diff --git a/.gitignore b/.gitignore
index eddeba9d44fd..2f27b29b45e2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,11 +13,11 @@ ID
 .*.sw[a-z]
 
 # User files that may appear at the root
-.mozconfig
-mozconfig
-configure
-config.cache
-config.log
+/.mozconfig*
+/mozconfig
+/configure
+/config.cache
+/config.log
 
 # Empty marker file that's generated when we check out NSS
 security/manager/.nss.checkout
diff --git a/Makefile.in b/Makefile.in
index 5f823293f577..3b9f3234818b 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -65,7 +65,7 @@ tier_base_dirs = \
 	$(NULL)
 
 ifndef LIBXUL_SDK
-ifeq ($(OS_TARGET),Android)
+ifeq (android,$(MOZ_WIDGET_TOOLKIT))
 tier_base_dirs += other-licenses/android
 endif
 
diff --git a/accessible/src/base/nsAccDocManager.cpp b/accessible/src/base/nsAccDocManager.cpp
index 5372c14dd3ce..07a8cb9c00b2 100644
--- a/accessible/src/base/nsAccDocManager.cpp
+++ b/accessible/src/base/nsAccDocManager.cpp
@@ -238,7 +238,8 @@ nsAccDocManager::OnProgressChange(nsIWebProgress *aWebProgress,
 
 NS_IMETHODIMP
 nsAccDocManager::OnLocationChange(nsIWebProgress *aWebProgress,
-                                  nsIRequest *aRequest, nsIURI *aLocation)
+                                  nsIRequest *aRequest, nsIURI *aLocation,
+                                  PRUint32 aFlags)
 {
   NS_NOTREACHED("notification excluded in AddProgressListener(...)");
   return NS_OK;
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index f3bad07f6237..b1736b140e8c 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -65,7 +65,7 @@ pref("extensions.minCompatibleAppVersion", "4.0");
 // Preferences for AMO integration
 pref("extensions.getAddons.cache.enabled", true);
 pref("extensions.getAddons.maxResults", 15);
-pref("extensions.getAddons.get.url", "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/guid:%IDS%?src=firefox&appOS=%OS%&appVersion=%VERSION%&tMain=%TIME_MAIN%&tFirstPaint=%TIME_FIRST_PAINT%&tSessionRestored=%TIME_SESSION_RESTORED%");
+pref("extensions.getAddons.get.url", "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/guid:%IDS%?src=firefox&appOS=%OS%&appVersion=%VERSION%");
 pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%");
 pref("extensions.getAddons.search.url", "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/%TERMS%/all/%MAX_RESULTS%/%OS%/%VERSION%?src=firefox");
 pref("extensions.webservice.discoverURL", "https://services.addons.mozilla.org/%LOCALE%/firefox/discovery/pane/%VERSION%/%OS%");
diff --git a/browser/base/content/aboutSyncTabs.js b/browser/base/content/aboutSyncTabs.js
index 8acdf7a416d1..222548e4ef23 100644
--- a/browser/base/content/aboutSyncTabs.js
+++ b/browser/base/content/aboutSyncTabs.js
@@ -140,7 +140,7 @@ let RemoteTabViewer = {
                                                    , "folderPicker"
                                                    , "loadInSidebar"
                                                    , "keyword" ]
-                                     });
+                                     }, window.top);
   },
 
   bookmarkSelectedTabs: function() {
@@ -160,7 +160,7 @@ let RemoteTabViewer = {
                                        , type: "folder"
                                        , URIList: URIs
                                        , hiddenRows: [ "description" ]
-                                       });
+                                       }, window.top);
     }
   },
 
diff --git a/browser/base/content/browser-places.js b/browser/base/content/browser-places.js
index 66cf691f2a1a..b85892c12cd7 100644
--- a/browser/base/content/browser-places.js
+++ b/browser/base/content/browser-places.js
@@ -388,13 +388,13 @@ var PlacesCommandHook = {
                                                      , "loadInSidebar"
                                                      , "folderPicker"
                                                      , "keyword" ]
-                                       });
+                                       }, window);
     }
     else {
       PlacesUIUtils.showBookmarkDialog({ action: "edit"
                                        , type: "bookmark"
                                        , itemId: itemId
-                                       });
+                                       }, window);
     }
   },
 
@@ -427,7 +427,7 @@ var PlacesCommandHook = {
                                      , type: "folder"
                                      , URIList: pages
                                      , hiddenRows: [ "description" ]
-                                     });
+                                     }, window);
     }
   },
 
@@ -478,7 +478,7 @@ var PlacesCommandHook = {
                                      , hiddenRows: [ "feedLocation"
                                                    , "siteLocation"
                                                    , "description" ]
-                                     });
+                                     }, window);
   },
 
   /**
diff --git a/browser/base/content/browser.css b/browser/base/content/browser.css
index f033c2bb4a34..e3a04bc9121b 100644
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -362,8 +362,8 @@ window[chromehidden~="toolbar"] toolbar:not(.toolbar-primary):not(.chromeclass-m
   position: fixed;
   top: 0;
   left: 0;
-  min-width: 100%;
-  min-height: 100%;
+  width: 100%;
+  height: 100%;
 }
 
 #full-screen-warning-container[fade-warning-out] {
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index ae06684d7a9d..739ac2b295d6 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -3165,7 +3165,7 @@ var bookmarksButtonObserver = {
                                                      , "loadInSidebar"
                                                      , "folderPicker"
                                                      , "keyword" ]
-                                       });
+                                       }, window);
     } catch(ex) { }
   },
 
@@ -4586,7 +4586,7 @@ var XULBrowserWindow = {
     }
   },
 
-  onLocationChange: function (aWebProgress, aRequest, aLocationURI) {
+  onLocationChange: function (aWebProgress, aRequest, aLocationURI, aFlags) {
     var location = aLocationURI ? aLocationURI.spec : "";
     this._hostChanged = true;
 
@@ -5052,7 +5052,8 @@ var TabsProgressListener = {
     }
   },
 
-  onLocationChange: function (aBrowser, aWebProgress, aRequest, aLocationURI) {
+  onLocationChange: function (aBrowser, aWebProgress, aRequest, aLocationURI,
+                              aFlags) {
     // Filter out any sub-frame loads
     if (aBrowser.contentWindow == aWebProgress.DOMWindow)
       FullZoom.onLocationChange(aLocationURI, false, aBrowser);
@@ -5793,7 +5794,7 @@ function contentAreaClick(event, isPanelClick)
                                                      , "location"
                                                      , "folderPicker"
                                                      , "keyword" ]
-                                       });
+                                       }, window);
       event.preventDefault();
       return true;
     }
@@ -6840,7 +6841,7 @@ function AddKeywordForSearchField() {
                                    , hiddenRows: [ "location"
                                                  , "loadInSidebar"
                                                  , "folderPicker" ]
-                                   });
+                                   }, window);
 }
 
 function SwitchDocumentDirection(aWindow) {
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index ba2a7cb7bdfa..5822018eb5c2 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -976,7 +976,7 @@
   </hbox>
 
   <hbox id="full-screen-warning-container" hidden="true" fadeout="true">
-    <hbox style="min-width: 100%;" pack="center"> <!-- Inner hbox needed due to bug 579776. -->
+    <hbox style="width: 100%;" pack="center"> <!-- Inner hbox needed due to bug 579776. -->
       <hbox id="full-screen-warning-message">
         <description id="full-screen-warning-text" value="&domFullScreenWarning.label;"></description>
       </hbox>
diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index a1a03f596cd0..d935ce626bdd 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -1408,13 +1408,13 @@ nsContextMenu.prototype = {
                                                      , "loadInSidebar"
                                                      , "folderPicker"
                                                      , "keyword" ]
-                                       });
+                                       }, window.top);
     }
     else {
       PlacesUIUtils.showBookmarkDialog({ action: "edit"
                                        , type: "bookmark"
                                        , itemId: itemId
-                                       });
+                                       }, window.top);
     }
   },
 
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 418f2b31e631..d4df769127cf 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -608,7 +608,8 @@
               this.mStatus = aStatus;
             },
 
-            onLocationChange: function (aWebProgress, aRequest, aLocation) {
+            onLocationChange: function (aWebProgress, aRequest, aLocation,
+                                        aFlags) {
               // OnLocationChange is called for both the top-level content
               // and the subframes.
               let topLevel = aWebProgress.DOMWindow == this.mBrowser.contentWindow;
@@ -641,7 +642,8 @@
 
               if (!this.mBlank) {
                 this._callProgressListeners("onLocationChange",
-                                            [aWebProgress, aRequest, aLocation]);
+                                            [aWebProgress, aRequest, aLocation,
+                                             aFlags]);
               }
 
               if (topLevel)
@@ -890,7 +892,8 @@
             var securityUI = this.mCurrentBrowser.securityUI;
 
             this._callProgressListeners(null, "onLocationChange",
-                                        [webProgress, null, loc], true, false);
+                                        [webProgress, null, loc, 0], true,
+                                        false);
 
             if (securityUI) {
               this._callProgressListeners(null, "onSecurityChange",
diff --git a/browser/base/content/test/browser_alltabslistener.js b/browser/base/content/test/browser_alltabslistener.js
index 70b1337c3656..4d7d11435169 100644
--- a/browser/base/content/test/browser_alltabslistener.js
+++ b/browser/base/content/test/browser_alltabslistener.js
@@ -17,7 +17,7 @@ var gFrontProgressListener = {
     gFrontNotificationsPos++;
   },
 
-  onLocationChange: function (aWebProgress, aRequest, aLocationURI) {
+  onLocationChange: function (aWebProgress, aRequest, aLocationURI, aFlags) {
     var state = "onLocationChange";
     info("FrontProgress: " + state + " " + aLocationURI.spec);
     ok(gFrontNotificationsPos < gFrontNotifications.length, "Got an expected notification for the front notifications listener");
@@ -53,7 +53,8 @@ var gAllProgressListener = {
     }
   },
 
-  onLocationChange: function (aBrowser, aWebProgress, aRequest, aLocationURI) {
+  onLocationChange: function (aBrowser, aWebProgress, aRequest, aLocationURI,
+                              aFlags) {
     var state = "onLocationChange";
     info("AllProgress: " + state + " " + aLocationURI.spec);
     ok(aBrowser == gTestBrowser, state + " notification came from the correct browser");
diff --git a/browser/base/content/test/browser_bug422590.js b/browser/base/content/test/browser_bug422590.js
index 92cf35477a95..608caa85388a 100644
--- a/browser/base/content/test/browser_bug422590.js
+++ b/browser/base/content/test/browser_bug422590.js
@@ -1,5 +1,6 @@
 function test() {
   waitForExplicitFinish();
+  ignoreAllUncaughtExceptions();
   
   // test the main (normal) browser window
   testCustomize(window, testChromeless);
diff --git a/browser/base/content/test/browser_bug599325.js b/browser/base/content/test/browser_bug599325.js
index 4c025cfe79e2..41c0ff2bb196 100644
--- a/browser/base/content/test/browser_bug599325.js
+++ b/browser/base/content/test/browser_bug599325.js
@@ -1,5 +1,6 @@
 function test() {
   waitForExplicitFinish();
+  ignoreAllUncaughtExceptions();
 
   testCustomize(window, finish);
 }
diff --git a/browser/base/content/test/browser_urlbarTrimURLs.js b/browser/base/content/test/browser_urlbarTrimURLs.js
index 74ee78a0a38e..095ccc4a633f 100644
--- a/browser/base/content/test/browser_urlbarTrimURLs.js
+++ b/browser/base/content/test/browser_urlbarTrimURLs.js
@@ -32,7 +32,13 @@ function test() {
   testVal("http://mozilla.org/sub/", "mozilla.org/sub/");
 
   testVal("http://ftp.mozilla.org/", "http://ftp.mozilla.org");
+  testVal("http://ftp1.mozilla.org/", "http://ftp1.mozilla.org");
+  testVal("http://ftp42.mozilla.org/", "http://ftp42.mozilla.org");
+  testVal("http://ftpx.mozilla.org/", "ftpx.mozilla.org");
   testVal("ftp://ftp.mozilla.org/", "ftp://ftp.mozilla.org");
+  testVal("ftp://ftp1.mozilla.org/", "ftp://ftp1.mozilla.org");
+  testVal("ftp://ftp42.mozilla.org/", "ftp://ftp42.mozilla.org");
+  testVal("ftp://ftpx.mozilla.org/", "ftp://ftpx.mozilla.org");
 
   testVal("https://user:pass@mozilla.org/", "https://user:pass@mozilla.org");
   testVal("http://user:pass@mozilla.org/", "http://user:pass@mozilla.org");
diff --git a/browser/base/content/utilityOverlay.js b/browser/base/content/utilityOverlay.js
index f1f7e40292bd..dfd5f15cab1b 100644
--- a/browser/base/content/utilityOverlay.js
+++ b/browser/base/content/utilityOverlay.js
@@ -635,8 +635,10 @@ function openPrefsHelp() {
 }
 
 function trimURL(aURL) {
+  // This function must not modify the given URL such that calling
+  // nsIURIFixup::createFixupURI with the result will produce a different URI.
   return aURL /* remove single trailing slash for http/https/ftp URLs */
              .replace(/^((?:http|https|ftp):\/\/[^/]+)\/$/, "$1")
-              /* remove http:// unless the host starts with "ftp." or contains "@" */
-             .replace(/^http:\/\/((?!ftp\.)[^\/@]+(?:\/|$))/, "$1");
+              /* remove http:// unless the host starts with "ftp\d*\." or contains "@" */
+             .replace(/^http:\/\/((?!ftp\d*\.)[^\/@]+(?:\/|$))/, "$1");
 }
diff --git a/browser/base/content/web-panels.js b/browser/base/content/web-panels.js
index 56c3fe2da5c6..d6686f2c1d48 100644
--- a/browser/base/content/web-panels.js
+++ b/browser/base/content/web-panels.js
@@ -72,7 +72,7 @@ var panelProgressListener = {
     }
     ,
 
-    onLocationChange : function(aWebProgress, aRequest, aLocation) {
+    onLocationChange : function(aWebProgress, aRequest, aLocation, aFlags) {
         UpdateBackForwardCommands(getPanelBrowser().webNavigation);
     },
 
diff --git a/browser/components/about/Makefile.in b/browser/components/about/Makefile.in
index ea232e319b4a..3227c3226a34 100644
--- a/browser/components/about/Makefile.in
+++ b/browser/components/about/Makefile.in
@@ -44,7 +44,6 @@ include $(DEPTH)/config/autoconf.mk
 MODULE = browserabout
 LIBRARY_NAME = browserabout_s
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 ifndef MOZ_MEMORY
 USE_STATIC_LIBS = 1
 endif
diff --git a/browser/components/dirprovider/Makefile.in b/browser/components/dirprovider/Makefile.in
index f0ddf6e8e171..e401ae301e1d 100644
--- a/browser/components/dirprovider/Makefile.in
+++ b/browser/components/dirprovider/Makefile.in
@@ -50,7 +50,6 @@ DIRS = tests
 endif
 
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 # Because we are an application component, link against the CRT statically
 # (on Windows, but only if we're not building our own CRT for jemalloc)
diff --git a/browser/components/feeds/src/Makefile.in b/browser/components/feeds/src/Makefile.in
index 8d071eb769c0..9737cfdc5951 100644
--- a/browser/components/feeds/src/Makefile.in
+++ b/browser/components/feeds/src/Makefile.in
@@ -44,7 +44,6 @@ include $(DEPTH)/config/autoconf.mk
 MODULE = browser_feeds
 LIBRARY_NAME = browser_feeds_s
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 ifndef MOZ_MEMORY
 USE_STATIC_LIBS = 1
 endif
diff --git a/browser/components/migration/src/Makefile.in b/browser/components/migration/src/Makefile.in
index 751ba7a9b8c0..9f4dda94d15d 100644
--- a/browser/components/migration/src/Makefile.in
+++ b/browser/components/migration/src/Makefile.in
@@ -44,7 +44,6 @@ include $(DEPTH)/config/autoconf.mk
 MODULE		= migration
 LIBRARY_NAME	= migration_s
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 ifndef MOZ_MEMORY
 USE_STATIC_LIBS = 1
 endif
diff --git a/browser/components/places/content/controller.js b/browser/components/places/content/controller.js
index b07ea098c098..15f8fc0d48ba 100644
--- a/browser/components/places/content/controller.js
+++ b/browser/components/places/content/controller.js
@@ -309,10 +309,11 @@ PlacesController.prototype = {
                                        , hiddenRows: [ "description"
                                                      , "keyword"
                                                      , "location"
+                                                     , "folderPicker"
                                                      , "loadInSidebar" ]
                                        , uri: NetUtil.newURI(node.uri)
                                        , title: node.title
-                                       }, window.top, true);
+                                       }, window.top);
       break;
     }
   },
@@ -768,7 +769,7 @@ PlacesController.prototype = {
                                        , type: aType
                                        , defaultInsertionPoint: ip
                                        , hiddenRows: [ "folderPicker" ]
-                                       }, window);
+                                       }, window.top);
     if (performed) {
       // Select the new item.
       let insertedNodeId = PlacesUtils.bookmarks
diff --git a/browser/components/places/tests/browser/browser_library_middleclick.js b/browser/components/places/tests/browser/browser_library_middleclick.js
index 8e864830918a..5f47790ea99f 100644
--- a/browser/components/places/tests/browser/browser_library_middleclick.js
+++ b/browser/components/places/tests/browser/browser_library_middleclick.js
@@ -64,7 +64,8 @@ var gTabsListener = {
        "Tab has been opened in current browser window");
   },
 
-  onLocationChange: function(aBrowser, aWebProgress, aRequest, aLocationURI) {
+  onLocationChange: function(aBrowser, aWebProgress, aRequest, aLocationURI,
+                             aFlags) {
     var spec = aLocationURI.spec;
     ok(true, spec);
     // When a new tab is opened, location is first set to "about:blank", so
diff --git a/browser/components/places/tests/browser/browser_sidebarpanels_click.js b/browser/components/places/tests/browser/browser_sidebarpanels_click.js
index 32f58633e29e..7bcbba2d7f9a 100644
--- a/browser/components/places/tests/browser/browser_sidebarpanels_click.js
+++ b/browser/components/places/tests/browser/browser_sidebarpanels_click.js
@@ -40,6 +40,7 @@
 
 function test() {
   waitForExplicitFinish();
+  ignoreAllUncaughtExceptions();
 
   const BOOKMARKS_SIDEBAR_ID = "viewBookmarksSidebar";
   const BOOKMARKS_SIDEBAR_TREE_ID = "bookmarks-view";
diff --git a/browser/components/privatebrowsing/src/Makefile.in b/browser/components/privatebrowsing/src/Makefile.in
index 267deb63bb34..60116206c213 100644
--- a/browser/components/privatebrowsing/src/Makefile.in
+++ b/browser/components/privatebrowsing/src/Makefile.in
@@ -45,7 +45,6 @@ include $(DEPTH)/config/autoconf.mk
 MODULE = privatebrowsing
 LIBRARY_NAME = privatebrowsing_s
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 ifndef MOZ_MEMORY
 USE_STATIC_LIBS = 1
 endif
diff --git a/browser/components/safebrowsing/content/malware-warden.js b/browser/components/safebrowsing/content/malware-warden.js
index 61c6efaa4893..934f7b2524ad 100644
--- a/browser/components/safebrowsing/content/malware-warden.js
+++ b/browser/components/safebrowsing/content/malware-warden.js
@@ -57,14 +57,14 @@ function PROT_MalwareWarden() {
   this.prefs_.addObserver(kMalwareWardenEnabledPref, malwareWardenPrefObserver);
 
   // Add a test chunk to the database
-  var testData = "mozilla.com/firefox/its-an-attack.html";
+  var testData = "mozilla.org/firefox/its-an-attack.html";
 
   var testUpdate =
     "n:1000\ni:test-malware-simple\nad:1\n" +
     "a:1:32:" + testData.length + "\n" +
     testData;
     
-  testData = "mozilla.com/firefox/its-a-trap.html";
+  testData = "mozilla.org/firefox/its-a-trap.html";
   testUpdate +=
     "n:1000\ni:test-phish-simple\nad:1\n" +
     "a:1:32:" + testData.length + "\n" +
diff --git a/browser/components/safebrowsing/content/test/browser_bug400731.js b/browser/components/safebrowsing/content/test/browser_bug400731.js
index a62773a33b9f..ff6b11e18724 100644
--- a/browser/components/safebrowsing/content/test/browser_bug400731.js
+++ b/browser/components/safebrowsing/content/test/browser_bug400731.js
@@ -8,7 +8,7 @@ function test() {
   // Navigate to malware site.  Can't use an onload listener here since
   // error pages don't fire onload
   window.addEventListener("DOMContentLoaded", testMalware, true);
-  content.location = "http://www.mozilla.com/firefox/its-an-attack.html";
+  content.location = "http://www.mozilla.org/firefox/its-an-attack.html";
 }
 
 function testMalware() {
@@ -23,7 +23,7 @@ function testMalware() {
   
   // Now launch the phishing test
   window.addEventListener("DOMContentLoaded", testPhishing, true);
-  content.location = "http://www.mozilla.com/firefox/its-a-trap.html";
+  content.location = "http://www.mozilla.org/firefox/its-a-trap.html";
 }
 
 function testPhishing() {
diff --git a/browser/components/safebrowsing/content/test/browser_bug415846.js b/browser/components/safebrowsing/content/test/browser_bug415846.js
index 84f030987b45..1f75bd1a9fce 100644
--- a/browser/components/safebrowsing/content/test/browser_bug415846.js
+++ b/browser/components/safebrowsing/content/test/browser_bug415846.js
@@ -37,7 +37,7 @@ function testNormal_PopupListener() {
   
   // Now launch the phishing test.  Can't use onload here because error pages don't
   // fire normal load events.
-  content.location = "http://www.mozilla.com/firefox/its-a-trap.html";
+  content.location = "http://www.mozilla.org/firefox/its-a-trap.html";
   setTimeout(testPhishing, 2000);
 }
 
diff --git a/browser/components/sessionstore/src/nsSessionStore.js b/browser/components/sessionstore/src/nsSessionStore.js
index a1d9578aea37..7deda88583a2 100644
--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@@ -2305,7 +2305,7 @@ SessionStoreService.prototype = {
 
     if (aEntry.children) {
       aEntry.children.forEach(function(entry) {
-        this._extractHostsForCookies(entry, aHosts, aCheckPrivacy, aIsPinned);
+        this._extractHostsForCookiesFromEntry(entry, aHosts, aCheckPrivacy, aIsPinned);
       }, this);
     }
   },
diff --git a/browser/components/shell/public/nsIWindowsShellService.idl b/browser/components/shell/public/nsIWindowsShellService.idl
index cabb9544e949..0409cbfafab5 100644
--- a/browser/components/shell/public/nsIWindowsShellService.idl
+++ b/browser/components/shell/public/nsIWindowsShellService.idl
@@ -38,16 +38,9 @@
 
 #include "nsIShellService.idl"
 
-[scriptable, uuid(16e7e8da-8bef-4f41-be5f-045b2e9918e1)]
+[scriptable, uuid(89b0a761-d9a0-4c39-ab83-d81566459a31)]
 interface nsIWindowsShellService : nsIShellService
 {
-    /** 
-     * The number of unread mail messages for the current user.
-     * 
-     * @return The number of unread (new) mail messages for the current user.
-     */
-    readonly attribute unsigned long unreadMailCount;
-
     /**
      * Provides the shell service an opportunity to do some Win7+ shortcut
      * maintenance needed on initial startup of the browser.
diff --git a/browser/components/shell/src/Makefile.in b/browser/components/shell/src/Makefile.in
index c9004a3dc3c2..0f1be090d6c5 100644
--- a/browser/components/shell/src/Makefile.in
+++ b/browser/components/shell/src/Makefile.in
@@ -44,7 +44,6 @@ include $(DEPTH)/config/autoconf.mk
 
 MODULE = shellservice
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 ifndef MOZ_MEMORY
 USE_STATIC_LIBS = 1
 endif
diff --git a/browser/components/shell/src/nsMacShellService.cpp b/browser/components/shell/src/nsMacShellService.cpp
index ad1297556868..6d4ca5ab8fd2 100644
--- a/browser/components/shell/src/nsMacShellService.cpp
+++ b/browser/components/shell/src/nsMacShellService.cpp
@@ -235,7 +235,8 @@ nsMacShellService::OnProgressChange(nsIWebProgress* aWebProgress,
 NS_IMETHODIMP
 nsMacShellService::OnLocationChange(nsIWebProgress* aWebProgress,
                                     nsIRequest* aRequest,
-                                    nsIURI* aLocation)
+                                    nsIURI* aLocation,
+                                    PRUint32 aFlags)
 {
   return NS_OK;
 }
diff --git a/browser/components/shell/src/nsWindowsShellService.cpp b/browser/components/shell/src/nsWindowsShellService.cpp
index 0a1a94f86dea..d7065446b4ff 100644
--- a/browser/components/shell/src/nsWindowsShellService.cpp
+++ b/browser/components/shell/src/nsWindowsShellService.cpp
@@ -803,66 +803,6 @@ nsWindowsShellService::SetDesktopBackgroundColor(PRUint32 aColor)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsWindowsShellService::GetUnreadMailCount(PRUint32* aCount)
-{
-  *aCount = 0;
-
-  HKEY accountKey;
-  if (GetMailAccountKey(&accountKey)) {
-    DWORD type, unreadCount;
-    DWORD len = sizeof unreadCount;
-    DWORD res = ::RegQueryValueExW(accountKey, L"MessageCount", 0,
-                                   &type, (LPBYTE)&unreadCount, &len);
-    if (REG_SUCCEEDED(res))
-      *aCount = unreadCount;
-
-    // Close the key we opened.
-    ::RegCloseKey(accountKey);
-  }
-
-  return NS_OK;
-}
-
-bool
-nsWindowsShellService::GetMailAccountKey(HKEY* aResult)
-{
-  NS_NAMED_LITERAL_STRING(unread,
-    "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UnreadMail\\");
-
-  HKEY mailKey;
-  DWORD res = ::RegOpenKeyExW(HKEY_CURRENT_USER, unread.get(), 0,
-                              KEY_ENUMERATE_SUB_KEYS, &mailKey);
-
-  PRInt32 i = 0;
-  do {
-    PRUnichar subkeyName[MAX_BUF];
-    DWORD len = sizeof subkeyName;
-    res = ::RegEnumKeyExW(mailKey, i++, subkeyName, &len, NULL, NULL,
-                          NULL, NULL);
-    if (REG_SUCCEEDED(res)) {
-      HKEY accountKey;
-      res = ::RegOpenKeyExW(mailKey, PromiseFlatString(subkeyName).get(),
-                            0, KEY_READ, &accountKey);
-      if (REG_SUCCEEDED(res)) {
-        *aResult = accountKey;
-    
-        // Close the key we opened.
-        ::RegCloseKey(mailKey);
-	 
-        return true;
-      }
-    }
-    else
-      break;
-  }
-  while (1);
-
-  // Close the key we opened.
-  ::RegCloseKey(mailKey);
-  return false;
-}
-
 NS_IMETHODIMP
 nsWindowsShellService::OpenApplicationWithURI(nsILocalFile* aApplication,
                                               const nsACString& aURI)
diff --git a/browser/components/shell/src/nsWindowsShellService.h b/browser/components/shell/src/nsWindowsShellService.h
index a62a9ad7fa56..8a50bce37780 100644
--- a/browser/components/shell/src/nsWindowsShellService.h
+++ b/browser/components/shell/src/nsWindowsShellService.h
@@ -59,8 +59,6 @@ public:
 protected:
   bool      IsDefaultBrowserVista(bool* aIsDefaultBrowser);
 
-  bool      GetMailAccountKey(HKEY* aResult);
-
 private:
   bool      mCheckedThisSession;
 };
diff --git a/browser/components/sidebar/src/nsSidebar.js b/browser/components/sidebar/src/nsSidebar.js
index 4cd31b2ba212..e18ed305b993 100644
--- a/browser/components/sidebar/src/nsSidebar.js
+++ b/browser/components/sidebar/src/nsSidebar.js
@@ -111,11 +111,12 @@ function (aTitle, aContentURL, aCustomizeURL, aPersist)
                                          , hiddenRows: [ "description"
                                                        , "keyword"
                                                        , "location"
+                                                       , "folderPicker"
                                                        , "loadInSidebar" ]
                                          , uri: uri
                                          , title: aTitle
                                          , loadBookmarkInSidebar: true
-                                         }, win, true);
+                                         }, win);
 }
 
 nsSidebar.prototype.validateSearchEngine =
diff --git a/browser/config/mozconfigs/win32/vs2010-mozconfig b/browser/config/mozconfigs/win32/vs2010-mozconfig
new file mode 100644
index 000000000000..8739895a1ba2
--- /dev/null
+++ b/browser/config/mozconfigs/win32/vs2010-mozconfig
@@ -0,0 +1,12 @@
+export INCLUDE=/d/msvs10/vc/include:/d/msvs10/vc/atlmfc/include:/d/sdks/v7.0/include:/d/sdks/v7.0/include/atl:/d/msvs8/VC/PlatformSDK/include:/d/sdks/dx10/include
+export LIBPATH=/d/msvs10/vc/lib:/d/msvs10/vc/atlmfc/lib:/c/WINDOWS/Microsoft.NET/Framework/v2.0.50727
+export LIB=/d/msvs10/vc/lib:/d/msvs10/vc/atlmfc/lib:/d/sdks/v7.0/lib:/d/msvs8/VC/PlatformSDK/lib:/d/msvs8/SDK/v2.0/lib:/d/mozilla-build/atlthunk_compat:/d/sdks/dx10/lib/x86
+export PATH="/d/msvs10/VSTSDB/Deploy:/d/msvs10/Common7/IDE/:/d/msvs10/VC/BIN:/d/msvs10/Common7/Tools:/d/msvs10/VC/VCPackages:${PATH}"
+export WIN32_REDIST_DIR=/d/msvs10/VC/redist/x86/Microsoft.VC100.CRT
+
+
+mk_add_options "export LIB=$LIB"
+mk_add_options "export LIBPATH=$LIBPATH"
+mk_add_options "export PATH=$PATH"
+mk_add_options "export INCLUDE=$INCLUDE"
+mk_add_options "export WIN32_REDIST_DIR=$WIN32_REDIST_DIR"
diff --git a/browser/devtools/highlighter/test/browser_inspector_breadcrumbs.js b/browser/devtools/highlighter/test/browser_inspector_breadcrumbs.js
index d8d5c34fd27b..cc4cff8c53bb 100644
--- a/browser/devtools/highlighter/test/browser_inspector_breadcrumbs.js
+++ b/browser/devtools/highlighter/test/browser_inspector_breadcrumbs.js
@@ -4,6 +4,7 @@
 function test()
 {
   waitForExplicitFinish();
+  ignoreAllUncaughtExceptions();
 
   let nodes = [
     {nodeId: "i1111", result: "i1 i11 i111 i1111"},
diff --git a/browser/installer/removed-files.in b/browser/installer/removed-files.in
index 94b17bc16d4f..238b8a51e33f 100644
--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@@ -684,6 +684,7 @@ uninstall/uninst.exe
 uninstall/uninstall.exe
 xpicleanup@BIN_SUFFIX@
 #ifdef MOZ_OMNIJAR
+  omni.jar
   chrome/af.jar
   chrome/af.manifest
   chrome/ar.jar
@@ -1087,6 +1088,7 @@ xpicleanup@BIN_SUFFIX@
 #else
   components/binary.manifest
   omni.jar
+  omni.ja
 #endif
 #ifdef XP_MACOSX
   ../Plug-Ins/PrintPDE.plugin/Contents/Info.plist
diff --git a/build/Makefile.in b/build/Makefile.in
index 0c056e70e418..6642ba80e405 100644
--- a/build/Makefile.in
+++ b/build/Makefile.in
@@ -56,7 +56,7 @@ endif
 DIRS += pgo
 
 ifdef ENABLE_TESTS
-ifeq (Android,$(OS_TARGET))
+ifeq (android,$(MOZ_WIDGET_TOOLKIT))
   DIRS += mobile/sutagent/android \
           mobile/sutagent/android/watcher \
           mobile/sutagent/android/ffxcp \
diff --git a/build/automation.py.in b/build/automation.py.in
index ce30cd9a644e..fdd8e8c896e8 100644
--- a/build/automation.py.in
+++ b/build/automation.py.in
@@ -52,7 +52,6 @@ import sys
 import threading
 import tempfile
 import sqlite3
-import zipfile
 
 SCRIPT_DIR = os.path.abspath(os.path.realpath(os.path.dirname(sys.argv[0])))
 sys.path.insert(0, SCRIPT_DIR)
@@ -98,69 +97,6 @@ _log.setLevel(logging.INFO)
 _log.addHandler(handler)
 
 
-class ZipFileReader(object):
-  """
-  Class to read zip files in Python 2.5 and later. Limited to only what we
-  actually use.
-  """
-
-  def __init__(self, filename):
-    self._zipfile = zipfile.ZipFile(filename, "r")
-
-  def __del__(self):
-    self._zipfile.close()
-
-  def _getnormalizedpath(self, path):
-    """
-    Gets a normalized path from 'path' (or the current working directory if
-    'path' is None). Also asserts that the path exists.
-    """
-    if path is None:
-      path = os.curdir
-    path = os.path.normpath(os.path.expanduser(path))
-    assert os.path.isdir(path)
-    return path
-
-  def _extractname(self, name, path):
-    """
-    Extracts a file with the given name from the zip file to the given path.
-    Also creates any directories needed along the way.
-    """
-    filename = os.path.normpath(os.path.join(path, name))
-    if name.endswith("/"):
-      os.makedirs(filename)
-    else:
-      path = os.path.split(filename)[0]
-      if not os.path.isdir(path):
-        os.makedirs(path)
-      with open(filename, "wb") as dest:
-        dest.write(self._zipfile.read(name))
-
-  def namelist(self):
-    return self._zipfile.namelist()
-
-  def read(self, name):
-    return self._zipfile.read(name)
-
-  def extract(self, name, path = None):
-    if hasattr(self._zipfile, "extract"):
-      return self._zipfile.extract(name, path)
-
-    # This will throw if name is not part of the zip file.
-    self._zipfile.getinfo(name)
-
-    self._extractname(name, self._getnormalizedpath(path))
-
-  def extractall(self, path = None):
-    if hasattr(self._zipfile, "extractall"):
-      return self._zipfile.extractall(path)
-
-    path = self._getnormalizedpath(path)
-
-    for name in self._zipfile.namelist():
-      self._extractname(name, path)
-
-
 #################
 # PROFILE SETUP #
 #################
@@ -418,6 +354,7 @@ user_pref("javascript.options.showInConsole", true);
 user_pref("devtools.errorconsole.enabled", true);
 user_pref("layout.debug.enable_data_xbl", true);
 user_pref("browser.EULA.override", true);
+user_pref("javascript.options.jit_hardening", true);
 user_pref("gfx.color_management.force_srgb", true);
 user_pref("network.manage-offline-status", false);
 user_pref("test.mousescroll", true);
@@ -1052,7 +989,7 @@ user_pref("camino.use_system_proxy_settings", false); // Camino-only, harmless t
       os.makedirs(extensionsRootDir)
 
     if os.path.isfile(extensionSource):
-      reader = ZipFileReader(extensionSource)
+      reader = automationutils.ZipFileReader(extensionSource)
 
       for filename in reader.namelist():
         # Sanity check the zip file.
diff --git a/build/automationutils.py b/build/automationutils.py
index 3f52516af8d3..7506e3e8fe09 100644
--- a/build/automationutils.py
+++ b/build/automationutils.py
@@ -36,11 +36,13 @@
 #
 # ***** END LICENSE BLOCK ***** */
 
-import glob, logging, os, platform, shutil, subprocess, sys
+from __future__ import with_statement
+import glob, logging, os, platform, shutil, subprocess, sys, tempfile, urllib2, zipfile
 import re
 from urlparse import urlparse
 
 __all__ = [
+  "ZipFileReader",
   "addCommonOptions",
   "checkForCrashes",
   "dumpLeakLog",
@@ -70,6 +72,68 @@ DEBUGGER_INFO = {
   }
 }
 
+class ZipFileReader(object):
+  """
+  Class to read zip files in Python 2.5 and later. Limited to only what we
+  actually use.
+  """
+
+  def __init__(self, filename):
+    self._zipfile = zipfile.ZipFile(filename, "r")
+
+  def __del__(self):
+    self._zipfile.close()
+
+  def _getnormalizedpath(self, path):
+    """
+    Gets a normalized path from 'path' (or the current working directory if
+    'path' is None). Also asserts that the path exists.
+    """
+    if path is None:
+      path = os.curdir
+    path = os.path.normpath(os.path.expanduser(path))
+    assert os.path.isdir(path)
+    return path
+
+  def _extractname(self, name, path):
+    """
+    Extracts a file with the given name from the zip file to the given path.
+    Also creates any directories needed along the way.
+    """
+    filename = os.path.normpath(os.path.join(path, name))
+    if name.endswith("/"):
+      os.makedirs(filename)
+    else:
+      path = os.path.split(filename)[0]
+      if not os.path.isdir(path):
+        os.makedirs(path)
+      with open(filename, "wb") as dest:
+        dest.write(self._zipfile.read(name))
+
+  def namelist(self):
+    return self._zipfile.namelist()
+
+  def read(self, name):
+    return self._zipfile.read(name)
+
+  def extract(self, name, path = None):
+    if hasattr(self._zipfile, "extract"):
+      return self._zipfile.extract(name, path)
+
+    # This will throw if name is not part of the zip file.
+    self._zipfile.getinfo(name)
+
+    self._extractname(name, self._getnormalizedpath(path))
+
+  def extractall(self, path = None):
+    if hasattr(self._zipfile, "extractall"):
+      return self._zipfile.extractall(path)
+
+    path = self._getnormalizedpath(path)
+
+    for name in self._zipfile.namelist():
+      self._extractname(name, path)
+
 log = logging.getLogger()
 
 def isURL(thing):
@@ -102,7 +166,6 @@ def addCommonOptions(parser, defaults={}):
 
 def checkForCrashes(dumpDir, symbolsPath, testName=None):
   stackwalkPath = os.environ.get('MINIDUMP_STACKWALK', None)
-  stackwalkCGI = os.environ.get('MINIDUMP_STACKWALK_CGI', None)
   # try to get the caller's filename if no test name is given
   if testName is None:
     try:
@@ -110,70 +173,70 @@ def checkForCrashes(dumpDir, symbolsPath, testName=None):
     except:
       testName = "unknown"
 
-  foundCrash = False
+  # Check preconditions
   dumps = glob.glob(os.path.join(dumpDir, '*.dmp'))
-  for d in dumps:
-    log.info("PROCESS-CRASH | %s | application crashed (minidump found)", testName)
-    print "Crash dump filename: " + d
-    if symbolsPath and stackwalkPath and os.path.exists(stackwalkPath):
-      p = subprocess.Popen([stackwalkPath, d, symbolsPath],
-                           stdout=subprocess.PIPE,
-                           stderr=subprocess.PIPE)
-      (out, err) = p.communicate()
-      if len(out) > 3:
-        # minidump_stackwalk is chatty, so ignore stderr when it succeeds.
-        print out
-      else:
-        print "stderr from minidump_stackwalk:"
-        print err
-      if p.returncode != 0:
-        print "minidump_stackwalk exited with return code %d" % p.returncode
-    elif stackwalkCGI and symbolsPath and isURL(symbolsPath):
-      f = None
-      try:
-        f = open(d, "rb")
-        sys.path.append(os.path.join(os.path.dirname(__file__), "poster.zip"))
-        from poster.encode import multipart_encode
-        from poster.streaminghttp import register_openers
-        import urllib2
-        register_openers()
-        datagen, headers = multipart_encode({"minidump": f,
-                                             "symbols": symbolsPath})
-        request = urllib2.Request(stackwalkCGI, datagen, headers)
-        result = urllib2.urlopen(request).read()
-        if len(result) > 3:
-          print result
+  if len(dumps) == 0:
+    return False
+
+  foundCrash = False
+  removeSymbolsPath = False
+
+  # If our symbols are at a remote URL, download them now
+  if isURL(symbolsPath):
+    print "Downloading symbols from: " + symbolsPath
+    removeSymbolsPath = True
+    # Get the symbols and write them to a temporary zipfile
+    data = urllib2.urlopen(symbolsPath)
+    symbolsFile = tempfile.TemporaryFile()
+    symbolsFile.write(data.read())
+    # extract symbols to a temporary directory (which we'll delete after
+    # processing all crashes)
+    symbolsPath = tempfile.mkdtemp()
+    zfile = ZipFileReader(symbolsFile)
+    zfile.extractall(symbolsPath)
+
+  try:
+    for d in dumps:
+      log.info("PROCESS-CRASH | %s | application crashed (minidump found)", testName)
+      print "Crash dump filename: " + d
+      if symbolsPath and stackwalkPath and os.path.exists(stackwalkPath):
+        # run minidump stackwalk
+        p = subprocess.Popen([stackwalkPath, d, symbolsPath],
+                             stdout=subprocess.PIPE,
+                             stderr=subprocess.PIPE)
+        (out, err) = p.communicate()
+        if len(out) > 3:
+          # minidump_stackwalk is chatty, so ignore stderr when it succeeds.
+          print out
         else:
-          print "stackwalkCGI returned nothing."
-      finally:
-        if f:
-          f.close()
-    else:
-      if not symbolsPath:
-        print "No symbols path given, can't process dump."
-      if not stackwalkPath and not stackwalkCGI:
-        print "Neither MINIDUMP_STACKWALK nor MINIDUMP_STACKWALK_CGI is set, can't process dump."
+          print "stderr from minidump_stackwalk:"
+          print err
+        if p.returncode != 0:
+          print "minidump_stackwalk exited with return code %d" % p.returncode
       else:
-        if stackwalkPath and not os.path.exists(stackwalkPath):
+        if not symbolsPath:
+          print "No symbols path given, can't process dump."
+        if not stackwalkPath:
+          print "MINIDUMP_STACKWALK not set, can't process dump."
+        elif stackwalkPath and not os.path.exists(stackwalkPath):
           print "MINIDUMP_STACKWALK binary not found: %s" % stackwalkPath
-        elif stackwalkCGI and not isURL(stackwalkCGI):
-          print "MINIDUMP_STACKWALK_CGI is not a URL: %s" % stackwalkCGI
-        elif symbolsPath and not isURL(symbolsPath):
-          print "symbolsPath is not a URL: %s" % symbolsPath
-    dumpSavePath = os.environ.get('MINIDUMP_SAVE_PATH', None)
-    if dumpSavePath:
-      shutil.move(d, dumpSavePath)
-      print "Saved dump as %s" % os.path.join(dumpSavePath,
-                                              os.path.basename(d))
-    else:
-      os.remove(d)
-    extra = os.path.splitext(d)[0] + ".extra"
-    if os.path.exists(extra):
-      os.remove(extra)
-    foundCrash = True
+      dumpSavePath = os.environ.get('MINIDUMP_SAVE_PATH', None)
+      if dumpSavePath:
+        shutil.move(d, dumpSavePath)
+        print "Saved dump as %s" % os.path.join(dumpSavePath,
+                                                os.path.basename(d))
+      else:
+        os.remove(d)
+      extra = os.path.splitext(d)[0] + ".extra"
+      if os.path.exists(extra):
+        os.remove(extra)
+      foundCrash = True
+  finally:
+    if removeSymbolsPath:
+      shutil.rmtree(symbolsPath)
 
   return foundCrash
-  
+
 def getFullPath(directory, path):
   "Get an absolute path relative to 'directory'."
   return os.path.normpath(os.path.join(directory, os.path.expanduser(path)))
diff --git a/build/mobile/devicemanagerADB.py b/build/mobile/devicemanagerADB.py
index 5b9b6f958e87..ab96f75adba8 100644
--- a/build/mobile/devicemanagerADB.py
+++ b/build/mobile/devicemanagerADB.py
@@ -256,11 +256,11 @@ class DeviceManagerADB(DeviceManager):
   #  failure: None
   def killProcess(self, appname):
     procs = self.getProcessList()
-    for proc in procs:
-      if (proc[1] == appname):
-        p = self.runCmd(["shell", "ps"])
+    for (pid, name, user) in procs:
+      if name == appname:
+        p = self.runCmdAs(["shell", "kill", pid])
         return p.stdout.read()
-      return None
+    return None
 
   # external function
   # returns:
@@ -506,6 +506,12 @@ class DeviceManagerADB(DeviceManager):
     args.insert(0, "adb")
     return subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 
+  def runCmdAs(self, args):
+    if self.useRunAs:
+      args.insert(1, "run-as")
+      args.insert(2, self.packageName)
+    return self.runCmd(args)
+
   def checkCmd(self, args):
     args.insert(0, "adb")
     return subprocess.check_call(args)
diff --git a/build/pgo/server-locations.txt b/build/pgo/server-locations.txt
index 5e8a9bcd8066..07da845042fb 100644
--- a/build/pgo/server-locations.txt
+++ b/build/pgo/server-locations.txt
@@ -135,7 +135,7 @@ http://fxfeeds.mozilla.com:80
 
 # Prevent safebrowsing tests from hitting the network for its-a-trap.html and
 # its-an-attack.html.
-http://www.mozilla.com:80
+http://www.mozilla.org:80
 
 #
 # These are subdomains of <ält.example.org>.
diff --git a/build/poster.zip b/build/poster.zip
deleted file mode 100644
index 122b4acd4698..000000000000
Binary files a/build/poster.zip and /dev/null differ
diff --git a/chrome/src/Makefile.in b/chrome/src/Makefile.in
index cba35fae7f2f..8a71582190e7 100644
--- a/chrome/src/Makefile.in
+++ b/chrome/src/Makefile.in
@@ -46,7 +46,6 @@ MODULE          = chrome
 LIBRARY_NAME    = chrome_s
 LIBXUL_LIBRARY  = 1
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 EXPORTS_NAMESPACES = mozilla/chrome
 
diff --git a/config/autoconf.mk.in b/config/autoconf.mk.in
index e9ffb9de508d..555cfd323a6f 100644
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -84,6 +84,7 @@ XULRUNNER_STUB_NAME = @XULRUNNER_STUB_NAME@
 
 MOZ_CHROME_FILE_FORMAT	= @MOZ_CHROME_FILE_FORMAT@
 MOZ_OMNIJAR		= @MOZ_OMNIJAR@
+OMNIJAR_NAME		= @OMNIJAR_NAME@
 
 MOZ_WIDGET_TOOLKIT	= @MOZ_WIDGET_TOOLKIT@
 MOZ_GFX_OPTIMIZE_MOBILE = @MOZ_GFX_OPTIMIZE_MOBILE@
@@ -139,6 +140,7 @@ MOZ_UPDATE_PACKAGING	= @MOZ_UPDATE_PACKAGING@
 MOZ_DISABLE_PARENTAL_CONTROLS = @MOZ_DISABLE_PARENTAL_CONTROLS@
 NS_ENABLE_TSF = @NS_ENABLE_TSF@
 MOZ_SPELLCHECK = @MOZ_SPELLCHECK@
+MOZ_JAVA_COMPOSITOR = @MOZ_JAVA_COMPOSITOR@
 MOZ_PROFILELOCKING = @MOZ_PROFILELOCKING@
 MOZ_FEEDS = @MOZ_FEEDS@
 MOZ_TOOLKIT_SEARCH = @MOZ_TOOLKIT_SEARCH@
diff --git a/configure.in b/configure.in
index 6cbc29845fec..9c5ec874090f 100644
--- a/configure.in
+++ b/configure.in
@@ -289,6 +289,56 @@ arm-android-eabi)
     ;;
 esac
 
+MOZ_ARG_WITH_STRING(gonk,
+[  --with-gonk=DIR
+               location of gonk dir],
+    gonkdir=$withval)
+
+if test -n "$gonkdir" ; then
+    kernel_name=`uname -s | tr "[[:upper:]]" "[[:lower:]]"`
+    gonk_toolchain="$gonkdir"/prebuilt/$kernel_name-x86/toolchain/arm-eabi-4.4.3
+
+    dnl set up compilers
+    AS="$gonk_toolchain"/bin/"$android_tool_prefix"-as
+    CC="$gonk_toolchain"/bin/"$android_tool_prefix"-gcc
+    CXX="$gonk_toolchain"/bin/"$android_tool_prefix"-g++
+    CPP="$gonk_toolchain"/bin/"$android_tool_prefix"-cpp
+    LD="$gonk_toolchain"/bin/"$android_tool_prefix"-ld
+    AR="$gonk_toolchain"/bin/"$android_tool_prefix"-ar
+    RANLIB="$gonk_toolchain"/bin/"$android_tool_prefix"-ranlib
+    STRIP="$gonk_toolchain"/bin/"$android_tool_prefix"-strip
+
+    STLPORT_CPPFLAGS="-I$gonkdir/ndk/sources/cxx-stl/stlport/stlport/"
+    STLPORT_LIBS="-lstlport"
+
+    CPPFLAGS="-DANDROID -I$gonkdir/bionic/libc/include/ -I$gonkdir/bionic/libc/kernel/common -I$gonkdir/bionic/libc/arch-arm/include -I$gonkdir/bionic/libc/kernel/arch-arm -I$gonkdir/bionic/libm/include -I$gonkdir/frameworks/base/opengl/include -I$gonkdir/frameworks/base/native/include -I$gonkdir/hardware/libhardware/include -I$gonkdir/system/core/include -I$gonkdir/bionic -I$gonkdir/frameworks/base/include $STLPORT_CPPFLAGS $CPPFLAGS"
+    CFLAGS="-mandroid -fno-short-enums -fno-exceptions $CFLAGS"
+    CXXFLAGS="-mandroid -fno-short-enums -fno-exceptions $CXXFLAGS"
+    LIBS="$LIBS $STLPORT_LIBS"
+
+    dnl Add -llog by default, since we use it all over the place.
+    LDFLAGS="-mandroid -L$gonkdir/out/target/product/$GONK_PRODUCT/obj/lib -Wl,-rpath-link=$gonkdir/out/target/product/$GONK_PRODUCT/obj/lib --sysroot=$gonkdir/out/target/product/$GONK_PRODUCT/obj/ -llog $LDFLAGS"
+
+    dnl prevent cross compile section from using these flags as host flags
+    if test -z "$HOST_CPPFLAGS" ; then
+        HOST_CPPFLAGS=" "
+    fi
+    if test -z "$HOST_CFLAGS" ; then
+        HOST_CFLAGS=" "
+    fi
+    if test -z "$HOST_CXXFLAGS" ; then
+        HOST_CXXFLAGS=" "
+    fi
+    if test -z "$HOST_LDFLAGS" ; then
+        HOST_LDFLAGS=" "
+    fi
+
+    AC_DEFINE(ANDROID)
+    CROSS_COMPILE=1
+    MOZ_CHROME_FILE_FORMAT=omni
+    ZLIB_DIR=yes
+    direct_nspr_config=1
+else
 case "$target" in
 *-android*|*-linuxandroid*)
     if test -z "$android_ndk" ; then
@@ -419,6 +469,8 @@ case "$target" in
     ;;
 esac
 
+fi
+
 AC_SUBST(ANDROID_NDK)
 AC_SUBST(ANDROID_TOOLCHAIN)
 AC_SUBST(ANDROID_PLATFORM)
@@ -1325,8 +1377,6 @@ fi
 # but that breaks when you have a 64 bit kernel with a 32 bit userland.
 OS_TEST="${target_cpu}"
 
-_COMPILER_PREFIX=
-
 HOST_OS_ARCH=`echo $host_os | sed -e 's|/|_|g'`
 
 #######################################################################
@@ -1708,6 +1758,48 @@ fi # CPU_ARCH = arm
 AC_SUBST(HAVE_ARM_SIMD)
 AC_SUBST(HAVE_ARM_NEON)
 
+dnl =================================================================
+dnl Set up and test static assertion macros used to avoid AC_TRY_RUN,
+dnl which is bad when cross compiling.
+dnl =================================================================
+if test "$COMPILE_ENVIRONMENT"; then
+configure_static_assert_macros='
+#define CONFIGURE_STATIC_ASSERT(condition) CONFIGURE_STATIC_ASSERT_IMPL(condition, __LINE__)
+#define CONFIGURE_STATIC_ASSERT_IMPL(condition, line) CONFIGURE_STATIC_ASSERT_IMPL2(condition, line)
+#define CONFIGURE_STATIC_ASSERT_IMPL2(condition, line) typedef int static_assert_line_##line[(condition) ? 1 : -1]
+'
+
+dnl test that the macros actually work:
+AC_MSG_CHECKING(that static assertion macros used in autoconf tests work)
+AC_CACHE_VAL(ac_cv_static_assertion_macros_work,
+ [AC_LANG_SAVE
+  AC_LANG_C
+  ac_cv_static_assertion_macros_work="yes"
+  AC_TRY_COMPILE([$configure_static_assert_macros],
+                 [CONFIGURE_STATIC_ASSERT(1)],
+                 ,
+                 ac_cv_static_assertion_macros_work="no")
+  AC_TRY_COMPILE([$configure_static_assert_macros],
+                 [CONFIGURE_STATIC_ASSERT(0)],
+                 ac_cv_static_assertion_macros_work="no",
+                 )
+  AC_LANG_CPLUSPLUS
+  AC_TRY_COMPILE([$configure_static_assert_macros],
+                 [CONFIGURE_STATIC_ASSERT(1)],
+                 ,
+                 ac_cv_static_assertion_macros_work="no")
+  AC_TRY_COMPILE([$configure_static_assert_macros],
+                 [CONFIGURE_STATIC_ASSERT(0)],
+                 ac_cv_static_assertion_macros_work="no",
+                 )
+  AC_LANG_RESTORE
+ ])
+AC_MSG_RESULT("$ac_cv_static_assertion_macros_work")
+if test "$ac_cv_static_assertion_macros_work" = "no"; then
+    AC_MSG_ERROR([Compiler cannot compile macros used in autoconf tests.])
+fi
+fi # COMPILE_ENVIRONMENT
+
 dnl ========================================================
 dnl Android libstdc++, placed here so it can use MOZ_ARCH
 dnl computed above.
@@ -1767,8 +1859,8 @@ if test "$GNU_CC"; then
     DSO_CFLAGS=''
     DSO_PIC_CFLAGS='-fPIC'
     ASFLAGS="$ASFLAGS -fPIC"
-    _MOZ_RTTI_FLAGS_ON=${_COMPILER_PREFIX}-frtti
-    _MOZ_RTTI_FLAGS_OFF=${_COMPILER_PREFIX}-fno-rtti
+    _MOZ_RTTI_FLAGS_ON=-frtti
+    _MOZ_RTTI_FLAGS_OFF=-fno-rtti
 
     # Turn on GNU specific features
     # -Wall - turn on all warnings
@@ -1844,13 +1936,44 @@ if test "$GNU_CXX"; then
     _DEFINES_CXXFLAGS='-DMOZILLA_CLIENT -include $(DEPTH)/mozilla-config.h'
     _USE_CPP_INCLUDE_FLAG=1
 
+    # Recent clang and gcc support C++11 deleted functions without warnings if
+    # compiling with -std=c++0x or -std=gnu++0x (or c++11 or gnu++11 in very new
+    # versions).  We can't use -std=c++0x yet, so gcc's support must remain
+    # unused.  But clang's warning can be disabled, so when compiling with clang
+    # we use it to opt out of the warning, enabling (macro-encapsulated) use of
+    # deleted function syntax.
+    if test "$CLANG_CXX"; then
+        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-c++0x-extensions"
+    fi
+
+    AC_CACHE_CHECK(whether the compiler supports -Wno-extended-offsetof,
+                   ac_has_wno_extended_offsetof,
+        [
+            AC_LANG_SAVE
+            AC_LANG_CPLUSPLUS
+            _SAVE_CXXFLAGS="$CXXFLAGS"
+            CXXFLAGS="$CXXFLAGS -Wno-extended-offsetof"
+            AC_TRY_COMPILE([$configure_static_assert_macros
+                            #ifndef __has_warning
+                            #define __has_warning(x) 0
+                            #endif],
+                           [CONFIGURE_STATIC_ASSERT(__has_warning("-Wextended-offsetof"))],
+                           ac_has_wno_extended_offsetof="yes",
+                           ac_has_wno_extended_offsetof="no")
+            CXXFLAGS="$_SAVE_CXXFLAGS"
+            AC_LANG_RESTORE
+        ])
+    if test "$ac_has_wno_extended_offsetof" = "yes"; then
+        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-extended-offsetof"
+    fi
+
     AC_CACHE_CHECK(whether the compiler supports -Wno-invalid-offsetof,
                    ac_has_wno_invalid_offsetof,
         [
             AC_LANG_SAVE
             AC_LANG_CPLUSPLUS
             _SAVE_CXXFLAGS="$CXXFLAGS"
-            CXXFLAGS="$CXXFLAGS ${_COMPILER_PREFIX}-Wno-invalid-offsetof"
+            CXXFLAGS="$CXXFLAGS -Wno-invalid-offsetof"
             AC_TRY_COMPILE([],
                            [return(0);],
                            ac_has_wno_invalid_offsetof="yes",
@@ -1859,7 +1982,7 @@ if test "$GNU_CXX"; then
             AC_LANG_RESTORE
         ])
     if test "$ac_has_wno_invalid_offsetof" = "yes"; then
-        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} ${_COMPILER_PREFIX}-Wno-invalid-offsetof"
+        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-invalid-offsetof"
     fi
 
