayerBuilder::GetLeafLayerFor(nsDisplayListBuilder* aBuilder,
   Layer* layer = GetOldLayerFor(f, aItem->GetPerFrameKey());
   if (!layer)
     return nsnull;
-  if (layer->HasUserData(&gThebesDisplayItemLayerUserData)) {
+  if (layer->GetUserData() == &gThebesDisplayItemLayerUserData) {
     // This layer was created to render Thebes-rendered content for this
     // display item. The display item should not use it for its own
     // layer rendering.
@@ -1490,7 +1352,7 @@ FrameLayerBuilder::InvalidateThebesLayersInSubtree(nsIFrame* aFrame)
 FrameLayerBuilder::InvalidateAllThebesLayerContents(LayerManager* aManager)
 {
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (aManager->GetUserData(&gLayerManagerUserData));
+    (aManager->GetUserData());
   if (data) {
     data->mInvalidateAllThebesContent = PR_TRUE;
   }
@@ -1500,7 +1362,7 @@ FrameLayerBuilder::InvalidateAllThebesLayerContents(LayerManager* aManager)
 FrameLayerBuilder::InvalidateAllLayers(LayerManager* aManager)
 {
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (aManager->GetUserData(&gLayerManagerUserData));
+    (aManager->GetUserData());
   if (data) {
     data->mInvalidateAllLayers = PR_TRUE;
   }
@@ -1518,9 +1380,9 @@ FrameLayerBuilder::HasDedicatedLayer(nsIFrame* aFrame, PRUint32 aDisplayItemKey)
     (reinterpret_cast<nsTArray<DisplayItemData>*>(&propValue));
   for (PRUint32 i = 0; i < array->Length(); ++i) {
     if (array->ElementAt(i).mDisplayItemKey == aDisplayItemKey) {
-      Layer* layer = array->ElementAt(i).mLayer;
-      if (!layer->HasUserData(&gColorLayerUserData) &&
-          !layer->HasUserData(&gThebesDisplayItemLayerUserData))
+      void* layerUserData = array->ElementAt(i).mLayer->GetUserData();
+      if (layerUserData != &gColorLayerUserData &&
+          layerUserData != &gThebesDisplayItemLayerUserData)
         return PR_TRUE;
     }
   }
@@ -1549,15 +1411,6 @@ FrameLayerBuilder::DrawThebesLayer(ThebesLayer* aLayer,
     // so 'entry' could become invalid.
   }
 
-  ThebesDisplayItemLayerUserData* userData =
-    static_cast<ThebesDisplayItemLayerUserData*>
-      (aLayer->GetUserData(&gThebesDisplayItemLayerUserData));
-  NS_ASSERTION(userData, "where did our user data go?");
-  if (NS_GET_A(userData->mForcedBackgroundColor) > 0) {
-    aContext->SetColor(gfxRGBA(userData->mForcedBackgroundColor));
-    aContext->Paint();
-  }
-
   gfxMatrix transform;
   if (!aLayer->GetTransform().Is2D(&transform)) {
     NS_ERROR("non-2D transform in our Thebes layer!");
diff --git a/layout/base/FrameLayerBuilder.h b/layout/base/FrameLayerBuilder.h
index 4cce9ebbcb70..e3e082068994 100644
--- a/layout/base/FrameLayerBuilder.h
+++ b/layout/base/FrameLayerBuilder.h
@@ -243,26 +243,6 @@ public:
    */
   Layer* GetOldLayerFor(nsIFrame* aFrame, PRUint32 aDisplayItemKey);
 
-  /**
-   * A useful hashtable iteration function that removes the
-   * DisplayItemData property for the frame, clears its
-   * NS_FRAME_HAS_CONTAINER_LAYER bit and returns PL_DHASH_REMOVE.
-   * aClosure is ignored.
-   */
-  static PLDHashOperator RemoveDisplayItemDataForFrame(nsPtrHashKey<nsIFrame>* aEntry,
-                                                       void* aClosure)
-  {
-    return UpdateDisplayItemDataForFrame(aEntry, nsnull);
-  }
-
-  /**
-   * Try to determine whether the ThebesLayer aLayer paints an opaque
-   * single color everywhere it's visible in aRect.
-   * If successful, return that color, otherwise return NS_RGBA(0,0,0,0).
-   */
-  nscolor FindOpaqueColorCovering(nsDisplayListBuilder* aBuilder,
-                                  ThebesLayer* aLayer, const nsRect& aRect);
-
 protected:
   /**
    * We store an array of these for each frame that is associated with
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index 364bf10385b5..df8ff01b4f95 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -1251,9 +1251,9 @@ IsSmoothScrollingEnabled()
 
 class ScrollFrameActivityTracker : public nsExpirationTracker<nsGfxScrollFrameInner,4> {
 public:
-  // Wait for 3-4s between scrolls before we remove our layers.
-  // That's 4 generations of 1s each.
-  enum { TIMEOUT_MS = 1000 };
+  // Wait for 75-100ms between scrolls before we switch the appearance back to
+  // subpixel AA. That's 4 generations of 25ms each.
+  enum { TIMEOUT_MS = 25 };
   ScrollFrameActivityTracker()
     : nsExpirationTracker<nsGfxScrollFrameInner,4>(TIMEOUT_MS) {}
   ~ScrollFrameActivityTracker() {
diff --git a/layout/reftests/bidi/logicalmarquee.html b/layout/reftests/bidi/logicalmarquee.html
index cb13827dec7b..9ba9d6306cf4 100644
--- a/layout/reftests/bidi/logicalmarquee.html
+++ b/layout/reftests/bidi/logicalmarquee.html
@@ -6,6 +6,6 @@
   </head>
 
   <body>
-    <marquee scrollamount="0" behavior="alternate" direction="right">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</marquee>
+    <marquee scrollamount="0" behavior="alternate" direction="right" style="opacity:0.9">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</marquee>
  </body>
 </html>
diff --git a/layout/reftests/bidi/marquee-ref.html b/layout/reftests/bidi/marquee-ref.html
index d8778dc88063..724e4f8559d2 100644
--- a/layout/reftests/bidi/marquee-ref.html
+++ b/layout/reftests/bidi/marquee-ref.html
@@ -6,6 +6,6 @@
   </head>
 
   <body>
-    <div dir="rtl" align="left">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</div>
+    <div dir="rtl" align="left" style="opacity:0.9">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</div>
  </body>
 </html>
diff --git a/layout/reftests/bidi/visualmarquee.html b/layout/reftests/bidi/visualmarquee.html
index 932fd775a191..51a559469124 100644
--- a/layout/reftests/bidi/visualmarquee.html
+++ b/layout/reftests/bidi/visualmarquee.html
@@ -6,6 +6,6 @@
   </head>
 
   <body>
-    <marquee scrollamount="0" behavior="alternate" direction="right">&#x05DD;&#x05D9;&#x05DC;&#x05D9;&#x05DC;&#x05E6;&#x05D4; &#x05D5;&#x05E1;&#x05E0;&#x05D5; &#x05DD;&#x05D5;&#x05D9;&#x05D4; &#x05D7;&#x05D5;&#x05E4;&#x05D9;&#x05E9; &#x05D3;&#x05E2;</marquee>
+    <marquee scrollamount="0" behavior="alternate" direction="right" style="opacity:0.9">&#x05DD;&#x05D9;&#x05DC;&#x05D9;&#x05DC;&#x05E6;&#x05D4; &#x05D5;&#x05E1;&#x05E0;&#x05D5; &#x05DD;&#x05D5;&#x05D9;&#x05D4; &#x05D7;&#x05D5;&#x05E4;&#x05D9;&#x05E9; &#x05D3;&#x05E2;</marquee>
  </body>
 </html>
diff --git a/layout/reftests/marquee/413027-4-ref.html b/layout/reftests/marquee/413027-4-ref.html
index 22fdd42e6016..fbe705e414da 100644
--- a/layout/reftests/marquee/413027-4-ref.html
+++ b/layout/reftests/marquee/413027-4-ref.html
@@ -4,7 +4,7 @@
 <body>
 
 <div style="background-color: lime; width: 600px; float:left;">
-  <div style="margin: 100px 0px; padding-left: 2px;">text</div>
+  <div style="margin: 100px 0px; padding-left: 2px; opacity:0.9;">text</div>
 </div>
       
 </body></html>
diff --git a/layout/reftests/marquee/413027-4.html b/layout/reftests/marquee/413027-4.html
index d57f2f121517..beb15e6f752a 100644
--- a/layout/reftests/marquee/413027-4.html
+++ b/layout/reftests/marquee/413027-4.html
@@ -8,7 +8,7 @@
 <!-- padding-left used to avoid risk of an antialiasing pixel that may
      project to the left of the origin, causing a spurious test failure
      (see bugs 476927, 475968) -->
-  <div style="margin: 100px 0px; padding-left: 2px;">text</div>
+  <div style="margin: 100px 0px; padding-left: 2px; opacity:0.9;">text</div>
 </div>
 </marquee>
       
diff --git a/layout/reftests/scrolling/fixed-text-1.html b/layout/reftests/scrolling/fixed-text-1.html
deleted file mode 100644
index d470a7c6415d..000000000000
--- a/layout/reftests/scrolling/fixed-text-1.html
+++ /dev/null
@@ -1,7 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<body style="height:2000px; overflow:hidden; background:url(repeatable-diagonal-gradient.png) fixed;">
-<script src="scrolling.js"></script>
-<p>Hello Kitty
-</body>
-</html>
diff --git a/layout/reftests/scrolling/reftest.list b/layout/reftests/scrolling/reftest.list
index e227cefd356b..bfdc32a7ad77 100644
--- a/layout/reftests/scrolling/reftest.list
+++ b/layout/reftests/scrolling/reftest.list
@@ -1,7 +1,5 @@
 HTTP == fixed-1.html fixed-1.html?ref
-HTTP == fixed-text-1.html fixed-text-1.html?ref
 HTTP == opacity-mixed-scrolling-1.html opacity-mixed-scrolling-1.html?ref
 HTTP == simple-1.html simple-1.html?ref
-HTTP == text-1.html text-1.html?ref
 == uncovering-1.html uncovering-1-ref.html
 == uncovering-2.html uncovering-2-ref.html
diff --git a/layout/reftests/scrolling/text-1.html b/layout/reftests/scrolling/text-1.html
deleted file mode 100644
index 0ede92a6fa28..000000000000
--- a/layout/reftests/scrolling/text-1.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<body>
-<script src="scrolling.js"></script>
-<div class="scrollTop" style="height:100px; overflow:auto;">
-  <div style="margin-top:30px;">Hello Kitty</div>
-  <div style="height:400px;"></div>
-</div>
-</body>
-</html>

From ab510e7491f2650199b1269e337771ee99158940 Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jfkthame@gmail.com>
Date: Thu, 2 Sep 2010 12:28:48 +0100
Subject: [PATCH 017/222] bug 569531 - enable harfbuzz by default on windows.
 r=roc approval2.0=roc

---
 layout/reftests/bidi/reftest.list          |  4 ++--
 layout/reftests/font-features/reftest.list | 10 ++++------
 layout/reftests/svg/reftest.list           |  2 +-
 modules/libpref/src/init/all.js            |  4 ----
 4 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/layout/reftests/bidi/reftest.list b/layout/reftests/bidi/reftest.list
index 64552fbc392e..0e483be389a8 100644
--- a/layout/reftests/bidi/reftest.list
+++ b/layout/reftests/bidi/reftest.list
@@ -31,10 +31,10 @@ random-if(gtk2Widget) == mixedChartype-03-j.html mixedChartype-03-ref.html
 == 115921-1.html 115921-1-ref.html
 == 115921-2.html 115921-2-ref.html
 == 258928-1.html 258928-1-ref.html
-== 267459-1.html 267459-1-ref.html
+random-if(winWidget) == 267459-1.html 267459-1-ref.html # depends on windows version, see bug 590101
 == 267459-2.html 267459-2-ref.html
 == 299065-1.html 299065-1-ref.html
-== 305643-1.html 305643-1-ref.html
+random-if(winWidget) == 305643-1.html 305643-1-ref.html # depends on windows version, see bug 590101
 == 332655-1.html 332655-1-ref.html
 == 332655-2.html 332655-2-ref.html
 == 381279-1.html 381279-1-ref.html
diff --git a/layout/reftests/font-features/reftest.list b/layout/reftests/font-features/reftest.list
index e9299769d238..3d34a7d11d3f 100644
--- a/layout/reftests/font-features/reftest.list
+++ b/layout/reftests/font-features/reftest.list
@@ -7,19 +7,17 @@
 
 # check that Turkish language causes a change in rendering (no fi ligature)
 # (also works via Pango)
-# marking as random on windows until we turn on harfbuzz, because behavior depends on uniscribe version
-random-if(winWidget) HTTP(..) != font-features-turkish.html font-features-ref.html
+HTTP(..) != font-features-turkish.html font-features-ref.html
 
 # check that disabling ligatures causes a change
-fails-if(!cocoaWidget) HTTP(..) != font-features-noliga.html font-features-ref.html
+fails-if(gtk2Widget) HTTP(..) != font-features-noliga.html font-features-ref.html
 
 # check that enabling optional ligatures causes a change
-fails-if(!cocoaWidget) HTTP(..) != font-features-hlig.html font-features-ref.html
+fails-if(gtk2Widget) HTTP(..) != font-features-hlig.html font-features-ref.html
 
 # compare Turkish rendering with reference using ZWNJ to break the ligature
 # (also works via Pango)
-# marking as random on windows until we turn on harfbuzz, because behavior depends on uniscribe version
-random-if(winWidget) HTTP(..) == font-features-turkish.html font-features-turkish-ref.html
+HTTP(..) == font-features-turkish.html font-features-turkish-ref.html
 
 # compare Turkish rendering with explicitly disabled ligatures
 # (fails on Linux because Pango recognizes the Turkish lang but not the feature setting)
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index 2ecfa10002c2..ab4af5e2452a 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -150,7 +150,7 @@ fails-if(gtk2Widget) == objectBoundingBox-and-fePointLight-01.svg objectBounding
 random-if(gtk2Widget) == text-font-weight-01.svg text-font-weight-01-ref.svg # bug 386713
 == switch-01.svg pass.svg
 == text-gradient-01.svg text-gradient-01-ref.svg
-== text-gradient-02.svg text-gradient-02-ref.svg
+random-if(winWidget) == text-gradient-02.svg text-gradient-02-ref.svg # see bug 590101
 == text-in-link-01.svg text-in-link-01-ref.svg
 == text-in-link-02.svg text-in-link-02-ref.svg
 == text-in-link-03.svg text-in-link-03-ref.svg
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 79a33d62facd..5b2f4765842a 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -183,11 +183,7 @@ pref("gfx.3d_video.enabled", false);
 
 pref("gfx.downloadable_fonts.enabled", true);
 
-#ifdef XP_MACOSX
 pref("gfx.font_rendering.harfbuzz.level", 1);
-#else
-pref("gfx.font_rendering.harfbuzz.level", 0);
-#endif
 
 #ifdef XP_WIN
 #ifndef WINCE

From fcc649f98aa4beb939ccfbd1fba8e9e32252d2e7 Mon Sep 17 00:00:00 2001
From: Kurt Schultz <supernova00@gmail.com>
Date: Sat, 28 Aug 2010 11:24:43 -0400
Subject: [PATCH 018/222] Bug 590738 - Adjust color of menu separators in the
 app button menu. r=dao

--HG--
extra : rebase_source : cea6aefb986df9e8d0660f12cb119b62e3c7c371
---
 browser/base/content/browser.xul             |  8 ++++----
 browser/themes/winstripe/browser/browser.css | 11 +++++++++++
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index 57456b936cab..d951453c2312 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -488,7 +488,7 @@
                     startlabel="&privateBrowsingCmd.start.label;"
                     stoplabel="&privateBrowsingCmd.stop.label;"
                     command="Tools:PrivateBrowsing"/>
-          <menuseparator/>
+          <menuseparator class="appmenu-menuseparator"/>
           <hbox class="split-menuitem">
             <menuitem id="appmenu-edit-menuitem"
                       label="&editMenu.label;"
@@ -512,7 +512,7 @@
           <menuitem id="appmenu_find"
                     label="&appMenuFind.label;"
                     command="cmd_find"/>
-          <menuseparator/>
+          <menuseparator class="appmenu-menuseparator"/>
           <menuitem id="appmenu_savePage"
                     label="&savePageCmd.label;"
                     command="Browser:SavePage"/>
@@ -541,7 +541,7 @@
               </menupopup>
             </menu>
           </hbox>
-          <menuseparator/>
+          <menuseparator class="appmenu-menuseparator"/>
           <menu id="appmenu_developer"
                 label="&developerMenu.label;">
             <menupopup id="appmenu_developer_popup">
@@ -563,7 +563,7 @@
                         oncommand="BrowserOffline.toggleOfflineStatus();"/>
             </menupopup>
           </menu>
-          <menuseparator/>
+          <menuseparator class="appmenu-menuseparator"/>
           <menuitem id="appmenu_fullScreen"
                     label="&fullScreenCmd.label;"
                     type="checkbox"
diff --git a/browser/themes/winstripe/browser/browser.css b/browser/themes/winstripe/browser/browser.css
index 1cb0441176ca..0f2eec437cd1 100644
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@@ -199,6 +199,17 @@ statusbarpanel#statusbar-display {
     padding-top: 5px;
     font-family: "Segoe UI Semibold", "Segoe UI", sans-serif;
   }
+
+  .appmenu-menuseparator {
+    -moz-appearance: none;
+    margin-top: 3px;
+    margin-bottom: 3px;
+    -moz-margin-start: 30px;
+    padding: 0;
+    border-top: 1px solid #d6e5f5;
+    border-bottom: none;
+  }
+
   .appmenu-edit-button:not([disabled]):hover {
     border: 1px solid #b8d6fb;
     -moz-box-shadow: inset 0 0 1px white;

From a518ce182f17027d85ce5d21d66edf82ad7b79fd Mon Sep 17 00:00:00 2001
From: Kurt Schultz <supernova00@gmail.com>
Date: Sun, 29 Aug 2010 09:36:28 -0400
Subject: [PATCH 019/222] Bug 587295 - Remove "Bookmark This Tab" from the tab
 context menu. r=dao ui-r=faabobrg

--HG--
extra : rebase_source : a6265f02b7537d123116dd8b92299d59f388bdba
---
 browser/base/content/browser.js                  | 5 -----
 browser/base/content/browser.xul                 | 4 ----
 browser/locales/en-US/chrome/browser/browser.dtd | 2 --
 3 files changed, 11 deletions(-)

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 71a90d4f9752..debad768d3ad 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -324,11 +324,6 @@ function SetClickAndHoldHandlers() {
 }
 #endif
 
-function BookmarkThisTab(aTab) {
-  PlacesCommandHook.bookmarkPage(aTab.linkedBrowser,
-                                 PlacesUtils.bookmarksMenuFolderId, true);
-}
-
 const gSessionHistoryObserver = {
   observe: function(subject, topic, data)
   {
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index d951453c2312..386237ca5ea9 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -136,10 +136,6 @@
         </menupopup>
       </menu>
       <menuseparator/>
-      <menuitem id="context_bookmarkTab"
-                label="&bookmarkThisTab.label;"
-                accesskey="&bookmarkThisTab.accesskey;"
-                oncommand="BookmarkThisTab(TabContextMenu.contextTab);"/>
       <menuitem id="context_bookmarkAllTabs"
                 label="&bookmarkAllTabs.label;"
                 accesskey="&bookmarkAllTabs.accesskey;"
diff --git a/browser/locales/en-US/chrome/browser/browser.dtd b/browser/locales/en-US/chrome/browser/browser.dtd
index 9ed9e1df23df..f578283db14a 100644
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@@ -27,8 +27,6 @@
 <!ENTITY  moveToGroup.label                  "Move to Group">
 <!ENTITY  moveToGroup.accesskey              "M">
 <!ENTITY  moveToNewGroup.label               "New Group">
-<!ENTITY  bookmarkThisTab.label              "Bookmark This Tab">
-<!ENTITY  bookmarkThisTab.accesskey          "B">
 <!ENTITY  bookmarkAllTabs.label              "Bookmark All Tabs…">
 <!ENTITY  bookmarkAllTabs.accesskey          "T">
 <!ENTITY  undoCloseTab.label                 "Undo Close Tab">

From a501a996a89d1d79e3864866764825564228524a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Thu, 2 Sep 2010 13:37:41 +0200
Subject: [PATCH 020/222] Bug 591125 - Sanitize the app name for the UA string.
 r=dwitte a=jst

--HG--
extra : rebase_source : caccb90b5338953d35f4a98c90bf2d7ed12fd06c
---
 netwerk/protocol/http/nsHttpHandler.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp
index 1fb60f34282a..f7b0cc8fc77c 100644
--- a/netwerk/protocol/http/nsHttpHandler.cpp
+++ b/netwerk/protocol/http/nsHttpHandler.cpp
@@ -283,6 +283,7 @@ nsHttpHandler::Init()
     if (mAppName.Length() == 0 && appInfo) {
         appInfo->GetName(mAppName);
         appInfo->GetVersion(mAppVersion);
+        mAppName.StripChars(" ()<>@,;:\\\"/[]?={}");
     } else {
         mAppVersion.AssignLiteral(MOZ_APP_UA_VERSION);
     }

From f87313f708539b6a71918f60f4f8c6aba4e2860a Mon Sep 17 00:00:00 2001
From: Honza Bambas <honzab.moz@firemni.cz>
Date: Thu, 2 Sep 2010 19:11:11 +0200
Subject: [PATCH 021/222] Backout nsHttpChannel part of bug 513008, r=michal
 a=bsmedberg

---
 netwerk/cache/nsCacheService.cpp        |   5 +-
 netwerk/protocol/http/nsHttpChannel.cpp | 374 ++++++++----------------
 netwerk/protocol/http/nsHttpChannel.h   |  17 +-
 3 files changed, 132 insertions(+), 264 deletions(-)

diff --git a/netwerk/cache/nsCacheService.cpp b/netwerk/cache/nsCacheService.cpp
index d9cdd31f29eb..6eae5546400d 100644
--- a/netwerk/cache/nsCacheService.cpp
+++ b/netwerk/cache/nsCacheService.cpp
@@ -1298,6 +1298,7 @@ nsCacheService::OpenCacheEntry(nsCacheSession *           session,
 
     CACHE_LOG_DEBUG(("Created request %p\n", request));
 
+#if 0 // Disabled because of bug 589296
     // Process the request on the background thread if we are on the main thread
     // and the the request is asynchronous
     if (NS_IsMainThread() && listener && gService->mCacheIOThread) {
@@ -1313,7 +1314,9 @@ nsCacheService::OpenCacheEntry(nsCacheSession *           session,
         if (NS_FAILED(rv))
             delete request;
     }
-    else {
+    else 
+#endif
+    {
         rv = gService->ProcessRequest(request, PR_TRUE, result);
 
         // delete requests that have completed
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index bc154299361e..ffb12f9e743a 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -117,8 +117,6 @@ nsHttpChannel::nsHttpChannel()
     , mCacheAccess(0)
     , mPostID(0)
     , mRequestTime(0)
-    , mOnCacheEntryAvailableCallback(nsnull)
-    , mAsyncCacheOpen(PR_FALSE)
     , mPendingAsyncCallOnResume(nsnull)
     , mSuspendCount(0)
     , mApplyConversion(PR_TRUE)
@@ -225,6 +223,8 @@ nsHttpChannel::Connect(PRBool firstTime)
 
     // true when called from AsyncOpen
     if (firstTime) {
+        PRBool delayed = PR_FALSE;
+
         // are we offline?
         PRBool offline = gIOService->IsOffline();
         if (offline)
@@ -239,7 +239,7 @@ nsHttpChannel::Connect(PRBool firstTime)
         }
 
         // open a cache entry for this channel...
-        rv = OpenCacheEntry();
+        rv = OpenCacheEntry(offline, &delayed);
 
         if (NS_FAILED(rv)) {
             LOG(("OpenCacheEntry failed [rv=%x]\n", rv));
@@ -263,7 +263,7 @@ nsHttpChannel::Connect(PRBool firstTime)
             if (NS_FAILED(rv)) return rv;
         }
 
-        if (NS_SUCCEEDED(rv) && mAsyncCacheOpen)
+        if (NS_SUCCEEDED(rv) && delayed)
             return NS_OK;
     }
 
@@ -296,14 +296,6 @@ nsHttpChannel::Connect(PRBool firstTime)
             return NS_ERROR_DOCUMENT_NOT_CACHED;
         }
     }
-    else if (mLoadFlags & LOAD_ONLY_FROM_CACHE) {
-        // If we have a fallback URI (and we're not already
-        // falling back), process the fallback asynchronously.
-        if (!mFallbackChannel && !mFallbackKey.IsEmpty()) {
-            return AsyncCall(&nsHttpChannel::HandleAsyncFallback);
-        }
-        return NS_ERROR_DOCUMENT_NOT_CACHED;
-    }
 
     // check to see if authorization headers should be included
     mAuthProvider->AddAuthorizationHeaders();
@@ -1942,11 +1934,11 @@ IsSubRangeRequest(nsHttpRequestHead &aRequestHead)
 }
 
 nsresult
-nsHttpChannel::OpenCacheEntry()
+nsHttpChannel::OpenCacheEntry(PRBool offline, PRBool *delayed)
 {
     nsresult rv;
 
-    mAsyncCacheOpen = PR_FALSE;
+    *delayed = PR_FALSE;
     mLoadedFromApplicationCache = PR_FALSE;
 
     LOG(("nsHttpChannel::OpenCacheEntry [this=%p]", this));
@@ -1982,10 +1974,23 @@ nsHttpChannel::OpenCacheEntry()
 
     GenerateCacheKey(mPostID, cacheKey);
 
+    // Get a cache session with appropriate storage policy
+    nsCacheStoragePolicy storagePolicy = DetermineStoragePolicy();
+
     // Set the desired cache access mode accordingly...
     nsCacheAccessMode accessRequested;
-    rv = DetermineCacheAccess(&accessRequested);
-    if (NS_FAILED(rv)) return rv;
+    if (offline || (mLoadFlags & INHIBIT_CACHING)) {
+        // If we have been asked to bypass the cache and not write to the
+        // cache, then don't use the cache at all.  Unless we're actually
+        // offline, which takes precedence over BYPASS_LOCAL_CACHE.
+        if (BYPASS_LOCAL_CACHE(mLoadFlags) && !offline)
+            return NS_ERROR_NOT_AVAILABLE;
+        accessRequested = nsICache::ACCESS_READ;
+    }
+    else if (BYPASS_LOCAL_CACHE(mLoadFlags))
+        accessRequested = nsICache::ACCESS_WRITE; // replace cache entry
+    else
+        accessRequested = nsICache::ACCESS_READ_WRITE; // normal browsing
 
     if (!mApplicationCache && mInheritApplicationCache) {
         // Pick up an application cache from the notification
@@ -2014,6 +2019,10 @@ nsHttpChannel::OpenCacheEntry()
 
     nsCOMPtr<nsICacheSession> session;
 
+    // Will be set to true if we've found the right session, but need
+    // to open the cache entry asynchronously.
+    PRBool waitingForValidation = PR_FALSE;
+
     // If we have an application cache, we check it first.
     if (mApplicationCache) {
         nsCAutoString appCacheClientID;
@@ -2029,217 +2038,107 @@ nsHttpChannel::OpenCacheEntry()
                                  getter_AddRefs(session));
         NS_ENSURE_SUCCESS(rv, rv);
 
-        if (mLoadFlags & LOAD_BYPASS_LOCAL_CACHE_IF_BUSY) {
-            // must use synchronous open for LOAD_BYPASS_LOCAL_CACHE_IF_BUSY
-            rv = session->OpenCacheEntry(cacheKey,
-                                         nsICache::ACCESS_READ, PR_FALSE,
-                                         getter_AddRefs(mCacheEntry));
-            if (NS_SUCCEEDED(rv)) {
-                mCacheEntry->GetAccessGranted(&mCacheAccess);
-                LOG(("nsHttpChannel::OpenCacheEntry [this=%p grantedAccess=%d]",
-                    this, mCacheAccess));
-                mLoadedFromApplicationCache = PR_TRUE;
-                return NS_OK;
-            } else if (rv == NS_ERROR_CACHE_WAIT_FOR_VALIDATION) {
-                LOG(("bypassing local cache since it is busy\n"));
-                // Don't try to load normal cache entry
-                return NS_ERROR_NOT_AVAILABLE;
-            }
-        } else {
-            mOnCacheEntryAvailableCallback =
-                &nsHttpChannel::OnOfflineCacheEntryAvailable;
-            // We open with ACCESS_READ only, because we don't want to
-            // overwrite the offline cache entry non-atomically.
-            // ACCESS_READ will prevent us from writing to the offline
-            // cache as a normal cache entry.
-            rv = session->AsyncOpenCacheEntry(cacheKey,
-                                              nsICache::ACCESS_READ,
-                                              this);
-
-            if (NS_SUCCEEDED(rv)) {
-                mAsyncCacheOpen = PR_TRUE;
-                return NS_OK;
-            }
+        // we'll try to synchronously open the cache entry... however,
+        // it may be in use and not yet validated, in which case we'll
+        // try asynchronously opening the cache entry.
+        //
+        // We open with ACCESS_READ only, because we don't want to
+        // overwrite the offline cache entry non-atomically.
+        // ACCESS_READ will prevent us from writing to the offline
+        // cache as a normal cache entry.
+        rv = session->OpenCacheEntry(cacheKey,
+                                     nsICache::ACCESS_READ, PR_FALSE,
+                                     getter_AddRefs(mCacheEntry));
+        if (rv == NS_ERROR_CACHE_WAIT_FOR_VALIDATION) {
+            accessRequested = nsICache::ACCESS_READ;
+            waitingForValidation = PR_TRUE;
+            rv = NS_OK;
         }
 
-        // sync or async opening failed
-        return OnOfflineCacheEntryAvailable(nsnull, nsICache::ACCESS_NONE,
-                                            rv, PR_TRUE);
-    }
-
-    return OpenNormalCacheEntry(PR_TRUE);
-}
-
-nsresult
-nsHttpChannel::OnOfflineCacheEntryAvailable(nsICacheEntryDescriptor *aEntry,
-                                            nsCacheAccessMode aAccess,
-                                            nsresult aEntryStatus,
-                                            PRBool aIsSync)
-{
-    nsresult rv;
-
-    if (NS_SUCCEEDED(aEntryStatus)) {
-        // We successfully opened an offline cache session and the entry,
-        // so indicate we will load from the offline cache.
-        mLoadedFromApplicationCache = PR_TRUE;
-        mCacheEntry = aEntry;
-        mCacheAccess = aAccess;
-    }
-
-    if (mCanceled && NS_FAILED(mStatus)) {
-        LOG(("channel was canceled [this=%p status=%x]\n", this, mStatus));
-        return mStatus;
-    }
-
-    if (NS_SUCCEEDED(aEntryStatus))
-        // Called from OnCacheEntryAvailable, advance to the next state
-        return Connect(PR_FALSE);
-
-    if (!mCacheForOfflineUse && !mFallbackChannel) {
-        nsCAutoString cacheKey;
-        GenerateCacheKey(mPostID, cacheKey);
-
-        // Check for namespace match.
-        nsCOMPtr<nsIApplicationCacheNamespace> namespaceEntry;
-        rv = mApplicationCache->GetMatchingNamespace
-            (cacheKey, getter_AddRefs(namespaceEntry));
-        if (NS_FAILED(rv) && !aIsSync)
-            return Connect(PR_FALSE);
-        NS_ENSURE_SUCCESS(rv, rv);
-
-        PRUint32 namespaceType = 0;
-        if (!namespaceEntry ||
-            NS_FAILED(namespaceEntry->GetItemType(&namespaceType)) ||
-            (namespaceType &
-             (nsIApplicationCacheNamespace::NAMESPACE_FALLBACK |
-              nsIApplicationCacheNamespace::NAMESPACE_OPPORTUNISTIC |
-              nsIApplicationCacheNamespace::NAMESPACE_BYPASS)) == 0) {
-            // When loading from an application cache, only items
-            // on the whitelist or matching a
-            // fallback/opportunistic namespace should hit the
-            // network...
-            mLoadFlags |= LOAD_ONLY_FROM_CACHE;
-
-            // ... and if there were an application cache entry,
-            // we would have found it earlier.
-            return aIsSync ? NS_ERROR_CACHE_KEY_NOT_FOUND : Connect(PR_FALSE);
-        }
-
-        if (namespaceType &
-            nsIApplicationCacheNamespace::NAMESPACE_FALLBACK) {
-            rv = namespaceEntry->GetData(mFallbackKey);
-            if (NS_FAILED(rv) && !aIsSync)
-                return Connect(PR_FALSE);
+        if (NS_FAILED(rv) && !mCacheForOfflineUse && !mFallbackChannel) {
+            // Check for namespace match.
+            nsCOMPtr<nsIApplicationCacheNamespace> namespaceEntry;
+            rv = mApplicationCache->GetMatchingNamespace
+                (cacheKey, getter_AddRefs(namespaceEntry));
             NS_ENSURE_SUCCESS(rv, rv);
+
+            PRUint32 namespaceType = 0;
+            if (!namespaceEntry ||
+                NS_FAILED(namespaceEntry->GetItemType(&namespaceType)) ||
+                (namespaceType &
+                 (nsIApplicationCacheNamespace::NAMESPACE_FALLBACK |
+                  nsIApplicationCacheNamespace::NAMESPACE_OPPORTUNISTIC |
+                  nsIApplicationCacheNamespace::NAMESPACE_BYPASS)) == 0) {
+                // When loading from an application cache, only items
+                // on the whitelist or matching a
+                // fallback/opportunistic namespace should hit the
+                // network...
+                mLoadFlags |= LOAD_ONLY_FROM_CACHE;
+
+                // ... and if there were an application cache entry,
+                // we would have found it earlier.
+                return NS_ERROR_CACHE_KEY_NOT_FOUND;
+            }
+
+            if (namespaceType &
+                nsIApplicationCacheNamespace::NAMESPACE_FALLBACK) {
+                rv = namespaceEntry->GetData(mFallbackKey);
+                NS_ENSURE_SUCCESS(rv, rv);
+            }
+
+            if ((namespaceType &
+                 nsIApplicationCacheNamespace::NAMESPACE_OPPORTUNISTIC) &&
+                mLoadFlags & LOAD_DOCUMENT_URI) {
+                // Document loads for items in an opportunistic namespace
+                // should be placed in the offline cache.
+                nsCString clientID;
+                mApplicationCache->GetClientID(clientID);
+
+                mCacheForOfflineUse = !clientID.IsEmpty();
+                SetOfflineCacheClientID(clientID);
+                mCachingOpportunistically = PR_TRUE;
+            }
         }
-
-        if ((namespaceType &
-             nsIApplicationCacheNamespace::NAMESPACE_OPPORTUNISTIC) &&
-            mLoadFlags & LOAD_DOCUMENT_URI) {
-            // Document loads for items in an opportunistic namespace
-            // should be placed in the offline cache.
-            nsCString clientID;
-            mApplicationCache->GetClientID(clientID);
-
-            mCacheForOfflineUse = !clientID.IsEmpty();
-            SetOfflineCacheClientID(clientID);
-            mCachingOpportunistically = PR_TRUE;
+        else if (NS_SUCCEEDED(rv)) {
+            // We successfully opened an offline cache session and the entry,
+            // now indiciate we load from the offline cache.
+            mLoadedFromApplicationCache = PR_TRUE;
         }
     }
 
-    return OpenNormalCacheEntry(aIsSync);
-}
+    if (!mCacheEntry && !waitingForValidation) {
+        rv = gHttpHandler->GetCacheSession(storagePolicy,
+                                           getter_AddRefs(session));
+        if (NS_FAILED(rv)) return rv;
 
-
-nsresult
-nsHttpChannel::OpenNormalCacheEntry(PRBool aIsSync)
-{
-    NS_ASSERTION(!mCacheEntry, "We have already mCacheEntry");
-
-    nsresult rv;
-
-    nsCAutoString cacheKey;
-    GenerateCacheKey(mPostID, cacheKey);
-
-    nsCacheStoragePolicy storagePolicy = DetermineStoragePolicy();
-
-    nsCOMPtr<nsICacheSession> session;
-    rv = gHttpHandler->GetCacheSession(storagePolicy,
-                                       getter_AddRefs(session));
-    if (NS_FAILED(rv)) return rv;
-
-    nsCacheAccessMode accessRequested;
-    rv = DetermineCacheAccess(&accessRequested);
-    if (NS_FAILED(rv)) return rv;
-
-    if (mLoadFlags & LOAD_BYPASS_LOCAL_CACHE_IF_BUSY) {
-        if (!aIsSync) {
-            // Unexpected state: we were called from OnCacheEntryAvailable(),
-            // so LOAD_BYPASS_LOCAL_CACHE_IF_BUSY shouldn't be set. Unless
-            // somebody altered mLoadFlags between OpenCacheEntry() and
-            // OnCacheEntryAvailable()...
-            NS_WARNING(
-                "OpenNormalCacheEntry() called from OnCacheEntryAvailable() "
-                "when LOAD_BYPASS_LOCAL_CACHE_IF_BUSY was specified");
-        }
-
-        // must use synchronous open for LOAD_BYPASS_LOCAL_CACHE_IF_BUSY
         rv = session->OpenCacheEntry(cacheKey, accessRequested, PR_FALSE,
                                      getter_AddRefs(mCacheEntry));
-        if (NS_SUCCEEDED(rv)) {
-            mCacheEntry->GetAccessGranted(&mCacheAccess);
-            LOG(("nsHttpChannel::OpenCacheEntry [this=%p grantedAccess=%d]",
-                this, mCacheAccess));
+        if (rv == NS_ERROR_CACHE_WAIT_FOR_VALIDATION) {
+            waitingForValidation = PR_TRUE;
+            rv = NS_OK;
         }
-        else if (rv == NS_ERROR_CACHE_WAIT_FOR_VALIDATION) {
+        if (NS_FAILED(rv)) return rv;
+    }
+
+    if (waitingForValidation) {
+        // access to the cache entry has been denied (because the
+        // cache entry is probably in use by another channel).
+        if (mLoadFlags & LOAD_BYPASS_LOCAL_CACHE_IF_BUSY) {
             LOG(("bypassing local cache since it is busy\n"));
-            rv = NS_ERROR_NOT_AVAILABLE;
+            return NS_ERROR_NOT_AVAILABLE;
         }
-    }
-    else {
-        mOnCacheEntryAvailableCallback =
-            &nsHttpChannel::OnNormalCacheEntryAvailable;
         rv = session->AsyncOpenCacheEntry(cacheKey, accessRequested, this);
-        if (NS_SUCCEEDED(rv)) {
-            mAsyncCacheOpen = PR_TRUE;
-            return NS_OK;
-        }
+        if (NS_FAILED(rv)) return rv;
+        // we'll have to wait for the cache entry
+        *delayed = PR_TRUE;
+    }
+    else if (NS_SUCCEEDED(rv)) {
+        mCacheEntry->GetAccessGranted(&mCacheAccess);
+        LOG(("nsHttpChannel::OpenCacheEntry [this=%p grantedAccess=%d]", this, mCacheAccess));
     }
-
-    if (!aIsSync)
-        // Called from OnCacheEntryAvailable, advance to the next state
-        rv = Connect(PR_FALSE);
-
     return rv;
 }
 
-nsresult
-nsHttpChannel::OnNormalCacheEntryAvailable(nsICacheEntryDescriptor *aEntry,
-                                           nsCacheAccessMode aAccess,
-                                           nsresult aEntryStatus,
-                                           PRBool aIsSync)
-{
-    NS_ASSERTION(!aIsSync, "aIsSync should be false");
-
-    if (NS_SUCCEEDED(aEntryStatus)) {
-        mCacheEntry = aEntry;
-        mCacheAccess = aAccess;
-    }
-
-    if (mCanceled && NS_FAILED(mStatus)) {
-        LOG(("channel was canceled [this=%p status=%x]\n", this, mStatus));
-        return mStatus;
-    }
-
-    if ((mLoadFlags & LOAD_ONLY_FROM_CACHE) && NS_FAILED(aEntryStatus))
-        // if this channel is only allowed to pull from the cache, then
-        // we must fail if we were unable to open a cache entry.
-        return NS_ERROR_DOCUMENT_NOT_CACHED;
-
-    // advance to the next state...
-    return Connect(PR_FALSE);
-}
-
 
 nsresult
 nsHttpChannel::OpenOfflineCacheEntryForWriting()
@@ -4436,8 +4335,6 @@ nsHttpChannel::OnCacheEntryAvailable(nsICacheEntryDescriptor *entry,
                                      nsCacheAccessMode access,
                                      nsresult status)
 {
-    nsresult rv;
-
     LOG(("nsHttpChannel::OnCacheEntryAvailable [this=%p entry=%p "
          "access=%x status=%x]\n", this, entry, access, status));
 
@@ -4446,24 +4343,28 @@ nsHttpChannel::OnCacheEntryAvailable(nsICacheEntryDescriptor *entry,
     if (!mIsPending)
         return NS_OK;
 
-    nsOnCacheEntryAvailableCallback callback = mOnCacheEntryAvailableCallback;
-    mOnCacheEntryAvailableCallback = nsnull;
+    // otherwise, we have to handle this event.
+    if (NS_SUCCEEDED(status)) {
+        mCacheEntry = entry;
+        mCacheAccess = access;
+    }
 
-    NS_ASSERTION(callback,
-        "nsHttpChannel::OnCacheEntryAvailable called without callback");
-    rv = ((*this).*callback)(entry, access, status, PR_FALSE);
+    nsresult rv;
 
+    if (mCanceled && NS_FAILED(mStatus)) {
+        LOG(("channel was canceled [this=%p status=%x]\n", this, mStatus));
+        rv = mStatus;
+    }
+    else if ((mLoadFlags & LOAD_ONLY_FROM_CACHE) && NS_FAILED(status))
+        // if this channel is only allowed to pull from the cache, then
+        // we must fail if we were unable to open a cache entry.
+        rv = NS_ERROR_DOCUMENT_NOT_CACHED;
+    else
+        // advance to the next state...
+        rv = Connect(PR_FALSE);
+
+    // a failure from Connect means that we have to abort the channel.
     if (NS_FAILED(rv)) {
-        LOG(("AsyncOpenCacheEntry failed [rv=%x]\n", rv));
-        if (mLoadFlags & LOAD_ONLY_FROM_CACHE) {
-            // If we have a fallback URI (and we're not already
-            // falling back), process the fallback asynchronously.
-            if (!mFallbackChannel && !mFallbackKey.IsEmpty()) {
-                rv = AsyncCall(&nsHttpChannel::HandleAsyncFallback);
-                if (NS_SUCCEEDED(rv))
-                    return rv;
-            }
-        }
         CloseCacheEntry(PR_TRUE);
         AsyncAbort(rv);
     }
@@ -4930,27 +4831,6 @@ nsHttpChannel::DetermineStoragePolicy()
     return policy;
 }
 
-nsresult
-nsHttpChannel::DetermineCacheAccess(nsCacheAccessMode *_retval)
-{
-    PRBool offline = gIOService->IsOffline();
-
-    if (offline || (mLoadFlags & INHIBIT_CACHING)) {
-        // If we have been asked to bypass the cache and not write to the
-        // cache, then don't use the cache at all.  Unless we're actually
-        // offline, which takes precedence over BYPASS_LOCAL_CACHE.
-        if (BYPASS_LOCAL_CACHE(mLoadFlags) && !offline)
-            return NS_ERROR_NOT_AVAILABLE;
-        *_retval = nsICache::ACCESS_READ;
-    }
-    else if (BYPASS_LOCAL_CACHE(mLoadFlags))
-        *_retval = nsICache::ACCESS_WRITE; // replace cache entry
-    else
-        *_retval = nsICache::ACCESS_READ_WRITE; // normal browsing
-
-    return NS_OK;
-}
-
 void
 nsHttpChannel::AsyncOnExamineCachedResponse()
 {
diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h
index ca77de3bf799..fa8539fc20b9 100644
--- a/netwerk/protocol/http/nsHttpChannel.h
+++ b/netwerk/protocol/http/nsHttpChannel.h
@@ -217,16 +217,7 @@ private:
     nsresult ResolveProxy();
 
     // cache specific methods
-    nsresult OpenCacheEntry();
-    nsresult OnOfflineCacheEntryAvailable(nsICacheEntryDescriptor *aEntry,
-                                          nsCacheAccessMode aAccess,
-                                          nsresult aResult,
-                                          PRBool aSync);
-    nsresult OpenNormalCacheEntry(PRBool aSync);
-    nsresult OnNormalCacheEntryAvailable(nsICacheEntryDescriptor *aEntry,
-                                         nsCacheAccessMode aAccess,
-                                         nsresult aResult,
-                                         PRBool aSync);
+    nsresult OpenCacheEntry(PRBool offline, PRBool *delayed);
     nsresult OpenOfflineCacheEntryForWriting();
     nsresult GenerateCacheKey(PRUint32 postID, nsACString &key);
     nsresult UpdateExpirationTime();
@@ -244,7 +235,6 @@ private:
     nsresult InstallOfflineCacheListener();
     void     MaybeInvalidateCacheEntryForSubsequentGet();
     nsCacheStoragePolicy DetermineStoragePolicy();
-    nsresult DetermineCacheAccess(nsCacheAccessMode *_retval);
     void     AsyncOnExamineCachedResponse();
 
     // Handle the bogus Content-Encoding Apache sometimes sends
@@ -287,11 +277,6 @@ private:
     PRUint32                          mPostID;
     PRUint32                          mRequestTime;
 
-    typedef nsresult (nsHttpChannel:: *nsOnCacheEntryAvailableCallback)(
-        nsICacheEntryDescriptor *, nsCacheAccessMode, nsresult, PRBool);
-    nsOnCacheEntryAvailableCallback   mOnCacheEntryAvailableCallback;
-    PRBool                            mAsyncCacheOpen;
-
     nsCOMPtr<nsICacheEntryDescriptor> mOfflineCacheEntry;
     nsCacheAccessMode                 mOfflineCacheAccess;
     nsCString                         mOfflineCacheClientID;

From c323cf4ed9b9637b018a342ffeba2254a23e1fd4 Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Thu, 2 Sep 2010 13:59:54 -0400
Subject: [PATCH 022/222] Backed out changeset be48a89b9561. Asked for by
 Mossop and dietrich.

---
 .../extensions/content/extensions-content.js  |  2 +-
 .../extensions/test/xpinstall/Makefile.in     |  2 -
 .../browser_unsigned_trigger_iframe.js        | 50 -------------------
 .../test/xpinstall/installtrigger_frame.html  | 29 -----------
 4 files changed, 1 insertion(+), 82 deletions(-)
 delete mode 100644 toolkit/mozapps/extensions/test/xpinstall/browser_unsigned_trigger_iframe.js
 delete mode 100644 toolkit/mozapps/extensions/test/xpinstall/installtrigger_frame.html

diff --git a/toolkit/mozapps/extensions/content/extensions-content.js b/toolkit/mozapps/extensions/content/extensions-content.js
index 0f2f5b7c88b2..32262753c071 100644
--- a/toolkit/mozapps/extensions/content/extensions-content.js
+++ b/toolkit/mozapps/extensions/content/extensions-content.js
@@ -250,7 +250,7 @@ function InstallTriggerManager() {
 
 InstallTriggerManager.prototype = {
   handleEvent: function handleEvent(aEvent) {
-    var window = aEvent.target.defaultView;
+    var window = aEvent.originalTarget.defaultView.content;
 
     // Need to make sure we are called on what we care about -
     // content windows. DOMWindowCreated is called on *all* HTMLDocuments,
diff --git a/toolkit/mozapps/extensions/test/xpinstall/Makefile.in b/toolkit/mozapps/extensions/test/xpinstall/Makefile.in
index da3810ca2650..b65413bea67a 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/Makefile.in
+++ b/toolkit/mozapps/extensions/test/xpinstall/Makefile.in
@@ -46,7 +46,6 @@ include $(topsrcdir)/config/rules.mk
 _BROWSER_FILES = head.js \
                  browser_unsigned_url.js \
                  browser_unsigned_trigger.js \
-                 browser_unsigned_trigger_iframe.js \
                  browser_whitelist.js \
                  browser_whitelist2.js \
                  browser_whitelist3.js \
@@ -101,7 +100,6 @@ _BROWSER_FILES = head.js \
                  multipackage.xpi \
                  enabled.html \
                  installtrigger.html \
-                 installtrigger_frame.html \
                  startsoftwareupdate.html \
                  installchrome.html \
                  triggerredirect.html \
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser_unsigned_trigger_iframe.js b/toolkit/mozapps/extensions/test/xpinstall/browser_unsigned_trigger_iframe.js
deleted file mode 100644
index e0422a5e601f..000000000000
--- a/toolkit/mozapps/extensions/test/xpinstall/browser_unsigned_trigger_iframe.js
+++ /dev/null
@@ -1,50 +0,0 @@
-// ----------------------------------------------------------------------------
-// Test for bug 589598 - Ensure that installing through InstallTrigger
-// works in an iframe in web content.
-
-function test() {
-  Harness.installConfirmCallback = confirm_install;
-  Harness.installEndedCallback = install_ended;
-  Harness.installsCompletedCallback = finish_test;
-  Harness.setup();
-
-  var pm = Services.perms;
-  pm.add(makeURI("http://example.com/"), "install", pm.ALLOW_ACTION);
-
-  var triggers = encodeURIComponent(JSON.stringify({
-    "Unsigned XPI": {
-      URL: TESTROOT + "unsigned.xpi",
-      IconURL: TESTROOT + "icon.png",
-      toString: function() { return this.URL; }
-    }
-  }));
-  gBrowser.selectedTab = gBrowser.addTab();
-  gBrowser.loadURI(TESTROOT + "installtrigger_frame.html?" + triggers);
-}
-
-function confirm_install(window) {
-  items = window.document.getElementById("itemList").childNodes;
-  is(items.length, 1, "Should only be 1 item listed in the confirmation dialog");
-  is(items[0].name, "XPI Test", "Should have seen the name");
-  is(items[0].url, TESTROOT + "unsigned.xpi", "Should have listed the correct url for the item");
-  is(items[0].icon, TESTROOT + "icon.png", "Should have listed the correct icon for the item");
-  is(items[0].signed, "false", "Should have listed the item as unsigned");
-  return true;
-}
-
-function install_ended(install, addon) {
-  install.cancel();
-}
-
-function finish_test(count) {
-  is(count, 1, "1 Add-on should have been successfully installed");
-
-  Services.perms.remove("example.com", "install");
-
-  var doc = gBrowser.contentWindow.frames[0].document; // Document of iframe
-  is(doc.getElementById("return").textContent, "true", "installTrigger in iframe should have claimed success");
-  is(doc.getElementById("status").textContent, "0", "Callback in iframe should have seen a success");
-
-  gBrowser.removeCurrentTab();
-  Harness.finish();
-}
diff --git a/toolkit/mozapps/extensions/test/xpinstall/installtrigger_frame.html b/toolkit/mozapps/extensions/test/xpinstall/installtrigger_frame.html
deleted file mode 100644
index 11af0f35f038..000000000000
--- a/toolkit/mozapps/extensions/test/xpinstall/installtrigger_frame.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
-          "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-
-<html>
-
-<!-- This page will accept some json as the uri query and pass it to
-     an inner iframe, which will run InstallTrigger.install -->
-
-<head>
-<title>InstallTrigger frame tests</title>
-<script type="text/javascript">
-function prepChild() {
-  // Pass our parameters over to the child
-  var child = window.frames[0];
-  var params = document.location.search.substr(1);
-  child.location = "installtrigger.html?" + params;
-}
-</script>
-</head>
-<body onload="prepChild()">
-
-<iframe src="about:blank">
-</iframe>
-
-<p>InstallTrigger tests</p>
-<p id="return"></p>
-<p id="status"></p>
-</body>
-</html>

From 8c37d3bfef808a6ff29b8809b04827923a4323fd Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 14:07:37 -0400
Subject: [PATCH 023/222] Bug 584494 - Regression: Transform rotation testcase
 performs significantly worse - r=dbaron

---
 layout/generic/nsAbsoluteContainingBlock.cpp | 10 +--
 layout/generic/nsBlockFrame.cpp              | 24 +++---
 layout/generic/nsFrame.cpp                   | 89 ++++++++++++--------
 layout/generic/nsIFrame.h                    | 10 +--
 layout/reftests/bugs/389224-1-ref.html       |  7 ++
 layout/reftests/bugs/389224-1.html           | 16 ++++
 layout/reftests/bugs/389224-2.html           | 16 ++++
 layout/reftests/bugs/reftest.list            |  2 +
 layout/style/nsStyleStruct.cpp               |  7 +-
 9 files changed, 116 insertions(+), 65 deletions(-)
 create mode 100644 layout/reftests/bugs/389224-1-ref.html
 create mode 100644 layout/reftests/bugs/389224-1.html
 create mode 100644 layout/reftests/bugs/389224-2.html

diff --git a/layout/generic/nsAbsoluteContainingBlock.cpp b/layout/generic/nsAbsoluteContainingBlock.cpp
index 58fc2ac8eeb1..4ada3da23f26 100644
--- a/layout/generic/nsAbsoluteContainingBlock.cpp
+++ b/layout/generic/nsAbsoluteContainingBlock.cpp
@@ -494,14 +494,8 @@ nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*                aDelegat
   }
 
   if (oldRect.TopLeft() != rect.TopLeft() || 
-      (aDelegatingFrame->GetStateBits() & NS_FRAME_FIRST_REFLOW) ||
-      (kidDesiredSize.mOverflowArea + rect.TopLeft() != oldOverflowRect &&
-        (kidDesiredSize.mOverflowArea + rect.TopLeft() != rect || oldRect != oldOverflowRect))) {
-    // The frame moved; we have to invalidate the whole frame
-    // because the children may have moved after they were reflowed
-    // We also have to invalidate when we have overflow and the overflow
-    // changes because the change might be caused by clipping
-    // XXX This could be optimized in some cases, especially clipping changes
+      (aDelegatingFrame->GetStateBits() & NS_FRAME_FIRST_REFLOW)) {
+    // The frame moved
     aKidFrame->GetParent()->Invalidate(oldOverflowRect);
     aKidFrame->GetParent()->Invalidate(kidDesiredSize.mOverflowArea +
                                        rect.TopLeft());
diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
index 24cf695e26d2..e7b8460e2e06 100644
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -520,17 +520,21 @@ nsBlockFrame::InvalidateInternal(const nsRect& aDamageRect,
                                  PRUint32 aFlags)
 {
   // Optimize by suppressing invalidation of areas that are clipped out
-  // with CSS 'clip'.
-  const nsStyleDisplay* disp = GetStyleDisplay();
-  nsRect absPosClipRect;
-  if (GetAbsPosClipRect(disp, &absPosClipRect, GetSize())) {
-    // Restrict the invalidated area to abs-pos clip rect
-    // abs-pos clipping clips everything in the frame
-    nsRect r;
-    if (r.IntersectRect(aDamageRect, absPosClipRect - nsPoint(aX, aY))) {
-      nsBlockFrameSuper::InvalidateInternal(r, aX, aY, this, aFlags);
+  // with CSS 'clip'. Don't suppress invalidation of *this* frame directly,
+  // because when 'clip' shrinks we need to invalidate this frame and
+  // be able to invalidate areas outside the 'clip'.
+  if (aForChild) {
+    const nsStyleDisplay* disp = GetStyleDisplay();
+    nsRect absPosClipRect;
+    if (GetAbsPosClipRect(disp, &absPosClipRect, GetSize())) {
+      // Restrict the invalidated area to abs-pos clip rect
+      // abs-pos clipping clips everything in the frame
+      nsRect r;
+      if (r.IntersectRect(aDamageRect, absPosClipRect - nsPoint(aX, aY))) {
+        nsBlockFrameSuper::InvalidateInternal(r, aX, aY, this, aFlags);
+      }
+      return;
     }
-    return;
   }
 
   nsBlockFrameSuper::InvalidateInternal(aDamageRect, aX, aY, this, aFlags);
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 2a97d8565393..4d073ef6cfe7 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -5866,26 +5866,6 @@ IsInlineFrame(nsIFrame *aFrame)
          type == nsGkAtoms::positionedInlineFrame;
 }
 
-nsRect
-nsIFrame::GetAdditionalOverflow(const nsRect& aOverflowArea,
-                                const nsSize& aNewSize,
-                                PRBool* aHasOutlineOrEffects)
-{
-  nsRect overflowRect =
-    ComputeOutlineAndEffectsRect(this, aHasOutlineOrEffects,
-                                 aOverflowArea, aNewSize, PR_TRUE);
-
-  // Absolute position clipping
-  PRBool hasAbsPosClip;
-  nsRect absPosClipRect;
-  hasAbsPosClip = GetAbsPosClipRect(GetStyleDisplay(), &absPosClipRect, aNewSize);
-  if (hasAbsPosClip) {
-    overflowRect.IntersectRect(overflowRect, absPosClipRect);
-  }
-
-  return overflowRect;
-}
-
 void 
 nsIFrame::FinishAndStoreOverflow(nsRect* aOverflowArea, nsSize aNewSize)
 {
@@ -5931,8 +5911,20 @@ nsIFrame::FinishAndStoreOverflow(nsRect* aOverflowArea, nsSize aNewSize)
   }
   
   PRBool hasOutlineOrEffects;
-  *aOverflowArea = GetAdditionalOverflow(*aOverflowArea, aNewSize,
-      &hasOutlineOrEffects);
+  *aOverflowArea =
+    ComputeOutlineAndEffectsRect(this, &hasOutlineOrEffects,
+                                 *aOverflowArea, aNewSize, PR_TRUE);
+
+  // Absolute position clipping
+  PRBool didHaveAbsPosClip = (GetStateBits() & NS_FRAME_HAS_CLIP) != 0;
+  nsRect absPosClipRect;
+  PRBool hasAbsPosClip = GetAbsPosClipRect(disp, &absPosClipRect, aNewSize);
+  if (hasAbsPosClip) {
+    aOverflowArea->IntersectRect(*aOverflowArea, absPosClipRect);
+    AddStateBits(NS_FRAME_HAS_CLIP);
+  } else {
+    RemoveStateBits(NS_FRAME_HAS_CLIP);
+  }
 
   /* If we're transformed, transform the overflow rect by the current transformation. */
   PRBool hasTransform = IsTransformed();
@@ -5962,19 +5954,46 @@ nsIFrame::FinishAndStoreOverflow(nsRect* aOverflowArea, nsSize aNewSize)
     }
   }
 
-  if (overflowChanged && (hasOutlineOrEffects || hasTransform)) {
-    // When there's an outline or box-shadow or SVG effects or transform,
-    // changes to those styles might require repainting of the old and new
-    // overflow areas. Repainting of the old overflow area is handled in
-    // nsCSSFrameConstructor::DoApplyRenderingChangeToTree in response
-    // to nsChangeHint_RepaintFrame. Since the new overflow area is not
-    // known at that time, we have to handle it here.
-    // If the overflow area hasn't changed, then we don't have to do
-    // anything here since repainting the old overflow area was enough.
-    // If there is no outline or other effects now, then we don't have
-    // to do anything here since removing those styles can't require
-    // repainting of areas that weren't in the old overflow area.
-    Invalidate(*aOverflowArea);
+  if (overflowChanged) {
+    if (hasOutlineOrEffects) {
+      // When there's an outline or box-shadow or SVG effects,
+      // changes to those styles might require repainting of the old and new
+      // overflow areas. Repainting of the old overflow area is handled in
+      // nsCSSFrameConstructor::DoApplyRenderingChangeToTree in response
+      // to nsChangeHint_RepaintFrame. Since the new overflow area is not
+      // known at that time, we have to handle it here.
+      // If the overflow area hasn't changed, then we don't have to do
+      // anything here since repainting the old overflow area was enough.
+      // If there is no outline or other effects now, then we don't have
+      // to do anything here since removing those styles can't require
+      // repainting of areas that weren't in the old overflow area.
+      Invalidate(*aOverflowArea);
+    } else if (hasAbsPosClip || didHaveAbsPosClip) {
+      // If we are (or were) clipped by the 'clip' property, and our
+      // overflow area changes, it might be because the clipping changed.
+      // The nsChangeHint_RepaintFrame for the style change will only
+      // repaint the old overflow area, so if the overflow area has
+      // changed (in particular, if it grows), we have to repaint the
+      // new area here.
+      Invalidate(*aOverflowArea);
+    } else if (hasTransform) {
+      // When there's a transform, changes to that style might require
+      // repainting of the old and new overflow areas in the widget.
+      // Repainting of the frame itself will not be required if there's
+      // a retained layer, so we can call InvalidateLayer here
+      // which will avoid repainting ThebesLayers if possible.
+      // nsCSSFrameConstructor::DoApplyRenderingChangeToTree repaints
+      // the old overflow area in the widget in response to
+      // nsChangeHint_UpdateTransformLayer. But since the new overflow
+      // area is not known at that time, we have to handle it here.
+      // If the overflow area hasn't changed, then it doesn't matter that
+      // we didn't reach here since repainting the old overflow area was enough.
+      // If there is no transform now, then the container layer for
+      // the transform will go away and the frame contents will change
+      // ThebesLayers, forcing it to be invalidated, so it doesn't matter
+      // that we didn't reach here.
+      InvalidateLayer(*aOverflowArea, nsDisplayItem::TYPE_TRANSFORM);
+    }
   }
 }
 
diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
index 68285e4de876..4ae237585904 100644
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -266,6 +266,9 @@ typedef PRUint64 nsFrameState;
 // NS_FRAME_HAS_CONTAINER_LAYER bit.
 #define NS_FRAME_HAS_CONTAINER_LAYER_DESCENDANT     NS_FRAME_STATE_BIT(34)
 
+// Frame's overflow area was clipped by the 'clip' property.
+#define NS_FRAME_HAS_CLIP                           NS_FRAME_STATE_BIT(35)
+
 // The lower 20 bits and upper 32 bits of the frame state are reserved
 // by this API.
 #define NS_FRAME_RESERVED                           ~NS_FRAME_IMPL_RESERVED
@@ -2519,13 +2522,6 @@ protected:
    */
   void InvalidateRoot(const nsRect& aDamageRect, PRUint32 aFlags);
 
-  /**
-   * Gets the overflow area for any properties that are common to all types of frames
-   * e.g. outlines.
-   */
-  nsRect GetAdditionalOverflow(const nsRect& aOverflowArea, const nsSize& aNewSize,
-                               PRBool* aHasOutlineOrEffects);
-
   /**
    * Can we stop inside this frame when we're skipping non-rendered whitespace?
    * @param  aForward [in] Are we moving forward (or backward) in content order.
diff --git a/layout/reftests/bugs/389224-1-ref.html b/layout/reftests/bugs/389224-1-ref.html
new file mode 100644
index 000000000000..8e96f277737f
--- /dev/null
+++ b/layout/reftests/bugs/389224-1-ref.html
@@ -0,0 +1,7 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<div style="position:absolute; left:10px; top:10px; width:100px; height:100px; background:lime">
+</div>
+</body>
+</html>
diff --git a/layout/reftests/bugs/389224-1.html b/layout/reftests/bugs/389224-1.html
new file mode 100644
index 000000000000..7fe96421100b
--- /dev/null
+++ b/layout/reftests/bugs/389224-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<body>
+<div id="d" style="position:absolute; left:10px; top:10px; width:10px; height:10px; clip:rect(auto,100px,50px,auto)">
+  <div style="width:100px; height:100px; background:lime;"></div>
+</div>
+<script>
+var d = document.getElementById("d");
+function doTest() {
+  d.style.clip = "";
+  document.documentElement.removeAttribute("class");
+}
+window.addEventListener("MozReftestInvalidate", doTest, false);
+</script>
+</body>
+</html>
diff --git a/layout/reftests/bugs/389224-2.html b/layout/reftests/bugs/389224-2.html
new file mode 100644
index 000000000000..ef9838fedc1b
--- /dev/null
+++ b/layout/reftests/bugs/389224-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<body>
+<div id="d" style="position:absolute; left:10px; top:10px; width:10px; height:10px;">
+  <div style="width:100px; height:100px; background:lime;"></div>
+</div>
+<script>
+var d = document.getElementById("d");
+function doTest() {
+  d.style.clip = "rect(0,0,0,0)";
+  document.documentElement.removeAttribute("class");
+}
+window.addEventListener("MozReftestInvalidate", doTest, false);
+</script>
+</body>
+</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index bd708068329d..19987537fe57 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -725,6 +725,8 @@ random == 387876-2.html 387876-2-ref.html # bug 471630
 == 388367-1.html about:blank
 == 388980-1.html 388980-1-ref.html
 == 389074-1.html 389074-1-ref.html
+== 389224-1.html 389224-1-ref.html
+== 389224-2.html about:blank
 == 389468-1.html 389468-1-ref.html
 == 389623-1.html 389623-1-ref.html
 == 389636-1.html about:blank  # assertion test
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index af9032f4fdb1..089d182244e5 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -1983,16 +1983,13 @@ nsChangeHint nsStyleDisplay::CalcDifference(const nsStyleDisplay& aOther) const
                                       nsChangeHint_NeedDirtyReflow)));
   }
 
-  if (mClipFlags != aOther.mClipFlags || mClip != aOther.mClip) {
-    // FIXME: Bug 507764.  Could we use a more precise hint here?
-    NS_UpdateHint(hint, nsChangeHint_ReflowFrame);
-  }
   // XXX the following is conservative, for now: changing float breaking shouldn't
   // necessarily require a repaint, reflow should suffice.
   if (mBreakType != aOther.mBreakType
       || mBreakBefore != aOther.mBreakBefore
       || mBreakAfter != aOther.mBreakAfter
-      || mAppearance != aOther.mAppearance)
+      || mAppearance != aOther.mAppearance
+      || mClipFlags != aOther.mClipFlags || mClip != aOther.mClip)
     NS_UpdateHint(hint, NS_CombineHint(nsChangeHint_ReflowFrame, nsChangeHint_RepaintFrame));
 
   if (mOpacity != aOther.mOpacity) {

From cde83c5f2c55a5898fc6fd594ef7513934989f53 Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Thu, 2 Sep 2010 10:28:38 -0400
Subject: [PATCH 024/222] Bug 591042 - validation fix in copyTexImage2D and
 update list of failing tests - r=vladimir, a=blocking2.0

---
 content/canvas/src/WebGLContextGL.cpp       | 6 ++++++
 content/canvas/test/webgl/failing_tests.txt | 2 --
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index 921322b4afb6..7947718f3789 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -580,6 +580,12 @@ WebGLContext::CopyTexImage2D(WebGLenum target,
     if (level < 0)
         return ErrorInvalidValue("copyTexImage2D: level may not be negative");
 
+    if (level >= 1) {
+        if (!(is_pot_assuming_nonnegative(width) &&
+              is_pot_assuming_nonnegative(height)))
+            return ErrorInvalidValue("copyTexImage2D: with level > 0, width and height must be powers of two");
+    }
+
     if (!CanvasUtils::CheckSaneSubrectSize(x,y,width, height, mWidth, mHeight))
         return ErrorInvalidOperation("CopyTexImage2D: copied rectangle out of bounds");
 
diff --git a/content/canvas/test/webgl/failing_tests.txt b/content/canvas/test/webgl/failing_tests.txt
index 19a04e4c9da0..193483fa32c6 100644
--- a/content/canvas/test/webgl/failing_tests.txt
+++ b/content/canvas/test/webgl/failing_tests.txt
@@ -38,14 +38,12 @@ conformance/tex-input-validation.html
 conformance/texparameter-test.html
 conformance/texture-active-bind-2.html
 conformance/texture-formats-test.html
-conformance/texture-npot.html
 conformance/uniform-samplers-test.html
 conformance/viewport-unchanged-upon-resize.html
 more/conformance/constants.html
 more/conformance/getContext.html
 more/conformance/quickCheckAPI.html
 more/conformance/quickCheckAPIBadArgs.html
-more/conformance/webGLArrays.html
 more/functions/bufferDataBadArgs.html
 more/functions/copyTexImage2D.html
 more/functions/copyTexImage2DBadArgs.html

From f6ebb04f65d8a0f35c4b059d22202ee1168509a8 Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Thu, 2 Sep 2010 10:29:41 -0400
Subject: [PATCH 025/222] Bug 591084 - various WebGLTexture improvements -
 r=vladimir

---
 content/canvas/src/WebGLContext.h        | 74 +++++++++++++++---------
 content/canvas/src/WebGLContextGL.cpp    |  8 ++-
 content/canvas/src/WebGLContextUtils.cpp |  4 +-
 3 files changed, 56 insertions(+), 30 deletions(-)

diff --git a/content/canvas/src/WebGLContext.h b/content/canvas/src/WebGLContext.h
index 1af669443a41..26be386183a7 100644
--- a/content/canvas/src/WebGLContext.h
+++ b/content/canvas/src/WebGLContext.h
@@ -685,7 +685,7 @@ public:
         mFacesCount(0),
         mMaxLevelWithCustomImages(0),
         mHaveGeneratedMipmap(PR_FALSE),
-        mFakeBlackStatus(DontKnowIfNeedFakeBlack)
+        mFakeBlackStatus(DoNotNeedFakeBlack)
     {}
 
     void Delete() {
@@ -913,12 +913,13 @@ public:
         mHaveGeneratedMipmap = PR_FALSE;
     }
 
-    PRBool IsGenerateMipmapAllowed() const {
-        const ImageInfo &first = ImageInfoAt(0, 0);
-        if (!first.IsPowerOfTwo())
-            return PR_FALSE;
-        for (size_t face = 0; face < mFacesCount; ++face) {
-            if (ImageInfoAt(0, face) != first)
+    PRBool IsFirstImagePowerOfTwo() const {
+        return ImageInfoAt(0, 0).IsPowerOfTwo();
+    }
+
+    PRBool AreAllLevel0ImageInfosEqual() const {
+        for (size_t face = 1; face < mFacesCount; ++face) {
+            if (ImageInfoAt(0, face) != ImageInfoAt(0, 0))
                 return PR_FALSE;
         }
         return PR_TRUE;
@@ -927,7 +928,7 @@ public:
     PRBool IsMipmapTexture2DComplete() const {
         if (mTarget != LOCAL_GL_TEXTURE_2D)
             return PR_FALSE;
-        if (!mImageInfos[0].IsPositive())
+        if (!ImageInfoAt(0, 0).IsPositive())
             return PR_FALSE;
         if (mHaveGeneratedMipmap)
             return PR_TRUE;
@@ -940,11 +941,7 @@ public:
         const ImageInfo &first = ImageInfoAt(0, 0);
         if (!first.IsPositive() || !first.IsSquare())
             return PR_FALSE;
-        for (size_t face = 0; face < mFacesCount; ++face) {
-            if (ImageInfoAt(0, face) != first)
-                return PR_FALSE;
-        }
-        return PR_TRUE;
+        return AreAllLevel0ImageInfosEqual();
     }
 
     PRBool IsMipmapCubeComplete() const {
@@ -966,26 +963,39 @@ public:
             // Determine if the texture needs to be faked as a black texture.
             // See 3.8.2 Shader Execution in the OpenGL ES 2.0.24 spec.
 
+            const char *msg_rendering_as_black
+                = "A texture is going to be rendered as if it were black, as per the OpenGL ES 2.0.24 spec section 3.8.2, "
+                  "because it";
+
             if (mTarget == LOCAL_GL_TEXTURE_2D)
             {
                 if (DoesMinFilterRequireMipmap())
                 {
-                    if (!IsMipmapTexture2DComplete() ||
-                        !mImageInfos[0].IsPowerOfTwo())
-                    {
+                    if (!IsMipmapTexture2DComplete()) {
+                        mContext->LogMessage("%s is a 2D texture, with a minification filter requiring a mipmap, "
+                                   "and is not mipmap complete (as defined in section 3.7.10).", msg_rendering_as_black);
+                        mFakeBlackStatus = DoNeedFakeBlack;
+                    } else if (!ImageInfoAt(0, 0).IsPowerOfTwo()) {
+                        mContext->LogMessage("%s is a 2D texture, with a minification filter requiring a mipmap, "
+                                   "and either its width or height is not a power of two.", msg_rendering_as_black);
                         mFakeBlackStatus = DoNeedFakeBlack;
                     }
                 }
                 else // no mipmap required
                 {
-                    if (!mImageInfos[0].IsPositive() ||
-                        (!AreBothWrapModesClampToEdge() && !mImageInfos[0].IsPowerOfTwo()))
-                    {
+                    if (!ImageInfoAt(0, 0).IsPositive()) {
+                        mContext->LogMessage("%s is a 2D texture and its width or height is equal to zero.",
+                                   msg_rendering_as_black);
+                        mFakeBlackStatus = DoNeedFakeBlack;
+                    } else if (!AreBothWrapModesClampToEdge() && !ImageInfoAt(0, 0).IsPowerOfTwo()) {
+                        mContext->LogMessage("%s is a 2D texture, with a minification filter not requiring a mipmap, "
+                                   "with its width or height not a power of two, and with a wrap mode "
+                                   "different from CLAMP_TO_EDGE.", msg_rendering_as_black);
                         mFakeBlackStatus = DoNeedFakeBlack;
                     }
                 }
             }
-            else if (mTarget == LOCAL_GL_TEXTURE_CUBE_MAP)
+            else // cube map
             {
                 PRBool areAllLevel0ImagesPOT = PR_TRUE;
                 for (size_t face = 0; face < mFacesCount; ++face)
@@ -993,17 +1003,29 @@ public:
 
                 if (DoesMinFilterRequireMipmap())
                 {
-                    if (!IsMipmapCubeComplete() ||
-                        !areAllLevel0ImagesPOT)
-                    {
+                    if (!IsMipmapCubeComplete()) {
+                        mContext->LogMessage("%s is a cube map texture, with a minification filter requiring a mipmap, "
+                                   "and is not mipmap cube complete (as defined in section 3.7.10).",
+                                   msg_rendering_as_black);
+                        mFakeBlackStatus = DoNeedFakeBlack;
+                    } else if (!areAllLevel0ImagesPOT) {
+                        mContext->LogMessage("%s is a cube map texture, with a minification filter requiring a mipmap, "
+                                   "and either the width or the height of some level 0 image is not a power of two.",
+                                   msg_rendering_as_black);
                         mFakeBlackStatus = DoNeedFakeBlack;
                     }
                 }
                 else // no mipmap required
                 {
-                    if (!IsCubeComplete() ||
-                        (!AreBothWrapModesClampToEdge() && !areAllLevel0ImagesPOT))
-                    {
+                    if (!IsCubeComplete()) {
+                        mContext->LogMessage("%s is a cube map texture, with a minification filter not requiring a mipmap, "
+                                   "and is not cube complete (as defined in section 3.7.10).",
+                                   msg_rendering_as_black);
+                        mFakeBlackStatus = DoNeedFakeBlack;
+                    } else if (!AreBothWrapModesClampToEdge() && !areAllLevel0ImagesPOT) {
+                        mContext->LogMessage("%s is a cube map texture, with a minification filter not requiring a mipmap, "
+                                   "with some level 0 image having width or height not a power of two, and with a wrap mode "
+                                   "different from CLAMP_TO_EDGE.", msg_rendering_as_black);
                         mFakeBlackStatus = DoNeedFakeBlack;
                     }
                 }
diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index 7947718f3789..392ea3b1d6b4 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -1254,8 +1254,12 @@ WebGLContext::GenerateMipmap(WebGLenum target)
     if (!tex)
         return ErrorInvalidOperation("generateMipmap: no texture is bound to this target");
 
-    if (!tex->IsGenerateMipmapAllowed()) {
-        return ErrorInvalidOperation("generateMipmap: texture does not satisfy requirements for generateMipmap");
+    if (!tex->IsFirstImagePowerOfTwo()) {
+        return ErrorInvalidOperation("generateMipmap: the width or height of this texture is not a power of two");
+    }
+
+    if (!tex->AreAllLevel0ImageInfosEqual()) {
+        return ErrorInvalidOperation("generateMipmap: the six faces of this cube map have different dimensions, format, or type.");
     }
 
     tex->SetGeneratedMipmap();
diff --git a/content/canvas/src/WebGLContextUtils.cpp b/content/canvas/src/WebGLContextUtils.cpp
index 6dafab047ea5..ee5c64926e04 100644
--- a/content/canvas/src/WebGLContextUtils.cpp
+++ b/content/canvas/src/WebGLContextUtils.cpp
@@ -213,11 +213,11 @@ WebGLContext::LogMessage(const char *fmt, ...)
 void
 WebGLContext::LogMessage(const char *fmt, va_list ap)
 {
-  char buf[256];
+  char buf[1024];
 
   nsCOMPtr<nsIConsoleService> console(do_GetService(NS_CONSOLESERVICE_CONTRACTID));
   if (console) {
-    PR_vsnprintf(buf, 256, fmt, ap);
+    PR_vsnprintf(buf, 1024, fmt, ap);
     console->LogStringMessage(NS_ConvertUTF8toUTF16(nsDependentCString(buf)).get());
     fprintf(stderr, "%s\n", buf);
   }

From 013b076d34d22d3fa739bd756c1a08ae5919e689 Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Thu, 2 Sep 2010 10:30:26 -0400
Subject: [PATCH 026/222] Bug 588918 - fix many valgrind uninitialized value
 errors - r=vladimir

---
 content/canvas/src/WebGLContextGL.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index 392ea3b1d6b4..91a40d97d510 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -2556,6 +2556,9 @@ WebGLContext::RenderbufferStorage(WebGLenum target, WebGLenum internalformat, We
     MakeContextCurrent();
     gl->fRenderbufferStorage(target, internalformat, width, height);
 
+    // now we need to initialize the renderbuffer to 0 as per the thread "about RenderBufferStorage"
+    // on the public_webgl list
+
     return NS_OK;
 }
 

From 4a993e198e8ad17bc391cb49592e1842506a113d Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Thu, 2 Sep 2010 10:31:08 -0400
Subject: [PATCH 027/222] Bug 591438 - disable getParameter random testing -
 r=vladimir

---
 content/canvas/test/webgl/more/conformance/quickCheckAPI.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/content/canvas/test/webgl/more/conformance/quickCheckAPI.js b/content/canvas/test/webgl/more/conformance/quickCheckAPI.js
index 108bd05c95a9..d0f25cc6f7cf 100644
--- a/content/canvas/test/webgl/more/conformance/quickCheckAPI.js
+++ b/content/canvas/test/webgl/more/conformance/quickCheckAPI.js
@@ -845,8 +845,9 @@ ArgGenerators = {
     }
   },
   getParameter : {
-    generate : function() { return [getParameterPname.random()]; },
-    checkArgValidity : function(p) { return getParameterPname.has(p); }
+// FIXME disabled because crashes, see bug 576620
+//    generate : function() { return [getParameterPname.random()]; },
+//    checkArgValidity : function(p) { return getParameterPname.has(p); }
   },
   getBufferParameter : {}, // FIXME
   getError : {

From 5ada19ecd0ad165a13ea0cc3387b1c723d47343e Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Thu, 2 Sep 2010 10:34:08 -0400
Subject: [PATCH 028/222] Bug 571054 - emulate vertex attrib 0 on desktop GL -
 r=vladimir

---
 content/canvas/src/WebGLContext.cpp         |   6 +
 content/canvas/src/WebGLContext.h           |  12 +-
 content/canvas/src/WebGLContextGL.cpp       | 191 +++++++++++++++++---
 content/canvas/src/WebGLContextValidate.cpp |   5 +
 content/canvas/test/webgl/failing_tests.txt |   1 -
 5 files changed, 186 insertions(+), 29 deletions(-)

diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index 5b4f9dfbc177..5882206473e4 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -102,6 +102,12 @@ WebGLContext::WebGLContext()
 
     mBlackTexturesAreInitialized = PR_FALSE;
     mFakeBlackStatus = DoNotNeedFakeBlack;
+
+    mFakeVertexAttrib0Array = nsnull;
+    mVertexAttrib0Vector[0] = 0;
+    mVertexAttrib0Vector[1] = 0;
+    mVertexAttrib0Vector[2] = 0;
+    mVertexAttrib0Vector[3] = 1;
 }
 
 WebGLContext::~WebGLContext()
diff --git a/content/canvas/src/WebGLContext.h b/content/canvas/src/WebGLContext.h
index 26be386183a7..8d878c43713a 100644
--- a/content/canvas/src/WebGLContext.h
+++ b/content/canvas/src/WebGLContext.h
@@ -226,7 +226,7 @@ class WebGLBuffer;
 
 struct WebGLVertexAttribData {
     WebGLVertexAttribData()
-        : buf(0), stride(0), size(0), byteOffset(0), type(0), enabled(PR_FALSE)
+        : buf(0), stride(0), size(0), byteOffset(0), type(0), enabled(PR_FALSE), normalized(PR_FALSE)
     { }
 
     WebGLObjectRefPtr<WebGLBuffer> buf;
@@ -235,6 +235,7 @@ struct WebGLVertexAttribData {
     GLuint byteOffset;
     GLenum type;
     PRBool enabled;
+    PRBool normalized;
 
     GLuint componentSize() const {
         switch(type) {
@@ -331,10 +332,13 @@ public:
     }
 
     PRBool NeedFakeBlack();
-
     void BindFakeBlackTextures();
     void UnbindFakeBlackTextures();
 
+    PRBool NeedFakeVertexAttrib0();
+    void DoFakeVertexAttrib0(WebGLuint vertexCount);
+    void UndoFakeVertexAttrib0();
+
 protected:
     nsCOMPtr<nsIDOMHTMLCanvasElement> mCanvasElement;
     nsHTMLCanvasElement *HTMLCanvasElement() {
@@ -475,6 +479,9 @@ protected:
     WebGLuint mBlackTexture2D, mBlackTextureCubeMap;
     PRBool mBlackTexturesAreInitialized;
 
+    WebGLfloat mVertexAttrib0Vector[4];
+    nsAutoArrayPtr<WebGLfloat> mFakeVertexAttrib0Array;
+
 public:
     // console logging helpers
     static void LogMessage (const char *fmt, ...);
@@ -1342,7 +1349,6 @@ protected:
 
 NS_DEFINE_STATIC_IID_ACCESSOR(WebGLActiveInfo, WEBGLACTIVEINFO_PRIVATE_IID)
 
-
 /**
  ** Template implementations
  **/
diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index 91a40d97d510..d1a4f70cf4bb 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -866,12 +866,55 @@ WebGLContext::DisableVertexAttribArray(WebGLuint index)
 
     MakeContextCurrent();
 
-    gl->fDisableVertexAttribArray(index);
+    if (index || gl->IsGLES2())
+        gl->fDisableVertexAttribArray(index);
+
     mAttribBuffers[index].enabled = PR_FALSE;
 
     return NS_OK;
 }
 
+PRBool
+WebGLContext::NeedFakeVertexAttrib0()
+{
+    return !gl->IsGLES2() &&
+           !mAttribBuffers[0].enabled;
+}
+
+void
+WebGLContext::DoFakeVertexAttrib0(WebGLuint vertexCount)
+{
+    if (!NeedFakeVertexAttrib0())
+        return;
+
+    mFakeVertexAttrib0Array = new WebGLfloat[4 * vertexCount];
+
+    for(size_t i = 0; i < vertexCount; ++i) {
+        mFakeVertexAttrib0Array[4 * i + 0] = mVertexAttrib0Vector[0];
+        mFakeVertexAttrib0Array[4 * i + 1] = mVertexAttrib0Vector[1];
+        mFakeVertexAttrib0Array[4 * i + 2] = mVertexAttrib0Vector[2];
+        mFakeVertexAttrib0Array[4 * i + 3] = mVertexAttrib0Vector[3];
+    }
+
+    gl->fVertexAttribPointer(0, 4, LOCAL_GL_FLOAT, LOCAL_GL_FALSE, 0, mFakeVertexAttrib0Array);
+}
+
+void
+WebGLContext::UndoFakeVertexAttrib0()
+{
+    if (!NeedFakeVertexAttrib0())
+        return;
+
+    mFakeVertexAttrib0Array = nsnull;
+
+    gl->fVertexAttribPointer(0,
+                             mAttribBuffers[0].size,
+                             mAttribBuffers[0].type,
+                             mAttribBuffers[0].normalized,
+                             mAttribBuffers[0].stride,
+                             (const GLvoid *) mAttribBuffers[0].byteOffset);
+}
+
 PRBool
 WebGLContext::NeedFakeBlack()
 {
@@ -989,7 +1032,11 @@ WebGLContext::DrawArrays(GLenum mode, WebGLint first, WebGLsizei count)
     MakeContextCurrent();
 
     BindFakeBlackTextures();
+    DoFakeVertexAttrib0(checked_firstPlusCount.value());
+
     gl->fDrawArrays(mode, first, count);
+
+    UndoFakeVertexAttrib0();
     UnbindFakeBlackTextures();
 
     Invalidate();
@@ -1062,7 +1109,11 @@ WebGLContext::DrawElements(WebGLenum mode, WebGLsizei count, WebGLenum type, Web
     MakeContextCurrent();
 
     BindFakeBlackTextures();
+    DoFakeVertexAttrib0(checked_neededCount.value());
+
     gl->fDrawElements(mode, count, type, (GLvoid*) (byteOffset));
+
+    UndoFakeVertexAttrib0();
     UnbindFakeBlackTextures();
 
     Invalidate();
@@ -2210,10 +2261,17 @@ WebGLContext::GetVertexAttrib(WebGLuint index, WebGLenum pname, nsIVariant **ret
 
         case LOCAL_GL_CURRENT_VERTEX_ATTRIB:
         {
-            GLfloat fv[4] = { 0 };
-            gl->fGetVertexAttribfv(index, LOCAL_GL_CURRENT_VERTEX_ATTRIB, fv);
+            WebGLfloat vec[4] = {0, 0, 0, 1};
+            if (index) {
+                gl->fGetVertexAttribfv(index, LOCAL_GL_CURRENT_VERTEX_ATTRIB, &vec[0]);
+            } else {
+                vec[0] = mVertexAttrib0Vector[0];
+                vec[1] = mVertexAttrib0Vector[1];
+                vec[2] = mVertexAttrib0Vector[2];
+                vec[3] = mVertexAttrib0Vector[3];
+            }
             wrval->SetAsArray(nsIDataType::VTYPE_FLOAT, nsnull,
-                              4, static_cast<void*>(fv));
+                              4, vec);
         }
             break;
         case LOCAL_GL_VERTEX_ATTRIB_ARRAY_ENABLED:
@@ -2779,23 +2837,6 @@ WebGLContext::name##_array(nsIWebGLUniformLocation *ploc, js::TypedArray *wa) \
     return NS_OK;                                                       \
 }
 
-#define SIMPLE_ARRAY_METHOD_NO_COUNT(name, cnt, arrayType, ptrType)  \
-NS_IMETHODIMP                                                           \
-WebGLContext::name(PRInt32 dummy) {                                     \
-     return NS_ERROR_NOT_IMPLEMENTED;                                   \
-}                                                                       \
-NS_IMETHODIMP                                                           \
-WebGLContext::name##_array(WebGLuint idx, js::TypedArray *wa)              \
-{                                                                       \
-    if (!wa || wa->type != js::TypedArray::arrayType)                   \
-        return ErrorInvalidOperation(#name ": array must be " #arrayType);      \
-    if (wa->length < cnt)                                               \
-        return ErrorInvalidOperation(#name ": array must be >= %d elements", cnt); \
-    MakeContextCurrent();                                               \
-    gl->f##name(idx, (ptrType *)wa->data);                              \
-    return NS_OK;                                                       \
-}
-
 #define SIMPLE_MATRIX_METHOD_UNIFORM(name, dim, arrayType, ptrType)     \
 NS_IMETHODIMP                                                           \
 WebGLContext::name(PRInt32 dummy) {                                     \
@@ -2864,10 +2905,109 @@ SIMPLE_MATRIX_METHOD_UNIFORM(UniformMatrix2fv, 2, TYPE_FLOAT32, WebGLfloat)
 SIMPLE_MATRIX_METHOD_UNIFORM(UniformMatrix3fv, 3, TYPE_FLOAT32, WebGLfloat)
 SIMPLE_MATRIX_METHOD_UNIFORM(UniformMatrix4fv, 4, TYPE_FLOAT32, WebGLfloat)
 
-GL_SAME_METHOD_2(VertexAttrib1f, VertexAttrib1f, PRUint32, WebGLfloat)
-GL_SAME_METHOD_3(VertexAttrib2f, VertexAttrib2f, PRUint32, WebGLfloat, WebGLfloat)
-GL_SAME_METHOD_4(VertexAttrib3f, VertexAttrib3f, PRUint32, WebGLfloat, WebGLfloat, WebGLfloat)
-GL_SAME_METHOD_5(VertexAttrib4f, VertexAttrib4f, PRUint32, WebGLfloat, WebGLfloat, WebGLfloat, WebGLfloat)
+NS_IMETHODIMP
+WebGLContext::VertexAttrib1f(PRUint32 index, WebGLfloat x0)
+{
+    MakeContextCurrent();
+
+    if (index) {
+        gl->fVertexAttrib1f(index, x0);
+    } else {
+        mVertexAttrib0Vector[0] = x0;
+        mVertexAttrib0Vector[1] = 0;
+        mVertexAttrib0Vector[2] = 0;
+        mVertexAttrib0Vector[3] = 1;
+        if (gl->IsGLES2())
+            gl->fVertexAttrib1f(index, x0);
+    }
+
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+WebGLContext::VertexAttrib2f(PRUint32 index, WebGLfloat x0, WebGLfloat x1)
+{
+    MakeContextCurrent();
+
+    if (index) {
+        gl->fVertexAttrib2f(index, x0, x1);
+    } else {
+        mVertexAttrib0Vector[0] = x0;
+        mVertexAttrib0Vector[1] = x1;
+        mVertexAttrib0Vector[2] = 0;
+        mVertexAttrib0Vector[3] = 1;
+        if (gl->IsGLES2())
+            gl->fVertexAttrib2f(index, x0, x1);
+    }
+
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+WebGLContext::VertexAttrib3f(PRUint32 index, WebGLfloat x0, WebGLfloat x1, WebGLfloat x2)
+{
+    MakeContextCurrent();
+
+    if (index) {
+        gl->fVertexAttrib3f(index, x0, x1, x2);
+    } else {
+        mVertexAttrib0Vector[0] = x0;
+        mVertexAttrib0Vector[1] = x1;
+        mVertexAttrib0Vector[2] = x2;
+        mVertexAttrib0Vector[3] = 1;
+        if (gl->IsGLES2())
+            gl->fVertexAttrib3f(index, x0, x1, x2);
+    }
+
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+WebGLContext::VertexAttrib4f(PRUint32 index, WebGLfloat x0, WebGLfloat x1,
+                                             WebGLfloat x2, WebGLfloat x3)
+{
+    MakeContextCurrent();
+
+    if (index) {
+        gl->fVertexAttrib4f(index, x0, x1, x2, x3);
+    } else {
+        mVertexAttrib0Vector[0] = x0;
+        mVertexAttrib0Vector[1] = x1;
+        mVertexAttrib0Vector[2] = x2;
+        mVertexAttrib0Vector[3] = x3;
+        if (gl->IsGLES2())
+            gl->fVertexAttrib4f(index, x0, x1, x2, x3);
+    }
+
+    return NS_OK;
+}
+
+#define SIMPLE_ARRAY_METHOD_NO_COUNT(name, cnt, arrayType, ptrType)  \
+NS_IMETHODIMP                                                           \
+WebGLContext::name(PRInt32 dummy) {                                     \
+     return NS_ERROR_NOT_IMPLEMENTED;                                   \
+}                                                                       \
+NS_IMETHODIMP                                                           \
+WebGLContext::name##_array(WebGLuint idx, js::TypedArray *wa)           \
+{                                                                       \
+    if (!wa || wa->type != js::TypedArray::arrayType)                   \
+        return ErrorInvalidOperation(#name ": array must be " #arrayType); \
+    if (wa->length < cnt)                                               \
+        return ErrorInvalidOperation(#name ": array must be >= %d elements", cnt); \
+    MakeContextCurrent();                                               \
+    ptrType *ptr = (ptrType *)wa->data;                                  \
+    if (idx) {                                                        \
+        gl->f##name(idx, ptr);                                          \
+    } else {                                                            \
+        mVertexAttrib0Vector[0] = ptr[0];                               \
+        mVertexAttrib0Vector[1] = cnt > 1 ? ptr[1] : ptrType(0);        \
+        mVertexAttrib0Vector[2] = cnt > 2 ? ptr[2] : ptrType(0);        \
+        mVertexAttrib0Vector[3] = cnt > 3 ? ptr[3] : ptrType(1);        \
+        if (gl->IsGLES2())                                              \
+            gl->f##name(idx, ptr);                                      \
+    }                                                                   \
+    return NS_OK;                                                       \
+}
 
 SIMPLE_ARRAY_METHOD_NO_COUNT(VertexAttrib1fv, 1, TYPE_FLOAT32, WebGLfloat)
 SIMPLE_ARRAY_METHOD_NO_COUNT(VertexAttrib2fv, 2, TYPE_FLOAT32, WebGLfloat)
@@ -3182,6 +3322,7 @@ WebGLContext::VertexAttribPointer(WebGLuint index, WebGLint size, WebGLenum type
     vd.size = size;
     vd.byteOffset = byteOffset;
     vd.type = type;
+    vd.normalized = normalized;
 
     MakeContextCurrent();
 
diff --git a/content/canvas/src/WebGLContextValidate.cpp b/content/canvas/src/WebGLContextValidate.cpp
index c1c7ee300baf..60837078877c 100644
--- a/content/canvas/src/WebGLContextValidate.cpp
+++ b/content/canvas/src/WebGLContextValidate.cpp
@@ -384,6 +384,11 @@ WebGLContext::InitAndValidateGL()
 
     MakeContextCurrent();
 
+    // on desktop OpenGL, we always keep vertex attrib 0 array enabled
+    if (!gl->IsGLES2()) {
+        gl->fEnableVertexAttribArray(0);
+    }
+
     gl->fGetIntegerv(LOCAL_GL_MAX_VERTEX_ATTRIBS, (GLint*) &mGLMaxVertexAttribs);
     if (mGLMaxVertexAttribs < 8) {
         LogMessage("GL_MAX_VERTEX_ATTRIBS: %d is < 8!", mGLMaxVertexAttribs);
diff --git a/content/canvas/test/webgl/failing_tests.txt b/content/canvas/test/webgl/failing_tests.txt
index 193483fa32c6..17803e7e0d53 100644
--- a/content/canvas/test/webgl/failing_tests.txt
+++ b/content/canvas/test/webgl/failing_tests.txt
@@ -19,7 +19,6 @@ conformance/gl-scissor-test.html
 conformance/gl-teximage.html
 conformance/gl-uniform-arrays.html
 conformance/gl-unknown-uniform.html
-conformance/gl-vertex-attrib.html
 conformance/glsl-2types-of-textures-on-same-unit.html
 conformance/glsl-conformance.html
 conformance/invalid-passed-params.html

From fd8083f61d82a4ad07b2408797773a792de17116 Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Thu, 2 Sep 2010 10:38:26 -0400
Subject: [PATCH 029/222] Bug 592416 - Various WebGL fixes - r=vladimir

---
 content/canvas/src/WebGLContextGL.cpp         | 52 +++++++++++++++----
 content/canvas/test/webgl/failing_tests.txt   |  3 --
 .../more/functions/vertexAttribPointer.html   |  1 -
 .../canvas/nsICanvasRenderingContextWebGL.idl |  3 +-
 4 files changed, 43 insertions(+), 16 deletions(-)

diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index d1a4f70cf4bb..58f1eaeec7bd 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -223,7 +223,7 @@ WebGLContext::BindFramebuffer(WebGLenum target, nsIWebGLFramebuffer *fbobj)
     WebGLFramebuffer *wfb;
 
     if (target != LOCAL_GL_FRAMEBUFFER)
-        return ErrorInvalidOperation("BindFramebuffer: target must be GL_FRAMEBUFFER");
+        return ErrorInvalidEnum("BindFramebuffer: target must be GL_FRAMEBUFFER");
 
     if (!GetConcreteObjectAndGLName("bindFramebuffer", fbobj, &wfb, &framebuffername, &isNull))
         return NS_OK;
@@ -1751,7 +1751,7 @@ WebGLContext::GetFramebufferAttachmentParameter(WebGLenum target, WebGLenum atta
                 break;
 
             default:
-                return ErrorInvalidEnum("GetFramebufferAttachmentParameter: invalid parameter");
+                return ErrorInvalidEnumInfo("GetFramebufferAttachmentParameter: pname", pname);
         }
     } else if (atype == LOCAL_GL_TEXTURE) {
         switch (pname) {
@@ -1777,10 +1777,18 @@ WebGLContext::GetFramebufferAttachmentParameter(WebGLenum target, WebGLenum atta
                 break;
 
             default:
-                return ErrorInvalidEnum("GetFramebufferAttachmentParameter: invalid parameter");
+                return ErrorInvalidEnumInfo("GetFramebufferAttachmentParameter: pname", pname);
         }
-    } else {
-        NS_WARNING("Unknown framebuffer attachment type?");
+    } else if (atype == LOCAL_GL_NONE) {
+        switch (pname) {
+            case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE:
+                wrval->SetAsInt32(atype);
+                break;
+
+            default:
+                return ErrorInvalidEnumInfo("GetFramebufferAttachmentParameter: pname", pname);
+        }
+    } else { // GL bug? should never happen
         return NS_ERROR_FAILURE;
     }
 
@@ -3282,39 +3290,61 @@ WebGLContext::ShaderSource(nsIWebGLShader *sobj, const nsAString& source)
 
 NS_IMETHODIMP
 WebGLContext::VertexAttribPointer(WebGLuint index, WebGLint size, WebGLenum type,
-                                  WebGLboolean normalized, WebGLuint stride,
-                                  WebGLuint byteOffset)
+                                  WebGLboolean normalized, WebGLsizei stride,
+                                  WebGLsizeiptr byteOffset)
 {
     if (mBoundArrayBuffer == nsnull)
         return ErrorInvalidOperation("VertexAttribPointer: must have valid GL_ARRAY_BUFFER binding");
 
+    WebGLsizei requiredAlignment = 1;
     switch (type) {
       case LOCAL_GL_BYTE:
       case LOCAL_GL_UNSIGNED_BYTE:
+          requiredAlignment = 1;
+          break;
       case LOCAL_GL_SHORT:
       case LOCAL_GL_UNSIGNED_SHORT:
+          requiredAlignment = 2;
+          break;
       // XXX case LOCAL_GL_FIXED:
       case LOCAL_GL_FLOAT:
+          requiredAlignment = 4;
           break;
       default:
           return ErrorInvalidEnumInfo("VertexAttribPointer: type", type);
     }
 
+    // requiredAlignment should always be a power of two.
+    WebGLsizei requiredAlignmentMask = requiredAlignment - 1;
+
     if (index >= mAttribBuffers.Length())
         return ErrorInvalidValue("VertexAttribPointer: index out of range - %d >= %d", index, mAttribBuffers.Length());
 
     if (size < 1 || size > 4)
         return ErrorInvalidValue("VertexAttribPointer: invalid element size");
 
+    if (stride < 0 || stride > 255) // see WebGL spec section 6.6 "Vertex Attribute Data Stride"
+        return ErrorInvalidValue("VertexAttribPointer: negative stride");
+
+    if (byteOffset < 0)
+        return ErrorInvalidValue("VertexAttribPointer: negative offset");
+
+    if (stride & requiredAlignmentMask) {
+        return ErrorInvalidValue("VertexAttribPointer: stride doesn't satisfy the alignment "
+                                 "requirement of given type");
+    }
+
+    if (byteOffset & requiredAlignmentMask) {
+        return ErrorInvalidValue("VertexAttribPointer: byteOffset doesn't satisfy the alignment "
+                                 "requirement of given type");
+
+    }
+    
     /* XXX make work with bufferSubData & heterogeneous types 
     if (type != mBoundArrayBuffer->GLType())
         return ErrorInvalidOperation("VertexAttribPointer: type must match bound VBO type: %d != %d", type, mBoundArrayBuffer->GLType());
     */
 
-    // XXX 0 stride?
-    //if (stride < (GLuint) size)
-    //    return ErrorInvalidOperation("VertexAttribPointer: stride must be >= size!");
-
     WebGLVertexAttribData &vd = mAttribBuffers[index];
 
     vd.buf = mBoundArrayBuffer;
diff --git a/content/canvas/test/webgl/failing_tests.txt b/content/canvas/test/webgl/failing_tests.txt
index 17803e7e0d53..2fa38a31484b 100644
--- a/content/canvas/test/webgl/failing_tests.txt
+++ b/content/canvas/test/webgl/failing_tests.txt
@@ -8,7 +8,6 @@ conformance/context-attributes-alpha-depth-stencil-antialias.html
 conformance/context-attributes.html
 conformance/context-type-test.html
 conformance/framebuffer-object-attachment.html
-conformance/framebuffer-test.html
 conformance/get-active-test.html
 conformance/gl-bind-attrib-location-test.html
 conformance/gl-enum-tests.html
@@ -58,7 +57,5 @@ more/functions/texSubImage2DHTMLBadArgs.html
 more/functions/uniformfBadArgs.html
 more/functions/uniformiBadArgs.html
 more/functions/uniformMatrixBadArgs.html
-more/functions/vertexAttribPointer.html
-more/functions/vertexAttribPointerBadArgs.html
 more/glsl/arrayOutOfBounds.html
 conformance/renderbuffer-initialization.html
diff --git a/content/canvas/test/webgl/more/functions/vertexAttribPointer.html b/content/canvas/test/webgl/more/functions/vertexAttribPointer.html
index 70658ab48813..1e9c448d4468 100644
--- a/content/canvas/test/webgl/more/functions/vertexAttribPointer.html
+++ b/content/canvas/test/webgl/more/functions/vertexAttribPointer.html
@@ -65,7 +65,6 @@ Tests.endUnit = function(gl, prog, v,n,t) {
 }
 
 Tests.testVertexAttribPointerVBO = function(gl, prog, v,n,t) {
-console.log(v);
   var vbo = gl.createBuffer();
   var vertsArr = new Float32Array(verts);
   gl.bindBuffer(gl.ARRAY_BUFFER, vbo);
diff --git a/dom/interfaces/canvas/nsICanvasRenderingContextWebGL.idl b/dom/interfaces/canvas/nsICanvasRenderingContextWebGL.idl
index 5fed505fd499..99f20a5b7033 100644
--- a/dom/interfaces/canvas/nsICanvasRenderingContextWebGL.idl
+++ b/dom/interfaces/canvas/nsICanvasRenderingContextWebGL.idl
@@ -49,6 +49,7 @@ typedef boolean        WebGLboolean;
 typedef unsigned long  WebGLbitfield;
 typedef long           WebGLint;
 typedef long           WebGLsizei;
+typedef long           WebGLsizeiptr;
 typedef unsigned long  WebGLuint;
 typedef float          WebGLfloat;
 typedef float          WebGLclampf;
@@ -830,7 +831,7 @@ interface nsICanvasRenderingContextWebGL : nsISupports
   [noscript] void vertexAttrib4fv_array(in WebGLuint indx, in WebGLArrayPtr values);
 
   // size is number of elements per attrib; offset, stride are in bytes
-  void vertexAttribPointer(in WebGLuint idx, in WebGLint size, in WebGLenum type, in WebGLboolean normalized, in WebGLuint stride, in WebGLuint offset);
+  void vertexAttribPointer(in WebGLuint idx, in WebGLint size, in WebGLenum type, in WebGLboolean normalized, in WebGLsizei stride, in WebGLsizeiptr offset);
 
   void viewport(in WebGLint x, in WebGLint y, in WebGLsizei width, in WebGLsizei height);
 };

From ef120138b8f72820ca973a18d939f5b169b40e18 Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Thu, 2 Sep 2010 10:46:51 -0400
Subject: [PATCH 030/222] Bug 592737 - vertexAttrib3fv crash
 [@JSObject::getClass] - r=vladimir, a=blocking2.0

---
 content/canvas/src/CustomQS_WebGL.h | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/content/canvas/src/CustomQS_WebGL.h b/content/canvas/src/CustomQS_WebGL.h
index 64eb1481ee93..d2421bb90ca4 100644
--- a/content/canvas/src/CustomQS_WebGL.h
+++ b/content/canvas/src/CustomQS_WebGL.h
@@ -532,7 +532,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_iv(JSContext *cx, uintN argc, js
         return JS_FALSE;
     }
 
-    if (!JSVAL_IS_OBJECT(argv[1])) {
+    if (JSVAL_IS_PRIMITIVE(argv[1])) {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 1);
         return JS_FALSE;
     }
@@ -606,7 +606,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_fv(JSContext *cx, uintN argc, js
         return JS_FALSE;
     }
 
-    if (!JSVAL_IS_OBJECT(argv[1])) {
+    if (JSVAL_IS_PRIMITIVE(argv[1])) {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 1);
         return JS_FALSE;
     }
@@ -684,7 +684,7 @@ helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv(JSContext *cx, uintN ar
     if (!JS_ValueToECMAInt32(cx, argv[1], &transpose))
         return JS_FALSE;
 
-    if (!JSVAL_IS_OBJECT(argv[2])) {
+    if (JSVAL_IS_PRIMITIVE(argv[2])) {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 2);
         return JS_FALSE;
     }
@@ -751,7 +751,7 @@ helper_nsICanvasRenderingContextWebGL_VertexAttrib_x_fv(JSContext *cx, uintN arg
     if (!JS_ValueToECMAUint32(cx, argv[0], &location))
         return JS_FALSE;
 
-    if (!JSVAL_IS_OBJECT(argv[1])) {
+    if (JSVAL_IS_PRIMITIVE(argv[1])) {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 1);
         return JS_FALSE;
     }
@@ -901,6 +901,11 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(JSContext *cx, JSObject *o
         return;
     }
 
+    if (!arg) {
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNiv");
+        js_SetTraceableNativeFailed(cx);
+    }
+
     js::AutoValueRooter obj_tvr(cx);
 
     nsIWebGLUniformLocation *location;
@@ -964,6 +969,11 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(JSContext *cx, JSObject *o
         return;
     }
 
+    if (!arg) {
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNfv");
+        js_SetTraceableNativeFailed(cx);
+    }
+
     js::AutoValueRooter obj_tvr(cx);
 
     nsIWebGLUniformLocation *location;
@@ -1029,6 +1039,11 @@ helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(JSContext *cx, JSObj
         return;
     }
 
+    if (!arg) {
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformMatrixNfv");
+        js_SetTraceableNativeFailed(cx);
+    }
+
     js::AutoValueRooter obj_tvr(cx);
 
     nsIWebGLUniformLocation *location;

From c59e3e67d249d38aad4329b32755805a213f327b Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 4 Jun 2010 14:58:02 -0400
Subject: [PATCH 031/222] Bug 570192 - Make sure that XUL textbox's constructor
 does not fail if we don't have a frame available; r,a=gavin

--HG--
extra : rebase_source : c5b6768df4a5286d85df39b45858f90ea376638c
---
 toolkit/content/tests/chrome/Makefile.in      |  1 +
 .../content/tests/chrome/test_bug570192.xul   | 57 +++++++++++++++++++
 toolkit/content/widgets/textbox.xml           |  2 +-
 3 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 toolkit/content/tests/chrome/test_bug570192.xul

diff --git a/toolkit/content/tests/chrome/Makefile.in b/toolkit/content/tests/chrome/Makefile.in
index 6383205403b1..a80d555b178d 100644
--- a/toolkit/content/tests/chrome/Makefile.in
+++ b/toolkit/content/tests/chrome/Makefile.in
@@ -69,6 +69,7 @@ _TEST_FILES = 	findbar_window.xul \
 		bug451540_window.xul \
 		test_bug451540.xul \
 		test_bug471776.xul \
+		test_bug570192.xul \
 		test_popup_preventdefault_chrome.xul \
 		window_popup_preventdefault_chrome.xul \
 		test_largemenu.xul \
diff --git a/toolkit/content/tests/chrome/test_bug570192.xul b/toolkit/content/tests/chrome/test_bug570192.xul
new file mode 100644
index 000000000000..0ee8815cd910
--- /dev/null
+++ b/toolkit/content/tests/chrome/test_bug570192.xul
@@ -0,0 +1,57 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet 
+  href="chrome://mochikit/content/tests/SimpleTest/test.css"
+  type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=570192
+-->
+<window title="Mozilla Bug 558406"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <title>Test for Bug 570192</title>
+  <script type="application/javascript" 
+          src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript" 
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
+  <script type="application/javascript"
+          src="RegisterUnregisterChrome.js"></script>
+
+  <body  xmlns="http://www.w3.org/1999/xhtml">
+    <a target="_blank" 
+       href="https://bugzilla.mozilla.org/show_bug.cgi?id=570192">
+      Mozilla Bug 570192
+    </a>
+
+    <p id="display">
+    </p>
+    <div id="content" style="display: none">
+    </div>
+    <pre id="test">
+    </pre>
+  </body>
+
+  <script type="application/javascript">
+    <![CDATA[
+
+    addLoadEvent(function() {
+      try {
+        var content = document.getElementById("content");
+        content.innerHTML = '<textbox newlines="pasteintact" ' +
+          'xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/>';
+        var textbox = content.firstChild;
+        ok(textbox, "created the textbox");
+        ok(!textbox.editor, "do we have an editor?");
+      } catch (e) {
+        ok(false, "Got an exception: " + e);
+      }
+      SimpleTest.finish();
+    });
+    SimpleTest.waitForExplicitFinish();
+
+   ]]>
+  </script>
+</window>
diff --git a/toolkit/content/widgets/textbox.xml b/toolkit/content/widgets/textbox.xml
index ce0c6897f76c..d5cd73d58943 100644
--- a/toolkit/content/widgets/textbox.xml
+++ b/toolkit/content/widgets/textbox.xml
@@ -132,7 +132,7 @@
       <method name="_setNewlineHandling">
         <body><![CDATA[
           var str = this.getAttribute("newlines");
-          if (str) {
+          if (str && this.editor) {
             const nsIPlaintextEditor = Components.interfaces.nsIPlaintextEditor;
             for (var x in nsIPlaintextEditor) {
               if (/^eNewlines/.test(x)) {

From f26d133589c3a2d42ac126a68d4830682db9c2a1 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Sun, 11 Jul 2010 16:26:26 -0400
Subject: [PATCH 032/222] Bug 240933 - Part 1: Do not split multiline text into
 textframes separated by BR elements; r=roc a=dbaron

--HG--
extra : rebase_source : 45cbd49946c1577786a5bd141384d92f9daf27c4
---
 editor/libeditor/text/nsTextEditRules.cpp     | 97 +++++--------------
 .../caret_on_textarea_lastline-ref.html       |  6 ++
 .../editor/caret_on_textarea_lastline.html    |  7 ++
 layout/reftests/editor/reftest.list           |  1 +
 4 files changed, 36 insertions(+), 75 deletions(-)
 create mode 100644 layout/reftests/editor/caret_on_textarea_lastline-ref.html
 create mode 100644 layout/reftests/editor/caret_on_textarea_lastline.html

diff --git a/editor/libeditor/text/nsTextEditRules.cpp b/editor/libeditor/text/nsTextEditRules.cpp
index 56e2b655bc6d..5212de932d98 100644
--- a/editor/libeditor/text/nsTextEditRules.cpp
+++ b/editor/libeditor/text/nsTextEditRules.cpp
@@ -756,83 +756,20 @@ nsTextEditRules::WillInsertText(PRInt32          aAction,
 
     // don't spaz my selection in subtransactions
     nsAutoTxnsConserveSelection dontSpazMySelection(mEditor);
-    nsString tString(*outString);
-    const PRUnichar *unicodeBuf = tString.get();
-    nsCOMPtr<nsIDOMNode> unused;
-    PRInt32 pos = 0;
 
-    // for efficiency, break out the pre case separately.  This is because
-    // it's a lot cheaper to search the input string for only newlines than
-    // it is to search for both tabs and newlines.
     if (isPRE)
     {
-      while (unicodeBuf && (pos != -1) && ((PRUint32)pos < tString.Length()))
-      {
-        PRInt32 oldPos = pos;
-        PRInt32 subStrLen;
-        pos = tString.FindChar(nsCRT::LF, oldPos);
-        
-        if (pos != -1) 
-        {
-          subStrLen = pos - oldPos;
-          // if first char is newline, then use just it
-          if (subStrLen == 0)
-            subStrLen = 1;
-        }
-        else
-        {
-          subStrLen = tString.Length() - oldPos;
-          pos = tString.Length();
-        }
-
-        nsDependentSubstring subStr(tString, oldPos, subStrLen);
-        
-        // is it a return?
-        if (subStr.EqualsLiteral(LFSTR))
-        {
-          if (IsSingleLineEditor())
-          {
-            NS_ASSERTION((mEditor->mNewlineHandling == nsIPlaintextEditor::eNewlinesPasteIntact),
-                  "Newline improperly getting into single-line edit field!");
-            res = mEditor->InsertTextImpl(subStr, address_of(curNode), &curOffset, doc);
-          }
-          else
-          {
-            res = mEditor->CreateBRImpl(address_of(curNode), &curOffset, address_of(unused), nsIEditor::eNone);
-
-            // If the newline is the last character in the string, and the BR we
-            // just inserted is the last node in the content tree, we need to add
-            // a mozBR so that a blank line is created.
-
-            if (NS_SUCCEEDED(res) && curNode && pos == (PRInt32)(tString.Length() - 1))
-            {
-              nsCOMPtr<nsIDOMNode> nextChild = mEditor->GetChildAt(curNode, curOffset);
-
-              if (!nextChild)
-              {
-                // We must be at the end since there isn't a nextChild.
-                //
-                // curNode and curOffset should be set to the position after
-                // the BR we added above, so just create a mozBR at that position.
-                //
-                // Note that we don't update curOffset after we've created/inserted
-                // the mozBR since we never want the selection to be placed after it.
-
-                res = CreateMozBR(curNode, curOffset, address_of(unused));
-              }
-            }
-          }
-          pos++;
-        }
-        else
-        {
-          res = mEditor->InsertTextImpl(subStr, address_of(curNode), &curOffset, doc);
-        }
-        NS_ENSURE_SUCCESS(res, res);
-      }
+      res = mEditor->InsertTextImpl(*outString, address_of(curNode),
+                                    &curOffset, doc);
+      NS_ENSURE_SUCCESS(res, res);
     }
     else
     {
+      const nsString& tString = PromiseFlatString(*outString);
+      const PRUnichar *unicodeBuf = tString.get();
+      nsCOMPtr<nsIDOMNode> unused;
+      PRInt32 pos = 0;
+
       char specialChars[] = {TAB, nsCRT::LF, 0};
       while (unicodeBuf && (pos != -1) && ((PRUint32)pos < tString.Length()))
       {
@@ -873,18 +810,28 @@ nsTextEditRules::WillInsertText(PRInt32          aAction,
         }
         NS_ENSURE_SUCCESS(res, res);
       }
+      outString->Assign(tString);
     }
-    outString->Assign(tString);
 
     if (curNode) 
     {
-      aSelection->Collapse(curNode, curOffset);
-      
       // Make the caret attach to the inserted text, unless this text ends with a LF, 
       // in which case make the caret attach to the next line.
-      PRBool endsWithLF = !tString.IsEmpty() && tString.get()[tString.Length() - 1] == nsCRT::LF;
+      PRBool endsWithLF =
+        !outString->IsEmpty() && outString->Last() == nsCRT::LF;
       nsCOMPtr<nsISelectionPrivate>selPrivate(do_QueryInterface(aSelection));
       selPrivate->SetInterlinePosition(endsWithLF);
+
+      // If the last character is a linefeed character, make sure that we inject
+      // a BR element for correct caret positioning.
+      if (endsWithLF) {
+        nsCOMPtr<nsIDOMNode> mozBR;
+        res = CreateMozBR(curNode, curOffset, address_of(mozBR));
+        NS_ENSURE_SUCCESS(res, res);
+        curNode = mozBR;
+        curOffset = 0;
+      }
+      aSelection->Collapse(curNode, curOffset);
     }
   }
   ASSERT_PASSWORD_LENGTHS_EQUAL()
diff --git a/layout/reftests/editor/caret_on_textarea_lastline-ref.html b/layout/reftests/editor/caret_on_textarea_lastline-ref.html
new file mode 100644
index 000000000000..6acd3d9b90e7
--- /dev/null
+++ b/layout/reftests/editor/caret_on_textarea_lastline-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.querySelector('textarea').focus();">
+<textarea>foo</textarea>
+</body>
+</html>
diff --git a/layout/reftests/editor/caret_on_textarea_lastline.html b/layout/reftests/editor/caret_on_textarea_lastline.html
new file mode 100644
index 000000000000..35973aa82858
--- /dev/null
+++ b/layout/reftests/editor/caret_on_textarea_lastline.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.querySelector('textarea').focus();">
+<textarea>foo
+</textarea>
+</body>
+</html>
diff --git a/layout/reftests/editor/reftest.list b/layout/reftests/editor/reftest.list
index 8a65c717a1f2..f95fdeaacbc4 100644
--- a/layout/reftests/editor/reftest.list
+++ b/layout/reftests/editor/reftest.list
@@ -18,3 +18,4 @@ include xul/reftest.list
 == emptypasswd-2.html emptypasswd-ref.html
 == caret_on_positioned.html caret_on_positioned-ref.html
 == spellcheck-1.html spellcheck-ref.html
+!= caret_on_textarea_lastline.html caret_on_textarea_lastline-ref.html

From 9bfb381743b615a8258dfc11b17d9e9ae4a928c8 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Mon, 12 Jul 2010 23:02:03 -0400
Subject: [PATCH 033/222] Bug 240933 - Part 2: Fix the accessibility test to
 only expect two children for textarea's; r=surkov a=dbaron

--HG--
extra : rebase_source : c4ed0124ad3ab8e36227dc9077f8c216f4d48a5e
---
 accessible/tests/mochitest/tree/test_txtctrl.html | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/accessible/tests/mochitest/tree/test_txtctrl.html b/accessible/tests/mochitest/tree/test_txtctrl.html
index 204da2b0f553..bc690b3e2df5 100644
--- a/accessible/tests/mochitest/tree/test_txtctrl.html
+++ b/accessible/tests/mochitest/tree/test_txtctrl.html
@@ -50,19 +50,7 @@
         role: ROLE_ENTRY,
         children: [
           {
-            role: ROLE_TEXT_LEAF // hello1 text
-          },
-          {
-            role: ROLE_WHITESPACE
-          },
-          {
-            role: ROLE_TEXT_LEAF, // hello2 text
-          },
-          {
-            role: ROLE_WHITESPACE
-          },
-          {
-            role: ROLE_TEXT_LEAF, // whitepsace text
+            role: ROLE_TEXT_LEAF // hello1\nhello2 text
           },
           {
             role: ROLE_WHITESPACE

From da0113546ac5efab6244800471ad63835a3c83d6 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 13 Jul 2010 21:49:16 -0400
Subject: [PATCH 034/222] Bug 240933 - Part 3: Correct the caret movement
 throughout textareas (and pre elements with caret browsing turned on as
 well); r=roc a=dbaron

--HG--
extra : rebase_source : 198f679bb5cea82b710c921576fa44c59f77aa23
---
 layout/generic/nsFrame.cpp                    | 11 +++-
 layout/generic/nsTextFrameThebes.cpp          | 30 ++++-----
 layout/generic/test/test_bug288789.html       | 61 ++++++++++++++++++-
 .../test/test_movement_by_characters.html     |  8 +--
 4 files changed, 88 insertions(+), 22 deletions(-)

diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 4d073ef6cfe7..b5bb78d707d8 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -5219,6 +5219,7 @@ nsIFrame::PeekOffset(nsPeekOffsetStruct* aPos)
     {
       PRBool eatingNonRenderableWS = PR_FALSE;
       PRBool done = PR_FALSE;
+      PRBool jumpedLine = PR_FALSE;
       
       while (!done) {
         PRBool movingInFrameDirection =
@@ -5230,7 +5231,6 @@ nsIFrame::PeekOffset(nsPeekOffsetStruct* aPos)
           done = current->PeekOffsetCharacter(movingInFrameDirection, &offset); 
 
         if (!done) {
-          PRBool jumpedLine;
           result =
             current->GetFrameFromDirection(aPos->mDirection, aPos->mVisual,
                                            aPos->mJumpLines, aPos->mScrollViewStop,
@@ -5251,6 +5251,15 @@ nsIFrame::PeekOffset(nsPeekOffsetStruct* aPos)
       aPos->mResultContent = range.content;
       // Output offset is relative to content, not frame
       aPos->mContentOffset = offset < 0 ? range.end : range.start + offset;
+      // If we're dealing with a text frame and moving backward positions us at
+      // the end of that line, decrease the offset by one to make sure that
+      // we're placed before the linefeed character on the previous line.
+      if (offset < 0 && jumpedLine &&
+          aPos->mDirection == eDirPrevious &&
+          current->GetStyleText()->NewlineIsSignificant() &&
+          current->HasTerminalNewline()) {
+        --aPos->mContentOffset;
+      }
       
       break;
     }
diff --git a/layout/generic/nsTextFrameThebes.cpp b/layout/generic/nsTextFrameThebes.cpp
index 7f698d207d94..c10c92ec1361 100644
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -5425,8 +5425,7 @@ IsAcceptableCaretPosition(const gfxSkipCharsIterator& aIter, gfxTextRun* aTextRu
   PRUint32 index = aIter.GetSkippedOffset();
   if (!aTextRun->IsClusterStart(index))
     return PR_FALSE;
-  return !(aFrame->GetStyleText()->NewlineIsSignificant() &&
-           aTextRun->GetChar(index) == '\n');
+  return PR_TRUE;
 }
 
 PRBool
@@ -5451,8 +5450,8 @@ nsTextFrame::PeekOffsetCharacter(PRBool aForward, PRInt32* aOffset)
   PRInt32 startOffset = GetContentOffset() + (*aOffset < 0 ? contentLength : *aOffset);
 
   if (!aForward) {
-    PRInt32 i;
-    for (i = NS_MIN(trimmed.GetEnd(), startOffset) - 1;
+    // If at the beginning of the line, look at the previous continuation
+    for (PRInt32 i = NS_MIN(trimmed.GetEnd(), startOffset) - 1;
          i >= trimmed.mStart; --i) {
       iter.SetOriginalOffset(i);
       if (IsAcceptableCaretPosition(iter, mTextRun, this)) {
@@ -5462,16 +5461,19 @@ nsTextFrame::PeekOffsetCharacter(PRBool aForward, PRInt32* aOffset)
     }
     *aOffset = 0;
   } else {
-    PRInt32 i;
-    for (i = startOffset + 1; i <= trimmed.GetEnd(); ++i) {
-      iter.SetOriginalOffset(i);
-      // XXX we can't necessarily stop at the end of this frame,
-      // but we really have no choice right now. We need to do a deeper
-      // fix/restructuring of PeekOffsetCharacter
-      if (i == trimmed.GetEnd() ||
-          IsAcceptableCaretPosition(iter, mTextRun, this)) {
-        *aOffset = i - mContentOffset;
-        return PR_TRUE;
+    // If we're at the end of a line, look at the next continuation
+    iter.SetOriginalOffset(startOffset);
+    if (iter.GetSkippedOffset() <= PRUint32(trimmed.GetEnd()) &&
+        !(iter.GetSkippedOffset() < PRUint32(trimmed.GetEnd()) &&
+          GetStyleText()->NewlineIsSignificant() &&
+          mTextRun->GetChar(iter.GetSkippedOffset()) == '\n')) {
+      for (PRInt32 i = startOffset + 1; i <= trimmed.GetEnd(); ++i) {
+        iter.SetOriginalOffset(i);
+        if (i == trimmed.GetEnd() ||
+            IsAcceptableCaretPosition(iter, mTextRun, this)) {
+          *aOffset = i - mContentOffset;
+          return PR_TRUE;
+        }
       }
     }
     *aOffset = contentLength;
diff --git a/layout/generic/test/test_bug288789.html b/layout/generic/test/test_bug288789.html
index 5e2f15f6272c..e21f2d4ee722 100644
--- a/layout/generic/test/test_bug288789.html
+++ b/layout/generic/test/test_bug288789.html
@@ -18,6 +18,11 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=288789
 
 &#x05d0;a&#x05d1;
 
+</textarea>
+<textarea id="tb">
+
+abc
+
 </textarea>
 </div>
 <pre id="test">
@@ -50,9 +55,59 @@ function test() {
 
   textarea.focus();
   collapse(0);
-  testLeft(1);
-  collapse(5);
-  testRight(4);
+  ok(true, "Testing forward movement in RTL mode");
+  for (var i = 0; i < textarea.textContent.length; ++i) {
+    if (i == 0) {
+      testRight(i);
+    }
+    if (textarea.textContent[i] == 'a') {
+      testLeft(i);
+    } else {
+      testLeft(i + 1);
+    }
+    if (i == textarea.textContent.length - 1) {
+      testLeft(i + 1);
+    }
+  }
+  ok(true, "Testing backward movement in RTL mode");
+  for (var i = textarea.textContent.length; i > 0; --i) {
+    if (i == textarea.textContent.length) {
+      testLeft(i);
+    }
+    if (i > 0 && textarea.textContent[i - 1] == 'a') {
+      testRight(i);
+    } else {
+      testRight(i - 1);
+    }
+    if (i == 1) {
+      testRight(i - 1);
+    }
+  }
+
+  textarea = $("tb");
+  textarea.focus();
+  collapse(0);
+  ok(true, "Testing forward movement in LTR mode");
+  for (var i = 0; i < textarea.textContent.length; ++i) {
+    if (i == 0) {
+      testLeft(i);
+    }
+    testRight(i + 1);
+    if (i == textarea.textContent.length - 1) {
+      testRight(i + 1);
+    }
+  }
+  ok(true, "Testing backward movement in LTR mode");
+  for (var i = textarea.textContent.length; i > 0; --i) {
+    if (i == textarea.textContent.length) {
+      testRight(i);
+    }
+    testLeft(i - 1);
+    if (i == 1) {
+      testLeft(i - 1);
+    }
+  }
+
   SimpleTest.finish();
 }
 
diff --git a/layout/generic/test/test_movement_by_characters.html b/layout/generic/test/test_movement_by_characters.html
index b8a0c4f616eb..61fff0865e08 100644
--- a/layout/generic/test/test_movement_by_characters.html
+++ b/layout/generic/test/test_movement_by_characters.html
@@ -68,13 +68,13 @@ function test() {
   editor.innerHTML = "<pre>aa\nbb</pre>";
   sel.collapse(editor.firstChild.firstChild, 0);
   testRight(editor.firstChild.firstChild, 1);
-  // at the 'bb' but HINTLEFT so appears at the end of the first line
-  testRight(editor.firstChild.firstChild, 3);  
+  // at the end of the first line, before the \n
+  testRight(editor.firstChild.firstChild, 2);
   testRight(editor.firstChild.firstChild, 3);
   testRight(editor.firstChild.firstChild, 4);
   testLeft(editor.firstChild.firstChild, 3);
-  // at the 'bb' but HINTLEFT so appears at the end of the first line
-  testLeft(editor.firstChild.firstChild, 3);
+  // at the end of the first line, before the \n
+  testLeft(editor.firstChild.firstChild, 2);
   testLeft(editor.firstChild.firstChild, 1);
   testLeft(editor.firstChild.firstChild, 0);
 

From 262d16a6c3de656633ca4d5fda103ee8f9a3d592 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 16 Jul 2010 17:34:36 -0400
Subject: [PATCH 035/222] Bug 240933 - Part 3.1: Position the selection before
 the terminating newline when clicking to the right of the line; r=roc
 a=dbaron

--HG--
extra : rebase_source : 51ab2d6caf2b8827cf2e1eb88e5034d75268f658
---
 layout/generic/nsTextFrameThebes.cpp    |  7 ++++
 layout/generic/test/Makefile.in         |  1 +
 layout/generic/test/test_bug240933.html | 46 +++++++++++++++++++++++++
 3 files changed, 54 insertions(+)
 create mode 100644 layout/generic/test/test_bug240933.html

diff --git a/layout/generic/nsTextFrameThebes.cpp b/layout/generic/nsTextFrameThebes.cpp
index c10c92ec1361..4dc203f467a7 100644
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -5062,6 +5062,13 @@ nsTextFrame::GetCharacterOffsetAtFramePointInternal(const nsPoint &aPoint,
     // intrinsic widths.
     selectedOffset =
         provider.GetStart().GetOriginalOffset() + provider.GetOriginalLength();
+    // If we're at the end of a preformatted line which has a terminating
+    // linefeed, we want to reduce the offset by one to make sure that the
+    // selection is placed before the linefeed character.
+    if (GetStyleText()->NewlineIsSignificant() &&
+        HasTerminalNewline()) {
+      --selectedOffset;
+    }
   }
 
   offsets.content = GetContent();
diff --git a/layout/generic/test/Makefile.in b/layout/generic/test/Makefile.in
index 2b0dc6c5fe11..44e456b47658 100644
--- a/layout/generic/test/Makefile.in
+++ b/layout/generic/test/Makefile.in
@@ -58,6 +58,7 @@ _TEST_FILES = \
 		plugin_clipping_lib.js \
 		plugin_focus_helper.html \
 		test_backspace_delete.xul \
+		test_bug240933.html \
 		test_bug263683.html \
 		test_bug288789.html \
 		test_bug290397.html \
diff --git a/layout/generic/test/test_bug240933.html b/layout/generic/test/test_bug240933.html
new file mode 100644
index 000000000000..fa90106bafbe
--- /dev/null
+++ b/layout/generic/test/test_bug240933.html
@@ -0,0 +1,46 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=240933
+-->
+
+<head>
+  <title>Test for Bug 240933</title>
+  <script type="application/javascript" src="/MochiKit/MochiKit.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+
+<body>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=240933">
+    Mozilla Bug 240933
+  </a>
+  <p id="display"></p>
+  <div id="content" style="display: none">
+  </div>
+
+  <pre id="test">
+    <script type="application/javascript">
+
+      /** Test for Bug 240933 **/
+
+      SimpleTest.waitForExplicitFinish();
+
+      SimpleTest.waitForFocus(function() {
+        var t = document.getElementById("t");
+        synthesizeMouse(t, t.clientWidth / 2, 5, {}, window);
+        is(t.selectionStart, 3, "The selection should be set before the newline");
+        is(t.selectionEnd,   3, "The selection should be set before the newline");
+        SimpleTest.finish();
+      });
+
+    </script>
+  </pre>
+
+  <textarea id="t" rows="10" cols="10">abc
+</textarea>
+
+</body>
+</html>

From f4fa8fbaff44ccd624815aa205aeb242e9cca507 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 16 Jul 2010 17:34:59 -0400
Subject: [PATCH 036/222] Bug 240933 - Part 4: Remove the code responsible for
 handling non-preformatted text in WillInsertText; r=roc a=dbaron

--HG--
extra : rebase_source : cb4457edb5716727801fad0152eff55d3f4d9b09
---
 editor/libeditor/text/nsTextEditRules.cpp     | 64 +------------------
 .../test_texteditor_keyevent_handling.html    | 16 ++++-
 2 files changed, 16 insertions(+), 64 deletions(-)

diff --git a/editor/libeditor/text/nsTextEditRules.cpp b/editor/libeditor/text/nsTextEditRules.cpp
index 5212de932d98..5c5dfe5cb717 100644
--- a/editor/libeditor/text/nsTextEditRules.cpp
+++ b/editor/libeditor/text/nsTextEditRules.cpp
@@ -748,70 +748,12 @@ nsTextEditRules::WillInsertText(PRInt32          aAction,
     nsCOMPtr<nsIDOMNode> curNode = selNode;
     PRInt32 curOffset = selOffset;
 
-    // is our text going to be PREformatted?  
-    // We remember this so that we know how to handle tabs.
-    PRBool isPRE;
-    res = mEditor->IsPreformatted(selNode, &isPRE);
-    NS_ENSURE_SUCCESS(res, res);    
-
     // don't spaz my selection in subtransactions
     nsAutoTxnsConserveSelection dontSpazMySelection(mEditor);
 
-    if (isPRE)
-    {
-      res = mEditor->InsertTextImpl(*outString, address_of(curNode),
-                                    &curOffset, doc);
-      NS_ENSURE_SUCCESS(res, res);
-    }
-    else
-    {
-      const nsString& tString = PromiseFlatString(*outString);
-      const PRUnichar *unicodeBuf = tString.get();
-      nsCOMPtr<nsIDOMNode> unused;
-      PRInt32 pos = 0;
-
-      char specialChars[] = {TAB, nsCRT::LF, 0};
-      while (unicodeBuf && (pos != -1) && ((PRUint32)pos < tString.Length()))
-      {
-        PRInt32 oldPos = pos;
-        PRInt32 subStrLen;
-        pos = tString.FindCharInSet(specialChars, oldPos);
-        
-        if (pos != -1) 
-        {
-          subStrLen = pos - oldPos;
-          // if first char is newline, then use just it
-          if (subStrLen == 0)
-            subStrLen = 1;
-        }
-        else
-        {
-          subStrLen = tString.Length() - oldPos;
-          pos = tString.Length();
-        }
-
-        nsDependentSubstring subStr(tString, oldPos, subStrLen);
-        
-        // is it a tab?
-        if (subStr.EqualsLiteral("\t"))
-        {
-          res = mEditor->InsertTextImpl(NS_LITERAL_STRING("    "), address_of(curNode), &curOffset, doc);
-          pos++;
-        }
-        // is it a return?
-        else if (subStr.EqualsLiteral(LFSTR))
-        {
-          res = mEditor->CreateBRImpl(address_of(curNode), &curOffset, address_of(unused), nsIEditor::eNone);
-          pos++;
-        }
-        else
-        {
-          res = mEditor->InsertTextImpl(subStr, address_of(curNode), &curOffset, doc);
-        }
-        NS_ENSURE_SUCCESS(res, res);
-      }
-      outString->Assign(tString);
-    }
+    res = mEditor->InsertTextImpl(*outString, address_of(curNode),
+                                  &curOffset, doc);
+    NS_ENSURE_SUCCESS(res, res);
 
     if (curNode) 
     {
diff --git a/editor/libeditor/text/tests/test_texteditor_keyevent_handling.html b/editor/libeditor/text/tests/test_texteditor_keyevent_handling.html
index 1aa0d8ae0053..627ebd5bb290 100644
--- a/editor/libeditor/text/tests/test_texteditor_keyevent_handling.html
+++ b/editor/libeditor/text/tests/test_texteditor_keyevent_handling.html
@@ -287,13 +287,23 @@ function runTests()
     synthesizeKey("VK_TAB", { });
     check(aDescription + "Tab",
           true, true, !aIsTabbable && !aIsReadonly);
-    // The tab char is converted to 4 space characters because textarea/input
-    // elements are not preformatted editor.
-    is(aElement.value, !aIsTabbable && !aIsReadonly ? "a    " : "a",
+    is(aElement.value, !aIsTabbable && !aIsReadonly ? "a\t" : "a",
        aDescription + "Tab");
     is(fm.focusedElement, aElement,
        aDescription + "focus moved unexpectedly (Tab)");
 
+    // If the editor is not tabbable, make sure that it accepts tab characters
+    // even if it's empty.
+    if (!aIsTabbable && !aIsReadonly) {
+      reset("");
+      synthesizeKey("VK_TAB", {});
+      check(aDescription + "Tab on empty textarea",
+            true, true, !aIsReadonly);
+      is(aElement.value, "\t", aDescription + "Tab on empty textarea");
+      is(fm.focusedElement, aElement,
+         aDescription + "focus moved unexpectedly (Tab on empty textarea");
+    }
+
     reset("a");
     synthesizeKey("VK_TAB", { shiftKey: true });
     check(aDescription + "Shift+Tab", true, true, false);

From c2ade13b05ab2dbc282306f65bd9856832dfa31b Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Sat, 17 Jul 2010 19:40:22 -0400
Subject: [PATCH 037/222] Bug 240933 - Part 5: Inject linefeed characters
 instead of BR elements when the user presses Enter; r=roc a=dbaron

--HG--
extra : rebase_source : af405de4d02ba543dffacea04dd026a1dd24c8bf
---
 editor/libeditor/text/nsPlaintextEditor.cpp | 77 ++++++++++-----------
 1 file changed, 37 insertions(+), 40 deletions(-)

diff --git a/editor/libeditor/text/nsPlaintextEditor.cpp b/editor/libeditor/text/nsPlaintextEditor.cpp
index 7dc9d3e3806c..dda0f07f55ac 100644
--- a/editor/libeditor/text/nsPlaintextEditor.cpp
+++ b/editor/libeditor/text/nsPlaintextEditor.cpp
@@ -867,52 +867,49 @@ NS_IMETHODIMP nsPlaintextEditor::InsertLineBreak()
   NS_ENSURE_SUCCESS(res, res);
   if (!cancel && !handled)
   {
-    // create the new BR node
-    nsCOMPtr<nsIDOMNode> newNode;
-    res = DeleteSelectionAndCreateNode(NS_LITERAL_STRING("br"), getter_AddRefs(newNode));
-    if (!newNode) res = NS_ERROR_NULL_POINTER; // don't return here, so DidDoAction is called
+    // get the (collapsed) selection location
+    nsCOMPtr<nsIDOMNode> selNode;
+    PRInt32 selOffset;
+    res = GetStartNodeAndOffset(selection, getter_AddRefs(selNode), &selOffset);
+    NS_ENSURE_SUCCESS(res, res);
+
+    // don't put text in places that can't have it
+    if (!IsTextNode(selNode) && !CanContainTag(selNode, NS_LITERAL_STRING("#text")))
+      return NS_ERROR_FAILURE;
+
+    // we need to get the doc
+    nsCOMPtr<nsIDOMDocument> doc;
+    res = GetDocument(getter_AddRefs(doc));
+    NS_ENSURE_SUCCESS(res, res);
+    NS_ENSURE_TRUE(doc, NS_ERROR_NULL_POINTER);
+
+    // don't spaz my selection in subtransactions
+    nsAutoTxnsConserveSelection dontSpazMySelection(this);
+
+    // insert a linefeed character
+    res = InsertTextImpl(NS_LITERAL_STRING("\n"), address_of(selNode),
+                         &selOffset, doc);
+    if (!selNode) res = NS_ERROR_NULL_POINTER; // don't return here, so DidDoAction is called
     if (NS_SUCCEEDED(res))
     {
-      // set the selection to the new node
-      nsCOMPtr<nsIDOMNode>parent;
-      res = newNode->GetParentNode(getter_AddRefs(parent));
-      if (!parent) res = NS_ERROR_NULL_POINTER; // don't return here, so DidDoAction is called
+      // set the selection to the correct location
+      res = selection->Collapse(selNode, selOffset);
+
       if (NS_SUCCEEDED(res))
       {
-        PRInt32 offsetInParent=-1;  // we use the -1 as a marker to see if we need to compute this or not
-        nsCOMPtr<nsIDOMNode>nextNode;
-        newNode->GetNextSibling(getter_AddRefs(nextNode));
-        if (nextNode)
-        {
-          nsCOMPtr<nsIDOMCharacterData>nextTextNode = do_QueryInterface(nextNode);
-          if (!nextTextNode) {
-            nextNode = do_QueryInterface(newNode); // is this QI needed?
-          }
-          else { 
-            offsetInParent=0; 
-          }
-        }
-        else {
-          nextNode = do_QueryInterface(newNode); // is this QI needed?
-        }
+        // see if we're at the end of the editor range
+        nsCOMPtr<nsIDOMNode> endNode;
+        PRInt32 endOffset;
+        res = GetEndNodeAndOffset(selection, getter_AddRefs(endNode), &endOffset);
 
-        if (-1==offsetInParent) 
+        if (NS_SUCCEEDED(res) && endNode == selNode && endOffset == selOffset)
         {
-          nextNode->GetParentNode(getter_AddRefs(parent));
-          res = GetChildOffset(nextNode, parent, offsetInParent);
-          if (NS_SUCCEEDED(res)) {
-            // SetInterlinePosition(PR_TRUE) means we want the caret to stick to the content on the "right".
-            // We want the caret to stick to whatever is past the break.  This is
-            // because the break is on the same line we were on, but the next content
-            // will be on the following line.
-            nsCOMPtr<nsISelectionPrivate> selPriv(do_QueryInterface(selection));
-            selPriv->SetInterlinePosition(PR_TRUE);
-            res = selection->Collapse(parent, offsetInParent+1);  // +1 to insert just after the break
-          }
-        }
-        else
-        {
-          res = selection->Collapse(nextNode, offsetInParent);
+          // SetInterlinePosition(PR_TRUE) means we want the caret to stick to the content on the "right".
+          // We want the caret to stick to whatever is past the break.  This is
+          // because the break is on the same line we were on, but the next content
+          // will be on the following line.
+          nsCOMPtr<nsISelectionPrivate> selPriv(do_QueryInterface(selection));
+          selPriv->SetInterlinePosition(PR_TRUE);
         }
       }
     }

From ebd843aa1ee496e2bedc644508bc3c573c89539c Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Mon, 19 Jul 2010 16:19:27 -0400
Subject: [PATCH 038/222] Bug 240933 - Part 6: Put the selection on the moz BR
 element if the user presses Enter at the end of a textarea; r=roc a=dbaron

--HG--
extra : rebase_source : d992d0950cd15c24d68f976d6e628eb349de5150
---
 editor/libeditor/text/nsTextEditRules.cpp | 48 +++++++++++------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/editor/libeditor/text/nsTextEditRules.cpp b/editor/libeditor/text/nsTextEditRules.cpp
index 5c5dfe5cb717..1c7036302657 100644
--- a/editor/libeditor/text/nsTextEditRules.cpp
+++ b/editor/libeditor/text/nsTextEditRules.cpp
@@ -463,40 +463,40 @@ nsTextEditRules::DidInsertBreak(nsISelection *aSelection, nsresult aResult)
     return NS_OK;
   }
 
-  // if we are at the end of the document, we need to insert 
-  // a special mozBR following the normal br, and then set the
-  // selection to stick to the mozBR.
+  // if we are at the end of the textarea, we need to set the
+  // selection to stick to the mozBR at the end of the textarea.
   PRInt32 selOffset;
   nsCOMPtr<nsIDOMNode> selNode;
   nsresult res;
   res = mEditor->GetStartNodeAndOffset(aSelection, getter_AddRefs(selNode), &selOffset);
   NS_ENSURE_SUCCESS(res, res);
-  // confirm we are at end of document
-  if (selOffset == 0) return NS_OK;  // can't be after a br if we are at offset 0
-  nsIDOMElement *rootElem = mEditor->GetRoot();
 
+  nsCOMPtr<nsIDOMText> nodeAsText = do_QueryInterface(selNode);
+  if (!nodeAsText) return NS_OK; // nothing to do if we're not at a text node
+
+  PRUint32 length;
+  res = nodeAsText->GetLength(&length);
+  NS_ENSURE_SUCCESS(res, res);
+
+  // nothing to do if we're not at the end of the text node
+  if (selOffset != length) return NS_OK;
+
+  nsCOMPtr<nsIDOMNode> parentNode;
+  PRInt32 parentOffset;
+  res = nsEditor::GetNodeLocation(selNode, address_of(parentNode),
+                                  &parentOffset);
+  NS_ENSURE_SUCCESS(res, res);
+
+  nsIDOMElement *rootElem = mEditor->GetRoot();
   nsCOMPtr<nsIDOMNode> root = do_QueryInterface(rootElem);
   NS_ENSURE_TRUE(root, NS_ERROR_NULL_POINTER);
-  if (selNode != root) return NS_OK; // must be inside text node or somewhere other than end of root
+  if (parentNode != root) return NS_OK;
 
-  nsCOMPtr<nsIDOMNode> temp = mEditor->GetChildAt(selNode, selOffset);
-  if (temp) return NS_OK; // can't be at end if there is a node after us.
-
-  nsCOMPtr<nsIDOMNode> nearNode = mEditor->GetChildAt(selNode, selOffset-1);
-  if (nearNode && nsTextEditUtils::IsBreak(nearNode) && !nsTextEditUtils::IsMozBR(nearNode))
+  nsCOMPtr<nsIDOMNode> nextNode = mEditor->GetChildAt(parentNode,
+                                                      parentOffset + 1);
+  if (nextNode && nsTextEditUtils::IsMozBR(nextNode))
   {
-    nsCOMPtr<nsISelectionPrivate>selPrivate(do_QueryInterface(aSelection));
-    // need to insert special moz BR. Why?  Because if we don't
-    // the user will see no new line for the break.  Also, things
-    // like table cells won't grow in height.
-    nsCOMPtr<nsIDOMNode> brNode;
-    res = CreateMozBR(selNode, selOffset, address_of(brNode));
-    NS_ENSURE_SUCCESS(res, res);
-
-    res = nsEditor::GetNodeLocation(brNode, address_of(selNode), &selOffset);
-    NS_ENSURE_SUCCESS(res, res);
-    selPrivate->SetInterlinePosition(PR_TRUE);
-    res = aSelection->Collapse(selNode, selOffset);
+    res = aSelection->Collapse(parentNode, parentOffset + 1);
     NS_ENSURE_SUCCESS(res, res);
   }
   return res;

From 29d308b3ae19ffc7f485bc74692141371f67100a Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Wed, 1 Sep 2010 18:06:52 -0400
Subject: [PATCH 039/222] Bug 240933 - Part 7: Collapse the selection in
 textarea's to the trailing BR if needed after every edit operation; r,a=roc

--HG--
extra : rebase_source : a13c6c277ddb545614eb8c93131112bc793c1348
---
 editor/libeditor/text/nsTextEditRules.cpp       |  9 +++++++++
 editor/libeditor/text/nsTextEditRules.h         |  2 ++
 layout/base/tests/Makefile.in                   |  3 +++
 layout/base/tests/bug240933-1-ref.html          | 10 ++++++++++
 layout/base/tests/bug240933-1.html              | 14 ++++++++++++++
 layout/base/tests/bug240933-2.html              | 16 ++++++++++++++++
 layout/base/tests/test_reftests_with_caret.html |  2 ++
 7 files changed, 56 insertions(+)
 create mode 100644 layout/base/tests/bug240933-1-ref.html
 create mode 100644 layout/base/tests/bug240933-1.html
 create mode 100644 layout/base/tests/bug240933-2.html

diff --git a/editor/libeditor/text/nsTextEditRules.cpp b/editor/libeditor/text/nsTextEditRules.cpp
index 1c7036302657..26eb907d51ff 100644
--- a/editor/libeditor/text/nsTextEditRules.cpp
+++ b/editor/libeditor/text/nsTextEditRules.cpp
@@ -267,6 +267,9 @@ nsTextEditRules::AfterEdit(PRInt32 action, nsIEditor::EDirection aDirection)
     // insure trailing br node
     res = CreateTrailingBRIfNeeded();
     NS_ENSURE_SUCCESS(res, res);
+
+    // collapse the selection to the trailing BR if it's at the end of our text node
+    CollapseSelectionToTrailingBRIfNeeded(selection);
     
     /* After inserting text the cursor Bidi level must be set to the level of the inserted text.
      * This is difficult, because we cannot know what the level is until after the Bidi algorithm
@@ -455,6 +458,12 @@ nsTextEditRules::WillInsertBreak(nsISelection *aSelection, PRBool *aCancel, PRBo
 
 nsresult
 nsTextEditRules::DidInsertBreak(nsISelection *aSelection, nsresult aResult)
+{
+  return NS_OK;
+}
+
+nsresult
+nsTextEditRules::CollapseSelectionToTrailingBRIfNeeded(nsISelection* aSelection)
 {
   // we only need to execute the stuff below if we are a plaintext editor.
   // html editors have a different mechanism for putting in mozBR's
diff --git a/editor/libeditor/text/nsTextEditRules.h b/editor/libeditor/text/nsTextEditRules.h
index ba1eadb4a5e6..48d1b3fe882e 100644
--- a/editor/libeditor/text/nsTextEditRules.h
+++ b/editor/libeditor/text/nsTextEditRules.h
@@ -233,6 +233,8 @@ protected:
 
   nsresult HideLastPWInput();
 
+  nsresult CollapseSelectionToTrailingBRIfNeeded(nsISelection *aSelection);
+
   PRBool IsPasswordEditor() const
   {
     return mEditor ? mEditor->IsPasswordEditor() : PR_FALSE;
diff --git a/layout/base/tests/Makefile.in b/layout/base/tests/Makefile.in
index ff72f1e331fd..83fef4b7d4b2 100644
--- a/layout/base/tests/Makefile.in
+++ b/layout/base/tests/Makefile.in
@@ -92,6 +92,9 @@ _TEST_FILES =	\
 		     bug106855-1.html \
 		     bug106855-2.html \
 		     bug106855-1-ref.html \
+		     bug240933-1.html \
+		     bug240933-2.html \
+		     bug240933-1-ref.html \
 		     bug482484.html \
 		     bug482484-ref.html \
 		     bug512295-1.html \
diff --git a/layout/base/tests/bug240933-1-ref.html b/layout/base/tests/bug240933-1-ref.html
new file mode 100644
index 000000000000..c3aa0a57e9cd
--- /dev/null
+++ b/layout/base/tests/bug240933-1-ref.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML><html>
+<body>
+<textarea id="t" rows="4">
+
+</textarea>
+<script>
+  document.getElementById("t").focus();
+</script>
+</body>
+</html>
diff --git a/layout/base/tests/bug240933-1.html b/layout/base/tests/bug240933-1.html
new file mode 100644
index 000000000000..c64ea3ac4a59
--- /dev/null
+++ b/layout/base/tests/bug240933-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML><html><head>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+</head>
+<body>
+<textarea id="t" rows="4"></textarea>
+<script>
+  var area = document.getElementById('t');
+  area.focus();
+
+  sendKey('VK_ENTER'); // press Enter once
+</script>
+</body>
+</html>
diff --git a/layout/base/tests/bug240933-2.html b/layout/base/tests/bug240933-2.html
new file mode 100644
index 000000000000..789b28542581
--- /dev/null
+++ b/layout/base/tests/bug240933-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML><html><head>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+</head>
+<body>
+<textarea id="t" rows="4"></textarea>
+<script>
+  var area = document.getElementById('t');
+  area.focus();
+
+  sendKey('VK_ENTER'); // press Enter twice
+  sendKey('VK_ENTER');
+  sendKey('VK_BACK_SPACE'); // press Backspace once
+</script>
+</body>
+</html>
diff --git a/layout/base/tests/test_reftests_with_caret.html b/layout/base/tests/test_reftests_with_caret.html
index e129684ebbc7..2b54805ebbd5 100644
--- a/layout/base/tests/test_reftests_with_caret.html
+++ b/layout/base/tests/test_reftests_with_caret.html
@@ -88,6 +88,8 @@ function endTest() {
 var tests = [
     [ 'bug106855-1.html' , 'bug106855-1-ref.html' ] ,
     [ 'bug106855-2.html' , 'bug106855-1-ref.html' ] ,
+    [ 'bug240933-1.html' , 'bug240933-1-ref.html' ] ,
+    [ 'bug240933-2.html' , 'bug240933-1-ref.html' ] ,
     [ 'bug482484.html'   , 'bug482484-ref.html'   ] ,
     [ 'bug512295-1.html' , 'bug512295-1-ref.html' ] ,
     [ 'bug512295-2.html' , 'bug512295-2-ref.html' ] ,

From 57f8ffa5cbc2d8cd2545fb3cf52c40f0e45df04e Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Mon, 19 Jul 2010 16:47:52 -0400
Subject: [PATCH 040/222] Bug 240933 - Part 8: Avoid creating multiple
 textnodes when adding text to textareas; r=roc a=dbaron

--HG--
extra : rebase_source : 7ca0900e7c97215684b523e249a9b5cef7cbdaac
---
 editor/libeditor/base/Makefile.in  |  1 +
 editor/libeditor/base/nsEditor.cpp | 45 +++++++++++++++++++++++++++++-
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/editor/libeditor/base/Makefile.in b/editor/libeditor/base/Makefile.in
index 81c5bdc964bb..acedb86f4994 100644
--- a/editor/libeditor/base/Makefile.in
+++ b/editor/libeditor/base/Makefile.in
@@ -90,6 +90,7 @@ FORCE_STATIC_LIB = 1
 include $(topsrcdir)/config/rules.mk
 
 INCLUDES	+= \
+		-I$(topsrcdir)/editor/libeditor/text \
 		-I$(topsrcdir)/content/base/src \
 		-I$(topsrcdir)/content/events/src \
 		-I$(topsrcdir)/layout/style \
diff --git a/editor/libeditor/base/nsEditor.cpp b/editor/libeditor/base/nsEditor.cpp
index 5adc2f26d48e..4b35ca417bcf 100644
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -113,6 +113,7 @@
 
 #include "nsITransferable.h"
 #include "nsComputedDOMStyle.h"
+#include "nsTextEditUtils.h"
 
 #include "mozilla/FunctionTimer.h"
 
@@ -2273,11 +2274,53 @@ NS_IMETHODIMP nsEditor::InsertTextImpl(const nsAString& aStringToInsert,
   // class to turn off txn selection updating.  Caller also turned on rules sniffing
   // if desired.
   
+  nsresult res;
   NS_ENSURE_TRUE(aInOutNode && *aInOutNode && aInOutOffset && aDoc, NS_ERROR_NULL_POINTER);
   if (!mInIMEMode && aStringToInsert.IsEmpty()) return NS_OK;
   nsCOMPtr<nsIDOMText> nodeAsText = do_QueryInterface(*aInOutNode);
+  if (!nodeAsText && IsPlaintextEditor()) {
+    // In some cases, aInOutNode is the anonymous DIV, and aInOutOffset is 0.
+    // To avoid injecting unneeded text nodes, we first look to see if we have
+    // one available.  In that case, we'll just adjust aInOutNode and aInOutOffset
+    // accordingly.
+    if (*aInOutNode == GetRoot() && *aInOutOffset == 0) {
+      nsCOMPtr<nsIDOMNode> possibleTextNode;
+      res = (*aInOutNode)->GetFirstChild(getter_AddRefs(possibleTextNode));
+      if (NS_SUCCEEDED(res)) {
+        nodeAsText = do_QueryInterface(possibleTextNode);
+        if (nodeAsText) {
+          *aInOutNode = possibleTextNode;
+        }
+      }
+    }
+    // In some other cases, aInOutNode is the anonymous DIV, and aInOutOffset points
+    // to the terminating mozBR.  In that case, we'll adjust aInOutNode and aInOutOffset
+    // to the preceding text node, if any.
+    if (!nodeAsText && *aInOutNode == GetRoot() && *aInOutOffset > 0) {
+      nsCOMPtr<nsIDOMNodeList> children;
+      res = (*aInOutNode)->GetChildNodes(getter_AddRefs(children));
+      if (NS_SUCCEEDED(res)) {
+        nsCOMPtr<nsIDOMNode> possibleMozBRNode;
+        res = children->Item(*aInOutOffset, getter_AddRefs(possibleMozBRNode));
+        if (NS_SUCCEEDED(res) && nsTextEditUtils::IsMozBR(possibleMozBRNode)) {
+          nsCOMPtr<nsIDOMNode> possibleTextNode;
+          res = children->Item(*aInOutOffset - 1, getter_AddRefs(possibleTextNode));
+          if (NS_SUCCEEDED(res)) {
+            nodeAsText = do_QueryInterface(possibleTextNode);
+            if (nodeAsText) {
+              PRUint32 length;
+              res = nodeAsText->GetLength(&length);
+              if (NS_SUCCEEDED(res)) {
+                *aInOutOffset = PRInt32(length);
+                *aInOutNode = possibleTextNode;
+              }
+            }
+          }
+        }
+      }
+    }
+  }
   PRInt32 offset = *aInOutOffset;
-  nsresult res;
   if (mInIMEMode)
   {
     if (!nodeAsText)

From 58248ee66ac1124f111b8e21af894297984052d9 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 20 Jul 2010 08:47:28 -0400
Subject: [PATCH 041/222] Bug 240933 - Part 9: Simplify text control frame's
 DOM point to offset conversion code; r=roc a=dbaron

--HG--
extra : rebase_source : 134895e08a57c7aeb39f25266d8925cde4595159
---
 layout/forms/nsTextControlFrame.cpp    | 132 ++++++-------------------
 layout/reftests/bugs/240933-1-ref.html |  25 +++++
 layout/reftests/bugs/240933-1.html     |  19 ++++
 layout/reftests/bugs/240933-2-ref.html |  29 ++++++
 layout/reftests/bugs/240933-2.html     |  19 ++++
 layout/reftests/bugs/reftest.list      |   2 +
 6 files changed, 125 insertions(+), 101 deletions(-)
 create mode 100644 layout/reftests/bugs/240933-1-ref.html
 create mode 100644 layout/reftests/bugs/240933-1.html
 create mode 100644 layout/reftests/bugs/240933-2-ref.html
 create mode 100644 layout/reftests/bugs/240933-2.html

diff --git a/layout/forms/nsTextControlFrame.cpp b/layout/forms/nsTextControlFrame.cpp
index 2dac683f0622..db7a72a590fa 100644
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -998,51 +998,27 @@ nsTextControlFrame::DOMPointToOffset(nsIDOMNode* aNode,
   if (!length || aNodeOffset < 0)
     return NS_OK;
 
-  PRInt32 i, textOffset = 0;
-  PRInt32 lastIndex = (PRInt32)length - 1;
+  NS_ASSERTION(length <= 2, "We should have one text node and one mozBR at most");
 
-  for (i = 0; i < (PRInt32)length; i++) {
-    if (rootNode == aNode && i == aNodeOffset) {
-      *aResult = textOffset;
-      return NS_OK;
-    }
+  nsCOMPtr<nsIDOMNode> firstNode;
+  rv = nodeList->Item(0, getter_AddRefs(firstNode));
+  NS_ENSURE_SUCCESS(rv, rv);
+  nsCOMPtr<nsIDOMText> textNode = do_QueryInterface(firstNode);
 
-    nsCOMPtr<nsIDOMNode> item;
-    rv = nodeList->Item(i, getter_AddRefs(item));
-    NS_ENSURE_SUCCESS(rv, rv);
-    NS_ENSURE_TRUE(item, NS_ERROR_FAILURE);
-
-    nsCOMPtr<nsIDOMText> domText(do_QueryInterface(item));
-
-    if (domText) {
-      PRUint32 textLength = 0;
-
-      rv = domText->GetLength(&textLength);
+  nsCOMPtr<nsIDOMText> nodeAsText = do_QueryInterface(aNode);
+  if (nodeAsText || (aNode == rootNode && aNodeOffset == 0)) {
+    // Selection is somewhere inside the text node; the offset is aNodeOffset
+    *aResult = aNodeOffset;
+  } else {
+    // Selection is on the mozBR node, so offset should be set to the length
+    // of the text node.
+    if (textNode) {
+      rv = textNode->GetLength(&length);
       NS_ENSURE_SUCCESS(rv, rv);
-
-      if (item == aNode) {
-        NS_ASSERTION((aNodeOffset >= 0 && aNodeOffset <= (PRInt32)textLength),
-                     "Invalid aNodeOffset!");
-        *aResult = textOffset + aNodeOffset;
-        return NS_OK;
-      }
-
-      textOffset += textLength;
-    }
-    else {
-      // Must be a BR node. If it's not the last BR node
-      // under the root, count it as a newline.
-
-      if (i != lastIndex)
-        ++textOffset;
+      *aResult = PRInt32(length);
     }
   }
 
-  NS_ASSERTION((aNode == rootNode && aNodeOffset == (PRInt32)length),
-               "Invalid node offset!");
-
-  *aResult = textOffset;
-  
   return NS_OK;
 }
 
@@ -1074,71 +1050,25 @@ nsTextControlFrame::OffsetToDOMPoint(PRInt32 aOffset,
   rv = nodeList->GetLength(&length);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (!length || aOffset < 0) {
+  NS_ASSERTION(length <= 2, "We should have one text node and one mozBR at most");
+
+  nsCOMPtr<nsIDOMNode> firstNode;
+  rv = nodeList->Item(0, getter_AddRefs(firstNode));
+  NS_ENSURE_SUCCESS(rv, rv);
+  nsCOMPtr<nsIDOMText> textNode = do_QueryInterface(firstNode);
+
+  if (length == 0 || aOffset < 0) {
+    NS_IF_ADDREF(*aResult = rootNode);
+    *aPosition = 0;
+  } else if (textNode) {
+    NS_IF_ADDREF(*aResult = firstNode);
+    *aPosition = aOffset;
+  } else {
+    NS_IF_ADDREF(*aResult = rootNode);
     *aPosition = 0;
-    *aResult = rootNode;
-    NS_ADDREF(*aResult);
-    return NS_OK;
   }
 
-  PRInt32 textOffset = 0;
-  PRUint32 lastIndex = length - 1;
-
-  for (PRUint32 i=0; i<length; i++) {
-    nsCOMPtr<nsIDOMNode> item;
-    rv = nodeList->Item(i, getter_AddRefs(item));
-    NS_ENSURE_SUCCESS(rv, rv);
-    NS_ENSURE_TRUE(item, NS_ERROR_FAILURE);
-
-    nsCOMPtr<nsIDOMText> domText(do_QueryInterface(item));
-
-    if (domText) {
-      PRUint32 textLength = 0;
-
-      rv = domText->GetLength(&textLength);
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      // Check if aOffset falls within this range.
-      if (aOffset >= textOffset && aOffset <= textOffset+(PRInt32)textLength) {
-        *aPosition = aOffset - textOffset;
-        *aResult = item;
-        NS_ADDREF(*aResult);
-        return NS_OK;
-      }
-
-      textOffset += textLength;
-
-      // If there aren't any more siblings after this text node,
-      // return the point at the end of this text node!
-
-      if (i == lastIndex) {
-        *aPosition = textLength;
-        *aResult = item;
-        NS_ADDREF(*aResult);
-        return NS_OK;
-      }
-    }
-    else {
-      // Must be a BR node, count it as a newline.
-
-      if (aOffset == textOffset || i == lastIndex) {
-        // We've found the correct position, or aOffset takes us
-        // beyond the last child under rootNode, just return the point
-        // under rootNode that is in front of this br.
-
-        *aPosition = i;
-        *aResult = rootNode;
-        NS_ADDREF(*aResult);
-        return NS_OK;
-      }
-
-      ++textOffset;
-    }
-  }
-
-  NS_ERROR("We should never get here!");
-
-  return NS_ERROR_FAILURE;
+  return NS_OK;
 }
 
 NS_IMETHODIMP
diff --git a/layout/reftests/bugs/240933-1-ref.html b/layout/reftests/bugs/240933-1-ref.html
new file mode 100644
index 000000000000..0d727af3a286
--- /dev/null
+++ b/layout/reftests/bugs/240933-1-ref.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<body onload="setup()">
+<textarea id="ta" dir="rtl">
+
+&#x05d0;a&#x05d1;
+
+</textarea>
+<textarea id="tb">
+
+abc
+
+</textarea>
+
+<div id="coords1"></div>
+<div id="coords2"></div>
+
+<script>
+  function setup() {
+    document.getElementById("coords1").innerHTML = document.getElementById("ta").selectionStart;
+    document.getElementById("coords2").innerHTML = document.getElementById("tb").selectionStart;
+  }
+</script>
+</body>
+</html>
diff --git a/layout/reftests/bugs/240933-1.html b/layout/reftests/bugs/240933-1.html
new file mode 100644
index 000000000000..e180c5f484de
--- /dev/null
+++ b/layout/reftests/bugs/240933-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<body>
+<textarea id="ta" dir="rtl">
+
+&#x05d0;a&#x05d1;
+
+</textarea>
+<textarea id="tb">
+
+abc
+
+</textarea>
+
+<div id="coords1">6</div>
+<div id="coords2">6</div>
+
+</body>
+</html>
diff --git a/layout/reftests/bugs/240933-2-ref.html b/layout/reftests/bugs/240933-2-ref.html
new file mode 100644
index 000000000000..7dbc082a58a5
--- /dev/null
+++ b/layout/reftests/bugs/240933-2-ref.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<body onload="setup()">
+<textarea id="ta" dir="rtl">
+
+&#x05d0;a&#x05d1;
+
+</textarea>
+<textarea id="tb">
+
+abc
+
+</textarea>
+
+<div id="coords1"></div>
+<div id="coords2"></div>
+
+<script>
+  function setup() {
+    document.getElementById("ta").selectionStart = 3;
+    document.getElementById("ta").selectionEnd = 3;
+    document.getElementById("coords1").innerHTML = document.getElementById("ta").selectionStart;
+    document.getElementById("tb").selectionStart = 3;
+    document.getElementById("tb").selectionEnd = 3;
+    document.getElementById("coords2").innerHTML = document.getElementById("tb").selectionStart;
+  }
+</script>
+</body>
+</html>
diff --git a/layout/reftests/bugs/240933-2.html b/layout/reftests/bugs/240933-2.html
new file mode 100644
index 000000000000..0fb9b9d5069c
--- /dev/null
+++ b/layout/reftests/bugs/240933-2.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<body>
+<textarea id="ta" dir="rtl">
+
+&#x05d0;a&#x05d1;
+
+</textarea>
+<textarea id="tb">
+
+abc
+
+</textarea>
+
+<div id="coords1">3</div>
+<div id="coords2">3</div>
+
+</body>
+</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 19987537fe57..204fe7060443 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -205,6 +205,8 @@ random == 99850-1b.html 99850-1-ref.html # bug 471629
 == 236539-1.html 236539-1-ref.html
 == 240029-1.html 240029-1-ref.html
 == 240470-1.html 240470-1-ref.html
+== 240933-1.html 240933-1-ref.html
+== 240933-2.html 240933-2-ref.html
 == 243266-1.html 243266-1-ref.html
 == 243302-1.html 243302-1-ref.html
 == 243519-1.html 243519-1-ref.html

From 06dfe9b12645870099e72b7ad7cee34b5c6dbbdd Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Wed, 21 Jul 2010 16:08:52 -0400
Subject: [PATCH 042/222] Bug 240933 - Part 10: Only hide/show the caret once
 when placeholder transactions finish; r=roc a=dbaron

--HG--
extra : rebase_source : 21823fb610b02859893f1461e8adaf38f5d61e94
---
 editor/libeditor/base/nsEditor.cpp | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/editor/libeditor/base/nsEditor.cpp b/editor/libeditor/base/nsEditor.cpp
index 4b35ca417bcf..2f7b4e258078 100644
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -904,14 +904,27 @@ nsEditor::EndPlaceHolderTransaction()
     if (selPrivate) {
       selPrivate->SetCanCacheFrameOffset(PR_TRUE);
     }
-    
-    // time to turn off the batch
-    EndUpdateViewBatch();
-    // make sure selection is in view
 
-    // After ScrollSelectionIntoView(), the pending notifications might be
-    // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
-    ScrollSelectionIntoView(PR_FALSE);
+    {
+      // Hide the caret here to avoid hiding it twice, once in EndUpdateViewBatch
+      // and once in ScrollSelectionIntoView.
+      nsRefPtr<nsCaret> caret;
+      nsCOMPtr<nsIPresShell> presShell;
+      GetPresShell(getter_AddRefs(presShell));
+
+      if (presShell)
+        caret = presShell->GetCaret();
+
+      StCaretHider caretHider(caret);
+
+      // time to turn off the batch
+      EndUpdateViewBatch();
+      // make sure selection is in view
+
+      // After ScrollSelectionIntoView(), the pending notifications might be
+      // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
+      ScrollSelectionIntoView(PR_FALSE);
+    }
 
     // cached for frame offset are Not available now
     if (selPrivate) {

From 41095d22376cde445962f1cc65a58bdd2fdd882c Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Wed, 21 Jul 2010 19:29:06 -0400
Subject: [PATCH 043/222] Bug 240933 - Part 11: Optimize setting the bidi flag
 for modifications to large DOM text nodes; r=smontagu a=dbaron

--HG--
extra : rebase_source : bdd58373ec59cdcdc231ca9eb61bc7a1a0c9191f
---
 content/base/src/nsGenericDOMDataNode.cpp | 6 +++---
 content/base/src/nsGenericDOMDataNode.h   | 2 +-
 content/base/src/nsTextFragment.cpp       | 6 +++---
 content/base/src/nsTextFragment.h         | 4 ++--
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/content/base/src/nsGenericDOMDataNode.cpp b/content/base/src/nsGenericDOMDataNode.cpp
index 34344f644b28..166fa69205c7 100644
--- a/content/base/src/nsGenericDOMDataNode.cpp
+++ b/content/base/src/nsGenericDOMDataNode.cpp
@@ -385,7 +385,7 @@ nsGenericDOMDataNode::SetTextInternal(PRUint32 aOffset, PRUint32 aCount,
     delete [] to;
   }
 
-  SetBidiStatus();
+  UpdateBidiStatus(aBuffer, aLength);
 
   // Notify observers
   if (aNotify) {
@@ -1084,7 +1084,7 @@ nsGenericDOMDataNode::AppendTextTo(nsAString& aResult)
   mText.AppendTo(aResult);
 }
 
-void nsGenericDOMDataNode::SetBidiStatus()
+void nsGenericDOMDataNode::UpdateBidiStatus(const PRUnichar* aBuffer, PRUint32 aLength)
 {
   nsIDocument *document = GetCurrentDoc();
   if (document && document->GetBidiEnabled()) {
@@ -1092,7 +1092,7 @@ void nsGenericDOMDataNode::SetBidiStatus()
     return;
   }
 
-  mText.SetBidiFlag();
+  mText.UpdateBidiFlag(aBuffer, aLength);
 
   if (document && mText.IsBidi()) {
     document->SetBidiEnabled();
diff --git a/content/base/src/nsGenericDOMDataNode.h b/content/base/src/nsGenericDOMDataNode.h
index a90f7243e01f..83c461fbb93d 100644
--- a/content/base/src/nsGenericDOMDataNode.h
+++ b/content/base/src/nsGenericDOMDataNode.h
@@ -358,7 +358,7 @@ protected:
   nsTextFragment mText;
 
 private:
-  void SetBidiStatus();
+  void UpdateBidiStatus(const PRUnichar* aBuffer, PRUint32 aLength);
 
   already_AddRefed<nsIAtom> GetCurrentValueAtom();
 };
diff --git a/content/base/src/nsTextFragment.cpp b/content/base/src/nsTextFragment.cpp
index ce1aab9f3924..87f4f8e91dd2 100644
--- a/content/base/src/nsTextFragment.cpp
+++ b/content/base/src/nsTextFragment.cpp
@@ -372,11 +372,11 @@ nsTextFragment::Append(const PRUnichar* aBuffer, PRUint32 aLength)
 // To save time we only do this when we really want to know, not during
 // every allocation
 void
-nsTextFragment::SetBidiFlag()
+nsTextFragment::UpdateBidiFlag(const PRUnichar* aBuffer, PRUint32 aLength)
 {
   if (mState.mIs2b && !mState.mIsBidi) {
-    const PRUnichar* cp = m2b;
-    const PRUnichar* end = cp + mState.mLength;
+    const PRUnichar* cp = aBuffer;
+    const PRUnichar* end = cp + aLength;
     while (cp < end) {
       PRUnichar ch1 = *cp++;
       PRUint32 utf32Char = ch1;
diff --git a/content/base/src/nsTextFragment.h b/content/base/src/nsTextFragment.h
index bbdd602c3961..4a5c27aca21e 100644
--- a/content/base/src/nsTextFragment.h
+++ b/content/base/src/nsTextFragment.h
@@ -112,7 +112,7 @@ public:
   /**
    * Return PR_TRUE if this fragment contains Bidi text
    * For performance reasons this flag is not set automatically, but
-   * requires an explicit call to SetBidiFlag()
+   * requires an explicit call to UpdateBidiFlag()
    */
   PRBool IsBidi() const
   {
@@ -209,7 +209,7 @@ public:
    * Scan the contents of the fragment and turn on mState.mIsBidi if it
    * includes any Bidi characters.
    */
-  void SetBidiFlag();
+  void UpdateBidiFlag(const PRUnichar* aBuffer, PRUint32 aLength);
 
   struct FragmentBits {
     // PRUint32 to ensure that the values are unsigned, because we

From 3a2d80139f8226afadd96224ca384158fc5122af Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 13 Aug 2010 18:58:24 -0400
Subject: [PATCH 044/222] Bug 240933 - Part 12: Avoid injecting textnodes as
 children of br nodes; r,a=roc

--HG--
extra : rebase_source : 8e6451d2e1414a61e15a9ffaf94470e02d2d0b72
---
 editor/libeditor/base/nsEditor.cpp      | 22 ++++++++++++++++++++++
 layout/generic/test/test_bug240933.html | 10 ++++++++++
 2 files changed, 32 insertions(+)

diff --git a/editor/libeditor/base/nsEditor.cpp b/editor/libeditor/base/nsEditor.cpp
index 2f7b4e258078..585dab4ada9b 100644
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -2332,6 +2332,28 @@ NS_IMETHODIMP nsEditor::InsertTextImpl(const nsAString& aStringToInsert,
         }
       }
     }
+    // Sometimes, aInOutNode is the mozBR element itself.  In that case, we'll
+    // adjust the insertion point to the previous text node, if one exists, or
+    // to the parent anonymous DIV.
+    if (nsTextEditUtils::IsMozBR(*aInOutNode) && *aInOutOffset == 0) {
+      nsCOMPtr<nsIDOMNode> previous;
+      (*aInOutNode)->GetPreviousSibling(getter_AddRefs(previous));
+      nodeAsText = do_QueryInterface(previous);
+      if (nodeAsText) {
+        PRUint32 length;
+        res = nodeAsText->GetLength(&length);
+        if (NS_SUCCEEDED(res)) {
+          *aInOutOffset = PRInt32(length);
+          *aInOutNode = previous;
+        }
+      } else {
+        nsCOMPtr<nsIDOMNode> parent;
+        (*aInOutNode)->GetParentNode(getter_AddRefs(parent));
+        if (parent == GetRoot()) {
+          *aInOutNode = parent;
+        }
+      }
+    }
   }
   PRInt32 offset = *aInOutOffset;
   if (mInIMEMode)
diff --git a/layout/generic/test/test_bug240933.html b/layout/generic/test/test_bug240933.html
index fa90106bafbe..620d1fb4924a 100644
--- a/layout/generic/test/test_bug240933.html
+++ b/layout/generic/test/test_bug240933.html
@@ -33,6 +33,12 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=240933
         synthesizeMouse(t, t.clientWidth / 2, 5, {}, window);
         is(t.selectionStart, 3, "The selection should be set before the newline");
         is(t.selectionEnd,   3, "The selection should be set before the newline");
+
+        t = document.getElementById("ta");
+        t.focus();
+        var val = t.value;
+        synthesizeKey("VK_ENTER", {});
+        is(t.value, val + "\n", "Pressing enter right after focusing the textarea should work");
         SimpleTest.finish();
       });
 
@@ -40,6 +46,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=240933
   </pre>
 
   <textarea id="t" rows="10" cols="10">abc
+</textarea>
+  <textarea id="ta" rows="10" cols="10">
+test
+
 </textarea>
 
 </body>

From bb655020399b6931ccaf83f3d80d4706fa455865 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 13 Aug 2010 18:58:26 -0400
Subject: [PATCH 045/222] Bug 240933 - Part 13: Consider text frame
 continuations containing only newlines editable; r,a=roc

--HG--
extra : rebase_source : b66535705ec25cd4dca7378424b78cc3bef94e46
---
 editor/libeditor/base/nsEditor.cpp      |  5 +++--
 layout/generic/nsIFrame.h               |  8 ++++++++
 layout/generic/nsTextFrame.h            |  2 ++
 layout/generic/nsTextFrameThebes.cpp    | 11 +++++++++++
 layout/generic/test/test_bug240933.html | 12 ++++++++++++
 5 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/editor/libeditor/base/nsEditor.cpp b/editor/libeditor/base/nsEditor.cpp
index 585dab4ada9b..39d9c693f425 100644
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -3624,8 +3624,9 @@ nsEditor::IsEditable(nsIDOMNode *aNode)
         // and uses enhanced logic to find out in the HTML world.
         return IsTextInDirtyFrameVisible(aNode);
       }
-      if (resultFrame->GetSize().width > 0) 
-        return PR_TRUE;  // text node has width
+      if (resultFrame->HasAnyNoncollapsedCharacters()) {
+        return PR_TRUE;
+      }
       resultFrame = resultFrame->GetNextContinuation();
     }
   }
diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
index 4ae237585904..98b92b1cb12a 100644
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -1635,6 +1635,14 @@ public:
                                    PRUint32 aSkippedMaxLength = PR_UINT32_MAX)
   { return NS_ERROR_NOT_IMPLEMENTED; }
 
+  /**
+   * Returns true if the frame contains any non-collapsed characters.
+   * This method is only available for text frames, and it will return false
+   * for all other frame types.
+   */
+  virtual PRBool HasAnyNoncollapsedCharacters()
+  { return PR_FALSE; }
+
   /**
    * Accessor functions to get/set the associated view object
    *
diff --git a/layout/generic/nsTextFrame.h b/layout/generic/nsTextFrame.h
index e2275096490b..acd26537791a 100644
--- a/layout/generic/nsTextFrame.h
+++ b/layout/generic/nsTextFrame.h
@@ -460,6 +460,8 @@ protected:
                    PRBool aForInsertionPoint);
 
   void ClearFrameOffsetCache();
+
+  virtual PRBool HasAnyNoncollapsedCharacters();
 };
 
 #endif
diff --git a/layout/generic/nsTextFrameThebes.cpp b/layout/generic/nsTextFrameThebes.cpp
index 4dc203f467a7..8dd3924c0d37 100644
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -7131,3 +7131,14 @@ nsTextFrame::IsAtEndOfLine() const
 {
   return (GetStateBits() & TEXT_END_OF_LINE) != 0;
 }
+
+PRBool
+nsTextFrame::HasAnyNoncollapsedCharacters()
+{
+  gfxSkipCharsIterator iter = EnsureTextRun();
+  PRInt32 offset = GetContentOffset(),
+          offsetEnd = GetContentEnd();
+  PRInt32 skippedOffset = iter.ConvertOriginalToSkipped(offset);
+  PRInt32 skippedOffsetEnd = iter.ConvertOriginalToSkipped(offsetEnd);
+  return skippedOffset != skippedOffsetEnd;
+}
diff --git a/layout/generic/test/test_bug240933.html b/layout/generic/test/test_bug240933.html
index 620d1fb4924a..e8d7ffde9d94 100644
--- a/layout/generic/test/test_bug240933.html
+++ b/layout/generic/test/test_bug240933.html
@@ -39,6 +39,17 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=240933
         var val = t.value;
         synthesizeKey("VK_ENTER", {});
         is(t.value, val + "\n", "Pressing enter right after focusing the textarea should work");
+
+        t = document.getElementById("tb");
+        t.focus();
+        synthesizeKey("VK_ENTER", {});
+        is(t.value, "\n", "Pressing enter for the first time should work");
+        synthesizeKey("VK_ENTER", {});
+        is(t.value, "\n\n", "Pressing enter for the second time should work");
+        synthesizeKey("VK_BACK_SPACE", {});
+        is(t.value, "\n", "Pressing backspace for the first time should work");
+        synthesizeKey("VK_BACK_SPACE", {});
+        is(t.value, "", "Pressing backspace for the second time should work");
         SimpleTest.finish();
       });
 
@@ -51,6 +62,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=240933
 test
 
 </textarea>
+  <textarea id="tb" rows="10" cols="10"></textarea>
 
 </body>
 </html>

From b63cc0ba47ac0ba10812aff62d306f2f398f6c27 Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Fri, 3 Sep 2010 23:21:26 -0400
Subject: [PATCH 046/222] Bug 593521 - Don't chain to
 nsBaseWidget::GetLayerManager, because it can do things we don't want (like
 use OpenGL). r=vlad a=blocking2.0:beta6+

---
 widget/src/windows/nsWindow.cpp | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index 12e2f6017aa5..3dcf07fe72e4 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -3162,20 +3162,6 @@ nsWindow::HasPendingInputEvent()
 mozilla::layers::LayerManager*
 nsWindow::GetLayerManager()
 {
-  nsWindow *topWindow = GetNSWindowPtr(GetTopLevelHWND(mWnd, PR_TRUE));
-
-  if (!topWindow) {
-    return nsBaseWidget::GetLayerManager();
-  }
-
-  /* We don't currently support using an accelerated layer manager with
-   * transparent windows so don't even try. I'm also not sure if we even
-   * want to support this case. See bug #593471 */
-  if (eTransparencyTransparent == mTransparencyMode) {
-    mUseAcceleratedRendering = PR_FALSE;
-    return nsBaseWidget::GetLayerManager();
-  }
-
 #ifndef WINCE
   if (!mLayerManager) {
     nsCOMPtr<nsIPrefBranch2> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
@@ -3196,6 +3182,12 @@ nsWindow::GetLayerManager()
     accelerateByDefault = accelerateByDefault ||
                           (acceleratedEnv && (*acceleratedEnv != '0'));
 
+    /* We don't currently support using an accelerated layer manager with
+     * transparent windows so don't even try. I'm also not sure if we even
+     * want to support this case. See bug #593471 */
+    disableAcceleration = disableAcceleration ||
+                          eTransparencyTransparent == mTransparencyMode;
+
     nsCOMPtr<nsIXULRuntime> xr = do_GetService("@mozilla.org/xre/runtime;1");
     PRBool safeMode = PR_FALSE;
     if (xr)
@@ -3224,10 +3216,14 @@ nsWindow::GetLayerManager()
         }
       }
     }
+
+    // Fall back to software if we couldn't use any hardware backends.
+    if (!mLayerManager)
+      mLayerManager = new BasicLayerManager(this);
   }
 #endif
 
-  return nsBaseWidget::GetLayerManager();
+  return mLayerManager;
 }
 
 /**************************************************************

From 881a4c21e1b9d780e6971d1a2ab9dafa94daa87e Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Fri, 3 Sep 2010 23:21:26 -0400
Subject: [PATCH 047/222] Bug 593530 - Don't leak the DeviceManagerD3D9 if
 initializing it fails. r=joe a=blocking2.0:beta6+

---
 gfx/layers/d3d9/DeviceManagerD3D9.cpp |  3 +++
 gfx/layers/d3d9/DeviceManagerD3D9.h   |  8 ++++++--
 gfx/layers/d3d9/LayerManagerD3D9.cpp  | 10 ++++++----
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/gfx/layers/d3d9/DeviceManagerD3D9.cpp b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
index 228fe9adcb86..f2618106e7b9 100644
--- a/gfx/layers/d3d9/DeviceManagerD3D9.cpp
+++ b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
@@ -189,6 +189,9 @@ DeviceManagerD3D9::~DeviceManagerD3D9()
   LayerManagerD3D9::OnDeviceManagerDestroy(this);
 }
 
+NS_IMPL_ADDREF(DeviceManagerD3D9)
+NS_IMPL_RELEASE(DeviceManagerD3D9)
+
 bool
 DeviceManagerD3D9::Init()
 {
diff --git a/gfx/layers/d3d9/DeviceManagerD3D9.h b/gfx/layers/d3d9/DeviceManagerD3D9.h
index 095a5c3423a0..05e412821329 100644
--- a/gfx/layers/d3d9/DeviceManagerD3D9.h
+++ b/gfx/layers/d3d9/DeviceManagerD3D9.h
@@ -106,9 +106,13 @@ class THEBES_API DeviceManagerD3D9
 {
 public:
   DeviceManagerD3D9();
+  NS_IMETHOD_(nsrefcnt) AddRef(void);
+  NS_IMETHOD_(nsrefcnt) Release(void);
+protected:
+  nsAutoRefCnt mRefCnt;
+  NS_DECL_OWNINGTHREAD
 
-  NS_INLINE_DECL_REFCOUNTING(DeviceManagerD3D9)
-
+public:
   bool Init();
 
   /**
diff --git a/gfx/layers/d3d9/LayerManagerD3D9.cpp b/gfx/layers/d3d9/LayerManagerD3D9.cpp
index 130c5ac57a35..9fa607a83d4a 100644
--- a/gfx/layers/d3d9/LayerManagerD3D9.cpp
+++ b/gfx/layers/d3d9/LayerManagerD3D9.cpp
@@ -65,8 +65,8 @@ LayerManagerD3D9::~LayerManagerD3D9()
    */
   mSwapChain = nsnull;
 
-  if (mDeviceManager) {
-    mDeviceManager->Release();
+  if (mDeviceManager && mDeviceManager->Release() == 0) {
+    mDeviceManager = nsnull;
   }
 }
 
@@ -79,15 +79,17 @@ LayerManagerD3D9::Initialize()
 
   if (!mDeviceManager) {
     mDeviceManager = new DeviceManagerD3D9;
+    mDeviceManager->AddRef();
 
     if (!mDeviceManager->Init()) {
+      mDeviceManager->Release();
       mDeviceManager = nsnull;
       return PR_FALSE;
     }
+  } else {
+    mDeviceManager->AddRef();
   }
 
-  mDeviceManager->AddRef();
-
   mSwapChain = mDeviceManager->
     CreateSwapChain((HWND)mWidget->GetNativeData(NS_NATIVE_WINDOW));
 

From 8ab02d729b167c5894240b05c944b4d30d9bd0be Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Fri, 27 Aug 2010 16:58:53 +1200
Subject: [PATCH 048/222] Bug 591155 - Temporarily disable certain failing
 reftests which are visually indistinguishable when running with accelerated
 layers. r=vlad a=blocking2.0:beta6+

---
 layout/reftests/bidi/reftest.list       | 4 ++--
 layout/reftests/box-shadow/reftest.list | 2 +-
 layout/reftests/bugs/reftest.list       | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/layout/reftests/bidi/reftest.list b/layout/reftests/bidi/reftest.list
index 0e483be389a8..9a0f69ec2a9e 100644
--- a/layout/reftests/bidi/reftest.list
+++ b/layout/reftests/bidi/reftest.list
@@ -9,8 +9,8 @@
 == bidi-005.html bidi-005-ref.html
 == bidi-006.html bidi-006-ref.html
 == bidi-006-j.html bidi-006-ref.html
-== visualmarquee.html marquee-ref.html
-== logicalmarquee.html marquee-ref.html
+random-if(layersGPUAccelerated) == visualmarquee.html marquee-ref.html
+random-if(layersGPUAccelerated) == logicalmarquee.html marquee-ref.html
 == visualmarquee.html logicalmarquee.html
 # test for glyph mirroring in right-to-left text
 == mirroring-01.html mirroring-01-ref.html
diff --git a/layout/reftests/box-shadow/reftest.list b/layout/reftests/box-shadow/reftest.list
index d8f0d53fed81..fc11c3a33e33 100644
--- a/layout/reftests/box-shadow/reftest.list
+++ b/layout/reftests/box-shadow/reftest.list
@@ -10,7 +10,7 @@
 == boxshadow-button.html boxshadow-button-ref.html
 == boxshadow-fileupload.html boxshadow-fileupload-ref.html
 == boxshadow-inner-basic.html boxshadow-inner-basic-ref.svg
-== boxshadow-mixed.html boxshadow-mixed-ref.html
+random-if(layersGPUAccelerated) == boxshadow-mixed.html boxshadow-mixed-ref.html
 random-if(d2d) == boxshadow-rounded-spread.html boxshadow-rounded-spread-ref.html
 HTTP(..) == boxshadow-dynamic.xul boxshadow-dynamic-ref.xul
 random-if(d2d) == boxshadow-onecorner.html boxshadow-onecorner-ref.html
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 19987537fe57..20bb75526415 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1467,7 +1467,7 @@ random-if(d2d) == 555388-1.html 555388-1-ref.html
 == 563584-10b.html 563584-10-ref.html
 == 563584-11.html 563584-11-ref.html
 == 564054-1.html 564054-1-ref.html
-== 564991-1.html 564991-1-ref.html
+random-if(layersGPUAccelerated) == 564991-1.html 564991-1-ref.html
 == 565819-1.html 565819-ref.html
 == 565819-2.html 565819-ref.html
 == 568441.html 568441-ref.html
@@ -1489,7 +1489,7 @@ random-if(d2d) == 555388-1.html 555388-1-ref.html
 == 579323-1.html 579323-1-ref.html
 == 579349-1.html 579349-1-ref.html
 == 580160-1.html 580160-1-ref.html
-== 581317-1.html 581317-1-ref.html
+random-if(layersGPUAccelerated) == 581317-1.html 581317-1-ref.html
 == 581579-1.html 581579-1-ref.html
 == 582037-1a.html 582037-1-ref.html
 == 582037-1b.html 582037-1-ref.html

From 074274faef6f37e5942c46166764e8b318a2bf3d Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 27 Aug 2010 01:36:09 -0400
Subject: [PATCH 049/222] Bug 590554 - maxlength in textarea does not prevent
 newline characters from being inserted; r,a=roc

--HG--
extra : rebase_source : bc351ffd6cd3a346b57808f338e4367e2c731947
---
 editor/libeditor/text/nsPlaintextEditor.cpp   |  8 +++-
 editor/libeditor/text/nsTextEditRules.cpp     | 36 +++++++++++++++---
 editor/libeditor/text/nsTextEditRules.h       |  6 ++-
 editor/libeditor/text/tests/Makefile.in       |  1 +
 .../libeditor/text/tests/test_bug590554.html  | 37 +++++++++++++++++++
 5 files changed, 80 insertions(+), 8 deletions(-)
 create mode 100644 editor/libeditor/text/tests/test_bug590554.html

diff --git a/editor/libeditor/text/nsPlaintextEditor.cpp b/editor/libeditor/text/nsPlaintextEditor.cpp
index dda0f07f55ac..7da8d30e54a8 100644
--- a/editor/libeditor/text/nsPlaintextEditor.cpp
+++ b/editor/libeditor/text/nsPlaintextEditor.cpp
@@ -623,7 +623,12 @@ nsPlaintextEditor::GetTextSelectionOffsets(nsISelection *aSelection,
       }
     }
 #ifdef NS_DEBUG
-    ++nodeCount;
+    // The post content iterator might return the parent node (which is the
+    // editor's root node) as the last item.  Don't count the root node itself
+    // as one of its children!
+    if (!SameCOMIdentity(currentNode, rootNode)) {
+      ++nodeCount;
+    }
 #endif
   }
 
@@ -862,6 +867,7 @@ NS_IMETHODIMP nsPlaintextEditor::InsertLineBreak()
   shell->MaybeInvalidateCaretPosition();
 
   nsTextRulesInfo ruleInfo(nsTextEditRules::kInsertBreak);
+  ruleInfo.maxLength = mMaxTextLength;
   PRBool cancel, handled;
   res = mRules->WillDoAction(selection, &ruleInfo, &cancel, &handled);
   NS_ENSURE_SUCCESS(res, res);
diff --git a/editor/libeditor/text/nsTextEditRules.cpp b/editor/libeditor/text/nsTextEditRules.cpp
index 26eb907d51ff..aea336ce7529 100644
--- a/editor/libeditor/text/nsTextEditRules.cpp
+++ b/editor/libeditor/text/nsTextEditRules.cpp
@@ -312,7 +312,7 @@ nsTextEditRules::WillDoAction(nsISelection *aSelection,
   switch (info->action)
   {
     case kInsertBreak:
-      return WillInsertBreak(aSelection, aCancel, aHandled);
+      return WillInsertBreak(aSelection, aCancel, aHandled, info->maxLength);
     case kInsertText:
     case kInsertTextIME:
       return WillInsertText(info->action,
@@ -424,7 +424,10 @@ nsTextEditRules::DidInsert(nsISelection *aSelection, nsresult aResult)
 }
 
 nsresult
-nsTextEditRules::WillInsertBreak(nsISelection *aSelection, PRBool *aCancel, PRBool *aHandled)
+nsTextEditRules::WillInsertBreak(nsISelection *aSelection,
+                                 PRBool *aCancel,
+                                 PRBool *aHandled,
+                                 PRInt32 aMaxLength)
 {
   if (!aSelection || !aCancel || !aHandled) { return NS_ERROR_NULL_POINTER; }
   CANCEL_OPERATION_IF_READONLY_OR_DISABLED
@@ -434,11 +437,24 @@ nsTextEditRules::WillInsertBreak(nsISelection *aSelection, PRBool *aCancel, PRBo
   }
   else 
   {
+    // handle docs with a max length
+    // NOTE, this function copies inString into outString for us.
+    NS_NAMED_LITERAL_STRING(inString, "\n");
+    nsAutoString outString;
+    PRBool didTruncate;
+    nsresult res = TruncateInsertionIfNeeded(aSelection, &inString, &outString,
+                                             aMaxLength, &didTruncate);
+    NS_ENSURE_SUCCESS(res, res);
+    if (didTruncate) {
+      *aCancel = PR_TRUE;
+      return NS_OK;
+    }
+
     *aCancel = PR_FALSE;
 
     // if the selection isn't collapsed, delete it.
     PRBool bCollapsed;
-    nsresult res = aSelection->GetIsCollapsed(&bCollapsed);
+    res = aSelection->GetIsCollapsed(&bCollapsed);
     NS_ENSURE_SUCCESS(res, res);
     if (!bCollapsed)
     {
@@ -642,7 +658,7 @@ nsTextEditRules::WillInsertText(PRInt32          aAction,
 
   // handle docs with a max length
   // NOTE, this function copies inString into outString for us.
-  nsresult res = TruncateInsertionIfNeeded(aSelection, inString, outString, aMaxLength);
+  nsresult res = TruncateInsertionIfNeeded(aSelection, inString, outString, aMaxLength, nsnull);
   NS_ENSURE_SUCCESS(res, res);
   
   PRUint32 start = 0;
@@ -1256,12 +1272,16 @@ nsresult
 nsTextEditRules::TruncateInsertionIfNeeded(nsISelection *aSelection, 
                                            const nsAString  *aInString,
                                            nsAString  *aOutString,
-                                           PRInt32          aMaxLength)
+                                           PRInt32          aMaxLength,
+                                           PRBool *aTruncated)
 {
   if (!aSelection || !aInString || !aOutString) {return NS_ERROR_NULL_POINTER;}
   
   nsresult res = NS_OK;
   *aOutString = *aInString;
+  if (aTruncated) {
+    *aTruncated = PR_FALSE;
+  }
   
   if ((-1 != aMaxLength) && IsPlaintextEditor() && !mEditor->IsIMEComposing() )
   {
@@ -1294,6 +1314,9 @@ nsTextEditRules::TruncateInsertionIfNeeded(nsISelection *aSelection,
     if (resultingDocLength >= aMaxLength)
     {
       aOutString->Truncate();
+      if (aTruncated) {
+        *aTruncated = PR_TRUE;
+      }
     }
     else
     {
@@ -1301,6 +1324,9 @@ nsTextEditRules::TruncateInsertionIfNeeded(nsISelection *aSelection,
       if (inCount + resultingDocLength > aMaxLength)
       {
         aOutString->Truncate(aMaxLength - resultingDocLength);
+        if (aTruncated) {
+          *aTruncated = PR_TRUE;
+        }
       }
     }
   }
diff --git a/editor/libeditor/text/nsTextEditRules.h b/editor/libeditor/text/nsTextEditRules.h
index 48d1b3fe882e..bd74bb44b624 100644
--- a/editor/libeditor/text/nsTextEditRules.h
+++ b/editor/libeditor/text/nsTextEditRules.h
@@ -160,7 +160,8 @@ protected:
   nsresult DidInsertText(nsISelection *aSelection, nsresult aResult);
   nsresult GetTopEnclosingPre(nsIDOMNode *aNode, nsIDOMNode** aOutPreNode);
 
-  nsresult WillInsertBreak(nsISelection *aSelection, PRBool *aCancel, PRBool *aHandled);
+  nsresult WillInsertBreak(nsISelection *aSelection, PRBool *aCancel,
+                           PRBool *aHandled, PRInt32 aMaxLength);
   nsresult DidInsertBreak(nsISelection *aSelection, nsresult aResult);
 
   nsresult WillInsert(nsISelection *aSelection, PRBool *aCancel);
@@ -218,7 +219,8 @@ protected:
   nsresult TruncateInsertionIfNeeded(nsISelection             *aSelection, 
                                      const nsAString          *aInString,
                                      nsAString                *aOutString,
-                                     PRInt32                   aMaxLength);
+                                     PRInt32                   aMaxLength,
+                                     PRBool                   *aTruncated);
 
   /** Remove IME composition text from password buffer */
   nsresult RemoveIMETextFromPWBuf(PRUint32 &aStart, nsAString *aIMEString);
diff --git a/editor/libeditor/text/tests/Makefile.in b/editor/libeditor/text/tests/Makefile.in
index 98aa6f079400..ad7125d51628 100644
--- a/editor/libeditor/text/tests/Makefile.in
+++ b/editor/libeditor/text/tests/Makefile.in
@@ -47,6 +47,7 @@ include $(topsrcdir)/config/rules.mk
 _TEST_FILES = \
 		test_bug471722.html \
 		test_bug569988.html \
+		test_bug590554.html \
 		$(NULL)
 
 # disables the key handling test on gtk2 because gtk2 overrides some key events
diff --git a/editor/libeditor/text/tests/test_bug590554.html b/editor/libeditor/text/tests/test_bug590554.html
new file mode 100644
index 000000000000..9fdff7480de5
--- /dev/null
+++ b/editor/libeditor/text/tests/test_bug590554.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=590554
+-->
+
+<head>
+  <title>Test for Bug 590554</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>  
+</head>
+
+<body>
+
+  <script type="application/javascript">
+
+    /** Test for Bug 590554 **/
+
+    SimpleTest.waitForExplicitFinish();
+
+    SimpleTest.waitForFocus(function() {
+      var t = document.querySelector("textarea");
+      t.focus();
+      synthesizeKey("VK_ENTER", {});
+      is(t.value, "\n", "Pressing enter should work the first time");
+      synthesizeKey("VK_ENTER", {});
+      is(t.value, "\n", "Pressing enter should not work the second time");
+      SimpleTest.finish();
+    });
+
+  </script>
+
+  <textarea maxlength="1"></textarea>
+</body>
+</html>

From 09f276ccbb9c13feb1a4a887fe5354a9e3475cf7 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 27 Aug 2010 15:03:09 -0400
Subject: [PATCH 050/222] Bug 591378 - REFTEST TEST-UNEXPECTED-PASS |
 file:///home/cltbld/talos-slave/mozilla-central_fedora-debug_test-crashtest/build/reftest/tests/editor/libeditor/html/crashtests/448329-3.html
 | assertion count 8 is less than expected 16 assertions; r=roc a=NPOTB

--HG--
extra : rebase_source : 486646660fa6970a7371a149eec08f5bbaaa569e
---
 editor/libeditor/html/crashtests/crashtests.list | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/editor/libeditor/html/crashtests/crashtests.list b/editor/libeditor/html/crashtests/crashtests.list
index 79bbac00da33..5799dd134198 100644
--- a/editor/libeditor/html/crashtests/crashtests.list
+++ b/editor/libeditor/html/crashtests/crashtests.list
@@ -8,7 +8,7 @@ load 428489-1.html
 load 431086-1.xhtml
 load 448329-1.html
 load 448329-2.html
-asserts(16-20) load 448329-3.html
+asserts(8-20) load 448329-3.html
 load 456727-1.html
 load 456727-2.html
 asserts(1) load 467647-1.html # bug 382210

From a61b24c639cdedcddec8b1185658810b20b90e2f Mon Sep 17 00:00:00 2001
From: Simon Montagu <smontagu@smontagu.org>
Date: Thu, 2 Sep 2010 14:20:56 -0400
Subject: [PATCH 051/222] Use member boolean instead of Window style to
 identify right-to-left windows. Bug 588735; r=jmathies a=blocking2.0:betaN+

--HG--
extra : rebase_source : f5c09abea4775e41c1bccb431ab620b46e25da32
---
 widget/src/windows/nsWindow.cpp | 5 +----
 widget/src/windows/nsWindow.h   | 5 +++--
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index 85c775725c7b..d59cb8c3cd14 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -553,14 +553,11 @@ nsWindow::Create(nsIWidget *aParent,
 
   mPopupType = aInitData->mPopupHint;
   mContentType = aInitData->mContentType;
+  mIsRTL = aInitData->mRTL;
 
   DWORD style = WindowStyle();
   DWORD extendedStyle = WindowExStyle();
 
-  if (aInitData->mRTL) {
-    extendedStyle |= WS_EX_LAYOUTRTL | WS_EX_NOINHERITLAYOUT;
-  }
-
   if (mWindowType == eWindowType_popup) {
     if (!aParent)
       parent = NULL;
diff --git a/widget/src/windows/nsWindow.h b/widget/src/windows/nsWindow.h
index 2d7f9919934b..b599a6e0413e 100644
--- a/widget/src/windows/nsWindow.h
+++ b/widget/src/windows/nsWindow.h
@@ -473,6 +473,9 @@ protected:
   PRPackedBool          mPainting;
   PRPackedBool          mExitToNonClientArea;
   PRPackedBool          mTouchWindow;
+  PRPackedBool          mDisplayPanFeedback;
+  PRPackedBool          mHideChrome;
+  PRPackedBool          mIsRTL;
   PRUint32              mBlurSuppressLevel;
   nsContentType         mContentType;
   DWORD_PTR             mOldStyle;
@@ -482,8 +485,6 @@ protected:
   nsNativeDragTarget*   mNativeDragTarget;
   HKL                   mLastKeyboardLayout;
   nsPopupType           mPopupType;
-  PRPackedBool          mDisplayPanFeedback;
-  PRPackedBool          mHideChrome;
   nsSizeMode            mOldSizeMode;
   WindowHook            mWindowHook;
   static PRUint32       sInstanceCount;

From a62b4f26138dd58368a3fb9fbe0a7ed7222f3536 Mon Sep 17 00:00:00 2001
From: Raymond Lee <raymond@raysquare.com>
Date: Tue, 31 Aug 2010 15:22:10 +0800
Subject: [PATCH 052/222] Bug 591448 - On tab switch, 'gWindow is not defined'
 after closing a window that opened Panorama [r=dao a=gavin]

--HG--
extra : rebase_source : d9d049b80efac0297dd40a58e5c733cbecaf3ef3
---
 browser/base/content/tabview/ui.js | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/browser/base/content/tabview/ui.js b/browser/base/content/tabview/ui.js
index bcc86761704a..bd9e63e403d0 100644
--- a/browser/base/content/tabview/ui.js
+++ b/browser/base/content/tabview/ui.js
@@ -81,6 +81,10 @@ var UIManager = {
   // Used to facilitate zooming down from a previous tab.
   _currentTab : null,
 
+  // Variable: _eventListeners
+  // Keeps track of event listeners added to the AllTabs object.
+  _eventListeners: {},
+
   // ----------
   // Function: init
   // Must be called after the object is created.
@@ -238,6 +242,7 @@ var UIManager = {
     GroupItems.uninit();
     Storage.uninit();
 
+    this._removeTabActionHandlers();
     this._currentTab = null;
     this._pageBounds = null;
     this._reorderTabItemsOnShow = null;
@@ -407,7 +412,7 @@ var UIManager = {
   _addTabActionHandlers: function() {
     var self = this;
 
-    AllTabs.register("close", function(tab) {
+    this._eventListeners.close = function(tab) {
       if (tab.ownerDocument.defaultView != gWindow)
         return;
 
@@ -438,23 +443,34 @@ var UIManager = {
           }
         }
       }
-    });
+    };
 
-    AllTabs.register("move", function(tab) {
+    this._eventListeners.move = function(tab) {
       if (tab.ownerDocument.defaultView != gWindow)
         return;
 
       let activeGroupItem = GroupItems.getActiveGroupItem();
       if (activeGroupItem)
         self.setReorderTabItemsOnShow(activeGroupItem);
-    });
+    };
 
-    AllTabs.register("select", function(tab) {
+    this._eventListeners.select = function(tab) {
       if (tab.ownerDocument.defaultView != gWindow)
         return;
 
       self.onTabSelect(tab);
-    });
+    };
+
+    for (let name in this._eventListeners)
+      AllTabs.register(name, this._eventListeners[name]);
+  },
+
+  // ----------
+  // Function: _removeTabActionHandlers
+  // Removes handlers to handle tab actions.
+  _removeTabActionHandlers: function() {
+    for (let name in this._eventListeners)
+      AllTabs.unregister(name, this._eventListeners[name]);
   },
 
   // ----------

From 8ae2d337285d6d8ce1663d590fa1fef92d302822 Mon Sep 17 00:00:00 2001
From: Bas Schouten <bas.schouten@live.nl>
Date: Thu, 2 Sep 2010 15:07:26 -0400
Subject: [PATCH 053/222] Bug 592024 - Don't clear shared D3D9/D2D surfaces in
 cairo_d2d_create_for_handle because D3D9 and D2D need a lot of
 synchronization points. Instead, put a clear in DrawRegion, which already has
 synchronization points. r=jrmuizel a=blocking

---
 gfx/cairo/cairo/src/cairo-d2d-surface.cpp | 2 --
 gfx/layers/d3d9/ThebesLayerD3D9.cpp       | 8 +++++++-
 gfx/layers/d3d9/ThebesLayerD3D9.h         | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/gfx/cairo/cairo/src/cairo-d2d-surface.cpp b/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
index 7019cbbbd234..995a3a63aa31 100644
--- a/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
+++ b/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
@@ -3628,8 +3628,6 @@ cairo_d2d_surface_create_for_handle(cairo_device_t *device, HANDLE handle, cairo
 
     newSurf->rt->CreateSolidColorBrush(D2D1::ColorF(0, 1.0), &newSurf->solidColorBrush);
 
-    _d2d_clear_surface(newSurf);
-
     newSurf->device = d2d_device;
     cairo_addref_device(device);
 
diff --git a/gfx/layers/d3d9/ThebesLayerD3D9.cpp b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
index 2c567b987577..438e73f0eea3 100644
--- a/gfx/layers/d3d9/ThebesLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
@@ -70,6 +70,7 @@ UseOpaqueSurface(Layer* aLayer)
 ThebesLayerD3D9::ThebesLayerD3D9(LayerManagerD3D9 *aManager)
   : ThebesLayer(aManager, NULL)
   , LayerD3D9(aManager)
+  , mD2DSurfaceInitialized(false)
 {
   mImplData = static_cast<LayerD3D9*>(this);
   aManager->deviceManager()->mThebesLayers.AppendElement(this);
@@ -289,6 +290,7 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
   if (mD2DSurface) {
     context = new gfxContext(mD2DSurface);
     nsIntRegionRectIterator iter(aRegion);
+
     context->Translate(gfxPoint(-visibleRect.x, -visibleRect.y));
     context->NewPath();
     const nsIntRect *iterRect;
@@ -296,11 +298,14 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
       context->Rectangle(gfxRect(iterRect->x, iterRect->y, iterRect->width, iterRect->height));      
     }
     context->Clip();
-    if (mD2DSurface->GetContentType() != gfxASurface::CONTENT_COLOR) {
+    if (!mD2DSurfaceInitialized || 
+        mD2DSurface->GetContentType() != gfxASurface::CONTENT_COLOR) {
       context->SetOperator(gfxContext::OPERATOR_CLEAR);
       context->Paint();
       context->SetOperator(gfxContext::OPERATOR_OVER);
+      mD2DSurfaceInitialized = true;
     }
+
     LayerManagerD3D9::CallbackInfo cbInfo = mD3DManager->GetCallbackInfo();
     cbInfo.Callback(this, context, aRegion, nsIntRegion(), cbInfo.CallbackData);
     mD2DSurface->Flush();
@@ -423,6 +428,7 @@ ThebesLayerD3D9::CreateNewTexture(const gfxIntSize &aSize)
                                   D3DUSAGE_RENDERTARGET, D3DFMT_A8R8G8B8,
                                   D3DPOOL_DEFAULT, getter_AddRefs(mTexture), &sharedHandle);
 
+          mD2DSurfaceInitialized = false;
           mD2DSurface = new gfxD2DSurface(sharedHandle, UseOpaqueSurface(this) ?
             gfxASurface::CONTENT_COLOR : gfxASurface::CONTENT_COLOR_ALPHA);
 
diff --git a/gfx/layers/d3d9/ThebesLayerD3D9.h b/gfx/layers/d3d9/ThebesLayerD3D9.h
index d51a9a86d4c5..d4e9ee608776 100644
--- a/gfx/layers/d3d9/ThebesLayerD3D9.h
+++ b/gfx/layers/d3d9/ThebesLayerD3D9.h
@@ -73,6 +73,8 @@ private:
   /* This contains the D2D surface if we have one */
   nsRefPtr<gfxASurface> mD2DSurface;
 
+  bool mD2DSurfaceInitialized;
+
   /* Have a region of our layer drawn */
   void DrawRegion(const nsIntRegion &aRegion);
 

From 23c6f17b467351467a7feecbc0fb910003e8455b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Thu, 2 Sep 2010 22:08:05 +0200
Subject: [PATCH 054/222] Bug 320638 - Allow dropping links in-between tabs.
 r=gavin

---
 browser/base/content/tabbrowser.xml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 3bf80c045702..b8857daea70b 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -2773,7 +2773,16 @@
       <method name="_getDragTargetTab">
         <parameter name="event"/>
         <body><![CDATA[
-          return event.target.localName == "tab" ? event.target : null;
+          let tab = event.target.localName == "tab" ? event.target : null;
+          if (tab &&
+              (event.type == "drop" || event.type == "dragover") &&
+              event.dataTransfer.dropEffect == "link") {
+            let boxObject = tab.boxObject;
+            if (event.screenX < boxObject.screenX + boxObject.width * .25 ||
+                event.screenX > boxObject.screenX + boxObject.width * .75)
+              return null;
+          }
+          return tab;
         ]]></body>
       </method>
 
@@ -3022,6 +3031,7 @@
               this._dragTime = Date.now();
             if (Date.now() >= this._dragTime + this._dragOverDelay)
               this.selectedItem = tab;
+            ind.collapsed = true;
             return;
           }
         }

From f38944642b9e453581291cacb79cf205b9f39379 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Thu, 2 Sep 2010 22:08:37 +0200
Subject: [PATCH 055/222] Bug 577096 - App Tabs should indicate change of state
 in <title>. r=gavin ui-r=beltzner

---
 browser/base/content/tabbrowser.xml            | 4 ++++
 browser/themes/gnomestripe/browser/browser.css | 4 ++++
 browser/themes/pinstripe/browser/browser.css   | 4 ++++
 browser/themes/winstripe/browser/browser.css   | 4 ++++
 4 files changed, 16 insertions(+)

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index b8857daea70b..664f8b800e87 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -808,6 +808,8 @@
               this._fastFind.setDocShell(this.mCurrentBrowser.docShell);
 
               this.updateTitlebar();
+
+              this.mCurrentTab.removeAttribute("titlechanged");
             }
 
             // If the new tab is busy, and our current state is not busy, then
@@ -2449,6 +2451,8 @@
           this.setTabTitle(tab);
           if (tab == this.mCurrentTab)
             this.updateTitlebar();
+          else if (!tab.hasAttribute("busy"))
+            tab.setAttribute("titlechanged", "true");
         ]]>
       </handler>
     </handlers>
diff --git a/browser/themes/gnomestripe/browser/browser.css b/browser/themes/gnomestripe/browser/browser.css
index b3741dccdc68..b446647f8d07 100644
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@@ -1230,6 +1230,10 @@ statusbarpanel#statusbar-display {
   -moz-margin-start: 0;
 }
 
+.tabbrowser-tab[pinned][titlechanged]:not([selected="true"]) {
+  -moz-box-shadow: 0 0 0 1em rgba(255,0,0,.5) inset;
+}
+
 .tab-icon-image {
   width: 16px;
   height: 16px;
diff --git a/browser/themes/pinstripe/browser/browser.css b/browser/themes/pinstripe/browser/browser.css
index 74311da3148c..ea4728f75949 100644
--- a/browser/themes/pinstripe/browser/browser.css
+++ b/browser/themes/pinstripe/browser/browser.css
@@ -1484,6 +1484,10 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
   background-color: -moz-mac-chrome-inactive;
 }
 
+.tabbrowser-tab[pinned][titlechanged]:not([selected="true"]) {
+  background-color: rgba(255,0,0,.5) !important;
+}
+
 #tabbrowser-tabs[tabsontop="true"] > .tabbrowser-tab[selected="true"] {
   -moz-border-top-colors: rgba(0,0,0,.04) rgba(0,0,0,.17) rgba(255,255,255,.9);
   -moz-border-right-colors: rgba(0,0,0,.04) rgba(0,0,0,.17) rgba(255,255,255,.6);
diff --git a/browser/themes/winstripe/browser/browser.css b/browser/themes/winstripe/browser/browser.css
index 0f2eec437cd1..d6b2dc6dbec2 100644
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@@ -1367,6 +1367,10 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
   background-image: -moz-linear-gradient(hsla(0,0%,80%,.5), hsla(0,0%,60%,.5) 50%);
 }
 
+.tabbrowser-tab[pinned][titlechanged]:not([selected="true"]) {
+  background-image: -moz-linear-gradient(rgba(255,0,0,.5), rgba(255,0,0,.5)) !important;
+}
+
 .tabbrowser-tab[busy] > .tab-icon-image {
   list-style-image: url("chrome://browser/skin/tabbrowser/progress.png") !important;
   -moz-image-region: rect(0, 16px, 16px, 0);

From f2ee8e16afdcebeb711ebd2f394678e23a6a05c9 Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Thu, 2 Sep 2010 22:12:47 +0200
Subject: [PATCH 056/222] Bug 589871 - Fix GetValidationmessage warnings;
 r=Olli.Pettay approval2.0=jst

---
 content/html/content/src/nsHTMLButtonElement.cpp   | 2 ++
 content/html/content/src/nsHTMLFieldSetElement.cpp | 2 ++
 content/html/content/src/nsHTMLInputElement.h      | 2 ++
 content/html/content/src/nsHTMLOutputElement.cpp   | 2 ++
 content/html/content/src/nsHTMLSelectElement.h     | 2 ++
 content/html/content/src/nsHTMLTextAreaElement.cpp | 2 ++
 6 files changed, 12 insertions(+)

diff --git a/content/html/content/src/nsHTMLButtonElement.cpp b/content/html/content/src/nsHTMLButtonElement.cpp
index b9197a28473e..24a13050c6d2 100644
--- a/content/html/content/src/nsHTMLButtonElement.cpp
+++ b/content/html/content/src/nsHTMLButtonElement.cpp
@@ -82,6 +82,8 @@ class nsHTMLButtonElement : public nsGenericHTMLFormElement,
                             public nsIConstraintValidation
 {
 public:
+  using nsIConstraintValidation::GetValidationMessage;
+
   nsHTMLButtonElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~nsHTMLButtonElement();
 
diff --git a/content/html/content/src/nsHTMLFieldSetElement.cpp b/content/html/content/src/nsHTMLFieldSetElement.cpp
index e1faf73e9cbd..3b58d98838f1 100644
--- a/content/html/content/src/nsHTMLFieldSetElement.cpp
+++ b/content/html/content/src/nsHTMLFieldSetElement.cpp
@@ -49,6 +49,8 @@ class nsHTMLFieldSetElement : public nsGenericHTMLFormElement,
                               public nsIConstraintValidation
 {
 public:
+  using nsIConstraintValidation::GetValidationMessage;
+
   nsHTMLFieldSetElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~nsHTMLFieldSetElement();
 
diff --git a/content/html/content/src/nsHTMLInputElement.h b/content/html/content/src/nsHTMLInputElement.h
index fef4b1d394b9..4161a7b55243 100644
--- a/content/html/content/src/nsHTMLInputElement.h
+++ b/content/html/content/src/nsHTMLInputElement.h
@@ -118,6 +118,8 @@ class nsHTMLInputElement : public nsGenericHTMLFormElement,
                            public nsIConstraintValidation
 {
 public:
+  using nsIConstraintValidation::GetValidationMessage;
+
   nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                      PRUint32 aFromParser);
   virtual ~nsHTMLInputElement();
diff --git a/content/html/content/src/nsHTMLOutputElement.cpp b/content/html/content/src/nsHTMLOutputElement.cpp
index 091b7466dab3..c65eddcde5fb 100644
--- a/content/html/content/src/nsHTMLOutputElement.cpp
+++ b/content/html/content/src/nsHTMLOutputElement.cpp
@@ -49,6 +49,8 @@ class nsHTMLOutputElement : public nsGenericHTMLFormElement,
                             public nsIConstraintValidation
 {
 public:
+  using nsIConstraintValidation::GetValidationMessage;
+
   nsHTMLOutputElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~nsHTMLOutputElement();
 
diff --git a/content/html/content/src/nsHTMLSelectElement.h b/content/html/content/src/nsHTMLSelectElement.h
index 492212d29527..ed2619ef589a 100644
--- a/content/html/content/src/nsHTMLSelectElement.h
+++ b/content/html/content/src/nsHTMLSelectElement.h
@@ -241,6 +241,8 @@ class nsHTMLSelectElement : public nsGenericHTMLFormElement,
                             public nsIConstraintValidation
 {
 public:
+  using nsIConstraintValidation::GetValidationMessage;
+
   nsHTMLSelectElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                       PRUint32 aFromParser = 0);
   virtual ~nsHTMLSelectElement();
diff --git a/content/html/content/src/nsHTMLTextAreaElement.cpp b/content/html/content/src/nsHTMLTextAreaElement.cpp
index e70a25274687..9c95e3189231 100644
--- a/content/html/content/src/nsHTMLTextAreaElement.cpp
+++ b/content/html/content/src/nsHTMLTextAreaElement.cpp
@@ -94,6 +94,8 @@ class nsHTMLTextAreaElement : public nsGenericHTMLFormElement,
                               public nsIConstraintValidation
 {
 public:
+  using nsIConstraintValidation::GetValidationMessage;
+
   nsHTMLTextAreaElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                         PRUint32 aFromParser = 0);
 

From 30726f670e27c82534587feac0d72ad74f093ccb Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Thu, 2 Sep 2010 22:18:04 +0200
Subject: [PATCH 057/222] Bug 590970 - Don't compare PL_strcasecmp's return
 value to nsnull; r=joshmoz approval2.0=jst

---
 modules/plugin/base/src/nsPluginHost.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/plugin/base/src/nsPluginHost.cpp b/modules/plugin/base/src/nsPluginHost.cpp
index 06321cb66dec..c755a5bccf56 100644
--- a/modules/plugin/base/src/nsPluginHost.cpp
+++ b/modules/plugin/base/src/nsPluginHost.cpp
@@ -1822,13 +1822,13 @@ static PRBool isUnwantedPlugin(nsPluginTag * tag)
     return PR_TRUE;
 
   for (PRInt32 i = 0; i < tag->mVariants; ++i) {
-    if (nsnull == PL_strcasecmp(tag->mMimeTypeArray[i], "application/pdf"))
+    if (!PL_strcasecmp(tag->mMimeTypeArray[i], "application/pdf"))
       return PR_FALSE;
 
-    if (nsnull == PL_strcasecmp(tag->mMimeTypeArray[i], "application/x-shockwave-flash"))
+    if (!PL_strcasecmp(tag->mMimeTypeArray[i], "application/x-shockwave-flash"))
       return PR_FALSE;
 
-    if (nsnull == PL_strcasecmp(tag->mMimeTypeArray[i],"application/x-director"))
+    if (!PL_strcasecmp(tag->mMimeTypeArray[i], "application/x-director"))
       return PR_FALSE;
   }
 

From 1c0c4eb2089610b1c1e3b710cfb9abbe417d2134 Mon Sep 17 00:00:00 2001
From: Margaret Leibovic <margaret.leibovic@gmail.com>
Date: Mon, 30 Aug 2010 12:55:17 -0400
Subject: [PATCH 058/222] Bug 573536: add 'Learn more' link to geolocation
 notifications, r=gavin, a=blocking

---
 browser/base/content/browser.css              |  4 +++
 browser/base/content/urlbarBindings.xml       | 33 +++++++++++++++++++
 .../themes/gnomestripe/browser/browser.css    |  5 +++
 browser/themes/pinstripe/browser/browser.css  |  9 ++---
 browser/themes/winstripe/browser/browser.css  |  4 +++
 5 files changed, 51 insertions(+), 4 deletions(-)

diff --git a/browser/base/content/browser.css b/browser/base/content/browser.css
index e675b6985a9e..3331daf75dca 100644
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -348,3 +348,7 @@ window[chromehidden~="toolbar"] toolbar:not(.toolbar-primary):not(.chromeclass-m
 #notification-popup-box[anchorid="addons-notification-icon"] > #addons-notification-icon {
   display: -moz-box;
 }
+
+#geolocation-notification {
+  -moz-binding: url("chrome://browser/content/urlbarBindings.xml#geolocation-notification");
+}
diff --git a/browser/base/content/urlbarBindings.xml b/browser/base/content/urlbarBindings.xml
index f32c96fd1066..cd7726aee8db 100644
--- a/browser/base/content/urlbarBindings.xml
+++ b/browser/base/content/urlbarBindings.xml
@@ -688,4 +688,37 @@
 
     </implementation>
   </binding>
+
+  <binding id="geolocation-notification" extends="chrome://global/content/bindings/notification.xml#popup-notification">
+    <content>
+      <xul:image class="popup-notification-icon"
+                 xbl:inherits="popupid"/>
+      <xul:vbox>
+        <xul:description class="popup-notification-description"
+                         xbl:inherits="value=label"/>
+        <xul:spacer flex="1"/>
+        <xul:hbox pack="end">
+          <xul:label anonid="learnmore" class="text-link geolocation-text-link"/>
+          <xul:spacer flex="1"/>
+          <xul:button anonid="button"
+                      class="popup-notification-menubutton"
+                      xbl:inherits="oncommand=buttoncommand,label=buttonlabel,accesskey=buttonaccesskey,type=buttontype">
+            <xul:menupopup anonid="menupopup"
+                           xbl:inherits="oncommand=menucommand">
+              <children/>
+            </xul:menupopup>
+          </xul:button>
+        </xul:hbox>
+      </xul:vbox>
+    </content>
+    <implementation>  
+      <constructor><![CDATA[
+        let link = document.getAnonymousElementByAttribute(this, "anonid", "learnmore");
+        link.value = gNavigatorBundle.getString("geolocation.learnMore");
+        
+        let formatter = Cc["@mozilla.org/toolkit/URLFormatterService;1"].getService(Ci.nsIURLFormatter);
+        link.href = formatter.formatURLPref("browser.geolocation.warning.infoURL");
+      ]]></constructor>
+    </implementation>
+  </binding>
 </bindings>
diff --git a/browser/themes/gnomestripe/browser/browser.css b/browser/themes/gnomestripe/browser/browser.css
index b446647f8d07..f6a882867aa6 100644
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@@ -1027,6 +1027,11 @@ toolbar[iconsize="small"] #fullscreen-button {
   list-style-image: url(chrome://browser/skin/Geolocation-16.png);
 }
 
+.geolocation-text-link {
+  -moz-padding-start: 13px;
+  padding-top: 10px;
+}
+
 #addons-notification-icon {
   list-style-image: url(chrome://mozapps/skin/extensions/extensionGeneric-16.png);
 }
diff --git a/browser/themes/pinstripe/browser/browser.css b/browser/themes/pinstripe/browser/browser.css
index ea4728f75949..53fad9b08b13 100644
--- a/browser/themes/pinstripe/browser/browser.css
+++ b/browser/themes/pinstripe/browser/browser.css
@@ -1859,6 +1859,7 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
 }
 
 #notification-popup {
+  color: #fff;
   margin-top: -1px;
   margin-left: -27px;
 }
@@ -1882,12 +1883,12 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
   list-style-image: url(chrome://browser/skin/Geolocation-16.png);
 }
 
-#addons-notification-icon {
-  list-style-image: url(chrome://mozapps/skin/extensions/extensionGeneric-16.png);
+.geolocation-text-link {
+  color: #fff;
 }
 
-.popup-notification-description {
-  color: #fff;
+#addons-notification-icon {
+  list-style-image: url(chrome://mozapps/skin/extensions/extensionGeneric-16.png);
 }
 
 .popup-notification-icon {
diff --git a/browser/themes/winstripe/browser/browser.css b/browser/themes/winstripe/browser/browser.css
index d6b2dc6dbec2..4d73b61dd605 100644
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@@ -1807,6 +1807,10 @@ toolbarbutton.bookmark-item[dragover="true"][open="true"] {
   list-style-image: url(chrome://browser/skin/Geolocation-64.png);
 }
 
+.geolocation-text-link {
+  padding-top: 5px;
+}
+
 .popup-notification-icon[popupid="xpinstall-disabled"],
 .popup-notification-icon[popupid="addon-install-blocked"],
 .popup-notification-icon[popupid="addon-install-failed"],

From 6b504676d77f32ba8cca2d1eac9d757684edd17c Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Mon, 30 Aug 2010 16:38:43 -0400
Subject: [PATCH 059/222] Bug 590554 - Part 2: Disable the end offset assertion
 for password fields; r=roc

--HG--
extra : rebase_source : 0e3dce695eafc269f1efdacd57d56d5383be6bd9
---
 editor/libeditor/text/nsPlaintextEditor.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/editor/libeditor/text/nsPlaintextEditor.cpp b/editor/libeditor/text/nsPlaintextEditor.cpp
index 7da8d30e54a8..0e30aa6e3dcc 100644
--- a/editor/libeditor/text/nsPlaintextEditor.cpp
+++ b/editor/libeditor/text/nsPlaintextEditor.cpp
@@ -634,7 +634,8 @@ nsPlaintextEditor::GetTextSelectionOffsets(nsISelection *aSelection,
 
   if (endOffset == -1) {
     NS_ASSERTION(endNode == rootNode, "failed to find the end node");
-    NS_ASSERTION(endNodeOffset == nodeCount-1 || endNodeOffset == 0,
+    NS_ASSERTION(IsPasswordEditor() ||
+                 (endNodeOffset == nodeCount-1 || endNodeOffset == 0),
                  "invalid end node offset");
     endOffset = endNodeOffset == 0 ? 0 : totalLength;
   }

From c58333e9faa6240d561ffa29d449677f9f36ce30 Mon Sep 17 00:00:00 2001
From: Wan-Teh Chang <wtc@google.com>
Date: Thu, 2 Sep 2010 13:40:19 -0700
Subject: [PATCH 060/222] Bug 580679: remove preference
 security.ssl.enable_compression because the change to build NSS with
 NSS_ENABLE_ZLIB=1 was reverted.  Will try again after mozilla 2.0.  review+
 and approval2.0+ by bsmedberg.

---
 netwerk/base/public/security-prefs.js       | 1 -
 security/manager/ssl/src/nsNSSComponent.cpp | 6 ------
 2 files changed, 7 deletions(-)

diff --git a/netwerk/base/public/security-prefs.js b/netwerk/base/public/security-prefs.js
index 191014d1ff6c..e781ffc53275 100644
--- a/netwerk/base/public/security-prefs.js
+++ b/netwerk/base/public/security-prefs.js
@@ -8,7 +8,6 @@ pref("security.ssl.renego_unrestricted_hosts", "");
 pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
 pref("security.ssl.require_safe_negotiation",  false);
 pref("security.ssl.warn_missing_rfc5746",  1);
-pref("security.ssl.enable_compression", false);
 pref("security.ssl.enable_false_start", true);
 
 pref("security.ssl2.rc4_128", false);
diff --git a/security/manager/ssl/src/nsNSSComponent.cpp b/security/manager/ssl/src/nsNSSComponent.cpp
index 3b216fa71ec3..0bd17002faef 100644
--- a/security/manager/ssl/src/nsNSSComponent.cpp
+++ b/security/manager/ssl/src/nsNSSComponent.cpp
@@ -1719,8 +1719,6 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox)
       SSL_OptionSetDefault(SSL_ENABLE_RENEGOTIATION, 
         enabled ? SSL_RENEGOTIATE_UNRESTRICTED : SSL_RENEGOTIATE_REQUIRES_XTN);
 
-      mPrefBranch->GetBoolPref("security.ssl.enable_compression", &enabled);
-      SSL_OptionSetDefault(SSL_ENABLE_DEFLATE, enabled);
 #ifdef SSL_ENABLE_FALSE_START // Requires NSS 3.12.8
       mPrefBranch->GetBoolPref("security.ssl.enable_false_start", &enabled);
       SSL_OptionSetDefault(SSL_ENABLE_FALSE_START, enabled);
@@ -2253,10 +2251,6 @@ nsNSSComponent::Observe(nsISupports *aSubject, const char *aTopic,
       PRInt32 warnLevel = 1;
       mPrefBranch->GetIntPref("security.ssl.warn_missing_rfc5746", &warnLevel);
       nsSSLIOLayerHelpers::setWarnLevelMissingRFC5746(warnLevel);
-    } else if (prefName.Equals("security.ssl.enable_compression")) {
-      mPrefBranch->GetBoolPref("security.ssl.enable_compression", &enabled);
-      SSL_OptionSetDefault(SSL_ENABLE_DEFLATE, enabled);
-      clearSessionCache = PR_TRUE;
 #ifdef SSL_ENABLE_FALSE_START // Requires NSS 3.12.8
     } else if (prefName.Equals("security.ssl.enable_false_start")) {
       mPrefBranch->GetBoolPref("security.ssl.enable_false_start", &enabled);

From 1f534c996b5e8eb87b804d04737a809f20952797 Mon Sep 17 00:00:00 2001
From: Julian Viereck <jviereck@mozilla.com>
Date: Thu, 2 Sep 2010 14:30:45 -0700
Subject: [PATCH 061/222] Bug 575789: Implements helper $, 2519, clear, keys,
 values, inspect and pprint. r=sdwilsh a=beta6+

---
 .../console/hudservice/HUDService.jsm         | 173 +++++++++++++++++-
 .../console/hudservice/PropertyPanel.jsm      |   2 +-
 .../browser/browser_HUDServiceTestsAll.js     |  46 +++++
 .../tests/browser/test-console.html           |   2 +-
 .../chrome/global/headsUpDisplay.properties   |   1 +
 5 files changed, 221 insertions(+), 3 deletions(-)

diff --git a/toolkit/components/console/hudservice/HUDService.jsm b/toolkit/components/console/hudservice/HUDService.jsm
index 994ee2625836..208a42a7360b 100644
--- a/toolkit/components/console/hudservice/HUDService.jsm
+++ b/toolkit/components/console/hudservice/HUDService.jsm
@@ -79,6 +79,11 @@ XPCOMUtils.defineLazyGetter(this, "PropertyPanel", function () {
   return obj.PropertyPanel;
 });
 
+XPCOMUtils.defineLazyGetter(this, "namesAndValuesOf", function () {
+  var obj = {};
+  Cu.import("resource://gre/modules/PropertyPanel.jsm", obj);
+  return obj.namesAndValuesOf;
+});
 
 function LogFactory(aMessagePrefix)
 {
@@ -3488,6 +3493,171 @@ function JSPropertyProvider(aScope, aInputValue)
 // JSTerm
 //////////////////////////////////////////////////////////////////////////
 
+/**
+ * JSTermHelper
+ *
+ * Defines a set of functions ("helper functions") that are available from the
+ * WebConsole but not from the webpage.
+ * A list of helper functions used by Firebug can be found here:
+ *   http://getfirebug.com/wiki/index.php/Command_Line_API
+ */
+function JSTermHelper(aJSTerm)
+{
+  return {
+    /**
+     * Returns the result of document.getElementById(aId).
+     *
+     * @param string aId
+     *        A string that is passed to window.document.getElementById.
+     * @returns nsIDOMNode or null
+     */
+    $: function JSTH_$(aId)
+    {
+      try {
+        return aJSTerm._window.document.getElementById(aId);
+      }
+      catch (ex) {
+        aJSTerm.console.error(ex.message);
+      }
+    },
+
+    /**
+     * Returns the result of document.querySelectorAll(aSelector).
+     *
+     * @param string aSelector
+     *        A string that is passed to window.document.querySelectorAll.
+     * @returns array of nsIDOMNode
+     */
+    $$: function JSTH_$$(aSelector)
+    {
+      try {
+        return aJSTerm._window.document.querySelectorAll(aSelector);
+      }
+      catch (ex) {
+        aJSTerm.console.error(ex.message);
+      }
+    },
+
+    /**
+     * Runs a xPath query and returns all matched nodes.
+     *
+     * @param string aXPath
+     *        xPath search query to execute.
+     * @param [optional] nsIDOMNode aContext
+     *        Context to run the xPath query on. Uses window.document if not set.
+     * @returns array of nsIDOMNode
+     */
+    $x: function JSTH_$x(aXPath, aContext)
+    {
+      let nodes = [];
+      let doc = aJSTerm._window.wrappedJSObject.document;
+      let aContext = aContext || doc;
+
+      try {
+        let results = doc.evaluate(aXPath, aContext, null,
+                                    Ci.nsIDOMXPathResult.ANY_TYPE, null);
+
+        let node;
+        while (node = results.iterateNext()) {
+          nodes.push(node);
+        }
+      }
+      catch (ex) {
+        aJSTerm.console.error(ex.message);
+      }
+
+      return nodes;
+    },
+
+    /**
+     * Clears the output of the JSTerm.
+     */
+    clear: function JSTH_clear()
+    {
+      aJSTerm.clearOutput();
+    },
+
+    /**
+     * Returns the result of Object.keys(aObject).
+     *
+     * @param object aObject
+     *        Object to return the property names from.
+     * @returns array of string
+     */
+    keys: function JSTH_keys(aObject)
+    {
+      try {
+        return Object.keys(XPCNativeWrapper.unwrap(aObject));
+      }
+      catch (ex) {
+        aJSTerm.console.error(ex.message);
+      }
+    },
+
+    /**
+     * Returns the values of all properties on aObject.
+     *
+     * @param object aObject
+     *        Object to display the values from.
+     * @returns array of string
+     */
+    values: function JSTH_values(aObject)
+    {
+      let arrValues = [];
+      let obj = XPCNativeWrapper.unwrap(aObject);
+
+      try {
+        for (let prop in obj) {
+          arrValues.push(obj[prop]);
+        }
+      }
+      catch (ex) {
+        aJSTerm.console.error(ex.message);
+      }
+      return arrValues;
+    },
+
+    /**
+     * Inspects the passed aObject. This is done by opening the PropertyPanel.
+     *
+     * @param object aObject
+     *        Object to inspect.
+     * @returns void
+     */
+    inspect: function JSTH_inspect(aObject)
+    {
+      let obj = XPCNativeWrapper.unwrap(aObject);
+      aJSTerm.openPropertyPanel(null, obj);
+    },
+
+    /**
+     * Prints aObject to the output.
+     *
+     * @param object aObject
+     *        Object to print to the output.
+     * @returns void
+     */
+    pprint: function JSTH_pprint(aObject)
+    {
+      if (aObject === null || aObject === undefined || aObject === true || aObject === false) {
+        aJSTerm.console.error(HUDService.getStr("helperFuncUnsupportedTypeError"));
+        return;
+      }
+      let output = [];
+      if (typeof aObject != "string") {
+        aObject = XPCNativeWrapper.unwrap(aObject);
+      }
+      let pairs = namesAndValuesOf(aObject);
+
+      pairs.forEach(function(pair) {
+        output.push("  " + pair.display);
+      });
+
+      aJSTerm.writeOutput(output.join("\n"));
+    }
+  }
+}
+
 /**
  * JSTerm
  *
@@ -3576,6 +3746,7 @@ JSTerm.prototype = {
     this.sandbox = new Cu.Sandbox(this._window);
     this.sandbox.window = this._window;
     this.sandbox.console = this.console;
+    this.sandbox.__helperFunctions__ = JSTermHelper(this);
     this.sandbox.__proto__ = this._window.wrappedJSObject;
   },
 
@@ -3594,7 +3765,7 @@ JSTerm.prototype = {
    */
   evalInSandbox: function JST_evalInSandbox(aString)
   {
-    let execStr = "with(window) {" + aString + "}";
+    let execStr = "with(__helperFunctions__) { with(window) {" + aString + "} }";
     return Cu.evalInSandbox(execStr,  this.sandbox, "default", "HUD Console", 1);
   },
 
diff --git a/toolkit/components/console/hudservice/PropertyPanel.jsm b/toolkit/components/console/hudservice/PropertyPanel.jsm
index 1ca788ca3bf7..d8e34f165cc3 100644
--- a/toolkit/components/console/hudservice/PropertyPanel.jsm
+++ b/toolkit/components/console/hudservice/PropertyPanel.jsm
@@ -44,7 +44,7 @@ const Cu = Components.utils;
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 
-var EXPORTED_SYMBOLS = ["PropertyPanel", "PropertyTreeView"];
+var EXPORTED_SYMBOLS = ["PropertyPanel", "PropertyTreeView", "namesAndValuesOf"];
 
 ///////////////////////////////////////////////////////////////////////////
 //// Helper for PropertyTreeView
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_HUDServiceTestsAll.js b/toolkit/components/console/hudservice/tests/browser/browser_HUDServiceTestsAll.js
index f0bd9f7a52a8..da5ee723f6d2 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_HUDServiceTestsAll.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_HUDServiceTestsAll.js
@@ -1049,6 +1049,51 @@ function testExecutionScope()
     "command was executed in the window scope");
 }
 
+function testJSTermHelper()
+{
+  content.location.href = TEST_URI;
+
+  let HUD = HUDService.hudWeakReferences[hudId].get();
+  let jsterm = HUD.jsterm;
+
+  jsterm.clearOutput();
+  jsterm.execute("'id=' + $('header').getAttribute('id')");
+  let group = jsterm.outputNode.querySelector(".hud-group");
+  is(group.childNodes[2].textContent, "id=header", "$() worked");
+
+  jsterm.clearOutput();
+  jsterm.execute("headerQuery = $$('h1')");
+  jsterm.execute("'length=' + headerQuery.length");
+  let group = jsterm.outputNode.querySelector(".hud-group");
+  is(group.childNodes[4].textContent, "length=1", "$$() worked");
+
+  jsterm.clearOutput();
+  jsterm.execute("xpathQuery = $x('.//*', document.body);");
+  jsterm.execute("'headerFound='  + (xpathQuery[0] == headerQuery[0])");
+  let group = jsterm.outputNode.querySelector(".hud-group");
+  is(group.childNodes[4].textContent, "headerFound=true", "$x() worked");
+
+  // no jsterm.clearOutput() here as we clear the output using the clear() fn.
+  jsterm.execute("clear()");
+  let group = jsterm.outputNode.querySelector(".hud-group");
+  is(group.childNodes[1].textContent, "undefined", "clear() worked");
+
+  jsterm.clearOutput();
+  jsterm.execute("'keysResult=' + (keys({b:1})[0] == 'b')");
+  let group = jsterm.outputNode.querySelector(".hud-group");
+  is(group.childNodes[2].textContent, "keysResult=true", "keys() worked");
+
+  jsterm.clearOutput();
+  jsterm.execute("'valuesResult=' + (values({b:1})[0] == 1)");
+  let group = jsterm.outputNode.querySelector(".hud-group");
+  is(group.childNodes[2].textContent, "valuesResult=true", "values() worked");
+
+  jsterm.clearOutput();
+  jsterm.execute("pprint({b:2, a:1})");
+  let group = jsterm.outputNode.querySelector(".hud-group");
+  is(group.childNodes[2].textContent, "  a: 1\n  b: 2", "pprint() worked");
+}
+
 function testPropertyPanel()
 {
   var HUD = HUDService.hudWeakReferences[hudId].get();
@@ -1383,6 +1428,7 @@ function test() {
       testPropertyProvider();
       testJSInputExpand();
       testPropertyPanel();
+      testJSTermHelper();
 
       // NOTE: Put any sync test above this comment.
       //
diff --git a/toolkit/components/console/hudservice/tests/browser/test-console.html b/toolkit/components/console/hudservice/tests/browser/test-console.html
index 19b496cccc48..fcfd5a101ace 100644
--- a/toolkit/components/console/hudservice/tests/browser/test-console.html
+++ b/toolkit/components/console/hudservice/tests/browser/test-console.html
@@ -16,7 +16,7 @@
     </script>
   </head>
   <body>
-    <h1>Heads Up Display Demo</h1>
+    <h1 id="header">Heads Up Display Demo</h1>
     <button onclick="test();">Log stuff about Dolske</button>
   </body>
 </html>
diff --git a/toolkit/locales/en-US/chrome/global/headsUpDisplay.properties b/toolkit/locales/en-US/chrome/global/headsUpDisplay.properties
index a91529907305..1fdef08b6dd6 100644
--- a/toolkit/locales/en-US/chrome/global/headsUpDisplay.properties
+++ b/toolkit/locales/en-US/chrome/global/headsUpDisplay.properties
@@ -63,6 +63,7 @@ jsPropertyTitle=Object Inspector
 jsPropertyInspectTitle=Inspect: %S
 copyCmd.label=Copy
 copyCmd.accesskey=C
+helperFuncUnsupportedTypeError=Can't call pprint on this type of object.
 # LOCALIZATION NOTE (networkUrlWithStatus):
 #
 # When the HTTP request is started only the URL of the request is printed to the

From c0c9e9da7f64b72482388b0c2481e06fda9d0859 Mon Sep 17 00:00:00 2001
From: Patrick Walton <pcwalton@mozilla.com>
Date: Thu, 2 Sep 2010 14:30:48 -0700
Subject: [PATCH 062/222] Bug 592410 - WebConsole: Reloading page while
 requests are not done causes exception r=sdwilsh a=gavin.sharp

---
 toolkit/components/console/hudservice/HUDService.jsm | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/toolkit/components/console/hudservice/HUDService.jsm b/toolkit/components/console/hudservice/HUDService.jsm
index 208a42a7360b..457efe993d67 100644
--- a/toolkit/components/console/hudservice/HUDService.jsm
+++ b/toolkit/components/console/hudservice/HUDService.jsm
@@ -165,14 +165,23 @@ ResponseListener.prototype =
     let httpActivity = this.httpActivity;
     // Check if the header isn't set yet.
     if (!httpActivity.response.header) {
-      httpActivity.response.header = {};
       if (aRequest instanceof Ci.nsIHttpChannel) {
+      httpActivity.response.header = {};
+        try {
         aRequest.visitResponseHeaders({
           visitHeader: function(aName, aValue) {
             httpActivity.response.header[aName] = aValue;
           }
         });
       }
+        // Accessing the response header can throw an NS_ERROR_NOT_AVAILABLE
+        // exception. Catch it and stop it to make it not show up in the.
+        // This can happen if the response is not finished yet and the user
+        // reloades the page.
+        catch (ex) {
+          delete httpActivity.response.header;
+        }
+      }
     }
   },
 

From e859c42f9dcfef14c5f73176a2f8fbe473d9a562 Mon Sep 17 00:00:00 2001
From: Johnathan Nightingale <johnath@mozilla.com>
Date: Thu, 2 Sep 2010 14:42:04 -0400
Subject: [PATCH 063/222] Bug 591776 - Add user agent to about:support
 r=sdwilsh a=blocking2.0beta6+

---
 toolkit/content/aboutSupport.js                      | 1 +
 toolkit/content/aboutSupport.xhtml                   | 9 +++++++++
 toolkit/locales/en-US/chrome/global/aboutSupport.dtd | 1 +
 3 files changed, 11 insertions(+)

diff --git a/toolkit/content/aboutSupport.js b/toolkit/content/aboutSupport.js
index d185430b7c92..acc0b1648df0 100644
--- a/toolkit/content/aboutSupport.js
+++ b/toolkit/content/aboutSupport.js
@@ -90,6 +90,7 @@ window.onload = function () {
   // Update the application basics section.
   document.getElementById("application-box").textContent = Application.name;
   document.getElementById("version-box").textContent = Application.version;
+  document.getElementById("useragent-box").textContent = navigator.userAgent;
   document.getElementById("supportLink").href = supportUrl;
 
   // Update the other sections.
diff --git a/toolkit/content/aboutSupport.xhtml b/toolkit/content/aboutSupport.xhtml
index 068ee0e7abf6..ebe6f4623a79 100644
--- a/toolkit/content/aboutSupport.xhtml
+++ b/toolkit/content/aboutSupport.xhtml
@@ -99,6 +99,15 @@
             </td>
           </tr>
             
+          <tr>
+            <th class="column">
+              &aboutSupport.appBasicsUserAgent;
+            </th>
+
+            <td id="useragent-box">
+            </td>
+          </tr>
+
           <tr>
             <th class="column">
               &aboutSupport.appBasicsProfileDir;
diff --git a/toolkit/locales/en-US/chrome/global/aboutSupport.dtd b/toolkit/locales/en-US/chrome/global/aboutSupport.dtd
index 28b62bbfc8e4..6facad9f5846 100644
--- a/toolkit/locales/en-US/chrome/global/aboutSupport.dtd
+++ b/toolkit/locales/en-US/chrome/global/aboutSupport.dtd
@@ -19,6 +19,7 @@
 <!ENTITY aboutSupport.appBasicsProfileDir "Profile Directory">
 <!ENTITY aboutSupport.appBasicsEnabledPlugins "Enabled Plugins">
 <!ENTITY aboutSupport.appBasicsBuildConfig "Build Configuration">
+<!ENTITY aboutSupport.appBasicsUserAgent "User Agent">
 
 <!ENTITY aboutSupport.show.label "Open Containing Folder">
 

From 2d9c2035d3e7f5aadb83ba9cd98d05281c88e5dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Thu, 2 Sep 2010 23:26:58 +0200
Subject: [PATCH 064/222] Disable browser_drag.js r=dao a=ehsan

---
 browser/base/content/test/Makefile.in | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/browser/base/content/test/Makefile.in b/browser/base/content/test/Makefile.in
index 0634f3f94026..f54073aa090d 100644
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -90,6 +90,8 @@ endif
 # back to the clear recent history dialog (santize.xul), if it ever is (bug
 # 480169)
 
+# browser_drag.js is disabled, as it needs to be updated for the new behavior from bug 320638.
+
 _BROWSER_FILES = \
                  browser_typeAheadFind.js \
                  browser_NetworkPrioritizer.js \
@@ -148,7 +150,6 @@ _BROWSER_FILES = \
                  browser_contextSearchTabPosition.js \
                  browser_ctrlTab.js \
                  browser_discovery.js \
-                 browser_drag.js \
                  browser_duplicateIDs.js \
                  browser_gestureSupport.js \
                  browser_getshortcutoruri.js \

From 1d599447d0edc6f15bfdf5e98b74d4dcba99dc27 Mon Sep 17 00:00:00 2001
From: Felipe Gomes <felipc@gmail.com>
Date: Thu, 2 Sep 2010 18:50:26 -0300
Subject: [PATCH 065/222] Bug 590035. Middle clicking tab bar with custom
 window drawing does not open a new tab. r=jmathies a=blocking-final

---
 widget/src/windows/nsWindow.cpp | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index d59cb8c3cd14..5538d41a2e36 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -4894,10 +4894,28 @@ PRBool nsWindow::ProcessMessage(UINT msg, WPARAM &wParam, LPARAM &lParam,
       break;
 
     case WM_MBUTTONDBLCLK:
-      result = DispatchMouseEvent(NS_MOUSE_BUTTON_DOWN, wParam, lParam, PR_FALSE,
+      result = DispatchMouseEvent(NS_MOUSE_DOUBLECLICK, wParam, lParam, PR_FALSE,
                                   nsMouseEvent::eMiddleButton, MOUSE_INPUT_SOURCE());
       break;
 
+    case WM_NCMBUTTONDOWN:
+      result = DispatchMouseEvent(NS_MOUSE_BUTTON_DOWN, 0, lParamToClient(lParam), PR_FALSE,
+                                  nsMouseEvent::eMiddleButton, MOUSE_INPUT_SOURCE());
+      DispatchPendingEvents();
+      break;
+
+    case WM_NCMBUTTONUP:
+      result = DispatchMouseEvent(NS_MOUSE_BUTTON_UP, 0, lParamToClient(lParam), PR_FALSE,
+                                  nsMouseEvent::eMiddleButton, MOUSE_INPUT_SOURCE());
+      DispatchPendingEvents();
+      break;
+
+    case WM_NCMBUTTONDBLCLK:
+      result = DispatchMouseEvent(NS_MOUSE_DOUBLECLICK, 0, lParamToClient(lParam), PR_FALSE,
+                                  nsMouseEvent::eMiddleButton, MOUSE_INPUT_SOURCE());
+      DispatchPendingEvents();
+      break;
+
     case WM_RBUTTONDOWN:
     {
       result = DispatchMouseEvent(NS_MOUSE_BUTTON_DOWN, wParam, lParam, PR_FALSE,

From 460eff69fc08e67ad68e1eb8fc5a0565f8ec8b7e Mon Sep 17 00:00:00 2001
From: Felipe Gomes <felipc@gmail.com>
Date: Thu, 2 Sep 2010 18:50:32 -0300
Subject: [PATCH 066/222] Bug 559991. Zoom flicker when switching quickly
 between tabs. r=gavin.sharp a=blocking-betaN

---
 browser/base/content/browser-fullZoom.js      |  8 +--
 browser/base/content/test/Makefile.in         |  1 +
 .../base/content/test/browser_bug559991.js    | 64 +++++++++++++++++++
 3 files changed, 69 insertions(+), 4 deletions(-)
 create mode 100644 browser/base/content/test/browser_bug559991.js

diff --git a/browser/base/content/browser-fullZoom.js b/browser/base/content/browser-fullZoom.js
index 0a6470d84490..24ff8df73ffc 100644
--- a/browser/base/content/browser-fullZoom.js
+++ b/browser/base/content/browser-fullZoom.js
@@ -256,10 +256,10 @@ var FullZoom = {
     var self = this;
     Services.contentPrefs.getPref(aURI, this.name, function (aResult) {
       // Check that we're still where we expect to be in case this took a while.
-      let isSaneURI = (aBrowser && aBrowser.currentURI) ?
-        aURI.equals(aBrowser.currentURI) : false;
-      if (!aBrowser || isSaneURI)
-        self._applyPrefToSetting(aResult, aBrowser);
+      let browser = aBrowser || gBrowser.selectedBrowser;
+      if (aURI.equals(browser.currentURI)) {
+        self._applyPrefToSetting(aResult, browser);
+      }
     });
   },
 
diff --git a/browser/base/content/test/Makefile.in b/browser/base/content/test/Makefile.in
index f54073aa090d..4a809bab8bf3 100644
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -138,6 +138,7 @@ _BROWSER_FILES = \
                  browser_bug555224.js \
                  browser_bug555767.js \
                  browser_bug556061.js \
+                 browser_bug559991.js \
                  browser_bug561623.js \
                  browser_bug562649.js \
                  browser_bug563588.js \
diff --git a/browser/base/content/test/browser_bug559991.js b/browser/base/content/test/browser_bug559991.js
new file mode 100644
index 000000000000..ce8054d475e5
--- /dev/null
+++ b/browser/base/content/test/browser_bug559991.js
@@ -0,0 +1,64 @@
+function test() {
+
+  // ----------
+  // Test setup
+
+  waitForExplicitFinish();
+
+  let oldOLC = FullZoom.onLocationChange;
+  FullZoom.onLocationChange = function(aURI, aIsTabSwitch, aBrowser) {
+    // Ignore calls that are not about tab switching on this test
+    if (aIsTabSwitch)
+      oldOLC.call(FullZoom, aURI, aIsTabSwitch, aBrowser);
+  };
+
+  gPrefService.setBoolPref("browser.zoom.updateBackgroundTabs", true);
+  gPrefService.setBoolPref("browser.zoom.siteSpecific", true);
+
+  let oldAPTS = FullZoom._applyPrefToSetting;
+  let uri = "http://example.org/browser/browser/base/content/test/dummy_page.html";
+
+  // ------------------------------------------------------
+  // Test 1 - Zoom should not be called if URIs don't match
+  FullZoom._applyPrefToSetting = function() {
+    ok(false, "This should not be called");
+  };
+  FullZoom.onLocationChange(makeURI(uri), true);
+
+  let tab = gBrowser.addTab();
+  tab.linkedBrowser.addEventListener("load", function(event) {
+    tab.linkedBrowser.removeEventListener("load", arguments.callee, true);
+
+    // -------------------------------------------------------------------
+    // Test 2 - Trigger a tab switch that should now update the zoom level
+    FullZoom._applyPrefToSetting = function() {
+      ok(true, "applyPrefToSetting was called");
+      endTest();
+    }
+    gBrowser.selectedTab = tab;
+
+  }, true); 
+  tab.linkedBrowser.loadURI(uri);
+
+  // -------------
+  // Test clean-up
+  function endTest() {
+    gBrowser.removeTab(tab);
+    FullZoom._applyPrefToSetting = oldAPTS;
+    FullZoom.onLocationChange = oldOLC;
+
+    oldAPTS = null;
+    oldOLC = null;
+    tab = null;
+
+    if (gPrefService.prefHasUserValue("browser.zoom.updateBackgroundTabs"))
+      gPrefService.clearUserPref("browser.zoom.updateBackgroundTabs");
+
+    if (gPrefService.prefHasUserValue("browser.zoom.siteSpecific"))
+      gPrefService.clearUserPref("browser.zoom.siteSpecific");
+
+    finish();
+  }
+
+}
+

From 2676d1a4956a6a2df4f64bf20d802d3931673119 Mon Sep 17 00:00:00 2001
From: Doug Turner <dougt@dougt.org>
Date: Thu, 2 Sep 2010 19:02:06 -0300
Subject: [PATCH 067/222] Bug 592308. IsLowMemory() is terribly slow and there
 is nothing to do about it. r=bsmedberg a=blocking-fennec2.0

---
 dom/base/nsJSEnvironment.cpp     |  74 ---------------------
 modules/libpr0n/src/imgFrame.cpp |  22 -------
 xpcom/base/nsIMemory.idl         |   2 +
 xpcom/base/nsMemoryImpl.cpp      |  71 +-------------------
 xpcom/tests/Makefile.in          |   1 -
 xpcom/tests/TestOOM.cpp          | 108 -------------------------------
 6 files changed, 3 insertions(+), 275 deletions(-)
 delete mode 100644 xpcom/tests/TestOOM.cpp

diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index d5568e7e6506..a81de38013c7 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -961,79 +961,6 @@ nsJSContext::DOMOperationCallback(JSContext *cx)
   ctx->mOperationCallbackTime = callbackTime;
   ctx->mModalStateTime = modalStateTime;
 
-  // Check to see if we are running OOM
-  nsCOMPtr<nsIMemory> mem;
-  NS_GetMemoryManager(getter_AddRefs(mem));
-  if (!mem) {
-    JS_ClearPendingException(cx);
-    return JS_FALSE;
-  }
-
-  PRBool lowMemory;
-  mem->IsLowMemory(&lowMemory);
-  if (lowMemory) {
-    // try to clean up:
-    nsJSContext::CC();
-
-    // never prevent system scripts from running
-    if (!::JS_IsSystemObject(cx, ::JS_GetGlobalObject(cx))) {
-
-      // lets see if CC() did anything, if not, cancel the script.
-      mem->IsLowMemory(&lowMemory);
-      if (lowMemory) {
-
-        if (nsContentUtils::GetBoolPref("dom.prevent_oom_dialog", PR_FALSE)) {
-          JS_ClearPendingException(cx);
-          return JS_FALSE;
-        }
-
-        nsCOMPtr<nsIScriptError> errorObject =
-          do_CreateInstance("@mozilla.org/scripterror;1");
-
-        if (errorObject) {
-          nsXPIDLString msg;
-          nsContentUtils::GetLocalizedString(nsContentUtils::eDOM_PROPERTIES,
-                                             "LowMemoryMessage",
-                                             msg);
-
-          JSStackFrame *fp, *iterator = nsnull;
-          fp = ::JS_FrameIterator(cx, &iterator);
-          PRUint32 lineno = 0;
-          nsAutoString sourcefile;
-          if (fp) {
-            JSScript* script = ::JS_GetFrameScript(cx, fp);
-            if (script) {
-              const char* filename = ::JS_GetScriptFilename(cx, script);
-              if (filename) {
-                CopyUTF8toUTF16(nsDependentCString(filename), sourcefile);
-              }
-              jsbytecode* pc = ::JS_GetFramePC(cx, fp);
-              if (pc) {
-                lineno = ::JS_PCToLineNumber(cx, script, pc);
-              }
-            }
-          }
-
-          rv = errorObject->Init(msg.get(),
-                                 sourcefile.get(),
-                                 EmptyString().get(),
-                                 lineno, 0, nsIScriptError::errorFlag,
-                                 "content javascript");
-          if (NS_SUCCEEDED(rv)) {
-            nsCOMPtr<nsIConsoleService> consoleService =
-              do_GetService(NS_CONSOLESERVICE_CONTRACTID, &rv);
-            if (NS_SUCCEEDED(rv)) {
-              consoleService->LogMessage(errorObject);
-            }
-          }
-        }
-
-        JS_ClearPendingException(cx);
-        return JS_FALSE;
-      }
-    }
-  }
-
   PRTime now = PR_Now();
 
   if (callbackTime == 0) {
@@ -1045,7 +972,6 @@ nsJSContext::DOMOperationCallback(JSContext *cx)
 
   if (ctx->mModalStateDepth) {
     // We're waiting on a modal dialog, nothing more to do here.
-
     return JS_TRUE;
   }
 
diff --git a/modules/libpr0n/src/imgFrame.cpp b/modules/libpr0n/src/imgFrame.cpp
index c233a0b91853..4efaf86aa5dd 100644
--- a/modules/libpr0n/src/imgFrame.cpp
+++ b/modules/libpr0n/src/imgFrame.cpp
@@ -192,17 +192,6 @@ nsresult imgFrame::Init(PRInt32 aX, PRInt32 aY, PRInt32 aWidth, PRInt32 aHeight,
   if (!AllowedImageSize(aWidth, aHeight))
     return NS_ERROR_FAILURE;
 
-  // Check to see if we are running OOM
-  nsCOMPtr<nsIMemory> mem;
-  NS_GetMemoryManager(getter_AddRefs(mem));
-  if (!mem)
-    return NS_ERROR_UNEXPECTED;
-
-  PRBool lowMemory;
-  mem->IsLowMemory(&lowMemory);
-  if (lowMemory)
-    return NS_ERROR_OUT_OF_MEMORY;
-
   mOffset.MoveTo(aX, aY);
   mSize.SizeTo(aWidth, aHeight);
 
@@ -553,17 +542,6 @@ nsresult imgFrame::Extract(const nsIntRect& aRegion, imgFrame** aResult)
 
 nsresult imgFrame::ImageUpdated(const nsIntRect &aUpdateRect)
 {
-  // Check to see if we are running OOM
-  nsCOMPtr<nsIMemory> mem;
-  NS_GetMemoryManager(getter_AddRefs(mem));
-  if (!mem)
-    return NS_ERROR_UNEXPECTED;
-
-  PRBool lowMemory;
-  mem->IsLowMemory(&lowMemory);
-  if (lowMemory)
-    return NS_ERROR_OUT_OF_MEMORY;
-
   mDecoded.UnionRect(mDecoded, aUpdateRect);
 
   // clamp to bounds, in case someone sends a bogus updateRect (I'm looking at
diff --git a/xpcom/base/nsIMemory.idl b/xpcom/base/nsIMemory.idl
index fd8cf43832c2..5f4fb892dbb5 100644
--- a/xpcom/base/nsIMemory.idl
+++ b/xpcom/base/nsIMemory.idl
@@ -122,6 +122,8 @@ interface nsIMemory : nsISupports
      * This predicate can be used to determine if we're in a low-memory
      * situation (what constitutes low-memory is platform dependent). This
      * can be used to trigger the memory pressure observers.
+     *
+     * DEPRECATED - Always returns false.  See bug 592308.
      */
     boolean isLowMemory();
 };
diff --git a/xpcom/base/nsMemoryImpl.cpp b/xpcom/base/nsMemoryImpl.cpp
index 2bed5ec7d932..f6adb9cb790c 100644
--- a/xpcom/base/nsMemoryImpl.cpp
+++ b/xpcom/base/nsMemoryImpl.cpp
@@ -54,30 +54,6 @@
 #include "nsString.h"
 #include "mozilla/Services.h"
 
-#if defined(XP_WIN)
-#include <windows.h>
-#endif
-
-#if (MOZ_PLATFORM_MAEMO == 5 || MOZ_PLATFORM_MAEMO == 4) && defined(__arm__)
-#include <fcntl.h>
-#include <unistd.h>
-static const char kHighMark[] = "/sys/kernel/high_watermark";
-#endif
-
-// Some platforms notify you when system memory is low, others do not.
-// In the case of those that do not, we want to post low memory
-// notifications from IsLowMemory().  For those that can notify us, that
-// code usually lives in toolkit.
-#ifdef WINCE
-#define NOTIFY_LOW_MEMORY
-#endif
-
-#ifdef WINCE_WINDOWS_MOBILE
-#include "aygshell.h"
-#endif
-
-#include "nsITimer.h"
-
 static nsMemoryImpl sGlobalMemory;
 
 NS_IMPL_QUERY_INTERFACE1(nsMemoryImpl, nsIMemory)
@@ -106,56 +82,11 @@ nsMemoryImpl::HeapMinimize(PRBool aImmediate)
     return FlushMemory(NS_LITERAL_STRING("heap-minimize").get(), aImmediate);
 }
 
-/* this magic number is something greater than 40mb
- * and after all, 40mb should be good enough for any web app
- * unless it's part of an office suite.
- */
-static const int kRequiredMemory = 0x3000000;
-
 NS_IMETHODIMP
 nsMemoryImpl::IsLowMemory(PRBool *result)
 {
-#if defined(WINCE_WINDOWS_MOBILE)
-    MEMORYSTATUS stat;
-    GlobalMemoryStatus(&stat);
-    *result = (stat.dwMemoryLoad >= 98);
-#elif defined(WINCE)
-    // Bug 525323 - GlobalMemoryStatus kills perf on WinCE.
+    NS_ERROR("IsLowMemory is deprecated.  See bug 592308.");
     *result = PR_FALSE;
-#elif defined(XP_WIN)
-    MEMORYSTATUSEX stat;
-    stat.dwLength = sizeof stat;
-    GlobalMemoryStatusEx(&stat);
-    *result = (stat.ullAvailPageFile < kRequiredMemory) &&
-        ((float)stat.ullAvailPageFile / stat.ullTotalPageFile) < 0.1;
-#elif (MOZ_PLATFORM_MAEMO == 5 || MOZ_PLATFORM_MAEMO == 4) && defined(__arm__)
-    static int osso_highmark_fd = -1;
-    if (osso_highmark_fd == -1) {
-        osso_highmark_fd = open (kHighMark, O_RDONLY);
-
-        if (osso_highmark_fd == -1) {
-            NS_ERROR("can't find the osso highmark file");    
-            *result = PR_FALSE;
-            return NS_OK;
-        }
-    }
-
-    // be kind, rewind.
-    lseek(osso_highmark_fd, 0L, SEEK_SET);
-
-    int c = 0;
-    read (osso_highmark_fd, &c, 1);
-
-    *result = (c == '1');
-#else
-    *result = PR_FALSE;
-#endif
-
-#ifdef NOTIFY_LOW_MEMORY
-    if (*result) {
-        sGlobalMemory.FlushMemory(NS_LITERAL_STRING("low-memory").get(), PR_FALSE);
-    }
-#endif
     return NS_OK;
 }
 
diff --git a/xpcom/tests/Makefile.in b/xpcom/tests/Makefile.in
index aac865cff1ae..2bcd35d83c53 100644
--- a/xpcom/tests/Makefile.in
+++ b/xpcom/tests/Makefile.in
@@ -73,7 +73,6 @@ CPPSRCS		= \
 		TestRegistrationOrder.cpp \
 		TestThreadPoolListener.cpp \
 		TestTimers.cpp \
-		TestOOM.cpp \
 		TestBlockingProcess.cpp \
 		TestQuickReturn.cpp \
 		TestArguments.cpp \
diff --git a/xpcom/tests/TestOOM.cpp b/xpcom/tests/TestOOM.cpp
deleted file mode 100644
index 3b5d1e1ef0e0..000000000000
--- a/xpcom/tests/TestOOM.cpp
+++ /dev/null
@@ -1,108 +0,0 @@
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is a simple OOM Test.
- *
- * The Initial Developer of the Original Code is
- * Mozilla Corporation.
- * Portions created by the Initial Developer are Copyright (C) 2008
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Doug Turner <dougt@meer.net>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <math.h>
-
-#include "nsXPCOM.h"
-#include "nsISupportsUtils.h"
-#include "nsCOMPtr.h"
-#include "nsIMemory.h"
-
-int main(int argc, char **argv)
-{
-  nsCOMPtr<nsIMemory> mem;
-  nsresult rv = NS_GetMemoryManager(getter_AddRefs(mem));
-
-  if (!mem || NS_FAILED(rv))
-  {
-    printf("Could not get the memory manager\n");
-    return -1;
-  }
-
-  // allocation note.  don't use nsIMemory to allocate,
-  // because we want to test the isLowMemory predicate
-  // without regard for the nsIMemory impelmentation (the
-  // implementation might count bytes handed out.  however,
-  // the predicate should work with out having to rely on
-  // that.
-  void *big_alloc = malloc(1024 * 1024 * 16);
-  (void)big_alloc; // Tell compiler we're not using big_alloc, to fix warning
-
-  const int highpower = 500000;
-  
-  char* buffers[highpower];
-  for (int i=0; i<highpower; i++)
-    buffers[i] = nsnull;
-  
-  for (int i=0; i<highpower; i++)
-  {
-    PRBool lowMem = PR_FALSE;
-    size_t s = 4096; //pow(2,i);
-    buffers[i] = (char*) malloc(s);
-    
-    // You have to touch the buffer
-    if (!buffers[i])
-      printf("Could not allocate a buffer of size %lu\n", (unsigned long)s);
-    else
-    {
-      for (size_t j=0; j<s; j++)
-        buffers[i][j] = 'a';
-    }
-   
-    PRIntervalTime start = PR_IntervalNow();
-    mem->IsLowMemory(&lowMem);
-    PRIntervalTime cost = PR_IntervalNow() - start;
-    
-    
-    printf("Total Allocated: %lu. \tLow Memory now?  %s\t Took (%d)\n",
-           (unsigned long)s*i,
-           lowMem ? "Yes" : "No",
-           PR_IntervalToMilliseconds(cost));
-  
-    if (lowMem)
-      break;
-  }
-
-  for(int i=0; i<highpower; i++)
-  {
-    if (buffers[i])
-      free(buffers[i]);
-  }
-  return 0;
-}

From 46436ed9f0a4239b296d9479c736ea0bf50a2468 Mon Sep 17 00:00:00 2001
From: Wan-Teh Chang <wtc@google.com>
Date: Thu, 2 Sep 2010 16:47:06 -0700
Subject: [PATCH 068/222] Bug 580679: do not define ZLIB_INTERNAL when
 compiling files outside zlib.  This reverts some of the zlib-related changes
 in Dec. 2004 for libxul (bug 272783 and bug 273876).  r=bsmedberg.
 a=bsmedberg.

