Merge only plugin changes from e10s to mozilla-central.

2009-12-16 09:19:07 -05:00 · 2009-12-16 09:19:07 -05:00 · 8051ceb908
--- a/accessible/src/atk/nsAccessibleWrap.cpp
+++ b/accessible/src/atk/nsAccessibleWrap.cpp
@ -925,10 +925,10 @@ refChildCB(AtkObject *aAtkObj, gint aChildIndex)
    NS_ASSERTION(childAtkObj, "Fail to get AtkObj");
    if (!childAtkObj)
        return nsnull;
+    g_object_ref(childAtkObj);
    
    //this will addref parent
    atk_object_set_parent(childAtkObj, aAtkObj);
-    g_object_ref(childAtkObj);
    return childAtkObj;
 }

--- a/accessible/src/base/nsARIAMap.cpp
+++ b/accessible/src/base/nsARIAMap.cpp
@ -408,6 +408,17 @@ nsRoleMapEntry nsARIAMap::gWAIRoleMap[] =
    eARIASelectable,
    eARIAReadonly
  },
+  {
+    "scrollbar",
+    nsIAccessibleRole::ROLE_SCROLLBAR,
+    kUseMapRole,
+    eHasValueMinMax,
+    eNoAction,
+    eNoLiveAttr,
+    kNoReqStates,
+    eARIAOrientation,
+    eARIAReadonly
+  },
  {
    "separator",
    nsIAccessibleRole::ROLE_SEPARATOR,
@ -628,6 +639,11 @@ nsStateMapEntry nsARIAMap::gWAIStateMap[] = {
  nsStateMapEntry(&nsAccessibilityAtoms::aria_multiselectable, kBoolType, 0,
                  nsIAccessibleStates::STATE_MULTISELECTABLE | nsIAccessibleStates::STATE_EXTSELECTABLE, 0),

+  // eARIAOrientation
+  nsStateMapEntry(&nsAccessibilityAtoms::aria_orientation, eUseFirstState,
+                  "vertical", 0, nsIAccessibleStates::EXT_STATE_VERTICAL,
+                  "horizontal", 0, nsIAccessibleStates::EXT_STATE_HORIZONTAL),
+
  // eARIAPressed
  nsStateMapEntry(&nsAccessibilityAtoms::aria_pressed, kMixedType,
                  nsIAccessibleStates::STATE_CHECKABLE,
@ -693,6 +709,7 @@ nsAttributeCharacteristics nsARIAMap::gWAIUnivAttrMap[] = {
  {&nsAccessibilityAtoms::aria_multiline,         ATTR_BYPASSOBJ | ATTR_VALTOKEN },
  {&nsAccessibilityAtoms::aria_multiselectable,   ATTR_BYPASSOBJ | ATTR_VALTOKEN },
  {&nsAccessibilityAtoms::aria_owns,              ATTR_BYPASSOBJ                 },
+  {&nsAccessibilityAtoms::aria_orientation,                        ATTR_VALTOKEN },
  {&nsAccessibilityAtoms::aria_pressed,           ATTR_BYPASSOBJ | ATTR_VALTOKEN },
  {&nsAccessibilityAtoms::aria_readonly,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
  {&nsAccessibilityAtoms::aria_relevant,          ATTR_BYPASSOBJ                 },
@ -749,6 +766,26 @@ nsStateMapEntry::nsStateMapEntry(nsIAtom **aAttrName,
 {
 }

+nsStateMapEntry::nsStateMapEntry(nsIAtom **aAttrName,
+                                 EDefaultStateRule aDefaultStateRule,
+                                 const char *aValue1,
+                                 PRUint32 aState1, PRUint32 aExtraState1,
+                                 const char *aValue2,
+                                 PRUint32 aState2, PRUint32 aExtraState2,
+                                 const char *aValue3,
+                                 PRUint32 aState3, PRUint32 aExtraState3) :
+  attributeName(aAttrName), isToken(PR_TRUE), permanentState(0),
+  value1(aValue1), state1(aState1), extraState1(aExtraState1),
+  value2(aValue2), state2(aState2), extraState2(aExtraState2),
+  value3(aValue3), state3(aState3), extraState3(aExtraState3),
+  defaultState(0), defaultExtraState(0), definedIfAbsent(PR_TRUE)
+{
+  if (aDefaultStateRule == eUseFirstState) {
+    defaultState = aState1;
+    defaultExtraState = aExtraState1;
+  }
+}
+
 PRBool
 nsStateMapEntry::MapToStates(nsIContent *aContent,
                             PRUint32 *aState, PRUint32 *aExtraState,
--- a/accessible/src/base/nsARIAMap.h
+++ b/accessible/src/base/nsARIAMap.h
@ -157,6 +157,12 @@ enum eStateValueType
  kMixedType
 };

+enum EDefaultStateRule
+{
+  //eNoDefaultState,
+  eUseFirstState
+};
+
 /**
 * ID for state map entry, used in nsRoleMapEntry.
 */
@ -174,6 +180,7 @@ enum eStateMapEntryID
  eARIAInvalid,
  eARIAMultiline,
  eARIAMultiSelectable,
+  eARIAOrientation,
  eARIAPressed,
  eARIAReadonly,
  eARIAReadonlyOrEditable,
@ -207,6 +214,17 @@ public:
                  const char *aValue3 = 0, PRUint32 aState3 = 0,
                  PRUint32 aExtraState3 = 0);

+  /**
+   * Used for ARIA attributes having enumerated values, and where a default
+   * attribute state should be assumed when not supplied by the author.
+   */
+  nsStateMapEntry(nsIAtom **aAttrName,
+                  EDefaultStateRule aDefaultStateRule,
+                  const char *aValue1, PRUint32 aState1, PRUint32 aExtraState1,
+                  const char *aValue2, PRUint32 aState2, PRUint32 aExtraState2,
+                  const char *aValue3 = 0, PRUint32 aState3 = 0,
+                  PRUint32 aExtraState3 = 0);
+
  /**
   * Maps ARIA state map pointed by state map entry ID to accessible states.
   *
--- a/accessible/src/base/nsAccessibilityAtomList.h
+++ b/accessible/src/base/nsAccessibilityAtomList.h
@ -241,6 +241,7 @@ ACCESSIBILITY_ATOM(aria_level, "aria-level")
 ACCESSIBILITY_ATOM(aria_live, "aria-live")
 ACCESSIBILITY_ATOM(aria_multiline, "aria-multiline")
 ACCESSIBILITY_ATOM(aria_multiselectable, "aria-multiselectable")
+ACCESSIBILITY_ATOM(aria_orientation, "aria-orientation")
 ACCESSIBILITY_ATOM(aria_owns, "aria-owns")
 ACCESSIBILITY_ATOM(aria_posinset, "aria-posinset")
 ACCESSIBILITY_ATOM(aria_pressed, "aria-pressed")
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@ -947,9 +947,12 @@ nsRootAccessible::Init()
  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
  NS_ENSURE_STATE(root);

-  root->AddRootAccessible(this);
+  nsresult rv = nsDocAccessibleWrap::Init();

-  return nsDocAccessibleWrap::Init();
+  if (NS_SUCCEEDED(rv))
+    root->AddRootAccessible(this);
+
+  return rv;
 }

 nsresult
--- a/accessible/tests/mochitest/common.js
+++ b/accessible/tests/mochitest/common.js
@ -79,6 +79,7 @@ const EXT_STATE_MULTI_LINE = nsIAccessibleStates.EXT_STATE_MULTI_LINE;
 const EXT_STATE_SINGLE_LINE = nsIAccessibleStates.EXT_STATE_SINGLE_LINE;
 const EXT_STATE_SUPPORTS_AUTOCOMPLETION = 
      nsIAccessibleStates.EXT_STATE_SUPPORTS_AUTOCOMPLETION;
+const EXT_STATE_VERTICAL = nsIAccessibleStates.EXT_STATE_VERTICAL;

 ////////////////////////////////////////////////////////////////////////////////
 // OS detect
--- a/accessible/tests/mochitest/role.js
+++ b/accessible/tests/mochitest/role.js
@ -44,6 +44,7 @@ const ROLE_PUSHBUTTON = nsIAccessibleRole.ROLE_PUSHBUTTON;
 const ROLE_RADIOBUTTON = nsIAccessibleRole.ROLE_RADIOBUTTON;
 const ROLE_ROW = nsIAccessibleRole.ROLE_ROW;
 const ROLE_ROWHEADER = nsIAccessibleRole.ROLE_ROWHEADER;
+const ROLE_SCROLLBAR = nsIAccessibleRole.ROLE_SCROLLBAR;
 const ROLE_SECTION = nsIAccessibleRole.ROLE_SECTION;
 const ROLE_SEPARATOR = nsIAccessibleRole.ROLE_SEPARATOR;
 const ROLE_SLIDER = nsIAccessibleRole.ROLE_SLIDER;
--- a/accessible/tests/mochitest/test_aria_roles.html
+++ b/accessible/tests/mochitest/test_aria_roles.html
@ -3,6 +3,7 @@
 <!--
 https://bugzilla.mozilla.org/show_bug.cgi?id=481114
 https://bugzilla.mozilla.org/show_bug.cgi?id=469688
+https://bugzilla.mozilla.org/show_bug.cgi?id=529289
 -->
 <head>
  <title>Test weak ARIA roles</title>
@ -63,6 +64,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=469688
      for (a in abstract_roles)
        testRole(abstract_roles[a], ROLE_SECTION);

+      // aria scrollbar
+      testRole("scrollbar", ROLE_SCROLLBAR);
      SimpleTest.finish();
    }

@ -74,6 +77,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=469688

  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=481114">Mozilla Bug 481114</a>
  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=469688">Mozilla Bug 469688</a>
+  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=529289">Mozilla Bug 529289</a>
+  </a>
  <p id="display"></p>
  <div id="content" style="display: none"></div>
  <pre id="test">
@ -134,5 +139,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=469688
  <div role="section" id="section">section</div>
  <div role="sectionhead" id="sectionhead">sectionhead</div>

+  <!-- aria scrollbar -->
+  <div role="scrollbar" id="scrollbar">scrollbar</div>
 </body>
 </html>
--- a/accessible/tests/mochitest/test_events_valuechange.html
+++ b/accessible/tests/mochitest/test_events_valuechange.html
@ -66,6 +66,7 @@
      testValue("slider_vn", "5", 5, 0, 1000, 0);
      testValue("slider_vnvt", "plain", 0, 0, 5, 0);
      testValue("slider_vt", "hi", 0, 0, 3, 0);
+      testValue("scrollbar", "5", 5, 0, 1000, 0);

      // Test value change events
      gQueue = new eventQueue(nsIAccessibleEvent.EVENT_VALUE_CHANGE);
@ -73,6 +74,7 @@
      gQueue.push(new changeValue("slider_vn", "6", undefined));
      gQueue.push(new changeValue("slider_vt", undefined, "hey!"));
      gQueue.push(new changeValue("slider_vnvt", "3", "sweet"));
+      gQueue.push(new changeValue("scrollbar", "6", undefined));

      gQueue.invoke(); // Will call SimpleTest.finish();
    }
@ -89,6 +91,11 @@
     title=" Fire delayed value changed event for aria-valuetext changes">
    Mozilla Bug 478032
  </a>
+  <a target="_blank"
+    href="https://bugzilla.mozilla.org/show_bug.cgi?id=529289"
+    title="We dont expose new aria role 'scrollbar' and property aria-orientation">
+   Mozilla Bug 529289
+  </a>

  <p id="display"></p>
  <div id="content" style="display: none"></div>
@ -98,12 +105,16 @@

  <!-- ARIA sliders -->
  <div id="slider_vn" role="slider" aria-valuenow="5"
-    aria-valuemin="0" aria-valuemax="1000">slider</div>
+       aria-valuemin="0" aria-valuemax="1000">slider</div>

  <div id="slider_vt" role="slider" aria-valuetext="hi"
-    aria-valuemin="0" aria-valuemax="3">greeting slider</div>
+       aria-valuemin="0" aria-valuemax="3">greeting slider</div>

  <div id="slider_vnvt" role="slider" aria-valuenow="0" aria-valuetext="plain"
-    aria-valuemin="0" aria-valuemax="5">sweetness slider</div>
+       aria-valuemin="0" aria-valuemax="5">sweetness slider</div>
+
+  <!-- ARIA scrollbar -->
+  <div id="scrollbar" role="scrollbar" aria-valuenow="5"
+       aria-valuemin="0" aria-valuemax="1000">slider</div>
 </body>
 </html>
--- a/accessible/tests/mochitest/test_states.html
+++ b/accessible/tests/mochitest/test_states.html
@ -93,6 +93,11 @@
      testStates("aria_main_anchor", STATE_SELECTABLE);
      testStates("aria_navigation_anchor", STATE_SELECTABLE);

+      // scrollbar
+      testStates("aria_scrollbar", 0, EXT_STATE_VERTICAL);
+      testStates("aria_hscrollbar", 0, EXT_STATE_HORIZONTAL);
+      testStates("aria_vscrollbar", 0, EXT_STATE_VERTICAL);
+
      SimpleTest.finish();
    }

@ -183,5 +188,9 @@
  <a id="aria_main_anchor" role="main" name="main_anchor">main</a>
  <a id="aria_navigation_anchor" role="navigation" name="nav_anchor">nav</a>

+  <!-- scrollbar -->
+  <div id="aria_scrollbar" role="scrollbar">scrollbar</a>
+  <div id="aria_hscrollbar" role="scrollbar" aria-orientation="horizontal">horizontal scrollbar</a>
+  <div id="aria_vscrollbar" role="scrollbar" aria-orientation="vertical">vertical scrollbar</a>
 </body>
 </html>
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@ -311,8 +311,13 @@ pref("browser.microsummary.updateGenerators", true);
 pref("browser.search.suggest.enabled", true);

 pref("browser.sessionhistory.max_entries", 50);
+#ifndef WINCE
 pref("browser.history_expire_days", 180);
 pref("browser.history_expire_days_min", 90);
+#else
+pref("browser.history_expire_days", 90);
+pref("browser.history_expire_days_min", 45);
+#endif
 pref("browser.history_expire_sites", 40000);

 // handle links targeting new windows
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@ -2292,7 +2292,7 @@ function SetPageProxyState(aState)
    gLastValidURLStr = gURLBar.value;
    gURLBar.addEventListener("input", UpdatePageProxyState, false);

-    PageProxySetIcon(gBrowser.selectedBrowser.mIconURL);
+    PageProxySetIcon(gBrowser.getIcon());
  } else if (aState == "invalid") {
    gURLBar.removeEventListener("input", UpdatePageProxyState, false);
    PageProxyClearIcon();
@ -3102,7 +3102,7 @@ const BrowserSearch = {
      var ss = Cc["@mozilla.org/browser/search-service;1"].
               getService(Ci.nsIBrowserSearchService);
      var searchForm = ss.defaultEngine.searchForm;
-      loadURI(searchForm, null, null, false);
+      openUILinkIn(searchForm, "current");
    }
  },

@ -3913,9 +3913,9 @@ var XULBrowserWindow = {
    }
  },
  
-  onLinkIconAvailable: function (aBrowser) {
+  onLinkIconAvailable: function (aBrowser, aIconURL) {
    if (gProxyFavIcon && gBrowser.userTypedValue === null)
-      PageProxySetIcon(aBrowser.mIconURL); // update the favicon in the URL bar
+      PageProxySetIcon(aIconURL); // update the favicon in the URL bar
  },

  onProgressChange: function (aWebProgress, aRequest,
@ -3980,7 +3980,7 @@ var XULBrowserWindow = {
        if (aWebProgress.DOMWindow == content) {
          if (aRequest)
            this.endDocumentLoad(aRequest, aStatus);
-          if (!gBrowser.mTabbedMode && !gBrowser.selectedBrowser.mIconURL)
+          if (!gBrowser.mTabbedMode && !gBrowser.getIcon())
            gBrowser.useDefaultIcon(gBrowser.selectedTab);
        }
      }
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@ -700,7 +700,7 @@
                let p = this.mProgressListeners[i];
                if ('onLinkIconAvailable' in p)
                  try {
-                    p.onLinkIconAvailable(browser);
+                    p.onLinkIconAvailable(browser, browser.mIconURL);
                  } catch (e) {
                    // don't inhibit other listeners
                    Components.utils.reportError(e);
@ -712,7 +712,7 @@
              let p = this.mTabsProgressListeners[i];
              if ('onLinkIconAvailable' in p)
                try {
-                  p.onLinkIconAvailable(browser);
+                  p.onLinkIconAvailable(browser, browser.mIconURL);
                } catch (e) {
                  // don't inhibit other listeners
                  Components.utils.reportError(e);
@ -722,6 +722,16 @@
        </body>
      </method>