     AC_CACHE_CHECK(whether the compiler supports -Wno-variadic-macros,
@@ -1868,7 +1991,7 @@ if test "$GNU_CXX"; then
             AC_LANG_SAVE
             AC_LANG_CPLUSPLUS
             _SAVE_CXXFLAGS="$CXXFLAGS"
-            CXXFLAGS="$CXXFLAGS ${_COMPILER_PREFIX}-Wno-variadic-macros"
+            CXXFLAGS="$CXXFLAGS -Wno-variadic-macros"
             AC_TRY_COMPILE([],
                            [return(0);],
                            ac_has_wno_variadic_macros="yes",
@@ -1877,7 +2000,7 @@ if test "$GNU_CXX"; then
             AC_LANG_RESTORE
         ])
     if test "$ac_has_wno_variadic_macros" = "yes"; then
-        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} ${_COMPILER_PREFIX}-Wno-variadic-macros"
+        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-variadic-macros"
     fi
 
     AC_CACHE_CHECK(whether the compiler supports -Werror=return-type,
@@ -1942,48 +2065,6 @@ LOOP_INPUT
 fi # GNU_CC
 fi # COMPILE_ENVIRONMENT
 
-dnl =================================================================
-dnl Set up and test static assertion macros used to avoid AC_TRY_RUN,
-dnl which is bad when cross compiling.
-dnl =================================================================
-if test "$COMPILE_ENVIRONMENT"; then
-configure_static_assert_macros='
-#define CONFIGURE_STATIC_ASSERT(condition) CONFIGURE_STATIC_ASSERT_IMPL(condition, __LINE__)
-#define CONFIGURE_STATIC_ASSERT_IMPL(condition, line) CONFIGURE_STATIC_ASSERT_IMPL2(condition, line)
-#define CONFIGURE_STATIC_ASSERT_IMPL2(condition, line) typedef int static_assert_line_##line[(condition) ? 1 : -1]
-'
-
-dnl test that the macros actually work:
-AC_MSG_CHECKING(that static assertion macros used in autoconf tests work)
-AC_CACHE_VAL(ac_cv_static_assertion_macros_work,
- [AC_LANG_SAVE
-  AC_LANG_C
-  ac_cv_static_assertion_macros_work="yes"
-  AC_TRY_COMPILE([$configure_static_assert_macros],
-                 [CONFIGURE_STATIC_ASSERT(1)],
-                 ,
-                 ac_cv_static_assertion_macros_work="no")
-  AC_TRY_COMPILE([$configure_static_assert_macros],
-                 [CONFIGURE_STATIC_ASSERT(0)],
-                 ac_cv_static_assertion_macros_work="no",
-                 )
-  AC_LANG_CPLUSPLUS
-  AC_TRY_COMPILE([$configure_static_assert_macros],
-                 [CONFIGURE_STATIC_ASSERT(1)],
-                 ,
-                 ac_cv_static_assertion_macros_work="no")
-  AC_TRY_COMPILE([$configure_static_assert_macros],
-                 [CONFIGURE_STATIC_ASSERT(0)],
-                 ac_cv_static_assertion_macros_work="no",
-                 )
-  AC_LANG_RESTORE
- ])
-AC_MSG_RESULT("$ac_cv_static_assertion_macros_work")
-if test "$ac_cv_static_assertion_macros_work" = "no"; then
-    AC_MSG_ERROR([Compiler cannot compile macros used in autoconf tests.])
-fi
-fi # COMPILE_ENVIRONMENT
-
 dnl ========================================================
 dnl Checking for 64-bit OS
 dnl ========================================================
@@ -2376,7 +2457,11 @@ ia64*-hpux*)
 *-android*|*-linuxandroid*)
     AC_DEFINE(NO_PW_GECOS)
     no_x=yes
-    _PLATFORM_DEFAULT_TOOLKIT=cairo-android
+    if test -n "$gonkdir"; then
+        _PLATFORM_DEFAULT_TOOLKIT=cairo-gonk
+    else
+        _PLATFORM_DEFAULT_TOOLKIT=cairo-android
+    fi
     TARGET_NSPR_MDCPUCFG='\"md/_linux.cfg\"'
 
     MOZ_GFX_OPTIMIZE_MOBILE=1
@@ -4577,6 +4662,7 @@ MOZ_REFLOW_PERF=
 MOZ_SAFE_BROWSING=
 MOZ_HELP_VIEWER=
 MOZ_SPELLCHECK=1
+MOZ_JAVA_COMPOSITOR=
 MOZ_SVG_DLISTS=
 MOZ_TOOLKIT_SEARCH=1
 MOZ_UI_LOCALE=en-US
@@ -4762,7 +4848,8 @@ MOZ_ARG_HEADER(Toolkit Options)
         -o "$_DEFAULT_TOOLKIT" = "cairo-os2" \
         -o "$_DEFAULT_TOOLKIT" = "cairo-cocoa" \
         -o "$_DEFAULT_TOOLKIT" = "cairo-uikit" \
-        -o "$_DEFAULT_TOOLKIT" = "cairo-android"
+        -o "$_DEFAULT_TOOLKIT" = "cairo-android" \
+        -o "$_DEFAULT_TOOLKIT" = "cairo-gonk"
     then
         dnl nglayout only supports building with one toolkit,
         dnl so ignore everything after the first comma (",").
@@ -4885,6 +4972,15 @@ cairo-android)
     MOZ_INSTRUMENT_EVENT_LOOP=1
     ;;
 
+cairo-gonk)
+    AC_DEFINE(MOZ_WIDGET_GONK)
+    MOZ_WIDGET_TOOLKIT=gonk
+    TK_CFLAGS='$(MOZ_CAIRO_CFLAGS)'
+    TK_LIBS='$(MOZ_CAIRO_LIBS)'
+    MOZ_WEBGL=1
+    MOZ_PDF_PRINTING=1
+    ;;
+
 esac
 
 AC_SUBST(MOZ_PDF_PRINTING)
@@ -7165,7 +7261,9 @@ dnl We need to wrap dlopen and related functions on Android because we use
 dnl our own linker.
 if test "$OS_TARGET" = Android; then
     WRAP_LDFLAGS="${WRAP_LDFLAGS} -L$_objdir/dist/lib -lmozutils"
-    WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=dlopen,--wrap=dlclose,--wrap=dlerror,--wrap=dlsym,--wrap=dladdr"
+    if test "$MOZ_WIDGET_TOOLKIT" = android; then
+        WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=dlopen,--wrap=dlclose,--wrap=dlerror,--wrap=dlsym,--wrap=dladdr"
+    fi
 fi
 
 dnl ========================================================
@@ -7217,6 +7315,17 @@ if test -n "$MOZ_TRACEVIS"; then
     AC_DEFINE(MOZ_TRACEVIS)
 fi
 
+dnl ========================================================
+dnl = Use incremental GC
+dnl ========================================================
+JSGC_INCREMENTAL=1
+MOZ_ARG_DISABLE_BOOL(gcincremental,
+[  --disable-gcincremental Disable incremental GC],
+    JSGC_INCREMENTAL= )
+if test -n "$JSGC_INCREMENTAL"; then
+    AC_DEFINE(JSGC_INCREMENTAL)
+fi
+
 dnl ========================================================
 dnl ETW - Event Tracing for Windows
 dnl ========================================================
@@ -7557,6 +7666,8 @@ elif test "$MOZ_CHROME_FILE_FORMAT" = "jar"; then
     AC_DEFINE(MOZ_CHROME_FILE_FORMAT_JAR)
 fi
 
+OMNIJAR_NAME=omni.ja
+AC_SUBST(OMNIJAR_NAME)
 AC_SUBST(MOZ_OMNIJAR)
 
 dnl ========================================================
@@ -7705,7 +7816,7 @@ MOZ_ARG_DISABLE_BOOL(pedantic,
 _PEDANTIC= )
 if test "$_PEDANTIC"; then
     _SAVE_CXXFLAGS=$CXXFLAGS
-    CXXFLAGS="$CXXFLAGS ${_WARNINGS_CXXFLAGS} ${_COMPILER_PREFIX}-pedantic ${_COMPILER_PREFIX}-Wno-long-long"
+    CXXFLAGS="$CXXFLAGS -pedantic ${_WARNINGS_CXXFLAGS} -Wno-long-long"
     AC_MSG_CHECKING([whether C++ compiler has -pedantic long long bug])
     AC_TRY_COMPILE([$configure_static_assert_macros],
                    [CONFIGURE_STATIC_ASSERT(sizeof(long long) == 8)],
@@ -7715,8 +7826,8 @@ if test "$_PEDANTIC"; then
 
     case "$result" in
     no)
-        _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} ${_COMPILER_PREFIX}-pedantic ${_COMPILER_PREFIX}-Wno-long-long"
-        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} ${_COMPILER_PREFIX}-pedantic ${_COMPILER_PREFIX}-Wno-long-long"
+        _WARNINGS_CFLAGS="-pedantic ${_WARNINGS_CFLAGS} -Wno-long-long"
+        _WARNINGS_CXXFLAGS="-pedantic ${_WARNINGS_CXXFLAGS} -Wno-long-long"
         ;;
     yes)
         AC_MSG_ERROR([Your compiler appears to have a known bug where long long is miscompiled when using -pedantic.  Reconfigure using --disable-pedantic. ])
@@ -8026,8 +8137,6 @@ if test "$MOZ_TREE_CAIRO"; then
       SANITY_CHECKING_FEATURE="#undef CAIRO_DO_SANITY_CHECKING"
     fi
 
-    PNG_FUNCTIONS_FEATURE="#define CAIRO_HAS_PNG_FUNCTIONS 1"
-
     AC_SUBST(PS_SURFACE_FEATURE)
     AC_SUBST(PDF_SURFACE_FEATURE)
     AC_SUBST(SVG_SURFACE_FEATURE)
@@ -8323,6 +8432,7 @@ AC_SUBST(IBMBIDI)
 AC_SUBST(MOZ_UNIVERSALCHARDET)
 AC_SUBST(ACCESSIBILITY)
 AC_SUBST(MOZ_SPELLCHECK)
+AC_SUBST(MOZ_JAVA_COMPOSITOR)
 AC_SUBST(MOZ_USER_DIR)
 AC_SUBST(MOZ_CRASHREPORTER)
 AC_SUBST(MOZ_UPDATER)
@@ -8835,20 +8945,22 @@ if test "$MOZ_TREE_FREETYPE"; then
    AC_OUTPUT_SUBDIRS(modules/freetype2)
 fi
 
-dnl ========================================================
-dnl = Setup a nice relatively clean build environment for
-dnl = sub-configures.
-dnl ========================================================
-CC="$_SUBDIR_CC"
-CXX="$_SUBDIR_CXX"
-CFLAGS="$_SUBDIR_CFLAGS"
-CPPFLAGS="$_SUBDIR_CPPFLAGS"
-CXXFLAGS="$_SUBDIR_CXXFLAGS"
-LDFLAGS="$_SUBDIR_LDFLAGS"
-HOST_CC="$_SUBDIR_HOST_CC"
-HOST_CFLAGS="$_SUBDIR_HOST_CFLAGS"
-HOST_LDFLAGS="$_SUBDIR_HOST_LDFLAGS"
-RC=
+if test -z "$direct_nspr_config"; then
+    dnl ========================================================
+    dnl = Setup a nice relatively clean build environment for
+    dnl = sub-configures.
+    dnl ========================================================
+    CC="$_SUBDIR_CC"
+    CXX="$_SUBDIR_CXX"
+    CFLAGS="$_SUBDIR_CFLAGS"
+    CPPFLAGS="$_SUBDIR_CPPFLAGS"
+    CXXFLAGS="$_SUBDIR_CXXFLAGS"
+    LDFLAGS="$_SUBDIR_LDFLAGS"
+    HOST_CC="$_SUBDIR_HOST_CC"
+    HOST_CFLAGS="$_SUBDIR_HOST_CFLAGS"
+    HOST_LDFLAGS="$_SUBDIR_HOST_LDFLAGS"
+    RC=
+fi
 
 unset MAKEFILES
 unset CONFIG_FILES
@@ -8897,6 +9009,23 @@ if test -z "$MOZ_NATIVE_NSPR"; then
     rm -f config/autoconf.mk.bak
 fi
 
+if test -n "$direct_nspr_config"; then
+    dnl ========================================================
+    dnl = Setup a nice relatively clean build environment for
+    dnl = sub-configures.
+    dnl ========================================================
+    CC="$_SUBDIR_CC"
+    CXX="$_SUBDIR_CXX"
+    CFLAGS="$_SUBDIR_CFLAGS"
+    CPPFLAGS="$_SUBDIR_CPPFLAGS"
+    CXXFLAGS="$_SUBDIR_CXXFLAGS"
+    LDFLAGS="$_SUBDIR_LDFLAGS"
+    HOST_CC="$_SUBDIR_HOST_CC"
+    HOST_CFLAGS="$_SUBDIR_HOST_CFLAGS"
+    HOST_LDFLAGS="$_SUBDIR_HOST_LDFLAGS"
+    RC=
+fi
+
 # Run the SpiderMonkey 'configure' script.
 dist=$MOZ_BUILD_ROOT/dist
 ac_configure_args="$_SUBDIR_CONFIG_ARGS"
diff --git a/content/base/crashtests/700090-1.html b/content/base/crashtests/700090-1.html
new file mode 100644
index 000000000000..30479454f7e9
--- /dev/null
+++ b/content/base/crashtests/700090-1.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
+  var t1 = document.createTextNode("123456 ");
+  mo.appendChild(t1);
+  document.body.appendChild(mo);
+  var t2 = document.createTextNode("x");
+  document.body.appendChild(t2);
+
+  var r1 = document.createRange();
+  r1.setEnd(t1, 7);
+  var r3 = document.createRange();
+  r3.setStart(t1, 7);
+
+  document.documentElement.offsetHeight;
+
+  var r2 = document.createRange();
+  r2.setStart(t1, 0);
+  r2.setEnd(t2, 0);
+  r2.deleteContents();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/content/base/crashtests/700090-2.html b/content/base/crashtests/700090-2.html
new file mode 100644
index 000000000000..c6d5eb211467
--- /dev/null
+++ b/content/base/crashtests/700090-2.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
+  var t1 = document.createTextNode("123456 ");
+  mo.appendChild(t1);
+  document.body.appendChild(mo);
+  var t2 = document.createTextNode("x");
+  document.body.appendChild(t2);
+
+  var r1 = document.createRange();
+  r1.setEnd(t1, 7);
+  var r3 = document.createRange();
+  r3.setStart(t1, 7);
+
+  document.documentElement.offsetHeight;
+
+  t1.splitText(t1.length);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index 263de8206d7f..f6182a5f0b6e 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -98,3 +98,5 @@ load 679689-1.html
 load 682463.html
 load 693212.xhtml
 load 698974-1.html
+load 700090-1.html
+load 700090-2.html
diff --git a/content/base/public/Element.h b/content/base/public/Element.h
index 406cc4afb5ff..aa5b91734bea 100644
--- a/content/base/public/Element.h
+++ b/content/base/public/Element.h
@@ -110,17 +110,6 @@ public:
     return mState;
   }
 
-  /**
-   * Request an update of the link state for this element.  This will
-   * make sure that if the element is a link at all then either
-   * NS_EVENT_STATE_VISITED or NS_EVENT_STATE_UNVISITED is set in
-   * mState, and a history lookup kicked off if needed to find out
-   * whether the link is really visited.  This method will NOT send any
-   * state change notifications.  If you want them to happen for this
-   * call, you need to handle them yourself.
-   */
-  virtual void RequestLinkStateUpdate();
-
   /**
    * Ask this element to update its state.  If aNotify is false, then
    * state change notifications will not be dispatched; in that
@@ -132,6 +121,11 @@ public:
    * removing it from the document).
    */
   void UpdateState(bool aNotify);
+  
+  /**
+   * Method to update mState with link state information.  This does not notify.
+   */
+  void UpdateLinkState(nsEventStates aState);
 
 protected:
   /**
@@ -142,11 +136,6 @@ protected:
    */
   virtual nsEventStates IntrinsicState() const;
 
-  /**
-   * Method to update mState with link state information.  This does not notify.
-   */
-  void UpdateLinkState(nsEventStates aState);
-
   /**
    * Method to add state bits.  This should be called from subclass
    * constructors to set up our event state correctly at construction
diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
index 1f0ab03a8239..550bebfd868a 100644
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -1735,6 +1735,12 @@ public:
    */
   static bool HasPluginWithUncontrolledEventDispatch(nsIContent* aContent);
 
+  /**
+   * Returns the root document in a document hierarchy. Normally this will
+   * be the chrome document.
+   */
+  static nsIDocument* GetRootDocument(nsIDocument* aDoc);
+
   /**
    * Returns the time limit on handling user input before
    * nsEventStateManager::IsHandlingUserInput() stops returning true.
diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
index 70925c18b71b..a42a92d215cf 100644
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -166,6 +166,7 @@ public:
       // &&-ed in, this is safe.
       mAllowDNSPrefetch(true),
       mIsBeingUsedAsImage(false),
+      mHasLinksToUpdate(false),
       mPartID(0)
   {
     SetInDocument();
@@ -1489,7 +1490,7 @@ public:
   /**
    * This method is similar to GetElementById() from nsIDOMDocument but it
    * returns a mozilla::dom::Element instead of a nsIDOMElement.
-   * It prevents converting nsIDOMElement to mozill:dom::Element which is
+   * It prevents converting nsIDOMElement to mozilla::dom::Element which is
    * already converted from mozilla::dom::Element.
    */
   virtual Element* GetElementById(const nsAString& aElementId) = 0;
@@ -1554,6 +1555,17 @@ public:
   virtual nsresult SetNavigationTiming(nsDOMNavigationTiming* aTiming) = 0;
 
   virtual Element* FindImageMap(const nsAString& aNormalizedMapName) = 0;
+  
+  // Add aLink to the set of links that need their status resolved. 
+  void RegisterPendingLinkUpdate(mozilla::dom::Link* aLink);
+  
+  // Remove aLink from the set of links that need their status resolved.
+  // This function must be called when links are removed from the document.
+  void UnregisterPendingLinkUpdate(mozilla::dom::Link* aElement);
+
+  // Update state on links in mLinksToUpdate.  This function must
+  // be called prior to selector matching.
+  void FlushPendingLinkUpdates();
 
 #define DEPRECATED_OPERATION(_op) e##_op,
   enum DeprecatedOperations {
@@ -1644,6 +1656,11 @@ protected:
   // These are non-owning pointers, the elements are responsible for removing
   // themselves when they go away.
   nsAutoPtr<nsTHashtable<nsPtrHashKey<nsIContent> > > mFreezableElements;
+  
+  // The set of all links that need their status resolved.  Links must add themselves
+  // to this set by calling RegisterPendingLinkUpdate when added to a document and must
+  // remove themselves by calling UnregisterPendingLinkUpdate when removed from a document.
+  nsTHashtable<nsPtrHashKey<mozilla::dom::Link> > mLinksToUpdate;
 
   // SMIL Animation Controller, lazily-initialized in GetAnimationController
   nsRefPtr<nsSMILAnimationController> mAnimationController;
@@ -1724,6 +1741,9 @@ protected:
   // file, etc.
   bool mIsSyntheticDocument;
 
+  // True if this document has links whose state needs updating
+  bool mHasLinksToUpdate;
+
   // The document's script global object, the object from which the
   // document can get its script context and scope. This is the
   // *inner* window object.
diff --git a/content/base/public/nsIDocumentEncoder.idl b/content/base/public/nsIDocumentEncoder.idl
index 13cadc20e924..6da4fbda80e5 100644
--- a/content/base/public/nsIDocumentEncoder.idl
+++ b/content/base/public/nsIDocumentEncoder.idl
@@ -51,7 +51,7 @@ class nsIDocument;
 [ptr] native nsINodePtr(nsINode);
 [ptr] native nsIDocumentPtr(nsIDocument);
 
-[scriptable, uuid(c0da5b87-0ba7-4d7c-8cb3-fcb02af4253d)]
+[scriptable, uuid(82adaeca-63ee-44eb-830a-e1678bb8745e)]
 interface nsIDocumentEncoderNodeFixup : nsISupports
 {
   /**
@@ -272,6 +272,7 @@ interface nsIDocumentEncoder : nsISupports
    * @param aNode The node to encode.
    */
   void setNode(in nsIDOMNode aNode);
+  [noscript] void setNativeNode(in nsINodePtr aNode);
 
   /**
    *  If the container is set to a non-null value, then its
diff --git a/content/base/public/nsIImageLoadingContent.idl b/content/base/public/nsIImageLoadingContent.idl
index e9346ea72ead..cdc8e27af006 100644
--- a/content/base/public/nsIImageLoadingContent.idl
+++ b/content/base/public/nsIImageLoadingContent.idl
@@ -42,6 +42,7 @@ interface nsIChannel;
 interface nsIStreamListener;
 interface nsIURI;
 interface nsIDocument;
+interface nsIFrame;
 
 /**
  * This interface represents a content node that loads images.  The interface
@@ -65,7 +66,7 @@ interface nsIDocument;
  * sufficient, when combined with the imageBlockingStatus information.)
  */
 
-[scriptable, uuid(95c74255-df9a-4060-b5a0-0d111fcafe08)]
+[scriptable, uuid(f7debb84-2854-4731-a57b-1bd752ad71f8)]
 interface nsIImageLoadingContent : imgIDecoderObserver
 {
   /**
@@ -128,6 +129,18 @@ interface nsIImageLoadingContent : imgIDecoderObserver
    */
   imgIRequest getRequest(in long aRequestType);
 
+  /**
+   * Used to notify the image loading content node that a frame has been
+   * created.
+   */
+  [notxpcom] void frameCreated(in nsIFrame aFrame);
+
+  /**
+   * Used to notify the image loading content node that a frame has been
+   * destroyed.
+   */
+  [notxpcom] void frameDestroyed(in nsIFrame aFrame);
+
   /**
    * Used to find out what type of request one is dealing with (eg
    * which request got passed through to the imgIDecoderObserver
diff --git a/content/base/src/Link.h b/content/base/src/Link.h
index dc35010bb595..67ed3c16a056 100644
--- a/content/base/src/Link.h
+++ b/content/base/src/Link.h
@@ -109,6 +109,9 @@ public:
    *        changes or false if it should not.
    */
   void ResetLinkState(bool aNotify);
+  
+  // This method nevers returns a null element.
+  Element* GetElement() const { return mElement; }
 
 protected:
   virtual ~Link();
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index be0e7b5aae25..6587009a60d0 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -5893,6 +5893,20 @@ nsContentUtils::HasPluginWithUncontrolledEventDispatch(nsIContent* aContent)
   return result;
 }
 
+/* static */
+nsIDocument*
+nsContentUtils::GetRootDocument(nsIDocument* aDoc)
+{
+  if (!aDoc) {
+    return nsnull;
+  }
+  nsIDocument* doc = aDoc;
+  while (doc->GetParentDocument()) {
+    doc = doc->GetParentDocument();
+  }
+  return doc;
+}
+
 // static
 void
 nsContentUtils::ReleaseWrapper(nsISupports* aScriptObjectHolder,
diff --git a/content/base/src/nsDataDocumentContentPolicy.cpp b/content/base/src/nsDataDocumentContentPolicy.cpp
index b0c52ed97dca..86206b402d88 100644
--- a/content/base/src/nsDataDocumentContentPolicy.cpp
+++ b/content/base/src/nsDataDocumentContentPolicy.cpp
@@ -51,6 +51,17 @@
 
 NS_IMPL_ISUPPORTS1(nsDataDocumentContentPolicy, nsIContentPolicy)
 
+// Helper method for ShouldLoad()
+// Checks a URI for the given flags.  Returns true if the URI has the flags,
+// and false if not (or if we weren't able to tell).
+static bool
+HasFlags(nsIURI* aURI, PRUint32 aURIFlags)
+{
+  bool hasFlags;
+  nsresult rv = NS_URIChainHasFlags(aURI, aURIFlags, &hasFlags);
+  return NS_SUCCEEDED(rv) && hasFlags;
+}
+
 NS_IMETHODIMP
 nsDataDocumentContentPolicy::ShouldLoad(PRUint32 aContentType,
                                         nsIURI *aContentLocation,
@@ -87,21 +98,26 @@ nsDataDocumentContentPolicy::ShouldLoad(PRUint32 aContentType,
   }
 
   if (doc->IsBeingUsedAsImage()) {
-    // Allow local resources for SVG-as-an-image documents, but disallow
-    // everything else, to prevent data leakage
-    bool hasFlags;
-    nsresult rv = NS_URIChainHasFlags(aContentLocation,
-                                      nsIProtocolHandler::URI_IS_LOCAL_RESOURCE,
-                                      &hasFlags);
-    if (NS_FAILED(rv) || !hasFlags) {
-      // resource is not local (or we couldn't tell) - reject!
+    // We only allow SVG images to load content from URIs that are local and
+    // also satisfy one of the following conditions:
+    //  - URI inherits security context, e.g. data URIs
+    //   OR
+    //  - URI loadable by subsumers, e.g. moz-filedata URIs
+    // Any URI that doesn't meet these requirements will be rejected below.
+    if (!HasFlags(aContentLocation,
+                  nsIProtocolHandler::URI_IS_LOCAL_RESOURCE) ||
+        (!HasFlags(aContentLocation,
+                   nsIProtocolHandler::URI_INHERITS_SECURITY_CONTEXT) &&
+         !HasFlags(aContentLocation,
+                   nsIProtocolHandler::URI_LOADABLE_BY_SUBSUMERS))) {
       *aDecision = nsIContentPolicy::REJECT_TYPE;
 
-      // report error, if we can.
+      // Report error, if we can.
       if (node) {
         nsIPrincipal* requestingPrincipal = node->NodePrincipal();
         nsRefPtr<nsIURI> principalURI;
-        rv = requestingPrincipal->GetURI(getter_AddRefs(principalURI));
+        nsresult rv =
+          requestingPrincipal->GetURI(getter_AddRefs(principalURI));
         if (NS_SUCCEEDED(rv) && principalURI) {
           nsScriptSecurityManager::ReportError(
             nsnull, NS_LITERAL_STRING("CheckSameOriginError"), principalURI,
@@ -112,8 +128,8 @@ nsDataDocumentContentPolicy::ShouldLoad(PRUint32 aContentType,
                doc->GetDocumentURI()) {
       // Check for (& disallow) recursive image-loads
       bool isRecursiveLoad;
-      rv = aContentLocation->EqualsExceptRef(doc->GetDocumentURI(),
-                                             &isRecursiveLoad);
+      nsresult rv = aContentLocation->EqualsExceptRef(doc->GetDocumentURI(),
+                                                      &isRecursiveLoad);
       if (NS_FAILED(rv) || isRecursiveLoad) {
         NS_WARNING("Refusing to recursively load image");
         *aDecision = nsIContentPolicy::REJECT_TYPE;
@@ -122,12 +138,12 @@ nsDataDocumentContentPolicy::ShouldLoad(PRUint32 aContentType,
     return NS_OK;
   }
 
-  // Allow all loads for non-external-resource documents
-  if (!doc->GetDisplayDocument()) {
+  // Allow all loads for non-resource documents
+  if (!doc->IsResourceDoc()) {
     return NS_OK;
   }
 
-  // For external resources, blacklist some load types
+  // For resource documents, blacklist some load types
   if (aContentType == nsIContentPolicy::TYPE_OBJECT ||
       aContentType == nsIContentPolicy::TYPE_DOCUMENT ||
       aContentType == nsIContentPolicy::TYPE_SUBDOCUMENT ||
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 9433071e5c1e..8915d789ec7d 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -1554,6 +1554,8 @@ nsDocument::nsDocument(const char* aContentType)
 
   // Start out mLastStyleSheetSet as null, per spec
   SetDOMStringToNull(mLastStyleSheetSet);
+  
+  mLinksToUpdate.Init();
 }
 
 static PLDHashOperator
@@ -1952,6 +1954,8 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDocument)
   if (tmp->mAnimationController) {
     tmp->mAnimationController->Unlink();
   }
+
+  tmp->mPendingTitleChangeEvent.Revoke();
   
   tmp->mInUnlinkOrDeletion = false;
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
@@ -3222,6 +3226,7 @@ nsDocument::DeleteShell()
   if (IsEventHandlingEnabled()) {
     RevokeAnimationFrameNotifications();
   }
+
   mPresShell = nsnull;
 }
 
@@ -7970,6 +7975,41 @@ nsIDocument::EnumerateFreezableElements(FreezableElementEnumerator aEnumerator,
   mFreezableElements->EnumerateEntries(EnumerateFreezables, &data);
 }
 
+void
+nsIDocument::RegisterPendingLinkUpdate(Link* aLink)
+{
+  mLinksToUpdate.PutEntry(aLink);
+  mHasLinksToUpdate = true;
+}
+
+void
+nsIDocument::UnregisterPendingLinkUpdate(Link* aLink)
+{
+  if (!mHasLinksToUpdate)
+    return;
+    
+  mLinksToUpdate.RemoveEntry(aLink);
+}
+  
+static PLDHashOperator
+EnumeratePendingLinkUpdates(nsPtrHashKey<Link>* aEntry, void* aData)
+{
+  aEntry->GetKey()->GetElement()->UpdateLinkState(aEntry->GetKey()->LinkState());
+  return PL_DHASH_NEXT;
+}
+
+void
+nsIDocument::FlushPendingLinkUpdates() 
+{
+  if (!mHasLinksToUpdate)
+    return;
+    
+  nsAutoScriptBlocker scriptBlocker;
+  mLinksToUpdate.EnumerateEntries(EnumeratePendingLinkUpdates, nsnull);
+  mLinksToUpdate.Clear();
+  mHasLinksToUpdate = false;
+}
+
 already_AddRefed<nsIDocument>
 nsIDocument::CreateStaticClone(nsISupports* aCloneContainer)
 {
@@ -8534,19 +8574,6 @@ GetCommonAncestor(nsIDocument* aDoc1, nsIDocument* aDoc2)
   return parent;
 }
 
-// Returns the root document in a document hierarchy.
-static nsIDocument*
-GetRootDocument(nsIDocument* aDoc)
-{
-  if (!aDoc)
-    return nsnull;
-  nsIDocument* doc = aDoc;
-  while (doc->GetParentDocument()) {
-    doc = doc->GetParentDocument();
-  }
-  return doc;
-}
-
 class nsCallRequestFullScreen : public nsRunnable
 {
 public:
@@ -8621,8 +8648,8 @@ nsDocument::RequestFullScreen(Element* aElement, bool aWasCallerChrome)
   }
 
   // Remember the root document, so that if a full-screen document is hidden
-  // we can reset full-screen state the remaining visible full-screen documents.
-  sFullScreenRootDoc = do_GetWeakReference(GetRootDocument(this));
+  // we can reset full-screen state in the remaining visible full-screen documents.
+  sFullScreenRootDoc = do_GetWeakReference(nsContentUtils::GetRootDocument(this));
 
   // Set the full-screen element. This sets the full-screen style on the
   // element, and the full-screen-ancestor styles on ancestors of the element
diff --git a/content/base/src/nsDocumentEncoder.cpp b/content/base/src/nsDocumentEncoder.cpp
index aa583313bdca..8b69baea6c3b 100644
--- a/content/base/src/nsDocumentEncoder.cpp
+++ b/content/base/src/nsDocumentEncoder.cpp
@@ -301,6 +301,14 @@ nsDocumentEncoder::SetNode(nsIDOMNode* aNode)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDocumentEncoder::SetNativeNode(nsINode* aNode)
+{
+  mNodeIsContainer = false;
+  mNode = aNode;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDocumentEncoder::SetContainerNode(nsIDOMNode *aContainer)
 {
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 256177a421a4..09310ea83910 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -1381,8 +1381,8 @@ nsFrameLoader::MaybeCreateDocShell()
     return NS_ERROR_UNEXPECTED;
   }
 
-  if (doc->GetDisplayDocument() || !doc->IsActive()) {
-    // Don't allow subframe loads in external reference documents, nor
+  if (doc->IsResourceDoc() || !doc->IsActive()) {
+    // Don't allow subframe loads in resource documents, nor
     // in non-active documents.
     return NS_ERROR_NOT_AVAILABLE;
   }
diff --git a/content/base/src/nsFrameMessageManager.cpp b/content/base/src/nsFrameMessageManager.cpp
index 215c771f7697..2058d6aad88a 100644
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -52,6 +52,10 @@
 #include "nsIConsoleService.h"
 #include "nsIProtocolHandler.h"
 
+#ifdef ANDROID
+#include <android/log.h>
+#endif
+
 static bool
 IsChromeProcess()
 {
@@ -279,6 +283,9 @@ nsFrameMessageManager::SendAsyncMessage(const nsAString& aMessageName,
 NS_IMETHODIMP
 nsFrameMessageManager::Dump(const nsAString& aStr)
 {
+#ifdef ANDROID
+  __android_log_print(ANDROID_LOG_INFO, "Gecko", NS_ConvertUTF16toUTF8(aStr).get());
+#endif
   fputs(NS_ConvertUTF16toUTF8(aStr).get(), stdout);
   fflush(stdout);
   return NS_OK;
diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
index 975662ac6898..15daa6d1fcb3 100644
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -1248,11 +1248,6 @@ Element::NotifyStateChange(nsEventStates aStates)
   }
 }
 
-void
-Element::RequestLinkStateUpdate()
-{
-}
-
 void
 Element::UpdateLinkState(nsEventStates aState)
 {
@@ -5385,6 +5380,7 @@ inline static nsresult FindMatchingElements(nsINode* aRoot,
   nsIDocument* doc = aRoot->OwnerDoc();  
   TreeMatchContext matchingContext(false, nsRuleWalker::eRelevantLinkUnvisited,
                                    doc);
+  doc->FlushPendingLinkUpdates();
 
   // Fast-path selectors involving IDs.  We can only do this if aRoot
   // is in the document and the document is not in quirks mode, since
@@ -5493,6 +5489,7 @@ nsGenericElement::MozMatchesSelector(const nsAString& aSelector, nsresult* aResu
   *aResult = ParseSelectorList(this, aSelector, getter_Transfers(selectorList));
 
   if (NS_SUCCEEDED(*aResult)) {
+    OwnerDoc()->FlushPendingLinkUpdates();
     TreeMatchContext matchingContext(false,
                                      nsRuleWalker::eRelevantLinkUnvisited,
                                      OwnerDoc());
diff --git a/content/base/src/nsImageLoadingContent.cpp b/content/base/src/nsImageLoadingContent.cpp
index 36b87bcf8e64..82618d326901 100644
--- a/content/base/src/nsImageLoadingContent.cpp
+++ b/content/base/src/nsImageLoadingContent.cpp
@@ -72,6 +72,7 @@
 #include "nsIDOMNode.h"
 
 #include "nsContentUtils.h"
+#include "nsLayoutUtils.h"
 #include "nsIContentPolicy.h"
 #include "nsContentPolicyUtils.h"
 #include "nsEventDispatcher.h"
@@ -115,7 +116,9 @@ nsImageLoadingContent::nsImageLoadingContent()
     mNewRequestsWillNeedAnimationReset(false),
     mPendingRequestNeedsResetAnimation(false),
     mCurrentRequestNeedsResetAnimation(false),
-    mStateChangerDepth(0)
+    mStateChangerDepth(0),
+    mCurrentRequestRegistered(false),
+    mPendingRequestRegistered(false)
 {
   if (!nsContentUtils::GetImgLoader()) {
     mLoadingEnabled = false;
@@ -328,7 +331,6 @@ nsImageLoadingContent::OnStopDecode(imgIRequest* aRequest,
   nsIDocument* doc = GetOurDocument();
   nsIPresShell* shell = doc ? doc->GetShell() : nsnull;
   if (shell) {
-
     // We need to figure out whether to kick off decoding
     bool doRequestDecode = false;
 
@@ -372,6 +374,18 @@ nsImageLoadingContent::OnStopRequest(imgIRequest* aRequest, bool aLastPart)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsImageLoadingContent::OnImageIsAnimated(imgIRequest *aRequest)
+{
+  bool* requestFlag = GetRegisteredFlagForRequest(aRequest);
+  if (requestFlag) {
+    nsLayoutUtils::RegisterImageRequest(GetFramePresContext(),
+                                        aRequest, requestFlag);
+  }
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsImageLoadingContent::OnDiscard(imgIRequest *aRequest)
 {
@@ -501,6 +515,44 @@ nsImageLoadingContent::GetRequest(PRInt32 aRequestType,
   return NS_OK;
 }
 
+NS_IMETHODIMP_(void)
+nsImageLoadingContent::FrameCreated(nsIFrame* aFrame)
+{
+  NS_ASSERTION(aFrame, "aFrame is null");
+
+  // We need to make sure that our image request is registered, if it should
+  // be registered.
+  nsPresContext* presContext = aFrame->PresContext();
+
+  if (mCurrentRequest) {
+    nsLayoutUtils::RegisterImageRequestIfAnimated(presContext, mCurrentRequest,
+                                                  &mCurrentRequestRegistered);
+  }
+
+  if (mPendingRequest) {
+    nsLayoutUtils::RegisterImageRequestIfAnimated(presContext, mPendingRequest,
+                                                  &mPendingRequestRegistered);
+  }
+}
+
+NS_IMETHODIMP_(void)
+nsImageLoadingContent::FrameDestroyed(nsIFrame* aFrame)
+{
+  NS_ASSERTION(aFrame, "aFrame is null");
+
+  // We need to make sure that our image request is deregistered.
+  if (mCurrentRequest) {
+    nsLayoutUtils::DeregisterImageRequest(GetFramePresContext(),
+                                          mCurrentRequest,
+                                          &mCurrentRequestRegistered);
+  }
+
+  if (mPendingRequest) {
+    nsLayoutUtils::DeregisterImageRequest(GetFramePresContext(),
+                                          mPendingRequest,
+                                          &mPendingRequestRegistered);
+  }
+}
 
 NS_IMETHODIMP
 nsImageLoadingContent::GetRequestType(imgIRequest* aRequest,
@@ -867,6 +919,23 @@ nsImageLoadingContent::GetOurDocument()
   return thisContent->OwnerDoc();
 }
 
+nsIFrame*
+nsImageLoadingContent::GetOurPrimaryFrame()
+{
+  nsCOMPtr<nsIContent> thisContent = do_QueryInterface(this);
+  return thisContent->GetPrimaryFrame();
+}
+
+nsPresContext* nsImageLoadingContent::GetFramePresContext()
+{
+  nsIFrame* frame = GetOurPrimaryFrame();
+  if (!frame) {
+    return nsnull;
+  }
+
+  return frame->PresContext();
+}
+
 nsresult
 nsImageLoadingContent::StringToURI(const nsAString& aSpec,
                                    nsIDocument* aDocument,
@@ -986,6 +1055,11 @@ nsImageLoadingContent::ClearCurrentRequest(nsresult aReason)
   NS_ABORT_IF_FALSE(!mCurrentURI,
                     "Shouldn't have both mCurrentRequest and mCurrentURI!");
 
+  // Deregister this image from the refresh driver so it no longer receives
+  // notifications.
+  nsLayoutUtils::DeregisterImageRequest(GetFramePresContext(), mCurrentRequest,
+                                        &mCurrentRequestRegistered);
+
   // Clean up the request.
   UntrackImage(mCurrentRequest);
   mCurrentRequest->CancelAndForgetObserver(aReason);
@@ -1009,12 +1083,29 @@ nsImageLoadingContent::ClearPendingRequest(nsresult aReason)
   nsCxPusher pusher;
   pusher.PushNull();
 
+  // Deregister this image from the refresh driver so it no longer receives
+  // notifications.
+  nsLayoutUtils::DeregisterImageRequest(GetFramePresContext(), mPendingRequest,
+                                        &mPendingRequestRegistered);
+
   UntrackImage(mPendingRequest);
   mPendingRequest->CancelAndForgetObserver(aReason);
   mPendingRequest = nsnull;
   mPendingRequestNeedsResetAnimation = false;
 }
 
+bool*
+nsImageLoadingContent::GetRegisteredFlagForRequest(imgIRequest* aRequest)
+{
+  if (aRequest == mCurrentRequest) {
+    return &mCurrentRequestRegistered;
+  } else if (aRequest == mPendingRequest) {
+    return &mPendingRequestRegistered;
+  } else {
+    return nsnull;
+  }
+}
+
 bool
 nsImageLoadingContent::HaveSize(imgIRequest *aImage)
 {
diff --git a/content/base/src/nsImageLoadingContent.h b/content/base/src/nsImageLoadingContent.h
index 2ad56d062a81..c5aea1966520 100644
--- a/content/base/src/nsImageLoadingContent.h
+++ b/content/base/src/nsImageLoadingContent.h
@@ -146,6 +146,24 @@ protected:
    */
   nsIDocument* GetOurDocument();
 
+  /**
+   * Helper function to get the frame associated with this content. Not named
+   * GetPrimaryFrame to prevent ambiguous method names in subclasses.
+   *
+   * @return The frame which we belong to, or nsnull if it doesn't exist.
+   */
+  nsIFrame* GetOurPrimaryFrame();
+
+  /**
+   * Helper function to get the PresContext associated with this content's
+   * frame. Not named GetPresContext to prevent ambiguous method names in
+   * subclasses.
+   *
+   * @return The nsPresContext associated with our frame, or nsnull if either
+   *         the frame doesn't exist, or the frame's prescontext doesn't exist.
+   */
+  nsPresContext* GetFramePresContext();
+
   /**
    * CancelImageRequests is called by subclasses when they want to
    * cancel all image requests (for example when the subclass is
@@ -302,6 +320,16 @@ protected:
   void ClearCurrentRequest(nsresult aReason);
   void ClearPendingRequest(nsresult aReason);
 
+  /**
+   * Retrieve a pointer to the 'registered with the refresh driver' flag for
+   * which a particular image request corresponds.
+   *
+   * @returns A pointer to the boolean flag for a given image request, or
+   *          |nsnull| if the request is not either |mPendingRequest| or
+   *          |mCurrentRequest|.
+   */
+  bool* GetRegisteredFlagForRequest(imgIRequest* aRequest);
+
   /**
    * Static helper method to tell us if we have the size of a request. The
    * image may be null.
@@ -382,6 +410,11 @@ private:
 
   /* The number of nested AutoStateChangers currently tracking our state. */
   PRUint8 mStateChangerDepth;
+
+  // Flags to indicate whether each of the current and pending requests are
+  // registered with the refresh driver.
+  bool mCurrentRequestRegistered;
+  bool mPendingRequestRegistered;
 };
 
 #endif // nsImageLoadingContent_h__
diff --git a/content/base/src/nsRange.cpp b/content/base/src/nsRange.cpp
index 15ed659db936..30d2e9245af4 100644
--- a/content/base/src/nsRange.cpp
+++ b/content/base/src/nsRange.cpp
@@ -286,7 +286,7 @@ nsRange::CharacterDataChanged(nsIDocument* aDocument,
       NS_ASSERTION(aInfo->mDetails->mType ==
                    CharacterDataChangeInfo::Details::eSplit,
                    "only a split can start before the end");
-      NS_ASSERTION(static_cast<PRUint32>(mStartOffset) <= aInfo->mChangeEnd,
+      NS_ASSERTION(static_cast<PRUint32>(mStartOffset) <= aInfo->mChangeEnd + 1,
                    "mStartOffset is beyond the end of this node");
       newStartOffset = static_cast<PRUint32>(mStartOffset) - aInfo->mChangeStart;
       newStartNode = aInfo->mDetails->mNextSibling;
@@ -313,7 +313,7 @@ nsRange::CharacterDataChanged(nsIDocument* aDocument,
       NS_ASSERTION(aInfo->mDetails->mType ==
                    CharacterDataChangeInfo::Details::eSplit,
                    "only a split can start before the end");
-      NS_ASSERTION(static_cast<PRUint32>(mEndOffset) <= aInfo->mChangeEnd,
+      NS_ASSERTION(static_cast<PRUint32>(mEndOffset) <= aInfo->mChangeEnd + 1,
                    "mEndOffset is beyond the end of this node");
       newEndOffset = static_cast<PRUint32>(mEndOffset) - aInfo->mChangeStart;
       newEndNode = aInfo->mDetails->mNextSibling;
diff --git a/content/base/src/nsStubImageDecoderObserver.cpp b/content/base/src/nsStubImageDecoderObserver.cpp
index 398cdeb49de8..74f8aeea16e3 100644
--- a/content/base/src/nsStubImageDecoderObserver.cpp
+++ b/content/base/src/nsStubImageDecoderObserver.cpp
@@ -106,6 +106,12 @@ nsStubImageDecoderObserver::OnDiscard(imgIRequest *aRequest)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsStubImageDecoderObserver::OnImageIsAnimated(imgIRequest *aRequest)
+{
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsStubImageDecoderObserver::FrameChanged(imgIContainer *aContainer,
                                          const nsIntRect *aDirtyRect)
diff --git a/content/base/test/Makefile.in b/content/base/test/Makefile.in
index ff89a7c17445..e9048c7b8b72 100644
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -521,6 +521,7 @@ _TEST_FILES2 = \
 		test_bug692434.html \
 		file_bug692434.xml \
 		test_bug693875.html \
+		test_nodelist_holes.html \
 		$(NULL)
 
 _CHROME_FILES =	\
diff --git a/content/base/test/test_nodelist_holes.html b/content/base/test/test_nodelist_holes.html
new file mode 100644
index 000000000000..a8aa8934f3e4
--- /dev/null
+++ b/content/base/test/test_nodelist_holes.html
@@ -0,0 +1,42 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=699826
+-->
+<head>
+  <title>Test for Bug 699826</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=699826">Mozilla Bug 699826</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 699826 **/
+HTMLCollection.prototype[0] = "PASSProto0";
+HTMLCollection.prototype[1] = "PASSProto1";
+var list = document.getElementsByTagName("testtag");
+is(list[0], "PASSProto0", "Should expose proto properties on the list");
+is(list[1], "PASSProto1", "Should expose more proto properties on the list");
+
+var testtag = document.createElement("testtag");
+
+document.body.appendChild(testtag);
+
+is(list[0], testtag, "Should expose elements in the list");
+is(list[1], "PASSProto1", "Should expose proto properties out of range on the list");
+
+testtag.parentNode.removeChild(testtag);
+
+is(list[0], "PASSProto0", "Should expose proto properties on the list after removal");
+is(list[1], "PASSProto1", "Should expose more proto properties on the list after removal");
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/canvas/src/WebGLContextNotSupported.cpp b/content/canvas/src/WebGLContextNotSupported.cpp
index 0df4c8476876..5ab5e17894eb 100644
--- a/content/canvas/src/WebGLContextNotSupported.cpp
+++ b/content/canvas/src/WebGLContextNotSupported.cpp
@@ -53,4 +53,5 @@ DOMCI_DATA(WebGLRenderbuffer, void)
 DOMCI_DATA(WebGLUniformLocation, void)
 DOMCI_DATA(WebGLActiveInfo, void)
 DOMCI_DATA(WebGLExtension, void)
+DOMCI_DATA(WebGLExtensionStandardDerivatives, void)
 DOMCI_DATA(WebGLExtensionLoseContext, void)
diff --git a/content/canvas/test/Makefile.in b/content/canvas/test/Makefile.in
index 1404414d5377..96b3aae9a962 100644
--- a/content/canvas/test/Makefile.in
+++ b/content/canvas/test/Makefile.in
@@ -81,6 +81,7 @@ _TEST_FILES_0 = \
 	test_2d.composite.uncovered.image.source-in.html \
 	test_2d.composite.uncovered.image.source-out.html \
 	test_2d.drawImage.zerocanvas.html \
+	test_toDataURL_alpha.html \
 	test_toDataURL_lowercase_ascii.html \
 	test_toDataURL_parameters.html \
 	test_mozGetAsFile.html \
diff --git a/content/canvas/test/test_toDataURL_alpha.html b/content/canvas/test/test_toDataURL_alpha.html
new file mode 100644
index 000000000000..23b003d562f4
--- /dev/null
+++ b/content/canvas/test/test_toDataURL_alpha.html
@@ -0,0 +1,206 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Canvas test: toDataURL parameters (Bug 564388)</title>
+<script src="/MochiKit/MochiKit.js"></script>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" href="/tests/SimpleTest/test.css">
+</head>
+<body>
+<p>
+For image types that do not support an alpha channel, the image must be
+composited onto a solid black background using the source-over operator,
+and the resulting image must be the one used to create the data: URL.
+</p>
+<p> See:
+<a href="http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-canvas-todataurl">
+http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-canvas-todataurl
+</a>
+</p>
+<p>Mozilla
+    <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=650720">Bug 650720</a>
+</p>
+<p class="output">Output:</p>
+<!--
+    Author's note:
+    To add more cases to this test:
+    - To add a row (another color value)
+      * Add a row to the table below, using the canvas id format
+        (c<row>-<col>)
+      * Update runTests to include the new row in the loop
+    - To add a column (another image format)
+      * Add a column to the table below, using the canvas id format above
+      * Update runTests to call do_canvas, passing your column number,
+        the image format, and any options to pass to the toDataUrl function
+
+    Vaguely derived from Philip Taylor's toDataURL.jpeg.alpha test:
+    http://philip.html5.org/tests/canvas/suite/tests/toDataURL.jpeg.alpha.html
+-->
+<table>
+    <tr>
+        <th>Type:</th>
+        <th>image/png</th>
+        <th>image/jpeg</th>
+        <th>image/bmp<br />(24 bpp)</th>
+        <th>image/bmp<br />(32 bpp)</th>
+    </tr>
+    <tr>
+        <td id="c1">rgba(128, 255, 128, 0.5)</td>
+        <td><canvas id="c1-1" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c1-2" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c1-3" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c1-4" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+    </tr>
+    <tr>
+        <td id="c2">rgba(255, 128, 128, 0.75)</td>
+        <td><canvas id="c2-1" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c2-2" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c2-3" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c2-4" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+    </tr>
+    <tr>
+        <td id="c3">rgba(128, 128, 255, 0.25)</td>
+        <td><canvas id="c3-1" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c3-2" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c3-3" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c3-4" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+    </tr>
+    <tr>
+        <td id="c4">rgba(255, 255, 255, 1.0)</td>
+        <td><canvas id="c4-1" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c4-2" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c4-3" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c4-4" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+    </tr>
+    <tr>
+        <td id="c5">rgba(255, 255, 255, 0)</td>
+        <td><canvas id="c5-1" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c5-2" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c5-3" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c5-4" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+    </tr>
+    <tr>
+        <td id="c6">rgba(0, 0, 0, 1.0)</td>
+        <td><canvas id="c6-1" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c6-2" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c6-3" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c6-4" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+    </tr>
+    <tr>
+        <td id="c7">rgba(0, 0, 0, 0)</td>
+        <td><canvas id="c7-1" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c7-2" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c7-3" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+        <td><canvas id="c7-4" class="output" width="100" height="50">
+            <p class="fallback">FAIL (fallback content)</p></canvas></td>
+    </tr>
+</table>
+
+<script>
+var finishedTests = [];
+
+function isPixel(ctx, x,y, r,g,b,a, d)
+{
+    var pos = x + "," + y;
+    var colour = r + "," + g + "," + b + "," + a;
+    var pixel = ctx.getImageData(x, y, 1, 1);
+    var pr = pixel.data[0],
+        pg = pixel.data[1],
+        pb = pixel.data[2],
+        pa = pixel.data[3];
+    ok(r-d <= pr && pr <= r+d &&
+       g-d <= pg && pg <= g+d &&
+       b-d <= pb && pb <= b+d &&
+       a-d <= pa && pa <= a+d,
+       "pixel "+pos+" of "+ctx.canvas.id+" is "+pr+","+pg+","+pb+","+pa+
+         "; expected "+colour+" +/- "+d);
+}
+
+
+function do_canvas(row, col, type, options)
+{
+    finishedTests[row + '_' + col] = false;
+    var canvas = document.getElementById('c' + row + '-' + col);
+    var ctx = canvas.getContext('2d');
+
+    ctx.fillStyle = document.getElementById('c' + row).textContent;
+    ctx.fillRect(0, 0, 100, 50);
+    var data = canvas.toDataURL(type, options);
+
+    ctx.fillStyle = '#000';
+    ctx.fillRect(0, 0, 100, 50);
+    var img = new Image();
+
+    var color = document.getElementById('c' + row).textContent;
+    color = color.substr(5, color.length - 6); // strip off the 'argb()'
+    var colors = color.replace(' ', '', 'g').split(',');
+    var r = colors[0]*colors[3],
+        g = colors[1]*colors[3],
+        b = colors[2]*colors[3];
+
+    img.onload = function ()
+    {
+        ctx.drawImage(img, 0, 0);
+        isPixel(ctx, 50,25, r,g,b,255, 8);
+        finishedTests[row + '_' + col] = true;
+    };
+    img.src = data;
+}
+
+function checkFinished()
+{
+    for (var t in finishedTests) {
+        if (!finishedTests[t]) {
+            setTimeout(checkFinished, 500);
+            return;
+        }
+    }
+    SimpleTest.finish();
+}
+
+function runTests()
+{
+    for (var row = 1; row <= 7; row++) {
+        do_canvas(row, 1, 'image/png');
+        do_canvas(row, 2, 'image/jpeg');
+        do_canvas(row, 3, 'image/bmp');
+        do_canvas(row, 4, 'image/bmp', '-moz-parse-options:bpp=32');
+    }
+
+    setTimeout(checkFinished, 500);
+}
+
+SimpleTest.waitForExplicitFinish();
+
+addLoadEvent(runTests);
+
+</script>
+
+</html>
diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp
index c764eaeb5b69..2b2f345bcc84 100644
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -120,6 +120,7 @@
 #include "nsPLDOMEvent.h"
 
 #include "mozilla/Preferences.h"
+#include "mozilla/dom/FromParser.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -665,15 +666,13 @@ nsGenericHTMLElement::GetOffsetParent(nsIDOMElement** aOffsetParent)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsGenericHTMLElement::GetInnerHTML(nsAString& aInnerHTML)
+nsresult
+nsGenericHTMLElement::GetMarkup(bool aIncludeSelf, nsAString& aMarkup)
 {
-  aInnerHTML.Truncate();
+  aMarkup.Truncate();
 
   nsIDocument* doc = OwnerDoc();
 
-  nsresult rv = NS_OK;
-
   nsAutoString contentType;
   if (IsInHTMLDocument()) {
     contentType.AssignLiteral("text/html");
@@ -698,21 +697,37 @@ nsGenericHTMLElement::GetInnerHTML(nsAString& aInnerHTML)
 
   NS_ENSURE_TRUE(docEncoder, NS_ERROR_FAILURE);
 
-  rv = docEncoder->NativeInit(doc, contentType,
-                              nsIDocumentEncoder::OutputEncodeBasicEntities |
-                              // Output DOM-standard newlines
-                              nsIDocumentEncoder::OutputLFLineBreak |
-                              // Don't do linebreaking that's not present in
-                              // the source
-                              nsIDocumentEncoder::OutputRaw);
+  nsresult rv = docEncoder->NativeInit(doc, contentType,
+                                       nsIDocumentEncoder::OutputEncodeBasicEntities |
+                                       // Output DOM-standard newlines
+                                       nsIDocumentEncoder::OutputLFLineBreak |
+                                       // Don't do linebreaking that's not present in
+                                       // the source
+                                       nsIDocumentEncoder::OutputRaw);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  docEncoder->SetNativeContainerNode(this);
-  rv = docEncoder->EncodeToString(aInnerHTML);
-  doc->SetCachedEncoder(docEncoder.forget());
+  if (aIncludeSelf) {
+    docEncoder->SetNativeNode(this);
+  } else {
+    docEncoder->SetNativeContainerNode(this);
+  }
+  rv = docEncoder->EncodeToString(aMarkup);
+  if (!aIncludeSelf) {
+    doc->SetCachedEncoder(docEncoder.forget());
+  }
   return rv;
 }
 
+nsresult
+nsGenericHTMLElement::GetInnerHTML(nsAString& aInnerHTML) {
+  return GetMarkup(false, aInnerHTML);
+}
+
+NS_IMETHODIMP
+nsGenericHTMLElement::GetOuterHTML(nsAString& aOuterHTML) {
+  return GetMarkup(true, aOuterHTML);
+}
+
 void
 nsGenericHTMLElement::FireMutationEventsForDirectParsing(nsIDocument* aDoc,
                                                          nsIContent* aDest,
@@ -740,8 +755,6 @@ nsGenericHTMLElement::SetInnerHTML(const nsAString& aInnerHTML)
 {
   nsIDocument* doc = OwnerDoc();
 
-  nsresult rv = NS_OK;
-
   // Batch possible DOMSubtreeModified events.
   mozAutoSubtreeModified subtree(doc, nsnull);
 
@@ -758,8 +771,7 @@ nsGenericHTMLElement::SetInnerHTML(const nsAString& aInnerHTML)
 
   nsAutoScriptLoaderDisabler sld(doc);
   
-  nsCOMPtr<nsIDOMDocumentFragment> df;
-
+  nsresult rv = NS_OK;
   if (doc->IsHTML()) {
     PRInt32 oldChildCount = GetChildCount();
     rv = nsContentUtils::ParseFragmentHTML(aInnerHTML,
@@ -772,6 +784,7 @@ nsGenericHTMLElement::SetInnerHTML(const nsAString& aInnerHTML)
     // HTML5 parser has notified, but not fired mutation events.
     FireMutationEventsForDirectParsing(doc, this, oldChildCount);
   } else {
+    nsCOMPtr<nsIDOMDocumentFragment> df;
     rv = nsContentUtils::CreateContextualFragment(this, aInnerHTML,
                                                   true,
                                                   getter_AddRefs(df));
@@ -789,6 +802,71 @@ nsGenericHTMLElement::SetInnerHTML(const nsAString& aInnerHTML)
   return rv;
 }
 
