diff --git a/browser/components/extensions/test/browser/head.js b/browser/components/extensions/test/browser/head.js
index f83ba03699b3..25a41bf42fa5 100644
--- a/browser/components/extensions/test/browser/head.js
+++ b/browser/components/extensions/test/browser/head.js
@@ -26,7 +26,6 @@ const {CustomizableUI} = Cu.import("resource:///modules/CustomizableUI.jsm", {})
 // use to select our configuration.
 if (gTestPath.includes("test-oop-extensions")) {
   SpecialPowers.pushPrefEnv({set: [
-    ["dom.ipc.processCount.extension", 1],
     ["extensions.webextensions.remote", true],
   ]});
   // We don't want to reset this at the end of the test, so that we don't have
diff --git a/browser/components/migration/tests/marionette/test_refresh_firefox.py b/browser/components/migration/tests/marionette/test_refresh_firefox.py
index 808115ca16cf..00b72cce658c 100644
--- a/browser/components/migration/tests/marionette/test_refresh_firefox.py
+++ b/browser/components/migration/tests/marionette/test_refresh_firefox.py
@@ -3,6 +3,7 @@ import shutil
 import time
 
 from marionette_harness import MarionetteTestCase
+from marionette_driver.errors import NoAlertPresentException
 
 
 class TestFirefoxRefresh(MarionetteTestCase):
@@ -269,11 +270,17 @@ class TestFirefoxRefresh(MarionetteTestCase):
         """)
         self.assertSequenceEqual(tabURIs, ["about:welcomeback"])
 
+        # Dismiss modal dialog if any. This is mainly to dismiss the check for
+        # default browser dialog if it shows up.
+        try:
+          alert = self.marionette.switch_to_alert()
+          alert.dismiss()
+        except NoAlertPresentException:
+          pass
+
         tabURIs = self.runAsyncCode("""
           let mm = gBrowser.selectedBrowser.messageManager;
-          let fs = function() {
-            content.document.getElementById("errorTryAgain").click();
-          };
+
           let {TabStateFlusher} = Cu.import("resource:///modules/sessionstore/TabStateFlusher.jsm", {});
           window.addEventListener("SSWindowStateReady", function testSSPostReset() {
             window.removeEventListener("SSWindowStateReady", testSSPostReset, false);
@@ -281,6 +288,17 @@ class TestFirefoxRefresh(MarionetteTestCase):
               marionetteScriptFinished([... gBrowser.browsers].map(b => b.currentURI && b.currentURI.spec));
             });
           }, false);
+
+          let fs = function() {
+            if (content.document.readyState === "complete") {
+              content.document.getElementById("errorTryAgain").click();
+            } else {
+              content.window.addEventListener("load", function(event) {
+                content.document.getElementById("errorTryAgain").click();
+              }, { once: true });
+            }
+          };
+
           mm.loadFrameScript("data:application/javascript,(" + fs.toString() + ")()", true);
         """)
         self.assertSequenceEqual(tabURIs, self._expectedURLs)
diff --git a/browser/extensions/aushelper/bootstrap.js b/browser/extensions/aushelper/bootstrap.js
index 4820e52a45fa..d1a9656f068e 100644
--- a/browser/extensions/aushelper/bootstrap.js
+++ b/browser/extensions/aushelper/bootstrap.js
@@ -8,8 +8,33 @@ const {classes: Cc, interfaces: Ci, utils: Cu} = Components;
 const APP_UPDATE_URL_PREF = "app.update.url";
 const REPLACE_KEY = "%OS_VERSION%";
 
+const AUSHELPER_CPU_RESULT_CODE_HISTOGRAM_ID = "AUSHELPER_CPU_RESULT_CODE";
+// The system is not vulnerable to Bug 1296630.
+const CPU_NO_BUG1296630 = 1;
+// The system is vulnerable to Bug 1296630.
+const CPU_YES_BUG1296630 = 2;
+// An error occured when checking if the system is vulnerable to Bug 1296630.
+const CPU_ERR_BUG1296630 = 3;
+// It is unknown whether the system is vulnerable to Bug 1296630 (should never happen).
+const CPU_UNKNOWN_BUG1296630 = 4;
+
+const AUSHELPER_CPU_ERROR_CODE_HISTOGRAM_ID = "AUSHELPER_CPU_ERROR_CODE";
+const CPU_SUCCESS = 0;
+const CPU_REG_OPEN_ERROR = 1;
+const CPU_VENDOR_ID_ERROR = 2;
+const CPU_ID_ERROR = 4;
+const CPU_REV_ERROR = 8;
+
+const AUSHELPER_WEBSENSE_REG_VERSION_SCALAR_NAME = "aushelper.websense_reg_version";
+const AUSHELPER_WEBSENSE_REG_EXISTS_HISTOGRAM_ID = "AUSHELPER_WEBSENSE_REG_EXISTS";
+
+const AUSHELPER_WEBSENSE_ERROR_CODE_HISTOGRAM_ID = "AUSHELPER_WEBSENSE_ERROR_CODE";
+const WEBSENSE_SUCCESS = 0;
+const WEBSENSE_REG_OPEN_ERROR = 1;
+const WEBSENSE_REG_READ_ERROR = 2;
+const WEBSENSE_ALREADY_MODIFIED = 4;
+
 Cu.import("resource://gre/modules/Services.jsm");
-Cu.import("resource://gre/modules/TelemetryLog.jsm");
 
 function startup() {
   if (Services.appinfo.OS != "WINNT") {
@@ -18,12 +43,13 @@ function startup() {
 
   const regCPUPath = "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0";
   let wrk;
+  let cpuErrorCode = CPU_SUCCESS;
   try {
     wrk = Cc["@mozilla.org/windows-registry-key;1"].createInstance(Ci.nsIWindowsRegKey);
     wrk.open(wrk.ROOT_KEY_LOCAL_MACHINE, regCPUPath, wrk.ACCESS_READ);
   } catch (e) {
-    Cu.reportError("Unable to open registry. Exception: " + e);
-    TelemetryLog.log("AUSHELPER_FATAL_ERROR", [e]);
+    Cu.reportError("AUSHelper - unable to open registry. Exception: " + e);
+    cpuErrorCode |= CPU_REG_OPEN_ERROR;
   }
 
   // If any of the following values are successfully retrieved and they don't
@@ -41,9 +67,9 @@ function startup() {
       cpuVendorIDMatch = true;
     }
   } catch (e) {
+    Cu.reportError("AUSHelper - error getting CPU vendor indentifier. Exception: " + e);
     cpuVendorIDMatch = null;
-    Cu.reportError("Error getting CPU vendor indentifier. Exception: " + e);
-    TelemetryLog.log("AUSHELPER_CPU_VENDOR_ID_ERROR", [e]);
+    cpuErrorCode |= CPU_VENDOR_ID_ERROR;
   }
 
   let cpuIDMatch = false;
@@ -53,9 +79,9 @@ function startup() {
       cpuIDMatch = true;
     }
   } catch (e) {
+    Cu.reportError("AUSHelper - error getting CPU indentifier. Exception: " + e);
     cpuIDMatch = null;
-    Cu.reportError("Error getting CPU indentifier. Exception: " + e);
-    TelemetryLog.log("AUSHELPER_CPU_ID_ERROR", [e]);
+    cpuErrorCode |= CPU_ID_ERROR;
   }
 
   let microCodeVersions = [0xe, 0x11, 0x12, 0x13, 0x16, 0x18, 0x19];
@@ -67,8 +93,8 @@ function startup() {
         let regVal = wrk.readBinaryValue(keyNames[i]);
         if (regVal.length == 8) {
           let hexVal = [];
-          // We are only inyterested in the highest byte and return the little
-          // endian value for it.
+          // We are only inyterested in the upper 4 bytes and the little endian
+          // value for it.
           for (let j = 4; j < 8; j++) {
             let c = regVal.charCodeAt(j).toString(16);
             if (c.length == 1) {
@@ -86,44 +112,78 @@ function startup() {
         if (i == keyNames.length - 1) {
           // The registry key name's value was not successfully queried.
           cpuRevMatch = null;
-          TelemetryLog.log("AUSHELPER_CPU_REV_ERROR", [e]);
+          cpuErrorCode |= CPU_REV_ERROR;
         }
       }
     }
+    wrk.close();
   } catch (ex) {
+    Cu.reportError("AUSHelper - error getting CPU revision. Exception: " + ex);
     cpuRevMatch = null;
-    Cu.reportError("Error getting CPU revision. Exception: " + ex);
-    TelemetryLog.log("AUSHELPER_CPU_REV_ERROR", [ex]);
+    cpuErrorCode |= CPU_REV_ERROR;
   }
 
-  let resultCode = 3;
-  let newValue = "(unkBug1296630v1)";
+  let cpuResult = CPU_UNKNOWN_BUG1296630;
+  let cpuValue = "(unkBug1296630v1)";
   // The following uses strict equality checks since the values can be true,
   // false, or null.
   if (cpuVendorIDMatch === false || cpuIDMatch === false || cpuRevMatch === false) {
     // Since one of the values is false then the system won't be affected by
     // bug 1296630 according to the conditions set out in bug 1311515.
-    newValue = "(noBug1296630v1)";
-    resultCode = 0;
+    cpuValue = "(noBug1296630v1)";
+    cpuResult = CPU_NO_BUG1296630;
   } else if (cpuVendorIDMatch === null || cpuIDMatch === null || cpuRevMatch === null) {
     // Since one of the values is null we can't say for sure if the system will
     // be affected by bug 1296630.
-    newValue = "(errBug1296630v1)";
-    resultCode = 2;
+    cpuValue = "(errBug1296630v1)";
+    cpuResult = CPU_ERR_BUG1296630;
   } else if (cpuVendorIDMatch === true && cpuIDMatch === true && cpuRevMatch === true) {
     // Since all of the values are true we can say that the system will be
     // affected by bug 1296630.
-    newValue = "(yesBug1296630v1)";
-    resultCode = 1;
+    cpuValue = "(yesBug1296630v1)";
+    cpuResult = CPU_YES_BUG1296630;
   }
 
-  let defaultBranch = Services.prefs.getDefaultBranch("");
-  let curPrefValue = defaultBranch.getCharPref(APP_UPDATE_URL_PREF);
-  let newPrefValue = curPrefValue.replace(REPLACE_KEY + "/", REPLACE_KEY + newValue + "/");
-  defaultBranch.setCharPref(APP_UPDATE_URL_PREF, newPrefValue);
-  TelemetryLog.log("AUSHELPER_RESULT", [resultCode]);
-}
+  Services.telemetry.getHistogramById(AUSHELPER_CPU_RESULT_CODE_HISTOGRAM_ID).add(cpuResult);
+  Services.telemetry.getHistogramById(AUSHELPER_CPU_ERROR_CODE_HISTOGRAM_ID).add(cpuErrorCode);
 
+  const regWebsensePath = "Websense\\Agent";
+  let websenseErrorCode = WEBSENSE_SUCCESS;
+  let websenseVersion = "";
+  try {
+    let regModes = [wrk.ACCESS_READ, wrk.ACCESS_READ | wrk.WOW64_64];
+    for (let i = 0; i < regModes.length; ++i) {
+      wrk.open(wrk.ROOT_KEY_LOCAL_MACHINE, "SOFTWARE", regModes[i]);
+      try {
+        if (wrk.hasChild(regWebsensePath)) {
+          let childKey = wrk.openChild(regWebsensePath, wrk.ACCESS_READ);
+          websenseVersion = childKey.readStringValue("InstallVersion");
+          Services.telemetry.scalarSet(AUSHELPER_WEBSENSE_REG_VERSION_SCALAR_NAME, websenseVersion);
+        }
+        wrk.close();
+      } catch (e) {
+        Cu.reportError("AUSHelper - unable to read registry. Exception: " + e);
+        websenseErrorCode |= WEBSENSE_REG_READ_ERROR;
+      }
+    }
+  } catch (ex) {
+    Cu.reportError("AUSHelper - unable to open registry. Exception: " + ex);
+    websenseErrorCode |= WEBSENSE_REG_OPEN_ERROR;
+  }
+
+  Services.telemetry.getHistogramById(AUSHELPER_WEBSENSE_REG_EXISTS_HISTOGRAM_ID).add(!!websenseVersion);
+  let websenseValue = "(" + (websenseVersion ? "websense-" + websenseVersion : "nowebsense") + ")";
+
+  let branch = Services.prefs.getDefaultBranch("");
+  let curValue = branch.getCharPref(APP_UPDATE_URL_PREF);
+  if (curValue.indexOf(REPLACE_KEY + "/") > -1) {
+    let newValue = curValue.replace(REPLACE_KEY + "/", REPLACE_KEY + cpuValue + websenseValue + "/");
+    branch.setCharPref(APP_UPDATE_URL_PREF, newValue);
+  } else {
+    websenseErrorCode |= WEBSENSE_ALREADY_MODIFIED;
+  }
+  Services.telemetry.getHistogramById(AUSHELPER_WEBSENSE_ERROR_CODE_HISTOGRAM_ID).add(websenseErrorCode);
+}
 function shutdown() {}
 function install() {}
 function uninstall() {}
diff --git a/browser/extensions/aushelper/install.rdf.in b/browser/extensions/aushelper/install.rdf.in
index eb60f64da330..78e841d884df 100644
--- a/browser/extensions/aushelper/install.rdf.in
+++ b/browser/extensions/aushelper/install.rdf.in
@@ -10,7 +10,7 @@
 
   <Description about="urn:mozilla:install-manifest">
     <em:id>aushelper@mozilla.org</em:id>
-    <em:version>1.0</em:version>
+    <em:version>2.0</em:version>
     <em:type>2</em:type>
     <em:bootstrap>true</em:bootstrap>
     <em:multiprocessCompatible>true</em:multiprocessCompatible>
diff --git a/browser/extensions/pdfjs/README.mozilla b/browser/extensions/pdfjs/README.mozilla
index 230209a4baee..975b06fbe425 100644
--- a/browser/extensions/pdfjs/README.mozilla
+++ b/browser/extensions/pdfjs/README.mozilla
@@ -1,3 +1,3 @@
 This is the pdf.js project output, https://github.com/mozilla/pdf.js
 
-Current extension version is: 1.7.290
+Current extension version is: 1.7.297
diff --git a/browser/extensions/pdfjs/content/build/pdf.js b/browser/extensions/pdfjs/content/build/pdf.js
index ae67eae53220..20b137d2ddd5 100644
--- a/browser/extensions/pdfjs/content/build/pdf.js
+++ b/browser/extensions/pdfjs/content/build/pdf.js
@@ -3632,8 +3632,8 @@ var _UnsupportedManager = function UnsupportedManagerClosure() {
   }
  };
 }();
-exports.version = '1.7.290';
-exports.build = 'b509a3f8';
+exports.version = '1.7.297';
+exports.build = '425ad309';
 exports.getDocument = getDocument;
 exports.PDFDataRangeTransport = PDFDataRangeTransport;
 exports.PDFWorker = PDFWorker;
@@ -4650,8 +4650,8 @@ if (!globalScope.PDFJS) {
  globalScope.PDFJS = {};
 }
 var PDFJS = globalScope.PDFJS;
-PDFJS.version = '1.7.290';
-PDFJS.build = 'b509a3f8';
+PDFJS.version = '1.7.297';
+PDFJS.build = '425ad309';
 PDFJS.pdfBug = false;
 if (PDFJS.verbosity !== undefined) {
  sharedUtil.setVerbosityLevel(PDFJS.verbosity);
@@ -7143,8 +7143,8 @@ exports.TilingPattern = TilingPattern;
 
 "use strict";
 
-var pdfjsVersion = '1.7.290';
-var pdfjsBuild = 'b509a3f8';
+var pdfjsVersion = '1.7.297';
+var pdfjsBuild = '425ad309';
 var pdfjsSharedUtil = __w_pdfjs_require__(0);
 var pdfjsDisplayGlobal = __w_pdfjs_require__(8);
 var pdfjsDisplayAPI = __w_pdfjs_require__(3);
diff --git a/browser/extensions/pdfjs/content/build/pdf.worker.js b/browser/extensions/pdfjs/content/build/pdf.worker.js
index 54d7321a2954..63170673249f 100644
--- a/browser/extensions/pdfjs/content/build/pdf.worker.js
+++ b/browser/extensions/pdfjs/content/build/pdf.worker.js
@@ -88,7 +88,7 @@ return /******/ (function(modules) { // webpackBootstrap
 /******/ 	__w_pdfjs_require__.p = "";
 
 /******/ 	// Load entry module and return exports
-/******/ 	return __w_pdfjs_require__(__w_pdfjs_require__.s = 36);
+/******/ 	return __w_pdfjs_require__(__w_pdfjs_require__.s = 35);
 /******/ })
 /************************************************************************/
 /******/ ([
@@ -1732,8 +1732,8 @@ exports.isStream = isStream;
 
 var sharedUtil = __w_pdfjs_require__(0);
 var corePrimitives = __w_pdfjs_require__(1);
-var coreJbig2 = __w_pdfjs_require__(28);
-var coreJpg = __w_pdfjs_require__(29);
+var coreJbig2 = __w_pdfjs_require__(27);
+var coreJpg = __w_pdfjs_require__(28);
 var coreJpx = __w_pdfjs_require__(13);
 var Util = sharedUtil.Util;
 var error = sharedUtil.error;
@@ -12357,7 +12357,7 @@ exports.Parser = Parser;
 
 var sharedUtil = __w_pdfjs_require__(0);
 var corePrimitives = __w_pdfjs_require__(1);
-var corePsParser = __w_pdfjs_require__(34);
+var corePsParser = __w_pdfjs_require__(33);
 var error = sharedUtil.error;
 var info = sharedUtil.info;
 var isArray = sharedUtil.isArray;
@@ -18279,7 +18279,7 @@ exports.ArithmeticDecoder = ArithmeticDecoder;
 "use strict";
 
 var sharedUtil = __w_pdfjs_require__(0);
-var coreCharsets = __w_pdfjs_require__(22);
+var coreCharsets = __w_pdfjs_require__(21);
 var coreEncodings = __w_pdfjs_require__(4);
 var error = sharedUtil.error;
 var info = sharedUtil.info;
@@ -24768,15 +24768,15 @@ var sharedUtil = __w_pdfjs_require__(0);
 var corePrimitives = __w_pdfjs_require__(1);
 var coreStream = __w_pdfjs_require__(2);
 var coreParser = __w_pdfjs_require__(5);
-var coreImage = __w_pdfjs_require__(27);
+var coreImage = __w_pdfjs_require__(26);
 var coreColorSpace = __w_pdfjs_require__(3);
-var coreMurmurHash3 = __w_pdfjs_require__(31);
-var coreFonts = __w_pdfjs_require__(26);
+var coreMurmurHash3 = __w_pdfjs_require__(30);
+var coreFonts = __w_pdfjs_require__(25);
 var coreFunction = __w_pdfjs_require__(6);
-var corePattern = __w_pdfjs_require__(32);
-var coreCMap = __w_pdfjs_require__(23);
-var coreMetrics = __w_pdfjs_require__(30);
-var coreBidi = __w_pdfjs_require__(21);
+var corePattern = __w_pdfjs_require__(31);
+var coreCMap = __w_pdfjs_require__(22);
+var coreMetrics = __w_pdfjs_require__(29);
+var coreBidi = __w_pdfjs_require__(20);
 var coreEncodings = __w_pdfjs_require__(4);
 var coreStandardFonts = __w_pdfjs_require__(15);
 var coreUnicode = __w_pdfjs_require__(16);
@@ -33906,10 +33906,10 @@ exports.getUnicodeForGlyph = getUnicodeForGlyph;
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
-/* WEBPACK VAR INJECTION */(function(module) {
+
 var sharedUtil = __w_pdfjs_require__(0);
 var corePrimitives = __w_pdfjs_require__(1);
-var corePdfManager = __w_pdfjs_require__(33);
+var corePdfManager = __w_pdfjs_require__(32);
 var UNSUPPORTED_FEATURES = sharedUtil.UNSUPPORTED_FEATURES;
 var InvalidPDFException = sharedUtil.InvalidPDFException;
 var MessageHandler = sharedUtil.MessageHandler;
@@ -34588,13 +34588,18 @@ function initializeWorker() {
  WorkerMessageHandler.setup(handler, self);
  handler.send('ready', null);
 }
-if (typeof window === 'undefined' && !(typeof module !== 'undefined' && module.require)) {
+function isNodeJS() {
+ if (typeof __pdfjsdev_webpack__ === 'undefined') {
+  return typeof process === 'object' && process + '' === '[object process]';
+ }
+ return false;
+}
+if (typeof window === 'undefined' && !isNodeJS()) {
  initializeWorker();
 }
 exports.setPDFNetworkStreamClass = setPDFNetworkStreamClass;
 exports.WorkerTask = WorkerTask;
 exports.WorkerMessageHandler = WorkerMessageHandler;
-/* WEBPACK VAR INJECTION */}.call(exports, __w_pdfjs_require__(19)(module)))
 
 /***/ }),
 /* 18 */
@@ -34614,34 +34619,6 @@ module.exports = g;
 
 /***/ }),
 /* 19 */
-/***/ (function(module, exports) {
-
-module.exports = function (module) {
- if (!module.webpackPolyfill) {
-  module.deprecate = function () {
-  };
-  module.paths = [];
-  if (!module.children)
-   module.children = [];
-  Object.defineProperty(module, "loaded", {
-   enumerable: true,
-   get: function () {
-    return module.l;
-   }
-  });
-  Object.defineProperty(module, "id", {
-   enumerable: true,
-   get: function () {
-    return module.i;
-   }
-  });
-  module.webpackPolyfill = 1;
- }
- return module;
-};
-
-/***/ }),
-/* 20 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -34667,6 +34644,7 @@ var Dict = corePrimitives.Dict;
 var isDict = corePrimitives.isDict;
 var isName = corePrimitives.isName;
 var isRef = corePrimitives.isRef;
+var isStream = corePrimitives.isStream;
 var Stream = coreStream.Stream;
 var ColorSpace = coreColorSpace.ColorSpace;
 var Catalog = coreObj.Catalog;
@@ -34760,30 +34738,13 @@ var Annotation = function AnnotationClosure() {
    rect[1] - minY * yRatio
   ];
  }
- function getDefaultAppearance(dict) {
-  var appearanceState = dict.get('AP');
-  if (!isDict(appearanceState)) {
-   return;
-  }
-  var appearance;
-  var appearances = appearanceState.get('N');
-  if (isDict(appearances)) {
-   var as = dict.get('AS');
-   if (as && appearances.has(as.name)) {
-    appearance = appearances.get(as.name);
-   }
-  } else {
-   appearance = appearances;
-  }
-  return appearance;
- }
  function Annotation(params) {
   var dict = params.dict;
   this.setFlags(dict.get('F'));
   this.setRectangle(dict.getArray('Rect'));
   this.setColor(dict.getArray('C'));
   this.setBorderStyle(dict);
-  this.appearance = getDefaultAppearance(dict);
+  this.setAppearance(dict);
   this.data = {};
   this.data.id = params.id;
   this.data.subtype = params.subtype;
@@ -34887,6 +34848,26 @@ var Annotation = function AnnotationClosure() {
     this.borderStyle.setWidth(0);
    }
   },
+  setAppearance: function Annotation_setAppearance(dict) {
+   this.appearance = null;
+   var appearanceStates = dict.get('AP');
+   if (!isDict(appearanceStates)) {
+    return;
+   }
+   var normalAppearanceState = appearanceStates.get('N');
+   if (isStream(normalAppearanceState)) {
+    this.appearance = normalAppearanceState;
+    return;
+   }
+   if (!isDict(normalAppearanceState)) {
+    return;
+   }
+   var as = dict.get('AS');
+   if (!isName(as) || !normalAppearanceState.has(as.name)) {
+    return;
+   }
+   this.appearance = normalAppearanceState.get(as.name);
+  },
   _preparePopup: function Annotation_preparePopup(dict) {
    if (!dict.has('C')) {
     this.data.color = null;
@@ -35332,7 +35313,7 @@ exports.AnnotationBorderStyle = AnnotationBorderStyle;
 exports.AnnotationFactory = AnnotationFactory;
 
 /***/ }),
-/* 21 */
+/* 20 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -36085,7 +36066,7 @@ function bidi(str, startLevel, vertical) {
 exports.bidi = bidi;
 
 /***/ }),
-/* 22 */
+/* 21 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -36583,7 +36564,7 @@ exports.ExpertCharset = ExpertCharset;
 exports.ExpertSubsetCharset = ExpertSubsetCharset;
 
 /***/ }),
-/* 23 */
+/* 22 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -37488,7 +37469,7 @@ exports.CMapFactory = CMapFactory;
 exports.IdentityCMap = IdentityCMap;
 
 /***/ }),
-/* 24 */
+/* 23 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -37500,7 +37481,7 @@ var coreObj = __w_pdfjs_require__(14);
 var coreParser = __w_pdfjs_require__(5);
 var coreCrypto = __w_pdfjs_require__(11);
 var coreEvaluator = __w_pdfjs_require__(12);
-var coreAnnotation = __w_pdfjs_require__(20);
+var coreAnnotation = __w_pdfjs_require__(19);
 var MissingDataException = sharedUtil.MissingDataException;
 var Util = sharedUtil.Util;
 var assert = sharedUtil.assert;
@@ -37988,7 +37969,7 @@ exports.Page = Page;
 exports.PDFDocument = PDFDocument;
 
 /***/ }),
-/* 25 */
+/* 24 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -38774,7 +38755,7 @@ var FontRendererFactory = function FontRendererFactoryClosure() {
 exports.FontRendererFactory = FontRendererFactory;
 
 /***/ }),
-/* 26 */
+/* 25 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -38783,11 +38764,11 @@ var sharedUtil = __w_pdfjs_require__(0);
 var corePrimitives = __w_pdfjs_require__(1);
 var coreStream = __w_pdfjs_require__(2);
 var coreGlyphList = __w_pdfjs_require__(7);
-var coreFontRenderer = __w_pdfjs_require__(25);
+var coreFontRenderer = __w_pdfjs_require__(24);
 var coreEncodings = __w_pdfjs_require__(4);
 var coreStandardFonts = __w_pdfjs_require__(15);
 var coreUnicode = __w_pdfjs_require__(16);
-var coreType1Parser = __w_pdfjs_require__(35);
+var coreType1Parser = __w_pdfjs_require__(34);
 var coreCFFParser = __w_pdfjs_require__(9);
 var FONT_IDENTITY_MATRIX = sharedUtil.FONT_IDENTITY_MATRIX;
 var FontType = sharedUtil.FontType;
@@ -40003,7 +39984,7 @@ var Font = function FontClosure() {
       useTable = true;
      } else if (platformId === 1 && encodingId === 0) {
       useTable = true;
-     } else if (platformId === 3 && encodingId === 1 && (!isSymbolicFont && hasEncoding || !potentialTable)) {
+     } else if (platformId === 3 && encodingId === 1 && (hasEncoding || !potentialTable)) {
       useTable = true;
       if (!isSymbolicFont) {
        canBreak = true;
@@ -41740,7 +41721,7 @@ exports.ToUnicodeMap = ToUnicodeMap;
 exports.getFontType = getFontType;
 
 /***/ }),
-/* 27 */
+/* 26 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -42231,7 +42212,7 @@ var PDFImage = function PDFImageClosure() {
 exports.PDFImage = PDFImage;
 
 /***/ }),
-/* 28 */
+/* 27 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -43432,7 +43413,7 @@ var Jbig2Image = function Jbig2ImageClosure() {
 exports.Jbig2Image = Jbig2Image;
 
 /***/ }),
-/* 29 */
+/* 28 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -44349,7 +44330,7 @@ var JpegImage = function JpegImageClosure() {
 exports.JpegImage = JpegImage;
 
 /***/ }),
-/* 30 */
+/* 29 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -47297,7 +47278,7 @@ var getMetrics = getLookupTableFactory(function (t) {
 exports.getMetrics = getMetrics;
 
 /***/ }),
-/* 31 */
+/* 30 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -47418,7 +47399,7 @@ var MurmurHash3_64 = function MurmurHash3_64Closure(seed) {
 exports.MurmurHash3_64 = MurmurHash3_64;
 
 /***/ }),
-/* 32 */
+/* 31 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -48257,7 +48238,7 @@ exports.Pattern = Pattern;
 exports.getTilingPatternIR = getTilingPatternIR;
 
 /***/ }),
-/* 33 */
+/* 32 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -48265,7 +48246,7 @@ exports.getTilingPatternIR = getTilingPatternIR;
 var sharedUtil = __w_pdfjs_require__(0);
 var coreStream = __w_pdfjs_require__(2);
 var coreChunkedStream = __w_pdfjs_require__(10);
-var coreDocument = __w_pdfjs_require__(24);
+var coreDocument = __w_pdfjs_require__(23);
 var warn = sharedUtil.warn;
 var createValidAbsoluteUrl = sharedUtil.createValidAbsoluteUrl;
 var shadow = sharedUtil.shadow;
@@ -48443,7 +48424,7 @@ exports.LocalPdfManager = LocalPdfManager;
 exports.NetworkPdfManager = NetworkPdfManager;
 
 /***/ }),
-/* 34 */
+/* 33 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -48642,7 +48623,7 @@ exports.PostScriptLexer = PostScriptLexer;
 exports.PostScriptParser = PostScriptParser;
 
 /***/ }),
-/* 35 */
+/* 34 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
@@ -49188,13 +49169,13 @@ var Type1Parser = function Type1ParserClosure() {
 exports.Type1Parser = Type1Parser;
 
 /***/ }),
-/* 36 */
+/* 35 */
 /***/ (function(module, exports, __w_pdfjs_require__) {
 
 "use strict";
 
-var pdfjsVersion = '1.7.290';
-var pdfjsBuild = 'b509a3f8';
+var pdfjsVersion = '1.7.297';
+var pdfjsBuild = '425ad309';
 var pdfjsCoreWorker = __w_pdfjs_require__(17);
 ;
 exports.WorkerMessageHandler = pdfjsCoreWorker.WorkerMessageHandler;
diff --git a/build/build-clang/clang-tidy-linux64.json b/build/build-clang/clang-tidy-linux64.json
index c341bb383dd0..4fe7d131b929 100644
--- a/build/build-clang/clang-tidy-linux64.json
+++ b/build/build-clang/clang-tidy-linux64.json
@@ -1,5 +1,5 @@
 {
-    "llvm_revision": "292415",
+    "llvm_revision": "295482",
     "stages": "1",
     "build_libcxx": true,
     "build_type": "Release",
diff --git a/build/build-clang/clang-tidy-macosx64.json b/build/build-clang/clang-tidy-macosx64.json
index aaba8800eb4c..2f7751be1aea 100644
--- a/build/build-clang/clang-tidy-macosx64.json
+++ b/build/build-clang/clang-tidy-macosx64.json
@@ -1,5 +1,5 @@
 {
-    "llvm_revision": "292415",
+    "llvm_revision": "295482",
     "stages": "1",
     "build_libcxx": true,
     "build_type": "Release",
diff --git a/build/build-clang/clang-tidy-win32.json b/build/build-clang/clang-tidy-win32.json
index ff59d00c9625..98983615fec6 100644
--- a/build/build-clang/clang-tidy-win32.json
+++ b/build/build-clang/clang-tidy-win32.json
@@ -1,5 +1,5 @@
 {
-    "llvm_revision": "292415",
+    "llvm_revision": "295482",
     "stages": "1",
     "build_libcxx": false,
     "build_type": "Release",
diff --git a/build/build-clang/clang-tidy-win64.json b/build/build-clang/clang-tidy-win64.json
index 65cce402f00b..eaab56d972f9 100644
--- a/build/build-clang/clang-tidy-win64.json
+++ b/build/build-clang/clang-tidy-win64.json
@@ -1,5 +1,5 @@
 {
-    "llvm_revision": "292415",
+    "llvm_revision": "295482",
     "stages": "1",
     "build_libcxx": false,
     "build_type": "Release",
diff --git a/devtools/client/commandline/test/browser_cmd_highlight_04.js b/devtools/client/commandline/test/browser_cmd_highlight_04.js
index 783ae78aef59..1ae49db15619 100644
--- a/devtools/client/commandline/test/browser_cmd_highlight_04.js
+++ b/devtools/client/commandline/test/browser_cmd_highlight_04.js
@@ -7,7 +7,7 @@
 
 // Tests the various highlight command parameters and options
 
-requestLongerTimeout(3);
+requestLongerTimeout(4);
 
 // Creating a test page with many elements to test the --showall option
 var TEST_PAGE = "data:text/html;charset=utf-8,<body><ul>";
diff --git a/devtools/client/inspector/inspector.js b/devtools/client/inspector/inspector.js
index 182006a9b190..3022b0d8f417 100644
--- a/devtools/client/inspector/inspector.js
+++ b/devtools/client/inspector/inspector.js
@@ -1094,50 +1094,9 @@ Inspector.prototype = {
       type: "separator",
     }));
 
-    let copySubmenu = new Menu();
-    copySubmenu.append(new MenuItem({
-      id: "node-menu-copyinner",
-      label: INSPECTOR_L10N.getStr("inspectorCopyInnerHTML.label"),
-      accesskey: INSPECTOR_L10N.getStr("inspectorCopyInnerHTML.accesskey"),
-      disabled: !isSelectionElement,
-      click: () => this.copyInnerHTML(),
-    }));
-    copySubmenu.append(new MenuItem({
-      id: "node-menu-copyouter",
-      label: INSPECTOR_L10N.getStr("inspectorCopyOuterHTML.label"),
-      accesskey: INSPECTOR_L10N.getStr("inspectorCopyOuterHTML.accesskey"),
-      disabled: !isSelectionElement,
-      click: () => this.copyOuterHTML(),
-    }));
-    copySubmenu.append(new MenuItem({
-      id: "node-menu-copyuniqueselector",
-      label: INSPECTOR_L10N.getStr("inspectorCopyCSSSelector.label"),
-      accesskey:
-        INSPECTOR_L10N.getStr("inspectorCopyCSSSelector.accesskey"),
-      disabled: !isSelectionElement,
-      hidden: !this.canGetUniqueSelector,
-      click: () => this.copyUniqueSelector(),
-    }));
-    copySubmenu.append(new MenuItem({
-      id: "node-menu-copycsspath",
-      label: INSPECTOR_L10N.getStr("inspectorCopyCSSPath.label"),
-      accesskey:
-        INSPECTOR_L10N.getStr("inspectorCopyCSSPath.accesskey"),
-      disabled: !isSelectionElement,
-      hidden: !this.canGetCssPath,
-      click: () => this.copyCssPath(),
-    }));
-    copySubmenu.append(new MenuItem({
-      id: "node-menu-copyimagedatauri",
-      label: INSPECTOR_L10N.getStr("inspectorImageDataUri.label"),
-      disabled: !isSelectionElement || !markupContainer ||
-                !markupContainer.isPreviewable(),
-      click: () => this.copyImageDataUri(),
-    }));
-
     menu.append(new MenuItem({
       label: INSPECTOR_L10N.getStr("inspectorCopyHTMLSubmenu.label"),
-      submenu: copySubmenu,
+      submenu: this._getCopySubmenu(markupContainer, isSelectionElement),
     }));
 
     menu.append(new MenuItem({
@@ -1210,6 +1169,51 @@ Inspector.prototype = {
     return menu;
   },
 
+  _getCopySubmenu: function (markupContainer, isSelectionElement) {
+    let copySubmenu = new Menu();
+    copySubmenu.append(new MenuItem({
+      id: "node-menu-copyinner",
+      label: INSPECTOR_L10N.getStr("inspectorCopyInnerHTML.label"),
+      accesskey: INSPECTOR_L10N.getStr("inspectorCopyInnerHTML.accesskey"),
+      disabled: !isSelectionElement,
+      click: () => this.copyInnerHTML(),
+    }));
+    copySubmenu.append(new MenuItem({
+      id: "node-menu-copyouter",
+      label: INSPECTOR_L10N.getStr("inspectorCopyOuterHTML.label"),
+      accesskey: INSPECTOR_L10N.getStr("inspectorCopyOuterHTML.accesskey"),
+      disabled: !isSelectionElement,
+      click: () => this.copyOuterHTML(),
+    }));
+    copySubmenu.append(new MenuItem({
+      id: "node-menu-copyuniqueselector",
+      label: INSPECTOR_L10N.getStr("inspectorCopyCSSSelector.label"),
+      accesskey:
+        INSPECTOR_L10N.getStr("inspectorCopyCSSSelector.accesskey"),
+      disabled: !isSelectionElement,
+      hidden: !this.canGetUniqueSelector,
+      click: () => this.copyUniqueSelector(),
+    }));
+    copySubmenu.append(new MenuItem({
+      id: "node-menu-copycsspath",
+      label: INSPECTOR_L10N.getStr("inspectorCopyCSSPath.label"),
+      accesskey:
+        INSPECTOR_L10N.getStr("inspectorCopyCSSPath.accesskey"),
+      disabled: !isSelectionElement,
+      hidden: !this.canGetCssPath,
+      click: () => this.copyCssPath(),
+    }));
+    copySubmenu.append(new MenuItem({
+      id: "node-menu-copyimagedatauri",
+      label: INSPECTOR_L10N.getStr("inspectorImageDataUri.label"),
+      disabled: !isSelectionElement || !markupContainer ||
+                !markupContainer.isPreviewable(),
+      click: () => this.copyImageDataUri(),
+    }));
+
+    return copySubmenu;
+  },
+
   _getPasteSubmenu: function (isEditableElement) {
     let isPasteable = isEditableElement && this._getClipboardContentForPaste();
     let disableAdjacentPaste = !isPasteable ||
@@ -1283,6 +1287,14 @@ Inspector.prototype = {
       disabled: !isEditableElement,
       click: () => this.onAddAttribute(),
     }));
+    attributesSubmenu.append(new MenuItem({
+      id: "node-menu-copy-attribute",
+      label: INSPECTOR_L10N.getFormatStr("inspectorCopyAttributeValue.label",
+                                        isAttributeClicked ? `"${nodeInfo.value}"` : ""),
+      accesskey: INSPECTOR_L10N.getStr("inspectorCopyAttributeValue.accesskey"),
+      disabled: !isAttributeClicked,
+      click: () => this.onCopyAttributeValue(),
+    }));
     attributesSubmenu.append(new MenuItem({
       id: "node-menu-edit-attribute",
       label: INSPECTOR_L10N.getFormatStr("inspectorEditAttribute.label",
@@ -1291,13 +1303,11 @@ Inspector.prototype = {
       disabled: !isAttributeClicked,
       click: () => this.onEditAttribute(),
     }));
-
     attributesSubmenu.append(new MenuItem({
       id: "node-menu-remove-attribute",
       label: INSPECTOR_L10N.getFormatStr("inspectorRemoveAttribute.label",
                                         isAttributeClicked ? `"${nodeInfo.name}"` : ""),
-      accesskey:
-        INSPECTOR_L10N.getStr("inspectorRemoveAttribute.accesskey"),
+      accesskey: INSPECTOR_L10N.getStr("inspectorRemoveAttribute.accesskey"),
       disabled: !isAttributeClicked,
       click: () => this.onRemoveAttribute(),
     }));
@@ -1817,6 +1827,14 @@ Inspector.prototype = {
     container.addAttribute();
   },
 
+  /**
+   * Copy attribute value for node.
+   * Used for node context menu and shouldn't be called directly.
+   */
+  onCopyAttributeValue: function () {
+    clipboardHelper.copyString(this.nodeMenuTriggerInfo.value);
+  },
+
   /**
    * Edit attribute for node.
    * Used for node context menu and shouldn't be called directly.
diff --git a/devtools/client/inspector/rules/test/browser.ini b/devtools/client/inspector/rules/test/browser.ini
index fc9bfc735bee..535e0d2f0807 100644
--- a/devtools/client/inspector/rules/test/browser.ini
+++ b/devtools/client/inspector/rules/test/browser.ini
@@ -215,6 +215,7 @@ skip-if = (os == 'linux' && bits == 32 && debug) # bug 1328915, disable linux32
 [browser_rules_selector-highlighter_04.js]
 [browser_rules_selector-highlighter_05.js]
 [browser_rules_selector_highlight.js]
+[browser_rules_shorthand-overridden-lists.js]
 [browser_rules_strict-search-filter-computed-list_01.js]
 [browser_rules_strict-search-filter_01.js]
 [browser_rules_strict-search-filter_02.js]
diff --git a/devtools/client/inspector/rules/test/browser_rules_shorthand-overridden-lists.js b/devtools/client/inspector/rules/test/browser_rules_shorthand-overridden-lists.js
new file mode 100644
index 000000000000..354e8ad07ba8
--- /dev/null
+++ b/devtools/client/inspector/rules/test/browser_rules_shorthand-overridden-lists.js
@@ -0,0 +1,70 @@
+/* vim: set ft=javascript ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+// Tests that the rule view shorthand overridden list works correctly,
+// can be shown and hidden correctly, and contain the right subproperties.
+
+var TEST_URI = `
+  <style type="text/css">
+    div {
+      margin: 0px 1px 2px 3px;
+      top: 0px;
+    }
+    #testid {
+        margin-left: 10px;
+        margin-right: 10px;
+    }
+  </style>
+  <div id="testid">Styled Node</div>
+`;
+
+add_task(function* () {
+  yield addTab("data:text/html;charset=utf-8," + encodeURIComponent(TEST_URI));
+  let {inspector, view} = yield openRuleView();
+  yield selectNode("#testid", inspector);
+  yield testComputedList(inspector, view);
+});
+
+function* testComputedList(inspector, view) {
+  let rule = getRuleViewRuleEditor(view, 2).rule;
+  let propEditor = rule.textProps[0].editor;
+  let expander = propEditor.expander;
+  let overriddenItems = propEditor.shorthandOverridden.children;
+  let propNames = [
+    "margin-right",
+    "margin-left"
+  ];
+
+  ok(!expander.hasAttribute("open"), "margin computed list is closed.");
+  ok(!propEditor.shorthandOverridden.hasAttribute("hidden"),
+      "The shorthandOverridden list should be open.");
+
+  is(overriddenItems.length, propNames.length,
+      "There should be 2 overridden shorthand value.");
+  for (let i = 0; i < propNames.length; i++) {
+    let overriddenItem = overriddenItems[i].querySelector(".ruleview-propertyname");
+    is(overriddenItem.textContent, propNames[i],
+        "The overridden item #" + i + " should be " + propNames[i]);
+  }
+
+  info("Opening the computed list of margin property.");
+  expander.click();
+  ok(expander.hasAttribute("open"), "margin computed list is open.");
+  ok(propEditor.shorthandOverridden.hasAttribute("hidden"),
+      "The shorthandOverridden list should be hidden.");
+
+  info("Closing the computed list of margin property.");
+  expander.click();
+  ok(!expander.hasAttribute("open"), "margin computed list is closed.");
+  ok(!propEditor.shorthandOverridden.hasAttribute("hidden"),
+      "The shorthandOverridden list should be open.");
+
+  for (let i = 0; i < propNames.length; i++) {
+    let overriddenItem = overriddenItems[i].querySelector(".ruleview-propertyname");
+    is(overriddenItem.textContent, propNames[i],
+        "The overridden item #" + i + " should still be " + propNames[i]);
+  }
+}
diff --git a/devtools/client/inspector/rules/views/text-property-editor.js b/devtools/client/inspector/rules/views/text-property-editor.js
index 99bbfc0bb513..90158d7260d1 100644
--- a/devtools/client/inspector/rules/views/text-property-editor.js
+++ b/devtools/client/inspector/rules/views/text-property-editor.js
@@ -197,6 +197,12 @@ TextPropertyEditor.prototype = {
       class: "ruleview-computedlist",
     });
 
+    // Holds the viewers for the overridden shorthand properties.
+    // will be populated in |_updateShorthandOverridden|.
+    this.shorthandOverridden = createChild(this.element, "ul", {
+      class: "ruleview-overridden-items",
+    });
+
     // Only bind event handlers if the rule is editable.
     if (this.ruleEditor.isEditable) {
       this.enable.addEventListener("click", this._onEnableClicked, true);
@@ -454,8 +460,9 @@ TextPropertyEditor.prototype = {
       elToClick.click();
     }
 
-    // Populate the computed styles.
+    // Populate the computed styles and shorthand overridden styles.
     this._updateComputed();
+    this._updateShorthandOverridden();
 
     // Update the rule property highlight.
     this.ruleView._updatePropertyHighlight(this);
@@ -469,7 +476,7 @@ TextPropertyEditor.prototype = {
 
   /**
    * Update the visibility of the enable checkbox, the warning indicator and
-   * the filter property, as well as the overriden state of the property.
+   * the filter property, as well as the overridden state of the property.
    */
   updatePropertyState: function () {
     if (this.prop.enabled) {
@@ -527,45 +534,86 @@ TextPropertyEditor.prototype = {
         continue;
       }
 
-      let li = createChild(this.computed, "li", {
-        class: "ruleview-computed"
-      });
-
-      if (computed.overridden) {
-        li.classList.add("ruleview-overridden");
-      }
-
-      createChild(li, "span", {
-        class: "ruleview-propertyname theme-fg-color5",
-        textContent: computed.name
-      });
-      appendText(li, ": ");
-
-      let outputParser = this.ruleView._outputParser;
-      let frag = outputParser.parseCssProperty(
-        computed.name, computed.value, {
-          colorSwatchClass: "ruleview-swatch ruleview-colorswatch",
-          urlClass: "theme-link",
-          baseURI: this.sheetHref
-        }
-      );
-
-      // Store the computed property value that was parsed for output
-      computed.parsedValue = frag.textContent;
-
-      createChild(li, "span", {
-        class: "ruleview-propertyvalue theme-fg-color1",
-        child: frag
-      });
-
-      appendText(li, ";");
-
       // Store the computed style element for easy access when highlighting
       // styles
-      computed.element = li;
+      computed.element = this._createComputedListItem(this.computed, computed,
+        "ruleview-computed");
     }
   },
 
+  /**
+   * Update the indicator for overridden shorthand styles. The shorthand
+   * overridden styles themselves are populated on demand, when they
+   * become visible.
+   */
+  _updateShorthandOverridden: function () {
+    this.shorthandOverridden.innerHTML = "";
+
+    this._populatedShorthandOverridden = false;
+    this._populateShorthandOverridden();
+  },
+
+  /**
+   * Populate the list of overridden shorthand styles.
+   */
+  _populateShorthandOverridden: function () {
+    if (this._populatedShorthandOverridden || this.prop.overridden) {
+      return;
+    }
+    this._populatedShorthandOverridden = true;
+
+    for (let computed of this.prop.computed) {
+      // Don't display duplicate information or show properties
+      // that are completely overridden.
+      if (computed.name === this.prop.name || !computed.overridden) {
+        continue;
+      }
+
+      this._createComputedListItem(this.shorthandOverridden, computed,
+        "ruleview-overridden-item");
+    }
+  },
+
+  /**
+   * Creates and populates a list item with the computed CSS property.
+   */
+  _createComputedListItem: function (parentEl, computed, className) {
+    let li = createChild(parentEl, "li", {
+      class: className
+    });
+
+    if (computed.overridden) {
+      li.classList.add("ruleview-overridden");
+    }
+
+    createChild(li, "span", {
+      class: "ruleview-propertyname theme-fg-color5",
+      textContent: computed.name
+    });
+    appendText(li, ": ");
+
+    let outputParser = this.ruleView._outputParser;
+    let frag = outputParser.parseCssProperty(
+      computed.name, computed.value, {
+        colorSwatchClass: "ruleview-swatch ruleview-colorswatch",
+        urlClass: "theme-link",
+        baseURI: this.sheetHref
+      }
+    );
+
+    // Store the computed property value that was parsed for output
+    computed.parsedValue = frag.textContent;
+
+    createChild(li, "span", {
+      class: "ruleview-propertyvalue theme-fg-color1",
+      child: frag
+    });
+
+    appendText(li, ";");
+
+    return li;
+  },
+
   /**
    * Handles clicks on the disabled property.
    */
@@ -593,9 +641,12 @@ TextPropertyEditor.prototype = {
       this.expander.removeAttribute("open");
       this.computed.removeAttribute("filter-open");
       this.computed.removeAttribute("user-open");
+      this.shorthandOverridden.removeAttribute("hidden");
+      this._populateShorthandOverridden();
     } else {
       this.expander.setAttribute("open", "true");
       this.computed.setAttribute("user-open", "");
+      this.shorthandOverridden.setAttribute("hidden", "true");
       this._populateComputed();
     }
 
diff --git a/devtools/client/inspector/test/browser_inspector_menu-01-sensitivity.js b/devtools/client/inspector/test/browser_inspector_menu-01-sensitivity.js
index 052e9da68c94..6d4831f20fba 100644
--- a/devtools/client/inspector/test/browser_inspector_menu-01-sensitivity.js
+++ b/devtools/client/inspector/test/browser_inspector_menu-01-sensitivity.js
@@ -35,6 +35,7 @@ const ALL_MENU_ITEMS = [
   "node-menu-scrollnodeintoview",
   "node-menu-screenshotnode",
   "node-menu-add-attribute",
+  "node-menu-copy-attribute",
   "node-menu-edit-attribute",
   "node-menu-remove-attribute"
 ].concat(PASTE_MENU_ITEMS, ACTIVE_ON_DOCTYPE_ITEMS);
@@ -70,6 +71,7 @@ const TEST_CASES = [
     clipboardDataType: "html",
     disabled: [
       "node-menu-copyimagedatauri",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ],
@@ -86,6 +88,7 @@ const TEST_CASES = [
       "node-menu-pasteafter",
       "node-menu-pastefirstchild",
       "node-menu-pastelastchild",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ],
@@ -99,6 +102,7 @@ const TEST_CASES = [
       "node-menu-copyimagedatauri",
       "node-menu-pastebefore",
       "node-menu-pasteafter",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ]
@@ -109,6 +113,7 @@ const TEST_CASES = [
     clipboardDataType: "html",
     selector: "img",
     disabled: [
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ]
@@ -123,6 +128,7 @@ const TEST_CASES = [
       "node-menu-pastebefore",
       "node-menu-pasteafter",
       "node-menu-screenshotnode",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ],
@@ -133,6 +139,7 @@ const TEST_CASES = [
     disabled: PASTE_MENU_ITEMS.concat([
       "node-menu-copyimagedatauri",
       "node-menu-screenshotnode",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ]),
@@ -144,6 +151,7 @@ const TEST_CASES = [
     selector: "#paste-area",
     disabled: [
       "node-menu-copyimagedatauri",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ]
@@ -157,6 +165,7 @@ const TEST_CASES = [
     selector: "#paste-area",
     disabled: PASTE_MENU_ITEMS.concat([
       "node-menu-copyimagedatauri",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ]),
@@ -168,6 +177,7 @@ const TEST_CASES = [
     selector: "#paste-area",
     disabled: PASTE_MENU_ITEMS.concat([
       "node-menu-copyimagedatauri",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ]),
@@ -179,6 +189,7 @@ const TEST_CASES = [
     selector: "#paste-area",
     disabled: PASTE_MENU_ITEMS.concat([
       "node-menu-copyimagedatauri",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ]),
@@ -189,6 +200,7 @@ const TEST_CASES = [
     disabled: PASTE_MENU_ITEMS.concat([
       "node-menu-copyimagedatauri",
       "node-menu-screenshotnode",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ]),
@@ -199,6 +211,7 @@ const TEST_CASES = [
     disabled: PASTE_MENU_ITEMS.concat([
       "node-menu-copyimagedatauri",
       "node-menu-screenshotnode",
+      "node-menu-copy-attribute",
       "node-menu-edit-attribute",
       "node-menu-remove-attribute"
     ]),
diff --git a/devtools/client/inspector/test/browser_inspector_menu-05-attribute-items.js b/devtools/client/inspector/test/browser_inspector_menu-05-attribute-items.js
index df901f0a495a..cecf9a010345 100644
--- a/devtools/client/inspector/test/browser_inspector_menu-05-attribute-items.js
+++ b/devtools/client/inspector/test/browser_inspector_menu-05-attribute-items.js
@@ -12,6 +12,7 @@ add_task(function* () {
   yield selectNode("#attributes", inspector);
 
   yield testAddAttribute();
+  yield testCopyAttributeValue();
   yield testEditAttribute();
   yield testRemoveAttribute();
 
@@ -29,6 +30,20 @@ add_task(function* () {
     ok(hasAttribute, "attribute was successfully added");
   }
 
+  function* testCopyAttributeValue() {
+    info("Testing 'Copy Attribute Value' and waiting for clipboard promise to resolve");
+    let copyAttributeValue = getMenuItem("node-menu-copy-attribute");
+
+    info("Triggering 'Copy Attribute Value' and waiting for clipboard to copy the value");
+    inspector.nodeMenuTriggerInfo = {
+      type: "attribute",
+      name: "data-edit",
+      value: "the"
+    };
+
+    yield waitForClipboardPromise(() => copyAttributeValue.click(), "the");
+  }
+
   function* testEditAttribute() {
     info("Testing 'Edit Attribute' menu item");
     let editAttribute = getMenuItem("node-menu-edit-attribute");
diff --git a/devtools/client/inspector/test/doc_inspector_menu.html b/devtools/client/inspector/test/doc_inspector_menu.html
index 862a345794e4..78985e8bb034 100644
--- a/devtools/client/inspector/test/doc_inspector_menu.html
+++ b/devtools/client/inspector/test/doc_inspector_menu.html
@@ -23,7 +23,7 @@
       </div>
       <p id="console-var">Paragraph for testing console variables</p>
       <p id="console-var-multi">Paragraph for testing multiple console variables</p>
-      <p id="attributes" data-edit="original" data-remove="thing">Attributes are going to be changed here</p>
+      <p id="attributes" data-copy="the" data-edit="original" data-remove="thing">Attributes are going to be changed here</p>
     </div>
   </body>
 </html>
diff --git a/devtools/client/locales/en-US/inspector.properties b/devtools/client/locales/en-US/inspector.properties
index 3298d820afec..29c7c9ddced6 100644
--- a/devtools/client/locales/en-US/inspector.properties
+++ b/devtools/client/locales/en-US/inspector.properties
@@ -117,6 +117,13 @@ inspectorEditAttribute.accesskey=E
 inspectorRemoveAttribute.label=Remove Attribute %S
 inspectorRemoveAttribute.accesskey=R
 
+# LOCALIZATION NOTE (inspectorCopyAttributeValue.label): This is the label of a
+# sub-menu "Attribute" in the inspector contextual-menu that appears
+# when the user right-clicks on the attribute of a node in the inspector,
+# and that allows to copy the attribute value to clipboard.
+inspectorCopyAttributeValue.label=Copy Attribute Value %S
+inspectorCopyAttributeValue.accesskey=V
+
 # LOCALIZATION NOTE (inspector.nodePreview.selectNodeLabel):
 # This string is displayed in a tooltip that is shown when hovering over a DOM
 # node preview (e.g. something like "div#foo.bar").
diff --git a/devtools/client/themes/rules.css b/devtools/client/themes/rules.css
index 824d38342462..0de1249fd200 100644
--- a/devtools/client/themes/rules.css
+++ b/devtools/client/themes/rules.css
@@ -123,13 +123,15 @@
 }
 
 .ruleview-computedlist,
+.ruleview-overridden-items[hidden],
 .ruleview-overridden-rule-filter[hidden],
 .ruleview-warning[hidden] {
   display: none;
 }
 
 .ruleview-computedlist[user-open],
-.ruleview-computedlist[filter-open] {
+.ruleview-computedlist[filter-open],
+.ruleview-overridden-items {
   display: block;
 }
 
@@ -362,6 +364,42 @@
   margin-inline-start: 35px;
 }
 
+.ruleview-overridden-items {
+  margin: 0px 0px 0px 5px;
+  list-style: none;
+  line-height: 1.5em;
+}
+
+.ruleview-overridden-item {
+  position: relative;
+}
+
+.ruleview-overridden-item::before {
+  position: absolute;
+  left: -15px;
+  top: 0px;
+  content: '';
+  display: block;
+  border-left: 1px solid var(--theme-highlight-gray);
+  height: 0.7em;
+  border-bottom: 1px solid var(--theme-highlight-gray);
+  width: 10px;
+}
+
+.ruleview-overridden-item::after {
+  position: absolute;
+  left: -15px;
+  bottom: -7px;
+  content: '';
+  display: block;
+  border-left: 1px solid var(--theme-highlight-gray);
+  height: 100%;
+}
+
+.ruleview-overridden-item:last-child:after {
+  display: none;
+}
+
 .ruleview-grid,
 .ruleview-swatch {
   cursor: pointer;
diff --git a/dom/base/nsContentAreaDragDrop.cpp b/dom/base/nsContentAreaDragDrop.cpp
index e710d372dc36..3d0b756ac373 100644
--- a/dom/base/nsContentAreaDragDrop.cpp
+++ b/dom/base/nsContentAreaDragDrop.cpp
@@ -353,7 +353,7 @@ DragDataProducer::GetNodeString(nsIContent* inNode,
 
   // use a range to get the text-equivalent of the node
   nsCOMPtr<nsIDocument> doc = node->OwnerDoc();
-  mozilla::ErrorResult rv;
+  mozilla::IgnoredErrorResult rv;
   RefPtr<nsRange> range = doc->CreateRange(rv);
   if (range) {
     range->SelectNode(*node, rv);
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 5b476ee79296..8f330b975ee5 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -7967,13 +7967,8 @@ nsDocument::FlushPendingNotifications(FlushType aType)
     mParentDocument->FlushPendingNotifications(parentType);
   }
 
-  // Call nsIPresShell::NeedFlush (inline, non-virtual) to check whether we
-  // really need to flush the shell (virtual, and needs a strong reference).
   if (nsIPresShell* shell = GetShell()) {
-    if (shell->NeedFlush(aType)) {
-      nsCOMPtr<nsIPresShell> presShell = shell;
-      presShell->FlushPendingNotifications(aType);
-    }
+    shell->FlushPendingNotifications(aType);
   }
 }
 
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 4341588e3539..266901b0c727 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -2179,7 +2179,6 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsGlobalWindow)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDoc)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mIdleService)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mWakeLock)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPendingStorageEvents)
 
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mIdleRequestExecutor)
   for (IdleRequest* request : tmp->mIdleRequestCallbacks) {
@@ -2260,7 +2259,6 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsGlobalWindow)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mDoc)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mIdleService)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mWakeLock)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mPendingStorageEvents)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mIdleObservers)
 
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mGamepads)
@@ -3240,7 +3238,11 @@ nsGlobalWindow::PreloadLocalStorage()
   // private browsing windows do not persist local storage to disk so we should
   // only try to precache storage when we're not a private browsing window.
   if (principal->GetPrivateBrowsingId() == 0) {
-    storageManager->PrecacheStorage(principal);
+    nsCOMPtr<nsIDOMStorage> storage;
+    rv = storageManager->PrecacheStorage(principal, getter_AddRefs(storage));
+    if (NS_SUCCEEDED(rv)) {
+      mLocalStorage = static_cast<Storage*>(storage.get());
+    }
   }
 }
 
@@ -11906,49 +11908,66 @@ nsGlobalWindow::Observe(nsISupports* aSubject, const char* aTopic,
     return NS_OK;
   }
 
-  bool isPrivateBrowsing = IsPrivateBrowsing();
-  if ((!nsCRT::strcmp(aTopic, "dom-storage2-changed") && !isPrivateBrowsing) ||
-      (!nsCRT::strcmp(aTopic, "dom-private-storage2-changed") && isPrivateBrowsing)) {
-    if (!IsInnerWindow() || !AsInner()->IsCurrentInnerWindow()) {
+  // We need these for our private-browsing check below; so save them off.
+  // (And we can't do the private-browsing enforcement check as part of our
+  // outer conditional because otherwise we'll trigger an NS_WARNING if control
+  // flow reaches the bottom of this method.)
+  bool isNonPrivateLocalStorageChange =
+    !nsCRT::strcmp(aTopic, "dom-storage2-changed");
+  bool isPrivateLocalStorageChange =
+    !nsCRT::strcmp(aTopic, "dom-private-storage2-changed");
+  if (isNonPrivateLocalStorageChange || isPrivateLocalStorageChange) {
+    // Enforce that the source storage area's private browsing state matches
+    // this window's state.  These flag checks and their maintenance independent
+    // from the principal's OriginAttributes matter because chrome docshells
+    // that are part of private browsing windows can be private browsing without
+    // having their OriginAttributes set (because they have the system
+    // principal).
+    bool isPrivateBrowsing = IsPrivateBrowsing();
+    if ((isNonPrivateLocalStorageChange && isPrivateBrowsing) ||
+        (isPrivateLocalStorageChange && !isPrivateBrowsing)) {
       return NS_OK;
     }
 
-    nsIPrincipal *principal;
-    nsresult rv;
+    // We require that aData be either u"SessionStorage" or u"localStorage".
+    // Assert under debug, but ignore the bogus event under non-debug.
+    MOZ_ASSERT(aData);
+    if (!aData) {
+      return NS_ERROR_INVALID_ARG;
+    }
+
+    // LocalStorage can only exist on an inner window, and we don't want to
+    // generate events on frozen or otherwise-navigated-away from windows.
+    // (Actually, this code used to try and buffer events for frozen windows,
+    // but it never worked, so we've removed it.  See bug 1285898.)
+    if (!IsInnerWindow() || !AsInner()->IsCurrentInnerWindow() || IsFrozen()) {
+      return NS_OK;
+    }
+
+    nsIPrincipal *principal = GetPrincipal();
+    if (!principal) {
+      return NS_OK;
+    }
 
     RefPtr<StorageEvent> event = static_cast<StorageEvent*>(aSubject);
     if (!event) {
       return NS_ERROR_FAILURE;
     }
 
-    RefPtr<Storage> changingStorage = event->GetStorageArea();
-    if (!changingStorage) {
-      return NS_ERROR_FAILURE;
-    }
-
-    nsCOMPtr<nsIDOMStorage> istorage = changingStorage.get();
-
     bool fireMozStorageChanged = false;
     nsAutoString eventType;
     eventType.AssignLiteral("storage");
-    principal = GetPrincipal();
-    if (!principal) {
-      return NS_OK;
-    }
 
-    if (changingStorage->IsPrivate() != IsPrivateBrowsing()) {
-      return NS_OK;
-    }
+    if (!NS_strcmp(aData, u"sessionStorage")) {
+      nsCOMPtr<nsIDOMStorage> changingStorage = event->GetStorageArea();
+      MOZ_ASSERT(changingStorage);
 
-    switch (changingStorage->GetType())
-    {
-    case Storage::SessionStorage:
-    {
       bool check = false;
 
       nsCOMPtr<nsIDOMStorageManager> storageManager = do_QueryInterface(GetDocShell());
       if (storageManager) {
-        rv = storageManager->CheckStorage(principal, istorage, &check);
+        nsresult rv = storageManager->CheckStorage(principal, changingStorage,
+                                                   &check);
         if (NS_FAILED(rv)) {
           return rv;
         }
@@ -11969,58 +11988,48 @@ nsGlobalWindow::Observe(nsISupports* aSubject, const char* aTopic,
       if (fireMozStorageChanged) {
         eventType.AssignLiteral("MozSessionStorageChanged");
       }
-      break;
     }
 
-    case Storage::LocalStorage:
-    {
-      // Allow event fire only for the same principal storages
-      // XXX We have to use EqualsIgnoreDomain after bug 495337 lands
-      nsIPrincipal* storagePrincipal = changingStorage->GetPrincipal();
+    else {
+      MOZ_ASSERT(!NS_strcmp(aData, u"localStorage"));
+      nsIPrincipal* storagePrincipal = event->GetPrincipal();
+      if (!storagePrincipal) {
+        return NS_OK;
+      }
 
       bool equals = false;
-      rv = storagePrincipal->Equals(principal, &equals);
+      nsresult rv = storagePrincipal->Equals(principal, &equals);
       NS_ENSURE_SUCCESS(rv, rv);
 
-      if (!equals)
+      if (!equals) {
         return NS_OK;
+      }
+
+      fireMozStorageChanged = mLocalStorage == event->GetStorageArea();
 
-      fireMozStorageChanged = mLocalStorage == changingStorage;
       if (fireMozStorageChanged) {
         eventType.AssignLiteral("MozLocalStorageChanged");
       }
-      break;
-    }
-    default:
-      return NS_OK;
     }
 
     // Clone the storage event included in the observer notification. We want
     // to dispatch clones rather than the original event.
     ErrorResult error;
-    RefPtr<StorageEvent> newEvent = CloneStorageEvent(eventType, event, error);
+    RefPtr<StorageEvent> clonedEvent =
+      CloneStorageEvent(eventType, event, error);
     if (error.Failed()) {
       return error.StealNSResult();
     }
 
-    newEvent->SetTrusted(true);
+    clonedEvent->SetTrusted(true);
 
     if (fireMozStorageChanged) {
-      WidgetEvent* internalEvent = newEvent->WidgetEventPtr();
+      WidgetEvent* internalEvent = clonedEvent->WidgetEventPtr();
       internalEvent->mFlags.mOnlyChromeDispatch = true;
     }
 
-    if (IsFrozen()) {
-      // This window is frozen, rather than firing the events here,
-      // store the domain in which the change happened and fire the
-      // events if we're ever thawed.
-
-      mPendingStorageEvents.AppendElement(newEvent);
-      return NS_OK;
-    }
-
     bool defaultActionEnabled;
-    DispatchEvent(newEvent, &defaultActionEnabled);
+    DispatchEvent(clonedEvent, &defaultActionEnabled);
 
     return NS_OK;
   }
@@ -12111,10 +12120,19 @@ nsGlobalWindow::CloneStorageEvent(const nsAString& aType,
   aEvent->GetUrl(dict.mUrl);
 
   RefPtr<Storage> storageArea = aEvent->GetStorageArea();
-  MOZ_ASSERT(storageArea);
 
   RefPtr<Storage> storage;
-  if (storageArea->GetType() == Storage::LocalStorage) {
+
+  // If null, this is a localStorage event received by IPC.
+  if (!storageArea) {
+    storage = GetLocalStorage(aRv);
+    if (aRv.Failed() || !storage) {
+      return nullptr;
+    }
+
+    // We must apply the current change to the 'local' localStorage.
+    storage->ApplyEvent(aEvent);
+  } else if (storageArea->GetType() == Storage::LocalStorage) {
     storage = GetLocalStorage(aRv);
   } else {
     MOZ_ASSERT(storageArea->GetType() == Storage::SessionStorage);
@@ -12126,7 +12144,7 @@ nsGlobalWindow::CloneStorageEvent(const nsAString& aType,
   }
 
   MOZ_ASSERT(storage);
-  MOZ_ASSERT(storage->IsForkOf(storageArea));
+  MOZ_ASSERT_IF(storageArea, storage->IsForkOf(storageArea));
 
   dict.mStorageArea = storage;
 
@@ -12419,11 +12437,6 @@ nsGlobalWindow::FireDelayedDOMEvents()
 {
   FORWARD_TO_INNER(FireDelayedDOMEvents, (), NS_ERROR_UNEXPECTED);
 
-  for (uint32_t i = 0, len = mPendingStorageEvents.Length(); i < len; ++i) {
-    Observe(mPendingStorageEvents[i], "dom-storage2-changed", nullptr);
-    Observe(mPendingStorageEvents[i], "dom-private-storage2-changed", nullptr);
-  }
-
   if (mApplicationCache) {
     static_cast<nsDOMOfflineResourceList*>(mApplicationCache.get())->FirePendingEvents();
   }
@@ -13293,6 +13306,13 @@ nsGlobalWindow::EventListenerAdded(nsIAtom* aType)
       aType == nsGkAtoms::onvrdisplaypresentchange) {
     NotifyVREventListenerAdded();
   }
+
+  // We need to initialize localStorage in order to receive notifications.
+  if (aType == nsGkAtoms::onstorage) {
+    ErrorResult rv;
+    GetLocalStorage(rv);
+    rv.SuppressException();
+  }
 }
 
 void
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 05fed83d9f65..483e021c6295 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -1946,9 +1946,6 @@ protected:
   // These member variables are used on both inner and the outer windows.
   nsCOMPtr<nsIPrincipal> mDocumentPrincipal;
 
-  typedef nsTArray<RefPtr<mozilla::dom::StorageEvent>> nsStorageEventArray;
-  nsStorageEventArray mPendingStorageEvents;
-
   uint32_t mSuspendDepth;
   uint32_t mFreezeDepth;
 
diff --git a/dom/canvas/test/chrome/chrome.ini b/dom/canvas/test/chrome/chrome.ini
index 6f7c96c27d68..8e634637c2bd 100644
--- a/dom/canvas/test/chrome/chrome.ini
+++ b/dom/canvas/test/chrome/chrome.ini
@@ -1,8 +1,7 @@
 [DEFAULT]
-skip-if = os == 'android'
-support-files = nonchrome_webgl_debug_renderer_info.html
 
 [test_webgl_debug_renderer_info.html]
 subsuite = gpu
 [test_drawWindow_widget_layers.html]
+skip-if = os == 'android'
 support-files = ../file_drawWindow_source.html ../file_drawWindow_common.js
diff --git a/dom/canvas/test/chrome/nonchrome_webgl_debug_renderer_info.html b/dom/canvas/test/chrome/nonchrome_webgl_debug_renderer_info.html
deleted file mode 100644
index 4668f2baf375..000000000000
--- a/dom/canvas/test/chrome/nonchrome_webgl_debug_renderer_info.html
+++ /dev/null
@@ -1,83 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<script>
-
-
-// This file has the portion of the test_webgl_renderer_info chrome mochitest
-// that has to run as non-chrome to check that this WebGL extension is not exposed to content
-
-// we can't call the chrome Mochitest ok() function ourselves from non-chrome code.
-// So we remote it to the chrome test.
-
-function ok(res, msg) {
-  // Note we post to ourselves as posting to the chrome code doesn't seem to work here.
-  // This works by having the chrome code put an event handler on our own window.
-  window.postMessage({ subTestFinished: true, result: res, message: msg }, "*");
-}
-
-function messageListener(e) {
-  // This is how the chrome test tells us to start running -- we have to wait for this
-  // message to avoid running before it's set up its event handler.
-  if (e.data.run) {
-    var canBeUnprivileged = e.data.canBeUnprivileged;
-    run(canBeUnprivileged);
-  }
-}
-
-window.addEventListener("message", messageListener, true);
-
-function run(canBeUnprivileged) {
-  const UNMASKED_VENDOR_WEBGL = 0x9245;
-  const UNMASKED_RENDERER_WEBGL = 0x9246;
-
-  var canvas = document.createElement("canvas");
-  var gl = canvas.getContext("experimental-webgl");
-
-  ok(!gl.getError(), "getError on newly created WebGL context should return NO_ERROR");
-
-  ok(!gl.getParameter(UNMASKED_VENDOR_WEBGL) && gl.getError() == gl.INVALID_ENUM,
-      "Should not be able to query UNMASKED_VENDOR_WEBGL without having enabled the"
-      + " WEBGL_debug_renderer_info extension");
-  ok(!gl.getParameter(UNMASKED_RENDERER_WEBGL) && gl.getError() == gl.INVALID_ENUM,
-      "Should not be able to query UNMASKED_RENDERER_WEBGL without having enabled the"
-      + " WEBGL_debug_renderer_info extension");
-
-  var exts = gl.getSupportedExtensions();
-  if (canBeUnprivileged) {
-    ok(exts.indexOf("WEBGL_debug_renderer_info") != -1,
-       "WEBGL_debug_renderer_info should be listed by getSupportedExtensions in"
-       + " non-chrome contexts on non-RELEASE_OR_BETAs");
-
-    var ext = gl.getExtension("WEBGL_debug_renderer_info");
-    ok(!!ext,
-       "WEBGL_debug_renderer_info should be available through getExtension in non-chrome"
-       + " contexts on non-RELEASE_OR_BETAs");
-
-    ok(gl.getParameter(UNMASKED_VENDOR_WEBGL) && gl.getError() == gl.NO_ERROR,
-       "Should be able to query UNMASKED_VENDOR_WEBGL if enabling"
-       + " WEBGL_debug_renderer_info succeeded");
-    ok(gl.getParameter(UNMASKED_RENDERER_WEBGL) && gl.getError() == gl.NO_ERROR,
-       "Should be able to query UNMASKED_RENDERER_WEBGL if enabling"
-       + " WEBGL_debug_renderer_info succeeded");
-  } else {
-    ok(exts.indexOf("WEBGL_debug_renderer_info") == -1,
-       "WEBGL_debug_renderer_info should not be listed by getSupportedExtensions in"
-       + " non-chrome contexts");
-    var ext = gl.getExtension("WEBGL_debug_renderer_info");
-    ok(!ext,
-       "WEBGL_debug_renderer_info should not be available through getExtension in"
-       + " non-chrome contexts");
-
-    ok(!gl.getParameter(UNMASKED_VENDOR_WEBGL) && gl.getError() == gl.INVALID_ENUM,
-        "Should not be able to query UNMASKED_VENDOR_WEBGL if enabling"
-        + " WEBGL_debug_renderer_info failed");
-    ok(!gl.getParameter(UNMASKED_RENDERER_WEBGL) && gl.getError() == gl.INVALID_ENUM,
-        "Should not be able to query UNMASKED_RENDERER_WEBGL if enabling"
-        + " WEBGL_debug_renderer_info failed");
-
-  }
-  window.postMessage({allTestsFinished: true}, "*");
-}
-
-</script>
-</html>
diff --git a/dom/canvas/test/chrome/test_webgl_debug_renderer_info.html b/dom/canvas/test/chrome/test_webgl_debug_renderer_info.html
index b70676f77f29..69a81b20a625 100644
--- a/dom/canvas/test/chrome/test_webgl_debug_renderer_info.html
+++ b/dom/canvas/test/chrome/test_webgl_debug_renderer_info.html
@@ -4,99 +4,48 @@
 https://bugzilla.mozilla.org/show_bug.cgi?id=666446
 -->
 <head>
-  <title>Test for WEBGL_debug_renderer_info chrome-only extension</title>
+  <title>Test that WEBGL_debug_renderer_info works in chrome code</title>
   <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
   <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 </head>
 <body>
 
-<pre id="test">
 <script>
 
 const UNMASKED_VENDOR_WEBGL = 0x9245;
 const UNMASKED_RENDERER_WEBGL = 0x9246;
 
-
-var Cu = parent.Components.utils;
-Cu.import("resource://gre/modules/AppConstants.jsm");
-// This gives us `AppConstants` in the global scope.
-// We need this because we only expose debug_renderer_info #ifndef RELEASE_OR_BETA.
-// This should match AppConstants.RELEASE_OR_BETA.
-
-const canBeUnprivileged = !AppConstants.RELEASE_OR_BETA;
-
-
-function isNonEmptyString(s)
-{
+function isNonEmptyString(s) {
   return s && (typeof s) == "string";
 }
 
-function messageListener(e) {
-  if (e.data.allTestsFinished) {
-    SimpleTest.finish();
-  } else if (e.data.subTestFinished) {
-    ok(e.data.result, "content iframe: " + e.data.message);
-  }
-}
+var canvas = document.createElement("canvas");
+var gl = canvas.getContext("experimental-webgl");
+ok(!gl.getError(), "getError on newly created WebGL context should return NO_ERROR");
 
-function checkChromeCase(canvas) {
+ok(!gl.getParameter(UNMASKED_VENDOR_WEBGL) && gl.getError() == gl.INVALID_ENUM,
+   "Should not be able to query UNMASKED_VENDOR_WEBGL without having enabled the WEBGL_debug_renderer_info extension");
+ok(!gl.getParameter(UNMASKED_RENDERER_WEBGL) && gl.getError() == gl.INVALID_ENUM,
+   "Should not be able to query UNMASKED_RENDERER_WEBGL without having enabled the WEBGL_debug_renderer_info extension");
 
-  var gl = canvas.getContext("experimental-webgl");
-  ok(!gl.getError(), "getError on newly created WebGL context should return NO_ERROR");
+var exts = gl.getSupportedExtensions();
+ok(exts.indexOf("WEBGL_debug_renderer_info") != -1,
+   "WEBGL_debug_renderer_info should be listed by getSupportedExtensions in chrome contexts");
+var ext = gl.getExtension("WEBGL_debug_renderer_info");
+ok(ext,
+   "WEBGL_debug_renderer_info should be available through getExtension in chrome contexts");
 
-  ok(!gl.getParameter(UNMASKED_VENDOR_WEBGL) && gl.getError() == gl.INVALID_ENUM,
-     "Should not be able to query UNMASKED_VENDOR_WEBGL without having enabled the WEBGL_debug_renderer_info extension");
-  ok(!gl.getParameter(UNMASKED_RENDERER_WEBGL) && gl.getError() == gl.INVALID_ENUM,
-     "Should not be able to query UNMASKED_RENDERER_WEBGL without having enabled the WEBGL_debug_renderer_info extension");
+ok(ext.UNMASKED_VENDOR_WEBGL == UNMASKED_VENDOR_WEBGL,
+   "UNMASKED_VENDOR_WEBGL has the correct value");
+ok(ext.UNMASKED_RENDERER_WEBGL == UNMASKED_RENDERER_WEBGL,
+   "UNMASKED_RENDERER_WEBGL has the correct value");
 
-  var exts = gl.getSupportedExtensions();
-  ok(exts.indexOf("WEBGL_debug_renderer_info") != -1,
-     "WEBGL_debug_renderer_info should be listed by getSupportedExtensions in chrome contexts");
-  var ext = gl.getExtension("WEBGL_debug_renderer_info");
-  ok(ext,
-     "WEBGL_debug_renderer_info should be available through getExtension in chrome contexts");
+ok(isNonEmptyString(gl.getParameter(UNMASKED_VENDOR_WEBGL)) && gl.getError() == gl.NO_ERROR,
+   "Should be able to query UNMASKED_VENDOR_WEBGL in chrome context with WEBGL_debug_renderer_info enabled");
+ok(isNonEmptyString(gl.getParameter(UNMASKED_RENDERER_WEBGL)) && gl.getError() == gl.NO_ERROR,
+   "Should be able to query UNMASKED_RENDERER_WEBGL in chrome context with WEBGL_debug_renderer_info enabled");
 
-  ok(ext.UNMASKED_VENDOR_WEBGL == UNMASKED_VENDOR_WEBGL,
-     "UNMASKED_VENDOR_WEBGL has the correct value");
-  ok(ext.UNMASKED_RENDERER_WEBGL == UNMASKED_RENDERER_WEBGL,
-     "UNMASKED_RENDERER_WEBGL has the correct value");
-
-  ok(isNonEmptyString(gl.getParameter(UNMASKED_VENDOR_WEBGL)) && gl.getError() == gl.NO_ERROR,
-     "Should be able to query UNMASKED_VENDOR_WEBGL in chrome context with WEBGL_debug_renderer_info enabled");
-  ok(isNonEmptyString(gl.getParameter(UNMASKED_RENDERER_WEBGL)) && gl.getError() == gl.NO_ERROR,
-     "Should be able to query UNMASKED_RENDERER_WEBGL in chrome context with WEBGL_debug_renderer_info enabled");
-}
-
-function main()
-{
-  SimpleTest.waitForExplicitFinish();
-
-  checkChromeCase(document.createElement("canvas"));
-
-  // Now run the non-chrome code to verify the security of this WebGL chrome-only extension.
-
-  var iframe = document.createElement("iframe");
-  iframe.src = "http://mochi.test:8888/chrome/dom/canvas/test/chrome/nonchrome_webgl_debug_renderer_info.html";
-
-  iframe.onload = function () {
-
-    // test that chrome can get WEBGL_debug_renderer_info on a canvas on the iframe...
-    // this is useful to check in itself, and is also useful so the subsequent non-chrome test
-    // will also test that doing so doesn't confuse our chrome-only check.
-    checkChromeCase(iframe.contentDocument.createElement("canvas"));
-
-    iframe.contentWindow.addEventListener("message", messageListener);
-    iframe.contentWindow.postMessage({run: true,
-                                      canBeUnprivileged: canBeUnprivileged},
-                                     "*");
-  };
-
-  document.body.appendChild(iframe);
-}
-
-window.onload = main;
 </script>
-</pre>
 </body>
 </html>
diff --git a/dom/canvas/test/webgl-mochitest/ensure-exts/test_common.html b/dom/canvas/test/webgl-mochitest/ensure-exts/test_common.html
index 153161d93028..c912aea4d2c6 100644
--- a/dom/canvas/test/webgl-mochitest/ensure-exts/test_common.html
+++ b/dom/canvas/test/webgl-mochitest/ensure-exts/test_common.html
@@ -31,7 +31,7 @@ var defaultExts = [
     ['OES_texture_half_float_linear' , [ENSURE          , FORBID          ]],
     ['OES_vertex_array_object'       , [ENSURE          , FORBID          ]],
     ['WEBGL_compressed_texture_s3tc' , [MACHINE_SPECIFIC, MACHINE_SPECIFIC]],
-//  ['WEBGL_debug_renderer_info'     , [FORBID          , FORBID          ]], // Complicated!
+    ['WEBGL_debug_renderer_info'     , [ENSURE          , ENSURE          ]],
     ['WEBGL_debug_shaders'           , [FORBID          , FORBID          ]],
     ['WEBGL_depth_texture'           , [MACHINE_SPECIFIC, FORBID          ]],
     ['WEBGL_draw_buffers'            , [MACHINE_SPECIFIC, FORBID          ]],
diff --git a/dom/events/StorageEvent.h b/dom/events/StorageEvent.h
index e82baf34131f..f9639ef58b50 100644
--- a/dom/events/StorageEvent.h
+++ b/dom/events/StorageEvent.h
@@ -13,6 +13,8 @@
 #include "mozilla/dom/Event.h"
 #include "mozilla/dom/StorageEventBinding.h"
 
+class nsIPrincipal;
+
 namespace mozilla {
 namespace dom {
 
@@ -34,6 +36,7 @@ protected:
   nsString mNewValue;
   nsString mUrl;
   RefPtr<Storage> mStorageArea;
+  nsCOMPtr<nsIPrincipal> mPrincipal;
 
 public:
   virtual StorageEvent* AsStorageEvent();
@@ -79,6 +82,18 @@ public:
   {
     return mStorageArea;
   }
+
+  // Non WebIDL methods
+  void SetPrincipal(nsIPrincipal* aPrincipal)
+  {
+    MOZ_ASSERT(!mPrincipal);
+    mPrincipal = aPrincipal;
+  }
+
+  nsIPrincipal* GetPrincipal() const
+  {
+    return mPrincipal;
+  }
 };
 
 } // namespace dom
diff --git a/dom/html/HTMLTrackElement.cpp b/dom/html/HTMLTrackElement.cpp
index b1208c5304e6..758018f8d29f 100644
--- a/dom/html/HTMLTrackElement.cpp
+++ b/dom/html/HTMLTrackElement.cpp
@@ -293,12 +293,37 @@ HTMLTrackElement::LoadResource()
     mChannel = nullptr;
   }
 
+  // According to https://www.w3.org/TR/html5/embedded-content-0.html#sourcing-out-of-band-text-tracks
+  //
+  // "8: If the track element's parent is a media element then let CORS mode
+  // be the state of the parent media element's crossorigin content attribute.
+  // Otherwise, let CORS mode be No CORS."
+  //
+  CORSMode corsMode = mMediaParent ? mMediaParent->GetCORSMode() : CORS_NONE;
+
+  // Determine the security flag based on corsMode.
+  nsSecurityFlags secFlags;
+  if (CORS_NONE == corsMode) {
+    // Same-origin is required for track element.
+    secFlags = nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_INHERITS;
+  } else {
+    secFlags = nsILoadInfo::SEC_REQUIRE_CORS_DATA_INHERITS;
+    if (CORS_ANONYMOUS == corsMode) {
+      secFlags |= nsILoadInfo::SEC_COOKIES_SAME_ORIGIN;
+    } else if (CORS_USE_CREDENTIALS == corsMode) {
+      secFlags |= nsILoadInfo::SEC_COOKIES_INCLUDE;
+    } else {
+      NS_WARNING("Unknown CORS mode.");
+      secFlags = nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_INHERITS;
+    }
+  }
+
   nsCOMPtr<nsIChannel> channel;
   nsCOMPtr<nsILoadGroup> loadGroup = OwnerDoc()->GetDocumentLoadGroup();
   rv = NS_NewChannel(getter_AddRefs(channel),
                      uri,
                      static_cast<Element*>(this),
-                     nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS,
+                     secFlags,
                      nsIContentPolicy::TYPE_INTERNAL_TRACK,
                      loadGroup,
                      nullptr,   // aCallbacks
@@ -313,7 +338,11 @@ HTMLTrackElement::LoadResource()
 
   LOG(LogLevel::Debug, ("opening webvtt channel"));
   rv = channel->AsyncOpen2(mListener);
-  NS_ENSURE_TRUE_VOID(NS_SUCCEEDED(rv));
+
+  if (NS_FAILED(rv)) {
+    SetReadyState(TextTrackReadyState::FailedToLoad);
+    return;
+  }
 
   mChannel = channel;
 }
diff --git a/dom/indexedDB/test/test_filehandle_workers.html b/dom/indexedDB/test/test_filehandle_workers.html
index 3d1a44c1e5f0..88aea896c07d 100644
--- a/dom/indexedDB/test/test_filehandle_workers.html
+++ b/dom/indexedDB/test/test_filehandle_workers.html
@@ -51,9 +51,9 @@
     let url =
       URL.createObjectURL(new Blob(["(", dummyWorkerScript.toSource(), ")()"]));
 
-    let worker = new Worker(url);
+    let worker1 = new Worker(url);
     try {
-      worker.postMessage(mutableFile);
+      worker1.postMessage(mutableFile);
       ok(false, "Should have thrown!");
     }
     catch (e) {
@@ -61,7 +61,6 @@
       is(e.name, "DataCloneError", "Good error.");
       is(e.code, DOMException.DATA_CLONE_ERR, "Good error code.")
     }
-    worker.terminate();
 
     mutableFile.onerror = errorHandler;
 
@@ -77,10 +76,10 @@
 
     let file = event.target.result;
 
-    worker = new Worker(url);
+    let worker2 = new Worker(url);
     URL.revokeObjectURL(url);
     try {
-      worker.postMessage(file);
+      worker2.postMessage(file);
       ok(false, "Should have thrown!");
     }
     catch (e) {
@@ -88,7 +87,6 @@
       is(e.name, "DataCloneError", "Good error.");
       is(e.code, DOMException.DATA_CLONE_ERR, "Good error code.")
     }
-    worker.terminate();
 
     let objectStore =
       db.transaction("Foo", "readwrite").objectStore("Foo");
@@ -126,14 +124,18 @@
 
     url = URL.createObjectURL(new Blob(["(", workerScript.toSource(), ")()"]));
 
-    worker = new Worker(url);
+    let worker3 = new Worker(url);
     URL.revokeObjectURL(url);
-    worker.postMessage(name);
-    worker.onmessage = grabEventAndContinueHandler;
+    worker3.postMessage(name);
+    worker3.onmessage = grabEventAndContinueHandler;
     event = yield undefined;
 
     is(event.data, "success", "Good response.");
-    worker.terminate();
+
+    todo(false, "Terminate all workers at the end of the test to work around bug 1340941.");
+    worker1.terminate();
+    worker2.terminate();
+    worker3.terminate();
 
     finishTest();
   }
diff --git a/dom/interfaces/storage/nsIDOMStorageManager.idl b/dom/interfaces/storage/nsIDOMStorageManager.idl
index 1008477c099e..45f79f301be0 100644
--- a/dom/interfaces/storage/nsIDOMStorageManager.idl
+++ b/dom/interfaces/storage/nsIDOMStorageManager.idl
@@ -20,8 +20,15 @@ interface nsIDOMStorageManager : nsISupports
   /**
    * This starts async preloading of a storage cache for scope
    * defined by the principal.
+   *
+   * Because of how multi-e10s support was implemented in bug 1285898, the
+   * StorageCache instance can no longer use a timer to keep itself alive.  So a
+   * Storage instance is returned if precaching believes the principal may have
+   * localStorage data.  (Previously the StorageCache would be brought into
+   * existence and kept alive by the timer so that it could be returned if a
+   * call to createStorage was made due to a request by the page.)
    */
-  void precacheStorage(in nsIPrincipal aPrincipal);
+  nsIDOMStorage precacheStorage(in nsIPrincipal aPrincipal);
 
   /**
    * Returns instance of DOM storage object for given principal.
diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index 9a915fbbe054..2134466e8d79 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -34,6 +34,7 @@
 #include "mozilla/dom/MemoryReportRequest.h"
 #include "mozilla/dom/ProcessGlobal.h"
 #include "mozilla/dom/PushNotifier.h"
+#include "mozilla/dom/Storage.h"
 #include "mozilla/dom/StorageIPC.h"
 #include "mozilla/dom/TabGroup.h"
 #include "mozilla/dom/workers/ServiceWorkerManager.h"
@@ -3035,6 +3036,20 @@ ContentChild::RecvBlobURLUnregistration(const nsCString& aURI)
   return IPC_OK();
 }
 
+mozilla::ipc::IPCResult
+ContentChild::RecvDispatchLocalStorageChange(const nsString& aDocumentURI,
+                                             const nsString& aKey,
+                                             const nsString& aOldValue,
+                                             const nsString& aNewValue,
+                                             const IPC::Principal& aPrincipal,
+                                             const bool& aIsPrivate)
+{
+  Storage::DispatchStorageEvent(Storage::LocalStorage,
+                                aDocumentURI, aKey, aOldValue, aNewValue,
+                                aPrincipal, aIsPrivate, nullptr, true);
+  return IPC_OK();
+}
+
 #if defined(XP_WIN) && defined(ACCESSIBILITY)
 bool
 ContentChild::SendGetA11yContentId()
diff --git a/dom/ipc/ContentChild.h b/dom/ipc/ContentChild.h
index 9c38e7e1fdbe..b6549f55432a 100644
--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@@ -391,6 +391,14 @@ public:
   virtual mozilla::ipc::IPCResult
   RecvInitBlobURLs(nsTArray<BlobURLRegistrationData>&& aRegistations) override;
 
+  virtual mozilla::ipc::IPCResult
+  RecvDispatchLocalStorageChange(const nsString& aDocumentURI,
+                                 const nsString& aKey,
+                                 const nsString& aOldValue,
+                                 const nsString& aNewValue,
+                                 const IPC::Principal& aPrincipal,
+                                 const bool& aIsPrivate) override;
+
   virtual mozilla::ipc::IPCResult RecvLastPrivateDocShellDestroyed() override;
 
   virtual mozilla::ipc::IPCResult RecvFilePathUpdate(const nsString& aStorageType,
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 81b5351201a1..d218912eab64 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -51,6 +51,7 @@
 #include "mozilla/dom/PContentPermissionRequestParent.h"
 #include "mozilla/dom/PCycleCollectWithLogsParent.h"
 #include "mozilla/dom/ServiceWorkerRegistrar.h"
+#include "mozilla/dom/Storage.h"
 #include "mozilla/dom/StorageIPC.h"
 #include "mozilla/dom/devicestorage/DeviceStorageRequestParent.h"
 #include "mozilla/dom/power/PowerManagerService.h"
@@ -4771,6 +4772,25 @@ ContentParent::RecvUnstoreAndBroadcastBlobURLUnregistration(const nsCString& aUR
   return IPC_OK();
 }
 
+mozilla::ipc::IPCResult
+ContentParent::RecvBroadcastLocalStorageChange(const nsString& aDocumentURI,
+                                               const nsString& aKey,
+                                               const nsString& aOldValue,
+                                               const nsString& aNewValue,
+                                               const Principal& aPrincipal,
+                                               const bool& aIsPrivate)
+{
+  for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
+    if (cp != this) {
+      Unused << cp->SendDispatchLocalStorageChange(
+        nsString(aDocumentURI), nsString(aKey), nsString(aOldValue),
+        nsString(aNewValue), IPC::Principal(aPrincipal), aIsPrivate);
+    }
+  }
+
+  return IPC_OK();
+}
+
 mozilla::ipc::IPCResult
 ContentParent::RecvGetA11yContentId(uint32_t* aContentId)
 {
diff --git a/dom/ipc/ContentParent.h b/dom/ipc/ContentParent.h
index fdd315822870..81f4a2c4ba69 100644
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -574,6 +574,14 @@ public:
   virtual mozilla::ipc::IPCResult
   RecvUnstoreAndBroadcastBlobURLUnregistration(const nsCString& aURI) override;
 
+  virtual mozilla::ipc::IPCResult
+  RecvBroadcastLocalStorageChange(const nsString& aDocumentURI,
+                                  const nsString& aKey,
+                                  const nsString& aOldValue,
+                                  const nsString& aNewValue,
+                                  const IPC::Principal& aPrincipal,
+                                  const bool& aIsPrivate) override;
+
   virtual mozilla::ipc::IPCResult
   RecvGetA11yContentId(uint32_t* aContentId) override;
 
diff --git a/dom/ipc/PContent.ipdl b/dom/ipc/PContent.ipdl
index 039044dcad52..a80382d1034a 100644
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -676,6 +676,12 @@ child:
 
     async BlobURLUnregistration(nsCString aURI);
 