+      <method name="getIcon">
+        <parameter name="aTab"/>
+        <body>
+          <![CDATA[
+            let browser = aTab ? this.getBrowserForTab(aTab) : this.selectedBrowser;
+            return browser.mIconURL;
+          ]]>
+        </body>
+      </method>
+
      <method name="updateIcon">
        <parameter name="aTab"/>
        <body>
--- a/browser/base/content/test/browser_bug477014.js
+++ b/browser/base/content/test/browser_bug477014.js
@ -76,7 +76,7 @@ function test() {
    }

    is(newWindow.gBrowser.selectedTab.hasAttribute("busy"), true);
-    is(newWindow.gBrowser.selectedTab.linkedBrowser.mIconURL,iconURLSpec);
+    is(newWindow.gBrowser.getIcon(), iconURLSpec);
    newWindow.close();
    finish();
  }
--- a/browser/components/nsBrowserGlue.js
+++ b/browser/components/nsBrowserGlue.js
@ -316,6 +316,18 @@ BrowserGlue.prototype = {
  // profile shutdown handler (contains profile cleanup routines)
  _onProfileShutdown: function() 
  {
+#ifdef WINCE
+    // If there's a pending update, clear cache to free up disk space.
+    try {
+      let um = Cc["@mozilla.org/updates/update-manager;1"].
+               getService(Ci.nsIUpdateManager);
+      if (um.activeUpdate && um.activeUpdate.state == "pending") {
+        let cacheService = Cc["@mozilla.org/network/cache-service;1"].
+                           getService(Ci.nsICacheService);
+        cacheService.evictEntries(Ci.nsICache.STORE_ANYWHERE);
+      }
+    } catch (e) { }
+#endif
    this._shutdownPlaces();
    this._idleService.removeIdleObserver(this, BOOKMARKS_BACKUP_IDLE_TIME);
    this._isIdleObserver = false;
--- a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_viewsource.js
+++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_viewsource.js
@ -102,7 +102,6 @@ function test() {
        onSecurityChange: function() {},
        onStatusChange: function() {},
        onRefreshAttempted: function() {},
-        onLinkIconAvailable: function() {},
        onStateChange: function(aBrowser, aWebProgress, aRequest, aStateFlags, aStatus) {
          if (aStateFlags & (Ci.nsIWebProgressListener.STATE_STOP |
                             Ci.nsIWebProgressListener.STATE_IS_WINDOW)) {
--- a/browser/components/search/content/engineManager.js
+++ b/browser/components/search/content/engineManager.js
@ -226,7 +226,7 @@ var gEngineManagerDialog = {

 function onDragEngineStart(event) {
  var selectedIndex = gEngineView.selectedIndex;
-  if (selectedIndex > 0) {
+  if (selectedIndex >= 0) {
    event.dataTransfer.setData(ENGINE_FLAVOR, selectedIndex.toString());
    event.dataTransfer.effectAllowed = "move";
  }
--- a/browser/components/sessionstore/test/browser/browser_354894.js
+++ b/browser/components/sessionstore/test/browser/browser_354894.js
@ -443,7 +443,29 @@ function test() {
        newWin.BrowserTryToCloseWindow();
        newWin2.BrowserTryToCloseWindow();

+        browserWindowsCount([0, 1], "browser windows while running testOpenCloseRestoreFromPopup");
+
        newWin = undoCloseWindow(0);
+        newWin.addEventListener("load", function () {
+          info(["testOpenCloseRestoreFromPopup: newWin loaded", newWin.closed, newWin.document]);
+          var ds = newWin.delayedStartup;
+          newWin.delayedStartup = function () {
+            info(["testOpenCloseRestoreFromPopup: newWin delayedStartup", newWin.closed, newWin.document]);
+            ds.apply(newWin, arguments);
+          };
+        }, false);
+        newWin.addEventListener("unload", function () {
+          info("testOpenCloseRestoreFromPopup: newWin unloaded");
+/*
+          var data;
+          try {
+            data = Cc["@mozilla.org/browser/sessionstore;1"]
+                     .getService(Ci.nsISessionStore)
+                     .getWindowState(newWin);
+          } catch (e) { }
+          ok(!data, "getWindowState should not have data about newWin");
+*/
+        }, false);

        newWin2 = openDialog(location, "_blank", CHROME_FEATURES);
        newWin2.addEventListener("load", function() {
@ -454,10 +476,20 @@ function test() {
            is(TEST_URLS.indexOf(newWin2.gBrowser.browsers[0].currentURI.spec), -1,
               "Did not restore, as undoCloseWindow() was last called (2)");

+            browserWindowsCount([2, 3], "browser windows while running testOpenCloseRestoreFromPopup");
+
+            info([newWin.closed, newWin.__SSi, newWin.__SS_restoreID, newWin.__SS_dyingCache]);
+
            // Cleanup
            newWin.close();
            newWin2.close();

+            info([newWin.closed, newWin.__SSi, newWin.__SS_restoreID, newWin.__SS_dyingCache]);
+
+            browserWindowsCount([0, 1], "browser windows while running testOpenCloseRestoreFromPopup");
+
+            info([newWin.closed, newWin.__SSi, newWin.__SS_restoreID, newWin.__SS_dyingCache]);
+
            // Next please
            executeSoon(nextFn);
          });
@ -536,7 +568,7 @@ function test() {
          browserWindowsCount([0, 1], "browser windows after testOpenCloseWindowAndPopup");
          testOpenCloseOnlyPopup(function () {
            browserWindowsCount([0, 1], "browser windows after testOpenCloseOnlyPopup");
-            testOpenCloseRestoreFromPopup (function () {
+            testOpenCloseRestoreFromPopup(function () {
              browserWindowsCount([0, 1], "browser windows after testOpenCloseRestoreFromPopup");
              testNotificationCount(function () {
                cleanupTestsuite();
--- a/browser/components/wintaskbar/WindowsJumpLists.jsm
+++ b/browser/components/wintaskbar/WindowsJumpLists.jsm
@ -341,7 +341,7 @@ var WinTaskbarJumpList =
                     createInstance(Ci.nsILocalHandlerApp);
    handlerApp.executable = file;
    // handlers default to the leaf name if a name is not specified
-    if (name.length != 0)
+    if (name && name.length != 0)
      handlerApp.name = name;
    handlerApp.detailedDescription = description;
    handlerApp.appendParameter(args);
--- a/browser/components/wintaskbar/WindowsPreviewPerTab.jsm
+++ b/browser/components/wintaskbar/WindowsPreviewPerTab.jsm
@ -517,9 +517,9 @@ TabWindow.prototype = {
  },
  onStatusChange: function () {
  },
-  onLinkIconAvailable: function (aBrowser) {
+  onLinkIconAvailable: function (aBrowser, aIconURL) {
    let self = this;
-    getFaviconAsImage(aBrowser.mIconURL, function (img) {
+    getFaviconAsImage(aIconURL, function (img) {
      let index = self.tabbrowser.browsers.indexOf(aBrowser);
      // Only add it if we've found the index.  The tab could have closed!
      if (index != -1)
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@ -90,7 +90,7 @@
 #elifdef XP_OS2
@BINPATH@/plugins/npnulos2.dll
 #endif
-@BINPATH@/@DLL_PREFIX@sqlite3@DLL_SUFFIX@
+@BINPATH@/@DLL_PREFIX@mozsqlite3@DLL_SUFFIX@
@BINPATH@/README.txt
@BINPATH@/LICENSE
@BINPATH@/blocklist.xml
--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@ -843,4 +843,5 @@ components/brwsrcmp.dll
 components/nsUpdateService.js
 components/nsUpdateServiceStub.js
 #endif
+@DLL_PREFIX@sqlite3@DLL_SUFFIX@
 old-homepage-default.properties
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@ -556,6 +556,9 @@ toolbar[mode="full"] .toolbarbutton-menubutton-button {
 #home-button {
  list-style-image: url("moz-icon://stock/gtk-home?size=toolbar");
 }
+#home-button[disabled="true"] {
+  list-style-image: url("moz-icon://stock/gtk-home?size=toolbar&state=disabled");
+}

 #downloads-button {
  -moz-image-region: rect(0px 24px 24px 0px);
@ -678,6 +681,10 @@ toolbar[iconsize="small"] #home-button ,
 #home-button.bookmark-item {
  list-style-image: url("moz-icon://stock/gtk-home?size=menu");
 }
+toolbar[iconsize="small"] #home-button[disabled="true"],
+#home-button.bookmark-item[disabled="true"] {
+  list-style-image: url("moz-icon://stock/gtk-home?size=menu&state=disabled");
+}

 toolbar[iconsize="small"] #downloads-button {
  -moz-image-region: rect(0px 16px 16px 0px);
--- a/browser/themes/pinstripe/browser/browser.css
+++ b/browser/themes/pinstripe/browser/browser.css
@ -582,6 +582,9 @@ toolbar[iconsize="small"] #unified-back-forward-button > #back-forward-dropmarke
 #home-button {
  -moz-image-region: rect(0px, 180px, 23px, 144px);
 }
+#home-button[disabled="true"] {
+  -moz-image-region: rect(23px, 180px, 46px, 144px) !important;
+}
 #home-button:hover:active {
  -moz-image-region: rect(46px, 180px, 69px, 144px);
 }
--- a/browser/themes/winstripe/browser/Toolbar-aero.png
+++ b/browser/themes/winstripe/browser/Toolbar-aero.png
--- a/browser/themes/winstripe/browser/Toolbar-small-aero.png
+++ b/browser/themes/winstripe/browser/Toolbar-small-aero.png
--- a/browser/themes/winstripe/browser/Toolbar-small.png
+++ b/browser/themes/winstripe/browser/Toolbar-small.png
--- a/browser/themes/winstripe/browser/Toolbar.png
+++ b/browser/themes/winstripe/browser/Toolbar.png
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@ -404,6 +404,9 @@ toolbar[iconsize="small"][mode="icons"] #back-forward-dropmarker:not([disabled="
 #home-button:hover {
  -moz-image-region: rect(24px 120px 48px 96px);
 }
+#home-button[disabled="true"] {
+  -moz-image-region: rect(48px 120px 72px 96px);
+}

 /* download manager button */

@ -599,6 +602,10 @@ toolbar[iconsize="small"] #home-button:hover,
 #home-button.bookmark-item:hover {
  -moz-image-region: rect(16px 80px 32px 64px);
 }
+toolbar[iconsize="small"] #home-button[disabled="true"],
+#home-button.bookmark-item[disabled="true"] {
+  -moz-image-region: rect(32px 80px 48px 64px);
+}

 /* download manager button */

--- a/build/automation.py.in
+++ b/build/automation.py.in
@ -526,15 +526,17 @@ else:
      # The method throws OSError if the PID is invalid, which we catch below.
      os.kill(pid, 0)

-      # wait on it to see if it's a zombie
+      # Wait on it to see if it's a zombie. This can throw OSError.ECHILD if
+      # the process terminates before we get to this point.
      wpid, wstatus = os.waitpid(pid, os.WNOHANG)
      if wpid == 0:
        return True

      return False
    except OSError, err:
-      # Catch the one error we expect from os.kill, and re-raise any others
-      if err.errno == errno.ESRCH:
+      # Catch the errors we might expect from os.kill/os.waitpid, 
+      # and re-raise any others
+      if err.errno == errno.ESRCH or err.errno == errno.ECHILD:
        return False
      raise

--- a/configure.in
+++ b/configure.in
@ -4566,6 +4566,7 @@ MOZ_DBGRINFO_MODULES=
 MOZ_FEEDS=1
 MOZ_IMG_DECODERS_DEFAULT="png gif jpeg bmp icon"
 MOZ_IMG_ENCODERS_DEFAULT="png jpeg"
+MOZ_IPC=1
 MOZ_JAVAXPCOM=
 MOZ_JSDEBUGGER=1
 MOZ_JSLOADER=1
@ -5294,13 +5295,11 @@ MOZ_ARG_DISABLE_BOOL(jsd,
 dnl ========================================================
 dnl = Disable IPC support for tabs and plugins
 dnl ========================================================
-MOZ_IPC=1
-
 case "${target}" in
 *-apple-darwin*)
    MOZ_IPC=
    ;;
-*wince)
+*-wince*)
    MOZ_IPC=
    ;;
 esac
@ -6183,7 +6182,7 @@ MOZ_NATIVE_SQLITE= )
 if test -z "$MOZ_NATIVE_SQLITE"
 then
    SQLITE_CFLAGS=
-    SQLITE_LIBS='$(call EXPAND_LIBNAME_PATH,sqlite3,$(DIST)/lib)'
+    SQLITE_LIBS='$(call EXPAND_LIBNAME_PATH,mozsqlite3,$(DIST)/lib)'
 else
    PKG_CHECK_MODULES(SQLITE, sqlite3 >= $SQLITE_VERSION)
 fi
--- a/content/base/src/nsCrossSiteListenerProxy.cpp
+++ b/content/base/src/nsCrossSiteListenerProxy.cpp
@ -245,7 +245,13 @@ nsCrossSiteListenerProxy::CheckRequestApproved(nsIRequest* aRequest,
    PRBool succeeded;
    rv = http->GetRequestSucceeded(&succeeded);
    NS_ENSURE_SUCCESS(rv, rv);
-    NS_ENSURE_TRUE(succeeded, NS_ERROR_DOM_BAD_URI);
+    if (!succeeded) {
+      PRUint32 responseStatus;
+      rv = http->GetResponseStatus(&responseStatus);
+      NS_ENSURE_SUCCESS(rv, rv);
+      NS_ENSURE_TRUE(mAllowedHTTPErrors.Contains(responseStatus),
+                     NS_ERROR_DOM_BAD_URI);
+    }
  }

  // Check the Access-Control-Allow-Origin header
--- a/content/base/src/nsCrossSiteListenerProxy.h
+++ b/content/base/src/nsCrossSiteListenerProxy.h
@ -81,6 +81,11 @@ public:
  // Must be called at startup.
  static void Startup();

+  void AllowHTTPResult(PRUint32 aResultCode)
+  {
+    mAllowedHTTPErrors.AppendElement(aResultCode);
+  }
+
 private:
  nsresult UpdateChannel(nsIChannel* aChannel);
  nsresult CheckRequestApproved(nsIRequest* aRequest, PRBool aIsRedirect);
@ -94,6 +99,7 @@ private:
  PRBool mIsPreflight;
  nsCString mPreflightMethod;
  nsTArray<nsCString> mPreflightHeaders;
+  nsTArray<PRUint32> mAllowedHTTPErrors;
 };

 #endif
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@ -631,13 +631,16 @@ nsresult nsHTMLMediaElement::LoadResource(nsIURI* aURI)

  nsCOMPtr<nsIStreamListener> listener;
  if (ShouldCheckAllowOrigin()) {
-    listener = new nsCrossSiteListenerProxy(loadListener,
-                                            NodePrincipal(),
-                                            mChannel,
-                                            PR_FALSE,
-                                            &rv);
-    NS_ENSURE_SUCCESS(rv,rv);
-    if (!listener) return NS_ERROR_OUT_OF_MEMORY;
+    nsCrossSiteListenerProxy* crossSiteListener =
+      new nsCrossSiteListenerProxy(loadListener,
+                                   NodePrincipal(),
+                                   mChannel,
+                                   PR_FALSE,
+                                   &rv);
+    listener = crossSiteListener;
+    NS_ENSURE_TRUE(crossSiteListener, NS_ERROR_OUT_OF_MEMORY);
+    NS_ENSURE_SUCCESS(rv, rv);
+    crossSiteListener->AllowHTTPResult(HTTP_REQUESTED_RANGE_NOT_SATISFIABLE_CODE);
  } else {
    rv = nsContentUtils::GetSecurityManager()->
           CheckLoadURIWithPrincipal(NodePrincipal(),
--- a/content/media/nsMediaStream.cpp
+++ b/content/media/nsMediaStream.cpp
@ -59,7 +59,6 @@

 #define HTTP_OK_CODE 200
 #define HTTP_PARTIAL_RESPONSE_CODE 206
-#define HTTP_REQUESTED_RANGE_NOT_SATISFIABLE_CODE 416

 using mozilla::TimeStamp;

@ -425,13 +424,16 @@ nsresult nsMediaChannelStream::OpenChannel(nsIStreamListener** aStreamListener)
    NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);
    if (element->ShouldCheckAllowOrigin()) {
      nsresult rv;
-      listener = new nsCrossSiteListenerProxy(mListener,
-                                              element->NodePrincipal(),
-                                              mChannel,
-                                              PR_FALSE,
-                                              &rv);
-      NS_ENSURE_TRUE(listener, NS_ERROR_OUT_OF_MEMORY);
+      nsCrossSiteListenerProxy* crossSiteListener =
+        new nsCrossSiteListenerProxy(mListener,
+                                     element->NodePrincipal(),
+                                     mChannel,
+                                     PR_FALSE,
+                                     &rv);
+      listener = crossSiteListener;
+      NS_ENSURE_TRUE(crossSiteListener, NS_ERROR_OUT_OF_MEMORY);
      NS_ENSURE_SUCCESS(rv, rv);
+      crossSiteListener->AllowHTTPResult(HTTP_REQUESTED_RANGE_NOT_SATISFIABLE_CODE);
    } else {
      nsresult rv = nsContentUtils::GetSecurityManager()->
        CheckLoadURIWithPrincipal(element->NodePrincipal(),
--- a/content/media/nsMediaStream.h
+++ b/content/media/nsMediaStream.h
@ -53,6 +53,8 @@
 // done rather than a byte range request.
 #define SEEK_VS_READ_THRESHOLD (32*1024)