+NS_IMETHODIMP
+nsGenericHTMLElement::SetOuterHTML(const nsAString& aOuterHTML)
+{
+  nsINode* parent = GetNodeParent();
+  if (!parent) {
+    return NS_OK;
+  }
+
+  if (parent->NodeType() == nsIDOMNode::DOCUMENT_NODE) {
+    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+  }
+
+  if (OwnerDoc()->IsHTML()) {
+    nsIAtom* localName;
+    PRInt32 namespaceID;
+    if (parent->IsElement()) {
+      localName = static_cast<nsIContent*>(parent)->Tag();
+      namespaceID = static_cast<nsIContent*>(parent)->GetNameSpaceID();
+    } else {
+      NS_ASSERTION(parent->NodeType() == nsIDOMNode::DOCUMENT_FRAGMENT_NODE,
+        "How come the parent isn't a document, a fragment or an element?");
+      localName = nsGkAtoms::body;
+      namespaceID = kNameSpaceID_XHTML;
+    }
+    nsCOMPtr<nsIDOMDocumentFragment> df;
+    nsresult rv = NS_NewDocumentFragment(getter_AddRefs(df),
+                                         OwnerDoc()->NodeInfoManager());
+    NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIContent> fragment = do_QueryInterface(df);
+    nsContentUtils::ParseFragmentHTML(aOuterHTML,
+                                      fragment,
+                                      localName,
+                                      namespaceID,
+                                      OwnerDoc()->GetCompatibilityMode() ==
+                                        eCompatibility_NavQuirks,
+                                      PR_TRUE);
+    parent->ReplaceChild(fragment, this, &rv);
+    return rv;
+  }
+
+  nsCOMPtr<nsINode> context;
+  if (parent->IsElement()) {
+    context = parent;
+  } else {
+    NS_ASSERTION(parent->NodeType() == nsIDOMNode::DOCUMENT_FRAGMENT_NODE,
+      "How come the parent isn't a document, a fragment or an element?");
+    nsCOMPtr<nsINodeInfo> info =
+      OwnerDoc()->NodeInfoManager()->GetNodeInfo(nsGkAtoms::body,
+                                                 nsnull,
+                                                 kNameSpaceID_XHTML,
+                                                 nsIDOMNode::ELEMENT_NODE);
+    context = NS_NewHTMLBodyElement(info.forget(), FROM_PARSER_FRAGMENT);
+  }
+
+  nsCOMPtr<nsIDOMDocumentFragment> df;
+  nsresult rv = nsContentUtils::CreateContextualFragment(context,
+                                                         aOuterHTML,
+                                                         PR_TRUE,
+                                                         getter_AddRefs(df));
+  NS_ENSURE_SUCCESS(rv, rv);
+  nsCOMPtr<nsINode> fragment = do_QueryInterface(df);
+  parent->ReplaceChild(fragment, this, &rv);
+  return rv;
+}
+
 enum nsAdjacentPosition {
   eBeforeBegin,
   eAfterBegin,
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index 41641a2edc03..9172bc10438e 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -132,6 +132,8 @@ public:
   nsresult GetOffsetParent(nsIDOMElement** aOffsetParent);
   NS_IMETHOD GetInnerHTML(nsAString& aInnerHTML);
   NS_IMETHOD SetInnerHTML(const nsAString& aInnerHTML);
+  NS_IMETHOD GetOuterHTML(nsAString& aOuterHTML);
+  NS_IMETHOD SetOuterHTML(const nsAString& aOuterHTML);
   NS_IMETHOD InsertAdjacentHTML(const nsAString& aPosition,
                                 const nsAString& aText);
   nsresult ScrollIntoView(bool aTop, PRUint8 optional_argc);
@@ -161,6 +163,10 @@ public:
   nsresult ClearDataset();
   nsresult GetContextMenu(nsIDOMHTMLMenuElement** aContextMenu);
 
+protected:
+  nsresult GetMarkup(bool aIncludeSelf, nsAString& aMarkup);
+
+public:
   // Implementation for nsIContent
   virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                               nsIContent* aBindingParent,
@@ -1571,6 +1577,12 @@ protected:
   NS_SCRIPTABLE NS_IMETHOD SetSpellcheck(bool aSpellcheck) { \
     return _to SetSpellcheck(aSpellcheck); \
   } \
+  NS_SCRIPTABLE NS_IMETHOD GetOuterHTML(nsAString& aOuterHTML) { \
+    return _to GetOuterHTML(aOuterHTML); \
+  } \
+  NS_SCRIPTABLE NS_IMETHOD SetOuterHTML(const nsAString& aOuterHTML) { \
+    return _to SetOuterHTML(aOuterHTML); \
+  } \
   NS_SCRIPTABLE NS_IMETHOD InsertAdjacentHTML(const nsAString& position, const nsAString& text) { \
     return _to InsertAdjacentHTML(position, text); \
   } \
diff --git a/content/html/content/src/nsHTMLAnchorElement.cpp b/content/html/content/src/nsHTMLAnchorElement.cpp
index 10a6ab810bf2..af5fbca85742 100644
--- a/content/html/content/src/nsHTMLAnchorElement.cpp
+++ b/content/html/content/src/nsHTMLAnchorElement.cpp
@@ -118,7 +118,6 @@ public:
   virtual bool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
   virtual nsLinkState GetLinkState() const;
-  virtual void RequestLinkStateUpdate();
   virtual already_AddRefed<nsIURI> GetHrefURI() const;
 
   nsresult SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
@@ -216,9 +215,13 @@ nsHTMLAnchorElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Prefetch links
-  if (aDocument && nsHTMLDNSPrefetch::IsAllowed(OwnerDoc())) {
-    nsHTMLDNSPrefetch::PrefetchLow(this);
+  if (aDocument) {
+    aDocument->RegisterPendingLinkUpdate(this);
+    if (nsHTMLDNSPrefetch::IsAllowed(OwnerDoc())) {
+      nsHTMLDNSPrefetch::PrefetchLow(this);
+    }
   }
+
   return rv;
 }
 
@@ -228,6 +231,11 @@ nsHTMLAnchorElement::UnbindFromTree(bool aDeep, bool aNullParent)
   // If this link is ever reinserted into a document, it might
   // be under a different xml:base, so forget the cached state now.
   Link::ResetLinkState(false);
+  
+  nsIDocument* doc = GetCurrentDoc();
+  if (doc) {
+    doc->UnregisterPendingLinkUpdate(this);
+  }
 
   nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
 }
@@ -389,12 +397,6 @@ nsHTMLAnchorElement::GetLinkState() const
   return Link::GetLinkState();
 }
 
-void
-nsHTMLAnchorElement::RequestLinkStateUpdate()
-{
-  UpdateLinkState(Link::LinkState());
-}
-
 already_AddRefed<nsIURI>
 nsHTMLAnchorElement::GetHrefURI() const
 {
diff --git a/content/html/content/src/nsHTMLAreaElement.cpp b/content/html/content/src/nsHTMLAreaElement.cpp
index 4a52c0ec74d3..ce8ed65e652e 100644
--- a/content/html/content/src/nsHTMLAreaElement.cpp
+++ b/content/html/content/src/nsHTMLAreaElement.cpp
@@ -99,7 +99,6 @@ public:
   virtual bool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
   virtual nsLinkState GetLinkState() const;
-  virtual void RequestLinkStateUpdate();
   virtual already_AddRefed<nsIURI> GetHrefURI() const;
 
   virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
@@ -213,7 +212,10 @@ nsHTMLAreaElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                               bool aCompileEventHandlers)
 {
   Link::ResetLinkState(false);
-
+  if (aDocument) {
+    aDocument->RegisterPendingLinkUpdate(this);
+  }
+  
   return nsGenericHTMLElement::BindToTree(aDocument, aParent,
                                                  aBindingParent,
                                                  aCompileEventHandlers);
@@ -225,6 +227,11 @@ nsHTMLAreaElement::UnbindFromTree(bool aDeep, bool aNullParent)
   // If this link is ever reinserted into a document, it might
   // be under a different xml:base, so forget the cached state now.
   Link::ResetLinkState(false);
+  
+  nsIDocument* doc = GetCurrentDoc();
+  if (doc) {
+    doc->UnregisterPendingLinkUpdate(this);
+  }
 
   nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
 }
@@ -314,12 +321,6 @@ nsHTMLAreaElement::GetLinkState() const
   return Link::GetLinkState();
 }
 
-void
-nsHTMLAreaElement::RequestLinkStateUpdate()
-{
-  UpdateLinkState(Link::LinkState());
-}
-
 already_AddRefed<nsIURI>
 nsHTMLAreaElement::GetHrefURI() const
 {
diff --git a/content/html/content/src/nsHTMLCanvasElement.cpp b/content/html/content/src/nsHTMLCanvasElement.cpp
index 8258e6dba820..b5d22d642c2b 100644
--- a/content/html/content/src/nsHTMLCanvasElement.cpp
+++ b/content/html/content/src/nsHTMLCanvasElement.cpp
@@ -501,8 +501,8 @@ nsHTMLCanvasElement::GetContext(const nsAString& aContextId,
 
         JSObject *opts = JSVAL_TO_OBJECT(aContextOptions);
         JSIdArray *props = JS_Enumerate(cx, opts);
-        for (int i = 0; props && i < props->length; ++i) {
-          jsid propid = props->vector[i];
+        for (int i = 0; props && i < JS_IdArrayLength(cx, props); ++i) {
+          jsid propid = JS_IdArrayGet(cx, props, i);
           jsval propname, propval;
           if (!JS_IdToValue(cx, propid, &propname) ||
               !JS_GetPropertyById(cx, opts, propid, &propval))
diff --git a/content/html/content/src/nsHTMLDNSPrefetch.cpp b/content/html/content/src/nsHTMLDNSPrefetch.cpp
index d4fd536e4ad3..9541b78556ca 100644
--- a/content/html/content/src/nsHTMLDNSPrefetch.cpp
+++ b/content/html/content/src/nsHTMLDNSPrefetch.cpp
@@ -395,7 +395,8 @@ nsHTMLDNSPrefetch::nsDeferrals::OnProgressChange(nsIWebProgress *aProgress,
 NS_IMETHODIMP
 nsHTMLDNSPrefetch::nsDeferrals::OnLocationChange(nsIWebProgress* aWebProgress,
                                                  nsIRequest* aRequest,
-                                                 nsIURI *location)
+                                                 nsIURI *location,
+                                                 PRUint32 aFlags)
 {
   return NS_OK;
 }
diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
index aa05016f0719..da2f792604f1 100644
--- a/content/html/content/src/nsHTMLFormElement.cpp
+++ b/content/html/content/src/nsHTMLFormElement.cpp
@@ -1843,7 +1843,8 @@ nsHTMLFormElement::OnProgressChange(nsIWebProgress* aWebProgress,
 NS_IMETHODIMP
 nsHTMLFormElement::OnLocationChange(nsIWebProgress* aWebProgress,
                                     nsIRequest* aRequest,
-                                    nsIURI* location)
+                                    nsIURI* location,
+                                    PRUint32 aFlags)
 {
   NS_NOTREACHED("notification excluded in AddProgressListener(...)");
   return NS_OK;
diff --git a/content/html/content/src/nsHTMLLinkElement.cpp b/content/html/content/src/nsHTMLLinkElement.cpp
index 40e62037ad5d..94ee6f7bd67f 100644
--- a/content/html/content/src/nsHTMLLinkElement.cpp
+++ b/content/html/content/src/nsHTMLLinkElement.cpp
@@ -111,7 +111,6 @@ public:
   virtual bool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
   virtual nsLinkState GetLinkState() const;
-  virtual void RequestLinkStateUpdate();
   virtual already_AddRefed<nsIURI> GetHrefURI() const;
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
@@ -213,6 +212,10 @@ nsHTMLLinkElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                                                  aBindingParent,
                                                  aCompileEventHandlers);
   NS_ENSURE_SUCCESS(rv, rv);
+  
+  if (aDocument) {
+    aDocument->RegisterPendingLinkUpdate(this);
+  }
 
   void (nsHTMLLinkElement::*update)() = &nsHTMLLinkElement::UpdateStyleSheetInternal;
   nsContentUtils::AddScriptRunner(NS_NewRunnableMethod(this, update));
@@ -246,6 +249,9 @@ nsHTMLLinkElement::UnbindFromTree(bool aDeep, bool aNullParent)
   // Once we have XPCOMGC we shouldn't need to call UnbindFromTree during Unlink
   // and so this messy event dispatch can go away.
   nsCOMPtr<nsIDocument> oldDoc = GetCurrentDoc();
+  if (oldDoc) {
+    oldDoc->UnregisterPendingLinkUpdate(this);
+  }
   CreateAndDispatchEvent(oldDoc, NS_LITERAL_STRING("DOMLinkRemoved"));
   nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
   UpdateStyleSheetInternal(oldDoc);
@@ -379,12 +385,6 @@ nsHTMLLinkElement::GetLinkState() const
   return Link::GetLinkState();
 }
 
-void
-nsHTMLLinkElement::RequestLinkStateUpdate()
-{
-  UpdateLinkState(Link::LinkState());
-}
-
 already_AddRefed<nsIURI>
 nsHTMLLinkElement::GetHrefURI() const
 {
diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index 104a8c7847e0..4a30ab38ee30 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -274,6 +274,9 @@ _TEST_FILES = \
 		test_bug583533.html \
 		test_restore_from_parser_fragment.html \
 		test_bug617528.html \
+		test_bug660959-1.html \
+		test_bug660959-2.html \
+		test_bug660959-3.html \
 		test_checked.html \
 		test_bug677658.html \
 		test_bug677463.html \
@@ -286,6 +289,8 @@ _TEST_FILES = \
 		file_fullscreen-denied-inner.html \
 		file_fullscreen-hidden.html \
 		file_fullscreen-navigation.html \
+		file_fullscreen-esc-exit.html \
+		file_fullscreen-esc-exit-inner.html \
 		test_li_attributes_reflection.html \
 		test_ol_attributes_reflection.html \
 		test_bug651956.html \
diff --git a/content/html/content/test/file_fullscreen-esc-exit-inner.html b/content/html/content/test/file_fullscreen-esc-exit-inner.html
new file mode 100644
index 000000000000..115d61ebb049
--- /dev/null
+++ b/content/html/content/test/file_fullscreen-esc-exit-inner.html
@@ -0,0 +1,58 @@
+ <!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=700764
+
+Verify that an ESC key press in a subdoc of a full-screen doc causes us to
+exit DOM full-screen mode.
+
+-->
+<head>
+  <title>Test for Bug 700764</title>
+  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <style>
+    body:not(:-moz-full-screen) {
+      background-color: blue;
+    }
+  </style>
+</head>
+<body>
+
+<script type="application/javascript">
+
+/** Test for Bug 700764 **/
+
+function ok(condition, msg) {
+  parent.ok(condition, msg);
+}
+
+function is(a, b, msg) {
+  parent.is(a, b, msg);
+}
+
+var escKeyReceived = false;
+var escKeySent = false;
+
+function keyHandler(event) {
+  if (escKeyReceived == Components.interfaces.nsIDOMKeyEvent.DOM_VK_ESC) {
+    escKeyReceived = true;
+  }
+}
+
+window.addEventListener("keydown", keyHandler, true);
+window.addEventListener("keyup", keyHandler, true);
+window.addEventListener("keypress", keyHandler, true);
+
+function startTest() {
+  ok(!document.mozFullScreen, "Subdoc should not be in full-screen mode");
+  ok(parent.document.mozFullScreen, "Parent should be in full-screen mode");
+  escKeySent = true;
+  window.focus();
+  synthesizeKey("VK_ESCAPE", {});
+}
+
+</script>
+</pre>
+<p>Inner frame</p>
+</body>
+</html>
diff --git a/content/html/content/test/file_fullscreen-esc-exit.html b/content/html/content/test/file_fullscreen-esc-exit.html
new file mode 100644
index 000000000000..ae17d06c7e2d
--- /dev/null
+++ b/content/html/content/test/file_fullscreen-esc-exit.html
@@ -0,0 +1,63 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=700764
+
+Verify that an ESC key press in a subdoc of a full-screen doc causes us to
+exit DOM full-screen mode.
+
+-->
+<head>
+  <title>Test for Bug 700764</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <style>
+  body:-moz-full-screen, div:-moz-full-screen {
+    background-color: red;
+  }
+  </style>
+</head>
+<body onload="startTest();">
+
+<script type="application/javascript">
+
+function ok(condition, msg) {
+  opener.ok(condition, msg);
+}
+
+function is(a, b, msg) {
+  opener.is(a, b, msg);
+}
+
+function finish() {
+  opener.nextTest();
+}
+
+function fullscreenchange1(event) {
+  ok(document.mozFullScreen, "Should have entered full-screen mode");
+  document.removeEventListener("mozfullscreenchange", fullscreenchange1, false);
+  document.addEventListener("mozfullscreenchange", fullscreenchange2, false);
+  ok(!document.getElementById("subdoc").contentWindow.escKeySent, "Should not yet have sent ESC key press.");
+  document.getElementById("subdoc").contentWindow.startTest();
+}
+
+function fullscreenchange2(event) {
+  document.removeEventListener("mozfullscreenchange", fullscreenchange2, false);
+  ok(document.getElementById("subdoc").contentWindow.escKeySent, "Should have sent ESC key press.");
+  ok(!document.getElementById("subdoc").contentWindow.escKeyReceived, "ESC key press to exit should not be delivered.");
+  ok(!document.mozFullScreen, "Should have left full-screen mode on ESC key press");
+  finish();
+}
+
+function startTest() {
+  document.addEventListener("mozfullscreenchange", fullscreenchange1, false);
+  SimpleTest.waitForFocus(function() {document.body.mozRequestFullScreen();});
+}
+
+</script>
+
+<!-- This subframe conducts the test. -->
+<iframe id="subdoc" src="file_fullscreen-esc-exit-inner.html"></iframe>
+
+</pre>
+</body>
+</html>
diff --git a/content/html/content/test/reflect.js b/content/html/content/test/reflect.js
index 4b019db982a2..99445d4663ee 100644
--- a/content/html/content/test/reflect.js
+++ b/content/html/content/test/reflect.js
@@ -468,22 +468,12 @@ function reflectInt(aParameters)
   }
 
   function stringToInteger(value, nonNegative, defaultValue) {
-    if (nonNegative === false) {
-      // Parse: Ignore leading whitespace, find [+/-][numbers]
-      var result = /^[ \t\n\f\r]*([\+\-]?[0-9]+)/.exec(value);
-      if (result) {
-        if (-0x80000000 <= result[1] && result[1] <= 0x7FFFFFFF) {
-          // If the value is within allowed value range for signed integer, return value
-          return result[1];
-        }
-      }
-    } else {
-      var result = /^[ \t\n\f\r]*(\+?[0-9]+)/.exec(value);
-      if (result) {
-        if (0 <= result[1] && result[1] <= 0x7FFFFFFF) {
-          // If the value is within allowed value range for non-negative integer, return value
-          return result[1];
-        }
+    // Parse: Ignore leading whitespace, find [+/-][numbers]
+    var result = /^[ \t\n\f\r]*([\+\-]?[0-9]+)/.exec(value);
+    if (result) {
+      if ((nonNegative ? 0:-0x80000000) <= result[1] && result[1] <= 0x7FFFFFFF) {
+        // If the value is within allowed value range for signed/unsigned integer, return value
+        return result[1];
       }
     }
     return defaultValue;
@@ -551,10 +541,6 @@ function reflectInt(aParameters)
       //TBD: Bug 586761: .setAttribute(attr, -2147483648) --> element[attr] == defaultValue instead of -2147483648
       todo_is(element[attr], intValue, "Bug 586761: " + element.localName +
         ".setAttribute(value, " + v + "), " + element.localName + "[" + attr + "] ");
-    } else if ((v === "-0" || v == "-0xABCDEF") && nonNegative) {
-      //TBD: Bug 688093: Non-negative integers should return defaultValue when attempting to reflect "-0"
-      todo_is(element[attr], intValue, "Bug 688093: " + element.localName +
-        ".setAttribute(" + attr + ", " + v + "), " + element.localName + "[" + attr + "] ");
     } else {
       is(element[attr], intValue, element.localName +
         ".setAttribute(" + attr + ", " + v + "), " + element.localName + "[" + attr + "] ");
diff --git a/content/html/content/test/test_bug660959-1.html b/content/html/content/test/test_bug660959-1.html
new file mode 100644
index 000000000000..0bffa0e05e6e
--- /dev/null
+++ b/content/html/content/test/test_bug660959-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=660959
+-->
+<head>
+  <title>Test for Bug 660959</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script src="reflect.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=660959">Mozilla Bug 660959</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  <a href="#" id="testa"></a>
+</div>
+<pre id="test">
+<script>
+    is($("content").querySelector(":link, :visited"), $("testa"),
+       "Should find a link even in a display:none subtree");
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/html/content/test/test_bug660959-2.html b/content/html/content/test/test_bug660959-2.html
new file mode 100644
index 000000000000..a4d74b6e3b64
--- /dev/null
+++ b/content/html/content/test/test_bug660959-2.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=660959
+-->
+<head>
+  <title>Test for Bug 660959</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script src="reflect.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <style>
+    :link, :visited {
+      color: red;
+    }
+  </style>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=660959">Mozilla Bug 660959</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  <a href="#" id="a"></a>
+</div>
+<pre id="test">
+<script type="application/javascript">
+  var a = document.getElementById("a");
+  is(window.getComputedStyle(a).color, "rgb(255, 0, 0)", "Link is not right color?");
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/html/content/test/test_bug660959-3.html b/content/html/content/test/test_bug660959-3.html
new file mode 100644
index 000000000000..4539a0449c18
--- /dev/null
+++ b/content/html/content/test/test_bug660959-3.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=660959
+-->
+<head>
+  <title>Test for Bug 660959</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script src="reflect.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=660959">Mozilla Bug 660959</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  <a href="http://www.example.com"></a>
+  <div id="foo">
+    <span id="test"></span>
+  </div>
+</div>
+<pre id="test">
+<script>
+    is($("foo").querySelector(":link + * span, :visited + * span"), $("test"),
+       "Should be able to find link siblings even in a display:none subtree");
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/html/content/test/test_fullscreen-api.html b/content/html/content/test/test_fullscreen-api.html
index 60e95671d174..fdfd7290ce2d 100644
--- a/content/html/content/test/test_fullscreen-api.html
+++ b/content/html/content/test/test_fullscreen-api.html
@@ -36,6 +36,7 @@ SpecialPowers.setBoolPref("full-screen-api.allow-trusted-requests-only", false);
 // run in an iframe, which by default will not have the mozallowfullscreen
 // attribute set, so full-screen won't work.
 var gTestWindows = [
+  "file_fullscreen-esc-exit.html",
   "file_fullscreen-denied.html",
   "file_fullscreen-api.html",
   "file_fullscreen-api-keys.html",
diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
index ffbc057a868c..79c8c3b12016 100644
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -1600,6 +1600,16 @@ nsHTMLDocument::Open(const nsAString& aContentTypeOrUrl,
     return NS_OK;
   }
 
+  // No calling document.open() without a script global object
+  if (!mScriptGlobalObject) {
+    return NS_OK;
+  }
+
+  nsPIDOMWindow* outer = GetWindow();
+  if (!outer || (GetInnerWindow() != outer->GetCurrentInnerWindow())) {
+    return NS_OK;
+  }
+
   // check whether we're in the middle of unload.  If so, ignore this call.
   nsCOMPtr<nsIDocShell> shell = do_QueryReferent(mDocumentContainer);
   if (!shell) {
diff --git a/content/mathml/content/src/nsMathMLElement.cpp b/content/mathml/content/src/nsMathMLElement.cpp
index 8fe6eed42122..a78498a46705 100644
--- a/content/mathml/content/src/nsMathMLElement.cpp
+++ b/content/mathml/content/src/nsMathMLElement.cpp
@@ -89,19 +89,23 @@ nsMathMLElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                                                 aCompileEventHandlers);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (aDocument && !aDocument->GetMathMLEnabled()) {
-    // Enable MathML and setup the style sheet during binding, not element
-    // construction, because we could move a MathML element from the document
-    // that created it to another document.
-    aDocument->SetMathMLEnabled();
-    aDocument->EnsureCatalogStyleSheet(kMathMLStyleSheetURI);
+  if (aDocument) {
+    aDocument->RegisterPendingLinkUpdate(this);
+    
+    if (!aDocument->GetMathMLEnabled()) {
+      // Enable MathML and setup the style sheet during binding, not element
+      // construction, because we could move a MathML element from the document
+      // that created it to another document.
+      aDocument->SetMathMLEnabled();
+      aDocument->EnsureCatalogStyleSheet(kMathMLStyleSheetURI);
 
-    // Rebuild style data for the presshell, because style system
-    // optimizations may have taken place assuming MathML was disabled.
-    // (See nsRuleNode::CheckSpecifiedProperties.)
-    nsCOMPtr<nsIPresShell> shell = aDocument->GetShell();
-    if (shell) {
-      shell->GetPresContext()->PostRebuildAllStyleDataEvent(nsChangeHint(0));
+      // Rebuild style data for the presshell, because style system
+      // optimizations may have taken place assuming MathML was disabled.
+      // (See nsRuleNode::CheckSpecifiedProperties.)
+      nsCOMPtr<nsIPresShell> shell = aDocument->GetShell();
+      if (shell) {
+        shell->GetPresContext()->PostRebuildAllStyleDataEvent(nsChangeHint(0));
+      }
     }
   }
 
@@ -114,6 +118,11 @@ nsMathMLElement::UnbindFromTree(bool aDeep, bool aNullParent)
   // If this link is ever reinserted into a document, it might
   // be under a different xml:base, so forget the cached state now.
   Link::ResetLinkState(false);
+  
+  nsIDocument* doc = GetCurrentDoc();
+  if (doc) {
+    doc->UnregisterPendingLinkUpdate(this);
+  }
 
   nsMathMLElementBase::UnbindFromTree(aDeep, aNullParent);
 }
@@ -622,12 +631,6 @@ nsMathMLElement::GetLinkState() const
   return Link::GetLinkState();
 }
 
-void
-nsMathMLElement::RequestLinkStateUpdate()
-{
-  UpdateLinkState(Link::LinkState());
-}
-
 already_AddRefed<nsIURI>
 nsMathMLElement::GetHrefURI() const
 {
diff --git a/content/mathml/content/src/nsMathMLElement.h b/content/mathml/content/src/nsMathMLElement.h
index 486def6d433e..6be1bea7ff3f 100644
--- a/content/mathml/content/src/nsMathMLElement.h
+++ b/content/mathml/content/src/nsMathMLElement.h
@@ -116,7 +116,6 @@ public:
   virtual bool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
   virtual nsLinkState GetLinkState() const;
-  virtual void RequestLinkStateUpdate();
   virtual already_AddRefed<nsIURI> GetHrefURI() const;
   nsresult SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                    const nsAString& aValue, bool aNotify)
diff --git a/content/media/nsBuiltinDecoder.h b/content/media/nsBuiltinDecoder.h
index fcfe08180d2c..03cd8c8b3160 100644
--- a/content/media/nsBuiltinDecoder.h
+++ b/content/media/nsBuiltinDecoder.h
@@ -501,7 +501,9 @@ class nsBuiltinDecoder : public nsMediaDecoder
   }
 
   virtual void NotifyDataArrived(const char* aBuffer, PRUint32 aLength, PRUint32 aOffset) {
-    return mDecoderStateMachine->NotifyDataArrived(aBuffer, aLength, aOffset);
+    if (mDecoderStateMachine) {
+      mDecoderStateMachine->NotifyDataArrived(aBuffer, aLength, aOffset);
+    }
   }
 
   // Sets the length of the framebuffer used in MozAudioAvailable events.
diff --git a/content/smil/crashtests/690994-1.svg b/content/smil/crashtests/690994-1.svg
new file mode 100644
index 000000000000..45c60b90ef8d
--- /dev/null
+++ b/content/smil/crashtests/690994-1.svg
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+<![CDATA[
+function boom()
+{
+  document.documentElement.removeChild(document.getElementById("a"));
+  document.documentElement.removeAttribute("class");
+}
+]]>
+</script>
+<animate id="a" begin="a.end; -0.1s" end="a.begin+0.2s" onend="boom()"/>
+<animate id="a" begin="a.end; -0.1s" end="a.begin+0.2s"/>
+</svg>
diff --git a/content/smil/crashtests/697640-1.svg b/content/smil/crashtests/697640-1.svg
new file mode 100644
index 000000000000..c2e1b89fdbb7
--- /dev/null
+++ b/content/smil/crashtests/697640-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animate id="b" end="b.end" dur="3s" />
+</svg>
diff --git a/content/smil/crashtests/crashtests.list b/content/smil/crashtests/crashtests.list
index 3289584e4a7a..17c458eb74db 100644
--- a/content/smil/crashtests/crashtests.list
+++ b/content/smil/crashtests/crashtests.list
@@ -42,4 +42,6 @@ load 670313-1.svg
 load 678822-1.svg
 load 678847-1.svg
 load 678938-1.svg
+load 690994-1.svg
+load 697640-1.svg
 load 699325-1.svg
diff --git a/content/smil/nsSMILTimedElement.cpp b/content/smil/nsSMILTimedElement.cpp
index caababa24a35..d564cf16c09e 100644
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -1622,10 +1622,6 @@ nsSMILTimedElement::GetNextInterval(const nsSMILInterval* aPrevInterval,
     beginAfter = aPrevInterval->End()->Time();
     prevIntervalWasZeroDur
       = aPrevInterval->End()->Time() == aPrevInterval->Begin()->Time();
-    if (aFixedBeginTime) {
-      prevIntervalWasZeroDur &=
-        aPrevInterval->Begin()->Time() == aFixedBeginTime->Time();
-    }
   } else {
     beginAfter.SetMillis(LL_MININT);
   }
@@ -1647,17 +1643,17 @@ nsSMILTimedElement::GetNextInterval(const nsSMILInterval* aPrevInterval,
       tempBegin = new nsSMILInstanceTime(nsSMILTimeValue(0));
     } else {
       PRInt32 beginPos = 0;
-      // If we're updating the current interval then skip any begin time that is
-      // dependent on the current interval's begin time. e.g.
-      //   <animate id="a" begin="b.begin; a.begin+2s"...
-      // If b's interval disappears whilst 'a' is in the waiting state the begin
-      // time at "a.begin+2s" should be skipped since 'a' never begun.
       do {
         tempBegin =
           GetNextGreaterOrEqual(mBeginInstances, beginAfter, beginPos);
         if (!tempBegin || !tempBegin->Time().IsDefinite()) {
           return false;
         }
+      // If we're updating the current interval then skip any begin time that is
+      // dependent on the current interval's begin time. e.g.
+      //   <animate id="a" begin="b.begin; a.begin+2s"...
+      // If b's interval disappears whilst 'a' is in the waiting state the begin
+      // time at "a.begin+2s" should be skipped since 'a' never begun.
       } while (aReplacedInterval &&
                tempBegin->GetBaseTime() == aReplacedInterval->Begin());
     }
@@ -1668,37 +1664,55 @@ nsSMILTimedElement::GetNextInterval(const nsSMILInterval* aPrevInterval,
     // Calculate end time
     {
       PRInt32 endPos = 0;
-      // As above with begin times, avoid creating self-referential loops
-      // between instance times by checking that the newly found end instance
-      // time is not already dependent on the end of the current interval.
       do {
         tempEnd =
           GetNextGreaterOrEqual(mEndInstances, tempBegin->Time(), endPos);
+
+        // SMIL doesn't allow for coincident zero-duration intervals, so if the
+        // previous interval was zero-duration, and tempEnd is going to give us
+        // another zero duration interval, then look for another end to use
+        // instead.
+        if (tempEnd && prevIntervalWasZeroDur &&
+            tempEnd->Time() == beginAfter) {
+          tempEnd = GetNextGreater(mEndInstances, tempBegin->Time(), endPos);
+        }
+      // As above with begin times, avoid creating self-referential loops
+      // between instance times by checking that the newly found end instance
+      // time is not already dependent on the end of the current interval.
       } while (tempEnd && aReplacedInterval &&
                tempEnd->GetBaseTime() == aReplacedInterval->End());
 
-      // If the last interval ended at the same point and was zero-duration and
-      // this one is too, look for another end to use instead
-      if (tempEnd && tempEnd->Time() == tempBegin->Time() &&
-          prevIntervalWasZeroDur) {
-        tempEnd = GetNextGreater(mEndInstances, tempBegin->Time(), endPos);
-      }
-
-      // If all the ends are before the beginning we have a bad interval UNLESS:
-      // a) We never had any end attribute to begin with (and hence we should
-      //    just use the active duration after allowing for the possibility of
-      //    an end instance provided by a DOM call), OR
-      // b) We have no definite end instances (SMIL only says "if the instance
-      //    list is empty"--but if we have indefinite/unresolved instance times
-      //    then there must be a good reason we haven't used them (since they
-      //    will be >= tempBegin) such as avoiding creating a self-referential
-      //    loop. In any case, the interval should be allowed to be open.), OR
-      // c) We have end events which leave the interval open-ended.
-      bool openEndedIntervalOk = mEndSpecs.IsEmpty() ||
-                                   !HaveDefiniteEndTimes() ||
+      if (!tempEnd) {
+        // If all the ends are before the beginning we have a bad interval
+        // UNLESS:
+        // a) We never had any end attribute to begin with (the SMIL pseudocode
+        //    places this condition earlier in the flow but that fails to allow
+        //    for DOM calls when no "indefinite" condition is given), OR
+        // b) We never had any end instance times to begin with, OR
+        // c) We have end events which leave the interval open-ended.
+        bool openEndedIntervalOk = mEndSpecs.IsEmpty() ||
+                                   mEndInstances.IsEmpty() ||
                                    EndHasEventConditions();
-      if (!tempEnd && !openEndedIntervalOk)
-        return false; // Bad interval
+
+        // The above conditions correspond with the SMIL pseudocode but SMIL
+        // doesn't address self-dependent instance times which we choose to
+        // ignore.
+        //
+        // Therefore we add a qualification of (b) above that even if
+        // there are end instance times but they all depend on the end of the
+        // current interval we should act as if they didn't exist and allow the
+        // open-ended interval.
+        //
+        // In the following condition we don't use |= because it doesn't provide
+        // short-circuit behavior.
+        openEndedIntervalOk = openEndedIntervalOk ||
+                             (aReplacedInterval &&
+                              AreEndTimesDependentOn(aReplacedInterval->End()));
+
+        if (!openEndedIntervalOk) {
+          return false; // Bad interval
+        }
+      }
 
       nsSMILTimeValue intervalEnd = tempEnd
                                   ? tempEnd->Time() : nsSMILTimeValue();
@@ -1710,17 +1724,21 @@ nsSMILTimedElement::GetNextInterval(const nsSMILInterval* aPrevInterval,
     }
     NS_ABORT_IF_FALSE(tempEnd, "Failed to get end point for next interval");
 
-    // If we get two zero-length intervals in a row we will potentially have an
-    // infinite loop so we break it here by searching for the next begin time
-    // greater than tempEnd on the next time around.
-    if (tempEnd->Time().IsDefinite() && tempBegin->Time() == tempEnd->Time()) {
+    // When we choose the interval endpoints, we don't allow coincident
+    // zero-duration intervals, so if we arrive here and we have a zero-duration
+    // interval starting at the same point as a previous zero-duration interval,
+    // then it must be because we've applied constraints to the active duration.
+    // In that case, we will potentially run into an infinite loop, so we break
+    // it by searching for the next interval that starts AFTER our current
+    // zero-duration interval.
+    if (prevIntervalWasZeroDur && tempEnd->Time() == beginAfter) {
       if (prevIntervalWasZeroDur) {
-        beginAfter.SetMillis(tempEnd->Time().GetMillis() + 1);
+        beginAfter.SetMillis(tempBegin->Time().GetMillis() + 1);
         prevIntervalWasZeroDur = false;
         continue;
       }
-      prevIntervalWasZeroDur = true;
     }
+    prevIntervalWasZeroDur = tempBegin->Time() == tempEnd->Time();
 
     // Check for valid interval
     if (tempEnd->Time() > zeroTime ||
@@ -2252,17 +2270,6 @@ nsSMILTimedElement::GetPreviousInterval() const
     : mOldIntervals[mOldIntervals.Length()-1].get();
 }
 
-bool
-nsSMILTimedElement::HaveDefiniteEndTimes() const
-{
-  if (mEndInstances.IsEmpty())
-    return false;
-
-  // mEndInstances is sorted so if the first time is not definite then none of
-  // them are
-  return mEndInstances[0]->Time().IsDefinite();
-}
-
 bool
 nsSMILTimedElement::EndHasEventConditions() const
 {
@@ -2273,6 +2280,21 @@ nsSMILTimedElement::EndHasEventConditions() const
   return false;
 }
 
+bool
+nsSMILTimedElement::AreEndTimesDependentOn(
+  const nsSMILInstanceTime* aBase) const
+{
+  if (mEndInstances.IsEmpty())
+    return false;
+
+  for (PRUint32 i = 0; i < mEndInstances.Length(); ++i) {
+    if (mEndInstances[i]->GetBaseTime() != aBase) {
+      return false;
+    }
+  }
+  return true;
+}
+
 //----------------------------------------------------------------------
 // Hashtable callback functions
 
diff --git a/content/smil/nsSMILTimedElement.h b/content/smil/nsSMILTimedElement.h
index 08c88227b636..1d796cc86051 100644
--- a/content/smil/nsSMILTimedElement.h
+++ b/content/smil/nsSMILTimedElement.h
@@ -525,8 +525,9 @@ protected:
   const nsSMILInstanceTime* GetEffectiveBeginInstance() const;
   const nsSMILInterval* GetPreviousInterval() const;
   bool              HasPlayed() const { return !mOldIntervals.IsEmpty(); }
-  bool              HaveDefiniteEndTimes() const;
   bool              EndHasEventConditions() const;
+  bool              AreEndTimesDependentOn(
+                      const nsSMILInstanceTime* aBase) const;
 
   // Reset the current interval by first passing ownership to a temporary
   // variable so that if Unlink() results in us receiving a callback,
diff --git a/content/svg/content/src/SVGLengthList.cpp b/content/svg/content/src/SVGLengthList.cpp
index 313a4fc93ba1..eb11d6bdd7b8 100644
--- a/content/svg/content/src/SVGLengthList.cpp
+++ b/content/svg/content/src/SVGLengthList.cpp
@@ -42,6 +42,7 @@
 #include "nsContentUtils.h"
 #include "nsString.h"
 #include "nsSVGUtils.h"
+#include "nsCharSeparatedTokenizer.h"
 #include "string.h"
 
 namespace mozilla {
@@ -85,32 +86,23 @@ SVGLengthList::SetValueFromString(const nsAString& aValue)
 {
   SVGLengthList temp;
 
-  NS_ConvertUTF16toUTF8 value(aValue);
-  char* start = SkipWhitespace(value.BeginWriting());
+  nsCharSeparatedTokenizerTemplate<IsSVGWhitespace>
+    tokenizer(aValue, ',', nsCharSeparatedTokenizer::SEPARATOR_OPTIONAL);
 
-  // We can't use strtok with SVG_COMMA_WSP_DELIM because to correctly handle
-  // invalid input in the form of two commas without a value between them, we
-  // would need to know if strtok overwrote a comma or not.
+  nsCAutoString str;  // outside loop to minimize memory churn
 
-  while (*start != '\0') {
-    int end = strcspn(start, SVG_COMMA_WSP_DELIM);
-    if (end == 0) {
-      // found comma in an invalid location
-      return NS_ERROR_DOM_SYNTAX_ERR;
-    }
+  while (tokenizer.hasMoreTokens()) {
     SVGLength length;
-    if (!length.SetValueFromString(NS_ConvertUTF8toUTF16(start, PRUint32(end)))) {
+    if (!length.SetValueFromString(tokenizer.nextToken())) {
       return NS_ERROR_DOM_SYNTAX_ERR;
     }
     if (!temp.AppendItem(length)) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
-    start = SkipWhitespace(start + end);
-    if (*start == ',') {
-      start = SkipWhitespace(start + 1);
-    }
   }
-
+  if (tokenizer.lastTokenEndedWithSeparator()) {
+    return NS_ERROR_DOM_SYNTAX_ERR; // trailing comma
+  }
   return CopyFrom(temp);
 }
 
diff --git a/content/svg/content/src/SVGNumberList.cpp b/content/svg/content/src/SVGNumberList.cpp
index 11e850a843d4..eab100655472 100644
--- a/content/svg/content/src/SVGNumberList.cpp
+++ b/content/svg/content/src/SVGNumberList.cpp
@@ -102,7 +102,9 @@ SVGNumberList::SetValueFromString(const nsAString& aValue)
     if (*end != '\0' || !NS_finite(num)) {
       return NS_ERROR_DOM_SYNTAX_ERR;
     }
-    temp.AppendItem(num);
+    if (!temp.AppendItem(num)) {
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
   }
   if (tokenizer.lastTokenEndedWithSeparator()) {
     return NS_ERROR_DOM_SYNTAX_ERR; // trailing comma
diff --git a/content/svg/content/src/nsSVGAElement.cpp b/content/svg/content/src/nsSVGAElement.cpp
index 7bc01fc3c790..80d48f4c27ee 100644
--- a/content/svg/content/src/nsSVGAElement.cpp
+++ b/content/svg/content/src/nsSVGAElement.cpp
@@ -145,6 +145,10 @@ nsSVGAElement::BindToTree(nsIDocument *aDocument, nsIContent *aParent,
                                               aBindingParent,
                                               aCompileEventHandlers);
   NS_ENSURE_SUCCESS(rv, rv);
+  
+  if (aDocument) {
+    aDocument->RegisterPendingLinkUpdate(this);
+  }
 
   return NS_OK;
 }
@@ -155,6 +159,11 @@ nsSVGAElement::UnbindFromTree(bool aDeep, bool aNullParent)
   // If this link is ever reinserted into a document, it might
   // be under a different xml:base, so forget the cached state now.
   Link::ResetLinkState(false);
+  
+  nsIDocument* doc = GetCurrentDoc();
+  if (doc) {
+    doc->UnregisterPendingLinkUpdate(this);
+  }
 
   nsSVGAElementBase::UnbindFromTree(aDeep, aNullParent);
 }
@@ -165,12 +174,6 @@ nsSVGAElement::GetLinkState() const
   return Link::GetLinkState();
 }
 
-void
-nsSVGAElement::RequestLinkStateUpdate()
-{
-  UpdateLinkState(Link::LinkState());
-}
-
 already_AddRefed<nsIURI>
 nsSVGAElement::GetHrefURI() const
 {
diff --git a/content/svg/content/src/nsSVGAElement.h b/content/svg/content/src/nsSVGAElement.h
index 8166620fc15a..f1b39d992e17 100644
--- a/content/svg/content/src/nsSVGAElement.h
+++ b/content/svg/content/src/nsSVGAElement.h
@@ -91,7 +91,6 @@ public:
   virtual bool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
   virtual nsLinkState GetLinkState() const;
-  virtual void RequestLinkStateUpdate();
   virtual already_AddRefed<nsIURI> GetHrefURI() const;
   virtual nsEventStates IntrinsicState() const;
   nsresult SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
diff --git a/content/svg/content/src/nsSVGPathElement.cpp b/content/svg/content/src/nsSVGPathElement.cpp
index 8b1e258d173e..d0063d503555 100644
--- a/content/svg/content/src/nsSVGPathElement.cpp
+++ b/content/svg/content/src/nsSVGPathElement.cpp
@@ -427,7 +427,7 @@ nsSVGPathElement::ConstructPath(gfxContext *aCtx)
 }
 
 gfxFloat
-nsSVGPathElement::GetScale()
+nsSVGPathElement::GetPathLengthScale()
 {
   if (mPathLength.IsExplicitlySet()) {
 
diff --git a/content/svg/content/src/nsSVGPathElement.h b/content/svg/content/src/nsSVGPathElement.h
index 742f62060005..e5c011d8a7a6 100644
--- a/content/svg/content/src/nsSVGPathElement.h
+++ b/content/svg/content/src/nsSVGPathElement.h
@@ -98,7 +98,12 @@ public:
     return nsGkAtoms::d;
   }
 
-  gfxFloat GetScale();
+  /**
+   * Gets the ratio of the actual path length to the content author's estimated
+   * length (as provided by the <path> element's 'pathLength' attribute). This
+   * is used to scale stroke dashing, and to scale offsets along a textPath.
+   */
+  gfxFloat GetPathLengthScale();
 
 protected:
 
diff --git a/content/svg/content/src/nsSVGSVGElement.cpp b/content/svg/content/src/nsSVGSVGElement.cpp
index bda06d508a54..714b5af26e55 100644
--- a/content/svg/content/src/nsSVGSVGElement.cpp
+++ b/content/svg/content/src/nsSVGSVGElement.cpp
@@ -62,6 +62,7 @@
 #include "nsSVGSVGElement.h"
 #include "nsContentErrors.h" // For NS_PROPTABLE_PROP_OVERWRITTEN
 #include "nsContentUtils.h"
+#include "nsStyleUtil.h"
 
 #include "nsEventDispatcher.h"
 #include "nsSMILTimeContainer.h"
@@ -666,7 +667,17 @@ nsSVGSVGElement::CreateSVGTransformFromMatrix(nsIDOMSVGMatrix *matrix,
 NS_IMETHODIMP
 nsSVGSVGElement::GetElementById(const nsAString & elementId, nsIDOMElement **_retval)
 {
-  return NS_ERROR_NOT_IMPLEMENTED;
+  NS_ENSURE_ARG_POINTER(_retval);
+  *_retval = nsnull;
+
+  nsresult rv = NS_OK;
+  nsAutoString selector(NS_LITERAL_STRING("#"));
+  nsStyleUtil::AppendEscapedCSSIdent(PromiseFlatString(elementId), selector);
+  nsIContent* element = nsGenericElement::doQuerySelector(this, selector, &rv);
+  if (NS_SUCCEEDED(rv) && element) {
+    return CallQueryInterface(element, _retval);
+  }
+  return rv;
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/test/Makefile.in b/content/svg/content/test/Makefile.in
index 09aec53550d0..408c37eee6de 100644
--- a/content/svg/content/test/Makefile.in
+++ b/content/svg/content/test/Makefile.in
@@ -68,6 +68,7 @@ _TEST_FILES = \
 		dataTypes-helper.svg \
 		getCTM-helper.svg \
 		test_getCTM.html \
+		test_getElementById.xhtml \
 		test_getSubStringLength.xhtml \
 		getSubStringLength-helper.svg \
 		test_isSupported.xhtml \
diff --git a/content/svg/content/test/test_getElementById.xhtml b/content/svg/content/test/test_getElementById.xhtml
new file mode 100644
index 000000000000..863f520474ec
--- /dev/null
+++ b/content/svg/content/test/test_getElementById.xhtml
@@ -0,0 +1,67 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+  <title>Test getElementById behaviour</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="matrixUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<p id="display"></p>
+<div id="content">
+  <svg xmlns="http://www.w3.org/2000/svg" width="100%" height="1" id="svg">
+    <!-- decoy element, same Id but not a <g> -->
+    <rect id="g"/>
+    <svg id="inner">
+      <!-- the one we want to find -->
+      <g id="g"/>
+      <!-- check we don't get confused by CSS selectors -->
+      <g id="foo bar"/>
+      <g id="goo > car"/>
+      <g id="hoo~dar"/>
+      <g id="ioo+ear"/>
+    </svg>
+    <g id="g2"/>
+  </svg>
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+<![CDATA[
+
+SimpleTest.waitForExplicitFinish();
+
+function main()
+{
+  var svgns = "http://www.w3.org/2000/svg";
+  
+  var svg = document.getElementById("inner");
+  
+  is(svg.getElementById("g").nodeName, "g", "expected to find g element child");
+  is(svg.getElementById("foo bar").nodeName, "g", "expected to find foo bar element child");
+  is(svg.getElementById("goo > car").nodeName, "g", "expected to find goo > car element child");
+  is(svg.getElementById("hoo~dar").nodeName, "g", "expected to find hoo~dar element child");
+  is(svg.getElementById("ioo+ear").nodeName, "g", "expected to find ioo+ear element child");
+  
+  is(svg.getElementById("g2"), null, "did not expect to find an element with id g2");
+
+  // no element with Id = "g3" in the document at all
+  is(svg.getElementById("g3"), null, "did not expect to find an element with id g3");
+  
+  svg = document.createElementNS(svgns, "svg");
+  
+  var c = document.createElementNS(svgns, "circle");
+  c.setAttribute("id", "c");
+  svg.appendChild(c);
+
+  is(svg.getElementById("c").nodeName, "circle", "expected to find circle element child");
+
+  SimpleTest.finish();
+}
+
+window.addEventListener("load", main, false);
+
+]]>
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/xslt/src/base/txCore.h b/content/xslt/src/base/txCore.h
index 873b35298ea9..9d76cb5fd3ca 100644
--- a/content/xslt/src/base/txCore.h
+++ b/content/xslt/src/base/txCore.h
@@ -109,10 +109,7 @@ public:
 // XXX These should go away eventually.
 #define TxObject txObject
 typedef txDouble Double;
-typedef bool MBool;
 
-#define MB_TRUE  true
-#define MB_FALSE false
 // XXX
 
 #endif
diff --git a/content/xslt/src/base/txDouble.cpp b/content/xslt/src/base/txDouble.cpp
index 3bfaf21a714f..3e97a47869c7 100644
--- a/content/xslt/src/base/txDouble.cpp
+++ b/content/xslt/src/base/txDouble.cpp
@@ -63,7 +63,7 @@ const dpun Double::NEGATIVE_INFINITY = {{0, DOUBLE_HI32_EXPMASK | DOUBLE_HI32_SI
  * Determines whether the given double represents positive or negative
  * inifinity
  */
-MBool Double::isInfinite(double aDbl)
+bool Double::isInfinite(double aDbl)
 {
     return ((DOUBLE_HI32(aDbl) & ~DOUBLE_HI32_SIGNBIT) == DOUBLE_HI32_EXPMASK &&
             !DOUBLE_LO32(aDbl));
@@ -72,7 +72,7 @@ MBool Double::isInfinite(double aDbl)
 /*
  * Determines whether the given double is NaN
  */
-MBool Double::isNaN(double aDbl)
+bool Double::isNaN(double aDbl)
 {
     return DOUBLE_IS_NaN(aDbl);
 }
@@ -80,7 +80,7 @@ MBool Double::isNaN(double aDbl)
 /*
  * Determines whether the given double is negative
  */
-MBool Double::isNeg(double aDbl)
+bool Double::isNeg(double aDbl)
 {
     return (DOUBLE_HI32(aDbl) & DOUBLE_HI32_SIGNBIT) != 0;
 }
diff --git a/content/xslt/src/base/txExpandedNameMap.h b/content/xslt/src/base/txExpandedNameMap.h
index 769cba4217a6..fa1d5cfd46ab 100644
--- a/content/xslt/src/base/txExpandedNameMap.h
+++ b/content/xslt/src/base/txExpandedNameMap.h
@@ -95,7 +95,7 @@ protected:
         {
         }
 
-        MBool next()
+        bool next()
         {
             return ++mCurrentPos < mMap.mItems.Length();
         }
diff --git a/content/xslt/src/base/txList.cpp b/content/xslt/src/base/txList.cpp
index 14f578233489..53a09c0d9588 100644
--- a/content/xslt/src/base/txList.cpp
+++ b/content/xslt/src/base/txList.cpp
@@ -243,7 +243,7 @@ void txList::clear()
 txListIterator::txListIterator(txList* list) {
    this->list   = list;
    currentItem  = 0;
-   atEndOfList  = MB_FALSE;
+   atEndOfList  = false;
 } //-- txListIterator
 
 /**
@@ -276,11 +276,11 @@ nsresult txListIterator::addBefore(void* objPtr)
 
 /**
  * Returns true if a successful call to the next() method can be made
- * @return MB_TRUE if a successful call to the next() method can be made,
- * otherwise MB_FALSE
+ * @return true if a successful call to the next() method can be made,
+ * otherwise false
 **/
-MBool txListIterator::hasNext() {
-    MBool hasNext = MB_FALSE;
+bool txListIterator::hasNext() {
+    bool hasNext = false;
     if (currentItem)
         hasNext = (currentItem->nextItem != 0);
     else if (!atEndOfList)
@@ -291,11 +291,11 @@ MBool txListIterator::hasNext() {
 
 /**
  * Returns true if a successful call to the previous() method can be made
- * @return MB_TRUE if a successful call to the previous() method can be made,
- * otherwise MB_FALSE
+ * @return true if a successful call to the previous() method can be made,
+ * otherwise false
 **/
-MBool txListIterator::hasPrevious() {
-    MBool hasPrevious = MB_FALSE;
+bool txListIterator::hasPrevious() {
+    bool hasPrevious = false;
     if (currentItem)
         hasPrevious = (currentItem->prevItem != 0);
     else if (atEndOfList)
@@ -318,7 +318,7 @@ void* txListIterator::next() {
     if (currentItem)
         obj = currentItem->objPtr;
     else
-        atEndOfList = MB_TRUE;
+        atEndOfList = true;
 
     return obj;
 } //-- next
@@ -338,7 +338,7 @@ void* txListIterator::previous() {
     if (currentItem)
         obj = currentItem->objPtr;
 
-    atEndOfList = MB_FALSE;
+    atEndOfList = false;
 
     return obj;
 } //-- previous
@@ -379,7 +379,7 @@ void* txListIterator::advance(int i) {
         for (; currentItem && i < 0; i++)
             currentItem = currentItem->prevItem;
 
-        atEndOfList = MB_FALSE;
+        atEndOfList = false;
     }
 
     if (currentItem)
@@ -409,7 +409,7 @@ void* txListIterator::remove() {
  * Resets the current location within the txList to the beginning of the txList
 **/
 void txListIterator::reset() {
-   atEndOfList = MB_FALSE;
+   atEndOfList = false;
    currentItem = 0;
 } //-- reset
 
@@ -417,6 +417,6 @@ void txListIterator::reset() {
  * Move the iterator to right after the last element
 **/
 void txListIterator::resetToEnd() {
-   atEndOfList = MB_TRUE;
+   atEndOfList = true;
    currentItem = 0;
 } //-- moveToEnd
diff --git a/content/xslt/src/base/txList.h b/content/xslt/src/base/txList.h
index 4bbd20663186..924404fb934d 100644
--- a/content/xslt/src/base/txList.h
+++ b/content/xslt/src/base/txList.h
@@ -161,17 +161,17 @@ public:
 
     /**
      * Returns true if a successful call to the next() method can be made
-     * @return MB_TRUE if a successful call to the next() method can be made,
-     * otherwise MB_FALSE
+     * @return true if a successful call to the next() method can be made,
+     * otherwise false
     **/
-    MBool  hasNext();
+    bool  hasNext();
 
     /**
      * Returns true if a successful call to the previous() method can be made
-     * @return MB_TRUE if a successful call to the previous() method can be made,
-     * otherwise MB_FALSE
+     * @return true if a successful call to the previous() method can be made,
+     * otherwise false
     **/
-    MBool  hasPrevious();
+    bool  hasPrevious();
 
     /**
      * Returns the next Object pointer from the list
@@ -218,7 +218,7 @@ private:
    txList* list;
 
    //-- we've moved off the end of the list
-   MBool atEndOfList;
+   bool atEndOfList;
 };
 
 typedef txList List;
diff --git a/content/xslt/src/xml/txDOM.h b/content/xslt/src/xml/txDOM.h
index d6a31b1cef4b..edfbd41d3343 100644
--- a/content/xslt/src/xml/txDOM.h
+++ b/content/xslt/src/xml/txDOM.h
@@ -116,7 +116,7 @@ class Node : public TxObject
     //Node manipulation functions
     virtual Node* appendChild(Node* newChild) = 0;
 
-    virtual MBool hasChildNodes() const = 0;
+    virtual bool hasChildNodes() const = 0;
     
     //From DOM3 26-Jan-2001 WD
     virtual nsresult getBaseURI(nsAString& aURI) = 0;
@@ -125,7 +125,7 @@ class Node : public TxObject
     virtual nsresult getNamespaceURI(nsAString& aNSURI) = 0;
 
     //txXPathNode functions
-    virtual MBool getLocalName(nsIAtom** aLocalName) = 0;
+    virtual bool getLocalName(nsIAtom** aLocalName) = 0;
     virtual PRInt32 getNamespaceID() = 0;
     virtual Node* getXPathParent() = 0;
     virtual PRInt32 compareDocumentPosition(Node* aOther) = 0;
@@ -156,7 +156,7 @@ class NodeDefinition : public Node
     //Child node manipulation functions
     virtual Node* appendChild(Node* newChild);
 
-    MBool hasChildNodes() const;
+    bool hasChildNodes() const;
     
     //From DOM3 26-Jan-2001 WD
     virtual nsresult getBaseURI(nsAString& aURI);
@@ -165,7 +165,7 @@ class NodeDefinition : public Node
     nsresult getNamespaceURI(nsAString& aNSURI);
 
     //txXPathNode functions
-    virtual MBool getLocalName(nsIAtom** aLocalName);
+    virtual bool getLocalName(nsIAtom** aLocalName);
     virtual PRInt32 getNamespaceID();
     virtual Node* getXPathParent();
     virtual PRInt32 compareDocumentPosition(Node* aOther);
@@ -299,10 +299,10 @@ class Element : public NodeDefinition
 
     //txXPathNode functions override
     nsresult getNodeName(nsAString& aName) const;
-    MBool getLocalName(nsIAtom** aLocalName);
+    bool getLocalName(nsIAtom** aLocalName);
     PRInt32 getNamespaceID();
-    MBool getAttr(nsIAtom* aLocalName, PRInt32 aNSID, nsAString& aValue);
-    MBool hasAttr(nsIAtom* aLocalName, PRInt32 aNSID);
+    bool getAttr(nsIAtom* aLocalName, PRInt32 aNSID, nsAString& aValue);
+    bool hasAttr(nsIAtom* aLocalName, PRInt32 aNSID);
 