---
 config/config.mk                 | 3 ---
 js/src/config/config.mk          | 3 ---
 toolkit/library/dlldeps-zlib.cpp | 1 +
 toolkit/library/libxul-config.mk | 2 --
 4 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/config/config.mk b/config/config.mk
index 4f8f19c3061e..c73303a4885f 100644
--- a/config/config.mk
+++ b/config/config.mk
@@ -394,9 +394,6 @@ DEFINES += \
 ifndef JS_SHARED_LIBRARY
 DEFINES += -DSTATIC_EXPORTABLE_JS_API
 endif
-ifndef MOZ_NATIVE_ZLIB
-DEFINES += -DZLIB_INTERNAL
-endif
 endif
 endif
 
diff --git a/js/src/config/config.mk b/js/src/config/config.mk
index 4f8f19c3061e..c73303a4885f 100644
--- a/js/src/config/config.mk
+++ b/js/src/config/config.mk
@@ -394,9 +394,6 @@ DEFINES += \
 ifndef JS_SHARED_LIBRARY
 DEFINES += -DSTATIC_EXPORTABLE_JS_API
 endif
-ifndef MOZ_NATIVE_ZLIB
-DEFINES += -DZLIB_INTERNAL
-endif
 endif
 endif
 
diff --git a/toolkit/library/dlldeps-zlib.cpp b/toolkit/library/dlldeps-zlib.cpp
index 51568c9f7a40..3d784e56a74a 100644
--- a/toolkit/library/dlldeps-zlib.cpp
+++ b/toolkit/library/dlldeps-zlib.cpp
@@ -38,6 +38,7 @@
 // Force references to all of the symbols that we want exported from
 // the dll that are located in the .lib files we link with
 
+#define ZLIB_INTERNAL
 #include "zlib.h"
 
 void xxxNeverCalledZLib()
diff --git a/toolkit/library/libxul-config.mk b/toolkit/library/libxul-config.mk
index 4030cbf6fe06..f089a10530a4 100644
--- a/toolkit/library/libxul-config.mk
+++ b/toolkit/library/libxul-config.mk
@@ -58,7 +58,6 @@ RCINCLUDE = xulrunner.rc
 
 ifndef MOZ_NATIVE_ZLIB
 CPPSRCS += dlldeps-zlib.cpp
-DEFINES += -DZLIB_INTERNAL
 endif
 
 LOCAL_INCLUDES += -I$(topsrcdir)/widget/src/windows
@@ -79,7 +78,6 @@ CPPSRCS += \
 
 ifndef MOZ_NATIVE_ZLIB
 CPPSRCS += dlldeps-zlib.cpp
-DEFINES += -DZLIB_INTERNAL
 endif
 
 ifdef MOZ_ENABLE_LIBXUL

From d84bc180241e8e97e71a016d587def2a17de15df Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Thu, 2 Sep 2010 19:54:23 -0400
Subject: [PATCH 069/222] Back out bug 240933 and bug 590554 because of reftest
 failure on Win7 and also bug 593211

---
 .../tests/mochitest/tree/test_txtctrl.html    |  14 +-
 content/base/src/nsGenericDOMDataNode.cpp     |   6 +-
 content/base/src/nsGenericDOMDataNode.h       |   2 +-
 content/base/src/nsTextFragment.cpp           |   6 +-
 content/base/src/nsTextFragment.h             |   4 +-
 editor/libeditor/base/Makefile.in             |   1 -
 editor/libeditor/base/nsEditor.cpp            |  99 +-------
 editor/libeditor/text/nsPlaintextEditor.cpp   |  90 ++++---
 editor/libeditor/text/nsTextEditRules.cpp     | 236 ++++++++++++------
 editor/libeditor/text/nsTextEditRules.h       |   8 +-
 editor/libeditor/text/tests/Makefile.in       |   1 -
 .../libeditor/text/tests/test_bug590554.html  |  37 ---
 .../test_texteditor_keyevent_handling.html    |  16 +-
 layout/base/tests/Makefile.in                 |   3 -
 layout/base/tests/bug240933-1-ref.html        |  10 -
 layout/base/tests/bug240933-1.html            |  14 --
 layout/base/tests/bug240933-2.html            |  16 --
 .../base/tests/test_reftests_with_caret.html  |   2 -
 layout/forms/nsTextControlFrame.cpp           | 132 +++++++---
 layout/generic/nsFrame.cpp                    |  11 +-
 layout/generic/nsIFrame.h                     |   8 -
 layout/generic/nsTextFrame.h                  |   2 -
 layout/generic/nsTextFrameThebes.cpp          |  48 ++--
 layout/generic/test/Makefile.in               |   1 -
 layout/generic/test/test_bug240933.html       |  68 -----
 layout/generic/test/test_bug288789.html       |  61 +----
 .../test/test_movement_by_characters.html     |   8 +-
 layout/reftests/bugs/240933-1-ref.html        |  25 --
 layout/reftests/bugs/240933-1.html            |  19 --
 layout/reftests/bugs/240933-2-ref.html        |  29 ---
 layout/reftests/bugs/240933-2.html            |  19 --
 layout/reftests/bugs/reftest.list             |   2 -
 .../caret_on_textarea_lastline-ref.html       |   6 -
 .../editor/caret_on_textarea_lastline.html    |   7 -
 layout/reftests/editor/reftest.list           |   1 -
 35 files changed, 359 insertions(+), 653 deletions(-)
 delete mode 100644 editor/libeditor/text/tests/test_bug590554.html
 delete mode 100644 layout/base/tests/bug240933-1-ref.html
 delete mode 100644 layout/base/tests/bug240933-1.html
 delete mode 100644 layout/base/tests/bug240933-2.html
 delete mode 100644 layout/generic/test/test_bug240933.html
 delete mode 100644 layout/reftests/bugs/240933-1-ref.html
 delete mode 100644 layout/reftests/bugs/240933-1.html
 delete mode 100644 layout/reftests/bugs/240933-2-ref.html
 delete mode 100644 layout/reftests/bugs/240933-2.html
 delete mode 100644 layout/reftests/editor/caret_on_textarea_lastline-ref.html
 delete mode 100644 layout/reftests/editor/caret_on_textarea_lastline.html

diff --git a/accessible/tests/mochitest/tree/test_txtctrl.html b/accessible/tests/mochitest/tree/test_txtctrl.html
index bc690b3e2df5..204da2b0f553 100644
--- a/accessible/tests/mochitest/tree/test_txtctrl.html
+++ b/accessible/tests/mochitest/tree/test_txtctrl.html
@@ -50,7 +50,19 @@
         role: ROLE_ENTRY,
         children: [
           {
-            role: ROLE_TEXT_LEAF // hello1\nhello2 text
+            role: ROLE_TEXT_LEAF // hello1 text
+          },
+          {
+            role: ROLE_WHITESPACE
+          },
+          {
+            role: ROLE_TEXT_LEAF, // hello2 text
+          },
+          {
+            role: ROLE_WHITESPACE
+          },
+          {
+            role: ROLE_TEXT_LEAF, // whitepsace text
           },
           {
             role: ROLE_WHITESPACE
diff --git a/content/base/src/nsGenericDOMDataNode.cpp b/content/base/src/nsGenericDOMDataNode.cpp
index 166fa69205c7..34344f644b28 100644
--- a/content/base/src/nsGenericDOMDataNode.cpp
+++ b/content/base/src/nsGenericDOMDataNode.cpp
@@ -385,7 +385,7 @@ nsGenericDOMDataNode::SetTextInternal(PRUint32 aOffset, PRUint32 aCount,
     delete [] to;
   }
 
-  UpdateBidiStatus(aBuffer, aLength);
+  SetBidiStatus();
 
   // Notify observers
   if (aNotify) {
@@ -1084,7 +1084,7 @@ nsGenericDOMDataNode::AppendTextTo(nsAString& aResult)
   mText.AppendTo(aResult);
 }
 
-void nsGenericDOMDataNode::UpdateBidiStatus(const PRUnichar* aBuffer, PRUint32 aLength)
+void nsGenericDOMDataNode::SetBidiStatus()
 {
   nsIDocument *document = GetCurrentDoc();
   if (document && document->GetBidiEnabled()) {
@@ -1092,7 +1092,7 @@ void nsGenericDOMDataNode::UpdateBidiStatus(const PRUnichar* aBuffer, PRUint32 a
     return;
   }
 
-  mText.UpdateBidiFlag(aBuffer, aLength);
+  mText.SetBidiFlag();
 
   if (document && mText.IsBidi()) {
     document->SetBidiEnabled();
diff --git a/content/base/src/nsGenericDOMDataNode.h b/content/base/src/nsGenericDOMDataNode.h
index 83c461fbb93d..a90f7243e01f 100644
--- a/content/base/src/nsGenericDOMDataNode.h
+++ b/content/base/src/nsGenericDOMDataNode.h
@@ -358,7 +358,7 @@ protected:
   nsTextFragment mText;
 
 private:
-  void UpdateBidiStatus(const PRUnichar* aBuffer, PRUint32 aLength);
+  void SetBidiStatus();
 
   already_AddRefed<nsIAtom> GetCurrentValueAtom();
 };
diff --git a/content/base/src/nsTextFragment.cpp b/content/base/src/nsTextFragment.cpp
index 87f4f8e91dd2..ce1aab9f3924 100644
--- a/content/base/src/nsTextFragment.cpp
+++ b/content/base/src/nsTextFragment.cpp
@@ -372,11 +372,11 @@ nsTextFragment::Append(const PRUnichar* aBuffer, PRUint32 aLength)
 // To save time we only do this when we really want to know, not during
 // every allocation
 void
-nsTextFragment::UpdateBidiFlag(const PRUnichar* aBuffer, PRUint32 aLength)
+nsTextFragment::SetBidiFlag()
 {
   if (mState.mIs2b && !mState.mIsBidi) {
-    const PRUnichar* cp = aBuffer;
-    const PRUnichar* end = cp + aLength;
+    const PRUnichar* cp = m2b;
+    const PRUnichar* end = cp + mState.mLength;
     while (cp < end) {
       PRUnichar ch1 = *cp++;
       PRUint32 utf32Char = ch1;
diff --git a/content/base/src/nsTextFragment.h b/content/base/src/nsTextFragment.h
index 4a5c27aca21e..bbdd602c3961 100644
--- a/content/base/src/nsTextFragment.h
+++ b/content/base/src/nsTextFragment.h
@@ -112,7 +112,7 @@ public:
   /**
    * Return PR_TRUE if this fragment contains Bidi text
    * For performance reasons this flag is not set automatically, but
-   * requires an explicit call to UpdateBidiFlag()
+   * requires an explicit call to SetBidiFlag()
    */
   PRBool IsBidi() const
   {
@@ -209,7 +209,7 @@ public:
    * Scan the contents of the fragment and turn on mState.mIsBidi if it
    * includes any Bidi characters.
    */
-  void UpdateBidiFlag(const PRUnichar* aBuffer, PRUint32 aLength);
+  void SetBidiFlag();
 
   struct FragmentBits {
     // PRUint32 to ensure that the values are unsigned, because we
diff --git a/editor/libeditor/base/Makefile.in b/editor/libeditor/base/Makefile.in
index acedb86f4994..81c5bdc964bb 100644
--- a/editor/libeditor/base/Makefile.in
+++ b/editor/libeditor/base/Makefile.in
@@ -90,7 +90,6 @@ FORCE_STATIC_LIB = 1
 include $(topsrcdir)/config/rules.mk
 
 INCLUDES	+= \
-		-I$(topsrcdir)/editor/libeditor/text \
 		-I$(topsrcdir)/content/base/src \
 		-I$(topsrcdir)/content/events/src \
 		-I$(topsrcdir)/layout/style \
diff --git a/editor/libeditor/base/nsEditor.cpp b/editor/libeditor/base/nsEditor.cpp
index 39d9c693f425..5adc2f26d48e 100644
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -113,7 +113,6 @@
 
 #include "nsITransferable.h"
 #include "nsComputedDOMStyle.h"
-#include "nsTextEditUtils.h"
 
 #include "mozilla/FunctionTimer.h"
 
@@ -904,27 +903,14 @@ nsEditor::EndPlaceHolderTransaction()
     if (selPrivate) {
       selPrivate->SetCanCacheFrameOffset(PR_TRUE);
     }
+    
+    // time to turn off the batch
+    EndUpdateViewBatch();
+    // make sure selection is in view
 
-    {
-      // Hide the caret here to avoid hiding it twice, once in EndUpdateViewBatch
-      // and once in ScrollSelectionIntoView.
-      nsRefPtr<nsCaret> caret;
-      nsCOMPtr<nsIPresShell> presShell;
-      GetPresShell(getter_AddRefs(presShell));
-
-      if (presShell)
-        caret = presShell->GetCaret();
-
-      StCaretHider caretHider(caret);
-
-      // time to turn off the batch
-      EndUpdateViewBatch();
-      // make sure selection is in view
-
-      // After ScrollSelectionIntoView(), the pending notifications might be
-      // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
-      ScrollSelectionIntoView(PR_FALSE);
-    }
+    // After ScrollSelectionIntoView(), the pending notifications might be
+    // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
+    ScrollSelectionIntoView(PR_FALSE);
 
     // cached for frame offset are Not available now
     if (selPrivate) {
@@ -2287,75 +2273,11 @@ NS_IMETHODIMP nsEditor::InsertTextImpl(const nsAString& aStringToInsert,
   // class to turn off txn selection updating.  Caller also turned on rules sniffing
   // if desired.
   
-  nsresult res;
   NS_ENSURE_TRUE(aInOutNode && *aInOutNode && aInOutOffset && aDoc, NS_ERROR_NULL_POINTER);
   if (!mInIMEMode && aStringToInsert.IsEmpty()) return NS_OK;
   nsCOMPtr<nsIDOMText> nodeAsText = do_QueryInterface(*aInOutNode);
-  if (!nodeAsText && IsPlaintextEditor()) {
-    // In some cases, aInOutNode is the anonymous DIV, and aInOutOffset is 0.
-    // To avoid injecting unneeded text nodes, we first look to see if we have
-    // one available.  In that case, we'll just adjust aInOutNode and aInOutOffset
-    // accordingly.
-    if (*aInOutNode == GetRoot() && *aInOutOffset == 0) {
-      nsCOMPtr<nsIDOMNode> possibleTextNode;
-      res = (*aInOutNode)->GetFirstChild(getter_AddRefs(possibleTextNode));
-      if (NS_SUCCEEDED(res)) {
-        nodeAsText = do_QueryInterface(possibleTextNode);
-        if (nodeAsText) {
-          *aInOutNode = possibleTextNode;
-        }
-      }
-    }
-    // In some other cases, aInOutNode is the anonymous DIV, and aInOutOffset points
-    // to the terminating mozBR.  In that case, we'll adjust aInOutNode and aInOutOffset
-    // to the preceding text node, if any.
-    if (!nodeAsText && *aInOutNode == GetRoot() && *aInOutOffset > 0) {
-      nsCOMPtr<nsIDOMNodeList> children;
-      res = (*aInOutNode)->GetChildNodes(getter_AddRefs(children));
-      if (NS_SUCCEEDED(res)) {
-        nsCOMPtr<nsIDOMNode> possibleMozBRNode;
-        res = children->Item(*aInOutOffset, getter_AddRefs(possibleMozBRNode));
-        if (NS_SUCCEEDED(res) && nsTextEditUtils::IsMozBR(possibleMozBRNode)) {
-          nsCOMPtr<nsIDOMNode> possibleTextNode;
-          res = children->Item(*aInOutOffset - 1, getter_AddRefs(possibleTextNode));
-          if (NS_SUCCEEDED(res)) {
-            nodeAsText = do_QueryInterface(possibleTextNode);
-            if (nodeAsText) {
-              PRUint32 length;
-              res = nodeAsText->GetLength(&length);
-              if (NS_SUCCEEDED(res)) {
-                *aInOutOffset = PRInt32(length);
-                *aInOutNode = possibleTextNode;
-              }
-            }
-          }
-        }
-      }
-    }
-    // Sometimes, aInOutNode is the mozBR element itself.  In that case, we'll
-    // adjust the insertion point to the previous text node, if one exists, or
-    // to the parent anonymous DIV.
-    if (nsTextEditUtils::IsMozBR(*aInOutNode) && *aInOutOffset == 0) {
-      nsCOMPtr<nsIDOMNode> previous;
-      (*aInOutNode)->GetPreviousSibling(getter_AddRefs(previous));
-      nodeAsText = do_QueryInterface(previous);
-      if (nodeAsText) {
-        PRUint32 length;
-        res = nodeAsText->GetLength(&length);
-        if (NS_SUCCEEDED(res)) {
-          *aInOutOffset = PRInt32(length);
-          *aInOutNode = previous;
-        }
-      } else {
-        nsCOMPtr<nsIDOMNode> parent;
-        (*aInOutNode)->GetParentNode(getter_AddRefs(parent));
-        if (parent == GetRoot()) {
-          *aInOutNode = parent;
-        }
-      }
-    }
-  }
   PRInt32 offset = *aInOutOffset;
+  nsresult res;
   if (mInIMEMode)
   {
     if (!nodeAsText)
@@ -3624,9 +3546,8 @@ nsEditor::IsEditable(nsIDOMNode *aNode)
         // and uses enhanced logic to find out in the HTML world.
         return IsTextInDirtyFrameVisible(aNode);
       }
-      if (resultFrame->HasAnyNoncollapsedCharacters()) {
-        return PR_TRUE;
-      }
+      if (resultFrame->GetSize().width > 0) 
+        return PR_TRUE;  // text node has width
       resultFrame = resultFrame->GetNextContinuation();
     }
   }
diff --git a/editor/libeditor/text/nsPlaintextEditor.cpp b/editor/libeditor/text/nsPlaintextEditor.cpp
index 0e30aa6e3dcc..7dc9d3e3806c 100644
--- a/editor/libeditor/text/nsPlaintextEditor.cpp
+++ b/editor/libeditor/text/nsPlaintextEditor.cpp
@@ -623,19 +623,13 @@ nsPlaintextEditor::GetTextSelectionOffsets(nsISelection *aSelection,
       }
     }
 #ifdef NS_DEBUG
-    // The post content iterator might return the parent node (which is the
-    // editor's root node) as the last item.  Don't count the root node itself
-    // as one of its children!
-    if (!SameCOMIdentity(currentNode, rootNode)) {
-      ++nodeCount;
-    }
+    ++nodeCount;
 #endif
   }
 
   if (endOffset == -1) {
     NS_ASSERTION(endNode == rootNode, "failed to find the end node");
-    NS_ASSERTION(IsPasswordEditor() ||
-                 (endNodeOffset == nodeCount-1 || endNodeOffset == 0),
+    NS_ASSERTION(endNodeOffset == nodeCount-1 || endNodeOffset == 0,
                  "invalid end node offset");
     endOffset = endNodeOffset == 0 ? 0 : totalLength;
   }
@@ -868,55 +862,57 @@ NS_IMETHODIMP nsPlaintextEditor::InsertLineBreak()
   shell->MaybeInvalidateCaretPosition();
 
   nsTextRulesInfo ruleInfo(nsTextEditRules::kInsertBreak);
-  ruleInfo.maxLength = mMaxTextLength;
   PRBool cancel, handled;
   res = mRules->WillDoAction(selection, &ruleInfo, &cancel, &handled);
   NS_ENSURE_SUCCESS(res, res);
   if (!cancel && !handled)
   {
-    // get the (collapsed) selection location
-    nsCOMPtr<nsIDOMNode> selNode;
-    PRInt32 selOffset;
-    res = GetStartNodeAndOffset(selection, getter_AddRefs(selNode), &selOffset);
-    NS_ENSURE_SUCCESS(res, res);
-
-    // don't put text in places that can't have it
-    if (!IsTextNode(selNode) && !CanContainTag(selNode, NS_LITERAL_STRING("#text")))
-      return NS_ERROR_FAILURE;
-
-    // we need to get the doc
-    nsCOMPtr<nsIDOMDocument> doc;
-    res = GetDocument(getter_AddRefs(doc));
-    NS_ENSURE_SUCCESS(res, res);
-    NS_ENSURE_TRUE(doc, NS_ERROR_NULL_POINTER);
-
-    // don't spaz my selection in subtransactions
-    nsAutoTxnsConserveSelection dontSpazMySelection(this);
-
-    // insert a linefeed character
-    res = InsertTextImpl(NS_LITERAL_STRING("\n"), address_of(selNode),
-                         &selOffset, doc);
-    if (!selNode) res = NS_ERROR_NULL_POINTER; // don't return here, so DidDoAction is called
+    // create the new BR node
+    nsCOMPtr<nsIDOMNode> newNode;
+    res = DeleteSelectionAndCreateNode(NS_LITERAL_STRING("br"), getter_AddRefs(newNode));
+    if (!newNode) res = NS_ERROR_NULL_POINTER; // don't return here, so DidDoAction is called
     if (NS_SUCCEEDED(res))
     {
-      // set the selection to the correct location
-      res = selection->Collapse(selNode, selOffset);
-
+      // set the selection to the new node
+      nsCOMPtr<nsIDOMNode>parent;
+      res = newNode->GetParentNode(getter_AddRefs(parent));
+      if (!parent) res = NS_ERROR_NULL_POINTER; // don't return here, so DidDoAction is called
       if (NS_SUCCEEDED(res))
       {
-        // see if we're at the end of the editor range
-        nsCOMPtr<nsIDOMNode> endNode;
-        PRInt32 endOffset;
-        res = GetEndNodeAndOffset(selection, getter_AddRefs(endNode), &endOffset);
-
-        if (NS_SUCCEEDED(res) && endNode == selNode && endOffset == selOffset)
+        PRInt32 offsetInParent=-1;  // we use the -1 as a marker to see if we need to compute this or not
+        nsCOMPtr<nsIDOMNode>nextNode;
+        newNode->GetNextSibling(getter_AddRefs(nextNode));
+        if (nextNode)
         {
-          // SetInterlinePosition(PR_TRUE) means we want the caret to stick to the content on the "right".
-          // We want the caret to stick to whatever is past the break.  This is
-          // because the break is on the same line we were on, but the next content
-          // will be on the following line.
-          nsCOMPtr<nsISelectionPrivate> selPriv(do_QueryInterface(selection));
-          selPriv->SetInterlinePosition(PR_TRUE);
+          nsCOMPtr<nsIDOMCharacterData>nextTextNode = do_QueryInterface(nextNode);
+          if (!nextTextNode) {
+            nextNode = do_QueryInterface(newNode); // is this QI needed?
+          }
+          else { 
+            offsetInParent=0; 
+          }
+        }
+        else {
+          nextNode = do_QueryInterface(newNode); // is this QI needed?
+        }
+
+        if (-1==offsetInParent) 
+        {
+          nextNode->GetParentNode(getter_AddRefs(parent));
+          res = GetChildOffset(nextNode, parent, offsetInParent);
+          if (NS_SUCCEEDED(res)) {
+            // SetInterlinePosition(PR_TRUE) means we want the caret to stick to the content on the "right".
+            // We want the caret to stick to whatever is past the break.  This is
+            // because the break is on the same line we were on, but the next content
+            // will be on the following line.
+            nsCOMPtr<nsISelectionPrivate> selPriv(do_QueryInterface(selection));
+            selPriv->SetInterlinePosition(PR_TRUE);
+            res = selection->Collapse(parent, offsetInParent+1);  // +1 to insert just after the break
+          }
+        }
+        else
+        {
+          res = selection->Collapse(nextNode, offsetInParent);
         }
       }
     }
diff --git a/editor/libeditor/text/nsTextEditRules.cpp b/editor/libeditor/text/nsTextEditRules.cpp
index aea336ce7529..56e2b655bc6d 100644
--- a/editor/libeditor/text/nsTextEditRules.cpp
+++ b/editor/libeditor/text/nsTextEditRules.cpp
@@ -267,9 +267,6 @@ nsTextEditRules::AfterEdit(PRInt32 action, nsIEditor::EDirection aDirection)
     // insure trailing br node
     res = CreateTrailingBRIfNeeded();
     NS_ENSURE_SUCCESS(res, res);
-
-    // collapse the selection to the trailing BR if it's at the end of our text node
-    CollapseSelectionToTrailingBRIfNeeded(selection);
     
     /* After inserting text the cursor Bidi level must be set to the level of the inserted text.
      * This is difficult, because we cannot know what the level is until after the Bidi algorithm
@@ -312,7 +309,7 @@ nsTextEditRules::WillDoAction(nsISelection *aSelection,
   switch (info->action)
   {
     case kInsertBreak:
-      return WillInsertBreak(aSelection, aCancel, aHandled, info->maxLength);
+      return WillInsertBreak(aSelection, aCancel, aHandled);
     case kInsertText:
     case kInsertTextIME:
       return WillInsertText(info->action,
@@ -424,10 +421,7 @@ nsTextEditRules::DidInsert(nsISelection *aSelection, nsresult aResult)
 }
 
 nsresult
-nsTextEditRules::WillInsertBreak(nsISelection *aSelection,
-                                 PRBool *aCancel,
-                                 PRBool *aHandled,
-                                 PRInt32 aMaxLength)
+nsTextEditRules::WillInsertBreak(nsISelection *aSelection, PRBool *aCancel, PRBool *aHandled)
 {
   if (!aSelection || !aCancel || !aHandled) { return NS_ERROR_NULL_POINTER; }
   CANCEL_OPERATION_IF_READONLY_OR_DISABLED
@@ -437,24 +431,11 @@ nsTextEditRules::WillInsertBreak(nsISelection *aSelection,
   }
   else 
   {
-    // handle docs with a max length
-    // NOTE, this function copies inString into outString for us.
-    NS_NAMED_LITERAL_STRING(inString, "\n");
-    nsAutoString outString;
-    PRBool didTruncate;
-    nsresult res = TruncateInsertionIfNeeded(aSelection, &inString, &outString,
-                                             aMaxLength, &didTruncate);
-    NS_ENSURE_SUCCESS(res, res);
-    if (didTruncate) {
-      *aCancel = PR_TRUE;
-      return NS_OK;
-    }
-
     *aCancel = PR_FALSE;
 
     // if the selection isn't collapsed, delete it.
     PRBool bCollapsed;
-    res = aSelection->GetIsCollapsed(&bCollapsed);
+    nsresult res = aSelection->GetIsCollapsed(&bCollapsed);
     NS_ENSURE_SUCCESS(res, res);
     if (!bCollapsed)
     {
@@ -474,12 +455,6 @@ nsTextEditRules::WillInsertBreak(nsISelection *aSelection,
 
 nsresult
 nsTextEditRules::DidInsertBreak(nsISelection *aSelection, nsresult aResult)
-{
-  return NS_OK;
-}
-
-nsresult
-nsTextEditRules::CollapseSelectionToTrailingBRIfNeeded(nsISelection* aSelection)
 {
   // we only need to execute the stuff below if we are a plaintext editor.
   // html editors have a different mechanism for putting in mozBR's
@@ -488,40 +463,40 @@ nsTextEditRules::CollapseSelectionToTrailingBRIfNeeded(nsISelection* aSelection)
     return NS_OK;
   }
 
-  // if we are at the end of the textarea, we need to set the
-  // selection to stick to the mozBR at the end of the textarea.
+  // if we are at the end of the document, we need to insert 
+  // a special mozBR following the normal br, and then set the
+  // selection to stick to the mozBR.
   PRInt32 selOffset;
   nsCOMPtr<nsIDOMNode> selNode;
   nsresult res;
   res = mEditor->GetStartNodeAndOffset(aSelection, getter_AddRefs(selNode), &selOffset);
   NS_ENSURE_SUCCESS(res, res);
-
-  nsCOMPtr<nsIDOMText> nodeAsText = do_QueryInterface(selNode);
-  if (!nodeAsText) return NS_OK; // nothing to do if we're not at a text node
-
-  PRUint32 length;
-  res = nodeAsText->GetLength(&length);
-  NS_ENSURE_SUCCESS(res, res);
-
-  // nothing to do if we're not at the end of the text node
-  if (selOffset != length) return NS_OK;
-
-  nsCOMPtr<nsIDOMNode> parentNode;
-  PRInt32 parentOffset;
-  res = nsEditor::GetNodeLocation(selNode, address_of(parentNode),
-                                  &parentOffset);
-  NS_ENSURE_SUCCESS(res, res);
-
+  // confirm we are at end of document
+  if (selOffset == 0) return NS_OK;  // can't be after a br if we are at offset 0
   nsIDOMElement *rootElem = mEditor->GetRoot();
+
   nsCOMPtr<nsIDOMNode> root = do_QueryInterface(rootElem);
   NS_ENSURE_TRUE(root, NS_ERROR_NULL_POINTER);
-  if (parentNode != root) return NS_OK;
+  if (selNode != root) return NS_OK; // must be inside text node or somewhere other than end of root
 
-  nsCOMPtr<nsIDOMNode> nextNode = mEditor->GetChildAt(parentNode,
-                                                      parentOffset + 1);
-  if (nextNode && nsTextEditUtils::IsMozBR(nextNode))
+  nsCOMPtr<nsIDOMNode> temp = mEditor->GetChildAt(selNode, selOffset);
+  if (temp) return NS_OK; // can't be at end if there is a node after us.
+
+  nsCOMPtr<nsIDOMNode> nearNode = mEditor->GetChildAt(selNode, selOffset-1);
+  if (nearNode && nsTextEditUtils::IsBreak(nearNode) && !nsTextEditUtils::IsMozBR(nearNode))
   {
-    res = aSelection->Collapse(parentNode, parentOffset + 1);
+    nsCOMPtr<nsISelectionPrivate>selPrivate(do_QueryInterface(aSelection));
+    // need to insert special moz BR. Why?  Because if we don't
+    // the user will see no new line for the break.  Also, things
+    // like table cells won't grow in height.
+    nsCOMPtr<nsIDOMNode> brNode;
+    res = CreateMozBR(selNode, selOffset, address_of(brNode));
+    NS_ENSURE_SUCCESS(res, res);
+
+    res = nsEditor::GetNodeLocation(brNode, address_of(selNode), &selOffset);
+    NS_ENSURE_SUCCESS(res, res);
+    selPrivate->SetInterlinePosition(PR_TRUE);
+    res = aSelection->Collapse(selNode, selOffset);
     NS_ENSURE_SUCCESS(res, res);
   }
   return res;
@@ -658,7 +633,7 @@ nsTextEditRules::WillInsertText(PRInt32          aAction,
 
   // handle docs with a max length
   // NOTE, this function copies inString into outString for us.
-  nsresult res = TruncateInsertionIfNeeded(aSelection, inString, outString, aMaxLength, nsnull);
+  nsresult res = TruncateInsertionIfNeeded(aSelection, inString, outString, aMaxLength);
   NS_ENSURE_SUCCESS(res, res);
   
   PRUint32 start = 0;
@@ -773,32 +748,143 @@ nsTextEditRules::WillInsertText(PRInt32          aAction,
     nsCOMPtr<nsIDOMNode> curNode = selNode;
     PRInt32 curOffset = selOffset;
 
+    // is our text going to be PREformatted?  
+    // We remember this so that we know how to handle tabs.
+    PRBool isPRE;
+    res = mEditor->IsPreformatted(selNode, &isPRE);
+    NS_ENSURE_SUCCESS(res, res);    
+
     // don't spaz my selection in subtransactions
     nsAutoTxnsConserveSelection dontSpazMySelection(mEditor);
+    nsString tString(*outString);
+    const PRUnichar *unicodeBuf = tString.get();
+    nsCOMPtr<nsIDOMNode> unused;
+    PRInt32 pos = 0;
 
-    res = mEditor->InsertTextImpl(*outString, address_of(curNode),
-                                  &curOffset, doc);
-    NS_ENSURE_SUCCESS(res, res);
+    // for efficiency, break out the pre case separately.  This is because
+    // it's a lot cheaper to search the input string for only newlines than
+    // it is to search for both tabs and newlines.
+    if (isPRE)
+    {
+      while (unicodeBuf && (pos != -1) && ((PRUint32)pos < tString.Length()))
+      {
+        PRInt32 oldPos = pos;
+        PRInt32 subStrLen;
+        pos = tString.FindChar(nsCRT::LF, oldPos);
+        
+        if (pos != -1) 
+        {
+          subStrLen = pos - oldPos;
+          // if first char is newline, then use just it
+          if (subStrLen == 0)
+            subStrLen = 1;
+        }
+        else
+        {
+          subStrLen = tString.Length() - oldPos;
+          pos = tString.Length();
+        }
+
+        nsDependentSubstring subStr(tString, oldPos, subStrLen);
+        
+        // is it a return?
+        if (subStr.EqualsLiteral(LFSTR))
+        {
+          if (IsSingleLineEditor())
+          {
+            NS_ASSERTION((mEditor->mNewlineHandling == nsIPlaintextEditor::eNewlinesPasteIntact),
+                  "Newline improperly getting into single-line edit field!");
+            res = mEditor->InsertTextImpl(subStr, address_of(curNode), &curOffset, doc);
+          }
+          else
+          {
+            res = mEditor->CreateBRImpl(address_of(curNode), &curOffset, address_of(unused), nsIEditor::eNone);
+
+            // If the newline is the last character in the string, and the BR we
+            // just inserted is the last node in the content tree, we need to add
+            // a mozBR so that a blank line is created.
+
+            if (NS_SUCCEEDED(res) && curNode && pos == (PRInt32)(tString.Length() - 1))
+            {
+              nsCOMPtr<nsIDOMNode> nextChild = mEditor->GetChildAt(curNode, curOffset);
+
+              if (!nextChild)
+              {
+                // We must be at the end since there isn't a nextChild.
+                //
+                // curNode and curOffset should be set to the position after
+                // the BR we added above, so just create a mozBR at that position.
+                //
+                // Note that we don't update curOffset after we've created/inserted
+                // the mozBR since we never want the selection to be placed after it.
+
+                res = CreateMozBR(curNode, curOffset, address_of(unused));
+              }
+            }
+          }
+          pos++;
+        }
+        else
+        {
+          res = mEditor->InsertTextImpl(subStr, address_of(curNode), &curOffset, doc);
+        }
+        NS_ENSURE_SUCCESS(res, res);
+      }
+    }
+    else
+    {
+      char specialChars[] = {TAB, nsCRT::LF, 0};
+      while (unicodeBuf && (pos != -1) && ((PRUint32)pos < tString.Length()))
+      {
+        PRInt32 oldPos = pos;
+        PRInt32 subStrLen;
+        pos = tString.FindCharInSet(specialChars, oldPos);
+        
+        if (pos != -1) 
+        {
+          subStrLen = pos - oldPos;
+          // if first char is newline, then use just it
+          if (subStrLen == 0)
+            subStrLen = 1;
+        }
+        else
+        {
+          subStrLen = tString.Length() - oldPos;
+          pos = tString.Length();
+        }
+
+        nsDependentSubstring subStr(tString, oldPos, subStrLen);
+        
+        // is it a tab?
+        if (subStr.EqualsLiteral("\t"))
+        {
+          res = mEditor->InsertTextImpl(NS_LITERAL_STRING("    "), address_of(curNode), &curOffset, doc);
+          pos++;
+        }
+        // is it a return?
+        else if (subStr.EqualsLiteral(LFSTR))
+        {
+          res = mEditor->CreateBRImpl(address_of(curNode), &curOffset, address_of(unused), nsIEditor::eNone);
+          pos++;
+        }
+        else
+        {
+          res = mEditor->InsertTextImpl(subStr, address_of(curNode), &curOffset, doc);
+        }
+        NS_ENSURE_SUCCESS(res, res);
+      }
+    }
+    outString->Assign(tString);
 
     if (curNode) 
     {
+      aSelection->Collapse(curNode, curOffset);
+      
       // Make the caret attach to the inserted text, unless this text ends with a LF, 
       // in which case make the caret attach to the next line.
-      PRBool endsWithLF =
-        !outString->IsEmpty() && outString->Last() == nsCRT::LF;
+      PRBool endsWithLF = !tString.IsEmpty() && tString.get()[tString.Length() - 1] == nsCRT::LF;
       nsCOMPtr<nsISelectionPrivate>selPrivate(do_QueryInterface(aSelection));
       selPrivate->SetInterlinePosition(endsWithLF);
-
-      // If the last character is a linefeed character, make sure that we inject
-      // a BR element for correct caret positioning.
-      if (endsWithLF) {
-        nsCOMPtr<nsIDOMNode> mozBR;
-        res = CreateMozBR(curNode, curOffset, address_of(mozBR));
-        NS_ENSURE_SUCCESS(res, res);
-        curNode = mozBR;
-        curOffset = 0;
-      }
-      aSelection->Collapse(curNode, curOffset);
     }
   }
   ASSERT_PASSWORD_LENGTHS_EQUAL()
@@ -1272,16 +1358,12 @@ nsresult
 nsTextEditRules::TruncateInsertionIfNeeded(nsISelection *aSelection, 
                                            const nsAString  *aInString,
                                            nsAString  *aOutString,
-                                           PRInt32          aMaxLength,
-                                           PRBool *aTruncated)
+                                           PRInt32          aMaxLength)
 {
   if (!aSelection || !aInString || !aOutString) {return NS_ERROR_NULL_POINTER;}
   
   nsresult res = NS_OK;
   *aOutString = *aInString;
-  if (aTruncated) {
-    *aTruncated = PR_FALSE;
-  }
   
   if ((-1 != aMaxLength) && IsPlaintextEditor() && !mEditor->IsIMEComposing() )
   {
@@ -1314,9 +1396,6 @@ nsTextEditRules::TruncateInsertionIfNeeded(nsISelection *aSelection,
     if (resultingDocLength >= aMaxLength)
     {
       aOutString->Truncate();
-      if (aTruncated) {
-        *aTruncated = PR_TRUE;
-      }
     }
     else
     {
@@ -1324,9 +1403,6 @@ nsTextEditRules::TruncateInsertionIfNeeded(nsISelection *aSelection,
       if (inCount + resultingDocLength > aMaxLength)
       {
         aOutString->Truncate(aMaxLength - resultingDocLength);
-        if (aTruncated) {
-          *aTruncated = PR_TRUE;
-        }
       }
     }
   }
diff --git a/editor/libeditor/text/nsTextEditRules.h b/editor/libeditor/text/nsTextEditRules.h
index bd74bb44b624..ba1eadb4a5e6 100644
--- a/editor/libeditor/text/nsTextEditRules.h
+++ b/editor/libeditor/text/nsTextEditRules.h
@@ -160,8 +160,7 @@ protected:
   nsresult DidInsertText(nsISelection *aSelection, nsresult aResult);
   nsresult GetTopEnclosingPre(nsIDOMNode *aNode, nsIDOMNode** aOutPreNode);
 
-  nsresult WillInsertBreak(nsISelection *aSelection, PRBool *aCancel,
-                           PRBool *aHandled, PRInt32 aMaxLength);
+  nsresult WillInsertBreak(nsISelection *aSelection, PRBool *aCancel, PRBool *aHandled);
   nsresult DidInsertBreak(nsISelection *aSelection, nsresult aResult);
 
   nsresult WillInsert(nsISelection *aSelection, PRBool *aCancel);
@@ -219,8 +218,7 @@ protected:
   nsresult TruncateInsertionIfNeeded(nsISelection             *aSelection, 
                                      const nsAString          *aInString,
                                      nsAString                *aOutString,
-                                     PRInt32                   aMaxLength,
-                                     PRBool                   *aTruncated);
+                                     PRInt32                   aMaxLength);
 
   /** Remove IME composition text from password buffer */
   nsresult RemoveIMETextFromPWBuf(PRUint32 &aStart, nsAString *aIMEString);
@@ -235,8 +233,6 @@ protected:
 
   nsresult HideLastPWInput();
 
-  nsresult CollapseSelectionToTrailingBRIfNeeded(nsISelection *aSelection);
-
   PRBool IsPasswordEditor() const
   {
     return mEditor ? mEditor->IsPasswordEditor() : PR_FALSE;
diff --git a/editor/libeditor/text/tests/Makefile.in b/editor/libeditor/text/tests/Makefile.in
index ad7125d51628..98aa6f079400 100644
--- a/editor/libeditor/text/tests/Makefile.in
+++ b/editor/libeditor/text/tests/Makefile.in
@@ -47,7 +47,6 @@ include $(topsrcdir)/config/rules.mk
 _TEST_FILES = \
 		test_bug471722.html \
 		test_bug569988.html \
-		test_bug590554.html \
 		$(NULL)
 
 # disables the key handling test on gtk2 because gtk2 overrides some key events
diff --git a/editor/libeditor/text/tests/test_bug590554.html b/editor/libeditor/text/tests/test_bug590554.html
deleted file mode 100644
index 9fdff7480de5..000000000000
--- a/editor/libeditor/text/tests/test_bug590554.html
+++ /dev/null
@@ -1,37 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=590554
--->
-
-<head>
-  <title>Test for Bug 590554</title>
-  <script type="application/javascript" src="/MochiKit/packed.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>  
-</head>
-
-<body>
-
-  <script type="application/javascript">
-
-    /** Test for Bug 590554 **/
-
-    SimpleTest.waitForExplicitFinish();
-
-    SimpleTest.waitForFocus(function() {
-      var t = document.querySelector("textarea");
-      t.focus();
-      synthesizeKey("VK_ENTER", {});
-      is(t.value, "\n", "Pressing enter should work the first time");
-      synthesizeKey("VK_ENTER", {});
-      is(t.value, "\n", "Pressing enter should not work the second time");
-      SimpleTest.finish();
-    });
-
-  </script>
-
-  <textarea maxlength="1"></textarea>
-</body>
-</html>
diff --git a/editor/libeditor/text/tests/test_texteditor_keyevent_handling.html b/editor/libeditor/text/tests/test_texteditor_keyevent_handling.html
index 627ebd5bb290..1aa0d8ae0053 100644
--- a/editor/libeditor/text/tests/test_texteditor_keyevent_handling.html
+++ b/editor/libeditor/text/tests/test_texteditor_keyevent_handling.html
@@ -287,23 +287,13 @@ function runTests()
     synthesizeKey("VK_TAB", { });
     check(aDescription + "Tab",
           true, true, !aIsTabbable && !aIsReadonly);
-    is(aElement.value, !aIsTabbable && !aIsReadonly ? "a\t" : "a",
+    // The tab char is converted to 4 space characters because textarea/input
+    // elements are not preformatted editor.
+    is(aElement.value, !aIsTabbable && !aIsReadonly ? "a    " : "a",
        aDescription + "Tab");
     is(fm.focusedElement, aElement,
        aDescription + "focus moved unexpectedly (Tab)");
 
-    // If the editor is not tabbable, make sure that it accepts tab characters
-    // even if it's empty.
-    if (!aIsTabbable && !aIsReadonly) {
-      reset("");
-      synthesizeKey("VK_TAB", {});
-      check(aDescription + "Tab on empty textarea",
-            true, true, !aIsReadonly);
-      is(aElement.value, "\t", aDescription + "Tab on empty textarea");
-      is(fm.focusedElement, aElement,
-         aDescription + "focus moved unexpectedly (Tab on empty textarea");
-    }
-
     reset("a");
     synthesizeKey("VK_TAB", { shiftKey: true });
     check(aDescription + "Shift+Tab", true, true, false);
diff --git a/layout/base/tests/Makefile.in b/layout/base/tests/Makefile.in
index 83fef4b7d4b2..ff72f1e331fd 100644
--- a/layout/base/tests/Makefile.in
+++ b/layout/base/tests/Makefile.in
@@ -92,9 +92,6 @@ _TEST_FILES =	\
 		     bug106855-1.html \
 		     bug106855-2.html \
 		     bug106855-1-ref.html \
-		     bug240933-1.html \
-		     bug240933-2.html \
-		     bug240933-1-ref.html \
 		     bug482484.html \
 		     bug482484-ref.html \
 		     bug512295-1.html \
diff --git a/layout/base/tests/bug240933-1-ref.html b/layout/base/tests/bug240933-1-ref.html
deleted file mode 100644
index c3aa0a57e9cd..000000000000
--- a/layout/base/tests/bug240933-1-ref.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML><html>
-<body>
-<textarea id="t" rows="4">
-
-</textarea>
-<script>
-  document.getElementById("t").focus();
-</script>
-</body>
-</html>
diff --git a/layout/base/tests/bug240933-1.html b/layout/base/tests/bug240933-1.html
deleted file mode 100644
index c64ea3ac4a59..000000000000
--- a/layout/base/tests/bug240933-1.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<!DOCTYPE HTML><html><head>
-  <script type="text/javascript" src="/MochiKit/packed.js"></script>
-  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
-</head>
-<body>
-<textarea id="t" rows="4"></textarea>
-<script>
-  var area = document.getElementById('t');
-  area.focus();
-
-  sendKey('VK_ENTER'); // press Enter once
-</script>
-</body>
-</html>
diff --git a/layout/base/tests/bug240933-2.html b/layout/base/tests/bug240933-2.html
deleted file mode 100644
index 789b28542581..000000000000
--- a/layout/base/tests/bug240933-2.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<!DOCTYPE HTML><html><head>
-  <script type="text/javascript" src="/MochiKit/packed.js"></script>
-  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
-</head>
-<body>
-<textarea id="t" rows="4"></textarea>
-<script>
-  var area = document.getElementById('t');
-  area.focus();
-
-  sendKey('VK_ENTER'); // press Enter twice
-  sendKey('VK_ENTER');
-  sendKey('VK_BACK_SPACE'); // press Backspace once
-</script>
-</body>
-</html>
diff --git a/layout/base/tests/test_reftests_with_caret.html b/layout/base/tests/test_reftests_with_caret.html
index 2b54805ebbd5..e129684ebbc7 100644
--- a/layout/base/tests/test_reftests_with_caret.html
+++ b/layout/base/tests/test_reftests_with_caret.html
@@ -88,8 +88,6 @@ function endTest() {
 var tests = [
     [ 'bug106855-1.html' , 'bug106855-1-ref.html' ] ,
     [ 'bug106855-2.html' , 'bug106855-1-ref.html' ] ,
-    [ 'bug240933-1.html' , 'bug240933-1-ref.html' ] ,
-    [ 'bug240933-2.html' , 'bug240933-1-ref.html' ] ,
     [ 'bug482484.html'   , 'bug482484-ref.html'   ] ,
     [ 'bug512295-1.html' , 'bug512295-1-ref.html' ] ,
     [ 'bug512295-2.html' , 'bug512295-2-ref.html' ] ,
diff --git a/layout/forms/nsTextControlFrame.cpp b/layout/forms/nsTextControlFrame.cpp
index db7a72a590fa..2dac683f0622 100644
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -998,27 +998,51 @@ nsTextControlFrame::DOMPointToOffset(nsIDOMNode* aNode,
   if (!length || aNodeOffset < 0)
     return NS_OK;
 
-  NS_ASSERTION(length <= 2, "We should have one text node and one mozBR at most");
+  PRInt32 i, textOffset = 0;
+  PRInt32 lastIndex = (PRInt32)length - 1;
 
-  nsCOMPtr<nsIDOMNode> firstNode;
-  rv = nodeList->Item(0, getter_AddRefs(firstNode));
-  NS_ENSURE_SUCCESS(rv, rv);
-  nsCOMPtr<nsIDOMText> textNode = do_QueryInterface(firstNode);
+  for (i = 0; i < (PRInt32)length; i++) {
+    if (rootNode == aNode && i == aNodeOffset) {
+      *aResult = textOffset;
+      return NS_OK;
+    }
 
-  nsCOMPtr<nsIDOMText> nodeAsText = do_QueryInterface(aNode);
-  if (nodeAsText || (aNode == rootNode && aNodeOffset == 0)) {
-    // Selection is somewhere inside the text node; the offset is aNodeOffset
-    *aResult = aNodeOffset;
-  } else {
-    // Selection is on the mozBR node, so offset should be set to the length
-    // of the text node.
-    if (textNode) {
-      rv = textNode->GetLength(&length);
+    nsCOMPtr<nsIDOMNode> item;
+    rv = nodeList->Item(i, getter_AddRefs(item));
+    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ENSURE_TRUE(item, NS_ERROR_FAILURE);
+
+    nsCOMPtr<nsIDOMText> domText(do_QueryInterface(item));
+
+    if (domText) {
+      PRUint32 textLength = 0;
+
+      rv = domText->GetLength(&textLength);
       NS_ENSURE_SUCCESS(rv, rv);
-      *aResult = PRInt32(length);
+
+      if (item == aNode) {
+        NS_ASSERTION((aNodeOffset >= 0 && aNodeOffset <= (PRInt32)textLength),
+                     "Invalid aNodeOffset!");
+        *aResult = textOffset + aNodeOffset;
+        return NS_OK;
+      }
+
+      textOffset += textLength;
+    }
+    else {
+      // Must be a BR node. If it's not the last BR node
+      // under the root, count it as a newline.
+
+      if (i != lastIndex)
+        ++textOffset;
     }
   }
 
+  NS_ASSERTION((aNode == rootNode && aNodeOffset == (PRInt32)length),
+               "Invalid node offset!");
+
+  *aResult = textOffset;
+  
   return NS_OK;
 }
 
@@ -1050,25 +1074,71 @@ nsTextControlFrame::OffsetToDOMPoint(PRInt32 aOffset,
   rv = nodeList->GetLength(&length);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  NS_ASSERTION(length <= 2, "We should have one text node and one mozBR at most");
-
-  nsCOMPtr<nsIDOMNode> firstNode;
-  rv = nodeList->Item(0, getter_AddRefs(firstNode));
-  NS_ENSURE_SUCCESS(rv, rv);
-  nsCOMPtr<nsIDOMText> textNode = do_QueryInterface(firstNode);
-
-  if (length == 0 || aOffset < 0) {
-    NS_IF_ADDREF(*aResult = rootNode);
-    *aPosition = 0;
-  } else if (textNode) {
-    NS_IF_ADDREF(*aResult = firstNode);
-    *aPosition = aOffset;
-  } else {
-    NS_IF_ADDREF(*aResult = rootNode);
+  if (!length || aOffset < 0) {
     *aPosition = 0;
+    *aResult = rootNode;
+    NS_ADDREF(*aResult);
+    return NS_OK;
   }
 
-  return NS_OK;
+  PRInt32 textOffset = 0;
+  PRUint32 lastIndex = length - 1;
+
+  for (PRUint32 i=0; i<length; i++) {
+    nsCOMPtr<nsIDOMNode> item;
+    rv = nodeList->Item(i, getter_AddRefs(item));
+    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ENSURE_TRUE(item, NS_ERROR_FAILURE);
+
+    nsCOMPtr<nsIDOMText> domText(do_QueryInterface(item));
+
+    if (domText) {
+      PRUint32 textLength = 0;
+
+      rv = domText->GetLength(&textLength);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      // Check if aOffset falls within this range.
+      if (aOffset >= textOffset && aOffset <= textOffset+(PRInt32)textLength) {
+        *aPosition = aOffset - textOffset;
+        *aResult = item;
+        NS_ADDREF(*aResult);
+        return NS_OK;
+      }
+
+      textOffset += textLength;
+
+      // If there aren't any more siblings after this text node,
+      // return the point at the end of this text node!
+
+      if (i == lastIndex) {
+        *aPosition = textLength;
+        *aResult = item;
+        NS_ADDREF(*aResult);
+        return NS_OK;
+      }
+    }
+    else {
+      // Must be a BR node, count it as a newline.
+
+      if (aOffset == textOffset || i == lastIndex) {
+        // We've found the correct position, or aOffset takes us
+        // beyond the last child under rootNode, just return the point
+        // under rootNode that is in front of this br.
+
+        *aPosition = i;
+        *aResult = rootNode;
+        NS_ADDREF(*aResult);
+        return NS_OK;
+      }
+
+      ++textOffset;
+    }
+  }
+
+  NS_ERROR("We should never get here!");
+
+  return NS_ERROR_FAILURE;
 }
 
 NS_IMETHODIMP
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index b5bb78d707d8..4d073ef6cfe7 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -5219,7 +5219,6 @@ nsIFrame::PeekOffset(nsPeekOffsetStruct* aPos)
     {
       PRBool eatingNonRenderableWS = PR_FALSE;
       PRBool done = PR_FALSE;
-      PRBool jumpedLine = PR_FALSE;
       
       while (!done) {
         PRBool movingInFrameDirection =
@@ -5231,6 +5230,7 @@ nsIFrame::PeekOffset(nsPeekOffsetStruct* aPos)
           done = current->PeekOffsetCharacter(movingInFrameDirection, &offset); 
 
         if (!done) {
+          PRBool jumpedLine;
           result =
             current->GetFrameFromDirection(aPos->mDirection, aPos->mVisual,
                                            aPos->mJumpLines, aPos->mScrollViewStop,
@@ -5251,15 +5251,6 @@ nsIFrame::PeekOffset(nsPeekOffsetStruct* aPos)
       aPos->mResultContent = range.content;
       // Output offset is relative to content, not frame
       aPos->mContentOffset = offset < 0 ? range.end : range.start + offset;
-      // If we're dealing with a text frame and moving backward positions us at
-      // the end of that line, decrease the offset by one to make sure that
-      // we're placed before the linefeed character on the previous line.
-      if (offset < 0 && jumpedLine &&
-          aPos->mDirection == eDirPrevious &&
-          current->GetStyleText()->NewlineIsSignificant() &&
-          current->HasTerminalNewline()) {
-        --aPos->mContentOffset;
-      }
       
       break;
     }
diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
index 98b92b1cb12a..4ae237585904 100644
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -1635,14 +1635,6 @@ public:
                                    PRUint32 aSkippedMaxLength = PR_UINT32_MAX)
   { return NS_ERROR_NOT_IMPLEMENTED; }
 
-  /**
-   * Returns true if the frame contains any non-collapsed characters.
-   * This method is only available for text frames, and it will return false
-   * for all other frame types.
-   */
-  virtual PRBool HasAnyNoncollapsedCharacters()
-  { return PR_FALSE; }
-
   /**
    * Accessor functions to get/set the associated view object
    *
diff --git a/layout/generic/nsTextFrame.h b/layout/generic/nsTextFrame.h
index acd26537791a..e2275096490b 100644
--- a/layout/generic/nsTextFrame.h
+++ b/layout/generic/nsTextFrame.h
@@ -460,8 +460,6 @@ protected:
                    PRBool aForInsertionPoint);
 
   void ClearFrameOffsetCache();
-
-  virtual PRBool HasAnyNoncollapsedCharacters();
 };
 
 #endif
diff --git a/layout/generic/nsTextFrameThebes.cpp b/layout/generic/nsTextFrameThebes.cpp
index 8dd3924c0d37..7f698d207d94 100644
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -5062,13 +5062,6 @@ nsTextFrame::GetCharacterOffsetAtFramePointInternal(const nsPoint &aPoint,
     // intrinsic widths.
     selectedOffset =
         provider.GetStart().GetOriginalOffset() + provider.GetOriginalLength();
-    // If we're at the end of a preformatted line which has a terminating
-    // linefeed, we want to reduce the offset by one to make sure that the
-    // selection is placed before the linefeed character.
-    if (GetStyleText()->NewlineIsSignificant() &&
-        HasTerminalNewline()) {
-      --selectedOffset;
-    }
   }
 
   offsets.content = GetContent();
@@ -5432,7 +5425,8 @@ IsAcceptableCaretPosition(const gfxSkipCharsIterator& aIter, gfxTextRun* aTextRu
   PRUint32 index = aIter.GetSkippedOffset();
   if (!aTextRun->IsClusterStart(index))
     return PR_FALSE;
-  return PR_TRUE;
+  return !(aFrame->GetStyleText()->NewlineIsSignificant() &&
+           aTextRun->GetChar(index) == '\n');
 }
 
 PRBool
@@ -5457,8 +5451,8 @@ nsTextFrame::PeekOffsetCharacter(PRBool aForward, PRInt32* aOffset)
   PRInt32 startOffset = GetContentOffset() + (*aOffset < 0 ? contentLength : *aOffset);
 
   if (!aForward) {
-    // If at the beginning of the line, look at the previous continuation
-    for (PRInt32 i = NS_MIN(trimmed.GetEnd(), startOffset) - 1;
+    PRInt32 i;
+    for (i = NS_MIN(trimmed.GetEnd(), startOffset) - 1;
          i >= trimmed.mStart; --i) {
       iter.SetOriginalOffset(i);
       if (IsAcceptableCaretPosition(iter, mTextRun, this)) {
@@ -5468,19 +5462,16 @@ nsTextFrame::PeekOffsetCharacter(PRBool aForward, PRInt32* aOffset)
     }
     *aOffset = 0;
   } else {
-    // If we're at the end of a line, look at the next continuation
-    iter.SetOriginalOffset(startOffset);
-    if (iter.GetSkippedOffset() <= PRUint32(trimmed.GetEnd()) &&
-        !(iter.GetSkippedOffset() < PRUint32(trimmed.GetEnd()) &&
-          GetStyleText()->NewlineIsSignificant() &&
-          mTextRun->GetChar(iter.GetSkippedOffset()) == '\n')) {
-      for (PRInt32 i = startOffset + 1; i <= trimmed.GetEnd(); ++i) {
-        iter.SetOriginalOffset(i);
-        if (i == trimmed.GetEnd() ||
-            IsAcceptableCaretPosition(iter, mTextRun, this)) {
-          *aOffset = i - mContentOffset;
-          return PR_TRUE;
-        }
+    PRInt32 i;
+    for (i = startOffset + 1; i <= trimmed.GetEnd(); ++i) {
+      iter.SetOriginalOffset(i);
+      // XXX we can't necessarily stop at the end of this frame,
+      // but we really have no choice right now. We need to do a deeper
+      // fix/restructuring of PeekOffsetCharacter
+      if (i == trimmed.GetEnd() ||
+          IsAcceptableCaretPosition(iter, mTextRun, this)) {
+        *aOffset = i - mContentOffset;
+        return PR_TRUE;
       }
     }
     *aOffset = contentLength;
@@ -7131,14 +7122,3 @@ nsTextFrame::IsAtEndOfLine() const
 {
   return (GetStateBits() & TEXT_END_OF_LINE) != 0;
 }
-
-PRBool
-nsTextFrame::HasAnyNoncollapsedCharacters()
-{
-  gfxSkipCharsIterator iter = EnsureTextRun();
-  PRInt32 offset = GetContentOffset(),
-          offsetEnd = GetContentEnd();
-  PRInt32 skippedOffset = iter.ConvertOriginalToSkipped(offset);
-  PRInt32 skippedOffsetEnd = iter.ConvertOriginalToSkipped(offsetEnd);
-  return skippedOffset != skippedOffsetEnd;
-}
diff --git a/layout/generic/test/Makefile.in b/layout/generic/test/Makefile.in
index 44e456b47658..2b0dc6c5fe11 100644
--- a/layout/generic/test/Makefile.in
+++ b/layout/generic/test/Makefile.in
@@ -58,7 +58,6 @@ _TEST_FILES = \
 		plugin_clipping_lib.js \
 		plugin_focus_helper.html \
 		test_backspace_delete.xul \
-		test_bug240933.html \
 		test_bug263683.html \
 		test_bug288789.html \
 		test_bug290397.html \
diff --git a/layout/generic/test/test_bug240933.html b/layout/generic/test/test_bug240933.html
deleted file mode 100644
index e8d7ffde9d94..000000000000
--- a/layout/generic/test/test_bug240933.html
+++ /dev/null
@@ -1,68 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=240933
--->
-
-<head>
-  <title>Test for Bug 240933</title>
-  <script type="application/javascript" src="/MochiKit/MochiKit.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-
-<body>
-  <a target="_blank"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=240933">
-    Mozilla Bug 240933
-  </a>
-  <p id="display"></p>
-  <div id="content" style="display: none">
-  </div>
-
-  <pre id="test">
-    <script type="application/javascript">
-
-      /** Test for Bug 240933 **/
-
-      SimpleTest.waitForExplicitFinish();
-
-      SimpleTest.waitForFocus(function() {
-        var t = document.getElementById("t");
-        synthesizeMouse(t, t.clientWidth / 2, 5, {}, window);
-        is(t.selectionStart, 3, "The selection should be set before the newline");
-        is(t.selectionEnd,   3, "The selection should be set before the newline");
-
-        t = document.getElementById("ta");
-        t.focus();
-        var val = t.value;
-        synthesizeKey("VK_ENTER", {});
-        is(t.value, val + "\n", "Pressing enter right after focusing the textarea should work");
-
-        t = document.getElementById("tb");
-        t.focus();
-        synthesizeKey("VK_ENTER", {});
-        is(t.value, "\n", "Pressing enter for the first time should work");
-        synthesizeKey("VK_ENTER", {});
-        is(t.value, "\n\n", "Pressing enter for the second time should work");
-        synthesizeKey("VK_BACK_SPACE", {});
-        is(t.value, "\n", "Pressing backspace for the first time should work");
-        synthesizeKey("VK_BACK_SPACE", {});
-        is(t.value, "", "Pressing backspace for the second time should work");
-        SimpleTest.finish();
-      });
-
-    </script>
-  </pre>
-
-  <textarea id="t" rows="10" cols="10">abc
-</textarea>
-  <textarea id="ta" rows="10" cols="10">
-test
-
-</textarea>
-  <textarea id="tb" rows="10" cols="10"></textarea>
-
-</body>
-</html>
diff --git a/layout/generic/test/test_bug288789.html b/layout/generic/test/test_bug288789.html
index e21f2d4ee722..5e2f15f6272c 100644
--- a/layout/generic/test/test_bug288789.html
+++ b/layout/generic/test/test_bug288789.html
@@ -18,11 +18,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=288789
 
 &#x05d0;a&#x05d1;
 
-</textarea>
-<textarea id="tb">
-
-abc
-
 </textarea>
 </div>
 <pre id="test">
@@ -55,59 +50,9 @@ function test() {
 
   textarea.focus();
   collapse(0);
-  ok(true, "Testing forward movement in RTL mode");
-  for (var i = 0; i < textarea.textContent.length; ++i) {
-    if (i == 0) {
-      testRight(i);
-    }
-    if (textarea.textContent[i] == 'a') {
-      testLeft(i);
-    } else {
-      testLeft(i + 1);
-    }
-    if (i == textarea.textContent.length - 1) {
-      testLeft(i + 1);
-    }
-  }
-  ok(true, "Testing backward movement in RTL mode");
-  for (var i = textarea.textContent.length; i > 0; --i) {
-    if (i == textarea.textContent.length) {
-      testLeft(i);
-    }
-    if (i > 0 && textarea.textContent[i - 1] == 'a') {
-      testRight(i);
-    } else {
-      testRight(i - 1);
-    }
-    if (i == 1) {
-      testRight(i - 1);
-    }
-  }
-
-  textarea = $("tb");
-  textarea.focus();
-  collapse(0);
-  ok(true, "Testing forward movement in LTR mode");
-  for (var i = 0; i < textarea.textContent.length; ++i) {
-    if (i == 0) {
-      testLeft(i);
-    }
-    testRight(i + 1);
-    if (i == textarea.textContent.length - 1) {
-      testRight(i + 1);
-    }
-  }
-  ok(true, "Testing backward movement in LTR mode");
-  for (var i = textarea.textContent.length; i > 0; --i) {
-    if (i == textarea.textContent.length) {
-      testRight(i);
-    }
-    testLeft(i - 1);
-    if (i == 1) {
-      testLeft(i - 1);
-    }
-  }
-
+  testLeft(1);
+  collapse(5);
+  testRight(4);
   SimpleTest.finish();
 }
 
diff --git a/layout/generic/test/test_movement_by_characters.html b/layout/generic/test/test_movement_by_characters.html
index 61fff0865e08..b8a0c4f616eb 100644
--- a/layout/generic/test/test_movement_by_characters.html
+++ b/layout/generic/test/test_movement_by_characters.html
@@ -68,13 +68,13 @@ function test() {
   editor.innerHTML = "<pre>aa\nbb</pre>";
   sel.collapse(editor.firstChild.firstChild, 0);
   testRight(editor.firstChild.firstChild, 1);
-  // at the end of the first line, before the \n
-  testRight(editor.firstChild.firstChild, 2);
+  // at the 'bb' but HINTLEFT so appears at the end of the first line
+  testRight(editor.firstChild.firstChild, 3);  
   testRight(editor.firstChild.firstChild, 3);
   testRight(editor.firstChild.firstChild, 4);
   testLeft(editor.firstChild.firstChild, 3);
-  // at the end of the first line, before the \n
-  testLeft(editor.firstChild.firstChild, 2);
+  // at the 'bb' but HINTLEFT so appears at the end of the first line
+  testLeft(editor.firstChild.firstChild, 3);
   testLeft(editor.firstChild.firstChild, 1);
   testLeft(editor.firstChild.firstChild, 0);
 
diff --git a/layout/reftests/bugs/240933-1-ref.html b/layout/reftests/bugs/240933-1-ref.html
deleted file mode 100644
index 0d727af3a286..000000000000
--- a/layout/reftests/bugs/240933-1-ref.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body onload="setup()">
-<textarea id="ta" dir="rtl">
-
-&#x05d0;a&#x05d1;
-
-</textarea>
-<textarea id="tb">
-
-abc
-
-</textarea>
-
-<div id="coords1"></div>
-<div id="coords2"></div>
-
-<script>
-  function setup() {
-    document.getElementById("coords1").innerHTML = document.getElementById("ta").selectionStart;
-    document.getElementById("coords2").innerHTML = document.getElementById("tb").selectionStart;
-  }
-</script>
-</body>
-</html>
diff --git a/layout/reftests/bugs/240933-1.html b/layout/reftests/bugs/240933-1.html
deleted file mode 100644
index e180c5f484de..000000000000
--- a/layout/reftests/bugs/240933-1.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body>
-<textarea id="ta" dir="rtl">
-
-&#x05d0;a&#x05d1;
-
-</textarea>
-<textarea id="tb">
-
-abc
-
-</textarea>
-
-<div id="coords1">6</div>
-<div id="coords2">6</div>
-
-</body>
-</html>
diff --git a/layout/reftests/bugs/240933-2-ref.html b/layout/reftests/bugs/240933-2-ref.html
deleted file mode 100644
index 7dbc082a58a5..000000000000
--- a/layout/reftests/bugs/240933-2-ref.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body onload="setup()">
-<textarea id="ta" dir="rtl">
-
-&#x05d0;a&#x05d1;
-
-</textarea>
-<textarea id="tb">
-
-abc
-
-</textarea>
-
-<div id="coords1"></div>
-<div id="coords2"></div>
-
-<script>
-  function setup() {
-    document.getElementById("ta").selectionStart = 3;
-    document.getElementById("ta").selectionEnd = 3;
-    document.getElementById("coords1").innerHTML = document.getElementById("ta").selectionStart;
-    document.getElementById("tb").selectionStart = 3;
-    document.getElementById("tb").selectionEnd = 3;
-    document.getElementById("coords2").innerHTML = document.getElementById("tb").selectionStart;
-  }
-</script>
-</body>
-</html>
diff --git a/layout/reftests/bugs/240933-2.html b/layout/reftests/bugs/240933-2.html
deleted file mode 100644
index 0fb9b9d5069c..000000000000
--- a/layout/reftests/bugs/240933-2.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body>
-<textarea id="ta" dir="rtl">
-
-&#x05d0;a&#x05d1;
-
-</textarea>
-<textarea id="tb">
-
-abc
-
-</textarea>
-
-<div id="coords1">3</div>
-<div id="coords2">3</div>
-
-</body>
-</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 204fe7060443..19987537fe57 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -205,8 +205,6 @@ random == 99850-1b.html 99850-1-ref.html # bug 471629
 == 236539-1.html 236539-1-ref.html
 == 240029-1.html 240029-1-ref.html
 == 240470-1.html 240470-1-ref.html
-== 240933-1.html 240933-1-ref.html
-== 240933-2.html 240933-2-ref.html
 == 243266-1.html 243266-1-ref.html
 == 243302-1.html 243302-1-ref.html
 == 243519-1.html 243519-1-ref.html
diff --git a/layout/reftests/editor/caret_on_textarea_lastline-ref.html b/layout/reftests/editor/caret_on_textarea_lastline-ref.html
deleted file mode 100644
index 6acd3d9b90e7..000000000000
--- a/layout/reftests/editor/caret_on_textarea_lastline-ref.html
+++ /dev/null
@@ -1,6 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body onload="document.querySelector('textarea').focus();">
-<textarea>foo</textarea>
-</body>
-</html>
diff --git a/layout/reftests/editor/caret_on_textarea_lastline.html b/layout/reftests/editor/caret_on_textarea_lastline.html
deleted file mode 100644
index 35973aa82858..000000000000
--- a/layout/reftests/editor/caret_on_textarea_lastline.html
+++ /dev/null
@@ -1,7 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body onload="document.querySelector('textarea').focus();">
-<textarea>foo
-</textarea>
-</body>
-</html>
diff --git a/layout/reftests/editor/reftest.list b/layout/reftests/editor/reftest.list
index f95fdeaacbc4..8a65c717a1f2 100644
--- a/layout/reftests/editor/reftest.list
+++ b/layout/reftests/editor/reftest.list
@@ -18,4 +18,3 @@ include xul/reftest.list
 == emptypasswd-2.html emptypasswd-ref.html
 == caret_on_positioned.html caret_on_positioned-ref.html
 == spellcheck-1.html spellcheck-ref.html
-!= caret_on_textarea_lastline.html caret_on_textarea_lastline-ref.html

From 3313bd2660158cff224e120fee2bd8ce57f1d947 Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nz>
Date: Fri, 3 Sep 2010 12:03:03 +1200
Subject: [PATCH 070/222] Bug 485288 - Update media load algorithm. r=roc
 a=blocking2.0

---
 .../html/content/public/nsHTMLMediaElement.h  |  75 +++--
 .../html/content/src/nsHTMLMediaElement.cpp   | 315 +++++++++++-------
 content/media/nsBuiltinDecoder.cpp            |   6 +-
 content/media/test/test_constants.html        |  27 +-
 content/media/test/test_decode_error.html     |   3 +-
 content/media/test/test_decoder_disable.html  |  30 +-
 content/media/test/test_info_leak.html        |   9 +-
 content/media/test/test_load.html             |   9 +-
 content/media/test/test_load_candidates.html  |   8 +-
 content/media/test/test_preload_actions.html  |  39 ++-
 content/media/test/test_source_write.html     |   4 +-
 content/media/wave/nsWaveDecoder.cpp          |   7 +-
 .../html/nsIDOMHTMLMediaElement.idl           |   5 +-
 parser/html/nsHtml5TreeBuilderCppSupplement.h |   4 +-
 widget/public/nsIAppShell.idl                 |  14 +-
 widget/src/xpwidgets/nsBaseAppShell.cpp       |  37 ++
 widget/src/xpwidgets/nsBaseAppShell.h         |   7 +
 17 files changed, 373 insertions(+), 226 deletions(-)

diff --git a/content/html/content/public/nsHTMLMediaElement.h b/content/html/content/public/nsHTMLMediaElement.h
index 1fae80cafc0a..ee8b34000511 100644
--- a/content/html/content/public/nsHTMLMediaElement.h
+++ b/content/html/content/public/nsHTMLMediaElement.h
@@ -117,9 +117,6 @@ public:
   virtual void UnbindFromTree(PRBool aDeep = PR_TRUE,
                               PRBool aNullParent = PR_TRUE);
 
-  virtual PRBool IsDoneAddingChildren();
-  virtual nsresult DoneAddingChildren(PRBool aHaveNotified);
-
   /**
    * Call this to reevaluate whether we should start/stop due to our owner
    * document being active or inactive.
@@ -149,6 +146,10 @@ public:
   // resource has a decode error during metadata loading or decoding.
   void DecodeError();
 
+  // Called by the video decoder object, on the main thread, when the
+  // resource load has been cancelled.
+  void LoadAborted();
+
   // Called by the video decoder object, on the main thread,
   // when the video playback has ended.
   void PlaybackEnded();
@@ -280,7 +281,7 @@ public:
 
   /**
    * Called when a child source element is added to this media element. This
-   * may queue a load() task if appropriate.
+   * may queue a task to run the select resource algorithm if appropriate.
    */
   void NotifyAddedSource();
 
@@ -333,8 +334,6 @@ public:
 
 protected:
   class MediaLoadListener;
-  class LoadNextSourceEvent;
-  class SelectResourceEvent;
 
   /**
    * Changes mHasPlayedOrSeeked to aValue. If mHasPlayedOrSeeked changes
@@ -388,23 +387,25 @@ protected:
 
   /**
    * Attempts to load resources from the <source> children. This is a
-   * substep of the media selection algorith. Do not call this directly,
+   * substep of the resource selection algorithm. Do not call this directly,
    * call QueueLoadFromSourceTask() instead.
    */
   void LoadFromSourceChildren();
 
   /**
-   * Sends an async event to call LoadFromSourceChildren().
+   * Asynchronously awaits a stable state, and then causes
+   * LoadFromSourceChildren() to be called on the main threads' event loop.
    */
   void QueueLoadFromSourceTask();
 
   /**
-   * Media selection algorithm.
+   * Runs the media resource selection algorithm.
    */
   void SelectResource();
 
   /**
-   * Sends an async event to call SelectResource().
+   * Asynchronously awaits a stable state, and then causes SelectResource()
+   * to be run on the main thread's event loop.
    */
   void QueueSelectResourceTask();
 
@@ -415,9 +416,10 @@ protected:
 
   /**
    * Selects the next <source> child from which to load a resource. Called
-   * during the media selection algorithm.
+   * during the resource selection algorithm. Stores the return value in
+   * mSourceLoadCandidate before returning.
    */
-  already_AddRefed<nsIURI> GetNextSource();
+  nsIContent* GetNextSource();
 
   /**
    * Changes mDelayingLoadEvent, and will call BlockOnLoad()/UnblockOnLoad()
@@ -493,6 +495,17 @@ protected:
    */
   void UpdatePreloadAction();
 
+  /**
+   * Dispatches an error event to a child source element.
+   */
+  void DispatchAsyncSourceError(nsIContent* aSourceElement);
+
+  /**
+   * Resets the media element for an error condition as per aErrorCode.
+   * aErrorCode must be one of nsIDOMHTMLMediaError codes.
+   */
+  void Error(PRUint16 aErrorCode);
+
   nsRefPtr<nsMediaDecoder> mDecoder;
 
   // A reference to the ImageContainer which contains the current frame
@@ -527,18 +540,19 @@ protected:
   nsMediaReadyState mReadyState;
 
   enum LoadAlgorithmState {
-    // Not waiting for any src/<source>.
+    // No load algorithm instance is waiting for a source to be added to the
+    // media in order to continue loading.
     NOT_WAITING,
-    // No src or <source> children, load is waiting at load algorithm step 1.
-    WAITING_FOR_SRC_OR_SOURCE,
-    // No src at load time, and all <source> children don't resolve or
-    // give network errors during fetch, waiting for more <source> children
-    // to be added.
+    // We've run the load algorithm, and we tried all source children of the 
+    // media element, and failed to load any successfully. We're waiting for
+    // another source element to be added to the media element, and will try
+    // to load any such element when its added.
     WAITING_FOR_SOURCE
   };
 
-  // When the load algorithm is waiting for more src/<source>, this denotes
-  // what type of waiting we're doing.
+  // Denotes the waiting state of a load algorithm instance. When the load
+  // algorithm is waiting for a source element child to be added, this is set
+  // to WAITING_FOR_SOURCE, otherwise it's NOT_WAITING.
   LoadAlgorithmState mLoadWaitStatus;
 
   // Current audio volume
@@ -550,11 +564,12 @@ protected:
   // Current audio sample rate.
   PRUint32 mRate;
 
-  // If we're loading a preload:none media, we'll record the URI we're
-  // attempting to load in mPreloadURI, and delay loading the resource until
-  // the user initiates a load by either playing the resource, or explicitly
-  // loading it.
-  nsCOMPtr<nsIURI> mPreloadURI;
+  // URI of the resource we're attempting to load. When the decoder is
+  // successfully initialized, we rely on it to record the URI we're playing,
+  // and clear mLoadingSrc. This stores the value we return in the currentSrc
+  // attribute until the decoder is initialized. Use GetCurrentSrc() to access
+  // the currentSrc attribute.
+  nsCOMPtr<nsIURI> mLoadingSrc;
   
   // Stores the current preload action for this element. Initially set to
   // PRELOAD_UNDEFINED, its value is changed by calling
@@ -562,11 +577,15 @@ protected:
   PreloadAction mPreloadAction;
 
   // Size of the media. Updated by the decoder on the main thread if
-  // it changes. Defaults to a width and height of -1 if not set.
+  // it changes. Defaults to a width and height of -1 inot set.
   nsIntSize mMediaSize;
 
   nsRefPtr<gfxASurface> mPrintSurface;
 
+  // Reference to the source element last returned by GetNextSource().
+  // This is the child source element which we're trying to load from.
+  nsCOMPtr<nsIContent> mSourceLoadCandidate;
+
   // An audio stream for writing audio directly from JS.
   nsAutoPtr<nsAudioStream> mAudioStream;
 
@@ -604,10 +623,6 @@ protected:
   // True if the sound is muted
   PRPackedBool mMuted;
 
-  // Flag to indicate if the child elements (eg. <source/>) have been
-  // parsed.
-  PRPackedBool mIsDoneAddingChildren;
-
   // If TRUE then the media element was actively playing before the currently
   // in progress seeking. If FALSE then the media element is either not seeking
   // or was not actively playing before the current seek. Used to decide whether
diff --git a/content/html/content/src/nsHTMLMediaElement.cpp b/content/html/content/src/nsHTMLMediaElement.cpp
index 6289ffaf392e..782a548ba622 100644
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@@ -57,6 +57,7 @@
 #include "nsXPCOMStrings.h"
 #include "prlock.h"
 #include "nsThreadUtils.h"
+#include "nsIThreadInternal.h"
 #include "nsContentUtils.h"
 #include "nsFrameManager.h"
 
@@ -88,6 +89,8 @@
 #include <limits>
 #include "nsIDocShellTreeItem.h"
 #include "nsIAsyncVerifyRedirectCallback.h"
+#include "nsIAppShell.h"
+#include "nsWidgetsCID.h"
 
 #include "nsIPrivateDOMEvent.h"
 #include "nsIDOMNotifyAudioAvailableEvent.h"
@@ -209,50 +212,31 @@ public:
   }
 };
 
-class nsHTMLMediaElement::LoadNextSourceEvent : public nsMediaEvent {
+class nsSourceErrorEventRunner : public nsMediaEvent
+{
+private:
+  nsCOMPtr<nsIContent> mSource;
 public:
-  LoadNextSourceEvent(nsHTMLMediaElement *aElement)
-    : nsMediaEvent(aElement) {}
+  nsSourceErrorEventRunner(nsHTMLMediaElement* aElement,
+                           nsIContent* aSource)
+    : nsMediaEvent(aElement),
+      mSource(aSource)
+  {
+  }
+
   NS_IMETHOD Run() {
-    if (!IsCancelled())
-      mElement->LoadFromSourceChildren();
-    return NS_OK;
+    // Silently cancel if our load has been cancelled.
+    if (IsCancelled())
+      return NS_OK;
+    LOG_EVENT(PR_LOG_DEBUG, ("%p Dispatching simple event source error", mElement.get()));
+    return nsContentUtils::DispatchTrustedEvent(mElement->GetOwnerDoc(),
+                                                mSource,
+                                                NS_LITERAL_STRING("error"),
+                                                PR_TRUE,
+                                                PR_TRUE);
   }
 };
 
-class nsHTMLMediaElement::SelectResourceEvent : public nsMediaEvent {
-public:
-  SelectResourceEvent(nsHTMLMediaElement *aElement)
-    : nsMediaEvent(aElement) {}
-  NS_IMETHOD Run() {
-    if (!IsCancelled()) {
-      NS_ASSERTION(mElement->mIsRunningSelectResource,
-                   "Should have flagged that we're running SelectResource()");
-      mElement->SelectResource();
-      mElement->mIsRunningSelectResource = PR_FALSE;
-    }
-    return NS_OK;
-  }
-};
-
-void nsHTMLMediaElement::QueueSelectResourceTask()
-{
-  // Don't allow multiple async select resource calls to be queued.
-  if (mIsRunningSelectResource)
-    return;
-  mIsRunningSelectResource = PR_TRUE;
-  ChangeDelayLoadStatus(PR_TRUE);
-  nsCOMPtr<nsIRunnable> event = new SelectResourceEvent(this);
-  NS_DispatchToMainThread(event);
-}
-
-void nsHTMLMediaElement::QueueLoadFromSourceTask()
-{
-  ChangeDelayLoadStatus(PR_TRUE);
-  nsCOMPtr<nsIRunnable> event = new LoadNextSourceEvent(this);
-  NS_DispatchToMainThread(event);
-}
-
 /**
  * There is a reference cycle involving this class: MediaLoadListener
  * holds a reference to the nsHTMLMediaElement, which holds a reference
@@ -441,6 +425,8 @@ NS_IMETHODIMP nsHTMLMediaElement::GetCurrentSrc(nsAString & aCurrentSrc)
     if (stream) {
       stream->URI()->GetSpec(src);
     }
+  } else if (mLoadingSrc) {
+    mLoadingSrc->GetSpec(src);
   }
 
   aCurrentSrc = NS_ConvertUTF8toUTF16(src);
@@ -504,7 +490,6 @@ void nsHTMLMediaElement::AbortExistingLoads()
   if (mNetworkState == nsIDOMHTMLMediaElement::NETWORK_LOADING ||
       mNetworkState == nsIDOMHTMLMediaElement::NETWORK_IDLE)
   {
-    mError = new nsMediaError(nsIDOMMediaError::MEDIA_ERR_ABORTED);
     DispatchProgressEvent(NS_LITERAL_STRING("abort"));
   }
 
@@ -551,6 +536,62 @@ void nsHTMLMediaElement::NoSupportedMediaSourceError()
   ChangeDelayLoadStatus(PR_FALSE);
 }
 
+typedef void (nsHTMLMediaElement::*SyncSectionFn)();
+
+// Runs a "synchronous section", a function that must run once the event loop
+// has reached a "stable state". See:
+// http://www.whatwg.org/specs/web-apps/current-work/multipage/webappapis.html#synchronous-section
+class nsSyncSection : public nsMediaEvent
+{
+private:
+  SyncSectionFn mClosure;
+public:
+  nsSyncSection(nsHTMLMediaElement* aElement,
+                SyncSectionFn aClosure) :
+    nsMediaEvent(aElement),
+    mClosure(aClosure)
+  {
+  }
+
+  NS_IMETHOD Run() {
+    // Silently cancel if our load has been cancelled.
+    if (IsCancelled())
+      return NS_OK;
+    (mElement.get()->*mClosure)();
+    return NS_OK;
+  }
+};
+
+static NS_DEFINE_CID(kAppShellCID, NS_APPSHELL_CID);
+
+// Asynchronously awaits a stable state, whereupon aClosure runs on the main
+// thread. This adds an event which run aClosure to the appshell's list of 
+// sections synchronous the next time control returns to the event loop.
+void AsyncAwaitStableState(nsHTMLMediaElement* aElement,
+                           SyncSectionFn aClosure)
+{
+  nsCOMPtr<nsIRunnable> event = new nsSyncSection(aElement, aClosure);
+  nsCOMPtr<nsIAppShell> appShell = do_GetService(kAppShellCID);
+  appShell->RunInStableState(event);
+}
+
+void nsHTMLMediaElement::QueueLoadFromSourceTask()
+{
+  ChangeDelayLoadStatus(PR_TRUE);
+  mNetworkState = nsIDOMHTMLMediaElement::NETWORK_LOADING;
+  AsyncAwaitStableState(this, &nsHTMLMediaElement::LoadFromSourceChildren);
+}
+
+void nsHTMLMediaElement::QueueSelectResourceTask()
+{
+  // Don't allow multiple async select resource calls to be queued.
+  if (mIsRunningSelectResource)
+    return;
+  mIsRunningSelectResource = PR_TRUE;
+  mNetworkState = nsIDOMHTMLMediaElement::NETWORK_NO_SOURCE;
+  AsyncAwaitStableState(this, &nsHTMLMediaElement::SelectResource);
+}
+
 /* void load (); */
 NS_IMETHODIMP nsHTMLMediaElement::Load()
 {
@@ -591,18 +632,20 @@ static PRBool HasPotentialResource(nsIContent *aElement)
 
 void nsHTMLMediaElement::SelectResource()
 {
-  NS_ASSERTION(mDelayingLoadEvent, "Load event not delayed during resource selection?");
-
+  NS_ASSERTION(!mDelayingLoadEvent,
+    "Load event should not be delayed at start of resource selection.");
   if (!HasPotentialResource(this)) {
-    // While the media element has neither a src attribute nor any source
-    // element children, wait. (This steps might wait forever.)
-    mNetworkState = nsIDOMHTMLMediaElement::NETWORK_NO_SOURCE;
-    mLoadWaitStatus = WAITING_FOR_SRC_OR_SOURCE;
+    // The media element has neither a src attribute nor any source
+    // element children, abort the load.
+    mNetworkState = nsIDOMHTMLMediaElement::NETWORK_EMPTY;
     // This clears mDelayingLoadEvent, so AddRemoveSelfReference will be called
     ChangeDelayLoadStatus(PR_FALSE);
+    mIsRunningSelectResource = PR_FALSE;
     return;
   }
 
+  ChangeDelayLoadStatus(PR_TRUE);
+
   mNetworkState = nsIDOMHTMLMediaElement::NETWORK_LOADING;
   // Load event was delayed, and still is, so no need to call
   // AddRemoveSelfReference, since it must still be held
@@ -617,29 +660,37 @@ void nsHTMLMediaElement::SelectResource()
     if (NS_SUCCEEDED(rv)) {
       LOG(PR_LOG_DEBUG, ("%p Trying load from src=%s", this, NS_ConvertUTF16toUTF8(src).get()));
       mIsLoadingFromSrcAttribute = PR_TRUE;
+      mLoadingSrc = uri;
       if (mPreloadAction == nsHTMLMediaElement::PRELOAD_NONE) {
         // preload:none media, suspend the load here before we make any
         // network requests.
         SuspendLoad(uri);
+        mIsRunningSelectResource = PR_FALSE;
         return;
       }
 
       rv = LoadResource(uri);
-      if (NS_SUCCEEDED(rv))
+      if (NS_SUCCEEDED(rv)) {
+        mIsRunningSelectResource = PR_FALSE;
         return;
+      }
     }
     NoSupportedMediaSourceError();
   } else {
     // Otherwise, the source elements will be used.
     LoadFromSourceChildren();
   }
+  mIsRunningSelectResource = PR_FALSE;
 }
 
 void nsHTMLMediaElement::NotifyLoadError()
 {
   if (mIsLoadingFromSrcAttribute) {
+    LOG(PR_LOG_DEBUG, ("NotifyLoadError(), no supported media error"));
     NoSupportedMediaSourceError();
   } else {
+    NS_ASSERTION(mSourceLoadCandidate, "Must know the source we were loading from!");
+    DispatchAsyncSourceError(mSourceLoadCandidate);
     QueueLoadFromSourceTask();
   }
 }
@@ -682,18 +733,47 @@ void nsHTMLMediaElement::LoadFromSourceChildren()
 {
   NS_ASSERTION(mDelayingLoadEvent,
                "Should delay load event (if in document) during load");
+  NS_ASSERTION(!mIsLoadingFromSrcAttribute,
+               "Must remember we're loading from source children");
   while (PR_TRUE) {
     nsresult rv;
-    nsCOMPtr<nsIURI> uri = GetNextSource();
-    if (!uri) {
+    nsIContent* child = GetNextSource();
+    if (!child) {
       // Exhausted candidates, wait for more candidates to be appended to
       // the media element.
       mLoadWaitStatus = WAITING_FOR_SOURCE;
-      NoSupportedMediaSourceError();
+      mNetworkState = nsIDOMHTMLMediaElement::NETWORK_NO_SOURCE;
+      ChangeDelayLoadStatus(PR_FALSE);
       return;
     }
 
-    mNetworkState = nsIDOMHTMLMediaElement::NETWORK_LOADING;
+    nsCOMPtr<nsIURI> uri;
+    nsAutoString src,type;
+
+    // Must have src attribute.
+    if (!child->GetAttr(kNameSpaceID_None, nsGkAtoms::src, src)) {
+      DispatchAsyncSourceError(child);
+      continue;
+    }
+
+    // If we have a type attribute, it must be a supported type.
+    if (child->GetAttr(kNameSpaceID_None, nsGkAtoms::type, type) &&
+        GetCanPlay(type) == CANPLAY_NO)
+    {
+      DispatchAsyncSourceError(child);
+      continue;
+    }
+    LOG(PR_LOG_DEBUG, ("%p Trying load from <source>=%s type=%s", this,
+      NS_ConvertUTF16toUTF8(src).get(), NS_ConvertUTF16toUTF8(type).get()));
+    NewURIFromString(src, getter_AddRefs(uri));
+    if (!uri) {
+      DispatchAsyncSourceError(child);
+      continue;
+    }
+
+    mLoadingSrc = uri;
+    NS_ASSERTION(mNetworkState == nsIDOMHTMLMediaElement::NETWORK_LOADING,
+                 "Network state should be loading");
 
     if (mPreloadAction == nsHTMLMediaElement::PRELOAD_NONE) {
       // preload:none media, suspend the load here before we make any
@@ -707,6 +787,7 @@ void nsHTMLMediaElement::LoadFromSourceChildren()
       return;
 
     // If we fail to load, loop back and try loading the next resource.
+    DispatchAsyncSourceError(child);
   }
   NS_NOTREACHED("Execution should not reach here!");
 }
@@ -714,7 +795,6 @@ void nsHTMLMediaElement::LoadFromSourceChildren()
 void nsHTMLMediaElement::SuspendLoad(nsIURI* aURI)
 {
   mLoadIsSuspended = PR_TRUE;
-  mPreloadURI = aURI;
   mNetworkState = nsIDOMHTMLMediaElement::NETWORK_IDLE;
   DispatchAsyncProgressEvent(NS_LITERAL_STRING("suspend"));
   ChangeDelayLoadStatus(PR_FALSE);
@@ -723,9 +803,8 @@ void nsHTMLMediaElement::SuspendLoad(nsIURI* aURI)
 void nsHTMLMediaElement::ResumeLoad(PreloadAction aAction)
 {
   NS_ASSERTION(mLoadIsSuspended, "Can only resume preload if halted for one");
-  nsCOMPtr<nsIURI> uri = mPreloadURI;
+  nsCOMPtr<nsIURI> uri = mLoadingSrc;
   mLoadIsSuspended = PR_FALSE;
-  mPreloadURI = nsnull;
   mPreloadAction = aAction;
   ChangeDelayLoadStatus(PR_TRUE);
   mNetworkState = nsIDOMHTMLMediaElement::NETWORK_LOADING;
@@ -1063,6 +1142,7 @@ NS_IMETHODIMP nsHTMLMediaElement::GetPaused(PRBool *aPaused)
 NS_IMETHODIMP nsHTMLMediaElement::Pause()
 {
   if (mNetworkState == nsIDOMHTMLMediaElement::NETWORK_EMPTY) {
+    LOG(PR_LOG_DEBUG, ("Loading due to Pause()"));
     nsresult rv = Load();
     NS_ENSURE_SUCCESS(rv, rv);
   } else if (mDecoder) {
@@ -1200,7 +1280,6 @@ nsHTMLMediaElement::nsHTMLMediaElement(already_AddRefed<nsINodeInfo> aNodeInfo,
     mAutoplayEnabled(PR_TRUE),
     mPaused(PR_TRUE),
     mMuted(PR_FALSE),
-    mIsDoneAddingChildren(!aFromParser),
     mPlayingBeforeSeek(PR_FALSE),
     mPausedForInactiveDocument(PR_FALSE),
     mWaitingFired(PR_FALSE),
@@ -1369,16 +1448,11 @@ nsresult nsHTMLMediaElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                                     aNotify);
   if (NS_FAILED(rv))
     return rv;
+  if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::src) {
+    Load();
+  }
   if (aNotify && aNameSpaceID == kNameSpaceID_None) {
-    if (aName == nsGkAtoms::src) {
-      if (mLoadWaitStatus == WAITING_FOR_SRC_OR_SOURCE) {
-        // A previous load algorithm instance is waiting on a src
-        // addition, resume the load. It is waiting at "step 1 of the load
-        // algorithm".
-        mLoadWaitStatus = NOT_WAITING;
-        QueueSelectResourceTask();
-      }
-    } else if (aName == nsGkAtoms::autoplay) {
+    if (aName == nsGkAtoms::autoplay) {
       StopSuspendingAfterFirstFrame();
       if (mReadyState == nsIDOMHTMLMediaElement::HAVE_ENOUGH_DATA) {
         NotifyAutoplayDataReady();
@@ -1429,15 +1503,6 @@ nsresult nsHTMLMediaElement::BindToTree(nsIDocument* aDocument, nsIContent* aPar
                                                  aParent,
                                                  aBindingParent,
                                                  aCompileEventHandlers);
-  if (aDocument) {
-    if (NS_SUCCEEDED(rv) &&
-        mIsDoneAddingChildren &&
-        mNetworkState == nsIDOMHTMLMediaElement::NETWORK_EMPTY)
-    {
-      QueueSelectResourceTask();
-    }
-  }
-
   mIsBindingToTree = PR_FALSE;
 
   return rv;
@@ -1813,6 +1878,9 @@ nsresult nsHTMLMediaElement::FinishDecoderSetup(nsMediaDecoder* aDecoder)
 {
   mDecoder = aDecoder;
 
+  // Decoder has assumed ownership responsibility for remembering the URI.
+  mLoadingSrc = nsnull;
+
   // Force a same-origin check before allowing events for this media resource.
   mMediaSecurityVerified = PR_FALSE;
 
@@ -1902,29 +1970,43 @@ void nsHTMLMediaElement::ResourceLoaded()
   mNetworkState = nsIDOMHTMLMediaElement::NETWORK_IDLE;
   AddRemoveSelfReference();
   ChangeReadyState(nsIDOMHTMLMediaElement::HAVE_ENOUGH_DATA);
-  // The download has stopped
+  // Ensure a progress event is dispatched at the end of download.
+  DispatchAsyncProgressEvent(NS_LITERAL_STRING("progress"));
+  // The download has stopped.
   DispatchAsyncSimpleEvent(NS_LITERAL_STRING("suspend"));
 }
 
 void nsHTMLMediaElement::NetworkError()
 {
-  mError = new nsMediaError(nsIDOMMediaError::MEDIA_ERR_NETWORK);
-  mBegun = PR_FALSE;
-  DispatchAsyncProgressEvent(NS_LITERAL_STRING("error"));
-  mNetworkState = nsIDOMHTMLMediaElement::NETWORK_EMPTY;
-  AddRemoveSelfReference();
-  DispatchAsyncSimpleEvent(NS_LITERAL_STRING("emptied"));
-  ChangeDelayLoadStatus(PR_FALSE);
+  Error(nsIDOMMediaError::MEDIA_ERR_NETWORK);
 }
 
 void nsHTMLMediaElement::DecodeError()
 {
-  mError = new nsMediaError(nsIDOMMediaError::MEDIA_ERR_DECODE);
+  Error(nsIDOMMediaError::MEDIA_ERR_DECODE);
+}
+
+void nsHTMLMediaElement::LoadAborted()
+{
+  Error(nsIDOMMediaError::MEDIA_ERR_ABORTED);
+}
+
+void nsHTMLMediaElement::Error(PRUint16 aErrorCode)
+{
+  NS_ASSERTION(aErrorCode == nsIDOMMediaError::MEDIA_ERR_DECODE ||
+               aErrorCode == nsIDOMMediaError::MEDIA_ERR_NETWORK ||
+               aErrorCode == nsIDOMMediaError::MEDIA_ERR_ABORTED,
+               "Only use nsIDOMMediaError codes!");
+  mError = new nsMediaError(aErrorCode);
   mBegun = PR_FALSE;
   DispatchAsyncProgressEvent(NS_LITERAL_STRING("error"));
-  mNetworkState = nsIDOMHTMLMediaElement::NETWORK_EMPTY;
+  if (mReadyState == nsIDOMHTMLMediaElement::HAVE_NOTHING) {
+    mNetworkState = nsIDOMHTMLMediaElement::NETWORK_EMPTY;
+    DispatchAsyncSimpleEvent(NS_LITERAL_STRING("emptied"));
+  } else {
+    mNetworkState = nsIDOMHTMLMediaElement::NETWORK_IDLE;
+  }
   AddRemoveSelfReference();
-  DispatchAsyncSimpleEvent(NS_LITERAL_STRING("emptied"));
   ChangeDelayLoadStatus(PR_FALSE);
 }
 
@@ -2211,25 +2293,6 @@ nsresult nsHTMLMediaElement::DispatchProgressEvent(const nsAString& aName)
   return target->DispatchEvent(event, &dummy);
 }
 
-nsresult nsHTMLMediaElement::DoneAddingChildren(PRBool aHaveNotified)
-{
-  if (!mIsDoneAddingChildren) {
-    mIsDoneAddingChildren = PR_TRUE;
-
-    UpdatePreloadAction();
-    if (mNetworkState == nsIDOMHTMLMediaElement::NETWORK_EMPTY) {
-      QueueSelectResourceTask();
-    }
-  }
-
-  return NS_OK;
-}
-
-PRBool nsHTMLMediaElement::IsDoneAddingChildren()
-{
-  return mIsDoneAddingChildren;
-}
-
 PRBool nsHTMLMediaElement::IsPotentiallyPlaying() const
 {
   // TODO:
@@ -2349,21 +2412,41 @@ nsHTMLMediaElement::IsNodeOfType(PRUint32 aFlags) const
   return !(aFlags & ~(eCONTENT | eMEDIA));
 }
 
+void nsHTMLMediaElement::DispatchAsyncSourceError(nsIContent* aSourceElement)
+{
+  LOG_EVENT(PR_LOG_DEBUG, ("%p Queuing simple source error event", this));
+
+  nsCOMPtr<nsIRunnable> event = new nsSourceErrorEventRunner(this, aSourceElement);
+  NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
+}
+
 void nsHTMLMediaElement::NotifyAddedSource()
 {
-  if (mLoadWaitStatus == WAITING_FOR_SRC_OR_SOURCE) {
+  // If a source element is inserted as a child of a media element
+  // that has no src attribute and whose networkState has the value
+  // NETWORK_EMPTY, the user agent must invoke the media element's
+  // resource selection algorithm.
+  if (!HasAttr(kNameSpaceID_None, nsGkAtoms::src) &&
+      mNetworkState == nsIDOMHTMLMediaElement::NETWORK_EMPTY)
+  {
     QueueSelectResourceTask();
-  } else if (mLoadWaitStatus == WAITING_FOR_SOURCE) {
+  }
+
+  // A load was paused in the resource selection algorithm, waiting for
+  // a new source child to be added, resume the resource selction algorithm.
+  if (mLoadWaitStatus == WAITING_FOR_SOURCE) {
     QueueLoadFromSourceTask();
   }
 }
 
-already_AddRefed<nsIURI> nsHTMLMediaElement::GetNextSource()
+nsIContent* nsHTMLMediaElement::GetNextSource()
 {
   nsresult rv = NS_OK;
   nsCOMPtr<nsIDOMNode> thisDomNode =
     do_QueryInterface(static_cast<nsGenericElement*>(this));
 
+  mSourceLoadCandidate = nsnull;
+
   if (!mSourcePointer) {
     // First time this has been run, create a selection to cover children.
     mSourcePointer = do_CreateInstance("@mozilla.org/content/range;1");
@@ -2397,27 +2480,13 @@ already_AddRefed<nsIURI> nsHTMLMediaElement::GetNextSource()
 
     nsIContent* child = GetChildAt(startOffset);
 
-    // If child is a <source> element, it may be the next candidate.
+    // If child is a <source> element, it is the next candidate.
     if (child &&
         child->Tag() == nsGkAtoms::source &&
         child->IsHTML())
     {
-      nsCOMPtr<nsIURI> uri;
-      nsAutoString src,type;
-
-      // Must have src attribute.
-      if (!child->GetAttr(kNameSpaceID_None, nsGkAtoms::src, src))
-        continue;
-
-      // If we have a type attribute, it must be a supported type.
-      if (child->GetAttr(kNameSpaceID_None, nsGkAtoms::type, type) &&
-          GetCanPlay(type) == CANPLAY_NO)
-        continue;
-
-      LOG(PR_LOG_DEBUG, ("%p Trying load from <source>=%s type=%s", this,
-                         NS_ConvertUTF16toUTF8(src).get(), NS_ConvertUTF16toUTF8(type).get()));
-      NewURIFromString(src, getter_AddRefs(uri));
-      return uri.forget();
+      mSourceLoadCandidate = child;
+      return child;
     }
   }
   NS_NOTREACHED("Execution should not reach here!");
diff --git a/content/media/nsBuiltinDecoder.cpp b/content/media/nsBuiltinDecoder.cpp
index faeb6aa177aa..964b2d54a0ff 100644
--- a/content/media/nsBuiltinDecoder.cpp
+++ b/content/media/nsBuiltinDecoder.cpp
@@ -411,7 +411,6 @@ void nsBuiltinDecoder::ResourceLoaded()
 
   // Ensure the final progress event gets fired
   if (mElement) {
-    mElement->DispatchAsyncProgressEvent(NS_LITERAL_STRING("progress"));
     mElement->ResourceLoaded();
   }
 }
@@ -566,8 +565,11 @@ void nsBuiltinDecoder::NotifyDownloadEnded(nsresult aStatus)
 {
   NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
 
-  if (aStatus == NS_BINDING_ABORTED)
+  if (aStatus == NS_BINDING_ABORTED) {
+    // Download has been cancelled by user.
+    mElement->LoadAborted();
     return;
+  }
 
   {
     MonitorAutoEnter mon(mMonitor);
diff --git a/content/media/test/test_constants.html b/content/media/test/test_constants.html
index 9bff765e6209..c459bd961cf1 100644
--- a/content/media/test/test_constants.html
+++ b/content/media/test/test_constants.html
@@ -17,7 +17,6 @@
 is(HTMLElement.NETWORK_EMPTY, undefined);
 is(HTMLElement.NETWORK_IDLE, undefined);
 is(HTMLElement.NETWORK_LOADING, undefined);
-is(HTMLElement.NETWORK_LOADED, undefined);
 is(HTMLElement.NETWORK_NO_SOURCE, undefined);
 is(HTMLElement.HAVE_NOTHING, undefined);
 is(HTMLElement.HAVE_METADATA, undefined);
@@ -31,8 +30,7 @@ is(HTMLElement.MEDIA_ERR_SRC_NOT_SUPPORTED, undefined);
 is(HTMLMediaElement.NETWORK_EMPTY, 0);
 is(HTMLMediaElement.NETWORK_IDLE, 1);
 is(HTMLMediaElement.NETWORK_LOADING, 2);
-todo_is(HTMLMediaElement.NETWORK_LOADED, undefined);
-is(HTMLMediaElement.NETWORK_NO_SOURCE, 4);
+is(HTMLMediaElement.NETWORK_NO_SOURCE, 3);
 is(HTMLMediaElement.HAVE_NOTHING, 0);
 is(HTMLMediaElement.HAVE_METADATA, 1);
 is(HTMLMediaElement.HAVE_CURRENT_DATA, 2);
@@ -58,7 +56,6 @@ is(HTMLVideoElement.MEDIA_ERR_SRC_NOT_SUPPORTED, undefined);
 is(HTMLAudioElement.NETWORK_EMPTY, undefined);
 is(HTMLAudioElement.NETWORK_IDLE, undefined);
 is(HTMLAudioElement.NETWORK_LOADING, undefined);
-is(HTMLAudioElement.NETWORK_LOADED, undefined);
 is(HTMLAudioElement.NETWORK_NO_SOURCE, undefined);
 is(HTMLAudioElement.HAVE_NOTHING, undefined);
 is(HTMLAudioElement.HAVE_METADATA, undefined);
@@ -72,7 +69,6 @@ is(HTMLAudioElement.MEDIA_ERR_SRC_NOT_SUPPORTED, undefined);
 is(HTMLSourceElement.NETWORK_EMPTY, undefined);
 is(HTMLSourceElement.NETWORK_IDLE, undefined);
 is(HTMLSourceElement.NETWORK_LOADING, undefined);
-is(HTMLSourceElement.NETWORK_LOADED, undefined);
 is(HTMLSourceElement.NETWORK_NO_SOURCE, undefined);
 is(HTMLSourceElement.HAVE_NOTHING, undefined);
 is(HTMLSourceElement.HAVE_METADATA, undefined);
@@ -86,7 +82,6 @@ is(HTMLSourceElement.MEDIA_ERR_SRC_NOT_SUPPORTED, undefined);
 is(MediaError.NETWORK_EMPTY, undefined);
 is(MediaError.NETWORK_IDLE, undefined);
 is(MediaError.NETWORK_LOADING, undefined);
-is(MediaError.NETWORK_LOADED, undefined);
 is(MediaError.NETWORK_NO_SOURCE, undefined);
 is(MediaError.HAVE_NOTHING, undefined);
 is(MediaError.HAVE_METADATA, undefined);
@@ -100,7 +95,6 @@ is(MediaError.MEDIA_ERR_SRC_NOT_SUPPORTED, 4);
 is(document.body.NETWORK_EMPTY, undefined);
 is(document.body.NETWORK_IDLE, undefined);
 is(document.body.NETWORK_LOADING, undefined);
-is(document.body.NETWORK_LOADED, undefined);
 is(document.body.NETWORK_NO_SOURCE, undefined);
 is(document.body.HAVE_NOTHING, undefined);             
 is(document.body.HAVE_METADATA, undefined);
@@ -114,8 +108,7 @@ is(document.body.MEDIA_ERR_SRC_NOT_SUPPORTED, undefined);
 is(document.getElementsByTagName("video")[0].NETWORK_EMPTY, 0);
 is(document.getElementsByTagName("video")[0].NETWORK_IDLE, 1);
 is(document.getElementsByTagName("video")[0].NETWORK_LOADING, 2);
-is(document.getElementsByTagName("video")[0].NETWORK_LOADED, 3);
-is(document.getElementsByTagName("video")[0].NETWORK_NO_SOURCE, 4);
+is(document.getElementsByTagName("video")[0].NETWORK_NO_SOURCE, 3);
 is(document.getElementsByTagName("video")[0].HAVE_NOTHING, 0);
 is(document.getElementsByTagName("video")[0].HAVE_METADATA, 1);
 is(document.getElementsByTagName("video")[0].HAVE_CURRENT_DATA, 2);
@@ -128,8 +121,7 @@ is(document.getElementsByTagName("video")[0].MEDIA_ERR_SRC_NOT_SUPPORTED, undefi
 is(document.getElementsByTagName("audio")[0].NETWORK_EMPTY, 0);
 is(document.getElementsByTagName("audio")[0].NETWORK_IDLE, 1);
 is(document.getElementsByTagName("audio")[0].NETWORK_LOADING, 2);
-is(document.getElementsByTagName("audio")[0].NETWORK_LOADED, 3);
-is(document.getElementsByTagName("audio")[0].NETWORK_NO_SOURCE, 4);
+is(document.getElementsByTagName("audio")[0].NETWORK_NO_SOURCE, 3);
 is(document.getElementsByTagName("audio")[0].HAVE_NOTHING, 0);
 is(document.getElementsByTagName("audio")[0].HAVE_METADATA, 1);
 is(document.getElementsByTagName("audio")[0].HAVE_CURRENT_DATA, 2);
@@ -142,7 +134,6 @@ is(document.getElementsByTagName("audio")[0].MEDIA_ERR_SRC_NOT_SUPPORTED, undefi
 is(document.getElementsByTagName("source")[0].NETWORK_EMPTY, undefined);
 is(document.getElementsByTagName("source")[0].NETWORK_IDLE, undefined);
 is(document.getElementsByTagName("source")[0].NETWORK_LOADING, undefined);
-is(document.getElementsByTagName("source")[0].NETWORK_LOADED, undefined);
 is(document.getElementsByTagName("source")[0].NETWORK_NO_SOURCE, undefined);
 is(document.getElementsByTagName("source")[0].HAVE_NOTHING, undefined);
 is(document.getElementsByTagName("source")[0].HAVE_METADATA, undefined);
@@ -156,7 +147,6 @@ is(document.getElementsByTagName("source")[0].MEDIA_ERR_SRC_NOT_SUPPORTED, undef
 is(HTMLElement.prototype.NETWORK_EMPTY, undefined);
 is(HTMLElement.prototype.NETWORK_IDLE, undefined);
 is(HTMLElement.prototype.NETWORK_LOADING, undefined);
-is(HTMLElement.prototype.NETWORK_LOADED, undefined);
 is(HTMLElement.prototype.NETWORK_NO_SOURCE, undefined);
 is(HTMLElement.prototype.HAVE_NOTHING, undefined);
 is(HTMLElement.prototype.HAVE_METADATA, undefined);
@@ -170,8 +160,7 @@ is(HTMLElement.prototype.MEDIA_ERR_SRC_NOT_SUPPORTED, undefined);
 todo_is(HTMLMediaElement.prototype.NETWORK_EMPTY, 0, "HTMLMediaElement.prototype.NETWORK_EMPTY");
 todo_is(HTMLMediaElement.prototype.NETWORK_IDLE, 1, "HTMLMediaElement.prototype.NETWORK_IDLE");
 todo_is(HTMLMediaElement.prototype.NETWORK_LOADING, 2, "HTMLMediaElement.prototype.NETWORK_LOADING");
-todo_is(HTMLMediaElement.prototype.NETWORK_LOADED, 3, "HTMLMediaElement.prototype.NETWORK_LOADED");
-todo_is(HTMLMediaElement.prototype.NETWORK_NO_SOURCE, 4, "HTMLMediaElement.prototype.NETWORK_NO_SOURCE");
+todo_is(HTMLMediaElement.prototype.NETWORK_NO_SOURCE, 3, "HTMLMediaElement.prototype.NETWORK_NO_SOURCE");
 todo_is(HTMLMediaElement.prototype.HAVE_NOTHING, 0, "HTMLMediaElement.prototype.HAVE_NOTHING");
 todo_is(HTMLMediaElement.prototype.HAVE_METADATA, 1, "HTMLMediaElement.prototype.HAVE_METADATA");
 todo_is(HTMLMediaElement.prototype.HAVE_CURRENT_DATA, 2, "HTMLMediaElement.prototype.HAVE_CURRENT_DATA");
@@ -184,8 +173,7 @@ is(HTMLMediaElement.prototype.MEDIA_ERR_SRC_NOT_SUPPORTED, undefined, "HTMLMedia
 is(HTMLVideoElement.prototype.NETWORK_EMPTY, 0);
 is(HTMLVideoElement.prototype.NETWORK_IDLE, 1);
 is(HTMLVideoElement.prototype.NETWORK_LOADING, 2);
-is(HTMLVideoElement.prototype.NETWORK_LOADED, 3);
-is(HTMLVideoElement.prototype.NETWORK_NO_SOURCE, 4);
+is(HTMLVideoElement.prototype.NETWORK_NO_SOURCE, 3);
 is(HTMLVideoElement.prototype.HAVE_NOTHING, 0);
 is(HTMLVideoElement.prototype.HAVE_METADATA, 1);
 is(HTMLVideoElement.prototype.HAVE_CURRENT_DATA, 2);
@@ -198,8 +186,7 @@ is(HTMLVideoElement.prototype.MEDIA_ERR_SRC_NOT_SUPPORTED, undefined);
 is(HTMLAudioElement.prototype.NETWORK_EMPTY, 0);
 is(HTMLAudioElement.prototype.NETWORK_IDLE, 1);
 is(HTMLAudioElement.prototype.NETWORK_LOADING, 2);
-is(HTMLAudioElement.prototype.NETWORK_LOADED, 3);
-is(HTMLAudioElement.prototype.NETWORK_NO_SOURCE, 4);
+is(HTMLAudioElement.prototype.NETWORK_NO_SOURCE, 3);
 is(HTMLAudioElement.prototype.HAVE_NOTHING, 0);
 is(HTMLAudioElement.prototype.HAVE_METADATA, 1);
 is(HTMLAudioElement.prototype.HAVE_CURRENT_DATA, 2);
@@ -212,7 +199,6 @@ is(HTMLAudioElement.prototype.MEDIA_ERR_SRC_NOT_SUPPORTED, undefined);
 is(HTMLSourceElement.prototype.NETWORK_EMPTY, undefined);
 is(HTMLSourceElement.prototype.NETWORK_IDLE, undefined);
 is(HTMLSourceElement.prototype.NETWORK_LOADING, undefined);
-is(HTMLSourceElement.prototype.NETWORK_LOADED, undefined);
 is(HTMLSourceElement.prototype.NETWORK_NO_SOURCE, undefined);
 is(HTMLSourceElement.prototype.HAVE_NOTHING, undefined);
 is(HTMLSourceElement.prototype.HAVE_METADATA, undefined);
@@ -226,7 +212,6 @@ is(HTMLSourceElement.prototype.MEDIA_ERR_SRC_NOT_SUPPORTED, undefined);
 is(MediaError.prototype.NETWORK_EMPTY, undefined);
 is(MediaError.prototype.NETWORK_IDLE, undefined);
 is(MediaError.prototype.NETWORK_LOADING, undefined);
-is(MediaError.prototype.NETWORK_LOADED, undefined);
 is(MediaError.prototype.NETWORK_NO_SOURCE, undefined);
 is(MediaError.prototype.HAVE_NOTHING, undefined);
 is(MediaError.prototype.HAVE_METADATA, undefined);
diff --git a/content/media/test/test_decode_error.html b/content/media/test/test_decode_error.html
index 8c75b664216b..e2324cf8daf7 100644
--- a/content/media/test/test_decode_error.html
+++ b/content/media/test/test_decode_error.html
@@ -43,8 +43,7 @@ function startTest(test, token) {
     ok(false, "Unexpected ended event");
   }, false);
 
-  v.src = test.name;
-  v.load();
+  v.src = test.name; // implicitly starts a load.
 }
 
 manager.runTests(gDecodeErrorTests, startTest);
diff --git a/content/media/test/test_decoder_disable.html b/content/media/test/test_decoder_disable.html
index 0eb2715fd3d0..7967036e0102 100644
--- a/content/media/test/test_decoder_disable.html
+++ b/content/media/test/test_decoder_disable.html
@@ -18,6 +18,14 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=448600
 <pre id="test">
 <script type="application/javascript">
 
+function filename(uri) {
+  return uri.substr(uri.lastIndexOf("/")+1);
+}
+
+function e(id) {
+  return document.getElementById(id);
+}
+
 netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 var prefService = Components.classes["@mozilla.org/preferences-service;1"]
                .getService(Components.interfaces.nsIPrefService);
@@ -39,13 +47,19 @@ var gErrorCount = 0;
 SimpleTest.waitForExplicitFinish();
 
 function finishTest() {
-  is(document.getElementById('video1').currentSrc, "", 'video1.currentSrc==""');
-  is(document.getElementById('video2').currentSrc, "", 'video2.currentSrc==""');
-  is(document.getElementById('video3').currentSrc, "", 'video3.currentSrc==""');
+  is(e('video1').currentSrc,
+     "",
+     'video1 currentSrc should be empty when there\'s no playable typed source children');
+  is(filename(e('video2').currentSrc),
+     filename(e('video2').src),
+     'video2 currentSrc should match src');
+  is(filename(e('video3').currentSrc),
+     filename(e('video3').src),
+     'video3 currentSrc should match src');
 
-  is(gLoadError['video1'], 1, "Load error on video1");
-  is(gLoadError['video2'], 1, "Load error on video2");
-  is(gLoadError['video3'], 1, "Load error on video3");
+  is(gLoadError['video1'], 2, "Expect one error per invalid source child on video1");
+  is(gLoadError['video2'], 1, "Expect one error on video2");
+  is(gLoadError['video3'], 1, "Expect one error on video3");
   
   netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 
@@ -59,7 +73,7 @@ function videoError(event, id) {
   event.stopPropagation();
   gLoadError[id]++;
   gErrorCount++;
-  if (gErrorCount == 3) {
+  if (gErrorCount >= 4) {
     finishTest();
   }
 }
@@ -68,7 +82,7 @@ function videoError(event, id) {
 
 <video id="video1" onerror="videoError(event, 'video1');">
   <source type="video/ogg" src="320x240.ogv"/>
-  <source type="audio/wave" src="r11025_u8_c1.wav"/>
+  <source type="audio/wave" src="r11025_u8_c1.wav" id='s2'/>
 </video>
 
 <video id="video2" src="320x240.ogv" onerror="videoError(event, 'video2');"></video>
diff --git a/content/media/test/test_info_leak.html b/content/media/test/test_info_leak.html
index d134d7195b86..8f2ff97bad7f 100644
--- a/content/media/test/test_info_leak.html
+++ b/content/media/test/test_info_leak.html
@@ -89,6 +89,7 @@ function createMedia(type, src) {
     gMedia.addEventListener(gEventTypes[i], listener, false);
   }
   gMedia.src = src;
+  gMedia._name = src;
   document.body.appendChild(gMedia);
 }
 
@@ -108,6 +109,10 @@ function test_is(a, b, msg) {
   }
 }
 
+function filename(uri) {
+  return uri.substr(uri.lastIndexOf("/")+1);
+}
+
 function checkState() {
   if (gMedia != null) {
     test_ok(gMedia.networkState <= HTMLMediaElement.NETWORK_LOADING || 
@@ -126,7 +131,9 @@ function checkState() {
     test_ok(gMedia.error==null || gMedia.error.code==MediaError.MEDIA_ERR_SRC_NOT_SUPPORTED,
             "Error code should not exist or be SRC_NOT_SUPPORTED. gMedia.error=" +
             (gMedia.error ? gMedia.error.code : "null"));
-    test_is(gMedia.currentSrc, "", "Leaked currentSrc");
+    test_ok(filename(gMedia.currentSrc) == filename(gMedia._name) ||
+            gMedia.networkState == HTMLMediaElement.NETWORK_NO_SOURCE,
+            "currentSrc should match candidate uri, if we've got a valid source");
   }
   if (!gFinished) {
     setTimeout(checkState, 1);
diff --git a/content/media/test/test_load.html b/content/media/test/test_load.html
index fa98a340ac62..53e2161e0d39 100644
--- a/content/media/test/test_load.html
+++ b/content/media/test/test_load.html
@@ -89,8 +89,9 @@ var gTests = [
         addSource(src, type);
       },
     expectedEvents: ['loadstart', 'durationchange', 'loadedmetadata', 'loadeddata']
-  }, {
-    // Test 2: video with multiple source, the first of which are bad, we should load the last.
+  },{
+    // Test 2: video with multiple source, the first of which are bad, we should load the last,
+    // and receive error events for failed loads on the source children.
     create:
       function(src, type) {
         document.body.appendChild(gMedia);
@@ -98,7 +99,7 @@ var gTests = [
         addSource("404b", type);
         addSource(src, type);
       },
-    expectedEvents: ['loadstart', 'durationchange', 'loadedmetadata', 'loadeddata']
+    expectedEvents: ['loadstart', 'error', 'error', 'durationchange', 'loadedmetadata', 'loadeddata']
   }, {
     // Test 3:  video with bad src, good <source>, ensure that <source> aren't used.
     create:
@@ -123,7 +124,7 @@ var gTests = [
           false);
         document.body.appendChild(gMedia);
       },
-    expectedEvents: ['loadstart', 'error', 'durationchange', 'loadedmetadata', 'loadeddata']
+    expectedEvents: ['loadstart', 'error', 'error', 'durationchange', 'loadedmetadata', 'loadeddata']
   }, {
     // Test 5: video with only 1 bad source, let it fail to load, then prepend
     // a good <source> to the video, it shouldn't be selected, because the
diff --git a/content/media/test/test_load_candidates.html b/content/media/test/test_load_candidates.html
index 34a4be07dfa2..140b0bb282e4 100644
--- a/content/media/test/test_load_candidates.html
+++ b/content/media/test/test_load_candidates.html
@@ -25,7 +25,7 @@ var manager = new MediaTestManager;
 
 function finish(evt) {
   var v = evt.target;
-  is(v._error, false, "Shouldn't have thrown an error - " + v._name);
+  ok(v._error, "Should have received an error event before loaded");
   v._finished = true;
   v.parentNode.removeChild(v);
   manager.finished(v.token);
@@ -33,8 +33,7 @@ function finish(evt) {
 
 function errorHandler(evt) {
   evt.stopPropagation();
-  evt.target._error = true;
-  finish(evt);
+  evt.target.parentNode._error = true;
 }
 
 var extenstion = {
@@ -56,6 +55,7 @@ function startTest(test, token) {
   var s1 = document.createElement("source");
   s1.type = test.type;
   s1.src = "404." + extenstion[test.type];
+  s1.addEventListener("error", errorHandler, false);
   v.appendChild(s1);
   
   var s2 = document.createElement("source");
@@ -63,9 +63,7 @@ function startTest(test, token) {
   s2.src = test.name;
   v.appendChild(s2);
   
-  v.addEventListener("error", errorHandler, false);
   v.addEventListener("loadeddata", finish, false);
-  
   document.body.appendChild(v);
 }
 
diff --git a/content/media/test/test_preload_actions.html b/content/media/test/test_preload_actions.html
index 224a981c1661..3b3cbb742bd8 100644
--- a/content/media/test/test_preload_actions.html
+++ b/content/media/test/test_preload_actions.html
@@ -134,8 +134,8 @@ var tests = [
       v.addEventListener("loadstart", function(e){v._gotLoadStart = true;}, false);
       v.addEventListener("loadedmetadata", function(e){v._gotLoadedMetaData = true;}, false);
       v.addEventListener("canplaythrough", this.canplaythrough, false);
-      v.src = test.name;
-      document.body.appendChild(v); // Causes implicit load.
+      v.src = test.name; // Causes implicit load.
+      document.body.appendChild(v);
     },
   },
   {
@@ -253,6 +253,7 @@ var tests = [
       ok(true, "(7) Got playback ended");
       var v = e.target;
       v._finished = true;
+      is(v._gotErrorEvent, true, "(7) Should get error event from first source load failure");      
       maybeFinish(v, 7);
     },
       
@@ -262,10 +263,12 @@ var tests = [
       v._gotLoadedMetaData = false;
       v._finished = false;
       v.preload = "none";
+      v._gotErrorEvent = false;
       v.addEventListener("loadedmetadata", function(e){v._gotLoadedMetaData = true;}, false);
       v.addEventListener("loadstart", function(e){v._gotLoadStart = true;}, false);
       v.addEventListener("suspend", this.suspend, false);
       v.addEventListener("ended", this.ended, false);
+      v.addEventListener("error", function(e){v._gotErrorEvent = true; e.stopPropagation();}, false);
       var s1 = document.createElement("source");
       s1.src = "not-a-real-file.404"
       s1.type = test.type;
@@ -297,8 +300,8 @@ var tests = [
       v.addEventListener("loadstart", function(e){v.preload = "metadata";}, false);
       v.addEventListener("loadedmetadata", function(e){v._gotLoadedMetaData = true;}, false);
       v.addEventListener("loadeddata", this.loadeddata, false);
-      v.src = test.name;
-      document.body.appendChild(v); // Causes implicit load.
+      v.src = test.name; // Causes implicit load.
+      document.body.appendChild(v);
     },
   },
   /*{
@@ -326,8 +329,8 @@ var tests = [
       v.addEventListener("loadedmetadata", function(e){v._gotLoadedMetaData = true;}, false);
       v.addEventListener("loadeddata", function(){v.preload = "auto"}, false);
       v.addEventListener("canplaythrough", this.canplaythrough, false);
-      v.src = test.name;
-      document.body.appendChild(v); // Causes implicit load.
+      v.src = test.name; // Causes implicit load.
+      document.body.appendChild(v);
     },
   },*/
   {
@@ -348,8 +351,8 @@ var tests = [
       v.addEventListener("loadstart", function(e){v.preload = "auto";}, false);
       v.addEventListener("loadedmetadata", function(e){v._gotLoadedMetaData = true;}, false);
       v.addEventListener("canplaythrough", this.canplaythrough, false);
-      v.src = test.name;
-      document.body.appendChild(v); // Causes implicit load.
+      v.src = test.name; // Causes implicit load.
+      document.body.appendChild(v);
     },
   },
   {
@@ -372,8 +375,8 @@ var tests = [
       v.addEventListener("loadstart", function(e){v.preload = "metadata";}, false);
       v.addEventListener("loadedmetadata", function(e){v._gotLoadedMetaData = true;}, false);
       v.addEventListener("loadeddata", this.loadeddata, false);
-      v.src = test.name;
-      document.body.appendChild(v); // Causes implicit load.
+      v.src = test.name; // Causes implicit load.
+      document.body.appendChild(v);
     },
   },
   {
@@ -397,8 +400,8 @@ var tests = [
       v.addEventListener("loadstart", function(e){v._gotLoadStart = true;}, false);
       v.addEventListener("loadedmetadata", function(e){v._gotLoadedMetaData = true;}, false);
       v.addEventListener("canplaythrough", this.canplaythrough, false);
-      v.src = test.name;
-      document.body.appendChild(v); // Causes implicit load.
+      v.src = test.name; // Causes implicit load.
+      document.body.appendChild(v);
       v.preload = "metadata";
     },
   },
@@ -426,8 +429,8 @@ var tests = [
       v.addEventListener("loadstart", function(e){v._gotLoadStart = true;}, false);
       v.addEventListener("loadedmetadata", function(e){v._gotLoadedMetaData = true;}, false);
       v.addEventListener("loadeddata", this.loadeddata, false);
-      v.src = test.name;
-      document.body.appendChild(v); // Causes implicit load.
+      v.src = test.name; // Causes implicit load.
+      document.body.appendChild(v);
       v.preload = "none";
     },
   },
@@ -486,8 +489,8 @@ var tests = [
       v.addEventListener("loadstart", function(e){v._gotLoadStart = true;}, false);
       v.addEventListener("loadedmetadata", function(e){v._gotLoadedMetaData = true;}, false);
       v.addEventListener("ended", this.ended, false);
-      v.src = test.name;
-      document.body.appendChild(v); // Causes implicit load.
+      v.src = test.name; // Causes implicit load.
+      document.body.appendChild(v);
     },
   },
   {
@@ -506,8 +509,8 @@ var tests = [
       v.preload = "metadata";
       v.autoplay = true;
       v.addEventListener("ended", this.ended, false);
-      v.src = test.name;
-      document.body.appendChild(v); // Causes implicit load.
+      v.src = test.name; // Causes implicit load.
+      document.body.appendChild(v);
     },
   },
   {
diff --git a/content/media/test/test_source_write.html b/content/media/test/test_source_write.html
index c7a156f26e2b..33503aaa71ae 100644
--- a/content/media/test/test_source_write.html
+++ b/content/media/test/test_source_write.html
@@ -33,8 +33,8 @@ if (resource != null) {
   v.appendChild(s);
 }
 
-ok(v.networkState == HTMLMediaElement.NETWORK_EMPTY,
-   "We shouldn't start a load until the video tag is closed.");
+ok(v.networkState == HTMLMediaElement.NETWORK_NO_SOURCE,
+   "We shouldn't start network load until the current task returns.");
 </script>
 </video>
 </body>
diff --git a/content/media/wave/nsWaveDecoder.cpp b/content/media/wave/nsWaveDecoder.cpp
index b54376fd4a04..91e1088c6562 100644
--- a/content/media/wave/nsWaveDecoder.cpp
+++ b/content/media/wave/nsWaveDecoder.cpp
@@ -1466,7 +1466,6 @@ nsWaveDecoder::ResourceLoaded()
 
   if (mElement) {
     // Ensure the final progress event gets fired
-    mElement->DispatchAsyncProgressEvent(NS_LITERAL_STRING("progress"));
     mElement->ResourceLoaded();
   }
 
@@ -1533,8 +1532,10 @@ nsWaveDecoder::NotifyDownloadEnded(nsresult aStatus)
 {
   if (NS_SUCCEEDED(aStatus)) {
     ResourceLoaded();
-  } else if (aStatus != NS_BASE_STREAM_CLOSED &&
-             aStatus != NS_BINDING_ABORTED) {
+  } else if (aStatus == NS_BINDING_ABORTED) {
+    // Download has been cancelled by user.
+    mElement->LoadAborted();
+  } else if (aStatus != NS_BASE_STREAM_CLOSED) {
     NetworkError();
   }
   UpdateReadyStateForData();
diff --git a/dom/interfaces/html/nsIDOMHTMLMediaElement.idl b/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
index d9a5cb05a0f6..0a1280421eb6 100644
--- a/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
@@ -57,7 +57,7 @@
 #endif
 %}
 
-[scriptable, uuid(4355cfdb-0d70-4e5b-bb48-3ae8111ee72b)]
+[scriptable, uuid(c8b1423f-1321-4324-b6b7-8548d2fdc3da)]
 interface nsIDOMHTMLMediaElement : nsIDOMHTMLElement
 {
   // error state
@@ -69,8 +69,7 @@ interface nsIDOMHTMLMediaElement : nsIDOMHTMLElement
   const unsigned short NETWORK_EMPTY = 0;
   const unsigned short NETWORK_IDLE = 1;
   const unsigned short NETWORK_LOADING = 2;
-  const unsigned short NETWORK_LOADED = 3;
-  const unsigned short NETWORK_NO_SOURCE = 4;
+  const unsigned short NETWORK_NO_SOURCE = 3;
   readonly attribute unsigned short networkState;
            attribute DOMString preload;  
   readonly attribute nsIDOMTimeRanges buffered;
diff --git a/parser/html/nsHtml5TreeBuilderCppSupplement.h b/parser/html/nsHtml5TreeBuilderCppSupplement.h
index 1f4311eb8dae..2e49a61cc2d4 100644
--- a/parser/html/nsHtml5TreeBuilderCppSupplement.h
+++ b/parser/html/nsHtml5TreeBuilderCppSupplement.h
@@ -515,9 +515,7 @@ nsHtml5TreeBuilder::elementPopped(PRInt32 aNamespace, nsIAtom* aName, nsIContent
   // Some HTML nodes need DoneAddingChildren() called to initialize
   // properly (e.g. form state restoration).
   // XXX expose ElementName group here and do switch
-  if (aName == nsHtml5Atoms::video ||
-      aName == nsHtml5Atoms::audio ||
-      aName == nsHtml5Atoms::object ||
+  if (aName == nsHtml5Atoms::object ||
       aName == nsHtml5Atoms::applet) {
     nsHtml5TreeOperation* treeOp = mOpQueue.AppendElement();
     NS_ASSERTION(treeOp, "Tree op allocation failed.");
diff --git a/widget/public/nsIAppShell.idl b/widget/public/nsIAppShell.idl
index d02278314073..ec4abec74ddc 100644
--- a/widget/public/nsIAppShell.idl
+++ b/widget/public/nsIAppShell.idl
@@ -38,12 +38,13 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsISupports.idl"
+#include "nsIRunnable.idl"
 
 /**
  * Interface for the native event system layer.  This interface is designed
  * to be used on the main application thread only.
  */
-[uuid(501403e9-a091-4780-ba55-cfd1e21287a1)]
+[uuid(40bc6280-ad83-471e-b197-80ab90e2065e)]
 interface nsIAppShell : nsISupports
 {
   /**
@@ -101,4 +102,15 @@ interface nsIAppShell : nsISupports
    * The current event loop nesting level.
    */
   readonly attribute unsigned long eventloopNestingLevel;
+  
+  /**
+   * Allows running of a "synchronous section", in the form of an nsIRunnable
+   * once the event loop has reached a "stable state". We've reached a stable
+   * state when the currently executing task/event has finished, see:
+   * http://www.whatwg.org/specs/web-apps/current-work/multipage/webappapis.html#synchronous-section
+   * In practice this runs aRunnable once the currently executing event
+   * finishes. If called multiple times per task/event, all the runnables will
+   * be executed, in the order in which runInStableState() was called.
+   */
+  void runInStableState(in nsIRunnable aRunnable);
 };
diff --git a/widget/src/xpwidgets/nsBaseAppShell.cpp b/widget/src/xpwidgets/nsBaseAppShell.cpp
index 1320eefb403a..fe489d8e8c25 100644
--- a/widget/src/xpwidgets/nsBaseAppShell.cpp
+++ b/widget/src/xpwidgets/nsBaseAppShell.cpp
@@ -324,14 +324,36 @@ nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal *thr, PRBool mayWait,
     thr->Dispatch(mDummyEvent, NS_DISPATCH_NORMAL);
   }
 
+  // We're about to run an event, so we're in a stable state. 
+  RunSyncSections();
+
   return NS_OK;
 }
 
+void
+nsBaseAppShell::RunSyncSections()
+{
+  if (mSyncSections.Count() == 0) {
+    return;
+  }
+  // We've got synchronous sections awaiting a stable state. Run
+  // all the synchronous sections. Note that a synchronous section could
+  // add another synchronous section, so we don't remove elements from
+  // mSyncSections until all sections have been run, else we'll screw up
+  // our iteration.
+  for (PRUint32 i=0; i<mSyncSections.Count(); i++) {
+    mSyncSections[i]->Run();
+  }
+  mSyncSections.Clear();
+}
+
 // Called from the main thread
 NS_IMETHODIMP
 nsBaseAppShell::AfterProcessNextEvent(nsIThreadInternal *thr,
                                       PRUint32 recursionDepth)
 {
+  // We've just finished running an event, so we're in a stable state. 
+  RunSyncSections();
   return NS_OK;
 }
 
@@ -343,3 +365,18 @@ nsBaseAppShell::Observe(nsISupports *subject, const char *topic,
   Exit();
   return NS_OK;
 }
+
+NS_IMETHODIMP
+nsBaseAppShell::RunInStableState(nsIRunnable* aRunnable)
+{
+  if (!mRunning) {
+    // We're not running a "task"/event, so we're already in a "stable state",
+    // so we can run the synchronous section immediately.
+    aRunnable->Run();
+    return NS_OK;
+  }
+  // Else we're running a "task"/event, record the synchronous section, and
+  // run it with any others once we reach a stable state.
+  mSyncSections.AppendObject(aRunnable);
+  return NS_OK;
+}
diff --git a/widget/src/xpwidgets/nsBaseAppShell.h b/widget/src/xpwidgets/nsBaseAppShell.h
index bb991e77204c..6924ab8e098c 100644
--- a/widget/src/xpwidgets/nsBaseAppShell.h
+++ b/widget/src/xpwidgets/nsBaseAppShell.h
@@ -42,6 +42,7 @@
 #include "nsIThreadInternal.h"
 #include "nsIObserver.h"
 #include "nsIRunnable.h"
+#include "nsCOMArray.h"
 #include "nsCOMPtr.h"
 #include "prinrval.h"
 
@@ -99,6 +100,11 @@ protected:
 private:
   PRBool DoProcessNextNativeEvent(PRBool mayWait);
 
+  /**
+   * Runs all synchronous sections which are queued up in mSyncSections.
+   */
+  void RunSyncSections();
+
   nsCOMPtr<nsIRunnable> mDummyEvent;
   /**
    * mBlockedWait points back to a slot that controls the wait loop in
@@ -119,6 +125,7 @@ private:
     eEventloopOther  // innermost native event loop is a native library/plugin etc
   };
   EventloopNestingState mEventloopNestingState;
+  nsCOMArray<nsIRunnable> mSyncSections;
   PRPackedBool mRunning;
   PRPackedBool mExiting;
   /**

From 126937b6af827c52d322548d5e468a27369ee6a0 Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nzm>
Date: Fri, 3 Sep 2010 12:03:03 +1200
Subject: [PATCH 071/222] Bug 528523 - Ensure sync sections run in between
 events. r=roc a=blocking2.0

---
 widget/src/xpwidgets/nsBaseAppShell.cpp | 27 +++++++++++++++++--------
 widget/src/xpwidgets/nsBaseAppShell.h   |  2 +-
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/widget/src/xpwidgets/nsBaseAppShell.cpp b/widget/src/xpwidgets/nsBaseAppShell.cpp
index fe489d8e8c25..c8e0a41da701 100644
--- a/widget/src/xpwidgets/nsBaseAppShell.cpp
+++ b/widget/src/xpwidgets/nsBaseAppShell.cpp
@@ -70,6 +70,11 @@ nsBaseAppShell::nsBaseAppShell()
 {
 }
 
+nsBaseAppShell::~nsBaseAppShell()
+{
+  NS_ASSERTION(mSyncSections.Count() == 0, "Must have run all sync sections");
+}
+
 nsresult
 nsBaseAppShell::Init()
 {
@@ -369,14 +374,20 @@ nsBaseAppShell::Observe(nsISupports *subject, const char *topic,
 NS_IMETHODIMP
 nsBaseAppShell::RunInStableState(nsIRunnable* aRunnable)
 {
-  if (!mRunning) {
-    // We're not running a "task"/event, so we're already in a "stable state",
-    // so we can run the synchronous section immediately.
-    aRunnable->Run();
-    return NS_OK;
-  }
-  // Else we're running a "task"/event, record the synchronous section, and
-  // run it with any others once we reach a stable state.
+  NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
+  // Record the synchronous section, and run it with any others once
+  // we reach a stable state.
   mSyncSections.AppendObject(aRunnable);
+
+  // Ensure we've got a pending event, else the callbacks will never run.
+  nsIThread* thread = NS_GetCurrentThread(); 
+  if (!NS_HasPendingEvents(thread) &&
+       NS_FAILED(thread->Dispatch(new nsRunnable(), NS_DISPATCH_NORMAL)))
+  {
+    // Failed to dispatch dummy event to cause sync sections to run, thread
+    // is probably done processing events, just run the sync sections now.
+    RunSyncSections();
+  }
   return NS_OK;
 }
+
diff --git a/widget/src/xpwidgets/nsBaseAppShell.h b/widget/src/xpwidgets/nsBaseAppShell.h
index 6924ab8e098c..3a8a1fe63215 100644
--- a/widget/src/xpwidgets/nsBaseAppShell.h
+++ b/widget/src/xpwidgets/nsBaseAppShell.h
@@ -62,7 +62,7 @@ public:
   nsBaseAppShell();
 
 protected:
-  virtual ~nsBaseAppShell() {}
+  virtual ~nsBaseAppShell();
 
   /**
    * This method is called by subclasses when the app shell singleton is

From 39524be8153861aa91f692cf6e0baabc24a71d50 Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nz>
Date: Fri, 3 Sep 2010 12:03:03 +1200
Subject: [PATCH 072/222] Bug 485288 - Ensure video context menu doesn't show
 when video's source children don't contain a resource. r=dolske a=blocking2.0

---
 browser/base/content/nsContextMenu.js   | 3 ++-
 content/media/test/test_audiowrite.html | 1 -
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index 977678017fda..eadc5b04f1d2 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -404,7 +404,8 @@ nsContextMenu.prototype = {
     this.showItem("context-video-fullscreen", this.onVideo);
     // Disable them when there isn't a valid media source loaded.
     if (onMedia) {
-      var hasError = (this.target.error != null);
+      var hasError = this.target.error != null ||
+                     this.target.networkState == this.target.NETWORK_NO_SOURCE;
       this.setItemAttr("context-media-play",  "disabled", hasError);
       this.setItemAttr("context-media-pause", "disabled", hasError);
       this.setItemAttr("context-media-mute",   "disabled", hasError);
diff --git a/content/media/test/test_audiowrite.html b/content/media/test/test_audiowrite.html
index be1dfb75bc84..50227091a2aa 100644
--- a/content/media/test/test_audiowrite.html
+++ b/content/media/test/test_audiowrite.html
@@ -60,7 +60,6 @@ function runTests() {
     writeArgsOK = true;
   }
   ok(writeArgsOK, "mozWriteAudio args test failed.");
-
   SimpleTest.finish();
 }
 

From b26c5c69d642c9e75dda1cebf4b8d7f49c57a932 Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nz>
Date: Fri, 3 Sep 2010 12:03:03 +1200
Subject: [PATCH 073/222] Bug 485288 - Don't process video controls events
 after bindings detached. r=dolske a=blocking2.0

---
 toolkit/content/widgets/videocontrols.xml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/toolkit/content/widgets/videocontrols.xml b/toolkit/content/widgets/videocontrols.xml
index d0f5fed53bad..bff881f57d05 100644
--- a/toolkit/content/widgets/videocontrols.xml
+++ b/toolkit/content/widgets/videocontrols.xml
@@ -404,8 +404,10 @@
 
                     // If the binding is detached (or has been replaced by a
                     // newer instance of the binding), nuke our event-listeners.
-                    if (this.videocontrols.randomID != this.randomID)
+                    if (this.videocontrols.randomID != this.randomID) {
                         this.terminateEventListeners();
+                        return;
+                    }
 
                     switch (aEvent.type) {
                         case "play":

From be2bfe2038717c18dd05f68c03b46451e4578246 Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nz>
Date: Fri, 3 Sep 2010 12:03:03 +1200
Subject: [PATCH 074/222] Bug 593074 - Prevent multiple test finish from
 causing errors. a=test-fix

---
 content/media/test/test_preload_actions.html | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/content/media/test/test_preload_actions.html b/content/media/test/test_preload_actions.html
index 3b3cbb742bd8..4172c4cfa9ae 100644
--- a/content/media/test/test_preload_actions.html
+++ b/content/media/test/test_preload_actions.html
@@ -46,7 +46,9 @@ function log(m) {
 
 function maybeFinish(v, n) {
   log(n + ",");
-  v.parentNode.removeChild(v);
+  if (v.parentNode) {
+    v.parentNode.removeChild(v);
+  }
   manager.finished(v.token);
 }
 

From 0f27aac7094be5a1baccf295a8cb6034d18cb408 Mon Sep 17 00:00:00 2001
From: Frank Yan <fryn@frankyan.com>
Date: Thu, 2 Sep 2010 19:20:12 -0700
Subject: [PATCH 075/222] Bug 544816 - Attach combined Stop/Go/Refresh button
 to the Location Bar.  r=dolske, ui-r=shorlander, a=dolske

---
 browser/base/content/browser.css              |  13 +++-
 browser/base/content/browser.js               |  28 +++++---
 browser/base/content/browser.xul              |  36 ++++++----
 browser/components/nsBrowserGlue.js           |  29 ++++++--
 .../themes/gnomestripe/browser/browser.css    |  64 +++++++++++++++++-
 browser/themes/gnomestripe/browser/jar.mn     |   1 +
 .../gnomestripe/browser/reload-stop-go.png    | Bin 0 -> 1608 bytes
 browser/themes/pinstripe/browser/browser.css  |  58 +++++++++++++++-
 browser/themes/pinstripe/browser/jar.mn       |   1 +
 .../pinstripe/browser/reload-stop-go.png      | Bin 0 -> 1516 bytes
 browser/themes/winstripe/browser/browser.css  |  63 ++++++++++++++++-
 browser/themes/winstripe/browser/jar.mn       |   2 +
 .../winstripe/browser/reload-stop-go.png      | Bin 0 -> 1590 bytes
 toolkit/content/widgets/autocomplete.xml      |   2 +
 14 files changed, 263 insertions(+), 34 deletions(-)
 create mode 100644 browser/themes/gnomestripe/browser/reload-stop-go.png
 create mode 100644 browser/themes/pinstripe/browser/reload-stop-go.png
 create mode 100644 browser/themes/winstripe/browser/reload-stop-go.png

diff --git a/browser/base/content/browser.css b/browser/base/content/browser.css
index 3331daf75dca..3b2e3831fd78 100644
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -100,6 +100,13 @@ toolbarpaletteitem[place="palette"] > toolbaritem > hbox[type="places"] {
   display: none;
 }
 
+#wrapper-urlbar-container #urlbar-container > #urlbar > toolbarbutton,
+#urlbar-container:not([combined]) > #urlbar > toolbarbutton,
+#urlbar-container[combined] + #reload-button + #stop-button,
+#urlbar-container[combined] + #reload-button,
+toolbar:not([mode="icons"]) > #urlbar-container > #urlbar > toolbarbutton,
+toolbar[mode="icons"] > #urlbar-container > #urlbar > #urlbar-reload-button:not([displaystop]) + #urlbar-stop-button,
+toolbar[mode="icons"] > #urlbar-container > #urlbar > #urlbar-reload-button[displaystop],
 toolbar[mode="icons"] > #reload-button:not([displaystop]) + #stop-button,
 toolbar[mode="icons"] > #reload-button[displaystop] {
   visibility: collapse;
@@ -178,8 +185,12 @@ richlistitem[type~="action"]:-moz-locale-dir(rtl) > .ac-url-box {
   direction: rtl;
 }
 
+#urlbar-container[combined] > #urlbar > #urlbar-icons > #go-button,
 #urlbar[pageproxystate="invalid"] > #urlbar-icons > .urlbar-icon:not(#go-button),
-#urlbar[pageproxystate="valid"] > #urlbar-icons > #go-button {
+#urlbar[pageproxystate="valid"] > #urlbar-icons > #go-button,
+#urlbar[pageproxystate="invalid"][focused="true"] > #urlbar-go-button ~ toolbarbutton,
+#urlbar[pageproxystate="valid"] > #urlbar-go-button,
+#urlbar:not([focused="true"]) > #urlbar-go-button {
   visibility: collapse;
 }
 
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index debad768d3ad..a47bc1f1d4a3 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -2360,10 +2360,13 @@ function UpdateUrlbarSearchSplitterState()
   var splitter = document.getElementById("urlbar-search-splitter");
   var urlbar = document.getElementById("urlbar-container");
   var searchbar = document.getElementById("search-container");
+  var stop = document.getElementById("stop-button");
 
   var ibefore = null;
   if (urlbar && searchbar) {
-    if (urlbar.nextSibling == searchbar)
+    if (urlbar.nextSibling == searchbar ||
+        urlbar.getAttribute("combined") &&
+        stop && stop.nextSibling == searchbar)
       ibefore = searchbar;
     else if (searchbar.nextSibling == urlbar)
       ibefore = urlbar;
@@ -4456,23 +4459,30 @@ var CombinedStopReload = {
     if (this._initialized)
       return;
 
-    var stop = document.getElementById("stop-button");
-    if (!stop)
-      return;
-
+    var urlbar = document.getElementById("urlbar-container");
     var reload = document.getElementById("reload-button");
-    if (!reload)
-      return;
+    var stop = document.getElementById("stop-button");
 
-    if (!(reload.nextSibling == stop))
+    if (urlbar) {
+      if (urlbar.parentNode.getAttribute("mode") != "icons" ||
+          !reload || urlbar.nextSibling != reload ||
+          !stop || reload.nextSibling != stop)
+        urlbar.removeAttribute("combined");
+      else {
+        urlbar.setAttribute("combined", "true");
+        reload = document.getElementById("urlbar-reload-button");
+        stop = document.getElementById("urlbar-stop-button");
+      }
+    }
+    if (!stop || !reload || reload.nextSibling != stop)
       return;
 
     this._initialized = true;
     if (XULBrowserWindow.stopCommand.getAttribute("disabled") != "true")
       reload.setAttribute("displaystop", "true");
     stop.addEventListener("click", this, false);
-    this.stop = stop;
     this.reload = reload;
+    this.stop = stop;
   },
 
   uninit: function () {
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index 386237ca5ea9..ecf93407570c 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -790,10 +790,10 @@
              fullscreentoolbar="true" mode="icons" customizable="true"
 #ifdef WINCE
              iconsize="small" defaulticonsize="small"
-             defaultset="unified-back-forward-button,reload-button,stop-button,home-button,urlbar-container,search-container,bookmarks-menu-button-container,navigator-throbber,fullscreenflex,window-controls"
+             defaultset="unified-back-forward-button,home-button,urlbar-container,reload-button,stop-button,search-container,bookmarks-menu-button-container,navigator-throbber,fullscreenflex,window-controls"
 #else
              iconsize="large"
-             defaultset="unified-back-forward-button,reload-button,stop-button,home-button,urlbar-container,search-container,bookmarks-menu-button-container,fullscreenflex,window-controls"
+             defaultset="unified-back-forward-button,home-button,urlbar-container,reload-button,stop-button,search-container,bookmarks-menu-button-container,fullscreenflex,window-controls"
 #endif
              context="toolbar-context-menu">
 
@@ -827,17 +827,6 @@
         </toolbarbutton>
       </toolbaritem>
 
-      <toolbarbutton id="reload-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
-                     label="&reloadCmd.label;" removable="true"
-                     command="Browser:ReloadOrDuplicate"
-                     onclick="checkForMiddleClick(this, event);"
-                     tooltiptext="&reloadButton.tooltip;"/>
-
-      <toolbarbutton id="stop-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
-                     label="&stopCmd.label;" removable="true"
-                     command="Browser:Stop"
-                     tooltiptext="&stopButton.tooltip;"/>
-
       <toolbarbutton id="home-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
                      persist="class" removable="true"
                      label="&homeButton.label;"
@@ -919,9 +908,30 @@
                    tooltiptext="&goEndCap.tooltip;"
                    onclick="gURLBar.handleCommand(event);"/>
           </hbox>
+          <toolbarbutton id="urlbar-go-button"
+                         onclick="gURLBar.handleCommand(event);"
+                         tooltiptext="&goEndCap.tooltip;"/>
+          <toolbarbutton id="urlbar-reload-button"
+                         command="Browser:ReloadOrDuplicate"
+                         onclick="checkForMiddleClick(this, event);"
+                         tooltiptext="&reloadButton.tooltip;"/>
+          <toolbarbutton id="urlbar-stop-button"
+                         command="Browser:Stop"
+                         tooltiptext="&stopButton.tooltip;"/>
         </textbox>
       </toolbaritem>
 
+      <toolbarbutton id="reload-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
+                     label="&reloadCmd.label;" removable="true"
+                     command="Browser:ReloadOrDuplicate"
+                     onclick="checkForMiddleClick(this, event);"
+                     tooltiptext="&reloadButton.tooltip;"/>
+
+      <toolbarbutton id="stop-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
+                     label="&stopCmd.label;" removable="true"
+                     command="Browser:Stop"
+                     tooltiptext="&stopButton.tooltip;"/>
+
       <toolbaritem id="search-container" title="&searchItem.title;"
                    align="center" class="chromeclass-toolbar-additional"
                    flex="100" persist="width" removable="true">
diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js
index 8ad446463adb..5df106cfad57 100644
--- a/browser/components/nsBrowserGlue.js
+++ b/browser/components/nsBrowserGlue.js
@@ -589,7 +589,7 @@ BrowserGlue.prototype = {
     var buttonAccessKey  = rightsBundle.GetStringFromName("buttonAccessKey");
     var productName      = brandBundle.GetStringFromName("brandFullName");
     var notifyRightsText = rightsBundle.formatStringFromName("notifyRightsText", [productName], 1);
-    
+
     var buttons = [
                     {
                       label:     buttonLabel,
@@ -995,7 +995,7 @@ BrowserGlue.prototype = {
   },
 
   _migrateUI: function BG__migrateUI() {
-    const UI_VERSION = 2;
+    const UI_VERSION = 3;
     let currentUIVersion = 0;
     try {
       currentUIVersion = Services.prefs.getIntPref("browser.migration.version");
@@ -1053,6 +1053,25 @@ BrowserGlue.prototype = {
       }
     }
 
+    if (currentUIVersion < 3) {
+      // This code merges the reload/stop/go button into the url bar.
+      let currentsetResource = this._rdf.GetResource("currentset");
+      let toolbarResource = this._rdf.GetResource("chrome://browser/content/browser.xul#nav-bar");
+      let currentset = this._getPersist(toolbarResource, currentsetResource);
+      // Need to migrate only if toolbar is customized and all 3 elements are found.
+      if (currentset &&
+          currentset.indexOf("reload-button") != -1 &&
+          currentset.indexOf("stop-button") != -1 &&
+          currentset.indexOf("urlbar-container") != -1 &&
+          currentset.indexOf("urlbar-container,reload-button,stop-button") == -1) {
+        currentset = currentset.replace(/(^|,)reload-button($|,)/, "$1$2").
+                                replace(/(^|,)stop-button($|,)/, "$1$2").
+                                replace(/(^|,)urlbar-container($|,)/,
+                                        "$1urlbar-container,reload-button,stop-button$2");
+        this._setPersist(toolbarResource, currentsetResource, currentset);
+      }
+    }
+
     if (this._dirty)
       this._dataSource.QueryInterface(Ci.nsIRDFRemoteDataSource).Flush();
 
@@ -1090,7 +1109,7 @@ BrowserGlue.prototype = {
   // ------------------------------
   // public nsIBrowserGlue members
   // ------------------------------
-  
+
   sanitize: function BG_sanitize(aParentWindow) {
     this._sanitizer.sanitize(aParentWindow);
   },
@@ -1229,7 +1248,7 @@ BrowserGlue.prototype = {
                                     SMART_BOOKMARKS_ANNO, smartBookmark.queryId,
                                     0, annosvc.EXPIRE_NEVER);
         }
-        
+
         // If we are creating all Smart Bookmarks from ground up, add a
         // separator below them in the bookmarks menu.
         if (smartBookmarksCurrentVersion == 0 &&
@@ -1324,7 +1343,7 @@ GeolocationPrompt.prototype = {
       request.allow();
       return;
     }
-    
+
     if (result == Ci.nsIPermissionManager.DENY_ACTION) {
       request.cancel();
       return;
diff --git a/browser/themes/gnomestripe/browser/browser.css b/browser/themes/gnomestripe/browser/browser.css
index f6a882867aa6..c684a32c73dc 100644
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@@ -701,7 +701,7 @@ toolbar[iconsize="small"] #reload-button[disabled="true"] {
   list-style-image: url("moz-icon://stock/gtk-refresh?size=menu&state=disabled");
 }
 
-toolbar[iconsize="small"] #home-button ,
+toolbar[iconsize="small"] #home-button,
 #home-button.bookmark-item {
   list-style-image: url("moz-icon://stock/gtk-home?size=menu");
 }
@@ -787,6 +787,7 @@ toolbar[iconsize="small"] #fullscreen-button {
   width: 7em;
   min-width: 7em;
   -moz-appearance: textfield;
+  padding: 0;
 }
 
 #urlbar > .autocomplete-textbox-container {
@@ -1113,11 +1114,72 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
 }
 
 /* Go button */
+
 #go-button {
   padding: 3px 2px 2px 2px;
   list-style-image: url("chrome://browser/skin/Go-arrow.png");
 }
 
+/* Combined go/reload/stop button in location bar */
+
+#urlbar > toolbarbutton {
+  -moz-appearance: none;
+  list-style-image: url("chrome://browser/skin/reload-stop-go.png");
+  margin: -1px;
+  -moz-margin-start: 0;
+  padding: 0 3px;
+  background-origin: border-box;
+  border: none;
+  border-left: 1px solid rgba(0,0,0,.35);
+  -moz-border-radius-topright: 2px;
+  -moz-border-radius-bottomright: 2px;
+}
+
+#urlbar > toolbarbutton:active:hover {
+  padding-left: 4px;
+  border-left: none;
+  -moz-box-shadow: 0 0 9px rgba(0,0,0,.4) inset,
+                   0 0 3px rgba(0,0,0,.4) inset;
+}
+
+#urlbar-go-button {
+  -moz-image-region: rect(0px, 56px, 14px, 42px);
+  background-image: -moz-linear-gradient(rgb(143,219,69), rgb(115,177,57));
+  -moz-box-shadow: 0 1px 0 rgba(0,0,0,.1) inset,
+                   -1px -1px 0 rgba(255,255,255,.2) inset;
+}
+
+#urlbar-go-button:hover {
+  background-image: -moz-linear-gradient(rgb(163,232,92), rgb(137,196,81));
+}
+
+#urlbar-reload-button {
+  -moz-image-region: rect(0px, 14px, 14px, 0px);
+}
+
+#urlbar-reload-button:hover {
+  -moz-image-region: rect(0px, 28px, 14px, 14px);
+  background-image: -moz-linear-gradient(rgb(137,183,233), rgb(79,130,195));
+  -moz-box-shadow: 0 1px 0 rgba(0,0,0,.1) inset,
+                   -1px -1px 0 rgba(255,255,255,.2) inset;
+}
+
+#urlbar-stop-button {
+  -moz-image-region: rect(0px, 42px, 14px, 28px);
+  background-image: -moz-linear-gradient(rgb(226,99,99), rgb(199,68,68));
+  -moz-box-shadow: 0 1px 0 rgba(0,0,0,.1) inset,
+                   -1px -1px 0 rgba(255,255,255,.2) inset;
+}
+
+#urlbar-stop-button:hover {
+  background-image: -moz-linear-gradient(rgb(237,120,120), rgb(216,92,92));
+}
+
+
+#urlbar-stop-button[disabled="true"] > .toolbarbutton-icon {
+  opacity: .5;
+}
+
 /* Star button */
 #star-button {
   padding: 1px;
diff --git a/browser/themes/gnomestripe/browser/jar.mn b/browser/themes/gnomestripe/browser/jar.mn
index 9acbfb90a0cd..1baff47933a4 100644
--- a/browser/themes/gnomestripe/browser/jar.mn
+++ b/browser/themes/gnomestripe/browser/jar.mn
@@ -26,6 +26,7 @@ browser.jar:
   skin/classic/browser/page-livemarks.png
   skin/classic/browser/Privacy-16.png
   skin/classic/browser/Privacy-48.png
+  skin/classic/browser/reload-stop-go.png
   skin/classic/browser/searchbar.css                  (searchbar.css)
   skin/classic/browser/section_collapsed.png
   skin/classic/browser/section_collapsed-rtl.png
diff --git a/browser/themes/gnomestripe/browser/reload-stop-go.png b/browser/themes/gnomestripe/browser/reload-stop-go.png
new file mode 100644
index 0000000000000000000000000000000000000000..922a4c4c62e8ecd1bd380a62673dbc0b429b1756
GIT binary patch
literal 1608
zcmV-O2DkZ%P)<h;3K|Lk000e1NJLTq001}u000gM1^@s6dZpj40000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU%>PbXFRCwCdR%>h(MHHUd*~fjh_x3@N
zVik}A)f5wHYl}t1z9>*=A-0jCqyz}i<U%4?2_=9fv?z&0v@r+@2&Eu34ayr)1F2vI
z8X!QywuD<C^!>Vzy?b{&gN58~Zy`1Dhnsvmd(NDhGvAyua~4xd(f{>%F^N<{v#jBi
z*FKO9H<$_2k|wSHHwz(QG5P-V<1sc2M&EB<0gd7%ymv$ji5$oV`$jNh>f7PGz;80>
zbr~4rK&sN49!2>Xx;B8k5^NWhSNvq|Pat*(!Z;rzoPaPgB8u)HL@z?u4w!u&A>3@a
zu`1Db%&QnLgC-S_cbU>=AAJZkI{`;QU-~qHV`lQz9FG*Qf<1~$wbdQ>Uewy~k3TY}
zr=$g0E#*3$q_<eC*G=YtW|zxpR@}}dydW$h97ozZIvxGU4UJ2{9Jda`>$$Mt`p{r&
zduv;#WPi}a2u;Lb!t<nCL(ZU+q%_6tws0J`Z32+3rnCjxU=d_hRjs@vrGworAn6z|
zf)a8O0ed(vB@lqEBh$#*x?|om{Rn2xNC~%E1Iq%;X2+bIc|~tbdaD}LY*B_CrCUB$
z6*&={B9*Eda<M~z_ZpMY(Dvzi+rb6zX50d`6Ch1UT`=p)_4?ruNpOx#zT;rg?yBR*
zx30;~Ug+rPFbW)3{5r<P62}#QAEP-i@Lo}Q`S$qKRJZ2L?Szz!=0)TIa<XW^-5g=d
zg54!Z1V2S1Q^@AJ6W+=`XV7RcZr1B{rfD<hYyxuILB)3Aj}^=EGMznLiIB2Lk|ZPu
zLLY*XAVQj9v~Ja+G9Y&pR5gHF@%c&7S8p@~bA)t&>rU8RZ4|t)_}@w@D!#H<t@j00
z<>AnM#9AgZJ?m$7eWD@YXi<;4MI-K#47f|sV+Rm+G6*`<1G1CX;eruKB)1PiNhIke
zlj&M=YWf}!+nFvmd&Xz7?6S4CwjjIRj_h~uqNb*%KC4s_9Ul=MR&QIFeG0@LrW3*^
z&PS9cQK}NEdPRT)GVzmP@`Nc<&Mw}#u~H(WRl@ioYnjaStiRul$Rjrqu?yfNjF^B~
zin<=@c<hEt$H_w<$K%CMHYICDGO=0$ErjEL1-b2U$9Lt2cSCbt<HO^Vo*c#mj;#2g
zH=X}6XgtRj*Pt1v_&Y=Ka25@M5XY;k3o{#4rJvhuaV1Nao~xo%_A`V<RN*l4fO8M#
zU_JQJPQw*|*(VPdoHr$5*4`(ZQgQgCDv4sdqo-?#W-@jom1*$(6HgB=P`ys<Y-#J%
z-m13&zi4n)yVBP%4uTXe^eT$U7!u-HRaSP9wM=Gu)~_97HHF<$Tu6|eNR*wFS7fLH
zuq^<p!q$6b4re63x2tsR!3y6LrRD%jwJf{ia%QK;52C!$5fQ`cTH4x2@k8Ur4W=$a
zozr7NwkWC^st*eCZm6t0GdVl^G;5j6^sJxR`HnkZ)>wSK!n69yK6(A6Z{!kB4;6th
z2ZV{o!I8Piwr`7<e|^|D6Ca(yoZR`JQi{6+Os4(WSyN+uC!Lu-<<047leeTLC5CDj
zT3ncaP!f0<>f8sAvST&1aXerN6nTqwTn(gOR7}ims7K1iLx+yM5+7g1(wwzSX8Neu
z*qb%|)0ExPe?ErC0g-edNp%R^;*7%GALf;u1bv6ULN6UC+g)(_#E}9Bw$ABtU+{R8
z%Pf-^TrPKq!EBzocmEGn8izvRrqXvl`C`v(MNtHp>MsZ^6nQin5DCORA=bc^_pY6|
z>hDkMPHpY*7a}7sXf6~H^s%6~`#H;fp3&*TF`Z7=u_Cu<M_!hV9RtVH{$#>xE>&k8
zI<PORrTO7lx7!tDFq&_KgoZWb%zgjI$T8zsZE5x6$9nYCxrv3vr3ts|?ZX^Srv-}r
z{V^{^G!?DRKbsH}%{HZLpjxdh1<%m;d0w7oJy5iK+n1TibAJcX^~_&2R@ebijBM|B
zb1!NE?x*<D0U`h_9VI|#Z>lu<-n{?86V-dE$pabuEx-T<{bG<=UxnWQ0000<MNUMn
GLSTYm5&hQy

literal 0
HcmV?d00001

diff --git a/browser/themes/pinstripe/browser/browser.css b/browser/themes/pinstripe/browser/browser.css
index 53fad9b08b13..5c2cb74d3625 100644
--- a/browser/themes/pinstripe/browser/browser.css
+++ b/browser/themes/pinstripe/browser/browser.css
@@ -691,6 +691,9 @@ toolbar[iconsize="small"][mode="icons"] #forward-button:-moz-locale-dir(rtl) {
 #urlbar {
   -moz-border-radius: @toolbarbuttonCornerRadius@;
   direction: ltr;
+}
+
+#urlbar-container:not([combined]) > #urlbar {
   -moz-padding-end: 3px;
 }
 
@@ -899,15 +902,64 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
 
 #go-button {
   list-style-image: url("chrome://browser/skin/Go-arrow.png");
-  -moz-image-region: rect(0px, 16px, 16px, 0px);  
+  -moz-image-region: rect(0px, 16px, 16px, 0px);
 }
 
 #go-button:hover {
-  -moz-image-region: rect(0px, 32px, 16px, 16px);  
+  -moz-image-region: rect(0px, 32px, 16px, 16px);
 }
 
 #go-button:hover:active {
-  -moz-image-region: rect(0px, 48px, 16px, 32px);  
+  -moz-image-region: rect(0px, 48px, 16px, 32px);
+}
+
+/* ----- COMBINED GO/RELOAD/STOP BUTTON IN LOCATION BAR ----- */
+
+#urlbar > toolbarbutton {
+  list-style-image: url("chrome://browser/skin/reload-stop-go.png");
+  margin: 0;
+  -moz-margin-start: 2px;
+  padding: 0 3px;
+  background-origin: border-box;
+  border: none;
+  border-left: 1px solid rgba(0,0,0,.25);
+  -moz-border-radius-topright: 2px;
+  -moz-border-radius-bottomright: 2px;
+}
+
+#urlbar > toolbarbutton:active:hover {
+  -moz-box-shadow: @toolbarbuttonPressedInnerShadow@;
+  padding-left: 4px;
+  border-left: none;
+}
+
+#urlbar-go-button {
+  -moz-image-region: rect(0px, 56px, 14px, 42px);
+  background-image: -moz-linear-gradient(rgb(184,221,142), rgb(154,201,111) 49%, rgb(130,187,92) 51%, rgb(114,171,79));
+  -moz-box-shadow: 0 1px 0 rgba(0,0,0,.1) inset,
+                   -1px -1px 1px rgba(255,255,255,.15) inset;
+}
+
+#urlbar-reload-button {
+  -moz-image-region: rect(0px, 14px, 14px, 0px);
+}
+
+#urlbar-reload-button:hover {
+  -moz-image-region: rect(0px, 28px, 14px, 14px);
+  background-image: -moz-linear-gradient(rgb(162,207,241), rgb(111,178,225) 49%, rgb(91,159,217) 51%, rgb(62,138,200));
+  -moz-box-shadow: 0 1px 0 rgba(0,0,0,.1) inset,
+                   -1px -1px 1px rgba(255,255,255,.15) inset;
+}
+
+#urlbar-stop-button {
+  -moz-image-region: rect(0px, 42px, 14px, 28px);
+  background-image: -moz-linear-gradient(rgb(231,162,140), rgb(209,119,100) 49%, rgb(193,92,78) 51%, rgb(173,72,58));
+  -moz-box-shadow: 0 1px 0 rgba(0,0,0,.1) inset,
+                   -1px -1px 1px rgba(255,255,255,.15) inset;
+}
+
+#urlbar-stop-button[disabled="true"] > .toolbarbutton-icon {
+  opacity: .4;
 }
 
 /* STAR BUTTON */
diff --git a/browser/themes/pinstripe/browser/jar.mn b/browser/themes/pinstripe/browser/jar.mn
index ba19934e32ca..31435d1b4b57 100644
--- a/browser/themes/pinstripe/browser/jar.mn
+++ b/browser/themes/pinstripe/browser/jar.mn
@@ -41,6 +41,7 @@ browser.jar:
   skin/classic/browser/Popup-blocked.png
   skin/classic/browser/Privacy-16.png
   skin/classic/browser/Privacy-48.png
+  skin/classic/browser/reload-stop-go.png
   skin/classic/browser/searchbar-dropmarker.png
   skin/classic/browser/searchbar.css
   skin/classic/browser/Search.png
diff --git a/browser/themes/pinstripe/browser/reload-stop-go.png b/browser/themes/pinstripe/browser/reload-stop-go.png
new file mode 100644
index 0000000000000000000000000000000000000000..0406477f52e20d343d5d7903aee28d6d05bcbc63
GIT binary patch
literal 1516
zcmV<I1rz#-P)<h;3K|Lk000e1NJLTq001}u000gM1^@s6dZpj40000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU%j!8s8RCwClR(()ZRTO{s-S^&p?;^Ue
zAHahZK@CM?%mi^ls!5qNMxAl8FenvshAFi&KXR-bOHE2MaA{1c889<zOa(Pd9We8&
z!cSC0Bnq~~T0VC7?R&3t4IKCNHb18R>CB$F@1A$|-t)WXch7l9mSyVyEcBf?8w`f2
zce4rRN6+{-gVv?6YeDU|<I5-jSZSJ`3_1cKWQFW{BuP33<0ly7Y>wlmfm@{t02_r+
z9z~&%FpZ)R)k?|o5qK^K9S`pcU@TMqZy1LjgJJ*o0l8gax4@7M_Rmzaf~X8cqs{sh
zb`$XLqwbS}5Dp;frKs6#9>%ilA`OVuYHe{i9KW@+wDk3OJdR*6C^8_#4{VQyfQuhJ
z64Cf|SPCcdj%&&NdEdE<P27d176U9T060uZqE@`LKU)D}GNPzOG{)y8QJi(62jp-7
z2eu7hONPi+0>}zw(8i%$ElpDaSRYHW{F5wEtGZ4K$HHdNVzF5Ddi~3hk&*uS^XG3V
zC@820b0<k^PEO90`uh5zkX1@h929`FVTO4%(qi#%T(#iL__3o-gSm}lF?ZJDjP3gl
z8v!^4*+j~XOLy+}ESvfCwbte<vA~Y?_i|_sm__mo;CQRu{`-=WGLI_dX(Z5?@{wm)
zy00Y3#Q^#nNLF!YozVU_fRMc@kT_jYQBfs;+Y2Tyu{)j4sX*JII-QOp0F`1g81g&1
z{kUZLyjlQ9DA;m+QCHS9gjo|pv`;1o5eh2*d;fzE9VxBa^TnKT507uX(&S_@E(Ws%
z;9{fgj*j(Jd#YT627jwcQ3eGWi~<Nz*9izeK@{Z-cuqH_avM5+2y6){G5{c*=lRCM
z!onNiqN1Xv0_bT39E=p)KME)uvXMl|8EGj=?YWPPxdD#tpZz3I_6Y#R$daU|#GoEV
zjY^zdd{VNzq<ZfTXB__rEs8c!ht1*izV{cn4dBzEN;?LLEJq70hy9!e2RM%I<}`E{
z!y*cFu4y>8G$ex%yb(a0?FC1qt*z})Z_wey?+<DXdfnxl{e+8Ok$LTH7R0WPSFfyu
zAV&8d9fz@R%ldVdFTPvS5w<EbGyxc-5fXtPaDIRzC@~sNE9K|TJiV}R>G2SNMx(LI
z>-Aa`>s;>9uwphD0?og8l-W7ZqqmfF4w)GSFGr$ijEaeY46yRgjhBpHZY+E4b9d>y
zT19oeiJ~&Y(K1aVs4+4v2{MzJmesN1`QoFl*u*MuIT}LIgoK28pU;;JG)=mbeso{z
zpteiRtud@??4UdCWdt0{;I%+YKFZ+?tl71vX7!HhgLXbX0Jd224t)Bk1BBdR8p{Z2
ztbH8Jx`iJ!ZeFwfQvgTqF=<b72*8OGC+>o~CO|cP3ED#lNSn=;WVhR=M@L7Slp7W0
zPpa0ijLdTE61aOIAjzC{WfkItF=n+OO=feBEQ(3}?2h1DReSfxB@cARBn~KBy>s`z
z=r~@0cm2%~5fj2RHx912_VIDgw12(v_<;#olh%QCo7$c2?Sopk+da9Wq9XU|)vHWr
zXXjbyeNE8%;<Q@rKq%b;H2f8Hb#=;K6Y=5JsztLG7pDk8iL`=qpiQtO4~IAyQ!;I{
zMl5YSwDq7$m}w;oUYIj(dj6^S(1N0GzHolV_V?YXv)@=%3iI!jf6RIIfo*TjeWxxZ
zF|`_|q|%DFZ1f;~YHDiI%gf70H8eE1{C>X)3Xd1)+mM%+cPKM6lN1iMJK;KU>iqO&
zZ*LlK;P8(oZ&$a@q}Td0M-1`4^4wGPX+x4Xflou2{YQYFQ8{@%=si7jQxo#ZNbcIT
zTU`aD_}JEh#)9@EEF(n`^jFX;puT@tCjvABl+fGQ6EOK$sJWdW{!95&fB^vXVi?_!
SEg&=i0000<MNUMnLSTY6BhV-S

literal 0
HcmV?d00001

diff --git a/browser/themes/winstripe/browser/browser.css b/browser/themes/winstripe/browser/browser.css
index 4d73b61dd605..43576d1e49a1 100644
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@@ -1181,11 +1181,70 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
 
 #go-button {
   list-style-image: url("chrome://browser/skin/Go-arrow.png");
-  -moz-image-region: rect(0px 16px 16px 0px);
+  -moz-image-region: rect(0px, 16px, 16px, 0px);
 }
 
 #go-button:hover {
-  -moz-image-region: rect(16px 16px 32px 0px);
+  -moz-image-region: rect(16px, 16px, 32px, 0px);
+}
+
+/* combined go/reload/stop button in location bar */
+
+#urlbar > toolbarbutton {
+  -moz-appearance: none;
+  list-style-image: url("chrome://browser/skin/reload-stop-go.png");
+  margin: -2px;
+  -moz-margin-start: 0;
+  padding: 0 3px;
+  background-origin: border-box;
+  border: none;
+  border-left: 1px solid rgba(0,0,0,.25);
+  -moz-border-radius-topright: 2px;
+  -moz-border-radius-bottomright: 2px;
+}
+
+#urlbar > toolbarbutton:active:hover {
+  padding-left: 4px;
+  border-left: none;
+  -moz-box-shadow: 0 0 9px rgba(0,0,0,.4) inset,
+                   0 0 3px rgba(0,0,0,.4) inset;
+}
+
+#urlbar-go-button {
+  -moz-image-region: rect(0px, 56px, 14px, 42px);
+  background-image: -moz-linear-gradient(rgb(115,213,115), rgb(96,190,96) 49%, rgb(82,174,82) 51%, rgb(79,155,79));
+  -moz-box-shadow: 0 1px 0 rgba(0,0,0,.1) inset,
+                   -1px -1px 1px rgba(255,255,255,.25) inset;
+}
+
+#urlbar-go-button:hover {
+  background-image: -moz-linear-gradient(rgb(96,221,96), rgb(71,191,71) 49%, rgb(54,171,54) 51%, rgb(50,147,50));
+}
+
+#urlbar-reload-button {
+  -moz-image-region: rect(0px, 14px, 14px, 0px);
+}
+
+#urlbar-reload-button:hover {
+  -moz-image-region: rect(0px, 28px, 14px, 14px);
+  background-image: -moz-linear-gradient(rgb(162,207,241), rgb(111,178,225) 49%, rgb(91,159,217) 51%, rgb(62,138,200));
+  -moz-box-shadow: 0 1px 0 rgba(0,0,0,.1) inset,
+                   -1px -1px 1px rgba(255,255,255,.25) inset;
+}
+
+#urlbar-stop-button {
+  -moz-image-region: rect(0px, 42px, 14px, 28px);
+  background-image: -moz-linear-gradient(rgb(231,162,140), rgb(209,119,100) 49%, rgb(193,92,78) 51%, rgb(173,72,58));
+  -moz-box-shadow: 0 1px 0 rgba(0,0,0,.1) inset,
+                   -1px -1px 1px rgba(255,255,255,.25) inset;
+}
+
+#urlbar-stop-button:hover {
+  background-image: -moz-linear-gradient(rgb(244,156,128), rgb(215,101,77) 49%, rgb(194,66,48) 51%, rgb(170,41,23));
+}
+
+#urlbar-stop-button[disabled="true"] > .toolbarbutton-icon {
+  opacity: .5;
 }
 
 /* star button */
diff --git a/browser/themes/winstripe/browser/jar.mn b/browser/themes/winstripe/browser/jar.mn
index a6b030584d53..27978100b484 100644
--- a/browser/themes/winstripe/browser/jar.mn
+++ b/browser/themes/winstripe/browser/jar.mn
@@ -32,6 +32,7 @@ browser.jar:
         skin/classic/browser/livemark-folder.png                     (livemark-folder.png)
         skin/classic/browser/Privacy-16.png
         skin/classic/browser/Privacy-48.png
+        skin/classic/browser/reload-stop-go.png
         skin/classic/browser/Secure.png                              (Secure.png)
         skin/classic/browser/Secure24.png                            (Secure24.png)
         skin/classic/browser/Security-broken.png                     (Security-broken.png)
@@ -147,6 +148,7 @@ browser.jar:
         skin/classic/aero/browser/livemark-folder.png                (livemark-folder-aero.png)
         skin/classic/aero/browser/Privacy-16.png                     (Privacy-16-aero.png)
         skin/classic/aero/browser/Privacy-48.png                     (Privacy-48-aero.png)
+        skin/classic/aero/browser/reload-stop-go.png
         skin/classic/aero/browser/Secure.png                         (Secure-aero.png)
         skin/classic/aero/browser/Secure24.png                       (Secure24-aero.png)
         skin/classic/aero/browser/Security-broken.png                (Security-broken-aero.png)
diff --git a/browser/themes/winstripe/browser/reload-stop-go.png b/browser/themes/winstripe/browser/reload-stop-go.png
new file mode 100644
index 0000000000000000000000000000000000000000..e070eb424b03f8bedf69aaeab810f398cc3b28ec
GIT binary patch
literal 1590
zcmV-62Fdw}P)<h;3K|Lk000e1NJLTq001}u000gM1^@s6dZpj40000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU%*hxe|RCwCdmTOE@M-+f(?sMOuMdjr#
z1!arXSZf94DOijMVig)~MZs=WsI{>%Hl!*BEU^*ArivgKYOP641+1d7h+@EqRhw9w
z0P$57QH#|0U|G1!?wy`X7YfTRtxf#VxjC7cbLY;S@18Sf1`|Ti|Fz&iY8g~x$aOK#
z)fnnUCQMqqB<sHzLhHg;yac$VP)UHZp}pSKIA&mH-ohj;Mbnu)%f~~l1@E@>^jM7u
zkzAHx(>R{bhG98Q06Y=Kuow=3?r4Nj8zST~w7&(J3-3OFy2SCjH#qzbRCT{t$P)*>
z8&tDEU*XE|pn#w$&9|B@(3B(!AVu)x4wrxc7b}y=D|k*Omn-DW8nya(XIGb>V6hk&
zicVvBo)d)bq2BQe55YA31;Ekcbly+(0lItFZnbbXTOQ1W=nn%p8i_Wu6S!oI&<6OC
zH>PlS)fGD=wB2Z$-YeQ{dKkk4<oC`1o2nXX6Eo&}RGzI=KvzHnMF1oL$owII2@4i#
z6$)jULaFG8i;Z2s=-uQ?pf-W1KHr>^V-|#XmSK?1YITJ3q!}h>q??;inwQx;H)ci?
zs2@pQT(D|mSY_=+6@Wtk5bS7R(aBTo*((iC+gk691)zdAIlLOwHmMD8x=~(U&o&j7
zv=0-d$Bz{rMM-Ou6DrPB$N<oSY$zP-DMYUQ4cQCGF<d6c@v7*^$WH;T3{=l0{i2k#
ztWh2w@iL_f90A)E4^BvGrE<BcOP~vL*EIl~6oL<WC-skBf@xL_-*gj+5M!&Ob<^LD
zy<B9hIl4M-_T096Ej}zw?*z37aAU`Kd7BE1HAerS2|o?mcY3NGvW5xKs0UHR0@e%A
z??N)v4R92)Vi8$;Au&Mi=ua}dOtw(1R{flsvZNnw@zS&`2-a*uVPt{OG@DJx+&MVX
zL`1@-P7HjqU`}K|92+oeDW>QYfMSR!D!}ausCg$IFzW*K#f8<UPxxqc&ncVD6U5uo
z+oxmCUvPWvQ8X|mngPm$IMRXSV5b6gAZ0J0fOzmAN4f#N6Mkt7glk;C2Qf{JWN5ao
z4^AqFzT1BQs`}wFnIKqYN`?GxADmQrZk>_(4gWG3nh$Q@b_k3JXYC4(rn?Up>^k(>
z?n2Yh)CuNe!ayxTOA>-O@E!O7JSX;!uo4m*GW+q7T@?@e0eO~tX0=+p9HzTt7nen&
zR$5wrZ+G-g{XhMfz7on|4a3m6*k)6W_VqP0EK45Vxve^0TC(NG;-Ym84%wA7i9_Z!
z<Qv>dYfE9{!GjT#5Ro91=a*M;EO)g(L^T>sJ-iKDW>^{gB4<(X<e*2lTibkD|Cpc`
zJ;x+CmZ86fu+)wA_Oaww)tujcqWYYd&d&n6vC=yjGs5AsEdvG5#CJ>2mMVZk@~LcI
z=sW^&Cjjn<^gsFmBf>)qD2fu)YRwNHW_&yd((uum;M5iATi;7HjC3^eljTX(Jj)Q4
zV>iLx8w4r!S^wyC`qfB{GeEUQ6HjcmKo2i(>ki}TI<5Y-V&8G&OSYdpRXawj>w$Lx
z8h7_Zmj`_aHb96*1DFUYMn3<o`M7LrnGxWQ_QCazvtQL@-yArYaka52m!fD+B;<m0
z)Ij>1fH9fTY3dYgww~mDdv;ejtmA&5+_)iQ<IagaR#7?%u7R|`lsZ^r0&Ee=bCmn$
zI~U5&Ik9nSVdnbPajDB2{RSr#MeEHQD=PODPtN!<uL$~=oB_^RGbgM1O0^y~nI$ne
z(Q-KV@JWC>HV|$gpj1Yjzi=`3OkG_{SGOe;LiQDad#vF3hM1^`gJCnK*T9%3PS*0j
z(s&~^`>Xxq>o5MQ?l5=B)e4yqF>O*u*4nh|Qzz;7!<gS(IAR(|^N?%_kRY#vTplLM
zqtbKJ-@o5}pDE8PKjsY15wO>jAX*R)DWTb~L4QbI0qGuQF?WzKkU;5jU^n<W$a#>b
oFY&$|1tMMRDxJYe<xc?y00@FH8IbQNc>n+a07*qoM6N<$f*HQzl>h($

literal 0
HcmV?d00001

diff --git a/toolkit/content/widgets/autocomplete.xml b/toolkit/content/widgets/autocomplete.xml
index ce1bc8c6f563..46c626e8ce1a 100644
--- a/toolkit/content/widgets/autocomplete.xml
+++ b/toolkit/content/widgets/autocomplete.xml
@@ -79,6 +79,8 @@
                       xbl:inherits="open,enablehistory,parentfocused=focused"/>
 
       <xul:popupset anonid="popupset" class="autocomplete-result-popupset"/>
+
+      <children includes="toolbarbutton"/>
     </content>
 
     <implementation implements="nsIAccessibleProvider, nsIAutoCompleteInput, nsIDOMXULMenuListElement">

From 849e25849e01de54a532861e7057d31293322957 Mon Sep 17 00:00:00 2001
From: Justin Dolske <dolske@mozilla.com>
Date: Thu, 2 Sep 2010 19:20:14 -0700
Subject: [PATCH 076/222] Bug 544816 - Attach combined Stop/Go/Refresh button
 to the Location Bar.  Perffix patch #1. a=blocker

---
 browser/base/content/browser.xul | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index ecf93407570c..32b7fdddf6ad 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -836,7 +836,7 @@
                      ondragleave="homeButtonObserver.onDragLeave(event)"
                      onclick="BrowserGoHome(event);"/>
 
-      <toolbaritem id="urlbar-container" align="center" flex="400" persist="width"
+      <toolbaritem id="urlbar-container" align="center" flex="400" persist="width" combined="true"
                    title="&locationItem.title;" class="chromeclass-location" removable="true">
         <textbox id="urlbar" flex="1"
                  placeholder="&urlbar.placeholder;"

From b505f862318b8cd88c00c93a79e341a331538ad9 Mon Sep 17 00:00:00 2001
From: Robert Strong <robert.bugzilla@gmail.com>
Date: Fri, 3 Sep 2010 14:27:06 +1200
Subject: [PATCH 077/222] followup test only fix for SeaMonkey and Thunderbird
 for bug 583408. r=dtownsend, a=test bustage fix

---
 toolkit/mozapps/update/test/chrome/utils.js | 3 ---
 toolkit/mozapps/update/test/shared.js       | 3 +++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/toolkit/mozapps/update/test/chrome/utils.js b/toolkit/mozapps/update/test/chrome/utils.js
index e5121d086eac..69a3ed1b5f47 100644
--- a/toolkit/mozapps/update/test/chrome/utils.js
+++ b/toolkit/mozapps/update/test/chrome/utils.js
@@ -143,9 +143,6 @@ const URI_UPDATE_PROMPT_DIALOG  = "chrome://mozapps/content/update/updates.xul";
 
 const CRC_ERROR = 4;
 
-const PREF_APP_UPDATE_CERT_INVALID_ATTR_NAME = PREF_APP_UPDATE_CERTS_BRANCH +
-                                               "1.invalidName";
-
 const ADDON_ID_SUFFIX = "@appupdatetest.mozilla.org";
 const ADDON_PREP_DIR = "appupdateprep";
 // Preference for storing add-ons that are disabled by the tests to prevent them
diff --git a/toolkit/mozapps/update/test/shared.js b/toolkit/mozapps/update/test/shared.js
index d1b43d5bf8ad..5c82782c75f3 100644
--- a/toolkit/mozapps/update/test/shared.js
+++ b/toolkit/mozapps/update/test/shared.js
@@ -59,6 +59,9 @@ const PREF_APP_UPDATE_URL                 = "app.update.url";
 const PREF_APP_UPDATE_URL_DETAILS         = "app.update.url.details";
 const PREF_APP_UPDATE_URL_OVERRIDE        = "app.update.url.override";
 
+const PREF_APP_UPDATE_CERT_INVALID_ATTR_NAME = PREF_APP_UPDATE_CERTS_BRANCH +
+                                               "1.invalidName";
+
 const PREF_APP_PARTNER_BRANCH             = "app.partner.";
 const PREF_DISTRIBUTION_ID                = "distribution.id";
 const PREF_DISTRIBUTION_VERSION           = "distribution.version";

From c64900878901d5b66e6ea42870ea460495ddeb53 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:39 +1200
Subject: [PATCH 078/222] Bug 579276. Part 1: Change layer/layermanager user
 data API to use keys and values. r=cjones,sr=vlad

---
 content/canvas/src/WebGLContext.cpp           |   4 +-
 .../canvas/src/nsCanvasRenderingContext2D.cpp |   4 +-
 gfx/layers/Layers.h                           | 113 ++++++++++++++++--
 layout/base/FrameLayerBuilder.cpp             |  59 +++++----
 4 files changed, 140 insertions(+), 40 deletions(-)

diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index 5882206473e4..c35058635638 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -514,7 +514,7 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
                              LayerManager *aManager)
 {
     if (!mResetLayer && aOldLayer &&
-        aOldLayer->GetUserData() == &gWebGLLayerUserData) {
+        aOldLayer->HasUserData(&gWebGLLayerUserData)) {
         NS_ADDREF(aOldLayer);
         if (mInvalidated) {
             aOldLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
@@ -528,7 +528,7 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
         NS_WARNING("CreateCanvasLayer returned null!");
         return nsnull;
     }
-    canvasLayer->SetUserData(&gWebGLLayerUserData);
+    canvasLayer->SetUserData(&gWebGLLayerUserData, nsnull);
 
     CanvasLayer::Data data;
 
diff --git a/content/canvas/src/nsCanvasRenderingContext2D.cpp b/content/canvas/src/nsCanvasRenderingContext2D.cpp
index c0a9f753d196..d76eee6f82e8 100644
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@@ -4154,7 +4154,7 @@ nsCanvasRenderingContext2D::GetCanvasLayer(CanvasLayer *aOldLayer,
         return nsnull;
 
     if (!mResetLayer && aOldLayer &&
-        aOldLayer->GetUserData() == &g2DContextLayerUserData) {
+        aOldLayer->HasUserData(&g2DContextLayerUserData)) {
         NS_ADDREF(aOldLayer);
         // XXX Need to just update the changed area here
         aOldLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
@@ -4166,7 +4166,7 @@ nsCanvasRenderingContext2D::GetCanvasLayer(CanvasLayer *aOldLayer,
         NS_WARNING("CreateCanvasLayer returned null!");
         return nsnull;
     }
-    canvasLayer->SetUserData(&g2DContextLayerUserData);
+    canvasLayer->SetUserData(&g2DContextLayerUserData, nsnull);
 
     CanvasLayer::Data data;
 
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 47a9baab9b75..6643d60f0062 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -83,6 +83,14 @@ class SpecificLayerAttributes;
   virtual const char* Name() const { return n; }            \
   virtual LayerType GetType() const { return e; }
 
+/**
+ * Base class for userdata objects attached to layers and layer managers.
+ */
+class THEBES_API LayerUserData {
+public:
+  virtual ~LayerUserData() {}
+};
+
 /*
  * Motivation: For truly smooth animation and video playback, we need to
  * be able to compose frames and render them on a dedicated thread (i.e.
@@ -109,6 +117,52 @@ class SpecificLayerAttributes;
  * BasicLayerManager for such an implementation.
  */
 
+/**
+ * Helper class to manage user data for layers and LayerManagers.
+ */
+class THEBES_API LayerUserDataSet {
+public:
+  LayerUserDataSet() : mKey(nsnull) {}
+
+  void Set(void* aKey, LayerUserData* aValue)
+  {
+    NS_ASSERTION(!mKey || mKey == aKey,
+                 "Multiple LayerUserData objects not supported");
+    mKey = aKey;
+    mValue = aValue;
+  }
+  /**
+   * This can be used anytime. Ownership passes to the caller!
+   */
+  LayerUserData* Remove(void* aKey)
+  {
+    if (mKey == aKey) {
+      mKey = nsnull;
+      LayerUserData* d = mValue.forget();
+      return d;
+    }
+    return nsnull;
+  }
+  /**
+   * This getter can be used anytime.
+   */
+  PRBool Has(void* aKey)
+  {
+    return mKey == aKey;
+  }
+  /**
+   * This getter can be used anytime. Ownership is retained by this object.
+   */
+  LayerUserData* Get(void* aKey)
+  {
+    return mKey == aKey ? mValue.get() : nsnull;
+  }
+
+private:
+  void* mKey;
+  nsAutoPtr<LayerUserData> mValue;
+};
+
 /**
  * A LayerManager controls a tree of layers. All layers in the tree
  * must use the same LayerManager.
@@ -142,7 +196,7 @@ public:
     LAYERS_D3D9
   };
 
-  LayerManager() : mUserData(nsnull), mDestroyed(PR_FALSE)
+  LayerManager() : mDestroyed(PR_FALSE)
   {
     InitLog();
   }
@@ -267,10 +321,28 @@ public:
    */
   virtual LayersBackend GetBackendType() = 0;
 
-  // This setter and getter can be used anytime. The user data is initially
-  // null.
-  void SetUserData(void* aData) { mUserData = aData; }
-  void* GetUserData() { return mUserData; }
+  /**
+   * This setter can be used anytime. The user data for all keys is
+   * initially null. Ownership pases to the layer manager.
+   */
+  void SetUserData(void* aKey, LayerUserData* aData)
+  { mUserData.Set(aKey, aData); }
+  /**
+   * This can be used anytime. Ownership passes to the caller!
+   */
+  nsAutoPtr<LayerUserData> RemoveUserData(void* aKey)
+  { nsAutoPtr<LayerUserData> d(mUserData.Remove(aKey)); return d; }
+  /**
+   * This getter can be used anytime.
+   */
+  PRBool HasUserData(void* aKey)
+  { return mUserData.Has(aKey); }
+  /**
+   * This getter can be used anytime. Ownership is retained by the layer
+   * manager.
+   */
+  LayerUserData* GetUserData(void* aKey)
+  { return mUserData.Get(aKey); }
 
   // We always declare the following logging symbols, because it's
   // extremely tricky to conditionally declare them.  However, for
@@ -305,7 +377,7 @@ public:
 
 protected:
   nsRefPtr<Layer> mRoot;
-  void* mUserData;
+  LayerUserDataSet mUserData;
   PRPackedBool mDestroyed;
 
   // Print interesting information about this into aTo.  Internally
@@ -460,10 +532,28 @@ public:
   // quality.
   PRBool CanUseOpaqueSurface();
 
-  // This setter and getter can be used anytime. The user data is initially
-  // null.
-  void SetUserData(void* aData) { mUserData = aData; }
-  void* GetUserData() { return mUserData; }
+  /**
+   * This setter can be used anytime. The user data for all keys is
+   * initially null. Ownership pases to the layer manager.
+   */
+  void SetUserData(void* aKey, LayerUserData* aData)
+  { mUserData.Set(aKey, aData); }
+  /**
+   * This can be used anytime. Ownership passes to the caller!
+   */
+  nsAutoPtr<LayerUserData> RemoveUserData(void* aKey)
+  { nsAutoPtr<LayerUserData> d(mUserData.Remove(aKey)); return d; }
+  /**
+   * This getter can be used anytime.
+   */
+  PRBool HasUserData(void* aKey)
+  { return mUserData.Has(aKey); }
+  /**
+   * This getter can be used anytime. Ownership is retained by the layer
+   * manager.
+   */
+  LayerUserData* GetUserData(void* aKey)
+  { return mUserData.Get(aKey); }
 
   /**
    * Dynamic downcast to a Thebes layer. Returns null if this is not
@@ -519,7 +609,6 @@ protected:
     mNextSibling(nsnull),
     mPrevSibling(nsnull),
     mImplData(aImplData),
-    mUserData(nsnull),
     mOpacity(1.0),
     mUseClipRect(PR_FALSE),
     mIsOpaqueContent(PR_FALSE)
@@ -539,7 +628,7 @@ protected:
   Layer* mNextSibling;
   Layer* mPrevSibling;
   void* mImplData;
-  void* mUserData;
+  LayerUserDataSet mUserData;
   nsIntRegion mVisibleRegion;
   gfx3DMatrix mTransform;
   float mOpacity;
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 01c9797f776b..df505c492ba5 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -57,14 +57,19 @@ namespace {
 /**
  * This is the userdata we associate with a layer manager.
  */
-class LayerManagerData {
+class LayerManagerData : public LayerUserData {
 public:
   LayerManagerData() :
     mInvalidateAllThebesContent(PR_FALSE),
     mInvalidateAllLayers(PR_FALSE)
   {
+    MOZ_COUNT_CTOR(LayerManagerData);
+
     mFramesWithLayers.Init();
   }
+  ~LayerManagerData() {
+    MOZ_COUNT_DTOR(LayerManagerData);
+  }
 
   /**
    * Tracks which frames have layers associated with them.
@@ -304,18 +309,26 @@ protected:
 
 /**
  * The address of gThebesDisplayItemLayerUserData is used as the user
- * data pointer for ThebesLayers created by FrameLayerBuilder.
+ * data key for ThebesLayers created by FrameLayerBuilder.
  * It identifies ThebesLayers used to draw non-layer content, which are
  * therefore eligible for recycling. We want display items to be able to
  * create their own dedicated ThebesLayers in BuildLayer, if necessary,
  * and we wouldn't want to accidentally recycle those.
+ * The user data is null.
  */
-static PRUint8 gThebesDisplayItemLayerUserData;
+PRUint8 gThebesDisplayItemLayerUserData;
 /**
  * The address of gColorLayerUserData is used as the user
- * data pointer for ColorLayers
+ * data key for ColorLayers created by FrameLayerBuilder.
+ * The user data is null.
  */
-static PRUint8 gColorLayerUserData;
+PRUint8 gColorLayerUserData;
+/**
+ * The address of gLayerManagerUserData is used as the user
+ * data key for retained LayerManagers managed by FrameLayerBuilder.
+ * The user data is a LayerManagerData.
+ */
+PRUint8 gLayerManagerUserData;
 
 } // anonymous namespace
 
@@ -342,12 +355,11 @@ FrameLayerBuilder::InternalDestroyDisplayItemData(nsIFrame* aFrame,
   if (aRemoveFromFramesWithLayers) {
     LayerManager* manager = array->ElementAt(0).mLayer->Manager();
     LayerManagerData* data = static_cast<LayerManagerData*>
-      (manager->GetUserData());
+      (manager->GetUserData(&gLayerManagerUserData));
     NS_ASSERTION(data, "Frame with layer should have been recorded");
     data->mFramesWithLayers.RemoveEntry(aFrame);
     if (data->mFramesWithLayers.Count() == 0) {
-      delete data;
-      manager->SetUserData(nsnull);
+      manager->RemoveUserData(&gLayerManagerUserData);
       // Consume the reference we added when we set the user data
       // in DidEndTransaction. But don't actually release until we've
       // released all the layers in the DisplayItemData array below!
@@ -371,7 +383,7 @@ FrameLayerBuilder::WillBeginRetainedLayerTransaction(LayerManager* aManager)
 {
   mRetainingManager = aManager;
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (aManager->GetUserData());
+    (aManager->GetUserData(&gLayerManagerUserData));
   if (data) {
     mInvalidateAllThebesContent = data->mInvalidateAllThebesContent;
     mInvalidateAllLayers = data->mInvalidateAllLayers;
@@ -420,13 +432,13 @@ FrameLayerBuilder::WillEndTransaction(LayerManager* aManager)
   // correctly and the NS_FRAME_HAS_CONTAINER_LAYER bits will be set
   // correctly.
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (mRetainingManager->GetUserData());
+    (mRetainingManager->GetUserData(&gLayerManagerUserData));
   if (data) {
     // Update all the frames that used to have layers.
     data->mFramesWithLayers.EnumerateEntries(UpdateDisplayItemDataForFrame, this);
   } else {
     data = new LayerManagerData();
-    mRetainingManager->SetUserData(data);
+    mRetainingManager->SetUserData(&gLayerManagerUserData, data);
     // Addref mRetainingManager. We'll release it when 'data' is
     // removed.
     NS_ADDREF(mRetainingManager);
@@ -595,7 +607,7 @@ ContainerState::CreateOrRecycleColorLayer()
     if (!layer)
       return nsnull;
     // Mark this layer as being used for Thebes-painting display items
-    layer->SetUserData(&gColorLayerUserData);
+    layer->SetUserData(&gColorLayerUserData, nsnull);
   }
   return layer.forget();
 }
@@ -637,7 +649,7 @@ ContainerState::CreateOrRecycleThebesLayer(nsIFrame* aActiveScrolledRoot)
     if (!layer)
       return nsnull;
     // Mark this layer as being used for Thebes-painting display items
-    layer->SetUserData(&gThebesDisplayItemLayerUserData);
+    layer->SetUserData(&gThebesDisplayItemLayerUserData, nsnull);
   }
 
   // Set up transform so that 0,0 in the Thebes layer corresponds to the
@@ -965,7 +977,7 @@ ContainerState::ProcessDisplayItems(const nsDisplayList& aList,
 
       // Update that layer's clip and visible rects.
       NS_ASSERTION(ownLayer->Manager() == mManager, "Wrong manager");
-      NS_ASSERTION(ownLayer->GetUserData() != &gThebesDisplayItemLayerUserData,
+      NS_ASSERTION(!ownLayer->HasUserData(&gLayerManagerUserData),
                    "We shouldn't have a FrameLayerBuilder-managed layer here!");
       // It has its own layer. Update that layer's clip and visible rects.
       if (aClipRect) {
@@ -1119,10 +1131,9 @@ ContainerState::CollectOldLayers()
 {
   for (Layer* layer = mContainerLayer->GetFirstChild(); layer;
        layer = layer->GetNextSibling()) {
-    void* data = layer->GetUserData();
-    if (data == &gColorLayerUserData) {
+    if (layer->HasUserData(&gColorLayerUserData)) {
       mRecycledColorLayers.AppendElement(static_cast<ColorLayer*>(layer));
-    } else if (data == &gThebesDisplayItemLayerUserData) {
+    } else if (layer->HasUserData(&gThebesDisplayItemLayerUserData)) {
       NS_ASSERTION(layer->AsThebesLayer(), "Wrong layer type");
       mRecycledThebesLayers.AppendElement(static_cast<ThebesLayer*>(layer));
     }
@@ -1203,7 +1214,7 @@ FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder* aBuilder,
     Layer* oldLayer = GetOldLayerFor(aContainerFrame, containerDisplayItemKey);
     if (oldLayer) {
       NS_ASSERTION(oldLayer->Manager() == aManager, "Wrong manager");
-      if (oldLayer->GetUserData() == &gThebesDisplayItemLayerUserData) {
+      if (oldLayer->HasUserData(&gThebesDisplayItemLayerUserData)) {
         // The old layer for this item is actually our ThebesLayer
         // because we rendered its layer into that ThebesLayer. So we
         // don't actually have a retained container layer.
@@ -1276,7 +1287,7 @@ FrameLayerBuilder::GetLeafLayerFor(nsDisplayListBuilder* aBuilder,
   Layer* layer = GetOldLayerFor(f, aItem->GetPerFrameKey());
   if (!layer)
     return nsnull;
-  if (layer->GetUserData() == &gThebesDisplayItemLayerUserData) {
+  if (layer->HasUserData(&gThebesDisplayItemLayerUserData)) {
     // This layer was created to render Thebes-rendered content for this
     // display item. The display item should not use it for its own
     // layer rendering.
@@ -1352,7 +1363,7 @@ FrameLayerBuilder::InvalidateThebesLayersInSubtree(nsIFrame* aFrame)
 FrameLayerBuilder::InvalidateAllThebesLayerContents(LayerManager* aManager)
 {
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (aManager->GetUserData());
+    (aManager->GetUserData(&gLayerManagerUserData));
   if (data) {
     data->mInvalidateAllThebesContent = PR_TRUE;
   }
@@ -1362,7 +1373,7 @@ FrameLayerBuilder::InvalidateAllThebesLayerContents(LayerManager* aManager)
 FrameLayerBuilder::InvalidateAllLayers(LayerManager* aManager)
 {
   LayerManagerData* data = static_cast<LayerManagerData*>
-    (aManager->GetUserData());
+    (aManager->GetUserData(&gLayerManagerUserData));
   if (data) {
     data->mInvalidateAllLayers = PR_TRUE;
   }
@@ -1380,9 +1391,9 @@ FrameLayerBuilder::HasDedicatedLayer(nsIFrame* aFrame, PRUint32 aDisplayItemKey)
     (reinterpret_cast<nsTArray<DisplayItemData>*>(&propValue));
   for (PRUint32 i = 0; i < array->Length(); ++i) {
     if (array->ElementAt(i).mDisplayItemKey == aDisplayItemKey) {
-      void* layerUserData = array->ElementAt(i).mLayer->GetUserData();
-      if (layerUserData != &gColorLayerUserData &&
-          layerUserData != &gThebesDisplayItemLayerUserData)
+      Layer* layer = array->ElementAt(i).mLayer;
+      if (!layer->HasUserData(&gColorLayerUserData) &&
+          !layer->HasUserData(&gThebesDisplayItemLayerUserData))
         return PR_TRUE;
     }
   }

From add75cf1da0244be69b76b21b92f5192976d30a1 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:39 +1200
Subject: [PATCH 079/222] Bug 579276. Part 2: If a transparent layer is over a
 solid background color, hoist that color into the layer to make it opaque.
 r=tnikkel

---
 layout/base/FrameLayerBuilder.cpp | 148 ++++++++++++++++++++++++++----
 layout/base/FrameLayerBuilder.h   |  20 ++++
 2 files changed, 148 insertions(+), 20 deletions(-)

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index df505c492ba5..3949bef8d325 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -64,10 +64,13 @@ public:
     mInvalidateAllLayers(PR_FALSE)
   {
     MOZ_COUNT_CTOR(LayerManagerData);
-
     mFramesWithLayers.Init();
   }
   ~LayerManagerData() {
+    // Remove display item data properties now, since we won't be able
+    // to find these frames again without mFramesWithLayers.
+    mFramesWithLayers.EnumerateEntries(
+        FrameLayerBuilder::RemoveDisplayItemDataForFrame, nsnull);
     MOZ_COUNT_DTOR(LayerManagerData);
   }
 
@@ -250,6 +253,12 @@ protected:
    * aItem in that layer.
    */
   void InvalidateForLayerChange(nsDisplayItem* aItem, Layer* aNewLayer);
+  /**
+   * Try to determine whether the ThebesLayer at aThebesLayerIndex
+   * has an opaque single color covering the visible area behind it.
+   * If successful, return that color, otherwise return NS_RGBA(0,0,0,0).
+   */
+  nscolor FindOpaqueBackgroundColorFor(PRInt32 aThebesLayerIndex);
   /**
    * Indicate that we are done adding items to the ThebesLayer at the top of
    * mThebesLayerDataStack. Set the final visible region and opaque-content
@@ -307,6 +316,15 @@ protected:
   PRPackedBool                     mInvalidateAllThebesContent;
 };
 
+class ThebesDisplayItemLayerUserData : public LayerUserData
+{
+public:
+  ThebesDisplayItemLayerUserData() :
+    mForcedBackgroundColor(NS_RGBA(0,0,0,0)) {}
+
+  nscolor mForcedBackgroundColor;
+};
+
 /**
  * The address of gThebesDisplayItemLayerUserData is used as the user
  * data key for ThebesLayers created by FrameLayerBuilder.
@@ -314,7 +332,7 @@ protected:
  * therefore eligible for recycling. We want display items to be able to
  * create their own dedicated ThebesLayers in BuildLayer, if necessary,
  * and we wouldn't want to accidentally recycle those.
- * The user data is null.
+ * The user data is a ThebesDisplayItemLayerUserData.
  */
 PRUint8 gThebesDisplayItemLayerUserData;
 /**
@@ -462,7 +480,7 @@ FrameLayerBuilder::UpdateDisplayItemDataForFrame(nsPtrHashKey<nsIFrame>* aEntry,
   nsIFrame* f = aEntry->GetKey();
   FrameProperties props = f->Properties();
   DisplayItemDataEntry* newDisplayItems =
-    builder->mNewDisplayItemData.GetEntry(f);
+    builder ? builder->mNewDisplayItemData.GetEntry(f) : nsnull;
   if (!newDisplayItems) {
     // This frame was visible, but isn't anymore.
     PRBool found;
@@ -649,7 +667,8 @@ ContainerState::CreateOrRecycleThebesLayer(nsIFrame* aActiveScrolledRoot)
     if (!layer)
       return nsnull;
     // Mark this layer as being used for Thebes-painting display items
-    layer->SetUserData(&gThebesDisplayItemLayerUserData, nsnull);
+    layer->SetUserData(&gThebesDisplayItemLayerUserData,
+        new ThebesDisplayItemLayerUserData());
   }
 
   // Set up transform so that 0,0 in the Thebes layer corresponds to the
@@ -709,6 +728,39 @@ SetVisibleRectForLayer(Layer* aLayer, const nsIntRect& aRect)
   }
 }
 
+nscolor
+ContainerState::FindOpaqueBackgroundColorFor(PRInt32 aThebesLayerIndex)
+{
+  ThebesLayerData* target = mThebesLayerDataStack[aThebesLayerIndex];
+  for (PRInt32 i = aThebesLayerIndex - 1; i >= 0; --i) {
+    ThebesLayerData* candidate = mThebesLayerDataStack[i];
+    nsIntRegion visibleAboveIntersection;
+    visibleAboveIntersection.And(candidate->mVisibleAboveRegion, target->mVisibleRegion);
+    if (!visibleAboveIntersection.IsEmpty()) {
+      // Some non-Thebes content between target and candidate; this is
+      // hopeless
+      break;
+    }
+
+    nsIntRegion intersection;
+    intersection.And(candidate->mVisibleRegion, target->mVisibleRegion);
+    if (intersection.IsEmpty()) {
+      // The layer doesn't intersect our target, ignore it and move on
+      continue;
+    }
+ 
+    // The candidate intersects our target. If any layer has a solid-color
+    // area behind our target, this must be it. Scan its display items.
+    nsPresContext* presContext = mContainerFrame->PresContext();
+    nscoord appUnitsPerDevPixel = presContext->AppUnitsPerDevPixel();
+    nsRect rect =
+      target->mVisibleRegion.GetBounds().ToAppUnits(appUnitsPerDevPixel);
+    return mBuilder->LayerBuilder()->
+      FindOpaqueColorCovering(mBuilder, candidate->mLayer, rect);
+  }
+  return NS_RGBA(0,0,0,0);
+}
+
 void
 ContainerState::PopThebesLayerData()
 {
@@ -717,21 +769,6 @@ ContainerState::PopThebesLayerData()
   PRInt32 lastIndex = mThebesLayerDataStack.Length() - 1;
   ThebesLayerData* data = mThebesLayerDataStack[lastIndex];
 
-  if (lastIndex > 0) {
-    // Since we're going to pop off the last ThebesLayerData, the
-    // mVisibleAboveRegion of the second-to-last item will need to include
-    // the regions of the last item.
-    ThebesLayerData* nextData = mThebesLayerDataStack[lastIndex - 1];
-    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
-                                     data->mVisibleAboveRegion);
-    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
-                                     data->mVisibleRegion);
-    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
-                                     data->mDrawAboveRegion);
-    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
-                                     data->mDrawRegion);
-  }
-
   Layer* layer;
   if (data->mIsSolidColorInVisibleRegion) {
     nsRefPtr<ColorLayer> colorLayer = CreateOrRecycleColorLayer();
@@ -778,7 +815,47 @@ ContainerState::PopThebesLayerData()
 
   nsIntRegion transparentRegion;
   transparentRegion.Sub(data->mVisibleRegion, data->mOpaqueRegion);
-  layer->SetIsOpaqueContent(transparentRegion.IsEmpty());
+  PRBool isOpaque = transparentRegion.IsEmpty();
+  // For translucent ThebesLayers, try to find an opaque background
+  // color that covers the entire area beneath it so we can pull that
+  // color into this layer to make it opaque.
+  if (layer == data->mLayer) {
+    nscolor backgroundColor = NS_RGBA(0,0,0,0);
+    if (!isOpaque) {
+      backgroundColor = FindOpaqueBackgroundColorFor(lastIndex);
+      if (NS_GET_A(backgroundColor) == 255) {
+        isOpaque = PR_TRUE;
+      }
+    }
+
+    // Store the background color
+    ThebesDisplayItemLayerUserData* userData =
+      static_cast<ThebesDisplayItemLayerUserData*>
+        (data->mLayer->GetUserData(&gThebesDisplayItemLayerUserData));
+    NS_ASSERTION(userData, "where did our user data go?");
+    if (userData->mForcedBackgroundColor != backgroundColor) {
+      // Invalidate the entire target ThebesLayer since we're changing
+      // the background color
+      data->mLayer->InvalidateRegion(data->mLayer->GetValidRegion());
+    }
+    userData->mForcedBackgroundColor = backgroundColor;
+  }
+  layer->SetIsOpaqueContent(isOpaque);
+
+  if (lastIndex > 0) {
+    // Since we're going to pop off the last ThebesLayerData, the
+    // mVisibleAboveRegion of the second-to-last item will need to include
+    // the regions of the last item.
+    ThebesLayerData* nextData = mThebesLayerDataStack[lastIndex - 1];
+    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
+                                     data->mVisibleAboveRegion);
+    nextData->mVisibleAboveRegion.Or(nextData->mVisibleAboveRegion,
+                                     data->mVisibleRegion);
+    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
+                                     data->mDrawAboveRegion);
+    nextData->mDrawAboveRegion.Or(nextData->mDrawAboveRegion,
+                                     data->mDrawRegion);
+  }
 
   mThebesLayerDataStack.RemoveElementAt(lastIndex);
 }
@@ -1126,6 +1203,28 @@ FrameLayerBuilder::AddLayerDisplayItem(Layer* aLayer,
   }
 }
 
+nscolor
+FrameLayerBuilder::FindOpaqueColorCovering(nsDisplayListBuilder* aBuilder,
+                                           ThebesLayer* aLayer,
+                                           const nsRect& aRect)
+{
+  ThebesLayerItemsEntry* entry = mThebesLayerItems.GetEntry(aLayer);
+  NS_ASSERTION(entry, "Must know about this layer!");
+  for (PRInt32 i = entry->mItems.Length() - 1; i >= 0; --i) {
+    nsDisplayItem* item = entry->mItems[i].mItem;
+    const nsRect& visible = item->GetVisibleRect();
+    if (!visible.Intersects(aRect))
+      continue;
+
+    nscolor color;
+    if (visible.Contains(aRect) && item->IsUniform(aBuilder, &color) &&
+        NS_GET_A(color) == 255)
+      return color;
+    break;
+  }
+  return NS_RGBA(0,0,0,0);
+}
+
 void
 ContainerState::CollectOldLayers()
 {
@@ -1422,6 +1521,15 @@ FrameLayerBuilder::DrawThebesLayer(ThebesLayer* aLayer,
     // so 'entry' could become invalid.
   }
 
+  ThebesDisplayItemLayerUserData* userData =
+    static_cast<ThebesDisplayItemLayerUserData*>
+      (aLayer->GetUserData(&gThebesDisplayItemLayerUserData));
+  NS_ASSERTION(userData, "where did our user data go?");
+  if (NS_GET_A(userData->mForcedBackgroundColor) > 0) {
+    aContext->SetColor(gfxRGBA(userData->mForcedBackgroundColor));
+    aContext->Paint();
+  }
+
   gfxMatrix transform;
   if (!aLayer->GetTransform().Is2D(&transform)) {
     NS_ERROR("non-2D transform in our Thebes layer!");
diff --git a/layout/base/FrameLayerBuilder.h b/layout/base/FrameLayerBuilder.h
index e3e082068994..4cce9ebbcb70 100644
--- a/layout/base/FrameLayerBuilder.h
+++ b/layout/base/FrameLayerBuilder.h
@@ -243,6 +243,26 @@ public:
    */
   Layer* GetOldLayerFor(nsIFrame* aFrame, PRUint32 aDisplayItemKey);
 
+  /**
+   * A useful hashtable iteration function that removes the
+   * DisplayItemData property for the frame, clears its
+   * NS_FRAME_HAS_CONTAINER_LAYER bit and returns PL_DHASH_REMOVE.
+   * aClosure is ignored.
+   */
+  static PLDHashOperator RemoveDisplayItemDataForFrame(nsPtrHashKey<nsIFrame>* aEntry,
+                                                       void* aClosure)
+  {
+    return UpdateDisplayItemDataForFrame(aEntry, nsnull);
+  }
+
+  /**
+   * Try to determine whether the ThebesLayer aLayer paints an opaque
+   * single color everywhere it's visible in aRect.
+   * If successful, return that color, otherwise return NS_RGBA(0,0,0,0).
+   */
+  nscolor FindOpaqueColorCovering(nsDisplayListBuilder* aBuilder,
+                                  ThebesLayer* aLayer, const nsRect& aRect);
+
 protected:
   /**
    * We store an array of these for each frame that is associated with

From 8f85c65afc57393eaf712a71c92806f900e4da53 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:39 +1200
Subject: [PATCH 080/222] Bug 579276. Part 8: Bump scroll timeout up a lot.
 r=tnikkel

---
 layout/generic/nsGfxScrollFrame.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index df8ff01b4f95..364bf10385b5 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -1251,9 +1251,9 @@ IsSmoothScrollingEnabled()
 
 class ScrollFrameActivityTracker : public nsExpirationTracker<nsGfxScrollFrameInner,4> {
 public:
-  // Wait for 75-100ms between scrolls before we switch the appearance back to
-  // subpixel AA. That's 4 generations of 25ms each.
-  enum { TIMEOUT_MS = 25 };
+  // Wait for 3-4s between scrolls before we remove our layers.
+  // That's 4 generations of 1s each.
+  enum { TIMEOUT_MS = 1000 };
   ScrollFrameActivityTracker()
     : nsExpirationTracker<nsGfxScrollFrameInner,4>(TIMEOUT_MS) {}
   ~ScrollFrameActivityTracker() {

From 61c4b7a2c44d5102ac3618fad98298ee0f38d625 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:39 +1200
Subject: [PATCH 081/222] Bug 579276. Part 4: Move nsDisplayItem parameter down
 to ThebesLayerData::Accumulate. r=tnikkel

---
 layout/base/FrameLayerBuilder.cpp | 56 +++++++++++++------------------
 1 file changed, 24 insertions(+), 32 deletions(-)

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 3949bef8d325..1932ea1a5127 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -173,10 +173,10 @@ protected:
      * @param aSolidColor if non-null, the visible area of the item is
      * a constant color given by *aSolidColor
      */
-    void Accumulate(const nsIntRect& aVisibleRect,
-                    const nsIntRect& aDrawRect,
-                    const nsIntRect* aOpaqueRect,
-                    nscolor* aSolidColor);
+    void Accumulate(nsDisplayListBuilder* aBuilder,
+                    nsDisplayItem* aItem,
+                    const nsIntRect& aVisibleRect,
+                    const nsIntRect& aDrawRect);
     nsIFrame* GetActiveScrolledRoot() { return mActiveScrolledRoot; }
 
     /**
@@ -282,11 +282,10 @@ protected:
    * @param aSolidColor if non-null, indicates that every pixel in aVisibleRect
    * will be painted with aSolidColor by the item
    */
-  already_AddRefed<ThebesLayer> FindThebesLayerFor(const nsIntRect& aVisibleRect,
+  already_AddRefed<ThebesLayer> FindThebesLayerFor(nsDisplayItem* aItem,
+                                                   const nsIntRect& aVisibleRect,
                                                    const nsIntRect& aDrawRect,
-                                                   nsIFrame* aActiveScrolledRoot,
-                                                   const nsIntRect* aOpaqueRect,
-                                                   nscolor* aSolidColor);
+                                                   nsIFrame* aActiveScrolledRoot);
   ThebesLayerData* GetTopThebesLayerData()
   {
     return mThebesLayerDataStack.IsEmpty() ? nsnull
@@ -861,20 +860,21 @@ ContainerState::PopThebesLayerData()
 }
 
 void
-ContainerState::ThebesLayerData::Accumulate(const nsIntRect& aVisibleRect,
-                                            const nsIntRect& aDrawRect,
-                                            const nsIntRect* aOpaqueRect,
-                                            nscolor* aSolidColor)
+ContainerState::ThebesLayerData::Accumulate(nsDisplayListBuilder* aBuilder,
+                                            nsDisplayItem* aItem,
+                                            const nsIntRect& aVisibleRect,
+                                            const nsIntRect& aDrawRect)
 {
-  if (aSolidColor) {
+  nscolor uniformColor;
+  if (aItem->IsUniform(aBuilder, &uniformColor)) {
     if (mVisibleRegion.IsEmpty()) {
       // This color is all we have
-      mSolidColor = *aSolidColor;
+      mSolidColor = uniformColor;
       mIsSolidColorInVisibleRegion = PR_TRUE;
     } else if (mIsSolidColorInVisibleRegion &&
                mVisibleRegion.IsEqual(nsIntRegion(aVisibleRect))) {
       // we can just blend the colors together
-      mSolidColor = NS_ComposeColors(mSolidColor, *aSolidColor);
+      mSolidColor = NS_ComposeColors(mSolidColor, uniformColor);
     } else {
       mIsSolidColorInVisibleRegion = PR_FALSE;
     }
@@ -886,14 +886,15 @@ ContainerState::ThebesLayerData::Accumulate(const nsIntRect& aVisibleRect,
   mVisibleRegion.SimplifyOutward(4);
   mDrawRegion.Or(mDrawRegion, aDrawRect);
   mDrawRegion.SimplifyOutward(4);
-  if (aOpaqueRect) {
+
+  if (aItem->IsOpaque(aBuilder)) {
     // We don't use SimplifyInward here since it's not defined exactly
     // what it will discard. For our purposes the most important case
     // is a large opaque background at the bottom of z-order (e.g.,
     // a canvas background), so we need to make sure that the first rect
     // we see doesn't get discarded.
     nsIntRegion tmp;
-    tmp.Or(mOpaqueRegion, *aOpaqueRect);
+    tmp.Or(mOpaqueRegion, aDrawRect);
     if (tmp.GetNumRects() <= 4) {
       mOpaqueRegion = tmp;
     }
@@ -901,11 +902,10 @@ ContainerState::ThebesLayerData::Accumulate(const nsIntRect& aVisibleRect,
 }
 
 already_AddRefed<ThebesLayer>
-ContainerState::FindThebesLayerFor(const nsIntRect& aVisibleRect,
+ContainerState::FindThebesLayerFor(nsDisplayItem* aItem,
+                                   const nsIntRect& aVisibleRect,
                                    const nsIntRect& aDrawRect,
-                                   nsIFrame* aActiveScrolledRoot,
-                                   const nsIntRect* aOpaqueRect,
-                                   nscolor* aSolidColor)
+                                   nsIFrame* aActiveScrolledRoot)
 {
   PRInt32 i;
   PRInt32 lowestUsableLayerWithScrolledRoot = -1;
@@ -959,7 +959,7 @@ ContainerState::FindThebesLayerFor(const nsIntRect& aVisibleRect,
     layer = thebesLayerData->mLayer;
   }
 
-  thebesLayerData->Accumulate(aVisibleRect, aDrawRect, aOpaqueRect, aSolidColor);
+  thebesLayerData->Accumulate(mBuilder, aItem, aVisibleRect, aDrawRect);
   return layer.forget();
 }
 
@@ -1105,17 +1105,9 @@ ContainerState::ProcessDisplayItems(const nsDisplayList& aList,
           nsLayoutUtils::GetActiveScrolledRootFor(viewportFrame, mBuilder->ReferenceFrame());
       }
 
-      nscolor uniformColor;
-      PRBool isUniform = item->IsUniform(mBuilder, &uniformColor);
-      PRBool isOpaque = item->IsOpaque(mBuilder);
-      nsIntRect opaqueRect;
-      if (isOpaque) {
-        opaqueRect = item->GetBounds(mBuilder).ToNearestPixels(appUnitsPerDevPixel);
-      }
       nsRefPtr<ThebesLayer> thebesLayer =
-        FindThebesLayerFor(itemVisibleRect, itemDrawRect, activeScrolledRoot,
-                           isOpaque ? &opaqueRect : nsnull,
-                           isUniform ? &uniformColor : nsnull);
+        FindThebesLayerFor(item, itemVisibleRect, itemDrawRect,
+                           activeScrolledRoot);
 
       InvalidateForLayerChange(item, thebesLayer);
 

From be2d05f9a8a96a08be8e3159b4a744d7a6fc3305 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:40 +1200
Subject: [PATCH 082/222] Bug 579276. Part 3: Change Set/IsOpaqueContent API to
 a more generic Get/SetContentFlags API. r=cjones,sr=vlad

---
 content/canvas/src/WebGLContext.cpp           |  4 +-
 .../canvas/src/nsCanvasRenderingContext2D.cpp |  3 +-
 gfx/layers/Layers.cpp                         | 20 ++++++---
 gfx/layers/Layers.h                           | 42 ++++++++++++++-----
 gfx/layers/basic/BasicLayers.cpp              |  4 +-
 gfx/layers/d3d9/ThebesLayerD3D9.cpp           | 36 ++++------------
 gfx/layers/ipc/PLayers.ipdl                   |  2 +-
 gfx/layers/ipc/ShadowLayers.cpp               |  2 +-
 gfx/layers/ipc/ShadowLayersParent.cpp         |  2 +-
 layout/base/FrameLayerBuilder.cpp             |  6 ++-
 10 files changed, 68 insertions(+), 53 deletions(-)

diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index c35058635638..89bb9d15f40e 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -63,6 +63,7 @@
 
 using namespace mozilla;
 using namespace mozilla::gl;
+using namespace mozilla::layers;
 
 nsresult NS_NewCanvasRenderingContextWebGL(nsICanvasRenderingContextWebGL** aResult);
 
@@ -548,7 +549,8 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
     data.mGLBufferIsPremultiplied = PR_FALSE;
 
     canvasLayer->Initialize(data);
-    canvasLayer->SetIsOpaqueContent(gl->CreationFormat().alpha == 0 ? PR_TRUE : PR_FALSE);
+    PRUint32 flags = gl->CreationFormat().alpha == 0 ? Layer::CONTENT_OPAQUE : 0;
+    canvasLayer->SetContentFlags(flags);
     canvasLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
 
     mInvalidated = PR_FALSE;
diff --git a/content/canvas/src/nsCanvasRenderingContext2D.cpp b/content/canvas/src/nsCanvasRenderingContext2D.cpp
index d76eee6f82e8..49a9e52f909a 100644
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@@ -4174,7 +4174,8 @@ nsCanvasRenderingContext2D::GetCanvasLayer(CanvasLayer *aOldLayer,
     data.mSize = nsIntSize(mWidth, mHeight);
 
     canvasLayer->Initialize(data);
-    canvasLayer->SetIsOpaqueContent(mOpaque);
+    PRUint32 flags = mOpaque ? Layer::CONTENT_OPAQUE : 0;
+    canvasLayer->SetContentFlags(flags);
     canvasLayer->Updated(nsIntRect(0, 0, mWidth, mHeight));
 
     mResetLayer = PR_FALSE;
diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index cccbd3d76a4d..d622b01a5e9e 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -147,7 +147,7 @@ Layer::CanUseOpaqueSurface()
 {
   // If the visible content in the layer is opaque, there is no need
   // for an alpha channel.
-  if (IsOpaqueContent())
+  if (GetContentFlags() & CONTENT_OPAQUE)
     return PR_TRUE;
   // Also, if this layer is the bottommost layer in a container which
   // doesn't need an alpha channel, we can use an opaque surface for this
@@ -221,14 +221,24 @@ Layer::PrintInfo(nsACString& aTo, const char* aPrefix)
   if (mUseClipRect) {
     AppendToString(aTo, mClipRect, " [clip=", "]");
   }
-  if (!mTransform.IsIdentity())
+  if (!mTransform.IsIdentity()) {
     AppendToString(aTo, mTransform, " [transform=", "]");
-  if (!mVisibleRegion.IsEmpty())
+  }
+  if (!mVisibleRegion.IsEmpty()) {
     AppendToString(aTo, mVisibleRegion, " [visible=", "]");
-  if (1.0 != mOpacity)
+  }
+  if (1.0 != mOpacity) {
     aTo.AppendPrintf(" [opacity=%g]", mOpacity);
-  if (IsOpaqueContent())
+  }
+  if (GetContentFlags() & CONTENT_OPAQUE) {
     aTo += " [opaqueContent]";
+  }
+  if (GetContentFlags() & CONTENT_NO_TEXT) {
+    aTo += " [noText]";
+  }
+  if (GetContentFlags() & CONTENT_NO_TEXT_OVER_TRANSPARENT) {
+    aTo += " [noTextOverTransparent]";
+  }
 
   return aTo;
 }
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 6643d60f0062..fe1e996f2979 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -416,17 +416,37 @@ public:
    */
   LayerManager* Manager() { return mManager; }
 
+  enum {
+    /**
+     * If this is set, the caller is promising that by the end of this
+     * transaction the entire visible region (as specified by
+     * SetVisibleRegion) will be filled with opaque content.
+     */
+    CONTENT_OPAQUE = 0x01,
+    /**
+     * ThebesLayers only!
+     * If this is set, the caller is promising that the visible region
+     * contains no text at all. If this is set,
+     * CONTENT_NO_TEXT_OVER_TRANSPARENT will also be set.
+     */
+    CONTENT_NO_TEXT = 0x02,
+    /**
+     * ThebesLayers only!
+     * If this is set, the caller is promising that the visible region
+     * contains no text over transparent pixels (any text, if present,
+     * is over fully opaque pixels).
+     */
+    CONTENT_NO_TEXT_OVER_TRANSPARENT = 0x04
+  };
   /**
    * CONSTRUCTION PHASE ONLY
-   * If this is called with aOpaque set to true, the caller is promising
-   * that by the end of this transaction the entire visible region
-   * (as specified by SetVisibleRegion) will be filled with opaque
-   * content. This enables some internal quality and performance
-   * optimizations.
+   * This lets layout make some promises about what will be drawn into the
+   * visible region of the ThebesLayer. This enables internal quality
+   * and performance optimizations.
    */
-  void SetIsOpaqueContent(PRBool aOpaque)
+  void SetContentFlags(PRUint32 aFlags)
   {
-    mIsOpaqueContent = aOpaque;
+    mContentFlags = aFlags;
     Mutated();
   }
   /**
@@ -509,7 +529,7 @@ public:
   // These getters can be used anytime.
   float GetOpacity() { return mOpacity; }
   const nsIntRect* GetClipRect() { return mUseClipRect ? &mClipRect : nsnull; }
-  PRBool IsOpaqueContent() { return mIsOpaqueContent; }
+  PRUint32 GetContentFlags() { return mContentFlags; }
   const nsIntRegion& GetVisibleRegion() { return mVisibleRegion; }
   ContainerLayer* GetParent() { return mParent; }
   Layer* GetNextSibling() { return mNextSibling; }
@@ -610,8 +630,8 @@ protected:
     mPrevSibling(nsnull),
     mImplData(aImplData),
     mOpacity(1.0),
-    mUseClipRect(PR_FALSE),
-    mIsOpaqueContent(PR_FALSE)
+    mContentFlags(0),
+    mUseClipRect(PR_FALSE)
     {}
 
   void Mutated() { mManager->Mutated(this); }
@@ -633,8 +653,8 @@ protected:
   gfx3DMatrix mTransform;
   float mOpacity;
   nsIntRect mClipRect;
+  PRUint32 mContentFlags;
   PRPackedBool mUseClipRect;
-  PRPackedBool mIsOpaqueContent;
 };
 
 /**
diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 217ad5926375..1cbac945e8a8 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -682,7 +682,7 @@ BasicCanvasLayer::Updated(const nsIntRect& aRect)
   if (mGLContext) {
     nsRefPtr<gfxImageSurface> isurf =
       new gfxImageSurface(gfxIntSize(mBounds.width, mBounds.height),
-                          IsOpaqueContent()
+                          (GetContentFlags() & CONTENT_OPAQUE)
                             ? gfxASurface::ImageFormatRGB24
                             : gfxASurface::ImageFormatARGB32);
     if (!isurf || isurf->CairoStatus() != 0) {
@@ -793,7 +793,7 @@ MayHaveOverlappingOrTransparentLayers(Layer* aLayer,
                                       const nsIntRect& aBounds,
                                       nsIntRegion* aDirtyVisibleRegionInContainer)
 {
-  if (!aLayer->IsOpaqueContent()) {
+  if (!(aLayer->GetContentFlags() & Layer::CONTENT_OPAQUE)) {
     return PR_TRUE;
   }
 
diff --git a/gfx/layers/d3d9/ThebesLayerD3D9.cpp b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
index 438e73f0eea3..8e7092a4f08d 100644
--- a/gfx/layers/d3d9/ThebesLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
@@ -46,27 +46,6 @@
 namespace mozilla {
 namespace layers {
 
-// Returns true if it's OK to save the contents of aLayer in an
-// opaque surface (a surface without an alpha channel).
-// If we can use a surface without an alpha channel, we should, because
-// it will often make painting of antialiased text faster and higher
-// quality.
-static PRBool
-UseOpaqueSurface(Layer* aLayer)
-{
-  // If the visible content in the layer is opaque, there is no need
-  // for an alpha channel.
-  if (aLayer->IsOpaqueContent())
-    return PR_TRUE;
-  // Also, if this layer is the bottommost layer in a container which
-  // doesn't need an alpha channel, we can use an opaque surface for this
-  // layer too. Any transparent areas must be covered by something else
-  // in the container.
-  ContainerLayer* parent = aLayer->GetParent();
-  return parent && parent->GetFirstChild() == aLayer &&
-         UseOpaqueSurface(parent);
-}
-
 ThebesLayerD3D9::ThebesLayerD3D9(LayerManagerD3D9 *aManager)
   : ThebesLayer(aManager, NULL)
   , LayerD3D9(aManager)
@@ -105,7 +84,7 @@ ThebesLayerD3D9::SetVisibleRegion(const nsIntRegion &aRegion)
     return;
   }
 
-  D3DFORMAT fmt = (UseOpaqueSurface(this) && !mD2DSurface) ?
+  D3DFORMAT fmt = (CanUseOpaqueSurface() && !mD2DSurface) ?
                     D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
 
   D3DSURFACE_DESC desc;
@@ -199,7 +178,7 @@ ThebesLayerD3D9::RenderLayer()
 
   // We differentiate between these formats since D3D9 will only allow us to
   // call GetDC on an opaque surface.
-  D3DFORMAT fmt = (UseOpaqueSurface(this) && !mD2DSurface) ?
+  D3DFORMAT fmt = (CanUseOpaqueSurface() && !mD2DSurface) ?
                     D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
 
   if (mTexture) {
@@ -319,7 +298,7 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
   }
 #endif
 
-  D3DFORMAT fmt = UseOpaqueSurface(this) ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
+  D3DFORMAT fmt = CanUseOpaqueSurface() ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8;
   nsIntRect bounds = aRegion.GetBounds();
 
   gfxASurface::gfxImageFormat imageFormat = gfxASurface::ImageFormatARGB32;
@@ -332,7 +311,7 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
 
   nsRefPtr<IDirect3DSurface9> surf;
   HDC dc;
-  if (UseOpaqueSurface(this)) {
+  if (CanUseOpaqueSurface()) {
     hr = tmpTexture->GetSurfaceLevel(0, getter_AddRefs(surf));
 
     if (FAILED(hr)) {
@@ -365,7 +344,7 @@ ThebesLayerD3D9::DrawRegion(const nsIntRegion &aRegion)
   LayerManagerD3D9::CallbackInfo cbInfo = mD3DManager->GetCallbackInfo();
   cbInfo.Callback(this, context, aRegion, nsIntRegion(), cbInfo.CallbackData);
 
-  if (UseOpaqueSurface(this)) {
+  if (CanUseOpaqueSurface()) {
     surf->ReleaseDC(dc);
   } else {
     D3DLOCKED_RECT r;
@@ -418,6 +397,7 @@ ThebesLayerD3D9::CreateNewTexture(const gfxIntSize &aSize)
   }
 
   mTexture = nsnull;
+  PRBool canUseOpaqueSurface = CanUseOpaqueSurface();
 #ifdef CAIRO_HAS_D2D_SURFACE
   if (gfxWindowsPlatform::GetPlatform()->GetRenderMode() ==
       gfxWindowsPlatform::RENDER_DIRECT2D) {
@@ -429,7 +409,7 @@ ThebesLayerD3D9::CreateNewTexture(const gfxIntSize &aSize)
                                   D3DPOOL_DEFAULT, getter_AddRefs(mTexture), &sharedHandle);
 
           mD2DSurfaceInitialized = false;
-          mD2DSurface = new gfxD2DSurface(sharedHandle, UseOpaqueSurface(this) ?
+          mD2DSurface = new gfxD2DSurface(sharedHandle, canUseOpaqueSurface ?
             gfxASurface::CONTENT_COLOR : gfxASurface::CONTENT_COLOR_ALPHA);
 