+#define HTTP_REQUESTED_RANGE_NOT_SATISFIABLE_CODE 416
+
 class nsMediaDecoder;

 /**
--- a/content/media/test/Makefile.in
+++ b/content/media/test/Makefile.in
@ -179,6 +179,7 @@ ifdef MOZ_OGG
 _TEST_FILES += \
 		dynamic_redirect.sjs \
 		file_access_controls.html \
+		test_access_control.html \
 		test_bug448534.html \
 		test_bug468190.html \
 		test_bug486646.html \
@ -227,7 +228,6 @@ ifneq ($(OS_ARCH),WINNT)
 # figure out the random failures. See bug 475369 and bug 526323
 _TEST_FILES += \
 		test_timeupdate3.html \
-		test_access_control.html \
 		$(NULL)
 endif
 endif
--- a/content/media/test/file_access_controls.html
+++ b/content/media/test/file_access_controls.html
@ -15,7 +15,7 @@ var gTests = [
  },{
    // Test 1
    url: "redirect.sjs?http://example.com/tests/content/media/test/320x240.allow-origin.ogv",
-    result: "loaded",
+    result: "loadeddata",
    description: "Can load when redirected to different domain with allow-origin",
  },{
    // Test 2
@ -25,17 +25,17 @@ var gTests = [
  },{
    // Test 3
    url: "redirect.sjs?http://test1.example.org/tests/content/media/test/320x240.allow-origin.ogv",
-    result: "loaded",
+    result: "loadeddata",
    description: "Can load when redirected to subdomain with allow-origin",
  },{
    // Test 4
    url: "redirect.sjs?http://example.org/tests/content/media/test/320x240.ogv",
-    result: "loaded",
+    result: "loadeddata",
    description: "Can load when redirected to same domain",
  },{
    // Test 5
    url: "http://example.org/tests/content/media/test/320x240.ogv",
-    result: "loaded",
+    result: "loadeddata",
    description: "Can load from same domain"
  },{
    // Test 6
@ -45,7 +45,7 @@ var gTests = [
  },{
    // Test 7
    url: "http://example.org:8000/tests/content/media/test/320x240.allow-origin.ogv",
-    result: "loaded",
+    result: "loadeddata",
    description: "Can load from different port on same domain with allow-origin",
  },{
    // Test 8
@ -55,12 +55,12 @@ var gTests = [
  },{
    // Test 9
    url: "http://example.com/tests/content/media/test/320x240.allow-origin.ogv",
-    result: "loaded",
+    result: "loadeddata",
    description: "Can load cross domain with allow-origin",
  },{
    // Test 10
    url: "http://test1.example.org/tests/content/media/test/320x240.allow-origin.ogv",
-    result: "loaded",
+    result: "loadeddata",
    description: "Can load from subdomain with allow-origin",
  },{
    // Test 11
@ -71,24 +71,25 @@ var gTests = [
 ];

 var gTestNum = 0;
-var gExpectedResult = null;
-var gTestDescription = null;
 var gVideo = null;
 var gTestedRemoved = false;
 var gOldPref;

-function result(code) {
-  //dump((gTestNum - 1) + ": " + code + "\n");
+function eventHandler(event) {
  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-  opener.is(code, gExpectedResult, gTestDescription);
+  //dump((gTestNum - 1) + ": " + event.type + "\n");
+  var video = event.target;
+  opener.is(event.type, video.expectedResult, video.testDescription +
+    (gTestedRemoved ? " (element not in document)" : " (element in document)"));
+  // Make sure any extra events cause an error
+  video.expectedResult = "<none>";
  nextTest();
 }

 function createVideo() {
  var v = document.createElement('video');
-  v.addEventListener('loadeddata', function(){result('loaded');}, false);
-  v.addEventListener('error', function(){result('error');}, false);
-  v.id = 'video';
+  v.addEventListener('loadeddata', eventHandler, false);
+  v.addEventListener('error', eventHandler, false);
  return v;
 }

@ -112,7 +113,6 @@ function load() {

 function nextTest() {
  //dump("nextTest() called, gTestNum="+gTestNum+" gTestedRemoved="+gTestedRemoved+"\n");
-  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
  if (gTestNum == gTests.length) {
    //dump("gTestNum == gTests.length\n");
    if (!gTestedRemoved) {
@ -126,15 +126,15 @@ function nextTest() {
      return;
    }
  }
-  gExpectedResult = gTests[gTestNum].result;
-  gTestDescription = gTests[gTestNum].description;
-  //dump("Starting test " + gTestNum + " at " + gTests[gTestNum].url + " expecting:" + gExpectedResult + "\n");

  if (gVideo && gVideo.parentNode)
    gVideo.parentNode.removeChild(gVideo);
  
  gVideo = createVideo();
+  gVideo.expectedResult = gTests[gTestNum].result;
+  gVideo.testDescription = gTests[gTestNum].description;
  gVideo.src = gTests[gTestNum].url;
+  //dump("Starting test " + gTestNum + " at " + gVideo.src + " expecting:" + gVideo.expectedResult + "\n");
  if (!gTestedRemoved) {
    document.body.appendChild(gVideo); 
    // Will cause load() to be invoked.
--- a/content/xul/templates/src/nsXULTemplateBuilder.cpp
+++ b/content/xul/templates/src/nsXULTemplateBuilder.cpp
@ -1870,9 +1870,11 @@ nsXULTemplateBuilder::CompileTemplate(nsIContent* aTemplate,
                                              getter_AddRefs(action));

            if (action){
-                nsCOMPtr<nsIAtom> memberVariable;
-                DetermineMemberVariable(action, getter_AddRefs(memberVariable));
-                if (! memberVariable) continue;
+                nsCOMPtr<nsIAtom> memberVariable = mMemberVariable;
+                if (!memberVariable) {
+                    memberVariable = DetermineMemberVariable(action);
+                    if (!memberVariable) continue;
+                }

                if (hasQuery) {
                    nsCOMPtr<nsIAtom> tag;
@ -1994,9 +1996,11 @@ nsXULTemplateBuilder::CompileTemplate(nsIContent* aTemplate,
            if (tag)
                aQuerySet->SetTag(tag);

-            nsCOMPtr<nsIAtom> memberVariable;
-            DetermineMemberVariable(rulenode, getter_AddRefs(memberVariable));
-            if (! memberVariable) continue;
+            nsCOMPtr<nsIAtom> memberVariable = mMemberVariable;
+            if (!memberVariable) {
+                memberVariable = DetermineMemberVariable(rulenode);
+                if (!memberVariable) continue;
+            }

            nsCOMPtr<nsIDOMNode> query(do_QueryInterface(aQuerySet->mQueryNode));

@ -2077,53 +2081,26 @@ nsXULTemplateBuilder::CompileExtendedQuery(nsIContent* aRuleElement,
    return NS_OK;
 }

-nsresult
-nsXULTemplateBuilder::DetermineMemberVariable(nsIContent* aActionElement,
-                                              nsIAtom** aMemberVariable)
+already_AddRefed<nsIAtom>
+nsXULTemplateBuilder::DetermineMemberVariable(nsIContent* aElement)
 {
-    // If the member variable hasn't already been specified, then
-    // grovel over <action> to find it. We'll use the first one
-    // that we find in a breadth-first search.
+    // recursively iterate over the children looking for an element
+    // with uri="?..."
+    for (nsINode::ChildIterator iter(aElement); !iter.IsDone(); iter.Next()) {
+        nsAutoString uri;
+        nsIContent *child = iter;
+        child->GetAttr(kNameSpaceID_None, nsGkAtoms::uri, uri);
+        if (!uri.IsEmpty() && uri[0] == PRUnichar('?')) {
+            return NS_NewAtom(uri);
+        }

-    if (mMemberVariable) {
-        *aMemberVariable = mMemberVariable;
-        NS_IF_ADDREF(*aMemberVariable);
-    }
-    else {
-        *aMemberVariable = nsnull;
-
-        nsCOMArray<nsIContent> unvisited;
-
-        if (!unvisited.AppendObject(aActionElement))
-            return NS_ERROR_OUT_OF_MEMORY;
-
-        while (unvisited.Count()) {
-            nsIContent* next = unvisited[0];
-            unvisited.RemoveObjectAt(0);
-
-            nsAutoString uri;
-            next->GetAttr(kNameSpaceID_None, nsGkAtoms::uri, uri);
-
-            if (!uri.IsEmpty() && uri[0] == PRUnichar('?')) {
-                // Found it.
-                *aMemberVariable = NS_NewAtom(uri);
-                break;
-            }
-
-            // otherwise, append the children to the unvisited list: this
-            // results in a breadth-first search.
-            PRUint32 count = next->GetChildCount();
-
-            for (PRUint32 i = 0; i < count; ++i) {
-                nsIContent *child = next->GetChildAt(i);
-
-                if (!unvisited.AppendObject(child))
-                    return NS_ERROR_OUT_OF_MEMORY;
-            }
+        nsCOMPtr<nsIAtom> result = DetermineMemberVariable(child);
+        if (result) {
+            return result.forget();
        }
    }

-    return NS_OK;
+    return nsnull;
 }

 void
--- a/content/xul/templates/src/nsXULTemplateBuilder.h
+++ b/content/xul/templates/src/nsXULTemplateBuilder.h
@ -212,8 +212,7 @@ public:
     * Determine the member variable from inside an action body. It will be
     * the value of the uri attribute on a node.
     */
-    nsresult
-    DetermineMemberVariable(nsIContent* aActionElement, nsIAtom** aMemberVariable);
+    already_AddRefed<nsIAtom> DetermineMemberVariable(nsIContent* aElement);

    /**
     * Compile a simple query. A simple query is one that doesn't have a
--- a/db/sqlite3/src/Makefile.in
+++ b/db/sqlite3/src/Makefile.in
@ -46,7 +46,7 @@ VPATH		= @srcdir@
 include $(DEPTH)/config/autoconf.mk

 MODULE           = sqlite3
-LIBRARY_NAME     = sqlite3
+LIBRARY_NAME     = mozsqlite3
 FORCE_SHARED_LIB = 1
 VISIBILITY_FLAGS =
 LIB_IS_C_ONLY    = 1
--- a/db/sqlite3/src/sqlite.def
+++ b/db/sqlite3/src/sqlite.def
@ -33,7 +33,7 @@
 ;
 ; ***** END LICENSE BLOCK *****

-LIBRARY sqlite3.dll
+LIBRARY mozsqlite3.dll

 EXPORTS
        sqlite3_aggregate_context
--- a/docshell/resources/content/netError.xhtml
+++ b/docshell/resources/content/netError.xhtml
@ -63,7 +63,7 @@
         toolkit/components/places/src/nsFaviconService.h should be updated. -->
    <link rel="icon" type="image/png" id="favicon" href="chrome://global/skin/icons/warning-16.png"/>

-    <script type="application/x-javascript"><![CDATA[
+    <script type="application/javascript"><![CDATA[
      // Error url MUST be formatted like this:
      //   moz-neterror:page?e=error&u=url&d=desc
      //
@ -376,7 +376,7 @@
    - an onload handler. This is because error pages are loaded as
    - LOAD_BACKGROUND, which means that onload handlers will not be executed.
    -->
-    <script type="application/x-javascript">initPage();</script>
+    <script type="application/javascript">initPage();</script>

  </body>
 </html>
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@ -419,6 +419,7 @@ public:
  NPError ShowNativeContextMenu(NPMenu* menu, void* event);
  NPBool ConvertPoint(double sourceX, double sourceY, NPCoordinateSpace sourceSpace,
                      double *destX, double *destY, NPCoordinateSpace destSpace);
+  void SendIdleEvent();

  NS_DECL_CYCLE_COLLECTION_CLASS(nsDummyJavaPluginOwner)

@ -563,6 +564,11 @@ nsDummyJavaPluginOwner::SetEventModel(PRInt32 eventModel)
  return NS_ERROR_NOT_IMPLEMENTED;
 }

+void
+nsDummyJavaPluginOwner::SendIdleEvent()
+{
+}
+
 /**
 * An indirect observer object that means we don't have to implement nsIObserver
 * on nsGlobalWindow, where any script could see it.
--- a/dom/plugins/NPEventWindows.h
+++ b/dom/plugins/NPEventWindows.h
@ -51,7 +51,7 @@ struct NPRemoteEvent
 {
    NPEvent event;
    union {
-        NPRect rect;
+        RECT rect;
        WINDOWPOS windowpos;
    } lParamData;
 };
@ -87,9 +87,9 @@ struct ParamTraits<mozilla::plugins::NPRemoteEvent>
                paramCopy.lParamData.windowpos = *(reinterpret_cast<WINDOWPOS*>(paramCopy.event.lParam));
                break;
            case WM_PAINT:
-                // The lParam paramter of WM_PAINT holds a pointer to an NPRect
+                // The lParam paramter of WM_PAINT holds a pointer to an RECT
                // structure specifying the bounding box of the update area.
-                paramCopy.lParamData.rect = *(reinterpret_cast<NPRect*>(paramCopy.event.lParam));
+                paramCopy.lParamData.rect = *(reinterpret_cast<RECT*>(paramCopy.event.lParam));
                break;

            // the white list of events that we will ipc to the client
@ -127,8 +127,12 @@ struct ParamTraits<mozilla::plugins::NPRemoteEvent>
            case WM_KILLFOCUS:
                break;

-            // ignore any events we don't expect
            default:
+                // RegisterWindowMessage events should be passed.
+                if (paramCopy.event.event >= 0xC000 && paramCopy.event.event <= 0xFFFF)
+                    break;
+
+                // ignore any events we don't expect
                return;
        }

@ -145,7 +149,7 @@ struct ParamTraits<mozilla::plugins::NPRemoteEvent>
        memcpy(aResult, bytes, sizeof(paramType));

        if (aResult->event.event == WM_PAINT) {
-            // restore the lParam to point at the NPRect
+            // restore the lParam to point at the RECT
            aResult->event.lParam = reinterpret_cast<LPARAM>(&aResult->lParamData.rect);
        } else if (aResult->event.event == WM_WINDOWPOSCHANGED) {
            // restore the lParam to point at the WINDOWPOS
--- a/dom/plugins/PluginInstanceChild.cpp
+++ b/dom/plugins/PluginInstanceChild.cpp
@ -59,6 +59,7 @@ using mozilla::gfx::SharedDIB;

 #include <windows.h>

+#define NS_OOPP_DOUBLEPASS_MSGID TEXT("MozDoublePassMsg")
 #endif

 PluginInstanceChild::PluginInstanceChild(const NPPluginFuncs* aPluginIface) :
@ -77,6 +78,10 @@ PluginInstanceChild::PluginInstanceChild(const NPPluginFuncs* aPluginIface) :
 #  ifdef MOZ_WIDGET_GTK2
        mWsInfo.display = GDK_DISPLAY();
 #  endif
+#endif
+#if defined(OS_WIN)
+    memset(&mAlphaExtract, 0, sizeof(mAlphaExtract));
+    mAlphaExtract.doublePassEvent = ::RegisterWindowMessage(NS_OOPP_DOUBLEPASS_MSGID);
 #endif
    }

@ -342,9 +347,21 @@ PluginInstanceChild::AnswerNPP_HandleEvent(const NPRemoteEvent& event,
    NPEvent evcopy = event.event;

 #ifdef OS_WIN
-    // Setup the shared dib for painting and update evcopy.
-    if (NPWindowTypeDrawable == mWindow.type && WM_PAINT == evcopy.event)
-        SharedSurfaceBeforePaint(evcopy);
+    // Painting for win32. SharedSurfacePaint handles everything.
+    if (mWindow.type == NPWindowTypeDrawable) {
+       if (evcopy.event == WM_PAINT) {
+          *handled = SharedSurfacePaint(evcopy);
+          return true;
+       }
+       else if (evcopy.event == mAlphaExtract.doublePassEvent) {
+            // We'll render to mSharedSurfaceDib first, then render to a cached bitmap
+            // we store locally. The two passes are for alpha extraction, so the second
+            // pass must be to a flat white surface in order for things to work.
+            mAlphaExtract.doublePass = RENDER_BACK_ONE;
+            *handled = true;
+            return true;
+       }
+    }
 #endif

    *handled = mPluginIface->event(&mData, reinterpret_cast<void*>(&evcopy));
@ -675,6 +692,9 @@ PluginInstanceChild::SharedSurfaceSetWindow(const NPRemoteWindow& aWindow,
        if (NS_FAILED(mSharedSurfaceDib.Attach((SharedDIB::Handle)aWindow.surfaceHandle,
                                               aWindow.width, aWindow.height, 32)))
          return false;
+        // Free any alpha extraction resources if needed. This will be reset
+        // the next time it's used.
+        AlphaExtractCacheRelease();
    }
      