     // ID getter
     bool getIDValue(nsAString& aValue);
@@ -337,7 +337,7 @@ class Attr : public NodeDefinition
 
     //txXPathNode functions override
     nsresult getNodeName(nsAString& aName) const;
-    MBool getLocalName(nsIAtom** aLocalName);
+    bool getLocalName(nsIAtom** aLocalName);
     PRInt32 getNamespaceID();
     Node* getXPathParent();
     bool equals(nsIAtom *aLocalName, PRInt32 aNamespaceID)
@@ -373,7 +373,7 @@ class ProcessingInstruction : public NodeDefinition
 {
   public:
     //txXPathNode functions override
-    MBool getLocalName(nsIAtom** aLocalName);
+    bool getLocalName(nsIAtom** aLocalName);
 
   private:
     friend class Document;
@@ -415,15 +415,15 @@ public:
         return NS_OK;
     }
 
-    static MBool init()
+    static bool init()
     {
         NS_ASSERTION(!mNamespaces,
                      "called without matching shutdown()");
         if (mNamespaces)
-            return MB_TRUE;
+            return true;
         mNamespaces = new nsStringArray();
         if (!mNamespaces)
-            return MB_FALSE;
+            return false;
         /*
          * Hardwiring some Namespace IDs.
          * no Namespace is 0
@@ -435,10 +435,10 @@ public:
             !mNamespaces->AppendString(NS_LITERAL_STRING("http://www.w3.org/1999/XSL/Transform"))) {
             delete mNamespaces;
             mNamespaces = 0;
-            return MB_FALSE;
+            return false;
         }
 
-        return MB_TRUE;
+        return true;
     }
 
     static void shutdown()
diff --git a/content/xslt/src/xml/txXMLUtils.cpp b/content/xslt/src/xml/txXMLUtils.cpp
index b125490c99ab..c40eb3beb63f 100644
--- a/content/xslt/src/xml/txXMLUtils.cpp
+++ b/content/xslt/src/xml/txXMLUtils.cpp
@@ -51,7 +51,7 @@
 
 nsresult
 txExpandedName::init(const nsAString& aQName, txNamespaceMap* aResolver,
-                     MBool aUseDefault)
+                     bool aUseDefault)
 {
     const nsAFlatString& qName = PromiseFlatString(aQName);
     const PRUnichar* colon;
@@ -230,7 +230,7 @@ void XMLUtils::normalizePIValue(nsAString& piValue)
 }
 
 //static
-MBool XMLUtils::getXMLSpacePreserve(const txXPathNode& aNode)
+bool XMLUtils::getXMLSpacePreserve(const txXPathNode& aNode)
 {
     nsAutoString value;
     txXPathTreeWalker walker(aNode);
diff --git a/content/xslt/src/xml/txXMLUtils.h b/content/xslt/src/xml/txXMLUtils.h
index 9da888ef4666..c2645e95c692 100644
--- a/content/xslt/src/xml/txXMLUtils.h
+++ b/content/xslt/src/xml/txXMLUtils.h
@@ -75,7 +75,7 @@ public:
     }
 
     nsresult init(const nsAString& aQName, txNamespaceMap* aResolver,
-                  MBool aUseDefault);
+                  bool aUseDefault);
 
     void reset()
     {
@@ -95,13 +95,13 @@ public:
         return *this;
     }
 
-    MBool operator == (const txExpandedName& rhs) const
+    bool operator == (const txExpandedName& rhs) const
     {
         return ((mLocalName == rhs.mLocalName) &&
                 (mNamespaceID == rhs.mNamespaceID));
     }
 
-    MBool operator != (const txExpandedName& rhs) const
+    bool operator != (const txExpandedName& rhs) const
     {
         return ((mLocalName != rhs.mLocalName) ||
                 (mNamespaceID != rhs.mNamespaceID));
@@ -124,7 +124,7 @@ public:
     /*
      * Returns true if the given character is whitespace.
      */
-    static MBool isWhitespace(const PRUnichar& aChar)
+    static bool isWhitespace(const PRUnichar& aChar)
     {
         return (aChar <= ' ' &&
                 (aChar == ' ' || aChar == '\r' ||
@@ -173,7 +173,7 @@ public:
      * Walks up the document tree and returns true if the closest xml:space
      * attribute is "preserve"
      */
-    static MBool getXMLSpacePreserve(const txXPathNode& aNode);
+    static bool getXMLSpacePreserve(const txXPathNode& aNode);
 };
 
 #endif
diff --git a/content/xslt/src/xpath/nsXPathExpression.cpp b/content/xslt/src/xpath/nsXPathExpression.cpp
index 1527e49eed06..e8f96a9a4f84 100644
--- a/content/xslt/src/xpath/nsXPathExpression.cpp
+++ b/content/xslt/src/xpath/nsXPathExpression.cpp
@@ -196,9 +196,9 @@ nsXPathExpression::EvalContextImpl::getVariable(PRInt32 aNamespace,
     return NS_ERROR_INVALID_ARG;
 }
 
-MBool nsXPathExpression::EvalContextImpl::isStripSpaceAllowed(const txXPathNode& aNode)
+bool nsXPathExpression::EvalContextImpl::isStripSpaceAllowed(const txXPathNode& aNode)
 {
-    return MB_FALSE;
+    return false;
 }
 
 void* nsXPathExpression::EvalContextImpl::getPrivateContext()
diff --git a/content/xslt/src/xpath/txBooleanResult.cpp b/content/xslt/src/xpath/txBooleanResult.cpp
index a8595a574e22..ee1c581bb1d1 100644
--- a/content/xslt/src/xpath/txBooleanResult.cpp
+++ b/content/xslt/src/xpath/txBooleanResult.cpp
@@ -43,8 +43,8 @@
 #include "txExprResult.h"
 
 /**
- * Creates a new BooleanResult with the value of the given MBool parameter
- * @param boolean the MBool to use for initialization of this BooleanResult's value
+ * Creates a new BooleanResult with the value of the given bool parameter
+ * @param boolean the bool to use for initialization of this BooleanResult's value
 **/
 BooleanResult::BooleanResult(bool boolean)
     : txAExprResult(nsnull)
@@ -80,7 +80,7 @@ BooleanResult::stringValuePointer()
     return nsnull;
 }
 
-MBool BooleanResult::booleanValue() {
+bool BooleanResult::booleanValue() {
    return this->value;
 } //-- toBoolean
 
diff --git a/content/xslt/src/xpath/txCoreFunctionCall.cpp b/content/xslt/src/xpath/txCoreFunctionCall.cpp
index 00e0d6355e34..19aa26a31397 100644
--- a/content/xslt/src/xpath/txCoreFunctionCall.cpp
+++ b/content/xslt/src/xpath/txCoreFunctionCall.cpp
@@ -303,23 +303,23 @@ txCoreFunctionCall::evaluate(txIEvalContext* aContext, txAExprResult** aResult)
             rv = aContext->recycler()->getStringResult(getter_AddRefs(strRes));
             NS_ENSURE_SUCCESS(rv, rv);
 
-            MBool addSpace = MB_FALSE;
-            MBool first = MB_TRUE;
+            bool addSpace = false;
+            bool first = true;
             strRes->mValue.SetCapacity(resultStr.Length());
             PRUnichar c;
             PRUint32 src;
             for (src = 0; src < resultStr.Length(); src++) {
                 c = resultStr.CharAt(src);
                 if (XMLUtils::isWhitespace(c)) {
-                    addSpace = MB_TRUE;
+                    addSpace = true;
                 }
                 else {
                     if (addSpace && !first)
                         strRes->mValue.Append(PRUnichar(' '));
 
                     strRes->mValue.Append(c);
-                    addSpace = MB_FALSE;
-                    first = MB_FALSE;
+                    addSpace = false;
+                    first = false;
                 }
             }
             *aResult = strRes;
diff --git a/content/xslt/src/xpath/txExprParser.cpp b/content/xslt/src/xpath/txExprParser.cpp
index 5094bb1e3358..222a1f5178b4 100644
--- a/content/xslt/src/xpath/txExprParser.cpp
+++ b/content/xslt/src/xpath/txExprParser.cpp
@@ -302,7 +302,7 @@ txExprParser::createExpr(txExprLexer& lexer, txIParseContext* aContext,
     *aResult = nsnull;
 
     nsresult rv = NS_OK;
-    MBool done = MB_FALSE;
+    bool done = false;
 
     nsAutoPtr<Expr> expr;
 
diff --git a/content/xslt/src/xpath/txExprParser.h b/content/xslt/src/xpath/txExprParser.h
index 16f7b4b2b2ca..563e6d729c8b 100644
--- a/content/xslt/src/xpath/txExprParser.h
+++ b/content/xslt/src/xpath/txExprParser.h
@@ -122,7 +122,7 @@ protected:
     static nsresult resolveQName(const nsAString& aQName, nsIAtom** aPrefix,
                                  txIParseContext* aContext,
                                  nsIAtom** aLocalName, PRInt32& aNamespace,
-                                 bool aIsNameTest = MB_FALSE);
+                                 bool aIsNameTest = false);
 
     /**
      * Using the given lexer, parses the tokens if they represent a
diff --git a/content/xslt/src/xpath/txExprResult.h b/content/xslt/src/xpath/txExprResult.h
index 1700e3cad3b5..aad11d50eb97 100644
--- a/content/xslt/src/xpath/txExprResult.h
+++ b/content/xslt/src/xpath/txExprResult.h
@@ -104,10 +104,10 @@ public:
     virtual const nsString* stringValuePointer() = 0;
 
     /**
-     * Converts this ExprResult to a Boolean (MBool) value
+     * Converts this ExprResult to a Boolean (bool) value
      * @return the Boolean value
     **/
-    virtual MBool booleanValue()          = 0;
+    virtual bool booleanValue()          = 0;
 
     /**
      * Converts this ExprResult to a Number (double) value
@@ -131,12 +131,12 @@ private:
 class BooleanResult : public txAExprResult {
 
 public:
-    BooleanResult(MBool aValue);
+    BooleanResult(bool aValue);
 
     TX_DECL_EXPRRESULT
 
 private:
-    MBool value;
+    bool value;
 };
 
 class NumberResult : public txAExprResult {
diff --git a/content/xslt/src/xpath/txForwardContext.cpp b/content/xslt/src/xpath/txForwardContext.cpp
index 9b2d94f75735..0a3f67c08119 100644
--- a/content/xslt/src/xpath/txForwardContext.cpp
+++ b/content/xslt/src/xpath/txForwardContext.cpp
@@ -63,7 +63,7 @@ nsresult txForwardContext::getVariable(PRInt32 aNamespace, nsIAtom* aLName,
     return mInner->getVariable(aNamespace, aLName, aResult);
 }
 
-MBool txForwardContext::isStripSpaceAllowed(const txXPathNode& aNode)
+bool txForwardContext::isStripSpaceAllowed(const txXPathNode& aNode)
 {
     NS_ASSERTION(mInner, "mInner is null!!!");
     return mInner->isStripSpaceAllowed(aNode);
diff --git a/content/xslt/src/xpath/txIXPathContext.h b/content/xslt/src/xpath/txIXPathContext.h
index 7f9b4e31ba08..72b323e07fae 100644
--- a/content/xslt/src/xpath/txIXPathContext.h
+++ b/content/xslt/src/xpath/txIXPathContext.h
@@ -113,7 +113,7 @@ public:
      * Is whitespace stripping allowed for the given node?
      * See http://www.w3.org/TR/xslt#strip
      */
-    virtual MBool isStripSpaceAllowed(const txXPathNode& aNode) = 0;
+    virtual bool isStripSpaceAllowed(const txXPathNode& aNode) = 0;
 
     /**
      * Returns a pointer to the private context
@@ -131,7 +131,7 @@ public:
 #define TX_DECL_MATCH_CONTEXT \
     nsresult getVariable(PRInt32 aNamespace, nsIAtom* aLName, \
                          txAExprResult*& aResult); \
-    MBool isStripSpaceAllowed(const txXPathNode& aNode); \
+    bool isStripSpaceAllowed(const txXPathNode& aNode); \
     void* getPrivateContext(); \
     txResultRecycler* recycler(); \
     void receiveError(const nsAString& aMsg, nsresult aRes)
diff --git a/content/xslt/src/xpath/txNameTest.cpp b/content/xslt/src/xpath/txNameTest.cpp
index 72ab2f78e257..7b1c529fc320 100644
--- a/content/xslt/src/xpath/txNameTest.cpp
+++ b/content/xslt/src/xpath/txNameTest.cpp
@@ -69,18 +69,18 @@ bool txNameTest::matches(const txXPathNode& aNode, txIMatchContext* aContext)
 
     // Totally wild?
     if (mLocalName == nsGkAtoms::_asterix && !mPrefix)
-        return MB_TRUE;
+        return true;
 
     // Compare namespaces
     if (mNamespace != txXPathNodeUtils::getNamespaceID(aNode) 
         && !(mNamespace == kNameSpaceID_None &&
              txXPathNodeUtils::isHTMLElementInHTMLDocument(aNode))
        )
-        return MB_FALSE;
+        return false;
 
     // Name wild?
     if (mLocalName == nsGkAtoms::_asterix)
-        return MB_TRUE;
+        return true;
 
     // Compare local-names
     return txXPathNodeUtils::localNameEquals(aNode, mLocalName);
diff --git a/content/xslt/src/xpath/txNodeSetContext.cpp b/content/xslt/src/xpath/txNodeSetContext.cpp
index 0217703c23dd..a9b1cd57b6b2 100644
--- a/content/xslt/src/xpath/txNodeSetContext.cpp
+++ b/content/xslt/src/xpath/txNodeSetContext.cpp
@@ -62,7 +62,7 @@ nsresult txNodeSetContext::getVariable(PRInt32 aNamespace, nsIAtom* aLName,
     return mInner->getVariable(aNamespace, aLName, aResult);
 }
 
-MBool txNodeSetContext::isStripSpaceAllowed(const txXPathNode& aNode)
+bool txNodeSetContext::isStripSpaceAllowed(const txXPathNode& aNode)
 {
     NS_ASSERTION(mInner, "mInner is null!!!");
     return mInner->isStripSpaceAllowed(aNode);
diff --git a/content/xslt/src/xpath/txNodeSetContext.h b/content/xslt/src/xpath/txNodeSetContext.h
index b8d16b0096f8..d64d898696da 100644
--- a/content/xslt/src/xpath/txNodeSetContext.h
+++ b/content/xslt/src/xpath/txNodeSetContext.h
@@ -52,7 +52,7 @@ public:
     }
 
     // Iteration over the given NodeSet
-    MBool hasNext()
+    bool hasNext()
     {
         return mPosition < size();
     }
diff --git a/content/xslt/src/xpath/txNumberResult.cpp b/content/xslt/src/xpath/txNumberResult.cpp
index 8485a5bf7703..edea4c3ab49b 100644
--- a/content/xslt/src/xpath/txNumberResult.cpp
+++ b/content/xslt/src/xpath/txNumberResult.cpp
@@ -76,11 +76,11 @@ NumberResult::stringValuePointer()
     return nsnull;
 }
 
-MBool NumberResult::booleanValue() {
+bool NumberResult::booleanValue() {
   // OG+
   // As per the XPath spec, the boolean value of a number is true if and only if
   // it is neither positive 0 nor negative 0 nor NaN
-  return (MBool)(value != 0.0 && !Double::isNaN(value));
+  return (bool)(value != 0.0 && !Double::isNaN(value));
   // OG-
 } //-- booleanValue
 
diff --git a/content/xslt/src/xpath/txPathExpr.cpp b/content/xslt/src/xpath/txPathExpr.cpp
index acd543491c35..c28ed2b1b4ed 100644
--- a/content/xslt/src/xpath/txPathExpr.cpp
+++ b/content/xslt/src/xpath/txPathExpr.cpp
@@ -193,7 +193,7 @@ PathExpr::evalDescendants(Expr* aStep, const txXPathNode& aNode,
 
     resNodes->addAndTransfer(newSet);
 
-    MBool filterWS = aContext->isStripSpaceAllowed(aNode);
+    bool filterWS = aContext->isStripSpaceAllowed(aNode);
 
     txXPathTreeWalker walker(aNode);
     if (!walker.moveToFirstChild()) {
diff --git a/content/xslt/src/xpath/txSingleNodeContext.h b/content/xslt/src/xpath/txSingleNodeContext.h
index eade9b58a778..4c2b6d2955af 100644
--- a/content/xslt/src/xpath/txSingleNodeContext.h
+++ b/content/xslt/src/xpath/txSingleNodeContext.h
@@ -59,7 +59,7 @@ public:
         return mInner->getVariable(aNamespace, aLName, aResult);
     }
 
-    MBool isStripSpaceAllowed(const txXPathNode& aNode)
+    bool isStripSpaceAllowed(const txXPathNode& aNode)
     {
         NS_ASSERTION(mInner, "mInner is null!!!");
         return mInner->isStripSpaceAllowed(aNode);
diff --git a/content/xslt/src/xpath/txStringResult.cpp b/content/xslt/src/xpath/txStringResult.cpp
index 2f206af84f6f..a1d1362afb70 100644
--- a/content/xslt/src/xpath/txStringResult.cpp
+++ b/content/xslt/src/xpath/txStringResult.cpp
@@ -79,7 +79,7 @@ StringResult::stringValuePointer()
     return &mValue;
 }
 
-MBool StringResult::booleanValue() {
+bool StringResult::booleanValue() {
    return !mValue.IsEmpty();
 } //-- booleanValue
 
diff --git a/content/xslt/src/xslt/txDocumentFunctionCall.cpp b/content/xslt/src/xslt/txDocumentFunctionCall.cpp
index 2478ac11a371..7ed4776cfef3 100644
--- a/content/xslt/src/xslt/txDocumentFunctionCall.cpp
+++ b/content/xslt/src/xslt/txDocumentFunctionCall.cpp
@@ -121,7 +121,7 @@ DocumentFunctionCall::evaluate(txIEvalContext* aContext,
     NS_ENSURE_SUCCESS(rv, rv);
 
     nsAutoString baseURI;
-    MBool baseURISet = MB_FALSE;
+    bool baseURISet = false;
 
     if (mParams.Length() == 2) {
         // We have 2 arguments, get baseURI from the first node
@@ -134,7 +134,7 @@ DocumentFunctionCall::evaluate(txIEvalContext* aContext,
         // Make this true, even if nodeSet2 is empty. For relative URLs,
         // we'll fail to load the document with an empty base URI, and for
         // absolute URLs, the base URI doesn't matter
-        baseURISet = MB_TRUE;
+        baseURISet = true;
 
         if (!nodeSet2->isEmpty()) {
             txXPathNodeUtils::getBaseURI(nodeSet2->get(0), baseURI);
diff --git a/content/xslt/src/xslt/txFormatNumberFunctionCall.cpp b/content/xslt/src/xslt/txFormatNumberFunctionCall.cpp
index fa6c795418ac..131e3daac8e6 100644
--- a/content/xslt/src/xslt/txFormatNumberFunctionCall.cpp
+++ b/content/xslt/src/xslt/txFormatNumberFunctionCall.cpp
@@ -96,7 +96,7 @@ txFormatNumberFunctionCall::evaluate(txIEvalContext* aContext,
         rv = mParams[2]->evaluateToString(aContext, formatQName);
         NS_ENSURE_SUCCESS(rv, rv);
 
-        rv = formatName.init(formatQName, mMappings, MB_FALSE);
+        rv = formatName.init(formatQName, mMappings, false);
         NS_ENSURE_SUCCESS(rv, rv);
     }
 
@@ -139,10 +139,10 @@ txFormatNumberFunctionCall::evaluate(txIEvalContext* aContext,
 
     PRUint32 pos = 0;
     PRUint32 formatLen = formatStr.Length();
-    MBool inQuote;
+    bool inQuote;
 
     // Get right subexpression
-    inQuote = MB_FALSE;
+    inQuote = false;
     if (Double::isNeg(value)) {
         while (pos < formatLen &&
                (inQuote ||
@@ -162,7 +162,7 @@ txFormatNumberFunctionCall::evaluate(txIEvalContext* aContext,
 
     // Parse the format string
     FormatParseState pState = Prefix;
-    inQuote = MB_FALSE;
+    inQuote = false;
 
     PRUnichar c = 0;
     while (pos < formatLen && pState != Finished) {
@@ -327,8 +327,8 @@ txFormatNumberFunctionCall::evaluate(txIEvalContext* aContext,
                   (intDigits-1)/groupSize); // group separators
 
     PRInt32 i = bufIntDigits + maxFractionSize - 1;
-    MBool carry = (i+1 < buflen) && (buf[i+1] >= '5');
-    MBool hasFraction = MB_FALSE;
+    bool carry = (i+1 < buflen) && (buf[i+1] >= '5');
+    bool hasFraction = false;
 
     PRUint32 resPos = res.Length()-1;
 
@@ -348,7 +348,7 @@ txFormatNumberFunctionCall::evaluate(txIEvalContext* aContext,
         }
 
         if (hasFraction || digit != 0 || i < bufIntDigits+minFractionSize) {
-            hasFraction = MB_TRUE;
+            hasFraction = true;
             res.SetCharAt((PRUnichar)(digit + format->mZeroDigit),
                           resPos--);
         }
@@ -448,7 +448,7 @@ txDecimalFormat::txDecimalFormat() : mInfinity(NS_LITERAL_STRING("Infinity")),
     mPatternSeparator = ';';
 }
 
-MBool txDecimalFormat::isEqual(txDecimalFormat* other)
+bool txDecimalFormat::isEqual(txDecimalFormat* other)
 {
     return mDecimalSeparator == other->mDecimalSeparator &&
            mGroupingSeparator == other->mGroupingSeparator &&
diff --git a/content/xslt/src/xslt/txNodeSorter.cpp b/content/xslt/src/xslt/txNodeSorter.cpp
index a6f6ab2103b8..94489d105d77 100644
--- a/content/xslt/src/xslt/txNodeSorter.cpp
+++ b/content/xslt/src/xslt/txNodeSorter.cpp
@@ -78,14 +78,14 @@ txNodeSorter::addSortElement(Expr* aSelectExpr, Expr* aLangExpr,
     key->mExpr = aSelectExpr;
 
     // Order
-    MBool ascending = MB_TRUE;
+    bool ascending = true;
     if (aOrderExpr) {
         nsAutoString attrValue;
         rv = aOrderExpr->evaluateToString(aContext, attrValue);
         NS_ENSURE_SUCCESS(rv, rv);
 
         if (TX_StringEqualsAtom(attrValue, nsGkAtoms::descending)) {
-            ascending = MB_FALSE;
+            ascending = false;
         }
         else if (!TX_StringEqualsAtom(attrValue, nsGkAtoms::ascending)) {
             // XXX ErrorReport: unknown value for order attribute
@@ -112,7 +112,7 @@ txNodeSorter::addSortElement(Expr* aSelectExpr, Expr* aLangExpr,
         }
 
         // Case-order 
-        MBool upperFirst = false;
+        bool upperFirst = false;
         if (aCaseOrderExpr) {
             nsAutoString attrValue;
 
diff --git a/content/xslt/src/xslt/txPatternParser.cpp b/content/xslt/src/xslt/txPatternParser.cpp
index ec585119a0d6..38763e1c09e8 100644
--- a/content/xslt/src/xslt/txPatternParser.cpp
+++ b/content/xslt/src/xslt/txPatternParser.cpp
@@ -139,21 +139,21 @@ nsresult txPatternParser::createLocPathPattern(txExprLexer& aLexer,
 {
     nsresult rv = NS_OK;
 
-    MBool isChild = MB_TRUE;
-    MBool isAbsolute = MB_FALSE;
+    bool isChild = true;
+    bool isAbsolute = false;
     txPattern* stepPattern = 0;
     txLocPathPattern* pathPattern = 0;
 
     Token::Type type = aLexer.peek()->mType;
     switch (type) {
         case Token::ANCESTOR_OP:
-            isChild = MB_FALSE;
-            isAbsolute = MB_TRUE;
+            isChild = false;
+            isAbsolute = true;
             aLexer.nextToken();
             break;
         case Token::PARENT_OP:
             aLexer.nextToken();
-            isAbsolute = MB_TRUE;
+            isAbsolute = true;
             if (aLexer.peek()->mType == Token::END || 
                 aLexer.peek()->mType == Token::UNION_OP) {
                 aPattern = new txRootPattern();
@@ -299,11 +299,11 @@ nsresult txPatternParser::createStepPattern(txExprLexer& aLexer,
                                             txPattern*& aPattern)
 {
     nsresult rv = NS_OK;
-    MBool isAttr = MB_FALSE;
+    bool isAttr = false;
     Token* tok = aLexer.peek();
     if (tok->mType == Token::AXIS_IDENTIFIER) {
         if (TX_StringEqualsAtom(tok->Value(), nsGkAtoms::attribute)) {
-            isAttr = MB_TRUE;
+            isAttr = true;
         }
         else if (!TX_StringEqualsAtom(tok->Value(), nsGkAtoms::child)) {
             // all done already for CHILD_AXIS, for all others
@@ -314,7 +314,7 @@ nsresult txPatternParser::createStepPattern(txExprLexer& aLexer,
     }
     else if (tok->mType == Token::AT_SIGN) {
         aLexer.nextToken();
-        isAttr = MB_TRUE;
+        isAttr = true;
     }
     tok = aLexer.nextToken();
 
diff --git a/content/xslt/src/xslt/txStylesheet.h b/content/xslt/src/xslt/txStylesheet.h
index 9fcd0d9a55b9..05825efb42fb 100644
--- a/content/xslt/src/xslt/txStylesheet.h
+++ b/content/xslt/src/xslt/txStylesheet.h
@@ -192,17 +192,17 @@ private:
 class txStripSpaceTest {
 public:
     txStripSpaceTest(nsIAtom* aPrefix, nsIAtom* aLocalName, PRInt32 aNSID,
-                     MBool stripSpace)
+                     bool stripSpace)
         : mNameTest(aPrefix, aLocalName, aNSID, txXPathNodeType::ELEMENT_NODE),
           mStrips(stripSpace)
     {
     }
 
-    MBool matches(const txXPathNode& aNode, txIMatchContext* aContext) {
+    bool matches(const txXPathNode& aNode, txIMatchContext* aContext) {
         return mNameTest.matches(aNode, aContext);
     }
 
-    MBool stripsSpace() {
+    bool stripsSpace() {
         return mStrips;
     }
 
@@ -212,7 +212,7 @@ public:
 
 protected:
     txNameTest mNameTest;
-    MBool mStrips;
+    bool mStrips;
 };
 
 /**
diff --git a/content/xslt/src/xslt/txStylesheetCompileHandlers.cpp b/content/xslt/src/xslt/txStylesheetCompileHandlers.cpp
index 52389f7238ac..e68e2a1baa8c 100644
--- a/content/xslt/src/xslt/txStylesheetCompileHandlers.cpp
+++ b/content/xslt/src/xslt/txStylesheetCompileHandlers.cpp
@@ -1367,7 +1367,7 @@ txFnText(const nsAString& aStr, txStylesheetCompilerState& aState)
 {
     TX_RETURN_IF_WHITESPACE(aStr, aState);
 
-    nsAutoPtr<txInstruction> instr(new txText(aStr, MB_FALSE));
+    nsAutoPtr<txInstruction> instr(new txText(aStr, false));
     NS_ENSURE_TRUE(instr, NS_ERROR_OUT_OF_MEMORY);
 
     nsresult rv = aState.addInstruction(instr);
@@ -2413,7 +2413,7 @@ txFnStartText(PRInt32 aNamespaceID,
 static nsresult
 txFnEndText(txStylesheetCompilerState& aState)
 {
-    aState.mDOE = MB_FALSE;
+    aState.mDOE = false;
     aState.popHandlerTable();
     return NS_OK;
 }
@@ -3044,7 +3044,7 @@ txHandlerTable::find(PRInt32 aNamespaceID, nsIAtom* aLocalName)
     gTx##_name##Handler = nsnull
 
 // static
-MBool
+bool
 txHandlerTable::init()
 {
     nsresult rv = NS_OK;
@@ -3066,7 +3066,7 @@ txHandlerTable::init()
     INIT_HANDLER_WITH_ELEMENT_HANDLERS(AttributeSet);
     INIT_HANDLER_WITH_ELEMENT_HANDLERS(Fallback);
 
-    return MB_TRUE;
+    return true;
 }
 
 // static
diff --git a/content/xslt/src/xslt/txStylesheetCompileHandlers.h b/content/xslt/src/xslt/txStylesheetCompileHandlers.h
index f531a8af9f7b..4de7213bbf28 100644
--- a/content/xslt/src/xslt/txStylesheetCompileHandlers.h
+++ b/content/xslt/src/xslt/txStylesheetCompileHandlers.h
@@ -75,7 +75,7 @@ public:
     const HandleTextFn mTextHandler;
     const txElementHandler* const mLREHandler;
 
-    static MBool init();
+    static bool init();
     static void shutdown();
 
 private:
diff --git a/content/xslt/src/xslt/txStylesheetCompiler.cpp b/content/xslt/src/xslt/txStylesheetCompiler.cpp
index 4240fdf84ca9..bf1b90e094c6 100644
--- a/content/xslt/src/xslt/txStylesheetCompiler.cpp
+++ b/content/xslt/src/xslt/txStylesheetCompiler.cpp
@@ -227,10 +227,10 @@ txStylesheetCompiler::startElementInternal(PRInt32 aNamespaceID,
             NS_ENSURE_SUCCESS(rv, rv);
 
             if (TX_StringEqualsAtom(attr->mValue, nsGkAtoms::preserve)) {
-                mElementContext->mPreserveWhitespace = MB_TRUE;
+                mElementContext->mPreserveWhitespace = true;
             }
             else if (TX_StringEqualsAtom(attr->mValue, nsGkAtoms::_default)) {
-                mElementContext->mPreserveWhitespace = MB_FALSE;
+                mElementContext->mPreserveWhitespace = false;
             }
             else {
                 return NS_ERROR_XSLT_PARSE_FAILURE;
@@ -291,20 +291,20 @@ txStylesheetCompiler::startElementInternal(PRInt32 aNamespaceID,
             NS_ENSURE_SUCCESS(rv, rv);
 
             if (attr->mValue.EqualsLiteral("1.0")) {
-                mElementContext->mForwardsCompatibleParsing = MB_FALSE;
+                mElementContext->mForwardsCompatibleParsing = false;
             }
             else {
-                mElementContext->mForwardsCompatibleParsing = MB_TRUE;
+                mElementContext->mForwardsCompatibleParsing = true;
             }
         }
     }
 
     // Find the right elementhandler and execute it
-    MBool isInstruction = MB_FALSE;
+    bool isInstruction = false;
     PRInt32 count = mElementContext->mInstructionNamespaces.Length();
     for (i = 0; i < count; ++i) {
         if (mElementContext->mInstructionNamespaces[i] == aNamespaceID) {
-            isInstruction = MB_TRUE;
+            isInstruction = true;
             break;
         }
     }
diff --git a/content/xslt/src/xslt/txTextHandler.cpp b/content/xslt/src/xslt/txTextHandler.cpp
index 219470878b23..1410a706aa31 100644
--- a/content/xslt/src/xslt/txTextHandler.cpp
+++ b/content/xslt/src/xslt/txTextHandler.cpp
@@ -39,7 +39,7 @@
 #include "txTextHandler.h"
 #include "nsAString.h"
 
-txTextHandler::txTextHandler(MBool aOnlyText) : mLevel(0),
+txTextHandler::txTextHandler(bool aOnlyText) : mLevel(0),
                                                 mOnlyText(aOnlyText)
 {
 }
diff --git a/content/xslt/src/xslt/txTextHandler.h b/content/xslt/src/xslt/txTextHandler.h
index be5be2f49375..8872e7277beb 100644
--- a/content/xslt/src/xslt/txTextHandler.h
+++ b/content/xslt/src/xslt/txTextHandler.h
@@ -45,7 +45,7 @@
 class txTextHandler : public txAXMLEventHandler
 {
 public:
-    txTextHandler(MBool aOnlyText);
+    txTextHandler(bool aOnlyText);
 
     TX_DECL_TXAXMLEVENTHANDLER
 
@@ -53,7 +53,7 @@ public:
 
 private:
     PRUint32 mLevel;
-    MBool mOnlyText;
+    bool mOnlyText;
 };
 
 #endif
diff --git a/content/xslt/src/xslt/txXPathResultComparator.cpp b/content/xslt/src/xslt/txXPathResultComparator.cpp
index 2a28f1859224..6fa50c5a5635 100644
--- a/content/xslt/src/xslt/txXPathResultComparator.cpp
+++ b/content/xslt/src/xslt/txXPathResultComparator.cpp
@@ -50,8 +50,8 @@
 #define kAscending (1<<0)
 #define kUpperFirst (1<<1)
 
-txResultStringComparator::txResultStringComparator(MBool aAscending,
-                                                   MBool aUpperFirst,
+txResultStringComparator::txResultStringComparator(bool aAscending,
+                                                   bool aUpperFirst,
                                                    const nsAFlatString& aLanguage)
 {
     mSorting = 0;
@@ -215,7 +215,7 @@ txResultStringComparator::StringValue::~StringValue()
         delete (nsString*)mCaseKey;
 }
 
-txResultNumberComparator::txResultNumberComparator(MBool aAscending)
+txResultNumberComparator::txResultNumberComparator(bool aAscending)
 {
     mAscending = aAscending ? 1 : -1;
 }
diff --git a/content/xslt/src/xslt/txXPathResultComparator.h b/content/xslt/src/xslt/txXPathResultComparator.h
index cd1958e20378..c70e72d69b04 100644
--- a/content/xslt/src/xslt/txXPathResultComparator.h
+++ b/content/xslt/src/xslt/txXPathResultComparator.h
@@ -77,7 +77,7 @@ public:
 class txResultStringComparator : public txXPathResultComparator
 {
 public:
-    txResultStringComparator(MBool aAscending, MBool aUpperFirst,
+    txResultStringComparator(bool aAscending, bool aUpperFirst,
                              const nsAFlatString& aLanguage);
 
     int compareValues(TxObject* aVal1, TxObject* aVal2);
@@ -110,7 +110,7 @@ private:
 class txResultNumberComparator : public txXPathResultComparator
 {
 public:
-    txResultNumberComparator(MBool aAscending);
+    txResultNumberComparator(bool aAscending);
 
     int compareValues(TxObject* aVal1, TxObject* aVal2);
     nsresult createSortableValue(Expr *aExpr, txIEvalContext *aContext,
diff --git a/content/xslt/src/xslt/txXSLTFunctions.h b/content/xslt/src/xslt/txXSLTFunctions.h
index f02c92b8bce7..a3f98cf8b4d1 100644
--- a/content/xslt/src/xslt/txXSLTFunctions.h
+++ b/content/xslt/src/xslt/txXSLTFunctions.h
@@ -127,7 +127,7 @@ public:
      * default values
      */
     txDecimalFormat();
-    MBool isEqual(txDecimalFormat* other);
+    bool isEqual(txDecimalFormat* other);
     
     PRUnichar       mDecimalSeparator;
     PRUnichar       mGroupingSeparator;
diff --git a/content/xslt/src/xslt/txXSLTNumber.cpp b/content/xslt/src/xslt/txXSLTNumber.cpp
index 28dfe577baf4..3056f277bc94 100644
--- a/content/xslt/src/xslt/txXSLTNumber.cpp
+++ b/content/xslt/src/xslt/txXSLTNumber.cpp
@@ -76,7 +76,7 @@ nsresult txXSLTNumber::createNumber(Expr* aValueExpr, txPattern* aCountPattern,
 
     // Create resulting string
     aResult = head;
-    MBool first = MB_TRUE;
+    bool first = true;
     txListIterator valueIter(&values);
     txListIterator counterIter(&counters);
     valueIter.resetToEnd();
@@ -92,7 +92,7 @@ nsresult txXSLTNumber::createNumber(Expr* aValueExpr, txPattern* aCountPattern,
         }
 
         counter->appendNumber(value, aResult);
-        first = MB_FALSE;
+        first = false;
     }
     
     aResult.Append(tail);
@@ -136,13 +136,13 @@ txXSLTNumber::getValueList(Expr* aValueExpr, txPattern* aCountPattern,
     // Otherwise use count/from/level
 
     txPattern* countPattern = aCountPattern;
-    MBool ownsCountPattern = MB_FALSE;
+    bool ownsCountPattern = false;
     const txXPathNode& currNode = aContext->getContextNode();
 
     // Parse count- and from-attributes
 
     if (!aCountPattern) {
-        ownsCountPattern = MB_TRUE;
+        ownsCountPattern = true;
         txNodeTest* nodeTest;
         PRUint16 nodeType = txXPathNodeUtils::getNodeType(currNode);
         switch (nodeType) {
@@ -191,7 +191,7 @@ txXSLTNumber::getValueList(Expr* aValueExpr, txPattern* aCountPattern,
         }
         NS_ENSURE_TRUE(nodeTest, NS_ERROR_OUT_OF_MEMORY);
 
-        countPattern = new txStepPattern(nodeTest, MB_FALSE);
+        countPattern = new txStepPattern(nodeTest, false);
         if (!countPattern) {
             // XXX error reporting
             delete nodeTest;
@@ -239,12 +239,12 @@ txXSLTNumber::getValueList(Expr* aValueExpr, txPattern* aCountPattern,
     else if (aLevel == eLevelMultiple) {
         // find all ancestor-or-selfs that matches count until...
         txXPathTreeWalker walker(currNode);
-        MBool matchedFrom = MB_FALSE;
+        bool matchedFrom = false;
         do {
             if (aFromPattern && !walker.isOnNode(currNode) &&
                 aFromPattern->matches(walker.getCurrentPosition(), aContext)) {
                 //... we find one that matches from
-                matchedFrom = MB_TRUE;
+                matchedFrom = true;
                 break;
             }
 
@@ -264,13 +264,13 @@ txXSLTNumber::getValueList(Expr* aValueExpr, txPattern* aCountPattern,
     // level = "any"
     else if (aLevel == eLevelAny) {
         PRInt32 value = 0;
-        MBool matchedFrom = MB_FALSE;
+        bool matchedFrom = false;
 
         txXPathTreeWalker walker(currNode);
         do {
             if (aFromPattern && !walker.isOnNode(currNode) &&
                 aFromPattern->matches(walker.getCurrentPosition(), aContext)) {
-                matchedFrom = MB_TRUE;
+                matchedFrom = true;
                 break;
             }
 
@@ -450,12 +450,12 @@ txXSLTNumber::getPrevInDocumentOrder(txXPathTreeWalker& aWalker)
     return aWalker.moveToParent();
 }
 
-#define TX_CHAR_RANGE(ch, a, b) if (ch < a) return MB_FALSE; \
-    if (ch <= b) return MB_TRUE
-#define TX_MATCH_CHAR(ch, a) if (ch < a) return MB_FALSE; \
-    if (ch == a) return MB_TRUE
+#define TX_CHAR_RANGE(ch, a, b) if (ch < a) return false; \
+    if (ch <= b) return true
+#define TX_MATCH_CHAR(ch, a) if (ch < a) return false; \
+    if (ch == a) return true
 
-MBool txXSLTNumber::isAlphaNumeric(PRUnichar ch)
+bool txXSLTNumber::isAlphaNumeric(PRUnichar ch)
 {
     TX_CHAR_RANGE(ch, 0x0030, 0x0039);
     TX_CHAR_RANGE(ch, 0x0041, 0x005A);
@@ -747,5 +747,5 @@ MBool txXSLTNumber::isAlphaNumeric(PRUnichar ch)
     TX_CHAR_RANGE(ch, 0xFFC2, 0xFFC7);
     TX_CHAR_RANGE(ch, 0xFFCA, 0xFFCF);
     TX_CHAR_RANGE(ch, 0xFFD2, 0xFFD7);
-    return MB_FALSE;
+    return false;
 }
diff --git a/content/xslt/src/xslt/txXSLTNumber.h b/content/xslt/src/xslt/txXSLTNumber.h
index d6fe96464136..3e801372b733 100644
--- a/content/xslt/src/xslt/txXSLTNumber.h
+++ b/content/xslt/src/xslt/txXSLTNumber.h
@@ -85,7 +85,7 @@ private:
     
     static bool getPrevInDocumentOrder(txXPathTreeWalker& aWalker);
 
-    static MBool isAlphaNumeric(PRUnichar ch);
+    static bool isAlphaNumeric(PRUnichar ch);
 };
 
 class txFormattedCounter {
diff --git a/content/xslt/src/xslt/txXSLTNumberCounters.cpp b/content/xslt/src/xslt/txXSLTNumberCounters.cpp
index 7a91c1ab4e84..54c9e2f7c6f5 100644
--- a/content/xslt/src/xslt/txXSLTNumberCounters.cpp
+++ b/content/xslt/src/xslt/txXSLTNumberCounters.cpp
@@ -71,7 +71,7 @@ private:
 
 class txRomanCounter : public txFormattedCounter {
 public:
-    txRomanCounter(MBool aUpper) : mTableOffset(aUpper ? 30 : 0)
+    txRomanCounter(bool aUpper) : mTableOffset(aUpper ? 30 : 0)
     {
     }
 
diff --git a/content/xslt/src/xslt/txXSLTPatterns.cpp b/content/xslt/src/xslt/txXSLTPatterns.cpp
index 9028d5e3e587..cc54ff17917c 100644
--- a/content/xslt/src/xslt/txXSLTPatterns.cpp
+++ b/content/xslt/src/xslt/txXSLTPatterns.cpp
@@ -63,15 +63,15 @@ double txUnionPattern::getDefaultPriority()
  * This should be called on the simple patterns for xsl:template,
  * but is fine for xsl:key and xsl:number
  */
-MBool txUnionPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
+bool txUnionPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
 {
     PRUint32 i, len = mLocPathPatterns.Length();
     for (i = 0; i < len; ++i) {
         if (mLocPathPatterns[i]->matches(aNode, aContext)) {
-            return MB_TRUE;
+            return true;
         }
     }
-    return MB_FALSE;
+    return false;
 }
 
 txPattern::Type
@@ -134,7 +134,7 @@ nsresult txLocPathPattern::addStep(txPattern* aPattern, bool isChild)
     return NS_OK;
 }
 
-MBool txLocPathPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
+bool txLocPathPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
 {
     NS_ASSERTION(mSteps.Length() > 1, "Internal error");
 
@@ -153,17 +153,17 @@ MBool txLocPathPattern::matches(const txXPathNode& aNode, txIMatchContext* aCont
     PRUint32 pos = mSteps.Length();
     Step* step = &mSteps[--pos];
     if (!step->pattern->matches(aNode, aContext))
-        return MB_FALSE;
+        return false;
 
     txXPathTreeWalker walker(aNode);
     bool hasParent = walker.moveToParent();
 
     while (step->isChild) {
         if (!pos)
-            return MB_TRUE; // all steps matched
+            return true; // all steps matched
         step = &mSteps[--pos];
         if (!hasParent || !step->pattern->matches(walker.getCurrentPosition(), aContext))
-            return MB_FALSE; // no more ancestors or no match
+            return false; // no more ancestors or no match
 
         hasParent = walker.moveToParent();
     }
@@ -174,7 +174,7 @@ MBool txLocPathPattern::matches(const txXPathNode& aNode, txIMatchContext* aCont
 
     while (pos) {
         if (!hasParent)
-            return MB_FALSE; // There are more steps in the current block 
+            return false; // There are more steps in the current block 
                              // than ancestors of the tested node
 
         step = &mSteps[--pos];
@@ -195,7 +195,7 @@ MBool txLocPathPattern::matches(const txXPathNode& aNode, txIMatchContext* aCont
         }
     }
 
-    return MB_TRUE;
+    return true;
 } // txLocPathPattern::matches
 
 double txLocPathPattern::getDefaultPriority()
@@ -249,7 +249,7 @@ txLocPathPattern::toString(nsAString& aDest)
  * a txPattern matching the document node, or '/'
  */
 
-MBool txRootPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
+bool txRootPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
 {
     return txXPathNodeUtils::isRoot(aNode);
 }
@@ -295,7 +295,7 @@ txIdPattern::txIdPattern(const nsSubstring& aString)
     }
 }
 
-MBool txIdPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
+bool txIdPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
 {
     if (!txXPathNodeUtils::isElement(aNode)) {
         return false;
@@ -351,7 +351,7 @@ txIdPattern::toString(nsAString& aDest)
  * argument.
  */
 
-MBool txKeyPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
+bool txKeyPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
 {
     txExecutionState* es = (txExecutionState*)aContext->getPrivateContext();
     nsAutoPtr<txXPathNode> contextDoc(txXPathNodeUtils::getOwnerDocument(aNode));
@@ -404,21 +404,21 @@ txKeyPattern::toString(nsAString& aDest)
  * a txPattern to hold the NodeTest and the Predicates of a StepPattern
  */
 
-MBool txStepPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
+bool txStepPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext)
 {
     NS_ASSERTION(mNodeTest, "Internal error");
 
     if (!mNodeTest->matches(aNode, aContext))
-        return MB_FALSE;
+        return false;
 
     txXPathTreeWalker walker(aNode);
     if ((!mIsAttr &&
          txXPathNodeUtils::isAttribute(walker.getCurrentPosition())) ||
         !walker.moveToParent()) {
-        return MB_FALSE;
+        return false;
     }
     if (isEmpty()) {
-        return MB_TRUE;
+        return true;
     }
 
     /*
@@ -431,7 +431,7 @@ MBool txStepPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext
      *   if the result is a number, check the context position,
      *    otherwise convert to bool
      *   if result is true, copy node to newNodes
-     *  if aNode is not member of newNodes, return MB_FALSE
+     *  if aNode is not member of newNodes, return false
      *  nodes = newNodes
      *
      * For the last Predicate, evaluate Predicate with aNode as
@@ -442,7 +442,7 @@ MBool txStepPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext
     // Create the context node set for evaluating the predicates
     nsRefPtr<txNodeSet> nodes;
     nsresult rv = aContext->recycler()->getNodeSet(getter_AddRefs(nodes));
-    NS_ENSURE_SUCCESS(rv, MB_FALSE);
+    NS_ENSURE_SUCCESS(rv, false);
 
     bool hasNext = mIsAttr ? walker.moveToFirstAttribute() :
                                walker.moveToFirstChild();
@@ -457,12 +457,12 @@ MBool txStepPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext
     Expr* predicate = mPredicates[0];
     nsRefPtr<txNodeSet> newNodes;
     rv = aContext->recycler()->getNodeSet(getter_AddRefs(newNodes));
-    NS_ENSURE_SUCCESS(rv, MB_FALSE);
+    NS_ENSURE_SUCCESS(rv, false);
 
     PRUint32 i, predLen = mPredicates.Length();
     for (i = 1; i < predLen; ++i) {
         newNodes->clear();
-        MBool contextIsInPredicate = MB_FALSE;
+        bool contextIsInPredicate = false;
         txNodeSetContext predContext(nodes, aContext);
         while (predContext.hasNext()) {
             predContext.next();
@@ -477,7 +477,7 @@ MBool txStepPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext
                         exprResult->numberValue()) {
                         const txXPathNode& tmp = predContext.getContextNode();
                         if (tmp == aNode)
-                            contextIsInPredicate = MB_TRUE;
+                            contextIsInPredicate = true;
                         newNodes->append(tmp);
                     }
                     break;
@@ -485,7 +485,7 @@ MBool txStepPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext
                     if (exprResult->booleanValue()) {
                         const txXPathNode& tmp = predContext.getContextNode();
                         if (tmp == aNode)
-                            contextIsInPredicate = MB_TRUE;
+                            contextIsInPredicate = true;
                         newNodes->append(tmp);
                     }
                     break;
@@ -495,7 +495,7 @@ MBool txStepPattern::matches(const txXPathNode& aNode, txIMatchContext* aContext
         nodes->clear();
         nodes->append(*newNodes);
         if (!contextIsInPredicate) {
-            return MB_FALSE;
+            return false;
         }
         predicate = mPredicates[i];
     }
diff --git a/content/xslt/src/xslt/txXSLTPatterns.h b/content/xslt/src/xslt/txXSLTPatterns.h
index 86848d117e15..45b8d5b7b224 100644
--- a/content/xslt/src/xslt/txXSLTPatterns.h
+++ b/content/xslt/src/xslt/txXSLTPatterns.h
@@ -59,7 +59,7 @@ public:
     /*
      * Determines whether this Pattern matches the given node.
      */
-    virtual MBool matches(const txXPathNode& aNode,
+    virtual bool matches(const txXPathNode& aNode,
                           txIMatchContext* aContext) = 0;
 
     /*
@@ -119,7 +119,7 @@ public:
 };
 
 #define TX_DECL_PATTERN_BASE \
-    MBool matches(const txXPathNode& aNode, txIMatchContext* aContext); \
+    bool matches(const txXPathNode& aNode, txIMatchContext* aContext); \
     double getDefaultPriority(); \
     virtual Expr* getSubExprAt(PRUint32 aPos); \
     virtual void setSubExprAt(PRUint32 aPos, Expr* aExpr); \
diff --git a/content/xslt/src/xslt/txXSLTProcessor.cpp b/content/xslt/src/xslt/txXSLTProcessor.cpp
index ebaa157f0f32..1d313de35e28 100644
--- a/content/xslt/src/xslt/txXSLTProcessor.cpp
+++ b/content/xslt/src/xslt/txXSLTProcessor.cpp
@@ -48,19 +48,19 @@
 TX_LG_IMPL
 
 /* static */
-MBool
+bool
 txXSLTProcessor::init()
 {
     TX_LG_CREATE;
 
     if (!txHandlerTable::init())
-        return MB_FALSE;
+        return false;
 
     extern bool TX_InitEXSLTFunction();
     if (!TX_InitEXSLTFunction())
-        return MB_FALSE;
+        return false;
 
-    return MB_TRUE;
+    return true;
 }
 
 /* static */
diff --git a/content/xslt/src/xslt/txXSLTProcessor.h b/content/xslt/src/xslt/txXSLTProcessor.h
index c96f3d7b6816..94c3105c7c3b 100644
--- a/content/xslt/src/xslt/txXSLTProcessor.h
+++ b/content/xslt/src/xslt/txXSLTProcessor.h
@@ -48,7 +48,7 @@ public:
      * Initialisation and shutdown routines. Initilizes and cleansup all
      * dependant classes
      */
-    static MBool init();
+    static bool init();
     static void shutdown();
 
 
diff --git a/content/xslt/tests/buster/buster-test.js b/content/xslt/tests/buster/buster-test.js
index 0bf51a40cfd5..3bf552228383 100644
--- a/content/xslt/tests/buster/buster-test.js
+++ b/content/xslt/tests/buster/buster-test.js
@@ -221,7 +221,7 @@ runItem.prototype =
     onProgressChange: function(aProg, b,c,d,e,f)
     {
     },
-    onLocationChange: function(aProg, aRequest, aURI)
+    onLocationChange: function(aProg, aRequest, aURI, aFlags)
     {
     },
     onStatusChange: function(aProg, aRequest, aStatus, aMessage)
diff --git a/dbm/src/Makefile.in b/dbm/src/Makefile.in
index 2f7476d8c86f..6c0122af173c 100644
--- a/dbm/src/Makefile.in
+++ b/dbm/src/Makefile.in
@@ -79,7 +79,6 @@ endif # WINNT
 LOCAL_INCLUDES	= -I$(srcdir)/../include
 
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/docshell/base/nsDefaultURIFixup.cpp b/docshell/base/nsDefaultURIFixup.cpp
index 30d98fade925..80475f9f5da0 100644
--- a/docshell/base/nsDefaultURIFixup.cpp
+++ b/docshell/base/nsDefaultURIFixup.cpp
@@ -234,9 +234,10 @@ nsDefaultURIFixup::CreateFixupURI(const nsACString& aStringURI, PRUint32 aFixupF
     // For these protocols, use system charset instead of the default UTF-8,
     // if the URI is non ASCII.
     bool bAsciiURI = IsASCII(uriString);
+    bool useUTF8 = (aFixupFlags & FIXUP_FLAG_USE_UTF8) ||
+                   Preferences::GetBool("browser.fixup.use-utf8", false);
     bool bUseNonDefaultCharsetForURI =
-                        !bAsciiURI &&
-                        !(aFixupFlags & FIXUP_FLAG_USE_UTF8) &&
+                        !bAsciiURI && !useUTF8 &&
                         (scheme.IsEmpty() ||
                          scheme.LowerCaseEqualsLiteral("http") ||
                          scheme.LowerCaseEqualsLiteral("https") ||
@@ -323,7 +324,7 @@ nsDefaultURIFixup::CreateFixupURI(const nsACString& aStringURI, PRUint32 aFixupF
             uriString.Assign(NS_LITERAL_CSTRING("http://") + uriString);
 
         // For ftp & http, we want to use system charset.
-        if (!bAsciiURI && !(aFixupFlags & FIXUP_FLAG_USE_UTF8))
+        if (!bAsciiURI && !useUTF8)
           bUseNonDefaultCharsetForURI = true;
     } // end if checkprotocol
 
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 2dd5a188c0bd..647c71877089 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -1770,17 +1770,19 @@ nsDocShell::GetChromeEventHandler(nsIDOMEventTarget** aChromeEventHandler)
     return NS_OK;
 }
 
-/* [noscript] void setCurrentURI (in nsIURI uri); */
+/* void setCurrentURI (in nsIURI uri); */
 NS_IMETHODIMP
 nsDocShell::SetCurrentURI(nsIURI *aURI)
 {
-    SetCurrentURI(aURI, nsnull, true);
+    // Note that securityUI will set STATE_IS_INSECURE, even if
+    // the scheme of |aURI| is "https".
+    SetCurrentURI(aURI, nsnull, true, 0);
     return NS_OK;
 }
 
 bool
 nsDocShell::SetCurrentURI(nsIURI *aURI, nsIRequest *aRequest,
-                          bool aFireOnLocationChange)
+                          bool aFireOnLocationChange, PRUint32 aLocationFlags)
 {
 #ifdef PR_LOGGING
     if (gDocShellLeakLog && PR_LOG_TEST(gDocShellLeakLog, PR_LOG_DEBUG)) {
@@ -1824,7 +1826,7 @@ nsDocShell::SetCurrentURI(nsIURI *aURI, nsIRequest *aRequest,
     }
 
     if (aFireOnLocationChange) {
-        FireOnLocationChange(this, aRequest, aURI);
+        FireOnLocationChange(this, aRequest, aURI, aLocationFlags);
     }
     return !aFireOnLocationChange;
 }
@@ -5928,7 +5930,7 @@ nsDocShell::OnStateChange(nsIWebProgress * aProgress, nsIRequest * aRequest,
                 // a new DOM here.
                 rv = AddToSessionHistory(uri, wcwgChannel, nsnull, false,
                                          getter_AddRefs(mLSHE));
-                SetCurrentURI(uri, aRequest, true);
+                SetCurrentURI(uri, aRequest, true, 0);
                 // Save history state of the previous page
                 rv = PersistLayoutHistoryState();
                 // We'll never get an Embed() for this load, so just go ahead
@@ -5984,8 +5986,8 @@ nsDocShell::OnStateChange(nsIWebProgress * aProgress, nsIRequest * aRequest,
 }
 
 NS_IMETHODIMP
-nsDocShell::OnLocationChange(nsIWebProgress * aProgress,
-                             nsIRequest * aRequest, nsIURI * aURI)
+nsDocShell::OnLocationChange(nsIWebProgress * aProgress, nsIRequest * aRequest,
+                             nsIURI * aURI, PRUint32 aFlags)
 {
     NS_NOTREACHED("notification excluded in AddProgressListener(...)");
     return NS_OK;
@@ -6515,7 +6517,7 @@ nsDocShell::CreateAboutBlankContentViewer(nsIPrincipal* aPrincipal,
         viewer->SetContainer(static_cast<nsIContentViewerContainer *>(this));
         Embed(viewer, "", 0);
 
-        SetCurrentURI(blankDoc->GetDocumentURI(), nsnull, true);
+        SetCurrentURI(blankDoc->GetDocumentURI(), nsnull, true, 0);
         rv = mIsBeingDestroyed ? NS_ERROR_NOT_AVAILABLE : NS_OK;
       }
     }
@@ -7166,7 +7168,7 @@ nsDocShell::RestoreFromHistory()
         // is still mLSHE or whether it's now mOSHE.
         nsCOMPtr<nsIURI> uri;
         origLSHE->GetURI(getter_AddRefs(uri));
-        SetCurrentURI(uri, document->GetChannel(), true);
+        SetCurrentURI(uri, document->GetChannel(), true, 0);
     }
 