           // If there's an error, go on and do what we always do.
@@ -442,7 +422,7 @@ ThebesLayerD3D9::CreateNewTexture(const gfxIntSize &aSize)
 #endif
   if (!mTexture) {
     device()->CreateTexture(aSize.width, aSize.height, 1,
-                            D3DUSAGE_RENDERTARGET, UseOpaqueSurface(this) ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8,
+                            D3DUSAGE_RENDERTARGET, canUseOpaqueSurface ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8,
                             D3DPOOL_DEFAULT, getter_AddRefs(mTexture), NULL);
   }
 }
diff --git a/gfx/layers/ipc/PLayers.ipdl b/gfx/layers/ipc/PLayers.ipdl
index 7f90abff46c9..fdde16ca6893 100644
--- a/gfx/layers/ipc/PLayers.ipdl
+++ b/gfx/layers/ipc/PLayers.ipdl
@@ -93,7 +93,7 @@ struct OpCreateImageBuffer {
 struct CommonLayerAttributes {
   nsIntRegion visibleRegion;
   gfx3DMatrix transform;
-  bool isOpaqueContent;
+  PRUint32 contentFlags;
   float opacity;
   bool useClipRect;
   nsIntRect clipRect;
diff --git a/gfx/layers/ipc/ShadowLayers.cpp b/gfx/layers/ipc/ShadowLayers.cpp
index f0222eb63c08..dc6b1ea6de32 100644
--- a/gfx/layers/ipc/ShadowLayers.cpp
+++ b/gfx/layers/ipc/ShadowLayers.cpp
@@ -271,7 +271,7 @@ ShadowLayerForwarder::EndTransaction(nsTArray<EditReply>* aReplies)
     CommonLayerAttributes& common = attrs.common();
     common.visibleRegion() = mutant->GetVisibleRegion();
     common.transform() = mutant->GetTransform();
-    common.isOpaqueContent() = mutant->IsOpaqueContent();
+    common.contentFlags() = mutant->GetContentFlags();
     common.opacity() = mutant->GetOpacity();
     common.useClipRect() = !!mutant->GetClipRect();
     common.clipRect() = (common.useClipRect() ?
diff --git a/gfx/layers/ipc/ShadowLayersParent.cpp b/gfx/layers/ipc/ShadowLayersParent.cpp
index 9b4b71428132..e61d886bce39 100644
--- a/gfx/layers/ipc/ShadowLayersParent.cpp
+++ b/gfx/layers/ipc/ShadowLayersParent.cpp
@@ -229,7 +229,7 @@ ShadowLayersParent::RecvUpdate(const nsTArray<Edit>& cset,
 
       const CommonLayerAttributes& common = attrs.common();
       layer->SetVisibleRegion(common.visibleRegion());
-      layer->SetIsOpaqueContent(common.isOpaqueContent());
+      layer->SetContentFlags(common.contentFlags());
       layer->SetOpacity(common.opacity());
       layer->SetClipRect(common.useClipRect() ? &common.clipRect() : NULL);
       layer->SetTransform(common.transform());
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 1932ea1a5127..d35fa352770d 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -839,7 +839,8 @@ ContainerState::PopThebesLayerData()
     }
     userData->mForcedBackgroundColor = backgroundColor;
   }
-  layer->SetIsOpaqueContent(isOpaque);
+  PRUint32 flags = isOpaque ? Layer::CONTENT_OPAQUE : 0;
+  layer->SetContentFlags(flags);
 
   if (lastIndex > 0) {
     // Since we're going to pop off the last ThebesLayerData, the
@@ -1361,7 +1362,8 @@ FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder* aBuilder,
   state.ProcessDisplayItems(aChildren, nsnull);
   state.Finish();
 
-  containerLayer->SetIsOpaqueContent(aChildren.IsOpaque());
+  PRUint32 flags = aChildren.IsOpaque() ? Layer::CONTENT_OPAQUE : 0;
+  containerLayer->SetContentFlags(flags);
   return containerLayer.forget();
 }
 

From b9aeeda471579934431940a72db2fdfb17ebd31d Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:40 +1200
Subject: [PATCH 083/222] Bug 579276. Part 5: Set CONTENT_NO_TEXT and
 CONTENT_NO_TEXT_OVER_TRANSPARENT flags. r=tnikkel

---
 layout/base/FrameLayerBuilder.cpp | 38 +++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index d35fa352770d..b0dcb3c1bcec 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -159,7 +159,8 @@ protected:
   public:
     ThebesLayerData() :
       mActiveScrolledRoot(nsnull), mLayer(nsnull),
-      mIsSolidColorInVisibleRegion(PR_FALSE) {}
+      mIsSolidColorInVisibleRegion(PR_FALSE),
+      mHasText(PR_FALSE), mHasTextOverTransparent(PR_FALSE) {}
     /**
      * Record that an item has been added to the ThebesLayer, so we
      * need to update our regions.
@@ -228,6 +229,15 @@ protected:
      * True if every pixel in mVisibleRegion will have color mSolidColor.
      */
     PRPackedBool mIsSolidColorInVisibleRegion;
+    /**
+     * True if there is any text visible in the layer.
+     */
+    PRPackedBool mHasText;
+    /**
+     * True if there is any text visible in the layer that's over
+     * transparent pixels in the layer.
+     */
+    PRPackedBool mHasTextOverTransparent;
   };
 
   /**
@@ -839,7 +849,10 @@ ContainerState::PopThebesLayerData()
     }
     userData->mForcedBackgroundColor = backgroundColor;
   }
-  PRUint32 flags = isOpaque ? Layer::CONTENT_OPAQUE : 0;
+  PRUint32 flags =
+    (isOpaque ? Layer::CONTENT_OPAQUE : 0) |
+    (data->mHasText ? 0 : Layer::CONTENT_NO_TEXT) |
+    (data->mHasTextOverTransparent ? 0 : Layer::CONTENT_NO_TEXT_OVER_TRANSPARENT);
   layer->SetContentFlags(flags);
 
   if (lastIndex > 0) {
@@ -860,6 +873,22 @@ ContainerState::PopThebesLayerData()
   mThebesLayerDataStack.RemoveElementAt(lastIndex);
 }
 
+static PRBool
+IsText(nsDisplayItem* aItem) {
+  switch (aItem->GetType()) {
+  case nsDisplayItem::TYPE_TEXT:
+  case nsDisplayItem::TYPE_BULLET:
+  case nsDisplayItem::TYPE_HEADER_FOOTER:
+  case nsDisplayItem::TYPE_MATHML_CHAR_FOREGROUND:
+#ifdef MOZ_XUL
+  case nsDisplayItem::TYPE_XUL_TEXT_BOX:
+#endif
+    return PR_TRUE;
+  default:
+    return PR_FALSE;
+  }
+}
+
 void
 ContainerState::ThebesLayerData::Accumulate(nsDisplayListBuilder* aBuilder,
                                             nsDisplayItem* aItem,
@@ -899,6 +928,11 @@ ContainerState::ThebesLayerData::Accumulate(nsDisplayListBuilder* aBuilder,
     if (tmp.GetNumRects() <= 4) {
       mOpaqueRegion = tmp;
     }
+  } else if (IsText(aItem)) {
+    mHasText = PR_TRUE;
+    if (!mOpaqueRegion.Contains(aVisibleRect)) {
+      mHasTextOverTransparent = PR_TRUE;
+    }
   }
 }
 

From 4251c4b8a97d323f3b03b846aefa469aeb083945 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:41 +1200
Subject: [PATCH 084/222] Bug 579276. Part 6: Add
 gfxASurface::GetTextQualityInTransparentSurfaces API. r=jrmuizel,sr=vlad

---
 gfx/thebes/gfxASurface.h       | 35 +++++++++++++++++++++++++++++++++-
 gfx/thebes/gfxD2DSurface.h     |  6 ++++++
 gfx/thebes/gfxQuartzSurface.h  |  4 ++++
 gfx/thebes/gfxWindowsSurface.h |  5 +++++
 gfx/thebes/gfxXlibSurface.h    |  5 +++++
 5 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/gfx/thebes/gfxASurface.h b/gfx/thebes/gfxASurface.h
index 9ee195608ad0..4a746f717d2b 100644
--- a/gfx/thebes/gfxASurface.h
+++ b/gfx/thebes/gfxASurface.h
@@ -153,7 +153,40 @@ public:
      */
     virtual PRBool AreSimilarSurfacesSensitiveToContentType()
     {
-      return PR_TRUE;
+        return PR_TRUE;
+    }
+
+    enum TextQuality {
+        /**
+         * TEXT_QUALITY_OK means that text is always rendered to a
+         * transparent surface just as well as it would be rendered to an
+         * opaque surface. This would normally only be true if
+         * subpixel antialiasing is disabled or if the platform's
+         * transparent surfaces support component alpha.
+         */
+        TEXT_QUALITY_OK,
+        /**
+         * TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS means that text is rendered
+         * to a transparent surface just as well as it would be rendered to an
+         * opaque surface, but only if all the pixels the text is drawn
+         * over already have opaque alpha values.
+         */
+        TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS,
+        /**
+         * TEXT_QUALITY_BAD means that text is rendered
+         * to a transparent surface worse than it would be rendered to an
+         * opaque surface, even if all the pixels the text is drawn
+         * over already have opaque alpha values.
+         */
+        TEXT_QUALITY_BAD
+    };
+    /**
+     * Determine how well text would be rendered in transparent surfaces that
+     * are similar to this surface.
+     */
+    virtual TextQuality GetTextQualityInTransparentSurfaces()
+    {
+        return TEXT_QUALITY_BAD;
     }
 
     int CairoStatus();
diff --git a/gfx/thebes/gfxD2DSurface.h b/gfx/thebes/gfxD2DSurface.h
index 1a3d641fdc57..3a08ffc5e103 100644
--- a/gfx/thebes/gfxD2DSurface.h
+++ b/gfx/thebes/gfxD2DSurface.h
@@ -57,6 +57,12 @@ public:
 
     virtual ~gfxD2DSurface();
 
+    virtual TextQuality GetTextQualityInTransparentSurfaces()
+    {
+      // D2D always draws text in transparent surfaces with grayscale-AA,
+      // even if the text is over opaque pixels.
+      return TEXT_QUALITY_BAD;
+    }
 
     void Present();
     void Scroll(const nsIntPoint &aDelta, const nsIntRect &aClip);
diff --git a/gfx/thebes/gfxQuartzSurface.h b/gfx/thebes/gfxQuartzSurface.h
index 5fbbe4040865..1fd5fd773175 100644
--- a/gfx/thebes/gfxQuartzSurface.h
+++ b/gfx/thebes/gfxQuartzSurface.h
@@ -60,6 +60,10 @@ public:
     {
       return PR_FALSE;
     }
+    virtual TextQuality GetTextQualityInTransparentSurfaces()
+    {
+      return TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS;
+    }
 
     const gfxSize& GetSize() const { return mSize; }
 
diff --git a/gfx/thebes/gfxWindowsSurface.h b/gfx/thebes/gfxWindowsSurface.h
index 20230ec799b6..0da4fe3d1f77 100644
--- a/gfx/thebes/gfxWindowsSurface.h
+++ b/gfx/thebes/gfxWindowsSurface.h
@@ -81,6 +81,11 @@ public:
                                                       const gfxIntSize& size,
                                                       gfxImageFormat format);
 
+    virtual TextQuality GetTextQualityInTransparentSurfaces()
+    {
+      return TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS;
+    }
+
     nsresult BeginPrinting(const nsAString& aTitle, const nsAString& aPrintToFileName);
     nsresult EndPrinting();
     nsresult AbortPrinting();
diff --git a/gfx/thebes/gfxXlibSurface.h b/gfx/thebes/gfxXlibSurface.h
index ad07f74d1efe..e3b1d1f0b613 100644
--- a/gfx/thebes/gfxXlibSurface.h
+++ b/gfx/thebes/gfxXlibSurface.h
@@ -77,6 +77,11 @@ public:
     virtual already_AddRefed<gfxASurface>
     CreateSimilarSurface(gfxContentType aType, const gfxIntSize& aSize);
 
+    virtual TextQuality GetTextQualityInTransparentSurfaces()
+    {
+      return TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS;
+    }
+
     const gfxIntSize& GetSize() { return mSize; }
 
     Display* XDisplay() { return mDisplay; }

From c4801219d756eccfa1592d852d32ea30e5dba290 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:41 +1200
Subject: [PATCH 085/222] Bug 579276. Part 7: Don't retain transparent layers
 that would hurt text rendering. r=cjones

---
 gfx/layers/basic/BasicLayers.cpp | 41 +++++++++++++++++++++++---------
 1 file changed, 30 insertions(+), 11 deletions(-)

diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 1cbac945e8a8..1bb1a8e539a9 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -367,6 +367,23 @@ InheritContextFlags(gfxContext* aSource, gfxContext* aDest)
   }
 }
 
+static PRBool
+ShouldRetainTransparentSurface(PRUint32 aContentFlags,
+                               gfxASurface* aTargetSurface)
+{
+  if (aContentFlags & Layer::CONTENT_NO_TEXT)
+    return PR_TRUE;
+
+  switch (aTargetSurface->GetTextQualityInTransparentSurfaces()) {
+  case gfxASurface::TEXT_QUALITY_OK:
+    return PR_TRUE;
+  case gfxASurface::TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS:
+    return (aContentFlags & Layer::CONTENT_NO_TEXT_OVER_TRANSPARENT) != 0;
+  default:
+    return PR_FALSE;
+  }
+}
+
 void
 BasicThebesLayer::Paint(gfxContext* aContext,
                         LayerManager::DrawThebesLayerCallback aCallback,
@@ -377,15 +394,20 @@ BasicThebesLayer::Paint(gfxContext* aContext,
                "Can only draw in drawing phase");
   gfxContext* target = BasicManager()->GetTarget();
   NS_ASSERTION(target, "We shouldn't be called if there's no target");
+  nsRefPtr<gfxASurface> targetSurface = aContext->CurrentSurface();
+
+  PRBool canUseOpaqueSurface = CanUseOpaqueSurface();
+  if (!BasicManager()->IsRetained() ||
+      (aOpacity == 1.0 && !canUseOpaqueSurface &&
+       !ShouldRetainTransparentSurface(mContentFlags, targetSurface))) {
+    mValidRegion.SetEmpty();
+    mBuffer.Clear();
 
-  if (!BasicManager()->IsRetained()) {
     if (aOpacity != 1.0) {
       target->Save();
       ClipToContain(target, mVisibleRegion.GetBounds());
       target->PushGroup(gfxASurface::CONTENT_COLOR_ALPHA);
     }
-    mValidRegion.SetEmpty();
-    mBuffer.Clear();
     aCallback(this, target, mVisibleRegion, nsIntRegion(), aCallbackData);
     if (aOpacity != 1.0) {
       target->PopGroupToSource();
@@ -395,15 +417,12 @@ BasicThebesLayer::Paint(gfxContext* aContext,
     return;
   }
 
-  nsRefPtr<gfxASurface> targetSurface = aContext->CurrentSurface();
-  PRBool isOpaqueContent =
-    (targetSurface->AreSimilarSurfacesSensitiveToContentType() &&
-     aOpacity == 1.0 &&
-     CanUseOpaqueSurface());
   {
+    PRBool opaqueBuffer = canUseOpaqueSurface &&
+      targetSurface->AreSimilarSurfacesSensitiveToContentType();
     Buffer::ContentType contentType =
-      isOpaqueContent ? gfxASurface::CONTENT_COLOR :
-                        gfxASurface::CONTENT_COLOR_ALPHA;
+      opaqueBuffer ? gfxASurface::CONTENT_COLOR :
+                     gfxASurface::CONTENT_COLOR_ALPHA;
     Buffer::PaintState state = mBuffer.BeginPaint(this, contentType);
     mValidRegion.Sub(mValidRegion, state.mRegionToInvalidate);
 
@@ -425,7 +444,7 @@ BasicThebesLayer::Paint(gfxContext* aContext,
     }
   }
 
-  mBuffer.DrawTo(this, isOpaqueContent, target, aOpacity);
+  mBuffer.DrawTo(this, canUseOpaqueSurface, target, aOpacity);
 }
 
 void

From c46464ab7b27562600b5a67c3b4253b4ccd3fabf Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:18:41 +1200
Subject: [PATCH 086/222] Bug 579276. Part 9: Backout 4d1dc2ea47fd since we no
 longer need those test changes

---
 layout/reftests/bidi/logicalmarquee.html  | 2 +-
 layout/reftests/bidi/marquee-ref.html     | 2 +-
 layout/reftests/bidi/visualmarquee.html   | 2 +-
 layout/reftests/marquee/413027-4-ref.html | 2 +-
 layout/reftests/marquee/413027-4.html     | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/layout/reftests/bidi/logicalmarquee.html b/layout/reftests/bidi/logicalmarquee.html
index 9ba9d6306cf4..cb13827dec7b 100644
--- a/layout/reftests/bidi/logicalmarquee.html
+++ b/layout/reftests/bidi/logicalmarquee.html
@@ -6,6 +6,6 @@
   </head>
 
   <body>
-    <marquee scrollamount="0" behavior="alternate" direction="right" style="opacity:0.9">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</marquee>
+    <marquee scrollamount="0" behavior="alternate" direction="right">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</marquee>
  </body>
 </html>
diff --git a/layout/reftests/bidi/marquee-ref.html b/layout/reftests/bidi/marquee-ref.html
index 724e4f8559d2..d8778dc88063 100644
--- a/layout/reftests/bidi/marquee-ref.html
+++ b/layout/reftests/bidi/marquee-ref.html
@@ -6,6 +6,6 @@
   </head>
 
   <body>
-    <div dir="rtl" align="left" style="opacity:0.9">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</div>
+    <div dir="rtl" align="left">&#x05E2;&#x05D3; &#x05E9;&#x05D9;&#x05E4;&#x05D5;&#x05D7; &#x05D4;&#x05D9;&#x05D5;&#x05DD; &#x05D5;&#x05E0;&#x05E1;&#x05D5; &#x05D4;&#x05E6;&#x05DC;&#x05D9;&#x05DC;&#x05D9;&#x05DD;</div>
  </body>
 </html>
diff --git a/layout/reftests/bidi/visualmarquee.html b/layout/reftests/bidi/visualmarquee.html
index 51a559469124..932fd775a191 100644
--- a/layout/reftests/bidi/visualmarquee.html
+++ b/layout/reftests/bidi/visualmarquee.html
@@ -6,6 +6,6 @@
   </head>
 
   <body>
-    <marquee scrollamount="0" behavior="alternate" direction="right" style="opacity:0.9">&#x05DD;&#x05D9;&#x05DC;&#x05D9;&#x05DC;&#x05E6;&#x05D4; &#x05D5;&#x05E1;&#x05E0;&#x05D5; &#x05DD;&#x05D5;&#x05D9;&#x05D4; &#x05D7;&#x05D5;&#x05E4;&#x05D9;&#x05E9; &#x05D3;&#x05E2;</marquee>
+    <marquee scrollamount="0" behavior="alternate" direction="right">&#x05DD;&#x05D9;&#x05DC;&#x05D9;&#x05DC;&#x05E6;&#x05D4; &#x05D5;&#x05E1;&#x05E0;&#x05D5; &#x05DD;&#x05D5;&#x05D9;&#x05D4; &#x05D7;&#x05D5;&#x05E4;&#x05D9;&#x05E9; &#x05D3;&#x05E2;</marquee>
  </body>
 </html>
diff --git a/layout/reftests/marquee/413027-4-ref.html b/layout/reftests/marquee/413027-4-ref.html
index fbe705e414da..22fdd42e6016 100644
--- a/layout/reftests/marquee/413027-4-ref.html
+++ b/layout/reftests/marquee/413027-4-ref.html
@@ -4,7 +4,7 @@
 <body>
 
 <div style="background-color: lime; width: 600px; float:left;">
-  <div style="margin: 100px 0px; padding-left: 2px; opacity:0.9;">text</div>
+  <div style="margin: 100px 0px; padding-left: 2px;">text</div>
 </div>
       
 </body></html>
diff --git a/layout/reftests/marquee/413027-4.html b/layout/reftests/marquee/413027-4.html
index beb15e6f752a..d57f2f121517 100644
--- a/layout/reftests/marquee/413027-4.html
+++ b/layout/reftests/marquee/413027-4.html
@@ -8,7 +8,7 @@
 <!-- padding-left used to avoid risk of an antialiasing pixel that may
      project to the left of the origin, causing a spurious test failure
      (see bugs 476927, 475968) -->
-  <div style="margin: 100px 0px; padding-left: 2px; opacity:0.9;">text</div>
+  <div style="margin: 100px 0px; padding-left: 2px;">text</div>
 </div>
 </marquee>
       

From 0a8fad86d1503859eb431da48a90e4a36c83ad59 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 2 Sep 2010 21:19:24 +1200
Subject: [PATCH 087/222] Bug 579276. Part 10: add a couple of scrolling tests
 to ensure that text looks good when scrolled in an overflow:auto div.
 a=blocking

---
 layout/reftests/scrolling/fixed-text-1.html |  7 +++++++
 layout/reftests/scrolling/reftest.list      |  2 ++
 layout/reftests/scrolling/text-1.html       | 10 ++++++++++
 3 files changed, 19 insertions(+)
 create mode 100644 layout/reftests/scrolling/fixed-text-1.html
 create mode 100644 layout/reftests/scrolling/text-1.html

diff --git a/layout/reftests/scrolling/fixed-text-1.html b/layout/reftests/scrolling/fixed-text-1.html
new file mode 100644
index 000000000000..d470a7c6415d
--- /dev/null
+++ b/layout/reftests/scrolling/fixed-text-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE HTML>
+<html>
+<body style="height:2000px; overflow:hidden; background:url(repeatable-diagonal-gradient.png) fixed;">
+<script src="scrolling.js"></script>
+<p>Hello Kitty
+</body>
+</html>
diff --git a/layout/reftests/scrolling/reftest.list b/layout/reftests/scrolling/reftest.list
index bfdc32a7ad77..e227cefd356b 100644
--- a/layout/reftests/scrolling/reftest.list
+++ b/layout/reftests/scrolling/reftest.list
@@ -1,5 +1,7 @@
 HTTP == fixed-1.html fixed-1.html?ref
+HTTP == fixed-text-1.html fixed-text-1.html?ref
 HTTP == opacity-mixed-scrolling-1.html opacity-mixed-scrolling-1.html?ref
 HTTP == simple-1.html simple-1.html?ref
+HTTP == text-1.html text-1.html?ref
 == uncovering-1.html uncovering-1-ref.html
 == uncovering-2.html uncovering-2-ref.html
diff --git a/layout/reftests/scrolling/text-1.html b/layout/reftests/scrolling/text-1.html
new file mode 100644
index 000000000000..0ede92a6fa28
--- /dev/null
+++ b/layout/reftests/scrolling/text-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<script src="scrolling.js"></script>
+<div class="scrollTop" style="height:100px; overflow:auto;">
+  <div style="margin-top:30px;">Hello Kitty</div>
+  <div style="height:400px;"></div>
+</div>
+</body>
+</html>

From dc9e28789b4d3e46726fb22f9f67131165e24a23 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Fri, 3 Sep 2010 14:31:42 +1200
Subject: [PATCH 088/222] Bug 579276. Part 11: Move ClipToRegion to gfxUtils.
 r=vlad

---
 gfx/layers/ThebesLayerBuffer.cpp | 16 ++--------------
 gfx/layers/ThebesLayerBuffer.h   |  3 ---
 gfx/layers/basic/BasicLayers.cpp |  2 +-
 gfx/thebes/gfxUtils.cpp          | 25 +++++++++++++++++++++++++
 gfx/thebes/gfxUtils.h            | 11 +++++++++++
 5 files changed, 39 insertions(+), 18 deletions(-)

diff --git a/gfx/layers/ThebesLayerBuffer.cpp b/gfx/layers/ThebesLayerBuffer.cpp
index 49da164e96c8..4e1949e8c0c0 100644
--- a/gfx/layers/ThebesLayerBuffer.cpp
+++ b/gfx/layers/ThebesLayerBuffer.cpp
@@ -39,23 +39,11 @@
 #include "Layers.h"
 #include "gfxContext.h"
 #include "gfxPlatform.h"
+#include "gfxUtils.h"
 
 namespace mozilla {
 namespace layers {
 
-/*static*/ void
-ThebesLayerBuffer::ClipToRegion(gfxContext* aContext,
-                                const nsIntRegion& aRegion)
-{
-  aContext->NewPath();
-  nsIntRegionRectIterator iter(aRegion);
-  const nsIntRect* r;
-  while ((r = iter.Next()) != nsnull) {
-    aContext->Rectangle(gfxRect(r->x, r->y, r->width, r->height));
-  }
-  aContext->Clip();
-}
-
 nsIntRect
 ThebesLayerBuffer::GetQuadrantRectangle(XSide aXSide, YSide aYSide)
 {
@@ -238,7 +226,7 @@ ThebesLayerBuffer::BeginPaint(ThebesLayer* aLayer, ContentType aContentType)
   NS_ASSERTION(quadrantRect.Contains(drawBounds), "Messed up quadrants");
   result.mContext->Translate(-gfxPoint(quadrantRect.x, quadrantRect.y));
 
-  ClipToRegion(result.mContext, result.mRegionToDraw);
+  gfxUtils::ClipToRegion(result.mContext, result.mRegionToDraw);
   if (aContentType == gfxASurface::CONTENT_COLOR_ALPHA && !isClear) {
     result.mContext->SetOperator(gfxContext::OPERATOR_CLEAR);
     result.mContext->Paint();
diff --git a/gfx/layers/ThebesLayerBuffer.h b/gfx/layers/ThebesLayerBuffer.h
index 936e1c3c2067..b1353b71e4a8 100644
--- a/gfx/layers/ThebesLayerBuffer.h
+++ b/gfx/layers/ThebesLayerBuffer.h
@@ -140,9 +140,6 @@ public:
   gfxASurface* GetBuffer() { return mBuffer; }
 
 protected:
-  // XXX make me a general utility
-  static void ClipToRegion(gfxContext* aContext, const nsIntRegion& aRegion);
-
   enum XSide {
     LEFT, RIGHT
   };
diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 1bb1a8e539a9..480de49e58af 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -454,7 +454,7 @@ BasicThebesLayerBuffer::DrawTo(ThebesLayer* aLayer,
                                float aOpacity)
 {
   aTarget->Save();
-  ClipToRegion(aTarget, aLayer->GetVisibleRegion());
+  gfxUtils::ClipToRegion(aTarget, aLayer->GetVisibleRegion());
   if (aIsOpaqueContent) {
     aTarget->SetOperator(gfxContext::OPERATOR_SOURCE);
   }
diff --git a/gfx/thebes/gfxUtils.cpp b/gfx/thebes/gfxUtils.cpp
index 01f9d83ccaca..bbe7a43e7866 100644
--- a/gfx/thebes/gfxUtils.cpp
+++ b/gfx/thebes/gfxUtils.cpp
@@ -39,6 +39,7 @@
 #include "gfxContext.h"
 #include "gfxPlatform.h"
 #include "gfxDrawable.h"
+#include "nsRegion.h"
 
 #if defined(XP_WIN) || defined(WINCE)
 #include "gfxWindowsPlatform.h"
@@ -418,3 +419,27 @@ gfxUtils::DrawPixelSnapped(gfxContext*      aContext,
     aContext->SetOperator(op);
 }
 
+static void
+ClipToRegionInternal(gfxContext* aContext, const nsIntRegion& aRegion,
+                     PRBool aSnap)
+{
+  aContext->NewPath();
+  nsIntRegionRectIterator iter(aRegion);
+  const nsIntRect* r;
+  while ((r = iter.Next()) != nsnull) {
+    aContext->Rectangle(gfxRect(r->x, r->y, r->width, r->height), aSnap);
+  }
+  aContext->Clip();
+}
+
+/*static*/ void
+gfxUtils::ClipToRegion(gfxContext* aContext, const nsIntRegion& aRegion)
+{
+  ClipToRegionInternal(aContext, aRegion, PR_FALSE);
+}
+
+/*static*/ void
+gfxUtils::ClipToRegionSnapped(gfxContext* aContext, const nsIntRegion& aRegion)
+{
+  ClipToRegionInternal(aContext, aRegion, PR_TRUE);
+}
diff --git a/gfx/thebes/gfxUtils.h b/gfx/thebes/gfxUtils.h
index 1a024a6448c0..9854b5e0769a 100644
--- a/gfx/thebes/gfxUtils.h
+++ b/gfx/thebes/gfxUtils.h
@@ -43,6 +43,7 @@
 #include "gfxImageSurface.h"
 
 class gfxDrawable;
+class nsIntRegion;
 
 class THEBES_API gfxUtils {
 public:
@@ -83,6 +84,16 @@ public:
                                  const gfxRect&   aFill,
                                  const gfxImageSurface::gfxImageFormat aFormat,
                                  const gfxPattern::GraphicsFilter& aFilter);
+
+    /**
+     * Clip aContext to the region aRegion.
+     */
+    static void ClipToRegion(gfxContext* aContext, const nsIntRegion& aRegion);
+
+    /**
+     * Clip aContext to the region aRegion, snapping the rectangles.
+     */
+    static void ClipToRegionSnapped(gfxContext* aContext, const nsIntRegion& aRegion);
 };
 
 #endif

From ef6a01f479b1ee1b9d4914dcb29c2c7f6cdcde59 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Fri, 3 Sep 2010 14:31:42 +1200
Subject: [PATCH 089/222] Bug 579276. Part 12: Clip all drawing to the visible
 region on the nonretained path. r=cjones

---
 gfx/layers/basic/BasicLayers.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 480de49e58af..e8ed254579c3 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -403,17 +403,17 @@ BasicThebesLayer::Paint(gfxContext* aContext,
     mValidRegion.SetEmpty();
     mBuffer.Clear();
 
+    target->Save();
+    gfxUtils::ClipToRegionSnapped(target, mVisibleRegion);
     if (aOpacity != 1.0) {
-      target->Save();
-      ClipToContain(target, mVisibleRegion.GetBounds());
       target->PushGroup(gfxASurface::CONTENT_COLOR_ALPHA);
     }
     aCallback(this, target, mVisibleRegion, nsIntRegion(), aCallbackData);
     if (aOpacity != 1.0) {
       target->PopGroupToSource();
       target->Paint(aOpacity);
-      target->Restore();
     }
+    target->Restore();
     return;
   }
 

From d070f2c342b10698d9b79369ef5a97e7c5643d69 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Fri, 3 Sep 2010 14:31:42 +1200
Subject: [PATCH 090/222] Bug 579276. Part 13: Use CONTENT_COLOR for temporary
 surface in nonretained path, if possible. r=cjones

---
 gfx/layers/basic/BasicLayers.cpp | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index e8ed254579c3..a56a93c20403 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -397,6 +397,12 @@ BasicThebesLayer::Paint(gfxContext* aContext,
   nsRefPtr<gfxASurface> targetSurface = aContext->CurrentSurface();
 
   PRBool canUseOpaqueSurface = CanUseOpaqueSurface();
+  PRBool opaqueBuffer = canUseOpaqueSurface &&
+    targetSurface->AreSimilarSurfacesSensitiveToContentType();
+  Buffer::ContentType contentType =
+    opaqueBuffer ? gfxASurface::CONTENT_COLOR :
+                   gfxASurface::CONTENT_COLOR_ALPHA;
+
   if (!BasicManager()->IsRetained() ||
       (aOpacity == 1.0 && !canUseOpaqueSurface &&
        !ShouldRetainTransparentSurface(mContentFlags, targetSurface))) {
@@ -406,7 +412,7 @@ BasicThebesLayer::Paint(gfxContext* aContext,
     target->Save();
     gfxUtils::ClipToRegionSnapped(target, mVisibleRegion);
     if (aOpacity != 1.0) {
-      target->PushGroup(gfxASurface::CONTENT_COLOR_ALPHA);
+      target->PushGroup(contentType);
     }
     aCallback(this, target, mVisibleRegion, nsIntRegion(), aCallbackData);
     if (aOpacity != 1.0) {
@@ -418,11 +424,6 @@ BasicThebesLayer::Paint(gfxContext* aContext,
   }
 
   {
-    PRBool opaqueBuffer = canUseOpaqueSurface &&
-      targetSurface->AreSimilarSurfacesSensitiveToContentType();
-    Buffer::ContentType contentType =
-      opaqueBuffer ? gfxASurface::CONTENT_COLOR :
-                     gfxASurface::CONTENT_COLOR_ALPHA;
     Buffer::PaintState state = mBuffer.BeginPaint(this, contentType);
     mValidRegion.Sub(mValidRegion, state.mRegionToInvalidate);
 

From c6e8dab10dbd286643794dd62a16c368a38eb2a9 Mon Sep 17 00:00:00 2001
From: Michael Wu <mwu@mozilla.com>
Date: Fri, 3 Sep 2010 14:56:04 +1200
Subject: [PATCH 091/222] Bug 589175 - Comment out binary-component entries,
 r=bsmedberg a=blocking2.0

---
 toolkit/mozapps/installer/packager.mk | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/toolkit/mozapps/installer/packager.mk b/toolkit/mozapps/installer/packager.mk
index c5b6d7c5b405..01814fbcc579 100644
--- a/toolkit/mozapps/installer/packager.mk
+++ b/toolkit/mozapps/installer/packager.mk
@@ -237,12 +237,18 @@ NON_OMNIJAR_FILES = \
 PACK_OMNIJAR	= \
   rm -f omni.jar components/binary.manifest && \
   grep -h '^binary-component' components/*.manifest > binary.manifest ; \
+  sed -e 's/^binary-component/\#binary-component/' components/components.manifest > components.manifest && \
+  mv components.manifest components && \
   find . | xargs touch -t 201001010000 && \
   zip -r9mX omni.jar $(OMNIJAR_FILES) -x $(NON_OMNIJAR_FILES) && \
   $(OPTIMIZE_JARS_CMD) $(DIST)/jarlog/ ./ ./ && \
   mv binary.manifest components && \
   printf "manifest components/binary.manifest\n" > chrome.manifest
-UNPACK_OMNIJAR	= unzip -o omni.jar && rm -f components/binary.manifest
+UNPACK_OMNIJAR	= \
+  unzip -o omni.jar && \
+  rm -f components/binary.manifest && \
+  sed -e 's/^\#binary-component/binary-component/' components/components.manifest > components.manifest && \
+  mv components.manifest components
 
 MAKE_PACKAGE	= (cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(PACK_OMNIJAR)) && $(INNER_MAKE_PACKAGE)
 UNMAKE_PACKAGE	= $(INNER_UNMAKE_PACKAGE) && (cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(UNPACK_OMNIJAR))

From 47a5284310c9b4e0b1ea2d0bb17f9aeab86cbc38 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Fri, 3 Sep 2010 15:50:29 +1200
Subject: [PATCH 092/222] Bug 589632 - Fix LayerManagerD3D9 debug output r=Bas,
 a=blocking2.0

---
 gfx/layers/Layers.cpp                | 8 ++++----
 gfx/layers/d3d9/LayerManagerD3D9.cpp | 8 ++++----
 gfx/layers/d3d9/LayerManagerD3D9.h   | 7 ++++---
 gfx/layers/opengl/LayerManagerOGL.h  | 4 ++++
 4 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index d622b01a5e9e..35b2b4f80631 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -291,12 +291,12 @@ LayerManager::Dump(FILE* aFile, const char* aPrefix)
 
   nsCAutoString pfx(aPrefix);
   pfx += "  ";
-  if (!mRoot) {
+  if (!GetRoot()) {
     fprintf(file, "%s(null)", pfx.get());
     return;
   }
 
-  mRoot->Dump(file, pfx.get());
+  GetRoot()->Dump(file, pfx.get());
 }
 
 void
@@ -317,12 +317,12 @@ LayerManager::Log(const char* aPrefix)
 
   nsCAutoString pfx(aPrefix);
   pfx += "  ";
-  if (!mRoot) {
+  if (!GetRoot()) {
     MOZ_LAYERS_LOG(("%s(null)", pfx.get()));
     return;
   }
 
-  mRoot->Log(pfx.get());
+  GetRoot()->Log(pfx.get());
 }
 
 void
diff --git a/gfx/layers/d3d9/LayerManagerD3D9.cpp b/gfx/layers/d3d9/LayerManagerD3D9.cpp
index 1ba30089bc62..130c5ac57a35 100644
--- a/gfx/layers/d3d9/LayerManagerD3D9.cpp
+++ b/gfx/layers/d3d9/LayerManagerD3D9.cpp
@@ -137,7 +137,7 @@ LayerManagerD3D9::EndTransaction(DrawThebesLayerCallback aCallback,
 void
 LayerManagerD3D9::SetRoot(Layer *aLayer)
 {
-  mRootLayer = static_cast<LayerD3D9*>(aLayer->ImplData());
+  mRoot = aLayer;
 }
 
 already_AddRefed<ThebesLayer>
@@ -198,8 +198,8 @@ LayerManagerD3D9::Render()
 
   device()->BeginScene();
 
-  if (mRootLayer) {
-    const nsIntRect *clipRect = mRootLayer->GetLayer()->GetClipRect();
+  if (mRoot) {
+    const nsIntRect *clipRect = mRoot->GetClipRect();
     RECT r;
     if (clipRect) {
       r.left = (LONG)clipRect->x;
@@ -213,7 +213,7 @@ LayerManagerD3D9::Render()
     }
     device()->SetScissorRect(&r);
 
-    mRootLayer->RenderLayer();
+    static_cast<LayerD3D9*>(mRoot->ImplData())->RenderLayer();
   }
 
   device()->EndScene();
diff --git a/gfx/layers/d3d9/LayerManagerD3D9.h b/gfx/layers/d3d9/LayerManagerD3D9.h
index d481f3fcf0f1..f9a3e5b7661b 100644
--- a/gfx/layers/d3d9/LayerManagerD3D9.h
+++ b/gfx/layers/d3d9/LayerManagerD3D9.h
@@ -145,6 +145,10 @@ public:
       mDeviceManager = nsnull;
   }
 
+#ifdef MOZ_LAYERS_HAVE_LOG
+  virtual const char* Name() const { return "D3D9"; }
+#endif // MOZ_LAYERS_HAVE_LOG
+
 private:
   /* Device manager instance */
   static DeviceManagerD3D9 *mDeviceManager;
@@ -160,9 +164,6 @@ private:
    */
   nsRefPtr<gfxContext> mTarget;
 
-  /* Current root layer. */
-  LayerD3D9 *mRootLayer;
-
   /* Callback info for current transaction */
   CallbackInfo mCurrentCallbackInfo;
 
diff --git a/gfx/layers/opengl/LayerManagerOGL.h b/gfx/layers/opengl/LayerManagerOGL.h
index dd054edafa43..e7d731ac5ba3 100644
--- a/gfx/layers/opengl/LayerManagerOGL.h
+++ b/gfx/layers/opengl/LayerManagerOGL.h
@@ -293,6 +293,10 @@ public:
                     aFlipped);
   }
 
+#ifdef MOZ_LAYERS_HAVE_LOG
+   virtual const char* Name() const { return "OGL"; }
+#endif // MOZ_LAYERS_HAVE_LOG
+
 private:
   /** Widget associated with this layer manager */
   nsIWidget *mWidget;

From b5fb6a703c4b79d6261d4a6b7d55fb2100fff507 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Fri, 3 Sep 2010 15:50:42 +1200
Subject: [PATCH 093/222] Bug 590735 - D3D9/OGL Image layers need to round up
 on uneven sized YCbCr images r=joe, a=blocking2.0

---
 gfx/layers/d3d9/ImageLayerD3D9.cpp  | 14 +++++++++++++-
 gfx/layers/d3d9/ImageLayerD3D9.h    |  1 +
 gfx/layers/opengl/ImageLayerOGL.cpp | 12 ++++++++++++
 gfx/layers/opengl/ImageLayerOGL.h   |  2 ++
 4 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/gfx/layers/d3d9/ImageLayerD3D9.cpp b/gfx/layers/d3d9/ImageLayerD3D9.cpp
index f10f87c7171e..eef6c6bf235c 100644
--- a/gfx/layers/d3d9/ImageLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ImageLayerD3D9.cpp
@@ -269,23 +269,35 @@ PlanarYCbCrImageD3D9::SetData(const PlanarYCbCrImage::Data &aData)
      // YV24 format
      width_shift = 0;
      height_shift = 0;
+     mType = gfx::YV24;
   } else if (aData.mYSize.width / 2 == aData.mCbCrSize.width &&
              aData.mYSize.height == aData.mCbCrSize.height) {
     // YV16 format
     width_shift = 1;
     height_shift = 0;
+    mType = gfx::YV16;
   } else if (aData.mYSize.width / 2 == aData.mCbCrSize.width &&
              aData.mYSize.height / 2 == aData.mCbCrSize.height ) {
       // YV12 format
     width_shift = 1;
     height_shift = 1;
+    mType = gfx::YV12;
   } else {
     NS_ERROR("YCbCr format not supported");
   }
 
   mData = aData;
   mData.mCbCrStride = mData.mCbCrSize.width = aData.mPicSize.width >> width_shift;
+  // Round up the values for width and height to make sure we sample enough data
+  // for the last pixel - See bug 590735
+  if (width_shift && (aData.mPicSize.width & 1)) {
+    mData.mCbCrStride++;
+    mData.mCbCrSize.width++;
+  }
   mData.mCbCrSize.height = aData.mPicSize.height >> height_shift;
+  if (height_shift && (aData.mPicSize.height & 1)) {
+      mData.mCbCrSize.height++;
+  }
   mData.mYSize = aData.mPicSize;
   mData.mYStride = mData.mYSize.width;
 
@@ -458,7 +470,7 @@ PlanarYCbCrImageD3D9::GetAsSurface()
                            mData.mYStride,
                            mData.mCbCrStride,
                            imageSurface->Stride(),
-                           gfx::YV12);
+                           mType);
 
   return imageSurface.forget().get();
 }
diff --git a/gfx/layers/d3d9/ImageLayerD3D9.h b/gfx/layers/d3d9/ImageLayerD3D9.h
index a21776519607..0ce25c147fba 100644
--- a/gfx/layers/d3d9/ImageLayerD3D9.h
+++ b/gfx/layers/d3d9/ImageLayerD3D9.h
@@ -129,6 +129,7 @@ public:
   nsRefPtr<IDirect3DTexture9> mCrTexture;
   nsRefPtr<IDirect3DTexture9> mCbTexture;
   PRPackedBool mHasData;
+  gfx::YUVType mType; 
 };
 
 
diff --git a/gfx/layers/opengl/ImageLayerOGL.cpp b/gfx/layers/opengl/ImageLayerOGL.cpp
index e9658b6427d8..405132cb7232 100644
--- a/gfx/layers/opengl/ImageLayerOGL.cpp
+++ b/gfx/layers/opengl/ImageLayerOGL.cpp
@@ -489,23 +489,35 @@ PlanarYCbCrImageOGL::SetData(const PlanarYCbCrImage::Data &aData)
      // YV24 format
      width_shift = 0;
      height_shift = 0;
+     mType = gfx::YV24;
   } else if (aData.mYSize.width / 2 == aData.mCbCrSize.width &&
              aData.mYSize.height == aData.mCbCrSize.height) {
     // YV16 format
     width_shift = 1;
     height_shift = 0;
+    mType = gfx::YV16;
   } else if (aData.mYSize.width / 2 == aData.mCbCrSize.width &&
              aData.mYSize.height / 2 == aData.mCbCrSize.height ) {
       // YV12 format
     width_shift = 1;
     height_shift = 1;
+    mType = gfx::YV16;
   } else {
     NS_ERROR("YCbCr format not supported");
   }
   
   mData = aData;
   mData.mCbCrStride = mData.mCbCrSize.width = aData.mPicSize.width >> width_shift;
+  // Round up the values for width and height to make sure we sample enough data
+  // for the last pixel - See bug 590735
+  if (width_shift && (aData.mPicSize.width & 1)) {
+    mData.mCbCrStride++;
+    mData.mCbCrSize.width++;
+  }
   mData.mCbCrSize.height = aData.mPicSize.height >> height_shift;
+  if (height_shift && (aData.mPicSize.height & 1)) {
+      mData.mCbCrSize.height++;
+  }
   mData.mYSize = aData.mPicSize;
   mData.mYStride = mData.mYSize.width;
 
diff --git a/gfx/layers/opengl/ImageLayerOGL.h b/gfx/layers/opengl/ImageLayerOGL.h
index e0d5b49d1226..287f72f4d3c5 100644
--- a/gfx/layers/opengl/ImageLayerOGL.h
+++ b/gfx/layers/opengl/ImageLayerOGL.h
@@ -40,6 +40,7 @@
 
 #include "LayerManagerOGL.h"
 #include "ImageLayers.h"
+#include "yuv_convert.h"
 #include "mozilla/Mutex.h"
 
 namespace mozilla {
@@ -213,6 +214,7 @@ public:
   Data mData;
   gfxIntSize mSize;
   PRPackedBool mHasData;
+  gfx::YUVType mType; 
 };
 
 

From e4a9dac062be882cf19f52af4e55ae4fe6a6e6f7 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Fri, 3 Sep 2010 15:50:53 +1200
Subject: [PATCH 094/222] Bug 593224 - ContainerLayerD3D9 can reset the clip
 rect r=Bas, a=blocking2.0

---
 gfx/layers/d3d9/ContainerLayerD3D9.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/gfx/layers/d3d9/ContainerLayerD3D9.cpp b/gfx/layers/d3d9/ContainerLayerD3D9.cpp
index 5ed9eee70f38..3e6a21d39c9d 100644
--- a/gfx/layers/d3d9/ContainerLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ContainerLayerD3D9.cpp
@@ -141,6 +141,7 @@ ContainerLayerD3D9::RenderLayer()
   nsRefPtr<IDirect3DSurface9> previousRenderTarget;
   nsRefPtr<IDirect3DTexture9> renderTexture;
   float previousRenderTargetOffset[4];
+  RECT oldClipRect;
   float renderTargetOffset[] = { 0, 0, 0, 0 };
   float oldViewMatrix[4][4];
 
@@ -149,6 +150,7 @@ ContainerLayerD3D9::RenderLayer()
 
   if (useIntermediate) {
     device()->GetRenderTarget(0, getter_AddRefs(previousRenderTarget));
+    device()->GetScissorRect(&oldClipRect);
     device()->CreateTexture(visibleRect.width, visibleRect.height, 1,
                             D3DUSAGE_RENDERTARGET, D3DFMT_A8R8G8B8,
                             D3DPOOL_DEFAULT, getter_AddRefs(renderTexture),
@@ -224,6 +226,7 @@ ContainerLayerD3D9::RenderLayer()
 
   if (useIntermediate) {
     device()->SetRenderTarget(0, previousRenderTarget);
+    device()->SetScissorRect(&oldClipRect);
     device()->SetVertexShaderConstantF(12, previousRenderTargetOffset, 1);
     device()->SetVertexShaderConstantF(8, &oldViewMatrix[0][0], 4);
 

From 0fe2dd0835db31fb7bf5843bb897285a5a36345c Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Fri, 3 Sep 2010 15:51:04 +1200
Subject: [PATCH 095/222] Bug 590367 - Render RGB d2d layers with a RGBA
 surface and shader r=Bas, a=blocking2.0

---
 gfx/layers/d3d9/CanvasLayerD3D9.cpp          |   2 +-
 gfx/layers/d3d9/ContainerLayerD3D9.cpp       |   2 +-
 gfx/layers/d3d9/DeviceManagerD3D9.cpp        |  11 ++
 gfx/layers/d3d9/DeviceManagerD3D9.h          |   4 +
 gfx/layers/d3d9/ImageLayerD3D9.cpp           |   2 +-
 gfx/layers/d3d9/LayerManagerD3D9Shaders.h    | 119 ++++++++++++++++---
 gfx/layers/d3d9/LayerManagerD3D9Shaders.hlsl |  10 +-
 gfx/layers/d3d9/ThebesLayerD3D9.cpp          |   7 +-
 gfx/layers/d3d9/genshaders.sh                |   2 +
 9 files changed, 138 insertions(+), 21 deletions(-)

diff --git a/gfx/layers/d3d9/CanvasLayerD3D9.cpp b/gfx/layers/d3d9/CanvasLayerD3D9.cpp
index b34a45ed4968..7bfdff061925 100644
--- a/gfx/layers/d3d9/CanvasLayerD3D9.cpp
+++ b/gfx/layers/d3d9/CanvasLayerD3D9.cpp
@@ -239,7 +239,7 @@ CanvasLayerD3D9::RenderLayer()
   opacity[0] = GetOpacity();
   device()->SetPixelShaderConstantF(0, opacity, 1);
 
-  mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBLAYER);
+  mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBALAYER);
 
   if (!mDataIsPremultiplied) {
     device()->SetRenderState(D3DRS_SRCBLEND, D3DBLEND_SRCALPHA);
diff --git a/gfx/layers/d3d9/ContainerLayerD3D9.cpp b/gfx/layers/d3d9/ContainerLayerD3D9.cpp
index 3e6a21d39c9d..97815aefbf7d 100644
--- a/gfx/layers/d3d9/ContainerLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ContainerLayerD3D9.cpp
@@ -257,7 +257,7 @@ ContainerLayerD3D9::RenderLayer()
     opacityVector[0] = opacity;
     device()->SetPixelShaderConstantF(0, opacityVector, 1);
 
-    mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBLAYER);
+    mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBALAYER);
 
     device()->SetTexture(0, renderTexture);
     device()->DrawPrimitive(D3DPT_TRIANGLESTRIP, 0, 2);
diff --git a/gfx/layers/d3d9/DeviceManagerD3D9.cpp b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
index 7c00fe308a7d..228fe9adcb86 100644
--- a/gfx/layers/d3d9/DeviceManagerD3D9.cpp
+++ b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
@@ -338,6 +338,13 @@ DeviceManagerD3D9::Init()
     return false;
   }
 
+  hr = mDevice->CreatePixelShader((DWORD*)RGBAShaderPS,
+                                  getter_AddRefs(mRGBAPS));
+
+  if (FAILED(hr)) {
+    return false;
+  }
+
   hr = mDevice->CreatePixelShader((DWORD*)YCbCrShaderPS,
                                   getter_AddRefs(mYCbCrPS));
 
@@ -459,6 +466,10 @@ DeviceManagerD3D9::SetShaderMode(ShaderMode aMode)
       mDevice->SetVertexShader(mLayerVS);
       mDevice->SetPixelShader(mRGBPS);
       break;
+    case RGBALAYER:
+      mDevice->SetVertexShader(mLayerVS);
+      mDevice->SetPixelShader(mRGBAPS);
+      break;
     case YCBCRLAYER:
       mDevice->SetVertexShader(mLayerVS);
       mDevice->SetPixelShader(mYCbCrPS);
diff --git a/gfx/layers/d3d9/DeviceManagerD3D9.h b/gfx/layers/d3d9/DeviceManagerD3D9.h
index 8be99987efe2..095a5c3423a0 100644
--- a/gfx/layers/d3d9/DeviceManagerD3D9.h
+++ b/gfx/layers/d3d9/DeviceManagerD3D9.h
@@ -129,6 +129,7 @@ public:
 
   enum ShaderMode {
     RGBLAYER,
+    RGBALAYER,
     YCBCRLAYER,
     SOLIDCOLORLAYER
   };
@@ -178,6 +179,9 @@ private:
   /* Pixel shader used for RGB textures */
   nsRefPtr<IDirect3DPixelShader9> mRGBPS;
 
+  /* Pixel shader used for RGBA textures */
+  nsRefPtr<IDirect3DPixelShader9> mRGBAPS;
+
   /* Pixel shader used for RGB textures */
   nsRefPtr<IDirect3DPixelShader9> mYCbCrPS;
 
diff --git a/gfx/layers/d3d9/ImageLayerD3D9.cpp b/gfx/layers/d3d9/ImageLayerD3D9.cpp
index eef6c6bf235c..f204eed0c06e 100644
--- a/gfx/layers/d3d9/ImageLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ImageLayerD3D9.cpp
@@ -243,7 +243,7 @@ ImageLayerD3D9::RenderLayer()
     opacity[0] = GetOpacity();
     device()->SetPixelShaderConstantF(0, opacity, 1);
 
-    mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBLAYER);
+    mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBALAYER);
 
     device()->SetTexture(0, cairoImage->mTexture);
     device()->DrawPrimitive(D3DPT_TRIANGLESTRIP, 0, 2);
diff --git a/gfx/layers/d3d9/LayerManagerD3D9Shaders.h b/gfx/layers/d3d9/LayerManagerD3D9Shaders.h
index 7201f070f275..4d22b6f8c6c5 100644
--- a/gfx/layers/d3d9/LayerManagerD3D9Shaders.h
+++ b/gfx/layers/d3d9/LayerManagerD3D9Shaders.h
@@ -1,6 +1,6 @@
 #if 0
 //
-// Generated by Microsoft (R) HLSL Shader Compiler 9.29.952.3111
+// Generated by Microsoft (R) HLSL Shader Compiler 9.27.952.3022
 //
 //   fxc LayerManagerD3D9Shaders.hlsl -ELayerQuadVS -nologo -FhtmpShaderHeader
 //    -VnLayerQuadVS
@@ -92,8 +92,8 @@ const BYTE LayerQuadVS[] =
      83, 104,  97, 100, 101, 114, 
      32,  67, 111, 109, 112, 105, 
     108, 101, 114,  32,  57,  46, 
-     50,  57,  46,  57,  53,  50, 
-     46,  51,  49,  49,  49,   0, 
+     50,  55,  46,  57,  53,  50, 
+     46,  51,  48,  50,  50,   0, 
      81,   0,   0,   5,  13,   0, 
      15, 160,   0,   0,   0, 191, 
       0,   0,   0,   0,   0,   0, 
@@ -149,10 +149,10 @@ const BYTE LayerQuadVS[] =
 };
 #if 0
 //
-// Generated by Microsoft (R) HLSL Shader Compiler 9.29.952.3111
+// Generated by Microsoft (R) HLSL Shader Compiler 9.27.952.3022
 //
-//   fxc LayerManagerD3D9Shaders.hlsl -ERGBShader -nologo -Tps_2_0
-//    -FhtmpShaderHeader -VnRGBShaderPS
+//   fxc LayerManagerD3D9Shaders.hlsl -ERGBAShader -nologo -Tps_2_0
+//    -FhtmpShaderHeader -VnRGBAShaderPS
 //
 //
 // Parameters:
@@ -179,6 +179,87 @@ const BYTE LayerQuadVS[] =
 // approximately 3 instruction slots used (1 texture, 2 arithmetic)
 #endif
 
+const BYTE RGBAShaderPS[] =
+{
+      0,   2, 255, 255, 254, 255, 
+     45,   0,  67,  84,  65,  66, 
+     28,   0,   0,   0, 127,   0, 
+      0,   0,   0,   2, 255, 255, 
+      2,   0,   0,   0,  28,   0, 
+      0,   0,   0,   1,   0,   0, 
+    120,   0,   0,   0,  68,   0, 
+      0,   0,   2,   0,   0,   0, 
+      1,   0,   0,   0,  84,   0, 
+      0,   0,   0,   0,   0,   0, 
+    100,   0,   0,   0,   3,   0, 
+      0,   0,   1,   0,   0,   0, 
+    104,   0,   0,   0,   0,   0, 
+      0,   0, 102,  76,  97, 121, 
+    101, 114,  79, 112,  97,  99, 
+    105, 116, 121,   0, 171, 171, 
+      0,   0,   3,   0,   1,   0, 
+      1,   0,   1,   0,   0,   0, 
+      0,   0,   0,   0, 115,  50, 
+     68,   0,   4,   0,  12,   0, 
+      1,   0,   1,   0,   1,   0, 
+      0,   0,   0,   0,   0,   0, 
+    112, 115,  95,  50,  95,  48, 
+      0,  77, 105,  99, 114, 111, 
+    115, 111, 102, 116,  32,  40, 
+     82,  41,  32,  72,  76,  83, 
+     76,  32,  83, 104,  97, 100, 
+    101, 114,  32,  67, 111, 109, 
+    112, 105, 108, 101, 114,  32, 
+     57,  46,  50,  55,  46,  57, 
+     53,  50,  46,  51,  48,  50, 
+     50,   0,  31,   0,   0,   2, 
+      0,   0,   0, 128,   0,   0, 
+      3, 176,  31,   0,   0,   2, 
+      0,   0,   0, 144,   0,   8, 
+     15, 160,  66,   0,   0,   3, 
+      0,   0,  15, 128,   0,   0, 
+    228, 176,   0,   8, 228, 160, 
+      5,   0,   0,   3,   0,   0, 
+     15, 128,   0,   0, 228, 128, 
+      0,   0,   0, 160,   1,   0, 
+      0,   2,   0,   8,  15, 128, 
+      0,   0, 228, 128, 255, 255, 
+      0,   0
+};
+#if 0
+//
+// Generated by Microsoft (R) HLSL Shader Compiler 9.27.952.3022
+//
+//   fxc LayerManagerD3D9Shaders.hlsl -ERGBShader -nologo -Tps_2_0
+//    -FhtmpShaderHeader -VnRGBShaderPS
+//
+//
+// Parameters:
+//
+//   float fLayerOpacity;
+//   sampler2D s2D;
+//
+//
+// Registers:
+//
+//   Name          Reg   Size
+//   ------------- ----- ----
+//   fLayerOpacity c0       1
+//   s2D           s0       1
+//
+
+    ps_2_0
+    def c1, 1, 0, 0, 0
+    dcl t0.xy
+    dcl_2d s0
+    texld r0, t0, s0
+    mul r0.xyz, r0, c0.x
+    mov r0.w, c1.x
+    mov oC0, r0
+
+// approximately 4 instruction slots used (1 texture, 3 arithmetic)
+#endif
+
 const BYTE RGBShaderPS[] =
 {
       0,   2, 255, 255, 254, 255, 
@@ -210,9 +291,13 @@ const BYTE RGBShaderPS[] =
      76,  32,  83, 104,  97, 100, 
     101, 114,  32,  67, 111, 109, 
     112, 105, 108, 101, 114,  32, 
-     57,  46,  50,  57,  46,  57, 
-     53,  50,  46,  51,  49,  49, 
-     49,   0,  31,   0,   0,   2, 
+     57,  46,  50,  55,  46,  57, 
+     53,  50,  46,  51,  48,  50, 
+     50,   0,  81,   0,   0,   5, 
+      1,   0,  15, 160,   0,   0, 
+    128,  63,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,  31,   0,   0,   2, 
       0,   0,   0, 128,   0,   0, 
       3, 176,  31,   0,   0,   2, 
       0,   0,   0, 144,   0,   8, 
@@ -220,15 +305,17 @@ const BYTE RGBShaderPS[] =
       0,   0,  15, 128,   0,   0, 
     228, 176,   0,   8, 228, 160, 
       5,   0,   0,   3,   0,   0, 
-     15, 128,   0,   0, 228, 128, 
+      7, 128,   0,   0, 228, 128, 
       0,   0,   0, 160,   1,   0, 
+      0,   2,   0,   0,   8, 128, 
+      1,   0,   0, 160,   1,   0, 
       0,   2,   0,   8,  15, 128, 
       0,   0, 228, 128, 255, 255, 
       0,   0
 };
 #if 0
 //
-// Generated by Microsoft (R) HLSL Shader Compiler 9.29.952.3111
+// Generated by Microsoft (R) HLSL Shader Compiler 9.27.952.3022
 //
 //   fxc LayerManagerD3D9Shaders.hlsl -EYCbCrShader -nologo -Tps_2_0
 //    -FhtmpShaderHeader -VnYCbCrShaderPS
@@ -323,9 +410,9 @@ const BYTE YCbCrShaderPS[] =
      76,  83,  76,  32,  83, 104, 
      97, 100, 101, 114,  32,  67, 
     111, 109, 112, 105, 108, 101, 
-    114,  32,  57,  46,  50,  57, 
+    114,  32,  57,  46,  50,  55, 
      46,  57,  53,  50,  46,  51, 
-     49,  49,  49,   0,  81,   0, 
+     48,  50,  50,   0,  81,   0, 
       0,   5,   1,   0,  15, 160, 
       0,   0,   0, 191,   0,   0, 
     128, 189, 244, 253, 148,  63, 
@@ -384,7 +471,7 @@ const BYTE YCbCrShaderPS[] =
 };
 #if 0
 //
-// Generated by Microsoft (R) HLSL Shader Compiler 9.29.952.3111
+// Generated by Microsoft (R) HLSL Shader Compiler 9.27.952.3022
 //
 //   fxc LayerManagerD3D9Shaders.hlsl -ESolidColorShader -nologo -Tps_2_0
 //    -FhtmpShaderHeader -VnSolidColorShaderPS
@@ -432,8 +519,8 @@ const BYTE SolidColorShaderPS[] =
      83, 104,  97, 100, 101, 114, 
      32,  67, 111, 109, 112, 105, 
     108, 101, 114,  32,  57,  46, 
-     50,  57,  46,  57,  53,  50, 
-     46,  51,  49,  49,  49,   0, 
+     50,  55,  46,  57,  53,  50, 
+     46,  51,  48,  50,  50,   0, 
       1,   0,   0,   2,   0,   8, 
      15, 128,   0,   0, 228, 160, 
     255, 255,   0,   0
diff --git a/gfx/layers/d3d9/LayerManagerD3D9Shaders.hlsl b/gfx/layers/d3d9/LayerManagerD3D9Shaders.hlsl
index 0bbba3c216ed..4b01ec50ec6c 100644
--- a/gfx/layers/d3d9/LayerManagerD3D9Shaders.hlsl
+++ b/gfx/layers/d3d9/LayerManagerD3D9Shaders.hlsl
@@ -39,11 +39,19 @@ VS_OUTPUT LayerQuadVS(const VS_INPUT aVertex)
   return outp;
 }
 
-float4 RGBShader(const VS_OUTPUT aVertex) : COLOR
+float4 RGBAShader(const VS_OUTPUT aVertex) : COLOR
 {
   return tex2D(s2D, aVertex.vTexCoords) * fLayerOpacity;
 }
 
+float4 RGBShader(const VS_OUTPUT aVertex) : COLOR
+{
+  float4 result;
+  result = tex2D(s2D, aVertex.vTexCoords) * fLayerOpacity;
+  result.a = 1.0;
+  return result;
+}
+
 float4 YCbCrShader(const VS_OUTPUT aVertex) : COLOR
 {
   float4 yuv;
diff --git a/gfx/layers/d3d9/ThebesLayerD3D9.cpp b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
index 8e7092a4f08d..a532e46cf35b 100644
--- a/gfx/layers/d3d9/ThebesLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
@@ -234,7 +234,12 @@ ThebesLayerD3D9::RenderLayer()
   opacity[0] = GetOpacity();
   device()->SetPixelShaderConstantF(0, opacity, 1);
 
-  mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBLAYER);
+#ifdef CAIRO_HAS_D2D_SURFACE
+  if (mD2DSurface && UseOpaqueSurface(this)) {
+    mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBLAYER);
+  } else
+#endif
+  mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBALAYER);
 
   device()->SetTexture(0, mTexture);
   device()->DrawPrimitive(D3DPT_TRIANGLESTRIP, 0, 2);
diff --git a/gfx/layers/d3d9/genshaders.sh b/gfx/layers/d3d9/genshaders.sh
index bf6bd8355665..383041ad03df 100644
--- a/gfx/layers/d3d9/genshaders.sh
+++ b/gfx/layers/d3d9/genshaders.sh
@@ -2,6 +2,8 @@ tempfile=tmpShaderHeader
 rm LayerManagerD3D9Shaders.h
 fxc LayerManagerD3D9Shaders.hlsl -ELayerQuadVS -nologo -Fh$tempfile -VnLayerQuadVS
 cat $tempfile >> LayerManagerD3D9Shaders.h
+fxc LayerManagerD3D9Shaders.hlsl -ERGBAShader -nologo -Tps_2_0 -Fh$tempfile -VnRGBAShaderPS
+cat $tempfile >> LayerManagerD3D9Shaders.h
 fxc LayerManagerD3D9Shaders.hlsl -ERGBShader -nologo -Tps_2_0 -Fh$tempfile -VnRGBShaderPS
 cat $tempfile >> LayerManagerD3D9Shaders.h
 fxc LayerManagerD3D9Shaders.hlsl -EYCbCrShader -nologo -Tps_2_0 -Fh$tempfile -VnYCbCrShaderPS

From d55c0df3ede5ae362639cfb2ab6ce4ccd4b30c6f Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Fri, 3 Sep 2010 15:51:15 +1200
Subject: [PATCH 096/222] Bug 592985 - Free global shared CGL context on
 shutdown r=vlad, a=blocking2.0

---
 gfx/thebes/GLContextProviderCGL.mm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/gfx/thebes/GLContextProviderCGL.mm b/gfx/thebes/GLContextProviderCGL.mm
index 934ef4118ea3..a2fd984e6c7e 100644
--- a/gfx/thebes/GLContextProviderCGL.mm
+++ b/gfx/thebes/GLContextProviderCGL.mm
@@ -530,6 +530,7 @@ GLContextProviderCGL::GetGlobalContext()
 void
 GLContextProviderCGL::Shutdown()
 {
+  gGlobalContext = nsnull;
 }
 
 } /* namespace gl */

From 418edf53e3ae9bd82621b3d4104a572da679d151 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Fri, 3 Sep 2010 16:20:23 +1200
Subject: [PATCH 097/222] Fixing bustage, a=me

---
 gfx/layers/d3d9/ImageLayerD3D9.h    | 1 +
 gfx/layers/d3d9/ThebesLayerD3D9.cpp | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/gfx/layers/d3d9/ImageLayerD3D9.h b/gfx/layers/d3d9/ImageLayerD3D9.h
index 0ce25c147fba..687d5d6fa0d6 100644
--- a/gfx/layers/d3d9/ImageLayerD3D9.h
+++ b/gfx/layers/d3d9/ImageLayerD3D9.h
@@ -40,6 +40,7 @@
 
 #include "LayerManagerD3D9.h"
 #include "ImageLayers.h"
+#include "yuv_convert.h"
 #include "mozilla/Mutex.h"
 
 namespace mozilla {
diff --git a/gfx/layers/d3d9/ThebesLayerD3D9.cpp b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
index a532e46cf35b..a82c1880c5d2 100644
--- a/gfx/layers/d3d9/ThebesLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
@@ -235,7 +235,7 @@ ThebesLayerD3D9::RenderLayer()
   device()->SetPixelShaderConstantF(0, opacity, 1);
 
 #ifdef CAIRO_HAS_D2D_SURFACE
-  if (mD2DSurface && UseOpaqueSurface(this)) {
+  if (mD2DSurface && CanUseOpaqueSurface()) {
     mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBLAYER);
   } else
 #endif

From 559a6b92cf904725d0cec4cba57e37991f2a436d Mon Sep 17 00:00:00 2001
From: Timothy Nikkel <tnikkel@gmail.com>
Date: Fri, 3 Sep 2010 00:43:26 -0500
Subject: [PATCH 098/222] Bug 593262. The stop/reload button is chasing me.
 Keep running from it. r=roc a=fix a test

--HG--
rename : layout/style/test/hover_helper.html => layout/style/test/chrome/hover_helper.html
rename : layout/style/test/test_hover.html => layout/style/test/chrome/test_hover.html
---
 layout/style/test/Makefile.in                 |  2 -
 layout/style/test/chrome/Makefile.in          |  2 +
 .../style/test/{ => chrome}/hover_helper.html | 39 +++++++++----------
 .../style/test/{ => chrome}/test_hover.html   |  8 ++--
 4 files changed, 25 insertions(+), 26 deletions(-)
 rename layout/style/test/{ => chrome}/hover_helper.html (89%)
 rename layout/style/test/{ => chrome}/test_hover.html (60%)

diff --git a/layout/style/test/Makefile.in b/layout/style/test/Makefile.in
index 2752dff78a9e..9815d73d837d 100644
--- a/layout/style/test/Makefile.in
+++ b/layout/style/test/Makefile.in
@@ -145,8 +145,6 @@ _TEST_FILES =	test_acid3_test46.html \
 		test_dont_use_document_colors.html \
 		test_font_face_parser.html \
 		test_garbage_at_end_of_declarations.html \
-		test_hover.html \
-		hover_helper.html \
 		test_ident_escaping.html \
 		test_inherit_computation.html \
 		test_inherit_storage.html \
diff --git a/layout/style/test/chrome/Makefile.in b/layout/style/test/chrome/Makefile.in
index e17e3329def8..735e0c029310 100644
--- a/layout/style/test/chrome/Makefile.in
+++ b/layout/style/test/chrome/Makefile.in
@@ -48,6 +48,8 @@ _CHROME_FILES = \
     bug535806-css.css \
     bug535806-html.html \
     bug535806-xul.xul \
+    test_hover.html \
+    hover_helper.html \
     $(NULL)
 
 libs:: $(_CHROME_FILES)
diff --git a/layout/style/test/hover_helper.html b/layout/style/test/chrome/hover_helper.html
similarity index 89%
rename from layout/style/test/hover_helper.html
rename to layout/style/test/chrome/hover_helper.html
index 549bd534b637..5b0fb9830fa9 100644
--- a/layout/style/test/hover_helper.html
+++ b/layout/style/test/chrome/hover_helper.html
@@ -2,10 +2,7 @@
 <html>
 <head>
   <title>Test for :hover</title>
-  <script type="application/javascript" src="/MochiKit/packed.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
   <style type="text/css">
 
   div#one { height: 10px; width: 10px; }
@@ -40,7 +37,7 @@
 
 var imports = [ "SimpleTest", "is", "isnot", "ok" ];
 for each (var import in imports) {
-    window[import] = window.opener[import];
+    window[import] = window.opener.wrappedJSObject[import];
 }
 
 var div = document.getElementById("display");
@@ -55,9 +52,11 @@ iframe.contentDocument.close();
 var moveEvent = { type: "mousemove", clickCount: "0" };
 
 function setResize(str) {
-  iframe.contentDocument.body.setAttribute("onresize",
-                                            "document.body.setAttribute('onresize', 'void(0)');" + 
-                                            "setTimeout('" + str + "', 100)");
+  var handler = function() {
+    iframe.contentWindow.removeEventListener("resize", arguments.callee, false);
+    setTimeout(str, 100);
+  };
+  iframe.contentWindow.addEventListener("resize", handler, false);
 }
 
 function step1() {
@@ -85,7 +84,7 @@ function step1() {
        ":hover applies");
 
     /** Test for Bug 302561 **/
-    setResize("parent.step2()");
+    setResize("step2();");
     is(iframe.contentDocument.body.offsetWidth, 50,
        ":hover does not apply (iframe body width)");
     synthesizeMouse(divtwoparent, 7, 5, moveEvent, window);
@@ -101,7 +100,7 @@ function step2() {
        ":hover applies");
     is(iframe.contentDocument.body.offsetWidth, 100,
        ":hover applies (iframe body width)");
-    setResize("parent.step3()");
+    setResize("step3()");
     synthesizeMouse(divtwoparent, 2, 5, moveEvent, window);
     is(iframe.contentDocument.body.offsetWidth, 50,
        ":hover does not apply (iframe body width)");
@@ -118,7 +117,7 @@ function step3() {
     }
     is(getComputedStyle(divtwo, "").backgroundColor, "transparent",
        ":hover does not apply");
-    setResize("parent.step4()");
+    setResize("step4()");
     /* expect to get a second resize from the oscillation */
 }
 
@@ -137,7 +136,7 @@ var step5called = false;
 function step5() {
     is(step5called, false, "step5 called only once");
     step5called = true;
-    setResize("parent.step6()");
+    setResize("step6()");
     synthesizeMouse(divtwoparent, 25, 5, moveEvent, window);
 }
 
@@ -147,7 +146,7 @@ function step6() {
     step6called = true;
     is(getComputedStyle(divtwo, "").backgroundColor, "transparent",
        ":hover does not apply");
-    setResize("parent.step7()");
+    setResize("step7()");
     synthesizeMouse(divtwoparent, 2, 5, moveEvent, window);
 }
 
@@ -162,7 +161,7 @@ function step7() {
     }
     is(getComputedStyle(divtwo, "").backgroundColor, "rgb(0, 255, 0)",
        ":hover applies");
-    setResize("parent.step8()");
+    setResize("step8()");
     /* expect to get a second resize from the oscillation */
 }
 
@@ -187,7 +186,7 @@ function step9() {
     /* move the mouse out of the way */
     synthesizeMouse(divtwoparent, 200, 5, moveEvent, window);
     divtwoparent.scrollLeft = 5;
-    setResize("parent.step10()");
+    setResize("step10()");
     synthesizeMouse(divtwoparent, 2, 5, moveEvent, window);
     /* mouse now over 7, 5 */
 }
@@ -198,7 +197,7 @@ function step10() {
     step10called = true;
     is(getComputedStyle(divtwo, "").backgroundColor, "rgb(0, 255, 0)",
        ":hover applies");
-    setResize("parent.step11()");
+    setResize("step11()");
     divtwoparent.scrollLeft = 0; /* mouse now over 2,5 */
 }
 
@@ -213,7 +212,7 @@ function step11() {
     }
     is(getComputedStyle(divtwo, "").backgroundColor, "transparent",
        ":hover does not apply");
-    setResize("parent.step12()");
+    setResize("step12()");
     /* expect to get a second resize from the oscillation */
 }
 
@@ -232,7 +231,7 @@ var step13called = false;
 function step13() {
     is(step13called, false, "step13 called only once");
     step13called = true;
-    setResize("parent.step14()");
+    setResize("step14()");
     divtwoparent.scrollLeft = 25; /* mouse now over 27,5 */
 }
 
@@ -242,7 +241,7 @@ function step14() {
     step14called = true;
     is(getComputedStyle(divtwo, "").backgroundColor, "transparent",
        ":hover does not apply");
-    setResize("parent.step15()");
+    setResize("step15()");
     divtwoparent.scrollLeft = 0; /* mouse now over 2,5 */
 }
 
@@ -257,7 +256,7 @@ function step15() {
     }
     is(getComputedStyle(divtwo, "").backgroundColor, "rgb(0, 255, 0)",
        ":hover applies");
-    setResize("parent.step16()");
+    setResize("step16()");
     /* expect to get a second resize from the oscillation */
 }
 
diff --git a/layout/style/test/test_hover.html b/layout/style/test/chrome/test_hover.html
similarity index 60%
rename from layout/style/test/test_hover.html
rename to layout/style/test/chrome/test_hover.html
index 8e766336e46a..f77f5bb5fd9c 100644
--- a/layout/style/test/test_hover.html
+++ b/layout/style/test/chrome/test_hover.html
@@ -2,10 +2,10 @@
 <html>
 <head>
   <title>Test for :hover</title>
-  <script type="application/javascript" src="/MochiKit/packed.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
 </head>
 <body onload="startTest();">
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=">Mozilla Bug </a>

From 5ab666d34a8992918954faf4e1b277a2daa44005 Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jfkthame@gmail.com>
Date: Fri, 3 Sep 2010 11:45:53 +0100
Subject: [PATCH 099/222] bug 593155 - check table length before accessing cmap
 data. r=jdaggett approval2.0=roc

---
 gfx/thebes/gfxDWriteFonts.cpp |  2 +-
 gfx/thebes/gfxFontUtils.cpp   | 14 ++++++++++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/gfx/thebes/gfxDWriteFonts.cpp b/gfx/thebes/gfxDWriteFonts.cpp
index 002b6272e527..712f247e7680 100644
--- a/gfx/thebes/gfxDWriteFonts.cpp
+++ b/gfx/thebes/gfxDWriteFonts.cpp
@@ -422,5 +422,5 @@ gfxDWriteFont::GetFontTable(PRUint32 aTag)
                               DestroyBlobFunc, ftr);
     }
 
-    return hb_blob_create_empty();
+    return nsnull;
 }
diff --git a/gfx/thebes/gfxFontUtils.cpp b/gfx/thebes/gfxFontUtils.cpp
index a88133c5910f..cb4a6c669acc 100644
--- a/gfx/thebes/gfxFontUtils.cpp
+++ b/gfx/thebes/gfxFontUtils.cpp
@@ -525,8 +525,16 @@ gfxFontUtils::FindPreferredSubtable(const PRUint8 *aBuf, PRUint32 aBufLength,
         *aUVSTableOffset = nsnull;
     }
 
+    if (!aBuf || aBufLength < SizeOfHeader) {
+        // cmap table is missing, or too small to contain header fields!
+        return 0;
+    }
+
     // PRUint16 version = ReadShortAt(aBuf, OffsetVersion); // Unused: self-documenting.
     PRUint16 numTables = ReadShortAt(aBuf, OffsetNumTables);
+    if (aBufLength < SizeOfHeader + numTables * SizeOfTable) {
+        return 0;
+    }
 
     // save the format we want here
     PRUint32 keepFormat = 0;
@@ -539,8 +547,10 @@ gfxFontUtils::FindPreferredSubtable(const PRUint8 *aBuf, PRUint32 aBufLength,
 
         const PRUint16 encodingID = ReadShortAt(table, TableOffsetEncodingID);
         const PRUint32 offset = ReadLongAt(table, TableOffsetOffset);
-
-        NS_ENSURE_TRUE(offset < aBufLength, NS_ERROR_GFX_CMAP_MALFORMED);
+        if (aBufLength - 2 < offset) {
+            // this subtable is not valid - beyond end of buffer
+            return 0;
+        }
 
         const PRUint8 *subtable = aBuf + offset;
         const PRUint16 format = ReadShortAt(subtable, SubtableOffsetFormat);

From 4cf341057c32aa6cda99ad8aedd2b34f5ce7b470 Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jfkthame@gmail.com>
Date: Fri, 3 Sep 2010 13:10:45 +0100
Subject: [PATCH 100/222] disable failing win7 reftest, see bug 593330.
 r=developers a=orange-test

---
 layout/reftests/transform/reftest.list | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/layout/reftests/transform/reftest.list b/layout/reftests/transform/reftest.list
index 878bb52e73d3..e773ba987e89 100644
--- a/layout/reftests/transform/reftest.list
+++ b/layout/reftests/transform/reftest.list
@@ -59,10 +59,10 @@ random == rotate-1e.html rotate-1-ref.html
 == percent-1f.html percent-1-ref.html
 == percent-1g.html percent-1-ref.html
 # Transformed elements are abs-pos and fixed-pos containing blocks.
-== abspos-1a.html abspos-1-ref.html
-== abspos-1b.html abspos-1-ref.html
-== abspos-1c.html abspos-1-ref.html
-== abspos-1d.html abspos-1-ref.html
+random-if(winWidget) == abspos-1a.html abspos-1-ref.html # bug 593330
+random-if(winWidget) == abspos-1b.html abspos-1-ref.html # bug 593330
+random-if(winWidget) == abspos-1c.html abspos-1-ref.html # bug 593330
+random-if(winWidget) == abspos-1d.html abspos-1-ref.html # bug 593330
 != abspos-1e.html abspos-1-ref.html
 # Origin can use "top" "right" etc.
 == origin-name-1a.html origin-name-1-ref.html

From e491aa2ad348104c7fa558067dda1720649143cb Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Sat, 4 Sep 2010 00:25:33 +1200
Subject: [PATCH 101/222] Backed out changeset b92757b90f6f

---
 layout/reftests/transform/reftest.list | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/layout/reftests/transform/reftest.list b/layout/reftests/transform/reftest.list
index e773ba987e89..878bb52e73d3 100644
--- a/layout/reftests/transform/reftest.list
+++ b/layout/reftests/transform/reftest.list
@@ -59,10 +59,10 @@ random == rotate-1e.html rotate-1-ref.html
 == percent-1f.html percent-1-ref.html
 == percent-1g.html percent-1-ref.html
 # Transformed elements are abs-pos and fixed-pos containing blocks.
-random-if(winWidget) == abspos-1a.html abspos-1-ref.html # bug 593330
-random-if(winWidget) == abspos-1b.html abspos-1-ref.html # bug 593330
-random-if(winWidget) == abspos-1c.html abspos-1-ref.html # bug 593330
-random-if(winWidget) == abspos-1d.html abspos-1-ref.html # bug 593330
+== abspos-1a.html abspos-1-ref.html
+== abspos-1b.html abspos-1-ref.html
+== abspos-1c.html abspos-1-ref.html
+== abspos-1d.html abspos-1-ref.html
 != abspos-1e.html abspos-1-ref.html
 # Origin can use "top" "right" etc.
 == origin-name-1a.html origin-name-1-ref.html

From 6618fba54bfcc440b47dae72a5ff4fd7da7d685f Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Sat, 4 Sep 2010 00:27:19 +1200
Subject: [PATCH 102/222] Disable abspos tests when D2D is enabled. With
 changeset c888cdffd617, glyphs get rasterized slightly differently. a=me

---
 layout/reftests/transform/reftest.list | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/layout/reftests/transform/reftest.list b/layout/reftests/transform/reftest.list
index 878bb52e73d3..b8c690aace5c 100644
--- a/layout/reftests/transform/reftest.list
+++ b/layout/reftests/transform/reftest.list
@@ -59,10 +59,10 @@ random == rotate-1e.html rotate-1-ref.html
 == percent-1f.html percent-1-ref.html
 == percent-1g.html percent-1-ref.html
 # Transformed elements are abs-pos and fixed-pos containing blocks.
-== abspos-1a.html abspos-1-ref.html
-== abspos-1b.html abspos-1-ref.html
-== abspos-1c.html abspos-1-ref.html
-== abspos-1d.html abspos-1-ref.html
+fails-if(d2d) == abspos-1a.html abspos-1-ref.html
+fails-if(d2d) == abspos-1b.html abspos-1-ref.html
+fails-if(d2d) == abspos-1c.html abspos-1-ref.html
+fails-if(d2d) == abspos-1d.html abspos-1-ref.html
 != abspos-1e.html abspos-1-ref.html
 # Origin can use "top" "right" etc.
 == origin-name-1a.html origin-name-1-ref.html

From 842363cdb71a1f07c42c587573c0e726daf07a79 Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Fri, 3 Sep 2010 16:22:00 +0200
Subject: [PATCH 103/222] Bug 449734 - Preserve presentation when dragging a
 tab between browser windows.  r=roc a=blocking2.0:betaN

---
 browser/base/content/test/Makefile.in         |   1 +
 .../base/content/test/browser_tab_dragdrop.js | 114 ++++++++++++++++
 content/base/src/nsFrameLoader.cpp            |  12 +-
 layout/base/FrameLayerBuilder.h               |   8 ++
 layout/generic/nsObjectFrame.cpp              |  49 ++++++-
 layout/generic/nsObjectFrame.h                |  13 ++
 layout/generic/nsSubDocumentFrame.cpp         | 126 +++++++++++++++++-
 view/public/nsIView.h                         |   3 +
 widget/src/gtk2/nsWindow.cpp                  |   4 +-
 9 files changed, 316 insertions(+), 14 deletions(-)
 create mode 100644 browser/base/content/test/browser_tab_dragdrop.js

diff --git a/browser/base/content/test/Makefile.in b/browser/base/content/test/Makefile.in
index 4a809bab8bf3..beac66271425 100644
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -177,6 +177,7 @@ _BROWSER_FILES = \
                  browser_sanitizeDialog.js \
                  browser_scope.js \
                  browser_selectTabAtIndex.js \
+                 browser_tab_dragdrop.js \
                  browser_tabfocus.js \
                  browser_tabs_owner.js \
                  browser_visibleTabs.js \
diff --git a/browser/base/content/test/browser_tab_dragdrop.js b/browser/base/content/test/browser_tab_dragdrop.js
new file mode 100644
index 000000000000..a1376f035144
--- /dev/null
+++ b/browser/base/content/test/browser_tab_dragdrop.js
@@ -0,0 +1,114 @@
+function test()
+{
+  var embed = '<embed type="application/x-test" allowscriptaccess="always" allowfullscreen="true" wmode="window" width="640" height="480"></embed>'
+
+  waitForExplicitFinish();
+
+  // create a few tabs
+  var tabs = [
+    gBrowser.tabs[0],
+    gBrowser.addTab("about:blank", {skipAnimation: true}),
+    gBrowser.addTab("about:blank", {skipAnimation: true}),
+    gBrowser.addTab("about:blank", {skipAnimation: true}),
+    gBrowser.addTab("about:blank", {skipAnimation: true})
+  ];
+
+  function setLocation(i, url) {
+    gBrowser.getBrowserForTab(tabs[i]).contentWindow.location = url;
+  }
+  function moveTabTo(a, b) {
+    gBrowser.swapBrowsersAndCloseOther(gBrowser.tabs[b], gBrowser.tabs[a]);
+  }
+  function clickTest(doc, win) {
+    var clicks = doc.defaultView.clicks;
+    EventUtils.synthesizeMouse(doc.body, 100, 600, {}, win);
+    is(doc.defaultView.clicks, clicks+1, "adding 1 more click on BODY");
+  }
+  function test1() {
+    moveTabTo(2, 3); // now: 0 1 2 4
+    is(gBrowser.tabs[1], tabs[1], "tab1");
+    is(gBrowser.tabs[2], tabs[3], "tab3");
+
+    var plugin = gBrowser.getBrowserForTab(tabs[4]).docShell.contentViewer.DOMDocument.wrappedJSObject.body.firstChild;
+    var tab4_plugin_object = plugin.getObjectValue();
+
+    gBrowser.selectedTab = gBrowser.tabs[2];
+    moveTabTo(3, 2); // now: 0 1 4
+    gBrowser.selectedTab = tabs[4];
+    var doc = gBrowser.getBrowserForTab(gBrowser.tabs[2]).docShell.contentViewer.DOMDocument.wrappedJSObject;
+    plugin = doc.body.firstChild;
+    ok(plugin && plugin.checkObjectValue(tab4_plugin_object), "same plugin instance");
+    is(gBrowser.tabs[1], tabs[1], "tab1");
+    is(gBrowser.tabs[2], tabs[3], "tab4");
+    is(doc.defaultView.clicks, 0, "no click on BODY so far");
+    clickTest(doc, window);
+
+    moveTabTo(2, 1); // now: 0 4
+    is(gBrowser.tabs[1], tabs[1], "tab1");
+    doc = gBrowser.getBrowserForTab(gBrowser.tabs[1]).docShell.contentViewer.DOMDocument.wrappedJSObject;
+    plugin = doc.body.firstChild;
+    ok(plugin && plugin.checkObjectValue(tab4_plugin_object), "same plugin instance");
+    clickTest(doc, window);
+
+    // Load a new document (about:blank) in tab4, then detach that tab into a new window.
+    // In the new window, navigate back to the original document and click on its <body>,
+    // verify that its onclick was called.
+    var t = tabs[1];
+    var b = gBrowser.getBrowserForTab(t);
+    gBrowser.selectedTab = t;
+    b.addEventListener("load", function() {
+      b.removeEventListener("load", arguments.callee, true);
+
+      executeSoon(function () {
+        var win = gBrowser.replaceTabWithWindow(t);
+        win.addEventListener("load", function () {
+          win.removeEventListener("load", arguments.callee, true);
+
+          // Verify that the original window now only has the initial tab left in it.
+          is(gBrowser.tabs[0], tabs[0], "tab0");
+          is(gBrowser.getBrowserForTab(gBrowser.tabs[0]).contentWindow.location, "about:blank", "tab0 uri");
+
+          executeSoon(function () {
+            win.gBrowser.addEventListener("pageshow", function () {
+              win.gBrowser.removeEventListener("pageshow", arguments.callee, false);
+              executeSoon(function () {
+                t = win.gBrowser.tabs[0];
+                b = win.gBrowser.getBrowserForTab(t);
+                var doc = b.docShell.contentViewer.DOMDocument.wrappedJSObject;
+                clickTest(doc, win);
+                win.close();
+                finish();
+              });
+            }, false);
+            win.gBrowser.goBack();
+          });
+        }, true);
+      });
+    }, true);
+    b.loadURI("about:blank");
+
+  }
+
+  var loads = 0;
+  function waitForLoad(tab) {
+    gBrowser.getBrowserForTab(gBrowser.tabs[tab]).removeEventListener("load", arguments.callee, true);
+    ++loads;
+    if (loads == tabs.length - 1) {
+      executeSoon(test1);
+    }
+  }
+
+  function fn(f, arg) {
+    return function () { return f(arg); };
+  }
+  for (var i = 1; i < tabs.length; ++i) {
+    gBrowser.getBrowserForTab(tabs[i]).addEventListener("load", fn(waitForLoad,i), true);
+  }
+
+  setLocation(1, "data:text/html,<title>tab1</title><body>tab1<iframe>");
+  setLocation(2, "data:text/plain,tab2");
+  setLocation(3, "data:text/html,<title>tab3</title><body>tab3<iframe>");
+  setLocation(4, "data:text/html,<body onload='clicks=0' onclick='++clicks'>"+embed);
+  gBrowser.selectedTab = tabs[3];
+
+}
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 43ba4b5e9b11..f98df24e1a0e 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -1086,15 +1086,15 @@ nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
     otherInternalHistory->EvictAllContentViewers();
   }
 
-  // We shouldn't have changed frames, but be really careful about it
-  if (ourFrame == ourContent->GetPrimaryFrame() &&
-      otherFrame == otherContent->GetPrimaryFrame()) {
-    ourFrameFrame->EndSwapDocShells(otherFrame);
-  }
+  NS_ASSERTION(ourFrame == ourContent->GetPrimaryFrame() &&
+               otherFrame == otherContent->GetPrimaryFrame(),
+               "changed primary frame");
+
+  ourFrameFrame->EndSwapDocShells(otherFrame);
 
   ourParentDocument->FlushPendingNotifications(Flush_Layout);
   otherParentDocument->FlushPendingNotifications(Flush_Layout);
-  
+
   FirePageShowEvent(ourTreeItem, otherChromeEventHandler, PR_TRUE);
   FirePageShowEvent(otherTreeItem, ourChromeEventHandler, PR_TRUE);
 
diff --git a/layout/base/FrameLayerBuilder.h b/layout/base/FrameLayerBuilder.h
index 4cce9ebbcb70..7925f3f3449f 100644
--- a/layout/base/FrameLayerBuilder.h
+++ b/layout/base/FrameLayerBuilder.h
@@ -263,6 +263,14 @@ public:
   nscolor FindOpaqueColorCovering(nsDisplayListBuilder* aBuilder,
                                   ThebesLayer* aLayer, const nsRect& aRect);
 
+  /**
+   * Destroy any stored DisplayItemDataProperty for aFrame.
+   */
+  static void DestroyDisplayItemDataFor(nsIFrame* aFrame)
+  {
+    aFrame->Properties().Delete(DisplayItemDataProperty());
+  }
+
 protected:
   /**
    * We store an array of these for each frame that is associated with
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index d5f73371194a..755d875128f6 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -28,7 +28,7 @@
  *   Robert O'Callahan <roc+moz@cs.cmu.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Josh Aas <josh@mozilla.com>
- *   Mats Palmgren <mats.palmgren@bredband.net>
+ *   Mats Palmgren <matspal@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -2423,6 +2423,53 @@ nsObjectFrame::GetNextObjectFrame(nsPresContext* aPresContext, nsIFrame* aRoot)
   return nsnull;
 }
 
+/*static*/ void
+nsObjectFrame::BeginSwapDocShells(nsIContent* aContent, void*)
+{
+  NS_PRECONDITION(aContent, "");
+
+  // This function is called from a document content enumerator so we need
+  // to filter out the nsObjectFrames and ignore the rest.
+  nsIObjectFrame* obj = do_QueryFrame(aContent->GetPrimaryFrame());
+  if (!obj)
+    return;
+
+  nsObjectFrame* objectFrame = static_cast<nsObjectFrame*>(obj);
+  NS_ASSERTION(!objectFrame->mWidget || objectFrame->mWidget->GetParent(),
+               "Plugin windows must not be toplevel");
+  nsRootPresContext* rootPC = objectFrame->PresContext()->GetRootPresContext();
+  NS_ASSERTION(rootPC, "unable to unregister the plugin frame");
+  rootPC->UnregisterPluginForGeometryUpdates(objectFrame);
+}
+
+/*static*/ void
+nsObjectFrame::EndSwapDocShells(nsIContent* aContent, void*)
+{
+  NS_PRECONDITION(aContent, "");
+
+  // This function is called from a document content enumerator so we need
+  // to filter out the nsObjectFrames and ignore the rest.
+  nsIObjectFrame* obj = do_QueryFrame(aContent->GetPrimaryFrame());
+  if (!obj)
+    return;
+
+  nsObjectFrame* objectFrame = static_cast<nsObjectFrame*>(obj);
+  nsRootPresContext* rootPC = objectFrame->PresContext()->GetRootPresContext();
+  NS_ASSERTION(rootPC, "unable to register the plugin frame");
+  nsIWidget* widget = objectFrame->GetWidget();
+  if (widget) {
+    // Reparent the widget.
+    nsIWidget* parent =
+      rootPC->PresShell()->GetRootFrame()->GetNearestWidget();
+    widget->SetParent(parent);
+    objectFrame->CallSetWindow();
+
+    // Register for geometry updates and make a request.
+    rootPC->RegisterPluginForGeometryUpdates(objectFrame);
+    rootPC->RequestUpdatePluginGeometry(objectFrame);
+  }
+}
+
 nsIFrame*
 NS_NewObjectFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
diff --git a/layout/generic/nsObjectFrame.h b/layout/generic/nsObjectFrame.h
index 9f52e97dd7ea..935c4656ec3f 100644
--- a/layout/generic/nsObjectFrame.h
+++ b/layout/generic/nsObjectFrame.h
@@ -162,6 +162,19 @@ public:
   static nsIObjectFrame* GetNextObjectFrame(nsPresContext* aPresContext,
                                             nsIFrame* aRoot);
 
+  /**
+   * If aContent has a nsObjectFrame, then prepare it for a DocShell swap.
+   * @see nsSubDocumentFrame::BeginSwapDocShells.
+   * There will be a call to EndSwapDocShells after we were moved to the
+   * new view tree.
+   */
+  static void BeginSwapDocShells(nsIContent* aContent, void*);
+  /**
+   * If aContent has a nsObjectFrame, then set it up after a DocShell swap.
+   * @see nsSubDocumentFrame::EndSwapDocShells.
+   */
+  static void EndSwapDocShells(nsIContent* aContent, void*);
+
 protected:
   nsObjectFrame(nsStyleContext* aContext);
   virtual ~nsObjectFrame();
diff --git a/layout/generic/nsSubDocumentFrame.cpp b/layout/generic/nsSubDocumentFrame.cpp
index 657307c779aa..0e5e4dad1b49 100644
--- a/layout/generic/nsSubDocumentFrame.cpp
+++ b/layout/generic/nsSubDocumentFrame.cpp
@@ -22,6 +22,7 @@
  * Contributor(s):
  *   Travis Bogard <travis@netscape.com>
  *   HÂkan Waara <hwaara@chello.se>
+ *   Mats Palmgren <matspal@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -87,6 +88,8 @@
 #include "nsIScrollableFrame.h"
 #include "nsIObjectLoadingContent.h"
 #include "nsLayoutUtils.h"
+#include "FrameLayerBuilder.h"
+#include "nsObjectFrame.h"
 
 #ifdef MOZ_XUL
 #include "nsXULPopupManager.h"
@@ -98,6 +101,18 @@
 #endif
 #include "nsIServiceManager.h"
 
+using namespace mozilla;
+
+static nsIDocument*
+GetDocumentFromView(nsIView* aView)
+{
+  NS_PRECONDITION(aView, "");
+
+  nsIFrame* f = static_cast<nsIFrame*>(aView->GetClientData());
+  nsIPresShell* ps =  f ? f->PresContext()->PresShell() : nsnull;
+  return ps ? ps->GetDocument() : nsnull;
+}
+
 class AsyncFrameInit;
 
 nsSubDocumentFrame::nsSubDocumentFrame(nsStyleContext* aContext)
@@ -166,7 +181,6 @@ nsSubDocumentFrame::Init(nsIContent*     aContent,
     rv = nsHTMLContainerFrame::CreateViewForFrame(this, PR_TRUE);
     NS_ENSURE_SUCCESS(rv, rv);
   }
-  nsIView* view = GetView();
 
   // Set the primary frame now so that
   // DocumentViewerImpl::FindContainerView called by ShowViewer below
@@ -786,6 +800,75 @@ nsSubDocumentFrame::GetDocShell(nsIDocShell **aDocShell)
   return mFrameLoader->GetDocShell(aDocShell);
 }
 
+static void
+DestroyDisplayItemDataForFrames(nsIFrame* aFrame)
+{
+  FrameLayerBuilder::DestroyDisplayItemDataFor(aFrame);
+
+  PRInt32 listIndex = 0;
+  nsIAtom* childList = nsnull;
+  do {
+    nsIFrame* child = aFrame->GetFirstChild(childList);
+    while (child) {
+      DestroyDisplayItemDataForFrames(child);
+      child = child->GetNextSibling();
+    }
+    childList = aFrame->GetAdditionalChildListName(listIndex++);
+  } while (childList);
+}
+
+static PRBool
+BeginSwapDocShellsForDocument(nsIDocument* aDocument, void*)
+{
+  NS_PRECONDITION(aDocument, "");
+
+  nsIPresShell* shell = aDocument->GetShell();
+  nsIFrame* rootFrame = shell ? shell->GetRootFrame() : nsnull;
+  if (rootFrame) {
+    ::DestroyDisplayItemDataForFrames(rootFrame);
+  }
+  aDocument->EnumerateFreezableElements(
+    nsObjectFrame::BeginSwapDocShells, nsnull);
+  aDocument->EnumerateSubDocuments(BeginSwapDocShellsForDocument, nsnull);
+  return PR_TRUE;
+}
+
+static nsIView*
+BeginSwapDocShellsForViews(nsIView* aSibling)
+{
+  // Collect the removed sibling views in reverse order in 'removedViews'.
+  nsIView* removedViews = nsnull;
+  while (aSibling) {
+    nsIDocument* doc = ::GetDocumentFromView(aSibling);
+    if (doc) {
+      ::BeginSwapDocShellsForDocument(doc, nsnull);
+    }
+    nsIView* next = aSibling->GetNextSibling();
+    aSibling->GetViewManager()->RemoveChild(aSibling);
+    aSibling->SetNextSibling(removedViews);
+    removedViews = aSibling;
+    aSibling = next;
+  }
+  return removedViews;
+}
+
+static void
+InsertViewsInReverseOrder(nsIView* aSibling, nsIView* aParent)
+{
+  NS_PRECONDITION(aParent, "");
+  NS_PRECONDITION(!aParent->GetFirstChild(), "inserting into non-empty list");
+
+  nsIViewManager* vm = aParent->GetViewManager();
+  while (aSibling) {
+    nsIView* next = aSibling->GetNextSibling();
+    aSibling->SetNextSibling(nsnull);
+    // PR_TRUE means 'after' in document order which is 'before' in view order,
+    // so this call prepends the child, thus reversing the siblings as we go.
+    vm->InsertChild(aParent, aSibling, nsnull, PR_TRUE);
+    aSibling = next;
+  }
+}
+
 nsresult
 nsSubDocumentFrame::BeginSwapDocShells(nsIFrame* aOther)
 {
@@ -799,21 +882,54 @@ nsSubDocumentFrame::BeginSwapDocShells(nsIFrame* aOther)
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
-  HideViewer();
-  other->HideViewer();
+  if (mInnerView && other->mInnerView) {
+    nsIView* ourSubdocViews = mInnerView->GetFirstChild();
+    nsIView* ourRemovedViews = ::BeginSwapDocShellsForViews(ourSubdocViews);
+    nsIView* otherSubdocViews = other->mInnerView->GetFirstChild();
+    nsIView* otherRemovedViews = ::BeginSwapDocShellsForViews(otherSubdocViews);
 
+    ::InsertViewsInReverseOrder(ourRemovedViews, other->mInnerView);
+    ::InsertViewsInReverseOrder(otherRemovedViews, mInnerView);
+  }
   mFrameLoader.swap(other->mFrameLoader);
   return NS_OK;
 }
 
+static PRBool
+EndSwapDocShellsForDocument(nsIDocument* aDocument, void*)
+{
+  NS_PRECONDITION(aDocument, "");
+
+  aDocument->EnumerateFreezableElements(
+    nsObjectFrame::EndSwapDocShells, nsnull);
+  aDocument->EnumerateSubDocuments(EndSwapDocShellsForDocument, nsnull);
+  return PR_TRUE;
+}
+
+static void
+EndSwapDocShellsForViews(nsIView* aSibling)
+{
+  for ( ; aSibling; aSibling = aSibling->GetNextSibling()) {
+    nsIDocument* doc = ::GetDocumentFromView(aSibling);
+    if (doc) {
+      ::EndSwapDocShellsForDocument(doc, nsnull);
+    }
+  }
+}
+
 void
 nsSubDocumentFrame::EndSwapDocShells(nsIFrame* aOther)
 {
   nsSubDocumentFrame* other = static_cast<nsSubDocumentFrame*>(aOther);
   nsWeakFrame weakThis(this);
   nsWeakFrame weakOther(aOther);
-  ShowViewer();
-  other->ShowViewer();
+
+  if (mInnerView) {
+    ::EndSwapDocShellsForViews(mInnerView->GetFirstChild());
+  }
+  if (other->mInnerView) {
+    ::EndSwapDocShellsForViews(other->mInnerView->GetFirstChild());
+  }
 
   // Now make sure we reflow both frames, in case their contents
   // determine their size.
diff --git a/view/public/nsIView.h b/view/public/nsIView.h
index 8d5245d89f67..ff556ea086e4 100644
--- a/view/public/nsIView.h
+++ b/view/public/nsIView.h
@@ -248,6 +248,9 @@ public:
    * @result view's next sibling
    */
   nsIView* GetNextSibling() const { return reinterpret_cast<nsIView*>(mNextSibling); }
+  void SetNextSibling(nsIView *aSibling) {
+    mNextSibling = reinterpret_cast<nsView*>(aSibling);
+  }
 
   /**
    * Set the view's link to client owned data.
diff --git a/widget/src/gtk2/nsWindow.cpp b/widget/src/gtk2/nsWindow.cpp
index 9ce6d5f7c8e9..d49d842f694c 100644
--- a/widget/src/gtk2/nsWindow.cpp
+++ b/widget/src/gtk2/nsWindow.cpp
@@ -21,7 +21,7 @@
  * are Copyright (C) 2001 the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
- *   Mats Palmgren <mats.palmgren@bredband.net>
+ *   Mats Palmgren <matspal@gmail.com>
  *   Masayuki Nakano <masayuki@d-toybox.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
@@ -890,7 +890,7 @@ nsWindow::SetParent(nsIWidget *aNewParent)
             SetWidgetForHierarchy(mGdkWindow, oldContainer, newContainer);
         }
 
-        gdk_window_reparent(mGdkWindow, newParentWindow, 0, 0);
+        gdk_window_reparent(mGdkWindow, newParentWindow, mBounds.x, mBounds.y);
     }
 
     PRBool parentHasMappedToplevel =

From 819fb6c21de357afdd5fc5e11656f00f806d7d6e Mon Sep 17 00:00:00 2001
From: Ben Turner <bent.mozilla@gmail.com>
Date: Fri, 3 Sep 2010 07:41:55 -0700
Subject: [PATCH 104/222] Bug 593045 - 'Add SQLite file size quota management
 to mozStorage'. r=ted+asuth, a=blocking2.0+.

---
 db/sqlite3/README.MOZILLA                     |   9 +
 db/sqlite3/src/test_quota.c                   | 938 ++++++++++++++++++
 storage/public/Makefile.in                    |   1 +
 .../mozIStorageServiceQuotaManagement.idl     | 113 +++
 storage/public/storage.h                      |   1 +
 storage/src/Makefile.in                       |   4 +-
 storage/src/mozStorageConnection.cpp          |   7 +-
 storage/src/mozStorageConnection.h            |   3 +-
 storage/src/mozStorageService.cpp             | 125 ++-
 storage/src/mozStorageService.h               |   3 +
 10 files changed, 1196 insertions(+), 8 deletions(-)
 create mode 100644 db/sqlite3/src/test_quota.c
 create mode 100644 storage/public/mozIStorageServiceQuotaManagement.idl

diff --git a/db/sqlite3/README.MOZILLA b/db/sqlite3/README.MOZILLA
index 9081030603b1..633df7d92911 100644
--- a/db/sqlite3/README.MOZILLA
+++ b/db/sqlite3/README.MOZILLA
@@ -11,6 +11,15 @@ To move to a new version:
 
 Simply copy the sqlite3.h and sqlite3.c files from the amalgamation of sqlite.
 
+Also copy test_quota.c from the full source package.
+
 Be sure to update SQLITE_VERSION accordingly in $(topsrcdir)/configure.in.
 
 -- Shawn Wilsher <me@shawnwilsher.com> 01/2008
+
+We are using an experimental quota management feature included in test_quota.c.
+This file is not compiled into mozsqlite, but instead included directly into
+mozStorageService.cpp for linking into mozstorage. This allows us to continue
+supporting system sqlite installations.
+
+-- Ben Turner <bent.mozilla@gmail.com>, 09/2010
diff --git a/db/sqlite3/src/test_quota.c b/db/sqlite3/src/test_quota.c
new file mode 100644
index 000000000000..f06b0446a342
--- /dev/null
+++ b/db/sqlite3/src/test_quota.c
@@ -0,0 +1,938 @@
+/*
+** 2010 September 31
+**
+** The author disclaims copyright to this source code.  In place of
+** a legal notice, here is a blessing:
+**
+**    May you do good and not evil.
+**    May you find forgiveness for yourself and forgive others.
+**    May you share freely, never taking more than you give.
+**
+*************************************************************************
+**
+** This file contains a VFS "shim" - a layer that sits in between the
+** pager and the real VFS.
+**
+** This particular shim enforces a quota system on files.  One or more
+** database files are in a "quota group" that is defined by a GLOB
+** pattern.  A quota is set for the combined size of all files in the
+** the group.  A quota of zero means "no limit".  If the total size
+** of all files in the quota group is greater than the limit, then
+** write requests that attempt to enlarge a file fail with SQLITE_FULL.
+**
+** However, before returning SQLITE_FULL, the write requests invoke
+** a callback function that is configurable for each quota group.
+** This callback has the opportunity to enlarge the quota.  If the
+** callback does enlarge the quota such that the total size of all
+** files within the group is less than the new quota, then the write
+** continues as if nothing had happened.
+*/
+#include "sqlite3.h"
+#include <string.h>
+#include <assert.h>
+
+/************************ Object Definitions ******************************/
+
+/* Forward declaration of all object types */
+typedef struct quotaGroup quotaGroup;
+typedef struct quotaConn quotaConn;
+typedef struct quotaFile quotaFile;
+
+/*
+** A "quota group" is a collection of files whose collective size we want
+** to limit.  Each quota group is defined by a GLOB pattern.
+**
+** There is an instance of the following object for each defined quota
+** group.  This object records the GLOB pattern that defines which files
+** belong to the quota group.  The object also remembers the size limit
+** for the group (the quota) and the callback to be invoked when the
+** sum of the sizes of the files within the group goes over the limit.
+**
+** A quota group must be established (using sqlite3_quota_set(...))
+** prior to opening any of the database connections that access files
+** within the quota group.
+*/
+struct quotaGroup {
+  const char *zPattern;          /* Filename pattern to be quotaed */
+  sqlite3_int64 iLimit;          /* Upper bound on total file size */
+  sqlite3_int64 iSize;           /* Current size of all files */
+  void (*xCallback)(             /* Callback invoked when going over quota */
+     const char *zFilename,         /* Name of file whose size increases */
+     sqlite3_int64 *piLimit,        /* IN/OUT: The current limit */
+     sqlite3_int64 iSize,           /* Total size of all files in the group */
+     void *pArg                     /* Client data */
+  );
+  void *pArg;                    /* Third argument to the xCallback() */
+  void (*xDestroy)(void*);       /* Optional destructor for pArg */
+  quotaGroup *pNext, **ppPrev;   /* Doubly linked list of all quota objects */
+  quotaFile *pFiles;             /* Files within this group */
+};
+
+/*
+** An instance of this structure represents a single file that is part
+** of a quota group.  A single file can be opened multiple times.  In
+** order keep multiple openings of the same file from causing the size
+** of the file to count against the quota multiple times, each file
+** has a unique instance of this object and multiple open connections
+** to the same file each point to a single instance of this object.
+*/
+struct quotaFile {
+  char *zFilename;                /* Name of this file */
+  quotaGroup *pGroup;             /* Quota group to which this file belongs */
+  sqlite3_int64 iSize;            /* Current size of this file */
+  int nRef;                       /* Number of times this file is open */
+  quotaFile *pNext, **ppPrev;     /* Linked list of files in the same group */
+};
+
+/*
+** An instance of the following object represents each open connection
+** to a file that participates in quota tracking.  This object is a 
+** subclass of sqlite3_file.  The sqlite3_file object for the underlying
+** VFS is appended to this structure.
+*/
+struct quotaConn {
+  sqlite3_file base;              /* Base class - must be first */
+  quotaFile *pFile;               /* The underlying file */
+  /* The underlying VFS sqlite3_file is appended to this object */
+};
+
+/************************* Global Variables **********************************/
+/*
+** All global variables used by this file are containing within the following
+** gQuota structure.
+*/
+static struct {
+  /* The pOrigVfs is the real, original underlying VFS implementation.
+  ** Most operations pass-through to the real VFS.  This value is read-only
+  ** during operation.  It is only modified at start-time and thus does not
+  ** require a mutex.
+  */
+  sqlite3_vfs *pOrigVfs;
+
+  /* The sThisVfs is the VFS structure used by this shim.  It is initialized
+  ** at start-time and thus does not require a mutex
+  */
+  sqlite3_vfs sThisVfs;
+
+  /* The sIoMethods defines the methods used by sqlite3_file objects 
+  ** associated with this shim.  It is initialized at start-time and does
+  ** not require a mutex.
+  **
+  ** When the underlying VFS is called to open a file, it might return 
+  ** either a version 1 or a version 2 sqlite3_file object.  This shim
+  ** has to create a wrapper sqlite3_file of the same version.  Hence
+  ** there are two I/O method structures, one for version 1 and the other
+  ** for version 2.
+  */
+  sqlite3_io_methods sIoMethodsV1;
+  sqlite3_io_methods sIoMethodsV2;
+
+  /* True when this shim as been initialized.
+  */
+  int isInitialized;
+
+  /* For run-time access any of the other global data structures in this
+  ** shim, the following mutex must be held.
+  */
+  sqlite3_mutex *pMutex;
+
+  /* List of quotaGroup objects.
+  */
+  quotaGroup *pGroup;
+
+} gQuota;
+
+/************************* Utility Routines *********************************/
+/*
+** Acquire and release the mutex used to serialize access to the
+** list of quotaGroups.
+*/
+static void quotaEnter(void){ sqlite3_mutex_enter(gQuota.pMutex); }
+static void quotaLeave(void){ sqlite3_mutex_leave(gQuota.pMutex); }
+
+
+/* If the reference count and threshold for a quotaGroup are both
+** zero, then destroy the quotaGroup.
+*/
+static void quotaGroupDeref(quotaGroup *pGroup){
+  if( pGroup->pFiles==0 && pGroup->iLimit==0 ){
+    *pGroup->ppPrev = pGroup->pNext;
+    if( pGroup->pNext ) pGroup->pNext->ppPrev = pGroup->ppPrev;
+    if( pGroup->xDestroy ) pGroup->xDestroy(pGroup->pArg);
+    sqlite3_free(pGroup);
+  }
+}
+
+/*
+** Return TRUE if string z matches glob pattern zGlob.
+**
+** Globbing rules:
+**
+**      '*'       Matches any sequence of zero or more characters.
+**
+**      '?'       Matches exactly one character.
+**
+**     [...]      Matches one character from the enclosed list of
+**                characters.
+**
+**     [^...]     Matches one character not in the enclosed list.
+**
+*/
+static int quotaStrglob(const char *zGlob, const char *z){
+  int c, c2;
+  int invert;
+  int seen;
+
+  while( (c = (*(zGlob++)))!=0 ){
+    if( c=='*' ){
+      while( (c=(*(zGlob++))) == '*' || c=='?' ){
+        if( c=='?' && (*(z++))==0 ) return 0;
+      }
+      if( c==0 ){
+        return 1;
+      }else if( c=='[' ){
+        while( *z && quotaStrglob(zGlob-1,z)==0 ){
+          z++;
+        }
+        return (*z)!=0;
+      }
+      while( (c2 = (*(z++)))!=0 ){
+        while( c2!=c ){
+          c2 = *(z++);
+          if( c2==0 ) return 0;
+        }
+        if( quotaStrglob(zGlob,z) ) return 1;
+      }
+      return 0;
+    }else if( c=='?' ){
+      if( (*(z++))==0 ) return 0;
+    }else if( c=='[' ){
+      int prior_c = 0;
+      seen = 0;
+      invert = 0;
+      c = *(z++);
+      if( c==0 ) return 0;
+      c2 = *(zGlob++);
+      if( c2=='^' ){
+        invert = 1;
+        c2 = *(zGlob++);
+      }
+      if( c2==']' ){
+        if( c==']' ) seen = 1;
+        c2 = *(zGlob++);
+      }
+      while( c2 && c2!=']' ){
+        if( c2=='-' && zGlob[0]!=']' && zGlob[0]!=0 && prior_c>0 ){
+          c2 = *(zGlob++);
+          if( c>=prior_c && c<=c2 ) seen = 1;
+          prior_c = 0;
+        }else{
+          if( c==c2 ){
+            seen = 1;
+          }
+          prior_c = c2;
+        }
+        c2 = *(zGlob++);
+      }
+      if( c2==0 || (seen ^ invert)==0 ) return 0;
+    }else{
+      if( c!=(*(z++)) ) return 0;
+    }
+  }
+  return *z==0;
+}
+
+
+/* Find a quotaGroup given the filename.
+**
+** Return a pointer to the quotaGroup object. Return NULL if not found.
+*/
+static quotaGroup *quotaGroupFind(const char *zFilename){
+  quotaGroup *p;
+  for(p=gQuota.pGroup; p && quotaStrglob(p->zPattern, zFilename)==0;
+      p=p->pNext){}
+  return p;
+}
+
+/* Translate an sqlite3_file* that is really a quotaConn* into
+** the sqlite3_file* for the underlying original VFS.
+*/
+static sqlite3_file *quotaSubOpen(sqlite3_file *pConn){
+  quotaConn *p = (quotaConn*)pConn;
+  return (sqlite3_file*)&p[1];
+}
+
+/************************* VFS Method Wrappers *****************************/
+/*
+** This is the xOpen method used for the "quota" VFS.
+**
+** Most of the work is done by the underlying original VFS.  This method
+** simply links the new file into the appropriate quota group if it is a
+** file that needs to be tracked.
+*/
+static int quotaOpen(
+  sqlite3_vfs *pVfs,          /* The quota VFS */
+  const char *zName,          /* Name of file to be opened */
+  sqlite3_file *pConn,        /* Fill in this file descriptor */
+  int flags,                  /* Flags to control the opening */
+  int *pOutFlags              /* Flags showing results of opening */
+){
+  int rc;                                    /* Result code */         
+  quotaConn *pQuotaOpen;                     /* The new quota file descriptor */
+  quotaFile *pFile;                          /* Corresponding quotaFile obj */
+  quotaGroup *pGroup;                        /* The group file belongs to */
+  sqlite3_file *pSubOpen;                    /* Real file descriptor */
+  sqlite3_vfs *pOrigVfs = gQuota.pOrigVfs;   /* Real VFS */
+
+  /* If the file is not a main database file or a WAL, then use the
+  ** normal xOpen method.
+  */
+  if( (flags & (SQLITE_OPEN_MAIN_DB|SQLITE_OPEN_WAL))==0 ){
+    return pOrigVfs->xOpen(pOrigVfs, zName, pConn, flags, pOutFlags);
+  }
+
+  /* If the name of the file does not match any quota group, then
+  ** use the normal xOpen method.
+  */
+  quotaEnter();
+  pGroup = quotaGroupFind(zName);
+  if( pGroup==0 ){
+    rc = pOrigVfs->xOpen(pOrigVfs, zName, pConn, flags, pOutFlags);
+  }else{
+    /* If we get to this point, it means the file needs to be quota tracked.
+    */
+    pQuotaOpen = (quotaConn*)pConn;
+    pSubOpen = quotaSubOpen(pConn);
+    rc = pOrigVfs->xOpen(pOrigVfs, zName, pSubOpen, flags, pOutFlags);
+    if( rc==SQLITE_OK ){
+      for(pFile=pGroup->pFiles; pFile && strcmp(pFile->zFilename, zName);
+          pFile=pFile->pNext){}
+      if( pFile==0 ){
+        int nName = strlen(zName);
+        pFile = (quotaFile *)sqlite3_malloc( sizeof(*pFile) + nName + 1 );
+        if( pFile==0 ){
+          quotaLeave();
+          pSubOpen->pMethods->xClose(pSubOpen);
+          return SQLITE_NOMEM;
+        }
+        memset(pFile, 0, sizeof(*pFile));
+        pFile->zFilename = (char*)&pFile[1];
+        memcpy(pFile->zFilename, zName, nName+1);
+        pFile->pNext = pGroup->pFiles;
+        if( pGroup->pFiles ) pGroup->pFiles->ppPrev = &pFile->pNext;
+        pFile->ppPrev = &pGroup->pFiles;
+        pGroup->pFiles = pFile;
+        pFile->pGroup = pGroup;
+      }
+      pFile->nRef++;
+      pQuotaOpen->pFile = pFile;
+      if( pSubOpen->pMethods->iVersion==1 ){
+        pQuotaOpen->base.pMethods = &gQuota.sIoMethodsV1;
+      }else{
+        pQuotaOpen->base.pMethods = &gQuota.sIoMethodsV2;
+      }
+    }
+  }
+  quotaLeave();
+  return rc;
+}
+
+/************************ I/O Method Wrappers *******************************/
+
+/* xClose requests get passed through to the original VFS.  But we
+** also have to unlink the quotaConn from the quotaFile and quotaGroup.
+** The quotaFile and/or quotaGroup are freed if they are no longer in use.
+*/
+static int quotaClose(sqlite3_file *pConn){
+  quotaConn *p = (quotaConn*)pConn;
+  quotaFile *pFile = p->pFile;
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  int rc;
+  rc = pSubOpen->pMethods->xClose(pSubOpen);
+  quotaEnter();
+  pFile->nRef--;
+  if( pFile->nRef==0 ){
+    quotaGroup *pGroup = pFile->pGroup;
+    pGroup->iSize -= pFile->iSize;
+    if( pFile->pNext ) pFile->pNext->ppPrev = pFile->ppPrev;
+    *pFile->ppPrev = pFile->pNext;
+    quotaGroupDeref(pGroup);
+    sqlite3_free(pFile);
+  }
+  quotaLeave();
+  return rc;
+}
+
+/* Pass xRead requests directory thru to the original VFS without
+** further processing.
+*/
+static int quotaRead(
+  sqlite3_file *pConn,
+  void *pBuf,
+  int iAmt,
+  sqlite3_int64 iOfst
+){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xRead(pSubOpen, pBuf, iAmt, iOfst);
+}
+
+/* Check xWrite requests to see if they expand the file.  If they do,
+** the perform a quota check before passing them through to the
+** original VFS.
+*/
+static int quotaWrite(
+  sqlite3_file *pConn,
+  const void *pBuf,
+  int iAmt,
+  sqlite3_int64 iOfst
+){
+  quotaConn *p = (quotaConn*)pConn;
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  sqlite3_int64 iEnd = iOfst+iAmt;
+  quotaGroup *pGroup;
+  quotaFile *pFile = p->pFile;
+  sqlite3_int64 szNew;
+
+  if( pFile->iSize<iEnd ){
+    pGroup = pFile->pGroup;
+    quotaEnter();
+    szNew = pGroup->iSize - pFile->iSize + iEnd;
+    if( szNew>pGroup->iLimit && pGroup->iLimit>0 ){
+      if( pGroup->xCallback ){
+        pGroup->xCallback(pFile->zFilename, &pGroup->iLimit, szNew, 
+                          pGroup->pArg);
+      }
+      if( szNew>pGroup->iLimit && pGroup->iLimit>0 ){
+        quotaLeave();
+        return SQLITE_FULL;
+      }
+    }
+    pGroup->iSize = szNew;
+    pFile->iSize = iEnd;
+    quotaLeave();
+  }
+  return pSubOpen->pMethods->xWrite(pSubOpen, pBuf, iAmt, iOfst);
+}
+
+/* Pass xTruncate requests thru to the original VFS.  If the
+** success, update the file size.
+*/
+static int quotaTruncate(sqlite3_file *pConn, sqlite3_int64 size){
+  quotaConn *p = (quotaConn*)pConn;
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  int rc = pSubOpen->pMethods->xTruncate(pSubOpen, size);
+  quotaFile *pFile = p->pFile;
+  quotaGroup *pGroup;
+  if( rc==SQLITE_OK ){
+    quotaEnter();
+    pGroup = pFile->pGroup;
+    pGroup->iSize -= pFile->iSize;
+    pFile->iSize = size;
+    pGroup->iSize += size;
+    quotaLeave();
+  }
+  return rc;
+}
+
+/* Pass xSync requests through to the original VFS without change
+*/
+static int quotaSync(sqlite3_file *pConn, int flags){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xSync(pSubOpen, flags);
+}
+
+/* Pass xFileSize requests through to the original VFS but then
+** update the quotaGroup with the new size before returning.
+*/
+static int quotaFileSize(sqlite3_file *pConn, sqlite3_int64 *pSize){
+  quotaConn *p = (quotaConn*)pConn;
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  quotaFile *pFile = p->pFile;
+  quotaGroup *pGroup;
+  sqlite3_int64 sz;
+  int rc;
+
+  rc = pSubOpen->pMethods->xFileSize(pSubOpen, &sz);
+  if( rc==SQLITE_OK ){
+    quotaEnter();
+    pGroup = pFile->pGroup;
+    pGroup->iSize -= pFile->iSize;
+    pFile->iSize = sz;
+    pGroup->iSize += sz;
+    quotaLeave();
+    *pSize = sz;
+  }
+  return rc;
+}
+
+/* Pass xLock requests through to the original VFS unchanged.
+*/
+static int quotaLock(sqlite3_file *pConn, int lock){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xLock(pSubOpen, lock);
+}
+
+/* Pass xUnlock requests through to the original VFS unchanged.
+*/
+static int quotaUnlock(sqlite3_file *pConn, int lock){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xUnlock(pSubOpen, lock);
+}
+
+/* Pass xCheckReservedLock requests through to the original VFS unchanged.
+*/
+static int quotaCheckReservedLock(sqlite3_file *pConn, int *pResOut){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xCheckReservedLock(pSubOpen, pResOut);
+}
+
+/* Pass xFileControl requests through to the original VFS unchanged.
+*/
+static int quotaFileControl(sqlite3_file *pConn, int op, void *pArg){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xFileControl(pSubOpen, op, pArg);
+}
+
+/* Pass xSectorSize requests through to the original VFS unchanged.
+*/
+static int quotaSectorSize(sqlite3_file *pConn){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xSectorSize(pSubOpen);
+}
+
+/* Pass xDeviceCharacteristics requests through to the original VFS unchanged.
+*/
+static int quotaDeviceCharacteristics(sqlite3_file *pConn){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xDeviceCharacteristics(pSubOpen);
+}
+
+/* Pass xShmMap requests through to the original VFS unchanged.
+*/
+static int quotaShmMap(
+  sqlite3_file *pConn,            /* Handle open on database file */
+  int iRegion,                    /* Region to retrieve */
+  int szRegion,                   /* Size of regions */
+  int bExtend,                    /* True to extend file if necessary */
+  void volatile **pp              /* OUT: Mapped memory */
+){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xShmMap(pSubOpen, iRegion, szRegion, bExtend, pp);
+}
+
+/* Pass xShmLock requests through to the original VFS unchanged.
+*/
+static int quotaShmLock(
+  sqlite3_file *pConn,       /* Database file holding the shared memory */
+  int ofst,                  /* First lock to acquire or release */
+  int n,                     /* Number of locks to acquire or release */
+  int flags                  /* What to do with the lock */
+){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xShmLock(pSubOpen, ofst, n, flags);
+}
+
+/* Pass xShmBarrier requests through to the original VFS unchanged.
+*/
+static void quotaShmBarrier(sqlite3_file *pConn){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  pSubOpen->pMethods->xShmBarrier(pSubOpen);
+}
+
+/* Pass xShmUnmap requests through to the original VFS unchanged.
+*/
+static int quotaShmUnmap(sqlite3_file *pConn, int deleteFlag){
+  sqlite3_file *pSubOpen = quotaSubOpen(pConn);
+  return pSubOpen->pMethods->xShmUnmap(pSubOpen, deleteFlag);
+}
+
+/************************** Public Interfaces *****************************/
+/*
+** Initialize the quota VFS shim.  Use the VFS named zOrigVfsName
+** as the VFS that does the actual work.  Use the default if
+** zOrigVfsName==NULL.  
+**
+** The quota VFS shim is named "quota".  It will become the default
+** VFS if makeDefault is non-zero.
+**
+** THIS ROUTINE IS NOT THREADSAFE.  Call this routine exactly once
+** during start-up.
+*/
+int sqlite3_quota_initialize(const char *zOrigVfsName, int makeDefault){
+  sqlite3_vfs *pOrigVfs;
+  if( gQuota.isInitialized ) return SQLITE_MISUSE;
+  pOrigVfs = sqlite3_vfs_find(zOrigVfsName);
+  if( pOrigVfs==0 ) return SQLITE_ERROR;
+  assert( pOrigVfs!=&gQuota.sThisVfs );
+  gQuota.pMutex = sqlite3_mutex_alloc(SQLITE_MUTEX_FAST);
+  if( !gQuota.pMutex ){
+    return SQLITE_NOMEM;
+  }
+  gQuota.isInitialized = 1;
+  gQuota.pOrigVfs = pOrigVfs;
+  gQuota.sThisVfs = *pOrigVfs;
+  gQuota.sThisVfs.xOpen = quotaOpen;
+  gQuota.sThisVfs.szOsFile += sizeof(quotaConn);
+  gQuota.sThisVfs.zName = "quota";
+  gQuota.sIoMethodsV1.iVersion = 1;
+  gQuota.sIoMethodsV1.xClose = quotaClose;
+  gQuota.sIoMethodsV1.xRead = quotaRead;
+  gQuota.sIoMethodsV1.xWrite = quotaWrite;
+  gQuota.sIoMethodsV1.xTruncate = quotaTruncate;
+  gQuota.sIoMethodsV1.xSync = quotaSync;
+  gQuota.sIoMethodsV1.xFileSize = quotaFileSize;
+  gQuota.sIoMethodsV1.xLock = quotaLock;
+  gQuota.sIoMethodsV1.xUnlock = quotaUnlock;
+  gQuota.sIoMethodsV1.xCheckReservedLock = quotaCheckReservedLock;
+  gQuota.sIoMethodsV1.xFileControl = quotaFileControl;
+  gQuota.sIoMethodsV1.xSectorSize = quotaSectorSize;
+  gQuota.sIoMethodsV1.xDeviceCharacteristics = quotaDeviceCharacteristics;
+  gQuota.sIoMethodsV2 = gQuota.sIoMethodsV1;
+  gQuota.sIoMethodsV2.iVersion = 2;
+  gQuota.sIoMethodsV2.xShmMap = quotaShmMap;
+  gQuota.sIoMethodsV2.xShmLock = quotaShmLock;
+  gQuota.sIoMethodsV2.xShmBarrier = quotaShmBarrier;
+  gQuota.sIoMethodsV2.xShmUnmap = quotaShmUnmap;
+  sqlite3_vfs_register(&gQuota.sThisVfs, makeDefault);
+  return SQLITE_OK;
+}
+
+/*
+** Shutdown the quota system.
+**
+** All SQLite database connections must be closed before calling this
+** routine.
+**
+** THIS ROUTINE IS NOT THREADSAFE.  Call this routine exactly one while
+** shutting down in order to free all remaining quota groups.
+*/
+int sqlite3_quota_shutdown(void){
+  quotaGroup *pGroup;
+  if( gQuota.isInitialized==0 ) return SQLITE_MISUSE;
+  for(pGroup=gQuota.pGroup; pGroup; pGroup=pGroup->pNext){
+    if( pGroup->pFiles ) return SQLITE_MISUSE;
+  }
+  while( gQuota.pGroup ){
+    pGroup = gQuota.pGroup;
+    gQuota.pGroup = pGroup->pNext;
+    pGroup->iLimit = 0;
+    quotaGroupDeref(pGroup);
+  }
+  gQuota.isInitialized = 0;
+  sqlite3_mutex_free(gQuota.pMutex);
+  sqlite3_vfs_unregister(&gQuota.sThisVfs);
+  memset(&gQuota, 0, sizeof(gQuota));
+  return SQLITE_OK;
+}
+
+/*
+** Create or destroy a quota group.
+**
+** The quota group is defined by the zPattern.  When calling this routine
+** with a zPattern for a quota group that already exists, this routine
+** merely updates the iLimit, xCallback, and pArg values for that quota
+** group.  If zPattern is new, then a new quota group is created.
+**
+** If the iLimit for a quota group is set to zero, then the quota group
+** is disabled and will be deleted when the last database connection using
+** the quota group is closed.
+**
+** Calling this routine on a zPattern that does not exist and with a
+** zero iLimit is a no-op.
+**
+** A quota group must exist with a non-zero iLimit prior to opening
+** database connections if those connections are to participate in the
+** quota group.  Creating a quota group does not affect database connections
+** that are already open.
+*/
+int sqlite3_quota_set(
+  const char *zPattern,           /* The filename pattern */
+  sqlite3_int64 iLimit,           /* New quota to set for this quota group */
+  void (*xCallback)(              /* Callback invoked when going over quota */
+     const char *zFilename,         /* Name of file whose size increases */
+     sqlite3_int64 *piLimit,        /* IN/OUT: The current limit */
+     sqlite3_int64 iSize,           /* Total size of all files in the group */
+     void *pArg                     /* Client data */
+  ),
+  void *pArg,                     /* client data passed thru to callback */
+  void (*xDestroy)(void*)         /* Optional destructor for pArg */
+){
+  quotaGroup *pGroup;
+  quotaEnter();
+  pGroup = gQuota.pGroup;
+  while( pGroup && strcmp(pGroup->zPattern, zPattern)!=0 ){
+    pGroup = pGroup->pNext;
+  }
+  if( pGroup==0 ){
+    int nPattern = strlen(zPattern);
+    if( iLimit<=0 ){
+      quotaLeave();
+      return SQLITE_OK;
+    }
+    pGroup = (quotaGroup *)sqlite3_malloc( sizeof(*pGroup) + nPattern + 1 );
+    if( pGroup==0 ){
+      quotaLeave();
+      return SQLITE_NOMEM;
+    }
+    memset(pGroup, 0, sizeof(*pGroup));
+    pGroup->zPattern = (char*)&pGroup[1];
+    memcpy((char *)pGroup->zPattern, zPattern, nPattern+1);
+    if( gQuota.pGroup ) gQuota.pGroup->ppPrev = &pGroup->pNext;
+    pGroup->pNext = gQuota.pGroup;
+    pGroup->ppPrev = &gQuota.pGroup;
+    gQuota.pGroup = pGroup;
+  }
+  pGroup->iLimit = iLimit;
+  pGroup->xCallback = xCallback;
+  if( pGroup->xDestroy && pGroup->pArg!=pArg ){
+    pGroup->xDestroy(pGroup->pArg);
+  }
+  pGroup->pArg = pArg;
+  pGroup->xDestroy = xDestroy;
+  quotaGroupDeref(pGroup);
+  quotaLeave();
+  return SQLITE_OK;
+}
+
+  
+/***************************** Test Code ***********************************/
+#ifdef SQLITE_TEST
+#include <tcl.h>
+
+/*
+** Argument passed to a TCL quota-over-limit callback.
+*/
+typedef struct TclQuotaCallback TclQuotaCallback;
+struct TclQuotaCallback {
+  Tcl_Interp *interp;    /* Interpreter in which to run the script */
+  Tcl_Obj *pScript;      /* Script to be run */
+};
+
+extern const char *sqlite3TestErrorName(int);
+
+
+/*
+** This is the callback from a quota-over-limit.
+*/
+static void tclQuotaCallback(
+  const char *zFilename,          /* Name of file whose size increases */
+  sqlite3_int64 *piLimit,         /* IN/OUT: The current limit */
+  sqlite3_int64 iSize,            /* Total size of all files in the group */
+  void *pArg                      /* Client data */
+){
+  TclQuotaCallback *p;            /* Callback script object */
+  Tcl_Obj *pEval;                 /* Script to evaluate */
+  Tcl_Obj *pVarname;              /* Name of variable to pass as 2nd arg */
+  unsigned int rnd;               /* Random part of pVarname */
+  int rc;                         /* Tcl error code */
+
+  p = (TclQuotaCallback *)pArg;
+  if( p==0 ) return;
+
+  pVarname = Tcl_NewStringObj("::piLimit_", -1);
+  Tcl_IncrRefCount(pVarname);
+  sqlite3_randomness(sizeof(rnd), (void *)&rnd);
+  Tcl_AppendObjToObj(pVarname, Tcl_NewIntObj((int)(rnd&0x7FFFFFFF)));
+  Tcl_ObjSetVar2(p->interp, pVarname, 0, Tcl_NewWideIntObj(*piLimit), 0);
+
+  pEval = Tcl_DuplicateObj(p->pScript);
+  Tcl_IncrRefCount(pEval);
+  Tcl_ListObjAppendElement(0, pEval, Tcl_NewStringObj(zFilename, -1));
+  Tcl_ListObjAppendElement(0, pEval, pVarname);
+  Tcl_ListObjAppendElement(0, pEval, Tcl_NewWideIntObj(iSize));
+  rc = Tcl_EvalObjEx(p->interp, pEval, TCL_EVAL_GLOBAL);
+
+  if( rc==TCL_OK ){
+    Tcl_Obj *pLimit = Tcl_ObjGetVar2(p->interp, pVarname, 0, 0);
+    rc = Tcl_GetWideIntFromObj(p->interp, pLimit, piLimit);
+    Tcl_UnsetVar(p->interp, Tcl_GetString(pVarname), 0);
+  }
+
+  Tcl_DecrRefCount(pEval);
+  Tcl_DecrRefCount(pVarname);
+  if( rc!=TCL_OK ) Tcl_BackgroundError(p->interp);
+}
+
+/*
+** Destructor for a TCL quota-over-limit callback.
+*/
+static void tclCallbackDestructor(void *pObj){
+  TclQuotaCallback *p = (TclQuotaCallback*)pObj;
+  if( p ){
+    Tcl_DecrRefCount(p->pScript);
+    sqlite3_free((char *)p);
+  }
+}
+
+/*
+** tclcmd: sqlite3_quota_initialize NAME MAKEDEFAULT
+*/
+static int test_quota_initialize(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  const char *zName;              /* Name of new quota VFS */
+  int makeDefault;                /* True to make the new VFS the default */
+  int rc;                         /* Value returned by quota_initialize() */
+
+  /* Process arguments */
+  if( objc!=3 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "NAME MAKEDEFAULT");
+    return TCL_ERROR;
+  }
+  zName = Tcl_GetString(objv[1]);
+  if( Tcl_GetBooleanFromObj(interp, objv[2], &makeDefault) ) return TCL_ERROR;
+  if( zName[0]=='\0' ) zName = 0;
+
+  /* Call sqlite3_quota_initialize() */
+  rc = sqlite3_quota_initialize(zName, makeDefault);
+  Tcl_SetResult(interp, (char *)sqlite3TestErrorName(rc), TCL_STATIC);
+
+  return TCL_OK;
+}
+
+/*
+** tclcmd: sqlite3_quota_shutdown
+*/
+static int test_quota_shutdown(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  int rc;                         /* Value returned by quota_shutdown() */
+
+  if( objc!=1 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "");
+    return TCL_ERROR;
+  }
+
+  /* Call sqlite3_quota_shutdown() */
+  rc = sqlite3_quota_shutdown();
+  Tcl_SetResult(interp, (char *)sqlite3TestErrorName(rc), TCL_STATIC);
+
+  return TCL_OK;
+}
+
+/*
+** tclcmd: sqlite3_quota_set PATTERN LIMIT SCRIPT
+*/
+static int test_quota_set(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  const char *zPattern;           /* File pattern to configure */
+  sqlite3_int64 iLimit;           /* Initial quota in bytes */
+  Tcl_Obj *pScript;               /* Tcl script to invoke to increase quota */
+  int rc;                         /* Value returned by quota_set() */
+  TclQuotaCallback *p;            /* Callback object */
+  int nScript;                    /* Length of callback script */
+  void (*xDestroy)(void*);        /* Optional destructor for pArg */
+  void (*xCallback)(const char *, sqlite3_int64 *, sqlite3_int64, void *);
+
+  /* Process arguments */
+  if( objc!=4 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "PATTERN LIMIT SCRIPT");
+    return TCL_ERROR;
+  }
+  zPattern = Tcl_GetString(objv[1]);
+  if( Tcl_GetWideIntFromObj(interp, objv[2], &iLimit) ) return TCL_ERROR;
+  pScript = objv[3];
+  Tcl_GetStringFromObj(pScript, &nScript);
+
+  if( nScript>0 ){
+    /* Allocate a TclQuotaCallback object */
+    p = (TclQuotaCallback *)sqlite3_malloc(sizeof(TclQuotaCallback));
+    if( !p ){
+      Tcl_SetResult(interp, (char *)"SQLITE_NOMEM", TCL_STATIC);
+      return TCL_OK;
+    }
+    memset(p, 0, sizeof(TclQuotaCallback));
+    p->interp = interp;
+    Tcl_IncrRefCount(pScript);
+    p->pScript = pScript;
+    xDestroy = tclCallbackDestructor;
+    xCallback = tclQuotaCallback;
+  }else{
+    p = 0;
+    xDestroy = 0;
+    xCallback = 0;
+  }
+
+  /* Invoke sqlite3_quota_set() */
+  rc = sqlite3_quota_set(zPattern, iLimit, xCallback, (void*)p, xDestroy);
+
+  Tcl_SetResult(interp, (char *)sqlite3TestErrorName(rc), TCL_STATIC);
+  return TCL_OK;
+}
+
+/*
+** tclcmd:  sqlite3_quota_dump
+*/
+static int test_quota_dump(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  Tcl_Obj *pResult;
+  Tcl_Obj *pGroupTerm;
+  Tcl_Obj *pFileTerm;
+  quotaGroup *pGroup;
+  quotaFile *pFile;
+
+  pResult = Tcl_NewObj();
+  quotaEnter();
+  for(pGroup=gQuota.pGroup; pGroup; pGroup=pGroup->pNext){
+    pGroupTerm = Tcl_NewObj();
+    Tcl_ListObjAppendElement(interp, pGroupTerm,
+          Tcl_NewStringObj(pGroup->zPattern, -1));
+    Tcl_ListObjAppendElement(interp, pGroupTerm,
+          Tcl_NewWideIntObj(pGroup->iLimit));
+    Tcl_ListObjAppendElement(interp, pGroupTerm,
+          Tcl_NewWideIntObj(pGroup->iSize));
+    for(pFile=pGroup->pFiles; pFile; pFile=pFile->pNext){
+      pFileTerm = Tcl_NewObj();
+      Tcl_ListObjAppendElement(interp, pFileTerm,
+            Tcl_NewStringObj(pFile->zFilename, -1));
+      Tcl_ListObjAppendElement(interp, pFileTerm,
+            Tcl_NewWideIntObj(pFile->iSize));
+      Tcl_ListObjAppendElement(interp, pFileTerm,
+            Tcl_NewWideIntObj(pFile->nRef));
+      Tcl_ListObjAppendElement(interp, pGroupTerm, pFileTerm);
+    }
+    Tcl_ListObjAppendElement(interp, pResult, pGroupTerm);
+  }
+  quotaLeave();
+  Tcl_SetObjResult(interp, pResult);
+  return TCL_OK;
+}
+
+/*
+** This routine registers the custom TCL commands defined in this
+** module.  This should be the only procedure visible from outside
+** of this module.
+*/
+int Sqlitequota_Init(Tcl_Interp *interp){
+  static struct {
+     char *zName;
+     Tcl_ObjCmdProc *xProc;
+  } aCmd[] = {
+    { "sqlite3_quota_initialize", test_quota_initialize },
+    { "sqlite3_quota_shutdown", test_quota_shutdown },
+    { "sqlite3_quota_set", test_quota_set },
+    { "sqlite3_quota_dump", test_quota_dump },
+  };
+  int i;
+
+  for(i=0; i<sizeof(aCmd)/sizeof(aCmd[0]); i++){
+    Tcl_CreateObjCommand(interp, aCmd[i].zName, aCmd[i].xProc, 0, 0);
+  }
+
+  return TCL_OK;
+}
+#endif
diff --git a/storage/public/Makefile.in b/storage/public/Makefile.in
index 339aabf288da..7d6e01259ab6 100644
--- a/storage/public/Makefile.in
+++ b/storage/public/Makefile.in
@@ -67,6 +67,7 @@ XPIDLSRCS = \
   mozIStorageCompletionCallback.idl \
   mozIStorageBaseStatement.idl \
   mozIStorageAsyncStatement.idl \
+  mozIStorageServiceQuotaManagement.idl \
 	$(NULL)
 
 EXPORTS_NAMESPACES = mozilla
diff --git a/storage/public/mozIStorageServiceQuotaManagement.idl b/storage/public/mozIStorageServiceQuotaManagement.idl
new file mode 100644
index 000000000000..c825400a05bc
--- /dev/null
+++ b/storage/public/mozIStorageServiceQuotaManagement.idl
@@ -0,0 +1,113 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Indexed Database.
+ *
+ * The Initial Developer of the Original Code is
+ * The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Ben Turner <bent.mozilla@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsISupports.idl"
+
+interface mozIStorageConnection;
+interface nsIFile;
+
+[scriptable, function, uuid(ae94f0a5-ebdf-48f4-9959-085e13235d8d)]
+interface mozIStorageQuotaCallback : nsISupports
+{
+  /**
+   * Called when the file size quota for a group of databases is exceeded.
+   *
+   * @param aFilename
+   *        The filename of the database that has exceeded the quota.
+   *
+   * @param aCurrentSizeLimit
+   *        The current size (in bytes) of the quota.
+   *
+   * @param aCurrentTotalSize
+   *        The current size of all databases in the quota group.
+   *
+   * @param aUserData
+   *        Any additional data that was provided to the
+   *        setQuotaForFilenamePattern function.
+   *
+   * @returns A new quota size. A new quota of 0 will disable the quota callback
+   *          and any quota value less than aCurrentTotalSize will cause the
+   *          database operation to fail with NS_ERROR_FILE_NO_DEVICE_SPACE.
+   */
+  long long quotaExceeded(in ACString aFilename,
+                          in long long aCurrentSizeLimit,
+                          in long long aCurrentTotalSize,
+                          in nsISupports aUserData);
+};
+
+/**
+ * This is a temporary interface that should eventually merge with
+ * mozIStorageService.
+ */
+[scriptable, uuid(11def472-446f-4635-a1d8-8856e85aac50)]
+interface mozIStorageServiceQuotaManagement : nsISupports
+{
+  /**
+   * See mozIStorageService.openDatabase. Exactly the same only with a custom
+   * SQLite VFS.
+   */
+  mozIStorageConnection openDatabaseWithVFS(in nsIFile aDatabaseFile,
+                                            in ACString aVFSName);
+
+  /**
+   * Set a file size quota for a group of databases matching the given filename
+   * pattern, optionally specifying a callback when the quota is exceeded.
+   *
+   * @param aPattern
+   *        A pattern to match filenames for inclusion in the quota system. May
+   *        contain the following special characters:
+   *          '*'    Matches any sequence of zero or more characters.
+   *          '?'    Matches exactly one character.
+   *          [...]  Matches one character from the enclosed list of characters.
+   *          [^...] Matches one character not in the enclosed list.
+   *
+   * @param aSizeLimit
+   *        The size limit (in bytes) for the quota group.
+   *
+   * @param aCallback
+   *        A callback that will be used when the quota is exceeded.
+   *
+   * @param aUserData
+   *        Additional information to be passed to the callback.
+   */
+  void setQuotaForFilenamePattern(in ACString aPattern,
+                                  in long long aSizeLimit,
+                                  in mozIStorageQuotaCallback aCallback,
+                                  in nsISupports aUserData);
+};
diff --git a/storage/public/storage.h b/storage/public/storage.h
index fc27fbce4cee..2bfa3f520fc9 100644
--- a/storage/public/storage.h
+++ b/storage/public/storage.h
@@ -57,6 +57,7 @@
 #include "mozIStorageStatementCallback.h"
 #include "mozIStorageBindingParamsArray.h"
 #include "mozIStorageBindingParams.h"
+#include "mozIStorageServiceQuotaManagement.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 //// Native Language Helpers
diff --git a/storage/src/Makefile.in b/storage/src/Makefile.in
index 9dd384e75635..a3f012c8f486 100644
--- a/storage/src/Makefile.in
+++ b/storage/src/Makefile.in
@@ -83,7 +83,9 @@ CPPSRCS = \
   $(NULL)
 
 LOCAL_INCLUDES = \
-	$(SQLITE_CFLAGS)
+  $(SQLITE_CFLAGS) \
+  -I$(topsrcdir)/db/sqlite3/src \
+  $(NULL)
 
 # This is the default value.  If we ever change it when compiling sqlite, we
 # will need to change it here as well.
diff --git a/storage/src/mozStorageConnection.cpp b/storage/src/mozStorageConnection.cpp
index 563c7ec63e10..042f9aa1040b 100644
--- a/storage/src/mozStorageConnection.cpp
+++ b/storage/src/mozStorageConnection.cpp
@@ -379,7 +379,8 @@ Connection::getAsyncExecutionTarget()
 }
 
 nsresult
-Connection::initialize(nsIFile *aDatabaseFile)
+Connection::initialize(nsIFile *aDatabaseFile,
+                       const char* aVFSName)
 {
   NS_ASSERTION (!mDBConn, "Initialize called on already opened database!");
 
@@ -394,11 +395,11 @@ Connection::initialize(nsIFile *aDatabaseFile)
     NS_ENSURE_SUCCESS(rv, rv);
 
     srv = ::sqlite3_open_v2(NS_ConvertUTF16toUTF8(path).get(), &mDBConn, mFlags,
-                            NULL);
+                            aVFSName);
   }
   else {
     // in memory database requested, sqlite uses a magic file name
-    srv = ::sqlite3_open_v2(":memory:", &mDBConn, mFlags, NULL);
+    srv = ::sqlite3_open_v2(":memory:", &mDBConn, mFlags, aVFSName);
   }
   if (srv != SQLITE_OK) {
     mDBConn = nsnull;
diff --git a/storage/src/mozStorageConnection.h b/storage/src/mozStorageConnection.h
index 711f80311fe5..e8194cdfd2f1 100644
--- a/storage/src/mozStorageConnection.h
+++ b/storage/src/mozStorageConnection.h
@@ -101,7 +101,8 @@ public:
    *        does not exist.  Passing in nsnull here creates an in-memory
    *        database.
    */
-  nsresult initialize(nsIFile *aDatabaseFile);
+  nsresult initialize(nsIFile *aDatabaseFile,
+                      const char* aVFSName = NULL);
 
   // fetch the native handle
   sqlite3 *GetNativeConnection() { return mDBConn; }
diff --git a/storage/src/mozStorageService.cpp b/storage/src/mozStorageService.cpp
index 70e7c27c001a..e579de05aed5 100644
--- a/storage/src/mozStorageService.cpp
+++ b/storage/src/mozStorageService.cpp
@@ -55,12 +55,68 @@
 #include "mozilla/Services.h"
 
 #include "sqlite3.h"
+#include "test_quota.c"
 
 #include "nsIPromptService.h"
 #include "nsIMemoryReporter.h"
 
 #include "mozilla/FunctionTimer.h"
 
+namespace {
+
+class QuotaCallbackData
+{
+public:
+  QuotaCallbackData(mozIStorageQuotaCallback *aCallback,
+                    nsISupports *aUserData)
+  : callback(aCallback), userData(aUserData)
+  {
+    MOZ_COUNT_CTOR(QuotaCallbackData);
+  }
+
+  ~QuotaCallbackData()
+  {
+    MOZ_COUNT_DTOR(QuotaCallbackData);
+  }
+
+  static void Callback(const char *zFilename,
+                       sqlite3_int64 *piLimit,
+                       sqlite3_int64 iSize,
+                       void *pArg)
+  {
+    NS_ASSERTION(zFilename && strlen(zFilename), "Null or empty filename!");
+    NS_ASSERTION(piLimit, "Null pointer!");
+
+    QuotaCallbackData *data = static_cast<QuotaCallbackData*>(pArg);
+    if (!data) {
+      // No callback specified, return immediately.
+      return;
+    }
+
+    NS_ASSERTION(data->callback, "Should never have a null callback!");
+
+    nsDependentCString filename(zFilename);
+
+    PRInt64 newLimit;
+    if (NS_SUCCEEDED(data->callback->QuotaExceeded(filename, *piLimit,
+                                                   iSize, data->userData,
+                                                   &newLimit))) {
+      *piLimit = newLimit;
+    }
+  }
+
+  static void Destroy(void *aUserData)
+  {
+    delete static_cast<QuotaCallbackData*>(aUserData);
+  }
+
+private:
+  nsCOMPtr<mozIStorageQuotaCallback> callback;
+  nsCOMPtr<nsISupports> userData;
+};
+
+} // anonymous namespace
+
 namespace mozilla {
 namespace storage {
 
@@ -148,10 +204,11 @@ private:
 ////////////////////////////////////////////////////////////////////////////////
 //// Service
 
-NS_IMPL_THREADSAFE_ISUPPORTS2(
+NS_IMPL_THREADSAFE_ISUPPORTS3(
   Service,
   mozIStorageService,
-  nsIObserver
+  nsIObserver,
+  mozIStorageServiceQuotaManagement
 )
 
 Service *Service::gService = nsnull;
@@ -218,7 +275,11 @@ Service::~Service()
 {
   // Shutdown the sqlite3 API.  Warn if shutdown did not turn out okay, but
   // there is nothing actionable we can do in that case.
-  int rc = ::sqlite3_shutdown();
+  int rc = ::sqlite3_quota_shutdown();
+  if (rc != SQLITE_OK)
+    NS_WARNING("sqlite3 did not shutdown cleanly.");
+
+  rc = ::sqlite3_shutdown();
   if (rc != SQLITE_OK)
     NS_WARNING("sqlite3 did not shutdown cleanly.");
 
@@ -248,6 +309,10 @@ Service::initialize()
   if (rc != SQLITE_OK)
     return convertResultCode(rc);
 
+  rc = ::sqlite3_quota_initialize(NULL, 0);
+  if (rc != SQLITE_OK)
+    return convertResultCode(rc);
+
   // Run the things that need to run on the main thread there.
   nsCOMPtr<nsIRunnable> event =
     new ServiceMainThreadInitializer(this, &sXPConnect);
@@ -466,5 +531,59 @@ Service::Observe(nsISupports *, const char *aTopic, const PRUnichar *)
   return NS_OK;
 }
 
+////////////////////////////////////////////////////////////////////////////////
+//// mozIStorageServiceQuotaManagement
+
+NS_IMETHODIMP
+Service::OpenDatabaseWithVFS(nsIFile *aDatabaseFile,
+                             const nsACString &aVFSName,
+                             mozIStorageConnection **_connection)
+{
+  NS_ENSURE_ARG(aDatabaseFile);
+
+#ifdef NS_FUNCTION_TIMER
+  nsCString leafname;
+  (void)aDatabaseFile->GetNativeLeafName(leafname);
+  NS_TIME_FUNCTION_FMT("mozIStorageService::OpenDatabaseWithVFS(%s)",
+                       leafname.get());
+#endif
+
+  // Always ensure that SQLITE_OPEN_CREATE is passed in for compatibility
+  // reasons.
+  int flags = SQLITE_OPEN_READWRITE | SQLITE_OPEN_SHAREDCACHE |
+              SQLITE_OPEN_CREATE;
+  nsRefPtr<Connection> msc = new Connection(this, flags);
+  NS_ENSURE_TRUE(msc, NS_ERROR_OUT_OF_MEMORY);
+
+  nsresult rv = msc->initialize(aDatabaseFile,
+                                PromiseFlatCString(aVFSName).get());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  NS_ADDREF(*_connection = msc);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+Service::SetQuotaForFilenamePattern(const nsACString &aPattern,
+                                    PRInt64 aSizeLimit,
+                                    mozIStorageQuotaCallback *aCallback,
+                                    nsISupports *aUserData)
+{
+  NS_ENSURE_FALSE(aPattern.IsEmpty(), NS_ERROR_INVALID_ARG);
+
+  nsAutoPtr<QuotaCallbackData> data;
+  if (aSizeLimit && aCallback) {
+    data = new QuotaCallbackData(aCallback, aUserData);
+  }
+
+  int rc = ::sqlite3_quota_set(PromiseFlatCString(aPattern).get(),
+                               aSizeLimit, QuotaCallbackData::Callback,
+                               data, QuotaCallbackData::Destroy);
+  NS_ENSURE_TRUE(rc == SQLITE_OK, convertResultCode(rc));
+
+  data.forget();
+  return NS_OK;
+}
+
 } // namespace storage
 } // namespace mozilla
diff --git a/storage/src/mozStorageService.h b/storage/src/mozStorageService.h
index 3471024c4e0c..9e535140acc3 100644
--- a/storage/src/mozStorageService.h
+++ b/storage/src/mozStorageService.h
@@ -50,6 +50,7 @@
 #include "mozilla/Mutex.h"
 
 #include "mozIStorageService.h"
+#include "mozIStorageServiceQuotaManagement.h"
 
 class nsIXPConnect;
 
@@ -58,6 +59,7 @@ namespace storage {
 
 class Service : public mozIStorageService
               , public nsIObserver
+              , public mozIStorageServiceQuotaManagement
 {
 public:
   /**
@@ -87,6 +89,7 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_MOZISTORAGESERVICE
   NS_DECL_NSIOBSERVER
+  NS_DECL_MOZISTORAGESERVICEQUOTAMANAGEMENT
 
   /**
    * Obtains an already AddRefed pointer to XPConnect.  This is used by

From f04c0c661b4fa4f3eb7c52a38a0f27cdea504585 Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Fri, 3 Sep 2010 18:13:49 +0200
Subject: [PATCH 105/222] Backing out bug 449734 due to unexpected orange.
 a=ted

---
 browser/base/content/test/Makefile.in         |   1 -
 .../base/content/test/browser_tab_dragdrop.js | 114 ----------------
 content/base/src/nsFrameLoader.cpp            |  12 +-
 layout/base/FrameLayerBuilder.h               |   8 --
 layout/generic/nsObjectFrame.cpp              |  49 +------
 layout/generic/nsObjectFrame.h                |  13 --
 layout/generic/nsSubDocumentFrame.cpp         | 126 +-----------------
 view/public/nsIView.h                         |   3 -
 widget/src/gtk2/nsWindow.cpp                  |   4 +-
 9 files changed, 14 insertions(+), 316 deletions(-)
 delete mode 100644 browser/base/content/test/browser_tab_dragdrop.js

diff --git a/browser/base/content/test/Makefile.in b/browser/base/content/test/Makefile.in
index beac66271425..4a809bab8bf3 100644
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -177,7 +177,6 @@ _BROWSER_FILES = \
                  browser_sanitizeDialog.js \
                  browser_scope.js \
                  browser_selectTabAtIndex.js \
-                 browser_tab_dragdrop.js \
                  browser_tabfocus.js \
                  browser_tabs_owner.js \
                  browser_visibleTabs.js \
diff --git a/browser/base/content/test/browser_tab_dragdrop.js b/browser/base/content/test/browser_tab_dragdrop.js
deleted file mode 100644
index a1376f035144..000000000000
--- a/browser/base/content/test/browser_tab_dragdrop.js
+++ /dev/null
@@ -1,114 +0,0 @@
-function test()
-{
-  var embed = '<embed type="application/x-test" allowscriptaccess="always" allowfullscreen="true" wmode="window" width="640" height="480"></embed>'
-
-  waitForExplicitFinish();
-
-  // create a few tabs
-  var tabs = [
-    gBrowser.tabs[0],
-    gBrowser.addTab("about:blank", {skipAnimation: true}),
-    gBrowser.addTab("about:blank", {skipAnimation: true}),
-    gBrowser.addTab("about:blank", {skipAnimation: true}),
-    gBrowser.addTab("about:blank", {skipAnimation: true})
-  ];
-
-  function setLocation(i, url) {
-    gBrowser.getBrowserForTab(tabs[i]).contentWindow.location = url;
-  }
-  function moveTabTo(a, b) {
-    gBrowser.swapBrowsersAndCloseOther(gBrowser.tabs[b], gBrowser.tabs[a]);
-  }
-  function clickTest(doc, win) {
-    var clicks = doc.defaultView.clicks;
-    EventUtils.synthesizeMouse(doc.body, 100, 600, {}, win);
-    is(doc.defaultView.clicks, clicks+1, "adding 1 more click on BODY");
-  }
-  function test1() {
-    moveTabTo(2, 3); // now: 0 1 2 4
-    is(gBrowser.tabs[1], tabs[1], "tab1");
-    is(gBrowser.tabs[2], tabs[3], "tab3");
-
-    var plugin = gBrowser.getBrowserForTab(tabs[4]).docShell.contentViewer.DOMDocument.wrappedJSObject.body.firstChild;
-    var tab4_plugin_object = plugin.getObjectValue();
-
-    gBrowser.selectedTab = gBrowser.tabs[2];
-    moveTabTo(3, 2); // now: 0 1 4
-    gBrowser.selectedTab = tabs[4];
-    var doc = gBrowser.getBrowserForTab(gBrowser.tabs[2]).docShell.contentViewer.DOMDocument.wrappedJSObject;
-    plugin = doc.body.firstChild;
-    ok(plugin && plugin.checkObjectValue(tab4_plugin_object), "same plugin instance");
-    is(gBrowser.tabs[1], tabs[1], "tab1");
-    is(gBrowser.tabs[2], tabs[3], "tab4");
-    is(doc.defaultView.clicks, 0, "no click on BODY so far");
-    clickTest(doc, window);
-
-    moveTabTo(2, 1); // now: 0 4
-    is(gBrowser.tabs[1], tabs[1], "tab1");
-    doc = gBrowser.getBrowserForTab(gBrowser.tabs[1]).docShell.contentViewer.DOMDocument.wrappedJSObject;
-    plugin = doc.body.firstChild;
-    ok(plugin && plugin.checkObjectValue(tab4_plugin_object), "same plugin instance");
-    clickTest(doc, window);
-
-    // Load a new document (about:blank) in tab4, then detach that tab into a new window.
-    // In the new window, navigate back to the original document and click on its <body>,
-    // verify that its onclick was called.
-    var t = tabs[1];
-    var b = gBrowser.getBrowserForTab(t);
-    gBrowser.selectedTab = t;
-    b.addEventListener("load", function() {
-      b.removeEventListener("load", arguments.callee, true);
-
-      executeSoon(function () {
-        var win = gBrowser.replaceTabWithWindow(t);
-        win.addEventListener("load", function () {
-          win.removeEventListener("load", arguments.callee, true);
-
-          // Verify that the original window now only has the initial tab left in it.
-          is(gBrowser.tabs[0], tabs[0], "tab0");
-          is(gBrowser.getBrowserForTab(gBrowser.tabs[0]).contentWindow.location, "about:blank", "tab0 uri");
-
-          executeSoon(function () {
-            win.gBrowser.addEventListener("pageshow", function () {
-              win.gBrowser.removeEventListener("pageshow", arguments.callee, false);
-              executeSoon(function () {
-                t = win.gBrowser.tabs[0];
-                b = win.gBrowser.getBrowserForTab(t);
-                var doc = b.docShell.contentViewer.DOMDocument.wrappedJSObject;
-                clickTest(doc, win);
-                win.close();
-                finish();
-              });
-            }, false);
-            win.gBrowser.goBack();
-          });
-        }, true);
-      });
-    }, true);
-    b.loadURI("about:blank");
-
-  }
-
-  var loads = 0;
-  function waitForLoad(tab) {
-    gBrowser.getBrowserForTab(gBrowser.tabs[tab]).removeEventListener("load", arguments.callee, true);
-    ++loads;
-    if (loads == tabs.length - 1) {
-      executeSoon(test1);
-    }
-  }
-
-  function fn(f, arg) {
-    return function () { return f(arg); };
-  }
-  for (var i = 1; i < tabs.length; ++i) {
-    gBrowser.getBrowserForTab(tabs[i]).addEventListener("load", fn(waitForLoad,i), true);
-  }
-
-  setLocation(1, "data:text/html,<title>tab1</title><body>tab1<iframe>");
-  setLocation(2, "data:text/plain,tab2");
-  setLocation(3, "data:text/html,<title>tab3</title><body>tab3<iframe>");
-  setLocation(4, "data:text/html,<body onload='clicks=0' onclick='++clicks'>"+embed);
-  gBrowser.selectedTab = tabs[3];
-
-}
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index f98df24e1a0e..43ba4b5e9b11 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -1086,15 +1086,15 @@ nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
     otherInternalHistory->EvictAllContentViewers();
   }
 
-  NS_ASSERTION(ourFrame == ourContent->GetPrimaryFrame() &&
-               otherFrame == otherContent->GetPrimaryFrame(),
-               "changed primary frame");
-
-  ourFrameFrame->EndSwapDocShells(otherFrame);
+  // We shouldn't have changed frames, but be really careful about it
+  if (ourFrame == ourContent->GetPrimaryFrame() &&
+      otherFrame == otherContent->GetPrimaryFrame()) {
+    ourFrameFrame->EndSwapDocShells(otherFrame);
+  }
 
   ourParentDocument->FlushPendingNotifications(Flush_Layout);
   otherParentDocument->FlushPendingNotifications(Flush_Layout);
-
+  
   FirePageShowEvent(ourTreeItem, otherChromeEventHandler, PR_TRUE);
   FirePageShowEvent(otherTreeItem, ourChromeEventHandler, PR_TRUE);
 
diff --git a/layout/base/FrameLayerBuilder.h b/layout/base/FrameLayerBuilder.h
index 7925f3f3449f..4cce9ebbcb70 100644
--- a/layout/base/FrameLayerBuilder.h
+++ b/layout/base/FrameLayerBuilder.h
@@ -263,14 +263,6 @@ public:
   nscolor FindOpaqueColorCovering(nsDisplayListBuilder* aBuilder,
                                   ThebesLayer* aLayer, const nsRect& aRect);
 
-  /**
-   * Destroy any stored DisplayItemDataProperty for aFrame.
-   */
-  static void DestroyDisplayItemDataFor(nsIFrame* aFrame)
-  {
-    aFrame->Properties().Delete(DisplayItemDataProperty());
-  }
-
 protected:
   /**
    * We store an array of these for each frame that is associated with
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index 755d875128f6..d5f73371194a 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -28,7 +28,7 @@
  *   Robert O'Callahan <roc+moz@cs.cmu.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Josh Aas <josh@mozilla.com>
- *   Mats Palmgren <matspal@gmail.com>
+ *   Mats Palmgren <mats.palmgren@bredband.net>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -2423,53 +2423,6 @@ nsObjectFrame::GetNextObjectFrame(nsPresContext* aPresContext, nsIFrame* aRoot)
   return nsnull;
 }
 
-/*static*/ void
-nsObjectFrame::BeginSwapDocShells(nsIContent* aContent, void*)
-{
-  NS_PRECONDITION(aContent, "");
-
-  // This function is called from a document content enumerator so we need
-  // to filter out the nsObjectFrames and ignore the rest.
-  nsIObjectFrame* obj = do_QueryFrame(aContent->GetPrimaryFrame());
-  if (!obj)
-    return;
-
-  nsObjectFrame* objectFrame = static_cast<nsObjectFrame*>(obj);
-  NS_ASSERTION(!objectFrame->mWidget || objectFrame->mWidget->GetParent(),
-               "Plugin windows must not be toplevel");
-  nsRootPresContext* rootPC = objectFrame->PresContext()->GetRootPresContext();
-  NS_ASSERTION(rootPC, "unable to unregister the plugin frame");
-  rootPC->UnregisterPluginForGeometryUpdates(objectFrame);
-}
-
-/*static*/ void
-nsObjectFrame::EndSwapDocShells(nsIContent* aContent, void*)
-{
-  NS_PRECONDITION(aContent, "");
-
-  // This function is called from a document content enumerator so we need
-  // to filter out the nsObjectFrames and ignore the rest.
-  nsIObjectFrame* obj = do_QueryFrame(aContent->GetPrimaryFrame());
-  if (!obj)
-    return;
-
-  nsObjectFrame* objectFrame = static_cast<nsObjectFrame*>(obj);
-  nsRootPresContext* rootPC = objectFrame->PresContext()->GetRootPresContext();
-  NS_ASSERTION(rootPC, "unable to register the plugin frame");
-  nsIWidget* widget = objectFrame->GetWidget();
-  if (widget) {
-    // Reparent the widget.
-    nsIWidget* parent =
-      rootPC->PresShell()->GetRootFrame()->GetNearestWidget();
-    widget->SetParent(parent);
-    objectFrame->CallSetWindow();
-
-    // Register for geometry updates and make a request.
-    rootPC->RegisterPluginForGeometryUpdates(objectFrame);
-    rootPC->RequestUpdatePluginGeometry(objectFrame);
-  }
-}
-
 nsIFrame*
 NS_NewObjectFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
diff --git a/layout/generic/nsObjectFrame.h b/layout/generic/nsObjectFrame.h
index 935c4656ec3f..9f52e97dd7ea 100644
--- a/layout/generic/nsObjectFrame.h
+++ b/layout/generic/nsObjectFrame.h
@@ -162,19 +162,6 @@ public:
   static nsIObjectFrame* GetNextObjectFrame(nsPresContext* aPresContext,
                                             nsIFrame* aRoot);
 
-  /**
-   * If aContent has a nsObjectFrame, then prepare it for a DocShell swap.
-   * @see nsSubDocumentFrame::BeginSwapDocShells.
-   * There will be a call to EndSwapDocShells after we were moved to the
-   * new view tree.
-   */
-  static void BeginSwapDocShells(nsIContent* aContent, void*);
-  /**
-   * If aContent has a nsObjectFrame, then set it up after a DocShell swap.
-   * @see nsSubDocumentFrame::EndSwapDocShells.
-   */
-  static void EndSwapDocShells(nsIContent* aContent, void*);
-
 protected:
   nsObjectFrame(nsStyleContext* aContext);
   virtual ~nsObjectFrame();
diff --git a/layout/generic/nsSubDocumentFrame.cpp b/layout/generic/nsSubDocumentFrame.cpp
index 0e5e4dad1b49..657307c779aa 100644
--- a/layout/generic/nsSubDocumentFrame.cpp
+++ b/layout/generic/nsSubDocumentFrame.cpp
@@ -22,7 +22,6 @@
  * Contributor(s):
  *   Travis Bogard <travis@netscape.com>
  *   HÂkan Waara <hwaara@chello.se>
- *   Mats Palmgren <matspal@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -88,8 +87,6 @@
 #include "nsIScrollableFrame.h"
 #include "nsIObjectLoadingContent.h"
 #include "nsLayoutUtils.h"
-#include "FrameLayerBuilder.h"
-#include "nsObjectFrame.h"
 
 #ifdef MOZ_XUL
 #include "nsXULPopupManager.h"
@@ -101,18 +98,6 @@
 #endif
 #include "nsIServiceManager.h"
 
-using namespace mozilla;
-
-static nsIDocument*
-GetDocumentFromView(nsIView* aView)
-{
-  NS_PRECONDITION(aView, "");
-
-  nsIFrame* f = static_cast<nsIFrame*>(aView->GetClientData());
-  nsIPresShell* ps =  f ? f->PresContext()->PresShell() : nsnull;
-  return ps ? ps->GetDocument() : nsnull;
-}
-
 class AsyncFrameInit;
 
 nsSubDocumentFrame::nsSubDocumentFrame(nsStyleContext* aContext)
@@ -181,6 +166,7 @@ nsSubDocumentFrame::Init(nsIContent*     aContent,
     rv = nsHTMLContainerFrame::CreateViewForFrame(this, PR_TRUE);
     NS_ENSURE_SUCCESS(rv, rv);
   }
+  nsIView* view = GetView();
 
   // Set the primary frame now so that
   // DocumentViewerImpl::FindContainerView called by ShowViewer below
@@ -800,75 +786,6 @@ nsSubDocumentFrame::GetDocShell(nsIDocShell **aDocShell)
   return mFrameLoader->GetDocShell(aDocShell);
 }
 
-static void
-DestroyDisplayItemDataForFrames(nsIFrame* aFrame)
-{
-  FrameLayerBuilder::DestroyDisplayItemDataFor(aFrame);
-
-  PRInt32 listIndex = 0;
-  nsIAtom* childList = nsnull;
-  do {
-    nsIFrame* child = aFrame->GetFirstChild(childList);
-    while (child) {
-      DestroyDisplayItemDataForFrames(child);
-      child = child->GetNextSibling();
-    }
-    childList = aFrame->GetAdditionalChildListName(listIndex++);
-  } while (childList);
-}
-
-static PRBool
-BeginSwapDocShellsForDocument(nsIDocument* aDocument, void*)
-{
-  NS_PRECONDITION(aDocument, "");
-
-  nsIPresShell* shell = aDocument->GetShell();
-  nsIFrame* rootFrame = shell ? shell->GetRootFrame() : nsnull;
-  if (rootFrame) {
-    ::DestroyDisplayItemDataForFrames(rootFrame);
-  }
-  aDocument->EnumerateFreezableElements(
-    nsObjectFrame::BeginSwapDocShells, nsnull);
-  aDocument->EnumerateSubDocuments(BeginSwapDocShellsForDocument, nsnull);
-  return PR_TRUE;
-}
-
-static nsIView*
-BeginSwapDocShellsForViews(nsIView* aSibling)
-{
-  // Collect the removed sibling views in reverse order in 'removedViews'.
-  nsIView* removedViews = nsnull;
-  while (aSibling) {
-    nsIDocument* doc = ::GetDocumentFromView(aSibling);
-    if (doc) {
-      ::BeginSwapDocShellsForDocument(doc, nsnull);
-    }
-    nsIView* next = aSibling->GetNextSibling();
-    aSibling->GetViewManager()->RemoveChild(aSibling);
-    aSibling->SetNextSibling(removedViews);
-    removedViews = aSibling;
-    aSibling = next;
-  }
-  return removedViews;
-}
-
-static void
-InsertViewsInReverseOrder(nsIView* aSibling, nsIView* aParent)
-{
-  NS_PRECONDITION(aParent, "");
-  NS_PRECONDITION(!aParent->GetFirstChild(), "inserting into non-empty list");
-
-  nsIViewManager* vm = aParent->GetViewManager();
-  while (aSibling) {
-    nsIView* next = aSibling->GetNextSibling();
-    aSibling->SetNextSibling(nsnull);
-    // PR_TRUE means 'after' in document order which is 'before' in view order,
-    // so this call prepends the child, thus reversing the siblings as we go.
-    vm->InsertChild(aParent, aSibling, nsnull, PR_TRUE);
-    aSibling = next;
-  }
-}
-
 nsresult
 nsSubDocumentFrame::BeginSwapDocShells(nsIFrame* aOther)
 {
@@ -882,54 +799,21 @@ nsSubDocumentFrame::BeginSwapDocShells(nsIFrame* aOther)
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
-  if (mInnerView && other->mInnerView) {
-    nsIView* ourSubdocViews = mInnerView->GetFirstChild();
-    nsIView* ourRemovedViews = ::BeginSwapDocShellsForViews(ourSubdocViews);
-    nsIView* otherSubdocViews = other->mInnerView->GetFirstChild();
-    nsIView* otherRemovedViews = ::BeginSwapDocShellsForViews(otherSubdocViews);
+  HideViewer();
+  other->HideViewer();
 
-    ::InsertViewsInReverseOrder(ourRemovedViews, other->mInnerView);
-    ::InsertViewsInReverseOrder(otherRemovedViews, mInnerView);
-  }
   mFrameLoader.swap(other->mFrameLoader);
   return NS_OK;
 }
 
-static PRBool
-EndSwapDocShellsForDocument(nsIDocument* aDocument, void*)
-{
-  NS_PRECONDITION(aDocument, "");
-
-  aDocument->EnumerateFreezableElements(
-    nsObjectFrame::EndSwapDocShells, nsnull);
-  aDocument->EnumerateSubDocuments(EndSwapDocShellsForDocument, nsnull);
-  return PR_TRUE;
-}
-
-static void
-EndSwapDocShellsForViews(nsIView* aSibling)
-{
-  for ( ; aSibling; aSibling = aSibling->GetNextSibling()) {
-    nsIDocument* doc = ::GetDocumentFromView(aSibling);
-    if (doc) {
-      ::EndSwapDocShellsForDocument(doc, nsnull);
-    }
-  }
-}
-
 void
 nsSubDocumentFrame::EndSwapDocShells(nsIFrame* aOther)
 {
   nsSubDocumentFrame* other = static_cast<nsSubDocumentFrame*>(aOther);
   nsWeakFrame weakThis(this);
   nsWeakFrame weakOther(aOther);
-
-  if (mInnerView) {
-    ::EndSwapDocShellsForViews(mInnerView->GetFirstChild());
-  }
-  if (other->mInnerView) {
-    ::EndSwapDocShellsForViews(other->mInnerView->GetFirstChild());
-  }
+  ShowViewer();
+  other->ShowViewer();
 
   // Now make sure we reflow both frames, in case their contents
   // determine their size.
diff --git a/view/public/nsIView.h b/view/public/nsIView.h
index ff556ea086e4..8d5245d89f67 100644
--- a/view/public/nsIView.h
+++ b/view/public/nsIView.h
@@ -248,9 +248,6 @@ public:
    * @result view's next sibling
    */
   nsIView* GetNextSibling() const { return reinterpret_cast<nsIView*>(mNextSibling); }
-  void SetNextSibling(nsIView *aSibling) {
-    mNextSibling = reinterpret_cast<nsView*>(aSibling);
-  }
 
   /**
    * Set the view's link to client owned data.
diff --git a/widget/src/gtk2/nsWindow.cpp b/widget/src/gtk2/nsWindow.cpp
index d49d842f694c..9ce6d5f7c8e9 100644
--- a/widget/src/gtk2/nsWindow.cpp
+++ b/widget/src/gtk2/nsWindow.cpp
@@ -21,7 +21,7 @@
  * are Copyright (C) 2001 the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
- *   Mats Palmgren <matspal@gmail.com>
+ *   Mats Palmgren <mats.palmgren@bredband.net>
  *   Masayuki Nakano <masayuki@d-toybox.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
@@ -890,7 +890,7 @@ nsWindow::SetParent(nsIWidget *aNewParent)
             SetWidgetForHierarchy(mGdkWindow, oldContainer, newContainer);
         }
 
-        gdk_window_reparent(mGdkWindow, newParentWindow, mBounds.x, mBounds.y);
+        gdk_window_reparent(mGdkWindow, newParentWindow, 0, 0);
     }
 
     PRBool parentHasMappedToplevel =

From 04e81fb21269ba634b9aa8c9dc6243eec7e83753 Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Fri, 3 Sep 2010 13:59:17 -0400
Subject: [PATCH 106/222] Bug 593093 - Don't use OpenGL on Windows unless
 layers.prefer-opengl is true. r=bas a=blocking2.0:beta6+

---
 widget/src/windows/nsWindow.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index 5538d41a2e36..c864bdcf712f 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -3209,7 +3209,7 @@ nsWindow::GetLayerManager()
         }
       }
 #endif
-      if (!mLayerManager) {
+      if (!mLayerManager && preferOpenGL) {
         nsRefPtr<mozilla::layers::LayerManagerOGL> layerManager =
           new mozilla::layers::LayerManagerOGL(this);
         if (layerManager->Initialize()) {

From dbb9a82fc29ad3d242eb62908ecb05faba2ef7bf Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Fri, 3 Sep 2010 14:01:05 -0400
Subject: [PATCH 107/222] Bug 590841 - Add the ability for a DOM window to let
 us know when it's accelerated, and use that value in about:support. r=gavin
 sr=roc a=blocking2.0:beta6+

---
 dom/base/nsDOMWindowUtils.cpp                 | 20 +++++++++++
 dom/interfaces/base/nsIDOMWindowUtils.idl     |  9 ++++-
 gfx/layers/Layers.h                           |  5 +++
 gfx/layers/basic/BasicLayers.h                |  1 +
 gfx/layers/d3d9/LayerManagerD3D9.h            |  1 +
 gfx/layers/ipc/ShadowLayers.h                 |  2 ++
 gfx/layers/opengl/LayerManagerOGL.h           |  1 +
 toolkit/content/aboutSupport.js               | 36 ++++++++++++++++---
 .../chrome/global/aboutSupport.properties     |  4 +++
 9 files changed, 74 insertions(+), 5 deletions(-)

diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 62c5518abd2f..9104317ea6b2 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -76,6 +76,10 @@
 
 #include "jsobj.h"
 
+#include "Layers.h"
+
+using namespace mozilla::layers;
+
 static PRBool IsUniversalXPConnectCapable()
 {
   PRBool hasCap = PR_FALSE;
@@ -1464,3 +1468,19 @@ nsDOMWindowUtils::ResumeTimeouts()
 
   return NS_OK;
 }
+
+NS_IMETHODIMP
+nsDOMWindowUtils::GetLayerManagerType(nsAString& aType)
+{
+  nsCOMPtr<nsIWidget> widget = GetWidget();
+  if (!widget)
+    return NS_ERROR_FAILURE;
+
+  LayerManager *mgr = widget->GetLayerManager();
+  if (!mgr)
+    return NS_ERROR_FAILURE;
+
+  mgr->GetBackendName(aType);
+
+  return NS_OK;
+}
diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index a89da9ca6d95..ac512218b67b 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -53,7 +53,7 @@ interface nsIDOMEvent;
 interface nsITransferable;
 interface nsIQueryContentEventResult;
 
-[scriptable, uuid(59e6f1be-ba0e-4102-9fe5-d5af8777742a)]
+[scriptable, uuid(8430e730-a085-421e-bb72-39fcf73fe57b)]
 interface nsIDOMWindowUtils : nsISupports {
 
   /**
@@ -711,4 +711,11 @@ interface nsIDOMWindowUtils : nsISupports {
    */
   void suspendTimeouts();
   void resumeTimeouts();
+
+  /**
+   * What type of layer manager the widget associated with this window is
+   * using. "Basic" is unaccelerated; other types are accelerated. Throws an
+   * error if there is no widget associated with this window.
+   */
+  readonly attribute AString layerManagerType;
 };
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index fe1e996f2979..44275da7102c 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -321,6 +321,11 @@ public:
    */
   virtual LayersBackend GetBackendType() = 0;
 
+  /**
+   * Return the name of the layer manager's backend.
+   */
+  virtual void GetBackendName(nsAString& aName) = 0;
+
   /**
    * This setter can be used anytime. The user data for all keys is
    * initially null. Ownership pases to the layer manager.
diff --git a/gfx/layers/basic/BasicLayers.h b/gfx/layers/basic/BasicLayers.h
index b7890918565e..626437a94807 100644
--- a/gfx/layers/basic/BasicLayers.h
+++ b/gfx/layers/basic/BasicLayers.h
@@ -142,6 +142,7 @@ public:
   { return NULL; }
 
   virtual LayersBackend GetBackendType() { return LAYERS_BASIC; }
+  virtual void GetBackendName(nsAString& name) { name.AssignLiteral("Basic"); }
 
 #ifdef DEBUG
   PRBool InConstruction() { return mPhase == PHASE_CONSTRUCTION; }
diff --git a/gfx/layers/d3d9/LayerManagerD3D9.h b/gfx/layers/d3d9/LayerManagerD3D9.h
index f9a3e5b7661b..cd2d0b6ec01f 100644
--- a/gfx/layers/d3d9/LayerManagerD3D9.h
+++ b/gfx/layers/d3d9/LayerManagerD3D9.h
@@ -118,6 +118,7 @@ public:
   virtual already_AddRefed<ImageContainer> CreateImageContainer();
 
   virtual LayersBackend GetBackendType() { return LAYERS_D3D9; }
+  virtual void GetBackendName(nsAString& name) { name.AssignLiteral("Direct3D 9"); }
 
   /*
    * Helper methods.
diff --git a/gfx/layers/ipc/ShadowLayers.h b/gfx/layers/ipc/ShadowLayers.h
index 447b88a1d3a6..4e7ec62cd018 100644
--- a/gfx/layers/ipc/ShadowLayers.h
+++ b/gfx/layers/ipc/ShadowLayers.h
@@ -252,6 +252,8 @@ public:
     mForwarder = aForwarder;
   }
 
+  virtual void GetBackendName(nsAString& name) { name.AssignLiteral("Shadow"); }
+
   void DestroySharedSurface(gfxSharedImageSurface* aSurface);
 
   /** CONSTRUCTION PHASE ONLY */
diff --git a/gfx/layers/opengl/LayerManagerOGL.h b/gfx/layers/opengl/LayerManagerOGL.h
index e7d731ac5ba3..692d7fdeb3ab 100644
--- a/gfx/layers/opengl/LayerManagerOGL.h
+++ b/gfx/layers/opengl/LayerManagerOGL.h
@@ -136,6 +136,7 @@ public:
   virtual already_AddRefed<ImageContainer> CreateImageContainer();
 
   virtual LayersBackend GetBackendType() { return LAYERS_OPENGL; }
+  virtual void GetBackendName(nsAString& name) { name.AssignLiteral("OpenGL"); }
 
   /**
    * Image Container management.
diff --git a/toolkit/content/aboutSupport.js b/toolkit/content/aboutSupport.js
index acc0b1648df0..91fe9b73f9f5 100644
--- a/toolkit/content/aboutSupport.js
+++ b/toolkit/content/aboutSupport.js
@@ -64,7 +64,9 @@ const PREFS_WHITELIST = [
   "extensions.lastAppVersion",
   "font.",
   "general.useragent.",
-  "gfx.color_management.mode",
+  "gfx.",
+  "mozilla.widget.render-mode",
+  "layers.",
   "javascript.",
   "keyword.",
   "layout.css.dpi",
@@ -149,12 +151,14 @@ function populateGraphicsSection() {
     return elem;
   }
   
+  let SBS = Cc["@mozilla.org/intl/stringbundle;1"].getService(Ci.nsIStringBundleService);
+  let bundle = SBS.createBundle("chrome://global/locale/aboutSupport.properties");
+  let graphics_tbody = document.getElementById("graphics-tbody");
+
   try {
     // nsIGfxInfo is currently only implemented on Windows
     let gfxInfo = Cc["@mozilla.org/gfx/info;1"].getService(Ci.nsIGfxInfo);
     let trGraphics = [];
-    var SBS = Cc["@mozilla.org/intl/stringbundle;1"].getService(Ci.nsIStringBundleService);
-    var bundle = SBS.createBundle("chrome://global/locale/aboutSupport.properties");
     trGraphics.push(createParentElement("tr", [
       createHeader(bundle.GetStringFromName("adapterDescription")),
       createElement("td", gfxInfo.adapterDescription),
@@ -194,11 +198,35 @@ function populateGraphicsSection() {
       createElement("td", gfxInfo.DWriteEnabled),
     ]));
 
-    appendChildren(document.getElementById("graphics-tbody"), trGraphics);
+    appendChildren(graphics_tbody, trGraphics);
 
   } catch (e) {
   }
 
+  let ww = Cc["@mozilla.org/embedcomp/window-watcher;1"]
+    .getService(Ci.nsIWindowWatcher);
+  let windows = ww.getWindowEnumerator();
+  let acceleratedWindows = 0;
+  let totalWindows = 0;
+  let mgrType;
+  while (windows.hasMoreElements()) {
+    totalWindows++;
+
+    let awindow = windows.getNext().QueryInterface(Ci.nsIInterfaceRequestor);
+    let windowutils = awindow.getInterface(Ci.nsIDOMWindowUtils);
+    if (windowutils.layerManagerType != "Basic") {
+      acceleratedWindows++;
+      mgrType = windowutils.layerManagerType;
+    }
+  }
+
+  let msg = acceleratedWindows + "/" + totalWindows;
+  if (acceleratedWindows)
+    msg += " " + mgrType;
+
+  let header = createHeader(bundle.GetStringFromName("acceleratedLayersEnabled"));
+
+  appendChildren(graphics_tbody, [ header, createElement("td", msg) ]);
 }
 
 
diff --git a/toolkit/locales/en-US/chrome/global/aboutSupport.properties b/toolkit/locales/en-US/chrome/global/aboutSupport.properties
index f5f873196399..dac8679524e7 100644
--- a/toolkit/locales/en-US/chrome/global/aboutSupport.properties
+++ b/toolkit/locales/en-US/chrome/global/aboutSupport.properties
@@ -1,6 +1,10 @@
 # LOCALIZATION NOTE In the following string, "Direct2D" is a proper noun and should not be translated.
 # Feel free to leave english strings if there are no good translations, these are only used in about:support
 
+# LOCALIZATION NOTE: This can be localized with a more generic term, like
+# "graphics acceleration."
+acceleratedLayersEnabled = GPU Accelerated Layers Enabled
+
 direct2DEnabled = Direct2D Enabled
 directWriteEnabled = DirectWrite Enabled
 adapterDescription = Adapter Description

From bf190e3ce411dabfe68c4d1265f3b3ca7c160366 Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Fri, 3 Sep 2010 14:02:23 -0400
Subject: [PATCH 108/222] Bug 590844 - Add layersGPUAccelerated to the reftest
 sandbox when we're using accelerated layers. r=dbaron a=blocking2.0:beta6+

---
 layout/tools/reftest/reftest.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index b7328c68f330..8bd2c47285b6 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -342,6 +342,11 @@ function BuildConditionSandbox(aURL) {
     } catch(e) {
       sandbox.d2d = false;
     }
+
+    if (gWindowUtils && gWindowUtils.layerManagerType == "Basic")
+      sandbox.layersGPUAccelerated = true;
+    else
+      sandbox.layersGPUAccelerated = false;
  
     // Shortcuts for widget toolkits.
     sandbox.cocoaWidget = xr.widgetToolkit == "cocoa";

From 95051089f93c79541f58adb6049012139de6a5b9 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Fri, 3 Sep 2010 14:07:59 -0400
Subject: [PATCH 109/222] b=593273, fix d3d9 layer manager crash on reftest
 shutdown, r=bas a=b

---
 gfx/layers/d3d9/ThebesLayerD3D9.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/gfx/layers/d3d9/ThebesLayerD3D9.cpp b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
index a82c1880c5d2..e7411023331c 100644
--- a/gfx/layers/d3d9/ThebesLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
@@ -57,7 +57,9 @@ ThebesLayerD3D9::ThebesLayerD3D9(LayerManagerD3D9 *aManager)
 
 ThebesLayerD3D9::~ThebesLayerD3D9()
 {
-  mD3DManager->deviceManager()->mThebesLayers.RemoveElement(this);
+  if (mD3DManager->deviceManager()) {
+    mD3DManager->deviceManager()->mThebesLayers.RemoveElement(this);
+  }
 }
 
 /**

From 3f09edc02c5d1823fef12af894073601d9f4337f Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Fri, 3 Sep 2010 14:08:23 -0400
Subject: [PATCH 110/222] Bug 591150 - Move MOZ_ACCELERATED usage to widget
 instantiation. r=bas,roc a=blocking2.0:beta6+

---
 widget/src/windows/nsWindow.cpp       | 4 ++++
 widget/src/xpwidgets/nsBaseWidget.cpp | 4 ++++
 xpfe/appshell/src/nsXULWindow.cpp     | 8 +-------
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index c864bdcf712f..5db06086cdc0 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -3189,6 +3189,10 @@ nsWindow::GetLayerManager()
                          &preferOpenGL);
     }
 
+    const char *acceleratedEnv = PR_GetEnv("MOZ_ACCELERATED");
+    accelerateByDefault = accelerateByDefault ||
+                          (acceleratedEnv && (*acceleratedEnv != '0'));
+
     nsCOMPtr<nsIXULRuntime> xr = do_GetService("@mozilla.org/xre/runtime;1");
     PRBool safeMode = PR_FALSE;
     if (xr)
diff --git a/widget/src/xpwidgets/nsBaseWidget.cpp b/widget/src/xpwidgets/nsBaseWidget.cpp
index d78f979f9a6e..0975b9cf5370 100644
--- a/widget/src/xpwidgets/nsBaseWidget.cpp
+++ b/widget/src/xpwidgets/nsBaseWidget.cpp
@@ -773,6 +773,10 @@ LayerManager* nsBaseWidget::GetLayerManager()
                          &disableAcceleration);
     }
 
+    const char *acceleratedEnv = PR_GetEnv("MOZ_ACCELERATED");
+    accelerateByDefault = accelerateByDefault || 
+                          (acceleratedEnv && (*acceleratedEnv != '0'));
+
     nsCOMPtr<nsIXULRuntime> xr = do_GetService("@mozilla.org/xre/runtime;1");
     PRBool safeMode = PR_FALSE;
     if (xr)
diff --git a/xpfe/appshell/src/nsXULWindow.cpp b/xpfe/appshell/src/nsXULWindow.cpp
index b0f469163316..266539f8244c 100644
--- a/xpfe/appshell/src/nsXULWindow.cpp
+++ b/xpfe/appshell/src/nsXULWindow.cpp
@@ -1404,13 +1404,7 @@ void nsXULWindow::SyncAttributesToWidget()
 
   // "accelerated" attribute
   PRBool isAccelerated;
-  static const char *acceleratedEnv = PR_GetEnv("MOZ_ACCELERATED");
-  if (acceleratedEnv && *acceleratedEnv) {
-    isAccelerated = *acceleratedEnv != '0';
-    rv = NS_OK;
-  } else
-    rv = windowElement->HasAttribute(NS_LITERAL_STRING("accelerated"), &isAccelerated);
-
+  rv = windowElement->HasAttribute(NS_LITERAL_STRING("accelerated"), &isAccelerated);
   if (NS_SUCCEEDED(rv)) {
     mWindow->SetAcceleratedRendering(isAccelerated);
   }

From 4eb0616a316811c0391eca0652d01879d5c85ac6 Mon Sep 17 00:00:00 2001
From: Rob Campbell <rcampbell@mozilla.com>
Date: Fri, 3 Sep 2010 15:34:09 -0300
Subject: [PATCH 111/222] Bug 572038 - Create new Tree Panel for Inspector,
 r=gavin, a=blocking2.0

---
 browser/base/Makefile.in                      |    1 +
 browser/base/content/browser.xul              |   23 +-
 browser/base/content/domplate.jsm             | 1891 +++++++++++++++++
 browser/base/content/insideOutBox.js          |  639 ++++++
 browser/base/content/inspector.html           |   11 +
 browser/base/content/inspector.js             |  584 +++--
 browser/base/content/stylePanel.jsm           |    1 +
 browser/base/content/test/Makefile.in         |    6 +-
 .../test/browser_inspector_domPanel.js        |   14 +-
 .../test/browser_inspector_highlighter.js     |   10 +-
 .../test/browser_inspector_iframeTest.js      |   28 +-
 .../test/browser_inspector_initialization.js  |   22 +-
 .../test/browser_inspector_scrolling.js       |   10 +-
 .../test/browser_inspector_stylePanel.js      |   10 +-
 .../test/browser_inspector_tab_switch.js      |   65 +-
 .../browser_inspector_treePanel_input.html    |   33 +
 .../browser_inspector_treePanel_output.js     |  123 ++
 .../browser_inspector_treePanel_result.html   |    8 +
 .../test/browser_inspector_treeSelection.js   |   12 +-
 browser/base/content/test/domplate_test.js    |   84 +
 browser/base/jar.mn                           |    1 +
 .../themes/gnomestripe/browser/inspector.css  |  377 ++++
 browser/themes/gnomestripe/browser/jar.mn     |    1 +
 .../themes/pinstripe/browser/inspector.css    |  365 ++++
 browser/themes/pinstripe/browser/jar.mn       |    1 +
 .../themes/winstripe/browser/inspector.css    |  350 +++
 browser/themes/winstripe/browser/jar.mn       |    1 +
 27 files changed, 4315 insertions(+), 356 deletions(-)
 create mode 100644 browser/base/content/domplate.jsm
 create mode 100644 browser/base/content/insideOutBox.js
 create mode 100644 browser/base/content/inspector.html
 create mode 100644 browser/base/content/test/browser_inspector_treePanel_input.html
 create mode 100644 browser/base/content/test/browser_inspector_treePanel_output.js
 create mode 100644 browser/base/content/test/browser_inspector_treePanel_result.html
 create mode 100644 browser/base/content/test/domplate_test.js
 create mode 100644 browser/themes/gnomestripe/browser/inspector.css
 create mode 100644 browser/themes/pinstripe/browser/inspector.css
 create mode 100644 browser/themes/winstripe/browser/inspector.css

diff --git a/browser/base/Makefile.in b/browser/base/Makefile.in
index 827ed2bc7eb3..1933342e952d 100644
--- a/browser/base/Makefile.in
+++ b/browser/base/Makefile.in
@@ -56,6 +56,7 @@ endif
 EXTRA_JS_MODULES = \
 	content/openLocationLastURL.jsm \
 	content/NetworkPrioritizer.jsm \
+	content/domplate.jsm \
 	content/stylePanel.jsm \
 	$(NULL)
 
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index 32b7fdddf6ad..540a67827275 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -230,13 +230,15 @@
            onmousemove="InspectorUI.highlighter.handleMouseMove(event);"
            onMozMousePixelScroll="InspectorUI.highlighter.handlePixelScroll(event);"/>
 
-    <panel id="inspector-panel"
+    <panel id="inspector-tree-panel"
            orient="vertical"
            hidden="true"
            ignorekeys="true"
            noautofocus="true"
            noautohide="true"
            titlebar="normal"
+           close="true"
+           onpopuphiding="InspectorUI.closeInspectorUI(true);"
            label="&inspectPanelTitle.label;">
       <toolbar id="inspector-toolbar"
                nowindowdrag="true">
@@ -266,20 +268,11 @@
                        class="toolbarbutton-text"
                        oncommand="InspectorUI.toggleDOMPanel();"/>
       </toolbar>
-      <tree id="inspector-tree" class="plain"
-            seltype="single"
-            treelines="true"
-            onselect="InspectorUI.onTreeSelected()"
-            flex="1">
-        <treecols>
-          <treecol id="colNodeName" label="nodeName" primary="true"
-                   persist="width,hidden,ordinal" flex="1"/>
-          <splitter class="tree-splitter"/>
-          <treecol id="colNodeValue" label="nodeValue"
-                   persist="width,hidden,ordinal" flex="1"/>
-        </treecols>
-        <treechildren id="inspector-tree-body"/>
-      </tree>
+      <iframe id="inspector-tree-iframe"
+               flex="1"
+               type="content"
+               src="chrome://browser/content/inspector.html"
+               onclick="InspectorUI.onTreeClick(event);" />
       <hbox align="end">
         <spacer flex="1" />
         <resizer dir="bottomend" />
diff --git a/browser/base/content/domplate.jsm b/browser/base/content/domplate.jsm
new file mode 100644
index 000000000000..1493d9ec585c
--- /dev/null
+++ b/browser/base/content/domplate.jsm
@@ -0,0 +1,1891 @@
+/*
+ * Software License Agreement (BSD License)
+ *
+ * Copyright (c) 2007, Parakey Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use of this software in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * * Redistributions of source code must retain the above
+ *   copyright notice, this list of conditions and the
+ *   following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above
+ *   copyright notice, this list of conditions and the
+ *   following disclaimer in the documentation and/or other
+ *   materials provided with the distribution.
+ *
+ * * Neither the name of Parakey Inc. nor the names of its
+ *   contributors may be used to endorse or promote products
+ *   derived from this software without specific prior
+ *   written permission of Parakey Inc.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Creator:
+ *  Joe Hewitt
+ * Contributors:
+ *  John J. Barton (IBM Almaden)
+ *  Jan Odvarko (Mozilla Corp.)
+ *  Max Stepanov (Aptana Inc.)
+ *  Rob Campbell (Mozilla Corp.)
+ *  Hans Hillen (Paciello Group, Mozilla)
+ *  Curtis Bartley (Mozilla Corp.)
+ *  Mike Collins (IBM Almaden)
+ *  Kevin Decker
+ *  Mike Ratcliffe (Comartis AG)
+ *  Hernan Rodríguez Colmeiro
+ *  Austin Andrews
+ *  Christoph Dorn
+ *  Steven Roussey (AppCenter Inc, Network54)
+ * Firefox Port Contributors:
+ *  Rob Campbell
+ *  Julian Viereck
+ *  Mihai Sucan
+ */
+
+var EXPORTED_SYMBOLS = ["domplate", "HTMLTemplates", "domplateUtils"];
+
+const Ci = Components.interfaces;
+const Cu = Components.utils;
+
+const invisibleTags = {
+  "head": true,
+  "base": true,
+  "basefont": true,
+  "isindex": true,
+  "link": true,
+  "meta": true,
+  "script": true,
+  "style": true,
+  "title": true,
+};
+
+// End tags for void elements are forbidden
+// http://wiki.whatwg.org/wiki/HTML_vs._XHTML
+const selfClosingTags = {
+  "meta": 1,
+  "link": 1,
+  "area": 1,
+  "base": 1,
+  "col": 1,
+  "input": 1,
+  "img": 1,
+  "br": 1,
+  "hr": 1,
+  "param": 1,
+  "embed": 1
+};
+
+const reNotWhitespace = /[^\s]/;
+const showTextNodesWithWhitespace = false;
+
+var DOM = {};
+var domplateUtils = {};
+
+/**
+ * Utility function to allow outside caller to set a global scope within
+ * domplate's DOM object. Specifically for access to DOM constants and classes.
+ * @param aGlobal
+ *        The global object whose scope we wish to capture.
+ */
+domplateUtils.setDOM = function(aGlobal)
+{
+  DOM = aGlobal;
+  if (!aGlobal) {
+    womb = null;
+  }
+};
+
+/**
+ * main domplate constructor function.
+ */
+
+let domplate = function()
+{
+  let lastSubject;
+  for (let i = 0; i < arguments.length; ++i)
+    lastSubject = lastSubject ? copyObject(lastSubject, arguments[i]) : arguments[i];
+
+  for (let name in lastSubject) {
+    let val = lastSubject[name];
+    if (isTag(val))
+      val.tag.subject = lastSubject;
+  }
+
+  return lastSubject;
+};
+
+var womb = null;
+
+///////////////////////////////////////////////////////////////////////////
+//// Base functions
+
+function DomplateTag(tagName)
+{
+  this.tagName = tagName;
+}
+
+function DomplateEmbed()
+{
+}
+
+function DomplateLoop()
+{
+}
+
+///////////////////////////////////////////////////////////////////////////
+//// Definitions
+
+domplate.context = function(context, fn)
+{
+  let lastContext = domplate.lastContext;
+  domplate.topContext = context;
+  fn.apply(context);
+  domplate.topContext = lastContext;
+};
+
+domplate.TAG = function()
+{
+  let embed = new DomplateEmbed();
+  return embed.merge(arguments);
+};
+
+domplate.FOR = function()
+{
+  let loop = new DomplateLoop();
+  return loop.merge(arguments);
+};
+
+DomplateTag.prototype =
+{
+  /**
+   * Initializer for DOM templates. Called to create new Functions objects
+   * like TR, TD, OBJLINK, etc. See defineTag
+   * @param args keyword argments for the template, the {} brace stuff after
+   *        the tag name, eg TR({...}, TD(...
+   * @param oldTag a nested tag, eg the TD tag in TR({...}, TD(...
+   */
+  merge: function(args, oldTag)
+  {
+    if (oldTag)
+      this.tagName = oldTag.tagName;
+
+    this.context = oldTag ? oldTag.context : null;  // normally null on construction
+    this.subject = oldTag ? oldTag.subject : null;
+    this.attrs = oldTag ? copyObject(oldTag.attrs) : {};
+    this.classes = oldTag ? copyObject(oldTag.classes) : {};
+    this.props = oldTag ? copyObject(oldTag.props) : null;
+    this.listeners = oldTag ? copyArray(oldTag.listeners) : null;
+    this.children = oldTag ? copyArray(oldTag.children) : [];
+    this.vars = oldTag ? copyArray(oldTag.vars) : [];
+
+    let attrs = args.length ? args[0] : null;
+    let hasAttrs = typeof(attrs) == "object" && !isTag(attrs);
+
+    // Do not clear children, they can be copied from the oldTag.
+    //this.children = [];
+
+    if (domplate.topContext)
+      this.context = domplate.topContext;
+
+    if (args.length)
+      parseChildren(args, hasAttrs ? 1 : 0, this.vars, this.children);
+
+    if (hasAttrs)
+      this.parseAttrs(attrs);
+
+    return creator(this, DomplateTag);
+  },
+
+  /**
+   * Parse node attributes.
+   * @param args
+   *        Object of arguments to process.
+   */
+  parseAttrs: function(args)
+  {
+    for (let name in args) {
+      let val = parseValue(args[name]);
+      readPartNames(val, this.vars);
+
+      if (name.indexOf("on") == 0) {
+        let eventName = name.substr(2);
+        if (!this.listeners)
+          this.listeners = [];
+        this.listeners.push(eventName, val);
+      } else if (name[0] == "_") {
+        let propName = name.substr(1);
+        if (!this.props)
+          this.props = {};
+        this.props[propName] = val;
+      } else if (name[0] == "$") {
+        let className = name.substr(1);
+        if (!this.classes)
+          this.classes = {};
+        this.classes[className] = val;
+      } else {
+        if (name == "class" && this.attrs.hasOwnProperty(name))
+          this.attrs[name] += " " + val;
+        else
+          this.attrs[name] = val;
+      }
+    }
+  },
+
+  compile: function()
+  {
+    if (this.renderMarkup)
+      return;
+
+    this.compileMarkup();
+    this.compileDOM();
+  },
+
+  compileMarkup: function()
+  {
+    this.markupArgs = [];
+    let topBlock = [], topOuts = [], blocks = [],
+      info = {args: this.markupArgs, argIndex: 0};
+
+    this.generateMarkup(topBlock, topOuts, blocks, info);
+    this.addCode(topBlock, topOuts, blocks);
+
+    let fnBlock = ['(function (__code__, __context__, __in__, __out__'];
+    for (let i = 0; i < info.argIndex; ++i)
+      fnBlock.push(', s', i);
+    fnBlock.push(') {\n');
+
+    if (this.subject)
+      fnBlock.push('with (this) {\n');
+    if (this.context)
+      fnBlock.push('with (__context__) {\n');
+    fnBlock.push('with (__in__) {\n');
+
+    fnBlock.push.apply(fnBlock, blocks);
+
+    if (this.subject)
+      fnBlock.push('}\n');
+    if (this.context)
+      fnBlock.push('}\n');
+
+    fnBlock.push('}})\n');
+
+    function __link__(tag, code, outputs, args)
+    {
+      tag.tag.compile();
+
+      let tagOutputs = [];
+      let markupArgs = [code, tag.tag.context, args, tagOutputs];
+      markupArgs.push.apply(markupArgs, tag.tag.markupArgs);
+      tag.tag.renderMarkup.apply(tag.tag.subject, markupArgs);
+
+      outputs.push(tag);
+      outputs.push(tagOutputs);
+    }
+
+    function __escape__(value)
+    {
+      function replaceChars(ch)
+      {
+        switch (ch) {
+          case "<":
+            return "&lt;";
+          case ">":
+            return "&gt;";
+          case "&":
+            return "&amp;";
+          case "'":
+            return "&#39;";
+          case '"':
+            return "&quot;";
+        }
+        return "?";
+      };
+      return String(value).replace(/[<>&"']/g, replaceChars);
+    }
+
+    function __loop__(iter, outputs, fn)
+    {
+      let iterOuts = [];
+      outputs.push(iterOuts);
+
+      if (iter instanceof Array)
+        iter = new ArrayIterator(iter);
+
+      try {
+        while (1) {
+          let value = iter.next();
+          let itemOuts = [0, 0];
+          iterOuts.push(itemOuts);
+          fn.apply(this, [value, itemOuts]);
+        }
+      } catch (exc) {
+        if (exc != StopIteration)
+          throw exc;
+      }
+    }
+
+    let js = fnBlock.join("");
+    this.renderMarkup = eval(js);
+  },
+
+  getVarNames: function(args)
+  {
+    if (this.vars)
+      args.push.apply(args, this.vars);
+
+    for (let i = 0; i < this.children.length; ++i) {
+      let child = this.children[i];
+      if (isTag(child))
+        child.tag.getVarNames(args);
+      else if (child instanceof Parts) {
+        for (let i = 0; i < child.parts.length; ++i) {
+          if (child.parts[i] instanceof Variable) {
+            let name = child.parts[i].name;
+            let names = name.split(".");
+            args.push(names[0]);
+          }
+        }
+      }
+    }
+  },
+
+  generateMarkup: function(topBlock, topOuts, blocks, info)
+  {
+    topBlock.push(',"<', this.tagName, '"');
+
+    for (let name in this.attrs) {
+      if (name != "class") {
+        let val = this.attrs[name];
+        topBlock.push(', " ', name, '=\\""');
+        addParts(val, ',', topBlock, info, true);
+        topBlock.push(', "\\""');
+      }
+    }
+
+    if (this.listeners) {
+      for (let i = 0; i < this.listeners.length; i += 2)
+        readPartNames(this.listeners[i+1], topOuts);
+    }
+
+    if (this.props) {
+      for (let name in this.props)
+        readPartNames(this.props[name], topOuts);
+    }
+
+    if (this.attrs.hasOwnProperty("class") || this.classes) {
+      topBlock.push(', " class=\\""');
+      if (this.attrs.hasOwnProperty("class"))
+        addParts(this.attrs["class"], ',', topBlock, info, true);
+      topBlock.push(', " "');
+      for (let name in this.classes) {
+        topBlock.push(', (');
+        addParts(this.classes[name], '', topBlock, info);
+        topBlock.push(' ? "', name, '" + " " : "")');
+      }
+      topBlock.push(', "\\""');
+    }
+    topBlock.push(',">"');
+
+    this.generateChildMarkup(topBlock, topOuts, blocks, info);
+    topBlock.push(',"</', this.tagName, '>"');
+  },
+
+  generateChildMarkup: function(topBlock, topOuts, blocks, info)
+  {
+    for (let i = 0; i < this.children.length; ++i) {
+      let child = this.children[i];
+      if (isTag(child))
+        child.tag.generateMarkup(topBlock, topOuts, blocks, info);
+      else
+        addParts(child, ',', topBlock, info, true);
+    }
+  },
+
+  addCode: function(topBlock, topOuts, blocks)
+  {
+    if (topBlock.length)
+      blocks.push('__code__.push(""', topBlock.join(""), ');\n');
+    if (topOuts.length)
+      blocks.push('__out__.push(', topOuts.join(","), ');\n');
+    topBlock.splice(0, topBlock.length);
+    topOuts.splice(0, topOuts.length);
+  },
+
+  addLocals: function(blocks)
+  {
+    let varNames = [];
+    this.getVarNames(varNames);
+
+    let map = {};
+    for (let i = 0; i < varNames.length; ++i) {
+      let name = varNames[i];
+      if ( map.hasOwnProperty(name) )
+        continue;
+
+      map[name] = 1;
+      let names = name.split(".");
+      blocks.push('var ', names[0] + ' = ' + '__in__.' + names[0] + ';\n');
+    }
+  },
+
+  compileDOM: function()
+  {
+    let path = [];
+    let blocks = [];
+    this.domArgs = [];
+    path.embedIndex = 0;
+    path.loopIndex = 0;
+    path.staticIndex = 0;
+    path.renderIndex = 0;
+    let nodeCount = this.generateDOM(path, blocks, this.domArgs);
+
+    let fnBlock = ['(function (root, context, o'];
+
+    for (let i = 0; i < path.staticIndex; ++i)
+      fnBlock.push(', ', 's'+i);
+
+    for (let i = 0; i < path.renderIndex; ++i)
+      fnBlock.push(', ', 'd'+i);
+
+    fnBlock.push(') {\n');
+    for (let i = 0; i < path.loopIndex; ++i)
+      fnBlock.push('var l', i, ' = 0;\n');
+    for (let i = 0; i < path.embedIndex; ++i)
+      fnBlock.push('var e', i, ' = 0;\n');
+
+    if (this.subject)
+      fnBlock.push('with (this) {\n');
+    if (this.context)
+      fnBlock.push('with (context) {\n');
+
+    fnBlock.push(blocks.join(""));
+
+    if (this.subject)
+      fnBlock.push('}\n');
+    if (this.context)
+      fnBlock.push('}\n');
+
+    fnBlock.push('return ', nodeCount, ';\n');
+    fnBlock.push('})\n');
+
+    function __bind__(object, fn)
+    {
+      return function(event) { return fn.apply(object, [event]); }
+    }
+
+    function __link__(node, tag, args)
+    {
+      if (!tag || !tag.tag)
+        return;
+
+      tag.tag.compile();
+
+      let domArgs = [node, tag.tag.context, 0];
+      domArgs.push.apply(domArgs, tag.tag.domArgs);
+      domArgs.push.apply(domArgs, args);
+
+      return tag.tag.renderDOM.apply(tag.tag.subject, domArgs);
+    }
+
+    function __loop__(iter, fn)
+    {
+      let nodeCount = 0;
+      for (let i = 0; i < iter.length; ++i) {
+        iter[i][0] = i;
+        iter[i][1] = nodeCount;
+        nodeCount += fn.apply(this, iter[i]);
+      }
+      return nodeCount;
+    }
+
+    function __path__(parent, offset)
+    {
+      let root = parent;
+
+      for (let i = 2; i < arguments.length; ++i) {
+        let index = arguments[i];
+        if (i == 3)
+          index += offset;
+
+        if (index == -1)
+          parent = parent.parentNode;
+        else
+          parent = parent.childNodes[index];
+      }
+
+      return parent;
+    }
+    let js = fnBlock.join("");
+    // Exceptions on this line are often in the eval
+    this.renderDOM = eval(js);
+  },
+
+  generateDOM: function(path, blocks, args)
+  {
+    if (this.listeners || this.props)
+      this.generateNodePath(path, blocks);
+
+    if (this.listeners) {
+      for (let i = 0; i < this.listeners.length; i += 2) {
+        let val = this.listeners[i+1];
+        let arg = generateArg(val, path, args);
+        blocks.push('node.addEventListener("', this.listeners[i],
+          '", __bind__(this, ', arg, '), false);\n');
+      }
+    }
+
+    if (this.props) {
+      for (let name in this.props) {
+        let val = this.props[name];
+        let arg = generateArg(val, path, args);
+        blocks.push('node.', name, ' = ', arg, ';\n');
+      }
+    }
+
+    this.generateChildDOM(path, blocks, args);
+    return 1;
+  },
+
+  generateNodePath: function(path, blocks)
+  {
+    blocks.push("var node = __path__(root, o");
+    for (let i = 0; i < path.length; ++i)
+      blocks.push(",", path[i]);
+    blocks.push(");\n");
+  },
+
+  generateChildDOM: function(path, blocks, args)
+  {
+    path.push(0);
+    for (let i = 0; i < this.children.length; ++i) {
+      let child = this.children[i];
+      if (isTag(child))
+        path[path.length - 1] += '+' + child.tag.generateDOM(path, blocks, args);
+      else
+        path[path.length - 1] += '+1';
+    }
+    path.pop();
+  },
+
+  /*
+   * We are just hiding from javascript.options.strict. For some reasons it's
+   * ok if we return undefined here.
+   * @return null or undefined or possibly a context.
+   */
+  getContext: function()
+  {
+    return this.context;
+  }
+};
+
+// * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
+
+DomplateEmbed.prototype = copyObject(DomplateTag.prototype,
+{
+  merge: function(args, oldTag)
+  {
+    this.value = oldTag ? oldTag.value : parseValue(args[0]);
+    this.attrs = oldTag ? oldTag.attrs : {};
+    this.vars = oldTag ? copyArray(oldTag.vars) : [];
+
+    let attrs = args[1];
+    for (let name in attrs) {
+      let val = parseValue(attrs[name]);
+      this.attrs[name] = val;
+      readPartNames(val, this.vars);
+    }
+
+    return creator(this, DomplateEmbed);
+  },
+
+  getVarNames: function(names)
+  {
+    if (this.value instanceof Parts)
+      names.push(this.value.parts[0].name);
+
+    if (this.vars)
+      names.push.apply(names, this.vars);
+  },
+
+  generateMarkup: function(topBlock, topOuts, blocks, info)
+  {
+    this.addCode(topBlock, topOuts, blocks);
+
+    blocks.push('__link__(');
+    addParts(this.value, '', blocks, info);
+    blocks.push(', __code__, __out__, {\n');
+
+    let lastName = null;
+    for (let name in this.attrs) {
+      if (lastName)
+        blocks.push(',');
+      lastName = name;
+
+      let val = this.attrs[name];
+      blocks.push('"', name, '":');
+      addParts(val, '', blocks, info);
+    }
+
+    blocks.push('});\n');
+  },
+
+  generateDOM: function(path, blocks, args)
+  {
+    let embedName = 'e' + path.embedIndex++;
+
+    this.generateNodePath(path, blocks);
+
+    let valueName = 'd' + path.renderIndex++;
+    let argsName = 'd' + path.renderIndex++;
+    blocks.push(embedName + ' = __link__(node, ', valueName, ', ',
+      argsName, ');\n');
+
+    return embedName;
+  }
+});
+
+// * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
+
+DomplateLoop.prototype = copyObject(DomplateTag.prototype,
+{
+  merge: function(args, oldTag)
+  {
+    this.isLoop = true;
+    this.varName = oldTag ? oldTag.varName : args[0];
+    this.iter = oldTag ? oldTag.iter : parseValue(args[1]);
+    this.vars = [];
+
+    this.children = oldTag ? copyArray(oldTag.children) : [];
+
+    let offset = Math.min(args.length, 2);
+    parseChildren(args, offset, this.vars, this.children);
+
+    return creator(this, DomplateLoop);
+  },
+
+  getVarNames: function(names)
+  {
+    if (this.iter instanceof Parts)
+      names.push(this.iter.parts[0].name);
+
+    DomplateTag.prototype.getVarNames.apply(this, [names]);
+  },
+
+  generateMarkup: function(topBlock, topOuts, blocks, info)
+  {
+    this.addCode(topBlock, topOuts, blocks);
+
+    let iterName;
+    if (this.iter instanceof Parts) {
+      let part = this.iter.parts[0];
+      iterName = part.name;
+
+      if (part.format) {
+        for (let i = 0; i < part.format.length; ++i)
+          iterName = part.format[i] + "(" + iterName + ")";
+      }
+    } else
+      iterName = this.iter;
+
+    blocks.push('__loop__.apply(this, [', iterName, ', __out__, function(', this.varName, ', __out__) {\n');
+    this.generateChildMarkup(topBlock, topOuts, blocks, info);
+    this.addCode(topBlock, topOuts, blocks);
+    blocks.push('}]);\n');
+  },
+
+  generateDOM: function(path, blocks, args)
+  {
+    let iterName = 'd' + path.renderIndex++;
+    let counterName = 'i' + path.loopIndex;
+    let loopName = 'l' + path.loopIndex++;
+
+    if (!path.length)
+      path.push(-1, 0);
+
+    let preIndex = path.renderIndex;
+    path.renderIndex = 0;
+
+    let nodeCount = 0;
+
+    let subBlocks = [];
+    let basePath = path[path.length-1];
+    for (let i = 0; i < this.children.length; ++i) {
+      path[path.length - 1] = basePath + '+' + loopName + '+' + nodeCount;
+
+      let child = this.children[i];
+      if (isTag(child))
+        nodeCount += '+' + child.tag.generateDOM(path, subBlocks, args);
+      else
+        nodeCount += '+1';
+    }
+
+    path[path.length - 1] = basePath + '+' + loopName;
+
+    blocks.push(loopName,' = __loop__.apply(this, [',
+      iterName, ', function(', counterName, ',', loopName);
+    for (let i = 0; i < path.renderIndex; ++i)
+      blocks.push(',d' + i);
+    blocks.push(') {\n');
+    blocks.push(subBlocks.join(""));
+    blocks.push('return ', nodeCount, ';\n');
+    blocks.push('}]);\n');
+
+    path.renderIndex = preIndex;
+
+    return loopName;
+  }
+});
+
+///////////////////////////////////////////////////////////////////////////
+
+function Variable(name, format)
+{
+  this.name = name;
+  this.format = format;
+}
+
+function Parts(parts)
+{
+  this.parts = parts;
+}
+
+///////////////////////////////////////////////////////////////////////////
+
+function parseParts(str)
+{
+  let re = /\$([_A-Za-z][_A-Za-z0-9.|]*)/g;
+  let index = 0;
+  let parts = [];
+
+  let m;
+  while (m = re.exec(str)) {
+    let pre = str.substr(index, (re.lastIndex-m[0].length)-index);
+    if (pre)
+      parts.push(pre);
+
+    let expr = m[1].split("|");
+    parts.push(new Variable(expr[0], expr.slice(1)));
+    index = re.lastIndex;
+  }
+
+  if (!index)
+    return str;
+
+  let post = str.substr(index);
+  if (post)
+    parts.push(post);
+
+  return new Parts(parts);
+}
+
+function parseValue(val)
+{
+  return typeof(val) == 'string' ? parseParts(val) : val;
+}
+
+function parseChildren(args, offset, vars, children)
+{
+  for (let i = offset; i < args.length; ++i) {
+    let val = parseValue(args[i]);
+    children.push(val);
+    readPartNames(val, vars);
+  }
+}
+
+function readPartNames(val, vars)
+{
+  if (val instanceof Parts) {
+    for (let i = 0; i < val.parts.length; ++i) {
+      let part = val.parts[i];
+      if (part instanceof Variable)
+        vars.push(part.name);
+    }
+  }
+}
+
+function generateArg(val, path, args)
+{
+  if (val instanceof Parts) {
+    let vals = [];
+    for (let i = 0; i < val.parts.length; ++i) {
+      let part = val.parts[i];
+      if (part instanceof Variable) {
+        let varName = 'd' + path.renderIndex++;
+        if (part.format) {
+          for (let j = 0; j < part.format.length; ++j)
+            varName = part.format[j] + '(' + varName + ')';
+        }
+
+        vals.push(varName);
+      }
+      else
+        vals.push('"' + part.replace(/"/g, '\\"') + '"');
+    }
+
+    return vals.join('+');
+  } else {
+    args.push(val);
+    return 's' + path.staticIndex++;
+  }
+}
+
+function addParts(val, delim, block, info, escapeIt)
+{
+  let vals = [];
+  if (val instanceof Parts) {
+    for (let i = 0; i < val.parts.length; ++i) {
+      let part = val.parts[i];
+      if (part instanceof Variable) {
+        let partName = part.name;
+        if (part.format) {
+          for (let j = 0; j < part.format.length; ++j)
+            partName = part.format[j] + "(" + partName + ")";
+        }
+
+        if (escapeIt)
+          vals.push("__escape__(" + partName + ")");
+        else
+          vals.push(partName);
+      }
+      else
+        vals.push('"' + part + '"');
+    }
+  } else if (isTag(val)) {
+    info.args.push(val);
+    vals.push('s' + info.argIndex++);
+  } else
+    vals.push('"' + val + '"');
+
+  let parts = vals.join(delim);
+  if (parts)
+    block.push(delim, parts);
+}
+
+function isTag(obj)
+{
+  return (typeof(obj) == "function" || obj instanceof Function) && !!obj.tag;
+}
+
+///////////////////////////////////////////////////////////////////////////
+//// creator
+
+function creator(tag, cons)
+{
+  let fn = new Function(
+    "var tag = arguments.callee.tag;" +
+    "var cons = arguments.callee.cons;" +
+    "var newTag = new cons();" +
+    "return newTag.merge(arguments, tag);");
+
+  fn.tag = tag;
+  fn.cons = cons;
+  extend(fn, Renderer);
+
+  return fn;
+}
+
+///////////////////////////////////////////////////////////////////////////
+//// Utility functions
+
+function arrayInsert(array, index, other)
+{
+  for (let i = 0; i < other.length; ++i)
+    array.splice(i+index, 0, other[i]);
+
+  return array;
+}
+
+function cloneArray(array, fn)
+{
+  let newArray = [];
+
+  if (fn)
+    for (let i = 0; i < array.length; ++i)
+      newArray.push(fn(array[i]));
+  else
+    for (let i = 0; i < array.length; ++i)
+      newArray.push(array[i]);
+
+  return newArray;
+}
+
+// fn, thisObject, args => thisObject.fn(args, arguments);
+function bind()
+{
+  let args = cloneArray(arguments), fn = args.shift(), object = args.shift();
+  return function bind()
+  {
+    return fn.apply(object, arrayInsert(cloneArray(args), 0, arguments));
+  }
+}
+
+function copyArray(oldArray)
+{
+  let array = [];
+  if (oldArray)
+    for (let i = 0; i < oldArray.length; ++i)
+      array.push(oldArray[i]);
+  return array;
+}
+
+function copyObject(l, r)
+{
+  let m = {};
+  extend(m, l);
+  extend(m, r);
+  return m;
+}
+
+function escapeNewLines(value)
+{
+  return value.replace(/\r/gm, "\\r").replace(/\n/gm, "\\n");
+}
+
+function extend(l, r)
+{
+  for (let n in r)
+    l[n] = r[n];
+}
+
+function cropString(text, limit, alterText)
+{
+  if (!alterText)
+    alterText = "..."; //…
+
+  text = text + "";
+
+  if (!limit)
+    limit = 88; // todo
+  var halfLimit = (limit / 2);
+  halfLimit -= 2; // adjustment for alterText's increase in size
+
+  if (text.length > limit)
+    return text.substr(0, halfLimit) + alterText +
+      text.substr(text.length - halfLimit);
+  else
+    return text;
+}
+
+function cropMultipleLines(text, limit)
+{
+  return escapeNewLines(this.cropString(text, limit));
+}
+
+function isVisible(elt)
+{
+  if (elt.localName) {
+    return elt.offsetWidth > 0 || elt.offsetHeight > 0 ||
+      elt.localName.toLowerCase() in invisibleTags;
+  } else {
+    return elt.offsetWidth > 0 || elt.offsetHeight > 0;
+  }
+    // || isElementSVG(elt) || isElementMathML(elt);
+}
+
+// Local Helpers
+
+function isElementXHTML(node)
+{
+  return node.nodeName == node.nodeName.toLowerCase();
+}
+
+function isContainerElement(element)
+{
+  let tag = element.localName.toLowerCase();
+  switch (tag) {
+    case "script":
+    case "style":
+    case "iframe":
+    case "frame":
+    case "tabbrowser":
+    case "browser":
+      return true;
+    case "link":
+      return element.getAttribute("rel") == "stylesheet";
+    case "embed":
+      return element.getSVGDocument();
+  }
+  return false;
+}
+
+domplateUtils.isWhitespace = function isWhitespace(text)
+{
+  return !reNotWhitespace.exec(text);
+};
+
+domplateUtils.isWhitespaceText = function isWhitespaceText(node)
+{
+  if (node instanceof DOM.HTMLAppletElement)
+    return false;
+  return node.nodeType == DOM.Node.TEXT_NODE && this.isWhitespace(node.nodeValue);
+}
+
+function isSelfClosing(element)
+{
+  //if (isElementSVG(element) || isElementMathML(element))
+  //    return true;
+  var tag = element.localName.toLowerCase();
+  return (selfClosingTags.hasOwnProperty(tag));
+};
+
+function isEmptyElement(element)
+{
+  if (showTextNodesWithWhitespace) {
+    return !element.firstChild && isSelfClosing(element);
+  } else {
+    for (let child = element.firstChild; child; child = child.nextSibling) {
+      if (!domplateUtils.isWhitespaceText(child))
+        return false;
+    }
+  }
+  return isSelfClosing(element);
+}
+
+function getEmptyElementTag(node)
+{
+  let isXhtml= isElementXHTML(node);
+  if (isXhtml)
+    return HTMLTemplates.XEmptyElement.tag;
+  else
+    return HTMLTemplates.EmptyElement.tag;
+}
+
+/**
+ * Determines if the given node has any children which are elements.
+ *
+ * @param {Element} element Element to test.
+ * @return true if immediate children of type Element exist, false otherwise
+ */
+function hasNoElementChildren(element)
+{
+  if (element.childElementCount != 0)
+    return false;
+
+  return true;
+}
+
+domplateUtils.getNodeTag = function getNodeTag(node, expandAll)
+{
+  if (node instanceof DOM.Element) {
+    if (node instanceof DOM.HTMLHtmlElement && node.ownerDocument
+        && node.ownerDocument.doctype)
+      return HTMLTemplates.HTMLHtmlElement.tag;
+    else if (node instanceof DOM.HTMLAppletElement)
+      return getEmptyElementTag(node);
+    else if (isContainerElement(node))
+      return HTMLTemplates.Element.tag;
+    else if (isEmptyElement(node))
+      return getEmptyElementTag(node);
+    else if (hasNoElementChildren(node))
+      return HTMLTemplates.TextElement.tag;
+    else
+      return HTMLTemplates.Element.tag;
+  }
+  else if (node instanceof DOM.Text)
+    return HTMLTemplates.TextNode.tag;
+  else if (node instanceof DOM.CDATASection)
+    return HTMLTemplates.CDATANode.tag;
+  else if (node instanceof DOM.Comment)
+    return HTMLTemplates.CommentNode.tag;
+  else if (node instanceof DOM.SourceText)
+    return HTMLTemplates.SourceText.tag;
+  else
+    return HTMLTemplates.Nada.tag;
+}
+
+function getNodeBoxTag(nodeBox)
+{
+  let re = /([^\s]+)NodeBox/;
+  let m = re.exec(nodeBox.className);
+  if (!m)
+    return null;
+
+  let nodeBoxType = m[1];
+  if (nodeBoxType == "container")
+    return HTMLTemplates.Element.tag;
+  else if (nodeBoxType == "text")
+    return HTMLTemplates.TextElement.tag;
+  else if (nodeBoxType == "empty")
+    return HTMLTemplates.EmptyElement.tag;
+}
+
+///////////////////////////////////////////////////////////////////////////
+//// ArrayIterator
+
+function ArrayIterator(array)
+{
+  let index = -1;
+
+  this.next = function()
+  {
+    if (++index >= array.length)
+      throw StopIteration;
+
+    return array[index];
+  };
+}
+
+function StopIteration() {}
+
+domplate.$break = function()
+{
+  throw StopIteration;
+};
+
+///////////////////////////////////////////////////////////////////////////
+//// Renderer
+
+var Renderer =
+{
+  renderHTML: function(args, outputs, self)
+  {
+    let code = [];
+    let markupArgs = [code, this.tag.getContext(), args, outputs];
+    markupArgs.push.apply(markupArgs, this.tag.markupArgs);
+    this.tag.renderMarkup.apply(self ? self : this.tag.subject, markupArgs);
+    return code.join("");
+  },
+
+  insertRows: function(args, before, self)
+  {
+    if (!args)
+      args = {};
+
+    this.tag.compile();
+
+    let outputs = [];
+    let html = this.renderHTML(args, outputs, self);
+
+    let doc = before.ownerDocument;
+    let table = doc.createElement("table");
+    table.innerHTML = html;
+
+    let tbody = table.firstChild;
+    let parent = before.localName.toLowerCase() == "tr" ? before.parentNode : before;
+    let after = before.localName.toLowerCase() == "tr" ? before.nextSibling : null;
+
+    let firstRow = tbody.firstChild, lastRow;
+    while (tbody.firstChild) {
+      lastRow = tbody.firstChild;
+      if (after)
+        parent.insertBefore(lastRow, after);
+      else
+        parent.appendChild(lastRow);
+    }
+
+    // To save the next poor soul:
+    // In order to properly apply properties and event handlers on elements
+    // constructed by a FOR tag, the tag needs to be able to iterate up and
+    // down the tree, meaning if FOR is the root element as is the case with
+    // many insertRows calls, it will need to iterator over portions of the
+    // new parent.
+    //
+    // To achieve this end, __path__ defines the -1 operator which allows
+    // parent traversal. When combined with the offset that we calculate
+    // below we are able to iterate over the elements.
+    //
+    // This fails when applied to a non-loop element as non-loop elements
+    // Do not generate to proper path to bounce up and down the tree.
+    let offset = 0;
+    if (this.tag.isLoop) {
+      let node = firstRow.parentNode.firstChild;
+      for (; node && node != firstRow; node = node.nextSibling)
+        ++offset;
+    }
+
+    // strict warning: this.tag.context undefined
+    let domArgs = [firstRow, this.tag.getContext(), offset];
+    domArgs.push.apply(domArgs, this.tag.domArgs);
+    domArgs.push.apply(domArgs, outputs);
+
+    this.tag.renderDOM.apply(self ? self : this.tag.subject, domArgs);
+    return [firstRow, lastRow];
+  },
+
+  insertBefore: function(args, before, self)
+  {
+    return this.insertNode(args, before.ownerDocument,
+      function(frag) {
+        before.parentNode.insertBefore(frag, before);
+      }, self);
+  },
+
+  insertAfter: function(args, after, self)
+  {
+    return this.insertNode(args, after.ownerDocument,
+      function(frag) {
+        after.parentNode.insertBefore(frag, after.nextSibling);
+      }, self);
+  },
+
+  insertNode: function(args, doc, inserter, self)
+  {
+    if (!args)
+      args = {};
+
+    this.tag.compile();
+
+    let outputs = [];
+    let html = this.renderHTML(args, outputs, self);
+
+    let range = doc.createRange();
+    range.selectNode(doc.body);
+    let frag = range.createContextualFragment(html);
+
+    let root = frag.firstChild;
+    root = inserter(frag) || root;
+
+    let domArgs = [root, this.tag.context, 0];
+    domArgs.push.apply(domArgs, this.tag.domArgs);
+    domArgs.push.apply(domArgs, outputs);
+
+    this.tag.renderDOM.apply(self ? self : this.tag.subject, domArgs);
+
+    return root;
+  },
+
+  replace: function(args, parent, self)
+  {
+    if (!args)
+      args = {};
+
+    this.tag.compile();
+
+    let outputs = [];
+    let html = this.renderHTML(args, outputs, self);
+
+    let root;
+    if (parent.nodeType == DOM.Node.ELEMENT_NODE) {
+      parent.innerHTML = html;
+      root = parent.firstChild;
+    } else {
+      if (!parent || parent.nodeType != DOM.Node.DOCUMENT_NODE)
+        return;
+
+      if (!womb || womb.ownerDocument != parent)
+        womb = parent.createElement("div");
+
+      womb.innerHTML = html;
+
+      root = womb.firstChild;
+    }
+
+    let domArgs = [root, this.tag.context, 0];
+    domArgs.push.apply(domArgs, this.tag.domArgs);
+    domArgs.push.apply(domArgs, outputs);
+    this.tag.renderDOM.apply(self ? self : this.tag.subject, domArgs);
+
+    return root;
+  },
+
+  append: function(args, parent, self)
+  {
+    if (!args)
+      args = {};
+
+    this.tag.compile();
+
+    let outputs = [];
+    let html = this.renderHTML(args, outputs, self);
+
+    if (!womb || womb.ownerDocument != parent.ownerDocument)
+      womb = parent.ownerDocument.createElement("div");
+    womb.innerHTML = html;
+
+    let root = womb.firstChild;
+    while (womb.firstChild)
+      parent.appendChild(womb.firstChild);
+
+    let domArgs = [root, this.tag.context, 0];
+    domArgs.push.apply(domArgs, this.tag.domArgs);
+    domArgs.push.apply(domArgs, outputs);
+
+    this.tag.renderDOM.apply(self ? self : this.tag.subject, domArgs);
+
+    return root;
+  }
+};
+
+///////////////////////////////////////////////////////////////////////////
+//// defineTags macro
+
+/**
+ * Create default tags for a list of tag names.
+ * @param Arguments
+ *        list of string arguments
+ */
+
+function defineTags()
+{
+  for (let i = 0; i < arguments.length; ++i) {
+    let tagName = arguments[i];
+    let fn = new Function("var newTag = new DomplateTag('" + tagName +
+      "'); return newTag.merge(arguments);");
+
+    let fnName = tagName.toUpperCase();
+    domplate[fnName] = fn;
+  }
+}
+
+defineTags(
+  "a", "button", "br", "canvas", "col", "colgroup", "div", "fieldset", "form",
+  "h1", "h2", "h3", "hr", "img", "input", "label", "legend", "li", "ol",
+  "optgroup", "option", "p", "pre", "select", "b", "span", "strong", "table",
+  "tbody", "td", "textarea", "tfoot", "th", "thead", "tr", "tt", "ul", "iframe",
+  "code"
+);
+
+///////////////////////////////////////////////////////////////////////////
+//// HTMLTemplates
+
+let HTMLTemplates = {
+  showTextNodesWithWhitespace: false
+};
+
+let BaseTemplates = {
+  showTextNodesWithWhitespace: false
+};
+
+///////////////////////////////////////////////////////////////////////////
+//// HTMLTemplates.Reps
+
+BaseTemplates.OBJECTLINK = domplate.A({
+  "class": "objectLink objectLink-$className a11yFocus",
+  _repObject: "$object"
+});
+
+BaseTemplates.Rep = domplate(
+{
+  className: "",
+  inspectable: true,
+
+  supportsObject: function(object, type)
+  {
+    return false;
+  },
+
+  inspectObject: function(object, context)
+  {
+    // Firebug.chrome.select(object);  // todo
+  },
+
+  browseObject: function(object, context)
+  {
+  },
+
+  persistObject: function(object, context)
+  {
+  },
+
+  getRealObject: function(object, context)
+  {
+    return object;
+  },
+
+  /**
+   * Return a sensible string title for the given object, removing any wrapper
+   * information from it.
+   * @param aObject
+   *        The object to get the title of.
+   * @returns string
+   */
+
+  getTitle: function(aObject)
+  {
+    // e.g., [object XPCWrappedNative [object foo]]
+    let label = safeToString(aObject);
+
+    const re =/\[object ([^\]]*)/;
+    let objectMatch = re.exec(label);
+    let secondObjectMatch = null;
+    if (objectMatch) {
+      // e.g., XPCWrappedNative [object foo
+      secondObjectMatch = re.exec(objectMatch[1]);
+    }
+
+    if (secondObjectMatch)
+      return secondObjectMatch[1];  // eg foo
+    else
+      return objectMatch ? objectMatch[1] : label;
+  },
+
+  getTooltip: function(object)
+  {
+    return null;
+  },
+
+  /**
+   * Called by chrome.onContextMenu to build the context menu when the
+   * underlying object has this rep.
+   * See also Panel for a similar function also called by onContextMenu.
+   * Extensions may monkey patch and chain off this call.
+   * @param object: the 'realObject', a model value, eg a DOM property
+   * @param target: the HTML element clicked on.
+   * @param context: the context, probably FirebugContext
+   * @returns an array of menu items.
+   */
+  getContextMenuItems: function(object, target, context)
+  {
+    return [];
+  },
+
+  /////////////////////////////////////////////////////////////////////////
+  // Convenience for domplates
+
+  STR: function(name)
+  {
+    return name; // todo getproperty?
+  },
+
+  cropString: function(text)
+  {
+    return cropString(text);
+  },
+
+  cropMultipleLines: function(text, limit)
+  {
+    return cropMultipleLines(text, limit);
+  },
+
+  toLowerCase: function(text)
+  {
+    return text ? text.toLowerCase() : text;
+  },
+
+  plural: function(n)
+  {
+    return n == 1 ? "" : "s";
+  }
+});
+
+BaseTemplates.Element = domplate(BaseTemplates.Rep,
+{
+  tag:
+    BaseTemplates.OBJECTLINK(
+      "&lt;",
+      domplate.SPAN({"class": "nodeTag"},
+        "$object.localName|toLowerCase"),
+      domplate.FOR("attr", "$object|attrIterator",
+        "&nbsp;$attr.localName=&quot;",
+        domplate.SPAN({"class": "nodeValue"},
+          "$attr.nodeValue"),
+        "&quot;"
+      ),
+      "&gt;"
+    ),
+
+  shortTag:
+    BaseTemplates.OBJECTLINK(
+      domplate.SPAN({"class": "$object|getVisible"},
+        domplate.SPAN({"class": "selectorTag"},
+          "$object|getSelectorTag"),
+        domplate.SPAN({"class": "selectorId"},
+          "$object|getSelectorId"),
+        domplate.SPAN({"class": "selectorClass"},
+          "$object|getSelectorClass"),
+        domplate.SPAN({"class": "selectorValue"},
+          "$object|getValue")
+      )
+    ),
+
+  getVisible: function(elt)
+  {
+    return isVisible(elt) ? "" : "selectorHidden";
+  },
+
+  getSelectorTag: function(elt)
+  {
+    return elt.localName.toLowerCase();
+  },
+
+  getSelectorId: function(elt)
+  {
+    return elt.id ? ("#" + elt.id) : "";
+  },
+
+  getSelectorClass: function(elt)
+  {
+    return elt.getAttribute("class")
+      ? ("." + elt.getAttribute("class").split(" ")[0])
+      : "";
+  },
+
+  getValue: function(elt)
+  { // todo getFileName
+    let value;
+/*
+    if (elt instanceof HTMLImageElement)
+      value = getFileName(elt.getAttribute("src"));
+    else if (elt instanceof HTMLAnchorElement)
+      value = getFileName(elt.getAttribute("href"));
+    else if (elt instanceof HTMLInputElement)
+      value = elt.getAttribute("value");
+    else if (elt instanceof HTMLFormElement)
+      value = getFileName(elt.getAttribute("action"));
+    else if (elt instanceof HTMLScriptElement)
+      value = getFileName(elt.getAttribute("src"));
+
+    return value ? " " + cropMultipleLines(value, 20) : ""; */
+    // trying a simplified version from above commented section
+    // todo
+    if (elt instanceof DOM.HTMLImageElement)
+      value = elt.getAttribute("src");
+    else if (elt instanceof DOM.HTMLAnchorElement)
+      value = elt.getAttribute("href");
+    else if (elt instanceof DOM.HTMLInputElement)
+      value = elt.getAttribute("value");
+    else if (elt instanceof DOM.HTMLFormElement)
+      value = elt.getAttribute("action");
+    else if (elt instanceof DOM.HTMLScriptElement)
+      value = elt.getAttribute("src");
+
+    return value ? " " + cropMultipleLines(value, 20) : "";
+  },
+
+  attrIterator: function(elt)
+  {
+    let attrs = [];
+    let idAttr, classAttr;
+    if (elt.attributes) {
+      for (let i = 0; i < elt.attributes.length; ++i) {
+        var attr = elt.attributes[i];
+        if (attr.localName.indexOf("-moz-math") != -1)
+          continue;
+        else if (attr.localName == "id")
+          idAttr = attr;
+        else if (attr.localName == "class")
+          classAttr = attr;
+        else
+          attrs.push(attr);
+      }
+    }
+    if (classAttr)
+      attrs.unshift(classAttr);
+    if (idAttr)
+      attrs.unshift(idAttr);
+    return attrs;
+  },
+
+  shortAttrIterator: function(elt)
+  {
+    let attrs = [];
+    if (elt.attributes) {
+      for (let i = 0; i < elt.attributes.length; ++i) {
+        let attr = elt.attributes[i];
+          if (attr.localName == "id" || attr.localName == "class")
+            attrs.push(attr);
+      }
+    }
+
+    return attrs;
+  },
+
+  getHidden: function(elt)
+  {
+    return isVisible(elt) ? "" : "nodeHidden";
+  },
+
+/* getXPath: function(elt)
+  {
+    return getElementTreeXPath(elt); // todo
+  }, */
+
+  getNodeTextGroups: function(element)
+  {
+    let text =  element.textContent;
+    return [{str: text, 'class': '', extra: ''}];
+  },
+
+  className: "element",
+
+  supportsObject: function(object, type)
+  {
+    return object instanceof DOM.Element;
+  },
+
+  browseObject: function(elt, context)
+  {
+    let tag = elt.localName.toLowerCase();
+    return true;
+  },
+});
+
+
+///////////////////////////////////////////////////////////////////////////
+//// HTMLTemplates.tags
+
+BaseTemplates.AttrTag =
+  domplate.SPAN({"class": "nodeAttr editGroup"},
+    "&nbsp;",
+    domplate.SPAN({"class": "nodeName editable"}, "$attr.nodeName"),
+    "=&quot;",
+    domplate.SPAN({"class": "nodeValue editable"}, "$attr.nodeValue"),
+    "&quot;");
+
+BaseTemplates.TextTag =
+  domplate.SPAN({"class": "nodeText editable"},
+    domplate.FOR("chr", "$object|getNodeTextGroups",
+      domplate.SPAN({"class": "$chr.class $chr.extra"},
+        "$chr.str")));
+
+///////////////////////////////////////////////////////////////////////////
+//// HTMLTemplates
+
+
+
+HTMLTemplates.CompleteElement = domplate(BaseTemplates.Element,
+{
+  tag:
+    domplate.DIV({"class":
+        "nodeBox open $object|getHidden repIgnore",
+        _repObject: "$object", role : 'presentation'},
+      domplate.DIV({"class": "nodeLabel", role: "presentation"},
+        domplate.SPAN({"class": "nodeLabelBox repTarget repTarget",
+          role : 'treeitem', 'aria-expanded' : 'false'},
+          "&lt;",
+          domplate.SPAN({"class": "nodeTag"},
+            "$object.nodeName|toLowerCase"),
+          domplate.FOR("attr", "$object|attrIterator", BaseTemplates.AttrTag),
+          domplate.SPAN({"class": "nodeBracket"}, "&gt;")
+        )
+      ),
+      domplate.DIV({"class": "nodeChildBox", role :"group"},
+        domplate.FOR("child", "$object|childIterator",
+          domplate.TAG("$child|getNodeTag", {object: "$child"})
+        )
+      ),
+      domplate.DIV({"class": "nodeCloseLabel", role:"presentation"},
+        "&lt;/",
+        domplate.SPAN({"class": "nodeTag"},
+          "$object.nodeName|toLowerCase"),
+        "&gt;"
+      )
+    ),
+
+  getNodeTag: function(node)
+  {
+    return domplateUtils.getNodeTag(node, true);
+  },
+
+  childIterator: function(node)
+  {
+    if (node.contentDocument)
+      return [node.contentDocument.documentElement];
+
+    if (this.showTextNodesWithWhitespace)
+      return cloneArray(node.childNodes);
+    else {
+      let nodes = [];
+      for (let child = node.firstChild; child; child = child.nextSibling) {
+        if (child.nodeType != DOM.Node.TEXT_NODE || !domplateUtils.isWhitespaceText(child))
+          nodes.push(child);
+      }
+      return nodes;
+    }
+  }
+});
+
+HTMLTemplates.SoloElement = domplate(HTMLTemplates.CompleteElement,
+{
+  tag:
+    domplate.DIV({"class": "soloElement",
+      onmousedown: "$onMouseDown"},
+      HTMLTemplates.CompleteElement.tag),
+
+  onMouseDown: function(event)
+  {
+    for (let child = event.target; child; child = child.parentNode) {
+      if (child.repObject) { // todo
+          // let panel = Firebug.getElementPanel(child);
+          // Firebug.chrome.select(child.repObject);
+          break;
+      }
+    }
+  }
+});
+
+HTMLTemplates.Element = domplate(BaseTemplates.Element,
+{
+  tag:
+    domplate.DIV({"class": "nodeBox containerNodeBox $object|getHidden repIgnore",
+      _repObject: "$object", role: "presentation"},
+      domplate.DIV({"class": "nodeLabel", role: "presentation"},
+        domplate.IMG({"class": "twisty", role: "presentation"}),
+        domplate.SPAN({"class": "nodeLabelBox repTarget",
+          role: 'treeitem', 'aria-expanded': 'false'},
+          "&lt;",
+          domplate.SPAN({"class": "nodeTag"},
+            "$object.nodeName|toLowerCase"),
+          domplate.FOR("attr", "$object|attrIterator", BaseTemplates.AttrTag),
+          domplate.SPAN({"class": "nodeBracket editable insertBefore"},
+            "&gt;")
+        )
+      ),
+      domplate.DIV({"class": "nodeChildBox", role: "group"}), /* nodeChildBox is special signal in insideOutBox */
+      domplate.DIV({"class": "nodeCloseLabel", role: "presentation"},
+        domplate.SPAN({"class": "nodeCloseLabelBox repTarget"},
+          "&lt;/",
+          domplate.SPAN({"class": "nodeTag"}, "$object.nodeName|toLowerCase"),
+          "&gt;"
+        )
+      )
+    )
+});
+
+HTMLTemplates.HTMLHtmlElement = domplate(BaseTemplates.Element,
+{
+  tag:
+    domplate.DIV({"class":
+        "nodeBox htmlNodeBox containerNodeBox $object|getHidden repIgnore",
+        _repObject: "$object", role: "presentation"},
+      domplate.DIV({"class": "docType"},
+        "$object|getDocType"),
+      domplate.DIV({"class": "nodeLabel", role: "presentation"},
+        domplate.IMG({"class": "twisty", role: "presentation"}),
+        domplate.SPAN({"class": "nodeLabelBox repTarget",
+            role: 'treeitem', 'aria-expanded' : 'false'},
+          "&lt;",
+          domplate.SPAN({"class": "nodeTag"},
+            "$object.nodeName|toLowerCase"),
+          domplate.FOR("attr", "$object|attrIterator", BaseTemplates.AttrTag),
+          domplate.SPAN({"class":
+            "nodeBracket editable insertBefore"}, "&gt;")
+        )
+      ), /* nodeChildBox is special signal in insideOutBox */
+      domplate.DIV({"class": "nodeChildBox", role: "group"}),
+      domplate.DIV({"class": "nodeCloseLabel", role:  "presentation"},
+        domplate.SPAN({"class": "nodeCloseLabelBox repTarget"},
+          "&lt;/",
+          domplate.SPAN({"class": "nodeTag"},
+            "$object.nodeName|toLowerCase"),
+          "&gt;"
+        )
+      )
+    ),
+
+  getDocType: function(obj)
+  {
+    let doctype = obj.ownerDocument.doctype;
+    return '<!DOCTYPE ' + doctype.name + (doctype.publicId ? ' PUBLIC "' +
+      doctype.publicId + '"': '') + (doctype.systemId ? ' "' +
+      doctype.systemId + '"' : '') + '>';
+  }
+});
+
+HTMLTemplates.TextElement = domplate(BaseTemplates.Element,
+{
+  tag:
+    domplate.DIV({"class":
+        "nodeBox textNodeBox $object|getHidden repIgnore",
+        _repObject: "$object", role: 'presentation'},
+      domplate.DIV({"class": "nodeLabel", role: "presentation"},
+        domplate.SPAN({"class": "nodeLabelBox repTarget",
+            role: 'treeitem'},
+          "&lt;",
+          domplate.SPAN({"class": "nodeTag"},
+            "$object.nodeName|toLowerCase"),
+          domplate.FOR("attr", "$object|attrIterator", BaseTemplates.AttrTag),
+          domplate.SPAN({"class":
+            "nodeBracket editable insertBefore"}, "&gt;"),
+          BaseTemplates.TextTag,
+          "&lt;/",
+          domplate.SPAN({"class": "nodeTag"},
+            "$object.nodeName|toLowerCase"),
+          "&gt;"
+        )
+      )
+    )
+});
+
+HTMLTemplates.EmptyElement = domplate(BaseTemplates.Element,
+{
+  tag:
+    domplate.DIV({"class":
+        "nodeBox emptyNodeBox $object|getHidden repIgnore",
+        _repObject: "$object", role: 'presentation'},
+      domplate.DIV({"class": "nodeLabel", role: "presentation"},
+        domplate.SPAN({"class": "nodeLabelBox repTarget",
+            role: 'treeitem'},
+          "&lt;",
+          domplate.SPAN({"class": "nodeTag"},
+            "$object.nodeName|toLowerCase"),
+          domplate.FOR("attr", "$object|attrIterator", BaseTemplates.AttrTag),
+          domplate.SPAN({"class":
+            "nodeBracket editable insertBefore"}, "&gt;")
+        )
+      )
+    )
+});
+
+HTMLTemplates.XEmptyElement = domplate(BaseTemplates.Element,
+{
+  tag:
+    domplate.DIV({"class":
+        "nodeBox emptyNodeBox $object|getHidden repIgnore",
+        _repObject: "$object", role: 'presentation'},
+      domplate.DIV({"class": "nodeLabel", role: "presentation"},
+        domplate.SPAN({"class": "nodeLabelBox repTarget",
+            role : 'treeitem'},
+          "&lt;",
+          domplate.SPAN({"class": "nodeTag"},
+            "$object.nodeName|toLowerCase"),
+          domplate.FOR("attr", "$object|attrIterator", BaseTemplates.AttrTag),
+          domplate.SPAN({"class":
+            "nodeBracket editable insertBefore"}, "/&gt;")
+        )
+      )
+    )
+});
+
+HTMLTemplates.AttrNode = domplate(BaseTemplates.Element,
+{
+  tag: BaseTemplates.AttrTag
+});
+
+HTMLTemplates.TextNode = domplate(BaseTemplates.Element,
+{
+  tag:
+    domplate.DIV({"class": "nodeBox", _repObject: "$object",
+      role: 'presentation'}, BaseTemplates.TextTag)
+});
+
+HTMLTemplates.CDATANode = domplate(BaseTemplates.Element,
+{
+  tag:
+    domplate.DIV({"class": "nodeBox", _repObject: "$object",
+      role: 'presentation'},
+        "&lt;![CDATA[",
+        domplate.SPAN({"class": "nodeText nodeCDATA editable"},
+          "$object.nodeValue"),
+        "]]&gt;")
+});
+
+HTMLTemplates.CommentNode = domplate(BaseTemplates.Element,
+{
+  tag:
+    domplate.DIV({"class": "nodeBox nodeComment",
+        _repObject: "$object", role : 'presentation'},
+      "&lt;!--",
+      domplate.SPAN({"class": "nodeComment editable"},
+        "$object.nodeValue"),
+      "--&gt;")
+});
+
+HTMLTemplates.Nada = domplate(BaseTemplates.Rep,
+{
+  tag: domplate.SPAN(""),
+  className: "nada"
+});
+
diff --git a/browser/base/content/insideOutBox.js b/browser/base/content/insideOutBox.js
new file mode 100644
index 000000000000..e632a13eb2bb
--- /dev/null
+++ b/browser/base/content/insideOutBox.js
@@ -0,0 +1,639 @@
+/*
+ * Software License Agreement (BSD License)
+ *
+ * Copyright (c) 2007, Parakey Inc.
+ * All rights reserved.
+ * 
+ * Redistribution and use of this software in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ * 
+ * * Redistributions of source code must retain the above
+ *   copyright notice, this list of conditions and the
+ *   following disclaimer.
+ * 
+ * * Redistributions in binary form must reproduce the above
+ *   copyright notice, this list of conditions and the
+ *   following disclaimer in the documentation and/or other
+ *   materials provided with the distribution.
+ * 
+ * * Neither the name of Parakey Inc. nor the names of its
+ *   contributors may be used to endorse or promote products
+ *   derived from this software without specific prior
+ *   written permission of Parakey Inc.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Creator:
+ *  Joe Hewitt
+ * Contributors
+ *  John J. Barton (IBM Almaden)
+ *  Jan Odvarko (Mozilla Corp.)
+ *  Max Stepanov (Aptana Inc.)
+ *  Rob Campbell (Mozilla Corp.)
+ *  Hans Hillen (Paciello Group, Mozilla)
+ *  Curtis Bartley (Mozilla Corp.)
+ *  Mike Collins (IBM Almaden)
+ *  Kevin Decker
+ *  Mike Ratcliffe (Comartis AG)
+ *  Hernan Rodríguez Colmeiro
+ *  Austin Andrews
+ *  Christoph Dorn
+ *  Steven Roussey (AppCenter Inc, Network54)
+ */
+
+///////////////////////////////////////////////////////////////////////////
+//// InsideOutBox
+
+/**
+ * InsideOutBoxView is a simple interface definition for views implementing
+ * InsideOutBox controls. All implementors must define these methods.
+ * Implemented in InspectorUI.
+ */
+
+/*
+InsideOutBoxView = {
+  //
+   * Retrieves the parent object for a given child object.
+   * @param aChild
+   *        The child node to retrieve the parent object for.
+   * @returns a DOM node | null
+   //
+  getParentObject: function(aChild) {},
+
+  //
+   * Retrieves a given child node.
+   *
+   * If both index and previousSibling are passed, the implementation
+   * may assume that previousSibling will be the return for getChildObject
+   * with index-1.
+   * @param aParent
+   *        The parent object of the child object to retrieve.
+   * @param aIndex
+   *        The index of the child object to retrieve from aParent.
+   * @param aPreviousSibling
+   *        The previous sibling of the child object to retrieve.
+   *        Supercedes aIndex.
+   * @returns a DOM object | null
+   //
+  getChildObject: function(aParent, aIndex, aPreviousSibling) {},
+
+  //
+   * Renders the HTML representation of the object. Should return an HTML
+   * object which will be displayed to the user.
+   * @param aObject
+   *        The object to create the box object for.
+   * @param aIsRoot
+   *        Is the object the root object. May not be used in all
+   *        implementations.
+   * @returns an object box | null
+   //
+  createObjectBox: function(aObject, aIsRoot) {},
+
+  //
+  * Convenience wrappers for classList API.
+  * @param aObject
+  *        DOM node to query/set.
+  * @param aClassName
+  *        String containing the class name to query/set.
+  //
+  hasClass: function(aObject, aClassName) {},
+  addClass: function(aObject, aClassName) {},
+  removeClass: function(aObject, aClassName) {}
+};
+*/
+
+/**
+ * Creates a tree based on objects provided by a separate "view" object.
+ *
+ * Construction uses an "inside-out" algorithm, meaning that the view's job is
+ * first to tell us the ancestry of each object, and secondarily its
+ * descendants.
+ *
+ * Constructor
+ * @param aView
+ *        The view requiring the InsideOutBox.
+ * @param aBox
+ *        The box object containing the InsideOutBox. Required to add/remove
+ *        children during box manipulation (toggling opened or closed).
+ */
+function InsideOutBox(aView, aBox)
+{
+  this.view = aView;
+  this.box = aBox;
+
+  this.rootObject = null;
+
+  this.rootObjectBox = null;
+  this.selectedObjectBox = null;
+  this.highlightedObjectBox = null;
+  this.scrollIntoView = false;
+};
+
+InsideOutBox.prototype =
+{
+  /**
+   * Highlight the given object node in the tree.
+   * @param aObject
+   *        the object to highlight.
+   * @returns objectBox
+   */
+  highlight: function IOBox_highlight(aObject)
+  {
+    let objectBox = this.createObjectBox(aObject);
+    this.highlightObjectBox(objectBox);
+    return objectBox;
+  },
+
+  /**
+   * Open the given object node in the tree.
+   * @param aObject
+   *        The object node to open.
+   * @returns objectBox
+   */
+  openObject: function IOBox_openObject(aObject)
+  {
+    let object = aObject;
+    let firstChild = this.view.getChildObject(object, 0);
+    if (firstChild)
+      object = firstChild;
+
+    return this.openToObject(object);
+  },
+
+  /**
+   * Open the tree up to the given object node.
+   * @param aObject
+   *        The object in the tree to open to.
+   * @returns objectBox
+   */
+  openToObject: function IOBox_openToObject(aObject)
+  {
+    let objectBox = this.createObjectBox(aObject);
+    this.openObjectBox(objectBox);
+    return objectBox;
+  },
+
+  /**
+   * Select the given object node in the tree.
+   * @param aObject
+   *        The object node to select.
+   * @param makeBoxVisible
+   *        Boolean. Open the object box in the tree?
+   * @param forceOpen
+   *        Force the object box open by expanding all elements in the tree?
+   * @param scrollIntoView
+   *        Scroll the objectBox into view?
+   * @returns objectBox
+   */
+  select:
+  function IOBox_select(aObject, makeBoxVisible, forceOpen, scrollIntoView)
+  {
+    let objectBox = this.createObjectBox(aObject);
+    this.selectObjectBox(objectBox, forceOpen);
+    if (makeBoxVisible) {
+      this.openObjectBox(objectBox);
+      if (scrollIntoView) {
+        objectBox.scrollIntoView(true);
+      }
+    }
+    return objectBox;
+  },
+
+  /**
+   * Expands/contracts the given object, depending on its state.
+   * @param aObject
+   *        The tree node to expand/contract.
+   */
+  toggleObject: function IOBox_toggleObject(aObject)
+  {
+    let box = this.createObjectBox(aObject);
+    if (!(this.view.hasClass(box, "open")))
+      this.expandObjectBox(box);
+    else
+      this.contractObjectBox(box);
+  },
+
+  /**
+   * Expand the given object in the tree.
+   * @param aObject
+   *        The tree node to expand.
+   */
+  expandObject: function IOBox_expandObject(aObject)
+  {
+    let objectBox = this.createObjectBox(aObject);
+    if (objectBox)
+      this.expandObjectBox(objectBox);
+  },
+
+  /**
+   * Contract the given object in the tree.
+   * @param aObject
+   *        The tree node to contract.
+   */
+  contractObject: function IOBox_contractObject(aObject)
+  {
+    let objectBox = this.createObjectBox(aObject);
+    if (objectBox)
+      this.contractObjectBox(objectBox);
+  },
+
+  /**
+   * General method for iterating over an object's ancestors and performing
+   * some function.
+   * @param aObject
+   *        The object whose ancestors we wish to iterate over.
+   * @param aCallback
+   *        The function to call with the object as argument.
+   */
+
+  iterateObjectAncestors: function IOBox_iterateObjectAncesors(aObject, aCallback)
+  {
+    let object = aObject;
+    if (!(aCallback && typeof(aCallback) == "function")) {
+      this.view._log("Illegal argument in IOBox.iterateObjectAncestors");
+      return;
+    }
+    while ((object = this.getParentObjectBox(object)))
+      aCallback(object);
+  },
+
+  /**
+   * Highlight the given objectBox in the tree.
+   * @param aObjectBox
+   *        The objectBox to highlight.
+   */
+  highlightObjectBox: function IOBox_highlightObjectBox(aObjectBox)
+  {
+    let self = this;
+
+    if (!aObjectBox)
+      return;
+
+    if (this.highlightedObjectBox) {
+      this.view.removeClass(this.highlightedObjectBox, "highlighted");
+      this.iterateObjectAncestors(this.highlightedObjectBox, function (box) {
+        self.view.removeClass(box, "highlightOpen");
+      });
+    }
+
+    this.highlightedObjectBox = aObjectBox;
+
+    this.view.addClass(aObjectBox, "highlighted");
+    this.iterateObjectAncestors(this.highlightedObjectBox, function (box) {
+      self.view.addClass(box, "highlightOpen");
+    });
+
+    aObjectBox.scrollIntoView(true);
+  },
+
+  /**
+   * Select the given objectBox in the tree, forcing it to be open if necessary.
+   * @param aObjectBox
+   *        The objectBox to select.
+   * @param forceOpen
+   *        Force the box (subtree) to be open?
+   */
+  selectObjectBox: function IOBox_selectObjectBox(aObjectBox, forceOpen)
+  {
+    let isSelected = this.selectedObjectBox &&
+      aObjectBox == this.selectedObjectBox;
+
+    // aObjectBox is already selected, return
+    if (isSelected)
+      return;
+
+    if (this.selectedObjectBox)
+      this.view.removeClass(this.selectedObjectBox, "selected");
+
+    this.selectedObjectBox = aObjectBox;
+
+    if (aObjectBox) {
+      this.view.addClass(aObjectBox, "selected");
+
+      // Force it open the first time it is selected
+      if (forceOpen)
+        this.expandObjectBox(aObjectBox, true);
+    }
+  },
+
+  /**
+   * Open the ancestors of the given object box.
+   * @param aObjectBox
+   *        The object box to open.
+   */
+  openObjectBox: function IOBox_openObjectBox(aObjectBox)
+  {
+    if (!aObjectBox)
+      return;
+
+    let self = this;
+    this.iterateObjectAncestors(aObjectBox, function (box) {
+      self.view.addClass(box, "open");
+      let labelBox = box.querySelector(".nodeLabelBox");
+      if (labelBox)
+        labelBox.setAttribute("aria-expanded", "true");
+   });
+  },
+
+  /**
+   * Expand the given object box.
+   * @param aObjectBox
+   *        The object box to expand.
+   */
+  expandObjectBox: function IOBox_expandObjectBox(aObjectBox)
+  {
+    let nodeChildBox = this.getChildObjectBox(aObjectBox);
+
+    // no children means nothing to expand, return
+    if (!nodeChildBox)
+      return;
+
+    if (!aObjectBox.populated) {
+      let firstChild = this.view.getChildObject(aObjectBox.repObject, 0);
+      this.populateChildBox(firstChild, nodeChildBox);
+    }
+    let labelBox = aObjectBox.querySelector(".nodeLabelBox");
+    if (labelBox)
+      labelBox.setAttribute("aria-expanded", "true");
+    this.view.addClass(aObjectBox, "open");
+  },
+
+  /**
+   * Contract the given object box.
+   * @param aObjectBox
+   *        The object box to contract.
+   */
+  contractObjectBox: function IOBox_contractObjectBox(aObjectBox)
+  {
+    this.view.removeClass(aObjectBox, "open");
+    let nodeLabel = aObjectBox.querySelector(".nodeLabel");
+    let labelBox = nodeLabel.querySelector(".nodeLabelBox");
+    if (labelBox)
+      labelBox.setAttribute("aria-expanded", "false");
+  },
+
+  /**
+   * Toggle the given object box, forcing open if requested.
+   * @param aObjectBox
+   *        The object box to toggle.
+   * @param forceOpen
+   *        Force the objectbox open?
+   */
+  toggleObjectBox: function IOBox_toggleObjectBox(aObjectBox, forceOpen)
+  {
+    let isOpen = this.view.hasClass(aObjectBox, "open");
+
+    if (!forceOpen && isOpen)
+      this.contractObjectBox(aObjectBox);
+    else if (!isOpen)
+      this.expandObjectBox(aObjectBox);
+  },
+
+  /**
+   * Creates all of the boxes for an object, its ancestors, and siblings.
+   * @param aObject
+   *        The tree node to create the object boxes for.
+   * @returns anObjectBox or null
+   */
+  createObjectBox: function IOBox_createObjectBox(aObject)
+  {
+    if (!aObject)
+      return null;
+
+    this.rootObject = this.getRootNode(aObject) || aObject;
+
+    // Get or create all of the boxes for the target and its ancestors
+    let objectBox = this.createObjectBoxes(aObject, this.rootObject);
+
+    if (!objectBox)
+      return null;
+
+    if (aObject == this.rootObject)
+      return objectBox;
+
+    return this.populateChildBox(aObject, objectBox.parentNode);
+  },
+
+  /**
+   * Creates all of the boxes for an object, its ancestors, and siblings up to
+   * a root.
+   * @param aObject
+   *        The tree's object node to create the object boxes for.
+   * @param aRootObject
+   *        The root object at which to stop building object boxes.
+   * @returns an object box or null
+   */
+  createObjectBoxes: function IOBox_createObjectBoxes(aObject, aRootObject)
+  {
+    if (!aObject)
+      return null;
+
+    if (aObject == aRootObject) {
+      if (!this.rootObjectBox || this.rootObjectBox.repObject != aRootObject) {
+        if (this.rootObjectBox) {
+          try {
+            this.box.removeChild(this.rootObjectBox);
+          } catch (exc) {
+            InspectorUI._log("this.box.removeChild(this.rootObjectBox) FAILS " +
+              this.box + " must not contain " + this.rootObjectBox);
+          }
+        }
+
+        this.highlightedObjectBox = null;
+        this.selectedObjectBox = null;
+        this.rootObjectBox = this.view.createObjectBox(aObject, true);
+        this.box.appendChild(this.rootObjectBox);
+      }
+      return this.rootObjectBox;
+    }
+
+    let parentNode = this.view.getParentObject(aObject);
+    let parentObjectBox = this.createObjectBoxes(parentNode, aRootObject);
+
+    if (!parentObjectBox)
+      return null;
+
+    let parentChildBox = this.getChildObjectBox(parentObjectBox);
+
+    if (!parentChildBox)
+      return null;
+
+    let childObjectBox = this.findChildObjectBox(parentChildBox, aObject);
+
+    return childObjectBox ? childObjectBox
+      : this.populateChildBox(aObject, parentChildBox);
+  },
+
+  /**
+   * Locate the object box for a given object node.
+   * @param aObject
+   *        The given object node in the tree.
+   * @returns an object box or null.
+   */
+  findObjectBox: function IOBox_findObjectBox(aObject)
+  {
+    if (!aObject)
+      return null;
+
+    if (aObject == this.rootObject)
+      return this.rootObjectBox;
+
+    let parentNode = this.view.getParentObject(aObject);
+    let parentObjectBox = this.findObjectBox(parentNode);
+    if (!parentObjectBox)
+      return null;
+
+    let parentChildBox = this.getChildObjectBox(parentObjectBox);
+    if (!parentChildBox)
+      return null;
+
+    return this.findChildObjectBox(parentChildBox, aObject);
+  },
+
+  getAncestorByClass: function IOBox_getAncestorByClass(node, className)
+  {
+    for (let parent = node; parent; parent = parent.parentNode) {
+      if (this.view.hasClass(parent, className))
+        return parent;
+    }
+
+    return null;
+  },
+
+  /**
+   * We want all children of the parent of repObject.
+   */
+  populateChildBox: function IOBox_populateChildBox(repObject, nodeChildBox)
+  {
+    if (!repObject)
+      return null;
+
+    let parentObjectBox = this.getAncestorByClass(nodeChildBox, "nodeBox");
+
+    if (parentObjectBox.populated)
+      return this.findChildObjectBox(nodeChildBox, repObject);
+
+    let lastSiblingBox = this.getChildObjectBox(nodeChildBox);
+    let siblingBox = nodeChildBox.firstChild;
+    let targetBox = null;
+    let view = this.view;
+    let targetSibling = null;
+    let parentNode = view.getParentObject(repObject);
+
+    for (let i = 0; 1; ++i) {
+      targetSibling = view.getChildObject(parentNode, i, targetSibling);
+      if (!targetSibling)
+        break;
+
+      // Check if we need to start appending, or continue to insert before
+      if (lastSiblingBox && lastSiblingBox.repObject == targetSibling)
+        lastSiblingBox = null;
+
+      if (!siblingBox || siblingBox.repObject != targetSibling) {
+        let newBox = view.createObjectBox(targetSibling);
+        if (newBox) {
+          if (lastSiblingBox)
+            nodeChildBox.insertBefore(newBox, lastSiblingBox);
+          else
+            nodeChildBox.appendChild(newBox);
+        }
+
+        siblingBox = newBox;
+      }
+
+      if (targetSibling == repObject)
+        targetBox = siblingBox;
+
+      if (siblingBox && siblingBox.repObject == targetSibling)
+        siblingBox = siblingBox.nextSibling;
+    }
+
+    if (targetBox)
+      parentObjectBox.populated = true;
+
+    return targetBox;
+  },
+
+  /**
+   * Get the parent object box of a given object box.
+   * @params aObjectBox
+   *         The object box of the parent.
+   * @returns an object box or null
+   */
+  getParentObjectBox: function IOBox_getParentObjectBox(aObjectBox)
+  {
+    let parent = aObjectBox.parentNode ? aObjectBox.parentNode.parentNode : null;
+    return parent && parent.repObject ? parent : null;
+  },
+
+  /**
+   * Get the child object box of a given object box.
+   * @param aObjectBox
+   *        The object box whose child you want.
+   * @returns an object box or null
+   */
+  getChildObjectBox: function IOBox_getChildObjectBox(aObjectBox)
+  {
+    return aObjectBox.querySelector(".nodeChildBox");
+  },
+
+  /**
+   * Find the child object box for a given repObject within the subtree
+   * rooted at aParentNodeBox.
+   * @param aParentNodeBox
+   *        root of the subtree in which to search for repObject.
+   * @param aRepObject
+   *        The object you wish to locate in the subtree.
+   * @returns an object box or null
+   */
+  findChildObjectBox: function IOBox_findChildObjectBox(aParentNodeBox, aRepObject)
+  {
+    let childBox = aParentNodeBox.firstChild;
+    while (childBox) {
+      if (childBox.repObject == aRepObject)
+        return childBox;
+      childBox = childBox.nextSibling;
+    }
+    return null; // not found
+  },
+
+  /**
+   * Determines if the given node is an ancestor of the current root.
+   * @param aNode
+   *        The node to look for within the tree.
+   * @returns boolean
+   */
+  isInExistingRoot: function IOBox_isInExistingRoot(aNode)
+  {
+    let parentNode = aNode;
+    while (parentNode && parentNode != this.rootObject) {
+      parentNode = this.view.getParentObject(parentNode);
+    }
+    return parentNode == this.rootObject;
+  },
+
+  /**
+   * Get the root node of a given node.
+   * @param aNode
+   *        The node whose root you wish to retrieve.
+   * @returns a root node or null
+   */
+  getRootNode: function IOBox_getRootNode(aNode)
+  {
+    let node = aNode;
+    let tmpNode;
+    while ((tmpNode = this.view.getParentObject(node)))
+      node = tmpNode;
+
+    return node;
+  },
+};
diff --git a/browser/base/content/inspector.html b/browser/base/content/inspector.html
new file mode 100644
index 000000000000..f37a7f610b1b
--- /dev/null
+++ b/browser/base/content/inspector.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
+  "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+<head>
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
+  <link rel="stylesheet" href="chrome://browser/skin/inspector.css" type="text/css"/>
+</head>
+<body role="application">
+</body>
+</html>
diff --git a/browser/base/content/inspector.js b/browser/base/content/inspector.js
index 01171936cb0e..e0e4d3d3eb97 100644
--- a/browser/base/content/inspector.js
+++ b/browser/base/content/inspector.js
@@ -41,6 +41,8 @@
  * ***** END LICENSE BLOCK ***** */
 #endif
 