    // NPRemoteWindow's origin is the origin of our shared dib.
@ -694,20 +714,137 @@ void
 PluginInstanceChild::SharedSurfaceRelease()
 {
    mSharedSurfaceDib.Close();
+    AlphaExtractCacheRelease();
+}
+
+/* double pass cache buffer - (rarely) used in cases where alpha extraction
+ * occurs for windowless plugins. */
+ 
+bool
+PluginInstanceChild::AlphaExtractCacheSetup()
+{
+    AlphaExtractCacheRelease();
+
+    mAlphaExtract.hdc = ::CreateCompatibleDC(NULL);
+
+    if (!mAlphaExtract.hdc)
+        return false;
+
+    BITMAPINFOHEADER bmih;
+    memset((void*)&bmih, 0, sizeof(BITMAPINFOHEADER));
+    bmih.biSize        = sizeof(BITMAPINFOHEADER);
+    bmih.biWidth       = mWindow.width;
+    bmih.biHeight      = mWindow.height;
+    bmih.biPlanes      = 1;
+    bmih.biBitCount    = 32;
+    bmih.biCompression = BI_RGB;
+
+    void* ppvBits = nsnull;
+    mAlphaExtract.bmp = ::CreateDIBSection(mAlphaExtract.hdc,
+                                           (BITMAPINFO*)&bmih,
+                                           DIB_RGB_COLORS,
+                                           (void**)&ppvBits,
+                                           NULL,
+                                           (unsigned long)sizeof(BITMAPINFOHEADER));
+    if (!mAlphaExtract.bmp)
+      return false;
+
+    DeleteObject(::SelectObject(mAlphaExtract.hdc, mAlphaExtract.bmp));
+    return true;
 }

 void
-PluginInstanceChild::SharedSurfaceBeforePaint(NPEvent& evcopy)
+PluginInstanceChild::AlphaExtractCacheRelease()
 {
-    // Update the clip rect on our internal hdc
-    RECT* pRect = reinterpret_cast<RECT*>(evcopy.lParam);
-    if (pRect) {
-      HRGN clip = ::CreateRectRgnIndirect(pRect);
-      ::SelectClipRgn(mSharedSurfaceDib.GetHDC(), clip);
-      ::DeleteObject(clip);
+    if (mAlphaExtract.bmp)
+        ::DeleteObject(mAlphaExtract.bmp);
+
+    if (mAlphaExtract.hdc)
+        ::DeleteObject(mAlphaExtract.hdc);
+
+    mAlphaExtract.bmp = NULL;
+    mAlphaExtract.hdc = NULL;
+}
+
+void
+PluginInstanceChild::UpdatePaintClipRect(RECT* aRect)
+{
+    if (aRect) {
+        // Update the clip rect on our internal hdc
+        HRGN clip = ::CreateRectRgnIndirect(aRect);
+        ::SelectClipRgn(mSharedSurfaceDib.GetHDC(), clip);
+        ::DeleteObject(clip);
    }
-    // pass the internal hdc to the plugin
-    evcopy.wParam = WPARAM(mSharedSurfaceDib.GetHDC());
+}
+
+int16_t
+PluginInstanceChild::SharedSurfacePaint(NPEvent& evcopy)
+{
+    RECT* pRect = reinterpret_cast<RECT*>(evcopy.lParam);
+
+    switch(mAlphaExtract.doublePass) {
+        case RENDER_NATIVE:
+            // pass the internal hdc to the plugin
+            UpdatePaintClipRect(pRect);
+            evcopy.wParam = WPARAM(mSharedSurfaceDib.GetHDC());
+            return mPluginIface->event(&mData, reinterpret_cast<void*>(&evcopy));
+        break;
+        case RENDER_BACK_ONE:
+              // Handle a double pass render used in alpha extraction for transparent
+              // plugins. (See nsObjectFrame and gfxWindowsNativeDrawing for details.)
+              // We render twice, once to the shared dib, and once to a cache which
+              // we copy back on a second paint. These paints can't be spread across
+              // multiple rpc messages as delays cause animation frame changes.
+              if (!mAlphaExtract.bmp && !AlphaExtractCacheSetup()) {
+                  mAlphaExtract.doublePass = RENDER_NATIVE;
+                  return false;
+              }
+
+              // See gfxWindowsNativeDrawing, color order doesn't have to match.
+              ::FillRect(mSharedSurfaceDib.GetHDC(), pRect, (HBRUSH)GetStockObject(WHITE_BRUSH));
+              UpdatePaintClipRect(pRect);
+              evcopy.wParam = WPARAM(mSharedSurfaceDib.GetHDC());
+              if (!mPluginIface->event(&mData, reinterpret_cast<void*>(&evcopy))) {
+                  mAlphaExtract.doublePass = RENDER_NATIVE;
+                  return false;
+              }
+
+              // Copy to cache. We render to shared dib so we don't have to call
+              // setwindow between calls (flash issue).  
+              ::BitBlt(mAlphaExtract.hdc,
+                       pRect->left,
+                       pRect->top,
+                       pRect->right - pRect->left,
+                       pRect->bottom - pRect->top,
+                       mSharedSurfaceDib.GetHDC(),
+                       pRect->left,
+                       pRect->top,
+                       SRCCOPY);
+
+              ::FillRect(mSharedSurfaceDib.GetHDC(), pRect, (HBRUSH)GetStockObject(BLACK_BRUSH));
+              if (!mPluginIface->event(&mData, reinterpret_cast<void*>(&evcopy))) {
+                  mAlphaExtract.doublePass = RENDER_NATIVE;
+                  return false;
+              }
+              mAlphaExtract.doublePass = RENDER_BACK_TWO;
+              return true;
+        break;
+        case RENDER_BACK_TWO:
+              // copy our cached surface back
+              ::BitBlt(mSharedSurfaceDib.GetHDC(),
+                       pRect->left,
+                       pRect->top,
+                       pRect->right - pRect->left,
+                       pRect->bottom - pRect->top,
+                       mAlphaExtract.hdc,
+                       pRect->left,
+                       pRect->top,
+                       SRCCOPY);
+              mAlphaExtract.doublePass = RENDER_NATIVE;
+              return true;
+        break;
+    }
+    return false;
 }

 #endif // OS_WIN
--- a/dom/plugins/PluginInstanceChild.h
+++ b/dom/plugins/PluginInstanceChild.h
@ -198,11 +198,25 @@ private:
 private:
    // Shared dib rendering management for windowless plugins.
    bool SharedSurfaceSetWindow(const NPRemoteWindow& aWindow, NPError* rv);
-    void SharedSurfaceBeforePaint(NPEvent& evcopy);
+    int16_t SharedSurfacePaint(NPEvent& evcopy);
    void SharedSurfaceRelease();
+    bool AlphaExtractCacheSetup();
+    void AlphaExtractCacheRelease();
+    void UpdatePaintClipRect(RECT* aRect);

 private:
+    enum {
+      RENDER_NATIVE,
+      RENDER_BACK_ONE,
+      RENDER_BACK_TWO 
+    };
    gfx::SharedDIBWin mSharedSurfaceDib;
+    struct {
+      PRUint32        doublePassEvent;
+      PRUint16        doublePass;
+      HDC             hdc;
+      HBITMAP         bmp;
+    } mAlphaExtract;
 #endif // defined(OS_WIN)
 };

--- a/dom/plugins/PluginInstanceParent.cpp
+++ b/dom/plugins/PluginInstanceParent.cpp
@ -48,7 +48,7 @@
 #include "nsAutoPtr.h"

 #if defined(OS_WIN)
-#define NS_OOPP_DOUBLEPASS_MSGID TEXT("MozDoublePassMsg")
+#include <windowsx.h>
 #endif

 using namespace mozilla::plugins;
@ -61,14 +61,6 @@ PluginInstanceParent::PluginInstanceParent(PluginModuleParent* parent,
    mNPNIface(npniface),
    mWindowType(NPWindowTypeWindow)
 {
-#if defined(OS_WIN)
-    // Event sent from nsObjectFrame indicating double pass rendering for
-    // windowless plugins. RegisterWindowMessage makes it easy sync event
-    // values, and insures we never conflict with windowing events we allow
-    // for windowless plugins.
-    mDoublePassEvent = ::RegisterWindowMessage(NS_OOPP_DOUBLEPASS_MSGID);
-    mLocalCopyRender = false;
-#endif
 }

 PluginInstanceParent::~PluginInstanceParent()
@ -464,20 +456,58 @@ PluginInstanceParent::NPP_HandleEvent(void* event)
    NPEvent* npevent = reinterpret_cast<NPEvent*>(event);
    NPRemoteEvent npremoteevent;
    npremoteevent.event = *npevent;
+    int16_t handled;

 #if defined(OS_WIN)
    RECT rect;
    if (mWindowType == NPWindowTypeDrawable) {
-        if (mDoublePassEvent && mDoublePassEvent == npevent->event) {
-            // Sent from nsObjectFrame to let us know a double pass render is in progress.
-            mLocalCopyRender = PR_TRUE;
-            return true;
-        } else if (WM_PAINT == npevent->event) {
-            // Don't forward on the second pass, otherwise, fall through.
-            if (!SharedSurfaceBeforePaint(rect, npremoteevent))
-                return true;
+        switch(npevent->event) {
+            case WM_PAINT:
+            {
+                RECT rect;
+                SharedSurfaceBeforePaint(rect, npremoteevent);
+                if (!CallNPP_HandleEvent(npremoteevent, &handled))
+                    return 0;
+                if (handled)
+                    SharedSurfaceAfterPaint(npevent);
+            }
+            break;
+            case WM_WINDOWPOSCHANGED:
+                SharedSurfaceSetOrigin(npremoteevent);
+                if (!CallNPP_HandleEvent(npremoteevent, &handled))
+                    return 0;
+            break;
+            case WM_MOUSEMOVE:
+            case WM_RBUTTONDOWN:
+            case WM_MBUTTONDOWN:
+            case WM_LBUTTONDOWN:
+            case WM_LBUTTONUP:
+            case WM_MBUTTONUP:
+            case WM_RBUTTONUP:
+            case WM_LBUTTONDBLCLK:
+            case WM_MBUTTONDBLCLK:
+            case WM_RBUTTONDBLCLK:
+            {
+                // Received mouse events have an origin at the position of the plugin rect
+                // in the page. However, when rendering to the shared dib, the rect origin
+                // changes to 0,0 via the WM_WINDOWPOSCHANGED event. In this case we need to
+                // translate these coords to the proper location.
+                nsPoint pt(GET_X_LPARAM(npremoteevent.event.lParam), GET_Y_LPARAM(npremoteevent.event.lParam));
+                pt.MoveBy(-mPluginPosOrigin.x, -mPluginPosOrigin.y);
+                npremoteevent.event.lParam = MAKELPARAM(pt.x, pt.y);
+                if (!CallNPP_HandleEvent(npremoteevent, &handled))
+                    return 0;
+            }
+            default:
+                if (!CallNPP_HandleEvent(npremoteevent, &handled))
+                    return 0;
+            break;
        }
    }
+    else {
+        if (!CallNPP_HandleEvent(npremoteevent, &handled))
+            return 0;
+    }
 #endif

 #if defined(MOZ_X11)
@ -495,16 +525,9 @@ PluginInstanceParent::NPP_HandleEvent(void* event)
        XSync(GDK_DISPLAY(), False);
 #  endif
    }
-#endif

-    int16_t handled;
-    if (!CallNPP_HandleEvent(npremoteevent, &handled)) {
-        return 0;               // no good way to handle errors here...
-    }
-
-#if defined(OS_WIN)
-    if (handled && mWindowType == NPWindowTypeDrawable && WM_PAINT == npevent->event)
-        SharedSurfaceAfterPaint(npevent);
+    if (!CallNPP_HandleEvent(npremoteevent, &handled))
+        return 0; // no good way to handle errors here...
 #endif

    return handled;
@ -680,6 +703,41 @@ PluginInstanceParent::AnswerNPN_PopPopupsEnabledState(bool* aSuccess)

 /* windowless drawing helpers */

+/*
+ * Origin info:
+ *
+ * windowless, offscreen:
+ *
+ * WM_WINDOWPOSCHANGED: origin is relative to container 
+ * setwindow: origin is 0,0
+ * WM_PAINT: origin is 0,0
+ *
+ * windowless, native:
+ *
+ * WM_WINDOWPOSCHANGED: origin is relative to container 
+ * setwindow: origin is relative to container
+ * WM_PAINT: origin is relative to container
+ *
+ * PluginInstanceParent:
+ *
+ * painting: mPluginPort (nsIntRect, saved in SetWindow)
+ * event translation: mPluginPosOrigin (nsIntPoint, saved in SetOrigin)
+ */
+
+void
+PluginInstanceParent::SharedSurfaceSetOrigin(NPRemoteEvent& npremoteevent)
+{
+    WINDOWPOS* winpos = (WINDOWPOS*)npremoteevent.event.lParam;
+
+    // save the origin, we'll use this to translate input coordinates
+    mPluginPosOrigin.x = winpos->x;
+    mPluginPosOrigin.y = winpos->y;
+
+    // Reset to the offscreen dib origin
+    winpos->x  = 0;
+    winpos->y  = 0;
+}
+
 void
 PluginInstanceParent::SharedSurfaceRelease()
 {
@ -711,7 +769,7 @@ PluginInstanceParent::SharedSurfaceSetWindow(const NPWindow* aWindow,
      aRemoteWindow.surfaceHandle = 0;
      return true;
    }
-    
+
    // allocate a new shared surface
    SharedSurfaceRelease();
    if (NS_FAILED(mSharedSurfaceDib.Create(reinterpret_cast<HDC>(aWindow->window),
@ -720,36 +778,23 @@ PluginInstanceParent::SharedSurfaceSetWindow(const NPWindow* aWindow,

    // save the new shared surface size we just allocated
    mSharedSize = newPort;
-    
+
    base::SharedMemoryHandle handle;
    if (NS_FAILED(mSharedSurfaceDib.ShareToProcess(mParent->ChildProcessHandle(), &handle)))
      return false;

    aRemoteWindow.surfaceHandle = handle;
-    
+
    return true;
 }

-bool
+void
 PluginInstanceParent::SharedSurfaceBeforePaint(RECT& rect,
                                               NPRemoteEvent& npremoteevent)
 {
    RECT* dr = (RECT*)npremoteevent.event.lParam;
    HDC parentHdc = (HDC)npremoteevent.event.wParam;

-    // We render twice per frame for windowless plugins that sit in transparent
-    // frames. (See nsObjectFrame and gfxWindowsNativeDrawing for details.) IPC
-    // message delays in OOP plugin painting can result in two passes yeilding
-    // different animation frames. The second rendering doesn't need to go over
-    // the wire (we already have a copy of the frame in mSharedSurfaceDib) so we
-    // skip off requesting the second. This also gives us a nice perf boost.
-    if (mLocalCopyRender) {
-      mLocalCopyRender = false;
-      // Reuse the old render.
-      SharedSurfaceAfterPaint(&npremoteevent.event);
-      return false;
-    }
-
    nsIntRect dirtyRect(dr->left, dr->top, dr->right-dr->left, dr->bottom-dr->top);
    dirtyRect.MoveBy(-mPluginPort.x, -mPluginPort.y); // should always be smaller than dirtyRect

@ -766,14 +811,11 @@ PluginInstanceParent::SharedSurfaceBeforePaint(RECT& rect,
    // setup the translated dirty rect we'll send to the child
    rect.left   = dirtyRect.x;
    rect.top    = dirtyRect.y;
-    rect.right  = dirtyRect.width;
-    rect.bottom = dirtyRect.height;
+    rect.right  = dirtyRect.x + dirtyRect.width;
+    rect.bottom = dirtyRect.y + dirtyRect.height;

    npremoteevent.event.wParam = WPARAM(0);
    npremoteevent.event.lParam = LPARAM(&rect);
-
-    // Send the event to the plugin
-    return true;
 }

 void
--- a/dom/plugins/PluginInstanceParent.h
+++ b/dom/plugins/PluginInstanceParent.h
@ -217,16 +217,16 @@ private:
 private:
    // Used in rendering windowless plugins in other processes.
    bool SharedSurfaceSetWindow(const NPWindow* aWindow, NPRemoteWindow& aRemoteWindow);
-    bool SharedSurfaceBeforePaint(RECT &rect, NPRemoteEvent& npremoteevent);
+    void SharedSurfaceBeforePaint(RECT &rect, NPRemoteEvent& npremoteevent);
    void SharedSurfaceAfterPaint(NPEvent* npevent);
+    void SharedSurfaceSetOrigin(NPRemoteEvent& npremoteevent);
    void SharedSurfaceRelease();

 private:
    gfx::SharedDIBWin  mSharedSurfaceDib;
    nsIntRect          mPluginPort;
    nsIntRect          mSharedSize;
-    PRUint32           mDoublePassEvent;
-    bool               mLocalCopyRender;
+    nsIntPoint         mPluginPosOrigin;
 #endif // defined(XP_WIN)
 };