     // This is the end of our CreateContentViewer() replacement.
@@ -7505,7 +7507,7 @@ nsDocShell::CreateContentViewer(const char *aContentType,
     }
 
     if (onLocationChangeNeeded) {
-      FireOnLocationChange(this, request, mCurrentURI);
+      FireOnLocationChange(this, request, mCurrentURI, 0);
     }
   
     return NS_OK;
@@ -8365,6 +8367,11 @@ nsDocShell::InternalLoad(nsIURI * aURI,
             // Pass true for aCloneSHChildren, since we're not
             // changing documents here, so all of our subframes are
             // still relevant to the new session history entry.
+            //
+            // It also makes OnNewURI(...) set LOCATION_CHANGE_SAME_DOCUMENT
+            // flag on firing onLocationChange(...).
+            // Anyway, aCloneSHChildren param is simply reflecting
+            // doShortCircuitedLoad in this scope.
             OnNewURI(aURI, nsnull, owner, mLoadType, true, true, true);
 
             nsCOMPtr<nsIInputStream> postData;
@@ -9418,8 +9425,14 @@ nsDocShell::OnNewURI(nsIURI * aURI, nsIChannel * aChannel, nsISupports* aOwner,
 #endif
         }
     }
+
+    // aCloneSHChildren exactly means "we are not loading a new document".
+    PRUint32 locationFlags = aCloneSHChildren?
+                                 PRUint32(LOCATION_CHANGE_SAME_DOCUMENT) : 0;
+
     bool onLocationChangeNeeded = SetCurrentURI(aURI, aChannel,
-                                                  aFireOnLocationChange);
+                                                aFireOnLocationChange,
+                                                locationFlags);
     // Make sure to store the referrer from the channel, if any
     SetupReferrerFromChannel(aChannel);
     return onLocationChangeNeeded;
@@ -9727,8 +9740,14 @@ nsDocShell::AddState(nsIVariant *aData, const nsAString& aTitle,
     // gets updated and the back button is enabled, but we only need to
     // explicitly call FireOnLocationChange if we're not calling SetCurrentURI,
     // since SetCurrentURI will call FireOnLocationChange for us.
+    //
+    // Both SetCurrentURI(...) and FireDummyOnLocationChange() pass
+    // nsnull for aRequest param to FireOnLocationChange(...). Such an update
+    // notification is allowed only when we know docshell is not loading a new
+    // document and it requires LOCATION_CHANGE_SAME_DOCUMENT flag. Otherwise,
+    // FireOnLocationChange(...) breaks security UI.
     if (!equalURIs) {
-        SetCurrentURI(newURI, nsnull, true);
+        SetCurrentURI(newURI, nsnull, true, LOCATION_CHANGE_SAME_DOCUMENT);
         document->SetDocumentURI(newURI);
 
         AddURIVisit(newURI, oldURI, oldURI, 0);
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index 934cf808ca7f..a840ad1397c2 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -269,10 +269,12 @@ public:
 
     friend class OnLinkClickEvent;
 
-    // We need dummy OnLocationChange in some cases to update the UI.
+    // We need dummy OnLocationChange in some cases to update the UI without
+    // updating security info.
     void FireDummyOnLocationChange()
     {
-      FireOnLocationChange(this, nsnull, mCurrentURI);
+        FireOnLocationChange(this, nsnull, mCurrentURI,
+                             LOCATION_CHANGE_SAME_DOCUMENT);
     }
 
     nsresult HistoryTransactionRemoved(PRInt32 aIndex);
@@ -593,7 +595,8 @@ protected:
     // FireOnLocationChange is called.
     // In all other cases false is returned.
     bool SetCurrentURI(nsIURI *aURI, nsIRequest *aRequest,
-                         bool aFireOnLocationChange);
+                       bool aFireOnLocationChange,
+                       PRUint32 aLocationFlags);
 
     // The following methods deal with saving and restoring content viewers
     // in session history.
diff --git a/docshell/build/nsDocShellModule.cpp b/docshell/build/nsDocShellModule.cpp
index 89030e8c4507..d5f2c1719737 100644
--- a/docshell/build/nsDocShellModule.cpp
+++ b/docshell/build/nsDocShellModule.cpp
@@ -57,10 +57,10 @@
 #ifdef MOZ_ENABLE_DBUS
 #include "nsDBusHandlerApp.h"
 #endif 
-#if defined(ANDROID) || defined(MOZ_ENABLE_MEEGOTOUCHSHARE)
+#if defined(MOZ_WIDGET_ANDROID) || defined(MOZ_ENABLE_MEEGOTOUCHSHARE)
 #include "nsExternalSharingAppService.h"
 #endif
-#if defined(ANDROID)
+#if defined(MOZ_WIDGET_ANDROID)
 #include "nsExternalURLHandlerService.h"
 #endif
 
@@ -118,10 +118,10 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(PlatformLocalHandlerApp_t)
 #ifdef MOZ_ENABLE_DBUS
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsDBusHandlerApp)
 #endif 
-#if defined(ANDROID) || defined(MOZ_ENABLE_MEEGOTOUCHSHARE)
+#if defined(MOZ_WIDGET_ANDROID) || defined(MOZ_ENABLE_MEEGOTOUCHSHARE)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsExternalSharingAppService)
 #endif
-#if defined(ANDROID)
+#if defined(MOZ_WIDGET_ANDROID)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsExternalURLHandlerService)
 #endif
 
@@ -148,10 +148,10 @@ NS_DEFINE_NAMED_CID(NS_LOCALHANDLERAPP_CID);
 #ifdef MOZ_ENABLE_DBUS
 NS_DEFINE_NAMED_CID(NS_DBUSHANDLERAPP_CID);
 #endif
-#if defined(ANDROID) || defined(MOZ_ENABLE_MEEGOTOUCHSHARE)
+#if defined(MOZ_WIDGET_ANDROID) || defined(MOZ_ENABLE_MEEGOTOUCHSHARE)
 NS_DEFINE_NAMED_CID(NS_EXTERNALSHARINGAPPSERVICE_CID);
 #endif
-#if defined(ANDROID)
+#if defined(MOZ_WIDGET_ANDROID)
 NS_DEFINE_NAMED_CID(NS_EXTERNALURLHANDLERSERVICE_CID);
 #endif
 NS_DEFINE_NAMED_CID(NS_SHENTRY_CID);
@@ -178,10 +178,10 @@ const mozilla::Module::CIDEntry kDocShellCIDs[] = {
 #ifdef MOZ_ENABLE_DBUS
   { &kNS_DBUSHANDLERAPP_CID, false, NULL, nsDBusHandlerAppConstructor },
 #endif
-#if defined(ANDROID) || defined(MOZ_ENABLE_MEEGOTOUCHSHARE)
+#if defined(MOZ_WIDGET_ANDROID) || defined(MOZ_ENABLE_MEEGOTOUCHSHARE)
   { &kNS_EXTERNALSHARINGAPPSERVICE_CID, false, NULL, nsExternalSharingAppServiceConstructor },
 #endif
-#if defined(ANDROID)
+#if defined(MOZ_WIDGET_ANDROID)
   { &kNS_EXTERNALURLHANDLERSERVICE_CID, false, NULL, nsExternalURLHandlerServiceConstructor },
 #endif
   { &kNS_SHENTRY_CID, false, NULL, nsSHEntryConstructor },
@@ -227,10 +227,10 @@ const mozilla::Module::ContractIDEntry kDocShellContracts[] = {
 #ifdef MOZ_ENABLE_DBUS
   { NS_DBUSHANDLERAPP_CONTRACTID, &kNS_DBUSHANDLERAPP_CID },
 #endif
-#if defined(ANDROID) || defined(MOZ_ENABLE_MEEGOTOUCHSHARE)
+#if defined(MOZ_WIDGET_ANDROID) || defined(MOZ_ENABLE_MEEGOTOUCHSHARE)
   { NS_EXTERNALSHARINGAPPSERVICE_CONTRACTID, &kNS_EXTERNALSHARINGAPPSERVICE_CID },
 #endif
-#if defined(ANDROID)
+#if defined(MOZ_WIDGET_ANDROID)
   { NS_EXTERNALURLHANDLERSERVICE_CONTRACTID, &kNS_EXTERNALURLHANDLERSERVICE_CID },
 #endif
   { NS_SHENTRY_CONTRACTID, &kNS_SHENTRY_CID },
diff --git a/docshell/test/chrome/Makefile.in b/docshell/test/chrome/Makefile.in
index b92291c281fd..6a0a5b623104 100644
--- a/docshell/test/chrome/Makefile.in
+++ b/docshell/test/chrome/Makefile.in
@@ -122,6 +122,8 @@ _TEST_FILES =	\
 		662200c.html \
 		test_bug690056.xul \
 		bug690056_window.xul \
+		test_bug311007.xul \
+		bug311007_window.xul \
 		$(NULL)
 
 _DOCSHELL_SUBHARNESS = \
diff --git a/docshell/test/chrome/bug311007_window.xul b/docshell/test/chrome/bug311007_window.xul
new file mode 100644
index 000000000000..2db7a4bbc9e8
--- /dev/null
+++ b/docshell/test/chrome/bug311007_window.xul
@@ -0,0 +1,186 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window id="311007Test"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        width="600"
+        height="600"
+        onload="startup();"
+        title="bug 311007 test">
+
+  <script type="application/javascript" src="docshell_helpers.js"></script>
+  <script type="application/javascript"><![CDATA[
+/*
+   Regression test for bug 283733 and bug 307027.
+
+   Bug 283733
+     "accessing a relative anchor in a secure page removes the
+      locked icon and yellow background UI"
+
+   Bug 307027
+     "Going back from secure page to error page does not clear yellow bar"
+
+ */
+
+const kDNSErrorURI = "https://example/err.html";
+const kSecureURI =
+  "https://example.com/tests/docshell/test/navigation/blank.html";
+
+/*
+  Step 1: load a network error page.   <err.html>       Not Secure
+  Step 2: load a secure page.          <blank.html>     Secure
+  Step 3: a secure page + hashchange.  <blank.html#foo> Secure     (bug 283733)
+  Step 4: go back to the error page.   <err.html>       Not Secure (bug 307027)
+ */
+
+var gListener = null;
+
+function WebProgressListener() {
+  this._callback = null;
+}
+
+WebProgressListener.prototype = {
+  QueryInterface: function(aIID) {
+    if (aIID.equals(Components.interfaces.nsIWebProgressListener) ||
+        aIID.equals(Components.interfaces.nsISupportsWeakReference) ||
+        aIID.equals(Components.interfaces.nsISupports))
+      return this;
+    throw Components.results.NS_NOINTERFACE;
+  },
+
+  onLocationChange: function(aWebProgress, aRequest, aLocation, aFlags) {
+    setTimeout(this._callback, 0, aWebProgress, aRequest, aLocation, aFlags);
+  },
+
+  set callback(aVal) {
+    this._callback = aVal;
+  }
+};
+
+function startup() {
+  gListener = new WebProgressListener();
+
+  document.getElementById("content")
+          .webProgress
+          .addProgressListener(gListener,
+                               Components.interfaces.nsIWebProgress
+                                         .NOTIFY_LOCATION);
+
+  setTimeout(step1A, 0);
+}
+
+/******************************************************************************
+ * Step 1: Load an error page, and confirm UA knows it's insecure.
+ ******************************************************************************/
+
+function step1A() {
+  gListener.callback = step1B;
+  content.location = kDNSErrorURI;
+}
+
+function step1B(aWebProgress, aRequest, aLocation, aFlags) {
+  /* XXX Here we receive 2 notifications, due to bug 673752. */
+  if (!aRequest) {
+    return;
+  }
+
+  is(aLocation.spec, kDNSErrorURI, "Error page's URI (1)");
+
+  ok(!(aFlags & Components.interfaces.nsIWebProgressListener
+                          .LOCATION_CHANGE_SAME_DOCUMENT),
+     "DocShell loaded a document (1)");
+
+  ok(!(aWebProgress.QueryInterface(Components.interfaces.nsIDocShell)
+                   .securityUI.state &
+       Components.interfaces.nsIWebProgressListener.STATE_IS_SECURE),
+     "This is not a secure page (1)");
+
+  /* Go to step 2. */
+  setTimeout(step2A, 0);
+}
+
+/******************************************************************************
+ * Step 2: Load a HTTPS page, and confirm it's secure. 
+ ******************************************************************************/
+
+function step2A() {
+  gListener.callback = step2B;
+  content.location = kSecureURI;
+}
+
+function step2B(aWebProgress, aRequest, aLocation, aFlags) {
+  is(aLocation.spec, kSecureURI, "A URI on HTTPS (2)");
+
+  ok(!(aFlags & Components.interfaces.nsIWebProgressListener
+                          .LOCATION_CHANGE_SAME_DOCUMENT),
+     "DocShell loaded a document (2)");
+
+  ok((aWebProgress.QueryInterface(Components.interfaces.nsIDocShell)
+                  .securityUI.state &
+      Components.interfaces.nsIWebProgressListener.STATE_IS_SECURE),
+     "This is a secure page (2)");
+
+  /* Go to step 3. */
+  setTimeout(step3A, 0);
+}
+
+/*****************************************************************************
+ * Step 3: Trigger hashchange within a secure page, and confirm UA knows
+ *         it's secure. (Bug 283733)
+ *****************************************************************************/
+
+function step3A() {
+  gListener.callback = step3B;
+  content.location += "#foo";
+}
+
+function step3B(aWebProgress, aRequest, aLocation, aFlags) {
+  is(aLocation.spec, kSecureURI + "#foo", "hashchange on HTTPS (3)");
+
+  ok((aFlags & Components.interfaces.nsIWebProgressListener
+                         .LOCATION_CHANGE_SAME_DOCUMENT),
+     "We are in the same document as before (3)");
+
+  ok((aWebProgress.QueryInterface(Components.interfaces.nsIDocShell)
+                  .securityUI.state &
+      Components.interfaces.nsIWebProgressListener.STATE_IS_SECURE),
+     "This is a secure page (3)");
+
+  /* Go to step 4. */
+  setTimeout(step4A, 0);
+}
+
+/*****************************************************************************
+ * Step 4: Go back from a secure page to an error page, and confirm UA knows
+ *         it's not secure. (Bug 307027)
+ *****************************************************************************/
+
+function step4A() {
+  gListener.callback = step4B;
+  content.history.go(-2);
+}
+
+function step4B(aWebProgress, aRequest, aLocation, aFlags) {
+  if (!aRequest) // See step1B(...) and bug 673752.
+    return;
+
+  is(aLocation.spec, kDNSErrorURI, "Go back to the error URI (4)");
+
+  ok(!(aFlags & Components.interfaces.nsIWebProgressListener
+                          .LOCATION_CHANGE_SAME_DOCUMENT),
+       "DocShell loaded a document (4)");
+
+  ok(!(aWebProgress.QueryInterface(Components.interfaces.nsIDocShell)
+                   .securityUI.state &
+       Components.interfaces.nsIWebProgressListener.STATE_IS_SECURE),
+     "This is not a secure page (4)");
+
+  /* End. */
+  aWebProgress.removeProgressListener(gListener);
+  delete(gListener);
+  finish();
+}
+  ]]></script>
+
+  <browser type="content-primary" flex="1" id="content" src="about:blank"/>
+</window>
diff --git a/docshell/test/chrome/test_bug311007.xul b/docshell/test/chrome/test_bug311007.xul
new file mode 100644
index 000000000000..73b1e8fcb57c
--- /dev/null
+++ b/docshell/test/chrome/test_bug311007.xul
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet
+  href="chrome://mochikit/content/tests/SimpleTest/test.css"
+  type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=311007.xul
+-->
+<window title="Mozilla Bug 311007"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <title>Test for Bug 311007</title>
+  <script type="application/javascript"
+    src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+    src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+<body  xmlns="http://www.w3.org/1999/xhtml">
+<a target="_blank"
+   href="https://bugzilla.mozilla.org/show_bug.cgi?id=311007">
+   Mozilla Bug 311007</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+
+<script class="testbody" type="application/javascript">
+<![CDATA[
+
+/** Test for Bug 311007 **/
+
+SimpleTest.waitForExplicitFinish();
+window.open("bug311007_window.xul", "bug311007",
+            "chrome,width=600,height=600");
+
+]]>
+</script>
+
+</window>
diff --git a/docshell/test/chrome/window.template.txt b/docshell/test/chrome/window.template.txt
index e07b47006bf9..76eb72c652b9 100644
--- a/docshell/test/chrome/window.template.txt
+++ b/docshell/test/chrome/window.template.txt
@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <?xml-stylesheet href="chrome://global/skin" type="text/css"?>
 
-<window id="303267Test"
+<window id="{BUGNUMBER}Test"
         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         width="600"
         height="600"
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index 21674d577cc9..4f4ffb2c830d 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -465,6 +465,19 @@ nsFocusManager::SetFocus(nsIDOMElement* aElement, PRUint32 aFlags)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsFocusManager::ElementIsFocusable(nsIDOMElement* aElement, PRUint32 aFlags,
+                                   bool* aIsFocusable)
+{
+  NS_ENSURE_TRUE(aElement, NS_ERROR_INVALID_ARG);
+
+  nsCOMPtr<nsIContent> aContent = do_QueryInterface(aElement);
+
+  *aIsFocusable = CheckIfFocusable(aContent, aFlags) != nsnull;
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsFocusManager::MoveFocus(nsIDOMWindow* aWindow, nsIDOMElement* aStartElement,
                           PRUint32 aType, PRUint32 aFlags, nsIDOMElement** aElement)
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index f62e6d8f29a3..4ce0a1286a66 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -253,6 +253,10 @@
 #include "nsLocation.h"
 #include "nsWrapperCacheInlines.h"
 
+#ifdef ANDROID
+#include <android/log.h>
+#endif
+
 #ifdef PR_LOGGING
 static PRLogModuleInfo* gDOMLeakPRLog;
 #endif
@@ -4571,6 +4575,9 @@ nsGlobalWindow::Dump(const nsAString& aStr)
 #endif
 
   if (cstr) {
+#ifdef ANDROID
+    __android_log_print(ANDROID_LOG_INFO, "Gecko", cstr);
+#endif
     FILE *fp = gDumpFile ? gDumpFile : stdout;
     fputs(cstr, fp);
     fflush(fp);
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index f60ff12eb10f..7259cd36a349 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -162,7 +162,7 @@ JSRuntime *nsJSRuntime::sRuntime;
 static const char kJSRuntimeServiceContractID[] =
   "@mozilla.org/js/xpc/RuntimeService;1";
 
-static JSGCCallback gOldJSGCCallback;
+static PRTime sFirstCollectionTime;
 
 static bool sIsInitialized;
 static bool sDidShutdown;
@@ -937,6 +937,7 @@ static const char js_methodjit_always_str[]   = JS_OPTIONS_DOT_STR "methodjit_al
 static const char js_typeinfer_str[]          = JS_OPTIONS_DOT_STR "typeinference";
 static const char js_pccounts_content_str[]   = JS_OPTIONS_DOT_STR "pccounts.content";
 static const char js_pccounts_chrome_str[]    = JS_OPTIONS_DOT_STR "pccounts.chrome";
+static const char js_jit_hardening_str[]      = JS_OPTIONS_DOT_STR "jit_hardening";
 static const char js_memlog_option_str[] = JS_OPTIONS_DOT_STR "mem.log";
 
 int
@@ -973,6 +974,7 @@ nsJSContext::JSOptionChangedCallback(const char *pref, void *data)
                                             js_pccounts_content_str);
   bool useMethodJITAlways = Preferences::GetBool(js_methodjit_always_str);
   bool useTypeInference = !chromeWindow && Preferences::GetBool(js_typeinfer_str);
+  bool useHardening = Preferences::GetBool(js_jit_hardening_str);
   nsCOMPtr<nsIXULRuntime> xr = do_GetService(XULRUNTIME_SERVICE_CONTRACTID);
   if (xr) {
     bool safeMode = false;
@@ -984,6 +986,7 @@ nsJSContext::JSOptionChangedCallback(const char *pref, void *data)
       usePCCounts = false;
       useTypeInference = false;
       useMethodJITAlways = true;
+      useHardening = false;
     }
   }    
 
@@ -1012,6 +1015,11 @@ nsJSContext::JSOptionChangedCallback(const char *pref, void *data)
   else
     newDefaultJSOptions &= ~JSOPTION_METHODJIT_ALWAYS;
 
+  if (useHardening)
+    newDefaultJSOptions &= ~JSOPTION_SOFTEN;
+  else
+    newDefaultJSOptions |= JSOPTION_SOFTEN;
+
   if (useTypeInference)
     newDefaultJSOptions |= JSOPTION_TYPE_INFERENCE;
   else
@@ -3244,10 +3252,17 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener)
 
   if (sPostGCEventsToConsole) {
     PRTime now = PR_Now();
+    PRTime delta = 0;
+    if (sFirstCollectionTime) {
+      delta = now - sFirstCollectionTime;
+    } else {
+      sFirstCollectionTime = now;
+    }
+
     NS_NAMED_LITERAL_STRING(kFmt,
-                            "CC timestamp: %lld, collected: %lu (%lu waiting for GC), suspected: %lu, duration: %llu ms.");
+                            "CC(T+%.1f) collected: %lu (%lu waiting for GC), suspected: %lu, duration: %llu ms.");
     nsString msg;
-    msg.Adopt(nsTextFormatter::smprintf(kFmt.get(), now,
+    msg.Adopt(nsTextFormatter::smprintf(kFmt.get(), double(delta) / PR_USEC_PER_SEC,
                                         collected, sCCollectedWaitingForGC, suspected,
                                         (now - start) / PR_USEC_PER_MSEC));
     nsCOMPtr<nsIConsoleService> cs =
@@ -3388,67 +3403,59 @@ nsJSContext::GC()
   PokeGC();
 }
 
-static JSBool
-DOMGCCallback(JSContext *cx, JSGCStatus status)
+static void
+DOMGCFinishedCallback(JSRuntime *rt, JSCompartment *comp, const char *status)
 {
-  static PRTime start;
+  NS_ASSERTION(NS_IsMainThread(), "GCs must run on the main thread");
 
-  if (sPostGCEventsToConsole && NS_IsMainThread()) {
-    if (status == JSGC_BEGIN) {
-      start = PR_Now();
-    } else if (status == JSGC_END) {
-      PRTime now = PR_Now();
-      NS_NAMED_LITERAL_STRING(kFmt, "GC mode: %s, timestamp: %lld, duration: %llu ms.");
-      nsString msg;
-      msg.Adopt(nsTextFormatter::smprintf(kFmt.get(),
-                cx->runtime->gcTriggerCompartment ? "compartment" : "full",
-                now,
-                (now - start) / PR_USEC_PER_MSEC));
-      nsCOMPtr<nsIConsoleService> cs = do_GetService(NS_CONSOLESERVICE_CONTRACTID);
-      if (cs) {
-        cs->LogStringMessage(msg.get());
-      }
-    }
-  }
-
-  if (status == JSGC_END) {
-    sCCollectedWaitingForGC = 0;
-    if (sGCTimer) {
-      // If we were waiting for a GC to happen, kill the timer.
-      nsJSContext::KillGCTimer();
-
-      // If this is a compartment GC, restart it. We still want
-      // a full GC to happen. Compartment GCs usually happen as a
-      // result of last-ditch or MaybeGC. In both cases its
-      // probably a time of heavy activity and we want to delay
-      // the full GC, but we do want it to happen eventually.
-      if (cx->runtime->gcTriggerCompartment) {
-        nsJSContext::PokeGC();
-
-        // We poked the GC, so we can kill any pending CC here.
-        nsJSContext::KillCCTimer();
-      }
+  if (sPostGCEventsToConsole) {
+    PRTime now = PR_Now();
+    PRTime delta = 0;
+    if (sFirstCollectionTime) {
+      delta = now - sFirstCollectionTime;
     } else {
-      // If this was a full GC, poke the CC to run soon.
-      if (!cx->runtime->gcTriggerCompartment) {
-        sGCHasRun = true;
-        nsJSContext::PokeCC();
-      }
+      sFirstCollectionTime = now;
     }
 
-    // If we didn't end up scheduling a GC, and there are unused
-    // chunks waiting to expire, make sure we will GC again soon.
-    if (!sGCTimer && JS_GetGCParameter(cx->runtime, JSGC_UNUSED_CHUNKS) > 0) {
-      nsJSContext::PokeGC();
+    NS_NAMED_LITERAL_STRING(kFmt, "GC(T+%.1f) %s");
+    nsString msg;
+    msg.Adopt(nsTextFormatter::smprintf(kFmt.get(),
+                                        double(delta) / PR_USEC_PER_SEC, status));
+    nsCOMPtr<nsIConsoleService> cs = do_GetService(NS_CONSOLESERVICE_CONTRACTID);
+    if (cs) {
+      cs->LogStringMessage(msg.get());
     }
   }
 
-  JSBool result = gOldJSGCCallback ? gOldJSGCCallback(cx, status) : JS_TRUE;
+  sCCollectedWaitingForGC = 0;
+  if (sGCTimer) {
+    // If we were waiting for a GC to happen, kill the timer.
+    nsJSContext::KillGCTimer();
 
-  if (status == JSGC_BEGIN && !NS_IsMainThread())
-    return JS_FALSE;
+    // If this is a compartment GC, restart it. We still want
+    // a full GC to happen. Compartment GCs usually happen as a
+    // result of last-ditch or MaybeGC. In both cases its
+    // probably a time of heavy activity and we want to delay
+    // the full GC, but we do want it to happen eventually.
+    if (comp) {
+      nsJSContext::PokeGC();
 
-  return result;
+      // We poked the GC, so we can kill any pending CC here.
+      nsJSContext::KillCCTimer();
+    }
+  } else {
+    // If this was a full GC, poke the CC to run soon.
+    if (!comp) {
+      sGCHasRun = true;
+      nsJSContext::PokeCC();
+    }
+  }
+
+  // If we didn't end up scheduling a GC, and there are unused
+  // chunks waiting to expire, make sure we will GC again soon.
+  if (!sGCTimer && JS_GetGCParameter(rt, JSGC_UNUSED_CHUNKS) > 0) {
+    nsJSContext::PokeGC();
+  }
 }
 
 // Script object mananagement - note duplicate implementation
@@ -3553,7 +3560,6 @@ nsJSRuntime::Startup()
   gNameSpaceManager = nsnull;
   sRuntimeService = nsnull;
   sRuntime = nsnull;
-  gOldJSGCCallback = nsnull;
   sIsInitialized = false;
   sDidShutdown = false;
   sContextCount = 0;
@@ -3707,11 +3713,7 @@ nsJSRuntime::Init()
   // Let's make sure that our main thread is the same as the xpcom main thread.
   NS_ASSERTION(NS_IsMainThread(), "bad");
 
-  NS_ASSERTION(!gOldJSGCCallback,
-               "nsJSRuntime initialized more than once");
-
-  // Save the old GC callback to chain to it, for GC-observing generality.
-  gOldJSGCCallback = ::JS_SetGCCallbackRT(sRuntime, DOMGCCallback);
+  ::JS_SetGCFinishedCallback(sRuntime, DOMGCFinishedCallback);
 
   JSSecurityCallbacks *callbacks = JS_GetRuntimeSecurityCallbacks(sRuntime);
   NS_ASSERTION(callbacks, "SecMan should have set security callbacks!");
diff --git a/dom/battery/BatteryManager.cpp b/dom/battery/BatteryManager.cpp
index b62d33a24e8b..b5fdfee9f07b 100644
--- a/dom/battery/BatteryManager.cpp
+++ b/dom/battery/BatteryManager.cpp
@@ -35,6 +35,7 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+#include <limits>
 #include "mozilla/Hal.h"
 #include "BatteryManager.h"
 #include "nsIDOMClassInfo.h"
@@ -46,8 +47,10 @@
  * We have to use macros here because our leak analysis tool things we are
  * leaking strings when we have |static const nsString|. Sad :(
  */
-#define LEVELCHANGE_EVENT_NAME    NS_LITERAL_STRING("levelchange")
-#define CHARGINGCHANGE_EVENT_NAME NS_LITERAL_STRING("chargingchange")
+#define LEVELCHANGE_EVENT_NAME           NS_LITERAL_STRING("levelchange")
+#define CHARGINGCHANGE_EVENT_NAME        NS_LITERAL_STRING("chargingchange")
+#define DISCHARGINGTIMECHANGE_EVENT_NAME NS_LITERAL_STRING("dischargingtimechange")
+#define CHARGINGTIMECHANGE_EVENT_NAME    NS_LITERAL_STRING("chargingtimechange")
 
 DOMCI_DATA(BatteryManager, mozilla::dom::battery::BatteryManager)
 
@@ -61,12 +64,14 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(BatteryManager,
                                                   nsDOMEventTargetHelper)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnLevelChangeListener)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnChargingChangeListener)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnDischargingTimeChangeListener)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(BatteryManager,
                                                 nsDOMEventTargetHelper)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnLevelChangeListener)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnChargingChangeListener)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnDischargingTimeChangeListener)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(BatteryManager)
@@ -80,6 +85,7 @@ NS_IMPL_RELEASE_INHERITED(BatteryManager, nsDOMEventTargetHelper)
 BatteryManager::BatteryManager()
   : mLevel(kDefaultLevel)
   , mCharging(kDefaultCharging)
+  , mRemainingTime(kUnknownRemainingTime)
 {
 }
 
@@ -118,13 +124,39 @@ BatteryManager::GetCharging(bool* aCharging)
 }
 
 NS_IMETHODIMP
-BatteryManager::GetLevel(float* aLevel)
+BatteryManager::GetLevel(double* aLevel)
 {
   *aLevel = mLevel;
 
   return NS_OK;
 }
 
+NS_IMETHODIMP
+BatteryManager::GetDischargingTime(double* aDischargingTime)
+{
+  if (mCharging || mRemainingTime == kUnknownRemainingTime) {
+    *aDischargingTime = std::numeric_limits<double>::infinity();
+    return NS_OK;
+  }
+
+  *aDischargingTime = mRemainingTime;
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+BatteryManager::GetChargingTime(double* aChargingTime)
+{
+  if (!mCharging || mRemainingTime == kUnknownRemainingTime) {
+    *aChargingTime = std::numeric_limits<double>::infinity();
+    return NS_OK;
+  }
+
+  *aChargingTime = mRemainingTime;
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 BatteryManager::GetOnlevelchange(nsIDOMEventListener** aOnlevelchange)
 {
@@ -151,6 +183,36 @@ BatteryManager::SetOnchargingchange(nsIDOMEventListener* aOnchargingchange)
                                 mOnChargingChangeListener, aOnchargingchange);
 }
 
+NS_IMETHODIMP
+BatteryManager::GetOndischargingtimechange(nsIDOMEventListener** aOndischargingtimechange)
+{
+  return GetInnerEventListener(mOnDischargingTimeChangeListener,
+                               aOndischargingtimechange);
+}
+
+NS_IMETHODIMP
+BatteryManager::SetOndischargingtimechange(nsIDOMEventListener* aOndischargingtimechange)
+{
+  return RemoveAddEventListener(DISCHARGINGTIMECHANGE_EVENT_NAME,
+                                mOnDischargingTimeChangeListener,
+                                aOndischargingtimechange);
+}
+
+NS_IMETHODIMP
+BatteryManager::GetOnchargingtimechange(nsIDOMEventListener** aOnchargingtimechange)
+{
+  return GetInnerEventListener(mOnChargingTimeChangeListener,
+                               aOnchargingtimechange);
+}
+
+NS_IMETHODIMP
+BatteryManager::SetOnchargingtimechange(nsIDOMEventListener* aOnchargingtimechange)
+{
+  return RemoveAddEventListener(CHARGINGTIMECHANGE_EVENT_NAME,
+                                mOnChargingTimeChangeListener,
+                                aOnchargingtimechange);
+}
+
 nsresult
 BatteryManager::DispatchTrustedEventToSelf(const nsAString& aEventName)
 {
@@ -173,13 +235,15 @@ BatteryManager::UpdateFromBatteryInfo(const hal::BatteryInformation& aBatteryInf
 {
   mLevel = aBatteryInfo.level();
   mCharging = aBatteryInfo.charging();
+  mRemainingTime = aBatteryInfo.remainingTime();
 }
 
 void
 BatteryManager::Notify(const hal::BatteryInformation& aBatteryInfo)
 {
-  float previousLevel = mLevel;
+  double previousLevel = mLevel;
   bool previousCharging = mCharging;
+  double previousRemainingTime = mRemainingTime;
 
   UpdateFromBatteryInfo(aBatteryInfo);
 
@@ -190,6 +254,29 @@ BatteryManager::Notify(const hal::BatteryInformation& aBatteryInfo)
   if (previousLevel != mLevel) {
     DispatchTrustedEventToSelf(LEVELCHANGE_EVENT_NAME);
   }
+
+  /*
+   * There are a few situations that could happen here:
+   * 1. Charging state changed:
+   *   a. Previous remaining time wasn't unkwonw, we have to fire an event for
+   *      the change.
+   *   b. New remaining time isn't unkwonw, we have to fire an event for it.
+   * 2. Charging state didn't change but remainingTime did, we have to fire
+   *    the event that correspond to the current charging state.
+   */
+  if (mCharging != previousCharging) {
+    if (previousRemainingTime != kUnknownRemainingTime) {
+      DispatchTrustedEventToSelf(previousCharging ? CHARGINGTIMECHANGE_EVENT_NAME
+                                                  : DISCHARGINGTIMECHANGE_EVENT_NAME);
+    }
+    if (mRemainingTime != kUnknownRemainingTime) {
+      DispatchTrustedEventToSelf(mCharging ? CHARGINGTIMECHANGE_EVENT_NAME
+                                           : DISCHARGINGTIMECHANGE_EVENT_NAME);
+    }
+  } else if (previousRemainingTime != mRemainingTime) {
+    DispatchTrustedEventToSelf(mCharging ? CHARGINGTIMECHANGE_EVENT_NAME
+                                         : DISCHARGINGTIMECHANGE_EVENT_NAME);
+  }
 }
 
 /* static */ bool
diff --git a/dom/battery/BatteryManager.h b/dom/battery/BatteryManager.h
index fd8d2bc5d8d1..e4a4072df2f1 100644
--- a/dom/battery/BatteryManager.h
+++ b/dom/battery/BatteryManager.h
@@ -93,11 +93,18 @@ private:
    */
   void UpdateFromBatteryInfo(const hal::BatteryInformation& aBatteryInfo);
 
-  float mLevel;
-  bool  mCharging;
+  double mLevel;
+  bool   mCharging;
+  /**
+   * Represents the discharging time or the charging time, dpending on the
+   * current battery status (charging or not).
+   */
+  double mRemainingTime;
 
   nsRefPtr<nsDOMEventListenerWrapper> mOnLevelChangeListener;
   nsRefPtr<nsDOMEventListenerWrapper> mOnChargingChangeListener;
+  nsRefPtr<nsDOMEventListenerWrapper> mOnDischargingTimeChangeListener;
+  nsRefPtr<nsDOMEventListenerWrapper> mOnChargingTimeChangeListener;
 };
 
 } // namespace battery
diff --git a/dom/battery/Constants.h b/dom/battery/Constants.h
index bd836c1889f9..633abc226f6b 100644
--- a/dom/battery/Constants.h
+++ b/dom/battery/Constants.h
@@ -46,8 +46,9 @@ namespace mozilla {
 namespace dom {
 namespace battery {
 
-  static const float kDefaultLevel    = 1.0f;
-  static const bool  kDefaultCharging = true;
+  static const double kDefaultLevel         = 1.0;
+  static const bool   kDefaultCharging      = true;
+  static const double kUnknownRemainingTime = -1;
 
 } // namespace battery
 } // namespace dom
diff --git a/dom/battery/nsIDOMBatteryManager.idl b/dom/battery/nsIDOMBatteryManager.idl
index 27d385a51beb..27a51e591de3 100644
--- a/dom/battery/nsIDOMBatteryManager.idl
+++ b/dom/battery/nsIDOMBatteryManager.idl
@@ -38,12 +38,16 @@
 
 interface nsIDOMEventListener;
 
-[scriptable, function, uuid(6ac8bdb2-f005-469b-a55e-398e23ef3c95)]
+[scriptable, function, uuid(6dcb803b-e968-4c02-88f5-049a3f2a2efb)]
 interface nsIDOMBatteryManager : nsIDOMEventTarget
 {
-  readonly attribute float      level;
+  readonly attribute double     level;
   readonly attribute boolean    charging;
+  readonly attribute double     dischargingTime;
+  readonly attribute double     chargingTime;
 
   attribute nsIDOMEventListener onlevelchange;
   attribute nsIDOMEventListener onchargingchange;
+  attribute nsIDOMEventListener ondischargingtimechange;
+  attribute nsIDOMEventListener onchargingtimechange;
 };
diff --git a/dom/battery/test/test_battery_basics.html b/dom/battery/test/test_battery_basics.html
index 5bc70057a09a..8abbff90313f 100644
--- a/dom/battery/test/test_battery_basics.html
+++ b/dom/battery/test/test_battery_basics.html
@@ -19,6 +19,8 @@ ok('mozBattery' in navigator, "navigator.mozBattery should exist");
 var battery = navigator.mozBattery;
 is(battery.level, 1.0, "Default battery level should be 1.0");
 is(battery.charging, true, "Default charging value should be true");
+is(battery.dischargingTime, Infinity, "Default dischargingTime should be Inifinity");
+is(battery.chargingTime, Infinity, "Default chargingTime should be Inifinity");
 
 </script>
 </pre>
diff --git a/dom/indexedDB/AsyncConnectionHelper.cpp b/dom/indexedDB/AsyncConnectionHelper.cpp
index fd19f67351de..1bd7935cede8 100644
--- a/dom/indexedDB/AsyncConnectionHelper.cpp
+++ b/dom/indexedDB/AsyncConnectionHelper.cpp
@@ -50,9 +50,6 @@
 #include "IndexedDatabaseManager.h"
 #include "TransactionThreadPool.h"
 
-using mozilla::TimeStamp;
-using mozilla::TimeDuration;
-
 USING_INDEXEDDB_NAMESPACE
 
 namespace {
@@ -60,7 +57,6 @@ namespace {
 IDBTransaction* gCurrentTransaction = nsnull;
 
 const PRUint32 kProgressHandlerGranularity = 1000;
-const PRUint32 kDefaultTimeoutMS = 30000;
 
 NS_STACK_CLASS
 class TransactionPoolEventTarget : public nsIEventTarget
@@ -170,7 +166,6 @@ AsyncConnectionHelper::AsyncConnectionHelper(IDBDatabase* aDatabase,
                                              IDBRequest* aRequest)
 : HelperBase(aRequest),
   mDatabase(aDatabase),
-  mTimeoutDuration(TimeDuration::FromMilliseconds(kDefaultTimeoutMS)),
   mResultCode(NS_OK),
   mDispatched(false)
 {
@@ -182,7 +177,6 @@ AsyncConnectionHelper::AsyncConnectionHelper(IDBTransaction* aTransaction,
 : HelperBase(aRequest),
   mDatabase(aTransaction->mDatabase),
   mTransaction(aTransaction),
-  mTimeoutDuration(TimeDuration::FromMilliseconds(kDefaultTimeoutMS)),
   mResultCode(NS_OK),
   mDispatched(false)
 {
@@ -272,12 +266,13 @@ AsyncConnectionHelper::Run()
     }
   }
 
+  bool setProgressHandler = false;
   if (connection) {
     rv = connection->SetProgressHandler(kProgressHandlerGranularity, this,
                                         getter_AddRefs(mOldProgressHandler));
     NS_WARN_IF_FALSE(NS_SUCCEEDED(rv), "SetProgressHandler failed!");
     if (NS_SUCCEEDED(rv)) {
-      mStartTime = TimeStamp::Now();
+      setProgressHandler = true;
     }
   }
 
@@ -322,18 +317,16 @@ AsyncConnectionHelper::Run()
     }
   }
 
-  if (!mStartTime.IsNull()) {
+  if (setProgressHandler) {
     nsCOMPtr<mozIStorageProgressHandler> handler;
     rv = connection->RemoveProgressHandler(getter_AddRefs(handler));
     NS_WARN_IF_FALSE(NS_SUCCEEDED(rv), "RemoveProgressHandler failed!");
 #ifdef DEBUG
     if (NS_SUCCEEDED(rv)) {
-      nsCOMPtr<nsISupports> handlerSupports(do_QueryInterface(handler));
-      nsCOMPtr<nsISupports> thisSupports = do_QueryObject(this);
-      NS_ASSERTION(thisSupports == handlerSupports, "Mismatch!");
+      NS_ASSERTION(SameCOMIdentity(handler, static_cast<nsIRunnable*>(this)),
+                   "Mismatch!");
     }
 #endif
-    mStartTime = TimeStamp();
   }
 
   return NS_DispatchToMainThread(this, NS_DISPATCH_NORMAL);
@@ -349,12 +342,6 @@ AsyncConnectionHelper::OnProgress(mozIStorageConnection* aConnection,
     return NS_OK;
   }
 
-  TimeDuration elapsed = TimeStamp::Now() - mStartTime;
-  if (elapsed >= mTimeoutDuration) {
-    *_retval = true;
-    return NS_OK;
-  }
-
   if (mOldProgressHandler) {
     return mOldProgressHandler->OnProgress(aConnection, _retval);
   }
diff --git a/dom/indexedDB/AsyncConnectionHelper.h b/dom/indexedDB/AsyncConnectionHelper.h
index 6f72a567f4aa..34a4065c31dd 100644
--- a/dom/indexedDB/AsyncConnectionHelper.h
+++ b/dom/indexedDB/AsyncConnectionHelper.h
@@ -47,13 +47,11 @@
 
 #include "mozIStorageProgressHandler.h"
 #include "nsIRunnable.h"
-#include "nsIThread.h"
 
 #include "nsDOMEvent.h"
 
-#include "mozilla/TimeStamp.h"
-
 class mozIStorageConnection;
+class nsIEventTarget;
 
 BEGIN_INDEXEDDB_NAMESPACE
 
@@ -149,14 +147,6 @@ protected:
 
   virtual ~AsyncConnectionHelper();
 
-  /**
-   * Set the timeout duration in milliseconds.
-   */
-  void SetTimeoutMS(PRUint32 aTimeoutMS)
-  {
-    mTimeoutDuration = TimeDuration::FromMilliseconds(aTimeoutMS);
-  }
-
   /**
    * This is called on the main thread after Dispatch is called but before the
    * runnable is actually dispatched to the database thread. Allows the subclass
@@ -219,10 +209,6 @@ protected:
 
 private:
   nsCOMPtr<mozIStorageProgressHandler> mOldProgressHandler;
-
-  mozilla::TimeStamp mStartTime;
-  mozilla::TimeDuration mTimeoutDuration;
-
   nsresult mResultCode;
   bool mDispatched;
 };
diff --git a/dom/indexedDB/IDBDatabase.cpp b/dom/indexedDB/IDBDatabase.cpp
index 246c4a3dc0ac..c38197d0c5da 100644
--- a/dom/indexedDB/IDBDatabase.cpp
+++ b/dom/indexedDB/IDBDatabase.cpp
@@ -64,8 +64,6 @@ USING_INDEXEDDB_NAMESPACE
 
 namespace {
 
-const PRUint32 kDefaultDatabaseTimeoutSeconds = 30;
-
 PRUint32 gDatabaseInstanceCount = 0;
 mozilla::Mutex* gPromptHelpersMutex = nsnull;
 
@@ -705,8 +703,7 @@ IDBDatabase::Transaction(const jsval& aStoreNames,
   }
 
   nsRefPtr<IDBTransaction> transaction =
-    IDBTransaction::Create(this, storesToOpen, aMode,
-                           kDefaultDatabaseTimeoutSeconds);
+    IDBTransaction::Create(this, storesToOpen, aMode, false);
   NS_ENSURE_TRUE(transaction, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
 
   transaction.forget(_retval);
diff --git a/dom/indexedDB/IDBEvents.h b/dom/indexedDB/IDBEvents.h
index 150c7911e743..a02c90d15721 100644
--- a/dom/indexedDB/IDBEvents.h
+++ b/dom/indexedDB/IDBEvents.h
@@ -53,7 +53,6 @@
 #define ERROR_EVT_STR "error"
 #define COMPLETE_EVT_STR "complete"
 #define ABORT_EVT_STR "abort"
-#define TIMEOUT_EVT_STR "timeout"
 #define VERSIONCHANGE_EVT_STR "versionchange"
 #define BLOCKED_EVT_STR "blocked"
 #define UPGRADENEEDED_EVT_STR "upgradeneeded"
diff --git a/dom/indexedDB/IDBFactory.cpp b/dom/indexedDB/IDBFactory.cpp
index 8a05b601c579..78cfdec55376 100644
--- a/dom/indexedDB/IDBFactory.cpp
+++ b/dom/indexedDB/IDBFactory.cpp
@@ -67,6 +67,7 @@
 #include "IDBEvents.h"
 #include "IDBKeyRange.h"
 #include "IndexedDatabaseManager.h"
+#include "Key.h"
 #include "LazyIdleThread.h"
 #include "nsIScriptSecurityManager.h"
 
@@ -463,3 +464,24 @@ IDBFactory::DeleteDatabase(const nsAString& aName,
 {
   return OpenCommon(aName, 0, true, _retval);
 }
+
+NS_IMETHODIMP
+IDBFactory::Cmp(const jsval& aFirst,
+                const jsval& aSecond,
+                JSContext* aCx,
+                PRInt16* _retval)
+{
+  Key first, second;
+  nsresult rv = first.SetFromJSVal(aCx, aFirst);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = second.SetFromJSVal(aCx, aSecond);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (first.IsUnset() || second.IsUnset()) {
+    return NS_ERROR_DOM_INDEXEDDB_DATA_ERR;
+  }
+
+  *_retval = first == second ? 0 : first < second ? -1 : 1;
+  return NS_OK;
+}
diff --git a/dom/indexedDB/IDBTransaction.cpp b/dom/indexedDB/IDBTransaction.cpp
index c8622fab1c85..182741df1c65 100644
--- a/dom/indexedDB/IDBTransaction.cpp
+++ b/dom/indexedDB/IDBTransaction.cpp
@@ -80,7 +80,6 @@ already_AddRefed<IDBTransaction>
 IDBTransaction::Create(IDBDatabase* aDatabase,
                        nsTArray<nsString>& aObjectStoreNames,
                        PRUint16 aMode,
-                       PRUint32 aTimeout,
                        bool aDispatchDelayed)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
@@ -92,7 +91,6 @@ IDBTransaction::Create(IDBDatabase* aDatabase,
 
   transaction->mDatabase = aDatabase;
   transaction->mMode = aMode;
-  transaction->mTimeout = aTimeout;
 
   if (!transaction->mObjectStoreNames.AppendElements(aObjectStoreNames)) {
     NS_ERROR("Out of memory!");
@@ -129,7 +127,6 @@ IDBTransaction::Create(IDBDatabase* aDatabase,
 IDBTransaction::IDBTransaction()
 : mReadyState(nsIIDBTransaction::INITIAL),
   mMode(nsIIDBTransaction::READ_ONLY),
-  mTimeout(0),
   mPendingRequests(0),
   mCreatedRecursionDepth(0),
   mSavepointCount(0),
@@ -524,7 +521,6 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(IDBTransaction,
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnErrorListener)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnCompleteListener)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnAbortListener)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnTimeoutListener)
 
   for (PRUint32 i = 0; i < tmp->mCreatedObjectStores.Length(); i++) {
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mCreatedObjectStores[i]");
@@ -540,7 +536,6 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(IDBTransaction,
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnErrorListener)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnCompleteListener)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnAbortListener)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnTimeoutListener)
 
   tmp->mCreatedObjectStores.Clear();
 
@@ -724,23 +719,6 @@ IDBTransaction::SetOnabort(nsIDOMEventListener* aOnabort)
                                 mOnAbortListener, aOnabort);
 }
 
-NS_IMETHODIMP
-IDBTransaction::GetOntimeout(nsIDOMEventListener** aOntimeout)
-{
-  NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
-
-  return GetInnerEventListener(mOnTimeoutListener, aOntimeout);
-}
-
-NS_IMETHODIMP
-IDBTransaction::SetOntimeout(nsIDOMEventListener* aOntimeout)
-{
-  NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
-
-  return RemoveAddEventListener(NS_LITERAL_STRING(TIMEOUT_EVT_STR),
-                                mOnTimeoutListener, aOntimeout);
-}
-
 nsresult
 IDBTransaction::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
 {
diff --git a/dom/indexedDB/IDBTransaction.h b/dom/indexedDB/IDBTransaction.h
index a757abf4bfa6..e60f9db3e97d 100644
--- a/dom/indexedDB/IDBTransaction.h
+++ b/dom/indexedDB/IDBTransaction.h
@@ -95,8 +95,7 @@ public:
   Create(IDBDatabase* aDatabase,
          nsTArray<nsString>& aObjectStoreNames,
          PRUint16 aMode,
-         PRUint32 aTimeout,
-         bool aDispatchDelayed = false);
+         bool aDispatchDelayed);
 
   // nsIDOMEventTarget
   virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
@@ -173,7 +172,6 @@ private:
   nsTArray<nsString> mObjectStoreNames;
   PRUint16 mReadyState;
   PRUint16 mMode;
-  PRUint32 mTimeout;
   PRUint32 mPendingRequests;
   PRUint32 mCreatedRecursionDepth;
 
@@ -181,7 +179,6 @@ private:
   nsRefPtr<nsDOMEventListenerWrapper> mOnErrorListener;
   nsRefPtr<nsDOMEventListenerWrapper> mOnCompleteListener;
   nsRefPtr<nsDOMEventListenerWrapper> mOnAbortListener;
-  nsRefPtr<nsDOMEventListenerWrapper> mOnTimeoutListener;
 
   nsInterfaceHashtable<nsCStringHashKey, mozIStorageStatement>
     mCachedStatements;
diff --git a/dom/indexedDB/OpenDatabaseHelper.cpp b/dom/indexedDB/OpenDatabaseHelper.cpp
index 97ff663f7959..7a620113dc73 100644
--- a/dom/indexedDB/OpenDatabaseHelper.cpp
+++ b/dom/indexedDB/OpenDatabaseHelper.cpp
@@ -50,8 +50,6 @@
 
 USING_INDEXEDDB_NAMESPACE
 
-const extern PRUint32 kDefaultDatabaseTimeoutSeconds = 30; 
-
 namespace {
 
 nsresult
@@ -853,8 +851,7 @@ OpenDatabaseHelper::StartSetVersion()
   nsTArray<nsString> storesToOpen;
   nsRefPtr<IDBTransaction> transaction =
     IDBTransaction::Create(mDatabase, storesToOpen,
-                           IDBTransaction::VERSION_CHANGE,
-                           kDefaultDatabaseTimeoutSeconds, true);
+                           IDBTransaction::VERSION_CHANGE, true);
   NS_ENSURE_TRUE(transaction, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
 
   nsRefPtr<SetVersionHelper> helper =
diff --git a/dom/indexedDB/nsIIDBFactory.idl b/dom/indexedDB/nsIIDBFactory.idl
index b3e4d78eee6b..029407237658 100644
--- a/dom/indexedDB/nsIIDBFactory.idl
+++ b/dom/indexedDB/nsIIDBFactory.idl
@@ -58,4 +58,9 @@ interface nsIIDBFactory : nsISupports
 
   nsIIDBOpenDBRequest
   deleteDatabase(in AString name);
+
+  [implicit_jscontext]
+  short
+  cmp(in jsval first,
+      in jsval second);
 };
diff --git a/dom/indexedDB/nsIIDBTransaction.idl b/dom/indexedDB/nsIIDBTransaction.idl
index 7d5eef62749b..203495bc64ec 100644
--- a/dom/indexedDB/nsIIDBTransaction.idl
+++ b/dom/indexedDB/nsIIDBTransaction.idl
@@ -83,10 +83,4 @@ interface nsIIDBTransaction : nsISupports
   // Event listener that fires when the transaction is aborted.
   // Receives an Event.
   attribute nsIDOMEventListener onabort;
-
-  // Event listener that fires when the transaction times out while
-  // attempting to grab the relevant locks, as specified by the
-  // timeoutSeconds parameter
-  // Receives an Event.
-  attribute nsIDOMEventListener ontimeout;
 };
diff --git a/dom/indexedDB/test/Makefile.in b/dom/indexedDB/test/Makefile.in
index ac4e39aded16..c16c13719e2a 100644
--- a/dom/indexedDB/test/Makefile.in
+++ b/dom/indexedDB/test/Makefile.in
@@ -58,6 +58,7 @@ TEST_FILES = \
   test_bad_keypath.html \
   test_bfcache.html \
   test_clear.html \
+  test_cmp.html \
   test_count.html \
   test_create_index.html \
   test_create_index_with_integer_keys.html \
diff --git a/dom/indexedDB/test/test_cmp.html b/dom/indexedDB/test/test_cmp.html
new file mode 100644
index 000000000000..fab02a80f09f
--- /dev/null
+++ b/dom/indexedDB/test/test_cmp.html
@@ -0,0 +1,85 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>Indexed Database Property Test</title>
+
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+  <script type="text/javascript;version=1.7">
+    function testSteps()
+    {
+      function compare(key1, key2, expected, exception) {
+        function maybeQuote(key) {
+          return typeof(key) == "string" ? "\"" + key + "\"" : key;
+        }
+
+        var cmp = "cmp(" + maybeQuote(key1) + ", " + maybeQuote(key2) + ")";
+
+        if (exception) {
+          var caught;
+          try {
+            var result = mozIndexedDB.cmp(key1, key2);
+          }
+          catch(e) {
+            caught = e;
+          }
+          ok(caught, "Got an exception for " + cmp);
+          is(caught instanceof IDBDatabaseException, true,
+             "Got IDBDatabaseException for " + cmp);
+          is(caught.code, IDBDatabaseException.DATA_ERR,
+             "Got correct exception code for " + cmp);
+        }
+        else {
+          is(mozIndexedDB.cmp(key1, key2), expected,
+             "Correct result for " + cmp);
+        }
+      }
+
+      compare(NaN, 0, 0, true);
+      compare(0, NaN, 0, true);
+      compare(undefined, 0, 0, true);
+      compare(0, undefined, 0, true);
+      compare(null, 0, 0, true);
+      compare(0, null, 0, true);
+
+      compare(0, 0, 0);
+      compare(1, 0, 1);
+      compare(0, 1, -1);
+      compare(1, 1, 0);
+      compare(2, 1, 1);
+      compare(1, 2, -1);
+      compare(-1, -1, 0);
+      compare(0, -1, 1);
+      compare(-1, 0, -1);
+
+      compare("", "", 0);
+      compare("a", "", 1);
+      compare("", "a", -1);
+      compare("a", "a", 0);
+      compare("a", "b", -1);
+      compare("b", "a", 1);
+      compare("a", "aa", -1);
+      compare("aa", "a", 1);
+
+      compare(0, "", -1);
+      compare("", 0, 1);
+      compare(0, "a", -1);
+      compare("a", 0, 1);
+      compare(99999, "", -1);
+      compare("", 99999, 1);
+
+      finishTest();
+      yield;
+    }
+  </script>
+  <script type="text/javascript;version=1.7" src="helpers.js"></script>
+
+</head>
+
+<body onload="runTest();"></body>
+
+</html>
diff --git a/dom/indexedDB/test/test_transaction_abort.html b/dom/indexedDB/test/test_transaction_abort.html
index 73a8b6fb07e9..5d4b2f228bd0 100644
--- a/dom/indexedDB/test/test_transaction_abort.html
+++ b/dom/indexedDB/test/test_transaction_abort.html
@@ -50,7 +50,6 @@
       is(transaction.objectStore("foo"), objectStore, "Can get stores");
       is(transaction.oncomplete, null, "No complete listener");
       is(transaction.onabort, null, "No abort listener");
-      is(transaction.ontimeout, null, "No timeout listener");
 
       is(objectStore.name, "foo", "Correct name");
       is(objectStore.keyPath, "", "Correct keyPath");
@@ -69,7 +68,6 @@
       is(transaction.objectStoreNames.length, 1, "Correct names length");
       is(transaction.objectStoreNames.item(0), "foo", "Correct name");
       is(transaction.onabort, null, "No abort listener");
-      is(transaction.ontimeout, null, "No timeout listener");
 
       try {
         is(transaction.objectStore("foo").name, "foo", "Can't get stores");
diff --git a/dom/interfaces/base/nsIFocusManager.idl b/dom/interfaces/base/nsIFocusManager.idl
index 6de2b32bc25c..89ff9043334b 100644
--- a/dom/interfaces/base/nsIFocusManager.idl
+++ b/dom/interfaces/base/nsIFocusManager.idl
@@ -166,6 +166,11 @@ interface nsIFocusManager : nsISupports
    */
   void moveCaretToFocus(in nsIDOMWindow aWindow);
 