+#include insideOutBox.js
+
 const INSPECTOR_INVISIBLE_ELEMENTS = {
   "head": true,
   "base": true,
@@ -272,7 +274,7 @@ PanelHighlighter.prototype = {
     let visibleWidth = this.win.innerWidth;
     let visibleHeight = this.win.innerHeight;
 
-    return ((0 <= aRect.left) && (aRect.right <= visibleWidth) && 
+    return ((0 <= aRect.left) && (aRect.right <= visibleWidth) &&
         (0 <= aRect.top) && (aRect.bottom <= visibleHeight))
   },
 
@@ -322,169 +324,6 @@ PanelHighlighter.prototype = {
   }
 };
 
-///////////////////////////////////////////////////////////////////////////
-//// InspectorTreeView
-
-/**
- * TreeView object to manage the view of the DOM tree. Wraps and provides an
- * interface to an inIDOMView object
- *
- * @param aWindow
- *        a top-level window object
- */
-function InspectorTreeView(aWindow)
-{
-  this.tree = document.getElementById("inspector-tree");
-  this.treeBody = document.getElementById("inspector-tree-body");
-  this.view = Cc["@mozilla.org/inspector/dom-view;1"]
-              .createInstance(Ci.inIDOMView);
-  this.view.showSubDocuments = true;
-  this.view.whatToShow = NodeFilter.SHOW_ALL;
-  this.tree.view = this.view;
-  this.contentWindow = aWindow;
-  this.view.rootNode = aWindow.document;
-  this.view.rebuild();
-}
-
-InspectorTreeView.prototype = {
-  get editable() { return false; },
-  get selection() { return this.view.selection; },
-
-  /**
-   * Destroy the view.
-   */
-  destroy: function ITV_destroy()
-  {
-    this.tree.view = null;
-    this.view = null;
-    this.tree = null;
-  },
-
-  /**
-   * Get the cell text at a given row and column.
-   *
-   * @param aRow
-   *        The row index of the desired cell.
-   * @param aCol
-   *        The column index of the desired cell.
-   * @returns string
-   */
-  getCellText: function ITV_getCellText(aRow, aCol)
-  {
-    return this.view.getCellText(aRow, aCol);
-  },
-
-  /**
-   * Get the index of the selected row.
-   *
-   * @returns number -1 if there is no row selected.
-   */
-  get selectionIndex()
-  {
-    return this.selection ? this.selection.currentIndex : -1;
-  },
-
-  /**
-   * Get the corresponding node for the currently-selected row in the tree.
-   *
-   * @returns DOMNode|null
-   */
-  get selectedNode()
-  {
-    let rowIndex = this.selectionIndex;
-    return rowIndex > -1 ? this.view.getNodeFromRowIndex(rowIndex) : null;
-  },
-
-  /**
-   * Set the selected row in the table to the specified index.
-   *
-   * @param anIndex
-   *        The index to set the selection to.
-   */
-  set selectedRow(anIndex)
-  {
-    this.view.selection.select(anIndex);
-    this.tree.treeBoxObject.ensureRowIsVisible(anIndex);
-  },
-
-  /**
-   * Set the selected node to the specified document node.
-   *
-   * @param aNode
-   *        The document node to select in the tree.
-   */
-  set selectedNode(aNode)
-  {
-    let rowIndex = this.view.getRowIndexFromNode(aNode);
-    if (rowIndex > -1) {
-      this.selectedRow = rowIndex;
-    } else {
-      this.selectElementInTree(aNode);
-    }
-  },
-
-  /**
-   * Select the given node in the tree, searching for and expanding rows
-   * as-needed.
-   *
-   * @param aNode
-   *        The document node to select in the three.
-   * @returns boolean
-   *          Whether a node was selected or not if not found.
-   */
-  selectElementInTree: function ITV_selectElementInTree(aNode)
-  {
-    if (!aNode) {
-      this.view.selection.select(null);
-      return false;      
-    }
-
-    // Keep searching until a pre-created ancestor is found, then 
-    // open each ancestor until the found element is created.
-    let domUtils = Cc["@mozilla.org/inspector/dom-utils;1"].
-                    getService(Ci.inIDOMUtils);
-    let line = [];
-    let parent = aNode;
-    let index = null;
-
-    while (parent) {
-      index = this.view.getRowIndexFromNode(parent);
-      line.push(parent);
-      if (index < 0) {
-        // Row for this node hasn't been created yet.
-        parent = domUtils.getParentForNode(parent,
-          this.view.showAnonymousContent);
-      } else {
-        break;
-      }
-    }
-
-    // We have all the ancestors, now open them one-by-one from the top
-    // to bottom.
-    let lastIndex;
-    let view = this.tree.treeBoxObject.view;
-
-    for (let i = line.length - 1; i >= 0; --i) {
-      index = this.view.getRowIndexFromNode(line[i]);
-      if (index < 0) {
-        // Can't find the row, so stop trying to descend.
-        break;
-      }
-      if (i > 0 && !view.isContainerOpen(index)) {
-        view.toggleOpenState(index);
-      }
-      lastIndex = index;
-    }
-
-    if (lastIndex >= 0) {
-      this.selectedRow = lastIndex;
-      return true;
-    }
-    
-    return false;
-  },
-};
-
 ///////////////////////////////////////////////////////////////////////////
 //// InspectorUI
 
@@ -494,6 +333,7 @@ InspectorTreeView.prototype = {
 var InspectorUI = {
   browser: null,
   selectEventsSuppressed: false,
+  showTextNodesWithWhitespace: false,
   inspecting: false,
 
   /**
@@ -504,7 +344,7 @@ var InspectorUI = {
    */
   toggleInspectorUI: function IUI_toggleInspectorUI(aEvent)
   {
-    if (this.isPanelOpen) {
+    if (this.isTreePanelOpen) {
       this.closeInspectorUI(true);
     } else {
       this.openInspectorUI();
@@ -533,8 +373,8 @@ var InspectorUI = {
       this.stylePanel.hidePopup();
     } else {
       this.openStylePanel();
-      if (this.treeView.selectedNode) {
-        this.updateStylePanel(this.treeView.selectedNode);
+      if (this.selection) {
+        this.updateStylePanel(this.selection);
       }
     }
   },
@@ -549,8 +389,8 @@ var InspectorUI = {
     } else {
       this.clearDOMPanel();
       this.openDOMPanel();
-      if (this.treeView.selectedNode) {
-        this.updateDOMPanel(this.treeView.selectedNode);
+      if (this.selection) {
+        this.updateDOMPanel(this.selection);
       }
     }
   },
@@ -560,7 +400,7 @@ var InspectorUI = {
    *
    * @returns boolean
    */
-  get isPanelOpen()
+  get isTreePanelOpen()
   {
     return this.treePanel && this.treePanel.state == "open";
   },
@@ -585,26 +425,145 @@ var InspectorUI = {
     return this.domPanel && this.domPanel.state == "open";
   },
 
+  /**
+   * Return the default selection element for the inspected document.
+   */
+  get defaultSelection()
+  {
+    let doc = this.win.document;
+    return doc.documentElement.lastElementChild;
+  },
+
   /**
    * Open the inspector's tree panel and initialize it.
    */
   openTreePanel: function IUI_openTreePanel()
   {
     if (!this.treePanel) {
-      this.treePanel = document.getElementById("inspector-panel");
+      this.treePanel = document.getElementById("inspector-tree-panel");
       this.treePanel.hidden = false;
     }
-    if (!this.isPanelOpen) {
-      const panelWidthRatio = 7 / 8;
-      const panelHeightRatio = 1 / 5;
-      let bar = document.getElementById("status-bar");
-      this.treePanel.openPopupAtScreen(this.win.screenX + 80,
-        this.win.outerHeight + this.win.screenY);
-      this.treePanel.sizeTo(this.win.outerWidth * panelWidthRatio, 
-        this.win.outerHeight * panelHeightRatio);
-      this.tree = document.getElementById("inspector-tree");
-      this.createDocumentModel();
+
+    const panelWidthRatio = 7 / 8;
+    const panelHeightRatio = 1 / 5;
+    this.treePanel.openPopup(this.browser, "overlap", 80, this.win.innerHeight,
+      false, false);
+    this.treePanel.sizeTo(this.win.outerWidth * panelWidthRatio,
+      this.win.outerHeight * panelHeightRatio);
+
+    this.treeIFrame = document.getElementById("inspector-tree-iframe");
+    this.treeBrowserDocument = this.treeIFrame.contentDocument;
+    this.treePanelDiv = this.treeBrowserDocument.createElement("div");
+    this.treeBrowserDocument.body.appendChild(this.treePanelDiv);
+    this.treePanelDiv.ownerPanel = this;
+    this.ioBox = new InsideOutBox(this, this.treePanelDiv);
+    this.ioBox.createObjectBox(this.win.document.documentElement);
+  },
+
+  createObjectBox: function IUI_createObjectBox(object, isRoot)
+  {
+    let tag = this.domplateUtils.getNodeTag(object);
+    if (tag)
+      return tag.replace({object: object}, this.treeBrowserDocument);
+  },
+
+  getParentObject: function IUI_getParentObject(node)
+  {
+    let parentNode = node ? node.parentNode : null;
+
+    if (!parentNode) {
+      // Documents have no parentNode; Attr, Document, DocumentFragment, Entity,
+      // and Notation. top level windows have no parentNode
+      if (node && node == Node.DOCUMENT_NODE) {
+        // document type
+        if (node.defaultView) {
+          let embeddingFrame = node.defaultView.frameElement;
+          if (embeddingFrame)
+            return embeddingFrame.parentNode;
+        }
+      }
+      // a Document object without a parentNode or window
+      return null;  // top level has no parent
     }
+
+    if (parentNode.nodeType == Node.DOCUMENT_NODE) {
+      if (parentNode.defaultView) {
+        return parentNode.defaultView.frameElement;
+      }
+      if (this.embeddedBrowserParents) {
+        let skipParent = this.embeddedBrowserParents[node];
+        // HTML element? could be iframe?
+        if (skipParent)
+          return skipParent;
+      } else // parent is document element, but no window at defaultView.
+        return null;
+    } else if (!parentNode.localName) {
+      return null;
+    }
+    return parentNode;
+  },
+
+  getChildObject: function IUI_getChildObject(node, index, previousSibling)
+  {
+    if (!node)
+      return null;
+
+    if (node.contentDocument) {
+      // then the node is a frame
+      if (index == 0) {
+        if (!this.embeddedBrowserParents)
+          this.embeddedBrowserParents = {};
+        let skipChild = node.contentDocument.documentElement;
+        this.embeddedBrowserParents[skipChild] = node;
+        return skipChild;  // the node's HTMLElement
+      }
+      return null;
+    }
+
+    if (node instanceof GetSVGDocument) {
+      // then the node is a frame
+      if (index == 0) {
+        if (!this.embeddedBrowserParents)
+          this.embeddedBrowserParents = {};
+        let skipChild = node.getSVGDocument().documentElement;
+        this.embeddedBrowserParents[skipChild] = node;
+        return skipChild;  // the node's SVGElement
+      }
+      return null;
+    }
+
+    let child = null;
+    if (previousSibling)  // then we are walking
+      child = this.getNextSibling(previousSibling);
+    else
+      child = this.getFirstChild(node);
+
+    if (this.showTextNodesWithWhitespace)
+      return child;
+
+    for (; child; child = this.getNextSibling(child)) {
+      if (!this.domplateUtils.isWhitespaceText(child))
+        return child;
+    }
+
+    return null;  // we have no children worth showing.
+  },
+
+  getFirstChild: function IUI_getFirstChild(node)
+  {
+    this.treeWalker = node.ownerDocument.createTreeWalker(node,
+      NodeFilter.SHOW_ALL, null, false);
+    return this.treeWalker.firstChild();
+  },
+
+  getNextSibling: function IUI_getNextSibling(node)
+  {
+    let next = this.treeWalker.nextSibling();
+
+    if (!next)
+      delete this.treeWalker;
+
+    return next;
   },
 
   /**
@@ -664,6 +623,10 @@ var InspectorUI = {
     this.browser = gBrowser.selectedBrowser;
     this.win = this.browser.contentWindow;
     this.winID = this.getWindowID(this.win);
+    if (!this.domplate) {
+      Cu.import("resource:///modules/domplate.jsm", this);
+      this.domplateUtils.setDOM(window);
+    }
 
     // DOM panel initialization and loading (via PropertyPanel.jsm)
     let objectPanelTitle = this.strings.
@@ -693,29 +656,16 @@ var InspectorUI = {
     // setup highlighter and start inspecting
     this.initializeHighlighter();
 
-    if (!InspectorStore.hasID(this.winID) ||
-      InspectorStore.getValue(this.winID, "inspecting")) {
+    // Setup the InspectorStore or restore state
+    this.initializeStore();
+
+    if (InspectorStore.getValue(this.winID, "inspecting"))
       this.startInspecting();
-    }
 
     this.win.document.addEventListener("scroll", this, false);
     this.win.addEventListener("resize", this, false);
     this.inspectCmd.setAttribute("checked", true);
-
-    if (InspectorStore.isEmpty()) {
-      gBrowser.tabContainer.addEventListener("TabSelect", this, false);
-    }
-
-    if (InspectorStore.hasID(this.winID)) {
-      let selectedNode = InspectorStore.getValue(this.winID, "selectedNode");
-      if (selectedNode) {
-        this.inspectNode(selectedNode);
-      }
-    } else {
-      InspectorStore.addStore(this.winID);
-      InspectorStore.setValue(this.winID, "selectedNode", null);
-      this.win.addEventListener("pagehide", this, true);
-    }
+    document.addEventListener("popupshown", this, false);
   },
 
   /**
@@ -726,6 +676,30 @@ var InspectorUI = {
     this.highlighter = new PanelHighlighter(this.browser);
   },
 
+  /**
+   * Initialize the InspectorStore.
+   */
+  initializeStore: function IUI_initializeStore()
+  {
+    // First time opened, add the TabSelect listener
+    if (InspectorStore.isEmpty())
+      gBrowser.tabContainer.addEventListener("TabSelect", this, false);
+
+    // Has this windowID been inspected before?
+    if (InspectorStore.hasID(this.winID)) {
+      let selectedNode = InspectorStore.getValue(this.winID, "selectedNode");
+      if (selectedNode) {
+        this.inspectNode(selectedNode);
+      }
+    } else {
+      // First time inspecting, set state to no selection + live inspection.
+      InspectorStore.addStore(this.winID);
+      InspectorStore.setValue(this.winID, "selectedNode", null);
+      InspectorStore.setValue(this.winID, "inspecting", true);
+      this.win.addEventListener("pagehide", this, true);
+    }
+  },
+
   /**
    * Close inspector UI and associated panels. Unhighlight and stop inspecting.
    * Remove event listeners for document scrolling, resize,
@@ -736,13 +710,21 @@ var InspectorUI = {
    */
   closeInspectorUI: function IUI_closeInspectorUI(aClearStore)
   {
+    if (this.closing || !this.win || !this.browser) {
+      return;
+    }
+
+    this.closing = true;
+
     if (aClearStore) {
       InspectorStore.deleteStore(this.winID);
       this.win.removeEventListener("pagehide", this, true);
     } else {
       // Update the store before closing.
-      InspectorStore.setValue(this.winID, "selectedNode",
-        this.treeView.selectedNode);
+      if (this.selection) {
+        InspectorStore.setValue(this.winID, "selectedNode",
+          this.selection);
+      }
       InspectorStore.setValue(this.winID, "inspecting", this.inspecting);
     }
 
@@ -756,10 +738,28 @@ var InspectorUI = {
     if (this.highlighter && this.highlighter.isHighlighting) {
       this.highlighter.unhighlight();
     }
-    if (this.isPanelOpen) {
+
+    if (this.isTreePanelOpen)
       this.treePanel.hidePopup();
-      this.treeView.destroy();
+    if (this.treePanelDiv) {
+      this.treePanelDiv.ownerPanel = null;
+      let parent = this.treePanelDiv.parentNode;
+      parent.removeChild(this.treePanelDiv);
+      delete this.treePanelDiv;
+      delete this.treeBrowserDocument;
     }
+
+    if (this.treeIFrame)
+      delete this.treeIFrame;
+    delete this.ioBox;
+
+    if (this.domplate) {
+      this.domplateUtils.setDOM(null);
+      delete this.domplate;
+      delete this.HTMLTemplates;
+      delete this.domplateUtils;
+    }
+
     if (this.isStylePanelOpen) {
       this.stylePanel.hidePopup();
     }
@@ -772,6 +772,9 @@ var InspectorUI = {
     this.inspectCmd.setAttribute("checked", false);
     this.browser = this.win = null; // null out references to browser and window
     this.winID = null;
+    this.selection = null;
+    this.closing = false;
+    Services.obs.notifyObservers(null, "inspector-closed", null);
   },
 
   /**
@@ -798,23 +801,40 @@ var InspectorUI = {
     this.inspecting = false;
     this.toggleDimForPanel(this.stylePanel);
     this.toggleDimForPanel(this.domPanel);
-    if (this.treeView.selection) {
-      this.updateStylePanel(this.treeView.selectedNode);
-      this.updateDOMPanel(this.treeView.selectedNode);
+    if (this.highlighter.node) {
+      this.select(this.highlighter.node, true, true);
+    }
+  },
+
+  /**
+   * Select an object in the tree view.
+   * @param aNode
+   *        node to inspect
+   * @param forceUpdate
+   *        force an update?
+   * @param aScroll
+   *        force scroll?
+   */
+  select: function IUI_select(aNode, forceUpdate, aScroll)
+  {
+    if (!aNode)
+      aNode = this.defaultSelection;
+
+    if (forceUpdate || aNode != this.selection) {
+      this.selection = aNode;
+      let box = this.ioBox.createObjectBox(this.selection);
+      if (!this.inspecting) {
+        this.highlighter.highlightNode(this.selection);
+        this.updateStylePanel(this.selection);
+        this.updateDOMPanel(this.selection);
+      }
+      this.ioBox.select(aNode, true, true, aScroll);
     }
   },
 
   /////////////////////////////////////////////////////////////////////////
   //// Model Creation Methods
 
-  /**
-   * Create treeView object from content window.
-   */
-  createDocumentModel: function IUI_createDocumentModel()
-  {
-    this.treeView = new InspectorTreeView(this.win);
-  },
-
   /**
    * Add a new item to the style panel listbox.
    *
@@ -879,8 +899,8 @@ var InspectorUI = {
   createStyleItems: function IUI_createStyleItems(aRules, aSections)
   {
     this.createStyleRuleItems(aRules);
-    let inheritedString = 
-        this.strings.GetStringFromName("style.inheritedFrom");
+    let inheritedString =
+      this.strings.GetStringFromName("style.inheritedFrom");
     aSections.forEach(function(section) {
       let sectionTitle = section.element.tagName;
       if (section.element.id)
@@ -954,19 +974,34 @@ var InspectorUI = {
   {
     let winID = null;
     let win = null;
+    let inspectorClosed = false;
 
     switch (event.type) {
+      case "popupshown":
+        if (event.target.id == "inspector-tree-panel" ||
+            event.target.id == "inspector-style-panel" ||
+            event.target.id == "inspector-dom-panel")
+          if (this.isTreePanelOpen && this.isStylePanelOpen && this.isDOMPanelOpen) {
+            document.removeEventListener("popupshowing", this, false);
+            Services.obs.notifyObservers(null, "inspector-opened", null);
+          }
+        break;
       case "TabSelect":
         winID = this.getWindowID(gBrowser.selectedBrowser.contentWindow);
-        if (this.isPanelOpen && winID != this.winID) {
+        if (this.isTreePanelOpen && winID != this.winID) {
           this.closeInspectorUI(false);
+          inspectorClosed = true;
         }
 
         if (winID && InspectorStore.hasID(winID)) {
-          this.openInspectorUI();
-        }
-
-        if (InspectorStore.isEmpty()) {
+          if (inspectorClosed && this.closing) {
+            Services.obs.addObserver(function () {
+              InspectorUI.openInspectorUI();
+            }, "inspector-closed", false);
+          } else {
+            this.openInspectorUI();
+          }
+        } else if (InspectorStore.isEmpty()) {
           gBrowser.tabContainer.removeEventListener("TabSelect", this, false);
         }
         break;
@@ -1014,24 +1049,31 @@ var InspectorUI = {
   },
 
   /**
-   * Event fired when a tree row is selected in the tree panel.
+   * Handle click events in the html tree panel.
+   * @param aEvent
+   *        The mouse event.
    */
-  onTreeSelected: function IUI_onTreeSelected()
+  onTreeClick: function IUI_onTreeClick(aEvent)
   {
-    if (this.selectEventsSuppressed) {
-      return false;
+    let node;
+    let target = aEvent.target;
+    let hitTwisty = false;
+    if (this.hasClass(target, "twisty")) {
+      node = this.getRepObject(aEvent.target.nextSibling);
+      hitTwisty = true;
+    } else {
+      node = this.getRepObject(aEvent.target);
     }
 
-    let node = this.treeView.selectedNode;
-    this.highlighter.highlightNode(node);
-    this.stopInspecting();
-    this.updateStylePanel(node);
-    this.updateDOMPanel(node);
-    return true;
+    if (node) {
+      if (hitTwisty)
+        this.ioBox.toggleObject(node);
+      this.select(node, false, false);
+    }
   },
 
   /**
-   * Attach event listeners to content window and child windows to enable 
+   * Attach event listeners to content window and child windows to enable
    * highlighting and click to stop inspection.
    */
   attachPageListeners: function IUI_attachPageListeners()
@@ -1066,14 +1108,14 @@ var InspectorUI = {
   {
     this.highlighter.highlightNode(aNode);
     this.selectEventsSuppressed = true;
-    this.treeView.selectedNode = aNode;
+    this.select(aNode, true, true);
     this.selectEventsSuppressed = false;
     this.updateStylePanel(aNode);
     this.updateDOMPanel(aNode);
   },
 
   /**
-   * Find an element from the given coordinates. This method descends through 
+   * Find an element from the given coordinates. This method descends through
    * frames to find the element the user clicked inside frames.
    *
    * @param DOMDocument aDocument the document to look into.
@@ -1104,6 +1146,47 @@ var InspectorUI = {
   ///////////////////////////////////////////////////////////////////////////
   //// Utility functions
 
+  /**
+   * Does the given object have a class attribute?
+   * @param aNode
+   *        the DOM node.
+   * @param aClass
+   *        The class string.
+   * @returns boolean
+   */
+  hasClass: function IUI_hasClass(aNode, aClass)
+  {
+    if (!(aNode instanceof Element))
+      return false;
+    return aNode.classList.contains(aClass);
+  },
+
+  /**
+   * Add the class name to the given object.
+   * @param aNode
+   *        the DOM node.
+   * @param aClass
+   *        The class string.
+   */
+  addClass: function IUI_addClass(aNode, aClass)
+  {
+    if (aNode instanceof Element)
+      aNode.classList.add(aClass);
+  },
+
+  /**
+   * Remove the class name from the given object
+   * @param aNode
+   *        the DOM node.
+   * @param aClass
+   *        The class string.
+   */
+  removeClass: function IUI_removeClass(aNode, aClass)
+  {
+    if (aNode instanceof Element)
+      aNode.classList.remove(aClass);
+  },
+
   /**
    * Retrieve the unique ID of a window object.
    *
@@ -1127,7 +1210,32 @@ var InspectorUI = {
   },
 
   /**
-   * debug logging facility
+   * Get the "repObject" from the HTML panel's domplate-constructed DOM node.
+   * In this system, a "repObject" is the Object being Represented by the box
+   * object. It is the "real" object that we're building our facade around.
+   *
+   * @param element
+   *        The element in the HTML panel the user clicked.
+   * @returns either a real node or null
+   */
+  getRepObject: function IUI_getRepObject(element)
+  {
+    let target = null;
+    for (let child = element; child; child = child.parentNode) {
+      if (this.hasClass(child, "repTarget"))
+        target = child;
+
+      if (child.repObject) {
+        if (!target && this.hasClass(child.repObject, "repIgnore"))
+          break;
+        else
+          return child.repObject;
+      }
+    }
+    return null;
+  },
+
+  /**
    * @param msg
    *        text message to send to the log
    */
@@ -1215,7 +1323,11 @@ var InspectorStore = {
    */
   getValue: function IS_getValue(aID, aKey)
   {
-    return aID in this.store ? this.store[aID][aKey] : null;
+    if (!this.hasID(aID))
+      return null;
+    if (aKey in this.store[aID])
+      return this.store[aID][aKey];
+    return null;
   },
 
   /**
diff --git a/browser/base/content/stylePanel.jsm b/browser/base/content/stylePanel.jsm
index f53a63d29b77..21d8ceb1a1d8 100644
--- a/browser/base/content/stylePanel.jsm
+++ b/browser/base/content/stylePanel.jsm
@@ -312,3 +312,4 @@ var style = {
     }
   },
 };
+
diff --git a/browser/base/content/test/Makefile.in b/browser/base/content/test/Makefile.in
index 4a809bab8bf3..26201f537450 100644
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -164,6 +164,9 @@ _BROWSER_FILES = \
                  browser_inspector_scrolling.js \
                  browser_inspector_store.js \
                  browser_inspector_tab_switch.js \
+                 browser_inspector_treePanel_output.js \
+                 browser_inspector_treePanel_input.html \
+                 browser_inspector_treePanel_result.html \
                  browser_pageInfo.js \
                  browser_page_style_menu.js \
                  browser_pinnedTabs.js \
@@ -185,6 +188,7 @@ _BROWSER_FILES = \
                  browser_visibleTabs_bookmarkAllTabs.js \
                  browser_visibleTabs_tabPreview.js \
                  discovery.html \
+                 domplate_test.js \
                  moz.png \
                  test_bug435035.html \
                  test_bug462673.html \
@@ -200,7 +204,7 @@ _BROWSER_FILES = \
                  browser_tabMatchesInAwesomebar.js \
                  file_bug550565_popup.html \
                  file_bug550565_favicon.ico \
-    $(NULL)
+                 $(NULL)
 
 ifneq (cocoa,$(MOZ_WIDGET_TOOLKIT))
 _BROWSER_FILES += \
diff --git a/browser/base/content/test/browser_inspector_domPanel.js b/browser/base/content/test/browser_inspector_domPanel.js
index 3055ec63b311..e2e3eb26be87 100644
--- a/browser/base/content/test/browser_inspector_domPanel.js
+++ b/browser/base/content/test/browser_inspector_domPanel.js
@@ -56,7 +56,7 @@ function createDocument()
     '<p id="closing">end transmission</p>\n' +
     '</div>';
   doc.title = "Inspector DOM Test";
-  document.addEventListener("popupshown", runDOMTests, false);
+  Services.obs.addObserver(runDOMTests, "inspector-opened", false);
   InspectorUI.openInspectorUI();
 }
 
@@ -71,19 +71,17 @@ function nodeGenerator()
   let first = doc.getElementById("first");
   InspectorUI.inspectNode(first);
   yield;
-  let closing = doc.getElementById("#closing");
+  let closing = doc.getElementById("closing");
   InspectorUI.inspectNode(closing);
   yield;
 }
 
-function runDOMTests(evt)
+function runDOMTests()
 {
-  if (evt.target.id != "inspector-dom-panel")
-    return true;
   InspectorUI._log("runDOMtests");
-  document.removeEventListener("popupshown", runDOMTests, false);
-  InspectorUI.stopInspecting();
+  Services.obs.removeObserver(runDOMTests, "inspector-opened", false);
   document.addEventListener("popupshown", performTestComparisons, false);
+  InspectorUI.stopInspecting();
   testGen = nodeGenerator();
   testGen.next();
 }
@@ -94,7 +92,7 @@ function performTestComparisons(evt)
   if (evt.target.id != "highlighter-panel")
     return true;
 
-  ok(InspectorUI.treeView.selectedNode, "selection");
+  ok(InspectorUI.selection, "selection");
   ok(InspectorUI.isDOMPanelOpen, "DOM panel is open?");
   ok(InspectorUI.highlighter.isHighlighting, "panel is highlighting");
   ok(InspectorUI.domTreeView.rowCount > 0, "domBox has items");
diff --git a/browser/base/content/test/browser_inspector_highlighter.js b/browser/base/content/test/browser_inspector_highlighter.js
index 826b14308934..82b2cab9fac5 100644
--- a/browser/base/content/test/browser_inspector_highlighter.js
+++ b/browser/base/content/test/browser_inspector_highlighter.js
@@ -78,15 +78,13 @@ function setupHighlighterTests()
 {
   h1 = doc.querySelectorAll("h1")[0];
   ok(h1, "we have the header node");
-  document.addEventListener("popupshown", runSelectionTests, false);
+  Services.obs.addObserver(runSelectionTests, "inspector-opened", false);
   InspectorUI.toggleInspectorUI();
 }
 
-function runSelectionTests(evt)
+function runSelectionTests()
 {
-  if (evt.target.id != "inspector-panel")
-    return true;
-  document.removeEventListener("popupshown", runSelectionTests, false);
+  Services.obs.removeObserver(runSelectionTests, "inspector-opened", false);
   document.addEventListener("popupshown", performTestComparisons, false);
   EventUtils.synthesizeMouse(h1, 2, 2, {type: "mousemove"}, content);
 }
@@ -96,7 +94,7 @@ function performTestComparisons(evt)
   if (evt.target.id != "highlighter-panel")
     return true;
   document.removeEventListener("popupshown", performTestComparisons, false);
-  is(h1, InspectorUI.treeView.selectedNode, "selection matches node");
+  is(h1, InspectorUI.selection, "selection matches node");
   ok(InspectorUI.highlighter.isHighlighting, "panel is highlighting");
   is(InspectorUI.highlighter.highlitNode, h1, "highlighter matches selection");
   executeSoon(finishUp);
diff --git a/browser/base/content/test/browser_inspector_iframeTest.js b/browser/base/content/test/browser_inspector_iframeTest.js
index ddcc8ed35e36..3ff84f853c5d 100644
--- a/browser/base/content/test/browser_inspector_iframeTest.js
+++ b/browser/base/content/test/browser_inspector_iframeTest.js
@@ -79,30 +79,27 @@ function createDocument()
 
 function setupIframeTests()
 {
-  document.addEventListener("popupshown", runIframeTests, false);
-  InspectorUI.toggleInspectorUI();
+  Services.obs.addObserver(runIframeTests, "inspector-opened", false);
+  InspectorUI.openInspectorUI();
 }
 
-function runIframeTests(evt)
+function runIframeTests()
 {
-  if (evt.target.id != "inspector-panel")
-    return true;
-
-  document.removeEventListener("popupshown", runIframeTests, false);
+  Services.obs.removeObserver(runIframeTests, "inspector-opened", false);
   document.addEventListener("popupshown", performTestComparisons1, false);
-
   EventUtils.synthesizeMouse(div1, 2, 2, {type: "mousemove"},
     iframe1.contentWindow);
 }
 
 function performTestComparisons1(evt)
 {
-  if (evt.target.id != "highlighter-panel")
+  if (evt.target.id != "highlighter-panel") {
     return true;
+  }
 
-  document.removeEventListener("popupshown", performTestComparisons1, false);
+  document.removeEventListener(evt.type, arguments.callee, false);
 
-  is(InspectorUI.treeView.selectedNode, div1, "selection matches div1 node");
+  is(InspectorUI.selection, div1, "selection matches div1 node");
   is(InspectorUI.highlighter.highlitNode, div1, "highlighter matches selection");
 
   document.addEventListener("popupshown", performTestComparisons2, false);
@@ -113,12 +110,13 @@ function performTestComparisons1(evt)
 
 function performTestComparisons2(evt)
 {
-  if (evt.target.id != "highlighter-panel")
+  if (evt.target.id != "highlighter-panel") {
     return true;
+  }
 
-  document.removeEventListener("popupshown", performTestComparisons2, false);
+  document.removeEventListener(evt.type, arguments.callee, false);
 
-  is(InspectorUI.treeView.selectedNode, div2, "selection matches div2 node");
+  is(InspectorUI.selection, div2, "selection matches div2 node");
   is(InspectorUI.highlighter.highlitNode, div2, "highlighter matches selection");
 
   executeSoon(finishUp);
@@ -139,7 +137,7 @@ function test()
     doc = content.document;
     waitForFocus(createDocument, content);
   }, true);
-  
+
   content.location = "data:text/html,iframe tests for inspector";
 }
 
diff --git a/browser/base/content/test/browser_inspector_initialization.js b/browser/base/content/test/browser_inspector_initialization.js
index 71e132aa9ab4..96f1c6f761c0 100644
--- a/browser/base/content/test/browser_inspector_initialization.js
+++ b/browser/base/content/test/browser_inspector_initialization.js
@@ -42,31 +42,27 @@ let doc;
 function startInspectorTests()
 {
   ok(InspectorUI, "InspectorUI variable exists");
-  document.addEventListener("popupshown", runInspectorTests, false);
+  Services.obs.addObserver(runInspectorTests, "inspector-opened", false);
   InspectorUI.toggleInspectorUI();
 }
 
-function runInspectorTests(evt)
+function runInspectorTests()
 {
-  if (evt.target.id != "inspector-dom-panel")
-    return true;
-  document.removeEventListener("popupshown", runInspectorTests, false);
-  document.addEventListener("popuphidden", finishInspectorTests, false);
+  Services.obs.removeObserver(runInspectorTests, "inspector-opened", false);
+  Services.obs.addObserver(finishInspectorTests, "inspector-closed", false);
   ok(InspectorUI.inspecting, "Inspector is highlighting");
-  ok(InspectorUI.isPanelOpen, "Inspector Tree Panel is open");
+  ok(InspectorUI.isTreePanelOpen, "Inspector Tree Panel is open");
   ok(InspectorUI.isStylePanelOpen, "Inspector Style Panel is open");
   ok(InspectorUI.isDOMPanelOpen, "Inspector DOM Panel is open");
-  InspectorUI.toggleInspectorUI();
+  InspectorUI.closeInspectorUI(true);
 }
 
-function finishInspectorTests(evt)
+function finishInspectorTests()
 {
-  if (evt.target.id != "inspector-dom-panel")
-    return true;
-  document.removeEventListener("popuphidden", finishInspectorTests, false);
+  Services.obs.removeObserver(finishInspectorTests, "inspector-closed", false);
   ok(!InspectorUI.isDOMPanelOpen, "Inspector DOM Panel is closed");
   ok(!InspectorUI.isStylePanelOpen, "Inspector Style Panel is closed");
-  ok(!InspectorUI.isPanelOpen, "Inspector Tree Panel is closed");
+  ok(!InspectorUI.isTreePanelOpen, "Inspector Tree Panel is closed");
   ok(!InspectorUI.inspecting, "Inspector is not highlighting");
   gBrowser.removeCurrentTab();
   finish();
diff --git a/browser/base/content/test/browser_inspector_scrolling.js b/browser/base/content/test/browser_inspector_scrolling.js
index 69feaa30e221..8bcc60ead766 100644
--- a/browser/base/content/test/browser_inspector_scrolling.js
+++ b/browser/base/content/test/browser_inspector_scrolling.js
@@ -65,17 +65,13 @@ function createDocument()
 
 function toggleInspector()
 {
-  document.addEventListener("popupshown", inspectNode, false);
+  Services.obs.addObserver(inspectNode, "inspector-opened", false);
   InspectorUI.toggleInspectorUI();
 }
 
-function inspectNode(aEvent)
+function inspectNode()
 {
-  if (aEvent.target.id != "inspector-panel") {
-    return true;
-  }
-
-  document.removeEventListener("popupshown", inspectNode, false);
+  Services.obs.removeObserver(inspectNode, "inspector-opened", false);
   document.addEventListener("popupshown", performScrollingTest, false);
 
   InspectorUI.inspectNode(div)
diff --git a/browser/base/content/test/browser_inspector_stylePanel.js b/browser/base/content/test/browser_inspector_stylePanel.js
index fd06ccef16d9..d4d2e7d165f2 100644
--- a/browser/base/content/test/browser_inspector_stylePanel.js
+++ b/browser/base/content/test/browser_inspector_stylePanel.js
@@ -64,7 +64,7 @@ function setupStyleTests()
 {
   spans = doc.querySelectorAll("span");
   ok(spans, "captain, we have the spans");
-  document.addEventListener("popupshown", runStyleTests, false);
+  Services.obs.addObserver(runStyleTests, "inspector-opened", false);
   InspectorUI.openInspectorUI();
 }
 
@@ -76,11 +76,9 @@ function spanGenerator()
   }
 }
 
-function runStyleTests(evt)
+function runStyleTests()
 {
-  if (evt.target.id != "inspector-style-panel")
-    return true;
-  document.removeEventListener("popupshown", runStyleTests, false);
+  Services.obs.removeObserver(runStyleTests, "inspector-opened", false);
   document.addEventListener("popupshown", performTestComparisons, false);
   InspectorUI.stopInspecting();
   testGen = spanGenerator();
@@ -92,7 +90,7 @@ function performTestComparisons(evt)
   if (evt.target.id != "highlighter-panel")
     return true;
 
-  ok(InspectorUI.treeView.selectedNode, "selection");
+  ok(InspectorUI.selection, "selection");
   ok(InspectorUI.isStylePanelOpen, "style panel is open?");
   ok(InspectorUI.highlighter.isHighlighting, "panel is highlighting");
   ok(InspectorUI.styleBox.itemCount > 0, "styleBox has items");
diff --git a/browser/base/content/test/browser_inspector_tab_switch.js b/browser/base/content/test/browser_inspector_tab_switch.js
index a77c13dd430f..07980d051f12 100644
--- a/browser/base/content/test/browser_inspector_tab_switch.js
+++ b/browser/base/content/test/browser_inspector_tab_switch.js
@@ -49,21 +49,17 @@ function inspectorTabOpen1()
   ok(!InspectorUI.inspecting, "Inspector is not highlighting");
   ok(InspectorStore.isEmpty(), "InspectorStore is empty");
 
-  document.addEventListener("popupshown", inspectorUIOpen1, false);
-  InspectorUI.toggleInspectorUI();
+  Services.obs.addObserver(inspectorUIOpen1, "inspector-opened", false);
+  InspectorUI.openInspectorUI();
 }
 
-function inspectorUIOpen1(evt)
+function inspectorUIOpen1()
 {
-  if (evt.target.id != "inspector-style-panel") {
-    return true;
-  }
-
-  document.removeEventListener(evt.type, arguments.callee, false);
+  Services.obs.removeObserver(inspectorUIOpen1, "inspector-opened", false);
 
   // Make sure the inspector is open.
   ok(InspectorUI.inspecting, "Inspector is highlighting");
-  ok(InspectorUI.isPanelOpen, "Inspector Tree Panel is open");
+  ok(InspectorUI.isTreePanelOpen, "Inspector Tree Panel is open");
   ok(InspectorUI.isStylePanelOpen, "Inspector Style Panel is open");
   ok(!InspectorStore.isEmpty(), "InspectorStore is not empty");
   is(InspectorStore.length, 1, "InspectorStore.length = 1");
@@ -71,8 +67,7 @@ function inspectorUIOpen1(evt)
   // Highlight a node.
   div = content.document.getElementsByTagName("div")[0];
   InspectorUI.inspectNode(div);
-  is(InspectorUI.treeView.selectedNode, div,
-    "selection matches the div element");
+  is(InspectorUI.selection, div, "selection matches the div element");
 
   // Open the second tab.
   tab2 = gBrowser.addTab();
@@ -95,21 +90,17 @@ function inspectorTabOpen2()
   is(InspectorStore.length, 1, "InspectorStore.length = 1");
 
   // Activate the inspector again.
-  document.addEventListener("popupshown", inspectorUIOpen2, false);
-  InspectorUI.toggleInspectorUI();
+  Services.obs.addObserver(inspectorUIOpen2, "inspector-opened", false);
+  InspectorUI.openInspectorUI();
 }
 
-function inspectorUIOpen2(evt)
+function inspectorUIOpen2()
 {
-  if (evt.target.id != "inspector-style-panel") {
-    return true;
-  }
-
-  document.removeEventListener(evt.type, arguments.callee, false);
+  Services.obs.removeObserver(inspectorUIOpen2, "inspector-opened", false);
 
   // Make sure the inspector is open.
   ok(InspectorUI.inspecting, "Inspector is highlighting");
-  ok(InspectorUI.isPanelOpen, "Inspector Tree Panel is open");
+  ok(InspectorUI.isTreePanelOpen, "Inspector Tree Panel is open");
   ok(InspectorUI.isStylePanelOpen, "Inspector Style Panel is open");
   is(InspectorStore.length, 2, "InspectorStore.length = 2");
 
@@ -118,50 +109,40 @@ function inspectorUIOpen2(evt)
   ok(!InspectorUI.inspecting, "Inspector is not highlighting");
 
   // Switch back to tab 1.
-  document.addEventListener("popupshown", inspectorFocusTab1, false);
+  Services.obs.addObserver(inspectorFocusTab1, "inspector-opened", false);
   gBrowser.selectedTab = tab1;
 }
 
-function inspectorFocusTab1(evt)
+function inspectorFocusTab1()
 {
-  if (evt.target.id != "inspector-style-panel") {
-    return true;
-  }
-
-  document.removeEventListener(evt.type, arguments.callee, false);
+  Services.obs.removeObserver(inspectorFocusTab1, "inspector-opened", false);
 
   // Make sure the inspector is still open.
   ok(InspectorUI.inspecting, "Inspector is highlighting");
-  ok(InspectorUI.isPanelOpen, "Inspector Tree Panel is open");
+  ok(InspectorUI.isTreePanelOpen, "Inspector Tree Panel is open");
   ok(InspectorUI.isStylePanelOpen, "Inspector Style Panel is open");
   is(InspectorStore.length, 2, "InspectorStore.length = 2");
-  is(InspectorUI.treeView.selectedNode, div,
-    "selection matches the div element");
+  is(InspectorUI.selection, div, "selection matches the div element");
 
   // Switch back to tab 2.
-  document.addEventListener("popupshown", inspectorFocusTab2, false);
+  Services.obs.addObserver(inspectorFocusTab2, "inspector-opened", false);
   gBrowser.selectedTab = tab2;
 }
 
-function inspectorFocusTab2(evt)
+function inspectorFocusTab2()
 {
-  if (evt.target.id != "inspector-style-panel") {
-    return true;
-  }
-
-  document.removeEventListener(evt.type, arguments.callee, false);
+  Services.obs.removeObserver(inspectorFocusTab2, "inspector-opened", false);
 
   // Make sure the inspector is still open.
   ok(!InspectorUI.inspecting, "Inspector is not highlighting");
-  ok(InspectorUI.isPanelOpen, "Inspector Tree Panel is open");
+  ok(InspectorUI.isTreePanelOpen, "Inspector Tree Panel is open");
   ok(InspectorUI.isStylePanelOpen, "Inspector Style Panel is open");
   is(InspectorStore.length, 2, "InspectorStore.length = 2");
-  isnot(InspectorUI.treeView.selectedNode, div,
-    "selection does not match the div element");
+  isnot(InspectorUI.selection, div, "selection does not match the div element");
 
   // Remove tab 1.
   tab1window = gBrowser.getBrowserForTab(tab1).contentWindow;
-  tab1window.addEventListener("unload", inspectorTabUnload1, false);
+  tab1window.addEventListener("pagehide", inspectorTabUnload1, false);
   gBrowser.removeTab(tab1);
 }
 
@@ -172,7 +153,7 @@ function inspectorTabUnload1(evt)
 
   // Make sure the Inspector is still open and that the state is correct.
   ok(!InspectorUI.inspecting, "Inspector is not highlighting");
-  ok(InspectorUI.isPanelOpen, "Inspector Tree Panel is open");
+  ok(InspectorUI.isTreePanelOpen, "Inspector Tree Panel is open");
   ok(InspectorUI.isStylePanelOpen, "Inspector Style Panel is open");
   is(InspectorStore.length, 1, "InspectorStore.length = 1");
 
diff --git a/browser/base/content/test/browser_inspector_treePanel_input.html b/browser/base/content/test/browser_inspector_treePanel_input.html
new file mode 100644
index 000000000000..64b3d367bb39
--- /dev/null
+++ b/browser/base/content/test/browser_inspector_treePanel_input.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html xml:lang="en">
+  <head>
+    <meta charset="utf-8">
+    <title>Inspector tree panel test</title>
+    <style type="text/css"><!--
+      #duplicate { color: green }
+    --></style>
+    <script type="text/javascript"><!--
+      function fooBarBaz(arg1) {
+        return true; // do nothing
+      }
+    // --></script>
+  </head>
+  <body arbitrary:attribute="value">
+    <p>Inspector tree panel test.</p>
+
+    <div id="foo" class="foo bar baz" style="border:1px solid red; 
+      unknownProperty: unknownValue; color: withUnkownValue">
+      <unknownTag unknownAttribute="fooBar">
+        <p unknownAttribute="fooBar" data-test1="value">hello world!</p>
+      </unknownTag>
+    </div>
+
+    <div id="duplicate" id="duplicate" id="different" class="test" class="foo" 
+      fooBar="baz" fooBar="bazbaz">test</div>
+
+    <iframe src="data:text/html,&lt;div&gt;hello from an iframe!&lt;/div&gt;">no 
+      frames!</iframe>
+
+    <!-- hello world from a comment! -->
+  </body>
+</html>
diff --git a/browser/base/content/test/browser_inspector_treePanel_output.js b/browser/base/content/test/browser_inspector_treePanel_output.js
new file mode 100644
index 000000000000..e2b729950d7e
--- /dev/null
+++ b/browser/base/content/test/browser_inspector_treePanel_output.js
@@ -0,0 +1,123 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Inspector iframe Tests.
+ *
+ * The Initial Developer of the Original Code is
+ * The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Mihai Șucan <mihai.sucan@gmail.com>
+ *   Rob Campbell <rcampbell@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+let doc = null;
+let xhr = null;
+let expectedResult = "";
+
+const TEST_URI = "http://mochi.test:8888/browser/browser/base/content/test/browser_inspector_treePanel_input.html";
+const RESULT_URI = "http://mochi.test:8888/browser/browser/base/content/test/browser_inspector_treePanel_result.html";
+
+function tabFocused()
+{
+  xhr = new XMLHttpRequest();
+  xhr.onreadystatechange = xhr_onReadyStateChange;
+  xhr.open("GET", RESULT_URI, true);
+  xhr.send(null);
+}
+
+function xhr_onReadyStateChange() {
+  if (xhr.readyState != 4) {
+    return;
+  }
+
+  is(xhr.status, 200, "xhr.status is 200");
+  ok(!!xhr.responseText, "xhr.responseText is available");
+  expectedResult = xhr.responseText.replace(/^\s+|\s+$/mg, '');
+  xhr = null;
+
+  Services.obs.addObserver(inspectorOpened, "inspector-opened", false);
+  InspectorUI.openInspectorUI();
+}
+
+function inspectorOpened()
+{
+  Services.obs.removeObserver(inspectorOpened, "inspector-opened", false);
+
+  ok(InspectorUI.inspecting, "Inspector is highlighting");
+  ok(InspectorUI.isTreePanelOpen, "Inspector Tree Panel is open");
+  InspectorUI.stopInspecting();
+  ok(!InspectorUI.inspecting, "Inspector is not highlighting");
+
+  let elements = doc.querySelectorAll("meta, script, style, p[unknownAttribute]");
+  for (let i = 0; i < elements.length; i++) {
+    InspectorUI.inspectNode(elements[i]);
+  }
+
+  let iframe = doc.querySelector("iframe");
+  ok(iframe, "Found the iframe tag");
+  ok(iframe.contentDocument, "Found the iframe.contentDocument");
+
+  let iframeDiv = iframe.contentDocument.querySelector("div");
+  ok(iframeDiv, "Found the div element inside the iframe");
+  InspectorUI.inspectNode(iframeDiv);
+
+  ok(InspectorUI.treePanelDiv, "InspectorUI.treePanelDiv is available");
+  is(InspectorUI.treePanelDiv.innerHTML.replace(/^\s+|\s+$/mg, ''),
+    expectedResult, "treePanelDiv.innerHTML is correct");
+  expectedResult = null;
+
+  Services.obs.addObserver(inspectorClosed, "inspector-closed", false);
+  InspectorUI.closeInspectorUI();
+}
+
+function inspectorClosed()
+{
+  Services.obs.removeObserver(inspectorClosed, "inspector-closed", false);
+
+  ok(!InspectorUI.inspecting, "Inspector is not highlighting");
+  ok(!InspectorUI.isTreePanelOpen, "Inspector Tree Panel is not open");
+
+  gBrowser.removeCurrentTab();
+  finish();
+}
+
+function test()
+{
+  waitForExplicitFinish();
+  gBrowser.selectedTab = gBrowser.addTab();
+  gBrowser.selectedBrowser.addEventListener("load", function(evt) {
+    gBrowser.selectedBrowser.removeEventListener(evt.type, arguments.callee, true);
+    doc = content.document;
+    waitForFocus(tabFocused, content);
+  }, true);
+  
+  content.location = TEST_URI;
+}
diff --git a/browser/base/content/test/browser_inspector_treePanel_result.html b/browser/base/content/test/browser_inspector_treePanel_result.html
new file mode 100644
index 000000000000..1156a1f251ed
--- /dev/null
+++ b/browser/base/content/test/browser_inspector_treePanel_result.html
@@ -0,0 +1,8 @@
+<div role="presentation" class="nodeBox htmlNodeBox containerNodeBox  repIgnore open"><div class="docType ">&lt;!DOCTYPE html&gt;</div><div role="presentation" class="nodeLabel "><img role="presentation" class="twisty "><span role="treeitem" aria-expanded="true" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">html</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">xml:lang</span>="<span class="nodeValue editable ">en</span>"</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div><div role="group" class="nodeChildBox "><div role="presentation" class="nodeBox containerNodeBox  repIgnore open"><div role="presentation" class="nodeLabel "><img role="presentation" class="twisty "><span role="treeitem" aria-expanded="true" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">head</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div><div role="group" class="nodeChildBox "><div role="presentation" class="nodeBox emptyNodeBox  repIgnore"><div role="presentation" class="nodeLabel "><span role="treeitem" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">meta</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">charset</span>="<span class="nodeValue editable ">utf-8</span>"</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div></div><div role="presentation" class="nodeBox textNodeBox  repIgnore "><div role="presentation" class="nodeLabel "><span role="treeitem" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">title</span><span class="nodeBracket editable insertBefore ">&gt;</span><span class="nodeText editable "><span class="  ">Inspector tree panel test</span></span>&lt;/<span class="nodeTag ">title</span>&gt;</span></div></div><div role="presentation" class="nodeBox containerNodeBox  repIgnore open"><div role="presentation" class="nodeLabel "><img role="presentation" class="twisty "><span role="treeitem" aria-expanded="true" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">style</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">type</span>="<span class="nodeValue editable ">text/css</span>"</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div><div role="group" class="nodeChildBox "><div role="presentation" class="nodeBox "><span class="nodeText editable "><span class="  ">&lt;!--
+#duplicate { color: green }
+--&gt;</span></span></div></div><div role="presentation" class="nodeCloseLabel "><span class="nodeCloseLabelBox repTarget ">&lt;/<span class="nodeTag ">style</span>&gt;</span></div></div><div role="presentation" class="nodeBox containerNodeBox  repIgnore open"><div role="presentation" class="nodeLabel "><img role="presentation" class="twisty "><span role="treeitem" aria-expanded="true" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">script</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">type</span>="<span class="nodeValue editable ">text/javascript</span>"</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div><div role="group" class="nodeChildBox "><div role="presentation" class="nodeBox "><span class="nodeText editable "><span class="  ">&lt;!--
+function fooBarBaz(arg1) {
+return true; // do nothing
+}
+// --&gt;</span></span></div></div><div role="presentation" class="nodeCloseLabel "><span class="nodeCloseLabelBox repTarget ">&lt;/<span class="nodeTag ">script</span>&gt;</span></div></div></div><div role="presentation" class="nodeCloseLabel "><span class="nodeCloseLabelBox repTarget ">&lt;/<span class="nodeTag ">head</span>&gt;</span></div></div><div role="presentation" class="nodeBox containerNodeBox  repIgnore open"><div role="presentation" class="nodeLabel "><img role="presentation" class="twisty "><span role="treeitem" aria-expanded="true" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">body</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">arbitrary:attribute</span>="<span class="nodeValue editable ">value</span>"</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div><div role="group" class="nodeChildBox "><div role="presentation" class="nodeBox textNodeBox  repIgnore "><div role="presentation" class="nodeLabel "><span role="treeitem" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">p</span><span class="nodeBracket editable insertBefore ">&gt;</span><span class="nodeText editable "><span class="  ">Inspector tree panel test.</span></span>&lt;/<span class="nodeTag ">p</span>&gt;</span></div></div><div role="presentation" class="nodeBox containerNodeBox  repIgnore open"><div role="presentation" class="nodeLabel "><img role="presentation" class="twisty "><span role="treeitem" aria-expanded="true" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">div</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">id</span>="<span class="nodeValue editable ">foo</span>"</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">class</span>="<span class="nodeValue editable ">foo bar baz</span>"</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">style</span>="<span class="nodeValue editable ">border:1px solid red;
+unknownProperty: unknownValue; color: withUnkownValue</span>"</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div><div role="group" class="nodeChildBox "><div role="presentation" class="nodeBox containerNodeBox  repIgnore open"><div role="presentation" class="nodeLabel "><img role="presentation" class="twisty "><span role="treeitem" aria-expanded="true" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">unknowntag</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">unknownattribute</span>="<span class="nodeValue editable ">fooBar</span>"</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div><div role="group" class="nodeChildBox "><div role="presentation" class="nodeBox textNodeBox  repIgnore"><div role="presentation" class="nodeLabel "><span role="treeitem" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">p</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">data-test1</span>="<span class="nodeValue editable ">value</span>"</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">unknownattribute</span>="<span class="nodeValue editable ">fooBar</span>"</span><span class="nodeBracket editable insertBefore ">&gt;</span><span class="nodeText editable "><span class="  ">hello world!</span></span>&lt;/<span class="nodeTag ">p</span>&gt;</span></div></div></div><div role="presentation" class="nodeCloseLabel "><span class="nodeCloseLabelBox repTarget ">&lt;/<span class="nodeTag ">unknowntag</span>&gt;</span></div></div></div><div role="presentation" class="nodeCloseLabel "><span class="nodeCloseLabelBox repTarget ">&lt;/<span class="nodeTag ">div</span>&gt;</span></div></div><div role="presentation" class="nodeBox textNodeBox  repIgnore "><div role="presentation" class="nodeLabel "><span role="treeitem" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">div</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">id</span>="<span class="nodeValue editable ">duplicate</span>"</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">class</span>="<span class="nodeValue editable ">test</span>"</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">foobar</span>="<span class="nodeValue editable ">baz</span>"</span><span class="nodeBracket editable insertBefore ">&gt;</span><span class="nodeText editable "><span class="  ">test</span></span>&lt;/<span class="nodeTag ">div</span>&gt;</span></div></div><div role="presentation" class="nodeBox containerNodeBox  repIgnore open"><div role="presentation" class="nodeLabel "><img role="presentation" class="twisty "><span role="treeitem" aria-expanded="true" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">iframe</span><span class="nodeAttr editGroup ">&nbsp;<span class="nodeName editable ">src</span>="<span class="nodeValue editable ">data:text/html,&lt;div&gt;hello from an iframe!&lt;/div&gt;</span>"</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div><div role="group" class="nodeChildBox "><div role="presentation" class="nodeBox containerNodeBox  repIgnore open"><div role="presentation" class="nodeLabel "><img role="presentation" class="twisty "><span role="treeitem" aria-expanded="true" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">html</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div><div role="group" class="nodeChildBox "><div role="presentation" class="nodeBox textNodeBox  repIgnore "><div role="presentation" class="nodeLabel "><span role="treeitem" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">head</span><span class="nodeBracket editable insertBefore ">&gt;</span><span class="nodeText editable "><span class="  "></span></span>&lt;/<span class="nodeTag ">head</span>&gt;</span></div></div><div role="presentation" class="nodeBox containerNodeBox  repIgnore open"><div role="presentation" class="nodeLabel "><img role="presentation" class="twisty "><span role="treeitem" aria-expanded="true" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">body</span><span class="nodeBracket editable insertBefore ">&gt;</span></span></div><div role="group" class="nodeChildBox "><div role="presentation" class="nodeBox textNodeBox  repIgnore selected"><div role="presentation" class="nodeLabel "><span role="treeitem" class="nodeLabelBox repTarget ">&lt;<span class="nodeTag ">div</span><span class="nodeBracket editable insertBefore ">&gt;</span><span class="nodeText editable "><span class="  ">hello from an iframe!</span></span>&lt;/<span class="nodeTag ">div</span>&gt;</span></div></div></div><div role="presentation" class="nodeCloseLabel "><span class="nodeCloseLabelBox repTarget ">&lt;/<span class="nodeTag ">body</span>&gt;</span></div></div></div><div role="presentation" class="nodeCloseLabel "><span class="nodeCloseLabelBox repTarget ">&lt;/<span class="nodeTag ">html</span>&gt;</span></div></div></div><div role="presentation" class="nodeCloseLabel "><span class="nodeCloseLabelBox repTarget ">&lt;/<span class="nodeTag ">iframe</span>&gt;</span></div></div><div role="presentation" class="nodeBox nodeComment ">&lt;!--<span class="nodeComment editable "> hello world from a comment! </span>--&gt;</div></div><div role="presentation" class="nodeCloseLabel "><span class="nodeCloseLabelBox repTarget ">&lt;/<span class="nodeTag ">body</span>&gt;</span></div></div></div><div role="presentation" class="nodeCloseLabel "><span class="nodeCloseLabelBox repTarget ">&lt;/<span class="nodeTag ">html</span>&gt;</span></div></div>
diff --git a/browser/base/content/test/browser_inspector_treeSelection.js b/browser/base/content/test/browser_inspector_treeSelection.js
index 6da08547f307..9f328d69e29f 100644
--- a/browser/base/content/test/browser_inspector_treeSelection.js
+++ b/browser/base/content/test/browser_inspector_treeSelection.js
@@ -68,18 +68,16 @@ function setupSelectionTests()
 {
   h1 = doc.querySelectorAll("h1")[0];
   ok(h1, "we have the header node");
-  document.addEventListener("popupshown", runSelectionTests, false);
+  Services.obs.addObserver(runSelectionTests, "inspector-opened", false);
   InspectorUI.openInspectorUI();
 }
 
-function runSelectionTests(evt)
+function runSelectionTests()
 {
-  if (evt.target.id != "inspector-panel")
-    return true;
-  document.removeEventListener("popupshown", runSelectionTests, false);
+  Services.obs.removeObserver(runSelectionTests, "inspector-opened", false);
   InspectorUI.stopInspecting();
   document.addEventListener("popupshown", performTestComparisons, false);
-  InspectorUI.treeView.selectedNode = h1;
+  InspectorUI.inspectNode(h1);
 }
 
 function performTestComparisons(evt)
@@ -87,7 +85,7 @@ function performTestComparisons(evt)
   if (evt.target.id != "highlighter-panel")
     return true;
   document.removeEventListener("popupshown", performTestComparisons, false);
-  is(h1, InspectorUI.treeView.selectedNode, "selection matches node");
+  is(h1, InspectorUI.selection, "selection matches node");
   ok(InspectorUI.highlighter.isHighlighting, "panel is highlighting");
   is(h1, InspectorUI.highlighter.highlitNode, "highlighter highlighting correct node");
   finishUp();
diff --git a/browser/base/content/test/domplate_test.js b/browser/base/content/test/domplate_test.js
new file mode 100644
index 000000000000..282a7edceb5f
--- /dev/null
+++ b/browser/base/content/test/domplate_test.js
@@ -0,0 +1,84 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Domplate Test.
+ *
+ * The Initial Developer of the Original Code is
+ * The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Rob Campbell <rcampbell@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+let doc;
+let div;
+let plate;
+
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+Components.utils.import("resource:///modules/domplate.jsm");
+
+function createDocument()
+{
+  doc.body.innerHTML = '<div id="first">no</div>';
+  doc.title = "Domplate Test";
+  setupDomplateTests();
+}
+
+function setupDomplateTests()
+{
+  ok(domplate, "domplate is defined");
+  plate = domplate({tag: domplate.DIV("Hello!")});
+  ok(plate, "template is defined");
+  div = doc.getElementById("first");
+  ok(div, "we have our div");
+  plate.tag.replace({}, div, template);
+  is(div.innerText, "Hello!", "Is the div's innerText replaced?");
+  finishUp();
+}
+
+function finishUp()
+{
+  gBrowser.removeCurrentTab();
+  finish();
+}
+
+function test()
+{
+  waitForExplicitFinish();
+  gBrowser.selectedTab = gBrowser.addTab();
+  gBrowser.selectedBrowser.addEventListener("load", function() {
+    gBrowser.selectedBrowser.removeEventListener("load", arguments.callee, true);
+    doc = content.document;
+    waitForFocus(createDocument, content);
+  }, true);
+
+  content.location = "data:text/html,basic domplate tests";
+}
+
diff --git a/browser/base/jar.mn b/browser/base/jar.mn
index 3e38a94ecbd7..4335d3b049db 100644
--- a/browser/base/jar.mn
+++ b/browser/base/jar.mn
@@ -30,6 +30,7 @@ browser.jar:
 *       content/browser/browser-tabPreviews.xml       (content/browser-tabPreviews.xml)
 *       content/browser/credits.xhtml                 (content/credits.xhtml)
 *       content/browser/fullscreen-video.xhtml        (content/fullscreen-video.xhtml)
+*       content/browser/inspector.html                (content/inspector.html)
 *       content/browser/pageinfo/pageInfo.xul         (content/pageinfo/pageInfo.xul)
 *       content/browser/pageinfo/pageInfo.js          (content/pageinfo/pageInfo.js)
 *       content/browser/pageinfo/pageInfo.css         (content/pageinfo/pageInfo.css)
diff --git a/browser/themes/gnomestripe/browser/inspector.css b/browser/themes/gnomestripe/browser/inspector.css
new file mode 100644
index 000000000000..c2764611e21a
--- /dev/null
+++ b/browser/themes/gnomestripe/browser/inspector.css
@@ -0,0 +1,377 @@
+/*
+ * Software License Agreement (BSD License)
+ *
+ * Copyright (c) 2007, Parakey Inc.
+ * All rights reserved.
+ * 
+ * Redistribution and use of this software in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ * 
+ * * Redistributions of source code must retain the above
+ *   copyright notice, this list of conditions and the
+ *   following disclaimer.
+ * 
+ * * Redistributions in binary form must reproduce the above
+ *   copyright notice, this list of conditions and the
+ *   following disclaimer in the documentation and/or other
+ *   materials provided with the distribution.
+ * 
+ * * Neither the name of Parakey Inc. nor the names of its
+ *   contributors may be used to endorse or promote products
+ *   derived from this software without specific prior
+ *   written permission of Parakey Inc.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Creator:
+ *  Joe Hewitt
+ * Contributors
+ *  John J. Barton (IBM Almaden)
+ *  Jan Odvarko (Mozilla Corp.)
+ *  Max Stepanov (Aptana Inc.)
+ *  Rob Campbell (Mozilla Corp.)
+ *  Hans Hillen (Paciello Group, Mozilla)
+ *  Curtis Bartley (Mozilla Corp.)
+ *  Mike Collins (IBM Almaden)
+ *  Kevin Decker
+ *  Mike Ratcliffe (Comartis AG)
+ *  Hernan Rodríguez Colmeiro
+ *  Austin Andrews
+ *  Christoph Dorn
+ *  Steven Roussey (AppCenter Inc, Network54)
+ */
+
+html {
+  background-color: -moz-dialog;
+}
+
+body {
+  margin: 0;
+  overflow: auto;
+  font-family: Lucida Grande, sans-serif;
+  font-size: 11px;
+  border-top: 1px solid #BBB9BA;
+}
+
+h1 {
+  font-size: 17px;
+  border-bottom: 1px solid threedlightshadow;
+}
+
+a {
+  color: #0000ff;
+}
+
+pre {
+  margin: 0;
+  font: inherit;
+}
+
+code {
+  display: block;
+  white-space: pre;
+}
+
+/* DOMPlate */
+
+.objectLink-element,
+.objectLink-textNode,
+.objectLink-function,
+.objectBox-stackTrace,
+.objectLink-profile {
+  font-family: Menlo, Andale Mono, monospace;
+}
+
+.objectLink-textNode {
+  white-space: pre-wrap;
+}
+
+.objectLink-styleRule,
+.objectLink-element,
+.objectLink-textNode {
+  color: #000088;
+}
+
+.selectorTag,
+.selectorId,
+.selectorClass {
+  font-family: Menlo, Andale Mono, monospace;
+  font-weight: normal;
+}
+
+.selectorTag {
+  color: #0000FF;
+}
+
+.selectorId {
+  color: DarkBlue;
+}
+
+.selectorClass {
+  color: red;
+}
+
+.selectorHidden > .selectorTag {
+  color: #5F82D9;
+}
+
+.selectorHidden > .selectorId {
+  color: #888888;
+}
+
+.selectorHidden > .selectorClass {
+  color: #D86060;
+}
+
+.selectorValue {
+  font-family: Menlo, Andale Mono, monospace;
+  font-style: italic;
+  color: #555555;
+}
+
+.panelNode-html {
+  -moz-box-sizing: padding-box;
+  padding: 4px 0 0 2px;
+}
+
+.nodeBox {
+  position: relative;
+  font-family: Menlo, Andale Mono, monospace;
+  padding-left: 13px;
+  -moz-user-select: -moz-none;
+}
+
+.nodeBox.search-selection {
+  -moz-user-select: text;
+}
+
+.twisty {
+  position: absolute;
+  left: 0px;
+  top: 0px;
+  width: 14px;
+  height: 14px;
+}
+
+.nodeChildBox {
+  margin-left: 12px;
+  display: none;
+}
+
+.nodeLabel,
+.nodeCloseLabel {
+  margin: -2px 2px 0 2px;
+  border: 2px solid transparent;
+  -moz-border-radius: 3px;
+  padding: 0 2px;
+  color: #000088;
+}
+
+.nodeCloseLabel {
+  display: none;
+}
+
+.nodeTag {
+  cursor: pointer;
+  color: blue;
+}
+
+.nodeValue {
+  color: #FF0000;
+  font-weight: normal;
+}
+
+.nodeText,
+.nodeComment {
+  margin: 0 2px;
+  vertical-align: top;
+}
+
+.nodeText {
+  color: #333333;
+}
+
+.docType {
+  position: absolute;
+  top: -16px;
+  font-family: Menlo, Andale Mono, monospace;
+  padding-left: 8px;
+  color: #999;
+  white-space: nowrap;
+  font-style: italic;
+}
+
+.htmlNodeBox {
+  top: 16px;
+}
+
+.nodeWhiteSpace {
+  border: 1px solid LightGray;
+  white-space: pre; /* otherwise the border will be collapsed around zero pixels */
+  margin-left: 1px;
+  color: gray;
+}
+
+.nodeWhiteSpace_Space {
+  border: 1px solid #ddd;
+}
+
+.nodeTextEntity {
+  border: 1px solid gray;
+  white-space: pre; /* otherwise the border will be collapsed around zero pixels */
+  margin-left: 1px;
+}
+
+.nodeComment {
+  color: DarkGreen;
+}
+
+.nodeBox.highlightOpen > .nodeLabel {
+  background-color: #EEEEEE;
+}
+
+.nodeBox.highlightOpen > .nodeCloseLabel,
+.nodeBox.highlightOpen > .nodeChildBox,
+.nodeBox.open > .nodeCloseLabel,
+.nodeBox.open > .nodeChildBox {
+  display: block;
+}
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel {
+  border-color: Highlight;
+  background-color: Highlight;
+  color: HighlightText !important;
+}
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeText {
+  color: inherit !important;
+}
+
+.nodeBox.highlighted > .nodeLabel {
+  border-color: Highlight !important;
+  background-color: cyan !important;
+  color: #000000 !important;
+}
+
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox,
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue,
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox > .nodeText {
+  color: #000000 !important;
+}
+
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox,
+.nodeBox.nodeHidden .nodeCloseLabel,
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox > .nodeText,
+.nodeBox.nodeHidden .nodeText {
+  color: #888888;
+}
+
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.nodeHidden .nodeCloseLabel > .nodeCloseLabelBox > .nodeTag {
+  color: #5F82D9;
+}
+
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue {
+  color: #D86060;
+}
+
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue,
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox > .nodeText {
+  color: SkyBlue !important;
+}
+
+.nodeBox.mutated > .nodeLabel,
+.nodeAttr.mutated,
+.nodeValue.mutated,
+.nodeText.mutated,
+.nodeBox.mutated > .nodeText {
+  background-color: #EFFF79;
+  color: #FF0000 !important;
+}
+
+.nodeBox.selected.mutated > .nodeLabel,
+.nodeBox.selected.mutated > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeAttr.mutated > .nodeValue,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue.mutated,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeText.mutated {
+  background-color: #EFFF79;
+  border-color: #EFFF79;
+  color: #FF0000 !important;
+}
+
+.logRow-dirxml {
+  padding-left: 0;
+}
+
+.soloElement > .nodeBox  {
+  padding-left: 0;
+}
+
+.useA11y .nodeLabel.focused {
+  outline: 2px solid #FF9933;
+  -moz-outline-radius: 3px;
+  outline-offset: -2px;
+}
+
+.useA11y .nodeLabelBox:focus {
+  outline: none;
+}
+
+/* from panel.css */
+
+/* HTML panel */
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel {
+  border-color: #3875d7;
+  background-color: #3875d7;
+  color: #FFFFFF !important;
+}
+
+.nodeBox.highlighted > .nodeLabel {
+  border-color: #3875d7 !important;
+}
+
+/************************************************************************************************/
+/* Twisties */
+
+.twisty
+{
+  -moz-appearance: treetwisty;
+}
+
+.nodeBox.highlightOpen > .nodeLabel > .twisty,
+.nodeBox.open > .nodeLabel > .twisty
+{
+  -moz-appearance: treetwistyopen;
+}
+
+/************************************************************************************************/
+/* HTML panel */
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel {
+  border-color: #3875d7;
+  background-color: #3875d7;
+  color: #FFFFFF !important;
+}
+
+.nodeBox.highlighted > .nodeLabel {
+  border-color: #3875d7 !important;
+}
diff --git a/browser/themes/gnomestripe/browser/jar.mn b/browser/themes/gnomestripe/browser/jar.mn
index 1baff47933a4..6fb08700dcb0 100644
--- a/browser/themes/gnomestripe/browser/jar.mn
+++ b/browser/themes/gnomestripe/browser/jar.mn
@@ -13,6 +13,7 @@ browser.jar:
 * skin/classic/browser/browser.css                    (browser.css)
 * skin/classic/browser/engineManager.css              (engineManager.css)
   skin/classic/browser/fullscreen-video.css
+  skin/classic/browser/inspector.css
   skin/classic/browser/Geolocation-16.png
   skin/classic/browser/Geolocation-64.png
   skin/classic/browser/Go-arrow.png
diff --git a/browser/themes/pinstripe/browser/inspector.css b/browser/themes/pinstripe/browser/inspector.css
new file mode 100644
index 000000000000..539a11f2ea44
--- /dev/null
+++ b/browser/themes/pinstripe/browser/inspector.css
@@ -0,0 +1,365 @@
+/*
+ * Software License Agreement (BSD License)
+ *
+ * Copyright (c) 2007, Parakey Inc.
+ * All rights reserved.
+ * 
+ * Redistribution and use of this software in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ * 
+ * * Redistributions of source code must retain the above
+ *   copyright notice, this list of conditions and the
+ *   following disclaimer.
+ * 
+ * * Redistributions in binary form must reproduce the above
+ *   copyright notice, this list of conditions and the
+ *   following disclaimer in the documentation and/or other
+ *   materials provided with the distribution.
+ * 
+ * * Neither the name of Parakey Inc. nor the names of its
+ *   contributors may be used to endorse or promote products
+ *   derived from this software without specific prior
+ *   written permission of Parakey Inc.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Creator:
+ *  Joe Hewitt
+ * Contributors
+ *  John J. Barton (IBM Almaden)
+ *  Jan Odvarko (Mozilla Corp.)
+ *  Max Stepanov (Aptana Inc.)
+ *  Rob Campbell (Mozilla Corp.)
+ *  Hans Hillen (Paciello Group, Mozilla)
+ *  Curtis Bartley (Mozilla Corp.)
+ *  Mike Collins (IBM Almaden)
+ *  Kevin Decker
+ *  Mike Ratcliffe (Comartis AG)
+ *  Hernan Rodríguez Colmeiro
+ *  Austin Andrews
+ *  Christoph Dorn
+ *  Steven Roussey (AppCenter Inc, Network54)
+ */
+
+html {
+  background-color: -moz-dialog;
+}
+
+body {
+  margin: 0;
+  overflow: auto;
+  font-family: Lucida Grande, sans-serif;
+  font-size: 11px;
+  border-top: 1px solid #BBB9BA;
+}
+
+h1 {
+  font-size: 17px;
+  border-bottom: 1px solid threedlightshadow;
+}
+
+a {
+  color: #0000ff;
+}
+
+pre {
+  margin: 0;
+  font: inherit;
+}
+
+code {
+  display: block;
+  white-space: pre;
+}
+
+/* DOMPlate */
+
+.objectLink-element,
+.objectLink-textNode,
+.objectLink-function,
+.objectBox-stackTrace,
+.objectLink-profile {
+  font-family: Menlo, Andale Mono, monospace;
+}
+
+.objectLink-textNode {
+  white-space: pre-wrap;
+}
+
+.objectLink-styleRule,
+.objectLink-element,
+.objectLink-textNode {
+  color: #000088;
+}
+
+.selectorTag,
+.selectorId,
+.selectorClass {
+  font-family: Menlo, Andale Mono, monospace;
+  font-weight: normal;
+}
+
+.selectorTag {
+  color: #0000FF;
+}
+
+.selectorId {
+  color: DarkBlue;
+}
+
+.selectorClass {
+  color: red;
+}
+
+.selectorHidden > .selectorTag {
+  color: #5F82D9;
+}
+
+.selectorHidden > .selectorId {
+  color: #888888;
+}
+
+.selectorHidden > .selectorClass {
+  color: #D86060;
+}
+
+.selectorValue {
+  font-family: Menlo, Andale Mono, monospace;
+  font-style: italic;
+  color: #555555;
+}
+
+.panelNode-html {
+  -moz-box-sizing: padding-box;
+  padding: 4px 0 0 2px;
+}
+
+.nodeBox {
+  position: relative;
+  font-family: Menlo, Andale Mono, monospace;
+  padding-left: 13px;
+  -moz-user-select: -moz-none;
+}
+
+.nodeBox.search-selection {
+  -moz-user-select: text;
+}
+
+.twisty {
+  position: absolute;
+  left: 0px;
+  top: 0px;
+  width: 14px;
+  height: 14px;
+}
+
+.nodeChildBox {
+  margin-left: 12px;
+  display: none;
+}
+
+.nodeLabel,
+.nodeCloseLabel {
+  margin: -2px 2px 0 2px;
+  border: 2px solid transparent;
+  -moz-border-radius: 3px;
+  padding: 0 2px;
+  color: #000088;
+}
+
+.nodeCloseLabel {
+  display: none;
+}
+
+.nodeTag {
+  cursor: pointer;
+  color: blue;
+}
+
+.nodeValue {
+  color: #FF0000;
+  font-weight: normal;
+}
+
+.nodeText,
+.nodeComment {
+  margin: 0 2px;
+  vertical-align: top;
+}
+
+.nodeText {
+  color: #333333;
+}
+
+.docType {
+  position: absolute;
+  top: -16px;
+  font-family: Menlo, Andale Mono, monospace;
+  padding-left: 8px;
+  color: #999;
+  white-space: nowrap;
+  font-style: italic;
+}
+
+.htmlNodeBox {
+  top: 16px;
+}
+
+.nodeWhiteSpace {
+  border: 1px solid LightGray;
+  white-space: pre; /* otherwise the border will be collapsed around zero pixels */
+  margin-left: 1px;
+  color: gray;
+}
+
+.nodeWhiteSpace_Space {
+  border: 1px solid #ddd;
+}
+
+.nodeTextEntity {
+  border: 1px solid gray;
+  white-space: pre; /* otherwise the border will be collapsed around zero pixels */
+  margin-left: 1px;
+}
+
+.nodeComment {
+  color: DarkGreen;
+}
+
+.nodeBox.highlightOpen > .nodeLabel {
+  background-color: #EEEEEE;
+}
+
+.nodeBox.highlightOpen > .nodeCloseLabel,
+.nodeBox.highlightOpen > .nodeChildBox,
+.nodeBox.open > .nodeCloseLabel,
+.nodeBox.open > .nodeChildBox {
+  display: block;
+}
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel {
+  border-color: Highlight;
+  background-color: Highlight;
+  color: HighlightText !important;
+}
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeText {
+  color: inherit !important;
+}
+
+.nodeBox.highlighted > .nodeLabel {
+  border-color: Highlight !important;
+  background-color: cyan !important;
+  color: #000000 !important;
+}
+
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox,
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue,
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox > .nodeText {
+  color: #000000 !important;
+}
+
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox,
+.nodeBox.nodeHidden .nodeCloseLabel,
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox > .nodeText,
+.nodeBox.nodeHidden .nodeText {
+  color: #888888;
+}
+
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.nodeHidden .nodeCloseLabel > .nodeCloseLabelBox > .nodeTag {
+  color: #5F82D9;
+}
+
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue {
+  color: #D86060;
+}
+
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue,
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox > .nodeText {
+  color: SkyBlue !important;
+}
+
+.nodeBox.mutated > .nodeLabel,
+.nodeAttr.mutated,
+.nodeValue.mutated,
+.nodeText.mutated,
+.nodeBox.mutated > .nodeText {
+  background-color: #EFFF79;
+  color: #FF0000 !important;
+}
+
+.nodeBox.selected.mutated > .nodeLabel,
+.nodeBox.selected.mutated > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeAttr.mutated > .nodeValue,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue.mutated,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeText.mutated {
+  background-color: #EFFF79;
+  border-color: #EFFF79;
+  color: #FF0000 !important;
+}
+
+.logRow-dirxml {
+  padding-left: 0;
+}
+
+.soloElement > .nodeBox  {
+  padding-left: 0;
+}
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel {
+  border-color: #3875d7;
+  background-color: #3875d7;
+  color: #FFFFFF !important;
+}
+
+.nodeBox.highlighted > .nodeLabel {
+  border-color: #3875d7 !important;
+}
+
+/************************************************************************************************/
+/* Twisties */
+
+.twisty
+{
+  -moz-appearance: treetwisty;
+}
+
+.nodeBox.highlightOpen > .nodeLabel > .twisty,
+.nodeBox.open > .nodeLabel > .twisty
+{
+  -moz-appearance: treetwistyopen;
+}
+
+.memberRow.hasChildren > .memberLabelCell > .memberLabel,
+.hasHeaders .netHrefLabel {
+  background-position: 2px 2px;
+}
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel {
+  border-color: #3875d7;
+  background-color: #3875d7;
+  color: #FFFFFF !important;
+}
+
+.nodeBox.highlighted > .nodeLabel {
+  border-color: #3875d7 !important;
+}
diff --git a/browser/themes/pinstripe/browser/jar.mn b/browser/themes/pinstripe/browser/jar.mn
index 31435d1b4b57..3a5fc1e5277d 100644
--- a/browser/themes/pinstripe/browser/jar.mn
+++ b/browser/themes/pinstripe/browser/jar.mn
@@ -65,6 +65,7 @@ browser.jar:
   skin/classic/browser/feeds/audioFeedIcon.png              (feeds/audioFeedIcon.png)
   skin/classic/browser/feeds/audioFeedIcon16.png            (feeds/audioFeedIcon16.png)
   skin/classic/browser/setDesktopBackground.css
+  skin/classic/browser/inspector.css
   skin/classic/browser/monitor.png
   skin/classic/browser/monitor_16-10.png
   skin/classic/browser/places/allBookmarks.png              (places/allBookmarks.png)
diff --git a/browser/themes/winstripe/browser/inspector.css b/browser/themes/winstripe/browser/inspector.css
new file mode 100644
index 000000000000..f04bd6c86654
--- /dev/null
+++ b/browser/themes/winstripe/browser/inspector.css
@@ -0,0 +1,350 @@
+/*
+ * Software License Agreement (BSD License)
+ *
+ * Copyright (c) 2007, Parakey Inc.
+ * All rights reserved.
+ * 
+ * Redistribution and use of this software in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ * 
+ * * Redistributions of source code must retain the above
+ *   copyright notice, this list of conditions and the
+ *   following disclaimer.
+ * 
+ * * Redistributions in binary form must reproduce the above
+ *   copyright notice, this list of conditions and the
+ *   following disclaimer in the documentation and/or other
+ *   materials provided with the distribution.
+ * 
+ * * Neither the name of Parakey Inc. nor the names of its
+ *   contributors may be used to endorse or promote products
+ *   derived from this software without specific prior
+ *   written permission of Parakey Inc.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Creator:
+ *  Joe Hewitt
+ * Contributors
+ *  John J. Barton (IBM Almaden)
+ *  Jan Odvarko (Mozilla Corp.)
+ *  Max Stepanov (Aptana Inc.)
+ *  Rob Campbell (Mozilla Corp.)
+ *  Hans Hillen (Paciello Group, Mozilla)
+ *  Curtis Bartley (Mozilla Corp.)
+ *  Mike Collins (IBM Almaden)
+ *  Kevin Decker
+ *  Mike Ratcliffe (Comartis AG)
+ *  Hernan Rodríguez Colmeiro
+ *  Austin Andrews
+ *  Christoph Dorn
+ *  Steven Roussey (AppCenter Inc, Network54)
+ */
+
+html {
+  background-color: -moz-dialog;
+}
+
+body {
+  margin: 0;
+  overflow: auto;
+  font-family: Lucida Grande, sans-serif;
+  font-size: 11px;
+}
+
+h1 {
+  font-size: 17px;
+  border-bottom: 1px solid threedlightshadow;
+}
+
+a {
+  color: #0000ff;
+}
+
+pre {
+  margin: 0;
+  font: inherit;
+}
+
+code {
+  display: block;
+  white-space: pre;
+}
+
+/* DOMPlate */
+
+.objectLink-element,
+.objectLink-textNode,
+.objectLink-function,
+.objectBox-stackTrace,
+.objectLink-profile {
+  font-family: Menlo, Andale Mono, monospace;
+}
+
+.objectLink-textNode {
+  white-space: pre-wrap;
+}
+
+.objectLink-styleRule,
+.objectLink-element,
+.objectLink-textNode {
+  color: #000088;
+}
+
+.selectorTag,
+.selectorId,
+.selectorClass {
+  font-family: Menlo, Andale Mono, monospace;
+  font-weight: normal;
+}
+
+.selectorTag {
+  color: #0000FF;
+}
+
+.selectorId {
+  color: DarkBlue;
+}
+
+.selectorClass {
+  color: red;
+}
+
+.selectorHidden > .selectorTag {
+  color: #5F82D9;
+}
+
+.selectorHidden > .selectorId {
+  color: #888888;
+}
+
+.selectorHidden > .selectorClass {
+  color: #D86060;
+}
+
+.selectorValue {
+  font-family: Menlo, Andale Mono, monospace;
+  font-style: italic;
+  color: #555555;
+}
+
+.panelNode-html {
+  -moz-box-sizing: padding-box;
+  padding: 4px 0 0 2px;
+}
+
+.nodeBox {
+  position: relative;
+  font-family: Menlo, Andale Mono, monospace;
+  padding-left: 13px;
+  -moz-user-select: -moz-none;
+}
+
+.nodeBox.search-selection {
+  -moz-user-select: text;
+}
+
+.twisty {
+  position: absolute;
+  left: 0px;
+  top: 0px;
+  width: 14px;
+  height: 14px;
+}
+
+.nodeChildBox {
+  margin-left: 12px;
+  display: none;
+}
+
+.nodeLabel,
+.nodeCloseLabel {
+  margin: -2px 2px 0 2px;
+  border: 2px solid transparent;
+  -moz-border-radius: 3px;
+  padding: 0 2px;
+  color: #000088;
+}
+
+.nodeCloseLabel {
+  display: none;
+}
+
+.nodeTag {
+  cursor: pointer;
+  color: blue;
+}
+
+.nodeValue {
+  color: #FF0000;
+  font-weight: normal;
+}
+
+.nodeText,
+.nodeComment {
+  margin: 0 2px;
+  vertical-align: top;
+}
+
+.nodeText {
+  color: #333333;
+}
+
+.docType {
+  position: absolute;
+  top: -16px;
+  font-family: Menlo, Andale Mono, monospace;
+  padding-left: 8px;
+  color: #999;
+  white-space: nowrap;
+  font-style: italic;
+}
+
+.htmlNodeBox {
+  top: 16px;
+}
+
+.nodeWhiteSpace {
+  border: 1px solid LightGray;
+  white-space: pre;
+  margin-left: 1px;
+  color: gray;
+}
+
+.nodeWhiteSpace_Space {
+  border: 1px solid #ddd;
+}
+
+.nodeTextEntity {
+  border: 1px solid gray;
+  white-space: pre;
+  margin-left: 1px;
+}
+
+.nodeComment {
+  color: DarkGreen;
+}
+
+.nodeBox.highlightOpen > .nodeLabel {
+  background-color: #EEEEEE;
+}
+
+.nodeBox.highlightOpen > .nodeCloseLabel,
+.nodeBox.highlightOpen > .nodeChildBox,
+.nodeBox.open > .nodeCloseLabel,
+.nodeBox.open > .nodeChildBox {
+  display: block;
+}
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel {
+  border-color: Highlight;
+  background-color: Highlight;
+  color: HighlightText !important;
+}
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeText {
+  color: inherit !important;
+}
+
+.nodeBox.highlighted > .nodeLabel {
+  border-color: Highlight !important;
+  background-color: cyan !important;
+  color: #000000 !important;
+}
+
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox,
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue,
+.nodeBox.highlighted > .nodeLabel > .nodeLabelBox > .nodeText {
+  color: #000000 !important;
+}
+
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox,
+.nodeBox.nodeHidden .nodeCloseLabel,
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox > .nodeText,
+.nodeBox.nodeHidden .nodeText {
+  color: #888888;
+}
+
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.nodeHidden .nodeCloseLabel > .nodeCloseLabelBox > .nodeTag {
+  color: #5F82D9;
+}
+
+.nodeBox.nodeHidden .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue {
+  color: #D86060;
+}
+
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox > .nodeTag,
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue,
+.nodeBox.nodeHidden.selected > .nodeLabel > .nodeLabelBox > .nodeText {
+  color: SkyBlue !important;
+}
+
+.nodeBox.mutated > .nodeLabel,
+.nodeAttr.mutated,
+.nodeValue.mutated,
+.nodeText.mutated,
+.nodeBox.mutated > .nodeText {
+  background-color: #EFFF79;
+  color: #FF0000 !important;
+}
+
+.nodeBox.selected.mutated > .nodeLabel,
+.nodeBox.selected.mutated > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeAttr.mutated > .nodeValue,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeAttr > .nodeValue.mutated,
+.nodeBox.selected > .nodeLabel > .nodeLabelBox > .nodeText.mutated {
+  background-color: #EFFF79;
+  border-color: #EFFF79;
+  color: #FF0000 !important;
+}
+
+.logRow-dirxml {
+  padding-left: 0;
+}
+
+.soloElement > .nodeBox  {
+  padding-left: 0;
+}
+
+.nodeBox.selected > .nodeLabel > .nodeLabelBox,
+.nodeBox.selected > .nodeLabel {
+  border-color: #3875d7;
+  background-color: #3875d7;
+  color: #FFFFFF !important;
+}
+
+.nodeBox.highlighted > .nodeLabel {
+  border-color: #3875d7 !important;
+}
+
+/* Twisties */
+
+.twisty
+{
+  background-repeat: no-repeat;
+  background-position: center;
+  background-image: url("chrome://global/skin/tree/twisty-clsd.png") !important;
+}
+
+.nodeBox.highlightOpen > .nodeLabel > .twisty,
+.nodeBox.open > .nodeLabel > .twisty
+{
+  background-image: url("chrome://global/skin/tree/twisty-open.png") !important;
+}
+
diff --git a/browser/themes/winstripe/browser/jar.mn b/browser/themes/winstripe/browser/jar.mn
index 27978100b484..7e2309f6baff 100644
--- a/browser/themes/winstripe/browser/jar.mn
+++ b/browser/themes/winstripe/browser/jar.mn
@@ -58,6 +58,7 @@ browser.jar:
         skin/classic/browser/feeds/videoFeedIcon16.png               (feeds/videoFeedIcon16.png)
         skin/classic/browser/feeds/subscribe.css                     (feeds/subscribe.css)
         skin/classic/browser/feeds/subscribe-ui.css                  (feeds/subscribe-ui.css)
+        skin/classic/browser/inspector.css
         skin/classic/browser/places/places.css                       (places/places.css)
 *       skin/classic/browser/places/organizer.css                    (places/organizer.css)
         skin/classic/browser/places/bookmark.png                     (places/bookmark.png)

From 2ae5984b1e4f0b2bd3056539c90477cfe3f4fc9b Mon Sep 17 00:00:00 2001
From: Josh Matthews <josh@joshmatthews.net>
Date: Fri, 3 Sep 2010 13:16:01 -0400
Subject: [PATCH 112/222] Bug 588351 - Add missing interface reference to
 ExternalHelperAppParent. r=dwitte a=blocking-fennec

---
 uriloader/exthandler/ExternalHelperAppParent.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/uriloader/exthandler/ExternalHelperAppParent.cpp b/uriloader/exthandler/ExternalHelperAppParent.cpp
index 7ec82177286a..95565977375c 100644
--- a/uriloader/exthandler/ExternalHelperAppParent.cpp
+++ b/uriloader/exthandler/ExternalHelperAppParent.cpp
@@ -50,10 +50,11 @@
 namespace mozilla {
 namespace dom {
 
-NS_IMPL_ISUPPORTS_INHERITED2(ExternalHelperAppParent,
+NS_IMPL_ISUPPORTS_INHERITED3(ExternalHelperAppParent,
                              nsHashPropertyBag,
                              nsIRequest,
-                             nsIChannel)
+                             nsIChannel,
+                             nsIResumableChannel)
 
 ExternalHelperAppParent::ExternalHelperAppParent(
     const IPC::URI& uri,

From 8eb36f1ade46a91b1dad42501861135e2b6cbfaa Mon Sep 17 00:00:00 2001
From: Ben Turner <bent.mozilla@gmail.com>
Date: Fri, 3 Sep 2010 09:12:27 -0700
Subject: [PATCH 113/222] Bug 593045 - 'Add SQLite file size quota management
 to mozStorage'. Missed a comment change. r=ted+asuth, a=blocking2.0+.

---
 storage/src/mozStorageConnection.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/storage/src/mozStorageConnection.h b/storage/src/mozStorageConnection.h
index e8194cdfd2f1..9394de97301b 100644
--- a/storage/src/mozStorageConnection.h
+++ b/storage/src/mozStorageConnection.h
@@ -100,6 +100,9 @@ public:
    *        The nsIFile of the location of the database to open, or create if it
    *        does not exist.  Passing in nsnull here creates an in-memory
    *        database.
+   * @param aVFSName
+   *        The VFS that SQLite will use when opening this database. NULL means
+   *        "default".
    */
   nsresult initialize(nsIFile *aDatabaseFile,
                       const char* aVFSName = NULL);

From 5e2fdc8e1fb38dcb735df118ec9ec65fd3edc80f Mon Sep 17 00:00:00 2001
From: Jeff Muizelaar <jmuizelaar@mozilla.com>
Date: Fri, 3 Sep 2010 17:11:50 -0400
Subject: [PATCH 114/222] Bug 593438. d3d9: Don't use an accelerated layer
 manager for transparent windows. r=vlad

Transparent windows require a more complicated dance to get transparency to work
correctly. For now, we'll just not accelerate them.
---
 widget/src/windows/nsWindow.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index 5db06086cdc0..853ad99136ce 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -3168,6 +3168,14 @@ nsWindow::GetLayerManager()
     return nsBaseWidget::GetLayerManager();
   }
 
+  /* We don't currently support using an accelerated layer manager with
+   * transparent windows so don't even try. I'm also not sure if we even
+   * want to support this case. See bug #593471 */
+  if (eTransparencyTransparent == mTransparencyMode) {
+    mUseAcceleratedRendering = PR_FALSE;
+    return nsBaseWidget::GetLayerManager();
+  }
+
   if (topWindow->GetAcceleratedRendering() != mUseAcceleratedRendering) {
     mLayerManager = NULL;
     mUseAcceleratedRendering = topWindow->GetAcceleratedRendering();

From 4b23d63e316d4938985bff31bb6451269cab0dcf Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Fri, 3 Sep 2010 17:14:44 -0400
Subject: [PATCH 115/222] Bug 593272. d3d9: Don't try to sync parent/child
 acceleration status. r=vlad

It doesn't make a ton of sense to make child widgets have the same acceleration
status as their parent now that we have (mostly - see bug 593440) only one
widget per window. (It might never have made sense.)

This fixes dialog boxes (which currently have child windows) not displaying any content.
---
 widget/src/windows/nsWindow.cpp | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index 853ad99136ce..12e2f6017aa5 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -3176,11 +3176,6 @@ nsWindow::GetLayerManager()
     return nsBaseWidget::GetLayerManager();
   }
 
-  if (topWindow->GetAcceleratedRendering() != mUseAcceleratedRendering) {
-    mLayerManager = NULL;
-    mUseAcceleratedRendering = topWindow->GetAcceleratedRendering();
-  }
-
 #ifndef WINCE
   if (!mLayerManager) {
     nsCOMPtr<nsIPrefBranch2> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);

From 3535a09d4bcb3ab8f0ab6832fecef39b0c490c9f Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Fri, 3 Sep 2010 17:15:10 -0400
Subject: [PATCH 116/222] Bug 590844. reftest: fix the condition setting
 layersGPUAccelerated. r=vlad, a=b

Frig. I accidentally reversed the condition here.
---
 layout/tools/reftest/reftest.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index 8bd2c47285b6..adfead48dc3d 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -343,7 +343,7 @@ function BuildConditionSandbox(aURL) {
       sandbox.d2d = false;
     }
 
-    if (gWindowUtils && gWindowUtils.layerManagerType == "Basic")
+    if (gWindowUtils && gWindowUtils.layerManagerType != "Basic")
       sandbox.layersGPUAccelerated = true;
     else
       sandbox.layersGPUAccelerated = false;

From 072da93f46aca2cbde804876d519a9ff0261e6c7 Mon Sep 17 00:00:00 2001
From: Mounir Lamouri <mounir.lamouri@gmail.com>
Date: Sat, 4 Sep 2010 00:39:29 +0200
Subject: [PATCH 117/222] Bug 575462 - Crash [@ nsDocument::AddToIdTable] with
 mutation events. r=sicking a2.0=blocking

---
 content/base/crashtests/575462.svg      | 27 +++++++++++++++++++++++++
 content/base/crashtests/crashtests.list |  1 +
 content/base/src/nsStyledElement.cpp    | 21 +++++++++++--------
 content/base/src/nsStyledElement.h      |  2 ++
 4 files changed, 43 insertions(+), 8 deletions(-)
 create mode 100644 content/base/crashtests/575462.svg

diff --git a/content/base/crashtests/575462.svg b/content/base/crashtests/575462.svg
new file mode 100644
index 000000000000..8131d5f1fd0b
--- /dev/null
+++ b/content/base/crashtests/575462.svg
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<g id="a"><g id="b"/></g>
+
+<script type="text/javascript">
+<![CDATA[
+
+function j()
+{
+  var a = document.getElementById("a");
+  var b = document.getElementById("b");
+  window.addEventListener("DOMAttrModified", k, true);
+  function k()
+  {
+    window.removeEventListener("DOMAttrModified", k, true);
+    a.appendChild(b);
+  }
+  b.removeAttribute("id");
+}
+
+window.addEventListener("load", j, false);
+
+]]>
+</script>
+</svg>
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index fd79e993735f..35cbba5c02ab 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -69,3 +69,4 @@ load 564079-1.html
 load 564114.html
 load 565125-1.html
 load 582601.html
+load 575462.svg
diff --git a/content/base/src/nsStyledElement.cpp b/content/base/src/nsStyledElement.cpp
index 81a92723ada3..d8d72c770a24 100644
--- a/content/base/src/nsStyledElement.cpp
+++ b/content/base/src/nsStyledElement.cpp
@@ -131,23 +131,28 @@ nsresult
 nsStyledElement::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
                            PRBool aNotify)
 {
-  PRBool isId = PR_FALSE;
   if (aAttribute == nsGkAtoms::id && aNameSpaceID == kNameSpaceID_None) {
     // Have to do this before clearing flag. See RemoveFromIdTable
     RemoveFromIdTable();
-    isId = PR_TRUE;
   }
 
-  nsMutationGuard guard;
-  
-  nsresult rv = nsGenericElement::UnsetAttr(aNameSpaceID, aAttribute, aNotify);
+  return nsGenericElement::UnsetAttr(aNameSpaceID, aAttribute, aNotify);
+}
 
-  if (isId &&
-      (!guard.Mutated(0) || !HasAttr(kNameSpaceID_None, nsGkAtoms::id))) {
+nsresult
+nsStyledElement::AfterSetAttr(PRInt32 aNamespaceID, nsIAtom* aAttribute,
+                              const nsAString* aValue, PRBool aNotify)
+{
+  if (aNamespaceID == kNameSpaceID_None && !aValue &&
+      aAttribute == nsGkAtoms::id) {
+    // The id has been removed when calling UnsetAttr but we kept it because
+    // the id is used for some layout stuff between UnsetAttr and AfterSetAttr.
+    // Now. the id is really removed so it would not be safe to keep this flag.
     UnsetFlags(NODE_HAS_ID);
   }
 
-  return rv;
+  return nsGenericElement::AfterSetAttr(aNamespaceID, aAttribute, aValue,
+                                        aNotify);
 }
 
 NS_IMETHODIMP
diff --git a/content/base/src/nsStyledElement.h b/content/base/src/nsStyledElement.h
index abece792698f..9aaf0eae46ca 100644
--- a/content/base/src/nsStyledElement.h
+++ b/content/base/src/nsStyledElement.h
@@ -80,6 +80,8 @@ public:
 
   virtual nsresult UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
                              PRBool aNotify);
+  virtual nsresult AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
+                                const nsAString* aValue, PRBool aNotify);
 
   nsIDOMCSSStyleDeclaration* GetStyle(nsresult* retval);
 

From f92bf942a3831fe6bc8432fa755363817c84069b Mon Sep 17 00:00:00 2001
From: Craig Topper <craig.topper@gmail.com>
Date: Sat, 4 Sep 2010 00:40:10 +0200
Subject: [PATCH 118/222] Bug 591864 - Convert nsCOMPtr<Element> to nsRefPtr
 for mImageElement in nsIdentifierMapEntry. r=sicking a2.0=jst

---
 content/base/src/nsDocument.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/base/src/nsDocument.h b/content/base/src/nsDocument.h
index 3c277c6ab3e0..763e38737658 100644
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@@ -264,7 +264,7 @@ private:
   nsBaseContentList *mNameContentList;
   nsRefPtr<nsContentList> mDocAllList;
   nsAutoPtr<nsTHashtable<ChangeCallbackEntry> > mChangeCallbacks;
-  nsCOMPtr<Element> mImageElement;
+  nsRefPtr<Element> mImageElement;
 };
 
 class nsDocHeaderData

From 3e387d5361ddc33c091581e8130e60555588c8f8 Mon Sep 17 00:00:00 2001
From: Jonas Sicking <jonas@sicking.cc>
Date: Fri, 3 Sep 2010 15:53:28 -0700
Subject: [PATCH 119/222] Bug 582176: Only send content-document-global-created
 (and its chrome counter part) when a new window was actually created. Not
 when we fast-backed to one. r=jst a=blocker

---
 docshell/test/chrome/582176_dummy.html    |  1 +
 docshell/test/chrome/Makefile.in          |  3 +
 docshell/test/chrome/bug582176_window.xul | 83 +++++++++++++++++++++++
 docshell/test/chrome/docshell_helpers.js  |  3 +-
 docshell/test/chrome/test_bug582176.xul   | 43 ++++++++++++
 dom/base/nsGlobalWindow.cpp               | 29 ++++----
 6 files changed, 144 insertions(+), 18 deletions(-)
 create mode 100644 docshell/test/chrome/582176_dummy.html
 create mode 100644 docshell/test/chrome/bug582176_window.xul
 create mode 100644 docshell/test/chrome/test_bug582176.xul

diff --git a/docshell/test/chrome/582176_dummy.html b/docshell/test/chrome/582176_dummy.html
new file mode 100644
index 000000000000..3b18e512dba7
--- /dev/null
+++ b/docshell/test/chrome/582176_dummy.html
@@ -0,0 +1 @@
+hello world
diff --git a/docshell/test/chrome/Makefile.in b/docshell/test/chrome/Makefile.in
index b8e7d92027ca..58d3efc4136a 100644
--- a/docshell/test/chrome/Makefile.in
+++ b/docshell/test/chrome/Makefile.in
@@ -52,6 +52,7 @@ _HTTP_FILES =	\
 		215405_nostore.html^headers^ \
 		215405_nocache.html \
 		215405_nocache.html^headers^ \
+		582176_dummy.html \
 		$(NULL)
 
 _TEST_FILES =	\
@@ -94,6 +95,8 @@ _TEST_FILES =	\
 		bug396519_window.xul \
 		test_bug396649.xul \
 		bug396649_window.xul \
+		test_bug582176.xul \
+		bug582176_window.xul \
 		test_bug428288.html \
 		test_bug449778.xul \
 		bug449778_window.xul \
diff --git a/docshell/test/chrome/bug582176_window.xul b/docshell/test/chrome/bug582176_window.xul
new file mode 100644
index 000000000000..7c39f3c09c9d
--- /dev/null
+++ b/docshell/test/chrome/bug582176_window.xul
@@ -0,0 +1,83 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window id="303267Test"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        width="600"
+        height="600"
+        onload="nextTestAsync();"
+        title="bug 582176 test">
+
+  <script type="application/javascript"
+  src="docshell_helpers.js">
+  </script>
+  <script type="application/javascript"><![CDATA[
+  
+    // Define the generator-iterator for the tests.
+    var tests = testIterator();
+
+    ////
+    // Execute the next test in the generator function.
+    //
+    function nextTestAsync() {
+      SimpleTest.executeSoon(tests.next.bind(tests));
+    }
+
+    ////
+    // Generator function for test steps for bug 582176:
+    // Description goes here.
+    //
+    function testIterator()
+    {
+      var browser = document.getElementById('content');
+      browser.addEventListener("pageshow", nextTestAsync, true);
+
+      enableBFCache(true);
+
+      var notificationCount = 0;
+      var observer = {
+        observe: function(aSubject, aTopic, aData) {
+          is(aSubject, browser.contentWindow,
+             "correct subject");
+          is(aTopic, "content-document-global-created",
+             "correct topic");
+          is(aData, "http://mochi.test:8888",
+             "correct data");
+          notificationCount++;
+        }
+      };
+
+      os = Components.classes["@mozilla.org/observer-service;1"].
+        getService(Components.interfaces.nsIObserverService);
+      os.addObserver(observer, "content-document-global-created", false);
+
+      browser.loadURI("http://mochi.test:8888/tests/docshell/test/chrome/582176_dummy.html");
+      yield;
+      is(browser.contentWindow.testVar, undefined,
+         "variable unexpectedly there already");
+      browser.contentWindow.wrappedJSObject.testVar = 1;
+      is(notificationCount, 1, "Should notify on first navigation");
+
+      browser.loadURI("http://mochi.test:8888/tests/docshell/test/chrome/582176_dummy.html?2");
+      yield;
+      is(browser.contentWindow.wrappedJSObject.testVar, undefined,
+         "variable should no longer be there");
+      is(notificationCount, 2, "Should notify on second navigation");
+
+      browser.goBack();
+      yield;
+      is(browser.contentWindow.wrappedJSObject.testVar, 1,
+         "variable should still be there");
+      is(notificationCount, 2, "Should not notify on back navigation");
+
+      os.removeObserver(observer, "content-document-global-created")
+
+      // Tell the framework the test is finished.  Include the final 'yield' 
+      // statement to prevent a StopIteration exception from being thrown.
+      finish();
+      yield;
+    }
+    
+  ]]></script>
+  <browser type="content-primary" flex="1" id="content" src="about:blank"/>
+</window>
diff --git a/docshell/test/chrome/docshell_helpers.js b/docshell/test/chrome/docshell_helpers.js
index 94e511e0362a..167bfe2eef8a 100755
--- a/docshell/test/chrome/docshell_helpers.js
+++ b/docshell/test/chrome/docshell_helpers.js
@@ -321,8 +321,9 @@ function finish() {
   }
 
   // Close the test window and signal the framework that the test is done.
+  let opener = window.opener;
   window.close();
-  window.opener.wrappedJSObject.SimpleTest.finish();
+  opener.wrappedJSObject.SimpleTest.finish();
 }
 
 /**
diff --git a/docshell/test/chrome/test_bug582176.xul b/docshell/test/chrome/test_bug582176.xul
new file mode 100644
index 000000000000..41090c4a30c2
--- /dev/null
+++ b/docshell/test/chrome/test_bug582176.xul
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet
+  href="chrome://mochikit/content/tests/SimpleTest/test.css"
+  type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=582176.xul
+-->
+<window title="Mozilla Bug 582176"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <title>Test for Bug 582176</title>
+  <script type="application/javascript"
+    src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+    src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+<body  xmlns="http://www.w3.org/1999/xhtml">
+<a target="_blank"
+   href="https://bugzilla.mozilla.org/show_bug.cgi?id=582176">
+   Mozilla Bug 582176</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+
+<script class="testbody" type="application/javascript">
+<![CDATA[
+
+/** Test for Bug 582176 **/
+
+SimpleTest.waitForExplicitFinish();
+window.open("bug582176_window.xul", "bug582176",
+            "chrome,width=600,height=600");
+
+]]>
+</script>
+
+</window>
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index dcb67c5fab66..d687ed70689a 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1757,6 +1757,8 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
     if (aState) {
       newInnerWindow = wsh->GetInnerWindow();
       mInnerWindowHolder = wsh->GetInnerWindowHolder();
+      
+      NS_ASSERTION(newInnerWindow, "Got a state without inner window");
 
       // These assignments addref.
       mNavigator = wsh->GetNavigator();
@@ -1766,22 +1768,13 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
         mNavigator->SetDocShell(mDocShell);
         mNavigator->LoadingNewDocument();
       }
+    } else if (thisChrome) {
+      newInnerWindow = new nsGlobalChromeWindow(this);
+      isChrome = PR_TRUE;
+    } else if (mIsModalContentWindow) {
+      newInnerWindow = new nsGlobalModalWindow(this);
     } else {
-      if (thisChrome) {
-        newInnerWindow = new nsGlobalChromeWindow(this);
-
-        isChrome = PR_TRUE;
-      } else {
-        if (mIsModalContentWindow) {
-          newInnerWindow = new nsGlobalModalWindow(this);
-        } else {
-          newInnerWindow = new nsGlobalWindow(this);
-        }
-      }
-    }
-
-    if (!newInnerWindow) {
-      return NS_ERROR_OUT_OF_MEMORY;
+      newInnerWindow = new nsGlobalWindow(this);
     }
 
     if (currentInner && currentInner->mJSObject) {
@@ -2047,8 +2040,10 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
                        wrapper, nsIXPConnect::XPC_XOW_NAVIGATED);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsContentUtils::AddScriptRunner(
-    NS_NewRunnableMethod(this, &nsGlobalWindow::DispatchDOMWindowCreated));
+  if (!aState && !reUseInnerWindow) {
+    nsContentUtils::AddScriptRunner(
+      NS_NewRunnableMethod(this, &nsGlobalWindow::DispatchDOMWindowCreated));
+  }
 
   return NS_OK;
 }

From ec1a4a941c58c159ae5b622b692c9a9e2037f619 Mon Sep 17 00:00:00 2001
From: Jonas Sicking <jonas@sicking.cc>
Date: Fri, 3 Sep 2010 15:53:28 -0700
Subject: [PATCH 120/222] Bug 590870: Allow mochitest domains that don't
 support XUL/XBL. r=ted a=test-only

---
 build/automation.py.in             | 8 ++++----
 build/pgo/server-locations.txt     | 1 +
 layout/tools/reftest/runreftest.py | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/build/automation.py.in b/build/automation.py.in
index 088d72b4a795..b706474bf0af 100644
--- a/build/automation.py.in
+++ b/build/automation.py.in
@@ -307,10 +307,10 @@ class Automation(object):
     # Insert desired permissions
     c = 0
     for perm in permissions.keys():
-      for host in permissions[perm]:
+      for host,allow in permissions[perm]:
         c += 1
-        cursor.execute("INSERT INTO moz_hosts values(?, ?, ?, 1, 0, 0)",
-                       (c, host, perm))
+        cursor.execute("INSERT INTO moz_hosts values(?, ?, ?, ?, 0, 0)",
+                       (c, host, perm, 1 if allow else 2))
 
     # Commit and close
     permDB.commit()
@@ -327,7 +327,7 @@ class Automation(object):
     # Set up permissions database
     locations = self.readLocations()
     self.setupPermissionsDatabase(profileDir,
-      {'allowXULXBL':map(lambda l: l.host, locations)});
+      {'allowXULXBL':[(l.host, 'noxul' not in l.options) for l in locations]});
 
     part = """\
 user_pref("browser.dom.window.dump.enabled", true);
diff --git a/build/pgo/server-locations.txt b/build/pgo/server-locations.txt
index 12190aa32ea6..a340b91df2d3 100644
--- a/build/pgo/server-locations.txt
+++ b/build/pgo/server-locations.txt
@@ -106,6 +106,7 @@ http://sub1.test1.example.com:80     privileged
 http://sub1.test2.example.com:80     privileged
 http://sub2.test1.example.com:80     privileged
 http://sub2.test2.example.com:80     privileged
+http://noxul.example.com:80          privileged,noxul
 
 https://example.com:443                privileged
 https://test1.example.com:443          privileged
diff --git a/layout/tools/reftest/runreftest.py b/layout/tools/reftest/runreftest.py
index b8d6ae1d35c6..f2273bb13223 100644
--- a/layout/tools/reftest/runreftest.py
+++ b/layout/tools/reftest/runreftest.py
@@ -69,7 +69,7 @@ class RefTest(object):
     "Sets up a profile for reftest."
 
     self.automation.setupPermissionsDatabase(profileDir,
-      {'allowXULXBL': ['localhost', '<file>']})
+      {'allowXULXBL': [('localhost', True), ('<file>', True)]})
 
     # Set preferences.
     prefsFile = open(os.path.join(profileDir, "user.js"), "w")

From a38d3a7e8dc4439e8745bbede0488a824ab95c06 Mon Sep 17 00:00:00 2001
From: Jonas Sicking <jonas@sicking.cc>
Date: Fri, 3 Sep 2010 15:53:28 -0700
Subject: [PATCH 121/222] Test for bug 590870. r=jst a=test-only

---
 content/base/test/Makefile.in         |  2 ++
 content/base/test/file_bug590870.html | 16 +++++++++++
 content/base/test/test_bug590870.html | 38 +++++++++++++++++++++++++++
 3 files changed, 56 insertions(+)
 create mode 100644 content/base/test/file_bug590870.html
 create mode 100644 content/base/test/test_bug590870.html

diff --git a/content/base/test/Makefile.in b/content/base/test/Makefile.in
index 8b19f0979cfb..6034132f5cda 100644
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -245,6 +245,8 @@ _TEST_FILES1 = 	test_bug5141.html \
 		test_bug454325.html \
 		file_bug391728_2.html \
 		test_bug456262.html \
+		test_bug590870.html \
+		file_bug590870.html \
 		test_bug368972.html \
 		test_bug448993.html \
 		test_bug450160.html \
diff --git a/content/base/test/file_bug590870.html b/content/base/test/file_bug590870.html
new file mode 100644
index 000000000000..4432b01d3cbb
--- /dev/null
+++ b/content/base/test/file_bug590870.html
@@ -0,0 +1,16 @@
+<html>
+  <head>
+    <script>
+onload = function() {
+  var x = null;
+  try {
+    x = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "spacer");
+  } catch(ex) {}
+  window.parent.postMessage(x == null, "http://mochi.test:8888");
+}
+    </script>
+  </head>
+  <body>
+    Here be dragons!
+  </body>
+</html>
diff --git a/content/base/test/test_bug590870.html b/content/base/test/test_bug590870.html
new file mode 100644
index 000000000000..4b24718f1fd2
--- /dev/null
+++ b/content/base/test/test_bug590870.html
@@ -0,0 +1,38 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+-->
+<head>
+  <title>Test for creating XUL elements, bug 590870</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body onload="gen.next()">
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=590870">Mozilla Bug 590870</a>
+<p id="display"></p>
+<iframe id=iframe></iframe>
+<pre id="test">
+<script class="testbody" type="application/javascript;version=1.8">
+
+SimpleTest.waitForExplicitFinish();
+window.addEventListener("message", function(e) { gen.send(e.data) }, false);
+
+var gen = runTest();
+
+function runTest() {
+  var iframe = $('iframe');
+  iframe.src = "http://noxul.example.com/tests/content/base/test/file_bug590870.html";
+  is((yield), "true", "shouldn't be able to create XUL elements");
+
+  iframe.src = "file_bug590870.html";
+  is((yield), "false", "should be able to create XUL elements");
+
+  SimpleTest.finish();
+  yield;
+}
+
+</script>
+</pre>
+</body>
+</html>

From 1a2c535e49d74a40790e85d9a0dfdfc281f02182 Mon Sep 17 00:00:00 2001
From: Jonas Sicking <jonas@sicking.cc>
Date: Fri, 3 Sep 2010 15:53:28 -0700
Subject: [PATCH 122/222] Test for bug 590812. r=jst a=test-only

---
 content/base/test/Makefile.in                 |  3 ++
 content/base/test/file_bug590812-ref.xhtml    |  3 ++
 content/base/test/file_bug590812.xml          |  1 +
 content/base/test/test_bug590812.html         | 37 +++++++++++++++++++
 .../tests/SimpleTest/WindowSnapshot.js        |  7 ++--
 5 files changed, 48 insertions(+), 3 deletions(-)
 create mode 100644 content/base/test/file_bug590812-ref.xhtml
 create mode 100644 content/base/test/file_bug590812.xml
 create mode 100644 content/base/test/test_bug590812.html

diff --git a/content/base/test/Makefile.in b/content/base/test/Makefile.in
index 6034132f5cda..9e7cc91ca35c 100644
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -247,6 +247,9 @@ _TEST_FILES1 = 	test_bug5141.html \
 		test_bug456262.html \
 		test_bug590870.html \
 		file_bug590870.html \
+		test_bug590812.html \
+		file_bug590812.xml \
+		file_bug590812-ref.xhtml \
 		test_bug368972.html \
 		test_bug448993.html \
 		test_bug450160.html \
diff --git a/content/base/test/file_bug590812-ref.xhtml b/content/base/test/file_bug590812-ref.xhtml
new file mode 100644
index 000000000000..85375f831759
--- /dev/null
+++ b/content/base/test/file_bug590812-ref.xhtml
@@ -0,0 +1,3 @@
+<out><div id="top" xmlns="http://www.w3.org/1999/xhtml"><link href="chrome://global/content/xml/XMLPrettyPrint.css" type="text/css" rel="stylesheet"/><div id="header"><p>
+        This XML file does not appear to have any style information associated with it. The document tree is shown below.
+      </p></div><div>&lt;<span class="start-tag">out</span>&gt;<span class="text">Here be sea hags</span>&lt;/<span class="end-tag">out</span>&gt;</div></div></out>
diff --git a/content/base/test/file_bug590812.xml b/content/base/test/file_bug590812.xml
new file mode 100644
index 000000000000..759d5066cf0f
--- /dev/null
+++ b/content/base/test/file_bug590812.xml
@@ -0,0 +1 @@
+<out>Here be sea hags</out>
diff --git a/content/base/test/test_bug590812.html b/content/base/test/test_bug590812.html
new file mode 100644
index 000000000000..c7965c321f23
--- /dev/null
+++ b/content/base/test/test_bug590812.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test for XML pretty printing, bug 590812</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/WindowSnapshot.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body onload="runTest()">
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=590812">Mozilla Bug 590812</a>
+<p id="display"></p>
+<iframe src="http://noxul.example.com/tests/content/base/test/file_bug590812.xml"></iframe>
+<iframe src="file_bug590812.xml"></iframe>
+<iframe src="file_bug590812-ref.xhtml"></iframe>
+<pre id="test">
+<script class="testbody" type="application/javascript;version=1.8">
+
+SimpleTest.waitForExplicitFinish();
+
+function runTest() {
+  sNoXUL = snapshotWindow(window.frames[0], false);
+  sWithXUL = snapshotWindow(window.frames[1], false);
+  sRef = snapshotWindow(window.frames[2], false);
+  let res;
+  ok(compareSnapshots(sNoXUL, sRef, true)[0],
+     "noxul domain same as ref");
+  ok(compareSnapshots(sWithXUL, sRef, true)[0],
+     "xul supporting domain same as ref");
+
+  SimpleTest.finish();
+}
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/testing/mochitest/tests/SimpleTest/WindowSnapshot.js b/testing/mochitest/tests/SimpleTest/WindowSnapshot.js
index e55c59bc25f9..f0c46b4472e0 100644
--- a/testing/mochitest/tests/SimpleTest/WindowSnapshot.js
+++ b/testing/mochitest/tests/SimpleTest/WindowSnapshot.js
@@ -11,13 +11,14 @@ try {
 }
 
 function snapshotWindow(win, withCaret) {
+  // drawWindow requires privileges, as might innerWidth/innerHeight if it's
+  // a cross domain window
+  netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
+
   var el = document.createElementNS("http://www.w3.org/1999/xhtml", "canvas");
   el.width = win.innerWidth;
   el.height = win.innerHeight;
 
-  // drawWindow requires privileges
-  netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
-
   var ctx = el.getContext("2d");
   ctx.drawWindow(win, win.scrollX, win.scrollY,
                  win.innerWidth, win.innerHeight,

From 6c4013865874ece5b1e511b1dda6e24d50afb73b Mon Sep 17 00:00:00 2001
From: Alexander Surkov <surkov.alexander@gmail.com>
Date: Sat, 4 Sep 2010 09:32:13 +0900
Subject: [PATCH 123/222] Bug 574588 - nsAccessible::GetRole() should avoid
 a11y tree traversal, r=davidb, a=davidb

---
 accessible/src/base/nsAccessible.cpp              |  4 +---
 accessible/src/xul/nsXULColorPickerAccessible.cpp |  2 --
 accessible/src/xul/nsXULFormControlAccessible.cpp |  2 --
 accessible/src/xul/nsXULMenuAccessible.cpp        | 11 ++++++-----
 4 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/accessible/src/base/nsAccessible.cpp b/accessible/src/base/nsAccessible.cpp
index 8808c98aa77c..3a32c796a2d5 100644
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -2785,9 +2785,7 @@ nsAccessible::GetParent()
 
   // XXX: mParent can be null randomly because supposedly we get layout
   // notification and invalidate parent-child relations, this accessible stays
-  // unattached. This should gone after bug 572951. Other reason is bug 574588
-  // since CacheChildren() implementation calls nsAccessible::GetRole() what
-  // can need to get a parent and we are here as result.
+  // unattached. This should gone after bug 572951.
   NS_WARNING("Bad accessible tree!");
 
 #ifdef DEBUG
diff --git a/accessible/src/xul/nsXULColorPickerAccessible.cpp b/accessible/src/xul/nsXULColorPickerAccessible.cpp
index ca88fc865b1d..ad21ff216009 100644
--- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
+++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
@@ -166,8 +166,6 @@ nsXULColorPickerAccessible::CacheChildren()
 
   nsRefPtr<nsAccessible> child;
   while ((child = walker.GetNextChild())) {
-    // XXX: do not call nsAccessible::GetRole() while accessible not in tree
-    // (bug 574588).
     PRUint32 role = nsAccUtils::Role(child);
 
     // Get an accessbile for menupopup or panel elements.
diff --git a/accessible/src/xul/nsXULFormControlAccessible.cpp b/accessible/src/xul/nsXULFormControlAccessible.cpp
index 975052aadbc8..237c3bcfee6c 100644
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -212,8 +212,6 @@ nsXULButtonAccessible::CacheChildren()
 
   nsRefPtr<nsAccessible> child;
   while ((child = walker.GetNextChild())) {
-    // XXX: do not call nsAccessible::GetRole() while accessible not in tree
-    // (bug 574588).
     PRUint32 role = nsAccUtils::Role(child);
 
     if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
diff --git a/accessible/src/xul/nsXULMenuAccessible.cpp b/accessible/src/xul/nsXULMenuAccessible.cpp
index 116f02a90898..8fdc59e9a894 100644
--- a/accessible/src/xul/nsXULMenuAccessible.cpp
+++ b/accessible/src/xul/nsXULMenuAccessible.cpp
@@ -488,7 +488,7 @@ nsXULMenuitemAccessible::GetRoleInternal(PRUint32 *aRole)
     return NS_OK;
   }
 
-  if (nsAccUtils::Role(GetParent()) == nsIAccessibleRole::ROLE_COMBOBOX_LIST) {
+  if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST) {
     *aRole = nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
     return NS_OK;
   }
@@ -670,9 +670,10 @@ nsXULMenupopupAccessible::GetNameInternal(nsAString& aName)
 nsresult
 nsXULMenupopupAccessible::GetRoleInternal(PRUint32 *aRole)
 {
-  nsAccessible *parent = GetParent();
-  if (parent) {
-    PRUint32 role = nsAccUtils::Role(parent);
+  // If accessible is not bound to the tree (this happens while children are
+  // cached) return general role.
+  if (mParent) {
+    PRUint32 role = nsAccUtils::Role(mParent);
     if (role == nsIAccessibleRole::ROLE_COMBOBOX ||
         role == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
       *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
@@ -680,7 +681,7 @@ nsXULMenupopupAccessible::GetRoleInternal(PRUint32 *aRole)
 
     } else if (role == nsIAccessibleRole::ROLE_PUSHBUTTON) {
       // Some widgets like the search bar have several popups, owned by buttons.
-      nsAccessible *grandParent = parent->GetParent();
+      nsAccessible* grandParent = mParent->GetParent();
       if (nsAccUtils::Role(grandParent) == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
         *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
         return NS_OK;

From 761a179dc15e20e7b2dcf67c0754b41fbf30afef Mon Sep 17 00:00:00 2001
From: Alon Zakai <azakai@mozilla.com>
Date: Fri, 3 Sep 2010 19:04:05 -0700
Subject: [PATCH 124/222] Bug 591052 - MessageManager wakeup service.
 r=mfinkle,smaug a=blocking-fennec2.0b1

---
 .../base/public/nsIMessageWakeupService.idl   |  74 ++++++++++++
 content/base/src/Makefile.in                  |   2 +
 content/base/src/messageWakeupService.js      | 110 ++++++++++++++++++
 .../base/src/messageWakeupService.manifest    |   4 +
 4 files changed, 190 insertions(+)
 create mode 100644 content/base/public/nsIMessageWakeupService.idl
 create mode 100644 content/base/src/messageWakeupService.js
 create mode 100644 content/base/src/messageWakeupService.manifest

diff --git a/content/base/public/nsIMessageWakeupService.idl b/content/base/public/nsIMessageWakeupService.idl
new file mode 100644
index 000000000000..bd16ee8eb329
--- /dev/null
+++ b/content/base/public/nsIMessageWakeupService.idl
@@ -0,0 +1,74 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is the Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Alon Zakai <azakai@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsISupports.idl"
+
+/**
+ * This service lets other components be woken up when particular
+ * messageManager messages arrive. By using this wakeup service,
+ * those components do not need to be started until they are
+ * needed.
+ *
+ * The parentprocessmessagemanager is used for this, so messages
+ * send from childprocessmessagemanagers will be heard.
+ *
+ * Components can request wakeups using the .manifest files, or
+ * by someone else calling requestWakeup. For .manifest files,
+ * the line should look something like
+ *
+ *   category wakeup-request nsComponent @mozilla.org/myservice;1,
+ *            nsIMyInterface,getService,myMessage1,myMessage2[,..]
+ *
+ * Currently we require services to expose wrappedJSObject, but
+ * that will be cleaned up in bug 593407, at which point the
+ * service that will be woken up must implement
+ * nsIFrameMessageListener.
+ */
+[scriptable, uuid(968e31b6-b859-42f3-8140-014378fe1783)]
+interface nsIMessageWakeupService : nsISupports
+{
+  /**
+   * Requests that the wakeup service wake us up when a particular
+   * message arrives. At that time the service will be woken up
+   * and subscribed to receive further messages of that name as
+   * well.
+   */
+  boolean requestWakeup(in AString aMessageName,
+                        in AString aCid,
+                        in AString aIid,
+                        in AString aMethod);
+};
+
diff --git a/content/base/src/Makefile.in b/content/base/src/Makefile.in
index f9018dc089a7..94b983561ab0 100644
--- a/content/base/src/Makefile.in
+++ b/content/base/src/Makefile.in
@@ -163,6 +163,8 @@ EXTRA_COMPONENTS = \
 		contentSecurityPolicy.manifest \
 		contentAreaDropListener.js \
 		contentAreaDropListener.manifest \
+		messageWakeupService.js \
+		messageWakeupService.manifest \
 		$(NULL)
 
 EXTRA_JS_MODULES = \
diff --git a/content/base/src/messageWakeupService.js b/content/base/src/messageWakeupService.js
new file mode 100644
index 000000000000..f4a0b6e2350b
--- /dev/null
+++ b/content/base/src/messageWakeupService.js
@@ -0,0 +1,110 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is the Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Alon Zakai <azakai@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+
+const CATEGORY_WAKEUP_REQUEST = "wakeup-request";
+
+function MessageWakeupService() { };
+
+MessageWakeupService.prototype =
+{
+  classID:          Components.ID("{f9798742-4f7b-4188-86ba-48b116412b29}"),
+  QueryInterface:   XPCOMUtils.generateQI([Ci.nsIMessageWakeupService, Ci.nsISupports, Ci.nsIObserver]),
+
+  messagesData: [],
+
+  get messageManager() {
+    if (!this._messageManager)
+      this._messageManager = Cc["@mozilla.org/parentprocessmessagemanager;1"].
+                             getService(Ci.nsIFrameMessageManager);
+    return this._messageManager;
+  },
+
+  requestWakeup: function(aMessageName, aCid, aIid, aMethod) {
+    this.messagesData[aMessageName] = {
+      cid: aCid,
+      iid: aIid,
+      method: aMethod,
+    };
+
+    this.messageManager.addMessageListener(aMessageName, this);
+  },
+
+  receiveMessage: function(aMessage) {
+    var data = this.messagesData[aMessage.name];
+    delete this.messagesData[aMessage.name];
+    var service = Cc[data.cid][data.method](Ci[data.iid]).
+                  wrappedJSObject;
+// TODO: When bug 593407 is ready, stop doing the wrappedJSObject hack
+//       and use the line below instead
+//                  QueryInterface(Ci.nsIFrameMessageListener);
+    this.messageManager.addMessageListener(aMessage.name, service);
+    this.messageManager.removeMessageListener(aMessage.name, this);
+    service.receiveMessage(aMessage);
+  },
+
+  observe: function TM_observe(aSubject, aTopic, aData) {
+    switch (aTopic) {
+      case "profile-after-change":
+        {
+          var catMan = Cc["@mozilla.org/categorymanager;1"].
+                           getService(Ci.nsICategoryManager);
+          var entries = catMan.enumerateCategory(CATEGORY_WAKEUP_REQUEST);
+          while (entries.hasMoreElements()) {
+            var entry = entries.getNext().QueryInterface(Ci.nsISupportsCString).data;
+            var value = catMan.getCategoryEntry(CATEGORY_WAKEUP_REQUEST, entry);
+            var parts = value.split(",");
+            var cid = parts[0];
+            var iid = parts[1];
+            var method = parts[2];
+            var messages = parts.slice(3);
+            messages.forEach(function(messageName) {
+              this.requestWakeup(messageName, cid, iid, method);
+            }, this);
+          }
+        }
+        break;
+    }
+  },
+};
+
+var components = [MessageWakeupService];
+const NSGetFactory = XPCOMUtils.generateNSGetFactory(components);
+
diff --git a/content/base/src/messageWakeupService.manifest b/content/base/src/messageWakeupService.manifest
new file mode 100644
index 000000000000..271e7b8f5413
--- /dev/null
+++ b/content/base/src/messageWakeupService.manifest
@@ -0,0 +1,4 @@
+component {f9798742-4f7b-4188-86ba-48b116412b29} messageWakeupService.js
+contract @mozilla.org/content/messagewakeupservice;1 {f9798742-4f7b-4188-86ba-48b116412b29}
+category profile-after-change messageWakeupService @mozilla.org/content/messagewakeupservice;1
+

From 27845c2ea101f03f98aab3d751be35ae96810f11 Mon Sep 17 00:00:00 2001
From: Masayuki Nakano <masayuki@d-toybox.com>
Date: Sat, 4 Sep 2010 11:20:09 +0900
Subject: [PATCH 125/222] Bug 593377 bug 585922 killed all tests in
 dom/tests/browser r=bzbarsky, a=blocking2.0 final+

---
 dom/tests/Makefile.in         | 2 +-
 dom/tests/browser/Makefile.in | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dom/tests/Makefile.in b/dom/tests/Makefile.in
index d972533afcdb..96e9e5e0514a 100644
--- a/dom/tests/Makefile.in
+++ b/dom/tests/Makefile.in
@@ -50,7 +50,7 @@ DIRS		+= mochitest \
 XPCSHELL_TESTS = unit
 
 ifneq (mobile,$(MOZ_BUILD_APP))
-	dirs += browser
+	DIRS += browser
 endif
 
 include $(topsrcdir)/config/rules.mk
diff --git a/dom/tests/browser/Makefile.in b/dom/tests/browser/Makefile.in
index 0bb5381acd2c..00eff1777c9f 100644
--- a/dom/tests/browser/Makefile.in
+++ b/dom/tests/browser/Makefile.in
@@ -46,7 +46,7 @@ include $(topsrcdir)/config/rules.mk
 
 _BROWSER_FILES = \
 		browser_focus_steal_from_chrome.js \
-		browser_autofocus_background.js \
+		$(warning browser_autofocus_background.js temporarily disabled, see bug 593378) \
 		$(NULL)
 
 libs::	$(_BROWSER_FILES)

From 9c2950db18930d52175881dea1651ebc73947eea Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Fri, 3 Sep 2010 23:21:14 -0400
Subject: [PATCH 126/222] Bug 593275. Take reftest snapshots by painting the
 toplevel window. r=dbaron

---
 layout/tools/reftest/reftest.js | 59 ++++++++++-----------------------
 1 file changed, 18 insertions(+), 41 deletions(-)

diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index adfead48dc3d..80633757e3b1 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -880,21 +880,21 @@ function OnDocumentLoad(event)
         }
 
         function WhenMozAfterPaintFlushed(continuation) {
-            if (utils.isMozAfterPaintPending) {
+            if (gWindowUtils.isMozAfterPaintPending) {
                 function handler() {
-                    gBrowser.removeEventListener("MozAfterPaint", handler, false);
+                    window.removeEventListener("MozAfterPaint", handler, false);
                     continuation();
                 }
-                gBrowser.addEventListener("MozAfterPaint", handler, false);
+                window.addEventListener("MozAfterPaint", handler, false);
             } else {
                 continuation();
             }
         }
 
         function AfterPaintListener(event) {
-            if (event.target.document != currentDoc) {
+            if (event.target.document != document) {
                 // ignore paint events for subframes or old documents in the window.
-                // Invalidation in subframes will cause invalidation in the main document anyway.
+                // Invalidation in subframes will cause invalidation in the toplevel document anyway.
                 return;
             }
 
@@ -903,13 +903,13 @@ function OnDocumentLoad(event)
             // When stopAfteraintReceived is set, we can stop --- but we should keep going as long
             // as there are paint events coming (there probably shouldn't be any, but it doesn't
             // hurt to process them)
-            if (stopAfterPaintReceived && !utils.isMozAfterPaintPending) {
+            if (stopAfterPaintReceived && !gWindowUtils.isMozAfterPaintPending) {
                 FinishWaitingForTestEnd();
             }
         }
 
         function FinishWaitingForTestEnd() {
-            gBrowser.removeEventListener("MozAfterPaint", AfterPaintListener, false);
+            window.removeEventListener("MozAfterPaint", AfterPaintListener, false);
             setTimeout(DocumentLoaded, 0);
         }
 
@@ -931,7 +931,7 @@ function OnDocumentLoad(event)
                 setupPrintMode();
             FlushRendering();
 
-            if (utils.isMozAfterPaintPending) {
+            if (gWindowUtils.isMozAfterPaintPending) {
                 // Wait for the last invalidation to have happened and been snapshotted before
                 // we stop the test
                 stopAfterPaintReceived = true;
@@ -945,7 +945,7 @@ function OnDocumentLoad(event)
             FlushRendering();
 
             function continuation() {
-                gBrowser.addEventListener("MozAfterPaint", AfterPaintListener, false);
+                window.addEventListener("MozAfterPaint", AfterPaintListener, false);
                 contentRootElement.addEventListener("DOMAttrModified", AttrModifiedListener, false);
 
                 // Take a snapshot of the window in its current state
@@ -1002,7 +1002,7 @@ function UpdateCanvasCache(url, canvas)
 
 // Compute drawWindow flags lazily so the window is set up and can be
 // measured accurately
-function DoDrawWindow(ctx, win, x, y, w, h)
+function DoDrawWindow(ctx, x, y, w, h)
 {
     if (typeof gDrawWindowFlags == "undefined") {
         gDrawWindowFlags = ctx.DRAWWINDOW_DRAW_CARET |
@@ -1021,13 +1021,7 @@ function DoDrawWindow(ctx, win, x, y, w, h)
              r.width + "," + r.height + "\n");
     }
 
-    var scrollX = 0;
-    var scrollY = 0;
-    if (!(gDrawWindowFlags & ctx.DRAWWINDOW_DRAW_VIEW)) {
-        scrollX = win.scrollX;
-        scrollY = win.scrollY;
-    }
-    ctx.drawWindow(win, scrollX + x, scrollY + y, w, h, "rgb(255,255,255)",
+    ctx.drawWindow(window, x, y, w, h, "rgb(255,255,255)",
                    gDrawWindowFlags);
 }
 
@@ -1040,21 +1034,8 @@ function InitCurrentCanvasWithSnapshot()
 
     gCurrentCanvas = AllocateCanvas();
 
-    /* XXX This needs to be rgb(255,255,255) because otherwise we get
-     * black bars at the bottom of every test that are different size
-     * for the first test and the rest (scrollbar-related??) */
-    var win = gBrowser.contentWindow;
     var ctx = gCurrentCanvas.getContext("2d");
-    var scale = gBrowser.markupDocumentViewer.fullZoom;
-    ctx.save();
-    // drawWindow always draws one canvas pixel for each CSS pixel in the source
-    // window, so scale the drawing to show the zoom (making each canvas pixel be one
-    // device pixel instead)
-    ctx.scale(scale, scale);
-    DoDrawWindow(ctx, win, 0, 0,
-                 Math.ceil(gCurrentCanvas.width / scale),
-                 Math.ceil(gCurrentCanvas.height / scale));
-    ctx.restore();
+    DoDrawWindow(ctx, 0, 0, gCurrentCanvas.width, gCurrentCanvas.height);
 }
 
 function roundTo(x, fraction)
@@ -1067,23 +1048,19 @@ function UpdateCurrentCanvasForEvent(event)
     if (!gCurrentCanvas)
         return;
 
-    var win = gBrowser.contentWindow;
     var ctx = gCurrentCanvas.getContext("2d");
-    var scale = gBrowser.markupDocumentViewer.fullZoom;
-
     var rectList = event.clientRects;
     for (var i = 0; i < rectList.length; ++i) {
         var r = rectList[i];
-        // Set left/top/right/bottom to "device pixel" boundaries
-        var left = Math.floor(roundTo(r.left*scale, 0.001))/scale;
-        var top = Math.floor(roundTo(r.top*scale, 0.001))/scale;
-        var right = Math.ceil(roundTo(r.right*scale, 0.001))/scale;
-        var bottom = Math.ceil(roundTo(r.bottom*scale, 0.001))/scale;
+        // Set left/top/right/bottom to pixel boundaries
+        var left = Math.floor(r.left);
+        var top = Math.floor(r.top);
+        var right = Math.ceil(r.right);
+        var bottom = Math.ceil(r.bottom);
 
         ctx.save();
-        ctx.scale(scale, scale);
         ctx.translate(left, top);
-        DoDrawWindow(ctx, win, left, top, right - left, bottom - top);
+        DoDrawWindow(ctx, left, top, right - left, bottom - top);
         ctx.restore();
     }
 }

From a851698e78c5ba564f3e74f7873b660930b0b5e4 Mon Sep 17 00:00:00 2001
From: Felipe Gomes <felipc@gmail.com>
Date: Fri, 3 Sep 2010 23:21:26 -0400
Subject: [PATCH 127/222] Bug 592870 - Make caption buttons work with
 D3D9-accelerated layers. r=jrmuizel a=blocking2.0:beta6+

---
 widget/src/windows/nsWindowGfx.cpp | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/widget/src/windows/nsWindowGfx.cpp b/widget/src/windows/nsWindowGfx.cpp
index db3d527f7563..4b9d616e3a72 100644
--- a/widget/src/windows/nsWindowGfx.cpp
+++ b/widget/src/windows/nsWindowGfx.cpp
@@ -756,6 +756,23 @@ DDRAW_FAILED:
     }
   }
 
+#if MOZ_WINSDK_TARGETVER >= MOZ_NTDDI_LONGHORN
+  if(event.region.Intersects(mCaptionButtons)) {
+    // Temporary workaround to make the captions buttons visible for D3D9
+    const nsIntRect* r;
+    RECT rect;
+    HBRUSH blackBrush = (HBRUSH)GetStockObject(BLACK_BRUSH);
+    for (nsIntRegionRectIterator iter(mCaptionButtonsRoundedRegion);
+         (r = iter.Next()) != nsnull;) {
+      rect.top = r->y;
+      rect.left = r->x;
+      rect.right = r->XMost();
+      rect.bottom = r->YMost();
+      FillRect(hDC, &rect, blackBrush);
+    }
+  }
+#endif
+
   if (!aDC) {
     ::EndPaint(mWnd, &ps);
   }

From aaa21a504a588ffe05f1d0c55f17b51224a9f124 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Fri, 3 Sep 2010 23:27:04 -0400
Subject: [PATCH 128/222] Bug 587678 - Implement
 ImageLayerOGL::GetCurrentAsSurface for YUV surfaces. r=bas
 a=blocking2.0:beta6+

---
 gfx/layers/opengl/ImageLayerOGL.cpp | 31 ++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/gfx/layers/opengl/ImageLayerOGL.cpp b/gfx/layers/opengl/ImageLayerOGL.cpp
index 405132cb7232..42d5aa51a190 100644
--- a/gfx/layers/opengl/ImageLayerOGL.cpp
+++ b/gfx/layers/opengl/ImageLayerOGL.cpp
@@ -38,6 +38,7 @@
 
 #include "ImageLayerOGL.h"
 #include "gfxImageSurface.h"
+#include "yuv_convert.h"
 #include "GLContextProvider.h"
 
 using namespace mozilla::gl;
@@ -253,22 +254,37 @@ ImageContainerOGL::GetCurrentAsSurface(gfxIntSize *aSize)
 
   GLContext *gl = nsnull;
   // tex1 will be RGBA or Y, tex2 will Cb, tex3 will be Cr
-  GLuint tex1 = 0, tex2 = 0, tex3 = 0;
+  GLuint tex1 = 0;
   gfxIntSize size;
 
   if (mActiveImage->GetFormat() == Image::PLANAR_YCBCR) {
     PlanarYCbCrImageOGL *yuvImage =
       static_cast<PlanarYCbCrImageOGL*>(mActiveImage.get());
-    if (!yuvImage->HasData() || !yuvImage->HasTextures()) {
+    if (!yuvImage->HasData()) {
       *aSize = gfxIntSize(0, 0);
       return nsnull;
     }
 
     size = yuvImage->mSize;
-    gl = yuvImage->mTextures[0].GetGLContext();
-    tex1 = yuvImage->mTextures[0].GetTextureID();
-    tex2 = yuvImage->mTextures[1].GetTextureID();
-    tex3 = yuvImage->mTextures[2].GetTextureID();
+
+    nsRefPtr<gfxImageSurface> imageSurface =
+      new gfxImageSurface(size, gfxASurface::ImageFormatRGB24);
+
+    gfx::ConvertYCbCrToRGB32(yuvImage->mData.mYChannel,
+                             yuvImage->mData.mCbChannel,
+                             yuvImage->mData.mCrChannel,
+                             imageSurface->Data(),
+                             0,
+                             0,
+                             size.width,
+                             size.height,
+                             yuvImage->mData.mYStride,
+                             yuvImage->mData.mCbCrStride,
+                             imageSurface->Stride(),
+                             yuvImage->mType);
+
+    *aSize = size;
+    return imageSurface.forget().get();
   }
 
   if (mActiveImage->GetFormat() == Image::CAIRO_SURFACE) {
@@ -279,9 +295,6 @@ ImageContainerOGL::GetCurrentAsSurface(gfxIntSize *aSize)
     tex1 = cairoImage->mTexture.GetTextureID();
   }
 
-  // XXX TODO: read all textures in YCbCr case and convert to RGB
-  // XXX Or maybe add a ReadYCbCrTextureImage that will take 3 textures
-  // and return RGB, since we can render YCbCr to the temporary framebuffer.
   nsRefPtr<gfxImageSurface> s = gl->ReadTextureImage(tex1, size, LOCAL_GL_RGBA);
   *aSize = size;
   return s.forget();

From 1f4350abad0021d71a7c3da6f0a6983bdd65db7c Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Fri, 3 Sep 2010 23:27:07 -0400
Subject: [PATCH 129/222] Bug 581212 - turn on Direct3D accelerated layers on
 Windows. r=vlad a=blocking2.0:beta6+

---
 modules/libpref/src/init/all.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 5b2f4765842a..dc571919a164 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -3182,7 +3182,11 @@ pref("gfx.color_management.mode", 0);
 pref("mozilla.widget.render-mode", -1);
 
 // Default value of acceleration for all widgets.
+#ifdef XP_WIN
+pref("layers.accelerate-all", true);
+#else
 pref("layers.accelerate-all", false);
+#endif
 
 // Whether to allow acceleration on layers at all.
 pref("layers.accelerate-none", false);

From 95b6aeb65f7153df2c38d497cebec0bd8cee3807 Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Sat, 4 Sep 2010 00:32:36 -0400
Subject: [PATCH 130/222] Back out roc's reftest patch, which broke reftests on
 non-accelerated layer managers.

---
 layout/tools/reftest/reftest.js | 59 +++++++++++++++++++++++----------
 1 file changed, 41 insertions(+), 18 deletions(-)

diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index 80633757e3b1..adfead48dc3d 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -880,21 +880,21 @@ function OnDocumentLoad(event)
         }
 
         function WhenMozAfterPaintFlushed(continuation) {
-            if (gWindowUtils.isMozAfterPaintPending) {
+            if (utils.isMozAfterPaintPending) {
                 function handler() {
-                    window.removeEventListener("MozAfterPaint", handler, false);
+                    gBrowser.removeEventListener("MozAfterPaint", handler, false);
                     continuation();
                 }
-                window.addEventListener("MozAfterPaint", handler, false);
+                gBrowser.addEventListener("MozAfterPaint", handler, false);
             } else {
                 continuation();
             }
         }
 
         function AfterPaintListener(event) {
-            if (event.target.document != document) {
+            if (event.target.document != currentDoc) {
                 // ignore paint events for subframes or old documents in the window.
-                // Invalidation in subframes will cause invalidation in the toplevel document anyway.
+                // Invalidation in subframes will cause invalidation in the main document anyway.
                 return;
             }
 
@@ -903,13 +903,13 @@ function OnDocumentLoad(event)
             // When stopAfteraintReceived is set, we can stop --- but we should keep going as long
             // as there are paint events coming (there probably shouldn't be any, but it doesn't
             // hurt to process them)
-            if (stopAfterPaintReceived && !gWindowUtils.isMozAfterPaintPending) {
+            if (stopAfterPaintReceived && !utils.isMozAfterPaintPending) {
                 FinishWaitingForTestEnd();
             }
         }
 
         function FinishWaitingForTestEnd() {
-            window.removeEventListener("MozAfterPaint", AfterPaintListener, false);
+            gBrowser.removeEventListener("MozAfterPaint", AfterPaintListener, false);
             setTimeout(DocumentLoaded, 0);
         }
 
@@ -931,7 +931,7 @@ function OnDocumentLoad(event)
                 setupPrintMode();
             FlushRendering();
 
-            if (gWindowUtils.isMozAfterPaintPending) {
+            if (utils.isMozAfterPaintPending) {
                 // Wait for the last invalidation to have happened and been snapshotted before
                 // we stop the test
                 stopAfterPaintReceived = true;
@@ -945,7 +945,7 @@ function OnDocumentLoad(event)
             FlushRendering();
 
             function continuation() {
-                window.addEventListener("MozAfterPaint", AfterPaintListener, false);
+                gBrowser.addEventListener("MozAfterPaint", AfterPaintListener, false);
                 contentRootElement.addEventListener("DOMAttrModified", AttrModifiedListener, false);
 
                 // Take a snapshot of the window in its current state
@@ -1002,7 +1002,7 @@ function UpdateCanvasCache(url, canvas)
 
 // Compute drawWindow flags lazily so the window is set up and can be
 // measured accurately
-function DoDrawWindow(ctx, x, y, w, h)
+function DoDrawWindow(ctx, win, x, y, w, h)
 {
     if (typeof gDrawWindowFlags == "undefined") {
         gDrawWindowFlags = ctx.DRAWWINDOW_DRAW_CARET |
@@ -1021,7 +1021,13 @@ function DoDrawWindow(ctx, x, y, w, h)
              r.width + "," + r.height + "\n");
     }
 
-    ctx.drawWindow(window, x, y, w, h, "rgb(255,255,255)",
+    var scrollX = 0;
+    var scrollY = 0;
+    if (!(gDrawWindowFlags & ctx.DRAWWINDOW_DRAW_VIEW)) {
+        scrollX = win.scrollX;
+        scrollY = win.scrollY;
+    }
+    ctx.drawWindow(win, scrollX + x, scrollY + y, w, h, "rgb(255,255,255)",
                    gDrawWindowFlags);
 }
 
@@ -1034,8 +1040,21 @@ function InitCurrentCanvasWithSnapshot()
 
     gCurrentCanvas = AllocateCanvas();
 
+    /* XXX This needs to be rgb(255,255,255) because otherwise we get
+     * black bars at the bottom of every test that are different size
+     * for the first test and the rest (scrollbar-related??) */
+    var win = gBrowser.contentWindow;
     var ctx = gCurrentCanvas.getContext("2d");
-    DoDrawWindow(ctx, 0, 0, gCurrentCanvas.width, gCurrentCanvas.height);
+    var scale = gBrowser.markupDocumentViewer.fullZoom;
+    ctx.save();
+    // drawWindow always draws one canvas pixel for each CSS pixel in the source
+    // window, so scale the drawing to show the zoom (making each canvas pixel be one
+    // device pixel instead)
+    ctx.scale(scale, scale);
+    DoDrawWindow(ctx, win, 0, 0,
+                 Math.ceil(gCurrentCanvas.width / scale),
+                 Math.ceil(gCurrentCanvas.height / scale));
+    ctx.restore();
 }
 
 function roundTo(x, fraction)
@@ -1048,19 +1067,23 @@ function UpdateCurrentCanvasForEvent(event)
     if (!gCurrentCanvas)
         return;
 
+    var win = gBrowser.contentWindow;
     var ctx = gCurrentCanvas.getContext("2d");
+    var scale = gBrowser.markupDocumentViewer.fullZoom;
+
     var rectList = event.clientRects;
     for (var i = 0; i < rectList.length; ++i) {
         var r = rectList[i];
-        // Set left/top/right/bottom to pixel boundaries
-        var left = Math.floor(r.left);
-        var top = Math.floor(r.top);
-        var right = Math.ceil(r.right);
-        var bottom = Math.ceil(r.bottom);
+        // Set left/top/right/bottom to "device pixel" boundaries
+        var left = Math.floor(roundTo(r.left*scale, 0.001))/scale;
+        var top = Math.floor(roundTo(r.top*scale, 0.001))/scale;
+        var right = Math.ceil(roundTo(r.right*scale, 0.001))/scale;
+        var bottom = Math.ceil(roundTo(r.bottom*scale, 0.001))/scale;
 
         ctx.save();
+        ctx.scale(scale, scale);
         ctx.translate(left, top);
-        DoDrawWindow(ctx, left, top, right - left, bottom - top);
+        DoDrawWindow(ctx, win, left, top, right - left, bottom - top);
         ctx.restore();
     }
 }

From 2b37d991aed97f96b9e92c1f0abb824261a2309e Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Sat, 4 Sep 2010 00:34:05 -0400
Subject: [PATCH 131/222] Without roc's reftest patch, we can't turn on D3D9,
 because we don't have reftest coverage. Back out the on-by-default patch.

---
 modules/libpref/src/init/all.js | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index dc571919a164..5b2f4765842a 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -3182,11 +3182,7 @@ pref("gfx.color_management.mode", 0);
 pref("mozilla.widget.render-mode", -1);
 
 // Default value of acceleration for all widgets.
-#ifdef XP_WIN
-pref("layers.accelerate-all", true);
-#else
 pref("layers.accelerate-all", false);
-#endif
 
 // Whether to allow acceleration on layers at all.
 pref("layers.accelerate-none", false);

From c0d7f645a099b5818e1657446336d54014e6e709 Mon Sep 17 00:00:00 2001
From: Alon Zakai <azakai@mozilla.com>
Date: Fri, 3 Sep 2010 21:48:17 -0700
Subject: [PATCH 132/222] 584842 - E10s nsIContentPrefService remoting
 implementation r=myk, a=blocking-fennec

---
 dom/interfaces/base/nsIContentPrefService.idl |   6 +
 .../contentprefs/src/nsContentPrefService.js  | 165 ++++++++++++------
 .../src/nsContentPrefService.manifest         |   2 +
 .../tests/unit/head_contentPrefs.js           |  14 +-
 .../tests/unit/test_contentPrefs_childipc.js  |  39 +++++
 .../tests/unit/test_contentPrefs_parentipc.js |  54 ++++++
 6 files changed, 223 insertions(+), 57 deletions(-)
 create mode 100644 toolkit/components/contentprefs/tests/unit/test_contentPrefs_childipc.js
 create mode 100644 toolkit/components/contentprefs/tests/unit/test_contentPrefs_parentipc.js

diff --git a/dom/interfaces/base/nsIContentPrefService.idl b/dom/interfaces/base/nsIContentPrefService.idl
index 278a54fca815..1c0834263041 100644
--- a/dom/interfaces/base/nsIContentPrefService.idl
+++ b/dom/interfaces/base/nsIContentPrefService.idl
@@ -82,6 +82,9 @@ interface nsIContentPrefService : nsISupports
    * to NULL in the database, as well as undefined (nsIDataType::VTYPE_VOID),
    * which means there is no record for this pref in the database.
    *
+   * This method can be called from content processes in electrolysis builds.
+   * We have a whitelist of values that can be read in such a way.
+   *
    * @param    aGroup      the group for which to get the pref, as an nsIURI
    *                       from which the hostname will be used, a string
    *                       (typically in the format of a hostname), or null 
@@ -101,6 +104,9 @@ interface nsIContentPrefService : nsISupports
   /**
    * Set a pref.
    *
+   * This method can be called from content processes in electrolysis builds.
+   * We have a whitelist of values that can be set in such a way.
+   *
    * @param    aGroup      the group for which to set the pref, as an nsIURI
    *                       from which the hostname will be used, a string
    *                       (typically in the format of a hostname), or null
diff --git a/toolkit/components/contentprefs/src/nsContentPrefService.js b/toolkit/components/contentprefs/src/nsContentPrefService.js
index de39372ffdb2..292efd37842b 100644
--- a/toolkit/components/contentprefs/src/nsContentPrefService.js
+++ b/toolkit/components/contentprefs/src/nsContentPrefService.js
@@ -43,7 +43,88 @@ const Cu = Components.utils;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 
+/**
+ * Remotes the service. All the remoting/electrolysis code is in here,
+ * so the regular service code below remains uncluttered and maintainable.
+ */
+function electrolify(service) {
+  // FIXME: For now, use the wrappedJSObject hack, until bug
+  //        593407 which will clean that up.
+  service.wrappedJSObject = service;
+
+  var appInfo = Cc["@mozilla.org/xre/app-info;1"];
+  if (!appInfo || appInfo.getService(Ci.nsIXULRuntime).processType ==
+      Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT) {
+    // Parent process
+
+    // Setup listener for child messages. We don't need to call
+    // addMessageListener as the wakeup service will do that for us.
+    service.receiveMessage = function(aMessage) {
+      var json = aMessage.json;
+      // We have a whitelist for getting/setting. This is because
+      // there are potential privacy issues with a compromised
+      // content process checking the user's content preferences
+      // and using that to discover all the websites visited, etc.
+      // Also there are both potential race conditions (if two processes
+      // set more than one value in succession, and the values
+      // only make sense together), as well as security issues, if
+      // a compromised content process can send arbitrary setPref
+      // messages. The whitelist contains only those settings that
+      // are not at risk for either.
+      // We currently whitelist saving/reading the last directory of file
+      // uploads, which is so far the only need we have identified.
+
+      const NAME_WHITELIST = ["browser.upload.lastDir"];
+      if (NAME_WHITELIST.indexOf(json.name) == -1)
+        return { succeeded: false };
+
+      switch (aMessage.name) {
+        case "ContentPref:getPref":
+          return { succeeded: true,
+                   value: service.getPref(json.group, json.name, json.value) };
+
+        case "ContentPref:setPref":
+          service.setPref(json.group, json.name, json.value);
+          return { succeeded: true };
+      }
+    };
+  } else {
+    // Child process
+
+    service._dbInit = function(){}; // No local DB
+
+    service.messageManager = Cc["@mozilla.org/childprocessmessagemanager;1"].
+                             getService(Ci.nsISyncMessageSender);
+
+    // Child method remoting
+    [
+      ['getPref', ['group', 'name'], ['_parseGroupParam']],
+      ['setPref', ['group', 'name', 'value'], ['_parseGroupParam']],
+    ].forEach(function(data) {
+      var method = data[0];
+      var params = data[1];
+      var parsers = data[2];
+      service[method] = function __remoted__() {
+        var json = {};
+        for (var i = 0; i < params.length; i++) {
+          if (params[i]) {
+            json[params[i]] = arguments[i];
+            if (parsers[i])
+              json[params[i]] = this[parsers[i]](json[params[i]]);
+          }
+        }
+        var ret = service.messageManager.sendSyncMessage('ContentPref:' + method, json)[0];
+        if (!ret.succeeded)
+          throw "ContentPrefs remoting failed to pass whitelist";
+        return ret.value;
+      };
+    });
+  }
+}
+
 function ContentPrefService() {
+  electrolify(this);
+
   // If this throws an exception, it causes the getService call to fail,
   // but the next time a consumer tries to retrieve the service, we'll try
   // to initialize the database again, which might work if the failure
@@ -59,7 +140,8 @@ ContentPrefService.prototype = {
   // XPCOM Plumbing
 
   classID:          Components.ID("{e6a3f533-4ffa-4615-8eb4-d4e72d883fa7}"),
-  QueryInterface:   XPCOMUtils.generateQI([Ci.nsIContentPrefService]),
+  QueryInterface:   XPCOMUtils.generateQI([Ci.nsIContentPrefService,
+                                           Ci.nsIFrameMessageListener]),
 
 
   //**************************************************************************//
@@ -137,15 +219,10 @@ ContentPrefService.prototype = {
       throw Components.Exception("aName cannot be null or an empty string",
                                  Cr.NS_ERROR_ILLEGAL_VALUE);
 
-    if (aGroup == null)
+    var group = this._parseGroupParam(aGroup);
+    if (group == null)
       return this._selectGlobalPref(aName, aCallback);
-    if (aGroup.constructor.name == "String")
-      return this._selectPref(aGroup.toString(), aName, aCallback);
-    if (aGroup instanceof Ci.nsIURI)
-      return this._selectPref(this.grouper.group(aGroup), aName, aCallback);
-
-    throw Components.Exception("aGroup is not a string, nsIURI or null",
-                               Cr.NS_ERROR_ILLEGAL_VALUE);
+    return this._selectPref(group, aName, aCallback);
   },
 
   setPref: function ContentPrefService_setPref(aGroup, aName, aValue) {
@@ -168,26 +245,15 @@ ContentPrefService.prototype = {
     }
 
     var settingID = this._selectSettingID(aName) || this._insertSetting(aName);
-    var group, groupID, prefID;
-    if (aGroup == null) {
-      group = null;
+    var group = this._parseGroupParam(aGroup);
+    var groupID, prefID;
+    if (group == null) {
       groupID = null;
       prefID = this._selectGlobalPrefID(settingID);
     }
-    else if (aGroup.constructor.name == "String") {
-      group = aGroup.toString();
-      groupID = this._selectGroupID(group) || this._insertGroup(group);
-      prefID = this._selectPrefID(groupID, settingID);
-    }
-    else if (aGroup instanceof Ci.nsIURI) {
-      group = this.grouper.group(aGroup);
-      groupID = this._selectGroupID(group) || this._insertGroup(group);
-      prefID = this._selectPrefID(groupID, settingID);
-    }
     else {
-      // Should never get here, due to earlier getPref call
-      throw Components.Exception("aGroup is not a string, nsIURI or null",
-                                 Cr.NS_ERROR_ILLEGAL_VALUE);
+      groupID = this._selectGroupID(group) || this._insertGroup(group);
+      prefID = this._selectPrefID(groupID, settingID);
     }
 
     // Update the existing record, if any, or create a new one.
@@ -217,27 +283,17 @@ ContentPrefService.prototype = {
     if (!this.hasPref(aGroup, aName))
       return;
 
+
     var settingID = this._selectSettingID(aName);
-    var group, groupID, prefID;
-    if (aGroup == null) {
-      group = null;
+    var group = this._parseGroupParam(aGroup);
+    var groupID, prefID;
+    if (group == null) {
       groupID = null;
       prefID = this._selectGlobalPrefID(settingID);
     }
-    else if (aGroup.constructor.name == "String") {
-      group = aGroup.toString();
-      groupID = this._selectGroupID(group);
-      prefID = this._selectPrefID(groupID, settingID);
-    }
-    else if (aGroup instanceof Ci.nsIURI) {
-      group = this.grouper.group(aGroup);
-      groupID = this._selectGroupID(group);
-      prefID = this._selectPrefID(groupID, settingID);
-    }
     else {
-      // Should never get here, due to earlier hasPref call
-      throw Components.Exception("aGroup is not a string, nsIURI or null",
-                                 Cr.NS_ERROR_ILLEGAL_VALUE);
+      groupID = this._selectGroupID(group);
+      prefID = this._selectPrefID(groupID, settingID);
     }
 
     this._deletePref(prefID);
@@ -312,18 +368,10 @@ ContentPrefService.prototype = {
   },
 
   getPrefs: function ContentPrefService_getPrefs(aGroup) {
-    if (aGroup == null)
+    var group = this._parseGroupParam(aGroup);
+    if (group == null)
       return this._selectGlobalPrefs();
-    if (aGroup.constructor.name == "String") {
-      group = aGroup.toString();
-      return this._selectPrefs(group);
-    }
-    if (aGroup instanceof Ci.nsIURI) {
-      var group = this.grouper.group(aGroup);
-      return this._selectPrefs(group);
-    }
-    throw Components.Exception("aGroup is not a string, nsIURI or null",
-                               Cr.NS_ERROR_ILLEGAL_VALUE);
+    return this._selectPrefs(group);
   },
 
   getPrefsByName: function ContentPrefService_getPrefsByName(aName) {
@@ -1011,8 +1059,19 @@ ContentPrefService.prototype = {
 
   _dbMigrate2To3: function ContentPrefService__dbMigrate2To3(aDBConnection) {
     this._dbCreateIndices(aDBConnection);
-  }
+  },
 
+  _parseGroupParam: function ContentPrefService__parseGroupParam(aGroup) {
+    if (aGroup == null)
+      return null;
+    if (aGroup.constructor.name == "String")
+      return aGroup.toString();
+    if (aGroup instanceof Ci.nsIURI)
+      return this.grouper.group(aGroup);
+
+    throw Components.Exception("aGroup is not a string, nsIURI or null",
+                               Cr.NS_ERROR_ILLEGAL_VALUE);
+  },
 };
 
 
diff --git a/toolkit/components/contentprefs/src/nsContentPrefService.manifest b/toolkit/components/contentprefs/src/nsContentPrefService.manifest
index 28bfc4807e77..04007510a4f0 100644
--- a/toolkit/components/contentprefs/src/nsContentPrefService.manifest
+++ b/toolkit/components/contentprefs/src/nsContentPrefService.manifest
@@ -2,3 +2,5 @@ component {e6a3f533-4ffa-4615-8eb4-d4e72d883fa7} nsContentPrefService.js
 contract @mozilla.org/content-pref/service;1 {e6a3f533-4ffa-4615-8eb4-d4e72d883fa7}
 component {8df290ae-dcaa-4c11-98a5-2429a4dc97bb} nsContentPrefService.js
 contract @mozilla.org/content-pref/hostname-grouper;1 {8df290ae-dcaa-4c11-98a5-2429a4dc97bb}
+category wakeup-request nsContentPrefService @mozilla.org/content-pref/service;1,nsIContentPrefService,getService,ContentPref:getPref,ContentPref:setPref
+
diff --git a/toolkit/components/contentprefs/tests/unit/head_contentPrefs.js b/toolkit/components/contentprefs/tests/unit/head_contentPrefs.js
index 289676dbbd7d..7a3dcb5db360 100644
--- a/toolkit/components/contentprefs/tests/unit/head_contentPrefs.js
+++ b/toolkit/components/contentprefs/tests/unit/head_contentPrefs.js
@@ -167,7 +167,13 @@ var ContentPrefTest = {
 ContentPrefTest.deleteDatabase();
 
 // Turn on logging for the content preferences service so we can troubleshoot
-// problems with the tests.
-var prefBranch = Cc["@mozilla.org/preferences-service;1"].
-                 getService(Ci.nsIPrefBranch);
-prefBranch.setBoolPref("browser.preferences.content.log", true);
+// problems with the tests. This is only useful in regular (parent)
+// processes - child processes are not able to do that and will crash.
+var appInfo = Cc["@mozilla.org/xre/app-info;1"];
+if (!appInfo || appInfo.getService(Ci.nsIXULRuntime).processType ==
+    Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT) {
+  var prefBranch = Cc["@mozilla.org/preferences-service;1"].
+                   getService(Ci.nsIPrefBranch);
+  prefBranch.setBoolPref("browser.preferences.content.log", true);
+}
+
diff --git a/toolkit/components/contentprefs/tests/unit/test_contentPrefs_childipc.js b/toolkit/components/contentprefs/tests/unit/test_contentPrefs_childipc.js
new file mode 100644
index 000000000000..2e228196c0fc
--- /dev/null
+++ b/toolkit/components/contentprefs/tests/unit/test_contentPrefs_childipc.js
@@ -0,0 +1,39 @@
+function run_test() {
+  var appInfo = Cc["@mozilla.org/xre/app-info;1"];
+  if (!appInfo || appInfo.getService(Ci.nsIXULRuntime).processType ==
+      Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT) {
+    return; // test harness also calls us in the parent process - ignore that
+  }
+
+  let cps = Cc["@mozilla.org/content-pref/service;1"].
+            createInstance(Ci.nsIContentPrefService);
+
+  // Cannot get general values
+  try {
+    cps.getPref("group", "name")
+    do_check_false(true, "Must have thrown exception on getting general value");
+  }
+  catch(e) { }
+
+  // Cannot set general values
+  try {
+    cps.setPref("group", "name", "someValue2");
+    do_check_false(true, "Must have thrown exception on setting general value");
+  }
+  catch(e) { }
+
+  // Can set&get whitelisted values
+  cps.setPref("group", "browser.upload.lastDir", "childValue");
+  do_check_eq(cps.getPref("group", "browser.upload.lastDir"), "childValue");
+
+  // Test sending URI
+  var ioSvc = Cc["@mozilla.org/network/io-service;1"].
+              getService(Ci.nsIIOService);
+  var uri = ioSvc.newURI("http://mozilla.org", null, null);
+  cps.setPref(uri, "browser.upload.lastDir", "childValue2");
+  do_check_eq(cps.getPref(uri, "browser.upload.lastDir"), "childValue2");
+
+  // Previous value
+  do_check_eq(cps.getPref("group", "browser.upload.lastDir"), "childValue");
+}
+
diff --git a/toolkit/components/contentprefs/tests/unit/test_contentPrefs_parentipc.js b/toolkit/components/contentprefs/tests/unit/test_contentPrefs_parentipc.js
new file mode 100644
index 000000000000..9d874863fd32
--- /dev/null
+++ b/toolkit/components/contentprefs/tests/unit/test_contentPrefs_parentipc.js
@@ -0,0 +1,54 @@
+
+function run_test() {
+  let cps = Cc["@mozilla.org/content-pref/service;1"].
+            createInstance(Ci.nsIContentPrefService);
+
+  // Check received messages
+
+  let messageHandler = cps;
+  // FIXME: For now, use the wrappedJSObject hack, until bug
+  //        593407 which will clean that up. After that, use
+  //        the commented out line below it.
+  messageHandler = cps.wrappedJSObject;
+  //messageHandler = cps.QueryInterface(Ci.nsIFrameMessageListener);
+
+  // Cannot get values
+  do_check_false(messageHandler.receiveMessage({
+    name: "ContentPref:getPref",
+    json: { group: 'group2', name: 'name' } }).succeeded);
+
+  // Cannot set general values
+  messageHandler.receiveMessage({ name: "ContentPref:setPref",
+    json: { group: 'group2', name: 'name', value: 'someValue' } });
+  do_check_eq(cps.getPref('group', 'name'), undefined);
+
+  // Can set whitelisted values
+  do_check_true(messageHandler.receiveMessage({ name: "ContentPref:setPref",
+    json: { group: 'group2', name: 'browser.upload.lastDir',
+            value: 'someValue' } }).succeeded);
+  do_check_eq(cps.getPref('group2', 'browser.upload.lastDir'), 'someValue');
+
+  // Prepare for child tests
+
+  // Mock construction for set/get for child. This is necessary because
+  // the IPC xpcshell setup doens't do well with the normal storage
+  // engine. But even with this mock interface, we are testing
+  // the whitelisting functionality properly, which is all we need here.
+  var mockStorage = {};
+  cps.wrappedJSObject.setPref = function(aGroup, aName, aValue) {
+    mockStorage[aGroup+':'+aName] = aValue;
+  }
+  cps.wrappedJSObject.getPref = function(aGroup, aName) {
+    return mockStorage[aGroup+':'+aName];
+  }
+
+  // Manually listen to messages - the wakeup manager should do this
+  // for us, but it doens't run in xpcshell tests
+  var mM = Cc["@mozilla.org/parentprocessmessagemanager;1"].
+           getService(Ci.nsIFrameMessageManager);
+  mM.addMessageListener("ContentPref:setPref", messageHandler);
+  mM.addMessageListener("ContentPref:getPref", messageHandler);
+
+  run_test_in_child("test_contentPrefs_childipc.js");
+}
+

From 8b0852baf74db2d57c74b88da289d6bccb683295 Mon Sep 17 00:00:00 2001
From: Doug Turner <dougt@dougt.org>
Date: Fri, 3 Sep 2010 22:56:49 -0700
Subject: [PATCH 133/222] Backed out changeset 38b763292cb1. MacOS doesn't
 support E10S tests.  a=bah

---
 dom/interfaces/base/nsIContentPrefService.idl |   6 -
 .../contentprefs/src/nsContentPrefService.js  | 161 ++++++------------
 .../src/nsContentPrefService.manifest         |   2 -
 .../tests/unit/head_contentPrefs.js           |  14 +-
 .../tests/unit/test_contentPrefs_childipc.js  |  39 -----
 .../tests/unit/test_contentPrefs_parentipc.js |  54 ------
 6 files changed, 55 insertions(+), 221 deletions(-)
 delete mode 100644 toolkit/components/contentprefs/tests/unit/test_contentPrefs_childipc.js
 delete mode 100644 toolkit/components/contentprefs/tests/unit/test_contentPrefs_parentipc.js

diff --git a/dom/interfaces/base/nsIContentPrefService.idl b/dom/interfaces/base/nsIContentPrefService.idl
index 1c0834263041..278a54fca815 100644
--- a/dom/interfaces/base/nsIContentPrefService.idl
+++ b/dom/interfaces/base/nsIContentPrefService.idl
@@ -82,9 +82,6 @@ interface nsIContentPrefService : nsISupports
    * to NULL in the database, as well as undefined (nsIDataType::VTYPE_VOID),
    * which means there is no record for this pref in the database.
    *
-   * This method can be called from content processes in electrolysis builds.
-   * We have a whitelist of values that can be read in such a way.
-   *
    * @param    aGroup      the group for which to get the pref, as an nsIURI
    *                       from which the hostname will be used, a string
    *                       (typically in the format of a hostname), or null 
@@ -104,9 +101,6 @@ interface nsIContentPrefService : nsISupports
   /**
    * Set a pref.
    *
-   * This method can be called from content processes in electrolysis builds.
-   * We have a whitelist of values that can be set in such a way.
-   *
    * @param    aGroup      the group for which to set the pref, as an nsIURI
    *                       from which the hostname will be used, a string
    *                       (typically in the format of a hostname), or null
diff --git a/toolkit/components/contentprefs/src/nsContentPrefService.js b/toolkit/components/contentprefs/src/nsContentPrefService.js
index 292efd37842b..de39372ffdb2 100644
--- a/toolkit/components/contentprefs/src/nsContentPrefService.js
+++ b/toolkit/components/contentprefs/src/nsContentPrefService.js
@@ -43,88 +43,7 @@ const Cu = Components.utils;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 
-/**
- * Remotes the service. All the remoting/electrolysis code is in here,
- * so the regular service code below remains uncluttered and maintainable.
- */
-function electrolify(service) {
-  // FIXME: For now, use the wrappedJSObject hack, until bug
-  //        593407 which will clean that up.
-  service.wrappedJSObject = service;
-
-  var appInfo = Cc["@mozilla.org/xre/app-info;1"];
-  if (!appInfo || appInfo.getService(Ci.nsIXULRuntime).processType ==
-      Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT) {
-    // Parent process
-
-    // Setup listener for child messages. We don't need to call
-    // addMessageListener as the wakeup service will do that for us.
-    service.receiveMessage = function(aMessage) {
-      var json = aMessage.json;
-      // We have a whitelist for getting/setting. This is because
-      // there are potential privacy issues with a compromised
-      // content process checking the user's content preferences
-      // and using that to discover all the websites visited, etc.
-      // Also there are both potential race conditions (if two processes
-      // set more than one value in succession, and the values
-      // only make sense together), as well as security issues, if
-      // a compromised content process can send arbitrary setPref
-      // messages. The whitelist contains only those settings that
-      // are not at risk for either.
-      // We currently whitelist saving/reading the last directory of file
-      // uploads, which is so far the only need we have identified.
-
-      const NAME_WHITELIST = ["browser.upload.lastDir"];
-      if (NAME_WHITELIST.indexOf(json.name) == -1)
-        return { succeeded: false };
-
-      switch (aMessage.name) {
-        case "ContentPref:getPref":
-          return { succeeded: true,
-                   value: service.getPref(json.group, json.name, json.value) };
-
-        case "ContentPref:setPref":
-          service.setPref(json.group, json.name, json.value);
-          return { succeeded: true };
-      }
-    };
-  } else {
-    // Child process
-
-    service._dbInit = function(){}; // No local DB
-
-    service.messageManager = Cc["@mozilla.org/childprocessmessagemanager;1"].
-                             getService(Ci.nsISyncMessageSender);
-
-    // Child method remoting
-    [
-      ['getPref', ['group', 'name'], ['_parseGroupParam']],
-      ['setPref', ['group', 'name', 'value'], ['_parseGroupParam']],
-    ].forEach(function(data) {
-      var method = data[0];
-      var params = data[1];
-      var parsers = data[2];
-      service[method] = function __remoted__() {
-        var json = {};
-        for (var i = 0; i < params.length; i++) {
-          if (params[i]) {
-            json[params[i]] = arguments[i];
-            if (parsers[i])
-              json[params[i]] = this[parsers[i]](json[params[i]]);
-          }
-        }
-        var ret = service.messageManager.sendSyncMessage('ContentPref:' + method, json)[0];
-        if (!ret.succeeded)
-          throw "ContentPrefs remoting failed to pass whitelist";
-        return ret.value;
-      };
-    });
-  }
-}
-
 function ContentPrefService() {
-  electrolify(this);
-
   // If this throws an exception, it causes the getService call to fail,
   // but the next time a consumer tries to retrieve the service, we'll try
   // to initialize the database again, which might work if the failure
@@ -140,8 +59,7 @@ ContentPrefService.prototype = {
   // XPCOM Plumbing
 
   classID:          Components.ID("{e6a3f533-4ffa-4615-8eb4-d4e72d883fa7}"),
-  QueryInterface:   XPCOMUtils.generateQI([Ci.nsIContentPrefService,
-                                           Ci.nsIFrameMessageListener]),
+  QueryInterface:   XPCOMUtils.generateQI([Ci.nsIContentPrefService]),
 
 
   //**************************************************************************//
@@ -219,10 +137,15 @@ ContentPrefService.prototype = {
       throw Components.Exception("aName cannot be null or an empty string",
                                  Cr.NS_ERROR_ILLEGAL_VALUE);
 
-    var group = this._parseGroupParam(aGroup);
-    if (group == null)
+    if (aGroup == null)
       return this._selectGlobalPref(aName, aCallback);
-    return this._selectPref(group, aName, aCallback);
+    if (aGroup.constructor.name == "String")
+      return this._selectPref(aGroup.toString(), aName, aCallback);
+    if (aGroup instanceof Ci.nsIURI)
+      return this._selectPref(this.grouper.group(aGroup), aName, aCallback);
+
+    throw Components.Exception("aGroup is not a string, nsIURI or null",
+                               Cr.NS_ERROR_ILLEGAL_VALUE);
   },
 
   setPref: function ContentPrefService_setPref(aGroup, aName, aValue) {
@@ -245,16 +168,27 @@ ContentPrefService.prototype = {
     }
 
     var settingID = this._selectSettingID(aName) || this._insertSetting(aName);
-    var group = this._parseGroupParam(aGroup);
-    var groupID, prefID;
-    if (group == null) {
+    var group, groupID, prefID;
+    if (aGroup == null) {
+      group = null;
       groupID = null;
       prefID = this._selectGlobalPrefID(settingID);
     }
-    else {
+    else if (aGroup.constructor.name == "String") {
+      group = aGroup.toString();
       groupID = this._selectGroupID(group) || this._insertGroup(group);
       prefID = this._selectPrefID(groupID, settingID);
     }
+    else if (aGroup instanceof Ci.nsIURI) {
+      group = this.grouper.group(aGroup);
+      groupID = this._selectGroupID(group) || this._insertGroup(group);
+      prefID = this._selectPrefID(groupID, settingID);
+    }
+    else {
+      // Should never get here, due to earlier getPref call
+      throw Components.Exception("aGroup is not a string, nsIURI or null",
+                                 Cr.NS_ERROR_ILLEGAL_VALUE);
+    }
 
     // Update the existing record, if any, or create a new one.
     if (prefID)
@@ -283,18 +217,28 @@ ContentPrefService.prototype = {
     if (!this.hasPref(aGroup, aName))
       return;
 
-
     var settingID = this._selectSettingID(aName);
-    var group = this._parseGroupParam(aGroup);
-    var groupID, prefID;
-    if (group == null) {
+    var group, groupID, prefID;
+    if (aGroup == null) {
+      group = null;
       groupID = null;
       prefID = this._selectGlobalPrefID(settingID);
     }
-    else {
+    else if (aGroup.constructor.name == "String") {
+      group = aGroup.toString();
       groupID = this._selectGroupID(group);
       prefID = this._selectPrefID(groupID, settingID);
     }
+    else if (aGroup instanceof Ci.nsIURI) {
+      group = this.grouper.group(aGroup);
+      groupID = this._selectGroupID(group);
+      prefID = this._selectPrefID(groupID, settingID);
+    }
+    else {
+      // Should never get here, due to earlier hasPref call
+      throw Components.Exception("aGroup is not a string, nsIURI or null",
+                                 Cr.NS_ERROR_ILLEGAL_VALUE);
+    }
 
     this._deletePref(prefID);
 
@@ -368,10 +312,18 @@ ContentPrefService.prototype = {
   },
 
   getPrefs: function ContentPrefService_getPrefs(aGroup) {
-    var group = this._parseGroupParam(aGroup);
-    if (group == null)
+    if (aGroup == null)
       return this._selectGlobalPrefs();
-    return this._selectPrefs(group);
+    if (aGroup.constructor.name == "String") {
+      group = aGroup.toString();
+      return this._selectPrefs(group);
+    }
+    if (aGroup instanceof Ci.nsIURI) {
+      var group = this.grouper.group(aGroup);
+      return this._selectPrefs(group);
+    }
+    throw Components.Exception("aGroup is not a string, nsIURI or null",
+                               Cr.NS_ERROR_ILLEGAL_VALUE);
   },
 
   getPrefsByName: function ContentPrefService_getPrefsByName(aName) {
@@ -1059,19 +1011,8 @@ ContentPrefService.prototype = {
 
   _dbMigrate2To3: function ContentPrefService__dbMigrate2To3(aDBConnection) {
     this._dbCreateIndices(aDBConnection);
-  },
+  }
 
-  _parseGroupParam: function ContentPrefService__parseGroupParam(aGroup) {
-    if (aGroup == null)
-      return null;
-    if (aGroup.constructor.name == "String")
-      return aGroup.toString();
-    if (aGroup instanceof Ci.nsIURI)
-      return this.grouper.group(aGroup);
-
-    throw Components.Exception("aGroup is not a string, nsIURI or null",
-                               Cr.NS_ERROR_ILLEGAL_VALUE);
-  },
 };
 
 
diff --git a/toolkit/components/contentprefs/src/nsContentPrefService.manifest b/toolkit/components/contentprefs/src/nsContentPrefService.manifest
index 04007510a4f0..28bfc4807e77 100644
--- a/toolkit/components/contentprefs/src/nsContentPrefService.manifest
+++ b/toolkit/components/contentprefs/src/nsContentPrefService.manifest
@@ -2,5 +2,3 @@ component {e6a3f533-4ffa-4615-8eb4-d4e72d883fa7} nsContentPrefService.js
 contract @mozilla.org/content-pref/service;1 {e6a3f533-4ffa-4615-8eb4-d4e72d883fa7}
 component {8df290ae-dcaa-4c11-98a5-2429a4dc97bb} nsContentPrefService.js
 contract @mozilla.org/content-pref/hostname-grouper;1 {8df290ae-dcaa-4c11-98a5-2429a4dc97bb}
-category wakeup-request nsContentPrefService @mozilla.org/content-pref/service;1,nsIContentPrefService,getService,ContentPref:getPref,ContentPref:setPref
-
diff --git a/toolkit/components/contentprefs/tests/unit/head_contentPrefs.js b/toolkit/components/contentprefs/tests/unit/head_contentPrefs.js
index 7a3dcb5db360..289676dbbd7d 100644
--- a/toolkit/components/contentprefs/tests/unit/head_contentPrefs.js
+++ b/toolkit/components/contentprefs/tests/unit/head_contentPrefs.js
@@ -167,13 +167,7 @@ var ContentPrefTest = {
 ContentPrefTest.deleteDatabase();
 
 // Turn on logging for the content preferences service so we can troubleshoot
-// problems with the tests. This is only useful in regular (parent)
-// processes - child processes are not able to do that and will crash.
-var appInfo = Cc["@mozilla.org/xre/app-info;1"];
-if (!appInfo || appInfo.getService(Ci.nsIXULRuntime).processType ==
-    Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT) {
-  var prefBranch = Cc["@mozilla.org/preferences-service;1"].
-                   getService(Ci.nsIPrefBranch);
-  prefBranch.setBoolPref("browser.preferences.content.log", true);
-}
-
+// problems with the tests.
+var prefBranch = Cc["@mozilla.org/preferences-service;1"].
+                 getService(Ci.nsIPrefBranch);
+prefBranch.setBoolPref("browser.preferences.content.log", true);
diff --git a/toolkit/components/contentprefs/tests/unit/test_contentPrefs_childipc.js b/toolkit/components/contentprefs/tests/unit/test_contentPrefs_childipc.js
deleted file mode 100644
index 2e228196c0fc..000000000000
--- a/toolkit/components/contentprefs/tests/unit/test_contentPrefs_childipc.js
+++ /dev/null
@@ -1,39 +0,0 @@
-function run_test() {
-  var appInfo = Cc["@mozilla.org/xre/app-info;1"];
-  if (!appInfo || appInfo.getService(Ci.nsIXULRuntime).processType ==
-      Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT) {
-    return; // test harness also calls us in the parent process - ignore that
-  }
-
-  let cps = Cc["@mozilla.org/content-pref/service;1"].
-            createInstance(Ci.nsIContentPrefService);
-
-  // Cannot get general values
-  try {
-    cps.getPref("group", "name")
-    do_check_false(true, "Must have thrown exception on getting general value");
-  }
-  catch(e) { }
-
-  // Cannot set general values
-  try {
-    cps.setPref("group", "name", "someValue2");
-    do_check_false(true, "Must have thrown exception on setting general value");
-  }
-  catch(e) { }
-
-  // Can set&get whitelisted values
-  cps.setPref("group", "browser.upload.lastDir", "childValue");
-  do_check_eq(cps.getPref("group", "browser.upload.lastDir"), "childValue");
-
-  // Test sending URI
-  var ioSvc = Cc["@mozilla.org/network/io-service;1"].
-              getService(Ci.nsIIOService);
-  var uri = ioSvc.newURI("http://mozilla.org", null, null);
-  cps.setPref(uri, "browser.upload.lastDir", "childValue2");
-  do_check_eq(cps.getPref(uri, "browser.upload.lastDir"), "childValue2");
-
-  // Previous value
-  do_check_eq(cps.getPref("group", "browser.upload.lastDir"), "childValue");
-}
-
diff --git a/toolkit/components/contentprefs/tests/unit/test_contentPrefs_parentipc.js b/toolkit/components/contentprefs/tests/unit/test_contentPrefs_parentipc.js
deleted file mode 100644
index 9d874863fd32..000000000000
--- a/toolkit/components/contentprefs/tests/unit/test_contentPrefs_parentipc.js
+++ /dev/null
@@ -1,54 +0,0 @@
-
-function run_test() {
-  let cps = Cc["@mozilla.org/content-pref/service;1"].
-            createInstance(Ci.nsIContentPrefService);
-
-  // Check received messages
-
-  let messageHandler = cps;
-  // FIXME: For now, use the wrappedJSObject hack, until bug
-  //        593407 which will clean that up. After that, use
-  //        the commented out line below it.
-  messageHandler = cps.wrappedJSObject;
-  //messageHandler = cps.QueryInterface(Ci.nsIFrameMessageListener);
-
-  // Cannot get values
-  do_check_false(messageHandler.receiveMessage({
-    name: "ContentPref:getPref",
-    json: { group: 'group2', name: 'name' } }).succeeded);
-
-  // Cannot set general values
-  messageHandler.receiveMessage({ name: "ContentPref:setPref",
-    json: { group: 'group2', name: 'name', value: 'someValue' } });
-  do_check_eq(cps.getPref('group', 'name'), undefined);
-
-  // Can set whitelisted values
-  do_check_true(messageHandler.receiveMessage({ name: "ContentPref:setPref",
-    json: { group: 'group2', name: 'browser.upload.lastDir',
-            value: 'someValue' } }).succeeded);
-  do_check_eq(cps.getPref('group2', 'browser.upload.lastDir'), 'someValue');
-
-  // Prepare for child tests
-
-  // Mock construction for set/get for child. This is necessary because
-  // the IPC xpcshell setup doens't do well with the normal storage
-  // engine. But even with this mock interface, we are testing
-  // the whitelisting functionality properly, which is all we need here.
-  var mockStorage = {};
-  cps.wrappedJSObject.setPref = function(aGroup, aName, aValue) {
-    mockStorage[aGroup+':'+aName] = aValue;
-  }
-  cps.wrappedJSObject.getPref = function(aGroup, aName) {
-    return mockStorage[aGroup+':'+aName];
-  }
-
-  // Manually listen to messages - the wakeup manager should do this
-  // for us, but it doens't run in xpcshell tests
-  var mM = Cc["@mozilla.org/parentprocessmessagemanager;1"].
-           getService(Ci.nsIFrameMessageManager);
-  mM.addMessageListener("ContentPref:setPref", messageHandler);
-  mM.addMessageListener("ContentPref:getPref", messageHandler);
-
-  run_test_in_child("test_contentPrefs_childipc.js");
-}
-

From c662cb6d9df4bd4fe8030e20249961710157a09a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Sat, 4 Sep 2010 10:46:14 +0200
Subject: [PATCH 134/222] Bug 591853 - Optimize chrome layer size with
 lightweight themes with transparent or no footer images. r=enn

---
 browser/themes/gnomestripe/browser/browser.css | 2 +-
 toolkit/content/LightweightThemeConsumer.jsm   | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/browser/themes/gnomestripe/browser/browser.css b/browser/themes/gnomestripe/browser/browser.css
index c684a32c73dc..a8dc14ada94e 100644
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@@ -68,7 +68,7 @@
   padding-top: 0;
 }
 
-#browser-bottombox:not([lwthemefooter="true"]) {
+#browser-bottombox {
   /* opaque for layers optimization */
   background-color: -moz-Dialog;
 }
diff --git a/toolkit/content/LightweightThemeConsumer.jsm b/toolkit/content/LightweightThemeConsumer.jsm
index 24a46c384e17..18481b73dcf1 100644
--- a/toolkit/content/LightweightThemeConsumer.jsm
+++ b/toolkit/content/LightweightThemeConsumer.jsm
@@ -89,6 +89,7 @@ LightweightThemeConsumer.prototype = {
     _setImage(root, active, aData.headerURL);
     if (this._footerId) {
       let footer = this._doc.getElementById(this._footerId);
+      footer.style.backgroundColor = active ? aData.accentcolor || "white" : "";
       _setImage(footer, active, aData.footerURL);
       if (active && aData.footerURL)
         footer.setAttribute("lwthemefooter", "true");

From 6cd35b9b2edc86e244c67da3df96ecca3d489ceb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Sat, 4 Sep 2010 10:46:24 +0200
Subject: [PATCH 135/222] Bug 572488 - New tab and toolbar style for Linux.
 r=gavin

---
 .../themes/gnomestripe/browser/browser.css    | 163 +++++++++++++-----
 browser/themes/gnomestripe/browser/jar.mn     |   1 +
 .../gnomestripe/browser/tabbrowser/tab.png    | Bin 0 -> 411 bytes
 3 files changed, 121 insertions(+), 43 deletions(-)
 create mode 100644 browser/themes/gnomestripe/browser/tabbrowser/tab.png

diff --git a/browser/themes/gnomestripe/browser/browser.css b/browser/themes/gnomestripe/browser/browser.css
index a8dc14ada94e..5a17a47a8a00 100644
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@@ -49,6 +49,8 @@
 @namespace html url("http://www.w3.org/1999/xhtml");
 
 %include ../../browserShared.inc
+%filter substitution
+%define toolbarHighlight rgba(255,255,255,.3)
 
 #menubar-items {
   -moz-box-orient: vertical; /* for flex hack */
@@ -58,14 +60,41 @@
   -moz-box-flex: 1; /* make menu items expand to fill toolbar height */
 }
 
-#personal-bookmarks {
-  min-height: 29px;
+#navigator-toolbox {
+  -moz-appearance: none;
+  background-color: transparent;
+  border-top: none;
+  border-bottom: 1px solid ThreeDShadow;
 }
 
-#navigator-toolbox[inFullscreen="true"],
-#navigator-toolbox[inFullscreen="true"] > #nav-bar {
-  border-top: none;
-  padding-top: 0;
+#navigator-toolbox > toolbar:not(:-moz-lwtheme):not(#toolbar-menubar) {
+  -moz-appearance: none;
+  border-style: none;
+  background-color: -moz-Dialog;
+}
+
+#navigator-toolbox > toolbar:not(#toolbar-menubar):not(#TabsToolbar) {
+  padding-top: 1px;
+  padding-bottom: 1px;
+}
+
+#nav-bar:not(:-moz-lwtheme),
+#nav-bar[collapsed="true"] + toolbar:not(:-moz-lwtheme),
+#nav-bar[collapsed="true"] + #customToolbars + #PersonalToolbar:not(:-moz-lwtheme),
+#navigator-toolbox[tabsontop="true"] > #nav-bar,
+#navigator-toolbox[tabsontop="true"]:not([customizing]) > #nav-bar[collapsed="true"] + toolbar,
+#navigator-toolbox[tabsontop="true"]:not([customizing]) > #nav-bar[collapsed="true"] + #customToolbars + #PersonalToolbar {
+  background-image: -moz-linear-gradient(@toolbarHighlight@, rgba(255,255,255,0));
+}
+
+#navigator-toolbox[tabsontop="true"] > #nav-bar:not(:-moz-lwtheme),
+#navigator-toolbox[tabsontop="true"]:not([customizing]) > #nav-bar[collapsed="true"] + toolbar:not(:-moz-lwtheme),
+#navigator-toolbox[tabsontop="true"]:not([customizing]) > #nav-bar[collapsed="true"] + #customToolbars + #PersonalToolbar:not(:-moz-lwtheme) {
+  border-top: 1px solid ThreeDShadow;
+}
+
+#personal-bookmarks {
+  min-height: 29px;
 }
 
 #browser-bottombox {
@@ -74,15 +103,10 @@
 }
 
 #urlbar:-moz-lwtheme:not([focused="true"]),
-.searchbar-textbox:-moz-lwtheme:not([focused="true"]),
-.tabbrowser-tab:-moz-lwtheme:not([selected="true"]) {
+.searchbar-textbox:-moz-lwtheme:not([focused="true"]) {
   opacity: .85;
 }
 
-.tabbrowser-tab:-moz-lwtheme {
-  text-shadow: none;
-}
-
 /* Places toolbar */
 toolbarbutton.bookmark-item {
   margin: 0;
@@ -1262,55 +1286,113 @@ statusbarpanel#statusbar-display {
   list-style-image: url("chrome://global/skin/icons/notloading_16.png");
 }
 
-/* Tabs */
+/* Tabstrip */
 #TabsToolbar {
-  -moz-appearance: none;
   min-height: 0;
   padding: 0;
-  -moz-box-shadow: ThreeDShadow 0 -1px inset;
 }
 
-#TabsToolbar > toolbarbutton,
-#TabsToolbar > toolbarpaletteitem > toolbarbutton,
-#TabsToolbar > #bookmarks-menu-button-container > #bookmarks-menu-button {
-  margin-bottom: 1px;
+#TabsToolbar:not(:-moz-lwtheme),
+#TabsToolbar[tabsontop="false"] {
+  background-image: -moz-linear-gradient(transparent, transparent 50%,
+                                         rgba(0,0,0,.05) 90%, rgba(0,0,0,.1));
 }
 
-.tabbrowser-tab {
-  padding: 0 2px 2px;
-  margin-bottom: 1px;
-  min-height: 25px; /* reserve space for the sometimes hidden close button */
+#tabbrowser-tabs[tabsontop="true"] > .tabbrowser-arrowscrollbox > scrollbox:not(:-moz-lwtheme) {
+  padding-bottom: 1px;
+  margin-bottom: -1px;
+  position: relative;
+}
+
+#tabbrowser-tabs[tabsontop="true"] > .tabbrowser-tab[selected="true"]:not(:-moz-lwtheme) {
+  margin-bottom: -1px;
+  padding-bottom: 1px;
+}
+
+.tabbrowser-tab,
+.tabs-newtab-button {
+  position: static;
+  -moz-appearance: none;
+  background: -moz-linear-gradient(hsla(0,0%,100%,.3), hsla(0,0%,50%,.1) 2px, hsla(0,0%,37%,.1) 50%);
+  background-position: -5px -2px;
+  background-repeat: no-repeat;
+  background-size: 200%;
+  margin: 0;
+  padding: 0;
+  -moz-border-image: url(tabbrowser/tab.png) 4 5 3 6 / 4px 5px 3px 6px;
+  -moz-border-radius: 10px 8px 0 0;
+  min-height: 27px; /* reserve space for the sometimes hidden close button */
+}
+
+.tabbrowser-tab:hover,
+.tabs-newtab-button:hover {
+  background-image: -moz-linear-gradient(hsla(0,0%,100%,.6), hsla(0,0%,100%,.4) 2px, hsla(0,0%,75%,.4) 50%);
 }
 
 .tabbrowser-tab[selected="true"] {
-  margin-bottom: 0;
-  padding-top: 2px; /* compensates the top margin of background tabs */
-  padding-bottom: 3px; /* compensates the bottom margin of background tabs */
-  min-height: 28px;
+  background-image: -moz-linear-gradient(rgba(255,255,255,.8), rgba(255,255,255,.5) 2px, @toolbarHighlight@ 20%),
+                    -moz-linear-gradient(-moz-dialog, -moz-dialog);
+}
+
+.tabbrowser-tab:-moz-lwtheme {
+  color: inherit;
+}
+
+.tabbrowser-tab[selected="true"]:-moz-lwtheme {
+  background-image: -moz-linear-gradient(rgba(255,255,255,.8), rgba(255,255,255,.5) 2px, @toolbarHighlight@ 20%);
+}
+
+.tabbrowser-tab:-moz-lwtheme-brighttext:not([selected="true"]),
+.tabs-newtab-button:-moz-lwtheme-brighttext {
+  background-image: -moz-linear-gradient(hsla(0,0%,60%,.6), hsla(0,0%,40%,.6) 2px, hsla(0,0%,30%,.6) 50%);
+}
+
+.tabbrowser-tab:-moz-lwtheme-brighttext:not([selected="true"]):hover,
+.tabs-newtab-button:-moz-lwtheme-brighttext:hover {
+  background-image: -moz-linear-gradient(hsla(0,0%,80%,.6), hsla(0,0%,60%,.6) 2px, hsla(0,0%,45%,.6) 50%);
+}
+
+.tabbrowser-tab:-moz-lwtheme-darktext:not([selected="true"]),
+.tabs-newtab-button:-moz-lwtheme-darktext {
+  background-image: -moz-linear-gradient(hsla(0,0%,100%,.5), hsla(0,0%,60%,.5) 2px, hsla(0,0%,45%,.5) 50%);
+}
+
+.tabbrowser-tab:-moz-lwtheme-darktext:not([selected="true"]):hover,
+.tabs-newtab-button:-moz-lwtheme-darktext:hover {
+  background-image: -moz-linear-gradient(hsla(0,0%,100%,.5), hsla(0,0%,80%,.5) 2px, hsla(0,0%,60%,.5) 50%);
+}
+
+.tabbrowser-tab[pinned][titlechanged]:not([selected="true"]) {
+  background-image: -moz-linear-gradient(rgba(255,0,0,.5), rgba(255,0,0,.5)) !important;
 }
 
 .tabbrowser-tab[pinned] {
   min-height: 20px; /* corresponds to the max. height of non-textual tab contents, i.e. the tab close button */
 }
 
-.tabbrowser-tab[pinned] + .tabbrowser-tab:not([pinned]) {
-  -moz-margin-start: 0;
+.tabbrowser-tab > .tab-text {
+  border: 1px dotted transparent;
+  margin: -1px !important; /* let the border not consume any space, like outline */
 }
 
-.tabbrowser-tab[pinned][titlechanged]:not([selected="true"]) {
-  -moz-box-shadow: 0 0 0 1em rgba(255,0,0,.5) inset;
+.tabbrowser-tab:focus > .tab-text {
+  border: 1px dotted -moz-DialogText;
+}
+
+.tabbrowser-tab[pinned]:focus > .tab-icon-image {
+  outline: 1px dotted;
 }
 
 .tab-icon-image {
   width: 16px;
   height: 16px;
-  -moz-margin-start: 1px;
-  -moz-margin-end: 4px;
+  -moz-margin-end: 3px;
   list-style-image: url("chrome://global/skin/icons/folder-item.png");
   -moz-image-region: rect(0px, 16px, 16px, 0px);
 }
 
-.tabbrowser-tab[pinned] > .tab-icon-image {
+.tabbrowser-tab[pinned] > .tab-icon-image,
+.tabs-newtab-button > .toolbarbutton-icon {
   -moz-margin-start: 2px;
   -moz-margin-end: 2px;
 }
@@ -1390,24 +1472,19 @@ statusbarpanel#statusbar-display {
   -moz-user-focus: normal;
 }
 
-.tab-close-button:focus {
-  outline: none !important;
-}
-
 /* Tabstrip new tab button */
 .tabs-newtab-button,
 #TabsToolbar > #new-tab-button ,
 #TabsToolbar > #wrapper-new-tab-button > #new-tab-button {
   list-style-image: url("moz-icon://stock/gtk-add?size=menu");
   -moz-image-region: auto;
+}
+
+#TabsToolbar > #new-tab-button,
+#TabsToolbar > #wrapper-new-tab-button > #new-tab-button {
   margin-bottom: 1px;
 }
 
-.tabs-newtab-button {
-  width: 32px;
-}
-
-.tabs-newtab-button > .toolbarbutton-icon,
 #TabsToolbar > #new-tab-button > .toolbarbutton-icon,
 #TabsToolbar > #wrapper-new-tab-button > #new-tab-button > .toolbarbutton-icon {
   margin-top: -2px;
diff --git a/browser/themes/gnomestripe/browser/jar.mn b/browser/themes/gnomestripe/browser/jar.mn
index 6fb08700dcb0..0b3516bab4f1 100644
--- a/browser/themes/gnomestripe/browser/jar.mn
+++ b/browser/themes/gnomestripe/browser/jar.mn
@@ -74,6 +74,7 @@ browser.jar:
   skin/classic/browser/tabbrowser/alltabs.png          (tabbrowser/alltabs.png)
   skin/classic/browser/tabbrowser/progress.png         (tabbrowser/progress.png)
   skin/classic/browser/tabbrowser/progress-pulsing.png (tabbrowser/progress-pulsing.png)
+  skin/classic/browser/tabbrowser/tab.png             (tabbrowser/tab.png)
   skin/classic/browser/tabbrowser/tabDragIndicator.png (tabbrowser/tabDragIndicator.png)
   skin/classic/browser/tabview/edit-light.png         (tabview/edit-light.png)
   skin/classic/browser/tabview/edit.png               (tabview/edit.png)
diff --git a/browser/themes/gnomestripe/browser/tabbrowser/tab.png b/browser/themes/gnomestripe/browser/tabbrowser/tab.png
new file mode 100644
index 0000000000000000000000000000000000000000..48bcf03d41a520846715c614358f56234be5c676
GIT binary patch
literal 411
zcmV;M0c8G(P)<h;3K|Lk000e1NJLTq000aC000*V1^@s6KV+`I0000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBUzJxN4CRCwCFl1)y8KoEtYY2sgkNMdvW
zF%mP;H3#qrY&i*6;67e}oflwdLf8-!F)=eyl!*-ZiYby_I5Uh3EBVrNSG}&Hx^!)A
zIuO8M1fTVw11qM}*&)FJxBw0~Rs^5m4ZMKmc<Uj!vu*n-Ns_iGijThUYg%bf=j5k2
zy5$I5<M1-evbpQJHTGZN8<^xT%km@$0;j5~XM+W|aU3tgFkImKo$J+jU0RmaHBF<X
zX?ji>&cJ=1=TE-x&y`@+3}mrA&zni^h>749YpeZkElMSyDU~j*xP_aH{Bq17Ie43(
z8wEPIwr4gO`3$wBy)#S^{4K*c9yBxc76HAwA(WD)*gp!yM1c^>PfyNZ>?5GIo=Pe8
zDba`<9_+?(oNC7$4YP!}SBT^+ilT=duROdo;vRnl7yyJzWY2X`E`$I8002ovPDHLk
FV1lLGt(E`)

literal 0
HcmV?d00001


From 734ad7fda89ad158f597ab29fc869ee1afeca5d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Sat, 4 Sep 2010 10:59:43 +0200
Subject: [PATCH 136/222] Bug 575056 - Background tabs should be more opaque.
 r=gavin a=blocking

---
 browser/themes/winstripe/browser/browser-aero.css | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/browser/themes/winstripe/browser/browser-aero.css b/browser/themes/winstripe/browser/browser-aero.css
index a71dff297223..6c278dd62730 100644
--- a/browser/themes/winstripe/browser/browser-aero.css
+++ b/browser/themes/winstripe/browser/browser-aero.css
@@ -88,13 +88,13 @@
 
   .tabbrowser-tab:not(:-moz-lwtheme):not([selected="true"]),
   .tabs-newtab-button:not(:-moz-lwtheme) {
-    background-image: -moz-linear-gradient(hsla(0,0%,100%,.4), hsla(0,0%,75%,.4) 50%);
+    background-image: -moz-linear-gradient(hsla(214,15%,80%,.8), hsla(214,15%,65%,.8) 50%);
     text-shadow: 0 1px 0 rgba(255,255,255,.4);
   }
 
   .tabbrowser-tab:not(:-moz-lwtheme):not([selected="true"]):hover,
   .tabs-newtab-button:not(:-moz-lwtheme):hover {
-    background-image: -moz-linear-gradient(hsla(0,0%,100%,.6), hsla(0,0%,75%,.6) 50%);
+    background-image: -moz-linear-gradient(hsla(214,15%,90%,.8), hsla(214,15%,75%,.8) 50%);
   }
 
   #allTabs-panel,

From 295632f66ae242bef0b5f851762f16fc117ac5eb Mon Sep 17 00:00:00 2001
From: Kurt Schultz <supernova00@gmail.com>
Date: Fri, 3 Sep 2010 06:09:46 -0400
Subject: [PATCH 137/222] Bug 592908 - Update the text 'Organize Bookmarks' in
 the Firefox menu. r=dao

---
 browser/base/content/browser-menubar.inc         | 2 +-
 browser/base/content/browser.xul                 | 6 +++---
 browser/locales/en-US/chrome/browser/browser.dtd | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/browser/base/content/browser-menubar.inc b/browser/base/content/browser-menubar.inc
index 50958acac2d5..09fd85e022d3 100644
--- a/browser/base/content/browser-menubar.inc
+++ b/browser/base/content/browser-menubar.inc
@@ -573,7 +573,7 @@
                 command="Browser:BookmarkAllTabs"
                 key="bookmarkAllTabsKb"/>
       <menuitem id="bookmarksShowAll"
-                label="&organizeBookmarks.label;"
+                label="&showAllBookmarks.label;"
                 command="Browser:ShowAllBookmarks"
                 key="manBookmarkKb"/>
       <menuseparator id="organizeBookmarksSeparator"/>
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index 540a67827275..01a64566a9dd 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -593,8 +593,8 @@
                           label="&appMenuUnsorted.label;"
                           oncommand="PlacesCommandHook.showPlacesOrganizer('UnfiledBookmarks');"
                           class="menuitem-iconic"/>
-                <menuitem id="appmenu_organizeBookmarks"
-                          label="&organizeBookmarks.label;"
+                <menuitem id="appmenu_showAllBookmarks"
+                          label="&showAllBookmarks.label;"
                           key="manBookmarkKb"
                           command="Browser:ShowAllBookmarks"
                           context=""/>
@@ -959,7 +959,7 @@
                       command="Browser:BookmarkAllTabs"
                       key="bookmarkAllTabsKb"/>
             <menuitem id="BMB_bookmarksShowAll"
-                      label="&organizeBookmarks.label;"
+                      label="&showAllBookmarks.label;"
                       command="Browser:ShowAllBookmarks"
                       key="manBookmarkKb"/>
             <menuseparator/>
diff --git a/browser/locales/en-US/chrome/browser/browser.dtd b/browser/locales/en-US/chrome/browser/browser.dtd
index f578283db14a..57b6974e1afa 100644
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@@ -97,7 +97,7 @@
 <!ENTITY subscribeToPageMenupopup.label "Subscribe to This Page">
 <!ENTITY subscribeToPageMenuitem.label "Subscribe to This Page…">
 <!ENTITY addCurPagesCmd.label "Bookmark All Tabs…">
-<!ENTITY organizeBookmarks.label "Organize Bookmarks…">
+<!ENTITY showAllBookmarks.label "Show All Bookmarks…">
 <!ENTITY bookmarkAllCmd.label "Bookmark All Tabs…">
 <!ENTITY bookmarksToolbarChevron.tooltip "Show more bookmarks">
 

From 3d65ece5086364122326d92870aacff908fa9d34 Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Sat, 4 Sep 2010 13:38:07 +0200
Subject: [PATCH 138/222] Bug 592827 - Implement
 DOMImplementation.createHTMLDocument; r=jonas approval2.0=jonas

---
 content/base/src/nsDocument.cpp               | 83 +++++++++++++++++++
 content/base/test/Makefile.in                 |  1 +
 .../base/test/test_createHTMLDocument.html    | 48 +++++++++++
 .../core/nsIDOMDOMImplementation.idl          | 12 ++-
 js/src/xpconnect/src/dom_quickstubs.qsconf    |  1 +
 5 files changed, 144 insertions(+), 1 deletion(-)
 create mode 100644 content/base/test/test_createHTMLDocument.html

diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index dab8ac14b72d..1b84f1a27f5d 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -201,6 +201,8 @@ static NS_DEFINE_CID(kDOMEventGroupCID, NS_DOMEVENTGROUP_CID);
 #include "nsHTMLCSSStyleSheet.h"
 
 #include "mozilla/dom/Link.h"
+#include "nsIHTMLDocument.h"
+
 using namespace mozilla::dom;
 
 
@@ -1435,6 +1437,87 @@ nsDOMImplementation::CreateDocument(const nsAString& aNamespaceURI,
                                         scriptHandlingObject, aReturn);
 }
 
+NS_IMETHODIMP
+nsDOMImplementation::CreateHTMLDocument(const nsAString& aTitle,
+                                        nsIDOMDocument** aReturn)
+{
+  *aReturn = NULL;
+
+  nsCOMPtr<nsIDocument> doc;
+  nsresult rv = NS_NewHTMLDocument(getter_AddRefs(doc));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIHTMLDocument> HTMLdoc = do_QueryInterface(doc);
+  HTMLdoc->SetCompatibilityMode(eCompatibility_FullStandards);
+
+  nsCOMPtr<nsIDOMDocumentType> doctype;
+  // Indicate that there is no internal subset (not just an empty one)
+  nsAutoString voidString;
+  voidString.SetIsVoid(true);
+  rv = NS_NewDOMDocumentType(getter_AddRefs(doctype),
+                             NULL, // aNodeInfoManager
+                             mPrincipal, // aPrincipal
+                             nsGkAtoms::html, // aName
+                             NULL, // aEntities
+                             NULL, // aNotations
+                             EmptyString(), // aPublicId
+                             EmptyString(), // aSystemId
+                             voidString); // aInternalSubset
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIContent> doctypeAsContent = do_QueryInterface(doctype);
+  rv = doc->AppendChildTo(doctypeAsContent, false);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIContent> root;
+  rv = doc->CreateElem(NS_LITERAL_STRING("html"), NULL, kNameSpaceID_XHTML,
+                       false, getter_AddRefs(root));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = doc->AppendChildTo(root, false);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIContent> head;
+  rv = doc->CreateElem(NS_LITERAL_STRING("head"), NULL, kNameSpaceID_XHTML,
+                       false, getter_AddRefs(head));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = root->AppendChildTo(head, false);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIContent> title;
+  rv = doc->CreateElem(NS_LITERAL_STRING("title"), NULL, kNameSpaceID_XHTML,
+                       false, getter_AddRefs(title));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = head->AppendChildTo(title, false);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIContent> titleText;
+  rv = NS_NewTextNode(getter_AddRefs(titleText), doc->NodeInfoManager());
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = titleText->SetText(aTitle, false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = title->AppendChildTo(titleText, false);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIContent> body;
+  rv = doc->CreateElem(NS_LITERAL_STRING("body"), NULL, kNameSpaceID_XHTML,
+                       false, getter_AddRefs(body));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = root->AppendChildTo(body, false);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIScriptGlobalObject> scriptHandlingObject =
+    do_QueryReferent(mScriptObject);
+  doc->SetScriptHandlingObject(scriptHandlingObject);
+
+  // created documents are immediately "complete" (ready to use)
+  doc->SetReadyStateInternal(nsIDocument::READYSTATE_COMPLETE);
+
+  nsCOMPtr<nsIDOMDocument> document = do_QueryInterface(doc);
+  document.forget(aReturn);
+
+  return NS_OK;
+}
+
 // ==================================================================
 // =
 // ==================================================================
diff --git a/content/base/test/Makefile.in b/content/base/test/Makefile.in
index 9e7cc91ca35c..e94dd36b44b5 100644
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -413,6 +413,7 @@ _TEST_FILES2 = \
 		test_x-frame-options.html \
 		file_x-frame-options_main.html \
 		file_x-frame-options_page.sjs \
+		test_createHTMLDocument.html \
 		$(NULL)
 
 # This test fails on the Mac for some reason
diff --git a/content/base/test/test_createHTMLDocument.html b/content/base/test/test_createHTMLDocument.html
new file mode 100644
index 000000000000..6e81eeef59f0
--- /dev/null
+++ b/content/base/test/test_createHTMLDocument.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<title>createHTMLDocument</title>
+<script src="/MochiKit/packed.js"></script>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" href="/tests/SimpleTest/test.css" />
+<link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
+<link rel="help" href="http://www.whatwg.org/html5/#creating-documents">
+<link rel="help" href="http://www.whatwg.org/html5/#document.title">
+<link rel="help" href="http://www.whatwg.org/html5/#dom-document-readystate">
+<body>
+<script>
+function isElement(element, localName) {
+  is(element.localName, localName);
+  is(element.namespaceURI, "http://www.w3.org/1999/xhtml");
+  is(element.tagName, localName.toUpperCase());
+  is(element.nodeName, localName.toUpperCase());
+  is(element.prefix, null);
+}
+function checkDoc(title, expectedtitle, normalizedtitle) {
+  var doc = document.implementation.createHTMLDocument(title);
+  is(doc.readyState, "complete");
+  is(doc.compatMode, "CSS1Compat");
+  // Opera doesn't have a doctype: DSK-311092
+  ok(doc.doctype, "Need a doctype");
+  is(doc.doctype.name, "html");
+  is(doc.doctype.publicId, "");
+  is(doc.doctype.systemId, "");
+  isElement(doc.documentElement, "html");
+  isElement(doc.documentElement.firstChild, "head");
+  is(doc.documentElement.firstChild.childNodes.length, 1);
+  isElement(doc.documentElement.firstChild.firstChild, "title");
+  // Doesn't always work out in WebKit.
+  ok(doc.documentElement.firstChild.firstChild.firstChild, "Need a text node.");
+  is(doc.documentElement.firstChild.firstChild.firstChild.data, expectedtitle);
+  isElement(doc.documentElement.lastChild, "body");
+  is(doc.documentElement.lastChild.childNodes.length, 0);
+  ((!title || title.indexOf("\f") === -1) ? is : todo_is)
+    (doc.title, normalizedtitle);
+}
+checkDoc("", "", "");
+checkDoc(null, "null", "null");
+checkDoc(undefined, "undefined", "undefined");
+checkDoc("foo  bar baz", "foo  bar baz", "foo bar baz");
+checkDoc("foo\t\tbar baz", "foo\t\tbar baz", "foo bar baz");
+checkDoc("foo\n\nbar baz", "foo\n\nbar baz", "foo bar baz");
+checkDoc("foo\f\fbar baz", "foo\f\fbar baz", "foo bar baz");
+checkDoc("foo\r\rbar baz", "foo\r\rbar baz", "foo bar baz");
+</script>
diff --git a/dom/interfaces/core/nsIDOMDOMImplementation.idl b/dom/interfaces/core/nsIDOMDOMImplementation.idl
index 2a26a8e80d7f..529f81b4576d 100644
--- a/dom/interfaces/core/nsIDOMDOMImplementation.idl
+++ b/dom/interfaces/core/nsIDOMDOMImplementation.idl
@@ -48,7 +48,7 @@
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, uuid(a6cf9074-15b3-11d2-932e-00805f8add32)]
+[scriptable, uuid(03a6f574-99ec-42f8-9e6c-812a4a9bcbf7)]
 interface nsIDOMDOMImplementation : nsISupports
 {
   boolean                   hasFeature(in DOMString feature, 
@@ -63,4 +63,14 @@ interface nsIDOMDOMImplementation : nsISupports
                                            in DOMString qualifiedName,
                                            in nsIDOMDocumentType doctype)
                                   raises(DOMException);
+
+  /**
+   * Returns an HTML document with a basic DOM already constructed and with an
+   * appropriate title element.
+   *
+   * @param title the title of the Document
+   * @see <http://www.whatwg.org/html/#creating-documents>
+   */
+  nsIDOMDocument            createHTMLDocument([Null(Stringify)]
+                                               in DOMString title);
 };
diff --git a/js/src/xpconnect/src/dom_quickstubs.qsconf b/js/src/xpconnect/src/dom_quickstubs.qsconf
index e70e973b616c..7a17ad23ce2d 100644
--- a/js/src/xpconnect/src/dom_quickstubs.qsconf
+++ b/js/src/xpconnect/src/dom_quickstubs.qsconf
@@ -148,6 +148,7 @@ members = [
     'nsIDOM3Document.adoptNode',
     'nsIDOM3Document.renameNode',
     'nsIDOM3Node.*',
+    'nsIDOMDOMImplementation.*',
     'nsIDOMDOMStringList.*',
     'nsIDOMDOMTokenList.*',
     'nsIDOMDOMSettableTokenList.*',

From 5b41ca7297f7a9112ef5006a15bd3d87b57f9245 Mon Sep 17 00:00:00 2001
From: Blair McBride <bmcbride@mozilla.com>
Date: Sat, 28 Aug 2010 14:45:11 +1200
Subject: [PATCH 139/222] Bug 581076 - No "See all results" link present when
 searching for add-ons and not all are displayed
 (extensions.getAddons.maxResults). r=dtownsend, a=blocking-beta6

---
 browser/app/profile/firefox.js                |   5 +-
 .../mozapps/extensions/extensions.properties  |   3 +
 .../mozapps/extensions/content/extensions.css |   3 +-
 .../mozapps/extensions/content/extensions.js  |  39 +++++-
 .../mozapps/extensions/content/extensions.xul |  19 +--
 .../extensions/test/browser/Makefile.in       |   1 +
 .../test/browser/browser_bug581076.js         | 121 ++++++++++++++++++
 .../test/xpcshell/test_AddonRepository.js     |   2 +-
 .../mozapps/extensions/extensions.css         |   5 +
 .../mozapps/extensions/extensions.css         |   5 +
 .../mozapps/extensions/extensions.css         |   5 +
 11 files changed, 189 insertions(+), 19 deletions(-)
 create mode 100644 toolkit/mozapps/extensions/test/browser/browser_bug581076.js

diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index 1e87d4b0c061..5e9be6cb28f2 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -56,13 +56,12 @@ pref("browser.hiddenWindowChromeURL", "chrome://browser/content/hiddenWindow.xul
 // Enables some extra Extension System Logging (can reduce performance)
 pref("extensions.logging.enabled", false);
 
-// Preferences for the Addon Repository
+// Preferences for AMO integration
 pref("extensions.getAddons.cache.enabled", true);
 pref("extensions.getAddons.maxResults", 15);
 pref("extensions.getAddons.get.url", "https://services.addons.mozilla.org/%LOCALE%/%APP%/api/%API_VERSION%/search/guid:%IDS%");
+pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/%APP%/search?q=%TERMS%");
 pref("extensions.getAddons.search.url", "https://services.addons.mozilla.org/%LOCALE%/%APP%/api/%API_VERSION%/search/%TERMS%/all/%MAX_RESULTS%/%OS%/%VERSION%");
-
-// Preferences for AMO integration
 pref("extensions.webservice.discoverURL", "https://services.addons.mozilla.org/%LOCALE%/%APP%/discovery/%VERSION%/%OS%");
 
 // Blocklist preferences
diff --git a/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties b/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties
index 236e9e7e00af..87e0ef424460 100644
--- a/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties
+++ b/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties
@@ -81,3 +81,6 @@ enableAddonTooltip=Enable this add-on
 enableAddonRestartRequiredTooltip=Enable this add-on (restart required)
 disableAddonTooltip=Disable this add-on
 disableAddonRestartRequiredTooltip=Disable this add-on (restart required)
+
+#LOCALIZATION NOTE (showAllSearchResults) #1 is the total number of search results
+showAllSearchResults=See one result;See all #1 results
diff --git a/toolkit/mozapps/extensions/content/extensions.css b/toolkit/mozapps/extensions/content/extensions.css
index e1eedb3a4f8c..29d4b9cdf2b6 100644
--- a/toolkit/mozapps/extensions/content/extensions.css
+++ b/toolkit/mozapps/extensions/content/extensions.css
@@ -115,7 +115,8 @@ xhtml|link {
 #detail-view:not([upgrade="true"]) .update-postfix,
 #detail-view[active="true"] .disabled-postfix,
 #detail-view[loading] > .detail-view-container,
-.detail-row:not([value]) {
+.detail-row:not([value]),
+#search-list[remote="false"] #search-allresults-link {
   display: none;
 }
 
diff --git a/toolkit/mozapps/extensions/content/extensions.js b/toolkit/mozapps/extensions/content/extensions.js
index fb081a164160..5ecbe0ded0ad 100644
--- a/toolkit/mozapps/extensions/content/extensions.js
+++ b/toolkit/mozapps/extensions/content/extensions.js
@@ -1201,7 +1201,9 @@ var gSearchView = {
   _sorters: null,
   _listBox: null,
   _emptyNotice: null,
+  _allResultsLink: null,
   _lastQuery: null,
+  _lastRemoteTotal: 0,
   _pendingSearches: 0,
 
   initialize: function() {
@@ -1211,6 +1213,7 @@ var gSearchView = {
     this._sorters.handler = this;
     this._listBox = document.getElementById("search-list");
     this._emptyNotice = document.getElementById("search-list-empty");
+    this._allResultsLink = document.getElementById("search-allresults-link");
 
     var self = this;
     this._listBox.addEventListener("keydown", function(aEvent) {
@@ -1237,6 +1240,7 @@ var gSearchView = {
   show: function(aQuery, aRequest) {
     gHeader.isSearching = true;
     this.showEmptyNotice(false);
+    this.showAllResultsLink(0);
 
     gHeader.searchQuery = aQuery;
     aQuery = aQuery.trim().toLocaleLowerCase();
@@ -1250,8 +1254,8 @@ var gSearchView = {
     if (AddonRepository.isSearching)
       AddonRepository.cancelSearch();
 
-    while (this._listBox.lastChild.localName == "richlistitem")
-      this._listBox.removeChild(this._listBox.lastChild);
+    while (this._listBox.firstChild.localName == "richlistitem")
+      this._listBox.removeChild(this._listBox.firstChild);
 
     var self = this;
     gCachedAddons = {};
@@ -1273,7 +1277,7 @@ var gSearchView = {
         if (aIsRemote)
           gCachedAddons[aObj.id] = aObj;
 
-        self._listBox.appendChild(item);
+        self._listBox.insertBefore(item, self._listBox.lastChild);
         createdCount++;
       });
 
@@ -1315,6 +1319,8 @@ var gSearchView = {
         if (gViewController && aRequest != gViewController.currentViewRequest)
           return;
 
+        self._lastRemoteTotal = 0;
+
         // XXXunf Better handling of AMO search failure. See bug 579502
         finishSearch(0); // Silently fail
       },
@@ -1323,6 +1329,11 @@ var gSearchView = {
         if (gViewController && aRequest != gViewController.currentViewRequest)
           return;
 
+        if (aTotalResults > maxRemoteResults)
+          self._lastRemoteTotal = aTotalResults;
+        else
+          self._lastRemoteTotal = 0;
+
         var createdCount = createSearchResults(aAddonsList, false, true);
         finishSearch(createdCount);
       }
@@ -1347,6 +1358,7 @@ var gSearchView = {
       }
 
       this.showEmptyNotice(isEmpty);
+      this.showAllResultsLink(this._lastRemoteTotal);
     }
 
     gViewController.updateCommands();
@@ -1407,9 +1419,24 @@ var gSearchView = {
     this._emptyNotice.hidden = !aShow;
   },
 
+  showAllResultsLink: function(aTotalResults) {
+    if (aTotalResults == 0) {
+      this._allResultsLink.hidden = true;
+      return;
+    }
+
+    var linkStr = gStrings.ext.GetStringFromName("showAllSearchResults");
+    linkStr = PluralForm.get(aTotalResults, linkStr);
+    linkStr = linkStr.replace("#1", aTotalResults);
+    this._allResultsLink.value = linkStr;
+
+    this._allResultsLink.href = AddonRepository.getSearchURL(this._lastQuery);
+    this._allResultsLink.hidden = false;
+ },
+
   onSortChanged: function(aSortBy, aAscending) {
-    var header = this._listBox.firstChild;
-    this._listBox.removeChild(header);
+    var footer = this._listBox.lastChild;
+    this._listBox.removeChild(footer);
 
     var hints = aAscending ? "ascending" : "descending";
     if (INTEGER_FIELDS.indexOf(aSortBy) >= 0)
@@ -1419,7 +1446,7 @@ var gSearchView = {
                       getService(Ci.nsIXULSortService);
     sortService.sort(this._listBox, aSortBy, hints);
 
-    this._listBox.insertBefore(header, this._listBox.firstChild);
+    this._listBox.appendChild(footer);
   },
 
   getSelectedAddon: function() {
diff --git a/toolkit/mozapps/extensions/content/extensions.xul b/toolkit/mozapps/extensions/content/extensions.xul
index 5ab0bc60d40e..0734c5ea4e1e 100644
--- a/toolkit/mozapps/extensions/content/extensions.xul
+++ b/toolkit/mozapps/extensions/content/extensions.xul
@@ -238,15 +238,18 @@
             <hbox id="search-sorters" class="sort-controls"
                   showrelevance="true" sortby="relevancescore" ascending="false"/>
           </hbox>
+          <vbox id="search-list-empty" class="empty-list-notice"
+                flex="1" hidden="true">
+            <spacer flex="1"/>
+            <label value="&listEmpty.search.label;"/>
+            <button label="&listEmpty.button.label;" class="addon-control"
+                    command="cmd_goToDiscoverPane"/>
+            <spacer flex="3"/>
+          </vbox>
           <richlistbox id="search-list" class="list" flex="1">
-            <vbox id="search-list-empty" class="empty-list-notice"
-                  flex="1" hidden="true">
-              <spacer flex="1"/>
-              <label value="&listEmpty.search.label;"/>
-              <button label="&listEmpty.button.label;" class="addon-control"
-                      command="cmd_goToDiscoverPane"/>
-              <spacer flex="3"/>
-            </vbox>
+            <hbox pack="center">
+              <label id="search-allresults-link" class="text-link"/>
+            </hbox>
           </richlistbox>
         </vbox>
 
diff --git a/toolkit/mozapps/extensions/test/browser/Makefile.in b/toolkit/mozapps/extensions/test/browser/Makefile.in
index dc830406dd98..f261120fe2a3 100644
--- a/toolkit/mozapps/extensions/test/browser/Makefile.in
+++ b/toolkit/mozapps/extensions/test/browser/Makefile.in
@@ -60,6 +60,7 @@ _TEST_FILES = \
   browser_bug567137.js \
   browser_bug572561.js \
   browser_bug577990.js \
+  browser_bug581076.js \
   browser_details.js \
   browser_dragdrop.js \
   browser_list.js \
diff --git a/toolkit/mozapps/extensions/test/browser/browser_bug581076.js b/toolkit/mozapps/extensions/test/browser/browser_bug581076.js
new file mode 100644
index 000000000000..c02c8491fa8e
--- /dev/null
+++ b/toolkit/mozapps/extensions/test/browser/browser_bug581076.js
@@ -0,0 +1,121 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+// Bug 581076 - No "See all results" link present when searching for add-ons and not all are displayed (extensions.getAddons.maxResults)
+
+const PREF_GETADDONS_BROWSESEARCHRESULTS = "extensions.getAddons.search.browseURL";
+const PREF_GETADDONS_GETSEARCHRESULTS = "extensions.getAddons.search.url";
+const PREF_GETADDONS_MAXRESULTS = "extensions.getAddons.maxResults";
+const SEARCH_URL = TESTROOT + "browser_searching.xml";
+const SEARCH_EXPECTED_TOTAL = 100;
+const SEARCH_QUERY = "search";
+
+var gManagerWindow;
+
+
+function test() {
+  Services.prefs.setCharPref(PREF_GETADDONS_GETSEARCHRESULTS, SEARCH_URL);
+  Services.prefs.setIntPref(PREF_SEARCH_MAXRESULTS, 15);
+
+  waitForExplicitFinish();
+
+  open_manager(null, function(aWindow) {
+    gManagerWindow = aWindow;
+    run_next_test();
+  });
+}
+
+function end_test() {
+  Services.prefs.clearUserPref(PREF_GETADDONS_GETSEARCHRESULTS);
+  close_manager(gManagerWindow, finish);
+}
+
+function search(aRemoteSearch, aCallback) {
+  var searchBox = gManagerWindow.document.getElementById("header-search");
+  searchBox.value = SEARCH_QUERY;
+
+  EventUtils.synthesizeMouse(searchBox, 2, 2, { }, gManagerWindow);
+  EventUtils.synthesizeKey("VK_RETURN", { }, gManagerWindow);
+
+  wait_for_view_load(gManagerWindow, function() {
+    if (aRemoteSearch)
+      var filter = gManagerWindow.document.getElementById("search-filter-remote");
+    else
+      var filter = gManagerWindow.document.getElementById("search-filter-local");
+    EventUtils.synthesizeMouse(filter, 2, 2, { }, gManagerWindow);
+
+    executeSoon(aCallback);
+  });
+}
+
+function check_allresultslink(aShouldShow) {
+  var list = gManagerWindow.document.getElementById("search-list");
+  var link = gManagerWindow.document.getElementById("search-allresults-link");
+  is(link.parentNode, list.lastChild, "Footer should be at the end of the richlistbox");
+  if (aShouldShow) {
+    is_element_visible(link, "All Results link should be visible");
+    is(link.value, "See all " + SEARCH_EXPECTED_TOTAL + " results", "All Results link should show the correct message");
+    var scope = {};
+    Components.utils.import("resource://gre/modules/AddonRepository.jsm", scope);
+    is(link.href, scope.AddonRepository.getSearchURL(SEARCH_QUERY), "All Results link should have the correct href");
+  } else {
+    is_element_hidden(link, "All Results link should be hidden");
+  }
+}
+
+add_test(function() {
+  info("Searching locally");
+  search(false, function() {
+    check_allresultslink(false);
+    restart_manager(gManagerWindow, null, function(aManager) {
+      gManagerWindow = aManager;
+      run_next_test();
+    });
+  });
+});
+
+add_test(function() {
+  info("Searching remotely - more results than cap");
+  Services.prefs.setIntPref(PREF_GETADDONS_MAXRESULTS, 3);
+  search(true, function() {
+    check_allresultslink(true);
+    restart_manager(gManagerWindow, null, function(aManager) {
+      gManagerWindow = aManager;
+      run_next_test();
+    });
+  });
+});
+
+add_test(function() {
+  info("Searching remotely - less results than cap");
+  Services.prefs.setIntPref(PREF_GETADDONS_MAXRESULTS, 200);
+  search(true, function() {
+    check_allresultslink(false);
+    restart_manager(gManagerWindow, null, function(aManager) {
+      gManagerWindow = aManager;
+      run_next_test();
+    });
+  });
+});
+
+add_test(function() {
+  info("Searching remotely - more results than cap");
+  Services.prefs.setIntPref(PREF_GETADDONS_MAXRESULTS, 3);
+  search(true, function() {
+    check_allresultslink(true);
+    run_next_test();
+  });
+});
+
+add_test(function() {
+  info("Switching views");
+  gManagerWindow.loadView("addons://list/extension");
+  wait_for_view_load(gManagerWindow, function() {
+    info("Re-loading previous search");
+    search(true, function() {
+      check_allresultslink(true);
+      run_next_test();
+    });
+  });
+});
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_AddonRepository.js b/toolkit/mozapps/extensions/test/xpcshell/test_AddonRepository.js
index 286af23a9627..cc1fee56d089 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_AddonRepository.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_AddonRepository.js
@@ -389,7 +389,7 @@ function run_test_1() {
     urlTests:           urlTests,
     getURL:             function() AddonRepository.getRecommendedURL()
   }, {
-    initiallyUndefined: true,
+    initiallyUndefined: false,
     preference:         PREF_GETADDONS_BROWSESEARCHRESULTS,
     urlTests:           urlTests.concat(searchURLTests),
     getURL:             function getSearchURL(aTest) {
diff --git a/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css b/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
index 966e7c7786fb..eb68a977ad69 100644
--- a/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
@@ -507,6 +507,11 @@
   display: none;
 }
 
+#search-allresults-link {
+  margin-top: 1em;
+  margin-bottom: 2em;
+}
+
 /*** detail view ***/
 
 #detail-view[active="false"] .fade {
diff --git a/toolkit/themes/pinstripe/mozapps/extensions/extensions.css b/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
index d77bb282db1a..ef5c6fe18f3f 100644
--- a/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
@@ -531,6 +531,11 @@
   display: none;
 }
 
+#search-allresults-link {
+  margin-top: 1em;
+  margin-bottom: 2em;
+}
+
 /*** detail view ***/
 
 #detail-view[active="false"] .fade {
diff --git a/toolkit/themes/winstripe/mozapps/extensions/extensions.css b/toolkit/themes/winstripe/mozapps/extensions/extensions.css
index bb91306ec802..ae73c21de953 100644
--- a/toolkit/themes/winstripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/winstripe/mozapps/extensions/extensions.css
@@ -498,6 +498,11 @@
   display: none;
 }
 
+#search-allresults-link {
+  margin-top: 1em;
+  margin-bottom: 2em;
+}
+
 /*** detail view ***/
 
 #detail-view[active="false"] .fade {

From 931dbba2c2bf75ced0b04a7bcbd73c053091a454 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Sat, 4 Sep 2010 20:33:34 +0200
Subject: [PATCH 140/222] Bug 593447 followup, set 'crop' property instead of
 attribute. r=gavin

---
 browser/base/content/tabbrowser.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 5371fc15f455..0f2c3ceae49c 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -886,7 +886,7 @@
         <body>
           <![CDATA[
             aTab.label = this.mStringBundle.getString("tabs.loading");
-            aTab.setAttribute("crop", "end");
+            aTab.crop = "end";
             this._tabAttrModified(aTab);
           ]]>
         </body>
@@ -931,7 +931,7 @@
               return false;
 
             aTab.label = title;
-            aTab.setAttribute("crop", crop);
+            aTab.crop = crop;
             this._tabAttrModified(aTab);
             return true;
           ]]>

From 44c970e596d39715a6016431434bed751baa837e Mon Sep 17 00:00:00 2001
From: Benedict Hsieh <bhsieh@mozilla.com>
Date: Thu, 2 Sep 2010 12:09:51 -0700
Subject: [PATCH 141/222] Bug 592323 - Fastload not invalidated after making on
 OSX. r=benjamin a=blocking

---
 toolkit/xre/nsAppRunner.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index f4ce1da93ba1..3a4ff64df556 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -3356,7 +3356,7 @@ XRE_main(int argc, char* argv[], const nsXREAppData* aAppData)
      }
      flagFile = do_QueryInterface(fFlagFile);
      if (flagFile) {
-       flagFile->SetNativeLeafName(FILE_INVALIDATE_CACHES);
+       flagFile->AppendNative(FILE_INVALIDATE_CACHES);
      }
  #endif
     PRBool cachesOK;

From 8d77bd08a9ac50e31e20f2b2d8e98a0b73471791 Mon Sep 17 00:00:00 2001
From: Ian Neal <iann_cvs@blueyonder.co.uk>
Date: Sat, 4 Sep 2010 17:45:25 +0100
Subject: [PATCH 142/222] Bug 593576 - test_contextmenu.html has some
 undeclared variables following fix from bug 496832 r/a=gavin

---
 browser/base/content/test/test_contextmenu.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/browser/base/content/test/test_contextmenu.html b/browser/base/content/test/test_contextmenu.html
index de2ad4cc4475..081a244985c0 100644
--- a/browser/base/content/test/test_contextmenu.html
+++ b/browser/base/content/test/test_contextmenu.html
@@ -436,8 +436,8 @@ function runTest(testNum) {
 
 var testNum = 1;
 var subwindow, chromeWin, contextMenu;
-var text, link, mailto, input, img, canvas, video, iframe,
-    textarea, contenteditable, inputspell;
+var text, link, mailto, input, img, canvas, video_ok, video_bad, video_bad2,
+    iframe, textarea, contenteditable, inputspell;
 
 function startTest() {
     netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');

From 1af62116a2f81d777c1597e66d66ce4a431f3ef6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Sat, 4 Sep 2010 18:51:52 +0200
Subject: [PATCH 143/222] Bug 593447 - Update the title only if it actually
 changed. r=gavin