--- a/dom/plugins/PluginPRLibrary.h
+++ b/dom/plugins/PluginPRLibrary.h
@ -96,13 +96,17 @@ public:

        mNP_GetMIMEDescription = (NP_GetMIMEDescriptionFunc)
            PR_FindFunctionSymbol(mLibrary, "NP_GetMIMEDescription");
+#ifndef XP_MACOSX
        if (!mNP_GetMIMEDescription)
            return false;
+#endif

        mNP_GetValue = (NP_GetValueFunc)
            PR_FindFunctionSymbol(mLibrary, "NP_GetValue");
+#ifndef XP_MACOSX
        if (!mNP_GetValue)
            return false;
+#endif

 #if defined(XP_WIN) || defined(XP_MACOSX)
        mNP_GetEntryPoints = (NP_GetEntryPointsFunc)
--- a/dom/plugins/PluginProcessParent.cpp
+++ b/dom/plugins/PluginProcessParent.cpp
@ -67,7 +67,11 @@ bool
 PluginProcessParent::Launch()
 {
    std::vector<std::string> args;
+#if defined(XP_WIN)
+    args.push_back("\""+ mPluginFilePath +"\"");
+#else
    args.push_back(mPluginFilePath);
+#endif
    return SyncLaunch(args);
 }

--- a/dom/tests/browser/browser_focus_steal_from_chrome.js
+++ b/dom/tests/browser/browser_focus_steal_from_chrome.js
@ -1,6 +1,10 @@
 function test() {
  waitForExplicitFinish();

+  let secMan = Components.classes["@mozilla.org/scriptsecuritymanager;1"]
+                         .getService(Components.interfaces
+                                               .nsIScriptSecurityManager);
+
  let fm = Components.classes["@mozilla.org/focus-manager;1"]
                     .getService(Components.interfaces.nsIFocusManager);

@ -136,6 +140,32 @@ function test() {
      return;
    }

+    // XXX puts some useful information for bug 534420
+    let activeWindow = fm.activeWindow;
+    let focusedWindow = fm.focusedWindow;
+    ok(activeWindow, "We're not active");
+    ok(focusedWindow, "There is no focused window");
+    is(activeWindow, window.top, "our window isn't active");
+    let searchbar = BrowserSearch.searchBar;
+    let focusedElement = fm.focusedElement;
+    if (searchbar) {
+      let principal = searchbar.nodePrincipal;
+      ok(principal, "principal is null");
+      info("search bar: tagName=" + searchbar.tagName + " id=" + searchbar.id);
+      ok(secMan.isSystemPrincipal(principal), "search bar isn't chrome");
+    } else {
+      info("search bar is NULL!!");
+    }
+    if (focusedElement) {
+      let principal = focusedElement.nodePrincipal;
+      ok(principal, "principal is null");
+      info("focusedElement: tagName=" + focusedElement.tagName +
+           " id=" + focusedElement.id);
+      ok(secMan.isSystemPrincipal(principal), "focusedElement isn't chrome");
+    } else {
+      info("focusedElement is NULL!!");
+    }
+
    // The contents shouldn't be able to steal the focus from chrome.

    // in foreground tab
--- a/extensions/auth/nsAuthSSPI.cpp
+++ b/extensions/auth/nsAuthSSPI.cpp
@ -315,6 +315,11 @@ nsAuthSSPI::GetNextToken(const void *inToken,

    LOG(("entering nsAuthSSPI::GetNextToken()\n"));

+    if (!mCtxt.dwLower && !mCtxt.dwUpper) {
+        LOG(("nsAuthSSPI::GetNextToken(), not initialized. exiting."));
+        return NS_ERROR_NOT_INITIALIZED;
+    }
+
    if (mServiceFlags & REQ_DELEGATE)
        ctxReq |= ISC_REQ_DELEGATE;
    if (mServiceFlags & REQ_MUTUAL_AUTH)
--- a/extensions/cookie/test/unit/test_eviction.js
+++ b/extensions/cookie/test/unit/test_eviction.js
@ -0,0 +1,89 @@
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+
+function run_test()
+{
+  var cs = Cc["@mozilla.org/cookieService;1"].getService(Ci.nsICookieService);
+  var cm = Cc["@mozilla.org/cookiemanager;1"].getService(Ci.nsICookieManager2);
+  var ios = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
+  var prefs = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch);
+
+  // twiddle prefs to convenient values for this test
+  prefs.setIntPref("network.cookie.purgeAge", 1);
+  prefs.setIntPref("network.cookie.maxNumber", 1000);
+
+  // eviction is performed based on two limits: when the total number of cookies
+  // exceeds maxNumber + 10% (1100), and when cookies are older than purgeAge
+  // (1 second). purging is done when both conditions are satisfied, and only
+  // those cookies are purged.
+
+  // we test the following cases of eviction:
+  // 1) excess and age are satisfied, but only some of the excess are old enough
+  // to be purged.
+  do_check_eq(testEviction(cm, 1101, 2, 50, 1051), 1051);
+
+  // 2) excess and age are satisfied, and all of the excess are old enough
+  // to be purged.
+  do_check_eq(testEviction(cm, 1101, 2, 100, 1001), 1001);
+
+  // 3) excess and age are satisfied, and more than the excess are old enough
+  // to be purged.
+  do_check_eq(testEviction(cm, 1101, 2, 500, 1001), 1001);
+
+  // 4) excess but not age are satisfied.
+  do_check_eq(testEviction(cm, 2000, 0, 0, 2000), 2000);
+
+  // 5) age but not excess are satisfied.
+  do_check_eq(testEviction(cm, 1100, 2, 200, 1100), 1100);
+
+  cm.removeAll();
+
+  // reset prefs to defaults
+  prefs.setIntPref("network.cookie.purgeAge", 30 * 24 * 60 * 60);
+  prefs.setIntPref("network.cookie.maxNumber", 2000);
+}
+
+// test that cookies are evicted by order of lastAccessed time, if both the limit
+// on total cookies (maxNumber + 10%) and the purge age are exceeded
+function
+testEviction(aCM, aNumberTotal, aSleepDuration, aNumberOld, aNumberToExpect)
+{
+  aCM.removeAll();
+  var expiry = (Date.now() + 1e6) * 1000;
+
+  var i;
+  for (i = 0; i < aNumberTotal; ++i) {
+    var host = "eviction." + i + ".tests";
+    aCM.add(host, "", "test", "eviction", false, false, false, expiry);
+
+    if ((i == aNumberOld - 1) && aSleepDuration) {
+      // sleep a while, to make sure the first batch of cookies is older than
+      // the second (timer resolution varies on different platforms).
+      sleep(aSleepDuration * 1000);
+    }
+  }
+
+  var enumerator = aCM.enumerator;
+
+  i = 0;
+  while (enumerator.hasMoreElements()) {
+    var cookie = enumerator.getNext().QueryInterface(Ci.nsICookie2);
+    ++i;
+
+    if (aNumberTotal != aNumberToExpect) {
+      // make sure the cookie is one of the batch we expect was purged.
+      var hostNumber = new Number(cookie.rawHost.split(".")[1]);
+      if (hostNumber < (aNumberOld - aNumberToExpect)) break;
+    }
+  }
+
+  return i;
+}
+
+// delay for a number of milliseconds
+function sleep(delay)
+{
+  var start = Date.now();
+  while (Date.now() < start + delay);
+}
+
--- a/extensions/layout-debug/src/Makefile.in
+++ b/extensions/layout-debug/src/Makefile.in
@ -47,7 +47,8 @@ LIBRARY_NAME	= gkdebug
 EXPORT_LIBRARY	= 1
 IS_COMPONENT	= 1
 MODULE_NAME	= nsLayoutDebugModule
-LIBXUL_LIBRARY = 1
+LIBXUL_LIBRARY	= 1
+GRE_MODULE	= 1


 XPIDLSRCS	= \
--- a/extensions/reporter/resources/content/reporter/reporterOverlay.js
+++ b/extensions/reporter/resources/content/reporter/reporterOverlay.js
@ -68,7 +68,6 @@ var reporterListener = {
  onProgressChange: function() {  },
  onStatusChange: function() {  },
  onSecurityChange: function() {  },
-  onLinkIconAvailable: function() {  },
  onProgressChange64: function() { },
  onRefreshAttempted: function() { return true; }
 }
--- a/gfx/src/thebes/nsThebesDeviceContext.cpp
+++ b/gfx/src/thebes/nsThebesDeviceContext.cpp
@ -646,11 +646,12 @@ nsThebesDeviceContext::SetDPI()
                break;
 #ifdef XP_WIN
            case gfxASurface::SurfaceTypeWin32:
-            case gfxASurface::SurfaceTypeWin32Printing:
+            case gfxASurface::SurfaceTypeWin32Printing: {
                PRInt32 OSVal = GetDeviceCaps(GetPrintHDC(), LOGPIXELSY);
                dpi = 144;
                mPrintingScale = float(OSVal) / dpi;
                break;
+            }
 #endif
 #ifdef XP_OS2
            case gfxASurface::SurfaceTypeOS2:
@ -659,6 +660,9 @@ nsThebesDeviceContext::SetDPI()
                    dpi = lDPI;
                break;
 #endif
+            default:
+                NS_NOTREACHED("Unexpected printing surface type");
+                break;
        }
        dotsArePixels = PR_FALSE;
    } else {
--- a/gfx/thebes/public/gfxPDFSurface.h
+++ b/gfx/thebes/public/gfxPDFSurface.h
@ -63,7 +63,11 @@ public:
    // this is in points!
    const gfxSize& GetSize() const { return mSize; }

-    virtual PRInt32 GetDefaultContextFlags() const { return gfxContext::FLAG_DISABLE_SNAPPING; }
+    virtual PRInt32 GetDefaultContextFlags() const
+    {
+        return gfxContext::FLAG_SIMPLIFY_OPERATORS |
+               gfxContext::FLAG_DISABLE_SNAPPING;
+    }

 private:
    nsCOMPtr<nsIOutputStream> mStream;
--- a/gfx/thebes/public/gfxPSSurface.h
+++ b/gfx/thebes/public/gfxPSSurface.h
@ -63,7 +63,11 @@ public:
    // this is in points!
    const gfxSize& GetSize() const { return mSize; }

-    virtual PRInt32 GetDefaultContextFlags() const { return gfxContext::FLAG_DISABLE_SNAPPING; }
+    virtual PRInt32 GetDefaultContextFlags() const
+    {
+        return gfxContext::FLAG_SIMPLIFY_OPERATORS |
+               gfxContext::FLAG_DISABLE_SNAPPING;
+    }

 private:
    nsCOMPtr<nsIOutputStream> mStream;
--- a/gfx/thebes/public/gfxWindowsNativeDrawing.h
+++ b/gfx/thebes/public/gfxWindowsNativeDrawing.h
@ -111,6 +111,9 @@ public:
    /* Returns PR_TRUE if the native drawing should be executed again */
    PRBool ShouldRenderAgain();

+    /* Returns PR_TRUE if double pass alpha extraction is taking place. */
+    PRBool IsDoublePass();
+
    /* Places the result to the context, if necessary */
    void PaintToContext();

--- a/gfx/thebes/src/gfxMacPlatformFontList.h
+++ b/gfx/thebes/src/gfxMacPlatformFontList.h
@ -70,7 +70,9 @@ public:
    ATSFontRef GetFontRef();
    nsresult ReadCMAP();

+#ifndef __LP64__
    PRBool UseLiGothicAtsuiHack() { return mUseLiGothicAtsuiHack; }
+#endif

 protected:
    // for use with data fonts
@ -82,7 +84,9 @@ protected:

    ATSFontRef mATSFontRef;
    PRPackedBool mATSFontRefInitialized;
+#ifndef __LP64__
    PRPackedBool mUseLiGothicAtsuiHack;
+#endif
 };

 class gfxMacPlatformFontList : public gfxPlatformFontList {
--- a/gfx/thebes/src/gfxMacPlatformFontList.mm
+++ b/gfx/thebes/src/gfxMacPlatformFontList.mm
@ -117,8 +117,10 @@ MacOSFontEntry::MacOSFontEntry(const nsAString& aPostscriptName,
                               PRBool aIsStandardFace)
    : gfxFontEntry(aPostscriptName, aFamily, aIsStandardFace),
      mATSFontRef(0),
-      mATSFontRefInitialized(PR_FALSE),
-      mUseLiGothicAtsuiHack(PR_FALSE)
+      mATSFontRefInitialized(PR_FALSE)
+#ifndef __LP64__
+      , mUseLiGothicAtsuiHack(PR_FALSE)
+#endif
 {
    mWeight = aWeight;
 }
@ -128,8 +130,10 @@ MacOSFontEntry::MacOSFontEntry(const nsAString& aPostscriptName, ATSFontRef aFon
                               gfxUserFontData *aUserFontData)
    : gfxFontEntry(aPostscriptName),
      mATSFontRef(aFontRef),
-      mATSFontRefInitialized(PR_TRUE),
-      mUseLiGothicAtsuiHack(PR_FALSE)
+      mATSFontRefInitialized(PR_TRUE)
+#ifndef __LP64__
+      , mUseLiGothicAtsuiHack(PR_FALSE)
+#endif
 {
    // xxx - stretch is basically ignored for now

@ -265,6 +269,8 @@ MacOSFontEntry::ReadCMAP()
        }
    }

+#ifndef __LP64__  /* ATSUI not available on 64-bit */
+
    if ((gfxPlatformMac::GetPlatform()->OSXVersion() &
         MAC_OS_X_MAJOR_VERSION_MASK) == MAC_OS_X_VERSION_10_6_HEX) {
        // even ruder hack - LiGothic font on 10.6 has a bad glyph for U+775B
@ -281,6 +287,8 @@ MacOSFontEntry::ReadCMAP()
        }
    }

+#endif /* not __LP64__ */
+
    PR_LOG(gFontInfoLog, PR_LOG_DEBUG, ("(fontinit-cmap) psname: %s, size: %d\n",
                                        NS_ConvertUTF16toUTF8(mName).get(), mCharacterMap.GetSize()));

--- a/gfx/thebes/src/gfxWindowsNativeDrawing.cpp
+++ b/gfx/thebes/src/gfxWindowsNativeDrawing.cpp
@ -205,6 +205,22 @@ gfxWindowsNativeDrawing::BeginNativeDrawing()
    }
 }

+PRBool
+gfxWindowsNativeDrawing::IsDoublePass()
+{
+    // this is the same test we use in BeginNativeDrawing.
+    nsRefPtr<gfxASurface> surf = mContext->CurrentSurface(&mDeviceOffset.x, &mDeviceOffset.y);
+    if (!surf || surf->CairoStatus())
+        return false;
+    if ((surf->GetType() == gfxASurface::SurfaceTypeWin32 ||
+         surf->GetType() == gfxASurface::SurfaceTypeWin32Printing) &&
+        (surf->GetContentType() != gfxASurface::CONTENT_COLOR ||
+         (surf->GetContentType() == gfxASurface::CONTENT_COLOR_ALPHA &&
+          !(mNativeDrawFlags & CAN_DRAW_TO_COLOR_ALPHA))))
+        return PR_TRUE;
+    return PR_FALSE;
+}
+
 PRBool
 gfxWindowsNativeDrawing::ShouldRenderAgain()
 {
--- a/gfx/thebes/src/woff.c
+++ b/gfx/thebes/src/woff.c
@ -40,7 +40,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <zlib.h>
+#include "zlib.h"

 #ifdef WOFF_MOZILLA_CLIENT /* define this when building as part of Gecko */
 # include "prmem.h"
--- a/ipc/ipdl/ipdl/ast.py
+++ b/ipc/ipdl/ipdl/ast.py
@ -123,7 +123,7 @@ class Loc:

 Loc.NONE = Loc(filename='<??>', lineno=0)

-class _struct():
+class _struct:
    pass

 class Node:
--- a/js/ctypes/ctypes.msg
+++ b/js/ctypes/ctypes.msg
@ -43,10 +43,5 @@
 */

 MSG_DEF(CTYPESMSG_PLACEHOLDER_0, 0, 0, JSEXN_NONE, NULL)
-MSG_DEF(CTYPESMSG_PLACEHOLDER_1, 1, 0, JSEXN_NONE, NULL)
-MSG_DEF(CTYPESMSG_PLACEHOLDER_2, 2, 0, JSEXN_NONE, NULL)
-
-// This error has to be number 3 in order to be a TypeError,
-// due to a bug in the js engine.
-MSG_DEF(CTYPESMSG_TYPE_ERROR,    3, 2, JSEXN_TYPEERR, "expected type {0}, got {1}")
+MSG_DEF(CTYPESMSG_TYPE_ERROR,    1, 2, JSEXN_TYPEERR, "expected type {0}, got {1}")

--- a/js/jsd/jsd.h
+++ b/js/jsd/jsd.h
@ -1041,6 +1041,9 @@ jsd_InitObjectManager(JSDContext* jsdc);
 extern void
 jsd_DestroyObjectManager(JSDContext* jsdc);

+extern void
+jsd_DestroyObjects(JSDContext* jsdc);
+
 extern void
 jsd_ObjectHook(JSContext *cx, JSObject *obj, JSBool isNew, void *closure);