+    async DispatchLocalStorageChange(nsString documentURI,
+                                     nsString key,
+                                     nsString oldValue,
+                                     nsString newValue,
+                                     Principal principal,
+                                     bool isPrivate);
 
     async GMPsChanged(GMPCapabilityData[] capabilities);
 
@@ -1178,6 +1184,13 @@ parent:
 
      async UnstoreAndBroadcastBlobURLUnregistration(nsCString url);
 
+     async BroadcastLocalStorageChange(nsString documentURI,
+                                       nsString key,
+                                       nsString oldValue,
+                                       nsString newValue,
+                                       Principal principal,
+                                       bool isPrivate);
+
     /**
      * Messages for communicating child Telemetry to the parent process
      */
diff --git a/dom/media/MediaStreamGraph.h b/dom/media/MediaStreamGraph.h
index 4a92bac854d5..d5ffd522d380 100644
--- a/dom/media/MediaStreamGraph.h
+++ b/dom/media/MediaStreamGraph.h
@@ -769,7 +769,7 @@ public:
    * Returns false if the data was not appended because no such track exists
    * or the stream was already finished.
    */
-  bool AppendToTrack(TrackID aID, MediaSegment* aSegment, MediaSegment *aRawSegment = nullptr);
+  virtual bool AppendToTrack(TrackID aID, MediaSegment* aSegment, MediaSegment *aRawSegment = nullptr);
   /**
    * Get the stream time of the end of the data that has been appended so far.
    * Can be called from any thread but won't be useful if it can race with
diff --git a/dom/media/MediaStreamTrack.cpp b/dom/media/MediaStreamTrack.cpp
index cd61effde9b0..853f9159adce 100644
--- a/dom/media/MediaStreamTrack.cpp
+++ b/dom/media/MediaStreamTrack.cpp
@@ -130,11 +130,12 @@ MediaStreamTrack::MediaStreamTrack(DOMMediaStream* aStream, TrackID aTrackID,
     mReadyState(MediaStreamTrackState::Live),
     mEnabled(true), mConstraints(aConstraints)
 {
-
   GetSource().RegisterSink(this);
 
-  mPrincipalHandleListener = new PrincipalHandleListener(this);
-  AddListener(mPrincipalHandleListener);
+  if (GetOwnedStream()) {
+    mPrincipalHandleListener = new PrincipalHandleListener(this);
+    AddListener(mPrincipalHandleListener);
+  }
 
   nsresult rv;
   nsCOMPtr<nsIUUIDGenerator> uuidgen =
diff --git a/dom/media/MediaStreamTrack.h b/dom/media/MediaStreamTrack.h
index 740b9d286277..cb11e919ac2e 100644
--- a/dom/media/MediaStreamTrack.h
+++ b/dom/media/MediaStreamTrack.h
@@ -394,7 +394,7 @@ public:
    * Adds a MediaStreamTrackListener to the MediaStreamGraph representation of
    * this track.
    */
-  void AddListener(MediaStreamTrackListener* aListener);
+  virtual void AddListener(MediaStreamTrackListener* aListener);
 
   /**
    * Removes a MediaStreamTrackListener from the MediaStreamGraph representation
@@ -408,7 +408,7 @@ public:
    * the listener succeeded (tracks originating from SourceMediaStreams) or
    * failed (e.g., WebAudio originated tracks).
    */
-  void AddDirectListener(DirectMediaStreamTrackListener *aListener);
+  virtual void AddDirectListener(DirectMediaStreamTrackListener *aListener);
   void RemoveDirectListener(DirectMediaStreamTrackListener  *aListener);
 
   /**
diff --git a/dom/plugins/ipc/PluginModuleParent.cpp b/dom/plugins/ipc/PluginModuleParent.cpp
index e4fb4941d529..d76cd402a8e8 100644
--- a/dom/plugins/ipc/PluginModuleParent.cpp
+++ b/dom/plugins/ipc/PluginModuleParent.cpp
@@ -2720,6 +2720,26 @@ ForceWindowless(InfallibleTArray<nsCString>& names,
     }
 }
 #endif // windows or linux
+#if defined(XP_WIN)
+static void
+ForceDirect(InfallibleTArray<nsCString>& names,
+            InfallibleTArray<nsCString>& values)
+{
+    nsCaseInsensitiveUTF8StringArrayComparator comparator;
+    NS_NAMED_LITERAL_CSTRING(wmodeAttributeName, "wmode");
+    NS_NAMED_LITERAL_CSTRING(directAttributeValue, "direct");
+    auto wmodeAttributeIndex =
+        names.IndexOf(wmodeAttributeName, 0, comparator);
+    if (wmodeAttributeIndex != names.NoIndex) {
+        if (values[wmodeAttributeIndex].EqualsLiteral("window")) {
+            values[wmodeAttributeIndex].Assign(directAttributeValue);
+        }
+    } else {
+        names.AppendElement(wmodeAttributeName);
+        values.AppendElement(directAttributeValue);
+    }
+}
+#endif // windows
 
 nsresult
 PluginModuleParent::NPP_NewInternal(NPMIMEType pluginType, NPP instance,
@@ -2758,6 +2778,8 @@ PluginModuleParent::NPP_NewInternal(NPMIMEType pluginType, NPP instance,
 #ifdef XP_WIN
         bool supportsAsyncRender =
           Preferences::GetBool("dom.ipc.plugins.asyncdrawing.enabled", false);
+        bool supportsForceDirect =
+          Preferences::GetBool("dom.ipc.plugins.forcedirect.enabled", false);
         if (supportsAsyncRender) {
           // Prefs indicates we want async plugin rendering, make sure
           // the flash module has support.
@@ -2777,6 +2799,14 @@ PluginModuleParent::NPP_NewInternal(NPMIMEType pluginType, NPP instance,
 #elif defined(MOZ_WIDGET_GTK)
         // We no longer support windowed mode on Linux.
         ForceWindowless(names, values);
+#endif
+#ifdef XP_WIN
+        // For all builds that use async rendering force use of the accelerated
+        // direct path for flash objects that have wmode=window or no wmode
+        // specified.
+        if (supportsAsyncRender && supportsForceDirect) {
+            ForceDirect(names, values);
+        }
 #endif
     }
 
diff --git a/dom/storage/Storage.cpp b/dom/storage/Storage.cpp
index 9379cb2eaef3..cbd62cda01ad 100644
--- a/dom/storage/Storage.cpp
+++ b/dom/storage/Storage.cpp
@@ -14,6 +14,9 @@
 #include "nsIPrincipal.h"
 #include "nsICookiePermission.h"
 
+#include "mozilla/dom/ContentChild.h"
+#include "mozilla/dom/ContentParent.h"
+#include "mozilla/dom/PermissionMessageUtils.h"
 #include "mozilla/dom/StorageBinding.h"
 #include "mozilla/dom/StorageEvent.h"
 #include "mozilla/dom/StorageEventBinding.h"
@@ -25,6 +28,9 @@
 #include "nsServiceManagerUtils.h"
 
 namespace mozilla {
+
+using namespace ipc;
+
 namespace dom {
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(Storage, mManager, mPrincipal, mWindow)
@@ -58,7 +64,6 @@ Storage::Storage(nsPIDOMWindowInner* aWindow,
 
 Storage::~Storage()
 {
-  mCache->KeepAlive();
 }
 
 /* virtual */ JSObject*
@@ -215,6 +220,30 @@ void
 Storage::BroadcastChangeNotification(const nsSubstring& aKey,
                                      const nsSubstring& aOldValue,
                                      const nsSubstring& aNewValue)
+{
+  if (!XRE_IsParentProcess() && GetType() == LocalStorage && mPrincipal) {
+    // If we are in a child process, we want to send a message to the parent in
+    // order to broadcast the StorageEvent correctly to any child process.
+    dom::ContentChild* cc = dom::ContentChild::GetSingleton();
+    Unused << NS_WARN_IF(!cc->SendBroadcastLocalStorageChange(
+      mDocumentURI, nsString(aKey), nsString(aOldValue), nsString(aNewValue),
+      IPC::Principal(mPrincipal), mIsPrivate));
+  }
+
+  DispatchStorageEvent(GetType(), mDocumentURI, aKey, aOldValue, aNewValue,
+                       mPrincipal, mIsPrivate, this, false);
+}
+
+/* static */ void
+Storage::DispatchStorageEvent(StorageType aStorageType,
+                              const nsAString& aDocumentURI,
+                              const nsAString& aKey,
+                              const nsAString& aOldValue,
+                              const nsAString& aNewValue,
+                              nsIPrincipal* aPrincipal,
+                              bool aIsPrivate,
+                              Storage* aStorage,
+                              bool aImmediateDispatch)
 {
   StorageEventInit dict;
   dict.mBubbles = false;
@@ -222,21 +251,67 @@ Storage::BroadcastChangeNotification(const nsSubstring& aKey,
   dict.mKey = aKey;
   dict.mNewValue = aNewValue;
   dict.mOldValue = aOldValue;
-  dict.mStorageArea = this;
-  dict.mUrl = mDocumentURI;
+  dict.mStorageArea = aStorage;
+  dict.mUrl = aDocumentURI;
 
   // Note, this DOM event should never reach JS. It is cloned later in
   // nsGlobalWindow.
   RefPtr<StorageEvent> event =
     StorageEvent::Constructor(nullptr, NS_LITERAL_STRING("storage"), dict);
 
+  event->SetPrincipal(aPrincipal);
+
   RefPtr<StorageNotifierRunnable> r =
     new StorageNotifierRunnable(event,
-                                GetType() == LocalStorage
+                                aStorageType == LocalStorage
                                   ? u"localStorage"
                                   : u"sessionStorage",
-                                IsPrivate());
-  NS_DispatchToMainThread(r);
+                                aIsPrivate);
+
+  if (aImmediateDispatch) {
+    Unused << r->Run();
+  } else {
+    NS_DispatchToMainThread(r);
+  }
+
+  // If we are in the parent process and we have the principal, we want to
+  // broadcast this event to every other process.
+  if (aStorageType == LocalStorage && XRE_IsParentProcess() && aPrincipal) {
+    for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
+      Unused << cp->SendDispatchLocalStorageChange(
+        nsString(aDocumentURI), nsString(aKey), nsString(aOldValue),
+        nsString(aNewValue), IPC::Principal(aPrincipal), aIsPrivate);
+    }
+  }
+}
+
+void
+Storage::ApplyEvent(StorageEvent* aStorageEvent)
+{
+  MOZ_ASSERT(aStorageEvent);
+
+  nsAutoString key;
+  nsAutoString old;
+  nsAutoString value;
+
+  aStorageEvent->GetKey(key);
+  aStorageEvent->GetNewValue(value);
+
+  // No key means clearing the full storage.
+  if (key.IsVoid()) {
+    MOZ_ASSERT(value.IsVoid());
+    mCache->Clear(this, StorageCache::E10sPropagated);
+    return;
+  }
+
+  // No new value means removing the key.
+  if (value.IsVoid()) {
+    mCache->RemoveItem(this, key, old, StorageCache::E10sPropagated);
+    return;
+  }
+
+  // Otherwise, we set the new value.
+  mCache->SetItem(this, key, value, old, StorageCache::E10sPropagated);
 }
 
 static const char kPermissionType[] = "cookie";
diff --git a/dom/storage/Storage.h b/dom/storage/Storage.h
index fb0c93966341..462c9b9877dd 100644
--- a/dom/storage/Storage.h
+++ b/dom/storage/Storage.h
@@ -24,6 +24,7 @@ namespace dom {
 
 class StorageManagerBase;
 class StorageCache;
+class StorageEvent;
 
 class Storage final
   : public nsIDOMStorage
@@ -129,6 +130,28 @@ public:
     return mCache == aOther->mCache;
   }
 
+  // aStorage can be null if this method is called by ContentChild.
+  //
+  // aImmediateDispatch is for use by (main-thread) IPC code so that PContent
+  // ordering can be maintained.  Without this, the event would be enqueued and
+  // run in a future turn of the event loop, potentially allowing other PContent
+  // Recv* methods to trigger script that wants to assume our localstorage
+  // changes have already been applied.  This is the case for message manager
+  // messages which are used by ContentTask testing logic and webextensions.
+  static void
+  DispatchStorageEvent(StorageType aStorageType,
+                       const nsAString& aDocumentURI,
+                       const nsAString& aKey,
+                       const nsAString& aOldValue,
+                       const nsAString& aNewValue,
+                       nsIPrincipal* aPrincipal,
+                       bool aIsPrivate,
+                       Storage* aStorage,
+                       bool aImmediateDispatch);
+
+  void
+  ApplyEvent(StorageEvent* aStorageEvent);
+
 protected:
   // The method checks whether the caller can use a storage.
   // CanUseStorage is called before any DOM initiated operation
diff --git a/dom/storage/StorageCache.cpp b/dom/storage/StorageCache.cpp
index bd217266e7d5..38d5da8737bf 100644
--- a/dom/storage/StorageCache.cpp
+++ b/dom/storage/StorageCache.cpp
@@ -59,7 +59,7 @@ GetDataSetIndex(const Storage* aStorage)
 
 NS_IMPL_ADDREF(StorageCacheBridge)
 
-// Since there is no consumer of return value of Release, we can turn this 
+// Since there is no consumer of return value of Release, we can turn this
 // method to void to make implementation of asynchronous StorageCache::Release
 // much simpler.
 NS_IMETHODIMP_(void) StorageCacheBridge::Release(void)
@@ -149,7 +149,7 @@ StorageCache::Init(StorageManagerBase* aManager,
   // Check the quota string has (or has not) the identical origin suffix as
   // this storage cache is bound to.
   MOZ_ASSERT(StringBeginsWith(mQuotaOriginScope, mOriginSuffix));
-  MOZ_ASSERT(mOriginSuffix.IsEmpty() != StringBeginsWith(mQuotaOriginScope, 
+  MOZ_ASSERT(mOriginSuffix.IsEmpty() != StringBeginsWith(mQuotaOriginScope,
                                                          NS_LITERAL_CSTRING("^")));
 
   mUsage = aManager->GetOriginUsage(mQuotaOriginScope);
@@ -198,28 +198,33 @@ StorageCache::DataSet(const Storage* aStorage)
 }
 
 bool
-StorageCache::ProcessUsageDelta(const Storage* aStorage, int64_t aDelta)
+StorageCache::ProcessUsageDelta(const Storage* aStorage, int64_t aDelta,
+                                const MutationSource aSource)
 {
-  return ProcessUsageDelta(GetDataSetIndex(aStorage), aDelta);
+  return ProcessUsageDelta(GetDataSetIndex(aStorage), aDelta, aSource);
 }
 
 bool
-StorageCache::ProcessUsageDelta(uint32_t aGetDataSetIndex, const int64_t aDelta)
+StorageCache::ProcessUsageDelta(uint32_t aGetDataSetIndex, const int64_t aDelta,
+                                const MutationSource aSource)
 {
   // Check if we are in a low disk space situation
-  if (aDelta > 0 && mManager && mManager->IsLowDiskSpace()) {
+  if (aSource == ContentMutation &&
+      aDelta > 0 && mManager && mManager->IsLowDiskSpace()) {
     return false;
   }
 
   // Check limit per this origin
   Data& data = mData[aGetDataSetIndex];
   uint64_t newOriginUsage = data.mOriginQuotaUsage + aDelta;
-  if (aDelta > 0 && newOriginUsage > StorageManagerBase::GetQuota()) {
+  if (aSource == ContentMutation &&
+      aDelta > 0 && newOriginUsage > StorageManagerBase::GetQuota()) {
     return false;
   }
 
   // Now check eTLD+1 limit
-  if (mUsage && !mUsage->CheckAndSetETLD1UsageDelta(aGetDataSetIndex, aDelta)) {
+  if (mUsage &&
+      !mUsage->CheckAndSetETLD1UsageDelta(aGetDataSetIndex, aDelta, aSource)) {
     return false;
   }
 
@@ -246,73 +251,6 @@ StorageCache::Preload()
 
 namespace {
 
-// This class is passed to timer as a tick observer.  It refers the cache
-// and keeps it alive for a time.
-class StorageCacheHolder : public nsITimerCallback, public nsINamed
-{
-  virtual ~StorageCacheHolder() {}
-
-  NS_DECL_ISUPPORTS
-
-  NS_IMETHOD
-  Notify(nsITimer* aTimer) override
-  {
-    mCache = nullptr;
-    return NS_OK;
-  }
-
-  NS_IMETHOD
-  GetName(nsACString& aName) override
-  {
-    aName.AssignASCII("StorageCacheHolder_timer");
-    return NS_OK;
-  }
-
-  NS_IMETHOD
-  SetName(const char* aName) override
-  {
-    return NS_ERROR_NOT_IMPLEMENTED;
-  }
-
-  RefPtr<StorageCache> mCache;
-
-public:
-  explicit StorageCacheHolder(StorageCache* aCache) : mCache(aCache) {}
-};
-
-NS_IMPL_ISUPPORTS(StorageCacheHolder, nsITimerCallback, nsINamed)
-
-} // namespace
-
-void
-StorageCache::KeepAlive()
-{
-  // Missing reference back to the manager means the cache is not responsible
-  // for its lifetime.  Used for keeping sessionStorage live forever.
-  if (!mManager) {
-    return;
-  }
-
-  if (!NS_IsMainThread()) {
-    // Timer and the holder must be initialized on the main thread.
-    NS_DispatchToMainThread(NewRunnableMethod(this, &StorageCache::KeepAlive));
-    return;
-  }
-
-  nsCOMPtr<nsITimer> timer = do_CreateInstance("@mozilla.org/timer;1");
-  if (!timer) {
-    return;
-  }
-
-  RefPtr<StorageCacheHolder> holder = new StorageCacheHolder(this);
-  timer->InitWithCallback(holder, DOM_STORAGE_CACHE_KEEP_ALIVE_TIME_MS,
-                          nsITimer::TYPE_ONE_SHOT);
-
-  mKeepAliveTimer.swap(timer);
-}
-
-namespace {
-
 // The AutoTimer provided by telemetry headers is only using static,
 // i.e. compile time known ID, but here we know the ID only at run time.
 // Hence a new class.
@@ -452,7 +390,8 @@ StorageCache::GetItem(const Storage* aStorage, const nsAString& aKey,
 
 nsresult
 StorageCache::SetItem(const Storage* aStorage, const nsAString& aKey,
-                      const nsString& aValue, nsString& aOld)
+                      const nsString& aValue, nsString& aOld,
+                      const MutationSource aSource)
 {
   // Size of the cache that will change after this action.
   int64_t delta = 0;
@@ -475,7 +414,7 @@ StorageCache::SetItem(const Storage* aStorage, const nsAString& aKey,
   delta += static_cast<int64_t>(aValue.Length()) -
            static_cast<int64_t>(aOld.Length());
 
-  if (!ProcessUsageDelta(aStorage, delta)) {
+  if (!ProcessUsageDelta(aStorage, delta, aSource)) {
     return NS_ERROR_DOM_QUOTA_REACHED;
   }
 
@@ -485,7 +424,7 @@ StorageCache::SetItem(const Storage* aStorage, const nsAString& aKey,
 
   data.mKeys.Put(aKey, aValue);
 
-  if (Persist(aStorage)) {
+  if (aSource == ContentMutation && Persist(aStorage)) {
     if (!sDatabase) {
       NS_ERROR("Writing to localStorage after the database has been shut down"
                ", data lose!");
@@ -504,7 +443,7 @@ StorageCache::SetItem(const Storage* aStorage, const nsAString& aKey,
 
 nsresult
 StorageCache::RemoveItem(const Storage* aStorage, const nsAString& aKey,
-                         nsString& aOld)
+                         nsString& aOld, const MutationSource aSource)
 {
   if (Persist(aStorage)) {
     WaitForPreload(Telemetry::LOCALDOMSTORAGE_REMOVEKEY_BLOCKING_MS);
@@ -522,10 +461,10 @@ StorageCache::RemoveItem(const Storage* aStorage, const nsAString& aKey,
   // Recalculate the cached data size
   const int64_t delta = -(static_cast<int64_t>(aOld.Length()) +
                           static_cast<int64_t>(aKey.Length()));
-  Unused << ProcessUsageDelta(aStorage, delta);
+  Unused << ProcessUsageDelta(aStorage, delta, aSource);
   data.mKeys.Remove(aKey);
 
-  if (Persist(aStorage)) {
+  if (aSource == ContentMutation && Persist(aStorage)) {
     if (!sDatabase) {
       NS_ERROR("Writing to localStorage after the database has been shut down"
                ", data lose!");
@@ -539,7 +478,7 @@ StorageCache::RemoveItem(const Storage* aStorage, const nsAString& aKey,
 }
 
 nsresult
-StorageCache::Clear(const Storage* aStorage)
+StorageCache::Clear(const Storage* aStorage, const MutationSource aSource)
 {
   bool refresh = false;
   if (Persist(aStorage)) {
@@ -561,11 +500,11 @@ StorageCache::Clear(const Storage* aStorage)
   bool hadData = !!data.mKeys.Count();
 
   if (hadData) {
-    Unused << ProcessUsageDelta(aStorage, -data.mOriginQuotaUsage);
+    Unused << ProcessUsageDelta(aStorage, -data.mOriginQuotaUsage, aSource);
     data.mKeys.Clear();
   }
 
-  if (Persist(aStorage) && (refresh || hadData)) {
+  if (aSource == ContentMutation && Persist(aStorage) && (refresh || hadData)) {
     if (!sDatabase) {
       NS_ERROR("Writing to localStorage after the database has been shut down"
                ", data lose!");
@@ -680,9 +619,6 @@ StorageCache::LoadItem(const nsAString& aKey, const nsString& aValue)
 void
 StorageCache::LoadDone(nsresult aRv)
 {
-  // Keep the preloaded cache alive for a time
-  KeepAlive();
-
   MonitorAutoLock monitor(mMonitor);
   mLoadResult = aRv;
   mLoaded = true;
@@ -743,12 +679,13 @@ StorageUsage::LoadUsage(const int64_t aUsage)
 
 bool
 StorageUsage::CheckAndSetETLD1UsageDelta(uint32_t aDataSetIndex,
-                                         const int64_t aDelta)
+  const int64_t aDelta, const StorageCache::MutationSource aSource)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   int64_t newUsage = mUsage[aDataSetIndex] + aDelta;
-  if (aDelta > 0 && newUsage > StorageManagerBase::GetQuota()) {
+  if (aSource == StorageCache::ContentMutation &&
+      aDelta > 0 && newUsage > StorageManagerBase::GetQuota()) {
     return false;
   }
 
diff --git a/dom/storage/StorageCache.h b/dom/storage/StorageCache.h
index 3dd74b1f6a1f..54610079103d 100644
--- a/dom/storage/StorageCache.h
+++ b/dom/storage/StorageCache.h
@@ -78,8 +78,24 @@ class StorageCache : public StorageCacheBridge
 public:
   NS_IMETHOD_(void) Release(void);
 
-  // Note: We pass aOriginNoSuffix through the ctor here, because 
-  // StorageCacheHashKey's ctor is creating this class and 
+  enum MutationSource {
+    // The mutation is a result of an explicit JS mutation in this process.
+    // The mutation should be sent to the sDatabase. Quota will be checked and
+    // QuotaExceededError may be returned without the mutation being applied.
+    ContentMutation,
+    // The mutation initially was triggered in a different process and is being
+    // propagated to this cache via Storage::ApplyEvent.  The mutation should
+    // not be sent to the sDatabase because the originating process is already
+    // doing that.  (In addition to the redundant writes being wasteful, there
+    // is the potential for other processes to see inconsistent state from the
+    // database while preloading.)  Quota will be updated but not checked
+    // because it's assumed it was checked in another process and data-coherency
+    // is more important than slightly exceeding quota.
+    E10sPropagated
+  };
+
+  // Note: We pass aOriginNoSuffix through the ctor here, because
+  // StorageCacheHashKey's ctor is creating this class and
   // accepts reversed-origin-no-suffix as an argument - the hashing key.
   explicit StorageCache(const nsACString* aOriginNoSuffix);
 
@@ -96,10 +112,6 @@ public:
   // Starts async preload of this cache if it persistent and not loaded.
   void Preload();
 
-  // Keeps the cache alive (i.e. present in the manager's hash table) for a
-  // time.
-  void KeepAlive();
-
   // The set of methods that are invoked by DOM storage web API.
   // We are passing the Storage object just to let the cache
   // read properties like mPrivate, mPrincipal and mSessionOnly.
@@ -109,10 +121,13 @@ public:
   nsresult GetItem(const Storage* aStorage, const nsAString& aKey,
                    nsAString& aRetval);
   nsresult SetItem(const Storage* aStorage, const nsAString& aKey,
-                   const nsString& aValue, nsString& aOld);
+                   const nsString& aValue, nsString& aOld,
+                   const MutationSource aSource=ContentMutation);
   nsresult RemoveItem(const Storage* aStorage, const nsAString& aKey,
-                      nsString& aOld);
-  nsresult Clear(const Storage* aStorage);
+                      nsString& aOld,
+                      const MutationSource aSource=ContentMutation);
+  nsresult Clear(const Storage* aStorage,
+                 const MutationSource aSource=ContentMutation);
 
   void GetKeys(const Storage* aStorage, nsTArray<nsString>& aKeys);
 
@@ -182,8 +197,18 @@ private:
 
   // Changes the quota usage on the given data set if it fits the quota.
   // If not, then false is returned and no change to the set must be done.
-  bool ProcessUsageDelta(uint32_t aGetDataSetIndex, const int64_t aDelta);
-  bool ProcessUsageDelta(const Storage* aStorage, const int64_t aDelta);
+  // A special case is if aSource==E10sPropagated, then we will return true even
+  // if the change would put us over quota.  This is done to ensure coherency of
+  // caches between processes in the face of races.  It does allow an attacker
+  // to potentially use N multiples of the quota storage limit if they can
+  // arrange for their origin to execute code in N processes.  However, this is
+  // not considered a particularly concerning threat model because it's already
+  // very possible for a rogue page to attempt to intentionally fill up the
+  // user's storage through the use of multiple domains.
+  bool ProcessUsageDelta(uint32_t aGetDataSetIndex, const int64_t aDelta,
+                         const MutationSource aSource=ContentMutation);
+  bool ProcessUsageDelta(const Storage* aStorage, const int64_t aDelta,
+                         const MutationSource aSource=ContentMutation);
 
 private:
   // When a cache is reponsible for its life time (in case of localStorage data
@@ -196,9 +221,6 @@ private:
   // Obtained from the manager during initialization (Init method).
   RefPtr<StorageUsage> mUsage;
 
-  // Timer that holds this cache alive for a while after it has been preloaded.
-  nsCOMPtr<nsITimer> mKeepAliveTimer;
-
   // Principal the cache has been initially created for, this is used only for
   // sessionStorage access checks since sessionStorage objects are strictly
   // scoped by a principal. localStorage objects on the other hand are scoped
@@ -211,7 +233,7 @@ private:
   // The origin attributes suffix
   nsCString mOriginSuffix;
 
-  // The eTLD+1 scope used to count quota usage.  It is in the reversed format 
+  // The eTLD+1 scope used to count quota usage.  It is in the reversed format
   // and contains the origin attributes suffix.
   nsCString mQuotaOriginScope;
 
@@ -277,7 +299,8 @@ class StorageUsage : public StorageUsageBridge
 public:
   explicit StorageUsage(const nsACString& aOriginScope);
 
-  bool CheckAndSetETLD1UsageDelta(uint32_t aDataSetIndex, int64_t aUsageDelta);
+  bool CheckAndSetETLD1UsageDelta(uint32_t aDataSetIndex, int64_t aUsageDelta,
+                                  const StorageCache::MutationSource aSource);
 
 private:
   virtual const nsCString& OriginScope() { return mOriginScope; }
diff --git a/dom/storage/StorageIPC.cpp b/dom/storage/StorageIPC.cpp
index ac9e5f38ec6a..19abddacb90f 100644
--- a/dom/storage/StorageIPC.cpp
+++ b/dom/storage/StorageIPC.cpp
@@ -224,6 +224,12 @@ StorageDBChild::RecvObserve(const nsCString& aTopic,
 mozilla::ipc::IPCResult
 StorageDBChild::RecvOriginsHavingData(nsTArray<nsCString>&& aOrigins)
 {
+  // Force population of mOriginsHavingData even if there are no origins so that
+  // ShouldPreloadOrigin does not generate false positives for all origins.
+  if (!aOrigins.Length()) {
+    Unused << OriginsHavingData();
+  }
+
   for (uint32_t i = 0; i < aOrigins.Length(); ++i) {
     OriginsHavingData().PutEntry(aOrigins[i]);
   }
diff --git a/dom/storage/StorageManager.cpp b/dom/storage/StorageManager.cpp
index c0301996b79b..17f086eeb244 100644
--- a/dom/storage/StorageManager.cpp
+++ b/dom/storage/StorageManager.cpp
@@ -309,7 +309,7 @@ StorageManagerBase::DropCache(StorageCache* aCache)
 }
 
 nsresult
-StorageManagerBase::GetStorageInternal(bool aCreate,
+StorageManagerBase::GetStorageInternal(CreateMode aCreateMode,
                                        mozIDOMWindow* aWindow,
                                        nsIPrincipal* aPrincipal,
                                        const nsAString& aDocumentURI,
@@ -331,12 +331,12 @@ StorageManagerBase::GetStorageInternal(bool aCreate,
 
   // Get or create a cache for the given scope
   if (!cache) {
-    if (!aCreate) {
+    if (aCreateMode == CreateMode::UseIfExistsNeverCreate) {
       *aRetval = nullptr;
       return NS_OK;
     }
 
-    if (!aRetval) {
+    if (aCreateMode == CreateMode::CreateIfShouldPreload) {
       // This is a demand to just preload the cache, if the scope has
       // no data stored, bypass creation and preload of the cache.
       StorageDBBridge* db = StorageCache::GetDatabase();
@@ -372,10 +372,11 @@ StorageManagerBase::GetStorageInternal(bool aCreate,
 }
 
 NS_IMETHODIMP
-StorageManagerBase::PrecacheStorage(nsIPrincipal* aPrincipal)
+StorageManagerBase::PrecacheStorage(nsIPrincipal* aPrincipal,
+                                    nsIDOMStorage** aRetval)
 {
-  return GetStorageInternal(true, nullptr, aPrincipal, EmptyString(), false,
-                            nullptr);
+  return GetStorageInternal(CreateMode::CreateIfShouldPreload, nullptr,
+                            aPrincipal, EmptyString(), false, aRetval);
 }
 
 NS_IMETHODIMP
@@ -385,8 +386,8 @@ StorageManagerBase::CreateStorage(mozIDOMWindow* aWindow,
                                   bool aPrivate,
                                   nsIDOMStorage** aRetval)
 {
-  return GetStorageInternal(true, aWindow, aPrincipal, aDocumentURI, aPrivate,
-                            aRetval);
+  return GetStorageInternal(CreateMode::CreateAlways, aWindow, aPrincipal,
+                            aDocumentURI, aPrivate, aRetval);
 }
 
 NS_IMETHODIMP
@@ -395,8 +396,8 @@ StorageManagerBase::GetStorage(mozIDOMWindow* aWindow,
                                bool aPrivate,
                                nsIDOMStorage** aRetval)
 {
-  return GetStorageInternal(false, aWindow, aPrincipal, EmptyString(), aPrivate,
-                            aRetval);
+  return GetStorageInternal(CreateMode::UseIfExistsNeverCreate, aWindow,
+                            aPrincipal, EmptyString(), aPrivate, aRetval);
 }
 
 NS_IMETHODIMP
diff --git a/dom/storage/StorageManager.h b/dom/storage/StorageManager.h
index 84ec05be7e95..247c7fc72049 100644
--- a/dom/storage/StorageManager.h
+++ b/dom/storage/StorageManager.h
@@ -90,8 +90,17 @@ private:
                                           const nsACString& aOriginNoSuffix,
                                           nsIPrincipal* aPrincipal);
 
+  enum class CreateMode {
+    // GetStorage: do not create if it's not already in memory.
+    UseIfExistsNeverCreate,
+    // CreateStorage: Create it if it's not already in memory.
+    CreateAlways,
+    // PrecacheStorage: Create only if the database says we ShouldPreloadOrigin.
+    CreateIfShouldPreload
+  };
+
   // Helper for creation of DOM storage objects
-  nsresult GetStorageInternal(bool aCreate,
+  nsresult GetStorageInternal(CreateMode aCreate,
                               mozIDOMWindow* aWindow,
                               nsIPrincipal* aPrincipal,
                               const nsAString& aDocumentURI,
diff --git a/dom/tests/browser/browser.ini b/dom/tests/browser/browser.ini
index 5df4446ae8eb..036761a2bcf6 100644
--- a/dom/tests/browser/browser.ini
+++ b/dom/tests/browser/browser.ini
@@ -2,6 +2,7 @@
 support-files =
   browser_frame_elements.html
   page_privatestorageevent.html
+  page_localstorage_e10s.html
   position.html
   test-console-api.html
   test_bug1004814.html
@@ -43,6 +44,8 @@ skip-if = e10s
 skip-if = !e10s || os != "win" || processor != "x86" # Large-Allocation requires e10s
 [browser_largeAllocation_non_win32.js]
 skip-if = !e10s || (os == "win" && processor == "x86") # Large-Allocation requires e10s
+[browser_localStorage_e10s.js]
+skip-if = !e10s # This is a test of e10s functionality.
 [browser_localStorage_privatestorageevent.js]
 [browser_test__content.js]
 [browser_test_focus_after_modal_state.js]
diff --git a/dom/tests/browser/browser_localStorage_e10s.js b/dom/tests/browser/browser_localStorage_e10s.js
new file mode 100644
index 000000000000..d67ad8ddb9f3
--- /dev/null
+++ b/dom/tests/browser/browser_localStorage_e10s.js
@@ -0,0 +1,360 @@
+const HELPER_PAGE_URL =
+  "http://example.com/browser/dom/tests/browser/page_localstorage_e10s.html";
+const HELPER_PAGE_ORIGIN = "http://example.com/";
+
+// Simple tab wrapper abstracting our messaging mechanism;
+class KnownTab {
+  constructor(name, tab) {
+    this.name = name;
+    this.tab = tab;
+  }
+
+  cleanup() {
+    this.tab = null;
+  }
+}
+
+// Simple data structure class to help us track opened tabs and their pids.
+class KnownTabs {
+  constructor() {
+    this.byPid = new Map();
+    this.byName = new Map();
+  }
+
+  cleanup() {
+    this.byPid = null;
+    this.byName = null;
+  }
+}
+
+/**
+ * Open our helper page in a tab in its own content process, asserting that it
+ * really is in its own process.
+ */
+function* openTestTabInOwnProcess(name, knownTabs) {
+  let url = HELPER_PAGE_URL + '?' + encodeURIComponent(name);
+  let tab = yield BrowserTestUtils.openNewForegroundTab(gBrowser, url);
+  let pid = tab.linkedBrowser.frameLoader.tabParent.osPid;
+  ok(!knownTabs.byName.has(name), "tab needs its own name: " + name);
+  ok(!knownTabs.byPid.has(pid), "tab needs to be in its own process: " + pid);
+
+  let knownTab = new KnownTab(name, tab);
+  knownTabs.byPid.set(pid, knownTab);
+  knownTabs.byName.set(name, knownTab);
+  return knownTab;
+}
+
+/**
+ * Close all the tabs we opened.
+ */
+function* cleanupTabs(knownTabs) {
+  for (let knownTab of knownTabs.byName.values()) {
+    yield BrowserTestUtils.removeTab(knownTab.tab);
+    knownTab.cleanup();
+  }
+  knownTabs.cleanup();
+}
+
+/**
+ * Clear the origin's storage so that "OriginsHavingData" will return false for
+ * our origin.  Note that this is only the case for AsyncClear() which is
+ * explicitly issued against a cache, or AsyncClearAll() which we can trigger
+ * by wiping all storage.  However, the more targeted domain clearings that
+ * we can trigger via observer, AsyncClearMatchingOrigin and
+ * AsyncClearMatchingOriginAttributes will not clear the hashtable entry for
+ * the origin.
+ *
+ * So we explicitly access the cache here in the parent for the origin and issue
+ * an explicit clear.  Clearing all storage might be a little easier but seems
+ * like asking for intermittent failures.
+ */
+function clearOriginStorageEnsuringNoPreload() {
+  let principal =
+    Services.scriptSecurityManager.createCodebasePrincipalFromOrigin(
+      HELPER_PAGE_ORIGIN);
+  // We want to use createStorage to force the cache to be created so we can
+  // issue the clear.  It's possible for getStorage to return false but for the
+  // origin preload hash to still have our origin in it.
+  let storage = Services.domStorageManager.createStorage(null, principal, "");
+  storage.clear();
+  // We don't need to wait for anything.  The clear call will have queued the
+  // clear operation on the database thread, and the child process requests
+  // for origins will likewise be answered via the database thread.
+}
+
+function* verifyTabPreload(knownTab, expectStorageExists) {
+  let storageExists = yield ContentTask.spawn(
+    knownTab.tab.linkedBrowser,
+    HELPER_PAGE_ORIGIN,
+    function(origin) {
+      let principal =
+        Services.scriptSecurityManager.createCodebasePrincipalFromOrigin(
+          origin);
+      return !!Services.domStorageManager.getStorage(null, principal);
+    });
+  is(storageExists, expectStorageExists, "Storage existence === preload");
+}
+
+/**
+ * Instruct the given tab to execute the given series of mutations.  For
+ * simplicity, the mutations representation matches the expected events rep.
+ */
+function* mutateTabStorage(knownTab, mutations) {
+  yield ContentTask.spawn(
+    knownTab.tab.linkedBrowser,
+    { mutations },
+    function(args) {
+      return content.wrappedJSObject.mutateStorage(args.mutations);
+    });
+}
+
+/**
+ * Instruct the given tab to add a "storage" event listener and record all
+ * received events.  verifyTabStorageEvents is the corresponding method to
+ * check and assert the recorded events.
+ */
+function* recordTabStorageEvents(knownTab) {
+  yield ContentTask.spawn(
+    knownTab.tab.linkedBrowser,
+    {},
+    function() {
+      return content.wrappedJSObject.listenForStorageEvents();
+    });
+}
+
+/**
+ * Retrieve the current localStorage contents perceived by the tab and assert
+ * that they match the provided expected state.
+ */
+function* verifyTabStorageState(knownTab, expectedState) {
+  let actualState = yield ContentTask.spawn(
+    knownTab.tab.linkedBrowser,
+    {},
+    function() {
+      return content.wrappedJSObject.getStorageState();
+    });
+
+  for (let [expectedKey, expectedValue] of Object.entries(expectedState)) {
+    ok(actualState.hasOwnProperty(expectedKey), "key present: " + expectedKey);
+    is(actualState[expectedKey], expectedValue, "value correct");
+  }
+  for (let actualKey of Object.keys(actualState)) {
+    if (!expectedState.hasOwnProperty(actualKey)) {
+      ok(false, "actual state has key it shouldn't have: " + actualKey);
+    }
+  }
+}
+
+/**
+ * Retrieve and clear the storage events recorded by the tab and assert that
+ * they match the provided expected events.  For simplicity, the expected events
+ * representation is the same as that used by mutateTabStorage.
+ */
+function* verifyTabStorageEvents(knownTab, expectedEvents) {
+  let actualEvents = yield ContentTask.spawn(
+    knownTab.tab.linkedBrowser,
+    {},
+    function() {
+      return content.wrappedJSObject.returnAndClearStorageEvents();
+    });
+
+  is(actualEvents.length, expectedEvents.length, "right number of events");
+  for (let i = 0; i < actualEvents.length; i++) {
+    let [actualKey, actualNewValue, actualOldValue] = actualEvents[i];
+    let [expectedKey, expectedNewValue, expectedOldValue] = expectedEvents[i];
+    is(actualKey, expectedKey, "keys match");
+    is(actualNewValue, expectedNewValue, "new values match");
+    is(actualOldValue, expectedOldValue, "old values match");
+  }
+}
+
+// We spin up a ton of child processes.
+requestLongerTimeout(4);
+
+/**
+ * Verify the basics of our multi-e10s localStorage support.  We are focused on
+ * whitebox testing two things.  When this is being written, broadcast filtering
+ * is not in place, but the test is intended to attempt to verify that its
+ * implementation does not break things.
+ *
+ * 1) That pages see the same localStorage state in a timely fashion when
+ *    engaging in non-conflicting operations.  We are not testing races or
+ *    conflict resolution; the spec does not cover that.
+ *
+ * 2) That there are no edge-cases related to when the Storage instance is
+ *    created for the page or the StorageCache for the origin.  (StorageCache is
+ *    what actually backs the Storage binding exposed to the page.)  This
+ *    matters because the following reasons can exist for them to be created:
+ *    - Preload, on the basis of knowing the origin uses localStorage.  The
+ *      interesting edge case is when we have the same origin open in different
+ *      processes and the origin starts using localStorage when it did not
+ *      before.  Preload will not have instantiated bindings, which could impact
+ *      correctness.
+ *    - The page accessing localStorage for read or write purposes.  This is the
+ *      obvious, boring one.
+ *    - The page adding a "storage" listener.  This is less obvious and
+ *      interacts with the preload edge-case mentioned above.  The page needs to
+ *      hear "storage" events even if the page has not touched localStorage
+ *      itself and its origin had nothing stored in localStorage when the page
+ *      was created.
+ *
+ * We use the same simple child page in all tabs that:
+ * - can be instructed to listen for and record "storage" events
+ * - can be instructed to issue a series of localStorage writes
+ * - can be instructed to return the current entire localStorage contents
+ *
+ * We open the 5 following tabs:
+ * - Open a "writer" tab that does not listen for "storage" events and will
+ *   issue only writes.
+ * - Open a "listener" tab instructed to listen for "storage" events
+ *   immediately.  We expect it to capture all events.
+ * - Open an "reader" tab that does not listen for "storage" events and will
+ *   only issue reads when instructed.
+ * - Open a "lateWriteThenListen" tab that initially does nothing.  We will
+ *   later tell it to issue a write and then listen for events to make sure it
+ *   captures the later events.
+ * - Open "lateOpenSeesPreload" tab after we've done everything and ensure that
+ *   it preloads/precaches the data without us having touched localStorage or
+ *   added an event listener.
+ */
+add_task(function*() {
+  // - Boost process count so all of our tabs get new processes.
+  // Our test wants to assert things about the precache status which is only
+  // populated at process startup and never updated.  (Per analysis at
+  // https://bugzilla.mozilla.org/show_bug.cgi?id=1312022 this still makes
+  // sense.)  https://bugzilla.mozilla.org/show_bug.cgi?id=1312022 introduced
+  // a mechanism for keeping an arbitrary number of processes alive, modifying
+  // all browser chrome tests to keep alive whatever dom.ipc.processCount is set
+  // to.  The mechanism was slightly modified later to be type-based, so now
+  // it's "dom.ipc.keepProcessesAlive.web" we care about.
+  //
+  // Our options for ensuring we get a new process are to either:
+  // 1) Try and push keepalive down to 1 and kill off the processes that are
+  //    already hanging around.
+  // 2) Just bump the process count up enough so that every tab we open will
+  //    get a new process.
+  //
+  // The first option turns out to be hard to get right.  Specifically,
+  // although one can set the keepalive and process counts to 1 and open and
+  // close tabs to try and trigger process termination down to 1, since we don't
+  // know how many processes might exist, we can't reliably listen for observer
+  // notifications of their shutdown to ensure we're avoiding shutdown races.
+  // (If there are races then the processes won't actually be shut down.)  So
+  // it's easiest to just boost the limit.
+  let keepAliveCount =
+    SpecialPowers.getIntPref("dom.ipc.keepProcessesAlive.web", 1);
+  let safeProcessCount = keepAliveCount + 6;
+  info("dom.ipc.keepProcessesAlive.web is " + keepAliveCount + ", boosting " +
+       "process count temporarily to " + safeProcessCount);
+
+  // (There's already one about:blank page open and we open 5 new tabs, so 6
+  // processes.  Actually, 7, just in case.)
+  yield SpecialPowers.pushPrefEnv({
+    set: [
+      ["dom.ipc.processCount", safeProcessCount],
+      ["dom.ipc.processCount.web", safeProcessCount]
+    ]
+  });
+
+  // Ensure that there is no localstorage data or potential false positives for
+  // localstorage preloads by forcing the origin to be cleared prior to the
+  // start of our test.
+  clearOriginStorageEnsuringNoPreload();
+
+  // - Open tabs.  Don't configure any of them yet.
+  const knownTabs = new KnownTabs();
+  const writerTab = yield* openTestTabInOwnProcess("writer", knownTabs);
+  const listenerTab = yield* openTestTabInOwnProcess("listener", knownTabs);
+  const readerTab = yield* openTestTabInOwnProcess("reader", knownTabs);
+  const lateWriteThenListenTab = yield* openTestTabInOwnProcess(
+    "lateWriteThenListen", knownTabs);
+
+  // Sanity check that preloading did not occur in the tabs.
+  yield* verifyTabPreload(writerTab, false);
+  yield* verifyTabPreload(listenerTab, false);
+  yield* verifyTabPreload(readerTab, false);
+
+  // - Configure the tabs.
+  yield* recordTabStorageEvents(listenerTab);
+
+  // - Issue the initial batch of writes and verify.
+  const initialWriteMutations = [
+    //[key (null=clear), newValue (null=delete), oldValue (verification)]
+    ["getsCleared", "1", null],
+    ["alsoGetsCleared", "2", null],
+    [null, null, null],
+    ["stays", "3", null],
+    ["clobbered", "pre", null],
+    ["getsDeletedLater", "4", null],
+    ["getsDeletedImmediately", "5", null],
+    ["getsDeletedImmediately", null, "5"],
+    ["alsoStays", "6", null],
+    ["getsDeletedLater", null, "4"],
+    ["clobbered", "post", "pre"]
+  ];
+  const initialWriteState = {
+    stays: "3",
+    clobbered: "post",
+    alsoStays: "6"
+  };
+
+  yield* mutateTabStorage(writerTab, initialWriteMutations);
+
+  yield* verifyTabStorageState(writerTab, initialWriteState);
+  yield* verifyTabStorageEvents(listenerTab, initialWriteMutations);
+  yield* verifyTabStorageState(listenerTab, initialWriteState);
+  yield* verifyTabStorageState(readerTab, initialWriteState);
+
+  // - Issue second set of writes from lateWriteThenListen
+  const lateWriteMutations = [
+    ["lateStays", "10", null],
+    ["lateClobbered", "latePre", null],
+    ["lateDeleted", "11", null],
+    ["lateClobbered", "lastPost", "latePre"],
+    ["lateDeleted", null, "11"]
+  ];
+  const lateWriteState = Object.assign({}, initialWriteState, {
+    lateStays: "10",
+    lateClobbered: "lastPost"
+  });
+
+  yield* mutateTabStorage(lateWriteThenListenTab, lateWriteMutations);
+  yield* recordTabStorageEvents(lateWriteThenListenTab);
+
+  yield* verifyTabStorageState(writerTab, lateWriteState);
+  yield* verifyTabStorageEvents(listenerTab, lateWriteMutations);
+  yield* verifyTabStorageState(listenerTab, lateWriteState);
+  yield* verifyTabStorageState(readerTab, lateWriteState);
+
+  // - Issue last set of writes from writerTab.
+  const lastWriteMutations = [
+    ["lastStays", "20", null],
+    ["lastDeleted", "21", null],
+    ["lastClobbered", "lastPre", null],
+    ["lastClobbered", "lastPost", "lastPre"],
+    ["lastDeleted", null, "21"]
+  ];
+  const lastWriteState = Object.assign({}, lateWriteState, {
+    lastStays: "20",
+    lastClobbered: "lastPost"
+  });
+
+  yield* mutateTabStorage(writerTab, lastWriteMutations);
+
+  yield* verifyTabStorageState(writerTab, lastWriteState);
+  yield* verifyTabStorageEvents(listenerTab, lastWriteMutations);
+  yield* verifyTabStorageState(listenerTab, lastWriteState);
+  yield* verifyTabStorageState(readerTab, lastWriteState);
+  yield* verifyTabStorageEvents(lateWriteThenListenTab, lastWriteMutations);
+  yield* verifyTabStorageState(lateWriteThenListenTab, lastWriteState);
+
+  // - Open a fresh tab and make sure it sees the precache/preload
+  const lateOpenSeesPreload =
+    yield* openTestTabInOwnProcess("lateOpenSeesPreload", knownTabs);
+  yield* verifyTabPreload(lateOpenSeesPreload, true);
+
+  // - Clean up.
+  yield* cleanupTabs(knownTabs);
+
+  clearOriginStorageEnsuringNoPreload();
+});
diff --git a/dom/tests/browser/page_localstorage_e10s.html b/dom/tests/browser/page_localstorage_e10s.html
new file mode 100644
index 000000000000..88025dfc931a
--- /dev/null
+++ b/dom/tests/browser/page_localstorage_e10s.html
@@ -0,0 +1,56 @@
+<!doctype html>
+<html>
+<head>
+  <meta charset="utf-8">
+<script>
+/**
+ * Helper page used by browser_localStorage_e10s.js.
+ **/
+var pageName = document.location.search.substring(1);
+window.addEventListener(
+  "load",
+  () => { document.getElementById("pageNameH").textContent = pageName; });
+
+var recordedEvents = null;
+function storageListener(event) {
+  recordedEvents.push([event.key, event.newValue, event.oldValue]);
+}
+
+function listenForStorageEvents() {
+  recordedEvents = [];
+  window.addEventListener("storage", storageListener);
+}
+
+function mutateStorage(mutations) {
+  mutations.forEach(function([key, value]) {
+    if (key !== null) {
+      if (value === null) {
+        localStorage.removeItem(key);
+      } else {
+        localStorage.setItem(key, value);
+      }
+    } else {
+      localStorage.clear();
+    }
+  });
+}
+
+function getStorageState() {
+  let numKeys = localStorage.length;
+  let state = {};
+  for (var iKey = 0; iKey < numKeys; iKey++) {
+    let key = localStorage.key(iKey);
+    state[key] = localStorage.getItem(key);
+  }
+  return state;
+}
+
+function returnAndClearStorageEvents() {
+  let loggedEvents = recordedEvents;
+  recordedEvents = [];
+  return loggedEvents;
+}
+</script>
+</head>
+<body><h2 id="pageNameH"></h2></body>
+</html>
diff --git a/editor/libeditor/tests/test_bug674770-1.html b/editor/libeditor/tests/test_bug674770-1.html
index 4ba65f507f0f..f2e65b2b91cd 100644
--- a/editor/libeditor/tests/test_bug674770-1.html
+++ b/editor/libeditor/tests/test_bug674770-1.html
@@ -24,7 +24,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=674770
 
 SimpleTest.waitForExplicitFinish();
 SimpleTest.waitForFocus(function() {
-  SpecialPowers.pushPrefEnv({"set":[["middlemouse.paste", true], ["dom.ipc.processCount", 1]]}, startTests);
+  SpecialPowers.pushPrefEnv({"set":[["middlemouse.paste", true]]}, startTests);
 });
 
 function startTests() {
diff --git a/extensions/auth/nsHttpNegotiateAuth.cpp b/extensions/auth/nsHttpNegotiateAuth.cpp
index 8b03f815c5ca..437fa69a7245 100644
--- a/extensions/auth/nsHttpNegotiateAuth.cpp
+++ b/extensions/auth/nsHttpNegotiateAuth.cpp
@@ -33,6 +33,9 @@
 #include "plbase64.h"
 #include "plstr.h"
 #include "mozilla/Logging.h"
+#include "mozilla/Tokenizer.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Unused.h"
 #include "prmem.h"
 #include "prnetdb.h"
 #include "mozilla/Likely.h"
@@ -43,6 +46,7 @@
 #include "nsIHttpAuthenticatorCallback.h"
 #include "mozilla/Mutex.h"
 #include "nsICancelable.h"
+#include "nsUnicharUtils.h"
 
 //-----------------------------------------------------------------------------
 
@@ -633,13 +637,20 @@ nsHttpNegotiateAuth::TestPref(nsIURI *uri, const char *pref)
         return false;
     if (NS_FAILED(uri->GetAsciiHost(host)))
         return false;
-    if (NS_FAILED(uri->GetPort(&port)))
+
+    port = NS_GetRealPort(uri);
+    if (port == -1) {
         return false;
+    }
 
     char *hostList;
     if (NS_FAILED(prefs->GetCharPref(pref, &hostList)) || !hostList)
         return false;
 
+    struct FreePolicy { void operator()(void* p) { free(p); } };
+    mozilla::UniquePtr<char[], FreePolicy> hostListScope;
+    hostListScope.reset(hostList);
+
     // pseudo-BNF
     // ----------
     //
@@ -652,24 +663,19 @@ nsHttpNegotiateAuth::TestPref(nsIURI *uri, const char *pref)
     //   "https://, http://office.foo.com"
     //
 
-    char *start = hostList, *end;
-    for (;;) {
-        // skip past any whitespace
-        while (*start == ' ' || *start == '\t')
-            ++start;
-        end = strchr(start, ',');
-        if (!end)
-            end = start + strlen(start);
-        if (start == end)
-            break;
-        if (MatchesBaseURI(scheme, host, port, start, end))
+    mozilla::Tokenizer t(hostList);
+    while (!t.CheckEOF()) {
+        t.SkipWhites();
+        nsDependentCSubstring url;
+        mozilla::Unused << t.ReadUntil(mozilla::Tokenizer::Token::Char(','), url);
+        if (url.IsEmpty()) {
+            continue;
+        }
+        if (MatchesBaseURI(scheme, host, port, url)) {
             return true;
-        if (*end == '\0')
-            break;
-        start = end + 1;
+        }
     }
-    
-    free(hostList);
+
     return false;
 }
 
@@ -677,54 +683,90 @@ bool
 nsHttpNegotiateAuth::MatchesBaseURI(const nsCSubstring &matchScheme,
                                     const nsCSubstring &matchHost,
                                     int32_t             matchPort,
-                                    const char         *baseStart,
-                                    const char         *baseEnd)
+                                    nsDependentCSubstring const& url)
 {
-    // check if scheme://host:port matches baseURI
+  // check if scheme://host:port matches baseURI
 
-    // parse the base URI
-    const char *hostStart, *schemeEnd = strstr(baseStart, "://");
-    if (schemeEnd) {
-        // the given scheme must match the parsed scheme exactly
-        if (!matchScheme.Equals(Substring(baseStart, schemeEnd)))
-            return false;
-        hostStart = schemeEnd + 3;
-    }
-    else
-        hostStart = baseStart;
+  // parse the base URI
+  mozilla::Tokenizer t(url);
+  mozilla::Tokenizer::Token token;
 
-    // XXX this does not work for IPv6-literals
-    const char *hostEnd = strchr(hostStart, ':');
-    if (hostEnd && hostEnd < baseEnd) {
-        // the given port must match the parsed port exactly
-        int port = atoi(hostEnd + 1);
-        if (matchPort != (int32_t) port)
-            return false;
-    }
-    else
-        hostEnd = baseEnd;
+  t.SkipWhites();
 
+  // We don't know if the url to check against starts with scheme
+  // or a host name.  Start recording here.
+  t.Record();
 
-    // if we didn't parse out a host, then assume we got a match.
-    if (hostStart == hostEnd)
-        return true;
+  mozilla::Unused << t.Next(token);
 
-    uint32_t hostLen = hostEnd - hostStart;
-
-    // matchHost must either equal host or be a subdomain of host
-    if (matchHost.Length() < hostLen)
-        return false;
-
-    const char *end = matchHost.EndReading();
-    if (PL_strncasecmp(end - hostLen, hostStart, hostLen) == 0) {
-        // if matchHost ends with host from the base URI, then make sure it is
-        // either an exact match, or prefixed with a dot.  we don't want
-        // "foobar.com" to match "bar.com"
-        if (matchHost.Length() == hostLen ||
-            *(end - hostLen) == '.' ||
-            *(end - hostLen - 1) == '.')
-            return true;
+  // The ipv6 literals MUST be enclosed with [] in the preference.
+  bool ipv6 = false;
+  if (token.Equals(mozilla::Tokenizer::Token::Char('['))) {
+    nsDependentCSubstring ipv6BareLiteral;
+    if (!t.ReadUntil(mozilla::Tokenizer::Token::Char(']'), ipv6BareLiteral)) {
+      // Broken ipv6 literal
+      return false;
     }
 
-    return false;
+    nsDependentCSubstring ipv6Literal;
+    t.Claim(ipv6Literal, mozilla::Tokenizer::INCLUDE_LAST);
+    if (!matchHost.Equals(ipv6Literal, nsCaseInsensitiveUTF8StringComparator()) &&
+        !matchHost.Equals(ipv6BareLiteral, nsCaseInsensitiveUTF8StringComparator())) {
+      return false;
+    }
+
+    ipv6 = true;
+  } else if (t.CheckChar(':') && t.CheckChar('/') && t.CheckChar('/')) {
+    if (!matchScheme.Equals(token.Fragment())) {
+      return false;
+    }
+    // Re-start recording the hostname from the point after scheme://.
+    t.Record();
+  }
+
+  while (t.Next(token)) {
+    bool eof = token.Equals(mozilla::Tokenizer::Token::EndOfFile());
+    bool port = token.Equals(mozilla::Tokenizer::Token::Char(':'));
+
+    if (eof || port) {
+      if (!ipv6) { // Match already performed above.
+        nsDependentCSubstring hostName;
+        t.Claim(hostName);
+
+        // An empty hostname means to accept everything for the schema
+        if (!hostName.IsEmpty()) {
+          if (hostName.First() == '.') {
+            if (!StringEndsWith(matchHost, hostName, nsCaseInsensitiveUTF8StringComparator())) {
+              return false;
+            }
+          } else { // host to match doesn't begin with '.', do a full compare
+            if (!matchHost.Equals(hostName, nsCaseInsensitiveUTF8StringComparator())) {
+              return false;
+            }
+          }
+        }
+      }
+
+      if (port) {
+        uint16_t portNumber;
+        if (!t.ReadInteger(&portNumber)) {
+          // Missing port number
+          return false;
+        }
+        if (matchPort != portNumber) {
+          return false;
+        }
+        if (!t.CheckEOF()) {
+          return false;
+        }
+      }
+    } else if (ipv6) {
+      // After an ipv6 literal there can only be EOF or :port.  Everything else
+      // must be treated as non-match/broken input.
+      return false;
+    }
+  }
+
+  // All negative checks has passed positively.
+  return true;
 }
diff --git a/extensions/auth/nsHttpNegotiateAuth.h b/extensions/auth/nsHttpNegotiateAuth.h
index 4c84616d856f..6e22936c21ba 100644
--- a/extensions/auth/nsHttpNegotiateAuth.h
+++ b/extensions/auth/nsHttpNegotiateAuth.h
@@ -34,10 +34,9 @@ private:
     bool TestPref(nsIURI *, const char *pref);
 
     bool MatchesBaseURI(const nsCSubstring &scheme,
-                          const nsCSubstring &host,
-                          int32_t             port,
-                          const char         *baseStart,
-                          const char         *baseEnd);
+                        const nsCSubstring &host,
+                        int32_t             port,
+                        nsDependentCSubstring const& url);
     // Thread for GenerateCredentialsAsync
     RefPtr<mozilla::LazyIdleThread> mNegotiateThread;
 };
diff --git a/extensions/pref/autoconfig/src/nsJSConfigTriggers.cpp b/extensions/pref/autoconfig/src/nsJSConfigTriggers.cpp
index 87f2bef20f8a..33b81da568ad 100644
--- a/extensions/pref/autoconfig/src/nsJSConfigTriggers.cpp
+++ b/extensions/pref/autoconfig/src/nsJSConfigTriggers.cpp
@@ -130,7 +130,7 @@ nsresult EvaluateAdminConfigScript(const char *js_buffer, size_t length,
         return NS_ERROR_UNEXPECTED;
     }
     rv = xpc->EvalInSandboxObject(convertedScript, filename, cx,
-                                  autoconfigSb, JSVERSION_LATEST, &v);
+                                  autoconfigSb, &v);
     NS_ENSURE_SUCCESS(rv, rv);
 
     return NS_OK;
diff --git a/gfx/2d/SourceSurfaceSkia.cpp b/gfx/2d/SourceSurfaceSkia.cpp
index 4619208a9803..3f242eaf9356 100644
--- a/gfx/2d/SourceSurfaceSkia.cpp
+++ b/gfx/2d/SourceSurfaceSkia.cpp
@@ -40,14 +40,36 @@ SourceSurfaceSkia::GetFormat() const
   return mFormat;
 }
 
+static sk_sp<SkData>
+MakeSkData(unsigned char* aData, const IntSize& aSize, int32_t aStride)
+{
+  CheckedInt<size_t> size = aStride;
+  size *= aSize.height;
+  if (size.isValid()) {
+    void* mem = sk_malloc_flags(size.value(), 0);
+    if (mem) {
+      if (aData) {
+        memcpy(mem, aData, size.value());
+      }
+      return SkData::MakeFromMalloc(mem, size.value());
+    }
+  }
+  return nullptr;
+}
+
 bool
 SourceSurfaceSkia::InitFromData(unsigned char* aData,
                                 const IntSize &aSize,
                                 int32_t aStride,
                                 SurfaceFormat aFormat)
 {
-  SkPixmap pixmap(MakeSkiaImageInfo(aSize, aFormat), aData, aStride);
-  mImage = SkImage::MakeRasterCopy(pixmap);
+  sk_sp<SkData> data = MakeSkData(aData, aSize, aStride);
+  if (!data) {
+    return false;
+  }
+
+  SkImageInfo info = MakeSkiaImageInfo(aSize, aFormat);
+  mImage = SkImage::MakeRasterData(info, data, aStride);
   if (!mImage) {
     return false;
   }
@@ -106,14 +128,10 @@ SourceSurfaceSkia::GetData()
 #ifdef USE_SKIA_GPU
   if (mImage->isTextureBacked()) {
     sk_sp<SkImage> raster;
-    CheckedInt<size_t> size = mStride;
-    size *= mSize.height;
-    if (size.isValid()) {
-      if (sk_sp<SkData> data = SkData::MakeUninitialized(size.value())) {
-        SkImageInfo info = MakeSkiaImageInfo(mSize, mFormat);
-        if (mImage->readPixels(info, data->writable_data(), mStride, 0, 0, SkImage::kDisallow_CachingHint)) {
-          raster = SkImage::MakeRasterData(info, data, mStride);
-        }
+    if (sk_sp<SkData> data = MakeSkData(nullptr, mSize, mStride)) {
+      SkImageInfo info = MakeSkiaImageInfo(mSize, mFormat);
+      if (mImage->readPixels(info, data->writable_data(), mStride, 0, 0, SkImage::kDisallow_CachingHint)) {
+        raster = SkImage::MakeRasterData(info, data, mStride);
       }
     }
     if (raster) {
diff --git a/gfx/gl/GLLibraryEGL.cpp b/gfx/gl/GLLibraryEGL.cpp
index f992d69b9015..5d09c719a821 100644
--- a/gfx/gl/GLLibraryEGL.cpp
+++ b/gfx/gl/GLLibraryEGL.cpp
@@ -51,7 +51,8 @@ static const char* sEGLExtensionNames[] = {
     "EGL_ANDROID_native_fence_sync",
     "EGL_ANDROID_image_crop",
     "EGL_ANGLE_platform_angle",
-    "EGL_ANGLE_platform_angle_d3d"
+    "EGL_ANGLE_platform_angle_d3d",
+    "EGL_ANGLE_d3d_share_handle_client_buffer"
 };
 
 #if defined(ANDROID)
@@ -414,6 +415,7 @@ GLLibraryEGL::EnsureInitialized(bool forceAccel, nsACString* const out_failureId
         SYMBOL(BindTexImage),
         SYMBOL(ReleaseTexImage),
         SYMBOL(QuerySurface),
+        SYMBOL(CreatePbufferFromClientBuffer),
         { nullptr, { nullptr } }
     };
 
diff --git a/gfx/gl/GLLibraryEGL.h b/gfx/gl/GLLibraryEGL.h
index fa6ea748b6fe..eba3e390d1ad 100644
--- a/gfx/gl/GLLibraryEGL.h
+++ b/gfx/gl/GLLibraryEGL.h
@@ -133,6 +133,7 @@ public:
         mSymbols.fDestroySurface = nullptr;
         mSymbols.fCreateWindowSurface = nullptr;
         mSymbols.fCreatePbufferSurface = nullptr;
+        mSymbols.fCreatePbufferFromClientBuffer = nullptr;
         mSymbols.fCreatePixmapSurface = nullptr;
         mSymbols.fBindAPI = nullptr;
         mSymbols.fInitialize = nullptr;
@@ -185,6 +186,7 @@ public:
         EGL_ANDROID_image_crop,
         ANGLE_platform_angle,
         ANGLE_platform_angle_d3d,
+        ANGLE_d3d_share_handle_client_buffer,
         Extensions_Max
     };
 
@@ -289,6 +291,14 @@ public:
         return surf;
     }
 
+    EGLSurface fCreatePbufferFromClientBuffer(EGLDisplay dpy, EGLenum buftype, EGLClientBuffer buffer, EGLConfig config, const EGLint *attrib_list)
+    {
+        BEFORE_GL_CALL;
+        EGLSurface ret = mSymbols.fCreatePbufferFromClientBuffer(dpy, buftype, buffer, config, attrib_list);
+        AFTER_GL_CALL;
+        return ret;
+    }
+
     EGLSurface fCreatePixmapSurface(EGLDisplay dpy, EGLConfig config, EGLNativePixmapType pixmap, const EGLint* attrib_list)
     {
         BEFORE_GL_CALL;
@@ -585,6 +595,8 @@ public:
         pfnCreateWindowSurface fCreateWindowSurface;
         typedef EGLSurface (GLAPIENTRY * pfnCreatePbufferSurface)(EGLDisplay dpy, EGLConfig config, const EGLint* attrib_list);
         pfnCreatePbufferSurface fCreatePbufferSurface;
+        typedef EGLSurface (GLAPIENTRY * pfnCreatePbufferFromClientBuffer)(EGLDisplay dpy, EGLenum buftype, EGLClientBuffer buffer, EGLConfig config, const EGLint *attrib_list);
+        pfnCreatePbufferFromClientBuffer fCreatePbufferFromClientBuffer;
         typedef EGLSurface (GLAPIENTRY * pfnCreatePixmapSurface)(EGLDisplay dpy, EGLConfig config, EGLNativePixmapType pixmap, const EGLint* attrib_list);
         pfnCreatePixmapSurface fCreatePixmapSurface;
         typedef EGLBoolean (GLAPIENTRY * pfnBindAPI)(EGLenum api);
diff --git a/intl/locale/DateTimeFormat.cpp b/intl/locale/DateTimeFormat.cpp
index 69822a90dc69..c558a0a75443 100644
--- a/intl/locale/DateTimeFormat.cpp
+++ b/intl/locale/DateTimeFormat.cpp
@@ -107,6 +107,8 @@ DateTimeFormat::FormatUDateTime(const nsDateFormatSelector aDateFormatSelector,
       dateStyle = UDAT_SHORT;
       break;
     case kDateFormatYearMonth:
+    case kDateFormatYearMonthLong:
+    case kDateFormatMonthLong:
     case kDateFormatWeekday:
       dateStyle = UDAT_PATTERN;
       break;
@@ -169,7 +171,23 @@ DateTimeFormat::FormatUDateTime(const nsDateFormatSelector aDateFormatSelector,
         }
       }
 
-      nsAutoString skeleton(aDateFormatSelector == kDateFormatYearMonth ? u"yyyyMM " : u"EEE ");
+      nsAutoString skeleton;
+      switch (aDateFormatSelector) {
+      case kDateFormatYearMonth:
+        skeleton.AssignLiteral("yyyyMM ");
+        break;
+      case kDateFormatYearMonthLong:
+        skeleton.AssignLiteral("yyyyMMMM ");
+        break;
+      case kDateFormatMonthLong:
+        skeleton.AssignLiteral("MMMM ");
+        break;
+      case kDateFormatWeekday:
+        skeleton.AssignLiteral("EEE ");
+        break;
+      default:
+        break;
+      }
       int32_t dateSkeletonLen = skeleton.Length();
 
       if (timeStyle != UDAT_NONE) {
diff --git a/intl/locale/nsIScriptableDateFormat.idl b/intl/locale/nsIScriptableDateFormat.idl
index 6bd47037b349..f138d1eaab49 100644
--- a/intl/locale/nsIScriptableDateFormat.idl
+++ b/intl/locale/nsIScriptableDateFormat.idl
@@ -13,6 +13,8 @@ enum
     kDateFormatLong,                // provides the long date format for the given locale
     kDateFormatShort,               // provides the short date format for the given locale
     kDateFormatYearMonth,           // formats using only the year and month 
+    kDateFormatYearMonthLong,       // long version of kDateFormatYearMonth
+    kDateFormatMonthLong,           // long format of month name only
     kDateFormatWeekday              // week day (e.g. Mon, Tue)
 };
 %}
diff --git a/intl/locale/tests/gtest/TestDateTimeFormat.cpp b/intl/locale/tests/gtest/TestDateTimeFormat.cpp
index 5f2e20c7967d..a433961049fe 100644
--- a/intl/locale/tests/gtest/TestDateTimeFormat.cpp
+++ b/intl/locale/tests/gtest/TestDateTimeFormat.cpp
@@ -58,6 +58,14 @@ TEST(DateTimeFormat, DateFormatSelectors) {
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_STREQ("01/1970", NS_ConvertUTF16toUTF8(formattedTime).get());
 
+  rv = mozilla::DateTimeFormat::FormatPRExplodedTime(kDateFormatYearMonthLong, kTimeFormatNone, &prExplodedTime, formattedTime);
+  ASSERT_TRUE(NS_SUCCEEDED(rv));
+  ASSERT_STREQ("January 1970", NS_ConvertUTF16toUTF8(formattedTime).get());
+
+  rv = mozilla::DateTimeFormat::FormatPRExplodedTime(kDateFormatMonthLong, kTimeFormatNone, &prExplodedTime, formattedTime);
+  ASSERT_TRUE(NS_SUCCEEDED(rv));
+  ASSERT_STREQ("January", NS_ConvertUTF16toUTF8(formattedTime).get());
+
   rv = mozilla::DateTimeFormat::FormatPRExplodedTime(kDateFormatYearMonth, kTimeFormatNoSeconds, &prExplodedTime, formattedTime);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_STREQ("01/1970, 12:00 AM", NS_ConvertUTF16toUTF8(formattedTime).get());
diff --git a/ipc/glue/ProtocolUtils.cpp b/ipc/glue/ProtocolUtils.cpp
index d91833af410a..8d19095fd767 100644
--- a/ipc/glue/ProtocolUtils.cpp
+++ b/ipc/glue/ProtocolUtils.cpp
@@ -545,6 +545,22 @@ IProtocol::SetEventTargetForActorInternal(IProtocol* aActor,
   Manager()->SetEventTargetForActorInternal(aActor, aEventTarget);
 }
 
+nsIEventTarget*
+IProtocol::GetActorEventTarget()
+{
+  // We should only call this function when this actor has been registered and
+  // is not unregistered yet.
+  MOZ_RELEASE_ASSERT(mId != kNullActorId && mId != kFreedActorId);
+  RefPtr<nsIEventTarget> target = Manager()->GetActorEventTargetInternal(this);
+  return target;
+}
+
+already_AddRefed<nsIEventTarget>
+IProtocol::GetActorEventTargetInternal(IProtocol* aActor)
+{
+  return Manager()->GetActorEventTargetInternal(aActor);
+}
+
 IToplevelProtocol::IToplevelProtocol(ProtocolId aProtoId, Side aSide)
  : IProtocol(aSide),
    mProtocolId(aProtoId),
@@ -802,7 +818,7 @@ IToplevelProtocol::GetMessageEventTarget(const Message& aMsg)
 }
 
 already_AddRefed<nsIEventTarget>
-IToplevelProtocol::GetActorEventTarget(IProtocol* aActor)
+IToplevelProtocol::GetActorEventTargetInternal(IProtocol* aActor)
 {
   MOZ_RELEASE_ASSERT(aActor->Id() != kNullActorId && aActor->Id() != kFreedActorId);
 
@@ -811,10 +827,26 @@ IToplevelProtocol::GetActorEventTarget(IProtocol* aActor)
   return target.forget();
 }
 
+already_AddRefed<nsIEventTarget>
+IToplevelProtocol::GetActorEventTarget(IProtocol* aActor)
+{
+  return GetActorEventTargetInternal(aActor);
+}
+
+nsIEventTarget*
+IToplevelProtocol::GetActorEventTarget()
+{
+  // The EventTarget of a ToplevelProtocol shall never be set.
+  return nullptr;
+}
+
 void
 IToplevelProtocol::SetEventTargetForActorInternal(IProtocol* aActor,
                                                   nsIEventTarget* aEventTarget)
 {
+  // The EventTarget of a ToplevelProtocol shall never be set.
+  MOZ_RELEASE_ASSERT(aActor != this);
+
   // We should only call this function on actors that haven't been used for IPC
   // code yet. Otherwise we'll be posting stuff to the wrong event target before
   // we're called.
diff --git a/ipc/glue/ProtocolUtils.h b/ipc/glue/ProtocolUtils.h
index 362e60304ce2..5f87ea9346cb 100644
--- a/ipc/glue/ProtocolUtils.h
+++ b/ipc/glue/ProtocolUtils.h
@@ -189,6 +189,9 @@ public:
     // aActor.
     void SetEventTargetForActor(IProtocol* aActor, nsIEventTarget* aEventTarget);
 
+    // Returns the event target set by SetEventTargetForActor() if available.
+    virtual nsIEventTarget* GetActorEventTarget();
+
 protected:
     friend class IToplevelProtocol;
 
@@ -198,6 +201,9 @@ protected:
 
     virtual void SetEventTargetForActorInternal(IProtocol* aActor, nsIEventTarget* aEventTarget);
 
+    virtual already_AddRefed<nsIEventTarget>
+    GetActorEventTargetInternal(IProtocol* aActor);
+
     static const int32_t kNullActorId = 0;
     static const int32_t kFreedActorId = 1;
 
@@ -365,12 +371,18 @@ public:
     already_AddRefed<nsIEventTarget>
     GetActorEventTarget(IProtocol* aActor);
 
+    virtual nsIEventTarget*
+    GetActorEventTarget();
+
 protected:
     virtual already_AddRefed<nsIEventTarget>
     GetConstructedEventTarget(const Message& aMsg) { return nullptr; }
 
     virtual void SetEventTargetForActorInternal(IProtocol* aActor, nsIEventTarget* aEventTarget);
 
+    virtual already_AddRefed<nsIEventTarget>
+    GetActorEventTargetInternal(IProtocol* aActor);
+
   private:
     ProtocolId mProtocolId;
     UniquePtr<Transport> mTrans;
diff --git a/ipc/ipdl/Makefile.in b/ipc/ipdl/Makefile.in
index 4002c997872a..f24c03ea859d 100644
--- a/ipc/ipdl/Makefile.in
+++ b/ipc/ipdl/Makefile.in
@@ -19,6 +19,7 @@ ipdl: $(ALL_IPDLSRCS)
 	$(PYTHON) $(topsrcdir)/config/pythonpath.py \
 	  $(PLY_INCLUDE) \
 	  $(srcdir)/ipdl.py \
+	  --sync-msg-list=$(srcdir)/sync-messages.ini \
 	  --outheaders-dir=_ipdlheaders \
 	  --outcpp-dir=. \
 	  $(IPDLDIRS:%=-I%) \
diff --git a/ipc/ipdl/ipdl.py b/ipc/ipdl/ipdl.py
index 7cb19f283e48..abd5d024e7d4 100755
--- a/ipc/ipdl/ipdl.py
+++ b/ipc/ipdl/ipdl.py
@@ -7,6 +7,7 @@ from cStringIO import StringIO
 from mozbuild.pythonutil import iter_modules_in_path
 import mozpack.path as mozpath
 import itertools
+from ConfigParser import RawConfigParser
 
 import ipdl
 
@@ -20,6 +21,8 @@ op = optparse.OptionParser(usage='ipdl.py [options] IPDLfiles...')
 op.add_option('-I', '--include', dest='includedirs', default=[ ],
               action='append',
               help='Additional directory to search for included protocol specifications')
+op.add_option('-s', '--sync-msg-list', dest='syncMsgList', default='sync-messages.ini',
+              help="Config file listing allowed sync messages")
 op.add_option('-v', '--verbose', dest='verbosity', default=1, action='count',
               help='Verbose logging (specify -vv or -vvv for very verbose logging)')
 op.add_option('-q', '--quiet', dest='verbosity', action='store_const', const=0,
@@ -35,9 +38,9 @@ A protocol Foo in the namespace bar will cause the sources
   cppdir/FooParent.cpp, cppdir/FooChild.cpp
 to be generated""")
 
-
 options, files = op.parse_args()
 _verbosity = options.verbosity
+syncMsgList = options.syncMsgList
 headersdir = options.headersdir
 cppdir = options.cppdir
 includedirs = [ os.path.abspath(incdir) for incdir in options.includedirs ]
@@ -113,6 +116,11 @@ def normalizedFilename(f):
         return '<stdin>'
     return f
 
+log(2, 'Reading sync message list')
+parser = RawConfigParser()
+parser.readfp(open(options.syncMsgList))
+syncMsgList = parser.sections()
+
 # First pass: parse and type-check all protocols
 for f in files:
     log(2, os.path.basename(f))
@@ -135,6 +143,10 @@ for f in files:
         print >>sys.stderr, 'Specification is not well typed.'
         sys.exit(1)
 
+    if not ipdl.checkSyncMessage(ast, syncMsgList):
+        print >>sys.stderr, 'Error: New sync IPC messages must be reviewed by an IPC peer and recorded in %s' % options.syncMsgList
+        sys.exit(1)
+
     if _verbosity > 2:
         log(3, '  pretty printed code:')
         ipdl.genipdl(ast, codedir)
diff --git a/ipc/ipdl/ipdl/__init__.py b/ipc/ipdl/ipdl/__init__.py
index c50827e127e6..726989ec0df4 100644
--- a/ipc/ipdl/ipdl/__init__.py
+++ b/ipc/ipdl/ipdl/__init__.py
@@ -2,7 +2,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-__all__ = [ 'gencxx', 'genipdl', 'parse', 'typecheck', 'writeifmodified' ]
+__all__ = [ 'gencxx', 'genipdl', 'parse', 'typecheck', 'writeifmodified', 'checkSyncMessage' ]
 
 import os, sys
 from cStringIO import StringIO
@@ -11,6 +11,7 @@ from ipdl.cgen import IPDLCodeGen
 from ipdl.lower import LowerToCxx, msgenums
 from ipdl.parser import Parser, ParseError
 from ipdl.type import TypeCheck
+from ipdl.checker import checkSyncMessage
 