+  /***
+   * Check if given element is focusable.
+   */
+  boolean elementIsFocusable(in nsIDOMElement aElement, in unsigned long aFlags);
+
   /*
    * Raise the window when switching focus
    */
diff --git a/dom/interfaces/html/nsIDOMHTMLAnchorElement.idl b/dom/interfaces/html/nsIDOMHTMLAnchorElement.idl
index cc493a375dfa..040f5c8f15f1 100644
--- a/dom/interfaces/html/nsIDOMHTMLAnchorElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAnchorElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(2da904fa-83da-426d-a320-a6868192583e)]
+[scriptable, uuid(bcb54394-d9f8-4bcb-bbbb-eca9826cdbca)]
 interface nsIDOMHTMLAnchorElement : nsIDOMHTMLElement
 {
            attribute DOMString        href;
diff --git a/dom/interfaces/html/nsIDOMHTMLAppletElement.idl b/dom/interfaces/html/nsIDOMHTMLAppletElement.idl
index 2295977f495e..74a5f0c0ab89 100644
--- a/dom/interfaces/html/nsIDOMHTMLAppletElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAppletElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(c874e500-a185-4d69-96dd-474d1137e21f)]
+[scriptable, uuid(a06bca18-791f-474e-a031-bf6c2bd14994)]
 interface nsIDOMHTMLAppletElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
diff --git a/dom/interfaces/html/nsIDOMHTMLAreaElement.idl b/dom/interfaces/html/nsIDOMHTMLAreaElement.idl
index b5bdfaf74e2b..07cd39176569 100644
--- a/dom/interfaces/html/nsIDOMHTMLAreaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAreaElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(d88c8515-5a27-4955-8ca5-18c908433cfd)]
+[scriptable, uuid(7e607c36-aecc-4dee-a93a-95e22a374bfb)]
 interface nsIDOMHTMLAreaElement : nsIDOMHTMLElement
 {
            attribute DOMString        alt;
diff --git a/dom/interfaces/html/nsIDOMHTMLAudioElement.idl b/dom/interfaces/html/nsIDOMHTMLAudioElement.idl
index 95d99c8ab847..4ebee6b48374 100644
--- a/dom/interfaces/html/nsIDOMHTMLAudioElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAudioElement.idl
@@ -52,7 +52,7 @@
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(f4115c13-bc51-4c3b-a5c0-9106af9f7368)]
+[scriptable, uuid(756e2792-b937-4a70-bd1f-9d6820473e7e)]
 interface nsIDOMHTMLAudioElement : nsIDOMHTMLMediaElement
 {
   // Setup the audio stream for writing
diff --git a/dom/interfaces/html/nsIDOMHTMLBRElement.idl b/dom/interfaces/html/nsIDOMHTMLBRElement.idl
index 8c8bb6d785ea..bef88132df01 100644
--- a/dom/interfaces/html/nsIDOMHTMLBRElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLBRElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(a4f319d7-442d-4154-8c60-b9acdca87523)]
+[scriptable, uuid(7eefd466-7c4d-499a-a076-e33204e69dc3)]
 interface nsIDOMHTMLBRElement : nsIDOMHTMLElement
 {
            attribute DOMString        clear;
diff --git a/dom/interfaces/html/nsIDOMHTMLBaseElement.idl b/dom/interfaces/html/nsIDOMHTMLBaseElement.idl
index 2b6bdfd407fe..1de84be9b9be 100644
--- a/dom/interfaces/html/nsIDOMHTMLBaseElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLBaseElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(1ba4957f-629e-4410-b5fd-64f2b7eeb32c)]
+[scriptable, uuid(e55cd224-b603-4976-892a-20b11d469394)]
 interface nsIDOMHTMLBaseElement : nsIDOMHTMLElement
 {
            attribute DOMString        href;
diff --git a/dom/interfaces/html/nsIDOMHTMLBodyElement.idl b/dom/interfaces/html/nsIDOMHTMLBodyElement.idl
index b4623b175cd7..5f4e595e166f 100644
--- a/dom/interfaces/html/nsIDOMHTMLBodyElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLBodyElement.idl
@@ -54,7 +54,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(dcf343a9-fa7f-4e16-b122-0ece0d8bdea9)]
+[scriptable, uuid(6c377d44-a5d1-4f0f-860a-9858d2cb5679)]
 interface nsIDOMHTMLBodyElement : nsIDOMHTMLElement
 {
            attribute DOMString        aLink;
diff --git a/dom/interfaces/html/nsIDOMHTMLButtonElement.idl b/dom/interfaces/html/nsIDOMHTMLButtonElement.idl
index b38f649b53fe..b454007d275f 100644
--- a/dom/interfaces/html/nsIDOMHTMLButtonElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLButtonElement.idl
@@ -52,7 +52,7 @@
 
 interface nsIDOMValidityState;
 
-[scriptable, uuid(4b48e075-a05b-480f-9e37-fcd88e7aebdd)]
+[scriptable, uuid(79f034f0-5c13-4101-9598-412e1eac1986)]
 interface nsIDOMHTMLButtonElement : nsIDOMHTMLElement
 {
            attribute boolean               autofocus;
diff --git a/dom/interfaces/html/nsIDOMHTMLCanvasElement.idl b/dom/interfaces/html/nsIDOMHTMLCanvasElement.idl
index 8d01e765548a..f19a8f46d18a 100644
--- a/dom/interfaces/html/nsIDOMHTMLCanvasElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLCanvasElement.idl
@@ -55,7 +55,7 @@
 interface nsIDOMFile;
 interface nsIVariant;
 
-[scriptable, uuid(e1ea26e6-4141-487f-a9cf-d7e9344b571c)]
+[scriptable, uuid(dbbeeba1-3c20-4d9d-ac82-98b69fd819a9)]
 interface nsIDOMHTMLCanvasElement : nsIDOMHTMLElement
 {
   attribute unsigned long width;
diff --git a/dom/interfaces/html/nsIDOMHTMLCommandElement.idl b/dom/interfaces/html/nsIDOMHTMLCommandElement.idl
index 527f0d596e26..e8efab96b5f8 100644
--- a/dom/interfaces/html/nsIDOMHTMLCommandElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLCommandElement.idl
@@ -46,7 +46,7 @@
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(4c466da8-5c6d-427f-95f5-bba96ab99c96)]
+[scriptable, uuid(13032f74-4150-4768-ab5e-51f4de39a300)]
 interface nsIDOMHTMLCommandElement : nsIDOMHTMLElement
 {
            attribute DOMString        type;
diff --git a/dom/interfaces/html/nsIDOMHTMLDListElement.idl b/dom/interfaces/html/nsIDOMHTMLDListElement.idl
index f4d6c282169f..e3ad0fcc13f7 100644
--- a/dom/interfaces/html/nsIDOMHTMLDListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDListElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(f3e65e2b-e079-4970-bb5d-f96ac9cd18c5)]
+[scriptable, uuid(50e9ff30-0982-4074-bc65-313f41be8624)]
 interface nsIDOMHTMLDListElement : nsIDOMHTMLElement
 {
            attribute boolean          compact;
diff --git a/dom/interfaces/html/nsIDOMHTMLDataListElement.idl b/dom/interfaces/html/nsIDOMHTMLDataListElement.idl
index 0a92f6b07880..4496b81c73b6 100644
--- a/dom/interfaces/html/nsIDOMHTMLDataListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDataListElement.idl
@@ -49,7 +49,7 @@
 
 interface nsIDOMHTMLCollection;
 
-[scriptable, uuid(312ed7c1-8c62-4d80-bbd9-99d7ea4377e6)]
+[scriptable, uuid(3bace78b-9eca-4990-a5d6-9c2b8c32cc8a)]
 interface nsIDOMHTMLDataListElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMHTMLCollection options;
diff --git a/dom/interfaces/html/nsIDOMHTMLDirectoryElement.idl b/dom/interfaces/html/nsIDOMHTMLDirectoryElement.idl
index aed3d77dc1f6..184e6bb54151 100644
--- a/dom/interfaces/html/nsIDOMHTMLDirectoryElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDirectoryElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(1e04cd43-edc0-4658-bd77-d67661af6c9c)]
+[scriptable, uuid(a99e86ae-7761-4145-b8a4-5a91186051f1)]
 interface nsIDOMHTMLDirectoryElement : nsIDOMHTMLElement
 {
            attribute boolean          compact;
diff --git a/dom/interfaces/html/nsIDOMHTMLDivElement.idl b/dom/interfaces/html/nsIDOMHTMLDivElement.idl
index b0fdcb046fa2..c8369f740813 100644
--- a/dom/interfaces/html/nsIDOMHTMLDivElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDivElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(771be9ee-b883-4556-bf90-2d7c904fe94d)]
+[scriptable, uuid(6815b902-8e04-49dd-977b-0a8785e5ffaf)]
 interface nsIDOMHTMLDivElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
diff --git a/dom/interfaces/html/nsIDOMHTMLElement.idl b/dom/interfaces/html/nsIDOMHTMLElement.idl
index 12397ba470f9..78cd0756eb16 100644
--- a/dom/interfaces/html/nsIDOMHTMLElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLElement.idl
@@ -53,7 +53,7 @@ interface nsIDOMHTMLMenuElement;
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
-[scriptable, uuid(0a21bb68-d8bd-4b2a-a3db-048a02e81c62)]
+[scriptable, uuid(4eccf8a3-8bf5-43f3-a728-f5b632f7db3a)]
 interface nsIDOMHTMLElement : nsIDOMElement
 {
   // metadata attributes
@@ -86,6 +86,7 @@ interface nsIDOMHTMLElement : nsIDOMElement
 
   // DOM Parsing and Serialization
            attribute DOMString        innerHTML;
+           attribute DOMString        outerHTML;
   void insertAdjacentHTML(in DOMString position,
                           in DOMString text);
 
diff --git a/dom/interfaces/html/nsIDOMHTMLEmbedElement.idl b/dom/interfaces/html/nsIDOMHTMLEmbedElement.idl
index 76ba843a7c43..9546df2aaadf 100644
--- a/dom/interfaces/html/nsIDOMHTMLEmbedElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLEmbedElement.idl
@@ -47,7 +47,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/#the-embed-element
  */
 
-[scriptable, uuid(d6309fc7-e9d2-4087-b452-490ed84f2dc2)]
+[scriptable, uuid(940a15c2-0d48-4186-b4d8-067fa1ce5675)]
 interface nsIDOMHTMLEmbedElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
diff --git a/dom/interfaces/html/nsIDOMHTMLFieldSetElement.idl b/dom/interfaces/html/nsIDOMHTMLFieldSetElement.idl
index 8f37aabdbcbf..d5905ebc6b46 100644
--- a/dom/interfaces/html/nsIDOMHTMLFieldSetElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFieldSetElement.idl
@@ -52,7 +52,7 @@
 
 interface nsIDOMValidityState;
 
-[scriptable, uuid(e153c20e-7a3d-4184-865c-ee7c6d9b65df)]
+[scriptable, uuid(781ae103-b030-4aad-b2d5-96e5c2317dec)]
 interface nsIDOMHTMLFieldSetElement : nsIDOMHTMLElement
 {
            attribute boolean                disabled;
diff --git a/dom/interfaces/html/nsIDOMHTMLFontElement.idl b/dom/interfaces/html/nsIDOMHTMLFontElement.idl
index 994a74ddb4c1..7648bf8961a0 100644
--- a/dom/interfaces/html/nsIDOMHTMLFontElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFontElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(8a205975-86cb-44db-b20e-df7f2d200580)]
+[scriptable, uuid(1c9778ee-a49c-40ee-9b93-c0ff15630431)]
 interface nsIDOMHTMLFontElement : nsIDOMHTMLElement
 {
            attribute DOMString        color;
diff --git a/dom/interfaces/html/nsIDOMHTMLFormElement.idl b/dom/interfaces/html/nsIDOMHTMLFormElement.idl
index a93cc376626a..65fb4dfccaae 100644
--- a/dom/interfaces/html/nsIDOMHTMLFormElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFormElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(8fe67952-6f7b-4d6e-b17b-79a454687e5f)]
+[scriptable, uuid(d873b251-6f96-4e70-baf5-aaa935aabe59)]
 interface nsIDOMHTMLFormElement : nsIDOMHTMLElement
 {
            attribute DOMString            acceptCharset;
diff --git a/dom/interfaces/html/nsIDOMHTMLFrameElement.idl b/dom/interfaces/html/nsIDOMHTMLFrameElement.idl
index 90752d2e8e06..dab1a4de2aeb 100644
--- a/dom/interfaces/html/nsIDOMHTMLFrameElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFrameElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(6de9d59d-42fd-44df-bb41-22cd64a85d4f)]
+[scriptable, uuid(318fdc4a-3fca-4099-94aa-c9a1c30ca2b9)]
 interface nsIDOMHTMLFrameElement : nsIDOMHTMLElement
 {
            attribute DOMString        frameBorder;
diff --git a/dom/interfaces/html/nsIDOMHTMLFrameSetElement.idl b/dom/interfaces/html/nsIDOMHTMLFrameSetElement.idl
index 7bff911baa94..5747a276db79 100644
--- a/dom/interfaces/html/nsIDOMHTMLFrameSetElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFrameSetElement.idl
@@ -54,7 +54,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(a9423392-0f92-4b25-8700-49d28752c092)]
+[scriptable, uuid(6eefbe6d-182c-42e9-9850-af1892b6f2e4)]
 interface nsIDOMHTMLFrameSetElement : nsIDOMHTMLElement
 {
            attribute DOMString        cols;
diff --git a/dom/interfaces/html/nsIDOMHTMLHRElement.idl b/dom/interfaces/html/nsIDOMHTMLHRElement.idl
index b5977327bf80..ac338fdc7d2b 100644
--- a/dom/interfaces/html/nsIDOMHTMLHRElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHRElement.idl
@@ -51,7 +51,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(a6950d69-a376-4ad5-a911-8f91abb2b15d)]
+[scriptable, uuid(b94bff8f-dfa7-4dd8-8d97-c301dd9de729)]
 interface nsIDOMHTMLHRElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
diff --git a/dom/interfaces/html/nsIDOMHTMLHeadElement.idl b/dom/interfaces/html/nsIDOMHTMLHeadElement.idl
index c017ac292fe4..4d7600fe9bfc 100644
--- a/dom/interfaces/html/nsIDOMHTMLHeadElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHeadElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(6d049c37-2cee-4c04-816c-270973e58ccf)]
+[scriptable, uuid(628fe597-6408-4387-9fcb-75381e2b2dd0)]
 interface nsIDOMHTMLHeadElement : nsIDOMHTMLElement
 {
 };
diff --git a/dom/interfaces/html/nsIDOMHTMLHeadingElement.idl b/dom/interfaces/html/nsIDOMHTMLHeadingElement.idl
index e3bf581f6d3c..0d7265080c2e 100644
--- a/dom/interfaces/html/nsIDOMHTMLHeadingElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHeadingElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(c3c30a05-1dc0-413a-85f6-3c4d5af5f2b6)]
+[scriptable, uuid(964c94b0-5571-44e7-9b29-f81c6ea7828a)]
 interface nsIDOMHTMLHeadingElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
diff --git a/dom/interfaces/html/nsIDOMHTMLHtmlElement.idl b/dom/interfaces/html/nsIDOMHTMLHtmlElement.idl
index 420570c389b8..f7459ab2ac0d 100644
--- a/dom/interfaces/html/nsIDOMHTMLHtmlElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHtmlElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(84825a7d-d5c7-4b1a-9d2a-b3e5df055824)]
+[scriptable, uuid(4bafbc15-aa88-4021-9ad6-e14189b7227b)]
 interface nsIDOMHTMLHtmlElement : nsIDOMHTMLElement
 {
            attribute DOMString        version;
diff --git a/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl b/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
index bcfdd797ba41..759a5f481a56 100644
--- a/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(166c1cdb-9af5-4217-9a2f-f9dae0923e85)]
+[scriptable, uuid(5ef30718-fe45-43a2-a478-a9e3cbf3a118)]
 interface nsIDOMHTMLIFrameElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
diff --git a/dom/interfaces/html/nsIDOMHTMLImageElement.idl b/dom/interfaces/html/nsIDOMHTMLImageElement.idl
index d5d039494b4e..9c04b214e060 100644
--- a/dom/interfaces/html/nsIDOMHTMLImageElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLImageElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(02dbe3c7-e75e-4a35-989c-b6f6d7a3108f)]
+[scriptable, uuid(56d9191f-5a94-432f-af70-6fccdeaf614b)]
 interface nsIDOMHTMLImageElement : nsIDOMHTMLElement
 {
            attribute DOMString        alt;
diff --git a/dom/interfaces/html/nsIDOMHTMLInputElement.idl b/dom/interfaces/html/nsIDOMHTMLInputElement.idl
index 6ecc4215c119..2b81463e4097 100644
--- a/dom/interfaces/html/nsIDOMHTMLInputElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLInputElement.idl
@@ -54,7 +54,7 @@ interface nsIDOMValidityState;
   * http://www.whatwg.org/specs/web-apps/current-work/
   */
 
-[scriptable, uuid(81cc1b30-02e1-4779-ac9e-0091933478a4)]
+[scriptable, uuid(7330cd35-c930-4f45-ae61-f5380c30222d)]
 interface nsIDOMHTMLInputElement : nsIDOMHTMLElement
 {
            attribute DOMString             accept;
diff --git a/dom/interfaces/html/nsIDOMHTMLLIElement.idl b/dom/interfaces/html/nsIDOMHTMLLIElement.idl
index a4c3180708a8..5b8b0135a51c 100644
--- a/dom/interfaces/html/nsIDOMHTMLLIElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLIElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(cb9bbac6-3198-4159-9ee9-262eef35f265)]
+[scriptable, uuid(85b15d13-be6d-4653-9c70-22a13d510247)]
 interface nsIDOMHTMLLIElement : nsIDOMHTMLElement
 {
            attribute DOMString           type;
diff --git a/dom/interfaces/html/nsIDOMHTMLLabelElement.idl b/dom/interfaces/html/nsIDOMHTMLLabelElement.idl
index 0557647b51cc..3cb02ca6c3f1 100644
--- a/dom/interfaces/html/nsIDOMHTMLLabelElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLabelElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(0c36c887-04e3-4926-a916-8e3596130f9a)]
+[scriptable, uuid(ddbca449-625d-467c-a22d-7887474f9eb9)]
 interface nsIDOMHTMLLabelElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMHTMLFormElement form;
diff --git a/dom/interfaces/html/nsIDOMHTMLLegendElement.idl b/dom/interfaces/html/nsIDOMHTMLLegendElement.idl
index f9b33d773375..b3a57b6f2905 100644
--- a/dom/interfaces/html/nsIDOMHTMLLegendElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLegendElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(cabacc5f-5179-4c97-be60-0af8feafb4c9)]
+[scriptable, uuid(dac72753-6919-414b-b771-9e1e86e7749c)]
 interface nsIDOMHTMLLegendElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMHTMLFormElement form;
diff --git a/dom/interfaces/html/nsIDOMHTMLLinkElement.idl b/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
index dc79e285df4a..f1f56d7ed9f2 100644
--- a/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(2f238f84-1b45-4ef9-9cda-bd1430ce9304)]
+[scriptable, uuid(2ece79f4-83d7-499c-946f-ae9ab93147b7)]
 interface nsIDOMHTMLLinkElement : nsIDOMHTMLElement
 {
            attribute boolean          disabled;
diff --git a/dom/interfaces/html/nsIDOMHTMLMapElement.idl b/dom/interfaces/html/nsIDOMHTMLMapElement.idl
index da0736fb208c..904847b7e0d5 100644
--- a/dom/interfaces/html/nsIDOMHTMLMapElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMapElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(3fb8ec10-8778-418d-9c83-556e46f115a9)]
+[scriptable, uuid(c919bc49-bd49-4b89-ba70-5c74c4ef504a)]
 interface nsIDOMHTMLMapElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMHTMLCollection areas;
diff --git a/dom/interfaces/html/nsIDOMHTMLMediaElement.idl b/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
index d9f673156659..785550892d0a 100644
--- a/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
@@ -57,7 +57,7 @@
 #endif
 %}
 
-[scriptable, uuid(85baaa10-73ab-4a48-a57a-b3951b67e494)]
+[scriptable, uuid(642a3b85-4edb-4c01-a162-06b5d88171e7)]
 interface nsIDOMHTMLMediaElement : nsIDOMHTMLElement
 {
   // error state
diff --git a/dom/interfaces/html/nsIDOMHTMLMenuElement.idl b/dom/interfaces/html/nsIDOMHTMLMenuElement.idl
index 1e227250daff..d4eb205997be 100644
--- a/dom/interfaces/html/nsIDOMHTMLMenuElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMenuElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(12de9196-b164-43e0-9347-f23e1bffbede)]
+[scriptable, uuid(06d48250-45e0-4f26-9a07-d9b5a3f08bb6)]
 interface nsIDOMHTMLMenuElement : nsIDOMHTMLElement
 {
            attribute boolean          compact;
diff --git a/dom/interfaces/html/nsIDOMHTMLMenuItemElement.idl b/dom/interfaces/html/nsIDOMHTMLMenuItemElement.idl
index 7b11b7c3a037..1cc730b87a69 100644
--- a/dom/interfaces/html/nsIDOMHTMLMenuItemElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMenuItemElement.idl
@@ -43,7 +43,7 @@
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(e0469d92-a137-4329-9d4b-9f2ba5ce8e77)]
+[scriptable, uuid(4680ec24-94f0-4eb7-9413-98f9a857de72)]
 interface nsIDOMHTMLMenuItemElement : nsIDOMHTMLCommandElement
 {
 };
diff --git a/dom/interfaces/html/nsIDOMHTMLMetaElement.idl b/dom/interfaces/html/nsIDOMHTMLMetaElement.idl
index 28d737c2ed33..b74cfc89cc64 100644
--- a/dom/interfaces/html/nsIDOMHTMLMetaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMetaElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(c883b92b-5ae0-4563-894a-fa7f0e9aacda)]
+[scriptable, uuid(db476657-5f59-4e29-84a6-50afe6f85ac7)]
 interface nsIDOMHTMLMetaElement : nsIDOMHTMLElement
 {
            attribute DOMString        content;
diff --git a/dom/interfaces/html/nsIDOMHTMLModElement.idl b/dom/interfaces/html/nsIDOMHTMLModElement.idl
index c10055044de7..fcb9e99895c9 100644
--- a/dom/interfaces/html/nsIDOMHTMLModElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLModElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(417626fa-191c-41e5-aed5-f6157b408e72)]
+[scriptable, uuid(170733d4-aad5-4f6e-86c0-94845ea6116d)]
 interface nsIDOMHTMLModElement : nsIDOMHTMLElement
 {
            attribute DOMString        cite;
diff --git a/dom/interfaces/html/nsIDOMHTMLOListElement.idl b/dom/interfaces/html/nsIDOMHTMLOListElement.idl
index b8c9c184cb6c..989aa350570e 100644
--- a/dom/interfaces/html/nsIDOMHTMLOListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOListElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(11e66686-b1ef-47be-9025-ffc20b875e4a)]
+[scriptable, uuid(31a5f083-59a6-41c3-8a0b-e58e484c6516)]
 interface nsIDOMHTMLOListElement : nsIDOMHTMLElement
 {
            attribute boolean          compact;
diff --git a/dom/interfaces/html/nsIDOMHTMLObjectElement.idl b/dom/interfaces/html/nsIDOMHTMLObjectElement.idl
index ff86e566c61b..ae2c09b996e2 100644
--- a/dom/interfaces/html/nsIDOMHTMLObjectElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLObjectElement.idl
@@ -52,7 +52,7 @@
 
 interface nsIDOMValidityState;
 
-[scriptable, uuid(5d873128-d4e3-4e89-8900-599155167105)]
+[scriptable, uuid(40037f4a-5bae-476f-977b-bbd8e78aaefe)]
 interface nsIDOMHTMLObjectElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMHTMLFormElement form;
diff --git a/dom/interfaces/html/nsIDOMHTMLOptGroupElement.idl b/dom/interfaces/html/nsIDOMHTMLOptGroupElement.idl
index 9865c534bc2b..77c3f6e863fa 100644
--- a/dom/interfaces/html/nsIDOMHTMLOptGroupElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOptGroupElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(7b585d49-1da3-4fc6-a50c-b661063c2edc)]
+[scriptable, uuid(ab55d67a-aabb-4441-b182-8ff2bd7d157e)]
 interface nsIDOMHTMLOptGroupElement : nsIDOMHTMLElement
 {
            attribute boolean          disabled;
diff --git a/dom/interfaces/html/nsIDOMHTMLOptionElement.idl b/dom/interfaces/html/nsIDOMHTMLOptionElement.idl
index c5451316161a..814046266eac 100644
--- a/dom/interfaces/html/nsIDOMHTMLOptionElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOptionElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(c20ead8a-cb89-43b1-89ed-8f4713bf8452)]
+[scriptable, uuid(7c5bf0ac-6230-4ee0-8b82-e7ebf211af03)]
 interface nsIDOMHTMLOptionElement : nsIDOMHTMLElement
 {
            attribute boolean               disabled;
diff --git a/dom/interfaces/html/nsIDOMHTMLOutputElement.idl b/dom/interfaces/html/nsIDOMHTMLOutputElement.idl
index c348a5b23146..9e3d17cbb43c 100644
--- a/dom/interfaces/html/nsIDOMHTMLOutputElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOutputElement.idl
@@ -50,7 +50,7 @@
 interface nsIDOMDOMSettableTokenList;
 interface nsIDOMValidityState;
 
-[scriptable, uuid(7d1fb2a9-7678-409e-8eb5-9216c47c233b)]
+[scriptable, uuid(f2074cdb-19cb-447a-935c-9f4402dc1b5e)]
 interface nsIDOMHTMLOutputElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMDOMSettableTokenList htmlFor;
diff --git a/dom/interfaces/html/nsIDOMHTMLParagraphElement.idl b/dom/interfaces/html/nsIDOMHTMLParagraphElement.idl
index 3dd0608addbc..6ff31c369ae4 100644
--- a/dom/interfaces/html/nsIDOMHTMLParagraphElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLParagraphElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(d5d3eb33-0925-4555-be2f-4078dec49f59)]
+[scriptable, uuid(e4f498f4-e3c5-46fe-92d0-c9957ccab530)]
 interface nsIDOMHTMLParagraphElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
diff --git a/dom/interfaces/html/nsIDOMHTMLParamElement.idl b/dom/interfaces/html/nsIDOMHTMLParamElement.idl
index f39e07ede768..fc76ad88c9d9 100644
--- a/dom/interfaces/html/nsIDOMHTMLParamElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLParamElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(ccffedb8-f234-474e-9af4-576eba766023)]
+[scriptable, uuid(d832b1ac-9bb6-4df0-9d9e-f7c040759672)]
 interface nsIDOMHTMLParamElement : nsIDOMHTMLElement
 {
            attribute DOMString        name;
diff --git a/dom/interfaces/html/nsIDOMHTMLPreElement.idl b/dom/interfaces/html/nsIDOMHTMLPreElement.idl
index 78440bd96973..462d9b91c251 100644
--- a/dom/interfaces/html/nsIDOMHTMLPreElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLPreElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(c9d9b45a-e7d9-4dfb-abae-f3b9e6addbaa)]
+[scriptable, uuid(f4088dff-649c-4eff-a3a4-dbd6333cdc44)]
 interface nsIDOMHTMLPreElement : nsIDOMHTMLElement
 {
            attribute long             width;
diff --git a/dom/interfaces/html/nsIDOMHTMLProgressElement.idl b/dom/interfaces/html/nsIDOMHTMLProgressElement.idl
index aa1db31233cf..24b584d78466 100644
--- a/dom/interfaces/html/nsIDOMHTMLProgressElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLProgressElement.idl
@@ -47,7 +47,7 @@
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(aa830aa2-a4ea-455e-8285-8344cadb4c6d)]
+[scriptable, uuid(9b1d2263-b60f-4d18-b4d1-66e8c3867c79)]
 interface nsIDOMHTMLProgressElement : nsIDOMHTMLElement
 {
            attribute double value;
diff --git a/dom/interfaces/html/nsIDOMHTMLQuoteElement.idl b/dom/interfaces/html/nsIDOMHTMLQuoteElement.idl
index 20e0ef6c4949..c100f9090e3d 100644
--- a/dom/interfaces/html/nsIDOMHTMLQuoteElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLQuoteElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(820ccd14-2479-4e4a-99d3-76d138caf7ec)]
+[scriptable, uuid(55643647-2eda-4a45-af55-b2ba6c40c5f5)]
 interface nsIDOMHTMLQuoteElement : nsIDOMHTMLElement
 {
            attribute DOMString        cite;
diff --git a/dom/interfaces/html/nsIDOMHTMLScriptElement.idl b/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
index 8e7cf55a5a6e..02a52c1486ab 100644
--- a/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(e6252d3b-521a-4f79-9d57-2721a81e7cc2)]
+[scriptable, uuid(4b6a0957-5466-4134-8a0a-dd7e4675c106)]
 interface nsIDOMHTMLScriptElement : nsIDOMHTMLElement
 {
            attribute DOMString        src;
diff --git a/dom/interfaces/html/nsIDOMHTMLSelectElement.idl b/dom/interfaces/html/nsIDOMHTMLSelectElement.idl
index 2a71f9f2df2a..8034c29a916a 100644
--- a/dom/interfaces/html/nsIDOMHTMLSelectElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLSelectElement.idl
@@ -53,7 +53,7 @@
 
 interface nsIDOMValidityState;
 
-[scriptable, uuid(30a948a3-61a0-453c-a1e4-de67a1664746)]
+[scriptable, uuid(98f111e0-2b7e-4abd-984b-2cc1d174fe44)]
 interface nsIDOMHTMLSelectElement : nsIDOMHTMLElement
 {
            attribute boolean                     autofocus;
diff --git a/dom/interfaces/html/nsIDOMHTMLSourceElement.idl b/dom/interfaces/html/nsIDOMHTMLSourceElement.idl
index 0cc0a6b1ca1a..4cf5f82416da 100644
--- a/dom/interfaces/html/nsIDOMHTMLSourceElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLSourceElement.idl
@@ -48,7 +48,7 @@
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(dcac4414-37e2-409f-b0a6-8231007e585b)]
+[scriptable, uuid(c49d9a78-fa02-49c9-b239-9cd51e99f866)]
 interface nsIDOMHTMLSourceElement : nsIDOMHTMLElement
 {
            attribute DOMString src;
diff --git a/dom/interfaces/html/nsIDOMHTMLStyleElement.idl b/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
index 41d4741d039e..2ce7924082e6 100644
--- a/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(e72a6069-4987-480b-a349-ffd5fbebd59f)]
+[scriptable, uuid(247fc8c4-92f3-427b-af6f-41b13f28287d)]
 interface nsIDOMHTMLStyleElement : nsIDOMHTMLElement
 {
            attribute boolean          disabled;
diff --git a/dom/interfaces/html/nsIDOMHTMLTableCaptionElem.idl b/dom/interfaces/html/nsIDOMHTMLTableCaptionElem.idl
index 19dd09797264..fecd4818488a 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableCaptionElem.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableCaptionElem.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(cbd44d29-3120-470d-a7fb-fac4730c8b4b)]
+[scriptable, uuid(db0e641f-ba2b-4c67-8da1-4e418cc5fbf7)]
 interface nsIDOMHTMLTableCaptionElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
diff --git a/dom/interfaces/html/nsIDOMHTMLTableCellElement.idl b/dom/interfaces/html/nsIDOMHTMLTableCellElement.idl
index 43a9133ffea3..2f91ade14a13 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableCellElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableCellElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(03dd5118-7eaf-4bd3-a4a7-77f3f7eb8539)]
+[scriptable, uuid(4caa7af0-fec4-44c1-9a81-e1f14166e60c)]
 interface nsIDOMHTMLTableCellElement : nsIDOMHTMLElement
 {
   readonly attribute long             cellIndex;
diff --git a/dom/interfaces/html/nsIDOMHTMLTableColElement.idl b/dom/interfaces/html/nsIDOMHTMLTableColElement.idl
index 2573a0c9ccd7..e82b5b5fb214 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableColElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableColElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(d221534a-d13c-43b2-9ba0-7e0dd7452856)]
+[scriptable, uuid(9a4d1f6a-fb19-4886-b0d8-dcd201566580)]
 interface nsIDOMHTMLTableColElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
diff --git a/dom/interfaces/html/nsIDOMHTMLTableElement.idl b/dom/interfaces/html/nsIDOMHTMLTableElement.idl
index 3614a17a74ec..e7724f3d98f3 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(bba4b8b2-d01c-4c9b-abc8-3df28d048e68)]
+[scriptable, uuid(0f809b97-9311-45c4-a44e-7145f354438b)]
 interface nsIDOMHTMLTableElement : nsIDOMHTMLElement
 {
   // Modified in DOM Level 2:
diff --git a/dom/interfaces/html/nsIDOMHTMLTableRowElement.idl b/dom/interfaces/html/nsIDOMHTMLTableRowElement.idl
index f9aeed647f6d..e6748b0cf673 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableRowElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableRowElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(b0199f36-9e76-4ec6-867f-850e388d6244)]
+[scriptable, uuid(d24a80d4-491d-4e36-9349-afd3c6999b3e)]
 interface nsIDOMHTMLTableRowElement : nsIDOMHTMLElement
 {
   // Modified in DOM Level 2:
diff --git a/dom/interfaces/html/nsIDOMHTMLTableSectionElem.idl b/dom/interfaces/html/nsIDOMHTMLTableSectionElem.idl
index 96facb0877c0..037f300de7dd 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableSectionElem.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableSectionElem.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(ac2e2719-71f1-4485-ac1e-694e7e49bd2a)]
+[scriptable, uuid(6acc106e-96a2-4519-8f3a-142ebbdc1bb1)]
 interface nsIDOMHTMLTableSectionElement : nsIDOMHTMLElement
 {
            attribute DOMString            align;
diff --git a/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl b/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
index fc78d04cf516..ec65b72c4e19 100644
--- a/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
@@ -53,7 +53,7 @@ interface nsIDOMValidityState;
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(88d09917-d2da-4737-a887-277a2f9750c7)]
+[scriptable, uuid(16db703d-4816-440c-bcb3-c1ae0cae6532)]
 interface nsIDOMHTMLTextAreaElement : nsIDOMHTMLElement
 {
            attribute boolean               autofocus;
diff --git a/dom/interfaces/html/nsIDOMHTMLTitleElement.idl b/dom/interfaces/html/nsIDOMHTMLTitleElement.idl
index 18345f1421ad..305b773467c2 100644
--- a/dom/interfaces/html/nsIDOMHTMLTitleElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTitleElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(5cb8cfaf-7551-422b-9b03-58d756e54339)]
+[scriptable, uuid(e20fd651-6240-4f20-b8f0-6cc25cb699b7)]
 interface nsIDOMHTMLTitleElement : nsIDOMHTMLElement
 {
            attribute DOMString        text;
diff --git a/dom/interfaces/html/nsIDOMHTMLUListElement.idl b/dom/interfaces/html/nsIDOMHTMLUListElement.idl
index 313c2a16fa10..8ecf76e00e6c 100644
--- a/dom/interfaces/html/nsIDOMHTMLUListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLUListElement.idl
@@ -50,7 +50,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(1f409357-8cea-4f69-9f0c-4149886b63a1)]
+[scriptable, uuid(2467d39c-2c30-407e-9b67-ea5f231b7809)]
 interface nsIDOMHTMLUListElement : nsIDOMHTMLElement
 {
            attribute boolean          compact;
diff --git a/dom/interfaces/html/nsIDOMHTMLUnknownElement.idl b/dom/interfaces/html/nsIDOMHTMLUnknownElement.idl
index 508930fd0d30..97809dbd594c 100644
--- a/dom/interfaces/html/nsIDOMHTMLUnknownElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLUnknownElement.idl
@@ -43,7 +43,7 @@
  *
  * @see <http://www.whatwg.org/html/#htmlunknownelement>
  */
-[scriptable, uuid(0d69049f-8181-47f1-a7f7-e5417dd54136)]
+[scriptable, uuid(5f922c13-c2c1-4c49-b7c2-0e4e5c8e6860)]
 interface nsIDOMHTMLUnknownElement : nsIDOMHTMLElement
 {
 };
diff --git a/dom/interfaces/html/nsIDOMHTMLVideoElement.idl b/dom/interfaces/html/nsIDOMHTMLVideoElement.idl
index 622eafe52946..02c2bbbf8a2b 100644
--- a/dom/interfaces/html/nsIDOMHTMLVideoElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLVideoElement.idl
@@ -48,7 +48,7 @@
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(5e1e4453-96fe-4cc0-9c32-7e9355b4f917)]
+[scriptable, uuid(390b974b-1c3a-4700-8001-5ef832c4b4bf)]
 interface nsIDOMHTMLVideoElement : nsIDOMHTMLMediaElement
 {
            attribute long width; 
diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index c7d339fecd4e..e3634a36a144 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -98,7 +98,7 @@
 
 #include "nsDeviceMotion.h"
 
-#if defined(ANDROID)
+#if defined(MOZ_WIDGET_ANDROID)
 #include "APKOpen.h"
 #endif
 
@@ -272,7 +272,7 @@ ContentChild::Init(MessageLoop* aIOLoop,
 #ifdef MOZ_CRASHREPORTER
     SendPCrashReporterConstructor(CrashReporter::CurrentThreadId(),
                                   XRE_GetProcessType());
-#if defined(ANDROID)
+#if defined(MOZ_WIDGET_ANDROID)
     PCrashReporterChild* crashreporter = ManagedPCrashReporterChild()[0];
 
     InfallibleTArray<Mapping> mappings;
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index e99ab420964c..f6dcaf9e6981 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -106,6 +106,8 @@
 
 #ifdef ANDROID
 #include "gfxAndroidPlatform.h"
+#endif
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidBridge.h"
 #endif
 
@@ -636,7 +638,7 @@ ContentParent::RecvClipboardHasText(bool* hasText)
 bool
 ContentParent::RecvGetSystemColors(const PRUint32& colorsCount, InfallibleTArray<PRUint32>* colors)
 {
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     NS_ASSERTION(AndroidBridge::Bridge() != nsnull, "AndroidBridge is not available");
     if (AndroidBridge::Bridge() == nsnull) {
         // Do not fail - the colors won't be right, but it's not critical
@@ -655,7 +657,7 @@ ContentParent::RecvGetSystemColors(const PRUint32& colorsCount, InfallibleTArray
 bool
 ContentParent::RecvGetIconForExtension(const nsCString& aFileExt, const PRUint32& aIconSize, InfallibleTArray<PRUint8>* bits)
 {
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     NS_ASSERTION(AndroidBridge::Bridge() != nsnull, "AndroidBridge is not available");
     if (AndroidBridge::Bridge() == nsnull) {
         // Do not fail - just no icon will be shown
@@ -674,7 +676,7 @@ ContentParent::RecvGetShowPasswordSetting(bool* showPassword)
 {
     // default behavior is to show the last password character
     *showPassword = true;
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     NS_ASSERTION(AndroidBridge::Bridge() != nsnull, "AndroidBridge is not available");
     if (AndroidBridge::Bridge() != nsnull)
         *showPassword = AndroidBridge::Bridge()->GetShowPasswordSetting();
diff --git a/dom/plugins/base/PluginPRLibrary.cpp b/dom/plugins/base/PluginPRLibrary.cpp
index 7686147af671..6ff84c96ff57 100644
--- a/dom/plugins/base/PluginPRLibrary.cpp
+++ b/dom/plugins/base/PluginPRLibrary.cpp
@@ -51,7 +51,7 @@ static int gNotOptimized;
 #define CALLING_CONVENTION_HACK
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidBridge.h"
 #include "android_npapi.h"
 #include <android/log.h>
@@ -59,7 +59,7 @@ static int gNotOptimized;
 #endif
 
 namespace mozilla {
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 nsresult
 PluginPRLibrary::NP_Initialize(NPNetscapeFuncs* bFuncs,
 			       NPPluginFuncs* pFuncs, NPError* error)
@@ -82,10 +82,16 @@ PluginPRLibrary::NP_Initialize(NPNetscapeFuncs* bFuncs,
   mNPP_GetSitesWithData = pFuncs->getsiteswithdata;
   return NS_OK;
 }
+#elif defined(MOZ_WIDGET_GONK)
+nsresult
+PluginPRLibrary::NP_Initialize(NPNetscapeFuncs* bFuncs, NPError* error)
+{
+  return NS_OK;
+}
 #elif defined(XP_UNIX) && !defined(XP_MACOSX)
 nsresult
 PluginPRLibrary::NP_Initialize(NPNetscapeFuncs* bFuncs,
-			       NPPluginFuncs* pFuncs, NPError* error)
+                               NPPluginFuncs* pFuncs, NPError* error)
 {
   if (mNP_Initialize) {
     *error = mNP_Initialize(bFuncs, pFuncs);
diff --git a/dom/plugins/base/PluginPRLibrary.h b/dom/plugins/base/PluginPRLibrary.h
index e1626238bb17..38546f184b33 100644
--- a/dom/plugins/base/PluginPRLibrary.h
+++ b/dom/plugins/base/PluginPRLibrary.h
@@ -114,7 +114,7 @@ public:
         return true;
     }
 
-#if defined(XP_UNIX) && !defined(XP_MACOSX)
+#if defined(XP_UNIX) && !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK)
     virtual nsresult NP_Initialize(NPNetscapeFuncs* bFuncs,
                                    NPPluginFuncs* pFuncs, NPError* error);
 #else
diff --git a/dom/plugins/base/npfunctions.h b/dom/plugins/base/npfunctions.h
index fe32ce557ee2..37c8213e585d 100644
--- a/dom/plugins/base/npfunctions.h
+++ b/dom/plugins/base/npfunctions.h
@@ -48,7 +48,7 @@
 #include "npapi.h"
 #include "npruntime.h"
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include <jni.h>
 #endif
 
@@ -311,7 +311,7 @@ NP_EXPORT(NPError)     NP_Initialize(NPNetscapeFuncs* bFuncs);
 typedef NPError        (*NP_GetEntryPointsFunc)(NPPluginFuncs*);
 NP_EXPORT(NPError)     NP_GetEntryPoints(NPPluginFuncs* pFuncs);
 #else
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 typedef NPError    (*NP_InitializeFunc)(NPNetscapeFuncs*, NPPluginFuncs*, JNIEnv* pEnv);
 NP_EXPORT(NPError) NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs, JNIEnv* pEnv);
 #else
diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp
index 2520d60db4b1..8f0e4bbd6ebc 100644
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -131,7 +131,7 @@ using mozilla::plugins::PluginModuleParent;
 #include <windows.h>
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "ANPBase.h"
 #include "AndroidBridge.h"
 #include <android/log.h>
@@ -488,7 +488,7 @@ nsNPAPIPlugin::CreatePlugin(nsPluginTag *aPluginTag, nsNPAPIPlugin** aResult)
     return NS_ERROR_FAILURE;
   }
 
-#if defined(XP_MACOSX) || defined(ANDROID)
+#if defined(XP_MACOSX) || defined(MOZ_WIDGET_ANDROID)
   if (!pluginLib->HasRequiredFunctions()) {
     NS_WARNING("Not all necessary functions exposed by plugin, it will not load.");
     return NS_ERROR_FAILURE;
@@ -526,6 +526,7 @@ nsNPAPIPlugin::CreatePlugin(nsPluginTag *aPluginTag, nsNPAPIPlugin** aResult)
   if (rv != NS_OK || pluginCallError != NPERR_NO_ERROR) {
     return NS_ERROR_FAILURE;
   }
+#elif defined(MOZ_WIDGET_GONK)
 #else
   rv = pluginLib->NP_Initialize(&sBrowserFuncs, &plugin->mPluginFuncs, &pluginCallError);
   if (rv != NS_OK || pluginCallError != NPERR_NO_ERROR) {
@@ -2298,7 +2299,7 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
   }
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     case kLogInterfaceV0_ANPGetValue: {
       LOG("get log interface");
       ANPLogInterfaceV0 *i = (ANPLogInterfaceV0 *) result;
@@ -2484,9 +2485,8 @@ _setvalue(NPP npp, NPPVariable variable, void *result)
       }
 
     case NPPVpluginKeepLibraryInMemory: {
-      // This variable is not supported any more but we'll pretend it is
-      // so that plugins don't fail on an error return.
-      return NS_OK;
+      NPBool bCached = (result != nsnull);
+      return inst->SetCached(bCached);
     }
 
     case NPPVpluginUsesDOMForCursorBool: {
@@ -2515,7 +2515,7 @@ _setvalue(NPP npp, NPPVariable variable, void *result)
       }
     }
 #endif
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   case kRequestDrawingModel_ANPSetValue:
     if (inst)
       inst->SetDrawingModel(NS_PTR_TO_INT32(result));
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.cpp b/dom/plugins/base/nsNPAPIPluginInstance.cpp
index 3e990d6f78a5..7aa883ef3044 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.cpp
+++ b/dom/plugins/base/nsNPAPIPluginInstance.cpp
@@ -61,7 +61,7 @@
 #include "nsNetCID.h"
 #include "nsIContent.h"
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "ANPBase.h"
 #include <android/log.h>
 #include "android_npapi.h"
@@ -72,7 +72,7 @@
 using namespace mozilla;
 using namespace mozilla::plugins::parent;
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include <map>
 static std::map<void*, nsNPAPIPluginInstance*> sSurfaceMap;
 #endif
@@ -91,7 +91,7 @@ nsNPAPIPluginInstance::nsNPAPIPluginInstance(nsNPAPIPlugin* plugin)
     mDrawingModel(NPDrawingModelQuickDraw),
 #endif
 #endif
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     mSurface(nsnull),
     mTargetSurface(nsnull),
     mDrawingModel(0),
@@ -100,6 +100,7 @@ nsNPAPIPluginInstance::nsNPAPIPluginInstance(nsNPAPIPlugin* plugin)
     mWindowless(false),
     mWindowlessLocal(false),
     mTransparent(false),
+    mCached(false),
     mUsesDOMForCursor(false),
     mInPluginInitCall(false),
     mPlugin(plugin),
@@ -127,7 +128,7 @@ nsNPAPIPluginInstance::nsNPAPIPluginInstance(nsNPAPIPlugin* plugin)
       mUsePluginLayersPref = useLayersPref;
   }
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   mTargetSurfaceLock = new Mutex("nsNPAPIPluginInstance::SurfaceLock");
 #endif
 
@@ -143,7 +144,7 @@ nsNPAPIPluginInstance::~nsNPAPIPluginInstance()
     mMIMEType = nsnull;
   }
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   if (mSurface) {
     sSurfaceMap.erase(mSurface);
   }
@@ -167,6 +168,12 @@ nsNPAPIPluginInstance::Destroy()
   mPlugin = nsnull;
 }
 
+TimeStamp
+nsNPAPIPluginInstance::StopTime()
+{
+  return mStopTime;
+}
+
 nsresult nsNPAPIPluginInstance::Initialize(nsIPluginInstanceOwner* aOwner, const char* aMIMEType)
 {
   PLUGIN_LOG(PLUGIN_LOG_NORMAL, ("nsNPAPIPluginInstance::Initialize this=%p\n",this));
@@ -225,6 +232,7 @@ nsresult nsNPAPIPluginInstance::Stop()
   {
     AsyncCallbackAutoLock lock;
     mRunning = DESTROYING;
+    mStopTime = TimeStamp::Now();
   }
 
   OnPluginDestroy(&mNPP);
@@ -364,7 +372,7 @@ nsNPAPIPluginInstance::InitializePlugin()
       const char* const* pvalues = nsnull;    
       if (NS_SUCCEEDED(GetParameters(pcount, pnames, pvalues))) {
         // Android expects an empty string as the separator instead of null
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
         NS_ASSERTION(PL_strcmp(values[count], "") == 0, "attribute/parameter array not setup correctly for Android NPAPI plugins");
 #else
         NS_ASSERTION(!values[count], "attribute/parameter array not setup correctly for NPAPI plugins");
@@ -747,7 +755,7 @@ void nsNPAPIPluginInstance::SetEventModel(NPEventModel aModel)
 }
 #endif
 
-#if defined(ANDROID)
+#if defined(MOZ_WIDGET_ANDROID)
 void nsNPAPIPluginInstance::SetDrawingModel(PRUint32 aModel)
 {
   mDrawingModel = aModel;
@@ -859,7 +867,7 @@ nsNPAPIPluginInstance::FindByJavaSurface(void* aJavaSurface)
 
 nsresult nsNPAPIPluginInstance::GetDrawingModel(PRInt32* aModel)
 {
-#if defined(XP_MACOSX) || defined(ANDROID)
+#if defined(XP_MACOSX) || defined(MOZ_WIDGET_ANDROID)
   *aModel = (PRInt32)mDrawingModel;
   return NS_OK;
 #else
@@ -955,10 +963,23 @@ nsNPAPIPluginInstance::DefineJavaProperties()
   return NS_OK;
 }
 
+nsresult
+nsNPAPIPluginInstance::SetCached(bool aCache)
+{
+  mCached = aCache;
+  return NS_OK;
+}
+
+bool
+nsNPAPIPluginInstance::ShouldCache()
+{
+  return mCached;
+}
+
 nsresult
 nsNPAPIPluginInstance::IsWindowless(bool* isWindowless)
 {
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   // On android, pre-honeycomb, all plugins are treated as windowless.
   *isWindowless = true;
 #else
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.h b/dom/plugins/base/nsNPAPIPluginInstance.h
index e2fd1e217431..886090bc06a1 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.h
+++ b/dom/plugins/base/nsNPAPIPluginInstance.h
@@ -93,7 +93,7 @@ public:
   nsresult NewStreamToPlugin(nsIPluginStreamListener** listener);
   nsresult NewStreamFromPlugin(const char* type, const char* target, nsIOutputStream* *result);
   nsresult Print(NPPrint* platformPrint);
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   nsresult PostEvent(void* event) { return 0; };
 #endif
   nsresult HandleEvent(void* event, PRInt16* result);
@@ -102,6 +102,7 @@ public:
   nsresult IsRemoteDrawingCoreAnimation(bool* aDrawing);
   nsresult GetJSObject(JSContext *cx, JSObject** outObject);
   nsresult DefineJavaProperties();
+  bool ShouldCache();
   nsresult IsWindowless(bool* isWindowless);
   nsresult AsyncSetWindow(NPWindow* window);
   nsresult GetImage(ImageContainer* aContainer, Image** aImage);
@@ -152,7 +153,7 @@ public:
   void SetEventModel(NPEventModel aModel);
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   void SetDrawingModel(PRUint32 aModel);
   void* GetJavaSurface();
 
@@ -187,6 +188,12 @@ public:
     return mRunning == RUNNING || mRunning == DESTROYING;
   }
 
+  // return is only valid when the plugin is not running
+  mozilla::TimeStamp StopTime();
+
+  // cache this NPAPI plugin
+  nsresult SetCached(bool aCache);
+
   already_AddRefed<nsPIDOMWindow> GetDOMWindow();
 
   nsresult PrivateModeStateChanged();
@@ -230,7 +237,7 @@ protected:
   NPDrawingModel mDrawingModel;
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   PRUint32 mDrawingModel;
 #endif
 
@@ -246,6 +253,7 @@ protected:
   bool mWindowless;
   bool mWindowlessLocal;
   bool mTransparent;
+  bool mCached;
   bool mUsesDOMForCursor;
 
 public:
@@ -274,10 +282,14 @@ private:
   // non-null during a HandleEvent call
   void* mCurrentPluginEvent;
 
+  // Timestamp for the last time this plugin was stopped.
+  // This is only valid when the plugin is actually stopped!
+  mozilla::TimeStamp mStopTime;
+
   nsCOMPtr<nsIURI> mURI;
 
   bool mUsePluginLayersPref;
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   void InvalidateTargetRect();
   
   void* mSurface;
diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp
index 3921578b7dde..c5d06d352ecd 100644
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -231,6 +231,10 @@ PRLogModuleInfo* nsPluginLogging::gPluginLog = nsnull;
 #define BRAND_PROPERTIES_URL "chrome://branding/locale/brand.properties"
 #define PLUGIN_PROPERTIES_URL "chrome://global/locale/downloadProgress.properties"
 
+// #defines for plugin cache and prefs
+#define NS_PREF_MAX_NUM_CACHED_INSTANCES "browser.plugins.max_num_cached_plugins"
+#define DEFAULT_NUMBER_OF_STOPPED_INSTANCES 10
+
 #ifdef CALL_SAFETY_ON
 // By default we run OOPP, so we don't want to cover up crashes.
 bool gSkipPluginSafeCalls = true;
@@ -3204,13 +3208,34 @@ nsPluginHost::StopPluginInstance(nsNPAPIPluginInstance* aInstance)
     return NS_OK;
   }
 
-  nsPluginTag* pluginTag = TagForPlugin(aInstance->GetPlugin());
-
   aInstance->Stop();
-  aInstance->Destroy();
-  mInstances.RemoveElement(aInstance);
 
-  OnPluginInstanceDestroyed(pluginTag);
+  // if the instance does not want to be 'cached' just remove it
+  bool doCache = aInstance->ShouldCache();
+  if (doCache) {
+    // try to get the max cached instances from a pref or use default
+    PRUint32 cachedInstanceLimit;
+    nsresult rv = NS_ERROR_FAILURE;
+    if (mPrefService)
+      rv = mPrefService->GetIntPref(NS_PREF_MAX_NUM_CACHED_INSTANCES, (int*)&cachedInstanceLimit);
+    if (NS_FAILED(rv))
+      cachedInstanceLimit = DEFAULT_NUMBER_OF_STOPPED_INSTANCES;
+    
+    if (StoppedInstanceCount() >= cachedInstanceLimit) {
+      nsNPAPIPluginInstance *oldestInstance = FindOldestStoppedInstance();
+      if (oldestInstance) {
+        nsPluginTag* pluginTag = TagForPlugin(oldestInstance->GetPlugin());
+        oldestInstance->Destroy();
+        mInstances.RemoveElement(oldestInstance);
+        OnPluginInstanceDestroyed(pluginTag);
+      }
+    }
+  } else {
+    nsPluginTag* pluginTag = TagForPlugin(aInstance->GetPlugin());
+    aInstance->Destroy();
+    mInstances.RemoveElement(aInstance);
+    OnPluginInstanceDestroyed(pluginTag);
+  }
 
   return NS_OK;
 }
@@ -3936,6 +3961,38 @@ nsPluginHost::FindInstance(const char *mimetype)
   return nsnull;
 }
 
+nsNPAPIPluginInstance*
+nsPluginHost::FindOldestStoppedInstance()
+{
+  nsNPAPIPluginInstance *oldestInstance = nsnull;
+  TimeStamp oldestTime = TimeStamp::Now();
+  for (PRUint32 i = 0; i < mInstances.Length(); i++) {
+    nsNPAPIPluginInstance *instance = mInstances[i];
+    if (instance->IsRunning())
+      continue;
+
+    TimeStamp time = instance->StopTime();
+    if (time < oldestTime) {
+      oldestTime = time;
+      oldestInstance = instance;
+    }
+  }
+
+  return oldestInstance;
+}
+
+PRUint32
+nsPluginHost::StoppedInstanceCount()
+{
+  PRUint32 stoppedCount = 0;
+  for (PRUint32 i = 0; i < mInstances.Length(); i++) {
+    nsNPAPIPluginInstance *instance = mInstances[i];
+    if (!instance->IsRunning())
+      stoppedCount++;
+  }
+  return stoppedCount;
+}
+
 nsTArray< nsRefPtr<nsNPAPIPluginInstance> >*
 nsPluginHost::InstanceArray()
 {
diff --git a/dom/plugins/base/nsPluginHost.h b/dom/plugins/base/nsPluginHost.h
index e9a3b23cb2a5..d78605bc382b 100644
--- a/dom/plugins/base/nsPluginHost.h
+++ b/dom/plugins/base/nsPluginHost.h
@@ -205,6 +205,8 @@ public:
                      const nsAString& browserDumpID);
 
   nsNPAPIPluginInstance *FindInstance(const char *mimetype);
+  nsNPAPIPluginInstance *FindOldestStoppedInstance();
+  PRUint32 StoppedInstanceCount();
 
   nsTArray< nsRefPtr<nsNPAPIPluginInstance> > *InstanceArray();
 
@@ -253,6 +255,9 @@ private:
   nsPluginTag*
   FindPluginEnabledForExtension(const char* aExtension, const char* &aMimeType);
 
+  nsresult
+  FindStoppedPluginForURL(nsIURI* aURL, nsIPluginInstanceOwner *aOwner);
+
   nsresult
   FindPlugins(bool aCreatePluginList, bool * aPluginsChanged);
 
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index caf2b8f7357f..0ddfeae78018 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -118,7 +118,7 @@ static NS_DEFINE_CID(kAppShellCID, NS_APPSHELL_CID);
 #include "gfxXlibNativeRenderer.h"
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "ANPBase.h"
 #include "android_npapi.h"
 #include "AndroidBridge.h"
@@ -1280,7 +1280,7 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
 
   // Add PARAM and null separator.
   mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING("PARAM"));
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   // Flash expects an empty string on android
   mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING(""));
 #else
@@ -1672,7 +1672,7 @@ void nsPluginInstanceOwner::ScrollPositionDidChange(nscoord aX, nscoord aY)
 #endif
 }
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 void nsPluginInstanceOwner::AddPluginView(const gfxRect& aRect)
 {
   void* javaSurface = mInstance->GetJavaSurface();
@@ -1714,7 +1714,7 @@ void nsPluginInstanceOwner::RemovePluginView()
 
 nsresult nsPluginInstanceOwner::DispatchFocusToPlugin(nsIDOMEvent* aFocusEvent)
 {
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   {
     ANPEvent event;
     event.inSize = sizeof(ANPEvent);
@@ -2527,7 +2527,7 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
     rv = nsEventStatus_eConsumeNoDefault;
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   // this code supports windowless plugins
   {
     // The plugin needs focus to receive keyboard and touch events
@@ -2733,7 +2733,7 @@ nsPluginInstanceOwner::PrepareToStop(bool aDelayedStop)
   }
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   RemovePluginView();
 #endif
 
@@ -2833,7 +2833,7 @@ void nsPluginInstanceOwner::Paint(const nsRect& aDirtyRect, HPS aHPS)
 }
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 
 void nsPluginInstanceOwner::Paint(gfxContext* aContext,
                                   const gfxRect& aFrameRect,
@@ -3556,7 +3556,7 @@ void nsPluginInstanceOwner::UpdateWindowPositionAndClipRect(bool aSetWindow)
   if (mPluginWindowVisible && mPluginDocumentActiveState) {
     mPluginWindow->clipRect.right = mPluginWindow->width;
     mPluginWindow->clipRect.bottom = mPluginWindow->height;
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     if (mInstance) {
       ANPEvent event;
       event.inSize = sizeof(ANPEvent);
@@ -3568,7 +3568,7 @@ void nsPluginInstanceOwner::UpdateWindowPositionAndClipRect(bool aSetWindow)
   } else {
     mPluginWindow->clipRect.right = 0;
     mPluginWindow->clipRect.bottom = 0;
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     if (mInstance) {
       ANPEvent event;
       event.inSize = sizeof(ANPEvent);
diff --git a/dom/plugins/ipc/PluginLibrary.h b/dom/plugins/ipc/PluginLibrary.h
index 9094437e23df..923afa027626 100644
--- a/dom/plugins/ipc/PluginLibrary.h
+++ b/dom/plugins/ipc/PluginLibrary.h
@@ -78,7 +78,7 @@ public:
 
   virtual bool HasRequiredFunctions() = 0;
 