---
 browser/base/content/tabbrowser.xml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 664f8b800e87..5371fc15f455 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -926,9 +926,14 @@
                 title = this.mStringBundle.getString("tabs.emptyTabTitle");
             }
 
+            if (aTab.label == title &&
+                aTab.crop == crop)
+              return false;
+
             aTab.label = title;
             aTab.setAttribute("crop", crop);
             this._tabAttrModified(aTab);
+            return true;
           ]]>
         </body>
       </method>
@@ -2448,7 +2453,10 @@
             return;
 
           var tab = this._getTabForContentWindow(contentWin);
-          this.setTabTitle(tab);
+          var titleChanged = this.setTabTitle(tab);
+          if (!titleChanged)
+            return;
+
           if (tab == this.mCurrentTab)
             this.updateTitlebar();
           else if (!tab.hasAttribute("busy"))

From bdec71ab0e37cf5ecc9a37b447640a7d1882f6ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Sat, 4 Sep 2010 18:52:14 +0200
Subject: [PATCH 144/222] Bug 593570 - reduce the tab close button's impact on
 the tab height. r+a=gavin

---
 browser/themes/gnomestripe/browser/browser.css | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/browser/themes/gnomestripe/browser/browser.css b/browser/themes/gnomestripe/browser/browser.css
index 5a17a47a8a00..9eee69fecf94 100644
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@@ -1321,7 +1321,7 @@ statusbarpanel#statusbar-display {
   padding: 0;
   -moz-border-image: url(tabbrowser/tab.png) 4 5 3 6 / 4px 5px 3px 6px;
   -moz-border-radius: 10px 8px 0 0;
-  min-height: 27px; /* reserve space for the sometimes hidden close button */
+  min-height: 25px; /* reserve space for the sometimes hidden close button */
 }
 
 .tabbrowser-tab:hover,
@@ -1367,7 +1367,7 @@ statusbarpanel#statusbar-display {
 }
 
 .tabbrowser-tab[pinned] {
-  min-height: 20px; /* corresponds to the max. height of non-textual tab contents, i.e. the tab close button */
+  min-height: 18px; /* corresponds to the max. height of non-textual tab contents, i.e. the tab close button */
 }
 
 .tabbrowser-tab > .tab-text {
@@ -1464,6 +1464,9 @@ statusbarpanel#statusbar-display {
 .tab-close-button {
   padding: 0;
   list-style-image: url("moz-icon://stock/gtk-close?size=menu");
+  margin-top: -1px;
+  margin-bottom: -1px;
+  -moz-margin-end: -1px;
 }
 
 .tabbrowser-tab[selected="true"] > .tab-close-button {

From 1f55f20dd46dad42f41198d88df762bc53fc507b Mon Sep 17 00:00:00 2001
From: Michael Yoshitaka Erlewine <mitcho@mitcho.com>
Date: Fri, 3 Sep 2010 14:43:24 -0400
Subject: [PATCH 145/222] Bug 591167: border trenches should be triggered even
 if the edge only overlaps, but is not contained by the active range of the
 trench [r+a=dietrich]

---
 browser/base/content/tabview/modules/utils.jsm | 14 ++++++++++++++
 browser/base/content/tabview/trench.js         |  2 +-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/browser/base/content/tabview/modules/utils.jsm b/browser/base/content/tabview/modules/utils.jsm
index ee0318f81abe..7985eb1c0b10 100644
--- a/browser/base/content/tabview/modules/utils.jsm
+++ b/browser/base/content/tabview/modules/utils.jsm
@@ -322,6 +322,20 @@ Range.prototype = {
     return false;
   },
 
+  // ----------
+  // Function: overlaps
+  // Whether the <Range> overlaps with the given <Range> or value or not.
+  //
+  // Paramaters
+  //  - a number or <Range>
+  overlaps: function Rect_overlaps(value) {
+    if (Utils.isNumber(value))
+      return this.contains(value);
+    if (Utils.isRange(value))
+      return !(value.max < this.min || this.max < value.min);
+    return false;
+  },
+
   // ----------
   // Function: proportion
   // Maps the given value to the range [0,1], so that it returns 0 if the value is <= the min,
diff --git a/browser/base/content/tabview/trench.js b/browser/base/content/tabview/trench.js
index e4812ac814e2..b08ff4fef1ff 100644
--- a/browser/base/content/tabview/trench.js
+++ b/browser/base/content/tabview/trench.js
@@ -382,7 +382,7 @@ Trench.prototype = {
   ruleOverlaps: function Trench_ruleOverlaps(position, range) {
     return (this.position - this.radius < position &&
            position < this.position + this.radius &&
-           this.activeRange.contains(range));
+           this.activeRange.overlaps(range));
   },
 
   //----------

From 85b674a456d822c6ac4fbecfea5bfc4a757b9ca7 Mon Sep 17 00:00:00 2001
From: Michael Yoshitaka Erlewine <mitcho@mitcho.com>
Date: Fri, 3 Sep 2010 14:55:55 -0400
Subject: [PATCH 146/222] Bug 591705 Don't animate on tab view startup
 [r+a=dietrich]

---
 browser/base/content/tabview/groupitems.js | 81 +++++++++++++---------
 browser/base/content/tabview/items.js      |  8 +--
 browser/base/content/tabview/tabitems.js   | 56 ++++++++-------
 3 files changed, 84 insertions(+), 61 deletions(-)

diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index 62f7ddd9f9f6..4fb9ce73ef6d 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -62,7 +62,8 @@
 //   bounds - a <Rect>; otherwise based on the locations of the provided elements
 //   container - a DOM element to use as the container for this groupItem; otherwise will create
 //   title - the title for the groupItem; otherwise blank
-//   dontPush - true if this groupItem shouldn't push away on creation; default is false
+//   dontPush - true if this groupItem shouldn't push away or snap on creation; default is false
+//   immediately - true if we want all placement immediately, not with animation
 let GroupItem = function GroupItem(listOfEls, options) {
   try {
   if (typeof options == 'undefined')
@@ -110,6 +111,7 @@ let GroupItem = function GroupItem(listOfEls, options) {
   }
 
   var $container = options.container;
+  let immediately = options.immediately || $container ? true : false;
   if (!$container) {
     $container = iQ('<div>')
       .addClass('groupItem')
@@ -169,7 +171,7 @@ let GroupItem = function GroupItem(listOfEls, options) {
   this.$titleShield = iQ('.title-shield', this.$titlebar);
   this.setTitle(options.title || this.defaultName);
 
-  var titleUnfocus = function() {
+  var titleUnfocus = function(immediately) {
     self.$titleShield.show();
     if (!self.getTitle()) {
       self.$title
@@ -177,13 +179,19 @@ let GroupItem = function GroupItem(listOfEls, options) {
         .val(self.defaultName);
     } else {
       self.$title
-        .css({"background":"none"})
-        .animate({
-          "padding-left": "1px"
-        }, {
-          duration: 200,
-          easing: "tabviewBounce"
-        });
+        .css({"background":"none"});
+      if (immediately) {
+        self.$title.css({
+            "padding-left": "1px"
+          });
+      } else {
+        self.$title.animate({
+            "padding-left": "1px"
+          }, {
+            duration: 200,
+            easing: "tabviewBounce"
+          });
+      }
     }
   };
 
@@ -218,7 +226,7 @@ let GroupItem = function GroupItem(listOfEls, options) {
     })
     .keyup(handleKeyPress);
 
-  titleUnfocus();
+  titleUnfocus(immediately);
 
   if (this.locked.title)
     this.$title.addClass('name-locked');
@@ -268,14 +276,14 @@ let GroupItem = function GroupItem(listOfEls, options) {
   this._addHandlers($container);
 
   if (!this.locked.bounds)
-    this.setResizable(true);
+    this.setResizable(true, immediately);
 
   GroupItems.register(this);
 
   // ___ Position
-  var immediately = $container ? true : false;
   this.setBounds(rectToBe, immediately);
-  this.snap();
+  if (!options.dontPush)
+    this.snap();
   if ($container)
     this.setBounds(rectToBe, immediately);
 
@@ -556,7 +564,8 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   //   a - The item to add. Can be an <Item>, a DOM element or an iQ object.
   //       The latter two must refer to the container of an <Item>.
   //   dropPos - An object with left and top properties referring to the location dropped at.  Optional.
-  //   options - An object with optional settings for this call. Currently the only one is dontArrange.
+  //   options - An object with optional settings for this call. Currently this includes dontArrange
+  //       and immediately
   add: function(a, dropPos, options) {
     try {
       var item;
@@ -646,15 +655,16 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
         item.setParent(this);
 
         if (typeof item.setResizable == 'function')
-          item.setResizable(false);
+          item.setResizable(false, options.immediately);
 
         if (item.tab == gBrowser.selectedTab)
           GroupItems.setActiveGroupItem(this);
       }
 
       if (!options.dontArrange) {
-        this.arrange();
+        this.arrange({animate: !options.immediately});
       }
+
       UI.setReorderTabsOnHide(this);
     } catch(e) {
       Utils.log('GroupItem.add error', e);
@@ -668,7 +678,8 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   //
   //   a - The item to remove. Can be an <Item>, a DOM element or an iQ object.
   //       The latter two must refer to the container of an <Item>.
-  //   options - An object with optional settings for this call. Currently the only one is dontArrange.
+  //   options - An object with optional settings for this call. Currently this includes
+  //             dontArrange and immediately
   remove: function(a, options) {
     try {
       var $el;
@@ -699,12 +710,12 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       item.removeSubscriber(this, "close");
 
       if (typeof item.setResizable == 'function')
-        item.setResizable(true);
+        item.setResizable(true, options.immediately);
 
       if (!this._children.length && !this.locked.close && !this.getTitle() && !options.dontClose) {
         this.close();
       } else if (!options.dontArrange) {
-        this.arrange();
+        this.arrange({animate: !options.immediately});
       }
     } catch(e) {
       Utils.log(e);
@@ -782,15 +793,15 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       var bb = this.getContentBounds();
       var count = this._children.length;
       if (!this.shouldStack(count)) {
+        if (!options)
+          options = {};
+          
         var animate;
-        if (!options || typeof options.animate == 'undefined')
+        if (typeof options.animate == 'undefined')
           animate = true;
         else
           animate = options.animate;
 
-        if (typeof options == 'undefined')
-          options = {};
-
         this._children.forEach(function(child) {
             child.removeClass("stacked")
         });
@@ -1151,15 +1162,15 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // ----------
   // Function: setResizable
   // Sets whether the groupItem is resizable and updates the UI accordingly.
-  setResizable: function(value) {
+  setResizable: function(value, immediately) {
     this.resizeOptions.minWidth = 90;
     this.resizeOptions.minHeight = 90;
 
     if (value) {
-      this.$resizer.fadeIn();
+      immediately ? this.$resizer.show() : this.$resizer.fadeIn();
       this.resizable(true);
     } else {
-      this.$resizer.fadeOut();
+      immediately ? this.$resizer.hide() : this.$resizer.fadeOut();
       this.resizable(false);
     }
   },
@@ -1377,7 +1388,8 @@ window.GroupItems = {
           var groupItem = groupItemData[id];
           if (this.groupItemStorageSanity(groupItem)) {
             var options = {
-              dontPush: true
+              dontPush: true,
+              immediately: true
             };
 
             new GroupItem([], Utils.extend({}, groupItem, options));
@@ -1505,12 +1517,12 @@ window.GroupItems = {
   // ----------
   // Function: newTab
   // Given a <TabItem>, files it in the appropriate groupItem.
-  newTab: function(tabItem) {
+  newTab: function(tabItem, options) {
     let activeGroupItem = this.getActiveGroupItem();
     let orphanTab = this.getActiveOrphanTab();
 //    Utils.log('newTab', activeGroupItem, orphanTab);
     if (activeGroupItem) {
-      activeGroupItem.add(tabItem);
+      activeGroupItem.add(tabItem, null, options);
     } else if (orphanTab) {
       let newGroupItemBounds = orphanTab.getBoundsWithTitle();
       newGroupItemBounds.inset(-40,-40);
@@ -1518,7 +1530,7 @@ window.GroupItems = {
       newGroupItem.snap();
       this.setActiveGroupItem(newGroupItem);
     } else {
-      this.positionNewTabAtBottom(tabItem);
+      this.positionNewTabAtBottom(tabItem, options);
     }
   },
 
@@ -1528,7 +1540,9 @@ window.GroupItems = {
   // TODO: Make more robust and improve documentation,
   // Also, this probably belongs in tabitems.js
   // Bug 586558
-  positionNewTabAtBottom: function(tabItem) {
+  // TODO: perhaps this should be positioned not at the bottom but in an
+  // empty part of the frame: Bug 592932
+  positionNewTabAtBottom: function(tabItem, options) {
     let windowBounds = Items.getSafeWindowBounds();
 
     let itemBounds = new Rect(
@@ -1538,7 +1552,10 @@ window.GroupItems = {
       TabItems.tabHeight
     );
 
-    tabItem.setBounds(itemBounds);
+    if (!options)
+      options = {};
+
+    tabItem.setBounds(itemBounds, options.immediately);
   },
 
   // ----------
diff --git a/browser/base/content/tabview/items.js b/browser/base/content/tabview/items.js
index d77083315684..4309ca77f7f5 100644
--- a/browser/base/content/tabview/items.js
+++ b/browser/base/content/tabview/items.js
@@ -724,13 +724,11 @@ window.Item.prototype = {
   droppable: function(value) {
     try {
       var $container = iQ(this.container);
-      if (value)
-        $container.addClass('iq-droppable');
-      else {
+      if (value) {
         Utils.assert(this.dropOptions, 'dropOptions');
-
+        $container.addClass('iq-droppable');
+      } else
         $container.removeClass('iq-droppable');
-      }
     } catch(e) {
       Utils.log(e);
     }
diff --git a/browser/base/content/tabview/tabitems.js b/browser/base/content/tabview/tabitems.js
index 7722121c9988..d6eca8b09b31 100644
--- a/browser/base/content/tabview/tabitems.js
+++ b/browser/base/content/tabview/tabitems.js
@@ -48,7 +48,7 @@
 //
 // Parameters:
 //   tab - a xul:tab
-window.TabItem = function(tab) {
+window.TabItem = function(tab, options) {
 
   Utils.assert(tab, "tab");
 
@@ -56,6 +56,9 @@ window.TabItem = function(tab) {
   // register this as the tab's tabItem
   this.tab.tabItem = this;
 
+  if (!options)
+    options = {};
+  
   // ___ set up div
   var $div = iQ('<div>')
     .addClass('tab')
@@ -97,6 +100,10 @@ window.TabItem = function(tab) {
   // ___ superclass setup
   this._init($div[0]);
 
+  // ___ attempt to reconnect to data from Storage
+  this._hasBeenDrawn = false;
+  let reconnected = TabItems.reconnect(this);
+
   // ___ drag/drop
   // override dropOptions with custom tabitem methods
   // This is mostly to support the phantom groupItems.
@@ -164,7 +171,6 @@ window.TabItem = function(tab) {
   };
 
   this.draggable();
-  this.droppable(true);
 
   // ___ more div setup
   $div.mousedown(function(e) {
@@ -194,17 +200,20 @@ window.TabItem = function(tab) {
     .addClass('expander')
     .appendTo($div);
 
-  // ___ additional setup
-  this.reconnected = false;
-  this._hasBeenDrawn = false;
-  this.setResizable(true);
-
   this._updateDebugBounds();
 
   TabItems.register(this);
-
-  if (!TabItems.reconnect(this))
-    GroupItems.newTab(this);
+  
+  if (!this.reconnected) {
+    GroupItems.newTab(this, options);
+  }
+  
+  // tabs which were not reconnected at all or were not immediately added
+  // to a group get the same treatment.
+  if (!this.reconnected || (reconnected && !reconnected.addedToGroup) ) {
+    this.setResizable(true, options.immediately);
+    this.droppable(true);
+  }
 };
 
 window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
@@ -364,9 +373,9 @@ window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
 
       if (css.fontSize && !this.inStack()) {
         if (css.fontSize < fontSizeRange.min)
-          $title.fadeOut();
+          immediately ? $title.hide() : $title.fadeOut();
         else
-          $title.fadeIn();
+          immediately ? $title.show() : $title.fadeIn();
       }
 
       if (css.width) {
@@ -470,17 +479,16 @@ window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // Function: setResizable
   // If value is true, makes this item resizable, otherwise non-resizable.
   // Shows/hides a visible resize handle as appropriate.
-  setResizable: function(value) {
+  setResizable: function(value, immediately) {
     var $resizer = iQ('.expander', this.container);
 
-    this.resizeOptions.minWidth = TabItems.minTabWidth;
-    this.resizeOptions.minHeight = TabItems.minTabWidth * (TabItems.tabHeight / TabItems.tabWidth);
-
     if (value) {
-      $resizer.fadeIn();
+      this.resizeOptions.minWidth = TabItems.minTabWidth;
+      this.resizeOptions.minHeight = TabItems.minTabWidth * (TabItems.tabHeight / TabItems.tabWidth);
+      immediately ? $resizer.show() : $resizer.fadeIn();
       this.resizable(true);
     } else {
-      $resizer.fadeOut();
+      immediately ? $resizer.hide() : $resizer.fadeOut();
       this.resizable(false);
     }
   },
@@ -695,7 +703,7 @@ window.TabItems = {
       if (tab.ownerDocument.defaultView != gWindow)
         return;
 
-      self.link(tab);
+      self.link(tab, {immediately: true});
       self.update(tab);
     });
   },
@@ -816,11 +824,11 @@ window.TabItems = {
   // ----------
   // Function: link
   // Takes in a xul:tab.
-  link: function(tab){
+  link: function(tab, options){
     try {
       Utils.assertThrow(tab, "tab");
       Utils.assertThrow(!tab.tabItem, "shouldn't already be linked");
-      new TabItem(tab); // sets tab.tabItem to itself
+      new TabItem(tab, options); // sets tab.tabItem to itself
     } catch(e) {
       Utils.log(e);
     }
@@ -981,7 +989,7 @@ window.TabItems = {
       let tabData = Storage.getTabData(item.tab);
       if (tabData && this.storageSanity(tabData)) {
         if (item.parent)
-          item.parent.remove(item);
+          item.parent.remove(item, {immediately: true});
 
         item.setBounds(tabData.bounds, true);
 
@@ -991,7 +999,7 @@ window.TabItems = {
         if (tabData.groupID) {
           var groupItem = GroupItems.groupItem(tabData.groupID);
           if (groupItem) {
-            groupItem.add(item);
+            groupItem.add(item, null, {immediately: true});
 
             if (item.tab == gBrowser.selectedTab)
               GroupItems.setActiveGroupItem(item.parent);
@@ -1010,7 +1018,7 @@ window.TabItems = {
         }
 
         item.reconnected = true;
-        found = true;
+        found = {addedToGroup: tabData.groupID};
       } else
         item.reconnected = item.tab.linkedBrowser.currentURI.spec != 'about:blank';
 

From e25a3c2344bf21b075bac55ef25e57c4b3327814 Mon Sep 17 00:00:00 2001
From: Michael Yoshitaka Erlewine <mitcho@mitcho.com>
Date: Fri, 3 Sep 2010 14:58:29 -0400
Subject: [PATCH 147/222] Bug 591706 GroupItem.add: don't compute
 findInsertionPoint if we don't have a dropPos [r+a=dietrich]

---
 browser/base/content/tabview/groupitems.js | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index 4fb9ce73ef6d..951c05f32fcc 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -582,9 +582,6 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
 
       item.removeTrenches();
 
-      if (!dropPos)
-        dropPos = {top:window.innerWidth, left:window.innerHeight};
-
       if (typeof options == 'undefined')
         options = {};
 
@@ -638,7 +635,7 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       }
 
       // Insert the tab into the right position.
-      var index = findInsertionPoint(dropPos);
+      var index = dropPos ? findInsertionPoint(dropPos) : this._children.length;
       this._children.splice(index, 0, item);
 
       item.setZ(this.getZ() + 1);

From 4a233508a8f79f73323ff5ce698f8f29ef3636ba Mon Sep 17 00:00:00 2001
From: Michael Yoshitaka Erlewine <mitcho@mitcho.com>
Date: Fri, 3 Sep 2010 15:00:09 -0400
Subject: [PATCH 148/222] Bug 592586 Remove code for "group tab by sites"
 [r+a=dietrich]

---
 browser/base/content/tabview/groupitems.js | 15 ------
 browser/base/content/tabview/ui.js         | 55 ----------------------
 2 files changed, 70 deletions(-)

diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index 951c05f32fcc..a203df427c92 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -1416,21 +1416,6 @@ window.GroupItems = {
     return sane;
   },
 
-  // ----------
-  // Function: getGroupItemWithTitle
-  // Returns the <GroupItem> that has the given title, or null if none found.
-  // TODO: what if there are multiple groupItems with the same title??
-  //       Right now, looks like it'll return the last one. Bug 586557
-  getGroupItemWithTitle: function(title) {
-    var result = null;
-    this.groupItems.forEach(function(groupItem) {
-      if (groupItem.getTitle() == title)
-        result = groupItem;
-    });
-
-    return result;
-  },
-
   // ----------
   // Function: register
   // Adds the given <GroupItem> to the list of groupItems we're tracking.
diff --git a/browser/base/content/tabview/ui.js b/browser/base/content/tabview/ui.js
index bd9e63e403d0..27a86616658d 100644
--- a/browser/base/content/tabview/ui.js
+++ b/browser/base/content/tabview/ui.js
@@ -929,11 +929,6 @@ var UIManager = {
         code: function() {
           self._saveAll();
         }
-      }, {
-        name: "group sites",
-        code: function() {
-          self._arrangeBySite();
-        }
       }];
 
       var count = commands.length;
@@ -997,56 +992,6 @@ var UIManager = {
     GroupItems.saveAll();
     TabItems.saveAll();
   },
-
-  // ----------
-  // Function: _arrangeBySite
-  // Blows away all existing groupItems and organizes the tabs into new groupItems based
-  // on domain.
-  _arrangeBySite: function() {
-    function putInGroupItem(set, key) {
-      var groupItem = GroupItems.getGroupItemWithTitle(key);
-      if (groupItem) {
-        set.forEach(function(el) {
-          groupItem.add(el);
-        });
-      } else
-        new GroupItem(set, { dontPush: true, dontArrange: true, title: key });
-    }
-
-    GroupItems.removeAll();
-
-    var groupItems = [];
-    var leftovers = [];
-    var items = TabItems.getItems();
-    items.forEach(function(item) {
-      var url = item.tab.linkedBrowser.currentURI.spec;
-      var domain = url.split('/')[2];
-
-      if (!domain)
-        leftovers.push(item.container);
-      else {
-        var domainParts = domain.split(".");
-        var mainDomain = domainParts[domainParts.length - 2];
-        if (groupItems[mainDomain])
-          groupItems[mainDomain].push(item.container);
-        else
-          groupItems[mainDomain] = [item.container];
-      }
-    });
-
-    for (key in groupItems) {
-      var set = groupItems[key];
-      if (set.length > 1) {
-        putInGroupItem(set, key);
-      } else
-        leftovers.push(set[0]);
-    }
-
-    if (leftovers.length)
-      putInGroupItem(leftovers, "mixed");
-
-    GroupItems.arrange();
-  },
 };
 
 // ----------

From 1e5e847253905cb6cb793f5d72fc9ad2ed9c7619 Mon Sep 17 00:00:00 2001
From: Michael Yoshitaka Erlewine <mitcho@mitcho.com>
Date: Fri, 3 Sep 2010 15:05:56 -0400
Subject: [PATCH 149/222] Bug 591147 Let TabItem spacing used in Items.arrange
 be specified via CSS [r+a=dietrich]

---
 browser/base/content/tabview/groupitems.js          |  2 +-
 browser/base/content/tabview/items.js               | 13 ++++++++-----
 .../themes/gnomestripe/browser/tabview/tabview.css  |  1 +
 .../themes/pinstripe/browser/tabview/tabview.css    |  1 +
 .../themes/winstripe/browser/tabview/tabview.css    |  1 +
 5 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index a203df427c92..27bc522126dc 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -785,7 +785,7 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       this.topChild = null;
       var box = new Rect(this.expanded.bounds);
       box.inset(8, 8);
-      Items.arrange(this._children, box, Utils.extend({}, options, {padding: 8, z: 99999}));
+      Items.arrange(this._children, box, Utils.extend({}, options, {z: 99999}));
     } else {
       var bb = this.getContentBounds();
       var count = this._children.length;
diff --git a/browser/base/content/tabview/items.js b/browser/base/content/tabview/items.js
index 4309ca77f7f5..98e2b9a37a99 100644
--- a/browser/base/content/tabview/items.js
+++ b/browser/base/content/tabview/items.js
@@ -913,7 +913,11 @@ window.Items = {
       return rects;
 
     var columns = 1;
-    var padding = options.padding || 0;
+    // We'll assume for the time being that all the items have the same styling
+    // and that the margin is the same width around.
+    var itemMargin = items && items.length ?
+                       parseInt(iQ(items[0].container).css('margin-left')) : 0;
+    var padding = itemMargin * 2;
     var yScale = 1.1; // to allow for titles
     var rows;
     var tabWidth;
@@ -922,9 +926,9 @@ window.Items = {
 
     function figure() {
       rows = Math.ceil(count / columns);
-      tabWidth = (bounds.width - (padding * (columns - 1))) / columns;
+      tabWidth = (bounds.width - (padding * columns)) / columns;
       tabHeight = tabWidth * tabAspect;
-      totalHeight = (tabHeight * yScale * rows) + (padding * (rows - 1));
+      totalHeight = (tabHeight * yScale * rows) + (padding * rows);
     }
 
     figure();
@@ -935,8 +939,7 @@ window.Items = {
     }
 
     if (rows == 1) {
-      var maxWidth = Math.max(TabItems.tabWidth, bounds.width / 2);
-      tabWidth = Math.min(Math.min(maxWidth, bounds.width / count), bounds.height / tabAspect);
+      tabWidth = Math.min(tabWidth, (bounds.height - 2 * itemMargin) / tabAspect);
       tabHeight = tabWidth * tabAspect;
     }
 
diff --git a/browser/themes/gnomestripe/browser/tabview/tabview.css b/browser/themes/gnomestripe/browser/tabview/tabview.css
index 1b1f5646efaa..06daf034cc99 100644
--- a/browser/themes/gnomestripe/browser/tabview/tabview.css
+++ b/browser/themes/gnomestripe/browser/tabview/tabview.css
@@ -24,6 +24,7 @@ body {
   -moz-border-radius: 0.4em;
   -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
+  margin: 4px;
 }
 
 .tab canvas,
diff --git a/browser/themes/pinstripe/browser/tabview/tabview.css b/browser/themes/pinstripe/browser/tabview/tabview.css
index b02b626ac6d4..c093548472d5 100644
--- a/browser/themes/pinstripe/browser/tabview/tabview.css
+++ b/browser/themes/pinstripe/browser/tabview/tabview.css
@@ -24,6 +24,7 @@ body {
   -moz-border-radius: 0.4em;
   -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
+  margin: 4px;
 }
 
 .tab canvas,
diff --git a/browser/themes/winstripe/browser/tabview/tabview.css b/browser/themes/winstripe/browser/tabview/tabview.css
index 66e23a08ae10..1684f0da0d76 100644
--- a/browser/themes/winstripe/browser/tabview/tabview.css
+++ b/browser/themes/winstripe/browser/tabview/tabview.css
@@ -24,6 +24,7 @@ body {
   -moz-border-radius: 0.4em;
   -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
+  margin: 4px;
 }
 
 .tab canvas,

From ad73fb23cc0137140fbe3d0dc667c7bd465c0583 Mon Sep 17 00:00:00 2001
From: Raymond Lee <raymond@appcoast.com>
Date: Fri, 3 Sep 2010 20:53:58 -0400
Subject: [PATCH 150/222] Bug 587040 - After navigating with arrow keys, active
 tab highlighting will move but clicking on the group will bring up the last
 active tab [r+a=dietrich]

---
 browser/base/content/tabview/tabitems.js | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/browser/base/content/tabview/tabitems.js b/browser/base/content/tabview/tabitems.js
index d6eca8b09b31..b0019bfbe012 100644
--- a/browser/base/content/tabview/tabitems.js
+++ b/browser/base/content/tabview/tabitems.js
@@ -497,17 +497,19 @@ window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // Function: makeActive
   // Updates this item to visually indicate that it's active.
   makeActive: function() {
-   iQ(this.container).find("canvas").addClass("focus");
-   iQ(this.container).find("img.cached-thumb").addClass("focus");
+    iQ(this.container).find("canvas").addClass("focus");
+    iQ(this.container).find("img.cached-thumb").addClass("focus");
 
+    if (this.parent)
+      this.parent.setActiveTab(this);
   },
 
   // ----------
   // Function: makeDeactive
   // Updates this item to visually indicate that it's not active.
   makeDeactive: function() {
-   iQ(this.container).find("canvas").removeClass("focus");
-   iQ(this.container).find("img.cached-thumb").removeClass("focus");
+    iQ(this.container).find("canvas").removeClass("focus");
+    iQ(this.container).find("img.cached-thumb").removeClass("focus");
   },
 
   // ----------
@@ -536,7 +538,7 @@ window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
           .css(orig.css())
           .removeClass("front");
 
-        // If it's not focused, the onFocus lsitener would handle it.
+        // If it's not focused, the onFocus listener would handle it.
         if (gBrowser.selectedTab == tab)
           UI.onTabSelect(tab);
         else

From 03eaa380a52acd7759e470ac24dac3a90d84c72f Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Fri, 3 Sep 2010 14:29:00 -0400
Subject: [PATCH 151/222] Bug 592964: Use nsDependentAtomString instead of
 nsAtomString for temporary variables. r=jst a=jst

Bug 592964: Use nsDependentAtomString instead of nsAtomString for temporary variables. r=jst a=jst
---
 content/base/src/nsNodeInfoManager.cpp        | 2 +-
 content/svg/content/src/nsSVGElement.cpp      | 5 +++--
 content/xslt/src/xslt/txEXSLTFunctions.cpp    | 3 ++-
 content/xslt/src/xslt/txMozillaTextOutput.cpp | 5 +++--
 content/xslt/src/xslt/txMozillaXMLOutput.cpp  | 5 +++--
 content/xul/document/src/nsXULDocument.cpp    | 9 +++++----
 6 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/content/base/src/nsNodeInfoManager.cpp b/content/base/src/nsNodeInfoManager.cpp
index c3e90df7db34..d27924d23593 100644
--- a/content/base/src/nsNodeInfoManager.cpp
+++ b/content/base/src/nsNodeInfoManager.cpp
@@ -74,7 +74,7 @@ nsNodeInfoManager::GetNodeInfoInnerHashValue(const void *key)
     reinterpret_cast<const nsINodeInfo::nsNodeInfoInner *>(key);
 
   if (node->mName) {
-    return HashString(nsAtomString(node->mName));
+    return HashString(nsDependentAtomString(node->mName));
   }
   return HashString(*(node->mNameString));
 }
diff --git a/content/svg/content/src/nsSVGElement.cpp b/content/svg/content/src/nsSVGElement.cpp
index b77d0a274b4d..8544e7cef6da 100644
--- a/content/svg/content/src/nsSVGElement.cpp
+++ b/content/svg/content/src/nsSVGElement.cpp
@@ -1169,7 +1169,7 @@ MappedAttrParser::ParseMappedAttrValue(nsIAtom* aMappedAttrName,
 
   // Get the nsCSSProperty ID for our mapped attribute.
   nsCSSProperty propertyID =
-    nsCSSProps::LookupProperty(nsAtomString(aMappedAttrName));
+    nsCSSProps::LookupProperty(nsDependentAtomString(aMappedAttrName));
   PRBool changed; // outparam for ParseProperty. (ignored)
   mParser.ParseProperty(propertyID, aMappedAttrValue, mDocURI, mBaseURI,
                         mNodePrincipal, mDecl, &changed, PR_FALSE);
@@ -2191,7 +2191,8 @@ nsSVGElement::GetAnimatedAttr(nsIAtom* aName)
 
   // Mapped attributes:
   if (IsAttributeMapped(aName)) {
-    nsCSSProperty prop = nsCSSProps::LookupProperty(nsAtomString(aName));
+    nsCSSProperty prop =
+      nsCSSProps::LookupProperty(nsDependentAtomString(aName));
     // Check IsPropertyAnimatable to avoid attributes that...
     //  - map to explicitly unanimatable properties (e.g. 'direction')
     //  - map to unsupported attributes (e.g. 'glyph-orientation-horizontal')
diff --git a/content/xslt/src/xslt/txEXSLTFunctions.cpp b/content/xslt/src/xslt/txEXSLTFunctions.cpp
index fa5e6a694f07..6808a980a4f5 100644
--- a/content/xslt/src/xslt/txEXSLTFunctions.cpp
+++ b/content/xslt/src/xslt/txEXSLTFunctions.cpp
@@ -172,7 +172,8 @@ createAndAddToResult(nsIAtom* aName, const nsSubstring& aValue,
 
     nsIDocument* doc = aResultHolder->GetOwnerDoc();
     nsCOMPtr<nsIContent> elem;
-    nsresult rv = doc->CreateElem(nsAtomString(aName), nsnull, kNameSpaceID_None, PR_FALSE,
+    nsresult rv = doc->CreateElem(nsDependentAtomString(aName),
+                                  nsnull, kNameSpaceID_None, PR_FALSE,
                                   getter_AddRefs(elem));
     NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/content/xslt/src/xslt/txMozillaTextOutput.cpp b/content/xslt/src/xslt/txMozillaTextOutput.cpp
index 7fddd77e99e2..1c4e9b1d5105 100644
--- a/content/xslt/src/xslt/txMozillaTextOutput.cpp
+++ b/content/xslt/src/xslt/txMozillaTextOutput.cpp
@@ -219,8 +219,9 @@ txMozillaTextOutput::createResultDocument(nsIDOMDocument* aSourceDocument,
             RegisterNameSpace(NS_LITERAL_STRING(kTXNameSpaceURI), namespaceID);
         NS_ENSURE_SUCCESS(rv, rv);
 
-        rv = mDocument->CreateElem(nsAtomString(nsGkAtoms::result), nsGkAtoms::transformiix,
-                                   namespaceID, PR_FALSE, getter_AddRefs(mTextParent));
+        rv = mDocument->CreateElem(nsDependentAtomString(nsGkAtoms::result),
+                                   nsGkAtoms::transformiix, namespaceID,
+                                   PR_FALSE, getter_AddRefs(mTextParent));
         NS_ENSURE_SUCCESS(rv, rv);
 
 
diff --git a/content/xslt/src/xslt/txMozillaXMLOutput.cpp b/content/xslt/src/xslt/txMozillaXMLOutput.cpp
index 8d956ac93b6d..0e017a8493a0 100644
--- a/content/xslt/src/xslt/txMozillaXMLOutput.cpp
+++ b/content/xslt/src/xslt/txMozillaXMLOutput.cpp
@@ -629,8 +629,9 @@ txMozillaXMLOutput::createTxWrapper()
     NS_ENSURE_SUCCESS(rv, rv);
 
     nsCOMPtr<nsIContent> wrapper;
-    rv = mDocument->CreateElem(nsAtomString(nsGkAtoms::result), nsGkAtoms::transformiix,
-                               namespaceID, PR_FALSE, getter_AddRefs(wrapper));
+    rv = mDocument->CreateElem(nsDependentAtomString(nsGkAtoms::result),
+                               nsGkAtoms::transformiix, namespaceID,
+                               PR_FALSE, getter_AddRefs(wrapper));
     NS_ENSURE_SUCCESS(rv, rv);
 
     PRUint32 i, j, childCount = mDocument->GetChildCount();
diff --git a/content/xul/document/src/nsXULDocument.cpp b/content/xul/document/src/nsXULDocument.cpp
index f622c726b68f..85ae01c2aace 100644
--- a/content/xul/document/src/nsXULDocument.cpp
+++ b/content/xul/document/src/nsXULDocument.cpp
@@ -3833,10 +3833,11 @@ nsXULDocument::CreateTemplateBuilder(nsIContent* aElement)
                                           getter_AddRefs(bodyContent));
 
         if (! bodyContent) {
-            nsresult rv = document->CreateElem(nsAtomString(nsGkAtoms::treechildren),
-                                               nsnull, kNameSpaceID_XUL,
-                                               PR_FALSE,
-                                               getter_AddRefs(bodyContent));
+            nsresult rv =
+                document->CreateElem(nsDependentAtomString(nsGkAtoms::treechildren),
+                                     nsnull, kNameSpaceID_XUL,
+                                     PR_FALSE,
+                                     getter_AddRefs(bodyContent));
             NS_ENSURE_SUCCESS(rv, rv);
 
             aElement->AppendChildTo(bodyContent, PR_FALSE);

From fe8af1477522f3e7e9fdba76b8c36b4201718e9b Mon Sep 17 00:00:00 2001
From: Josh Matthews <josh@joshmatthews.net>
Date: Sat, 4 Sep 2010 15:15:31 -0400
Subject: [PATCH 152/222] Backing out ebce58252cf8, 1f94199af190, 81664d1912ee,
 8e95db7adbea, f97a99ad74af, 66d12a1541f2, 6b936d1a9e65

---
 browser/base/content/tabview/groupitems.js    | 103 +++++++++---------
 browser/base/content/tabview/items.js         |  21 ++--
 .../base/content/tabview/modules/utils.jsm    |  14 ---
 browser/base/content/tabview/tabitems.js      |  68 +++++-------
 browser/base/content/tabview/trench.js        |   2 +-
 browser/base/content/tabview/ui.js            |  55 ++++++++++
 .../gnomestripe/browser/tabview/tabview.css   |   1 -
 .../pinstripe/browser/tabview/tabview.css     |   1 -
 .../winstripe/browser/tabview/tabview.css     |   1 -
 content/base/src/nsNodeInfoManager.cpp        |   2 +-
 content/svg/content/src/nsSVGElement.cpp      |   5 +-
 content/xslt/src/xslt/txEXSLTFunctions.cpp    |   3 +-
 content/xslt/src/xslt/txMozillaTextOutput.cpp |   5 +-
 content/xslt/src/xslt/txMozillaXMLOutput.cpp  |   5 +-
 content/xul/document/src/nsXULDocument.cpp    |   9 +-
 15 files changed, 159 insertions(+), 136 deletions(-)

diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index 27bc522126dc..62f7ddd9f9f6 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -62,8 +62,7 @@
 //   bounds - a <Rect>; otherwise based on the locations of the provided elements
 //   container - a DOM element to use as the container for this groupItem; otherwise will create
 //   title - the title for the groupItem; otherwise blank
-//   dontPush - true if this groupItem shouldn't push away or snap on creation; default is false
-//   immediately - true if we want all placement immediately, not with animation
+//   dontPush - true if this groupItem shouldn't push away on creation; default is false
 let GroupItem = function GroupItem(listOfEls, options) {
   try {
   if (typeof options == 'undefined')
@@ -111,7 +110,6 @@ let GroupItem = function GroupItem(listOfEls, options) {
   }
 
   var $container = options.container;
-  let immediately = options.immediately || $container ? true : false;
   if (!$container) {
     $container = iQ('<div>')
       .addClass('groupItem')
@@ -171,7 +169,7 @@ let GroupItem = function GroupItem(listOfEls, options) {
   this.$titleShield = iQ('.title-shield', this.$titlebar);
   this.setTitle(options.title || this.defaultName);
 
-  var titleUnfocus = function(immediately) {
+  var titleUnfocus = function() {
     self.$titleShield.show();
     if (!self.getTitle()) {
       self.$title
@@ -179,19 +177,13 @@ let GroupItem = function GroupItem(listOfEls, options) {
         .val(self.defaultName);
     } else {
       self.$title
-        .css({"background":"none"});
-      if (immediately) {
-        self.$title.css({
-            "padding-left": "1px"
-          });
-      } else {
-        self.$title.animate({
-            "padding-left": "1px"
-          }, {
-            duration: 200,
-            easing: "tabviewBounce"
-          });
-      }
+        .css({"background":"none"})
+        .animate({
+          "padding-left": "1px"
+        }, {
+          duration: 200,
+          easing: "tabviewBounce"
+        });
     }
   };
 
@@ -226,7 +218,7 @@ let GroupItem = function GroupItem(listOfEls, options) {
     })
     .keyup(handleKeyPress);
 
-  titleUnfocus(immediately);
+  titleUnfocus();
 
   if (this.locked.title)
     this.$title.addClass('name-locked');
@@ -276,14 +268,14 @@ let GroupItem = function GroupItem(listOfEls, options) {
   this._addHandlers($container);
 
   if (!this.locked.bounds)
-    this.setResizable(true, immediately);
+    this.setResizable(true);
 
   GroupItems.register(this);
 
   // ___ Position
+  var immediately = $container ? true : false;
   this.setBounds(rectToBe, immediately);
-  if (!options.dontPush)
-    this.snap();
+  this.snap();
   if ($container)
     this.setBounds(rectToBe, immediately);
 
@@ -564,8 +556,7 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   //   a - The item to add. Can be an <Item>, a DOM element or an iQ object.
   //       The latter two must refer to the container of an <Item>.
   //   dropPos - An object with left and top properties referring to the location dropped at.  Optional.
-  //   options - An object with optional settings for this call. Currently this includes dontArrange
-  //       and immediately
+  //   options - An object with optional settings for this call. Currently the only one is dontArrange.
   add: function(a, dropPos, options) {
     try {
       var item;
@@ -582,6 +573,9 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
 
       item.removeTrenches();
 
+      if (!dropPos)
+        dropPos = {top:window.innerWidth, left:window.innerHeight};
+
       if (typeof options == 'undefined')
         options = {};
 
@@ -635,7 +629,7 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       }
 
       // Insert the tab into the right position.
-      var index = dropPos ? findInsertionPoint(dropPos) : this._children.length;
+      var index = findInsertionPoint(dropPos);
       this._children.splice(index, 0, item);
 
       item.setZ(this.getZ() + 1);
@@ -652,16 +646,15 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
         item.setParent(this);
 
         if (typeof item.setResizable == 'function')
-          item.setResizable(false, options.immediately);
+          item.setResizable(false);
 
         if (item.tab == gBrowser.selectedTab)
           GroupItems.setActiveGroupItem(this);
       }
 
       if (!options.dontArrange) {
-        this.arrange({animate: !options.immediately});
+        this.arrange();
       }
-
       UI.setReorderTabsOnHide(this);
     } catch(e) {
       Utils.log('GroupItem.add error', e);
@@ -675,8 +668,7 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   //
   //   a - The item to remove. Can be an <Item>, a DOM element or an iQ object.
   //       The latter two must refer to the container of an <Item>.
-  //   options - An object with optional settings for this call. Currently this includes
-  //             dontArrange and immediately
+  //   options - An object with optional settings for this call. Currently the only one is dontArrange.
   remove: function(a, options) {
     try {
       var $el;
@@ -707,12 +699,12 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       item.removeSubscriber(this, "close");
 
       if (typeof item.setResizable == 'function')
-        item.setResizable(true, options.immediately);
+        item.setResizable(true);
 
       if (!this._children.length && !this.locked.close && !this.getTitle() && !options.dontClose) {
         this.close();
       } else if (!options.dontArrange) {
-        this.arrange({animate: !options.immediately});
+        this.arrange();
       }
     } catch(e) {
       Utils.log(e);
@@ -785,20 +777,20 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       this.topChild = null;
       var box = new Rect(this.expanded.bounds);
       box.inset(8, 8);
-      Items.arrange(this._children, box, Utils.extend({}, options, {z: 99999}));
+      Items.arrange(this._children, box, Utils.extend({}, options, {padding: 8, z: 99999}));
     } else {
       var bb = this.getContentBounds();
       var count = this._children.length;
       if (!this.shouldStack(count)) {
-        if (!options)
-          options = {};
-          
         var animate;
-        if (typeof options.animate == 'undefined')
+        if (!options || typeof options.animate == 'undefined')
           animate = true;
         else
           animate = options.animate;
 
+        if (typeof options == 'undefined')
+          options = {};
+
         this._children.forEach(function(child) {
             child.removeClass("stacked")
         });
@@ -1159,15 +1151,15 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // ----------
   // Function: setResizable
   // Sets whether the groupItem is resizable and updates the UI accordingly.
-  setResizable: function(value, immediately) {
+  setResizable: function(value) {
     this.resizeOptions.minWidth = 90;
     this.resizeOptions.minHeight = 90;
 
     if (value) {
-      immediately ? this.$resizer.show() : this.$resizer.fadeIn();
+      this.$resizer.fadeIn();
       this.resizable(true);
     } else {
-      immediately ? this.$resizer.hide() : this.$resizer.fadeOut();
+      this.$resizer.fadeOut();
       this.resizable(false);
     }
   },
@@ -1385,8 +1377,7 @@ window.GroupItems = {
           var groupItem = groupItemData[id];
           if (this.groupItemStorageSanity(groupItem)) {
             var options = {
-              dontPush: true,
-              immediately: true
+              dontPush: true
             };
 
             new GroupItem([], Utils.extend({}, groupItem, options));
@@ -1416,6 +1407,21 @@ window.GroupItems = {
     return sane;
   },
 
+  // ----------
+  // Function: getGroupItemWithTitle
+  // Returns the <GroupItem> that has the given title, or null if none found.
+  // TODO: what if there are multiple groupItems with the same title??
+  //       Right now, looks like it'll return the last one. Bug 586557
+  getGroupItemWithTitle: function(title) {
+    var result = null;
+    this.groupItems.forEach(function(groupItem) {
+      if (groupItem.getTitle() == title)
+        result = groupItem;
+    });
+
+    return result;
+  },
+
   // ----------
   // Function: register
   // Adds the given <GroupItem> to the list of groupItems we're tracking.
@@ -1499,12 +1505,12 @@ window.GroupItems = {
   // ----------
   // Function: newTab
   // Given a <TabItem>, files it in the appropriate groupItem.
-  newTab: function(tabItem, options) {
+  newTab: function(tabItem) {
     let activeGroupItem = this.getActiveGroupItem();
     let orphanTab = this.getActiveOrphanTab();
 //    Utils.log('newTab', activeGroupItem, orphanTab);
     if (activeGroupItem) {
-      activeGroupItem.add(tabItem, null, options);
+      activeGroupItem.add(tabItem);
     } else if (orphanTab) {
       let newGroupItemBounds = orphanTab.getBoundsWithTitle();
       newGroupItemBounds.inset(-40,-40);
@@ -1512,7 +1518,7 @@ window.GroupItems = {
       newGroupItem.snap();
       this.setActiveGroupItem(newGroupItem);
     } else {
-      this.positionNewTabAtBottom(tabItem, options);
+      this.positionNewTabAtBottom(tabItem);
     }
   },
 
@@ -1522,9 +1528,7 @@ window.GroupItems = {
   // TODO: Make more robust and improve documentation,
   // Also, this probably belongs in tabitems.js
   // Bug 586558
-  // TODO: perhaps this should be positioned not at the bottom but in an
-  // empty part of the frame: Bug 592932
-  positionNewTabAtBottom: function(tabItem, options) {
+  positionNewTabAtBottom: function(tabItem) {
     let windowBounds = Items.getSafeWindowBounds();
 
     let itemBounds = new Rect(
@@ -1534,10 +1538,7 @@ window.GroupItems = {
       TabItems.tabHeight
     );
 
-    if (!options)
-      options = {};
-
-    tabItem.setBounds(itemBounds, options.immediately);
+    tabItem.setBounds(itemBounds);
   },
 
   // ----------
diff --git a/browser/base/content/tabview/items.js b/browser/base/content/tabview/items.js
index 98e2b9a37a99..d77083315684 100644
--- a/browser/base/content/tabview/items.js
+++ b/browser/base/content/tabview/items.js
@@ -724,11 +724,13 @@ window.Item.prototype = {
   droppable: function(value) {
     try {
       var $container = iQ(this.container);
-      if (value) {
-        Utils.assert(this.dropOptions, 'dropOptions');
+      if (value)
         $container.addClass('iq-droppable');
-      } else
+      else {
+        Utils.assert(this.dropOptions, 'dropOptions');
+
         $container.removeClass('iq-droppable');
+      }
     } catch(e) {
       Utils.log(e);
     }
@@ -913,11 +915,7 @@ window.Items = {
       return rects;
 
     var columns = 1;
-    // We'll assume for the time being that all the items have the same styling
-    // and that the margin is the same width around.
-    var itemMargin = items && items.length ?
-                       parseInt(iQ(items[0].container).css('margin-left')) : 0;
-    var padding = itemMargin * 2;
+    var padding = options.padding || 0;
     var yScale = 1.1; // to allow for titles
     var rows;
     var tabWidth;
@@ -926,9 +924,9 @@ window.Items = {
 
     function figure() {
       rows = Math.ceil(count / columns);
-      tabWidth = (bounds.width - (padding * columns)) / columns;
+      tabWidth = (bounds.width - (padding * (columns - 1))) / columns;
       tabHeight = tabWidth * tabAspect;
-      totalHeight = (tabHeight * yScale * rows) + (padding * rows);
+      totalHeight = (tabHeight * yScale * rows) + (padding * (rows - 1));
     }
 
     figure();
@@ -939,7 +937,8 @@ window.Items = {
     }
 
     if (rows == 1) {
-      tabWidth = Math.min(tabWidth, (bounds.height - 2 * itemMargin) / tabAspect);
+      var maxWidth = Math.max(TabItems.tabWidth, bounds.width / 2);
+      tabWidth = Math.min(Math.min(maxWidth, bounds.width / count), bounds.height / tabAspect);
       tabHeight = tabWidth * tabAspect;
     }
 
diff --git a/browser/base/content/tabview/modules/utils.jsm b/browser/base/content/tabview/modules/utils.jsm
index 7985eb1c0b10..ee0318f81abe 100644
--- a/browser/base/content/tabview/modules/utils.jsm
+++ b/browser/base/content/tabview/modules/utils.jsm
@@ -322,20 +322,6 @@ Range.prototype = {
     return false;
   },
 
-  // ----------
-  // Function: overlaps
-  // Whether the <Range> overlaps with the given <Range> or value or not.
-  //
-  // Paramaters
-  //  - a number or <Range>
-  overlaps: function Rect_overlaps(value) {
-    if (Utils.isNumber(value))
-      return this.contains(value);
-    if (Utils.isRange(value))
-      return !(value.max < this.min || this.max < value.min);
-    return false;
-  },
-
   // ----------
   // Function: proportion
   // Maps the given value to the range [0,1], so that it returns 0 if the value is <= the min,
diff --git a/browser/base/content/tabview/tabitems.js b/browser/base/content/tabview/tabitems.js
index b0019bfbe012..7722121c9988 100644
--- a/browser/base/content/tabview/tabitems.js
+++ b/browser/base/content/tabview/tabitems.js
@@ -48,7 +48,7 @@
 //
 // Parameters:
 //   tab - a xul:tab
-window.TabItem = function(tab, options) {
+window.TabItem = function(tab) {
 
   Utils.assert(tab, "tab");
 
@@ -56,9 +56,6 @@ window.TabItem = function(tab, options) {
   // register this as the tab's tabItem
   this.tab.tabItem = this;
 
-  if (!options)
-    options = {};
-  
   // ___ set up div
   var $div = iQ('<div>')
     .addClass('tab')
@@ -100,10 +97,6 @@ window.TabItem = function(tab, options) {
   // ___ superclass setup
   this._init($div[0]);
 
-  // ___ attempt to reconnect to data from Storage
-  this._hasBeenDrawn = false;
-  let reconnected = TabItems.reconnect(this);
-
   // ___ drag/drop
   // override dropOptions with custom tabitem methods
   // This is mostly to support the phantom groupItems.
@@ -171,6 +164,7 @@ window.TabItem = function(tab, options) {
   };
 
   this.draggable();
+  this.droppable(true);
 
   // ___ more div setup
   $div.mousedown(function(e) {
@@ -200,20 +194,17 @@ window.TabItem = function(tab, options) {
     .addClass('expander')
     .appendTo($div);
 
+  // ___ additional setup
+  this.reconnected = false;
+  this._hasBeenDrawn = false;
+  this.setResizable(true);
+
   this._updateDebugBounds();
 
   TabItems.register(this);
-  
-  if (!this.reconnected) {
-    GroupItems.newTab(this, options);
-  }
-  
-  // tabs which were not reconnected at all or were not immediately added
-  // to a group get the same treatment.
-  if (!this.reconnected || (reconnected && !reconnected.addedToGroup) ) {
-    this.setResizable(true, options.immediately);
-    this.droppable(true);
-  }
+
+  if (!TabItems.reconnect(this))
+    GroupItems.newTab(this);
 };
 
 window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
@@ -373,9 +364,9 @@ window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
 
       if (css.fontSize && !this.inStack()) {
         if (css.fontSize < fontSizeRange.min)
-          immediately ? $title.hide() : $title.fadeOut();
+          $title.fadeOut();
         else
-          immediately ? $title.show() : $title.fadeIn();
+          $title.fadeIn();
       }
 
       if (css.width) {
@@ -479,16 +470,17 @@ window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // Function: setResizable
   // If value is true, makes this item resizable, otherwise non-resizable.
   // Shows/hides a visible resize handle as appropriate.
-  setResizable: function(value, immediately) {
+  setResizable: function(value) {
     var $resizer = iQ('.expander', this.container);
 
+    this.resizeOptions.minWidth = TabItems.minTabWidth;
+    this.resizeOptions.minHeight = TabItems.minTabWidth * (TabItems.tabHeight / TabItems.tabWidth);
+
     if (value) {
-      this.resizeOptions.minWidth = TabItems.minTabWidth;
-      this.resizeOptions.minHeight = TabItems.minTabWidth * (TabItems.tabHeight / TabItems.tabWidth);
-      immediately ? $resizer.show() : $resizer.fadeIn();
+      $resizer.fadeIn();
       this.resizable(true);
     } else {
-      immediately ? $resizer.hide() : $resizer.fadeOut();
+      $resizer.fadeOut();
       this.resizable(false);
     }
   },
@@ -497,19 +489,17 @@ window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // Function: makeActive
   // Updates this item to visually indicate that it's active.
   makeActive: function() {
-    iQ(this.container).find("canvas").addClass("focus");
-    iQ(this.container).find("img.cached-thumb").addClass("focus");
+   iQ(this.container).find("canvas").addClass("focus");
+   iQ(this.container).find("img.cached-thumb").addClass("focus");
 
-    if (this.parent)
-      this.parent.setActiveTab(this);
   },
 
   // ----------
   // Function: makeDeactive
   // Updates this item to visually indicate that it's not active.
   makeDeactive: function() {
-    iQ(this.container).find("canvas").removeClass("focus");
-    iQ(this.container).find("img.cached-thumb").removeClass("focus");
+   iQ(this.container).find("canvas").removeClass("focus");
+   iQ(this.container).find("img.cached-thumb").removeClass("focus");
   },
 
   // ----------
@@ -538,7 +528,7 @@ window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
           .css(orig.css())
           .removeClass("front");
 
-        // If it's not focused, the onFocus listener would handle it.
+        // If it's not focused, the onFocus lsitener would handle it.
         if (gBrowser.selectedTab == tab)
           UI.onTabSelect(tab);
         else
@@ -705,7 +695,7 @@ window.TabItems = {
       if (tab.ownerDocument.defaultView != gWindow)
         return;
 
-      self.link(tab, {immediately: true});
+      self.link(tab);
       self.update(tab);
     });
   },
@@ -826,11 +816,11 @@ window.TabItems = {
   // ----------
   // Function: link
   // Takes in a xul:tab.
-  link: function(tab, options){
+  link: function(tab){
     try {
       Utils.assertThrow(tab, "tab");
       Utils.assertThrow(!tab.tabItem, "shouldn't already be linked");
-      new TabItem(tab, options); // sets tab.tabItem to itself
+      new TabItem(tab); // sets tab.tabItem to itself
     } catch(e) {
       Utils.log(e);
     }
@@ -991,7 +981,7 @@ window.TabItems = {
       let tabData = Storage.getTabData(item.tab);
       if (tabData && this.storageSanity(tabData)) {
         if (item.parent)
-          item.parent.remove(item, {immediately: true});
+          item.parent.remove(item);
 
         item.setBounds(tabData.bounds, true);
 
@@ -1001,7 +991,7 @@ window.TabItems = {
         if (tabData.groupID) {
           var groupItem = GroupItems.groupItem(tabData.groupID);
           if (groupItem) {
-            groupItem.add(item, null, {immediately: true});
+            groupItem.add(item);
 
             if (item.tab == gBrowser.selectedTab)
               GroupItems.setActiveGroupItem(item.parent);
@@ -1020,7 +1010,7 @@ window.TabItems = {
         }
 
         item.reconnected = true;
-        found = {addedToGroup: tabData.groupID};
+        found = true;
       } else
         item.reconnected = item.tab.linkedBrowser.currentURI.spec != 'about:blank';
 
diff --git a/browser/base/content/tabview/trench.js b/browser/base/content/tabview/trench.js
index b08ff4fef1ff..e4812ac814e2 100644
--- a/browser/base/content/tabview/trench.js
+++ b/browser/base/content/tabview/trench.js
@@ -382,7 +382,7 @@ Trench.prototype = {
   ruleOverlaps: function Trench_ruleOverlaps(position, range) {
     return (this.position - this.radius < position &&
            position < this.position + this.radius &&
-           this.activeRange.overlaps(range));
+           this.activeRange.contains(range));
   },
 
   //----------
diff --git a/browser/base/content/tabview/ui.js b/browser/base/content/tabview/ui.js
index 27a86616658d..bd9e63e403d0 100644
--- a/browser/base/content/tabview/ui.js
+++ b/browser/base/content/tabview/ui.js
@@ -929,6 +929,11 @@ var UIManager = {
         code: function() {
           self._saveAll();
         }
+      }, {
+        name: "group sites",
+        code: function() {
+          self._arrangeBySite();
+        }
       }];
 
       var count = commands.length;
@@ -992,6 +997,56 @@ var UIManager = {
     GroupItems.saveAll();
     TabItems.saveAll();
   },
+
+  // ----------
+  // Function: _arrangeBySite
+  // Blows away all existing groupItems and organizes the tabs into new groupItems based
+  // on domain.
+  _arrangeBySite: function() {
+    function putInGroupItem(set, key) {
+      var groupItem = GroupItems.getGroupItemWithTitle(key);
+      if (groupItem) {
+        set.forEach(function(el) {
+          groupItem.add(el);
+        });
+      } else
+        new GroupItem(set, { dontPush: true, dontArrange: true, title: key });
+    }
+
+    GroupItems.removeAll();
+
+    var groupItems = [];
+    var leftovers = [];
+    var items = TabItems.getItems();
+    items.forEach(function(item) {
+      var url = item.tab.linkedBrowser.currentURI.spec;
+      var domain = url.split('/')[2];
+
+      if (!domain)
+        leftovers.push(item.container);
+      else {
+        var domainParts = domain.split(".");
+        var mainDomain = domainParts[domainParts.length - 2];
+        if (groupItems[mainDomain])
+          groupItems[mainDomain].push(item.container);
+        else
+          groupItems[mainDomain] = [item.container];
+      }
+    });
+
+    for (key in groupItems) {
+      var set = groupItems[key];
+      if (set.length > 1) {
+        putInGroupItem(set, key);
+      } else
+        leftovers.push(set[0]);
+    }
+
+    if (leftovers.length)
+      putInGroupItem(leftovers, "mixed");
+
+    GroupItems.arrange();
+  },
 };
 
 // ----------
diff --git a/browser/themes/gnomestripe/browser/tabview/tabview.css b/browser/themes/gnomestripe/browser/tabview/tabview.css
index 06daf034cc99..1b1f5646efaa 100644
--- a/browser/themes/gnomestripe/browser/tabview/tabview.css
+++ b/browser/themes/gnomestripe/browser/tabview/tabview.css
@@ -24,7 +24,6 @@ body {
   -moz-border-radius: 0.4em;
   -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
-  margin: 4px;
 }
 
 .tab canvas,
diff --git a/browser/themes/pinstripe/browser/tabview/tabview.css b/browser/themes/pinstripe/browser/tabview/tabview.css
index c093548472d5..b02b626ac6d4 100644
--- a/browser/themes/pinstripe/browser/tabview/tabview.css
+++ b/browser/themes/pinstripe/browser/tabview/tabview.css
@@ -24,7 +24,6 @@ body {
   -moz-border-radius: 0.4em;
   -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
-  margin: 4px;
 }
 
 .tab canvas,
diff --git a/browser/themes/winstripe/browser/tabview/tabview.css b/browser/themes/winstripe/browser/tabview/tabview.css
index 1684f0da0d76..66e23a08ae10 100644
--- a/browser/themes/winstripe/browser/tabview/tabview.css
+++ b/browser/themes/winstripe/browser/tabview/tabview.css
@@ -24,7 +24,6 @@ body {
   -moz-border-radius: 0.4em;
   -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
-  margin: 4px;
 }
 
 .tab canvas,
diff --git a/content/base/src/nsNodeInfoManager.cpp b/content/base/src/nsNodeInfoManager.cpp
index d27924d23593..c3e90df7db34 100644
--- a/content/base/src/nsNodeInfoManager.cpp
+++ b/content/base/src/nsNodeInfoManager.cpp
@@ -74,7 +74,7 @@ nsNodeInfoManager::GetNodeInfoInnerHashValue(const void *key)
     reinterpret_cast<const nsINodeInfo::nsNodeInfoInner *>(key);
 
   if (node->mName) {
-    return HashString(nsDependentAtomString(node->mName));
+    return HashString(nsAtomString(node->mName));
   }
   return HashString(*(node->mNameString));
 }
diff --git a/content/svg/content/src/nsSVGElement.cpp b/content/svg/content/src/nsSVGElement.cpp
index 8544e7cef6da..b77d0a274b4d 100644
--- a/content/svg/content/src/nsSVGElement.cpp
+++ b/content/svg/content/src/nsSVGElement.cpp
@@ -1169,7 +1169,7 @@ MappedAttrParser::ParseMappedAttrValue(nsIAtom* aMappedAttrName,
 
   // Get the nsCSSProperty ID for our mapped attribute.
   nsCSSProperty propertyID =
-    nsCSSProps::LookupProperty(nsDependentAtomString(aMappedAttrName));
+    nsCSSProps::LookupProperty(nsAtomString(aMappedAttrName));
   PRBool changed; // outparam for ParseProperty. (ignored)
   mParser.ParseProperty(propertyID, aMappedAttrValue, mDocURI, mBaseURI,
                         mNodePrincipal, mDecl, &changed, PR_FALSE);
@@ -2191,8 +2191,7 @@ nsSVGElement::GetAnimatedAttr(nsIAtom* aName)
 
   // Mapped attributes:
   if (IsAttributeMapped(aName)) {
-    nsCSSProperty prop =
-      nsCSSProps::LookupProperty(nsDependentAtomString(aName));
+    nsCSSProperty prop = nsCSSProps::LookupProperty(nsAtomString(aName));
     // Check IsPropertyAnimatable to avoid attributes that...
     //  - map to explicitly unanimatable properties (e.g. 'direction')
     //  - map to unsupported attributes (e.g. 'glyph-orientation-horizontal')
diff --git a/content/xslt/src/xslt/txEXSLTFunctions.cpp b/content/xslt/src/xslt/txEXSLTFunctions.cpp
index 6808a980a4f5..fa5e6a694f07 100644
--- a/content/xslt/src/xslt/txEXSLTFunctions.cpp
+++ b/content/xslt/src/xslt/txEXSLTFunctions.cpp
@@ -172,8 +172,7 @@ createAndAddToResult(nsIAtom* aName, const nsSubstring& aValue,
 
     nsIDocument* doc = aResultHolder->GetOwnerDoc();
     nsCOMPtr<nsIContent> elem;
-    nsresult rv = doc->CreateElem(nsDependentAtomString(aName),
-                                  nsnull, kNameSpaceID_None, PR_FALSE,
+    nsresult rv = doc->CreateElem(nsAtomString(aName), nsnull, kNameSpaceID_None, PR_FALSE,
                                   getter_AddRefs(elem));
     NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/content/xslt/src/xslt/txMozillaTextOutput.cpp b/content/xslt/src/xslt/txMozillaTextOutput.cpp
index 1c4e9b1d5105..7fddd77e99e2 100644
--- a/content/xslt/src/xslt/txMozillaTextOutput.cpp
+++ b/content/xslt/src/xslt/txMozillaTextOutput.cpp
@@ -219,9 +219,8 @@ txMozillaTextOutput::createResultDocument(nsIDOMDocument* aSourceDocument,
             RegisterNameSpace(NS_LITERAL_STRING(kTXNameSpaceURI), namespaceID);
         NS_ENSURE_SUCCESS(rv, rv);
 
-        rv = mDocument->CreateElem(nsDependentAtomString(nsGkAtoms::result),
-                                   nsGkAtoms::transformiix, namespaceID,
-                                   PR_FALSE, getter_AddRefs(mTextParent));
+        rv = mDocument->CreateElem(nsAtomString(nsGkAtoms::result), nsGkAtoms::transformiix,
+                                   namespaceID, PR_FALSE, getter_AddRefs(mTextParent));
         NS_ENSURE_SUCCESS(rv, rv);
 
 
diff --git a/content/xslt/src/xslt/txMozillaXMLOutput.cpp b/content/xslt/src/xslt/txMozillaXMLOutput.cpp
index 0e017a8493a0..8d956ac93b6d 100644
--- a/content/xslt/src/xslt/txMozillaXMLOutput.cpp
+++ b/content/xslt/src/xslt/txMozillaXMLOutput.cpp
@@ -629,9 +629,8 @@ txMozillaXMLOutput::createTxWrapper()
     NS_ENSURE_SUCCESS(rv, rv);
 
     nsCOMPtr<nsIContent> wrapper;
-    rv = mDocument->CreateElem(nsDependentAtomString(nsGkAtoms::result),
-                               nsGkAtoms::transformiix, namespaceID,
-                               PR_FALSE, getter_AddRefs(wrapper));
+    rv = mDocument->CreateElem(nsAtomString(nsGkAtoms::result), nsGkAtoms::transformiix,
+                               namespaceID, PR_FALSE, getter_AddRefs(wrapper));
     NS_ENSURE_SUCCESS(rv, rv);
 
     PRUint32 i, j, childCount = mDocument->GetChildCount();
diff --git a/content/xul/document/src/nsXULDocument.cpp b/content/xul/document/src/nsXULDocument.cpp
index 85ae01c2aace..f622c726b68f 100644
--- a/content/xul/document/src/nsXULDocument.cpp
+++ b/content/xul/document/src/nsXULDocument.cpp
@@ -3833,11 +3833,10 @@ nsXULDocument::CreateTemplateBuilder(nsIContent* aElement)
                                           getter_AddRefs(bodyContent));
 
         if (! bodyContent) {
-            nsresult rv =
-                document->CreateElem(nsDependentAtomString(nsGkAtoms::treechildren),
-                                     nsnull, kNameSpaceID_XUL,
-                                     PR_FALSE,
-                                     getter_AddRefs(bodyContent));
+            nsresult rv = document->CreateElem(nsAtomString(nsGkAtoms::treechildren),
+                                               nsnull, kNameSpaceID_XUL,
+                                               PR_FALSE,
+                                               getter_AddRefs(bodyContent));
             NS_ENSURE_SUCCESS(rv, rv);
 
             aElement->AppendChildTo(bodyContent, PR_FALSE);

From 449d61b522bf9bb98e60b7448ec84aadba025f6b Mon Sep 17 00:00:00 2001
From: Alexander Surkov <surkov.alexander@gmail.com>
Date: Sun, 5 Sep 2010 11:14:01 +0900
Subject: [PATCH 153/222] Bug 592193 - add dexpcom version of
 nsIAccessible::role, part1: change GetRoleInternal, r=marcoz, a=davidb

---
 accessible/src/atk/nsMaiInterfaceAction.cpp   | 22 ++---
 accessible/src/atk/nsMaiInterfaceText.cpp     |  8 +-
 accessible/src/base/nsAccUtils.cpp            | 17 ----
 accessible/src/base/nsAccUtils.h              |  5 -
 accessible/src/base/nsAccessible.cpp          | 19 ++--
 accessible/src/base/nsAccessible.h            |  4 +-
 .../src/base/nsApplicationAccessible.cpp      | 11 ++-
 accessible/src/base/nsApplicationAccessible.h |  2 +-
 .../src/base/nsBaseWidgetAccessible.cpp       |  7 +-
 accessible/src/base/nsBaseWidgetAccessible.h  |  2 +-
 accessible/src/base/nsDocAccessible.cpp       | 28 +++---
 accessible/src/base/nsDocAccessible.h         |  2 +-
 .../src/base/nsFormControlAccessible.cpp      |  7 +-
 accessible/src/base/nsFormControlAccessible.h |  2 +-
 accessible/src/base/nsOuterDocAccessible.cpp  |  7 +-
 accessible/src/base/nsOuterDocAccessible.h    |  2 +-
 accessible/src/base/nsRootAccessible.cpp      | 19 ++--
 accessible/src/base/nsRootAccessible.h        |  2 +-
 accessible/src/base/nsTextAccessible.cpp      |  7 +-
 accessible/src/base/nsTextAccessible.h        |  2 +-
 .../src/html/nsHTMLFormControlAccessible.cpp  | 45 ++++-----
 .../src/html/nsHTMLFormControlAccessible.h    | 12 +--
 accessible/src/html/nsHTMLImageAccessible.cpp |  7 +-
 accessible/src/html/nsHTMLImageAccessible.h   |  2 +-
 .../src/html/nsHTMLImageMapAccessible.cpp     |  7 +-
 .../src/html/nsHTMLImageMapAccessible.h       |  2 +-
 accessible/src/html/nsHTMLLinkAccessible.cpp  |  7 +-
 accessible/src/html/nsHTMLLinkAccessible.h    |  2 +-
 .../src/html/nsHTMLSelectAccessible.cpp       | 34 +++----
 accessible/src/html/nsHTMLSelectAccessible.h  |  8 +-
 accessible/src/html/nsHTMLTableAccessible.cpp | 54 +++++-----
 accessible/src/html/nsHTMLTableAccessible.h   |  8 +-
 accessible/src/html/nsHTMLTextAccessible.cpp  | 55 +++++------
 accessible/src/html/nsHTMLTextAccessible.h    | 14 +--
 accessible/src/html/nsHyperTextAccessible.cpp | 57 +++++------
 accessible/src/html/nsHyperTextAccessible.h   |  2 +-
 .../src/msaa/nsHTMLWin32ObjectAccessible.cpp  |  9 +-
 .../src/msaa/nsHTMLWin32ObjectAccessible.h    |  2 +-
 accessible/src/xforms/nsXFormsAccessible.cpp  |  7 +-
 accessible/src/xforms/nsXFormsAccessible.h    |  2 +-
 .../xforms/nsXFormsFormControlsAccessible.cpp | 98 ++++++++-----------
 .../xforms/nsXFormsFormControlsAccessible.h   | 28 +++---
 .../src/xforms/nsXFormsWidgetsAccessible.cpp  | 21 ++--
 .../src/xforms/nsXFormsWidgetsAccessible.h    |  6 +-
 accessible/src/xul/nsXULAlertAccessible.cpp   |  7 +-
 accessible/src/xul/nsXULAlertAccessible.h     |  2 +-
 .../src/xul/nsXULColorPickerAccessible.cpp    | 14 ++-
 .../src/xul/nsXULColorPickerAccessible.h      |  4 +-
 .../src/xul/nsXULComboboxAccessible.cpp       | 17 +---
 accessible/src/xul/nsXULComboboxAccessible.h  |  2 +-
 .../src/xul/nsXULFormControlAccessible.cpp    | 77 ++++++---------
 .../src/xul/nsXULFormControlAccessible.h      | 20 ++--
 accessible/src/xul/nsXULListboxAccessible.cpp | 65 ++++++------
 accessible/src/xul/nsXULListboxAccessible.h   | 10 +-
 accessible/src/xul/nsXULMenuAccessible.cpp    | 69 ++++++-------
 accessible/src/xul/nsXULMenuAccessible.h      |  8 +-
 accessible/src/xul/nsXULSliderAccessible.cpp  | 17 ++--
 accessible/src/xul/nsXULSliderAccessible.h    |  4 +-
 accessible/src/xul/nsXULTabAccessible.cpp     | 28 +++---
 accessible/src/xul/nsXULTabAccessible.h       |  8 +-
 accessible/src/xul/nsXULTextAccessible.cpp    | 21 ++--
 accessible/src/xul/nsXULTextAccessible.h      |  6 +-
 accessible/src/xul/nsXULTreeAccessible.cpp    | 24 ++---
 accessible/src/xul/nsXULTreeAccessible.h      |  4 +-
 .../src/xul/nsXULTreeGridAccessible.cpp       | 27 +++--
 accessible/src/xul/nsXULTreeGridAccessible.h  |  6 +-
 66 files changed, 465 insertions(+), 639 deletions(-)

diff --git a/accessible/src/atk/nsMaiInterfaceAction.cpp b/accessible/src/atk/nsMaiInterfaceAction.cpp
index 9d682e4a9a84..4ab38930c4e8 100644
--- a/accessible/src/atk/nsMaiInterfaceAction.cpp
+++ b/accessible/src/atk/nsMaiInterfaceAction.cpp
@@ -124,11 +124,9 @@ getKeyBindingCB(AtkAction *aAction, gint aActionIndex)
     nsresult rv = accWrap->GetKeyboardShortcut(accessKey);
 
     if (NS_SUCCEEDED(rv) && !accessKey.IsEmpty()) {
-        nsCOMPtr<nsIAccessible> parentAccessible;
-        accWrap->GetParent(getter_AddRefs(parentAccessible));
-        if (parentAccessible) {
-          PRUint32 geckoRole = nsAccUtils::RoleInternal(parentAccessible);
-          PRUint32 atkRole = atkRoleMap[geckoRole];
+        nsAccessible* parent = accWrap->GetParent();
+        if (parent) {
+          PRUint32 atkRole = atkRoleMap[parent->NativeRole()];
 
             if (atkRole == ATK_ROLE_MENU_BAR) {
                 //it is topmenu, change from "Alt+f" to "f;<Alt>f"
@@ -140,11 +138,11 @@ getKeyBindingCB(AtkAction *aAction, gint aActionIndex)
             else if ((atkRole == ATK_ROLE_MENU) || (atkRole == ATK_ROLE_MENU_ITEM)) {
                 //it is submenu, change from "s" to "s;<Alt>f:s"
                 nsAutoString allKey = accessKey;
-                nsCOMPtr<nsIAccessible> grandParentAcc = parentAccessible;
+                nsAccessible* grandParent = parent;
 
-                while ((grandParentAcc) && (atkRole != ATK_ROLE_MENU_BAR)) {
+                do {
                     nsAutoString grandParentKey;
-                    grandParentAcc->GetKeyboardShortcut(grandParentKey);
+                    grandParent->GetKeyboardShortcut(grandParentKey);
 
                     if (!grandParentKey.IsEmpty()) {
                         nsAutoString rightChar;
@@ -152,11 +150,9 @@ getKeyBindingCB(AtkAction *aAction, gint aActionIndex)
                         allKey = rightChar + NS_LITERAL_STRING(":") + allKey;
                     }
 
-                    nsCOMPtr<nsIAccessible> tempAcc = grandParentAcc;
-                    tempAcc->GetParent(getter_AddRefs(grandParentAcc));
-                  geckoRole = nsAccUtils::RoleInternal(grandParentAcc);
-                  atkRole = atkRoleMap[geckoRole];
-                }
+                } while ((grandParent = grandParent->GetParent()) &&
+                         atkRoleMap[grandParent->NativeRole()] != ATK_ROLE_MENU_BAR);
+
                 allKeyBinding = accessKey + NS_LITERAL_STRING(";<Alt>") +
                                 allKey;
             }
diff --git a/accessible/src/atk/nsMaiInterfaceText.cpp b/accessible/src/atk/nsMaiInterfaceText.cpp
index 2a946e1479dc..d8089dd30d89 100644
--- a/accessible/src/atk/nsMaiInterfaceText.cpp
+++ b/accessible/src/atk/nsMaiInterfaceText.cpp
@@ -80,9 +80,7 @@ textInterfaceInitCB(AtkTextIface *aIface)
 void ConvertTexttoAsterisks(nsAccessibleWrap* accWrap, nsAString& aString)
 {
     // convert each char to "*" when it's "password text" 
-    PRUint32 accRole = 0;
-    accWrap->GetRoleInternal(&accRole);
-    PRUint32 atkRole = atkRoleMap[accRole];
+    PRUint32 atkRole = atkRoleMap[accWrap->NativeRole()];
     if (atkRole == ATK_ROLE_PASSWORD_TEXT) {
         for (PRUint32 i = 0; i < aString.Length(); i++)
             aString.Replace(i, 1, NS_LITERAL_STRING("*"));
@@ -189,9 +187,7 @@ getCharacterAtOffsetCB(AtkText *aText, gint aOffset)
         accText->GetCharacterAtOffset(aOffset, &uniChar);
 
     // convert char to "*" when it's "password text" 
-    PRUint32 accRole;
-    accWrap->GetRoleInternal(&accRole);
-    PRUint32 atkRole = atkRoleMap[accRole];
+    PRUint32 atkRole = atkRoleMap[accWrap->NativeRole()];
     if (atkRole == ATK_ROLE_PASSWORD_TEXT)
         uniChar = '*';
 
diff --git a/accessible/src/base/nsAccUtils.cpp b/accessible/src/base/nsAccUtils.cpp
index 51cfa07c7622..eaec26033984 100644
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -578,23 +578,6 @@ nsAccUtils::GetRoleMapEntry(nsINode *aNode)
   return &nsARIAMap::gLandmarkRoleMap;
 }
 
-PRUint32
-nsAccUtils::RoleInternal(nsIAccessible *aAcc)
-{
-  PRUint32 role = nsIAccessibleRole::ROLE_NOTHING;
-  if (aAcc) {
-    nsAccessible* accessible = nsnull;
-    CallQueryInterface(aAcc, &accessible);
-
-    if (accessible) {
-      accessible->GetRoleInternal(&role);
-      NS_RELEASE(accessible);
-    }
-  }
-
-  return role;
-}
-
 PRUint8
 nsAccUtils::GetAttributeCharacteristics(nsIAtom* aAtom)
 {
diff --git a/accessible/src/base/nsAccUtils.h b/accessible/src/base/nsAccUtils.h
index 85fd591c19bb..9f3812fd41ae 100644
--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -297,11 +297,6 @@ public:
     return role;
   }
 
-  /**
-   * Return the role from native markup of the given accessible.
-   */
-  static PRUint32 RoleInternal(nsIAccessible *aAcc);
-
   /**
    * Return the state for the given accessible.
    */
diff --git a/accessible/src/base/nsAccessible.cpp b/accessible/src/base/nsAccessible.cpp
index 3a32c796a2d5..b525aa418e98 100644
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -1308,7 +1308,8 @@ nsAccessible::GetRole(PRUint32 *aRole)
       return NS_OK;
   }
 
-  return GetRoleInternal(aRole);
+  *aRole = NativeRole();
+  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -1852,19 +1853,11 @@ nsAccessible::GetKeyBindings(PRUint8 aActionIndex,
   return NS_OK;
 }
 
-/* unsigned long getRole (); */
-nsresult
-nsAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_NOTHING;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  if (nsCoreUtils::IsXLink(mContent))
-    *aRole = nsIAccessibleRole::ROLE_LINK;
-
-  return NS_OK;
+  return nsCoreUtils::IsXLink(mContent) ?
+    nsIAccessibleRole::ROLE_LINK : nsIAccessibleRole::ROLE_NOTHING;
 }
 
 // readonly attribute PRUint8 numActions
diff --git a/accessible/src/base/nsAccessible.h b/accessible/src/base/nsAccessible.h
index 85a3e54d946d..bfb0ccf30787 100644
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -146,10 +146,8 @@ public:
   /**
    * Returns enumerated accessible role from native markup (see constants in
    * nsIAccessibleRole). Doesn't take into account ARIA roles.
-   *
-   * @param aRole  [out] accessible role.
    */
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 
   /**
    * Return the state of accessible that doesn't take into account ARIA states.
diff --git a/accessible/src/base/nsApplicationAccessible.cpp b/accessible/src/base/nsApplicationAccessible.cpp
index 1b5a40469a08..168c4c97c241 100644
--- a/accessible/src/base/nsApplicationAccessible.cpp
+++ b/accessible/src/base/nsApplicationAccessible.cpp
@@ -143,7 +143,9 @@ NS_IMETHODIMP
 nsApplicationAccessible::GetRole(PRUint32 *aRole)
 {
   NS_ENSURE_ARG_POINTER(aRole);
-  return GetRoleInternal(aRole);
+  *aRole = NativeRole();
+
+  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -379,11 +381,10 @@ nsApplicationAccessible::GetARIAState(PRUint32 *aState, PRUint32 *aExtraState)
   return NS_OK;
 }
 
-nsresult
-nsApplicationAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsApplicationAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_APP_ROOT;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_APP_ROOT;
 }
 
 nsresult
diff --git a/accessible/src/base/nsApplicationAccessible.h b/accessible/src/base/nsApplicationAccessible.h
index 0abed936bc88..ff38e61c2200 100644
--- a/accessible/src/base/nsApplicationAccessible.h
+++ b/accessible/src/base/nsApplicationAccessible.h
@@ -113,7 +113,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetARIAState(PRUint32 *aState, PRUint32 *aExtraState);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
   virtual void InvalidateChildren();
diff --git a/accessible/src/base/nsBaseWidgetAccessible.cpp b/accessible/src/base/nsBaseWidgetAccessible.cpp
index 223ce3fd3ee3..db316e5c2f89 100644
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -302,9 +302,8 @@ nsEnumRoleAccessible::
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsEnumRoleAccessible, nsAccessible)
 
-nsresult
-nsEnumRoleAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsEnumRoleAccessible::NativeRole()
 {
-  *aRole = mRole;
-  return NS_OK;
+  return mRole;
 }
diff --git a/accessible/src/base/nsBaseWidgetAccessible.h b/accessible/src/base/nsBaseWidgetAccessible.h
index 83ff99f958fd..74245e034b16 100644
--- a/accessible/src/base/nsBaseWidgetAccessible.h
+++ b/accessible/src/base/nsBaseWidgetAccessible.h
@@ -135,7 +135,7 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 
 protected:
   PRUint32 mRole;
diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
index 99ccb5f4dae4..e4ab3e490449 100644
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -203,11 +203,9 @@ nsDocAccessible::GetName(nsAString& aName)
 }
 
 // nsAccessible public method
-nsresult
-nsDocAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsDocAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PANE; // Fall back
-
   nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
     nsCoreUtils::GetDocShellTreeItemFor(mDocument);
   if (docShellTreeItem) {
@@ -217,28 +215,24 @@ nsDocAccessible::GetRoleInternal(PRUint32 *aRole)
     docShellTreeItem->GetItemType(&itemType);
     if (sameTypeRoot == docShellTreeItem) {
       // Root of content or chrome tree
-      if (itemType == nsIDocShellTreeItem::typeChrome) {
-        *aRole = nsIAccessibleRole::ROLE_CHROME_WINDOW;
-      }
-      else if (itemType == nsIDocShellTreeItem::typeContent) {
+      if (itemType == nsIDocShellTreeItem::typeChrome)
+        return nsIAccessibleRole::ROLE_CHROME_WINDOW;
+
+      if (itemType == nsIDocShellTreeItem::typeContent) {
 #ifdef MOZ_XUL
         nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
-        if (xulDoc) {
-          *aRole = nsIAccessibleRole::ROLE_APPLICATION;
-        } else {
-          *aRole = nsIAccessibleRole::ROLE_DOCUMENT;
-        }
-#else
-        *aRole = nsIAccessibleRole::ROLE_DOCUMENT;
+        if (xulDoc)
+          return nsIAccessibleRole::ROLE_APPLICATION;
 #endif
+        return nsIAccessibleRole::ROLE_DOCUMENT;
       }
     }
     else if (itemType == nsIDocShellTreeItem::typeContent) {
-      *aRole = nsIAccessibleRole::ROLE_DOCUMENT;
+      return nsIAccessibleRole::ROLE_DOCUMENT;
     }
   }
 
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PANE; // Fall back;
 }
 
 // nsAccessible public method
diff --git a/accessible/src/base/nsDocAccessible.h b/accessible/src/base/nsDocAccessible.h
index 296ae2720f0e..1faff719d8a3 100644
--- a/accessible/src/base/nsDocAccessible.h
+++ b/accessible/src/base/nsDocAccessible.h
@@ -110,7 +110,7 @@ public:
   virtual nsINode* GetNode() const { return mDocument; }
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual nsresult GetARIAState(PRUint32 *aState, PRUint32 *aExtraState);
 
diff --git a/accessible/src/base/nsFormControlAccessible.cpp b/accessible/src/base/nsFormControlAccessible.cpp
index 66a251f8119b..af783f90632e 100644
--- a/accessible/src/base/nsFormControlAccessible.cpp
+++ b/accessible/src/base/nsFormControlAccessible.cpp
@@ -82,10 +82,9 @@ nsRadioButtonAccessible::DoAction(PRUint8 aIndex)
   return NS_OK;
 }
 
-nsresult
-nsRadioButtonAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsRadioButtonAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_RADIOBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_RADIOBUTTON;
 }
 
diff --git a/accessible/src/base/nsFormControlAccessible.h b/accessible/src/base/nsFormControlAccessible.h
index 8d8c959ef0e5..90cc10460a05 100644
--- a/accessible/src/base/nsFormControlAccessible.h
+++ b/accessible/src/base/nsFormControlAccessible.h
@@ -58,7 +58,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 
   enum { eAction_Click = 0 };
 };
diff --git a/accessible/src/base/nsOuterDocAccessible.cpp b/accessible/src/base/nsOuterDocAccessible.cpp
index 0e4c240f3be1..0983f34fcb3f 100644
--- a/accessible/src/base/nsOuterDocAccessible.cpp
+++ b/accessible/src/base/nsOuterDocAccessible.cpp
@@ -60,11 +60,10 @@ NS_IMPL_ISUPPORTS_INHERITED0(nsOuterDocAccessible,
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible public (DON'T add methods here)
 
-nsresult
-nsOuterDocAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsOuterDocAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_INTERNAL_FRAME;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_INTERNAL_FRAME;
 }
 
 nsresult
diff --git a/accessible/src/base/nsOuterDocAccessible.h b/accessible/src/base/nsOuterDocAccessible.h
index 8afff0b0ba6f..accff652be1b 100644
--- a/accessible/src/base/nsOuterDocAccessible.h
+++ b/accessible/src/base/nsOuterDocAccessible.h
@@ -67,7 +67,7 @@ public:
   virtual void Shutdown();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
   virtual nsresult GetChildAtPoint(PRInt32 aX, PRInt32 aY,
diff --git a/accessible/src/base/nsRootAccessible.cpp b/accessible/src/base/nsRootAccessible.cpp
index 2d317338e7ff..fedd396e2b7f 100644
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@@ -142,14 +142,9 @@ nsRootAccessible::GetName(nsAString& aName)
   return document->GetTitle(aName);
 }
 
-/* readonly attribute unsigned long accRole; */
-nsresult
-nsRootAccessible::GetRoleInternal(PRUint32 *aRole) 
-{ 
-  if (!mDocument) {
-    return NS_ERROR_FAILURE;
-  }
-
+PRUint32
+nsRootAccessible::NativeRole()
+{
   // If it's a <dialog> or <wizard>, use nsIAccessibleRole::ROLE_DIALOG instead
   dom::Element *root = mDocument->GetRootElement();
   if (root) {
@@ -158,13 +153,12 @@ nsRootAccessible::GetRoleInternal(PRUint32 *aRole)
       nsAutoString name;
       rootElement->GetLocalName(name);
       if (name.EqualsLiteral("dialog") || name.EqualsLiteral("wizard")) {
-        *aRole = nsIAccessibleRole::ROLE_DIALOG; // Always at the root
-        return NS_OK;
+        return nsIAccessibleRole::ROLE_DIALOG; // Always at the root
       }
     }
   }
 
-  return nsDocAccessibleWrap::GetRoleInternal(aRole);
+  return nsDocAccessibleWrap::NativeRole();
 }
 
 // nsRootAccessible protected member
@@ -395,8 +389,7 @@ nsRootAccessible::FireAccessibleFocusEvent(nsAccessible *aAccessible,
   if (role == nsIAccessibleRole::ROLE_MENUITEM) {
     if (!mCurrentARIAMenubar) {  // Entering menus
       // The natural role is the role that this type of element normally has
-      PRUint32 naturalRole = nsAccUtils::RoleInternal(finalFocusAccessible);
-      if (role != naturalRole) { // Must be a DHTML menuitem
+      if (role != finalFocusAccessible->NativeRole()) { // Must be a DHTML menuitem
         nsAccessible *menuBarAccessible =
           nsAccUtils::GetAncestorWithRole(finalFocusAccessible,
                                           nsIAccessibleRole::ROLE_MENUBAR);
diff --git a/accessible/src/base/nsRootAccessible.h b/accessible/src/base/nsRootAccessible.h
index 3b64fd17f286..a4547a1cbcac 100644
--- a/accessible/src/base/nsRootAccessible.h
+++ b/accessible/src/base/nsRootAccessible.h
@@ -84,7 +84,7 @@ public:
   virtual void Shutdown();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
   // nsRootAccessible
diff --git a/accessible/src/base/nsTextAccessible.cpp b/accessible/src/base/nsTextAccessible.cpp
index 93b134a5ad36..835f3b7840df 100644
--- a/accessible/src/base/nsTextAccessible.cpp
+++ b/accessible/src/base/nsTextAccessible.cpp
@@ -50,11 +50,10 @@ nsTextAccessible::
 {
 }
 
-nsresult
-nsTextAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsTextAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_TEXT_LEAF;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_TEXT_LEAF;
 }
 
 nsresult
diff --git a/accessible/src/base/nsTextAccessible.h b/accessible/src/base/nsTextAccessible.h
index f8044615159a..0e3c7795824a 100644
--- a/accessible/src/base/nsTextAccessible.h
+++ b/accessible/src/base/nsTextAccessible.h
@@ -50,7 +50,7 @@ public:
   nsTextAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult AppendTextTo(nsAString& aText, PRUint32 aStartOffset,
                                 PRUint32 aLength);
 
diff --git a/accessible/src/html/nsHTMLFormControlAccessible.cpp b/accessible/src/html/nsHTMLFormControlAccessible.cpp
index 9f34a5c2289a..15d5836a33a3 100644
--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
+++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
@@ -69,11 +69,10 @@ nsHTMLCheckboxAccessible::
 {
 }
 
-nsresult
-nsHTMLCheckboxAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLCheckboxAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_CHECKBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_CHECKBUTTON;
 }
 
 NS_IMETHODIMP nsHTMLCheckboxAccessible::GetNumActions(PRUint8 *_retval)
@@ -282,11 +281,10 @@ nsHTMLButtonAccessible::GetStateInternal(PRUint32 *aState,
   return NS_OK;
 }
 
-nsresult
-nsHTMLButtonAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLButtonAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PUSHBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PUSHBUTTON;
 }
 
 nsresult
@@ -359,11 +357,10 @@ nsHTML4ButtonAccessible::DoAction(PRUint8 aIndex)
   return NS_OK;
 }
 
-nsresult
-nsHTML4ButtonAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTML4ButtonAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PUSHBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PUSHBUTTON;
 }
 
 nsresult
@@ -396,16 +393,14 @@ nsHTMLTextFieldAccessible::
 
 NS_IMPL_ISUPPORTS_INHERITED3(nsHTMLTextFieldAccessible, nsAccessible, nsHyperTextAccessible, nsIAccessibleText, nsIAccessibleEditableText)
 
-nsresult
-nsHTMLTextFieldAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLTextFieldAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_ENTRY;
-
   if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
                             nsAccessibilityAtoms::password, eIgnoreCase)) {
-    *aRole = nsIAccessibleRole::ROLE_PASSWORD_TEXT;
+    return nsIAccessibleRole::ROLE_PASSWORD_TEXT;
   }
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_ENTRY;
 }
 
 nsresult
@@ -588,11 +583,10 @@ nsHTMLGroupboxAccessible::
 {
 }
 
-nsresult
-nsHTMLGroupboxAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLGroupboxAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_GROUPING;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_GROUPING;
 }
 
 nsIContent* nsHTMLGroupboxAccessible::GetLegend()
@@ -687,9 +681,8 @@ nsHTMLLegendAccessible::GetRelationByType(PRUint32 aRelationType,
   return NS_OK;
 }
 
-nsresult
-nsHTMLLegendAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLLegendAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LABEL;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LABEL;
 }
diff --git a/accessible/src/html/nsHTMLFormControlAccessible.h b/accessible/src/html/nsHTMLFormControlAccessible.h
index da0850220ec6..a191264d866f 100644
--- a/accessible/src/html/nsHTMLFormControlAccessible.h
+++ b/accessible/src/html/nsHTMLFormControlAccessible.h
@@ -59,7 +59,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -99,7 +99,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -121,7 +121,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -150,7 +150,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -169,7 +169,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 
 protected:
   nsIContent* GetLegend();
@@ -189,7 +189,7 @@ public:
                                nsIAccessibleRelation **aRelation);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 #endif  
diff --git a/accessible/src/html/nsHTMLImageAccessible.cpp b/accessible/src/html/nsHTMLImageAccessible.cpp
index 15366b0a2709..9f4481f6f8ca 100644
--- a/accessible/src/html/nsHTMLImageAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageAccessible.cpp
@@ -120,11 +120,10 @@ nsHTMLImageAccessible::GetNameInternal(nsAString& aName)
   return NS_OK;
 }
 
-nsresult
-nsHTMLImageAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLImageAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_GRAPHIC;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_GRAPHIC;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/accessible/src/html/nsHTMLImageAccessible.h b/accessible/src/html/nsHTMLImageAccessible.h
index 374d8f704daf..72cbb5ce2ba8 100644
--- a/accessible/src/html/nsHTMLImageAccessible.h
+++ b/accessible/src/html/nsHTMLImageAccessible.h
@@ -66,7 +66,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
 
diff --git a/accessible/src/html/nsHTMLImageMapAccessible.cpp b/accessible/src/html/nsHTMLImageMapAccessible.cpp
index f529ddbfd4f9..c73839002b97 100644
--- a/accessible/src/html/nsHTMLImageMapAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageMapAccessible.cpp
@@ -68,11 +68,10 @@ NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLImageMapAccessible, nsHTMLImageAccessible)
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLImageMapAccessible: nsAccessible public
 
-nsresult
-nsHTMLImageMapAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLImageMapAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_IMAGE_MAP;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_IMAGE_MAP;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/accessible/src/html/nsHTMLImageMapAccessible.h b/accessible/src/html/nsHTMLImageMapAccessible.h
index 76d7010cd978..8a53faad2779 100644
--- a/accessible/src/html/nsHTMLImageMapAccessible.h
+++ b/accessible/src/html/nsHTMLImageMapAccessible.h
@@ -58,7 +58,7 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 
   // HyperLinkAccessible
   virtual PRUint32 AnchorCount();
diff --git a/accessible/src/html/nsHTMLLinkAccessible.cpp b/accessible/src/html/nsHTMLLinkAccessible.cpp
index de28f85da128..4490b0141f59 100644
--- a/accessible/src/html/nsHTMLLinkAccessible.cpp
+++ b/accessible/src/html/nsHTMLLinkAccessible.cpp
@@ -60,11 +60,10 @@ NS_IMPL_ISUPPORTS_INHERITED1(nsHTMLLinkAccessible, nsHyperTextAccessibleWrap,
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessible
 
-nsresult
-nsHTMLLinkAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLLinkAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LINK;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LINK;
 }
 
 nsresult
diff --git a/accessible/src/html/nsHTMLLinkAccessible.h b/accessible/src/html/nsHTMLLinkAccessible.h
index a9b1972000c5..9ce14e856346 100644
--- a/accessible/src/html/nsHTMLLinkAccessible.h
+++ b/accessible/src/html/nsHTMLLinkAccessible.h
@@ -57,7 +57,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
   // HyperLinkAccessible
diff --git a/accessible/src/html/nsHTMLSelectAccessible.cpp b/accessible/src/html/nsHTMLSelectAccessible.cpp
index 2d08951cc917..276f5894f748 100644
--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
@@ -101,15 +101,13 @@ nsHTMLSelectListAccessible::GetStateInternal(PRUint32 *aState,
   return NS_OK;
 }
 
-nsresult
-nsHTMLSelectListAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLSelectListAccessible::NativeRole()
 {
   if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX)
-    *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
-  else
-    *aRole = nsIAccessibleRole::ROLE_LISTBOX;
+    return nsIAccessibleRole::ROLE_COMBOBOX_LIST;
 
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LISTBOX;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -198,15 +196,13 @@ nsHTMLSelectOptionAccessible::
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectOptionAccessible: nsAccessible public
 
-nsresult
-nsHTMLSelectOptionAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLSelectOptionAccessible::NativeRole()
 {
   if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
-    *aRole = nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
-  else
-    *aRole = nsIAccessibleRole::ROLE_OPTION;
+    return nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
 
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_OPTION;
 }
 
 nsresult
@@ -621,11 +617,10 @@ nsHTMLSelectOptGroupAccessible::
 {
 }
 
-nsresult
-nsHTMLSelectOptGroupAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLSelectOptGroupAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_HEADING;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_HEADING;
 }
 
 nsresult
@@ -681,11 +676,10 @@ nsHTMLComboboxAccessible::
 {
 }
 
-nsresult
-nsHTMLComboboxAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLComboboxAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_COMBOBOX;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_COMBOBOX;
 }
 
 void
diff --git a/accessible/src/html/nsHTMLSelectAccessible.h b/accessible/src/html/nsHTMLSelectAccessible.h
index bbf2d3774614..4089dcff1334 100644
--- a/accessible/src/html/nsHTMLSelectAccessible.h
+++ b/accessible/src/html/nsHTMLSelectAccessible.h
@@ -73,7 +73,7 @@ public:
   virtual ~nsHTMLSelectListAccessible() {}
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
   // SelectAccessible
@@ -113,7 +113,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
   virtual PRInt32 GetLevelInternal();
@@ -158,7 +158,7 @@ public:
   NS_IMETHOD GetNumActions(PRUint8 *_retval);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
@@ -194,7 +194,7 @@ public:
   virtual void Shutdown();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
diff --git a/accessible/src/html/nsHTMLTableAccessible.cpp b/accessible/src/html/nsHTMLTableAccessible.cpp
index bfcd7fdf35fa..6eed6dc2387b 100644
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -86,11 +86,10 @@ NS_IMPL_ISUPPORTS_INHERITED1(nsHTMLTableCellAccessible,
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableCellAccessible: nsAccessible implementation
 
-nsresult
-nsHTMLTableCellAccessible::GetRoleInternal(PRUint32 *aResult)
+PRUint32
+nsHTMLTableCellAccessible::NativeRole()
 {
-  *aResult = nsIAccessibleRole::ROLE_CELL;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_CELL;
 }
 
 nsresult
@@ -372,8 +371,8 @@ nsHTMLTableHeaderCellAccessible::
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableHeaderAccessible: nsAccessible implementation
 
-nsresult
-nsHTMLTableHeaderCellAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLTableHeaderCellAccessible::NativeRole()
 {
   // Check value of @scope attribute.
   static nsIContent::AttrValuesArray scopeValues[] =
@@ -384,17 +383,18 @@ nsHTMLTableHeaderCellAccessible::GetRoleInternal(PRUint32 *aRole)
 
   switch (valueIdx) {
     case 0:
-      *aRole = nsIAccessibleRole::ROLE_COLUMNHEADER;
-      return NS_OK;
+      return nsIAccessibleRole::ROLE_COLUMNHEADER;
     case 1:
-      *aRole = nsIAccessibleRole::ROLE_ROWHEADER;
-      return NS_OK;
+      return nsIAccessibleRole::ROLE_ROWHEADER;
   }
 
   // Assume it's columnheader if there are headers in siblings, oterwise
   // rowheader.
   nsIContent *parent = mContent->GetParent();
-  NS_ENSURE_STATE(parent);
+  if (!parent) {
+    NS_ERROR("Deattached content on alive accessible?");
+    return nsIAccessibleRole::ROLE_NOTHING;
+  }
 
   PRInt32 indexInParent = parent->IndexOf(mContent);
 
@@ -402,11 +402,8 @@ nsHTMLTableHeaderCellAccessible::GetRoleInternal(PRUint32 *aRole)
     nsIContent* sibling = parent->GetChildAt(idx);
     if (sibling && sibling->IsElement()) {
       if (nsCoreUtils::IsHTMLTableHeader(sibling))
-        *aRole = nsIAccessibleRole::ROLE_COLUMNHEADER;
-      else
-        *aRole = nsIAccessibleRole::ROLE_ROWHEADER;
-
-      return NS_OK;
+        return nsIAccessibleRole::ROLE_COLUMNHEADER;
+      return nsIAccessibleRole::ROLE_ROWHEADER;
     }
   }
 
@@ -415,19 +412,14 @@ nsHTMLTableHeaderCellAccessible::GetRoleInternal(PRUint32 *aRole)
     nsIContent* sibling = parent->GetChildAt(idx);
     if (sibling && sibling->IsElement()) {
       if (nsCoreUtils::IsHTMLTableHeader(sibling))
-        *aRole = nsIAccessibleRole::ROLE_COLUMNHEADER;
-      else
-        *aRole = nsIAccessibleRole::ROLE_ROWHEADER;
-      
-      return NS_OK;
+        return nsIAccessibleRole::ROLE_COLUMNHEADER;
+      return nsIAccessibleRole::ROLE_ROWHEADER;
     }
   }
 
   // No elements in siblings what means the table has one column only. Therefore
   // it should be column header.
-  *aRole = nsIAccessibleRole::ROLE_COLUMNHEADER;
-
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_COLUMNHEADER;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -470,11 +462,10 @@ nsHTMLTableAccessible::CacheChildren()
   }
 }
 
-nsresult
-nsHTMLTableAccessible::GetRoleInternal(PRUint32 *aResult)
+PRUint32
+nsHTMLTableAccessible::NativeRole()
 {
-  *aResult = nsIAccessibleRole::ROLE_TABLE;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_TABLE;
 }
 
 nsresult
@@ -1560,9 +1551,8 @@ nsHTMLCaptionAccessible::GetRelationByType(PRUint32 aRelationType,
   return NS_OK;
 }
 
-nsresult
-nsHTMLCaptionAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLCaptionAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_CAPTION;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_CAPTION;
 }
diff --git a/accessible/src/html/nsHTMLTableAccessible.h b/accessible/src/html/nsHTMLTableAccessible.h
index 952e6fdf025c..754f170b3b33 100644
--- a/accessible/src/html/nsHTMLTableAccessible.h
+++ b/accessible/src/html/nsHTMLTableAccessible.h
@@ -61,7 +61,7 @@ public:
   NS_DECL_NSIACCESSIBLETABLECELL
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
 
@@ -99,7 +99,7 @@ public:
                                   nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 
@@ -137,7 +137,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
 
@@ -215,7 +215,7 @@ public:
                                nsIAccessibleRelation **aRelation);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 #endif  
diff --git a/accessible/src/html/nsHTMLTextAccessible.cpp b/accessible/src/html/nsHTMLTextAccessible.cpp
index be66e84d910b..309e0faa40ec 100644
--- a/accessible/src/html/nsHTMLTextAccessible.cpp
+++ b/accessible/src/html/nsHTMLTextAccessible.cpp
@@ -68,18 +68,17 @@ nsHTMLTextAccessible::GetName(nsAString& aName)
   return AppendTextTo(aName, 0, PR_UINT32_MAX);
 }
 
-nsresult
-nsHTMLTextAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLTextAccessible::NativeRole()
 {
   nsIFrame *frame = GetFrame();
   // Don't return on null frame -- we still return a role
   // after accessible is shutdown/DEFUNCT
   if (frame && frame->IsGeneratedContentFrame()) {
-    *aRole = nsIAccessibleRole::ROLE_STATICTEXT;
-    return NS_OK;
+    return nsIAccessibleRole::ROLE_STATICTEXT;
   }
 
-  return nsTextAccessible::GetRoleInternal(aRole);
+  return nsTextAccessible::NativeRole();
 }
 
 nsresult
@@ -103,9 +102,7 @@ nsHTMLTextAccessible::GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState)
 nsresult
 nsHTMLTextAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)
 {
-  PRUint32 role;
-  GetRoleInternal(&role);
-  if (role == nsIAccessibleRole::ROLE_STATICTEXT) {
+  if (NativeRole() == nsIAccessibleRole::ROLE_STATICTEXT) {
     nsAutoString oldValueUnused;
     aAttributes->SetStringProperty(NS_LITERAL_CSTRING("auto-generated"),
                                   NS_LITERAL_STRING("true"), oldValueUnused);
@@ -125,11 +122,10 @@ nsHTMLHRAccessible::
 {
 }
 
-nsresult
-nsHTMLHRAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLHRAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_SEPARATOR;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_SEPARATOR;
 }
 
 
@@ -143,11 +139,10 @@ nsHTMLBRAccessible::
 {
 }
 
-nsresult
-nsHTMLBRAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLBRAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_WHITESPACE;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_WHITESPACE;
 }
 
 nsresult
@@ -194,11 +189,10 @@ nsHTMLLabelAccessible::GetNameInternal(nsAString& aName)
   return nsTextEquivUtils::GetNameFromSubtree(this, aName);
 }
 
-nsresult
-nsHTMLLabelAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLLabelAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LABEL;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LABEL;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -232,11 +226,10 @@ nsHTMLLIAccessible::Shutdown()
   mBulletAccessible = nsnull;
 }
 
-nsresult
-nsHTMLLIAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLLIAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LISTITEM;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LISTITEM;
 }
 
 nsresult
@@ -315,11 +308,10 @@ nsHTMLListBulletAccessible::GetName(nsAString &aName)
   return NS_OK;
 }
 
-nsresult
-nsHTMLListBulletAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLListBulletAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_STATICTEXT;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_STATICTEXT;
 }
 
 nsresult
@@ -357,11 +349,10 @@ nsHTMLListAccessible::
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLListAccessible, nsHyperTextAccessible)
 
-nsresult
-nsHTMLListAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLListAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LIST;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LIST;
 }
 
 nsresult
diff --git a/accessible/src/html/nsHTMLTextAccessible.h b/accessible/src/html/nsHTMLTextAccessible.h
index 3e523ab2fb66..1635a95ce620 100644
--- a/accessible/src/html/nsHTMLTextAccessible.h
+++ b/accessible/src/html/nsHTMLTextAccessible.h
@@ -60,7 +60,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -73,7 +73,7 @@ public:
   nsHTMLHRAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 /**
@@ -86,7 +86,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -102,7 +102,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 /**
@@ -124,7 +124,7 @@ public:
   virtual void Shutdown();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual nsresult AppendTextTo(nsAString& aText, PRUint32 aStartOffset,
                                 PRUint32 aLength);
@@ -151,7 +151,7 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -174,7 +174,7 @@ public:
   virtual void Shutdown();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
diff --git a/accessible/src/html/nsHyperTextAccessible.cpp b/accessible/src/html/nsHyperTextAccessible.cpp
index 6d91e2b24e95..fe02c1020cf0 100644
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -126,42 +126,35 @@ nsresult nsHyperTextAccessible::QueryInterface(REFNSIID aIID, void** aInstancePt
   return nsAccessible::QueryInterface(aIID, aInstancePtr);
 }
 
-nsresult
-nsHyperTextAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHyperTextAccessible::NativeRole()
 {
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
   nsIAtom *tag = mContent->Tag();
 
-  if (tag == nsAccessibilityAtoms::form) {
-    *aRole = nsIAccessibleRole::ROLE_FORM;
+  if (tag == nsAccessibilityAtoms::form)
+    return nsIAccessibleRole::ROLE_FORM;
+
+  if (tag == nsAccessibilityAtoms::div ||
+      tag == nsAccessibilityAtoms::blockquote)
+    return nsIAccessibleRole::ROLE_SECTION;
+
+  if (tag == nsAccessibilityAtoms::h1 ||
+      tag == nsAccessibilityAtoms::h2 ||
+      tag == nsAccessibilityAtoms::h3 ||
+      tag == nsAccessibilityAtoms::h4 ||
+      tag == nsAccessibilityAtoms::h5 ||
+      tag == nsAccessibilityAtoms::h6)
+    return nsIAccessibleRole::ROLE_HEADING;
+
+  nsIFrame *frame = GetFrame();
+  if (frame && frame->GetType() == nsAccessibilityAtoms::blockFrame &&
+      frame->GetContent()->Tag() != nsAccessibilityAtoms::input) {
+    // An html:input @type="file" is the only input that is exposed as a
+    // blockframe. It must be exposed as ROLE_TEXT_CONTAINER for JAWS.
+    return nsIAccessibleRole::ROLE_PARAGRAPH;
   }
-  else if (tag == nsAccessibilityAtoms::div ||
-           tag == nsAccessibilityAtoms::blockquote) {
-    *aRole = nsIAccessibleRole::ROLE_SECTION;
-  }
-  else if (tag == nsAccessibilityAtoms::h1 ||
-           tag == nsAccessibilityAtoms::h2 ||
-           tag == nsAccessibilityAtoms::h3 ||
-           tag == nsAccessibilityAtoms::h4 ||
-           tag == nsAccessibilityAtoms::h5 ||
-           tag == nsAccessibilityAtoms::h6) {
-    *aRole = nsIAccessibleRole::ROLE_HEADING;
-  }
-  else {
-    nsIFrame *frame = GetFrame();
-    if (frame && frame->GetType() == nsAccessibilityAtoms::blockFrame &&
-        frame->GetContent()->Tag() != nsAccessibilityAtoms::input) {
-      // An html:input @type="file" is the only input that is exposed as a
-      // blockframe. It must be exposed as ROLE_TEXT_CONTAINER for JAWS.
-      *aRole = nsIAccessibleRole::ROLE_PARAGRAPH;
-    }
-    else {
-      *aRole = nsIAccessibleRole::ROLE_TEXT_CONTAINER; // In ATK this works
-    }
-  }
-  return NS_OK;
+
+  return nsIAccessibleRole::ROLE_TEXT_CONTAINER; // In ATK this works
 }
 
 nsresult
diff --git a/accessible/src/html/nsHyperTextAccessible.h b/accessible/src/html/nsHyperTextAccessible.h
index 788ba9a397c5..f225e39b8db6 100644
--- a/accessible/src/html/nsHyperTextAccessible.h
+++ b/accessible/src/html/nsHyperTextAccessible.h
@@ -86,7 +86,7 @@ public:
   // nsAccessible
   virtual PRInt32 GetLevelInternal();
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
   virtual void InvalidateChildren();
diff --git a/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp b/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
index db8fa8db6b72..9159e3760ded 100644
--- a/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
+++ b/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
@@ -64,13 +64,10 @@ nsHTMLWin32ObjectOwnerAccessible::Shutdown()
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLWin32ObjectOwnerAccessible: nsAccessible implementation
 
-nsresult
-nsHTMLWin32ObjectOwnerAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsHTMLWin32ObjectOwnerAccessible::NativeRole()
 {
-  NS_ENSURE_ARG_POINTER(aRole);
-
-  *aRole = nsIAccessibleRole::ROLE_EMBEDDED_OBJECT;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_EMBEDDED_OBJECT;
 }
 
 nsresult
diff --git a/accessible/src/msaa/nsHTMLWin32ObjectAccessible.h b/accessible/src/msaa/nsHTMLWin32ObjectAccessible.h
index cae0e4b830e6..a3f6d6076fa7 100644
--- a/accessible/src/msaa/nsHTMLWin32ObjectAccessible.h
+++ b/accessible/src/msaa/nsHTMLWin32ObjectAccessible.h
@@ -61,7 +61,7 @@ public:
   virtual void Shutdown();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
diff --git a/accessible/src/xforms/nsXFormsAccessible.cpp b/accessible/src/xforms/nsXFormsAccessible.cpp
index 3534e8ca452e..f6530d0496c9 100644
--- a/accessible/src/xforms/nsXFormsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsAccessible.cpp
@@ -244,11 +244,10 @@ nsXFormsContainerAccessible::
 {
 }
 
-nsresult
-nsXFormsContainerAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsContainerAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_GROUPING;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_GROUPING;
 }
 
 PRBool
diff --git a/accessible/src/xforms/nsXFormsAccessible.h b/accessible/src/xforms/nsXFormsAccessible.h
index 6fe316981bb3..543a6bcdb93e 100644
--- a/accessible/src/xforms/nsXFormsAccessible.h
+++ b/accessible/src/xforms/nsXFormsAccessible.h
@@ -128,7 +128,7 @@ public:
   nsXFormsContainerAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 
   // Allows accessible nodes in anonymous content of xforms element by
   // always returning PR_TRUE value.
diff --git a/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp b/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
index a0db92b864a5..cc4a16156531 100644
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
@@ -50,11 +50,10 @@ nsXFormsLabelAccessible::
 {
 }
 
-nsresult
-nsXFormsLabelAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsLabelAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LABEL;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LABEL;
 }
 
 nsresult
@@ -86,11 +85,10 @@ nsXFormsOutputAccessible::
 {
 }
 
-nsresult
-nsXFormsOutputAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsOutputAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_STATICTEXT;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_STATICTEXT;
 }
 
 
@@ -104,11 +102,10 @@ nsXFormsTriggerAccessible::
 {
 }
 
-nsresult
-nsXFormsTriggerAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsTriggerAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PUSHBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PUSHBUTTON;
 }
 
 NS_IMETHODIMP
@@ -160,11 +157,10 @@ nsXFormsInputAccessible::
 
 NS_IMPL_ISUPPORTS_INHERITED3(nsXFormsInputAccessible, nsAccessible, nsHyperTextAccessible, nsIAccessibleText, nsIAccessibleEditableText)
 
-nsresult
-nsXFormsInputAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsInputAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_ENTRY;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_ENTRY;
 }
 
 NS_IMETHODIMP
@@ -207,11 +203,10 @@ nsXFormsInputBooleanAccessible::
 {
 }
 
-nsresult
-nsXFormsInputBooleanAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsInputBooleanAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_CHECKBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_CHECKBUTTON;
 }
 
 nsresult
@@ -281,11 +276,10 @@ nsXFormsInputDateAccessible::
 {
 }
 
-nsresult
-nsXFormsInputDateAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsInputDateAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_DROPLIST;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_DROPLIST;
 }
 
 
@@ -299,11 +293,10 @@ nsXFormsSecretAccessible::
 {
 }
 
-nsresult
-nsXFormsSecretAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsSecretAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PASSWORD_TEXT;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PASSWORD_TEXT;
 }
 
 nsresult
@@ -334,11 +327,10 @@ nsXFormsRangeAccessible::
 {
 }
 
-nsresult
-nsXFormsRangeAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsRangeAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_SLIDER;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_SLIDER;
 }
 
 nsresult
@@ -460,11 +452,10 @@ nsXFormsChoicesAccessible::
 {
 }
 
-nsresult
-nsXFormsChoicesAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsChoicesAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_GROUPING;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_GROUPING;
 }
 
 NS_IMETHODIMP
@@ -491,11 +482,10 @@ nsXFormsSelectFullAccessible::
 {
 }
 
-nsresult
-nsXFormsSelectFullAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsSelectFullAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_GROUPING;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_GROUPING;
 }
 
 void
@@ -515,11 +505,10 @@ nsXFormsItemCheckgroupAccessible::
 {
 }
 
-nsresult
-nsXFormsItemCheckgroupAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsItemCheckgroupAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_CHECKBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_CHECKBUTTON;
 }
 
 nsresult
@@ -561,11 +550,10 @@ nsXFormsItemRadiogroupAccessible::
 {
 }
 
-nsresult
-nsXFormsItemRadiogroupAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsItemRadiogroupAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_RADIOBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_RADIOBUTTON;
 }
 
 nsresult
@@ -603,11 +591,10 @@ nsXFormsSelectComboboxAccessible::
 {
 }
 
-nsresult
-nsXFormsSelectComboboxAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsSelectComboboxAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_COMBOBOX;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_COMBOBOX;
 }
 
 nsresult
@@ -650,11 +637,10 @@ nsXFormsItemComboboxAccessible::
 {
 }
 
-nsresult
-nsXFormsItemComboboxAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsItemComboboxAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LISTITEM;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LISTITEM;
 }
 
 nsresult
diff --git a/accessible/src/xforms/nsXFormsFormControlsAccessible.h b/accessible/src/xforms/nsXFormsFormControlsAccessible.h
index 470757b92601..64502d26f3eb 100644
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.h
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.h
@@ -55,7 +55,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 /**
@@ -68,7 +68,7 @@ public:
   nsXFormsOutputAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 /**
@@ -88,7 +88,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 /**
@@ -108,7 +108,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 /**
@@ -126,7 +126,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -140,7 +140,7 @@ public:
   nsXFormsInputDateAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 /**
@@ -156,7 +156,7 @@ public:
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -177,7 +177,7 @@ public:
   NS_IMETHOD GetCurrentValue(double *aCurrentValue);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -210,7 +210,7 @@ public:
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 
 protected:
   // nsAccessible
@@ -229,7 +229,7 @@ public:
   nsXFormsSelectFullAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 
 protected:
   // nsAccessible
@@ -253,7 +253,7 @@ public:
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -274,7 +274,7 @@ public:
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -291,7 +291,7 @@ public:
                                    nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual PRBool GetAllowsAnonChildAccessibles();
 };
@@ -313,7 +313,7 @@ public:
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
diff --git a/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp b/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
index 9f93999946c9..99b0961a083c 100644
--- a/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
@@ -49,11 +49,10 @@ nsXFormsDropmarkerWidgetAccessible::
 {
 }
 
-nsresult
-nsXFormsDropmarkerWidgetAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsDropmarkerWidgetAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PUSHBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PUSHBUTTON;
 }
 
 nsresult
@@ -134,11 +133,10 @@ nsXFormsCalendarWidgetAccessible(nsIContent *aContent, nsIWeakReference *aShell)
 {
 }
 
-nsresult
-nsXFormsCalendarWidgetAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsCalendarWidgetAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_CALENDAR;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_CALENDAR;
 }
 
 
@@ -153,11 +151,10 @@ nsXFormsComboboxPopupWidgetAccessible::
 {
 }
 
-nsresult
-nsXFormsComboboxPopupWidgetAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXFormsComboboxPopupWidgetAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LIST;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LIST;
 }
 
 nsresult
diff --git a/accessible/src/xforms/nsXFormsWidgetsAccessible.h b/accessible/src/xforms/nsXFormsWidgetsAccessible.h
index 7e4f26d2803e..fe61552a121c 100644
--- a/accessible/src/xforms/nsXFormsWidgetsAccessible.h
+++ b/accessible/src/xforms/nsXFormsWidgetsAccessible.h
@@ -60,7 +60,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -75,7 +75,7 @@ public:
                                    nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 
@@ -95,7 +95,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
diff --git a/accessible/src/xul/nsXULAlertAccessible.cpp b/accessible/src/xul/nsXULAlertAccessible.cpp
index 64eaec31231c..8fb0dffa0733 100644
--- a/accessible/src/xul/nsXULAlertAccessible.cpp
+++ b/accessible/src/xul/nsXULAlertAccessible.cpp
@@ -50,11 +50,10 @@ nsXULAlertAccessible::
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULAlertAccessible, nsAccessible)
 
-nsresult
-nsXULAlertAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULAlertAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_ALERT;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_ALERT;
 }
 
 nsresult
diff --git a/accessible/src/xul/nsXULAlertAccessible.h b/accessible/src/xul/nsXULAlertAccessible.h
index ca202de745b6..f1fec6355005 100644
--- a/accessible/src/xul/nsXULAlertAccessible.h
+++ b/accessible/src/xul/nsXULAlertAccessible.h
@@ -55,7 +55,7 @@ public:
   NS_IMETHOD GetName(nsAString& aName);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
diff --git a/accessible/src/xul/nsXULColorPickerAccessible.cpp b/accessible/src/xul/nsXULColorPickerAccessible.cpp
index ad21ff216009..abbb53614765 100644
--- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
+++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
@@ -73,11 +73,10 @@ nsXULColorPickerTileAccessible::GetValue(nsAString& aValue)
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerTileAccessible: nsAccessible
 
-nsresult
-nsXULColorPickerTileAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULColorPickerTileAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PUSHBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PUSHBUTTON;
 }
 
 nsresult
@@ -149,11 +148,10 @@ nsXULColorPickerAccessible::GetStateInternal(PRUint32 *aState,
   return NS_OK;
 }
 
-nsresult
-nsXULColorPickerAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULColorPickerAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_BUTTONDROPDOWNGRID;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_BUTTONDROPDOWNGRID;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/accessible/src/xul/nsXULColorPickerAccessible.h b/accessible/src/xul/nsXULColorPickerAccessible.h
index 3202f341e54d..94f019296218 100644
--- a/accessible/src/xul/nsXULColorPickerAccessible.h
+++ b/accessible/src/xul/nsXULColorPickerAccessible.h
@@ -55,7 +55,7 @@ public:
   NS_IMETHOD GetValue(nsAString& _retval);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -72,7 +72,7 @@ public:
   virtual PRBool Init();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
diff --git a/accessible/src/xul/nsXULComboboxAccessible.cpp b/accessible/src/xul/nsXULComboboxAccessible.cpp
index 4153fed3a179..80acedc73ef9 100644
--- a/accessible/src/xul/nsXULComboboxAccessible.cpp
+++ b/accessible/src/xul/nsXULComboboxAccessible.cpp
@@ -66,20 +66,13 @@ nsXULComboboxAccessible::Init()
   return PR_TRUE;
 }
 
-nsresult
-nsXULComboboxAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULComboboxAccessible::NativeRole()
 {
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
   if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                            nsAccessibilityAtoms::autocomplete, eIgnoreCase)) {
-    *aRole = nsIAccessibleRole::ROLE_AUTOCOMPLETE;
-  } else {
-    *aRole = nsIAccessibleRole::ROLE_COMBOBOX;
-  }
-
-  return NS_OK;
+                            nsAccessibilityAtoms::autocomplete, eIgnoreCase))
+    return nsIAccessibleRole::ROLE_AUTOCOMPLETE;
+  return nsIAccessibleRole::ROLE_COMBOBOX;
 }
 
 nsresult
diff --git a/accessible/src/xul/nsXULComboboxAccessible.h b/accessible/src/xul/nsXULComboboxAccessible.h
index e4510767f3b5..2b1f733877a5 100644
--- a/accessible/src/xul/nsXULComboboxAccessible.h
+++ b/accessible/src/xul/nsXULComboboxAccessible.h
@@ -64,7 +64,7 @@ public:
   virtual PRBool Init();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual PRBool GetAllowsAnonChildAccessibles();
 };
diff --git a/accessible/src/xul/nsXULFormControlAccessible.cpp b/accessible/src/xul/nsXULFormControlAccessible.cpp
index 237c3bcfee6c..5ddbf71ddeee 100644
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -125,11 +125,10 @@ nsXULButtonAccessible::Init()
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULButtonAccessible: nsAccessible
 
-nsresult
-nsXULButtonAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULButtonAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PUSHBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PUSHBUTTON;
 }
 
 nsresult
@@ -317,14 +316,10 @@ NS_IMETHODIMP nsXULDropmarkerAccessible::DoAction(PRUint8 index)
   return NS_ERROR_INVALID_ARG;
 }
 
-/**
-  * We are a pushbutton
-  */
-nsresult
-nsXULDropmarkerAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULDropmarkerAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PUSHBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PUSHBUTTON;
 }
 
 nsresult
@@ -360,11 +355,10 @@ nsXULCheckboxAccessible::
 {
 }
 
-nsresult
-nsXULCheckboxAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULCheckboxAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_CHECKBUTTON;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_CHECKBUTTON;
 }
 
 NS_IMETHODIMP nsXULCheckboxAccessible::GetNumActions(PRUint8 *_retval)
@@ -448,11 +442,10 @@ nsXULGroupboxAccessible::
 {
 }
 
-nsresult
-nsXULGroupboxAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULGroupboxAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_GROUPING;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_GROUPING;
 }
 
 nsresult
@@ -519,11 +512,10 @@ NS_IMPL_ISUPPORTS_INHERITED1(nsXULProgressMeterAccessible,
 
 // nsAccessible
 
-nsresult
-nsXULProgressMeterAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULProgressMeterAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PROGRESSBAR;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PROGRESSBAR;
 }
 
 // nsIAccessibleValue
@@ -699,11 +691,10 @@ nsXULRadioGroupAccessible::
 { 
 }
 
-nsresult
-nsXULRadioGroupAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULRadioGroupAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_GROUPING;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_GROUPING;
 }
 
 nsresult
@@ -733,11 +724,10 @@ nsXULStatusBarAccessible::
 {
 }
 
-nsresult
-nsXULStatusBarAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULStatusBarAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_STATUSBAR;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_STATUSBAR;
 }
 
 
@@ -808,11 +798,10 @@ nsXULToolbarAccessible::
 {
 }
 
-nsresult
-nsXULToolbarAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULToolbarAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_TOOLBAR;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_TOOLBAR;
 }
 
 nsresult
@@ -840,11 +829,10 @@ nsXULToolbarSeparatorAccessible::
 {
 }
 
-nsresult
-nsXULToolbarSeparatorAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULToolbarSeparatorAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_SEPARATOR;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_SEPARATOR;
 }
 
 nsresult
@@ -974,16 +962,13 @@ nsXULTextFieldAccessible::GetStateInternal(PRUint32 *aState,
   return NS_OK;
 }
 
-nsresult
-nsXULTextFieldAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTextFieldAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_ENTRY;
-
   if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
                             nsAccessibilityAtoms::password, eIgnoreCase))
-    *aRole = nsIAccessibleRole::ROLE_PASSWORD_TEXT;
-
-  return NS_OK;
+    return nsIAccessibleRole::ROLE_PASSWORD_TEXT;
+  return nsIAccessibleRole::ROLE_ENTRY;
 }
 
 
diff --git a/accessible/src/xul/nsXULFormControlAccessible.h b/accessible/src/xul/nsXULFormControlAccessible.h
index 9c7e88235e9f..325bbb0d2a42 100644
--- a/accessible/src/xul/nsXULFormControlAccessible.h
+++ b/accessible/src/xul/nsXULFormControlAccessible.h
@@ -70,7 +70,7 @@ public:
   virtual PRBool Init();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
@@ -98,7 +98,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -117,7 +117,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 private:
@@ -137,7 +137,7 @@ public:
                                nsIAccessibleRelation **aRelation);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetNameInternal(nsAString& aName);
 };
 
@@ -154,7 +154,7 @@ public:
   NS_IMETHOD GetValue(nsAString &aValue);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 /**
@@ -181,7 +181,7 @@ public:
   nsXULRadioGroupAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -194,7 +194,7 @@ public:
   nsXULStatusBarAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 /**
@@ -222,7 +222,7 @@ public:
   nsXULToolbarAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetNameInternal(nsAString& aName);
 };
 
@@ -236,7 +236,7 @@ public:
                                   nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -263,7 +263,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetARIAState(PRUint32 *aState, PRUint32 *aExtraState);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual PRBool GetAllowsAnonChildAccessibles();
 
diff --git a/accessible/src/xul/nsXULListboxAccessible.cpp b/accessible/src/xul/nsXULListboxAccessible.cpp
index 04f7d2121373..453a19e02d73 100644
--- a/accessible/src/xul/nsXULListboxAccessible.cpp
+++ b/accessible/src/xul/nsXULListboxAccessible.cpp
@@ -57,11 +57,10 @@ nsXULColumnsAccessible::
 {
 }
 
-nsresult
-nsXULColumnsAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULColumnsAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LIST;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LIST;
 }
 
 nsresult
@@ -97,11 +96,10 @@ nsXULColumnItemAccessible::
 {
 }
 
-nsresult
-nsXULColumnItemAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULColumnItemAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_COLUMNHEADER;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_COLUMNHEADER;
 }
 
 nsresult
@@ -236,24 +234,19 @@ NS_IMETHODIMP nsXULListboxAccessible::GetValue(nsAString& _retval)
   return NS_ERROR_FAILURE;
 }
 
-nsresult
-nsXULListboxAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULListboxAccessible::NativeRole()
 {
   // A richlistbox is used with the new autocomplete URL bar, and has a parent
   // popup <panel>.
   nsCOMPtr<nsIDOMXULPopupElement> xulPopup =
     do_QueryInterface(mContent->GetParent());
-  if (xulPopup) {
-    *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
-    return NS_OK;
-  }
+  if (xulPopup)
+    return nsIAccessibleRole::ROLE_COMBOBOX_LIST;
 
   if (IsMulticolumn())
-    *aRole = nsIAccessibleRole::ROLE_TABLE;
-  else
-    *aRole = nsIAccessibleRole::ROLE_LISTBOX;
-
-  return NS_OK;
+    return nsIAccessibleRole::ROLE_TABLE;
+  return nsIAccessibleRole::ROLE_LISTBOX;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -923,24 +916,25 @@ nsXULListitemAccessible::GetNameInternal(nsAString& aName)
   return GetXULName(aName);
 }
 
-nsresult
-nsXULListitemAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULListitemAccessible::NativeRole()
 {
   nsAccessible *list = GetListAccessible();
-  NS_ENSURE_STATE(list);
-
-  if (nsAccUtils::Role(list) == nsIAccessibleRole::ROLE_TABLE) {
-    *aRole = nsIAccessibleRole::ROLE_ROW;
-    return NS_OK;
+  if (!list) {
+    NS_ERROR("No list accessible for listitem accessible!");
+    return nsIAccessibleRole::ROLE_NOTHING;
   }
 
+  if (nsAccUtils::Role(list) == nsIAccessibleRole::ROLE_TABLE)
+    return nsIAccessibleRole::ROLE_ROW;
+
   if (mIsCheckbox)
-    *aRole = nsIAccessibleRole::ROLE_CHECKBUTTON;
-  else if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
-    *aRole = nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
-  else
-    *aRole = nsIAccessibleRole::ROLE_RICH_OPTION;
-  return NS_OK;
+    return nsIAccessibleRole::ROLE_CHECKBUTTON;
+
+  if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
+    return nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
+
+  return nsIAccessibleRole::ROLE_RICH_OPTION;
 }
 
 nsresult
@@ -1228,11 +1222,10 @@ nsXULListCellAccessible::IsSelected(PRBool *aIsSelected)
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListCellAccessible. nsAccessible implementation
 
-nsresult
-nsXULListCellAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULListCellAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_CELL;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_CELL;
 }
 
 nsresult
diff --git a/accessible/src/xul/nsXULListboxAccessible.h b/accessible/src/xul/nsXULListboxAccessible.h
index 30b353df9868..a787529d4ed7 100644
--- a/accessible/src/xul/nsXULListboxAccessible.h
+++ b/accessible/src/xul/nsXULListboxAccessible.h
@@ -58,7 +58,7 @@ public:
   nsXULColumnsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -77,7 +77,7 @@ public:
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
   enum { eAction_Click = 0 };
@@ -100,7 +100,7 @@ public:
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
@@ -127,7 +127,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
@@ -160,7 +160,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 #endif
diff --git a/accessible/src/xul/nsXULMenuAccessible.cpp b/accessible/src/xul/nsXULMenuAccessible.cpp
index 8fdc59e9a894..ef266fffd9cb 100644
--- a/accessible/src/xul/nsXULMenuAccessible.cpp
+++ b/accessible/src/xul/nsXULMenuAccessible.cpp
@@ -428,7 +428,7 @@ nsXULMenuitemAccessible::GetKeyboardShortcut(nsAString& aAccessKey)
 
   nsAccessible* parentAcc = GetParent();
   if (parentAcc) {
-    if (nsAccUtils::RoleInternal(parentAcc) == nsIAccessibleRole::ROLE_MENUBAR) {
+    if (parentAcc->NativeRole() == nsIAccessibleRole::ROLE_MENUBAR) {
       // If top level menu item, add Alt+ or whatever modifier text to string
       // No need to cache pref service, this happens rarely
       if (gMenuAccesskeyModifier == -1) {
@@ -479,34 +479,28 @@ nsXULMenuitemAccessible::GetDefaultKeyBinding(nsAString& aKeyBinding)
   return NS_OK;
 }
 
-nsresult
-nsXULMenuitemAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULMenuitemAccessible::NativeRole()
 {
   nsCOMPtr<nsIDOMXULContainerElement> xulContainer(do_QueryInterface(mContent));
-  if (xulContainer) {
-    *aRole = nsIAccessibleRole::ROLE_PARENT_MENUITEM;
-    return NS_OK;
-  }
+  if (xulContainer)
+    return nsIAccessibleRole::ROLE_PARENT_MENUITEM;
 
-  if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST) {
-    *aRole = nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
-    return NS_OK;
-  }
+  if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
+    return nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
 
   if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
                             nsAccessibilityAtoms::radio, eCaseMatters)) {
-    *aRole = nsIAccessibleRole::ROLE_RADIO_MENU_ITEM;
-
-  } else if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                                   nsAccessibilityAtoms::checkbox,
-                                   eCaseMatters)) {
-    *aRole = nsIAccessibleRole::ROLE_CHECK_MENU_ITEM;
-
-  } else {
-    *aRole = nsIAccessibleRole::ROLE_MENUITEM;
+    return nsIAccessibleRole::ROLE_RADIO_MENU_ITEM;
   }
 
-  return NS_OK;
+  if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
+                            nsAccessibilityAtoms::checkbox,
+                            eCaseMatters)) {
+    return nsIAccessibleRole::ROLE_CHECK_MENU_ITEM;
+  }
+
+  return nsIAccessibleRole::ROLE_MENUITEM;
 }
 
 PRInt32
@@ -587,11 +581,10 @@ nsXULMenuSeparatorAccessible::GetNameInternal(nsAString& aName)
   return NS_OK;
 }
 
-nsresult
-nsXULMenuSeparatorAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULMenuSeparatorAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_SEPARATOR;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_SEPARATOR;
 }
 
 NS_IMETHODIMP nsXULMenuSeparatorAccessible::DoAction(PRUint8 index)
@@ -667,8 +660,8 @@ nsXULMenupopupAccessible::GetNameInternal(nsAString& aName)
   return NS_OK;
 }
 
-nsresult
-nsXULMenupopupAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULMenupopupAccessible::NativeRole()
 {
   // If accessible is not bound to the tree (this happens while children are
   // cached) return general role.
@@ -676,21 +669,18 @@ nsXULMenupopupAccessible::GetRoleInternal(PRUint32 *aRole)
     PRUint32 role = nsAccUtils::Role(mParent);
     if (role == nsIAccessibleRole::ROLE_COMBOBOX ||
         role == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
-      *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
-      return NS_OK;
+      return nsIAccessibleRole::ROLE_COMBOBOX_LIST;
+    }
 
-    } else if (role == nsIAccessibleRole::ROLE_PUSHBUTTON) {
+    if (role == nsIAccessibleRole::ROLE_PUSHBUTTON) {
       // Some widgets like the search bar have several popups, owned by buttons.
       nsAccessible* grandParent = mParent->GetParent();
-      if (nsAccUtils::Role(grandParent) == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
-        *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
-        return NS_OK;
-      }
+      if (nsAccUtils::Role(grandParent) == nsIAccessibleRole::ROLE_AUTOCOMPLETE)
+        return nsIAccessibleRole::ROLE_COMBOBOX_LIST;
     }
   }
 
-  *aRole = nsIAccessibleRole::ROLE_MENUPOPUP;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_MENUPOPUP;
 }
 
 
@@ -724,10 +714,9 @@ nsXULMenubarAccessible::GetNameInternal(nsAString& aName)
   return NS_OK;
 }
 
-nsresult
-nsXULMenubarAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULMenubarAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_MENUBAR;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_MENUBAR;
 }
 
diff --git a/accessible/src/xul/nsXULMenuAccessible.h b/accessible/src/xul/nsXULMenuAccessible.h
index db55eb784b74..9a2fbecef41e 100644
--- a/accessible/src/xul/nsXULMenuAccessible.h
+++ b/accessible/src/xul/nsXULMenuAccessible.h
@@ -94,7 +94,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual PRInt32 GetLevelInternal();
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
@@ -118,7 +118,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -133,7 +133,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -147,7 +147,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
diff --git a/accessible/src/xul/nsXULSliderAccessible.cpp b/accessible/src/xul/nsXULSliderAccessible.cpp
index 550a0de7a653..06e1a5e604e4 100644
--- a/accessible/src/xul/nsXULSliderAccessible.cpp
+++ b/accessible/src/xul/nsXULSliderAccessible.cpp
@@ -62,11 +62,10 @@ NS_IMPL_ISUPPORTS_INHERITED1(nsXULSliderAccessible,
 
 // nsAccessible
 
-nsresult
-nsXULSliderAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULSliderAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_SLIDER;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_SLIDER;
 }
 
 nsresult
@@ -300,12 +299,12 @@ nsXULThumbAccessible::
 {
 }
 
-// nsIAccessible
+////////////////////////////////////////////////////////////////////////////////
+// nsXULThumbAccessible: nsAccessible
 
-nsresult
-nsXULThumbAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULThumbAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_INDICATOR;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_INDICATOR;
 }
 
diff --git a/accessible/src/xul/nsXULSliderAccessible.h b/accessible/src/xul/nsXULSliderAccessible.h
index fbfd8a972878..77e75063b63d 100644
--- a/accessible/src/xul/nsXULSliderAccessible.h
+++ b/accessible/src/xul/nsXULSliderAccessible.h
@@ -64,7 +64,7 @@ public:
   NS_DECL_NSIACCESSIBLEVALUE
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual PRBool GetAllowsAnonChildAccessibles();
 
@@ -91,7 +91,7 @@ public:
   nsXULThumbAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 #endif
diff --git a/accessible/src/xul/nsXULTabAccessible.cpp b/accessible/src/xul/nsXULTabAccessible.cpp
index a33640751d19..5c2cf551e2cd 100644
--- a/accessible/src/xul/nsXULTabAccessible.cpp
+++ b/accessible/src/xul/nsXULTabAccessible.cpp
@@ -96,11 +96,10 @@ NS_IMETHODIMP nsXULTabAccessible::DoAction(PRUint8 index)
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabAccessible: nsAccessible
 
-nsresult
-nsXULTabAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTabAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PAGETAB;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PAGETAB;
 }
 
 nsresult
@@ -184,11 +183,10 @@ nsXULTabsAccessible::
 {
 }
 
-nsresult
-nsXULTabsAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTabsAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PAGETABLIST;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PAGETABLIST;
 }
 
 NS_IMETHODIMP
@@ -224,11 +222,10 @@ nsXULTabpanelsAccessible::
 {
 }
 
-nsresult
-nsXULTabpanelsAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTabpanelsAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PANE;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PANE;
 }
 
 
@@ -242,11 +239,10 @@ nsXULTabpanelAccessible::
 {
 }
 
-nsresult
-nsXULTabpanelAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTabpanelAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_PROPERTYPAGE;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_PROPERTYPAGE;
 }
 
 NS_IMETHODIMP
diff --git a/accessible/src/xul/nsXULTabAccessible.h b/accessible/src/xul/nsXULTabAccessible.h
index 92645d5dba23..6ec18ca78305 100644
--- a/accessible/src/xul/nsXULTabAccessible.h
+++ b/accessible/src/xul/nsXULTabAccessible.h
@@ -63,7 +63,7 @@ public:
   // nsAccessible
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -82,7 +82,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 
@@ -95,7 +95,7 @@ public:
   nsXULTabpanelsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 
@@ -119,7 +119,7 @@ public:
                                nsIAccessibleRelation **aRelation);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 };
 
 #endif
diff --git a/accessible/src/xul/nsXULTextAccessible.cpp b/accessible/src/xul/nsXULTextAccessible.cpp
index bba0f081ea0d..c7524be0c7aa 100644
--- a/accessible/src/xul/nsXULTextAccessible.cpp
+++ b/accessible/src/xul/nsXULTextAccessible.cpp
@@ -71,11 +71,10 @@ nsXULTextAccessible::GetNameInternal(nsAString& aName)
   return NS_OK;
 }
 
-nsresult
-nsXULTextAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTextAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LABEL;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LABEL;
 }
 
 nsresult
@@ -137,11 +136,10 @@ nsXULTooltipAccessible::GetStateInternal(PRUint32 *aState,
   return NS_OK;
 }
 
-nsresult
-nsXULTooltipAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTooltipAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_TOOLTIP;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_TOOLTIP;
 }
 
 
@@ -184,11 +182,10 @@ nsXULLinkAccessible::GetNameInternal(nsAString& aName)
   return nsTextEquivUtils::GetNameFromSubtree(this, aName);
 }
 
-nsresult
-nsXULLinkAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULLinkAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_LINK;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_LINK;
 }
 
 
diff --git a/accessible/src/xul/nsXULTextAccessible.h b/accessible/src/xul/nsXULTextAccessible.h
index 0a3e855b5a09..2dd453a05350 100644
--- a/accessible/src/xul/nsXULTextAccessible.h
+++ b/accessible/src/xul/nsXULTextAccessible.h
@@ -58,7 +58,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -72,7 +72,7 @@ public:
   nsXULTooltipAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 };
 
@@ -93,7 +93,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
   // HyperLinkAccessible
diff --git a/accessible/src/xul/nsXULTreeAccessible.cpp b/accessible/src/xul/nsXULTreeAccessible.cpp
index 88fc9f96dccf..bd9f4249e54c 100644
--- a/accessible/src/xul/nsXULTreeAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeAccessible.cpp
@@ -181,12 +181,9 @@ nsXULTreeAccessible::Shutdown()
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeAccessible: nsAccessible implementation (put methods here)
 
-nsresult
-nsXULTreeAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTreeAccessible::NativeRole()
 {
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
   // No primary column means we're in a list. In fact, history and mail turn off
   // the primary flag when switching to a flat view.
 
@@ -196,11 +193,9 @@ nsXULTreeAccessible::GetRoleInternal(PRUint32 *aRole)
   if (cols)
     cols->GetPrimaryColumn(getter_AddRefs(primaryCol));
 
-  *aRole = primaryCol ?
+  return primaryCol ?
     static_cast<PRUint32>(nsIAccessibleRole::ROLE_OUTLINE) :
     static_cast<PRUint32>(nsIAccessibleRole::ROLE_LIST);
-
-  return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -1159,21 +1154,22 @@ nsXULTreeItemAccessible::Shutdown()
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeItemAccessible: nsAccessible implementation
 
-nsresult
-nsXULTreeItemAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTreeItemAccessible::NativeRole()
 {
   nsCOMPtr<nsITreeColumns> columns;
   mTree->GetColumns(getter_AddRefs(columns));
-  NS_ENSURE_STATE(columns);
+  if (!columns) {
+    NS_ERROR("No tree columns object in the tree!");
+    return nsIAccessibleRole::ROLE_NOTHING;
+  }
 
   nsCOMPtr<nsITreeColumn> primaryColumn;
   columns->GetPrimaryColumn(getter_AddRefs(primaryColumn));
 
-  *aRole = primaryColumn ?
+  return primaryColumn ?
     static_cast<PRUint32>(nsIAccessibleRole::ROLE_OUTLINEITEM) :
     static_cast<PRUint32>(nsIAccessibleRole::ROLE_LISTITEM);
-
-  return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/accessible/src/xul/nsXULTreeAccessible.h b/accessible/src/xul/nsXULTreeAccessible.h
index 43bd7db982a3..3f1fc75428cd 100644
--- a/accessible/src/xul/nsXULTreeAccessible.h
+++ b/accessible/src/xul/nsXULTreeAccessible.h
@@ -84,7 +84,7 @@ public:
   virtual void Shutdown();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual nsresult GetChildAtPoint(PRInt32 aX, PRInt32 aY,
                                    PRBool aDeepestChild,
@@ -275,7 +275,7 @@ public:
   virtual void Shutdown();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 
   // nsXULTreeItemAccessibleBase
   virtual void RowInvalidated(PRInt32 aStartColIdx, PRInt32 aEndColIdx);
diff --git a/accessible/src/xul/nsXULTreeGridAccessible.cpp b/accessible/src/xul/nsXULTreeGridAccessible.cpp
index a7683276c36d..83740ec31054 100644
--- a/accessible/src/xul/nsXULTreeGridAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeGridAccessible.cpp
@@ -575,21 +575,22 @@ nsXULTreeGridAccessible::IsProbablyForLayout(PRBool *aIsProbablyForLayout)
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridAccessible: nsAccessible implementation
 
-nsresult
-nsXULTreeGridAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTreeGridAccessible::NativeRole()
 {
   nsCOMPtr<nsITreeColumns> treeColumns;
   mTree->GetColumns(getter_AddRefs(treeColumns));
-  NS_ENSURE_STATE(treeColumns);
+  if (!treeColumns) {
+    NS_ERROR("No treecolumns object for tree!");
+    return nsIAccessibleRole::ROLE_NOTHING;
+  }
 
   nsCOMPtr<nsITreeColumn> primaryColumn;
   treeColumns->GetPrimaryColumn(getter_AddRefs(primaryColumn));
 
-  *aRole = primaryColumn ?
+  return primaryColumn ?
     static_cast<PRUint32>(nsIAccessibleRole::ROLE_TREE_TABLE) :
     static_cast<PRUint32>(nsIAccessibleRole::ROLE_TABLE);
-
-  return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -656,11 +657,10 @@ nsXULTreeGridRowAccessible::Shutdown()
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridRowAccessible: nsAccessible implementation
 
-nsresult
-nsXULTreeGridRowAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTreeGridRowAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_ROW;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_ROW;
 }
 
 nsresult
@@ -1164,11 +1164,10 @@ nsXULTreeGridCellAccessible::GetAttributesInternal(nsIPersistentProperties *aAtt
   return NS_OK;
 }
 
-nsresult
-nsXULTreeGridCellAccessible::GetRoleInternal(PRUint32 *aRole)
+PRUint32
+nsXULTreeGridCellAccessible::NativeRole()
 {
-  *aRole = nsIAccessibleRole::ROLE_GRID_CELL;
-  return NS_OK;
+  return nsIAccessibleRole::ROLE_GRID_CELL;
 }
 
 nsresult
diff --git a/accessible/src/xul/nsXULTreeGridAccessible.h b/accessible/src/xul/nsXULTreeGridAccessible.h
index 3853c1545c01..1c5e0e0ee440 100644
--- a/accessible/src/xul/nsXULTreeGridAccessible.h
+++ b/accessible/src/xul/nsXULTreeGridAccessible.h
@@ -59,7 +59,7 @@ public:
   NS_DECL_NSIACCESSIBLETABLE
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
 
 protected:
 
@@ -92,7 +92,7 @@ public:
   virtual void Shutdown();
 
   // nsAccessible
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetChildAtPoint(PRInt32 aX, PRInt32 aY,
                                    PRBool aDeepestChild,
                                    nsIAccessible **aChild);
@@ -164,7 +164,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
-  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+  virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual PRInt32 GetIndexInParent() { return GetColumnIndex(); }
 

From 777be5436f7d9fe292fbce9f10f55088252a62c9 Mon Sep 17 00:00:00 2001
From: Vladimir Vukicevic <vladimir@pobox.com>
Date: Sat, 4 Sep 2010 23:32:39 -0400
Subject: [PATCH 154/222] Bug 591155 - Disable an additional test that has
 shown up as failing with no visual difference. r=joe a=blocking2.0:beta6+

---
 layout/reftests/bugs/reftest.list | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 20bb75526415..04425c6672b2 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1486,7 +1486,7 @@ random-if(layersGPUAccelerated) == 564991-1.html 564991-1-ref.html
 == 574898-1.html 574898-ref.html
 == 577838-1.html 577838-1-ref.html
 == 577838-2.html 577838-2-ref.html
-== 579323-1.html 579323-1-ref.html
+random-if(layersGPUAccelerated) == 579323-1.html 579323-1-ref.html
 == 579349-1.html 579349-1-ref.html
 == 580160-1.html 580160-1-ref.html
 random-if(layersGPUAccelerated) == 581317-1.html 581317-1-ref.html

From 35d8542aa1c192ae7eaf4b43d873ff5c1dc1a403 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Sat, 4 Sep 2010 23:39:32 -0400
Subject: [PATCH 155/222] Bug 593275. Take reftest snapshots by painting the
 toplevel window. r=dbaron a=blocking2.0:beta6+

---
 layout/tools/reftest/reftest.js | 59 ++++++++++-----------------------
 1 file changed, 18 insertions(+), 41 deletions(-)

diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index adfead48dc3d..80633757e3b1 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -880,21 +880,21 @@ function OnDocumentLoad(event)
         }
 
         function WhenMozAfterPaintFlushed(continuation) {
-            if (utils.isMozAfterPaintPending) {
+            if (gWindowUtils.isMozAfterPaintPending) {
                 function handler() {
-                    gBrowser.removeEventListener("MozAfterPaint", handler, false);
+                    window.removeEventListener("MozAfterPaint", handler, false);
                     continuation();
                 }
-                gBrowser.addEventListener("MozAfterPaint", handler, false);
+                window.addEventListener("MozAfterPaint", handler, false);
             } else {
                 continuation();
             }
         }
 
         function AfterPaintListener(event) {
-            if (event.target.document != currentDoc) {
+            if (event.target.document != document) {
                 // ignore paint events for subframes or old documents in the window.
-                // Invalidation in subframes will cause invalidation in the main document anyway.
+                // Invalidation in subframes will cause invalidation in the toplevel document anyway.
                 return;
             }
 
@@ -903,13 +903,13 @@ function OnDocumentLoad(event)
             // When stopAfteraintReceived is set, we can stop --- but we should keep going as long
             // as there are paint events coming (there probably shouldn't be any, but it doesn't
             // hurt to process them)
-            if (stopAfterPaintReceived && !utils.isMozAfterPaintPending) {
+            if (stopAfterPaintReceived && !gWindowUtils.isMozAfterPaintPending) {
                 FinishWaitingForTestEnd();
             }
         }
 
         function FinishWaitingForTestEnd() {
-            gBrowser.removeEventListener("MozAfterPaint", AfterPaintListener, false);
+            window.removeEventListener("MozAfterPaint", AfterPaintListener, false);
             setTimeout(DocumentLoaded, 0);
         }
 
@@ -931,7 +931,7 @@ function OnDocumentLoad(event)
                 setupPrintMode();
             FlushRendering();
 
-            if (utils.isMozAfterPaintPending) {
+            if (gWindowUtils.isMozAfterPaintPending) {
                 // Wait for the last invalidation to have happened and been snapshotted before
                 // we stop the test
                 stopAfterPaintReceived = true;
@@ -945,7 +945,7 @@ function OnDocumentLoad(event)
             FlushRendering();
 
             function continuation() {
-                gBrowser.addEventListener("MozAfterPaint", AfterPaintListener, false);
+                window.addEventListener("MozAfterPaint", AfterPaintListener, false);
                 contentRootElement.addEventListener("DOMAttrModified", AttrModifiedListener, false);
 
                 // Take a snapshot of the window in its current state
@@ -1002,7 +1002,7 @@ function UpdateCanvasCache(url, canvas)
 
 // Compute drawWindow flags lazily so the window is set up and can be
 // measured accurately
-function DoDrawWindow(ctx, win, x, y, w, h)
+function DoDrawWindow(ctx, x, y, w, h)
 {
     if (typeof gDrawWindowFlags == "undefined") {
         gDrawWindowFlags = ctx.DRAWWINDOW_DRAW_CARET |
@@ -1021,13 +1021,7 @@ function DoDrawWindow(ctx, win, x, y, w, h)
              r.width + "," + r.height + "\n");
     }
 
-    var scrollX = 0;
-    var scrollY = 0;
-    if (!(gDrawWindowFlags & ctx.DRAWWINDOW_DRAW_VIEW)) {
-        scrollX = win.scrollX;
-        scrollY = win.scrollY;
-    }
-    ctx.drawWindow(win, scrollX + x, scrollY + y, w, h, "rgb(255,255,255)",
+    ctx.drawWindow(window, x, y, w, h, "rgb(255,255,255)",
                    gDrawWindowFlags);
 }
 
@@ -1040,21 +1034,8 @@ function InitCurrentCanvasWithSnapshot()
 
     gCurrentCanvas = AllocateCanvas();
 
-    /* XXX This needs to be rgb(255,255,255) because otherwise we get
-     * black bars at the bottom of every test that are different size
-     * for the first test and the rest (scrollbar-related??) */
-    var win = gBrowser.contentWindow;
     var ctx = gCurrentCanvas.getContext("2d");
-    var scale = gBrowser.markupDocumentViewer.fullZoom;
-    ctx.save();
-    // drawWindow always draws one canvas pixel for each CSS pixel in the source
-    // window, so scale the drawing to show the zoom (making each canvas pixel be one
-    // device pixel instead)
-    ctx.scale(scale, scale);
-    DoDrawWindow(ctx, win, 0, 0,
-                 Math.ceil(gCurrentCanvas.width / scale),
-                 Math.ceil(gCurrentCanvas.height / scale));
-    ctx.restore();
+    DoDrawWindow(ctx, 0, 0, gCurrentCanvas.width, gCurrentCanvas.height);
 }
 
 function roundTo(x, fraction)
@@ -1067,23 +1048,19 @@ function UpdateCurrentCanvasForEvent(event)
     if (!gCurrentCanvas)
         return;
 
-    var win = gBrowser.contentWindow;
     var ctx = gCurrentCanvas.getContext("2d");
-    var scale = gBrowser.markupDocumentViewer.fullZoom;
-
     var rectList = event.clientRects;
     for (var i = 0; i < rectList.length; ++i) {
         var r = rectList[i];
-        // Set left/top/right/bottom to "device pixel" boundaries
-        var left = Math.floor(roundTo(r.left*scale, 0.001))/scale;
-        var top = Math.floor(roundTo(r.top*scale, 0.001))/scale;
-        var right = Math.ceil(roundTo(r.right*scale, 0.001))/scale;
-        var bottom = Math.ceil(roundTo(r.bottom*scale, 0.001))/scale;
+        // Set left/top/right/bottom to pixel boundaries
+        var left = Math.floor(r.left);
+        var top = Math.floor(r.top);
+        var right = Math.ceil(r.right);
+        var bottom = Math.ceil(r.bottom);
 
         ctx.save();
-        ctx.scale(scale, scale);
         ctx.translate(left, top);
-        DoDrawWindow(ctx, win, left, top, right - left, bottom - top);
+        DoDrawWindow(ctx, left, top, right - left, bottom - top);
         ctx.restore();
     }
 }

From 150734916874aab897ccef52281a5e7e267532da Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Sat, 4 Sep 2010 23:39:35 -0400
Subject: [PATCH 156/222] Bug 593275 part 2 - Dynamically recompute drawWindow
 flags, in case our window is asynchronously resized on us. r=dbaron
 a=blocking2.0:beta6+

---
 layout/tools/reftest/reftest.js | 47 ++++++++++++++++++++++-----------
 1 file changed, 31 insertions(+), 16 deletions(-)

diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index 80633757e3b1..c644e106600c 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -1000,25 +1000,40 @@ function UpdateCanvasCache(url, canvas)
     }
 }
 
-// Compute drawWindow flags lazily so the window is set up and can be
-// measured accurately
+// Recompute drawWindow flags for every drawWindow operation.
+// We have to do this every time since our window can be
+// asynchronously resized (e.g. by the window manager, to make
+// it fit on screen) at unpredictable times.
+// Fortunately this is pretty cheap.
 function DoDrawWindow(ctx, x, y, w, h)
 {
-    if (typeof gDrawWindowFlags == "undefined") {
-        gDrawWindowFlags = ctx.DRAWWINDOW_DRAW_CARET |
-                           ctx.DRAWWINDOW_DRAW_VIEW;
-        var flags = "DRAWWINDOW_DRAW_CARET | DRAWWINDOW_DRAW_VIEW";
-        var r = gBrowser.getBoundingClientRect();
-        if (window.innerWidth >= r.right && window.innerHeight >= r.bottom) {
-            // We can use the window's retained layers
-            // because the window is big enough to display the entire browser element
-            gDrawWindowFlags |= ctx.DRAWWINDOW_USE_WIDGET_LAYERS;
-            flags += " | DRAWWINDOW_USE_WIDGET_LAYERS";
+    var flags = ctx.DRAWWINDOW_DRAW_CARET | ctx.DRAWWINDOW_DRAW_VIEW;
+    var testRect = gBrowser.getBoundingClientRect();
+    if (0 <= testRect.left &&
+        0 <= testRect.top &&
+        window.innerWidth >= testRect.right &&
+        window.innerHeight >= testRect.bottom) {
+        // We can use the window's retained layer manager
+        // because the window is big enough to display the entire
+        // browser element
+        flags |= ctx.DRAWWINDOW_USE_WIDGET_LAYERS;
+    }
+
+    if (gDrawWindowFlags != flags) {
+        // Every time the flags change, dump the new state.
+        gDrawWindowFlags = flags;
+        var flagsStr = "DRAWWINDOW_DRAW_CARET | DRAWWINDOW_DRAW_VIEW";
+        if (flags & ctx.DRAWWINDOW_USE_WIDGET_LAYERS) {
+            flagsStr += " | DRAWWINDOW_USE_WIDGET_LAYERS";
+        } else {
+            // Output a special warning because we need to be able to detect
+            // this whenever it happens.
+            dump("REFTEST INFO | WARNING: USE_WIDGET_LAYERS disabled\n");
         }
-        dump("REFTEST INFO | drawWindow flags = " + flags +
-             "; window.innerWidth/Height = " + window.innerWidth + "," +
-             window.innerHeight + "; browser.width/height = " +
-             r.width + "," + r.height + "\n");
+        dump("REFTEST INFO | drawWindow flags = " + flagsStr +
+             "; window size = " + window.innerWidth + "," + window.innerHeight +
+             "; test browser size = " + testRect.width + "," + testRect.height +
+             "\n");
     }
 
     ctx.drawWindow(window, x, y, w, h, "rgb(255,255,255)",

From ef970d70d1c6bf492b1b8a5e899f599e45219fa6 Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Sat, 4 Sep 2010 23:41:17 -0400
Subject: [PATCH 157/222] Bug 592964: Use nsDependentAtomString instead of
 nsAtomString for temporary variables. r=jst a=jst

---
 content/base/src/nsNodeInfoManager.cpp        | 2 +-
 content/svg/content/src/nsSVGElement.cpp      | 5 +++--
 content/xslt/src/xslt/txEXSLTFunctions.cpp    | 3 ++-
 content/xslt/src/xslt/txMozillaTextOutput.cpp | 5 +++--
 content/xslt/src/xslt/txMozillaXMLOutput.cpp  | 5 +++--
 content/xul/document/src/nsXULDocument.cpp    | 9 +++++----
 6 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/content/base/src/nsNodeInfoManager.cpp b/content/base/src/nsNodeInfoManager.cpp
index c3e90df7db34..d27924d23593 100644
--- a/content/base/src/nsNodeInfoManager.cpp
+++ b/content/base/src/nsNodeInfoManager.cpp
@@ -74,7 +74,7 @@ nsNodeInfoManager::GetNodeInfoInnerHashValue(const void *key)
     reinterpret_cast<const nsINodeInfo::nsNodeInfoInner *>(key);
 
   if (node->mName) {
-    return HashString(nsAtomString(node->mName));
+    return HashString(nsDependentAtomString(node->mName));
   }
   return HashString(*(node->mNameString));
 }
diff --git a/content/svg/content/src/nsSVGElement.cpp b/content/svg/content/src/nsSVGElement.cpp
index b77d0a274b4d..8544e7cef6da 100644
--- a/content/svg/content/src/nsSVGElement.cpp
+++ b/content/svg/content/src/nsSVGElement.cpp
@@ -1169,7 +1169,7 @@ MappedAttrParser::ParseMappedAttrValue(nsIAtom* aMappedAttrName,
 
   // Get the nsCSSProperty ID for our mapped attribute.
   nsCSSProperty propertyID =
-    nsCSSProps::LookupProperty(nsAtomString(aMappedAttrName));
+    nsCSSProps::LookupProperty(nsDependentAtomString(aMappedAttrName));
   PRBool changed; // outparam for ParseProperty. (ignored)
   mParser.ParseProperty(propertyID, aMappedAttrValue, mDocURI, mBaseURI,
                         mNodePrincipal, mDecl, &changed, PR_FALSE);
@@ -2191,7 +2191,8 @@ nsSVGElement::GetAnimatedAttr(nsIAtom* aName)
 
   // Mapped attributes:
   if (IsAttributeMapped(aName)) {
-    nsCSSProperty prop = nsCSSProps::LookupProperty(nsAtomString(aName));
+    nsCSSProperty prop =
+      nsCSSProps::LookupProperty(nsDependentAtomString(aName));
     // Check IsPropertyAnimatable to avoid attributes that...
     //  - map to explicitly unanimatable properties (e.g. 'direction')
     //  - map to unsupported attributes (e.g. 'glyph-orientation-horizontal')
diff --git a/content/xslt/src/xslt/txEXSLTFunctions.cpp b/content/xslt/src/xslt/txEXSLTFunctions.cpp
index fa5e6a694f07..6808a980a4f5 100644
--- a/content/xslt/src/xslt/txEXSLTFunctions.cpp
+++ b/content/xslt/src/xslt/txEXSLTFunctions.cpp
@@ -172,7 +172,8 @@ createAndAddToResult(nsIAtom* aName, const nsSubstring& aValue,
 
     nsIDocument* doc = aResultHolder->GetOwnerDoc();
     nsCOMPtr<nsIContent> elem;
-    nsresult rv = doc->CreateElem(nsAtomString(aName), nsnull, kNameSpaceID_None, PR_FALSE,
+    nsresult rv = doc->CreateElem(nsDependentAtomString(aName),
+                                  nsnull, kNameSpaceID_None, PR_FALSE,
                                   getter_AddRefs(elem));
     NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/content/xslt/src/xslt/txMozillaTextOutput.cpp b/content/xslt/src/xslt/txMozillaTextOutput.cpp
index 7fddd77e99e2..1c4e9b1d5105 100644
--- a/content/xslt/src/xslt/txMozillaTextOutput.cpp
+++ b/content/xslt/src/xslt/txMozillaTextOutput.cpp
@@ -219,8 +219,9 @@ txMozillaTextOutput::createResultDocument(nsIDOMDocument* aSourceDocument,
             RegisterNameSpace(NS_LITERAL_STRING(kTXNameSpaceURI), namespaceID);
         NS_ENSURE_SUCCESS(rv, rv);
 
-        rv = mDocument->CreateElem(nsAtomString(nsGkAtoms::result), nsGkAtoms::transformiix,
-                                   namespaceID, PR_FALSE, getter_AddRefs(mTextParent));
+        rv = mDocument->CreateElem(nsDependentAtomString(nsGkAtoms::result),
+                                   nsGkAtoms::transformiix, namespaceID,
+                                   PR_FALSE, getter_AddRefs(mTextParent));
         NS_ENSURE_SUCCESS(rv, rv);
 
 
diff --git a/content/xslt/src/xslt/txMozillaXMLOutput.cpp b/content/xslt/src/xslt/txMozillaXMLOutput.cpp
index 8d956ac93b6d..0e017a8493a0 100644
--- a/content/xslt/src/xslt/txMozillaXMLOutput.cpp
+++ b/content/xslt/src/xslt/txMozillaXMLOutput.cpp
@@ -629,8 +629,9 @@ txMozillaXMLOutput::createTxWrapper()
     NS_ENSURE_SUCCESS(rv, rv);
 
     nsCOMPtr<nsIContent> wrapper;
-    rv = mDocument->CreateElem(nsAtomString(nsGkAtoms::result), nsGkAtoms::transformiix,
-                               namespaceID, PR_FALSE, getter_AddRefs(wrapper));
+    rv = mDocument->CreateElem(nsDependentAtomString(nsGkAtoms::result),
+                               nsGkAtoms::transformiix, namespaceID,
+                               PR_FALSE, getter_AddRefs(wrapper));
     NS_ENSURE_SUCCESS(rv, rv);
 
     PRUint32 i, j, childCount = mDocument->GetChildCount();
diff --git a/content/xul/document/src/nsXULDocument.cpp b/content/xul/document/src/nsXULDocument.cpp
index f622c726b68f..85ae01c2aace 100644
--- a/content/xul/document/src/nsXULDocument.cpp
+++ b/content/xul/document/src/nsXULDocument.cpp
@@ -3833,10 +3833,11 @@ nsXULDocument::CreateTemplateBuilder(nsIContent* aElement)
                                           getter_AddRefs(bodyContent));
 
         if (! bodyContent) {
-            nsresult rv = document->CreateElem(nsAtomString(nsGkAtoms::treechildren),
-                                               nsnull, kNameSpaceID_XUL,
-                                               PR_FALSE,
-                                               getter_AddRefs(bodyContent));
+            nsresult rv =
+                document->CreateElem(nsDependentAtomString(nsGkAtoms::treechildren),
+                                     nsnull, kNameSpaceID_XUL,
+                                     PR_FALSE,
+                                     getter_AddRefs(bodyContent));
             NS_ENSURE_SUCCESS(rv, rv);
 
             aElement->AppendChildTo(bodyContent, PR_FALSE);

From a6a9e1fd22b55541a48971db3448cbda7f84b140 Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Sun, 5 Sep 2010 01:31:19 -0400
Subject: [PATCH 158/222] Bug 593618 - Because we always paint the whole
 texture we're drawing to, we need to validate and draw the _bounds_ of the
 visible region, not just the visible region's subrectangles. r=bas
 a=blocking2.0:beta6+

---
 gfx/layers/d3d9/ThebesLayerD3D9.cpp | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/gfx/layers/d3d9/ThebesLayerD3D9.cpp b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
index e7411023331c..ce8a91fa405f 100644
--- a/gfx/layers/d3d9/ThebesLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ThebesLayerD3D9.cpp
@@ -200,13 +200,19 @@ ThebesLayerD3D9::RenderLayer()
     mValidRegion.SetEmpty();
   }
 
-  if (!mValidRegion.IsEqual(mVisibleRegion)) {
+  if (!mValidRegion.IsEqual(mVisibleRegion.GetBounds())) {
+    /* We use the bounds of the visible region because we draw the bounds of
+     * this region when we draw this entire texture. We have to make sure that
+     * the areas that aren't filled with content get their background drawn.
+     * This is an issue for opaque surfaces, which otherwise won't get their
+     * background painted.
+     */
     nsIntRegion region;
-    region.Sub(mVisibleRegion, mValidRegion);
+    region.Sub(mVisibleRegion.GetBounds(), mValidRegion);
 
     DrawRegion(region);
 
-    mValidRegion = mVisibleRegion;
+    mValidRegion = mVisibleRegion.GetBounds();
   }
 
   float quadTransform[4][4];

From 6edac14c064f2785d113df9f053dab6f5db26be9 Mon Sep 17 00:00:00 2001
From: Joe Drew <joe@drew.ca>
Date: Sun, 5 Sep 2010 01:39:38 -0400
Subject: [PATCH 159/222] Bug 581212 - turn on Direct3D accelerated layers by
 default on Windows. r=vlad a=blocking2.0:beta6+

---
 modules/libpref/src/init/all.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 5b2f4765842a..dc571919a164 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -3182,7 +3182,11 @@ pref("gfx.color_management.mode", 0);
 pref("mozilla.widget.render-mode", -1);
 
 // Default value of acceleration for all widgets.
+#ifdef XP_WIN
+pref("layers.accelerate-all", true);
+#else
 pref("layers.accelerate-all", false);
+#endif
 
 // Whether to allow acceleration on layers at all.
 pref("layers.accelerate-none", false);

From 636852ef94db17d3b6519f056ad9ec9b06c8eb02 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Sun, 5 Sep 2010 16:17:02 +0200
Subject: [PATCH 160/222] Bug 580063: Add a LatestSinceStartup() method to
 function timer logs. r=vlad a=benjamin

---
 xpcom/base/FunctionTimer.cpp | 10 +++++++++-
 xpcom/base/FunctionTimer.h   | 13 +++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/xpcom/base/FunctionTimer.cpp b/xpcom/base/FunctionTimer.cpp
index 5b994fe68f9b..0d25eb414a67 100644
--- a/xpcom/base/FunctionTimer.cpp
+++ b/xpcom/base/FunctionTimer.cpp
@@ -86,6 +86,7 @@ FunctionTimer::InitTimers()
 }
 
 FunctionTimerLog::FunctionTimerLog(const char *fname)
+    : mLatest(sAppStart)
 {
     if (strcmp(fname, "stdout") == 0) {
         mFile = stdout;
@@ -119,11 +120,18 @@ void
 FunctionTimerLog::LogString(const char *str)
 {
     if (mFile) {
-        TimeDuration elapsed = TimeStamp::Now() - sAppStart;
+        mLatest = TimeStamp::Now();
+        TimeDuration elapsed = mLatest - sAppStart;
         fprintf((FILE*)mFile, "[% 9.2f] %s\n", elapsed.ToSeconds() * 1000.0, str);
     }
 }
 
+TimeDuration
+FunctionTimerLog::LatestSinceStartup() const
+{
+    return mLatest - sAppStart;
+}
+
 int
 FunctionTimer::ft_vsnprintf(char *str, int maxlen, const char *fmt, va_list args)
 {
diff --git a/xpcom/base/FunctionTimer.h b/xpcom/base/FunctionTimer.h
index 2362d2e72318..0d71ff25c0bd 100644
--- a/xpcom/base/FunctionTimer.h
+++ b/xpcom/base/FunctionTimer.h
@@ -112,6 +112,11 @@
 #define NS_TIME_FUNCTION_ELAPSED_SINCE_MARK                             \
     ft__autogen.ElapsedSinceMark
 
+// A TimeDuration value representing the elapsed time between the
+// last logged event of any sort and the app startup.
+#define NS_TIME_FUNCTION_LATEST \
+    mozilla::FunctionTimer::LatestSinceStartup()
+
 #else
 
 #define NS_TIME_FUNCTION do { } while (0)
@@ -122,6 +127,7 @@
 #define NS_TIME_FUNCTION_MARK(...) do { } while (0)
 #define NS_TIME_FUNCTION_ELAPSED (0)
 #define NS_TIME_FUNCTION_ELAPSED_SINCE_MARK (0)
+#define NS_TIME_FUNCTION_LATEST (mozilla::TimeDuration(0))
 
 #endif
 
@@ -135,8 +141,11 @@ public:
 
     void LogString(const char *str);
 
+    TimeDuration LatestSinceStartup() const;
+
 private:
     void *mFile;
+    TimeStamp mLatest;
 };
 
 class NS_COM FunctionTimer
@@ -199,6 +208,10 @@ public:
         return 0.0;
     }
 
+    static inline TimeDuration LatestSinceStartup() {
+        return sLog ? sLog->LatestSinceStartup() : TimeDuration(0);
+    }
+
     FunctionTimer(double minms, const char *s, ...)
         : mMinMs(minms), mHasMinMs(PR_TRUE),
           mEnabled(sLog && s && *s), mDepth(++sDepth)

From 12d0992fbc39ac7ba6014b2fba5e227fa2dded9e Mon Sep 17 00:00:00 2001
From: Kyle Huey <khuey@kylehuey.com>
Date: Sun, 5 Sep 2010 09:09:04 -0400
Subject: [PATCH 161/222] Bug 583863: Refactor <input> implementation to deal
 with files that are not on the disk. r=sicking a=blocking-fennec

---
 .../test/browser/browser_248970_b.js          |    7 +-
 .../test/browser/browser_346337.js            |   17 +-
 .../test/browser/browser_466937.js            |    8 +-
 content/base/public/Makefile.in               |    1 -
 content/base/public/nsDOMFile.h               |   37 +-
 content/base/public/nsIDOMFile.idl            |   11 +-
 content/base/public/nsIDOMFileInternal.idl    |   46 -
 content/base/src/nsDOMFile.cpp                |  178 ++-
 content/base/src/nsDOMFileReader.cpp          |   37 +-
 content/base/src/nsDOMFileReader.h            |    6 +-
 .../base/src/nsFileDataProtocolHandler.cpp    |   17 +-
 content/base/src/nsFileDataProtocolHandler.h  |    5 +-
 content/base/src/nsFormData.cpp               |   13 +-
 content/base/src/nsFormData.h                 |    8 +-
 content/base/src/nsXMLHttpRequest.cpp         |   24 -
 content/base/test/test_bug345339.html         |   15 +-
 content/html/content/public/Makefile.in       |    1 -
 .../html/content/public/nsFormSubmission.h    |    5 +-
 .../content/public/nsIFileControlElement.h    |   86 --
 content/html/content/src/nsFormSubmission.cpp |   41 +-
 .../html/content/src/nsGenericHTMLElement.h   |   12 +
 .../html/content/src/nsHTMLInputElement.cpp   |  241 ++--
 content/html/content/src/nsHTMLInputElement.h | 1052 +++++++++--------
 docshell/test/chrome/bug294258_window.xul     |   10 +-
 .../base/tests/chrome/printpreview_helper.xul |    7 +-
 layout/forms/nsFileControlFrame.cpp           |   78 +-
 layout/forms/nsICapturePicker.idl             |    4 +-
 27 files changed, 996 insertions(+), 971 deletions(-)
 delete mode 100644 content/base/public/nsIDOMFileInternal.idl
 delete mode 100644 content/html/content/public/nsIFileControlElement.h

diff --git a/browser/components/sessionstore/test/browser/browser_248970_b.js b/browser/components/sessionstore/test/browser/browser_248970_b.js
index 458d7104a6f8..1fa00efaaaf9 100644
--- a/browser/components/sessionstore/test/browser/browser_248970_b.js
+++ b/browser/components/sessionstore/test/browser/browser_248970_b.js
@@ -45,6 +45,11 @@ function test() {
     return false;
   }
 
+  var file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsIFile);
+  filePath = file.path;
+
   let fieldList = {
     "//input[@name='input']":     Date.now().toString(),
     "//input[@name='spaced 1']":  Math.random().toString(),
@@ -59,7 +64,7 @@ function test() {
     "//textarea[1]":              "",
     "//textarea[2]":              "Some text... " + Math.random(),
     "//textarea[3]":              "Some more text\n" + new Date(),
-    "//input[@type='file']":      "/dev/null"
+    "//input[@type='file']":      filePath
   };
 
   function getElementByXPath(aTab, aQuery) {
diff --git a/browser/components/sessionstore/test/browser/browser_346337.js b/browser/components/sessionstore/test/browser/browser_346337.js
index 1f3baabc00de..e5333b227eaa 100644
--- a/browser/components/sessionstore/test/browser/browser_346337.js
+++ b/browser/components/sessionstore/test/browser/browser_346337.js
@@ -36,6 +36,19 @@
 
 function test() {
   /** Test for Bug 346337 **/
+
+  var file = Components.classes["@mozilla.org/file/directory_service;1"]
+               .getService(Components.interfaces.nsIProperties)
+               .get("TmpD", Components.interfaces.nsILocalFile);
+  file.append("346337_test1.file");
+  file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
+  filePath1 = file.path;
+  file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsILocalFile);
+  file.append("346337_test2.file");
+  file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
+  filePath2 = file.path;
   
   let fieldList = {
     "//input[@name='input']":     Date.now().toString(),
@@ -51,8 +64,8 @@ function test() {
     "//textarea[1]":              "",
     "//textarea[2]":              "Some text... " + Math.random(),
     "//textarea[3]":              "Some more text\n" + new Date(),
-    "//input[@type='file'][1]":   ["/dev/null"],
-    "//input[@type='file'][2]":   ["/dev/null", "/dev/stdin"]
+    "//input[@type='file'][1]":   [filePath1],
+    "//input[@type='file'][2]":   [filePath1, filePath2]
   };
   
   function getElementByXPath(aTab, aQuery) {
diff --git a/browser/components/sessionstore/test/browser/browser_466937.js b/browser/components/sessionstore/test/browser/browser_466937.js
index e8cfd80456ad..00356a08fae5 100644
--- a/browser/components/sessionstore/test/browser/browser_466937.js
+++ b/browser/components/sessionstore/test/browser/browser_466937.js
@@ -38,10 +38,16 @@ function test() {
   /** Test for Bug 466937 **/
   
   waitForExplicitFinish();
+
+  var file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsILocalFile);
+  file.append("466937_test.file");
+  file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
+  filePath = file.path;
   
   let testURL = "http://mochi.test:8888/browser/" +
     "browser/components/sessionstore/test/browser/browser_466937_sample.html";
-  let testPath = "/home/user/regular.file";
   
   let tab = gBrowser.addTab(testURL);
   tab.linkedBrowser.addEventListener("load", function(aEvent) {
diff --git a/content/base/public/Makefile.in b/content/base/public/Makefile.in
index a7580a76ab5c..c0758b948615 100644
--- a/content/base/public/Makefile.in
+++ b/content/base/public/Makefile.in
@@ -99,7 +99,6 @@ XPIDLSRCS	= \
 		nsIDocumentEncoder.idl      \
 		nsIDOMFile.idl \
 		nsIDOMFileReader.idl \
-		nsIDOMFileInternal.idl \
 		nsIDOMFileList.idl \
 		nsIDOMFileException.idl \
 		nsIDOMFileError.idl \
diff --git a/content/base/public/nsDOMFile.h b/content/base/public/nsDOMFile.h
index 7e984a2af5b3..4df62f573741 100644
--- a/content/base/public/nsDOMFile.h
+++ b/content/base/public/nsDOMFile.h
@@ -41,7 +41,6 @@
 
 #include "nsICharsetDetectionObserver.h"
 #include "nsIDOMFile.h"
-#include "nsIDOMFileInternal.h"
 #include "nsIDOMFileList.h"
 #include "nsIDOMFileError.h"
 #include "nsIInputStream.h"
@@ -51,24 +50,32 @@
 #include "nsIWeakReference.h"
 #include "nsIWeakReferenceUtils.h"
 #include "nsIDocument.h"
+#include "nsIXMLHttpRequest.h"
 
 class nsIDOMDocument;
 class nsIFile;
 class nsIInputStream;
 
 class nsDOMFile : public nsIDOMFile,
-                  public nsIDOMFileInternal,
+                  public nsIXHRSendable,
                   public nsICharsetDetectionObserver
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMFILE
-  NS_DECL_NSIDOMFILEINTERNAL
+  NS_DECL_NSIXHRSENDABLE
+
+  nsDOMFile(nsIFile *aFile, nsIDocument* aRelatedDoc, nsAString& aContentType)
+    : mFile(aFile),
+      mRelatedDoc(do_GetWeakReference(aRelatedDoc)),
+      mContentType(aContentType)
+  {}
 
   nsDOMFile(nsIFile *aFile, nsIDocument* aRelatedDoc)
     : mFile(aFile),
       mRelatedDoc(do_GetWeakReference(aRelatedDoc))
   {}
+
   ~nsDOMFile() {}
 
   // from nsICharsetDetectionObserver
@@ -87,6 +94,30 @@ private:
                          nsAString &aResult);
 };
 
+class nsDOMMemoryFile : public nsDOMFile
+{
+public:
+  nsDOMMemoryFile(void *aMemoryBuffer,
+                  PRUint64 aLength,
+                  nsAString& aContentType,
+                  nsIDocument *aRelatedDoc)
+    : nsDOMFile(nsnull, aRelatedDoc, aContentType),
+      mInternalData(aMemoryBuffer), mLength(aLength)
+  { }
+
+  ~nsDOMMemoryFile()
+  { free(mInternalData); }
+
+  NS_IMETHOD GetName(nsAString&);
+  NS_IMETHOD GetSize(PRUint64*);
+  NS_IMETHOD GetInternalStream(nsIInputStream**);
+  NS_IMETHOD GetMozFullPathInternal(nsAString&);
+
+protected:
+  void* mInternalData;
+  PRUint64 mLength;
+};
+
 class nsDOMFileList : public nsIDOMFileList
 {
 public:
diff --git a/content/base/public/nsIDOMFile.idl b/content/base/public/nsIDOMFile.idl
index 4af299e92f40..9e63b5dfeb51 100644
--- a/content/base/public/nsIDOMFile.idl
+++ b/content/base/public/nsIDOMFile.idl
@@ -38,8 +38,10 @@
 #include "domstubs.idl"
 
 interface nsIDOMFileError;
+interface nsIInputStream;
+interface nsIURI;
 
-[scriptable, uuid(b10293e1-d531-4bdd-9b2b-4d8c1c9bc633)]
+[scriptable, uuid(e72e2d6e-e267-4ea1-a798-6703d3a2c362)]
 interface nsIDOMFile : nsISupports
 {
   //fileName and fileSize are now deprecated attributes
@@ -56,4 +58,11 @@ interface nsIDOMFile : nsISupports
   DOMString getAsText(in DOMString encoding); // raises(FileException) on retrieval
   DOMString getAsDataURL();             // raises(FileException) on retrieval
   DOMString getAsBinary();              // raises(FileException) on retrieval
+
+  [noscript] readonly attribute nsIInputStream internalStream;
+  // The caller is responsible for releasing the internalUrl from the
+  // moz-filedata: protocol handler
+  [noscript] readonly attribute DOMString internalUrl;
+  // This performs no security checks!
+  [noscript] readonly attribute DOMString mozFullPathInternal;
 };
diff --git a/content/base/public/nsIDOMFileInternal.idl b/content/base/public/nsIDOMFileInternal.idl
deleted file mode 100644
index a4e5dd6d461e..000000000000
--- a/content/base/public/nsIDOMFileInternal.idl
+++ /dev/null
@@ -1,46 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Mozilla Corporation
- * Portions created by the Initial Developer are Copyright (C) 2007
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "domstubs.idl"
-
-interface nsIFile;
-
-[scriptable, uuid(047CA6C4-52B3-46F1-8976-E198B724F72F)]
-interface nsIDOMFileInternal : nsISupports
-{
-  attribute nsIFile internalFile;
-};
diff --git a/content/base/src/nsDOMFile.cpp b/content/base/src/nsDOMFile.cpp
index 05bd5a20f5fd..abb71f66421d 100644
--- a/content/base/src/nsDOMFile.cpp
+++ b/content/base/src/nsDOMFile.cpp
@@ -15,7 +15,7 @@
  * The Original Code is mozila.org code.
  *
  * The Initial Developer of the Original Code is
- * Mozilla Corporation
+ * Mozilla Foundation
  * Portions created by the Initial Developer are Copyright (C) 2007
  * the Initial Developer. All Rights Reserved.
  *
@@ -61,6 +61,7 @@
 #include "nsNetUtil.h"
 #include "nsIUUIDGenerator.h"
 #include "nsFileDataProtocolHandler.h"
+#include "nsStringStream.h"
 
 #include "plbase64.h"
 #include "prmem.h"
@@ -72,7 +73,7 @@ DOMCI_DATA(File, nsDOMFile)
 NS_INTERFACE_MAP_BEGIN(nsDOMFile)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMFile)
   NS_INTERFACE_MAP_ENTRY(nsIDOMFile)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMFileInternal)
+  NS_INTERFACE_MAP_ENTRY(nsIXHRSendable)
   NS_INTERFACE_MAP_ENTRY(nsICharsetDetectionObserver)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(File)
 NS_INTERFACE_MAP_END
@@ -116,12 +117,18 @@ NS_IMETHODIMP
 nsDOMFile::GetMozFullPath(nsAString &aFileName)
 {
   if (nsContentUtils::IsCallerTrustedForCapability("UniversalFileRead")) {
-    return mFile->GetPath(aFileName);
+    return GetMozFullPathInternal(aFileName);
   }
   aFileName.Truncate();
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDOMFile::GetMozFullPathInternal(nsAString &aFilename)
+{
+  return mFile->GetPath(aFilename);
+}
+
 NS_IMETHODIMP
 nsDOMFile::GetSize(PRUint64 *aFileSize)
 {
@@ -162,36 +169,56 @@ nsDOMFile::GetType(nsAString &aType)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDOMFile::GetInternalStream(nsIInputStream **aStream)
+{
+  return NS_NewLocalFileInputStream(aStream, mFile, -1, -1,
+                                    nsIFileInputStream::CLOSE_ON_EOF |
+                                    nsIFileInputStream::REOPEN_ON_REWIND);
+}
+
 NS_IMETHODIMP
 nsDOMFile::GetUrl(nsAString& aURL)
 {
   if (mURL.IsEmpty()) {
-    nsresult rv;
-    nsCOMPtr<nsIUUIDGenerator> uuidgen =
-      do_GetService("@mozilla.org/uuid-generator;1", &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-  
-    nsID id;
-    rv = uuidgen->GenerateUUIDInPlace(&id);
-    NS_ENSURE_SUCCESS(rv, rv);
-  
-    char chars[NSID_LENGTH];
-    id.ToProvidedString(chars);
-    
-    nsCString url = NS_LITERAL_CSTRING(FILEDATA_SCHEME ":") +
-                    Substring(chars + 1, chars + NSID_LENGTH - 2);
+    GetInternalUrl(mURL);
 
     nsCOMPtr<nsIDocument> doc = do_QueryReferent(mRelatedDoc);
-    if (doc) {
-      doc->RegisterFileDataUri(url);
-      nsFileDataProtocolHandler::AddFileDataEntry(url, mFile,
-                                                  doc->NodePrincipal());
-    }
-
-    CopyASCIItoUTF16(url, mURL);
+    NS_LossyConvertUTF16toASCII shortURL(mURL);
+    doc->RegisterFileDataUri(shortURL);
   }
 
   aURL = mURL;
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDOMFile::GetInternalUrl(nsAString& aURL)
+{
+  nsresult rv;
+  nsCOMPtr<nsIUUIDGenerator> uuidgen =
+    do_GetService("@mozilla.org/uuid-generator;1", &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  nsID id;
+  rv = uuidgen->GenerateUUIDInPlace(&id);
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  char chars[NSID_LENGTH];
+  id.ToProvidedString(chars);
+    
+  nsCString url = NS_LITERAL_CSTRING(FILEDATA_SCHEME ":") +
+    Substring(chars + 1, chars + NSID_LENGTH - 2);
+
+  nsCOMPtr<nsIDocument> doc = do_QueryReferent(mRelatedDoc);
+  if (doc) {
+    nsFileDataProtocolHandler::AddFileDataEntry(url,
+                                                this,
+                                                doc->NodePrincipal());
+  }
+
+  CopyASCIItoUTF16(url, aURL);
   
   return NS_OK;
 }
@@ -202,9 +229,7 @@ nsDOMFile::GetAsText(const nsAString &aCharset, nsAString &aResult)
   aResult.Truncate();
 
   nsCOMPtr<nsIInputStream> stream;
-  nsresult rv = NS_NewLocalFileInputStream
-                  (getter_AddRefs(stream),
-                   mFile, -1, -1, 0);
+  nsresult rv = GetInternalStream(getter_AddRefs(stream));
   NS_ENSURE_SUCCESS(rv, DOMFileResult(rv));
 
   nsCAutoString charsetGuess;
@@ -231,43 +256,33 @@ nsDOMFile::GetAsText(const nsAString &aCharset, nsAString &aResult)
   return ConvertStream(stream, charset.get(), aResult);
 }
 
-NS_IMETHODIMP
-nsDOMFile::GetInternalFile(nsIFile **aFile)
-{
-  NS_IF_ADDREF(*aFile = mFile);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMFile::SetInternalFile(nsIFile *aFile)
-{
-  mFile = aFile;
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsDOMFile::GetAsDataURL(nsAString &aResult)
 {
   aResult.AssignLiteral("data:");
 
   nsresult rv;
-  nsCOMPtr<nsIMIMEService> mimeService =
-    do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (!mContentType.Length()) {
+    nsCOMPtr<nsIMIMEService> mimeService =
+      do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCAutoString contentType;
-  rv = mimeService->GetTypeFromFile(mFile, contentType);
-  if (NS_SUCCEEDED(rv)) {
-    AppendUTF8toUTF16(contentType, aResult);
+    nsCAutoString contentType;
+    rv = mimeService->GetTypeFromFile(mFile, contentType);
+    if (NS_SUCCEEDED(rv)) {
+      CopyUTF8toUTF16(contentType, mContentType);
+    }
+  }
+
+  if (mContentType.Length()) {
+    aResult.Append(mContentType);
   } else {
     aResult.AppendLiteral("application/octet-stream");
   }
   aResult.AppendLiteral(";base64,");
 
   nsCOMPtr<nsIInputStream> stream;
-  rv = NS_NewLocalFileInputStream(getter_AddRefs(stream),
-                                  mFile, -1, -1,
-                                  nsIFileInputStream::CLOSE_ON_EOF);
+  rv = GetInternalStream(getter_AddRefs(stream));
   NS_ENSURE_SUCCESS(rv, DOMFileResult(rv));
 
   char readBuf[4096];
@@ -307,10 +322,7 @@ nsDOMFile::GetAsBinary(nsAString &aResult)
   aResult.Truncate();
 
   nsCOMPtr<nsIInputStream> stream;
-  nsresult rv = NS_NewLocalFileInputStream
-                  (getter_AddRefs(stream),
-                   mFile, -1, -1,
-                   nsIFileInputStream::CLOSE_ON_EOF);
+  nsresult rv = GetInternalStream(getter_AddRefs(stream));
   NS_ENSURE_SUCCESS(rv, DOMFileResult(rv));
 
   PRUint32 numRead;
@@ -423,6 +435,29 @@ nsDOMFile::GuessCharset(nsIInputStream *aStream,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDOMFile::GetSendInfo(nsIInputStream** aBody,
+                       nsACString& aContentType,
+                       nsACString& aCharset)
+{
+  nsresult rv;
+
+  nsCOMPtr<nsIInputStream> stream;
+  rv = this->GetInternalStream(getter_AddRefs(stream));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsString contentType;
+  rv = this->GetType(contentType);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  CopyUTF16toUTF8(contentType, aContentType);
+
+  aCharset.Truncate();
+
+  stream.forget(aBody);
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDOMFile::Notify(const char* aCharset, nsDetectionConfident aConf)
 {
@@ -463,6 +498,39 @@ nsDOMFile::ConvertStream(nsIInputStream *aStream,
   return rv;
 }
 
+// nsDOMMemoryFile Implementation
+NS_IMETHODIMP
+nsDOMMemoryFile::GetName(nsAString &aFileName)
+{
+  aFileName.Truncate();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDOMMemoryFile::GetSize(PRUint64 *aFileSize)
+{
+  *aFileSize = mLength;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDOMMemoryFile::GetInternalStream(nsIInputStream **aStream)
+{
+  if (mLength > PR_INT32_MAX)
+    return NS_ERROR_FAILURE;
+
+  PRInt32 l = mLength;
+
+  return NS_NewByteInputStream(aStream, (const char*)mInternalData, l);
+}
+
+NS_IMETHODIMP
+nsDOMMemoryFile::GetMozFullPathInternal(nsAString &aFilename)
+{
+  aFilename.Truncate();
+  return NS_OK;
+}
+
 // nsDOMFileList implementation
 
 DOMCI_DATA(FileList, nsDOMFileList)
diff --git a/content/base/src/nsDOMFileReader.cpp b/content/base/src/nsDOMFileReader.cpp
index 0fdb844ed1f3..46f510b8a81f 100644
--- a/content/base/src/nsDOMFileReader.cpp
+++ b/content/base/src/nsDOMFileReader.cpp
@@ -15,7 +15,7 @@
  * The Original Code is mozila.org code.
  *
  * The Initial Developer of the Original Code is
- * Mozilla Corporation
+ * Mozilla Foundation
  * Portions created by the Initial Developer are Copyright (C) 2007
  * the Initial Developer. All Rights Reserved.
  *
@@ -71,13 +71,13 @@
 #include "nsJSEnvironment.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIDOMClassInfo.h"
-#include "nsIDOMFileInternal.h"
 #include "nsCExternalHandlerService.h"
 #include "nsIStreamConverterService.h"
 #include "nsEventDispatcher.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsLayoutStatics.h"
 #include "nsIScriptObjectPrincipal.h"
+#include "nsFileDataProtocolHandler.h"
 
 #define LOAD_STR "load"
 #define ERROR_STR "error"
@@ -496,26 +496,31 @@ nsDOMFileReader::ReadFileContent(nsIDOMFile* aFile,
   mReadyState = nsIDOMFileReader::EMPTY;
   FreeFileData();
 
+  mFile = aFile;
   mDataFormat = aDataFormat;
   mCharset = aCharset;
 
-  //Obtain the nsDOMFile's underlying nsIFile
-  nsresult rv;
-  nsCOMPtr<nsIDOMFileInternal> domFile(do_QueryInterface(aFile));
-  rv = domFile->GetInternalFile(getter_AddRefs(mFile));
+  //Establish a channel with our file
+  nsAutoString url;
+  nsresult rv = mFile->GetInternalUrl(url);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  //Establish a channel with our file
   nsCOMPtr<nsIURI> uri;
-  rv = NS_NewFileURI(getter_AddRefs(uri), mFile);
+  rv = NS_NewURI(getter_AddRefs(uri), url);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = NS_NewChannel(getter_AddRefs(mChannel), uri);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  // After we open the channel we don't need the url anymore.  The channel will
+  // hold alive whatever we're interested in.
+  nsCAutoString narrowUrl;
+  CopyUTF16toUTF8(url, narrowUrl);
+  nsFileDataProtocolHandler::RemoveFileDataEntry(narrowUrl);
+
   //Obtain the total size of the file before reading
   mReadTotal = -1;
-  mFile->GetFileSize(&mReadTotal);
+  mFile->GetSize(&mReadTotal);
 
   rv = mChannel->AsyncOpen(this, nsnull);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -604,7 +609,7 @@ nsDOMFileReader::GetAsText(const nsAString &aCharset,
 }
 
 nsresult
-nsDOMFileReader::GetAsDataURL(nsIFile *aFile,
+nsDOMFileReader::GetAsDataURL(nsIDOMFile *aFile,
                               const char *aFileData,
                               PRUint32 aDataLen,
                               nsAString& aResult)
@@ -612,14 +617,10 @@ nsDOMFileReader::GetAsDataURL(nsIFile *aFile,
   aResult.AssignLiteral("data:");
 
   nsresult rv;
-  nsCOMPtr<nsIMIMEService> mimeService =
-    do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCAutoString contentType;
-  rv = mimeService->GetTypeFromFile(aFile, contentType);
-  if (NS_SUCCEEDED(rv)) {
-    AppendUTF8toUTF16(contentType, aResult);
+  nsString contentType;
+  rv = aFile->GetType(contentType);
+  if (NS_SUCCEEDED(rv) && !contentType.IsEmpty()) {
+    aResult.Append(contentType);
   } else {
     aResult.AppendLiteral("application/octet-stream");
   }
diff --git a/content/base/src/nsDOMFileReader.h b/content/base/src/nsDOMFileReader.h
index 42922d632ba3..fdd028cac6cf 100644
--- a/content/base/src/nsDOMFileReader.h
+++ b/content/base/src/nsDOMFileReader.h
@@ -120,7 +120,7 @@ protected:
   nsresult ReadFileContent(nsIDOMFile *aFile, const nsAString &aCharset, eDataFormat aDataFormat); 
   nsresult GetAsText(const nsAString &aCharset,
                      const char *aFileData, PRUint32 aDataLen, nsAString &aResult);
-  nsresult GetAsDataURL(nsIFile *aFile, const char *aFileData, PRUint32 aDataLen, nsAString &aResult); 
+  nsresult GetAsDataURL(nsIDOMFile *aFile, const char *aFileData, PRUint32 aDataLen, nsAString &aResult); 
   nsresult GuessCharset(const char *aFileData, PRUint32 aDataLen, nsACString &aCharset); 
   nsresult ConvertStream(const char *aFileData, PRUint32 aDataLen, const char *aCharset, nsAString &aResult); 
   void DispatchError(nsresult rv);
@@ -133,7 +133,7 @@ protected:
   }
 
   char *mFileData;
-  nsCOMPtr<nsIFile> mFile;
+  nsCOMPtr<nsIDOMFile> mFile;
   nsString mCharset;
   PRUint32 mDataLen;
 
@@ -150,7 +150,7 @@ protected:
   nsCOMPtr<nsIPrincipal> mPrincipal;
   nsCOMPtr<nsIChannel> mChannel;
 
-  PRInt64 mReadTotal;
+  PRUint64 mReadTotal;
   PRUint64 mReadTransferred;
 
   nsRefPtr<nsDOMEventListenerWrapper> mOnLoadEndListener;
diff --git a/content/base/src/nsFileDataProtocolHandler.cpp b/content/base/src/nsFileDataProtocolHandler.cpp
index 314c987fd4bf..9c1bf5db4f66 100644
--- a/content/base/src/nsFileDataProtocolHandler.cpp
+++ b/content/base/src/nsFileDataProtocolHandler.cpp
@@ -42,7 +42,7 @@
 #include "nsNetUtil.h"
 #include "nsIURIWithPrincipal.h"
 #include "nsIPrincipal.h"
-#include "nsIFileChannel.h"
+#include "nsIDOMFile.h"
 #include "nsISerializable.h"
 #include "nsIClassInfo.h"
 #include "nsIObjectInputStream.h"
@@ -55,14 +55,15 @@ static NS_DEFINE_CID(kSimpleURICID, NS_SIMPLEURI_CID);
 // Hash table
 struct FileDataInfo
 {
-  nsCOMPtr<nsIURI> mFileUri;
+  nsCOMPtr<nsIDOMFile> mFile;
   nsCOMPtr<nsIPrincipal> mPrincipal;
 };
 
 static nsClassHashtable<nsCStringHashKey, FileDataInfo>* gFileDataTable;
 
 void
-nsFileDataProtocolHandler::AddFileDataEntry(nsACString& aUri, nsIFile* aFile,
+nsFileDataProtocolHandler::AddFileDataEntry(nsACString& aUri,
+					    nsIDOMFile* aFile,
                                             nsIPrincipal* aPrincipal)
 {
   if (!gFileDataTable) {
@@ -72,7 +73,7 @@ nsFileDataProtocolHandler::AddFileDataEntry(nsACString& aUri, nsIFile* aFile,
 
   FileDataInfo* info = new FileDataInfo;
 
-  NS_NewFileURI(getter_AddRefs(info->mFileUri), aFile);
+  info->mFile = aFile;
   info->mPrincipal = aPrincipal;
 
   gFileDataTable->Put(aUri, info);
@@ -413,8 +414,14 @@ nsFileDataProtocolHandler::NewChannel(nsIURI* uri, nsIChannel* *result)
   }
 #endif
 
+  nsCOMPtr<nsIInputStream> stream;
+  nsresult rv = info->mFile->GetInternalStream(getter_AddRefs(stream));
+  NS_ENSURE_SUCCESS(rv, rv);
+
   nsCOMPtr<nsIChannel> channel;
-  nsresult rv = NS_NewChannel(getter_AddRefs(channel), info->mFileUri);
+  rv = NS_NewInputStreamChannel(getter_AddRefs(channel),
+				uri,
+				stream);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsISupports> owner = do_QueryInterface(info->mPrincipal);
diff --git a/content/base/src/nsFileDataProtocolHandler.h b/content/base/src/nsFileDataProtocolHandler.h
index 402f56a67797..b98d397b492e 100644
--- a/content/base/src/nsFileDataProtocolHandler.h
+++ b/content/base/src/nsFileDataProtocolHandler.h
@@ -41,7 +41,7 @@
 
 #define FILEDATA_SCHEME "moz-filedata"
 
-class nsIFile;
+class nsIDOMFile;
 class nsIPrincipal;
 
 class nsFileDataProtocolHandler : public nsIProtocolHandler
@@ -57,7 +57,8 @@ public:
   virtual ~nsFileDataProtocolHandler() {}
 
   // Methods for managing uri->file mapping
-  static void AddFileDataEntry(nsACString& aUri, nsIFile* aFile,
+  static void AddFileDataEntry(nsACString& aUri,
+			       nsIDOMFile* aFile,
                                nsIPrincipal* aPrincipal);
   static void RemoveFileDataEntry(nsACString& aUri);
   
diff --git a/content/base/src/nsFormData.cpp b/content/base/src/nsFormData.cpp
index 068964108cce..c9176d9c245b 100644
--- a/content/base/src/nsFormData.cpp
+++ b/content/base/src/nsFormData.cpp
@@ -36,9 +36,8 @@
 
 #include "nsFormData.h"
 #include "nsIVariant.h"
-#include "nsIDOMFileInternal.h"
 #include "nsIInputStream.h"
-#include "nsIFile.h"
+#include "nsIDOMFile.h"
 #include "nsContentUtils.h"
 
 nsFormData::nsFormData()
@@ -84,7 +83,7 @@ nsFormData::AddNameValuePair(const nsAString& aName,
 
 nsresult
 nsFormData::AddNameFilePair(const nsAString& aName,
-                            nsIFile* aFile)
+                            nsIDOMFile* aFile)
 {
   FormDataTuple* data = mFormData.AppendElement();
   data->name = aName;
@@ -113,13 +112,9 @@ nsFormData::Append(const nsAString& aName, nsIVariant* aValue)
 
     nsMemory::Free(iid);
 
-    nsCOMPtr<nsIDOMFileInternal> domFile = do_QueryInterface(supports);
+    nsCOMPtr<nsIDOMFile> domFile = do_QueryInterface(supports);
     if (domFile) {
-      nsCOMPtr<nsIFile> file;
-      rv = domFile->GetInternalFile(getter_AddRefs(file));
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      return AddNameFilePair(aName, file);
+      return AddNameFilePair(aName, domFile);
     }
   }
 
diff --git a/content/base/src/nsFormData.h b/content/base/src/nsFormData.h
index 3dc745b7416b..19ca9433fce8 100644
--- a/content/base/src/nsFormData.h
+++ b/content/base/src/nsFormData.h
@@ -42,6 +42,8 @@
 #include "nsFormSubmission.h"
 #include "nsTArray.h"
 
+class nsIDOMFile;
+
 class nsFormData : public nsIDOMFormData,
                    public nsIXHRSendable,
                    public nsFormSubmission
@@ -59,16 +61,14 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIFile* aFile);
-
-  
+                                   nsIDOMFile* aFile);
 
 private:
   struct FormDataTuple
   {
     nsString name;
     nsString stringValue;
-    nsCOMPtr<nsIFile> fileValue;
+    nsCOMPtr<nsIDOMFile> fileValue;
     PRBool valueIsFile;
   };
   
diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
index 71649c629d78..fe3921272f6d 100644
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -63,7 +63,6 @@
 #include "nsIScriptGlobalObject.h"
 #include "nsIDOMClassInfo.h"
 #include "nsIDOMElement.h"
-#include "nsIDOMFileInternal.h"
 #include "nsIDOMWindow.h"
 #include "nsIMIMEService.h"
 #include "nsCExternalHandlerService.h"
@@ -2328,29 +2327,6 @@ GetRequestBody(nsIVariant* aBody, nsIInputStream** aResult,
       return NS_OK;
     }
 
-    // nsIDOMFile?
-    nsCOMPtr<nsIDOMFileInternal> file = do_QueryInterface(supports);
-    if (file) {
-      aCharset.Truncate();
-
-      nsCOMPtr<nsIFile> internalFile;
-      rv = file->GetInternalFile(getter_AddRefs(internalFile));
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      // Get the mimetype
-      nsCOMPtr<nsIMIMEService> mimeService =
-          do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      rv = mimeService->GetTypeFromFile(internalFile, aContentType);
-      if (NS_FAILED(rv)) {
-        aContentType.Truncate();
-      }
-
-      // Feed local file input stream into our upload channel
-      return NS_NewLocalFileInputStream(aResult, internalFile);
-    }
-
     // nsIXHRSendable?
     nsCOMPtr<nsIXHRSendable> sendable = do_QueryInterface(supports);
     if (sendable) {
diff --git a/content/base/test/test_bug345339.html b/content/base/test/test_bug345339.html
index 323d5c799ad2..407e268d5449 100644
--- a/content/base/test/test_bug345339.html
+++ b/content/base/test/test_bug345339.html
@@ -22,6 +22,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=345339
 /** Test for Bug 345339 **/
 SimpleTest.waitForExplicitFinish();
 
+var filePath;
+
 function afterLoad() {
     var iframeDoc = $("testframe").contentDocument;
 
@@ -31,8 +33,15 @@ function afterLoad() {
     iframeDoc.getElementById("password").value = "123456";
     iframeDoc.getElementById("hidden").value = "gecko";
 
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalFileRead");
-    iframeDoc.getElementById("file").value = "dummyfile.txt";
+    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+    var file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsILocalFile);
+    file.append("345339_test.file");
+    file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
+    filePath = file.path;
+
+    iframeDoc.getElementById("file").value = filePath;
 
     /* Reload the page */
     $("testframe").setAttribute("onload", "afterReload()");
@@ -55,7 +64,7 @@ function afterReload() {
     is(iframeDoc.getElementById("hidden").value, "gecko",
        "hidden field value preserved");
     netscape.security.PrivilegeManager.enablePrivilege("UniversalFileRead");
-    is(iframeDoc.getElementById("file").value, "dummyfile.txt",
+    is(iframeDoc.getElementById("file").value, filePath,
        "file field value preserved");
 
     SimpleTest.finish();
diff --git a/content/html/content/public/Makefile.in b/content/html/content/public/Makefile.in
index b5de365f6c8d..bb24b40db9be 100644
--- a/content/html/content/public/Makefile.in
+++ b/content/html/content/public/Makefile.in
@@ -60,7 +60,6 @@ EXPORTS = \
 		nsIRadioVisitor.h \
 		nsIRadioGroupContainer.h \
 		nsITextControlElement.h \
-		nsIFileControlElement.h \
 		nsFormSubmission.h \
 		nsIFrameSetElement.h \
 		nsHTMLAudioElement.h \
diff --git a/content/html/content/public/nsFormSubmission.h b/content/html/content/public/nsFormSubmission.h
index 83fbb1ccd8cf..5c26ae9d1016 100644
--- a/content/html/content/public/nsFormSubmission.h
+++ b/content/html/content/public/nsFormSubmission.h
@@ -52,6 +52,7 @@ class nsIDocShell;
 class nsIRequest;
 class nsISaveAsCharset;
 class nsIMultiplexInputStream;
+class nsIDOMFile;
 
 /**
  * Class for form submissions; encompasses the function to call to submit as
@@ -81,7 +82,7 @@ public:
    * @param aFile the file to submit
    */
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIFile* aFile) = 0;
+                                   nsIDOMFile* aFile) = 0;
   
   /**
    * Reports whether the instance supports AddIsindex().
@@ -187,7 +188,7 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIFile* aFile);
+                                   nsIDOMFile* aFile);
   virtual nsresult GetEncodedSubmission(nsIURI* aURI,
                                         nsIInputStream** aPostDataStream);
 
diff --git a/content/html/content/public/nsIFileControlElement.h b/content/html/content/public/nsIFileControlElement.h
deleted file mode 100644
index 73cb76e2baee..000000000000
--- a/content/html/content/public/nsIFileControlElement.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Mozilla Foundation
- * Portions created by the Initial Developer are Copyright (C) 2006
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Jonas Sicking <jonas@sicking.cc> (Original author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nsIFileControlElement_h___
-#define nsIFileControlElement_h___
-
-#include "nsISupports.h"
-#include "nsTArray.h"
-#include "nsString.h"
-#include "nsCOMArray.h"
-
-class nsIFile;
-
-// IID for the nsIFileControl interface
-#define NS_IFILECONTROLELEMENT_IID \
-{ 0x1f6a32fd, 0x9cda, 0x43e9, \
-  { 0x90, 0xef, 0x18, 0x0a, 0xd5, 0xe6, 0xcd, 0xa9 } }
-
-/**
- * This interface is used for the file control frame to store its value away
- * into the content.
- */
-class nsIFileControlElement : public nsISupports {
-public:
-
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IFILECONTROLELEMENT_IID)
-
-  /**
-   * Gets a readable string representing the list of files currently
-   * selected by this control. This value might not be a valid file name
-   * and should not be used for anything but displaying the filename to the
-   * user.
-   */
-  virtual void GetDisplayFileName(nsAString& aFileName) = 0;
-
-  /**
-   * Sets the list of filenames currently selected by this control.
-   */
-  virtual void SetFileNames(const nsTArray<nsString>& aFileNames) = 0;
-
-  /**
-   * Gets a list of nsIFile objects for the files currently selected by
-   * this control.
-   */
-  virtual void GetFileArray(nsCOMArray<nsIFile>& aFiles) = 0;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsIFileControlElement,
-                              NS_IFILECONTROLELEMENT_IID)
-
-#endif // nsIFileControlElement_h___
diff --git a/content/html/content/src/nsFormSubmission.cpp b/content/html/content/src/nsFormSubmission.cpp
index 62563101e83b..d2979ba5486d 100644
--- a/content/html/content/src/nsFormSubmission.cpp
+++ b/content/html/content/src/nsFormSubmission.cpp
@@ -49,9 +49,8 @@
 #include "nsDOMError.h"
 #include "nsGenericHTMLElement.h"
 #include "nsISaveAsCharset.h"
-
-// JBK added for submit move from content frame
 #include "nsIFile.h"
+#include "nsIDOMFile.h"
 #include "nsDirectoryServiceDefs.h"
 #include "nsStringStream.h"
 #include "nsIURI.h"
@@ -110,7 +109,7 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIFile* aFile);
+                                   nsIDOMFile* aFile);
   virtual nsresult GetEncodedSubmission(nsIURI* aURI,
                                         nsIInputStream** aPostDataStream);
 
@@ -196,7 +195,7 @@ nsFSURLEncoded::AddIsindex(const nsAString& aValue)
 
 nsresult
 nsFSURLEncoded::AddNameFilePair(const nsAString& aName,
-                                nsIFile* aFile)
+                                nsIDOMFile* aFile)
 {
   if (!mWarnedFileControl) {
     SendJSWarning(mDocument, "ForgotFileEnctypeWarning", nsnull, 0);
@@ -205,7 +204,7 @@ nsFSURLEncoded::AddNameFilePair(const nsAString& aName,
 
   nsAutoString filename;
   if (aFile) {
-    aFile->GetLeafName(filename);
+    aFile->GetName(filename);
   }
 
   return AddNameValuePair(aName, filename);
@@ -469,7 +468,7 @@ nsFSMultipartFormData::AddNameValuePair(const nsAString& aName,
 
 nsresult
 nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
-                                       nsIFile* aFile)
+                                       nsIDOMFile* aFile)
 {
   // Encode the control name
   nsCAutoString nameStr;
@@ -477,12 +476,13 @@ nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCString filenameStr;
-  nsCAutoString contentType;
+  nsAutoString contentType;
   nsCOMPtr<nsIInputStream> fileStream;
   if (aFile) {
     // Get and encode the filename
     nsAutoString filename;
-    aFile->GetLeafName(filename);
+    rv = aFile->GetName(filename);
+    NS_ENSURE_SUCCESS(rv, rv);
     nsCAutoString encodedFileName;
     rv = EncodeVal(filename, encodedFileName);
     NS_ENSURE_SUCCESS(rv, rv);
@@ -493,20 +493,14 @@ nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
                                         nsLinebreakConverter::eLinebreakNet));
   
     // Get content type
-    nsCOMPtr<nsIMIMEService> MIMEService =
-      do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    rv = MIMEService->GetTypeFromFile(aFile, contentType);
-    if (NS_FAILED(rv)) {
+    rv = aFile->GetType(contentType);
+    if (NS_FAILED(rv) || contentType.IsEmpty()) {
       contentType.AssignLiteral("application/octet-stream");
     }
   
     // Get input stream
-    rv = NS_NewLocalFileInputStream(getter_AddRefs(fileStream),
-                                    aFile, -1, -1,
-                                    nsIFileInputStream::CLOSE_ON_EOF |
-                                    nsIFileInputStream::REOPEN_ON_REWIND);
+    rv = aFile->GetInternalStream(getter_AddRefs(fileStream));
+    NS_ENSURE_SUCCESS(rv, rv);
     if (fileStream) {
       // Create buffered stream (for efficiency)
       nsCOMPtr<nsIInputStream> bufferedStream;
@@ -534,8 +528,9 @@ nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
          NS_LITERAL_CSTRING("Content-Disposition: form-data; name=\"")
        + nameStr + NS_LITERAL_CSTRING("\"; filename=\"")
        + filenameStr + NS_LITERAL_CSTRING("\"" CRLF)
-       + NS_LITERAL_CSTRING("Content-Type: ") + contentType
-       + NS_LITERAL_CSTRING(CRLF CRLF);
+       + NS_LITERAL_CSTRING("Content-Type: ");
+  AppendUTF16toUTF8(contentType, mPostDataChunk);
+  mPostDataChunk += NS_LITERAL_CSTRING(CRLF CRLF);
 
   // Add the file to the stream
   if (fileStream) {
@@ -605,7 +600,7 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIFile* aFile);
+                                   nsIDOMFile* aFile);
   virtual nsresult GetEncodedSubmission(nsIURI* aURI,
                                         nsIInputStream** aPostDataStream);
 
@@ -628,11 +623,11 @@ nsFSTextPlain::AddNameValuePair(const nsAString& aName,
 
 nsresult
 nsFSTextPlain::AddNameFilePair(const nsAString& aName,
-                               nsIFile* aFile)
+                               nsIDOMFile* aFile)
 {
   nsAutoString filename;
   if (aFile) {
-    aFile->GetLeafName(filename);
+    aFile->GetName(filename);
   }
     
   AddNameValuePair(aName, filename);
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index c4d37657c0a0..e5f510585276 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -1315,6 +1315,18 @@ NS_NewHTML##_elementName##Element(already_AddRefed<nsINodeInfo> aNodeInfo,   \
     NS_INTERFACE_TABLE_ENTRY(_class, _i6)                                     \
   NS_OFFSET_AND_INTERFACE_TABLE_END
 
+#define NS_HTML_CONTENT_INTERFACE_TABLE7(_class, _i1, _i2, _i3, _i4, _i5,     \
+                                         _i6, _i7)                            \
+  NS_HTML_CONTENT_INTERFACE_TABLE_BEGIN(_class)                               \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i1)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i2)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i3)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i4)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i5)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i6)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i7)                                     \
+  NS_OFFSET_AND_INTERFACE_TABLE_END
+
 #define NS_HTML_CONTENT_INTERFACE_TABLE8(_class, _i1, _i2, _i3, _i4, _i5,     \
                                          _i6, _i7, _i8)                       \
   NS_HTML_CONTENT_INTERFACE_TABLE_BEGIN(_class)                               \
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index f0ef08b156a0..e82752974615 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -38,7 +38,6 @@
 
 #include "nsIDOMHTMLInputElement.h"
 #include "nsITextControlElement.h"
-#include "nsIFileControlElement.h"
 #include "nsIDOMNSEditableElement.h"
 #include "nsIRadioVisitor.h"
 #include "nsIPhonetic.h"
@@ -93,8 +92,8 @@
 
 #include "nsRuleData.h"
 
-// input type=radio
-#include "nsIRadioGroupContainer.h"
+// input type=radio
+#include "nsIRadioGroupContainer.h"
 
 // input type=file
 #include "nsIFile.h"
@@ -207,12 +206,13 @@ class nsHTMLInputElementState : public nsISupports
       mValue = aValue;
     }
 
-    const nsTArray<nsString>& GetFilenames() {
-      return mFilenames;
+    const nsCOMArray<nsIDOMFile>& GetFiles() {
+      return mFiles;
     }
 
-    void SetFilenames(const nsTArray<nsString> &aFilenames) {
-      mFilenames = aFilenames;
+    void SetFiles(const nsCOMArray<nsIDOMFile> &aFiles) {
+      mFiles.Clear();
+      mFiles.AppendObjects(aFiles);
     }
 
     nsHTMLInputElementState()
@@ -223,7 +223,7 @@ class nsHTMLInputElementState : public nsISupports
  
   protected:
     nsString mValue;
-    nsTArray<nsString> mFilenames;
+    nsCOMArray<nsIDOMFile> mFiles;
     PRPackedBool mChecked;
     PRPackedBool mCheckedSet;
 };
@@ -268,21 +268,21 @@ AsyncClickHandler::Run()
 
   // Check if page is allowed to open the popup
   if (mPopupControlState != openAllowed) {
-    nsCOMPtr<nsIPopupWindowManager> pm =
-      do_GetService(NS_POPUPWINDOWMANAGER_CONTRACTID);
- 
-    if (!pm) {
-      return NS_OK;
-    }
-
-    PRUint32 permission;
-    pm->TestPermission(doc->GetDocumentURI(), &permission);
-    if (permission == nsIPopupWindowManager::DENY_POPUP) {
-      nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(doc);
-      nsGlobalWindow::FirePopupBlockedEvent(domDoc, win, nsnull, EmptyString(), EmptyString());
+    nsCOMPtr<nsIPopupWindowManager> pm =
+      do_GetService(NS_POPUPWINDOWMANAGER_CONTRACTID);
+ 
+    if (!pm) {
       return NS_OK;
     }
-  }
+
+    PRUint32 permission;
+    pm->TestPermission(doc->GetDocumentURI(), &permission);
+    if (permission == nsIPopupWindowManager::DENY_POPUP) {
+      nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(doc);
+      nsGlobalWindow::FirePopupBlockedEvent(domDoc, win, nsnull, EmptyString(), EmptyString());
+      return NS_OK;
+    }
+  }
 
   // Get Loc title
   nsXPIDLString title;
@@ -325,17 +325,24 @@ AsyncClickHandler::Run()
   // Set default directry and filename
   nsAutoString defaultName;
 
-  nsCOMArray<nsIFile> oldFiles;
-  mInput->GetFileArray(oldFiles);
+  const nsCOMArray<nsIDOMFile>& oldFiles = mInput->GetFiles();
 
   if (oldFiles.Count()) {
-    // set directory
-    nsCOMPtr<nsIFile> parentFile;
-    oldFiles[0]->GetParent(getter_AddRefs(parentFile));
-    if (parentFile) {
-      nsCOMPtr<nsILocalFile> parentLocalFile = do_QueryInterface(parentFile, &rv);
-      if (parentLocalFile) {
-        filePicker->SetDisplayDirectory(parentLocalFile);
+    nsString path;
+
+    oldFiles[0]->GetMozFullPathInternal(path);
+
+    nsCOMPtr<nsILocalFile> localFile;
+    rv = NS_NewLocalFile(path, PR_FALSE, getter_AddRefs(localFile));
+
+    if (NS_SUCCEEDED(rv)) {
+      nsCOMPtr<nsIFile> parentFile;
+      rv = localFile->GetParent(getter_AddRefs(parentFile));
+      if (NS_SUCCEEDED(rv)) {
+        nsCOMPtr<nsILocalFile> parentLocalFile = do_QueryInterface(parentFile, &rv);
+        if (parentLocalFile) {
+          filePicker->SetDisplayDirectory(parentLocalFile);
+        }
       }
     }
 
@@ -344,7 +351,7 @@ AsyncClickHandler::Run()
     // one file was selected before.
     if (oldFiles.Count() == 1) {
       nsAutoString leafName;
-      oldFiles[0]->GetLeafName(leafName);
+      oldFiles[0]->GetName(leafName);
       if (!leafName.IsEmpty()) {
         filePicker->SetDefaultString(leafName);
       }
@@ -375,7 +382,7 @@ AsyncClickHandler::Run()
     return NS_OK;
   
   // Collect new selected filenames
-  nsTArray<nsString> newFileNames;
+  nsCOMArray<nsIDOMFile> newFiles;
   if (multi) {
     nsCOMPtr<nsISimpleEnumerator> iter;
     rv = filePicker->GetFiles(getter_AddRefs(iter));
@@ -389,7 +396,9 @@ AsyncClickHandler::Run()
         nsString unicodePath;
         rv = localFile->GetPath(unicodePath);
         if (!unicodePath.IsEmpty()) {
-          newFileNames.AppendElement(unicodePath);
+          nsCOMPtr<nsIDOMFile> domFile =
+            do_QueryObject(new nsDOMFile(localFile, doc));
+          newFiles.AppendObject(domFile);
         }
         if (!prefSaved) {
           // Store the last used directory using the content pref service
@@ -408,7 +417,9 @@ AsyncClickHandler::Run()
       nsString unicodePath;
       rv = localFile->GetPath(unicodePath);
       if (!unicodePath.IsEmpty()) {
-        newFileNames.AppendElement(unicodePath);
+        nsCOMPtr<nsIDOMFile> domFile=
+          do_QueryObject(new nsDOMFile(localFile, doc));
+        newFiles.AppendObject(domFile);
       }
       // Store the last used directory using the content pref service
       rv = nsHTMLInputElement::gUploadLastDir->StoreLastUsedDirectory(doc->GetDocumentURI(),
@@ -418,7 +429,7 @@ AsyncClickHandler::Run()
   }
 
   // Set new selected files
-  if (!newFileNames.IsEmpty()) {
+  if (newFiles.Count()) {
     // Tell mTextFrame that this update of the value is a user initiated
     // change. Otherwise it'll think that the value is being set by a script
     // and not fire onchange when it should.
@@ -428,7 +439,7 @@ AsyncClickHandler::Run()
       textFrame->SetFireChangeEventState(PR_TRUE);
     }
 
-    mInput->SetFileNames(newFileNames);
+    mInput->SetFiles(newFiles);
     if (textFrame) {
       textFrame->SetFireChangeEventState(oldState);
       // May need to fire an onchange here
@@ -669,10 +680,9 @@ DOMCI_NODE_DATA(HTMLInputElement, nsHTMLInputElement)
 
 // QueryInterface implementation for nsHTMLInputElement
 NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(nsHTMLInputElement)
-  NS_HTML_CONTENT_INTERFACE_TABLE9(nsHTMLInputElement,
+  NS_HTML_CONTENT_INTERFACE_TABLE8(nsHTMLInputElement,
                                    nsIDOMHTMLInputElement,
                                    nsITextControlElement,
-                                   nsIFileControlElement,
                                    nsIPhonetic,
                                    imgIDecoderObserver,
                                    nsIImageLoadingContent,
@@ -721,7 +731,14 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
       }
       break;
     case NS_FORM_INPUT_FILE:
-      it->mFileNames = mFileNames;
+      if (it->GetOwnerDoc()->IsStaticDocument()) {
+        // We're going to be used in print preview.  Since the doc is static
+        // we can just grab the pretty string and use it as wallpaper
+        GetDisplayFileName(it->mStaticDocFileList);
+      } else {
+        it->mFiles.Clear();
+        it->mFiles.AppendObjects(mFiles);
+      }
       break;
     case NS_FORM_INPUT_RADIO:
     case NS_FORM_INPUT_CHECKBOX:
@@ -1025,17 +1042,15 @@ nsHTMLInputElement::GetValue(nsAString& aValue)
 
   if (mType == NS_FORM_INPUT_FILE) {
     if (nsContentUtils::IsCallerTrustedForCapability("UniversalFileRead")) {
-      if (!mFileNames.IsEmpty()) {
-        aValue = mFileNames[0];
+      if (mFiles.Count()) {
+        return mFiles[0]->GetMozFullPath(aValue);
       }
       else {
         aValue.Truncate();
       }
     } else {
       // Just return the leaf name
-      nsCOMArray<nsIFile> files;
-      GetFileArray(files);
-      if (files.Count() == 0 || NS_FAILED(files[0]->GetLeafName(aValue))) {
+      if (mFiles.Count() == 0 || NS_FAILED(mFiles[0]->GetName(aValue))) {
         aValue.Truncate();
       }
     }
@@ -1065,10 +1080,11 @@ nsHTMLInputElement::SetValue(const nsAString& aValue)
         // UniversalFileRead privilege
         return NS_ERROR_DOM_SECURITY_ERR;
       }
-      SetSingleFileName(aValue);
+      const PRUnichar *name = PromiseFlatString(aValue).get();
+      return MozSetFileNameArray(&name, 1);
     }
     else {
-      ClearFileNames();
+      ClearFiles();
     }
   }
   else {
@@ -1087,12 +1103,14 @@ nsHTMLInputElement::MozGetFileNameArray(PRUint32 *aLength, PRUnichar ***aFileNam
     return NS_ERROR_DOM_SECURITY_ERR;
   }
 
-  *aLength = mFileNames.Length();
+  *aLength = mFiles.Count();
   PRUnichar **ret =
-    static_cast<PRUnichar **>(NS_Alloc(mFileNames.Length() * sizeof(PRUnichar*)));
+    static_cast<PRUnichar **>(NS_Alloc(mFiles.Count() * sizeof(PRUnichar*)));
   
-  for (PRUint32 i = 0; i <  mFileNames.Length(); i++) {
-    ret[i] = NS_strdup(mFileNames[i].get());
+  for (PRUint32 i = 0; i <  mFiles.Count(); i++) {
+    nsString str;
+    mFiles[i]->GetMozFullPath(str);
+    ret[i] = NS_strdup(str.get());
   }
 
   *aFileNames = ret;
@@ -1109,12 +1127,36 @@ nsHTMLInputElement::MozSetFileNameArray(const PRUnichar **aFileNames, PRUint32 a
     return NS_ERROR_DOM_SECURITY_ERR;
   }
 
-  nsTArray<nsString> fileNames(aLength);
+  nsCOMArray<nsIDOMFile> files;
   for (PRUint32 i = 0; i < aLength; ++i) {
-    fileNames.AppendElement(aFileNames[i]);
+    nsCOMPtr<nsIFile> file;
+    if (StringBeginsWith(nsDependentString(aFileNames[i]),
+                         NS_LITERAL_STRING("file:"),
+                         nsASCIICaseInsensitiveStringComparator())) {
+      // Converts the URL string into the corresponding nsIFile if possible
+      // A local file will be created if the URL string begins with file://
+      NS_GetFileFromURLSpec(NS_ConvertUTF16toUTF8(aFileNames[i]),
+                            getter_AddRefs(file));
+    }
+
+    if (!file) {
+      // this is no "file://", try as local file
+      nsCOMPtr<nsILocalFile> localFile;
+      NS_NewLocalFile(nsDependentString(aFileNames[i]),
+                      PR_FALSE, getter_AddRefs(localFile));
+      file = do_QueryInterface(localFile);
+    }
+
+    if (file) {
+      nsCOMPtr<nsIDOMFile> domFile = new nsDOMFile(file, GetOwnerDoc());
+      files.AppendObject(domFile);
+    } else {
+      continue; // Not much we can do if the file doesn't exist
+    }
+
   }
 
-  SetFileNames(fileNames);
+  SetFiles(files);
 
   return NS_OK;
 }
@@ -1136,7 +1178,8 @@ nsHTMLInputElement::SetUserInput(const nsAString& aValue)
 
   if (mType == NS_FORM_INPUT_FILE)
   {
-    SetSingleFileName(aValue);
+    const PRUnichar* name = PromiseFlatString(aValue).get();
+    return MozSetFileNameArray(&name, 1);
   } else {
     SetValueInternal(aValue, PR_TRUE, PR_TRUE);
   }
@@ -1241,28 +1284,32 @@ nsHTMLInputElement::SetPlaceholderClass(PRBool aVisible, PRBool aNotify)
 }
 
 void
-nsHTMLInputElement::GetDisplayFileName(nsAString& aValue)
+nsHTMLInputElement::GetDisplayFileName(nsAString& aValue) const
 {
+  if (GetOwnerDoc()->IsStaticDocument()) {
+    aValue = mStaticDocFileList;
+    return;
+  }
+
   aValue.Truncate();
-  for (PRUint32 i = 0; i < mFileNames.Length(); ++i) {
+  for (PRUint32 i = 0; i < (PRUint32)mFiles.Count(); ++i) {
+    nsString str;
+    mFiles[i]->GetMozFullPath(str);
     if (i == 0) {
-      aValue.Append(mFileNames[i]);
+      aValue.Append(str);
     }
     else {
-      aValue.Append(NS_LITERAL_STRING(", ") + mFileNames[i]);
+      aValue.Append(NS_LITERAL_STRING(", ") + str);
     }
   }
 }
 
 void
-nsHTMLInputElement::SetFileNames(const nsTArray<nsString>& aFileNames)
+nsHTMLInputElement::SetFiles(const nsCOMArray<nsIDOMFile>& aFiles)
 {
-  mFileNames = aFileNames;
-#if DEBUG
-  for (PRUint32 i = 0; i < (PRUint32)aFileNames.Length(); ++i) {
-    NS_ASSERTION(!aFileNames[i].IsEmpty(), "Empty file name");
-  }
-#endif
+  mFiles.Clear();
+  mFiles.AppendObjects(aFiles);
+
   // No need to flush here, if there's no frame at this point we
   // don't need to force creation of one just to tell it about this
   // new value.  We just want the display to update as needed.
@@ -1279,37 +1326,10 @@ nsHTMLInputElement::SetFileNames(const nsTArray<nsString>& aFileNames)
   UpdateAllValidityStates(PR_TRUE);
 }
 
-void
-nsHTMLInputElement::GetFileArray(nsCOMArray<nsIFile> &aFiles)
+const nsCOMArray<nsIDOMFile>&
+nsHTMLInputElement::GetFiles()
 {
-  aFiles.Clear();
-
-  if (mType != NS_FORM_INPUT_FILE) {
-    return;
-  }
-
-  for (PRUint32 i = 0; i < mFileNames.Length(); ++i) {
-    nsCOMPtr<nsIFile> file;
-    if (StringBeginsWith(mFileNames[i], NS_LITERAL_STRING("file:"),
-                         nsCaseInsensitiveStringComparator())) {
-      // Converts the URL string into the corresponding nsIFile if possible.
-      // A local file will be created if the URL string begins with file://.
-      NS_GetFileFromURLSpec(NS_ConvertUTF16toUTF8(mFileNames[i]),
-                            getter_AddRefs(file));
-    }
-
-    if (!file) {
-      // this is no "file://", try as local file
-      nsCOMPtr<nsILocalFile> localFile;
-      NS_NewLocalFile(mFileNames[i], PR_FALSE, getter_AddRefs(localFile));
-      // Wish there was a better way to downcast an already_AddRefed
-      file = dont_AddRef(static_cast<nsIFile*>(localFile.forget().get()));
-    }
-
-    if (file) {
-      aFiles.AppendObject(file);
-    }
-  }
+  return mFiles;
 }
 
 nsresult
@@ -1318,16 +1338,10 @@ nsHTMLInputElement::UpdateFileList()
   if (mFileList) {
     mFileList->Clear();
 
-    nsIDocument* doc = GetOwnerDoc();
-
-    nsCOMArray<nsIFile> files;
-    GetFileArray(files);
+    const nsCOMArray<nsIDOMFile>& files = GetFiles();
     for (PRUint32 i = 0; i < (PRUint32)files.Count(); ++i) {
-      nsRefPtr<nsDOMFile> domFile = new nsDOMFile(files[i], doc);
-      if (domFile) {
-        if (!mFileList->Append(domFile)) {
-          return NS_ERROR_FAILURE;
-        }
+      if (!mFileList->Append(files[i])) {
+        return NS_ERROR_FAILURE;
       }
     }
   }
@@ -1819,7 +1833,7 @@ nsHTMLInputElement::Click()
       nsEventStatus status = nsEventStatus_eIgnore;
 
       SET_BOOLBIT(mBitField, BF_HANDLING_CLICK, PR_TRUE);
-      if (mType == NS_FORM_INPUT_FILE){
+      if (mType == NS_FORM_INPUT_FILE){
         FireAsyncClickHandler();
       }
       nsEventDispatcher::Dispatch(static_cast<nsIContent*>(this), context,
@@ -2561,7 +2575,7 @@ nsHTMLInputElement::ParseAttribute(PRInt32 aNamespaceID,
           // This call isn't strictly needed any more since we'll never
           // confuse values and filenames. However it's there for backwards
           // compat.
-          ClearFileNames();
+          ClearFiles();
         }
 
         HandleTypeChange(newType);
@@ -2882,7 +2896,7 @@ nsHTMLInputElement::SetDefaultValueAsValue()
     case NS_FORM_INPUT_FILE:
     {
       // Resetting it to blank should not perform security check
-      ClearFileNames();
+      ClearFiles();
       break;
     }
     // Value is the same as defaultValue for hidden inputs
@@ -3007,8 +3021,7 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   if (mType == NS_FORM_INPUT_FILE) {
     // Submit files
 
-    nsCOMArray<nsIFile> files;
-    GetFileArray(files);
+    const nsCOMArray<nsIDOMFile>& files = GetFiles();
 
     for (PRUint32 i = 0; i < (PRUint32)files.Count(); ++i) {
       aFormSubmission->AddNameFilePair(name, files[i]);
@@ -3100,13 +3113,13 @@ nsHTMLInputElement::SaveState()
     }
     case NS_FORM_INPUT_FILE:
       {
-        if (!mFileNames.IsEmpty()) {
+        if (mFiles.Count()) {
           inputState = new nsHTMLInputElementState();
           if (!inputState) {
             return NS_ERROR_OUT_OF_MEMORY;
           }
 
-          inputState->SetFilenames(mFileNames);
+          inputState->SetFiles(mFiles);
         }
         break;
       }
@@ -3253,7 +3266,8 @@ nsHTMLInputElement::RestoreState(nsPresState* aState)
         }
       case NS_FORM_INPUT_FILE:
         {
-          SetFileNames(inputState->GetFilenames());
+          const nsCOMArray<nsIDOMFile>& files = inputState->GetFiles();
+          SetFiles(files);
           break;
         }
     }
@@ -3662,8 +3676,7 @@ nsHTMLInputElement::IsValueMissing()
       }
     case NS_FORM_INPUT_FILE:
       {
-        nsCOMArray<nsIFile> files;
-        GetFileArray(files);
+        const nsCOMArray<nsIDOMFile>& files = GetFiles();
         return !files.Count();
       }
     default:
diff --git a/content/html/content/src/nsHTMLInputElement.h b/content/html/content/src/nsHTMLInputElement.h
index 4161a7b55243..5864a7cfd183 100644
--- a/content/html/content/src/nsHTMLInputElement.h
+++ b/content/html/content/src/nsHTMLInputElement.h
@@ -1,80 +1,83 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Communicator client code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Pierre Phaneuf <pp@ludusdesign.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nsHTMLInputElement_h__
-#define nsHTMLInputElement_h__
-
-#include "nsGenericHTMLElement.h"
-#include "nsImageLoadingContent.h"
-#include "nsIDOMHTMLInputElement.h"
-#include "nsITextControlElement.h"
-#include "nsIPhonetic.h"
-#include "nsIDOMNSEditableElement.h"
-#include "nsIFileControlElement.h"
-
-#include "nsTextEditorState.h"
-#include "nsCOMPtr.h"
-#include "nsIConstraintValidation.h"
-
-//
-// Accessors for mBitField
-//
-#define BF_DISABLED_CHANGED 0
-#define BF_HANDLING_CLICK 1
-#define BF_VALUE_CHANGED 2
-#define BF_CHECKED_CHANGED 3
-#define BF_CHECKED 4
-#define BF_HANDLING_SELECT_EVENT 5
-#define BF_SHOULD_INIT_CHECKED 6
-#define BF_PARSER_CREATING 7
-#define BF_IN_INTERNAL_ACTIVATE 8
-#define BF_CHECKED_IS_TOGGLED 9
-#define BF_INDETERMINATE 10
-#define BF_INHIBIT_RESTORATION 11
-
-#define GET_BOOLBIT(bitfield, field) (((bitfield) & (0x01 << (field))) \
-                                        ? PR_TRUE : PR_FALSE)
-#define SET_BOOLBIT(bitfield, field, b) ((b) \
-                                        ? ((bitfield) |=  (0x01 << (field))) \
-                                        : ((bitfield) &= ~(0x01 << (field))))
-
-class nsDOMFileList;
-
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Communicator client code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Pierre Phaneuf <pp@ludusdesign.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsHTMLInputElement_h__
+#define nsHTMLInputElement_h__
+
+#include "nsGenericHTMLElement.h"
+#include "nsImageLoadingContent.h"
+#include "nsIDOMHTMLInputElement.h"
+#include "nsITextControlElement.h"
+#include "nsIPhonetic.h"
+#include "nsIDOMNSEditableElement.h"
+
+#include "nsTextEditorState.h"
+#include "nsCOMPtr.h"
+#include "nsIConstraintValidation.h"
+#include "nsDOMFile.h"
+
+//
+// Accessors for mBitField
+//
+#define BF_DISABLED_CHANGED 0
+#define BF_HANDLING_CLICK 1
+#define BF_VALUE_CHANGED 2
+#define BF_CHECKED_CHANGED 3
+#define BF_CHECKED 4
+#define BF_HANDLING_SELECT_EVENT 5
+#define BF_SHOULD_INIT_CHECKED 6
+#define BF_PARSER_CREATING 7
+#define BF_IN_INTERNAL_ACTIVATE 8
+#define BF_CHECKED_IS_TOGGLED 9
+#define BF_INDETERMINATE 10
+#define BF_INHIBIT_RESTORATION 11
+
+#define GET_BOOLBIT(bitfield, field) (((bitfield) & (0x01 << (field))) \
+                                        ? PR_TRUE : PR_FALSE)
+#define SET_BOOLBIT(bitfield, field, b) ((b) \
+                                        ? ((bitfield) |=  (0x01 << (field))) \
+                                        : ((bitfield) &= ~(0x01 << (field))))
+
+class nsDOMFileList;
+class nsIRadioGroupContainer;
+class nsIRadioGroupVisitor;
+class nsIRadioVisitor;
+
 class UploadLastDir : public nsIObserver, public nsSupportsWeakReference {
 public:
   NS_DECL_ISUPPORTS
@@ -103,451 +106,460 @@ private:
   // Directories are stored here during private browsing mode
   nsInterfaceHashtable<nsStringHashKey, nsILocalFile> mUploadLastDirStore;
   PRBool mInPrivateBrowsing;
-};
-
-class nsIRadioGroupContainer;
-class nsIRadioVisitor;
-
-class nsHTMLInputElement : public nsGenericHTMLFormElement,
-                           public nsImageLoadingContent,
-                           public nsIDOMHTMLInputElement,
-                           public nsITextControlElement,
-                           public nsIPhonetic,
-                           public nsIDOMNSEditableElement,
-                           public nsIFileControlElement,
-                           public nsIConstraintValidation
-{
-public:
+};
+
+class nsIRadioGroupContainer;
+class nsIRadioVisitor;
+
+class nsHTMLInputElement : public nsGenericHTMLFormElement,
+                           public nsImageLoadingContent,
+                           public nsIDOMHTMLInputElement,
+                           public nsITextControlElement,
+                           public nsIPhonetic,
+                           public nsIDOMNSEditableElement,
+                           public nsIConstraintValidation
+{
+public:
   using nsIConstraintValidation::GetValidationMessage;
 