 from ipdl.cxx.cgen import CxxCodeGen
 
diff --git a/ipc/ipdl/ipdl/checker.py b/ipc/ipdl/ipdl/checker.py
new file mode 100644
index 000000000000..7ce755e926b0
--- /dev/null
+++ b/ipc/ipdl/ipdl/checker.py
@@ -0,0 +1,43 @@
+# vim: set ts=4 sw=4 tw=99 et:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import sys
+from ipdl.ast import Visitor, ASYNC
+
+class SyncMessageChecker(Visitor):
+    def __init__(self, syncMsgList):
+        self.syncMsgList = syncMsgList
+        self.errors = []
+
+    def prettyMsgName(self, msg):
+        return "%s::%s" % (self.currentProtocol, msg)
+
+    def errorUnknownSyncMessage(self, loc, msg):
+        self.errors.append('%s: error: Unknown sync IPC message %s' %
+                           (str(loc), msg))
+
+    def errorAsyncMessageCanRemove(self, loc, msg):
+        self.errors.append('%s: error: IPC message %s is async, can be delisted' %
+                           (str(loc), msg))
+
+    def visitProtocol(self, p):
+        self.currentProtocol = p.name
+        Visitor.visitProtocol(self, p)
+
+    def visitMessageDecl(self, md):
+        pn = self.prettyMsgName(md.name)
+        if md.sendSemantics is not ASYNC and pn not in self.syncMsgList:
+            self.errorUnknownSyncMessage(md.loc, pn)
+        if md.sendSemantics is ASYNC and pn in self.syncMsgList:
+            self.errorAsyncMessageCanRemove(md.loc, pn)
+
+def checkSyncMessage(tu, syncMsgList, errout=sys.stderr):
+    checker = SyncMessageChecker(syncMsgList)
+    tu.accept(checker)
+    if len(checker.errors):
+        for error in checker.errors:
+            print >>errout, error
+        return False
+    return True
diff --git a/ipc/ipdl/sync-messages.ini b/ipc/ipdl/sync-messages.ini
new file mode 100644
index 000000000000..19a253893a4e
--- /dev/null
+++ b/ipc/ipdl/sync-messages.ini
@@ -0,0 +1,1013 @@
+#############################################################
+#                                                           #
+# Any changes to this file must be reviewed by an IPC peer. #
+#                                                           #
+#############################################################
+
+# C++ unit tests
+[PTestBadActorSub::__delete__]
+description =
+[PTestCancel::Test1_1]
+description =
+[PTestCancel::Test2_2]
+description =
+[PTestCancel::Test2_1]
+description =
+[PTestCancel::Test3_1]
+description =
+[PTestCancel::Test3_2]
+description =
+[PTestCancel::CheckChild]
+description =
+[PTestCancel::CheckParent]
+description =
+[PTestCrashCleanup::DIEDIEDIE]
+description =
+[PTestDataStructures::Test1]
+description =
+[PTestDataStructures::Test2]
+description =
+[PTestDataStructures::Test3]
+description =
+[PTestDataStructures::Test4]
+description =
+[PTestDataStructures::Test5]
+description =
+[PTestDataStructures::Test6]
+description =
+[PTestDataStructures::Test7_0]
+description =
+[PTestDataStructures::Test7]
+description =
+[PTestDataStructures::Test8]
+description =
+[PTestDataStructures::Test9]
+description =
+[PTestDataStructures::Test10]
+description =
+[PTestDataStructures::Test11]
+description =
+[PTestDataStructures::Test12]
+description =
+[PTestDataStructures::Test13]
+description =
+[PTestDataStructures::Test14]
+description =
+[PTestDataStructures::Test15]
+description =
+[PTestDataStructures::Test16]
+description =
+[PTestDataStructures::Test17]
+description =
+[PTestDataStructures::Test18]
+description =
+[PTestDataStructures::Dummy]
+description =
+[PTestDataStructuresSub::__delete__]
+description =
+[PTestDemon::HiPrioSyncMessage]
+description =
+[PTestDemon::SyncMessage]
+description =
+[PTestDemon::UrgentSyncMessage]
+description =
+[PTestDesc::PTestDescSub]
+description =
+[PTestDescSub::PTestDescSubsub]
+description =
+[PTestDescSubsub::__delete__]
+description =
+[PTestEndpointBridgeMainSub::HiRpc]
+description =
+[PTestEndpointBridgeMainSub::HelloSync]
+description =
+[PTestEndpointBridgeMainSub::HelloRpc]
+description =
+[PTestEndpointOpensOpened::HiRpc]
+description =
+[PTestEndpointOpensOpened::HelloSync]
+description =
+[PTestEndpointOpensOpened::HelloRpc]
+description =
+[PTestFailedCtor::PTestFailedCtorSub]
+description =
+[PTestFailedCtorSub::Sync]
+description =
+[PTestHangs::StackFrame]
+description =
+[PTestHangs::Hang]
+description =
+[PTestHighestPrio::Msg2]
+description =
+[PTestHighestPrio::Msg4]
+description =
+[PTestHighestPrio::StartInner]
+description =
+[PTestIndirectProtocolParamFirst::Test]
+description =
+[PTestInterruptErrorCleanup::Error]
+description =
+[PTestInterruptErrorCleanup::__delete__]
+description =
+[PTestInterruptRaces::Race]
+description =
+[PTestInterruptRaces::StackFrame]
+description =
+[PTestInterruptRaces::StackFrame3]
+description =
+[PTestInterruptRaces::StartRace]
+description =
+[PTestInterruptRaces::Parent]
+description =
+[PTestInterruptRaces::GetAnsweredParent]
+description =
+[PTestInterruptRaces::Child]
+description =
+[PTestInterruptShutdownRace::StartDeath]
+description =
+[PTestInterruptShutdownRace::Exit]
+description =
+[PTestJSON::Test]
+description =
+[PTestLatency::Rpc]
+description =
+[PTestLatency::Synchro]
+description =
+[PTestLatency::Synchro2]
+description =
+[PTestNestedLoops::R]
+description =
+[PTestPriority::Msg2]
+description =
+[PTestRPC::Test1_Start]
+description =
+[PTestRPC::Test1_InnerEvent]
+description =
+[PTestRPC::Test2_OutOfOrder]
+description =
+[PTestRPC::Test1_InnerQuery]
+description =
+[PTestRPC::Test1_NoReenter]
+description =
+[PTestRPC::Test2_FirstUrgent]
+description =
+[PTestRPC::Test2_SecondUrgent]
+description =
+[PTestRaceDeadlock::Lose]
+description =
+[PTestRaceDeadlock::Win]
+description =
+[PTestRaceDeadlock::Rpc]
+description =
+[PTestRaceDeferral::Lose]
+description =
+[PTestRaceDeferral::Win]
+description =
+[PTestRaceDeferral::Rpc]
+description =
+[PTestRacyInterruptReplies::R_]
+description =
+[PTestRacyInterruptReplies::_R]
+description =
+[PTestRacyReentry::E]
+description =
+[PTestRacyReentry::H]
+description =
+[PTestRacyUndefer::Race]
+description =
+[PTestRacyUndefer::Spam]
+description =
+[PTestRacyUndefer::RaceWinTwice]
+description =
+[PTestShutdown::Sync]
+description =
+[PTestShutdownSub::StackFrame]
+description =
+[PTestShutdownSub::__delete__]
+description =
+[PTestShutdownSubsub::__delete__]
+description =
+[PTestStackHooks::Sync]
+description =
+[PTestStackHooks::Rpc]
+description =
+[PTestStackHooks::StackFrame]
+description =
+[PTestSyncError::Error]
+description =
+[PTestSyncWakeup::StackFrame]
+description =
+[PTestSyncWakeup::Sync1]
+description =
+[PTestSyncWakeup::Sync2]
+description =
+[PTestUrgency::Test1]
+description =
+[PTestUrgency::Test3]
+description =
+[PTestUrgency::FinalTest_Begin]
+description =
+[PTestUrgency::Reply1]
+description =
+[PTestUrgency::Reply2]
+description =
+[PTestUrgentHangs::Test1_2]
+description =
+[PTestUrgentHangs::TestInner]
+description =
+[PTestUrgentHangs::TestInnerUrgent]
+description =
+[PTestUrgentHangs::Test1_1]
+description =
+[PTestUrgentHangs::Test1_3]
+description =
+[PTestUrgentHangs::Test2]
+description =
+[PTestUrgentHangs::Test3]
+description =
+[PTestUrgentHangs::Test4_1]
+description =
+[PTestUrgentHangs::Test5_1]
+description =
+
+# A11y code
+[PDocAccessible::State]
+description =
+[PDocAccessible::NativeState]
+description =
+[PDocAccessible::Name]
+description =
+[PDocAccessible::Value]
+description =
+[PDocAccessible::Help]
+description =
+[PDocAccessible::Description]
+description =
+[PDocAccessible::Attributes]
+description =
+[PDocAccessible::RelationByType]
+description =
+[PDocAccessible::Relations]
+description =
+[PDocAccessible::IsSearchbox]
+description =
+[PDocAccessible::LandmarkRole]
+description =
+[PDocAccessible::ARIARoleAtom]
+description =
+[PDocAccessible::GetLevelInternal]
+description =
+[PDocAccessible::CaretLineNumber]
+description =
+[PDocAccessible::CaretOffset]
+description =
+[PDocAccessible::CharacterCount]
+description =
+[PDocAccessible::SelectionCount]
+description =
+[PDocAccessible::TextSubstring]
+description =
+[PDocAccessible::GetTextAfterOffset]
+description =
+[PDocAccessible::GetTextAtOffset]
+description =
+[PDocAccessible::GetTextBeforeOffset]
+description =
+[PDocAccessible::CharAt]
+description =
+[PDocAccessible::TextAttributes]
+description =
+[PDocAccessible::DefaultTextAttributes]
+description =
+[PDocAccessible::TextBounds]
+description =
+[PDocAccessible::CharBounds]
+description =
+[PDocAccessible::OffsetAtPoint]
+description =
+[PDocAccessible::SelectionBoundsAt]
+description =
+[PDocAccessible::SetSelectionBoundsAt]
+description =
+[PDocAccessible::AddToSelection]
+description =
+[PDocAccessible::RemoveFromSelection]
+description =
+[PDocAccessible::Text]
+description =
+[PDocAccessible::ReplaceText]
+description =
+[PDocAccessible::InsertText]
+description =
+[PDocAccessible::CopyText]
+description =
+[PDocAccessible::CutText]
+description =
+[PDocAccessible::DeleteText]
+description =
+[PDocAccessible::PasteText]
+description =
+[PDocAccessible::ImagePosition]
+description =
+[PDocAccessible::ImageSize]
+description =
+[PDocAccessible::StartOffset]
+description =
+[PDocAccessible::EndOffset]
+description =
+[PDocAccessible::IsLinkValid]
+description =
+[PDocAccessible::AnchorCount]
+description =
+[PDocAccessible::AnchorURIAt]
+description =
+[PDocAccessible::AnchorAt]
+description =
+[PDocAccessible::LinkCount]
+description =
+[PDocAccessible::LinkAt]
+description =
+[PDocAccessible::LinkIndexOf]
+description =
+[PDocAccessible::LinkIndexAtOffset]
+description =
+[PDocAccessible::TableOfACell]
+description =
+[PDocAccessible::ColIdx]
+description =
+[PDocAccessible::RowIdx]
+description =
+[PDocAccessible::GetPosition]
+description =
+[PDocAccessible::ColExtent]
+description =
+[PDocAccessible::RowExtent]
+description =
+[PDocAccessible::GetColRowExtents]
+description =
+[PDocAccessible::ColHeaderCells]
+description =
+[PDocAccessible::RowHeaderCells]
+description =
+[PDocAccessible::IsCellSelected]
+description =
+[PDocAccessible::TableCaption]
+description =
+[PDocAccessible::TableSummary]
+description =
+[PDocAccessible::TableColumnCount]
+description =
+[PDocAccessible::TableRowCount]
+description =
+[PDocAccessible::TableCellAt]
+description =
+[PDocAccessible::TableCellIndexAt]
+description =
+[PDocAccessible::TableColumnIndexAt]
+description =
+[PDocAccessible::TableRowIndexAt]
+description =
+[PDocAccessible::TableRowAndColumnIndicesAt]
+description =
+[PDocAccessible::TableColumnExtentAt]
+description =
+[PDocAccessible::TableRowExtentAt]
+description =
+[PDocAccessible::TableColumnDescription]
+description =
+[PDocAccessible::TableRowDescription]
+description =
+[PDocAccessible::TableColumnSelected]
+description =
+[PDocAccessible::TableRowSelected]
+description =
+[PDocAccessible::TableCellSelected]
+description =
+[PDocAccessible::TableSelectedCellCount]
+description =
+[PDocAccessible::TableSelectedColumnCount]
+description =
+[PDocAccessible::TableSelectedRowCount]
+description =
+[PDocAccessible::TableSelectedCells]
+description =
+[PDocAccessible::TableSelectedCellIndices]
+description =
+[PDocAccessible::TableSelectedColumnIndices]
+description =
+[PDocAccessible::TableSelectedRowIndices]
+description =
+[PDocAccessible::TableSelectColumn]
+description =
+[PDocAccessible::TableSelectRow]
+description =
+[PDocAccessible::TableUnselectColumn]
+description =
+[PDocAccessible::TableUnselectRow]
+description =
+[PDocAccessible::TableIsProbablyForLayout]
+description =
+[PDocAccessible::AtkTableColumnHeader]
+description =
+[PDocAccessible::AtkTableRowHeader]
+description =
+[PDocAccessible::SelectedItems]
+description =
+[PDocAccessible::SelectedItemCount]
+description =
+[PDocAccessible::GetSelectedItem]
+description =
+[PDocAccessible::IsItemSelected]
+description =
+[PDocAccessible::AddItemToSelection]
+description =
+[PDocAccessible::RemoveItemFromSelection]
+description =
+[PDocAccessible::SelectAll]
+description =
+[PDocAccessible::UnselectAll]
+description =
+[PDocAccessible::DoAction]
+description =
+[PDocAccessible::ActionCount]
+description =
+[PDocAccessible::ActionDescriptionAt]
+description =
+[PDocAccessible::ActionNameAt]
+description =
+[PDocAccessible::AccessKey]
+description =
+[PDocAccessible::KeyboardShortcut]
+description =
+[PDocAccessible::AtkKeyBinding]
+description =
+[PDocAccessible::CurValue]
+description =
+[PDocAccessible::SetCurValue]
+description =
+[PDocAccessible::MinValue]
+description =
+[PDocAccessible::MaxValue]
+description =
+[PDocAccessible::Step]
+description =
+[PDocAccessible::FocusedChild]
+description =
+[PDocAccessible::Language]
+description =
+[PDocAccessible::DocType]
+description =
+[PDocAccessible::Title]
+description =
+[PDocAccessible::URL]
+description =
+[PDocAccessible::MimeType]
+description =
+[PDocAccessible::URLDocTypeMimeType]
+description =
+[PDocAccessible::AccessibleAtPoint]
+description =
+[PDocAccessible::Extents]
+description =
+[PDocAccessible::DOMNodeID]
+description =
+[PDocAccessible::GetWindowedPluginIAccessible]
+description =
+
+# CPOWs
+[PBrowser::RpcMessage]
+description =
+[PContent::RpcMessage]
+description =
+[PJavaScript::PreventExtensions]
+description =
+[PJavaScript::GetPropertyDescriptor]
+description =
+[PJavaScript::GetOwnPropertyDescriptor]
+description =
+[PJavaScript::DefineProperty]
+description =
+[PJavaScript::Delete]
+description =
+[PJavaScript::Has]
+description =
+[PJavaScript::HasOwn]
+description =
+[PJavaScript::Get]
+description =
+[PJavaScript::Set]
+description =
+[PJavaScript::IsExtensible]
+description =
+[PJavaScript::CallOrConstruct]
+description =
+[PJavaScript::HasInstance]
+description =
+[PJavaScript::GetBuiltinClass]
+description =
+[PJavaScript::IsArray]
+description =
+[PJavaScript::ClassName]
+description =
+[PJavaScript::GetPrototype]
+description =
+[PJavaScript::GetPrototypeIfOrdinary]
+description =
+[PJavaScript::RegExpToShared]
+description =
+[PJavaScript::GetPropertyKeys]
+description =
+[PJavaScript::InstanceOf]
+description =
+[PJavaScript::DOMInstanceOf]
+description =
+
+# Plugins
+[PPluginWidget::Create]
+description =
+[PPluginWidget::GetNativePluginPort]
+description =
+[PPluginWidget::SetNativeChildWindow]
+description =
+[PPluginInstance::__delete__]
+description =
+[PPluginInstance::CreateChildPluginWindow]
+description =
+[PPluginInstance::NPP_SetWindow]
+description =
+[PPluginInstance::NPP_GetValue_NPPVpluginWantsAllNetworkStreams]
+description =
+[PPluginInstance::NPP_GetValue_NPPVpluginNeedsXEmbed]
+description =
+[PPluginInstance::NPP_GetValue_NPPVpluginScriptableNPObject]
+description =
+[PPluginInstance::NPP_SetValue_NPNVprivateModeBool]
+description =
+[PPluginInstance::NPP_GetValue_NPPVpluginNativeAccessibleAtkPlugId]
+description =
+[PPluginInstance::NPP_SetValue_NPNVCSSZoomFactor]
+description =
+[PPluginInstance::NPP_SetValue_NPNVmuteAudioBool]
+description =
+[PPluginInstance::NPP_HandleEvent]
+description =
+[PPluginInstance::NPP_HandleEvent_Shmem]
+description =
+[PPluginInstance::NPP_HandleEvent_IOSurface]
+description =
+[PPluginInstance::Paint]
+description =
+[PPluginInstance::NPP_Destroy]
+description =
+[PPluginInstance::NPN_GetValue_NPNVWindowNPObject]
+description =
+[PPluginInstance::NPN_GetValue_NPNVPluginElementNPObject]
+description =
+[PPluginInstance::NPN_GetValue_NPNVprivateModeBool]
+description =
+[PPluginInstance::NPN_GetValue_NPNVnetscapeWindow]
+description =
+[PPluginInstance::NPN_GetValue_NPNVdocumentOrigin]
+description =
+[PPluginInstance::NPN_GetValue_DrawingModelSupport]
+description =
+[PPluginInstance::NPN_GetValue_SupportsAsyncBitmapSurface]
+description =
+[PPluginInstance::NPN_GetValue_SupportsAsyncDXGISurface]
+description =
+[PPluginInstance::NPN_GetValue_PreferredDXGIAdapter]
+description =
+[PPluginInstance::NPN_SetValue_NPPVpluginWindow]
+description =
+[PPluginInstance::NPN_SetValue_NPPVpluginTransparent]
+description =
+[PPluginInstance::NPN_SetValue_NPPVpluginUsesDOMForCursor]
+description =
+[PPluginInstance::NPN_SetValue_NPPVpluginDrawingModel]
+description =
+[PPluginInstance::NPN_SetValue_NPPVpluginEventModel]
+description =
+[PPluginInstance::NPN_SetValue_NPPVpluginIsPlayingAudio]
+description =
+[PPluginInstance::NPN_GetURL]
+description =
+[PPluginInstance::NPN_PostURL]
+description =
+[PPluginInstance::PStreamNotify]
+description =
+[PPluginInstance::RevokeCurrentDirectSurface]
+description =
+[PPluginInstance::InitDXGISurface]
+description =
+[PPluginInstance::FinalizeDXGISurface]
+description =
+[PPluginInstance::ShowDirectBitmap]
+description =
+[PPluginInstance::ShowDirectDXGISurface]
+description =
+[PPluginInstance::Show]
+description =
+[PPluginInstance::NPN_PushPopupsEnabledState]
+description =
+[PPluginInstance::NPN_PopPopupsEnabledState]
+description =
+[PPluginInstance::NPN_GetValueForURL]
+description =
+[PPluginInstance::NPN_SetValueForURL]
+description =
+[PPluginInstance::NPN_GetAuthenticationInfo]
+description =
+[PPluginInstance::NPN_ConvertPoint]
+description =
+[PPluginInstance::NegotiatedCarbon]
+description =
+[PPluginInstance::GetCompositionString]
+description =
+[PPluginInstance::NPP_NewStream]
+description =
+[PPluginInstance::PPluginStream]
+description =
+[PPluginInstance::PluginFocusChange]
+description =
+[PPluginInstance::SetPluginFocus]
+description =
+[PPluginInstance::UpdateWindow]
+description =
+[PPluginModule::ModuleSupportsAsyncRender]
+description =
+[PPluginModule::NP_GetEntryPoints]
+description =
+[PPluginModule::NP_Initialize]
+description =
+[PPluginModule::SyncNPP_New]
+description =
+[PPluginModule::NP_Shutdown]
+description =
+[PPluginModule::OptionalFunctionsSupported]
+description =
+[PPluginModule::PCrashReporter]
+description =
+[PPluginModule::ProcessSomeEvents]
+description =
+[PPluginModule::NPN_SetException]
+description =
+[PPluginModule::GetKeyState]
+description =
+[PPluginModule::NPN_SetValue_NPPVpluginRequiresAudioDeviceChanges]
+description =
+[PPluginModule::InitCrashReporter]
+description =
+[PPluginScriptableObject::NPN_Evaluate]
+description =
+[PPluginScriptableObject::Invalidate]
+description =
+[PPluginScriptableObject::HasMethod]
+description =
+[PPluginScriptableObject::Invoke]
+description =
+[PPluginScriptableObject::InvokeDefault]
+description =
+[PPluginScriptableObject::HasProperty]
+description =
+[PPluginScriptableObject::SetProperty]
+description =
+[PPluginScriptableObject::RemoveProperty]
+description =
+[PPluginScriptableObject::Enumerate]
+description =
+[PPluginScriptableObject::Construct]
+description =
+[PPluginScriptableObject::GetParentProperty]
+description =
+[PPluginScriptableObject::GetChildProperty]
+description =
+[PPluginStream::NPN_Write]
+description =
+[PPluginStream::__delete__]
+description =
+
+# The rest
+[PHeapSnapshotTempFileHelper::OpenHeapSnapshotTempFile]
+description =
+[PBlob::BlobStreamSync]
+description =
+[PBlob::WaitForSliceCreation]
+description =
+[PBlob::GetFileId]
+description =
+[PBlob::GetFilePath]
+description =
+[PBackgroundMutableFile::GetFileId]
+description =
+[PBackgroundIndexedDBUtils::GetFileReferences]
+description =
+[PBrowser::SyncMessage]
+description =
+[PBrowser::PPluginWidget]
+description =
+[PBrowser::GetWidgetNativeData]
+description =
+[PBrowser::DispatchFocusToTopLevelWindow]
+description =
+[PBrowser::NotifyIMEFocus]
+description =
+[PBrowser::NotifyIMEMouseButtonEvent]
+description =
+[PBrowser::RequestIMEToCommitComposition]
+description =
+[PBrowser::StartPluginIME]
+description =
+[PBrowser::GetInputContext]
+description =
+[PBrowser::IsParentWindowMainWidgetVisible]
+description =
+[PBrowser::GetDPI]
+description =
+[PBrowser::GetDefaultScale]
+description =
+[PBrowser::GetWidgetRounding]
+description =
+[PBrowser::GetMaxTouchPoints]
+description =
+[PBrowser::BrowserFrameOpenWindow]
+description =
+[PBrowser::RequestNativeKeyBindings]
+description =
+[PBrowser::GetTabCount]
+description =
+[PBrowser::DispatchWheelEvent]
+description =
+[PBrowser::DispatchMouseEvent]
+description =
+[PBrowser::DispatchKeyboardEvent]
+description =
+[PBrowser::EnsureLayersConnected]
+description =
+[PContent::SyncMessage]
+description =
+[PContent::CreateChildProcess]
+description =
+[PContent::BridgeToChildProcess]
+description =
+[PContent::LoadPlugin]
+description =
+[PContent::ConnectPluginBridge]
+description =
+[PContent::GetBlocklistState]
+description =
+[PContent::FindPlugins]
+description =
+[PContent::PCrashReporter]
+description =
+[PContent::NSSU2FTokenIsCompatibleVersion]
+description =
+[PContent::NSSU2FTokenIsRegistered]
+description =
+[PContent::NSSU2FTokenRegister]
+description =
+[PContent::NSSU2FTokenSign]
+description =
+[PContent::IsSecureURI]
+description =
+[PContent::PScreenManager]
+description =
+[PContent::PURLClassifier]
+description =
+[PContent::ClassifyLocal]
+description =
+[PContent::GetGfxVars]
+description =
+[PContent::ReadFontList]
+description =
+[PContent::ReadDataStorageArray]
+description =
+[PContent::ReadPermissions]
+description =
+[PContent::GetClipboard]
+description =
+[PContent::ClipboardHasType]
+description =
+[PContent::GetSystemColors]
+description =
+[PContent::GetIconForExtension]
+description =
+[PContent::GetShowPasswordSetting]
+description =
+[PContent::KeywordToURI]
+description =
+[PContent::NotifyKeywordSearchLoading]
+description =
+[PContent::AllocateLayerTreeId]
+description =
+[PContent::GetGfxInfoFeatureStatus]
+description =
+[PContent::BeginDriverCrashGuard]
+description =
+[PContent::EndDriverCrashGuard]
+description =
+[PContent::OpenAnonymousTemporaryFile]
+description =
+[PContent::KeygenProcessValue]
+description =
+[PContent::KeygenProvideContent]
+description =
+[PContent::AllocateTabId]
+description =
+[PContent::GetGraphicsDeviceInitData]
+description =
+[PContent::CreateWindow]
+description =
+[PContent::GetDeviceStorageLocation]
+description =
+[PContent::GetDeviceStorageLocations]
+description =
+[PContent::GetAndroidSystemInfo]
+description =
+[PContent::UngrabPointer]
+description =
+[PContent::RemovePermission]
+description =
+[PContent::GetA11yContentId]
+description =
+[PContentBridge::SyncMessage]
+description =
+[PScreenManager::Refresh]
+description =
+[PScreenManager::ScreenRefresh]
+description =
+[PScreenManager::GetPrimaryScreen]
+description =
+[PScreenManager::ScreenForRect]
+description =
+[PScreenManager::ScreenForBrowser]
+description =
+[PGMP::StartPlugin]
+description =
+[PGMPService::LaunchGMP]
+description =
+[PGMPService::GetGMPNodeId]
+description =
+[PGMPVideoDecoder::NeedShmem]
+description =
+[PGMPVideoEncoder::NeedShmem]
+description =
+[PVideoDecoderManager::PVideoDecoder]
+description =
+[PVideoDecoderManager::Readback]
+description =
+[PSpeechSynthesis::ReadVoicesAndState]
+description =
+[PBrowserStream::NPN_RequestRead]
+description =
+[PStorage::Preload]
+description =
+[PRemoteSpellcheckEngine::Check]
+description =
+[PRemoteSpellcheckEngine::CheckAndSuggest]
+description =
+[PRemoteSpellcheckEngine::SetDictionary]
+description =
+[PGPU::AddLayerTreeIdMapping]
+description =
+[PGPU::GetDeviceStatus]
+description =
+[PAPZCTreeManager::ReceiveMultiTouchInputEvent]
+description =
+[PAPZCTreeManager::ReceiveMouseInputEvent]
+description =
+[PAPZCTreeManager::ReceivePanGestureInputEvent]
+description =
+[PAPZCTreeManager::ReceivePinchGestureInputEvent]
+description =
+[PAPZCTreeManager::ReceiveTapGestureInputEvent]
+description =
+[PAPZCTreeManager::ReceiveScrollWheelInputEvent]
+description =
+[PAPZCTreeManager::TransformEventRefPoint]
+description =
+[PCompositorBridge::Initialize]
+description =
+[PCompositorBridge::Reset]
+description =
+[PCompositorBridge::GetCompositorOptions]
+description =
+[PCompositorBridge::GetFrameUniformity]
+description =
+[PCompositorBridge::WillClose]
+description =
+[PCompositorBridge::Pause]
+description =
+[PCompositorBridge::Resume]
+description =
+[PCompositorBridge::NotifyChildCreated]
+description =
+[PCompositorBridge::NotifyChildRecreated]
+description =
+[PCompositorBridge::MakeSnapshot]
+description =
+[PCompositorBridge::FlushRendering]
+description =
+[PCompositorBridge::StartFrameTimeRecording]
+description =
+[PCompositorBridge::StopFrameTimeRecording]
+description =
+[PCompositorBridge::PLayerTransaction]
+description =
+[PCompositorBridge::SyncWithCompositor]
+description =
+[PCompositorBridge::PWebRenderBridge]
+description =
+[PCompositorWidget::EnterPresentLock]
+description =
+[PCompositorWidget::LeavePresentLock]
+description =
+[PCompositorWidget::ClearTransparentWindow]
+description =
+[PImageBridge::WillClose]
+description =
+[PImageBridge::NewCompositable]
+description =
+[PLayerTransaction::SetTestSampleTime]
+description =
+[PLayerTransaction::LeaveTestMode]
+description =
+[PLayerTransaction::GetAnimationOpacity]
+description =
+[PLayerTransaction::GetAnimationTransform]
+description =
+[PLayerTransaction::SetAsyncScrollOffset]
+description =
+[PLayerTransaction::SetAsyncZoom]
+description =
+[PLayerTransaction::GetAPZTestData]
+description =
+[PLayerTransaction::RequestProperty]
+description =
+[PTexture::DestroySync]
+description =
+[PUiCompositorController::Pause]
+description =
+[PUiCompositorController::Resume]
+description =
+[PUiCompositorController::ResumeAndResize]
+description =
+[PWebRenderBridge::Create]
+description =
+[PWebRenderBridge::AddImage]
+description =
+[PWebRenderBridge::UpdateImage]
+description =
+[PWebRenderBridge::DeleteImage]
+description =
+[PWebRenderBridge::DPBegin]
+description =
+[PWebRenderBridge::DPSyncEnd]
+description =
+[PWebRenderBridge::DPGetSnapshot]
+description =
+[PVRManager::GetDisplays]
+description =
+[PVRManager::GetSensorState]
+description =
+[PVRManager::GetImmediateSensorState]
+description =
+[PVRManager::SetHaveEventListener]
+description =
+[PVRManager::GetControllers]
+description =
+[PHal::GetCurrentBatteryInformation]
+description =
+[PHal::GetCurrentNetworkInformation]
+description =
+[PHal::GetScreenEnabled]
+description =
+[PHal::GetKeyLightEnabled]
+description =
+[PHal::GetCpuSleepAllowed]
+description =
+[PHal::GetScreenBrightness]
+description =
+[PHal::GetTimezone]
+description =
+[PHal::GetTimezoneOffset]
+description =
+[PHal::GetWakeLockInfo]
+description =
+[PHal::GetCurrentScreenConfiguration]
+description =
+[PHal::LockScreenOrientation]
+description =
+[PHal::GetCurrentSwitchState]
+description =
+[PCookieService::GetCookieString]
+description =
+[PPrinting::ShowProgress]
+description =
+[PPrinting::SavePrintSettings]
+description =
+[PHandlerService::FillHandlerInfo]
+description =
+[PHandlerService::Exists]
+description =
+[PHandlerService::GetTypeFromExtension]
+description =
diff --git a/ipc/ipdl/test/ipdl/Makefile.in b/ipc/ipdl/test/ipdl/Makefile.in
index 71981c616e35..d8f5b1310514 100644
--- a/ipc/ipdl/test/ipdl/Makefile.in
+++ b/ipc/ipdl/test/ipdl/Makefile.in
@@ -13,5 +13,6 @@ check::
 		$(PYTHON) $(topsrcdir)/config/pythonpath.py  \
 		$(PLY_INCLUDE)  \
 		$(topsrcdir)/ipc/ipdl/ipdl.py  \
+		-s $(srcdir)/sync-messages.ini \
 		OKTESTS $(OKTESTS)  \
 		ERRORTESTS $(ERRORTESTS)
diff --git a/ipc/ipdl/test/ipdl/error/asyncMessageListed.ipdl b/ipc/ipdl/test/ipdl/error/asyncMessageListed.ipdl
new file mode 100644
index 000000000000..f73262787592
--- /dev/null
+++ b/ipc/ipdl/test/ipdl/error/asyncMessageListed.ipdl
@@ -0,0 +1,4 @@
+protocol asyncMessageListed {
+parent:
+    async Msg();
+};
diff --git a/ipc/ipdl/test/ipdl/error/unknownIntrMessage.ipdl b/ipc/ipdl/test/ipdl/error/unknownIntrMessage.ipdl
new file mode 100644
index 000000000000..c24c4654711a
--- /dev/null
+++ b/ipc/ipdl/test/ipdl/error/unknownIntrMessage.ipdl
@@ -0,0 +1,4 @@
+intr protocol unknownSyncMessage {
+parent:
+    intr Msg();
+};
diff --git a/ipc/ipdl/test/ipdl/error/unknownSyncMessage.ipdl b/ipc/ipdl/test/ipdl/error/unknownSyncMessage.ipdl
new file mode 100644
index 000000000000..a4d340c2362d
--- /dev/null
+++ b/ipc/ipdl/test/ipdl/error/unknownSyncMessage.ipdl
@@ -0,0 +1,4 @@
+sync protocol unknownSyncMessage {
+parent:
+    sync Msg();
+};
diff --git a/ipc/ipdl/test/ipdl/sync-messages.ini b/ipc/ipdl/test/ipdl/sync-messages.ini
new file mode 100644
index 000000000000..09fb3abb780b
--- /dev/null
+++ b/ipc/ipdl/test/ipdl/sync-messages.ini
@@ -0,0 +1,22 @@
+[actorreturn::Msg]
+[array_Union::Msg]
+[union_Basic::Msg]
+[Struct::test]
+[intrProtocol::SyncMsg]
+[intrProtocol::InterruptMsg]
+[shmem::SyncMsg]
+[shmem::InterruptMsg]
+[syncProtocol::SyncMsg]
+[messageVerify::__delete__]
+[messageVerify::msg3]
+[messageVerify::msg4]
+[messageVerifyTopLevel::messageVerify]
+[DeleteSub::__delete__]
+[intrMessageCompress::foo]
+[intrMessageCompress::bar]
+[syncMessageCompress::foo]
+[syncParentToChild::Msg]
+[tooWeakIntrSync::Msg]
+[tooWeakSyncAsync::Msg]
+[undeclReturnType::Msg]
+[asyncMessageListed::Msg]
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 8471736685a4..b8cfdb642ce6 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -8052,6 +8052,8 @@ Parser<ParseHandler>::comprehensionFor(GeneratorKind comprehensionKind)
 
     MUST_MATCH_TOKEN_FUNC(TokenKindIsPossibleIdentifier, JSMSG_NO_VARIABLE_NAME);
     RootedPropertyName name(context, bindingIdentifier(YieldIsKeyword));
+    if (!name)
+        return null();
     if (name == context->names().let) {
         error(JSMSG_LET_COMP_BINDING);
         return null();
diff --git a/js/src/jit-test/lib/wasm.js b/js/src/jit-test/lib/wasm.js
index 06a1bf71a11e..954320fd0b9f 100644
--- a/js/src/jit-test/lib/wasm.js
+++ b/js/src/jit-test/lib/wasm.js
@@ -35,6 +35,9 @@ function mismatchError(actual, expect) {
     return RegExp(str);
 }
 
+const emptyStackError = /from empty stack/;
+const unusedValuesError = /unused values not explicitly dropped by end of block/;
+
 function jsify(wasmVal) {
     if (wasmVal === 'nan')
         return NaN;
@@ -179,4 +182,4 @@ function wasmGetScriptBreakpoints(wasmScript) {
         result.push({str: line.trim(), line: i + 1, offset: lineOffsets[0]});
     });
     return result;
-}
\ No newline at end of file
+}
diff --git a/js/src/jit-test/tests/basic/cooperative-threading-interrupt.js b/js/src/jit-test/tests/basic/cooperative-threading-interrupt.js
new file mode 100644
index 000000000000..749128ad559a
--- /dev/null
+++ b/js/src/jit-test/tests/basic/cooperative-threading-interrupt.js
@@ -0,0 +1,16 @@
+if (helperThreadCount() === 0)
+  quit();
+setInterruptCallback(function() { print("MainThread Interrupt!"); cooperativeYield(); return true; });
+evalInCooperativeThread('\
+  setInterruptCallback(function() { print("Worker Interrupt!"); cooperativeYield(); return true; });\
+  for (var i = 0; i < 10; i++) {\
+     print("Worker: " + i);\
+     interruptIf(true);\
+  }\
+  print("Worker Done!");\
+');
+for (var i = 0; i < 10; i++) {
+    print("MainThread: " + i);
+    interruptIf(true);
+}
+print("MainThread Done!");
diff --git a/js/src/jit-test/tests/basic/cooperative-threading.js b/js/src/jit-test/tests/basic/cooperative-threading.js
new file mode 100644
index 000000000000..5beb89bb0e65
--- /dev/null
+++ b/js/src/jit-test/tests/basic/cooperative-threading.js
@@ -0,0 +1,7 @@
+if (helperThreadCount() === 0)
+  quit();
+evalInCooperativeThread("var x = 3");
+evalInCooperativeThread("cooperativeYield()");
+cooperativeYield();
+evalInCooperativeThread("cooperativeYield(); gc();");
+gc();
diff --git a/js/src/jit-test/tests/wasm/basic.js b/js/src/jit-test/tests/wasm/basic.js
index 57b21075f9a5..f74f37f8dee0 100644
--- a/js/src/jit-test/tests/wasm/basic.js
+++ b/js/src/jit-test/tests/wasm/basic.js
@@ -58,8 +58,8 @@ wasmFailValidateText('(module (func) (func) (export "a" 0) (export "a" 1))', /du
 // ----------------------------------------------------------------------------
 // signatures
 
-wasmFailValidateText('(module (func (result i32)))', mismatchError("void", "i32"));
-wasmFailValidateText('(module (func (result i32) (nop)))', mismatchError("void", "i32"));
+wasmFailValidateText('(module (func (result i32)))', emptyStackError);
+wasmFailValidateText('(module (func (result i32) (nop)))', emptyStackError);
 
 wasmValidateText('(module (func (nop)))');
 wasmValidateText('(module (func (result i32) (i32.const 42)))');
@@ -196,7 +196,7 @@ wasmFullPass('(module (func (result f32) (param i32) (local f32) (get_local 1))
 
 wasmFailValidateText('(module (func (set_local 0 (i32.const 0))))', /set_local index out of range/);
 wasmFailValidateText('(module (func (local f32) (set_local 0 (i32.const 0))))', mismatchError("i32", "f32"));
-wasmFailValidateText('(module (func (local f32) (set_local 0 (nop))))', /popping value from empty stack/);
+wasmFailValidateText('(module (func (local f32) (set_local 0 (nop))))', emptyStackError);
 wasmFailValidateText('(module (func (local i32) (local f32) (set_local 0 (get_local 1))))', mismatchError("f32", "i32"));
 wasmFailValidateText('(module (func (local i32) (local f32) (set_local 1 (get_local 0))))', mismatchError("i32", "f32"));
 
@@ -217,9 +217,9 @@ wasmValidateText('(module (func (local i32) (local $a f32) (set_local 0 (i32.con
 
 wasmFullPass('(module (func (block )) (export "run" 0))', undefined);
 
-wasmFailValidateText('(module (func (result i32) (block )))', mismatchError("void", "i32"));
-wasmFailValidateText('(module (func (result i32) (block (block ))))', mismatchError("void", "i32"));
-wasmFailValidateText('(module (func (local i32) (set_local 0 (block ))))', /popping value from empty stack/);
+wasmFailValidateText('(module (func (result i32) (block )))', emptyStackError);
+wasmFailValidateText('(module (func (result i32) (block (block ))))', emptyStackError);
+wasmFailValidateText('(module (func (local i32) (set_local 0 (block ))))', emptyStackError);
 
 wasmFullPass('(module (func (block (block ))) (export "run" 0))', undefined);
 wasmFullPass('(module (func (result i32) (block i32 (i32.const 42))) (export "run" 0))', 42);
@@ -234,9 +234,9 @@ wasmFullPass('(module (func (result i32) (local i32) (set_local 0 (i32.const 42)
 // ----------------------------------------------------------------------------
 // calls
 
-wasmFailValidateText('(module (func (nop)) (func (call 0 (i32.const 0))))', /unused values not explicitly dropped by end of block/);
+wasmFailValidateText('(module (func (nop)) (func (call 0 (i32.const 0))))', unusedValuesError);
 
-wasmFailValidateText('(module (func (param i32) (nop)) (func (call 0)))', /peeking at value from outside block/);
+wasmFailValidateText('(module (func (param i32) (nop)) (func (call 0)))', emptyStackError);
 wasmFailValidateText('(module (func (param f32) (nop)) (func (call 0 (i32.const 0))))', mismatchError("i32", "f32"));
 wasmFailValidateText('(module (func (nop)) (func (call 3)))', /callee index out of range/);
 
@@ -250,8 +250,8 @@ assertThrowsInstanceOf(() => wasmEvalText('(module (func (call 1)) (func (call 0
 wasmValidateText('(module (func (param i32 f32)) (func (call 0 (i32.const 0) (f32.const nan))))');
 wasmFailValidateText('(module (func (param i32 f32)) (func (call 0 (i32.const 0) (i32.const 0))))', mismatchError("i32", "f32"));
 
-wasmFailValidateText('(module (import "a" "") (func (call 0 (i32.const 0))))', /unused values not explicitly dropped by end of block/);
-wasmFailValidateText('(module (import "a" "" (param i32)) (func (call 0)))', /peeking at value from outside block/);
+wasmFailValidateText('(module (import "a" "") (func (call 0 (i32.const 0))))', unusedValuesError);
+wasmFailValidateText('(module (import "a" "" (param i32)) (func (call 0)))', emptyStackError);
 wasmFailValidateText('(module (import "a" "" (param f32)) (func (call 0 (i32.const 0))))', mismatchError("i32", "f32"));
 
 assertErrorMessage(() => wasmEvalText('(module (import "a" "") (func (call 1)))'), TypeError, noImportObj);
@@ -462,11 +462,12 @@ wasmValidateText('(module (import $bar "" "a") (func (call $bar)) (func $foo (no
 wasmFailValidateText('(module (func (select (i32.const 0) (i32.const 0) (f32.const 0))))', mismatchError("f32", "i32"));
 
 wasmFailValidateText('(module (func (select (i32.const 0) (f32.const 0) (i32.const 0))) (export "" 0))', /select operand types must match/);
-wasmFailValidateText('(module (func (select (block ) (i32.const 0) (i32.const 0))) (export "" 0))', /popping value from empty stack/);
-assertEq(wasmEvalText('(module (func (select (return) (i32.const 0) (i32.const 0))) (export "" 0))').exports[""](), undefined);
-assertEq(wasmEvalText('(module (func (i32.add (i32.const 0) (select (return) (i32.const 0) (i32.const 0)))) (export "" 0))').exports[""](), undefined);
+wasmFailValidateText('(module (func (select (block ) (i32.const 0) (i32.const 0))) (export "" 0))', emptyStackError);
+wasmFailValidateText('(module (func (select (return) (i32.const 0) (i32.const 0))) (export "" 0))', unusedValuesError);
+assertEq(wasmEvalText('(module (func (drop (select (return) (i32.const 0) (i32.const 0)))) (export "" 0))').exports[""](), undefined);
+assertEq(wasmEvalText('(module (func (result i32) (i32.add (i32.const 0) (select (return (i32.const 42)) (i32.const 0) (i32.const 0)))) (export "" 0))').exports[""](), 42);
 wasmFailValidateText('(module (func (select (if i32 (i32.const 1) (i32.const 0) (f32.const 0)) (i32.const 0) (i32.const 0))) (export "" 0))', mismatchError("f32", "i32"));
-wasmFailValidateText('(module (func) (func (select (call 0) (call 0) (i32.const 0))) (export "" 0))', /popping value from empty stack/);
+wasmFailValidateText('(module (func) (func (select (call 0) (call 0) (i32.const 0))) (export "" 0))', emptyStackError);
 
 (function testSideEffects() {
 
diff --git a/js/src/jit-test/tests/wasm/control-flow.js b/js/src/jit-test/tests/wasm/control-flow.js
index fd4f8e4bef36..6cccb61da36d 100644
--- a/js/src/jit-test/tests/wasm/control-flow.js
+++ b/js/src/jit-test/tests/wasm/control-flow.js
@@ -157,11 +157,11 @@ assertEq(counter, 0);
 
 // "if" doesn't return an expression value
 wasmFailValidateText('(module (func (result i32) (if i32 (i32.const 42) (i32.const 0))))', /if without else with a result value/);
-wasmFailValidateText('(module (func (result i32) (if i32 (i32.const 42) (drop (i32.const 0)))))', mismatchError("void", "i32"));
+wasmFailValidateText('(module (func (result i32) (if i32 (i32.const 42) (drop (i32.const 0)))))', emptyStackError);
 wasmFailValidateText('(module (func (result i32) (if i32 (i32.const 1) (i32.const 0) (if i32 (i32.const 1) (i32.const 1)))))', /if without else with a result value/);
-wasmFailValidateText('(module (func (result i32) (if i32 (i32.const 1) (drop (i32.const 0)) (if (i32.const 1) (drop (i32.const 1))))))', mismatchError("void", "i32"));
+wasmFailValidateText('(module (func (result i32) (if i32 (i32.const 1) (drop (i32.const 0)) (if (i32.const 1) (drop (i32.const 1))))))', emptyStackError);
 wasmFailValidateText('(module (func (if i32 (i32.const 1) (i32.const 0) (if i32 (i32.const 1) (i32.const 1)))))', /if without else with a result value/);
-wasmFailValidateText('(module (func (if i32 (i32.const 1) (i32.const 0) (if (i32.const 1) (drop (i32.const 1))))))', mismatchError("void", "i32"));
+wasmFailValidateText('(module (func (if i32 (i32.const 1) (i32.const 0) (if (i32.const 1) (drop (i32.const 1))))))', emptyStackError);
 wasmFailValidateText('(module (func (if (i32.const 1) (drop (i32.const 0)) (if i32 (i32.const 1) (i32.const 1)))))', /if without else with a result value/);
 wasmEvalText('(module (func (if (i32.const 1) (drop (i32.const 0)) (if (i32.const 1) (drop (i32.const 1))))))');
 
@@ -170,18 +170,18 @@ wasmEvalText('(module (func (if (i32.const 1) (drop (i32.const 0)) (if (i32.cons
 
 wasmFullPass('(module (func (return)) (export "run" 0))', undefined);
 wasmFullPass('(module (func (result i32) (return (i32.const 1))) (export "run" 0))', 1);
-wasmFullPass('(module (func (if (return) (i32.const 0))) (export "run" 0))', undefined);
-wasmFailValidateText('(module (func (result i32) (return)) (export "" 0))', /popping value from empty stack/);
+wasmFailValidateText('(module (func (if (return) (i32.const 0))) (export "run" 0))', unusedValuesError);
+wasmFailValidateText('(module (func (result i32) (return)) (export "" 0))', emptyStackError);
 wasmFullPass('(module (func (return (i32.const 1))) (export "run" 0))', undefined);
 wasmFailValidateText('(module (func (result f32) (return (i32.const 1))) (export "" 0))', mismatchError("i32", "f32"));
-wasmFailValidateText('(module (func (result i32) (return)) (export "" 0))', /popping value from empty stack/);
+wasmFailValidateText('(module (func (result i32) (return)) (export "" 0))', emptyStackError);
 
 // ----------------------------------------------------------------------------
 // br / br_if
 
-wasmFailValidateText('(module (func (result i32) (block (br 0))) (export "" 0))', mismatchError("void", "i32"));
-wasmFailValidateText('(module (func (result i32) (br 0)) (export "" 0))', /popping value from empty stack/);
-wasmFailValidateText('(module (func (result i32) (block (br_if 0 (i32.const 0)))) (export "" 0))', mismatchError("void", "i32"));
+wasmFailValidateText('(module (func (result i32) (block (br 0))) (export "" 0))', emptyStackError);
+wasmFailValidateText('(module (func (result i32) (br 0)) (export "" 0))', emptyStackError);
+wasmFailValidateText('(module (func (result i32) (block (br_if 0 (i32.const 0)))) (export "" 0))', emptyStackError);
 
 const DEPTH_OUT_OF_BOUNDS = /branch depth exceeds current nesting level/;
 
@@ -197,14 +197,14 @@ wasmFailValidateText('(module (func (block (br_if 2 (i32.const 0)))))', DEPTH_OU
 wasmFailValidateText('(module (func (loop (br_if 2 (i32.const 0)))))', DEPTH_OUT_OF_BOUNDS);
 
 wasmFailValidateText(`(module (func (result i32)
-  (block
-    (if
-      (br 0)
-      (i32.const 0)
-      (i32.const 2)
-    )
-  )
-) (export "" 0))`, mismatchError("void", "i32"));
+  block
+    br 0
+    if
+      i32.const 0
+      i32.const 2
+    end
+  end
+) (export "" 0))`, unusedValuesError);
 
 wasmFullPass(`(module (func (block $out (br_if $out (br 0)))) (export "run" 0))`, undefined);
 
@@ -273,6 +273,7 @@ wasmFullPass(`(module (func
       (i32.const 0)
       (return (br 0))
     )
+    drop
   )
   (return)
 ) (export "run" 0))`, undefined);
@@ -308,9 +309,9 @@ assertEq(isNonZero(-1), 1);
 
 // branches with values
 // br/br_if and block
-wasmFailValidateText('(module (func (result i32) (br 0)))', /popping value from empty stack/);
+wasmFailValidateText('(module (func (result i32) (br 0)))', emptyStackError);
 wasmFailValidateText('(module (func (result i32) (br 0 (f32.const 42))))', mismatchError("f32", "i32"));
-wasmFailValidateText('(module (func (result i32) (block (br 0))))', mismatchError("void", "i32"));
+wasmFailValidateText('(module (func (result i32) (block (br 0))))', emptyStackError);
 wasmFailValidateText('(module (func (result i32) (block f32 (br 0 (f32.const 42)))))', mismatchError("f32", "i32"));
 
 wasmFailValidateText(`(module (func (result i32) (param i32) (block (if i32 (get_local 0) (br 0 (i32.const 42))))) (export "" 0))`, /if without else with a result value/);
@@ -319,8 +320,8 @@ wasmFailValidateText(`(module (func (result i32) (param i32) (block i32 (if (get
 wasmFullPass('(module (func (result i32) (br 0 (i32.const 42)) (i32.const 13)) (export "run" 0))', 42);
 wasmFullPass('(module (func (result i32) (block i32 (br 0 (i32.const 42)) (i32.const 13))) (export "run" 0))', 42);
 
-wasmFailValidateText('(module (func) (func (block i32 (br 0 (call 0)) (i32.const 13))) (export "" 0))', /popping value from empty stack/);
-wasmFailValidateText('(module (func) (func (block i32 (br_if 0 (call 0) (i32.const 1)) (i32.const 13))) (export "" 0))', /popping value from empty stack/);
+wasmFailValidateText('(module (func) (func (block i32 (br 0 (call 0)) (i32.const 13))) (export "" 0))', emptyStackError);
+wasmFailValidateText('(module (func) (func (block i32 (br_if 0 (call 0) (i32.const 1)) (i32.const 13))) (export "" 0))', emptyStackError);
 
 var f = wasmEvalText(`(module (func (result i32) (param i32) (block i32 (if (get_local 0) (drop (i32.const 42))) (i32.const 43))) (export "" 0))`).exports[""];
 assertEq(f(0), 43);
@@ -414,7 +415,7 @@ assertEq(called, 0);
 
 // br/br_if and loop
 wasmFullPass(`(module (func (param i32) (result i32) (loop $out $in i32 (br $out (get_local 0)))) (export "run" 0))`, 1, {}, 1);
-wasmFullPass(`(module (func (param i32) (result i32) (loop $in (br 1 (get_local 0)))) (export "run" 0))`, 1, {}, 1);
+wasmFullPass(`(module (func (param i32) (result i32) (loop $in i32 (br 1 (get_local 0)))) (export "run" 0))`, 1, {}, 1);
 wasmFullPass(`(module (func (param i32) (result i32) (block $out i32 (loop $in i32 (br $out (get_local 0))))) (export "run" 0))`, 1, {}, 1);
 
 wasmFailValidateText(`(module (func (param i32) (result i32)
@@ -432,11 +433,14 @@ wasmFullPass(`(module
   (result i32)
   (local i32)
   (block $out i32
-  (loop $in
-   (set_local 0 (i32.add (get_local 0) (i32.const 1)))
-   (if (i32.ge_s (get_local 0) (i32.const 7)) (br $out (get_local 0)))
-   (br $in)
-  )
+    (loop $in i32
+     (set_local 0 (i32.add (get_local 0) (i32.const 1)))
+     (if
+        (i32.ge_s (get_local 0) (i32.const 7))
+        (br $out (get_local 0))
+     )
+     (br $in)
+    )
   )
  )
 (export "run" 0))`, 7);
@@ -446,7 +450,7 @@ wasmFullPass(`(module
   (result i32)
   (local i32)
   (block $out i32
-   (loop $in
+   (loop $in i32
     (set_local 0 (i32.add (get_local 0) (i32.const 1)))
     (br_if $out (get_local 0) (i32.ge_s (get_local 0) (i32.const 7)))
     (br $in)
@@ -687,7 +691,7 @@ assertEq(f(2), 2);
 assertEq(f(3), -1);
 
 // br_table with values
-wasmFailValidateText('(module (func (result i32) (block (br_table 0 (i32.const 0)))))', mismatchError("void", "i32"));
+wasmFailValidateText('(module (func (result i32) (block i32 (br_table 0 (i32.const 0)))))', emptyStackError);
 wasmFailValidateText('(module (func (result i32) (block i32 (br_table 0 (f32.const 0) (i32.const 0)))))', mismatchError("f32", "i32"));
 
 wasmFailValidateText(`(module
@@ -730,7 +734,7 @@ assertEq(f(4), 13);
 
 const UNREACHABLE = /unreachable/;
 assertErrorMessage(wasmEvalText(`(module (func (unreachable)) (export "" 0))`).exports[""], RuntimeError, UNREACHABLE);
-assertErrorMessage(wasmEvalText(`(module (func (if (unreachable) (i32.const 0))) (export "" 0))`).exports[""], RuntimeError, UNREACHABLE);
+assertErrorMessage(wasmEvalText(`(module (func (if (unreachable) (nop))) (export "" 0))`).exports[""], RuntimeError, UNREACHABLE);
 assertErrorMessage(wasmEvalText(`(module (func (block (br_if 0 (unreachable)))) (export "" 0))`).exports[""], RuntimeError, UNREACHABLE);
 assertErrorMessage(wasmEvalText(`(module (func (block (br_table 0 (unreachable)))) (export "" 0))`).exports[""], RuntimeError, UNREACHABLE);
 assertErrorMessage(wasmEvalText(`(module (func (result i32) (i32.add (i32.const 0) (unreachable))) (export "" 0))`).exports[""], RuntimeError, UNREACHABLE);
diff --git a/js/src/jit-test/tests/wasm/full-cycle.js b/js/src/jit-test/tests/wasm/full-cycle.js
index 85bb2e761e19..94c38af45801 100644
--- a/js/src/jit-test/tests/wasm/full-cycle.js
+++ b/js/src/jit-test/tests/wasm/full-cycle.js
@@ -16,7 +16,7 @@ wasmFullPass(`(module
         i32.const 0
         call 3
         i32.const 42
-        f32.add
+        i32.add
     )
     (func) (func) (func)
 (export "run" 0))`, 43);
diff --git a/js/src/jit-test/tests/wasm/regress/misc-control-flow.js b/js/src/jit-test/tests/wasm/regress/misc-control-flow.js
index 81d44f2788bd..2fafed562765 100644
--- a/js/src/jit-test/tests/wasm/regress/misc-control-flow.js
+++ b/js/src/jit-test/tests/wasm/regress/misc-control-flow.js
@@ -16,7 +16,7 @@ wasmFailValidateText(`(module
    (func (result i32) (param i32)
      (loop (if (i32.const 0) (br 0)) (drop (get_local 0))))
    (export "" 0)
-)`, mismatchError("void", "i32"));
+)`, emptyStackError);
 
 assertEq(wasmEvalText(`(module
    (func (result i32) (param i32)
@@ -113,19 +113,20 @@ wasmEvalText(`
 }).exports.foo();
 
 assertEq(wasmEvalText(`(module (func
- (return)
+ return
  (select
-  (loop (i32.const 1))
-  (loop (i32.const 2))
+  (loop i32 (i32.const 1))
+  (loop i32 (i32.const 2))
   (i32.const 3)
  )
+ drop
 ) (export "" 0))`).exports[""](), undefined);
 
 wasmEvalText(`(module (func (result i32)
  (return (i32.const 0))
  (select
-  (loop (i32.const 1))
-  (loop (i32.const 2))
+  (loop i32 (i32.const 1))
+  (loop i32 (i32.const 2))
   (i32.const 3)
  )
 ))`);
@@ -203,7 +204,7 @@ wasmFailValidateText(`
         (br_table 1 0 (i32.const 15))
       )
     )
-)`, mismatchError("i32", "void"));
+)`, /br_table targets must all have the same value type/);
 
 wasmFailValidateText(`
 (module
@@ -213,7 +214,7 @@ wasmFailValidateText(`
       (br_table 1 0 (i32.const 15))
     )
   )
-)`, mismatchError("i32", "void"));
+)`, /br_table targets must all have the same value type/);
 
 wasmValidateText(`
 (module
diff --git a/js/src/jit-test/tests/wasm/regress/movable-traps.js b/js/src/jit-test/tests/wasm/regress/movable-traps.js
index 07a980a1ed16..46ccc4b07be5 100644
--- a/js/src/jit-test/tests/wasm/regress/movable-traps.js
+++ b/js/src/jit-test/tests/wasm/regress/movable-traps.js
@@ -25,7 +25,7 @@ for (let body of bodies) {
     wasmFullPass(`
     (module
         (func $f (param $x i32) (result i32)
-            loop $top
+            loop $top i32
                 get_local $x
                 if
                     get_local $x
diff --git a/js/src/jit-test/tests/wasm/regress/select-any.js b/js/src/jit-test/tests/wasm/regress/select-any.js
index 51b589d25b8e..5850c6e4a5a4 100644
--- a/js/src/jit-test/tests/wasm/regress/select-any.js
+++ b/js/src/jit-test/tests/wasm/regress/select-any.js
@@ -6,7 +6,13 @@ var m1 = wasmEvalText(
 `(module
   (type $type0 (func))
   (func $func0
-   (select (unreachable) (return (nop)) (loop (i32.const 1))))
+   (select
+     (unreachable)
+     (return (nop))
+     (loop i32 (i32.const 1))
+   )
+   drop
+  )
   (export "" 0))`).exports[""];
 
 try {
@@ -20,7 +26,13 @@ var m2 = wasmEvalText(
 `(module
   (type $type0 (func))
   (func $func0
-   (select (i32.const 26) (unreachable) (i32.const 3)))
+   (select
+    (i32.const 26)
+    (unreachable)
+    (i32.const 3)
+   )
+   drop
+  )
   (export "" 0))`).exports[""];
 
 try {
diff --git a/js/src/jit-test/tests/wasm/spec/br_table.wast b/js/src/jit-test/tests/wasm/spec/br_table.wast
index 24f6ed2ebf41..180d1a1a6d42 100644
--- a/js/src/jit-test/tests/wasm/spec/br_table.wast
+++ b/js/src/jit-test/tests/wasm/spec/br_table.wast
@@ -1401,6 +1401,17 @@
   ))
   "type mismatch"
 )
+(assert_invalid
+  (module (func $type-arg-num-vs-arg-num
+    (block
+      (block f32
+        (br_table 0 1 (f32.const 0) (i64.const 0))
+      )
+      (drop)
+    )
+  ))
+  "type mismatch"
+)
 
 (assert_invalid
   (module (func $type-index-void-vs-i32
diff --git a/js/src/jit-test/tests/wasm/spec/call_indirect.wast b/js/src/jit-test/tests/wasm/spec/call_indirect.wast
index 702381eda557..532f613c9954 100644
--- a/js/src/jit-test/tests/wasm/spec/call_indirect.wast
+++ b/js/src/jit-test/tests/wasm/spec/call_indirect.wast
@@ -361,8 +361,40 @@
   "unknown type"
 )
 
-;; invalid table
+
+;; Unbound function in table
+
 (assert_invalid 
   (module (table anyfunc (elem 0 0)))
   "unknown function 0"
 )
+
+
+;; Invalid bounds for elements
+
+(assert_unlinkable
+  (module
+    (table 10 anyfunc)
+    (elem (i32.const 10) $f)
+    (func $f)
+  )
+  "elements segment does not fit"
+)
+
+(assert_unlinkable
+  (module
+    (table 10 anyfunc)
+    (elem (i32.const -1) $f)
+    (func $f)
+  )
+  "elements segment does not fit"
+)
+
+(assert_unlinkable
+  (module
+    (table 10 anyfunc)
+    (elem (i32.const -10) $f)
+    (func $f)
+  )
+  "elements segment does not fit"
+)
diff --git a/js/src/jit-test/tests/wasm/spec/linking.wast b/js/src/jit-test/tests/wasm/spec/linking.wast
index 2ee11b1a86aa..6a7dc36530b4 100644
--- a/js/src/jit-test/tests/wasm/spec/linking.wast
+++ b/js/src/jit-test/tests/wasm/spec/linking.wast
@@ -156,12 +156,21 @@
 
 (assert_trap (invoke $Ot "call" (i32.const 20)) "undefined")
 
-(module $Pt
+(module
   (table (import "Mt" "tab") 0 anyfunc)
   (elem (i32.const 9) $f)
   (func $f)
 )
 
+(assert_unlinkable
+  (module
+    (table (import "Mt" "tab") 0 anyfunc)
+    (elem (i32.const 10) $f)
+    (func $f)
+  )
+  "elements segment does not fit"
+)
+
 (assert_unlinkable
   (module
     (table (import "Mt" "tab") 10 anyfunc)
@@ -240,12 +249,20 @@
 (assert_return (invoke $Nm "load" (i32.const 12)) (i32.const 0xf2))
 (assert_return (invoke $Om "load" (i32.const 12)) (i32.const 0xa7))
 
-(module $Pm
+(module
   (memory (import "Mm" "mem") 0)
-  (data (i32.const 1000) "abc")
+  (data (i32.const 0xffff) "a")
 )
 
-(module $Qm
+(assert_unlinkable
+  (module
+    (memory (import "Mm" "mem") 0)
+    (data (i32.const 0x10000) "a")
+  )
+  "data segment does not fit"
+)
+
+(module $Pm
   (memory (import "Mm" "mem") 1 8)
 
   (func (export "grow") (param $a i32) (result i32)
@@ -253,14 +270,14 @@
   )
 )
 
-(assert_return (invoke $Qm "grow" (i32.const 0)) (i32.const 1))
-(assert_return (invoke $Qm "grow" (i32.const 2)) (i32.const 1))
-(assert_return (invoke $Qm "grow" (i32.const 0)) (i32.const 3))
-(assert_return (invoke $Qm "grow" (i32.const 1)) (i32.const 3))
-(assert_return (invoke $Qm "grow" (i32.const 1)) (i32.const 4))
-(assert_return (invoke $Qm "grow" (i32.const 0)) (i32.const 5))
-(assert_return (invoke $Qm "grow" (i32.const 1)) (i32.const -1))
-(assert_return (invoke $Qm "grow" (i32.const 0)) (i32.const 5))
+(assert_return (invoke $Pm "grow" (i32.const 0)) (i32.const 1))
+(assert_return (invoke $Pm "grow" (i32.const 2)) (i32.const 1))
+(assert_return (invoke $Pm "grow" (i32.const 0)) (i32.const 3))
+(assert_return (invoke $Pm "grow" (i32.const 1)) (i32.const 3))
+(assert_return (invoke $Pm "grow" (i32.const 1)) (i32.const 4))
+(assert_return (invoke $Pm "grow" (i32.const 0)) (i32.const 5))
+(assert_return (invoke $Pm "grow" (i32.const 1)) (i32.const -1))
+(assert_return (invoke $Pm "grow" (i32.const 0)) (i32.const 5))
 
 (assert_unlinkable
   (module
diff --git a/js/src/jit-test/tests/wasm/spec/memory.wast b/js/src/jit-test/tests/wasm/spec/memory.wast
index de3e6d90b862..e9e3aa377eb9 100644
--- a/js/src/jit-test/tests/wasm/spec/memory.wast
+++ b/js/src/jit-test/tests/wasm/spec/memory.wast
@@ -82,6 +82,14 @@
   (module (memory 0 1) (data (i32.const 0) "a"))
   "data segment does not fit"
 )
+(assert_unlinkable
+  (module (memory 1 2) (data (i32.const -1) "a"))
+  "data segment does not fit"
+)
+(assert_unlinkable
+  (module (memory 1 2) (data (i32.const -1000) "a"))
+  "data segment does not fit"
+)
 (assert_unlinkable
   (module (memory 1 2) (data (i32.const 0) "a") (data (i32.const 98304) "b"))
   "data segment does not fit"
@@ -94,13 +102,20 @@
   (module (memory 1) (data (i32.const 0x12000) ""))
   "data segment does not fit"
 )
+(assert_unlinkable
+  (module (memory 1 2) (data (i32.const -1) ""))
+  "data segment does not fit"
+)
 ;; This seems to cause a time-out on Travis.
 (;assert_unlinkable
   (module (memory 0x10000) (data (i32.const 0xffffffff) "ab"))
   ""  ;; either out of memory or segment does not fit
 ;)
 (assert_unlinkable
-  (module (global (import "spectest" "global") i32) (memory 0) (data (get_global 0) "a"))
+  (module
+    (global (import "spectest" "global") i32)
+    (memory 0) (data (get_global 0) "a")
+  )
   "data segment does not fit"
 )
 
diff --git a/js/src/jit-test/tests/wasm/spec/soft-fail.wast.js b/js/src/jit-test/tests/wasm/spec/soft-fail.wast.js
deleted file mode 100644
index 72db66c9b907..000000000000
--- a/js/src/jit-test/tests/wasm/spec/soft-fail.wast.js
+++ /dev/null
@@ -1 +0,0 @@
-var importedArgs = ['soft-fail.wast']; load(scriptdir + '../wast.js');
diff --git a/js/src/jit-test/tests/wasm/spec/unreachable.wast b/js/src/jit-test/tests/wasm/spec/unreachable.wast
index 82efa8fad7b6..f2c7e157b365 100644
--- a/js/src/jit-test/tests/wasm/spec/unreachable.wast
+++ b/js/src/jit-test/tests/wasm/spec/unreachable.wast
@@ -75,6 +75,9 @@
   (func (export "as-br_table-value-index") (result i32)
     (block i32 (br_table 0 0 (i32.const 6) (unreachable)) (i32.const 7))
   )
+  (func (export "as-br_table-value-and-index") (result i32)
+    (block i32 (br_table 0 0 (unreachable)) (i32.const 8))
+  )
 
   (func (export "as-return-value") (result i64)
     (return (unreachable))
diff --git a/js/src/jit-test/tests/wasm/spec/soft-fail.wast b/js/src/jit-test/tests/wasm/spec/unreached-invalid.wast
similarity index 82%
rename from js/src/jit-test/tests/wasm/spec/soft-fail.wast
rename to js/src/jit-test/tests/wasm/spec/unreached-invalid.wast
index 13c965382ef0..e1ec30516bdc 100644
--- a/js/src/jit-test/tests/wasm/spec/soft-fail.wast
+++ b/js/src/jit-test/tests/wasm/spec/unreached-invalid.wast
@@ -1,21 +1,35 @@
-;; Test soft failures
-;; These are invalid Wasm, but the failure is in dead code, which
-;; implementations are not required to validate. If they do, they shall
-;; diagnose the correct error.
+;; Failures in unreachable code.
 
-(assert_soft_invalid
+(assert_invalid
+  (module (func $local-index (unreachable) (drop (get_local 0))))
+  "unknown local"
+)
+(assert_invalid
+  (module (func $global-index (unreachable) (drop (get_global 0))))
+  "unknown global"
+)
+(assert_invalid
+  (module (func $func-index (unreachable) (call 1)))
+  "unknown function"
+)
+(assert_invalid
+  (module (func $label-index (unreachable) (br 1)))
+  "unknown label"
+)
+
+(assert_invalid
   (module (func $type-num-vs-num
     (unreachable) (drop (i64.eqz (i32.const 0))))
   )
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-poly-num-vs-num (result i32)
     (unreachable) (i64.const 0) (i32.const 0) (select)
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-poly-transitive-num-vs-num (result i32)
     (unreachable)
     (i64.const 0) (i32.const 0) (select)
@@ -24,275 +38,279 @@
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unconsumed-const (unreachable) (i32.const 0)))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unconsumed-result (unreachable) (i32.eqz)))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unconsumed-result2
     (unreachable) (i32.const 0) (i32.add)
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unconsumed-poly0 (unreachable) (select)))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unconsumed-poly1 (unreachable) (i32.const 0) (select)))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unconsumed-poly2
     (unreachable) (i32.const 0) (i32.const 0) (select)
   ))
   "type mismatch"
 )
+(assert_invalid
+  (module (func $type-select-any (result i32) (i32.const 1) (if i64 (then (i64.const 0)) (else (unreachable) (select)))))
+  "type mismatch"
+)
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-void-after-break
     (block (br 0) (block (drop (i32.eqz (nop)))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-num-after-break
     (block (br 0) (drop (i32.eqz (f32.const 1))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-void-after-break
     (block (br 0) (block (drop (f32.eq (i32.const 1)))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-num-after-break
     (block (br 0) (drop (f32.eq (i32.const 1) (f32.const 0))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-void-after-break
     (block (br 0) (i32.const 1))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-num-after-break (result i32)
     (block i32 (i32.const 1) (br 0) (f32.const 0))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-num-vs-void-after-break
     (block (loop (br 1) (i32.const 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-num-vs-num-after-break (result i32)
     (loop i32 (br 1 (i32.const 1)) (f32.const 0))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-func-value-num-vs-void-after-break
     (br 0) (i32.const 1)
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-func-value-num-vs-num-after-break (result i32)
     (br 0 (i32.const 1)) (f32.const 0)
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-void-after-return
     (return) (block (drop (i32.eqz (nop))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-num-after-return
     (return) (drop (i32.eqz (f32.const 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-void-after-return
     (return) (block (drop (f32.eq (i32.const 1))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-num-after-return
     (return) (drop (f32.eq (i32.const 1) (f32.const 0)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-void-after-return
     (block (return) (i32.const 1))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-num-after-return (result i32)
     (block i32 (i32.const 1) (return (i32.const 0)) (f32.const 0))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-num-vs-void-after-return
     (block (loop (return) (i32.const 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-num-vs-num-after-return (result i32)
     (loop i32 (return (i32.const 1)) (f32.const 0))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-func-value-num-vs-void-after-return
     (return) (i32.const 1)
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-func-value-num-vs-num-after-return (result i32)
     (return (i32.const 1)) (f32.const 0)
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-void-after-unreachable
     (unreachable) (block (drop (i32.eqz (nop))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-num-after-unreachable
     (unreachable) (drop (i32.eqz (f32.const 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-void-after-unreachable
     (unreachable) (block (drop (f32.eq (i32.const 1))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-num-after-unreachable
     (unreachable) (drop (f32.eq (i32.const 1) (f32.const 0)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-void-after-unreachable
     (block (unreachable) (i32.const 1))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-num-after-unreachable (result i32)
     (block i32 (i32.const 1) (unreachable) (f32.const 0))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-num-vs-void-after-unreachable
     (block (loop (unreachable) (i32.const 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-num-vs-num-after-unreachable (result i32)
     (loop i32 (unreachable) (f32.const 0))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-func-value-num-vs-void-after-unreachable
     (unreachable) (i32.const 1)
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-func-value-num-vs-num-after-unreachable (result i32)
     (unreachable) (f32.const 0)
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-void-after-nested-unreachable
     (block (unreachable)) (block (drop (i32.eqz (nop))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-num-after-nested-unreachable
     (block (unreachable)) (drop (i32.eqz (f32.const 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-void-after-nested-unreachable
     (block (unreachable)) (block (drop (f32.eq (i32.const 1))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-num-after-nested-unreachable
     (block (unreachable)) (drop (f32.eq (i32.const 1) (f32.const 0)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-void-after-nested-unreachable
     (block (block (unreachable)) (i32.const 1))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-num-after-nested-unreachable
     (result i32)
     (block i32 (i32.const 1) (block (unreachable)) (f32.const 0))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-num-vs-void-after-nested-unreachable
     (block (loop (block (unreachable)) (i32.const 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-num-vs-num-after-nested-unreachable
     (result i32)
     (loop i32 (block (unreachable)) (f32.const 0))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-func-value-num-vs-void-after-nested-unreachable
     (block (unreachable)) (i32.const 1)
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-func-value-num-vs-num-after-nested-unreachable
     (result i32)
     (block (unreachable)) (f32.const 0)
@@ -300,243 +318,275 @@
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-void-after-infinite-loop
     (loop (br 0)) (block (drop (i32.eqz (nop))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-num-after-infinite-loop
     (loop (br 0)) (drop (i32.eqz (f32.const 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-void-after-infinite-loop
     (loop (br 0)) (block (drop (f32.eq (i32.const 1))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-num-after-infinite-loop
     (loop (br 0)) (drop (f32.eq (i32.const 1) (f32.const 0)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-void-after-infinite-loop
     (block (loop (br 0)) (i32.const 1))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-num-after-infinite-loop (result i32)
     (block i32 (i32.const 1) (loop (br 0)) (f32.const 0))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-num-vs-void-after-infinite-loop
     (block (loop (loop (br 0)) (i32.const 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-num-vs-num-after-infinite-loop (result i32)
     (loop i32 (loop (br 0)) (f32.const 0))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-func-value-num-vs-void-after-infinite-loop
     (loop (br 0)) (i32.const 1)
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-func-value-num-vs-num-after-infinite-loop (result i32)
     (loop (br 0)) (f32.const 0)
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-void-in-dead-body
     (if (i32.const 0) (then (drop (i32.eqz (nop)))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-unary-num-vs-num-in-dead-body
     (if (i32.const 0) (then (drop (i32.eqz (f32.const 1)))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-void-in-dead-body
     (if (i32.const 0) (then (drop (f32.eq (i32.const 1)))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-binary-num-vs-num-in-dead-body
     (if (i32.const 0) (then (drop (f32.eq (i32.const 1) (f32.const 0)))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-if-value-num-vs-void-in-dead-body
     (if (i32.const 0) (then (i32.const 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-if-value-num-vs-num-in-dead-body (result i32)
     (if i32 (i32.const 0) (then (f32.const 0)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-void-in-dead-body
     (if (i32.const 0) (then (block (i32.const 1))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-num-in-dead-body (result i32)
     (if i32 (i32.const 0) (then (block i32 (f32.const 0))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-void-in-dead-body
     (if (i32.const 0) (then (loop (i32.const 1))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-num-vs-num-in-dead-body (result i32)
     (if i32 (i32.const 0) (then (loop i32 (f32.const 0))))
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-return-second-num-vs-num (result i32)
     (return (i32.const 1)) (return (f64.const 1))
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-br-second-num-vs-num (result i32)
     (block i32 (br 0 (i32.const 1)) (br 0 (f64.const 1)))
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-br_if-cond-num-vs-num-after-unreachable
     (block (br_if 0 (unreachable) (f32.const 0)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-br_table-num-vs-num-after-unreachable
     (block (br_table 0 (unreachable) (f32.const 1)))
   ))
   "type mismatch"
 )
+(assert_invalid
+  (module (func $type-br_table-label-num-vs-num-after-unreachable (result i32)
+    (block i32 (unreachable) (br_table 0 (f32.const 0) (i32.const 1)))
+  ))
+  "type mismatch"
+)
+(assert_invalid
+  (module (func $type-br_table-label-num-vs-label-void-after-unreachable
+    (block
+      (block f32
+        (unreachable)
+        (br_table 0 1 0 (i32.const 1))
+      )
+      (drop)
+    )
+  ))
+  "type mismatch"
+)
+(assert_invalid
+  (module (func $type-br_table-label-num-vs-label-num-after-unreachable
+    (block f64
+      (block f32
+        (unreachable)
+        (br_table 0 1 1 (i32.const 1))
+      )
+      (drop)
+      (f64.const 0)
+    )
+    (drop)
+  ))
+  "type mismatch"
+)
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-unreachable-num-vs-void
     (block (i32.const 3) (block (unreachable)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-unreachable-void-vs-num (result i32)
     (block (block (unreachable)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-unreachable-num-vs-num (result i32)
     (block i64 (i64.const 0) (block (unreachable)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-unreachable-num2-vs-void (result i32)
     (block (i32.const 3) (block (i64.const 1) (unreachable))) (i32.const 9)
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-br-num-vs-void
     (block (i32.const 3) (block (br 1)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-br-void-vs-num (result i32)
     (block i32 (block (br 1 (i32.const 0))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-br-num-vs-num (result i32)
     (block i32 (i64.const 0) (block (br 1 (i32.const 0))))
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested2-br-num-vs-void
     (block (block (i32.const 3) (block (br 2))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested2-br-void-vs-num (result i32)
     (block i32 (block (block (br 2 (i32.const 0)))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested2-br-num-vs-num (result i32)
     (block i32 (block i64 (i64.const 0) (block (br 2 (i32.const 0)))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested2-br-num2-vs-void (result i32)
     (block (i32.const 3) (block (i64.const 1) (br 1))) (i32.const 9)
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-return-num-vs-void
     (block (i32.const 3) (block (return)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-return-void-vs-num (result i32)
     (block (block (return (i32.const 0))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-return-num-vs-num (result i32)
     (block i64 (i64.const 0) (block (return (i32.const 0))))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-block-value-nested-return-num2-vs-void (result i32)
     (block (i32.const 3) (block (i64.const 1) (return (i32.const 0))))
     (i32.const 9)
@@ -544,32 +594,32 @@
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-nested-unreachable-num-vs-void
     (loop (i32.const 3) (block (unreachable)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-nested-unreachable-void-vs-num (result i32)
     (loop (block (unreachable)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-loop-value-nested-unreachable-num-vs-num (result i32)
     (loop i64 (i64.const 0) (block (unreachable)))
   ))
   "type mismatch"
 )
 
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-cont-last-void-vs-empty (result i32)
     (loop (br 0 (nop)))
   ))
   "type mismatch"
 )
-(assert_soft_invalid
+(assert_invalid
   (module (func $type-cont-last-num-vs-empty (result i32)
     (loop (br 0 (i32.const 0)))
   ))
diff --git a/js/src/jit-test/tests/wasm/spec/unreached-invalid.wast.js b/js/src/jit-test/tests/wasm/spec/unreached-invalid.wast.js
new file mode 100644
index 000000000000..a51c6f496224
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/spec/unreached-invalid.wast.js
@@ -0,0 +1 @@
+var importedArgs = ['unreached-invalid.wast']; load(scriptdir + '../wast.js');
diff --git a/js/src/jit-test/tests/wasm/to-text-experimental.js b/js/src/jit-test/tests/wasm/to-text-experimental.js
index aca5de308b73..91f897f9f3bd 100644
--- a/js/src/jit-test/tests/wasm/to-text-experimental.js
+++ b/js/src/jit-test/tests/wasm/to-text-experimental.js
@@ -62,7 +62,7 @@ wasmFailValidateText(
   )
   (export "test" 0)
   (memory 1 10)
-)`, /popping value from empty stack/);
+)`, emptyStackError);
 
 // function calls
 runTest(`
diff --git a/js/src/jit-test/tests/wasm/unreachable.js b/js/src/jit-test/tests/wasm/unreachable.js
deleted file mode 100644
index 0bfd90d7e3e1..000000000000
--- a/js/src/jit-test/tests/wasm/unreachable.js
+++ /dev/null
@@ -1,30 +0,0 @@
-load(libdir + "wasm.js");
-
-// In unreachable code, the current design is that validation is disabled,
-// meaning we have to have a special mode in the decoder for decoding code
-// that won't actually run.
-
-wasmFullPass(`(module
-   (func (result i32)
-     (return (i32.const 42))
-     (i32.add (f64.const 1.0) (f32.const 0.0))
-     (return (f64.const 2.0))
-     (if (f32.const 3.0) (i64.const 2) (i32.const 1))
-     (select (f64.const -5.0) (f32.const 2.3) (f64.const 8.9))
-   )
-   (export "run" 0)
-)`, 42);
-
-wasmFullPass(`(module
-   (func (result i32) (param i32)
-     (block
-        (br_if 1 (i32.const 41) (get_local 0))
-        (br 1 (i32.const 42))
-     )
-     (i32.add (f32.const 0.0) (f64.const 1.0))
-     (return (f64.const 2.0))
-     (if (f32.const 3.0) (i64.const 2) (i32.const 1))
-     (select (f64.const -5.0) (f32.const 2.3) (f64.const 8.9))
-   )
-   (export "run" 0)
-)`, 42, {}, 0);
diff --git a/js/src/jit-test/tests/wasm/wast.js b/js/src/jit-test/tests/wasm/wast.js
index 97dc7e02d6fe..54abfe857edb 100644
--- a/js/src/jit-test/tests/wasm/wast.js
+++ b/js/src/jit-test/tests/wasm/wast.js
@@ -435,23 +435,6 @@ function exec(e) {
         return;
     }
 
-    if (exprName === "assert_soft_invalid") {
-        let moduleText = e.list[1].toString();
-        let errMsg = e.list[2];
-        if (errMsg) {
-            assert(errMsg.quoted, "assert_soft_invalid second argument must be a string");
-            errMsg.quoted = false;
-        }
-
-        try {
-            new WebAssembly.Module(wasmTextToBinary(moduleText));
-        } catch(e) {
-            debug('assert_soft_invalid caught:\nExpected:', errMsg, '\nActual:', e.toString());
-        }
-
-        return;
-    }
-
     if (exprName === 'assert_trap') {
         let caught = false;
         let errMsg = e.list[2];
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 02bdbfe337ba..aacc20c4ea42 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -474,6 +474,24 @@ JS_NewContext(uint32_t maxbytes, uint32_t maxNurseryBytes, JSRuntime* parentRunt
     return NewContext(maxbytes, maxNurseryBytes, parentRuntime);
 }
 
+JS_PUBLIC_API(JSContext*)
+JS_NewCooperativeContext(JSContext* siblingContext)
+{
+    return NewCooperativeContext(siblingContext);
+}
+
+JS_PUBLIC_API(void)
+JS_YieldCooperativeContext(JSContext* cx)
+{
+    YieldCooperativeContext(cx);
+}
+
+JS_PUBLIC_API(void)
+JS_ResumeCooperativeContext(JSContext* cx)
+{
+    ResumeCooperativeContext(cx);
+}
+
 JS_PUBLIC_API(void)
 JS_DestroyContext(JSContext* cx)
 {
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index cf41feaca2e7..937cc402a22c 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -981,11 +981,37 @@ JS_IsBuiltinFunctionConstructor(JSFunction* fun);
  * See: http://developer.mozilla.org/en/docs/Category:JSAPI_Reference
  */
 
+// Create a new runtime, with a single cooperative context for this thread.
+// On success, the new context will be the active context for the runtime.
 extern JS_PUBLIC_API(JSContext*)
 JS_NewContext(uint32_t maxbytes,
               uint32_t maxNurseryBytes = JS::DefaultNurseryBytes,
               JSRuntime* parentRuntime = nullptr);
 
+// The methods below for controlling the active context in a cooperatively
+// multithreaded runtime are not threadsafe, and the caller must ensure they
+// are called serially if there is a chance for contention between threads.
+
+// Called from the active context for a runtime, yield execution so that
+// this context is no longer active and can no longer use the API.
+extern JS_PUBLIC_API(void)
+JS_YieldCooperativeContext(JSContext* cx);
+
+// Called from a context whose runtime has no active context, this thread
+// becomes the active context for that runtime and may use the API.
+extern JS_PUBLIC_API(void)
+JS_ResumeCooperativeContext(JSContext* cx);
+
+// Create a new context on this thread for cooperative multithreading in the
+// same runtime as siblingContext. Called on a runtime (as indicated by
+// siblingContet) which has no active context, on success the new context will
+// become the runtime's active context.
+extern JS_PUBLIC_API(JSContext*)
+JS_NewCooperativeContext(JSContext* siblingContext);
+
+// Destroy a context allocated with JS_NewContext or JS_NewCooperativeContext.
+// The context must be the current active context in the runtime, and after
+// this call the runtime will have no active context.
 extern JS_PUBLIC_API(void)
 JS_DestroyContext(JSContext* cx);
 
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index c068bc44a85c..604ffa691fd0 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -99,36 +99,43 @@ js::TraceCycleDetectionSet(JSTracer* trc, AutoCycleDetector::Set& set)
 }
 
 bool
-JSContext::init()
+JSContext::init(ContextKind kind)
 {
-    // Get a platform-native handle for this thread, used by js::InterruptRunningJitCode.
+    // Skip most of the initialization if this thread will not be running JS.
+    if (kind == ContextKind::Cooperative) {
+        // Get a platform-native handle for this thread, used by js::InterruptRunningJitCode.
 #ifdef XP_WIN
-    size_t openFlags = THREAD_GET_CONTEXT | THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME |
-                       THREAD_QUERY_INFORMATION;
-    HANDLE self = OpenThread(openFlags, false, GetCurrentThreadId());
-    if (!self)
+        size_t openFlags = THREAD_GET_CONTEXT | THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME |
+                           THREAD_QUERY_INFORMATION;
+        HANDLE self = OpenThread(openFlags, false, GetCurrentThreadId());
+        if (!self)
         return false;
-    static_assert(sizeof(HANDLE) <= sizeof(threadNative_), "need bigger field");
-    threadNative_ = (size_t)self;
+        static_assert(sizeof(HANDLE) <= sizeof(threadNative_), "need bigger field");
+        threadNative_ = (size_t)self;
 #else
-    static_assert(sizeof(pthread_t) <= sizeof(threadNative_), "need bigger field");
-    threadNative_ = (size_t)pthread_self();
+        static_assert(sizeof(pthread_t) <= sizeof(threadNative_), "need bigger field");
+        threadNative_ = (size_t)pthread_self();
 #endif
 
-    if (!regexpStack.ref().init())
-        return false;
+        if (!regexpStack.ref().init())
+            return false;
 
-    if (!fx.initInstance())
-        return false;
+        if (!fx.initInstance())
+            return false;
 
 #ifdef JS_SIMULATOR
-    simulator_ = js::jit::Simulator::Create(this);
-    if (!simulator_)
-        return false;
+        simulator_ = js::jit::Simulator::Create(this);
+        if (!simulator_)
+            return false;
 #endif
 
-    if (!wasm::EnsureSignalHandlers(this))
-        return false;
+        if (!wasm::EnsureSignalHandlers(this))
+            return false;
+    }
+
+    // Set the ContextKind last, so that ProtectedData checks will allow us to
+    // initialize this context before it becomes the runtime's active context.
+    kind_ = kind;
 
     return true;
 }
@@ -156,8 +163,7 @@ js::NewContext(uint32_t maxBytes, uint32_t maxNurseryBytes, JSRuntime* parentRun
         return nullptr;
     }
 
-
-    if (!cx->init()) {
+    if (!cx->init(ContextKind::Cooperative)) {
         js_delete(cx);
         js_delete(runtime);
         return nullptr;
@@ -166,6 +172,39 @@ js::NewContext(uint32_t maxBytes, uint32_t maxNurseryBytes, JSRuntime* parentRun
     return cx;
 }
 
+JSContext*
+js::NewCooperativeContext(JSContext* siblingContext)
+{
+    MOZ_RELEASE_ASSERT(!TlsContext.get());
+
+    JSRuntime* runtime = siblingContext->runtime();
+
+    JSContext* cx = js_new<JSContext>(runtime, JS::ContextOptions());
+    if (!cx || !cx->init(ContextKind::Cooperative)) {
+        js_delete(cx);
+        return nullptr;
+    }
+
+    runtime->setNewbornActiveContext(cx);
+    return cx;
+}
+
+void
+js::YieldCooperativeContext(JSContext* cx)
+{
+    MOZ_ASSERT(cx == TlsContext.get());
+    MOZ_ASSERT(cx->runtime()->activeContext() == cx);
+    cx->runtime()->setActiveContext(nullptr);
+}
+
+void
+js::ResumeCooperativeContext(JSContext* cx)
+{
+    MOZ_ASSERT(cx == TlsContext.get());
+    MOZ_ASSERT(cx->runtime()->activeContext() == nullptr);
+    cx->runtime()->setActiveContext(cx);
+}
+
 void
 js::DestroyContext(JSContext* cx)
 {
@@ -186,6 +225,8 @@ js::DestroyContext(JSContext* cx)
         // Destroy the runtime along with its last context.
         cx->runtime()->destroyRuntime();
         js_delete(cx->runtime());
+
+        js_delete_poison(cx);
     } else {
         DebugOnly<bool> found = false;
         for (size_t i = 0; i < cx->runtime()->cooperatingContexts().length(); i++) {
@@ -197,9 +238,9 @@ js::DestroyContext(JSContext* cx)
             }
         }
         MOZ_ASSERT(found);
-    }
 
-    js_delete_poison(cx);
+        cx->runtime()->deleteActiveContext(cx);
+    }
 }
 
 void
@@ -1092,6 +1133,7 @@ JSContext::alreadyReportedError()
 
 JSContext::JSContext(JSRuntime* runtime, const JS::ContextOptions& options)
   : runtime_(runtime),
+    kind_(ContextKind::Background),
     threadNative_(0),
     helperThread_(nullptr),
     options_(options),
@@ -1171,15 +1213,20 @@ JSContext::JSContext(JSRuntime* runtime, const JS::ContextOptions& options)
 {
     MOZ_ASSERT(static_cast<JS::RootingContext*>(this) ==
                JS::RootingContext::get(this));
-    for (size_t i = 0; i < mozilla::ArrayLength(nativeStackQuota); i++)
-        nativeStackQuota[i] = 0;
 
     MOZ_ASSERT(!TlsContext.get());
     TlsContext.set(this);
+
+    for (size_t i = 0; i < mozilla::ArrayLength(nativeStackQuota); i++)
+        nativeStackQuota[i] = 0;
 }
 
 JSContext::~JSContext()
 {
+    // Clear the ContextKind first, so that ProtectedData checks will allow us to
+    // destroy this context even if the runtime is already gone.
+    kind_ = ContextKind::Background;
+
 #ifdef XP_WIN
     if (threadNative_)
         CloseHandle((HANDLE)threadNative_.ref());
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index b0e629b2595d..1dfec3f798c7 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -80,6 +80,12 @@ void ReportOverRecursed(JSContext* cx, unsigned errorNumber);
 /* Thread Local Storage slot for storing the context for a thread. */
 extern MOZ_THREAD_LOCAL(JSContext*) TlsContext;
 
+enum class ContextKind
+{
+    Cooperative,
+    Background
+};
+
 } /* namespace js */
 
 /*
@@ -89,13 +95,14 @@ extern MOZ_THREAD_LOCAL(JSContext*) TlsContext;
 struct JSContext : public JS::RootingContext,
                    public js::MallocProvider<JSContext>
 {
-    explicit JSContext(JSRuntime* runtime, const JS::ContextOptions& options);
+    JSContext(JSRuntime* runtime, const JS::ContextOptions& options);
     ~JSContext();
 
-    bool init();
+    bool init(js::ContextKind kind);
 
   private:
     js::UnprotectedData<JSRuntime*> runtime_;
+    js::WriteOnceData<js::ContextKind> kind_;
 
     // System handle for the thread this context is associated with.
     js::WriteOnceData<size_t> threadNative_;
@@ -112,6 +119,7 @@ struct JSContext : public JS::RootingContext,
     // currently operating on.
     void setRuntime(JSRuntime* rt);
 
+    bool isCooperativelyScheduled() const { return kind_ == js::ContextKind::Cooperative; }
     size_t threadNative() const { return threadNative_; }
 
     inline js::gc::ArenaLists* arenas() const { return arenas_; }
@@ -639,7 +647,7 @@ struct JSContext : public JS::RootingContext,
     const js::AutoCycleDetector::Set& cycleDetectorSet() const { return cycleDetectorSet_.ref(); }
 
     /* Client opaque pointer. */
-    void* data;
+    js::UnprotectedData<void*> data;
 
     void initJitStackLimit();
     void resetJitStackLimit();
@@ -951,6 +959,15 @@ struct MOZ_RAII AutoResolving {
 extern JSContext*
 NewContext(uint32_t maxBytes, uint32_t maxNurseryBytes, JSRuntime* parentRuntime);
 
+extern JSContext*
+NewCooperativeContext(JSContext* siblingContext);
+
+extern void
+YieldCooperativeContext(JSContext* cx);
+
+extern void
+ResumeCooperativeContext(JSContext* cx);
+
 extern void
 DestroyContext(JSContext* cx);
 
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index b8a80c1f3d75..9c103a497228 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -984,9 +984,10 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
           if (op == JSOP_TRY) {
               TryNoteArray* trynotes = script->trynotes();
               uint32_t i;
+              size_t mainOffset = script->mainOffset();
               for(i = 0; i < trynotes->length; i++) {
                   JSTryNote note = trynotes->vector[i];
-                  if (note.kind == JSTRY_CATCH && note.start == loc + 1) {
+                  if (note.kind == JSTRY_CATCH && note.start + mainOffset == loc + 1) {
                       if (!sp->jsprintf(" %u (%+d)",
                                         unsigned(loc + note.length + 1),
                                         int(note.length + 1)))
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index ab871dccd3ba..823d47b49190 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -3362,14 +3362,96 @@ EvalInContext(JSContext* cx, unsigned argc, Value* vp)
     return true;
 }
 
+struct CooperationState
+{
+    CooperationState()
+      : lock(mutexid::ShellThreadCooperation)
+      , idle(false)
+      , numThreads(0)
+      , yieldCount(0)
+    {}
+
+    Mutex lock;
+    ConditionVariable cvar;
+    bool idle;
+    size_t numThreads;
+    uint64_t yieldCount;
+};
+static CooperationState* cooperationState = nullptr;
+
+static void
+CooperativeBeginWait(JSContext* cx)
+{
+    MOZ_ASSERT(cx == TlsContext.get());
+    JS_YieldCooperativeContext(cx);
+}
+
+static void
+CooperativeEndWait(JSContext* cx)
+{
+    MOZ_ASSERT(cx == TlsContext.get());
+    LockGuard<Mutex> lock(cooperationState->lock);
+
+    cooperationState->cvar.wait(lock, [&] { return cooperationState->idle; });
+
+    JS_ResumeCooperativeContext(cx);
+    cooperationState->idle = false;
+    cooperationState->yieldCount++;
+    cooperationState->cvar.notify_all();
+}
+
+static void
+CooperativeYield()
+{
+    LockGuard<Mutex> lock(cooperationState->lock);
+    MOZ_ASSERT(!cooperationState->idle);
+    cooperationState->idle = true;
+    cooperationState->cvar.notify_all();
+
+    // Wait until another thread takes over control before returning, if there
+    // is another thread to do so.
+    if (cooperationState->numThreads) {
+        uint64_t count = cooperationState->yieldCount;
+        cooperationState->cvar.wait(lock, [&] { return cooperationState->yieldCount != count; });
+    }
+}
+
+static bool
+CooperativeYieldThread(JSContext* cx, unsigned argc, Value* vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    if (!cooperationState) {
+        JS_ReportErrorASCII(cx, "No cooperative threads have been created");
+        return false;
+    }
+
+    if (GetShellContext(cx)->isWorker) {
+        JS_ReportErrorASCII(cx, "Worker threads cannot yield");
+        return false;
+    }
+
+    CooperativeBeginWait(cx);
+    CooperativeYield();
+    CooperativeEndWait(cx);
+
+    args.rval().setUndefined();
+    return true;
+}
+
 struct WorkerInput
 {
     JSRuntime* parentRuntime;
+    JSContext* siblingContext;
     char16_t* chars;
     size_t length;
 
     WorkerInput(JSRuntime* parentRuntime, char16_t* chars, size_t length)
-      : parentRuntime(parentRuntime), chars(chars), length(length)
+      : parentRuntime(parentRuntime), siblingContext(nullptr), chars(chars), length(length)
+    {}
+
+    WorkerInput(JSContext* siblingContext, char16_t* chars, size_t length)
+      : parentRuntime(nullptr), siblingContext(siblingContext), chars(chars), length(length)
     {}
 
     ~WorkerInput() {
@@ -3383,48 +3465,65 @@ static void
 WorkerMain(void* arg)
 {
     WorkerInput* input = (WorkerInput*) arg;
+    MOZ_ASSERT(!!input->parentRuntime != !!input->siblingContext);
 
-    JSContext* cx = JS_NewContext(8L * 1024L * 1024L, 2L * 1024L * 1024L, input->parentRuntime);
-    if (!cx) {
-        js_delete(input);
+    JSContext* cx = nullptr;
+
+    auto guard = mozilla::MakeScopeExit([&] {
+            if (cx)
+                JS_DestroyContext(cx);
+            if (input->siblingContext) {
+                cooperationState->numThreads--;
+                CooperativeYield();
+            }
+            js_delete(input);
+        });
+
+    cx = input->parentRuntime
+         ? JS_NewContext(8L * 1024L * 1024L, 2L * 1024L * 1024L, input->parentRuntime)
+         : JS_NewCooperativeContext(input->siblingContext);
+    if (!cx)
         return;
-    }
 
     UniquePtr<ShellContext> sc = MakeUnique<ShellContext>(cx);
-    if (!sc) {
-        JS_DestroyContext(cx);
-        js_delete(input);
+    if (!sc)
         return;
-    }
 
-    sc->isWorker = true;
+    if (input->parentRuntime)
+        sc->isWorker = true;
     JS_SetContextPrivate(cx, sc.get());
-    JS_SetFutexCanWait(cx);
-    JS::SetWarningReporter(cx, WarningReporter);
-    js::SetPreserveWrapperCallback(cx, DummyPreserveWrapperCallback);
-    JS_InitDestroyPrincipalsCallback(cx, ShellPrincipals::destroy);
     SetWorkerContextOptions(cx);
-
-    if (!JS::InitSelfHostedCode(cx)) {
-        JS_DestroyContext(cx);
-        js_delete(input);
-        return;
-    }
-
     sc->jobQueue.init(cx, JobQueue(SystemAllocPolicy()));
-    JS::SetEnqueuePromiseJobCallback(cx, ShellEnqueuePromiseJobCallback);
-    JS::SetGetIncumbentGlobalCallback(cx, ShellGetIncumbentGlobalCallback);
-    JS::SetAsyncTaskCallbacks(cx, ShellStartAsyncTaskCallback, ShellFinishAsyncTaskCallback);
 
-    EnvironmentPreparer environmentPreparer(cx);
+    Maybe<EnvironmentPreparer> environmentPreparer;
+    if (input->parentRuntime) {
+        JS_SetFutexCanWait(cx);
+        JS::SetWarningReporter(cx, WarningReporter);
+        js::SetPreserveWrapperCallback(cx, DummyPreserveWrapperCallback);
+        JS_InitDestroyPrincipalsCallback(cx, ShellPrincipals::destroy);
 
-    JS::SetLargeAllocationFailureCallback(cx, my_LargeAllocFailCallback, (void*)cx);
+        if (!JS::InitSelfHostedCode(cx))
+            return;
+
+        JS::SetEnqueuePromiseJobCallback(cx, ShellEnqueuePromiseJobCallback);
+        JS::SetGetIncumbentGlobalCallback(cx, ShellGetIncumbentGlobalCallback);
+        JS::SetAsyncTaskCallbacks(cx, ShellStartAsyncTaskCallback, ShellFinishAsyncTaskCallback);
+
+        environmentPreparer.emplace(cx);
+
+        JS::SetLargeAllocationFailureCallback(cx, my_LargeAllocFailCallback, (void*)cx);
+    } else {
+        JS_AddInterruptCallback(cx, ShellInterruptCallback);
+    }
 
     do {
         JSAutoRequest ar(cx);
 
         JS::CompartmentOptions compartmentOptions;
         SetStandardCompartmentOptions(compartmentOptions);
+        if (input->siblingContext)
+            compartmentOptions.creationOptions().setNewZoneInNewZoneGroup();
+
         RootedObject global(cx, NewGlobalObject(cx, compartmentOptions, nullptr));
         if (!global)
             break;
@@ -3450,10 +3549,6 @@ WorkerMain(void* arg)
     sc->jobQueue.reset();
 
     KillWatchdog(cx);
-
-    JS_DestroyContext(cx);
-
-    js_delete(input);
 }
 
 // Workers can spawn other workers, so we need a lock to access workerThreads.
@@ -3472,26 +3567,35 @@ class MOZ_RAII AutoLockWorkerThreads : public LockGuard<Mutex>
 };
 
 static bool
-EvalInWorker(JSContext* cx, unsigned argc, Value* vp)
+EvalInThread(JSContext* cx, unsigned argc, Value* vp, bool cooperative)
 {
     if (!CanUseExtraThreads()) {
-        JS_ReportErrorASCII(cx, "Can't create worker threads with --no-threads");
+        JS_ReportErrorASCII(cx, "Can't create threads with --no-threads");
         return false;
     }
 
     CallArgs args = CallArgsFromVp(argc, vp);
     if (!args.get(0).isString()) {
-        JS_ReportErrorASCII(cx, "Invalid arguments to evalInWorker");
+        JS_ReportErrorASCII(cx, "Invalid arguments");
         return false;
     }
 
 #if defined(DEBUG) || defined(JS_OOM_BREAKPOINT)
     if (cx->runningOOMTest) {
-        JS_ReportErrorASCII(cx, "Can't create workers while running simulated OOM test");
+        JS_ReportErrorASCII(cx, "Can't create threads while running simulated OOM test");
         return false;
     }
 #endif
 
+    if (cooperative && GetShellContext(cx)->isWorker) {
+        // Disallowing cooperative multithreading in worker runtimes allows
+        // yield state to be process wide, and some other simplifications.
+        // When we have a better idea of how cooperative multithreading will be
+        // used in the browser this restriction might be relaxed.
+        JS_ReportErrorASCII(cx, "Cooperative multithreading in worker runtimes is not supported");
+        return false;
+    }
+
     if (!args[0].toString()->ensureLinear(cx))
         return false;
 
@@ -3513,29 +3617,60 @@ EvalInWorker(JSContext* cx, unsigned argc, Value* vp)
 
     CopyChars(chars, *str);
 
-    WorkerInput* input = js_new<WorkerInput>(JS_GetParentRuntime(cx), chars, str->length());
+    WorkerInput* input =
+        cooperative
+        ? js_new<WorkerInput>(cx, chars, str->length())
+        : js_new<WorkerInput>(JS_GetParentRuntime(cx), chars, str->length());
     if (!input) {
         ReportOutOfMemory(cx);
         return false;
     }
 
+    if (cooperative) {
+        if (!cooperationState)
+            cooperationState = js_new<CooperationState>();
+        cooperationState->numThreads++;
+        CooperativeBeginWait(cx);
+    }
+
     auto thread = js_new<Thread>(Thread::Options().setStackSize(gMaxStackSize + 128 * 1024));
     if (!thread || !thread->init(WorkerMain, input)) {
         ReportOutOfMemory(cx);
+        if (cooperative) {
+            cooperationState->numThreads--;
+            CooperativeYield();
+            CooperativeEndWait(cx);
+        }
         return false;
     }
 
-    AutoLockWorkerThreads alwt;
-    if (!workerThreads.append(thread)) {
-        ReportOutOfMemory(cx);
-        thread->join();
-        return false;
+    if (cooperative) {
+        CooperativeEndWait(cx);
+    } else {
+        AutoLockWorkerThreads alwt;
+        if (!workerThreads.append(thread)) {
+            ReportOutOfMemory(cx);
+            thread->join();
+            return false;
+        }
     }
 
     args.rval().setUndefined();
     return true;
 }
 
+static bool
+EvalInWorker(JSContext* cx, unsigned argc, Value* vp)
+{
+    return EvalInThread(cx, argc, vp, false);
+}
+
+static bool
+EvalInCooperativeThread(JSContext* cx, unsigned argc, Value* vp)
+{
+    return EvalInThread(cx, argc, vp, true);
+}
+
 static bool
 ShapeOf(JSContext* cx, unsigned argc, JS::Value* vp)
 {
@@ -3713,7 +3848,7 @@ ScheduleWatchdog(JSContext* cx, double t)
 }
 
 static void
-KillWorkerThreads()
+KillWorkerThreads(JSContext* cx)
 {
     MOZ_ASSERT_IF(!CanUseExtraThreads(), workerThreads.empty());
 
@@ -3738,6 +3873,16 @@ KillWorkerThreads()
 
     js_delete(workerThreadsLock);
     workerThreadsLock = nullptr;
+
+    // Yield until all other cooperative threads in the main runtime finish.
+    while (cooperationState && cooperationState->numThreads) {
+        CooperativeBeginWait(cx);
+        CooperativeYield();
+        CooperativeEndWait(cx);
+    }
+
+    js_delete(cooperationState);
+    cooperationState = nullptr;
 }
 
 static void
@@ -4822,6 +4967,7 @@ NewGlobal(JSContext* cx, unsigned argc, Value* vp)
     JS::CompartmentBehaviors& behaviors = options.behaviors();
 
     SetStandardCompartmentOptions(options);
+    options.creationOptions().setNewZoneInExistingZoneGroup(cx->global());
 
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() == 1 && args[0].isObject()) {
@@ -6020,6 +6166,14 @@ static const JSFunctionSpecWithHelp shell_functions[] = {
 "evalInWorker(str)",
 "  Evaluate 'str' in a separate thread with its own runtime.\n"),
 
+    JS_FN_HELP("evalInCooperativeThread", EvalInCooperativeThread, 1, 0,
+"evalInCooperativeThread(str)",
+"  Evaluate 'str' in a separate cooperatively scheduled thread using the same runtime.\n"),
+
+    JS_FN_HELP("cooperativeYield", CooperativeYieldThread, 0, 0,
+"evalInCooperativeThread()",
+"  Yield execution to another cooperatively scheduled thread using the same runtime.\n"),
+
     JS_FN_HELP("getSharedArrayBuffer", GetSharedArrayBuffer, 0, 0,
 "getSharedArrayBuffer()",
 "  Retrieve the SharedArrayBuffer object from the cross-worker mailbox.\n"
@@ -8178,7 +8332,7 @@ main(int argc, char** argv, char** envp)
 
     KillWatchdog(cx);
 
-    KillWorkerThreads();
+    KillWorkerThreads(cx);
 