--- a/js/jsd/jsd_obj.c
+++ b/js/jsd/jsd_obj.c
@ -238,11 +238,19 @@ jsd_InitObjectManager(JSDContext* jsdc)

 void
 jsd_DestroyObjectManager(JSDContext* jsdc)
+{
+    jsd_DestroyObjects(jsdc);
+    JSD_LOCK_OBJECTS(jsdc);
+    JS_HashTableDestroy(jsdc->objectsTable);
+    JSD_UNLOCK_OBJECTS(jsdc);
+}
+
+void
+jsd_DestroyObjects(JSDContext* jsdc)
 {
    JSD_LOCK_OBJECTS(jsdc);
    while( !JS_CLIST_IS_EMPTY(&jsdc->objectsList) )
        _destroyJSDObject(jsdc, (JSDObject*)JS_NEXT_LINK(&jsdc->objectsList));
-    JS_HashTableDestroy(jsdc->objectsTable);
    JSD_UNLOCK_OBJECTS(jsdc);
 }

--- a/js/jsd/jsdebug.c
+++ b/js/jsd/jsdebug.c
@ -140,18 +140,17 @@ JSD_SetContextFlags(JSDContext *jsdc, uint32 flags)
    jsdc->flags = flags;
    if ((flags & JSD_COLLECT_PROFILE_DATA) ||
        !(flags & JSD_DISABLE_OBJECT_TRACE)) {
-        // Need to reenable our call hooks now
+        /* Need to reenable our call hooks now */
        JS_SetExecuteHook(jsdc->jsrt, jsd_TopLevelCallHook, jsdc);
        JS_SetCallHook(jsdc->jsrt, jsd_FunctionCallHook, jsdc);
    }
    if ((oldFlags ^ flags) & JSD_DISABLE_OBJECT_TRACE) {
-        // Changing our JSD_DISABLE_OBJECT_TRACE flag
+        /* Changing our JSD_DISABLE_OBJECT_TRACE flag */
        if (!(flags & JSD_DISABLE_OBJECT_TRACE)) {
-            // Need to reenable our object hooks now
-            if (jsd_InitObjectManager(jsdc))
-                JS_SetObjectHook(jsdc->jsrt, jsd_ObjectHook, jsdc);
+            /* Need to reenable our object hooks now */
+            JS_SetObjectHook(jsdc->jsrt, jsd_ObjectHook, jsdc);
        } else {
-            jsd_DestroyObjectManager(jsdc);
+            jsd_DestroyObjects(jsdc);
            JS_SetObjectHook(jsdc->jsrt, NULL, NULL);
        }
    }
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@ -5827,7 +5827,8 @@ JS_PUBLIC_API(JSBool)
 JS_ThrowReportedError(JSContext *cx, const char *message,
                      JSErrorReport *reportp)
 {
-    return JS_IsRunning(cx) && js_ErrorToException(cx, message, reportp);
+    return JS_IsRunning(cx) &&
+           js_ErrorToException(cx, message, reportp, NULL, NULL);
 }

 JS_PUBLIC_API(JSBool)
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@ -1281,7 +1281,8 @@ MarkLocalRoots(JSTracer *trc, JSLocalRootStack *lrs)
 }

 static void
-ReportError(JSContext *cx, const char *message, JSErrorReport *reportp)
+ReportError(JSContext *cx, const char *message, JSErrorReport *reportp,
+            JSErrorCallback callback, void *userRef)
 {
    /*
     * Check the error report, and set a JavaScript-catchable exception
@ -1290,7 +1291,8 @@ ReportError(JSContext *cx, const char *message, JSErrorReport *reportp)
     * on the error report, and exception-aware hosts should ignore it.
     */
    JS_ASSERT(reportp);
-    if (reportp->errorNumber == JSMSG_UNCAUGHT_EXCEPTION)
+    if ((!callback || callback == js_GetErrorMessage) &&
+        reportp->errorNumber == JSMSG_UNCAUGHT_EXCEPTION)
        reportp->flags |= JSREPORT_EXCEPTION;

    /*
@ -1301,7 +1303,8 @@ ReportError(JSContext *cx, const char *message, JSErrorReport *reportp)
     * propagates out of scope.  This is needed for compatability
     * with the old scheme.
     */
-    if (!JS_IsRunning(cx) || !js_ErrorToException(cx, message, reportp)) {
+    if (!JS_IsRunning(cx) ||
+        !js_ErrorToException(cx, message, reportp, callback, userRef)) {
        js_ReportErrorAgain(cx, message, reportp);
    } else if (cx->debugHooks->debugErrorHook && cx->errorReporter) {
        JSDebugErrorHook hook = cx->debugHooks->debugErrorHook;
@ -1457,7 +1460,7 @@ js_ReportErrorVA(JSContext *cx, uintN flags, const char *format, va_list ap)

    warning = JSREPORT_IS_WARNING(report.flags);

-    ReportError(cx, message, &report);
+    ReportError(cx, message, &report, NULL, NULL);
    js_free(message);
    cx->free(ucmessage);
    return warning;
@ -1651,7 +1654,7 @@ js_ReportErrorNumberVA(JSContext *cx, uintN flags, JSErrorCallback callback,
        return JS_FALSE;
    }

-    ReportError(cx, message, &report);
+    ReportError(cx, message, &report, callback, userRef);

    if (message)
        cx->free(message);
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@ -1104,7 +1104,8 @@ static struct exnname { char *name; char *exception; } errortoexnname[] = {
 #endif /* DEBUG */

 JSBool
-js_ErrorToException(JSContext *cx, const char *message, JSErrorReport *reportp)
+js_ErrorToException(JSContext *cx, const char *message, JSErrorReport *reportp,
+                    JSErrorCallback callback, void *userRef)
 {
    JSErrNum errorNumber;
    const JSErrorFormatString *errorString;
@ -1124,7 +1125,10 @@ js_ErrorToException(JSContext *cx, const char *message, JSErrorReport *reportp)

    /* Find the exception index associated with this error. */
    errorNumber = (JSErrNum) reportp->errorNumber;
-    errorString = js_GetLocalizedErrorMessage(cx, NULL, NULL, errorNumber);
+    if (!callback || callback == js_GetErrorMessage)
+        errorString = js_GetLocalizedErrorMessage(cx, NULL, NULL, errorNumber);
+    else
+        errorString = callback(userRef, NULL, errorNumber);
    exn = errorString ? (JSExnType) errorString->exnType : JSEXN_NONE;
    JS_ASSERT(exn < JSEXN_LIMIT);

--- a/js/src/jsexn.h
+++ b/js/src/jsexn.h
@ -63,7 +63,8 @@ js_InitExceptionClasses(JSContext *cx, JSObject *obj);
 * found and set, JS_FALSE otherwise.
 */
 extern JSBool
-js_ErrorToException(JSContext *cx, const char *message, JSErrorReport *reportp);
+js_ErrorToException(JSContext *cx, const char *message, JSErrorReport *reportp,
+                    JSErrorCallback callback, void *userRef);

 /*
 * Called if a JS API call to js_Execute or js_InternalCall fails; calls the
--- a/js/src/jsscan.cpp
+++ b/js/src/jsscan.cpp
@ -607,7 +607,7 @@ ReportCompileErrorNumberVA(JSContext *cx, JSTokenStream *ts, JSParseNode *pn,
     * which is likely spurious.
     */
    if (!(ts->flags & TSF_ERROR)) {
-        if (js_ErrorToException(cx, message, &report))
+        if (js_ErrorToException(cx, message, &report, NULL, NULL))
            onError = NULL;
    }

--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@ -3254,7 +3254,9 @@ Scatter(JSContext *cx, uintN argc, jsval *vp)
        );
        if (!newcx)
            goto fail;
+        JS_BeginRequest(newcx);
        JS_SetGlobalObject(newcx, JS_GetGlobalObject(cx));
+        JS_EndRequest(newcx);
        JS_ClearContextThread(newcx);
        sd.threads[i].cx = newcx;
    }
--- a/js/src/tests/js1_5/Regress/jstests.list
+++ b/js/src/tests/js1_5/Regress/jstests.list
@ -170,7 +170,7 @@ skip-if(xulRuntime.OS=="WINNT"&&isDebugBuild) script regress-341360.js # slow
 script regress-343713.js
 script regress-343966.js
 script regress-344711-n.js
-fails-if(!xulRuntime.shell&&xulRuntime.OS=="WINNT") script regress-344804.js # bug 524732
+script regress-344804.js # bug 524732
 script regress-344959.js
 script regress-346237.js
 script regress-346801.js
--- a/js/src/tests/js1_5/Scope/jstests.list
+++ b/js/src/tests/js1_5/Scope/jstests.list
@ -1,6 +1,6 @@
 url-prefix ../../jsreftest.html?test=js1_5/Scope/
 script regress-154693.js
-fails-if(!xulRuntime.shell&&xulRuntime.OS=="WINNT") script regress-181834.js # bug 524732
+script regress-181834.js # bug 524732
 script regress-184107.js
 script regress-185485.js
 script regress-191276.js
--- a/js/src/xpconnect/loader/XPCOMUtils.jsm
+++ b/js/src/xpconnect/loader/XPCOMUtils.jsm
@ -115,7 +115,7 @@ var XPCOMUtils = {
   * that object, it checks if the given iid is listed in the |interfaces|
   * param, and if it is, returns |this| (the object it was called on).
   */
-  generateQI: function(interfaces) {
+  generateQI: function XPCU_generateQI(interfaces) {
    /* Note that Ci[Ci.x] == Ci.x for all x */
    return makeQI([Ci[i].name for each (i in interfaces) if (Ci[i])]);
  },
@ -124,7 +124,9 @@ var XPCOMUtils = {
   * Generate the NSGetModule function (along with the module definition).
   * See the parameters to generateModule.
   */
-  generateNSGetModule: function(componentsArray, postRegister, preUnregister) {
+  generateNSGetModule: function XPCU_generateNSGetModule(componentsArray,
+                                                         postRegister,
+                                                         preUnregister) {
    return function NSGetModule(compMgr, fileSpec) {
      return XPCOMUtils.generateModule(componentsArray,
                                       postRegister,
@ -144,7 +146,8 @@ var XPCOMUtils = {
   *                      signature 'preUnregister(nsIComponentManager,
   *                                               nsIFile, componentsArray)'
   */
-  generateModule: function(componentsArray, postRegister, preUnregister) {
+  generateModule: function XPCU_generateModule(componentsArray, postRegister,
+                                               preUnregister) {
    let classes = [];
    for each (let component in componentsArray) {
      classes.push({
@ -281,7 +284,7 @@ var XPCOMUtils = {
  /**
   * Returns an nsIFactory for |component|.
   */
-  _getFactory: function(component) {
+  _getFactory: function XPCOMUtils__getFactory(component) {
    var factory = component.prototype._xpcom_factory;
    if (!factory) {
      factory = {
--- a/layout/generic/nsInlineFrame.cpp
+++ b/layout/generic/nsInlineFrame.cpp
@ -1010,6 +1010,7 @@ nsFirstLineFrame::Reflow(nsPresContext* aPresContext,
  InlineReflowState irs;
  irs.mPrevFrame = nsnull;
  irs.mLineContainer = lineContainer;
+  irs.mLineLayout = aReflowState.mLineLayout;
  irs.mNextInFlow = (nsInlineFrame*) GetNextInFlow();

  nsresult rv;
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@ -224,9 +224,9 @@ enum { XKeyPress = KeyPress };
 static PRLogModuleInfo *nsObjectFrameLM = PR_NewLogModule("nsObjectFrame");
 #endif /* PR_LOGGING */

-#define NORMAL_PLUGIN_DELAY 20
-// must avoid audio skipping/delays
-#define HIDDEN_PLUGIN_DELAY 125
+#if defined(XP_MACOSX) && !defined(NP_NO_CARBON)
+#define MAC_CARBON_PLUGINS
+#endif

 // special class for handeling DOM context menu events because for
 // some reason it starves other mouse events if implemented on the
@ -257,7 +257,6 @@ public:

 class nsPluginInstanceOwner : public nsIPluginInstanceOwner,
                              public nsIPluginTagInfo,
-                              public nsITimerCallback,
                              public nsIDOMMouseListener,
                              public nsIDOMMouseMotionListener,
                              public nsIDOMKeyListener,
@ -325,11 +324,11 @@ public:
  void Paint(const nsRect& aDirtyRect, HPS aHPS);
 #endif

-  // nsITimerCallback interface
-  NS_DECL_NSITIMERCALLBACK
-  
+#ifdef MAC_CARBON_PLUGINS
  void CancelTimer();
-  void StartTimer(unsigned int aDelay);
+  void StartTimer(PRBool isVisible);
+#endif
+  void SendIdleEvent();

  // nsIScrollPositionListener interface
  NS_IMETHOD ScrollPositionWillChange(nsIScrollableView* aScrollable, nscoord aX, nscoord aY);
@ -432,7 +431,6 @@ private:
  nsCString                   mDocumentBase;
  char                       *mTagText;
  nsCOMPtr<nsIWidget>         mWidget;
-  nsCOMPtr<nsITimer>          mPluginTimer;
  nsCOMPtr<nsIPluginHost>     mPluginHost;

 #ifdef XP_MACOSX
@ -452,7 +450,6 @@ private:
  // If true, destroy the widget on destruction. Used when plugin stop
  // is being delayed to a safer point in time.
  PRPackedBool                mDestroyWidget;
-  PRPackedBool                mTimerCanceled;
  PRUint16          mNumCachedAttrs;
  PRUint16          mNumCachedParams;
  char              **mCachedAttrParamNames;
@ -1368,7 +1365,7 @@ nsObjectFrame::PrintPlugin(nsIRenderingContext& aRenderingContext,
  window.clipRect.left = 0; window.clipRect.right = 0;
  
 // platform specific printing code
-#if defined(XP_MACOSX) && !defined(NP_NO_CARBON)
+#ifdef MAC_CARBON_PLUGINS
  nsSize contentSize = GetContentRect().Size();
  window.x = 0;
  window.y = 0;
@ -1675,9 +1672,26 @@ nsObjectFrame::PaintPlugin(nsIRenderingContext& aRenderingContext,
      PRBool doupdatewindow = PR_FALSE;
      // the offset of the DC
      nsPoint origin;
-      
+
      gfxWindowsNativeDrawing nativeDraw(ctx, frameGfxRect);
-      PRBool doublePass = PR_FALSE;
+#ifdef MOZ_IPC
+      if (nativeDraw.IsDoublePass()) {
+        // OOP plugin specific: let the shim know before we paint if we are doing a
+        // double pass render. If this plugin isn't oop, the register window message
+        // will be ignored.
+        if (!mDoublePassEvent)
+          mDoublePassEvent = ::RegisterWindowMessage(NS_OOPP_DOUBLEPASS_MSGID);
+        if (mDoublePassEvent) {
+          NPEvent pluginEvent;
+          pluginEvent.event = mDoublePassEvent;
+          pluginEvent.wParam = 0;
+          pluginEvent.lParam = 0;
+          PRBool eventHandled = PR_FALSE;
+
+          inst->HandleEvent(&pluginEvent, &eventHandled);
+        }
+      }
+#endif
      do {
        HDC hdc = nativeDraw.BeginNativeDrawing();
        if (!hdc)
@ -1696,17 +1710,22 @@ nsObjectFrame::PaintPlugin(nsIRenderingContext& aRenderingContext,
          window->x = dest.left;
          window->y = dest.top;

-          // Windowless plugins on windows need a special event to update their location, see bug 135737
+          // Windowless plugins on windows need a special event to update their location,
+          // see bug 135737.
+          //
          // bug 271442: note, the rectangle we send is now purely the bounds of the plugin
-          // relative to the window it is contained in, which is useful for the plugin to correctly translate mouse coordinates
+          // relative to the window it is contained in, which is useful for the plugin to
+          // correctly translate mouse coordinates.
          //
          // this does not mesh with the comments for bug 135737 which imply that the rectangle
-          // must be clipped in some way to prevent the plugin attempting to paint over areas it shouldn't;
+          // must be clipped in some way to prevent the plugin attempting to paint over areas
+          // it shouldn't.
          //
-          // since the two uses of the rectangle are mutually exclusive in some cases,
-          // and since I don't see any incorrect painting (at least with Flash and ViewPoint - the originator of 135737),
-          // it seems that windowless plugins are not relying on information here for clipping their drawing,
-          // and we can safely use this message to tell the plugin exactly where it is in all cases.
+          // since the two uses of the rectangle are mutually exclusive in some cases, and
+          // since I don't see any incorrect painting (at least with Flash and ViewPoint -
+          // the originator of bug 135737), it seems that windowless plugins are not relying
+          // on information here for clipping their drawing, and we can safely use this message
+          // to tell the plugin exactly where it is in all cases.

          nsIntPoint origin = GetWindowOriginInPixels(PR_TRUE);
          nsIntRect winlessRect = nsIntRect(origin, nsIntSize(window->width, window->height));
@ -1735,32 +1754,11 @@ nsObjectFrame::PaintPlugin(nsIRenderingContext& aRenderingContext,
            inst->HandleEvent(&pluginEvent, &eventHandled);
          }