-  nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
-                     PRUint32 aFromParser);
-  virtual ~nsHTMLInputElement();
-
-  // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
-
-  // nsIDOMNode
-  NS_FORWARD_NSIDOMNODE(nsGenericHTMLFormElement::)
-
-  // nsIDOMElement
-  NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLFormElement::)
-
-  // nsIDOMHTMLElement
-  NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLFormElement::)
-
-  // nsIDOMHTMLInputElement
-  NS_DECL_NSIDOMHTMLINPUTELEMENT
-
-  // nsIPhonetic
-  NS_DECL_NSIPHONETIC
-
-  // nsIDOMNSEditableElement
-  NS_IMETHOD GetEditor(nsIEditor** aEditor)
-  {
-    return nsGenericHTMLElement::GetEditor(aEditor);
-  }
-  NS_IMETHOD SetUserInput(const nsAString& aInput);
-
-  // Overriden nsIFormControl methods
-  NS_IMETHOD_(PRUint32) GetType() const { return mType; }
-  NS_IMETHOD Reset();
-  NS_IMETHOD SubmitNamesValues(nsFormSubmission* aFormSubmission);
-  NS_IMETHOD SaveState();
-  virtual PRBool RestoreState(nsPresState* aState);
-  virtual PRBool AllowDrop();
-
-  // nsIContent
-  virtual PRBool IsHTMLFocusable(PRBool aWithMouse, PRBool *aIsFocusable, PRInt32 *aTabIndex);
-
-  virtual PRBool ParseAttribute(PRInt32 aNamespaceID,
-                                nsIAtom* aAttribute,
-                                const nsAString& aValue,
-                                nsAttrValue& aResult);
-  virtual nsChangeHint GetAttributeChangeHint(const nsIAtom* aAttribute,
-                                              PRInt32 aModType) const;
-  NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
-  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
-
-  virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
-  virtual nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor);
-
-  virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
-                              nsIContent* aBindingParent,
-                              PRBool aCompileEventHandlers);
-  virtual void UnbindFromTree(PRBool aDeep = PR_TRUE,
-                              PRBool aNullParent = PR_TRUE);
-
-  virtual void DoneCreatingElement();
-
-  virtual PRInt32 IntrinsicState() const;
-
-  // nsITextControlElement
-  NS_IMETHOD SetValueChanged(PRBool aValueChanged);
-  NS_IMETHOD_(PRBool) IsSingleLineTextControl() const;
-  NS_IMETHOD_(PRBool) IsTextArea() const;
-  NS_IMETHOD_(PRBool) IsPlainTextControl() const;
-  NS_IMETHOD_(PRBool) IsPasswordTextControl() const;
-  NS_IMETHOD_(PRInt32) GetCols();
-  NS_IMETHOD_(PRInt32) GetWrapCols();
-  NS_IMETHOD_(PRInt32) GetRows();
-  NS_IMETHOD_(void) GetDefaultValueFromContent(nsAString& aValue);
-  NS_IMETHOD_(PRBool) ValueChanged() const;
-  NS_IMETHOD_(void) GetTextEditorValue(nsAString& aValue, PRBool aIgnoreWrap) const;
-  NS_IMETHOD_(void) SetTextEditorValue(const nsAString& aValue, PRBool aUserInput);
-  NS_IMETHOD_(nsIEditor*) GetTextEditor();
-  NS_IMETHOD_(nsISelectionController*) GetSelectionController();
-  NS_IMETHOD_(nsFrameSelection*) GetConstFrameSelection();
-  NS_IMETHOD BindToFrame(nsTextControlFrame* aFrame);
-  NS_IMETHOD_(void) UnbindFromFrame(nsTextControlFrame* aFrame);
-  NS_IMETHOD CreateEditor();
-  NS_IMETHOD_(nsIContent*) GetRootEditorNode();
-  NS_IMETHOD_(nsIContent*) GetPlaceholderNode();
-  NS_IMETHOD_(void) UpdatePlaceholderText(PRBool aNotify);
-  NS_IMETHOD_(void) SetPlaceholderClass(PRBool aVisible, PRBool aNotify);
-  NS_IMETHOD_(void) InitializeKeyboardEventListeners();
-  NS_IMETHOD_(void) OnValueChanged(PRBool aNotify);
-
-  // nsIFileControlElement
-  virtual void GetDisplayFileName(nsAString& aFileName);
-  virtual void GetFileArray(nsCOMArray<nsIFile> &aFile);
-  virtual void SetFileNames(const nsTArray<nsString>& aFileNames);
-
-  void SetCheckedChangedInternal(PRBool aCheckedChanged);
-  PRBool GetCheckedChanged();
-  void AddedToRadioGroup(PRBool aNotify = PR_TRUE);
-  void WillRemoveFromRadioGroup(PRBool aNotify);
-  /**
-   * Get the radio group container for this button (form or document)
-   * @return the radio group container (or null if no form or document)
-   */
-  virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer();
-
- /**
-   * Helper function returning the currently selected button in the radio group.
-   * Returning null if the element is not a button or if there is no selectied
-   * button in the group.
-   *
-   * @return the selected button (or null).
-   */
-  already_AddRefed<nsIDOMHTMLInputElement> GetSelectedRadioButton();
-
-  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
-
-  NS_IMETHOD FireAsyncClickHandler();
-
-  virtual void UpdateEditableState()
-  {
-    return UpdateEditableFormControlState();
-  }
-
-  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED_NO_UNLINK(nsHTMLInputElement,
-                                                     nsGenericHTMLFormElement)
-
-  static UploadLastDir* gUploadLastDir;
+  nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
+                     PRUint32 aFromParser);
+  virtual ~nsHTMLInputElement();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // nsIDOMNode
+  NS_FORWARD_NSIDOMNODE(nsGenericHTMLFormElement::)
+
+  // nsIDOMElement
+  NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLFormElement::)
+
+  // nsIDOMHTMLElement
+  NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLFormElement::)
+
+  // nsIDOMHTMLInputElement
+  NS_DECL_NSIDOMHTMLINPUTELEMENT
+
+  // nsIPhonetic
+  NS_DECL_NSIPHONETIC
+
+  // nsIDOMNSEditableElement
+  NS_IMETHOD GetEditor(nsIEditor** aEditor)
+  {
+    return nsGenericHTMLElement::GetEditor(aEditor);
+  }
+  NS_IMETHOD SetUserInput(const nsAString& aInput);
+
+  // Overriden nsIFormControl methods
+  NS_IMETHOD_(PRUint32) GetType() const { return mType; }
+  NS_IMETHOD Reset();
+  NS_IMETHOD SubmitNamesValues(nsFormSubmission* aFormSubmission);
+  NS_IMETHOD SaveState();
+  virtual PRBool RestoreState(nsPresState* aState);
+  virtual PRBool AllowDrop();
+
+  // nsIContent
+  virtual PRBool IsHTMLFocusable(PRBool aWithMouse, PRBool *aIsFocusable, PRInt32 *aTabIndex);
+
+  virtual PRBool ParseAttribute(PRInt32 aNamespaceID,
+                                nsIAtom* aAttribute,
+                                const nsAString& aValue,
+                                nsAttrValue& aResult);
+  virtual nsChangeHint GetAttributeChangeHint(const nsIAtom* aAttribute,
+                                              PRInt32 aModType) const;
+  NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
+  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
+
+  virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
+  virtual nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor);
+
+  virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
+                              nsIContent* aBindingParent,
+                              PRBool aCompileEventHandlers);
+  virtual void UnbindFromTree(PRBool aDeep = PR_TRUE,
+                              PRBool aNullParent = PR_TRUE);
+
+  virtual void DoneCreatingElement();
+
+  virtual PRInt32 IntrinsicState() const;
+
+  // nsITextControlElement
+  NS_IMETHOD SetValueChanged(PRBool aValueChanged);
+  NS_IMETHOD_(PRBool) IsSingleLineTextControl() const;
+  NS_IMETHOD_(PRBool) IsTextArea() const;
+  NS_IMETHOD_(PRBool) IsPlainTextControl() const;
+  NS_IMETHOD_(PRBool) IsPasswordTextControl() const;
+  NS_IMETHOD_(PRInt32) GetCols();
+  NS_IMETHOD_(PRInt32) GetWrapCols();
+  NS_IMETHOD_(PRInt32) GetRows();
+  NS_IMETHOD_(void) GetDefaultValueFromContent(nsAString& aValue);
+  NS_IMETHOD_(PRBool) ValueChanged() const;
+  NS_IMETHOD_(void) GetTextEditorValue(nsAString& aValue, PRBool aIgnoreWrap) const;
+  NS_IMETHOD_(void) SetTextEditorValue(const nsAString& aValue, PRBool aUserInput);
+  NS_IMETHOD_(nsIEditor*) GetTextEditor();
+  NS_IMETHOD_(nsISelectionController*) GetSelectionController();
+  NS_IMETHOD_(nsFrameSelection*) GetConstFrameSelection();
+  NS_IMETHOD BindToFrame(nsTextControlFrame* aFrame);
+  NS_IMETHOD_(void) UnbindFromFrame(nsTextControlFrame* aFrame);
+  NS_IMETHOD CreateEditor();
+  NS_IMETHOD_(nsIContent*) GetRootEditorNode();
+  NS_IMETHOD_(nsIContent*) GetPlaceholderNode();
+  NS_IMETHOD_(void) UpdatePlaceholderText(PRBool aNotify);
+  NS_IMETHOD_(void) SetPlaceholderClass(PRBool aVisible, PRBool aNotify);
+  NS_IMETHOD_(void) InitializeKeyboardEventListeners();
+  NS_IMETHOD_(void) OnValueChanged(PRBool aNotify);
+
+  // nsIFileControlElement
+  void GetDisplayFileName(nsAString& aFileName) const;
+  const nsCOMArray<nsIDOMFile>& GetFiles();
+  void SetFiles(const nsCOMArray<nsIDOMFile>& aFiles);
+
+  void SetCheckedChangedInternal(PRBool aCheckedChanged);
+  PRBool GetCheckedChanged();
+  void AddedToRadioGroup(PRBool aNotify = PR_TRUE);
+  void WillRemoveFromRadioGroup(PRBool aNotify);
+  /**
+   * Get the radio group container for this button (form or document)
+   * @return the radio group container (or null if no form or document)
+   */
+  virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer();
+
+ /**
+   * Helper function returning the currently selected button in the radio group.
+   * Returning null if the element is not a button or if there is no selectied
+   * button in the group.
+   *
+   * @return the selected button (or null).
+   */
+  already_AddRefed<nsIDOMHTMLInputElement> GetSelectedRadioButton();
+
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
+
+  NS_IMETHOD FireAsyncClickHandler();
+
+  virtual void UpdateEditableState()
+  {
+    return UpdateEditableFormControlState();
+  }
+
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED_NO_UNLINK(nsHTMLInputElement,
+                                                     nsGenericHTMLFormElement)
+
+  static UploadLastDir* gUploadLastDir;
   // create and destroy the static UploadLastDir object for remembering
   // which directory was last used on a site-by-site basis
   static void InitUploadLastDir();
-  static void DestroyUploadLastDir();
-
-  void MaybeLoadImage();
-
-  virtual nsXPCClassInfo* GetClassInfo();
-
-  // nsIConstraintValidation
-  PRBool   IsTooLong();
-  PRBool   IsValueMissing();
-  PRBool   HasTypeMismatch();
-  PRBool   HasPatternMismatch();
-  void     UpdateTooLongValidityState();
-  void     UpdateValueMissingValidityState();
-  void     UpdateTypeMismatchValidityState();
-  void     UpdatePatternMismatchValidityState();
-  void     UpdateAllValidityStates(PRBool aNotify);
-  PRBool   IsBarredFromConstraintValidation() const;
-  nsresult GetValidationMessage(nsAString& aValidationMessage,
-                                ValidityStateType aType);
-
-protected:
-  // Pull IsSingleLineTextControl into our scope, otherwise it'd be hidden
-  // by the nsITextControlElement version.
-  using nsGenericHTMLFormElement::IsSingleLineTextControl;
-
-  /**
-   * The ValueModeType specifies how the value IDL attribute should behave.
-   *
-   * See: http://dev.w3.org/html5/spec/forms.html#dom-input-value
-   */
-  enum ValueModeType
-  {
-    // On getting, returns the value.
-    // On setting, sets value.
-    VALUE_MODE_VALUE,
-    // On getting, returns the value if present or the empty string.
-    // On setting, sets the value.
-    VALUE_MODE_DEFAULT,
-    // On getting, returns the value if present or "on".
-    // On setting, sets the value.
-    VALUE_MODE_DEFAULT_ON,
-    // On getting, returns "C:\fakepath\" followed by the file name of the
-    // first file of the selected files if any.
-    // On setting the empty string, empties the selected files list, otherwise
-    // throw the INVALID_STATE_ERR exception.
-    VALUE_MODE_FILENAME
-  };
-
-  /**
-   * This helper method returns true if aValue is a valid email address.
-   * This is following the HTML5 specification:
-   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address
-   *
-   * @param aValue  the email address to check.
-   * @result        whether the given string is a valid email address.
-   */
-  static PRBool IsValidEmailAddress(const nsAString& aValue);
-
-  /**
-   * This helper method returns true if aValue is a valid email address list.
-   * Email address list is a list of email address separated by comas (,) which
-   * can be surrounded by space charecters.
-   * This is following the HTML5 specification:
-   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address-list
-   *
-   * @param aValue  the email address list to check.
-   * @result        whether the given string is a valid email address list.
-   */
-  static PRBool IsValidEmailAddressList(const nsAString& aValue);
-
-  /**
-   * This helper method returns true if the aPattern pattern matches aValue.
-   * aPattern should not contain leading and trailing slashes (/).
-   * The pattern has to match the entire value not just a subset.
-   * aDocument must be a valid pointer (not null).
-   *
-   * This is following the HTML5 specification:
-   * http://dev.w3.org/html5/spec/forms.html#attr-input-pattern
-   *
-   * @param aValue    the string to check.
-   * @param aPattern  the string defining the pattern.
-   * @param aDocument the owner document of the element.
-   * @result          whether the given string is matches the pattern.
-   */
-  static PRBool IsPatternMatching(nsAString& aValue, nsAString& aPattern,
-                                  nsIDocument* aDocument);
-
-  // Helper method
-  nsresult SetValueInternal(const nsAString& aValue,
-                            PRBool aUserInput,
-                            PRBool aSetValueChanged);
-
-  void ClearFileNames() {
-    nsTArray<nsString> fileNames;
-    SetFileNames(fileNames);
-  }
-
-  void SetSingleFileName(const nsAString& aFileName) {
-    nsAutoTArray<nsString, 1> fileNames;
-    fileNames.AppendElement(aFileName);
-    SetFileNames(fileNames);
-  }
-
-  nsresult SetIndeterminateInternal(PRBool aValue,
-                                    PRBool aShouldInvalidate);
-
-  nsresult GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelectionEnd);
-
-  /**
-   * Get the name if it exists and return whether it did exist
-   * @param aName the name returned [OUT]
-   * @param true if the name is empty, false otherwise
-   */
-  PRBool GetNameIfExists(nsAString& aName) {
-    GetAttr(kNameSpaceID_None, nsGkAtoms::name, aName);
-    return !aName.IsEmpty();
-  }
-
-  /**
-   * Called when an attribute is about to be changed
-   */
-  virtual nsresult BeforeSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                                 const nsAString* aValue, PRBool aNotify);
-  /**
-   * Called when an attribute has just been changed
-   */
-  virtual nsresult AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                                const nsAString* aValue, PRBool aNotify);
-
-  /**
-   * Dispatch a select event. Returns true if the event was not cancelled.
-   */
-  PRBool DispatchSelectEvent(nsPresContext* aPresContext);
-
-  void SelectAll(nsPresContext* aPresContext);
-  PRBool IsImage() const
-  {
-    return AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
-                       nsGkAtoms::image, eIgnoreCase);
-  }
-
-  virtual PRBool AcceptAutofocus() const
-  {
-    return PR_TRUE;
-  }
-
-  /**
-   * Fire the onChange event
-   */
-  void FireOnChange();
-
-  /**
-   * Visit a the group of radio buttons this radio belongs to
-   * @param aVisitor the visitor to visit with
-   */
-  nsresult VisitGroup(nsIRadioVisitor* aVisitor, PRBool aFlushContent);
-
-  /**
-   * Do all the work that |SetChecked| does (radio button handling, etc.), but
-   * take an |aNotify| parameter.
-   */
-  nsresult DoSetChecked(PRBool aValue, PRBool aNotify, PRBool aSetValueChanged);
-
-  /**
-   * Do all the work that |SetCheckedChanged| does (radio button handling,
-   * etc.), but take an |aNotify| parameter that lets it avoid flushing content
-   * when it can.
-   */
-  void DoSetCheckedChanged(PRBool aCheckedChanged, PRBool aNotify);
-
-  /**
-   * Actually set checked and notify the frame of the change.
-   * @param aValue the value of checked to set
-   */
-  void SetCheckedInternal(PRBool aValue, PRBool aNotify);
-
-  /**
-   * Syntax sugar to make it easier to check for checked
-   */
-  PRBool GetChecked() const
-  {
-    return GET_BOOLBIT(mBitField, BF_CHECKED);
-  }
-
-  nsresult RadioSetChecked(PRBool aNotify);
-  void SetCheckedChanged(PRBool aCheckedChanged);
-
-  /**
-   * MaybeSubmitForm looks for a submit input or a single text control
-   * and submits the form if either is present.
-   */
-  nsresult MaybeSubmitForm(nsPresContext* aPresContext);
-
-  /**
-   * Update mFileList with the currently selected file.
-   */
-  nsresult UpdateFileList();
-
-  /**
-   * Determine whether the editor needs to be initialized explicitly for
-   * a particular event.
-   */
-  PRBool NeedToInitializeEditorForEvent(nsEventChainPreVisitor& aVisitor) const;
-
-  /**
-   * Get the value mode of the element, depending of the type.
-   */
-  ValueModeType GetValueMode() const;
-
-  /**
-   * Get the mutable state of the element.
-   * When the element isn't mutable (immutable), the value or checkedness
-   * should not be changed by the user.
-   *
-   * See: http://dev.w3.org/html5/spec/forms.html#concept-input-mutable
-   */
-  PRBool IsMutable() const;
-
-  /**
-   * Returns if the readonly attribute applies for the current type.
-   */
-  PRBool DoesReadOnlyApply() const;
-
-  /**
-   * Returns if the required attribute applies for the current type.
-   */
-  PRBool DoesRequiredApply() const;
-
-  /**
-   * Returns if the pattern attribute applies for the current type.
-   */
-  PRBool DoesPatternApply() const;
-
-  void FreeData();
-  nsTextEditorState *GetEditorState() const;
-
-  /**
-   * Manages the internal data storage across type changes.
-   */
-  void HandleTypeChange(PRUint8 aNewType);
-
-  /**
-   * Sanitize the value of the element depending of its current type.
-   * See: http://www.whatwg.org/specs/web-apps/current-work/#value-sanitization-algorithm
-   */
-  void SanitizeValue(nsAString& aValue);
-
-  /**
-   * Returns whether the placeholder attribute applies for the current type.
-   */
-  bool PlaceholderApplies() const { return IsSingleLineTextControlInternal(PR_FALSE, mType); }
-
-  /**
-   * Set the current default value to the value of the input element.
-   */
-  nsresult SetDefaultValueAsValue();
-
-  nsCOMPtr<nsIControllers> mControllers;
-
-  /**
-   * The type of this input (<input type=...>) as an integer.
-   * @see nsIFormControl.h (specifically NS_FORM_INPUT_*)
-   */
-  PRUint8                  mType;
-  /**
-   * A bitfield containing our booleans
-   * @see GET_BOOLBIT / SET_BOOLBIT macros and BF_* field identifiers
-   */
-  PRInt16                  mBitField;
-  /*
-   * In mInputData, the mState field is used if IsSingleLineTextControl returns
-   * true and mValue is used otherwise.  We have to be careful when handling it
-   * on a type change.
-   *
-   * Accessing the mState member should be done using the GetEditorState function,
-   * which returns null if the state is not present.
-   */
-  union InputData {
-    /**
-     * The current value of the input if it has been changed from the default
-     */
-    char*                    mValue;
-    /**
-     * The state of the text editor associated with the text/password input
-     */
-    nsTextEditorState*       mState;
-  } mInputData;
-  /**
-   * The value of the input if it is a file input. This is the list of filenames
-   * used when uploading a file. It is vital that this is kept separate from
-   * mValue so that it won't be possible to 'leak' the value from a text-input
-   * to a file-input. Additionally, the logic for this value is kept as simple
-   * as possible to avoid accidental errors where the wrong filename is used.
-   * Therefor the list of filenames is always owned by this member, never by
-   * the frame. Whenever the frame wants to change the filename it has to call
-   * SetFileNames to update this member.
-   */
-  nsTArray<nsString>       mFileNames;
-
-  nsRefPtr<nsDOMFileList>  mFileList;
-};
-
-#endif
+  static void DestroyUploadLastDir();
+
+  void MaybeLoadImage();
+
+  virtual nsXPCClassInfo* GetClassInfo();
+
+  static nsHTMLInputElement* FromContent(nsIContent *aContent)
+  {
+    if (aContent->NodeInfo()->Equals(nsGkAtoms::input, kNameSpaceID_XHTML))
+      return static_cast<nsHTMLInputElement*>(aContent);
+    return NULL;
+  }
+
+  // nsIConstraintValidation
+  PRBool   IsTooLong();
+  PRBool   IsValueMissing();
+  PRBool   HasTypeMismatch();
+  PRBool   HasPatternMismatch();
+  void     UpdateTooLongValidityState();
+  void     UpdateValueMissingValidityState();
+  void     UpdateTypeMismatchValidityState();
+  void     UpdatePatternMismatchValidityState();
+  void     UpdateAllValidityStates(PRBool aNotify);
+  PRBool   IsBarredFromConstraintValidation() const;
+  nsresult GetValidationMessage(nsAString& aValidationMessage,
+                                ValidityStateType aType);
+
+protected:
+  // Pull IsSingleLineTextControl into our scope, otherwise it'd be hidden
+  // by the nsITextControlElement version.
+  using nsGenericHTMLFormElement::IsSingleLineTextControl;
+
+  /**
+   * The ValueModeType specifies how the value IDL attribute should behave.
+   *
+   * See: http://dev.w3.org/html5/spec/forms.html#dom-input-value
+   */
+  enum ValueModeType
+  {
+    // On getting, returns the value.
+    // On setting, sets value.
+    VALUE_MODE_VALUE,
+    // On getting, returns the value if present or the empty string.
+    // On setting, sets the value.
+    VALUE_MODE_DEFAULT,
+    // On getting, returns the value if present or "on".
+    // On setting, sets the value.
+    VALUE_MODE_DEFAULT_ON,
+    // On getting, returns "C:\fakepath\" followed by the file name of the
+    // first file of the selected files if any.
+    // On setting the empty string, empties the selected files list, otherwise
+    // throw the INVALID_STATE_ERR exception.
+    VALUE_MODE_FILENAME
+  };
+
+  /**
+   * This helper method returns true if aValue is a valid email address.
+   * This is following the HTML5 specification:
+   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address
+   *
+   * @param aValue  the email address to check.
+   * @result        whether the given string is a valid email address.
+   */
+  static PRBool IsValidEmailAddress(const nsAString& aValue);
+
+  /**
+   * This helper method returns true if aValue is a valid email address list.
+   * Email address list is a list of email address separated by comas (,) which
+   * can be surrounded by space charecters.
+   * This is following the HTML5 specification:
+   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address-list
+   *
+   * @param aValue  the email address list to check.
+   * @result        whether the given string is a valid email address list.
+   */
+  static PRBool IsValidEmailAddressList(const nsAString& aValue);
+
+  /**
+   * This helper method returns true if the aPattern pattern matches aValue.
+   * aPattern should not contain leading and trailing slashes (/).
+   * The pattern has to match the entire value not just a subset.
+   * aDocument must be a valid pointer (not null).
+   *
+   * This is following the HTML5 specification:
+   * http://dev.w3.org/html5/spec/forms.html#attr-input-pattern
+   *
+   * @param aValue    the string to check.
+   * @param aPattern  the string defining the pattern.
+   * @param aDocument the owner document of the element.
+   * @result          whether the given string is matches the pattern.
+   */
+  static PRBool IsPatternMatching(nsAString& aValue, nsAString& aPattern,
+                                  nsIDocument* aDocument);
+
+  // Helper method
+  nsresult SetValueInternal(const nsAString& aValue,
+                            PRBool aUserInput,
+                            PRBool aSetValueChanged);
+
+  void ClearFiles() {
+    nsCOMArray<nsIDOMFile> files;
+    SetFiles(files);
+  }
+
+  void SetSingleFile(nsIDOMFile* aFile) {
+    nsCOMArray<nsIDOMFile> files;
+    nsCOMPtr<nsIDOMFile> file = aFile;
+    files.AppendObject(file);
+    SetFiles(files);
+  }
+
+  nsresult SetIndeterminateInternal(PRBool aValue,
+                                    PRBool aShouldInvalidate);
+
+  nsresult GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelectionEnd);
+
+  /**
+   * Get the name if it exists and return whether it did exist
+   * @param aName the name returned [OUT]
+   * @param true if the name is empty, false otherwise
+   */
+  PRBool GetNameIfExists(nsAString& aName) {
+    GetAttr(kNameSpaceID_None, nsGkAtoms::name, aName);
+    return !aName.IsEmpty();
+  }
+
+  /**
+   * Called when an attribute is about to be changed
+   */
+  virtual nsresult BeforeSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
+                                 const nsAString* aValue, PRBool aNotify);
+  /**
+   * Called when an attribute has just been changed
+   */
+  virtual nsresult AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
+                                const nsAString* aValue, PRBool aNotify);
+
+  /**
+   * Dispatch a select event. Returns true if the event was not cancelled.
+   */
+  PRBool DispatchSelectEvent(nsPresContext* aPresContext);
+
+  void SelectAll(nsPresContext* aPresContext);
+  PRBool IsImage() const
+  {
+    return AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                       nsGkAtoms::image, eIgnoreCase);
+  }
+
+  virtual PRBool AcceptAutofocus() const
+  {
+    return PR_TRUE;
+  }
+
+  /**
+   * Fire the onChange event
+   */
+  void FireOnChange();
+
+  /**
+   * Visit a the group of radio buttons this radio belongs to
+   * @param aVisitor the visitor to visit with
+   */
+  nsresult VisitGroup(nsIRadioVisitor* aVisitor, PRBool aFlushContent);
+
+  /**
+   * Do all the work that |SetChecked| does (radio button handling, etc.), but
+   * take an |aNotify| parameter.
+   */
+  nsresult DoSetChecked(PRBool aValue, PRBool aNotify, PRBool aSetValueChanged);
+
+  /**
+   * Do all the work that |SetCheckedChanged| does (radio button handling,
+   * etc.), but take an |aNotify| parameter that lets it avoid flushing content
+   * when it can.
+   */
+  void DoSetCheckedChanged(PRBool aCheckedChanged, PRBool aNotify);
+
+  /**
+   * Actually set checked and notify the frame of the change.
+   * @param aValue the value of checked to set
+   */
+  void SetCheckedInternal(PRBool aValue, PRBool aNotify);
+
+  /**
+   * Syntax sugar to make it easier to check for checked
+   */
+  PRBool GetChecked() const
+  {
+    return GET_BOOLBIT(mBitField, BF_CHECKED);
+  }
+
+  nsresult RadioSetChecked(PRBool aNotify);
+  void SetCheckedChanged(PRBool aCheckedChanged);
+
+  /**
+   * MaybeSubmitForm looks for a submit input or a single text control
+   * and submits the form if either is present.
+   */
+  nsresult MaybeSubmitForm(nsPresContext* aPresContext);
+
+  /**
+   * Update mFileList with the currently selected file.
+   */
+  nsresult UpdateFileList();
+
+  /**
+   * Determine whether the editor needs to be initialized explicitly for
+   * a particular event.
+   */
+  PRBool NeedToInitializeEditorForEvent(nsEventChainPreVisitor& aVisitor) const;
+
+  /**
+   * Get the value mode of the element, depending of the type.
+   */
+  ValueModeType GetValueMode() const;
+
+  /**
+   * Get the mutable state of the element.
+   * When the element isn't mutable (immutable), the value or checkedness
+   * should not be changed by the user.
+   *
+   * See: http://dev.w3.org/html5/spec/forms.html#concept-input-mutable
+   */
+  PRBool IsMutable() const;
+
+  /**
+   * Returns if the readonly attribute applies for the current type.
+   */
+  PRBool DoesReadOnlyApply() const;
+
+  /**
+   * Returns if the required attribute applies for the current type.
+   */
+  PRBool DoesRequiredApply() const;
+
+  /**
+   * Returns if the pattern attribute applies for the current type.
+   */
+  PRBool DoesPatternApply() const;
+
+  void FreeData();
+  nsTextEditorState *GetEditorState() const;
+
+  /**
+   * Manages the internal data storage across type changes.
+   */
+  void HandleTypeChange(PRUint8 aNewType);
+
+  /**
+   * Sanitize the value of the element depending of its current type.
+   * See: http://www.whatwg.org/specs/web-apps/current-work/#value-sanitization-algorithm
+   */
+  void SanitizeValue(nsAString& aValue);
+
+  /**
+   * Returns whether the placeholder attribute applies for the current type.
+   */
+  bool PlaceholderApplies() const { return IsSingleLineTextControlInternal(PR_FALSE, mType); }
+
+  /**
+   * Set the current default value to the value of the input element.
+   */
+  nsresult SetDefaultValueAsValue();
+
+  nsCOMPtr<nsIControllers> mControllers;
+
+  /**
+   * The type of this input (<input type=...>) as an integer.
+   * @see nsIFormControl.h (specifically NS_FORM_INPUT_*)
+   */
+  PRUint8                  mType;
+  /**
+   * A bitfield containing our booleans
+   * @see GET_BOOLBIT / SET_BOOLBIT macros and BF_* field identifiers
+   */
+  PRInt16                  mBitField;
+  /*
+   * In mInputData, the mState field is used if IsSingleLineTextControl returns
+   * true and mValue is used otherwise.  We have to be careful when handling it
+   * on a type change.
+   *
+   * Accessing the mState member should be done using the GetEditorState function,
+   * which returns null if the state is not present.
+   */
+  union InputData {
+    /**
+     * The current value of the input if it has been changed from the default
+     */
+    char*                    mValue;
+    /**
+     * The state of the text editor associated with the text/password input
+     */
+    nsTextEditorState*       mState;
+  } mInputData;
+  /**
+   * The value of the input if it is a file input. This is the list of filenames
+   * used when uploading a file. It is vital that this is kept separate from
+   * mValue so that it won't be possible to 'leak' the value from a text-input
+   * to a file-input. Additionally, the logic for this value is kept as simple
+   * as possible to avoid accidental errors where the wrong filename is used.
+   * Therefor the list of filenames is always owned by this member, never by
+   * the frame. Whenever the frame wants to change the filename it has to call
+   * SetFileNames to update this member.
+   */
+  nsCOMArray<nsIDOMFile>   mFiles;
+
+  nsRefPtr<nsDOMFileList>  mFileList;
+
+  nsString mStaticDocFileList;
+};
+
+#endif
diff --git a/docshell/test/chrome/bug294258_window.xul b/docshell/test/chrome/bug294258_window.xul
index 8ceab4d0be57..f1f2cb343b8e 100644
--- a/docshell/test/chrome/bug294258_window.xul
+++ b/docshell/test/chrome/bug294258_window.xul
@@ -43,7 +43,13 @@
       // Change the data for each of the form fields, and reload.
       $("text").value = "text value";
       $("checkbox").checked = true;
-      $("file").value = "file value";
+      var file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsILocalFile);
+      file.append("294258_test.file");
+      file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
+      filePath = file.path;
+      $("file").value = filePath;
       $("textarea").value = "textarea value";
       $("radio1").checked = true;
       $("select").selectedIndex = 2;
@@ -56,7 +62,7 @@
       // Verify that none of the form data has changed.
       is($("text").value, "text value", "Text value changed");
       is($("checkbox").checked, true, "Checkbox value changed");
-      is($("file").value, "file value", "File value changed");
+      is($("file").value, filePath, "File value changed");
       is($("textarea").value, "textarea value", "Textarea value changed");
       is($("radio1").checked, true, "Radio value changed");
       is($("select").selectedIndex, 2, "Select value changed");
diff --git a/layout/base/tests/chrome/printpreview_helper.xul b/layout/base/tests/chrome/printpreview_helper.xul
index 41c5df677915..fe5332ea727c 100644
--- a/layout/base/tests/chrome/printpreview_helper.xul
+++ b/layout/base/tests/chrome/printpreview_helper.xul
@@ -18,6 +18,11 @@ var ctx1;
 var ctx2;
 var counter = 0;
 
+var file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsILocalFile);
+filePath = file.path;
+
 function printpreview() {
   gWbp = window.frames[1].QueryInterface(Components.interfaces.nsIInterfaceRequestor)
              .getInterface(Components.interfaces.nsIWebBrowserPrint);
@@ -155,7 +160,7 @@ var emptyFormElements =
 var formElements =
   ["<input type='text' value='text'>",
    "<input type='password' value='password'>",
-   "<input type='file' value='file'>",
+   "<input type='file' value='" + filePath + "'>",
    "<input type='button' value='button'>",
    "<input type='submit' value='submit button'>",
    "<input type='reset' value='reset button'>",
diff --git a/layout/forms/nsFileControlFrame.cpp b/layout/forms/nsFileControlFrame.cpp
index 290d63807bc2..2e08cf8f9041 100644
--- a/layout/forms/nsFileControlFrame.cpp
+++ b/layout/forms/nsFileControlFrame.cpp
@@ -65,7 +65,7 @@
 #include "nsINodeInfo.h"
 #include "nsIDOMEventTarget.h"
 #include "nsILocalFile.h"
-#include "nsIFileControlElement.h"
+#include "nsHTMLInputElement.h"
 #include "nsNodeInfoManager.h"
 #include "nsContentCreatorFunctions.h"
 #include "nsContentUtils.h"
@@ -90,6 +90,7 @@
 #include "nsHTMLInputElement.h"
 #include "nsICapturePicker.h"
 #include "nsIFileURL.h"
+#include "nsDOMFile.h"
 
 #define SYNC_TEXT 0x1
 #define SYNC_BUTTON 0x2
@@ -235,20 +236,21 @@ nsFileControlFrame::CreateAnonymousContent(nsTArray<nsIContent*>& aElements)
   mTextContent->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
                         NS_LITERAL_STRING("text"), PR_FALSE);
 
-  nsCOMPtr<nsIDOMHTMLInputElement> textControl = do_QueryInterface(mTextContent);
-  if (textControl) {
-    nsCOMPtr<nsIFileControlElement> fileControl = do_QueryInterface(mContent);
-    if (fileControl) {
-      // Initialize value when we create the content in case the value was set
-      // before we got here
-      nsAutoString value;
-      fileControl->GetDisplayFileName(value);
-      textControl->SetValue(value);
-    }
+  nsHTMLInputElement* inputElement =
+    nsHTMLInputElement::FromContent(mContent);
+  NS_ASSERTION(inputElement, "Why is our content not a <input>?");
 
-    textControl->SetTabIndex(-1);
-    textControl->SetReadOnly(PR_TRUE);
-  }
+  // Initialize value when we create the content in case the value was set
+  // before we got here
+  nsAutoString value;
+  inputElement->GetDisplayFileName(value);
+
+  nsCOMPtr<nsIDOMHTMLInputElement> textControl = do_QueryInterface(mTextContent);
+  NS_ASSERTION(textControl, "Why is the <input> we created not a <input>?");
+  textControl->SetValue(value);
+
+  textControl->SetTabIndex(-1);
+  textControl->SetReadOnly(PR_TRUE);
 
   if (!aElements.AppendElement(mTextContent))
     return NS_ERROR_OUT_OF_MEMORY;
@@ -398,9 +400,11 @@ nsFileControlFrame::CaptureMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
 
   // Get parent nsIDOMWindowInternal object.
   nsIContent* content = mFrame->GetContent();
-  nsCOMPtr<nsIDOMHTMLInputElement> inputElem = do_QueryInterface(content);
-  nsCOMPtr<nsIFileControlElement> fileControl = do_QueryInterface(content);
-  if (!content || !inputElem || !fileControl)
+  if (!content)
+    return NS_ERROR_FAILURE;
+
+  nsHTMLInputElement* inputElement = nsHTMLInputElement::FromContent(content);
+  if (!inputElement)
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIDocument> doc = content->GetDocument();
@@ -443,21 +447,13 @@ nsFileControlFrame::CaptureMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
     return NS_OK;
   }
 
-  nsCOMPtr<nsIURI> uri;
-  rv = capturePicker->GetUri(getter_AddRefs(uri));
+  nsCOMPtr<nsIDOMFile> domFile;
+  rv = capturePicker->GetFile(getter_AddRefs(domFile));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsTArray<nsString> newFileNames;
-  if (uri) {
-    nsCOMPtr<nsIFileURL> fileURL = do_QueryInterface(uri);
-    if (!fileURL)
-      return NS_ERROR_UNEXPECTED;
-
-    nsCAutoString spec;
-    rv = uri->GetSpec(spec);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    newFileNames.AppendElement(NS_ConvertUTF8toUTF16(spec));
+  nsCOMArray<nsIDOMFile> newFiles;
+  if (domFile) {
+    newFiles.AppendObject(domFile);
   } else {
     return NS_ERROR_FAILURE;
   }
@@ -465,13 +461,13 @@ nsFileControlFrame::CaptureMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
   // XXXkhuey we really should have a better UI story than the tired old
   // uneditable text box with the file name inside.
   // Set new selected files
-  if (!newFileNames.IsEmpty()) {
+  if (newFiles.Count()) {
     // Tell mTextFrame that this update of the value is a user initiated
     // change. Otherwise it'll think that the value is being set by a script
     // and not fire onchange when it should.
     PRBool oldState = mFrame->mTextFrame->GetFireChangeEventState();
     mFrame->mTextFrame->SetFireChangeEventState(PR_TRUE);
-    fileControl->SetFileNames(newFileNames);
+    inputElement->SetFiles(newFiles);
 
     mFrame->mTextFrame->SetFireChangeEventState(oldState);
     // May need to fire an onchange here
@@ -491,12 +487,9 @@ nsFileControlFrame::BrowseMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
   if (!ShouldProcessMouseClick(aMouseEvent))
     return NS_OK;
   
-  nsIContent* content = mFrame->GetContent();
-  if (content->IsHTML() && content->Tag() == nsGkAtoms::input) {
-    nsHTMLInputElement* input = static_cast<nsHTMLInputElement*>(content);
-    return input->FireAsyncClickHandler();
-  }
-  return NS_OK;
+  nsHTMLInputElement* input =
+    nsHTMLInputElement::FromContent(mFrame->GetContent());
+  return input ? input->FireAsyncClickHandler() : NS_OK;
 }
 
 nscoord
@@ -643,10 +636,11 @@ nsFileControlFrame::GetFormProperty(nsIAtom* aName, nsAString& aValue) const
   aValue.Truncate();  // initialize out param
 
   if (nsGkAtoms::value == aName) {
-    nsCOMPtr<nsIFileControlElement> fileControl =
-      do_QueryInterface(mContent);
-    if (fileControl) {
-      fileControl->GetDisplayFileName(aValue);
+    nsHTMLInputElement* inputElement =
+      nsHTMLInputElement::FromContent(mContent);
+
+    if (inputElement) {
+      inputElement->GetDisplayFileName(aValue);
     }
   }
   return NS_OK;
diff --git a/layout/forms/nsICapturePicker.idl b/layout/forms/nsICapturePicker.idl
index 148e22258a35..3d552cd88860 100644
--- a/layout/forms/nsICapturePicker.idl
+++ b/layout/forms/nsICapturePicker.idl
@@ -39,7 +39,7 @@
 #include "nsISupports.idl"
 
 interface nsIDOMWindow;
-interface nsIURI;
+interface nsIDOMFile;
 
 [scriptable, uuid(a4e2b2de-5712-4f80-aabb-7de3a747f227)]
 interface nsICapturePicker : nsISupports
@@ -88,7 +88,7 @@ interface nsICapturePicker : nsISupports
    * Get the captured image/video/audio.  This may be a data URI, file URI,
    * or a moz-filedata reference URI.
    */
-  readonly attribute nsIURI uri;
+  readonly attribute nsIDOMFile file;
 
   // The MIME type of the captured content.  Cannot be set after calling show()
   attribute AString type;

From fe112d14d1a60dc3dda1cb5360988962ccb06c71 Mon Sep 17 00:00:00 2001
From: Kyle Huey <khuey@kylehuey.com>
Date: Sun, 5 Sep 2010 11:10:23 -0400
Subject: [PATCH 162/222] Followup to Bug 583863: Don't accidentally rename a
 variable. a=bustage

---
 browser/components/sessionstore/test/browser/browser_466937.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/components/sessionstore/test/browser/browser_466937.js b/browser/components/sessionstore/test/browser/browser_466937.js
index 00356a08fae5..a74539cd76c1 100644
--- a/browser/components/sessionstore/test/browser/browser_466937.js
+++ b/browser/components/sessionstore/test/browser/browser_466937.js
@@ -44,7 +44,7 @@ function test() {
              .get("TmpD", Components.interfaces.nsILocalFile);
   file.append("466937_test.file");
   file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
-  filePath = file.path;
+  let testPath = file.path;
   
   let testURL = "http://mochi.test:8888/browser/" +
     "browser/components/sessionstore/test/browser/browser_466937_sample.html";

From ea62dbc536eed6042f6ee3c453fbeb487cbcdc01 Mon Sep 17 00:00:00 2001
From: Kyle Huey <khuey@kylehuey.com>
Date: Sun, 5 Sep 2010 11:32:31 -0400
Subject: [PATCH 163/222] Backed out changeset c5b883cba2f7

---
 browser/components/sessionstore/test/browser/browser_466937.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/components/sessionstore/test/browser/browser_466937.js b/browser/components/sessionstore/test/browser/browser_466937.js
index a74539cd76c1..00356a08fae5 100644
--- a/browser/components/sessionstore/test/browser/browser_466937.js
+++ b/browser/components/sessionstore/test/browser/browser_466937.js
@@ -44,7 +44,7 @@ function test() {
              .get("TmpD", Components.interfaces.nsILocalFile);
   file.append("466937_test.file");
   file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
-  let testPath = file.path;
+  filePath = file.path;
   
   let testURL = "http://mochi.test:8888/browser/" +
     "browser/components/sessionstore/test/browser/browser_466937_sample.html";

From f9c0cf9c1916c69d4f1778381dd770ce4073c7e2 Mon Sep 17 00:00:00 2001
From: Kyle Huey <khuey@kylehuey.com>
Date: Sun, 5 Sep 2010 11:32:57 -0400
Subject: [PATCH 164/222] Backed out changeset af1365b24066

---
 .../test/browser/browser_248970_b.js          |    7 +-
 .../test/browser/browser_346337.js            |   17 +-
 .../test/browser/browser_466937.js            |    8 +-
 content/base/public/Makefile.in               |    1 +
 content/base/public/nsDOMFile.h               |   37 +-
 content/base/public/nsIDOMFile.idl            |   11 +-
 content/base/public/nsIDOMFileInternal.idl    |   46 +
 content/base/src/nsDOMFile.cpp                |  178 +--
 content/base/src/nsDOMFileReader.cpp          |   37 +-
 content/base/src/nsDOMFileReader.h            |    6 +-
 .../base/src/nsFileDataProtocolHandler.cpp    |   17 +-
 content/base/src/nsFileDataProtocolHandler.h  |    5 +-
 content/base/src/nsFormData.cpp               |   13 +-
 content/base/src/nsFormData.h                 |    8 +-
 content/base/src/nsXMLHttpRequest.cpp         |   24 +
 content/base/test/test_bug345339.html         |   15 +-
 content/html/content/public/Makefile.in       |    1 +
 .../html/content/public/nsFormSubmission.h    |    5 +-
 .../content/public/nsIFileControlElement.h    |   86 ++
 content/html/content/src/nsFormSubmission.cpp |   41 +-
 .../html/content/src/nsGenericHTMLElement.h   |   12 -
 .../html/content/src/nsHTMLInputElement.cpp   |  241 ++--
 content/html/content/src/nsHTMLInputElement.h | 1052 ++++++++---------
 docshell/test/chrome/bug294258_window.xul     |   10 +-
 .../base/tests/chrome/printpreview_helper.xul |    7 +-
 layout/forms/nsFileControlFrame.cpp           |   76 +-
 layout/forms/nsICapturePicker.idl             |    4 +-
 27 files changed, 970 insertions(+), 995 deletions(-)
 create mode 100644 content/base/public/nsIDOMFileInternal.idl
 create mode 100644 content/html/content/public/nsIFileControlElement.h

diff --git a/browser/components/sessionstore/test/browser/browser_248970_b.js b/browser/components/sessionstore/test/browser/browser_248970_b.js
index 1fa00efaaaf9..458d7104a6f8 100644
--- a/browser/components/sessionstore/test/browser/browser_248970_b.js
+++ b/browser/components/sessionstore/test/browser/browser_248970_b.js
@@ -45,11 +45,6 @@ function test() {
     return false;
   }
 
-  var file = Components.classes["@mozilla.org/file/directory_service;1"]
-             .getService(Components.interfaces.nsIProperties)
-             .get("TmpD", Components.interfaces.nsIFile);
-  filePath = file.path;
-
   let fieldList = {
     "//input[@name='input']":     Date.now().toString(),
     "//input[@name='spaced 1']":  Math.random().toString(),
@@ -64,7 +59,7 @@ function test() {
     "//textarea[1]":              "",
     "//textarea[2]":              "Some text... " + Math.random(),
     "//textarea[3]":              "Some more text\n" + new Date(),
-    "//input[@type='file']":      filePath
+    "//input[@type='file']":      "/dev/null"
   };
 
   function getElementByXPath(aTab, aQuery) {
diff --git a/browser/components/sessionstore/test/browser/browser_346337.js b/browser/components/sessionstore/test/browser/browser_346337.js
index e5333b227eaa..1f3baabc00de 100644
--- a/browser/components/sessionstore/test/browser/browser_346337.js
+++ b/browser/components/sessionstore/test/browser/browser_346337.js
@@ -36,19 +36,6 @@
 
 function test() {
   /** Test for Bug 346337 **/
-
-  var file = Components.classes["@mozilla.org/file/directory_service;1"]
-               .getService(Components.interfaces.nsIProperties)
-               .get("TmpD", Components.interfaces.nsILocalFile);
-  file.append("346337_test1.file");
-  file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
-  filePath1 = file.path;
-  file = Components.classes["@mozilla.org/file/directory_service;1"]
-             .getService(Components.interfaces.nsIProperties)
-             .get("TmpD", Components.interfaces.nsILocalFile);
-  file.append("346337_test2.file");
-  file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
-  filePath2 = file.path;
   
   let fieldList = {
     "//input[@name='input']":     Date.now().toString(),
@@ -64,8 +51,8 @@ function test() {
     "//textarea[1]":              "",
     "//textarea[2]":              "Some text... " + Math.random(),
     "//textarea[3]":              "Some more text\n" + new Date(),
-    "//input[@type='file'][1]":   [filePath1],
-    "//input[@type='file'][2]":   [filePath1, filePath2]
+    "//input[@type='file'][1]":   ["/dev/null"],
+    "//input[@type='file'][2]":   ["/dev/null", "/dev/stdin"]
   };
   
   function getElementByXPath(aTab, aQuery) {
diff --git a/browser/components/sessionstore/test/browser/browser_466937.js b/browser/components/sessionstore/test/browser/browser_466937.js
index 00356a08fae5..e8cfd80456ad 100644
--- a/browser/components/sessionstore/test/browser/browser_466937.js
+++ b/browser/components/sessionstore/test/browser/browser_466937.js
@@ -38,16 +38,10 @@ function test() {
   /** Test for Bug 466937 **/
   
   waitForExplicitFinish();
-
-  var file = Components.classes["@mozilla.org/file/directory_service;1"]
-             .getService(Components.interfaces.nsIProperties)
-             .get("TmpD", Components.interfaces.nsILocalFile);
-  file.append("466937_test.file");
-  file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
-  filePath = file.path;
   
   let testURL = "http://mochi.test:8888/browser/" +
     "browser/components/sessionstore/test/browser/browser_466937_sample.html";
+  let testPath = "/home/user/regular.file";
   
   let tab = gBrowser.addTab(testURL);
   tab.linkedBrowser.addEventListener("load", function(aEvent) {
diff --git a/content/base/public/Makefile.in b/content/base/public/Makefile.in
index c0758b948615..a7580a76ab5c 100644
--- a/content/base/public/Makefile.in
+++ b/content/base/public/Makefile.in
@@ -99,6 +99,7 @@ XPIDLSRCS	= \
 		nsIDocumentEncoder.idl      \
 		nsIDOMFile.idl \
 		nsIDOMFileReader.idl \
+		nsIDOMFileInternal.idl \
 		nsIDOMFileList.idl \
 		nsIDOMFileException.idl \
 		nsIDOMFileError.idl \
diff --git a/content/base/public/nsDOMFile.h b/content/base/public/nsDOMFile.h
index 4df62f573741..7e984a2af5b3 100644
--- a/content/base/public/nsDOMFile.h
+++ b/content/base/public/nsDOMFile.h
@@ -41,6 +41,7 @@
 
 #include "nsICharsetDetectionObserver.h"
 #include "nsIDOMFile.h"
+#include "nsIDOMFileInternal.h"
 #include "nsIDOMFileList.h"
 #include "nsIDOMFileError.h"
 #include "nsIInputStream.h"
@@ -50,32 +51,24 @@
 #include "nsIWeakReference.h"
 #include "nsIWeakReferenceUtils.h"
 #include "nsIDocument.h"
-#include "nsIXMLHttpRequest.h"
 
 class nsIDOMDocument;
 class nsIFile;
 class nsIInputStream;
 
 class nsDOMFile : public nsIDOMFile,
-                  public nsIXHRSendable,
+                  public nsIDOMFileInternal,
                   public nsICharsetDetectionObserver
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMFILE
-  NS_DECL_NSIXHRSENDABLE
-
-  nsDOMFile(nsIFile *aFile, nsIDocument* aRelatedDoc, nsAString& aContentType)
-    : mFile(aFile),
-      mRelatedDoc(do_GetWeakReference(aRelatedDoc)),
-      mContentType(aContentType)
-  {}
+  NS_DECL_NSIDOMFILEINTERNAL
 
   nsDOMFile(nsIFile *aFile, nsIDocument* aRelatedDoc)
     : mFile(aFile),
       mRelatedDoc(do_GetWeakReference(aRelatedDoc))
   {}
-
   ~nsDOMFile() {}
 
   // from nsICharsetDetectionObserver
@@ -94,30 +87,6 @@ private:
                          nsAString &aResult);
 };
 
-class nsDOMMemoryFile : public nsDOMFile
-{
-public:
-  nsDOMMemoryFile(void *aMemoryBuffer,
-                  PRUint64 aLength,
-                  nsAString& aContentType,
-                  nsIDocument *aRelatedDoc)
-    : nsDOMFile(nsnull, aRelatedDoc, aContentType),
-      mInternalData(aMemoryBuffer), mLength(aLength)
-  { }
-
-  ~nsDOMMemoryFile()
-  { free(mInternalData); }
-
-  NS_IMETHOD GetName(nsAString&);
-  NS_IMETHOD GetSize(PRUint64*);
-  NS_IMETHOD GetInternalStream(nsIInputStream**);
-  NS_IMETHOD GetMozFullPathInternal(nsAString&);
-
-protected:
-  void* mInternalData;
-  PRUint64 mLength;
-};
-
 class nsDOMFileList : public nsIDOMFileList
 {
 public:
diff --git a/content/base/public/nsIDOMFile.idl b/content/base/public/nsIDOMFile.idl
index 9e63b5dfeb51..4af299e92f40 100644
--- a/content/base/public/nsIDOMFile.idl
+++ b/content/base/public/nsIDOMFile.idl
@@ -38,10 +38,8 @@
 #include "domstubs.idl"
 
 interface nsIDOMFileError;
-interface nsIInputStream;
-interface nsIURI;
 
-[scriptable, uuid(e72e2d6e-e267-4ea1-a798-6703d3a2c362)]
+[scriptable, uuid(b10293e1-d531-4bdd-9b2b-4d8c1c9bc633)]
 interface nsIDOMFile : nsISupports
 {
   //fileName and fileSize are now deprecated attributes
@@ -58,11 +56,4 @@ interface nsIDOMFile : nsISupports
   DOMString getAsText(in DOMString encoding); // raises(FileException) on retrieval
   DOMString getAsDataURL();             // raises(FileException) on retrieval
   DOMString getAsBinary();              // raises(FileException) on retrieval
-
-  [noscript] readonly attribute nsIInputStream internalStream;
-  // The caller is responsible for releasing the internalUrl from the
-  // moz-filedata: protocol handler
-  [noscript] readonly attribute DOMString internalUrl;
-  // This performs no security checks!
-  [noscript] readonly attribute DOMString mozFullPathInternal;
 };
diff --git a/content/base/public/nsIDOMFileInternal.idl b/content/base/public/nsIDOMFileInternal.idl
new file mode 100644
index 000000000000..a4e5dd6d461e
--- /dev/null
+++ b/content/base/public/nsIDOMFileInternal.idl
@@ -0,0 +1,46 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Corporation
+ * Portions created by the Initial Developer are Copyright (C) 2007
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "domstubs.idl"
+
+interface nsIFile;
+
+[scriptable, uuid(047CA6C4-52B3-46F1-8976-E198B724F72F)]
+interface nsIDOMFileInternal : nsISupports
+{
+  attribute nsIFile internalFile;
+};
diff --git a/content/base/src/nsDOMFile.cpp b/content/base/src/nsDOMFile.cpp
index abb71f66421d..05bd5a20f5fd 100644
--- a/content/base/src/nsDOMFile.cpp
+++ b/content/base/src/nsDOMFile.cpp
@@ -15,7 +15,7 @@
  * The Original Code is mozila.org code.
  *
  * The Initial Developer of the Original Code is
- * Mozilla Foundation
+ * Mozilla Corporation
  * Portions created by the Initial Developer are Copyright (C) 2007
  * the Initial Developer. All Rights Reserved.
  *
@@ -61,7 +61,6 @@
 #include "nsNetUtil.h"
 #include "nsIUUIDGenerator.h"
 #include "nsFileDataProtocolHandler.h"
-#include "nsStringStream.h"
 
 #include "plbase64.h"
 #include "prmem.h"
@@ -73,7 +72,7 @@ DOMCI_DATA(File, nsDOMFile)
 NS_INTERFACE_MAP_BEGIN(nsDOMFile)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMFile)
   NS_INTERFACE_MAP_ENTRY(nsIDOMFile)
-  NS_INTERFACE_MAP_ENTRY(nsIXHRSendable)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMFileInternal)
   NS_INTERFACE_MAP_ENTRY(nsICharsetDetectionObserver)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(File)
 NS_INTERFACE_MAP_END
@@ -117,18 +116,12 @@ NS_IMETHODIMP
 nsDOMFile::GetMozFullPath(nsAString &aFileName)
 {
   if (nsContentUtils::IsCallerTrustedForCapability("UniversalFileRead")) {
-    return GetMozFullPathInternal(aFileName);
+    return mFile->GetPath(aFileName);
   }
   aFileName.Truncate();
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsDOMFile::GetMozFullPathInternal(nsAString &aFilename)
-{
-  return mFile->GetPath(aFilename);
-}
-
 NS_IMETHODIMP
 nsDOMFile::GetSize(PRUint64 *aFileSize)
 {
@@ -169,56 +162,36 @@ nsDOMFile::GetType(nsAString &aType)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsDOMFile::GetInternalStream(nsIInputStream **aStream)
-{
-  return NS_NewLocalFileInputStream(aStream, mFile, -1, -1,
-                                    nsIFileInputStream::CLOSE_ON_EOF |
-                                    nsIFileInputStream::REOPEN_ON_REWIND);
-}
-
 NS_IMETHODIMP
 nsDOMFile::GetUrl(nsAString& aURL)
 {
   if (mURL.IsEmpty()) {
-    GetInternalUrl(mURL);
+    nsresult rv;
+    nsCOMPtr<nsIUUIDGenerator> uuidgen =
+      do_GetService("@mozilla.org/uuid-generator;1", &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+  
+    nsID id;
+    rv = uuidgen->GenerateUUIDInPlace(&id);
+    NS_ENSURE_SUCCESS(rv, rv);
+  
+    char chars[NSID_LENGTH];
+    id.ToProvidedString(chars);
+    
+    nsCString url = NS_LITERAL_CSTRING(FILEDATA_SCHEME ":") +
+                    Substring(chars + 1, chars + NSID_LENGTH - 2);
 
     nsCOMPtr<nsIDocument> doc = do_QueryReferent(mRelatedDoc);
-    NS_LossyConvertUTF16toASCII shortURL(mURL);
-    doc->RegisterFileDataUri(shortURL);
+    if (doc) {
+      doc->RegisterFileDataUri(url);
+      nsFileDataProtocolHandler::AddFileDataEntry(url, mFile,
+                                                  doc->NodePrincipal());
+    }
+
+    CopyASCIItoUTF16(url, mURL);
   }
 
   aURL = mURL;
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMFile::GetInternalUrl(nsAString& aURL)
-{
-  nsresult rv;
-  nsCOMPtr<nsIUUIDGenerator> uuidgen =
-    do_GetService("@mozilla.org/uuid-generator;1", &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-  
-  nsID id;
-  rv = uuidgen->GenerateUUIDInPlace(&id);
-  NS_ENSURE_SUCCESS(rv, rv);
-  
-  char chars[NSID_LENGTH];
-  id.ToProvidedString(chars);
-    
-  nsCString url = NS_LITERAL_CSTRING(FILEDATA_SCHEME ":") +
-    Substring(chars + 1, chars + NSID_LENGTH - 2);
-
-  nsCOMPtr<nsIDocument> doc = do_QueryReferent(mRelatedDoc);
-  if (doc) {
-    nsFileDataProtocolHandler::AddFileDataEntry(url,
-                                                this,
-                                                doc->NodePrincipal());
-  }
-
-  CopyASCIItoUTF16(url, aURL);
   
   return NS_OK;
 }
@@ -229,7 +202,9 @@ nsDOMFile::GetAsText(const nsAString &aCharset, nsAString &aResult)
   aResult.Truncate();
 
   nsCOMPtr<nsIInputStream> stream;
-  nsresult rv = GetInternalStream(getter_AddRefs(stream));
+  nsresult rv = NS_NewLocalFileInputStream
+                  (getter_AddRefs(stream),
+                   mFile, -1, -1, 0);
   NS_ENSURE_SUCCESS(rv, DOMFileResult(rv));
 
   nsCAutoString charsetGuess;
@@ -256,33 +231,43 @@ nsDOMFile::GetAsText(const nsAString &aCharset, nsAString &aResult)
   return ConvertStream(stream, charset.get(), aResult);
 }
 
+NS_IMETHODIMP
+nsDOMFile::GetInternalFile(nsIFile **aFile)
+{
+  NS_IF_ADDREF(*aFile = mFile);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDOMFile::SetInternalFile(nsIFile *aFile)
+{
+  mFile = aFile;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDOMFile::GetAsDataURL(nsAString &aResult)
 {
   aResult.AssignLiteral("data:");
 
   nsresult rv;
-  if (!mContentType.Length()) {
-    nsCOMPtr<nsIMIMEService> mimeService =
-      do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
+  nsCOMPtr<nsIMIMEService> mimeService =
+    do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
 
-    nsCAutoString contentType;
-    rv = mimeService->GetTypeFromFile(mFile, contentType);
-    if (NS_SUCCEEDED(rv)) {
-      CopyUTF8toUTF16(contentType, mContentType);
-    }
-  }
-
-  if (mContentType.Length()) {
-    aResult.Append(mContentType);
+  nsCAutoString contentType;
+  rv = mimeService->GetTypeFromFile(mFile, contentType);
+  if (NS_SUCCEEDED(rv)) {
+    AppendUTF8toUTF16(contentType, aResult);
   } else {
     aResult.AppendLiteral("application/octet-stream");
   }
   aResult.AppendLiteral(";base64,");
 
   nsCOMPtr<nsIInputStream> stream;
-  rv = GetInternalStream(getter_AddRefs(stream));
+  rv = NS_NewLocalFileInputStream(getter_AddRefs(stream),
+                                  mFile, -1, -1,
+                                  nsIFileInputStream::CLOSE_ON_EOF);
   NS_ENSURE_SUCCESS(rv, DOMFileResult(rv));
 
   char readBuf[4096];
@@ -322,7 +307,10 @@ nsDOMFile::GetAsBinary(nsAString &aResult)
   aResult.Truncate();
 
   nsCOMPtr<nsIInputStream> stream;
-  nsresult rv = GetInternalStream(getter_AddRefs(stream));
+  nsresult rv = NS_NewLocalFileInputStream
+                  (getter_AddRefs(stream),
+                   mFile, -1, -1,
+                   nsIFileInputStream::CLOSE_ON_EOF);
   NS_ENSURE_SUCCESS(rv, DOMFileResult(rv));
 
   PRUint32 numRead;
@@ -435,29 +423,6 @@ nsDOMFile::GuessCharset(nsIInputStream *aStream,
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsDOMFile::GetSendInfo(nsIInputStream** aBody,
-                       nsACString& aContentType,
-                       nsACString& aCharset)
-{
-  nsresult rv;
-
-  nsCOMPtr<nsIInputStream> stream;
-  rv = this->GetInternalStream(getter_AddRefs(stream));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsString contentType;
-  rv = this->GetType(contentType);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  CopyUTF16toUTF8(contentType, aContentType);
-
-  aCharset.Truncate();
-
-  stream.forget(aBody);
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsDOMFile::Notify(const char* aCharset, nsDetectionConfident aConf)
 {
@@ -498,39 +463,6 @@ nsDOMFile::ConvertStream(nsIInputStream *aStream,
   return rv;
 }
 
-// nsDOMMemoryFile Implementation
-NS_IMETHODIMP
-nsDOMMemoryFile::GetName(nsAString &aFileName)
-{
-  aFileName.Truncate();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMMemoryFile::GetSize(PRUint64 *aFileSize)
-{
-  *aFileSize = mLength;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMMemoryFile::GetInternalStream(nsIInputStream **aStream)
-{
-  if (mLength > PR_INT32_MAX)
-    return NS_ERROR_FAILURE;
-
-  PRInt32 l = mLength;
-
-  return NS_NewByteInputStream(aStream, (const char*)mInternalData, l);
-}
-
-NS_IMETHODIMP
-nsDOMMemoryFile::GetMozFullPathInternal(nsAString &aFilename)
-{
-  aFilename.Truncate();
-  return NS_OK;
-}
-
 // nsDOMFileList implementation
 
 DOMCI_DATA(FileList, nsDOMFileList)
diff --git a/content/base/src/nsDOMFileReader.cpp b/content/base/src/nsDOMFileReader.cpp
index 46f510b8a81f..0fdb844ed1f3 100644
--- a/content/base/src/nsDOMFileReader.cpp
+++ b/content/base/src/nsDOMFileReader.cpp
@@ -15,7 +15,7 @@
  * The Original Code is mozila.org code.
  *
  * The Initial Developer of the Original Code is
- * Mozilla Foundation
+ * Mozilla Corporation
  * Portions created by the Initial Developer are Copyright (C) 2007
  * the Initial Developer. All Rights Reserved.
  *
@@ -71,13 +71,13 @@
 #include "nsJSEnvironment.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIDOMClassInfo.h"
+#include "nsIDOMFileInternal.h"
 #include "nsCExternalHandlerService.h"
 #include "nsIStreamConverterService.h"
 #include "nsEventDispatcher.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsLayoutStatics.h"
 #include "nsIScriptObjectPrincipal.h"
-#include "nsFileDataProtocolHandler.h"
 
 #define LOAD_STR "load"
 #define ERROR_STR "error"
@@ -496,31 +496,26 @@ nsDOMFileReader::ReadFileContent(nsIDOMFile* aFile,
   mReadyState = nsIDOMFileReader::EMPTY;
   FreeFileData();
 
-  mFile = aFile;
   mDataFormat = aDataFormat;
   mCharset = aCharset;
 
-  //Establish a channel with our file
-  nsAutoString url;
-  nsresult rv = mFile->GetInternalUrl(url);
+  //Obtain the nsDOMFile's underlying nsIFile
+  nsresult rv;
+  nsCOMPtr<nsIDOMFileInternal> domFile(do_QueryInterface(aFile));
+  rv = domFile->GetInternalFile(getter_AddRefs(mFile));
   NS_ENSURE_SUCCESS(rv, rv);
 
+  //Establish a channel with our file
   nsCOMPtr<nsIURI> uri;
-  rv = NS_NewURI(getter_AddRefs(uri), url);
+  rv = NS_NewFileURI(getter_AddRefs(uri), mFile);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = NS_NewChannel(getter_AddRefs(mChannel), uri);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // After we open the channel we don't need the url anymore.  The channel will
-  // hold alive whatever we're interested in.
-  nsCAutoString narrowUrl;
-  CopyUTF16toUTF8(url, narrowUrl);
-  nsFileDataProtocolHandler::RemoveFileDataEntry(narrowUrl);
-
   //Obtain the total size of the file before reading
   mReadTotal = -1;
-  mFile->GetSize(&mReadTotal);
+  mFile->GetFileSize(&mReadTotal);
 
   rv = mChannel->AsyncOpen(this, nsnull);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -609,7 +604,7 @@ nsDOMFileReader::GetAsText(const nsAString &aCharset,
 }
 
 nsresult
-nsDOMFileReader::GetAsDataURL(nsIDOMFile *aFile,
+nsDOMFileReader::GetAsDataURL(nsIFile *aFile,
                               const char *aFileData,
                               PRUint32 aDataLen,
                               nsAString& aResult)
@@ -617,10 +612,14 @@ nsDOMFileReader::GetAsDataURL(nsIDOMFile *aFile,
   aResult.AssignLiteral("data:");
 
   nsresult rv;
-  nsString contentType;
-  rv = aFile->GetType(contentType);
-  if (NS_SUCCEEDED(rv) && !contentType.IsEmpty()) {
-    aResult.Append(contentType);
+  nsCOMPtr<nsIMIMEService> mimeService =
+    do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCAutoString contentType;
+  rv = mimeService->GetTypeFromFile(aFile, contentType);
+  if (NS_SUCCEEDED(rv)) {
+    AppendUTF8toUTF16(contentType, aResult);
   } else {
     aResult.AppendLiteral("application/octet-stream");
   }
diff --git a/content/base/src/nsDOMFileReader.h b/content/base/src/nsDOMFileReader.h
index fdd028cac6cf..42922d632ba3 100644
--- a/content/base/src/nsDOMFileReader.h
+++ b/content/base/src/nsDOMFileReader.h
@@ -120,7 +120,7 @@ protected:
   nsresult ReadFileContent(nsIDOMFile *aFile, const nsAString &aCharset, eDataFormat aDataFormat); 
   nsresult GetAsText(const nsAString &aCharset,
                      const char *aFileData, PRUint32 aDataLen, nsAString &aResult);
-  nsresult GetAsDataURL(nsIDOMFile *aFile, const char *aFileData, PRUint32 aDataLen, nsAString &aResult); 
+  nsresult GetAsDataURL(nsIFile *aFile, const char *aFileData, PRUint32 aDataLen, nsAString &aResult); 
   nsresult GuessCharset(const char *aFileData, PRUint32 aDataLen, nsACString &aCharset); 
   nsresult ConvertStream(const char *aFileData, PRUint32 aDataLen, const char *aCharset, nsAString &aResult); 
   void DispatchError(nsresult rv);
@@ -133,7 +133,7 @@ protected:
   }
 
   char *mFileData;
-  nsCOMPtr<nsIDOMFile> mFile;
+  nsCOMPtr<nsIFile> mFile;
   nsString mCharset;
   PRUint32 mDataLen;
 
@@ -150,7 +150,7 @@ protected:
   nsCOMPtr<nsIPrincipal> mPrincipal;
   nsCOMPtr<nsIChannel> mChannel;
 
-  PRUint64 mReadTotal;
+  PRInt64 mReadTotal;
   PRUint64 mReadTransferred;
 
   nsRefPtr<nsDOMEventListenerWrapper> mOnLoadEndListener;
diff --git a/content/base/src/nsFileDataProtocolHandler.cpp b/content/base/src/nsFileDataProtocolHandler.cpp
index 9c1bf5db4f66..314c987fd4bf 100644
--- a/content/base/src/nsFileDataProtocolHandler.cpp
+++ b/content/base/src/nsFileDataProtocolHandler.cpp
@@ -42,7 +42,7 @@
 #include "nsNetUtil.h"
 #include "nsIURIWithPrincipal.h"
 #include "nsIPrincipal.h"
-#include "nsIDOMFile.h"
+#include "nsIFileChannel.h"
 #include "nsISerializable.h"
 #include "nsIClassInfo.h"
 #include "nsIObjectInputStream.h"
@@ -55,15 +55,14 @@ static NS_DEFINE_CID(kSimpleURICID, NS_SIMPLEURI_CID);
 // Hash table
 struct FileDataInfo
 {
-  nsCOMPtr<nsIDOMFile> mFile;
+  nsCOMPtr<nsIURI> mFileUri;
   nsCOMPtr<nsIPrincipal> mPrincipal;
 };
 
 static nsClassHashtable<nsCStringHashKey, FileDataInfo>* gFileDataTable;
 
 void
-nsFileDataProtocolHandler::AddFileDataEntry(nsACString& aUri,
-					    nsIDOMFile* aFile,
+nsFileDataProtocolHandler::AddFileDataEntry(nsACString& aUri, nsIFile* aFile,
                                             nsIPrincipal* aPrincipal)
 {
   if (!gFileDataTable) {
@@ -73,7 +72,7 @@ nsFileDataProtocolHandler::AddFileDataEntry(nsACString& aUri,
 
   FileDataInfo* info = new FileDataInfo;
 
-  info->mFile = aFile;
+  NS_NewFileURI(getter_AddRefs(info->mFileUri), aFile);
   info->mPrincipal = aPrincipal;
 
   gFileDataTable->Put(aUri, info);
@@ -414,14 +413,8 @@ nsFileDataProtocolHandler::NewChannel(nsIURI* uri, nsIChannel* *result)
   }
 #endif
 
-  nsCOMPtr<nsIInputStream> stream;
-  nsresult rv = info->mFile->GetInternalStream(getter_AddRefs(stream));
-  NS_ENSURE_SUCCESS(rv, rv);
-
   nsCOMPtr<nsIChannel> channel;
-  rv = NS_NewInputStreamChannel(getter_AddRefs(channel),
-				uri,
-				stream);
+  nsresult rv = NS_NewChannel(getter_AddRefs(channel), info->mFileUri);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsISupports> owner = do_QueryInterface(info->mPrincipal);
diff --git a/content/base/src/nsFileDataProtocolHandler.h b/content/base/src/nsFileDataProtocolHandler.h
index b98d397b492e..402f56a67797 100644
--- a/content/base/src/nsFileDataProtocolHandler.h
+++ b/content/base/src/nsFileDataProtocolHandler.h
@@ -41,7 +41,7 @@
 
 #define FILEDATA_SCHEME "moz-filedata"
 
-class nsIDOMFile;
+class nsIFile;
 class nsIPrincipal;
 
 class nsFileDataProtocolHandler : public nsIProtocolHandler
@@ -57,8 +57,7 @@ public:
   virtual ~nsFileDataProtocolHandler() {}
 
   // Methods for managing uri->file mapping
-  static void AddFileDataEntry(nsACString& aUri,
-			       nsIDOMFile* aFile,
+  static void AddFileDataEntry(nsACString& aUri, nsIFile* aFile,
                                nsIPrincipal* aPrincipal);
   static void RemoveFileDataEntry(nsACString& aUri);
   
diff --git a/content/base/src/nsFormData.cpp b/content/base/src/nsFormData.cpp
index c9176d9c245b..068964108cce 100644
--- a/content/base/src/nsFormData.cpp
+++ b/content/base/src/nsFormData.cpp
@@ -36,8 +36,9 @@
 
 #include "nsFormData.h"
 #include "nsIVariant.h"
+#include "nsIDOMFileInternal.h"
 #include "nsIInputStream.h"
-#include "nsIDOMFile.h"
+#include "nsIFile.h"
 #include "nsContentUtils.h"
 
 nsFormData::nsFormData()
@@ -83,7 +84,7 @@ nsFormData::AddNameValuePair(const nsAString& aName,
 
 nsresult
 nsFormData::AddNameFilePair(const nsAString& aName,
-                            nsIDOMFile* aFile)
+                            nsIFile* aFile)
 {
   FormDataTuple* data = mFormData.AppendElement();
   data->name = aName;
@@ -112,9 +113,13 @@ nsFormData::Append(const nsAString& aName, nsIVariant* aValue)
 
     nsMemory::Free(iid);
 
-    nsCOMPtr<nsIDOMFile> domFile = do_QueryInterface(supports);
+    nsCOMPtr<nsIDOMFileInternal> domFile = do_QueryInterface(supports);
     if (domFile) {
-      return AddNameFilePair(aName, domFile);
+      nsCOMPtr<nsIFile> file;
+      rv = domFile->GetInternalFile(getter_AddRefs(file));
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      return AddNameFilePair(aName, file);
     }
   }
 
diff --git a/content/base/src/nsFormData.h b/content/base/src/nsFormData.h
index 19ca9433fce8..3dc745b7416b 100644
--- a/content/base/src/nsFormData.h
+++ b/content/base/src/nsFormData.h
@@ -42,8 +42,6 @@
 #include "nsFormSubmission.h"
 #include "nsTArray.h"
 
-class nsIDOMFile;
-
 class nsFormData : public nsIDOMFormData,
                    public nsIXHRSendable,
                    public nsFormSubmission
@@ -61,14 +59,16 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIDOMFile* aFile);
+                                   nsIFile* aFile);
+
+  
 
 private:
   struct FormDataTuple
   {
     nsString name;
     nsString stringValue;
-    nsCOMPtr<nsIDOMFile> fileValue;
+    nsCOMPtr<nsIFile> fileValue;
     PRBool valueIsFile;
   };
   
diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
index fe3921272f6d..71649c629d78 100644
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -63,6 +63,7 @@
 #include "nsIScriptGlobalObject.h"
 #include "nsIDOMClassInfo.h"
 #include "nsIDOMElement.h"
+#include "nsIDOMFileInternal.h"
 #include "nsIDOMWindow.h"
 #include "nsIMIMEService.h"
 #include "nsCExternalHandlerService.h"
@@ -2327,6 +2328,29 @@ GetRequestBody(nsIVariant* aBody, nsIInputStream** aResult,
       return NS_OK;
     }
 
+    // nsIDOMFile?
+    nsCOMPtr<nsIDOMFileInternal> file = do_QueryInterface(supports);
+    if (file) {
+      aCharset.Truncate();
+
+      nsCOMPtr<nsIFile> internalFile;
+      rv = file->GetInternalFile(getter_AddRefs(internalFile));
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      // Get the mimetype
+      nsCOMPtr<nsIMIMEService> mimeService =
+          do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      rv = mimeService->GetTypeFromFile(internalFile, aContentType);
+      if (NS_FAILED(rv)) {
+        aContentType.Truncate();
+      }
+
+      // Feed local file input stream into our upload channel
+      return NS_NewLocalFileInputStream(aResult, internalFile);
+    }
+
     // nsIXHRSendable?
     nsCOMPtr<nsIXHRSendable> sendable = do_QueryInterface(supports);
     if (sendable) {
diff --git a/content/base/test/test_bug345339.html b/content/base/test/test_bug345339.html
index 407e268d5449..323d5c799ad2 100644
--- a/content/base/test/test_bug345339.html
+++ b/content/base/test/test_bug345339.html
@@ -22,8 +22,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=345339
 /** Test for Bug 345339 **/
 SimpleTest.waitForExplicitFinish();
 
-var filePath;
-
 function afterLoad() {
     var iframeDoc = $("testframe").contentDocument;
 
@@ -33,15 +31,8 @@ function afterLoad() {
     iframeDoc.getElementById("password").value = "123456";
     iframeDoc.getElementById("hidden").value = "gecko";
 
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-    var file = Components.classes["@mozilla.org/file/directory_service;1"]
-             .getService(Components.interfaces.nsIProperties)
-             .get("TmpD", Components.interfaces.nsILocalFile);
-    file.append("345339_test.file");
-    file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
-    filePath = file.path;
-
-    iframeDoc.getElementById("file").value = filePath;
+    netscape.security.PrivilegeManager.enablePrivilege("UniversalFileRead");
+    iframeDoc.getElementById("file").value = "dummyfile.txt";
 
     /* Reload the page */
     $("testframe").setAttribute("onload", "afterReload()");
@@ -64,7 +55,7 @@ function afterReload() {
     is(iframeDoc.getElementById("hidden").value, "gecko",
        "hidden field value preserved");
     netscape.security.PrivilegeManager.enablePrivilege("UniversalFileRead");
-    is(iframeDoc.getElementById("file").value, filePath,
+    is(iframeDoc.getElementById("file").value, "dummyfile.txt",
        "file field value preserved");
 
     SimpleTest.finish();
diff --git a/content/html/content/public/Makefile.in b/content/html/content/public/Makefile.in
index bb24b40db9be..b5de365f6c8d 100644
--- a/content/html/content/public/Makefile.in
+++ b/content/html/content/public/Makefile.in
@@ -60,6 +60,7 @@ EXPORTS = \
 		nsIRadioVisitor.h \
 		nsIRadioGroupContainer.h \
 		nsITextControlElement.h \
+		nsIFileControlElement.h \
 		nsFormSubmission.h \
 		nsIFrameSetElement.h \
 		nsHTMLAudioElement.h \
diff --git a/content/html/content/public/nsFormSubmission.h b/content/html/content/public/nsFormSubmission.h
index 5c26ae9d1016..83fbb1ccd8cf 100644
--- a/content/html/content/public/nsFormSubmission.h
+++ b/content/html/content/public/nsFormSubmission.h
@@ -52,7 +52,6 @@ class nsIDocShell;
 class nsIRequest;
 class nsISaveAsCharset;
 class nsIMultiplexInputStream;
-class nsIDOMFile;
 
 /**
  * Class for form submissions; encompasses the function to call to submit as
@@ -82,7 +81,7 @@ public:
    * @param aFile the file to submit
    */
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIDOMFile* aFile) = 0;
+                                   nsIFile* aFile) = 0;
   
   /**
    * Reports whether the instance supports AddIsindex().
@@ -188,7 +187,7 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIDOMFile* aFile);
+                                   nsIFile* aFile);
   virtual nsresult GetEncodedSubmission(nsIURI* aURI,
                                         nsIInputStream** aPostDataStream);
 
diff --git a/content/html/content/public/nsIFileControlElement.h b/content/html/content/public/nsIFileControlElement.h
new file mode 100644
index 000000000000..73cb76e2baee
--- /dev/null
+++ b/content/html/content/public/nsIFileControlElement.h
@@ -0,0 +1,86 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2006
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Jonas Sicking <jonas@sicking.cc> (Original author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsIFileControlElement_h___
+#define nsIFileControlElement_h___
+
+#include "nsISupports.h"
+#include "nsTArray.h"
+#include "nsString.h"
+#include "nsCOMArray.h"
+
+class nsIFile;
+
+// IID for the nsIFileControl interface
+#define NS_IFILECONTROLELEMENT_IID \
+{ 0x1f6a32fd, 0x9cda, 0x43e9, \
+  { 0x90, 0xef, 0x18, 0x0a, 0xd5, 0xe6, 0xcd, 0xa9 } }
+
+/**
+ * This interface is used for the file control frame to store its value away
+ * into the content.
+ */
+class nsIFileControlElement : public nsISupports {
+public:
+
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IFILECONTROLELEMENT_IID)
+
+  /**
+   * Gets a readable string representing the list of files currently
+   * selected by this control. This value might not be a valid file name
+   * and should not be used for anything but displaying the filename to the
+   * user.
+   */
+  virtual void GetDisplayFileName(nsAString& aFileName) = 0;
+
+  /**
+   * Sets the list of filenames currently selected by this control.
+   */
+  virtual void SetFileNames(const nsTArray<nsString>& aFileNames) = 0;
+
+  /**
+   * Gets a list of nsIFile objects for the files currently selected by
+   * this control.
+   */
+  virtual void GetFileArray(nsCOMArray<nsIFile>& aFiles) = 0;
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(nsIFileControlElement,
+                              NS_IFILECONTROLELEMENT_IID)
+
+#endif // nsIFileControlElement_h___
diff --git a/content/html/content/src/nsFormSubmission.cpp b/content/html/content/src/nsFormSubmission.cpp
index d2979ba5486d..62563101e83b 100644
--- a/content/html/content/src/nsFormSubmission.cpp
+++ b/content/html/content/src/nsFormSubmission.cpp
@@ -49,8 +49,9 @@
 #include "nsDOMError.h"
 #include "nsGenericHTMLElement.h"
 #include "nsISaveAsCharset.h"
+
+// JBK added for submit move from content frame
 #include "nsIFile.h"
-#include "nsIDOMFile.h"
 #include "nsDirectoryServiceDefs.h"
 #include "nsStringStream.h"
 #include "nsIURI.h"
@@ -109,7 +110,7 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIDOMFile* aFile);
+                                   nsIFile* aFile);
   virtual nsresult GetEncodedSubmission(nsIURI* aURI,
                                         nsIInputStream** aPostDataStream);
 
@@ -195,7 +196,7 @@ nsFSURLEncoded::AddIsindex(const nsAString& aValue)
 
 nsresult
 nsFSURLEncoded::AddNameFilePair(const nsAString& aName,
-                                nsIDOMFile* aFile)
+                                nsIFile* aFile)
 {
   if (!mWarnedFileControl) {
     SendJSWarning(mDocument, "ForgotFileEnctypeWarning", nsnull, 0);
@@ -204,7 +205,7 @@ nsFSURLEncoded::AddNameFilePair(const nsAString& aName,
 
   nsAutoString filename;
   if (aFile) {
-    aFile->GetName(filename);
+    aFile->GetLeafName(filename);
   }
 
   return AddNameValuePair(aName, filename);
@@ -468,7 +469,7 @@ nsFSMultipartFormData::AddNameValuePair(const nsAString& aName,
 
 nsresult
 nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
-                                       nsIDOMFile* aFile)
+                                       nsIFile* aFile)
 {
   // Encode the control name
   nsCAutoString nameStr;
@@ -476,13 +477,12 @@ nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCString filenameStr;
-  nsAutoString contentType;
+  nsCAutoString contentType;
   nsCOMPtr<nsIInputStream> fileStream;
   if (aFile) {
     // Get and encode the filename
     nsAutoString filename;
-    rv = aFile->GetName(filename);
-    NS_ENSURE_SUCCESS(rv, rv);
+    aFile->GetLeafName(filename);
     nsCAutoString encodedFileName;
     rv = EncodeVal(filename, encodedFileName);
     NS_ENSURE_SUCCESS(rv, rv);
@@ -493,14 +493,20 @@ nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
                                         nsLinebreakConverter::eLinebreakNet));
   
     // Get content type
-    rv = aFile->GetType(contentType);
-    if (NS_FAILED(rv) || contentType.IsEmpty()) {
+    nsCOMPtr<nsIMIMEService> MIMEService =
+      do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = MIMEService->GetTypeFromFile(aFile, contentType);
+    if (NS_FAILED(rv)) {
       contentType.AssignLiteral("application/octet-stream");
     }
   
     // Get input stream
-    rv = aFile->GetInternalStream(getter_AddRefs(fileStream));
-    NS_ENSURE_SUCCESS(rv, rv);
+    rv = NS_NewLocalFileInputStream(getter_AddRefs(fileStream),
+                                    aFile, -1, -1,
+                                    nsIFileInputStream::CLOSE_ON_EOF |
+                                    nsIFileInputStream::REOPEN_ON_REWIND);
     if (fileStream) {
       // Create buffered stream (for efficiency)
       nsCOMPtr<nsIInputStream> bufferedStream;
@@ -528,9 +534,8 @@ nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
          NS_LITERAL_CSTRING("Content-Disposition: form-data; name=\"")
        + nameStr + NS_LITERAL_CSTRING("\"; filename=\"")
        + filenameStr + NS_LITERAL_CSTRING("\"" CRLF)
-       + NS_LITERAL_CSTRING("Content-Type: ");
-  AppendUTF16toUTF8(contentType, mPostDataChunk);
-  mPostDataChunk += NS_LITERAL_CSTRING(CRLF CRLF);
+       + NS_LITERAL_CSTRING("Content-Type: ") + contentType
+       + NS_LITERAL_CSTRING(CRLF CRLF);
 
   // Add the file to the stream
   if (fileStream) {
@@ -600,7 +605,7 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIDOMFile* aFile);
+                                   nsIFile* aFile);
   virtual nsresult GetEncodedSubmission(nsIURI* aURI,
                                         nsIInputStream** aPostDataStream);
 
@@ -623,11 +628,11 @@ nsFSTextPlain::AddNameValuePair(const nsAString& aName,
 
 nsresult
 nsFSTextPlain::AddNameFilePair(const nsAString& aName,
-                               nsIDOMFile* aFile)
+                               nsIFile* aFile)
 {
   nsAutoString filename;
   if (aFile) {
-    aFile->GetName(filename);
+    aFile->GetLeafName(filename);
   }
     
   AddNameValuePair(aName, filename);
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index e5f510585276..c4d37657c0a0 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -1315,18 +1315,6 @@ NS_NewHTML##_elementName##Element(already_AddRefed<nsINodeInfo> aNodeInfo,   \
     NS_INTERFACE_TABLE_ENTRY(_class, _i6)                                     \
   NS_OFFSET_AND_INTERFACE_TABLE_END
 
-#define NS_HTML_CONTENT_INTERFACE_TABLE7(_class, _i1, _i2, _i3, _i4, _i5,     \
-                                         _i6, _i7)                            \
-  NS_HTML_CONTENT_INTERFACE_TABLE_BEGIN(_class)                               \
-    NS_INTERFACE_TABLE_ENTRY(_class, _i1)                                     \
-    NS_INTERFACE_TABLE_ENTRY(_class, _i2)                                     \
-    NS_INTERFACE_TABLE_ENTRY(_class, _i3)                                     \
-    NS_INTERFACE_TABLE_ENTRY(_class, _i4)                                     \
-    NS_INTERFACE_TABLE_ENTRY(_class, _i5)                                     \
-    NS_INTERFACE_TABLE_ENTRY(_class, _i6)                                     \
-    NS_INTERFACE_TABLE_ENTRY(_class, _i7)                                     \
-  NS_OFFSET_AND_INTERFACE_TABLE_END
-
 #define NS_HTML_CONTENT_INTERFACE_TABLE8(_class, _i1, _i2, _i3, _i4, _i5,     \
                                          _i6, _i7, _i8)                       \
   NS_HTML_CONTENT_INTERFACE_TABLE_BEGIN(_class)                               \
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index e82752974615..f0ef08b156a0 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -38,6 +38,7 @@
 
 #include "nsIDOMHTMLInputElement.h"
 #include "nsITextControlElement.h"
+#include "nsIFileControlElement.h"
 #include "nsIDOMNSEditableElement.h"
 #include "nsIRadioVisitor.h"
 #include "nsIPhonetic.h"
@@ -92,8 +93,8 @@
 
 #include "nsRuleData.h"
 
-// input type=radio
-#include "nsIRadioGroupContainer.h"
+// input type=radio
+#include "nsIRadioGroupContainer.h"
 
 // input type=file
 #include "nsIFile.h"
@@ -206,13 +207,12 @@ class nsHTMLInputElementState : public nsISupports
       mValue = aValue;
     }
 
-    const nsCOMArray<nsIDOMFile>& GetFiles() {
-      return mFiles;
+    const nsTArray<nsString>& GetFilenames() {
+      return mFilenames;
     }
 
-    void SetFiles(const nsCOMArray<nsIDOMFile> &aFiles) {
-      mFiles.Clear();
-      mFiles.AppendObjects(aFiles);
+    void SetFilenames(const nsTArray<nsString> &aFilenames) {
+      mFilenames = aFilenames;
     }
 
     nsHTMLInputElementState()
@@ -223,7 +223,7 @@ class nsHTMLInputElementState : public nsISupports
  
   protected:
     nsString mValue;
-    nsCOMArray<nsIDOMFile> mFiles;
+    nsTArray<nsString> mFilenames;
     PRPackedBool mChecked;
     PRPackedBool mCheckedSet;
 };
@@ -268,21 +268,21 @@ AsyncClickHandler::Run()
 
   // Check if page is allowed to open the popup
   if (mPopupControlState != openAllowed) {
-    nsCOMPtr<nsIPopupWindowManager> pm =
-      do_GetService(NS_POPUPWINDOWMANAGER_CONTRACTID);
- 
-    if (!pm) {
+    nsCOMPtr<nsIPopupWindowManager> pm =
+      do_GetService(NS_POPUPWINDOWMANAGER_CONTRACTID);
+ 
+    if (!pm) {
+      return NS_OK;
+    }
+
+    PRUint32 permission;
+    pm->TestPermission(doc->GetDocumentURI(), &permission);
+    if (permission == nsIPopupWindowManager::DENY_POPUP) {
+      nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(doc);
+      nsGlobalWindow::FirePopupBlockedEvent(domDoc, win, nsnull, EmptyString(), EmptyString());
       return NS_OK;
     }
-
-    PRUint32 permission;
-    pm->TestPermission(doc->GetDocumentURI(), &permission);
-    if (permission == nsIPopupWindowManager::DENY_POPUP) {
-      nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(doc);
-      nsGlobalWindow::FirePopupBlockedEvent(domDoc, win, nsnull, EmptyString(), EmptyString());
-      return NS_OK;
-    }
-  }
+  }
 
   // Get Loc title
   nsXPIDLString title;
@@ -325,24 +325,17 @@ AsyncClickHandler::Run()
   // Set default directry and filename
   nsAutoString defaultName;
 
-  const nsCOMArray<nsIDOMFile>& oldFiles = mInput->GetFiles();
+  nsCOMArray<nsIFile> oldFiles;
+  mInput->GetFileArray(oldFiles);
 
   if (oldFiles.Count()) {
-    nsString path;
-
-    oldFiles[0]->GetMozFullPathInternal(path);
-
-    nsCOMPtr<nsILocalFile> localFile;
-    rv = NS_NewLocalFile(path, PR_FALSE, getter_AddRefs(localFile));
-
-    if (NS_SUCCEEDED(rv)) {
-      nsCOMPtr<nsIFile> parentFile;
-      rv = localFile->GetParent(getter_AddRefs(parentFile));
-      if (NS_SUCCEEDED(rv)) {
-        nsCOMPtr<nsILocalFile> parentLocalFile = do_QueryInterface(parentFile, &rv);
-        if (parentLocalFile) {
-          filePicker->SetDisplayDirectory(parentLocalFile);
-        }
+    // set directory
+    nsCOMPtr<nsIFile> parentFile;
+    oldFiles[0]->GetParent(getter_AddRefs(parentFile));
+    if (parentFile) {
+      nsCOMPtr<nsILocalFile> parentLocalFile = do_QueryInterface(parentFile, &rv);
+      if (parentLocalFile) {
+        filePicker->SetDisplayDirectory(parentLocalFile);
       }
     }
 
@@ -351,7 +344,7 @@ AsyncClickHandler::Run()
     // one file was selected before.
     if (oldFiles.Count() == 1) {
       nsAutoString leafName;
-      oldFiles[0]->GetName(leafName);
+      oldFiles[0]->GetLeafName(leafName);
       if (!leafName.IsEmpty()) {
         filePicker->SetDefaultString(leafName);
       }
@@ -382,7 +375,7 @@ AsyncClickHandler::Run()
     return NS_OK;
   
   // Collect new selected filenames
-  nsCOMArray<nsIDOMFile> newFiles;
+  nsTArray<nsString> newFileNames;
   if (multi) {
     nsCOMPtr<nsISimpleEnumerator> iter;
     rv = filePicker->GetFiles(getter_AddRefs(iter));
@@ -396,9 +389,7 @@ AsyncClickHandler::Run()
         nsString unicodePath;
         rv = localFile->GetPath(unicodePath);
         if (!unicodePath.IsEmpty()) {
-          nsCOMPtr<nsIDOMFile> domFile =
-            do_QueryObject(new nsDOMFile(localFile, doc));
-          newFiles.AppendObject(domFile);
+          newFileNames.AppendElement(unicodePath);
         }
         if (!prefSaved) {
           // Store the last used directory using the content pref service
@@ -417,9 +408,7 @@ AsyncClickHandler::Run()
       nsString unicodePath;
       rv = localFile->GetPath(unicodePath);
       if (!unicodePath.IsEmpty()) {
-        nsCOMPtr<nsIDOMFile> domFile=
-          do_QueryObject(new nsDOMFile(localFile, doc));
-        newFiles.AppendObject(domFile);
+        newFileNames.AppendElement(unicodePath);
       }
       // Store the last used directory using the content pref service
       rv = nsHTMLInputElement::gUploadLastDir->StoreLastUsedDirectory(doc->GetDocumentURI(),
@@ -429,7 +418,7 @@ AsyncClickHandler::Run()
   }
 
   // Set new selected files
-  if (newFiles.Count()) {
+  if (!newFileNames.IsEmpty()) {
     // Tell mTextFrame that this update of the value is a user initiated
     // change. Otherwise it'll think that the value is being set by a script
     // and not fire onchange when it should.
@@ -439,7 +428,7 @@ AsyncClickHandler::Run()
       textFrame->SetFireChangeEventState(PR_TRUE);
     }
 
-    mInput->SetFiles(newFiles);
+    mInput->SetFileNames(newFileNames);
     if (textFrame) {
       textFrame->SetFireChangeEventState(oldState);
       // May need to fire an onchange here
@@ -680,9 +669,10 @@ DOMCI_NODE_DATA(HTMLInputElement, nsHTMLInputElement)
 
 // QueryInterface implementation for nsHTMLInputElement
 NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(nsHTMLInputElement)
-  NS_HTML_CONTENT_INTERFACE_TABLE8(nsHTMLInputElement,
+  NS_HTML_CONTENT_INTERFACE_TABLE9(nsHTMLInputElement,
                                    nsIDOMHTMLInputElement,
                                    nsITextControlElement,
+                                   nsIFileControlElement,
                                    nsIPhonetic,
                                    imgIDecoderObserver,
                                    nsIImageLoadingContent,
@@ -731,14 +721,7 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
       }
       break;
     case NS_FORM_INPUT_FILE:
-      if (it->GetOwnerDoc()->IsStaticDocument()) {
-        // We're going to be used in print preview.  Since the doc is static
-        // we can just grab the pretty string and use it as wallpaper
-        GetDisplayFileName(it->mStaticDocFileList);
-      } else {
-        it->mFiles.Clear();
-        it->mFiles.AppendObjects(mFiles);
-      }
+      it->mFileNames = mFileNames;
       break;
     case NS_FORM_INPUT_RADIO:
     case NS_FORM_INPUT_CHECKBOX:
@@ -1042,15 +1025,17 @@ nsHTMLInputElement::GetValue(nsAString& aValue)
 
   if (mType == NS_FORM_INPUT_FILE) {
     if (nsContentUtils::IsCallerTrustedForCapability("UniversalFileRead")) {
-      if (mFiles.Count()) {
-        return mFiles[0]->GetMozFullPath(aValue);
+      if (!mFileNames.IsEmpty()) {
+        aValue = mFileNames[0];
       }
       else {
         aValue.Truncate();
       }
     } else {
       // Just return the leaf name
-      if (mFiles.Count() == 0 || NS_FAILED(mFiles[0]->GetName(aValue))) {
+      nsCOMArray<nsIFile> files;
+      GetFileArray(files);
+      if (files.Count() == 0 || NS_FAILED(files[0]->GetLeafName(aValue))) {
         aValue.Truncate();
       }
     }
@@ -1080,11 +1065,10 @@ nsHTMLInputElement::SetValue(const nsAString& aValue)
         // UniversalFileRead privilege
         return NS_ERROR_DOM_SECURITY_ERR;
       }
-      const PRUnichar *name = PromiseFlatString(aValue).get();
-      return MozSetFileNameArray(&name, 1);
+      SetSingleFileName(aValue);
     }
     else {
-      ClearFiles();
+      ClearFileNames();
     }
   }
   else {
@@ -1103,14 +1087,12 @@ nsHTMLInputElement::MozGetFileNameArray(PRUint32 *aLength, PRUnichar ***aFileNam
     return NS_ERROR_DOM_SECURITY_ERR;
   }
 
-  *aLength = mFiles.Count();
+  *aLength = mFileNames.Length();
   PRUnichar **ret =
-    static_cast<PRUnichar **>(NS_Alloc(mFiles.Count() * sizeof(PRUnichar*)));
+    static_cast<PRUnichar **>(NS_Alloc(mFileNames.Length() * sizeof(PRUnichar*)));
   
-  for (PRUint32 i = 0; i <  mFiles.Count(); i++) {
-    nsString str;
-    mFiles[i]->GetMozFullPath(str);
-    ret[i] = NS_strdup(str.get());
+  for (PRUint32 i = 0; i <  mFileNames.Length(); i++) {
+    ret[i] = NS_strdup(mFileNames[i].get());
   }
 
   *aFileNames = ret;
@@ -1127,36 +1109,12 @@ nsHTMLInputElement::MozSetFileNameArray(const PRUnichar **aFileNames, PRUint32 a
     return NS_ERROR_DOM_SECURITY_ERR;
   }
 
-  nsCOMArray<nsIDOMFile> files;
+  nsTArray<nsString> fileNames(aLength);
   for (PRUint32 i = 0; i < aLength; ++i) {
-    nsCOMPtr<nsIFile> file;
-    if (StringBeginsWith(nsDependentString(aFileNames[i]),
-                         NS_LITERAL_STRING("file:"),
-                         nsASCIICaseInsensitiveStringComparator())) {
-      // Converts the URL string into the corresponding nsIFile if possible
-      // A local file will be created if the URL string begins with file://
-      NS_GetFileFromURLSpec(NS_ConvertUTF16toUTF8(aFileNames[i]),
-                            getter_AddRefs(file));
-    }
-
-    if (!file) {
-      // this is no "file://", try as local file
-      nsCOMPtr<nsILocalFile> localFile;
-      NS_NewLocalFile(nsDependentString(aFileNames[i]),
-                      PR_FALSE, getter_AddRefs(localFile));
-      file = do_QueryInterface(localFile);
-    }
-
-    if (file) {
-      nsCOMPtr<nsIDOMFile> domFile = new nsDOMFile(file, GetOwnerDoc());
-      files.AppendObject(domFile);
-    } else {
-      continue; // Not much we can do if the file doesn't exist
-    }
-
+    fileNames.AppendElement(aFileNames[i]);
   }
 
-  SetFiles(files);
+  SetFileNames(fileNames);
 
   return NS_OK;
 }
@@ -1178,8 +1136,7 @@ nsHTMLInputElement::SetUserInput(const nsAString& aValue)
 
   if (mType == NS_FORM_INPUT_FILE)
   {
-    const PRUnichar* name = PromiseFlatString(aValue).get();
-    return MozSetFileNameArray(&name, 1);
+    SetSingleFileName(aValue);
   } else {
     SetValueInternal(aValue, PR_TRUE, PR_TRUE);
   }
@@ -1284,32 +1241,28 @@ nsHTMLInputElement::SetPlaceholderClass(PRBool aVisible, PRBool aNotify)
 }
 
 void
-nsHTMLInputElement::GetDisplayFileName(nsAString& aValue) const
+nsHTMLInputElement::GetDisplayFileName(nsAString& aValue)
 {
-  if (GetOwnerDoc()->IsStaticDocument()) {
-    aValue = mStaticDocFileList;
-    return;
-  }
-
   aValue.Truncate();
-  for (PRUint32 i = 0; i < (PRUint32)mFiles.Count(); ++i) {
-    nsString str;
-    mFiles[i]->GetMozFullPath(str);
+  for (PRUint32 i = 0; i < mFileNames.Length(); ++i) {
     if (i == 0) {
-      aValue.Append(str);
+      aValue.Append(mFileNames[i]);
     }
     else {
-      aValue.Append(NS_LITERAL_STRING(", ") + str);
+      aValue.Append(NS_LITERAL_STRING(", ") + mFileNames[i]);
     }
   }
 }
 
 void
-nsHTMLInputElement::SetFiles(const nsCOMArray<nsIDOMFile>& aFiles)
+nsHTMLInputElement::SetFileNames(const nsTArray<nsString>& aFileNames)
 {
-  mFiles.Clear();
-  mFiles.AppendObjects(aFiles);
-
+  mFileNames = aFileNames;
+#if DEBUG
+  for (PRUint32 i = 0; i < (PRUint32)aFileNames.Length(); ++i) {
+    NS_ASSERTION(!aFileNames[i].IsEmpty(), "Empty file name");
+  }
+#endif
   // No need to flush here, if there's no frame at this point we
   // don't need to force creation of one just to tell it about this
   // new value.  We just want the display to update as needed.
@@ -1326,10 +1279,37 @@ nsHTMLInputElement::SetFiles(const nsCOMArray<nsIDOMFile>& aFiles)
   UpdateAllValidityStates(PR_TRUE);
 }
 
-const nsCOMArray<nsIDOMFile>&
-nsHTMLInputElement::GetFiles()
+void
+nsHTMLInputElement::GetFileArray(nsCOMArray<nsIFile> &aFiles)
 {
-  return mFiles;
+  aFiles.Clear();
+
+  if (mType != NS_FORM_INPUT_FILE) {
+    return;
+  }
+
+  for (PRUint32 i = 0; i < mFileNames.Length(); ++i) {
+    nsCOMPtr<nsIFile> file;
+    if (StringBeginsWith(mFileNames[i], NS_LITERAL_STRING("file:"),
+                         nsCaseInsensitiveStringComparator())) {
+      // Converts the URL string into the corresponding nsIFile if possible.
+      // A local file will be created if the URL string begins with file://.
+      NS_GetFileFromURLSpec(NS_ConvertUTF16toUTF8(mFileNames[i]),
+                            getter_AddRefs(file));
+    }
+
+    if (!file) {
+      // this is no "file://", try as local file
+      nsCOMPtr<nsILocalFile> localFile;
+      NS_NewLocalFile(mFileNames[i], PR_FALSE, getter_AddRefs(localFile));
+      // Wish there was a better way to downcast an already_AddRefed
+      file = dont_AddRef(static_cast<nsIFile*>(localFile.forget().get()));
+    }
+
+    if (file) {
+      aFiles.AppendObject(file);
+    }
+  }
 }
 
 nsresult
@@ -1338,10 +1318,16 @@ nsHTMLInputElement::UpdateFileList()
   if (mFileList) {
     mFileList->Clear();
 
-    const nsCOMArray<nsIDOMFile>& files = GetFiles();
+    nsIDocument* doc = GetOwnerDoc();
+
+    nsCOMArray<nsIFile> files;
+    GetFileArray(files);
     for (PRUint32 i = 0; i < (PRUint32)files.Count(); ++i) {
-      if (!mFileList->Append(files[i])) {
-        return NS_ERROR_FAILURE;
+      nsRefPtr<nsDOMFile> domFile = new nsDOMFile(files[i], doc);
+      if (domFile) {
+        if (!mFileList->Append(domFile)) {
+          return NS_ERROR_FAILURE;
+        }
       }
     }
   }
@@ -1833,7 +1819,7 @@ nsHTMLInputElement::Click()
       nsEventStatus status = nsEventStatus_eIgnore;
 
       SET_BOOLBIT(mBitField, BF_HANDLING_CLICK, PR_TRUE);
-      if (mType == NS_FORM_INPUT_FILE){
+      if (mType == NS_FORM_INPUT_FILE){
         FireAsyncClickHandler();
       }
       nsEventDispatcher::Dispatch(static_cast<nsIContent*>(this), context,
@@ -2575,7 +2561,7 @@ nsHTMLInputElement::ParseAttribute(PRInt32 aNamespaceID,
           // This call isn't strictly needed any more since we'll never
           // confuse values and filenames. However it's there for backwards
           // compat.
-          ClearFiles();
+          ClearFileNames();
         }
 
         HandleTypeChange(newType);
@@ -2896,7 +2882,7 @@ nsHTMLInputElement::SetDefaultValueAsValue()
     case NS_FORM_INPUT_FILE:
     {
       // Resetting it to blank should not perform security check
-      ClearFiles();
+      ClearFileNames();
       break;
     }
     // Value is the same as defaultValue for hidden inputs
@@ -3021,7 +3007,8 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   if (mType == NS_FORM_INPUT_FILE) {
     // Submit files
 
-    const nsCOMArray<nsIDOMFile>& files = GetFiles();
+    nsCOMArray<nsIFile> files;
+    GetFileArray(files);
 
     for (PRUint32 i = 0; i < (PRUint32)files.Count(); ++i) {
       aFormSubmission->AddNameFilePair(name, files[i]);
@@ -3113,13 +3100,13 @@ nsHTMLInputElement::SaveState()
     }
     case NS_FORM_INPUT_FILE:
       {
-        if (mFiles.Count()) {
+        if (!mFileNames.IsEmpty()) {
           inputState = new nsHTMLInputElementState();
           if (!inputState) {
             return NS_ERROR_OUT_OF_MEMORY;
           }
 
-          inputState->SetFiles(mFiles);
+          inputState->SetFilenames(mFileNames);
         }
         break;
       }
@@ -3266,8 +3253,7 @@ nsHTMLInputElement::RestoreState(nsPresState* aState)
         }
       case NS_FORM_INPUT_FILE:
         {
-          const nsCOMArray<nsIDOMFile>& files = inputState->GetFiles();
-          SetFiles(files);
+          SetFileNames(inputState->GetFilenames());
           break;
         }
     }
@@ -3676,7 +3662,8 @@ nsHTMLInputElement::IsValueMissing()
       }
     case NS_FORM_INPUT_FILE:
       {
-        const nsCOMArray<nsIDOMFile>& files = GetFiles();
+        nsCOMArray<nsIFile> files;
+        GetFileArray(files);
         return !files.Count();
       }
     default:
diff --git a/content/html/content/src/nsHTMLInputElement.h b/content/html/content/src/nsHTMLInputElement.h
index 5864a7cfd183..4161a7b55243 100644
--- a/content/html/content/src/nsHTMLInputElement.h
+++ b/content/html/content/src/nsHTMLInputElement.h
@@ -1,83 +1,80 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Communicator client code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Pierre Phaneuf <pp@ludusdesign.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nsHTMLInputElement_h__
-#define nsHTMLInputElement_h__
-
-#include "nsGenericHTMLElement.h"
-#include "nsImageLoadingContent.h"
-#include "nsIDOMHTMLInputElement.h"
-#include "nsITextControlElement.h"
-#include "nsIPhonetic.h"
-#include "nsIDOMNSEditableElement.h"
-
-#include "nsTextEditorState.h"
-#include "nsCOMPtr.h"
-#include "nsIConstraintValidation.h"
-#include "nsDOMFile.h"
-
-//
-// Accessors for mBitField
-//
-#define BF_DISABLED_CHANGED 0
-#define BF_HANDLING_CLICK 1
-#define BF_VALUE_CHANGED 2
-#define BF_CHECKED_CHANGED 3
-#define BF_CHECKED 4
-#define BF_HANDLING_SELECT_EVENT 5
-#define BF_SHOULD_INIT_CHECKED 6
-#define BF_PARSER_CREATING 7
-#define BF_IN_INTERNAL_ACTIVATE 8
-#define BF_CHECKED_IS_TOGGLED 9
-#define BF_INDETERMINATE 10
-#define BF_INHIBIT_RESTORATION 11
-
-#define GET_BOOLBIT(bitfield, field) (((bitfield) & (0x01 << (field))) \
-                                        ? PR_TRUE : PR_FALSE)
-#define SET_BOOLBIT(bitfield, field, b) ((b) \
-                                        ? ((bitfield) |=  (0x01 << (field))) \
-                                        : ((bitfield) &= ~(0x01 << (field))))
-
-class nsDOMFileList;
-class nsIRadioGroupContainer;
-class nsIRadioGroupVisitor;
-class nsIRadioVisitor;
-
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Communicator client code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Pierre Phaneuf <pp@ludusdesign.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsHTMLInputElement_h__
+#define nsHTMLInputElement_h__
+
+#include "nsGenericHTMLElement.h"
+#include "nsImageLoadingContent.h"
+#include "nsIDOMHTMLInputElement.h"
+#include "nsITextControlElement.h"
+#include "nsIPhonetic.h"
+#include "nsIDOMNSEditableElement.h"
+#include "nsIFileControlElement.h"
+
+#include "nsTextEditorState.h"
+#include "nsCOMPtr.h"
+#include "nsIConstraintValidation.h"
+
+//
+// Accessors for mBitField
+//
+#define BF_DISABLED_CHANGED 0
+#define BF_HANDLING_CLICK 1
+#define BF_VALUE_CHANGED 2
+#define BF_CHECKED_CHANGED 3
+#define BF_CHECKED 4
+#define BF_HANDLING_SELECT_EVENT 5
+#define BF_SHOULD_INIT_CHECKED 6
+#define BF_PARSER_CREATING 7
+#define BF_IN_INTERNAL_ACTIVATE 8
+#define BF_CHECKED_IS_TOGGLED 9
+#define BF_INDETERMINATE 10
+#define BF_INHIBIT_RESTORATION 11
+
+#define GET_BOOLBIT(bitfield, field) (((bitfield) & (0x01 << (field))) \
+                                        ? PR_TRUE : PR_FALSE)
+#define SET_BOOLBIT(bitfield, field, b) ((b) \
+                                        ? ((bitfield) |=  (0x01 << (field))) \
+                                        : ((bitfield) &= ~(0x01 << (field))))
+
+class nsDOMFileList;
+
 class UploadLastDir : public nsIObserver, public nsSupportsWeakReference {
 public:
   NS_DECL_ISUPPORTS
@@ -106,460 +103,451 @@ private:
   // Directories are stored here during private browsing mode
   nsInterfaceHashtable<nsStringHashKey, nsILocalFile> mUploadLastDirStore;
   PRBool mInPrivateBrowsing;
-};
-
-class nsIRadioGroupContainer;
-class nsIRadioVisitor;
-
-class nsHTMLInputElement : public nsGenericHTMLFormElement,
-                           public nsImageLoadingContent,
-                           public nsIDOMHTMLInputElement,
-                           public nsITextControlElement,
-                           public nsIPhonetic,
-                           public nsIDOMNSEditableElement,
-                           public nsIConstraintValidation
-{
-public:
+};
+
+class nsIRadioGroupContainer;
+class nsIRadioVisitor;
+
+class nsHTMLInputElement : public nsGenericHTMLFormElement,
+                           public nsImageLoadingContent,
+                           public nsIDOMHTMLInputElement,
+                           public nsITextControlElement,
+                           public nsIPhonetic,
+                           public nsIDOMNSEditableElement,
+                           public nsIFileControlElement,
+                           public nsIConstraintValidation
+{
+public:
   using nsIConstraintValidation::GetValidationMessage;
 
-  nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
-                     PRUint32 aFromParser);
-  virtual ~nsHTMLInputElement();
-
-  // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
-
-  // nsIDOMNode
-  NS_FORWARD_NSIDOMNODE(nsGenericHTMLFormElement::)
-
-  // nsIDOMElement
-  NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLFormElement::)
-
-  // nsIDOMHTMLElement
-  NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLFormElement::)
-
-  // nsIDOMHTMLInputElement
-  NS_DECL_NSIDOMHTMLINPUTELEMENT
-
-  // nsIPhonetic
-  NS_DECL_NSIPHONETIC
-
-  // nsIDOMNSEditableElement
-  NS_IMETHOD GetEditor(nsIEditor** aEditor)
-  {
-    return nsGenericHTMLElement::GetEditor(aEditor);
-  }
-  NS_IMETHOD SetUserInput(const nsAString& aInput);
-
-  // Overriden nsIFormControl methods
-  NS_IMETHOD_(PRUint32) GetType() const { return mType; }
-  NS_IMETHOD Reset();
-  NS_IMETHOD SubmitNamesValues(nsFormSubmission* aFormSubmission);
-  NS_IMETHOD SaveState();
-  virtual PRBool RestoreState(nsPresState* aState);
-  virtual PRBool AllowDrop();
-
-  // nsIContent
-  virtual PRBool IsHTMLFocusable(PRBool aWithMouse, PRBool *aIsFocusable, PRInt32 *aTabIndex);
-
-  virtual PRBool ParseAttribute(PRInt32 aNamespaceID,
-                                nsIAtom* aAttribute,
-                                const nsAString& aValue,
-                                nsAttrValue& aResult);
-  virtual nsChangeHint GetAttributeChangeHint(const nsIAtom* aAttribute,
-                                              PRInt32 aModType) const;
-  NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
-  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
-
-  virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
-  virtual nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor);
-
-  virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
-                              nsIContent* aBindingParent,
-                              PRBool aCompileEventHandlers);
-  virtual void UnbindFromTree(PRBool aDeep = PR_TRUE,
-                              PRBool aNullParent = PR_TRUE);
-
-  virtual void DoneCreatingElement();
-
-  virtual PRInt32 IntrinsicState() const;
-
-  // nsITextControlElement
-  NS_IMETHOD SetValueChanged(PRBool aValueChanged);
-  NS_IMETHOD_(PRBool) IsSingleLineTextControl() const;
-  NS_IMETHOD_(PRBool) IsTextArea() const;
-  NS_IMETHOD_(PRBool) IsPlainTextControl() const;
-  NS_IMETHOD_(PRBool) IsPasswordTextControl() const;
-  NS_IMETHOD_(PRInt32) GetCols();
-  NS_IMETHOD_(PRInt32) GetWrapCols();
-  NS_IMETHOD_(PRInt32) GetRows();
-  NS_IMETHOD_(void) GetDefaultValueFromContent(nsAString& aValue);
-  NS_IMETHOD_(PRBool) ValueChanged() const;
-  NS_IMETHOD_(void) GetTextEditorValue(nsAString& aValue, PRBool aIgnoreWrap) const;
-  NS_IMETHOD_(void) SetTextEditorValue(const nsAString& aValue, PRBool aUserInput);
-  NS_IMETHOD_(nsIEditor*) GetTextEditor();
-  NS_IMETHOD_(nsISelectionController*) GetSelectionController();
-  NS_IMETHOD_(nsFrameSelection*) GetConstFrameSelection();
-  NS_IMETHOD BindToFrame(nsTextControlFrame* aFrame);
-  NS_IMETHOD_(void) UnbindFromFrame(nsTextControlFrame* aFrame);
-  NS_IMETHOD CreateEditor();
-  NS_IMETHOD_(nsIContent*) GetRootEditorNode();
-  NS_IMETHOD_(nsIContent*) GetPlaceholderNode();
-  NS_IMETHOD_(void) UpdatePlaceholderText(PRBool aNotify);
-  NS_IMETHOD_(void) SetPlaceholderClass(PRBool aVisible, PRBool aNotify);
-  NS_IMETHOD_(void) InitializeKeyboardEventListeners();
-  NS_IMETHOD_(void) OnValueChanged(PRBool aNotify);
-
-  // nsIFileControlElement
-  void GetDisplayFileName(nsAString& aFileName) const;
-  const nsCOMArray<nsIDOMFile>& GetFiles();
-  void SetFiles(const nsCOMArray<nsIDOMFile>& aFiles);
-
-  void SetCheckedChangedInternal(PRBool aCheckedChanged);
-  PRBool GetCheckedChanged();
-  void AddedToRadioGroup(PRBool aNotify = PR_TRUE);
-  void WillRemoveFromRadioGroup(PRBool aNotify);
-  /**
-   * Get the radio group container for this button (form or document)
-   * @return the radio group container (or null if no form or document)
-   */
-  virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer();
-
- /**
-   * Helper function returning the currently selected button in the radio group.
-   * Returning null if the element is not a button or if there is no selectied
-   * button in the group.
-   *
-   * @return the selected button (or null).
-   */
-  already_AddRefed<nsIDOMHTMLInputElement> GetSelectedRadioButton();
-
-  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
-
-  NS_IMETHOD FireAsyncClickHandler();
-
-  virtual void UpdateEditableState()
-  {
-    return UpdateEditableFormControlState();
-  }
-
-  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED_NO_UNLINK(nsHTMLInputElement,
-                                                     nsGenericHTMLFormElement)
-
-  static UploadLastDir* gUploadLastDir;
+  nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
+                     PRUint32 aFromParser);
+  virtual ~nsHTMLInputElement();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // nsIDOMNode
+  NS_FORWARD_NSIDOMNODE(nsGenericHTMLFormElement::)
+
+  // nsIDOMElement
+  NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLFormElement::)
+
+  // nsIDOMHTMLElement
+  NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLFormElement::)
+
+  // nsIDOMHTMLInputElement
+  NS_DECL_NSIDOMHTMLINPUTELEMENT
+
+  // nsIPhonetic
+  NS_DECL_NSIPHONETIC
+
+  // nsIDOMNSEditableElement
+  NS_IMETHOD GetEditor(nsIEditor** aEditor)
+  {
+    return nsGenericHTMLElement::GetEditor(aEditor);
+  }
+  NS_IMETHOD SetUserInput(const nsAString& aInput);
+
+  // Overriden nsIFormControl methods
+  NS_IMETHOD_(PRUint32) GetType() const { return mType; }
+  NS_IMETHOD Reset();
+  NS_IMETHOD SubmitNamesValues(nsFormSubmission* aFormSubmission);
+  NS_IMETHOD SaveState();
+  virtual PRBool RestoreState(nsPresState* aState);
+  virtual PRBool AllowDrop();
+
+  // nsIContent
+  virtual PRBool IsHTMLFocusable(PRBool aWithMouse, PRBool *aIsFocusable, PRInt32 *aTabIndex);
+
+  virtual PRBool ParseAttribute(PRInt32 aNamespaceID,
+                                nsIAtom* aAttribute,
+                                const nsAString& aValue,
+                                nsAttrValue& aResult);
+  virtual nsChangeHint GetAttributeChangeHint(const nsIAtom* aAttribute,
+                                              PRInt32 aModType) const;
+  NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
+  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
+
+  virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
+  virtual nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor);
+
+  virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
+                              nsIContent* aBindingParent,
+                              PRBool aCompileEventHandlers);
+  virtual void UnbindFromTree(PRBool aDeep = PR_TRUE,
+                              PRBool aNullParent = PR_TRUE);
+
+  virtual void DoneCreatingElement();
+
+  virtual PRInt32 IntrinsicState() const;
+
+  // nsITextControlElement
+  NS_IMETHOD SetValueChanged(PRBool aValueChanged);
+  NS_IMETHOD_(PRBool) IsSingleLineTextControl() const;
+  NS_IMETHOD_(PRBool) IsTextArea() const;
+  NS_IMETHOD_(PRBool) IsPlainTextControl() const;
+  NS_IMETHOD_(PRBool) IsPasswordTextControl() const;
+  NS_IMETHOD_(PRInt32) GetCols();
+  NS_IMETHOD_(PRInt32) GetWrapCols();
+  NS_IMETHOD_(PRInt32) GetRows();
+  NS_IMETHOD_(void) GetDefaultValueFromContent(nsAString& aValue);
+  NS_IMETHOD_(PRBool) ValueChanged() const;
+  NS_IMETHOD_(void) GetTextEditorValue(nsAString& aValue, PRBool aIgnoreWrap) const;
+  NS_IMETHOD_(void) SetTextEditorValue(const nsAString& aValue, PRBool aUserInput);
+  NS_IMETHOD_(nsIEditor*) GetTextEditor();
+  NS_IMETHOD_(nsISelectionController*) GetSelectionController();
+  NS_IMETHOD_(nsFrameSelection*) GetConstFrameSelection();
+  NS_IMETHOD BindToFrame(nsTextControlFrame* aFrame);
+  NS_IMETHOD_(void) UnbindFromFrame(nsTextControlFrame* aFrame);
+  NS_IMETHOD CreateEditor();
+  NS_IMETHOD_(nsIContent*) GetRootEditorNode();
+  NS_IMETHOD_(nsIContent*) GetPlaceholderNode();
+  NS_IMETHOD_(void) UpdatePlaceholderText(PRBool aNotify);
+  NS_IMETHOD_(void) SetPlaceholderClass(PRBool aVisible, PRBool aNotify);
+  NS_IMETHOD_(void) InitializeKeyboardEventListeners();
+  NS_IMETHOD_(void) OnValueChanged(PRBool aNotify);
+
+  // nsIFileControlElement
+  virtual void GetDisplayFileName(nsAString& aFileName);
+  virtual void GetFileArray(nsCOMArray<nsIFile> &aFile);
+  virtual void SetFileNames(const nsTArray<nsString>& aFileNames);
+
+  void SetCheckedChangedInternal(PRBool aCheckedChanged);
+  PRBool GetCheckedChanged();
+  void AddedToRadioGroup(PRBool aNotify = PR_TRUE);
+  void WillRemoveFromRadioGroup(PRBool aNotify);
+  /**
+   * Get the radio group container for this button (form or document)
+   * @return the radio group container (or null if no form or document)
+   */
+  virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer();
+
+ /**
+   * Helper function returning the currently selected button in the radio group.
+   * Returning null if the element is not a button or if there is no selectied
+   * button in the group.
+   *
+   * @return the selected button (or null).
+   */
+  already_AddRefed<nsIDOMHTMLInputElement> GetSelectedRadioButton();
+
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
+
+  NS_IMETHOD FireAsyncClickHandler();
+
+  virtual void UpdateEditableState()
+  {
+    return UpdateEditableFormControlState();
+  }
+
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED_NO_UNLINK(nsHTMLInputElement,
+                                                     nsGenericHTMLFormElement)
+
+  static UploadLastDir* gUploadLastDir;
   // create and destroy the static UploadLastDir object for remembering
   // which directory was last used on a site-by-site basis
   static void InitUploadLastDir();
-  static void DestroyUploadLastDir();
-
-  void MaybeLoadImage();
-
-  virtual nsXPCClassInfo* GetClassInfo();
-
-  static nsHTMLInputElement* FromContent(nsIContent *aContent)
-  {
-    if (aContent->NodeInfo()->Equals(nsGkAtoms::input, kNameSpaceID_XHTML))
-      return static_cast<nsHTMLInputElement*>(aContent);
-    return NULL;
-  }
-
-  // nsIConstraintValidation
-  PRBool   IsTooLong();
-  PRBool   IsValueMissing();
-  PRBool   HasTypeMismatch();
-  PRBool   HasPatternMismatch();
-  void     UpdateTooLongValidityState();
-  void     UpdateValueMissingValidityState();
-  void     UpdateTypeMismatchValidityState();
-  void     UpdatePatternMismatchValidityState();
-  void     UpdateAllValidityStates(PRBool aNotify);
-  PRBool   IsBarredFromConstraintValidation() const;
-  nsresult GetValidationMessage(nsAString& aValidationMessage,
-                                ValidityStateType aType);
-
-protected:
-  // Pull IsSingleLineTextControl into our scope, otherwise it'd be hidden
-  // by the nsITextControlElement version.
-  using nsGenericHTMLFormElement::IsSingleLineTextControl;
-
-  /**
-   * The ValueModeType specifies how the value IDL attribute should behave.
-   *
-   * See: http://dev.w3.org/html5/spec/forms.html#dom-input-value
-   */
-  enum ValueModeType
-  {
-    // On getting, returns the value.
-    // On setting, sets value.
-    VALUE_MODE_VALUE,
-    // On getting, returns the value if present or the empty string.
-    // On setting, sets the value.
-    VALUE_MODE_DEFAULT,
-    // On getting, returns the value if present or "on".
-    // On setting, sets the value.
-    VALUE_MODE_DEFAULT_ON,
-    // On getting, returns "C:\fakepath\" followed by the file name of the
-    // first file of the selected files if any.
-    // On setting the empty string, empties the selected files list, otherwise
-    // throw the INVALID_STATE_ERR exception.
-    VALUE_MODE_FILENAME
-  };
-
-  /**
-   * This helper method returns true if aValue is a valid email address.
-   * This is following the HTML5 specification:
-   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address
-   *
-   * @param aValue  the email address to check.
-   * @result        whether the given string is a valid email address.
-   */
-  static PRBool IsValidEmailAddress(const nsAString& aValue);
-
-  /**
-   * This helper method returns true if aValue is a valid email address list.
-   * Email address list is a list of email address separated by comas (,) which
-   * can be surrounded by space charecters.
-   * This is following the HTML5 specification:
-   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address-list
-   *
-   * @param aValue  the email address list to check.
-   * @result        whether the given string is a valid email address list.
-   */
-  static PRBool IsValidEmailAddressList(const nsAString& aValue);
-
-  /**
-   * This helper method returns true if the aPattern pattern matches aValue.
-   * aPattern should not contain leading and trailing slashes (/).
-   * The pattern has to match the entire value not just a subset.
-   * aDocument must be a valid pointer (not null).
-   *
-   * This is following the HTML5 specification:
-   * http://dev.w3.org/html5/spec/forms.html#attr-input-pattern
-   *
-   * @param aValue    the string to check.
-   * @param aPattern  the string defining the pattern.
-   * @param aDocument the owner document of the element.
-   * @result          whether the given string is matches the pattern.
-   */
-  static PRBool IsPatternMatching(nsAString& aValue, nsAString& aPattern,
-                                  nsIDocument* aDocument);
-
-  // Helper method
-  nsresult SetValueInternal(const nsAString& aValue,
-                            PRBool aUserInput,
-                            PRBool aSetValueChanged);
-
-  void ClearFiles() {
-    nsCOMArray<nsIDOMFile> files;
-    SetFiles(files);
-  }
-
-  void SetSingleFile(nsIDOMFile* aFile) {
-    nsCOMArray<nsIDOMFile> files;
-    nsCOMPtr<nsIDOMFile> file = aFile;
-    files.AppendObject(file);
-    SetFiles(files);
-  }
-
-  nsresult SetIndeterminateInternal(PRBool aValue,
-                                    PRBool aShouldInvalidate);
-
-  nsresult GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelectionEnd);
-
-  /**
-   * Get the name if it exists and return whether it did exist
-   * @param aName the name returned [OUT]
-   * @param true if the name is empty, false otherwise
-   */
-  PRBool GetNameIfExists(nsAString& aName) {
-    GetAttr(kNameSpaceID_None, nsGkAtoms::name, aName);
-    return !aName.IsEmpty();
-  }
-
-  /**
-   * Called when an attribute is about to be changed
-   */
-  virtual nsresult BeforeSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                                 const nsAString* aValue, PRBool aNotify);
-  /**
-   * Called when an attribute has just been changed
-   */
-  virtual nsresult AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                                const nsAString* aValue, PRBool aNotify);
-
-  /**
-   * Dispatch a select event. Returns true if the event was not cancelled.
-   */
-  PRBool DispatchSelectEvent(nsPresContext* aPresContext);
-
-  void SelectAll(nsPresContext* aPresContext);
-  PRBool IsImage() const
-  {
-    return AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
-                       nsGkAtoms::image, eIgnoreCase);
-  }
-
-  virtual PRBool AcceptAutofocus() const
-  {
-    return PR_TRUE;
-  }
-
-  /**
-   * Fire the onChange event
-   */
-  void FireOnChange();
-
-  /**
-   * Visit a the group of radio buttons this radio belongs to
-   * @param aVisitor the visitor to visit with
-   */
-  nsresult VisitGroup(nsIRadioVisitor* aVisitor, PRBool aFlushContent);
-
-  /**
-   * Do all the work that |SetChecked| does (radio button handling, etc.), but
-   * take an |aNotify| parameter.
-   */
-  nsresult DoSetChecked(PRBool aValue, PRBool aNotify, PRBool aSetValueChanged);
-
-  /**
-   * Do all the work that |SetCheckedChanged| does (radio button handling,
-   * etc.), but take an |aNotify| parameter that lets it avoid flushing content
-   * when it can.
-   */
-  void DoSetCheckedChanged(PRBool aCheckedChanged, PRBool aNotify);
-
-  /**
-   * Actually set checked and notify the frame of the change.
-   * @param aValue the value of checked to set
-   */
-  void SetCheckedInternal(PRBool aValue, PRBool aNotify);
-
-  /**
-   * Syntax sugar to make it easier to check for checked
-   */
-  PRBool GetChecked() const
-  {
-    return GET_BOOLBIT(mBitField, BF_CHECKED);
-  }
-
-  nsresult RadioSetChecked(PRBool aNotify);
-  void SetCheckedChanged(PRBool aCheckedChanged);
-
-  /**
-   * MaybeSubmitForm looks for a submit input or a single text control
-   * and submits the form if either is present.
-   */
-  nsresult MaybeSubmitForm(nsPresContext* aPresContext);
-
-  /**
-   * Update mFileList with the currently selected file.
-   */
-  nsresult UpdateFileList();
-
-  /**
-   * Determine whether the editor needs to be initialized explicitly for
-   * a particular event.
-   */
-  PRBool NeedToInitializeEditorForEvent(nsEventChainPreVisitor& aVisitor) const;
-
-  /**
-   * Get the value mode of the element, depending of the type.
-   */
-  ValueModeType GetValueMode() const;
-
-  /**
-   * Get the mutable state of the element.
-   * When the element isn't mutable (immutable), the value or checkedness
-   * should not be changed by the user.
-   *
-   * See: http://dev.w3.org/html5/spec/forms.html#concept-input-mutable
-   */
-  PRBool IsMutable() const;
-
-  /**
-   * Returns if the readonly attribute applies for the current type.
-   */
-  PRBool DoesReadOnlyApply() const;
-
-  /**
-   * Returns if the required attribute applies for the current type.
-   */
-  PRBool DoesRequiredApply() const;
-
-  /**
-   * Returns if the pattern attribute applies for the current type.
-   */
-  PRBool DoesPatternApply() const;
-
-  void FreeData();
-  nsTextEditorState *GetEditorState() const;
-
-  /**
-   * Manages the internal data storage across type changes.
-   */
-  void HandleTypeChange(PRUint8 aNewType);
-
-  /**
-   * Sanitize the value of the element depending of its current type.
-   * See: http://www.whatwg.org/specs/web-apps/current-work/#value-sanitization-algorithm
-   */
-  void SanitizeValue(nsAString& aValue);
-
-  /**
-   * Returns whether the placeholder attribute applies for the current type.
-   */
-  bool PlaceholderApplies() const { return IsSingleLineTextControlInternal(PR_FALSE, mType); }
-
-  /**
-   * Set the current default value to the value of the input element.
-   */
-  nsresult SetDefaultValueAsValue();
-
-  nsCOMPtr<nsIControllers> mControllers;
-
-  /**
-   * The type of this input (<input type=...>) as an integer.
-   * @see nsIFormControl.h (specifically NS_FORM_INPUT_*)
-   */
-  PRUint8                  mType;
-  /**
-   * A bitfield containing our booleans
-   * @see GET_BOOLBIT / SET_BOOLBIT macros and BF_* field identifiers
-   */
-  PRInt16                  mBitField;
-  /*
-   * In mInputData, the mState field is used if IsSingleLineTextControl returns
-   * true and mValue is used otherwise.  We have to be careful when handling it
-   * on a type change.
-   *
-   * Accessing the mState member should be done using the GetEditorState function,
-   * which returns null if the state is not present.
-   */
-  union InputData {
-    /**
-     * The current value of the input if it has been changed from the default
-     */
-    char*                    mValue;
-    /**
-     * The state of the text editor associated with the text/password input
-     */
-    nsTextEditorState*       mState;
-  } mInputData;
-  /**
-   * The value of the input if it is a file input. This is the list of filenames
-   * used when uploading a file. It is vital that this is kept separate from
-   * mValue so that it won't be possible to 'leak' the value from a text-input
-   * to a file-input. Additionally, the logic for this value is kept as simple
-   * as possible to avoid accidental errors where the wrong filename is used.
-   * Therefor the list of filenames is always owned by this member, never by
-   * the frame. Whenever the frame wants to change the filename it has to call
-   * SetFileNames to update this member.
-   */
-  nsCOMArray<nsIDOMFile>   mFiles;
-
-  nsRefPtr<nsDOMFileList>  mFileList;
-
-  nsString mStaticDocFileList;
-};
-
-#endif
+  static void DestroyUploadLastDir();
+
+  void MaybeLoadImage();
+
+  virtual nsXPCClassInfo* GetClassInfo();
+
+  // nsIConstraintValidation
+  PRBool   IsTooLong();
+  PRBool   IsValueMissing();
+  PRBool   HasTypeMismatch();
+  PRBool   HasPatternMismatch();
+  void     UpdateTooLongValidityState();
+  void     UpdateValueMissingValidityState();
+  void     UpdateTypeMismatchValidityState();
+  void     UpdatePatternMismatchValidityState();
+  void     UpdateAllValidityStates(PRBool aNotify);
+  PRBool   IsBarredFromConstraintValidation() const;
+  nsresult GetValidationMessage(nsAString& aValidationMessage,
+                                ValidityStateType aType);
+
+protected:
+  // Pull IsSingleLineTextControl into our scope, otherwise it'd be hidden
+  // by the nsITextControlElement version.
+  using nsGenericHTMLFormElement::IsSingleLineTextControl;
+
+  /**
+   * The ValueModeType specifies how the value IDL attribute should behave.
+   *
+   * See: http://dev.w3.org/html5/spec/forms.html#dom-input-value
+   */
+  enum ValueModeType
+  {
+    // On getting, returns the value.
+    // On setting, sets value.
+    VALUE_MODE_VALUE,
+    // On getting, returns the value if present or the empty string.
+    // On setting, sets the value.
+    VALUE_MODE_DEFAULT,
+    // On getting, returns the value if present or "on".
+    // On setting, sets the value.
+    VALUE_MODE_DEFAULT_ON,
+    // On getting, returns "C:\fakepath\" followed by the file name of the
+    // first file of the selected files if any.
+    // On setting the empty string, empties the selected files list, otherwise
+    // throw the INVALID_STATE_ERR exception.
+    VALUE_MODE_FILENAME
+  };
+
+  /**
+   * This helper method returns true if aValue is a valid email address.
+   * This is following the HTML5 specification:
+   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address
+   *
+   * @param aValue  the email address to check.
+   * @result        whether the given string is a valid email address.
+   */
+  static PRBool IsValidEmailAddress(const nsAString& aValue);
+
+  /**
+   * This helper method returns true if aValue is a valid email address list.
+   * Email address list is a list of email address separated by comas (,) which
+   * can be surrounded by space charecters.
+   * This is following the HTML5 specification:
+   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address-list
+   *
+   * @param aValue  the email address list to check.
+   * @result        whether the given string is a valid email address list.
+   */
+  static PRBool IsValidEmailAddressList(const nsAString& aValue);
+
+  /**
+   * This helper method returns true if the aPattern pattern matches aValue.
+   * aPattern should not contain leading and trailing slashes (/).
+   * The pattern has to match the entire value not just a subset.
+   * aDocument must be a valid pointer (not null).
+   *
+   * This is following the HTML5 specification:
+   * http://dev.w3.org/html5/spec/forms.html#attr-input-pattern
+   *
+   * @param aValue    the string to check.
+   * @param aPattern  the string defining the pattern.
+   * @param aDocument the owner document of the element.
+   * @result          whether the given string is matches the pattern.
+   */
+  static PRBool IsPatternMatching(nsAString& aValue, nsAString& aPattern,
+                                  nsIDocument* aDocument);
+
+  // Helper method
+  nsresult SetValueInternal(const nsAString& aValue,
+                            PRBool aUserInput,
+                            PRBool aSetValueChanged);
+
+  void ClearFileNames() {
+    nsTArray<nsString> fileNames;
+    SetFileNames(fileNames);
+  }
+
+  void SetSingleFileName(const nsAString& aFileName) {
+    nsAutoTArray<nsString, 1> fileNames;
+    fileNames.AppendElement(aFileName);
+    SetFileNames(fileNames);
+  }
+
+  nsresult SetIndeterminateInternal(PRBool aValue,
+                                    PRBool aShouldInvalidate);
+
+  nsresult GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelectionEnd);
+
+  /**
+   * Get the name if it exists and return whether it did exist
+   * @param aName the name returned [OUT]
+   * @param true if the name is empty, false otherwise
+   */
+  PRBool GetNameIfExists(nsAString& aName) {
+    GetAttr(kNameSpaceID_None, nsGkAtoms::name, aName);
+    return !aName.IsEmpty();
+  }
+
+  /**
+   * Called when an attribute is about to be changed
+   */
+  virtual nsresult BeforeSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
+                                 const nsAString* aValue, PRBool aNotify);
+  /**
+   * Called when an attribute has just been changed
+   */
+  virtual nsresult AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
+                                const nsAString* aValue, PRBool aNotify);
+
+  /**
+   * Dispatch a select event. Returns true if the event was not cancelled.
+   */
+  PRBool DispatchSelectEvent(nsPresContext* aPresContext);
+
+  void SelectAll(nsPresContext* aPresContext);
+  PRBool IsImage() const
+  {
+    return AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                       nsGkAtoms::image, eIgnoreCase);
+  }
+
+  virtual PRBool AcceptAutofocus() const
+  {
+    return PR_TRUE;
+  }
+
+  /**
+   * Fire the onChange event
+   */
+  void FireOnChange();
+
+  /**
+   * Visit a the group of radio buttons this radio belongs to
+   * @param aVisitor the visitor to visit with
+   */
+  nsresult VisitGroup(nsIRadioVisitor* aVisitor, PRBool aFlushContent);
+
+  /**
+   * Do all the work that |SetChecked| does (radio button handling, etc.), but
+   * take an |aNotify| parameter.
+   */
+  nsresult DoSetChecked(PRBool aValue, PRBool aNotify, PRBool aSetValueChanged);
+
+  /**
+   * Do all the work that |SetCheckedChanged| does (radio button handling,
+   * etc.), but take an |aNotify| parameter that lets it avoid flushing content
+   * when it can.
+   */
+  void DoSetCheckedChanged(PRBool aCheckedChanged, PRBool aNotify);
+
+  /**
+   * Actually set checked and notify the frame of the change.
+   * @param aValue the value of checked to set
+   */
+  void SetCheckedInternal(PRBool aValue, PRBool aNotify);
+
+  /**
+   * Syntax sugar to make it easier to check for checked
+   */
+  PRBool GetChecked() const
+  {
+    return GET_BOOLBIT(mBitField, BF_CHECKED);
+  }
+
+  nsresult RadioSetChecked(PRBool aNotify);
+  void SetCheckedChanged(PRBool aCheckedChanged);
+
+  /**
+   * MaybeSubmitForm looks for a submit input or a single text control
+   * and submits the form if either is present.
+   */
+  nsresult MaybeSubmitForm(nsPresContext* aPresContext);
+
+  /**
+   * Update mFileList with the currently selected file.
+   */
+  nsresult UpdateFileList();
+
+  /**
+   * Determine whether the editor needs to be initialized explicitly for
+   * a particular event.
+   */
+  PRBool NeedToInitializeEditorForEvent(nsEventChainPreVisitor& aVisitor) const;
+
+  /**
+   * Get the value mode of the element, depending of the type.
+   */
+  ValueModeType GetValueMode() const;
+
+  /**
+   * Get the mutable state of the element.
+   * When the element isn't mutable (immutable), the value or checkedness
+   * should not be changed by the user.
+   *
+   * See: http://dev.w3.org/html5/spec/forms.html#concept-input-mutable
+   */
+  PRBool IsMutable() const;
+
+  /**
+   * Returns if the readonly attribute applies for the current type.
+   */
+  PRBool DoesReadOnlyApply() const;
+
+  /**
+   * Returns if the required attribute applies for the current type.
+   */
+  PRBool DoesRequiredApply() const;
+
+  /**
+   * Returns if the pattern attribute applies for the current type.
+   */
+  PRBool DoesPatternApply() const;
+
+  void FreeData();
+  nsTextEditorState *GetEditorState() const;
+
+  /**
+   * Manages the internal data storage across type changes.
+   */
+  void HandleTypeChange(PRUint8 aNewType);
+
+  /**
+   * Sanitize the value of the element depending of its current type.
+   * See: http://www.whatwg.org/specs/web-apps/current-work/#value-sanitization-algorithm
+   */
+  void SanitizeValue(nsAString& aValue);
+
+  /**
+   * Returns whether the placeholder attribute applies for the current type.
+   */
+  bool PlaceholderApplies() const { return IsSingleLineTextControlInternal(PR_FALSE, mType); }
+
+  /**
+   * Set the current default value to the value of the input element.
+   */
+  nsresult SetDefaultValueAsValue();
+
+  nsCOMPtr<nsIControllers> mControllers;
+
+  /**
+   * The type of this input (<input type=...>) as an integer.
+   * @see nsIFormControl.h (specifically NS_FORM_INPUT_*)
+   */
+  PRUint8                  mType;
+  /**
+   * A bitfield containing our booleans
+   * @see GET_BOOLBIT / SET_BOOLBIT macros and BF_* field identifiers
+   */
+  PRInt16                  mBitField;
+  /*
+   * In mInputData, the mState field is used if IsSingleLineTextControl returns
+   * true and mValue is used otherwise.  We have to be careful when handling it
+   * on a type change.
+   *
+   * Accessing the mState member should be done using the GetEditorState function,
+   * which returns null if the state is not present.
+   */
+  union InputData {
+    /**
+     * The current value of the input if it has been changed from the default
+     */
+    char*                    mValue;
+    /**
+     * The state of the text editor associated with the text/password input
+     */
+    nsTextEditorState*       mState;
+  } mInputData;
+  /**
+   * The value of the input if it is a file input. This is the list of filenames
+   * used when uploading a file. It is vital that this is kept separate from
+   * mValue so that it won't be possible to 'leak' the value from a text-input
+   * to a file-input. Additionally, the logic for this value is kept as simple
+   * as possible to avoid accidental errors where the wrong filename is used.
+   * Therefor the list of filenames is always owned by this member, never by
+   * the frame. Whenever the frame wants to change the filename it has to call
+   * SetFileNames to update this member.
+   */
+  nsTArray<nsString>       mFileNames;
+
+  nsRefPtr<nsDOMFileList>  mFileList;
+};
+
+#endif
diff --git a/docshell/test/chrome/bug294258_window.xul b/docshell/test/chrome/bug294258_window.xul
index f1f2cb343b8e..8ceab4d0be57 100644
--- a/docshell/test/chrome/bug294258_window.xul
+++ b/docshell/test/chrome/bug294258_window.xul
@@ -43,13 +43,7 @@
       // Change the data for each of the form fields, and reload.
       $("text").value = "text value";
       $("checkbox").checked = true;
-      var file = Components.classes["@mozilla.org/file/directory_service;1"]
-             .getService(Components.interfaces.nsIProperties)
-             .get("TmpD", Components.interfaces.nsILocalFile);
-      file.append("294258_test.file");
-      file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
-      filePath = file.path;
-      $("file").value = filePath;
+      $("file").value = "file value";
       $("textarea").value = "textarea value";
       $("radio1").checked = true;
       $("select").selectedIndex = 2;
@@ -62,7 +56,7 @@
       // Verify that none of the form data has changed.
       is($("text").value, "text value", "Text value changed");
       is($("checkbox").checked, true, "Checkbox value changed");
-      is($("file").value, filePath, "File value changed");
+      is($("file").value, "file value", "File value changed");
       is($("textarea").value, "textarea value", "Textarea value changed");
       is($("radio1").checked, true, "Radio value changed");
       is($("select").selectedIndex, 2, "Select value changed");
diff --git a/layout/base/tests/chrome/printpreview_helper.xul b/layout/base/tests/chrome/printpreview_helper.xul
index fe5332ea727c..41c5df677915 100644
--- a/layout/base/tests/chrome/printpreview_helper.xul
+++ b/layout/base/tests/chrome/printpreview_helper.xul
@@ -18,11 +18,6 @@ var ctx1;
 var ctx2;
 var counter = 0;
 
-var file = Components.classes["@mozilla.org/file/directory_service;1"]
-             .getService(Components.interfaces.nsIProperties)
-             .get("TmpD", Components.interfaces.nsILocalFile);
-filePath = file.path;
-
 function printpreview() {
   gWbp = window.frames[1].QueryInterface(Components.interfaces.nsIInterfaceRequestor)
              .getInterface(Components.interfaces.nsIWebBrowserPrint);
@@ -160,7 +155,7 @@ var emptyFormElements =
 var formElements =
   ["<input type='text' value='text'>",
    "<input type='password' value='password'>",
-   "<input type='file' value='" + filePath + "'>",
+   "<input type='file' value='file'>",
    "<input type='button' value='button'>",
    "<input type='submit' value='submit button'>",
    "<input type='reset' value='reset button'>",
diff --git a/layout/forms/nsFileControlFrame.cpp b/layout/forms/nsFileControlFrame.cpp
index 2e08cf8f9041..290d63807bc2 100644
--- a/layout/forms/nsFileControlFrame.cpp
+++ b/layout/forms/nsFileControlFrame.cpp
@@ -65,7 +65,7 @@
 #include "nsINodeInfo.h"
 #include "nsIDOMEventTarget.h"
 #include "nsILocalFile.h"
-#include "nsHTMLInputElement.h"
+#include "nsIFileControlElement.h"
 #include "nsNodeInfoManager.h"
 #include "nsContentCreatorFunctions.h"
 #include "nsContentUtils.h"
@@ -90,7 +90,6 @@
 #include "nsHTMLInputElement.h"
 #include "nsICapturePicker.h"
 #include "nsIFileURL.h"
-#include "nsDOMFile.h"
 
 #define SYNC_TEXT 0x1
 #define SYNC_BUTTON 0x2
@@ -236,21 +235,20 @@ nsFileControlFrame::CreateAnonymousContent(nsTArray<nsIContent*>& aElements)
   mTextContent->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
                         NS_LITERAL_STRING("text"), PR_FALSE);
 
-  nsHTMLInputElement* inputElement =
-    nsHTMLInputElement::FromContent(mContent);
-  NS_ASSERTION(inputElement, "Why is our content not a <input>?");
-
-  // Initialize value when we create the content in case the value was set
-  // before we got here
-  nsAutoString value;
-  inputElement->GetDisplayFileName(value);
-
   nsCOMPtr<nsIDOMHTMLInputElement> textControl = do_QueryInterface(mTextContent);
-  NS_ASSERTION(textControl, "Why is the <input> we created not a <input>?");
-  textControl->SetValue(value);
+  if (textControl) {
+    nsCOMPtr<nsIFileControlElement> fileControl = do_QueryInterface(mContent);
+    if (fileControl) {
+      // Initialize value when we create the content in case the value was set
+      // before we got here
+      nsAutoString value;
+      fileControl->GetDisplayFileName(value);
+      textControl->SetValue(value);
+    }
 
-  textControl->SetTabIndex(-1);
-  textControl->SetReadOnly(PR_TRUE);
+    textControl->SetTabIndex(-1);
+    textControl->SetReadOnly(PR_TRUE);
+  }
 
   if (!aElements.AppendElement(mTextContent))
     return NS_ERROR_OUT_OF_MEMORY;
@@ -400,11 +398,9 @@ nsFileControlFrame::CaptureMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
 
   // Get parent nsIDOMWindowInternal object.
   nsIContent* content = mFrame->GetContent();
-  if (!content)
-    return NS_ERROR_FAILURE;
-
-  nsHTMLInputElement* inputElement = nsHTMLInputElement::FromContent(content);
-  if (!inputElement)
+  nsCOMPtr<nsIDOMHTMLInputElement> inputElem = do_QueryInterface(content);
+  nsCOMPtr<nsIFileControlElement> fileControl = do_QueryInterface(content);
+  if (!content || !inputElem || !fileControl)
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIDocument> doc = content->GetDocument();
@@ -447,13 +443,21 @@ nsFileControlFrame::CaptureMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
     return NS_OK;
   }
 
-  nsCOMPtr<nsIDOMFile> domFile;
-  rv = capturePicker->GetFile(getter_AddRefs(domFile));
+  nsCOMPtr<nsIURI> uri;
+  rv = capturePicker->GetUri(getter_AddRefs(uri));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMArray<nsIDOMFile> newFiles;
-  if (domFile) {
-    newFiles.AppendObject(domFile);
+  nsTArray<nsString> newFileNames;
+  if (uri) {
+    nsCOMPtr<nsIFileURL> fileURL = do_QueryInterface(uri);
+    if (!fileURL)
+      return NS_ERROR_UNEXPECTED;
+
+    nsCAutoString spec;
+    rv = uri->GetSpec(spec);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    newFileNames.AppendElement(NS_ConvertUTF8toUTF16(spec));
   } else {
     return NS_ERROR_FAILURE;
   }
@@ -461,13 +465,13 @@ nsFileControlFrame::CaptureMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
   // XXXkhuey we really should have a better UI story than the tired old
   // uneditable text box with the file name inside.
   // Set new selected files
-  if (newFiles.Count()) {
+  if (!newFileNames.IsEmpty()) {
     // Tell mTextFrame that this update of the value is a user initiated
     // change. Otherwise it'll think that the value is being set by a script
     // and not fire onchange when it should.
     PRBool oldState = mFrame->mTextFrame->GetFireChangeEventState();
     mFrame->mTextFrame->SetFireChangeEventState(PR_TRUE);
-    inputElement->SetFiles(newFiles);
+    fileControl->SetFileNames(newFileNames);
 
     mFrame->mTextFrame->SetFireChangeEventState(oldState);
     // May need to fire an onchange here
@@ -487,9 +491,12 @@ nsFileControlFrame::BrowseMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
   if (!ShouldProcessMouseClick(aMouseEvent))
     return NS_OK;
   
-  nsHTMLInputElement* input =
-    nsHTMLInputElement::FromContent(mFrame->GetContent());
-  return input ? input->FireAsyncClickHandler() : NS_OK;
+  nsIContent* content = mFrame->GetContent();
+  if (content->IsHTML() && content->Tag() == nsGkAtoms::input) {
+    nsHTMLInputElement* input = static_cast<nsHTMLInputElement*>(content);
+    return input->FireAsyncClickHandler();
+  }
+  return NS_OK;
 }
 
 nscoord
@@ -636,11 +643,10 @@ nsFileControlFrame::GetFormProperty(nsIAtom* aName, nsAString& aValue) const
   aValue.Truncate();  // initialize out param
 
   if (nsGkAtoms::value == aName) {
-    nsHTMLInputElement* inputElement =
-      nsHTMLInputElement::FromContent(mContent);
-
-    if (inputElement) {
-      inputElement->GetDisplayFileName(aValue);
+    nsCOMPtr<nsIFileControlElement> fileControl =
+      do_QueryInterface(mContent);
+    if (fileControl) {
+      fileControl->GetDisplayFileName(aValue);
     }
   }
   return NS_OK;
diff --git a/layout/forms/nsICapturePicker.idl b/layout/forms/nsICapturePicker.idl
index 3d552cd88860..148e22258a35 100644
--- a/layout/forms/nsICapturePicker.idl
+++ b/layout/forms/nsICapturePicker.idl
@@ -39,7 +39,7 @@
 #include "nsISupports.idl"
 
 interface nsIDOMWindow;
-interface nsIDOMFile;
+interface nsIURI;
 
 [scriptable, uuid(a4e2b2de-5712-4f80-aabb-7de3a747f227)]
 interface nsICapturePicker : nsISupports
@@ -88,7 +88,7 @@ interface nsICapturePicker : nsISupports
    * Get the captured image/video/audio.  This may be a data URI, file URI,
    * or a moz-filedata reference URI.
    */
-  readonly attribute nsIDOMFile file;
+  readonly attribute nsIURI uri;
 
   // The MIME type of the captured content.  Cannot be set after calling show()
   attribute AString type;

From f7a7d600cc3c0269cf72da4a50361f860f416677 Mon Sep 17 00:00:00 2001
From: Bas Schouten <bschouten@mozilla.com>
Date: Sun, 5 Sep 2010 18:59:57 +0200
Subject: [PATCH 165/222] Bug 590695: Don't check mDeviceEx when it doesn't
 exist. r=vlad a=blocking-beta6

---
 gfx/layers/d3d9/DeviceManagerD3D9.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gfx/layers/d3d9/DeviceManagerD3D9.cpp b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
index f2618106e7b9..cc09119c0edd 100644
--- a/gfx/layers/d3d9/DeviceManagerD3D9.cpp
+++ b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
@@ -284,7 +284,7 @@ DeviceManagerD3D9::Init()
     }
 
     D3DCAPS9 caps;
-    if (mDeviceEx->GetDeviceCaps(&caps)) {
+    if (mDeviceEx && mDeviceEx->GetDeviceCaps(&caps)) {
       if (LACKS_CAP(caps.Caps2, D3DCAPS2_DYNAMICTEXTURES)) {
         // XXX - Should we actually hit this we'll need a CanvasLayer that
         // supports static D3DPOOL_DEFAULT textures.

From 176e3c88241e7f56f6683e14815f04dac983eebf Mon Sep 17 00:00:00 2001
From: Vladimir Vukicevic <vladimir@pobox.com>
Date: Sun, 5 Sep 2010 13:37:43 -0400
Subject: [PATCH 166/222] b=593529; gfxinfo blacklisting ANY_DEVICE not
 working; r=jrmuizel, a=b

---
 widget/src/windows/GfxInfo.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/widget/src/windows/GfxInfo.cpp b/widget/src/windows/GfxInfo.cpp
index c4c3495651fa..965a948451f8 100644
--- a/widget/src/windows/GfxInfo.cpp
+++ b/widget/src/windows/GfxInfo.cpp
@@ -395,10 +395,10 @@ struct GfxDriverInfo {
 
 /* NVIDIA vendor and device IDs */
 
-#define V(a,b,c,d)   ((PRUint64(a)<<48) | (PRUint64(b)<<32) | (PRUint64(c)<<16) | PRUint64(d))
-
 /* AMD vendor and device IDs */
 
+#define V(a,b,c,d)   ((PRUint64(a)<<48) | (PRUint64(b)<<32) | (PRUint64(c)<<16) | PRUint64(d))
+
 static GfxDriverInfo driverInfo[] = {
   /*
    * Intel entries
@@ -469,7 +469,7 @@ GfxInfo::GetFeatureStatus(PRInt32 aFeature, PRInt32 *aStatus)
     bool match = false;
 
     if (info->vendor != adapterVendor ||
-        info->device != adapterDeviceID)
+        (info->device != ANY_DEVICE && info->device != adapterDeviceID))
     {
       info++;
       continue;

From 55beafe241d73c78186f2431562d450669686fc8 Mon Sep 17 00:00:00 2001
From: Kyle Huey <khuey@kylehuey.com>
Date: Sun, 5 Sep 2010 14:00:05 -0400
Subject: [PATCH 167/222] Bug 583863: Refactor <input> implementation to deal
 with files that aren't on the disk. r=sicking a=blocking-fennec

--HG--
extra : rebase_source : 2b3605042aea4e4c8273cdad5ec7f05af15959cc
---
 .../test/browser/browser_248970_b.js          |    7 +-
 .../test/browser/browser_346337.js            |   17 +-
 .../test/browser/browser_466937.js            |    8 +-
 content/base/public/Makefile.in               |    1 -
 content/base/public/nsDOMFile.h               |   47 +-
 content/base/public/nsIDOMFile.idl            |   11 +-
 content/base/public/nsIDOMFileInternal.idl    |   46 -
 content/base/src/nsDOMFile.cpp                |  192 ++-
 content/base/src/nsDOMFileReader.cpp          |   45 +-
 content/base/src/nsDOMFileReader.h            |    6 +-
 .../base/src/nsFileDataProtocolHandler.cpp    |   17 +-
 content/base/src/nsFileDataProtocolHandler.h  |    5 +-
 content/base/src/nsFormData.cpp               |   13 +-
 content/base/src/nsFormData.h                 |    8 +-
 content/base/src/nsXMLHttpRequest.cpp         |   24 -
 content/base/test/test_bug345339.html         |   15 +-
 content/html/content/public/Makefile.in       |    1 -
 .../html/content/public/nsFormSubmission.h    |    5 +-
 .../content/public/nsIFileControlElement.h    |   86 --
 content/html/content/src/nsFormSubmission.cpp |   41 +-
 .../html/content/src/nsGenericHTMLElement.h   |   12 +
 .../html/content/src/nsHTMLInputElement.cpp   |  241 ++--
 content/html/content/src/nsHTMLInputElement.h | 1052 +++++++++--------
 docshell/test/chrome/bug294258_window.xul     |   10 +-
 .../base/tests/chrome/printpreview_helper.xul |    7 +-
 layout/forms/nsFileControlFrame.cpp           |   78 +-
 layout/forms/nsICapturePicker.idl             |    4 +-
 27 files changed, 1023 insertions(+), 976 deletions(-)
 delete mode 100644 content/base/public/nsIDOMFileInternal.idl
 delete mode 100644 content/html/content/public/nsIFileControlElement.h

diff --git a/browser/components/sessionstore/test/browser/browser_248970_b.js b/browser/components/sessionstore/test/browser/browser_248970_b.js
index 458d7104a6f8..1fa00efaaaf9 100644
--- a/browser/components/sessionstore/test/browser/browser_248970_b.js
+++ b/browser/components/sessionstore/test/browser/browser_248970_b.js
@@ -45,6 +45,11 @@ function test() {
     return false;
   }
 
+  var file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsIFile);
+  filePath = file.path;
+
   let fieldList = {
     "//input[@name='input']":     Date.now().toString(),
     "//input[@name='spaced 1']":  Math.random().toString(),
@@ -59,7 +64,7 @@ function test() {
     "//textarea[1]":              "",
     "//textarea[2]":              "Some text... " + Math.random(),
     "//textarea[3]":              "Some more text\n" + new Date(),
-    "//input[@type='file']":      "/dev/null"
+    "//input[@type='file']":      filePath
   };
 
   function getElementByXPath(aTab, aQuery) {
diff --git a/browser/components/sessionstore/test/browser/browser_346337.js b/browser/components/sessionstore/test/browser/browser_346337.js
index 1f3baabc00de..e5333b227eaa 100644
--- a/browser/components/sessionstore/test/browser/browser_346337.js
+++ b/browser/components/sessionstore/test/browser/browser_346337.js
@@ -36,6 +36,19 @@
 
 function test() {
   /** Test for Bug 346337 **/
+
+  var file = Components.classes["@mozilla.org/file/directory_service;1"]
+               .getService(Components.interfaces.nsIProperties)
+               .get("TmpD", Components.interfaces.nsILocalFile);
+  file.append("346337_test1.file");
+  file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
+  filePath1 = file.path;
+  file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsILocalFile);
+  file.append("346337_test2.file");
+  file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
+  filePath2 = file.path;
   
   let fieldList = {
     "//input[@name='input']":     Date.now().toString(),
@@ -51,8 +64,8 @@ function test() {
     "//textarea[1]":              "",
     "//textarea[2]":              "Some text... " + Math.random(),
     "//textarea[3]":              "Some more text\n" + new Date(),
-    "//input[@type='file'][1]":   ["/dev/null"],
-    "//input[@type='file'][2]":   ["/dev/null", "/dev/stdin"]
+    "//input[@type='file'][1]":   [filePath1],
+    "//input[@type='file'][2]":   [filePath1, filePath2]
   };
   
   function getElementByXPath(aTab, aQuery) {
diff --git a/browser/components/sessionstore/test/browser/browser_466937.js b/browser/components/sessionstore/test/browser/browser_466937.js
index e8cfd80456ad..a74539cd76c1 100644
--- a/browser/components/sessionstore/test/browser/browser_466937.js
+++ b/browser/components/sessionstore/test/browser/browser_466937.js
@@ -38,10 +38,16 @@ function test() {
   /** Test for Bug 466937 **/
   
   waitForExplicitFinish();
+
+  var file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsILocalFile);
+  file.append("466937_test.file");
+  file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
+  let testPath = file.path;
   
   let testURL = "http://mochi.test:8888/browser/" +
     "browser/components/sessionstore/test/browser/browser_466937_sample.html";
-  let testPath = "/home/user/regular.file";
   
   let tab = gBrowser.addTab(testURL);
   tab.linkedBrowser.addEventListener("load", function(aEvent) {
diff --git a/content/base/public/Makefile.in b/content/base/public/Makefile.in
index a7580a76ab5c..c0758b948615 100644
--- a/content/base/public/Makefile.in
+++ b/content/base/public/Makefile.in
@@ -99,7 +99,6 @@ XPIDLSRCS	= \
 		nsIDocumentEncoder.idl      \
 		nsIDOMFile.idl \
 		nsIDOMFileReader.idl \
-		nsIDOMFileInternal.idl \
 		nsIDOMFileList.idl \
 		nsIDOMFileException.idl \
 		nsIDOMFileError.idl \
diff --git a/content/base/public/nsDOMFile.h b/content/base/public/nsDOMFile.h
index 7e984a2af5b3..0c8f67919390 100644
--- a/content/base/public/nsDOMFile.h
+++ b/content/base/public/nsDOMFile.h
@@ -41,34 +41,42 @@
 
 #include "nsICharsetDetectionObserver.h"
 #include "nsIDOMFile.h"
-#include "nsIDOMFileInternal.h"
 #include "nsIDOMFileList.h"
 #include "nsIDOMFileError.h"
 #include "nsIInputStream.h"
 #include "nsCOMArray.h"
 #include "nsCOMPtr.h"
+#include "mozilla/AutoRestore.h"
 #include "nsString.h"
 #include "nsIWeakReference.h"
 #include "nsIWeakReferenceUtils.h"
 #include "nsIDocument.h"
+#include "nsIXMLHttpRequest.h"
 
 class nsIDOMDocument;
 class nsIFile;
 class nsIInputStream;
 
 class nsDOMFile : public nsIDOMFile,
-                  public nsIDOMFileInternal,
+                  public nsIXHRSendable,
                   public nsICharsetDetectionObserver
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMFILE
-  NS_DECL_NSIDOMFILEINTERNAL
+  NS_DECL_NSIXHRSENDABLE
+
+  nsDOMFile(nsIFile *aFile, nsIDocument* aRelatedDoc, nsAString& aContentType)
+    : mFile(aFile),
+      mRelatedDoc(do_GetWeakReference(aRelatedDoc)),
+      mContentType(aContentType)
+  {}
 
   nsDOMFile(nsIFile *aFile, nsIDocument* aRelatedDoc)
     : mFile(aFile),
       mRelatedDoc(do_GetWeakReference(aRelatedDoc))
   {}
+
   ~nsDOMFile() {}
 
   // from nsICharsetDetectionObserver
@@ -87,6 +95,30 @@ private:
                          nsAString &aResult);
 };
 
+class nsDOMMemoryFile : public nsDOMFile
+{
+public:
+  nsDOMMemoryFile(void *aMemoryBuffer,
+                  PRUint64 aLength,
+                  nsAString& aContentType,
+                  nsIDocument *aRelatedDoc)
+    : nsDOMFile(nsnull, aRelatedDoc, aContentType),
+      mInternalData(aMemoryBuffer), mLength(aLength)
+  { }
+
+  ~nsDOMMemoryFile()
+  { free(mInternalData); }
+
+  NS_IMETHOD GetName(nsAString&);
+  NS_IMETHOD GetSize(PRUint64*);
+  NS_IMETHOD GetInternalStream(nsIInputStream**);
+  NS_IMETHOD GetMozFullPathInternal(nsAString&);
+
+protected:
+  void* mInternalData;
+  PRUint64 mLength;
+};
+
 class nsDOMFileList : public nsIDOMFileList
 {
 public:
@@ -136,4 +168,13 @@ private:
   PRUint16 mCode;
 };
 
+class NS_STACK_CLASS nsDOMFileInternalUrlHolder {
+public:
+  nsDOMFileInternalUrlHolder(nsIDOMFile* aFile MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM);
+  ~nsDOMFileInternalUrlHolder();
+  nsAutoString mUrl;
+private:
+  MOZILLA_DECL_USE_GUARD_OBJECT_NOTIFIER
+};
+
 #endif
diff --git a/content/base/public/nsIDOMFile.idl b/content/base/public/nsIDOMFile.idl
index 4af299e92f40..9e63b5dfeb51 100644
--- a/content/base/public/nsIDOMFile.idl
+++ b/content/base/public/nsIDOMFile.idl
@@ -38,8 +38,10 @@
 #include "domstubs.idl"
 
 interface nsIDOMFileError;
+interface nsIInputStream;
+interface nsIURI;
 
-[scriptable, uuid(b10293e1-d531-4bdd-9b2b-4d8c1c9bc633)]
+[scriptable, uuid(e72e2d6e-e267-4ea1-a798-6703d3a2c362)]
 interface nsIDOMFile : nsISupports
 {
   //fileName and fileSize are now deprecated attributes
@@ -56,4 +58,11 @@ interface nsIDOMFile : nsISupports
   DOMString getAsText(in DOMString encoding); // raises(FileException) on retrieval
   DOMString getAsDataURL();             // raises(FileException) on retrieval
   DOMString getAsBinary();              // raises(FileException) on retrieval
+
+  [noscript] readonly attribute nsIInputStream internalStream;
+  // The caller is responsible for releasing the internalUrl from the
+  // moz-filedata: protocol handler
+  [noscript] readonly attribute DOMString internalUrl;
+  // This performs no security checks!
+  [noscript] readonly attribute DOMString mozFullPathInternal;
 };
diff --git a/content/base/public/nsIDOMFileInternal.idl b/content/base/public/nsIDOMFileInternal.idl
deleted file mode 100644
index a4e5dd6d461e..000000000000
--- a/content/base/public/nsIDOMFileInternal.idl
+++ /dev/null
@@ -1,46 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Mozilla Corporation
- * Portions created by the Initial Developer are Copyright (C) 2007
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "domstubs.idl"
-
-interface nsIFile;
-
-[scriptable, uuid(047CA6C4-52B3-46F1-8976-E198B724F72F)]
-interface nsIDOMFileInternal : nsISupports
-{
-  attribute nsIFile internalFile;
-};
diff --git a/content/base/src/nsDOMFile.cpp b/content/base/src/nsDOMFile.cpp
index 05bd5a20f5fd..532f04371df7 100644
--- a/content/base/src/nsDOMFile.cpp
+++ b/content/base/src/nsDOMFile.cpp
@@ -15,7 +15,7 @@
  * The Original Code is mozila.org code.
  *
  * The Initial Developer of the Original Code is
- * Mozilla Corporation
+ * Mozilla Foundation
  * Portions created by the Initial Developer are Copyright (C) 2007
  * the Initial Developer. All Rights Reserved.
  *
@@ -61,6 +61,7 @@
 #include "nsNetUtil.h"
 #include "nsIUUIDGenerator.h"
 #include "nsFileDataProtocolHandler.h"
+#include "nsStringStream.h"
 
 #include "plbase64.h"
 #include "prmem.h"
@@ -72,7 +73,7 @@ DOMCI_DATA(File, nsDOMFile)
 NS_INTERFACE_MAP_BEGIN(nsDOMFile)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMFile)
   NS_INTERFACE_MAP_ENTRY(nsIDOMFile)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMFileInternal)
+  NS_INTERFACE_MAP_ENTRY(nsIXHRSendable)
   NS_INTERFACE_MAP_ENTRY(nsICharsetDetectionObserver)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(File)
 NS_INTERFACE_MAP_END
@@ -116,12 +117,18 @@ NS_IMETHODIMP
 nsDOMFile::GetMozFullPath(nsAString &aFileName)
 {
   if (nsContentUtils::IsCallerTrustedForCapability("UniversalFileRead")) {
-    return mFile->GetPath(aFileName);
+    return GetMozFullPathInternal(aFileName);
   }
   aFileName.Truncate();
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDOMFile::GetMozFullPathInternal(nsAString &aFilename)
+{
+  return mFile->GetPath(aFilename);
+}
+
 NS_IMETHODIMP
 nsDOMFile::GetSize(PRUint64 *aFileSize)
 {
@@ -162,36 +169,56 @@ nsDOMFile::GetType(nsAString &aType)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDOMFile::GetInternalStream(nsIInputStream **aStream)
+{
+  return NS_NewLocalFileInputStream(aStream, mFile, -1, -1,
+                                    nsIFileInputStream::CLOSE_ON_EOF |
+                                    nsIFileInputStream::REOPEN_ON_REWIND);
+}
+
 NS_IMETHODIMP
 nsDOMFile::GetUrl(nsAString& aURL)
 {
   if (mURL.IsEmpty()) {
-    nsresult rv;
-    nsCOMPtr<nsIUUIDGenerator> uuidgen =
-      do_GetService("@mozilla.org/uuid-generator;1", &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-  
-    nsID id;
-    rv = uuidgen->GenerateUUIDInPlace(&id);
-    NS_ENSURE_SUCCESS(rv, rv);
-  
-    char chars[NSID_LENGTH];
-    id.ToProvidedString(chars);
-    
-    nsCString url = NS_LITERAL_CSTRING(FILEDATA_SCHEME ":") +
-                    Substring(chars + 1, chars + NSID_LENGTH - 2);
+    GetInternalUrl(mURL);
 
     nsCOMPtr<nsIDocument> doc = do_QueryReferent(mRelatedDoc);
-    if (doc) {
-      doc->RegisterFileDataUri(url);
-      nsFileDataProtocolHandler::AddFileDataEntry(url, mFile,
-                                                  doc->NodePrincipal());
-    }
-
-    CopyASCIItoUTF16(url, mURL);
+    NS_LossyConvertUTF16toASCII shortURL(mURL);
+    doc->RegisterFileDataUri(shortURL);
   }
 
   aURL = mURL;
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDOMFile::GetInternalUrl(nsAString& aURL)
+{
+  nsresult rv;
+  nsCOMPtr<nsIUUIDGenerator> uuidgen =
+    do_GetService("@mozilla.org/uuid-generator;1", &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  nsID id;
+  rv = uuidgen->GenerateUUIDInPlace(&id);
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  char chars[NSID_LENGTH];
+  id.ToProvidedString(chars);
+    
+  nsCString url = NS_LITERAL_CSTRING(FILEDATA_SCHEME ":") +
+    Substring(chars + 1, chars + NSID_LENGTH - 2);
+
+  nsCOMPtr<nsIDocument> doc = do_QueryReferent(mRelatedDoc);
+  if (doc) {
+    nsFileDataProtocolHandler::AddFileDataEntry(url,
+                                                this,
+                                                doc->NodePrincipal());
+  }
+
+  CopyASCIItoUTF16(url, aURL);
   
   return NS_OK;
 }
@@ -202,9 +229,7 @@ nsDOMFile::GetAsText(const nsAString &aCharset, nsAString &aResult)
   aResult.Truncate();
 
   nsCOMPtr<nsIInputStream> stream;
-  nsresult rv = NS_NewLocalFileInputStream
-                  (getter_AddRefs(stream),
-                   mFile, -1, -1, 0);
+  nsresult rv = GetInternalStream(getter_AddRefs(stream));
   NS_ENSURE_SUCCESS(rv, DOMFileResult(rv));
 
   nsCAutoString charsetGuess;
@@ -231,43 +256,33 @@ nsDOMFile::GetAsText(const nsAString &aCharset, nsAString &aResult)
   return ConvertStream(stream, charset.get(), aResult);
 }
 
-NS_IMETHODIMP
-nsDOMFile::GetInternalFile(nsIFile **aFile)
-{
-  NS_IF_ADDREF(*aFile = mFile);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMFile::SetInternalFile(nsIFile *aFile)
-{
-  mFile = aFile;
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsDOMFile::GetAsDataURL(nsAString &aResult)
 {
   aResult.AssignLiteral("data:");
 
   nsresult rv;
-  nsCOMPtr<nsIMIMEService> mimeService =
-    do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (!mContentType.Length()) {
+    nsCOMPtr<nsIMIMEService> mimeService =
+      do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCAutoString contentType;
-  rv = mimeService->GetTypeFromFile(mFile, contentType);
-  if (NS_SUCCEEDED(rv)) {
-    AppendUTF8toUTF16(contentType, aResult);
+    nsCAutoString contentType;
+    rv = mimeService->GetTypeFromFile(mFile, contentType);
+    if (NS_SUCCEEDED(rv)) {
+      CopyUTF8toUTF16(contentType, mContentType);
+    }
+  }
+
+  if (mContentType.Length()) {
+    aResult.Append(mContentType);
   } else {
     aResult.AppendLiteral("application/octet-stream");
   }
   aResult.AppendLiteral(";base64,");
 
   nsCOMPtr<nsIInputStream> stream;
-  rv = NS_NewLocalFileInputStream(getter_AddRefs(stream),
-                                  mFile, -1, -1,
-                                  nsIFileInputStream::CLOSE_ON_EOF);
+  rv = GetInternalStream(getter_AddRefs(stream));
   NS_ENSURE_SUCCESS(rv, DOMFileResult(rv));
 
   char readBuf[4096];
@@ -307,10 +322,7 @@ nsDOMFile::GetAsBinary(nsAString &aResult)
   aResult.Truncate();
 
   nsCOMPtr<nsIInputStream> stream;
-  nsresult rv = NS_NewLocalFileInputStream
-                  (getter_AddRefs(stream),
-                   mFile, -1, -1,
-                   nsIFileInputStream::CLOSE_ON_EOF);
+  nsresult rv = GetInternalStream(getter_AddRefs(stream));
   NS_ENSURE_SUCCESS(rv, DOMFileResult(rv));
 
   PRUint32 numRead;
@@ -423,6 +435,29 @@ nsDOMFile::GuessCharset(nsIInputStream *aStream,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDOMFile::GetSendInfo(nsIInputStream** aBody,
+                       nsACString& aContentType,
+                       nsACString& aCharset)
+{
+  nsresult rv;
+
+  nsCOMPtr<nsIInputStream> stream;
+  rv = this->GetInternalStream(getter_AddRefs(stream));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsString contentType;
+  rv = this->GetType(contentType);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  CopyUTF16toUTF8(contentType, aContentType);
+
+  aCharset.Truncate();
+
+  stream.forget(aBody);
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDOMFile::Notify(const char* aCharset, nsDetectionConfident aConf)
 {
@@ -463,6 +498,39 @@ nsDOMFile::ConvertStream(nsIInputStream *aStream,
   return rv;
 }
 
+// nsDOMMemoryFile Implementation
+NS_IMETHODIMP
+nsDOMMemoryFile::GetName(nsAString &aFileName)
+{
+  aFileName.Truncate();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDOMMemoryFile::GetSize(PRUint64 *aFileSize)
+{
+  *aFileSize = mLength;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDOMMemoryFile::GetInternalStream(nsIInputStream **aStream)
+{
+  if (mLength > PR_INT32_MAX)
+    return NS_ERROR_FAILURE;
+
+  PRInt32 l = mLength;
+
+  return NS_NewByteInputStream(aStream, (const char*)mInternalData, l);
+}
+
+NS_IMETHODIMP
+nsDOMMemoryFile::GetMozFullPathInternal(nsAString &aFilename)
+{
+  aFilename.Truncate();
+  return NS_OK;
+}
+
 // nsDOMFileList implementation
 
 DOMCI_DATA(FileList, nsDOMFileList)
@@ -511,3 +579,17 @@ nsDOMFileError::GetCode(PRUint16* aCode)
   *aCode = mCode;
   return NS_OK;
 }
+
+nsDOMFileInternalUrlHolder::nsDOMFileInternalUrlHolder(nsIDOMFile* aFile
+                                                       MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL) {
+  MOZILLA_GUARD_OBJECT_NOTIFIER_INIT;
+  aFile->GetInternalUrl(mUrl);
+}
+ 
+nsDOMFileInternalUrlHolder::~nsDOMFileInternalUrlHolder() {
+  if (!mUrl.IsEmpty()) {
+    nsCAutoString narrowUrl;
+    CopyUTF16toUTF8(mUrl, narrowUrl);
+    nsFileDataProtocolHandler::RemoveFileDataEntry(narrowUrl);
+  }
+}
diff --git a/content/base/src/nsDOMFileReader.cpp b/content/base/src/nsDOMFileReader.cpp
index 0fdb844ed1f3..48e2b8ac513f 100644
--- a/content/base/src/nsDOMFileReader.cpp
+++ b/content/base/src/nsDOMFileReader.cpp
@@ -15,7 +15,7 @@
  * The Original Code is mozila.org code.
  *
  * The Initial Developer of the Original Code is
- * Mozilla Corporation
+ * Mozilla Foundation
  * Portions created by the Initial Developer are Copyright (C) 2007
  * the Initial Developer. All Rights Reserved.
  *
@@ -71,13 +71,13 @@
 #include "nsJSEnvironment.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIDOMClassInfo.h"
-#include "nsIDOMFileInternal.h"
 #include "nsCExternalHandlerService.h"
 #include "nsIStreamConverterService.h"
 #include "nsEventDispatcher.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsLayoutStatics.h"
 #include "nsIScriptObjectPrincipal.h"
+#include "nsFileDataProtocolHandler.h"
 
 #define LOAD_STR "load"
 #define ERROR_STR "error"
@@ -485,6 +485,7 @@ nsDOMFileReader::ReadFileContent(nsIDOMFile* aFile,
                                  const nsAString &aCharset,
                                  eDataFormat aDataFormat)
 {
+  nsresult rv;
   NS_ENSURE_TRUE(aFile, NS_ERROR_NULL_POINTER);
 
   //Implicit abort to clear any other activity going on
@@ -496,26 +497,28 @@ nsDOMFileReader::ReadFileContent(nsIDOMFile* aFile,
   mReadyState = nsIDOMFileReader::EMPTY;
   FreeFileData();
 
+  mFile = aFile;
   mDataFormat = aDataFormat;
   mCharset = aCharset;
 
-  //Obtain the nsDOMFile's underlying nsIFile
-  nsresult rv;
-  nsCOMPtr<nsIDOMFileInternal> domFile(do_QueryInterface(aFile));
-  rv = domFile->GetInternalFile(getter_AddRefs(mFile));
-  NS_ENSURE_SUCCESS(rv, rv);
-
   //Establish a channel with our file
-  nsCOMPtr<nsIURI> uri;
-  rv = NS_NewFileURI(getter_AddRefs(uri), mFile);
-  NS_ENSURE_SUCCESS(rv, rv);
+  {
+    // Hold the internal URL alive only as long as necessary
+    // After the channel is created it will own whatever is backing
+    // the DOMFile.
+    nsDOMFileInternalUrlHolder urlHolder(mFile);
 
-  rv = NS_NewChannel(getter_AddRefs(mChannel), uri);
-  NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIURI> uri;
+    rv = NS_NewURI(getter_AddRefs(uri), urlHolder.mUrl);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = NS_NewChannel(getter_AddRefs(mChannel), uri);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
 
   //Obtain the total size of the file before reading
   mReadTotal = -1;
-  mFile->GetFileSize(&mReadTotal);
+  mFile->GetSize(&mReadTotal);
 
   rv = mChannel->AsyncOpen(this, nsnull);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -604,7 +607,7 @@ nsDOMFileReader::GetAsText(const nsAString &aCharset,
 }
 
 nsresult
-nsDOMFileReader::GetAsDataURL(nsIFile *aFile,
+nsDOMFileReader::GetAsDataURL(nsIDOMFile *aFile,
                               const char *aFileData,
                               PRUint32 aDataLen,
                               nsAString& aResult)
@@ -612,14 +615,10 @@ nsDOMFileReader::GetAsDataURL(nsIFile *aFile,
   aResult.AssignLiteral("data:");
 
   nsresult rv;
-  nsCOMPtr<nsIMIMEService> mimeService =
-    do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCAutoString contentType;
-  rv = mimeService->GetTypeFromFile(aFile, contentType);
-  if (NS_SUCCEEDED(rv)) {
-    AppendUTF8toUTF16(contentType, aResult);
+  nsString contentType;
+  rv = aFile->GetType(contentType);
+  if (NS_SUCCEEDED(rv) && !contentType.IsEmpty()) {
+    aResult.Append(contentType);
   } else {
     aResult.AppendLiteral("application/octet-stream");
   }
diff --git a/content/base/src/nsDOMFileReader.h b/content/base/src/nsDOMFileReader.h
index 42922d632ba3..fdd028cac6cf 100644
--- a/content/base/src/nsDOMFileReader.h
+++ b/content/base/src/nsDOMFileReader.h
@@ -120,7 +120,7 @@ protected:
   nsresult ReadFileContent(nsIDOMFile *aFile, const nsAString &aCharset, eDataFormat aDataFormat); 
   nsresult GetAsText(const nsAString &aCharset,
                      const char *aFileData, PRUint32 aDataLen, nsAString &aResult);
-  nsresult GetAsDataURL(nsIFile *aFile, const char *aFileData, PRUint32 aDataLen, nsAString &aResult); 
+  nsresult GetAsDataURL(nsIDOMFile *aFile, const char *aFileData, PRUint32 aDataLen, nsAString &aResult); 
   nsresult GuessCharset(const char *aFileData, PRUint32 aDataLen, nsACString &aCharset); 
   nsresult ConvertStream(const char *aFileData, PRUint32 aDataLen, const char *aCharset, nsAString &aResult); 
   void DispatchError(nsresult rv);
@@ -133,7 +133,7 @@ protected:
   }
 
   char *mFileData;
-  nsCOMPtr<nsIFile> mFile;
+  nsCOMPtr<nsIDOMFile> mFile;
   nsString mCharset;
   PRUint32 mDataLen;
 
@@ -150,7 +150,7 @@ protected:
   nsCOMPtr<nsIPrincipal> mPrincipal;
   nsCOMPtr<nsIChannel> mChannel;
 
-  PRInt64 mReadTotal;
+  PRUint64 mReadTotal;
   PRUint64 mReadTransferred;
 
   nsRefPtr<nsDOMEventListenerWrapper> mOnLoadEndListener;
diff --git a/content/base/src/nsFileDataProtocolHandler.cpp b/content/base/src/nsFileDataProtocolHandler.cpp
index 314c987fd4bf..9c1bf5db4f66 100644
--- a/content/base/src/nsFileDataProtocolHandler.cpp
+++ b/content/base/src/nsFileDataProtocolHandler.cpp
@@ -42,7 +42,7 @@
 #include "nsNetUtil.h"
 #include "nsIURIWithPrincipal.h"
 #include "nsIPrincipal.h"
-#include "nsIFileChannel.h"
+#include "nsIDOMFile.h"
 #include "nsISerializable.h"
 #include "nsIClassInfo.h"
 #include "nsIObjectInputStream.h"
@@ -55,14 +55,15 @@ static NS_DEFINE_CID(kSimpleURICID, NS_SIMPLEURI_CID);
 // Hash table
 struct FileDataInfo
 {
-  nsCOMPtr<nsIURI> mFileUri;
+  nsCOMPtr<nsIDOMFile> mFile;
   nsCOMPtr<nsIPrincipal> mPrincipal;
 };
 
 static nsClassHashtable<nsCStringHashKey, FileDataInfo>* gFileDataTable;
 
 void
-nsFileDataProtocolHandler::AddFileDataEntry(nsACString& aUri, nsIFile* aFile,
+nsFileDataProtocolHandler::AddFileDataEntry(nsACString& aUri,
+					    nsIDOMFile* aFile,
                                             nsIPrincipal* aPrincipal)
 {
   if (!gFileDataTable) {
@@ -72,7 +73,7 @@ nsFileDataProtocolHandler::AddFileDataEntry(nsACString& aUri, nsIFile* aFile,
 
   FileDataInfo* info = new FileDataInfo;
 
-  NS_NewFileURI(getter_AddRefs(info->mFileUri), aFile);
+  info->mFile = aFile;
   info->mPrincipal = aPrincipal;
 
   gFileDataTable->Put(aUri, info);
@@ -413,8 +414,14 @@ nsFileDataProtocolHandler::NewChannel(nsIURI* uri, nsIChannel* *result)
   }
 #endif
 
+  nsCOMPtr<nsIInputStream> stream;
+  nsresult rv = info->mFile->GetInternalStream(getter_AddRefs(stream));
+  NS_ENSURE_SUCCESS(rv, rv);
+
   nsCOMPtr<nsIChannel> channel;
-  nsresult rv = NS_NewChannel(getter_AddRefs(channel), info->mFileUri);
+  rv = NS_NewInputStreamChannel(getter_AddRefs(channel),
+				uri,
+				stream);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsISupports> owner = do_QueryInterface(info->mPrincipal);
diff --git a/content/base/src/nsFileDataProtocolHandler.h b/content/base/src/nsFileDataProtocolHandler.h
index 402f56a67797..b98d397b492e 100644
--- a/content/base/src/nsFileDataProtocolHandler.h
+++ b/content/base/src/nsFileDataProtocolHandler.h
@@ -41,7 +41,7 @@
 
 #define FILEDATA_SCHEME "moz-filedata"
 
-class nsIFile;
+class nsIDOMFile;
 class nsIPrincipal;
 
 class nsFileDataProtocolHandler : public nsIProtocolHandler
@@ -57,7 +57,8 @@ public:
   virtual ~nsFileDataProtocolHandler() {}
 
   // Methods for managing uri->file mapping
-  static void AddFileDataEntry(nsACString& aUri, nsIFile* aFile,
+  static void AddFileDataEntry(nsACString& aUri,
+			       nsIDOMFile* aFile,
                                nsIPrincipal* aPrincipal);
   static void RemoveFileDataEntry(nsACString& aUri);
   
diff --git a/content/base/src/nsFormData.cpp b/content/base/src/nsFormData.cpp
index 068964108cce..c9176d9c245b 100644
--- a/content/base/src/nsFormData.cpp
+++ b/content/base/src/nsFormData.cpp
@@ -36,9 +36,8 @@
 
 #include "nsFormData.h"
 #include "nsIVariant.h"
-#include "nsIDOMFileInternal.h"
 #include "nsIInputStream.h"
-#include "nsIFile.h"
+#include "nsIDOMFile.h"
 #include "nsContentUtils.h"
 
 nsFormData::nsFormData()
@@ -84,7 +83,7 @@ nsFormData::AddNameValuePair(const nsAString& aName,
 
 nsresult
 nsFormData::AddNameFilePair(const nsAString& aName,
-                            nsIFile* aFile)
+                            nsIDOMFile* aFile)
 {
   FormDataTuple* data = mFormData.AppendElement();
   data->name = aName;
@@ -113,13 +112,9 @@ nsFormData::Append(const nsAString& aName, nsIVariant* aValue)
 
     nsMemory::Free(iid);
 
-    nsCOMPtr<nsIDOMFileInternal> domFile = do_QueryInterface(supports);
+    nsCOMPtr<nsIDOMFile> domFile = do_QueryInterface(supports);
     if (domFile) {
-      nsCOMPtr<nsIFile> file;
-      rv = domFile->GetInternalFile(getter_AddRefs(file));
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      return AddNameFilePair(aName, file);
+      return AddNameFilePair(aName, domFile);
     }
   }
 
diff --git a/content/base/src/nsFormData.h b/content/base/src/nsFormData.h
index 3dc745b7416b..19ca9433fce8 100644
--- a/content/base/src/nsFormData.h
+++ b/content/base/src/nsFormData.h
@@ -42,6 +42,8 @@
 #include "nsFormSubmission.h"
 #include "nsTArray.h"
 
+class nsIDOMFile;
+
 class nsFormData : public nsIDOMFormData,
                    public nsIXHRSendable,
                    public nsFormSubmission
@@ -59,16 +61,14 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIFile* aFile);
-
-  
+                                   nsIDOMFile* aFile);
 
 private:
   struct FormDataTuple
   {
     nsString name;
     nsString stringValue;
-    nsCOMPtr<nsIFile> fileValue;
+    nsCOMPtr<nsIDOMFile> fileValue;
     PRBool valueIsFile;
   };
   
diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
index 71649c629d78..fe3921272f6d 100644
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -63,7 +63,6 @@
 #include "nsIScriptGlobalObject.h"
 #include "nsIDOMClassInfo.h"
 #include "nsIDOMElement.h"
-#include "nsIDOMFileInternal.h"
 #include "nsIDOMWindow.h"
 #include "nsIMIMEService.h"
 #include "nsCExternalHandlerService.h"
@@ -2328,29 +2327,6 @@ GetRequestBody(nsIVariant* aBody, nsIInputStream** aResult,
       return NS_OK;
     }
 
-    // nsIDOMFile?
-    nsCOMPtr<nsIDOMFileInternal> file = do_QueryInterface(supports);
-    if (file) {
-      aCharset.Truncate();
-
-      nsCOMPtr<nsIFile> internalFile;
-      rv = file->GetInternalFile(getter_AddRefs(internalFile));
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      // Get the mimetype
-      nsCOMPtr<nsIMIMEService> mimeService =
-          do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      rv = mimeService->GetTypeFromFile(internalFile, aContentType);
-      if (NS_FAILED(rv)) {
-        aContentType.Truncate();
-      }
-
-      // Feed local file input stream into our upload channel
-      return NS_NewLocalFileInputStream(aResult, internalFile);
-    }
-
     // nsIXHRSendable?
     nsCOMPtr<nsIXHRSendable> sendable = do_QueryInterface(supports);
     if (sendable) {
diff --git a/content/base/test/test_bug345339.html b/content/base/test/test_bug345339.html
index 323d5c799ad2..407e268d5449 100644
--- a/content/base/test/test_bug345339.html
+++ b/content/base/test/test_bug345339.html
@@ -22,6 +22,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=345339
 /** Test for Bug 345339 **/
 SimpleTest.waitForExplicitFinish();
 
+var filePath;
+
 function afterLoad() {
     var iframeDoc = $("testframe").contentDocument;
 
@@ -31,8 +33,15 @@ function afterLoad() {
     iframeDoc.getElementById("password").value = "123456";
     iframeDoc.getElementById("hidden").value = "gecko";
 
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalFileRead");
-    iframeDoc.getElementById("file").value = "dummyfile.txt";
+    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+    var file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsILocalFile);
+    file.append("345339_test.file");
+    file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
+    filePath = file.path;
+
+    iframeDoc.getElementById("file").value = filePath;
 
     /* Reload the page */
     $("testframe").setAttribute("onload", "afterReload()");
@@ -55,7 +64,7 @@ function afterReload() {
     is(iframeDoc.getElementById("hidden").value, "gecko",
        "hidden field value preserved");
     netscape.security.PrivilegeManager.enablePrivilege("UniversalFileRead");
-    is(iframeDoc.getElementById("file").value, "dummyfile.txt",
+    is(iframeDoc.getElementById("file").value, filePath,
        "file field value preserved");
 
     SimpleTest.finish();
diff --git a/content/html/content/public/Makefile.in b/content/html/content/public/Makefile.in
index b5de365f6c8d..bb24b40db9be 100644
--- a/content/html/content/public/Makefile.in
+++ b/content/html/content/public/Makefile.in
@@ -60,7 +60,6 @@ EXPORTS = \
 		nsIRadioVisitor.h \
 		nsIRadioGroupContainer.h \
 		nsITextControlElement.h \
-		nsIFileControlElement.h \
 		nsFormSubmission.h \
 		nsIFrameSetElement.h \
 		nsHTMLAudioElement.h \
diff --git a/content/html/content/public/nsFormSubmission.h b/content/html/content/public/nsFormSubmission.h
index 83fbb1ccd8cf..5c26ae9d1016 100644
--- a/content/html/content/public/nsFormSubmission.h
+++ b/content/html/content/public/nsFormSubmission.h
@@ -52,6 +52,7 @@ class nsIDocShell;
 class nsIRequest;
 class nsISaveAsCharset;
 class nsIMultiplexInputStream;
+class nsIDOMFile;
 
 /**
  * Class for form submissions; encompasses the function to call to submit as
@@ -81,7 +82,7 @@ public:
    * @param aFile the file to submit
    */
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIFile* aFile) = 0;
+                                   nsIDOMFile* aFile) = 0;
   
   /**
    * Reports whether the instance supports AddIsindex().
@@ -187,7 +188,7 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIFile* aFile);
+                                   nsIDOMFile* aFile);
   virtual nsresult GetEncodedSubmission(nsIURI* aURI,
                                         nsIInputStream** aPostDataStream);
 
diff --git a/content/html/content/public/nsIFileControlElement.h b/content/html/content/public/nsIFileControlElement.h
deleted file mode 100644
index 73cb76e2baee..000000000000
--- a/content/html/content/public/nsIFileControlElement.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Mozilla Foundation
- * Portions created by the Initial Developer are Copyright (C) 2006
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Jonas Sicking <jonas@sicking.cc> (Original author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nsIFileControlElement_h___
-#define nsIFileControlElement_h___
-
-#include "nsISupports.h"
-#include "nsTArray.h"
-#include "nsString.h"
-#include "nsCOMArray.h"
-
-class nsIFile;
-
-// IID for the nsIFileControl interface
-#define NS_IFILECONTROLELEMENT_IID \
-{ 0x1f6a32fd, 0x9cda, 0x43e9, \
-  { 0x90, 0xef, 0x18, 0x0a, 0xd5, 0xe6, 0xcd, 0xa9 } }
-
-/**
- * This interface is used for the file control frame to store its value away
- * into the content.
- */
-class nsIFileControlElement : public nsISupports {
-public:
-
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IFILECONTROLELEMENT_IID)
-
-  /**
-   * Gets a readable string representing the list of files currently
-   * selected by this control. This value might not be a valid file name
-   * and should not be used for anything but displaying the filename to the
-   * user.
-   */
-  virtual void GetDisplayFileName(nsAString& aFileName) = 0;
-
-  /**
-   * Sets the list of filenames currently selected by this control.
-   */
-  virtual void SetFileNames(const nsTArray<nsString>& aFileNames) = 0;
-
-  /**
-   * Gets a list of nsIFile objects for the files currently selected by
-   * this control.
-   */
-  virtual void GetFileArray(nsCOMArray<nsIFile>& aFiles) = 0;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsIFileControlElement,
-                              NS_IFILECONTROLELEMENT_IID)
-
-#endif // nsIFileControlElement_h___
diff --git a/content/html/content/src/nsFormSubmission.cpp b/content/html/content/src/nsFormSubmission.cpp
index 62563101e83b..d2979ba5486d 100644
--- a/content/html/content/src/nsFormSubmission.cpp
+++ b/content/html/content/src/nsFormSubmission.cpp
@@ -49,9 +49,8 @@
 #include "nsDOMError.h"
 #include "nsGenericHTMLElement.h"
 #include "nsISaveAsCharset.h"
-
-// JBK added for submit move from content frame
 #include "nsIFile.h"
+#include "nsIDOMFile.h"
 #include "nsDirectoryServiceDefs.h"
 #include "nsStringStream.h"
 #include "nsIURI.h"
@@ -110,7 +109,7 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIFile* aFile);
+                                   nsIDOMFile* aFile);
   virtual nsresult GetEncodedSubmission(nsIURI* aURI,
                                         nsIInputStream** aPostDataStream);
 
@@ -196,7 +195,7 @@ nsFSURLEncoded::AddIsindex(const nsAString& aValue)
 
 nsresult
 nsFSURLEncoded::AddNameFilePair(const nsAString& aName,
-                                nsIFile* aFile)
+                                nsIDOMFile* aFile)
 {
   if (!mWarnedFileControl) {
     SendJSWarning(mDocument, "ForgotFileEnctypeWarning", nsnull, 0);
@@ -205,7 +204,7 @@ nsFSURLEncoded::AddNameFilePair(const nsAString& aName,
 
   nsAutoString filename;
   if (aFile) {
-    aFile->GetLeafName(filename);
+    aFile->GetName(filename);
   }
 
   return AddNameValuePair(aName, filename);
@@ -469,7 +468,7 @@ nsFSMultipartFormData::AddNameValuePair(const nsAString& aName,
 
 nsresult
 nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
-                                       nsIFile* aFile)
+                                       nsIDOMFile* aFile)
 {
   // Encode the control name
   nsCAutoString nameStr;
@@ -477,12 +476,13 @@ nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCString filenameStr;
-  nsCAutoString contentType;
+  nsAutoString contentType;
   nsCOMPtr<nsIInputStream> fileStream;
   if (aFile) {
     // Get and encode the filename
     nsAutoString filename;
-    aFile->GetLeafName(filename);
+    rv = aFile->GetName(filename);
+    NS_ENSURE_SUCCESS(rv, rv);
     nsCAutoString encodedFileName;
     rv = EncodeVal(filename, encodedFileName);
     NS_ENSURE_SUCCESS(rv, rv);
@@ -493,20 +493,14 @@ nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
                                         nsLinebreakConverter::eLinebreakNet));
   
     // Get content type
-    nsCOMPtr<nsIMIMEService> MIMEService =
-      do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    rv = MIMEService->GetTypeFromFile(aFile, contentType);
-    if (NS_FAILED(rv)) {
+    rv = aFile->GetType(contentType);
+    if (NS_FAILED(rv) || contentType.IsEmpty()) {
       contentType.AssignLiteral("application/octet-stream");
     }
   
     // Get input stream
-    rv = NS_NewLocalFileInputStream(getter_AddRefs(fileStream),
-                                    aFile, -1, -1,
-                                    nsIFileInputStream::CLOSE_ON_EOF |
-                                    nsIFileInputStream::REOPEN_ON_REWIND);
+    rv = aFile->GetInternalStream(getter_AddRefs(fileStream));
+    NS_ENSURE_SUCCESS(rv, rv);
     if (fileStream) {
       // Create buffered stream (for efficiency)
       nsCOMPtr<nsIInputStream> bufferedStream;
@@ -534,8 +528,9 @@ nsFSMultipartFormData::AddNameFilePair(const nsAString& aName,
          NS_LITERAL_CSTRING("Content-Disposition: form-data; name=\"")
        + nameStr + NS_LITERAL_CSTRING("\"; filename=\"")
        + filenameStr + NS_LITERAL_CSTRING("\"" CRLF)
-       + NS_LITERAL_CSTRING("Content-Type: ") + contentType
-       + NS_LITERAL_CSTRING(CRLF CRLF);
+       + NS_LITERAL_CSTRING("Content-Type: ");
+  AppendUTF16toUTF8(contentType, mPostDataChunk);
+  mPostDataChunk += NS_LITERAL_CSTRING(CRLF CRLF);
 
   // Add the file to the stream
   if (fileStream) {
@@ -605,7 +600,7 @@ public:
   virtual nsresult AddNameValuePair(const nsAString& aName,
                                     const nsAString& aValue);
   virtual nsresult AddNameFilePair(const nsAString& aName,
-                                   nsIFile* aFile);
+                                   nsIDOMFile* aFile);
   virtual nsresult GetEncodedSubmission(nsIURI* aURI,
                                         nsIInputStream** aPostDataStream);
 
@@ -628,11 +623,11 @@ nsFSTextPlain::AddNameValuePair(const nsAString& aName,
 
 nsresult
 nsFSTextPlain::AddNameFilePair(const nsAString& aName,
-                               nsIFile* aFile)
+                               nsIDOMFile* aFile)
 {
   nsAutoString filename;
   if (aFile) {
-    aFile->GetLeafName(filename);
+    aFile->GetName(filename);
   }
     
   AddNameValuePair(aName, filename);
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index c4d37657c0a0..e5f510585276 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -1315,6 +1315,18 @@ NS_NewHTML##_elementName##Element(already_AddRefed<nsINodeInfo> aNodeInfo,   \
     NS_INTERFACE_TABLE_ENTRY(_class, _i6)                                     \
   NS_OFFSET_AND_INTERFACE_TABLE_END
 
+#define NS_HTML_CONTENT_INTERFACE_TABLE7(_class, _i1, _i2, _i3, _i4, _i5,     \
+                                         _i6, _i7)                            \
+  NS_HTML_CONTENT_INTERFACE_TABLE_BEGIN(_class)                               \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i1)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i2)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i3)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i4)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i5)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i6)                                     \
+    NS_INTERFACE_TABLE_ENTRY(_class, _i7)                                     \
+  NS_OFFSET_AND_INTERFACE_TABLE_END
+
 #define NS_HTML_CONTENT_INTERFACE_TABLE8(_class, _i1, _i2, _i3, _i4, _i5,     \
                                          _i6, _i7, _i8)                       \
   NS_HTML_CONTENT_INTERFACE_TABLE_BEGIN(_class)                               \
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index f0ef08b156a0..e82752974615 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -38,7 +38,6 @@
 
 #include "nsIDOMHTMLInputElement.h"
 #include "nsITextControlElement.h"
-#include "nsIFileControlElement.h"
 #include "nsIDOMNSEditableElement.h"
 #include "nsIRadioVisitor.h"
 #include "nsIPhonetic.h"
@@ -93,8 +92,8 @@
 
 #include "nsRuleData.h"
 
-// input type=radio
-#include "nsIRadioGroupContainer.h"
+// input type=radio
+#include "nsIRadioGroupContainer.h"
 
 // input type=file
 #include "nsIFile.h"
@@ -207,12 +206,13 @@ class nsHTMLInputElementState : public nsISupports
       mValue = aValue;
     }
 
-    const nsTArray<nsString>& GetFilenames() {
-      return mFilenames;
+    const nsCOMArray<nsIDOMFile>& GetFiles() {
+      return mFiles;
     }
 
-    void SetFilenames(const nsTArray<nsString> &aFilenames) {
-      mFilenames = aFilenames;
+    void SetFiles(const nsCOMArray<nsIDOMFile> &aFiles) {
+      mFiles.Clear();
+      mFiles.AppendObjects(aFiles);
     }
 
     nsHTMLInputElementState()
@@ -223,7 +223,7 @@ class nsHTMLInputElementState : public nsISupports
  
   protected:
     nsString mValue;
-    nsTArray<nsString> mFilenames;
+    nsCOMArray<nsIDOMFile> mFiles;
     PRPackedBool mChecked;
     PRPackedBool mCheckedSet;
 };
@@ -268,21 +268,21 @@ AsyncClickHandler::Run()
 
   // Check if page is allowed to open the popup
   if (mPopupControlState != openAllowed) {
-    nsCOMPtr<nsIPopupWindowManager> pm =
-      do_GetService(NS_POPUPWINDOWMANAGER_CONTRACTID);
- 
-    if (!pm) {
-      return NS_OK;
-    }
-
-    PRUint32 permission;
-    pm->TestPermission(doc->GetDocumentURI(), &permission);
-    if (permission == nsIPopupWindowManager::DENY_POPUP) {
-      nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(doc);
-      nsGlobalWindow::FirePopupBlockedEvent(domDoc, win, nsnull, EmptyString(), EmptyString());
+    nsCOMPtr<nsIPopupWindowManager> pm =
+      do_GetService(NS_POPUPWINDOWMANAGER_CONTRACTID);
+ 
+    if (!pm) {
       return NS_OK;
     }
-  }
+
+    PRUint32 permission;
+    pm->TestPermission(doc->GetDocumentURI(), &permission);
+    if (permission == nsIPopupWindowManager::DENY_POPUP) {
+      nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(doc);
+      nsGlobalWindow::FirePopupBlockedEvent(domDoc, win, nsnull, EmptyString(), EmptyString());
+      return NS_OK;
+    }
+  }
 
   // Get Loc title
   nsXPIDLString title;
@@ -325,17 +325,24 @@ AsyncClickHandler::Run()
   // Set default directry and filename
   nsAutoString defaultName;
 
-  nsCOMArray<nsIFile> oldFiles;
-  mInput->GetFileArray(oldFiles);
+  const nsCOMArray<nsIDOMFile>& oldFiles = mInput->GetFiles();
 
   if (oldFiles.Count()) {
-    // set directory
-    nsCOMPtr<nsIFile> parentFile;
-    oldFiles[0]->GetParent(getter_AddRefs(parentFile));
-    if (parentFile) {
-      nsCOMPtr<nsILocalFile> parentLocalFile = do_QueryInterface(parentFile, &rv);
-      if (parentLocalFile) {
-        filePicker->SetDisplayDirectory(parentLocalFile);
+    nsString path;
+
+    oldFiles[0]->GetMozFullPathInternal(path);
+
+    nsCOMPtr<nsILocalFile> localFile;
+    rv = NS_NewLocalFile(path, PR_FALSE, getter_AddRefs(localFile));
+
+    if (NS_SUCCEEDED(rv)) {
+      nsCOMPtr<nsIFile> parentFile;
+      rv = localFile->GetParent(getter_AddRefs(parentFile));
+      if (NS_SUCCEEDED(rv)) {
+        nsCOMPtr<nsILocalFile> parentLocalFile = do_QueryInterface(parentFile, &rv);
+        if (parentLocalFile) {
+          filePicker->SetDisplayDirectory(parentLocalFile);
+        }
       }
     }
 
@@ -344,7 +351,7 @@ AsyncClickHandler::Run()
     // one file was selected before.
     if (oldFiles.Count() == 1) {
       nsAutoString leafName;
-      oldFiles[0]->GetLeafName(leafName);
+      oldFiles[0]->GetName(leafName);
       if (!leafName.IsEmpty()) {
         filePicker->SetDefaultString(leafName);
       }
@@ -375,7 +382,7 @@ AsyncClickHandler::Run()
     return NS_OK;
   
   // Collect new selected filenames
-  nsTArray<nsString> newFileNames;
+  nsCOMArray<nsIDOMFile> newFiles;
   if (multi) {
     nsCOMPtr<nsISimpleEnumerator> iter;
     rv = filePicker->GetFiles(getter_AddRefs(iter));
@@ -389,7 +396,9 @@ AsyncClickHandler::Run()
         nsString unicodePath;
         rv = localFile->GetPath(unicodePath);
         if (!unicodePath.IsEmpty()) {
-          newFileNames.AppendElement(unicodePath);
+          nsCOMPtr<nsIDOMFile> domFile =
+            do_QueryObject(new nsDOMFile(localFile, doc));
+          newFiles.AppendObject(domFile);
         }
         if (!prefSaved) {
           // Store the last used directory using the content pref service
@@ -408,7 +417,9 @@ AsyncClickHandler::Run()
       nsString unicodePath;
       rv = localFile->GetPath(unicodePath);
       if (!unicodePath.IsEmpty()) {
-        newFileNames.AppendElement(unicodePath);
+        nsCOMPtr<nsIDOMFile> domFile=
+          do_QueryObject(new nsDOMFile(localFile, doc));
+        newFiles.AppendObject(domFile);
       }
       // Store the last used directory using the content pref service
       rv = nsHTMLInputElement::gUploadLastDir->StoreLastUsedDirectory(doc->GetDocumentURI(),
@@ -418,7 +429,7 @@ AsyncClickHandler::Run()
   }
 
   // Set new selected files
-  if (!newFileNames.IsEmpty()) {
+  if (newFiles.Count()) {
     // Tell mTextFrame that this update of the value is a user initiated
     // change. Otherwise it'll think that the value is being set by a script
     // and not fire onchange when it should.
@@ -428,7 +439,7 @@ AsyncClickHandler::Run()
       textFrame->SetFireChangeEventState(PR_TRUE);
     }
 
-    mInput->SetFileNames(newFileNames);
+    mInput->SetFiles(newFiles);
     if (textFrame) {
       textFrame->SetFireChangeEventState(oldState);
       // May need to fire an onchange here
@@ -669,10 +680,9 @@ DOMCI_NODE_DATA(HTMLInputElement, nsHTMLInputElement)
 
 // QueryInterface implementation for nsHTMLInputElement
 NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(nsHTMLInputElement)
-  NS_HTML_CONTENT_INTERFACE_TABLE9(nsHTMLInputElement,
+  NS_HTML_CONTENT_INTERFACE_TABLE8(nsHTMLInputElement,
                                    nsIDOMHTMLInputElement,
                                    nsITextControlElement,
-                                   nsIFileControlElement,
                                    nsIPhonetic,
                                    imgIDecoderObserver,
                                    nsIImageLoadingContent,
@@ -721,7 +731,14 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
       }
       break;
     case NS_FORM_INPUT_FILE:
-      it->mFileNames = mFileNames;
+      if (it->GetOwnerDoc()->IsStaticDocument()) {
+        // We're going to be used in print preview.  Since the doc is static
+        // we can just grab the pretty string and use it as wallpaper
+        GetDisplayFileName(it->mStaticDocFileList);
+      } else {
+        it->mFiles.Clear();
+        it->mFiles.AppendObjects(mFiles);
+      }
       break;
     case NS_FORM_INPUT_RADIO:
     case NS_FORM_INPUT_CHECKBOX:
@@ -1025,17 +1042,15 @@ nsHTMLInputElement::GetValue(nsAString& aValue)
 
   if (mType == NS_FORM_INPUT_FILE) {
     if (nsContentUtils::IsCallerTrustedForCapability("UniversalFileRead")) {
-      if (!mFileNames.IsEmpty()) {
-        aValue = mFileNames[0];
+      if (mFiles.Count()) {
+        return mFiles[0]->GetMozFullPath(aValue);
       }
       else {
         aValue.Truncate();
       }
     } else {
       // Just return the leaf name
-      nsCOMArray<nsIFile> files;
-      GetFileArray(files);
-      if (files.Count() == 0 || NS_FAILED(files[0]->GetLeafName(aValue))) {
+      if (mFiles.Count() == 0 || NS_FAILED(mFiles[0]->GetName(aValue))) {
         aValue.Truncate();
       }
     }
@@ -1065,10 +1080,11 @@ nsHTMLInputElement::SetValue(const nsAString& aValue)
         // UniversalFileRead privilege
         return NS_ERROR_DOM_SECURITY_ERR;
       }
-      SetSingleFileName(aValue);
+      const PRUnichar *name = PromiseFlatString(aValue).get();
+      return MozSetFileNameArray(&name, 1);
     }
     else {
-      ClearFileNames();
+      ClearFiles();
     }
   }
   else {
@@ -1087,12 +1103,14 @@ nsHTMLInputElement::MozGetFileNameArray(PRUint32 *aLength, PRUnichar ***aFileNam
     return NS_ERROR_DOM_SECURITY_ERR;
   }
 
-  *aLength = mFileNames.Length();
+  *aLength = mFiles.Count();
   PRUnichar **ret =
-    static_cast<PRUnichar **>(NS_Alloc(mFileNames.Length() * sizeof(PRUnichar*)));
+    static_cast<PRUnichar **>(NS_Alloc(mFiles.Count() * sizeof(PRUnichar*)));
   
-  for (PRUint32 i = 0; i <  mFileNames.Length(); i++) {
-    ret[i] = NS_strdup(mFileNames[i].get());
+  for (PRUint32 i = 0; i <  mFiles.Count(); i++) {
+    nsString str;
+    mFiles[i]->GetMozFullPath(str);
+    ret[i] = NS_strdup(str.get());
   }
 
   *aFileNames = ret;
@@ -1109,12 +1127,36 @@ nsHTMLInputElement::MozSetFileNameArray(const PRUnichar **aFileNames, PRUint32 a
     return NS_ERROR_DOM_SECURITY_ERR;
   }
 
-  nsTArray<nsString> fileNames(aLength);
+  nsCOMArray<nsIDOMFile> files;
   for (PRUint32 i = 0; i < aLength; ++i) {
-    fileNames.AppendElement(aFileNames[i]);
+    nsCOMPtr<nsIFile> file;
+    if (StringBeginsWith(nsDependentString(aFileNames[i]),
+                         NS_LITERAL_STRING("file:"),
+                         nsASCIICaseInsensitiveStringComparator())) {
+      // Converts the URL string into the corresponding nsIFile if possible
+      // A local file will be created if the URL string begins with file://
+      NS_GetFileFromURLSpec(NS_ConvertUTF16toUTF8(aFileNames[i]),
+                            getter_AddRefs(file));
+    }
+
+    if (!file) {
+      // this is no "file://", try as local file
+      nsCOMPtr<nsILocalFile> localFile;
+      NS_NewLocalFile(nsDependentString(aFileNames[i]),
+                      PR_FALSE, getter_AddRefs(localFile));
+      file = do_QueryInterface(localFile);
+    }
+
+    if (file) {
+      nsCOMPtr<nsIDOMFile> domFile = new nsDOMFile(file, GetOwnerDoc());
+      files.AppendObject(domFile);
+    } else {
+      continue; // Not much we can do if the file doesn't exist
+    }
+
   }
 
-  SetFileNames(fileNames);
+  SetFiles(files);
 
   return NS_OK;
 }
@@ -1136,7 +1178,8 @@ nsHTMLInputElement::SetUserInput(const nsAString& aValue)
 
   if (mType == NS_FORM_INPUT_FILE)
   {
-    SetSingleFileName(aValue);
+    const PRUnichar* name = PromiseFlatString(aValue).get();
+    return MozSetFileNameArray(&name, 1);
   } else {
     SetValueInternal(aValue, PR_TRUE, PR_TRUE);
   }
@@ -1241,28 +1284,32 @@ nsHTMLInputElement::SetPlaceholderClass(PRBool aVisible, PRBool aNotify)
 }
 
 void
-nsHTMLInputElement::GetDisplayFileName(nsAString& aValue)
+nsHTMLInputElement::GetDisplayFileName(nsAString& aValue) const
 {
+  if (GetOwnerDoc()->IsStaticDocument()) {
+    aValue = mStaticDocFileList;
+    return;
+  }
+
   aValue.Truncate();
-  for (PRUint32 i = 0; i < mFileNames.Length(); ++i) {
+  for (PRUint32 i = 0; i < (PRUint32)mFiles.Count(); ++i) {
+    nsString str;
+    mFiles[i]->GetMozFullPath(str);
     if (i == 0) {
-      aValue.Append(mFileNames[i]);
+      aValue.Append(str);
     }
     else {
-      aValue.Append(NS_LITERAL_STRING(", ") + mFileNames[i]);
+      aValue.Append(NS_LITERAL_STRING(", ") + str);
     }
   }
 }
 
 void
-nsHTMLInputElement::SetFileNames(const nsTArray<nsString>& aFileNames)
+nsHTMLInputElement::SetFiles(const nsCOMArray<nsIDOMFile>& aFiles)
 {
-  mFileNames = aFileNames;
-#if DEBUG
-  for (PRUint32 i = 0; i < (PRUint32)aFileNames.Length(); ++i) {
-    NS_ASSERTION(!aFileNames[i].IsEmpty(), "Empty file name");
-  }
-#endif
+  mFiles.Clear();
+  mFiles.AppendObjects(aFiles);
+
   // No need to flush here, if there's no frame at this point we
   // don't need to force creation of one just to tell it about this
   // new value.  We just want the display to update as needed.
@@ -1279,37 +1326,10 @@ nsHTMLInputElement::SetFileNames(const nsTArray<nsString>& aFileNames)
   UpdateAllValidityStates(PR_TRUE);
 }
 
-void
-nsHTMLInputElement::GetFileArray(nsCOMArray<nsIFile> &aFiles)
+const nsCOMArray<nsIDOMFile>&
+nsHTMLInputElement::GetFiles()
 {
-  aFiles.Clear();
-
-  if (mType != NS_FORM_INPUT_FILE) {
-    return;
-  }
-
-  for (PRUint32 i = 0; i < mFileNames.Length(); ++i) {
-    nsCOMPtr<nsIFile> file;
-    if (StringBeginsWith(mFileNames[i], NS_LITERAL_STRING("file:"),
-                         nsCaseInsensitiveStringComparator())) {
-      // Converts the URL string into the corresponding nsIFile if possible.
-      // A local file will be created if the URL string begins with file://.
-      NS_GetFileFromURLSpec(NS_ConvertUTF16toUTF8(mFileNames[i]),
-                            getter_AddRefs(file));
-    }
-
-    if (!file) {
-      // this is no "file://", try as local file
-      nsCOMPtr<nsILocalFile> localFile;
-      NS_NewLocalFile(mFileNames[i], PR_FALSE, getter_AddRefs(localFile));
-      // Wish there was a better way to downcast an already_AddRefed
-      file = dont_AddRef(static_cast<nsIFile*>(localFile.forget().get()));
-    }
-
-    if (file) {
-      aFiles.AppendObject(file);
-    }
-  }
+  return mFiles;
 }
 
 nsresult
@@ -1318,16 +1338,10 @@ nsHTMLInputElement::UpdateFileList()
   if (mFileList) {
     mFileList->Clear();
 
-    nsIDocument* doc = GetOwnerDoc();
-
-    nsCOMArray<nsIFile> files;
-    GetFileArray(files);
+    const nsCOMArray<nsIDOMFile>& files = GetFiles();
     for (PRUint32 i = 0; i < (PRUint32)files.Count(); ++i) {
-      nsRefPtr<nsDOMFile> domFile = new nsDOMFile(files[i], doc);
-      if (domFile) {
-        if (!mFileList->Append(domFile)) {
-          return NS_ERROR_FAILURE;
-        }
+      if (!mFileList->Append(files[i])) {
+        return NS_ERROR_FAILURE;
       }
     }
   }
@@ -1819,7 +1833,7 @@ nsHTMLInputElement::Click()
       nsEventStatus status = nsEventStatus_eIgnore;
 
       SET_BOOLBIT(mBitField, BF_HANDLING_CLICK, PR_TRUE);
-      if (mType == NS_FORM_INPUT_FILE){
+      if (mType == NS_FORM_INPUT_FILE){
         FireAsyncClickHandler();
       }
       nsEventDispatcher::Dispatch(static_cast<nsIContent*>(this), context,
@@ -2561,7 +2575,7 @@ nsHTMLInputElement::ParseAttribute(PRInt32 aNamespaceID,
           // This call isn't strictly needed any more since we'll never
           // confuse values and filenames. However it's there for backwards
           // compat.
-          ClearFileNames();
+          ClearFiles();
         }
 
         HandleTypeChange(newType);
@@ -2882,7 +2896,7 @@ nsHTMLInputElement::SetDefaultValueAsValue()
     case NS_FORM_INPUT_FILE:
     {
       // Resetting it to blank should not perform security check
-      ClearFileNames();
+      ClearFiles();
       break;
     }
     // Value is the same as defaultValue for hidden inputs
@@ -3007,8 +3021,7 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   if (mType == NS_FORM_INPUT_FILE) {
     // Submit files
 
-    nsCOMArray<nsIFile> files;
-    GetFileArray(files);
+    const nsCOMArray<nsIDOMFile>& files = GetFiles();
 
     for (PRUint32 i = 0; i < (PRUint32)files.Count(); ++i) {
       aFormSubmission->AddNameFilePair(name, files[i]);
@@ -3100,13 +3113,13 @@ nsHTMLInputElement::SaveState()
     }
     case NS_FORM_INPUT_FILE:
       {
-        if (!mFileNames.IsEmpty()) {
+        if (mFiles.Count()) {
           inputState = new nsHTMLInputElementState();
           if (!inputState) {
             return NS_ERROR_OUT_OF_MEMORY;
           }
 
-          inputState->SetFilenames(mFileNames);
+          inputState->SetFiles(mFiles);
         }
         break;
       }
@@ -3253,7 +3266,8 @@ nsHTMLInputElement::RestoreState(nsPresState* aState)
         }
       case NS_FORM_INPUT_FILE:
         {
-          SetFileNames(inputState->GetFilenames());
+          const nsCOMArray<nsIDOMFile>& files = inputState->GetFiles();
+          SetFiles(files);
           break;
         }
     }
@@ -3662,8 +3676,7 @@ nsHTMLInputElement::IsValueMissing()
       }
     case NS_FORM_INPUT_FILE:
       {
-        nsCOMArray<nsIFile> files;
-        GetFileArray(files);
+        const nsCOMArray<nsIDOMFile>& files = GetFiles();
         return !files.Count();
       }
     default:
diff --git a/content/html/content/src/nsHTMLInputElement.h b/content/html/content/src/nsHTMLInputElement.h
index 4161a7b55243..5864a7cfd183 100644
--- a/content/html/content/src/nsHTMLInputElement.h
+++ b/content/html/content/src/nsHTMLInputElement.h
@@ -1,80 +1,83 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Communicator client code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Pierre Phaneuf <pp@ludusdesign.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nsHTMLInputElement_h__
-#define nsHTMLInputElement_h__
-
-#include "nsGenericHTMLElement.h"
-#include "nsImageLoadingContent.h"
-#include "nsIDOMHTMLInputElement.h"
-#include "nsITextControlElement.h"
-#include "nsIPhonetic.h"
-#include "nsIDOMNSEditableElement.h"
-#include "nsIFileControlElement.h"
-
-#include "nsTextEditorState.h"
-#include "nsCOMPtr.h"
-#include "nsIConstraintValidation.h"
-
-//
-// Accessors for mBitField
-//
-#define BF_DISABLED_CHANGED 0
-#define BF_HANDLING_CLICK 1
-#define BF_VALUE_CHANGED 2
-#define BF_CHECKED_CHANGED 3
-#define BF_CHECKED 4
-#define BF_HANDLING_SELECT_EVENT 5
-#define BF_SHOULD_INIT_CHECKED 6
-#define BF_PARSER_CREATING 7
-#define BF_IN_INTERNAL_ACTIVATE 8
-#define BF_CHECKED_IS_TOGGLED 9
-#define BF_INDETERMINATE 10
-#define BF_INHIBIT_RESTORATION 11
-
-#define GET_BOOLBIT(bitfield, field) (((bitfield) & (0x01 << (field))) \
-                                        ? PR_TRUE : PR_FALSE)
-#define SET_BOOLBIT(bitfield, field, b) ((b) \
-                                        ? ((bitfield) |=  (0x01 << (field))) \
-                                        : ((bitfield) &= ~(0x01 << (field))))
-
-class nsDOMFileList;
-
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Communicator client code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Pierre Phaneuf <pp@ludusdesign.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsHTMLInputElement_h__
+#define nsHTMLInputElement_h__
+
+#include "nsGenericHTMLElement.h"
+#include "nsImageLoadingContent.h"
+#include "nsIDOMHTMLInputElement.h"
+#include "nsITextControlElement.h"
+#include "nsIPhonetic.h"
+#include "nsIDOMNSEditableElement.h"
+
+#include "nsTextEditorState.h"
+#include "nsCOMPtr.h"
+#include "nsIConstraintValidation.h"
+#include "nsDOMFile.h"
+
+//
+// Accessors for mBitField
+//
+#define BF_DISABLED_CHANGED 0
+#define BF_HANDLING_CLICK 1
+#define BF_VALUE_CHANGED 2
+#define BF_CHECKED_CHANGED 3
+#define BF_CHECKED 4
+#define BF_HANDLING_SELECT_EVENT 5
+#define BF_SHOULD_INIT_CHECKED 6
+#define BF_PARSER_CREATING 7
+#define BF_IN_INTERNAL_ACTIVATE 8
+#define BF_CHECKED_IS_TOGGLED 9
+#define BF_INDETERMINATE 10
+#define BF_INHIBIT_RESTORATION 11
+
+#define GET_BOOLBIT(bitfield, field) (((bitfield) & (0x01 << (field))) \
+                                        ? PR_TRUE : PR_FALSE)
+#define SET_BOOLBIT(bitfield, field, b) ((b) \
+                                        ? ((bitfield) |=  (0x01 << (field))) \
+                                        : ((bitfield) &= ~(0x01 << (field))))
+
+class nsDOMFileList;
+class nsIRadioGroupContainer;
+class nsIRadioGroupVisitor;
+class nsIRadioVisitor;
+
 class UploadLastDir : public nsIObserver, public nsSupportsWeakReference {
 public:
   NS_DECL_ISUPPORTS
@@ -103,451 +106,460 @@ private:
   // Directories are stored here during private browsing mode
   nsInterfaceHashtable<nsStringHashKey, nsILocalFile> mUploadLastDirStore;
   PRBool mInPrivateBrowsing;
-};
-
-class nsIRadioGroupContainer;
-class nsIRadioVisitor;
-
-class nsHTMLInputElement : public nsGenericHTMLFormElement,
-                           public nsImageLoadingContent,
-                           public nsIDOMHTMLInputElement,
-                           public nsITextControlElement,
-                           public nsIPhonetic,
-                           public nsIDOMNSEditableElement,
-                           public nsIFileControlElement,
-                           public nsIConstraintValidation
-{
-public:
+};
+
+class nsIRadioGroupContainer;
+class nsIRadioVisitor;
+
+class nsHTMLInputElement : public nsGenericHTMLFormElement,
+                           public nsImageLoadingContent,
+                           public nsIDOMHTMLInputElement,
+                           public nsITextControlElement,
+                           public nsIPhonetic,
+                           public nsIDOMNSEditableElement,
+                           public nsIConstraintValidation
+{
+public:
   using nsIConstraintValidation::GetValidationMessage;
 
-  nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
-                     PRUint32 aFromParser);
-  virtual ~nsHTMLInputElement();
-
-  // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
-
-  // nsIDOMNode
-  NS_FORWARD_NSIDOMNODE(nsGenericHTMLFormElement::)
-
-  // nsIDOMElement
-  NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLFormElement::)
-
-  // nsIDOMHTMLElement
-  NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLFormElement::)
-
-  // nsIDOMHTMLInputElement
-  NS_DECL_NSIDOMHTMLINPUTELEMENT
-
-  // nsIPhonetic
-  NS_DECL_NSIPHONETIC
-
-  // nsIDOMNSEditableElement
-  NS_IMETHOD GetEditor(nsIEditor** aEditor)
-  {
-    return nsGenericHTMLElement::GetEditor(aEditor);
-  }
-  NS_IMETHOD SetUserInput(const nsAString& aInput);
-
-  // Overriden nsIFormControl methods
-  NS_IMETHOD_(PRUint32) GetType() const { return mType; }
-  NS_IMETHOD Reset();
-  NS_IMETHOD SubmitNamesValues(nsFormSubmission* aFormSubmission);
-  NS_IMETHOD SaveState();
-  virtual PRBool RestoreState(nsPresState* aState);
-  virtual PRBool AllowDrop();
-
-  // nsIContent
-  virtual PRBool IsHTMLFocusable(PRBool aWithMouse, PRBool *aIsFocusable, PRInt32 *aTabIndex);
-
-  virtual PRBool ParseAttribute(PRInt32 aNamespaceID,
-                                nsIAtom* aAttribute,
-                                const nsAString& aValue,
-                                nsAttrValue& aResult);
-  virtual nsChangeHint GetAttributeChangeHint(const nsIAtom* aAttribute,
-                                              PRInt32 aModType) const;
-  NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
-  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
-
-  virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
-  virtual nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor);
-
-  virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
-                              nsIContent* aBindingParent,
-                              PRBool aCompileEventHandlers);
-  virtual void UnbindFromTree(PRBool aDeep = PR_TRUE,
-                              PRBool aNullParent = PR_TRUE);
-
-  virtual void DoneCreatingElement();
-
-  virtual PRInt32 IntrinsicState() const;
-
-  // nsITextControlElement
-  NS_IMETHOD SetValueChanged(PRBool aValueChanged);
-  NS_IMETHOD_(PRBool) IsSingleLineTextControl() const;
-  NS_IMETHOD_(PRBool) IsTextArea() const;
-  NS_IMETHOD_(PRBool) IsPlainTextControl() const;
-  NS_IMETHOD_(PRBool) IsPasswordTextControl() const;
-  NS_IMETHOD_(PRInt32) GetCols();
-  NS_IMETHOD_(PRInt32) GetWrapCols();
-  NS_IMETHOD_(PRInt32) GetRows();
-  NS_IMETHOD_(void) GetDefaultValueFromContent(nsAString& aValue);
-  NS_IMETHOD_(PRBool) ValueChanged() const;
-  NS_IMETHOD_(void) GetTextEditorValue(nsAString& aValue, PRBool aIgnoreWrap) const;
-  NS_IMETHOD_(void) SetTextEditorValue(const nsAString& aValue, PRBool aUserInput);
-  NS_IMETHOD_(nsIEditor*) GetTextEditor();
-  NS_IMETHOD_(nsISelectionController*) GetSelectionController();
-  NS_IMETHOD_(nsFrameSelection*) GetConstFrameSelection();
-  NS_IMETHOD BindToFrame(nsTextControlFrame* aFrame);
-  NS_IMETHOD_(void) UnbindFromFrame(nsTextControlFrame* aFrame);
-  NS_IMETHOD CreateEditor();
-  NS_IMETHOD_(nsIContent*) GetRootEditorNode();
-  NS_IMETHOD_(nsIContent*) GetPlaceholderNode();
-  NS_IMETHOD_(void) UpdatePlaceholderText(PRBool aNotify);
-  NS_IMETHOD_(void) SetPlaceholderClass(PRBool aVisible, PRBool aNotify);
-  NS_IMETHOD_(void) InitializeKeyboardEventListeners();
-  NS_IMETHOD_(void) OnValueChanged(PRBool aNotify);
-
-  // nsIFileControlElement
-  virtual void GetDisplayFileName(nsAString& aFileName);
-  virtual void GetFileArray(nsCOMArray<nsIFile> &aFile);
-  virtual void SetFileNames(const nsTArray<nsString>& aFileNames);
-
-  void SetCheckedChangedInternal(PRBool aCheckedChanged);
-  PRBool GetCheckedChanged();
-  void AddedToRadioGroup(PRBool aNotify = PR_TRUE);
-  void WillRemoveFromRadioGroup(PRBool aNotify);
-  /**
-   * Get the radio group container for this button (form or document)
-   * @return the radio group container (or null if no form or document)
-   */
-  virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer();
-
- /**
-   * Helper function returning the currently selected button in the radio group.
-   * Returning null if the element is not a button or if there is no selectied
-   * button in the group.
-   *
-   * @return the selected button (or null).
-   */
-  already_AddRefed<nsIDOMHTMLInputElement> GetSelectedRadioButton();
-
-  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
-
-  NS_IMETHOD FireAsyncClickHandler();
-
-  virtual void UpdateEditableState()
-  {
-    return UpdateEditableFormControlState();
-  }
-
-  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED_NO_UNLINK(nsHTMLInputElement,
-                                                     nsGenericHTMLFormElement)
-
-  static UploadLastDir* gUploadLastDir;
+  nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
+                     PRUint32 aFromParser);
+  virtual ~nsHTMLInputElement();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // nsIDOMNode
+  NS_FORWARD_NSIDOMNODE(nsGenericHTMLFormElement::)
+
+  // nsIDOMElement
+  NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLFormElement::)
+
+  // nsIDOMHTMLElement
+  NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLFormElement::)
+
+  // nsIDOMHTMLInputElement
+  NS_DECL_NSIDOMHTMLINPUTELEMENT
+
+  // nsIPhonetic
+  NS_DECL_NSIPHONETIC
+
+  // nsIDOMNSEditableElement
+  NS_IMETHOD GetEditor(nsIEditor** aEditor)
+  {
+    return nsGenericHTMLElement::GetEditor(aEditor);
+  }
+  NS_IMETHOD SetUserInput(const nsAString& aInput);
+
+  // Overriden nsIFormControl methods
+  NS_IMETHOD_(PRUint32) GetType() const { return mType; }
+  NS_IMETHOD Reset();
+  NS_IMETHOD SubmitNamesValues(nsFormSubmission* aFormSubmission);
+  NS_IMETHOD SaveState();
+  virtual PRBool RestoreState(nsPresState* aState);
+  virtual PRBool AllowDrop();
+
+  // nsIContent
+  virtual PRBool IsHTMLFocusable(PRBool aWithMouse, PRBool *aIsFocusable, PRInt32 *aTabIndex);
+
+  virtual PRBool ParseAttribute(PRInt32 aNamespaceID,
+                                nsIAtom* aAttribute,
+                                const nsAString& aValue,
+                                nsAttrValue& aResult);
+  virtual nsChangeHint GetAttributeChangeHint(const nsIAtom* aAttribute,
+                                              PRInt32 aModType) const;
+  NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
+  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
+
+  virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
+  virtual nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor);
+
+  virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
+                              nsIContent* aBindingParent,
+                              PRBool aCompileEventHandlers);
+  virtual void UnbindFromTree(PRBool aDeep = PR_TRUE,
+                              PRBool aNullParent = PR_TRUE);
+
+  virtual void DoneCreatingElement();
+
+  virtual PRInt32 IntrinsicState() const;
+
+  // nsITextControlElement
+  NS_IMETHOD SetValueChanged(PRBool aValueChanged);
+  NS_IMETHOD_(PRBool) IsSingleLineTextControl() const;
+  NS_IMETHOD_(PRBool) IsTextArea() const;
+  NS_IMETHOD_(PRBool) IsPlainTextControl() const;
+  NS_IMETHOD_(PRBool) IsPasswordTextControl() const;
+  NS_IMETHOD_(PRInt32) GetCols();
+  NS_IMETHOD_(PRInt32) GetWrapCols();
+  NS_IMETHOD_(PRInt32) GetRows();
+  NS_IMETHOD_(void) GetDefaultValueFromContent(nsAString& aValue);
+  NS_IMETHOD_(PRBool) ValueChanged() const;
+  NS_IMETHOD_(void) GetTextEditorValue(nsAString& aValue, PRBool aIgnoreWrap) const;
+  NS_IMETHOD_(void) SetTextEditorValue(const nsAString& aValue, PRBool aUserInput);
+  NS_IMETHOD_(nsIEditor*) GetTextEditor();
+  NS_IMETHOD_(nsISelectionController*) GetSelectionController();
+  NS_IMETHOD_(nsFrameSelection*) GetConstFrameSelection();
+  NS_IMETHOD BindToFrame(nsTextControlFrame* aFrame);
+  NS_IMETHOD_(void) UnbindFromFrame(nsTextControlFrame* aFrame);
+  NS_IMETHOD CreateEditor();
+  NS_IMETHOD_(nsIContent*) GetRootEditorNode();
+  NS_IMETHOD_(nsIContent*) GetPlaceholderNode();
+  NS_IMETHOD_(void) UpdatePlaceholderText(PRBool aNotify);
+  NS_IMETHOD_(void) SetPlaceholderClass(PRBool aVisible, PRBool aNotify);
+  NS_IMETHOD_(void) InitializeKeyboardEventListeners();
+  NS_IMETHOD_(void) OnValueChanged(PRBool aNotify);
+
+  // nsIFileControlElement
+  void GetDisplayFileName(nsAString& aFileName) const;
+  const nsCOMArray<nsIDOMFile>& GetFiles();
+  void SetFiles(const nsCOMArray<nsIDOMFile>& aFiles);
+
+  void SetCheckedChangedInternal(PRBool aCheckedChanged);
+  PRBool GetCheckedChanged();
+  void AddedToRadioGroup(PRBool aNotify = PR_TRUE);
+  void WillRemoveFromRadioGroup(PRBool aNotify);
+  /**
+   * Get the radio group container for this button (form or document)
+   * @return the radio group container (or null if no form or document)
+   */
+  virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer();
+
+ /**
+   * Helper function returning the currently selected button in the radio group.
+   * Returning null if the element is not a button or if there is no selectied
+   * button in the group.
+   *
+   * @return the selected button (or null).
+   */
+  already_AddRefed<nsIDOMHTMLInputElement> GetSelectedRadioButton();
+
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
+
+  NS_IMETHOD FireAsyncClickHandler();
+
+  virtual void UpdateEditableState()
+  {
+    return UpdateEditableFormControlState();
+  }
+
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED_NO_UNLINK(nsHTMLInputElement,
+                                                     nsGenericHTMLFormElement)
+
+  static UploadLastDir* gUploadLastDir;
   // create and destroy the static UploadLastDir object for remembering
   // which directory was last used on a site-by-site basis
   static void InitUploadLastDir();
-  static void DestroyUploadLastDir();
-
-  void MaybeLoadImage();
-
-  virtual nsXPCClassInfo* GetClassInfo();
-
-  // nsIConstraintValidation
-  PRBool   IsTooLong();
-  PRBool   IsValueMissing();
-  PRBool   HasTypeMismatch();
-  PRBool   HasPatternMismatch();
-  void     UpdateTooLongValidityState();
-  void     UpdateValueMissingValidityState();
-  void     UpdateTypeMismatchValidityState();
-  void     UpdatePatternMismatchValidityState();
-  void     UpdateAllValidityStates(PRBool aNotify);
-  PRBool   IsBarredFromConstraintValidation() const;
-  nsresult GetValidationMessage(nsAString& aValidationMessage,
-                                ValidityStateType aType);
-
-protected:
-  // Pull IsSingleLineTextControl into our scope, otherwise it'd be hidden
-  // by the nsITextControlElement version.
-  using nsGenericHTMLFormElement::IsSingleLineTextControl;
-
-  /**
-   * The ValueModeType specifies how the value IDL attribute should behave.
-   *
-   * See: http://dev.w3.org/html5/spec/forms.html#dom-input-value
-   */
-  enum ValueModeType
-  {
-    // On getting, returns the value.
-    // On setting, sets value.
-    VALUE_MODE_VALUE,
-    // On getting, returns the value if present or the empty string.
-    // On setting, sets the value.
-    VALUE_MODE_DEFAULT,
-    // On getting, returns the value if present or "on".
-    // On setting, sets the value.
-    VALUE_MODE_DEFAULT_ON,
-    // On getting, returns "C:\fakepath\" followed by the file name of the
-    // first file of the selected files if any.
-    // On setting the empty string, empties the selected files list, otherwise
-    // throw the INVALID_STATE_ERR exception.
-    VALUE_MODE_FILENAME
-  };
-
-  /**
-   * This helper method returns true if aValue is a valid email address.
-   * This is following the HTML5 specification:
-   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address
-   *
-   * @param aValue  the email address to check.
-   * @result        whether the given string is a valid email address.
-   */
-  static PRBool IsValidEmailAddress(const nsAString& aValue);
-
-  /**
-   * This helper method returns true if aValue is a valid email address list.
-   * Email address list is a list of email address separated by comas (,) which
-   * can be surrounded by space charecters.
-   * This is following the HTML5 specification:
-   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address-list
-   *
-   * @param aValue  the email address list to check.
-   * @result        whether the given string is a valid email address list.
-   */
-  static PRBool IsValidEmailAddressList(const nsAString& aValue);
-
-  /**
-   * This helper method returns true if the aPattern pattern matches aValue.
-   * aPattern should not contain leading and trailing slashes (/).
-   * The pattern has to match the entire value not just a subset.
-   * aDocument must be a valid pointer (not null).
-   *
-   * This is following the HTML5 specification:
-   * http://dev.w3.org/html5/spec/forms.html#attr-input-pattern
-   *
-   * @param aValue    the string to check.
-   * @param aPattern  the string defining the pattern.
-   * @param aDocument the owner document of the element.
-   * @result          whether the given string is matches the pattern.
-   */
-  static PRBool IsPatternMatching(nsAString& aValue, nsAString& aPattern,
-                                  nsIDocument* aDocument);
-
-  // Helper method
-  nsresult SetValueInternal(const nsAString& aValue,
-                            PRBool aUserInput,
-                            PRBool aSetValueChanged);
-
-  void ClearFileNames() {
-    nsTArray<nsString> fileNames;
-    SetFileNames(fileNames);
-  }
-
-  void SetSingleFileName(const nsAString& aFileName) {
-    nsAutoTArray<nsString, 1> fileNames;
-    fileNames.AppendElement(aFileName);
-    SetFileNames(fileNames);
-  }
-
-  nsresult SetIndeterminateInternal(PRBool aValue,
-                                    PRBool aShouldInvalidate);
-
-  nsresult GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelectionEnd);
-
-  /**
-   * Get the name if it exists and return whether it did exist
-   * @param aName the name returned [OUT]
-   * @param true if the name is empty, false otherwise
-   */
-  PRBool GetNameIfExists(nsAString& aName) {
-    GetAttr(kNameSpaceID_None, nsGkAtoms::name, aName);
-    return !aName.IsEmpty();
-  }
-
-  /**
-   * Called when an attribute is about to be changed
-   */
-  virtual nsresult BeforeSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                                 const nsAString* aValue, PRBool aNotify);
-  /**
-   * Called when an attribute has just been changed
-   */
-  virtual nsresult AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                                const nsAString* aValue, PRBool aNotify);
-
-  /**
-   * Dispatch a select event. Returns true if the event was not cancelled.
-   */
-  PRBool DispatchSelectEvent(nsPresContext* aPresContext);
-
-  void SelectAll(nsPresContext* aPresContext);
-  PRBool IsImage() const
-  {
-    return AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
-                       nsGkAtoms::image, eIgnoreCase);
-  }
-
-  virtual PRBool AcceptAutofocus() const
-  {
-    return PR_TRUE;
-  }
-
-  /**
-   * Fire the onChange event
-   */
-  void FireOnChange();
-
-  /**
-   * Visit a the group of radio buttons this radio belongs to
-   * @param aVisitor the visitor to visit with
-   */
-  nsresult VisitGroup(nsIRadioVisitor* aVisitor, PRBool aFlushContent);
-
-  /**
-   * Do all the work that |SetChecked| does (radio button handling, etc.), but
-   * take an |aNotify| parameter.
-   */
-  nsresult DoSetChecked(PRBool aValue, PRBool aNotify, PRBool aSetValueChanged);
-
-  /**
-   * Do all the work that |SetCheckedChanged| does (radio button handling,
-   * etc.), but take an |aNotify| parameter that lets it avoid flushing content
-   * when it can.
-   */
-  void DoSetCheckedChanged(PRBool aCheckedChanged, PRBool aNotify);
-
-  /**
-   * Actually set checked and notify the frame of the change.
-   * @param aValue the value of checked to set
-   */
-  void SetCheckedInternal(PRBool aValue, PRBool aNotify);
-
-  /**
-   * Syntax sugar to make it easier to check for checked
-   */
-  PRBool GetChecked() const
-  {
-    return GET_BOOLBIT(mBitField, BF_CHECKED);
-  }
-
-  nsresult RadioSetChecked(PRBool aNotify);
-  void SetCheckedChanged(PRBool aCheckedChanged);
-
-  /**
-   * MaybeSubmitForm looks for a submit input or a single text control
-   * and submits the form if either is present.
-   */
-  nsresult MaybeSubmitForm(nsPresContext* aPresContext);
-
-  /**
-   * Update mFileList with the currently selected file.
-   */
-  nsresult UpdateFileList();
-
-  /**
-   * Determine whether the editor needs to be initialized explicitly for
-   * a particular event.
-   */
-  PRBool NeedToInitializeEditorForEvent(nsEventChainPreVisitor& aVisitor) const;
-
-  /**
-   * Get the value mode of the element, depending of the type.
-   */
-  ValueModeType GetValueMode() const;
-
-  /**
-   * Get the mutable state of the element.
-   * When the element isn't mutable (immutable), the value or checkedness
-   * should not be changed by the user.
-   *
-   * See: http://dev.w3.org/html5/spec/forms.html#concept-input-mutable
-   */
-  PRBool IsMutable() const;
-
-  /**
-   * Returns if the readonly attribute applies for the current type.
-   */
-  PRBool DoesReadOnlyApply() const;
-
-  /**
-   * Returns if the required attribute applies for the current type.
-   */
-  PRBool DoesRequiredApply() const;
-
-  /**
-   * Returns if the pattern attribute applies for the current type.
-   */
-  PRBool DoesPatternApply() const;
-
-  void FreeData();
-  nsTextEditorState *GetEditorState() const;
-
-  /**
-   * Manages the internal data storage across type changes.
-   */
-  void HandleTypeChange(PRUint8 aNewType);
-
-  /**
-   * Sanitize the value of the element depending of its current type.
-   * See: http://www.whatwg.org/specs/web-apps/current-work/#value-sanitization-algorithm
-   */
-  void SanitizeValue(nsAString& aValue);
-
-  /**
-   * Returns whether the placeholder attribute applies for the current type.
-   */
-  bool PlaceholderApplies() const { return IsSingleLineTextControlInternal(PR_FALSE, mType); }
-
-  /**
-   * Set the current default value to the value of the input element.
-   */
-  nsresult SetDefaultValueAsValue();
-
-  nsCOMPtr<nsIControllers> mControllers;
-
-  /**
-   * The type of this input (<input type=...>) as an integer.
-   * @see nsIFormControl.h (specifically NS_FORM_INPUT_*)
-   */
-  PRUint8                  mType;
-  /**
-   * A bitfield containing our booleans
-   * @see GET_BOOLBIT / SET_BOOLBIT macros and BF_* field identifiers
-   */
-  PRInt16                  mBitField;
-  /*
-   * In mInputData, the mState field is used if IsSingleLineTextControl returns
-   * true and mValue is used otherwise.  We have to be careful when handling it
-   * on a type change.
-   *
-   * Accessing the mState member should be done using the GetEditorState function,
-   * which returns null if the state is not present.
-   */
-  union InputData {
-    /**
-     * The current value of the input if it has been changed from the default
-     */
-    char*                    mValue;
-    /**
-     * The state of the text editor associated with the text/password input
-     */
-    nsTextEditorState*       mState;
-  } mInputData;
-  /**
-   * The value of the input if it is a file input. This is the list of filenames
-   * used when uploading a file. It is vital that this is kept separate from
-   * mValue so that it won't be possible to 'leak' the value from a text-input
-   * to a file-input. Additionally, the logic for this value is kept as simple
-   * as possible to avoid accidental errors where the wrong filename is used.
-   * Therefor the list of filenames is always owned by this member, never by
-   * the frame. Whenever the frame wants to change the filename it has to call
-   * SetFileNames to update this member.
-   */
-  nsTArray<nsString>       mFileNames;
-
-  nsRefPtr<nsDOMFileList>  mFileList;
-};
-
-#endif
+  static void DestroyUploadLastDir();
+
+  void MaybeLoadImage();
+
+  virtual nsXPCClassInfo* GetClassInfo();
+
+  static nsHTMLInputElement* FromContent(nsIContent *aContent)
+  {
+    if (aContent->NodeInfo()->Equals(nsGkAtoms::input, kNameSpaceID_XHTML))
+      return static_cast<nsHTMLInputElement*>(aContent);
+    return NULL;
+  }
+
+  // nsIConstraintValidation
+  PRBool   IsTooLong();
+  PRBool   IsValueMissing();
+  PRBool   HasTypeMismatch();
+  PRBool   HasPatternMismatch();
+  void     UpdateTooLongValidityState();
+  void     UpdateValueMissingValidityState();
+  void     UpdateTypeMismatchValidityState();
+  void     UpdatePatternMismatchValidityState();
+  void     UpdateAllValidityStates(PRBool aNotify);
+  PRBool   IsBarredFromConstraintValidation() const;
+  nsresult GetValidationMessage(nsAString& aValidationMessage,
+                                ValidityStateType aType);
+
+protected:
+  // Pull IsSingleLineTextControl into our scope, otherwise it'd be hidden
+  // by the nsITextControlElement version.
+  using nsGenericHTMLFormElement::IsSingleLineTextControl;
+
+  /**
+   * The ValueModeType specifies how the value IDL attribute should behave.
+   *
+   * See: http://dev.w3.org/html5/spec/forms.html#dom-input-value
+   */
+  enum ValueModeType
+  {
+    // On getting, returns the value.
+    // On setting, sets value.
+    VALUE_MODE_VALUE,
+    // On getting, returns the value if present or the empty string.
+    // On setting, sets the value.
+    VALUE_MODE_DEFAULT,
+    // On getting, returns the value if present or "on".
+    // On setting, sets the value.
+    VALUE_MODE_DEFAULT_ON,
+    // On getting, returns "C:\fakepath\" followed by the file name of the
+    // first file of the selected files if any.
+    // On setting the empty string, empties the selected files list, otherwise
+    // throw the INVALID_STATE_ERR exception.
+    VALUE_MODE_FILENAME
+  };
+
+  /**
+   * This helper method returns true if aValue is a valid email address.
+   * This is following the HTML5 specification:
+   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address
+   *
+   * @param aValue  the email address to check.
+   * @result        whether the given string is a valid email address.
+   */
+  static PRBool IsValidEmailAddress(const nsAString& aValue);
+
+  /**
+   * This helper method returns true if aValue is a valid email address list.
+   * Email address list is a list of email address separated by comas (,) which
+   * can be surrounded by space charecters.
+   * This is following the HTML5 specification:
+   * http://dev.w3.org/html5/spec/forms.html#valid-e-mail-address-list
+   *
+   * @param aValue  the email address list to check.
+   * @result        whether the given string is a valid email address list.
+   */
+  static PRBool IsValidEmailAddressList(const nsAString& aValue);
+
+  /**
+   * This helper method returns true if the aPattern pattern matches aValue.
+   * aPattern should not contain leading and trailing slashes (/).
+   * The pattern has to match the entire value not just a subset.
+   * aDocument must be a valid pointer (not null).
+   *
+   * This is following the HTML5 specification:
+   * http://dev.w3.org/html5/spec/forms.html#attr-input-pattern
+   *
+   * @param aValue    the string to check.
+   * @param aPattern  the string defining the pattern.
+   * @param aDocument the owner document of the element.
+   * @result          whether the given string is matches the pattern.
+   */
+  static PRBool IsPatternMatching(nsAString& aValue, nsAString& aPattern,
+                                  nsIDocument* aDocument);
+
+  // Helper method
+  nsresult SetValueInternal(const nsAString& aValue,
+                            PRBool aUserInput,
+                            PRBool aSetValueChanged);
+
+  void ClearFiles() {
+    nsCOMArray<nsIDOMFile> files;
+    SetFiles(files);
+  }
+
+  void SetSingleFile(nsIDOMFile* aFile) {
+    nsCOMArray<nsIDOMFile> files;
+    nsCOMPtr<nsIDOMFile> file = aFile;
+    files.AppendObject(file);
+    SetFiles(files);
+  }
+
+  nsresult SetIndeterminateInternal(PRBool aValue,
+                                    PRBool aShouldInvalidate);
+
+  nsresult GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelectionEnd);
+
+  /**
+   * Get the name if it exists and return whether it did exist
+   * @param aName the name returned [OUT]
+   * @param true if the name is empty, false otherwise
+   */
+  PRBool GetNameIfExists(nsAString& aName) {
+    GetAttr(kNameSpaceID_None, nsGkAtoms::name, aName);
+    return !aName.IsEmpty();
+  }
+
+  /**
+   * Called when an attribute is about to be changed
+   */
+  virtual nsresult BeforeSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
+                                 const nsAString* aValue, PRBool aNotify);
+  /**
+   * Called when an attribute has just been changed
+   */
+  virtual nsresult AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
+                                const nsAString* aValue, PRBool aNotify);
+
+  /**
+   * Dispatch a select event. Returns true if the event was not cancelled.
+   */
+  PRBool DispatchSelectEvent(nsPresContext* aPresContext);
+
+  void SelectAll(nsPresContext* aPresContext);
+  PRBool IsImage() const
+  {
+    return AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                       nsGkAtoms::image, eIgnoreCase);
+  }
+
+  virtual PRBool AcceptAutofocus() const
+  {
+    return PR_TRUE;
+  }
+
+  /**
+   * Fire the onChange event
+   */
+  void FireOnChange();
+
+  /**
+   * Visit a the group of radio buttons this radio belongs to
+   * @param aVisitor the visitor to visit with
+   */
+  nsresult VisitGroup(nsIRadioVisitor* aVisitor, PRBool aFlushContent);
+
+  /**
+   * Do all the work that |SetChecked| does (radio button handling, etc.), but
+   * take an |aNotify| parameter.
+   */
+  nsresult DoSetChecked(PRBool aValue, PRBool aNotify, PRBool aSetValueChanged);
+
+  /**
+   * Do all the work that |SetCheckedChanged| does (radio button handling,
+   * etc.), but take an |aNotify| parameter that lets it avoid flushing content
+   * when it can.
+   */
+  void DoSetCheckedChanged(PRBool aCheckedChanged, PRBool aNotify);
+
+  /**
+   * Actually set checked and notify the frame of the change.
+   * @param aValue the value of checked to set
+   */
+  void SetCheckedInternal(PRBool aValue, PRBool aNotify);
+
+  /**
+   * Syntax sugar to make it easier to check for checked
+   */
+  PRBool GetChecked() const
+  {
+    return GET_BOOLBIT(mBitField, BF_CHECKED);
+  }
+
+  nsresult RadioSetChecked(PRBool aNotify);
+  void SetCheckedChanged(PRBool aCheckedChanged);
+
+  /**
+   * MaybeSubmitForm looks for a submit input or a single text control
+   * and submits the form if either is present.
+   */
+  nsresult MaybeSubmitForm(nsPresContext* aPresContext);
+
+  /**
+   * Update mFileList with the currently selected file.
+   */
+  nsresult UpdateFileList();
+
+  /**
+   * Determine whether the editor needs to be initialized explicitly for
+   * a particular event.
+   */
+  PRBool NeedToInitializeEditorForEvent(nsEventChainPreVisitor& aVisitor) const;
+
+  /**
+   * Get the value mode of the element, depending of the type.
+   */
+  ValueModeType GetValueMode() const;
+
+  /**
+   * Get the mutable state of the element.
+   * When the element isn't mutable (immutable), the value or checkedness
+   * should not be changed by the user.
+   *
+   * See: http://dev.w3.org/html5/spec/forms.html#concept-input-mutable
+   */
+  PRBool IsMutable() const;
+
+  /**
+   * Returns if the readonly attribute applies for the current type.
+   */
+  PRBool DoesReadOnlyApply() const;
+
+  /**
+   * Returns if the required attribute applies for the current type.
+   */
+  PRBool DoesRequiredApply() const;
+
+  /**
+   * Returns if the pattern attribute applies for the current type.
+   */
+  PRBool DoesPatternApply() const;
+
+  void FreeData();
+  nsTextEditorState *GetEditorState() const;
+
+  /**
+   * Manages the internal data storage across type changes.
+   */
+  void HandleTypeChange(PRUint8 aNewType);
+
+  /**
+   * Sanitize the value of the element depending of its current type.
+   * See: http://www.whatwg.org/specs/web-apps/current-work/#value-sanitization-algorithm
+   */
+  void SanitizeValue(nsAString& aValue);
+
+  /**
+   * Returns whether the placeholder attribute applies for the current type.
+   */
+  bool PlaceholderApplies() const { return IsSingleLineTextControlInternal(PR_FALSE, mType); }
+
+  /**
+   * Set the current default value to the value of the input element.
+   */
+  nsresult SetDefaultValueAsValue();
+
+  nsCOMPtr<nsIControllers> mControllers;
+
+  /**
+   * The type of this input (<input type=...>) as an integer.
+   * @see nsIFormControl.h (specifically NS_FORM_INPUT_*)
+   */
+  PRUint8                  mType;
+  /**
+   * A bitfield containing our booleans
+   * @see GET_BOOLBIT / SET_BOOLBIT macros and BF_* field identifiers
+   */
+  PRInt16                  mBitField;
+  /*
+   * In mInputData, the mState field is used if IsSingleLineTextControl returns
+   * true and mValue is used otherwise.  We have to be careful when handling it
+   * on a type change.
+   *
+   * Accessing the mState member should be done using the GetEditorState function,
+   * which returns null if the state is not present.
+   */
+  union InputData {
+    /**
+     * The current value of the input if it has been changed from the default
+     */
+    char*                    mValue;
+    /**
+     * The state of the text editor associated with the text/password input
+     */
+    nsTextEditorState*       mState;
+  } mInputData;
+  /**
+   * The value of the input if it is a file input. This is the list of filenames
+   * used when uploading a file. It is vital that this is kept separate from
+   * mValue so that it won't be possible to 'leak' the value from a text-input
+   * to a file-input. Additionally, the logic for this value is kept as simple
+   * as possible to avoid accidental errors where the wrong filename is used.
+   * Therefor the list of filenames is always owned by this member, never by
+   * the frame. Whenever the frame wants to change the filename it has to call
+   * SetFileNames to update this member.
+   */
+  nsCOMArray<nsIDOMFile>   mFiles;
+
+  nsRefPtr<nsDOMFileList>  mFileList;
+
+  nsString mStaticDocFileList;
+};
+
+#endif
diff --git a/docshell/test/chrome/bug294258_window.xul b/docshell/test/chrome/bug294258_window.xul
index 8ceab4d0be57..f1f2cb343b8e 100644
--- a/docshell/test/chrome/bug294258_window.xul
+++ b/docshell/test/chrome/bug294258_window.xul
@@ -43,7 +43,13 @@
       // Change the data for each of the form fields, and reload.
       $("text").value = "text value";
       $("checkbox").checked = true;
-      $("file").value = "file value";
+      var file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsILocalFile);
+      file.append("294258_test.file");
+      file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
+      filePath = file.path;
+      $("file").value = filePath;
       $("textarea").value = "textarea value";
       $("radio1").checked = true;
       $("select").selectedIndex = 2;
@@ -56,7 +62,7 @@
       // Verify that none of the form data has changed.
       is($("text").value, "text value", "Text value changed");
       is($("checkbox").checked, true, "Checkbox value changed");
-      is($("file").value, "file value", "File value changed");
+      is($("file").value, filePath, "File value changed");
       is($("textarea").value, "textarea value", "Textarea value changed");
       is($("radio1").checked, true, "Radio value changed");
       is($("select").selectedIndex, 2, "Select value changed");
diff --git a/layout/base/tests/chrome/printpreview_helper.xul b/layout/base/tests/chrome/printpreview_helper.xul
index 41c5df677915..fe5332ea727c 100644
--- a/layout/base/tests/chrome/printpreview_helper.xul
+++ b/layout/base/tests/chrome/printpreview_helper.xul
@@ -18,6 +18,11 @@ var ctx1;
 var ctx2;
 var counter = 0;
 
+var file = Components.classes["@mozilla.org/file/directory_service;1"]
+             .getService(Components.interfaces.nsIProperties)
+             .get("TmpD", Components.interfaces.nsILocalFile);
+filePath = file.path;
+
 function printpreview() {
   gWbp = window.frames[1].QueryInterface(Components.interfaces.nsIInterfaceRequestor)
              .getInterface(Components.interfaces.nsIWebBrowserPrint);
@@ -155,7 +160,7 @@ var emptyFormElements =
 var formElements =
   ["<input type='text' value='text'>",
    "<input type='password' value='password'>",
-   "<input type='file' value='file'>",
+   "<input type='file' value='" + filePath + "'>",
    "<input type='button' value='button'>",
    "<input type='submit' value='submit button'>",
    "<input type='reset' value='reset button'>",
diff --git a/layout/forms/nsFileControlFrame.cpp b/layout/forms/nsFileControlFrame.cpp
index 290d63807bc2..2e08cf8f9041 100644
--- a/layout/forms/nsFileControlFrame.cpp
+++ b/layout/forms/nsFileControlFrame.cpp
@@ -65,7 +65,7 @@
 #include "nsINodeInfo.h"
 #include "nsIDOMEventTarget.h"
 #include "nsILocalFile.h"
-#include "nsIFileControlElement.h"
+#include "nsHTMLInputElement.h"
 #include "nsNodeInfoManager.h"
 #include "nsContentCreatorFunctions.h"
 #include "nsContentUtils.h"
@@ -90,6 +90,7 @@
 #include "nsHTMLInputElement.h"
 #include "nsICapturePicker.h"
 #include "nsIFileURL.h"
+#include "nsDOMFile.h"
 
 #define SYNC_TEXT 0x1
 #define SYNC_BUTTON 0x2
@@ -235,20 +236,21 @@ nsFileControlFrame::CreateAnonymousContent(nsTArray<nsIContent*>& aElements)
   mTextContent->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
                         NS_LITERAL_STRING("text"), PR_FALSE);
 
-  nsCOMPtr<nsIDOMHTMLInputElement> textControl = do_QueryInterface(mTextContent);
-  if (textControl) {
-    nsCOMPtr<nsIFileControlElement> fileControl = do_QueryInterface(mContent);
-    if (fileControl) {
-      // Initialize value when we create the content in case the value was set
-      // before we got here
-      nsAutoString value;
-      fileControl->GetDisplayFileName(value);
-      textControl->SetValue(value);
-    }
+  nsHTMLInputElement* inputElement =
+    nsHTMLInputElement::FromContent(mContent);
+  NS_ASSERTION(inputElement, "Why is our content not a <input>?");
 
-    textControl->SetTabIndex(-1);
-    textControl->SetReadOnly(PR_TRUE);
-  }
+  // Initialize value when we create the content in case the value was set
+  // before we got here
+  nsAutoString value;
+  inputElement->GetDisplayFileName(value);
+
+  nsCOMPtr<nsIDOMHTMLInputElement> textControl = do_QueryInterface(mTextContent);
+  NS_ASSERTION(textControl, "Why is the <input> we created not a <input>?");
+  textControl->SetValue(value);
+
+  textControl->SetTabIndex(-1);
+  textControl->SetReadOnly(PR_TRUE);
 
   if (!aElements.AppendElement(mTextContent))
     return NS_ERROR_OUT_OF_MEMORY;
@@ -398,9 +400,11 @@ nsFileControlFrame::CaptureMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
 
   // Get parent nsIDOMWindowInternal object.
   nsIContent* content = mFrame->GetContent();
-  nsCOMPtr<nsIDOMHTMLInputElement> inputElem = do_QueryInterface(content);
-  nsCOMPtr<nsIFileControlElement> fileControl = do_QueryInterface(content);
-  if (!content || !inputElem || !fileControl)
+  if (!content)
+    return NS_ERROR_FAILURE;
+
+  nsHTMLInputElement* inputElement = nsHTMLInputElement::FromContent(content);
+  if (!inputElement)
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIDocument> doc = content->GetDocument();
@@ -443,21 +447,13 @@ nsFileControlFrame::CaptureMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
     return NS_OK;
   }
 
-  nsCOMPtr<nsIURI> uri;
-  rv = capturePicker->GetUri(getter_AddRefs(uri));
+  nsCOMPtr<nsIDOMFile> domFile;
+  rv = capturePicker->GetFile(getter_AddRefs(domFile));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsTArray<nsString> newFileNames;
-  if (uri) {
-    nsCOMPtr<nsIFileURL> fileURL = do_QueryInterface(uri);
-    if (!fileURL)
-      return NS_ERROR_UNEXPECTED;
-
-    nsCAutoString spec;
-    rv = uri->GetSpec(spec);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    newFileNames.AppendElement(NS_ConvertUTF8toUTF16(spec));
+  nsCOMArray<nsIDOMFile> newFiles;
+  if (domFile) {
+    newFiles.AppendObject(domFile);
   } else {
     return NS_ERROR_FAILURE;
   }
@@ -465,13 +461,13 @@ nsFileControlFrame::CaptureMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
   // XXXkhuey we really should have a better UI story than the tired old
   // uneditable text box with the file name inside.
   // Set new selected files
-  if (!newFileNames.IsEmpty()) {
+  if (newFiles.Count()) {
     // Tell mTextFrame that this update of the value is a user initiated
     // change. Otherwise it'll think that the value is being set by a script
     // and not fire onchange when it should.
     PRBool oldState = mFrame->mTextFrame->GetFireChangeEventState();
     mFrame->mTextFrame->SetFireChangeEventState(PR_TRUE);
-    fileControl->SetFileNames(newFileNames);
+    inputElement->SetFiles(newFiles);
 
     mFrame->mTextFrame->SetFireChangeEventState(oldState);
     // May need to fire an onchange here
@@ -491,12 +487,9 @@ nsFileControlFrame::BrowseMouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
   if (!ShouldProcessMouseClick(aMouseEvent))
     return NS_OK;
   
-  nsIContent* content = mFrame->GetContent();
-  if (content->IsHTML() && content->Tag() == nsGkAtoms::input) {
-    nsHTMLInputElement* input = static_cast<nsHTMLInputElement*>(content);
-    return input->FireAsyncClickHandler();
-  }
-  return NS_OK;
+  nsHTMLInputElement* input =
+    nsHTMLInputElement::FromContent(mFrame->GetContent());
+  return input ? input->FireAsyncClickHandler() : NS_OK;
 }
 
 nscoord
@@ -643,10 +636,11 @@ nsFileControlFrame::GetFormProperty(nsIAtom* aName, nsAString& aValue) const
   aValue.Truncate();  // initialize out param
 
   if (nsGkAtoms::value == aName) {
-    nsCOMPtr<nsIFileControlElement> fileControl =
-      do_QueryInterface(mContent);
-    if (fileControl) {
-      fileControl->GetDisplayFileName(aValue);
+    nsHTMLInputElement* inputElement =
+      nsHTMLInputElement::FromContent(mContent);
+
+    if (inputElement) {
+      inputElement->GetDisplayFileName(aValue);
     }
   }
   return NS_OK;
diff --git a/layout/forms/nsICapturePicker.idl b/layout/forms/nsICapturePicker.idl
index 148e22258a35..3d552cd88860 100644
--- a/layout/forms/nsICapturePicker.idl
+++ b/layout/forms/nsICapturePicker.idl
@@ -39,7 +39,7 @@
 #include "nsISupports.idl"
 
 interface nsIDOMWindow;
-interface nsIURI;
+interface nsIDOMFile;
 