     DestructSharedArrayBufferMailbox();
 
diff --git a/js/src/tests/ecma_6/Comprehensions/for-reserved-word.js b/js/src/tests/ecma_6/Comprehensions/for-reserved-word.js
new file mode 100644
index 000000000000..9b320fc91e42
--- /dev/null
+++ b/js/src/tests/ecma_6/Comprehensions/for-reserved-word.js
@@ -0,0 +1,107 @@
+var BUGNUMBER = 1340089;
+var summary = "Comprehension should check the binding names";
+
+print(BUGNUMBER + ": " + summary);
+
+// Non strict mode.
+// Keywords, literals, 'let', and 'yield' are not allowed.
+
+assertThrowsInstanceOf(function () {
+    eval("[for (true of [1]) 2]");
+}, SyntaxError);
+assertThrowsInstanceOf(function () {
+    eval("(for (true of [1]) 2)");
+}, SyntaxError);
+
+assertThrowsInstanceOf(function () {
+    eval("[for (throw of [1]) 2]");
+}, SyntaxError);
+assertThrowsInstanceOf(function () {
+    eval("(for (throw of [1]) 2)");
+}, SyntaxError);
+
+assertThrowsInstanceOf(function () {
+    eval("[for (let of [1]) 2]");
+}, SyntaxError);
+assertThrowsInstanceOf(function () {
+    eval("(for (let of [1]) 2)");
+}, SyntaxError);
+
+assertThrowsInstanceOf(function () {
+    eval("[for (yield of [1]) 2]");
+}, SyntaxError);
+assertThrowsInstanceOf(function () {
+    eval("(for (yield of [1]) 2)");
+}, SyntaxError);
+
+eval("[for (public of [1]) 2]");
+eval("(for (public of [1]) 2)");
+
+eval("[for (static of [1]) 2]");
+eval("(for (static of [1]) 2)");
+
+// Strict mode.
+// All reserved words are not allowed.
+
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("[for (true of [1]) 2]");
+}, SyntaxError);
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("(for (true of [1]) 2)");
+}, SyntaxError);
+
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("[for (throw of [1]) 2]");
+}, SyntaxError);
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("(for (throw of [1]) 2)");
+}, SyntaxError);
+
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("[for (let of [1]) 2]");
+}, SyntaxError);
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("(for (let of [1]) 2)");
+}, SyntaxError);
+
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("[for (yield of [1]) 2]");
+}, SyntaxError);
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("(for (yield of [1]) 2)");
+}, SyntaxError);
+
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("[for (public of [1]) 2]");
+}, SyntaxError);
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("(for (public of [1]) 2)");
+}, SyntaxError);
+
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("[for (static of [1]) 2]");
+}, SyntaxError);
+assertThrowsInstanceOf(function () {
+    "use strict";
+    eval("(for (static of [1]) 2)");
+}, SyntaxError);
+
+(function () {
+    "use strict";
+    eval("[for (await of [1]) 2]");
+    eval("(for (await of [1]) 2)");
+})();
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/tests/ecma_6/TypedArray/set-detached.js b/js/src/tests/ecma_6/TypedArray/set-detached.js
new file mode 100644
index 000000000000..56f9631daf7b
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedArray/set-detached.js
@@ -0,0 +1,240 @@
+// Tests for detached ArrayBuffer checks in %TypedArray%.prototype.set(array|typedArray, offset).
+
+function* createTypedArrays(lengths = [0, 1, 4, 4096]) {
+    for (let length of lengths) {
+        let buffer = new ArrayBuffer(length * Int32Array.BYTES_PER_ELEMENT);
+        let typedArray = new Int32Array(buffer);
+
+        yield {typedArray, buffer};
+    }
+}
+
+if (typeof detachArrayBuffer === "function") {
+    class ExpectedError extends Error {}
+
+    // No detached check on function entry.
+    for (let {typedArray, buffer} of createTypedArrays()) {
+        detachArrayBuffer(buffer);
+
+        assertThrowsInstanceOf(() => typedArray.set(null, {
+            valueOf() {
+                throw new ExpectedError();
+            }
+        }), ExpectedError);
+    }
+
+    // Check for detached buffer after calling ToInteger(offset). Test with:
+    // - valid offset,
+    // - too large offset,
+    // - and negative offset.
+    for (let [offset, error] of [[0, TypeError], [1000000, TypeError], [-1, RangeError]]) {
+        for (let source of [[], [0], new Int32Array(0), new Int32Array(1)]) {
+            for (let {typedArray, buffer} of createTypedArrays()) {
+                assertThrowsInstanceOf(() => typedArray.set(source, {
+                    valueOf() {
+                        detachArrayBuffer(buffer);
+                        return offset;
+                    }
+                }), error);
+            }
+        }
+    }
+
+    // Tests when called with detached typed array as source.
+    for (let {typedArray} of createTypedArrays()) {
+        for (let {typedArray: source, buffer: sourceBuffer} of createTypedArrays()) {
+            detachArrayBuffer(sourceBuffer);
+
+            assertThrowsInstanceOf(() => typedArray.set(source, {
+                valueOf() {
+                    throw new ExpectedError();
+                }
+            }), ExpectedError);
+        }
+    }
+
+    // Check when detaching source buffer in ToInteger(offset). Test with:
+    // - valid offset,
+    // - too large offset,
+    // - and negative offset.
+    for (let [offset, error] of [[0, TypeError], [1000000, TypeError], [-1, RangeError]]) {
+        for (let {typedArray} of createTypedArrays()) {
+            for (let {typedArray: source, buffer: sourceBuffer} of createTypedArrays()) {
+                assertThrowsInstanceOf(() => typedArray.set(source, {
+                    valueOf() {
+                        detachArrayBuffer(sourceBuffer);
+                        return offset;
+                    }
+                }), error);
+            }
+        }
+    }
+
+    // Test when target and source use the same underlying buffer and
+    // ToInteger(offset) detaches the buffer. Test with:
+    // - same typed array,
+    // - different typed array, but same element type,
+    // - and different element type.
+    for (let src of [ta => ta, ta => new Int32Array(ta.buffer), ta => new Float32Array(ta.buffer)]) {
+        for (let {typedArray, buffer} of createTypedArrays()) {
+            let source = src(typedArray);
+            assertThrowsInstanceOf(() => typedArray.set(source, {
+                valueOf() {
+                    detachArrayBuffer(buffer);
+                    return 0;
+                }
+            }), TypeError);
+        }
+    }
+
+    // Test when Get(src, "length") detaches the buffer, but srcLength is 0.
+    // Also use different offsets to ensure bounds checks use the typed array's
+    // length value from before detaching the buffer.
+    for (let offset of [() => 0, ta => Math.min(1, ta.length), ta => Math.max(0, ta.length - 1)]) {
+        for (let {typedArray, buffer} of createTypedArrays()) {
+            let source = {
+                get length() {
+                    detachArrayBuffer(buffer);
+                    return 0;
+                }
+            };
+            typedArray.set(source, offset(typedArray));
+        }
+    }
+
+    // Test when ToLength(Get(src, "length")) detaches the buffer, but
+    // srcLength is 0. Also use different offsets to ensure bounds checks use
+    // the typed array's length value from before detaching the buffer.
+    for (let offset of [() => 0, ta => Math.min(1, ta.length), ta => Math.max(0, ta.length - 1)]) {
+        for (let {typedArray, buffer} of createTypedArrays()) {
+            let source = {
+                length: {
+                    valueOf() {
+                        detachArrayBuffer(buffer);
+                        return 0;
+                    }
+                }
+            };
+            typedArray.set(source, offset(typedArray));
+        }
+    }
+
+    // Test a TypeError is thrown when the typed array is detached and
+    // srcLength > 0.
+    for (let {typedArray, buffer} of createTypedArrays()) {
+        let source = {
+            length: {
+                valueOf() {
+                    detachArrayBuffer(buffer);
+                    return 1;
+                }
+            }
+        };
+        let err = typedArray.length === 0 ? RangeError : TypeError;
+        assertThrowsInstanceOf(() => typedArray.set(source), err);
+    }
+
+    // Same as above, but with side-effect when executing Get(src, "0").
+    for (let {typedArray, buffer} of createTypedArrays()) {
+        let source = {
+            get 0() {
+                throw new ExpectedError();
+            },
+            length: {
+                valueOf() {
+                    detachArrayBuffer(buffer);
+                    return 1;
+                }
+            }
+        };
+        let err = typedArray.length === 0 ? RangeError : ExpectedError;
+        assertThrowsInstanceOf(() => typedArray.set(source), err);
+    }
+
+    // Same as above, but with side-effect when executing ToNumber(Get(src, "0")).
+    for (let {typedArray, buffer} of createTypedArrays()) {
+        let source = {
+            get 0() {
+                return {
+                    valueOf() {
+                        throw new ExpectedError();
+                    }
+                };
+            },
+            length: {
+                valueOf() {
+                    detachArrayBuffer(buffer);
+                    return 1;
+                }
+            }
+        };
+        let err = typedArray.length === 0 ? RangeError : ExpectedError;
+        assertThrowsInstanceOf(() => typedArray.set(source), err);
+    }
+
+    // Side-effects when getting the source elements detach the buffer.
+    for (let {typedArray, buffer} of createTypedArrays()) {
+        let source = Object.defineProperties([], {
+            0: {
+                get() {
+                    detachArrayBuffer(buffer);
+                    return 1;
+                }
+            }
+        });
+        let err = typedArray.length === 0 ? RangeError : TypeError;
+        assertThrowsInstanceOf(() => typedArray.set(source), err);
+    }
+
+    // Side-effects when getting the source elements detach the buffer. Also
+    // ensure other elements aren't accessed.
+    for (let {typedArray, buffer} of createTypedArrays()) {
+        let source = Object.defineProperties([], {
+            0: {
+                get() {
+                    detachArrayBuffer(buffer);
+                    return 1;
+                }
+            },
+            1: {
+                get() {
+                    throw new Error("Unexpected access");
+                }
+            }
+        });
+        let err = typedArray.length <= 1 ? RangeError : TypeError;
+        assertThrowsInstanceOf(() => typedArray.set(source), err);
+    }
+
+    // Side-effects when converting the source elements detach the buffer.
+    for (let {typedArray, buffer} of createTypedArrays()) {
+        let source = [{
+            valueOf() {
+                detachArrayBuffer(buffer);
+                return 1;
+            }
+        }];
+        let err = typedArray.length === 0 ? RangeError : TypeError;
+        assertThrowsInstanceOf(() => typedArray.set(source), err);
+    }
+
+    // Side-effects when converting the source elements detach the buffer. Also
+    // ensure other elements aren't accessed.
+    for (let {typedArray, buffer} of createTypedArrays()) {
+        let source = [{
+            valueOf() {
+                detachArrayBuffer(buffer);
+                return 1;
+            }
+        }, {
+            valueOf() {
+                throw new Error("Unexpected access");
+            }
+        }];
+        let err = typedArray.length <= 1 ? RangeError : TypeError;
+        assertThrowsInstanceOf(() => typedArray.set(source), err);
+    }
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/tests/ecma_6/TypedArray/set-tointeger.js b/js/src/tests/ecma_6/TypedArray/set-tointeger.js
new file mode 100644
index 000000000000..8c1e9c241832
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedArray/set-tointeger.js
@@ -0,0 +1,95 @@
+// Test ToInteger conversion in %TypedArray%.prototype.set(array|typedArray, offset).
+
+let ta = new Int32Array(4);
+
+// %TypedArray%.prototype.set has two different implementations for typed array
+// and non-typed array arguments. Test with both input types.
+let emptySources = [[], new Int32Array(0)];
+let nonEmptySource = [[0], new Int32Array(1)];
+let sources = [...emptySources, ...nonEmptySource];
+
+// Test when ToInteger(offset) is in (-1, 4).
+let validOffsets = [
+    // Values in [+0, 4).
+    0,
+    0.1,
+    3,
+    3.9,
+
+    // Values in (-1, -0].
+    -0,
+    -0.1,
+    -0.9,
+
+    NaN,
+
+    // Also include some non-number values.
+    undefined,
+    null,
+    true,
+    "",
+    "3",
+    "  1\t\n",
+    "some string",
+    {valueOf() { return 2; }},
+];
+
+for (let offset of validOffsets) {
+    for (let source of sources) {
+        ta.set(source, offset);
+    }
+}
+
+// Test when ToInteger(offset) isn't in (-1, 4).
+let invalidOffsets = [
+    // Values exceeding the typed array's length.
+    5,
+    2147483647,
+    2147483648,
+    2147483649,
+    4294967295,
+    4294967296,
+    4294967297,
+    Infinity,
+
+    // Negative values.
+    -1,
+    -1.1,
+    -2147483647,
+    -2147483648,
+    -2147483649,
+    -4294967295,
+    -4294967296,
+    -4294967297,
+    -Infinity,
+
+    // Also include some non-number values.
+    "8",
+    "Infinity",
+    "  Infinity  ",
+    {valueOf() { return 10; }},
+];
+
+for (let offset of invalidOffsets) {
+    for (let source of sources) {
+        assertThrowsInstanceOf(() => ta.set(source, offset), RangeError);
+    }
+}
+
+// Test when ToInteger(offset) is in [4, 5).
+for (let source of emptySources) {
+    ta.set(source, 4);
+    ta.set(source, 4.9);
+}
+for (let source of nonEmptySource) {
+    assertThrowsInstanceOf(() => ta.set(source, 4), RangeError);
+    assertThrowsInstanceOf(() => ta.set(source, 4.9), RangeError);
+}
+
+// ToInteger(symbol value) throws a TypeError.
+for (let source of sources) {
+    assertThrowsInstanceOf(() => ta.set(source, Symbol()), TypeError);
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/tests/ecma_6/TypedArray/set-toobject.js b/js/src/tests/ecma_6/TypedArray/set-toobject.js
new file mode 100644
index 000000000000..360c5dde7ebe
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedArray/set-toobject.js
@@ -0,0 +1,53 @@
+// Test ToObject in %TypedArray%.prototype.set(array|typedArray, offset).
+
+let ta = new Int32Array(4);
+
+for (let nullOrUndefined of [null, undefined]) {
+    // ToObject(array) throws a TypeError when |array| is null or undefined.
+    assertThrowsInstanceOf(() => ta.set(nullOrUndefined), TypeError);
+
+    // ToInteger(offset) is called before ToObject(array).
+    class ExpectedError extends Error {}
+    assertThrowsInstanceOf(() => ta.set(nullOrUndefined, {
+        valueOf() {
+            throw new ExpectedError();
+        }
+    }), ExpectedError);
+}
+
+// Ensure ta is still initialized with zeros.
+assertEqArray(ta, [0, 0, 0, 0]);
+
+// %TypedArray%.prototype.set can be called with a string primitive values.
+ta.set("");
+assertEqArray(ta, [0, 0, 0, 0]);
+
+ta.set("123");
+assertEqArray(ta, [1, 2, 3, 0]);
+
+// Throws a RangeError if the length is too large.
+assertThrowsInstanceOf(() => ta.set("456789"), RangeError);
+assertEqArray(ta, [1, 2, 3, 0]);
+
+// When called with other primitive values the typed array contents don't
+// change since ToObject(<primitive>).length is zero, i.e. the source object is
+// treated the same as an empty array.
+for (let value of [true, false, 0, NaN, 123, Infinity, Symbol()]) {
+    ta.set(value);
+    assertEqArray(ta, [1, 2, 3, 0]);
+}
+
+// Repeat test from above when the primitive wrapper prototype has been changed
+// to include "length" and an indexed property.
+Number.prototype.length = 4;
+Number.prototype[3] = -1;
+try {
+    ta.set(456);
+    assertEqArray(ta, [0, 0, 0, -1]);
+} finally {
+    delete Number.prototype.length;
+    delete Number.prototype[3];
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/tests/js1_8_5/extensions/typedarray-set-neutering.js b/js/src/tests/js1_8_5/extensions/typedarray-set-neutering.js
index 277bc971ec6c..edfc3379418c 100644
--- a/js/src/tests/js1_8_5/extensions/typedarray-set-neutering.js
+++ b/js/src/tests/js1_8_5/extensions/typedarray-set-neutering.js
@@ -35,7 +35,7 @@ Object.defineProperty(src, 4, {
   }
 });
 
-a.set(src);
+assertThrowsInstanceOf(() => a.set(src), TypeError);
 
 // Not really needed
 Array.reverse(a_2);
diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
index 426f549a54dd..e0339a65aad3 100644
--- a/js/src/tests/jstests.list
+++ b/js/src/tests/jstests.list
@@ -437,6 +437,7 @@ skip script test262/intl402/DateTimeFormat/12.1.1_1.js
 skip script test262/intl402/DateTimeFormat/prototype/12.3_a.js
 skip script test262/intl402/Collator/prototype/10.3_a.js
 skip script test262/intl402/NumberFormat/prototype/11.3_a.js
+skip script test262/intl402/PluralRules/prototype/prototype.js
 
 # https://bugzilla.mozilla.org/show_bug.cgi?id=1317378
 skip script test262/language/statements/do-while/cptn-abrupt-empty.js
@@ -548,27 +549,6 @@ skip script test262/language/expressions/async-generators/expression-yield-star-
 # https://bugzilla.mozilla.org/show_bug.cgi?id=1050755
 skip script test262/built-ins/Date/UTC/return-value.js
 
-# PluralRules.
-skip script test262/intl402/PluralRules/builtin.js
-skip script test262/intl402/PluralRules/this-not-ignored.js
-skip script test262/intl402/PluralRules/name.js
-skip script test262/intl402/PluralRules/length.js
-skip script test262/intl402/PluralRules/supportedLocalesOf/main.js
-skip script test262/intl402/PluralRules/can-be-subclassed.js
-skip script test262/intl402/PluralRules/internals.js
-skip script test262/intl402/PluralRules/prototype/properties.js
-skip script test262/intl402/PluralRules/supportedLocalesOf/supportedLocalesOf.js
-skip script test262/intl402/PluralRules/supportedLocalesOf/name.js
-skip script test262/intl402/PluralRules/supportedLocalesOf/arguments.js
-skip script test262/intl402/PluralRules/prototype/builtins.js
-skip script test262/intl402/PluralRules/prototype/prototype.js
-skip script test262/intl402/PluralRules/prototype/bind.js
-skip script test262/intl402/PluralRules/prototype/resolvedOptions/name.js
-skip script test262/intl402/PluralRules/prototype/resolvedOptions/properties.js
-skip script test262/intl402/PluralRules/prototype/resolvedOptions/builtins.js
-skip script test262/intl402/PluralRules/prototype/constructor/main.js
-skip script test262/intl402/PluralRules/prototype/select/name.js
-
 # SIMD.
 skip script test262/built-ins/Simd/check.js
 skip script test262/built-ins/Simd/from.js
diff --git a/js/src/tests/test262-intl-extras.js b/js/src/tests/test262-intl-extras.js
new file mode 100644
index 000000000000..d8c92b6d29ab
--- /dev/null
+++ b/js/src/tests/test262-intl-extras.js
@@ -0,0 +1,7 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Call the shell helper to add experimental features to the Intl object.
+if (typeof addIntlExtras === "function")
+    addIntlExtras(Intl);
diff --git a/js/src/tests/test262-update.py b/js/src/tests/test262-update.py
index fc79f4f57473..4f7ee25ed7f9 100644
--- a/js/src/tests/test262-update.py
+++ b/js/src/tests/test262-update.py
@@ -52,8 +52,8 @@ def tryParseTestFile(test262parser, source, testName):
     try:
         return test262parser.parseTestRecord(source, testName)
     except Exception as err:
-        # TODO: Report erroneous files to test262 Github repository.
-        # print("Error '%s' in file: %s" % (err, testName), file=sys.stderr)
+        print("Error '%s' in file: %s" % (err, testName), file=sys.stderr)
+        print("Please report this error to the test262 GitHub repository!")
         return None
 
 def makeRefTestLine(refTest):
@@ -109,7 +109,7 @@ def addSuffixToFileName(fileName, suffix):
     (filePath, ext) = os.path.splitext(fileName)
     return filePath + suffix + ext
 
-def writeShellAndBrowserFiles(test262OutDir, harnessDir, includesMap, relPath, helperFiles=[]):
+def writeShellAndBrowserFiles(test262OutDir, harnessDir, includesMap, localIncludesMap, relPath):
     """
     Generate the shell.js and browser.js files for the test harness.
     """
@@ -137,13 +137,15 @@ def writeShellAndBrowserFiles(test262OutDir, harnessDir, includesMap, relPath, h
         with io.open(filePath, "rb") as includeFile:
             return "// file: %s\n%s" % (os.path.basename(filePath), includeFile.read())
 
+    localIncludes = localIncludesMap[relPath] if relPath in localIncludesMap else []
+
     # Concatenate all includes files.
     includeSource = "\n".join(imap(readIncludeFile, chain(
         # The requested include files.
         imap(partial(os.path.join, harnessDir), findIncludes(includesMap, relPath)),
 
-        # And additional local helper files.
-        imap(partial(os.path.join, os.getcwd()), helperFiles)
+        # And additional local include files.
+        imap(partial(os.path.join, os.getcwd()), localIncludes)
     )))
 
     # Write the concatenated include sources to shell.js.
@@ -192,19 +194,17 @@ def convertTestFile(test262parser, testSource, testName, includeSet, strictTests
     raw = "raw" in testRec
     assert not (raw and (onlyStrict or noStrict))
 
-    # Most async tests are marked with the "async" attribute. But fallback to
-    # detect async tests when $DONE is present in the test source code.
-    async = "async" in testRec or "$DONE" in testSource
+    # Async tests are marked with the "async" attribute. It is an error for a
+    # test to use the $DONE function without specifying the "async" attribute.
+    async = "async" in testRec
+    assert "$DONE" not in testSource or async
 
-    # Most negative tests use {type=<error name>, phase=early|runtime}, except
-    # those which weren't update. These are still using negative=<error name>.
-    if "negative" in testRec:
-        negative = testRec["negative"]
-        # errorType is currently ignored. :-(
-        errorType = negative["type"] if type(negative) == dict else negative
-        isNegative = True
-    else:
-        isNegative = False
+    # Negative tests have additional meta-data to specify the error type and
+    # when the error is issued (runtime error or early parse error). We're
+    # currently ignoring this additional meta-data.
+    # testRec["negative"] == {type=<error name>, phase=early|runtime}
+    isNegative = "negative" in testRec
+    assert not isNegative or type(testRec["negative"]) == dict
 
     # Skip non-test files.
     isSupportFile = fileNameEndsWith(testName, "FIXTURE")
@@ -236,6 +236,10 @@ def convertTestFile(test262parser, testSource, testName, includeSet, strictTests
     if pathStartsWith(testName, "intl402"):
         refTestSkipIf.append(("!this.hasOwnProperty('Intl')", "needs Intl"))
 
+    # Skip Intl.PluralRules tests when the addIntlExtras helper isn't available.
+    if pathStartsWith(testName, "intl402", "PluralRules"):
+        refTestSkipIf.append(("!this.hasOwnProperty('addIntlExtras')", "needs addIntlExtras"))
+
     # Skip built-ins/Simd tests when SIMD isn't available.
     if pathStartsWith(testName, "built-ins", "Simd"):
         refTestSkipIf.append(("!this.hasOwnProperty('SIMD')", "needs SIMD"))
@@ -275,17 +279,26 @@ def process_test262(test262Dir, test262OutDir, strictTests):
     testDir = os.path.join(test262Dir, "test")
     test262parser = loadTest262Parser(test262Dir)
 
+    # Map of test262 subdirectories to the set of include files required for
+    # tests in that subdirectory. The includes for all tests in a subdirectory
+    # are merged into a single shell.js.
     # map<dirname, set<includeFiles>>
     includesMap = {}
 
-    # Root directory contains required harness files.
+    # Additional local includes keyed by test262 directory names. The include
+    # files in this map must be located in the js/src/tests directory.
+    # map<dirname, list<includeFiles>>
+    localIncludesMap = {}
+
+    # The root directory contains required harness files and test262-host.js.
     includesMap[""] = set(["sta.js", "assert.js"])
+    localIncludesMap[""] = ["test262-host.js"]
 
     # Also add files known to be used by many tests to the root shell.js file.
     includesMap[""].update(["propertyHelper.js", "compareArray.js"])
 
-    # Add "test262-host.js" to the root shell.js file.
-    writeShellAndBrowserFiles(test262OutDir, harnessDir, includesMap, "", ["test262-host.js"])
+    # Write the root shell.js file.
+    writeShellAndBrowserFiles(test262OutDir, harnessDir, includesMap, localIncludesMap, "")
 
     # Additional explicit includes inserted at well-chosen locations to reduce
     # code duplication in shell.js files.
@@ -297,6 +310,9 @@ def process_test262(test262Dir, test262OutDir, strictTests):
         "detachArrayBuffer.js", "nans.js"]
     explicitIncludes[os.path.join("built-ins", "TypedArrays")] = ["detachArrayBuffer.js"]
 
+    # Intl.PluralRules isn't yet enabled by default.
+    localIncludesMap[os.path.join("intl402", "PluralRules")] = ["test262-intl-extras.js"]
+
     # Process all test directories recursively.
     for (dirPath, dirNames, fileNames) in os.walk(testDir):
         relPath = os.path.relpath(dirPath, testDir)
@@ -323,7 +339,7 @@ def process_test262(test262Dir, test262OutDir, strictTests):
                 writeTestFile(test262OutDir, newFileName, newSource)
 
         # Add shell.js and browers.js files for the current directory.
-        writeShellAndBrowserFiles(test262OutDir, harnessDir, includesMap, relPath)
+        writeShellAndBrowserFiles(test262OutDir, harnessDir, includesMap, localIncludesMap, relPath)
 
 def update_test262(args):
     import subprocess
diff --git a/js/src/tests/test262/intl402/PluralRules/builtin.js b/js/src/tests/test262/intl402/PluralRules/builtin.js
index 74f09b38d6cd..24263a29f614 100644
--- a/js/src/tests/test262/intl402/PluralRules/builtin.js
+++ b/js/src/tests/test262/intl402/PluralRules/builtin.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/can-be-subclassed.js b/js/src/tests/test262/intl402/PluralRules/can-be-subclassed.js
index 1fdcea962e09..9a4a8f964664 100644
--- a/js/src/tests/test262/intl402/PluralRules/can-be-subclassed.js
+++ b/js/src/tests/test262/intl402/PluralRules/can-be-subclassed.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/internals.js b/js/src/tests/test262/intl402/PluralRules/internals.js
index f75e042cbde4..c5046a348abe 100644
--- a/js/src/tests/test262/intl402/PluralRules/internals.js
+++ b/js/src/tests/test262/intl402/PluralRules/internals.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/length.js b/js/src/tests/test262/intl402/PluralRules/length.js
index 0649956e063e..4d93afcbcba9 100644
--- a/js/src/tests/test262/intl402/PluralRules/length.js
+++ b/js/src/tests/test262/intl402/PluralRules/length.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/name.js b/js/src/tests/test262/intl402/PluralRules/name.js
index 7f94e8c92ed4..c60ce021511b 100644
--- a/js/src/tests/test262/intl402/PluralRules/name.js
+++ b/js/src/tests/test262/intl402/PluralRules/name.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/prototype/bind.js b/js/src/tests/test262/intl402/PluralRules/prototype/bind.js
index 840bcaf0b15e..943d250af9b4 100644
--- a/js/src/tests/test262/intl402/PluralRules/prototype/bind.js
+++ b/js/src/tests/test262/intl402/PluralRules/prototype/bind.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/prototype/builtins.js b/js/src/tests/test262/intl402/PluralRules/prototype/builtins.js
index bfb954369a5b..f04e261f7d42 100644
--- a/js/src/tests/test262/intl402/PluralRules/prototype/builtins.js
+++ b/js/src/tests/test262/intl402/PluralRules/prototype/builtins.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/prototype/constructor/main.js b/js/src/tests/test262/intl402/PluralRules/prototype/constructor/main.js
index e0512d5886fe..b752bd039e73 100644
--- a/js/src/tests/test262/intl402/PluralRules/prototype/constructor/main.js
+++ b/js/src/tests/test262/intl402/PluralRules/prototype/constructor/main.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/prototype/properties.js b/js/src/tests/test262/intl402/PluralRules/prototype/properties.js
index e429ec2b1664..ad5adc7795aa 100644
--- a/js/src/tests/test262/intl402/PluralRules/prototype/properties.js
+++ b/js/src/tests/test262/intl402/PluralRules/prototype/properties.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/prototype/prototype.js b/js/src/tests/test262/intl402/PluralRules/prototype/prototype.js
index 2f2dfd2ade3d..364b98b58665 100644
--- a/js/src/tests/test262/intl402/PluralRules/prototype/prototype.js
+++ b/js/src/tests/test262/intl402/PluralRules/prototype/prototype.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/builtins.js b/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/builtins.js
index 4bd7f4b8bb9b..f98b28dc8a91 100644
--- a/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/builtins.js
+++ b/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/builtins.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/name.js b/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/name.js
index 651fffd00bb0..499bc0c9cc32 100644
--- a/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/name.js
+++ b/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/name.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/properties.js b/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/properties.js
index cf370d1e490f..8b148f6cce64 100644
--- a/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/properties.js
+++ b/js/src/tests/test262/intl402/PluralRules/prototype/resolvedOptions/properties.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/prototype/select/name.js b/js/src/tests/test262/intl402/PluralRules/prototype/select/name.js
index a4518a081be5..d1040332e3c0 100644
--- a/js/src/tests/test262/intl402/PluralRules/prototype/select/name.js
+++ b/js/src/tests/test262/intl402/PluralRules/prototype/select/name.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/shell.js b/js/src/tests/test262/intl402/PluralRules/shell.js
index e69de29bb2d1..fcb524be040b 100644
--- a/js/src/tests/test262/intl402/PluralRules/shell.js
+++ b/js/src/tests/test262/intl402/PluralRules/shell.js
@@ -0,0 +1,8 @@
+// file: test262-intl-extras.js
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Call the shell helper to add experimental features to the Intl object.
+if (typeof addIntlExtras === "function")
+    addIntlExtras(Intl);
diff --git a/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/arguments.js b/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/arguments.js
index 9483f371930a..4f9d798e9f22 100644
--- a/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/arguments.js
+++ b/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/arguments.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/main.js b/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/main.js
index c02ae89a43ab..7cb2eb93155e 100644
--- a/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/main.js
+++ b/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/main.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/name.js b/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/name.js
index 5a4ec7c28d2c..72ffd22770ff 100644
--- a/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/name.js
+++ b/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/name.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/supportedLocalesOf.js b/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/supportedLocalesOf.js
index a6b2c7b36087..e65c7b8439a4 100644
--- a/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/supportedLocalesOf.js
+++ b/js/src/tests/test262/intl402/PluralRules/supportedLocalesOf/supportedLocalesOf.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/intl402/PluralRules/this-not-ignored.js b/js/src/tests/test262/intl402/PluralRules/this-not-ignored.js
index 8aeb5a362ad5..72f045c55364 100644
--- a/js/src/tests/test262/intl402/PluralRules/this-not-ignored.js
+++ b/js/src/tests/test262/intl402/PluralRules/this-not-ignored.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(!this.hasOwnProperty('Intl')) -- needs Intl
+// |reftest| skip-if(!this.hasOwnProperty('Intl')||!this.hasOwnProperty('addIntlExtras')) -- needs Intl, needs addIntlExtras
 // Copyright 2016 Mozilla Corporation. All rights reserved.
 // This code is governed by the license found in the LICENSE file.
 
diff --git a/js/src/threading/ProtectedData.cpp b/js/src/threading/ProtectedData.cpp
index f178f63681dd..3b0bdaeae83d 100644
--- a/js/src/threading/ProtectedData.cpp
+++ b/js/src/threading/ProtectedData.cpp
@@ -34,6 +34,21 @@ OnHelperThread()
     return false;
 }
 
+void
+CheckThreadLocal::check() const
+{
+    JSContext* cx = TlsContext.get();
+    MOZ_ASSERT(cx);
+
+    // As for CheckZoneGroup, in a cooperatively scheduled runtime the active
+    // thread is permitted access to thread local state for other suspended
+    // threads in the same runtime.
+    if (cx->isCooperativelyScheduled())
+        MOZ_ASSERT(CurrentThreadCanAccessRuntime(cx->runtime()));
+    else
+        MOZ_ASSERT(id == ThisThread::GetId());
+}
+
 template <AllowedHelperThread Helper>
 void
 CheckActiveThread<Helper>::check() const
@@ -62,6 +77,7 @@ CheckZoneGroup<Helper>::check() const
     if (OnHelperThread<Helper>())
         return;
 
+    JSContext* cx = TlsContext.get();
     if (group) {
         if (group->usedByHelperThread) {
             MOZ_ASSERT(group->ownedByCurrentThread());
@@ -73,16 +89,18 @@ CheckZoneGroup<Helper>::check() const
             // permitted access to all zone groups --- even those it has not
             // entered --- for GC and similar purposes. Since all other
             // cooperative threads are suspended, these accesses are threadsafe
-            // if the zone group is not in use by a helper thread which is not
-            // cooperatively scheduled.
-            JSContext* cx = TlsContext.get();
+            // if the zone group is not in use by a helper thread.
+            //
+            // A corollary to this is that suspended cooperative threads may
+            // not access anything in a zone group, even zone groups they own,
+            // because they're not allowed to interact with the JS API.
             MOZ_ASSERT(CurrentThreadCanAccessRuntime(cx->runtime()));
 #endif
         }
     } else {
         // |group| will be null for data in the atoms zone. This is protected
         // by the exclusive access lock.
-        MOZ_ASSERT(TlsContext.get()->runtime()->currentThreadHasExclusiveAccess());
+        MOZ_ASSERT(cx->runtime()->currentThreadHasExclusiveAccess());
     }
 }
 
diff --git a/js/src/threading/ProtectedData.h b/js/src/threading/ProtectedData.h
index 6ccc748e52b9..69eabbe16f22 100644
--- a/js/src/threading/ProtectedData.h
+++ b/js/src/threading/ProtectedData.h
@@ -179,9 +179,7 @@ class CheckThreadLocal
       : id(ThisThread::GetId())
     {}
 
-    inline void check() const {
-        MOZ_ASSERT(id == ThisThread::GetId());
-    }
+    void check() const;
 #endif
 };
 
diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
index 0c4b016193c3..6f6f568055bf 100644
--- a/js/src/vm/HelperThreads.cpp
+++ b/js/src/vm/HelperThreads.cpp
@@ -1891,6 +1891,11 @@ HelperThread::threadLoop()
     AutoLockHelperThreadState lock;
 
     JSContext cx(nullptr, JS::ContextOptions());
+    {
+        AutoEnterOOMUnsafeRegion oomUnsafe;
+        if (!cx.init(ContextKind::Background))
+            oomUnsafe.crash("HelperThread cx.init()");
+    }
     cx.setHelperThread(this);
 
     // Compute the thread's stack limit, for over-recursed checks.
diff --git a/js/src/vm/MutexIDs.h b/js/src/vm/MutexIDs.h
index 4f7173769e95..4f173fcb4124 100644
--- a/js/src/vm/MutexIDs.h
+++ b/js/src/vm/MutexIDs.h
@@ -15,6 +15,7 @@
   _(TestMutex,                   100) \
   _(ShellContextWatchdog,        100) \
   _(ShellWorkerThreads,          100) \
+  _(ShellThreadCooperation,      100) \
   _(ShellArrayBufferMailbox,     100) \
                                       \
   _(RuntimeExclusiveAccess,      200) \
diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
index 56a017bef9a4..9c6bbef45d70 100644
--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@@ -334,11 +334,36 @@ JSRuntime::destroyRuntime()
 void
 JSRuntime::setActiveContext(JSContext* cx)
 {
-    MOZ_ASSERT_IF(cx, isCooperatingContext(cx));
+    MOZ_ASSERT_IF(cx, cx->isCooperativelyScheduled());
+    MOZ_RELEASE_ASSERT(!activeContextChangeProhibited());
+    MOZ_RELEASE_ASSERT(!activeContext() || gc.canChangeActiveContext(activeContext()));
+
+    activeContext_ = cx;
+}
+
+void
+JSRuntime::setNewbornActiveContext(JSContext* cx)
+{
+    MOZ_ASSERT_IF(cx, cx->isCooperativelyScheduled());
+    MOZ_RELEASE_ASSERT(!activeContextChangeProhibited());
+    MOZ_RELEASE_ASSERT(!activeContext());
+
+    activeContext_ = cx;
+
+    AutoEnterOOMUnsafeRegion oomUnsafe;
+    if (!cooperatingContexts().append(cx))
+        oomUnsafe.crash("Add cooperating context");
+}
+
+void
+JSRuntime::deleteActiveContext(JSContext* cx)
+{
+    MOZ_ASSERT(cx == activeContext());
     MOZ_RELEASE_ASSERT(!activeContextChangeProhibited());
     MOZ_RELEASE_ASSERT(gc.canChangeActiveContext(cx));
 
-    activeContext_ = cx;
+    js_delete_poison(cx);
+    activeContext_ = nullptr;
 }
 
 void
diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
index 09f72cc7650a..8370f1ca55ea 100644
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -340,13 +340,15 @@ struct JSRuntime : public js::MallocProvider<JSRuntime>
     js::ActiveThreadData<js::Vector<js::CooperatingContext, 4, js::SystemAllocPolicy>> cooperatingContexts_;
 
     // Count of AutoProhibitActiveContextChange instances on the active context.
-    js::ActiveThreadData<size_t> activeContextChangeProhibited_;
+    mozilla::Atomic<size_t> activeContextChangeProhibited_;
 
   public:
     JSContext* activeContext() const { return activeContext_; }
     const void* addressOfActiveContext() { return &activeContext_; }
 
     void setActiveContext(JSContext* cx);
+    void setNewbornActiveContext(JSContext* cx);
+    void deleteActiveContext(JSContext* cx);
 
     inline JSContext* activeContextFromOwnThread();
 
@@ -354,16 +356,6 @@ struct JSRuntime : public js::MallocProvider<JSRuntime>
         return cooperatingContexts_.ref();
     }
 
-#ifdef DEBUG
-    bool isCooperatingContext(JSContext* cx) {
-        for (const js::CooperatingContext& target : cooperatingContexts()) {
-            if (target.context() == cx)
-                return true;
-        }
-        return false;
-    }
-#endif
-
     class MOZ_RAII AutoProhibitActiveContextChange
     {
         JSRuntime* rt;
diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
index da0a2e229ca5..82ca3b9c7145 100644
--- a/js/src/vm/StructuredClone.cpp
+++ b/js/src/vm/StructuredClone.cpp
@@ -29,6 +29,7 @@
 
 #include "js/StructuredClone.h"
 
+#include "mozilla/CheckedInt.h"
 #include "mozilla/EndianUtils.h"
 #include "mozilla/FloatingPoint.h"
 
@@ -744,6 +745,18 @@ void
 swapFromLittleEndianInPlace(uint8_t* ptr, size_t nelems)
 {}
 
+// Data is packed into an integral number of uint64_t words. Compute the
+// padding required to finish off the final word.
+static size_t
+ComputePadding(size_t nelems, size_t elemSize)
+{
+    // We want total length mod 8, where total length is nelems * sizeof(T),
+    // but that might overflow. So reduce nelems to nelems mod 8, since we are
+    // going to be doing a mod 8 later anyway.
+    size_t leftoverLength = (nelems % sizeof(uint64_t)) * elemSize;
+    return (-leftoverLength) & (sizeof(uint64_t) - 1);
+}
+
 template <class T>
 bool
 SCInput::readArray(T* p, size_t nelems)
@@ -754,20 +767,18 @@ SCInput::readArray(T* p, size_t nelems)
     JS_STATIC_ASSERT(sizeof(uint64_t) % sizeof(T) == 0);
 
     /*
-     * Fail if nelems is so huge as to make JS_HOWMANY overflow or if nwords is
-     * larger than the remaining data.
+     * Fail if nelems is so huge that computing the full size will overflow.
      */
-    size_t nwords = JS_HOWMANY(nelems, sizeof(uint64_t) / sizeof(T));
-    if (nelems + sizeof(uint64_t) / sizeof(T) - 1 < nelems)
+    mozilla::CheckedInt<size_t> size = mozilla::CheckedInt<size_t>(nelems) * sizeof(T);
+    if (!size.isValid())
         return reportTruncated();
 
-    size_t size = sizeof(T) * nelems;
-    if (!point.readBytes(reinterpret_cast<char*>(p), size))
+    if (!point.readBytes(reinterpret_cast<char*>(p), size.value()))
         return false;
 
     swapFromLittleEndianInPlace(p, nelems);
 
-    point += sizeof(uint64_t) * nwords - size;
+    point += ComputePadding(nelems, sizeof(T));
 
     return true;
 }
@@ -850,20 +861,6 @@ SCOutput::writeDouble(double d)
     return write(BitwiseCast<uint64_t>(CanonicalizeNaN(d)));
 }
 
-template <typename T>
-static T
-swapToLittleEndian(T value)
-{
-    return NativeEndian::swapToLittleEndian(value);
-}
-
-template <>
-uint8_t
-swapToLittleEndian(uint8_t value)
-{
-    return value;
-}
-
 template <class T>
 bool
 SCOutput::writeArray(const T* p, size_t nelems)
@@ -874,25 +871,36 @@ SCOutput::writeArray(const T* p, size_t nelems)
     if (nelems == 0)
         return true;
 
-    if (nelems + sizeof(uint64_t) / sizeof(T) - 1 < nelems) {
-        ReportAllocationOverflow(context());
-        return false;
-    }
-
     for (size_t i = 0; i < nelems; i++) {
-        T value = swapToLittleEndian(p[i]);
+        T value = NativeEndian::swapToLittleEndian(p[i]);
         if (!buf.WriteBytes(reinterpret_cast<char*>(&value), sizeof(value)))
             return false;
     }
 
+    // Zero-pad to 8 bytes boundary.
+    size_t padbytes = ComputePadding(nelems, sizeof(T));
+    char zeroes[sizeof(uint64_t)] = { 0 };
+    if (!buf.WriteBytes(zeroes, padbytes))
+        return false;
+
+    return true;
+}
+
+template <>
+bool
+SCOutput::writeArray<uint8_t>(const uint8_t* p, size_t nelems)
+{
+    if (nelems == 0)
+        return true;
+
+    if (!buf.WriteBytes(reinterpret_cast<const char*>(p), nelems))
+        return false;
+
     // zero-pad to 8 bytes boundary
-    size_t nwords = JS_HOWMANY(nelems, sizeof(uint64_t) / sizeof(T));
-    size_t padbytes = sizeof(uint64_t) * nwords - sizeof(T) * nelems;
-    char zero = 0;
-    for (size_t i = 0; i < padbytes; i++) {
-        if (!buf.WriteBytes(&zero, sizeof(zero)))
-            return false;
-    }
+    size_t padbytes = ComputePadding(nelems, 1);
+    char zeroes[sizeof(uint64_t)] = { 0 };
+    if (!buf.WriteBytes(zeroes, padbytes))
+        return false;
 
     return true;
 }
diff --git a/js/src/vm/TypedArrayObject-inl.h b/js/src/vm/TypedArrayObject-inl.h
index 34da8181040c..76cda67cd66b 100644
--- a/js/src/vm/TypedArrayObject-inl.h
+++ b/js/src/vm/TypedArrayObject-inl.h
@@ -275,6 +275,8 @@ class ElementSpecific
     {
         MOZ_ASSERT(TypeIDOfType<T>::id == target->type(),
                    "calling wrong setFromTypedArray specialization");
+        MOZ_ASSERT(!target->hasDetachedBuffer(), "target isn't detached");
+        MOZ_ASSERT(!source->hasDetachedBuffer(), "source isn't detached");
 
         MOZ_ASSERT(offset <= target->length());
         MOZ_ASSERT(source->length() <= target->length() - offset);
@@ -368,6 +370,7 @@ class ElementSpecific
     {
         MOZ_ASSERT(target->type() == TypeIDOfType<T>::id,
                    "target type and NativeType must match");
+        MOZ_ASSERT(!target->hasDetachedBuffer(), "target isn't detached");
         MOZ_ASSERT(!source->is<TypedArrayObject>(),
                    "use setFromTypedArray instead of this method");
 
@@ -406,7 +409,8 @@ class ElementSpecific
             if (i >= len)
                 break;
 
-            // Compute every iteration in case getElement/valueToNative is wacky.
+            // Compute every iteration in case getElement/valueToNative
+            // detaches the underlying array buffer or GC moves the data.
             SharedMem<T*> dest = target->viewDataEither().template cast<T*>() + offset + i;
             Ops::store(dest, n);
         }
@@ -423,6 +427,7 @@ class ElementSpecific
     {
         MOZ_ASSERT(target->type() == TypeIDOfType<T>::id,
                    "target type and NativeType must match");
+        MOZ_ASSERT(!target->hasDetachedBuffer(), "target isn't detached");
         MOZ_ASSERT(IsPackedArray(source), "source array must be packed");
         MOZ_ASSERT(source->getDenseInitializedLength() <= target->length());
 
@@ -479,6 +484,8 @@ class ElementSpecific
     {
         MOZ_ASSERT(TypeIDOfType<T>::id == target->type(),
                    "calling wrong setFromTypedArray specialization");
+        MOZ_ASSERT(!target->hasDetachedBuffer(), "target isn't detached");
+        MOZ_ASSERT(!source->hasDetachedBuffer(), "source isn't detached");
         MOZ_ASSERT(TypedArrayObject::sameBuffer(target, source),
                    "the provided arrays don't actually overlap, so it's "
                    "undesirable to use this method");
diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp
index 4b1ee2aaea38..ccf251063cd0 100644
--- a/js/src/vm/TypedArrayObject.cpp
+++ b/js/src/vm/TypedArrayObject.cpp
@@ -1520,40 +1520,65 @@ SetFromNonTypedArray(JSContext* cx, Handle<TypedArrayObject*> target, HandleObje
     return ElementSpecific<T, UnsharedOps>::setFromNonTypedArray(cx, target, source, len, offset);
 }
 
-/* set(array[, offset]) */
+// ES2017 draft rev c57ef95c45a371f9c9485bb1c3881dbdc04524a2
+// 22.2.3.23 %TypedArray%.prototype.set ( overloaded [ , offset ] )
+// 22.2.3.23.1 %TypedArray%.prototype.set ( array [ , offset ] )
+// 22.2.3.23.2 %TypedArray%.prototype.set( typedArray [ , offset ] )
 /* static */ bool
 TypedArrayObject::set_impl(JSContext* cx, const CallArgs& args)
 {
     MOZ_ASSERT(TypedArrayObject::is(args.thisv()));
 
+    // Steps 1-5 (Validation performed as part of CallNonGenericMethod).
     Rooted<TypedArrayObject*> target(cx, &args.thisv().toObject().as<TypedArrayObject>());
 
-    // The first argument must be either a typed array or arraylike.
-    if (args.length() == 0 || !args[0].isObject()) {
-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
-        return false;
-    }
-
-    int32_t offset = 0;
+    // Steps 6-7.
+    double targetOffset = 0;
     if (args.length() > 1) {
-        if (!ToInt32(cx, args[1], &offset))
+        // Step 6.
+        if (!ToInteger(cx, args[1], &targetOffset))
             return false;
 
-        if (offset < 0 || uint32_t(offset) > target->length()) {
-            // the given offset is bogus
+        // Step 7.
+        if (targetOffset < 0) {
             JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_BAD_INDEX);
             return false;
         }
     }
 
-    RootedObject arg0(cx, &args[0].toObject());
-    if (arg0->is<TypedArrayObject>()) {
-        Handle<TypedArrayObject*> source = arg0.as<TypedArrayObject>();
-        if (source->length() > target->length() - offset) {
+    // Steps 8-9.
+    if (target->hasDetachedBuffer()) {
+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_DETACHED);
+        return false;
+    }
+
+    if (args.get(0).isObject() && args[0].toObject().is<TypedArrayObject>()) {
+        // Remaining steps of 22.2.3.23.2.
+        Rooted<TypedArrayObject*> source(cx, &args[0].toObject().as<TypedArrayObject>());
+
+        // Steps 11-12.
+        if (source->hasDetachedBuffer()) {
+            JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_DETACHED);
+            return false;
+        }
+
+        // Step 10 (Reordered).
+        uint32_t targetLength = target->length();
+
+        // Step 22 (Split into two checks to provide better error messages).
+        if (targetOffset > targetLength) {
+            JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_BAD_INDEX);
+            return false;
+        }
+
+        // Step 22 (Cont'd).
+        uint32_t offset = uint32_t(targetOffset);
+        if (source->length() > targetLength - offset) {
             JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_BAD_ARRAY_LENGTH);
             return false;
         }
 
+        // Steps 13-21, 23-28.
         switch (target->type()) {
 #define SET_FROM_TYPED_ARRAY(T, N) \
           case Scalar::N: \
@@ -1566,28 +1591,83 @@ JS_FOR_EACH_TYPED_ARRAY(SET_FROM_TYPED_ARRAY)
             MOZ_CRASH("Unsupported TypedArray type");
         }
     } else {
-        uint32_t len;
-        if (!GetLengthProperty(cx, arg0, &len))
+        // Remaining steps of 22.2.3.23.1.
+
+        // Step 10.
+        // We can't reorder this step because side-effects in step 16 can
+        // detach the underlying array buffer from the typed array.
+        uint32_t targetLength = target->length();
+
+        // Step 15.
+        RootedObject src(cx, ToObject(cx, args.get(0)));
+        if (!src)
             return false;
 
-        if (uint32_t(offset) > target->length() || len > target->length() - offset) {
+        // Step 16.
+        uint32_t srcLength;
+        if (!GetLengthProperty(cx, src, &srcLength))
+            return false;
+
+        // Step 17 (Split into two checks to provide better error messages).
+        if (targetOffset > targetLength) {
+            JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_BAD_INDEX);
+            return false;
+        }
+
+        // Step 17 (Cont'd).
+        uint32_t offset = uint32_t(targetOffset);
+        if (srcLength > targetLength - offset) {
             JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_BAD_ARRAY_LENGTH);
             return false;
         }
 
-        switch (target->type()) {
+        // Steps 11-14, 18-21.
+        if (srcLength > 0) {
+            // GetLengthProperty in step 16 can lead to the execution of user
+            // code which may detach the buffer. Handle this case here to
+            // ensure SetFromNonTypedArray is never called with a detached
+            // buffer. We still need to execute steps 21.a-b for their
+            // possible side-effects.
+            if (target->hasDetachedBuffer()) {
+                // Steps 21.a-b.
+                RootedValue v(cx);
+                if (!GetElement(cx, src, src, 0, &v))
+                   return false;
+
+                double unused;
+                if (!ToNumber(cx, v, &unused))
+                    return false;
+
+                // Step 21.c.
+                JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                                          JSMSG_TYPED_ARRAY_DETACHED);
+                return false;
+            }
+
+            switch (target->type()) {
 #define SET_FROM_NON_TYPED_ARRAY(T, N) \
-          case Scalar::N: \
-            if (!SetFromNonTypedArray<T>(cx, target, arg0, len, offset)) \
-                return false; \
-            break;
+              case Scalar::N: \
+                if (!SetFromNonTypedArray<T>(cx, target, src, srcLength, offset)) \
+                    return false; \
+                break;
 JS_FOR_EACH_TYPED_ARRAY(SET_FROM_NON_TYPED_ARRAY)
 #undef SET_FROM_NON_TYPED_ARRAY
-          default:
-            MOZ_CRASH("Unsupported TypedArray type");
+              default:
+                MOZ_CRASH("Unsupported TypedArray type");
+            }
+
+            // Step 21.c.
+            // SetFromNonTypedArray doesn't throw when the array buffer gets
+            // detached.
+            if (target->hasDetachedBuffer()) {
+                JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                                          JSMSG_TYPED_ARRAY_DETACHED);
+                return false;
+            }
         }
     }
 
+    // Step 29/22.
     args.rval().setUndefined();
     return true;
 }
diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
index 6fbaf1cd8666..500b5e44d5f8 100644
--- a/js/src/wasm/AsmJS.cpp
+++ b/js/src/wasm/AsmJS.cpp
@@ -2338,15 +2338,15 @@ class MOZ_STACK_CLASS ModuleValidator
     }
 
     bool startFunctionBodies() {
+        if (!arrayViews_.empty())
+            mg_.initMemoryUsage(atomicsPresent_ ? MemoryUsage::Shared : MemoryUsage::Unshared);
+
         return mg_.startFuncDefs();
     }
     bool finishFunctionBodies() {
         return mg_.finishFuncDefs();
     }
     SharedModule finish() {
-        if (!arrayViews_.empty())
-            mg_.initMemoryUsage(atomicsPresent_ ? MemoryUsage::Shared : MemoryUsage::Unshared);
-
         asmJSMetadata_->usesSimd = simdPresent_;
 
         MOZ_ASSERT(asmJSMetadata_->asmJSFuncNames.empty());
diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompile.cpp
index 7c337e6f9b36..8de489e1f87e 100644
--- a/js/src/wasm/WasmBaselineCompile.cpp
+++ b/js/src/wasm/WasmBaselineCompile.cpp
@@ -5398,14 +5398,12 @@ BaseCompiler::emitEnd()
     LabelKind kind;
     ExprType type;
     Nothing unused_value;
-
     if (!iter_.readEnd(&kind, &type, &unused_value))
         return false;
 
     switch (kind) {
       case LabelKind::Block: endBlock(type); break;
       case LabelKind::Loop:  endLoop(type); break;
-      case LabelKind::UnreachableThen:
       case LabelKind::Then:  endIfThen(); break;
       case LabelKind::Else:  endIfThenElse(type); break;
     }
@@ -5475,46 +5473,28 @@ BaseCompiler::emitBrIf()
 bool
 BaseCompiler::emitBrTable()
 {
-    uint32_t tableLength;
-    ExprType type;
-    Nothing unused_value, unused_index;
-    if (!iter_.readBrTable(&tableLength, &type, &unused_value, &unused_index))
-        return false;
-
-    LabelVector stubs;
-    if (!stubs.reserve(tableLength+1))
-        return false;
-
     Uint32Vector depths;
-    if (!depths.reserve(tableLength))
-        return false;
-
-    for (size_t i = 0; i < tableLength; ++i) {
-        uint32_t depth;
-        if (!iter_.readBrTableEntry(&type, &unused_value, &depth))
-            return false;
-        depths.infallibleAppend(depth);
-    }
-
     uint32_t defaultDepth;
-    if (!iter_.readBrTableDefault(&type, &unused_value, &defaultDepth))
+    ExprType branchValueType;
+    Nothing unused_value, unused_index;
+    if (!iter_.readBrTable(&depths, &defaultDepth, &branchValueType, &unused_value, &unused_index))
         return false;
 
     if (deadCode_)
         return true;
 
     // Don't use joinReg for rc
-    maybeReserveJoinRegI(type);
+    maybeReserveJoinRegI(branchValueType);
 
     // Table switch value always on top.
     RegI32 rc = popI32();
 
-    maybeUnreserveJoinRegI(type);
+    maybeUnreserveJoinRegI(branchValueType);
 
-    AnyReg r = popJoinRegUnlessVoid(type);
+    AnyReg r = popJoinRegUnlessVoid(branchValueType);
 
     Label dispatchCode;
-    masm.branch32(Assembler::Below, rc, Imm32(tableLength), &dispatchCode);
+    masm.branch32(Assembler::Below, rc, Imm32(depths.length()), &dispatchCode);
 
     // This is the out-of-range stub.  rc is dead here but we don't need it.
 
@@ -5530,13 +5510,16 @@ BaseCompiler::emitBrTable()
     // TODO / OPTIMIZE (Bug 1316804): Branch directly to the case code if we
     // can, don't emit an intermediate stub.
 
-    for (uint32_t i = 0; i < tableLength; i++) {
+    LabelVector stubs;
+    if (!stubs.reserve(depths.length()))
+        return false;
+
+    for (uint32_t depth : depths) {
         stubs.infallibleEmplaceBack(NonAssertingLabel());
         masm.bind(&stubs.back());
-        uint32_t k = depths[i];
-        popStackBeforeBranch(controlItem(k).framePushed);
-        controlItem(k).bceSafeOnExit &= bceSafe_;
-        masm.jump(&controlItem(k).label);
+        popStackBeforeBranch(controlItem(depth).framePushed);
+        controlItem(depth).bceSafeOnExit &= bceSafe_;
+        masm.jump(&controlItem(depth).label);
     }
 
     // Emit table.
@@ -5627,21 +5610,15 @@ BaseCompiler::emitReturn()
 }
 
 bool
-BaseCompiler::emitCallArgs(const ValTypeVector& args, FunctionCall& baselineCall)
+BaseCompiler::emitCallArgs(const ValTypeVector& argTypes, FunctionCall& baselineCall)
 {
     MOZ_ASSERT(!deadCode_);
 
-    startCallArgs(baselineCall, stackArgAreaSize(args));
+    startCallArgs(baselineCall, stackArgAreaSize(argTypes));
 
-    uint32_t numArgs = args.length();
-    for (size_t i = 0; i < numArgs; ++i) {
-        ValType argType = args[i];
-        Nothing arg_;
-        if (!iter_.readCallArg(argType, numArgs, i, &arg_))
-            return false;
-        Stk& arg = peek(numArgs - 1 - i);
-        passArg(baselineCall, argType, arg);
-    }
+    uint32_t numArgs = argTypes.length();
+    for (size_t i = 0; i < numArgs; ++i)
+        passArg(baselineCall, argTypes[i], peek(numArgs - 1 - i));
 
     // Pass the TLS pointer as a hidden argument in WasmTlsReg.  Load
     // it directly out if its stack slot so we don't interfere with
@@ -5649,9 +5626,6 @@ BaseCompiler::emitCallArgs(const ValTypeVector& args, FunctionCall& baselineCall
     if (baselineCall.loadTlsBefore)
         loadFromFramePtr(WasmTlsReg, frameOffsetFromSlot(tlsSlot_, MIRType::Pointer));
 
-    if (!iter_.readCallArgsEnd(numArgs))
-        return false;
-
     return true;
 }
 
@@ -5706,7 +5680,8 @@ BaseCompiler::emitCall()
     uint32_t lineOrBytecode = readCallSiteLineOrBytecode();
 
     uint32_t funcIndex;
-    if (!iter_.readCall(&funcIndex))
+    BaseOpIter::ValueVector args_;
+    if (!iter_.readCall(&funcIndex, &args_))
         return false;
 
     if (deadCode_)
@@ -5726,9 +5701,6 @@ BaseCompiler::emitCall()
     if (!emitCallArgs(sig.args(), baselineCall))
         return false;
 
-    if (!iter_.readCallReturn(sig.ret()))
-        return false;
-
     if (import)
         callImport(env_.funcImportGlobalDataOffsets[funcIndex], baselineCall);
     else
@@ -5751,7 +5723,8 @@ BaseCompiler::emitCallIndirect()
 
     uint32_t sigIndex;
     Nothing callee_;
-    if (!iter_.readCallIndirect(&sigIndex, &callee_))
+    BaseOpIter::ValueVector args_;
+    if (!iter_.readCallIndirect(&sigIndex, &callee_, &args_))
         return false;
 
     if (deadCode_)
@@ -5778,9 +5751,6 @@ BaseCompiler::emitCallIndirect()
     if (!emitCallArgs(sig.args(), baselineCall))
         return false;
 
-    if (!iter_.readCallReturn(sig.ret()))
-        return false;
-
     callIndirect(sigIndex, callee, baselineCall);
 
     endCall(baselineCall, stackSpace);
@@ -5798,6 +5768,10 @@ BaseCompiler::emitUnaryMathBuiltinCall(SymbolicAddress callee, ValType operandTy
 {
     uint32_t lineOrBytecode = readCallSiteLineOrBytecode();
 
+    Nothing operand_;
+    if (!iter_.readUnary(operandType, &operand_))
+        return false;
+
     if (deadCode_)
         return true;
 
@@ -5814,9 +5788,6 @@ BaseCompiler::emitUnaryMathBuiltinCall(SymbolicAddress callee, ValType operandTy
     if (!emitCallArgs(signature, baselineCall))
         return false;
 
-    if (!iter_.readCallReturn(retType))
-      return false;
-
     builtinCall(callee, baselineCall);
 
     endCall(baselineCall, stackSpace);
@@ -6077,7 +6048,7 @@ bool
 BaseCompiler::emitGetGlobal()
 {
     uint32_t id;
-    if (!iter_.readGetGlobal(env_.globals, &id))
+    if (!iter_.readGetGlobal(&id))
         return false;
 
     if (deadCode_)
@@ -6143,7 +6114,7 @@ BaseCompiler::emitSetGlobal()
 {
     uint32_t id;
     Nothing unused_value;
-    if (!iter_.readSetGlobal(env_.globals, &id, &unused_value))
+    if (!iter_.readSetGlobal(&id, &unused_value))
         return false;
 
     if (deadCode_)
@@ -6427,7 +6398,7 @@ BaseCompiler::emitStore(ValType resultType, Scalar::Type viewType)
 bool
 BaseCompiler::emitSelect()
 {
-    ValType type;
+    StackType type;
     Nothing unused_trueValue;
     Nothing unused_falseValue;
     Nothing unused_condition;
@@ -6445,7 +6416,7 @@ BaseCompiler::emitSelect()
     BranchState b(&done);
     emitBranchSetup(&b);
 
-    switch (type) {
+    switch (NonAnyToValType(type)) {
       case ValType::I32: {
         RegI32 r0, r1;
         pop2xI32(&r0, &r1);
@@ -7355,7 +7326,7 @@ BaseCompiler::BaseCompiler(const ModuleEnvironment& env,
                            TempAllocator* alloc,
                            MacroAssembler* masm)
     : env_(env),
-      iter_(decoder, func.lineOrBytecode()),
+      iter_(env, decoder, func.lineOrBytecode()),
       func_(func),
       lastReadCallSite_(0),
       alloc_(*alloc),
diff --git a/js/src/wasm/WasmBinaryIterator.h b/js/src/wasm/WasmBinaryIterator.h
index 0bbe64f00130..5048eaf320ba 100644
--- a/js/src/wasm/WasmBinaryIterator.h
+++ b/js/src/wasm/WasmBinaryIterator.h
@@ -30,14 +30,68 @@ namespace js {
 namespace wasm {
 
 // The kind of a control-flow stack item.
-enum class LabelKind : uint8_t {
+enum class LabelKind : uint8_t
+{
     Block,
     Loop,
     Then,
-    UnreachableThen, // like Then, but not reachable
     Else
 };
 
+// The type of values on the operand stack during validation. The Any type
+// represents the type of a value produced by an unconditional branch.
+enum class StackType
+{
+    I32   = uint8_t(ValType::I32),
+    I64   = uint8_t(ValType::I64),
+    F32   = uint8_t(ValType::F32),
+    F64   = uint8_t(ValType::F64),
+
+    I8x16 = uint8_t(ValType::I8x16),
+    I16x8 = uint8_t(ValType::I16x8),
+    I32x4 = uint8_t(ValType::I32x4),
+    F32x4 = uint8_t(ValType::F32x4),
+    B8x16 = uint8_t(ValType::B8x16),
+    B16x8 = uint8_t(ValType::B16x8),
+    B32x4 = uint8_t(ValType::B32x4),
+
+    Any   = uint8_t(TypeCode::Limit)
+};
+
+static inline StackType
+ToStackType(ValType type)
+{
+    return StackType(type);
+}
+
+static inline ValType
+NonAnyToValType(StackType type)
+{
+    MOZ_ASSERT(type != StackType::Any);
+    return ValType(type);
+}
+
+static inline bool
+Unify(StackType one, StackType two, StackType* result)
+{
+    if (MOZ_LIKELY(one == two)) {
+        *result = one;
+        return true;
+    }
+
+    if (one == StackType::Any) {
+        *result = two;
+        return true;
+    }
+
+    if (two == StackType::Any) {
+        *result = one;
+        return true;
+    }
+
+    return false;
+}
+
 #ifdef DEBUG
 // Families of opcodes that share a signature and validation logic.
 enum class OpKind {
@@ -126,31 +180,31 @@ template <typename ControlItem>
 class ControlStackEntry
 {
     LabelKind kind_;
-    bool reachable_;
+    bool polymorphicBase_;
     ExprType type_;
     size_t valueStackStart_;
     ControlItem controlItem_;
 
   public:
-    ControlStackEntry(LabelKind kind, ExprType type, bool reachable, size_t valueStackStart)
-      : kind_(kind), reachable_(reachable), type_(type), valueStackStart_(valueStackStart),
+    ControlStackEntry(LabelKind kind, ExprType type, size_t valueStackStart)
+      : kind_(kind), polymorphicBase_(false), type_(type), valueStackStart_(valueStackStart),
         controlItem_()
     {
         MOZ_ASSERT(type != ExprType::Limit);
     }
 
     LabelKind kind() const { return kind_; }
-    ExprType type() const { return type_; }
-    bool reachable() const { return reachable_; }
+    ExprType resultType() const { return type_; }
+    ExprType branchTargetType() const { return kind_ == LabelKind::Loop ? ExprType::Void : type_; }
     size_t valueStackStart() const { return valueStackStart_; }
     ControlItem& controlItem() { return controlItem_; }
+    void setPolymorphicBase() { polymorphicBase_ = true; }
+    bool polymorphicBase() const { return polymorphicBase_; }
 
-    void setReachable() { reachable_ = true; }
-
-    void switchToElse(bool reachable) {
-        MOZ_ASSERT(kind_ == LabelKind::Then || kind_ == LabelKind::UnreachableThen);
-        reachable_ = reachable;
+    void switchToElse() {
+        MOZ_ASSERT(kind_ == LabelKind::Then);
         kind_ = LabelKind::Else;
+        polymorphicBase_ = false;
     }
 };
 
@@ -159,47 +213,56 @@ template <>
 class ControlStackEntry<Nothing>
 {
     LabelKind kind_;
-    bool reachable_;
+    bool polymorphicBase_;
     ExprType type_;
     size_t valueStackStart_;
 
   public:
-    ControlStackEntry(LabelKind kind, ExprType type, bool reachable, size_t valueStackStart)
-      : kind_(kind), reachable_(reachable), type_(type), valueStackStart_(valueStackStart)
+    ControlStackEntry(LabelKind kind, ExprType type, size_t valueStackStart)
+      : kind_(kind), polymorphicBase_(false), type_(type), valueStackStart_(valueStackStart)
     {
         MOZ_ASSERT(type != ExprType::Limit);
     }
 
     LabelKind kind() const { return kind_; }
-    ExprType type() const { return type_; }
-    bool reachable() const { return reachable_; }
+    ExprType resultType() const { return type_; }
+    ExprType branchTargetType() const { return kind_ == LabelKind::Loop ? ExprType::Void : type_; }
     size_t valueStackStart() const { return valueStackStart_; }
     Nothing controlItem() { return Nothing(); }
+    void setPolymorphicBase() { polymorphicBase_ = true; }
+    bool polymorphicBase() const { return polymorphicBase_; }
 
-    void setReachable() { reachable_ = true; }
-
-    void switchToElse(bool reachable) {
-        MOZ_ASSERT(kind_ == LabelKind::Then || kind_ == LabelKind::UnreachableThen);
-        reachable_ = reachable;
+    void switchToElse() {
+        MOZ_ASSERT(kind_ == LabelKind::Then);
         kind_ = LabelKind::Else;
+        polymorphicBase_ = false;
     }
 };
 
 template <typename Value>
 class TypeAndValue
 {
-    ValType type_;
+    StackType type_;
     Value value_;
 
   public:
-    TypeAndValue() : type_(ValType(TypeCode::Limit)), value_() {}
-    explicit TypeAndValue(ValType type)
+    TypeAndValue() : type_(StackType(TypeCode::Limit)), value_() {}
+    explicit TypeAndValue(StackType type)
       : type_(type), value_()
     {}
-    TypeAndValue(ValType type, Value value)
+    explicit TypeAndValue(ValType type)
+      : type_(ToStackType(type)), value_()
+    {}
+    TypeAndValue(StackType type, Value value)
       : type_(type), value_(value)
     {}
-    ValType type() const {
+    TypeAndValue(ValType type, Value value)
+      : type_(ToStackType(type)), value_(value)
+    {}
+    StackType type() const {
+        return type_;
+    }
+    StackType& typeRef() {
         return type_;
     }
     Value value() const {
@@ -214,17 +277,17 @@ class TypeAndValue
 template <>
 class TypeAndValue<Nothing>
 {
-    ValType type_;
+    StackType type_;
 
   public:
-    TypeAndValue() : type_(ValType(TypeCode::Limit)) {}
-    explicit TypeAndValue(ValType type) : type_(type) {}
+    TypeAndValue() : type_(StackType(TypeCode::Limit)) {}
+    explicit TypeAndValue(StackType type) : type_(type) {}
+    explicit TypeAndValue(ValType type) : type_(ToStackType(type)) {}
+    TypeAndValue(StackType type, Nothing value) : type_(type) {}
+    TypeAndValue(ValType type, Nothing value) : type_(ToStackType(type)) {}
 
-    TypeAndValue(ValType type, Nothing value)
-      : type_(type)
-    {}
-
-    ValType type() const { return type_; }
+    StackType type() const { return type_; }
+    StackType& typeRef() { return type_; }
     Nothing value() const { return Nothing(); }
     void setValue(Nothing value) {}
 };
@@ -262,11 +325,11 @@ class MOZ_STACK_CLASS OpIter : private Policy
     typedef typename Policy::ControlItem ControlItem;
 
     Decoder& d_;
+    const ModuleEnvironment& env_;
     const size_t offsetInModule_;
 
     Vector<TypeAndValue<Value>, 8, SystemAllocPolicy> valueStack_;
     Vector<ControlStackEntry<ControlItem>, 8, SystemAllocPolicy> controlStack_;
-    bool reachable_;
 
     DebugOnly<Op> op_;
     size_t offsetOfExpr_;
@@ -376,139 +439,60 @@ class MOZ_STACK_CLASS OpIter : private Policy
 
     MOZ_MUST_USE bool readLinearMemoryAddress(uint32_t byteSize, LinearMemoryAddress<Value>* addr);
     MOZ_MUST_USE bool readBlockType(ExprType* expr);
+    MOZ_MUST_USE bool popCallArgs(const ValTypeVector& expectedTypes, Vector<Value, 8, SystemAllocPolicy>* values);
 
-    MOZ_MUST_USE bool typeMismatch(ExprType actual, ExprType expected) MOZ_COLD;
-    MOZ_MUST_USE bool checkType(ValType actual, ValType expected);
-    MOZ_MUST_USE bool checkType(ExprType actual, ExprType expected);
+    MOZ_MUST_USE bool popAnyType(StackType* type, Value* value);
+    MOZ_MUST_USE bool typeMismatch(StackType actual, StackType expected);
+    MOZ_MUST_USE bool popWithType(StackType expectedType, Value* value);
+    MOZ_MUST_USE bool popWithType(ValType valType, Value* value) { return popWithType(ToStackType(valType), value); }
+    MOZ_MUST_USE bool popWithType(ExprType expectedType, Value* value);
+    MOZ_MUST_USE bool topWithType(ExprType expectedType, Value* value);
+    MOZ_MUST_USE bool topWithType(ValType valType, Value* value);
 
-    MOZ_MUST_USE bool pushControl(LabelKind kind, ExprType type, bool reachable);
-    MOZ_MUST_USE bool checkControlAtEndOfBlock(LabelKind* kind, ExprType* type, Value* value);
-    MOZ_MUST_USE bool finishControl(LabelKind* kind, ExprType* type, Value* value);
+    MOZ_MUST_USE bool pushControl(LabelKind kind, ExprType type);
+    MOZ_MUST_USE bool checkStackAtEndOfBlock(ExprType* type, Value* value);
+    MOZ_MUST_USE bool getControl(uint32_t relativeDepth, ControlStackEntry<ControlItem>** controlEntry);
+    MOZ_MUST_USE bool checkBranchValue(uint32_t relativeDepth, ExprType* type, Value* value);
+    MOZ_MUST_USE bool checkBrTableEntry(uint32_t* relativeDepth, ExprType* branchValueType, Value* branchValue);
 
-    MOZ_MUST_USE bool push(ValType t) {
-        if (MOZ_UNLIKELY(!reachable_))
-            return true;
+    MOZ_MUST_USE bool push(StackType t) {
         return valueStack_.emplaceBack(t);
     }
+    MOZ_MUST_USE bool push(ValType t) {
+        return valueStack_.emplaceBack(t);
+    }
+    MOZ_MUST_USE bool push(ExprType t) {
+        return IsVoid(t) || push(NonVoidToValType(t));
+    }
     MOZ_MUST_USE bool push(TypeAndValue<Value> tv) {
-        if (MOZ_UNLIKELY(!reachable_))
-            return true;
         return valueStack_.append(tv);
     }
-    void infalliblePush(ValType t) {
-        if (MOZ_UNLIKELY(!reachable_))
-            return;
+    void infalliblePush(StackType t) {
         valueStack_.infallibleEmplaceBack(t);
     }
+    void infalliblePush(ValType t) {
+        valueStack_.infallibleEmplaceBack(ToStackType(t));
+    }
     void infalliblePush(TypeAndValue<Value> tv) {
-        if (MOZ_UNLIKELY(!reachable_))
-            return;
         valueStack_.infallibleAppend(tv);
     }
 
-    // Test whether reading the top of the value stack is currently valid.
-    MOZ_MUST_USE bool checkTop() {
-        MOZ_ASSERT(reachable_);
-        if (Validate && valueStack_.length() <= controlStack_.back().valueStackStart()) {
-            if (valueStack_.empty())
-                return fail("popping value from empty stack");
-            return fail("popping value from outside block");
-        }
-        return true;
-    }
-
-    // Pop the top of the value stack.
-    MOZ_MUST_USE bool pop(TypeAndValue<Value>* tv) {
-        if (MOZ_UNLIKELY(!reachable_))
-            return true;
-        if (!checkTop())
-            return false;
-        *tv = valueStack_.popCopy();
-        return true;
-    }
-
-    // Pop the top of the value stack and check that it has the given type.
-    MOZ_MUST_USE bool popWithType(ValType expectedType, Value* value) {
-        if (MOZ_UNLIKELY(!reachable_))
-            return true;
-        if (!checkTop())
-            return false;
-        TypeAndValue<Value> tv = valueStack_.popCopy();
-        if (!checkType(tv.type(), expectedType))
-            return false;
-        if (Output)
-            *value = tv.value();
-        return true;
-    }
-
-    // Pop the top of the value stack and discard the result.
-    MOZ_MUST_USE bool pop() {
-        if (MOZ_UNLIKELY(!reachable_))
-            return true;
-        if (!checkTop())
-            return false;
-        valueStack_.popBack();
-        return true;
-    }
-
-    // Read the top of the value stack (without popping it).
-    MOZ_MUST_USE bool top(TypeAndValue<Value>* tv) {
-        if (MOZ_UNLIKELY(!reachable_))
-            return true;
-        if (!checkTop())
-            return false;
-        *tv = valueStack_.back();
-        return true;
-    }
-
-    // Read the top of the value stack (without popping it) and check that it
-    // has the given type.
-    MOZ_MUST_USE bool topWithType(ValType expectedType, Value* value) {
-        if (MOZ_UNLIKELY(!reachable_))
-            return true;
-        if (!checkTop())
-            return false;
-        TypeAndValue<Value>& tv = valueStack_.back();
-        if (!checkType(tv.type(), expectedType))
-            return false;
-        if (Output)
-            *value = tv.value();
-        return true;
-    }
-
-    // Read the value stack entry at depth |index|.
-    MOZ_MUST_USE bool peek(uint32_t index, TypeAndValue<Value>* tv) {
-        MOZ_ASSERT(reachable_);
-        if (Validate && valueStack_.length() - controlStack_.back().valueStackStart() < index)
-            return fail("peeking at value from outside block");
-        *tv = valueStack_[valueStack_.length() - index];
-        return true;
-    }
-
-    bool getControl(uint32_t relativeDepth, ControlStackEntry<ControlItem>** controlEntry) {
-        if (Validate && relativeDepth >= controlStack_.length())
-            return fail("branch depth exceeds current nesting level");
-
-        *controlEntry = &controlStack_[controlStack_.length() - 1 - relativeDepth];
-        return true;
-    }
-
-    void enterUnreachableCode() {
+    void afterUnconditionalBranch() {
         valueStack_.shrinkTo(controlStack_.back().valueStackStart());
-        reachable_ = false;
+        controlStack_.back().setPolymorphicBase();
     }
 
-    bool checkBrValue(uint32_t relativeDepth, ExprType* type, Value* value);
-    bool checkBrIfValues(uint32_t relativeDepth, Value* condition, ExprType* type, Value* value);
-
   public:
-    explicit OpIter(Decoder& decoder, uint32_t offsetInModule = 0)
-      : d_(decoder), offsetInModule_(offsetInModule), reachable_(true),
-        op_(Op::Limit), offsetOfExpr_(0)
+    typedef Vector<Value, 8, SystemAllocPolicy> ValueVector;
+
+    explicit OpIter(const ModuleEnvironment& env, Decoder& decoder, uint32_t offsetInModule = 0)
+      : d_(decoder), env_(env), offsetInModule_(offsetInModule), op_(Op::Limit), offsetOfExpr_(0)
     {}
 
     // Return the decoding byte offset.
-    uint32_t currentOffset() const { return d_.currentOffset(); }
+    uint32_t currentOffset() const {
+        return d_.currentOffset();
+    }
 
     // Returning the offset within the entire module of the last-read Op.
     TrapOffset trapOffset() const {
@@ -516,19 +500,21 @@ class MOZ_STACK_CLASS OpIter : private Policy
     }
 
     // Test whether the iterator has reached the end of the buffer.
-    bool done() const { return d_.done(); }
+    bool done() const {
+        return d_.done();
+    }
 
     // Report a general failure.
     MOZ_MUST_USE bool fail(const char* msg) MOZ_COLD;
 
-    // Report an unimplemented feature.
-    MOZ_MUST_USE bool notYetImplemented(const char* what) MOZ_COLD;
-
     // Report an unrecognized opcode.
     MOZ_MUST_USE bool unrecognizedOpcode(uint32_t expr) MOZ_COLD;
 
-    // Test whether the iterator is currently in "reachable" code.
-    bool inReachableCode() const { return reachable_; }
+    // Return whether the innermost block has a polymorphic base of its stack.
+    // Ideally this accessor would be removed; consider using something else.
+    bool currentBlockHasPolymorphicBase() const {
+        return !controlStack_.empty() && controlStack_.back().polymorphicBase();
+    }
 
     // ------------------------------------------------------------------------
     // Decoding and validation interface.
@@ -546,10 +532,8 @@ class MOZ_STACK_CLASS OpIter : private Policy
     MOZ_MUST_USE bool readBr(uint32_t* relativeDepth, ExprType* type, Value* value);
     MOZ_MUST_USE bool readBrIf(uint32_t* relativeDepth, ExprType* type,
                                Value* value, Value* condition);
-    MOZ_MUST_USE bool readBrTable(uint32_t* tableLength, ExprType* type,
-                                  Value* value, Value* index);
-    MOZ_MUST_USE bool readBrTableEntry(ExprType* type, Value* value, uint32_t* depth);
-    MOZ_MUST_USE bool readBrTableDefault(ExprType* type, Value* value, uint32_t* depth);
+    MOZ_MUST_USE bool readBrTable(Uint32Vector* depths, uint32_t* defaultDepth,
+                                  ExprType* branchValueType, Value* branchValue, Value* index);
     MOZ_MUST_USE bool readUnreachable();
     MOZ_MUST_USE bool readDrop();
     MOZ_MUST_USE bool readUnary(ValType operandType, Value* input);
@@ -565,14 +549,14 @@ class MOZ_STACK_CLASS OpIter : private Policy
     MOZ_MUST_USE bool readNop();
     MOZ_MUST_USE bool readCurrentMemory();
     MOZ_MUST_USE bool readGrowMemory(Value* input);
-    MOZ_MUST_USE bool readSelect(ValType* type,
+    MOZ_MUST_USE bool readSelect(StackType* type,
                                  Value* trueValue, Value* falseValue, Value* condition);
     MOZ_MUST_USE bool readGetLocal(const ValTypeVector& locals, uint32_t* id);
     MOZ_MUST_USE bool readSetLocal(const ValTypeVector& locals, uint32_t* id, Value* value);
     MOZ_MUST_USE bool readTeeLocal(const ValTypeVector& locals, uint32_t* id, Value* value);
-    MOZ_MUST_USE bool readGetGlobal(const GlobalDescVector& globals, uint32_t* id);
-    MOZ_MUST_USE bool readSetGlobal(const GlobalDescVector& globals, uint32_t* id, Value* value);
-    MOZ_MUST_USE bool readTeeGlobal(const GlobalDescVector& globals, uint32_t* id, Value* value);
+    MOZ_MUST_USE bool readGetGlobal(uint32_t* id);
+    MOZ_MUST_USE bool readSetGlobal(uint32_t* id, Value* value);
+    MOZ_MUST_USE bool readTeeGlobal(uint32_t* id, Value* value);
     MOZ_MUST_USE bool readI32Const(int32_t* i32);
     MOZ_MUST_USE bool readI64Const(int64_t* i64);
     MOZ_MUST_USE bool readF32Const(float* f32);
@@ -584,13 +568,9 @@ class MOZ_STACK_CLASS OpIter : private Policy
     MOZ_MUST_USE bool readB8x16Const(I8x16* i8x16);
     MOZ_MUST_USE bool readB16x8Const(I16x8* i16x8);
     MOZ_MUST_USE bool readB32x4Const(I32x4* i32x4);
-    MOZ_MUST_USE bool readCall(uint32_t* calleeIndex);
-    MOZ_MUST_USE bool readCallIndirect(uint32_t* sigIndex, Value* callee);
-    MOZ_MUST_USE bool readOldCallIndirect(uint32_t* sigIndex);
-    MOZ_MUST_USE bool readCallArg(ValType type, uint32_t numArgs, uint32_t argIndex, Value* arg);
-    MOZ_MUST_USE bool readCallArgsEnd(uint32_t numArgs);
-    MOZ_MUST_USE bool readOldCallIndirectCallee(Value* callee);
-    MOZ_MUST_USE bool readCallReturn(ExprType ret);
+    MOZ_MUST_USE bool readCall(uint32_t* calleeIndex, ValueVector* argValues);
+    MOZ_MUST_USE bool readCallIndirect(uint32_t* sigIndex, Value* callee, ValueVector* argValues);
+    MOZ_MUST_USE bool readOldCallIndirect(uint32_t* sigIndex, Value* callee, ValueVector* argValues);
     MOZ_MUST_USE bool readAtomicLoad(LinearMemoryAddress<Value>* addr,
                                      Scalar::Type* viewType);
     MOZ_MUST_USE bool readAtomicStore(LinearMemoryAddress<Value>* addr,
@@ -623,11 +603,8 @@ class MOZ_STACK_CLASS OpIter : private Policy
     MOZ_MUST_USE bool readSimdSelect(ValType simdType, Value* trueValue,
                                      Value* falseValue,
                                      Value* condition);
-    MOZ_MUST_USE bool readSimdCtor();
-    MOZ_MUST_USE bool readSimdCtorArg(ValType elementType, uint32_t numElements, uint32_t argIndex,
-                                      Value* arg);
-    MOZ_MUST_USE bool readSimdCtorArgsEnd(uint32_t numElements);
-    MOZ_MUST_USE bool readSimdCtorReturn(ValType simdType);
+    MOZ_MUST_USE bool readSimdCtor(ValType elementType, uint32_t numElements, ValType simdType,
+                                   ValueVector* argValues);
 
     // At a location where readOp is allowed, peek at the next opcode
     // without consuming it or updating any internal state.
@@ -639,13 +616,11 @@ class MOZ_STACK_CLASS OpIter : private Policy
 
     // Set the result value of the current top-of-value-stack expression.
     void setResult(Value value) {
-        if (MOZ_LIKELY(reachable_))
-            valueStack_.back().setValue(value);
+        valueStack_.back().setValue(value);
     }
 
     // Return the result value of the current top-of-value-stack expression.
     Value getResult() {
-        MOZ_ASSERT(reachable_);
         return valueStack_.back().value();
     }
 
@@ -664,11 +639,6 @@ class MOZ_STACK_CLASS OpIter : private Policy
         return controlStack_[0].controlItem();
     }
 
-    // Return the signature of the top of the control stack.
-    ExprType controlType() {
-        return controlStack_.back().type();
-    }
-
     // Test whether the control-stack is empty, meaning we've consumed the final
     // end of the function body.
     bool controlStackEmpty() const {
@@ -676,58 +646,8 @@ class MOZ_STACK_CLASS OpIter : private Policy
     }
 };
 
-template <typename Policy>
-bool
-OpIter<Policy>::typeMismatch(ExprType actual, ExprType expected)
-{
-    MOZ_ASSERT(Validate);
-    MOZ_ASSERT(reachable_);
-
-    UniqueChars error(JS_smprintf("type mismatch: expression has type %s but expected %s",
-                                  ToCString(actual), ToCString(expected)));
-    if (!error)
-        return false;
-
-    return fail(error.get());
-}
-
 template <typename Policy>
 inline bool
-OpIter<Policy>::checkType(ValType actual, ValType expected)
-{
-    return checkType(ToExprType(actual), ToExprType(expected));
-}
-
-template <typename Policy>
-inline bool
-OpIter<Policy>::checkType(ExprType actual, ExprType expected)
-{
-    MOZ_ASSERT(reachable_);
-
-    if (!Validate) {
-        MOZ_ASSERT(actual == expected, "type mismatch");
-        return true;
-    }
-
-    if (MOZ_LIKELY(actual == expected))
-        return true;
-
-    return typeMismatch(actual, expected);
-}
-
-template <typename Policy>
-bool
-OpIter<Policy>::notYetImplemented(const char* what)
-{
-    UniqueChars error(JS_smprintf("not yet implemented: %s", what));
-    if (!error)
-        return false;
-
-    return fail(error.get());
-}
-
-template <typename Policy>
-bool
 OpIter<Policy>::unrecognizedOpcode(uint32_t expr)
 {
     UniqueChars error(JS_smprintf("unrecognized opcode: %x", expr));
@@ -738,83 +658,211 @@ OpIter<Policy>::unrecognizedOpcode(uint32_t expr)
 }
 
 template <typename Policy>
-bool
+inline bool
 OpIter<Policy>::fail(const char* msg)
 {
     return d_.fail("%s", msg);
 }
 
+// This function pops exactly one value from the stack, yielding Any types in
+// various cases and therefore making it the caller's responsibility to do the
+// right thing for StackType::Any. Prefer (pop|top)WithType.
 template <typename Policy>
 inline bool
-OpIter<Policy>::pushControl(LabelKind kind, ExprType type, bool reachable)
+OpIter<Policy>::popAnyType(StackType* type, Value* value)
 {
-    return controlStack_.emplaceBack(kind, type, reachable, valueStack_.length());
-}
+    ControlStackEntry<ControlItem>& block = controlStack_.back();
 
-template <typename Policy>
-inline bool
-OpIter<Policy>::checkControlAtEndOfBlock(LabelKind* kind, ExprType* type, Value* value)
-{
-    MOZ_ASSERT(!controlStack_.empty());
+    MOZ_ASSERT(valueStack_.length() >= block.valueStackStart());
+    if (MOZ_UNLIKELY(valueStack_.length() == block.valueStackStart())) {
+        // If the base of this block's stack is polymorphic, then we can pop a
+        // dummy value of any type; it won't be used since we're in unreachable code.
+        if (block.polymorphicBase()) {
+            *type = StackType::Any;
+            if (Output)
+                *value = Value();
 
-    ControlStackEntry<ControlItem>& controlItem = controlStack_.back();
-    *kind = controlItem.kind();
-
-    if (reachable_) {
-        // Unlike branching, exiting a scope via fallthrough does not implicitly
-        // pop excess items on the stack.
-        size_t valueStackStart = controlItem.valueStackStart();
-        size_t valueStackLength = valueStack_.length();
-        MOZ_ASSERT(valueStackLength >= valueStackStart);
-        if (valueStackLength == valueStackStart) {
-            *type = ExprType::Void;
-            if (!checkType(ExprType::Void, controlItem.type()))
-                return false;
-        } else {
-            *type = controlItem.type();
-            if (Validate && valueStackLength - valueStackStart > (IsVoid(*type) ? 0u : 1u))
-                return fail("unused values not explicitly dropped by end of block");
-            if (!topWithType(NonVoidToValType(*type), value))
-                return false;
+            // Maintain the invariant that, after a pop, there is always memory
+            // reserved to push a value infallibly.
+            return valueStack_.reserve(valueStack_.length() + 1);
         }
-    } else {
-        if (*kind != LabelKind::Loop && controlItem.reachable()) {
-            // There was no fallthrough path, but there was some other reachable
-            // branch to the end.
-            reachable_ = true;
-            *type = controlItem.type();
-            if (!IsVoid(*type)) {
-                if (!push(NonVoidToValType(*type)))
-                    return false;
-            }
-        } else {
-            // No fallthrough and no branch to the end either; we remain
-            // unreachable.
-            *type = ExprType::Void;
-        }
-        if (Output)
-            *value = Value();
+
+        if (valueStack_.empty())
+            return fail("popping value from empty stack");
+        return fail("popping value from outside block");
     }
 
+    TypeAndValue<Value>& tv = valueStack_.back();
+
+    *type = tv.type();
+    if (Output)
+        *value = tv.value();
+
+    valueStack_.popBack();
+
     return true;
 }
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::finishControl(LabelKind* kind, ExprType* type, Value* value)
+OpIter<Policy>::typeMismatch(StackType actual, StackType expected)
 {
-    if (!checkControlAtEndOfBlock(kind, type, value))
+    UniqueChars error(JS_smprintf("type mismatch: expression has type %s but expected %s",
+                                  ToCString(NonAnyToValType(actual)),
+                                  ToCString(NonAnyToValType(expected))));
+    if (!error)
         return false;
 
-    if (*kind == LabelKind::Then) {
-        // A reachable If without an Else. Forbid a result value.
-        if (reachable_) {
-            if (Validate && !IsVoid(*type))
-                return fail("if without else with a result value");
+    return fail(error.get());
+}
+
+// This function pops exactly one value from the stack, checking that it has the
+// expected type which can either be a specific value type or a type variable.
+template <typename Policy>
+inline bool
+OpIter<Policy>::popWithType(StackType expectedType, Value* value)
+{
+    ControlStackEntry<ControlItem>& block = controlStack_.back();
+
+    MOZ_ASSERT(valueStack_.length() >= block.valueStackStart());
+    if (MOZ_UNLIKELY(valueStack_.length() == block.valueStackStart())) {
+        // If the base of this block's stack is polymorphic, then we can pop a
+        // dummy value of any expected type; it won't be used since we're in
+        // unreachable code.
+        if (block.polymorphicBase()) {
+            if (Output)
+                *value = Value();
+
+            // Maintain the invariant that, after a pop, there is always memory
+            // reserved to push a value infallibly.
+            return valueStack_.reserve(valueStack_.length() + 1);
         }
-        reachable_ = true;
+
+        if (valueStack_.empty())
+            return fail("popping value from empty stack");
+        return fail("popping value from outside block");
     }
 
+    TypeAndValue<Value> tv = valueStack_.popCopy();
+
+    if (Validate) {
+        StackType _;
+        if (MOZ_UNLIKELY(!Unify(tv.type(), expectedType, &_)))
+            return typeMismatch(tv.type(), expectedType);
+    } else {
+        DebugOnly<StackType> result;
+        MOZ_ASSERT(Unify(tv.type(), expectedType, &result));
+    }
+
+    if (Output)
+        *value = tv.value();
+
+    return true;
+}
+
+// This function pops as many types from the stack as determined by the given
+// signature. Currently, all signatures are limited to 0 or 1 types, with
+// ExprType::Void meaning 0 and all other ValTypes meaning 1, but this will be
+// generalized in the future.
+template <typename Policy>
+inline bool
+OpIter<Policy>::popWithType(ExprType expectedType, Value* value)
+{
+    if (IsVoid(expectedType)) {
+        if (Output)
+            *value = Value();
+        return true;
+    }
+
+    return popWithType(NonVoidToValType(expectedType), value);
+}
+
+// This function is just an optimization of popWithType + push.
+template <typename Policy>
+inline bool
+OpIter<Policy>::topWithType(ValType expectedType, Value* value)
+{
+    ControlStackEntry<ControlItem>& block = controlStack_.back();
+
+    MOZ_ASSERT(valueStack_.length() >= block.valueStackStart());
+    if (MOZ_UNLIKELY(valueStack_.length() == block.valueStackStart())) {
+        // If the base of this block's stack is polymorphic, then we can just
+        // pull out a dummy value of the expected type; it won't be used since
+        // we're in unreachable code. We must however push this value onto the
+        // stack since it is now fixed to a specific type by this type
+        // constraint.
+        if (block.polymorphicBase()) {
+            if (!valueStack_.emplaceBack(expectedType, Value()))
+                return false;
+            if (Output)
+                *value = Value();
+            return true;
+        }
+
+        if (valueStack_.empty())
+            return fail("reading value from empty stack");
+        return fail("reading value from outside block");
+    }
+
+    TypeAndValue<Value>& tv = valueStack_.back();
+
+    if (MOZ_UNLIKELY(!Unify(tv.type(), ToStackType(expectedType), &tv.typeRef())))
+        return typeMismatch(tv.type(), ToStackType(expectedType));
+
+    if (Output)
+        *value = tv.value();
+
+    return true;
+}
+
+template <typename Policy>
+inline bool
+OpIter<Policy>::topWithType(ExprType expectedType, Value* value)
+{
+    if (IsVoid(expectedType)) {
+        if (Output)
+            *value = Value();
+        return true;
+    }
+
+    return topWithType(NonVoidToValType(expectedType), value);
+}
+
+template <typename Policy>
+inline bool
+OpIter<Policy>::pushControl(LabelKind kind, ExprType type)
+{
+    return controlStack_.emplaceBack(kind, type, valueStack_.length());
+}
+
+template <typename Policy>
+inline bool
+OpIter<Policy>::checkStackAtEndOfBlock(ExprType* type, Value* value)
+{
+    ControlStackEntry<ControlItem>& block = controlStack_.back();
+
+    MOZ_ASSERT(valueStack_.length() >= block.valueStackStart());
+    size_t pushed = valueStack_.length() - block.valueStackStart();
+    if (Validate && pushed > (IsVoid(block.resultType()) ? 0u : 1u))
+        return fail("unused values not explicitly dropped by end of block");
+
+    if (!topWithType(block.resultType(), value))
+        return false;
+
+    if (Output)
+        *type = block.resultType();
+
+    return true;
+}
+
+template <typename Policy>
+inline bool
+OpIter<Policy>::getControl(uint32_t relativeDepth, ControlStackEntry<ControlItem>** controlEntry)
+{
+    if (Validate && relativeDepth >= controlStack_.length())
+        return fail("branch depth exceeds current nesting level");
+
+    *controlEntry = &controlStack_[controlStack_.length() - 1 - relativeDepth];
     return true;
 }
 
@@ -854,6 +902,8 @@ template <typename Policy>
 inline bool
 OpIter<Policy>::readOp(uint16_t* op)
 {
+    MOZ_ASSERT(!controlStack_.empty());
+
     offsetOfExpr_ = d_.currentOffset();
 
     if (Validate) {
@@ -894,9 +944,8 @@ OpIter<Policy>::readFunctionStart(ExprType ret)
     MOZ_ASSERT(valueStack_.empty());
     MOZ_ASSERT(controlStack_.empty());
     MOZ_ASSERT(Op(op_) == Op::Limit);
-    MOZ_ASSERT(reachable_);
 
-    return pushControl(LabelKind::Block, ret, false);
+    return pushControl(LabelKind::Block, ret);
 }
 
 template <typename Policy>
@@ -921,19 +970,13 @@ OpIter<Policy>::readReturn(Value* value)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::Return);
 
-    if (MOZ_LIKELY(reachable_)) {
-        ControlStackEntry<ControlItem>& controlItem = controlStack_[0];
-        MOZ_ASSERT(controlItem.kind() == LabelKind::Block);
+    ControlStackEntry<ControlItem>& body = controlStack_[0];
+    MOZ_ASSERT(body.kind() == LabelKind::Block);
 
-        controlItem.setReachable();
+    if (!popWithType(body.resultType(), value))
+        return false;
 
-        if (!IsVoid(controlItem.type())) {
-            if (!popWithType(NonVoidToValType(controlItem.type()), value))
-                return false;
-        }
-    }
-
-    enterUnreachableCode();
+    afterUnconditionalBranch();
     return true;
 }
 
@@ -947,7 +990,7 @@ OpIter<Policy>::readBlock()
     if (!readBlockType(&type))
         return false;
 
-    return pushControl(LabelKind::Block, type, false);
+    return pushControl(LabelKind::Block, type);
 }
 
 template <typename Policy>
@@ -960,7 +1003,7 @@ OpIter<Policy>::readLoop()
     if (!readBlockType(&type))
         return false;
 
-    return pushControl(LabelKind::Loop, type, reachable_);
+    return pushControl(LabelKind::Loop, type);
 }
 
 template <typename Policy>
@@ -973,45 +1016,36 @@ OpIter<Policy>::readIf(Value* condition)
     if (!readBlockType(&type))
         return false;
 
-    if (MOZ_LIKELY(reachable_)) {
-        if (!popWithType(ValType::I32, condition))
-            return false;
+    if (!popWithType(ValType::I32, condition))
+        return false;
 
-        return pushControl(LabelKind::Then, type, false);
-    }
-
-    return pushControl(LabelKind::UnreachableThen, type, false);
+    return pushControl(LabelKind::Then, type);
 }
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readElse(ExprType* thenType, Value* thenValue)
+OpIter<Policy>::readElse(ExprType* type, Value* value)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::Else);
 
-    // Finish up the then arm.
-    ExprType type = ExprType::Limit;
-    LabelKind kind;
-    if (!checkControlAtEndOfBlock(&kind, &type, thenValue))
+    // Finish checking the then-block.
+
+    if (!checkStackAtEndOfBlock(type, value))
         return false;
 
-    if (Output)
-        *thenType = type;
+    ControlStackEntry<ControlItem>& block = controlStack_.back();
 
-    // Pop the old then value from the stack.
-    if (!IsVoid(type))
-        valueStack_.popBack();
-
-    if (Validate && kind != LabelKind::Then && kind != LabelKind::UnreachableThen)
+    if (Validate && block.kind() != LabelKind::Then)
         return fail("else can only be used within an if");
 
-    // Switch to the else arm.
-    controlStack_.back().switchToElse(reachable_);
+    // Switch to the else-block.
 