-#if defined(XP_UNIX) && !defined(XP_MACOSX)
+#if defined(XP_UNIX) && !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK)
   virtual nsresult NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs, NPError* error) = 0;
 #else
   virtual nsresult NP_Initialize(NPNetscapeFuncs* bFuncs, NPError* error) = 0;
diff --git a/dom/plugins/ipc/PluginModuleParent.cpp b/dom/plugins/ipc/PluginModuleParent.cpp
index b84e53f1b042..5d4b1edf92a9 100644
--- a/dom/plugins/ipc/PluginModuleParent.cpp
+++ b/dom/plugins/ipc/PluginModuleParent.cpp
@@ -735,7 +735,7 @@ PluginModuleParent::EndUpdateBackground(NPP instance,
     return i->EndUpdateBackground(aCtx, aRect);
 }
 
-#if defined(XP_UNIX) && !defined(XP_MACOSX)
+#if defined(XP_UNIX) && !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK)
 nsresult
 PluginModuleParent::NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs, NPError* error)
 {
diff --git a/dom/plugins/ipc/PluginModuleParent.h b/dom/plugins/ipc/PluginModuleParent.h
index 66bb84e515ea..7910e6ab9434 100644
--- a/dom/plugins/ipc/PluginModuleParent.h
+++ b/dom/plugins/ipc/PluginModuleParent.h
@@ -276,7 +276,7 @@ private:
                                          gfxContext* aCtx,
                                          const nsIntRect& aRect);
 
-#if defined(XP_UNIX) && !defined(XP_MACOSX)
+#if defined(XP_UNIX) && !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK)
     virtual nsresult NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs, NPError* error);
 #else
     virtual nsresult NP_Initialize(NPNetscapeFuncs* bFuncs, NPError* error);
diff --git a/dom/plugins/test/mochitest/test_crash_submit.xul b/dom/plugins/test/mochitest/test_crash_submit.xul
index 659a835528c4..8b404ae0599b 100644
--- a/dom/plugins/test/mochitest/test_crash_submit.xul
+++ b/dom/plugins/test/mochitest/test_crash_submit.xul
@@ -16,6 +16,7 @@
 <script class="testbody" type="application/javascript">
 <![CDATA[
 SimpleTest.waitForExplicitFinish();
+SimpleTest.ignoreAllUncaughtExceptions();
 
 Components.utils.import("resource://gre/modules/NetUtil.jsm");
 Components.utils.import("resource://gre/modules/Services.jsm");
diff --git a/dom/src/geolocation/nsGeolocation.cpp b/dom/src/geolocation/nsGeolocation.cpp
index a11f87c24d78..3071c27d816f 100644
--- a/dom/src/geolocation/nsGeolocation.cpp
+++ b/dom/src/geolocation/nsGeolocation.cpp
@@ -84,7 +84,7 @@
 #include "QTMLocationProvider.h"
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidLocationProvider.h"
 #endif
 
@@ -595,7 +595,7 @@ nsresult nsGeolocationService::Init()
     mProviders.AppendObject(provider);
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   provider = new AndroidLocationProvider();
   if (provider)
     mProviders.AppendObject(provider);
diff --git a/dom/src/storage/nsDOMStorage.cpp b/dom/src/storage/nsDOMStorage.cpp
index 9de9633ec364..87feb60f253f 100644
--- a/dom/src/storage/nsDOMStorage.cpp
+++ b/dom/src/storage/nsDOMStorage.cpp
@@ -287,16 +287,27 @@ nsDOMStorageManager::Initialize()
   if (!os)
     return NS_OK;
 
-  os->AddObserver(gStorageManager, "cookie-changed", false);
-  os->AddObserver(gStorageManager, "offline-app-removed", false);
-  os->AddObserver(gStorageManager, NS_PRIVATE_BROWSING_SWITCH_TOPIC, false);
-  os->AddObserver(gStorageManager, "profile-after-change", false);
-  os->AddObserver(gStorageManager, "perm-changed", false);
-  os->AddObserver(gStorageManager, "browser:purge-domain-data", false);
+  nsresult rv;
+  rv = os->AddObserver(gStorageManager, "cookie-changed", false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = os->AddObserver(gStorageManager, "offline-app-removed", false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = os->AddObserver(gStorageManager, NS_PRIVATE_BROWSING_SWITCH_TOPIC,
+                       false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = os->AddObserver(gStorageManager, "profile-after-change", false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = os->AddObserver(gStorageManager, "perm-changed", false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = os->AddObserver(gStorageManager, "browser:purge-domain-data", false);
+  NS_ENSURE_SUCCESS(rv, rv);
   // Used for temporary table flushing
-  os->AddObserver(gStorageManager, "profile-before-change", false);
-  os->AddObserver(gStorageManager, NS_XPCOM_SHUTDOWN_OBSERVER_ID, false);
-  os->AddObserver(gStorageManager, NS_DOMSTORAGE_FLUSH_TIMER_TOPIC, false);
+  rv = os->AddObserver(gStorageManager, "profile-before-change", false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = os->AddObserver(gStorageManager, NS_XPCOM_SHUTDOWN_OBSERVER_ID, false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = os->AddObserver(gStorageManager, NS_DOMSTORAGE_FLUSH_TIMER_TOPIC, false);
+  NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_OK;
 }
diff --git a/dom/tests/mochitest/general/Makefile.in b/dom/tests/mochitest/general/Makefile.in
index d548a8ebfbff..e35c278fad62 100644
--- a/dom/tests/mochitest/general/Makefile.in
+++ b/dom/tests/mochitest/general/Makefile.in
@@ -45,6 +45,8 @@ include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 _TEST_FILES = \
+		test_outerHTML.html \
+		test_outerHTML.xhtml \
 		497633.html \
 		489127.html \
 		historyframes.html \
diff --git a/dom/tests/mochitest/general/test_outerHTML.html b/dom/tests/mochitest/general/test_outerHTML.html
new file mode 100644
index 000000000000..dba259844232
--- /dev/null
+++ b/dom/tests/mochitest/general/test_outerHTML.html
@@ -0,0 +1,73 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=92264
+-->
+<head>
+  <title>Test for Bug 92264</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body onload="runTest();">
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=92264">Mozilla Bug 92264</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<div id="wrap"><dl></dl><p id="thep">foo<span>bar</span></p><ol></ol></div>
+<table id="thetable"><tbody><tr><td>1</td></tr><tr id="thetr"><td>2</td></tr><tr><td>3</td></tr></tbody></table>
+<iframe></iframe>
+<div id="fragmentwrap"></div>
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 92264 **/
+
+SimpleTest.waitForExplicitFinish();
+
+function runTest() {
+
+  var thep = document.getElementById("thep");
+  var wrap = document.getElementById("wrap");
+  is(thep.outerHTML, '<p id="thep">foo<span>bar</span></p>', "Unexpected thep outerHTML");
+  thep.outerHTML = "<ul></ul><tr></tr><p></p>";
+  is(wrap.innerHTML, "<dl></dl><ul></ul><p></p><ol></ol>", "Bad outerHTML parsing inside wrap");
+
+  var thetr = document.getElementById("thetr");
+  thetr.outerHTML = "<tr><td>a</td></tr><div></div><tr><td>b</td></tr>";
+  var thetable = document.getElementById("thetable");
+  is(thetable.innerHTML, "<tbody><tr><td>1</td></tr><tr><td>a</td></tr><div></div><tr><td>b</td></tr><tr><td>3</td></tr></tbody>", "Wrong outerHTML parsing inside table");
+
+  var iframe = document.getElementsByTagName("iframe")[0];
+  var oldbody = iframe.contentDocument.body;
+  iframe.contentDocument.body.outerHTML = "<body></body>";
+  isnot(oldbody, iframe.contentDocument.body, "Failed to replace body");
+  is(iframe.contentDocument.getElementsByTagName("body").length, 1, "Should have gotten one body");
+  // Yes, two heads per spec. Also Ragnarök and Chrome produce two heads.
+  is(iframe.contentDocument.getElementsByTagName("head").length, 2, "Should have gotten two heads");
+
+  try {
+    document.documentElement.outerHTML = "<html></html>";
+    ok(false, "Should have thrown an exception");
+  } catch(e) {
+    is(e.code, 7, "outerHTML should throw NO_MODIFICATION_ALLOWED_ERR");
+  }
+
+  var f = document.createDocumentFragment();
+  var dl = document.createElement("dl");
+  var p = document.createElement("p");
+  var ol = document.createElement("ol");
+  f.appendChild(dl);
+  f.appendChild(p);
+  f.appendChild(ol);
+  p.outerHTML = "<ul></ul><tr></tr><body></body><p></p>";
+  var fragmentwrap = document.getElementById("fragmentwrap");
+  fragmentwrap.appendChild(f);
+  is(fragmentwrap.innerHTML, "<dl></dl><ul></ul><p></p><ol></ol>", "Bad outerHTML parsing in fragment");
+
+  SimpleTest.finish();
+}
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/tests/mochitest/general/test_outerHTML.xhtml b/dom/tests/mochitest/general/test_outerHTML.xhtml
new file mode 100644
index 000000000000..46013deb0af9
--- /dev/null
+++ b/dom/tests/mochitest/general/test_outerHTML.xhtml
@@ -0,0 +1,74 @@
+<!DOCTYPE HTML>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=92264
+-->
+<head>
+  <title>Test for Bug 92264</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body onload="runTest();">
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=92264">Mozilla Bug 92264</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<div id="wrap"><dl></dl><p id="thep">foo<span>bar</span></p><ol></ol></div>
+<table id="thetable"><tbody><tr><td>1</td></tr><tr id="thetr"><td>2</td></tr><tr><td>3</td></tr></tbody></table>
+<iframe></iframe>
+<div id="fragmentwrap"></div>
+</div>
+<pre id="test">
+<script type="application/javascript">
+<![CDATA[
+
+/** Test for Bug 92264 **/
+
+SimpleTest.waitForExplicitFinish();
+
+function runTest() {
+
+  var thep = document.getElementById("thep");
+  var wrap = document.getElementById("wrap");
+  is(thep.outerHTML, '<p xmlns="http://www.w3.org/1999/xhtml" id="thep">foo<span>bar</span></p>', "Unexpected thep outerHTML");
+  thep.outerHTML = "<ul></ul><tr></tr><p></p>";
+  is(wrap.innerHTML, '<dl xmlns="http://www.w3.org/1999/xhtml"></dl><ul xmlns="http://www.w3.org/1999/xhtml"></ul><tr xmlns="http://www.w3.org/1999/xhtml"></tr><p xmlns="http://www.w3.org/1999/xhtml"></p><ol xmlns="http://www.w3.org/1999/xhtml"></ol>', "Bad outerHTML parsing inside wrap");
+
+  var thetr = document.getElementById("thetr");
+  thetr.outerHTML = "<tr><td>a</td></tr><div></div><tr><td>b</td></tr>";
+  var thetable = document.getElementById("thetable");
+  is(thetable.innerHTML, '<tbody xmlns="http://www.w3.org/1999/xhtml"><tr><td>1</td></tr><tr><td>a</td></tr><div></div><tr><td>b</td></tr><tr><td>3</td></tr></tbody>', "Wrong outerHTML parsing inside table");
+
+  var iframe = document.getElementsByTagName("iframe")[0];
+  var oldbody = iframe.contentDocument.body;
+  iframe.contentDocument.body.outerHTML = "<body></body>";
+  isnot(oldbody, iframe.contentDocument.body, "Failed to replace body");
+  is(iframe.contentDocument.getElementsByTagName("body").length, 1, "Should have gotten one body");
+  // Yes, two heads per spec. Also Ragnarök and Chrome produce two heads.
+  is(iframe.contentDocument.getElementsByTagName("head").length, 2, "Should have gotten two heads");
+
+  try {
+    document.documentElement.outerHTML = "<html></html>";
+    ok(false, "Should have thrown an exception");
+  } catch(e) {
+    is(e.code, 7, "outerHTML should throw NO_MODIFICATION_ALLOWED_ERR");
+  }
+
+  var f = document.createDocumentFragment();
+  var dl = document.createElement("dl");
+  var p = document.createElement("p");
+  var ol = document.createElement("ol");
+  f.appendChild(dl);
+  f.appendChild(p);
+  f.appendChild(ol);
+  p.outerHTML = "<ul></ul><tr></tr><body></body><p></p>";
+  var fragmentwrap = document.getElementById("fragmentwrap");
+  fragmentwrap.appendChild(f);
+  is(fragmentwrap.innerHTML, '<dl xmlns="http://www.w3.org/1999/xhtml"></dl><ul xmlns="http://www.w3.org/1999/xhtml"></ul><tr xmlns="http://www.w3.org/1999/xhtml"></tr><body xmlns="http://www.w3.org/1999/xhtml"></body><p xmlns="http://www.w3.org/1999/xhtml"></p><ol xmlns="http://www.w3.org/1999/xhtml"></ol>', "Bad outerHTML parsing in fragment");
+
+  SimpleTest.finish();
+}
+]]>
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/workers/WorkerScope.cpp b/dom/workers/WorkerScope.cpp
index a2210474250e..a4bd3e61d08d 100644
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -832,6 +832,11 @@ CreateDedicatedWorkerGlobalScope(JSContext* aCx)
     return NULL;
   }
 
+  JSAutoEnterCompartment ac;
+  if (!ac.enter(aCx, global)) {
+    return NULL;
+  }
+
   // Make the private slots now so that all our instance checks succeed.
   if (!DedicatedWorkerGlobalScope::InitPrivate(aCx, global, worker)) {
     return NULL;
diff --git a/dom/workers/test/test_xhr.html b/dom/workers/test/test_xhr.html
index 12ed32c93c2e..b4161f34ed82 100644
--- a/dom/workers/test/test_xhr.html
+++ b/dom/workers/test/test_xhr.html
@@ -23,9 +23,11 @@ Tests of DOM Worker Threads XHR(Bug 450452 )
 
   var worker = new Worker("xhr_worker.js");
 
+  var gotUploadLoad = false, gotLoadend = false;
+
   worker.onmessage = function(event) {
     is(event.target, worker);
-    var args = eval(event.data);
+    var args = event.data;
     switch (args.type) {
       case "progress": {
         ok(parseInt(args.current) <= parseInt(args.total));
@@ -33,12 +35,17 @@ Tests of DOM Worker Threads XHR(Bug 450452 )
       case "error": {
         ok(false, "XHR error: " + args.error);
       } break;
+      case "upload.load": {
+        gotUploadLoad = true;
+      } break;
       case "load": {
-        is(args.data, "A noisy noise annoys an oyster.");
+        ok(gotUploadLoad, "Should have gotten upload load event");
+        gotLoadend = true;
+        is(args.data, "A noisy noise annoys an oyster.", "correct data");
         document.getElementById("content").textContent = args.data;
       } break;
       case "loadend": {
-        ok(true, "Should have got loadend.");
+        ok(gotLoadend, "Should have gotten load.");
         SimpleTest.finish();
         break;
       }
diff --git a/dom/workers/test/xhr_worker.js b/dom/workers/test/xhr_worker.js
index 4f53a522a9dc..5e3e74a3ec8c 100644
--- a/dom/workers/test/xhr_worker.js
+++ b/dom/workers/test/xhr_worker.js
@@ -12,12 +12,12 @@ function onload(event) {
   if (event.target.status != 200) {
     var message = { type: "error",
                     error: event.target.status };
-    postMessage(message.toSource());
+    postMessage(message);
   }
 
   var message = { type: "load",
                   data: xhr.responseText };
-  postMessage(message.toSource());
+  postMessage(message);
 }
 
 xhr.onload = onload;
@@ -26,7 +26,7 @@ xhr.removeEventListener("load", onload, false);
 if (!xhr.onload) {
   var message = { type: "error",
                   error: "Lost message listener!" };
-  postMessage(message.toSource());
+  postMessage(message);
 }
 
 xhr.addEventListener("error", function(event) {
@@ -35,7 +35,7 @@ xhr.addEventListener("error", function(event) {
   }
   var message = { type: "error",
                   error: event.target.status };
-  postMessage(message.toSource());
+  postMessage(message);
 }, false);
 
 function onprogress(event) {
@@ -45,7 +45,7 @@ function onprogress(event) {
   var message = { type: "progress",
                   current: event.loaded,
                   total: event.total };
-  postMessage(message.toSource());
+  postMessage(message);
 }
 xhr.addEventListener("progress", onprogress, false);
 
@@ -54,15 +54,19 @@ xhr.removeEventListener("doopety", function(event) {}, false);
 
 xhr.onloadend = function(event) {
   var message = { type: "loadend" };
-  postMessage(message.toSource());  
+  postMessage(message);  
 }
 
 var upload = xhr.upload;
 upload.onprogress = function(event) { };
-upload.addEventListener("readystatechange", function(event) { }, false);
-upload.removeEventListener("readystatechange", function(event) { }, false);
+upload.addEventListener("foo", function(event) { }, false);
+upload.removeEventListener("foo", function(event) { }, false);
 upload.addEventListener("load", function(event) { }, false);
-upload.removeEventListener("readystatechange", function(event) { }, false);
+upload.removeEventListener("foo", function(event) { }, false);
+upload.onload = function(event) {
+  var message = { type: "upload.load" };
+  postMessage(message);
+}
 
 onmessage = function(event) {
   if (xhr.DONE != 4 || XMLHttpRequest.DONE != 4) {
@@ -71,6 +75,6 @@ onmessage = function(event) {
   if (xhr.readystate > xhr.UNSENT) {
     throw "XHR already running!";
   }
-  xhr.open("GET", event.data);
-  xhr.send(null);
+  xhr.open("POST", event.data);
+  xhr.send("Data to send");
 }
diff --git a/editor/composer/src/nsEditingSession.cpp b/editor/composer/src/nsEditingSession.cpp
index 4ca5aca5b57c..88a67050b635 100644
--- a/editor/composer/src/nsEditingSession.cpp
+++ b/editor/composer/src/nsEditingSession.cpp
@@ -837,7 +837,8 @@ nsEditingSession::OnProgressChange(nsIWebProgress *aWebProgress,
 ----------------------------------------------------------------------------*/
 NS_IMETHODIMP
 nsEditingSession::OnLocationChange(nsIWebProgress *aWebProgress, 
-                                   nsIRequest *aRequest, nsIURI *aURI)
+                                   nsIRequest *aRequest, nsIURI *aURI,
+                                   PRUint32 aFlags)
 {
   nsCOMPtr<nsIDOMWindow> domWindow;
   nsresult rv = aWebProgress->GetDOMWindow(getter_AddRefs(domWindow));
diff --git a/editor/composer/test/test_bug434998.xul b/editor/composer/test/test_bug434998.xul
index 3a5f50faa778..bf2ac8db9fd6 100644
--- a/editor/composer/test/test_bug434998.xul
+++ b/editor/composer/test/test_bug434998.xul
@@ -78,7 +78,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=434998
     {
     },
 
-    onLocationChange : function(aWebProgress, aRequest, aLocation)
+    onLocationChange : function(aWebProgress, aRequest, aLocation, aFlags)
     {
     },
 
diff --git a/editor/libeditor/html/tests/test_bug607584.xul b/editor/libeditor/html/tests/test_bug607584.xul
index a5f1527932c8..dec88720550d 100644
--- a/editor/libeditor/html/tests/test_bug607584.xul
+++ b/editor/libeditor/html/tests/test_bug607584.xul
@@ -83,7 +83,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=607584
       {
       },
   
-    onLocationChange : function(aWebProgress, aRequest, aLocation)
+    onLocationChange : function(aWebProgress, aRequest, aLocation, aFlags)
       {
       },
   
diff --git a/editor/libeditor/html/tests/test_bug616590.xul b/editor/libeditor/html/tests/test_bug616590.xul
index 51bbf33bf82b..edf0fd76ab52 100644
--- a/editor/libeditor/html/tests/test_bug616590.xul
+++ b/editor/libeditor/html/tests/test_bug616590.xul
@@ -73,7 +73,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=616590
     {
     },
 
-    onLocationChange : function(aWebProgress, aRequest, aLocation)
+    onLocationChange : function(aWebProgress, aRequest, aLocation, aFlags)
     {
     },
 
diff --git a/embedding/Makefile.in b/embedding/Makefile.in
index 7e289dfb829c..d1329b2a1069 100644
--- a/embedding/Makefile.in
+++ b/embedding/Makefile.in
@@ -53,7 +53,7 @@ XPCSHELL_TESTS = tests/unit
 DIRS += test
 endif
 
-ifeq ($(OS_TARGET),Android)
+ifeq ($(MOZ_WIDGET_TOOLKIT),android)
 DIRS += android
 endif
 
diff --git a/embedding/android/GeckoApp.java b/embedding/android/GeckoApp.java
index 3945e6ad28de..c6254c7c92e8 100644
--- a/embedding/android/GeckoApp.java
+++ b/embedding/android/GeckoApp.java
@@ -358,7 +358,9 @@ abstract public class GeckoApp
                     } catch (Exception e) {
                         Log.e(LOG_FILE_NAME, "top level exception", e);
                         StringWriter sw = new StringWriter();
-                        e.printStackTrace(new PrintWriter(sw));
+                        PrintWriter pw = new PrintWriter(sw);
+                        e.printStackTrace(pw);
+                        pw.flush();
                         GeckoAppShell.reportJavaCrash(sw.toString());
                     }
                     // resetting this is kinda pointless, but oh well
diff --git a/embedding/android/GeckoAppShell.java b/embedding/android/GeckoAppShell.java
index 2c3d2f6f56ba..d5369c233fbf 100644
--- a/embedding/android/GeckoAppShell.java
+++ b/embedding/android/GeckoAppShell.java
@@ -62,6 +62,8 @@ import android.webkit.MimeTypeMap;
 import android.media.MediaScannerConnection;
 import android.media.MediaScannerConnection.MediaScannerConnectionClient;
 import android.provider.Settings;
+import android.view.accessibility.AccessibilityManager;
+import android.view.accessibility.AccessibilityEvent;
 
 import android.util.*;
 import android.net.Uri;
@@ -114,7 +116,7 @@ public class GeckoAppShell
 
     public static native void processNextNativeEvent();
 
-    public static native void notifyBatteryChange(float aLevel, boolean aCharging);
+    public static native void notifyBatteryChange(double aLevel, boolean aCharging, double aRemainingTime);
 
     // A looper thread, accessed by GeckoAppShell.getHandler
     private static class LooperThread extends Thread {
@@ -411,8 +413,6 @@ public class GeckoAppShell
         GeckoAppShell.nativeRun(combinedArgs);
     }
 
-    private static GeckoEvent mLastDrawEvent;
-
     private static void sendPendingEventsToGecko() {
         try {
             while (!gPendingEvents.isEmpty()) {
@@ -1359,6 +1359,13 @@ public class GeckoAppShell
             return true;
         }
     }
+
+    public static boolean getAccessibilityEnabled() {
+        AccessibilityManager accessibilityManager =
+            (AccessibilityManager) GeckoApp.mAppContext.getSystemService(Context.ACCESSIBILITY_SERVICE);
+        return accessibilityManager.isEnabled();
+    }
+
     public static void addPluginView(final View view,
                                      final double x, final double y,
                                      final double w, final double h) {
@@ -1620,6 +1627,16 @@ public class GeckoAppShell
         }
     }
 
+    // unused
+    public static String handleGeckoMessage(String message) {
+        return "";
+    }
+    // unused
+    static void checkUriVisited(String uri) {}
+    // unused
+    static void markUriVisited(final String uri) {}
+
+
     public static void enableBatteryNotifications() {
         GeckoBatteryManager.enableNotifications();
     }
@@ -1628,7 +1645,7 @@ public class GeckoAppShell
         GeckoBatteryManager.disableNotifications();
     }
 
-    public static float[] getCurrentBatteryInformation() {
+    public static double[] getCurrentBatteryInformation() {
         return GeckoBatteryManager.getCurrentInformation();
     }
 }
diff --git a/embedding/android/GeckoBatteryManager.java b/embedding/android/GeckoBatteryManager.java
index 5f9eeba602d5..974f6b0534b5 100644
--- a/embedding/android/GeckoBatteryManager.java
+++ b/embedding/android/GeckoBatteryManager.java
@@ -38,6 +38,7 @@
 package org.mozilla.gecko;
 
 import java.lang.Math;
+import java.util.Date;
 
 import android.util.Log;
 
@@ -50,13 +51,17 @@ import android.os.BatteryManager;
 public class GeckoBatteryManager
   extends BroadcastReceiver
 {
-  private final static float   kDefaultLevel       = 1.0f;
-  private final static boolean kDefaultCharging    = true;
-  private final static float   kMinimumLevelChange = 0.01f;
+  // Those constants should be keep in sync with the ones in:
+  // dom/battery/Constants.h
+  private final static double  kDefaultLevel         = 1.0;
+  private final static boolean kDefaultCharging      = true;
+  private final static double  kUnknownRemainingTime = -1.0;
 
-  private static boolean sNotificationsEnabled     = false;
-  private static float   sLevel                    = kDefaultLevel;
-  private static boolean sCharging                 = kDefaultCharging;
+  private static Date    sLastLevelChange            = new Date(0);
+  private static boolean sNotificationsEnabled       = false;
+  private static double  sLevel                      = kDefaultLevel;
+  private static boolean sCharging                   = kDefaultCharging;
+  private static double  sRemainingTime              = kUnknownRemainingTime;;
 
   @Override
   public void onReceive(Context context, Intent intent) {
@@ -66,7 +71,7 @@ public class GeckoBatteryManager
     }
 
     boolean previousCharging = isCharging();
-    float previousLevel = getLevel();
+    double previousLevel = getLevel();
 
     if (intent.getBooleanExtra(BatteryManager.EXTRA_PRESENT, false)) {
       int plugged = intent.getIntExtra(BatteryManager.EXTRA_PLUGGED, -1);
@@ -79,31 +84,74 @@ public class GeckoBatteryManager
         sCharging = plugged != 0;
       }
 
-      // We need two floats because sLevel is a float.
-      float current =  (float)intent.getIntExtra(BatteryManager.EXTRA_LEVEL, -1);
-      float max = (float)intent.getIntExtra(BatteryManager.EXTRA_SCALE, -1);
+      if (sCharging != previousCharging) {
+        sRemainingTime = kUnknownRemainingTime;
+        // The new remaining time is going to take some time to show up but
+        // it's the best way to show a not too wrong value.
+        sLastLevelChange = new Date(0);
+      }
+
+      // We need two doubles because sLevel is a double.
+      double current =  (double)intent.getIntExtra(BatteryManager.EXTRA_LEVEL, -1);
+      double max = (double)intent.getIntExtra(BatteryManager.EXTRA_SCALE, -1);
       if (current == -1 || max == -1) {
         Log.e("GeckoBatteryManager", "Failed to get battery level!");
         sLevel = kDefaultLevel;
       } else {
         sLevel = current / max;
       }
+
+      if (sLevel == 1.0 && sCharging) {
+        sRemainingTime = 0.0;
+      } else if (sLevel != previousLevel) {
+        // Estimate remaining time.
+        if (sLastLevelChange.getTime() != 0) {
+          Date currentTime = new Date();
+          long dt = (currentTime.getTime() - sLastLevelChange.getTime()) / 1000;
+          double dLevel = sLevel - previousLevel;
+
+          if (sCharging) {
+            if (dLevel < 0) {
+              Log.w("GeckoBatteryManager", "When charging, level should increase!");
+              sRemainingTime = kUnknownRemainingTime;
+            } else {
+              sRemainingTime = Math.round(dt / dLevel * (1.0 - sLevel));
+            }
+          } else {
+            if (dLevel > 0) {
+              Log.w("GeckoBatteryManager", "When discharging, level should decrease!");
+              sRemainingTime = kUnknownRemainingTime;
+            } else {
+              sRemainingTime = Math.round(dt / -dLevel * sLevel);
+            }
+          }
+
+          sLastLevelChange = currentTime;
+        } else {
+          // That's the first time we got an update, we can't do anything.
+          sLastLevelChange = new Date();
+        }
+      }
     } else {
       sLevel = kDefaultLevel;
       sCharging = kDefaultCharging;
+      sRemainingTime = kUnknownRemainingTime;
     }
 
     /*
      * We want to inform listeners if the following conditions are fulfilled:
      *  - we have at least one observer;
-     *  - the charging state has changed
-     *    OR
-     *    the level has changed of at least kMinimumLevelChange
+     *  - the charging state or the level has changed.
+     *
+     * Note: no need to check for a remaining time change given that it's only
+     * updated if there is a level change or a charging change.
+     *
+     * The idea is to prevent doing all the way to the DOM code in the child
+     * process to finally not send an event.
      */
     if (sNotificationsEnabled &&
-        (previousCharging != isCharging() ||
-         Math.abs(previousLevel - getLevel()) >= kMinimumLevelChange)) {
-      GeckoAppShell.notifyBatteryChange(sLevel, sCharging);
+        (previousCharging != isCharging() || previousLevel != getLevel())) {
+      GeckoAppShell.notifyBatteryChange(getLevel(), isCharging(), getRemainingTime());
     }
   }
 
@@ -111,10 +159,14 @@ public class GeckoBatteryManager
     return sCharging;
   }
 
-  public static float getLevel() {
+  public static double getLevel() {
     return sLevel;
   }
 
+  public static double getRemainingTime() {
+    return sRemainingTime;
+  }
+
   public static void enableNotifications() {
     sNotificationsEnabled = true;
   }
@@ -123,7 +175,7 @@ public class GeckoBatteryManager
     sNotificationsEnabled = false;
   }
 
-  public static float[] getCurrentInformation() {
-    return new float[] { getLevel(), isCharging() ? 1.0f : 0.0f };
+  public static double[] getCurrentInformation() {
+    return new double[] { getLevel(), isCharging() ? 1.0 : 0.0, getRemainingTime() };
   }
 }
diff --git a/embedding/android/GeckoEvent.java b/embedding/android/GeckoEvent.java
index 7985f2a02526..c164f019e9f7 100644
--- a/embedding/android/GeckoEvent.java
+++ b/embedding/android/GeckoEvent.java
@@ -73,6 +73,8 @@ public class GeckoEvent {
     public static final int SURFACE_DESTROYED = 14;
     public static final int GECKO_EVENT_SYNC = 15;
     public static final int ACTIVITY_START = 17;
+    public static final int SAVE_STATE = 18;
+    public static final int BROADCAST = 19;
 
     public static final int IME_COMPOSITION_END = 0;
     public static final int IME_COMPOSITION_BEGIN = 1;
@@ -104,7 +106,7 @@ public class GeckoEvent {
     public int mMetaState, mFlags;
     public int mKeyCode, mUnicodeChar;
     public int mOffset, mCount;
-    public String mCharacters;
+    public String mCharacters, mCharactersExtra;
     public int mRangeType, mRangeStyles;
     public int mRangeForeColor, mRangeBackColor;
     public Location mLocation;
@@ -223,6 +225,12 @@ public class GeckoEvent {
         mP1 = new Point(screenw, screenh);
     }
 
+    public GeckoEvent(String subject, String data) {
+        mType = BROADCAST;
+        mCharacters = subject;
+        mCharactersExtra = data;
+    }
+
     public GeckoEvent(String uri) {
         mType = LOAD_URI;
         mCharacters = uri;
diff --git a/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp b/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
index 83194ce3983d..f99bf4f7fe47 100644
--- a/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
+++ b/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
@@ -723,7 +723,8 @@ nsDocShellTreeOwner::OnStateChange(nsIWebProgress* aProgress,
 NS_IMETHODIMP
 nsDocShellTreeOwner::OnLocationChange(nsIWebProgress* aWebProgress,
                                       nsIRequest* aRequest,
-                                      nsIURI* aURI)
+                                      nsIURI* aURI,
+                                      PRUint32 aFlags)
 {
     return NS_OK;
 }
diff --git a/embedding/browser/webBrowser/nsWebBrowser.cpp b/embedding/browser/webBrowser/nsWebBrowser.cpp
index ac2c84850349..87c4f3354edc 100644
--- a/embedding/browser/webBrowser/nsWebBrowser.cpp
+++ b/embedding/browser/webBrowser/nsWebBrowser.cpp
@@ -852,12 +852,12 @@ NS_IMETHODIMP nsWebBrowser::OnProgressChange(nsIWebProgress *aWebProgress, nsIRe
     return NS_OK;
 }
 
-/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location); */
-NS_IMETHODIMP nsWebBrowser::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location)
+/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location, in unsigned long aFlags); */
+NS_IMETHODIMP nsWebBrowser::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location, PRUint32 aFlags)
 {
     if (mProgressListener)
     {
-        return mProgressListener->OnLocationChange(aWebProgress, aRequest, location);
+        return mProgressListener->OnLocationChange(aWebProgress, aRequest, location, aFlags);
     }
     return NS_OK;
 }
diff --git a/embedding/components/printingui/src/mac/nsPrintProgress.cpp b/embedding/components/printingui/src/mac/nsPrintProgress.cpp
index c7c69c3544bb..7c07816ddcfe 100644
--- a/embedding/components/printingui/src/mac/nsPrintProgress.cpp
+++ b/embedding/components/printingui/src/mac/nsPrintProgress.cpp
@@ -257,8 +257,8 @@ NS_IMETHODIMP nsPrintProgress::OnProgressChange(nsIWebProgress *aWebProgress, ns
   return rv;
 }
 
-/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location); */
-NS_IMETHODIMP nsPrintProgress::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location)
+/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location, in unsigned long aFlags); */
+NS_IMETHODIMP nsPrintProgress::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location, PRUint32 aFlags)
 {
     return NS_OK;
 }
diff --git a/embedding/components/printingui/src/mac/nsPrintingPromptServiceX.mm b/embedding/components/printingui/src/mac/nsPrintingPromptServiceX.mm
index 0431c57721ee..b35aac6d53a6 100644
--- a/embedding/components/printingui/src/mac/nsPrintingPromptServiceX.mm
+++ b/embedding/components/printingui/src/mac/nsPrintingPromptServiceX.mm
@@ -136,9 +136,9 @@ nsPrintingPromptService::OnProgressChange(nsIWebProgress *aWebProgress, nsIReque
     return NS_OK;
 }
 
-/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location); */
+/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location, in unsigned long aFlags); */
 NS_IMETHODIMP 
-nsPrintingPromptService::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location)
+nsPrintingPromptService::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location, PRUint32 aFlags)
 {
     return NS_OK;
 }
diff --git a/embedding/components/printingui/src/os2/nsPrintProgress.cpp b/embedding/components/printingui/src/os2/nsPrintProgress.cpp
index 99a8429396ba..8586e442e05d 100644
--- a/embedding/components/printingui/src/os2/nsPrintProgress.cpp
+++ b/embedding/components/printingui/src/os2/nsPrintProgress.cpp
@@ -254,8 +254,8 @@ NS_IMETHODIMP nsPrintProgress::OnProgressChange(nsIWebProgress *aWebProgress, ns
   return rv;
 }
 
-/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location); */
-NS_IMETHODIMP nsPrintProgress::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location)
+/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location, in unsigned long aFlags); */
+NS_IMETHODIMP nsPrintProgress::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location, PRUint32 aFlags)
 {
     return NS_OK;
 }
diff --git a/embedding/components/printingui/src/os2/nsPrintingPromptService.cpp b/embedding/components/printingui/src/os2/nsPrintingPromptService.cpp
index 97b3981fd804..2fbc209abde7 100644
--- a/embedding/components/printingui/src/os2/nsPrintingPromptService.cpp
+++ b/embedding/components/printingui/src/os2/nsPrintingPromptService.cpp
@@ -289,12 +289,12 @@ nsPrintingPromptService::OnProgressChange(nsIWebProgress *aWebProgress, nsIReque
   return NS_OK;
 }
 
-/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location); */
+/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location, in unsigned long aFlags); */
 NS_IMETHODIMP 
-nsPrintingPromptService::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location)
+nsPrintingPromptService::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location, PRUint32 aFlags)
 {
   if (mWebProgressListener) {
-    return mWebProgressListener->OnLocationChange(aWebProgress, aRequest, location);
+    return mWebProgressListener->OnLocationChange(aWebProgress, aRequest, location, aFlags);
   }
   return NS_OK;
 }
diff --git a/embedding/components/printingui/src/unixshared/nsPrintProgress.cpp b/embedding/components/printingui/src/unixshared/nsPrintProgress.cpp
index ba52fa19ea1c..663eaa13ff89 100644
--- a/embedding/components/printingui/src/unixshared/nsPrintProgress.cpp
+++ b/embedding/components/printingui/src/unixshared/nsPrintProgress.cpp
@@ -257,8 +257,8 @@ NS_IMETHODIMP nsPrintProgress::OnProgressChange(nsIWebProgress *aWebProgress, ns
   return rv;
 }
 
-/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location); */
-NS_IMETHODIMP nsPrintProgress::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location)
+/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location, in unsigned long aFlags); */
+NS_IMETHODIMP nsPrintProgress::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location, PRUint32 aFlags)
 {
     return NS_ERROR_NOT_IMPLEMENTED;
 }
diff --git a/embedding/components/printingui/src/unixshared/nsPrintingPromptService.cpp b/embedding/components/printingui/src/unixshared/nsPrintingPromptService.cpp
index 6185550ae2e1..d4a03849eac9 100644
--- a/embedding/components/printingui/src/unixshared/nsPrintingPromptService.cpp
+++ b/embedding/components/printingui/src/unixshared/nsPrintingPromptService.cpp
@@ -308,12 +308,12 @@ nsPrintingPromptService::OnProgressChange(nsIWebProgress *aWebProgress, nsIReque
   return NS_OK;
 }
 
-/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location); */
+/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location, in unsigned long aFlags); */
 NS_IMETHODIMP 
-nsPrintingPromptService::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location)
+nsPrintingPromptService::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location, PRUint32 aFlags)
 {
   if (mWebProgressListener) {
-    return mWebProgressListener->OnLocationChange(aWebProgress, aRequest, location);
+    return mWebProgressListener->OnLocationChange(aWebProgress, aRequest, location, aFlags);
   }
   return NS_OK;
 }
diff --git a/embedding/components/printingui/src/win/nsPrintProgress.cpp b/embedding/components/printingui/src/win/nsPrintProgress.cpp
index 9cde50826c75..786096c4098c 100644
--- a/embedding/components/printingui/src/win/nsPrintProgress.cpp
+++ b/embedding/components/printingui/src/win/nsPrintProgress.cpp
@@ -285,8 +285,8 @@ NS_IMETHODIMP nsPrintProgress::OnProgressChange(nsIWebProgress *aWebProgress, ns
   return rv;
 }
 
-/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location); */
-NS_IMETHODIMP nsPrintProgress::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location)
+/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location, in unsigned long aFlags); */
+NS_IMETHODIMP nsPrintProgress::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location, PRUint32 aFlags)
 {
     return NS_OK;
 }
diff --git a/embedding/components/printingui/src/win/nsPrintingPromptService.cpp b/embedding/components/printingui/src/win/nsPrintingPromptService.cpp
index f8432c003be1..e8344598d966 100644
--- a/embedding/components/printingui/src/win/nsPrintingPromptService.cpp
+++ b/embedding/components/printingui/src/win/nsPrintingPromptService.cpp
@@ -357,13 +357,13 @@ nsPrintingPromptService::OnProgressChange(nsIWebProgress *aWebProgress, nsIReque
   return NS_ERROR_FAILURE;
 }
 
-/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location); */
+/* void onLocationChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in nsIURI location, in unsigned long aFlags); */
 NS_IMETHODIMP 
-nsPrintingPromptService::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location)
+nsPrintingPromptService::OnLocationChange(nsIWebProgress *aWebProgress, nsIRequest *aRequest, nsIURI *location, PRUint32 aFlags)
 {
   if (mWebProgressListener) 
   {
-      return mWebProgressListener->OnLocationChange(aWebProgress, aRequest, location);
+      return mWebProgressListener->OnLocationChange(aWebProgress, aRequest, location, aFlags);
   }
   return NS_ERROR_FAILURE;
 }
diff --git a/embedding/tests/winEmbed/WebBrowserChrome.cpp b/embedding/tests/winEmbed/WebBrowserChrome.cpp
index eb3e9eb217db..e05692dcf9ed 100644
--- a/embedding/tests/winEmbed/WebBrowserChrome.cpp
+++ b/embedding/tests/winEmbed/WebBrowserChrome.cpp
@@ -276,7 +276,8 @@ NS_IMETHODIMP WebBrowserChrome::OnStateChange(nsIWebProgress *progress, nsIReque
 
 NS_IMETHODIMP WebBrowserChrome::OnLocationChange(nsIWebProgress* aWebProgress,
                                                  nsIRequest* aRequest,
-                                                 nsIURI *location)
+                                                 nsIURI *location,
+                                                 PRUint32 aFlags)
 {
   bool isSubFrameLoad = false; // Is this a subframe load
   if (aWebProgress) {
diff --git a/extensions/auth/nsAuthSSPI.cpp b/extensions/auth/nsAuthSSPI.cpp
index 27d5bc1d9892..dbc7c35c63aa 100644
--- a/extensions/auth/nsAuthSSPI.cpp
+++ b/extensions/auth/nsAuthSSPI.cpp
@@ -21,6 +21,7 @@
  * Contributor(s):
  *   Darin Fisher <darin@meer.net>
  *   Jim Mathies <jmathies@mozilla.com>
+ *   Guillermo Robla Vicario <groblavicario@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -52,6 +53,7 @@
 #include "nsIDNSRecord.h"
 #include "nsNetCID.h"
 #include "nsCOMPtr.h"
+#include "nsICryptoHash.h"
 
 #include <windows.h>
 
@@ -190,6 +192,8 @@ nsAuthSSPI::nsAuthSSPI(pType package)
     : mServiceFlags(REQ_DEFAULT)
     , mMaxTokenLen(0)
     , mPackage(package)
+    , mCertDERData(nsnull)
+    , mCertDERLength(0)
 {
     memset(&mCred, 0, sizeof(mCred));
     memset(&mCtxt, 0, sizeof(mCtxt));
@@ -212,6 +216,14 @@ nsAuthSSPI::~nsAuthSSPI()
 void
 nsAuthSSPI::Reset()
 {
+    mIsFirst = true;
+
+    if (mCertDERData){
+        nsMemory::Free(mCertDERData);
+        mCertDERData = nsnull;
+        mCertDERLength = 0;   
+    }
+
     if (mCtxt.dwLower || mCtxt.dwUpper) {
         (sspi->DeleteSecurityContext)(&mCtxt);
         memset(&mCtxt, 0, sizeof(mCtxt));
@@ -229,6 +241,10 @@ nsAuthSSPI::Init(const char *serviceName,
 {
     LOG(("  nsAuthSSPI::Init\n"));
 
+    mIsFirst = true;
+    mCertDERLength = 0;
+    mCertDERData = nsnull;
+
     // The caller must supply a service name to be used. (For why we now require
     // a service name for NTLM, see bug 487872.)
     NS_ENSURE_TRUE(serviceName && *serviceName, NS_ERROR_INVALID_ARG);
@@ -314,19 +330,32 @@ nsAuthSSPI::Init(const char *serviceName,
     return NS_OK;
 }
 
+// The arguments inToken and inTokenLen are used to pass in the server
+// certificate (when available) in the first call of the function. The
+// second time these arguments hold an input token. 
 NS_IMETHODIMP
 nsAuthSSPI::GetNextToken(const void *inToken,
                          PRUint32    inTokenLen,
                          void      **outToken,
                          PRUint32   *outTokenLen)
 {
+    // String for end-point bindings.
+    const char end_point[] = "tls-server-end-point:"; 
+    const int end_point_length = sizeof(end_point) - 1;
+    const int hash_size = 32;  // Size of a SHA256 hash.
+    const int cbt_size = hash_size + end_point_length;
+	
     SECURITY_STATUS rc;
     TimeStamp ignored;
 
     DWORD ctxAttr, ctxReq = 0;
     CtxtHandle *ctxIn;
     SecBufferDesc ibd, obd;
-    SecBuffer ib, ob;
+    // Optional second input buffer for the CBT (Channel Binding Token)
+    SecBuffer ib[2], ob;
+    // Pointer to the block of memory that stores the CBT
+    char* sspi_cbt = nsnull;
+    SEC_CHANNEL_BINDINGS pendpoint_binding;
 
     LOG(("entering nsAuthSSPI::GetNextToken()\n"));
 
@@ -341,26 +370,123 @@ nsAuthSSPI::GetNextToken(const void *inToken,
         ctxReq |= ISC_REQ_MUTUAL_AUTH;
 
     if (inToken) {
-        ib.BufferType = SECBUFFER_TOKEN;
-        ib.cbBuffer = inTokenLen;
-        ib.pvBuffer = (void *) inToken;
-        ibd.ulVersion = SECBUFFER_VERSION;
-        ibd.cBuffers = 1;
-        ibd.pBuffers = &ib;
-        ctxIn = &mCtxt;
-    }
-    else {
-        // If there is no input token, then we are starting a new
-        // authentication sequence.  If we have already initialized our
-        // security context, then we're in trouble because it means that the
-        // first sequence failed.  We need to bail or else we might end up in
-        // an infinite loop.
-        if (mCtxt.dwLower || mCtxt.dwUpper) {
+        if (mIsFirst) {
+            // First time if it comes with a token,
+            // the token represents the server certificate.
+            mIsFirst = false;
+            mCertDERLength = inTokenLen;
+            mCertDERData = nsMemory::Alloc(inTokenLen);
+            if (!mCertDERData)
+                return NS_ERROR_OUT_OF_MEMORY;
+            memcpy(mCertDERData, inToken, inTokenLen);
+
+            // We are starting a new authentication sequence.  
+            // If we have already initialized our
+            // security context, then we're in trouble because it means that the
+            // first sequence failed.  We need to bail or else we might end up in
+            // an infinite loop.
+            if (mCtxt.dwLower || mCtxt.dwUpper) {
+                LOG(("Cannot restart authentication sequence!"));
+                return NS_ERROR_UNEXPECTED;
+            }
+            ctxIn = nsnull;
+            // The certificate needs to be erased before being passed 
+            // to InitializeSecurityContextW().
+            inToken = nsnull;
+            inTokenLen = 0;
+        } else {
+            ibd.ulVersion = SECBUFFER_VERSION;
+            ibd.cBuffers = 0;
+            ibd.pBuffers = ib;
+            
+            // If we have stored a certificate, the Channel Binding Token
+            // needs to be generated and sent in the first input buffer.
+            if (mCertDERLength > 0) {
+                // First we create a proper Endpoint Binding structure. 
+                pendpoint_binding.dwInitiatorAddrType = 0;
+                pendpoint_binding.cbInitiatorLength = 0;
+                pendpoint_binding.dwInitiatorOffset = 0;
+                pendpoint_binding.dwAcceptorAddrType = 0;
+                pendpoint_binding.cbAcceptorLength = 0;
+                pendpoint_binding.dwAcceptorOffset = 0;
+                pendpoint_binding.cbApplicationDataLength = cbt_size;
+                pendpoint_binding.dwApplicationDataOffset = 
+                                            sizeof(SEC_CHANNEL_BINDINGS);
+
+                // Then add it to the array of sec buffers accordingly.
+                ib[ibd.cBuffers].BufferType = SECBUFFER_CHANNEL_BINDINGS;
+                ib[ibd.cBuffers].cbBuffer =
+                        pendpoint_binding.cbApplicationDataLength
+                        + pendpoint_binding.dwApplicationDataOffset;
+          
+                sspi_cbt = (char *) nsMemory::Alloc(ib[ibd.cBuffers].cbBuffer);
+                if (!sspi_cbt){
+                    return NS_ERROR_OUT_OF_MEMORY;
+                }
+
+                // Helper to write in the memory block that stores the CBT
+                char* sspi_cbt_ptr = sspi_cbt;
+          
+                ib[ibd.cBuffers].pvBuffer = sspi_cbt;
+                ibd.cBuffers++;
+
+                memcpy(sspi_cbt_ptr, &pendpoint_binding,
+                       pendpoint_binding.dwApplicationDataOffset);
+                sspi_cbt_ptr += pendpoint_binding.dwApplicationDataOffset;
+
+                memcpy(sspi_cbt_ptr, end_point, end_point_length);
+                sspi_cbt_ptr += end_point_length;
+          
+                // Start hashing. We are always doing SHA256, but depending
+                // on the certificate, a different alogirthm might be needed.
+                nsCAutoString hashString;
+
+                nsresult rv;
+                nsCOMPtr<nsICryptoHash> crypto;
+                crypto = do_CreateInstance(NS_CRYPTO_HASH_CONTRACTID, &rv);
+                if (NS_SUCCEEDED(rv))
+                    rv = crypto->Init(nsICryptoHash::SHA256);
+                if (NS_SUCCEEDED(rv))
+                    rv = crypto->Update((unsigned char*)mCertDERData, mCertDERLength);
+                if (NS_SUCCEEDED(rv))
+                    rv = crypto->Finish(false, hashString);
+                if (NS_FAILED(rv)) {
+                    nsMemory::Free(mCertDERData);
+                    mCertDERData = nsnull;
+                    mCertDERLength = 0;
+                    nsMemory::Free(sspi_cbt);
+                    return rv;
+                }
+          
+                // Once the hash has been computed, we store it in memory right
+                // after the Endpoint structure and the "tls-server-end-point:"
+                // char array.
+                memcpy(sspi_cbt_ptr, hashString.get(), hash_size);
+          
+                // Free memory used to store the server certificate
+                nsMemory::Free(mCertDERData);
+                mCertDERData = nsnull;
+                mCertDERLength = 0;
+            } // End of CBT computation.
+
+            // We always need this SECBUFFER.
+            ib[ibd.cBuffers].BufferType = SECBUFFER_TOKEN;
+            ib[ibd.cBuffers].cbBuffer = inTokenLen;
+            ib[ibd.cBuffers].pvBuffer = (void *) inToken;
+            ibd.cBuffers++;
+            ctxIn = &mCtxt;
+        }
+    } else { // First time and without a token (no server certificate)
+        // We are starting a new authentication sequence.  If we have already 
+        // initialized our security context, then we're in trouble because it 
+        // means that the first sequence failed.  We need to bail or else we 
+        // might end up in an infinite loop.
+        if (mCtxt.dwLower || mCtxt.dwUpper || mCertDERData || mCertDERLength) {
             LOG(("Cannot restart authentication sequence!"));
             return NS_ERROR_UNEXPECTED;
         }
-
         ctxIn = NULL;
+        mIsFirst = false;
     }
 
     obd.ulVersion = SECBUFFER_VERSION;
@@ -369,8 +495,11 @@ nsAuthSSPI::GetNextToken(const void *inToken,
     ob.BufferType = SECBUFFER_TOKEN;
     ob.cbBuffer = mMaxTokenLen;
     ob.pvBuffer = nsMemory::Alloc(ob.cbBuffer);
-    if (!ob.pvBuffer)
+    if (!ob.pvBuffer){
+        if (sspi_cbt)
+            nsMemory::Free(sspi_cbt);
         return NS_ERROR_OUT_OF_MEMORY;
+    }
     memset(ob.pvBuffer, 0, ob.cbBuffer);
 
     NS_ConvertUTF8toUTF16 wSN(mServiceName);
@@ -396,7 +525,9 @@ nsAuthSSPI::GetNextToken(const void *inToken,
         else
             LOG(("InitializeSecurityContext: continue.\n"));
 #endif
-
+        if (sspi_cbt)
+            nsMemory::Free(sspi_cbt);
+            
         if (!ob.cbBuffer) {
             nsMemory::Free(ob.pvBuffer);
             ob.pvBuffer = NULL;
diff --git a/extensions/auth/nsAuthSSPI.h b/extensions/auth/nsAuthSSPI.h
index c4050fe9834a..e466717a733b 100644
--- a/extensions/auth/nsAuthSSPI.h
+++ b/extensions/auth/nsAuthSSPI.h
@@ -20,6 +20,7 @@
  *
  * Contributor(s):
  *   Darin Fisher <darin@meer.net>
+ *   Guillermo Robla Vicario <groblavicario@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -81,6 +82,9 @@ private:
     nsString     mDomain;
     nsString     mUsername;
     nsString     mPassword;
+    bool         mIsFirst;	
+    void*        mCertDERData; 
+    PRUint32     mCertDERLength;
 };
 
 #endif /* nsAuthSSPI_h__ */
diff --git a/extensions/spellcheck/tests/chrome/test_add_remove_dictionaries.xul b/extensions/spellcheck/tests/chrome/test_add_remove_dictionaries.xul
index 8299c2a93134..b197ecafed8b 100644
--- a/extensions/spellcheck/tests/chrome/test_add_remove_dictionaries.xul
+++ b/extensions/spellcheck/tests/chrome/test_add_remove_dictionaries.xul
@@ -12,6 +12,7 @@
   <script type="application/javascript">
   <![CDATA[
 SimpleTest.waitForExplicitFinish();
+SimpleTest.ignoreAllUncaughtExceptions();
 
 function getMisspelledWords(editor) {
   return editor.selectionController.getSelection(Components.interfaces.nsISelectionController.SELECTION_SPELLCHECK).toString();
diff --git a/extensions/universalchardet/src/base/Makefile.in b/extensions/universalchardet/src/base/Makefile.in
index 8c7f9a1e3660..46d8e0e11afb 100644
--- a/extensions/universalchardet/src/base/Makefile.in
+++ b/extensions/universalchardet/src/base/Makefile.in
@@ -78,7 +78,5 @@ CPPSRCS = \
 
 FORCE_STATIC_LIB = 1
 LIBXUL_LIBRARY = 1
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
diff --git a/gfx/2d/BaseRect.h b/gfx/2d/BaseRect.h
index 9359f5a7f2f3..b9988f199cd0 100644
--- a/gfx/2d/BaseRect.h
+++ b/gfx/2d/BaseRect.h
@@ -308,6 +308,63 @@ struct BaseRect {
   T XMost() const { return x + width; }
   T YMost() const { return y + height; }
 