-          inst->SetWindow(window);        
+          inst->SetWindow(window);
        }
-
        mInstanceOwner->Paint(dirty, hdc);
        nativeDraw.EndNativeDrawing();
-        doublePass = nativeDraw.ShouldRenderAgain();
-#ifdef MOZ_IPC
-        if (doublePass) {
-          // OOP plugin specific: let the shim know we are in the middle of a double pass
-          // render. The second pass will reuse the previous rendering without going over
-          // the wire.
-          if (!mDoublePassEvent)
-            mDoublePassEvent = ::RegisterWindowMessage(NS_OOPP_DOUBLEPASS_MSGID);
-          if (mDoublePassEvent) {
-            NPEvent pluginEvent;
-            pluginEvent.event = mDoublePassEvent;
-            pluginEvent.wParam = 0;
-            pluginEvent.lParam = 0;
-            PRBool eventHandled = PR_FALSE;
-
-            inst->HandleEvent(&pluginEvent, &eventHandled);
-          }          
-        }
-#endif
-      } while (doublePass);
-
+      } while (nativeDraw.ShouldRenderAgain());
      nativeDraw.PaintToContext();
    } else if (!(ctx->GetFlags() & gfxContext::FLAG_DESTINED_FOR_SCREEN)) {
      // Get PrintWindow dynamically since it's not present on Win2K,
@ -1932,7 +1930,9 @@ nsObjectFrame::HandleEvent(nsPresContext* aPresContext,
 #endif

  if (anEvent->message == NS_DESTROY) {
+#ifdef MAC_CARBON_PLUGINS
    mInstanceOwner->CancelTimer();
+#endif
    return rv;
  }

@ -2432,7 +2432,6 @@ nsPluginInstanceOwner::nsPluginInstanceOwner()
  mCachedAttrParamNames = nsnull;
  mCachedAttrParamValues = nsnull;
  mDestroyWidget = PR_FALSE;
-  mTimerCanceled = PR_TRUE;

 #ifdef MOZ_COMPOSITED_PLUGINS
  mLastPoint = nsIntPoint(0,0);
@ -2463,8 +2462,9 @@ nsPluginInstanceOwner::~nsPluginInstanceOwner()
  PR_LOG(nsObjectFrameLM, PR_LOG_DEBUG,
         ("nsPluginInstanceOwner %p deleted\n", this));

-  // shut off the timer.
+#ifdef MAC_CARBON_PLUGINS
  CancelTimer();
+#endif

  mObjectFrame = nsnull;

@ -2521,7 +2521,6 @@ NS_IMPL_RELEASE(nsPluginInstanceOwner)
 NS_INTERFACE_MAP_BEGIN(nsPluginInstanceOwner)
  NS_INTERFACE_MAP_ENTRY(nsIPluginInstanceOwner)
  NS_INTERFACE_MAP_ENTRY(nsIPluginTagInfo)
-  NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
  NS_INTERFACE_MAP_ENTRY(nsIDOMMouseListener)
  NS_INTERFACE_MAP_ENTRY(nsIDOMMouseMotionListener)
  NS_INTERFACE_MAP_ENTRY(nsIDOMKeyListener)
@ -3571,7 +3570,7 @@ nsPluginInstanceOwner::GetEventloopNestingLevel()

 nsresult nsPluginInstanceOwner::ScrollPositionWillChange(nsIScrollableView* aScrollable, nscoord aX, nscoord aY)
 {
-#if defined(XP_MACOSX) && !defined(NP_NO_CARBON)
+#ifdef MAC_CARBON_PLUGINS
  if (GetEventModel() != NPEventModelCarbon)
    return NS_OK;

@ -3598,7 +3597,7 @@ nsresult nsPluginInstanceOwner::ScrollPositionWillChange(nsIScrollableView* aScr

 nsresult nsPluginInstanceOwner::ScrollPositionDidChange(nsIScrollableView* aScrollable, nscoord aX, nscoord aY)
 {
-#if defined(XP_MACOSX) && !defined(NP_NO_CARBON)
+#ifdef MAC_CARBON_PLUGINS
  if (GetEventModel() != NPEventModelCarbon)
    return NS_OK;

@ -3617,9 +3616,9 @@ nsresult nsPluginInstanceOwner::ScrollPositionDidChange(nsIScrollableView* aScro
      pluginWidget->EndDrawPlugin();
    }
  }
-#endif

-  StartTimer(NORMAL_PLUGIN_DELAY);
+  StartTimer(PR_TRUE);
+#endif
  return NS_OK;
 }

@ -3679,7 +3678,7 @@ nsresult nsPluginInstanceOwner::KeyUp(nsIDOMEvent* aKeyEvent)

 nsresult nsPluginInstanceOwner::KeyPress(nsIDOMEvent* aKeyEvent)
 {
-#if defined(XP_MACOSX) && !defined(NP_NO_CARBON)
+#ifdef MAC_CARBON_PLUGINS
  // send KeyPress events only for Mac OS X Carbon event model
  if (GetEventModel() != NPEventModelCarbon)
    return aKeyEvent->PreventDefault();
@ -4634,8 +4633,10 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
 nsresult
 nsPluginInstanceOwner::Destroy()
 {
+#ifdef MAC_CARBON_PLUGINS
  // stop the timer explicitly to reduce reference count.
  CancelTimer();
+#endif

  // unregister context menu listener
  if (mCXMenuListener) {
@ -5361,14 +5362,9 @@ nsPluginInstanceOwner::Renderer::NativeDraw(QWidget * drawable,
 }
 #endif

-// Here's how we give idle time to plugins.
-
-NS_IMETHODIMP nsPluginInstanceOwner::Notify(nsITimer* timer)
+void nsPluginInstanceOwner::SendIdleEvent()
 {
-#if defined(XP_MACOSX) && !defined(NP_NO_CARBON)
-  if (GetEventModel() != NPEventModelCarbon)
-    return NS_OK;
-
+#ifdef MAC_CARBON_PLUGINS
  // validate the plugin clipping information by syncing the plugin window info to
  // reflect the current widget location. This makes sure that everything is updated
  // correctly in the event of scrolling in the window.
@ -5394,36 +5390,22 @@ NS_IMETHODIMP nsPluginInstanceOwner::Notify(nsITimer* timer)
    }
  }
 #endif
-  return NS_OK;
 }

-void nsPluginInstanceOwner::StartTimer(unsigned int aDelay)
+#ifdef MAC_CARBON_PLUGINS
+void nsPluginInstanceOwner::StartTimer(PRBool isVisible)
 {
-#if defined(XP_MACOSX) && !defined(NP_NO_CARBON)
  if (GetEventModel() != NPEventModelCarbon)
    return;

-  if (!mTimerCanceled)
-    return;
-
-  // start a periodic timer to provide null events to the plugin instance.
-  if (!mPluginTimer) {
-    mPluginTimer = do_CreateInstance("@mozilla.org/timer;1");
-  }
-  if (mPluginTimer) {
-    mTimerCanceled = PR_FALSE;
-    mPluginTimer->InitWithCallback(this, aDelay, nsITimer::TYPE_REPEATING_SLACK);
-  }
-#endif
+  mPluginHost->AddIdleTimeTarget(this, isVisible);
 }

 void nsPluginInstanceOwner::CancelTimer()
 {
-  if (mPluginTimer) {
-    mPluginTimer->Cancel();
-  }
-  mTimerCanceled = PR_TRUE;
+  mPluginHost->RemoveIdleTimeTarget(this);
 }
+#endif

 nsresult nsPluginInstanceOwner::Init(nsPresContext* aPresContext,
                                     nsObjectFrame* aFrame,
@ -5596,8 +5578,10 @@ NS_IMETHODIMP nsPluginInstanceOwner::CreateWidget(void)
          mPluginWindow->type = NPWindowTypeWindow;
          mPluginWindow->window = GetPluginPort();

+#ifdef MAC_CARBON_PLUGINS
          // start the idle timer.
-          StartTimer(NORMAL_PLUGIN_DELAY);
+          StartTimer(PR_TRUE);
+#endif

          // tell the plugin window about the widget
          mPluginWindow->SetPluginWidget(mWidget);
@ -5638,7 +5622,7 @@ PRBool nsPluginInstanceOwner::UpdateVisibility()
 }
 #endif

-  // Mac specific code to fix up the port location and clipping region
+// Mac specific code to fix up the port location and clipping region
 #ifdef XP_MACOSX

 void* nsPluginInstanceOwner::FixUpPluginWindow(PRInt32 inPaintState)
@ -5734,15 +5718,17 @@ void* nsPluginInstanceOwner::FixUpPluginWindow(PRInt32 inPaintState)
  {
    mInstance->SetWindow(mPluginWindow);
    mPluginPortChanged = PR_FALSE;
+#ifdef MAC_CARBON_PLUGINS
    // if the clipRect is of size 0, make the null timer fire less often
    CancelTimer();
    if (mPluginWindow->clipRect.left == mPluginWindow->clipRect.right ||
        mPluginWindow->clipRect.top == mPluginWindow->clipRect.bottom) {
-      StartTimer(HIDDEN_PLUGIN_DELAY);
+      StartTimer(PR_FALSE);
    }
    else {
-      StartTimer(NORMAL_PLUGIN_DELAY);
+      StartTimer(PR_TRUE);
    }
+#endif
  } else if (mPluginPortChanged) {
    mInstance->SetWindow(mPluginWindow);
    mPluginPortChanged = PR_FALSE;
--- a/layout/generic/test/file_bug514732_helper.html
+++ b/layout/generic/test/file_bug514732_helper.html
@ -67,33 +67,37 @@ function makeResult() {
  };
 }

-function waitInterrupt(result, gen, timewait) {
+function makeListener(result, eventGen) {
+  return function(ev) {
+    result.success = true;
+    result.event = ev;
+    setTimeout(function() { eventGen.next(); }, 0);
+  };
+}
+
+function waitInterrupt(result, gen) {
  result.event = null;
  result.success = false;
-  setTimeout(function() { if (!result.success) gen.next(); }, (timewait || 2000));
+  setTimeout(function() { if (!result.success) gen.next(); }, 3500);
 }

 function testPhoom(isCapturing, x, y, expectEvent) {
-  var result;

  var eventGen = (function() {
    var innerdoc = document.getElementById('testframe').contentDocument;

    for each (var doc in [document, innerdoc]) {
      var inner = (doc == innerdoc);
-      var w, h;
-      var listener = function(ev) {
-        result.success = true;
-        result.event = ev;
-        setTimeout(function() { eventGen.next(); }, 0);
-      };
+      var w, h, result, listener;

      /* --- EXPANSION --- */

+      result = makeResult();
+      listener = makeListener(result, eventGen);
+
      doc.addEventListener("MozScrolledAreaChanged", listener, isCapturing);

-      result = makeResult();
-      waitInterrupt(result, eventGen, 1200);
+      if (!expectEvent) waitInterrupt(result, eventGen);
      phoom(doc, x, y);
      yield;

@ -103,7 +107,7 @@ function testPhoom(isCapturing, x, y, expectEvent) {
         one can still arrive, but we don't complain if it did not.  In either case, any event
         that arrives will have its data checked below. */
      if (expectEvent) {
-        ok(result.success, "Received expected expansion event");
+        ok(result.success, "Received expected " + (inner ? "inner" : "") + " expansion event");
      }

      if (result.success) {
@ -129,17 +133,19 @@ function testPhoom(isCapturing, x, y, expectEvent) {

      /* --- CONTRACTION --- */

+      result = makeResult();
+      listener = makeListener(result, eventGen);
+
      doc.addEventListener("MozScrolledAreaChanged", listener, isCapturing);

-      result = makeResult();
-      waitInterrupt(result, eventGen, 1200);
+      if (!expectEvent) waitInterrupt(result, eventGen);
      unphoom(doc);
      yield;

      doc.removeEventListener("MozScrolledAreaChanged", listener, isCapturing);

      if (expectEvent) {
-        ok(result.success, "Received expected contraction event");
+        ok(result.success, "Received expected " + (inner ? "inner" : "") + " contraction event");
      }

      if (result.success) {
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@ -1878,8 +1878,10 @@ nsPrintEngine::ReflowPrintObject(nsPrintObject * aPO)
    }
    // Without a frame, this document can't be displayed; therefore, there is no
    // point to reflowing it
-    if (!frame)
+    if (!frame) {
+      aPO->mDontPrint = PR_TRUE;
      return NS_OK;
+    }

    adjSize = frame->GetContentRect().Size();
    documentIsTopLevel = PR_FALSE;
--- a/layout/reftests/css-gradients/height-dependence-1-ref.html
+++ b/layout/reftests/css-gradients/height-dependence-1-ref.html
@ -0,0 +1,43 @@
+<!doctype html>
+<html><head>
+<style>
+html {
+  background-image: -moz-linear-gradient(black, white 20%);
+  background-repeat: repeat-x;
+}
+body {
+  font-size: 1em;
+  padding: 2em;
+  margin: 50px auto;
+  width: 14em;
+  border: 1px solid black;
+  background-color: white;
+}
+</style>
+</head><body>
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+</body>
+</html>
--- a/layout/reftests/css-gradients/height-dependence-1.html
+++ b/layout/reftests/css-gradients/height-dependence-1.html
@ -0,0 +1,49 @@
+<!doctype html>
+<html class="reftest-wait"><head>
+<style>
+html {
+  background-image: -moz-linear-gradient(black, white 20%);
+  background-repeat: repeat-x;
+}
+body {
+  font-size: 1em;
+  padding: 2em;
+  margin: 50px auto;
+  width: 28em;
+  border: 1px solid black;
+  background-color: white;
+}
+</style>
+<script>
+window.addEventListener("MozReftestInvalidate", function() {
+  document.body.style.width = "14em";
+  document.documentElement.removeAttribute("class");
+}, false);
+</script>
+</head><body>
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+</body>
+</html>
--- a/layout/reftests/css-gradients/height-dependence-2-ref.html
+++ b/layout/reftests/css-gradients/height-dependence-2-ref.html
@ -0,0 +1,44 @@
+<!doctype html>
+<html><head>
+<style>
+html {
+  background-image: -moz-linear-gradient(black, white 20%);
+  background-repeat: repeat-x;
+  -moz-background-size: 1px 400px;
+}
+body {
+  font-size: 1em;
+  padding: 2em;
+  margin: 50px auto;
+  width: 14em;
+  border: 1px solid black;
+  background-color: white;
+}
+</style>
+</head><body>
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+</body>
+</html>
--- a/layout/reftests/css-gradients/height-dependence-2.html
+++ b/layout/reftests/css-gradients/height-dependence-2.html
@ -0,0 +1,50 @@
+<!doctype html>
+<html class="reftest-wait"><head>
+<style>
+html {
+  background-image: -moz-linear-gradient(black, white 20%);
+  background-repeat: repeat-x;
+  -moz-background-size: 1px 400px;
+}
+body {
+  font-size: 1em;
+  padding: 2em;
+  margin: 50px auto;
+  width: 28em;
+  border: 1px solid black;
+  background-color: white;
+}
+</style>
+<script>
+window.addEventListener("MozReftestInvalidate", function() {
+  document.body.style.width = "14em";
+  document.documentElement.removeAttribute("class");
+}, false);
+</script>
+</head><body>
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+</body>
+</html>
--- a/layout/reftests/css-gradients/height-dependence-3-ref.html
+++ b/layout/reftests/css-gradients/height-dependence-3-ref.html
@ -0,0 +1,44 @@
+<!doctype html>
+<html><head>
+<style>
+html {
+  background-image: -moz-linear-gradient(black, white 20%);
+  background-repeat: repeat-x;
+  -moz-background-size: 1px 80%;
+}
+body {
+  font-size: 1em;
+  padding: 2em;
+  margin: 50px auto;
+  width: 14em;
+  border: 1px solid black;
+  background-color: white;
+}
+</style>
+</head><body>
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+</body>
+</html>
--- a/layout/reftests/css-gradients/height-dependence-3.html
+++ b/layout/reftests/css-gradients/height-dependence-3.html
@ -0,0 +1,50 @@
+<!doctype html>
+<html class="reftest-wait"><head>
+<style>
+html {
+  background-image: -moz-linear-gradient(black, white 20%);
+  background-repeat: repeat-x;
+  -moz-background-size: 1px 80%;
+}
+body {
+  font-size: 1em;
+  padding: 2em;
+  margin: 50px auto;
+  width: 28em;
+  border: 1px solid black;
+  background-color: white;
+}
+</style>
+<script>
+window.addEventListener("MozReftestInvalidate", function() {
+  document.body.style.width = "14em";
+  document.documentElement.removeAttribute("class");
+}, false);
+</script>
+</head><body>
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+pad pad pad pad pad pad pad pad
+</body>
+</html>
--- a/layout/reftests/css-gradients/reftest.list
+++ b/layout/reftests/css-gradients/reftest.list
@ -85,4 +85,6 @@ fails == aja-linear-2d.html aja-linear-2-ref.html # bug 526694
 == aja-linear-5a.html aja-linear-5-ref.html
 fails-if(MOZ_WIDGET_TOOLKIT=="cocoa") == aja-linear-6a.html aja-linear-6-ref.html # bug 526708
 fails == aja-linear-6b.html aja-linear-6-ref.html # bug 522607
-
+== height-dependence-1.html height-dependence-1-ref.html
+fails-if(MOZ_WIDGET_TOOLKIT=="cocoa") == height-dependence-2.html height-dependence-2-ref.html # bug 535007
+== height-dependence-3.html height-dependence-3-ref.html
--- a/layout/style/nsCSSDeclaration.cpp
+++ b/layout/style/nsCSSDeclaration.cpp
@ -876,6 +876,12 @@ nsCSSDeclaration::GetValue(nsCSSProperty aProperty,
      const nsCSSValuePairList *size =
        * data->ValuePairListStorageFor(eCSSProperty__moz_background_size);
      for (;;) {
+        if (size->mXValue.GetUnit() != eCSSUnit_Auto ||
+            size->mYValue.GetUnit() != eCSSUnit_Auto) {
+          // Non-default background-size, so can't be serialized as shorthand.
+          aValue.Truncate();
+          return NS_OK;
+        }
        AppendCSSValueToString(eCSSProperty_background_image,
                               image->mValue, aValue);
        aValue.Append(PRUnichar(' '));
--- a/layout/style/nsStyleStruct.h
+++ b/layout/style/nsStyleStruct.h
@ -413,10 +413,19 @@ struct nsStyleBackground {
    };
    PRUint8 mWidthType, mHeightType;