-    reachable_ = kind != LabelKind::UnreachableThen;
+    if (!IsVoid(block.resultType()))
+        valueStack_.popBack();
 
-    MOZ_ASSERT(valueStack_.length() == controlStack_.back().valueStackStart());
+    MOZ_ASSERT(valueStack_.length() == block.valueStackStart());
 
+    block.switchToElse();
     return true;
 }
 
@@ -1021,15 +1055,18 @@ OpIter<Policy>::readEnd(LabelKind* kind, ExprType* type, Value* value)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::End);
 
-    LabelKind validateKind = static_cast<LabelKind>(-1);
-    ExprType validateType = ExprType::Limit;
-    if (!finishControl(&validateKind, &validateType, value))
+    if (!checkStackAtEndOfBlock(type, value))
         return false;
 
-    if (Output) {
-        *kind = validateKind;
-        *type = validateType;
-    }
+    ControlStackEntry<ControlItem>& block = controlStack_.back();
+
+    // If an `if` block ends with `end` instead of `else`, then we must
+    // additionally validate that the then-block doesn't push anything.
+    if (Validate && block.kind() == LabelKind::Then && !IsVoid(block.resultType()))
+        return fail("if without else with a result value");
+
+    if (Output)
+        *kind = block.kind();
 
     return true;
 }
@@ -1041,187 +1078,137 @@ OpIter<Policy>::popEnd()
     MOZ_ASSERT(Classify(op_) == OpKind::End);
 
     controlStack_.popBack();
-
-    if (!reachable_ && !controlStack_.empty())
-        valueStack_.shrinkTo(controlStack_.back().valueStackStart());
 }
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::checkBrValue(uint32_t relativeDepth, ExprType* type, Value* value)
+OpIter<Policy>::checkBranchValue(uint32_t relativeDepth, ExprType* type, Value* value)
 {
-    if (MOZ_LIKELY(reachable_)) {
-        ControlStackEntry<ControlItem>* controlItem = nullptr;
-        if (!getControl(relativeDepth, &controlItem))
-            return false;
+    ControlStackEntry<ControlItem>* block = nullptr;
+    if (!getControl(relativeDepth, &block))
+        return false;
 
-        if (controlItem->kind() != LabelKind::Loop) {
-            controlItem->setReachable();
-
-            ExprType expectedType = controlItem->type();
-            if (Output)
-                *type = expectedType;
-
-            if (!IsVoid(expectedType))
-                return topWithType(NonVoidToValType(expectedType), value);
-        }
-    }
-
-    if (Output) {
-        *type = ExprType::Void;
-        *value = Value();
-    }
-
-    return true;
+    *type = block->branchTargetType();
+    return topWithType(*type, value);
 }
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readBr(uint32_t* relativeDepth, ExprType* type, Value* value)
+OpIter<Policy>::readBr(uint32_t* relativeDepthOut, ExprType* typeOut, Value* value)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::Br);
 
-    uint32_t validateRelativeDepth;
-    if (!readVarU32(&validateRelativeDepth))
+    uint32_t relativeDepth;
+    if (!readVarU32(&relativeDepth))
         return fail("unable to read br depth");
 
-    if (!checkBrValue(validateRelativeDepth, type, value))
+    if (Output)
+        *relativeDepthOut = relativeDepth;
+
+    ExprType type;
+    if (!checkBranchValue(relativeDepth, &type, value))
         return false;
 
     if (Output)
-        *relativeDepth = validateRelativeDepth;
+        *typeOut = type;
 
-    enterUnreachableCode();
+    afterUnconditionalBranch();
     return true;
 }
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::checkBrIfValues(uint32_t relativeDepth, Value* condition,
-                                  ExprType* type, Value* value)
-{
-    if (MOZ_LIKELY(reachable_)) {
-        if (!popWithType(ValType::I32, condition))
-            return false;
-
-        ControlStackEntry<ControlItem>* controlItem = nullptr;
-        if (!getControl(relativeDepth, &controlItem))
-            return false;
-
-        if (controlItem->kind() != LabelKind::Loop) {
-            controlItem->setReachable();
-
-            ExprType expectedType = controlItem->type();
-            if (Output)
-                *type = expectedType;
-
-            if (!IsVoid(expectedType))
-                return topWithType(NonVoidToValType(expectedType), value);
-        }
-    }
-
-    if (Output) {
-        *type = ExprType::Void;
-        *value = Value();
-    }
-
-    return true;
-}
-
-template <typename Policy>
-inline bool
-OpIter<Policy>::readBrIf(uint32_t* relativeDepth, ExprType* type, Value* value, Value* condition)
+OpIter<Policy>::readBrIf(uint32_t* relativeDepthOut, ExprType* typeOut, Value* value, Value* condition)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::BrIf);
 
-    uint32_t validateRelativeDepth;
-    if (!readVarU32(&validateRelativeDepth))
+    uint32_t relativeDepth;
+    if (!readVarU32(&relativeDepth))
         return fail("unable to read br_if depth");
 
-    if (!checkBrIfValues(validateRelativeDepth, condition, type, value))
+    if (Output)
+        *relativeDepthOut = relativeDepth;
+
+    if (!popWithType(ValType::I32, condition))
+        return false;
+
+    ExprType type;
+    if (!checkBranchValue(relativeDepth, &type, value))
         return false;
 
     if (Output)
-        *relativeDepth = validateRelativeDepth;
+        *typeOut = type;
 
     return true;
 }
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readBrTable(uint32_t* tableLength, ExprType* type,
-                              Value* value, Value* index)
+OpIter<Policy>::checkBrTableEntry(uint32_t* relativeDepth, ExprType* branchValueType,
+                                  Value* branchValue)
+{
+    if (!readVarU32(relativeDepth))
+        return false;
+
+    // For the first encountered branch target, do a normal branch value type
+    // check which will change *branchValueType to a non-sentinel value. For all
+    // subsequent branch targets, check that the branch target matches the
+    // now-known branch value type.
+
+    if (*branchValueType == ExprType::Limit) {
+        if (!checkBranchValue(*relativeDepth, branchValueType, branchValue))
+            return false;
+    } else {
+        ControlStackEntry<ControlItem>* block = nullptr;
+        if (!getControl(*relativeDepth, &block))
+            return false;
+
+        if (*branchValueType != block->branchTargetType())
+            return fail("br_table targets must all have the same value type");
+    }
+
+    return true;
+}
+
+template <typename Policy>
+inline bool
+OpIter<Policy>::readBrTable(Uint32Vector* depthsOut, uint32_t* defaultDepthOut,
+                            ExprType* branchValueType, Value* branchValue, Value* index)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::BrTable);
 
-    if (!readVarU32(tableLength))
+    uint32_t tableLength;
+    if (!readVarU32(&tableLength))
         return fail("unable to read br_table table length");
 
-    if (MOZ_LIKELY(reachable_)) {
-        if (!popWithType(ValType::I32, index))
+    if (!popWithType(ValType::I32, index))
+        return false;
+
+    Uint32Vector depths;
+    if (!depths.resize(tableLength))
+        return false;
+
+    ExprType type = ExprType::Limit;
+
+    for (uint32_t i = 0; i < tableLength; i++) {
+        if (!checkBrTableEntry(&depths[i], &type, branchValue))
             return false;
     }
 
-    // Set *type to indicate that we don't know the type yet.
-    *type = ExprType::Limit;
-    if (Output)
-        *value = Value();
-
-    return true;
-}
-
-template <typename Policy>
-inline bool
-OpIter<Policy>::readBrTableEntry(ExprType* type, Value* value, uint32_t* depth)
-{
-    MOZ_ASSERT(Classify(op_) == OpKind::BrTable);
-
-    if (!readVarU32(depth))
+    uint32_t defaultDepth;
+    if (!checkBrTableEntry(&defaultDepth, &type, branchValue))
         return false;
 
-    ExprType knownType = *type;
+    MOZ_ASSERT(type != ExprType::Limit);
 
-    if (MOZ_LIKELY(reachable_)) {
-        ControlStackEntry<ControlItem>* controlItem = nullptr;
-        if (!getControl(*depth, &controlItem))
-            return false;
+    afterUnconditionalBranch();
 
-        if (controlItem->kind() != LabelKind::Loop) {
-            controlItem->setReachable();
-
-            // If we've already seen one label, we know the type and can check
-            // that the type for the current label matches it.
-            if (knownType != ExprType::Limit)
-                return checkType(knownType, controlItem->type());
-
-            // This is the first label; record the type and the value now.
-            ExprType expectedType = controlItem->type();
-            if (!IsVoid(expectedType)) {
-                *type = expectedType;
-                return popWithType(NonVoidToValType(expectedType), value);
-            }
-        }
-
-        if (knownType != ExprType::Limit && knownType != ExprType::Void)
-            return typeMismatch(knownType, ExprType::Void);
+    if (Output) {
+        *depthsOut = Move(depths);
+        *defaultDepthOut = defaultDepth;
+        *branchValueType = type;
     }
 
-    *type = ExprType::Void;
-    if (Output)
-        *value = Value();
-    return true;
-}
-
-template <typename Policy>
-inline bool
-OpIter<Policy>::readBrTableDefault(ExprType* type, Value* value, uint32_t* depth)
-{
-    if (!readBrTableEntry(type, value, depth))
-        return false;
-
-    MOZ_ASSERT(!reachable_ || *type != ExprType::Limit);
-
-    enterUnreachableCode();
     return true;
 }
 
@@ -1231,7 +1218,7 @@ OpIter<Policy>::readUnreachable()
 {
     MOZ_ASSERT(Classify(op_) == OpKind::Unreachable);
 
-    enterUnreachableCode();
+    afterUnconditionalBranch();
     return true;
 }
 
@@ -1240,11 +1227,9 @@ inline bool
 OpIter<Policy>::readDrop()
 {
     MOZ_ASSERT(Classify(op_) == OpKind::Drop);
-
-    if (!pop())
-        return false;
-
-    return true;
+    StackType type;
+    Value value;
+    return popAnyType(&type, &value);
 }
 
 template <typename Policy>
@@ -1313,6 +1298,9 @@ template <typename Policy>
 inline bool
 OpIter<Policy>::readLinearMemoryAddress(uint32_t byteSize, LinearMemoryAddress<Value>* addr)
 {
+    if (!env_.usesMemory())
+        return fail("can't touch memory without memory");
+
     uint8_t alignLog2;
     if (!readFixedU8(&alignLog2))
         return fail("unable to read load alignment");
@@ -1397,6 +1385,9 @@ OpIter<Policy>::readCurrentMemory()
 {
     MOZ_ASSERT(Classify(op_) == OpKind::CurrentMemory);
 
+    if (!env_.usesMemory())
+        return fail("can't touch memory without memory");
+
     uint32_t flags;
     if (!readVarU32(&flags))
         return false;
@@ -1404,10 +1395,7 @@ OpIter<Policy>::readCurrentMemory()
     if (Validate && flags != uint32_t(MemoryTableFlags::Default))
         return fail("unexpected flags");
 
-    if (!push(ValType::I32))
-        return false;
-
-    return true;
+    return push(ValType::I32);
 }
 
 template <typename Policy>
@@ -1416,6 +1404,9 @@ OpIter<Policy>::readGrowMemory(Value* input)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::GrowMemory);
 
+    if (!env_.usesMemory())
+        return fail("can't touch memory without memory");
+
     uint32_t flags;
     if (!readVarU32(&flags))
         return false;
@@ -1433,32 +1424,29 @@ OpIter<Policy>::readGrowMemory(Value* input)
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readSelect(ValType* type, Value* trueValue, Value* falseValue, Value* condition)
+OpIter<Policy>::readSelect(StackType* type, Value* trueValue, Value* falseValue, Value* condition)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::Select);
 
     if (!popWithType(ValType::I32, condition))
         return false;
 
-    TypeAndValue<Value> false_;
-    if (!pop(&false_))
+    StackType falseType;
+    if (!popAnyType(&falseType, falseValue))
         return false;
 
-    TypeAndValue<Value> true_;
-    if (!pop(&true_))
+    StackType trueType;
+    if (!popAnyType(&trueType, trueValue))
         return false;
 
-    ValType resultType = true_.type();
-    if (Validate && resultType != false_.type())
+    StackType resultType;
+    if (!Unify(falseType, trueType, &resultType))
         return fail("select operand types must match");
 
     infalliblePush(resultType);
 
-    if (Output) {
+    if (Output)
         *type = resultType;
-        *trueValue = true_.value();
-        *falseValue = false_.value();
-    }
 
     return true;
 }
@@ -1531,7 +1519,7 @@ OpIter<Policy>::readTeeLocal(const ValTypeVector& locals, uint32_t* id, Value* v
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readGetGlobal(const GlobalDescVector& globals, uint32_t* id)
+OpIter<Policy>::readGetGlobal(uint32_t* id)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::GetGlobal);
 
@@ -1539,10 +1527,10 @@ OpIter<Policy>::readGetGlobal(const GlobalDescVector& globals, uint32_t* id)
     if (!readVarU32(&validateId))
         return false;
 
-    if (Validate && validateId >= globals.length())
+    if (Validate && validateId >= env_.globals.length())
         return fail("get_global index out of range");
 
-    if (!push(globals[validateId].type()))
+    if (!push(env_.globals[validateId].type()))
         return false;
 
     if (Output)
@@ -1553,7 +1541,7 @@ OpIter<Policy>::readGetGlobal(const GlobalDescVector& globals, uint32_t* id)
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readSetGlobal(const GlobalDescVector& globals, uint32_t* id, Value* value)
+OpIter<Policy>::readSetGlobal(uint32_t* id, Value* value)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::SetGlobal);
 
@@ -1561,13 +1549,13 @@ OpIter<Policy>::readSetGlobal(const GlobalDescVector& globals, uint32_t* id, Val
     if (!readVarU32(&validateId))
         return false;
 
-    if (Validate && validateId >= globals.length())
+    if (Validate && validateId >= env_.globals.length())
         return fail("set_global index out of range");
 
-    if (Validate && !globals[validateId].isMutable())
+    if (Validate && !env_.globals[validateId].isMutable())
         return fail("can't write an immutable global");
 
-    if (!popWithType(globals[validateId].type(), value))
+    if (!popWithType(env_.globals[validateId].type(), value))
         return false;
 
     if (Output)
@@ -1578,7 +1566,7 @@ OpIter<Policy>::readSetGlobal(const GlobalDescVector& globals, uint32_t* id, Val
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readTeeGlobal(const GlobalDescVector& globals, uint32_t* id, Value* value)
+OpIter<Policy>::readTeeGlobal(uint32_t* id, Value* value)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::TeeGlobal);
 
@@ -1586,13 +1574,13 @@ OpIter<Policy>::readTeeGlobal(const GlobalDescVector& globals, uint32_t* id, Val
     if (!readVarU32(&validateId))
         return false;
 
-    if (Validate && validateId >= globals.length())
+    if (Validate && validateId >= env_.globals.length())
         return fail("set_global index out of range");
 
-    if (Validate && !globals[validateId].isMutable())
+    if (Validate && !env_.globals[validateId].isMutable())
         return fail("can't write an immutable global");
 
-    if (!topWithType(globals[validateId].type(), value))
+    if (!topWithType(env_.globals[validateId].type(), value))
         return false;
 
     if (Output)
@@ -1611,10 +1599,7 @@ OpIter<Policy>::readI32Const(int32_t* i32)
     if (!readVarS32(Output ? i32 : &unused))
         return false;
 
-    if (!push(ValType::I32))
-       return false;
-
-    return true;
+    return push(ValType::I32);
 }
 
 template <typename Policy>
@@ -1779,25 +1764,66 @@ OpIter<Policy>::readB32x4Const(I32x4* i32x4)
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readCall(uint32_t* calleeIndex)
+OpIter<Policy>::popCallArgs(const ValTypeVector& expectedTypes, ValueVector* values)
 {
-    MOZ_ASSERT(Classify(op_) == OpKind::Call);
+    // Iterate through the argument types backward so that pops occur in the
+    // right order.
 
-    if (!readVarU32(calleeIndex))
-        return fail("unable to read call function index");
+    if (Output && !values->resize(expectedTypes.length()))
+        return false;
+
+    for (int32_t i = expectedTypes.length() - 1; i >= 0; i--) {
+        Value* argValue = Output ? &(*values)[i] : nullptr;
+        if (!popWithType(expectedTypes[i], argValue))
+            return false;
+    }
 
     return true;
 }
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readCallIndirect(uint32_t* sigIndex, Value* callee)
+OpIter<Policy>::readCall(uint32_t* funcIndexOut, ValueVector* argValues)
+{
+    MOZ_ASSERT(Classify(op_) == OpKind::Call);
+
+    uint32_t funcIndex;
+    if (!readVarU32(&funcIndex))
+        return fail("unable to read call function index");
+
+    if (funcIndex >= env_.funcSigs.length())
+        return fail("callee index out of range");
+
+    const Sig& sig = *env_.funcSigs[funcIndex];
+
+    if (!popCallArgs(sig.args(), argValues))
+        return false;
+
+    if (!push(sig.ret()))
+        return false;
+
+    if (Output)
+        *funcIndexOut = funcIndex;
+
+    return true;
+}
+
+template <typename Policy>
+inline bool
+OpIter<Policy>::readCallIndirect(uint32_t* sigIndexOut, Value* callee, ValueVector* argValues)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::CallIndirect);
 
-    if (!readVarU32(sigIndex))
+    if (!env_.tables.length())
+        return fail("can't call_indirect without a table");
+
+    uint32_t sigIndex;
+    if (!readVarU32(&sigIndex))
         return fail("unable to read call_indirect signature index");
 
+    if (sigIndex >= env_.numSigs())
+        return fail("signature index out of range");
+
     uint32_t flags;
     if (!readVarU32(&flags))
         return false;
@@ -1805,80 +1831,45 @@ OpIter<Policy>::readCallIndirect(uint32_t* sigIndex, Value* callee)
     if (Validate && flags != uint32_t(MemoryTableFlags::Default))
         return fail("unexpected flags");
 
-    if (reachable_) {
-        if (!popWithType(ValType::I32, callee))
-            return false;
-    }
+    if (!popWithType(ValType::I32, callee))
+        return false;
+
+    const Sig& sig = env_.sigs[sigIndex];
+
+    if (!popCallArgs(sig.args(), argValues))
+        return false;
+
+    if (!push(sig.ret()))
+        return false;
+
+    if (Output)
+        *sigIndexOut = sigIndex;
 
     return true;
 }
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readOldCallIndirect(uint32_t* sigIndex)
+OpIter<Policy>::readOldCallIndirect(uint32_t* sigIndex, Value* callee, ValueVector* argValues)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::OldCallIndirect);
 
     if (!readVarU32(sigIndex))
         return fail("unable to read call_indirect signature index");
 
-    return true;
-}
+    if (*sigIndex >= env_.numSigs())
+        return fail("signature index out of range");
 
-template <typename Policy>
-inline bool
-OpIter<Policy>::readCallArg(ValType type, uint32_t numArgs, uint32_t argIndex, Value* arg)
-{
-    MOZ_ASSERT(reachable_);
+    const Sig& sig = env_.sigs[*sigIndex];
 
-    TypeAndValue<Value> tv;
-
-    if (!peek(numArgs - argIndex, &tv))
+    if (!popCallArgs(sig.args(), argValues))
         return false;
-    if (!checkType(tv.type(), type))
-        return false;
-
-    if (Output)
-        *arg = tv.value();
-
-    return true;
-}
-
-template <typename Policy>
-inline bool
-OpIter<Policy>::readCallArgsEnd(uint32_t numArgs)
-{
-    MOZ_ASSERT(reachable_);
-    MOZ_ASSERT(numArgs <= valueStack_.length());
-
-    valueStack_.shrinkBy(numArgs);
-
-    return true;
-}
-
-template <typename Policy>
-inline bool
-OpIter<Policy>::readOldCallIndirectCallee(Value* callee)
-{
-    MOZ_ASSERT(Classify(op_) == OpKind::OldCallIndirect);
-    MOZ_ASSERT(reachable_);
 
     if (!popWithType(ValType::I32, callee))
         return false;
 
-    return true;
-}
-
-template <typename Policy>
-inline bool
-OpIter<Policy>::readCallReturn(ExprType ret)
-{
-    MOZ_ASSERT(reachable_);
-
-    if (!IsVoid(ret)) {
-        if (!push(NonVoidToValType(ret)))
-            return false;
-    }
+    if (!push(sig.ret()))
+        return false;
 
     return true;
 }
@@ -2200,49 +2191,19 @@ OpIter<Policy>::readSimdSelect(ValType simdType, Value* trueValue, Value* falseV
 
 template <typename Policy>
 inline bool
-OpIter<Policy>::readSimdCtor()
+OpIter<Policy>::readSimdCtor(ValType elementType, uint32_t numElements, ValType simdType,
+                             ValueVector* argValues)
 {
     MOZ_ASSERT(Classify(op_) == OpKind::SimdCtor);
 
-    return true;
-}
-
-template <typename Policy>
-inline bool
-OpIter<Policy>::readSimdCtorArg(ValType elementType, uint32_t numElements, uint32_t index,
-                                Value* arg)
-{
-    MOZ_ASSERT(Classify(op_) == OpKind::SimdCtor);
-    MOZ_ASSERT(numElements > 0);
-
-    TypeAndValue<Value> tv;
-
-    if (!peek(numElements - index, &tv))
-        return false;
-    if (!checkType(tv.type(), elementType))
+    if (Output && !argValues->resize(numElements))
         return false;
 
-    *arg = tv.value();
-    return true;
-}
-
-template <typename Policy>
-inline bool
-OpIter<Policy>::readSimdCtorArgsEnd(uint32_t numElements)
-{
-    MOZ_ASSERT(Classify(op_) == OpKind::SimdCtor);
-    MOZ_ASSERT(numElements <= valueStack_.length());
-
-    valueStack_.shrinkBy(numElements);
-
-    return true;
-}
-
-template <typename Policy>
-inline bool
-OpIter<Policy>::readSimdCtorReturn(ValType simdType)
-{
-    MOZ_ASSERT(Classify(op_) == OpKind::SimdCtor);
+    for (int32_t i = numElements - 1; i >= 0; i--) {
+        Value* argValue = Output ? &(*argValues)[i] : nullptr;
+        if (!popWithType(elementType, argValue))
+            return false;
+    }
 
     infalliblePush(simdType);
 
diff --git a/js/src/wasm/WasmBinaryToAST.cpp b/js/src/wasm/WasmBinaryToAST.cpp
index 5de639fe2e9d..0296ed8a7d51 100644
--- a/js/src/wasm/WasmBinaryToAST.cpp
+++ b/js/src/wasm/WasmBinaryToAST.cpp
@@ -135,12 +135,6 @@ class AstDecodeContext
     AstDecodeStackItem& top() { return exprs().back(); }
     MOZ_MUST_USE bool push(AstDecodeStackItem item) { return exprs().append(item); }
 
-    bool checkHasMemory() {
-        if (!module().hasMemory())
-            return iter().fail("can't touch memory without memory");
-        return true;
-    }
-
     bool needFirst() {
         for (size_t i = depths().back(); i < exprs().length(); ++i) {
             if (!exprs()[i].expr->isVoid())
@@ -256,30 +250,18 @@ GenerateRef(AstDecodeContext& c, const AstName& prefix, uint32_t index, AstRef*
 static bool
 AstDecodeCallArgs(AstDecodeContext& c, const SigWithId& sig, AstExprVector* funcArgs)
 {
-    MOZ_ASSERT(c.iter().inReachableCode());
-
-    const ValTypeVector& args = sig.args();
-    uint32_t numArgs = args.length();
+    MOZ_ASSERT(!c.iter().currentBlockHasPolymorphicBase());
 
+    uint32_t numArgs = sig.args().length();
     if (!funcArgs->resize(numArgs))
         return false;
 
-    for (size_t i = 0; i < numArgs; ++i) {
-        ValType argType = args[i];
-        AstDecodeStackItem item;
-        if (!c.iter().readCallArg(argType, numArgs, i, nullptr))
-            return false;
+    for (size_t i = 0; i < numArgs; ++i)
         (*funcArgs)[i] = c.exprs()[c.exprs().length() - numArgs + i].expr;
-    }
+
     c.exprs().shrinkBy(numArgs);
 
-    return c.iter().readCallArgsEnd(numArgs);
-}
-
-static bool
-AstDecodeCallReturn(AstDecodeContext& c, const SigWithId& sig)
-{
-    return c.iter().readCallReturn(sig.ret());
+    return true;
 }
 
 static bool
@@ -311,15 +293,13 @@ static bool
 AstDecodeCall(AstDecodeContext& c)
 {
     uint32_t funcIndex;
-    if (!c.iter().readCall(&funcIndex))
+    AstDecodeOpIter::ValueVector unusedArgs;
+    if (!c.iter().readCall(&funcIndex, &unusedArgs))
         return false;
 
-    if (!c.iter().inReachableCode())
+    if (c.iter().currentBlockHasPolymorphicBase())
         return true;
 
-    if (funcIndex >= c.env().numFuncs())
-        return c.iter().fail("callee index out of range");
-
     AstRef funcRef;
     if (funcIndex < c.module().numFuncImports()) {
         AstImport* import = c.module().imports()[funcIndex];
@@ -335,9 +315,6 @@ AstDecodeCall(AstDecodeContext& c)
     if (!AstDecodeCallArgs(c, *sig, &args))
         return false;
 
-    if (!AstDecodeCallReturn(c, *sig))
-        return false;
-
     AstCall* call = new(c.lifo) AstCall(Op::Call, sig->ret(), funcRef, Move(args));
     if (!call)
         return false;
@@ -355,19 +332,14 @@ AstDecodeCall(AstDecodeContext& c)
 static bool
 AstDecodeCallIndirect(AstDecodeContext& c)
 {
-    if (!c.env().tables.length())
-        return c.iter().fail("can't call_indirect without a table");
-
     uint32_t sigIndex;
-    if (!c.iter().readCallIndirect(&sigIndex, nullptr))
+    AstDecodeOpIter::ValueVector unusedArgs;
+    if (!c.iter().readCallIndirect(&sigIndex, nullptr, &unusedArgs))
         return false;
 
-    if (!c.iter().inReachableCode())
+    if (c.iter().currentBlockHasPolymorphicBase())
         return true;
 
-    if (sigIndex >= c.module().sigs().length())
-        return c.iter().fail("signature index out of range");
-
     AstDecodeStackItem index = c.popCopy();
 
     AstRef sigRef;
@@ -379,9 +351,6 @@ AstDecodeCallIndirect(AstDecodeContext& c)
     if (!AstDecodeCallArgs(c, sig, &args))
         return false;
 
-    if (!AstDecodeCallReturn(c, sig))
-        return false;
-
     AstCallIndirect* call = new(c.lifo) AstCallIndirect(sigRef, sig.ret(), Move(args), index.expr);
     if (!call)
         return false;
@@ -418,38 +387,31 @@ AstDecodeGetBlockRef(AstDecodeContext& c, uint32_t depth, AstRef* ref)
 static bool
 AstDecodeBrTable(AstDecodeContext& c)
 {
-    uint32_t tableLength;
+    Uint32Vector depths;
+    uint32_t defaultDepth;
     ExprType type;
-    if (!c.iter().readBrTable(&tableLength, &type, nullptr, nullptr))
+    if (!c.iter().readBrTable(&depths, &defaultDepth, &type, nullptr, nullptr))
         return false;
 
     AstRefVector table(c.lifo);
-    if (!table.resize(tableLength))
+    if (!table.resize(depths.length()))
         return false;
 
-    uint32_t depth;
-    for (size_t i = 0, e = tableLength; i < e; ++i) {
-        if (!c.iter().readBrTableEntry(&type, nullptr, &depth))
-            return false;
-        if (!AstDecodeGetBlockRef(c, depth, &table[i]))
+    for (size_t i = 0; i < depths.length(); ++i) {
+        if (!AstDecodeGetBlockRef(c, depths[i], &table[i]))
             return false;
     }
 
-    // Read the default label.
-    if (!c.iter().readBrTableDefault(&type, nullptr, &depth))
-        return false;
-
     AstDecodeStackItem index = c.popCopy();
     AstDecodeStackItem value;
     if (!IsVoid(type))
         value = c.popCopy();
 
     AstRef def;
-    if (!AstDecodeGetBlockRef(c, depth, &def))
+    if (!AstDecodeGetBlockRef(c, defaultDepth, &def))
         return false;
 
-    AstBranchTable* branchTable = new(c.lifo) AstBranchTable(*index.expr,
-                                                             def, Move(table), value.expr);
+    auto branchTable = new(c.lifo) AstBranchTable(*index.expr, def, Move(table), value.expr);
     if (!branchTable)
         return false;
 
@@ -681,7 +643,7 @@ AstDecodeBinary(AstDecodeContext& c, ValType type, Op op)
 static bool
 AstDecodeSelect(AstDecodeContext& c)
 {
-    ValType type;
+    StackType type;
     if (!c.iter().readSelect(&type, nullptr, nullptr, nullptr))
         return false;
 
@@ -746,9 +708,6 @@ AstDecodeLoadStoreAddress(const LinearMemoryAddress<Nothing>& addr, const AstDec
 static bool
 AstDecodeLoad(AstDecodeContext& c, ValType type, uint32_t byteSize, Op op)
 {
-    if (!c.checkHasMemory())
-        return false;
-
     LinearMemoryAddress<Nothing> addr;
     if (!c.iter().readLoad(type, byteSize, &addr))
         return false;
@@ -768,9 +727,6 @@ AstDecodeLoad(AstDecodeContext& c, ValType type, uint32_t byteSize, Op op)
 static bool
 AstDecodeStore(AstDecodeContext& c, ValType type, uint32_t byteSize, Op op)
 {
-    if (!c.checkHasMemory())
-        return false;
-
     LinearMemoryAddress<Nothing> addr;
     if (!c.iter().readStore(type, byteSize, &addr, nullptr))
         return false;
@@ -939,7 +895,7 @@ static bool
 AstDecodeGetGlobal(AstDecodeContext& c)
 {
     uint32_t globalId;
-    if (!c.iter().readGetGlobal(c.env().globals, &globalId))
+    if (!c.iter().readGetGlobal(&globalId))
         return false;
 
     AstRef globalRef;
@@ -960,7 +916,7 @@ static bool
 AstDecodeSetGlobal(AstDecodeContext& c)
 {
     uint32_t globalId;
-    if (!c.iter().readSetGlobal(c.env().globals, &globalId, nullptr))
+    if (!c.iter().readSetGlobal(&globalId, nullptr))
         return false;
 
     AstDecodeStackItem value = c.popCopy();
@@ -1448,7 +1404,7 @@ AstDecodeFunctionBody(AstDecodeContext &c, uint32_t funcIndex, AstFunc** func)
     if (!DecodeLocalEntries(c.d, ModuleKind::Wasm, &locals))
         return false;
 
-    AstDecodeOpIter iter(c.d);
+    AstDecodeOpIter iter(c.env(), c.d);
     c.startFunction(&iter, &locals, sig->ret());
 
     AstName funcName;
diff --git a/js/src/wasm/WasmIonCompile.cpp b/js/src/wasm/WasmIonCompile.cpp
index 72f97475e3ba..3953dbd46e67 100644
--- a/js/src/wasm/WasmIonCompile.cpp
+++ b/js/src/wasm/WasmIonCompile.cpp
@@ -176,7 +176,7 @@ class FunctionCompiler
                      const ValTypeVector& locals,
                      MIRGenerator& mirGen)
       : env_(env),
-        iter_(decoder, func.lineOrBytecode()),
+        iter_(env, decoder, func.lineOrBytecode()),
         func_(func),
         locals_(locals),
         lastReadCallSite_(0),
@@ -1703,7 +1703,6 @@ EmitEnd(FunctionCompiler& f)
             return false;
         break;
       case LabelKind::Then:
-      case LabelKind::UnreachableThen:
         // If we didn't see an Else, create a trivial else block so that we create
         // a diamond anyway, to preserve Ion invariants.
         if (!f.switchToElse(block, &block))
@@ -1770,31 +1769,14 @@ EmitBrIf(FunctionCompiler& f)
 static bool
 EmitBrTable(FunctionCompiler& f)
 {
-    uint32_t tableLength;
-    ExprType type;
-    MDefinition* value;
-    MDefinition* index;
-    if (!f.iter().readBrTable(&tableLength, &type, &value, &index))
-        return false;
-
     Uint32Vector depths;
-    if (!depths.reserve(tableLength))
-        return false;
-
-    for (size_t i = 0; i < tableLength; ++i) {
-        uint32_t depth;
-        if (!f.iter().readBrTableEntry(&type, &value, &depth))
-            return false;
-        depths.infallibleAppend(depth);
-    }
-
-    // Read the default label.
     uint32_t defaultDepth;
-    if (!f.iter().readBrTableDefault(&type, &value, &defaultDepth))
+    ExprType branchValueType;
+    MDefinition* branchValue;
+    MDefinition* index;
+    if (!f.iter().readBrTable(&depths, &defaultDepth, &branchValueType, &branchValue, &index))
         return false;
 
-    MDefinition* maybeValue = IsVoid(type) ? nullptr : value;
-
     // If all the targets are the same, or there are no targets, we can just
     // use a goto. This is not just an optimization: MaybeFoldConditionBlock
     // assumes that tables have more than one successor.
@@ -1807,9 +1789,9 @@ EmitBrTable(FunctionCompiler& f)
     }
 
     if (allSameDepth)
-        return f.br(defaultDepth, maybeValue);
+        return f.br(defaultDepth, branchValue);
 
-    return f.brTable(index, defaultDepth, depths, maybeValue);
+    return f.brTable(index, defaultDepth, depths, branchValue);
 }
 
 static bool
@@ -1819,9 +1801,6 @@ EmitReturn(FunctionCompiler& f)
     if (!f.iter().readReturn(&value))
         return false;
 
-    if (f.inDeadCode())
-        return true;
-
     if (IsVoid(f.sig().ret())) {
         f.returnVoid();
         return true;
@@ -1831,28 +1810,22 @@ EmitReturn(FunctionCompiler& f)
     return true;
 }
 
+typedef IonOpIter::ValueVector DefVector;
+
 static bool
-EmitCallArgs(FunctionCompiler& f, const Sig& sig, TlsUsage tls, CallCompileState* call)
+EmitCallArgs(FunctionCompiler& f, const Sig& sig, const DefVector& args, TlsUsage tls,
+             CallCompileState* call)
 {
     MOZ_ASSERT(NeedsTls(tls));
 
     if (!f.startCall(call))
         return false;
 
-    MDefinition* arg;
-    const ValTypeVector& argTypes = sig.args();
-    uint32_t numArgs = argTypes.length();
-    for (size_t i = 0; i < numArgs; ++i) {
-        ValType argType = argTypes[i];
-        if (!f.iter().readCallArg(argType, numArgs, i, &arg))
-            return false;
-        if (!f.passArg(arg, argType, call))
+    for (size_t i = 0, n = sig.args().length(); i < n; ++i) {
+        if (!f.passArg(args[i], sig.args()[i], call))
             return false;
     }
 
-    if (!f.iter().readCallArgsEnd(numArgs))
-        return false;
-
     return f.finishCall(call, tls);
 }
 
@@ -1862,7 +1835,8 @@ EmitCall(FunctionCompiler& f)
     uint32_t lineOrBytecode = f.readCallSiteLineOrBytecode();
 
     uint32_t funcIndex;
-    if (!f.iter().readCall(&funcIndex))
+    DefVector args;
+    if (!f.iter().readCall(&funcIndex, &args))
         return false;
 
     if (f.inDeadCode())
@@ -1870,12 +1844,10 @@ EmitCall(FunctionCompiler& f)
 
     const Sig& sig = *f.env().funcSigs[funcIndex];
     bool import = f.env().funcIsImport(funcIndex);
+    TlsUsage tls = import ? TlsUsage::CallerSaved : TlsUsage::Need;
 
     CallCompileState call(f, lineOrBytecode);
-    if (!EmitCallArgs(f, sig, import ? TlsUsage::CallerSaved : TlsUsage::Need, &call))
-        return false;
-
-    if (!f.iter().readCallReturn(sig.ret()))
+    if (!EmitCallArgs(f, sig, args, tls, &call))
         return false;
 
     MDefinition* def;
@@ -1902,11 +1874,12 @@ EmitCallIndirect(FunctionCompiler& f, bool oldStyle)
 
     uint32_t sigIndex;
     MDefinition* callee;
+    DefVector args;
     if (oldStyle) {
-        if (!f.iter().readOldCallIndirect(&sigIndex))
+        if (!f.iter().readOldCallIndirect(&sigIndex, &callee, &args))
             return false;
     } else {
-        if (!f.iter().readCallIndirect(&sigIndex, &callee))
+        if (!f.iter().readCallIndirect(&sigIndex, &callee, &args))
             return false;
     }
 
@@ -1920,15 +1893,7 @@ EmitCallIndirect(FunctionCompiler& f, bool oldStyle)
                    : TlsUsage::Need;
 
     CallCompileState call(f, lineOrBytecode);
-    if (!EmitCallArgs(f, sig, tls, &call))
-        return false;
-
-    if (oldStyle) {
-        if (!f.iter().readOldCallIndirectCallee(&callee))
-            return false;
-    }
-
-    if (!f.iter().readCallReturn(sig.ret()))
+    if (!EmitCallArgs(f, sig, args, tls, &call))
         return false;
 
     MDefinition* def;
@@ -1981,7 +1946,7 @@ static bool
 EmitGetGlobal(FunctionCompiler& f)
 {
     uint32_t id;
-    if (!f.iter().readGetGlobal(f.env().globals, &id))
+    if (!f.iter().readGetGlobal(&id))
         return false;
 
     const GlobalDesc& global = f.env().globals[id];
@@ -2033,7 +1998,7 @@ EmitSetGlobal(FunctionCompiler& f)
 {
     uint32_t id;
     MDefinition* value;
-    if (!f.iter().readSetGlobal(f.env().globals, &id, &value))
+    if (!f.iter().readSetGlobal(&id, &value))
         return false;
 
     const GlobalDesc& global = f.env().globals[id];
@@ -2048,7 +2013,7 @@ EmitTeeGlobal(FunctionCompiler& f)
 {
     uint32_t id;
     MDefinition* value;
-    if (!f.iter().readTeeGlobal(f.env().globals, &id, &value))
+    if (!f.iter().readTeeGlobal(&id, &value))
         return false;
 
     const GlobalDesc& global = f.env().globals[id];
@@ -2300,7 +2265,7 @@ EmitComparison(FunctionCompiler& f,
 static bool
 EmitSelect(FunctionCompiler& f)
 {
-    ValType type;
+    StackType type;
     MDefinition* trueValue;
     MDefinition* falseValue;
     MDefinition* condition;
@@ -2807,15 +2772,15 @@ static bool
 EmitSimdChainedCtor(FunctionCompiler& f, ValType valType, MIRType type, const SimdConstant& init)
 {
     const unsigned length = SimdTypeToLength(type);
-    MDefinition* val = f.constant(init, type);
-    for (unsigned i = 0; i < length; i++) {
-        MDefinition* scalar = 0;
-        if (!f.iter().readSimdCtorArg(ValType::I32, length, i, &scalar))
-            return false;
-        val = f.insertElementSimd(val, scalar, i, type);
-    }
-    if (!f.iter().readSimdCtorArgsEnd(length) || !f.iter().readSimdCtorReturn(valType))
+
+    DefVector args;
+    if (!f.iter().readSimdCtor(ValType::I32, length, valType, &args))
         return false;
+
+    MDefinition* val = f.constant(init, type);
+    for (unsigned i = 0; i < length; i++)
+        val = f.insertElementSimd(val, args[i], i, type);
+
     f.iter().setResult(val);
     return true;
 }
@@ -2826,15 +2791,15 @@ EmitSimdBooleanChainedCtor(FunctionCompiler& f, ValType valType, MIRType type,
                            const SimdConstant& init)
 {
     const unsigned length = SimdTypeToLength(type);
-    MDefinition* val = f.constant(init, type);
-    for (unsigned i = 0; i < length; i++) {
-        MDefinition* scalar = 0;
-        if (!f.iter().readSimdCtorArg(ValType::I32, length, i, &scalar))
-            return false;
-        val = f.insertElementSimd(val, EmitSimdBooleanLaneExpr(f, scalar), i, type);
-    }
-    if (!f.iter().readSimdCtorArgsEnd(length) || !f.iter().readSimdCtorReturn(valType))
+
+    DefVector args;
+    if (!f.iter().readSimdCtor(ValType::I32, length, valType, &args))
         return false;
+
+    MDefinition* val = f.constant(init, type);
+    for (unsigned i = 0; i < length; i++)
+        val = f.insertElementSimd(val, EmitSimdBooleanLaneExpr(f, args[i]), i, type);
+
     f.iter().setResult(val);
     return true;
 }
@@ -2842,34 +2807,25 @@ EmitSimdBooleanChainedCtor(FunctionCompiler& f, ValType valType, MIRType type,
 static bool
 EmitSimdCtor(FunctionCompiler& f, ValType type)
 {
-    if (!f.iter().readSimdCtor())
-        return false;
-
     switch (type) {
       case ValType::I8x16:
         return EmitSimdChainedCtor(f, type, MIRType::Int8x16, SimdConstant::SplatX16(0));
       case ValType::I16x8:
         return EmitSimdChainedCtor(f, type, MIRType::Int16x8, SimdConstant::SplatX8(0));
       case ValType::I32x4: {
-        MDefinition* args[4];
-        for (unsigned i = 0; i < 4; i++) {
-            if (!f.iter().readSimdCtorArg(ValType::I32, 4, i, &args[i]))
-                return false;
-        }
-        if (!f.iter().readSimdCtorArgsEnd(4) || !f.iter().readSimdCtorReturn(type))
+        DefVector args;
+        if (!f.iter().readSimdCtor(ValType::I32, 4, type, &args))
             return false;
+
         f.iter().setResult(f.constructSimd<MSimdValueX4>(args[0], args[1], args[2], args[3],
                                                          MIRType::Int32x4));
         return true;
       }
       case ValType::F32x4: {
-        MDefinition* args[4];
-        for (unsigned i = 0; i < 4; i++) {
-            if (!f.iter().readSimdCtorArg(ValType::F32, 4, i, &args[i]))
-                return false;
-        }
-        if (!f.iter().readSimdCtorArgsEnd(4) || !f.iter().readSimdCtorReturn(type))
+        DefVector args;
+        if (!f.iter().readSimdCtor(ValType::F32, 4, type, &args))
             return false;
+
         f.iter().setResult(f.constructSimd<MSimdValueX4>(args[0], args[1], args[2], args[3],
                            MIRType::Float32x4));
         return true;
@@ -2879,15 +2835,14 @@ EmitSimdCtor(FunctionCompiler& f, ValType type)
       case ValType::B16x8:
         return EmitSimdBooleanChainedCtor(f, type, MIRType::Bool16x8, SimdConstant::SplatX8(0));
       case ValType::B32x4: {
-        MDefinition* args[4];
-        for (unsigned i = 0; i < 4; i++) {
-            MDefinition* i32;
-            if (!f.iter().readSimdCtorArg(ValType::I32, 4, i, &i32))
-                return false;
-            args[i] = EmitSimdBooleanLaneExpr(f, i32);
-        }
-        if (!f.iter().readSimdCtorArgsEnd(4) || !f.iter().readSimdCtorReturn(type))
+        DefVector args;
+        if (!f.iter().readSimdCtor(ValType::I32, 4, type, &args))
             return false;
+
+        MOZ_ASSERT(args.length() == 4);
+        for (unsigned i = 0; i < 4; i++)
+            args[i] = EmitSimdBooleanLaneExpr(f, args[i]);
+
         f.iter().setResult(f.constructSimd<MSimdValueX4>(args[0], args[1], args[2], args[3],
                            MIRType::Bool32x4));
         return true;
diff --git a/js/src/wasm/WasmValidate.cpp b/js/src/wasm/WasmValidate.cpp
index e21e0f3e3455..09a19f0a38c8 100644
--- a/js/src/wasm/WasmValidate.cpp
+++ b/js/src/wasm/WasmValidate.cpp
@@ -308,170 +308,74 @@ struct ValidatingPolicy : OpIterPolicy
 
 typedef OpIter<ValidatingPolicy> ValidatingOpIter;
 
-class FunctionDecoder
-{
-    const ModuleEnvironment& env_;
-    const ValTypeVector& locals_;
-    ValidatingOpIter iter_;
-
-  public:
-    FunctionDecoder(const ModuleEnvironment& env, const ValTypeVector& locals, Decoder& d)
-      : env_(env), locals_(locals), iter_(d)
-    {}
-
-    const ModuleEnvironment& env() const { return env_; }
-    ValidatingOpIter& iter() { return iter_; }
-    const ValTypeVector& locals() const { return locals_; }
-
-    bool checkHasMemory() {
-        if (!env().usesMemory())
-            return iter().fail("can't touch memory without memory");
-        return true;
-    }
-};
-
 static bool
-DecodeCallArgs(FunctionDecoder& f, const Sig& sig)
+DecodeFunctionBodyExprs(const ModuleEnvironment& env, const Sig& sig, const ValTypeVector& locals,
+                        Decoder* d)
 {
-    const ValTypeVector& args = sig.args();
-    uint32_t numArgs = args.length();
-    for (size_t i = 0; i < numArgs; ++i) {
-        ValType argType = args[i];
-        if (!f.iter().readCallArg(argType, numArgs, i, nullptr))
-            return false;
-    }
+    ValidatingOpIter iter(env, *d);
 
-    return f.iter().readCallArgsEnd(numArgs);
-}
-
-static bool
-DecodeCallReturn(FunctionDecoder& f, const Sig& sig)
-{
-    return f.iter().readCallReturn(sig.ret());
-}
-
-static bool
-DecodeCall(FunctionDecoder& f)
-{
-    uint32_t funcIndex;
-    if (!f.iter().readCall(&funcIndex))
+    if (!iter.readFunctionStart(sig.ret()))
         return false;
 
-    if (funcIndex >= f.env().numFuncs())
-        return f.iter().fail("callee index out of range");
-
-    if (!f.iter().inReachableCode())
-        return true;
-
-    const Sig* sig = f.env().funcSigs[funcIndex];
-
-    return DecodeCallArgs(f, *sig) &&
-           DecodeCallReturn(f, *sig);
-}
-
-static bool
-DecodeCallIndirect(FunctionDecoder& f)
-{
-    if (!f.env().numTables())
-        return f.iter().fail("can't call_indirect without a table");
-
-    uint32_t sigIndex;
-    if (!f.iter().readCallIndirect(&sigIndex, nullptr))
-        return false;
-
-    if (sigIndex >= f.env().numSigs())
-        return f.iter().fail("signature index out of range");
-
-    if (!f.iter().inReachableCode())
-        return true;
-
-    const Sig& sig = f.env().sigs[sigIndex];
-    if (!DecodeCallArgs(f, sig))
-        return false;
-
-    return DecodeCallReturn(f, sig);
-}
-
-static bool
-DecodeBrTable(FunctionDecoder& f)
-{
-    uint32_t tableLength;
-    ExprType type = ExprType::Limit;
-    if (!f.iter().readBrTable(&tableLength, &type, nullptr, nullptr))
-        return false;
-
-    uint32_t depth;
-    for (size_t i = 0, e = tableLength; i < e; ++i) {
-        if (!f.iter().readBrTableEntry(&type, nullptr, &depth))
-            return false;
-    }
-
-    // Read the default label.
-    return f.iter().readBrTableDefault(&type, nullptr, &depth);
-}
-
-static bool
-DecodeFunctionBodyExprs(FunctionDecoder& f)
-{
 #define CHECK(c) if (!(c)) return false; break
 
     while (true) {
         uint16_t op;
-        if (!f.iter().readOp(&op))
+        if (!iter.readOp(&op))
             return false;
 
         switch (op) {
           case uint16_t(Op::End):
-            if (!f.iter().readEnd(nullptr, nullptr, nullptr))
+            if (!iter.readEnd(nullptr, nullptr, nullptr))
                 return false;
-            f.iter().popEnd();
-            if (f.iter().controlStackEmpty())
-                return true;
+            iter.popEnd();
+            if (iter.controlStackEmpty())
+                return iter.readFunctionEnd();
             break;
           case uint16_t(Op::Nop):
-            CHECK(f.iter().readNop());
+            CHECK(iter.readNop());
           case uint16_t(Op::Drop):
-            CHECK(f.iter().readDrop());
+            CHECK(iter.readDrop());
           case uint16_t(Op::Call):
-            CHECK(DecodeCall(f));
+            CHECK(iter.readCall(nullptr, nullptr));
           case uint16_t(Op::CallIndirect):
-            CHECK(DecodeCallIndirect(f));
+            CHECK(iter.readCallIndirect(nullptr, nullptr, nullptr));
           case uint16_t(Op::I32Const):
-            CHECK(f.iter().readI32Const(nullptr));
+            CHECK(iter.readI32Const(nullptr));
           case uint16_t(Op::I64Const):
-            CHECK(f.iter().readI64Const(nullptr));
+            CHECK(iter.readI64Const(nullptr));
           case uint16_t(Op::F32Const):
-            CHECK(f.iter().readF32Const(nullptr));
+            CHECK(iter.readF32Const(nullptr));
           case uint16_t(Op::F64Const):
-            CHECK(f.iter().readF64Const(nullptr));
+            CHECK(iter.readF64Const(nullptr));
           case uint16_t(Op::GetLocal):
-            CHECK(f.iter().readGetLocal(f.locals(), nullptr));
+            CHECK(iter.readGetLocal(locals, nullptr));
           case uint16_t(Op::SetLocal):
-            CHECK(f.iter().readSetLocal(f.locals(), nullptr, nullptr));
+            CHECK(iter.readSetLocal(locals, nullptr, nullptr));
           case uint16_t(Op::TeeLocal):
-            CHECK(f.iter().readTeeLocal(f.locals(), nullptr, nullptr));
+            CHECK(iter.readTeeLocal(locals, nullptr, nullptr));
           case uint16_t(Op::GetGlobal):
-            CHECK(f.iter().readGetGlobal(f.env().globals, nullptr));
+            CHECK(iter.readGetGlobal(nullptr));
           case uint16_t(Op::SetGlobal):
-            CHECK(f.iter().readSetGlobal(f.env().globals, nullptr, nullptr));
+            CHECK(iter.readSetGlobal(nullptr, nullptr));
           case uint16_t(Op::Select):
-            CHECK(f.iter().readSelect(nullptr, nullptr, nullptr, nullptr));
+            CHECK(iter.readSelect(nullptr, nullptr, nullptr, nullptr));
           case uint16_t(Op::Block):
-            CHECK(f.iter().readBlock());
+            CHECK(iter.readBlock());
           case uint16_t(Op::Loop):
-            CHECK(f.iter().readLoop());
+            CHECK(iter.readLoop());
           case uint16_t(Op::If):
-            CHECK(f.iter().readIf(nullptr));
+            CHECK(iter.readIf(nullptr));
           case uint16_t(Op::Else):
-            CHECK(f.iter().readElse(nullptr, nullptr));
+            CHECK(iter.readElse(nullptr, nullptr));
           case uint16_t(Op::I32Clz):
           case uint16_t(Op::I32Ctz):
           case uint16_t(Op::I32Popcnt):
-            CHECK(f.iter().readUnary(ValType::I32, nullptr));
+            CHECK(iter.readUnary(ValType::I32, nullptr));
           case uint16_t(Op::I64Clz):
           case uint16_t(Op::I64Ctz):
           case uint16_t(Op::I64Popcnt):
-            CHECK(f.iter().readUnary(ValType::I64, nullptr));
+            CHECK(iter.readUnary(ValType::I64, nullptr));
           case uint16_t(Op::F32Abs):
           case uint16_t(Op::F32Neg):
           case uint16_t(Op::F32Ceil):
@@ -479,7 +383,7 @@ DecodeFunctionBodyExprs(FunctionDecoder& f)
           case uint16_t(Op::F32Sqrt):
           case uint16_t(Op::F32Trunc):
           case uint16_t(Op::F32Nearest):
-            CHECK(f.iter().readUnary(ValType::F32, nullptr));
+            CHECK(iter.readUnary(ValType::F32, nullptr));
           case uint16_t(Op::F64Abs):
           case uint16_t(Op::F64Neg):
           case uint16_t(Op::F64Ceil):
@@ -487,7 +391,7 @@ DecodeFunctionBodyExprs(FunctionDecoder& f)
           case uint16_t(Op::F64Sqrt):
           case uint16_t(Op::F64Trunc):
           case uint16_t(Op::F64Nearest):
-            CHECK(f.iter().readUnary(ValType::F64, nullptr));
+            CHECK(iter.readUnary(ValType::F64, nullptr));
           case uint16_t(Op::I32Add):
           case uint16_t(Op::I32Sub):
           case uint16_t(Op::I32Mul):
@@ -503,7 +407,7 @@ DecodeFunctionBodyExprs(FunctionDecoder& f)
           case uint16_t(Op::I32ShrU):
           case uint16_t(Op::I32Rotl):
           case uint16_t(Op::I32Rotr):
-            CHECK(f.iter().readBinary(ValType::I32, nullptr, nullptr));
+            CHECK(iter.readBinary(ValType::I32, nullptr, nullptr));
           case uint16_t(Op::I64Add):
           case uint16_t(Op::I64Sub):
           case uint16_t(Op::I64Mul):
@@ -519,7 +423,7 @@ DecodeFunctionBodyExprs(FunctionDecoder& f)
           case uint16_t(Op::I64ShrU):
           case uint16_t(Op::I64Rotl):
           case uint16_t(Op::I64Rotr):
-            CHECK(f.iter().readBinary(ValType::I64, nullptr, nullptr));
+            CHECK(iter.readBinary(ValType::I64, nullptr, nullptr));
           case uint16_t(Op::F32Add):
           case uint16_t(Op::F32Sub):
           case uint16_t(Op::F32Mul):
@@ -527,7 +431,7 @@ DecodeFunctionBodyExprs(FunctionDecoder& f)
           case uint16_t(Op::F32Min):
           case uint16_t(Op::F32Max):
           case uint16_t(Op::F32CopySign):
-            CHECK(f.iter().readBinary(ValType::F32, nullptr, nullptr));
+            CHECK(iter.readBinary(ValType::F32, nullptr, nullptr));
           case uint16_t(Op::F64Add):
           case uint16_t(Op::F64Sub):
           case uint16_t(Op::F64Mul):
@@ -535,7 +439,7 @@ DecodeFunctionBodyExprs(FunctionDecoder& f)
           case uint16_t(Op::F64Min):
           case uint16_t(Op::F64Max):
           case uint16_t(Op::F64CopySign):
-            CHECK(f.iter().readBinary(ValType::F64, nullptr, nullptr));
+            CHECK(iter.readBinary(ValType::F64, nullptr, nullptr));
           case uint16_t(Op::I32Eq):
           case uint16_t(Op::I32Ne):
           case uint16_t(Op::I32LtS):
@@ -546,7 +450,7 @@ DecodeFunctionBodyExprs(FunctionDecoder& f)
           case uint16_t(Op::I32GtU):
           case uint16_t(Op::I32GeS):
           case uint16_t(Op::I32GeU):
-            CHECK(f.iter().readComparison(ValType::I32, nullptr, nullptr));
+            CHECK(iter.readComparison(ValType::I32, nullptr, nullptr));
           case uint16_t(Op::I64Eq):
           case uint16_t(Op::I64Ne):
           case uint16_t(Op::I64LtS):
@@ -557,118 +461,118 @@ DecodeFunctionBodyExprs(FunctionDecoder& f)
           case uint16_t(Op::I64GtU):
           case uint16_t(Op::I64GeS):
           case uint16_t(Op::I64GeU):
-            CHECK(f.iter().readComparison(ValType::I64, nullptr, nullptr));
+            CHECK(iter.readComparison(ValType::I64, nullptr, nullptr));
           case uint16_t(Op::F32Eq):
           case uint16_t(Op::F32Ne):
           case uint16_t(Op::F32Lt):
           case uint16_t(Op::F32Le):
           case uint16_t(Op::F32Gt):
           case uint16_t(Op::F32Ge):
-            CHECK(f.iter().readComparison(ValType::F32, nullptr, nullptr));
+            CHECK(iter.readComparison(ValType::F32, nullptr, nullptr));
           case uint16_t(Op::F64Eq):
           case uint16_t(Op::F64Ne):
           case uint16_t(Op::F64Lt):
           case uint16_t(Op::F64Le):
           case uint16_t(Op::F64Gt):
           case uint16_t(Op::F64Ge):
-            CHECK(f.iter().readComparison(ValType::F64, nullptr, nullptr));
+            CHECK(iter.readComparison(ValType::F64, nullptr, nullptr));
           case uint16_t(Op::I32Eqz):
-            CHECK(f.iter().readConversion(ValType::I32, ValType::I32, nullptr));
+            CHECK(iter.readConversion(ValType::I32, ValType::I32, nullptr));
           case uint16_t(Op::I64Eqz):
           case uint16_t(Op::I32WrapI64):
-            CHECK(f.iter().readConversion(ValType::I64, ValType::I32, nullptr));
+            CHECK(iter.readConversion(ValType::I64, ValType::I32, nullptr));
           case uint16_t(Op::I32TruncSF32):
           case uint16_t(Op::I32TruncUF32):
           case uint16_t(Op::I32ReinterpretF32):
-            CHECK(f.iter().readConversion(ValType::F32, ValType::I32, nullptr));
+            CHECK(iter.readConversion(ValType::F32, ValType::I32, nullptr));
           case uint16_t(Op::I32TruncSF64):
           case uint16_t(Op::I32TruncUF64):
-            CHECK(f.iter().readConversion(ValType::F64, ValType::I32, nullptr));
+            CHECK(iter.readConversion(ValType::F64, ValType::I32, nullptr));
           case uint16_t(Op::I64ExtendSI32):
           case uint16_t(Op::I64ExtendUI32):
-            CHECK(f.iter().readConversion(ValType::I32, ValType::I64, nullptr));
+            CHECK(iter.readConversion(ValType::I32, ValType::I64, nullptr));
           case uint16_t(Op::I64TruncSF32):
           case uint16_t(Op::I64TruncUF32):
-            CHECK(f.iter().readConversion(ValType::F32, ValType::I64, nullptr));
+            CHECK(iter.readConversion(ValType::F32, ValType::I64, nullptr));
           case uint16_t(Op::I64TruncSF64):
           case uint16_t(Op::I64TruncUF64):
           case uint16_t(Op::I64ReinterpretF64):
-            CHECK(f.iter().readConversion(ValType::F64, ValType::I64, nullptr));
+            CHECK(iter.readConversion(ValType::F64, ValType::I64, nullptr));
           case uint16_t(Op::F32ConvertSI32):
           case uint16_t(Op::F32ConvertUI32):
           case uint16_t(Op::F32ReinterpretI32):
-            CHECK(f.iter().readConversion(ValType::I32, ValType::F32, nullptr));
+            CHECK(iter.readConversion(ValType::I32, ValType::F32, nullptr));
           case uint16_t(Op::F32ConvertSI64):
           case uint16_t(Op::F32ConvertUI64):
-            CHECK(f.iter().readConversion(ValType::I64, ValType::F32, nullptr));
+            CHECK(iter.readConversion(ValType::I64, ValType::F32, nullptr));
           case uint16_t(Op::F32DemoteF64):
-            CHECK(f.iter().readConversion(ValType::F64, ValType::F32, nullptr));
+            CHECK(iter.readConversion(ValType::F64, ValType::F32, nullptr));
           case uint16_t(Op::F64ConvertSI32):
           case uint16_t(Op::F64ConvertUI32):
-            CHECK(f.iter().readConversion(ValType::I32, ValType::F64, nullptr));
+            CHECK(iter.readConversion(ValType::I32, ValType::F64, nullptr));
           case uint16_t(Op::F64ConvertSI64):
           case uint16_t(Op::F64ConvertUI64):
           case uint16_t(Op::F64ReinterpretI64):
-            CHECK(f.iter().readConversion(ValType::I64, ValType::F64, nullptr));
+            CHECK(iter.readConversion(ValType::I64, ValType::F64, nullptr));
           case uint16_t(Op::F64PromoteF32):
-            CHECK(f.iter().readConversion(ValType::F32, ValType::F64, nullptr));
+            CHECK(iter.readConversion(ValType::F32, ValType::F64, nullptr));
           case uint16_t(Op::I32Load8S):
           case uint16_t(Op::I32Load8U):
-            CHECK(f.checkHasMemory() && f.iter().readLoad(ValType::I32, 1, nullptr));
+            CHECK(iter.readLoad(ValType::I32, 1, nullptr));
           case uint16_t(Op::I32Load16S):
           case uint16_t(Op::I32Load16U):
-            CHECK(f.checkHasMemory() && f.iter().readLoad(ValType::I32, 2, nullptr));
+            CHECK(iter.readLoad(ValType::I32, 2, nullptr));
           case uint16_t(Op::I32Load):
-            CHECK(f.checkHasMemory() && f.iter().readLoad(ValType::I32, 4, nullptr));
+            CHECK(iter.readLoad(ValType::I32, 4, nullptr));
           case uint16_t(Op::I64Load8S):
           case uint16_t(Op::I64Load8U):
-            CHECK(f.checkHasMemory() && f.iter().readLoad(ValType::I64, 1, nullptr));
+            CHECK(iter.readLoad(ValType::I64, 1, nullptr));
           case uint16_t(Op::I64Load16S):
           case uint16_t(Op::I64Load16U):
-            CHECK(f.checkHasMemory() && f.iter().readLoad(ValType::I64, 2, nullptr));
+            CHECK(iter.readLoad(ValType::I64, 2, nullptr));
           case uint16_t(Op::I64Load32S):
           case uint16_t(Op::I64Load32U):
-            CHECK(f.checkHasMemory() && f.iter().readLoad(ValType::I64, 4, nullptr));
+            CHECK(iter.readLoad(ValType::I64, 4, nullptr));
           case uint16_t(Op::I64Load):
-            CHECK(f.checkHasMemory() && f.iter().readLoad(ValType::I64, 8, nullptr));
+            CHECK(iter.readLoad(ValType::I64, 8, nullptr));
           case uint16_t(Op::F32Load):
-            CHECK(f.checkHasMemory() && f.iter().readLoad(ValType::F32, 4, nullptr));
+            CHECK(iter.readLoad(ValType::F32, 4, nullptr));
           case uint16_t(Op::F64Load):
-            CHECK(f.checkHasMemory() && f.iter().readLoad(ValType::F64, 8, nullptr));
+            CHECK(iter.readLoad(ValType::F64, 8, nullptr));
           case uint16_t(Op::I32Store8):
-            CHECK(f.checkHasMemory() && f.iter().readStore(ValType::I32, 1, nullptr, nullptr));
+            CHECK(iter.readStore(ValType::I32, 1, nullptr, nullptr));
           case uint16_t(Op::I32Store16):
-            CHECK(f.checkHasMemory() && f.iter().readStore(ValType::I32, 2, nullptr, nullptr));
+            CHECK(iter.readStore(ValType::I32, 2, nullptr, nullptr));
           case uint16_t(Op::I32Store):
-            CHECK(f.checkHasMemory() && f.iter().readStore(ValType::I32, 4, nullptr, nullptr));
+            CHECK(iter.readStore(ValType::I32, 4, nullptr, nullptr));
           case uint16_t(Op::I64Store8):
-            CHECK(f.checkHasMemory() && f.iter().readStore(ValType::I64, 1, nullptr, nullptr));
+            CHECK(iter.readStore(ValType::I64, 1, nullptr, nullptr));
           case uint16_t(Op::I64Store16):
-            CHECK(f.checkHasMemory() && f.iter().readStore(ValType::I64, 2, nullptr, nullptr));
+            CHECK(iter.readStore(ValType::I64, 2, nullptr, nullptr));
           case uint16_t(Op::I64Store32):
-            CHECK(f.checkHasMemory() && f.iter().readStore(ValType::I64, 4, nullptr, nullptr));
+            CHECK(iter.readStore(ValType::I64, 4, nullptr, nullptr));
           case uint16_t(Op::I64Store):
-            CHECK(f.checkHasMemory() && f.iter().readStore(ValType::I64, 8, nullptr, nullptr));
+            CHECK(iter.readStore(ValType::I64, 8, nullptr, nullptr));
           case uint16_t(Op::F32Store):
-            CHECK(f.checkHasMemory() && f.iter().readStore(ValType::F32, 4, nullptr, nullptr));
+            CHECK(iter.readStore(ValType::F32, 4, nullptr, nullptr));
           case uint16_t(Op::F64Store):
-            CHECK(f.checkHasMemory() && f.iter().readStore(ValType::F64, 8, nullptr, nullptr));
+            CHECK(iter.readStore(ValType::F64, 8, nullptr, nullptr));
           case uint16_t(Op::GrowMemory):
-            CHECK(f.checkHasMemory() && f.iter().readGrowMemory(nullptr));
+            CHECK(iter.readGrowMemory(nullptr));
           case uint16_t(Op::CurrentMemory):
-            CHECK(f.checkHasMemory() && f.iter().readCurrentMemory());
+            CHECK(iter.readCurrentMemory());
           case uint16_t(Op::Br):
-            CHECK(f.iter().readBr(nullptr, nullptr, nullptr));
+            CHECK(iter.readBr(nullptr, nullptr, nullptr));
           case uint16_t(Op::BrIf):
-            CHECK(f.iter().readBrIf(nullptr, nullptr, nullptr, nullptr));
+            CHECK(iter.readBrIf(nullptr, nullptr, nullptr, nullptr));
           case uint16_t(Op::BrTable):
-            CHECK(DecodeBrTable(f));
+            CHECK(iter.readBrTable(nullptr, nullptr, nullptr, nullptr, nullptr));
           case uint16_t(Op::Return):
-            CHECK(f.iter().readReturn(nullptr));
+            CHECK(iter.readReturn(nullptr));
           case uint16_t(Op::Unreachable):
-            CHECK(f.iter().readUnreachable());
+            CHECK(iter.readUnreachable());
           default:
-            return f.iter().unrecognizedOpcode(op);
+            return iter.unrecognizedOpcode(op);
         }
     }
 
@@ -681,8 +585,9 @@ bool
 wasm::ValidateFunctionBody(const ModuleEnvironment& env, uint32_t funcIndex, uint32_t bodySize,
                            Decoder& d)
 {
-    ValTypeVector locals;
     const Sig& sig = *env.funcSigs[funcIndex];
+
+    ValTypeVector locals;
     if (!locals.appendAll(sig.args()))
         return false;
 
@@ -691,15 +596,7 @@ wasm::ValidateFunctionBody(const ModuleEnvironment& env, uint32_t funcIndex, uin
     if (!DecodeLocalEntries(d, ModuleKind::Wasm, &locals))
         return false;
 
-    FunctionDecoder f(env, locals, d);
-
-    if (!f.iter().readFunctionStart(sig.ret()))
-        return false;
-
-    if (!DecodeFunctionBodyExprs(f))
-        return false;
-
-    if (!f.iter().readFunctionEnd())
+    if (!DecodeFunctionBodyExprs(env, sig, locals, &d))
         return false;
 
     if (d.currentPosition() != bodyBegin + bodySize)
diff --git a/js/xpconnect/idl/nsIXPConnect.idl b/js/xpconnect/idl/nsIXPConnect.idl
index 369340105407..dc1d35138901 100644
--- a/js/xpconnect/idl/nsIXPConnect.idl
+++ b/js/xpconnect/idl/nsIXPConnect.idl
@@ -492,8 +492,6 @@ interface nsIXPConnect : nsISupports
      *           the script. The actual evaluation will happen on a new
      *           temporary context.
      * @param sandbox The sandbox object to evaluate the script in.
-     * @param version The JavaScript version to use for evaluating the script.
-     *                Should be a valid JSVersion from jspubtd.h.
      * @return The result of the evaluation as a jsval. If the caller
      *         intends to use the return value from this call the caller
      *         is responsible for rooting the jsval before making a call
@@ -501,8 +499,7 @@ interface nsIXPConnect : nsISupports
      */
     [noscript] jsval evalInSandboxObject(in AString source, in string filename,
                                          in JSContextPtr cx,
-                                         in JSObjectPtr sandbox,
-                                         in int32_t version);
+                                         in JSObjectPtr sandbox);
 
     /**
      * Trigger a JS garbage collection.
diff --git a/js/xpconnect/loader/mozJSComponentLoader.cpp b/js/xpconnect/loader/mozJSComponentLoader.cpp
index 2ec4cc02f250..ea2de906b662 100644
--- a/js/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/xpconnect/loader/mozJSComponentLoader.cpp
@@ -378,7 +378,7 @@ mozJSComponentLoader::LoadModule(FileLocation& aFile)
 
     ModuleEntry* mod;
     if (mModules.Get(spec, &mod))
-    return mod;
+        return mod;
 
     dom::AutoJSAPI jsapi;
     jsapi.Init();
diff --git a/js/xpconnect/src/nsXPConnect.cpp b/js/xpconnect/src/nsXPConnect.cpp
index b80aa2f6b086..2ba0ddaf9fb7 100644
--- a/js/xpconnect/src/nsXPConnect.cpp
+++ b/js/xpconnect/src/nsXPConnect.cpp
@@ -874,15 +874,8 @@ nsXPConnect::CreateSandbox(JSContext* cx, nsIPrincipal* principal,
 NS_IMETHODIMP
 nsXPConnect::EvalInSandboxObject(const nsAString& source, const char* filename,
                                  JSContext* cx, JSObject* sandboxArg,
-                                 int32_t jsVersion,
                                  MutableHandleValue rval)
 {
-#ifdef DEBUG
-    {
-        const char *version = JS_VersionToString(JSVersion(jsVersion));
-        MOZ_ASSERT(version && strcmp(version, "unknown") != 0, "Illegal JS version passed");
-    }
-#endif
     if (!sandboxArg)
         return NS_ERROR_INVALID_ARG;
 
@@ -894,7 +887,7 @@ nsXPConnect::EvalInSandboxObject(const nsAString& source, const char* filename,
         filenameStr = NS_LITERAL_CSTRING("x-bogus://XPConnect/Sandbox");
     }
     return EvalInSandbox(cx, sandbox, source, filenameStr, 1,
-                         JSVersion(jsVersion), rval);
+                         JSVERSION_DEFAULT, rval);
 }
 
 NS_IMETHODIMP
diff --git a/layout/base/PresShell.cpp b/layout/base/PresShell.cpp
index a3e961c8764c..f53df549bd4a 100644
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -1927,7 +1927,6 @@ PresShell::ResizeReflowIgnoreOverride(nscoord aWidth, nscoord aHeight, nscoord a
                                : aOldHeight != aHeight;
 
   RefPtr<nsViewManager> viewManager = mViewManager;
-  // Take this ref after viewManager so it'll make sure to go away first.
   nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
 
   if (!GetPresContext()->SuppressingResizeReflow()) {
@@ -4030,7 +4029,7 @@ PresShell::IsSafeToFlush() const
 
 
 void
-PresShell::FlushPendingNotifications(FlushType aType)
+PresShell::DoFlushPendingNotifications(FlushType aType)
 {
   // by default, flush animations if aType >= FlushType::Style
   mozilla::ChangesToFlush flush(aType, aType >= FlushType::Style);
@@ -4038,8 +4037,11 @@ PresShell::FlushPendingNotifications(FlushType aType)
 }
 
 void
-PresShell::FlushPendingNotifications(mozilla::ChangesToFlush aFlush)
+PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush aFlush)
 {
+  // Per our API contract, hold a strong ref to ourselves until we return.
+  nsCOMPtr<nsIPresShell> kungFuDeathGrip = this;
+
   /**
    * VERY IMPORTANT: If you add some sort of new flushing to this
    * method, make sure to add the relevant SetNeedLayoutFlush or
@@ -4047,6 +4049,8 @@ PresShell::FlushPendingNotifications(mozilla::ChangesToFlush aFlush)
    */
   FlushType flushType = aFlush.mFlushType;
 
+  MOZ_ASSERT(NeedFlush(flushType), "Why did we get called?");
+
 #ifdef MOZ_GECKO_PROFILER
   static const EnumeratedArray<FlushType,
                                FlushType::Count,
@@ -4098,7 +4102,6 @@ PresShell::FlushPendingNotifications(mozilla::ChangesToFlush aFlush)
   RefPtr<nsViewManager> viewManager = mViewManager;
   bool didStyleFlush = false;
   bool didLayoutFlush = false;
-  nsCOMPtr<nsIPresShell> kungFuDeathGrip;
   if (isSafeToFlush && viewManager) {
     // Record that we are in a flush, so that our optimization in
     // nsDocument::FlushPendingNotifications doesn't skip any re-entrant
@@ -4108,10 +4111,6 @@ PresShell::FlushPendingNotifications(mozilla::ChangesToFlush aFlush)
     AutoRestore<bool> guard(mInFlush);
     mInFlush = true;
 
-    // Processing pending notifications can kill us, and some callers only
-    // hold weak refs when calling FlushPendingNotifications().  :(
-    kungFuDeathGrip = this;
-
     if (mResizeEvent.IsPending()) {
       FireResizeEvent();
       if (mIsDestroying) {
diff --git a/layout/base/PresShell.h b/layout/base/PresShell.h
index 2b22d18caa62..ef508fb54567 100644
--- a/layout/base/PresShell.h
+++ b/layout/base/PresShell.h
@@ -126,8 +126,8 @@ public:
   virtual void FrameNeedsToContinueReflow(nsIFrame *aFrame) override;
   virtual void CancelAllPendingReflows() override;
   virtual bool IsSafeToFlush() const override;
-  virtual void FlushPendingNotifications(mozilla::FlushType aType) override;
-  virtual void FlushPendingNotifications(mozilla::ChangesToFlush aType) override;
+  virtual void DoFlushPendingNotifications(mozilla::FlushType aType) override;
+  virtual void DoFlushPendingNotifications(mozilla::ChangesToFlush aType) override;
   virtual void DestroyFramesFor(nsIContent*  aContent,
                                 nsIContent** aDestroyedFramesFor) override;
   virtual void CreateFramesFor(nsIContent* aContent) override;
diff --git a/layout/base/nsIPresShell.h b/layout/base/nsIPresShell.h
index 6f15d9b7db28..ba0e0b89a628 100644
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -580,11 +580,41 @@ public:
    * than the document itself) should probably be calling
    * nsIDocument::FlushPendingNotifications.
    *
+   * This method can execute script, which can destroy this presshell object
+   * unless someone is holding a reference to it on the stack.  The presshell
+   * itself will ensure it lives up until the method returns, but callers who
+   * plan to use the presshell after this call should hold a strong ref
+   * themselves!
+   *
    * @param aType the type of notifications to flush
    */
-  virtual void FlushPendingNotifications(mozilla::FlushType aType) = 0;
-  virtual void FlushPendingNotifications(mozilla::ChangesToFlush aType) = 0;
+public:
+  void FlushPendingNotifications(mozilla::FlushType aType)
+  {
+    if (!NeedFlush(aType)) {
+      return;
+    }
 
+    DoFlushPendingNotifications(aType);
+  }
+
+  void FlushPendingNotifications(mozilla::ChangesToFlush aType)
+  {
+    if (!NeedFlush(aType.mFlushType)) {
+      return;
+    }
+
+    DoFlushPendingNotifications(aType);
+  }
+
+protected:
+  /**
+   * Implementation methods for FlushPendingNotifications.
+   */
+  virtual void DoFlushPendingNotifications(mozilla::FlushType aType) = 0;
+  virtual void DoFlushPendingNotifications(mozilla::ChangesToFlush aType) = 0;
+
+public:
   /**
    * Whether we might need a flush for the given flush type.  If this
    * function returns false, we definitely don't need to flush.
diff --git a/layout/base/nsRefreshDriver.cpp b/layout/base/nsRefreshDriver.cpp
index 4ffb656c7f71..45c683a06915 100644
--- a/layout/base/nsRefreshDriver.cpp
+++ b/layout/base/nsRefreshDriver.cpp
@@ -610,7 +610,9 @@ private:
       } else {
         // Request the vsync rate from the parent process. Might be a few vsyncs
         // until the parent responds.
-        mVsyncRate = mVsyncRefreshDriverTimer->mVsyncChild->GetVsyncRate();
+        if (mVsyncRefreshDriverTimer) {
+          mVsyncRate = mVsyncRefreshDriverTimer->mVsyncChild->GetVsyncRate();
+        }
       }
     #endif
     }
diff --git a/layout/reftests/bugs/1114526-1.html b/layout/reftests/bugs/1114526-1.html
index b6428fa2a91e..00ea1b87e9f6 100644
--- a/layout/reftests/bugs/1114526-1.html
+++ b/layout/reftests/bugs/1114526-1.html
@@ -5,12 +5,14 @@
 var startPaintCount = 0;
 function doTest() {
   startPaintCount = window.mozPaintCount;
+  document.querySelector('#src').style.visibility='visible';
+  document.querySelector('#dest').style.visibility='visible';
   setTimeout(check, 200);
 }
 var calls = 0;
 function check() {
   calls++;
-  if ((window.mozPaintCount - startPaintCount) > 2) {
+  if ((window.mozPaintCount - startPaintCount) > 3) {
     finishSuccess();
     return;
   }
@@ -46,11 +48,13 @@ div {
 #src {
   background-image: url('1114526-1.gif');
   top: -500px;
+  visibility: hidden;
 }
 
 #dest {
   background-image: -moz-element(#src);
   top: 100px;
+  visibility: hidden;
 }
 </style>
 </head>
diff --git a/layout/reftests/svg/reftest-stylo.list b/layout/reftests/svg/reftest-stylo.list
index 15aa8952a529..84cc4dfe4860 100644
--- a/layout/reftests/svg/reftest-stylo.list
+++ b/layout/reftests/svg/reftest-stylo.list
@@ -43,6 +43,7 @@ fuzzy-if(/^Windows\x20NT\x2010\.0/.test(http.oscpu)||/^Windows\x20NT\x206\.[12]/
 == clipPath-basic-07.svg clipPath-basic-07.svg
 == clipPath-winding-01.svg clipPath-winding-01.svg
 == clip-surface-clone-01.svg clip-surface-clone-01.svg
+fails == comments-in-pres-attrs.svg pass.svg
 == conditions-01.svg conditions-01.svg
 == conditions-02.svg conditions-02.svg
 == conditions-03.svg conditions-03.svg
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index 2658c66d2a2a..06a6f306da1c 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -2616,6 +2616,9 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
       const void* parentStruct = parentContext->StyleData(aSID);
       aContext->AddStyleBit(bit); // makes const_cast OK.
       aContext->SetStyle(aSID, const_cast<void*>(parentStruct));
+      if (isReset) {
+        parentContext->AddStyleBit(NS_STYLE_HAS_CHILD_THAT_USES_RESET_STYLE);
+      }
       return parentStruct;
     }
     else
diff --git a/layout/xul/nsMenuFrame.cpp b/layout/xul/nsMenuFrame.cpp
index 4a1743dd0293..05ce4b917e43 100644
--- a/layout/xul/nsMenuFrame.cpp
+++ b/layout/xul/nsMenuFrame.cpp
@@ -174,6 +174,7 @@ nsMenuFrame::nsMenuFrame(nsStyleContext* aContext):
     mIsMenu(false),
     mChecked(false),
     mIgnoreAccelTextChange(false),
+    mReflowCallbackPosted(false),
     mType(eMenuType_Normal),
     mBlinkState(0)
 {
@@ -196,33 +197,20 @@ nsMenuFrame::GetMenuParent() const
   return nullptr;
 }
 
-class nsASyncMenuInitialization final : public nsIReflowCallback
+bool
+nsMenuFrame::ReflowFinished()
 {
-public:
-  explicit nsASyncMenuInitialization(nsIFrame* aFrame)
-    : mWeakFrame(aFrame)
-  {
-  }
+  mReflowCallbackPosted = false;
 
-  virtual bool ReflowFinished() override
-  {
-    bool shouldFlush = false;
-    nsMenuFrame* menu = do_QueryFrame(mWeakFrame.GetFrame());
-    if (menu) {
-      menu->UpdateMenuType();
-      shouldFlush = true;
-    }
-    delete this;
-    return shouldFlush;
-  }
+  UpdateMenuType();
+  return true;
+}
 
-  virtual void ReflowCallbackCanceled() override
-  {
-    delete this;
-  }
-
-  nsWeakFrame mWeakFrame;
-};
+void
+nsMenuFrame::ReflowCallbackCanceled()
+{
+  mReflowCallbackPosted = false;
+}
 
 void
 nsMenuFrame::Init(nsIContent*       aContent,
@@ -235,8 +223,10 @@ nsMenuFrame::Init(nsIContent*       aContent,
   mTimerMediator = new nsMenuTimerMediator(this);
 
   BuildAcceleratorText(false);
-  nsIReflowCallback* cb = new nsASyncMenuInitialization(this);
-  PresContext()->PresShell()->PostReflowCallback(cb);
+  if (!mReflowCallbackPosted) {
+    mReflowCallbackPosted = true;
+    PresContext()->PresShell()->PostReflowCallback(this);
+  }
 }
 
 const nsFrameList&
@@ -321,6 +311,11 @@ nsMenuFrame::SetInitialChildList(ChildListID     aListID,
 void
 nsMenuFrame::DestroyFrom(nsIFrame* aDestructRoot)
 {
+  if (mReflowCallbackPosted) {
+    PresContext()->PresShell()->CancelReflowCallback(this);
+    mReflowCallbackPosted = false;
+  }
+
   // Kill our timer if one is active. This is not strictly necessary as
   // the pointer to this frame will be cleared from the mediator, but
   // this is done for added safety.
diff --git a/layout/xul/nsMenuFrame.h b/layout/xul/nsMenuFrame.h
index 1941ec69e6cb..93d1b5981af2 100644
--- a/layout/xul/nsMenuFrame.h
+++ b/layout/xul/nsMenuFrame.h
@@ -18,6 +18,7 @@
 #include "nsGkAtoms.h"
 #include "nsMenuParent.h"
 #include "nsXULPopupManager.h"
+#include "nsIReflowCallback.h"
 #include "nsITimer.h"
 #include "mozilla/Attributes.h"
 
@@ -72,6 +73,7 @@ private:
 };
 
 class nsMenuFrame final : public nsBoxFrame
+                        , public nsIReflowCallback
 {
 public:
   explicit nsMenuFrame(nsStyleContext* aContext);
@@ -211,6 +213,10 @@ public:
 
   static bool IsSizedToPopup(nsIContent* aContent, bool aRequireAlways);
 
+  // nsIReflowCallback
+  virtual bool ReflowFinished() override;
+  virtual void ReflowCallbackCanceled() override;
+
 protected:
   friend class nsMenuTimerMediator;
   friend class nsASyncMenuInitialization;
@@ -270,6 +276,7 @@ protected:
   bool mIsMenu; // Whether or not we can even have children or not.
   bool mChecked;              // are we checked?
   bool mIgnoreAccelTextChange; // temporarily set while determining the accelerator key
+  bool mReflowCallbackPosted;
   nsMenuType mType;
 
   // Reference to the mediator which wraps this frame.
diff --git a/media/webrtc/moz.build b/media/webrtc/moz.build
index a6ce0f86090d..695fbecadc21 100644
--- a/media/webrtc/moz.build
+++ b/media/webrtc/moz.build
@@ -103,7 +103,6 @@ if CONFIG['MOZ_WEBRTC_SIGNALING']:
             CXXFLAGS += ['-validate-charset-']
 
     TEST_DIRS += ['signaling/gtest']
-
 if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gonk':
     GYP_DIRS += ['trunk/testing']
     GYP_DIRS['trunk/testing'].input = 'trunk/testing/gtest.gyp'
@@ -112,17 +111,5 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gonk':
     GYP_DIRS['trunk/testing'].sandbox_vars['ALLOW_COMPILER_WARNINGS'] = True
     GYP_DIRS['trunk/testing'].non_unified_sources += webrtc_non_unified_sources
 
-    if CONFIG['MOZ_WEBRTC_SIGNALING']:
-        GYP_DIRS += ['signalingtest']
-        GYP_DIRS['signalingtest'].input = 'signaling/signaling.gyp'
-        GYP_DIRS['signalingtest'].variables = gyp_vars.copy()
-        GYP_DIRS['signalingtest'].variables.update(
-            build_for_test=1,
-            moz_webrtc_mediacodec=0,
-            build_for_standalone=0
-        )
-
-        GYP_DIRS['signalingtest'].non_unified_sources += signaling_non_unified_sources
-
 if CONFIG['ENABLE_TESTS']:
     DIRS += ['signaling/fuzztest']
diff --git a/media/webrtc/signaling/gtest/moz.build b/media/webrtc/signaling/gtest/moz.build
index 155664924ced..ec54d3ef588e 100644
--- a/media/webrtc/signaling/gtest/moz.build
+++ b/media/webrtc/signaling/gtest/moz.build
@@ -6,8 +6,6 @@
 
 # TODO: bug 1172551 - get these tests working on iOS
 if CONFIG['OS_TARGET'] != 'WINNT' and CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gonk' and CONFIG['MOZ_WIDGET_TOOLKIT'] != 'uikit':
-    DEFINES['MOZILLA_EXTERNAL_LINKAGE'] = True
-
     LOCAL_INCLUDES += [
       '/ipc/chromium/src',
       '/media/mtransport',
diff --git a/media/webrtc/signaling/gtest/sdp_unittests.cpp b/media/webrtc/signaling/gtest/sdp_unittests.cpp
index 0e3a60347747..de5cb4d3dc26 100644
--- a/media/webrtc/signaling/gtest/sdp_unittests.cpp
+++ b/media/webrtc/signaling/gtest/sdp_unittests.cpp
@@ -17,8 +17,6 @@
 #include "ssl.h"
 
 #include "nsThreadUtils.h"
-#include "PeerConnectionImpl.h"
-#include "PeerConnectionCtx.h"
 
 #include "signaling/src/sdp/SipccSdpParser.h"
 #include "signaling/src/sdp/SdpMediaSection.h"
@@ -58,7 +56,6 @@ class SdpTest : public ::testing::Test {
     }
 
     static void TearDownTestCase() {
-      PeerConnectionCtx::Destroy();
     }
 
     void ResetSdp() {
diff --git a/media/webrtc/signaling/src/common/browser_logging/WebRtcLog.cpp b/media/webrtc/signaling/src/common/browser_logging/WebRtcLog.cpp
index 833cdc29ae9f..8ec8341e2de0 100644
--- a/media/webrtc/signaling/src/common/browser_logging/WebRtcLog.cpp
+++ b/media/webrtc/signaling/src/common/browser_logging/WebRtcLog.cpp
@@ -187,12 +187,10 @@ void ConfigWebRtcLog(mozilla::LogLevel level, uint32_t trace_mask,
   }
 #endif
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (XRE_IsParentProcess()) {
     // Capture the final choice for the trace setting.
     mozilla::Preferences::SetCString("media.webrtc.debug.log_file", aLogFile);
   }
-#endif
   return;
 }
 