 [scriptable, uuid(a4e2b2de-5712-4f80-aabb-7de3a747f227)]
 interface nsICapturePicker : nsISupports
@@ -88,7 +88,7 @@ interface nsICapturePicker : nsISupports
    * Get the captured image/video/audio.  This may be a data URI, file URI,
    * or a moz-filedata reference URI.
    */
-  readonly attribute nsIURI uri;
+  readonly attribute nsIDOMFile file;
 
   // The MIME type of the captured content.  Cannot be set after calling show()
   attribute AString type;

From 3c0cf6471d5d2cac60ec8b7adf16fc77a95ff396 Mon Sep 17 00:00:00 2001
From: Timothy Nikkel <tnikkel@gmail.com>
Date: Sun, 5 Sep 2010 14:21:56 -0500
Subject: [PATCH 168/222] Bug 592405. Printing view manager shouldn't be hooked
 into screen view manager. r=roc a=blocking final

---
 layout/printing/nsPrintEngine.cpp | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/layout/printing/nsPrintEngine.cpp b/layout/printing/nsPrintEngine.cpp
index c4943cbd3e8b..8b7441e11f8e 100644
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -1932,9 +1932,11 @@ nsPrintEngine::ReflowPrintObject(nsPrintObject * aPO)
 #endif // XP_UNIX && !XP_MACOSX
     documentIsTopLevel = PR_TRUE;
 
-    nsCOMPtr<nsIDocumentViewer> dv = do_QueryInterface(mDocViewerPrint);
-    if (dv) {
-      parentView = dv->FindContainerView();
+    if (mIsCreatingPrintPreview) {
+      nsCOMPtr<nsIDocumentViewer> dv = do_QueryInterface(mDocViewerPrint);
+      if (dv) {
+        parentView = dv->FindContainerView();
+      }
     }
   }
 

From 6861d60e7695a3b9007d86884cb6319240cfca75 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Sun, 5 Sep 2010 21:10:35 +0300
Subject: [PATCH 169/222] Bug 534178, remove dublicate nsSHTransactions, r=bz,
 a=blocking

--HG--
extra : rebase_source : a963bc21f3d2fd2038d6b26e50ad9aa50f6bc3e4
---
 docshell/base/nsDocShell.cpp              | 33 +++++++++-
 docshell/base/nsDocShell.h                |  7 ++
 docshell/shistory/src/nsSHTransaction.cpp |  8 ++-
 docshell/shistory/src/nsSHistory.cpp      | 79 +++++++++++++++++++++++
 docshell/shistory/src/nsSHistory.h        |  3 +
 5 files changed, 126 insertions(+), 4 deletions(-)

diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 989ff3a09d62..c49ea13dcc2d 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -2166,6 +2166,37 @@ nsDocShell::HistoryPurged(PRInt32 aNumEntries)
     return NS_OK;
 }
 
+nsresult
+nsDocShell::HistoryTransactionRemoved(PRInt32 aIndex)
+{
+    // These indices are used for fastback cache eviction, to determine
+    // which session history entries are candidates for content viewer
+    // eviction.  We need to adjust by the number of entries that we
+    // just purged from history, so that we look at the right session history
+    // entries during eviction.
+    if (aIndex == mPreviousTransIndex) {
+        mPreviousTransIndex = -1;
+    } else if (aIndex < mPreviousTransIndex) {
+        --mPreviousTransIndex;
+    }
+    if (mLoadedTransIndex == aIndex) {
+        mLoadedTransIndex = 0;
+    } else if (aIndex < mLoadedTransIndex) {
+        --mLoadedTransIndex;
+    }
+                            
+    PRInt32 count = mChildList.Count();
+    for (PRInt32 i = 0; i < count; ++i) {
+        nsCOMPtr<nsIDocShell> shell = do_QueryInterface(ChildAt(i));
+        if (shell) {
+            static_cast<nsDocShell*>(shell.get())->
+                HistoryTransactionRemoved(aIndex);
+        }
+    }
+
+    return NS_OK;
+}
+
 static
 nsresult
 GetPrincipalDomain(nsIPrincipal* aPrincipal, nsACString& aDomain)
@@ -9628,7 +9659,7 @@ nsDocShell::AddState(nsIVariant *aData, const nsAString& aTitle,
         AddURIVisit(newURI, oldURI, oldURI, 0);
     }
     else {
-        FireOnLocationChange(this, nsnull, mCurrentURI);
+        FireDummyOnLocationChange();
     }
 
     return NS_OK;
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index b0010a3f8ee6..2e95717263ac 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -269,6 +269,13 @@ public:
 
     friend class OnLinkClickEvent;
 
+    // We need dummy OnLocationChange in some cases to update the UI.
+    void FireDummyOnLocationChange()
+    {
+      FireOnLocationChange(this, nsnull, mCurrentURI);
+    }
+
+    nsresult HistoryTransactionRemoved(PRInt32 aIndex);
 protected:
     // Object Management
     virtual ~nsDocShell();
diff --git a/docshell/shistory/src/nsSHTransaction.cpp b/docshell/shistory/src/nsSHTransaction.cpp
index 7df15527a416..2050349a9104 100644
--- a/docshell/shistory/src/nsSHTransaction.cpp
+++ b/docshell/shistory/src/nsSHTransaction.cpp
@@ -111,10 +111,12 @@ nsSHTransaction::GetNext(nsISHTransaction * * aResult)
 NS_IMETHODIMP
 nsSHTransaction::SetNext(nsISHTransaction * aNext)
 {
-   NS_ENSURE_SUCCESS(aNext->SetPrev(this), NS_ERROR_FAILURE);
+  if (aNext) {
+    NS_ENSURE_SUCCESS(aNext->SetPrev(this), NS_ERROR_FAILURE);
+  }
 
-   mNext = aNext;
-   return NS_OK;
+  mNext = aNext;
+  return NS_OK;
 }
 
 NS_IMETHODIMP
diff --git a/docshell/shistory/src/nsSHistory.cpp b/docshell/shistory/src/nsSHistory.cpp
index d17ee517377f..d20523e6e0eb 100644
--- a/docshell/shistory/src/nsSHistory.cpp
+++ b/docshell/shistory/src/nsSHistory.cpp
@@ -62,6 +62,7 @@
 #include "mozilla/Services.h"
 #include "nsTArray.h"
 #include "nsCOMArray.h"
+#include "nsDocShell.h"
 
 // For calculating max history entries and max cachable contentviewers
 #include "nspr.h"
@@ -1137,13 +1138,91 @@ PRBool RemoveChildEntries(nsISHistory* aHistory, PRInt32 aIndex,
   return root ? RemoveFromSessionHistoryContainer(root, aEntryIDs) : PR_FALSE;
 }
 
+PRBool IsSameTree(nsISHEntry* aEntry1, nsISHEntry* aEntry2)
+{
+  if (!aEntry1 && !aEntry2) {
+    return PR_TRUE;
+  }
+  if ((!aEntry1 && aEntry2) || (aEntry1 && !aEntry2)) {
+    return PR_FALSE;
+  }
+  PRUint32 id1, id2;
+  aEntry1->GetID(&id1);
+  aEntry2->GetID(&id2);
+  if (id1 != id2) {
+    return PR_FALSE;
+  }
+
+  nsCOMPtr<nsISHContainer> container1 = do_QueryInterface(aEntry1);
+  nsCOMPtr<nsISHContainer> container2 = do_QueryInterface(aEntry2);
+  PRInt32 count1, count2;
+  container1->GetChildCount(&count1);
+  container2->GetChildCount(&count2);
+  // We allow null entries in the end of the child list.
+  PRInt32 count = PR_MAX(count1, count2);
+  for (PRInt32 i = 0; i < count; ++i) {
+    nsCOMPtr<nsISHEntry> child1, child2;
+    container1->GetChildAt(i, getter_AddRefs(child1));
+    container2->GetChildAt(i, getter_AddRefs(child2));
+    if (!IsSameTree(child1, child2)) {
+      return PR_FALSE;
+    }
+  }
+  
+  return PR_TRUE;
+}
+
+PRBool
+nsSHistory::RemoveDuplicate(PRInt32 aIndex)
+{
+  NS_ASSERTION(aIndex > 0, "aIndex must be > 0!");
+  nsCOMPtr<nsIHistoryEntry> rootHE1, rootHE2;
+  GetEntryAtIndex(aIndex, PR_FALSE, getter_AddRefs(rootHE1));
+  GetEntryAtIndex(aIndex - 1, PR_FALSE, getter_AddRefs(rootHE2));
+  nsCOMPtr<nsISHEntry> root1 = do_QueryInterface(rootHE1);
+  nsCOMPtr<nsISHEntry> root2 = do_QueryInterface(rootHE2);
+  if (IsSameTree(root1, root2)) {
+    nsCOMPtr<nsISHTransaction> txToRemove, txToKeep, txNext;
+    GetTransactionAtIndex(aIndex, getter_AddRefs(txToRemove));
+    GetTransactionAtIndex(aIndex - 1, getter_AddRefs(txToKeep));
+    NS_ENSURE_TRUE(txToRemove, PR_FALSE);
+    NS_ENSURE_TRUE(txToKeep, PR_FALSE);
+    txToRemove->GetNext(getter_AddRefs(txNext));
+    txToRemove->SetNext(nsnull);
+    txToRemove->SetPrev(nsnull);
+    // If txNext is non-null, this will set txNext's .prev
+    txToKeep->SetNext(txNext);
+    static_cast<nsDocShell*>(mRootDocShell)->HistoryTransactionRemoved(aIndex);
+    if (mIndex >= aIndex) {
+      mIndex = mIndex - 1;
+    }
+    --mLength;
+    return PR_TRUE;
+  }
+  return PR_FALSE;
+}
+
 NS_IMETHODIMP_(void)
 nsSHistory::RemoveEntries(nsTArray<PRUint64>& aIDs, PRInt32 aStartIndex)
 {
   PRInt32 index = aStartIndex;
   while(index >= 0 && RemoveChildEntries(this, --index, aIDs));
+  // Nothing was removed from minIndex if it is > 0!
+  PRInt32 minIndex = index >= 0 ? index : 0;
   index = aStartIndex;
   while(index >= 0 && RemoveChildEntries(this, index++, aIDs));
+  
+  // We need to remove duplicate nsSHEntry trees.
+  PRBool didRemove = PR_FALSE;
+  while (index && index > minIndex) {
+    didRemove = RemoveDuplicate(index--) || didRemove;
+  }
+  if (didRemove && mRootDocShell) {
+    nsRefPtr<nsIRunnable> ev =
+      NS_NewRunnableMethod(static_cast<nsDocShell*>(mRootDocShell),
+                           &nsDocShell::FireDummyOnLocationChange);
+    NS_DispatchToCurrentThread(ev);
+  }
 }
 
 void
diff --git a/docshell/shistory/src/nsSHistory.h b/docshell/shistory/src/nsSHistory.h
index 25fd56424c3c..9eb52a7a2e32 100644
--- a/docshell/shistory/src/nsSHistory.h
+++ b/docshell/shistory/src/nsSHistory.h
@@ -116,6 +116,9 @@ protected:
 
   nsresult LoadNextPossibleEntry(PRInt32 aNewIndex, long aLoadType, PRUint32 aHistCmd);
 protected:
+  // Note, aIndex must be > 0, since it is compared to aIndex - 1.
+  PRBool RemoveDuplicate(PRInt32 aIndex);
+
   nsCOMPtr<nsISHTransaction> mListRoot;
   PRInt32 mIndex;
   PRInt32 mLength;

From 796209cd433c3e41064f9a64fdf6be14dbda9afa Mon Sep 17 00:00:00 2001
From: Vladimir Vukicevic <vladimir@pobox.com>
Date: Sun, 5 Sep 2010 16:37:51 -0400
Subject: [PATCH 170/222] b=592106; correctly update GL context format;
 r=jrmuizel

---
 gfx/thebes/GLContext.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/gfx/thebes/GLContext.cpp b/gfx/thebes/GLContext.cpp
index c6b35e1aa997..1ff2c29b8279 100644
--- a/gfx/thebes/GLContext.cpp
+++ b/gfx/thebes/GLContext.cpp
@@ -747,12 +747,12 @@ GLContext::UpdateActualFormat()
 {
     ContextFormat nf;
 
-    fGetIntegerv(LOCAL_GL_RED_BITS, (GLint*) &nf.alpha);
-    fGetIntegerv(LOCAL_GL_GREEN_BITS, (GLint*) &nf.alpha);
-    fGetIntegerv(LOCAL_GL_BLUE_BITS, (GLint*) &nf.alpha);
+    fGetIntegerv(LOCAL_GL_RED_BITS, (GLint*) &nf.red);
+    fGetIntegerv(LOCAL_GL_GREEN_BITS, (GLint*) &nf.green);
+    fGetIntegerv(LOCAL_GL_BLUE_BITS, (GLint*) &nf.blue);
     fGetIntegerv(LOCAL_GL_ALPHA_BITS, (GLint*) &nf.alpha);
     fGetIntegerv(LOCAL_GL_DEPTH_BITS, (GLint*) &nf.depth);
-    fGetIntegerv(LOCAL_GL_STENCIL_BITS, (GLint*) &nf.depth);
+    fGetIntegerv(LOCAL_GL_STENCIL_BITS, (GLint*) &nf.stencil);
 
     mActualFormat = nf;
 }

From 293ddefb00cb5854c0f58a63a1e912088c857d69 Mon Sep 17 00:00:00 2001
From: Vladimir Vukicevic <vladimir@pobox.com>
Date: Sun, 5 Sep 2010 16:37:52 -0400
Subject: [PATCH 171/222] b=593396; implement BYTES_PER_ELEMENT on typed
 arrays; r=shaver

---
 js/src/jstypedarray.cpp                       | 14 ++++++++++++++
 js/src/tests/js1_8_5/extensions/typedarray.js |  6 ++++++
 2 files changed, 20 insertions(+)

diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index c675a8b650f1..ada5b6939467 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -482,6 +482,7 @@ class TypedArrayTemplate
   : public TypedArray
 {
   public:
+    typedef NativeType ThisType;
     typedef TypedArrayTemplate<NativeType> ThisTypeArray;
     static const int ArrayTypeID() { return TypeIDOfType<NativeType>(); }
     static const bool ArrayTypeIsUnsigned() { return TypeIsUnsigned<NativeType>(); }
@@ -1548,6 +1549,19 @@ do {                                                                           \
                          NULL, NULL);                                          \
     if (!proto)                                                                \
         return NULL;                                                           \
+    JSObject *ctor = JS_GetConstructor(cx, proto);                             \
+    if (!ctor ||                                                               \
+        !JS_DefineProperty(cx, ctor, "BYTES_PER_ELEMENT",                      \
+                           INT_TO_JSVAL(sizeof(_typedArray::ThisType)),        \
+                           JS_PropertyStub, JS_PropertyStub,                   \
+                           JSPROP_PERMANENT | JSPROP_READONLY) ||              \
+        !JS_DefineProperty(cx, proto, "BYTES_PER_ELEMENT",                     \
+                           INT_TO_JSVAL(sizeof(_typedArray::ThisType)),        \
+                           JS_PropertyStub, JS_PropertyStub,                   \
+                           JSPROP_PERMANENT | JSPROP_READONLY))                \
+    {                                                                          \
+        return NULL;                                                           \
+    }                                                                          \
     proto->setPrivate(0);                                                      \
 } while (0)
 
diff --git a/js/src/tests/js1_8_5/extensions/typedarray.js b/js/src/tests/js1_8_5/extensions/typedarray.js
index d8eb2dfbd3fb..0bcdf943108a 100644
--- a/js/src/tests/js1_8_5/extensions/typedarray.js
+++ b/js/src/tests/js1_8_5/extensions/typedarray.js
@@ -312,6 +312,12 @@ function test()
     checkThrows(function() new Int32Array(Int32Array));
     checkThrows(function() new Int32Array(Float64Array));
 
+    check(function() Int32Array.BYTES_PER_ELEMENT == 4);
+    check(function() (new Int32Array(4)).BYTES_PER_ELEMENT == 4);
+    check(function() (new Int32Array()).BYTES_PER_ELEMENT == 4);
+    check(function() (new Int32Array(0)).BYTES_PER_ELEMENT == 4);
+    check(function() Int16Array.BYTES_PER_ELEMENT == Uint16Array.BYTES_PER_ELEMENT);
+
     print ("done");
 
     reportCompare(0, TestFailCount, "typed array tests");

From d45fb468b233f28db9168ae9f7c7a4ebf2c45489 Mon Sep 17 00:00:00 2001
From: Vladimir Vukicevic <vladimir@pobox.com>
Date: Sun, 5 Sep 2010 16:37:52 -0400
Subject: [PATCH 172/222] b=593558; make gl context creation quieter;
 r=matt.woodrow; a=b

---
 gfx/thebes/GLContext.cpp | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/gfx/thebes/GLContext.cpp b/gfx/thebes/GLContext.cpp
index 1ff2c29b8279..7d7e00955f8b 100644
--- a/gfx/thebes/GLContext.cpp
+++ b/gfx/thebes/GLContext.cpp
@@ -342,7 +342,11 @@ GLContext::InitExtensions()
     const GLubyte *extensions = fGetString(LOCAL_GL_EXTENSIONS);
     char *exts = strdup((char *)extensions);
 
-    printf_stderr("GL extensions: %s\n", exts);
+    static bool once = false;
+
+    if (!once) {
+        printf_stderr("GL extensions: %s\n", exts);
+    }
 
     char *s = exts;
     bool done = false;
@@ -356,7 +360,9 @@ GLContext::InitExtensions()
 
         for (int i = 0; sExtensionNames[i]; ++i) {
             if (strcmp(s, sExtensionNames[i]) == 0) {
-                printf_stderr("Found extension %s\n", s);
+                if (!once) {
+                    printf_stderr("Found extension %s\n", s);
+                }
                 mAvailableExtensions[i] = 1;
             }
         }
@@ -365,6 +371,8 @@ GLContext::InitExtensions()
     }
 
     free(exts);
+
+    once = true;
 }
 
 PRBool
@@ -679,9 +687,11 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize)
     if (firstTime) {
         UpdateActualFormat();
 
+#ifdef DEBUG
         printf_stderr("Created offscreen FBO: r: %d g: %d b: %d a: %d depth: %d stencil: %d\n",
                       mActualFormat.red, mActualFormat.green, mActualFormat.blue, mActualFormat.alpha,
                       mActualFormat.depth, mActualFormat.stencil);
+#endif
     }
 
     // We're good, and the framebuffer is already attached, so let's
@@ -1008,6 +1018,10 @@ RemoveNamesFromArray(GLContext *aOrigin, GLsizei aCount, GLuint *aNames, nsTArra
 {
     for (GLsizei j = 0; j < aCount; ++j) {
         GLuint name = aNames[j];
+        // name 0 can be ignored
+        if (name == 0)
+            continue;
+
         PRBool found = PR_FALSE;
         for (PRUint32 i = 0; i < aArray.Length(); ++i) {
             if (aArray[i].name == name) {
@@ -1016,8 +1030,11 @@ RemoveNamesFromArray(GLContext *aOrigin, GLsizei aCount, GLuint *aNames, nsTArra
                 break;
             }
         }
-        if (!found)
-            printf_stderr("GL Context %p deleting resource %d, which doesn't exist!", aOrigin, name);
+#ifdef DEBUG
+        if (!found) {
+            printf_stderr("GL Context %p deleting resource %d, which doesn't exist!\n", aOrigin, name);
+        }
+#endif
     }
 }
 

From 99ed5c183dfd5afff7fcdc027fdcdf431c73fa99 Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Sun, 5 Sep 2010 17:27:04 -0400
Subject: [PATCH 173/222] Bug 593608 - drawArrays() crash - r+a=vladimir

---
 content/canvas/src/WebGLContextGL.cpp | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index 58f1eaeec7bd..9881f67a8769 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -896,6 +896,7 @@ WebGLContext::DoFakeVertexAttrib0(WebGLuint vertexCount)
         mFakeVertexAttrib0Array[4 * i + 3] = mVertexAttrib0Vector[3];
     }
 
+    gl->fBindBuffer(LOCAL_GL_ARRAY_BUFFER, 0);
     gl->fVertexAttribPointer(0, 4, LOCAL_GL_FLOAT, LOCAL_GL_FALSE, 0, mFakeVertexAttrib0Array);
 }
 
@@ -907,12 +908,21 @@ WebGLContext::UndoFakeVertexAttrib0()
 
     mFakeVertexAttrib0Array = nsnull;
 
+    // first set the bound buffer as needed for subsequent gl->fVertexAttribPointer call.
+    // since in DoFakeVertexAttrib0() we called bindBuffer on buffer zero, we only need to do that if
+    // we have a nonzero buffer binding for this attrib.
+    if (mAttribBuffers[0].buf)
+        gl->fBindBuffer(LOCAL_GL_ARRAY_BUFFER, mAttribBuffers[0].buf->GLName());
+
     gl->fVertexAttribPointer(0,
                              mAttribBuffers[0].size,
                              mAttribBuffers[0].type,
                              mAttribBuffers[0].normalized,
                              mAttribBuffers[0].stride,
                              (const GLvoid *) mAttribBuffers[0].byteOffset);
+
+    // now restore the bound buffer to its state before we did this whole draw call business
+    gl->fBindBuffer(LOCAL_GL_ARRAY_BUFFER, mBoundArrayBuffer ? mBoundArrayBuffer->GLName() : 0);
 }
 
 PRBool

From c5fcd015fa15293ffeba925ebe460a8212cc7141 Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nz>
Date: Mon, 6 Sep 2010 11:59:50 +1200
Subject: [PATCH 174/222] Bug 589626 - Make video buffing logic consistent.
 r=kinetik a=blocking2.0

---
 content/media/nsBuiltinDecoderStateMachine.cpp | 13 +++++++------
 content/media/nsBuiltinDecoderStateMachine.h   | 10 ++++++++++
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/content/media/nsBuiltinDecoderStateMachine.cpp b/content/media/nsBuiltinDecoderStateMachine.cpp
index 6bce566a33d9..48be18750d5d 100644
--- a/content/media/nsBuiltinDecoderStateMachine.cpp
+++ b/content/media/nsBuiltinDecoderStateMachine.cpp
@@ -164,7 +164,7 @@ PRBool nsBuiltinDecoderStateMachine::HasFutureAudio() const {
   mDecoder->GetMonitor().AssertCurrentThreadIn();
   PRBool aboveLowAudioThreshold = PR_FALSE;
   if (mAudioEndTime != -1) {
-    aboveLowAudioThreshold = mAudioEndTime - mCurrentFrameTime + mStartTime > LOW_AUDIO_MS;
+    aboveLowAudioThreshold = mAudioEndTime - GetMediaTime() > LOW_AUDIO_MS;
   }
   return HasAudio() &&
     !mAudioCompleted &&
@@ -259,7 +259,7 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
     PRInt64 audioDecoded = 0;
     {
       MonitorAutoEnter mon(mDecoder->GetMonitor());
-      currentTime = mCurrentFrameTime + mStartTime;
+      currentTime = GetMediaTime();
       audioDecoded = mReader->mAudioQueue.Duration();
       if (mAudioEndTime != -1) {
         audioDecoded += mAudioEndTime - currentTime;
@@ -451,7 +451,7 @@ void nsBuiltinDecoderStateMachine::AudioLoop()
         break;
       }
 
-      PRInt64 audioAhead = mAudioEndTime - mCurrentFrameTime - mStartTime;
+      PRInt64 audioAhead = mAudioEndTime - GetMediaTime();
       if (audioAhead > AMPLE_AUDIO_MS) {
         // We've pushed enough audio onto the hardware that we've queued up a
         // significant amount ahead of the playback position. The decode
@@ -653,7 +653,7 @@ void nsBuiltinDecoderStateMachine::UpdatePlaybackPosition(PRInt64 aTime)
   }
 
   // Notify DOM of any queued up audioavailable events
-  mEventManager.DispatchPendingEvents(mCurrentFrameTime + mStartTime);
+  mEventManager.DispatchPendingEvents(GetMediaTime());
 }
 
 void nsBuiltinDecoderStateMachine::ClearPositionChangeFlag()
@@ -989,6 +989,7 @@ nsresult nsBuiltinDecoderStateMachine::Run()
           StopPlayback(AUDIO_SHUTDOWN);
           StopDecodeThreads();
           ResetPlayback();
+          PRInt64 currentTime = GetMediaTime();
           nsresult res;
           {
             MonitorAutoExit exitMon(mDecoder->GetMonitor());
@@ -997,7 +998,7 @@ nsresult nsBuiltinDecoderStateMachine::Run()
             res = mReader->Seek(seekTime,
                                 mStartTime,
                                 mEndTime,
-                                mCurrentFrameTime + mStartTime);
+                                currentTime);
           }
           if (NS_SUCCEEDED(res)){
             PRInt64 audioTime = seekTime;
@@ -1035,7 +1036,7 @@ nsresult nsBuiltinDecoderStateMachine::Run()
         // if we need to seek again.
         
         nsCOMPtr<nsIRunnable> stopEvent;
-        if (mCurrentFrameTime == mEndTime) {
+        if (GetMediaTime() == mEndTime) {
           LOG(PR_LOG_DEBUG, ("%p Changed state from SEEKING (to %lldms) to COMPLETED",
                              mDecoder, seekTime));
           stopEvent = NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::SeekingStoppedAtEnd);
diff --git a/content/media/nsBuiltinDecoderStateMachine.h b/content/media/nsBuiltinDecoderStateMachine.h
index a934911eec1c..ddc1e003ec0f 100644
--- a/content/media/nsBuiltinDecoderStateMachine.h
+++ b/content/media/nsBuiltinDecoderStateMachine.h
@@ -338,6 +338,16 @@ protected:
   // be held.
   PRBool IsPlaying();
 
+  // Returns the "media time". This is the absolute time which the media
+  // playback has reached. i.e. this returns values in the range
+  // [mStartTime, mEndTime], and mStartTime will not be 0 if the media does
+  // not start at 0. Note this is different to the value returned
+  // by GetCurrentTime(), which is in the range [0,duration].
+  PRInt64 GetMediaTime() const {
+    mDecoder->GetMonitor().AssertCurrentThreadIn();
+    return mStartTime + mCurrentFrameTime;
+  }
+
   // Monitor on mAudioStream. This monitor must be held in order to delete
   // or use the audio stream. This stops us destroying the audio stream
   // while it's being used on another thread (typically when it's being

From 75bb37cff2f079636e47b03b678f7e3289ea6a0a Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nz>
Date: Mon, 6 Sep 2010 14:14:43 +1200
Subject: [PATCH 175/222] Bug 589626 - Make video buffing logic consistent.
 r=kinetik a=blocking2.0

---
 content/media/nsBuiltinDecoderReader.h        |   9 ++
 .../media/nsBuiltinDecoderStateMachine.cpp    | 137 ++++++++++--------
 content/media/nsBuiltinDecoderStateMachine.h  |  11 ++
 content/media/nsMediaDecoder.cpp              |  26 +++-
 4 files changed, 124 insertions(+), 59 deletions(-)

diff --git a/content/media/nsBuiltinDecoderReader.h b/content/media/nsBuiltinDecoderReader.h
index 8905d1c2524b..4ef5888b400d 100644
--- a/content/media/nsBuiltinDecoderReader.h
+++ b/content/media/nsBuiltinDecoderReader.h
@@ -330,6 +330,15 @@ template <class T> class MediaQueue : private nsDeque {
     return GetSize() == 0 && mEndOfStream;    
   }
 
+  // Returns PR_TRUE if the media queue has had its last sample added to it.
+  // This happens when the media stream has been completely decoded. Note this
+  // does not mean that the corresponding stream has finished playback.
+  PRBool IsFinished() {
+    MonitorAutoEnter mon(mMonitor);
+    return mEndOfStream;    
+  }
+
+  // Informs the media queue that it won't be receiving any more samples.
   void Finish() {
     MonitorAutoEnter mon(mMonitor);
     mEndOfStream = PR_TRUE;    
diff --git a/content/media/nsBuiltinDecoderStateMachine.cpp b/content/media/nsBuiltinDecoderStateMachine.cpp
index 48be18750d5d..5c34c6152015 100644
--- a/content/media/nsBuiltinDecoderStateMachine.cpp
+++ b/content/media/nsBuiltinDecoderStateMachine.cpp
@@ -99,6 +99,11 @@ const PRUint32 SILENCE_BYTES_CHUNK = 32 * 1024;
 // less than LOW_VIDEO_FRAMES frames.
 static const PRUint32 LOW_VIDEO_FRAMES = 1;
 
+// If we've got more than AMPLE_VIDEO_FRAMES decoded video frames waiting in
+// the video queue, we will not decode any more video frames until some have
+// been consumed by the play state machine thread.
+static const PRUint32 AMPLE_VIDEO_FRAMES = 10;
+
 // Arbitrary "frame duration" when playing only audio.
 static const int AUDIO_DURATION_MS = 40;
 
@@ -162,19 +167,20 @@ nsBuiltinDecoderStateMachine::~nsBuiltinDecoderStateMachine()
 
 PRBool nsBuiltinDecoderStateMachine::HasFutureAudio() const {
   mDecoder->GetMonitor().AssertCurrentThreadIn();
-  PRBool aboveLowAudioThreshold = PR_FALSE;
-  if (mAudioEndTime != -1) {
-    aboveLowAudioThreshold = mAudioEndTime - GetMediaTime() > LOW_AUDIO_MS;
-  }
-  return HasAudio() &&
-    !mAudioCompleted &&
-    (mReader->mAudioQueue.GetSize() > 0 || aboveLowAudioThreshold);
+  NS_ASSERTION(HasAudio(), "Should only call HasFutureAudio() when we have audio");
+  // We've got audio ready to play if:
+  // 1. We've not completed playback of audio, and
+  // 2. we either have more than the threshold of decoded audio available, or
+  //    we've completely decoded all audio (but not finished playing it yet
+  //    as per 1).
+  return !mAudioCompleted &&
+         (AudioDecodedMs() > LOW_AUDIO_MS || mReader->mAudioQueue.IsFinished());
 }
 
 PRBool nsBuiltinDecoderStateMachine::HaveNextFrameData() const {
-    return ((!HasAudio() || mReader->mAudioQueue.AtEndOfStream()) && 
-             mReader->mVideoQueue.GetSize() > 0) ||
-            HasFutureAudio();
+  mDecoder->GetMonitor().AssertCurrentThreadIn();
+  return (!HasAudio() || HasFutureAudio()) &&
+         (!HasVideo() || mReader->mVideoQueue.GetSize() > 0);
 }
 
 void nsBuiltinDecoderStateMachine::DecodeLoop()
@@ -201,12 +207,7 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
 
   // Once we've decoded more than videoPumpThreshold video frames, we'll
   // no longer be considered to be "pumping video".
-  const unsigned videoPumpThreshold = 5;
-
-  // If we've got more than videoWaitThreshold decoded video frames waiting in
-  // the video queue, we will not decode any more video frames until they've
-  // been consumed by the play state machine thread.
-  const unsigned videoWaitThreshold = 10;
+  const unsigned videoPumpThreshold = AMPLE_VIDEO_FRAMES / 2;
 
   // After the audio decode fills with more than audioPumpThresholdMs ms
   // of decoded audio, we'll start to check whether the audio or video decode
@@ -221,12 +222,6 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
       // Wait for more data to download if we've exhausted all our
       // buffered data.
       MonitorAutoEnter mon(mDecoder->GetMonitor());
-      while (!mStopDecodeThreads &&
-             mBufferExhausted &&
-             mState != DECODER_STATE_SHUTDOWN)
-      {
-        mon.Wait();
-      }
       if (mState == DECODER_STATE_SHUTDOWN || mStopDecodeThreads)
         break;
     }
@@ -234,7 +229,7 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
     PRUint32 videoQueueSize = mReader->mVideoQueue.GetSize();
     // Don't decode any more frames if we've filled our buffers.
     // Limits memory consumption.
-    if (videoQueueSize > videoWaitThreshold) {
+    if (videoQueueSize > AMPLE_VIDEO_FRAMES) {
       videoWait = PR_TRUE;
     }
 
@@ -244,7 +239,8 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
     if (videoPump && videoQueueSize >= videoPumpThreshold) {
       videoPump = PR_FALSE;
     }
-    if (!videoPump &&
+    if (audioPlaying &&
+        !videoPump &&
         videoPlaying &&
         videoQueueSize < LOW_VIDEO_FRAMES)
     {
@@ -283,9 +279,7 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
       videoPlaying = mReader->DecodeVideoFrame(skipToNextKeyframe, currentTime);
       {
         MonitorAutoEnter mon(mDecoder->GetMonitor());
-        if (mDecoder->mDecoderPosition > initialDownloadPosition) {
-          mBufferExhausted = PR_TRUE;
-        }
+        mBufferExhausted = mDecoder->mDecoderPosition > initialDownloadPosition;
       }
     }
     {
@@ -299,9 +293,7 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
       audioPlaying = mReader->DecodeAudioData();
       {
         MonitorAutoEnter mon(mDecoder->GetMonitor());
-        if (mDecoder->mDecoderPosition > initialDownloadPosition) {
-          mBufferExhausted = PR_TRUE;
-        }
+        mBufferExhausted = mDecoder->mDecoderPosition > initialDownloadPosition;
       }
     }
 
@@ -325,11 +317,15 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
       if (mState == DECODER_STATE_SHUTDOWN || mStopDecodeThreads) {
         break;
       }
+
       if ((!HasAudio() || (audioWait && audioPlaying)) &&
           (!HasVideo() || (videoWait && videoPlaying)))
       {
         // All active bitstreams' decode is well ahead of the playback
-        // position, we may as well wait have for the playback to catch up.
+        // position, we may as well wait for the playback to catch up.
+        // Set mBufferExhausted to PR_FALSE, as we'll receive more data
+        // while we wait.
+        mBufferExhausted = PR_FALSE;
         mon.Wait();
       }
     }
@@ -848,6 +844,39 @@ nsBuiltinDecoderStateMachine::StartDecodeThreads()
   return NS_OK;
 }
 
+PRInt64 nsBuiltinDecoderStateMachine::AudioDecodedMs() const
+{
+  NS_ASSERTION(HasAudio(),
+               "Should only call AudioDecodedMs() when we have audio");
+  // The amount of audio we have decoded is the amount of audio data we've
+  // already decoded and pushed to the hardware, plus the amount of audio
+  // data waiting to be pushed to the hardware.
+  PRInt64 pushed = (mAudioEndTime != -1) ? (mAudioEndTime - GetMediaTime()) : 0;
+  return pushed + mReader->mAudioQueue.Duration();
+}
+
+PRBool nsBuiltinDecoderStateMachine::HasLowDecodedData() const
+{
+  // We consider ourselves low on decoded data if we're low on audio, or
+  // if we're only playing video and we're low on video frames.
+  return (HasAudio() && AudioDecodedMs() < LOW_AUDIO_MS)
+         ||
+         (!HasAudio() &&
+          HasVideo() &&
+          (PRUint32)mReader->mVideoQueue.GetSize() < LOW_VIDEO_FRAMES);
+}
+
+PRBool nsBuiltinDecoderStateMachine::HasAmpleDecodedData() const
+{
+  return (!HasAudio() ||
+          AudioDecodedMs() >= AMPLE_AUDIO_MS ||
+          mReader->mAudioQueue.IsFinished())
+         &&
+         (!HasVideo() ||
+          (PRUint32)mReader->mVideoQueue.GetSize() > AMPLE_VIDEO_FRAMES ||
+          mReader->mVideoQueue.AtEndOfStream());
+}
+
 nsresult nsBuiltinDecoderStateMachine::Run()
 {
   NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
@@ -938,25 +967,16 @@ nsresult nsBuiltinDecoderStateMachine::Run()
           continue;
 
         if (mBufferExhausted &&
+            HasLowDecodedData() &&
             mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING &&
-            !mDecoder->GetCurrentStream()->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
-            !mDecoder->GetCurrentStream()->IsSuspendedByCache() &&
-            ((HasAudio() && mReader->mAudioQueue.Duration() < LOW_AUDIO_MS) ||
-             (HasVideo() && (PRUint32)mReader->mVideoQueue.GetSize() < LOW_VIDEO_FRAMES)))
+            !stream->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
+            !stream->IsSuspended())
         {
-          // There is at most one frame in the queue and there's
-          // more data to load. Let's buffer to make sure we can play a
-          // decent amount of video in the future.
+          // We're low on decoded data, and/or our decode has caught up with
+          // the download. Let's buffer to make sure we can play a decent
+          // amount of video in the future.
           StartBuffering();
-        } else {
-          if (mBufferExhausted) {
-            // This will wake up the decode thread and force it to try to
-            // decode video and audio. This guarantees we make progress.
-            mBufferExhausted = PR_FALSE;
-            mDecoder->GetMonitor().NotifyAll();
-          }
         }
-
       }
       break;
 
@@ -1059,17 +1079,20 @@ nsresult nsBuiltinDecoderStateMachine::Run()
 
     case DECODER_STATE_BUFFERING:
       {
-        TimeStamp now = TimeStamp::Now();
-        nsMediaStream* stream = mDecoder->GetCurrentStream();
-        if (!mDecoder->CanPlayThrough() &&
-            now - mBufferingStart < TimeDuration::FromSeconds(BUFFERING_WAIT) &&
-            stream->GetCachedDataEnd(mDecoder->mDecoderPosition) < mBufferingEndOffset &&
-            !stream->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
-            !stream->IsSuspendedByCache()) {
+        // We will remain in the buffering state if we've not decoded enough
+        // data to begin playback, or if we've not downloaded a reasonable
+        // amount of data inside our buffering time.
+        TimeDuration elapsed = TimeStamp::Now() - mBufferingStart;
+        if ((!mDecoder->CanPlayThrough() || !HasAmpleDecodedData()) &&
+             elapsed < TimeDuration::FromSeconds(BUFFERING_WAIT) &&
+             stream->GetCachedDataEnd(mDecoder->mDecoderPosition) < mBufferingEndOffset &&
+             !stream->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
+             !stream->IsSuspended())
+        {
           LOG(PR_LOG_DEBUG,
-              ("In buffering: buffering data until %d bytes available or %f seconds",
-               PRUint32(mBufferingEndOffset - mDecoder->GetCurrentStream()->GetCachedDataEnd(mDecoder->mDecoderPosition)),
-               BUFFERING_WAIT - (now - mBufferingStart).ToSeconds()));
+              ("In buffering: buffering data until %u bytes available or %f seconds",
+               PRUint32(mBufferingEndOffset - stream->GetCachedDataEnd(mDecoder->mDecoderPosition)),
+               BUFFERING_WAIT - elapsed.ToSeconds()));
           Wait(1000);
           if (mState == DECODER_STATE_SHUTDOWN)
             continue;
@@ -1082,7 +1105,6 @@ nsresult nsBuiltinDecoderStateMachine::Run()
         }
 
         if (mState != DECODER_STATE_BUFFERING) {
-          mBufferExhausted = PR_FALSE;
           // Notify to allow blocked decoder thread to continue
           mDecoder->GetMonitor().NotifyAll();
           UpdateReadyState();
@@ -1092,7 +1114,6 @@ nsresult nsBuiltinDecoderStateMachine::Run()
             }
           }
         }
-
         break;
       }
 
diff --git a/content/media/nsBuiltinDecoderStateMachine.h b/content/media/nsBuiltinDecoderStateMachine.h
index ddc1e003ec0f..9e696158a25f 100644
--- a/content/media/nsBuiltinDecoderStateMachine.h
+++ b/content/media/nsBuiltinDecoderStateMachine.h
@@ -242,6 +242,17 @@ public:
 
 protected:
 
+  // Returns the number of unplayed ms of audio we've got decoded and/or
+  // pushed to the hardware waiting to play. This is how much audio we can
+  // play without having to run the audio decoder.
+  PRInt64 AudioDecodedMs() const;
+
+  // Returns PR_TRUE if we're running low on decoded data.
+  PRBool HasLowDecodedData() const;
+
+  // Returns PR_TRUE if we've got plenty of decoded data.
+  PRBool HasAmpleDecodedData() const;
+
   // Returns PR_TRUE when there's decoded audio waiting to play.
   // The decoder monitor must be held.
   PRBool HasFutureAudio() const;
diff --git a/content/media/nsMediaDecoder.cpp b/content/media/nsMediaDecoder.cpp
index 64bbeff52a31..607330f4ec5b 100644
--- a/content/media/nsMediaDecoder.cpp
+++ b/content/media/nsMediaDecoder.cpp
@@ -68,6 +68,14 @@
 // Number of milliseconds of no data before a stall event is fired as defined by spec
 #define STALL_MS 3000
 
+// Number of estimated seconds worth of data we need to have buffered 
+// ahead of the current playback position before we allow the media decoder
+// to report that it can play through the entire media without the decode
+// catching up with the download. Having this margin make the
+// nsMediaDecoder::CanPlayThrough() calculation more stable in the case of
+// fluctuating bitrates.
+#define CAN_PLAY_THROUGH_MARGIN 20
+
 nsMediaDecoder::nsMediaDecoder() :
   mElement(0),
   mRGBWidth(-1),
@@ -289,5 +297,21 @@ PRBool nsMediaDecoder::CanPlayThrough()
   double timeToDownload =
     (bytesToDownload + gDownloadSizeSafetyMargin)/stats.mDownloadRate;
   double timeToPlay = bytesToPlayback/stats.mPlaybackRate;
-  return timeToDownload <= timeToPlay;
+
+  if (timeToDownload > timeToPlay) {
+    // Estimated time to download is greater than the estimated time to play.
+    // We probably can't play through without having to stop to buffer.
+    return PR_FALSE;
+  }
+
+  // Estimated time to download is less than the estimated time to play.
+  // We can probably play through without having to buffer, but ensure that
+  // we've got a reasonable amount of data buffered after the current
+  // playback position, so that if the bitrate of the media fluctuates, or if
+  // our download rate or decode rate estimation is otherwise inaccurate,
+  // we don't suddenly discover that we need to buffer. This is particularly
+  // required near the start of the media, when not much data is downloaded.
+  PRInt64 readAheadMargin = stats.mPlaybackRate * CAN_PLAY_THROUGH_MARGIN;
+  return stats.mTotalBytes == stats.mDownloadPosition ||
+         stats.mDownloadPosition > stats.mPlaybackPosition + readAheadMargin;
 }

From 8a0660c5582b3bd7a8a096de15eb417af8ccfe45 Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nz>
Date: Mon, 6 Sep 2010 14:14:50 +1200
Subject: [PATCH 176/222] Bug 593528 - Ensure audioavailable frame buffer
 memory is always freed. r=kinetik a=blocking2.0

---
 .../events/src/nsDOMNotifyAudioAvailableEvent.cpp | 12 +++++++-----
 content/html/content/src/nsHTMLMediaElement.cpp   | 15 +++++++++++++--
 content/media/nsAudioAvailableEventManager.cpp    | 11 +++++++++++
 content/media/nsAudioAvailableEventManager.h      |  1 +
 content/media/nsBuiltinDecoder.cpp                |  6 +++++-
 5 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/content/events/src/nsDOMNotifyAudioAvailableEvent.cpp b/content/events/src/nsDOMNotifyAudioAvailableEvent.cpp
index 709e08788e7b..57aa537438c5 100644
--- a/content/events/src/nsDOMNotifyAudioAvailableEvent.cpp
+++ b/content/events/src/nsDOMNotifyAudioAvailableEvent.cpp
@@ -53,6 +53,7 @@ nsDOMNotifyAudioAvailableEvent::nsDOMNotifyAudioAvailableEvent(nsPresContext* aP
     mCachedArray(nsnull),
     mAllowAudioData(PR_FALSE)
 {
+  MOZ_COUNT_CTOR(nsDOMNotifyAudioAvailableEvent);
   if (mEvent) {
     mEvent->message = aEventType;
   }
@@ -90,6 +91,7 @@ NS_INTERFACE_MAP_END_INHERITING(nsDOMEvent)
 
 nsDOMNotifyAudioAvailableEvent::~nsDOMNotifyAudioAvailableEvent()
 {
+  MOZ_COUNT_DTOR(nsDOMNotifyAudioAvailableEvent);
   if (mCachedArray) {
     NS_DROP_JS_OBJECTS(this, nsDOMNotifyAudioAvailableEvent);
     mCachedArray = nsnull;
@@ -142,10 +144,14 @@ nsDOMNotifyAudioAvailableEvent::InitAudioAvailableEvent(const nsAString& aType,
                                                         float aTime,
                                                         PRBool aAllowAudioData)
 {
+  // Auto manage the memory which stores the frame buffer. This ensures
+  // that if we exit due to some error, the memory will be freed. Otherwise,
+  // the framebuffer's memory will be freed when this event is destroyed.
+  nsAutoArrayPtr<float> frameBuffer(aFrameBuffer);
   nsresult rv = nsDOMEvent::InitEvent(aType, aCanBubble, aCancelable);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  mFrameBuffer = aFrameBuffer;
+  mFrameBuffer = frameBuffer.forget();
   mFrameBufferLength = aFrameBufferLength;
   mTime = aTime;
   mAllowAudioData = aAllowAudioData;
@@ -163,9 +169,5 @@ nsresult NS_NewDOMAudioAvailableEvent(nsIDOMEvent** aInstancePtrResult,
   nsDOMNotifyAudioAvailableEvent* it =
     new nsDOMNotifyAudioAvailableEvent(aPresContext, aEvent, aEventType,
                                        aFrameBuffer, aFrameBufferLength, aTime);
-  if (nsnull == it) {
-    return NS_ERROR_OUT_OF_MEMORY;
-  }
-
   return CallQueryInterface(it, aInstancePtrResult);
 }
diff --git a/content/html/content/src/nsHTMLMediaElement.cpp b/content/html/content/src/nsHTMLMediaElement.cpp
index 782a548ba622..9811766cec70 100644
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@@ -699,6 +699,11 @@ void nsHTMLMediaElement::NotifyAudioAvailable(float* aFrameBuffer,
                                               PRUint32 aFrameBufferLength,
                                               PRUint64 aTime)
 {
+  // Auto manage the memory for the frame buffer, so that if we add an early
+  // return-on-error here in future, we won't forget to release the memory.
+  // Otherwise we hand ownership of the memory over to the event created by 
+  // DispatchAudioAvailableEvent().
+  nsAutoArrayPtr<float> frameBuffer(aFrameBuffer);
   // Do same-origin check on element and media before allowing MozAudioAvailable events.
   if (!mMediaSecurityVerified) {
     nsCOMPtr<nsIPrincipal> principal = GetCurrentPrincipal();
@@ -708,7 +713,7 @@ void nsHTMLMediaElement::NotifyAudioAvailable(float* aFrameBuffer,
     }
   }
 
-  DispatchAudioAvailableEvent(aFrameBuffer, aFrameBufferLength, aTime);
+  DispatchAudioAvailableEvent(frameBuffer.forget(), aFrameBufferLength, aTime);
 }
 
 PRBool nsHTMLMediaElement::MayHaveAudioAvailableEventListener()
@@ -2213,6 +2218,12 @@ nsresult nsHTMLMediaElement::DispatchAudioAvailableEvent(float* aFrameBuffer,
                                                          PRUint32 aFrameBufferLength,
                                                          PRUint64 aTime)
 {
+  // Auto manage the memory for the frame buffer. If we fail and return
+  // an error, this ensures we free the memory in the frame buffer. Otherwise
+  // we hand off ownership of the frame buffer to the audioavailable event,
+  // which frees the memory when it's destroyed.
+  nsAutoArrayPtr<float> frameBuffer(aFrameBuffer);
+
   nsCOMPtr<nsIDOMDocumentEvent> docEvent(do_QueryInterface(GetOwnerDoc()));
   nsCOMPtr<nsIDOMEventTarget> target(do_QueryInterface(static_cast<nsIContent*>(this)));
   NS_ENSURE_TRUE(docEvent && target, NS_ERROR_INVALID_ARG);
@@ -2224,7 +2235,7 @@ nsresult nsHTMLMediaElement::DispatchAudioAvailableEvent(float* aFrameBuffer,
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = audioavailableEvent->InitAudioAvailableEvent(NS_LITERAL_STRING("MozAudioAvailable"),
-                                                    PR_TRUE, PR_TRUE, aFrameBuffer, aFrameBufferLength,
+                                                    PR_TRUE, PR_TRUE, frameBuffer.forget(), aFrameBufferLength,
                                                     (float)aTime / MS_PER_SECOND, mAllowAudioData);
   NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/content/media/nsAudioAvailableEventManager.cpp b/content/media/nsAudioAvailableEventManager.cpp
index 190fdca0674d..6a33a36e7a86 100644
--- a/content/media/nsAudioAvailableEventManager.cpp
+++ b/content/media/nsAudioAvailableEventManager.cpp
@@ -58,6 +58,11 @@ public:
     mFrameBufferLength(aFrameBufferLength),
     mTime(aTime)
   {
+    MOZ_COUNT_CTOR(nsAudioAvailableEventRunner);
+  }
+
+  ~nsAudioAvailableEventRunner() {
+    MOZ_COUNT_DTOR(nsAudioAvailableEventRunner);
   }
 
   NS_IMETHOD Run()
@@ -78,6 +83,12 @@ nsAudioAvailableEventManager::nsAudioAvailableEventManager(nsBuiltinDecoder* aDe
   mSignalBufferPosition(0),
   mMonitor("media.audioavailableeventmanager")
 {
+  MOZ_COUNT_CTOR(nsAudioAvailableEventManager);
+}
+
+nsAudioAvailableEventManager::~nsAudioAvailableEventManager()
+{
+  MOZ_COUNT_DTOR(nsAudioAvailableEventManager);
 }
 
 void nsAudioAvailableEventManager::Init(PRUint32 aChannels, PRUint32 aRate)
diff --git a/content/media/nsAudioAvailableEventManager.h b/content/media/nsAudioAvailableEventManager.h
index 17ccb781e8ce..3db94b7dc26b 100644
--- a/content/media/nsAudioAvailableEventManager.h
+++ b/content/media/nsAudioAvailableEventManager.h
@@ -51,6 +51,7 @@ class nsAudioAvailableEventManager
 {
 public:
   nsAudioAvailableEventManager(nsBuiltinDecoder* aDecoder);
+  ~nsAudioAvailableEventManager();
 
   // Initialize the event manager with audio metadata.  Called before
   // audio begins to get queued or events are dispatched.
diff --git a/content/media/nsBuiltinDecoder.cpp b/content/media/nsBuiltinDecoder.cpp
index 964b2d54a0ff..2baa2870267f 100644
--- a/content/media/nsBuiltinDecoder.cpp
+++ b/content/media/nsBuiltinDecoder.cpp
@@ -307,6 +307,10 @@ void nsBuiltinDecoder::AudioAvailable(float* aFrameBuffer,
                                       PRUint32 aFrameBufferLength,
                                       PRUint64 aTime)
 {
+  // Auto manage the frame buffer's memory. If we return due to an error
+  // here, this ensures we free the memory. Otherwise, we pass off ownership
+  // to HTMLMediaElement::NotifyAudioAvailable().
+  nsAutoArrayPtr<float> frameBuffer(aFrameBuffer);
   NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
   if (mShuttingDown) {
     return;
@@ -316,7 +320,7 @@ void nsBuiltinDecoder::AudioAvailable(float* aFrameBuffer,
     return;
   }
 
-  mElement->NotifyAudioAvailable(aFrameBuffer, aFrameBufferLength, aTime);
+  mElement->NotifyAudioAvailable(frameBuffer.forget(), aFrameBufferLength, aTime);
 }
 
 void nsBuiltinDecoder::MetadataLoaded(PRUint32 aChannels,

From acb9e628bda16f1618b24140eb303bd3dfd6ffb0 Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nz>
Date: Mon, 6 Sep 2010 14:14:50 +1200
Subject: [PATCH 177/222] Bug 578804 - Defer media volume to the audio thread.
 r=kinetik a=blocking2.0

---
 .../media/nsBuiltinDecoderStateMachine.cpp    | 27 ++++++++++++-------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/content/media/nsBuiltinDecoderStateMachine.cpp b/content/media/nsBuiltinDecoderStateMachine.cpp
index 5c34c6152015..f0e6f0028044 100644
--- a/content/media/nsBuiltinDecoderStateMachine.cpp
+++ b/content/media/nsBuiltinDecoderStateMachine.cpp
@@ -358,6 +358,8 @@ void nsBuiltinDecoderStateMachine::AudioLoop()
   PRUint64 audioDuration = 0;
   PRInt64 audioStartTime = -1;
   PRUint32 channels, rate;
+  float volume = -1;
+  PRBool setVolume;
   {
     MonitorAutoEnter mon(mDecoder->GetMonitor());
     mAudioCompleted = PR_FALSE;
@@ -391,8 +393,21 @@ void nsBuiltinDecoderStateMachine::AudioLoop()
       {
         break;
       }
+
+      // We only want to go to the expense of taking the audio monitor and
+      // changing the volume if it's the first time we've entered the loop
+      // (as we must sync the volume in case it's changed since the
+      // nsAudioStream was created) or if the volume has changed.
+      setVolume = volume != mVolume;
+      volume = mVolume;
     }
 
+    if (setVolume) {
+      MonitorAutoEnter audioMon(mAudioMonitor);
+      if (mAudioStream) {
+        mAudioStream->SetVolume(volume);
+      }
+    }
     NS_ASSERTION(mReader->mAudioQueue.GetSize() > 0,
                  "Should have data to play");
     // See if there's missing samples in the audio stream. If there is, push
@@ -674,16 +689,8 @@ nsHTMLMediaElement::NextFrameStatus nsBuiltinDecoderStateMachine::GetNextFrameSt
 void nsBuiltinDecoderStateMachine::SetVolume(float volume)
 {
   NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
-  {
-    MonitorAutoEnter audioMon(mAudioMonitor);
-    if (mAudioStream) {
-      mAudioStream->SetVolume(volume);
-    }
-  }
-  {
-    MonitorAutoEnter mon(mDecoder->GetMonitor());
-    mVolume = volume;
-  }
+  MonitorAutoEnter mon(mDecoder->GetMonitor());
+  mVolume = volume;
 }
 
 float nsBuiltinDecoderStateMachine::GetCurrentTime()

From c8a1f39823a898922248f514fa22b00daf2074c2 Mon Sep 17 00:00:00 2001
From: Alexander Surkov <surkov.alexander@gmail.com>
Date: Mon, 6 Sep 2010 12:33:29 +0900
Subject: [PATCH 178/222] Bug 592193 - add dexpcom version of
 nsIAccessible::role, part2: dexpcomed GetRole, r=marcoz, a=davidb

---
 accessible/src/atk/nsAccessibleWrap.cpp       |  7 +-
 accessible/src/base/nsAccessible.cpp          | 97 +++++++++----------
 accessible/src/base/nsAccessible.h            |  5 +
 .../src/base/nsApplicationAccessible.cpp      | 15 ++-
 accessible/src/base/nsApplicationAccessible.h |  2 +-
 accessible/src/mac/mozAccessible.mm           |  2 +-
 accessible/src/msaa/nsAccessibleWrap.cpp      | 13 +--
 7 files changed, 65 insertions(+), 76 deletions(-)

diff --git a/accessible/src/atk/nsAccessibleWrap.cpp b/accessible/src/atk/nsAccessibleWrap.cpp
index 321dff5434de..74ce8a3d7430 100644
--- a/accessible/src/atk/nsAccessibleWrap.cpp
+++ b/accessible/src/atk/nsAccessibleWrap.cpp
@@ -752,11 +752,8 @@ getRoleCB(AtkObject *aAtkObj)
 #endif
 
     if (aAtkObj->role == ATK_ROLE_INVALID) {
-        PRUint32 accRole, atkRole;
-        nsresult rv = accWrap->GetRole(&accRole);
-        NS_ENSURE_SUCCESS(rv, ATK_ROLE_INVALID);
-
-        atkRole = atkRoleMap[accRole]; // map to the actual value
+        // map to the actual value
+        PRUint32 atkRole = atkRoleMap[accWrap->Role()];
         NS_ASSERTION(atkRoleMap[nsIAccessibleRole::ROLE_LAST_ENTRY] ==
                      kROLE_ATK_LAST_ENTRY, "ATK role map skewed");
         aAtkObj->role = static_cast<AtkRole>(atkRole);
diff --git a/accessible/src/base/nsAccessible.cpp b/accessible/src/base/nsAccessible.cpp
index b525aa418e98..ada3cea942f8 100644
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -1263,52 +1263,7 @@ nsAccessible::GetRole(PRUint32 *aRole)
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  if (mRoleMapEntry) {
-    *aRole = mRoleMapEntry->role;
-
-    // These unfortunate exceptions don't fit into the ARIA table
-    // This is where the nsIAccessible role depends on both the role and ARIA state
-    if (*aRole == nsIAccessibleRole::ROLE_PUSHBUTTON) {
-
-      if (nsAccUtils::HasDefinedARIAToken(mContent,
-                                          nsAccessibilityAtoms::aria_pressed)) {
-        // For simplicity, any existing pressed attribute except "", or "undefined"
-        // indicates a toggle.
-        *aRole = nsIAccessibleRole::ROLE_TOGGLE_BUTTON;
-
-      } else if (mContent->AttrValueIs(kNameSpaceID_None,
-                                       nsAccessibilityAtoms::aria_haspopup,
-                                       nsAccessibilityAtoms::_true,
-                                       eCaseMatters)) {
-        // For button with aria-haspopup="true".
-        *aRole = nsIAccessibleRole::ROLE_BUTTONMENU;
-      }
-    }
-    else if (*aRole == nsIAccessibleRole::ROLE_LISTBOX) {
-      // A listbox inside of a combo box needs a special role because of ATK mapping to menu
-      nsCOMPtr<nsIAccessible> possibleCombo;
-      GetParent(getter_AddRefs(possibleCombo));
-      if (nsAccUtils::Role(possibleCombo) == nsIAccessibleRole::ROLE_COMBOBOX) {
-        *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
-      }
-      else {   // Check to see if combo owns the listbox instead
-        possibleCombo = nsRelUtils::
-          GetRelatedAccessible(this, nsIAccessibleRelation::RELATION_NODE_CHILD_OF);
-        if (nsAccUtils::Role(possibleCombo) == nsIAccessibleRole::ROLE_COMBOBOX)
-          *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
-      }
-    }
-    else if (*aRole == nsIAccessibleRole::ROLE_OPTION) {
-      if (nsAccUtils::Role(GetParent()) == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
-        *aRole = nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
-    }
-
-    // We are done if the mapped role trumps native semantics
-    if (mRoleMapEntry->roleRule == kUseMapRole)
-      return NS_OK;
-  }
-
-  *aRole = NativeRole();
+  *aRole = Role();
   return NS_OK;
 }
 
@@ -1628,10 +1583,6 @@ nsAccessible::GetState(PRUint32 *aState, PRUint32 *aExtraState)
     }
   }
 
-  PRUint32 role;
-  rv = GetRole(&role);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   // For some reasons DOM node may have not a frame. We tract such accessibles
   // as invisible.
   nsIFrame *frame = GetFrame();
@@ -1853,6 +1804,52 @@ nsAccessible::GetKeyBindings(PRUint8 aActionIndex,
   return NS_OK;
 }
 
+PRUint32
+nsAccessible::Role()
+{
+  // No ARIA role or it doesn't suppress role from native markup.
+  if (!mRoleMapEntry || mRoleMapEntry->roleRule != kUseMapRole)
+    return NativeRole();
+
+  // XXX: these unfortunate exceptions don't fit into the ARIA table. This is
+  // where the accessible role depends on both the role and ARIA state.
+  if (mRoleMapEntry->role == nsIAccessibleRole::ROLE_PUSHBUTTON) {
+    if (nsAccUtils::HasDefinedARIAToken(mContent,
+                                        nsAccessibilityAtoms::aria_pressed)) {
+      // For simplicity, any existing pressed attribute except "" or "undefined"
+      // indicates a toggle.
+      return nsIAccessibleRole::ROLE_TOGGLE_BUTTON;
+    }
+
+    if (mContent->AttrValueIs(kNameSpaceID_None,
+                              nsAccessibilityAtoms::aria_haspopup,
+                              nsAccessibilityAtoms::_true,
+                              eCaseMatters)) {
+      // For button with aria-haspopup="true".
+      return nsIAccessibleRole::ROLE_BUTTONMENU;
+    }
+
+  } else if (mRoleMapEntry->role == nsIAccessibleRole::ROLE_LISTBOX) {
+    // A listbox inside of a combobox needs a special role because of ATK
+    // mapping to menu.
+    if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX) {
+      return nsIAccessibleRole::ROLE_COMBOBOX_LIST;
+
+      nsCOMPtr<nsIAccessible> possibleCombo =
+        nsRelUtils::GetRelatedAccessible(this,
+                                         nsIAccessibleRelation::RELATION_NODE_CHILD_OF);
+      if (nsAccUtils::Role(possibleCombo) == nsIAccessibleRole::ROLE_COMBOBOX)
+        return nsIAccessibleRole::ROLE_COMBOBOX_LIST;
+    }
+
+  } else if (mRoleMapEntry->role == nsIAccessibleRole::ROLE_OPTION) {
+    if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
+      return nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
+  }
+
+  return mRoleMapEntry->role;
+}
+
 PRUint32
 nsAccessible::NativeRole()
 {
diff --git a/accessible/src/base/nsAccessible.h b/accessible/src/base/nsAccessible.h
index bfb0ccf30787..32bd37536b39 100644
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -143,6 +143,11 @@ public:
    */
   virtual nsresult GetNameInternal(nsAString& aName);
 
+  /**
+   * Return enumerated accessible role (see constants in nsIAccessibleRole).
+   */
+  virtual PRUint32 Role();
+
   /**
    * Returns enumerated accessible role from native markup (see constants in
    * nsIAccessibleRole). Doesn't take into account ARIA roles.
diff --git a/accessible/src/base/nsApplicationAccessible.cpp b/accessible/src/base/nsApplicationAccessible.cpp
index 168c4c97c241..5f6b9cccc35a 100644
--- a/accessible/src/base/nsApplicationAccessible.cpp
+++ b/accessible/src/base/nsApplicationAccessible.cpp
@@ -139,15 +139,6 @@ nsApplicationAccessible::GetKeyboardShortcut(nsAString &aKeyboardShortcut)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsApplicationAccessible::GetRole(PRUint32 *aRole)
-{
-  NS_ENSURE_ARG_POINTER(aRole);
-  *aRole = NativeRole();
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsApplicationAccessible::GetState(PRUint32 *aState, PRUint32 *aExtraState)
 {
@@ -381,6 +372,12 @@ nsApplicationAccessible::GetARIAState(PRUint32 *aState, PRUint32 *aExtraState)
   return NS_OK;
 }
 
+PRUint32
+nsApplicationAccessible::Role()
+{
+  return NativeRole();
+}
+
 PRUint32
 nsApplicationAccessible::NativeRole()
 {
diff --git a/accessible/src/base/nsApplicationAccessible.h b/accessible/src/base/nsApplicationAccessible.h
index ff38e61c2200..92d71bd77475 100644
--- a/accessible/src/base/nsApplicationAccessible.h
+++ b/accessible/src/base/nsApplicationAccessible.h
@@ -81,7 +81,6 @@ public:
   NS_IMETHOD GetValue(nsAString &aValue);
   NS_IMETHOD GetDescription(nsAString &aDescription);
   NS_IMETHOD GetKeyboardShortcut(nsAString &aKeyboardShortcut);
-  NS_IMETHOD GetRole(PRUint32 *aRole);
   NS_IMETHOD GetState(PRUint32 *aState , PRUint32 *aExtraState );
   NS_IMETHOD GetAttributes(nsIPersistentProperties **aAttributes);
   NS_IMETHOD GroupPosition(PRInt32 *aGroupLevel, PRInt32 *aSimilarItemsInGroup,
@@ -113,6 +112,7 @@ public:
 
   // nsAccessible
   virtual nsresult GetARIAState(PRUint32 *aState, PRUint32 *aExtraState);
+  virtual PRUint32 Role();
   virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
diff --git a/accessible/src/mac/mozAccessible.mm b/accessible/src/mac/mozAccessible.mm
index 5c78b436527c..5bb45bba5a32 100644
--- a/accessible/src/mac/mozAccessible.mm
+++ b/accessible/src/mac/mozAccessible.mm
@@ -135,7 +135,7 @@ GetNativeFromGeckoAccessible(nsIAccessible *anAccessible)
   if ((self = [super init])) {
     mGeckoAccessible = geckoAccessible;
     mIsExpired = NO;
-    geckoAccessible->GetRole(&mRole);
+    mRole = geckoAccessible->Role();
     
     // Check for OS X "role skew"; the role constants in nsIAccessible.idl need to match the ones
     // in nsRoleMap.h.
diff --git a/accessible/src/msaa/nsAccessibleWrap.cpp b/accessible/src/msaa/nsAccessibleWrap.cpp
index a9b949ba2d55..b94a3737740d 100644
--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@@ -399,11 +399,8 @@ __try {
                "Does not support nsIAccessibleText when it should");
 #endif
 
-  PRUint32 xpRole = 0, msaaRole = 0;
-  if (NS_FAILED(xpAccessible->GetRole(&xpRole)))
-    return E_FAIL;
-
-  msaaRole = gWindowsRoleMap[xpRole].msaaRole;
+  PRUint32 xpRole = xpAccessible->Role();
+  PRUint32 msaaRole = gWindowsRoleMap[xpRole].msaaRole;
   NS_ASSERTION(gWindowsRoleMap[nsIAccessibleRole::ROLE_LAST_ENTRY].msaaRole == ROLE_WINDOWS_LAST_ENTRY,
                "MSAA role map skewed");
 
@@ -1192,14 +1189,10 @@ nsAccessibleWrap::role(long *aRole)
 __try {
   *aRole = 0;
 
-  PRUint32 xpRole = 0;
-  nsresult rv = GetRole(&xpRole);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
   NS_ASSERTION(gWindowsRoleMap[nsIAccessibleRole::ROLE_LAST_ENTRY].ia2Role == ROLE_WINDOWS_LAST_ENTRY,
                "MSAA role map skewed");
 
+  PRUint32 xpRole = Role();
   *aRole = gWindowsRoleMap[xpRole].ia2Role;
 
   // Special case, if there is a ROLE_ROW inside of a ROLE_TREE_TABLE, then call

From 4d0d597a6fd5f97e04b9d5b0d6aa0e6fd4674f67 Mon Sep 17 00:00:00 2001
From: Steven Michaud <smichaud@pobox.com>
Date: Mon, 6 Sep 2010 14:56:11 +1200
Subject: [PATCH 179/222] Bug 592563. When a plugin is completely invisible,
 hide its NSView. r=roc

--HG--
extra : rebase_source : 1ca8ca2e91f57a1eaf0f97e1e4eba7927f8a3b32
---
 widget/src/cocoa/nsChildView.h  |  2 ++
 widget/src/cocoa/nsChildView.mm | 23 ++++++++++++++---------
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/widget/src/cocoa/nsChildView.h b/widget/src/cocoa/nsChildView.h
index 367c4bf4b7c3..ad3b325efbb3 100644
--- a/widget/src/cocoa/nsChildView.h
+++ b/widget/src/cocoa/nsChildView.h
@@ -402,6 +402,8 @@ public:
   nsCocoaTextInputHandler* TextInputHandler() { return &mTextInputHandler; }
   NSView<mozView>* GetEditorView();
 
+  PRBool IsPluginView() { return (mWindowType == eWindowType_plugin); }
+
 protected:
 
   PRBool            ReportDestroyEvent();
diff --git a/widget/src/cocoa/nsChildView.mm b/widget/src/cocoa/nsChildView.mm
index 8ce9ac94c62b..b5862adfaaa0 100644
--- a/widget/src/cocoa/nsChildView.mm
+++ b/widget/src/cocoa/nsChildView.mm
@@ -907,8 +907,8 @@ NS_IMETHODIMP nsChildView::Show(PRBool aState)
 
     [mView setHidden:!aState];
     mVisible = aState;
-    if (!mVisible)
-      HideChildPluginViews(mView);
+    if (!mVisible && IsPluginView())
+      HidePlugin();
   }
   return NS_OK;
 
@@ -1660,18 +1660,23 @@ void nsChildView::ApplyConfiguration(nsIWidget* aExpectedParent,
   nsWindowType kidType;
   aConfiguration.mChild->GetWindowType(kidType);
 #endif
-  NS_ASSERTION(kidType == eWindowType_plugin || kidType == eWindowType_child,
-               "Configured widget is not a child or plugin type");
+  NS_ASSERTION(kidType == eWindowType_plugin,
+               "Configured widget is not a plugin type");
   NS_ASSERTION(aConfiguration.mChild->GetParent() == aExpectedParent,
                "Configured widget is not a child of the right widget");
-  aConfiguration.mChild->Resize(
+
+  // nsIWidget::Show() doesn't get called on plugin widgets unless we call
+  // it from here.  See bug 592563.
+  nsChildView* child = static_cast<nsChildView*>(aConfiguration.mChild);
+  child->Show(!aConfiguration.mClipRegion.IsEmpty());
+
+  child->Resize(
       aConfiguration.mBounds.x, aConfiguration.mBounds.y,
       aConfiguration.mBounds.width, aConfiguration.mBounds.height,
       aRepaint);
-  // On Mac we don't use the clip region here, we just store it
-  // in case GetPluginClipRect needs it.
-  static_cast<nsChildView*>(aConfiguration.mChild)->
-    StoreWindowClipRegion(aConfiguration.mClipRegion);
+
+  // Store the clip region here in case GetPluginClipRect needs it.
+  child->StoreWindowClipRegion(aConfiguration.mClipRegion);
 }
 
 nsresult nsChildView::ConfigureChildren(const nsTArray<Configuration>& aConfigurations)

From 349f37cc97d0f9554908b8ba8fc8fd73b5ec2b79 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Mon, 6 Sep 2010 15:00:10 +1200
Subject: [PATCH 180/222] Bug 593361. Part 1: Limit the region of a
 non-retained layer we repaint to the clip region of the destination buffer.
 r=tnikkel

--HG--
extra : rebase_source : 20bea1e114bffe61bb621e7e99757cccd9fc98a0
---
 gfx/layers/basic/BasicLayers.cpp | 34 ++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index a56a93c20403..9536cd2b7109 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -384,6 +384,17 @@ ShouldRetainTransparentSurface(PRUint32 aContentFlags,
   }
 }
 
+static nsIntRegion
+IntersectWithClip(const nsIntRegion& aRegion, gfxContext* aContext)
+{
+  gfxRect clip = aContext->GetClipExtents();
+  clip.RoundOut();
+  nsIntRect r(clip.X(), clip.Y(), clip.Width(), clip.Height());
+  nsIntRegion result;
+  result.And(aRegion, r);
+  return result;
+}
+
 void
 BasicThebesLayer::Paint(gfxContext* aContext,
                         LayerManager::DrawThebesLayerCallback aCallback,
@@ -409,17 +420,20 @@ BasicThebesLayer::Paint(gfxContext* aContext,
     mValidRegion.SetEmpty();
     mBuffer.Clear();
 
-    target->Save();
-    gfxUtils::ClipToRegionSnapped(target, mVisibleRegion);
-    if (aOpacity != 1.0) {
-      target->PushGroup(contentType);
+    nsIntRegion toDraw = IntersectWithClip(mVisibleRegion, target);
+    if (!toDraw.IsEmpty()) {
+      target->Save();
+      gfxUtils::ClipToRegionSnapped(target, toDraw);
+      if (aOpacity != 1.0) {
+        target->PushGroup(contentType);
+      }
+      aCallback(this, target, toDraw, nsIntRegion(), aCallbackData);
+      if (aOpacity != 1.0) {
+        target->PopGroupToSource();
+        target->Paint(aOpacity);
+      }
+      target->Restore();
     }
-    aCallback(this, target, mVisibleRegion, nsIntRegion(), aCallbackData);
-    if (aOpacity != 1.0) {
-      target->PopGroupToSource();
-      target->Paint(aOpacity);
-    }
-    target->Restore();
     return;
   }
 

From c06ae165fee01fd37f412804926dfc41df20cb84 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Mon, 6 Sep 2010 15:02:43 +1200
Subject: [PATCH 181/222] Bug 593361. Part 2. Don't bother trying to draw
 directly to the backbuffer instead of retaining ThebesLayer, if the
 backbuffer is transparent anyway. r=tnikkel

--HG--
extra : rebase_source : 4a8d5833d6fab79147389a7c2f49f8653e90b9c5
---
 gfx/layers/basic/BasicLayers.cpp | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 9536cd2b7109..02f20d517aa7 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -378,9 +378,18 @@ ShouldRetainTransparentSurface(PRUint32 aContentFlags,
   case gfxASurface::TEXT_QUALITY_OK:
     return PR_TRUE;
   case gfxASurface::TEXT_QUALITY_OK_OVER_OPAQUE_PIXELS:
+    // Retain the buffer if all text is over opaque pixels. Otherwise,
+    // don't retain the buffer, in the hope that the backbuffer has
+    // opaque pixels where our layer does not.
     return (aContentFlags & Layer::CONTENT_NO_TEXT_OVER_TRANSPARENT) != 0;
+  case gfxASurface::TEXT_QUALITY_BAD:
+    // If the backbuffer is opaque, then draw directly into it to get
+    // subpixel AA. If the backbuffer is not an opaque format, then we won't get
+    // subpixel AA by drawing into it, so we might as well retain.
+    return aTargetSurface->GetContentType() != gfxASurface::CONTENT_COLOR;
   default:
-    return PR_FALSE;
+    NS_ERROR("Unknown quality type");
+    return PR_TRUE;
   }
 }
 

From 4af6bcda967b85c3d23fd005624bf602c359fd40 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Mon, 6 Sep 2010 15:04:36 +1200
Subject: [PATCH 182/222] Bug 584699. Invalidate ThebesLayers in abs-pos frame
 subtree that's moved. r=dbaron

--HG--
extra : rebase_source : 06dd1df6b08d331b38ee8a9edbf6ce07e7841c25
---
 layout/generic/nsAbsoluteContainingBlock.cpp |  3 +--
 layout/reftests/bugs/584699-1-ref.html       |  6 ++++++
 layout/reftests/bugs/584699-1.html           | 16 ++++++++++++++++
 layout/reftests/bugs/reftest.list            |  1 +
 4 files changed, 24 insertions(+), 2 deletions(-)
 create mode 100644 layout/reftests/bugs/584699-1-ref.html
 create mode 100644 layout/reftests/bugs/584699-1.html

diff --git a/layout/generic/nsAbsoluteContainingBlock.cpp b/layout/generic/nsAbsoluteContainingBlock.cpp
index 4ada3da23f26..3d3d476e5807 100644
--- a/layout/generic/nsAbsoluteContainingBlock.cpp
+++ b/layout/generic/nsAbsoluteContainingBlock.cpp
@@ -497,8 +497,7 @@ nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*                aDelegat
       (aDelegatingFrame->GetStateBits() & NS_FRAME_FIRST_REFLOW)) {
     // The frame moved
     aKidFrame->GetParent()->Invalidate(oldOverflowRect);
-    aKidFrame->GetParent()->Invalidate(kidDesiredSize.mOverflowArea +
-                                       rect.TopLeft());
+    aKidFrame->InvalidateFrameSubtree();
   } else if (oldRect.Size() != rect.Size()) {
     // Invalidate the area where the frame changed size.
     nscoord innerWidth = NS_MIN(oldRect.width, rect.width);
diff --git a/layout/reftests/bugs/584699-1-ref.html b/layout/reftests/bugs/584699-1-ref.html
new file mode 100644
index 000000000000..02fbd47ff471
--- /dev/null
+++ b/layout/reftests/bugs/584699-1-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<div style="position: absolute; top:20px; opacity:0.5; border:1px solid black; width:200px; height:200px;"></div>
+</body>
+</html>
diff --git a/layout/reftests/bugs/584699-1.html b/layout/reftests/bugs/584699-1.html
new file mode 100644
index 000000000000..e4920ab5bb44
--- /dev/null
+++ b/layout/reftests/bugs/584699-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<script>
+function doTest() {
+  var c = document.getElementById("c");
+  c.style.top = "20px";
+  document.documentElement.removeAttribute("class");
+}
+window.addEventListener("MozReftestInvalidate", doTest, false);
+</script>
+</head>
+<body>
+<canvas id="c" style="position: absolute; top:0; opacity:0.5; border:1px solid black; width:200px; height:200px;"></canvas>
+</body>
+</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 04425c6672b2..30657649bf1b 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1496,6 +1496,7 @@ random-if(layersGPUAccelerated) == 581317-1.html 581317-1-ref.html
 == 582037-2a.html 582037-2-ref.html
 == 582037-2b.html 582037-2-ref.html
 == 584400-dash-length.svg 584400-dash-length-ref.svg
+== 584699-1.html 584699-1-ref.html
 == 585598-2.xhtml 585598-2-ref.xhtml
 == 589672-1.html 589672-1-ref.html
 == 586400-1.html 586400-1-ref.html

From 561bcd2027e8193fba1758cbe63cc5e5ad89b025 Mon Sep 17 00:00:00 2001
From: Markus Stange <mstange@themasta.com>
Date: Mon, 6 Sep 2010 15:12:46 +1200
Subject: [PATCH 183/222] Bug 591141. Protect against null pattern. r=roc

--HG--
extra : rebase_source : 51658e6b24a3c2b7857e44ab5880d240aacd8115
---
 layout/generic/crashtests/591141.html         | 7 +++++++
 layout/generic/crashtests/crashtests.list     | 1 +
 layout/svg/base/src/nsSVGIntegrationUtils.cpp | 9 +++++++--
 3 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 layout/generic/crashtests/591141.html

diff --git a/layout/generic/crashtests/591141.html b/layout/generic/crashtests/591141.html
new file mode 100644
index 000000000000..e1f0bbbd3dfa
--- /dev/null
+++ b/layout/generic/crashtests/591141.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+<svg><pattern id="p"/></svg>
+<div style="width: 100px; height: 100px; background: -moz-element(#p);"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index c6a2b0e5ecce..153058ba59a3 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -333,3 +333,4 @@ load 586806-1.html
 load 586806-2.html
 load 586806-3.html
 load 586973-1.html
+load 591141.html
diff --git a/layout/svg/base/src/nsSVGIntegrationUtils.cpp b/layout/svg/base/src/nsSVGIntegrationUtils.cpp
index 3ea184ecf213..e71eadaaa000 100644
--- a/layout/svg/base/src/nsSVGIntegrationUtils.cpp
+++ b/layout/svg/base/src/nsSVGIntegrationUtils.cpp
@@ -504,6 +504,9 @@ DrawableFromPaintServer(nsIFrame*         aFrame,
     nsRefPtr<gfxPattern> pattern =
       server->GetPaintServerPattern(aTarget, 1.0, &overrideBounds);
 
+    if (!pattern)
+      return nsnull;
+
     // pattern is now set up to fill aPaintServerSize. But we want it to
     // fill aRenderSize, so we need to add a scaling transform.
     // We couldn't just have set overrideBounds to aRenderSize - it would have
@@ -547,6 +550,8 @@ nsSVGIntegrationUtils::DrawPaintServer(nsIRenderingContext* aRenderingContext,
   nsRefPtr<gfxDrawable> drawable =
     DrawableFromPaintServer(aPaintServer, aTarget, aPaintServerSize, imageSize);
 
-  nsLayoutUtils::DrawPixelSnapped(aRenderingContext, drawable, aFilter,
-                                  aDest, aFill, aAnchor, aDirty);
+  if (drawable) {
+    nsLayoutUtils::DrawPixelSnapped(aRenderingContext, drawable, aFilter,
+                                    aDest, aFill, aAnchor, aDirty);
+  }
 }

From d0ad1eef93cb4c5b3f3ad16d49d64e52c444d0f1 Mon Sep 17 00:00:00 2001
From: Dmitri Gribenko <gribozavr@gmail.com>
Date: Mon, 6 Sep 2010 15:18:07 +1200
Subject: [PATCH 184/222] Bug 590753. Avoid adding empty entries to paths.
 r=bsmedberg

--HG--
extra : rebase_source : 0220d37deb0ec175cc1580b0c1ec82c886c6db94
---
 build/unix/run-mozilla.sh | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/build/unix/run-mozilla.sh b/build/unix/run-mozilla.sh
index cb62ced97a64..8372064c308d 100755
--- a/build/unix/run-mozilla.sh
+++ b/build/unix/run-mozilla.sh
@@ -308,36 +308,36 @@ moz_should_set_ld_library_path()
 }
 if moz_should_set_ld_library_path
 then
-	LD_LIBRARY_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH+":$LD_LIBRARY_PATH"}
+	LD_LIBRARY_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH:+":$LD_LIBRARY_PATH"}
 fi 
 
 if [ -n "$LD_LIBRARYN32_PATH" ]
 then
-	LD_LIBRARYN32_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARYN32_PATH+":$LD_LIBRARYN32_PATH"}
+	LD_LIBRARYN32_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARYN32_PATH:+":$LD_LIBRARYN32_PATH"}
 fi
 if [ -n "$LD_LIBRARYN64_PATH" ]
 then
-	LD_LIBRARYN64_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARYN64_PATH+":$LD_LIBRARYN64_PATH"}
+	LD_LIBRARYN64_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARYN64_PATH:+":$LD_LIBRARYN64_PATH"}
 fi
 if [ -n "$LD_LIBRARY_PATH_64" ]; then
-	LD_LIBRARY_PATH_64=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH_64+":$LD_LIBRARY_PATH_64"}
+	LD_LIBRARY_PATH_64=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH_64:+":$LD_LIBRARY_PATH_64"}
 fi
 #
 #
 ## Set SHLIB_PATH for HPUX
-SHLIB_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${SHLIB_PATH+":$SHLIB_PATH"}
+SHLIB_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${SHLIB_PATH:+":$SHLIB_PATH"}
 #
 ## Set LIBPATH for AIX
-LIBPATH=${MOZ_DIST_BIN}:${MRE_HOME}${LIBPATH+":$LIBPATH"}
+LIBPATH=${MOZ_DIST_BIN}:${MRE_HOME}${LIBPATH:+":$LIBPATH"}
 #
 ## Set DYLD_LIBRARY_PATH for Mac OS X (Darwin)
-DYLD_LIBRARY_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${DYLD_LIBRARY_PATH+":$DYLD_LIBRARY_PATH"}
+DYLD_LIBRARY_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${DYLD_LIBRARY_PATH:+":$DYLD_LIBRARY_PATH"}
 #
 ## Set LIBRARY_PATH for BeOS
-LIBRARY_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/components:${MRE_HOME}${LIBRARY_PATH+":$LIBRARY_PATH"}
+LIBRARY_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/components:${MRE_HOME}${LIBRARY_PATH:+":$LIBRARY_PATH"}
 #
 ## Set ADDON_PATH for BeOS
-ADDON_PATH=${MOZ_DIST_BIN}${ADDON_PATH+":$ADDON_PATH"}
+ADDON_PATH=${MOZ_DIST_BIN}${ADDON_PATH:+":$ADDON_PATH"}
 #
 ## Solaris Xserver(Xsun) tuning - use shared memory transport if available
 if [ "$XSUNTRANSPORT" = "" ]

From 65b02549df3150304200a97afe9a46c8f94e4036 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Mon, 6 Sep 2010 15:23:44 +1200
Subject: [PATCH 185/222] Bug 584703. Compute XUL listbox contents overlow area
 correctly. r=enndeakin

--HG--
extra : rebase_source : a5c20c7ad240643a734a3e0f27c5357adc13c9ae
---
 layout/xul/base/src/nsListBoxBodyFrame.cpp    | 18 +++++++++++++++
 layout/xul/base/src/nsListBoxBodyFrame.h      |  2 ++
 .../tests/widgets/test_hiddenpaging.xul       | 23 +++++++++++++++++++
 3 files changed, 43 insertions(+)

diff --git a/layout/xul/base/src/nsListBoxBodyFrame.cpp b/layout/xul/base/src/nsListBoxBodyFrame.cpp
index 767959035a25..4e0fb5593ef1 100644
--- a/layout/xul/base/src/nsListBoxBodyFrame.cpp
+++ b/layout/xul/base/src/nsListBoxBodyFrame.cpp
@@ -290,6 +290,24 @@ nsListBoxBodyFrame::DoLayout(nsBoxLayoutState& aBoxLayoutState)
 
   nsresult rv = nsBoxFrame::DoLayout(aBoxLayoutState);
 
+  // determine the real height for the scrollable area from the total number
+  // of rows, since non-visible rows don't yet have frames
+  nsSize size = GetSize();
+  nsRect overflowRect = nsRect(nsPoint(0, 0), size);
+  if (mLayoutManager) {
+    nsIFrame* childFrame = mFrames.FirstChild();
+    while (childFrame) {
+      ConsiderChildOverflow(overflowRect, childFrame);
+      childFrame = childFrame->GetNextSibling();
+    }
+
+    nsSize prefSize = mLayoutManager->GetPrefSize(this, aBoxLayoutState);
+    if (prefSize.height > overflowRect.height) {
+      overflowRect.height = prefSize.height;
+    }
+  }
+  FinishAndStoreOverflow(&overflowRect, GetSize());
+
   if (mScrolling)
     aBoxLayoutState.SetPaintingDisabled(PR_FALSE);
 
diff --git a/layout/xul/base/src/nsListBoxBodyFrame.h b/layout/xul/base/src/nsListBoxBodyFrame.h
index 1428cceeefd5..e221af1e427b 100644
--- a/layout/xul/base/src/nsListBoxBodyFrame.h
+++ b/layout/xul/base/src/nsListBoxBodyFrame.h
@@ -156,6 +156,8 @@ public:
 
   virtual PRBool SupportsOrdinalsInChildren();
 
+  virtual PRBool ComputesOwnOverflowArea() { return PR_TRUE; }
+
 protected:
   class nsPositionChangedEvent;
   friend class nsPositionChangedEvent;
diff --git a/toolkit/content/tests/widgets/test_hiddenpaging.xul b/toolkit/content/tests/widgets/test_hiddenpaging.xul
index 228ad3729551..6eb9e3ef6e38 100644
--- a/toolkit/content/tests/widgets/test_hiddenpaging.xul
+++ b/toolkit/content/tests/widgets/test_hiddenpaging.xul
@@ -104,6 +104,8 @@ function testListbox()
   ok(listbox.firstChild.getBoundingClientRect().width < listbox.getBoundingClientRect().width - 10,
      id + ": Scrollbar visible");
 
+  var rowHeight = listbox.firstChild.getBoundingClientRect().height;
+
   listbox.selectedIndex = 0;
   sendKey("PAGE_DOWN", id);
   is(listbox.selectedItem.id, id + "_item8", id + ": Page down should go to the item one visible page away");
@@ -124,6 +126,27 @@ function testListbox()
   sendKey("PAGE_UP", id);
   is(listbox.selectedItem.id, id + "_item1", id + ": Third page up should return to the first visible item");
   is(listbox.getIndexOfFirstVisibleRow(), 0, id + ": Third page up should not have scrolled at all");
+
+  var scrollHeight = document.getAnonymousNodes(listbox)[1].lastChild.scrollHeight;
+  is(scrollHeight, rowHeight * 15, id + ": scrollHeight when rows set");
+
+  listbox.minHeight = 50;
+  scrollHeight = document.getAnonymousNodes(listbox)[1].lastChild.scrollHeight;
+  is(scrollHeight, rowHeight * 15, id + ": scrollHeight when rows and minimium height set");
+
+  listbox.removeAttribute("rows");
+
+  var availHeight = document.getAnonymousNodes(listbox)[1].lastChild.getBoundingClientRect().height;
+  // The listbox layout adds this extra height in GetPrefSize. Not sure what it's for though.
+  var e = (rowHeight * 15 - availHeight) % rowHeight;
+  var extraHeight = (e == 0) ? 0 : rowHeight - e;
+
+  scrollHeight = document.getAnonymousNodes(listbox)[1].lastChild.scrollHeight;
+  is(scrollHeight, rowHeight * 15 + extraHeight, id + ": scrollHeight when minimium height set");
+
+  listbox.removeAttribute("minheight");
+  scrollHeight = document.getAnonymousNodes(listbox)[1].lastChild.scrollHeight;
+  is(scrollHeight, rowHeight * 15 + extraHeight, id + ": scrollHeight");
 }
 
 window.onload = function runTests() {

From 08f632c3d8a7c873863ccd11329fad75a6674a02 Mon Sep 17 00:00:00 2001
From: Neil Deakin <enndeakin@gmail.com>
Date: Mon, 6 Sep 2010 15:30:17 +1200
Subject: [PATCH 186/222] Bug 558072. Allow getting of popup position and size
 from popupshowing event. r=roc,a=blocking

--HG--
extra : rebase_source : 0589fbc0410548f8f7ee748d59e70721c5fcc29b
---
 .../base/content/test/test_contextmenu.html   |   5 +
 layout/base/nsCSSFrameConstructor.cpp         |  81 +++-------
 layout/base/nsCSSFrameConstructor.h           |  38 +----
 layout/xul/base/public/nsXULPopupManager.h    |  21 +--
 layout/xul/base/src/nsMenuFrame.h             |   3 -
 layout/xul/base/src/nsMenuPopupFrame.cpp      | 153 +++++++-----------
 layout/xul/base/src/nsMenuPopupFrame.h        |  10 +-
 layout/xul/base/src/nsXULPopupManager.cpp     | 122 +++++++-------
 .../tests/widgets/test_popup_coords.xul       |   6 +
 .../tests/widgets/test_popup_scaled.xul       |   1 +
 .../tests/widgets/test_popuphidden.xul        |  15 +-
 11 files changed, 170 insertions(+), 285 deletions(-)

diff --git a/browser/base/content/test/test_contextmenu.html b/browser/base/content/test/test_contextmenu.html
index 081a244985c0..0d842ea6e448 100644
--- a/browser/base/content/test/test_contextmenu.html
+++ b/browser/base/content/test/test_contextmenu.html
@@ -452,6 +452,11 @@ function startTest() {
     contextMenu = chromeWin.document.getElementById("contentAreaContextMenu");
     ok(contextMenu, "Got context menu XUL");
 
+    if (chromeWin.document.getElementById("Browser:Stop").getAttribute("disabled") != "true") {
+      SimpleTest.executeSoon(startTest);
+      return;
+    }
+
     text   = subwindow.document.getElementById("test-text");
     link   = subwindow.document.getElementById("test-link");
     mailto = subwindow.document.getElementById("test-mailto");
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 629d2d23c106..e7ed1fb09fc5 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -4212,17 +4212,6 @@ nsCSSFrameConstructor::FindXULDisplayData(const nsStyleDisplay* aDisplay,
                        sXULDisplayData, NS_ARRAY_LENGTH(sXULDisplayData));
 }
 
-nsresult
-nsCSSFrameConstructor::AddLazyChildren(nsIContent* aContent,
-                                       nsLazyFrameConstructionCallback* aCallback,
-                                       void* aArg, PRBool aIsSynch)
-{
-  nsCOMPtr<nsIRunnable> event =
-    new LazyGenerateChildrenEvent(aContent, mPresShell, aCallback, aArg);
-  return aIsSynch ? event->Run() :
-                    NS_DispatchToCurrentThread(event);
-}
-
 already_AddRefed<nsStyleContext>
 nsCSSFrameConstructor::BeginBuildingScrollFrame(nsFrameConstructorState& aState,
                                                 nsIContent*              aContent,
@@ -11654,62 +11643,34 @@ nsCSSFrameConstructor::PostRebuildAllStyleDataEvent(nsChangeHint aExtraHint)
   PostRestyleEventInternal(PR_FALSE);
 }
 
-NS_IMETHODIMP
-nsCSSFrameConstructor::LazyGenerateChildrenEvent::Run()
+nsresult
+nsCSSFrameConstructor::GenerateChildFrames(nsIFrame* aFrame)
 {
-  mPresShell->GetDocument()->FlushPendingNotifications(Flush_Layout);
+  {
+    nsAutoScriptBlocker scriptBlocker;
+    BeginUpdate();
 
-  // this is hard-coded to handle only menu popup frames
-  nsIFrame* frame = mPresShell->GetPresContext() ?
-    mPresShell->GetPresContext()->GetPrimaryFrameFor(mContent) : nsnull;
-  if (frame && frame->GetType() == nsGkAtoms::menuPopupFrame) {
-    nsWeakFrame weakFrame(frame);
-#ifdef MOZ_XUL
-    // it is possible that the frame is different than the one that requested
-    // the lazy generation, but as long as it's a popup frame that hasn't
-    // generated its children yet, that's OK.
-    nsMenuPopupFrame* menuPopupFrame = static_cast<nsMenuPopupFrame *>(frame);
-    if (menuPopupFrame->HasGeneratedChildren()) {
-      if (mCallback)
-        mCallback(mContent, frame, mArg);
-      
-      return NS_OK;
-    }     
-
-    // indicate that the children have been generated
-    menuPopupFrame->SetGeneratedChildren();
-#endif
-
-   {
-      nsAutoScriptBlocker scriptBlocker;
-      nsCSSFrameConstructor* fc = mPresShell->FrameConstructor();
-      fc->BeginUpdate();
-
-      nsFrameItems childItems;
-      nsFrameConstructorState state(mPresShell, nsnull, nsnull, nsnull);
-      // We don't have a parent frame with a pending binding constructor here,
-      // so no need to worry about ordering of the kids' constructors with it.
-      // Pass null for the PendingBinding.
-      nsresult rv = fc->ProcessChildren(state, mContent, frame->GetStyleContext(),
-                                        frame, PR_FALSE, childItems, PR_FALSE,
-                                        nsnull);
-      if (NS_FAILED(rv)) {
-        fc->EndUpdate();
-        return rv;
-      }
-
-      frame->SetInitialChildList(nsnull, childItems);
-
-      fc->EndUpdate();
+    nsFrameItems childItems;
+    nsFrameConstructorState state(mPresShell, nsnull, nsnull, nsnull);
+    // We don't have a parent frame with a pending binding constructor here,
+    // so no need to worry about ordering of the kids' constructors with it.
+    // Pass null for the PendingBinding.
+    nsresult rv = ProcessChildren(state, aFrame->GetContent(), aFrame->GetStyleContext(),
+                                  aFrame, PR_FALSE, childItems, PR_FALSE,
+                                  nsnull);
+    if (NS_FAILED(rv)) {
+      EndUpdate();
+      return rv;
     }
 
-    if (mCallback && weakFrame.IsAlive())
-      mCallback(mContent, frame, mArg);
+    aFrame->SetInitialChildList(nsnull, childItems);
 
-    // call XBL constructors after the frames are created
-    mPresShell->GetDocument()->BindingManager()->ProcessAttachedQueue();
+    EndUpdate();
   }
 
+  // call XBL constructors after the frames are created
+  mPresShell->GetDocument()->BindingManager()->ProcessAttachedQueue();
+
   return NS_OK;
 }
 
diff --git a/layout/base/nsCSSFrameConstructor.h b/layout/base/nsCSSFrameConstructor.h
index 2e54708e1f1d..a680028d99b6 100644
--- a/layout/base/nsCSSFrameConstructor.h
+++ b/layout/base/nsCSSFrameConstructor.h
@@ -73,9 +73,6 @@ class nsPageContentFrame;
 struct PendingBinding;
 class nsRefreshDriver;
 
-typedef void (nsLazyFrameConstructionCallback)
-             (nsIContent* aContent, nsIFrame* aFrame, void* aArg);
-
 class nsFrameConstructorState;
 class nsFrameConstructorSaveState;
 
@@ -242,18 +239,8 @@ public:
                                 nsIContent*     aContent2,
                                 PRInt32         aStateMask);
 
-  // Process the children of aContent and indicate that frames should be
-  // created for them. This is used for lazily built content such as that
-  // inside popups so that it is only created when the popup is opened.
-  // If aIsSynch is true, this method constructs the frames synchronously.
-  // aCallback will be called with three arguments, the first is the value
-  // of aContent, the second is aContent's primary frame, and the third is
-  // the value of aArg.
-  // aCallback will always be called even if the children of aContent had
-  // been generated earlier.
-  nsresult AddLazyChildren(nsIContent* aContent,
-                           nsLazyFrameConstructionCallback* aCallback,
-                           void* aArg, PRBool aIsSynch = PR_FALSE);
+  // generate the child frames and process bindings
+  nsresult GenerateChildFrames(nsIFrame* aFrame);
 
   // Should be called when a frame is going to be destroyed and
   // WillDestroyFrameTree hasn't been called yet.
@@ -1809,27 +1796,6 @@ public:
 
 private:
 
-  class LazyGenerateChildrenEvent;
-  friend class LazyGenerateChildrenEvent;
-
-  // See comments of nsCSSFrameConstructor::AddLazyChildren()
-  class LazyGenerateChildrenEvent : public nsRunnable {
-  public:
-    NS_DECL_NSIRUNNABLE
-    LazyGenerateChildrenEvent(nsIContent *aContent,
-                              nsIPresShell *aPresShell,
-                              nsLazyFrameConstructionCallback* aCallback,
-                              void* aArg)
-      : mContent(aContent), mPresShell(aPresShell), mCallback(aCallback), mArg(aArg)
-    {}
-
-  private:
-    nsCOMPtr<nsIContent> mContent;
-    nsCOMPtr<nsIPresShell> mPresShell;
-    nsLazyFrameConstructionCallback* mCallback;
-    void* mArg;
-  };
-
   nsIDocument*        mDocument;  // Weak ref
   nsIPresShell*       mPresShell; // Weak ref
 
diff --git a/layout/xul/base/public/nsXULPopupManager.h b/layout/xul/base/public/nsXULPopupManager.h
index 49c2d6a0de7f..38e3df2a7182 100644
--- a/layout/xul/base/public/nsXULPopupManager.h
+++ b/layout/xul/base/public/nsXULPopupManager.h
@@ -51,6 +51,7 @@
 #include "nsCOMPtr.h"
 #include "nsTArray.h"
 #include "nsITimer.h"
+#include "nsIReflowCallback.h"
 #include "nsThreadUtils.h"
 #include "nsStyleConsts.h"
 
@@ -208,26 +209,19 @@ class nsXULPopupShowingEvent : public nsRunnable
 {
 public:
   nsXULPopupShowingEvent(nsIContent *aPopup,
-                         nsIContent *aMenu,
-                         nsPopupType aPopupType,
                          PRBool aIsContextMenu,
                          PRBool aSelectFirstItem)
     : mPopup(aPopup),
-      mMenu(aMenu),
-      mPopupType(aPopupType),
       mIsContextMenu(aIsContextMenu),
       mSelectFirstItem(aSelectFirstItem)
   {
     NS_ASSERTION(aPopup, "null popup supplied to nsXULPopupShowingEvent constructor");
-    NS_ASSERTION(aMenu, "null menu supplied to nsXULPopupShowingEvent constructor");
   }
 
   NS_IMETHOD Run();
 
 private:
   nsCOMPtr<nsIContent> mPopup;
-  nsCOMPtr<nsIContent> mMenu;
-  nsPopupType mPopupType;
   PRBool mIsContextMenu;
   PRBool mSelectFirstItem;
 };
@@ -659,22 +653,13 @@ protected:
                          PRBool aDeselectMenu);
 
   /**
-   * Fire a popupshowing event on the popup aPopup and then open the popup.
+   * Fire a popupshowing event on the popup and then open the popup.
    *
-   * The caller must keep a strong reference to aPopup.
-   *
-   * aPopup - the popup node to open
-   * aMenu - should be set to the parent menu if this is a popup associated
-   *         with a menu. Otherwise, should be null.
-   * aPresContext - the prescontext 
-   * aPopupType - the popup frame's PopupType
+   * aPopup - the popup to open
    * aIsContextMenu - true for context menus
    * aSelectFirstItem - true to select the first item in the menu
    */
   void FirePopupShowingEvent(nsIContent* aPopup,
-                             nsIContent* aMenu,
-                             nsPresContext* aPresContext,
-                             nsPopupType aPopupType,
                              PRBool aIsContextMenu,
                              PRBool aSelectFirstItem);
 
diff --git a/layout/xul/base/src/nsMenuFrame.h b/layout/xul/base/src/nsMenuFrame.h
index a351b9be0375..141f5d21037e 100644
--- a/layout/xul/base/src/nsMenuFrame.h
+++ b/layout/xul/base/src/nsMenuFrame.h
@@ -185,14 +185,11 @@ public:
 
   // nsMenuFrame methods 
 
-  nsresult DestroyPopupFrames(nsPresContext* aPresContext);
-
   virtual PRBool IsOnMenuBar() { return mMenuParent && mMenuParent->IsMenuBar(); }
   virtual PRBool IsOnActiveMenuBar() { return IsOnMenuBar() && mMenuParent->IsActive(); }
   virtual PRBool IsOpen();
   virtual PRBool IsMenu();
   PRBool IsDisabled();
-  PRBool IsGenerated();
   void ToggleMenuState();
 
   // indiciate that the menu's popup has just been opened, so that the menu
diff --git a/layout/xul/base/src/nsMenuPopupFrame.cpp b/layout/xul/base/src/nsMenuPopupFrame.cpp
index 290dbd60fc91..b5cb20937b9c 100644
--- a/layout/xul/base/src/nsMenuPopupFrame.cpp
+++ b/layout/xul/base/src/nsMenuPopupFrame.cpp
@@ -40,7 +40,6 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-
 #include "nsMenuPopupFrame.h"
 #include "nsGkAtoms.h"
 #include "nsIContent.h"
@@ -406,11 +405,27 @@ nsMenuPopupFrame::IsLeaf() const
 void
 nsMenuPopupFrame::LayoutPopup(nsBoxLayoutState& aState, nsIFrame* aParentMenu, PRBool aSizedToPopup)
 {
-  // if the popup is not open, only do layout if the menu is sized to the popup
-  PRBool isOpen = IsOpen();
-  if (!mGeneratedChildren || (!isOpen && !aSizedToPopup))
+  if (!mGeneratedChildren)
     return;
 
+  PRBool shouldPosition = PR_TRUE;
+  PRBool isOpen = IsOpen();
+  if (!isOpen) {
+    // if the popup is not open, only do layout while showing or if the menu
+    // is sized to the popup
+    shouldPosition = (mPopupState == ePopupShowing);
+    if (!shouldPosition && !aSizedToPopup)
+      return;
+  }
+
+  // if the popup has just been opened, make sure the scrolled window is at 0,0
+  if (mIsOpenChanged) {
+    nsIScrollableFrame *scrollframe = do_QueryFrame(GetChildBox());
+    if (scrollframe) {
+      scrollframe->ScrollTo(nsPoint(0,0), nsIScrollableFrame::INSTANT);
+    }
+  }
+
   // get the preferred, minimum and maximum size. If the menu is sized to the
   // popup, then the popup's width is the menu's width.
   nsSize prefSize = GetPrefSize(aState);
@@ -429,7 +444,7 @@ nsMenuPopupFrame::LayoutPopup(nsBoxLayoutState& aState, nsIFrame* aParentMenu, P
     mPrefSize = prefSize;
   }
 
-  if (isOpen) {
+  if (shouldPosition) {
     SetPopupPosition(aParentMenu, PR_FALSE);
   }
 
@@ -452,50 +467,36 @@ nsMenuPopupFrame::LayoutPopup(nsBoxLayoutState& aState, nsIFrame* aParentMenu, P
     }
   }
 
-  if (isOpen) {
-    AdjustView();
-  }
-}
-
-void
-nsMenuPopupFrame::AdjustView()
-{
-  // if the popup has just opened, make sure the scrolled window is at 0,0
-  if (mIsOpenChanged) {
-    nsIBox* child = GetChildBox();
-    nsIScrollableFrame *scrollframe = do_QueryFrame(child);
-    if (scrollframe)
-      scrollframe->ScrollTo(nsPoint(0,0), nsIScrollableFrame::INSTANT);
-  }
-
-  nsIView* view = GetView();
-  nsIViewManager* viewManager = view->GetViewManager();
-  nsRect rect = GetRect();
-  rect.x = rect.y = 0;
-
-  // Increase the popup's view size to account for any titlebar or borders.
-  // XXXndeakin this should really be accounted for earlier in
-  // SetPopupPosition so that this extra size is accounted for when flipping
-  // or resizing the popup due to it being too large, but that can be a
-  // followup bug.
   nsPresContext* pc = PresContext();
-  if (mPopupType == ePopupTypePanel && view) {
-    nsIWidget* widget = view->GetWidget();
-    if (widget) {
-      nsIntSize popupSize = nsIntSize(pc->AppUnitsToDevPixels(rect.width),
-                                      pc->AppUnitsToDevPixels(rect.height));
-      popupSize = widget->ClientToWindowSize(popupSize);
-      rect.width = pc->DevPixelsToAppUnits(popupSize.width);
-      rect.height = pc->DevPixelsToAppUnits(popupSize.height);
+  if (isOpen) {
+    nsIView* view = GetView();
+    nsIViewManager* viewManager = view->GetViewManager();
+    nsRect rect = GetRect();
+    rect.x = rect.y = 0;
+
+    // Increase the popup's view size to account for any titlebar or borders.
+    // XXXndeakin this should really be accounted for earlier in
+    // SetPopupPosition so that this extra size is accounted for when flipping
+    // or resizing the popup due to it being too large, but that can be a
+    // followup bug.
+    if (mPopupType == ePopupTypePanel && view) {
+      nsIWidget* widget = view->GetWidget();
+      if (widget) {
+        nsIntSize popupSize = nsIntSize(pc->AppUnitsToDevPixels(rect.width),
+                                        pc->AppUnitsToDevPixels(rect.height));
+        popupSize = widget->ClientToWindowSize(popupSize);
+        rect.width = pc->DevPixelsToAppUnits(popupSize.width);
+        rect.height = pc->DevPixelsToAppUnits(popupSize.height);
+      }
     }
+    viewManager->ResizeView(view, rect);
+
+    viewManager->SetViewVisibility(view, nsViewVisibility_kShow);
+    mPopupState = ePopupOpenAndVisible;
+    nsContainerFrame::SyncFrameViewProperties(pc, this, nsnull, view, 0);
   }
-  viewManager->ResizeView(view, rect);
 
-  viewManager->SetViewVisibility(view, nsViewVisibility_kShow);
-  mPopupState = ePopupOpenAndVisible;
-  nsContainerFrame::SyncFrameViewProperties(pc, this, nsnull, view, 0);
-
-  // fire popupshown event when the state has changed
+  // finally, if the popup just opened, send a popupshown event
   if (mIsOpenChanged) {
     mIsOpenChanged = PR_FALSE;
     nsCOMPtr<nsIRunnable> event = new nsXULPopupShownEvent(GetContent(), pc);
@@ -693,44 +694,10 @@ nsMenuPopupFrame::InitializePopupWithAnchorAlign(nsIContent* aAnchorContent,
 }
 
 void
-LazyGeneratePopupDone(nsIContent* aPopup, nsIFrame* aFrame, void* aArg)
-{
-  // be safe and check the frame type
-  if (aFrame->GetType() == nsGkAtoms::menuPopupFrame) {
-    nsWeakFrame weakFrame(aFrame);
-    nsMenuPopupFrame* popupFrame = static_cast<nsMenuPopupFrame*>(aFrame);
-
-    nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
-    if (pm && popupFrame->IsMenu()) {
-      nsCOMPtr<nsIContent> popup = aPopup;
-      pm->UpdateMenuItems(popup);
-
-      if (!weakFrame.IsAlive())
-        return;
-
-      PRBool selectFirstItem = (PRBool)NS_PTR_TO_INT32(aArg);
-      if (selectFirstItem) {
-        nsMenuFrame* next = pm->GetNextMenuItem(popupFrame, nsnull, PR_TRUE);
-        popupFrame->SetCurrentMenuItem(next);
-      }
-    }
-
-    if (weakFrame.IsAlive()) {
-      popupFrame->PresContext()->PresShell()->
-        FrameNeedsReflow(popupFrame, nsIPresShell::eTreeChange,
-                         NS_FRAME_HAS_DIRTY_CHILDREN);
-    }
-  }
-}
-
-
-PRBool
 nsMenuPopupFrame::ShowPopup(PRBool aIsContextMenu, PRBool aSelectFirstItem)
 {
   mIsContextMenu = aIsContextMenu;
 
-  PRBool hasChildren = PR_FALSE;
-
   if (mPopupState == ePopupShowing) {
     mPopupState = ePopupOpen;
     mIsOpenChanged = PR_TRUE;
@@ -740,21 +707,14 @@ nsMenuPopupFrame::ShowPopup(PRBool aIsContextMenu, PRBool aSelectFirstItem)
       nsWeakFrame weakFrame(this);
       menuFrame->PopupOpened();
       if (!weakFrame.IsAlive())
-        return PR_FALSE;
+        return;
     }
 
-    // the frames for the child menus have not been created yet, so tell the
-    // frame constructor to build them
-    if (mFrames.IsEmpty() && !mGeneratedChildren) {
-      PresContext()->PresShell()->FrameConstructor()->
-        AddLazyChildren(mContent, LazyGeneratePopupDone, NS_INT32_TO_PTR(aSelectFirstItem));
-    }
-    else {
-      hasChildren = PR_TRUE;
-      PresContext()->PresShell()->
-        FrameNeedsReflow(this, nsIPresShell::eTreeChange,
-                         NS_FRAME_HAS_DIRTY_CHILDREN);
-    }
+    // do we need an actual reflow here?
+    // is SetPopupPosition all that is needed?
+    PresContext()->PresShell()->FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                                                 NS_FRAME_HAS_DIRTY_CHILDREN);
+
     if (mPopupType == ePopupTypeMenu) {
       nsCOMPtr<nsISound> sound(do_CreateInstance("@mozilla.org/sound;1"));
       if (sound)
@@ -763,7 +723,6 @@ nsMenuPopupFrame::ShowPopup(PRBool aIsContextMenu, PRBool aSelectFirstItem)
   }
 
   mShouldAutoPosition = PR_TRUE;
-  return hasChildren;
 }
 
 void
@@ -1713,10 +1672,12 @@ nsMenuPopupFrame::AttributeChanged(PRInt32 aNameSpaceID,
   if (aAttribute == nsGkAtoms::menugenerated &&
       mFrames.IsEmpty() && !mGeneratedChildren) {
     EnsureWidget();
-    PresContext()->PresShell()->FrameConstructor()->
-      AddLazyChildren(mContent, LazyGeneratePopupDone, nsnull, PR_TRUE);
+
+    // indicate that the children have been generated and then generate them
+    mGeneratedChildren = PR_TRUE;
+    PresContext()->PresShell()->FrameConstructor()->GenerateChildFrames(this);
   }
-  
+
   return rv;
 }
 
diff --git a/layout/xul/base/src/nsMenuPopupFrame.h b/layout/xul/base/src/nsMenuPopupFrame.h
index ed8b438f987a..727b94c2c746 100644
--- a/layout/xul/base/src/nsMenuPopupFrame.h
+++ b/layout/xul/base/src/nsMenuPopupFrame.h
@@ -65,9 +65,8 @@ class nsIWidget;
 //   ePopupShowing - during the period when the popupshowing event fires
 //   ePopupOpen - between the popupshowing event and being visible. Creation
 //                of the child frames, layout and reflow occurs in this state.
-//   ePopupOpenAndVisible - layout is done and AdjustView is called to make
-//                          the popup's widget visible. The popup is now
-//                          visible and the popupshown event fires.
+//   ePopupOpenAndVisible - layout is done and the popup's view and widget are
+//                          made visible. The popupshown event fires.
 // When closing a popup:
 //   ePopupHidden - during the period when the popuphiding event fires and
 //                  the popup is removed.
@@ -203,9 +202,6 @@ public:
   // layout, position and display the popup as needed
   void LayoutPopup(nsBoxLayoutState& aState, nsIFrame* aParentMenu, PRBool aSizedToPopup);
 
-  // AdjustView is called by LayoutPopup to position and show the popup's view.
-  void AdjustView();
-
   nsIView* GetRootViewForPopup(nsIFrame* aStartFrame);
 
   // set the position of the popup either relative to the anchor aAnchorFrame
@@ -269,7 +265,7 @@ public:
                                       PRInt32 aXPos, PRInt32 aYPos);
 
   // indicate that the popup should be opened
-  PRBool ShowPopup(PRBool aIsContextMenu, PRBool aSelectFirstItem);
+  void ShowPopup(PRBool aIsContextMenu, PRBool aSelectFirstItem);
   // indicate that the popup should be hidden. The new state should either be
   // ePopupClosed or ePopupInvisible.
   void HidePopup(PRBool aDeselectMenu, nsPopupState aNewState);
diff --git a/layout/xul/base/src/nsXULPopupManager.cpp b/layout/xul/base/src/nsXULPopupManager.cpp
index fc39993b3331..c52870b1ae03 100644
--- a/layout/xul/base/src/nsXULPopupManager.cpp
+++ b/layout/xul/base/src/nsXULPopupManager.cpp
@@ -364,7 +364,7 @@ nsXULPopupManager::GetFrameOfTypeForContent(nsIContent* aContent,
     if (document) {
       nsCOMPtr<nsIPresShell> presShell = document->GetShell();
       if (presShell)
-        presShell->FlushPendingNotifications(Flush_Frames);
+        presShell->FlushPendingNotifications(Flush_Layout);
     }
   }
 
@@ -540,21 +540,19 @@ nsXULPopupManager::ShowMenu(nsIContent *aMenu,
   else
     position.AssignLiteral("end_before");
 
+  // there is no trigger event for menus
+  InitTriggerEvent(nsnull, nsnull, nsnull);
   popupFrame->InitializePopup(aMenu, nsnull, position, 0, 0, PR_TRUE);
 
   if (aAsynchronous) {
-    // there is no trigger event for menus
-    InitTriggerEvent(nsnull, nsnull, nsnull);
     nsCOMPtr<nsIRunnable> event =
-      new nsXULPopupShowingEvent(popupFrame->GetContent(), aMenu, popupFrame->PopupType(),
+      new nsXULPopupShowingEvent(popupFrame->GetContent(),
                                  parentIsContextMenu, aSelectFirstItem);
     NS_DispatchToCurrentThread(event);
   }
   else {
     nsCOMPtr<nsIContent> popupContent = popupFrame->GetContent();
-    FirePopupShowingEvent(popupContent, aMenu,
-                          popupFrame->PresContext(), popupFrame->PopupType(),
-                          parentIsContextMenu, aSelectFirstItem);
+    FirePopupShowingEvent(popupContent, parentIsContextMenu, aSelectFirstItem);
   }
 }
 
@@ -578,8 +576,7 @@ nsXULPopupManager::ShowPopup(nsIContent* aPopup,
   popupFrame->InitializePopup(aAnchorContent, triggerContent, aPosition,
                               aXPos, aYPos, aAttributesOverride);
 
-  FirePopupShowingEvent(aPopup, nsnull, popupFrame->PresContext(),
-                        popupFrame->PopupType(), aIsContextMenu, aSelectFirstItem);
+  FirePopupShowingEvent(aPopup, aIsContextMenu, aSelectFirstItem);
 }
 
 void
@@ -596,9 +593,7 @@ nsXULPopupManager::ShowPopupAtScreen(nsIContent* aPopup,
   InitTriggerEvent(aTriggerEvent, aPopup, getter_AddRefs(triggerContent));
 
   popupFrame->InitializePopupAtScreen(triggerContent, aXPos, aYPos, aIsContextMenu);
-
-  FirePopupShowingEvent(aPopup, nsnull, popupFrame->PresContext(),
-                        popupFrame->PopupType(), aIsContextMenu, PR_FALSE);
+  FirePopupShowingEvent(aPopup, aIsContextMenu, PR_FALSE);
 }
 
 void
@@ -617,9 +612,7 @@ nsXULPopupManager::ShowPopupWithAnchorAlign(nsIContent* aPopup,
 
   popupFrame->InitializePopupWithAnchorAlign(aAnchorContent, aAnchor,
                                              aAlign, aXPos, aYPos);
-
-  FirePopupShowingEvent(aPopup, nsnull, popupFrame->PresContext(),
-                        popupFrame->PopupType(), aIsContextMenu, PR_FALSE);
+  FirePopupShowingEvent(aPopup, aIsContextMenu, PR_FALSE);
 }
 
 static void
@@ -686,7 +679,7 @@ nsXULPopupManager::ShowPopupCallback(nsIContent* aPopup,
 
   // use a weak frame as the popup will set an open attribute if it is a menu
   nsWeakFrame weakFrame(aPopupFrame);
-  PRBool hasChildren = aPopupFrame->ShowPopup(aIsContextMenu, aSelectFirstItem);
+  aPopupFrame->ShowPopup(aIsContextMenu, aSelectFirstItem);
   ENSURE_TRUE(weakFrame.IsAlive());
 
   // popups normally hide when an outside click occurs. Panels may use
@@ -706,16 +699,14 @@ nsXULPopupManager::ShowPopupCallback(nsIContent* aPopup,
     SetCaptureState(oldmenu);
   }
 
-  if (hasChildren) {
-    if (aSelectFirstItem) {
-      nsMenuFrame* next = GetNextMenuItem(aPopupFrame, nsnull, PR_TRUE);
-      aPopupFrame->SetCurrentMenuItem(next);
-    }
-
-    if (ismenu)
-      UpdateMenuItems(aPopup);
+  if (aSelectFirstItem) {
+    nsMenuFrame* next = GetNextMenuItem(aPopupFrame, nsnull, PR_TRUE);
+    aPopupFrame->SetCurrentMenuItem(next);
   }
 
+  if (ismenu)
+    UpdateMenuItems(aPopup);
+
   // Caret visibility may have been affected, ensure that
   // the caret isn't now drawn when it shouldn't be.
   CheckCaretDrawingState();
@@ -1081,13 +1072,33 @@ nsXULPopupManager::ExecuteMenu(nsIContent* aMenu, nsXULMenuCommandEvent* aEvent)
 
 void
 nsXULPopupManager::FirePopupShowingEvent(nsIContent* aPopup,
-                                         nsIContent* aMenu,
-                                         nsPresContext* aPresContext,
-                                         nsPopupType aPopupType,
                                          PRBool aIsContextMenu,
                                          PRBool aSelectFirstItem)
 {
-  nsCOMPtr<nsIPresShell> presShell = aPresContext->PresShell();
+  nsCOMPtr<nsIContent> popup = aPopup; // keep a strong reference to the popup
+
+  nsIFrame* frame = aPopup->GetPrimaryFrame();
+  if (!frame || frame->GetType() != nsGkAtoms::menuPopupFrame)
+    return;
+
+  nsMenuPopupFrame* popupFrame = static_cast<nsMenuPopupFrame *>(frame);
+  nsPresContext *presContext = popupFrame->PresContext();
+  nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
+  nsPopupType popupType = popupFrame->PopupType();
+
+  // generate the child frames if they have not already been generated
+  if (!popupFrame->HasGeneratedChildren()) {
+    popupFrame->SetGeneratedChildren();
+    presShell->FrameConstructor()->GenerateChildFrames(popupFrame);
+  }
+
+  // get the frame again
+  frame = aPopup->GetPrimaryFrame();
+  if (!frame)
+    return;
+
+  presShell->FrameNeedsReflow(frame, nsIPresShell::eTreeChange,
+                              NS_FRAME_HAS_DIRTY_CHILDREN);
 
   // cache the popup so that document.popupNode can retrieve the trigger node
   // during the popupshowing event. It will be cleared below after the event
@@ -1109,7 +1120,7 @@ nsXULPopupManager::FirePopupShowingEvent(nsIContent* aPopup,
   }
 
   event.refPoint = mCachedMousePoint;
-  nsEventDispatcher::Dispatch(aPopup, aPresContext, &event, nsnull, &status);
+  nsEventDispatcher::Dispatch(popup, presContext, &event, nsnull, &status);
   mCachedMousePoint = nsIntPoint(0, 0);
   mOpeningPopup = nsnull;
 
@@ -1117,12 +1128,12 @@ nsXULPopupManager::FirePopupShowingEvent(nsIContent* aPopup,
   // This is done after the popupshowing event in case that event is cancelled.
   // Using noautofocus="true" will disable this behaviour, which is needed for
   // the autocomplete widget as it manages focus itself.
-  if (aPopupType == ePopupTypePanel &&
-      !aPopup->AttrValueIs(kNameSpaceID_None, nsGkAtoms::noautofocus,
+  if (popupType == ePopupTypePanel &&
+      !popup->AttrValueIs(kNameSpaceID_None, nsGkAtoms::noautofocus,
                            nsGkAtoms::_true, eCaseMatters)) {
     nsIFocusManager* fm = nsFocusManager::GetFocusManager();
     if (fm) {
-      nsIDocument* doc = aPopup->GetCurrentDoc();
+      nsIDocument* doc = popup->GetCurrentDoc();
 
       // Only remove the focus if the currently focused item is ouside the
       // popup. It isn't a big deal if the current focus is in a child popup
@@ -1133,27 +1144,18 @@ nsXULPopupManager::FirePopupShowingEvent(nsIContent* aPopup,
       fm->GetFocusedElement(getter_AddRefs(currentFocusElement));
       nsCOMPtr<nsIContent> currentFocus = do_QueryInterface(currentFocusElement);
       if (doc && currentFocus &&
-          !nsContentUtils::ContentIsCrossDocDescendantOf(currentFocus, aPopup)) {
+          !nsContentUtils::ContentIsCrossDocDescendantOf(currentFocus, popup)) {
         fm->ClearFocus(doc->GetWindow());
       }
     }
   }
 
-  // it is common to append content to the menu during the popupshowing event.
-  // Flush the notifications so that the frames are up to date before showing
-  // the popup, otherwise the new frames will reflow after the popup appears,
-  // causing the popup to flicker. Frame code always calls this asynchronously,
-  // so this should be safe.
-  nsIDocument *document = aPopup->GetCurrentDoc();
-  if (document)
-    document->FlushPendingNotifications(Flush_Layout);
-
   // clear these as they are no longer valid
   mRangeParent = nsnull;
   mRangeOffset = 0;
 
   // get the frame again in case it went away
-  nsIFrame* frame = aPopup->GetPrimaryFrame();
+  frame = aPopup->GetPrimaryFrame();
   if (frame && frame->GetType() == nsGkAtoms::menuPopupFrame) {
     nsMenuPopupFrame* popupFrame = static_cast<nsMenuPopupFrame *>(frame);
 
@@ -2160,27 +2162,12 @@ nsXULPopupManager::KeyPress(nsIDOMEvent* aKeyEvent)
   return NS_OK; // I am consuming event
 }
 
-static nsPresContext*
-GetPresContextFor(nsIContent* aContent)
-{
-  nsIDocument *document = aContent->GetCurrentDoc();
-  if (document) {
-    nsIPresShell* presShell = document->GetShell();
-    if (presShell)
-      return presShell->GetPresContext();
-  }
-
-  return nsnull;
-}
-
 NS_IMETHODIMP
 nsXULPopupShowingEvent::Run()
 {
   nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
-  nsPresContext* context = GetPresContextFor(mPopup);
-  if (pm && context) {
-    pm->FirePopupShowingEvent(mPopup, mMenu, context, mPopupType,
-                              mIsContextMenu, mSelectFirstItem);
+  if (pm) {
+    pm->FirePopupShowingEvent(mPopup, mIsContextMenu, mSelectFirstItem);
   }
 
   return NS_OK;
@@ -2190,10 +2177,17 @@ NS_IMETHODIMP
 nsXULPopupHidingEvent::Run()
 {
   nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
-  nsPresContext* context = GetPresContextFor(mPopup);
-  if (pm && context) {
-    pm->FirePopupHidingEvent(mPopup, mNextPopup, mLastPopup,
-                             context, mPopupType, mDeselectMenu);
+
+  nsIDocument *document = mPopup->GetCurrentDoc();
+  if (pm && document) {
+    nsIPresShell* presShell = document->GetShell();
+    if (presShell) {
+      nsPresContext* context = presShell->GetPresContext();
+      if (context) {
+        pm->FirePopupHidingEvent(mPopup, mNextPopup, mLastPopup,
+                                 context, mPopupType, mDeselectMenu);
+      }
+    }
   }
 
   return NS_OK;
diff --git a/toolkit/content/tests/widgets/test_popup_coords.xul b/toolkit/content/tests/widgets/test_popup_coords.xul
index ea66cffce5a7..2d9cf52eacd7 100644
--- a/toolkit/content/tests/widgets/test_popup_coords.xul
+++ b/toolkit/content/tests/widgets/test_popup_coords.xul
@@ -73,6 +73,12 @@ function popupShowingEventOccurred(event)
   // should be one higher than its index within its parent.
   is(event.rangeParent, trigger.parentNode, testname + "rangeParent");
   is(event.rangeOffset, Array.indexOf(trigger.parentNode.childNodes, trigger) + 1, testname + "rangeOffset");
+
+  var popuprect = event.target.getBoundingClientRect();
+  is(Math.round(popuprect.left), Math.round(rect.left + 4), "popup left");
+  is(Math.round(popuprect.top), Math.round(rect.top + 5), "popup top");
+  ok(popuprect.width > 0, "popup width");
+  ok(popuprect.height > 0, "popup height");
 }
 </script>
 
diff --git a/toolkit/content/tests/widgets/test_popup_scaled.xul b/toolkit/content/tests/widgets/test_popup_scaled.xul
index 7e5b75e3a412..a1bd45688991 100644
--- a/toolkit/content/tests/widgets/test_popup_scaled.xul
+++ b/toolkit/content/tests/widgets/test_popup_scaled.xul
@@ -36,6 +36,7 @@ function runTests()
   setScale($("frame").contentWindow, 2);
 
   var anchor = $("frame").contentDocument.getElementById("two");
+  anchor.getBoundingClientRect(); // flush to update display after scale change
   $("popup").openPopup(anchor, "after_start");
 }
 
diff --git a/toolkit/content/tests/widgets/test_popuphidden.xul b/toolkit/content/tests/widgets/test_popuphidden.xul
index 17a2206a58de..a9c27b6b28b8 100644
--- a/toolkit/content/tests/widgets/test_popuphidden.xul
+++ b/toolkit/content/tests/widgets/test_popuphidden.xul
@@ -10,7 +10,13 @@
 <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>      
 
 <menupopup id="popup" hidden="true" onpopupshown="ok(true, 'popupshown'); this.hidePopup()"
-                                    onpopuphidden="runTests($('popupinbutton'));">
+                                    onpopuphidden="$('popup-hideonshow').openPopup(null, 'after_start')">
+  <menuitem id="i1" label="One"/>
+  <menuitem id="i2" label="Two"/>
+</menupopup>
+
+<menupopup id="popup-hideonshow" onpopupshowing="hidePopupWhileShowing(this)"
+                                 onpopupshown="ok(false, 'popupshown when hidden')">
   <menuitem id="i1" label="One"/>
   <menuitem id="i2" label="Two"/>
 </menupopup>
@@ -34,6 +40,13 @@ function runTests(popup)
   popup.openPopup(null, "after_start");
 }
 
+function hidePopupWhileShowing(popup)
+{
+  popup.hidden = true;
+  is(popup.state, 'closed', 'popupshowing hidden');
+  SimpleTest.executeSoon(function () runTests($('popupinbutton')));
+}
+
 function checkEndTest(event)
 {
   var button = $("button");

From 93aed894ab70abef6653b896f9c4ff6507d51f5f Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nz>
Date: Mon, 6 Sep 2010 16:52:22 +1200
Subject: [PATCH 187/222] Backed out changeset 528a97f6bc3b a=backout

---
 content/media/nsBuiltinDecoderReader.h        |   9 --
 .../media/nsBuiltinDecoderStateMachine.cpp    | 137 ++++++++----------
 content/media/nsBuiltinDecoderStateMachine.h  |  11 --
 content/media/nsMediaDecoder.cpp              |  26 +---
 4 files changed, 59 insertions(+), 124 deletions(-)

diff --git a/content/media/nsBuiltinDecoderReader.h b/content/media/nsBuiltinDecoderReader.h
index 4ef5888b400d..8905d1c2524b 100644
--- a/content/media/nsBuiltinDecoderReader.h
+++ b/content/media/nsBuiltinDecoderReader.h
@@ -330,15 +330,6 @@ template <class T> class MediaQueue : private nsDeque {
     return GetSize() == 0 && mEndOfStream;    
   }
 
-  // Returns PR_TRUE if the media queue has had its last sample added to it.
-  // This happens when the media stream has been completely decoded. Note this
-  // does not mean that the corresponding stream has finished playback.
-  PRBool IsFinished() {
-    MonitorAutoEnter mon(mMonitor);
-    return mEndOfStream;    
-  }
-
-  // Informs the media queue that it won't be receiving any more samples.
   void Finish() {
     MonitorAutoEnter mon(mMonitor);
     mEndOfStream = PR_TRUE;    
diff --git a/content/media/nsBuiltinDecoderStateMachine.cpp b/content/media/nsBuiltinDecoderStateMachine.cpp
index 5c34c6152015..48be18750d5d 100644
--- a/content/media/nsBuiltinDecoderStateMachine.cpp
+++ b/content/media/nsBuiltinDecoderStateMachine.cpp
@@ -99,11 +99,6 @@ const PRUint32 SILENCE_BYTES_CHUNK = 32 * 1024;
 // less than LOW_VIDEO_FRAMES frames.
 static const PRUint32 LOW_VIDEO_FRAMES = 1;
 
-// If we've got more than AMPLE_VIDEO_FRAMES decoded video frames waiting in
-// the video queue, we will not decode any more video frames until some have
-// been consumed by the play state machine thread.
-static const PRUint32 AMPLE_VIDEO_FRAMES = 10;
-
 // Arbitrary "frame duration" when playing only audio.
 static const int AUDIO_DURATION_MS = 40;
 
@@ -167,20 +162,19 @@ nsBuiltinDecoderStateMachine::~nsBuiltinDecoderStateMachine()
 
 PRBool nsBuiltinDecoderStateMachine::HasFutureAudio() const {
   mDecoder->GetMonitor().AssertCurrentThreadIn();
-  NS_ASSERTION(HasAudio(), "Should only call HasFutureAudio() when we have audio");
-  // We've got audio ready to play if:
-  // 1. We've not completed playback of audio, and
-  // 2. we either have more than the threshold of decoded audio available, or
-  //    we've completely decoded all audio (but not finished playing it yet
-  //    as per 1).
-  return !mAudioCompleted &&
-         (AudioDecodedMs() > LOW_AUDIO_MS || mReader->mAudioQueue.IsFinished());
+  PRBool aboveLowAudioThreshold = PR_FALSE;
+  if (mAudioEndTime != -1) {
+    aboveLowAudioThreshold = mAudioEndTime - GetMediaTime() > LOW_AUDIO_MS;
+  }
+  return HasAudio() &&
+    !mAudioCompleted &&
+    (mReader->mAudioQueue.GetSize() > 0 || aboveLowAudioThreshold);
 }
 
 PRBool nsBuiltinDecoderStateMachine::HaveNextFrameData() const {
-  mDecoder->GetMonitor().AssertCurrentThreadIn();
-  return (!HasAudio() || HasFutureAudio()) &&
-         (!HasVideo() || mReader->mVideoQueue.GetSize() > 0);
+    return ((!HasAudio() || mReader->mAudioQueue.AtEndOfStream()) && 
+             mReader->mVideoQueue.GetSize() > 0) ||
+            HasFutureAudio();
 }
 
 void nsBuiltinDecoderStateMachine::DecodeLoop()
@@ -207,7 +201,12 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
 
   // Once we've decoded more than videoPumpThreshold video frames, we'll
   // no longer be considered to be "pumping video".
-  const unsigned videoPumpThreshold = AMPLE_VIDEO_FRAMES / 2;
+  const unsigned videoPumpThreshold = 5;
+
+  // If we've got more than videoWaitThreshold decoded video frames waiting in
+  // the video queue, we will not decode any more video frames until they've
+  // been consumed by the play state machine thread.
+  const unsigned videoWaitThreshold = 10;
 
   // After the audio decode fills with more than audioPumpThresholdMs ms
   // of decoded audio, we'll start to check whether the audio or video decode
@@ -222,6 +221,12 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
       // Wait for more data to download if we've exhausted all our
       // buffered data.
       MonitorAutoEnter mon(mDecoder->GetMonitor());
+      while (!mStopDecodeThreads &&
+             mBufferExhausted &&
+             mState != DECODER_STATE_SHUTDOWN)
+      {
+        mon.Wait();
+      }
       if (mState == DECODER_STATE_SHUTDOWN || mStopDecodeThreads)
         break;
     }
@@ -229,7 +234,7 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
     PRUint32 videoQueueSize = mReader->mVideoQueue.GetSize();
     // Don't decode any more frames if we've filled our buffers.
     // Limits memory consumption.
-    if (videoQueueSize > AMPLE_VIDEO_FRAMES) {
+    if (videoQueueSize > videoWaitThreshold) {
       videoWait = PR_TRUE;
     }
 
@@ -239,8 +244,7 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
     if (videoPump && videoQueueSize >= videoPumpThreshold) {
       videoPump = PR_FALSE;
     }
-    if (audioPlaying &&
-        !videoPump &&
+    if (!videoPump &&
         videoPlaying &&
         videoQueueSize < LOW_VIDEO_FRAMES)
     {
@@ -279,7 +283,9 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
       videoPlaying = mReader->DecodeVideoFrame(skipToNextKeyframe, currentTime);
       {
         MonitorAutoEnter mon(mDecoder->GetMonitor());
-        mBufferExhausted = mDecoder->mDecoderPosition > initialDownloadPosition;
+        if (mDecoder->mDecoderPosition > initialDownloadPosition) {
+          mBufferExhausted = PR_TRUE;
+        }
       }
     }
     {
@@ -293,7 +299,9 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
       audioPlaying = mReader->DecodeAudioData();
       {
         MonitorAutoEnter mon(mDecoder->GetMonitor());
-        mBufferExhausted = mDecoder->mDecoderPosition > initialDownloadPosition;
+        if (mDecoder->mDecoderPosition > initialDownloadPosition) {
+          mBufferExhausted = PR_TRUE;
+        }
       }
     }
 
@@ -317,15 +325,11 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
       if (mState == DECODER_STATE_SHUTDOWN || mStopDecodeThreads) {
         break;
       }
-
       if ((!HasAudio() || (audioWait && audioPlaying)) &&
           (!HasVideo() || (videoWait && videoPlaying)))
       {
         // All active bitstreams' decode is well ahead of the playback
-        // position, we may as well wait for the playback to catch up.
-        // Set mBufferExhausted to PR_FALSE, as we'll receive more data
-        // while we wait.
-        mBufferExhausted = PR_FALSE;
+        // position, we may as well wait have for the playback to catch up.
         mon.Wait();
       }
     }
@@ -844,39 +848,6 @@ nsBuiltinDecoderStateMachine::StartDecodeThreads()
   return NS_OK;
 }
 
-PRInt64 nsBuiltinDecoderStateMachine::AudioDecodedMs() const
-{
-  NS_ASSERTION(HasAudio(),
-               "Should only call AudioDecodedMs() when we have audio");
-  // The amount of audio we have decoded is the amount of audio data we've
-  // already decoded and pushed to the hardware, plus the amount of audio
-  // data waiting to be pushed to the hardware.
-  PRInt64 pushed = (mAudioEndTime != -1) ? (mAudioEndTime - GetMediaTime()) : 0;
-  return pushed + mReader->mAudioQueue.Duration();
-}
-
-PRBool nsBuiltinDecoderStateMachine::HasLowDecodedData() const
-{
-  // We consider ourselves low on decoded data if we're low on audio, or
-  // if we're only playing video and we're low on video frames.
-  return (HasAudio() && AudioDecodedMs() < LOW_AUDIO_MS)
-         ||
-         (!HasAudio() &&
-          HasVideo() &&
-          (PRUint32)mReader->mVideoQueue.GetSize() < LOW_VIDEO_FRAMES);
-}
-
-PRBool nsBuiltinDecoderStateMachine::HasAmpleDecodedData() const
-{
-  return (!HasAudio() ||
-          AudioDecodedMs() >= AMPLE_AUDIO_MS ||
-          mReader->mAudioQueue.IsFinished())
-         &&
-         (!HasVideo() ||
-          (PRUint32)mReader->mVideoQueue.GetSize() > AMPLE_VIDEO_FRAMES ||
-          mReader->mVideoQueue.AtEndOfStream());
-}
-
 nsresult nsBuiltinDecoderStateMachine::Run()
 {
   NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
@@ -967,16 +938,25 @@ nsresult nsBuiltinDecoderStateMachine::Run()
           continue;
 
         if (mBufferExhausted &&
-            HasLowDecodedData() &&
             mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING &&
-            !stream->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
-            !stream->IsSuspended())
+            !mDecoder->GetCurrentStream()->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
+            !mDecoder->GetCurrentStream()->IsSuspendedByCache() &&
+            ((HasAudio() && mReader->mAudioQueue.Duration() < LOW_AUDIO_MS) ||
+             (HasVideo() && (PRUint32)mReader->mVideoQueue.GetSize() < LOW_VIDEO_FRAMES)))
         {
-          // We're low on decoded data, and/or our decode has caught up with
-          // the download. Let's buffer to make sure we can play a decent
-          // amount of video in the future.
+          // There is at most one frame in the queue and there's
+          // more data to load. Let's buffer to make sure we can play a
+          // decent amount of video in the future.
           StartBuffering();
+        } else {
+          if (mBufferExhausted) {
+            // This will wake up the decode thread and force it to try to
+            // decode video and audio. This guarantees we make progress.
+            mBufferExhausted = PR_FALSE;
+            mDecoder->GetMonitor().NotifyAll();
+          }
         }
+
       }
       break;
 
@@ -1079,20 +1059,17 @@ nsresult nsBuiltinDecoderStateMachine::Run()
 
     case DECODER_STATE_BUFFERING:
       {
-        // We will remain in the buffering state if we've not decoded enough
-        // data to begin playback, or if we've not downloaded a reasonable
-        // amount of data inside our buffering time.
-        TimeDuration elapsed = TimeStamp::Now() - mBufferingStart;
-        if ((!mDecoder->CanPlayThrough() || !HasAmpleDecodedData()) &&
-             elapsed < TimeDuration::FromSeconds(BUFFERING_WAIT) &&
-             stream->GetCachedDataEnd(mDecoder->mDecoderPosition) < mBufferingEndOffset &&
-             !stream->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
-             !stream->IsSuspended())
-        {
+        TimeStamp now = TimeStamp::Now();
+        nsMediaStream* stream = mDecoder->GetCurrentStream();
+        if (!mDecoder->CanPlayThrough() &&
+            now - mBufferingStart < TimeDuration::FromSeconds(BUFFERING_WAIT) &&
+            stream->GetCachedDataEnd(mDecoder->mDecoderPosition) < mBufferingEndOffset &&
+            !stream->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
+            !stream->IsSuspendedByCache()) {
           LOG(PR_LOG_DEBUG,
-              ("In buffering: buffering data until %u bytes available or %f seconds",
-               PRUint32(mBufferingEndOffset - stream->GetCachedDataEnd(mDecoder->mDecoderPosition)),
-               BUFFERING_WAIT - elapsed.ToSeconds()));
+              ("In buffering: buffering data until %d bytes available or %f seconds",
+               PRUint32(mBufferingEndOffset - mDecoder->GetCurrentStream()->GetCachedDataEnd(mDecoder->mDecoderPosition)),
+               BUFFERING_WAIT - (now - mBufferingStart).ToSeconds()));
           Wait(1000);
           if (mState == DECODER_STATE_SHUTDOWN)
             continue;
@@ -1105,6 +1082,7 @@ nsresult nsBuiltinDecoderStateMachine::Run()
         }
 
         if (mState != DECODER_STATE_BUFFERING) {
+          mBufferExhausted = PR_FALSE;
           // Notify to allow blocked decoder thread to continue
           mDecoder->GetMonitor().NotifyAll();
           UpdateReadyState();
@@ -1114,6 +1092,7 @@ nsresult nsBuiltinDecoderStateMachine::Run()
             }
           }
         }
+
         break;
       }
 
diff --git a/content/media/nsBuiltinDecoderStateMachine.h b/content/media/nsBuiltinDecoderStateMachine.h
index 9e696158a25f..ddc1e003ec0f 100644
--- a/content/media/nsBuiltinDecoderStateMachine.h
+++ b/content/media/nsBuiltinDecoderStateMachine.h
@@ -242,17 +242,6 @@ public:
 
 protected:
 
-  // Returns the number of unplayed ms of audio we've got decoded and/or
-  // pushed to the hardware waiting to play. This is how much audio we can
-  // play without having to run the audio decoder.
-  PRInt64 AudioDecodedMs() const;
-
-  // Returns PR_TRUE if we're running low on decoded data.
-  PRBool HasLowDecodedData() const;
-
-  // Returns PR_TRUE if we've got plenty of decoded data.
-  PRBool HasAmpleDecodedData() const;
-
   // Returns PR_TRUE when there's decoded audio waiting to play.
   // The decoder monitor must be held.
   PRBool HasFutureAudio() const;
diff --git a/content/media/nsMediaDecoder.cpp b/content/media/nsMediaDecoder.cpp
index 607330f4ec5b..64bbeff52a31 100644
--- a/content/media/nsMediaDecoder.cpp
+++ b/content/media/nsMediaDecoder.cpp
@@ -68,14 +68,6 @@
 // Number of milliseconds of no data before a stall event is fired as defined by spec
 #define STALL_MS 3000
 
-// Number of estimated seconds worth of data we need to have buffered 
-// ahead of the current playback position before we allow the media decoder
-// to report that it can play through the entire media without the decode
-// catching up with the download. Having this margin make the
-// nsMediaDecoder::CanPlayThrough() calculation more stable in the case of
-// fluctuating bitrates.
-#define CAN_PLAY_THROUGH_MARGIN 20
-
 nsMediaDecoder::nsMediaDecoder() :
   mElement(0),
   mRGBWidth(-1),
@@ -297,21 +289,5 @@ PRBool nsMediaDecoder::CanPlayThrough()
   double timeToDownload =
     (bytesToDownload + gDownloadSizeSafetyMargin)/stats.mDownloadRate;
   double timeToPlay = bytesToPlayback/stats.mPlaybackRate;
-
-  if (timeToDownload > timeToPlay) {
-    // Estimated time to download is greater than the estimated time to play.
-    // We probably can't play through without having to stop to buffer.
-    return PR_FALSE;
-  }
-
-  // Estimated time to download is less than the estimated time to play.
-  // We can probably play through without having to buffer, but ensure that
-  // we've got a reasonable amount of data buffered after the current
-  // playback position, so that if the bitrate of the media fluctuates, or if
-  // our download rate or decode rate estimation is otherwise inaccurate,
-  // we don't suddenly discover that we need to buffer. This is particularly
-  // required near the start of the media, when not much data is downloaded.
-  PRInt64 readAheadMargin = stats.mPlaybackRate * CAN_PLAY_THROUGH_MARGIN;
-  return stats.mTotalBytes == stats.mDownloadPosition ||
-         stats.mDownloadPosition > stats.mPlaybackPosition + readAheadMargin;
+  return timeToDownload <= timeToPlay;
 }

From fb48311436339646c17c1a6166b9b2f3c86e3ca2 Mon Sep 17 00:00:00 2001
From: Chris Pearce <chris@pearce.org.nz>
Date: Mon, 6 Sep 2010 16:53:39 +1200
Subject: [PATCH 188/222] Backed out changeset 619459aa5005 a=backout

---
 content/media/nsBuiltinDecoderStateMachine.cpp | 13 ++++++-------
 content/media/nsBuiltinDecoderStateMachine.h   | 10 ----------
 2 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/content/media/nsBuiltinDecoderStateMachine.cpp b/content/media/nsBuiltinDecoderStateMachine.cpp
index 48be18750d5d..6bce566a33d9 100644
--- a/content/media/nsBuiltinDecoderStateMachine.cpp
+++ b/content/media/nsBuiltinDecoderStateMachine.cpp
@@ -164,7 +164,7 @@ PRBool nsBuiltinDecoderStateMachine::HasFutureAudio() const {
   mDecoder->GetMonitor().AssertCurrentThreadIn();
   PRBool aboveLowAudioThreshold = PR_FALSE;
   if (mAudioEndTime != -1) {
-    aboveLowAudioThreshold = mAudioEndTime - GetMediaTime() > LOW_AUDIO_MS;
+    aboveLowAudioThreshold = mAudioEndTime - mCurrentFrameTime + mStartTime > LOW_AUDIO_MS;
   }
   return HasAudio() &&
     !mAudioCompleted &&
@@ -259,7 +259,7 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
     PRInt64 audioDecoded = 0;
     {
       MonitorAutoEnter mon(mDecoder->GetMonitor());
-      currentTime = GetMediaTime();
+      currentTime = mCurrentFrameTime + mStartTime;
       audioDecoded = mReader->mAudioQueue.Duration();
       if (mAudioEndTime != -1) {
         audioDecoded += mAudioEndTime - currentTime;
@@ -451,7 +451,7 @@ void nsBuiltinDecoderStateMachine::AudioLoop()
         break;
       }
 
-      PRInt64 audioAhead = mAudioEndTime - GetMediaTime();
+      PRInt64 audioAhead = mAudioEndTime - mCurrentFrameTime - mStartTime;
       if (audioAhead > AMPLE_AUDIO_MS) {
         // We've pushed enough audio onto the hardware that we've queued up a
         // significant amount ahead of the playback position. The decode
@@ -653,7 +653,7 @@ void nsBuiltinDecoderStateMachine::UpdatePlaybackPosition(PRInt64 aTime)
   }
 
   // Notify DOM of any queued up audioavailable events
-  mEventManager.DispatchPendingEvents(GetMediaTime());
+  mEventManager.DispatchPendingEvents(mCurrentFrameTime + mStartTime);
 }
 
 void nsBuiltinDecoderStateMachine::ClearPositionChangeFlag()
@@ -989,7 +989,6 @@ nsresult nsBuiltinDecoderStateMachine::Run()
           StopPlayback(AUDIO_SHUTDOWN);
           StopDecodeThreads();
           ResetPlayback();
-          PRInt64 currentTime = GetMediaTime();
           nsresult res;
           {
             MonitorAutoExit exitMon(mDecoder->GetMonitor());
@@ -998,7 +997,7 @@ nsresult nsBuiltinDecoderStateMachine::Run()
             res = mReader->Seek(seekTime,
                                 mStartTime,
                                 mEndTime,
-                                currentTime);
+                                mCurrentFrameTime + mStartTime);
           }
           if (NS_SUCCEEDED(res)){
             PRInt64 audioTime = seekTime;
@@ -1036,7 +1035,7 @@ nsresult nsBuiltinDecoderStateMachine::Run()
         // if we need to seek again.
         
         nsCOMPtr<nsIRunnable> stopEvent;
-        if (GetMediaTime() == mEndTime) {
+        if (mCurrentFrameTime == mEndTime) {
           LOG(PR_LOG_DEBUG, ("%p Changed state from SEEKING (to %lldms) to COMPLETED",
                              mDecoder, seekTime));
           stopEvent = NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::SeekingStoppedAtEnd);
diff --git a/content/media/nsBuiltinDecoderStateMachine.h b/content/media/nsBuiltinDecoderStateMachine.h
index ddc1e003ec0f..a934911eec1c 100644
--- a/content/media/nsBuiltinDecoderStateMachine.h
+++ b/content/media/nsBuiltinDecoderStateMachine.h
@@ -338,16 +338,6 @@ protected:
   // be held.
   PRBool IsPlaying();
 
-  // Returns the "media time". This is the absolute time which the media
-  // playback has reached. i.e. this returns values in the range
-  // [mStartTime, mEndTime], and mStartTime will not be 0 if the media does
-  // not start at 0. Note this is different to the value returned
-  // by GetCurrentTime(), which is in the range [0,duration].
-  PRInt64 GetMediaTime() const {
-    mDecoder->GetMonitor().AssertCurrentThreadIn();
-    return mStartTime + mCurrentFrameTime;
-  }
-
   // Monitor on mAudioStream. This monitor must be held in order to delete
   // or use the audio stream. This stops us destroying the audio stream
   // while it's being used on another thread (typically when it's being

From 3386bf1f7ce4e35ae8e2e6589082420eb09f692b Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Mon, 6 Sep 2010 16:57:11 +1200
Subject: [PATCH 189/222] Backed out changeset 0ebfa9dfba8e

---
 widget/src/cocoa/nsChildView.h  |  2 --
 widget/src/cocoa/nsChildView.mm | 23 +++++++++--------------
 2 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/widget/src/cocoa/nsChildView.h b/widget/src/cocoa/nsChildView.h
index ad3b325efbb3..367c4bf4b7c3 100644
--- a/widget/src/cocoa/nsChildView.h
+++ b/widget/src/cocoa/nsChildView.h
@@ -402,8 +402,6 @@ public:
   nsCocoaTextInputHandler* TextInputHandler() { return &mTextInputHandler; }
   NSView<mozView>* GetEditorView();
 
-  PRBool IsPluginView() { return (mWindowType == eWindowType_plugin); }
-
 protected:
 
   PRBool            ReportDestroyEvent();
diff --git a/widget/src/cocoa/nsChildView.mm b/widget/src/cocoa/nsChildView.mm
index b5862adfaaa0..8ce9ac94c62b 100644
--- a/widget/src/cocoa/nsChildView.mm
+++ b/widget/src/cocoa/nsChildView.mm
@@ -907,8 +907,8 @@ NS_IMETHODIMP nsChildView::Show(PRBool aState)
 
     [mView setHidden:!aState];
     mVisible = aState;
-    if (!mVisible && IsPluginView())
-      HidePlugin();
+    if (!mVisible)
+      HideChildPluginViews(mView);
   }
   return NS_OK;
 
@@ -1660,23 +1660,18 @@ void nsChildView::ApplyConfiguration(nsIWidget* aExpectedParent,
   nsWindowType kidType;
   aConfiguration.mChild->GetWindowType(kidType);
 #endif
-  NS_ASSERTION(kidType == eWindowType_plugin,
-               "Configured widget is not a plugin type");
+  NS_ASSERTION(kidType == eWindowType_plugin || kidType == eWindowType_child,
+               "Configured widget is not a child or plugin type");
   NS_ASSERTION(aConfiguration.mChild->GetParent() == aExpectedParent,
                "Configured widget is not a child of the right widget");
-
-  // nsIWidget::Show() doesn't get called on plugin widgets unless we call
-  // it from here.  See bug 592563.
-  nsChildView* child = static_cast<nsChildView*>(aConfiguration.mChild);
-  child->Show(!aConfiguration.mClipRegion.IsEmpty());
-
-  child->Resize(
+  aConfiguration.mChild->Resize(
       aConfiguration.mBounds.x, aConfiguration.mBounds.y,
       aConfiguration.mBounds.width, aConfiguration.mBounds.height,
       aRepaint);
-
-  // Store the clip region here in case GetPluginClipRect needs it.
-  child->StoreWindowClipRegion(aConfiguration.mClipRegion);
+  // On Mac we don't use the clip region here, we just store it
+  // in case GetPluginClipRect needs it.
+  static_cast<nsChildView*>(aConfiguration.mChild)->
+    StoreWindowClipRegion(aConfiguration.mClipRegion);
 }
 
 nsresult nsChildView::ConfigureChildren(const nsTArray<Configuration>& aConfigurations)

From a9bb380e435b3f1c943e4646e264f943cc303929 Mon Sep 17 00:00:00 2001
From: Blair McBride <bmcbride@mozilla.com>
Date: Thu, 2 Sep 2010 11:40:20 +1200
Subject: [PATCH 190/222] Bug 566194 - safe mode / security & compatibility
 check status are not exposed in new addon manager UI. r=dtownsend,
 a=blocking-beta6

---
 .../chrome/mozapps/extensions/extensions.dtd  |   9 +
 .../mozapps/extensions/content/extensions.css |   7 +
 .../mozapps/extensions/content/extensions.js  |  73 ++++
 .../mozapps/extensions/content/extensions.xul | 367 +++++++++++-------
 .../extensions/test/browser/Makefile.in       |   1 +
 .../test/browser/browser_globalwarnings.js    |  65 ++++
 .../mozapps/extensions/extensions.css         |  70 ++--
 .../mozapps/extensions/warning-stripes.png    | Bin 0 -> 2177 bytes
 toolkit/themes/gnomestripe/mozapps/jar.mn     |   1 +
 .../mozapps/extensions/extensions.css         |  70 ++--
 .../mozapps/extensions/warning-stripes.png    | Bin 0 -> 2177 bytes
 toolkit/themes/pinstripe/mozapps/jar.mn       |   1 +
 .../mozapps/extensions/extensions.css         |  79 ++--
 .../mozapps/extensions/warning-stripes.png    | Bin 0 -> 2177 bytes
 toolkit/themes/winstripe/mozapps/jar.mn       |   2 +
 15 files changed, 523 insertions(+), 222 deletions(-)
 create mode 100644 toolkit/mozapps/extensions/test/browser/browser_globalwarnings.js
 create mode 100644 toolkit/themes/gnomestripe/mozapps/extensions/warning-stripes.png
 create mode 100644 toolkit/themes/pinstripe/mozapps/extensions/warning-stripes.png
 create mode 100644 toolkit/themes/winstripe/mozapps/extensions/warning-stripes.png

diff --git a/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd b/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd
index 57da04ba4ba0..2cf599920447 100644
--- a/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd
+++ b/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd
@@ -13,6 +13,15 @@
 <!ENTITY cmd.back.tooltip                     "Go back one page">
 <!ENTITY cmd.forward.tooltip                  "Go forward one page">
 
+<!-- global warnings -->
+<!ENTITY warning.safemode.label                    "All add-ons have been disabled by safe mode.">
+<!ENTITY warning.checkcompatibility.label          "Add-on compatibility checking is disabled. You may have incompatible add-ons.">
+<!ENTITY warning.checkcompatibility.enable.label   "Enable">
+<!ENTITY warning.checkcompatibility.enable.tooltip "Enable add-on compatibility checking">
+<!ENTITY warning.updatesecurity.label              "Add-on update security checking is disabled. You may be compromised by updates.">
+<!ENTITY warning.updatesecurity.enable.label       "Enable">
+<!ENTITY warning.updatesecurity.enable.tooltip     "Enable add-on update security checking">
+
 <!-- categories / views -->
 <!ENTITY view.search.label                    "Search">
 <!ENTITY view.discover.label                  "Get Add-ons">
diff --git a/toolkit/mozapps/extensions/content/extensions.css b/toolkit/mozapps/extensions/content/extensions.css
index 29d4b9cdf2b6..96080e00b28b 100644
--- a/toolkit/mozapps/extensions/content/extensions.css
+++ b/toolkit/mozapps/extensions/content/extensions.css
@@ -123,3 +123,10 @@ xhtml|link {
 .view-pane:not(#updates-view) .addon .relnotes-toggle {
   display: none;
 }
+
+#addons-page:not([warning]) .global-warning,
+#addons-page:not([warning="safemode"]) .global-warning-safemode,
+#addons-page:not([warning="checkcompatibility"]) .global-warning-checkcompatibility,
+#addons-page:not([warning="updatesecurity"]) .global-warning-updatesecurity {
+  display: none;
+}
diff --git a/toolkit/mozapps/extensions/content/extensions.js b/toolkit/mozapps/extensions/content/extensions.js
index 5ecbe0ded0ad..56af0db30286 100644
--- a/toolkit/mozapps/extensions/content/extensions.js
+++ b/toolkit/mozapps/extensions/content/extensions.js
@@ -51,6 +51,10 @@ Cu.import("resource://gre/modules/AddonRepository.jsm");
 const PREF_DISCOVERURL = "extensions.webservice.discoverURL";
 const PREF_MAXRESULTS = "extensions.getAddons.maxResults";
 const PREF_BACKGROUND_UPDATE = "extensions.update.enabled";
+const PREF_CHECK_COMPATIBILITY = "extensions.checkCompatibility";
+const PREF_CHECK_UPDATE_SECURITY = "extensions.checkUpdateSecurity";
+
+const BRANCH_REGEXP = /^([^\.]+\.[0-9]+[a-z]*).*/gi;
 
 const LOADING_MSG_DELAY = 100;
 
@@ -142,6 +146,7 @@ function loadView(aViewId) {
 var gEventManager = {
   _listeners: {},
   _installListeners: [],
+  checkCompatibilityPref: "",
 
   initialize: function() {
     var self = this;
@@ -164,9 +169,20 @@ var gEventManager = {
     });
     AddonManager.addInstallListener(this);
     AddonManager.addAddonListener(this);
+    
+    var version = Services.appinfo.version.replace(BRANCH_REGEXP, "$1");
+    this.checkCompatibilityPref = PREF_CHECK_COMPATIBILITY + "." + version;
+
+    Services.prefs.addObserver(this.checkCompatibilityPref, this, false);
+    Services.prefs.addObserver(PREF_CHECK_UPDATE_SECURITY, this, false);
+
+    this.refreshGlobalWarning();
   },
 
   shutdown: function() {
+    Services.prefs.removeObserver(this.checkCompatibilityPref, this);
+    Services.prefs.removeObserver(PREF_CHECK_UPDATE_SECURITY, this);
+
     AddonManager.removeInstallListener(this);
     AddonManager.removeAddonListener(this);
   },
@@ -244,6 +260,49 @@ var gEventManager = {
         Cu.reportError(e);
       }
     }
+  },
+  
+  refreshGlobalWarning: function() {
+    var page = document.getElementById("addons-page");
+
+    if (Services.appinfo.inSafeMode) {
+      page.setAttribute("warning", "safemode");
+      return;
+    } 
+
+    var checkUpdateSecurity = true;
+    var checkUpdateSecurityDefault = true;
+    try {
+      checkUpdateSecurity = Services.prefs.getBoolPref(PREF_CHECK_UPDATE_SECURITY);
+    } catch(e) { }
+    try {
+      var defaultBranch = Services.prefs.getDefaultBranch("");
+      checkUpdateSecurityDefault = defaultBranch.getBoolPref(PREF_CHECK_UPDATE_SECURITY);
+    } catch(e) { }
+    if (checkUpdateSecurityDefault && !checkUpdateSecurity) {
+      page.setAttribute("warning", "updatesecurity");
+      return;
+    }
+
+    var checkCompatibility = true;
+    try {
+      checkCompatibility = Services.prefs.getBoolPref(this.checkCompatibilityPref);
+    } catch(e) { }
+    if (!checkCompatibility) {
+      page.setAttribute("warning", "checkcompatibility");
+      return;
+    }
+    
+    page.removeAttribute("warning");
+  },
+  
+  observe: function(aSubject, aTopic, aData) {
+    switch (aData) {
+    case this.checkCompatibilityPref:
+    case PREF_CHECK_UPDATE_SECURITY:
+      this.refreshGlobalWarning();
+      break;
+    }
   }
 };
 
@@ -440,6 +499,20 @@ var gViewController = {
       }
     },
 
+    cmd_enableCheckCompatibility: {
+      isEnabled: function() true,
+      doCommand: function() {
+        Services.prefs.clearUserPref(gEventManager.checkCompatibilityPref);
+      }
+    },
+
+    cmd_enableUpdateSecurity: {
+      isEnabled: function() true,
+      doCommand: function() {
+        Services.prefs.clearUserPref(PREF_CHECK_UPDATE_SECURITY);
+      }
+    },
+
     cmd_goToDiscoverPane: {
       isEnabled: function() {
         return gDiscoverView.enabled;
diff --git a/toolkit/mozapps/extensions/content/extensions.xul b/toolkit/mozapps/extensions/content/extensions.xul
index 0734c5ea4e1e..707df333b4cc 100644
--- a/toolkit/mozapps/extensions/content/extensions.xul
+++ b/toolkit/mozapps/extensions/content/extensions.xul
@@ -98,6 +98,8 @@
     <command id="cmd_installFromFile"/>
     <command id="cmd_back"/>
     <command id="cmd_forward"/>
+    <command id="cmd_enableCheckCompatibility"/>
+    <command id="cmd_enableUpdateSecurity"/>
   </commandset>
 
   <!-- view commands - these act on the selected addon -->
@@ -234,7 +236,26 @@
                      tooltiptext="&search.filter2.available.tooltip;"/>
             </radiogroup>
           </hbox>
-          <hbox class="view-header" pack="end">
+          <hbox class="view-header global-warning-container">
+            <!-- global warnings -->
+            <hbox class="global-warning">
+              <image class="warning-icon"/>
+              <label class="global-warning-safemode"
+                     value="&warning.safemode.label;"/>
+              <label class="global-warning-checkcompatibility"
+                     value="&warning.checkcompatibility.label;"/>
+              <button class="button-link global-warning-checkcompatibility"
+                      label="&warning.checkcompatibility.enable.label;"
+                      tooltiptext="&warning.checkcompatibility.enable.tooltip;"
+                      command="cmd_enableCheckCompatibility"/>
+              <label class="global-warning-updatesecurity"
+                     value="&warning.updatesecurity.label;"/>
+              <button class="button-link global-warning-updatesecurity"
+                      label="&warning.updatesecurity.enable.label;"
+                      tooltiptext="&warning.updatesecurity.enable.tooltip;"
+                      command="cmd_enableUpdateSecurity"/>
+            </hbox>
+            <spacer flex="1"/>
             <hbox id="search-sorters" class="sort-controls"
                   showrelevance="true" sortby="relevancescore" ascending="false"/>
           </hbox>
@@ -255,7 +276,26 @@
 
         <!-- list view -->
         <vbox id="list-view" flex="1" class="view-pane">
-          <hbox class="view-header" pack="end">
+          <hbox class="view-header global-warning-container">
+            <!-- global warnings -->
+            <hbox class="global-warning">
+              <image class="warning-icon"/>
+              <label class="global-warning-safemode"
+                     value="&warning.safemode.label;"/>
+              <label class="global-warning-checkcompatibility"
+                     value="&warning.checkcompatibility.label;"/>
+              <button class="button-link global-warning-checkcompatibility"
+                      label="&warning.checkcompatibility.enable.label;"
+                      tooltiptext="&warning.checkcompatibility.enable.tooltip;"
+                      command="cmd_enableCheckCompatibility"/>
+              <label class="global-warning-updatesecurity"
+                     value="&warning.updatesecurity.label;"/>
+              <button class="button-link global-warning-updatesecurity"
+                      label="&warning.updatesecurity.enable.label;"
+                      tooltiptext="&warning.updatesecurity.enable.tooltip;"
+                      command="cmd_enableUpdateSecurity"/>
+            </hbox>
+            <spacer flex="1"/>
             <hbox id="list-sorters" class="sort-controls" sortby="name"
                   ascending="true"/>
           </hbox>
@@ -272,7 +312,26 @@
 
         <!-- updates view -->
         <vbox id="updates-view" flex="1" class="view-pane">
-          <hbox class="view-header" pack="end">
+          <hbox class="view-header global-warning-container">
+            <!-- global warnings -->
+            <hbox class="global-warning">
+              <image class="warning-icon"/>
+              <label class="global-warning-safemode"
+                     value="&warning.safemode.label;"/>
+              <label class="global-warning-checkcompatibility"
+                     value="&warning.checkcompatibility.label;"/>
+              <button class="button-link global-warning-checkcompatibility"
+                      label="&warning.checkcompatibility.enable.label;"
+                      tooltiptext="&warning.checkcompatibility.enable.tooltip;"
+                      command="cmd_enableCheckCompatibility"/>
+              <label class="global-warning-updatesecurity"
+                     value="&warning.updatesecurity.label;"/>
+              <button class="button-link global-warning-updatesecurity"
+                      label="&warning.updatesecurity.enable.label;"
+                      tooltiptext="&warning.updatesecurity.enable.tooltip;"
+                      command="cmd_enableUpdateSecurity"/>
+            </hbox>
+            <spacer flex="1"/>
             <hbox id="updates-sorters" class="sort-controls" sortby="dateUpdated"
                   ascending="false"/>
           </hbox>
@@ -292,151 +351,171 @@
         </vbox>
 
         <!-- detail view -->
-        <scrollbox id="detail-view" flex="1" class="view-pane addon-view" orient="horizontal" pack="stretch" align="start">
-          <spacer flex="1"/>
-          <!-- "loading" splash screen -->
-          <hbox class="loading" flex="1">
-            <image/>
-            <label value="&loading.label;"/>
+        <vbox id="detail-view" flex="1" class="view-pane">
+          <!-- global warnings -->
+          <hbox class="global-warning-container global-warning" pack="start">
+            <image class="warning-icon"/>
+            <label class="global-warning-safemode"
+                   value="&warning.safemode.label;"/>
+            <label class="global-warning-checkcompatibility"
+                   value="&warning.checkcompatibility.label;"/>
+            <button class="button-link global-warning-checkcompatibility"
+                    label="&warning.checkcompatibility.enable.label;"
+                    tooltiptext="&warning.checkcompatibility.enable.tooltip;"
+                    command="cmd_enableCheckCompatibility"/>
+            <label class="global-warning-updatesecurity"
+                   value="&warning.updatesecurity.label;"/>
+            <button class="button-link global-warning-updatesecurity"
+                    label="&warning.updatesecurity.enable.label;"
+                    tooltiptext="&warning.updatesecurity.enable.tooltip;"
+                    command="cmd_enableUpdateSecurity"/>
           </hbox>
-          <!-- actual detail view -->
-          <vbox class="detail-view-container" flex="3">
-            <vbox id="detail-notifications">
-              <hbox id="warning-container" align="center" class="warning">
-                <image class="warning-icon"/>
-                <label id="detail-warning" flex="1"/>
-                <label id="detail-warning-link" class="text-link"/>
-                <spacer flex="5000"/> <!-- Necessary to allow the message to wrap -->
-              </hbox>
-              <hbox id="error-container" align="center" class="error">
-                <image class="error-icon"/>
-                <label id="detail-error" flex="1"/>
-                <label id="detail-error-link" class="text-link"/>
-                <spacer flex="5000"/> <!-- Necessary to allow the message to wrap -->
-              </hbox>
-              <hbox id="pending-container" align="center" class="pending">
-                <image class="pending-icon"/>
-                <label id="detail-pending" flex="1"/>
-                <button class="button-link"
-                            label="&addon.restartNow.label;"
-                            command="cmd_restartApp"/>
-                <button id="detail-undo" class="button-link"
-                            label="&addon.undoAction.label;"
-                            tooltipText="&addon.undoAction.tooltip;"
-                            command="cmd_cancelOperation"/>
-                <spacer flex="5000"/> <!-- Necessary to allow the message to wrap -->
-              </hbox>
-            </vbox>
-            <hbox align="start">
-              <image id="detail-icon" class="icon"/>
-              <vbox flex="1">
-                <vbox id="detail-summary">
-                  <hbox id="detail-name-container">
-                    <label id="detail-name"/>
-                    <label id="detail-version"/>
-                    <label class="disabled-postfix" value="&addon.disabled.postfix;"/>
-                    <label class="update-postfix" value="&addon.update.postfix;"/>
-                  </hbox>
-                  <label id="detail-creator" class="creator"/>
-                </vbox>
-                <hbox id="detail-desc-container" align="end">
-                  <image id="detail-screenshot" hidden="true"/>
-                  <description id="detail-desc" flex="1"/>
+          <scrollbox  flex="1" class="addon-view" orient="horizontal" pack="stretch" align="start">
+            <spacer flex="1"/>
+            <!-- "loading" splash screen -->
+            <hbox class="loading" flex="1">
+              <image/>
+              <label value="&loading.label;"/>
+            </hbox>
+            <!-- actual detail view -->
+            <vbox class="detail-view-container" flex="3">
+              <vbox id="detail-notifications">
+                <hbox id="warning-container" align="center" class="warning">
+                  <image class="warning-icon"/>
+                  <label id="detail-warning" flex="1"/>
+                  <label id="detail-warning-link" class="text-link"/>
+                  <spacer flex="5000"/> <!-- Necessary to allow the message to wrap -->
                 </hbox>
-                <vbox id="detail-contributions">
-                  <description id="detail-contrib-description">
-                    &detail.contributions.description;
-                  </description>
-                  <hbox align="center">
-                    <label id="detail-contrib-suggested"/>
-                    <spacer flex="1"/>
-                    <button id="detail-contrib-button" class="addon-control"
-                            label="&cmd.contribute.label;"
-                            accesskey="&cmd.contribute.accesskey;"
-                            tooltiptext="&cmd.contribute.tooltip;"
-                            command="cmd_contribute"/>
-                  </hbox>
-                </vbox>
-                <grid id="detail-grid">
-                  <columns>
-                     <column flex="1"/>
-                     <column flex="2"/>
-                  </columns>
-                  <rows>
-                    <row class="detail-row" id="detail-dateUpdated" label="&detail.lastupdated.label;"/>
-                    <row class="detail-row-complex" id="detail-updates-row">
-                      <label class="detail-row-label" value="&detail.updateType;"/>
-                      <hbox align="center">
-                        <radiogroup id="detail-autoUpdate" orient="horizontal">
-                          <radio label="&detail.updateAutomatic.label;"
-                                 tooltiptext="&detail.updateAutomatic.tooltip;"
-                                 value="true"/>
-                          <radio label="&detail.updateManual.label;"
-                                 tooltiptext="&detail.updateAutomatic.tooltip;"
-                                 value="false"/>
-                        </radiogroup>
-                        <button id="detail-findUpdates" class="button-link"
-                                label="&detail.checkForUpdates.label;"
-                                accesskey="&detail.checkForUpdates.accesskey;"
-                                tooltiptext="&detail.checkForUpdates.tooltip;"
-                                command="cmd_findItemUpdates"/>
-                      </hbox>
-                    </row>
-                    <row class="detail-row-complex" id="detail-homepage-row" label="&detail.home;">
-                      <label class="detail-row-label" value="&detail.home;"/>
-                      <label id="detail-homepage" class="detail-row-value text-link"/>
-                    </row>
-                    <row class="detail-row-complex" id="detail-repository-row" label="&detail.repository;">
-                      <label class="detail-row-label" value="&detail.repository;"/>
-                      <label id="detail-repository" class="detail-row-value text-link"/>
-                    </row>
-                    <row class="detail-row" id="detail-size" label="&detail.size;"/>
-                    <row class="detail-row-complex" id="detail-rating-row">
-                      <label class="detail-row-label" value="&rating.label;"/>
-                      <hbox>
-                        <label id="detail-rating" class="meta-value meta-rating"
-                               showrating="average"/>
-                        <label id="detail-reviews" class="text-link"/>
-                      </hbox>
-                    </row>
-                    <row class="detail-row" id="detail-downloads" label="&detail.numberOfDownloads.label;"/>
-                  </rows>
-                </grid>
-                <hbox id="detail-controls">
-                  <button id="detail-prefs" class="addon-control"
-#ifdef XP_WIN
-                          label="&detail.showPreferencesWin.label;"
-                          accesskey="&detail.showPreferencesWin.accesskey;"
-                          tooltiptext="&detail.showPreferencesWin.tooltip;"
-#else
-                          label="&detail.showPreferencesUnix.label;"
-                          accesskey="&detail.showPreferencesUnix.accesskey;"
-                          tooltiptext="&detail.showPreferencesUnix.tooltip;"
-#endif
-                          command="cmd_showItemPreferences"/>
-                  <spacer flex="1"/>
-                  <button id="detail-uninstall" class="addon-control remove"
-                          label="&cmd.uninstallAddon.label;"
-                          accesskey="&cmd.uninstallAddon.accesskey;"
-                          command="cmd_uninstallItem"/>
-                  <button id="detail-enable" class="addon-control enable"
-                          label="&cmd.enableAddon.label;"
-                          accesskey="&cmd.enableAddon.accesskey;"
-                          command="cmd_enableItem"/>
-                  <button id="detail-disable" class="addon-control disable"
-                          label="&cmd.disableAddon.label;"
-                          accesskey="&cmd.disableAddon.accesskey;"
-                          command="cmd_disableItem"/>
-                  <button id="detail-install" class="addon-control install"
-                          label="&cmd.installAddon.label;"
-                          accesskey="&cmd.installAddon.accesskey;"
-                          command="cmd_installItem"/>
+                <hbox id="error-container" align="center" class="error">
+                  <image class="error-icon"/>
+                  <label id="detail-error" flex="1"/>
+                  <label id="detail-error-link" class="text-link"/>
+                  <spacer flex="5000"/> <!-- Necessary to allow the message to wrap -->
+                </hbox>
+                <hbox id="pending-container" align="center" class="pending">
+                  <image class="pending-icon"/>
+                  <label id="detail-pending" flex="1"/>
+                  <button class="button-link"
+                              label="&addon.restartNow.label;"
+                              command="cmd_restartApp"/>
+                  <button id="detail-undo" class="button-link"
+                              label="&addon.undoAction.label;"
+                              tooltipText="&addon.undoAction.tooltip;"
+                              command="cmd_cancelOperation"/>
+                  <spacer flex="5000"/> <!-- Necessary to allow the message to wrap -->
                 </hbox>
               </vbox>
-            </hbox>
-          </vbox>
-          <spacer flex="1"/>
-        </scrollbox>
+              <hbox align="start">
+                <image id="detail-icon" class="icon"/>
+                <vbox flex="1">
+                  <vbox id="detail-summary">
+                    <hbox id="detail-name-container">
+                      <label id="detail-name"/>
+                      <label id="detail-version"/>
+                      <label class="disabled-postfix" value="&addon.disabled.postfix;"/>
+                      <label class="update-postfix" value="&addon.update.postfix;"/>
+                    </hbox>
+                    <label id="detail-creator" class="creator"/>
+                  </vbox>
+                  <hbox id="detail-desc-container" align="end">
+                    <image id="detail-screenshot" hidden="true"/>
+                    <description id="detail-desc" flex="1"/>
+                  </hbox>
+                  <vbox id="detail-contributions">
+                    <description id="detail-contrib-description">
+                      &detail.contributions.description;
+                    </description>
+                    <hbox align="center">
+                      <label id="detail-contrib-suggested"/>
+                      <spacer flex="1"/>
+                      <button id="detail-contrib-button" class="addon-control"
+                              label="&cmd.contribute.label;"
+                              accesskey="&cmd.contribute.accesskey;"
+                              tooltiptext="&cmd.contribute.tooltip;"
+                              command="cmd_contribute"/>
+                    </hbox>
+                  </vbox>
+                  <grid id="detail-grid">
+                    <columns>
+                       <column flex="1"/>
+                       <column flex="2"/>
+                    </columns>
+                    <rows>
+                      <row class="detail-row" id="detail-dateUpdated" label="&detail.lastupdated.label;"/>
+                      <row class="detail-row-complex" id="detail-updates-row">
+                        <label class="detail-row-label" value="&detail.updateType;"/>
+                        <hbox align="center">
+                          <radiogroup id="detail-autoUpdate" orient="horizontal">
+                            <radio label="&detail.updateAutomatic.label;"
+                                   tooltiptext="&detail.updateAutomatic.tooltip;"
+                                   value="true"/>
+                            <radio label="&detail.updateManual.label;"
+                                   tooltiptext="&detail.updateAutomatic.tooltip;"
+                                   value="false"/>
+                          </radiogroup>
+                          <button id="detail-findUpdates" class="button-link"
+                                  label="&detail.checkForUpdates.label;"
+                                  accesskey="&detail.checkForUpdates.accesskey;"
+                                  tooltiptext="&detail.checkForUpdates.tooltip;"
+                                  command="cmd_findItemUpdates"/>
+                        </hbox>
+                      </row>
+                      <row class="detail-row-complex" id="detail-homepage-row" label="&detail.home;">
+                        <label class="detail-row-label" value="&detail.home;"/>
+                        <label id="detail-homepage" class="detail-row-value text-link"/>
+                      </row>
+                      <row class="detail-row-complex" id="detail-repository-row" label="&detail.repository;">
+                        <label class="detail-row-label" value="&detail.repository;"/>
+                        <label id="detail-repository" class="detail-row-value text-link"/>
+                      </row>
+                      <row class="detail-row" id="detail-size" label="&detail.size;"/>
+                      <row class="detail-row-complex" id="detail-rating-row">
+                        <label class="detail-row-label" value="&rating.label;"/>
+                        <hbox>
+                          <label id="detail-rating" class="meta-value meta-rating"
+                                 showrating="average"/>
+                          <label id="detail-reviews" class="text-link"/>
+                        </hbox>
+                      </row>
+                      <row class="detail-row" id="detail-downloads" label="&detail.numberOfDownloads.label;"/>
+                    </rows>
+                  </grid>
+                  <hbox id="detail-controls">
+                    <button id="detail-prefs" class="addon-control"
+#ifdef XP_WIN
+                            label="&detail.showPreferencesWin.label;"
+                            accesskey="&detail.showPreferencesWin.accesskey;"
+                            tooltiptext="&detail.showPreferencesWin.tooltip;"
+#else
+                            label="&detail.showPreferencesUnix.label;"
+                            accesskey="&detail.showPreferencesUnix.accesskey;"
+                            tooltiptext="&detail.showPreferencesUnix.tooltip;"
+#endif
+                            command="cmd_showItemPreferences"/>
+                    <spacer flex="1"/>
+                    <button id="detail-uninstall" class="addon-control remove"
+                            label="&cmd.uninstallAddon.label;"
+                            accesskey="&cmd.uninstallAddon.accesskey;"
+                            command="cmd_uninstallItem"/>
+                    <button id="detail-enable" class="addon-control enable"
+                            label="&cmd.enableAddon.label;"
+                            accesskey="&cmd.enableAddon.accesskey;"
+                            command="cmd_enableItem"/>
+                    <button id="detail-disable" class="addon-control disable"
+                            label="&cmd.disableAddon.label;"
+                            accesskey="&cmd.disableAddon.accesskey;"
+                            command="cmd_disableItem"/>
+                    <button id="detail-install" class="addon-control install"
+                            label="&cmd.installAddon.label;"
+                            accesskey="&cmd.installAddon.accesskey;"
+                            command="cmd_installItem"/>
+                  </hbox>
+                </vbox>
+              </hbox>
+            </vbox>
+            <spacer flex="1"/>
+          </scrollbox>
+        </vbox>
 
       </deck>
 
diff --git a/toolkit/mozapps/extensions/test/browser/Makefile.in b/toolkit/mozapps/extensions/test/browser/Makefile.in
index f261120fe2a3..f33da314f8b0 100644
--- a/toolkit/mozapps/extensions/test/browser/Makefile.in
+++ b/toolkit/mozapps/extensions/test/browser/Makefile.in
@@ -75,6 +75,7 @@ _TEST_FILES = \
   browser_backgroundupdate_menuitem.js \
   browser_recentupdates.js \
   browser_manualupdates.js \
+  browser_globalwarnings.js \
   redirect.sjs \
   releaseNotes.xhtml \
   $(NULL)
diff --git a/toolkit/mozapps/extensions/test/browser/browser_globalwarnings.js b/toolkit/mozapps/extensions/test/browser/browser_globalwarnings.js
new file mode 100644
index 000000000000..fefd9cf0d4f7
--- /dev/null
+++ b/toolkit/mozapps/extensions/test/browser/browser_globalwarnings.js
@@ -0,0 +1,65 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+// Bug 566194 - safe mode / security & compatibility check status are not exposed in new addon manager UI
+
+function test() {
+  waitForExplicitFinish();
+  run_next_test();
+}
+
+function end_test() {
+  finish();
+}
+
+add_test(function() {
+  info("Testing compatibility checking warning");
+
+  var version = Services.appinfo.version.replace(/^([^\.]+\.[0-9]+[a-z]*).*/gi, "$1");
+  var pref = "extensions.checkCompatibility." + version;
+  info("Setting " + pref + " pref to false")
+  Services.prefs.setBoolPref(pref, false);
+
+  open_manager(null, function(aWindow) {
+    var label = aWindow.document.querySelector("#list-view label.global-warning-checkcompatibility");
+    is_element_visible(label, "Check Compatibility warning label should be visible");
+    var button = aWindow.document.querySelector("#list-view button.global-warning-checkcompatibility");
+    is_element_visible(button, "Check Compatibility warning button should be visible");
+
+    info("Clicking 'Enable' button");
+    EventUtils.synthesizeMouse(button, 2, 2, { }, aWindow);
+    is(Services.prefs.prefHasUserValue(pref), false, "Check Compatability pref should be cleared");
+    is_element_hidden(label, "Check Compatibility warning label should be hidden");
+    is_element_hidden(button, "Check Compatibility warning button should be hidden");
+
+    close_manager(aWindow, function() {
+      run_next_test();
+    });
+  });
+});
+
+add_test(function() {
+  info("Testing update security checking warning");
+
+  var pref = "extensions.checkUpdateSecurity";
+  info("Setting " + pref + " pref to false")
+  Services.prefs.setBoolPref(pref, false);
+
+  open_manager(null, function(aWindow) {
+    var label = aWindow.document.querySelector("#list-view label.global-warning-updatesecurity");
+    is_element_visible(label, "Check Update Security warning label should be visible");
+    var button = aWindow.document.querySelector("#list-view button.global-warning-updatesecurity");
+    is_element_visible(button, "Check Update Security warning button should be visible");
+
+    info("Clicking 'Enable' button");
+    EventUtils.synthesizeMouse(button, 2, 2, { }, aWindow);
+    is(Services.prefs.prefHasUserValue(pref), false, "Check Update Security pref should be cleared");
+    is_element_hidden(label, "Check Update Security warning label should be hidden");
+    is_element_hidden(button, "Check Update Security warning button should be hidden");
+
+    close_manager(aWindow, function() {
+      run_next_test();
+    });
+  });
+});
diff --git a/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css b/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
index eb68a977ad69..d086e367e401 100644
--- a/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
@@ -83,6 +83,46 @@
   list-style-image: url("moz-icon://stock/gtk-go-forward-rtl?size=toolbar&state=disabled");
 }
 
+/*** global warnings ***/
+
+.global-warning {
+  -moz-box-align: center;
+  margin: 0 8px;
+  color: #916D15;
+  text-shadow: #FFFFFF 1px 1px 1px;
+  font-weight: bold;
+}
+
+#addons-page[warning] .global-warning-container {
+  background-color: rgba(255, 255, 0, 0.1);
+  background-image: url("chrome://mozapps/skin/extensions/warning-stripes.png");
+  background-repeat: repeat-x;
+}
+
+/*** notification icons ***/
+
+.warning-icon {
+  list-style-image: url("chrome://global/skin/icons/warning-16.png");
+  width: 16px;
+  height: 16px;
+  margin: 3px 0;
+}
+
+.error-icon {
+  list-style-image: url("chrome://global/skin/icons/error-16.png");
+  width: 16px;
+  height: 16px;
+  margin: 3px 0;
+}
+
+.pending-icon,
+.info-icon {
+  list-style-image: url("chrome://global/skin/icons/information-16.png");
+  width: 16px;
+  height: 16px;
+  margin: 3px 0;
+}
+
 /*** category selector ***/
 
 #categories {
@@ -379,28 +419,6 @@
   color: #4F7939;
 }
 
-.warning-icon {
-  list-style-image: url("chrome://global/skin/icons/warning-16.png");
-  width: 16px;
-  height: 16px;
-  margin: 3px 0;
-}
-
-.error-icon {
-  list-style-image: url("chrome://global/skin/icons/error-16.png");
-  width: 16px;
-  height: 16px;
-  margin: 3px 0;
-}
-
-.pending-icon,
-.info-icon {
-  list-style-image: url("chrome://global/skin/icons/information-16.png");
-  width: 16px;
-  height: 16px;
-  margin: 3px 0;
-}
-
 .addon-view[notification="warning"] {
   background-image: -moz-linear-gradient(rgba(255, 255, 0, 0.2), rgba(255, 255, 0, 0.1));
 }
@@ -518,15 +536,15 @@
   opacity: 0.6;
 }
 
-#detail-view > .loading {
+#detail-view .loading {
   opacity: 0;
 }
 
-#detail-view:not([loading]) > .loading {
+#detail-view:not([loading]) .loading {
   visibility: collapse;
 }
 
-#detail-view[loading-extended] > .loading {
+#detail-view[loading-extended] .loading {
   -moz-box-align: center;
   -moz-box-pack: center;
   opacity: 1;
@@ -534,7 +552,7 @@
   -moz-transition-duration: 1s;
 }
 
-#detail-view > .loading > image {
+#detail-view .loading > image {
   list-style-image: url("chrome://global/skin/icons/loading_16.png");
 }
 
diff --git a/toolkit/themes/gnomestripe/mozapps/extensions/warning-stripes.png b/toolkit/themes/gnomestripe/mozapps/extensions/warning-stripes.png
new file mode 100644
index 0000000000000000000000000000000000000000..69463fb1af3de8f2cb8c9acc2fcbd61b226cb114
GIT binary patch
literal 2177
zcmaJ@c~ld39#4Q}5s`BGf(1KFpga+BOn^X2IFd<BEMYN(O9dN}0a9|21PDsG)~W<V
zB9vQPlvi4%R8f3Ys8wLYQ7A{dMHFlmeY>_u5kW<$>;#4Ok7eh*ncw_=@ALV5ug|<U
zg%RPqwpebn#9%O6xEz>|u4?q&Z()u;<FD%ef-X)PR;(sck)+8Kst`=5SdoYTT$wN#
z;UhwER$3nth{2eG5<#pcmKR17DP#np5kt_*lqeg62@KXMg`!kM10*8J5;-0Gt^FGi
zkcjDEj4zMGQ!<eh3Fn{+i98rC5FJbv1&G1mARtgnLj`1rMhIwSQn{L@rGu-wH1yqg
zOay^dh$fW|zD_EZ7XdI8Dg^K)ki11CKN8?aCXgvUR4UaAfJkH#kpvORkT;o1qd+tg
z33zjXXf%~LiN=T7Z(^Z4I+&u-C}~7uW@aWKlR{9al8NMifB>Tg1bL$fZ*`VjBh-4!
z)%Z097*UH<5~W6>kOM|VVWJ{kLkH1JUzZ?LuFJ~RZ`y=5jHneViDUxFSkfAh$NT?K
znQR@c*6@)(^8KH}YC)C~A@UKmB3&gy2bY95hEmd)DnzJJs00dybghdKDGH53ouW_z
z%t&8=ClpEK#{DXu$D?uOYK>4XLbxy;L=^}UiI_%Z!DJ?d%nD`rLS!<`4uDvpOa{}(
zkI7~*U@B>i3oAtFGDNOf<BI>_vNz-!tsqmPkzqt7$w0(xl|lxrmQ0guoC|Y9y*FI(
z#<{>7a*1d%MB`xpH0ZS>)IG-6b=#twb>ky))a@$N*7XVE0~n0i0v8SyXm3xSDypaj
zY(j*Llh=dNR$6}VzMer%JIA&kD=5f!a{gHwzCGyvf(gY&wy^ZPi~7ZrW(&(RGxZ5~
zdj7`Rr~AO?AGKvaT1GvuY`%P8IQQ=}K&~w_$2}=~%4VFrZ8D~DzI2O8Wv?1r9FIgr
zu=<5QlQ$cS-U$e~8?N0{4A|Rwl<xkdGv&VhGj7P{&liERjPr|7&1cw$*hPa`)-U*~
zcWtX(@bjK{I-B!Ub+4e~^sL~76-;w-P55{a7LT&43pu;Uwg*oImECvv+^(n&QWee%
zeTEo`!QYL3`9<$f-K7WSG1dO?U8g&hag-Wi$@@cg4J*)+oKCm8Wsp^|>J?oJJ^8<m
z=h+2&9durijvtjJ*G)>`jy4X#kmevpF1LkUwrZFzoWSSIm+trG@3T%5&N;?Z4Bav;
zEcN%hL*;4vOnexS&W)Q<#WGh|L^WFJZ$jsLJDeJH<*ur*yy$1jCEeD!Q``r8nznPo
zan&$e=u=-BU$o4$TFlB5^yQv##@%U(rx0G%_j%1VHl4juUS^UFo`o2%z$h#@<#53S
zD%wwbp5L-HvwH``kJosFXivX-ROV9gqCx(>q}FY*`90);PQSgl_Qk;bq;k+>vv|p0
ze$g?ESY@lqm!?Wz;&#-HgaPd@o>b!I>@RXgia-6hyWxr|6ciRY3|b77p2O(H#l{I8
z_T*dR#U_Psdzep)`U2r=vBRxaE~j_)T#IHiEhN!)*a?5~tnhd2T&LTp;h3vq+P$Yc
z@V9YW9NqR*c6pwxB`;v>ntsZ!%6{4LYeqsLE2*o>Eh!<V%65*U<zI!9x>D?P#fKtC
z`^TUwy;7WO11Bo4w;5+_7F09f3BAR(k9)9pdAQ_BS$*J8aAd{Ue(<f5smO{c&DW>Z
zJ9}~poOovXChVw(ZS31_XM5Zjl_Ou<76lH%E!NZ2>$y5x@L1zahCe)0V0(_^1X9y4
zS?gQ0|JEI9c|kr9Ln#XMFB$iUzI`q7&a<g2W64f~Z2i$sUgdh5pUZpvrH;xz(!D&q
za0cpR>jmx}`f*APM!zeu_uJBc?Wu^TF!DH&dA;$Jn!K%C--c{Ns&7v^Ja8>KT;HC2
z*baDqwSQ;RLOORZ4{!c<p&!UfsId|?CR8oY2K@DDpXtf|550c-$WVW=rM2BU&ZUhr
zE4HW>WIjIH+*&i9`iuPN-bMv7>5g}Jm+ylY=vBDmyOxi|Z8Nk)1>%wApB>`NR!`Ax
zb$#_vCv~~Nqqv!tKeW*nf7tahfYh1Y(f-imorz6i%TMcYBfj5-jXa)aHR22ov&XZp
z3iMXS89z!-ynFIU7}$2E*5*c?J<SH-I|8HULmYQ7AN<(R7s&SOE)DT&b=p2o>9l4s
zuppIOvZ-|EjoUM|&h60z&e%uCTMk7H-xRf9W+j7mrgrV`mBm$KFW#ke-fDZ9V7Rw;
z=y_0tczSQzKMTL#lcF}5B)T>AHf8czmNrh{CEWxTtpS3=FO9qFIaZI<_cT&Hh;wD?
zfAHp8y)MtJmv3}L7y30h8zg=^>8XxGuU*<`I_Al@SZ_i~`9Q($9M|?Ur!E;(h2ms0
zMsFLrekfRK+j_$J2$0%CTUq%=I`p3``47QZb4*Oq;|mj^VxIA*fXfPpTNob{{1>ME
BY6JiP

literal 0
HcmV?d00001

diff --git a/toolkit/themes/gnomestripe/mozapps/jar.mn b/toolkit/themes/gnomestripe/mozapps/jar.mn
index 27fd55265c8a..3f9ca601cc59 100644
--- a/toolkit/themes/gnomestripe/mozapps/jar.mn
+++ b/toolkit/themes/gnomestripe/mozapps/jar.mn
@@ -25,6 +25,7 @@ toolkit.jar:
 + skin/classic/mozapps/extensions/pause.png                (extensions/pause.png)
 + skin/classic/mozapps/extensions/utilities.png            (extensions/utilities.png)
 + skin/classic/mozapps/extensions/heart.png                (extensions/heart.png)
++ skin/classic/mozapps/extensions/warning-stripes.png      (extensions/warning-stripes.png)
 + skin/classic/mozapps/passwordmgr/key.png                 (passwordmgr/key.png)
 + skin/classic/mozapps/plugins/notifyPluginBlocked.png     (plugins/pluginBlocked-16.png)
 + skin/classic/mozapps/plugins/notifyPluginCrashed.png     (plugins/pluginGeneric-16.png)
diff --git a/toolkit/themes/pinstripe/mozapps/extensions/extensions.css b/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
index ef5c6fe18f3f..60fa8891f2a5 100644
--- a/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
@@ -96,6 +96,46 @@
   background-image: @toolbarbuttonInactiveBackgroundImage@;
 }
 
+/*** global warnings ***/
+
+.global-warning {
+  -moz-box-align: center;
+  margin: 0 8px;
+  color: #916D15;
+  text-shadow: #FFFFFF 1px 1px 1px;
+  font-weight: bold;
+}
+
+#addons-page[warning] .global-warning-container {
+  background-color: rgba(255, 255, 0, 0.1);
+  background-image: url("chrome://mozapps/skin/extensions/warning-stripes.png");
+  background-repeat: repeat-x;
+}
+
+/*** notification icons ***/
+
+.warning-icon {
+  list-style-image: url("chrome://global/skin/icons/warning-16.png");
+  width: 16px;
+  height: 16px;
+  margin: 3px 0;
+}
+
+.error-icon {
+  list-style-image: url("chrome://global/skin/icons/error-16.png");
+  width: 16px;
+  height: 16px;
+  margin: 3px 0;
+}
+
+.pending-icon,
+.info-icon {
+  list-style-image: url("chrome://global/skin/icons/information-16.png");
+  width: 16px;
+  height: 16px;
+  margin: 3px 0;
+}
+
 /*** category selector ***/
 
 #categories {
@@ -392,28 +432,6 @@
   color: #4F7939;
 }
 
-.warning-icon {
-  list-style-image: url("chrome://global/skin/icons/warning-16.png");
-  width: 16px;
-  height: 16px;
-  margin: 3px 0;
-}
-
-.error-icon {
-  list-style-image: url("chrome://global/skin/icons/error-16.png");
-  width: 16px;
-  height: 16px;
-  margin: 3px 0;
-}
-
-.pending-icon,
-.info-icon {
-  list-style-image: url("chrome://global/skin/icons/information-16.png");
-  width: 16px;
-  height: 16px;
-  margin: 3px 0;
-}
-
 .addon-view[notification="warning"] {
   background-image: -moz-linear-gradient(rgba(255, 255, 0, 0.2), rgba(255, 255, 0, 0.1));
 }
@@ -542,15 +560,15 @@
   opacity: 0.6;
 }
 
-#detail-view > .loading {
+#detail-view .loading {
   opacity: 0;
 }
 
-#detail-view:not([loading]) > .loading {
+#detail-view:not([loading]) .loading {
   visibility: collapse;
 }
 
-#detail-view[loading-extended] > .loading {
+#detail-view[loading-extended] .loading {
   -moz-box-align: center;
   -moz-box-pack: center;
   opacity: 1;
@@ -558,7 +576,7 @@
   -moz-transition-duration: 1s;
 }
 
-#detail-view > .loading > image {
+#detail-view .loading > image {
   list-style-image: url("chrome://global/skin/icons/loading_16.png");
 }
 
diff --git a/toolkit/themes/pinstripe/mozapps/extensions/warning-stripes.png b/toolkit/themes/pinstripe/mozapps/extensions/warning-stripes.png
new file mode 100644
index 0000000000000000000000000000000000000000..69463fb1af3de8f2cb8c9acc2fcbd61b226cb114
GIT binary patch
literal 2177
zcmaJ@c~ld39#4Q}5s`BGf(1KFpga+BOn^X2IFd<BEMYN(O9dN}0a9|21PDsG)~W<V
zB9vQPlvi4%R8f3Ys8wLYQ7A{dMHFlmeY>_u5kW<$>;#4Ok7eh*ncw_=@ALV5ug|<U
zg%RPqwpebn#9%O6xEz>|u4?q&Z()u;<FD%ef-X)PR;(sck)+8Kst`=5SdoYTT$wN#
z;UhwER$3nth{2eG5<#pcmKR17DP#np5kt_*lqeg62@KXMg`!kM10*8J5;-0Gt^FGi
zkcjDEj4zMGQ!<eh3Fn{+i98rC5FJbv1&G1mARtgnLj`1rMhIwSQn{L@rGu-wH1yqg
zOay^dh$fW|zD_EZ7XdI8Dg^K)ki11CKN8?aCXgvUR4UaAfJkH#kpvORkT;o1qd+tg
z33zjXXf%~LiN=T7Z(^Z4I+&u-C}~7uW@aWKlR{9al8NMifB>Tg1bL$fZ*`VjBh-4!
z)%Z097*UH<5~W6>kOM|VVWJ{kLkH1JUzZ?LuFJ~RZ`y=5jHneViDUxFSkfAh$NT?K
znQR@c*6@)(^8KH}YC)C~A@UKmB3&gy2bY95hEmd)DnzJJs00dybghdKDGH53ouW_z
z%t&8=ClpEK#{DXu$D?uOYK>4XLbxy;L=^}UiI_%Z!DJ?d%nD`rLS!<`4uDvpOa{}(
zkI7~*U@B>i3oAtFGDNOf<BI>_vNz-!tsqmPkzqt7$w0(xl|lxrmQ0guoC|Y9y*FI(
z#<{>7a*1d%MB`xpH0ZS>)IG-6b=#twb>ky))a@$N*7XVE0~n0i0v8SyXm3xSDypaj
zY(j*Llh=dNR$6}VzMer%JIA&kD=5f!a{gHwzCGyvf(gY&wy^ZPi~7ZrW(&(RGxZ5~
zdj7`Rr~AO?AGKvaT1GvuY`%P8IQQ=}K&~w_$2}=~%4VFrZ8D~DzI2O8Wv?1r9FIgr
zu=<5QlQ$cS-U$e~8?N0{4A|Rwl<xkdGv&VhGj7P{&liERjPr|7&1cw$*hPa`)-U*~
zcWtX(@bjK{I-B!Ub+4e~^sL~76-;w-P55{a7LT&43pu;Uwg*oImECvv+^(n&QWee%
zeTEo`!QYL3`9<$f-K7WSG1dO?U8g&hag-Wi$@@cg4J*)+oKCm8Wsp^|>J?oJJ^8<m
z=h+2&9durijvtjJ*G)>`jy4X#kmevpF1LkUwrZFzoWSSIm+trG@3T%5&N;?Z4Bav;
zEcN%hL*;4vOnexS&W)Q<#WGh|L^WFJZ$jsLJDeJH<*ur*yy$1jCEeD!Q``r8nznPo
zan&$e=u=-BU$o4$TFlB5^yQv##@%U(rx0G%_j%1VHl4juUS^UFo`o2%z$h#@<#53S
zD%wwbp5L-HvwH``kJosFXivX-ROV9gqCx(>q}FY*`90);PQSgl_Qk;bq;k+>vv|p0
ze$g?ESY@lqm!?Wz;&#-HgaPd@o>b!I>@RXgia-6hyWxr|6ciRY3|b77p2O(H#l{I8
z_T*dR#U_Psdzep)`U2r=vBRxaE~j_)T#IHiEhN!)*a?5~tnhd2T&LTp;h3vq+P$Yc
z@V9YW9NqR*c6pwxB`;v>ntsZ!%6{4LYeqsLE2*o>Eh!<V%65*U<zI!9x>D?P#fKtC
z`^TUwy;7WO11Bo4w;5+_7F09f3BAR(k9)9pdAQ_BS$*J8aAd{Ue(<f5smO{c&DW>Z
zJ9}~poOovXChVw(ZS31_XM5Zjl_Ou<76lH%E!NZ2>$y5x@L1zahCe)0V0(_^1X9y4
zS?gQ0|JEI9c|kr9Ln#XMFB$iUzI`q7&a<g2W64f~Z2i$sUgdh5pUZpvrH;xz(!D&q
za0cpR>jmx}`f*APM!zeu_uJBc?Wu^TF!DH&dA;$Jn!K%C--c{Ns&7v^Ja8>KT;HC2
z*baDqwSQ;RLOORZ4{!c<p&!UfsId|?CR8oY2K@DDpXtf|550c-$WVW=rM2BU&ZUhr
zE4HW>WIjIH+*&i9`iuPN-bMv7>5g}Jm+ylY=vBDmyOxi|Z8Nk)1>%wApB>`NR!`Ax
zb$#_vCv~~Nqqv!tKeW*nf7tahfYh1Y(f-imorz6i%TMcYBfj5-jXa)aHR22ov&XZp
z3iMXS89z!-ynFIU7}$2E*5*c?J<SH-I|8HULmYQ7AN<(R7s&SOE)DT&b=p2o>9l4s
zuppIOvZ-|EjoUM|&h60z&e%uCTMk7H-xRf9W+j7mrgrV`mBm$KFW#ke-fDZ9V7Rw;
z=y_0tczSQzKMTL#lcF}5B)T>AHf8czmNrh{CEWxTtpS3=FO9qFIaZI<_cT&Hh;wD?
zfAHp8y)MtJmv3}L7y30h8zg=^>8XxGuU*<`I_Al@SZ_i~`9Q($9M|?Ur!E;(h2ms0
zMsFLrekfRK+j_$J2$0%CTUq%=I`p3``47QZb4*Oq;|mj^VxIA*fXfPpTNob{{1>ME
BY6JiP

literal 0
HcmV?d00001

diff --git a/toolkit/themes/pinstripe/mozapps/jar.mn b/toolkit/themes/pinstripe/mozapps/jar.mn
index cad5964d5f32..8b2441ba06ec 100644
--- a/toolkit/themes/pinstripe/mozapps/jar.mn
+++ b/toolkit/themes/pinstripe/mozapps/jar.mn
@@ -28,6 +28,7 @@ toolkit.jar:
   skin/classic/mozapps/extensions/utilities.png                   (extensions/utilities.png)
   skin/classic/mozapps/extensions/heart.png                       (extensions/heart.png)
   skin/classic/mozapps/extensions/navigation.png                  (extensions/navigation.png)
+  skin/classic/mozapps/extensions/warning-stripes.png             (extensions/warning-stripes.png)
   skin/classic/mozapps/extensions/about.css                       (extensions/about.css)
 * skin/classic/mozapps/extensions/extensions.css                  (extensions/extensions.css)
   skin/classic/mozapps/extensions/update.css                      (extensions/update.css)
diff --git a/toolkit/themes/winstripe/mozapps/extensions/extensions.css b/toolkit/themes/winstripe/mozapps/extensions/extensions.css
index ae73c21de953..8d2805647eef 100644
--- a/toolkit/themes/winstripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/winstripe/mozapps/extensions/extensions.css
@@ -63,6 +63,55 @@
   -moz-image-region: rect(0, 36px, 18px, 18px);
 }
 
+/*** global warnings ***/
+
+.global-warning {
+  -moz-box-align: center;
+  padding: 0 8px;
+  color: #916D15;
+  font-weight: bold;
+}
+
+.global-warning,
+.global-warning .button-link {
+  text-shadow: #FFFFFF 1px 1px 1px;
+}
+
+#addons-page[warning] .global-warning-container {
+  background-color: rgba(255, 255, 0, 0.1);
+  background-image: url("chrome://mozapps/skin/extensions/warning-stripes.png");
+  background-repeat: repeat-x;
+}
+
+#detail-view .global-warning {
+  padding: 4px 12px;
+  border-bottom: 1px solid #A8A8A8;  
+}
+
+/*** notification icons ***/
+
+.warning-icon {
+  list-style-image: url("chrome://global/skin/icons/warning-16.png");
+  width: 16px;
+  height: 16px;
+  margin: 3px 0;
+}
+
+.error-icon {
+  list-style-image: url("chrome://global/skin/icons/error-16.png");
+  width: 16px;
+  height: 16px;
+  margin: 3px 0;
+}
+
+.pending-icon,
+.info-icon {
+  list-style-image: url("chrome://global/skin/icons/information-16.png");
+  width: 16px;
+  height: 16px;
+  margin: 3px 0;
+}
+
 /*** category selector ***/
 
 #categories {
@@ -359,28 +408,6 @@
   color: #4F7939;
 }
 
-.warning-icon {
-  list-style-image: url("chrome://global/skin/icons/warning-16.png");
-  width: 16px;
-  height: 16px;
-  margin: 3px 0;
-}
-
-.error-icon {
-  list-style-image: url("chrome://global/skin/icons/error-16.png");
-  width: 16px;
-  height: 16px;
-  margin: 3px 0;
-}
-
-.pending-icon,
-.info-icon {
-  list-style-image: url("chrome://global/skin/icons/information-16.png");
-  width: 16px;
-  height: 16px;
-  margin: 3px 0;
-}
-
 .addon-view[notification="warning"] {
   background-image: -moz-linear-gradient(rgba(255, 255, 0, 0.2), rgba(255, 255, 0, 0.1));
 }
@@ -509,15 +536,15 @@
   opacity: 0.6;
 }
 
-#detail-view > .loading {
+#detail-view .loading {
   opacity: 0;
 }
 
-#detail-view:not([loading]) > .loading {
+#detail-view:not([loading]) .loading {
   visibility: collapse;
 }
 
-#detail-view[loading-extended] > .loading {
+#detail-view[loading-extended] .loading {
   -moz-box-align: center;
   -moz-box-pack: center;
   opacity: 1;
@@ -525,7 +552,7 @@
   -moz-transition-duration: 1s;
 }
 
-#detail-view > .loading > image {
+#detail-view .loading > image {
   list-style-image: url("chrome://global/skin/icons/loading_16.png");
 }
 
diff --git a/toolkit/themes/winstripe/mozapps/extensions/warning-stripes.png b/toolkit/themes/winstripe/mozapps/extensions/warning-stripes.png
new file mode 100644
index 0000000000000000000000000000000000000000..69463fb1af3de8f2cb8c9acc2fcbd61b226cb114
GIT binary patch
literal 2177
zcmaJ@c~ld39#4Q}5s`BGf(1KFpga+BOn^X2IFd<BEMYN(O9dN}0a9|21PDsG)~W<V
zB9vQPlvi4%R8f3Ys8wLYQ7A{dMHFlmeY>_u5kW<$>;#4Ok7eh*ncw_=@ALV5ug|<U
zg%RPqwpebn#9%O6xEz>|u4?q&Z()u;<FD%ef-X)PR;(sck)+8Kst`=5SdoYTT$wN#
z;UhwER$3nth{2eG5<#pcmKR17DP#np5kt_*lqeg62@KXMg`!kM10*8J5;-0Gt^FGi
zkcjDEj4zMGQ!<eh3Fn{+i98rC5FJbv1&G1mARtgnLj`1rMhIwSQn{L@rGu-wH1yqg
zOay^dh$fW|zD_EZ7XdI8Dg^K)ki11CKN8?aCXgvUR4UaAfJkH#kpvORkT;o1qd+tg
z33zjXXf%~LiN=T7Z(^Z4I+&u-C}~7uW@aWKlR{9al8NMifB>Tg1bL$fZ*`VjBh-4!
z)%Z097*UH<5~W6>kOM|VVWJ{kLkH1JUzZ?LuFJ~RZ`y=5jHneViDUxFSkfAh$NT?K
znQR@c*6@)(^8KH}YC)C~A@UKmB3&gy2bY95hEmd)DnzJJs00dybghdKDGH53ouW_z
z%t&8=ClpEK#{DXu$D?uOYK>4XLbxy;L=^}UiI_%Z!DJ?d%nD`rLS!<`4uDvpOa{}(
zkI7~*U@B>i3oAtFGDNOf<BI>_vNz-!tsqmPkzqt7$w0(xl|lxrmQ0guoC|Y9y*FI(
z#<{>7a*1d%MB`xpH0ZS>)IG-6b=#twb>ky))a@$N*7XVE0~n0i0v8SyXm3xSDypaj
zY(j*Llh=dNR$6}VzMer%JIA&kD=5f!a{gHwzCGyvf(gY&wy^ZPi~7ZrW(&(RGxZ5~
zdj7`Rr~AO?AGKvaT1GvuY`%P8IQQ=}K&~w_$2}=~%4VFrZ8D~DzI2O8Wv?1r9FIgr
zu=<5QlQ$cS-U$e~8?N0{4A|Rwl<xkdGv&VhGj7P{&liERjPr|7&1cw$*hPa`)-U*~
zcWtX(@bjK{I-B!Ub+4e~^sL~76-;w-P55{a7LT&43pu;Uwg*oImECvv+^(n&QWee%
zeTEo`!QYL3`9<$f-K7WSG1dO?U8g&hag-Wi$@@cg4J*)+oKCm8Wsp^|>J?oJJ^8<m
z=h+2&9durijvtjJ*G)>`jy4X#kmevpF1LkUwrZFzoWSSIm+trG@3T%5&N;?Z4Bav;
zEcN%hL*;4vOnexS&W)Q<#WGh|L^WFJZ$jsLJDeJH<*ur*yy$1jCEeD!Q``r8nznPo
zan&$e=u=-BU$o4$TFlB5^yQv##@%U(rx0G%_j%1VHl4juUS^UFo`o2%z$h#@<#53S
zD%wwbp5L-HvwH``kJosFXivX-ROV9gqCx(>q}FY*`90);PQSgl_Qk;bq;k+>vv|p0
ze$g?ESY@lqm!?Wz;&#-HgaPd@o>b!I>@RXgia-6hyWxr|6ciRY3|b77p2O(H#l{I8
z_T*dR#U_Psdzep)`U2r=vBRxaE~j_)T#IHiEhN!)*a?5~tnhd2T&LTp;h3vq+P$Yc
z@V9YW9NqR*c6pwxB`;v>ntsZ!%6{4LYeqsLE2*o>Eh!<V%65*U<zI!9x>D?P#fKtC
z`^TUwy;7WO11Bo4w;5+_7F09f3BAR(k9)9pdAQ_BS$*J8aAd{Ue(<f5smO{c&DW>Z
zJ9}~poOovXChVw(ZS31_XM5Zjl_Ou<76lH%E!NZ2>$y5x@L1zahCe)0V0(_^1X9y4
zS?gQ0|JEI9c|kr9Ln#XMFB$iUzI`q7&a<g2W64f~Z2i$sUgdh5pUZpvrH;xz(!D&q
za0cpR>jmx}`f*APM!zeu_uJBc?Wu^TF!DH&dA;$Jn!K%C--c{Ns&7v^Ja8>KT;HC2
z*baDqwSQ;RLOORZ4{!c<p&!UfsId|?CR8oY2K@DDpXtf|550c-$WVW=rM2BU&ZUhr
zE4HW>WIjIH+*&i9`iuPN-bMv7>5g}Jm+ylY=vBDmyOxi|Z8Nk)1>%wApB>`NR!`Ax
zb$#_vCv~~Nqqv!tKeW*nf7tahfYh1Y(f-imorz6i%TMcYBfj5-jXa)aHR22ov&XZp
z3iMXS89z!-ynFIU7}$2E*5*c?J<SH-I|8HULmYQ7AN<(R7s&SOE)DT&b=p2o>9l4s
zuppIOvZ-|EjoUM|&h60z&e%uCTMk7H-xRf9W+j7mrgrV`mBm$KFW#ke-fDZ9V7Rw;
z=y_0tczSQzKMTL#lcF}5B)T>AHf8czmNrh{CEWxTtpS3=FO9qFIaZI<_cT&Hh;wD?
zfAHp8y)MtJmv3}L7y30h8zg=^>8XxGuU*<`I_Al@SZ_i~`9Q($9M|?Ur!E;(h2ms0
zMsFLrekfRK+j_$J2$0%CTUq%=I`p3``47QZb4*Oq;|mj^VxIA*fXfPpTNob{{1>ME
BY6JiP

literal 0
HcmV?d00001

diff --git a/toolkit/themes/winstripe/mozapps/jar.mn b/toolkit/themes/winstripe/mozapps/jar.mn
index e5533d3ded33..442d3f798e29 100644
--- a/toolkit/themes/winstripe/mozapps/jar.mn
+++ b/toolkit/themes/winstripe/mozapps/jar.mn
@@ -34,6 +34,7 @@ toolkit.jar:
         skin/classic/mozapps/extensions/utilities.png              (extensions/utilities.png)
         skin/classic/mozapps/extensions/heart.png                  (extensions/heart.png)
         skin/classic/mozapps/extensions/navigation.png             (extensions/navigation.png)
+        skin/classic/mozapps/extensions/warning-stripes.png        (extensions/warning-stripes.png)
         skin/classic/mozapps/extensions/eula.css                   (extensions/eula.css)
         skin/classic/mozapps/handling/handling.css                 (handling/handling.css)
         skin/classic/mozapps/passwordmgr/key.png                   (passwordmgr/key.png)
@@ -99,6 +100,7 @@ toolkit.jar:
         skin/classic/aero/mozapps/extensions/utilities.png                 (extensions/utilities.png)
         skin/classic/aero/mozapps/extensions/heart.png                     (extensions/heart.png)
         skin/classic/aero/mozapps/extensions/navigation.png                (extensions/navigation.png)
+        skin/classic/aero/mozapps/extensions/warning-stripes.png           (extensions/warning-stripes.png)
         skin/classic/aero/mozapps/extensions/eula.css                      (extensions/eula.css)
         skin/classic/aero/mozapps/handling/handling.css                    (handling/handling.css)
         skin/classic/aero/mozapps/passwordmgr/key.png                      (passwordmgr/key-aero.png)

From a1f6ff98e38f5ef1d2b8dcc1e5997544842cf01c Mon Sep 17 00:00:00 2001
From: Blair McBride <bmcbride@mozilla.com>
Date: Fri, 3 Sep 2010 16:41:06 +1200
Subject: [PATCH 191/222] Bug 591465 - Context menu of add-ons miss context
 related state change entries. r=dtownsend, a=blocking-beta6

---
 .../chrome/mozapps/extensions/extensions.dtd  |   4 +
 .../mozapps/extensions/content/extensions.css |  11 +
 .../mozapps/extensions/content/extensions.js  |  19 +-
 .../mozapps/extensions/content/extensions.xul |  26 +-
 .../extensions/test/browser/Makefile.in       |   2 +
 .../test/browser/browser_bug591465.js         | 311 ++++++++++++++++++
 .../test/browser/browser_bug591465.xml        |  29 ++
 7 files changed, 392 insertions(+), 10 deletions(-)
 create mode 100644 toolkit/mozapps/extensions/test/browser/browser_bug591465.js
 create mode 100644 toolkit/mozapps/extensions/test/browser/browser_bug591465.xml

diff --git a/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd b/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd
index 2cf599920447..499c314ccf94 100644
--- a/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd
+++ b/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd
@@ -65,6 +65,10 @@
 <!ENTITY cmd.enableAddon.accesskey            "E">
 <!ENTITY cmd.disableAddon.label               "Disable">
 <!ENTITY cmd.disableAddon.accesskey           "D">
+<!ENTITY cmd.enableTheme.label                "Wear Theme">
+<!ENTITY cmd.enableTheme.accesskey            "W">
+<!ENTITY cmd.disableTheme.label               "Stop Wearing Theme">
+<!ENTITY cmd.disableTheme.accesskey           "W">
 <!ENTITY cmd.installAddon.label               "Install">
 <!ENTITY cmd.installAddon.accesskey           "I">
 <!ENTITY cmd.uninstallAddon.label             "Remove">
diff --git a/toolkit/mozapps/extensions/content/extensions.css b/toolkit/mozapps/extensions/content/extensions.css
index 96080e00b28b..f7bf41969f90 100644
--- a/toolkit/mozapps/extensions/content/extensions.css
+++ b/toolkit/mozapps/extensions/content/extensions.css
@@ -87,6 +87,17 @@ xhtml|link {
   -moz-binding: url("chrome://mozapps/content/extensions/extensions.xml#detail-row");
 }
 
+#addonitem-popup > menuitem[disabled="true"] {
+  display: none;
+}
+
+#addonitem-popup[addontype="theme"] > #menuitem_enableItem,
+#addonitem-popup[addontype="theme"] > #menuitem_disableItem,
+#addonitem-popup:not([addontype="theme"]) > #menuitem_enableTheme,
+#addonitem-popup:not([addontype="theme"]) > #menuitem_disableTheme {
+  display: none;
+}
+
 #header-searching:not([active]) {
   visibility: hidden;
 }
diff --git a/toolkit/mozapps/extensions/content/extensions.js b/toolkit/mozapps/extensions/content/extensions.js
index 56af0db30286..af5f3b4fde45 100644
--- a/toolkit/mozapps/extensions/content/extensions.js
+++ b/toolkit/mozapps/extensions/content/extensions.js
@@ -177,6 +177,12 @@ var gEventManager = {
     Services.prefs.addObserver(PREF_CHECK_UPDATE_SECURITY, this, false);
 
     this.refreshGlobalWarning();
+
+    var contextMenu = document.getElementById("addonitem-popup");
+    contextMenu.addEventListener("popupshowing", function() {
+      var addon = gViewController.currentViewObj.getSelectedAddon();
+      contextMenu.setAttribute("addontype", addon.type);
+    }, false);
   },
 
   shutdown: function() {
@@ -762,13 +768,14 @@ var gViewController = {
         return aAddon.install && aAddon.install.state == AddonManager.STATE_AVAILABLE;
       },
       doCommand: function(aAddon) {
-        // This case should never happen
-        if (gViewController.currentViewObj != gDetailView)
-          return;
-
-        gViewController.popState(function() {
+        function doInstall() {
           gViewController.currentViewObj.getListItemForID(aAddon.id)._installStatus.installRemote();
-        });
+        }
+
+        if (gViewController.currentViewObj == gDetailView)
+          gViewController.popState(doInstall);
+        else
+          doInstall();
       }
     },
 
diff --git a/toolkit/mozapps/extensions/content/extensions.xul b/toolkit/mozapps/extensions/content/extensions.xul
index 707df333b4cc..b4bd72674f6a 100644
--- a/toolkit/mozapps/extensions/content/extensions.xul
+++ b/toolkit/mozapps/extensions/content/extensions.xul
@@ -67,9 +67,24 @@
       <menuitem id="menuitem_showDetails" command="cmd_showItemDetails"
                 default="true" label="&cmd.showDetails.label;"
                 accesskey="&cmd.showDetails.accesskey;"/>
-      <menuitem id="menuitem_findUpdates" command="cmd_findItemUpdates"
-                label="&cmd.findUpdates.label;"
-                accesskey="&cmd.findUpdates.accesskey;"/>
+      <menuitem id="menuitem_enableItem" command="cmd_enableItem"
+                label="&cmd.enableAddon.label;"
+                accesskey="&cmd.enableAddon.accesskey;"/>
+      <menuitem id="menuitem_disableItem" command="cmd_disableItem"
+                label="&cmd.disableAddon.label;"
+                accesskey="&cmd.disableAddon.accesskey;"/>
+      <menuitem id="menuitem_enableTheme" command="cmd_enableItem"
+                label="&cmd.enableTheme.label;"
+                accesskey="&cmd.enableTheme.accesskey;"/>
+      <menuitem id="menuitem_disableTheme" command="cmd_disableItem"
+                label="&cmd.disableTheme.label;"
+                accesskey="&cmd.disableTheme.accesskey;"/>
+      <menuitem id="menuitem_installItem" command="cmd_installItem"
+                label="&cmd.installAddon.label;"
+                accesskey="&cmd.installAddon.accesskey;"/>
+      <menuitem id="menuitem_uninstallItem" command="cmd_uninstallItem"
+                label="&cmd.uninstallAddon.label;"
+                accesskey="&cmd.uninstallAddon.accesskey;"/>
       <menuseparator/>
       <menuitem id="menuitem_preferences" command="cmd_showItemPreferences"
 #ifdef XP_WIN
@@ -79,6 +94,9 @@
                 label="&cmd.preferencesUnix.label;"
                 accesskey="&cmd.preferencesUnix.accesskey;"/>
 #endif
+      <menuitem id="menuitem_findUpdates" command="cmd_findItemUpdates"
+                label="&cmd.findUpdates.label;"
+                accesskey="&cmd.findUpdates.accesskey;"/>
       <menuitem id="menuitem_about" command="cmd_showItemAbout"
                 label="&cmd.about.label;"
                 accesskey="&cmd.about.accesskey;"/>
@@ -378,7 +396,7 @@
               <label value="&loading.label;"/>
             </hbox>
             <!-- actual detail view -->
-            <vbox class="detail-view-container" flex="3">
+            <vbox class="detail-view-container" flex="3" contextmenu="addonitem-popup">
               <vbox id="detail-notifications">
                 <hbox id="warning-container" align="center" class="warning">
                   <image class="warning-icon"/>
diff --git a/toolkit/mozapps/extensions/test/browser/Makefile.in b/toolkit/mozapps/extensions/test/browser/Makefile.in
index f33da314f8b0..8178e42d9e4d 100644
--- a/toolkit/mozapps/extensions/test/browser/Makefile.in
+++ b/toolkit/mozapps/extensions/test/browser/Makefile.in
@@ -61,6 +61,8 @@ _TEST_FILES = \
   browser_bug572561.js \
   browser_bug577990.js \
   browser_bug581076.js \
+  browser_bug591465.js \
+  browser_bug591465.xml \
   browser_details.js \
   browser_dragdrop.js \
   browser_list.js \
diff --git a/toolkit/mozapps/extensions/test/browser/browser_bug591465.js b/toolkit/mozapps/extensions/test/browser/browser_bug591465.js
new file mode 100644
index 000000000000..cdd06dadb165
--- /dev/null
+++ b/toolkit/mozapps/extensions/test/browser/browser_bug591465.js
@@ -0,0 +1,311 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+// Bug 591465 - Context menu of add-ons miss context related state change entries
+
+const PREF_GETADDONS_MAXRESULTS = "extensions.getAddons.maxResults";
+const PREF_GETADDONS_GETSEARCHRESULTS = "extensions.getAddons.search.url";
+const SEARCH_URL = TESTROOT + "browser_bug591465.xml";
+const SEARCH_QUERY = "SEARCH";
+
+var gManagerWindow;
+var gProvider;
+var gContextMenu;
+
+
+function test() {
+  waitForExplicitFinish();
+  
+  gProvider = new MockProvider();
+
+  gProvider.createAddons([{
+    id: "addon1@tests.mozilla.org",
+    name: "addon 1",
+    version: "1.0"
+  }, {
+    id: "addon2@tests.mozilla.org",
+    name: "addon 2",
+    version: "1.0",
+    _userDisabled: true
+  }, {
+    id: "theme1@tests.mozilla.org",
+    name: "theme 1",
+    version: "1.0",
+    type: "theme"
+  }, {
+    id: "theme2@tests.mozilla.org",
+    name: "theme 2",
+    version: "1.0",
+    type: "theme",
+    _userDisabled: true
+  }]);
+
+  open_manager("addons://list/extension", function(aWindow) {
+    gManagerWindow = aWindow;
+    gContextMenu = aWindow.document.getElementById("addonitem-popup");
+    run_next_test();
+  });
+}
+
+
+function end_test() {
+  Services.prefs.clearUserPref(PREF_GETADDONS_GETSEARCHRESULTS);
+  close_manager(gManagerWindow, finish);
+}
+
+
+function check_contextmenu(aIsTheme, aIsEnabled, aIsRemote) {
+  if (aIsTheme || aIsEnabled || aIsRemote)
+    is_element_hidden(gManagerWindow.document.getElementById("menuitem_enableItem"),
+                       "'Enable' should be hidden");
+  else
+    is_element_visible(gManagerWindow.document.getElementById("menuitem_enableItem"),
+                       "'Enable' should be visible");
+  
+  if (aIsTheme || !aIsEnabled || aIsRemote)
+    is_element_hidden(gManagerWindow.document.getElementById("menuitem_disableItem"),
+                       "'Disable' should be hidden");
+  else
+    is_element_visible(gManagerWindow.document.getElementById("menuitem_disableItem"),
+                       "'Disable' should be visible");
+
+  if (!aIsTheme || aIsEnabled || aIsRemote)
+    is_element_hidden(gManagerWindow.document.getElementById("menuitem_enableTheme"),
+                       "'Wear Theme' should be hidden");
+  else
+    is_element_visible(gManagerWindow.document.getElementById("menuitem_enableTheme"),
+                       "'Wear Theme' should be visible");
+  
+  if (!aIsTheme || !aIsEnabled || aIsRemote)
+    is_element_hidden(gManagerWindow.document.getElementById("menuitem_disableTheme"),
+                       "'Stop Wearing Theme' should be hidden");
+  else
+    is_element_visible(gManagerWindow.document.getElementById("menuitem_disableTheme"),
+                       "'Stop Wearing Theme' should be visible");
+
+  if (aIsRemote)
+    is_element_visible(gManagerWindow.document.getElementById("menuitem_installItem"),
+                       "'Install' should be visible");
+  else
+    is_element_hidden(gManagerWindow.document.getElementById("menuitem_installItem"),
+                       "'Install' should be hidden");
+}
+
+
+add_test(function() {
+  var el = get_addon_element(gManagerWindow, "addon1@tests.mozilla.org");
+  isnot(el, null, "Should have found addon element");
+
+  gContextMenu.addEventListener("popupshown", function() {
+    gContextMenu.removeEventListener("popupshown", arguments.callee, false);
+
+    check_contextmenu(false, true, false);
+
+    gContextMenu.hidePopup();
+    run_next_test();
+  }, false);
+
+  info("Opening context menu on enabled extension item");
+  EventUtils.synthesizeMouse(el, 4, 4, { }, gManagerWindow);
+  EventUtils.synthesizeMouse(el, 4, 4, { type: "contextmenu", button: 2 }, gManagerWindow);
+});
+
+
+add_test(function() {
+  var el = get_addon_element(gManagerWindow, "addon2@tests.mozilla.org");
+
+  gContextMenu.addEventListener("popupshown", function() {
+    gContextMenu.removeEventListener("popupshown", arguments.callee, false);
+
+    check_contextmenu(false, false, false);
+
+    gContextMenu.hidePopup();
+    run_next_test();
+  }, false);
+
+  info("Opening context menu on disabled extension item");
+  EventUtils.synthesizeMouse(el, 4, 4, { }, gManagerWindow);
+  EventUtils.synthesizeMouse(el, 4, 4, { type: "contextmenu", button: 2 }, gManagerWindow);
+});
+
+
+add_test(function() {
+  gManagerWindow.loadView("addons://list/theme");
+  wait_for_view_load(gManagerWindow, function() {
+    var el = get_addon_element(gManagerWindow, "theme1@tests.mozilla.org");
+  
+    gContextMenu.addEventListener("popupshown", function() {
+      gContextMenu.removeEventListener("popupshown", arguments.callee, false);
+  
+    check_contextmenu(true, true, false);
+  
+      gContextMenu.hidePopup();
+      run_next_test();
+    }, false);
+  
+    info("Opening context menu on enabled theme item");
+    EventUtils.synthesizeMouse(el, 4, 4, { }, gManagerWindow);
+    EventUtils.synthesizeMouse(el, 4, 4, { type: "contextmenu", button: 2 }, gManagerWindow);
+  });
+});
+
+
+add_test(function() {
+  var el = get_addon_element(gManagerWindow, "theme2@tests.mozilla.org");
+
+  gContextMenu.addEventListener("popupshown", function() {
+    gContextMenu.removeEventListener("popupshown", arguments.callee, false);
+
+    check_contextmenu(true, false, false);
+
+    gContextMenu.hidePopup();
+    run_next_test();
+  }, false);
+
+  info("Opening context menu on disabled theme item");
+  EventUtils.synthesizeMouse(el, 4, 4, { }, gManagerWindow);
+  EventUtils.synthesizeMouse(el, 4, 4, { type: "contextmenu", button: 2 }, gManagerWindow);
+});
+
+
+add_test(function() {
+  gManagerWindow.loadView("addons://detail/addon1@tests.mozilla.org");
+  wait_for_view_load(gManagerWindow, function() {
+    
+    gContextMenu.addEventListener("popupshown", function() {
+      gContextMenu.removeEventListener("popupshown", arguments.callee, false);
+  
+      check_contextmenu(false, true, false);
+  
+      gContextMenu.hidePopup();
+      run_next_test();
+    }, false);
+
+    info("Opening context menu on enabled extension, in detail view");
+    var el = gManagerWindow.document.querySelector("#detail-view .detail-view-container");
+    EventUtils.synthesizeMouse(el, 4, 4, { }, gManagerWindow);
+    EventUtils.synthesizeMouse(el, 4, 4, { type: "contextmenu", button: 2 }, gManagerWindow);
+  });
+});
+
+
+add_test(function() {
+  gManagerWindow.loadView("addons://detail/addon2@tests.mozilla.org");
+  wait_for_view_load(gManagerWindow, function() {
+    
+    gContextMenu.addEventListener("popupshown", function() {
+      gContextMenu.removeEventListener("popupshown", arguments.callee, false);
+  
+      check_contextmenu(false, false, false);
+  
+      gContextMenu.hidePopup();
+      run_next_test();
+    }, false);
+
+    info("Opening context menu on disabled extension, in detail view");
+    var el = gManagerWindow.document.querySelector("#detail-view .detail-view-container");
+    EventUtils.synthesizeMouse(el, 4, 4, { }, gManagerWindow);
+    EventUtils.synthesizeMouse(el, 4, 4, { type: "contextmenu", button: 2 }, gManagerWindow);
+  });
+});
+
+
+add_test(function() {
+  gManagerWindow.loadView("addons://detail/theme1@tests.mozilla.org");
+  wait_for_view_load(gManagerWindow, function() {
+    
+    gContextMenu.addEventListener("popupshown", function() {
+      gContextMenu.removeEventListener("popupshown", arguments.callee, false);
+  
+      check_contextmenu(true, true, false);
+  
+      gContextMenu.hidePopup();
+      run_next_test();
+    }, false);
+
+    info("Opening context menu on enabled theme, in detail view");
+    var el = gManagerWindow.document.querySelector("#detail-view .detail-view-container");
+    EventUtils.synthesizeMouse(el, 4, 4, { }, gManagerWindow);
+    EventUtils.synthesizeMouse(el, 4, 4, { type: "contextmenu", button: 2 }, gManagerWindow);
+  });
+});
+
+
+add_test(function() {
+  gManagerWindow.loadView("addons://detail/theme2@tests.mozilla.org");
+  wait_for_view_load(gManagerWindow, function() {
+    
+    gContextMenu.addEventListener("popupshown", function() {
+      gContextMenu.removeEventListener("popupshown", arguments.callee, false);
+  
+      check_contextmenu(true, false, false);
+  
+      gContextMenu.hidePopup();
+      run_next_test();
+    }, false);
+
+    info("Opening context menu on disabled theme, in detail view");
+    var el = gManagerWindow.document.querySelector("#detail-view .detail-view-container");
+    EventUtils.synthesizeMouse(el, 4, 4, { }, gManagerWindow);
+    EventUtils.synthesizeMouse(el, 4, 4, { type: "contextmenu", button: 2 }, gManagerWindow);
+  });
+});
+
+
+add_test(function() {
+  info("Searching for remote addons");
+
+  Services.prefs.setCharPref(PREF_GETADDONS_GETSEARCHRESULTS, SEARCH_URL);
+  Services.prefs.setIntPref(PREF_SEARCH_MAXRESULTS, 15);
+
+  var searchBox = gManagerWindow.document.getElementById("header-search");
+  searchBox.value = SEARCH_QUERY;
+
+  EventUtils.synthesizeMouse(searchBox, 2, 2, { }, gManagerWindow);
+  EventUtils.synthesizeKey("VK_RETURN", { }, gManagerWindow);
+
+  wait_for_view_load(gManagerWindow, function() {
+    var filter = gManagerWindow.document.getElementById("search-filter-remote");
+    EventUtils.synthesizeMouse(filter, 2, 2, { }, gManagerWindow);
+    executeSoon(function() {
+      
+      var el = get_addon_element(gManagerWindow, "remote1@tests.mozilla.org");
+    
+      gContextMenu.addEventListener("popupshown", function() {
+        gContextMenu.removeEventListener("popupshown", arguments.callee, false);
+    
+        check_contextmenu(false, false, true);
+    
+        gContextMenu.hidePopup();
+        run_next_test();
+      }, false);
+    
+      info("Opening context menu on remote extension item");
+      EventUtils.synthesizeMouse(el, 4, 4, { }, gManagerWindow);
+      EventUtils.synthesizeMouse(el, 4, 4, { type: "contextmenu", button: 2 }, gManagerWindow);
+      
+    });
+  });
+});
+
+
+add_test(function() {
+  gManagerWindow.loadView("addons://detail/remote1@tests.mozilla.org");
+  wait_for_view_load(gManagerWindow, function() {
+    
+    gContextMenu.addEventListener("popupshown", function() {
+      gContextMenu.removeEventListener("popupshown", arguments.callee, false);
+  
+      check_contextmenu(false, false, true);
+  
+      gContextMenu.hidePopup();
+      run_next_test();
+    }, false);
+
+    info("Opening context menu on remote extension, in detail view");
+    var el = gManagerWindow.document.querySelector("#detail-view .detail-view-container");
+    EventUtils.synthesizeMouse(el, 4, 4, { }, gManagerWindow);
+    EventUtils.synthesizeMouse(el, 4, 4, { type: "contextmenu", button: 2 }, gManagerWindow);
+  });
+});
diff --git a/toolkit/mozapps/extensions/test/browser/browser_bug591465.xml b/toolkit/mozapps/extensions/test/browser/browser_bug591465.xml
new file mode 100644
index 000000000000..042bec5666c2
--- /dev/null
+++ b/toolkit/mozapps/extensions/test/browser/browser_bug591465.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<searchresults total_results="100">
+  <addon>
+    <name>MAGICAL SEARCH RESULT</name>
+    <type id='1'>Extension</type>
+    <guid>remote1@tests.mozilla.org</guid>
+    <version>3.0</version>
+    <authors>
+      <author>
+        <name>Test Creator</name>
+        <link>http://example.com/creator.html</link>
+      </author>
+    </authors>
+    <status id='4'>Public</status>
+    <summary>Test summary - SEARCH SEARCH</summary>
+    <description>Test description</description>
+    <compatible_applications>
+      <application>
+        <name>Firefox</name>
+        <appID>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</appID>
+        <min_version>0</min_version>
+        <max_version>*</max_version>
+      </application>
+    </compatible_applications>
+    <compatible_os>ALL</compatible_os>
+    <install size="2">http://example.com/browser/toolkit/mozapps/extensions/test/browser/addons/browser_searching.xpi</install>
+  </addon>
+</searchresults>
+

From d16609cebd1913140b18606ea861de7657cfa31d Mon Sep 17 00:00:00 2001
From: Dave Townsend <dtownsend@mozilla.com>
Date: Mon, 6 Sep 2010 19:00:47 +1200
Subject: [PATCH 192/222] Bug 593217 - Detail view always shows full
 screenshot, not thumbnail. r=bmcbride, a=blocking-beta6

---
 toolkit/mozapps/extensions/content/extensions.js      |  4 ++--
 .../extensions/test/browser/browser_details.js        | 11 ++++++++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/toolkit/mozapps/extensions/content/extensions.js b/toolkit/mozapps/extensions/content/extensions.js
index af5f3b4fde45..0772e5924759 100644
--- a/toolkit/mozapps/extensions/content/extensions.js
+++ b/toolkit/mozapps/extensions/content/extensions.js
@@ -1727,8 +1727,8 @@ var gDetailView = {
 
     var screenshot = document.getElementById("detail-screenshot");
     if (aAddon.screenshots && aAddon.screenshots.length > 0) {
-      if (aAddon.screenshots[0].thumbnail)
-        screenshot.src = aAddon.screenshots[0].thumbnail;
+      if (aAddon.screenshots[0].thumbnailURL)
+        screenshot.src = aAddon.screenshots[0].thumbnailURL;
       else
         screenshot.src = aAddon.screenshots[0].url;
       screenshot.hidden = false;
diff --git a/toolkit/mozapps/extensions/test/browser/browser_details.js b/toolkit/mozapps/extensions/test/browser/browser_details.js
index 7bd81deaa484..6e4cacd127f2 100644
--- a/toolkit/mozapps/extensions/test/browser/browser_details.js
+++ b/toolkit/mozapps/extensions/test/browser/browser_details.js
@@ -90,7 +90,11 @@ function test() {
     appDisabled: true,
     permissions: AddonManager.PERM_CAN_ENABLE |
                  AddonManager.PERM_CAN_DISABLE |
-                 AddonManager.PERM_CAN_UPGRADE
+                 AddonManager.PERM_CAN_UPGRADE,
+    screenshots: [{
+      url: "http://example.com/screenshot",
+      thumbnailURL: "http://example.com/thumbnail"
+    }],
   }, {
     id: "addon4@tests.mozilla.org",
     name: "Test add-on 4",
@@ -243,7 +247,7 @@ add_test(function() {
     is_element_hidden(get("detail-creator")._creatorLink, "Creator link should be hidden");
 
     is_element_visible(get("detail-screenshot"), "Screenshot should be visible");
-    ok(get("detail-screenshot").src, "http://example.com/screenshot");
+    is(get("detail-screenshot").src, "http://example.com/screenshot", "Should be showing the full sized screenshot");
     is(get("detail-desc").textContent, "Short description", "Description should be correct");
 
     is_element_hidden(get("detail-contributions"), "Contributions section should be hidden");
@@ -290,7 +294,8 @@ add_test(function() {
     is(get("detail-creator")._creatorLink.value, "Mozilla", "Creator link should be correct");
     is(get("detail-creator")._creatorLink.href, "http://www.mozilla.org", "Creator link href should be correct");
 
-    is_element_hidden(get("detail-screenshot"), "Screenshot should not be visible");
+    is_element_visible(get("detail-screenshot"), "Screenshot should be visible");
+    is(get("detail-screenshot").src, "http://example.com/thumbnail", "Should be showing the thumbnail");
 
     is_element_hidden(get("detail-contributions"), "Contributions section should be hidden");
 

From d2bf08d0588380f6fb794831dc01868c5befc452 Mon Sep 17 00:00:00 2001
From: Paolo Amadini <paolo.02.prg@amadzone.org>
Date: Mon, 6 Sep 2010 19:07:49 +1200
Subject: [PATCH 193/222] Bug 590201 - Remove buttons are difficult to discover
 in list view. r=bmcbride, a=blocking-beta6

---
 .../mozapps/extensions/content/extensions.xml |  7 ++--
 .../mozapps/extensions/extensions.css         | 20 -----------
 .../mozapps/extensions/extensions.css         | 26 --------------
 .../mozapps/extensions/extensions.css         | 36 -------------------
 4 files changed, 3 insertions(+), 86 deletions(-)

diff --git a/toolkit/mozapps/extensions/content/extensions.xml b/toolkit/mozapps/extensions/content/extensions.xml
index 5c9caf4856a4..01174e33c7fb 100644
--- a/toolkit/mozapps/extensions/content/extensions.xml
+++ b/toolkit/mozapps/extensions/content/extensions.xml
@@ -817,12 +817,11 @@
             <xul:button anonid="disable-btn" class="addon-control disable"
                         label="&cmd.disableAddon.label;"
                         oncommand="document.getBindingParent(this).userDisabled = true;"/>
+            <xul:button anonid="remove-btn" class="addon-control remove"
+                        label="&cmd.uninstallAddon.label;"
+                        oncommand="document.getBindingParent(this).uninstall();"/>
           </xul:hbox>
         </xul:vbox>
-        <xul:vbox pack="start" class="remove-container">
-          <xul:button anonid="remove-btn" class="remove-button"
-                      oncommand="document.getBindingParent(this).uninstall();"/>
-        </xul:vbox>
       </xul:hbox>
     </content>
 
diff --git a/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css b/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
index d086e367e401..65be2788f2f3 100644
--- a/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
@@ -768,26 +768,6 @@
   display: none;
 }
 
-.remove-button {
-  -moz-appearance: toolbarbutton;
-  margin: 0;
-  list-style-image: url("moz-icon://stock/gtk-close?size=menu");
-  min-width: 0;
-  margin: 0;
-}
-
-.remove-button .button-text {
-  display: none;
-}
-
-.remove-button .button-icon {
-  margin: 0;
-}
-
-.remove-button .button-box {
-  padding: 0;
-}
-
 .button-link {
   -moz-appearance: none;
   background: transparent;
diff --git a/toolkit/themes/pinstripe/mozapps/extensions/extensions.css b/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
index 60fa8891f2a5..cdcfb2f2058a 100644
--- a/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
@@ -493,10 +493,6 @@
   list-style-image: url("chrome://global/skin/arrow/arrow-up.gif");
 }
 
-.remove-container {
-  width: 16px;
-}
-
 /*** item - uninstalled ***/
 
 .addon[status="uninstalled"] {
@@ -829,28 +825,6 @@
   display: none;
 }
 
-.remove-button {
-  -moz-appearance: none;
-  padding: 0;
-  margin: 0;
-  list-style-image: url("chrome://global/skin/icons/closetab.png");
-  border: none;
-  min-width: 0;
-  margin: 0;
-}
-
-.remove-button .button-text {
-  display: none;
-}
-
-.remove-button:hover {
-  list-style-image: url("chrome://global/skin/icons/closetab-hover.png");
-}
-
-.remove-button:hover:active {
-  list-style-image: url("chrome://global/skin/icons/closetab-active.png");
-}
-  
 .button-link {
   -moz-appearance: none;
   background: transparent;
diff --git a/toolkit/themes/winstripe/mozapps/extensions/extensions.css b/toolkit/themes/winstripe/mozapps/extensions/extensions.css
index 8d2805647eef..68a427b48c88 100644
--- a/toolkit/themes/winstripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/winstripe/mozapps/extensions/extensions.css
@@ -469,10 +469,6 @@
   list-style-image: url("chrome://global/skin/arrow/arrow-up.gif");
 }
 
-.remove-container {
-  width: 16px;
-}
-
 /*** item - uninstalled ***/
 
 .addon[status="uninstalled"] {
@@ -787,38 +783,6 @@
   display: none;
 }
 
-.remove-button {
-  -moz-appearance: none;
-  background: transparent;
-  padding: 0;
-  margin: 0;
-  list-style-image: url("chrome://global/skin/icons/close.png");
-  -moz-image-region: rect(0, 64px, 16px, 48px);
-  border: none;
-  min-width: 0;
-  margin: 0;
-}
-
-.remove-button .button-box {
-  padding: 0;
-}
-
-.addon[selected] .remove-button:not(:hover):not(:active) {
-  -moz-image-region: rect(0, 16px, 16px, 0);
-}
-
-.remove-button:hover {
-  -moz-image-region: rect(0, 32px, 16px, 16px);
-}
-
-.remove-button:active {
-  -moz-image-region: rect(0, 48px, 16px, 32px);
-}
-
-.remove-button .button-text {
-  display: none;
-}
-
 .button-link {
   -moz-appearance: none;
   background: transparent;

From 487c2220d250e07d442340842a91b6b1e1658bf5 Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@iki.fi>
Date: Wed, 1 Sep 2010 14:41:07 +0300
Subject: [PATCH 194/222] Bug 585819 - When the context passed to
 Range.createContextualFragment is "html" in an HTML document, use "body" as
 the context instead. r=bzbarsky, a=blocking2.0-betaN.