-    // True if the effective image size described by this depends on the size
-    // of the corresponding frame.
-    PRBool DependsOnFrameSize() const {
-      return mWidthType <= ePercentage || mHeightType <= ePercentage;
+    // True if the effective image size described by this depends on
+    // the size of the corresponding frame.  Gradients depend on the
+    // frame size when their dimensions are 'auto', images don't; both
+    // types depend on the frame size when their dimensions are
+    // 'contain', 'cover', or a percentage.
+    PRBool DependsOnFrameSize(nsStyleImageType aType) const {
+      if (aType == eStyleImageType_Image) {
+        return mWidthType <= ePercentage || mHeightType <= ePercentage;
+      } else {
+        NS_ABORT_IF_FALSE(aType == eStyleImageType_Gradient,
+                          "unrecognized image type");
+        return mWidthType <= eAuto || mHeightType <= eAuto;
+      }
    }

    // Initialize nothing
@ -448,12 +457,14 @@ struct nsStyleBackground {

    void SetInitialValues();

-    // True if the rendering of this layer might change when the size of the
-    // corresponding frame changes (if its position or size is a percentage of
-    // the frame's dimensions).
+    // True if the rendering of this layer might change when the size
+    // of the corresponding frame changes.  This is true for any
+    // non-solid-color background whose position or size depends on
+    // the frame size.
    PRBool RenderingMightDependOnFrameSize() const {
-      return !mImage.IsEmpty() &&
-             (mPosition.DependsOnFrameSize() || mSize.DependsOnFrameSize());
+      return (!mImage.IsEmpty() &&
+              (mPosition.DependsOnFrameSize() ||
+               mSize.DependsOnFrameSize(mImage.GetType())));
    }

    // An equality operator that compares the images using URL-equality
--- a/layout/style/test/test_shorthand_property_getters.html
+++ b/layout/style/test/test_shorthand_property_getters.html
@ -122,29 +122,35 @@ is(e.style.background, "", "should not have background shorthand (origin:content
 //is(e.style.background, "", "should not have background shorthand (clip:content)");
 //e.setAttribute("style", "background: red; -moz-background-clip: content; -moz-background-origin: content;");
 //isnot(e.style.background, "", "should have background shorthand (clip:content;origin:content)");
+e.setAttribute("style", "background: red; -moz-background-size: 100% 100%");
+is(e.style.background, "", "should not have background shorthand (size:100% 100%)");
+e.setAttribute("style", "background: red; -moz-background-size: 100% auto");
+is(e.style.background, "", "should not have background shorthand (size:100% auto)");
+e.setAttribute("style", "background: red; -moz-background-size: auto 100%");
+is(e.style.background, "", "should not have background shorthand (size:auto 100%)");
 e.setAttribute("style", "background: red; -moz-background-inline-policy: each-box");
 isnot(e.style.background, "", "should have background shorthand (-moz-background-inline-policy not relevant)");

 // Check that we only serialize background when the lists (of layers) for
 // the subproperties are the same length.
 // XXX Should change background-clip to border,padding,border and
-// background-origin to border,padding,padding once serialization does
-// clip/origin.
-e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: cover, auto, contain; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
+// background-origin to border,padding,padding and background-size to
+// cover,auto,contain once serialization does clip/origin/size.
+e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: auto, auto, auto; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
 isnot(e.style.background, "", "should have background shorthand (all lists length 3)");
-e.setAttribute("style", "-moz-background-clip: border, border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: cover, auto, contain; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
+e.setAttribute("style", "-moz-background-clip: border, border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: auto, auto, auto; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
 is(e.style.background, "", "should not have background shorthand (background-clip too long)");
-e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: border, padding; -moz-background-size: cover, auto, contain; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
+e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding; -moz-background-size: auto, auto, auto; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
 is(e.style.background, "", "should not have background shorthand (background-origin too short)");
-e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: cover, auto, contain; background-color: blue; background-image: url(404.png), none, url(404-2.png), none; background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
+e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: auto, auto, auto; background-color: blue; background-image: url(404.png), none, url(404-2.png), none; background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
 is(e.style.background, "", "should not have background shorthand (background-image too long)");
-e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: cover, auto, contain; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
+e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: auto, auto, auto; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
 is(e.style.background, "", "should not have background shorthand (background-attachment too short)");
-e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: cover, auto, contain; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px, bottom; background-repeat: repeat-x, repeat, no-repeat");
+e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: auto, auto, auto; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px, bottom; background-repeat: repeat-x, repeat, no-repeat");
 is(e.style.background, "", "should not have background shorthand (background-position too long)");
-e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: cover, auto, contain; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat");
+e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: auto, auto, auto; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat");
 is(e.style.background, "", "should not have background shorthand (background-repeat too short)");
-e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: cover, auto, contain, cover; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
+e.setAttribute("style", "-moz-background-clip: border, border, border; -moz-background-origin: padding, padding, padding; -moz-background-size: auto, auto, auto, auto; background-color: blue; background-image: url(404.png), none, url(404-2.png); background-attachment: fixed, scroll, scroll; background-position: top left, center, 30px 50px; background-repeat: repeat-x, repeat, no-repeat");
 is(e.style.background, "", "should not have background shorthand (-moz-background-size too long)");

 // Check that we only serialize transition when the lists are the same length.
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@ -702,8 +702,11 @@ function OnDocumentLoad(event)
       // above causes 2 assertions.  So that we don't have to annotate
       // the manifests for every reftest-print reftest, bump the
       // assertion count by two right here.
-       gURLs[0].minAsserts += 2;
-       gURLs[0].maxAsserts += 2;
+       // And on Mac, it causes *three* assertions.
+       var xr = CC[NS_XREAPPINFO_CONTRACTID].getService(CI.nsIXULRuntime);
+       var count = (xr.widgetToolkit == "cocoa") ? 3 : 2;
+       gURLs[0].minAsserts += count;
+       gURLs[0].maxAsserts += count;
    }

    setupZoom(contentRootElement);
--- a/layout/xul/base/src/nsScrollBoxFrame.cpp
+++ b/layout/xul/base/src/nsScrollBoxFrame.cpp
@ -77,7 +77,12 @@ protected:
    nsButtonBoxFrame(aPresShell, aContext) {}
  
  void StartRepeat() {
-    nsRepeatService::GetInstance()->Start(Notify, this, 0);
+    if (IsActivatedOnHover()) {
+      // No initial delay on hover.
+      nsRepeatService::GetInstance()->Start(Notify, this, 0);
+    } else {
+      nsRepeatService::GetInstance()->Start(Notify, this);
+    }
  }
  void StopRepeat() {
    nsRepeatService::GetInstance()->Stop(Notify, this);
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@ -59,7 +59,11 @@ pref("general.warnOnAboutConfig", true);
 pref("browser.bookmarks.max_backups",       5);

 pref("browser.cache.disk.enable",           true);
+#ifndef WINCE
 pref("browser.cache.disk.capacity",         51200);
+#else
+pref("browser.cache.disk.capacity",         20000);
+#endif
 pref("browser.cache.memory.enable",         true);
 //pref("browser.cache.memory.capacity",     -1);
 // -1 = determine dynamically, 0 = none, n = memory capacity in kilobytes
@ -68,6 +72,7 @@ pref("browser.cache.disk_cache_ssl",        false);
 pref("browser.cache.check_doc_frequency",   3);

 pref("browser.cache.offline.enable",           true);
+#ifndef WINCE
 // offline cache capacity in kilobytes
 pref("browser.cache.offline.capacity",         512000);

@ -78,6 +83,12 @@ pref("offline-apps.quota.max",        204800);
 // the user should be warned if offline app disk usage exceeds this amount
 // (in kilobytes)
 pref("offline-apps.quota.warn",        51200);
+#else
+// Limited disk space on WinCE, tighten limits.
+pref("browser.cache.offline.capacity", 15000);
+pref("offline-apps.quota.max",          7000);
+pref("offline-apps.quota.warn",         4000);
+#endif

 // Fastback caching - if this pref is negative, then we calculate the number
 // of content viewers to cache based on the amount of available memory.
--- a/modules/libpref/src/nsPrefBranch.cpp
+++ b/modules/libpref/src/nsPrefBranch.cpp
@ -67,6 +67,7 @@ struct PrefCallbackData {
  nsPrefBranch     *pBranch;
  nsIObserver      *pObserver;
  nsIWeakReference *pWeakRef;
+  char pDomain[1];
 };


@ -591,7 +592,7 @@ NS_IMETHODIMP nsPrefBranch::AddObserver(const char *aDomain, nsIObserver *aObser
      return NS_ERROR_OUT_OF_MEMORY;
  }

-  pCallback = (PrefCallbackData *)nsMemory::Alloc(sizeof(PrefCallbackData));
+  pCallback = (PrefCallbackData *)NS_Alloc(sizeof(PrefCallbackData) + strlen(aDomain));
  if (nsnull == pCallback)
    return NS_ERROR_OUT_OF_MEMORY;

@ -613,8 +614,8 @@ NS_IMETHODIMP nsPrefBranch::AddObserver(const char *aDomain, nsIObserver *aObser
    NS_ADDREF(pCallback->pObserver);
  }

+  strcpy(pCallback->pDomain, aDomain);
  mObservers->AppendElement(pCallback);
-  mObserverDomains.AppendElement(nsCString(aDomain));

  // We must pass a fully qualified preference name to the callback
  pref = getPrefName(aDomain); // aDomain == nsnull only possible failure, trapped above
@ -644,28 +645,24 @@ NS_IMETHODIMP nsPrefBranch::RemoveObserver(const char *aDomain, nsIObserver *aOb

  for (i = 0; i < count; i++) {
    pCallback = (PrefCallbackData *)mObservers->ElementAt(i);
-    if (pCallback) {
-      if (pCallback->pObserver == aObserver) {
-        domain = mObserverDomains[i];
-        if (domain.Equals(aDomain)) {
-          // We must pass a fully qualified preference name to remove the callback
-          pref = getPrefName(aDomain); // aDomain == nsnull only possible failure, trapped above
-          rv = PREF_UnregisterCallback(pref, NotifyObserver, pCallback);
-          if (NS_SUCCEEDED(rv)) {
-            // Remove this observer from our array so that nobody else can remove
-            // what we're trying to remove ourselves right now.
-            mObservers->RemoveElementAt(i);
-            mObserverDomains.RemoveElementAt(i);
-            if (pCallback->pWeakRef) {
-              NS_RELEASE(pCallback->pWeakRef);
-            } else {
-              NS_RELEASE(pCallback->pObserver);
-            }
-            nsMemory::Free(pCallback);
-          }
-          return rv;
+    if (pCallback &&
+        pCallback->pObserver == aObserver &&
+        !strcmp(pCallback->pDomain, aDomain)) {
+      // We must pass a fully qualified preference name to remove the callback
+      pref = getPrefName(aDomain); // aDomain == nsnull only possible failure, trapped above
+      rv = PREF_UnregisterCallback(pref, NotifyObserver, pCallback);
+      if (NS_SUCCEEDED(rv)) {
+        // Remove this observer from our array so that nobody else can remove
+        // what we're trying to remove ourselves right now.
+        mObservers->RemoveElementAt(i);
+        if (pCallback->pWeakRef) {
+          NS_RELEASE(pCallback->pWeakRef);
+        } else {
+          NS_RELEASE(pCallback->pObserver);
        }
+        NS_Free(pCallback);
      }
+      return rv;
    }
  }

@ -695,7 +692,7 @@ static nsresult NotifyObserver(const char *newpref, void *data)
    observer = do_QueryReferent(pData->pWeakRef);
    if (!observer) {
      // this weak referenced observer went away, remove them from the list
-      pData->pBranch->RemoveObserver(newpref, pData->pObserver);
+      pData->pBranch->RemoveObserver(pData->pDomain, pData->pObserver);
      return NS_OK;
    }
  } else {
@ -725,9 +722,8 @@ void nsPrefBranch::freeObserverList(void)
      for (i = 0; i < count; ++i) {
        pCallback = (PrefCallbackData *)mObservers->ElementAt(i);
        if (pCallback) {
-          domain = mObserverDomains[i];
          // We must pass a fully qualified preference name to remove the callback
-          pref = getPrefName(domain.get()); // can't fail because domain must be valid
+          pref = getPrefName(pCallback->pDomain);
          // Remove this observer from our array so that nobody else can remove
          // what we're trying to remove right now.
          mObservers->ReplaceElementAt(nsnull, i);
@ -740,9 +736,6 @@ void nsPrefBranch::freeObserverList(void)
          nsMemory::Free(pCallback);
        }
      }
-
-      // now empty the observer domains array in bulk
-      mObserverDomains.Clear();
    }
    delete mObservers;
    mObservers = 0;
--- a/modules/libpref/src/nsPrefBranch.h
+++ b/modules/libpref/src/nsPrefBranch.h
@ -83,7 +83,6 @@ private:
  PRInt32               mPrefRootLength;
  nsAutoVoidArray       *mObservers;
  nsCString             mPrefRoot;
-  nsTArray<nsCString>   mObserverDomains;
  PRBool                mIsDefault;

 };
--- a/modules/plugin/base/public/nsIPluginHost.idl
+++ b/modules/plugin/base/public/nsIPluginHost.idl
@ -64,7 +64,7 @@ interface nsIPluginStreamListener;
 [ref] native nsIStreamListenerRef(nsIStreamListener *);
 [ptr] native nsPluginNativeWindowPtr(nsPluginNativeWindow);

-[scriptable, uuid(30C7C529-B05C-4950-B5B8-9AF673E46521)]
+[scriptable, uuid(AA13B116-2AFC-4F23-8395-913C0475D173)]
 interface nsIPluginHost : nsISupports
 {
  [noscript] void init();
@ -285,6 +285,11 @@ interface nsIPluginHost : nsISupports
   * @return plugin tag object
   */
  [noscript] nsIPluginTag getPluginTagForInstance(in nsIPluginInstance aInstance);
+  
+%{C++
+  virtual void AddIdleTimeTarget(nsIPluginInstanceOwner* objectFrame, PRBool isVisible) = 0;
+  virtual void RemoveIdleTimeTarget(nsIPluginInstanceOwner* objectFrame) = 0;
+%}
 };

 %{C++
--- a/modules/plugin/base/public/nsIPluginInstanceOwner.idl
+++ b/modules/plugin/base/public/nsIPluginInstanceOwner.idl
@ -49,7 +49,7 @@ class nsPluginEvent;

 [ref] native nsIPluginInstanceRef(nsIPluginInstance*);

-[uuid(8080E717-7261-4707-B8B4-48250F47055F)]
+[uuid(D8776CDC-00DF-4395-A432-2E78EBCC12B6)]
 interface nsIPluginInstanceOwner : nsISupports
 {
  /**
@ -137,4 +137,8 @@ interface nsIPluginInstanceOwner : nsISupports
 %}

  void setEventModel(in PRInt32 eventModel);
+
+%{C++
+  virtual void SendIdleEvent() = 0;
+%}
 };
--- a/modules/plugin/base/src/Makefile.in
+++ b/modules/plugin/base/src/Makefile.in
@ -57,6 +57,7 @@ CPPSRCS		= \
 		nsPluginHost.cpp \
 		nsPluginModule.cpp \
 		nsJSNPRuntime.cpp \
+		nsPluginTags.cpp \
 		$(NULL)

 ifeq ($(OS_ARCH), BeOS)
--- a/Показать больше
+++ b/Показать больше