@@ -281,12 +279,10 @@ void ConfigAecLog(nsCString &aAECLogDir) {
   }
 #endif
   webrtc::Trace::set_aec_debug_filename(aAECLogDir.get());
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (XRE_IsParentProcess()) {
     // Capture the final choice for the aec_log_dir setting.
     mozilla::Preferences::SetCString("media.webrtc.debug.aec_log_dir", aAECLogDir);
   }
-#endif
 }
 
 void StartAecLog()
diff --git a/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp b/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp
index 2e2590121b37..1ece4c8170f0 100644
--- a/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp
+++ b/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp
@@ -18,10 +18,8 @@
 #include "nsIPrefService.h"
 #include "nsIPrefBranch.h"
 #include "nsThreadUtils.h"
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "Latency.h"
 #include "mozilla/Telemetry.h"
-#endif
 
 #include "webrtc/common.h"
 #include "webrtc/modules/audio_processing/include/audio_processing.h"
@@ -458,7 +456,6 @@ WebrtcAudioConduit::ConfigureSendMediaCodec(const AudioCodecConfig* codecConfig)
     }
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // TEMPORARY - see bug 694814 comment 2
   nsresult rv;
   nsCOMPtr<nsIPrefService> prefs = do_GetService("@mozilla.org/preferences-service;1", &rv);
@@ -469,7 +466,6 @@ WebrtcAudioConduit::ConfigureSendMediaCodec(const AudioCodecConfig* codecConfig)
       branch->GetIntPref("media.peerconnection.capture_delay", &mCaptureDelay);
     }
   }
-#endif
 
   condError = StartTransmitting();
   if (condError != kMediaConduitNoError) {
@@ -618,12 +614,10 @@ WebrtcAudioConduit::SendAudioFrame(const int16_t audio_data[],
     return kMediaConduitSessionNotInited;
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
-    if (MOZ_LOG_TEST(GetLatencyLog(), LogLevel::Debug)) {
-      struct Processing insert = { TimeStamp::Now(), 0 };
-      mProcessing.AppendElement(insert);
-    }
-#endif
+  if (MOZ_LOG_TEST(GetLatencyLog(), LogLevel::Debug)) {
+    struct Processing insert = { TimeStamp::Now(), 0 };
+    mProcessing.AppendElement(insert);
+  }
 
   capture_delay = mCaptureDelay;
   //Insert the samples
@@ -712,7 +706,6 @@ WebrtcAudioConduit::GetAudioFrame(int16_t speechData[],
     if (GetAVStats(&jitter_buffer_delay_ms,
                    &playout_buffer_delay_ms,
                    &avsync_offset_ms)) {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
       if (avsync_offset_ms < 0) {
         Telemetry::Accumulate(Telemetry::WEBRTC_AVSYNC_WHEN_VIDEO_LAGS_AUDIO_MS,
                               -avsync_offset_ms);
@@ -720,7 +713,6 @@ WebrtcAudioConduit::GetAudioFrame(int16_t speechData[],
         Telemetry::Accumulate(Telemetry::WEBRTC_AVSYNC_WHEN_AUDIO_LAGS_VIDEO_MS,
                               avsync_offset_ms);
       }
-#endif
       CSFLogError(logTag,
                   "A/V sync: sync delta: %dms, audio jitter delay %dms, playout delay %dms",
                   avsync_offset_ms, jitter_buffer_delay_ms, playout_buffer_delay_ms);
@@ -730,7 +722,6 @@ WebrtcAudioConduit::GetAudioFrame(int16_t speechData[],
     mLastSyncLog = mSamples;
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (MOZ_LOG_TEST(GetLatencyLog(), LogLevel::Debug)) {
     if (mProcessing.Length() > 0) {
       unsigned int now;
@@ -753,7 +744,6 @@ WebrtcAudioConduit::GetAudioFrame(int16_t speechData[],
       }
     }
   }
-#endif
   CSFLogDebug(logTag,"%s GetAudioFrame:Got samples: length %d ",__FUNCTION__,
                                                                lengthSamples);
   return kMediaConduitNoError;
@@ -767,14 +757,12 @@ WebrtcAudioConduit::ReceivedRTPPacket(const void *data, int len)
 
   if(mEngineReceiving)
   {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
     if (MOZ_LOG_TEST(GetLatencyLog(), LogLevel::Debug)) {
       // timestamp is at 32 bits in ([1])
       struct Processing insert = { TimeStamp::Now(),
                                    ntohl(static_cast<const uint32_t *>(data)[1]) };
       mProcessing.AppendElement(insert);
     }
-#endif
 
     // XXX we need to get passed the time the packet was received
     if(mPtrVoENetwork->ReceivedRTPPacket(mChannel, data, len) == -1)
@@ -907,7 +895,6 @@ WebrtcAudioConduit::SendRtp(const uint8_t* data,
 {
   CSFLogDebug(logTag,  "%s: len %lu", __FUNCTION__, (unsigned long)len);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (MOZ_LOG_TEST(GetLatencyLog(), LogLevel::Debug)) {
     if (mProcessing.Length() > 0) {
       TimeStamp started = mProcessing[0].mTimeStamp;
@@ -918,7 +905,6 @@ WebrtcAudioConduit::SendRtp(const uint8_t* data,
       LogTime(AsyncLatencyLogger::AudioSendRTP, ((uint64_t) this), delta);
     }
   }
-#endif
   ReentrantMonitorAutoEnter enter(mTransportMonitor);
   // XXX(pkerr) - the PacketOptions are being ignored. This parameter was added along
   // with the Call API update in the webrtc.org codebase.
diff --git a/media/webrtc/signaling/src/media-conduit/AudioConduit.h b/media/webrtc/signaling/src/media-conduit/AudioConduit.h
index ecdd427d382c..4f435747a84a 100755
--- a/media/webrtc/signaling/src/media-conduit/AudioConduit.h
+++ b/media/webrtc/signaling/src/media-conduit/AudioConduit.h
@@ -175,9 +175,7 @@ public:
                       mDtmfEnabled(false),
                       mCodecMutex("AudioConduit codec db"),
                       mCaptureDelay(150),
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
                       mLastTimestamp(0),
-#endif // MOZILLA_INTERNAL_API
                       mSamples(0),
                       mLastSyncLog(0)
   {
@@ -303,9 +301,7 @@ private:
   // Current "capture" delay (really output plus input delay)
   int32_t mCaptureDelay;
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   uint32_t mLastTimestamp;
-#endif // MOZILLA_INTERNAL_API
 
   uint32_t mSamples;
   uint32_t mLastSyncLog;
diff --git a/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp b/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp
index 48d92c7bb49d..2383cdf16c29 100755
--- a/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp
+++ b/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp
@@ -42,9 +42,7 @@
 #ifdef MOZ_WEBRTC_MEDIACODEC
 #include "MediaCodecVideoCodec.h"
 #endif
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "WebrtcGmpVideoCodec.h"
-#endif
 
 // for ntohs
 #ifdef _MSC_VER
diff --git a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
index 87e15d775cdb..b54d7f82e30c 100644
--- a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
+++ b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
@@ -7,16 +7,13 @@
 
 #include "MediaPipeline.h"
 
-#ifndef USE_FAKE_MEDIA_STREAMS
 #include "MediaStreamGraphImpl.h"
-#endif
 
 #include <math.h>
 
 #include "nspr.h"
 #include "srtp.h"
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "VideoSegment.h"
 #include "Layers.h"
 #include "LayersLogging.h"
@@ -32,7 +29,6 @@
 #include "GrallocImages.h"
 #include "mozilla/layers/GrallocTextureClient.h"
 #endif
-#endif
 
 #include "nsError.h"
 #include "AudioSegment.h"
@@ -46,11 +42,9 @@
 #include "runnable_utils.h"
 #include "libyuv/convert.h"
 #include "mozilla/SharedThreadPool.h"
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "mozilla/PeerIdentity.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/TaskQueue.h"
-#endif
 #include "mozilla/gfx/Point.h"
 #include "mozilla/gfx/Types.h"
 #include "mozilla/UniquePtr.h"
@@ -79,7 +73,6 @@ MOZ_MTLOG_MODULE("mediapipeline")
 
 namespace mozilla {
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 class VideoConverterListener
 {
 public:
@@ -467,7 +460,6 @@ protected:
   Mutex mMutex;
   nsTArray<RefPtr<VideoConverterListener>> mListeners;
 };
-#endif
 
 // An async inserter for audio data, to avoid running audio codec encoders
 // on the MSG/input audio thread.  Basically just bounces all the audio
@@ -484,7 +476,6 @@ public:
     MOZ_ASSERT(mConduit);
     MOZ_COUNT_CTOR(AudioProxyThread);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
     // Use only 1 thread; also forces FIFO operation
     // We could use multiple threads, but that may be dicier with the webrtc.org
     // code.  If so we'd need to use TaskQueues like the videoframe converter
@@ -492,12 +483,6 @@ public:
       SharedThreadPool::Get(NS_LITERAL_CSTRING("AudioProxy"), 1);
 
     mThread = pool.get();
-#else
-    nsCOMPtr<nsIThread> thread;
-    if (!NS_WARN_IF(NS_FAILED(NS_NewNamedThread("AudioProxy", getter_AddRefs(thread))))) {
-      mThread = thread;
-    }
-#endif
   }
 
   // called on mThread
@@ -1235,11 +1220,9 @@ public:
     } else {
       conduit_ = nullptr;
     }
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
     if (converter_) {
       converter_->Shutdown();
     }
-#endif
   }
 
   // Dispatches setting the internal TrackID to TRACK_INVALID to the media
@@ -1258,7 +1241,6 @@ public:
     audio_processing_ = proxy;
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   void SetVideoFrameConverter(const RefPtr<VideoFrameConverter>& converter)
   {
     converter_ = converter;
@@ -1281,7 +1263,6 @@ public:
     MOZ_ASSERT(conduit_->type() == MediaSessionConduit::VIDEO);
     static_cast<VideoSessionConduit*>(conduit_.get())->SendVideoFrame(aVideoFrame);
   }
-#endif
 
   // Implement MediaStreamTrackListener
   void NotifyQueuedChanges(MediaStreamGraph* aGraph,
@@ -1309,9 +1290,7 @@ private:
 
   RefPtr<MediaSessionConduit> conduit_;
   RefPtr<AudioProxyThread> audio_processing_;
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   RefPtr<VideoFrameConverter> converter_;
-#endif
 
   // May be TRACK_INVALID until we see data from the track
   TrackID track_id_; // this is the current TrackID this listener is attached to
@@ -1330,7 +1309,6 @@ private:
   bool direct_connect_;
 };
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 // Implements VideoConverterListener for MediaPipeline.
 //
 // We pass converted frames on to MediaPipelineTransmit::PipelineListener
@@ -1392,7 +1370,6 @@ protected:
   RefPtr<PipelineListener> listener_;
   Mutex mutex_;
 };
-#endif
 
 MediaPipelineTransmit::MediaPipelineTransmit(
     const std::string& pc,
@@ -1414,7 +1391,6 @@ MediaPipelineTransmit::MediaPipelineTransmit(
     audio_processing_ = MakeAndAddRef<AudioProxyThread>(static_cast<AudioSessionConduit*>(conduit.get()));
     listener_->SetAudioProxy(audio_processing_);
   }
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   else { // Video
     // For video we send frames to an async VideoFrameConverter that calls
     // back to a VideoFrameFeeder that feeds I420 frames to VideoConduit.
@@ -1426,16 +1402,13 @@ MediaPipelineTransmit::MediaPipelineTransmit(
 
     listener_->SetVideoFrameConverter(converter_);
   }
-#endif
 }
 
 MediaPipelineTransmit::~MediaPipelineTransmit()
 {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (feeder_) {
     feeder_->Detach();
   }
-#endif
 }
 
 nsresult MediaPipelineTransmit::Init() {
@@ -1494,7 +1467,6 @@ MediaPipelineTransmit::IsVideo() const
   return !!domtrack_->AsVideoStreamTrack();
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 void MediaPipelineTransmit::UpdateSinkIdentity_m(MediaStreamTrack* track,
                                                  nsIPrincipal* principal,
                                                  const PeerIdentity* sinkIdentity) {
@@ -1521,7 +1493,6 @@ void MediaPipelineTransmit::UpdateSinkIdentity_m(MediaStreamTrack* track,
 
   listener_->SetEnabled(enableTrack);
 }
-#endif
 
 void
 MediaPipelineTransmit::DetachMedia()
@@ -1556,13 +1527,9 @@ nsresult MediaPipelineTransmit::TransportReady_s(TransportInfo &info) {
 
 nsresult MediaPipelineTransmit::ReplaceTrack(MediaStreamTrack& domtrack) {
   // MainThread, checked in calls we make
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   nsString nsTrackId;
   domtrack.GetId(nsTrackId);
   std::string track_id(NS_ConvertUTF16toUTF8(nsTrackId).get());
-#else
-  std::string track_id = domtrack.GetId();
-#endif
   MOZ_MTLOG(ML_DEBUG, "Reattaching pipeline " << description_ << " to track "
             << static_cast<void *>(&domtrack)
             << " track " << track_id << " conduit type=" <<
@@ -1713,7 +1680,6 @@ nsresult MediaPipeline::PipelineTransport::SendRtcpPacket(
 
 void MediaPipelineTransmit::PipelineListener::
 UnsetTrackId(MediaStreamGraphImpl* graph) {
-#ifndef USE_FAKE_MEDIA_STREAMS
   class Message : public ControlMessage {
   public:
     explicit Message(PipelineListener* listener) :
@@ -1725,9 +1691,6 @@ UnsetTrackId(MediaStreamGraphImpl* graph) {
     RefPtr<PipelineListener> listener_;
   };
   graph->AppendMessage(MakeUnique<Message>(this));
-#else
-  UnsetTrackIdImpl();
-#endif
 }
 // Called if we're attached with AddDirectListener()
 void MediaPipelineTransmit::PipelineListener::
@@ -1764,7 +1727,14 @@ NotifyQueuedChanges(MediaStreamGraph* graph,
     return;
   }
 
-  NewData(queued_media, graph->GraphRate());
+  size_t rate;
+  if (graph) {
+    rate = graph->GraphRate();
+  } else {
+    // When running tests, graph may be null. In that case use a default.
+    rate = 16000;
+  }
+  NewData(queued_media, rate);
 }
 
 void MediaPipelineTransmit::PipelineListener::
@@ -1807,14 +1777,12 @@ NewData(const MediaSegment& media, TrackRate aRate /* = 0 */) {
     for(AudioSegment::ChunkIterator iter(*audio); !iter.IsEnded(); iter.Next()) {
       audio_processing_->QueueAudioChunk(aRate, *iter, enabled_);
     }
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   } else {
     VideoSegment* video = const_cast<VideoSegment *>(static_cast<const VideoSegment*>(&media));
     VideoSegment::ChunkIterator iter(*video);
     for(VideoSegment::ChunkIterator iter(*video); !iter.IsEnded(); iter.Next()) {
       converter_->QueueVideoChunk(*iter, !enabled_);
     }
-#endif // MOZILLA_EXTERNAL_LINKAGE
   }
 }
 
@@ -1850,7 +1818,6 @@ class GenericReceiveCallback : public TrackAddedCallback
 
 // Add a listener on the MSG thread using the MSG command queue
 static void AddListener(MediaStream* source, MediaStreamListener* listener) {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   class Message : public ControlMessage {
    public:
     Message(MediaStream* stream, MediaStreamListener* listener)
@@ -1866,10 +1833,9 @@ static void AddListener(MediaStream* source, MediaStreamListener* listener) {
 
   MOZ_ASSERT(listener);
 
-  source->GraphImpl()->AppendMessage(MakeUnique<Message>(source, listener));
-#else
-  source->AddListener(listener);
-#endif
+  if (source->GraphImpl()) {
+    source->GraphImpl()->AppendMessage(MakeUnique<Message>(source, listener));
+  }
 }
 
 class GenericReceiveListener : public MediaStreamListener
@@ -1893,7 +1859,6 @@ class GenericReceiveListener : public MediaStreamListener
     source_->EndTrack(track_id_);
   }
 
-#ifndef USE_FAKE_MEDIA_STREAMS
   // Must be called on the main thread
   void SetPrincipalHandle_m(const PrincipalHandle& principal_handle)
   {
@@ -1924,7 +1889,6 @@ class GenericReceiveListener : public MediaStreamListener
   {
     principal_handle_ = principal_handle;
   }
-#endif // USE_FAKE_MEDIA_STREAMS
 
  protected:
   SourceMediaStream *source_;
@@ -2092,7 +2056,10 @@ void MediaPipelineReceiveAudio::DetachMedia()
   ASSERT_ON_THREAD(main_thread_);
   if (stream_ && listener_) {
     listener_->EndTrack();
-    stream_->RemoveListener(listener_);
+
+    if (stream_->GraphImpl()) {
+      stream_->RemoveListener(listener_);
+    }
     stream_ = nullptr;
   }
 }
@@ -2110,12 +2077,10 @@ nsresult MediaPipelineReceiveAudio::Init() {
   return MediaPipelineReceive::Init();
 }
 
-#ifndef USE_FAKE_MEDIA_STREAMS
 void MediaPipelineReceiveAudio::SetPrincipalHandle_m(const PrincipalHandle& principal_handle)
 {
   listener_->SetPrincipalHandle_m(principal_handle);
 }
-#endif // USE_FAKE_MEDIA_STREAMS
 
 class MediaPipelineReceiveVideo::PipelineListener
   : public GenericReceiveListener {
@@ -2130,16 +2095,13 @@ public:
 #endif
       monitor_("Video PipelineListener")
   {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
     image_container_ =
       LayerManager::CreateImageContainer(ImageContainer::ASYNCHRONOUS);
-#endif
   }
 
   // Implement MediaStreamListener
   void NotifyPull(MediaStreamGraph* graph, StreamTime desired_time) override
   {
-  #if defined(MOZILLA_INTERNAL_API)
     ReentrantMonitorAutoEnter enter(monitor_);
 
     RefPtr<Image> image = image_;
@@ -2160,7 +2122,6 @@ public:
         return;
       }
     }
-  #endif
   }
 
   // Accessors for external writes from the renderer
@@ -2346,11 +2307,9 @@ nsresult MediaPipelineReceiveVideo::Init() {
   return MediaPipelineReceive::Init();
 }
 
-#ifndef USE_FAKE_MEDIA_STREAMS
 void MediaPipelineReceiveVideo::SetPrincipalHandle_m(const PrincipalHandle& principal_handle)
 {
   listener_->SetPrincipalHandle_m(principal_handle);
 }
-#endif // USE_FAKE_MEDIA_STREAMS
 
 }  // end namespace
diff --git a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.h b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.h
index 3e744b31ebf5..be286620be8d 100644
--- a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.h
+++ b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.h
@@ -10,9 +10,6 @@
 
 #include "sigslot.h"
 
-#ifdef USE_FAKE_MEDIA_STREAMS
-#include "FakeMediaStreams.h"
-#endif
 #include "MediaConduitInterface.h"
 #include "mozilla/ReentrantMonitor.h"
 #include "mozilla/Atomics.h"
@@ -35,17 +32,13 @@ namespace mozilla {
 class MediaPipelineFilter;
 class PeerIdentity;
 class AudioProxyThread;
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 class VideoFrameConverter;
-#endif
 
-#ifndef USE_FAKE_MEDIA_STREAMS
 namespace dom {
   class MediaStreamTrack;
 } // namespace dom
 
 class SourceMediaStream;
-#endif // USE_FAKE_MEDIA_STREAMS
 
 // A class that represents the pipeline of audio and video
 // The dataflow looks like:
@@ -324,14 +317,12 @@ public:
   // written and used from MainThread
   bool IsVideo() const override;
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // When the principal of the domtrack changes, it calls through to here
   // so that we can determine whether to enable track transmission.
   // `track` has to be null or equal `domtrack_` for us to apply the update.
   virtual void UpdateSinkIdentity_m(dom::MediaStreamTrack* track,
                                     nsIPrincipal* principal,
                                     const PeerIdentity* sinkIdentity);
-#endif
 
   // Called on the main thread.
   void DetachMedia() override;
@@ -355,10 +346,8 @@ public:
  private:
   RefPtr<PipelineListener> listener_;
   RefPtr<AudioProxyThread> audio_processing_;
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   RefPtr<VideoFrameFeeder> feeder_;
   RefPtr<VideoFrameConverter> converter_;
-#endif
   dom::MediaStreamTrack* domtrack_;
 };
 
@@ -381,11 +370,9 @@ class MediaPipelineReceive : public MediaPipeline {
 
   int segments_added() const { return segments_added_; }
 
-#ifndef USE_FAKE_MEDIA_STREAMS
   // Sets the PrincipalHandle we set on the media chunks produced by this
   // pipeline. Must be called on the main thread.
   virtual void SetPrincipalHandle_m(const PrincipalHandle& principal_handle) = 0;
-#endif // USE_FAKE_MEDIA_STREAMS
  protected:
   ~MediaPipelineReceive();
 
@@ -422,9 +409,7 @@ class MediaPipelineReceiveAudio : public MediaPipelineReceive {
   nsresult Init() override;
   bool IsVideo() const override { return false; }
 
-#ifndef USE_FAKE_MEDIA_STREAMS
   void SetPrincipalHandle_m(const PrincipalHandle& principal_handle) override;
-#endif // USE_FAKE_MEDIA_STREAMS
 
  private:
   // Separate class to allow ref counting
@@ -461,9 +446,7 @@ class MediaPipelineReceiveVideo : public MediaPipelineReceive {
   nsresult Init() override;
   bool IsVideo() const override { return true; }
 
-#ifndef USE_FAKE_MEDIA_STREAMS
   void SetPrincipalHandle_m(const PrincipalHandle& principal_handle) override;
-#endif // USE_FAKE_MEDIA_STREAMS
 
  private:
   class PipelineRenderer;
diff --git a/media/webrtc/signaling/src/peerconnection/MediaPipelineFactory.cpp b/media/webrtc/signaling/src/peerconnection/MediaPipelineFactory.cpp
index 7f35b1217875..2a6ac6d69214 100644
--- a/media/webrtc/signaling/src/peerconnection/MediaPipelineFactory.cpp
+++ b/media/webrtc/signaling/src/peerconnection/MediaPipelineFactory.cpp
@@ -19,21 +19,17 @@
 #include "signaling/src/jsep/JsepTransport.h"
 #include "signaling/src/common/PtrVector.h"
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "MediaStreamTrack.h"
 #include "nsIPrincipal.h"
 #include "nsIDocument.h"
 #include "mozilla/Preferences.h"
 #include "MediaEngine.h"
-#endif
 
 #ifdef MOZILLA_INTERNAL_API
 #include "mozilla/Preferences.h"
 #endif
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "WebrtcGmpVideoCodec.h"
-#endif
 
 #include <stdlib.h>
 
@@ -382,13 +378,11 @@ MediaPipelineFactory::CreateOrUpdateMediaPipeline(
     const JsepTrackPair& aTrackPair,
     const JsepTrack& aTrack)
 {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // The GMP code is all the way on the other side of webrtc.org, and it is not
   // feasible to plumb this information all the way through. So, we set it (for
   // the duration of this call) in a global variable. This allows the GMP code
   // to report errors to the PC.
   WebrtcGmpPCHandleSetter setter(mPC->GetHandle());
-#endif
 
   MOZ_ASSERT(aTrackPair.mRtpTransport);
 
@@ -638,7 +632,6 @@ MediaPipelineFactory::CreateMediaPipelineSending(
       aRtcpFlow,
       aFilter);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // implement checking for peerIdentity (where failure == black/silence)
   nsIDocument* doc = mPC->GetWindow()->GetExtantDoc();
   if (doc) {
@@ -649,7 +642,6 @@ MediaPipelineFactory::CreateMediaPipelineSending(
     MOZ_MTLOG(ML_ERROR, "Cannot initialize pipeline without attached doc");
     return NS_ERROR_FAILURE; // Don't remove this till we know it's safe.
   }
-#endif
 
   rv = pipeline->Init();
   if (NS_FAILED(rv)) {
@@ -898,7 +890,6 @@ nsresult
 MediaPipelineFactory::ConfigureVideoCodecMode(const JsepTrack& aTrack,
                                               VideoSessionConduit& aConduit)
 {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   RefPtr<LocalSourceStreamInfo> stream =
     mPCMedia->GetLocalStreamByTrackId(aTrack.GetTrackId());
 
@@ -936,7 +927,6 @@ MediaPipelineFactory::ConfigureVideoCodecMode(const JsepTrack& aTrack,
     return NS_ERROR_FAILURE;
   }
 
-#endif
   return NS_OK;
 }
 
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.cpp
index 4be19138df05..15844e2f3fc3 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.cpp
@@ -12,11 +12,9 @@
 #include "mozilla/Telemetry.h"
 #include "browser_logging/WebRtcLog.h"
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "mozilla/dom/RTCPeerConnectionBinding.h"
 #include "mozilla/Preferences.h"
 #include <mozilla/Types.h>
-#endif
 
 #include "nsNetCID.h" // NS_SOCKETTRANSPORTSERVICE_CONTRACTID
 #include "nsServiceManagerUtils.h" // do_GetService
@@ -190,7 +188,6 @@ void PeerConnectionCtx::Destroy() {
   StopWebRtcLog();
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 typedef Vector<nsAutoPtr<RTCStatsQuery>> RTCStatsQueries;
 
 // Telemetry reporting every second after start of first call.
@@ -362,7 +359,6 @@ PeerConnectionCtx::EverySecondTelemetryCallback_m(nsITimer* timer, void *closure
     NS_ENSURE_SUCCESS_VOID(rv);
   }
 }
-#endif
 
 void
 PeerConnectionCtx::UpdateNetworkState(bool online) {
@@ -378,7 +374,6 @@ PeerConnectionCtx::UpdateNetworkState(bool online) {
 nsresult PeerConnectionCtx::Initialize() {
   initGMP();
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   mTelemetryTimer = do_CreateInstance(NS_TIMER_CONTRACTID);
   MOZ_ASSERT(mTelemetryTimer);
   nsresult rv = mTelemetryTimer->SetTarget(gMainThread);
@@ -389,7 +384,6 @@ nsresult PeerConnectionCtx::Initialize() {
   if (XRE_IsContentProcess()) {
     WebrtcGlobalChild::Create();
   }
-#endif // MOZILLA_INTERNAL_API
 
   return NS_OK;
 }
@@ -442,11 +436,9 @@ nsresult PeerConnectionCtx::Cleanup() {
 PeerConnectionCtx::~PeerConnectionCtx() {
     // ensure mTelemetryTimer ends on main thread
   MOZ_ASSERT(NS_IsMainThread());
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (mTelemetryTimer) {
     mTelemetryTimer->Cancel();
   }
-#endif
 };
 
 void PeerConnectionCtx::queueJSEPOperation(nsIRunnable* aOperation) {
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.h b/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.h
index c150e2a06fbc..c13710f0047e 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.h
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.h
@@ -7,9 +7,7 @@
 
 #include <string>
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "WebrtcGlobalChild.h"
-#endif
 
 #include "mozilla/Attributes.h"
 #include "mozilla/StaticPtr.h"
@@ -55,12 +53,10 @@ class PeerConnectionCtx {
   friend class PeerConnectionWrapper;
   friend class mozilla::dom::WebrtcGlobalInformation;
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // WebrtcGlobalInformation uses this; we put it here so we don't need to
   // create another shutdown observer class.
   mozilla::dom::Sequence<mozilla::dom::RTCStatsReportInternal>
     mStatsForClosedPeerConnections;
-#endif
 
   const std::map<const std::string, PeerConnectionImpl *>& mGetPeerConnections();
  private:
@@ -81,7 +77,6 @@ class PeerConnectionCtx {
   static void
   EverySecondTelemetryCallback_m(nsITimer* timer, void *);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   nsCOMPtr<nsITimer> mTelemetryTimer;
 
 public:
@@ -89,7 +84,6 @@ public:
   //std::map<nsString,nsAutoPtr<mozilla::dom::RTCStatsReportInternal>> mLastReports;
   nsTArray<nsAutoPtr<mozilla::dom::RTCStatsReportInternal>> mLastReports;
 private:
-#endif
 
   // We cannot form offers/answers properly until the Gecko Media Plugin stuff
   // has been initted, which is a complicated mess of thread dispatches,
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
index a66fd0e37e91..ede360f89549 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
@@ -49,7 +49,6 @@
 #include "mozilla/IntegerPrintfMacros.h"
 #include "mozilla/Sprintf.h"
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #ifdef XP_WIN
 // We need to undef the MS macro for nsIDocument::CreateEvent
 #ifdef CreateEvent
@@ -100,13 +99,9 @@
 #include "mozilla/dom/Event.h"
 #include "nsIDOMCustomEvent.h"
 #include "mozilla/EventDispatcher.h"
-#endif
-
 #include "mozilla/net/DataChannelProtocol.h"
 
-#ifndef USE_FAKE_MEDIA_STREAMS
 #include "MediaStreamGraphImpl.h"
-#endif
 
 #ifdef XP_WIN
 // We need to undef the MS macro again in case the windows include file
@@ -116,9 +111,7 @@
 #endif
 #endif // XP_WIN
 
-#ifndef USE_FAKE_MEDIA_STREAMS
 #include "MediaSegment.h"
-#endif
 
 #ifdef USE_FAKE_PCOBSERVER
 #include "FakePCObserver.h"
@@ -157,9 +150,7 @@ class JSErrorResult :
 public:
   ~JSErrorResult()
   {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
     SuppressException();
-#endif
   }
 };
 
@@ -194,7 +185,6 @@ private:
 };
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 static nsresult InitNSSInContent()
 {
   NS_ENSURE_TRUE(NS_IsMainThread(), NS_ERROR_NOT_SAME_THREAD);
@@ -225,7 +215,6 @@ static nsresult InitNSSInContent()
 
   return NS_OK;
 }
-#endif // MOZILLA_INTERNAL_API
 
 namespace mozilla {
   class DataChannel;
@@ -242,7 +231,6 @@ const nsIID nsISupportsWeakReference::COMTypeInfo<nsSupportsWeakReference, void>
 
 namespace mozilla {
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 RTCStatsQuery::RTCStatsQuery(bool internal) :
   failed(false),
   internalStats(internal),
@@ -253,11 +241,9 @@ RTCStatsQuery::~RTCStatsQuery() {
   MOZ_ASSERT(NS_IsMainThread());
 }
 
-#endif
 
 NS_IMPL_ISUPPORTS0(PeerConnectionImpl)
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 bool
 PeerConnectionImpl::WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aGivenProto,
@@ -265,7 +251,6 @@ PeerConnectionImpl::WrapObject(JSContext* aCx,
 {
   return PeerConnectionImplBinding::Wrap(aCx, this, aGivenProto, aReflector);
 }
-#endif
 
 bool PCUuidGenerator::Generate(std::string* idp) {
   nsresult rv;
@@ -294,9 +279,6 @@ bool PCUuidGenerator::Generate(std::string* idp) {
 
 bool IsPrivateBrowsing(nsPIDOMWindowInner* aWindow)
 {
-#if defined(MOZILLA_EXTERNAL_LINKAGE)
-  return false;
-#else
   if (!aWindow) {
     return false;
   }
@@ -308,7 +290,6 @@ bool IsPrivateBrowsing(nsPIDOMWindowInner* aWindow)
 
   nsILoadContext *loadContext = doc->GetLoadContext();
   return loadContext && loadContext->UsePrivateBrowsing();
-#endif
 }
 
 PeerConnectionImpl::PeerConnectionImpl(const GlobalObject* aGlobal)
@@ -319,11 +300,7 @@ PeerConnectionImpl::PeerConnectionImpl(const GlobalObject* aGlobal)
   , mIceGatheringState(PCImplIceGatheringState::New)
   , mDtlsConnected(false)
   , mWindow(nullptr)
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   , mCertificate(nullptr)
-#else
-  , mIdentity(nullptr)
-#endif
   , mPrivacyRequested(false)
   , mSTSThread(nullptr)
   , mAllowIceLoopback(false)
@@ -340,7 +317,6 @@ PeerConnectionImpl::PeerConnectionImpl(const GlobalObject* aGlobal)
   , mNegotiationNeeded(false)
   , mPrivateWindow(false)
 {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   MOZ_ASSERT(NS_IsMainThread());
   auto log = RLogConnector::CreateInstance();
   if (aGlobal) {
@@ -350,18 +326,15 @@ PeerConnectionImpl::PeerConnectionImpl(const GlobalObject* aGlobal)
       log->EnterPrivateMode();
     }
   }
-#endif
   CSFLogInfo(logTag, "%s: PeerConnectionImpl constructor for %s",
              __FUNCTION__, mHandle.c_str());
   STAMP_TIMECARD(mTimeCard, "Constructor Completed");
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   mAllowIceLoopback = Preferences::GetBool(
     "media.peerconnection.ice.loopback", false);
   mAllowIceLinkLocal = Preferences::GetBool(
     "media.peerconnection.ice.link_local", false);
   mForceIceTcp = Preferences::GetBool(
     "media.peerconnection.ice.force_ice_tcp", false);
-#endif
   memset(mMaxReceiving, 0, sizeof(mMaxReceiving));
   memset(mMaxSending, 0, sizeof(mMaxSending));
 }
@@ -376,7 +349,6 @@ PeerConnectionImpl::~PeerConnectionImpl()
   }
   // This aborts if not on main thread (in Debug builds)
   PC_AUTO_ENTER_API_CALL_NO_CHECK();
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (mPrivateWindow) {
     auto * log = RLogConnector::GetInstance();
     if (log) {
@@ -384,7 +356,6 @@ PeerConnectionImpl::~PeerConnectionImpl()
     }
     mPrivateWindow = false;
   }
-#endif
   if (PeerConnectionCtx::isActive()) {
     PeerConnectionCtx::GetInstance()->mPeerConnections.erase(mHandle);
   } else {
@@ -440,7 +411,6 @@ PeerConnectionImpl::CreateRemoteSourceStreamInfo(RefPtr<RemoteSourceStreamInfo>*
   return NS_OK;
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 /**
  * In JS, an RTCConfiguration looks like this:
  *
@@ -592,7 +562,6 @@ PeerConnectionConfiguration::AddIceServer(const RTCIceServer &aServer)
   }
   return NS_OK;
 }
-#endif
 
 nsresult
 PeerConnectionImpl::Initialize(PeerConnectionObserver& aObserver,
@@ -616,7 +585,6 @@ PeerConnectionImpl::Initialize(PeerConnectionObserver& aObserver,
 
   mSTSThread = do_GetService(NS_SOCKETTRANSPORTSERVICE_CONTRACTID, &res);
   MOZ_ASSERT(mSTSThread);
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 
   // Initialize NSS if we are in content process. For chrome process, NSS should already
   // been initialized.
@@ -633,13 +601,11 @@ PeerConnectionImpl::Initialize(PeerConnectionObserver& aObserver,
   MOZ_ASSERT(aWindow);
   mWindow = aWindow->AsInner();
   NS_ENSURE_STATE(mWindow);
-#endif // MOZILLA_INTERNAL_API
 
   PRTime timestamp = PR_Now();
   // Ok if we truncate this.
   char temp[128];
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   nsAutoCString locationCStr;
 
   if (nsCOMPtr<nsIDOMLocation> location = mWindow->GetLocation()) {
@@ -655,10 +621,6 @@ PeerConnectionImpl::Initialize(PeerConnectionObserver& aObserver,
                  static_cast<uint64_t>(mWindow ? mWindow->WindowID() : 0),
                  locationCStr.get() ? locationCStr.get() : "NULL");
 
-#else
-  SprintfLiteral(temp, "%" PRIu64, static_cast<uint64_t>(timestamp));
-#endif // MOZILLA_INTERNAL_API
-
   mName = temp;
 
   // Generate a random handle
@@ -736,24 +698,6 @@ PeerConnectionImpl::Initialize(PeerConnectionObserver& aObserver,
     return res;
   }
 
-#if defined(MOZILLA_EXTERNAL_LINKAGE)
-  {
-    mIdentity = DtlsIdentity::Generate();
-    if (!mIdentity) {
-      return NS_ERROR_FAILURE;
-    }
-
-    std::vector<uint8_t> fingerprint;
-    res = CalculateFingerprint(DtlsIdentity::DEFAULT_HASH_ALGORITHM,
-                               &fingerprint);
-    NS_ENSURE_SUCCESS(res, res);
-
-    res = mJsepSession->AddDtlsFingerprint(DtlsIdentity::DEFAULT_HASH_ALGORITHM,
-                                           fingerprint);
-    NS_ENSURE_SUCCESS(res, res);
-  }
-#endif
-
   res = mJsepSession->SetBundlePolicy(aConfiguration.getBundlePolicy());
   if (NS_FAILED(res)) {
     CSFLogError(logTag, "%s: Couldn't set bundle policy, res=%u, error=%s",
@@ -766,7 +710,6 @@ PeerConnectionImpl::Initialize(PeerConnectionObserver& aObserver,
   return NS_OK;
 }
 
-#ifndef MOZILLA_EXTERNAL_LINKAGE
 void
 PeerConnectionImpl::Initialize(PeerConnectionObserver& aObserver,
                                nsGlobalWindow& aWindow,
@@ -796,9 +739,7 @@ PeerConnectionImpl::Initialize(PeerConnectionObserver& aObserver,
     mPrivacyRequested = true;
   }
 }
-#endif
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 void
 PeerConnectionImpl::SetCertificate(mozilla::dom::RTCCertificate& aCertificate)
 {
@@ -830,19 +771,13 @@ PeerConnectionImpl::Certificate() const
   PC_AUTO_ENTER_API_CALL_NO_CHECK();
   return mCertificate;
 }
-#endif
 
 RefPtr<DtlsIdentity>
 PeerConnectionImpl::Identity() const
 {
   PC_AUTO_ENTER_API_CALL_NO_CHECK();
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   MOZ_ASSERT(mCertificate);
   return mCertificate->CreateDtlsIdentity();
-#else
-  RefPtr<DtlsIdentity> id = mIdentity;
-  return id;
-#endif
 }
 
 class CompareCodecPriority {
@@ -922,12 +857,7 @@ class ConfigureCodec {
 
 #endif // MOZ_WEBRTC_OMX
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
       mSoftwareH264Enabled = PeerConnectionCtx::GetInstance()->gmpHasH264();
-#else
-      // For unit-tests
-      mSoftwareH264Enabled = true;
-#endif
 
       mH264Enabled = mHardwareH264Supported || mSoftwareH264Enabled;
 
@@ -1155,7 +1085,6 @@ PeerConnectionImpl::EnsureDataConnection(uint16_t aNumstreams)
 {
   PC_AUTO_ENTER_API_CALL(false);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (mDataConnection) {
     CSFLogDebug(logTag,"%s DataConnection already connected",__FUNCTION__);
     // Ignore the request to connect when already connected.  This entire
@@ -1170,7 +1099,6 @@ PeerConnectionImpl::EnsureDataConnection(uint16_t aNumstreams)
   }
   CSFLogDebug(logTag,"%s DataChannelConnection %p attached to %s",
               __FUNCTION__, (void*) mDataConnection.get(), mHandle.c_str());
-#endif
   return NS_OK;
 }
 
@@ -1311,7 +1239,6 @@ PeerConnectionImpl::InitializeDataChannel()
     return NS_OK;
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (channels > MAX_NUM_STREAMS) {
     channels = MAX_NUM_STREAMS;
   }
@@ -1333,7 +1260,6 @@ PeerConnectionImpl::InitializeDataChannel()
     mDataConnection->Destroy();
   }
   mDataConnection = nullptr;
-#endif
   return NS_ERROR_FAILURE;
 }
 
@@ -1348,15 +1274,11 @@ PeerConnectionImpl::CreateDataChannel(const nsAString& aLabel,
                                       uint16_t aStream,
                                       ErrorResult &rv)
 {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   RefPtr<nsDOMDataChannel> result;
   rv = CreateDataChannel(aLabel, aProtocol, aType, ordered,
                          aMaxTime, aMaxNum, aExternalNegotiated,
                          aStream, getter_AddRefs(result));
   return result.forget();
-#else
-  return nullptr;
-#endif
 }
 
 NS_IMETHODIMP
@@ -1373,7 +1295,6 @@ PeerConnectionImpl::CreateDataChannel(const nsAString& aLabel,
   PC_AUTO_ENTER_API_CALL(false);
   MOZ_ASSERT(aRetval);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   RefPtr<DataChannel> dataChannel;
   DataChannelConnection::Type theType =
     static_cast<DataChannelConnection::Type>(aType);
@@ -1427,7 +1348,6 @@ PeerConnectionImpl::CreateDataChannel(const nsAString& aLabel,
     return rv;
   }
   *aRetval = static_cast<nsDOMDataChannel*>(retval);
-#endif
   return NS_OK;
 }
 
@@ -1457,7 +1377,6 @@ do_QueryObjectReferent(nsIWeakReference* aRawPtr) {
 }
 
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 // Not a member function so that we don't need to keep the PC live.
 static void NotifyDataChannel_m(RefPtr<nsIDOMDataChannel> aChannel,
                                 RefPtr<PeerConnectionObserver> aObserver)
@@ -1468,7 +1387,6 @@ static void NotifyDataChannel_m(RefPtr<nsIDOMDataChannel> aChannel,
   aObserver->NotifyDataChannel(*channel, rv);
   NS_DataChannelAppReady(aChannel);
 }
-#endif
 
 void
 PeerConnectionImpl::NotifyDataChannel(already_AddRefed<DataChannel> aChannel)
@@ -1485,7 +1403,6 @@ PeerConnectionImpl::NotifyDataChannel(already_AddRefed<DataChannel> aChannel)
 
   CSFLogDebug(logTag, "%s: channel: %p", __FUNCTION__, channel);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   nsCOMPtr<nsIDOMDataChannel> domchannel;
   nsresult rv = NS_NewDOMDataChannel(already_AddRefed<DataChannel>(channel),
                                      mWindow, getter_AddRefs(domchannel));
@@ -1503,14 +1420,12 @@ PeerConnectionImpl::NotifyDataChannel(already_AddRefed<DataChannel> aChannel)
                                domchannel.get(),
                                pco),
                 NS_DISPATCH_NORMAL);
-#endif
 }
 
 NS_IMETHODIMP
 PeerConnectionImpl::CreateOffer(const RTCOfferOptions& aOptions)
 {
   JsepOfferOptions options;
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // convert the RTCOfferOptions to JsepOfferOptions
   if (aOptions.mOfferToReceiveAudio.WasPassed()) {
     options.mOfferToReceiveAudio =
@@ -1528,7 +1443,6 @@ PeerConnectionImpl::CreateOffer(const RTCOfferOptions& aOptions)
     options.mDontOfferDataChannel =
       mozilla::Some(aOptions.mMozDontOfferDataChannel.Value());
   }
-#endif
   return CreateOffer(options);
 }
 
@@ -1772,10 +1686,8 @@ PeerConnectionImpl::SetLocalDescription(int32_t aAction, const char* aSDP)
 
   STAMP_TIMECARD(mTimeCard, "Set Local Description");
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   bool isolated = mMedia->AnyLocalTrackHasPeerIdentity();
   mPrivacyRequested = mPrivacyRequested || isolated;
-#endif
 
   mLocalRequestedSDP = aSDP;
 
@@ -1842,7 +1754,6 @@ static void DeferredSetRemote(const std::string& aPcHandle,
 static void StartTrack(MediaStream* aSource,
                        TrackID aTrackId,
                        nsAutoPtr<MediaSegment>&& aSegment) {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   class Message : public ControlMessage {
    public:
     Message(MediaStream* aStream,
@@ -1890,7 +1801,6 @@ static void StartTrack(MediaStream* aSource,
       MakeUnique<Message>(aSource, aTrackId, Move(aSegment)));
   CSFLogInfo(logTag, "Dispatched track-add for track id %u on stream %p",
              aTrackId, aSource);
-#endif
 }
 
 
@@ -1942,16 +1852,11 @@ PeerConnectionImpl::CreateNewRemoteTracks(RefPtr<PeerConnectionObserver>& aPco)
 
       CSFLogDebug(logTag, "Added remote stream %s", info->GetId().c_str());
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
       info->GetMediaStream()->AssignId(NS_ConvertUTF8toUTF16(streamId.c_str()));
       info->GetMediaStream()->SetLogicalStreamStartTime(
           info->GetMediaStream()->GetPlaybackStream()->GetCurrentTime());
-#else
-      info->GetMediaStream()->AssignId((streamId));
-#endif
     }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
     Sequence<OwningNonNull<DOMMediaStream>> streams;
     if (!streams.AppendElement(OwningNonNull<DOMMediaStream>(
             *info->GetMediaStream()),
@@ -1973,7 +1878,6 @@ PeerConnectionImpl::CreateNewRemoteTracks(RefPtr<PeerConnectionObserver>& aPco)
       // we're not sure and we can fix the stream in SetDtlsConnected
       principal =  nsNullPrincipal::CreateWithInheritedAttributes(doc->NodePrincipal());
     }
-#endif
 
     // We need to select unique ids, just use max + 1
     TrackID maxTrackId = 0;
@@ -1988,12 +1892,8 @@ PeerConnectionImpl::CreateNewRemoteTracks(RefPtr<PeerConnectionObserver>& aPco)
     for (RefPtr<JsepTrack>& track : tracks) {
       std::string webrtcTrackId(track->GetTrackId());
       if (!info->HasTrack(webrtcTrackId)) {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
         RefPtr<RemoteTrackSource> source =
           new RemoteTrackSource(principal, nsString());
-#else
-        RefPtr<MediaStreamTrackSource> source = new MediaStreamTrackSource();
-#endif
         TrackID trackID = ++maxTrackId;
         RefPtr<MediaStreamTrack> domTrack;
         nsAutoPtr<MediaSegment> segment;
@@ -2010,9 +1910,7 @@ PeerConnectionImpl::CreateNewRemoteTracks(RefPtr<PeerConnectionObserver>& aPco)
                                                    MediaSegment::VIDEO,
                                                    source);
           info->GetMediaStream()->AddTrackInternal(domTrack);
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
           segment = new VideoSegment;
-#endif
         }
 
         StartTrack(info->GetMediaStream()->GetInputStream()->AsSourceStream(),
@@ -2021,7 +1919,6 @@ PeerConnectionImpl::CreateNewRemoteTracks(RefPtr<PeerConnectionObserver>& aPco)
         CSFLogDebug(logTag, "Added remote track %s/%s",
                     info->GetId().c_str(), webrtcTrackId.c_str());
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
         domTrack->AssignId(NS_ConvertUTF8toUTF16(webrtcTrackId.c_str()));
         aPco->OnAddTrack(*domTrack, streams, jrv);
         if (jrv.Failed()) {
@@ -2029,7 +1926,6 @@ PeerConnectionImpl::CreateNewRemoteTracks(RefPtr<PeerConnectionObserver>& aPco)
                       webrtcTrackId.c_str(),
                       jrv.ErrorCodeAsInt());
         }
-#endif
       }
     }
 
@@ -2169,9 +2065,7 @@ PeerConnectionImpl::SetRemoteDescription(int32_t action, const char* aSDP)
     RemoveOldRemoteTracks(pco);
 
     pco->OnSetRemoteDescriptionSuccess(jrv);
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
     startCallTelem();
-#endif
   }
 
   UpdateSignalingState(sdpType == mozilla::kJsepSdpRollback);
@@ -2180,7 +2074,6 @@ PeerConnectionImpl::SetRemoteDescription(int32_t action, const char* aSDP)
 
 // WebRTC uses highres time relative to the UNIX epoch (Jan 1, 1970, UTC).
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 nsresult
 PeerConnectionImpl::GetTimeSinceEpoch(DOMHighResTimeStamp *result) {
   MOZ_ASSERT(NS_IsMainThread());
@@ -2206,13 +2099,11 @@ public:
     mTimestamp.Construct(now);
   }
 };
-#endif
 
 NS_IMETHODIMP
 PeerConnectionImpl::GetStats(MediaStreamTrack *aSelector) {
   PC_AUTO_ENTER_API_CALL(true);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (!mMedia) {
     // Since we zero this out before the d'tor, we should check.
     return NS_ERROR_UNEXPECTED;
@@ -2229,7 +2120,6 @@ PeerConnectionImpl::GetStats(MediaStreamTrack *aSelector) {
                                mHandle,
                                query),
                 NS_DISPATCH_NORMAL);
-#endif
   return NS_OK;
 }
 
@@ -2252,7 +2142,6 @@ PeerConnectionImpl::AddIceCandidate(const char* aCandidate, const char* aMid, un
 
   CSFLogDebug(logTag, "AddIceCandidate: %s", aCandidate);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // When remote candidates are added before our ICE ctx is up and running
   // (the transition to New is async through STS, so this is not impossible),
   // we won't record them as trickle candidates. Is this what we want?
@@ -2266,7 +2155,6 @@ PeerConnectionImpl::AddIceCandidate(const char* aCandidate, const char* aMid, un
                             timeDelta.ToMilliseconds());
     }
   }
-#endif
 
   nsresult res = mJsepSession->AddRemoteIceCandidate(aCandidate, aMid, aLevel);
 
@@ -2322,7 +2210,6 @@ PeerConnectionImpl::CloseStreams() {
   return NS_OK;
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 nsresult
 PeerConnectionImpl::SetPeerIdentity(const nsAString& aPeerIdentity)
 {
@@ -2346,7 +2233,6 @@ PeerConnectionImpl::SetPeerIdentity(const nsAString& aPeerIdentity)
   }
   return NS_OK;
 }
-#endif
 
 nsresult
 PeerConnectionImpl::SetDtlsConnected(bool aPrivacyRequested)
@@ -2357,7 +2243,6 @@ PeerConnectionImpl::SetDtlsConnected(bool aPrivacyRequested)
   // fixate on that peer.  Dealing with multiple peers or connections is more
   // than this run-down wreck of an object can handle.
   // Besides, this is only used to say if we have been connected ever.
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (!mPrivacyRequested && !aPrivacyRequested && !mDtlsConnected) {
     // now we know that privacy isn't needed for sure
     nsIDocument* doc = GetWindow()->GetExtantDoc();
@@ -2367,13 +2252,11 @@ PeerConnectionImpl::SetDtlsConnected(bool aPrivacyRequested)
     }
     mMedia->UpdateRemoteStreamPrincipals_m(doc->NodePrincipal());
   }
-#endif
   mDtlsConnected = true;
   mPrivacyRequested = mPrivacyRequested || aPrivacyRequested;
   return NS_OK;
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 void
 PeerConnectionImpl::PrincipalChanged(MediaStreamTrack* aTrack) {
   nsIDocument* doc = GetWindow()->GetExtantDoc();
@@ -2383,30 +2266,21 @@ PeerConnectionImpl::PrincipalChanged(MediaStreamTrack* aTrack) {
     CSFLogInfo(logTag, "Can't update sink principal; document gone");
   }
 }
-#endif
 
 std::string
 PeerConnectionImpl::GetTrackId(const MediaStreamTrack& aTrack)
 {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   nsString wideTrackId;
   aTrack.GetId(wideTrackId);
   return NS_ConvertUTF16toUTF8(wideTrackId).get();
-#else
-  return aTrack.GetId();
-#endif
 }
 
 std::string
 PeerConnectionImpl::GetStreamId(const DOMMediaStream& aStream)
 {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   nsString wideStreamId;
   aStream.GetId(wideStreamId);
   return NS_ConvertUTF16toUTF8(wideStreamId).get();
-#else
-  return aStream.GetId();
-#endif
 }
 
 void
@@ -2445,9 +2319,7 @@ PeerConnectionImpl::AddTrack(MediaStreamTrack& aTrack,
                       trackId.c_str(), streamId.c_str());
 
   aTrack.AddPrincipalChangeObserver(this);
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   PrincipalChanged(&aTrack);
-#endif
 
   if (aTrack.AsAudioStreamTrack()) {
     res = AddTrackToJsepSession(SdpMediaSection::kAudio, streamId, trackId);
@@ -2458,13 +2330,11 @@ PeerConnectionImpl::AddTrack(MediaStreamTrack& aTrack,
   }
 
   if (aTrack.AsVideoStreamTrack()) {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
     if (!Preferences::GetBool("media.peerconnection.video.enabled", true)) {
       // Before this code was moved, this would silently ignore just like it
       // does now. Is this actually what we want to do?
       return NS_OK;
     }
-#endif
 
     res = AddTrackToJsepSession(SdpMediaSection::kVideo, streamId, trackId);
     if (NS_FAILED(res)) {
@@ -2500,7 +2370,6 @@ PeerConnectionImpl::RemoveTrack(MediaStreamTrack& aTrack) {
 
   std::string trackId = PeerConnectionImpl::GetTrackId(aTrack);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   nsString wideTrackId;
   aTrack.GetId(wideTrackId);
   for (size_t i = 0; i < mDTMFStates.Length(); ++i) {
@@ -2510,7 +2379,6 @@ PeerConnectionImpl::RemoveTrack(MediaStreamTrack& aTrack) {
       break;
     }
   }
-#endif
 
   RefPtr<LocalSourceStreamInfo> info = media()->GetLocalStreamByTrackId(trackId);
 
@@ -2557,7 +2425,6 @@ NS_IMETHODIMP
 PeerConnectionImpl::InsertDTMF(mozilla::dom::RTCRtpSender& sender,
                                const nsAString& tones, uint32_t duration,
                                uint32_t interToneGap) {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   PC_AUTO_ENTER_API_CALL(false);
 
   // Check values passed in from PeerConnection.js
@@ -2616,14 +2483,12 @@ PeerConnectionImpl::InsertDTMF(mozilla::dom::RTCRtpSender& sender,
     state->mSendTimer->InitWithFuncCallback(DTMFSendTimerCallback_m, state, 0,
                                             nsITimer::TYPE_ONE_SHOT);
   }
-#endif
   return NS_OK;
 }
 
 NS_IMETHODIMP
 PeerConnectionImpl::GetDTMFToneBuffer(mozilla::dom::RTCRtpSender& sender,
                                       nsAString& outToneBuffer) {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   PC_AUTO_ENTER_API_CALL(false);
 
   JSErrorResult jrv;
@@ -2645,7 +2510,6 @@ PeerConnectionImpl::GetDTMFToneBuffer(mozilla::dom::RTCRtpSender& sender,
       break;
     }
   }
-#endif
 
   return NS_OK;
 }
@@ -2655,7 +2519,6 @@ PeerConnectionImpl::ReplaceTrack(MediaStreamTrack& aThisTrack,
                                  MediaStreamTrack& aWithTrack) {
   PC_AUTO_ENTER_API_CALL(true);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   nsString trackId;
   aThisTrack.GetId(trackId);
 
@@ -2666,7 +2529,6 @@ PeerConnectionImpl::ReplaceTrack(MediaStreamTrack& aThisTrack,
       break;
     }
   }
-#endif
 
   RefPtr<PeerConnectionObserver> pco = do_QueryObjectReferent(mPCObserver);
   if (!pco) {
@@ -2674,7 +2536,6 @@ PeerConnectionImpl::ReplaceTrack(MediaStreamTrack& aThisTrack,
   }
   JSErrorResult jrv;
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (&aThisTrack == &aWithTrack) {
     pco->OnReplaceTrackSuccess(jrv);
     if (jrv.Failed()) {
@@ -2699,7 +2560,6 @@ PeerConnectionImpl::ReplaceTrack(MediaStreamTrack& aThisTrack,
     }
     return NS_OK;
   }
-#endif
   std::string origTrackId = PeerConnectionImpl::GetTrackId(aThisTrack);
   std::string newTrackId = PeerConnectionImpl::GetTrackId(aWithTrack);
 
@@ -2749,9 +2609,7 @@ PeerConnectionImpl::ReplaceTrack(MediaStreamTrack& aThisTrack,
   }
   aThisTrack.RemovePrincipalChangeObserver(this);
   aWithTrack.AddPrincipalChangeObserver(this);
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   PrincipalChanged(&aWithTrack);
-#endif
 
   // We update the media pipelines here so we can apply different codec
   // settings for different sources (e.g. screensharing as opposed to camera.)
@@ -2771,7 +2629,6 @@ PeerConnectionImpl::ReplaceTrack(MediaStreamTrack& aThisTrack,
   return NS_OK;
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 NS_IMETHODIMP
 PeerConnectionImpl::SetParameters(MediaStreamTrack& aTrack,
                                   const RTCRtpParameters& aParameters) {
@@ -2793,7 +2650,6 @@ PeerConnectionImpl::SetParameters(MediaStreamTrack& aTrack,
   }
   return SetParameters(aTrack, constraints);
 }
-#endif
 
 nsresult
 PeerConnectionImpl::SetParameters(
@@ -2811,7 +2667,6 @@ PeerConnectionImpl::SetParameters(
   return mJsepSession->SetParameters(streamId, trackId, aConstraints);
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 NS_IMETHODIMP
 PeerConnectionImpl::GetParameters(MediaStreamTrack& aTrack,
                                   RTCRtpParameters& aOutParameters) {
@@ -2832,7 +2687,6 @@ PeerConnectionImpl::GetParameters(MediaStreamTrack& aTrack,
   }
   return NS_OK;
 }
-#endif
 
 nsresult
 PeerConnectionImpl::GetParameters(
@@ -2858,11 +2712,7 @@ PeerConnectionImpl::CalculateFingerprint(
   size_t len = 0;
 
   MOZ_ASSERT(fingerprint);
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   const UniqueCERTCertificate& cert = mCertificate->Certificate();
-#else
-  const UniqueCERTCertificate& cert = mIdentity->cert();
-#endif
   nsresult rv = DtlsIdentity::ComputeFingerprint(cert, algorithm,
                                                  &buf[0], sizeof(buf),
                                                  &len);
@@ -2880,9 +2730,7 @@ NS_IMETHODIMP
 PeerConnectionImpl::GetFingerprint(char** fingerprint)
 {
   MOZ_ASSERT(fingerprint);
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   MOZ_ASSERT(mCertificate);
-#endif
   std::vector<uint8_t> fp;
   nsresult rv = CalculateFingerprint(DtlsIdentity::DEFAULT_HASH_ALGORITHM, &fp);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -3000,7 +2848,6 @@ PeerConnectionImpl::PluginCrash(uint32_t aPluginID,
 
   CSFLogError(logTag, "%s: Our plugin %llu crashed", __FUNCTION__, static_cast<unsigned long long>(aPluginID));
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   nsCOMPtr<nsIDocument> doc = mWindow->GetExtantDoc();
   if (!doc) {
     NS_WARNING("Couldn't get document for PluginCrashed event!");
@@ -3022,7 +2869,6 @@ PeerConnectionImpl::PluginCrash(uint32_t aPluginID,
   event->WidgetEventPtr()->mFlags.mOnlyChromeDispatch = true;
 
   EventDispatcher::DispatchDOMEvent(mWindow, nullptr, event, nullptr, nullptr);
-#endif
 
   return true;
 }
@@ -3034,7 +2880,6 @@ PeerConnectionImpl::RecordEndOfCallTelemetry() const
     return;
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // Bitmask used for WEBRTC/LOOP_CALL_TYPE telemetry reporting
   static const uint32_t kAudioTypeMask = 1;
   static const uint32_t kVideoTypeMask = 2;
@@ -3072,7 +2917,6 @@ PeerConnectionImpl::RecordEndOfCallTelemetry() const
   }
   Telemetry::Accumulate(Telemetry::WEBRTC_CALL_TYPE,
                         type);
-#endif
 }
 
 nsresult
@@ -3097,14 +2941,12 @@ PeerConnectionImpl::CloseInt()
   if (mJsepSession) {
     mJsepSession->Close();
   }
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (mDataConnection) {
     CSFLogInfo(logTag, "%s: Destroying DataChannelConnection %p for %s",
                __FUNCTION__, (void *) mDataConnection.get(), mHandle.c_str());
     mDataConnection->Destroy();
     mDataConnection = nullptr; // it may not go away until the runnables are dead
   }
-#endif
   ShutdownMedia();
 
   // DataConnection will need to stay alive until all threads/runnables exit
@@ -3120,7 +2962,6 @@ PeerConnectionImpl::ShutdownMedia()
   if (!mMedia)
     return;
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // before we destroy references to local tracks, detach from them
   for(uint32_t i = 0; i < media()->LocalStreamsLength(); ++i) {
     LocalSourceStreamInfo *info = media()->GetLocalStreamByIndex(i);
@@ -3135,7 +2976,6 @@ PeerConnectionImpl::ShutdownMedia()
     Telemetry::Accumulate(Telemetry::WEBRTC_CALL_DURATION,
                           timeDelta.ToSeconds());
   }
-#endif
 
   // Forget the reference so that we can transfer it to
   // SelfDestruct().
@@ -3419,7 +3259,6 @@ PeerConnectionImpl::SendLocalIceCandidateToContent(
       NS_DISPATCH_NORMAL);
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 static bool isDone(PCImplIceConnectionState state) {
   return state != PCImplIceConnectionState::Checking &&
          state != PCImplIceConnectionState::New;
@@ -3433,7 +3272,6 @@ static bool isSucceeded(PCImplIceConnectionState state) {
 static bool isFailed(PCImplIceConnectionState state) {
   return state == PCImplIceConnectionState::Failed;
 }
-#endif
 
 void PeerConnectionImpl::IceConnectionStateChange(
     NrIceCtx* ctx,
@@ -3449,7 +3287,6 @@ void PeerConnectionImpl::IceConnectionStateChange(
     return;
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   if (!isDone(mIceConnectionState) && isDone(domState)) {
     // mIceStartTime can be null if going directly from New to Closed, in which
     // case we don't count it as a success or a failure.
@@ -3474,7 +3311,6 @@ void PeerConnectionImpl::IceConnectionStateChange(
           mAddCandidateErrorCount);
     }
   }
-#endif
 
   mIceConnectionState = domState;
 
@@ -3493,10 +3329,8 @@ void PeerConnectionImpl::IceConnectionStateChange(
       STAMP_TIMECARD(mTimeCard, "Ice state: new");
       break;
     case PCImplIceConnectionState::Checking:
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
       // For telemetry
       mIceStartTime = TimeStamp::Now();
-#endif
       STAMP_TIMECARD(mTimeCard, "Ice state: checking");
       break;
     case PCImplIceConnectionState::Connected:
@@ -3595,7 +3429,6 @@ PeerConnectionImpl::EndOfLocalCandidates(uint16_t level) {
   mJsepSession->EndOfLocalCandidates(level);
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 nsresult
 PeerConnectionImpl::BuildStatsQuery_m(
     mozilla::dom::MediaStreamTrack *aSelector,
@@ -4026,13 +3859,9 @@ void PeerConnectionImpl::DeliverStatsReportToPCObserver_m(
   }
 }
 
-#endif
-
 void
 PeerConnectionImpl::RecordLongtermICEStatistics() {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   WebrtcGlobalInformation::StoreLongTermICEStatistics(*this);
-#endif
 }
 
 void
@@ -4092,7 +3921,6 @@ PeerConnectionImpl::IceStreamReady(NrIceMediaStream *aStream)
   CSFLogDebug(logTag, "%s: %s", __FUNCTION__, aStream->name().c_str());
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 //Telemetry for when calls start
 void
 PeerConnectionImpl::startCallTelem() {
@@ -4107,38 +3935,29 @@ PeerConnectionImpl::startCallTelem() {
   // If we want to track Loop calls independently here, we need two histograms.
   Telemetry::Accumulate(Telemetry::WEBRTC_CALL_COUNT_2, 1);
 }
-#endif
 
 NS_IMETHODIMP
 PeerConnectionImpl::GetLocalStreams(nsTArray<RefPtr<DOMMediaStream > >& result)
 {
   PC_AUTO_ENTER_API_CALL_NO_CHECK();
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   for(uint32_t i=0; i < media()->LocalStreamsLength(); i++) {
     LocalSourceStreamInfo *info = media()->GetLocalStreamByIndex(i);
     NS_ENSURE_TRUE(info, NS_ERROR_UNEXPECTED);
     result.AppendElement(info->GetMediaStream());
   }
   return NS_OK;
-#else
-  return NS_ERROR_FAILURE;
-#endif
 }
 
 NS_IMETHODIMP
 PeerConnectionImpl::GetRemoteStreams(nsTArray<RefPtr<DOMMediaStream > >& result)
 {
   PC_AUTO_ENTER_API_CALL_NO_CHECK();
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   for(uint32_t i=0; i < media()->RemoteStreamsLength(); i++) {
     RemoteSourceStreamInfo *info = media()->GetRemoteStreamByIndex(i);
     NS_ENSURE_TRUE(info, NS_ERROR_UNEXPECTED);
     result.AppendElement(info->GetMediaStream());
   }
   return NS_OK;
-#else
-  return NS_ERROR_FAILURE;
-#endif
 }
 
 void
@@ -4183,7 +4002,6 @@ PeerConnectionImpl::DTMFSendTimerCallback_m(nsITimer* timer, void* closure)
     state->mSendTimer->Cancel();
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   RefPtr<PeerConnectionObserver> pco = do_QueryObjectReferent(state->mPeerConnectionImpl->mPCObserver);
   if (!pco) {
     NS_WARNING("Failed to dispatch the RTCDTMFToneChange event!");
@@ -4197,7 +4015,6 @@ PeerConnectionImpl::DTMFSendTimerCallback_m(nsITimer* timer, void* closure)
     NS_WARNING("Failed to dispatch the RTCDTMFToneChange event!");
     return;
   }
-#endif
 }
 
 }  // end mozilla namespace
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
index d6ad78c6e647..cf3f97b366e0 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
@@ -34,7 +34,6 @@
 #include "PrincipalChangeObserver.h"
 #include "StreamTracks.h"
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "mozilla/TimeStamp.h"
 #include "mozilla/net/DataChannel.h"
 #include "VideoUtils.h"
@@ -42,7 +41,6 @@
 #include "mozilla/dom/RTCStatsReportBinding.h"
 #include "nsIPrincipal.h"
 #include "mozilla/PeerIdentity.h"
-#endif
 
 namespace test {
 #ifdef USE_FAKE_PCOBSERVER
@@ -50,11 +48,6 @@ class AFakePCObserver;
 #endif
 }
 
-#ifdef USE_FAKE_MEDIA_STREAMS
-class Fake_DOMMediaStream;
-class Fake_MediaStreamTrack;
-#endif
-
 class nsGlobalWindow;
 class nsDOMDataChannel;
 
@@ -67,11 +60,7 @@ class NrIceStunServer;
 class NrIceTurnServer;
 class MediaPipeline;
 
-#ifdef USE_FAKE_MEDIA_STREAMS
-typedef Fake_DOMMediaStream DOMMediaStream;
-#else
 class DOMMediaStream;
-#endif
 
 namespace dom {
 class RTCCertificate;
@@ -81,11 +70,7 @@ struct RTCIceServer;
 struct RTCOfferOptions;
 struct RTCRtpParameters;
 class RTCRtpSender;
-#ifdef USE_FAKE_MEDIA_STREAMS
-typedef Fake_MediaStreamTrack MediaStreamTrack;
-#else
 class MediaStreamTrack;
-#endif
 
 #ifdef USE_FAKE_PCOBSERVER
 typedef test::AFakePCObserver PeerConnectionObserver;
@@ -129,9 +114,7 @@ using mozilla::DtlsIdentity;
 using mozilla::ErrorResult;
 using mozilla::NrIceStunServer;
 using mozilla::NrIceTurnServer;
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 using mozilla::PeerIdentity;
-#endif
 
 class PeerConnectionWrapper;
 class PeerConnectionMedia;
@@ -189,10 +172,8 @@ public:
   void setIceTransportPolicy(NrIceCtx::Policy policy) { mIceTransportPolicy = policy;}
   NrIceCtx::Policy getIceTransportPolicy() const { return mIceTransportPolicy; }
 
-#ifndef MOZILLA_EXTERNAL_LINKAGE
   nsresult Init(const RTCConfiguration& aSrc);
   nsresult AddIceServer(const RTCIceServer& aServer);
-#endif
 
 private:
   std::vector<NrIceStunServer> mStunServers;
@@ -201,7 +182,6 @@ private:
   NrIceCtx::Policy mIceTransportPolicy;
 };
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 // Not an inner class so we can forward declare.
 class RTCStatsQuery {
   public:
@@ -224,7 +204,6 @@ class RTCStatsQuery {
     bool grabAllLevels;
     DOMHighResTimeStamp now;
 };
-#endif // MOZILLA_INTERNAL_API
 
 // Enter an API call and check that the state is OK,
 // the PC isn't closed, etc.
@@ -243,10 +222,8 @@ class RTCStatsQuery {
 #define PC_AUTO_ENTER_API_CALL_NO_CHECK() CheckThread()
 
 class PeerConnectionImpl final : public nsISupports,
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
                                  public mozilla::DataChannelConnection::DataConnectionListener,
                                  public dom::PrincipalChangeObserver<dom::MediaStreamTrack>,
-#endif
                                  public sigslot::has_slots<>
 {
   struct Internal; // Avoid exposing c includes to bindings
@@ -267,9 +244,7 @@ public:
 
   NS_DECL_THREADSAFE_ISUPPORTS
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   bool WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto, JS::MutableHandle<JSObject*> aReflector);
-#endif
 
   static already_AddRefed<PeerConnectionImpl>
       Constructor(const mozilla::dom::GlobalObject& aGlobal, ErrorResult& rv);
@@ -281,11 +256,9 @@ public:
 
   // DataConnection observers
   void NotifyDataChannel(already_AddRefed<mozilla::DataChannel> aChannel)
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
     // PeerConnectionImpl only inherits from mozilla::DataChannelConnection
     // inside libxul.
     override
-#endif
     ;
 
   // Get the media object
@@ -349,19 +322,15 @@ public:
                       const PeerConnectionConfiguration& aConfiguration,
                       nsISupports* aThread);
 
-#ifndef MOZILLA_EXTERNAL_LINKAGE
   // Initialize PeerConnection from an RTCConfiguration object (JS entrypoint)
   void Initialize(PeerConnectionObserver& aObserver,
                   nsGlobalWindow& aWindow,
                   const RTCConfiguration& aConfiguration,
                   nsISupports* aThread,
                   ErrorResult &rv);
-#endif
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   void SetCertificate(mozilla::dom::RTCCertificate& aCertificate);
   const RefPtr<mozilla::dom::RTCCertificate>& Certificate() const;
-#endif
   // This is a hack to support external linkage.
   RefPtr<DtlsIdentity> Identity() const;
 
@@ -459,7 +428,6 @@ public:
     rv = ReplaceTrack(aThisTrack, aWithTrack);
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   NS_IMETHODIMP_TO_ERRORRESULT(SetParameters, ErrorResult &rv,
                                dom::MediaStreamTrack& aTrack,
                                const dom::RTCRtpParameters& aParameters)
@@ -473,7 +441,6 @@ public:
   {
     rv = GetParameters(aTrack, aOutParameters);
   }
-#endif
 
   nsresult
   SetParameters(dom::MediaStreamTrack& aTrack,
@@ -492,18 +459,15 @@ public:
 
   nsresult GetPeerIdentity(nsAString& peerIdentity)
   {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
     if (mPeerIdentity) {
       peerIdentity = mPeerIdentity->ToString();
       return NS_OK;
     }
-#endif
 
     peerIdentity.SetIsVoid(true);
     return NS_OK;
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   const PeerIdentity* GetPeerIdentity() const { return mPeerIdentity; }
   nsresult SetPeerIdentity(const nsAString& peerIdentity);
 
@@ -523,7 +487,6 @@ public:
     mName = NS_ConvertUTF16toUTF8(id).get();
     return NS_OK;
   }
-#endif
 
   // this method checks to see if we've made a promise to protect media.
   bool PrivacyRequested() const { return mPrivacyRequested; }
@@ -648,7 +611,6 @@ public:
 
   bool HasMedia() const;
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // initialize telemetry for when calls start
   void startCallTelem();
 
@@ -662,8 +624,6 @@ public:
   // PeerConnectionMedia can't do it because it doesn't know about principals
   virtual void PrincipalChanged(dom::MediaStreamTrack* aTrack) override;
 
-#endif
-
   static std::string GetStreamId(const DOMMediaStream& aStream);
   static std::string GetTrackId(const dom::MediaStreamTrack& track);
 
@@ -685,22 +645,13 @@ private:
     MOZ_ASSERT(CheckThreadInt(), "Wrong thread");
   }
   bool CheckThreadInt() const {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
-    // Thread assertions are disabled in the C++ unit tests because those
-    // make API calls off the main thread.
-    // This affects the standalone version of WebRTC since it is also used
-    // for an alternate build of the unit tests.
-    // TODO(ekr@rtfm.com): Fix the unit tests so they don't do that.
     bool on;
     NS_ENSURE_SUCCESS(mThread->IsOnCurrentThread(&on), false);
     NS_ENSURE_TRUE(on, false);
-#endif
     return true;
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   nsresult GetTimeSinceEpoch(DOMHighResTimeStamp *result);
-#endif
 
   // Shut down media - called on main thread only
   void ShutdownMedia();
@@ -729,7 +680,6 @@ private:
   nsresult RollbackIceRestart();
   void FinalizeIceRestart();
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   static void GetStatsForPCObserver_s(
       const std::string& pcHandle,
       nsAutoPtr<RTCStatsQuery> query);
@@ -739,7 +689,6 @@ private:
       const std::string& pcHandle,
       nsresult result,
       nsAutoPtr<RTCStatsQuery> query);
-#endif
 
   // When ICE completes, we record a bunch of statistics that outlive the
   // PeerConnection. This is just telemetry right now, but this can also
@@ -782,15 +731,11 @@ private:
   std::string mRemoteFingerprint;
 
   // identity-related fields
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // The entity on the other end of the peer-to-peer connection;
   // void if they are not yet identified, and no identity setting has been set
   RefPtr<PeerIdentity> mPeerIdentity;
   // The certificate we are using.
   RefPtr<mozilla::dom::RTCCertificate> mCertificate;
-#else
-  RefPtr<DtlsIdentity> mIdentity;
-#endif
   // Whether an app should be prevented from accessing media produced by the PC
   // If this is true, then media will not be sent until mPeerIdentity matches
   // local streams PeerIdentity; and remote streams are protected from content
@@ -808,10 +753,8 @@ private:
   // The target to run stuff on
   nsCOMPtr<nsIEventTarget> mSTSThread;
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // DataConnection that's used to get all the DataChannels
   RefPtr<mozilla::DataChannelConnection> mDataConnection;
-#endif
 
   bool mAllowIceLoopback;
   bool mAllowIceLinkLocal;
@@ -824,12 +767,10 @@ private:
   std::string mPreviousIceUfrag; // used during rollback of ice restart
   std::string mPreviousIcePwd; // used during rollback of ice restart
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // Start time of ICE, used for telemetry
   mozilla::TimeStamp mIceStartTime;
   // Start time of call used for Telemetry
   mozilla::TimeStamp mStartTime;
-#endif
 
   // Temporary: used to prevent multiple audio streams or multiple video streams
   // in a single PC. This is tied up in the IETF discussion around proper
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
index ec94bab3688f..ebf667ac4a15 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
@@ -23,19 +23,12 @@
 #include "signaling/src/jsep/JsepSession.h"
 #include "signaling/src/jsep/JsepTransport.h"
 
-#ifdef USE_FAKE_STREAMS
-#include "DOMMediaStream.h"
-#include "FakeMediaStreams.h"
-#else
 #include "MediaSegment.h"
 #ifdef MOZILLA_INTERNAL_API
 #include "MediaStreamGraph.h"
 #endif
-#endif
 
-#ifndef USE_FAKE_MEDIA_STREAMS
 #include "MediaStreamGraphImpl.h"
-#endif
 
 #include "nsNetCID.h"
 #include "nsNetUtil.h"
@@ -49,7 +42,6 @@
 
 #include "nsProxyRelease.h"
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "MediaStreamList.h"
 #include "nsIScriptGlobalObject.h"
 #include "mozilla/Preferences.h"
@@ -59,7 +51,6 @@
 #include "VideoStreamTrack.h"
 #include "MediaStreamError.h"
 #include "MediaManager.h"
-#endif
 
 
 
@@ -131,7 +122,6 @@ SourceStreamInfo::EndTrack(MediaStream* stream, dom::MediaStreamTrack* track)
     return;
   }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   class Message : public ControlMessage {
    public:
     Message(MediaStream* stream, TrackID track)
@@ -147,8 +137,6 @@ SourceStreamInfo::EndTrack(MediaStream* stream, dom::MediaStreamTrack* track)
 
   stream->GraphImpl()->AppendMessage(
       MakeUnique<Message>(stream, track->mTrackID));
-#endif
-
 }
 
 void
@@ -289,7 +277,6 @@ PeerConnectionMedia::PeerConnectionMedia(PeerConnectionImpl *parent)
 nsresult
 PeerConnectionMedia::InitProxy()
 {
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // Allow mochitests to disable this, since mochitest configures a fake proxy
   // that serves up content.
   bool disable = Preferences::GetBool("media.peerconnection.disable_http_proxy",
@@ -298,7 +285,6 @@ PeerConnectionMedia::InitProxy()
     mProxyResolveCompleted = true;
     return NS_OK;
   }
-#endif
 
   nsresult rv;
   nsCOMPtr<nsIProtocolProxyService> pps =
@@ -367,11 +353,7 @@ nsresult PeerConnectionMedia::Init(const std::vector<NrIceStunServer>& stun_serv
   nsresult rv = InitProxy();
   NS_ENSURE_SUCCESS(rv, rv);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   bool ice_tcp = Preferences::GetBool("media.peerconnection.ice.tcp", false);
-#else
-  bool ice_tcp = false;
-#endif
 
   // TODO(ekr@rtfm.com): need some way to set not offerer later
   // Looks like a bug in the NrIceCtx API.
@@ -391,11 +373,7 @@ nsresult PeerConnectionMedia::Init(const std::vector<NrIceStunServer>& stun_serv
     return rv;
   }
   // Give us a way to globally turn off TURN support
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   bool disabled = Preferences::GetBool("media.peerconnection.turn.disable", false);
-#else
-  bool disabled = false;
-#endif
   if (!disabled) {
     if (NS_FAILED(rv = mIceCtxHdlr->ctx()->SetTurnServers(turn_servers))) {
       CSFLogError(logTag, "%s: Failed to set turn servers", __FUNCTION__);
@@ -798,16 +776,12 @@ PeerConnectionMedia::GetPrefDefaultAddressOnly() const
 {
   ASSERT_ON_THREAD(mMainThread); // will crash on STS thread
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   uint64_t winId = mParent->GetWindow()->WindowID();
 
   bool default_address_only = Preferences::GetBool(
     "media.peerconnection.ice.default_address_only", false);
   default_address_only |=
     !MediaManager::Get()->IsActivelyCapturingOrHasAPermission(winId);
-#else
-  bool default_address_only = true;
-#endif
   return default_address_only;
 }
 
@@ -816,11 +790,7 @@ PeerConnectionMedia::GetPrefProxyOnly() const
 {
   ASSERT_ON_THREAD(mMainThread); // will crash on STS thread
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   return Preferences::GetBool("media.peerconnection.ice.proxy_only", false);
-#else
-  return false;
-#endif
 }
 
 void
@@ -1478,7 +1448,6 @@ LocalSourceStreamInfo::TakePipelineFrom(RefPtr<LocalSourceStreamInfo>& info,
   return NS_OK;
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 /**
  * Tells you if any local track is isolated to a specific peer identity.
  * Obviously, we want all the tracks to be isolated equally so that they can
@@ -1557,7 +1526,6 @@ void RemoteSourceStreamInfo::UpdatePrincipal_m(nsIPrincipal* aPrincipal)
     }
   }
 }
-#endif // MOZILLA_INTERNAL_API
 
 bool
 PeerConnectionMedia::AnyCodecHasPluginID(uint64_t aPluginID)
@@ -1709,7 +1677,6 @@ LocalSourceStreamInfo::ForgetPipelineByTrackId_m(const std::string& trackId)
   return nullptr;
 }
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 auto
 RemoteTrackSource::ApplyConstraints(
     nsPIDOMWindowInner* aWindow,
@@ -1722,6 +1689,5 @@ RemoteTrackSource::ApplyConstraints(
                                       NS_LITERAL_STRING("")));
   return p.forget();
 }
-#endif
 
 } // namespace mozilla
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
index 47401631fa86..6fff17a95118 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
@@ -20,13 +20,11 @@
 #include "signaling/src/jsep/JsepSession.h"
 #include "AudioSegment.h"
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "Layers.h"
 #include "VideoUtils.h"
 #include "ImageLayers.h"
 #include "VideoSegment.h"
 #include "MediaStreamTrack.h"
-#endif
 
 class nsIPrincipal;
 
@@ -143,11 +141,9 @@ public:
                             dom::MediaStreamTrack& aNewTrack,
                             const std::string& newTrackId);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   void UpdateSinkIdentity_m(dom::MediaStreamTrack* aTrack,
                             nsIPrincipal* aPrincipal,
                             const PeerIdentity* aSinkIdentity);
-#endif
 
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(LocalSourceStreamInfo)
 
@@ -156,7 +152,6 @@ private:
       const std::string& trackId);
 };
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
 class RemoteTrackSource : public dom::MediaStreamTrackSource
 {
 public:
@@ -188,7 +183,6 @@ public:
 protected:
   virtual ~RemoteTrackSource() {}
 };
-#endif
 
 class RemoteSourceStreamInfo : public SourceStreamInfo {
   ~RemoteSourceStreamInfo() {}
@@ -205,9 +199,7 @@ class RemoteSourceStreamInfo : public SourceStreamInfo {
   void RemoveTrack(const std::string& trackId) override;
   void SyncPipeline(RefPtr<MediaPipelineReceive> aPipeline);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   void UpdatePrincipal_m(nsIPrincipal* aPrincipal);
-#endif
 
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(RemoteSourceStreamInfo)
 
@@ -339,7 +331,6 @@ class PeerConnectionMedia : public sigslot::has_slots<> {
                         const std::string& aNewStreamId,
                         const std::string& aNewTrackId);
 
-#if !defined(MOZILLA_EXTERNAL_LINKAGE)
   // In cases where the peer isn't yet identified, we disable the pipeline (not
   // the stream, that would potentially affect others), so that it sends
   // black/silence.  Once the peer is identified, re-enable those streams.
@@ -352,7 +343,6 @@ class PeerConnectionMedia : public sigslot::has_slots<> {
   // When we finally learn who is on the other end, we need to change the ownership
   // on streams
   void UpdateRemoteStreamPrincipals_m(nsIPrincipal* aPrincipal);
-#endif
 
   bool AnyCodecHasPluginID(uint64_t aPluginID);
 
diff --git a/media/webrtc/signaling/test/moz.build b/media/webrtc/signaling/test/moz.build
index c8cdbdb6013b..c12b6fd5743f 100644
--- a/media/webrtc/signaling/test/moz.build
+++ b/media/webrtc/signaling/test/moz.build
@@ -13,8 +13,6 @@ include('/ipc/chromium/chromium-config.mozbuild')
 include('common.build')
 
 USE_LIBS += [
-    '/media/webrtc/signalingtest/signaling_ecc/ecc',
-    'mtransport_s',
 ]
 
 if CONFIG['GNU_CXX']:
diff --git a/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java b/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
index 4c46db4fcee5..4abe5fd9734c 100644
--- a/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
+++ b/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
@@ -12,6 +12,7 @@ import android.content.ContentProviderClient;
 import android.os.Environment;
 import android.os.Process;
 import android.support.annotation.NonNull;
+import android.support.annotation.UiThread;
 
 import android.graphics.Rect;
 
@@ -923,6 +924,25 @@ public class BrowserApp extends GeckoApp
         }
     }
 
+    /**
+     * Code to actually show the first run pager, separated
+     * for distribution purposes.
+     */
+    @UiThread
+    private void checkFirstrunInternal() {
+        showFirstrunPager();
+
+        if (HardwareUtils.isTablet()) {
+            mTabStrip.setOnTabChangedListener(new TabStripInterface.OnTabAddedOrRemovedListener() {
+                @Override
+                public void onTabChanged() {
+                    hideFirstrunPager(TelemetryContract.Method.BUTTON);
+                    mTabStrip.setOnTabChangedListener(null);
+                }
+            });
+        }
+    }
+
     /**
      * Check and show the firstrun pane if the browser has never been launched and
      * is not opening an external link from another application.
@@ -946,16 +966,40 @@ public class BrowserApp extends GeckoApp
         try {
             final SharedPreferences prefs = GeckoSharedPrefs.forProfile(this);
 
-            if (prefs.getBoolean(FirstrunAnimationContainer.PREF_FIRSTRUN_ENABLED, true)) {
+            if (prefs.getBoolean(FirstrunAnimationContainer.PREF_FIRSTRUN_ENABLED_OLD, true) &&
+                prefs.getBoolean(FirstrunAnimationContainer.PREF_FIRSTRUN_ENABLED, true)) {
                 if (!Intent.ACTION_VIEW.equals(intent.getAction())) {
-                    showFirstrunPager();
-
-                    if (HardwareUtils.isTablet()) {
-                        mTabStrip.setOnTabChangedListener(new TabStripInterface.OnTabAddedOrRemovedListener() {
+                    // Check to see if a distribution has turned off the first run pager.
+                    final Distribution distribution = Distribution.getInstance(BrowserApp.this);
+                    if (!distribution.shouldWaitForSystemDistribution()) {
+                        checkFirstrunInternal();
+                    } else {
+                        distribution.addOnDistributionReadyCallback(new Distribution.ReadyCallback() {
                             @Override
-                            public void onTabChanged() {
-                                hideFirstrunPager(TelemetryContract.Method.BUTTON);
-                                mTabStrip.setOnTabChangedListener(null);
+                            public void distributionNotFound() {
+                                ThreadUtils.postToUiThread(new Runnable() {
+                                    @Override
+                                    public void run() {
+                                        checkFirstrunInternal();
+                                    }
+                                });
+                            }
+
+                            @Override
+                            public void distributionFound(final Distribution distribution) {
+                                // Check preference again in case distribution turned it off.
+                                if (prefs.getBoolean(FirstrunAnimationContainer.PREF_FIRSTRUN_ENABLED, true)) {
+                                    ThreadUtils.postToUiThread(new Runnable() {
+                                        @Override
+                                        public void run() {
+                                            checkFirstrunInternal();
+                                        }
+                                    });
+                                }
+                            }
+
+                            @Override
+                            public void distributionArrivedLate(final Distribution distribution) {
                             }
                         });
                     }
diff --git a/mobile/android/base/java/org/mozilla/gecko/distribution/Distribution.java b/mobile/android/base/java/org/mozilla/gecko/distribution/Distribution.java
index a7b0fe32d360..3f461f65ee6c 100644
--- a/mobile/android/base/java/org/mozilla/gecko/distribution/Distribution.java
+++ b/mobile/android/base/java/org/mozilla/gecko/distribution/Distribution.java
@@ -226,6 +226,11 @@ public class Distribution {
                     String preferencesJSON = "";
                     try {
                         final File descFile = distribution.getDistributionFile("preferences.json");
+                        if (descFile == null) {
+                            // This can happen if we have a distribution directory, but no
+                            // preferences.json file.
+                            throw new IOException("preferences.json not found");
+                        }
                         preferencesJSON = FileUtils.readStringFromFile(descFile);
                     } catch (IOException e) {
                         Log.e(LOGTAG, "Error getting distribution descriptor file.", e);
@@ -690,6 +695,28 @@ public class Distribution {
         return checkDirectories(getSystemDistributionDirectories(context));
     }
 
+    /**
+     * @return true if we should wait for a system distribution to load.
+     * Not applicable to APK or OTA distributions.
+     */
+    public boolean shouldWaitForSystemDistribution() {
+        if (state == STATE_NONE) {
+            return false;
+        }
+        if (state == STATE_SET) {
+            return true;
+        }
+
+        final String[] directories = getSystemDistributionDirectories(context);
+        for (String path : directories) {
+            final File directory = new File(path);
+            if (directory.exists()) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     /**
      * @return true if one of the specified distribution directories exists.  Sets distributionDir in that case.
      */
diff --git a/mobile/android/base/java/org/mozilla/gecko/firstrun/FirstrunAnimationContainer.java b/mobile/android/base/java/org/mozilla/gecko/firstrun/FirstrunAnimationContainer.java
index 93dd0c254e36..02d6d688f5cf 100644
--- a/mobile/android/base/java/org/mozilla/gecko/firstrun/FirstrunAnimationContainer.java
+++ b/mobile/android/base/java/org/mozilla/gecko/firstrun/FirstrunAnimationContainer.java
@@ -18,13 +18,16 @@ import org.mozilla.gecko.R;
 import org.mozilla.gecko.Telemetry;
 import org.mozilla.gecko.TelemetryContract;
 import org.mozilla.gecko.Experiments;
+import org.mozilla.gecko.preferences.GeckoPreferences;
 
 /**
  * A container for the pager and the entire first run experience.
  * This is used for animation purposes.
  */
 public class FirstrunAnimationContainer extends LinearLayout {
-    public static final String PREF_FIRSTRUN_ENABLED = "startpane_enabled";
+    // See bug 1330714. Need NON_PREF_PREFIX to set from distribution.
+    public static final String PREF_FIRSTRUN_ENABLED_OLD = "startpane_enabled";
+    public static final String PREF_FIRSTRUN_ENABLED = GeckoPreferences.NON_PREF_PREFIX + "startpane_enabled";
 
     public static interface OnFinishListener {
         public void onFinish();
diff --git a/mobile/locales/l10n-changesets.json b/mobile/locales/l10n-changesets.json
new file mode 100644
index 000000000000..5d1cda1d88d8
--- /dev/null
+++ b/mobile/locales/l10n-changesets.json
@@ -0,0 +1,315 @@
+{
+    "ar": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "ca": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "cs": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "da": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "de": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "es-AR": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "es-ES": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "et": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "eu": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "fa": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "fi": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "fr": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "fy-NL": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "ga-IE": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "gd": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "gl": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "he": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "hu": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "id": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "it": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "ja": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "ko": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "lt": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "nb-NO": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "nl": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "nn-NO": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "pa-IN": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "pl": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "pt-BR": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "pt-PT": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "ro": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "ru": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "sk": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "sl": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "sq": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "sr": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "sv-SE": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "th": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "tr": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "uk": {
+        "platforms": [
+            "android", 
+            "android-api-15"
+        ], 
+        "revision": "default"
+    }, 
+    "zh-CN": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }, 
+    "zh-TW": {
+        "platforms": [
+            "android", 
+            "android-api-15", 
+            "android-multilocale"
+        ], 
+        "revision": "default"
+    }
+}
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index afb0347d0c38..e12bb4387678 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -2915,6 +2915,8 @@ pref("dom.ipc.plugins.asyncdrawing.enabled", false);
 #else
 // Allow the AsyncDrawing mode to be used for plugins in dev channels.
 pref("dom.ipc.plugins.asyncdrawing.enabled", true);
+// Force the accelerated path for a subset of Flash wmode values
+pref("dom.ipc.plugins.forcedirect.enabled", true);
 #endif
 
 #ifdef NIGHTLY_BUILD
@@ -2923,6 +2925,9 @@ pref("dom.ipc.processCount", 2);
 pref("dom.ipc.processCount", 1);
 #endif
 
+// WebExtensions only support a single extension process.
+pref("dom.ipc.processCount.extension", 1);
+
 // Disable support for SVG
 pref("svg.disabled", false);
 
diff --git a/netwerk/base/RustURL.cpp b/netwerk/base/RustURL.cpp
index b7df783e793a..02c5bcb4bf9c 100644
--- a/netwerk/base/RustURL.cpp
+++ b/netwerk/base/RustURL.cpp
@@ -315,7 +315,7 @@ RustURL::SchemeIs(const char * aScheme, bool *aRetVal)
   if (NS_FAILED(rv)) {
     return rv;
   }
-  if (scheme.Equals(aScheme)) {
+  if (scheme.Equals(aScheme, nsCaseInsensitiveCStringComparator())) {
     *aRetVal = true;
   }
   return NS_OK;
diff --git a/netwerk/base/nsNetUtil.cpp b/netwerk/base/nsNetUtil.cpp
index d48029d049db..3886a20dda3f 100644
--- a/netwerk/base/nsNetUtil.cpp
+++ b/netwerk/base/nsNetUtil.cpp
@@ -385,14 +385,9 @@ NS_NewInputStreamChannelInternal(nsIChannel        **outChannel,
   stream = do_CreateInstance(NS_STRINGINPUTSTREAM_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-#ifdef MOZILLA_INTERNAL_API
     uint32_t len;
     char* utf8Bytes = ToNewUTF8String(aData, &len);
     rv = stream->AdoptData(utf8Bytes, len);
-#else
-    char* utf8Bytes = ToNewUTF8String(aData);
-    rv = stream->AdoptData(utf8Bytes, strlen(utf8Bytes));
-#endif
 
   nsCOMPtr<nsIChannel> channel;
   rv = NS_NewInputStreamChannelInternal(getter_AddRefs(channel),
@@ -1188,8 +1183,6 @@ NS_ReadInputStreamToBuffer(nsIInputStream *aInputStream,
     return rv;
 }
 