---
 content/base/public/nsContentUtils.h         |  5 +++
 content/base/src/nsContentUtils.cpp          |  4 ++-
 dom/tests/mochitest/bugs/Makefile.in         |  1 +
 dom/tests/mochitest/bugs/test_bug585819.html | 38 ++++++++++++++++++++
 4 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 dom/tests/mochitest/bugs/test_bug585819.html

diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
index a45ae16027dc..f0bea80c228a 100644
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -1046,6 +1046,11 @@ public:
    * Creates a DocumentFragment from text using a context node to resolve
    * namespaces.
    *
+   * Note! In the HTML case with the HTML5 parser enabled, this is only called
+   * from Range.createContextualFragment() and the implementation here is
+   * quirky accordingly (html context node behaves like a body context node).
+   * If you don't want that quirky behavior, don't use this method as-is!
+   *
    * @param aContextNode the node which is used to resolve namespaces
    * @param aFragment the string which is parsed to a DocumentFragment
    * @param aWillOwnFragment is PR_TRUE if ownership of the fragment should be
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index b3ce5b47ea5f..d51a158a16ac 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -3896,7 +3896,9 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
     }
     
     nsCOMPtr<nsIContent> fragment = do_QueryInterface(frag);
-    if (contextAsContent) {
+    if (contextAsContent &&
+        !(nsGkAtoms::html == contextAsContent->Tag() &&
+          contextAsContent->IsHTML())) {
       parser->ParseFragment(aFragment, 
                             fragment, 
                             contextAsContent->Tag(), 
diff --git a/dom/tests/mochitest/bugs/Makefile.in b/dom/tests/mochitest/bugs/Makefile.in
index 0fb16697a975..134289cd86f8 100644
--- a/dom/tests/mochitest/bugs/Makefile.in
+++ b/dom/tests/mochitest/bugs/Makefile.in
@@ -120,6 +120,7 @@ _TEST_FILES	= \
 		test_DOMWindowCreated_chromeonly.html \
 		test_bug581072.html \
 		test_bug583225.html \
+		test_bug585819.html \
 		$(NULL)
 
 libs:: 	$(_TEST_FILES)
diff --git a/dom/tests/mochitest/bugs/test_bug585819.html b/dom/tests/mochitest/bugs/test_bug585819.html
new file mode 100644
index 000000000000..60824e7d9625
--- /dev/null
+++ b/dom/tests/mochitest/bugs/test_bug585819.html
@@ -0,0 +1,38 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=585819
+-->
+<head>
+  <title>Test for Bug 585819</title>
+  <script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=585819">Mozilla Bug 585819</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  <iframe></iframe>
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+/** Test for Bug 585819 **/
+
+var range = document.createRange();
+range.setStartBefore(document.body);
+var fragment = range.createContextualFragment("<span></span>");
+is(fragment.firstChild.localName, "span", "We don't want tag inference here!");
+
+var iframeDoc = document.getElementsByTagName("iframe")[0].contentDocument;
+var root = iframeDoc.documentElement;
+is(root.localName, "html", "Wrong root.");
+root.innerHTML = "<span></span>";
+is(root.firstChild.localName, "head", "We want inference here!");
+
+</script>
+</pre>
+</body>
+</html>
+

From ec8623329e4d48bf1ab05612fbcc24d65fcca3c0 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Mon, 6 Sep 2010 21:11:54 +1200
Subject: [PATCH 195/222] Fixing test for D2D, a=fixing-test

---
 layout/reftests/bugs/584699-1-ref.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/reftests/bugs/584699-1-ref.html b/layout/reftests/bugs/584699-1-ref.html
index 02fbd47ff471..8d1f53bdf5ad 100644
--- a/layout/reftests/bugs/584699-1-ref.html
+++ b/layout/reftests/bugs/584699-1-ref.html
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML>
 <html>
 <body>
-<div style="position: absolute; top:20px; opacity:0.5; border:1px solid black; width:200px; height:200px;"></div>
+<canvas style="position: absolute; top:20px; opacity:0.5; border:1px solid black; width:200px; height:200px;"></canvas>
 </body>
 </html>

From 3012fd843326fcea27517ec26a6488ba00fe2375 Mon Sep 17 00:00:00 2001
From: Andreas Nilsson <nisses.mail@home.se>
Date: Mon, 6 Sep 2010 10:45:46 +0200
Subject: [PATCH 196/222] Bug 584006 - Drop non-native style for the Add-ons
 manager utilities button. r=bmcbride a=blocking

---
 .../mozapps/extensions/extensions.css         |  23 +++---------------
 .../mozapps/extensions/utilities.png          | Bin 3203 -> 946 bytes
 2 files changed, 3 insertions(+), 20 deletions(-)

diff --git a/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css b/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
index 65be2788f2f3..d24ebf4ee484 100644
--- a/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
@@ -260,30 +260,13 @@
 }
 
 #header-utils-btn {
-  -moz-appearance: none;
   min-width: 4.5em;
-  border-width: 1px;
-  -moz-border-top-colors: #999;
-  -moz-border-bottom-colors: #999;
-  -moz-border-left-colors: #999;
-  -moz-border-right-colors: #999;
-  -moz-border-radius: 8px;
-  background-image: -moz-linear-gradient(#FFF, #BBB);
+}
+
+#header-utils-btn .button-icon {
   list-style-image: url("chrome://mozapps/skin/extensions/utilities.png");
 }
 
-#header-utils-btn:hover,
-#header-utils-btn[open="true"] {
-  -moz-border-top-colors: #777;
-  -moz-border-bottom-colors: #777;
-  -moz-border-left-colors: #777;
-  -moz-border-right-colors: #777;
-}
-
-#header-utils-btn[open="true"] {
-  -moz-box-shadow: inset 3px 3px 8px #555;
-}
-
 #header-utils-btn:-moz-focusring > .button-box {
   border: none;
 }
diff --git a/toolkit/themes/gnomestripe/mozapps/extensions/utilities.png b/toolkit/themes/gnomestripe/mozapps/extensions/utilities.png
index 9e362f48811bf4758fe276b40314048b04f7d812..6f845c03a32ee553b19d49f8e82f2b0288885c15 100644
GIT binary patch
literal 946
zcmV;j15NyiP)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV00004b3#c}2nYxW
zd<bNS00009a7bBm000fw000fw0YWI7cmMzZ8FWQhbW?9;ba!ELWdL_~cP?peYja~^
zaAhuUa%Y?FJQ@H1120KLK~y-6ZIfMSn{^b%pY!Jbf8RHWTZ)ZMq_Z8YscoVi4YJn8
zWNoU$bRX=ZP#9ANWjO6r6hVsGcA==?g?hCivei13wHw-QGO^v9{kYg<)h4wYMcr)c
zg`?R>#k_C&e*C>kr6UIpJQvS_-{Cojgb*lJ{qH3kIOpF00)}Dkf4jTqYB8U5-%wRS
z6H)w$aM)k>c%6@k;>A1wKm~&LKX~_=BFmxt+S(VUY4$P3&Nn^T7&g`n{B-^LjA@#C
zIp=)@91y_#n{RaQSSL8v-y4u+ITVk#x+*IkImkIrd%fNoNs=HdGW>pDjiM;&N2{x!
zOC%C*Aw=+4e{Wy|!8?6#4TOThj$m!AdS~Sh06<YxaL&Ow2Xinm2g8k<H?>qcHI(e_
zKLh}*u*+(8wP$W_Zjbk&Qq`$C@#o@_G5_n091%o)eZBj!P>AdKJW{DtE}PBv6z16B
zBb^PBB*htXbd>qZTpo`HON-0q)YQ~>hGD!20OOa&j|*WZDl02ksrNzGN@ivBg_jPW
zv2FV@BhW}&qOHvBa?<9K5_mRwaPI2Y|E^|NkDea<@-F~5`22yR)6>(lTPwGg1Z!)Y
zRok|0*EPNF+lv?fmUK;rM1VvR6j_0)Isp*0oW={7T2AAJVUmM603rxmz_M)UIUV$D
z+pY%2Se$d-(bCdVok%2{%S+4lM<0JUk<YIk0RUO%CptSjV?Lixx^UsVmQK$tn5K2c
zvaHMNDKxjlD*S%m%*(HIm2N4o!0lVN#mMN$KejEfd(ZAofvPH+P5+F+fzz2x=5F}P
z4-<<UQcx5n+1S|V<_;OZq-Ie5@D}Ro>e@_1xOeX^X45n9`^pgx*SoI#IFST!X#J3)
zu}DCYr1nUpNgW#>(@vcn%nY9$*8aHlI~IOhz|ioJcIxEknW@Q1z4hr<CxP0dvB<_l
zdS+MaH6jWMh_kw;_b7@o`r7NSZr3#p$4`7Ro7eOERHvFGP`eOfe(d{8I{*Mei1mId
z+7u}0oz2niq2aH@z-OP@JDa23#XLfY{|WA|Xe`p;e!x9qS(eZ>egEXdbkTSI5A^Y6
Uwg;^z-T(jq07*qoM6N<$g7U1&Gynhq

literal 3203
zcmV-}41Dv6P)<h;3K|Lk000e1NJLTq000sI000pP1^@s6&|3WY00009a7bBm000XU
z000XU0RWnu7ytkYPiaF#P*7-ZbZ>KLZ*U+<Lqi~Na&Km7Y-Iodc-oy)XH-+^7Crag
z^g>IBfRsybQWXdwQbLP>6p<z>Aqfylh#{fb6;Z(vMMVS~$e@S=j*ftg6;Uh<iVD~V
z<RPMtgQJLw%KPDaqifc@_vX$1wbwr9tn;0-&j-K=43<bUQ8j=JsX`tR;Dg7+#^K~H
zK!FM*Z~zbpvt%K2{UZSY_<lS*D<Z%Lz5oGu(+dayz)hRLFdT>f59&ghTmgWD0l;*T
zI7<kC6aYYajzXpYKt=(8otP$50H6c_V9R4-;{Z@C0AMG7=F<Rxo%or10RUT+Ar%3j
zkpLhQWr#!oXgdI`&sK^>09Y^p6lP1rIRMx#05C~cW=H_Aw*bJ-5DT&Z2n+x)QHX^p
z00esgV8|mQcmRZ%02D^@S3L16t`O%c004NIvOKvYIYoh62rY33S640`D9%Y2D-<?i
z0%4j!F2Z@488U%158(66005wo6%pWr^Zj_v4zAA5HjcIqUoGmt2LB>rV&neh&#Q1i
z007~1e$oCcFS8neI|hJl{-P!B1ZZ9hpmq0)X0i`JwE&>$+E?>%_<lS*MWK+n+1cgf
z<k(8YLR(?VSAG6x!e78w{cQPuJpA|d;J)G{fihizM+Erb!p!tcr5w+a34~(Y=8s4G
zw+sLL9n&JjNn*KJDiq^U5^;`1nvC-@r6P$!k}1U{(*I=Q-z@tBKHoI}uxdU5dyy@u
zU1J0GOD7Ombim^G008p4Z^6_k2m^p<gW=D2|L;HjN1!DDfM!XOaR2~bL?kX$%CkSm
z2mk;?pn)o|K^yeJ7%adB9Ki+L!3+FgHiSYX#KJ-lLJDMn9CBbOtb#%)hRv`YDqt_v
zKpix|QD}yfa1JiQRk#j4a1Z)n2%f<xynzV>LC6RbVIkUx0b+_+BaR3cnT7Zv!AJxW
zizFb)h!jyGOOZ85F;a?DAXP{m@;!0_Ifq<Ex{*7`05XF7hP+2Hl!3BQJ=6@fL%FCo
z8iYoo3(#bAF`ADSpqtQgv>H8(HlgRxt7s3}k3K`kFu>>-2Q$QMFfPW!La{h336o>X
zu_CMttHv6zR;&ZNiS=X8v3CR#fknUxHUxJ<AYmRsNLWl*PS{AOARHt#5!wki2?K;t
z!Y3k=s7tgax)J%r7-BLphge7~Bi0g+6E6^Zh(p9TBoc{3GAFr^0!gu?RMHaCM$&Fl
zBk3%un>0uoBa_M6WNWeqIg~6QE69c9o#eyhGvpiOA@W-aonk<7r1(?fC{oI5N*U!4
z<uv66WtcKSRim0x-Ke2d5jBrmLam{;Qm;{ms1r1GnmNsb7D-E`t)i9F8fX`2_i3-_
zbh;7Ul^#x)&{xvS=|||7=mYe33=M`AgU5(xC>fg=2N-7=cNnjjOr{yriy6mMFgG#l
znCF=fnQv8CDz++o6_Lscl}eQ+l^ZHARH>?_s@|##Rr6KLRFA1%Q+=*RRWnoLsR`7U
zt5vF<Q0r40Q)j6=sE4X&sBct1q<&fbi3VB2Ov6t@q*0);U*o*SAPZv|vv@2aYYnT0
zb%8a+Cb7-ge0D0knEf5Qi#@8Tp*ce{N;6lpQuCB%KL_KOarm5cP6_8Ir<e17iry6O
zDdH&`rZh~sF=bq9s+O0QSgS~@QL9Jmy*94xr=6y~MY~!1fet~(N+(<=M`w@D1)b+p
z*;C!83a1uLJv#NSE~;y#8=<>IcfW3@?wFpwUVxrVZ>QdQz32KIeJ}k~{cZZE^+ya?
z2D1z#2HOnI7(B%_ac?{wFUQ;QQA1tBKtrWrm0_3Rgps+?Jfqb{jYbcQX~taRB;#$y
zZN{S}1|}gUOHJxc?wV3fxuz+mJ4`!F$IZ;mqRrNsHJd##*D~ju=bP7?-?v~|cv>vB
zsJ6IeNwVZxrdjT`yl#bBIa#GxRa#xMMy;K#CDyyGyQdMSxlWT#tDe?p!?5wT$+oGt
z8L;Kp2HUQ-ZMJ=3XJQv;x5ci*?vuTfeY$;({XGW_huIFR9a<fJbF^|4I#xQ~n$Dc=
zKYhjYmgz5NSkDm8*fZm{6U!;YX`NG>(?@3)XSs8O^N5RyOM=TTmp(3=8^+zpz2r)C
z^>JO{deZfso3oq3?Wo(Y?l$ge?uXo;%ru`Vo>?<<(8I_>;8Eq#KMS9gFl*neeosSB
zfoHYnBQIkwkyowPu(zdms`p{<7e4kra-ZWq<2*OsGTvEV%s0Td$hXT+!*8Bnh2KMe
zBmZRodjHV?r+_5^X9J0WL4jKW`}lf%A-|44I@@LTvf1rHjG(ze6+w@Jt%Bvjts!X0
z?2xS?_ve_-k<Mujg;0Lz*3buG=3$G&ehepthlN*$KaOySSQ^nWmo<0M+(UEUMEXRQ
zMBbZcF;6+KElM>iKB_KiJlZ$9G`c^=E@oNG)mWWaNo-3TIW8)$Hg0Ub-~8?KhvJ>$
z3*&nim@mj(aCxE5!t{lw7O5^0EIO7zOo&c6l<+|iDySBWCGrz@C5{St!X3hAA}`T4
z(TLbXTq+(;@<=L8dXnssyft|w#WSTW<++3>sgS%(4NTpeI-VAqb|7ssJvzNHgOZVu
zaYCvgO_R1~>SyL=cFU|~g|hy|Zi}}s9+d~lYqOB71z9Z$wnC=pR9Yz4DhIM>Wmjgu
z&56o6maCpC&F##y%G;1PobR9i?GnNg;gYtchD%p19a!eQtZF&3JaKv33gZ<8D~47E
ztUS1iwkmDaPpj=$m#%)jCVEY4fnLGNg2A-`YwHVD3gv};>)hAvT~AmqS>Lr``i7kw
zJ{5_It`yrBmlc25DBO7E8;5VoznR>Ww5hAaxn$2~(q`%A-YuS64wkBy=9dm`4cXeX
z4c}I@?e+FW+b@^RDBHV(wnMq2zdX3SWv9u`%{xC-q*U}&`cyXV(%rRT*Z6MH?i+i&
z_B8C(+grT%{XWUQ+f@NoP1R=AW&26{v-dx)iK^-Nmiuj8txj!m?Z*Ss1N{dh4z}01
z)YTo*JycSU)+_5r4#yw9{+;i4Ee$peRgIj+;v;ZGdF1K$3E%e~4LaI(jC-u%2h$&R
z9cLXcYC@Xwnns&bn)_Q~Te?roKGD|d-g^8;+aC{{G(1^(O7m37Y1-+6)01cN&y1aw
zoqc{T`P^XJqPBbIW6s}d4{z_f5Om?vMgNQEJG?v2T=KYd^0M3I6IZxbny)%vZR&LD
zJpPl@Psh8QyPB@KTx+@RdcC!KX7}kEo;S|j^u2lU7XQ}Oo;f|;z4Ll+_r>@1-xl3|
zawq-H%e&ckC+@AhPrP6BK<z=<L*0kfKU@CX*zeqbYQT4(^U>T#_XdT7&;F71j}Joy
zkC~6lh7E@6o;W@^IpRNZ{ptLtL(gQ-CY~4mqW;US7Zxvm_|@yz&e53Bp_lTPlfP|z
zrTyx_>lv@x#=^!PzR7qqF<$gm`|ZJZ+;<)Cqu&ot<a{81DF0~rvGr5Xr~8u`lav1h
z1DNytV>2z=0000WV@Og>004R=004l4008;_004mL004C`008P>0026e000+nl3&F}
z00055Nkl<Zc-oZIJ7`rw5C-7y-e?jCzEGQBL{uykkpvqb=_9dFLA0>25G-u&79wb2
zC5nZEHi|ZarG<||5PX17L`>|o(LzNnZl(Aj7_ZF+HYX<#7Y=97&OiT|`DbPuoleJW
zE2T7uoB4BpL_D7j+pIV)PAT;jM{BV%KdTGe(v;Hj(zh`cQA%kIu4591(TCI6ma)%p
z0$sR>3G9uCH!!at-HpM#e~KP73j0<(M5j34gHzSiF5^kw_f|-zWs%>HaAAf<5%DdD
zKi4%L5#Q@HT7ehnFTi(k27hrBI}2Mo%kefM+KpDLHG<<9z^VfH4x1w4NB&Va#<9K<
z*=Jm7Vl##-BrrBbl2f0+tC|%1vAvlqbPpdZfT5Jqf}(eNFjT?3#CcpQH5$MemKDJJ
zIGanJu%n{U#)$YjP3%l|E<4O+-HC|N8RbtY^<v$Blz&S~X}E6I4q_C4@E#xVyRc8<
zOK!wAmf%nw(Jef{HH=^%Ze)GnH4b1Gj^K8lJ#`u_$`Sp_qp$&wu`mzv)oky={D}Bj
pOH^|ob>n32v11YOX*TS?0RT*3iTo|SxG(?!002ovPDHLkV1gdo@H_wj


From 798f3e559794a1a05f6c9a8153cc8a589f474f6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Mon, 6 Sep 2010 11:39:59 +0200
Subject: [PATCH 197/222] Bug 533232 - closing tab to the right of its parent
 should select the parent, not the next tab on the right. r=mano a=dietrich

---
 browser/base/content/tabbrowser.xml           | 10 +++++-
 browser/base/content/test/Makefile.in         |  1 +
 .../base/content/test/browser_bug533232.js    | 36 +++++++++++++++++++
 3 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 browser/base/content/test/browser_bug533232.js

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 0f2c3ceae49c..1975aaac63cb 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -758,7 +758,11 @@
             if (!this._previewMode && oldTab != this.selectedTab)
               oldTab.owner = null;
 
-            this._lastRelatedTab = null;
+            if (this._lastRelatedTab) {
+              if (this._lastRelatedTab != this.selectedTab)
+                this._lastRelatedTab.owner = null;
+              this._lastRelatedTab = null;
+            }
 
             var oldBrowser = this.mCurrentBrowser;
             if (oldBrowser) {
@@ -1252,6 +1256,10 @@
                 Services.prefs.getBoolPref("browser.tabs.insertRelatedAfterCurrent")) {
               let newTabPos = (this._lastRelatedTab ||
                                this.selectedTab)._tPos + 1;
+              if (this._lastRelatedTab)
+                this._lastRelatedTab.owner = null;
+              else
+                t.owner = this.selectedTab;
               this.moveTabTo(t, newTabPos);
               this._lastRelatedTab = t;
             }
diff --git a/browser/base/content/test/Makefile.in b/browser/base/content/test/Makefile.in
index 26201f537450..b0ededabbd61 100644
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -132,6 +132,7 @@ _BROWSER_FILES = \
                  browser_bug519216.js \
                  browser_bug520538.js \
                  browser_bug521216.js \
+                 browser_bug533232.js \
                  browser_bug537474.js \
                  browser_bug550565.js \
                  browser_bug553455.js \
diff --git a/browser/base/content/test/browser_bug533232.js b/browser/base/content/test/browser_bug533232.js
new file mode 100644
index 000000000000..fdee75ba266e
--- /dev/null
+++ b/browser/base/content/test/browser_bug533232.js
@@ -0,0 +1,36 @@
+function test() {
+  var tab1 = gBrowser.selectedTab;
+  var tab2 = gBrowser.addTab();
+  var childTab1;
+  var childTab2;
+
+  childTab1 = gBrowser.addTab("about:blank", { relatedToCurrent: true });
+  gBrowser.selectedTab = childTab1;
+  gBrowser.removeCurrentTab();
+  is(idx(gBrowser.selectedTab), idx(tab1),
+     "closing a tab next to its parent selects the parent");
+
+  childTab1 = gBrowser.addTab("about:blank", { relatedToCurrent: true });
+  gBrowser.selectedTab = tab2;
+  gBrowser.selectedTab = childTab1;
+  gBrowser.removeCurrentTab();
+  is(idx(gBrowser.selectedTab), idx(tab2),
+     "closing a tab next to its parent doesn't select the parent if another tab had been selected ad interim");
+
+  gBrowser.selectedTab = tab1;
+  childTab1 = gBrowser.addTab("about:blank", { relatedToCurrent: true });
+  childTab2 = gBrowser.addTab("about:blank", { relatedToCurrent: true });
+  gBrowser.selectedTab = childTab1;
+  gBrowser.removeCurrentTab();
+  is(idx(gBrowser.selectedTab), idx(childTab2),
+     "closing a tab next to its parent selects the next tab with the same parent");
+  gBrowser.removeCurrentTab();
+  is(idx(gBrowser.selectedTab), idx(tab2),
+     "closing the last tab in a set of child tabs doesn't go back to the parent");
+
+  gBrowser.removeTab(tab2);
+}
+
+function idx(tab) {
+  return Array.indexOf(gBrowser.tabs, tab);
+}

From ccf7ad92f03adb32c5eb84cb5ee0571c8431f31f Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Mon, 6 Sep 2010 09:14:48 +0200
Subject: [PATCH 198/222] Bug 589743 - Use the slow path for ycbcr on
 unsupported architectures instead of failing to building. r+a=roc

--HG--
extra : rebase_source : 94d945125b193a29551ebdb5c8f52b98b6787e3e
---
 gfx/ycbcr/chromium_types.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gfx/ycbcr/chromium_types.h b/gfx/ycbcr/chromium_types.h
index 5218a1b164c8..333614520d3d 100644
--- a/gfx/ycbcr/chromium_types.h
+++ b/gfx/ycbcr/chromium_types.h
@@ -73,7 +73,7 @@ typedef PRInt16 int16;
 #define ARCH_CPU_SPARC 1
 #define ARCH_CPU_64_BITS 1
 #else
-#error Please add support for your architecture in chromium_types.h
+#warning Please add support for your architecture in chromium_types.h
 #endif
 
 #endif // GFX_CHROMIUMTYPES_H

From e883ee67902a5179df50e26c8c4e8bc0811bd80e Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Mon, 6 Sep 2010 09:17:26 +0200
Subject: [PATCH 199/222] Bug 589878 - Use resource:/// urls instead of
 resource://gre/ for tabview. r=ian,r+a=dietrich

--HG--
extra : rebase_source : 35d0f9842314646f6693046059296085b5575442
---
 browser/base/content/tabview/tabview.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/browser/base/content/tabview/tabview.js b/browser/base/content/tabview/tabview.js
index 13895ccd08a9..eef2feb2f63f 100644
--- a/browser/base/content/tabview/tabview.js
+++ b/browser/base/content/tabview/tabview.js
@@ -2,9 +2,9 @@ const Cc = Components.classes;
 const Ci = Components.interfaces;
 const Cu = Components.utils;
 
-Cu.import("resource://gre/modules/tabview/AllTabs.jsm");
-Cu.import("resource://gre/modules/tabview/groups.jsm");
-Cu.import("resource://gre/modules/tabview/utils.jsm");
+Cu.import("resource:///modules/tabview/AllTabs.jsm");
+Cu.import("resource:///modules/tabview/groups.jsm");
+Cu.import("resource:///modules/tabview/utils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 

From cb7cc8a6a54cd24967c41f9e82a010d7ff9ecd5a Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Mon, 6 Sep 2010 15:36:32 +0300
Subject: [PATCH 200/222] A test for Bug 534178, a=testcase for a blocker

---
 docshell/test/navigation/Makefile.in          |  1 +
 docshell/test/navigation/file_bug534178.html  | 32 +++++++++++++++++++
 .../test/navigation/test_sessionhistory.html  |  3 +-
 3 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 docshell/test/navigation/file_bug534178.html

diff --git a/docshell/test/navigation/Makefile.in b/docshell/test/navigation/Makefile.in
index d7b844f34e04..3b4121b4a73b 100644
--- a/docshell/test/navigation/Makefile.in
+++ b/docshell/test/navigation/Makefile.in
@@ -78,6 +78,7 @@ _TEST_FILES = \
 		frame2.html \
 		frame3.html \
 		goback.html \
+		file_bug534178.html \
 		$(NULL)
 
 ifneq (mobile,$(MOZ_BUILD_APP))
diff --git a/docshell/test/navigation/file_bug534178.html b/docshell/test/navigation/file_bug534178.html
new file mode 100644
index 000000000000..0bbf62174410
--- /dev/null
+++ b/docshell/test/navigation/file_bug534178.html
@@ -0,0 +1,32 @@
+<html>
+  <head>
+    <script>
+    
+      function testDone() {
+        document.body.removeChild(document.body.firstChild);
+        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+        var isOK = false;
+        try {
+          isOK = history.previous != location;
+        } catch(ex) {
+          // history.previous should throw if this is the first page in shistory.
+          isOK = true;
+        }
+        document.body.textContent = isOK ? "PASSED" : "FAILED";
+        opener.ok(isOK, "Duplicate session history transactions should have been removed!");
+        opener.nextTest();
+        window.close();
+      }
+      function ifrload() {
+        setTimeout(testDone, 0);
+      }
+      function test() {
+        var ifr = document.getElementsByTagName("iframe")[0];
+        ifr.onload = ifrload;
+        ifr.src = "data:text/html,doc2";
+      }
+    </script>
+  </head>
+  <body onload="setTimeout(test, 0)"><iframe src="data:text/html,doc1"></iframe>
+  </body>
+</html>
diff --git a/docshell/test/navigation/test_sessionhistory.html b/docshell/test/navigation/test_sessionhistory.html
index 3108a650e2a0..863265fb426e 100644
--- a/docshell/test/navigation/test_sessionhistory.html
+++ b/docshell/test/navigation/test_sessionhistory.html
@@ -26,7 +26,8 @@ var testFiles =
     "file_bug462076_3.html",         // Dynamic frames after onload
     "file_bug508537_1.html",         // Dynamic frames and forward-back
     "file_document_write_1.html",    // Session history + document.write
-    "file_static_and_dynamic_1.html" // Static and dynamic frames and forward-back
+    "file_static_and_dynamic_1.html",// Static and dynamic frames and forward-back
+    "file_bug534178.html"            // Session history transaction clean-up.
   ];
 var testCount = 0; // Used by the test files.
 

From aa1d36ba179d6afa942bd6033cf8d8d36e75b647 Mon Sep 17 00:00:00 2001
From: Simon Montagu <smontagu@smontagu.org>
Date: Mon, 6 Sep 2010 17:09:19 +0300
Subject: [PATCH 201/222] Make Windows Common Dialogs children of a temporary
 window, which is styled as right-to-left when the parent window is
 right-to-left. Bug 588735, r=jmathies, blocking.betaN+=bsmedberg

---
 .../printingui/src/win/nsPrintDialogUtil.cpp       |  3 +++
 .../printingui/src/win/nsPrintingPromptService.cpp |  2 +-
 widget/public/nsIWidget.h                          |  1 +
 widget/src/windows/nsFilePicker.cpp                |  8 +++++---
 widget/src/windows/nsWindow.cpp                    | 14 ++++++++++++++
 5 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/embedding/components/printingui/src/win/nsPrintDialogUtil.cpp b/embedding/components/printingui/src/win/nsPrintDialogUtil.cpp
index ffa4432704ac..66ed617f1ca3 100644
--- a/embedding/components/printingui/src/win/nsPrintDialogUtil.cpp
+++ b/embedding/components/printingui/src/win/nsPrintDialogUtil.cpp
@@ -1484,6 +1484,9 @@ nsresult NativeShowPrintDialog(HWND                aHWnd,
 #else
   rv = ShowNativePrintDialog(aHWnd, aPrintSettings);
 #endif
+  if (aHWnd) {
+    ::DestroyWindow(aHWnd);
+  }
 
   return rv;
 }
diff --git a/embedding/components/printingui/src/win/nsPrintingPromptService.cpp b/embedding/components/printingui/src/win/nsPrintingPromptService.cpp
index d6c087054197..4f45eda7131d 100644
--- a/embedding/components/printingui/src/win/nsPrintingPromptService.cpp
+++ b/embedding/components/printingui/src/win/nsPrintingPromptService.cpp
@@ -172,7 +172,7 @@ nsPrintingPromptService::GetHWNDForDOMWindow(nsIDOMWindow *aWindow)
     baseWin->GetMainWidget(getter_AddRefs(widget));
     if (!widget) return nsnull;
 
-    return (HWND)widget->GetNativeData(NS_NATIVE_WINDOW);
+    return (HWND)widget->GetNativeData(NS_NATIVE_TMP_WINDOW);
 
 }
 
diff --git a/widget/public/nsIWidget.h b/widget/public/nsIWidget.h
index 4c85d9e6c7b1..e6e6a1387542 100644
--- a/widget/public/nsIWidget.h
+++ b/widget/public/nsIWidget.h
@@ -92,6 +92,7 @@ typedef nsEventStatus (* EVENT_CALLBACK)(nsGUIEvent *event);
  */
 #define NS_NATIVE_WINDOW      0
 #define NS_NATIVE_GRAPHIC     1
+#define NS_NATIVE_TMP_WINDOW  2
 #define NS_NATIVE_WIDGET      3
 #define NS_NATIVE_DISPLAY     4
 #define NS_NATIVE_REGION      5
diff --git a/widget/src/windows/nsFilePicker.cpp b/widget/src/windows/nsFilePicker.cpp
index 1ece60582694..27d61e36004f 100644
--- a/widget/src/windows/nsFilePicker.cpp
+++ b/widget/src/windows/nsFilePicker.cpp
@@ -152,7 +152,7 @@ NS_IMETHODIMP nsFilePicker::ShowW(PRInt16 *aReturnVal)
 
     BROWSEINFOW browserInfo;
     browserInfo.hwndOwner      = (HWND)
-      (mParentWidget.get() ? mParentWidget->GetNativeData(NS_NATIVE_WINDOW) : 0); 
+      (mParentWidget.get() ? mParentWidget->GetNativeData(NS_NATIVE_TMP_WINDOW) : 0); 
     browserInfo.pidlRoot       = nsnull;
     browserInfo.pszDisplayName = (LPWSTR)dirBuffer;
     browserInfo.lpszTitle      = mTitle.get();
@@ -202,7 +202,7 @@ NS_IMETHODIMP nsFilePicker::ShowW(PRInt16 *aReturnVal)
     // If we're running fullscreen the dialog inherits that, which is bad
     ofn.hwndOwner    = (HWND) 0;
 #else
-    ofn.hwndOwner    = (HWND) (mParentWidget.get() ? mParentWidget->GetNativeData(NS_NATIVE_WINDOW) : 0); 
+    ofn.hwndOwner    = (HWND) (mParentWidget.get() ? mParentWidget->GetNativeData(NS_NATIVE_TMP_WINDOW) : 0); 
 #endif
     ofn.lpstrFile    = fileBuffer;
     ofn.nMaxFile     = FILE_BUFFER_SIZE;
@@ -352,7 +352,9 @@ NS_IMETHODIMP nsFilePicker::ShowW(PRInt16 *aReturnVal)
         mUnicodeFile.Assign(fileBuffer);
       }
     }
-
+    if (ofn.hwndOwner) {
+      ::DestroyWindow(ofn.hwndOwner);
+    }
   }
 
   if (result) {
diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index 3dcf07fe72e4..e5526011e529 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -2785,6 +2785,20 @@ NS_IMETHODIMP nsWindow::Update()
 void* nsWindow::GetNativeData(PRUint32 aDataType)
 {
   switch (aDataType) {
+    case NS_NATIVE_TMP_WINDOW:
+      return (void*)::CreateWindowExW(WS_EX_NOACTIVATE |
+                                       mIsRTL ? WS_EX_LAYOUTRTL : 0,
+                                      WindowClass(),
+                                      L"",
+                                      WS_CHILD,
+                                      CW_USEDEFAULT,
+                                      CW_USEDEFAULT,
+                                      CW_USEDEFAULT,
+                                      CW_USEDEFAULT,
+                                      mWnd,
+                                      NULL,
+                                      nsToolkit::mDllInstance,
+                                      NULL);
     case NS_NATIVE_PLUGIN_PORT:
     case NS_NATIVE_WIDGET:
     case NS_NATIVE_WINDOW:

From 242bb0f08c5a3940a50e798fba91ac369fa02224 Mon Sep 17 00:00:00 2001
From: Marco Bonardo <mbonardo@mozilla.com>
Date: Mon, 6 Sep 2010 16:27:06 +0200
Subject: [PATCH 202/222] Bug 591104 - Mirrored images in about:robots are
 useless. r=mstange rs=dolske a=gavin

---
 browser/base/content/aboutRobots-icon-rtl.png | Bin 7884 -> 0 bytes
 .../base/content/aboutRobots-widget-right.png | Bin 2228 -> 0 bytes
 browser/base/content/aboutRobots.xhtml        |  24 ++++++------------
 browser/base/jar.mn                           |   2 --
 4 files changed, 8 insertions(+), 18 deletions(-)
 delete mode 100644 browser/base/content/aboutRobots-icon-rtl.png
 delete mode 100644 browser/base/content/aboutRobots-widget-right.png

diff --git a/browser/base/content/aboutRobots-icon-rtl.png b/browser/base/content/aboutRobots-icon-rtl.png
deleted file mode 100644
index f35501684ad17e4cfd4dc8777bea49100abb7340..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 7884
zcmV;-9y8&IP)<h;3K|Lk000e1NJLTq002M$002M;1^@s6s%dfF00007bV*G`2iOJ-
z3nnFVpvHIr000JJOGiWi{{a60|De66lK=n!32;bRa{vGf6951U69E94oEQKA9$865
zK~#9!<(qksW><OMe`mSdxAi*RGd-ix%t%5TVjBcP0m%}QSR5j}P}rDqm0b=p5XY3a
zRN|sy$MKR7I|gqk*aX`mfCd>PTM{5-8MIg+A+)cv_bk1C>)r1;Cx6_p8|1iLDGQ-L
z++EdO)!pBB&w01!d7t-f!AtmY?1}p?=#A2!8)p378!x}&M!<c)&mdn)1LT$i=by9h
zXR+~T-+t}eU;a{@LBEs+_{?A3^4#9tXPkd(>2x+b(av9rGpLu+08!Ms?eyyE84o@A
z_`kdPrduE3U*gAye)->D|583*zSIV2hS8b-q74u=qJ{nY_j~^$4e;@gfApMfQ&Z=h
zeZkr1zUy7@ie8E{h!^_-Wq9@F&sL|*h1C=H0P?Rs`)3y^<$VMtE;f}l#+aFB4jsYw
zJtkU>&tCU|U;6Ry$HgCHzxT4Bv+u=(K~V%({9Gx@-~CGU#HWFKrl+F?CB1uFtyVKD
za`G(2Si}6bS=KhX_<s0ffAS~4_l3E+xs$%H)5)kkQVkp1RXcd&wb!OV_5b^D_t8(i
zIe+-*TmSgf6TkfnUp}z$-M?Gp4beig`QRhv`hR`VBB12LH<q29x81g9rR`s^?~XTq
z<hSnZ4+qzdlH`&kE5zFR2L0iXB+bb4g1oG#suF}iN=X<5=|rcUw4yL>H5+S>KK9s&
zQzuS-_2+)}y3g;q;I*g!$;;n*=Vk80pZm(A7fl2Y+;R6;|Lv*!ul{bwxagW2o-zG*
z9xm3Wzo!Ox;)xr5ZFcQzPETIk`r4C!DqjCGKQ%d}_BnBKi9sAQ9FADu=n^LhNt#kt
z25T)+O0-r)VTi9ioPeq_RMz5YMd14czQ>t67mm%(Prv^aula%7|Iy3ecVEQ&|LoZl
zd)vDndh#jUk#&wW%qQ>ZfBSt0z?R`v|9L3N4?k3O|Mykpqd)V44e;QD*LxGe%XfqP
zg~$)CQoi09dVbSug~Z(<i%To4tZtB%1yxm%WjRTj5XT8|no^Y&##s;$XrCbTX@n6$
z5a666&2oluLX~G&ArUwxTFv4|-}A$lp1E-Tx1M+TkKNF5AHU<VxXgFo)5#b<@-zdM
zX$I$T+{=IISF-7DuDw6IuUun;^kqMqKlR)TGQiO%AAHTpm9<|_(&S&an+@i-P19;N
z(OP3F!;=ROv)&y54oB_LJg*Hf7z`PVV)7!#Iq*D<6p|qDX*ZiRn+<%=r>ZK3aZH@$
zBuPf#Yg8CA-|2j-^N~OJUvt~`{+E|se#PR#Z~e-}cJ|s^OkTX>fgO_5$4|3XK0{m0
z66iU4((qcE)><cz*<|sZ*+aWuP%rS{m%g;)se{LE>J58)1P*5{Q52$-rqfic^?Iyz
z`$!=`NQ84pB@qJF);CBHWUDJkYlsmHl8pK7b4V%4@|?i;@wA5@_(axHloe7qgpjCH
zr^x^C<NGgo!`rW)Xw0#C(>?PC!%H6!ak76of{oK72Gt@$C_*($i6e57Z;Mz)PO$Eq
zkC45<W@s^9eMg*RXLfsig1~3{+#J5=A%M~tk|YD?5VEEkLQ15ytZ#JLHPPan1Aolk
zbd6Fs=r*T#^n%y(fD`okeLT;jC`)|b$MZCy?{lI*plXDu2fxkkuie9CKlTBNr%!Y0
z8(*Q!5|XI(+Nr?fU^ZZwonq)Vm<-Nmpul3smlY@kj|qFj3u=aLxZz`+M$oxFPP6%=
z#}?_d+bqn_(P=jc1D_<#SzcQod#$eON-0h)Eiv6+<H{TVI~V-$J81pbPtiVpKik$$
zaNd!pX`Fo?hY2vo5C#FB=b?4&BNc^k*Voy0`yIUcvTLaxI7auOrzlKGDFkIza;k{w
zn*pol7=gDF>rIflF1dnIX)KPOXYc!s-lKo?f|%f2vqvs|{WorY`J0!X<jPl_&+_sz
zT1%u5RK}8|DS1&KL`}7%6m>4It?`P7?_~SFNqE~k;oS3)KY9(~RnvG)$E)wYnRi`v
zIg2MwQj`VO7_4=aRYmXa`-pD2jdRZ0kNoB-){h)x-GgU5$J4%JMJr+|R;r^2-9`lS
z3_Tl<@{_+WM$b{W7%L?Q!}2#?upTgzo&F_z@LRCBj+{N4^`HEY96fe|smTdkQBaf>
zZmjKWMnIelARaI?I0~<xg2BU(`XG)WFW!q?eTwNvS12}C*td5NX`0b$HnFy%x4eS*
z;@{BlLZ(k?M#EM5o?vJTCMz&lRvVU<bePH#`FqHzIO><b_|Y=I{*RP;((ga}%V}$0
z^JAwEedz@mz}<D1W^evhdC4*CpZqEd4?oR(Z;4Z_S&E`WN=ce!7;9>xEkqp&4zl40
zPgz7;!-=m#&;cDnqkv8b0jwW9NL~pPP*oL1NCscKo9Q@aM$ePSLn<XXDN1(OI)^vh
zY1-Kg{nivyTtFcNBV~?#^z>t&0QjIWp8!6=@X+_58QOj9EmS>79!Kuq4f7#0r;ea}
zA7c!8mXl-|##kf*De5Q)0-v}!K`#@CURsk{lYvQLm?K6xD9NqIS2=!s5$7D0F=R!K
zeDn!~gpd#;9GMXGgux()=^;c2BBBx&BP2#xo@!R_gK_oyo=Rc|Kl=`*E(YmA<U#0h
zJkBVx9OE2mo{{CnKj^mvVGuAeJ<Z+w-o)-lZo!K*EKEUVuurcbPmj30v4_>%&~Ofm
zqpB*>!3e#+fk2Q7K@-R%6jCx2eVonk<qlR<%{D4wS@YcOL)W|e#nA){_X@gCLYBda
z0c8wd8o*^*VJbtC<QQXd&f$a@Qy_?ffISQIEcq96izm6}Z*QhOa{@|3x?%WobQYiA
zcQLNtqd7l^vkqenF3S;8B7|f>MoS1vpp=ev71ELu^n_(S6wD$h1=-PN`9BUEJCT0R
z4d8wa$x|oyx<P^4NRWqDI52q$WqXo|P8(AhimJpphY$js!#S|lBD7**VF!6p(0{{Q
zxOM*(bPhdEp2i%STwp!R=|A}l+h%77eII8G#yCt>;YSgaC8<luBnSix1RM?>(p3m4
znN|T|38}IV^pA1Ri=ql2edUKbvquj#)guqGmJ05fcpbOSoX;Eg?Is8UimIflOl>UZ
zKnR?3HIx~HuRYG(y_^1E$a<DC*n1&XK(@5Zsij5s?%j>Ebtqd0;E?SWajU`PU_j-D
z^zDd->d>)@b3}tgS~LQ`0M9yi$8`QPU)XrMcu`d0tNzW8pK)aN!Vf%i-j&{+{yg`W
z0srb%7qV;TLhUu@o|peZ2!s$d6e@|JP6;Um+S54e81@ImNlMggV6Da07C<UV7zQ+>
zh^5I%+7CX2FBQ4%V`YSv4Lm0ZoxnHFX~ghLGsPQjI`Y&LFWOw7@@AV=W$lrZ$LJfu
z{#RYZ{M<a&I*fBPqmVo=7^N9fDx7oldwm9@5k*lDCkg%jfH;mB^arGQPM#N3#vp}2
zYmFE9w3<yOwMHP&N-?)@5071W8Ry>jO<HA1RvscT4SYF6Sb)9sl}pRB!Bq!tKJes=
zIvBCadD02dXhgKKCR%CoJY%ERV{N_5`r10(!GM0R&&u*D&n@)`U5U$M+GfPkTEf7=
zq=LQysT6^h%r^w55`oeRr4&1NEpXM<SAqa7B~#4?8~b0wLyZQlLr0kG^@*yIvgHWg
zdNn`v)9+1Y1AY2G-F)E1oeU{MY$d*wl8x>L-+K6AR#(?KeB?MX>9aOSdH=qO-UuFB
zf_r}`;1~bC;=WbG4Q~th^mCd|K2!0VZ}50v#qz0V4X>J)eB!MkKX7BpYFvPGY^-(b
z!ifMOXhspc7j}>)DW^Q2Rp-z_$khBcE;{Ed7G|fjjYP*U`e<yq8z0>^)AEcleCf+~
za`@mO%A(}j-Gbk_I^crORXorWoE$n53zy%N69Zwh$(!%ggc`yy=Y#iTC@Gnmn&7x<
zbM@af*mj1Xou(|Wu8|iRQpg%YodW@_M#Sv&BzcxGjAM2$Y{vkdC`3vXUwGk##fxr$
z>#n;lx#_@PR!S-DtfeeU0Pa`|`S!zmdGnj+XirY@x}DoO>#RM@&&^?sAx;vi%Ak})
zYY)%UBuUEB>M9%EE^(3~fL5bHmL`1mvwww<0%I(BSt4>tSynjbP+B2`V6EGu)9FxE
z6-vnd_iZ?Od~xyKsp;v<m6H76+ppmR@B3-m6K&QvdI%};JP#!WI7qS#X)GP>QJIRW
ztVpwr)wMO&yM5L-))~bKMOk8vWtla6-{<_7pU-eOB8no!P%s#dNYWHz3`J2Q0Ou@e
zn$l`SJpRN}**`XO0Sr)lPYv+MqmO>&E!SLg`P}>*ufODVYzzh@MNNL3Eo(K$^8iPZ
zq%}eqLs1lDMb2mx)9VlD_4{K<te`R_ww47k)-tz!o^H2?=V=B?Q&~fjW@sVk_4)`U
zQL;vj?c1ihH{5vO(__x<-nM7ohh8_i^Xf*}==h<pQfIOq+qRuLcl*u<<m|*vm;Bm)
zIPro8BbQye|C;MQ`2O3zaLcXg%rnnq$NU_#Gt&qGrn0rdt0cx4k|d=lYNO<3S?hsG
z$|#BH4~E2XOi`2=Q+JL^s_``-j$<Y#CTTV!l&T@sIZKx1SrkRt%+%y$6b4Rf_4wy+
zx#fReyz0(;r+>zWJEf3)Q&1=<eL)#$oUaKQA+xO(`}SY>%&s?H^s7(K&E0&(6<1XM
z98om*i$A|UyX))s5`+=$PK(J-r=A6rCB_<@b(E$ejuZNW5lNDuq`*-NBXJyqv-rM8
zGiuOmgeWg0NeY^gWO}l}?92>7(7-t{HmYKN+YEpC`7hvUpKh;@m4b=F@!oIt+++!b
z5F!^)O2~vGQ;t|U5)Fm4cu00{pXbtRuV&%(7k;|^_P4$FpCgFm_x=4hZr?UH_qNkZ
zOZ58#dd)6cD?F_cV?7@PLEy1(*A6=E4%V5vh)G4W8R2;zQcA3KSR_U734ZvZ`>0%l
zIE6u~S?Yxx%HKk()nuyE;qj-RWiU*bp7eOxzCElQUgRh4Ut&igMK0^EQzGyTXi@8b
z4u=yKgCJFw!%Itex8B7iQvO8x^}A>PNduhvZ+~>Y%&LWQY5jttpH@#X`sRCY`^=#W
z&+42#+gRh`Gb)C$Wgz#`nV6!iN^l^gsB=ry#n4#0sf{3|LI}pR7?hGolcRmZ7aw~Q
zg=^vD1PH~{gwK3uigqg^&vWj5;9H!rupMhH&piDcKlJ2)9i_wx@SH<AhZX`O1RC&+
zKs$lwYDjg`QVPeBqbKk__1CCD`j&qz1;qL%KeH=&?9h!S&dxWzc*3j?$u|aUG(DEy
z{c5DWosrqW`p{=$Y8t<_2V~9lYn7#Lg6hxus-CBb!iXpe2?HM~1kOQGL3Z+U?3p-5
zR+>6Bv?D1ri{8((bH2^&)C9l%2iJ4-#7TUmnVgv-_|`$*_f&>Zbvv`EeAv2#P~j+r
zq>z$S3i_U-uPp=5Vg$_Qk_$!W|3!h--~ZDOb#J}@_iR6*IJHi)++~!dth79;pWnyM
z_Ft2i5ewl-s`)8a<mCi`9<w&L#onY4D5dayO(TqGG(w^<L`#L%3MmCn2=X+c+x|&X
zJd{>wDe$$!$Ivn!XPvo|Km61U96Gv)(vq|&kZHnCpQunmV#i&l{I065!zNy*O_Ajc
zM+2~q$_Pp!$dn{jmcDOU8V<f=fE#bTQN8Ku<&UlY`B$zhPxTR%qc`etG#^r3d=@)@
z{XJCKh~?paq+DVxmCWzj&%Cd;D)^@Sy;%=DtqFV&PiwSNAOzMqoOM{|P(qOQpXJ<b
zgSv2*7F+gs_^EYf&iWB{@0{h1yYJ<;uYL{R_s01wXfF+TnGG3=xHkA$fps`M7128H
zO!WLD);aXECozjBi45dI5LibhAy%*)eisjT-QPU)`-`9X+YdM_L3@JK6D$Uf^mXU)
zs$c&Zl9ewqRXxJl6CO%?9C9CI``mQhvrDyw%StM=l1M4Hh9b^dvZAD{D$1&=m7cL^
zGR!;N`$UCv1-J@n0xJJ(=4WR(y}ZK5|KfA_zQ#FlPEcxi&8dVkFYsi5)E=T19&yGJ
zow>mD5567~XC%)Y$Di%s9a}<4gGS(4fpWDZx#nB+T|e+^dT!&1PoDfgx4%~kNz|Mo
z#d2gcAinf$Ui0CfLI*x-_fH_)yBUcRYXxVv+I6ol>v=$3_-X~XG!|QySmQ9xVk$#r
zDvWbmtB_(`eWK<hjn?#*c4(brqSZi2!6!a_0E9y-wG}m1IJTc2qN8bo`6<*)vwp3$
zxV&QSJy$aOfggdq;P|gzPyZXw;#`Sz5@kW#x<-K|)}SX3-uLeA$<yzVN{O&F#i+<R
zS`8Uow2MoA>u15bx-%1Fs)mPDkY;%;djZyMc5ZbA+Wh&Lvtn$m5kfsA5#sqqtG#QH
zLePu?7Pimu#oO=X;NhcnQzRTtI-D_x$|8)T3?#}r>@Wub&R8%OXDy@|<ORj4b<&Ns
z8hu19folY6ET`uJbaHy>6G}-Hbf&SLkfo&_;_a{H%HO;WS=q6wQ|Gu+5-IEACZ*hh
zGAU{}6GGy78a2ju99yC&0;H&Ggj5P4zEif8=hZ5+6rdZ7y35>s{{twkxAMEP^>T==
z3`0-RP5LyF0dlPEJL?d@;_u!_c6f=hKVtRE_m7`HMkfc-j*Z|%4V%uoD4LtczwiuJ
z2Ys^LdpPTT@1V+ZoQ2AmEp}&&p)`id7=)uPGD;zp92-GXnTk9wFve0=bq6QL8liJ;
z%oc5}`x#3$<_P1h5H7#$a+Xh>V0nGLW{+<3@RG_^2xD1m2(}Le)*5{4(3{$xbC~W1
zCq8*I&N`eN%W{Bp4uwEFhqeN3K}&)5ypYEJv#{IRoPO{m@p*eVohBTArjPGw5CUT@
zWm!@bB}G|MZC*^&2bW{n+F6USw%+Wh>c6YTh0i+oycWcbwZBd6u-Ry^-tCUx!(b{i
zeqY8$tPN2CD<Q1sma0@Vgd=he-&*vh5{&~To;UrGfVK`_N_=PW9asa}pPE3QG0W20
zI*S`?OwPTM#p5UGOtgV|-d|QF8~qV+5|hL+Nj#)1Dy-6IKR|mvQmZ=TO-Y{Rb&HF{
z3V{<69r#p5fu}u8S<q6BC<u^JQkEstlan~>SUkOimSU@p$T5;wTjRYEaH0ukj~w7A
zjG(FnO$m{6&r^BFv)Qrt!9x&O2#p|AvW^CCZW8NjmRHy4RymzOvt#=l>+2h|TP=(+
z^t(Nt(=#wJ%j#&6$+IuO4@0UXK}R9N^U1S>!Nxj`sTmNGe9)skHG@=&q`N_TW`?Ds
zhtLz#IBQsY_7Ub}S#t!fSzTYp_dT+#pb`0~F~i%80&8np9cj(!>40>jK)Tup7Kt?y
zVJrdedF)P(nW1(LBOJaHG>pKMg1}0&Yz8E8!s_Ze1s1Q}A_xL@?p&ZO>kuBLDeGmQ
zR=b7g`}m$hR23#qNUMTO$huXHV_H))C@t}|#uOQqvs6V+G92J}0gZMW<@=mISbKg8
zMui-!K;K!K+GLXe);OdPbUGazaA;@Bd5bZ!5;!affp!vUEb1Th`C@Dc&p9e<35CQj
zB|FjzojrG&!A6g~+s88wuhZBXX4vs}2~6!+U~1beYsZfgHd+WNF{Yw1F@e&x$EqTy
zGc!w7mXuje5H-MoRvwLsDL~+bjXIYrgB5m5^V^&u)Jb2Xji)@cS6{~gN-I`2HptS9
zmC1;+Pb3u5A)O$Xj)4*=6xtZPaZ%i)$!=UIeLxyZXdTb(ZlaG2S2&y)mSn{g8r6(2
z)@@a7a7eA`9zR0XT_sNwOjY3p0qJmnDNF1aDMq~>E5{Bal}Db&b<UOrSv(?*hs3=u
zc|5{zG-@RAYc8-=NCDqdl%~Yf9${GT3Dx2#c%H}X<P<$MAPF=F+k*3Yj!Zh76G-LA
ztRNCK#L0g+26qk*m?$dlKX;0|UNeurON=OSV4<6jI75Om)tD>Qp7A`7siwxCo+cf5
z1no9RP2B5J<|(eKY8bR73WsnNWjth<rIcwx9uEn^h$_$UZ9z7agvE$pavQ#<@qK^n
zC4p25oFnjkTCEno=TVlmz7Q25MV{kp4=ohm-X@uk4J{*J%mWe&k&}4iVasL|Y^8y<
zeD%^@Ja*0$yQZhnH6N*GaT@4l2_0k5+Cxc+a}fAGyV3z`&z;2f`>YKI<Y`iK6e$o&
zgQ)*@`MF0hWijsm>m1gehf@+yD$H;hUu(9_OcMq^VHgqy!FTbBx`7JAkcn0cr4@Nz
z)<R2J(JM=es@xJ)PP}rK^B*`xq9qoP8X_wQtw3%@fpbU%xvx0z+HDM8eFm?XTVQ5p
z8lAU8l9opzp>cGL)r~Hy-60G^w9?}ZFF~sj;hZJZidM5hk>?a;g|)WE^vwzK^S{)&
zz1bxyh39$o)@R@og&|SsqqRmNsjNk7O&Itz8Vx$F7EXW^3g@6|)X!5&k>xq9W`kZQ
z<dN-~^VTX7T~q5oOPaQh0v}O}AX6TH`PykFXQw!OVuoEi7jVv@Ph7H>pxt76a*`rR
z7_M&6k{&pL=UcQ=^}rJFm4^*$?DjpcW{Km@&W%Umn~hGbP)UTS=X*j3v{q=X@jVaU
z_lZKEFbq&iBal>Oxkaa=ARvmuarkZ)$a){KC`(3hOuN<M$kF5Y(>{@bxj}{1b+w-=
zB~zv4@mbB+cLhAXJz_TSnVOhjdTNs1U{FKw?92??W@k`JG61ZpSzlfhI4qT{VaOPZ
z#cqW)V>!#(ny<SpnXAr4IfgYUYtL(?(4Iysy=90ntoMJV)CizZvQ9f|@H~y@)vd0r
z3_?o6&}XvUqSb65a17%S*IfQ4?!5b6o}BeL(osZ}qv;eA%@!+D9$o2(D$BIz;cHEn
z<*cl(v3+h1&-c+&lM_s|Tdb_DV~jy5MOjs3c}`_3eC;7bt;}v>v>0!H38`vN<F@+y
zt&zBt^{`WJhJJl%r4(AKIs&4wR)>VdIajkj=ZK2}H5OE~S4U&V*EE8V)wMO!BxU>j
z9Cpd^%)vv1L4b9ZG}M$@QG^k0qQhCc7U*?*<at4sWm_W5j_upgT4JgSeZhI>;wgnt
zih~Ca*E(HMjE5AuUUnKE%v!s}4>n_6jJvJPT$d7rkYiQILo1EvjlHfkay&f>1D_!9
zP(s$DbSy$hN>ld^a-1@u@8c^)tJOg3x+7JdW_e|eji67}s2C+FWi{>=$2A1!&{Ekm
zb}q={izo3tk8QKFY@gpYu3NI6K09YIR$z>yGtnWA>uC)_pp3y9jZ|Y#k2gN*hJ!8T
z*KI9AfRYle_149`aoDTP(DyXWD8%<_d>2CCDLvK>N-TCPtJlfYj6$RmIO|B_l;zcR
zy1gD!K)cld=NQB>x~y>2-D%+agh9aa%F59o@EenpliM4O2w&HAOOK-(1lsp}27@7a
zk#DuJMUih6Er-K%4wTwbah|Us3zVplV)OEz(s;hNb@@8<$0;GynD_|nc=(H`x5b@v
z<YP}-=O~MkF!U+QlI8UcMsZ9$N-)-t<~bAXHiwU&An<D>!8w%D_`Ziy3S-TqgF*a_
zPOJ0V&f4$DP-BG3vJ9D}Dcyd5t97l5psCx~aW7zut;NjoOSfpN6kA&V^B^wt>qTen
zea8@5qohViG1eID7)30VsSt=-a2cO5&kNSN8!WGFaOC(2jxL_$<mnYQ`UA4OtS8D+
zuxIB2K@g0gHNf|40ai(cKvoAnbKrN<Jo|S2pD6X4E2%hi_z3rX^Feg0-J;v?b8K;q
zBuNnxyvoBEUGM5hfz@^^^f&ps+!}P$p7oTjbKa{B;pwr=JywsTkXr{3)T8fODx)Sr
zUR_@{%S&Dqq*=!LMvpj&DK|NXb!a8Y%91DuSXx`(stucPDaM!eJzWCgE4SVLzIXlj
zyT4(rm2n*N=%bI*9SmtU8%QApQfVBpvbIW^6}5nA4bGY89cq&l$?*e}uAwT>wa5L?
z$M^j2x_n*rrBDbZ#%r^69jPjV9cy@%tv5omycjoP_2@f^6E=E1;-p@_%=21Vj<bCH
zpC=i!Q&Tmnc>Z|YR>O1<283ZK0eATD;)92tdG<5TI{JelC`A-SwS&v5VlWz#qzRty
zk*3M`a5X))wr)eK%8+F#Wm(n&rj+<f;VX%+1)-J%0z6quO=_IyQb@FxbvkGdrSz5|
zHdE4COOoX^_i**|vMeLbGK##YWi(^3uAU;#Oim!Bq$rCqjdx?ksz54D7>4+MK&R98
qHy!u+&)@Ri_RPeInrD26z5ZWLDe;0~r&i(s0000<MNUMnLSTaNjzl5=

diff --git a/browser/base/content/aboutRobots-widget-right.png b/browser/base/content/aboutRobots-widget-right.png
deleted file mode 100644
index 44a59d6388af7143cd1cb989eb75c68b812659e0..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 2228
zcmV;l2ut^gP)<h;3K|Lk000e1NJLTq000~S0012b1^@s6xls%;000PkNkl<ZNQt$T
zX;jl!8pf}+iZN^ngoOM<2oQuMB!DPkF&GF*NJ0WcL)fyBkU#)gL_m;|Q)LkqDySf<
zB3LFEcC6EWm^ri5nenKz)p|H~&P?ZYJDt{LYPBl7^JVPl3|gyap0Dq7pWnUjx$nIQ
zy@EIz=X$w(JTTwriYqLd%eL6&wPy1|j@3H9S*IJtze@H~l1c}Ond)(~(KOR%Fil@I
z6wZEDpr5*%o9B9%Q!sVEK=1l{f!;NxEtuH+N+6?gKHOM1Q*W`(U9uI=FB=MHAv?zj
zvh*=XP91?H;UFXl2S6kq1VzRv(B_R@-LYdh_(y{@8mGIZWWLm5UASf|IS+;AIoO%)
z1c~hQcZo^;H@C(fza6!?XC*TFDDa{?Au{GL@Dq-JRDKea83Qc{p*1fID=M1f*zAix
zv6Y-(vDg+MuV4xk%CRLu^3X6p;e?eNbu@#;J)9ZNX|E1rwO$Toy$PY=&A^UuKy3U$
zNJ;IUj)`$>d?A>%WHHZXUtF@;7r|hffs7p!*TvG2x;SAk10l`Y|Mt_F4mK88dyN`U
z1p$m|2<J4y*4Wl@CbQh_xgecx6klYUZ?%>z-Yc>$fHrsXD@Dec<Eg15+#lK`m9~4q
zA1ebgwG^;`atLPD*FATEM&tA{S>{h!OBTRro`tL(6CX)sXY@>2_o};;$-3RN+6mT9
z?Sx5{dHRSj<>=>0!cIuo)&abzW)O;w6g(3q6gplvTIRZ}#f!@Z<18pM&)yJ=Pl=x8
z)oLdtIeC-E)Y%g^6sj{1rD?;EoZ1ITDLo)b>jg!6A7t$uaLQ!eq*Z}Ad6Nw``{Hte
zVH(m^V;>8W2NPHI<-ASJ*Sq>OTIWAiS#N_lZ4?B;p^sy>9=*$p?f_0?3vi?MLqcLZ
zNM+q15_gsUPe|6ziF8}>!X2Gq8WhSi-wK2StF|J)(3O?1o4&5rOn_K^`etI%z(h=J
zPad0l$VR1A-lEbffF4v2A)$>B&TfQQehb7Ww)H#}BA1U)bcUHL2GcAkGsi(795}_{
zIMzSuQK^PJ45pa_x%uZFDKpPPa_Xsb2}ylP2svIOlXZA9wS30c&jJKr6ObsSH?V-+
zUj_tL!=~_BVDp+<p3GWfFwO2Yndd;6c@_lQ2X97iJ+b{sgGTSfbcPwHHg^(a^3mG@
z!C)1QR)s?dA-tc3>_;h|B$2J)Lo$OGvG8|PdX>^2tGrD1F9nQV@l7bJG3om-z1~ST
z7tQ}+N467$qCtq^cmMLqxyi~p?US#cn#|6fgf#h?Pm_~J)sJgLa!DM;zwGBEaxr)j
zj4K49<!{k3ZB5%neS7)w9rqHqbwYf?p)Vwo6IPAp-yO5qX4S^Rxs^1<Y1kUq0}+u2
z-+de?6pn1r>8882x#vJC8~r9W{#X`52r(GO4SrZ@2?g8rR}$F<o&+OMF#9dR_Tx(`
zwe!zX`Phm$?G%WmLm-x(e3Y*2|5hyPtwl()78Tp)YYnDpND&VLFZwVrH#t6_(W;0D
zA(U4zrO(&99;B<r9|@9&YY{@ohg{01V7tyysO1lRNmlUmHZ5-o-wSE-QIMyf{W31$
z_}8q67GQ=smbtw4TiodOl`XLcAwke}na_WVj7rNEx{YQRB&YNOJ7PZshBN?1-#y9U
zwi)wvuHWy>c7iZv@N*Wobw4d|_Yj%7>r=9S8TgQ_;72KW7#n{WR9VhDLea=zID3CL
z*}wQJPl5r6B=Z6zc%LaWtof5otY+Xvx4s`0<?u%KvYEz0iwjajJ;35L13jn)NaQl$
zCmecIpq~bXavZqPhrXi*R6oS%l|Z5H0-}%YPH;%=7ZTYpWT+=U+`{iJq%&$NiN5B~
z@I*7<eTx4?q?B@q#BxstbKkWf=3dyuc8nmTS&MAtGwdSkxurDu3E)LFLtt<<_*2V4
zl6Deu@}@v28Uj{CD`0^&fYEEdrqXKO*&NgH)2tm6x6%~jAFw0Zipdmv51v@GjPtPp
zjgZ|hMKmHp2r+}|lr%=|eMZop`$5b%l;7V}o$jnsuIOEgi*E(yraeGsRD(h_1R3fx
zz)$FgFm?+tLK-jA0_$Xg<YO7yT-S#wl930@u%-*%zJ*tC#3Jw@m~JHCxkk%6TwJx=
zTKOKlmxMtpzu-=-2aH}bijZ~PQ^TK{+7--?Z?A~pHTOnv9eoPb$y;fPUf@L^07gi|
zN&usFDKNNxOd=b+C{G`QFt%ga-76p5z4d?*)Qi#$lw{-j*E%dXx0_Ws+`W2l-`hE)
zIACGsiyqY4u+?6z$78-0A+#nVtG7y$)(H`j`+!ET03VVK!dQ)vt{Q`FNqs=_vpv9j
z8$a>)$!*iDcW0a2kW05=BiQjC(BMUcBP0s+GJ;^36W#M1*nbogV_lcHy{$7cs&R?N
zD8J)HFx-vhw?C3APeV-XTYv>rcKHX^vJgTjALp5u=e8a!I6TyQctMAcAM`Vra4s$$
z-b+{f;}`kat9}Bjo;ED3hKFIL=>d$&+*I+gOCm`x@S<BGIJ9Yj7Q9zZ39OSzyg2We
zHmrkP8{J{Q7ZLg>G?<9o4DYEm@SDnNc)y~m>;-{OOO-L$FBEkFC!z_kfC})Xlz=C>
z^zIff0Tkizum|q}?cTmHL=T49#3cAtkq!QMparfpH0fUoC=zwE6SuX$%i%WM#OS5>
zNq&~Qct87J7(Uq-O5E_*>+$Z;PVj{x1`}qtC&RDpWpMS4H?RD*rY7j6fCwQJ5z#;n
z39n1Qu!?j)f4iFCSHYuu<q;~~+!T9pxR2VriO^3A1lLyn%FpzMi<fF^V_zEfLu$g|
z_#GaEhCW|v$5|H7eqODn{oi1Z<v{55PK0pJs{aePT66?0lpC%90000<MNUMnLSTaH
CN+>7*

diff --git a/browser/base/content/aboutRobots.xhtml b/browser/base/content/aboutRobots.xhtml
index 97be60ee4e54..4e2145373a24 100644
--- a/browser/base/content/aboutRobots.xhtml
+++ b/browser/base/content/aboutRobots.xhtml
@@ -83,22 +83,14 @@
     ]]></script>
 
     <style type="text/css"><![CDATA[
-      #errorPageContainer {
-        background: url('chrome://browser/content/aboutRobots-icon.png') left 0 no-repeat -moz-Field;
-        background-origin: content-box;
+      #errorPageContainer:before {
+        content: url('chrome://browser/content/aboutRobots-icon.png');
+        position: absolute;
       }
 
-      #errorTrailerDescText {
-        float: right;
-      }
-
-      body[dir=rtl] #errorPageContainer {
-        background-image: url('chrome://browser/content/aboutRobots-icon-rtl.png');
-        background-position: right 0;
-      }
-
-      body[dir=rtl] #errorTrailerDescText {
-        float: left;
+      body[dir=rtl] #icon,
+      body[dir=rtl] #errorPageContainer:before {
+        -moz-transform: scaleX(-1);
       }
     ]]></style>
   </head>
@@ -145,8 +137,8 @@
 
       <img src="chrome://browser/content/aboutRobots-widget-left.png"
            style="position: absolute; bottom: -12px; left: -10px;"/>
-      <img src="chrome://browser/content/aboutRobots-widget-right.png"
-           style="position: absolute; bottom: -12px; right: -10px;"/>
+      <img src="chrome://browser/content/aboutRobots-widget-left.png"
+           style="position: absolute; bottom: -12px; right: -10px; -moz-transform: scaleX(-1);"/>
     </div>
 
   </body>
diff --git a/browser/base/jar.mn b/browser/base/jar.mn
index 4335d3b049db..a1fdfdc92e84 100644
--- a/browser/base/jar.mn
+++ b/browser/base/jar.mn
@@ -21,9 +21,7 @@ browser.jar:
 *       content/browser/aboutHome.js                  (content/aboutHome.js)
 *       content/browser/aboutHome.css                 (content/aboutHome.css)
         content/browser/aboutRobots-icon.png          (content/aboutRobots-icon.png)
-        content/browser/aboutRobots-icon-rtl.png      (content/aboutRobots-icon-rtl.png)
         content/browser/aboutRobots-widget-left.png   (content/aboutRobots-widget-left.png)
-        content/browser/aboutRobots-widget-right.png  (content/aboutRobots-widget-right.png)
 *       content/browser/browser.css                   (content/browser.css)
 *       content/browser/browser.js                    (content/browser.js)
 *       content/browser/browser.xul                   (content/browser.xul)

From 387c2c58f47341de4046a832adf934f0abd7e75a Mon Sep 17 00:00:00 2001
From: Marco Bonardo <mbonardo@mozilla.com>
Date: Mon, 6 Sep 2010 16:27:29 +0200
Subject: [PATCH 203/222] Bug 589876 - Switch-to-Tab does not match detached
 tabs. r=gavin a=dietrich

---
 browser/base/content/tabbrowser.xml              | 16 ++++++++++++----
 .../test/browser_tabMatchesInAwesomebar.js       | 14 ++++++++++++++
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 1975aaac63cb..10045e7c9616 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1456,7 +1456,7 @@
             filter.removeProgressListener(this.mTabListeners[aTab._tPos]);
             this.mTabListeners[aTab._tPos].destroy();
 
-            if (browser.registeredOpenURI) {
+            if (browser.registeredOpenURI && !aTabWillBeMoved) {
               this.mBrowserHistory.unregisterOpenPage(browser.registeredOpenURI);
               delete browser.registeredOpenURI;
             }
@@ -1658,10 +1658,18 @@
             filter.removeProgressListener(tabListener);
             var tabListenerBlank = tabListener.mBlank;
 
+            var otherBrowser = aOtherTab.linkedBrowser;
+
+            // Restore current registered open URI.
+            if (ourBrowser.registeredOpenURI)
+              this.mBrowserHistory.unregisterOpenPage(ourBrowser.registeredOpenURI);
+            if (otherBrowser.registeredOpenURI)
+              ourBrowser.registeredOpenURI = otherBrowser.registeredOpenURI;
+
             // Workarounds for bug 458697
             // Icon might have been set on DOMLinkAdded, don't override that.
-            if (!ourBrowser.mIconURL && aOtherTab.linkedBrowser.mIconURL)
-              this.setIcon(aOurTab, aOtherTab.linkedBrowser.mIconURL);
+            if (!ourBrowser.mIconURL && otherBrowser.mIconURL)
+              this.setIcon(aOurTab, otherBrowser.mIconURL);
             var isBusy = aOtherTab.hasAttribute("busy");
             if (isBusy) {
               aOurTab.setAttribute("busy", "true");
@@ -1671,7 +1679,7 @@
             }
 
             // Swap the docshells
-            ourBrowser.swapDocShells(aOtherTab.linkedBrowser);
+            ourBrowser.swapDocShells(otherBrowser);
 
             // Finish tearing down the tab that's going away.
             remoteBrowser._endRemoveTab(aOtherTab);
diff --git a/browser/base/content/test/browser_tabMatchesInAwesomebar.js b/browser/base/content/test/browser_tabMatchesInAwesomebar.js
index 73705ec3df68..337cefce63b3 100644
--- a/browser/base/content/test/browser_tabMatchesInAwesomebar.js
+++ b/browser/base/content/test/browser_tabMatchesInAwesomebar.js
@@ -126,6 +126,20 @@ var gTestSteps = [
     ensure_opentabs_match_db();
     nextStep();
   },
+  function() {
+    info("Running step 8 - check swapBrowsersAndCloseOther preserves registered switch-to-tab result");
+    let tabToKeep = gBrowser.addTab();
+    let tab = gBrowser.addTab();
+    tab.linkedBrowser.addEventListener("load", function () {
+      tab.linkedBrowser.removeEventListener("load", arguments.callee, true);
+      gBrowser.swapBrowsersAndCloseOther(tabToKeep, tab);
+      ensure_opentabs_match_db();
+      gBrowser.removeTab(tabToKeep);
+      ensure_opentabs_match_db();
+      nextStep();
+    }, true);
+    tab.linkedBrowser.loadURI('about:robots');
+  },
 ];
 
 

From 81990e49479fa3934b324518687711a735c15a65 Mon Sep 17 00:00:00 2001
From: Simon Montagu <smontagu@smontagu.org>
Date: Mon, 6 Sep 2010 17:32:01 +0300
Subject: [PATCH 204/222] Tests for bug 588739

---
 layout/reftests/bidi/588739-1.html   | 12 ++++++++++++
 layout/reftests/bidi/588739-2.html   | 12 ++++++++++++
 layout/reftests/bidi/588739-3.html   | 12 ++++++++++++
 layout/reftests/bidi/588739-ref.html |  9 +++++++++
 layout/reftests/bidi/reftest.list    |  3 +++
 5 files changed, 48 insertions(+)
 create mode 100644 layout/reftests/bidi/588739-1.html
 create mode 100644 layout/reftests/bidi/588739-2.html
 create mode 100644 layout/reftests/bidi/588739-3.html
 create mode 100644 layout/reftests/bidi/588739-ref.html

diff --git a/layout/reftests/bidi/588739-1.html b/layout/reftests/bidi/588739-1.html
new file mode 100644
index 000000000000..842ee5e05a53
--- /dev/null
+++ b/layout/reftests/bidi/588739-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+  <style type="text/css">
+   span.page-sep {	position:absolute; visibility:hidden; }
+  </style>
+ </head>
+ <body>
+עמוד <span>1<span class="page-sep"></span>2<span class="page-sep"></span>3</span>
+ </body>
+</html>
diff --git a/layout/reftests/bidi/588739-2.html b/layout/reftests/bidi/588739-2.html
new file mode 100644
index 000000000000..65592eb16377
--- /dev/null
+++ b/layout/reftests/bidi/588739-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+  <style type="text/css">
+   span.page-sep {	visibility:hidden; }
+  </style>
+ </head>
+ <body>
+עמוד <span>1<span class="page-sep"></span>2<span class="page-sep"></span>3</span>
+ </body>
+</html>
diff --git a/layout/reftests/bidi/588739-3.html b/layout/reftests/bidi/588739-3.html
new file mode 100644
index 000000000000..e309774d78ab
--- /dev/null
+++ b/layout/reftests/bidi/588739-3.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+  <style type="text/css">
+   span.page-sep {	position:absolute; }
+  </style>
+ </head>
+ <body>
+עמוד <span>1<span class="page-sep"></span>2<span class="page-sep"></span>3</span>
+ </body>
+</html>
diff --git a/layout/reftests/bidi/588739-ref.html b/layout/reftests/bidi/588739-ref.html
new file mode 100644
index 000000000000..7cac69a934b6
--- /dev/null
+++ b/layout/reftests/bidi/588739-ref.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+ </head>
+ <body>
+עמוד 321
+ </body>
+</html>
diff --git a/layout/reftests/bidi/reftest.list b/layout/reftests/bidi/reftest.list
index 9a0f69ec2a9e..cb7f1356ebe5 100644
--- a/layout/reftests/bidi/reftest.list
+++ b/layout/reftests/bidi/reftest.list
@@ -54,3 +54,6 @@ random-if(gtk2Widget) == 386339.html 386339-ref.html
 == 503957-1.html 503957-1-ref.html
 == 525740-1.html 525740-1-ref.html
 == 536963-1.html 536963-1-ref.html
+== 588739-1.html 588739-ref.html
+== 588739-2.html 588739-ref.html
+== 588739-3.html 588739-ref.html

From 4421d80c311106afd77f22055340f83a1b668486 Mon Sep 17 00:00:00 2001
From: Simon Montagu <smontagu@smontagu.org>
Date: Mon, 6 Sep 2010 17:33:18 +0300
Subject: [PATCH 205/222] Don't include floats in bidi resolution and
 reordering, unless they are first-letters. Bug 588739, r+a=roc

---
 layout/base/nsBidiPresUtils.cpp | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/layout/base/nsBidiPresUtils.cpp b/layout/base/nsBidiPresUtils.cpp
index 6b3d1e18cbc0..3823f017ced0 100644
--- a/layout/base/nsBidiPresUtils.cpp
+++ b/layout/base/nsBidiPresUtils.cpp
@@ -627,14 +627,14 @@ nsBidiPresUtils::InitLogicalArray(nsIFrame*       aCurrentFrame)
   for (nsIFrame* childFrame = aCurrentFrame; childFrame;
        childFrame = childFrame->GetNextSibling()) {
 
-    // If the real frame for a placeholder is an inline container, we need to
-    // drill down into it and include its contents in Bidi resolution. If it
-    // isn't an inline container, we just use the placeholder.
+    // If the real frame for a placeholder is a first letter frame, we need to
+    // drill down into it and include its contents in Bidi resolution.
+    // If not, we just use the placeholder.
     nsIFrame* frame = childFrame;
     if (nsGkAtoms::placeholderFrame == childFrame->GetType()) {
       nsIFrame* realFrame =
         nsPlaceholderFrame::GetRealFrameForPlaceholder(childFrame);
-      if (realFrame->IsFrameOfType(nsIFrame::eBidiInlineContainer)) {
+      if (realFrame->GetType() == nsGkAtoms::letterFrame) {
         frame = realFrame;
       }
     }
@@ -843,8 +843,10 @@ nsBidiPresUtils::GetFrameEmbeddingLevel(nsIFrame* aFrame)
 {
   nsIFrame* firstLeaf = aFrame;
   while (!IsBidiLeaf(firstLeaf)) {
-    firstLeaf = 
-      nsPlaceholderFrame::GetRealFrameFor(firstLeaf->GetFirstChild(nsnull));
+    nsIFrame* firstChild = firstLeaf->GetFirstChild(nsnull);
+    nsIFrame* realFrame = nsPlaceholderFrame::GetRealFrameFor(firstChild);
+    firstLeaf = (realFrame->GetType() == nsGkAtoms::letterFrame) ?
+                 realFrame : firstChild;
   }
   return NS_GET_EMBEDDING_LEVEL(firstLeaf);
 }

From 62db652c13d188d3cd7a6307231b53315623e3f4 Mon Sep 17 00:00:00 2001
From: "mitcho@mitcho.com" <mitcho@mitcho.com>
Date: Mon, 6 Sep 2010 23:15:20 +0700
Subject: [PATCH 206/222] Bug 593783 - a comment in the Makefile says tabview
 tests are disabled, but they're not. (r+a=dietrich)

---
 browser/base/content/test/tabview/Makefile.in | 2 --
 1 file changed, 2 deletions(-)

diff --git a/browser/base/content/test/tabview/Makefile.in b/browser/base/content/test/tabview/Makefile.in
index bae5126c26b1..0f4a41ecfb46 100644
--- a/browser/base/content/test/tabview/Makefile.in
+++ b/browser/base/content/test/tabview/Makefile.in
@@ -43,8 +43,6 @@ relativesrcdir  = browser/base/content/test/tabview
 include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
-$(warning All TabView tests are disabled for now while we iterate on the UI)
-
 _BROWSER_FILES = \
                  browser_tabview_launch.js \
                  browser_tabview_dragdrop.js \

From 664a176ac6c621a78212fd53bfe385166c077fe1 Mon Sep 17 00:00:00 2001
From: Michael Yoshitaka Erlewine <mitcho@mitcho.com>
Date: Fri, 3 Sep 2010 15:00:09 -0400
Subject: [PATCH 207/222] Bug 592586 Remove code for "group tab by sites"
 [r+a=dietrich]

---
 browser/base/content/tabview/groupitems.js | 15 ------
 browser/base/content/tabview/ui.js         | 55 ----------------------
 2 files changed, 70 deletions(-)

diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index 62f7ddd9f9f6..25171e75df0b 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -1407,21 +1407,6 @@ window.GroupItems = {
     return sane;
   },
 
-  // ----------
-  // Function: getGroupItemWithTitle
-  // Returns the <GroupItem> that has the given title, or null if none found.
-  // TODO: what if there are multiple groupItems with the same title??
-  //       Right now, looks like it'll return the last one. Bug 586557
-  getGroupItemWithTitle: function(title) {
-    var result = null;
-    this.groupItems.forEach(function(groupItem) {
-      if (groupItem.getTitle() == title)
-        result = groupItem;
-    });
-
-    return result;
-  },
-
   // ----------
   // Function: register
   // Adds the given <GroupItem> to the list of groupItems we're tracking.
diff --git a/browser/base/content/tabview/ui.js b/browser/base/content/tabview/ui.js
index bd9e63e403d0..27a86616658d 100644
--- a/browser/base/content/tabview/ui.js
+++ b/browser/base/content/tabview/ui.js
@@ -929,11 +929,6 @@ var UIManager = {
         code: function() {
           self._saveAll();
         }
-      }, {
-        name: "group sites",
-        code: function() {
-          self._arrangeBySite();
-        }
       }];
 
       var count = commands.length;
@@ -997,56 +992,6 @@ var UIManager = {
     GroupItems.saveAll();
     TabItems.saveAll();
   },
-
-  // ----------
-  // Function: _arrangeBySite
-  // Blows away all existing groupItems and organizes the tabs into new groupItems based
-  // on domain.
-  _arrangeBySite: function() {
-    function putInGroupItem(set, key) {
-      var groupItem = GroupItems.getGroupItemWithTitle(key);
-      if (groupItem) {
-        set.forEach(function(el) {
-          groupItem.add(el);
-        });
-      } else
-        new GroupItem(set, { dontPush: true, dontArrange: true, title: key });
-    }
-
-    GroupItems.removeAll();
-
-    var groupItems = [];
-    var leftovers = [];
-    var items = TabItems.getItems();
-    items.forEach(function(item) {
-      var url = item.tab.linkedBrowser.currentURI.spec;
-      var domain = url.split('/')[2];
-
-      if (!domain)
-        leftovers.push(item.container);
-      else {
-        var domainParts = domain.split(".");
-        var mainDomain = domainParts[domainParts.length - 2];
-        if (groupItems[mainDomain])
-          groupItems[mainDomain].push(item.container);
-        else
-          groupItems[mainDomain] = [item.container];
-      }
-    });
-
-    for (key in groupItems) {
-      var set = groupItems[key];
-      if (set.length > 1) {
-        putInGroupItem(set, key);
-      } else
-        leftovers.push(set[0]);
-    }
-
-    if (leftovers.length)
-      putInGroupItem(leftovers, "mixed");
-
-    GroupItems.arrange();
-  },
 };
 
 // ----------

From aad71dc63a8d7df991602802fb4fd36000bdf654 Mon Sep 17 00:00:00 2001
From: Michael Yoshitaka Erlewine <mitcho@mitcho.com>
Date: Mon, 6 Sep 2010 10:42:41 -0400
Subject: [PATCH 208/222] Bug 591147 Let TabItem spacing used in Items.arrange
 be specified via CSS [r+a=dietrich]

---
 browser/base/content/tabview/groupitems.js          |  2 +-
 browser/base/content/tabview/items.js               | 13 ++++++++-----
 .../themes/gnomestripe/browser/tabview/tabview.css  |  1 +
 .../themes/pinstripe/browser/tabview/tabview.css    |  1 +
 .../themes/winstripe/browser/tabview/tabview.css    |  1 +
 5 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index 25171e75df0b..68f50f2c39ad 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -777,7 +777,7 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       this.topChild = null;
       var box = new Rect(this.expanded.bounds);
       box.inset(8, 8);
-      Items.arrange(this._children, box, Utils.extend({}, options, {padding: 8, z: 99999}));
+      Items.arrange(this._children, box, Utils.extend({}, options, {z: 99999}));
     } else {
       var bb = this.getContentBounds();
       var count = this._children.length;
diff --git a/browser/base/content/tabview/items.js b/browser/base/content/tabview/items.js
index d77083315684..5f99d98fc32f 100644
--- a/browser/base/content/tabview/items.js
+++ b/browser/base/content/tabview/items.js
@@ -915,7 +915,11 @@ window.Items = {
       return rects;
 
     var columns = 1;
-    var padding = options.padding || 0;
+    // We'll assume for the time being that all the items have the same styling
+    // and that the margin is the same width around.
+    var itemMargin = items && items.length ?
+                       parseInt(iQ(items[0].container).css('margin-left')) : 0;
+    var padding = itemMargin * 2;
     var yScale = 1.1; // to allow for titles
     var rows;
     var tabWidth;
@@ -924,9 +928,9 @@ window.Items = {
 
     function figure() {
       rows = Math.ceil(count / columns);
-      tabWidth = (bounds.width - (padding * (columns - 1))) / columns;
+      tabWidth = (bounds.width - (padding * columns)) / columns;
       tabHeight = tabWidth * tabAspect;
-      totalHeight = (tabHeight * yScale * rows) + (padding * (rows - 1));
+      totalHeight = (tabHeight * yScale * rows) + (padding * rows);
     }
 
     figure();
@@ -937,8 +941,7 @@ window.Items = {
     }
 
     if (rows == 1) {
-      var maxWidth = Math.max(TabItems.tabWidth, bounds.width / 2);
-      tabWidth = Math.min(Math.min(maxWidth, bounds.width / count), bounds.height / tabAspect);
+      tabWidth = Math.min(tabWidth, (bounds.height - 2 * itemMargin) / tabAspect);
       tabHeight = tabWidth * tabAspect;
     }
 
diff --git a/browser/themes/gnomestripe/browser/tabview/tabview.css b/browser/themes/gnomestripe/browser/tabview/tabview.css
index 1b1f5646efaa..06daf034cc99 100644
--- a/browser/themes/gnomestripe/browser/tabview/tabview.css
+++ b/browser/themes/gnomestripe/browser/tabview/tabview.css
@@ -24,6 +24,7 @@ body {
   -moz-border-radius: 0.4em;
   -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
+  margin: 4px;
 }
 
 .tab canvas,
diff --git a/browser/themes/pinstripe/browser/tabview/tabview.css b/browser/themes/pinstripe/browser/tabview/tabview.css
index b02b626ac6d4..c093548472d5 100644
--- a/browser/themes/pinstripe/browser/tabview/tabview.css
+++ b/browser/themes/pinstripe/browser/tabview/tabview.css
@@ -24,6 +24,7 @@ body {
   -moz-border-radius: 0.4em;
   -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
+  margin: 4px;
 }
 
 .tab canvas,
diff --git a/browser/themes/winstripe/browser/tabview/tabview.css b/browser/themes/winstripe/browser/tabview/tabview.css
index 66e23a08ae10..1684f0da0d76 100644
--- a/browser/themes/winstripe/browser/tabview/tabview.css
+++ b/browser/themes/winstripe/browser/tabview/tabview.css
@@ -24,6 +24,7 @@ body {
   -moz-border-radius: 0.4em;
   -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
+  margin: 4px;
 }
 
 .tab canvas,

From 465f310de2392d6de679348f4474516c6f71f3b7 Mon Sep 17 00:00:00 2001
From: Michael Yoshitaka Erlewine <mitcho@mitcho.com>
Date: Mon, 6 Sep 2010 11:36:55 -0400
Subject: [PATCH 209/222] Bug 590742 - Incorporate new CSS for Tab Candy
 appearance polish [r+a=dietrich]

---
 browser/base/content/tabview/tabitems.js      |   9 +-
 browser/base/content/tabview/tabview.css      |   7 +-
 .../gnomestripe/browser/tabview/tabview.css   |  40 ++++----
 .../pinstripe/browser/tabview/tabview.css     |  87 +++++++++--------
 .../winstripe/browser/tabview/grain.png       | Bin 0 -> 1865 bytes
 .../winstripe/browser/tabview/tabview.css     |  88 +++++++++++-------
 6 files changed, 130 insertions(+), 101 deletions(-)
 create mode 100644 browser/themes/winstripe/browser/tabview/grain.png

diff --git a/browser/base/content/tabview/tabitems.js b/browser/base/content/tabview/tabitems.js
index 7722121c9988..f3269cdac88a 100644
--- a/browser/base/content/tabview/tabitems.js
+++ b/browser/base/content/tabview/tabitems.js
@@ -59,7 +59,7 @@ window.TabItem = function(tab) {
   // ___ set up div
   var $div = iQ('<div>')
     .addClass('tab')
-    .html("<div class='thumb'><div class='thumb-shadow'></div>" +
+    .html("<div class='thumb'>" +
           "<img class='cached-thumb' style='display:none'/><canvas/></div>" +
           "<div class='favicon'><img/></div>" +
           "<span class='tab-title'>&nbsp;</span>"
@@ -489,17 +489,14 @@ window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // Function: makeActive
   // Updates this item to visually indicate that it's active.
   makeActive: function() {
-   iQ(this.container).find("canvas").addClass("focus");
-   iQ(this.container).find("img.cached-thumb").addClass("focus");
-
+   iQ(this.container).addClass("focus");
   },
 
   // ----------
   // Function: makeDeactive
   // Updates this item to visually indicate that it's not active.
   makeDeactive: function() {
-   iQ(this.container).find("canvas").removeClass("focus");
-   iQ(this.container).find("img.cached-thumb").removeClass("focus");
+   iQ(this.container).removeClass("focus");
   },
 
   // ----------
diff --git a/browser/base/content/tabview/tabview.css b/browser/base/content/tabview/tabview.css
index a375571617ad..863adf5253d6 100644
--- a/browser/base/content/tabview/tabview.css
+++ b/browser/base/content/tabview/tabview.css
@@ -52,10 +52,6 @@ body {
   height: 100%;
 }
 
-.thumb-shadow {
-  position: absolute;
-}
-
 .favicon {
   position: absolute;
 }
@@ -73,8 +69,7 @@ body {
   position: absolute;
 }
 
-.stacked .tab-title,
-.stacked .thumb-shadow {
+.stacked .tab-title {
   display: none;
 }
 
diff --git a/browser/themes/gnomestripe/browser/tabview/tabview.css b/browser/themes/gnomestripe/browser/tabview/tabview.css
index 06daf034cc99..d2e4afc909fe 100644
--- a/browser/themes/gnomestripe/browser/tabview/tabview.css
+++ b/browser/themes/gnomestripe/browser/tabview/tabview.css
@@ -3,7 +3,6 @@
 */
 
 body {
-  background-color: transparent;  
   font-family: Tahoma, sans-serif !important;
   color: rgba(0,0,0,0.4);
   font-size: 12px;
@@ -19,10 +18,13 @@ body {
 
 .tab {
   padding: 4px 6px 6px 4px;
-  border: 1px solid rgba(230,230,230,1);
-  background-color: rgba(245,245,245,1);
+  background-color: #D7D7D7;
   -moz-border-radius: 0.4em;
-  -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
+  -moz-box-shadow: 0 1px 0 #FFFFFF inset,
+                   0 -1px 1px rgba(255, 255, 255, 0.4) inset,
+                   1px 0 1px rgba(255, 255, 255, 0.4) inset,
+                   -1px 0 1px rgba(255, 255, 255, 0.4) inset,
+                   0 1px 2px rgba(0, 0, 0, 0.4);
   cursor: pointer;
   margin: 4px;
 }
@@ -32,26 +34,23 @@ body {
   border: 1px solid rgba(0,0,0,0.2);
 }
 
-.thumb-shadow {
-  border-bottom: 5px solid rgba(0,0,0,0.05);
-  margin-right: -12px;
-  bottom: 2px;
-  width: 94.5%;
+.thumb {
+  -moz-box-shadow: 1px 2px 0 rgba(0, 0, 0, 0.2);
 }
 
 .favicon {
-  background-color: rgba(245,245,245,1);
+  background-color: #D7D7D7;
   -moz-border-radius-bottomright: 0.4em;
   -moz-box-shadow:
-    inset rgba(255, 255, 255, 0.6) 0 -2px 0px,
-    inset rgba(255, 255, 255, 0.6) -2px 0px 0px;
+    0 -1px 0 rgba(225, 225, 225, 0.8) inset,
+    -1px 0 0 rgba(225, 225, 225, 0.8) inset;
   padding: 4px 6px 6px 4px;
   top: 4px;
   left: 4px;
-  border-right: 1px solid rgba(0,0,0,0.2);
-  border-bottom: 1px solid rgba(0,0,0,0.2);
-  height: 17px;
-  width: 17px;
+  border-right: 1px solid rgba(0, 0, 0, 0.3);
+  border-bottom: 1px solid rgba(0, 0, 0, 0.3);
+  height: 16px;
+  width: 16px;
 }
 
 .favicon img {
@@ -74,7 +73,7 @@ body {
 }
 
 .expander {
-  bottom: 6px;
+  bottom: 8px;
   right: 6px;
   width: 16px;
   height: 16px;
@@ -86,6 +85,13 @@ body {
   opacity: 1.0;
 }
 
+.close:hover,
+.expander:hover {
+  -moz-transition-property: opacity;
+  -moz-transition-duration: 0.5s;
+  -moz-transition-timing-function: ease-out;
+}
+
 .favicon img:hover, 
 .close img:hover, 
 .expander img:hover {
diff --git a/browser/themes/pinstripe/browser/tabview/tabview.css b/browser/themes/pinstripe/browser/tabview/tabview.css
index c093548472d5..80b9d1c052f7 100644
--- a/browser/themes/pinstripe/browser/tabview/tabview.css
+++ b/browser/themes/pinstripe/browser/tabview/tabview.css
@@ -5,7 +5,7 @@
 body {
   background-color: transparent;  
   font-family: Tahoma, sans-serif !important;
-  color: rgba(0,0,0,0.4);
+  color: rgba(0, 0, 0, 0.6);
   font-size: 12px;
   line-height: 16px;
 }
@@ -19,39 +19,36 @@ body {
 
 .tab {
   padding: 4px 6px 6px 4px;
-  border: 1px solid rgba(230,230,230,1);
-  background-color: rgba(245,245,245,1);
+  background-color: #D7D7D7;
   -moz-border-radius: 0.4em;
-  -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
+  -moz-box-shadow: 0 1px 2px rgba(0, 0, 0, 0.4);
+  border: 1px solid rgba(255, 255, 255, 0.5);
   cursor: pointer;
-  margin: 4px;
+  margin: 8px;
 }
 
 .tab canvas,
 .cached-thumb {
-  border: 1px solid rgba(0,0,0,0.2);
+  border: 1px solid rgba(0, 0, 0, 0.3);
 }
 
-.thumb-shadow {
-  border-bottom: 5px solid rgba(0,0,0,0.05);
-  margin-right: -12px;
-  bottom: 2px;
-  width: 94.5%;
+.thumb {
+  -moz-box-shadow: 1px 2px 0 rgba(0, 0, 0, 0.2);
 }
 
 .favicon {
-  background-color: rgba(245,245,245,1);
+  background-color: #D7D7D7;
   -moz-border-radius-bottomright: 0.4em;
   -moz-box-shadow:
-    inset rgba(255, 255, 255, 0.6) 0 -2px 0px,
-    inset rgba(255, 255, 255, 0.6) -2px 0px 0px;
+    0 -1px 0 rgba(225, 225, 225, 0.8) inset,
+    -1px 0 0 rgba(225, 225, 225, 0.8) inset;
   padding: 4px 6px 6px 4px;
   top: 4px;
   left: 4px;
-  border-right: 1px solid rgba(0,0,0,0.2);
-  border-bottom: 1px solid rgba(0,0,0,0.2);
-  height: 17px;
-  width: 17px;
+  border-right: 1px solid rgba(0, 0, 0, 0.3);
+  border-bottom: 1px solid rgba(0, 0, 0, 0.3);
+  height: 16px;
+  width: 16px;
 }
 
 .favicon img {
@@ -65,24 +62,30 @@ body {
   right: 6px;
   width: 16px;
   height: 16px;
-  opacity: 0.2;
   background: url(chrome://global/skin/icons/closetab.png) no-repeat;
-}
-
-.close:hover {
-  opacity: 1.0;
+  -moz-transition-property: opacity;
+  -moz-transition-duration: 0.5s;
+  -moz-transition-timing-function: ease-out;
+  opacity: 0.2;
 }
 
 .expander {
-  bottom: 6px;
+  bottom: 8px;
   right: 6px;
   width: 16px;
   height: 16px;
   background: url(chrome://global/skin/icons/resizer.png) no-repeat;
+  -moz-transition-property: opacity;
+  -moz-transition-duration: 0.5s;
+  -moz-transition-timing-function: ease-out;
   opacity: 0.2;
 }
 
+.close:hover,
 .expander:hover {
+  -moz-transition-property: opacity;
+  -moz-transition-duration: 0.5s;
+  -moz-transition-timing-function: ease-out;
   opacity: 1.0;
 }
 
@@ -94,11 +97,12 @@ body {
 }
 
 .tab-title {
-  top: 100%;
+  bottom: -20px;
   text-align: center;
   width: 94.5%;
   white-space: nowrap;
   overflow: hidden;
+	text-shadow: 0 1px rgba(255, 255, 255, 0.6);
 }
 
 .stacked {
@@ -119,8 +123,9 @@ body {
   -moz-box-shadow: none !important;
 }
 
-.focus {
-  -moz-box-shadow:  rgba(54,79,225,1) 0px 0px 5px -1px !important;
+.tab.focus {
+  -moz-box-shadow: 0 0 8px -moz-mac-menuselect/*#0060D6*/;
+  border: 1px solid rgba(255, 255, 255, 0.6);
 }
 
 /* Tab: Zooming
@@ -134,26 +139,34 @@ body {
   display: none;
 }
 
-.front .focus {
+.front .thumb {
   -moz-box-shadow: none !important;
 }
 
+.front.focus {
+  -moz-box-shadow: none !important;
+  border: none !important;
+}
+
 /* Tab GroupItem
 ----------------------------------*/
 
 .tabInGroupItem {
-  border: none;
-  -moz-box-shadow: none !important;
+  -moz-box-shadow: none;
+  border-color: transparent;
+  background-color: transparent;
+}
+
+.tabInGroupItem .favicon {
+  background-color: #EBEBEB;
 }
 
 .groupItem {
   cursor: move;
-  border: 1px solid rgba(230,230,230,1);
-  background-color: rgba(248,248,248,1);
+  background-color: #EBEBEB;
   -moz-border-radius: 0.4em;
-  -moz-box-shadow:
-    inset rgba(255, 255, 255, 0.6) 0 0 0 2px,
-    rgba(0,0,0,0.2) 1px 1px 4px;
+  -moz-box-shadow: 0 1px 4px rgba(0, 0, 0, 0.6);
+  border: 1px solid rgba(255, 255, 255, 0.5);
 }
 
 .groupItem.activeGroupItem {
@@ -162,7 +175,7 @@ body {
 }
 
 .phantom {
-  border: 1px solid rgba(190,190,190,1);
+  border: 1px solid rgba(255, 255, 255, 0.5);
 }
 
 .overlay {
@@ -341,4 +354,4 @@ input.defaultName {
   height: 12px;
   right: 1px;
   bottom: 1px;
-}
\ No newline at end of file
+}
diff --git a/browser/themes/winstripe/browser/tabview/grain.png b/browser/themes/winstripe/browser/tabview/grain.png
new file mode 100644
index 0000000000000000000000000000000000000000..2c0608a27909177db37d4b5d877caace344b16fe
GIT binary patch
literal 1865
zcmaJ?X;c$e7>ygs)~Zy&h%g3MBs(Dx2y57c0ER`1M4co9iI7Z428p6o5k%pLiY2lM
zrv(HTkca^l5qCvYM5<^IOOd4@1zHOV3U;EP{ZTsS%)IyJ+<U+K-goEBfdD^GLp`h>
z27@v5_F{3+(G0!K=jfo%!RVc{(P0td9*P9Q5l9>;gD@@vm<IvgVlWcoK%ih-OdaHa
z!OXykf<lo{wl9MZiwU3>Lr{pNC>w)ua8gJ?eiVcNJSb8mVd4g=YjJ=`z{IVmu}N&H
z8zdBYZI?lT+x>$0+oSk)0-Td0;Gkfj0%8aO0fjhPB4;R=xKFwabgq3(!~vfmNE8$I
z*;FVy0C0n45I`f4@O+XD39um($W&`Ooo)qCNMsU`L?MzXcru+qr7%b&VB*4|)ntMQ
z28ZP_Q43u$aY6)<GKj>uxHv)_l>o~kiDWxFJFNzVf=3Z}`8EjxD)17y#iRlYlJjLE
zDI$U;fL0OY!LbMvhdTYd1+nyttVBL>Oz43T6`+(zCXlpSngp`h{|^<5zo6v^2m0#w
zKZWH%+oTYY1Igi786Rz2goU=0l;I|WKm?Wr!Ep5CDFz5(1eOb7Dc}}J1K1#6B+;%v
z;n{44w?vMB5<cY3V&YH*f=DD_P+2Ux2Z>H~v7>sB$t(|BD%H)EMsv4yrMr@-Wa=cB
z1@mLYkOZ0J3chl!r{rp*AeN$)S&&S$6%u&JU@`D%%M8)fUdU7GO>hNMd!bCpC8B1C
z+Q$B?(UY&x^k}DFVv8=m1Rs*1X_uj~et8$)j(#mQ-Yl0Og{CjW2R2&&-MGW>vn9Ei
zH=A#rEZv=;(82vVKiV?5*ZlPfPEiO~%|!wi1VlkM_VKP;q|6KfEDwdn%w1|iU$&Lk
ztJ-UB63@#SNsB4uIOlPVuRMP8Lf)S>koUHxY~+^{SS<FsD#qz))$aSfSlp30-|TA*
zt*bg*-$_!zrty2Pwr??fvSmT?a1yB4bEn}C^S&6tz?@!oTiq73F`g*P*W;?S;hY`Q
zt?+m-K7Ipcgc}~7`0JX&yG2c+lBJuEJ*e+~L%F!3L05UYsb^J%-V1-GyERs=rVXCK
z%*)QszCM1~usp=mCg)bqtJxj9<NZ@gnqS-6FG}i~-cNu)6P<^qdOvTnI#}E!PI8^5
zgbvu4<y5OwdtM6FVdvn>Pn5~ZdgvYE{MPwthut;VEu%xhwx+jF&aim4LwDIiv;A9>
zotjja!2^}~`SwYw)~kDqH?(Vr4Q5I=cx8pKs^wjKhpkmh0o_>HNK}U2&v&wZS>^fm
z2jN-R>h^`Fzn47Am^DNi;~d#Yv+wPGW|%QvY=KY$*VS^bSjY<DF?HGag(0t}x#35<
zXVzPgD}0uk7`QeMNpv(RjZn>RTdU{kC9%>L-DkCzU(!u=2Fh=|Hr97IuJ#qLRi};i
zv<D9f$JCELq!WTJX*g+rF@3VkbD0`lWh9U1nvz%W0h^hdn|S9{PekF^a&ARwfDPO3
zUWFjD=6qsI{FA=0-kJJL@h;n4?qe6D`)_uh9%!gP_V-vudS6u-cT{scW7qc&Gt*IL
z?#BYEjgxTul9S10NJpiH#5P*Hn&n}ACTpQ(hTd>u!s8?7BDlSX@2s2I><TOLLCYCv
zb89zcU#qCi_i6sAt;%Vmb3x<Piv{_5wmo-C2=Du9evI^FsGNY<dv&yJe&yi?jIn{H
zR-tCKm&@7aRIVd^BP~p5lQTH7V^D)H0o8@w=@Fi%=$BgS%ByuNj(r?XEn0GLv}5>P
zXS06${4IXh&eo3jVZ4k}-Jchmc0S+JPHir-h<O-ZyV_x8=tos1p{J3lzo<42uVnnt
zawwkmzU-FyjmKSGT^*HeOX}ME{ryvYyaGuJQ<s`PO6=Onu(w}RWw5f;cg0cr^F~(2
z`q}E>Rg!B1Z+!;ebXHzST(UpmVtP_o>AnCdtH0?1hbzfq7PMyXTz6`%Cw4LI5m9;j
zeFpY^LxWHDw=JEn>u<h_8A(5}8Fyr^-Myw$L6*x=@n&t}4D%fK7B{r@P!*#Fd5$07
d7dI@Prh~CmajnOfE7;nfo430ktITzC!atko0yY2u

literal 0
HcmV?d00001

diff --git a/browser/themes/winstripe/browser/tabview/tabview.css b/browser/themes/winstripe/browser/tabview/tabview.css
index 1684f0da0d76..1d768f79d095 100644
--- a/browser/themes/winstripe/browser/tabview/tabview.css
+++ b/browser/themes/winstripe/browser/tabview/tabview.css
@@ -3,15 +3,14 @@
 */
 
 body {
-  background-color: transparent;  
   font-family: Tahoma, sans-serif !important;
-  color: rgba(0,0,0,0.4);
-  font-size: 12px;
+  color: rgba(0, 0, 0, 0.6);
+  font-size: 13px;
   line-height: 16px;
 }
 
 #bg {
-  background: -moz-linear-gradient(top,#F1F5FB,#EDF4FB);
+  background: url("chrome://browser/skin/tabview/grain.png") repeat scroll center top, -moz-linear-gradient(center top , #CCD9EA, #C7D5E7) repeat scroll 0 0 transparent;
 }
 
 /* Tabs
@@ -19,37 +18,35 @@ body {
 
 .tab {
   padding: 4px 6px 6px 4px;
-  border: 1px solid rgba(230,230,230,1);
-  background-color: rgba(245,245,245,1);
+  background-color: #E0EAF5;
   -moz-border-radius: 0.4em;
-  -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
+  -moz-box-shadow:
+    0 1px 0 #FFFFFF inset,
+    0 -1px 1px rgba(255, 255, 255, 0.8) inset,
+    1px 0 1px rgba(255, 255, 255, 0.8) inset,
+    -1px 0 1px rgba(255, 255, 255, 0.8) inset,
+    0 1px 2px rgba(4, 38, 60, 0.4);
   cursor: pointer;
   margin: 4px;
 }
 
 .tab canvas,
 .cached-thumb {
-  border: 1px solid rgba(0,0,0,0.2);
+  border: 1px solid rgba(73, 99, 119, 0.3);
 }
 
-.thumb-shadow {
-  border-bottom: 5px solid rgba(0,0,0,0.05);
-  margin-right: -12px;
-  bottom: 2px;
-  width: 94.5%;
+.thumb {
+  -moz-box-shadow: 1px 2px 0 rgba(0, 0, 0, 0.1);
 }
 
 .favicon {
-  background-color: rgba(245,245,245,1);
+  background-color: #E0EAF5;
   -moz-border-radius-bottomright: 0.4em;
-  -moz-box-shadow:
-    inset rgba(255, 255, 255, 0.6) 0 -2px 0px,
-    inset rgba(255, 255, 255, 0.6) -2px 0px 0px;
   padding: 4px 6px 6px 4px;
   top: 4px;
   left: 4px;
-  border-right: 1px solid rgba(0,0,0,0.2);
-  border-bottom: 1px solid rgba(0,0,0,0.2);
+  border-right: 1px solid rgba(73, 99, 119, 0.3);
+  border-bottom: 1px solid rgba(73, 99, 119, 0.3);
   height: 17px;
   width: 17px;
 }
@@ -65,12 +62,11 @@ body {
   right: 6px;
   width: 16px;
   height: 16px;
-  opacity: 0.2;
   background: url(chrome://global/skin/icons/Close.gif) no-repeat;
-}
-
-.close:hover {
-  opacity: 1.0;
+  -moz-transition-property: opacity;
+  -moz-transition-duration: 0.5s;
+  -moz-transition-timing-function: ease-out;
+  opacity: 0.2;
 }
 
 .expander {
@@ -79,10 +75,17 @@ body {
   width: 16px;
   height: 16px;
   background: url(chrome://global/skin/icons/resizer.png) no-repeat;
+  -moz-transition-property: opacity;
+  -moz-transition-duration: 0.5s;
+  -moz-transition-timing-function: ease-out;
   opacity: 0.2;
 }
 
+.close:hover,
 .expander:hover {
+  -moz-transition-property: opacity;
+  -moz-transition-duration: 0.5s;
+  -moz-transition-timing-function: ease-out;
   opacity: 1.0;
 }
 
@@ -94,11 +97,12 @@ body {
 }
 
 .tab-title {
-  top: 100%;
+  bottom: -20px;
   text-align: center;
   width: 94.5%;
   white-space: nowrap;
   overflow: hidden;
+  text-shadow: 0 1px rgba(255, 255, 255, 0.6);
 }
 
 .stacked {
@@ -119,8 +123,13 @@ body {
   -moz-box-shadow: none !important;
 }
 
-.focus {
-  -moz-box-shadow:  rgba(54,79,225,1) 0px 0px 5px -1px !important;
+.tab.focus {
+  -moz-box-shadow:
+    0 1px 0 #FFFFFF inset,
+    0 -1px 1px #FFFFFF inset,
+    1px 0 1px #FFFFFF inset,
+    -1px 0 1px #FFFFFF inset,
+    0 0 8px #007ECE;
 }
 
 /* Tab: Zooming
@@ -134,7 +143,11 @@ body {
   display: none;
 }
 
-.front .focus {
+.front .thumb {
+  -moz-box-shadow: none !important;
+}
+
+.front.focus {
   -moz-box-shadow: none !important;
 }
 
@@ -142,18 +155,24 @@ body {
 ----------------------------------*/
 
 .tabInGroupItem {
-  border: none;
-  -moz-box-shadow: none !important;
+  -moz-box-shadow: none;
+  background-color: #E0EAF5;
+}
+
+.tabInGroupItem .favicon {
+  background-color: #E0EAF5;
 }
 
 .groupItem {
   cursor: move;
-  border: 1px solid rgba(230,230,230,1);
-  background-color: rgba(248,248,248,1);
+  background-color: #E0EAF5;
   -moz-border-radius: 0.4em;
   -moz-box-shadow:
-    inset rgba(255, 255, 255, 0.6) 0 0 0 2px,
-    rgba(0,0,0,0.2) 1px 1px 4px;
+    0 1px 0 #FFFFFF inset,
+    0 -1px 1px rgba(255, 255, 255, 0.8) inset,
+    1px 0 1px rgba(255, 255, 255, 0.8) inset,
+    -1px 0 1px rgba(255, 255, 255, 0.8) inset,
+    0 1px 4px rgba(4, 38, 60, 0.6);
 }
 
 .groupItem.activeGroupItem {
@@ -162,7 +181,6 @@ body {
 }
 
 .phantom {
-  border: 1px solid rgba(190,190,190,1);
 }
 
 .overlay {

From eb95ce188e6366399bc1361a566c02a9849957f3 Mon Sep 17 00:00:00 2001
From: Dietrich Ayala <dietrich@mozilla.com>
Date: Tue, 7 Sep 2010 00:28:01 +0700
Subject: [PATCH 210/222] backing out bug 590742, bug 591147, bug 592586,
 a=dietrich

---
 browser/base/content/tabview/groupitems.js    |  17 +++-
 browser/base/content/tabview/items.js         |  13 +--
 browser/base/content/tabview/tabitems.js      |   9 +-
 browser/base/content/tabview/tabview.css      |   7 +-
 browser/base/content/tabview/ui.js            |  55 +++++++++++
 .../gnomestripe/browser/tabview/tabview.css   |  41 ++++----
 .../pinstripe/browser/tabview/tabview.css     |  86 +++++++----------
 .../winstripe/browser/tabview/grain.png       | Bin 1865 -> 0 bytes
 .../winstripe/browser/tabview/tabview.css     |  89 +++++++-----------
 9 files changed, 176 insertions(+), 141 deletions(-)
 delete mode 100644 browser/themes/winstripe/browser/tabview/grain.png

diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index 68f50f2c39ad..62f7ddd9f9f6 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -777,7 +777,7 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       this.topChild = null;
       var box = new Rect(this.expanded.bounds);
       box.inset(8, 8);
-      Items.arrange(this._children, box, Utils.extend({}, options, {z: 99999}));
+      Items.arrange(this._children, box, Utils.extend({}, options, {padding: 8, z: 99999}));
     } else {
       var bb = this.getContentBounds();
       var count = this._children.length;
@@ -1407,6 +1407,21 @@ window.GroupItems = {
     return sane;
   },
 
+  // ----------
+  // Function: getGroupItemWithTitle
+  // Returns the <GroupItem> that has the given title, or null if none found.
+  // TODO: what if there are multiple groupItems with the same title??
+  //       Right now, looks like it'll return the last one. Bug 586557
+  getGroupItemWithTitle: function(title) {
+    var result = null;
+    this.groupItems.forEach(function(groupItem) {
+      if (groupItem.getTitle() == title)
+        result = groupItem;
+    });
+
+    return result;
+  },
+
   // ----------
   // Function: register
   // Adds the given <GroupItem> to the list of groupItems we're tracking.
diff --git a/browser/base/content/tabview/items.js b/browser/base/content/tabview/items.js
index 5f99d98fc32f..d77083315684 100644
--- a/browser/base/content/tabview/items.js
+++ b/browser/base/content/tabview/items.js
@@ -915,11 +915,7 @@ window.Items = {
       return rects;
 
     var columns = 1;
-    // We'll assume for the time being that all the items have the same styling
-    // and that the margin is the same width around.
-    var itemMargin = items && items.length ?
-                       parseInt(iQ(items[0].container).css('margin-left')) : 0;
-    var padding = itemMargin * 2;
+    var padding = options.padding || 0;
     var yScale = 1.1; // to allow for titles
     var rows;
     var tabWidth;
@@ -928,9 +924,9 @@ window.Items = {
 
     function figure() {
       rows = Math.ceil(count / columns);
-      tabWidth = (bounds.width - (padding * columns)) / columns;
+      tabWidth = (bounds.width - (padding * (columns - 1))) / columns;
       tabHeight = tabWidth * tabAspect;
-      totalHeight = (tabHeight * yScale * rows) + (padding * rows);
+      totalHeight = (tabHeight * yScale * rows) + (padding * (rows - 1));
     }
 
     figure();
@@ -941,7 +937,8 @@ window.Items = {
     }
 
     if (rows == 1) {
-      tabWidth = Math.min(tabWidth, (bounds.height - 2 * itemMargin) / tabAspect);
+      var maxWidth = Math.max(TabItems.tabWidth, bounds.width / 2);
+      tabWidth = Math.min(Math.min(maxWidth, bounds.width / count), bounds.height / tabAspect);
       tabHeight = tabWidth * tabAspect;
     }
 
diff --git a/browser/base/content/tabview/tabitems.js b/browser/base/content/tabview/tabitems.js
index f3269cdac88a..7722121c9988 100644
--- a/browser/base/content/tabview/tabitems.js
+++ b/browser/base/content/tabview/tabitems.js
@@ -59,7 +59,7 @@ window.TabItem = function(tab) {
   // ___ set up div
   var $div = iQ('<div>')
     .addClass('tab')
-    .html("<div class='thumb'>" +
+    .html("<div class='thumb'><div class='thumb-shadow'></div>" +
           "<img class='cached-thumb' style='display:none'/><canvas/></div>" +
           "<div class='favicon'><img/></div>" +
           "<span class='tab-title'>&nbsp;</span>"
@@ -489,14 +489,17 @@ window.TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // Function: makeActive
   // Updates this item to visually indicate that it's active.
   makeActive: function() {
-   iQ(this.container).addClass("focus");
+   iQ(this.container).find("canvas").addClass("focus");
+   iQ(this.container).find("img.cached-thumb").addClass("focus");
+
   },
 
   // ----------
   // Function: makeDeactive
   // Updates this item to visually indicate that it's not active.
   makeDeactive: function() {
-   iQ(this.container).removeClass("focus");
+   iQ(this.container).find("canvas").removeClass("focus");
+   iQ(this.container).find("img.cached-thumb").removeClass("focus");
   },
 
   // ----------
diff --git a/browser/base/content/tabview/tabview.css b/browser/base/content/tabview/tabview.css
index 863adf5253d6..a375571617ad 100644
--- a/browser/base/content/tabview/tabview.css
+++ b/browser/base/content/tabview/tabview.css
@@ -52,6 +52,10 @@ body {
   height: 100%;
 }
 
+.thumb-shadow {
+  position: absolute;
+}
+
 .favicon {
   position: absolute;
 }
@@ -69,7 +73,8 @@ body {
   position: absolute;
 }
 
-.stacked .tab-title {
+.stacked .tab-title,
+.stacked .thumb-shadow {
   display: none;
 }
 
diff --git a/browser/base/content/tabview/ui.js b/browser/base/content/tabview/ui.js
index 27a86616658d..bd9e63e403d0 100644
--- a/browser/base/content/tabview/ui.js
+++ b/browser/base/content/tabview/ui.js
@@ -929,6 +929,11 @@ var UIManager = {
         code: function() {
           self._saveAll();
         }
+      }, {
+        name: "group sites",
+        code: function() {
+          self._arrangeBySite();
+        }
       }];
 
       var count = commands.length;
@@ -992,6 +997,56 @@ var UIManager = {
     GroupItems.saveAll();
     TabItems.saveAll();
   },
+
+  // ----------
+  // Function: _arrangeBySite
+  // Blows away all existing groupItems and organizes the tabs into new groupItems based
+  // on domain.
+  _arrangeBySite: function() {
+    function putInGroupItem(set, key) {
+      var groupItem = GroupItems.getGroupItemWithTitle(key);
+      if (groupItem) {
+        set.forEach(function(el) {
+          groupItem.add(el);
+        });
+      } else
+        new GroupItem(set, { dontPush: true, dontArrange: true, title: key });
+    }
+
+    GroupItems.removeAll();
+
+    var groupItems = [];
+    var leftovers = [];
+    var items = TabItems.getItems();
+    items.forEach(function(item) {
+      var url = item.tab.linkedBrowser.currentURI.spec;
+      var domain = url.split('/')[2];
+
+      if (!domain)
+        leftovers.push(item.container);
+      else {
+        var domainParts = domain.split(".");
+        var mainDomain = domainParts[domainParts.length - 2];
+        if (groupItems[mainDomain])
+          groupItems[mainDomain].push(item.container);
+        else
+          groupItems[mainDomain] = [item.container];
+      }
+    });
+
+    for (key in groupItems) {
+      var set = groupItems[key];
+      if (set.length > 1) {
+        putInGroupItem(set, key);
+      } else
+        leftovers.push(set[0]);
+    }
+
+    if (leftovers.length)
+      putInGroupItem(leftovers, "mixed");
+
+    GroupItems.arrange();
+  },
 };
 
 // ----------
diff --git a/browser/themes/gnomestripe/browser/tabview/tabview.css b/browser/themes/gnomestripe/browser/tabview/tabview.css
index d2e4afc909fe..1b1f5646efaa 100644
--- a/browser/themes/gnomestripe/browser/tabview/tabview.css
+++ b/browser/themes/gnomestripe/browser/tabview/tabview.css
@@ -3,6 +3,7 @@
 */
 
 body {
+  background-color: transparent;  
   font-family: Tahoma, sans-serif !important;
   color: rgba(0,0,0,0.4);
   font-size: 12px;
@@ -18,15 +19,11 @@ body {
 
 .tab {
   padding: 4px 6px 6px 4px;
-  background-color: #D7D7D7;
+  border: 1px solid rgba(230,230,230,1);
+  background-color: rgba(245,245,245,1);
   -moz-border-radius: 0.4em;
-  -moz-box-shadow: 0 1px 0 #FFFFFF inset,
-                   0 -1px 1px rgba(255, 255, 255, 0.4) inset,
-                   1px 0 1px rgba(255, 255, 255, 0.4) inset,
-                   -1px 0 1px rgba(255, 255, 255, 0.4) inset,
-                   0 1px 2px rgba(0, 0, 0, 0.4);
+  -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
-  margin: 4px;
 }
 
 .tab canvas,
@@ -34,23 +31,26 @@ body {
   border: 1px solid rgba(0,0,0,0.2);
 }
 
-.thumb {
-  -moz-box-shadow: 1px 2px 0 rgba(0, 0, 0, 0.2);
+.thumb-shadow {
+  border-bottom: 5px solid rgba(0,0,0,0.05);
+  margin-right: -12px;
+  bottom: 2px;
+  width: 94.5%;
 }
 
 .favicon {
-  background-color: #D7D7D7;
+  background-color: rgba(245,245,245,1);
   -moz-border-radius-bottomright: 0.4em;
   -moz-box-shadow:
-    0 -1px 0 rgba(225, 225, 225, 0.8) inset,
-    -1px 0 0 rgba(225, 225, 225, 0.8) inset;
+    inset rgba(255, 255, 255, 0.6) 0 -2px 0px,
+    inset rgba(255, 255, 255, 0.6) -2px 0px 0px;
   padding: 4px 6px 6px 4px;
   top: 4px;
   left: 4px;
-  border-right: 1px solid rgba(0, 0, 0, 0.3);
-  border-bottom: 1px solid rgba(0, 0, 0, 0.3);
-  height: 16px;
-  width: 16px;
+  border-right: 1px solid rgba(0,0,0,0.2);
+  border-bottom: 1px solid rgba(0,0,0,0.2);
+  height: 17px;
+  width: 17px;
 }
 
 .favicon img {
@@ -73,7 +73,7 @@ body {
 }
 
 .expander {
-  bottom: 8px;
+  bottom: 6px;
   right: 6px;
   width: 16px;
   height: 16px;
@@ -85,13 +85,6 @@ body {
   opacity: 1.0;
 }
 
-.close:hover,
-.expander:hover {
-  -moz-transition-property: opacity;
-  -moz-transition-duration: 0.5s;
-  -moz-transition-timing-function: ease-out;
-}
-
 .favicon img:hover, 
 .close img:hover, 
 .expander img:hover {
diff --git a/browser/themes/pinstripe/browser/tabview/tabview.css b/browser/themes/pinstripe/browser/tabview/tabview.css
index 80b9d1c052f7..b02b626ac6d4 100644
--- a/browser/themes/pinstripe/browser/tabview/tabview.css
+++ b/browser/themes/pinstripe/browser/tabview/tabview.css
@@ -5,7 +5,7 @@
 body {
   background-color: transparent;  
   font-family: Tahoma, sans-serif !important;
-  color: rgba(0, 0, 0, 0.6);
+  color: rgba(0,0,0,0.4);
   font-size: 12px;
   line-height: 16px;
 }
@@ -19,36 +19,38 @@ body {
 
 .tab {
   padding: 4px 6px 6px 4px;
-  background-color: #D7D7D7;
+  border: 1px solid rgba(230,230,230,1);
+  background-color: rgba(245,245,245,1);
   -moz-border-radius: 0.4em;
-  -moz-box-shadow: 0 1px 2px rgba(0, 0, 0, 0.4);
-  border: 1px solid rgba(255, 255, 255, 0.5);
+  -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
-  margin: 8px;
 }
 
 .tab canvas,
 .cached-thumb {
-  border: 1px solid rgba(0, 0, 0, 0.3);
+  border: 1px solid rgba(0,0,0,0.2);
 }
 
-.thumb {
-  -moz-box-shadow: 1px 2px 0 rgba(0, 0, 0, 0.2);
+.thumb-shadow {
+  border-bottom: 5px solid rgba(0,0,0,0.05);
+  margin-right: -12px;
+  bottom: 2px;
+  width: 94.5%;
 }
 
 .favicon {
-  background-color: #D7D7D7;
+  background-color: rgba(245,245,245,1);
   -moz-border-radius-bottomright: 0.4em;
   -moz-box-shadow:
-    0 -1px 0 rgba(225, 225, 225, 0.8) inset,
-    -1px 0 0 rgba(225, 225, 225, 0.8) inset;
+    inset rgba(255, 255, 255, 0.6) 0 -2px 0px,
+    inset rgba(255, 255, 255, 0.6) -2px 0px 0px;
   padding: 4px 6px 6px 4px;
   top: 4px;
   left: 4px;
-  border-right: 1px solid rgba(0, 0, 0, 0.3);
-  border-bottom: 1px solid rgba(0, 0, 0, 0.3);
-  height: 16px;
-  width: 16px;
+  border-right: 1px solid rgba(0,0,0,0.2);
+  border-bottom: 1px solid rgba(0,0,0,0.2);
+  height: 17px;
+  width: 17px;
 }
 
 .favicon img {
@@ -62,30 +64,24 @@ body {
   right: 6px;
   width: 16px;
   height: 16px;
-  background: url(chrome://global/skin/icons/closetab.png) no-repeat;
-  -moz-transition-property: opacity;
-  -moz-transition-duration: 0.5s;
-  -moz-transition-timing-function: ease-out;
   opacity: 0.2;
+  background: url(chrome://global/skin/icons/closetab.png) no-repeat;
+}
+
+.close:hover {
+  opacity: 1.0;
 }
 
 .expander {
-  bottom: 8px;
+  bottom: 6px;
   right: 6px;
   width: 16px;
   height: 16px;
   background: url(chrome://global/skin/icons/resizer.png) no-repeat;
-  -moz-transition-property: opacity;
-  -moz-transition-duration: 0.5s;
-  -moz-transition-timing-function: ease-out;
   opacity: 0.2;
 }
 
-.close:hover,
 .expander:hover {
-  -moz-transition-property: opacity;
-  -moz-transition-duration: 0.5s;
-  -moz-transition-timing-function: ease-out;
   opacity: 1.0;
 }
 
@@ -97,12 +93,11 @@ body {
 }
 
 .tab-title {
-  bottom: -20px;
+  top: 100%;
   text-align: center;
   width: 94.5%;
   white-space: nowrap;
   overflow: hidden;
-	text-shadow: 0 1px rgba(255, 255, 255, 0.6);
 }
 
 .stacked {
@@ -123,9 +118,8 @@ body {
   -moz-box-shadow: none !important;
 }
 
-.tab.focus {
-  -moz-box-shadow: 0 0 8px -moz-mac-menuselect/*#0060D6*/;
-  border: 1px solid rgba(255, 255, 255, 0.6);
+.focus {
+  -moz-box-shadow:  rgba(54,79,225,1) 0px 0px 5px -1px !important;
 }
 
 /* Tab: Zooming
@@ -139,34 +133,26 @@ body {
   display: none;
 }
 
-.front .thumb {
+.front .focus {
   -moz-box-shadow: none !important;
 }
 
-.front.focus {
-  -moz-box-shadow: none !important;
-  border: none !important;
-}
-
 /* Tab GroupItem
 ----------------------------------*/
 
 .tabInGroupItem {
-  -moz-box-shadow: none;
-  border-color: transparent;
-  background-color: transparent;
-}
-
-.tabInGroupItem .favicon {
-  background-color: #EBEBEB;
+  border: none;
+  -moz-box-shadow: none !important;
 }
 
 .groupItem {
   cursor: move;
-  background-color: #EBEBEB;
+  border: 1px solid rgba(230,230,230,1);
+  background-color: rgba(248,248,248,1);
   -moz-border-radius: 0.4em;
-  -moz-box-shadow: 0 1px 4px rgba(0, 0, 0, 0.6);
-  border: 1px solid rgba(255, 255, 255, 0.5);
+  -moz-box-shadow:
+    inset rgba(255, 255, 255, 0.6) 0 0 0 2px,
+    rgba(0,0,0,0.2) 1px 1px 4px;
 }
 
 .groupItem.activeGroupItem {
@@ -175,7 +161,7 @@ body {
 }
 
 .phantom {
-  border: 1px solid rgba(255, 255, 255, 0.5);
+  border: 1px solid rgba(190,190,190,1);
 }
 
 .overlay {
@@ -354,4 +340,4 @@ input.defaultName {
   height: 12px;
   right: 1px;
   bottom: 1px;
-}
+}
\ No newline at end of file
diff --git a/browser/themes/winstripe/browser/tabview/grain.png b/browser/themes/winstripe/browser/tabview/grain.png
deleted file mode 100644
index 2c0608a27909177db37d4b5d877caace344b16fe..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1865
zcmaJ?X;c$e7>ygs)~Zy&h%g3MBs(Dx2y57c0ER`1M4co9iI7Z428p6o5k%pLiY2lM
zrv(HTkca^l5qCvYM5<^IOOd4@1zHOV3U;EP{ZTsS%)IyJ+<U+K-goEBfdD^GLp`h>
z27@v5_F{3+(G0!K=jfo%!RVc{(P0td9*P9Q5l9>;gD@@vm<IvgVlWcoK%ih-OdaHa
z!OXykf<lo{wl9MZiwU3>Lr{pNC>w)ua8gJ?eiVcNJSb8mVd4g=YjJ=`z{IVmu}N&H
z8zdBYZI?lT+x>$0+oSk)0-Td0;Gkfj0%8aO0fjhPB4;R=xKFwabgq3(!~vfmNE8$I
z*;FVy0C0n45I`f4@O+XD39um($W&`Ooo)qCNMsU`L?MzXcru+qr7%b&VB*4|)ntMQ
z28ZP_Q43u$aY6)<GKj>uxHv)_l>o~kiDWxFJFNzVf=3Z}`8EjxD)17y#iRlYlJjLE
zDI$U;fL0OY!LbMvhdTYd1+nyttVBL>Oz43T6`+(zCXlpSngp`h{|^<5zo6v^2m0#w
zKZWH%+oTYY1Igi786Rz2goU=0l;I|WKm?Wr!Ep5CDFz5(1eOb7Dc}}J1K1#6B+;%v
z;n{44w?vMB5<cY3V&YH*f=DD_P+2Ux2Z>H~v7>sB$t(|BD%H)EMsv4yrMr@-Wa=cB
z1@mLYkOZ0J3chl!r{rp*AeN$)S&&S$6%u&JU@`D%%M8)fUdU7GO>hNMd!bCpC8B1C
z+Q$B?(UY&x^k}DFVv8=m1Rs*1X_uj~et8$)j(#mQ-Yl0Og{CjW2R2&&-MGW>vn9Ei
zH=A#rEZv=;(82vVKiV?5*ZlPfPEiO~%|!wi1VlkM_VKP;q|6KfEDwdn%w1|iU$&Lk
ztJ-UB63@#SNsB4uIOlPVuRMP8Lf)S>koUHxY~+^{SS<FsD#qz))$aSfSlp30-|TA*
zt*bg*-$_!zrty2Pwr??fvSmT?a1yB4bEn}C^S&6tz?@!oTiq73F`g*P*W;?S;hY`Q
zt?+m-K7Ipcgc}~7`0JX&yG2c+lBJuEJ*e+~L%F!3L05UYsb^J%-V1-GyERs=rVXCK
z%*)QszCM1~usp=mCg)bqtJxj9<NZ@gnqS-6FG}i~-cNu)6P<^qdOvTnI#}E!PI8^5
zgbvu4<y5OwdtM6FVdvn>Pn5~ZdgvYE{MPwthut;VEu%xhwx+jF&aim4LwDIiv;A9>
zotjja!2^}~`SwYw)~kDqH?(Vr4Q5I=cx8pKs^wjKhpkmh0o_>HNK}U2&v&wZS>^fm
z2jN-R>h^`Fzn47Am^DNi;~d#Yv+wPGW|%QvY=KY$*VS^bSjY<DF?HGag(0t}x#35<
zXVzPgD}0uk7`QeMNpv(RjZn>RTdU{kC9%>L-DkCzU(!u=2Fh=|Hr97IuJ#qLRi};i
zv<D9f$JCELq!WTJX*g+rF@3VkbD0`lWh9U1nvz%W0h^hdn|S9{PekF^a&ARwfDPO3
zUWFjD=6qsI{FA=0-kJJL@h;n4?qe6D`)_uh9%!gP_V-vudS6u-cT{scW7qc&Gt*IL
z?#BYEjgxTul9S10NJpiH#5P*Hn&n}ACTpQ(hTd>u!s8?7BDlSX@2s2I><TOLLCYCv
zb89zcU#qCi_i6sAt;%Vmb3x<Piv{_5wmo-C2=Du9evI^FsGNY<dv&yJe&yi?jIn{H
zR-tCKm&@7aRIVd^BP~p5lQTH7V^D)H0o8@w=@Fi%=$BgS%ByuNj(r?XEn0GLv}5>P
zXS06${4IXh&eo3jVZ4k}-Jchmc0S+JPHir-h<O-ZyV_x8=tos1p{J3lzo<42uVnnt
zawwkmzU-FyjmKSGT^*HeOX}ME{ryvYyaGuJQ<s`PO6=Onu(w}RWw5f;cg0cr^F~(2
z`q}E>Rg!B1Z+!;ebXHzST(UpmVtP_o>AnCdtH0?1hbzfq7PMyXTz6`%Cw4LI5m9;j
zeFpY^LxWHDw=JEn>u<h_8A(5}8Fyr^-Myw$L6*x=@n&t}4D%fK7B{r@P!*#Fd5$07
d7dI@Prh~CmajnOfE7;nfo430ktITzC!atko0yY2u

diff --git a/browser/themes/winstripe/browser/tabview/tabview.css b/browser/themes/winstripe/browser/tabview/tabview.css
index 1d768f79d095..66e23a08ae10 100644
--- a/browser/themes/winstripe/browser/tabview/tabview.css
+++ b/browser/themes/winstripe/browser/tabview/tabview.css
@@ -3,14 +3,15 @@
 */
 
 body {
+  background-color: transparent;  
   font-family: Tahoma, sans-serif !important;
-  color: rgba(0, 0, 0, 0.6);
-  font-size: 13px;
+  color: rgba(0,0,0,0.4);
+  font-size: 12px;
   line-height: 16px;
 }
 
 #bg {
-  background: url("chrome://browser/skin/tabview/grain.png") repeat scroll center top, -moz-linear-gradient(center top , #CCD9EA, #C7D5E7) repeat scroll 0 0 transparent;
+  background: -moz-linear-gradient(top,#F1F5FB,#EDF4FB);
 }
 
 /* Tabs
@@ -18,35 +19,36 @@ body {
 
 .tab {
   padding: 4px 6px 6px 4px;
-  background-color: #E0EAF5;
+  border: 1px solid rgba(230,230,230,1);
+  background-color: rgba(245,245,245,1);
   -moz-border-radius: 0.4em;
-  -moz-box-shadow:
-    0 1px 0 #FFFFFF inset,
-    0 -1px 1px rgba(255, 255, 255, 0.8) inset,
-    1px 0 1px rgba(255, 255, 255, 0.8) inset,
-    -1px 0 1px rgba(255, 255, 255, 0.8) inset,
-    0 1px 2px rgba(4, 38, 60, 0.4);
+  -moz-box-shadow: inset rgba(255, 255, 255, 0.6) 0 0 0 2px;
   cursor: pointer;
-  margin: 4px;
 }
 
 .tab canvas,
 .cached-thumb {
-  border: 1px solid rgba(73, 99, 119, 0.3);
+  border: 1px solid rgba(0,0,0,0.2);
 }
 
-.thumb {
-  -moz-box-shadow: 1px 2px 0 rgba(0, 0, 0, 0.1);
+.thumb-shadow {
+  border-bottom: 5px solid rgba(0,0,0,0.05);
+  margin-right: -12px;
+  bottom: 2px;
+  width: 94.5%;
 }
 
 .favicon {
-  background-color: #E0EAF5;
+  background-color: rgba(245,245,245,1);
   -moz-border-radius-bottomright: 0.4em;
+  -moz-box-shadow:
+    inset rgba(255, 255, 255, 0.6) 0 -2px 0px,
+    inset rgba(255, 255, 255, 0.6) -2px 0px 0px;
   padding: 4px 6px 6px 4px;
   top: 4px;
   left: 4px;
-  border-right: 1px solid rgba(73, 99, 119, 0.3);
-  border-bottom: 1px solid rgba(73, 99, 119, 0.3);
+  border-right: 1px solid rgba(0,0,0,0.2);
+  border-bottom: 1px solid rgba(0,0,0,0.2);
   height: 17px;
   width: 17px;
 }
@@ -62,11 +64,12 @@ body {
   right: 6px;
   width: 16px;
   height: 16px;
-  background: url(chrome://global/skin/icons/Close.gif) no-repeat;
-  -moz-transition-property: opacity;
-  -moz-transition-duration: 0.5s;
-  -moz-transition-timing-function: ease-out;
   opacity: 0.2;
+  background: url(chrome://global/skin/icons/Close.gif) no-repeat;
+}
+
+.close:hover {
+  opacity: 1.0;
 }
 
 .expander {
@@ -75,17 +78,10 @@ body {
   width: 16px;
   height: 16px;
   background: url(chrome://global/skin/icons/resizer.png) no-repeat;
-  -moz-transition-property: opacity;
-  -moz-transition-duration: 0.5s;
-  -moz-transition-timing-function: ease-out;
   opacity: 0.2;
 }
 
-.close:hover,
 .expander:hover {
-  -moz-transition-property: opacity;
-  -moz-transition-duration: 0.5s;
-  -moz-transition-timing-function: ease-out;
   opacity: 1.0;
 }
 
@@ -97,12 +93,11 @@ body {
 }
 
 .tab-title {
-  bottom: -20px;
+  top: 100%;
   text-align: center;
   width: 94.5%;
   white-space: nowrap;
   overflow: hidden;
-  text-shadow: 0 1px rgba(255, 255, 255, 0.6);
 }
 
 .stacked {
@@ -123,13 +118,8 @@ body {
   -moz-box-shadow: none !important;
 }
 
-.tab.focus {
-  -moz-box-shadow:
-    0 1px 0 #FFFFFF inset,
-    0 -1px 1px #FFFFFF inset,
-    1px 0 1px #FFFFFF inset,
-    -1px 0 1px #FFFFFF inset,
-    0 0 8px #007ECE;
+.focus {
+  -moz-box-shadow:  rgba(54,79,225,1) 0px 0px 5px -1px !important;
 }
 
 /* Tab: Zooming
@@ -143,11 +133,7 @@ body {
   display: none;
 }
 
-.front .thumb {
-  -moz-box-shadow: none !important;
-}
-
-.front.focus {
+.front .focus {
   -moz-box-shadow: none !important;
 }
 
@@ -155,24 +141,18 @@ body {
 ----------------------------------*/
 
 .tabInGroupItem {
-  -moz-box-shadow: none;
-  background-color: #E0EAF5;
-}
-
-.tabInGroupItem .favicon {
-  background-color: #E0EAF5;
+  border: none;
+  -moz-box-shadow: none !important;
 }
 
 .groupItem {
   cursor: move;
-  background-color: #E0EAF5;
+  border: 1px solid rgba(230,230,230,1);
+  background-color: rgba(248,248,248,1);
   -moz-border-radius: 0.4em;
   -moz-box-shadow:
-    0 1px 0 #FFFFFF inset,
-    0 -1px 1px rgba(255, 255, 255, 0.8) inset,
-    1px 0 1px rgba(255, 255, 255, 0.8) inset,
-    -1px 0 1px rgba(255, 255, 255, 0.8) inset,
-    0 1px 4px rgba(4, 38, 60, 0.6);
+    inset rgba(255, 255, 255, 0.6) 0 0 0 2px,
+    rgba(0,0,0,0.2) 1px 1px 4px;
 }
 
 .groupItem.activeGroupItem {
@@ -181,6 +161,7 @@ body {
 }
 
 .phantom {
+  border: 1px solid rgba(190,190,190,1);
 }
 
 .overlay {

From 71e47e6c5b8880c2769ca7997c022a87d2235a4d Mon Sep 17 00:00:00 2001
From: Alexander Surkov <surkov.alexander@gmail.com>
Date: Tue, 7 Sep 2010 11:41:53 +0900
Subject: [PATCH 211/222] Bug 592193 - add dexpcom version of
 nsIAccessible::role, part3: reduce amount of nsAccUtils::Role calls,
 r=marcoz, a=davidb

---
 accessible/src/base/AccGroupInfo.cpp          | 14 ++--
 accessible/src/base/AccGroupInfo.h            |  2 +-
 accessible/src/base/filters.cpp               |  4 +-
 accessible/src/base/nsARIAGridAccessible.cpp  | 80 +++++++++++--------
 accessible/src/base/nsAccUtils.cpp            |  6 +-
 .../src/base/nsAccessibilityService.cpp       |  2 +-
 accessible/src/base/nsAccessible.cpp          | 10 +--
 .../src/base/nsBaseWidgetAccessible.cpp       |  6 +-
 accessible/src/base/nsDocAccessible.cpp       |  7 +-
 accessible/src/base/nsEventShell.cpp          |  3 +-
 accessible/src/base/nsRootAccessible.cpp      | 27 ++++---
 accessible/src/base/nsTextEquivUtils.cpp      | 12 +--
 .../src/html/nsHTMLFormControlAccessible.cpp  |  5 +-
 .../src/html/nsHTMLSelectAccessible.cpp       |  8 +-
 accessible/src/html/nsHTMLTableAccessible.cpp | 27 +++----
 accessible/src/html/nsHyperTextAccessible.cpp |  9 +--
 accessible/src/mac/nsAccessibleWrap.mm        |  2 +-
 accessible/src/msaa/nsAccessibleWrap.cpp      |  6 +-
 accessible/src/msaa/nsDocAccessibleWrap.cpp   |  2 +-
 .../src/xul/nsXULColorPickerAccessible.cpp    |  2 +-
 .../src/xul/nsXULFormControlAccessible.cpp    |  4 +-
 accessible/src/xul/nsXULListboxAccessible.cpp | 54 +++++++------
 accessible/src/xul/nsXULMenuAccessible.cpp    | 12 +--
 accessible/src/xul/nsXULTextAccessible.cpp    |  8 +-
 24 files changed, 159 insertions(+), 153 deletions(-)

diff --git a/accessible/src/base/AccGroupInfo.cpp b/accessible/src/base/AccGroupInfo.cpp
index 07471f0897ed..35067d310065 100644
--- a/accessible/src/base/AccGroupInfo.cpp
+++ b/accessible/src/base/AccGroupInfo.cpp
@@ -52,7 +52,7 @@ AccGroupInfo::AccGroupInfo(nsAccessible* aItem, PRUint32 aRole) :
   mPosInSet = 1;
   for (PRInt32 idx = indexInParent - 1; idx >=0 ; idx--) {
     nsAccessible* sibling = parent->GetChildAt(idx);
-    PRUint32 siblingRole = nsAccUtils::Role(sibling);
+    PRUint32 siblingRole = sibling->Role();
 
     // If the sibling is separator then the group is ended.
     if (siblingRole == nsIAccessibleRole::ROLE_SEPARATOR)
@@ -96,7 +96,7 @@ AccGroupInfo::AccGroupInfo(nsAccessible* aItem, PRUint32 aRole) :
   for (PRInt32 idx = indexInParent + 1; idx < siblingCount; idx++) {
     nsAccessible* sibling = parent->GetChildAt(idx);
 
-    PRUint32 siblingRole = nsAccUtils::Role(sibling);
+    PRUint32 siblingRole = sibling->Role();
 
     // If the sibling is separator then the group is ended.
     if (siblingRole == nsIAccessibleRole::ROLE_SEPARATOR)
@@ -131,7 +131,7 @@ AccGroupInfo::AccGroupInfo(nsAccessible* aItem, PRUint32 aRole) :
     return;
 
   // Compute parent.
-  PRUint32 parentRole = nsAccUtils::Role(parent);
+  PRUint32 parentRole = parent->Role();
 
   // In the case of ARIA row in treegrid, return treegrid since ARIA
   // groups aren't used to organize levels in ARIA treegrids.
@@ -153,14 +153,18 @@ AccGroupInfo::AccGroupInfo(nsAccessible* aItem, PRUint32 aRole) :
   }
 
   nsAccessible* parentPrevSibling = parent->GetSiblingAtOffset(-1);
-  PRUint32 parentPrevSiblingRole = nsAccUtils::Role(parentPrevSibling);
+  if (!parentPrevSibling)
+    return;
+
+  PRUint32 parentPrevSiblingRole = parentPrevSibling->Role();
   if (parentPrevSiblingRole == nsIAccessibleRole::ROLE_TEXT_LEAF) {
     // XXX Sometimes an empty text accessible is in the hierarchy here,
     // although the text does not appear to be rendered, GetRenderedText()
     // says that it is so we need to skip past it to find the true
     // previous sibling.
     parentPrevSibling = parentPrevSibling->GetSiblingAtOffset(-1);
-    parentPrevSiblingRole = nsAccUtils::Role(parentPrevSibling);
+    if (parentPrevSibling)
+      parentPrevSiblingRole = parentPrevSibling->Role();
   }
 
   // Previous sibling of parent group is a tree item, this is the
diff --git a/accessible/src/base/AccGroupInfo.h b/accessible/src/base/AccGroupInfo.h
index 07351e82327a..ccba061d890d 100644
--- a/accessible/src/base/AccGroupInfo.h
+++ b/accessible/src/base/AccGroupInfo.h
@@ -59,7 +59,7 @@ public:
    */
   static AccGroupInfo* CreateGroupInfo(nsAccessible* aAccessible)
   {
-    PRUint32 role = nsAccUtils::Role(aAccessible);
+    PRUint32 role = aAccessible->Role();
     if (role != nsIAccessibleRole::ROLE_ROW &&
         role != nsIAccessibleRole::ROLE_GRID_CELL &&
         role != nsIAccessibleRole::ROLE_OUTLINEITEM &&
diff --git a/accessible/src/base/filters.cpp b/accessible/src/base/filters.cpp
index 929350206238..46e194b94fab 100644
--- a/accessible/src/base/filters.cpp
+++ b/accessible/src/base/filters.cpp
@@ -55,13 +55,13 @@ filters::GetSelectable(nsAccessible* aAccessible)
 bool
 filters::GetRow(nsAccessible* aAccessible)
 {
-  return nsAccUtils::Role(aAccessible) == nsIAccessibleRole::ROLE_ROW;
+  return aAccessible->Role() == nsIAccessibleRole::ROLE_ROW;
 }
 
 bool
 filters::GetCell(nsAccessible* aAccessible)
 {
-  PRUint32 role = nsAccUtils::Role(aAccessible);
+  PRUint32 role = aAccessible->Role();
   return role == nsIAccessibleRole::ROLE_GRID_CELL ||
       role == nsIAccessibleRole::ROLE_ROWHEADER ||
       role == nsIAccessibleRole::ROLE_COLUMNHEADER;
diff --git a/accessible/src/base/nsARIAGridAccessible.cpp b/accessible/src/base/nsARIAGridAccessible.cpp
index 3b76c7519a36..8a7211b530af 100644
--- a/accessible/src/base/nsARIAGridAccessible.cpp
+++ b/accessible/src/base/nsARIAGridAccessible.cpp
@@ -808,7 +808,7 @@ nsARIAGridAccessible::SetARIASelected(nsAccessible *aAccessible,
   if (aIsSelected)
     return NS_OK;
 
-  PRUint32 role = nsAccUtils::Role(aAccessible);
+  PRUint32 role = aAccessible->Role();
 
   // If the given accessible is row that was unselected then remove
   // aria-selected from cell accessible.
@@ -831,7 +831,7 @@ nsARIAGridAccessible::SetARIASelected(nsAccessible *aAccessible,
       role == nsIAccessibleRole::ROLE_COLUMNHEADER) {
     nsAccessible *row = aAccessible->GetParent();
 
-    if (nsAccUtils::Role(row) == nsIAccessibleRole::ROLE_ROW &&
+    if (row && row->Role() == nsIAccessibleRole::ROLE_ROW &&
         nsAccUtils::IsARIASelected(row)) {
       rv = SetARIASelected(row, PR_FALSE, PR_FALSE);
       NS_ENSURE_SUCCESS(rv, rv);
@@ -948,15 +948,17 @@ nsARIAGridCellAccessible::GetTable(nsIAccessibleTable **aTable)
   NS_ENSURE_ARG_POINTER(aTable);
   *aTable = nsnull;
 
-  nsCOMPtr<nsIAccessible> thisRow;
-  GetParent(getter_AddRefs(thisRow));
-  if (nsAccUtils::Role(thisRow) != nsIAccessibleRole::ROLE_ROW)
+  nsAccessible* thisRow = GetParent();
+  if (!thisRow || thisRow->Role() != nsIAccessibleRole::ROLE_ROW)
     return NS_OK;
 
-  nsCOMPtr<nsIAccessible> table;
-  thisRow->GetParent(getter_AddRefs(table));
-  if (nsAccUtils::Role(table) != nsIAccessibleRole::ROLE_TABLE &&
-      nsAccUtils::Role(table) != nsIAccessibleRole::ROLE_TREE_TABLE)
+  nsAccessible* table = thisRow->GetParent();
+  if (!table)
+    return NS_OK;
+
+  PRUint32 tableRole = table->Role();
+  if (tableRole != nsIAccessibleRole::ROLE_TABLE &&
+      tableRole != nsIAccessibleRole::ROLE_TREE_TABLE)
     return NS_OK;
 
   CallQueryInterface(table, aTable);
@@ -972,20 +974,20 @@ nsARIAGridCellAccessible::GetColumnIndex(PRInt32 *aColumnIndex)
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
+  nsAccessible* row = GetParent();
+  if (!row)
+    return NS_OK;
+
   *aColumnIndex = 0;
 
-  nsCOMPtr<nsIAccessible> prevCell, tmpAcc;
-  GetPreviousSibling(getter_AddRefs(prevCell));
-
-  while (prevCell) {
-    PRUint32 role = nsAccUtils::Role(prevCell);
+  PRInt32 indexInRow = GetIndexInParent();
+  for (PRInt32 idx = 0; idx < indexInRow; idx++) {
+    nsAccessible* cell = row->GetChildAt(idx);
+    PRUint32 role = cell->Role();
     if (role == nsIAccessibleRole::ROLE_GRID_CELL ||
         role == nsIAccessibleRole::ROLE_ROWHEADER ||
         role == nsIAccessibleRole::ROLE_COLUMNHEADER)
       (*aColumnIndex)++;
-
-    prevCell->GetPreviousSibling(getter_AddRefs(tmpAcc));
-    tmpAcc.swap(prevCell);
   }
 
   return NS_OK;
@@ -1000,15 +1002,21 @@ nsARIAGridCellAccessible::GetRowIndex(PRInt32 *aRowIndex)
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row, prevRow;
-  GetParent(getter_AddRefs(row));
+  nsAccessible* row = GetParent();
+  if (!row)
+    return NS_OK;
 
-  while (row) {
-    if (nsAccUtils::Role(row) == nsIAccessibleRole::ROLE_ROW)
+  nsAccessible* table = row->GetParent();
+  if (!table)
+    return NS_OK;
+
+  *aRowIndex = 0;
+
+  PRInt32 indexInTable = row->GetIndexInParent();
+  for (PRInt32 idx = 0; idx < indexInTable; idx++) {
+    row = table->GetChildAt(idx);
+    if (row->Role() == nsIAccessibleRole::ROLE_ROW)
       (*aRowIndex)++;
-
-    row->GetPreviousSibling(getter_AddRefs(prevRow));
-    row.swap(prevRow);
   }
 
   return NS_OK;
@@ -1088,7 +1096,7 @@ nsARIAGridCellAccessible::IsSelected(PRBool *aIsSelected)
     return NS_ERROR_FAILURE;
 
   nsAccessible *row = GetParent();
-  if (nsAccUtils::Role(row) != nsIAccessibleRole::ROLE_ROW)
+  if (!row || row->Role() != nsIAccessibleRole::ROLE_ROW)
     return NS_OK;
 
   if (!nsAccUtils::IsARIASelected(row) && !nsAccUtils::IsARIASelected(this))
@@ -1112,8 +1120,8 @@ nsARIAGridCellAccessible::GetARIAState(PRUint32 *aState, PRUint32 *aExtraState)
     return NS_OK;
 
   // Check aria-selected="true" on the row.
-  nsAccessible *row = GetParent();
-  if (nsAccUtils::Role(row) != nsIAccessibleRole::ROLE_ROW)
+  nsAccessible* row = GetParent();
+  if (!row || row->Role() != nsIAccessibleRole::ROLE_ROW)
     return NS_OK;
 
   nsIContent *rowContent = row->GetContent();
@@ -1141,8 +1149,8 @@ nsARIAGridCellAccessible::GetAttributesInternal(nsIPersistentProperties *aAttrib
 
   // Expose "table-cell-index" attribute.
 
-  nsAccessible *thisRow = GetParent();
-  if (nsAccUtils::Role(thisRow) != nsIAccessibleRole::ROLE_ROW)
+  nsAccessible* thisRow = GetParent();
+  if (!thisRow || thisRow->Role() != nsIAccessibleRole::ROLE_ROW)
     return NS_OK;
 
   PRInt32 colIdx = 0, colCount = 0;
@@ -1152,16 +1160,20 @@ nsARIAGridCellAccessible::GetAttributesInternal(nsIPersistentProperties *aAttrib
     if (child == this)
       colIdx = colCount;
 
-    PRUint32 role = nsAccUtils::Role(child);
+    PRUint32 role = child->Role();
     if (role == nsIAccessibleRole::ROLE_GRID_CELL ||
         role == nsIAccessibleRole::ROLE_ROWHEADER ||
         role == nsIAccessibleRole::ROLE_COLUMNHEADER)
       colCount++;
   }
 
-  nsAccessible *table = thisRow->GetParent();
-  if (nsAccUtils::Role(table) != nsIAccessibleRole::ROLE_TABLE &&
-      nsAccUtils::Role(table) != nsIAccessibleRole::ROLE_TREE_TABLE)
+  nsAccessible* table = thisRow->GetParent();
+  if (!table)
+    return NS_OK;
+
+  PRUint32 tableRole = table->Role();
+  if (tableRole != nsIAccessibleRole::ROLE_TABLE &&
+      tableRole != nsIAccessibleRole::ROLE_TREE_TABLE)
     return NS_OK;
 
   PRInt32 rowIdx = 0;
@@ -1171,7 +1183,7 @@ nsARIAGridCellAccessible::GetAttributesInternal(nsIPersistentProperties *aAttrib
     if (child == thisRow)
       break;
 
-    if (nsAccUtils::Role(child) == nsIAccessibleRole::ROLE_ROW)
+    if (child->Role() == nsIAccessibleRole::ROLE_ROW)
       rowIdx++;
   }
 
diff --git a/accessible/src/base/nsAccUtils.cpp b/accessible/src/base/nsAccUtils.cpp
index eaec26033984..e8295019ed8b 100644
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -103,14 +103,14 @@ nsAccUtils::SetAccGroupAttrs(nsIPersistentProperties *aAttributes,
 PRInt32
 nsAccUtils::GetDefaultLevel(nsAccessible *aAccessible)
 {
-  PRUint32 role = nsAccUtils::Role(aAccessible);
+  PRUint32 role = aAccessible->Role();
 
   if (role == nsIAccessibleRole::ROLE_OUTLINEITEM)
     return 1;
 
   if (role == nsIAccessibleRole::ROLE_ROW) {
     nsAccessible *parent = aAccessible->GetParent();
-    if (Role(parent) == nsIAccessibleRole::ROLE_TREE_TABLE) {
+    if (parent && parent->Role() == nsIAccessibleRole::ROLE_TREE_TABLE) {
       // It is a row inside flatten treegrid. Group level is always 1 until it
       // is overriden by aria-level attribute.
       return 1;
@@ -357,7 +357,7 @@ nsAccUtils::GetAncestorWithRole(nsAccessible *aDescendant, PRUint32 aRole)
   nsAccessible *document = aDescendant->GetDocAccessible();
   nsAccessible *parent = aDescendant;
   while ((parent = parent->GetParent())) {
-    PRUint32 testRole = nsAccUtils::Role(parent);
+    PRUint32 testRole = parent->Role();
     if (testRole == aRole)
       return parent;
 
diff --git a/accessible/src/base/nsAccessibilityService.cpp b/accessible/src/base/nsAccessibilityService.cpp
index 5341394764b6..02e1ffa30f84 100644
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -943,7 +943,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
 
           if (tableAccessible) {
             if (!roleMapEntry) {
-              PRUint32 role = nsAccUtils::Role(tableAccessible);
+              PRUint32 role = tableAccessible->Role();
               if (role != nsIAccessibleRole::ROLE_TABLE &&
                   role != nsIAccessibleRole::ROLE_TREE_TABLE) {
                 // No ARIA role and not in table: override role. For example,
diff --git a/accessible/src/base/nsAccessible.cpp b/accessible/src/base/nsAccessible.cpp
index ada3cea942f8..5f7dd1be76b5 100644
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -1832,7 +1832,7 @@ nsAccessible::Role()
   } else if (mRoleMapEntry->role == nsIAccessibleRole::ROLE_LISTBOX) {
     // A listbox inside of a combobox needs a special role because of ATK
     // mapping to menu.
-    if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX) {
+    if (mParent && mParent->Role() == nsIAccessibleRole::ROLE_COMBOBOX) {
       return nsIAccessibleRole::ROLE_COMBOBOX_LIST;
 
       nsCOMPtr<nsIAccessible> possibleCombo =
@@ -1843,7 +1843,7 @@ nsAccessible::Role()
     }
 
   } else if (mRoleMapEntry->role == nsIAccessibleRole::ROLE_OPTION) {
-    if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
+    if (mParent && mParent->Role() == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
       return nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
   }
 
@@ -3352,7 +3352,7 @@ nsAccessible::GetLevelInternal()
 {
   PRInt32 level = nsAccUtils::GetDefaultLevel(this);
 
-  PRUint32 role = nsAccUtils::Role(this);
+  PRUint32 role = Role();
   nsAccessible* parent = GetParent();
 
   if (role == nsIAccessibleRole::ROLE_OUTLINEITEM) {
@@ -3362,7 +3362,7 @@ nsAccessible::GetLevelInternal()
     level = 1;
 
     while (parent) {
-      PRUint32 parentRole = nsAccUtils::Role(parent);
+      PRUint32 parentRole = parent->Role();
 
       if (parentRole == nsIAccessibleRole::ROLE_OUTLINE)
         break;
@@ -3382,7 +3382,7 @@ nsAccessible::GetLevelInternal()
     level = 0;
 
     while (parent) {
-      PRUint32 parentRole = nsAccUtils::Role(parent);
+      PRUint32 parentRole = parent->Role();
 
       if (parentRole == nsIAccessibleRole::ROLE_LISTITEM)
         ++ level;
diff --git a/accessible/src/base/nsBaseWidgetAccessible.cpp b/accessible/src/base/nsBaseWidgetAccessible.cpp
index db316e5c2f89..3024209dab50 100644
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -257,17 +257,17 @@ nsLinkableAccessible::CacheActionContent()
   }
 
   while ((walkUpContent = walkUpContent->GetParent())) {
-    isOnclick = nsCoreUtils::HasClickListener(walkUpContent);
-    nsAccessible *walkUpAcc =
+    nsAccessible* walkUpAcc =
       GetAccService()->GetAccessibleInWeakShell(walkUpContent, mWeakShell);
 
-    if (nsAccUtils::Role(walkUpAcc) == nsIAccessibleRole::ROLE_LINK &&
+    if (walkUpAcc && walkUpAcc->Role() == nsIAccessibleRole::ROLE_LINK &&
         nsAccUtils::State(walkUpAcc) & nsIAccessibleStates::STATE_LINKED) {
       mIsLink = PR_TRUE;
       mActionContent = walkUpContent;
       return;
     }
 
+    isOnclick = nsCoreUtils::HasClickListener(walkUpContent);
     if (isOnclick) {
       mActionContent = walkUpContent;
       mIsOnclick = PR_TRUE;
diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
index e4ab3e490449..ef72c74f7f04 100644
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -1285,7 +1285,7 @@ nsDocAccessible::HandleAccEvent(AccEvent* aAccEvent)
 void
 nsDocAccessible::FireValueChangeForTextFields(nsAccessible *aAccessible)
 {
-  if (nsAccUtils::Role(aAccessible) != nsIAccessibleRole::ROLE_ENTRY)
+  if (aAccessible->Role() != nsIAccessibleRole::ROLE_ENTRY)
     return;
 
   // Dependent value change event for text changes in textfields
@@ -1372,7 +1372,7 @@ nsDocAccessible::CreateTextChangeEventForNode(nsAccessible *aContainerAccessible
   PRInt32 offset = 0;
   if (aChangeChild) {
     // Don't fire event for the first html:br in an editor.
-    if (nsAccUtils::Role(aChangeChild) == nsIAccessibleRole::ROLE_WHITESPACE) {
+    if (aChangeChild->Role() == nsIAccessibleRole::ROLE_WHITESPACE) {
       nsCOMPtr<nsIEditor> editor;
       textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
       if (editor) {
@@ -1624,8 +1624,7 @@ nsDocAccessible::RefreshNodes(nsINode *aStartNode)
   nsAccessible *accessible = GetCachedAccessible(aStartNode);
   if (accessible) {
     // Fire menupopup end if a menu goes away
-    PRUint32 role = nsAccUtils::Role(accessible);
-    if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
+    if (accessible->Role() == nsIAccessibleRole::ROLE_MENUPOPUP) {
       nsCOMPtr<nsIDOMXULPopupElement> popup(do_QueryInterface(aStartNode));
       if (!popup) {
         // Popup elements already fire these via DOMMenuInactive
diff --git a/accessible/src/base/nsEventShell.cpp b/accessible/src/base/nsEventShell.cpp
index eece39c0f8a2..bf1856022033 100644
--- a/accessible/src/base/nsEventShell.cpp
+++ b/accessible/src/base/nsEventShell.cpp
@@ -532,8 +532,7 @@ nsAccEventQueue::CreateTextChangeEventFor(AccHideEvent* aEvent)
     return;
 
   // Don't fire event for the first html:br in an editor.
-  if (nsAccUtils::Role(aEvent->mAccessible) ==
-      nsIAccessibleRole::ROLE_WHITESPACE) {
+  if (aEvent->mAccessible->Role() == nsIAccessibleRole::ROLE_WHITESPACE) {
     nsCOMPtr<nsIEditor> editor;
     textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
     if (editor) {
diff --git a/accessible/src/base/nsRootAccessible.cpp b/accessible/src/base/nsRootAccessible.cpp
index fedd396e2b7f..de222db7c148 100644
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@@ -385,7 +385,7 @@ nsRootAccessible::FireAccessibleFocusEvent(nsAccessible *aAccessible,
   }
 
   gLastFocusedAccessiblesState = nsAccUtils::State(finalFocusAccessible);
-  PRUint32 role = nsAccUtils::Role(finalFocusAccessible);
+  PRUint32 role = finalFocusAccessible->Role();
   if (role == nsIAccessibleRole::ROLE_MENUITEM) {
     if (!mCurrentARIAMenubar) {  // Entering menus
       // The natural role is the role that this type of element normally has
@@ -673,7 +673,7 @@ nsRootAccessible::HandleEvent(nsIDOMEvent* aEvent)
     HandlePopupShownEvent(accessible);
   }
   else if (eventType.EqualsLiteral("DOMMenuInactive")) {
-    if (nsAccUtils::Role(accessible) == nsIAccessibleRole::ROLE_MENUPOPUP) {
+    if (accessible->Role() == nsIAccessibleRole::ROLE_MENUPOPUP) {
       nsEventShell::FireEvent(nsIAccessibleEvent::EVENT_MENUPOPUP_END,
                               accessible);
     }
@@ -707,7 +707,7 @@ nsRootAccessible::HandleEvent(nsIDOMEvent* aEvent)
         if (nsAccUtils::State(containerAccessible) & nsIAccessibleStates::STATE_COLLAPSED) {
           nsAccessible *containerParent = containerAccessible->GetParent();
           NS_ENSURE_TRUE(containerParent, NS_ERROR_FAILURE);
-          if (nsAccUtils::Role(containerParent) != nsIAccessibleRole::ROLE_COMBOBOX) {
+          if (containerParent->Role() != nsIAccessibleRole::ROLE_COMBOBOX) {
             return NS_OK;
           }
         }
@@ -856,7 +856,7 @@ nsRootAccessible::GetRelationByType(PRUint32 aRelationType,
 nsresult
 nsRootAccessible::HandlePopupShownEvent(nsAccessible *aAccessible)
 {
-  PRUint32 role = nsAccUtils::Role(aAccessible);
+  PRUint32 role = aAccessible->Role();
 
   if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
     // Don't fire menupopup events for combobox and autocomplete lists.
@@ -876,12 +876,14 @@ nsRootAccessible::HandlePopupShownEvent(nsAccessible *aAccessible)
 
   if (role == nsIAccessibleRole::ROLE_COMBOBOX_LIST) {
     // Fire expanded state change event for comboboxes and autocompeletes.
-    nsAccessible *comboboxAcc = aAccessible->GetParent();
-    PRUint32 comboboxRole = nsAccUtils::Role(comboboxAcc);
+    nsAccessible* combobox = aAccessible->GetParent();
+    NS_ENSURE_STATE(combobox);
+
+    PRUint32 comboboxRole = combobox->Role();
     if (comboboxRole == nsIAccessibleRole::ROLE_COMBOBOX ||
         comboboxRole == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
       nsRefPtr<AccEvent> event =
-        new AccStateChangeEvent(comboboxAcc,
+        new AccStateChangeEvent(combobox,
                                 nsIAccessibleStates::STATE_EXPANDED,
                                 PR_FALSE, PR_TRUE);
       NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
@@ -914,16 +916,17 @@ nsRootAccessible::HandlePopupHidingEvent(nsINode *aNode,
   if (!aAccessible)
     return NS_OK;
 
-  PRUint32 role = nsAccUtils::Role(aAccessible);
-  if (role != nsIAccessibleRole::ROLE_COMBOBOX_LIST)
+  if (aAccessible->Role() != nsIAccessibleRole::ROLE_COMBOBOX_LIST)
     return NS_OK;
 
-  nsAccessible *comboboxAcc = aAccessible->GetParent();
-  PRUint32 comboboxRole = nsAccUtils::Role(comboboxAcc);
+  nsAccessible* combobox = aAccessible->GetParent();
+  NS_ENSURE_STATE(combobox);
+
+  PRUint32 comboboxRole = combobox->Role();
   if (comboboxRole == nsIAccessibleRole::ROLE_COMBOBOX ||
       comboboxRole == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
     nsRefPtr<AccEvent> event =
-      new AccStateChangeEvent(comboboxAcc,
+      new AccStateChangeEvent(combobox,
                               nsIAccessibleStates::STATE_EXPANDED,
                               PR_FALSE, PR_FALSE);
     NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
diff --git a/accessible/src/base/nsTextEquivUtils.cpp b/accessible/src/base/nsTextEquivUtils.cpp
index 72dd20957f70..0abdb8073c48 100644
--- a/accessible/src/base/nsTextEquivUtils.cpp
+++ b/accessible/src/base/nsTextEquivUtils.cpp
@@ -64,9 +64,7 @@ nsTextEquivUtils::GetNameFromSubtree(nsAccessible *aAccessible,
 
   gInitiatorAcc = aAccessible;
 
-  PRUint32 role = nsAccUtils::Role(aAccessible);
-  PRUint32 nameRule = gRoleToNameRulesMap[role];
-
+  PRUint32 nameRule = gRoleToNameRulesMap[aAccessible->Role()];
   if (nameRule == eFromSubtree) {
     //XXX: is it necessary to care the accessible is not a document?
     if (aAccessible->IsContent()) {
@@ -269,9 +267,7 @@ nsTextEquivUtils::AppendFromAccessible(nsAccessible *aAccessible,
   // into subtree if accessible allows "text equivalent from subtree rule" or
   // it's not root and not control.
   if (isEmptyTextEquiv) {
-    PRUint32 role = nsAccUtils::Role(aAccessible);
-    PRUint32 nameRule = gRoleToNameRulesMap[role];
-
+    PRUint32 nameRule = gRoleToNameRulesMap[aAccessible->Role()];
     if (nameRule & eFromSubtreeIfRec) {
       rv = AppendFromAccessibleChildren(aAccessible, aString);
       NS_ENSURE_SUCCESS(rv, rv);
@@ -294,9 +290,7 @@ nsresult
 nsTextEquivUtils::AppendFromValue(nsAccessible *aAccessible,
                                   nsAString *aString)
 {
-  PRUint32 role = nsAccUtils::Role(aAccessible);
-  PRUint32 nameRule = gRoleToNameRulesMap[role];
-
+  PRUint32 nameRule = gRoleToNameRulesMap[aAccessible->Role()];
   if (nameRule != eFromValue)
     return NS_OK_NO_NAME_CLAUSE_HANDLED;
 
diff --git a/accessible/src/html/nsHTMLFormControlAccessible.cpp b/accessible/src/html/nsHTMLFormControlAccessible.cpp
index 15d5836a33a3..1645431bbb9f 100644
--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
+++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
@@ -460,7 +460,8 @@ nsHTMLTextFieldAccessible::GetStateInternal(PRUint32 *aState,
     *aState |= nsIAccessibleStates::STATE_PROTECTED;
   }
   else {
-    if (nsAccUtils::Role(GetParent()) == nsIAccessibleRole::ROLE_AUTOCOMPLETE)
+    nsAccessible* parent = GetParent();
+    if (parent && parent->Role() == nsIAccessibleRole::ROLE_AUTOCOMPLETE)
       *aState |= nsIAccessibleStates::STATE_HASPOPUP;
   }
 
@@ -662,7 +663,7 @@ nsHTMLLegendAccessible::GetRelationByType(PRUint32 aRelationType,
     // Look for groupbox parent
     nsAccessible* groupbox = GetParent();
 
-    if (nsAccUtils::Role(groupbox) == nsIAccessibleRole::ROLE_GROUPING) {
+    if (groupbox && groupbox->Role() == nsIAccessibleRole::ROLE_GROUPING) {
       // XXX: if group box exposes more than one relation of the given type
       // then we fail.
       nsCOMPtr<nsIAccessible> testLabelAccessible =
diff --git a/accessible/src/html/nsHTMLSelectAccessible.cpp b/accessible/src/html/nsHTMLSelectAccessible.cpp
index 276f5894f748..41ebec1b23be 100644
--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
@@ -104,7 +104,7 @@ nsHTMLSelectListAccessible::GetStateInternal(PRUint32 *aState,
 PRUint32
 nsHTMLSelectListAccessible::NativeRole()
 {
-  if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX)
+  if (mParent && mParent->Role() == nsIAccessibleRole::ROLE_COMBOBOX)
     return nsIAccessibleRole::ROLE_COMBOBOX_LIST;
 
   return nsIAccessibleRole::ROLE_LISTBOX;
@@ -199,7 +199,7 @@ nsHTMLSelectOptionAccessible::
 PRUint32
 nsHTMLSelectOptionAccessible::NativeRole()
 {
-  if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
+  if (mParent && mParent->Role() == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
     return nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
 
   return nsIAccessibleRole::ROLE_OPTION;
@@ -348,10 +348,8 @@ nsHTMLSelectOptionAccessible::GetLevelInternal()
   PRInt32 level =
     parentContent->NodeInfo()->Equals(nsAccessibilityAtoms::optgroup) ? 2 : 1;
 
-  if (level == 1 &&
-      nsAccUtils::Role(this) != nsIAccessibleRole::ROLE_HEADING) {
+  if (level == 1 && Role() != nsIAccessibleRole::ROLE_HEADING)
     level = 0; // In a single level list, the level is irrelevant
-  }
 
   return level;
 }
diff --git a/accessible/src/html/nsHTMLTableAccessible.cpp b/accessible/src/html/nsHTMLTableAccessible.cpp
index 6eed6dc2387b..a72dbc63fa66 100644
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -267,20 +267,15 @@ nsHTMLTableCellAccessible::IsSelected(PRBool *aIsSelected)
 already_AddRefed<nsIAccessibleTable>
 nsHTMLTableCellAccessible::GetTableAccessible()
 {
-  nsCOMPtr<nsIAccessible> childAcc(this), parentAcc;
-  childAcc->GetParent(getter_AddRefs(parentAcc));
-
-  while (parentAcc) {
-    PRUint32 role = nsAccUtils::Role(parentAcc);
+  nsAccessible* parent = this;
+  while ((parent = parent->GetParent())) {
+    PRUint32 role = parent->Role();
     if (role == nsIAccessibleRole::ROLE_TABLE ||
         role == nsIAccessibleRole::ROLE_TREE_TABLE) {
       nsIAccessibleTable* tableAcc = nsnull;
-      CallQueryInterface(parentAcc, &tableAcc);
+      CallQueryInterface(parent, &tableAcc);
       return tableAcc;
     }
-
-    parentAcc.swap(childAcc);
-    childAcc->GetParent(getter_AddRefs(parentAcc));
   }
 
   return nsnull;
@@ -334,9 +329,9 @@ nsHTMLTableCellAccessible::GetHeaderCells(PRInt32 aRowOrColumnHeaderCell,
 
         if (headerCell &&
             (aRowOrColumnHeaderCell == nsAccUtils::eRowHeaderCells &&
-             nsAccUtils::Role(headerCell) == nsIAccessibleRole::ROLE_ROWHEADER ||
+             headerCell->Role() == nsIAccessibleRole::ROLE_ROWHEADER ||
              aRowOrColumnHeaderCell == nsAccUtils::eColumnHeaderCells &&
-             nsAccUtils::Role(headerCell) == nsIAccessibleRole::ROLE_COLUMNHEADER))
+             headerCell->Role() == nsIAccessibleRole::ROLE_COLUMNHEADER))
           headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
                                      PR_FALSE);
       }
@@ -453,7 +448,7 @@ nsHTMLTableAccessible::CacheChildren()
 
   nsRefPtr<nsAccessible> child;
   while ((child = walker.GetNextChild())) {
-    if (nsAccUtils::Role(child) == nsIAccessibleRole::ROLE_CAPTION) {
+    if (child->Role() == nsIAccessibleRole::ROLE_CAPTION) {
       InsertChildAt(0, child);
       while ((child = walker.GetNextChild()) && AppendChild(child));
       break;
@@ -532,9 +527,8 @@ nsHTMLTableAccessible::GetRelationByType(PRUint32 aRelationType,
 NS_IMETHODIMP
 nsHTMLTableAccessible::GetCaption(nsIAccessible **aCaption)
 {
-  nsCOMPtr<nsIAccessible> firstChild;
-  GetFirstChild(getter_AddRefs(firstChild));
-  if (nsAccUtils::Role(firstChild) == nsIAccessibleRole::ROLE_CAPTION)
+  nsAccessible* firstChild = GetChildAt(0);
+  if (firstChild && firstChild->Role() == nsIAccessibleRole::ROLE_CAPTION)
     NS_ADDREF(*aCaption = firstChild);
 
   return NS_OK;
@@ -1389,8 +1383,7 @@ nsHTMLTableAccessible::IsProbablyForLayout(PRBool *aIsProbablyForLayout)
 
   // Check to see if an ARIA role overrides the role from native markup,
   // but for which we still expose table semantics (treegrid, for example).
-  PRBool hasNonTableRole =
-    (nsAccUtils::Role(this) != nsIAccessibleRole::ROLE_TABLE);
+  PRBool hasNonTableRole = (Role() != nsIAccessibleRole::ROLE_TABLE);
   if (hasNonTableRole) {
     RETURN_LAYOUT_ANSWER(PR_FALSE, "Has role attribute");
   }
diff --git a/accessible/src/html/nsHyperTextAccessible.cpp b/accessible/src/html/nsHyperTextAccessible.cpp
index fe02c1020cf0..f2e487e285e4 100644
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -279,8 +279,7 @@ nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
   PRInt32 startOffset = aStartOffset;
   PRInt32 endOffset = aEndOffset;
   // XXX this prevents text interface usage on <input type="password">
-  PRBool isPassword =
-    (nsAccUtils::Role(this) == nsIAccessibleRole::ROLE_PASSWORD_TEXT);
+  PRBool isPassword = (Role() == nsIAccessibleRole::ROLE_PASSWORD_TEXT);
 
   // Clear out parameters and set up loop
   if (aText) {
@@ -804,7 +803,7 @@ nsHyperTextAccessible::GetRelativeOffset(nsIPresShell *aPresShell,
     nsAccessible *firstChild = mChildren.SafeElementAt(0, nsnull);
     // For line selection with needsStart, set start of line exactly to line break
     if (pos.mContentOffset == 0 && firstChild &&
-        nsAccUtils::Role(firstChild) == nsIAccessibleRole::ROLE_STATICTEXT &&
+        firstChild->Role() == nsIAccessibleRole::ROLE_STATICTEXT &&
         static_cast<PRInt32>(nsAccUtils::TextLength(firstChild)) == hyperTextOffset) {
       // XXX Bullet hack -- we should remove this once list bullets use anonymous content
       hyperTextOffset = 0;
@@ -816,7 +815,7 @@ nsHyperTextAccessible::GetRelativeOffset(nsIPresShell *aPresShell,
   else if (aAmount == eSelectEndLine && finalAccessible) { 
     // If not at very end of hypertext, we may need change the end of line offset by 1, 
     // to make sure we are in the right place relative to the line ending
-    if (nsAccUtils::Role(finalAccessible) == nsIAccessibleRole::ROLE_WHITESPACE) {  // Landed on <br> hard line break
+    if (finalAccessible->Role() == nsIAccessibleRole::ROLE_WHITESPACE) {  // Landed on <br> hard line break
       // if aNeedsStart, set end of line exactly 1 character past line break
       // XXX It would be cleaner if we did not have to have the hard line break check,
       // and just got the correct results from PeekOffset() for the <br> case -- the returned offset should
@@ -983,7 +982,7 @@ nsresult nsHyperTextAccessible::GetTextHelper(EGetTextType aType, nsAccessibleTe
     nsRefPtr<nsAccessible> endAcc;
     nsIFrame *endFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
                                        nsnull, getter_AddRefs(endAcc));
-    if (nsAccUtils::Role(endAcc) == nsIAccessibleRole::ROLE_STATICTEXT) {
+    if (endAcc && endAcc->Role() == nsIAccessibleRole::ROLE_STATICTEXT) {
       // Static text like list bullets will ruin our forward calculation,
       // since the caret cannot be in the static text. Start just after the static text.
       startOffset = endOffset = finalStartOffset +
diff --git a/accessible/src/mac/nsAccessibleWrap.mm b/accessible/src/mac/nsAccessibleWrap.mm
index c42be777bfd0..6cf75c146ac8 100644
--- a/accessible/src/mac/nsAccessibleWrap.mm
+++ b/accessible/src/mac/nsAccessibleWrap.mm
@@ -104,7 +104,7 @@ nsAccessibleWrap::GetNativeType ()
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
-  PRUint32 role = nsAccUtils::Role(this);
+  PRUint32 role = Role();
   switch (role) {
     case nsIAccessibleRole::ROLE_PUSHBUTTON:
     case nsIAccessibleRole::ROLE_SPLITBUTTON:
diff --git a/accessible/src/msaa/nsAccessibleWrap.cpp b/accessible/src/msaa/nsAccessibleWrap.cpp
index b94a3737740d..5a102f9f0d95 100644
--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@@ -408,7 +408,8 @@ __try {
   // a ROLE_OUTLINEITEM for consistency and compatibility.
   // We need this because ARIA has a role of "row" for both grid and treegrid
   if (xpRole == nsIAccessibleRole::ROLE_ROW) {
-    if (nsAccUtils::Role(GetParent()) == nsIAccessibleRole::ROLE_TREE_TABLE)
+    nsAccessible* xpParent = GetParent();
+    if (xpParent && xpParent->Role() == nsIAccessibleRole::ROLE_TREE_TABLE)
       msaaRole = ROLE_SYSTEM_OUTLINEITEM;
   }
   
@@ -1198,7 +1199,8 @@ __try {
   // Special case, if there is a ROLE_ROW inside of a ROLE_TREE_TABLE, then call
   // the IA2 role a ROLE_OUTLINEITEM.
   if (xpRole == nsIAccessibleRole::ROLE_ROW) {
-    if (nsAccUtils::Role(GetParent()) == nsIAccessibleRole::ROLE_TREE_TABLE)
+    nsAccessible* xpParent = GetParent();
+    if (xpParent && xpParent->Role() == nsIAccessibleRole::ROLE_TREE_TABLE)
       *aRole = ROLE_SYSTEM_OUTLINEITEM;
   }
 
diff --git a/accessible/src/msaa/nsDocAccessibleWrap.cpp b/accessible/src/msaa/nsDocAccessibleWrap.cpp
index 4e9716f353ee..8fc4d693b55a 100644
--- a/accessible/src/msaa/nsDocAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsDocAccessibleWrap.cpp
@@ -262,7 +262,7 @@ STDMETHODIMP nsDocAccessibleWrap::get_accValue(
   if (FAILED(hr) || *pszValue || varChild.lVal != CHILDID_SELF)
     return hr;
   // If document is being used to create a widget, don't use the URL hack
-  PRUint32 role = nsAccUtils::Role(this);
+  PRUint32 role = Role();
   if (role != nsIAccessibleRole::ROLE_DOCUMENT &&
       role != nsIAccessibleRole::ROLE_APPLICATION &&
       role != nsIAccessibleRole::ROLE_DIALOG &&
diff --git a/accessible/src/xul/nsXULColorPickerAccessible.cpp b/accessible/src/xul/nsXULColorPickerAccessible.cpp
index abbb53614765..b5792cb0f3b6 100644
--- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
+++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
@@ -164,7 +164,7 @@ nsXULColorPickerAccessible::CacheChildren()
 
   nsRefPtr<nsAccessible> child;
   while ((child = walker.GetNextChild())) {
-    PRUint32 role = nsAccUtils::Role(child);
+    PRUint32 role = child->Role();
 
     // Get an accessbile for menupopup or panel elements.
     if (role == nsIAccessibleRole::ROLE_ALERT) {
diff --git a/accessible/src/xul/nsXULFormControlAccessible.cpp b/accessible/src/xul/nsXULFormControlAccessible.cpp
index 5ddbf71ddeee..9106507e4268 100644
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -211,7 +211,7 @@ nsXULButtonAccessible::CacheChildren()
 
   nsRefPtr<nsAccessible> child;
   while ((child = walker.GetNextChild())) {
-    PRUint32 role = nsAccUtils::Role(child);
+    PRUint32 role = child->Role();
 
     if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
       // Get an accessbile for menupopup or panel elements.
@@ -476,7 +476,7 @@ nsXULGroupboxAccessible::GetRelationByType(PRUint32 aRelationType,
     PRInt32 childCount = GetChildCount();
     for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
       nsAccessible *childAcc = GetChildAt(childIdx);
-      if (nsAccUtils::Role(childAcc) == nsIAccessibleRole::ROLE_LABEL) {
+      if (childAcc->Role() == nsIAccessibleRole::ROLE_LABEL) {
         // Ensure that it's our label
         // XXX: we'll fail if group accessible expose more than one relation
         // targets.
diff --git a/accessible/src/xul/nsXULListboxAccessible.cpp b/accessible/src/xul/nsXULListboxAccessible.cpp
index 453a19e02d73..f38018caf929 100644
--- a/accessible/src/xul/nsXULListboxAccessible.cpp
+++ b/accessible/src/xul/nsXULListboxAccessible.cpp
@@ -642,7 +642,7 @@ nsXULListboxAccessible::GetSelectedCells(nsIArray **aCells)
       PRInt32 cellCount = item->GetChildCount();
       for (PRInt32 cellIdx = 0; cellIdx < cellCount; cellIdx++) {
         nsAccessible *cell = mChildren[cellIdx];
-        if (nsAccUtils::Role(cell) == nsIAccessibleRole::ROLE_CELL)
+        if (cell->Role() == nsIAccessibleRole::ROLE_CELL)
           selCells->AppendElement(static_cast<nsIAccessible*>(cell), PR_FALSE);
       }
     }
@@ -925,13 +925,13 @@ nsXULListitemAccessible::NativeRole()
     return nsIAccessibleRole::ROLE_NOTHING;
   }
 
-  if (nsAccUtils::Role(list) == nsIAccessibleRole::ROLE_TABLE)
+  if (list->Role() == nsIAccessibleRole::ROLE_TABLE)
     return nsIAccessibleRole::ROLE_ROW;
 
   if (mIsCheckbox)
     return nsIAccessibleRole::ROLE_CHECKBUTTON;
 
-  if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
+  if (mParent && mParent->Role() == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
     return nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
 
   return nsIAccessibleRole::ROLE_RICH_OPTION;
@@ -1040,14 +1040,12 @@ nsXULListCellAccessible::GetTable(nsIAccessibleTable **aTable)
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> thisRow;
-  GetParent(getter_AddRefs(thisRow));
-  if (nsAccUtils::Role(thisRow) != nsIAccessibleRole::ROLE_ROW)
+  nsAccessible* thisRow = GetParent();
+  if (!thisRow || thisRow->Role() != nsIAccessibleRole::ROLE_ROW)
     return NS_OK;
 
-  nsCOMPtr<nsIAccessible> table;
-  thisRow->GetParent(getter_AddRefs(table));
-  if (nsAccUtils::Role(table) != nsIAccessibleRole::ROLE_TABLE)
+  nsAccessible* table = thisRow->GetParent();
+  if (!table || table->Role() != nsIAccessibleRole::ROLE_TABLE)
     return NS_OK;
 
   CallQueryInterface(table, aTable);
@@ -1063,21 +1061,21 @@ nsXULListCellAccessible::GetColumnIndex(PRInt32 *aColumnIndex)
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
+  nsAccessible* row = GetParent();
+  if (!row)
+    return NS_OK;
+
   *aColumnIndex = 0;
 
-  nsCOMPtr<nsIAccessible> prevCell, tmpAcc;
-  GetPreviousSibling(getter_AddRefs(prevCell));
-
-  while (prevCell) {
-    PRUint32 role = nsAccUtils::Role(prevCell);
+  PRInt32 indexInRow = GetIndexInParent();
+  for (PRInt32 idx = 0; idx < indexInRow; idx++) {
+    nsAccessible* cell = row->GetChildAt(idx);
+    PRUint32 role = cell->Role();
     if (role == nsIAccessibleRole::ROLE_CELL ||
         role == nsIAccessibleRole::ROLE_GRID_CELL ||
         role == nsIAccessibleRole::ROLE_ROWHEADER ||
         role == nsIAccessibleRole::ROLE_COLUMNHEADER)
       (*aColumnIndex)++;
-
-    prevCell->GetPreviousSibling(getter_AddRefs(tmpAcc));
-    tmpAcc.swap(prevCell);
   }
 
   return NS_OK;
@@ -1092,15 +1090,21 @@ nsXULListCellAccessible::GetRowIndex(PRInt32 *aRowIndex)
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row, prevRow;
-  GetParent(getter_AddRefs(row));
+  nsAccessible* row = GetParent();
+  if (!row)
+    return NS_OK;
 
-  while (row) {
-    if (nsAccUtils::Role(row) == nsIAccessibleRole::ROLE_ROW)
+  nsAccessible* table = row->GetParent();
+  if (!table)
+    return NS_OK;
+
+  *aRowIndex = 0;
+
+  PRInt32 indexInTable = row->GetIndexInParent();
+  for (PRInt32 idx = 0; idx < indexInTable; idx++) {
+    row = table->GetChildAt(idx);
+    if (row->Role() == nsIAccessibleRole::ROLE_ROW)
       (*aRowIndex)++;
-
-    row->GetPreviousSibling(getter_AddRefs(prevRow));
-    row.swap(prevRow);
   }
 
   return NS_OK;
@@ -1152,7 +1156,7 @@ nsXULListCellAccessible::GetColumnHeaderCells(nsIArray **aHeaderCells)
   PRInt32 tableChildCount = tableAcc->GetChildCount();
   for (PRInt32 childIdx = 0; childIdx < tableChildCount; childIdx++) {
     nsAccessible *child = tableAcc->GetChildAt(childIdx);
-    if (nsAccUtils::Role(child) == nsIAccessibleRole::ROLE_LIST) {
+    if (child->Role() == nsIAccessibleRole::ROLE_LIST) {
       list = child;
       break;
     }
diff --git a/accessible/src/xul/nsXULMenuAccessible.cpp b/accessible/src/xul/nsXULMenuAccessible.cpp
index ef266fffd9cb..49206a32ef0d 100644
--- a/accessible/src/xul/nsXULMenuAccessible.cpp
+++ b/accessible/src/xul/nsXULMenuAccessible.cpp
@@ -329,8 +329,7 @@ nsXULMenuitemAccessible::GetStateInternal(PRUint32 *aState,
   }
 
   // Combo box listitem
-  PRBool isComboboxOption =
-    (nsAccUtils::Role(this) == nsIAccessibleRole::ROLE_COMBOBOX_OPTION);
+  PRBool isComboboxOption = (Role() == nsIAccessibleRole::ROLE_COMBOBOX_OPTION);
   if (isComboboxOption) {
     // Is selected?
     PRBool isSelected = PR_FALSE;
@@ -353,7 +352,7 @@ nsXULMenuitemAccessible::GetStateInternal(PRUint32 *aState,
         // Set selected option offscreen/invisible according to combobox state
         nsAccessible* grandParentAcc = parentAcc->GetParent();
         NS_ENSURE_TRUE(grandParentAcc, NS_ERROR_FAILURE);
-        NS_ASSERTION(nsAccUtils::Role(grandParentAcc) == nsIAccessibleRole::ROLE_COMBOBOX,
+        NS_ASSERTION(grandParentAcc->Role() == nsIAccessibleRole::ROLE_COMBOBOX,
                      "grandparent of combobox listitem is not combobox");
         PRUint32 grandParentState, grandParentExtState;
         grandParentAcc->GetState(&grandParentState, &grandParentExtState);
@@ -486,7 +485,7 @@ nsXULMenuitemAccessible::NativeRole()
   if (xulContainer)
     return nsIAccessibleRole::ROLE_PARENT_MENUITEM;
 
-  if (nsAccUtils::Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
+  if (mParent && mParent->Role() == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
     return nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
 
   if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
@@ -666,7 +665,7 @@ nsXULMenupopupAccessible::NativeRole()
   // If accessible is not bound to the tree (this happens while children are
   // cached) return general role.
   if (mParent) {
-    PRUint32 role = nsAccUtils::Role(mParent);
+    PRUint32 role = mParent->Role();
     if (role == nsIAccessibleRole::ROLE_COMBOBOX ||
         role == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
       return nsIAccessibleRole::ROLE_COMBOBOX_LIST;
@@ -675,7 +674,8 @@ nsXULMenupopupAccessible::NativeRole()
     if (role == nsIAccessibleRole::ROLE_PUSHBUTTON) {
       // Some widgets like the search bar have several popups, owned by buttons.
       nsAccessible* grandParent = mParent->GetParent();
-      if (nsAccUtils::Role(grandParent) == nsIAccessibleRole::ROLE_AUTOCOMPLETE)
+      if (grandParent &&
+          grandParent->Role() == nsIAccessibleRole::ROLE_AUTOCOMPLETE)
         return nsIAccessibleRole::ROLE_COMBOBOX_LIST;
     }
   }
diff --git a/accessible/src/xul/nsXULTextAccessible.cpp b/accessible/src/xul/nsXULTextAccessible.cpp
index c7524be0c7aa..5ce7aacff5e0 100644
--- a/accessible/src/xul/nsXULTextAccessible.cpp
+++ b/accessible/src/xul/nsXULTextAccessible.cpp
@@ -102,11 +102,9 @@ nsXULTextAccessible::GetRelationByType(PRUint32 aRelationType,
     // Caption is the label for groupbox
     nsIContent *parent = mContent->GetParent();
     if (parent && parent->Tag() == nsAccessibilityAtoms::caption) {
-      nsCOMPtr<nsIAccessible> parentAccessible;
-      GetParent(getter_AddRefs(parentAccessible));
-      if (nsAccUtils::Role(parentAccessible) == nsIAccessibleRole::ROLE_GROUPING)
-        return nsRelUtils::
-          AddTarget(aRelationType, aRelation, parentAccessible);
+      nsAccessible* parent = GetParent();
+      if (parent && parent->Role() == nsIAccessibleRole::ROLE_GROUPING)
+        return nsRelUtils::AddTarget(aRelationType, aRelation, parent);
     }
   }
 

From ff607a58a5dccc45acc9007e94a6204e06532c9f Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Wed, 1 Sep 2010 23:02:13 -0700
Subject: [PATCH 212/222] Bug 592953 - Remove ancient build/file_migrate.pl,
 which would move modified files from one CVS tree to another, r=khuey,
 a=NPOTB

---
 build/file_migrate.pl | 292 ------------------------------------------
 1 file changed, 292 deletions(-)
 delete mode 100644 build/file_migrate.pl

diff --git a/build/file_migrate.pl b/build/file_migrate.pl
deleted file mode 100644
index 0b6073fa7820..000000000000
--- a/build/file_migrate.pl
+++ /dev/null
@@ -1,292 +0,0 @@
-#!perl -w
-
-# This script copies modified files from a source CVS tree to a destination
-# tree. Modified files are detected by comparing their modification dates
-# with the CVS Entries file.
-# 
-# Modified files are copied in their entirety to the destination tree
-# (no diffing is done). Files are only copied of the CVS version of the
-# file is the same in both trees. If the destination file is modified
-# already, it is backed up and replaced.
-# 
-# To use this on your tree/platform, do the following:
-# 
-# 1. Fix the !perl line, if necessary.
-# 2. Fix $dirsep to be the directory separator on your platform.
-# 3. Uncomment the appropriate $dst_linebreaks file specify what linebreaks
-#    you want for the copied files. This variable defines the *destination* linebreaks 
-#    that you want your changes to be converted to.
-#    For example, if you have a linux volume 
-#    mounted (via SAMBA perhaps) to your windows box where you've made changes to 
-#    source files, you'd want $dst_linebreaks to be set for unix. This ensures that 
-#    linebreaks are converted to the appropriate OS linebreak scheme for your *target* tree.
-# 4. Set $src_tree and $dest_tree to point to the directories you want
-#    to sync up. These don't have to point to the root of the tree,
-#    but should be equivalent directories in the two trees.
-#    
-# First version:
-#     Simon Fraser <sfraser@netscape.com>
-
-use File::stat;
-use Time::Local;
-
-# change for your platform ('\' == windows, ':' == mac, '/' == unix)
-$dirsep = "\\";
-
-# Set this to the native OS of the *destination* tree
-# $dst_linebreaks = pack("cc", 13);           # Mac
-#$dst_linebreaks = pack("cc", 13, 10);       # DOS
-$dst_linebreaks = pack("cc", 10);           # UNIX
-
-#change for your src and dest trees
-$src_tree =  "x:\\mozilla\\xpfe\\components";
-$dest_tree = "h:\\builds\\mozilla\\xpfe\\components";
-
-
-#//--------------------------------------------------------------------------------------------------
-#// _copyFile. Copy file from src to dest, converting linebreaks if necessary
-#//--------------------------------------------------------------------------------------------------
-sub _copyFile($;$;$;$)
-{
-    my($srcdir, $destdir, $file, $backup) = @_;
-
-    my($srcfile) = $srcdir.$dirsep.$file;
-    my($dstfile) = $destdir.$dirsep.$file;
-    
-    if ($backup)
-    {
-        my($counter) = 0;
-        
-        while (-f $dstfile."-".$counter)
-        {
-            $counter ++;
-        }
-        
-        rename($dstfile, $dstfile."-".$counter) or die "Failed to rename file\n";
-    }
-    
-    print "Copying $file over to dest\n";
-
-    my($newdest) = $dstfile."_temp";
-    
-    open(SRCFILE, "< $srcfile")     or die "Can't open source file $srcfile\n";
-    open(NEWDEST, "> $newdest")     or die "Can't open dest file $newdest\n";
-    
-    while (<SRCFILE>)
-    {
-        chomp($_);
-        print NEWDEST $_.$dst_linebreaks;
-    }
-    
-    close(SRCFILE);
-    close(NEWDEST);
-    
-    if (!$backup) {
-        unlink($dstfile)  or die "Failed to remove $dstfile\n";
-    }
-    rename($newdest, $dstfile)      or die "Failed to rename $newdest\n";
-}
-
-
-#//--------------------------------------------------------------------------------------------------
-#// _readCVSInfo. Suck in the CVS info from the Entries file
-#//--------------------------------------------------------------------------------------------------
-
-sub _readCVSInfo($)
-{
-    my($cvsDir) = @_;
-
-    my($entries_file_name) = $cvsDir.$dirsep."CVS".$dirsep."Entries";
-    
-    # print "Reading $entries_file_name\n";
-    open(ENTRIES, $entries_file_name) || die "Could not open file $entries_file_name";
-
-    my(%cvs_entries);
-    
-    # Read in the path if available    
-    while (defined ($line = <ENTRIES>))
-    {
-        chomp($line);
-        
-        #parse out the line. Format is:
-        #   files:    /filename/version/date/options/tag
-        #   dirs:     D/dirname////
-        #   dir?      D
-        # because we might be reading an entries file from another platform, with
-        # different linebreaks, be anal about cleaning up $line.
-                
-        if ($line =~ /^?\/(.+)\/(.+)\/(.+)\/(.*)\/(.*)?$/)
-        {
-            my($filename) = $1;
-            my($version) = $2;
-            my($date) = $3;
-            my($options) = $4;
-            my($tag) = $5;
-            
-            my(%cvs_file) = (
-                "version"   => $version,
-                "date"      => $date,
-                "options"   => $options,
-                "tag"       => $tag
-            );
-                        
-            # print $filename." ".$version." ".$date." ".$options." ".$tag."\n";
-            $cvs_entries{$filename} = \%cvs_file;
-        }
-    }
-   
-    close ENTRIES;
-
-    return %cvs_entries;
-}
-
-
-#//--------------------------------------------------------------------------------------------------
-#// _fileIsModified. compare mod date with CVS entries to see if a file is modified
-#//--------------------------------------------------------------------------------------------------
-sub _fileIsModified($;$;$)
-{
-    my($entries, $dir, $file) = @_;
-
-    my($abs_file) = $dir.$dirsep.$file;
-
-    if (exists($entries->{$file}))
-    {
-        my($date) = $entries->{$file}->{"date"};
-        
-        # stat the file to get its date
-        my($file_data) = stat($abs_file) || die "Could not stat $file\n";
-        my($mod_string) = scalar(gmtime($file_data->mtime));
-
-       return ($mod_string ne $date);
-    }
-    else
-    {
-        return 0;    
-    }
-}
-
-
-#//--------------------------------------------------------------------------------------------------
-#// _processFile. args: entries hash, dir, filename
-#//--------------------------------------------------------------------------------------------------
-
-sub _processFile($;$;$;$;$)
-{
-    my($src_entries, $dest_entries, $srcdir, $destdir, $file) = @_;
-
-    my($abs_file) = $srcdir.$dirsep.$file;
-            
-    if (exists($src_entries->{$file}))
-    {
-        my($file_entry) = $src_entries->{$file};
-        my($version) = $file_entry->{"version"};
-        
-        if (_fileIsModified($src_entries, $srcdir, $file))
-        {
-            my($rel_file) = $abs_file;
-            $rel_file =~ s/^$src_tree//;
-            
-            # print "¥ÊFile $rel_file is modified\n";
-            
-            # check CVS version in dest
-            my($dest_entry) = $dest_entries->{$file};
-            if ($dest_entry)
-            {
-                my($dest_version) = $dest_entry->{"version"};
-                my($versions_match) = ($version == $dest_version);
-                my($dest_modified) = _fileIsModified($dest_entries, $destdir, $file);
-                                
-                if ($versions_match)
-                {
-                    # ok, we can copy the file over now, backing up dest if it is modified
-                    _copyFile($srcdir, $destdir, $file, $dest_modified);
-                }
-                else
-                {
-                    print "File $rel_file is version $version in the src tree, but $dest_version in dest. This file will not be copied.\n";
-                }
-            }
-            else
-            {
-                print "No CVS entry found in destination tree for $rel_file\n";
-            }
-        }
-    }
-    else
-    {
-        print "No entry for file $file\n";
-    }
-}
-
-
-#//--------------------------------------------------------------------------------------------------
-#// _traverseDir. Traverse one dir, recurse for each found dir.
-#//--------------------------------------------------------------------------------------------------
-
-sub _traverseDir($;$)
-{
-    my($srcdir, $destdir) = @_;
-
-    opendir(DIR, $srcdir) or die "Cannot open dir $srcdir\n";
-    my @files = readdir(DIR);
-    closedir DIR;
-    
-    # suck in the CVS info for this dir, if there is a CVS dir
-    unless (-e $srcdir.$dirsep."CVS".$dirsep."Entries" && -e $destdir.$dirsep."CVS".$dirsep."Entries") {
-        print "$srcdir is not a CVS directory in both source and dest\n";
-        return;
-    }
-    
-    print " Doing $srcdir\n";
-    
-    my(%src_entries)  = _readCVSInfo($srcdir);
-    my(%dest_entries) = _readCVSInfo($destdir);
-
-    my $file;    
-    foreach $file (@files)
-    {        
-        my $filepath = $srcdir.$dirsep.$file;
-                
-        if (-d $filepath)
-        {
-            if ($file ne "CVS")     # ignore 'CVS' dirs
-            {
-                # print "Going into $filepath\n";            
-                _traverseDir($filepath, $destdir.$dirsep.$file);
-            }
-        }
-        else
-        {
-            # process this file
-            _processFile(\%src_entries, \%dest_entries, $srcdir, $destdir, $file);
-        }
-    }
-}
-
-#//--------------------------------------------------------------------------------------------------
-#// MigrateChanges
-#//--------------------------------------------------------------------------------------------------
-sub MigrateChanges($;$)
-{
-    my($srcdir, $destdir) = @_;
-
-    # Check that src and dest exist
-    if (! -d $srcdir) {
-        die "Source directory $srcdir does not exist\n";
-    }
-
-    if (! -d $destdir) {
-        die "Dest directory $destdir does not exist\n";
-    }
-
-    print "---------------------------------------------------------\n";
-    print "Migrating changes from\n  $srcdir\nto\n  $destdir\n";
-    print "---------------------------------------------------------\n";
-    _traverseDir($srcdir, $destdir);
-    print "---------------------------------------------------------\n";
-}
-
-
-MigrateChanges($src_tree, $dest_tree);
-

From b0e8d7121813719530ae8ef29c555661939ddd0a Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Tue, 31 Aug 2010 22:26:30 -0700
Subject: [PATCH 213/222] Bug 592599 - Remove unused
 browser/components/feeds/src/GenericFactory.js, r+a=gavin

---
 .../components/feeds/src/GenericFactory.js    | 63 -------------------
 1 file changed, 63 deletions(-)
 delete mode 100644 browser/components/feeds/src/GenericFactory.js

diff --git a/browser/components/feeds/src/GenericFactory.js b/browser/components/feeds/src/GenericFactory.js
deleted file mode 100644
index 532f02b9589a..000000000000
--- a/browser/components/feeds/src/GenericFactory.js
+++ /dev/null
@@ -1,63 +0,0 @@
-# -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is the Generic Component Factory.
-#
-# The Initial Developer of the Original Code is Google Inc.
-# Portions created by the Initial Developer are Copyright (C) 2006
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#   Ben Goodger <beng@google.com>
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either the GNU General Public License Version 2 or later (the "GPL"), or
-# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK ***** */
-
-/**
- * An object implementing nsIFactory that can construct other objects upon
- * createInstance, passing a set of parameters to that object's constructor.
- */
-function GenericComponentFactory(ctor, params) {
-  this._ctor = ctor;
-  this._params = params;
-}
-GenericComponentFactory.prototype = {
-  _ctor: null,
-  _params: null,
-  
-  createInstance: function GCF_createInstance(outer, iid) {
-    if (outer != null)
-      throw Cr.NS_ERROR_NO_AGGREGATION;
-    return (new this._ctor(this._params)).QueryInterface(iid);
-  },
-  
-  QueryInterface: function GCF_QueryInterface(iid) {
-    if (iid.equals(Ci.nsIFactory) ||
-        iid.equals(Ci.nsISupports)) 
-      return this;
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  }
-};
-

From 693f7115dd12d323cfd2f73fb0a7562c2d728a73 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Tue, 31 Aug 2010 19:42:50 -0700
Subject: [PATCH 214/222] Bug 592191 - Remove embedding/browser/src/tlb2xpt/,
 r=bsmedberg, a=NPOTB

---
 .../browser/activex/src/tlb2xpt/ReadMe.txt    |   1 -
 .../browser/activex/src/tlb2xpt/StdAfx.cpp    |   8 -
 .../browser/activex/src/tlb2xpt/StdAfx.h      |  32 --
 .../browser/activex/src/tlb2xpt/TypeDesc.cpp  | 242 ----------
 .../browser/activex/src/tlb2xpt/TypeDesc.h    |  53 ---
 .../activex/src/tlb2xpt/axIUnknown.idl        |   7 -
 .../browser/activex/src/tlb2xpt/makefile.win  |  70 ---
 .../browser/activex/src/tlb2xpt/tlb2xpt.cpp   | 430 ------------------
 8 files changed, 843 deletions(-)
 delete mode 100644 embedding/browser/activex/src/tlb2xpt/ReadMe.txt
 delete mode 100644 embedding/browser/activex/src/tlb2xpt/StdAfx.cpp
 delete mode 100644 embedding/browser/activex/src/tlb2xpt/StdAfx.h
 delete mode 100644 embedding/browser/activex/src/tlb2xpt/TypeDesc.cpp
 delete mode 100644 embedding/browser/activex/src/tlb2xpt/TypeDesc.h
 delete mode 100644 embedding/browser/activex/src/tlb2xpt/axIUnknown.idl
 delete mode 100644 embedding/browser/activex/src/tlb2xpt/makefile.win
 delete mode 100644 embedding/browser/activex/src/tlb2xpt/tlb2xpt.cpp

diff --git a/embedding/browser/activex/src/tlb2xpt/ReadMe.txt b/embedding/browser/activex/src/tlb2xpt/ReadMe.txt
deleted file mode 100644
index 186d242154bc..000000000000
--- a/embedding/browser/activex/src/tlb2xpt/ReadMe.txt
+++ /dev/null
@@ -1 +0,0 @@
-Utility for turning ActiveX typelibrary files into XPCOM xpt, idl & stub files
\ No newline at end of file
diff --git a/embedding/browser/activex/src/tlb2xpt/StdAfx.cpp b/embedding/browser/activex/src/tlb2xpt/StdAfx.cpp
deleted file mode 100644
index 6aacf29a5a80..000000000000
--- a/embedding/browser/activex/src/tlb2xpt/StdAfx.cpp
+++ /dev/null
@@ -1,8 +0,0 @@
-// stdafx.cpp : source file that includes just the standard includes
-//	tlb2xpt.pch will be the pre-compiled header
-//	stdafx.obj will contain the pre-compiled type information
-
-#include "stdafx.h"
-
-// TODO: reference any additional headers you need in STDAFX.H
-// and not in this file
diff --git a/embedding/browser/activex/src/tlb2xpt/StdAfx.h b/embedding/browser/activex/src/tlb2xpt/StdAfx.h
deleted file mode 100644
index afc44b5cefb3..000000000000
--- a/embedding/browser/activex/src/tlb2xpt/StdAfx.h
+++ /dev/null
@@ -1,32 +0,0 @@
-// stdafx.h : include file for standard system include files,
-//  or project specific include files that are used frequently, but
-//      are changed infrequently
-//
-
-#if !defined(AFX_STDAFX_H__55CC9557_F6D1_4BE8_A84D_BBCC8E265BDC__INCLUDED_)
-#define AFX_STDAFX_H__55CC9557_F6D1_4BE8_A84D_BBCC8E265BDC__INCLUDED_
-
-#if _MSC_VER > 1000
-#pragma once
-#endif // _MSC_VER > 1000
-
-#include <windows.h>
-#include <comdef.h>
-
-#include <stddef.h>
-#include <stdio.h>
-
-#include <string>
-#include <locale>
-
-#include <crtdbg.h>
-#include <atlconv.h>
-
-#include "TypeDesc.h"
-
-// TODO: reference additional headers your program requires here
-
-//{{AFX_INSERT_LOCATION}}
-// Microsoft Visual C++ will insert additional declarations immediately before the previous line.
-
-#endif // !defined(AFX_STDAFX_H__55CC9557_F6D1_4BE8_A84D_BBCC8E265BDC__INCLUDED_)
diff --git a/embedding/browser/activex/src/tlb2xpt/TypeDesc.cpp b/embedding/browser/activex/src/tlb2xpt/TypeDesc.cpp
deleted file mode 100644
index 418b7852c3ce..000000000000
--- a/embedding/browser/activex/src/tlb2xpt/TypeDesc.cpp
+++ /dev/null
@@ -1,242 +0,0 @@
-
-#include "stdafx.h"
-
-#include "TypeDesc.h"
-
-TypeDesc::TypeDesc(ITypeInfo* pti, TYPEDESC* ptdesc)
-{
-	if (ptdesc->vt == VT_PTR)
-	{
-		// ptdesc->lptdesc points to a TYPEDESC that specifies the thing pointed to
-        mType = T_POINTER;
-        mData.mPtr = new TypeDesc(pti, ptdesc->lptdesc);
-	}
-	else if ((ptdesc->vt & 0x0FFF) == VT_CARRAY)
-	{
-        mType = T_UNSUPPORTED;
-        mData.mName = strdup("VT_CARRAY");
-        /*
-        // ptdesc->lpadesc points to an ARRAYDESC
-		str = TYPEDESCtoString(pti, &ptdesc->lpadesc->tdescElem );
-
-		// Allocate cDims * lstrlen("[123456]")
-        char buf[20];
-		for (USHORT n = 0; n < ptdesc->lpadesc->cDims; n++)
-		{
-            sprintf(buf, "[%d]", ptdesc->lpadesc->rgbounds[n].cElements);
-			str += buf;
-		}
-		return str;
-        */
-	}
-    else if ((ptdesc->vt & 0x0FFF) == VT_SAFEARRAY)
-	{
-        mType = T_UNSUPPORTED;
-        mData.mName = strdup("VT_SAFEARRAY");
-        /*
-		str = "SAFEARRAY(" + TYPEDESCtoString( pti, ptdesc->lptdesc ) + ")";
-		return str;
-        */
-	}
-    else  switch(ptdesc->vt)
-    {
-    case VT_VOID:
-        mType = T_VOID;
-        break;
-    case VT_HRESULT:
-        mType = T_RESULT;
-        break;
-    case VT_I1:
-        mType = T_INT8;
-        break;
-    case VT_I2:
-        mType = T_INT16;
-        break;
-    case VT_INT:
-    case VT_I4:
-        mType = T_INT32;
-        break;
-    case VT_I8:
-        mType = T_INT64;
-        break;
-    case VT_UI1:
-        mType = T_UINT8;
-        break;
-    case VT_UI2:
-        mType = T_UINT16;
-        break;
-    case VT_UINT:
-    case VT_UI4:
-        mType = T_UINT32;
-        break;
-    case VT_UI8:
-        mType = T_UINT64;
-        break;
-    case VT_BSTR:
-    case VT_LPWSTR:
-        mType = T_WSTRING;
-        break;
-    case VT_LPSTR:
-        mType = T_STRING;
-        break;
-    case VT_UNKNOWN:
-    case VT_DISPATCH:
-        mType = T_INTERFACE;
-        break;
-    case VT_BOOL:
-        mType = T_BOOL;
-        break;
-    case VT_R4:
-        mType = T_FLOAT;
-        break;
-    case VT_R8:
-        mType = T_DOUBLE;
-        break;
-    case VT_EMPTY:
-        mType = T_UNSUPPORTED;
-        mData.mName = strdup("VT_EMPTY");
-        break;
-    case VT_NULL:
-        mType = T_UNSUPPORTED;
-        mData.mName = strdup("VT_NULL");
-        break;
-    case VT_CY:
-        mType = T_UNSUPPORTED;
-        mData.mName = strdup("VT_CY");
-        break;
-    case VT_DATE:
-        mType = T_UNSUPPORTED;
-        mData.mName = strdup("VT_DATE");
-        break;
-    case VT_ERROR:
-        mType = T_UNSUPPORTED;
-        mData.mName = strdup("VT_ERROR");
-        break;
-    case VT_VARIANT:
-        mType = T_UNSUPPORTED;
-        mData.mName = strdup("VT_VARIANT");
-        break;
-    case VT_USERDEFINED:
-        mType = T_UNSUPPORTED;
-        mData.mName = strdup("VT_USERDEFINED");
-        break;
-    default:
-        {
-            char szBuf[50];
-            sprintf(szBuf, "VT = %08x", ptdesc->vt);
-            mType = T_UNSUPPORTED;
-            mData.mName = strdup(szBuf);
-        }
-        break;
-    }
-}
-
-TypeDesc::~TypeDesc()
-{
-    if (mType == T_ARRAY)
-    {
-        delete mData.mArray.mElements;
-    }
-    else if (mType == T_POINTER)
-    {
-        delete mData.mPtr;
-    }
-    else if (mType == T_UNSUPPORTED)
-    {
-        free(mData.mName);
-    }
-}
-
-std::string TypeDesc::ToCString()
-{
-    std::string str;
-
-	if (mType == T_POINTER)
-	{
-		// ptdesc->lptdesc points to a TYPEDESC that specifies the thing pointed to
-		str = mData.mPtr->ToXPIDLString();
-		str += " *";
-		return str;
-	}
-	else if (mType == T_ARRAY)
-	{
-        // TODO
-        str = "void * /* T_ARRAY */";
-		return str;
-	}
-    else switch (mType) {
-    case T_VOID:    return "void";
-    case T_RESULT:  return "nsresult";
-    case T_CHAR:    return "char";
-    case T_WCHAR:   return "PRUnichar";
-    case T_INT8:    return "PRInt8";
-    case T_INT16:   return "PRInt16";
-    case T_INT32:   return "PRInt32";
-    case T_INT64:   return "PRInt64";
-    case T_UINT8:   return "PRUint8";
-    case T_UINT16:  return "PRUint16";
-    case T_UINT32:  return "PRUint32";
-    case T_UINT64:  return "PRUint64";
-    case T_STRING:  return "char*";
-    case T_WSTRING: return "PRUnichar*";
-    case T_FLOAT:   return "float";
-    case T_DOUBLE:  return "double";
-    case T_BOOL:    return "PRBool";
-    case T_INTERFACE: return "nsISupports *";
-    default:
-    case T_UNSUPPORTED:
-        {
-            std::string str = "/*";
-            str += mData.mName;
-            str += " */ void ";
-            return str;
-        }
-   }
-}
-
-std::string TypeDesc::ToXPIDLString()
-{
-    std::string str;
-
-	if (mType == T_POINTER)
-	{
-		// ptdesc->lptdesc points to a TYPEDESC that specifies the thing pointed to
-		str = mData.mPtr->ToXPIDLString();
-		str += " *";
-		return str;
-	}
-	else if (mType == T_ARRAY)
-	{
-        // TODO
-        str = "void * /* T_ARRAY */";
-		return str;
-	}
-    else switch (mType) {
-    case T_VOID:    return "void";
-    case T_RESULT:  return "nsresult";
-    case T_CHAR:    return "char";
-    case T_WCHAR:   return "wchar";
-    case T_INT8:    return "octet";
-    case T_INT16:   return "short";
-    case T_INT32:   return "long";
-    case T_INT64:   return "long long";
-    case T_UINT8:   return "octect";
-    case T_UINT16:  return "unsigned short";
-    case T_UINT32:  return "unsigned long";
-    case T_UINT64:  return "unsigned long long";
-    case T_STRING:  return "string";
-    case T_WSTRING: return "wstring";
-    case T_FLOAT:   return "float";
-    case T_DOUBLE:  return "double";
-    case T_BOOL:    return "boolean";
-    case T_INTERFACE: return "nsISupports";
-    default:
-    case T_UNSUPPORTED:
-        {
-            std::string str = "/* ";
-            str += mData.mName;
-            str += " */ void";
-            return str;
-        }
-   }
-}
diff --git a/embedding/browser/activex/src/tlb2xpt/TypeDesc.h b/embedding/browser/activex/src/tlb2xpt/TypeDesc.h
deleted file mode 100644
index 83256a31becf..000000000000
--- a/embedding/browser/activex/src/tlb2xpt/TypeDesc.h
+++ /dev/null
@@ -1,53 +0,0 @@
-#ifndef TYPEDESC_H
-#define TYPEDESC_H
-
-class TypeDesc
-{
-public:
-    enum Type
-    {
-        T_POINTER, // A pointer to something else
-        T_ARRAY,   // An array of other things
-        T_VOID,
-        T_RESULT, // nsresult / HRESULT
-        T_CHAR,
-        T_WCHAR,
-        T_INT8,
-        T_INT16,
-        T_INT32,
-        T_INT64,
-        T_UINT8,
-        T_UINT16,
-        T_UINT32,
-        T_UINT64,
-        T_STRING,
-        T_WSTRING,
-        T_FLOAT,
-        T_DOUBLE,
-        T_BOOL,
-        T_INTERFACE,
-        T_OTHER,
-        T_UNSUPPORTED
-    };
-
-    Type      mType;
-    union {
-        // T_POINTER
-        TypeDesc *mPtr;
-        // T_ARRAY
-        struct {
-            long mNumElements;
-            TypeDesc **mElements;
-        } mArray;
-        // T_UNSUPPORTED
-        char *mName;
-    } mData;
-
-    TypeDesc(ITypeInfo* pti, TYPEDESC* ptdesc);
-    ~TypeDesc();
-
-	std::string ToXPIDLString();
-	std::string ToCString();
-};
-
-#endif
\ No newline at end of file
diff --git a/embedding/browser/activex/src/tlb2xpt/axIUnknown.idl b/embedding/browser/activex/src/tlb2xpt/axIUnknown.idl
deleted file mode 100644
index ff6919a80838..000000000000
--- a/embedding/browser/activex/src/tlb2xpt/axIUnknown.idl
+++ /dev/null
@@ -1,7 +0,0 @@
-#include "nsISupports.idl"
-
-// By happy coincidence, nsISupports implements the same methods as IUnknown
-// and the same UUID too!
-
-#define axIUnknown nsISupports
-
diff --git a/embedding/browser/activex/src/tlb2xpt/makefile.win b/embedding/browser/activex/src/tlb2xpt/makefile.win
deleted file mode 100644
index 9fbccc74e6d0..000000000000
--- a/embedding/browser/activex/src/tlb2xpt/makefile.win
+++ /dev/null
@@ -1,70 +0,0 @@
-#!nmake
-#
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is mozilla.org code.
-#
-# The Initial Developer of the Original Code is
-# Netscape Communications Corporation.
-# Portions created by the Initial Developer are Copyright (C) 1998
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#   Adam Lock <adamlock@netscape.com>
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either the GNU General Public License Version 2 or later (the "GPL"), or
-# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
-
-DEPTH = ..\..\..\..\..
-
-REQUIRES = \
-    xpcom \
-    $(NULL)
-
-MAKE_OBJ_TYPE = EXE
-PROGRAM = .\$(OBJDIR)\tlb2xpt.exe
-
-LCFLAGS = /D "WIN32" -DEXPORT_XPT_API /GX
-
-LLIBS = \
-    $(DIST)\lib\xpcomxpt_s.lib \
-    $(NULL)
-
-OBJS = \
-    .\$(OBJDIR)\tlb2xpt.obj  \
-    .\$(OBJDIR)\TypeDesc.obj \
-    $(NULL)
-
-MOZ_NO_COVERAGE = 1
-
-include <$(DEPTH)\config\rules.mak>
-
-export:: $(PROGRAM)
-    $(MAKE_INSTALL) $(PROGRAM) $(DIST)\bin
-
-clobber::
-    rm -f $(DIST)\bin\tlb2xpt.exe
-
-
diff --git a/embedding/browser/activex/src/tlb2xpt/tlb2xpt.cpp b/embedding/browser/activex/src/tlb2xpt/tlb2xpt.cpp
deleted file mode 100644
index 7e009b28ef67..000000000000
--- a/embedding/browser/activex/src/tlb2xpt/tlb2xpt.cpp
+++ /dev/null
@@ -1,430 +0,0 @@
-// tlb2xpt.cpp : Defines the entry point for the console application.
-//
-
-#include "stdafx.h"
-
-#include "xpt_xdr.h"
-
-typedef void (*EnumTypeLibProc)(ITypeInfo *typeInfo, TYPEATTR *typeAttr);
-
-void EnumTypeLib(ITypeLib *typeLib, EnumTypeLibProc pfn);
-void EnumTypeLibProcVerbose(ITypeInfo *typeInfo, TYPEATTR *typeAttr);
-void EnumTypeLibProcXPIDL(ITypeInfo *typeInfo, TYPEATTR *typeAttr);
-void EnumTypeLibProcXPT(ITypeInfo *typeInfo, TYPEATTR *typeAttr);
-void EnumTypeLibProcStubs(ITypeInfo *typeInfo, TYPEATTR *typeAttr);
-
-void DumpXPCOMInterfaceXPT(FILE *f, ITypeInfo *tiInterface);
-void DumpXPCOMInterfaceIDL(FILE *f, ITypeInfo *typeInfo);
-void DumpXPCOMInterfaceStubH(FILE *f, ITypeInfo *tiInterface);
-void DumpXPCOMInterfaceStubC(FILE *f, ITypeInfo *tiInterface);
-
-FILE *fidl   = NULL;
-FILE *fxpt   = NULL;
-FILE *fstubc = NULL;
-FILE *fstubh = NULL;
-
-int main(int argc, char* argv[])
-{
-    BOOL verbose = FALSE;
-    BOOL genIDL = FALSE;
-    BOOL genXPT = FALSE;
-    BOOL genStubs = FALSE;
-    
-    char *inputTLB = NULL;
-    char *output = NULL;
-
-    for (int arg = 1; arg < argc; arg++)
-    {
-        if (stricmp(argv[arg], "-verbose") == 0)
-        {
-            verbose = TRUE;
-        }
-        else if (stricmp(argv[arg], "-idl") == 0)
-        {
-            genIDL = TRUE;
-        }
-        else if (stricmp(argv[arg], "-xpt") == 0)
-        {
-            genXPT = TRUE;
-        }
-        else if (stricmp(argv[arg], "-stubs") == 0)
-        {
-            genStubs = TRUE;
-        }
-        else if (!inputTLB)
-        {
-          inputTLB = argv[arg];
-        }
-        else if (!output)
-        {
-            output = argv[arg];
-        }
-    }
-    if (inputTLB == NULL || output == NULL)
-    {
-        fputs("Usage: tlb2xpt [-verbose] [-idl] [-stubs] [-xpt] typelibrary outputname\n"
-              "  -verbose   Print out extra information\n"
-              "  -idl       Generate an outputname.idl file\n"
-              "  -xpt       Generate an outputname.xpt file\n"
-              "  -stubs     Generate outputname.cpp and outputname.h stubs\n",
-              stderr);
-        return 1;
-    }
-
-    // Open FILE handles to the various things that need to be generated
-    if (genIDL)
-    {
-        if (output)
-        {
-            std::string filename(output);
-            filename += ".idl";
-            fidl = fopen(filename.c_str(), "wt");
-        }
-        else
-        {
-            fidl = stdout;
-        }
-    }
-    if (genXPT)
-    {
-        if (output)
-        {
-            std::string filename(output);
-            filename += ".xpy";
-            fxpt = fopen(filename.c_str(), "wb");
-        }
-    }
-    if (genStubs)
-    {
-        std::string stubh(output);
-        std::string stubc(output);
-        stubh += ".h";
-        stubc += ".cpp";
-        fstubh = fopen(stubh.c_str(), "wt");
-        fstubc = fopen(stubc.c_str(), "wt");
-    }
-
-    if (verbose)
-        fprintf(stderr, "Opening TLB \"%s\"\n", inputTLB);
-
-    ITypeLibPtr typeLib;
-    USES_CONVERSION;
-    HRESULT hr = LoadTypeLib(A2W(inputTLB), &typeLib);
-    if (FAILED(hr))
-    {
-        fprintf(stderr, "Error: failed to open \"%s\"\n", inputTLB);
-        return 1;
-    }
-
-    if (verbose)
-        EnumTypeLib(typeLib, EnumTypeLibProcVerbose);
-    
-    if (genIDL)
-    {
-        fputs("#include \"axIUnknown.idl\"\n\n", fidl);
-        EnumTypeLib(typeLib, EnumTypeLibProcXPIDL);
-    }
-
-    if (genXPT)
-        EnumTypeLib(typeLib, EnumTypeLibProcXPT);
-
-    if (genStubs)
-    {
-        EnumTypeLib(typeLib, EnumTypeLibProcStubs);
-    }
-
-    return 0;
-}
-
-
-
-void EnumTypeLibProcVerbose(ITypeInfo *typeInfo, TYPEATTR *typeAttr)
-{
-    char *type;
-    switch (typeAttr->typekind)
-    {
-    case TKIND_ENUM:
-        type = "TKIND_ENUM";
-        break;
-    case TKIND_RECORD:
-        type = "TKIND_RECORD";
-        break;
-    case TKIND_MODULE:
-        type = "TKIND_MODULE";
-        break;
-    case TKIND_INTERFACE:
-        type = "TKIND_INTERFACE";
-        break;
-    case TKIND_DISPATCH:
-        type = "TKIND_DISPATCH";
-        break;
-    case TKIND_COCLASS:
-        type = "TKIND_COCLASS";
-        break;
-    case TKIND_ALIAS:
-        type = "TKIND_ALIAS";
-        break;
-    case TKIND_UNION:
-        type = "TKIND_UNION";
-        break;
-    case TKIND_MAX:
-        type = "TKIND_MAX";
-        break;
-    default:
-        type = "default";
-        break;
-    }
-    fprintf(stderr, "Reading %s type\n", type);
-}
-
-void EnumTypeLibProcXPT(ITypeInfo *typeInfo, TYPEATTR *typeAttr)
-{
-    if (typeAttr->typekind == TKIND_INTERFACE)
-    {
-        DumpXPCOMInterfaceXPT(fxpt, typeInfo);
-    }
-}
-
-void EnumTypeLibProcXPIDL(ITypeInfo *typeInfo, TYPEATTR *typeAttr)
-{
-    if (typeAttr->typekind == TKIND_INTERFACE)
-    {
-        DumpXPCOMInterfaceIDL(fidl, typeInfo);
-    }
-}
-
-
-void EnumTypeLibProcStubs(ITypeInfo *typeInfo, TYPEATTR *typeAttr)
-{
-    if (typeAttr->typekind == TKIND_INTERFACE)
-    {
-        DumpXPCOMInterfaceStubH(fstubh, typeInfo);
-        DumpXPCOMInterfaceStubC(fstubc, typeInfo);
-    }
-}
-
-void EnumTypeLib(ITypeLib *typeLib, EnumTypeLibProc pfn)
-{
-    UINT count = typeLib->GetTypeInfoCount();
-    for (UINT i = 0; i < count; i++)
-    {
-        ITypeInfoPtr typeInfo;
-        typeLib->GetTypeInfo(i, &typeInfo);
-        TYPEATTR *typeAttr = NULL;
-        typeInfo->GetTypeAttr(&typeAttr);
-        pfn(typeInfo, typeAttr);
-        typeInfo->ReleaseTypeAttr(typeAttr);
-    }
-}
-
-
-// [scriptable, uuid(00000000-0000-0000-0000-000000000000)]
-// interface axIFoo : axIBar
-void DumpXPCOMInterfaceXPT(FILE *f, ITypeInfo *tiInterface)
-{
-    XPTArena *arena = XPT_NewArena(1024 * 10, sizeof(double), "main xpt_link arena");
-    // TODO. Maybe it would be better to just feed an IDL through the regular compiler
-    //       than try and generate some XPT here.
-    XPT_DestroyArena(arena);
-}
-
-void DumpXPCOMInterfaceStubH(FILE *f, ITypeInfo *tiInterface)
-{
-    HRESULT hr;
-
-    USES_CONVERSION;
-    BSTR bstrName = NULL;
-    hr = tiInterface->GetDocumentation(MEMBERID_NIL, &bstrName, NULL, NULL, NULL);
-    char *name = strdup(W2A(bstrName));
-    SysFreeString(bstrName);
-
-    fputs("template<class T>\n", f);
-    fprintf(f, "class nsAX%sImpl : public ax%s\n", name, name);
-    fputs("{\n}", f);
-
-    for (char *c = name; *c; c++)
-    {
-        *c = toupper(*c);
-    }
-    fprintf(f, "  NS_DECL_AX%s\n", name);
-    fputs("};\n\n", f);
-
-    free(name);
-}
-
-void DumpXPCOMInterfaceStubC(FILE *f, ITypeInfo *tiInterface)
-{
-
-}
-
-void DumpXPCOMInterfaceIDL(FILE *f, ITypeInfo *tiInterface)
-{
-    HRESULT hr;
-
-    // [scriptable, uuid(00000000-0000-0000-0000-000000000000)]
-    // interface axIFoo : axIBar
-    // {
-    //    void method1();
-    // };
-
-    TYPEATTR *attr;
-    tiInterface->GetTypeAttr(&attr);
-
-    USES_CONVERSION;
-
-    //
-    // Attribute block
-    //
-    fputs("[scriptable, ", f);
-
-    // uuid()
-	WCHAR szGUID[64];
-	StringFromGUID2(attr->guid, szGUID, sizeof(szGUID));
-    szGUID[0] = L'(';
-    szGUID[wcslen(szGUID) - 1] = L')';
-    fprintf(f, "uuid%s", W2A(szGUID));
-    
-    fputs("]\n", f);
-
-
-    //
-    // Interface block
-    //
-
-    fprintf(f, "interface ");
-
-    BSTR bstrName = NULL;
-    hr = tiInterface->GetDocumentation(MEMBERID_NIL, &bstrName, NULL, NULL, NULL);
-    fprintf(f, "ax%s", W2A(bstrName));
-    SysFreeString(bstrName);
-
-    // Check for the base interface
-	for (UINT n = 0; n <  attr->cImplTypes; n++)
-	{
-		HREFTYPE href = NULL;
-		if (FAILED(hr = tiInterface->GetRefTypeOfImplType(n, &href)))
-           ;  // TODO
-
-        ITypeInfoPtr tiParent;
-		if (FAILED(hr = tiInterface->GetRefTypeInfo(href, &tiParent)))
-           ; // TODO
-
-		if (FAILED(hr = tiParent->GetDocumentation(MEMBERID_NIL, &bstrName, NULL, NULL, NULL)))
-           ; // TODO
-
-		fprintf(f, " : ax%s", W2A(bstrName));
-
-		SysFreeString(bstrName);
-        bstrName = NULL;
-
-		tiParent.Release();
-	}
-
-
-    //
-    // Methods and properties block
-    //
-
-    fprintf(f, "\n");
-    fprintf(f, "{\n");
-
-
-    for (n = 0; n < attr->cFuncs; n++)
-    {
-        FUNCDESC *func;
-        tiInterface->GetFuncDesc(n, &func);
-
-        fprintf(f, "  ");
-        if (func->invkind & INVOKE_PROPERTYPUT ||
-            func->invkind & INVOKE_PROPERTYGET)
-		{
-		}
-
-        // Return type
-        TypeDesc tf(tiInterface, &func->elemdescFunc.tdesc);
-        if (tf.mType == TypeDesc::T_RESULT)
-        {
-            fprintf(f, "void ");
-        }
-        else
-        {
-            fprintf(f, "%s ", tf.ToXPIDLString().c_str());
-        }
-
-        // Method / property name
-        BSTR bstrName = NULL;
-    	tiInterface->GetDocumentation(func->memid, &bstrName, NULL, NULL, NULL);
-        fprintf(f, "%s (\n", W2A(bstrName));
-        SysFreeString(bstrName);
-
-        // Get the names of all the arguments
-		UINT cNames;
-	    BSTR rgbstrNames[100];
-        hr = tiInterface->GetNames(func->memid, rgbstrNames, 100, (UINT*) &cNames);
-
-        // Dump out all parameters
-        for (int p = 0; p < func->cParams; p++)
-        {
-            fputs("    ", f);
-
-            BOOL isIn = FALSE;
-            BOOL isOut = FALSE;
-
-            // Keywords
-			if (func->lprgelemdescParam[p].idldesc.wIDLFlags & IDLFLAG_FRETVAL)
-			{
-				fputs("[retval] ", f);
-			}
-			if (func->lprgelemdescParam[p].idldesc.wIDLFlags & IDLFLAG_FIN &&
-                func->lprgelemdescParam[p].idldesc.wIDLFlags & IDLFLAG_FOUT)
-            {
-                fputs("inout ", f);
-            }
-            else if (func->lprgelemdescParam[p].idldesc.wIDLFlags & IDLFLAG_FIN)
-            {
-                fputs("in ", f);
-            }
-            else if (func->lprgelemdescParam[p].idldesc.wIDLFlags & IDLFLAG_FOUT)
-            {
-                fputs("out ", f);
-            }
-
-            // Type
-            // NOTE: If the arg is an out param, lop off the first pointer reference,
-            //       because XPIDL implicitly expects out params to be pointers.
-            TypeDesc tp(tiInterface, &func->lprgelemdescParam[p].tdesc);
-            if (tp.mType == TypeDesc::T_POINTER &&
-                func->lprgelemdescParam[p].idldesc.wIDLFlags & IDLFLAG_FOUT)
-            {
-                fprintf(f, "%s ", tp.mData.mPtr->ToXPIDLString().c_str());
-            }
-            else
-            {
-                // Type
-                fprintf(f, "%s ", tp.ToXPIDLString().c_str());
-            }
-
-            // Name
-            fputs(W2A(rgbstrNames[p+1]), f);
-
-            if (p < func->cParams - 1)
-            {
-                fprintf(f, ",\n");
-            }
-            else
-            {
-                fprintf(f, "\n");
-            }
-        	SysFreeString(rgbstrNames[0]);
-        }
-        fputs("  );\n", f);
-
-        tiInterface->ReleaseFuncDesc(func);
-    }
-
-
-    // Fin
-    fputs("};\n\n", f);
-
-    tiInterface->ReleaseTypeAttr(attr);
-}

From c129b752098e01678d32af2adf42aea65c1d45e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Tue, 7 Sep 2010 09:27:45 +0200
Subject: [PATCH 215/222] Bug 593650 - Increase contrast between the selected
 tab and background tabs. r+a=gavin

---
 browser/themes/gnomestripe/browser/browser.css | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/browser/themes/gnomestripe/browser/browser.css b/browser/themes/gnomestripe/browser/browser.css
index 9eee69fecf94..480de7dd93c3 100644
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@@ -1313,7 +1313,7 @@ statusbarpanel#statusbar-display {
 .tabs-newtab-button {
   position: static;
   -moz-appearance: none;
-  background: -moz-linear-gradient(hsla(0,0%,100%,.3), hsla(0,0%,50%,.1) 2px, hsla(0,0%,37%,.1) 50%);
+  background: -moz-linear-gradient(hsla(0,0%,100%,.2), hsla(0,0%,45%,.2) 1px, hsla(0,0%,32%,.2) 50%);
   background-position: -5px -2px;
   background-repeat: no-repeat;
   background-size: 200%;
@@ -1326,7 +1326,7 @@ statusbarpanel#statusbar-display {
 
 .tabbrowser-tab:hover,
 .tabs-newtab-button:hover {
-  background-image: -moz-linear-gradient(hsla(0,0%,100%,.6), hsla(0,0%,100%,.4) 2px, hsla(0,0%,75%,.4) 50%);
+  background-image: -moz-linear-gradient(hsla(0,0%,100%,.6), hsla(0,0%,100%,.2) 2px, hsla(0,0%,75%,.2) 50%);
 }
 
 .tabbrowser-tab[selected="true"] {

From f0b701b88f236d4f38c2e13a6c275251effcf9f2 Mon Sep 17 00:00:00 2001
From: Stephen Horlander <shorlander@mozilla.com>
Date: Tue, 7 Sep 2010 12:44:36 +0200
Subject: [PATCH 216/222] Bug 574681 - Tweak app button appearance. r=dao
 a=blocking

---
 .../themes/winstripe/browser/browser-aero.css | 79 ++++++++++++-------
 browser/themes/winstripe/browser/browser.css  | 48 ++++++-----
 2 files changed, 77 insertions(+), 50 deletions(-)

diff --git a/browser/themes/winstripe/browser/browser-aero.css b/browser/themes/winstripe/browser/browser-aero.css
index 6c278dd62730..4ac6537f3893 100644
--- a/browser/themes/winstripe/browser/browser-aero.css
+++ b/browser/themes/winstripe/browser/browser-aero.css
@@ -13,6 +13,56 @@
     background-image: -moz-linear-gradient(white, @toolbarHighlight@ 30%),
                       -moz-linear-gradient(@customToolbarColor@, @customToolbarColor@);
   }
+
+  /* App menu button */
+
+  #main-window[sizemode="normal"] > #titlebar > #titlebar-content > #appmenu-button-container {
+    margin-top: 1px;
+  }
+
+  #appmenu-button {
+    border: 2px solid;
+    border-top: none;
+    -moz-border-left-colors: rgba(255,255,255,.5) rgba(83,42,6,.9);
+    -moz-border-bottom-colors: rgba(255,255,255,.5) rgba(83,42,6,.9);
+    -moz-border-right-colors: rgba(255,255,255,.5) rgba(83,42,6,.9);
+    -moz-box-shadow: 0 1px 0 rgba(255,255,255,.25) inset,
+                     0 0 2px 1px rgba(255,255,255,.25) inset;
+  }
+
+  #appmenu-button:-moz-window-inactive {
+    -moz-border-left-colors: rgba(255,255,255,.4) rgba(0,0,0,.5);
+    -moz-border-bottom-colors: rgba(255,255,255,.4) rgba(0,0,0,.5);
+    -moz-border-right-colors: rgba(255,255,255,.4) rgba(0,0,0,.5);
+    -moz-box-shadow: 0 0 0 1px rgba(255,255,255,.25) inset;
+  }
+
+  /* Bug 413060, comment 16: Vista Aero is a special case where we use a
+     tooltip appearance for the address bar popup panels */
+  #identity-popup,
+  #editBookmarkPanel,
+  #notification-popup {
+    -moz-appearance: tooltip;
+    color: InfoText;
+  }
+
+  /* Make the left and right paddings smaller, to compensate for the horizontal
+     space added by the tooltip appearance, see bug 432529. */
+  #identity-popup-container {
+    -moz-padding-start: 6px;
+    -moz-padding-end: 6px;
+  }
+
+  #sidebar-splitter {
+    border: 0;
+    -moz-border-end: 1px solid #A9B7C9;
+    min-width: 0;
+    width: 3px;
+    background-color: transparent;
+    -moz-margin-start: -3px;
+    position: relative;
+    z-index: 10;
+  }
 }
 
 @media all and (-moz-windows-compositor) {
@@ -115,35 +165,6 @@
   }
 }
 
-@media all and (-moz-windows-default-theme) {
-  /* Bug 413060, comment 16: Vista Aero is a special case where we use a
-     tooltip appearance for the address bar popup panels */
-  #identity-popup,
-  #editBookmarkPanel,
-  #notification-popup {
-    -moz-appearance: tooltip;
-    color: InfoText;
-  }
-
-  /* Make the left and right paddings smaller, to compensate for the horizontal
-     space added by the tooltip appearance, see bug 432529. */
-  #identity-popup-container {
-    -moz-padding-start: 6px;
-    -moz-padding-end: 6px;
-  }
-
-  #sidebar-splitter {
-    border: 0;
-    -moz-border-end: 1px solid #A9B7C9;
-    min-width: 0;
-    width: 3px;
-    background-color: transparent;
-    -moz-margin-start: -3px;
-    position: relative;
-    z-index: 10;
-  }
-}
-
 /* ::::: fullscreen window controls ::::: */
 
 #window-controls {
diff --git a/browser/themes/winstripe/browser/browser.css b/browser/themes/winstripe/browser/browser.css
index 43576d1e49a1..16618fb985c0 100644
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@@ -114,31 +114,42 @@ statusbarpanel#statusbar-display {
 
 #appmenu-button {
   -moz-appearance: none;
-  background-color: rgb(228,120,14);
-  background-image: -moz-linear-gradient(rgba(255,255,255,.7),
-                                         rgba(255,255,255,.4) 10%,
-                                         rgba(255,255,255,0) 50%);
+  background-image: -moz-linear-gradient(rgb(247,182,82), rgb(215,98,10) 95%);
   background-clip: padding-box;
-  border: 1px solid rgba(0,0,0,.5);
-  border-top-style: none;
-  -moz-border-radius-bottomleft: 4px;
-  -moz-border-radius-bottomright: 4px;
-  -moz-box-shadow: 0 0 5px rgba(255,255,255,.5) inset;
+  -moz-border-radius: 0 0 4px 4px;
+  border: 1px solid rgba(83,42,6,.9);
+  border-top: none;
+  -moz-box-shadow: 0 1px 0 rgba(255,255,255,.25) inset,
+                   0 0 0 1px rgba(255,255,255,.25) inset;
   color: white;
-  text-shadow: 0 0 2px #333;
+  text-shadow: 0 0 1px rgba(0,0,0,.7),
+               0 1px 2px rgba(0,0,0,.5);
   font-weight: bold;
-  padding: .1em 1.5em;
+  padding: .1em 1.5em .15em;
   margin: 0;
 }
 
+#appmenu-button:-moz-window-inactive {
+  background: transparent;
+  border-color: rgba(0,0,0,.4);
+}
+
 #appmenu-button:hover:not(:active):not([open]) {
-  background-color: rgb(248,140,34);
+  background-image: -moz-radial-gradient(center bottom, farthest-side, rgba(252,240,89,.5) 10%, rgba(252,240,89,0) 70%),
+                    -moz-radial-gradient(center bottom, farthest-side, rgb(236,133,0), rgba(255,229,172,0)),
+                    -moz-linear-gradient(rgb(246,170,69), rgb(209,74,0) 95%);
+  border-color: rgba(83,42,6,.9);
+  -moz-box-shadow: 0 1px 0 rgba(255,255,255,.1) inset,
+                   0 0 2px 1px rgba(250,234,169,.7) inset,
+                   0 -1px 0 rgba(250,234,169,.5) inset;
 }
 
 #appmenu-button:hover:active,
 #appmenu-button[open] {
-  background-image: -moz-linear-gradient(rgba(0,0,0,.3), rgba(0,0,0,.2) 10%, transparent 60%);
-  -moz-box-shadow: 0 0 4px rgba(0,0,0,.3) inset;
+  background-image: -moz-linear-gradient(rgb(246,170,69), rgb(209,74,0) 95%);
+  -moz-border-radius: 0;
+  -moz-box-shadow: 0 2px 4px rgba(0,0,0,.4) inset,
+                   0 1px 1px rgba(0,0,0,.2) inset;
 }
 
 #appmenu-button > .button-box {
@@ -303,14 +314,9 @@ statusbarpanel#statusbar-display {
   margin-right: 15px;
 }
 
-/* aesthetic - push the fx button off the top window border */
-@media not all and (-moz-windows-classic) {
+@media all and (-moz-windows-classic) {
   #main-window[sizemode="normal"] > #titlebar > #titlebar-content > #appmenu-button-container {
-%ifndef WINSTRIPE_AERO
-    margin-top: 1px;
-%else
-    margin-top: 2px;
-%endif
+    margin-top: 4px;
   }
 }
 

From b8e7d0d8738142a97b8163c0ad5594ea5dfb966d Mon Sep 17 00:00:00 2001
From: Ian Neal <iann_cvs@blueyonder.co.uk>
Date: Tue, 7 Sep 2010 13:25:18 +0100
Subject: [PATCH 217/222] Bug 535903 - [SeaMonkey 2.1]
 mochitest-browser-chrome: "browser_focus_steal_from_chrome.js | Timed out"
 r=bzbarsky a=testing

---
 dom/tests/browser/browser_focus_steal_from_chrome.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dom/tests/browser/browser_focus_steal_from_chrome.js b/dom/tests/browser/browser_focus_steal_from_chrome.js
index 1d434b2d0177..b5d032ba3c1c 100644
--- a/dom/tests/browser/browser_focus_steal_from_chrome.js
+++ b/dom/tests/browser/browser_focus_steal_from_chrome.js
@@ -90,7 +90,7 @@ function test() {
     if (setFocusToChrome) {
       // Set focus to a chrome element before the loaded content tries to move
       // focus.
-      BrowserSearch.searchBar.focus();
+      document.getElementById("urlbar").focus();
     }
     onLoadComplete();
   }

From e809294900b3f8764798b14d88f3a7086a4615f5 Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Tue, 7 Sep 2010 09:58:26 -0500
Subject: [PATCH 218/222] Bug 593069 - Firefox window positioning incorrect
 after transitioning from full screen to minimized to full screen. r=roc,
 a=blocking-final.

---
 widget/src/windows/nsWindow.cpp | 6 ++++++
 widget/src/windows/nsWindow.h   | 1 +
 2 files changed, 7 insertions(+)

diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index e5526011e529..ac449960ca59 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -386,6 +386,7 @@ nsWindow::nsWindow() : nsBaseWidget()
   mTouchWindow          = PR_FALSE;
   mCustomNonClient      = PR_FALSE;
   mHideChrome           = PR_FALSE;
+  mFullscreenMode       = PR_FALSE;
   mWindowType           = eWindowType_child;
   mBorderStyle          = eBorderStyle_default;
   mPopupType            = ePopupTypeAny;
@@ -2724,6 +2725,7 @@ nsWindow::MakeFullScreen(PRBool aFullScreen)
 
 #else
 
+  mFullscreenMode = aFullScreen;
   if (aFullScreen) {
     if (mSizeMode == nsSizeMode_Fullscreen)
       return NS_OK;
@@ -5904,6 +5906,8 @@ void nsWindow::OnWindowPosChanged(WINDOWPOS *wp, PRBool& result)
       event.mSizeMode = nsSizeMode_Maximized;
     else if (pl.showCmd == SW_SHOWMINIMIZED)
       event.mSizeMode = nsSizeMode_Minimized;
+    else if (mFullscreenMode)
+      event.mSizeMode = nsSizeMode_Fullscreen;
     else
       event.mSizeMode = nsSizeMode_Normal;
 
@@ -6071,6 +6075,8 @@ void nsWindow::OnWindowPosChanging(LPWINDOWPOS& info)
       sizeMode = nsSizeMode_Maximized;
     else if (pl.showCmd == SW_SHOWMINIMIZED)
       sizeMode = nsSizeMode_Minimized;
+    else if (mFullscreenMode)
+      sizeMode = nsSizeMode_Fullscreen;
     else
       sizeMode = nsSizeMode_Normal;
 
diff --git a/widget/src/windows/nsWindow.h b/widget/src/windows/nsWindow.h
index b599a6e0413e..1ec2f503175d 100644
--- a/widget/src/windows/nsWindow.h
+++ b/widget/src/windows/nsWindow.h
@@ -476,6 +476,7 @@ protected:
   PRPackedBool          mDisplayPanFeedback;
   PRPackedBool          mHideChrome;
   PRPackedBool          mIsRTL;
+  PRPackedBool          mFullscreenMode;
   PRUint32              mBlurSuppressLevel;
   nsContentType         mContentType;
   DWORD_PTR             mOldStyle;

From 962d768006bc29c3739ec1ae9d2b526c4b883533 Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Tue, 7 Sep 2010 09:58:45 -0500
Subject: [PATCH 219/222] Bug 575855 - Transitions from fullscreen briefly show
 an aero basic window frame. r=vlad, a=blocking-final.

---
 widget/src/windows/nsWindow.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index ac449960ca59..556719cc4fd3 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -2737,11 +2737,18 @@ nsWindow::MakeFullScreen(PRBool aFullScreen)
 
   UpdateNonClientMargins();
 
+  // Prevent window updates during the transition.
+  DWORD style = GetWindowLong(mWnd, GWL_STYLE);
+  SetWindowLong(mWnd, GWL_STYLE, style & ~WS_VISIBLE);
+
   // Will call hide chrome, reposition window. Note this will
   // also cache dimensions for restoration, so it should only
   // be called once per fullscreen request.
   nsresult rv = nsBaseWidget::MakeFullScreen(aFullScreen);
 
+  style = GetWindowLong(mWnd, GWL_STYLE);
+  SetWindowLong(mWnd, GWL_STYLE, style | WS_VISIBLE);
+
   // Let the dom know via web shell window
   nsSizeModeEvent event(PR_TRUE, NS_SIZEMODE, this);
   event.mSizeMode = mSizeMode;

From fb28a5fffacba9d2ebedf16ce8009c216856fcee Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Tue, 7 Sep 2010 11:12:28 -0500
Subject: [PATCH 220/222] Bug 531551 - fix for crashes with older acrobat
 versions. r=jimm, a=blocking-final.

---
 .../base/src/nsPluginNativeWindowWin.cpp      | 60 +++++++++++++------
 1 file changed, 42 insertions(+), 18 deletions(-)

diff --git a/modules/plugin/base/src/nsPluginNativeWindowWin.cpp b/modules/plugin/base/src/nsPluginNativeWindowWin.cpp
index 6dd777f5cd1d..51bb169f723d 100644
--- a/modules/plugin/base/src/nsPluginNativeWindowWin.cpp
+++ b/modules/plugin/base/src/nsPluginNativeWindowWin.cpp
@@ -132,6 +132,7 @@ typedef enum {
   nsPluginType_Unknown = 0,
   nsPluginType_Flash,
   nsPluginType_Real,
+  nsPluginType_PDF,
   nsPluginType_Other
 } nsPluginType;
 
@@ -163,6 +164,8 @@ private:
   PluginWindowWeakRef mWeakRef;
   nsRefPtr<PluginWindowEvent> mCachedPluginWindowEvent;
 
+  HWND mParentWnd;
+  LONG_PTR mParentProc;
 public:
   nsPluginType mPluginType;
 };
@@ -230,23 +233,6 @@ static LRESULT CALLBACK PluginWndProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM
   nsCOMPtr<nsIPluginInstance> inst;
   win->GetPluginInstance(inst);
 
-  // check plugin mime type and cache whether it is Flash or not
-  // Flash will need special treatment later
-  if (win->mPluginType == nsPluginType_Unknown) {
-    if (inst) {
-      const char* mimetype = nsnull;
-      inst->GetMIMEType(&mimetype);
-      if (mimetype) { 
-        if (!strcmp(mimetype, "application/x-shockwave-flash"))
-          win->mPluginType = nsPluginType_Flash;
-        else if (!strcmp(mimetype, "audio/x-pn-realaudio-plugin"))
-          win->mPluginType = nsPluginType_Real;
-        else
-          win->mPluginType = nsPluginType_Other;
-      }
-    }
-  }
-
   // Real may go into a state where it recursivly dispatches the same event
   // when subclassed. If this is Real, lets examine the event and drop it
   // on the floor if we get into this recursive situation. See bug 192914.
@@ -408,7 +394,10 @@ nsPluginNativeWindowWin::nsPluginNativeWindowWin() : nsPluginNativeWindow()
   mPrevWinProc = NULL;
   mPluginWinProc = NULL;
   mPluginType = nsPluginType_Unknown;
-  
+
+  mParentWnd = NULL;
+  mParentProc = NULL;
+
   if (sWM_FLASHBOUNCEMSG == 0)
     sWM_FLASHBOUNCEMSG = ::RegisterWindowMessage(NS_PLUGIN_CUSTOM_MSG_ID);
 
@@ -503,6 +492,24 @@ nsresult nsPluginNativeWindowWin::CallSetWindow(nsCOMPtr<nsIPluginInstance> &aPl
   // check the incoming instance, null indicates that window is going away and we are
   // not interested in subclassing business any more, undo and don't subclass
 
+  // check plugin mime type and cache it if it will need special treatment later
+  if (mPluginType == nsPluginType_Unknown) {
+    if (aPluginInstance) {
+      const char* mimetype = nsnull;
+      aPluginInstance->GetMIMEType(&mimetype);
+      if (mimetype) { 
+        if (!strcmp(mimetype, "application/x-shockwave-flash"))
+          mPluginType = nsPluginType_Flash;
+        else if (!strcmp(mimetype, "audio/x-pn-realaudio-plugin"))
+          mPluginType = nsPluginType_Real;
+        else if (!strcmp(mimetype, "application/pdf"))
+          mPluginType = nsPluginType_PDF;
+        else
+          mPluginType = nsPluginType_Other;
+      }
+    }
+  }
+
   // WINCE does not subclass windows.  See bug 300011 for the details.
 #ifndef WINCE
   if (!aPluginInstance) {
@@ -515,6 +522,17 @@ nsresult nsPluginNativeWindowWin::CallSetWindow(nsCOMPtr<nsIPluginInstance> &aPl
     WNDPROC currentWndProc = (WNDPROC)::GetWindowLongPtr((HWND)window, GWLP_WNDPROC);
     if (currentWndProc != PluginWndProc)
       mPrevWinProc = currentWndProc;
+
+    // PDF plugin v7.0.9, v8.1.3, and v9.0 subclass parent window, bug 531551
+    // V8.2.2 and V9.1 don't have such problem.
+    if (mPluginType == nsPluginType_PDF) {
+      HWND parent = ::GetParent((HWND)window);
+      if (mParentWnd != parent) {
+        NS_ASSERTION(!mParentWnd, "Plugin's parent window changed");
+        mParentWnd = parent;
+        mParentProc = ::GetWindowLongPtr(mParentWnd, GWLP_WNDPROC);
+      }
+    }
   }
 #endif
 
@@ -593,6 +611,12 @@ nsresult nsPluginNativeWindowWin::UndoSubclassAndAssociateWindow()
     SetWindowLongPtr(hWnd, GWL_STYLE, style);
   }
 
+  if (mPluginType == nsPluginType_PDF && mParentWnd) {
+    ::SetWindowLongPtr(mParentWnd, GWLP_WNDPROC, mParentProc);
+    mParentWnd = NULL;
+    mParentProc = NULL;
+  }
+
   return NS_OK;
 }
 #endif // WINCE

From d9e0814bb4f24db525ddedde343c5c4f2afc2ec9 Mon Sep 17 00:00:00 2001
From: Mitchell Field <mitchell.field@live.com.au>
Date: Wed, 8 Sep 2010 02:06:55 +1000
Subject: [PATCH 221/222] Bug 542582 - pymake should support -s. r=khuey,
 a=NPOTB

---
 build/pymake/pymake/command.py | 9 ++++++++-
 build/pymake/pymake/data.py    | 6 ++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/build/pymake/pymake/command.py b/build/pymake/pymake/command.py
index 5cce422f1d0a..439baf3e5702 100644
--- a/build/pymake/pymake/command.py
+++ b/build/pymake/pymake/command.py
@@ -106,7 +106,8 @@ class _MakeContext(object):
                                           makeoverrides=self.overrides,
                                           workdir=self.workdir,
                                           context=self.context, env=self.env, makelevel=self.makelevel,
-                                          targets=self.targets, keepgoing=self.options.keepgoing)
+                                          targets=self.targets, keepgoing=self.options.keepgoing,
+                                          silent=self.options.silent)
 
             self.restarts += 1
 
@@ -186,6 +187,8 @@ def main(args, env, cwd, cb):
                       dest="printdir")
         op.add_option('--no-print-directory', action="store_false",
                       dest="printdir", default=True)
+        op.add_option('-s', '--silent', action="store_true",
+                      dest="silent", default=False)
 
         options, arguments1 = op.parse_args(parsemakeflags(env))
         options, arguments2 = op.parse_args(args, values=options)
@@ -208,6 +211,10 @@ def main(args, env, cwd, cb):
         if options.printdir:
             shortflags.append('w')
 
+        if options.silent:
+            shortflags.append('s')
+            options.printdir = False
+
         loglevel = logging.WARNING
         if options.verbose:
             loglevel = logging.DEBUG
diff --git a/build/pymake/pymake/data.py b/build/pymake/pymake/data.py
index 9b6e4f2bde86..b869830e0eb4 100644
--- a/build/pymake/pymake/data.py
+++ b/build/pymake/pymake/data.py
@@ -1185,7 +1185,7 @@ def getcommandsforrule(rule, target, makefile, prerequisites, stem):
         cstring = c.resolvestr(makefile, v)
         for cline in splitcommand(cstring):
             cline, isHidden, isRecursive, ignoreErrors = findmodifiers(cline)
-            if isHidden:
+            if isHidden or makefile.silent:
                 echo = None
             else:
                 echo = "%s$ %s" % (c.loc, cline)
@@ -1335,7 +1335,8 @@ class Makefile(object):
 
     def __init__(self, workdir=None, env=None, restarts=0, make=None,
                  makeflags='', makeoverrides='',
-                 makelevel=0, context=None, targets=(), keepgoing=False):
+                 makelevel=0, context=None, targets=(), keepgoing=False,
+                 silent=False):
         self.defaulttarget = None
 
         if env is None:
@@ -1349,6 +1350,7 @@ class Makefile(object):
         self.exportedvars = {}
         self._targets = {}
         self.keepgoing = keepgoing
+        self.silent = silent
         self._patternvariables = [] # of (pattern, variables)
         self.implicitrules = []
         self.parsingfinished = False

From fb431a2f1c84fd760f05ce6d2dcd7bc26842ebe4 Mon Sep 17 00:00:00 2001
From: Steven Michaud <smichaud@pobox.com>
Date: Tue, 7 Sep 2010 12:20:03 -0500
Subject: [PATCH 222/222] Bug 592563 - Call nsIWidget::Show() on plugin widgets
 from nsIWidget::ConfigureChildren(). r=roc,josh a=blockingbeta6+

---
 widget/src/cocoa/nsChildView.h  |  2 ++
 widget/src/cocoa/nsChildView.mm | 34 ++++++++++++++++-----------------
 2 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/widget/src/cocoa/nsChildView.h b/widget/src/cocoa/nsChildView.h
index 367c4bf4b7c3..ad3b325efbb3 100644
--- a/widget/src/cocoa/nsChildView.h
+++ b/widget/src/cocoa/nsChildView.h
@@ -402,6 +402,8 @@ public:
   nsCocoaTextInputHandler* TextInputHandler() { return &mTextInputHandler; }
   NSView<mozView>* GetEditorView();
 
+  PRBool IsPluginView() { return (mWindowType == eWindowType_plugin); }
+
 protected:
 
   PRBool            ReportDestroyEvent();
diff --git a/widget/src/cocoa/nsChildView.mm b/widget/src/cocoa/nsChildView.mm
index 8ce9ac94c62b..701686475172 100644
--- a/widget/src/cocoa/nsChildView.mm
+++ b/widget/src/cocoa/nsChildView.mm
@@ -907,8 +907,8 @@ NS_IMETHODIMP nsChildView::Show(PRBool aState)
 
     [mView setHidden:!aState];
     mVisible = aState;
-    if (!mVisible)
-      HideChildPluginViews(mView);
+    if (!mVisible && IsPluginView())
+      HidePlugin();
   }
   return NS_OK;
 
@@ -1004,14 +1004,9 @@ NS_IMETHODIMP nsChildView::SetFocus(PRBool aRaise)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  // Don't so anything if we're invisible (if Show(PR_FALSE) has been
-  // called on us, or if Show(PR_TRUE) hasn't yet been called).  This
-  // resolves bug 504450.
-  if (mView && ![mView isHidden]) {
-    NSWindow* window = [mView window];
-    if (window)
-      [window makeFirstResponder:mView];
-  }
+  NSWindow* window = [mView window];
+  if (window)
+    [window makeFirstResponder:mView];
   return NS_OK;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
@@ -1660,18 +1655,23 @@ void nsChildView::ApplyConfiguration(nsIWidget* aExpectedParent,
   nsWindowType kidType;
   aConfiguration.mChild->GetWindowType(kidType);
 #endif
-  NS_ASSERTION(kidType == eWindowType_plugin || kidType == eWindowType_child,
-               "Configured widget is not a child or plugin type");
+  NS_ASSERTION(kidType == eWindowType_plugin,
+               "Configured widget is not a plugin type");
   NS_ASSERTION(aConfiguration.mChild->GetParent() == aExpectedParent,
                "Configured widget is not a child of the right widget");
-  aConfiguration.mChild->Resize(
+
+  // nsIWidget::Show() doesn't get called on plugin widgets unless we call
+  // it from here.  See bug 592563.
+  nsChildView* child = static_cast<nsChildView*>(aConfiguration.mChild);
+  child->Show(!aConfiguration.mClipRegion.IsEmpty());
+
+  child->Resize(
       aConfiguration.mBounds.x, aConfiguration.mBounds.y,
       aConfiguration.mBounds.width, aConfiguration.mBounds.height,
       aRepaint);
-  // On Mac we don't use the clip region here, we just store it
-  // in case GetPluginClipRect needs it.
-  static_cast<nsChildView*>(aConfiguration.mChild)->
-    StoreWindowClipRegion(aConfiguration.mClipRegion);
+
+  // Store the clip region here in case GetPluginClipRect needs it.
+  child->StoreWindowClipRegion(aConfiguration.mClipRegion);
 }
 
 nsresult nsChildView::ConfigureChildren(const nsTArray<Configuration>& aConfigurations)