-#ifdef MOZILLA_INTERNAL_API
-
 nsresult
 NS_ReadInputStreamToString(nsIInputStream *aInputStream,
                            nsACString &aDest,
@@ -1201,8 +1194,6 @@ NS_ReadInputStreamToString(nsIInputStream *aInputStream,
     return NS_ReadInputStreamToBuffer(aInputStream, &dest, aCount);
 }
 
-#endif
-
 nsresult
 NS_LoadPersistentPropertiesFromURISpec(nsIPersistentProperties **outResult,
                                        const nsACString         &aSpec)
@@ -1711,11 +1702,7 @@ NS_SecurityCompareURIs(nsIURI *aSourceURI,
         return false;
     }
 
-#ifdef MOZILLA_INTERNAL_API
     if (!targetHost.Equals(sourceHost, nsCaseInsensitiveCStringComparator() ))
-#else
-    if (!targetHost.Equals(sourceHost, CaseInsensitiveCompare))
-#endif
     {
         return false;
     }
diff --git a/netwerk/cache/nsDiskCacheDeviceSQL.cpp b/netwerk/cache/nsDiskCacheDeviceSQL.cpp
index b28bbff89eb2..e5eef60a46b8 100644
--- a/netwerk/cache/nsDiskCacheDeviceSQL.cpp
+++ b/netwerk/cache/nsDiskCacheDeviceSQL.cpp
@@ -9,6 +9,7 @@
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/Sprintf.h"
+#include "mozilla/ThreadLocal.h"
 
 #include "nsCache.h"
 #include "nsDiskCache.h"
@@ -115,13 +116,13 @@ class EvictionObserver
                    nsOfflineCacheEvictionFunction *evictionFunction)
     : mDB(db), mEvictionFunction(evictionFunction)
     {
+      mEvictionFunction->Init();
       mDB->ExecuteSimpleSQL(
           NS_LITERAL_CSTRING("CREATE TEMP TRIGGER cache_on_delete BEFORE DELETE"
                              " ON moz_cache FOR EACH ROW BEGIN SELECT"
                              " cache_eviction_observer("
                              "  OLD.ClientID, OLD.key, OLD.generation);"
                              " END;"));
-      mEvictionFunction->Reset();
     }
 
     ~EvictionObserver()
@@ -187,6 +188,13 @@ GetCacheDataFile(nsIFile *cacheDir, const char *key,
   return file->AppendNative(nsDependentCString(leaf));
 }
 
+namespace appcachedetail {
+
+typedef nsCOMArray<nsIFile> FileArray;
+static MOZ_THREAD_LOCAL(FileArray*) tlsEvictionItems;
+
+} // appcachedetail
+
 NS_IMETHODIMP
 nsOfflineCacheEvictionFunction::OnFunctionCall(mozIStorageValueArray *values, nsIVariant **_retval)
 {
@@ -223,27 +231,69 @@ nsOfflineCacheEvictionFunction::OnFunctionCall(mozIStorageValueArray *values, ns
     return rv;
   }
 
-  mItems.AppendObject(file);
+  appcachedetail::FileArray* items = appcachedetail::tlsEvictionItems.get();
+  MOZ_ASSERT(items);
+  if (items) {
+    items->AppendObject(file);
+  }
 
   return NS_OK;
 }
 
+nsOfflineCacheEvictionFunction::nsOfflineCacheEvictionFunction(nsOfflineCacheDevice * device)
+  : mDevice(device)
+{
+  mTLSInited = appcachedetail::tlsEvictionItems.init();
+}
+
+void nsOfflineCacheEvictionFunction::Init()
+{
+  if (mTLSInited) {
+    appcachedetail::tlsEvictionItems.set(new appcachedetail::FileArray());
+  }
+}
+
+void nsOfflineCacheEvictionFunction::Reset()
+{
+  if (!mTLSInited) {
+    return;
+  }
+
+  appcachedetail::FileArray* items = appcachedetail::tlsEvictionItems.get();
+  if (!items) {
+    return;
+  }
+
+  appcachedetail::tlsEvictionItems.set(nullptr);
+  delete items;
+}
+
 void
 nsOfflineCacheEvictionFunction::Apply()
 {
   LOG(("nsOfflineCacheEvictionFunction::Apply\n"));
 
-  for (int32_t i = 0; i < mItems.Count(); i++) {
+  if (!mTLSInited) {
+    return;
+  }
+
+  appcachedetail::FileArray* pitems = appcachedetail::tlsEvictionItems.get();
+  if (!pitems) {
+    return;
+  }
+
+  appcachedetail::FileArray items;
+  items.SwapElements(*pitems);
+
+  for (int32_t i = 0; i < items.Count(); i++) {
     if (MOZ_LOG_TEST(gCacheLog, LogLevel::Debug)) {
       nsAutoCString path;
-      mItems[i]->GetNativePath(path);
+      items[i]->GetNativePath(path);
       LOG(("  removing %s\n", path.get()));
     }
 
-    mItems[i]->Remove(false);
+    items[i]->Remove(false);
   }
-
-  Reset();
 }
 
 class nsOfflineCacheDiscardCache : public Runnable
diff --git a/netwerk/cache/nsDiskCacheDeviceSQL.h b/netwerk/cache/nsDiskCacheDeviceSQL.h
index 316a319738b3..fcde58d3d77d 100644
--- a/netwerk/cache/nsDiskCacheDeviceSQL.h
+++ b/netwerk/cache/nsDiskCacheDeviceSQL.h
@@ -49,19 +49,17 @@ public:
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_MOZISTORAGEFUNCTION
 
-  explicit nsOfflineCacheEvictionFunction(nsOfflineCacheDevice *device)
-    : mDevice(device)
-  {}
+  explicit nsOfflineCacheEvictionFunction(nsOfflineCacheDevice *device);
 
-  void Reset() { mItems.Clear(); }
+  void Init();
+  void Reset();
   void Apply();
 
 private:
   ~nsOfflineCacheEvictionFunction() {}
 
   nsOfflineCacheDevice *mDevice;
-  nsCOMArray<nsIFile> mItems;
-
+  bool mTLSInited;
 };
 
 class nsOfflineCacheDevice final : public nsCacheDevice
diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.cpp b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
index f81927373a7b..8220b78b062f 100644
--- a/netwerk/protocol/http/nsHttpNTLMAuth.cpp
+++ b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
@@ -27,8 +27,12 @@
 #include "nsISSLStatusProvider.h"
 #endif
 #include "mozilla/Attributes.h"
+#include "mozilla/Tokenizer.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Unused.h"
 #include "nsNetUtil.h"
 #include "nsIChannel.h"
+#include "nsUnicharUtils.h"
 
 namespace mozilla {
 namespace net {
@@ -47,56 +51,92 @@ static bool
 MatchesBaseURI(const nsCSubstring &matchScheme,
                const nsCSubstring &matchHost,
                int32_t             matchPort,
-               const char         *baseStart,
-               const char         *baseEnd)
+               nsDependentCSubstring const& url)
 {
-    // check if scheme://host:port matches baseURI
+  // check if scheme://host:port matches baseURI
 
-    // parse the base URI
-    const char *hostStart, *schemeEnd = strstr(baseStart, "://");
-    if (schemeEnd) {
-        // the given scheme must match the parsed scheme exactly
-        if (!matchScheme.Equals(Substring(baseStart, schemeEnd)))
-            return false;
-        hostStart = schemeEnd + 3;
-    }
-    else
-        hostStart = baseStart;
+  // parse the base URI
+  mozilla::Tokenizer t(url);
+  mozilla::Tokenizer::Token token;
 
-    // XXX this does not work for IPv6-literals
-    const char *hostEnd = strchr(hostStart, ':');
-    if (hostEnd && hostEnd < baseEnd) {
-        // the given port must match the parsed port exactly
-        int port = atoi(hostEnd + 1);
-        if (matchPort != (int32_t) port)
-            return false;
-    }
-    else
-        hostEnd = baseEnd;
+  t.SkipWhites();
 
+  // We don't know if the url to check against starts with scheme
+  // or a host name.  Start recording here.
+  t.Record();
 
-    // if we didn't parse out a host, then assume we got a match.
-    if (hostStart == hostEnd)
-        return true;
+  mozilla::Unused << t.Next(token);
 
-    uint32_t hostLen = hostEnd - hostStart;
-
-    // matchHost must either equal host or be a subdomain of host
-    if (matchHost.Length() < hostLen)
-        return false;
-
-    const char *end = matchHost.EndReading();
-    if (PL_strncasecmp(end - hostLen, hostStart, hostLen) == 0) {
-        // if matchHost ends with host from the base URI, then make sure it is
-        // either an exact match, or prefixed with a dot.  we don't want
-        // "foobar.com" to match "bar.com"
-        if (matchHost.Length() == hostLen ||
-            *(end - hostLen) == '.' ||
-            *(end - hostLen - 1) == '.')
-            return true;
+  // The ipv6 literals MUST be enclosed with [] in the preference.
+  bool ipv6 = false;
+  if (token.Equals(mozilla::Tokenizer::Token::Char('['))) {
+    nsDependentCSubstring ipv6BareLiteral;
+    if (!t.ReadUntil(mozilla::Tokenizer::Token::Char(']'), ipv6BareLiteral)) {
+      // Broken ipv6 literal
+      return false;
     }
 
-    return false;
+    nsDependentCSubstring ipv6Literal;
+    t.Claim(ipv6Literal, mozilla::Tokenizer::INCLUDE_LAST);
+    if (!matchHost.Equals(ipv6Literal, nsCaseInsensitiveUTF8StringComparator()) &&
+        !matchHost.Equals(ipv6BareLiteral, nsCaseInsensitiveUTF8StringComparator())) {
+      return false;
+    }
+
+    ipv6 = true;
+  } else if (t.CheckChar(':') && t.CheckChar('/') && t.CheckChar('/')) {
+    if (!matchScheme.Equals(token.Fragment())) {
+      return false;
+    }
+    // Re-start recording the hostname from the point after scheme://.
+    t.Record();
+  }
+
+  while (t.Next(token)) {
+    bool eof = token.Equals(mozilla::Tokenizer::Token::EndOfFile());
+    bool port = token.Equals(mozilla::Tokenizer::Token::Char(':'));
+
+    if (eof || port) {
+      if (!ipv6) { // Match already performed above.
+        nsDependentCSubstring hostName;
+        t.Claim(hostName);
+
+        // An empty hostname means to accept everything for the schema
+        if (!hostName.IsEmpty()) {
+          if (hostName.First() == '.') {
+            if (!StringEndsWith(matchHost, hostName, nsCaseInsensitiveUTF8StringComparator())) {
+              return false;
+            }
+          } else { // host to match doesn't begin with '.', do a full compare
+            if (!matchHost.Equals(hostName, nsCaseInsensitiveUTF8StringComparator())) {
+              return false;
+            }
+          }
+        }
+      }
+
+      if (port) {
+        uint16_t portNumber;
+        if (!t.ReadInteger(&portNumber)) {
+          // Missing port number
+          return false;
+        }
+        if (matchPort != portNumber) {
+          return false;
+        }
+        if (!t.CheckEOF()) {
+          return false;
+        }
+      }
+    } else if (ipv6) {
+      // After an ipv6 literal there can only be EOF or :port.  Everything else
+      // must be treated as non-match/broken input.
+      return false;
+    }
+  }
+
+  // All negative checks has passed positively.
+  return true;
 }
 
 static bool
@@ -134,6 +174,10 @@ TestPref(nsIURI *uri, const char *pref)
     if (NS_FAILED(prefs->GetCharPref(pref, &hostList)) || !hostList)
         return false;
 
+    struct FreePolicy { void operator()(void* p) { free(p); } };
+    mozilla::UniquePtr<char[], FreePolicy> hostListScope;
+    hostListScope.reset(hostList);
+
     // pseudo-BNF
     // ----------
     //
@@ -146,24 +190,19 @@ TestPref(nsIURI *uri, const char *pref)
     //   "https://, http://office.foo.com"
     //
 
-    char *start = hostList, *end;
-    for (;;) {
-        // skip past any whitespace
-        while (*start == ' ' || *start == '\t')
-            ++start;
-        end = strchr(start, ',');
-        if (!end)
-            end = start + strlen(start);
-        if (start == end)
-            break;
-        if (MatchesBaseURI(scheme, host, port, start, end))
-            return true;
-        if (*end == '\0')
-            break;
-        start = end + 1;
+    mozilla::Tokenizer t(hostList);
+    while (!t.CheckEOF()) {
+      t.SkipWhites();
+      nsDependentCSubstring url;
+      mozilla::Unused << t.ReadUntil(mozilla::Tokenizer::Token::Char(','), url);
+      if (url.IsEmpty()) {
+        continue;
+      }
+      if (MatchesBaseURI(scheme, host, port, url)) {
+        return true;
+      }
     }
 
-    free(hostList);
     return false;
 }
 
diff --git a/netwerk/test/unit/test_rusturl.js b/netwerk/test/unit/test_rusturl.js
index a876c74cd681..01fd2035eb5e 100644
--- a/netwerk/test/unit/test_rusturl.js
+++ b/netwerk/test/unit/test_rusturl.js
@@ -464,3 +464,12 @@ add_test({ skip_if: () => rustIsMissing }, function test_ipv4Normalize()
 
   run_next_test();
 });
+
+add_test({ skip_if: () => rustIsMissing }, function test_schemeIsCaseInsensitive()
+{
+  var url = stringToURL("http://example.com/");
+  do_check_true(url.schemeIs("http"));
+  do_check_true(url.schemeIs("HtTp"));
+
+  run_next_test();
+});
diff --git a/security/manager/ssl/nsNSSIOLayer.cpp b/security/manager/ssl/nsNSSIOLayer.cpp
index e86f5419db4a..6d84bca2095d 100644
--- a/security/manager/ssl/nsNSSIOLayer.cpp
+++ b/security/manager/ssl/nsNSSIOLayer.cpp
@@ -1158,12 +1158,18 @@ static_assert((mozilla::pkix::ERROR_BASE - mozilla::pkix::END_OF_LIST) < 31,
               "too many moz::pkix errors");
 
 static void
-reportHandshakeResult(int32_t bytesTransferred, PRErrorCode err)
+reportHandshakeResult(int32_t bytesTransferred, bool wasReading, PRErrorCode err)
 {
   uint32_t bucket;
 
-  if (bytesTransferred >= 0) {
+  // A negative bytesTransferred or a 0 read are errors.
+  if (bytesTransferred > 0) {
     bucket = 0;
+  } else if ((bytesTransferred == 0) && !wasReading) {
+    // PR_Write() is defined to never return 0, but let's make sure.
+    // https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/PR_Write.
+    MOZ_ASSERT(false);
+    bucket = 671;
   } else if (IS_SSL_ERROR(err)) {
     bucket = err - SSL_ERROR_BASE;
     MOZ_ASSERT(bucket > 0);   // SSL_ERROR_EXPORT_ONLY_SERVER isn't used.
@@ -1261,7 +1267,7 @@ checkHandshake(int32_t bytesTransfered, bool wasReading,
     // Report the result once for each handshake. Note that this does not
     // get handshakes which are cancelled before any reads or writes
     // happen.
-    reportHandshakeResult(bytesTransfered, originalError);
+    reportHandshakeResult(bytesTransfered, wasReading, originalError);
     socketInfo->SetHandshakeNotPending();
   }
 
diff --git a/services/sync/modules/record.js b/services/sync/modules/record.js
index 65634f652acc..329777c50536 100644
--- a/services/sync/modules/record.js
+++ b/services/sync/modules/record.js
@@ -783,13 +783,23 @@ Collection.prototype = {
 
     this._onRecord = onRecord;
 
-    this._onProgress = function() {
-      let newline;
+    this._onProgress = function(httpChannel) {
+      let newline, length = 0, contentLength = "unknown";
+
+      try {
+          // Content-Length of the value of this response header
+          contentLength = httpChannel.getResponseHeader("Content-Length");
+      } catch (ex) { }
+
       while ((newline = this._data.indexOf("\n")) > 0) {
         // Split the json record from the rest of the data
         let json = this._data.slice(0, newline);
         this._data = this._data.slice(newline + 1);
 
+        length += json.length;
+        coll._log.trace("Record: Content-Length = " + contentLength +
+                        ", ByteCount = " + length);
+
         // Deserialize a record from json and give it to the callback
         let record = new coll._recordObj();
         record.deserialize(json);
diff --git a/services/sync/modules/resource.js b/services/sync/modules/resource.js
index 1a190a40f8fb..54c173ebfd85 100644
--- a/services/sync/modules/resource.js
+++ b/services/sync/modules/resource.js
@@ -540,7 +540,8 @@ ChannelListener.prototype = {
     }
 
     try {
-      this._onProgress();
+      let httpChannel = req.QueryInterface(Ci.nsIHttpChannel);
+      this._onProgress(httpChannel);
     } catch (ex) {
       if (Async.isShutdownException(ex)) {
         throw ex;
diff --git a/testing/mozharness/configs/l10n_bumper/jamun.py b/testing/mozharness/configs/l10n_bumper/jamun.py
new file mode 100644
index 000000000000..f35b7a2a1af5
--- /dev/null
+++ b/testing/mozharness/configs/l10n_bumper/jamun.py
@@ -0,0 +1,34 @@
+MULTI_REPO = "projects/jamun"
+config = {
+    "log_name": "l10n_bumper",
+
+    "exes": {
+        # Get around the https warnings
+        "hg": ["/usr/local/bin/hg", "--config", "web.cacerts=/etc/pki/tls/certs/ca-bundle.crt"],
+        "hgtool.py": ["/usr/local/bin/hgtool.py"],
+    },
+
+    "gecko_pull_url": "https://hg.mozilla.org/{}".format(MULTI_REPO),
+    "gecko_push_url": "ssh://hg.mozilla.org/{}".format(MULTI_REPO),
+
+    "hg_user": "L10n Bumper Bot <release+l10nbumper@mozilla.com>",
+    "ssh_key": "~/.ssh/ffxbld_rsa",
+    "ssh_user": "ffxbld",
+
+    "vcs_share_base": "/builds/hg-shared",
+    "version_path": "browser/config/version.txt",
+
+    "bump_configs": [{
+        "path": "mobile/locales/l10n-changesets.json",
+        "format": "json",
+        "name": "Fennec l10n changesets",
+        "revision_url": "https://l10n.mozilla.org/shipping/l10n-changesets?av=fennec%(MAJOR_VERSION)s",
+        "platform_configs": [{
+            "platforms": ["android-api-15", "android"],
+            "path": "mobile/android/locales/all-locales"
+        }, {
+            "platforms": ["android-multilocale"],
+            "path": "mobile/android/locales/maemo-locales"
+        }],
+    }],
+}
diff --git a/testing/mozharness/configs/l10n_bumper/mozilla-aurora.py b/testing/mozharness/configs/l10n_bumper/mozilla-aurora.py
new file mode 100644
index 000000000000..58eb1f61f01c
--- /dev/null
+++ b/testing/mozharness/configs/l10n_bumper/mozilla-aurora.py
@@ -0,0 +1,33 @@
+MULTI_REPO = "releases/mozilla-aurora"
+config = {
+    "log_name": "l10n_bumper",
+
+    "exes": {
+        # Get around the https warnings
+        "hg": ["/usr/local/bin/hg", "--config", "web.cacerts=/etc/pki/tls/certs/ca-bundle.crt"],
+        "hgtool.py": ["/usr/local/bin/hgtool.py"],
+    },
+
+    "gecko_pull_url": "https://hg.mozilla.org/{}".format(MULTI_REPO),
+    "gecko_push_url": "ssh://hg.mozilla.org/{}".format(MULTI_REPO),
+
+    "hg_user": "L10n Bumper Bot <release+l10nbumper@mozilla.com>",
+    "ssh_key": "~/.ssh/ffxbld_rsa",
+    "ssh_user": "ffxbld",
+
+    "vcs_share_base": "/builds/hg-shared",
+    "version_path": "browser/config/version.txt",
+
+    "bump_configs": [{
+        "path": "mobile/locales/l10n-changesets.json",
+        "format": "json",
+        "name": "Fennec l10n changesets",
+        "platform_configs": [{
+            "platforms": ["android-api-15", "android"],
+            "path": "mobile/android/locales/all-locales"
+        }, {
+            "platforms": ["android-multilocale"],
+            "path": "mobile/android/locales/maemo-locales"
+        }],
+    }],
+}
diff --git a/testing/mozharness/configs/l10n_bumper/mozilla-beta.py b/testing/mozharness/configs/l10n_bumper/mozilla-beta.py
index c2b2406efd48..0773e3c2e519 100644
--- a/testing/mozharness/configs/l10n_bumper/mozilla-beta.py
+++ b/testing/mozharness/configs/l10n_bumper/mozilla-beta.py
@@ -8,10 +8,8 @@ config = {
         "hgtool.py": ["/usr/local/bin/hgtool.py"],
     },
 
-#    "gecko_pull_url": "https://hg.mozilla.org/{}".format(MULTI_REPO),
-#    "gecko_push_url": "ssh://hg.mozilla.org/{}".format(MULTI_REPO),
-    "gecko_pull_url": "https://hg.mozilla.org/projects/jamun",
-    "gecko_push_url": "ssh://hg.mozilla.org/projects/jamun",
+    "gecko_pull_url": "https://hg.mozilla.org/{}".format(MULTI_REPO),
+    "gecko_push_url": "ssh://hg.mozilla.org/{}".format(MULTI_REPO),
 
     "hg_user": "L10n Bumper Bot <release+l10nbumper@mozilla.com>",
     "ssh_key": "~/.ssh/ffxbld_rsa",
@@ -24,6 +22,13 @@ config = {
         "path": "mobile/locales/l10n-changesets.json",
         "format": "json",
         "name": "Fennec l10n changesets",
-        "url": "https://l10n.mozilla.org/shipping/json-changesets?av=fennec%(MAJOR_VERSION)s&platforms=android&multi_android-multilocale_repo={}&multi_android-multilocale_rev=default&multi_android-multilocale_path=mobile/android/locales/maemo-locales".format(MULTI_REPO),
+        "revision_url": "https://l10n.mozilla.org/shipping/l10n-changesets?av=fennec%(MAJOR_VERSION)s",
+        "platform_configs": [{
+            "platforms": ["android-api-15", "android"],
+            "path": "mobile/android/locales/all-locales"
+        }, {
+            "platforms": ["android-multilocale"],
+            "path": "mobile/android/locales/maemo-locales"
+        }],
     }],
 }
diff --git a/testing/mozharness/configs/l10n_bumper/mozilla-central.py b/testing/mozharness/configs/l10n_bumper/mozilla-central.py
new file mode 100644
index 000000000000..b212f3127606
--- /dev/null
+++ b/testing/mozharness/configs/l10n_bumper/mozilla-central.py
@@ -0,0 +1,33 @@
+MULTI_REPO = "mozilla-central"
+config = {
+    "log_name": "l10n_bumper",
+
+    "exes": {
+        # Get around the https warnings
+        "hg": ["/usr/local/bin/hg", "--config", "web.cacerts=/etc/pki/tls/certs/ca-bundle.crt"],
+        "hgtool.py": ["/usr/local/bin/hgtool.py"],
+    },
+
+    "gecko_pull_url": "https://hg.mozilla.org/{}".format(MULTI_REPO),
+    "gecko_push_url": "ssh://hg.mozilla.org/{}".format(MULTI_REPO),
+
+    "hg_user": "L10n Bumper Bot <release+l10nbumper@mozilla.com>",
+    "ssh_key": "~/.ssh/ffxbld_rsa",
+    "ssh_user": "ffxbld",
+
+    "vcs_share_base": "/builds/hg-shared",
+    "version_path": "browser/config/version.txt",
+
+    "bump_configs": [{
+        "path": "mobile/locales/l10n-changesets.json",
+        "format": "json",
+        "name": "Fennec l10n changesets",
+        "platform_configs": [{
+            "platforms": ["android-api-15", "android"],
+            "path": "mobile/android/locales/all-locales"
+        }, {
+            "platforms": ["android-multilocale"],
+            "path": "mobile/android/locales/maemo-locales"
+        }],
+    }],
+}
diff --git a/testing/mozharness/configs/merge_day/central_to_aurora.py b/testing/mozharness/configs/merge_day/central_to_aurora.py
index a82e7cca7176..585c10e93110 100644
--- a/testing/mozharness/configs/merge_day/central_to_aurora.py
+++ b/testing/mozharness/configs/merge_day/central_to_aurora.py
@@ -61,7 +61,8 @@ config = {
         "browser/locales/shipped-locales",
         "browser/locales/all-locales",
         "mobile/android/locales/maemo-locales",
-        "mobile/android/locales/all-locales"
+        "mobile/android/locales/all-locales",
+        "mobile/locales/l10n-changesets.json",
     ],
 
     "vcs_share_base": os.path.join(ABS_WORK_DIR, 'hg-shared'),
diff --git a/testing/mozharness/configs/multi_locale/android-mozharness-build.json b/testing/mozharness/configs/multi_locale/android-mozharness-build.json
index b28f5c01534f..3b8f59b39e07 100644
--- a/testing/mozharness/configs/multi_locale/android-mozharness-build.json
+++ b/testing/mozharness/configs/multi_locale/android-mozharness-build.json
@@ -1,5 +1,6 @@
 {
     "work_dir": "build",
-    "locales_file": "src/mobile/android/locales/maemo-locales",
+    "locales_file": "src/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "mozilla_dir": "src"
 }
diff --git a/testing/mozharness/configs/multi_locale/ash_android-x86.json b/testing/mozharness/configs/multi_locale/ash_android-x86.json
index 6a37ce24fef5..6fe6c442b248 100644
--- a/testing/mozharness/configs/multi_locale/ash_android-x86.json
+++ b/testing/mozharness/configs/multi_locale/ash_android-x86.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/ash_android.json b/testing/mozharness/configs/multi_locale/ash_android.json
index 831d4f7c39dc..991ecc00185a 100644
--- a/testing/mozharness/configs/multi_locale/ash_android.json
+++ b/testing/mozharness/configs/multi_locale/ash_android.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/date_android-armv6.json b/testing/mozharness/configs/multi_locale/date_android-armv6.json
index ab29bf55d054..d6ea04289774 100644
--- a/testing/mozharness/configs/multi_locale/date_android-armv6.json
+++ b/testing/mozharness/configs/multi_locale/date_android-armv6.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/date_android-x86.json b/testing/mozharness/configs/multi_locale/date_android-x86.json
index 63fe6303b828..692433b980aa 100644
--- a/testing/mozharness/configs/multi_locale/date_android-x86.json
+++ b/testing/mozharness/configs/multi_locale/date_android-x86.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/date_android.json b/testing/mozharness/configs/multi_locale/date_android.json
index 80ea897afe4d..75a166e425da 100644
--- a/testing/mozharness/configs/multi_locale/date_android.json
+++ b/testing/mozharness/configs/multi_locale/date_android.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-aurora_android-armv6.json b/testing/mozharness/configs/multi_locale/mozilla-aurora_android-armv6.json
index dc50707cfa91..122b9255a8c0 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-aurora_android-armv6.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-aurora_android-armv6.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-aurora_android-x86.json b/testing/mozharness/configs/multi_locale/mozilla-aurora_android-x86.json
index bd5f8b6baed0..bbd0cc4cbe73 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-aurora_android-x86.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-aurora_android-x86.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-aurora_android.json b/testing/mozharness/configs/multi_locale/mozilla-aurora_android.json
index 1cc38e35b6a5..aa44ba7ce4d3 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-aurora_android.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-aurora_android.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-beta_android-armv6.json b/testing/mozharness/configs/multi_locale/mozilla-beta_android-armv6.json
index 4cffd4807791..3231e30b4496 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-beta_android-armv6.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-beta_android-armv6.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-beta_android-x86.json b/testing/mozharness/configs/multi_locale/mozilla-beta_android-x86.json
index 233e740aae9e..29fc4b7b7018 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-beta_android-x86.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-beta_android-x86.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-beta_android.json b/testing/mozharness/configs/multi_locale/mozilla-beta_android.json
index c9d0e4d6b971..28a847d38ec3 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-beta_android.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-beta_android.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-central_android-armv6.json b/testing/mozharness/configs/multi_locale/mozilla-central_android-armv6.json
index 1b27a017e638..98c9f36ff0ab 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-central_android-armv6.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-central_android-armv6.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-central_android-x86.json b/testing/mozharness/configs/multi_locale/mozilla-central_android-x86.json
index 0873a01982a7..468a7e0cfe5c 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-central_android-x86.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-central_android-x86.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-central_android.json b/testing/mozharness/configs/multi_locale/mozilla-central_android.json
index 67d195242bf5..a99c46bc2fef 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-central_android.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-central_android.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-release_android-armv6.json b/testing/mozharness/configs/multi_locale/mozilla-release_android-armv6.json
index fbfff0d7cc32..55127d067e14 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-release_android-armv6.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-release_android-armv6.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-release_android-x86.json b/testing/mozharness/configs/multi_locale/mozilla-release_android-x86.json
index 96aa60cef8eb..726a4269b99e 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-release_android-x86.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-release_android-x86.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/mozilla-release_android.json b/testing/mozharness/configs/multi_locale/mozilla-release_android.json
index 9a737f9a909d..2c07588d9de4 100644
--- a/testing/mozharness/configs/multi_locale/mozilla-release_android.json
+++ b/testing/mozharness/configs/multi_locale/mozilla-release_android.json
@@ -2,7 +2,8 @@
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": "obj-firefox",
-    "locales_file": "build/mobile/android/locales/maemo-locales",
+    "locales_file": "build/mobile/locales/l10n-changesets.json",
+    "locales_platform": "android-multilocale",
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/multi_locale/standalone_mozilla-central.py b/testing/mozharness/configs/multi_locale/standalone_mozilla-central.py
index 36ad4de581b9..fce75aeb3509 100644
--- a/testing/mozharness/configs/multi_locale/standalone_mozilla-central.py
+++ b/testing/mozharness/configs/multi_locale/standalone_mozilla-central.py
@@ -20,7 +20,8 @@ config = {
     "work_dir": ".",
     "log_name": "multilocale",
     "objdir": OBJDIR,
-    "locales_file": "%s/%s/locales/maemo-locales" % (BUILD_DIR, ANDROID_DIR),
+    "locales_file": "%s/mobile/locales/l10n-changesets.json" % BUILD_DIR,
+    "locales_platform": "android-multilocale",
     "locales_dir": "%s/locales" % ANDROID_DIR,
     "ignore_locales": ["en-US", "multi"],
     "repos": [{
diff --git a/testing/mozharness/configs/single_locale/ash_android-api-15.py b/testing/mozharness/configs/single_locale/ash_android-api-15.py
index d3cae75b771b..ee4dd2794eb4 100644
--- a/testing/mozharness/configs/single_locale/ash_android-api-15.py
+++ b/testing/mozharness/configs/single_locale/ash_android-api-15.py
@@ -13,7 +13,7 @@ config = {
     "buildbot_json_path": "buildprops.json",
     "force_clobber": True,
     "clobberer_url": "https://api.pub.build.mozilla.org/clobberer/lastclobber",
-    "locales_file": "%s/mobile/android/locales/all-locales" % MOZILLA_DIR,
+    "locales_file": "%s/mobile/locales/l10n-changesets.json" % MOZILLA_DIR,
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US"],
     "nightly_build": True,
diff --git a/testing/mozharness/configs/single_locale/date_android-api-15.py b/testing/mozharness/configs/single_locale/date_android-api-15.py
index 96612428378d..cd7b66243969 100644
--- a/testing/mozharness/configs/single_locale/date_android-api-15.py
+++ b/testing/mozharness/configs/single_locale/date_android-api-15.py
@@ -13,7 +13,7 @@ config = {
     "buildbot_json_path": "buildprops.json",
     "force_clobber": True,
     "clobberer_url": "https://api.pub.build.mozilla.org/clobberer/lastclobber",
-    "locales_file": "%s/mobile/android/locales/all-locales" % MOZILLA_DIR,
+    "locales_file": "%s/mobile/locales/l10n-changesets.json" % MOZILLA_DIR,
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US"],
     "nightly_build": True,
diff --git a/testing/mozharness/configs/single_locale/mozilla-aurora_android-api-15.py b/testing/mozharness/configs/single_locale/mozilla-aurora_android-api-15.py
index 58104defe80a..4c6731471b7e 100644
--- a/testing/mozharness/configs/single_locale/mozilla-aurora_android-api-15.py
+++ b/testing/mozharness/configs/single_locale/mozilla-aurora_android-api-15.py
@@ -15,7 +15,7 @@ config = {
     "buildbot_json_path": "buildprops.json",
     "force_clobber": True,
     "clobberer_url": "https://api.pub.build.mozilla.org/clobberer/lastclobber",
-    "locales_file": "%s/mobile/android/locales/all-locales" % MOZILLA_DIR,
+    "locales_file": "%s/mobile/locales/l10n-changesets.json" % MOZILLA_DIR,
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US"],
     "nightly_build": True,
diff --git a/testing/mozharness/configs/single_locale/mozilla-central_android-api-15.py b/testing/mozharness/configs/single_locale/mozilla-central_android-api-15.py
index 7f9d17d37976..c8bfad89bee8 100644
--- a/testing/mozharness/configs/single_locale/mozilla-central_android-api-15.py
+++ b/testing/mozharness/configs/single_locale/mozilla-central_android-api-15.py
@@ -15,7 +15,7 @@ config = {
     "buildbot_json_path": "buildprops.json",
     "force_clobber": True,
     "clobberer_url": "https://api.pub.build.mozilla.org/clobberer/lastclobber",
-    "locales_file": "%s/mobile/android/locales/all-locales" % MOZILLA_DIR,
+    "locales_file": "%s/mobile/locales/l10n-changesets.json" % MOZILLA_DIR,
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US"],
     "nightly_build": True,
diff --git a/testing/mozharness/configs/single_locale/tc_android-api-15.py b/testing/mozharness/configs/single_locale/tc_android-api-15.py
index db9605958205..17fcfe51ec9d 100644
--- a/testing/mozharness/configs/single_locale/tc_android-api-15.py
+++ b/testing/mozharness/configs/single_locale/tc_android-api-15.py
@@ -1,6 +1,6 @@
 config = {
     "stage_platform": "android-api-15",
-    "locales_file": "src/mobile/android/locales/all-locales",
+    "locales_file": "src/mobile/locales/l10n-changesets.json",
     "tools_repo": "https://hg.mozilla.org/build/tools",
     "mozconfig": "src/mobile/android/config/mozconfigs/android-api-15/l10n-nightly",
     "tooltool_config": {
diff --git a/testing/mozharness/configs/single_locale/try_android-api-15.py b/testing/mozharness/configs/single_locale/try_android-api-15.py
index 81a90bba6382..8770db50c8be 100644
--- a/testing/mozharness/configs/single_locale/try_android-api-15.py
+++ b/testing/mozharness/configs/single_locale/try_android-api-15.py
@@ -11,7 +11,7 @@ config = {
     "buildbot_json_path": "buildprops.json",
     "force_clobber": True,
     "clobberer_url": "https://api.pub.build.mozilla.org/clobberer/lastclobber",
-    "locales_file": "%s/mobile/android/locales/all-locales" % MOZILLA_DIR,
+    "locales_file": "%s/mobile/locales/l10n-changesets.json" % MOZILLA_DIR,
     "locales_dir": "mobile/android/locales",
     "ignore_locales": ["en-US"],
     "nightly_build": False,
diff --git a/testing/mozharness/mozharness/mozilla/l10n/locales.py b/testing/mozharness/mozharness/mozilla/l10n/locales.py
index a8d5f7f4315c..89bfc845c150 100755
--- a/testing/mozharness/mozharness/mozilla/l10n/locales.py
+++ b/testing/mozharness/mozharness/mozilla/l10n/locales.py
@@ -9,6 +9,7 @@
 
 import os
 from urlparse import urljoin
+import pprint
 import sys
 from copy import deepcopy
 
@@ -122,11 +123,12 @@ class LocalesMixin(ChunkingMixin):
     def parse_locales_file(self, locales_file):
         locales = []
         c = self.config
+        self.info("Parsing locales file %s" % locales_file)
         platform = c.get("locales_platform", None)
 
         if locales_file.endswith('json'):
             locales_json = parse_config_file(locales_file)
-            for locale in locales_json.keys():
+            for locale in sorted(locales_json.keys()):
                 if isinstance(locales_json[locale], dict):
                     if platform and platform not in locales_json[locale]['platforms']:
                         continue
@@ -137,6 +139,8 @@ class LocalesMixin(ChunkingMixin):
                 locales.append(locale)
         else:
             locales = self.read_from_file(locales_file).split()
+        self.info("self.l10n_revisions: %s" % pprint.pformat(self.l10n_revisions))
+        self.info("locales: %s" % locales)
         return locales
 
     def run_compare_locales(self, locale, halt_on_failure=False):
diff --git a/testing/mozharness/scripts/l10n_bumper.py b/testing/mozharness/scripts/l10n_bumper.py
index 1154812d603c..e85142978909 100755
--- a/testing/mozharness/scripts/l10n_bumper.py
+++ b/testing/mozharness/scripts/l10n_bumper.py
@@ -29,7 +29,7 @@ sys.path.insert(1, os.path.dirname(sys.path[0]))
 
 from mozharness.base.errors import HgErrorList
 from mozharness.base.vcs.vcsbase import VCSScript
-from mozharness.base.log import ERROR
+from mozharness.base.log import ERROR, FATAL
 
 
 class L10nBumper(VCSScript):
@@ -71,16 +71,17 @@ class L10nBumper(VCSScript):
         self.abs_dirs = abs_dirs
         return self.abs_dirs
 
-    def hg_commit(self, repo_path, message):
+    def hg_commit(self, path, repo_path, message):
         """
         Commits changes in repo_path, with specified user and commit message
         """
         user = self.config['hg_user']
         hg = self.query_exe('hg', return_type='list')
-        cmd = hg + ['commit', '-u', user, '-m', message]
         env = self.query_env(partial_env={'LANG': 'en_US.UTF-8'})
+        cmd = hg + ['add', path]
+        self.run_command(cmd, cwd=repo_path, env=env)
+        cmd = hg + ['commit', '-u', user, '-m', message]
         status = self.run_command(cmd, cwd=repo_path, env=env)
-        return status == 0
 
     def hg_push(self, repo_path):
         hg = self.query_exe('hg', return_type='list')
@@ -123,10 +124,52 @@ class L10nBumper(VCSScript):
             if key not in new_contents:
                 locale_map[key] = "removed"
         for k,v in new_contents.items():
-            if old_contents.get(k) != v:
+            if old_contents.get(k, {}).get('revision') != v['revision']:
                 locale_map[k] = v['revision']
+            elif old_contents.get(k, {}).get('platforms') != v['platforms']:
+                locale_map[k] = v['platforms']
         return locale_map
 
+    def _build_platform_dict(self, bump_config):
+        dirs = self.query_abs_dirs()
+        repo_path = dirs['gecko_local_dir']
+        platform_dict = {}
+        for platform_config in bump_config['platform_configs']:
+            path = os.path.join(repo_path, platform_config['path'])
+            self.info("Reading %s for %s locales..." % (path, platform_config['platforms']))
+            contents = self.read_from_file(path)
+            for locale in contents.splitlines():
+                platforms = platform_dict.get(locale, {}).get('platforms', [])
+                platforms = sorted(list(platform_config['platforms']) + platforms)
+                platform_dict[locale] = {'platforms': platforms}
+        self.info("Built platform_dict:\n%s" % pprint.pformat(platform_dict))
+        return platform_dict
+
+    def _build_revision_dict(self, bump_config, version_list):
+        self.info("Building revision dict...")
+        platform_dict = self._build_platform_dict(bump_config)
+        revision_dict = {}
+        if bump_config.get('revision_url'):
+            repl_dict = {
+                'MAJOR_VERSION': version_list[0],
+            }
+
+            url = bump_config['revision_url'] % repl_dict
+            path = self.download_file(url, error_level=FATAL)
+            revision_info = self.read_from_file(path)
+            self.info("Got %s" % revision_info)
+            for line in revision_info.splitlines():
+                locale, revision = line.split(' ')
+                if locale in platform_dict:
+                    revision_dict[locale] = platform_dict[locale]
+                    revision_dict[locale]['revision'] = revision
+        else:
+            for k, v in platform_dict.items():
+                v['revision'] = 'default'
+                revision_dict[k] = v
+        self.info("revision_dict:\n%s" % pprint.pformat(revision_dict))
+        return revision_dict
+
     def build_commit_message(self, name, locale_map):
         revisions = []
         comments = ''
@@ -193,13 +236,8 @@ class L10nBumper(VCSScript):
             else:
                 old_contents = {}
 
-            repl_dict = {
-                'MAJOR_VERSION': version_list[0],
-            }
+            new_contents = self._build_revision_dict(bump_config, version_list)
 
-            url = bump_config['url'] % repl_dict
-            new_contents = self.load_json_url(url)
-            self.info("Got %s" % pprint.pformat(new_contents))
             if new_contents == old_contents:
                 continue
             # super basic sanity check
@@ -218,7 +256,7 @@ class L10nBumper(VCSScript):
             # Commit
             message = self.build_commit_message(bump_config['name'],
                                                 locale_map)
-            self.hg_commit(repo_path, message)
+            self.hg_commit(path, repo_path, message)
             changes = True
         return changes
 
diff --git a/toolkit/components/extensions/ExtensionParent.jsm b/toolkit/components/extensions/ExtensionParent.jsm
index 2750b86a2afd..cb353d8a42ab 100644
--- a/toolkit/components/extensions/ExtensionParent.jsm
+++ b/toolkit/components/extensions/ExtensionParent.jsm
@@ -724,35 +724,30 @@ class HiddenExtensionPage {
    * @returns {Promise<XULElement>}
    *   a Promise which resolves to the newly created browser XUL element.
    */
-  createBrowserElement() {
+  async createBrowserElement() {
     if (this.browser) {
       throw new Error("createBrowserElement called twice");
     }
 
-    let waitForParentDocument;
+    let chromeDoc = await this.createWindowlessBrowser();
+
+    const browser = this.browser = chromeDoc.createElement("browser");
+    browser.setAttribute("type", "content");
+    browser.setAttribute("disableglobalhistory", "true");
+    browser.setAttribute("webextension-view-type", this.viewType);
+
+    let awaitFrameLoader = Promise.resolve();
+
     if (this.extension.remote) {
-      waitForParentDocument = this.createWindowedBrowser();
-    } else {
-      waitForParentDocument = this.createWindowlessBrowser();
+      browser.setAttribute("remote", "true");
+      browser.setAttribute("remoteType", E10SUtils.EXTENSION_REMOTE_TYPE);
+      awaitFrameLoader = promiseEvent(browser, "XULFrameLoaderCreated");
     }
 
-    return waitForParentDocument.then(chromeDoc => {
-      const browser = this.browser = chromeDoc.createElement("browser");
-      browser.setAttribute("type", "content");
-      browser.setAttribute("disableglobalhistory", "true");
-      browser.setAttribute("webextension-view-type", this.viewType);
+    chromeDoc.documentElement.appendChild(browser);
+    await awaitFrameLoader;
 
-      let awaitFrameLoader = Promise.resolve();
-
-      if (this.extension.remote) {
-        browser.setAttribute("remote", "true");
-        browser.setAttribute("remoteType", E10SUtils.EXTENSION_REMOTE_TYPE);
-        awaitFrameLoader = promiseEvent(browser, "XULFrameLoaderCreated");
-      }
-
-      chromeDoc.documentElement.appendChild(browser);
-      return awaitFrameLoader.then(() => browser);
-    });
+    return browser;
   }
 
   /**
@@ -769,58 +764,26 @@ class HiddenExtensionPage {
    *   a promise which resolves to the newly created XULDocument.
    */
   createWindowlessBrowser() {
-    return Task.spawn(function* () {
-      // The invisible page is currently wrapped in a XUL window to fix an issue
-      // with using the canvas API from a background page (See Bug 1274775).
-      let windowlessBrowser = Services.appShell.createWindowlessBrowser(true);
-      this.windowlessBrowser = windowlessBrowser;
+    // The invisible page is currently wrapped in a XUL window to fix an issue
+    // with using the canvas API from a background page (See Bug 1274775).
+    let windowlessBrowser = Services.appShell.createWindowlessBrowser(true);
+    this.windowlessBrowser = windowlessBrowser;
 
-      // The windowless browser is a thin wrapper around a docShell that keeps
-      // its related resources alive. It implements nsIWebNavigation and
-      // forwards its methods to the underlying docShell, but cannot act as a
-      // docShell itself. Calling `getInterface(nsIDocShell)` gives us the
-      // underlying docShell, and `QueryInterface(nsIWebNavigation)` gives us
-      // access to the webNav methods that are already available on the
-      // windowless browser, but contrary to appearances, they are not the same
-      // object.
-      let chromeShell = windowlessBrowser.QueryInterface(Ci.nsIInterfaceRequestor)
-                                         .getInterface(Ci.nsIDocShell)
-                                         .QueryInterface(Ci.nsIWebNavigation);
-
-      yield this.initParentWindow(chromeShell);
+    // The windowless browser is a thin wrapper around a docShell that keeps
+    // its related resources alive. It implements nsIWebNavigation and
+    // forwards its methods to the underlying docShell, but cannot act as a
+    // docShell itself. Calling `getInterface(nsIDocShell)` gives us the
+    // underlying docShell, and `QueryInterface(nsIWebNavigation)` gives us
+    // access to the webNav methods that are already available on the
+    // windowless browser, but contrary to appearances, they are not the same
+    // object.
+    let chromeShell = windowlessBrowser.QueryInterface(Ci.nsIInterfaceRequestor)
+                                       .getInterface(Ci.nsIDocShell)
+                                       .QueryInterface(Ci.nsIWebNavigation);
 
+    return this.initParentWindow(chromeShell).then(() => {
       return promiseDocumentLoaded(windowlessBrowser.document);
-    }.bind(this));
-  }
-
-  /**
-   * Private helper that create a XULDocument in a visible dialog window.
-   *
-   * Using this helper, the extension page is loaded into a visible dialog window.
-   * Only to be used for debugging, and in temporary, test-only use for
-   * out-of-process extensions.
-   *
-   * @returns {Promise<XULDocument>}
-   *   a promise which resolves to the newly created XULDocument.
-   */
-  createWindowedBrowser() {
-    return Task.spawn(function* () {
-      let window = Services.ww.openWindow(null, "about:blank", "_blank",
-                                          "chrome,alwaysLowered,dialog", null);
-
-      this.parentWindow = window;
-
-      let chromeShell = window.QueryInterface(Ci.nsIInterfaceRequestor)
-                              .getInterface(Ci.nsIDocShell)
-                              .QueryInterface(Ci.nsIWebNavigation);
-
-
-      yield this.initParentWindow(chromeShell);
-
-      window.minimize();
-
-      return promiseDocumentLoaded(window.document);
-    }.bind(this));
+    });
   }
 
   /**
diff --git a/toolkit/components/extensions/MessageChannel.jsm b/toolkit/components/extensions/MessageChannel.jsm
index cb8e97683ad7..2e0bee1cb789 100644
--- a/toolkit/components/extensions/MessageChannel.jsm
+++ b/toolkit/components/extensions/MessageChannel.jsm
@@ -159,7 +159,7 @@ class FilteringMessageManager {
    * passes the result to our message callback.
    */
   receiveMessage({data, target}) {
-    let handlers = Array.from(this.getHandlers(data.messageName, data.sender, data.recipient));
+    let handlers = Array.from(this.getHandlers(data.messageName, data.sender || null, data.recipient));
 
     data.target = target;
     this.callback(handlers, data);
diff --git a/toolkit/components/extensions/Schemas.jsm b/toolkit/components/extensions/Schemas.jsm
index 70113ea8c3de..8013da72f541 100644
--- a/toolkit/components/extensions/Schemas.jsm
+++ b/toolkit/components/extensions/Schemas.jsm
@@ -966,7 +966,7 @@ class StringType extends Type {
       format = FORMATS[schema.format];
     }
     return new this(schema,
-                    schema.id,
+                    schema.id || undefined,
                     enumeration,
                     schema.minLength || 0,
                     schema.maxLength || Infinity,
diff --git a/toolkit/components/extensions/test/mochitest/head.js b/toolkit/components/extensions/test/mochitest/head.js
index 62c133a90267..9063da3d57ff 100644
--- a/toolkit/components/extensions/test/mochitest/head.js
+++ b/toolkit/components/extensions/test/mochitest/head.js
@@ -10,7 +10,6 @@ var {AppConstants} = SpecialPowers.Cu.import("resource://gre/modules/AppConstant
 // use to select our configuration.
 if (location.pathname.includes("test-oop-extensions")) {
   SpecialPowers.pushPrefEnv({set: [
-    ["dom.ipc.processCount.extension", 1],
     ["extensions.webextensions.remote", true],
   ]});
   // We don't want to reset this at the end of the test, so that we don't have
diff --git a/toolkit/components/extensions/test/xpcshell/xpcshell.ini b/toolkit/components/extensions/test/xpcshell/xpcshell.ini
index 18ce1c3ea8b2..5f3048026aeb 100644
--- a/toolkit/components/extensions/test/xpcshell/xpcshell.ini
+++ b/toolkit/components/extensions/test/xpcshell/xpcshell.ini
@@ -47,6 +47,7 @@ skip-if = release_or_beta
 [test_ext_manifest_incognito.js]
 [test_ext_manifest_minimum_chrome_version.js]
 [test_ext_onmessage_removelistener.js]
+skip-if = true # This test no longer tests what it is meant to test.
 [test_ext_runtime_connect_no_receiver.js]
 [test_ext_runtime_getBrowserInfo.js]
 [test_ext_runtime_getPlatformInfo.js]
diff --git a/toolkit/components/places/nsNavHistory.cpp b/toolkit/components/places/nsNavHistory.cpp
index 496a80eb7b33..c848b76230fe 100644
--- a/toolkit/components/places/nsNavHistory.cpp
+++ b/toolkit/components/places/nsNavHistory.cpp
@@ -17,6 +17,7 @@
 #include "nsAnnotationService.h"
 #include "nsFaviconService.h"
 #include "nsPlacesMacros.h"
+#include "DateTimeFormat.h"
 #include "History.h"
 #include "Helpers.h"
 
@@ -1754,12 +1755,11 @@ PlacesSQLQueryBuilder::SelectAsDay()
         PR_NormalizeTime(&tm, PR_GMTParameters);
         // If the container is for a past year, add the year to its title,
         // otherwise just show the month name.
-        // Note that tm_month starts from 0, while we need a 1-based index.
         if (tm.tm_year < currentYear) {
-          history->GetMonthYear(tm.tm_month + 1, tm.tm_year, dateName);
+          nsNavHistory::GetMonthYear(tm, dateName);
         }
         else {
-          history->GetMonthName(tm.tm_month + 1, dateName);
+          nsNavHistory::GetMonthName(tm, dateName);
         }
 
         // From start of MonthIndex + 1 months ago
@@ -4210,46 +4210,36 @@ nsNavHistory::GetStringFromName(const char16_t *aName, nsACString& aResult)
   CopyUTF16toUTF8(nsDependentString(aName), aResult);
 }
 
+// static
 void
-nsNavHistory::GetMonthName(int32_t aIndex, nsACString& aResult)
+nsNavHistory::GetMonthName(const PRExplodedTime& aTime, nsACString& aResult)
 {
-  nsIStringBundle *bundle = GetDateFormatBundle();
-  if (bundle) {
-    nsCString name = nsPrintfCString("month.%d.name", aIndex);
-    nsXPIDLString value;
-    nsresult rv = bundle->GetStringFromName(NS_ConvertUTF8toUTF16(name).get(),
-                                            getter_Copies(value));
-    if (NS_SUCCEEDED(rv)) {
-      CopyUTF16toUTF8(value, aResult);
-      return;
-    }
+  nsAutoString month;
+  nsresult rv = DateTimeFormat::FormatPRExplodedTime(kDateFormatMonthLong,
+                                                     kTimeFormatNone,
+                                                     &aTime,
+                                                     month);
+  if (NS_FAILED(rv)) {
+    aResult = nsPrintfCString("[%d]", aTime.tm_month + 1);
+    return;
   }
-  aResult = nsPrintfCString("[%d]", aIndex);
+  CopyUTF16toUTF8(month, aResult);
 }
 
+// static
 void
-nsNavHistory::GetMonthYear(int32_t aMonth, int32_t aYear, nsACString& aResult)
+nsNavHistory::GetMonthYear(const PRExplodedTime& aTime, nsACString& aResult)
 {
-  nsIStringBundle *bundle = GetBundle();
-  if (bundle) {
-    nsAutoCString monthName;
-    GetMonthName(aMonth, monthName);
-    nsAutoString yearString;
-    yearString.AppendInt(aYear);
-    const char16_t* strings[2] = {
-      NS_ConvertUTF8toUTF16(monthName).get()
-    , yearString.get()
-    };
-    nsXPIDLString value;
-    if (NS_SUCCEEDED(bundle->FormatStringFromName(
-          u"finduri-MonthYear", strings, 2,
-          getter_Copies(value)
-        ))) {
-      CopyUTF16toUTF8(value, aResult);
-      return;
-    }
+  nsAutoString monthYear;
+  nsresult rv = DateTimeFormat::FormatPRExplodedTime(kDateFormatYearMonthLong,
+                                                     kTimeFormatNone,
+                                                     &aTime,
+                                                     monthYear);
+  if (NS_FAILED(rv)) {
+    aResult = nsPrintfCString("[%d-%d]", aTime.tm_month + 1, aTime.tm_year);
+    return;
   }
-  aResult.AppendLiteral("finduri-MonthYear");
+  CopyUTF16toUTF8(monthYear, aResult);
 }
 
 
@@ -4518,18 +4508,3 @@ nsNavHistory::GetBundle()
   }
   return mBundle;
 }
-
-nsIStringBundle *
-nsNavHistory::GetDateFormatBundle()
-{
-  if (!mDateFormatBundle) {
-    nsCOMPtr<nsIStringBundleService> bundleService =
-      services::GetStringBundleService();
-    NS_ENSURE_TRUE(bundleService, nullptr);
-    nsresult rv = bundleService->CreateBundle(
-        "chrome://global/locale/dateFormat.properties",
-        getter_AddRefs(mDateFormatBundle));
-    NS_ENSURE_SUCCESS(rv, nullptr);
-  }
-  return mDateFormatBundle;
-}
diff --git a/toolkit/components/places/nsNavHistory.h b/toolkit/components/places/nsNavHistory.h
index 37fdb1ae8b87..d001efec616b 100644
--- a/toolkit/components/places/nsNavHistory.h
+++ b/toolkit/components/places/nsNavHistory.h
@@ -208,13 +208,12 @@ public:
    * objects for places components.
    */
   nsIStringBundle* GetBundle();
-  nsIStringBundle* GetDateFormatBundle();
   nsICollation* GetCollation();
   void GetStringFromName(const char16_t* aName, nsACString& aResult);
   void GetAgeInDaysString(int32_t aInt, const char16_t *aName,
                           nsACString& aResult);
-  void GetMonthName(int32_t aIndex, nsACString& aResult);
-  void GetMonthYear(int32_t aMonth, int32_t aYear, nsACString& aResult);
+  static void GetMonthName(const PRExplodedTime& aTime, nsACString& aResult);
+  static void GetMonthYear(const PRExplodedTime& aTime, nsACString& aResult);
 
   // Returns whether history is enabled or not.
   bool IsHistoryDisabled() {
@@ -565,7 +564,6 @@ protected:
 
   // localization
   nsCOMPtr<nsIStringBundle> mBundle;
-  nsCOMPtr<nsIStringBundle> mDateFormatBundle;
   nsCOMPtr<nsICollation> mCollation;
 
   // recent events
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index 78834628290d..4713b63506a5 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -144,6 +144,41 @@
     "description": "The operating system audio back-end used when successfully opening an audio stream, or whether the failure occurred on the first try or not <https://dxr.mozilla.org/mozilla-central/search?q=AUDIOSTREAM_BACKEND_ID_STR>",
     "releaseChannelCollection": "opt-out"
   },
+  "AUSHELPER_CPU_ERROR_CODE": {
+    "alert_emails": ["application-update-telemetry-alerts@mozilla.com"],
+    "bug_numbers": [1296630],
+    "expires_in_version": "60",
+    "kind": "enumerated",
+    "n_values": 16,
+    "releaseChannelCollection": "opt-out",
+    "description": "The error code from the aushelper system add-on when querying the registry for CPU information for bug 1296630 (see browser/extensions/aushelper/bootstrap.js)."
+  },
+  "AUSHELPER_CPU_RESULT_CODE": {
+    "alert_emails": ["application-update-telemetry-alerts@mozilla.com"],
+    "bug_numbers": [1296630],
+    "expires_in_version": "60",
+    "kind": "enumerated",
+    "n_values": 5,
+    "releaseChannelCollection": "opt-out",
+    "description": "Whether the system is affected by bug 1296630 (1=No, 2=Yes, 3=Error, and 4=Unknown)."
+  },
+  "AUSHELPER_WEBSENSE_ERROR_CODE": {
+    "alert_emails": ["application-update-telemetry-alerts@mozilla.com"],
+    "bug_numbers": [1305847],
+    "expires_in_version": "60",
+    "kind": "enumerated",
+    "n_values": 8,
+    "releaseChannelCollection": "opt-out",
+    "description": "The error code from the aushelper system add-on when gathering information on Websense (see browser/extensions/aushelper/bootstrap.js)."
+  },
+  "AUSHELPER_WEBSENSE_REG_EXISTS": {
+    "alert_emails": ["application-update-telemetry-alerts@mozilla.com"],
+    "bug_numbers": [1305847],
+    "expires_in_version": "60",
+    "kind": "boolean",
+    "releaseChannelCollection": "opt-out",
+    "description": "Whether the system has a Websense InstallVersion registry value (see browser/extensions/aushelper/bootstrap.js)."
+  },
   "BACKGROUNDFILESAVER_THREAD_COUNT": {
     "expires_in_version": "never",
     "kind": "enumerated",
diff --git a/toolkit/components/telemetry/Scalars.yaml b/toolkit/components/telemetry/Scalars.yaml
index 0f0ae9784c7c..94fdd8e8b5aa 100644
--- a/toolkit/components/telemetry/Scalars.yaml
+++ b/toolkit/components/telemetry/Scalars.yaml
@@ -1,6 +1,20 @@
 # This file contains a definition of the scalar probes that are recorded in Telemetry.
 # They are submitted with the "main" pings and can be inspected in about:telemetry.
 
+# The following section contains the aushelper system add-on scalars.
+aushelper:
+  websense_reg_version:
+    bug_numbers:
+      - 1305847
+    description: The Websense version from the Windows registry.
+    expires: "60"
+    kind: string
+    notification_emails:
+      - application-update-telemetry-alerts@mozilla.com
+    release_channel_collection: opt-out
+    record_in_processes:
+      - 'main'
+
 # The following section contains the browser engagement scalars.
 browser.engagement:
   max_concurrent_tab_count:
diff --git a/toolkit/components/telemetry/Telemetry.cpp b/toolkit/components/telemetry/Telemetry.cpp
index ff665dc9b593..8ad87ad8ca11 100644
--- a/toolkit/components/telemetry/Telemetry.cpp
+++ b/toolkit/components/telemetry/Telemetry.cpp
@@ -12,6 +12,7 @@
 #include <prproces.h>
 
 #include "mozilla/dom/ToJSValue.h"
+#include "mozilla/dom/Promise.h"
 #include "mozilla/Atomics.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/DebugOnly.h"
@@ -24,6 +25,7 @@
 #include "nsIComponentManager.h"
 #include "nsIServiceManager.h"
 #include "nsThreadManager.h"
+#include "nsXPCOMCIDInternal.h"
 #include "nsCOMArray.h"
 #include "nsCOMPtr.h"
 #include "nsXPCOMPrivate.h"
@@ -76,6 +78,8 @@
 #include "mozilla/PoisonIOInterposer.h"
 #include "mozilla/StartupTimeline.h"
 #include "mozilla/HangMonitor.h"
+#include "nsNativeCharsetUtils.h"
+#include "nsProxyRelease.h"
 
 #if defined(MOZ_GECKO_PROFILER)
 #include "shared-libraries.h"
@@ -96,6 +100,8 @@ namespace {
 using namespace mozilla;
 using namespace mozilla::HangMonitor;
 using Telemetry::Common::AutoHashtable;
+using mozilla::dom::Promise;
+using mozilla::dom::AutoJSAPI;
 
 // The maximum number of chrome hangs stacks that we're keeping.
 const size_t kMaxChromeStacksKept = 50;
@@ -1654,8 +1660,197 @@ CreateJSStackObject(JSContext *cx, const CombinedStacks &stacks) {
   return ret;
 }
 
+#if defined(MOZ_GECKO_PROFILER)
+class GetLoadedModulesResultRunnable final : public Runnable
+{
+  nsMainThreadPtrHandle<Promise> mPromise;
+  SharedLibraryInfo mRawModules;
+  nsCOMPtr<nsIThread> mWorkerThread;
+
+public:
+  GetLoadedModulesResultRunnable(const nsMainThreadPtrHandle<Promise>& aPromise, const SharedLibraryInfo& rawModules)
+    : mPromise(aPromise)
+    , mRawModules(rawModules)
+    , mWorkerThread(do_GetCurrentThread())
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+  }
+
+  NS_IMETHOD
+  Run() override
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    mWorkerThread->Shutdown();
+
+    AutoJSAPI jsapi;
+    if (NS_WARN_IF(!jsapi.Init(mPromise->GlobalJSObject()))) {
+      mPromise->MaybeReject(NS_ERROR_FAILURE);
+      return NS_OK;
+    }
+
+    JSContext* cx = jsapi.cx();
+
+    JS::RootedObject moduleArray(cx, JS_NewArrayObject(cx, 0));
+    if (!moduleArray) {
+      mPromise->MaybeReject(NS_ERROR_FAILURE);
+      return NS_OK;
+    }
+
+    for (unsigned int i = 0, n = mRawModules.GetSize(); i != n; i++) {
+      const SharedLibrary &info = mRawModules.GetEntry(i);
+
+      nsString basename = info.GetName();
+#if defined(XP_MACOSX) || defined(XP_LINUX)
+      int32_t pos = basename.RFindChar('/');
+      if (pos != kNotFound) {
+        basename.Cut(0, pos + 1);
+      }
+#endif
+
+      nsString debug_basename = info.GetDebugName();
+#if defined(XP_MACOSX) || defined(XP_LINUX)
+      pos = debug_basename.RFindChar('/');
+      if (pos != kNotFound) {
+        debug_basename.Cut(0, pos + 1);
+      }
+#endif
+
+      JS::RootedObject moduleObj(cx, JS_NewPlainObject(cx));
+      if (!moduleObj) {
+        mPromise->MaybeReject(NS_ERROR_FAILURE);
+        return NS_OK;
+      }
+
+      // Module name.
+      JS::RootedString moduleName(cx, JS_NewUCStringCopyZ(cx, basename.get()));
+      if (!moduleName || !JS_DefineProperty(cx, moduleObj, "name", moduleName, JSPROP_ENUMERATE)) {
+        mPromise->MaybeReject(NS_ERROR_FAILURE);
+        return NS_OK;
+      }
+
+      // Module debug name.
+      JS::RootedValue moduleDebugName(cx);
+
+      if (!debug_basename.IsEmpty()) {
+        JS::RootedString str_moduleDebugName(cx, JS_NewUCStringCopyZ(cx, debug_basename.get()));
+        if (!str_moduleDebugName) {
+          mPromise->MaybeReject(NS_ERROR_FAILURE);
+          return NS_OK;
+        }
+        moduleDebugName.setString(str_moduleDebugName);
+      }
+      else {
+        moduleDebugName.setNull();
+      }
+
+      if (!JS_DefineProperty(cx, moduleObj, "debugName", moduleDebugName, JSPROP_ENUMERATE)) {
+        mPromise->MaybeReject(NS_ERROR_FAILURE);
+        return NS_OK;
+      }
+
+      // Module Breakpad identifier.
+      JS::RootedValue id(cx);
+
+      if (!info.GetBreakpadId().empty()) {
+        JS::RootedString str_id(cx, JS_NewStringCopyZ(cx, info.GetBreakpadId().c_str()));
+        if (!str_id) {
+          mPromise->MaybeReject(NS_ERROR_FAILURE);
+          return NS_OK;
+        }
+        id.setString(str_id);
+      } else {
+        id.setNull();
+      }
+
+      if (!JS_DefineProperty(cx, moduleObj, "debugID", id, JSPROP_ENUMERATE)) {
+        mPromise->MaybeReject(NS_ERROR_FAILURE);
+        return NS_OK;
+      }
+
+      // Module version.
+      JS::RootedValue version(cx);
+
+      if (!info.GetVersion().empty()) {
+        JS::RootedString v(cx, JS_NewStringCopyZ(cx, info.GetVersion().c_str()));
+        if (!v) {
+          mPromise->MaybeReject(NS_ERROR_FAILURE);
+          return NS_OK;
+        }
+        version.setString(v);
+      } else {
+        version.setNull();
+      }
+
+      if (!JS_DefineProperty(cx, moduleObj, "version", version, JSPROP_ENUMERATE)) {
+        mPromise->MaybeReject(NS_ERROR_FAILURE);
+        return NS_OK;
+      }
+
+      if (!JS_DefineElement(cx, moduleArray, i, moduleObj, JSPROP_ENUMERATE)) {
+        mPromise->MaybeReject(NS_ERROR_FAILURE);
+        return NS_OK;
+      }
+    }
+
+    mPromise->MaybeResolve(moduleArray);
+    return NS_OK;
+  }
+};
+
+class GetLoadedModulesRunnable final : public Runnable
+{
+  nsMainThreadPtrHandle<Promise> mPromise;
+
+public:
+  explicit GetLoadedModulesRunnable(const nsMainThreadPtrHandle<Promise>& aPromise)
+    : mPromise(aPromise)
+  { }
+
+  NS_IMETHOD
+  Run() override
+  {
+    nsCOMPtr<nsIRunnable> resultRunnable = new GetLoadedModulesResultRunnable(mPromise, SharedLibraryInfo::GetInfoForSelf());
+    return NS_DispatchToMainThread(resultRunnable);
+  }
+};
+#endif // MOZ_GECKO_PROFILER
+
+NS_IMETHODIMP
+TelemetryImpl::GetLoadedModules(JSContext *cx, nsISupports** aPromise)
+{
+  nsIGlobalObject* global = xpc::NativeGlobal(JS::CurrentGlobalOrNull(cx));
+  if (NS_WARN_IF(!global)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  ErrorResult result;
+  RefPtr<Promise> promise = Promise::Create(global, result);
+  if (NS_WARN_IF(result.Failed())) {
+    return result.StealNSResult();
+  }
+
+#if defined(MOZ_GECKO_PROFILER)
+  nsCOMPtr<nsIThreadManager> tm = do_GetService(NS_THREADMANAGER_CONTRACTID);
+  nsCOMPtr<nsIThread> getModulesThread;
+  nsresult rv = tm->NewThread(0, 0, getter_AddRefs(getModulesThread));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  nsMainThreadPtrHandle<Promise> mainThreadPromise(new nsMainThreadPtrHolder<Promise>(promise));
+  nsCOMPtr<nsIRunnable> runnable = new GetLoadedModulesRunnable(mainThreadPromise);
+  promise.forget(aPromise);
+
+  return getModulesThread->Dispatch(runnable, nsIEventTarget::DISPATCH_NORMAL);
+#else // MOZ_GECKO_PROFILER
+  return NS_ERROR_NOT_IMPLEMENTED;
+#endif // MOZ_GECKO_PROFILER
+}
+
 static bool
-IsValidBreakpadId(const std::string &breakpadId) {
+IsValidBreakpadId(const std::string &breakpadId)
+{
   if (breakpadId.size() < 33) {
     return false;
   }
@@ -3029,15 +3224,14 @@ GetStackAndModules(const std::vector<uintptr_t>& aPCs)
 #ifdef MOZ_GECKO_PROFILER
   for (unsigned i = 0, n = rawModules.GetSize(); i != n; ++i) {
     const SharedLibrary &info = rawModules.GetEntry(i);
-    const std::string &name = info.GetName();
-    std::string basename = name;
+    std::string basename = info.GetNativeDebugName();
 #if defined(XP_MACOSX) || defined(XP_LINUX)
     // We want to use just the basename as the libname, but the
     // current profiler addon needs the full path name, so we compute the
     // basename in here.
-    size_t pos = name.rfind('/');
+    size_t pos = basename.rfind('/');
     if (pos != std::string::npos) {
-      basename = name.substr(pos + 1);
+      basename = basename.substr(pos + 1);
     }
 #endif
     mozilla::Telemetry::ProcessedStack::Module module = {
diff --git a/toolkit/components/telemetry/TelemetryController.jsm b/toolkit/components/telemetry/TelemetryController.jsm
index 546bd49f5bff..e9b598441315 100644
--- a/toolkit/components/telemetry/TelemetryController.jsm
+++ b/toolkit/components/telemetry/TelemetryController.jsm
@@ -84,6 +84,8 @@ XPCOMUtils.defineLazyModuleGetter(this, "TelemetrySend",
                                   "resource://gre/modules/TelemetrySend.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "TelemetryReportingPolicy",
                                   "resource://gre/modules/TelemetryReportingPolicy.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "TelemetryModules",
+                                  "resource://gre/modules/TelemetryModules.jsm");
 
 /**
  * Setup Telemetry logging. This function also gets called when loggin related
@@ -750,6 +752,9 @@ var Impl = {
         // in the future.
         TelemetryStorage.removeFHRDatabase();
 
+        // Report the modules loaded in the Firefox process.
+        TelemetryModules.start();
+
         this._delayedInitTaskDeferred.resolve();
       } catch (e) {
         this._delayedInitTaskDeferred.reject(e);
diff --git a/toolkit/components/telemetry/TelemetryModules.jsm b/toolkit/components/telemetry/TelemetryModules.jsm
new file mode 100644
index 000000000000..0964ab3998f5
--- /dev/null
+++ b/toolkit/components/telemetry/TelemetryModules.jsm
@@ -0,0 +1,99 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "Preferences",
+  "resource://gre/modules/Preferences.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "Log",
+  "resource://gre/modules/Log.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "TelemetryController",
+  "resource://gre/modules/TelemetryController.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "AppConstants",
+  "resource://gre/modules/AppConstants.jsm");
+
+XPCOMUtils.defineLazyServiceGetter(this, "gUpdateTimerManager",
+  "@mozilla.org/updates/timer-manager;1", "nsIUpdateTimerManager");
+XPCOMUtils.defineLazyServiceGetter(this, "Telemetry",
+  "@mozilla.org/base/telemetry;1", "nsITelemetry");
+
+this.EXPORTED_SYMBOLS = [
+  "TelemetryModules",
+];
+
+const LOGGER_NAME = "Toolkit.Telemetry";
+const LOGGER_PREFIX = "TelemetryModules::";
+
+// The default is 1 week.
+const MODULES_PING_INTERVAL_SECONDS = 7 * 24 * 60 * 60;
+const MODULES_PING_INTERVAL_PREFERENCE = "toolkit.telemetry.modulesPing.interval";
+
+const MAX_MODULES_NUM = 512;
+const MAX_NAME_LENGTH = 64;
+const TRUNCATION_DELIMITER = "\u2026";
+
+this.TelemetryModules = Object.freeze({
+  _log: Log.repository.getLoggerWithMessagePrefix(LOGGER_NAME, LOGGER_PREFIX),
+
+  start() {
+    // The list of loaded modules is obtainable only when the profiler is enabled.
+    // If it isn't, we don't want to send the ping at all.
+    if (!AppConstants.MOZ_GECKO_PROFILER) {
+      return;
+    }
+
+    // Use nsIUpdateTimerManager for a long-duration timer that survives across sessions.
+    gUpdateTimerManager.registerTimer(
+      "telemetry_modules_ping",
+      this,
+      Preferences.get(MODULES_PING_INTERVAL_PREFERENCE, MODULES_PING_INTERVAL_SECONDS)
+    );
+  },
+
+  /**
+   * Called when the 'telemetry_modules_ping' timer fires.
+   */
+  notify() {
+    try {
+      Telemetry.getLoadedModules().then(
+        modules => {
+          modules = modules.filter(module => module.name.length > 0);
+
+          // Cut the list of modules to MAX_MODULES_NUM entries.
+          if (modules.length > MAX_MODULES_NUM) {
+            modules = modules.slice(0, MAX_MODULES_NUM);
+          }
+
+          // Cut the file names of the modules to MAX_NAME_LENGTH characters.
+          for (let module of modules) {
+            if (module.name.length > MAX_NAME_LENGTH) {
+              module.name = module.name.substr(0, MAX_NAME_LENGTH - 1) + TRUNCATION_DELIMITER;
+            }
+
+            if (module.debugName !== null && module.debugName.length > MAX_NAME_LENGTH) {
+              module.debugName = module.debugName.substr(0, MAX_NAME_LENGTH - 1) + TRUNCATION_DELIMITER;
+            }
+          }
+
+          TelemetryController.submitExternalPing("modules",
+            {
+              version: 1,
+              modules,
+            },
+            {
+              addClientId: true,
+              addEnvironment: true,
+            }
+          );
+        },
+        err => this._log.error("notify - promise failed", ex)
+      );
+    } catch (ex) {
+      this._log.error("notify - caught exception", ex);
+    }
+  },
+});
+
diff --git a/toolkit/components/telemetry/docs/data/modules-ping.rst b/toolkit/components/telemetry/docs/data/modules-ping.rst
new file mode 100644
index 000000000000..209eba95948f
--- /dev/null
+++ b/toolkit/components/telemetry/docs/data/modules-ping.rst
@@ -0,0 +1,45 @@
+
+"modules" ping
+============
+
+This ping is sent once a week and includes the modules loaded in the Firefox process.
+
+The client ID and environment is submitted with this ping.
+
+Structure:
+
+.. code-block:: js
+
+    {
+      type: "modules",
+      ... common ping data
+      clientId: <UUID>,
+      environment: { ... },
+      payload: {
+        version: 1,
+        modules: [
+          {
+            name: <string>, // Name of the module file (e.g. xul.dll)
+            version: <string>, // Version of the module
+            debugID: <string>, // ID of the debug information file
+            debugName: <string>, // Name of the debug information file
+          },
+          ...
+        ],
+      }
+    }
+
+Notes
+~~~~~
+
+The version information is only available on Windows, it is null on other platforms.
+
+The debug name is the name of the PDB on Windows (which isn't always the same as the module name modulo the extension, e.g. the PDB for C:\Windows\SysWOW64\ntdll.dll is wntdll.pdb) and is the same as the module name on other platforms.
+
+The debug ID is platform-dependent. It is compatible with the Breakpad ID used on Socorro.
+
+Sometimes the debug name and debug ID are missing for Windows modules (often with malware). In this case, they will be "null".
+
+The length of the modules array is limited to 512 entries.
+
+The name and debug name are length limited, with a maximum of 64 characters.
diff --git a/toolkit/components/telemetry/docs/internals/preferences.rst b/toolkit/components/telemetry/docs/internals/preferences.rst
index 710cd3cc3e42..f0e9d58a1833 100644
--- a/toolkit/components/telemetry/docs/internals/preferences.rst
+++ b/toolkit/components/telemetry/docs/internals/preferences.rst
@@ -118,6 +118,10 @@ The following prefs are for testing purpose only.
 
   Timeout until we decide whether a user is idle or not (seconds).
 
+``toolkit.telemetry.modulesPing.interval``
+
+  Interval between "modules" ping transmissions.
+
 ``toolkit.telemetry.send.overrideOfficialCheck``
 
   If true, allows sending pings on unofficial builds. Requires a restart.
diff --git a/toolkit/components/telemetry/moz.build b/toolkit/components/telemetry/moz.build
index ab5258fc67a6..776f8bd9dfc3 100644
--- a/toolkit/components/telemetry/moz.build
+++ b/toolkit/components/telemetry/moz.build
@@ -30,6 +30,8 @@ if CONFIG['GNU_CXX']:
 if CONFIG['ENABLE_TESTS']:
     DIRS += ['tests/gtest']
 
+TEST_DIRS += ['tests']
+
 XPCSHELL_TESTS_MANIFESTS += ['tests/unit/xpcshell.ini']
 BROWSER_CHROME_MANIFESTS += ['tests/browser/browser.ini']
 
@@ -72,6 +74,7 @@ EXTRA_JS_MODULES += [
     'TelemetryController.jsm',
     'TelemetryEnvironment.jsm',
     'TelemetryLog.jsm',
+    'TelemetryModules.jsm',
     'TelemetryReportingPolicy.jsm',
     'TelemetrySend.jsm',
     'TelemetrySession.jsm',
diff --git a/toolkit/components/telemetry/nsITelemetry.idl b/toolkit/components/telemetry/nsITelemetry.idl
index f9ced2cb0e2b..fdf0dd26bd25 100644
--- a/toolkit/components/telemetry/nsITelemetry.idl
+++ b/toolkit/components/telemetry/nsITelemetry.idl
@@ -180,6 +180,25 @@ interface nsITelemetry : nsISupports
   [implicit_jscontext]
   jsval snapshotCapturedStacks([optional] in boolean clear);
 
+  /*
+   * Returns an array of the modules loaded in the process. The data has the following structure:
+   *
+   * [
+   *   {
+   *     "name": <string>, // Name of the module file (e.g. xul.dll)
+   *     "version": <string>, // Version of the module
+   *     "debugName": <string>, // ID of the debug information file
+   *     "debugID": <string>, // Name of the debug information file
+   *   },
+   *   ...
+   * ]
+   *
+   * @return An array of modules.
+   * @throws NS_ERROR_FAILURE on failure.
+   */
+  [implicit_jscontext]
+  nsISupports getLoadedModules();
+
   /*
    * An array of thread hang stats,
    *   [<thread>, <thread>, ...]
diff --git a/toolkit/components/telemetry/tests/modules-test.cpp b/toolkit/components/telemetry/tests/modules-test.cpp
new file mode 100644
index 000000000000..365d39e04ada
--- /dev/null
+++ b/toolkit/components/telemetry/tests/modules-test.cpp
@@ -0,0 +1,8 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+void nothing()
+{
+  return;
+}
+
diff --git a/toolkit/components/telemetry/tests/moz.build b/toolkit/components/telemetry/tests/moz.build
new file mode 100644
index 000000000000..dd65d2c82c91
--- /dev/null
+++ b/toolkit/components/telemetry/tests/moz.build
@@ -0,0 +1,17 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+DIST_INSTALL = False
+
+SOURCES += [
+    'modules-test.cpp',
+]
+
+SharedLibrary('modules-test')
+
+if CONFIG['COMPILE_ENVIRONMENT']:
+    shared_library = '!%smodules-test%s' % (CONFIG['DLL_PREFIX'], CONFIG['DLL_SUFFIX'])
+    TEST_HARNESS_FILES.xpcshell.toolkit.components.telemetry.tests.unit += [shared_library]
diff --git a/toolkit/components/telemetry/tests/unit/testNoPDB32.dll b/toolkit/components/telemetry/tests/unit/testNoPDB32.dll
new file mode 100644
index 000000000000..e7f9febc4b56
Binary files /dev/null and b/toolkit/components/telemetry/tests/unit/testNoPDB32.dll differ
diff --git a/toolkit/components/telemetry/tests/unit/testNoPDB64.dll b/toolkit/components/telemetry/tests/unit/testNoPDB64.dll
new file mode 100644
index 000000000000..19f95c98ed5f
Binary files /dev/null and b/toolkit/components/telemetry/tests/unit/testNoPDB64.dll differ
diff --git a/toolkit/components/telemetry/tests/unit/testUnicodePDB32.dll b/toolkit/components/telemetry/tests/unit/testUnicodePDB32.dll
new file mode 100644
index 000000000000..d3eec65ea567
Binary files /dev/null and b/toolkit/components/telemetry/tests/unit/testUnicodePDB32.dll differ
diff --git a/toolkit/components/telemetry/tests/unit/testUnicodePDB64.dll b/toolkit/components/telemetry/tests/unit/testUnicodePDB64.dll
new file mode 100644
index 000000000000..c11f8453de87
Binary files /dev/null and b/toolkit/components/telemetry/tests/unit/testUnicodePDB64.dll differ
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetryModules.js b/toolkit/components/telemetry/tests/unit/test_TelemetryModules.js
new file mode 100644
index 000000000000..412eaa5813fd
--- /dev/null
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetryModules.js
@@ -0,0 +1,176 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+Cu.import("resource://gre/modules/TelemetryModules.jsm");
+Cu.import("resource://gre/modules/AppConstants.jsm");
+Cu.import("resource://gre/modules/Preferences.jsm");
+Cu.import("resource://gre/modules/ctypes.jsm");
+Cu.import("resource://gre/modules/osfile.jsm");
+
+const MAX_NAME_LENGTH = 64;
+
+const libModules = ctypes.libraryName("modules-test");
+const libUnicode = ctypes.libraryName("modμles-test");
+const libLongName = "lorem_ipsum_dolor_sit_amet_consectetur_adipiscing_elit_Fusce_sit_amet_tellus_non_magna_euismod_vestibulum_Vivamus_turpis_duis.dll"
+const libUnicodePDB = Services.appinfo.is64Bit ? "testUnicodePDB64.dll" : "testUnicodePDB32.dll";
+const libNoPDB = Services.appinfo.is64Bit ? "testNoPDB64.dll" : "testNoPDB32.dll";
+const libxul = OS.Path.basename(OS.Constants.Path.libxul);
+
+const libModulesFile = do_get_file(libModules).path;
+const libUnicodeFile = OS.Path.join(OS.Path.dirname(libModulesFile), libUnicode);
+const libLongNameFile = OS.Path.join(OS.Path.dirname(libModulesFile), libLongName);
+const libUnicodePDBFile = do_get_file(libUnicodePDB).path;
+const libNoPDBFile = do_get_file(libNoPDB).path;
+
+let libModulesHandle, libUnicodeHandle, libLongNameHandle, libUnicodePDBHandle, libNoPDBHandle;
+
+let expectedLibs;
+if (AppConstants.platform === "win") {
+  const version = AppConstants.MOZ_APP_VERSION.substring(0, AppConstants.MOZ_APP_VERSION.indexOf(".") + 2);
+
+  expectedLibs = [
+    {
+      name: libxul,
+      debugName: libxul.replace(".dll", ".pdb"),
+      version,
+    },
+    {
+      name: libModules,
+      debugName: libModules.replace(".dll", ".pdb"),
+      version,
+    },
+    {
+      name: libUnicode,
+      debugName: libModules.replace(".dll", ".pdb"),
+      version,
+    },
+    {
+      name: libLongName.substring(0, MAX_NAME_LENGTH - 1) + "…",
+      debugName: libModules.replace(".dll", ".pdb"),
+      version,
+    },
+    {
+      name: libUnicodePDB,
+      debugName: "libmodμles.pdb",
+      version: null,
+    },
+    {
+      name: libNoPDB,
+      debugName: null,
+      version: null,
+    },
+  ];
+} else if (AppConstants.platform === "android") {
+  // Listing shared libraries doesn't work in Android xpcshell tests.
+  // https://hg.mozilla.org/mozilla-central/file/0eef1d5a39366059677c6d7944cfe8a97265a011/tools/profiler/core/shared-libraries-linux.cc#l95
+  expectedLibs = [];
+} else {
+  expectedLibs = [
+    {
+      name: libxul,
+      debugName: libxul,
+      version: null,
+    },
+    {
+      name: libModules,
+      debugName: libModules,
+      version: null,
+    },
+    {
+      name: libUnicode,
+      debugName: libUnicode,
+      version: null,
+    },
+    {
+      name: libLongName.substring(0, MAX_NAME_LENGTH - 1) + "…",
+      debugName: libLongName.substring(0, MAX_NAME_LENGTH - 1) + "…",
+      version: null,
+    },
+  ];
+}
+
+add_task(function* setup() {
+  do_get_profile();
+
+  yield OS.File.copy(libModulesFile, libUnicodeFile);
+  yield OS.File.copy(libModulesFile, libLongName);
+
+  if (AppConstants.platform !== "android") {
+    libModulesHandle = ctypes.open(libModulesFile);
+    libUnicodeHandle = ctypes.open(libUnicodeFile);
+    libLongNameHandle = ctypes.open(libLongNameFile);
+    if (AppConstants.platform === "win") {
+      libUnicodePDBHandle = ctypes.open(libUnicodePDBFile);
+      libNoPDBHandle = ctypes.open(libNoPDBFile);
+    }
+  }
+
+  // Force the timer to fire (using a small interval).
+  Cc["@mozilla.org/updates/timer-manager;1"].getService(Ci.nsIObserver).observe(null, "utm-test-init", "");
+  Preferences.set("toolkit.telemetry.modulesPing.interval", 0);
+  Preferences.set("app.update.url", "http:/localhost");
+
+  // Start the local ping server and setup Telemetry to use it during the tests.
+  PingServer.start();
+  Preferences.set("toolkit.telemetry.server", "http://localhost:" + PingServer.port);
+});
+
+do_register_cleanup(function() {
+  if (libModulesHandle) {
+    libModulesHandle.close();
+  }
+  if (libUnicodeHandle) {
+    libUnicodeHandle.close();
+  }
+  if (libLongNameHandle) {
+    libLongNameHandle.close();
+  }
+  if (libUnicodePDBHandle) {
+    libUnicodePDBHandle.close();
+  }
+  if (libNoPDBHandle) {
+    libNoPDBHandle.close();
+  }
+
+  return OS.File.remove(libUnicodeFile)
+  .then(() => OS.File.remove(libLongNameFile))
+  .then(() => PingServer.stop());
+});
+
+add_task({
+  skip_if: () => !AppConstants.MOZ_GECKO_PROFILER,
+}, function* test_send_ping() {
+  yield TelemetryController.testSetup();
+
+  let found = yield PingServer.promiseNextPing();
+  Assert.ok(!!found, "Telemetry ping submitted.");
+  Assert.strictEqual(found.type, "modules", "Ping type is 'modules'");
+  Assert.ok(found.environment, "'modules' ping has an environment.");
+  Assert.ok(!!found.clientId, "'modules' ping has a client ID.");
+  Assert.ok(!!found.payload.modules, "Telemetry ping payload contains the 'modules' array.");
+
+  for (let lib of expectedLibs) {
+    let test_lib = found.payload.modules.find(module => module.name === lib.name);
+
+    Assert.ok(!!test_lib, "There is a '" + lib.name + "' module.");
+
+    if (lib.version !== null) {
+      Assert.ok(test_lib.version.startsWith(lib.version), "The version of the " + lib.name + " module (" + test_lib.version + ") is correct (it starts with '" + lib.version + "').");
+    } else {
+      Assert.strictEqual(test_lib.version, null, "The version of the " + lib.name + " module is null.");
+    }
+
+    Assert.strictEqual(test_lib.debugName, lib.debugName, "The " + lib.name + " module has the correct debug name.");
+
+    if (lib.debugName === null) {
+      Assert.strictEqual(test_lib.debugID, null, "The " + lib.name + " module doesn't have a debug ID.");
+    } else {
+      Assert.greater(test_lib.debugID.length, 0, "The " + lib.name + " module has a debug ID.");
+    }
+  }
+
+  let test_lib = found.payload.modules.find(module => module.name === libLongName);
+  Assert.ok(!test_lib, "There isn't a '" + libLongName + "' module.");
+});
diff --git a/toolkit/components/telemetry/tests/unit/xpcshell.ini b/toolkit/components/telemetry/tests/unit/xpcshell.ini
index bde008bcaa13..544d0fc89fe2 100644
--- a/toolkit/components/telemetry/tests/unit/xpcshell.ini
+++ b/toolkit/components/telemetry/tests/unit/xpcshell.ini
@@ -14,6 +14,10 @@ support-files =
   system.xpi
   restartless.xpi
   theme.xpi
+  testUnicodePDB32.dll
+  testNoPDB32.dll
+  testUnicodePDB64.dll
+  testNoPDB64.dll
   !/toolkit/mozapps/extensions/test/xpcshell/head_addons.js
 generated-files =
   dictionary.xpi
@@ -63,5 +67,6 @@ tags = addons
 skip-if = toolkit == 'android'
 [test_TelemetryCaptureStack.js]
 [test_TelemetryEvents.js]
+[test_TelemetryModules.js]
 [test_PingSender.js]
 skip-if = (os == "android") || (os == "linux" && bits == 32)
diff --git a/toolkit/components/url-classifier/tests/mochitest/basic.vtt^headers^ b/toolkit/components/url-classifier/tests/mochitest/basic.vtt^headers^
new file mode 100644
index 000000000000..23de552c1a40
--- /dev/null
+++ b/toolkit/components/url-classifier/tests/mochitest/basic.vtt^headers^
@@ -0,0 +1 @@
+Access-Control-Allow-Origin: *
\ No newline at end of file
diff --git a/toolkit/components/url-classifier/tests/mochitest/mochitest.ini b/toolkit/components/url-classifier/tests/mochitest/mochitest.ini
index 924a62d441e1..753d8038e0d7 100644
--- a/toolkit/components/url-classifier/tests/mochitest/mochitest.ini
+++ b/toolkit/components/url-classifier/tests/mochitest/mochitest.ini
@@ -20,6 +20,7 @@ support-files =
   workerFrame.html
   ping.sjs
   basic.vtt
+  basic.vtt^headers^
   dnt.html
   dnt.sjs
   update.sjs
@@ -28,6 +29,7 @@ support-files =
   gethash.sjs
   gethashFrame.html
   tracker.js
+  seek.webm
 
 [test_classifier.html]
 skip-if = (os == 'linux' && debug) #Bug 1199778
diff --git a/toolkit/components/url-classifier/tests/mochitest/seek.webm b/toolkit/components/url-classifier/tests/mochitest/seek.webm
new file mode 100644
index 000000000000..72b029723336
Binary files /dev/null and b/toolkit/components/url-classifier/tests/mochitest/seek.webm differ
diff --git a/toolkit/components/url-classifier/tests/mochitest/test_classify_track.html b/toolkit/components/url-classifier/tests/mochitest/test_classify_track.html
index 3ff6039beefc..a868d79602c5 100644
--- a/toolkit/components/url-classifier/tests/mochitest/test_classify_track.html
+++ b/toolkit/components/url-classifier/tests/mochitest/test_classify_track.html
@@ -20,6 +20,9 @@
   const validtrack_url = "http://mochi.test:8888/" + track_path;
 
   var video = document.createElement("video");
+  video.src = "seek.webm";
+  video.crossOrigin = "anonymous";
+
   document.body.appendChild(video);
 
   function testValidTrack() {
diff --git a/toolkit/content/license.html b/toolkit/content/license.html
index 59aed63f84f9..5e80638e4f5b 100644
--- a/toolkit/content/license.html
+++ b/toolkit/content/license.html
@@ -139,6 +139,7 @@
       <li><a href="about:license#pocketsphinx">Pocketsphinx License</a></li>
 #endif
       <li><a href="about:license#praton">praton License</a></li>
+      <li><a href="about:license#praton1">praton and inet_ntop License</a></li>
       <li><a href="about:license#qcms">qcms License</a></li>
       <li><a href="about:license#qrcode-generator">QR Code Generator License</a></li>
       <li><a href="about:license#react">React License</a></li>
@@ -4645,8 +4646,18 @@ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
 PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
 ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 SOFTWARE.
+</pre>
 
 
+    <hr>
+
+    <h1><a id="praton1"></a>praton and inet_ntop License</h1>
+
+    <p>This license applies to the files
+    <span class="path">nsprpub/pr/src/misc/praton.c</span> and
+    <span class="path">media/mtransport/third_party/nrappkit/src/util/util.c</span>.</p>
+
+<pre>
 Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 Portions Copyright (c) 1996-1999 by Internet Software Consortium.
 
diff --git a/toolkit/locales/en-US/chrome/global/dateFormat.properties b/toolkit/locales/en-US/chrome/global/dateFormat.properties
deleted file mode 100644
index a564c0d4d079..000000000000
--- a/toolkit/locales/en-US/chrome/global/dateFormat.properties
+++ /dev/null
@@ -1,58 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-month.1.Mmm=Jan
-month.2.Mmm=Feb
-month.3.Mmm=Mar
-month.4.Mmm=Apr
-month.5.Mmm=May
-month.6.Mmm=Jun
-month.7.Mmm=Jul
-month.8.Mmm=Aug
-month.9.Mmm=Sep
-month.10.Mmm=Oct
-month.11.Mmm=Nov
-month.12.Mmm=Dec
-
-month.1.name=January
-month.2.name=February
-month.3.name=March
-month.4.name=April
-month.5.name=May
-month.6.name=June
-month.7.name=July
-month.8.name=August
-month.9.name=September
-month.10.name=October
-month.11.name=November
-month.12.name=December
-
-day.1.name=Sunday
-day.2.name=Monday
-day.3.name=Tuesday
-day.4.name=Wednesday
-day.5.name=Thursday
-day.6.name=Friday
-day.7.name=Saturday
-
-day.1.Mmm=Sun
-day.2.Mmm=Mon
-day.3.Mmm=Tue
-day.4.Mmm=Wed
-day.5.Mmm=Thu
-day.6.Mmm=Fri
-day.7.Mmm=Sat
-
-day.1.short=Su
-day.2.short=Mo
-day.3.short=Tu
-day.4.short=We
-day.5.short=Th
-day.6.short=Fr
-day.7.short=Sa
-
-noon=Noon
-midnight=Midnight
-
-AllDay=All Day
diff --git a/toolkit/locales/en-US/chrome/places/places.properties b/toolkit/locales/en-US/chrome/places/places.properties
index f9edeeff07c0..e863f9796ba1 100644
--- a/toolkit/locales/en-US/chrome/places/places.properties
+++ b/toolkit/locales/en-US/chrome/places/places.properties
@@ -17,9 +17,6 @@ finduri-AgeInDays-last-is=Last %S days
 finduri-AgeInDays-isgreater=Older than %S days
 finduri-AgeInMonths-is-0=This month
 finduri-AgeInMonths-isgreater=Older than %S months
-# LOCALIZATION NOTE (finduri-MonthYear):
-# %1$S is the month name, %2$S is the year (4 digits format).
-finduri-MonthYear=%1$S %2$S
 
 # LOCALIZATION NOTE (localFiles):
 # This is used to generate local files container when history is grouped by site
diff --git a/toolkit/locales/jar.mn b/toolkit/locales/jar.mn
index 2de411e37164..bb365a51d048 100644
--- a/toolkit/locales/jar.mn
+++ b/toolkit/locales/jar.mn
@@ -38,7 +38,6 @@
   locale/@AB_CD@/global/customizeToolbar.properties     (%chrome/global/customizeToolbar.properties)
 #endif
   locale/@AB_CD@/global/datetimepicker.dtd              (%chrome/global/datetimepicker.dtd)
-  locale/@AB_CD@/global/dateFormat.properties           (%chrome/global/dateFormat.properties)
   locale/@AB_CD@/global/dialogOverlay.dtd               (%chrome/global/dialogOverlay.dtd)
 #ifndef MOZ_FENNEC
   locale/@AB_CD@/global/editMenuOverlay.dtd             (%chrome/global/editMenuOverlay.dtd)
diff --git a/toolkit/modules/subprocess/subprocess_worker_win.js b/toolkit/modules/subprocess/subprocess_worker_win.js
index 4bef3bca2aa5..eec5232544c1 100644
--- a/toolkit/modules/subprocess/subprocess_worker_win.js
+++ b/toolkit/modules/subprocess/subprocess_worker_win.js
@@ -521,7 +521,10 @@ class Process extends BaseProcess {
 
     if (ok) {
       ok = libc.AssignProcessToJobObject(this.jobHandle, procInfo.hProcess);
-      errorMessage = `Failed to attach process to job object: 0x${(ctypes.winLastError || 0).toString(16)}`;
+      if (!ok) {
+        errorMessage = `Failed to attach process to job object: 0x${(ctypes.winLastError || 0).toString(16)}`;
+        libc.TerminateProcess(procInfo.hProcess, TERMINATE_EXIT_CODE);
+      }
     }
 
     if (!ok) {
diff --git a/tools/profiler/core/EHABIStackWalk.cpp b/tools/profiler/core/EHABIStackWalk.cpp
index 76068cdea607..fb8a171e97fa 100644
--- a/tools/profiler/core/EHABIStackWalk.cpp
+++ b/tools/profiler/core/EHABIStackWalk.cpp
@@ -638,7 +638,7 @@ void EHAddrSpace::Update() {
       // itself.
       continue;
     EHTable tab(reinterpret_cast<const void *>(lib.GetStart()),
-              lib.GetEnd() - lib.GetStart(), lib.GetName());
+              lib.GetEnd() - lib.GetStart(), lib.GetNativeDebugName());
     if (tab.isValid())
       tables.push_back(tab);
   }
diff --git a/tools/profiler/core/PlatformMacros.h b/tools/profiler/core/PlatformMacros.h
index 6e7cea2187ac..bfa725fe7e17 100644
--- a/tools/profiler/core/PlatformMacros.h
+++ b/tools/profiler/core/PlatformMacros.h
@@ -3,80 +3,81 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef SPS_PLATFORM_MACROS_H
-#define SPS_PLATFORM_MACROS_H
+#ifndef PLATFORM_MACROS_H
+#define PLATFORM_MACROS_H
 
-/* Define platform selection macros in a consistent way.  Don't add
-   anything else to this file, so it can remain freestanding.  The
-   primary factorisation is on (ARCH,OS) pairs ("PLATforms") but ARCH_
-   and OS_ macros are defined too, since they are sometimes
-   convenient. */
+// Define platform selection macros in a consistent way. Don't add anything
+// else to this file, so it can remain freestanding. The primary factorisation
+// is on (ARCH,OS) pairs ("PLATforms") but ARCH_ and OS_ macros are defined
+// too, since they are sometimes convenient.
+//
+// Note: "GP" is short for "Gecko Profiler".
 
-#undef SPS_PLAT_x86_android
-#undef SPS_PLAT_arm_android
-#undef SPS_PLAT_x86_linux
-#undef SPS_PLAT_amd64_linux
-#undef SPS_PLAT_x86_darwin
-#undef SPS_PLAT_amd64_darwin
-#undef SPS_PLAT_x86_windows
-#undef SPS_PLAT_amd64_windows
+#undef GP_PLAT_x86_android
+#undef GP_PLAT_arm_android
+#undef GP_PLAT_x86_linux
+#undef GP_PLAT_amd64_linux
+#undef GP_PLAT_x86_darwin
+#undef GP_PLAT_amd64_darwin
+#undef GP_PLAT_x86_windows
+#undef GP_PLAT_amd64_windows
 
-#undef SPS_ARCH_x86
-#undef SPS_ARCH_amd64
-#undef SPS_ARCH_arm
+#undef GP_ARCH_x86
+#undef GP_ARCH_amd64
+#undef GP_ARCH_arm
 
-#undef SPS_OS_android
-#undef SPS_OS_linux
-#undef SPS_OS_darwin
-#undef SPS_OS_windows
+#undef GP_OS_android
+#undef GP_OS_linux
+#undef GP_OS_darwin
+#undef GP_OS_windows
 
 // We test __ANDROID__ before __linux__ because __linux__ is defined on both
-// Android and Linux, whereas SPS_OS_android is not defined on vanilla Linux.
+// Android and Linux, whereas GP_OS_android is not defined on vanilla Linux.
 
 #if defined(__ANDROID__) && defined(__i386__)
-#  define SPS_PLAT_x86_android 1
-#  define SPS_ARCH_x86 1
-#  define SPS_OS_android 1
+# define GP_PLAT_x86_android 1
+# define GP_ARCH_x86 1
+# define GP_OS_android 1
 
 #elif defined(__ANDROID__) && defined(__arm__)
-#  define SPS_PLAT_arm_android 1
-#  define SPS_ARCH_arm 1
-#  define SPS_OS_android 1
+# define GP_PLAT_arm_android 1
+# define GP_ARCH_arm 1
+# define GP_OS_android 1
 
 #elif defined(__linux__) && defined(__i386__)
-#  define SPS_PLAT_x86_linux 1
-#  define SPS_ARCH_x86 1
-#  define SPS_OS_linux 1
+# define GP_PLAT_x86_linux 1
+# define GP_ARCH_x86 1
+# define GP_OS_linux 1
 
 #elif defined(__linux__) && defined(__x86_64__)
-#  define SPS_PLAT_amd64_linux 1
-#  define SPS_ARCH_amd64 1
-#  define SPS_OS_linux 1
+# define GP_PLAT_amd64_linux 1
+# define GP_ARCH_amd64 1
+# define GP_OS_linux 1
 
 #elif defined(__APPLE__) && defined(__i386__)
-#  define SPS_PLAT_x86_darwin 1
-#  define SPS_ARCH_x86 1
-#  define SPS_OS_darwin 1
+# define GP_PLAT_x86_darwin 1
+# define GP_ARCH_x86 1
+# define GP_OS_darwin 1
 
 #elif defined(__APPLE__) && defined(__x86_64__)
-#  define SPS_PLAT_amd64_darwin 1
-#  define SPS_ARCH_amd64 1
-#  define SPS_OS_darwin 1
+# define GP_PLAT_amd64_darwin 1
+# define GP_ARCH_amd64 1
+# define GP_OS_darwin 1
 
 #elif (defined(_MSC_VER) || defined(__MINGW32__)) && \
       (defined(_M_IX86) || defined(__i386__))
-#  define SPS_PLAT_x86_windows 1
-#  define SPS_ARCH_x86 1
-#  define SPS_OS_windows 1
+# define GP_PLAT_x86_windows 1
+# define GP_ARCH_x86 1
+# define GP_OS_windows 1
 
 #elif (defined(_MSC_VER) || defined(__MINGW32__)) && \
       (defined(_M_X64) || defined(__x86_64__))
-#  define SPS_PLAT_amd64_windows 1
-#  define SPS_ARCH_amd64 1
-#  define SPS_OS_windows 1
+# define GP_PLAT_amd64_windows 1
+# define GP_ARCH_amd64 1
+# define GP_OS_windows 1
 
 #else
-#  error "Unsupported platform"
+# error "Unsupported platform"
 #endif
 
-#endif /* ndef SPS_PLATFORM_MACROS_H */
+#endif /* ndef PLATFORM_MACROS_H */
diff --git a/tools/profiler/core/ProfileEntry.h b/tools/profiler/core/ProfileEntry.h
index c89d96ce170a..6cec5b0babe1 100644
--- a/tools/profiler/core/ProfileEntry.h
+++ b/tools/profiler/core/ProfileEntry.h
@@ -42,7 +42,7 @@
     _(UnsharedMemory,  double)
 
 // NB: Packing this structure has been shown to cause SIGBUS issues on ARM.
-#ifndef __arm__
+#if !defined(GP_ARCH_arm)
 #pragma pack(push, 1)
 #endif
 
@@ -110,7 +110,7 @@ private:
   Kind mKind;
 };
 
-#ifndef __arm__
+#if !defined(GP_ARCH_arm)
 #pragma pack(pop)
 #endif
 
diff --git a/tools/profiler/core/StackTop.cpp b/tools/profiler/core/StackTop.cpp
index 1f7944e5e96a..02654aa3c650 100644
--- a/tools/profiler/core/StackTop.cpp
+++ b/tools/profiler/core/StackTop.cpp
@@ -4,22 +4,24 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifdef XP_MACOSX
+#include "PlatformMacros.h"
+
+#if defined(GP_OS_darwin)
 #include <mach/task.h>
 #include <mach/thread_act.h>
 #include <pthread.h>
-#elif XP_WIN
+#elif defined(GP_OS_windows)
 #include <windows.h>
 #endif
 
 #include "StackTop.h"
 
 void *GetStackTop(void *guess) {
-#if defined(XP_MACOSX)
+#if defined(GP_OS_darwin)
   pthread_t thread = pthread_self();
   return pthread_get_stackaddr_np(thread);
-#elif defined(XP_WIN)
-#if defined(_MSC_VER) && defined(_M_IX86)
+#elif defined(GP_OS_windows)
+#if defined(_MSC_VER) && defined(GP_ARCH_x86)
   // offset 0x18 from the FS segment register gives a pointer to
   // the thread information block for the current thread
   NT_TIB* pTib;
@@ -28,7 +30,7 @@ void *GetStackTop(void *guess) {
       MOV pTib, EAX
   }
   return static_cast<void*>(pTib->StackBase);
-#elif defined(__GNUC__) && defined(i386)
+#elif defined(__GNUC__) && defined(GP_ARCH_x86)
   // offset 0x18 from the FS segment register gives a pointer to
   // the thread information block for the current thread
   NT_TIB* pTib;
@@ -36,7 +38,7 @@ void *GetStackTop(void *guess) {
        : "=r" (pTib)
       );
   return static_cast<void*>(pTib->StackBase);
-#elif defined(_M_X64) || defined(__x86_64)
+#elif defined(GP_ARCH_amd64)
   PNT_TIB64 pTib = reinterpret_cast<PNT_TIB64>(NtCurrentTeb());
   return reinterpret_cast<void*>(pTib->StackBase);
 #else
diff --git a/tools/profiler/core/ThreadInfo.cpp b/tools/profiler/core/ThreadInfo.cpp
index adebb0a742a2..9e424fc7a1b4 100644
--- a/tools/profiler/core/ThreadInfo.cpp
+++ b/tools/profiler/core/ThreadInfo.cpp
@@ -8,6 +8,10 @@
 
 #include "mozilla/DebugOnly.h"
 
+#if defined(GP_OS_darwin)
+#include <pthread.h>
+#endif
+
 ThreadInfo::ThreadInfo(const char* aName, int aThreadId,
                        bool aIsMainThread, PseudoStack* aPseudoStack,
                        void* aStackTop)
@@ -19,7 +23,7 @@ ThreadInfo::ThreadInfo(const char* aName, int aThreadId,
   , mStackTop(aStackTop)
   , mPendingDelete(false)
   , mMutex(MakeUnique<mozilla::Mutex>("ThreadInfo::mMutex"))
-#ifdef XP_LINUX
+#if defined(GP_OS_linux) || defined(GP_OS_android)
   , mRssMemory(0)
   , mUssMemory(0)
 #endif
@@ -28,7 +32,7 @@ ThreadInfo::ThreadInfo(const char* aName, int aThreadId,
   mThread = NS_GetCurrentThread();
 
   // We don't have to guess on mac
-#ifdef XP_MACOSX
+#if defined(GP_OS_darwin)
   pthread_t self = pthread_self();
   mStackTop = pthread_get_stackaddr_np(self);
 #endif
diff --git a/tools/profiler/core/ThreadInfo.h b/tools/profiler/core/ThreadInfo.h
index 82a08cd9f5c1..7b5905058b1b 100644
--- a/tools/profiler/core/ThreadInfo.h
+++ b/tools/profiler/core/ThreadInfo.h
@@ -107,7 +107,7 @@ private:
   mozilla::UniquePtr<mozilla::Mutex> mMutex;
   ThreadResponsiveness mRespInfo;
 
-#ifdef XP_LINUX
+#if defined(GP_OS_linux) || defined(GP_OS_android)
   // Only Linux is using a signal sender, instead of stopping the thread, so we
   // need some space to store the data which cannot be collected in the signal
   // handler code.
diff --git a/tools/profiler/core/platform-linux.cc b/tools/profiler/core/platform-linux-android.cpp
similarity index 94%
rename from tools/profiler/core/platform-linux.cc
rename to tools/profiler/core/platform-linux-android.cpp
index 77c51bfee711..ceaf713292d1 100644
--- a/tools/profiler/core/platform-linux.cc
+++ b/tools/profiler/core/platform-linux-android.cpp
@@ -44,11 +44,6 @@
 #include <sys/prctl.h> // set name
 #include <stdlib.h>
 #include <sched.h>
-#ifdef ANDROID
-#include <android/log.h>
-#else
-#define __android_log_print(a, ...)
-#endif
 #include <ucontext.h>
 // Ubuntu Dapper requires memory pages to be marked as
 // executable. Otherwise, OS raises an exception when executing code
@@ -114,7 +109,7 @@ Thread::GetCurrentId()
   return gettid();
 }
 
-#if !defined(ANDROID)
+#if !defined(GP_OS_android)
 // Keep track of when any of our threads calls fork(), so we can
 // temporarily disable signal delivery during the fork() call.  Not
 // doing so appears to cause a kind of race, in which signals keep
@@ -149,7 +144,7 @@ static void* setup_atfork() {
   pthread_atfork(paf_prepare, paf_parent, NULL);
   return NULL;
 }
-#endif /* !defined(ANDROID) */
+#endif /* !defined(GP_OS_android) */
 
 static mozilla::Atomic<ThreadInfo*> gCurrentThreadInfo;
 static sem_t gSignalHandlingDone;
@@ -159,41 +154,24 @@ static void SetSampleContext(TickSample* sample, void* context)
   // Extracting the sample from the context is extremely machine dependent.
   ucontext_t* ucontext = reinterpret_cast<ucontext_t*>(context);
   mcontext_t& mcontext = ucontext->uc_mcontext;
-#if V8_HOST_ARCH_IA32
+#if defined(GP_ARCH_x86)
   sample->pc = reinterpret_cast<Address>(mcontext.gregs[REG_EIP]);
   sample->sp = reinterpret_cast<Address>(mcontext.gregs[REG_ESP]);
   sample->fp = reinterpret_cast<Address>(mcontext.gregs[REG_EBP]);
-#elif V8_HOST_ARCH_X64
+#elif defined(GP_ARCH_amd64)
   sample->pc = reinterpret_cast<Address>(mcontext.gregs[REG_RIP]);
   sample->sp = reinterpret_cast<Address>(mcontext.gregs[REG_RSP]);
   sample->fp = reinterpret_cast<Address>(mcontext.gregs[REG_RBP]);
-#elif V8_HOST_ARCH_ARM
-// An undefined macro evaluates to 0, so this applies to Android's Bionic also.
-#if !defined(ANDROID) && (__GLIBC__ < 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ <= 3))
-  sample->pc = reinterpret_cast<Address>(mcontext.gregs[R15]);
-  sample->sp = reinterpret_cast<Address>(mcontext.gregs[R13]);
-  sample->fp = reinterpret_cast<Address>(mcontext.gregs[R11]);
-  sample->lr = reinterpret_cast<Address>(mcontext.gregs[R14]);
-#else
+#elif defined(GP_ARCH_arm)
   sample->pc = reinterpret_cast<Address>(mcontext.arm_pc);
   sample->sp = reinterpret_cast<Address>(mcontext.arm_sp);
   sample->fp = reinterpret_cast<Address>(mcontext.arm_fp);
   sample->lr = reinterpret_cast<Address>(mcontext.arm_lr);
-#endif
-#elif V8_HOST_ARCH_MIPS
-  // Implement this on MIPS.
-  UNIMPLEMENTED();
+#else
+# error "bad platform"
 #endif
 }
 
-#ifdef ANDROID
-#define V8_HOST_ARCH_ARM 1
-#define SYS_gettid __NR_gettid
-#define SYS_tgkill __NR_tgkill
-#else
-#define V8_HOST_ARCH_X64 1
-#endif
-
 static void
 SigprofHandler(int signal, siginfo_t* info, void* context)
 {
@@ -225,6 +203,10 @@ SigprofHandler(int signal, siginfo_t* info, void* context)
   errno = savedErrno;
 }
 
+#if defined(GP_OS_android)
+#define SYS_tgkill __NR_tgkill
+#endif
+
 int tgkill(pid_t tgid, pid_t tid, int signalno) {
   return syscall(SYS_tgkill, tgid, tid, signalno);
 }
@@ -254,6 +236,31 @@ PlatformDataDestructor::operator()(PlatformData* aData)
   delete aData;
 }
 
+static void
+SleepMicro(int aMicroseconds)
+{
+  if (MOZ_UNLIKELY(aMicroseconds >= 1000000)) {
+    // Use usleep for larger intervals, because the nanosleep
+    // code below only supports intervals < 1 second.
+    MOZ_ALWAYS_TRUE(!::usleep(aMicroseconds));
+    return;
+  }
+
+  struct timespec ts;
+  ts.tv_sec  = 0;
+  ts.tv_nsec = aMicroseconds * 1000UL;
+
+  int rv = ::nanosleep(&ts, &ts);
+
+  while (rv != 0 && errno == EINTR) {
+    // Keep waiting in case of interrupt.
+    // nanosleep puts the remaining time back into ts.
+    rv = ::nanosleep(&ts, &ts);
+  }
+
+  MOZ_ASSERT(!rv, "nanosleep call failed");
+}
+
 static void*
 SigprofSender(void* aArg)
 {
@@ -341,7 +348,7 @@ SigprofSender(void* aArg)
     TimeStamp beforeSleep = TimeStamp::Now();
     TimeDuration targetSleepDuration = targetSleepEndTime - beforeSleep;
     double sleepTime = std::max(0.0, (targetSleepDuration - lastSleepOverhead).ToMicroseconds());
-    OS::SleepMicro(sleepTime);
+    SleepMicro(sleepTime);
     sampleStart = TimeStamp::Now();
     lastSleepOverhead = sampleStart - (beforeSleep + TimeDuration::FromMicroseconds(sleepTime));
   }
@@ -429,7 +436,7 @@ PlatformStop()
   }
 }
 
-#ifdef ANDROID
+#if defined(GP_OS_android)
 static struct sigaction gOldSigstartHandler;
 const int SIGSTART = SIGUSR2;
 
@@ -530,7 +537,8 @@ static void StartSignalHandler(int signal, siginfo_t* info, void* context) {
   NS_DispatchToMainThread(new StartTask());
 }
 
-void OS::Startup()
+static void
+PlatformInit()
 {
   LOG("Registering start signal");
   struct sigaction sa;
@@ -544,7 +552,9 @@ void OS::Startup()
 
 #else
 
-void OS::Startup() {
+static void
+PlatformInit()
+{
   // Set up the fork handlers.
   setup_atfork();
 }
@@ -561,26 +571,3 @@ void TickSample::PopulateContext(void* aContext)
   }
 }
 
-void OS::SleepMicro(int microseconds)
-{
-  if (MOZ_UNLIKELY(microseconds >= 1000000)) {
-    // Use usleep for larger intervals, because the nanosleep
-    // code below only supports intervals < 1 second.
-    MOZ_ALWAYS_TRUE(!::usleep(microseconds));
-    return;
-  }
-
-  struct timespec ts;
-  ts.tv_sec  = 0;
-  ts.tv_nsec = microseconds * 1000UL;
-
-  int rv = ::nanosleep(&ts, &ts);
-
-  while (rv != 0 && errno == EINTR) {
-    // Keep waiting in case of interrupt.
-    // nanosleep puts the remaining time back into ts.
-    rv = ::nanosleep(&ts, &ts);
-  }
-
-  MOZ_ASSERT(!rv, "nanosleep call failed");
-}
diff --git a/tools/profiler/core/platform-macos.cc b/tools/profiler/core/platform-macos.cpp
similarity index 96%
rename from tools/profiler/core/platform-macos.cc
rename to tools/profiler/core/platform-macos.cpp
index c5efd173bbef..2ff975f0b622 100644
--- a/tools/profiler/core/platform-macos.cc
+++ b/tools/profiler/core/platform-macos.cpp
@@ -42,17 +42,6 @@ using mozilla::TimeDuration;
 static const pthread_t kNoThread = (pthread_t) 0;
 #endif
 
-void OS::Startup() {
-}
-
-void OS::Sleep(int milliseconds) {
-  usleep(1000 * milliseconds);
-}
-
-void OS::SleepMicro(int microseconds) {
-  usleep(microseconds);
-}
-
 class PlatformData {
  public:
   PlatformData() : profiled_thread_(mach_thread_self())
@@ -186,7 +175,7 @@ public:
       TimeStamp beforeSleep = TimeStamp::Now();
       TimeDuration targetSleepDuration = targetSleepEndTime - beforeSleep;
       double sleepTime = std::max(0.0, (targetSleepDuration - lastSleepOverhead).ToMicroseconds());
-      OS::SleepMicro(sleepTime);
+      usleep(sleepTime);
       sampleStart = TimeStamp::Now();
       lastSleepOverhead = sampleStart - (beforeSleep + TimeDuration::FromMicroseconds(sleepTime));
     }
@@ -214,7 +203,7 @@ public:
 
     if (KERN_SUCCESS != thread_suspend(profiled_thread)) return;
 
-#if V8_HOST_ARCH_X64
+#if defined(GP_ARCH_amd64)
     thread_state_flavor_t flavor = x86_THREAD_STATE64;
     x86_thread_state64_t state;
     mach_msg_type_number_t count = x86_THREAD_STATE64_COUNT;
@@ -223,7 +212,7 @@ public:
 #else
 #define REGISTER_FIELD(name) r ## name
 #endif  // __DARWIN_UNIX03
-#elif V8_HOST_ARCH_IA32
+#elif defined(GP_ARCH_x86)
     thread_state_flavor_t flavor = i386_THREAD_STATE;
     i386_thread_state_t state;
     mach_msg_type_number_t count = i386_THREAD_STATE_COUNT;
@@ -234,7 +223,7 @@ public:
 #endif  // __DARWIN_UNIX03
 #else
 #error Unsupported Mac OS X host architecture.
-#endif  // V8_HOST_ARCH
+#endif  // GP_ARCH_*
 
     if (thread_get_state(profiled_thread,
                          flavor,
@@ -266,6 +255,11 @@ private:
 
 SamplerThread* SamplerThread::mInstance = NULL;
 
+static void
+PlatformInit()
+{
+}
+
 static void
 PlatformStart()
 {
@@ -295,7 +289,7 @@ Thread::GetCurrentId()
 void TickSample::PopulateContext(void* aContext)
 {
   // Note that this asm changes if PopulateContext's parameter list is altered
-#if defined(SPS_PLAT_amd64_darwin)
+#if defined(GP_ARCH_amd64)
   asm (
       // Compute caller's %rsp by adding to %rbp:
       // 8 bytes for previous %rbp, 8 bytes for return address
@@ -306,7 +300,7 @@ void TickSample::PopulateContext(void* aContext)
       "=r"(sp),
       "=r"(fp)
   );
-#elif defined(SPS_PLAT_x86_darwin)
+#elif defined(GP_ARCH_x86)
   asm (
       // Compute caller's %esp by adding to %ebp:
       // 4 bytes for aContext + 4 bytes for return address +
diff --git a/tools/profiler/core/platform-win32.cc b/tools/profiler/core/platform-win32.cpp
similarity index 97%
rename from tools/profiler/core/platform-win32.cc
rename to tools/profiler/core/platform-win32.cpp
index e22ae160cbc7..9bab1a7225fd 100644
--- a/tools/profiler/core/platform-win32.cc
+++ b/tools/profiler/core/platform-win32.cpp
@@ -180,7 +180,7 @@ class SamplerThread
           isFirstProfiledThread = false;
         }
       }
-      OS::Sleep(mInterval);
+      ::Sleep(mInterval);
     }
 
     // disable any timer resolution changes we've made
@@ -225,7 +225,7 @@ class SamplerThread
 
     // Using only CONTEXT_CONTROL is faster but on 64-bit it causes crashes in
     // RtlVirtualUnwind (see bug 1120126) so we set all the flags.
-#if V8_HOST_ARCH_X64
+#if defined(GP_ARCH_amd64)
     context.ContextFlags = CONTEXT_FULL;
 #else
     context.ContextFlags = CONTEXT_CONTROL;
@@ -235,7 +235,7 @@ class SamplerThread
       return;
     }
 
-#if V8_HOST_ARCH_X64
+#if defined(GP_ARCH_amd64)
     sample->pc = reinterpret_cast<Address>(context.Rip);
     sample->sp = reinterpret_cast<Address>(context.Rsp);
     sample->fp = reinterpret_cast<Address>(context.Rbp);
@@ -267,6 +267,11 @@ private:
 
 SamplerThread* SamplerThread::mInstance = NULL;
 
+static void
+PlatformInit()
+{
+}
+
 static void
 PlatformStart()
 {
@@ -293,13 +298,6 @@ Thread::GetCurrentId()
   return GetCurrentThreadId();
 }
 
-void OS::Startup() {
-}
-
-void OS::Sleep(int milliseconds) {
-  ::Sleep(milliseconds);
-}
-
 void TickSample::PopulateContext(void* aContext)
 {
   MOZ_ASSERT(aContext);
@@ -307,18 +305,14 @@ void TickSample::PopulateContext(void* aContext)
   context = pContext;
   RtlCaptureContext(pContext);
 
-#if defined(SPS_PLAT_amd64_windows)
-
+#if defined(GP_ARCH_amd64)
   pc = reinterpret_cast<Address>(pContext->Rip);
   sp = reinterpret_cast<Address>(pContext->Rsp);
   fp = reinterpret_cast<Address>(pContext->Rbp);
-
-#elif defined(SPS_PLAT_x86_windows)
-
+#elif defined(GP_ARCH_x86)
   pc = reinterpret_cast<Address>(pContext->Eip);
   sp = reinterpret_cast<Address>(pContext->Esp);
   fp = reinterpret_cast<Address>(pContext->Ebp);
-
 #endif
 }
 
diff --git a/tools/profiler/core/platform.cpp b/tools/profiler/core/platform.cpp
index fff1f688a244..76777ff8f95f 100644
--- a/tools/profiler/core/platform.cpp
+++ b/tools/profiler/core/platform.cpp
@@ -49,17 +49,18 @@
 # include "FennecJNIWrappers.h"
 #endif
 
-#if defined(MOZ_PROFILING) && (defined(XP_MACOSX) || defined(XP_WIN))
+#if defined(MOZ_PROFILING) && \
+    (defined(GP_OS_windows) || defined(GP_OS_darwin))
 # define USE_NS_STACKWALK
 #endif
 
 // This should also work on ARM Linux, but not tested there yet.
-#if defined(__arm__) && defined(ANDROID)
+#if defined(GP_arm_android)
 # define USE_EHABI_STACKWALK
 # include "EHABIStackWalk.h"
 #endif
 
-#if defined(SPS_PLAT_amd64_linux) || defined(SPS_PLAT_x86_linux)
+#if defined(GP_PLAT_amd64_linux) || defined(GP_PLAT_x86_linux)
 # define USE_LUL_STACKWALK
 # include "lul/LulMain.h"
 # include "lul/platform-linux-lul.h"
@@ -71,9 +72,9 @@
 # define VALGRIND_MAKE_MEM_DEFINED(_addr,_len)   ((void)0)
 #endif
 
-#if defined(XP_WIN)
+#if defined(GP_OS_windows)
 typedef CONTEXT tickcontext_t;
-#elif defined(LINUX)
+#elif defined(GP_OS_linux) || defined(GP_OS_android)
 #include <ucontext.h>
 typedef ucontext_t tickcontext_t;
 #endif
@@ -199,7 +200,7 @@ CanNotifyObservers()
 {
   MOZ_RELEASE_ASSERT(NS_IsMainThread());
 
-#if defined(SPS_OS_android)
+#if defined(GP_OS_android)
   // Android ANR reporter uses the profiler off the main thread.
   return NS_IsMainThread();
 #else
@@ -545,7 +546,7 @@ MergeStacksIntoProfile(ThreadInfo& aInfo, TickSample* aSample,
   }
 }
 
-#ifdef XP_WIN
+#if defined(GP_OS_windows)
 static uintptr_t GetThreadHandle(PlatformData* aData);
 #endif
 
@@ -580,7 +581,7 @@ DoNativeBacktrace(ThreadInfo& aInfo, TickSample* aSample)
 
   uint32_t maxFrames = uint32_t(nativeStack.size - nativeStack.count);
 
-#if defined(XP_MACOSX) || (defined(XP_WIN) && !defined(V8_HOST_ARCH_X64))
+#if defined(GP_OS_darwin) || (defined(GP_PLAT_x86_windows))
   void* stackEnd = aSample->threadInfo->StackTop();
   if (aSample->fp >= aSample->sp && aSample->fp <= stackEnd) {
     FramePointerStackWalk(StackWalkCallback, /* skipFrames */ 0, maxFrames,
@@ -681,18 +682,18 @@ DoNativeBacktrace(ThreadInfo& aInfo, TickSample* aSample)
   lul::UnwindRegs startRegs;
   memset(&startRegs, 0, sizeof(startRegs));
 
-#if defined(SPS_PLAT_amd64_linux)
+#if defined(GP_PLAT_amd64_linux)
   startRegs.xip = lul::TaggedUWord(mc->gregs[REG_RIP]);
   startRegs.xsp = lul::TaggedUWord(mc->gregs[REG_RSP]);
   startRegs.xbp = lul::TaggedUWord(mc->gregs[REG_RBP]);
-#elif defined(SPS_PLAT_arm_android)
+#elif defined(GP_PLAT_arm_android)
   startRegs.r15 = lul::TaggedUWord(mc->arm_pc);
   startRegs.r14 = lul::TaggedUWord(mc->arm_lr);
   startRegs.r13 = lul::TaggedUWord(mc->arm_sp);
   startRegs.r12 = lul::TaggedUWord(mc->arm_ip);
   startRegs.r11 = lul::TaggedUWord(mc->arm_fp);
   startRegs.r7  = lul::TaggedUWord(mc->arm_r7);
-#elif defined(SPS_PLAT_x86_linux) || defined(SPS_PLAT_x86_android)
+#elif defined(GP_PLAT_x86_linux) || defined(GP_PLAT_x86_android)
   startRegs.xip = lul::TaggedUWord(mc->gregs[REG_EIP]);
   startRegs.xsp = lul::TaggedUWord(mc->gregs[REG_ESP]);
   startRegs.xbp = lul::TaggedUWord(mc->gregs[REG_EBP]);
@@ -708,13 +709,13 @@ DoNativeBacktrace(ThreadInfo& aInfo, TickSample* aSample)
   lul::StackImage stackImg;
 
   {
-#if defined(SPS_PLAT_amd64_linux)
+#if defined(GP_PLAT_amd64_linux)
     uintptr_t rEDZONE_SIZE = 128;
     uintptr_t start = startRegs.xsp.Value() - rEDZONE_SIZE;
-#elif defined(SPS_PLAT_arm_android)
+#elif defined(GP_PLAT_arm_android)
     uintptr_t rEDZONE_SIZE = 0;
     uintptr_t start = startRegs.r13.Value() - rEDZONE_SIZE;
-#elif defined(SPS_PLAT_x86_linux) || defined(SPS_PLAT_x86_android)
+#elif defined(GP_PLAT_x86_linux) || defined(GP_PLAT_x86_android)
     uintptr_t rEDZONE_SIZE = 0;
     uintptr_t start = startRegs.xsp.Value() - rEDZONE_SIZE;
 #else
@@ -782,11 +783,9 @@ DoSampleStackTrace(ThreadInfo& aInfo, TickSample* aSample,
   NativeStack nativeStack = { nullptr, nullptr, 0, 0 };
   MergeStacksIntoProfile(aInfo, aSample, nativeStack);
 
-#ifdef ENABLE_LEAF_DATA
   if (aSample && aAddLeafAddresses) {
     aInfo.addTag(ProfileEntry::NativeLeafAddr((void*)aSample->pc));
   }
-#endif
 }
 
 // This function is called for each sampling period with the current program
@@ -888,34 +887,9 @@ AddSharedLibraryInfoToStream(std::ostream& aStream, const SharedLibrary& aLib)
   aStream << "\"start\":" << aLib.GetStart();
   aStream << ",\"end\":" << aLib.GetEnd();
   aStream << ",\"offset\":" << aLib.GetOffset();
-  aStream << ",\"name\":\"" << aLib.GetName() << "\"";
+  aStream << ",\"name\":\"" << aLib.GetNativeDebugName() << "\"";
   const std::string& breakpadId = aLib.GetBreakpadId();
   aStream << ",\"breakpadId\":\"" << breakpadId << "\"";
-
-#ifdef XP_WIN
-  // FIXME: remove this XP_WIN code when the profiler plugin has switched to
-  // using breakpadId.
-  std::string pdbSignature = breakpadId.substr(0, 32);
-  std::string pdbAgeStr = breakpadId.substr(32,  breakpadId.size() - 1);
-
-  std::stringstream stream;
-  stream << pdbAgeStr;
-
-  unsigned pdbAge;
-  stream << std::hex;
-  stream >> pdbAge;
-
-#ifdef DEBUG
-  std::ostringstream oStream;
-  oStream << pdbSignature << std::hex << std::uppercase << pdbAge;
-  MOZ_ASSERT(breakpadId == oStream.str());
-#endif
-
-  aStream << ",\"pdbSignature\":\"" << pdbSignature << "\"";
-  aStream << ",\"pdbAge\":" << pdbAge;
-  aStream << ",\"pdbName\":\"" << aLib.GetName() << "\"";
-#endif
-
   aStream << "}";
 }
 
@@ -1615,6 +1589,11 @@ RegisterCurrentThread(const char* aName, PseudoStack* aPseudoStack,
   gRegisteredThreads->push_back(info);
 }
 
+// Platform-specific init/start/stop actions.
+static void PlatformInit();
+static void PlatformStart();
+static void PlatformStop();
+
 void
 profiler_init(void* stackTop)
 {
@@ -1661,8 +1640,8 @@ profiler_init(void* stackTop)
   // threshhold from MOZ_PROFILER_STACK_SCAN.
   read_profiler_env_vars();
 
-  // platform specific initialization
-  OS::Startup();
+  // Platform-specific initialization.
+  PlatformInit();
 
   set_stderr_callback(profiler_log);
 
@@ -1680,24 +1659,20 @@ profiler_init(void* stackTop)
     return;
   }
 
-  const char* features[] = {"js"
-                         , "leaf"
-                         , "threads"
-#if defined(XP_WIN) || defined(XP_MACOSX) \
-    || (defined(SPS_ARCH_arm) && defined(linux)) \
-    || defined(SPS_PLAT_amd64_linux) || defined(SPS_PLAT_x86_linux)
-                         , "stackwalk"
+  const char* features[] = { "js", "leaf", "threads"
+#if defined(HAVE_NATIVE_UNWIND)
+                           , "stackwalk"
 #endif
 #if defined(PROFILE_JAVA)
-                         , "java"
+                           , "java"
 #endif
-                         };
+                           };
 
   const char* threadFilters[] = { "GeckoMain", "Compositor" };
 
   profiler_start(PROFILE_DEFAULT_ENTRY, PROFILE_DEFAULT_INTERVAL,
-                         features, MOZ_ARRAY_LENGTH(features),
-                         threadFilters, MOZ_ARRAY_LENGTH(threadFilters));
+                 features, MOZ_ARRAY_LENGTH(features),
+                 threadFilters, MOZ_ARRAY_LENGTH(threadFilters));
   LOG("END   profiler_init");
 }
 
@@ -1894,11 +1869,10 @@ profiler_get_features()
     // Walk the C++ stack.
     "stackwalk",
 #endif
-#if defined(ENABLE_LEAF_DATA)
     // Include the C++ leaf node if not stackwalking. DevTools
     // profiler doesn't want the native addresses.
     "leaf",
-#endif
+    // Profile Java code (Android only).
     "java",
     // Tell the JS engine to emit pseudostack entries in the prologue/epilogue.
     "js",
@@ -1961,10 +1935,6 @@ hasFeature(const char** aFeatures, uint32_t aFeatureCount, const char* aFeature)
   return false;
 }
 
-// Platform-specific start/stop actions.
-static void PlatformStart();
-static void PlatformStop();
-
 // XXX: an empty class left behind after refactoring. Will be removed soon.
 class Sampler {};
 
@@ -1995,7 +1965,7 @@ profiler_start(int aProfileEntries, double aInterval,
   profiler_stop();
 
   // Deep copy aThreadNameFilters. Must happen before the MaybeSetProfile()
-  // calls below.
+  // call below.
   {
     StaticMutexAutoLock lock(gThreadNameFiltersMutex);
 
@@ -2011,6 +1981,29 @@ profiler_start(int aProfileEntries, double aInterval,
     gFeatures[i] = aFeatures[i];
   }
 
+  bool mainThreadIO = hasFeature(aFeatures, aFeatureCount, "mainthreadio");
+  bool privacyMode  = hasFeature(aFeatures, aFeatureCount, "privacy");
+
+#if defined(PROFILE_JAVA)
+  gProfileJava = mozilla::jni::IsFennec() &&
+                      hasFeature(aFeatures, aFeatureCount, "java");
+#endif
+  gProfileJS   = hasFeature(aFeatures, aFeatureCount, "js");
+  gTaskTracer  = hasFeature(aFeatures, aFeatureCount, "tasktracer");
+
+  gAddLeafAddresses = hasFeature(aFeatures, aFeatureCount, "leaf");
+  gDisplayListDump  = hasFeature(aFeatures, aFeatureCount, "displaylistdump");
+  gLayersDump       = hasFeature(aFeatures, aFeatureCount, "layersdump");
+  gProfileGPU       = hasFeature(aFeatures, aFeatureCount, "gpu");
+  gProfileMemory    = hasFeature(aFeatures, aFeatureCount, "memory");
+  gProfileRestyle   = hasFeature(aFeatures, aFeatureCount, "restyle");
+  // Profile non-main threads if we have a filter, because users sometimes ask
+  // to filter by a list of threads but forget to explicitly request.
+  // gProfileThreads must be set before the MaybeSetProfile() call below.
+  gProfileThreads   = hasFeature(aFeatures, aFeatureCount, "threads") ||
+                      aFilterCount > 0;
+  gUseStackWalk     = hasFeature(aFeatures, aFeatureCount, "stackwalk");
+
   gEntrySize = aProfileEntries ? aProfileEntries : PROFILE_DEFAULT_ENTRY;
   gInterval = aInterval ? aInterval : PROFILE_DEFAULT_INTERVAL;
   gBuffer = new ProfileBuffer(gEntrySize);
@@ -2038,28 +2031,6 @@ profiler_start(int aProfileEntries, double aInterval,
 
   gGatherer = new mozilla::ProfileGatherer(gSampler);
 
-  bool mainThreadIO = hasFeature(aFeatures, aFeatureCount, "mainthreadio");
-  bool privacyMode  = hasFeature(aFeatures, aFeatureCount, "privacy");
-
-#if defined(PROFILE_JAVA)
-  gProfileJava = mozilla::jni::IsFennec() &&
-                      hasFeature(aFeatures, aFeatureCount, "java");
-#endif
-  gProfileJS   = hasFeature(aFeatures, aFeatureCount, "js");
-  gTaskTracer  = hasFeature(aFeatures, aFeatureCount, "tasktracer");
-
-  gAddLeafAddresses = hasFeature(aFeatures, aFeatureCount, "leaf");
-  gDisplayListDump  = hasFeature(aFeatures, aFeatureCount, "displaylistdump");
-  gLayersDump       = hasFeature(aFeatures, aFeatureCount, "layersdump");
-  gProfileGPU       = hasFeature(aFeatures, aFeatureCount, "gpu");
-  gProfileMemory    = hasFeature(aFeatures, aFeatureCount, "memory");
-  gProfileRestyle   = hasFeature(aFeatures, aFeatureCount, "restyle");
-  // Profile non-main threads if we have a filter, because users sometimes ask
-  // to filter by a list of threads but forget to explicitly request.
-  gProfileThreads   = hasFeature(aFeatures, aFeatureCount, "threads") ||
-                      aFilterCount > 0;
-  gUseStackWalk     = hasFeature(aFeatures, aFeatureCount, "stackwalk");
-
   MOZ_ASSERT(!gIsActive && !gIsPaused);
   PlatformStart();
   MOZ_ASSERT(gIsActive && !gIsPaused);  // PlatformStart() sets gIsActive.
@@ -2523,12 +2494,14 @@ profiler_get_backtrace()
   TickSample sample;
   sample.threadInfo = profile;
 
-#if defined(HAVE_NATIVE_UNWIND) || defined(USE_LUL_STACKWALK)
-#if defined(XP_WIN) || defined(LINUX)
+#if defined(HAVE_NATIVE_UNWIND)
+#if defined(GP_OS_windows) || defined(GP_OS_linux) || defined(GP_OS_android)
   tickcontext_t context;
   sample.PopulateContext(&context);
-#elif defined(XP_MACOSX)
+#elif defined(GP_OS_darwin)
   sample.PopulateContext(nullptr);
+#else
+# error "unknown platform"
 #endif
 #endif
 
@@ -2681,12 +2654,12 @@ void PseudoStack::flushSamplerOnJSShutdown()
 
 // We #include these files directly because it means those files can use
 // declarations from this file trivially.
-#if defined(SPS_OS_windows)
-# include "platform-win32.cc"
-#elif defined(SPS_OS_darwin)
-# include "platform-macos.cc"
-#elif defined(SPS_OS_linux) || defined(SPS_OS_android)
-# include "platform-linux.cc"
+#if defined(GP_OS_windows)
+# include "platform-win32.cpp"
+#elif defined(GP_OS_darwin)
+# include "platform-macos.cpp"
+#elif defined(GP_OS_linux) || defined(GP_OS_android)
+# include "platform-linux-android.cpp"
 #else
 # error "bad platform"
 #endif
diff --git a/tools/profiler/core/platform.h b/tools/profiler/core/platform.h
index 5c2285b881e4..91b0edc6efa4 100644
--- a/tools/profiler/core/platform.h
+++ b/tools/profiler/core/platform.h
@@ -29,16 +29,6 @@
 #ifndef TOOLS_PLATFORM_H_
 #define TOOLS_PLATFORM_H_
 
-#ifdef ANDROID
-#include <android/log.h>
-#else
-#define __android_log_print(a, ...)
-#endif
-
-#ifdef XP_UNIX
-#include <pthread.h>
-#endif
-
 #include <stdint.h>
 #include <math.h>
 #include "MainThreadUtils.h"
@@ -61,7 +51,7 @@ static inline pid_t gettid()
 {
   return (pid_t) syscall(SYS_gettid);
 }
-#elif defined(XP_MACOSX)
+#elif defined(GP_OS_darwin)
 #include <unistd.h>
 #include <sys/syscall.h>
 static inline pid_t gettid()
@@ -70,16 +60,14 @@ static inline pid_t gettid()
 }
 #endif
 
-#ifdef XP_WIN
+#if defined(GP_OS_windows)
 #include <windows.h>
 #endif
 
 bool profiler_verbose();
 
-#ifdef ANDROID
-# if defined(__arm__) || defined(__thumb__)
-#  define ENABLE_LEAF_DATA
-# endif
+#if defined(GP_OS_android)
+# include <android/log.h>
 # define LOG(text) \
     do { if (profiler_verbose()) \
            __android_log_write(ANDROID_LOG_ERROR, "Profiler", text); \
@@ -101,11 +89,7 @@ bool profiler_verbose();
 
 #endif
 
-#if defined(XP_MACOSX) || defined(XP_WIN) || defined(XP_LINUX)
-#define ENABLE_LEAF_DATA
-#endif
-
-#if defined(SPS_OS_android) && !defined(MOZ_WIDGET_GONK)
+#if defined(GP_OS_android) && !defined(MOZ_WIDGET_GONK)
 #define PROFILE_JAVA
 #endif
 
@@ -113,25 +97,6 @@ extern mozilla::TimeStamp gStartTime;
 
 typedef uint8_t* Address;
 
-// ----------------------------------------------------------------------------
-// OS
-//
-// This class has static methods for the different platform specific
-// functions. Add methods here to cope with differences between the
-// supported platforms.
-
-class OS {
-public:
-  // Sleep for a number of milliseconds.
-  static void Sleep(const int milliseconds);
-
-  // Sleep for a number of microseconds.
-  static void SleepMicro(const int microseconds);
-
-  // Called on startup to initialize platform specific things
-  static void Startup();
-};
-
 // ----------------------------------------------------------------------------
 // Thread
 //
@@ -141,7 +106,7 @@ public:
 
 class Thread {
 public:
-#ifdef XP_WIN
+#if defined(GP_OS_windows)
   typedef DWORD tid_t;
 #else
   typedef ::pid_t tid_t;
@@ -160,12 +125,11 @@ public:
 // platform.
 
 #undef HAVE_NATIVE_UNWIND
-#if defined(MOZ_PROFILING) \
-    && (defined(SPS_PLAT_amd64_linux) || defined(SPS_PLAT_arm_android) \
-        || (defined(MOZ_WIDGET_ANDROID) && defined(__arm__)) \
-        || defined(SPS_PLAT_x86_linux) \
-        || defined(SPS_OS_windows) \
-        || defined(SPS_OS_darwin))
+#if defined(MOZ_PROFILING) && \
+    (defined(GP_OS_windows) || \
+     defined(GP_OS_darwin) || \
+     defined(GP_OS_linux) || \
+     defined(GP_PLAT_arm_android))
 # define HAVE_NATIVE_UNWIND
 #endif
 
diff --git a/tools/profiler/core/shared-libraries-linux.cc b/tools/profiler/core/shared-libraries-linux.cc
index 630908e2baa2..5ca440bea091 100644
--- a/tools/profiler/core/shared-libraries-linux.cc
+++ b/tools/profiler/core/shared-libraries-linux.cc
@@ -14,6 +14,8 @@
 #include <fstream>
 #include "platform.h"
 #include "shared-libraries.h"
+#include "mozilla/Unused.h"
+#include "nsNativeCharsetUtils.h"
 
 #include "common/linux/file_id.h"
 #include <algorithm>
@@ -40,7 +42,7 @@ static std::string getId(const char *bin_name)
 #if !defined(MOZ_WIDGET_GONK)
 // TODO fix me with proper include
 #include "nsDebug.h"
-#ifdef ANDROID
+#if defined(GP_OS_android)
 #include "ElfLoader.h" // dl_phdr_info
 #else
 #include <link.h> // dl_phdr_info
@@ -49,7 +51,7 @@ static std::string getId(const char *bin_name)
 #include <dlfcn.h>
 #include <sys/types.h>
 
-#ifdef ANDROID
+#if defined(GP_OS_android)
 extern "C" MOZ_EXPORT __attribute__((weak))
 int dl_iterate_phdr(
           int (*callback) (struct dl_phdr_info *info,
@@ -80,7 +82,11 @@ dl_iterate_callback(struct dl_phdr_info *dl_info, size_t size, void *data)
       libEnd = end;
   }
   const char *name = dl_info->dlpi_name;
-  SharedLibrary shlib(libStart, libEnd, 0, getId(name), name);
+
+  nsAutoString nameStr;
+  mozilla::Unused << NS_WARN_IF(NS_FAILED(NS_CopyNativeToUnicode(nsDependentCString(name), nameStr)));
+
+  SharedLibrary shlib(libStart, libEnd, 0, getId(name), nameStr, nameStr, "");
   info.AddSharedLibrary(shlib);
 
   return 0;
@@ -93,7 +99,7 @@ SharedLibraryInfo SharedLibraryInfo::GetInfoForSelf()
   SharedLibraryInfo info;
 
 #if !defined(MOZ_WIDGET_GONK)
-#ifdef ANDROID
+#if defined(GP_OS_android)
   if (!dl_iterate_phdr) {
     // On ARM Android, dl_iterate_phdr is provided by the custom linker.
     // So if libxul was loaded by the system linker (e.g. as part of
@@ -101,12 +107,12 @@ SharedLibraryInfo SharedLibraryInfo::GetInfoForSelf()
     // not call it.
     return info;
   }
-#endif // ANDROID
+#endif // defined(GP_OS_android)
 
   dl_iterate_phdr(dl_iterate_callback, &info);
-#endif // !MOZ_WIDGET_GONK
+#endif // !defined(MOZ_WIDGET_GONK)
 
-#if defined(ANDROID) || defined(MOZ_WIDGET_GONK)
+#if defined(GP_OS_android) || defined(MOZ_WIDGET_GONK)
   pid_t pid = getpid();
   char path[PATH_MAX];
   snprintf(path, PATH_MAX, "/proc/%d/maps", pid);
@@ -146,7 +152,11 @@ SharedLibraryInfo SharedLibraryInfo::GetInfoForSelf()
       continue;
     }
 #endif
-    SharedLibrary shlib(start, end, offset, getId(name), name);
+
+    nsAutoString nameStr;
+    mozilla::Unused << NS_WARN_IF(NS_FAILED(NS_CopyNativeToUnicode(nsDependentCString(name), nameStr)));
+
+    SharedLibrary shlib(start, end, offset, getId(name), nameStr, nameStr, "");
     info.AddSharedLibrary(shlib);
     if (count > 10000) {
       LOG("Get maps failed");
@@ -154,7 +164,7 @@ SharedLibraryInfo SharedLibraryInfo::GetInfoForSelf()
     }
     count++;
   }
-#endif // ANDROID || MOZ_WIDGET_GONK
+#endif // defined(GP_OS_android) || defined(MOZ_WIDGET_GONK)
 
   return info;
 }
diff --git a/tools/profiler/core/shared-libraries-macos.cc b/tools/profiler/core/shared-libraries-macos.cc
index bffda747df53..b5ddfca299ea 100644
--- a/tools/profiler/core/shared-libraries-macos.cc
+++ b/tools/profiler/core/shared-libraries-macos.cc
@@ -14,11 +14,13 @@
 #include <stdlib.h>
 #include <vector>
 #include <sstream>
+#include "mozilla/Unused.h"
+#include "nsNativeCharsetUtils.h"
 
 #include "shared-libraries.h"
 
 // Architecture specific abstraction.
-#ifdef __i386__
+#if defined(GP_ARCH_x86)
 typedef mach_header platform_mach_header;
 typedef segment_command mach_segment_command_type;
 #define MACHO_MAGIC_NUMBER MH_MAGIC
@@ -70,8 +72,11 @@ void addSharedLibrary(const platform_mach_header* header, char *name, SharedLibr
     uuid << '0';
   }
 
+  nsAutoString nameStr;
+  mozilla::Unused << NS_WARN_IF(NS_FAILED(NS_CopyNativeToUnicode(nsDependentCString(name), nameStr)));
+
   info.AddSharedLibrary(SharedLibrary(start, start + size, 0, uuid.str(),
-                                      name));
+                                      nameStr, nameStr, ""));
 }
 
 // Use dyld to inspect the macho image information. We can build the SharedLibraryEntry structure
diff --git a/tools/profiler/core/shared-libraries-win32.cc b/tools/profiler/core/shared-libraries-win32.cc
index e2db2579b88e..3e98150093f6 100644
--- a/tools/profiler/core/shared-libraries-win32.cc
+++ b/tools/profiler/core/shared-libraries-win32.cc
@@ -4,12 +4,15 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include <windows.h>
-#include <tlhelp32.h>
 #include <dbghelp.h>
 #include <sstream>
+#include <psapi.h>
 
 #include "shared-libraries.h"
 #include "nsWindowsHelpers.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Unused.h"
+#include "nsNativeCharsetUtils.h"
 
 #define CV_SIGNATURE 0x53445352 // 'SDSR'
 
@@ -18,6 +21,7 @@ struct CodeViewRecord70
   uint32_t signature;
   GUID pdbSignature;
   uint32_t pdbAge;
+  // A UTF-8 string, according to https://github.com/Microsoft/microsoft-pdb/blob/082c5290e5aff028ae84e43affa8be717aa7af73/PDB/dbi/locator.cpp#L785
   char pdbFileName[1];
 };
 
@@ -65,13 +69,7 @@ static bool GetPdbInfo(uintptr_t aStart, nsID& aSignature, uint32_t& aAge, char*
 
   // The PDB file name could be different from module filename, so report both
   // e.g. The PDB for C:\Windows\SysWOW64\ntdll.dll is wntdll.pdb
-  char * leafName = strrchr(debugInfo->pdbFileName, '\\');
-  if (leafName) {
-    // Only report the file portion of the path
-    *aPdbName = leafName + 1;
-  } else {
-    *aPdbName = debugInfo->pdbFileName;
-  }
+  *aPdbName = debugInfo->pdbFileName;
 
   return true;
 }
@@ -81,55 +79,121 @@ static bool IsDashOrBraces(char c)
   return c == '-' || c == '{' || c == '}';
 }
 
+std::string GetVersion(WCHAR* dllPath)
+{
+  DWORD infoSize = GetFileVersionInfoSizeW(dllPath, nullptr);
+  if (infoSize == 0) {
+    return "";
+  }
+
+  mozilla::UniquePtr<unsigned char[]> infoData = mozilla::MakeUnique<unsigned char[]>(infoSize);
+  if (!GetFileVersionInfoW(dllPath, 0, infoSize, infoData.get())) {
+    return "";
+  }
+
+  VS_FIXEDFILEINFO* vInfo;
+  UINT vInfoLen;
+  if (!VerQueryValueW(infoData.get(), L"\\", (LPVOID*)&vInfo, &vInfoLen)) {
+    return "";
+  }
+  if (!vInfo) {
+    return "";
+  }
+
+  std::ostringstream stream;
+  stream << (vInfo->dwFileVersionMS >> 16)    << "."
+         << (vInfo->dwFileVersionMS & 0xFFFF) << "."
+         << (vInfo->dwFileVersionLS >> 16)    << "."
+         << (vInfo->dwFileVersionLS & 0xFFFF);
+
+  return stream.str();
+}
+
 SharedLibraryInfo SharedLibraryInfo::GetInfoForSelf()
 {
   SharedLibraryInfo sharedLibraryInfo;
 
-  nsAutoHandle snap(CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId()));
+  HANDLE hProcess = GetCurrentProcess();
+  mozilla::UniquePtr<HMODULE[]> hMods;
+  size_t modulesNum = 0;
+  if (hProcess != NULL) {
+    DWORD modulesSize;
+    if (!EnumProcessModules(hProcess, nullptr, 0, &modulesSize)) {
+      return sharedLibraryInfo;
+    }
+    modulesNum = modulesSize / sizeof(HMODULE);
+    hMods = mozilla::MakeUnique<HMODULE[]>(modulesNum);
+    if (!EnumProcessModules(hProcess, hMods.get(), modulesNum * sizeof(HMODULE), &modulesSize)) {
+      return sharedLibraryInfo;
+    }
+  }
 
-  MODULEENTRY32 module = {0};
-  module.dwSize = sizeof(MODULEENTRY32);
-  if (Module32First(snap, &module)) {
-    do {
-      nsID pdbSig;
-      uint32_t pdbAge;
-      char *pdbName = NULL;
+  for (unsigned int i = 0; i <= modulesNum; i++) {
+    nsID pdbSig;
+    uint32_t pdbAge;
+    nsAutoString pdbNameStr;
+    char *pdbName = NULL;
+    std::string breakpadId;
+    WCHAR modulePath[MAX_PATH + 1];
 
-      // Load the module again to make sure that its handle will remain remain
-      // valid as we attempt to read the PDB information from it.  We load the
-      // DLL as a datafile so that if the module actually gets unloaded between
-      // the call to Module32Next and the following LoadLibraryEx, we don't end
-      // up running the now newly loaded module's DllMain function.  If the
-      // module is already loaded, LoadLibraryEx just increments its refcount.
-      //
-      // Note that because of the race condition above, merely loading the DLL
-      // again is not safe enough, therefore we also need to make sure that we
-      // can read the memory mapped at the base address before we can safely
-      // proceed to actually access those pages.
-      HMODULE handleLock = LoadLibraryEx(module.szExePath, NULL, LOAD_LIBRARY_AS_DATAFILE);
-      MEMORY_BASIC_INFORMATION vmemInfo = {0};
-      if (handleLock &&
-          sizeof(vmemInfo) == VirtualQuery(module.modBaseAddr, &vmemInfo, sizeof(vmemInfo)) &&
-          vmemInfo.State == MEM_COMMIT &&
-          GetPdbInfo((uintptr_t)module.modBaseAddr, pdbSig, pdbAge, &pdbName)) {
-        std::ostringstream stream;
-        stream << pdbSig.ToString() << std::hex << pdbAge;
-        std::string breakpadId = stream.str();
-        std::string::iterator end =
-          std::remove_if(breakpadId.begin(), breakpadId.end(), IsDashOrBraces);
-        breakpadId.erase(end, breakpadId.end());
-        std::transform(breakpadId.begin(), breakpadId.end(),
-                       breakpadId.begin(), toupper);
+    if (!GetModuleFileNameEx(hProcess, hMods[i], modulePath, sizeof(modulePath) / sizeof(WCHAR))) {
+      continue;
+    }
 
-        SharedLibrary shlib((uintptr_t)module.modBaseAddr,
-                            (uintptr_t)module.modBaseAddr+module.modBaseSize,
-                            0, // DLLs are always mapped at offset 0 on Windows
-                            breakpadId,
-                            pdbName);
-        sharedLibraryInfo.AddSharedLibrary(shlib);
+    MODULEINFO module = {0};
+    if (!GetModuleInformation(hProcess, hMods[i], &module, sizeof(MODULEINFO))) {
+      continue;
+    }
+
+    // Load the module again to make sure that its handle will remain remain
+    // valid as we attempt to read the PDB information from it.  We load the
+    // DLL as a datafile so that if the module actually gets unloaded between
+    // the call to EnumProcessModules and the following LoadLibraryEx, we don't
+    // end up running the now newly loaded module's DllMain function.  If the
+    // module is already loaded, LoadLibraryEx just increments its refcount.
+    //
+    // Note that because of the race condition above, merely loading the DLL
+    // again is not safe enough, therefore we also need to make sure that we
+    // can read the memory mapped at the base address before we can safely
+    // proceed to actually access those pages.
+    HMODULE handleLock = LoadLibraryEx(modulePath, NULL, LOAD_LIBRARY_AS_DATAFILE);
+    MEMORY_BASIC_INFORMATION vmemInfo = { 0 };
+    if (handleLock &&
+      sizeof(vmemInfo) == VirtualQuery(module.lpBaseOfDll, &vmemInfo, sizeof(vmemInfo)) &&
+      vmemInfo.State == MEM_COMMIT &&
+      GetPdbInfo((uintptr_t)module.lpBaseOfDll, pdbSig, pdbAge, &pdbName)) {
+      std::ostringstream stream;
+      stream << pdbSig.ToString() << std::hex << pdbAge;
+      breakpadId = stream.str();
+      std::string::iterator end =
+        std::remove_if(breakpadId.begin(), breakpadId.end(), IsDashOrBraces);
+      breakpadId.erase(end, breakpadId.end());
+      std::transform(breakpadId.begin(), breakpadId.end(),
+        breakpadId.begin(), toupper);
+
+      pdbNameStr = NS_ConvertUTF8toUTF16(pdbName);
+      int32_t pos = pdbNameStr.RFindChar('\\');
+      if (pos != kNotFound) {
+        pdbNameStr.Cut(0, pos + 1);
       }
-      FreeLibrary(handleLock); // ok to free null handles
-    } while (Module32Next(snap, &module));
+    }
+
+    nsAutoString moduleName(modulePath);
+    int32_t pos = moduleName.RFindChar('\\');
+    if (pos != kNotFound) {
+      moduleName.Cut(0, pos + 1);
+    }
+
+    SharedLibrary shlib((uintptr_t)module.lpBaseOfDll,
+      (uintptr_t)module.lpBaseOfDll + module.SizeOfImage,
+      0, // DLLs are always mapped at offset 0 on Windows
+      breakpadId,
+      moduleName,
+      pdbNameStr,
+      GetVersion(modulePath));
+    sharedLibraryInfo.AddSharedLibrary(shlib);
+
+    FreeLibrary(handleLock); // ok to free null handles
   }
 
   return sharedLibraryInfo;
diff --git a/tools/profiler/lul/AutoObjectMapper.h b/tools/profiler/lul/AutoObjectMapper.h
index facf8d191d4e..ac51df631c4f 100644
--- a/tools/profiler/lul/AutoObjectMapper.h
+++ b/tools/profiler/lul/AutoObjectMapper.h
@@ -12,7 +12,7 @@
 #include "mozilla/Attributes.h"
 #include "PlatformMacros.h"
 
-#if defined(SPS_OS_android) && !defined(MOZ_WIDGET_GONK)
+#if defined(GP_OS_android) && !defined(MOZ_WIDGET_GONK)
 #define USE_FAULTY_LIB
 #endif
 
diff --git a/tools/profiler/lul/LulDwarfSummariser.cpp b/tools/profiler/lul/LulDwarfSummariser.cpp
index 8c5b27aa6851..174d2ea732e7 100644
--- a/tools/profiler/lul/LulDwarfSummariser.cpp
+++ b/tools/profiler/lul/LulDwarfSummariser.cpp
@@ -134,7 +134,7 @@ Summariser::Rule(uintptr_t aAddress, int aNewReg,
 
   // FIXME: factor out common parts of the arch-dependent summarisers.
 
-#if defined(SPS_ARCH_arm)
+#if defined(GP_ARCH_arm)
 
   // ----------------- arm ----------------- //
 
@@ -237,7 +237,7 @@ Summariser::Rule(uintptr_t aAddress, int aNewReg,
     mCurrRules.mR15expr = LExpr(NODEREF, DW_REG_ARM_R14, 0);
   }
 
-#elif defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#elif defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
 
   // ---------------- x64/x86 ---------------- //
 
diff --git a/tools/profiler/lul/LulElf.cpp b/tools/profiler/lul/LulElf.cpp
index 09dcedeca655..cb5bee324517 100644
--- a/tools/profiler/lul/LulElf.cpp
+++ b/tools/profiler/lul/LulElf.cpp
@@ -68,7 +68,7 @@
 #include "LulMainInt.h"
 
 
-#if defined(SPS_PLAT_arm_android) && !defined(SHT_ARM_EXIDX)
+#if defined(GP_PLAT_arm_android) && !defined(SHT_ARM_EXIDX)
 // bionic and older glibsc don't define it
 # define SHT_ARM_EXIDX (SHT_LOPROC + 1)
 #endif
diff --git a/tools/profiler/lul/LulElfInt.h b/tools/profiler/lul/LulElfInt.h
index 360a284bb1de..c02251068258 100644
--- a/tools/profiler/lul/LulElfInt.h
+++ b/tools/profiler/lul/LulElfInt.h
@@ -55,7 +55,7 @@
 // elfutils.h: Utilities for dealing with ELF files.
 //
 
-#if defined(SPS_OS_android)
+#if defined(GP_OS_android)
 
 // From toolkit/crashreporter/google-breakpad/src/common/android/include/elf.h
 // The Android headers don't always define this constant.
diff --git a/tools/profiler/lul/LulMain.cpp b/tools/profiler/lul/LulMain.cpp
index 5b69ce1cd16c..80d7db59f14a 100644
--- a/tools/profiler/lul/LulMain.cpp
+++ b/tools/profiler/lul/LulMain.cpp
@@ -60,11 +60,11 @@ NameOf_DW_REG(int16_t aReg)
 {
   switch (aReg) {
     case DW_REG_CFA:       return "cfa";
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
     case DW_REG_INTEL_XBP: return "xbp";
     case DW_REG_INTEL_XSP: return "xsp";
     case DW_REG_INTEL_XIP: return "xip";
-#elif defined(SPS_ARCH_arm)
+#elif defined(GP_ARCH_arm)
     case DW_REG_ARM_R7:    return "r7";
     case DW_REG_ARM_R11:   return "r11";
     case DW_REG_ARM_R12:   return "r12";
@@ -119,11 +119,11 @@ RuleSet::Print(void(*aLog)(const char*)) const
   res += mCfaExpr.ShowRule("cfa");
   res += " in";
   // For each reg we care about, print the recovery expression.
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
   res += mXipExpr.ShowRule(" RA");
   res += mXspExpr.ShowRule(" SP");
   res += mXbpExpr.ShowRule(" BP");
-#elif defined(SPS_ARCH_arm)
+#elif defined(GP_ARCH_arm)
   res += mR15expr.ShowRule(" R15");
   res += mR7expr .ShowRule(" R7" );
   res += mR11expr.ShowRule(" R11");
@@ -140,11 +140,11 @@ LExpr*
 RuleSet::ExprForRegno(DW_REG_NUMBER aRegno) {
   switch (aRegno) {
     case DW_REG_CFA: return &mCfaExpr;
-#   if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#   if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
     case DW_REG_INTEL_XIP: return &mXipExpr;
     case DW_REG_INTEL_XSP: return &mXspExpr;
     case DW_REG_INTEL_XBP: return &mXbpExpr;
-#   elif defined(SPS_ARCH_arm)
+#   elif defined(GP_ARCH_arm)
     case DW_REG_ARM_R15:   return &mR15expr;
     case DW_REG_ARM_R14:   return &mR14expr;
     case DW_REG_ARM_R13:   return &mR13expr;
@@ -633,7 +633,7 @@ class PriMap {
     // |ia| falls within an r-x range.  So we can
     // safely poke around in [insns_min, insns_max].
 
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
     // Is the previous instruction recognisably a CALL?  This is
     // common for the 32- and 64-bit versions, except for the
     // simm32(%rip) case, which is 64-bit only.
@@ -645,7 +645,7 @@ class PriMap {
     // logic works for both 32- and 64-bit cases.
 
     uint8_t* p = (uint8_t*)ia;
-#   if defined(SPS_ARCH_amd64)
+#   if defined(GP_ARCH_amd64)
     // CALL simm32(%rip)  == FF15 simm32
     if (ia - 6 >= insns_min && p[-6] == 0xFF && p[-5] == 0x15) {
       return true;
@@ -745,7 +745,7 @@ class PriMap {
       return true;
     }
 
-#elif defined(SPS_ARCH_arm)
+#elif defined(GP_ARCH_arm)
     if (ia & 1) {
       uint16_t w0 = 0, w1 = 0;
       // The return address has its lowest bit set, indicating a return
@@ -1093,11 +1093,11 @@ TaggedUWord EvaluateReg(int16_t aReg, const UnwindRegs* aOldRegs,
 {
   switch (aReg) {
     case DW_REG_CFA:       return aCFA;
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
     case DW_REG_INTEL_XBP: return aOldRegs->xbp;
     case DW_REG_INTEL_XSP: return aOldRegs->xsp;
     case DW_REG_INTEL_XIP: return aOldRegs->xip;
-#elif defined(SPS_ARCH_arm)
+#elif defined(GP_ARCH_arm)
     case DW_REG_ARM_R7:    return aOldRegs->r7;
     case DW_REG_ARM_R11:   return aOldRegs->r11;
     case DW_REG_ARM_R12:   return aOldRegs->r12;
@@ -1285,11 +1285,11 @@ void UseRuleSet(/*MOD*/UnwindRegs* aRegs,
   // anew.  If we don't even manage to compute a new PC value, then
   // the caller will have to abandon the unwind.
   // FIXME: Create and use instead: aRegs->SetAllInvalid();
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
   aRegs->xbp = TaggedUWord();
   aRegs->xsp = TaggedUWord();
   aRegs->xip = TaggedUWord();
-#elif defined(SPS_ARCH_arm)
+#elif defined(GP_ARCH_arm)
   aRegs->r7  = TaggedUWord();
   aRegs->r11 = TaggedUWord();
   aRegs->r12 = TaggedUWord();
@@ -1313,14 +1313,14 @@ void UseRuleSet(/*MOD*/UnwindRegs* aRegs,
   // value rules mention the CFA.  In any case, compute the new values
   // for each register that we're tracking.
 
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
   aRegs->xbp
     = aRS->mXbpExpr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
   aRegs->xsp
     = aRS->mXspExpr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
   aRegs->xip
     = aRS->mXipExpr.EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
-#elif defined(SPS_ARCH_arm)
+#elif defined(GP_ARCH_arm)
   aRegs->r7
     = aRS->mR7expr .EvaluateExpr(&old_regs, cfa, aStackImg, aPfxInstrs);
   aRegs->r11
@@ -1370,7 +1370,7 @@ LUL::Unwind(/*OUT*/uintptr_t* aFramePCs,
     if (DEBUG_MAIN) {
       char buf[300];
       mLog("\n");
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
       SprintfLiteral(buf,
                      "LoopTop: rip %d/%llx  rsp %d/%llx  rbp %d/%llx\n",
                      (int)regs.xip.Valid(), (unsigned long long int)regs.xip.Value(),
@@ -1378,7 +1378,7 @@ LUL::Unwind(/*OUT*/uintptr_t* aFramePCs,
                      (int)regs.xbp.Valid(), (unsigned long long int)regs.xbp.Value());
       buf[sizeof(buf)-1] = 0;
       mLog(buf);
-#elif defined(SPS_ARCH_arm)
+#elif defined(GP_ARCH_arm)
       SprintfLiteral(buf,
                      "LoopTop: r15 %d/%llx  r7 %d/%llx  r11 %d/%llx"
                      "  r12 %d/%llx  r13 %d/%llx  r14 %d/%llx\n",
@@ -1395,10 +1395,10 @@ LUL::Unwind(/*OUT*/uintptr_t* aFramePCs,
 #endif
     }
 
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
     TaggedUWord ia = regs.xip;
     TaggedUWord sp = regs.xsp;
-#elif defined(SPS_ARCH_arm)
+#elif defined(GP_ARCH_arm)
     TaggedUWord ia = (*aFramesUsed == 0 ? regs.r15 : regs.r14);
     TaggedUWord sp = regs.r13;
 #else
@@ -1503,7 +1503,7 @@ LUL::Unwind(/*OUT*/uintptr_t* aFramePCs,
     // hasn't been rescheduled.  The code below doesn't handle that;
     // it could easily be made to.
     //
-#if defined(SPS_PLAT_x86_android) || defined(SPS_PLAT_x86_linux)
+#if defined(GP_PLAT_x86_android) || defined(GP_PLAT_x86_linux)
     if (!ruleset && *aFramesUsed == 1 && ia.Valid() && sp.Valid()) {
       uintptr_t insns_min, insns_max;
       uintptr_t eip = ia.Value();
@@ -1575,11 +1575,11 @@ LUL::Unwind(/*OUT*/uintptr_t* aFramePCs,
           scan_succeeded = true;
           (*aScannedFramesAcquired)++;
 
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
           // The same logic applies for the 32- and 64-bit cases.
           // Register names of the form xsp etc refer to (eg) esp in
           // the 32-bit case and rsp in the 64-bit case.
-#         if defined(SPS_ARCH_amd64)
+#         if defined(GP_ARCH_amd64)
           const int wordSize = 8;
 #         else
           const int wordSize = 4;
@@ -1619,7 +1619,7 @@ LUL::Unwind(/*OUT*/uintptr_t* aFramePCs,
           // Move on to the next word up the stack
           sp = sp + TaggedUWord(wordSize);
 
-#elif defined(SPS_ARCH_arm)
+#elif defined(GP_ARCH_arm)
           // Set all registers to be undefined, except for SP(R13) and
           // PC(R15).
 
@@ -1686,7 +1686,7 @@ bool GetAndCheckStackTrace(LUL* aLUL, const char* dstring)
   // Get hold of the current unwind-start registers.
   UnwindRegs startRegs;
   memset(&startRegs, 0, sizeof(startRegs));
-#if defined(SPS_PLAT_amd64_linux)
+#if defined(GP_PLAT_amd64_linux)
   volatile uintptr_t block[3];
   MOZ_ASSERT(sizeof(block) == 24);
   __asm__ __volatile__(
@@ -1701,7 +1701,7 @@ bool GetAndCheckStackTrace(LUL* aLUL, const char* dstring)
   startRegs.xbp = TaggedUWord(block[2]);
   const uintptr_t REDZONE_SIZE = 128;
   uintptr_t start = block[1] - REDZONE_SIZE;
-#elif defined(SPS_PLAT_x86_linux) || defined(SPS_PLAT_x86_android)
+#elif defined(GP_PLAT_x86_linux) || defined(GP_PLAT_x86_android)
   volatile uintptr_t block[3];
   MOZ_ASSERT(sizeof(block) == 12);
   __asm__ __volatile__(
@@ -1717,7 +1717,7 @@ bool GetAndCheckStackTrace(LUL* aLUL, const char* dstring)
   startRegs.xbp = TaggedUWord(block[2]);
   const uintptr_t REDZONE_SIZE = 0;
   uintptr_t start = block[1] - REDZONE_SIZE;
-#elif defined(SPS_PLAT_arm_android)
+#elif defined(GP_PLAT_arm_android)
   volatile uintptr_t block[6];
   MOZ_ASSERT(sizeof(block) == 24);
   __asm__ __volatile__(
diff --git a/tools/profiler/lul/LulMain.h b/tools/profiler/lul/LulMain.h
index ca9145c5c2d7..52a25c8521dd 100644
--- a/tools/profiler/lul/LulMain.h
+++ b/tools/profiler/lul/LulMain.h
@@ -141,14 +141,14 @@ private:
 // The registers, with validity tags, that will be unwound.
 
 struct UnwindRegs {
-#if defined(SPS_ARCH_arm)
+#if defined(GP_ARCH_arm)
   TaggedUWord r7;
   TaggedUWord r11;
   TaggedUWord r12;
   TaggedUWord r13;
   TaggedUWord r14;
   TaggedUWord r15;
-#elif defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#elif defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
   TaggedUWord xbp;
   TaggedUWord xsp;
   TaggedUWord xip;
diff --git a/tools/profiler/lul/LulMainInt.h b/tools/profiler/lul/LulMainInt.h
index 10ee9b16c830..31e833d52790 100644
--- a/tools/profiler/lul/LulMainInt.h
+++ b/tools/profiler/lul/LulMainInt.h
@@ -35,7 +35,7 @@ enum DW_REG_NUMBER {
   // treat the CFA (Canonical Frame Address) as "just another
   // register", though.
   DW_REG_CFA = -1,
-#if defined(SPS_ARCH_arm)
+#if defined(GP_ARCH_arm)
   // ARM registers
   DW_REG_ARM_R7  = 7,
   DW_REG_ARM_R11 = 11,
@@ -43,13 +43,13 @@ enum DW_REG_NUMBER {
   DW_REG_ARM_R13 = 13,
   DW_REG_ARM_R14 = 14,
   DW_REG_ARM_R15 = 15,
-#elif defined(SPS_ARCH_amd64)
+#elif defined(GP_ARCH_amd64)
   // Because the X86 (32 bit) and AMD64 (64 bit) summarisers are
   // combined, a merged set of register constants is needed.
   DW_REG_INTEL_XBP = 6,
   DW_REG_INTEL_XSP = 7,
   DW_REG_INTEL_XIP = 16,
-#elif defined(SPS_ARCH_x86)
+#elif defined(GP_ARCH_x86)
   DW_REG_INTEL_XBP = 5,
   DW_REG_INTEL_XSP = 4,
   DW_REG_INTEL_XIP = 8,
@@ -264,11 +264,11 @@ public:
   LExpr  mCfaExpr;
   // How to compute caller register values.  These may reference the
   // value defined by |mCfaExpr|.
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
   LExpr  mXipExpr; // return address
   LExpr  mXspExpr;
   LExpr  mXbpExpr;
-#elif defined(SPS_ARCH_arm)
+#elif defined(GP_ARCH_arm)
   LExpr  mR15expr; // return address
   LExpr  mR14expr;
   LExpr  mR13expr;
@@ -284,10 +284,10 @@ public:
 // of the set of registers that LUL unwinds on this target.
 static inline bool registerIsTracked(DW_REG_NUMBER reg) {
   switch (reg) {
-#   if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#   if defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
     case DW_REG_INTEL_XBP: case DW_REG_INTEL_XSP: case DW_REG_INTEL_XIP:
       return true;
-#   elif defined(SPS_ARCH_arm)
+#   elif defined(GP_ARCH_arm)
     case DW_REG_ARM_R7:  case DW_REG_ARM_R11: case DW_REG_ARM_R12:
     case DW_REG_ARM_R13: case DW_REG_ARM_R14: case DW_REG_ARM_R15:
       return true;
diff --git a/tools/profiler/lul/platform-linux-lul.cpp b/tools/profiler/lul/platform-linux-lul.cpp
index 207cd683d17e..d020cba52c39 100644
--- a/tools/profiler/lul/platform-linux-lul.cpp
+++ b/tools/profiler/lul/platform-linux-lul.cpp
@@ -26,12 +26,14 @@ read_procmaps(lul::LUL* aLUL)
 {
   MOZ_ASSERT(aLUL->CountMappings() == 0);
 
-# if defined(SPS_OS_linux) || defined(SPS_OS_android) || defined(SPS_OS_darwin)
+# if defined(GP_OS_linux) || defined(GP_OS_android) || defined(GP_OS_darwin)
   SharedLibraryInfo info = SharedLibraryInfo::GetInfoForSelf();
 
   for (size_t i = 0; i < info.GetSize(); i++) {
     const SharedLibrary& lib = info.GetEntry(i);
 
+    std::string nativeName = lib.GetNativeDebugName();
+
 #   if defined(USE_FAULTY_LIB)
     // We're using faulty.lib.  Use a special-case object mapper.
     AutoObjectMapperFaultyLib mapper(aLUL->mLog);
@@ -44,11 +46,11 @@ read_procmaps(lul::LUL* aLUL)
     // to NotifyAfterMap().
     void*  image = nullptr;
     size_t size  = 0;
-    bool ok = mapper.Map(&image, &size, lib.GetName());
+    bool ok = mapper.Map(&image, &size, nativeName);
     if (ok && image && size > 0) {
       aLUL->NotifyAfterMap(lib.GetStart(), lib.GetEnd()-lib.GetStart(),
-                           lib.GetName().c_str(), image);
-    } else if (!ok && lib.GetName() == "") {
+                           nativeName.c_str(), image);
+    } else if (!ok && lib.GetDebugName().IsEmpty()) {
       // The object has no name and (as a consequence) the mapper
       // failed to map it.  This happens on Linux, where
       // GetInfoForSelf() produces two such mappings: one for the
diff --git a/tools/profiler/public/GeckoProfiler.h b/tools/profiler/public/GeckoProfiler.h
index 3a048a0d28fa..dd3177e89c82 100644
--- a/tools/profiler/public/GeckoProfiler.h
+++ b/tools/profiler/public/GeckoProfiler.h
@@ -329,9 +329,7 @@ extern MOZ_THREAD_LOCAL(PseudoStack*) tlsPseudoStack;
 extern bool stack_key_initialized;
 
 #ifndef SAMPLE_FUNCTION_NAME
-# ifdef __GNUC__
-#  define SAMPLE_FUNCTION_NAME __FUNCTION__
-# elif defined(_MSC_VER)
+# if defined(__GNUC__) || defined(_MSC_VER)
 #  define SAMPLE_FUNCTION_NAME __FUNCTION__
 # else
 #  define SAMPLE_FUNCTION_NAME __func__  // defined in C99, supported in various C++ compilers. Just raw function name.
@@ -448,20 +446,10 @@ void profiler_get_gatherer(nsISupports** aRetVal);
  * important case, b2g, there are also many gecko processes which
  * magnify these effects. */
 # define PROFILE_DEFAULT_INTERVAL 10
-#elif defined(ANDROID)
-// We use a lower frequency on Android, in order to make things work
-// more smoothly on phones.  This value can be adjusted later with
-// some libunwind optimizations.
-// In one sample measurement on Galaxy Nexus, out of about 700 backtraces,
-// 60 of them took more than 25ms, and the average and standard deviation
-// were 6.17ms and 9.71ms respectively.
-
-// For now since we don't support stackwalking let's use 1ms since it's fast
-// enough.
-#define PROFILE_DEFAULT_INTERVAL 1
 #else
 #define PROFILE_DEFAULT_INTERVAL 1
 #endif
+
 #define PROFILE_DEFAULT_FEATURES NULL
 #define PROFILE_DEFAULT_FEATURE_COUNT 0
 
diff --git a/tools/profiler/public/PseudoStack.h b/tools/profiler/public/PseudoStack.h
index cb6520cdfdb2..cabeabe17f9d 100644
--- a/tools/profiler/public/PseudoStack.h
+++ b/tools/profiler/public/PseudoStack.h
@@ -18,23 +18,11 @@
 
 #include <algorithm>
 
-// We duplicate this code here to avoid header dependencies which make it more
-// difficult to include in other places.
-#if defined(_M_X64) || defined(__x86_64__)
-#define V8_HOST_ARCH_X64 1
-#elif defined(_M_IX86) || defined(__i386__) || defined(__i386)
-#define V8_HOST_ARCH_IA32 1
-#elif defined(__ARMEL__)
-#define V8_HOST_ARCH_ARM 1
-#else
-#warning Please add support for your architecture in chromium_types.h
-#endif
-
 // STORE_SEQUENCER: Because signals can interrupt our profile modification
 //                  we need to make stores are not re-ordered by the compiler
 //                  or hardware to make sure the profile is consistent at
 //                  every point the signal can fire.
-#ifdef V8_HOST_ARCH_ARM
+#if defined(__arm__)
 // TODO Is there something cheaper that will prevent memory stores from being
 // reordered?
 
@@ -43,7 +31,9 @@ LinuxKernelMemoryBarrierFunc pLinuxKernelMemoryBarrier __attribute__((weak)) =
     (LinuxKernelMemoryBarrierFunc) 0xffff0fa0;
 
 # define STORE_SEQUENCER() pLinuxKernelMemoryBarrier()
-#elif defined(V8_HOST_ARCH_IA32) || defined(V8_HOST_ARCH_X64)
+
+#elif defined(__i386__) || defined(__x86_64__) || \
+      defined(_M_IX86) || defined(_M_X64)
 # if defined(_MSC_VER)
 #  include <intrin.h>
 #  define STORE_SEQUENCER() _ReadWriteBarrier();
@@ -54,6 +44,7 @@ LinuxKernelMemoryBarrierFunc pLinuxKernelMemoryBarrier __attribute__((weak)) =
 # else
 #  error "Memory clobber not supported for your compiler."
 # endif
+
 #else
 # error "Memory clobber not supported for your platform."
 #endif
diff --git a/tools/profiler/public/shared-libraries.h b/tools/profiler/public/shared-libraries.h
index baafea2fc61a..ca40715930f4 100644
--- a/tools/profiler/public/shared-libraries.h
+++ b/tools/profiler/public/shared-libraries.h
@@ -17,6 +17,8 @@
 #include <stdlib.h>
 #include <stdint.h>
 #include <nsID.h>
+#include "nsString.h"
+#include "nsNativeCharsetUtils.h"
 
 class SharedLibrary {
 public:
@@ -25,12 +27,16 @@ public:
                 uintptr_t aEnd,
                 uintptr_t aOffset,
                 const std::string& aBreakpadId,
-                const std::string& aName)
+                const nsString& aName,
+                const nsString& aDebugName,
+                const std::string& aVersion)
     : mStart(aStart)
     , mEnd(aEnd)
     , mOffset(aOffset)
     , mBreakpadId(aBreakpadId)
     , mName(aName)
+    , mDebugName(aDebugName)
+    , mVersion(aVersion)
   {}
 
   SharedLibrary(const SharedLibrary& aEntry)
@@ -39,6 +45,8 @@ public:
     , mOffset(aEntry.mOffset)
     , mBreakpadId(aEntry.mBreakpadId)
     , mName(aEntry.mName)
+    , mDebugName(aEntry.mDebugName)
+    , mVersion(aEntry.mVersion)
   {}
 
   SharedLibrary& operator=(const SharedLibrary& aEntry)
@@ -51,6 +59,8 @@ public:
     mOffset = aEntry.mOffset;
     mBreakpadId = aEntry.mBreakpadId;
     mName = aEntry.mName;
+    mDebugName = aEntry.mDebugName;
+    mVersion = aEntry.mVersion;
     return *this;
   }
 
@@ -60,14 +70,25 @@ public:
            (mEnd == other.mEnd) &&
            (mOffset == other.mOffset) &&
            (mName == other.mName) &&
-           (mBreakpadId == other.mBreakpadId);
+           (mDebugName == other.mDebugName) &&
+           (mBreakpadId == other.mBreakpadId) &&
+           (mVersion == other.mVersion);
   }
 
   uintptr_t GetStart() const { return mStart; }
   uintptr_t GetEnd() const { return mEnd; }
   uintptr_t GetOffset() const { return mOffset; }
   const std::string &GetBreakpadId() const { return mBreakpadId; }
-  const std::string &GetName() const { return mName; }
+  const nsString &GetName() const { return mName; }
+  const std::string GetNativeDebugName() const {
+    nsAutoCString debugNameStr;
+
+    NS_CopyUnicodeToNative(mDebugName, debugNameStr);
+
+    return debugNameStr.get();
+  }
+  const nsString &GetDebugName() const { return mDebugName; }
+  const std::string &GetVersion() const { return mVersion; }
 
 private:
   SharedLibrary() {}
@@ -76,7 +97,9 @@ private:
   uintptr_t mEnd;
   uintptr_t mOffset;
   std::string mBreakpadId;
-  std::string mName;
+  nsString mName;
+  nsString mDebugName;
+  std::string mVersion;
 };
 
 static bool
diff --git a/tools/profiler/tasktracer/GeckoTaskTracer.cpp b/tools/profiler/tasktracer/GeckoTaskTracer.cpp
index 2a8251c8b131..ed320e7b635f 100644
--- a/tools/profiler/tasktracer/GeckoTaskTracer.cpp
+++ b/tools/profiler/tasktracer/GeckoTaskTracer.cpp
@@ -21,7 +21,7 @@
 
 #include <stdarg.h>
 
-#ifdef XP_WIN
+#if defined(GP_OS_windows)
 #include <windows.h>
 #define getpid GetCurrentProcessId
 #endif
diff --git a/tools/profiler/tests/gtest/LulTestDwarf.cpp b/tools/profiler/tests/gtest/LulTestDwarf.cpp
index 4daa52914141..bdda527c0e98 100644
--- a/tools/profiler/tests/gtest/LulTestDwarf.cpp
+++ b/tools/profiler/tests/gtest/LulTestDwarf.cpp
@@ -2403,10 +2403,10 @@ TEST_F(LulDwarfExpr, ExpressionOverrun) {
 
 // We'll need to mention specific Dwarf registers in the EvaluatePfxExpr tests,
 // and those names are arch-specific, so a bit of macro magic is helpful.
-#if defined(SPS_ARCH_arm)
+#if defined(GP_ARCH_arm)
 # define TESTED_REG_STRUCT_NAME  r11
 # define TESTED_REG_DWARF_NAME   DW_REG_ARM_R11
-#elif defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)
+#elif defined(GP_ARCH_amd64) || defined(GP_ARCH_x86)
 # define TESTED_REG_STRUCT_NAME  xbp
 # define TESTED_REG_DWARF_NAME   DW_REG_INTEL_XBP
 #else
diff --git a/widget/PuppetWidget.cpp b/widget/PuppetWidget.cpp
index 6a5110ae789c..f9b2bbbcbb31 100644
--- a/widget/PuppetWidget.cpp
+++ b/widget/PuppetWidget.cpp
@@ -76,6 +76,9 @@ MightNeedIMEFocus(const nsWidgetInitData* aInitData)
 // Arbitrary, fungible.
 const size_t PuppetWidget::kMaxDimension = 4000;
 
+static bool gRemoteDesktopBehaviorEnabled = false;
+static bool gRemoteDesktopBehaviorInitialized = false;
+
 NS_IMPL_ISUPPORTS_INHERITED0(PuppetWidget, nsBaseWidget)
 
 PuppetWidget::PuppetWidget(TabChild* aTabChild)
@@ -94,6 +97,11 @@ PuppetWidget::PuppetWidget(TabChild* aTabChild)
 
   // Setting 'Unknown' means "not yet cached".
   mInputContext.mIMEState.mEnabled = IMEState::UNKNOWN;
+
+  if (!gRemoteDesktopBehaviorInitialized) {
+    Preferences::AddBoolVarCache(&gRemoteDesktopBehaviorEnabled, "browser.tabs.remote.desktopbehavior", false);
+    gRemoteDesktopBehaviorInitialized = true;
+  }
 }
 
 PuppetWidget::~PuppetWidget()
@@ -1171,7 +1179,7 @@ PuppetWidget::NeedsPaint()
 {
   // e10s popups are handled by the parent process, so never should be painted here
   if (XRE_IsContentProcess() &&
-      Preferences::GetBool("browser.tabs.remote.desktopbehavior", false) &&
+      gRemoteDesktopBehaviorEnabled &&
       mWindowType == eWindowType_popup) {
     NS_WARNING("Trying to paint an e10s popup in the child process!");
     return false;
diff --git a/widget/gtk/gtk2drawing.c b/widget/gtk/gtk2drawing.c
index 25a76a87d4f3..1ac34eca425e 100644
--- a/widget/gtk/gtk2drawing.c
+++ b/widget/gtk/gtk2drawing.c
@@ -2972,7 +2972,9 @@ moz_gtk_get_widget_border(WidgetNodeType widget, gint* left, gint* top,
     case MOZ_GTK_RADIOBUTTON:
     case MOZ_GTK_SCROLLBAR_BUTTON:
     case MOZ_GTK_SCROLLBAR_HORIZONTAL:
+    case MOZ_GTK_SCROLLBAR_TROUGH_HORIZONTAL:
     case MOZ_GTK_SCROLLBAR_VERTICAL:
+    case MOZ_GTK_SCROLLBAR_TROUGH_VERTICAL:
     case MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL:
     case MOZ_GTK_SCROLLBAR_THUMB_VERTICAL:
     case MOZ_GTK_SCALE_THUMB_HORIZONTAL:
@@ -3229,6 +3231,10 @@ moz_gtk_widget_paint(WidgetNodeType widget, GdkDrawable* drawable,
         return moz_gtk_scrollbar_trough_paint(widget, drawable, rect,
                                               cliprect, state, direction);
         break;
+    case MOZ_GTK_SCROLLBAR_TROUGH_HORIZONTAL:
+    case MOZ_GTK_SCROLLBAR_TROUGH_VERTICAL:
+        return MOZ_GTK_SUCCESS;
+        break;
     case MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL:
     case MOZ_GTK_SCROLLBAR_THUMB_VERTICAL:
         return moz_gtk_scrollbar_thumb_paint(widget, drawable, rect,