+  // Round the rectangle edges to integer coordinates, such that the rounded
+  // rectangle has the same set of pixel centers as the original rectangle.
+  // Edges at offset 0.5 round up.
+  // Suitable for most places where integral device coordinates
+  // are needed, but note that any translation should be applied first to
+  // avoid pixel rounding errors.
+  // Note that this is *not* rounding to nearest integer if the values are negative.
+  // They are always rounding as floor(n + 0.5).
+  // See https://bugzilla.mozilla.org/show_bug.cgi?id=410748#c14
+  // If you need similar method which is using NS_round(), you should create
+  // new |RoundAwayFromZero()| method.
+  void Round()
+  {
+    T x0 = static_cast<T>(floor(T(X()) + 0.5));
+    T y0 = static_cast<T>(floor(T(Y()) + 0.5));
+    T x1 = static_cast<T>(floor(T(XMost()) + 0.5));
+    T y1 = static_cast<T>(floor(T(YMost()) + 0.5));
+
+    x = x0;
+    y = y0;
+
+    width = x1 - x0;
+    height = y1 - y0;
+  }
+
+  // Snap the rectangle edges to integer coordinates, such that the
+  // original rectangle contains the resulting rectangle.
+  void RoundIn()
+  {
+    T x0 = static_cast<T>(ceil(T(X())));
+    T y0 = static_cast<T>(ceil(T(Y())));
+    T x1 = static_cast<T>(floor(T(XMost())));
+    T y1 = static_cast<T>(floor(T(YMost())));
+
+    x = x0;
+    y = y0;
+
+    width = x1 - x0;
+    height = y1 - y0;
+  }
+
+  // Snap the rectangle edges to integer coordinates, such that the
+  // resulting rectangle contains the original rectangle.
+  void RoundOut()
+  {
+    T x0 = static_cast<T>(floor(T(X())));
+    T y0 = static_cast<T>(floor(T(Y())));
+    T x1 = static_cast<T>(ceil(T(XMost())));
+    T y1 = static_cast<T>(ceil(T(YMost())));
+
+    x = x0;
+    y = y0;
+
+    width = x1 - x0;
+    height = y1 - y0;
+  }
+
   // Scale 'this' by aScale, converting coordinates to integers so that the result is
   // the smallest integer-coordinate rectangle containing the unrounded result.
   // Note: this can turn an empty rectangle into a non-empty rectangle
diff --git a/gfx/2d/Blur.cpp b/gfx/2d/Blur.cpp
new file mode 100644
index 000000000000..b03853a575d4
--- /dev/null
+++ b/gfx/2d/Blur.cpp
@@ -0,0 +1,526 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla gfx.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include <algorithm>
+#include <math.h>
+
+#include "CheckedInt.h"
+#include "mozilla/Util.h"
+
+#include "mozilla/gfx/Blur.h"
+
+#ifndef M_PI
+#define M_PI 3.14159265358979323846
+#endif
+
+using namespace std;
+
+namespace mozilla {
+namespace gfx {
+
+/**
+ * Box blur involves looking at one pixel, and setting its value to the average
+ * of its neighbouring pixels.
+ * @param aInput The input buffer.
+ * @param aOutput The output buffer.
+ * @param aLeftLobe The number of pixels to blend on the left.
+ * @param aRightLobe The number of pixels to blend on the right.
+ * @param aWidth The number of columns in the buffers.
+ * @param aRows The number of rows in the buffers.
+ * @param aSkipRect An area to skip blurring in.
+ * XXX shouldn't we pass stride in separately here?
+ */
+static void
+BoxBlurHorizontal(unsigned char* aInput,
+                  unsigned char* aOutput,
+                  int32_t aLeftLobe,
+                  int32_t aRightLobe,
+                  int32_t aWidth,
+                  int32_t aRows,
+                  const IntRect& aSkipRect)
+{
+    MOZ_ASSERT(aWidth > 0);
+
+    int32_t boxSize = aLeftLobe + aRightLobe + 1;
+    bool skipRectCoversWholeRow = 0 >= aSkipRect.x &&
+                                  aWidth <= aSkipRect.XMost();
+
+    for (int32_t y = 0; y < aRows; y++) {
+        // Check whether the skip rect intersects this row. If the skip
+        // rect covers the whole surface in this row, we can avoid
+        // this row entirely (and any others along the skip rect).
+        bool inSkipRectY = y >= aSkipRect.y &&
+                           y < aSkipRect.YMost();
+        if (inSkipRectY && skipRectCoversWholeRow) {
+            y = aSkipRect.YMost() - 1;
+            continue;
+        }
+
+        int32_t alphaSum = 0;
+        for (int32_t i = 0; i < boxSize; i++) {
+            int32_t pos = i - aLeftLobe;
+            // See assertion above; if aWidth is zero, then we would have no
+            // valid position to clamp to.
+            pos = max(pos, 0);
+            pos = min(pos, aWidth - 1);
+            alphaSum += aInput[aWidth * y + pos];
+        }
+        for (int32_t x = 0; x < aWidth; x++) {
+            // Check whether we are within the skip rect. If so, go
+            // to the next point outside the skip rect.
+            if (inSkipRectY && x >= aSkipRect.x &&
+                x < aSkipRect.XMost()) {
+                x = aSkipRect.XMost();
+                if (x >= aWidth)
+                    break;
+
+                // Recalculate the neighbouring alpha values for
+                // our new point on the surface.
+                alphaSum = 0;
+                for (int32_t i = 0; i < boxSize; i++) {
+                    int32_t pos = x + i - aLeftLobe;
+                    // See assertion above; if aWidth is zero, then we would have no
+                    // valid position to clamp to.
+                    pos = max(pos, 0);
+                    pos = min(pos, aWidth - 1);
+                    alphaSum += aInput[aWidth * y + pos];
+                }
+            }
+            int32_t tmp = x - aLeftLobe;
+            int32_t last = max(tmp, 0);
+            int32_t next = min(tmp + boxSize, aWidth - 1);
+
+            aOutput[aWidth * y + x] = alphaSum / boxSize;
+
+            alphaSum += aInput[aWidth * y + next] -
+                        aInput[aWidth * y + last];
+        }
+    }
+}
+
+/**
+ * Identical to BoxBlurHorizontal, except it blurs top and bottom instead of
+ * left and right.
+ * XXX shouldn't we pass stride in separately here?
+ */
+static void
+BoxBlurVertical(unsigned char* aInput,
+                unsigned char* aOutput,
+                int32_t aTopLobe,
+                int32_t aBottomLobe,
+                int32_t aWidth,
+                int32_t aRows,
+                const IntRect& aSkipRect)
+{
+    MOZ_ASSERT(aRows > 0);
+
+    int32_t boxSize = aTopLobe + aBottomLobe + 1;
+    bool skipRectCoversWholeColumn = 0 >= aSkipRect.y &&
+                                     aRows <= aSkipRect.YMost();
+
+    for (int32_t x = 0; x < aWidth; x++) {
+        bool inSkipRectX = x >= aSkipRect.x &&
+                           x < aSkipRect.XMost();
+        if (inSkipRectX && skipRectCoversWholeColumn) {
+            x = aSkipRect.XMost() - 1;
+            continue;
+        }
+
+        int32_t alphaSum = 0;
+        for (int32_t i = 0; i < boxSize; i++) {
+            int32_t pos = i - aTopLobe;
+            // See assertion above; if aRows is zero, then we would have no
+            // valid position to clamp to.
+            pos = max(pos, 0);
+            pos = min(pos, aRows - 1);
+            alphaSum += aInput[aWidth * pos + x];
+        }
+        for (int32_t y = 0; y < aRows; y++) {
+            if (inSkipRectX && y >= aSkipRect.y &&
+                y < aSkipRect.YMost()) {
+                y = aSkipRect.YMost();
+                if (y >= aRows)
+                    break;
+
+                alphaSum = 0;
+                for (int32_t i = 0; i < boxSize; i++) {
+                    int32_t pos = y + i - aTopLobe;
+                    // See assertion above; if aRows is zero, then we would have no
+                    // valid position to clamp to.
+                    pos = max(pos, 0);
+                    pos = min(pos, aRows - 1);
+                    alphaSum += aInput[aWidth * pos + x];
+                }
+            }
+            int32_t tmp = y - aTopLobe;
+            int32_t last = max(tmp, 0);
+            int32_t next = min(tmp + boxSize, aRows - 1);
+
+            aOutput[aWidth * y + x] = alphaSum/boxSize;
+
+            alphaSum += aInput[aWidth * next + x] -
+                        aInput[aWidth * last + x];
+        }
+    }
+}
+
+static void ComputeLobes(int32_t aRadius, int32_t aLobes[3][2])
+{
+    int32_t major, minor, final;
+
+    /* See http://www.w3.org/TR/SVG/filters.html#feGaussianBlur for
+     * some notes about approximating the Gaussian blur with box-blurs.
+     * The comments below are in the terminology of that page.
+     */
+    int32_t z = aRadius / 3;
+    switch (aRadius % 3) {
+    case 0:
+        // aRadius = z*3; choose d = 2*z + 1
+        major = minor = final = z;
+        break;
+    case 1:
+        // aRadius = z*3 + 1
+        // This is a tricky case since there is no value of d which will
+        // yield a radius of exactly aRadius. If d is odd, i.e. d=2*k + 1
+        // for some integer k, then the radius will be 3*k. If d is even,
+        // i.e. d=2*k, then the radius will be 3*k - 1.
+        // So we have to choose values that don't match the standard
+        // algorithm.
+        major = z + 1;
+        minor = final = z;
+        break;
+    case 2:
+        // aRadius = z*3 + 2; choose d = 2*z + 2
+        major = final = z + 1;
+        minor = z;
+        break;
+    default:
+        // Mathematical impossibility!
+        MOZ_ASSERT(false);
+        major = minor = final = 0;
+    }
+    MOZ_ASSERT(major + minor + final == aRadius);
+
+    aLobes[0][0] = major;
+    aLobes[0][1] = minor;
+    aLobes[1][0] = minor;
+    aLobes[1][1] = major;
+    aLobes[2][0] = final;
+    aLobes[2][1] = final;
+}
+
+static void
+SpreadHorizontal(unsigned char* aInput,
+                 unsigned char* aOutput,
+                 int32_t aRadius,
+                 int32_t aWidth,
+                 int32_t aRows,
+                 int32_t aStride,
+                 const IntRect& aSkipRect)
+{
+    if (aRadius == 0) {
+        memcpy(aOutput, aInput, aStride * aRows);
+        return;
+    }
+
+    bool skipRectCoversWholeRow = 0 >= aSkipRect.x &&
+                                    aWidth <= aSkipRect.XMost();
+    for (int32_t y = 0; y < aRows; y++) {
+        // Check whether the skip rect intersects this row. If the skip
+        // rect covers the whole surface in this row, we can avoid
+        // this row entirely (and any others along the skip rect).
+        bool inSkipRectY = y >= aSkipRect.y &&
+                             y < aSkipRect.YMost();
+        if (inSkipRectY && skipRectCoversWholeRow) {
+            y = aSkipRect.YMost() - 1;
+            continue;
+        }
+
+        for (int32_t x = 0; x < aWidth; x++) {
+            // Check whether we are within the skip rect. If so, go
+            // to the next point outside the skip rect.
+            if (inSkipRectY && x >= aSkipRect.x &&
+                x < aSkipRect.XMost()) {
+                x = aSkipRect.XMost();
+                if (x >= aWidth)
+                    break;
+            }
+
+            int32_t sMin = max(x - aRadius, 0);
+            int32_t sMax = min(x + aRadius, aWidth - 1);
+            int32_t v = 0;
+            for (int32_t s = sMin; s <= sMax; ++s) {
+                v = max<int32_t>(v, aInput[aStride * y + s]);
+            }
+            aOutput[aStride * y + x] = v;
+        }
+    }
+}
+
+static void
+SpreadVertical(unsigned char* aInput,
+               unsigned char* aOutput,
+               int32_t aRadius,
+               int32_t aWidth,
+               int32_t aRows,
+               int32_t aStride,
+               const IntRect& aSkipRect)
+{
+    if (aRadius == 0) {
+        memcpy(aOutput, aInput, aStride * aRows);
+        return;
+    }
+
+    bool skipRectCoversWholeColumn = 0 >= aSkipRect.y &&
+                                     aRows <= aSkipRect.YMost();
+    for (int32_t x = 0; x < aWidth; x++) {
+        bool inSkipRectX = x >= aSkipRect.x &&
+                           x < aSkipRect.XMost();
+        if (inSkipRectX && skipRectCoversWholeColumn) {
+            x = aSkipRect.XMost() - 1;
+            continue;
+        }
+
+        for (int32_t y = 0; y < aRows; y++) {
+            // Check whether we are within the skip rect. If so, go
+            // to the next point outside the skip rect.
+            if (inSkipRectX && y >= aSkipRect.y &&
+                y < aSkipRect.YMost()) {
+                y = aSkipRect.YMost();
+                if (y >= aRows)
+                    break;
+            }
+
+            int32_t sMin = max(y - aRadius, 0);
+            int32_t sMax = min(y + aRadius, aRows - 1);
+            int32_t v = 0;
+            for (int32_t s = sMin; s <= sMax; ++s) {
+                v = max<int32_t>(v, aInput[aStride * s + x]);
+            }
+            aOutput[aStride * y + x] = v;
+        }
+    }
+}
+
+static CheckedInt<int32_t>
+RoundUpToMultipleOf4(int32_t aVal)
+{
+  CheckedInt<int32_t> val(aVal);
+
+  val += 3;
+  val /= 4;
+  val *= 4;
+
+  return val;
+}
+
+AlphaBoxBlur::AlphaBoxBlur(const Rect& aRect,
+                           const IntSize& aSpreadRadius,
+                           const IntSize& aBlurRadius,
+                           const Rect* aDirtyRect,
+                           const Rect* aSkipRect)
+ : mSpreadRadius(aSpreadRadius),
+   mBlurRadius(aBlurRadius),
+   mData(NULL)
+{
+  Rect rect(aRect);
+  rect.Inflate(Size(aBlurRadius + aSpreadRadius));
+  rect.RoundOut();
+
+  if (aDirtyRect) {
+    // If we get passed a dirty rect from layout, we can minimize the
+    // shadow size and make painting faster.
+    mHasDirtyRect = true;
+    mDirtyRect = *aDirtyRect;
+    Rect requiredBlurArea = mDirtyRect.Intersect(rect);
+    requiredBlurArea.Inflate(Size(aBlurRadius + aSpreadRadius));
+    rect = requiredBlurArea.Intersect(rect);
+  } else {
+    mHasDirtyRect = false;
+  }
+
+  if (rect.IsEmpty()) {
+    return;
+  }
+
+  if (aSkipRect) {
+    // If we get passed a skip rect, we can lower the amount of
+    // blurring/spreading we need to do. We convert it to IntRect to avoid
+    // expensive int<->float conversions if we were to use Rect instead.
+    Rect skipRect = *aSkipRect;
+    skipRect.RoundIn();
+    skipRect.Deflate(Size(aBlurRadius + aSpreadRadius));
+    mSkipRect = IntRect(skipRect.x, skipRect.y, skipRect.width, skipRect.height);
+
+    IntRect shadowIntRect(rect.x, rect.y, rect.width, rect.height);
+    mSkipRect.IntersectRect(mSkipRect, shadowIntRect);
+
+    if (mSkipRect.IsEqualInterior(shadowIntRect))
+      return;
+
+    mSkipRect -= shadowIntRect.TopLeft();
+  } else {
+    mSkipRect = IntRect(0, 0, 0, 0);
+  }
+
+  mRect = IntRect(rect.x, rect.y, rect.width, rect.height);
+
+  CheckedInt<int32_t> stride = RoundUpToMultipleOf4(mRect.width);
+  if (stride.valid()) {
+    mStride = stride.value();
+
+    CheckedInt<int32_t> size = CheckedInt<int32_t>(mStride) * mRect.height *
+                               sizeof(unsigned char);
+    if (size.valid()) {
+      mData = static_cast<unsigned char*>(malloc(size.value()));
+      memset(mData, 0, size.value());
+    }
+  }
+}
+
+AlphaBoxBlur::~AlphaBoxBlur()
+{
+  free(mData);
+}
+
+unsigned char*
+AlphaBoxBlur::GetData()
+{
+  return mData;
+}
+
+IntSize
+AlphaBoxBlur::GetSize()
+{
+  IntSize size(mRect.width, mRect.height);
+  return size;
+}
+
+int32_t
+AlphaBoxBlur::GetStride()
+{
+  return mStride;
+}
+
+IntRect
+AlphaBoxBlur::GetRect()
+{
+  return mRect;
+}
+
+Rect*
+AlphaBoxBlur::GetDirtyRect()
+{
+  if (mHasDirtyRect) {
+    return &mDirtyRect;
+  }
+
+  return NULL;
+}
+
+void
+AlphaBoxBlur::Blur()
+{
+  if (!mData) {
+    return;
+  }
+
+  // no need to do all this if not blurring or spreading
+  if (mBlurRadius != IntSize(0,0) || mSpreadRadius != IntSize(0,0)) {
+    int32_t stride = GetStride();
+
+    // No need to use CheckedInt here - we have validated it in the constructor.
+    size_t szB = stride * GetSize().height * sizeof(unsigned char);
+    unsigned char* tmpData = static_cast<unsigned char*>(malloc(szB));
+    if (!tmpData)
+      return; // OOM
+
+    memset(tmpData, 0, szB);
+
+    if (mSpreadRadius.width > 0 || mSpreadRadius.height > 0) {
+      SpreadHorizontal(mData, tmpData, mSpreadRadius.width, GetSize().width, GetSize().height, stride, mSkipRect);
+      SpreadVertical(tmpData, mData, mSpreadRadius.height, GetSize().width, GetSize().height, stride, mSkipRect);
+    }
+
+    if (mBlurRadius.width > 0) {
+      int32_t lobes[3][2];
+      ComputeLobes(mBlurRadius.width, lobes);
+      BoxBlurHorizontal(mData, tmpData, lobes[0][0], lobes[0][1], stride, GetSize().height, mSkipRect);
+      BoxBlurHorizontal(tmpData, mData, lobes[1][0], lobes[1][1], stride, GetSize().height, mSkipRect);
+      BoxBlurHorizontal(mData, tmpData, lobes[2][0], lobes[2][1], stride, GetSize().height, mSkipRect);
+    } else {
+      memcpy(tmpData, mData, stride * GetSize().height);
+    }
+
+    if (mBlurRadius.height > 0) {
+      int32_t lobes[3][2];
+      ComputeLobes(mBlurRadius.height, lobes);
+      BoxBlurVertical(tmpData, mData, lobes[0][0], lobes[0][1], stride, GetSize().height, mSkipRect);
+      BoxBlurVertical(mData, tmpData, lobes[1][0], lobes[1][1], stride, GetSize().height, mSkipRect);
+      BoxBlurVertical(tmpData, mData, lobes[2][0], lobes[2][1], stride, GetSize().height, mSkipRect);
+    } else {
+      memcpy(mData, tmpData, stride * GetSize().height);
+    }
+
+    free(tmpData);
+  }
+
+}
+
+/**
+ * Compute the box blur size (which we're calling the blur radius) from
+ * the standard deviation.
+ *
+ * Much of this, the 3 * sqrt(2 * pi) / 4, is the known value for
+ * approximating a Gaussian using box blurs.  This yields quite a good
+ * approximation for a Gaussian.  Then we multiply this by 1.5 since our
+ * code wants the radius of the entire triple-box-blur kernel instead of
+ * the diameter of an individual box blur.  For more details, see:
+ *   http://www.w3.org/TR/SVG11/filters.html#feGaussianBlurElement
+ *   https://bugzilla.mozilla.org/show_bug.cgi?id=590039#c19
+ */
+static const Float GAUSSIAN_SCALE_FACTOR = (3 * sqrt(2 * M_PI) / 4) * 1.5;
+
+IntSize
+AlphaBoxBlur::CalculateBlurRadius(const Point& aStd)
+{
+    IntSize size(static_cast<int32_t>(floor(aStd.x * GAUSSIAN_SCALE_FACTOR + 0.5)),
+                 static_cast<int32_t>(floor(aStd.y * GAUSSIAN_SCALE_FACTOR + 0.5)));
+
+    return size;
+}
+
+}
+}
diff --git a/gfx/2d/Blur.h b/gfx/2d/Blur.h
new file mode 100644
index 000000000000..4220ea60b6c3
--- /dev/null
+++ b/gfx/2d/Blur.h
@@ -0,0 +1,180 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla gfx.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "mozilla/gfx/Rect.h"
+#include "mozilla/gfx/Point.h"
+
+namespace mozilla {
+namespace gfx {
+
+/**
+ * Implementation of a triple box blur approximation of a Gaussian blur.
+ *
+ * A Gaussian blur is good for blurring because, when done independently
+ * in the horizontal and vertical directions, it matches the result that
+ * would be obtained using a different (rotated) set of axes.  A triple
+ * box blur is a very close approximation of a Gaussian.
+ *
+ * Creates an 8-bit alpha channel context for callers to draw in,
+ * spreads the contents of that context, and blurs the contents.
+ *
+ * A spread N makes each output pixel the maximum value of all source
+ * pixels within a square of side length 2N+1 centered on the output pixel.
+ *
+ * A temporary surface is created in the Init function. The caller then draws
+ * any desired content onto the context acquired through GetContext, and lastly
+ * calls Paint to apply the blurred content as an alpha mask.
+ */
+class AlphaBoxBlur
+{
+public:
+
+  /** Constructs a box blur and initializes the backing surface.
+   *
+   * @param aRect The coordinates of the surface to create in device units.
+   *
+   * @param aBlurRadius The blur radius in pixels.  This is the radius of the
+   *   entire (triple) kernel function.  Each individual box blur has radius
+   *   approximately 1/3 this value, or diameter approximately 2/3 this value.
+   *   This parameter should nearly always be computed using CalculateBlurRadius,
+   *   below.
+   *
+   * @param aDirtyRect A pointer to a dirty rect, measured in device units, if
+   *   available.  This will be used for optimizing the blur operation. It is
+   *   safe to pass NULL here.
+   *
+   * @param aSkipRect A pointer to a rect, measured in device units, that
+   *   represents an area where blurring is unnecessary and shouldn't be done for
+   *   speed reasons. It is safe to pass NULL here.
+   */
+  AlphaBoxBlur(const Rect& aRect,
+               const IntSize& aSpreadRadius,
+               const IntSize& aBlurRadius,
+               const Rect* aDirtyRect,
+               const Rect* aSkipRect);
+
+  ~AlphaBoxBlur();
+
+  /**
+   * Return the pointer to memory allocated by the constructor for the 8-bit
+   * alpha surface you need to be blurred. After you draw to this surface, call
+   * Blur(), below, to have its contents blurred.
+   */
+  unsigned char* GetData();
+
+  /**
+   * Return the size, in pixels, of the 8-bit alpha surface backed by the
+   * pointer returned by GetData().
+   */
+  IntSize GetSize();
+
+  /**
+   * Return the stride, in bytes, of the 8-bit alpha surface backed by the
+   * pointer returned by GetData().
+   */
+  int32_t GetStride();
+
+  /**
+   * Returns the device-space rectangle the 8-bit alpha surface covers.
+   */
+  IntRect GetRect();
+
+  /**
+   * Return a pointer to a dirty rect, as passed in to the constructor, or NULL
+   * if none was passed in.
+   */
+  Rect* GetDirtyRect();
+
+  /**
+   * Perform the blur in-place on the surface backed by the pointer returned by
+   * GetData().
+   */
+  void Blur();
+
+  /**
+   * Calculates a blur radius that, when used with box blur, approximates a
+   * Gaussian blur with the given standard deviation.  The result of this
+   * function should be used as the aBlurRadius parameter to AlphaBoxBlur's
+   * constructor, above.
+   */
+  static IntSize CalculateBlurRadius(const Point& aStandardDeviation);
+
+private:
+
+  /**
+   * A rect indicating the area where blurring is unnecessary, and the blur
+   * algorithm should skip over it.
+   */
+  IntRect mSkipRect;
+
+  /**
+   * The device-space rectangle the the backing 8-bit alpha surface covers.
+   */
+  IntRect mRect;
+
+  /**
+   * A copy of the dirty rect passed to the constructor. This will only be valid if
+   * mHasDirtyRect is true.
+   */
+  Rect mDirtyRect;
+
+  /**
+   * The spread radius, in pixels.
+   */
+  IntSize mSpreadRadius;
+
+  /**
+   * The blur radius, in pixels.
+   */
+  IntSize mBlurRadius;
+
+  /**
+   * A pointer to the backing 8-bit alpha surface.
+   */
+  unsigned char* mData;
+
+  /**
+   * The stride of the data contained in mData.
+   */
+  int32_t mStride;
+
+  /**
+   * Whether mDirtyRect contains valid data.
+   */
+  bool mHasDirtyRect;
+};
+
+}
+}
diff --git a/gfx/2d/Makefile.in b/gfx/2d/Makefile.in
index 0c576474a67b..5f4fcf5f483f 100644
--- a/gfx/2d/Makefile.in
+++ b/gfx/2d/Makefile.in
@@ -56,6 +56,7 @@ EXPORTS_mozilla/gfx	= \
         BaseMargin.h \
         BaseRect.h \
         BaseSize.h \
+        Blur.h \
         PathHelpers.h \
         Point.h \
         Matrix.h \
@@ -68,6 +69,7 @@ CPPSRCS	= \
         Matrix.cpp \
         DrawTargetCairo.cpp \
         SourceSurfaceCairo.cpp \
+        Blur.cpp \
         $(NULL)
 
 
diff --git a/gfx/2d/Point.h b/gfx/2d/Point.h
index 2d8913635c06..fabed9dd71a4 100644
--- a/gfx/2d/Point.h
+++ b/gfx/2d/Point.h
@@ -45,26 +45,21 @@
 namespace mozilla {
 namespace gfx {
 
-struct Point :
-  public BasePoint<Float, Point> {
-  typedef BasePoint<Float, Point> Super;
-  Point() : Super() {}
-  Point(Float aX, Float aY) : Super(aX, aY) {}
-};
-
 struct IntPoint :
-  public BasePoint<int32_t, Point> {
-  typedef BasePoint<int32_t, Point> Super;
+  public BasePoint<int32_t, IntPoint> {
+  typedef BasePoint<int32_t, IntPoint> Super;
+
   IntPoint() : Super() {}
   IntPoint(int32_t aX, int32_t aY) : Super(aX, aY) {}
 };
 
-struct Size :
-  public BaseSize<Float, Size> {
-  typedef BaseSize<Float, Size> Super;
+struct Point :
+  public BasePoint<Float, Point> {
+  typedef BasePoint<Float, Point> Super;
 
-  Size() : Super() {}
-  Size(Float aWidth, Float aHeight) : Super(aWidth, aHeight) {}
+  Point() : Super() {}
+  Point(Float aX, Float aY) : Super(aX, aY) {}
+  Point(const IntPoint& point) : Super(point.x, point.y) {}
 };
 
 struct IntSize :
@@ -75,6 +70,15 @@ struct IntSize :
   IntSize(int32_t aWidth, int32_t aHeight) : Super(aWidth, aHeight) {}
 };
 
+struct Size :
+  public BaseSize<Float, Size> {
+  typedef BaseSize<Float, Size> Super;
+
+  Size() : Super() {}
+  Size(Float aWidth, Float aHeight) : Super(aWidth, aHeight) {}
+  explicit Size(const IntSize& size) : Super(size.width, size.height) {}
+};
+
 }
 }
 
diff --git a/gfx/2d/Rect.h b/gfx/2d/Rect.h
index 3028c08995d8..8e31d95ade20 100644
--- a/gfx/2d/Rect.h
+++ b/gfx/2d/Rect.h
@@ -55,17 +55,6 @@ struct Margin :
     : Super(aLeft, aTop, aRight, aBottom) {}
 };
 
-struct Rect :
-    public BaseRect<Float, Rect, Point, Size, Margin> {
-    typedef BaseRect<Float, Rect, Point, mozilla::gfx::Size, Margin> Super;
-
-    Rect() : Super() {}
-    Rect(Point aPos, mozilla::gfx::Size aSize) :
-        Super(aPos, aSize) {}
-    Rect(Float _x, Float _y, Float _width, Float _height) :
-        Super(_x, _y, _width, _height) {}
-};
-
 struct IntRect :
     public BaseRect<int32_t, IntRect, IntPoint, IntSize, Margin> {
     typedef BaseRect<int32_t, IntRect, IntPoint, mozilla::gfx::IntSize, Margin> Super;
@@ -75,6 +64,24 @@ struct IntRect :
         Super(aPos, aSize) {}
     IntRect(int32_t _x, int32_t _y, int32_t _width, int32_t _height) :
         Super(_x, _y, _width, _height) {}
+
+    // Rounding isn't meaningful on an integer rectangle.
+    void Round() {}
+    void RoundIn() {}
+    void RoundOut() {}
+};
+
+struct Rect :
+    public BaseRect<Float, Rect, Point, Size, Margin> {
+    typedef BaseRect<Float, Rect, Point, mozilla::gfx::Size, Margin> Super;
+
+    Rect() : Super() {}
+    Rect(Point aPos, mozilla::gfx::Size aSize) :
+        Super(aPos, aSize) {}
+    Rect(Float _x, Float _y, Float _width, Float _height) :
+        Super(_x, _y, _width, _height) {}
+    explicit Rect(const IntRect& rect) :
+        Super(rect.x, rect.y, rect.width, rect.height) {}
 };
 
 }
diff --git a/gfx/cairo/cairo/src/Makefile.in b/gfx/cairo/cairo/src/Makefile.in
index d910ac606035..549741488e7a 100644
--- a/gfx/cairo/cairo/src/Makefile.in
+++ b/gfx/cairo/cairo/src/Makefile.in
@@ -205,7 +205,7 @@ CSRCS   += $(PSPDF_BASE_CSRCS) $(PDF_CSRCS) $(PS_CSRCS)
 EXPORTS_cairo += $(PDF_EXPORTS) $(PS_EXPORTS)
 endif
 
-ifeq ($(MOZ_WIDGET_TOOLKIT),android)
+ifneq (,$(filter android gonk,$(MOZ_WIDGET_TOOLKIT)))
 CSRCS   += $(PSPDF_BASE_CSRCS) $(PDF_CSRCS)
 EXPORTS_cairo += $(PDF_EXPORTS)
 endif
@@ -241,8 +241,6 @@ endif
 LOCAL_INCLUDES  += -I$(srcdir)
 
 FORCE_STATIC_LIB = 1
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/gfx/cairo/cairo/src/cairo-win32-surface.c b/gfx/cairo/cairo/src/cairo-win32-surface.c
index 3b868d4b1648..467510436f13 100644
--- a/gfx/cairo/cairo/src/cairo-win32-surface.c
+++ b/gfx/cairo/cairo/src/cairo-win32-surface.c
@@ -2206,67 +2206,6 @@ _cairo_win32_surface_span_renderer_finish (void *abstract_renderer)
     return CAIRO_STATUS_SUCCESS;
 }
 
-static cairo_bool_t
-_cairo_win32_surface_check_span_renderer (cairo_operator_t	  op,
-					  const cairo_pattern_t  *pattern,
-					  void			 *abstract_dst,
-					  cairo_antialias_t	  antialias)
-{
-    (void) op;
-    (void) pattern;
-    (void) abstract_dst;
-    (void) antialias;
-    return TRUE;
-}
-
-static cairo_span_renderer_t *
-_cairo_win32_surface_create_span_renderer (cairo_operator_t	 op,
-					   const cairo_pattern_t  *pattern,
-					   void			*abstract_dst,
-					   cairo_antialias_t	 antialias,
-					   const cairo_composite_rectangles_t *rects,
-					   cairo_region_t	*clip_region)
-{
-    cairo_win32_surface_t *dst = abstract_dst;
-    cairo_win32_surface_span_renderer_t *renderer;
-    cairo_status_t status;
-    int width = rects->bounded.width;
-    int height = rects->bounded.height;
-
-    renderer = calloc(1, sizeof(*renderer));
-    if (renderer == NULL)
-	return _cairo_span_renderer_create_in_error (CAIRO_STATUS_NO_MEMORY);
-
-    renderer->base.destroy = _cairo_win32_surface_span_renderer_destroy;
-    renderer->base.finish = _cairo_win32_surface_span_renderer_finish;
-    renderer->base.render_rows = _cairo_win32_surface_span_renderer_render_rows;
-    renderer->op = op;
-    renderer->pattern = pattern;
-    renderer->antialias = antialias;
-    renderer->dst = dst;
-    renderer->clip_region = clip_region;
-
-    renderer->composite_rectangles = *rects;
-
-    /* TODO: support rendering to A1 surfaces (or: go add span
-     * compositing to pixman.) */
-    renderer->mask = (cairo_image_surface_t *)
-	cairo_image_surface_create (CAIRO_FORMAT_A8,
-				    width, height);
-
-    status = cairo_surface_status (&renderer->mask->base);
-
-    if (status != CAIRO_STATUS_SUCCESS) {
-	_cairo_win32_surface_span_renderer_destroy (renderer);
-	return _cairo_span_renderer_create_in_error (status);
-    }
-
-    renderer->mask_data = renderer->mask->data - rects->bounded.x - rects->bounded.y * renderer->mask->stride;
-    renderer->mask_stride = renderer->mask->stride;
-    return &renderer->base;
-}
-
-
 static cairo_int_status_t
 _cairo_win32_surface_paint (void			*abstract_surface,
 			    cairo_operator_t		 op,
@@ -3268,54 +3207,6 @@ _cairo_win32_surface_span_renderer_composite
     }
     return status;
 }
-#if 0
-static cairo_span_renderer_t *
-_cairo_win32_surface_create_span_renderer (cairo_operator_t	 op,
-					   const cairo_pattern_t  *pattern,
-					   void			*abstract_dst,
-					   cairo_antialias_t	 antialias,
-					   const cairo_composite_rectangles_t *rects,
-					   cairo_region_t	*clip_region)
-{
-    cairo_win32_surface_t *dst = abstract_dst;
-    cairo_win32_surface_span_renderer_t *renderer;
-    cairo_status_t status;
-    int width = rects->bounded.width;
-    int height = rects->bounded.height;
-
-    renderer = calloc(1, sizeof(*renderer));
-    if (renderer == NULL)
-	return _cairo_span_renderer_create_in_error (CAIRO_STATUS_NO_MEMORY);
-
-    renderer->base.destroy = _cairo_win32_surface_span_renderer_destroy;
-    renderer->base.finish = _cairo_win32_surface_span_renderer_finish;
-    renderer->base.render_rows = _cairo_win32_surface_span_renderer_render_rows;
-    renderer->op = op;
-    renderer->pattern = pattern;
-    renderer->antialias = antialias;
-    renderer->dst = dst;
-    renderer->clip_region = clip_region;
-
-    renderer->composite_rectangles = *rects;
-
-    /* TODO: support rendering to A1 surfaces (or: go add span
-     * compositing to pixman.) */
-    renderer->mask = (cairo_image_surface_t *)
-	cairo_image_surface_create (CAIRO_FORMAT_A8,
-				    width, height);
-
-    status = cairo_surface_status (&renderer->mask->base);
-
-    if (status != CAIRO_STATUS_SUCCESS) {
-	_cairo_win32_surface_span_renderer_destroy (renderer);
-	return _cairo_span_renderer_create_in_error (status);
-    }
-
-    renderer->mask_data = renderer->mask->data - rects->bounded.x - rects->bounded.y * renderer->mask->stride;
-    renderer->mask_stride = renderer->mask->stride;
-    return &renderer->base;
-}
-#endif
 
 typedef struct _cairo_image_surface_span_renderer {
     cairo_span_renderer_t base;
@@ -3638,7 +3529,7 @@ _cairo_win32_surface_fallback_stroke (cairo_surface_t		*surface,
 	    goto CLEANUP;
     }
 
-    if (_cairo_surface_check_span_renderer (op, source, surface, antialias)) {
+    if (antialias != CAIRO_ANTIALIAS_NONE) {
 	cairo_composite_spans_info_t info;
 
 	info.polygon = &polygon;
@@ -3755,7 +3646,7 @@ _cairo_win32_surface_fallback_fill (cairo_surface_t		*surface,
     }
 
 
-    if (_cairo_surface_check_span_renderer (op, source, surface, antialias)) {
+    if (antialias != CAIRO_ANTIALIAS_NONE) {
 	cairo_composite_spans_info_t info;
 
 	info.polygon = &polygon;
@@ -3790,419 +3681,6 @@ _cairo_win32_surface_fallback_fill (cairo_surface_t		*surface,
     return status;
 }
 
-typedef struct {
-    cairo_scaled_font_t *font;
-    cairo_glyph_t *glyphs;
-    int num_glyphs;
-} cairo_show_glyphs_info_t;
-
-static cairo_status_t
-_cairo_surface_old_show_glyphs_draw_func (void                          *closure,
-					  cairo_operator_t               op,
-					  const cairo_pattern_t         *src,
-					  cairo_surface_t               *dst,
-					  int                            dst_x,
-					  int                            dst_y,
-					  const cairo_rectangle_int_t	*extents,
-					  cairo_region_t		*clip_region)
-{
-    cairo_show_glyphs_info_t *glyph_info = closure;
-    cairo_status_t status;
-    cairo_region_t *extents_region = NULL;
-
-    if (clip_region == NULL &&
-        !_cairo_operator_bounded_by_source (op)) {
-        extents_region = cairo_region_create_rectangle (extents);
-        if (unlikely (extents_region->status))
-            return extents_region->status;
-        cairo_region_translate (extents_region, -dst_x, -dst_y);
-        clip_region = extents_region;
-    }
-
-    /* Modifying the glyph array is fine because we know that this function
-     * will be called only once, and we've already made a copy of the
-     * glyphs in the wrapper.
-     */
-    if (dst_x != 0 || dst_y != 0) {
-	int i;
-
-	for (i = 0; i < glyph_info->num_glyphs; ++i) {
-	    ((cairo_glyph_t *) glyph_info->glyphs)[i].x -= dst_x;
-	    ((cairo_glyph_t *) glyph_info->glyphs)[i].y -= dst_y;
-	}
-    }
-
-    status = _cairo_surface_old_show_glyphs (glyph_info->font, op, src,
-					     dst,
-					     extents->x, extents->y,
-					     extents->x - dst_x,
-					     extents->y - dst_y,
-					     extents->width,
-					     extents->height,
-					     glyph_info->glyphs,
-					     glyph_info->num_glyphs,
-					     clip_region);
-
-    if (status == CAIRO_INT_STATUS_UNSUPPORTED) {
-	status = _cairo_scaled_font_show_glyphs (glyph_info->font,
-                                                 op,
-                                                 src, dst,
-                                                 extents->x,         extents->y,
-                                                 extents->x - dst_x,
-                                                 extents->y - dst_y,
-                                                 extents->width,     extents->height,
-                                                 glyph_info->glyphs,
-                                                 glyph_info->num_glyphs,
-                                                 clip_region);
-    }
-
-    if (extents_region)
-        cairo_region_destroy (extents_region);
-
-    return status;
-}
-
-cairo_status_t
-_cairo_win32_surface_fallback_show_glyphs (cairo_surface_t		*surface,
-				     cairo_operator_t		 op,
-				     const cairo_pattern_t	*source,
-				     cairo_glyph_t		*glyphs,
-				     int			 num_glyphs,
-				     cairo_scaled_font_t	*scaled_font,
-				     cairo_clip_t		*clip)
-{
-    cairo_show_glyphs_info_t glyph_info;
-    cairo_composite_rectangles_t extents;
-    cairo_rectangle_int_t rect;
-    cairo_status_t status;
-
-    if (!_cairo_surface_get_extents (surface, &rect))
-        ASSERT_NOT_REACHED;
-
-    status = _cairo_composite_rectangles_init_for_glyphs (&extents,
-							  &rect,
-							  op, source,
-							  scaled_font,
-							  glyphs, num_glyphs,
-							  clip,
-							  NULL);
-    if (unlikely (status))
-	return status;
-
-    if (_cairo_clip_contains_rectangle (clip, &extents.mask))
-	clip = NULL;
-
-    if (clip != NULL && extents.is_bounded) {
-	status = _cairo_clip_rectangle (clip, &extents.bounded);
-	if (unlikely (status))
-	    return status;
-    }
-
-    glyph_info.font = scaled_font;
-    glyph_info.glyphs = glyphs;
-    glyph_info.num_glyphs = num_glyphs;
-
-    return _clip_and_composite (clip, op, source,
-				_cairo_surface_old_show_glyphs_draw_func,
-				&glyph_info,
-				surface,
-                                extents.is_bounded ? &extents.bounded : &extents.unbounded);
-}
-
-cairo_surface_t *
-_cairo_win32_surface_fallback_snapshot (cairo_surface_t *surface)
-{
-    cairo_surface_t *snapshot;
-    cairo_status_t status;
-    cairo_format_t format;
-    cairo_surface_pattern_t pattern;
-    cairo_image_surface_t *image;
-    void *image_extra;
-
-    status = _cairo_surface_acquire_source_image (surface,
-						  &image, &image_extra);
-    if (unlikely (status))
-	return _cairo_surface_create_in_error (status);
-
-    format = image->format;
-    if (format == CAIRO_FORMAT_INVALID) {
-	/* Non-standard images formats can be generated when retrieving
-	 * images from unusual xservers, for example.
-	 */
-	format = _cairo_format_from_content (image->base.content);
-    }
-    snapshot = cairo_image_surface_create (format,
-					   image->width,
-					   image->height);
-    if (cairo_surface_status (snapshot)) {
-	_cairo_surface_release_source_image (surface, image, image_extra);
-	return snapshot;
-    }
-
-    _cairo_pattern_init_for_surface (&pattern, &image->base);
-    status = _cairo_surface_paint (snapshot,
-				   CAIRO_OPERATOR_SOURCE,
-				   &pattern.base,
-				   NULL);
-    _cairo_pattern_fini (&pattern.base);
-    _cairo_surface_release_source_image (surface, image, image_extra);
-    if (unlikely (status)) {
-	cairo_surface_destroy (snapshot);
-	return _cairo_surface_create_in_error (status);
-    }
-
-    return snapshot;
-}
-
-cairo_status_t
-_cairo_win32_surface_fallback_composite (cairo_operator_t		 op,
-				   const cairo_pattern_t	*src,
-				   const cairo_pattern_t	*mask,
-				   cairo_surface_t		*dst,
-				   int				 src_x,
-				   int				 src_y,
-				   int				 mask_x,
-				   int				 mask_y,
-				   int				 dst_x,
-				   int				 dst_y,
-				   unsigned int			 width,
-				   unsigned int			 height,
-				   cairo_region_t		*clip_region)
-{
-    fallback_state_t state;
-    cairo_region_t *fallback_region = NULL;
-    cairo_status_t status;
-
-    status = _fallback_init (&state, dst, dst_x, dst_y, width, height);
-    if (unlikely (status))
-	return status;
-
-    /* We know this will never fail with the image backend; but
-     * instead of calling into it directly, we call
-     * _cairo_surface_composite so that we get the correct device
-     * offset handling.
-     */
-
-    if (clip_region != NULL && (state.image_rect.x || state.image_rect.y)) {
-	fallback_region = cairo_region_copy (clip_region);
-	status = fallback_region->status;
-	if (unlikely (status))
-	    goto FAIL;
-
-	cairo_region_translate (fallback_region,
-				-state.image_rect.x,
-				-state.image_rect.y);
-	clip_region = fallback_region;
-    }
-
-    status = _cairo_surface_composite (op, src, mask,
-				       &state.image->base,
-				       src_x, src_y, mask_x, mask_y,
-				       dst_x - state.image_rect.x,
-				       dst_y - state.image_rect.y,
-				       width, height,
-				       clip_region);
-  FAIL:
-    if (fallback_region != NULL)
-	cairo_region_destroy (fallback_region);
-    _fallback_fini (&state);
-
-    return status;
-}
-
-cairo_status_t
-_cairo_win32_surface_fallback_fill_rectangles (cairo_surface_t         *surface,
-					 cairo_operator_t	  op,
-					 const cairo_color_t	 *color,
-					 cairo_rectangle_int_t   *rects,
-					 int			  num_rects)
-{
-    fallback_state_t state;
-    cairo_rectangle_int_t *offset_rects = NULL;
-    cairo_status_t status;
-    int x1, y1, x2, y2;
-    int i;
-
-    assert (surface->snapshot_of == NULL);
-
-    if (num_rects <= 0)
-	return CAIRO_STATUS_SUCCESS;
-
-    /* Compute the bounds of the rectangles, so that we know what area of the
-     * destination surface to fetch
-     */
-    x1 = rects[0].x;
-    y1 = rects[0].y;
-    x2 = rects[0].x + rects[0].width;
-    y2 = rects[0].y + rects[0].height;
-
-    for (i = 1; i < num_rects; i++) {
-	if (rects[i].x < x1)
-	    x1 = rects[i].x;
-	if (rects[i].y < y1)
-	    y1 = rects[i].y;
-
-	if ((int) (rects[i].x + rects[i].width) > x2)
-	    x2 = rects[i].x + rects[i].width;
-	if ((int) (rects[i].y + rects[i].height) > y2)
-	    y2 = rects[i].y + rects[i].height;
-    }
-
-    status = _fallback_init (&state, surface, x1, y1, x2 - x1, y2 - y1);
-    if (unlikely (status))
-	return status;
-
-    /* If the fetched image isn't at 0,0, we need to offset the rectangles */
-
-    if (state.image_rect.x != 0 || state.image_rect.y != 0) {
-	offset_rects = _cairo_malloc_ab (num_rects, sizeof (cairo_rectangle_int_t));
-	if (unlikely (offset_rects == NULL)) {
-	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	    goto DONE;
-	}
-
-	for (i = 0; i < num_rects; i++) {
-	    offset_rects[i].x = rects[i].x - state.image_rect.x;
-	    offset_rects[i].y = rects[i].y - state.image_rect.y;
-	    offset_rects[i].width = rects[i].width;
-	    offset_rects[i].height = rects[i].height;
-	}
-
-	rects = offset_rects;
-    }
-
-    status = _cairo_surface_fill_rectangles (&state.image->base,
-					     op, color,
-					     rects, num_rects);
-
-    free (offset_rects);
-
- DONE:
-    _fallback_fini (&state);
-
-    return status;
-}
-
-cairo_status_t
-_cairo_win32_surface_fallback_composite_trapezoids (cairo_operator_t		op,
-					      const cairo_pattern_t    *pattern,
-					      cairo_surface_t	       *dst,
-					      cairo_antialias_t		antialias,
-					      int			src_x,
-					      int			src_y,
-					      int			dst_x,
-					      int			dst_y,
-					      unsigned int		width,
-					      unsigned int		height,
-					      cairo_trapezoid_t	       *traps,
-					      int			num_traps,
-					      cairo_region_t		*clip_region)
-{
-    fallback_state_t state;
-    cairo_region_t *fallback_region = NULL;
-    cairo_trapezoid_t *offset_traps = NULL;
-    cairo_status_t status;
-
-    status = _fallback_init (&state, dst, dst_x, dst_y, width, height);
-    if (unlikely (status))
-	return status;
-
-    /* If the destination image isn't at 0,0, we need to offset the trapezoids */
-
-    if (state.image_rect.x != 0 || state.image_rect.y != 0) {
-	offset_traps = _cairo_malloc_ab (num_traps, sizeof (cairo_trapezoid_t));
-	if (offset_traps == NULL) {
-	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	    goto FAIL;
-	}
-
-	_cairo_trapezoid_array_translate_and_scale (offset_traps, traps, num_traps,
-                                                    - state.image_rect.x, - state.image_rect.y,
-                                                    1.0, 1.0);
-	traps = offset_traps;
-
-	/* similarly we need to adjust the region */
-	if (clip_region != NULL) {
-	    fallback_region = cairo_region_copy (clip_region);
-	    status = fallback_region->status;
-	    if (unlikely (status))
-		goto FAIL;
-
-	    cairo_region_translate (fallback_region,
-				    -state.image_rect.x,
-				    -state.image_rect.y);
-	    clip_region = fallback_region;
-	}
-    }
-
-    status = _cairo_surface_composite_trapezoids (op, pattern,
-					          &state.image->base,
-						  antialias,
-						  src_x, src_y,
-						  dst_x - state.image_rect.x,
-						  dst_y - state.image_rect.y,
-						  width, height,
-						  traps, num_traps,
-						  clip_region);
- FAIL:
-    if (offset_traps != NULL)
-	free (offset_traps);
-
-    if (fallback_region != NULL)
-	cairo_region_destroy (fallback_region);
-
-    _fallback_fini (&state);
-
-    return status;
-}
-
-cairo_status_t
-_cairo_win32_surface_fallback_clone_similar (cairo_surface_t	*surface,
-				       cairo_surface_t	*src,
-				       int		 src_x,
-				       int		 src_y,
-				       int		 width,
-				       int		 height,
-				       int		*clone_offset_x,
-				       int		*clone_offset_y,
-				       cairo_surface_t **clone_out)
-{
-    cairo_surface_t *new_surface;
-    cairo_surface_pattern_t pattern;
-    cairo_status_t status;
-
-    new_surface = _cairo_surface_create_similar_scratch (surface,
-							 src->content,
-							 width, height);
-    if (new_surface == NULL)
-	return CAIRO_INT_STATUS_UNSUPPORTED;
-    if (unlikely (new_surface->status))
-	return new_surface->status;
-
-    /* We have to copy these here, so that the coordinate spaces are correct */
-    new_surface->device_transform = src->device_transform;
-    new_surface->device_transform_inverse = src->device_transform_inverse;
-
-    _cairo_pattern_init_for_surface (&pattern, src);
-    cairo_matrix_init_translate (&pattern.base.matrix, src_x, src_y);
-    pattern.base.filter = CAIRO_FILTER_NEAREST;
-
-    status = _cairo_surface_paint (new_surface,
-				   CAIRO_OPERATOR_SOURCE,
-				   &pattern.base,
-				   NULL);
-    _cairo_pattern_fini (&pattern.base);
-
-    if (unlikely (status)) {
-	cairo_surface_destroy (new_surface);
-	return status;
-    }
-
-    *clone_offset_x = src_x;
-    *clone_offset_y = src_y;
-    *clone_out = new_surface;
-    return CAIRO_STATUS_SUCCESS;
-}
 static const cairo_surface_backend_t cairo_win32_surface_backend = {
     CAIRO_SURFACE_TYPE_WIN32,
     _cairo_win32_surface_create_similar,
@@ -4215,8 +3693,8 @@ static const cairo_surface_backend_t cairo_win32_surface_backend = {
     _cairo_win32_surface_composite,
     _cairo_win32_surface_fill_rectangles,
     NULL, /* composite_trapezoids */
-    _cairo_win32_surface_create_span_renderer,
-    _cairo_win32_surface_check_span_renderer,
+    NULL, /* create_span_renderer */
+    NULL, /* check_span_renderer */
     NULL, /* copy_page */
     NULL, /* show_page */
     _cairo_win32_surface_get_extents,
diff --git a/gfx/cairo/libpixman/src/Makefile.in b/gfx/cairo/libpixman/src/Makefile.in
index 3f3637ab55ba..8f8b2128eb6c 100644
--- a/gfx/cairo/libpixman/src/Makefile.in
+++ b/gfx/cairo/libpixman/src/Makefile.in
@@ -171,8 +171,6 @@ EXPORTS		= pixman.h pixman-version.h
 LOCAL_INCLUDES	+= -I$(srcdir) -I$(srcdir)/../../cairo/src
 
 FORCE_STATIC_LIB = 1
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/config.mk
 
diff --git a/gfx/harfbuzz/src/Makefile.in b/gfx/harfbuzz/src/Makefile.in
index 932a09bdfd85..f4b4527f7e7e 100644
--- a/gfx/harfbuzz/src/Makefile.in
+++ b/gfx/harfbuzz/src/Makefile.in
@@ -73,8 +73,6 @@ EXPORTS_harfbuzz = \
 LOCAL_INCLUDES  += -I$(srcdir) 
 
 FORCE_STATIC_LIB = 1
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/gfx/layers/basic/BasicImages.cpp b/gfx/layers/basic/BasicImages.cpp
index 25f768e3e473..d0d2c56a6abb 100644
--- a/gfx/layers/basic/BasicImages.cpp
+++ b/gfx/layers/basic/BasicImages.cpp
@@ -145,8 +145,9 @@ void
 BasicPlanarYCbCrImage::SetData(const Data& aData)
 {
   // Do some sanity checks to prevent integer overflow
-  if (aData.mYSize.width > 16384 || aData.mYSize.height > 16384) {
-    NS_ERROR("Illegal width or height");
+  if (aData.mYSize.width > PlanarYCbCrImage::MAX_DIMENSION ||
+      aData.mYSize.height > PlanarYCbCrImage::MAX_DIMENSION) {
+    NS_ERROR("Illegal image source width or height");
     return;
   }
   
@@ -159,6 +160,11 @@ BasicPlanarYCbCrImage::SetData(const Data& aData)
 
   gfxIntSize size(mScaleHint);
   gfxUtils::GetYCbCrToRGBDestFormatAndSize(aData, format, size);
+  if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
+      size.height > PlanarYCbCrImage::MAX_DIMENSION) {
+    NS_ERROR("Illegal image dest width or height");
+    return;
+  }
 
   mStride = gfxASurface::FormatStrideForWidth(format, size.width);
   mBuffer = AllocateBuffer(size.height * mStride);
diff --git a/gfx/layers/d3d10/LayerManagerD3D10.fx b/gfx/layers/d3d10/LayerManagerD3D10.fx
index c24beeb7ca21..53b34fddcecb 100644
--- a/gfx/layers/d3d10/LayerManagerD3D10.fx
+++ b/gfx/layers/d3d10/LayerManagerD3D10.fx
@@ -48,8 +48,8 @@ BlendState ComponentAlphaBlend
   SrcBlend = One;
   DestBlend = Inv_Src1_Color;
   BlendOp = Add;
-  SrcBlendAlpha = Src1_Alpha;
-  DestBlendAlpha = Inv_Src1_Alpha;
+  SrcBlendAlpha = One;
+  DestBlendAlpha = Inv_Src_Alpha;
   BlendOpAlpha = Add;
   RenderTargetWriteMask[0] = 0x0F; // All
 };
@@ -172,7 +172,7 @@ PS_OUTPUT ComponentAlphaShader(const VS_OUTPUT aVertex) : SV_Target
 
   result.vSrc = tRGB.Sample(LayerTextureSamplerLinear, aVertex.vTexCoords);
   result.vAlpha = 1.0 - tRGBWhite.Sample(LayerTextureSamplerLinear, aVertex.vTexCoords) + result.vSrc;
-  result.vAlpha.a = result.vAlpha.g;
+  result.vSrc.a = result.vAlpha.g;
   result.vSrc *= fLayerOpacity;
   result.vAlpha *= fLayerOpacity;
   return result;
diff --git a/gfx/layers/d3d10/LayerManagerD3D10Effect.h b/gfx/layers/d3d10/LayerManagerD3D10Effect.h
index 32a7cad0b918..beef65cda9b1 100644
--- a/gfx/layers/d3d10/LayerManagerD3D10Effect.h
+++ b/gfx/layers/d3d10/LayerManagerD3D10Effect.h
@@ -58,8 +58,8 @@ BlendState ComponentAlphaBlend
     SrcBlend[0] = uint(ONE /* 2 */);
     DestBlend[0] = uint(INV_SRC1_COLOR /* 17 */);
     BlendOp[0] = uint(ADD /* 1 */);
-    SrcBlendAlpha[0] = uint(SRC1_ALPHA /* 18 */);
-    DestBlendAlpha[0] = uint(INV_SRC1_ALPHA /* 19 */);
+    SrcBlendAlpha[0] = uint(ONE /* 2 */);
+    DestBlendAlpha[0] = uint(INV_SRC_ALPHA /* 6 */);
     BlendOpAlpha[0] = uint(ADD /* 1 */);
     RenderTargetWriteMask[0] = byte(0x0f);
 };
@@ -1782,16 +1782,17 @@ technique10 RenderComponentAlphaLayer
                 dcl t0.xy
                 dcl_2d s0
                 dcl_2d s1
-                texld r0, t0, s1
-                texld r1, t0, s0
-                mul r2, r1, c0.x
-                mov oC0, r2
-                add r0, -r0.xyzy, r1.xyzy
-                add r0, r0, c1.x
+                texld r0, t0, s0
+                texld r1, t0, s1
+                add r1, r0, -r1
+                add r1, r1, c1.x
+                mov r0.w, r1.y
+                mul r1, r1, c0.x
+                mov oC1, r1
                 mul r0, r0, c0.x
-                mov oC1, r0
+                mov oC0, r0
             
-            // approximately 8 instruction slots used (2 texture, 6 arithmetic)
+            // approximately 9 instruction slots used (2 texture, 7 arithmetic)
             ps_4_0
             dcl_constantbuffer cb0[3], immediateIndexed
             dcl_sampler s0, mode_default
@@ -1801,14 +1802,15 @@ technique10 RenderComponentAlphaLayer
             dcl_output o0.xyzw
             dcl_output o1.xyzw
             dcl_temps 2
-            sample r0.xyzw, v1.xyxx, t0.xyzw, s0
-            mul o0.xyzw, r0.xyzw, cb0[2].xxxx
-            sample r1.xyzw, v1.xyxx, t1.xyzw, s0
-            add r0.xyzw, r0.xyzy, -r1.xyzy
+            sample r0.xyzw, v1.xyxx, t1.xyzw, s0
+            sample r1.xyzw, v1.xyxx, t0.xyzw, s0
+            add r0.xyzw, -r0.xyzw, r1.xyzw
             add r0.xyzw, r0.xyzw, l(1.000000, 1.000000, 1.000000, 1.000000)
+            mov r1.w, r0.y
             mul o1.xyzw, r0.xyzw, cb0[2].xxxx
+            mul o0.xyzw, r1.xyzw, cb0[2].xxxx
             ret 
-            // Approximately 7 instruction slots used
+            // Approximately 8 instruction slots used
                     
         };
     }
@@ -2008,19 +2010,19 @@ technique10 RenderSolidColorLayer
 
 const BYTE g_main[] =
 {
-     68,  88,  66,  67,  21, 243, 
-     73, 121, 130,  48,  25,  26, 
-    247,  68, 153, 158,  16, 193, 
-     45,  39,   1,   0,   0,   0, 
-     51, 121,   0,   0,   1,   0, 
+     68,  88,  66,  67, 161,  12, 
+    182,  80, 237,  87,  86, 175, 
+    237, 176, 210, 190, 107, 130, 
+    119, 127,   1,   0,   0,   0, 
+     83, 121,   0,   0,   1,   0, 
       0,   0,  36,   0,   0,   0, 
-     70,  88,  49,  48,   7, 121, 
+     70,  88,  49,  48,  39, 121, 
       0,   0,   1,  16, 255, 254, 
       3,   0,   0,   0,   7,   0, 
       0,   0,  11,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
-      9,   0,   0,   0, 195, 111, 
+      9,   0,   0,   0, 227, 111, 
       0,   0,   0,   0,   0,   0, 
       5,   0,   0,   0,   0,   0, 
       0,   0,   3,   0,   0,   0, 
@@ -2130,9 +2132,9 @@ const BYTE g_main[] =
       1,   0,   0,   0,   2,   0, 
       0,   0,   1,   0,   0,   0, 
       1,   0,   0,   0,   2,   0, 
-      0,   0,  18,   0,   0,   0, 
+      0,   0,   2,   0,   0,   0, 
       1,   0,   0,   0,   2,   0, 
-      0,   0,  19,   0,   0,   0, 
+      0,   0,   6,   0,   0,   0, 
       1,   0,   0,   0,   2,   0, 
       0,   0,   1,   0,   0,   0, 
       1,   0,   0,   0,   3,   0, 
@@ -6118,20 +6120,20 @@ const BYTE g_main[] =
     171, 171, 171, 197,  88,   0, 
       0,   0,   0,   0,   0,   1, 
       0,   0,   0,   2,   0,   0, 
-      0,   0,   0,   0,   0, 144, 
+      0,   0,   0,   0,   0, 176, 
       5,   0,   0,  68,  88,  66, 
-     67,  23, 135,  64, 119, 108, 
-    229, 229,  18, 197,  12,  24, 
-     84,  10, 199, 133, 166,   1, 
-      0,   0,   0, 144,   5,   0, 
+     67,  10, 232, 128,  36, 124, 
+    206, 211, 130, 126,  20, 252, 
+    175, 204,  95, 106,  47,   1, 
+      0,   0,   0, 176,   5,   0, 
       0,   6,   0,   0,   0,  56, 
-      0,   0,   0,  52,   1,   0, 
-      0, 128,   2,   0,   0, 252, 
-      2,   0,   0, 236,   4,   0, 
-      0,  68,   5,   0,   0,  65, 
-    111, 110,  57, 244,   0,   0, 
-      0, 244,   0,   0,   0,   0, 
-      2, 255, 255, 188,   0,   0, 
+      0,   0,   0,  64,   1,   0, 
+      0, 160,   2,   0,   0,  28, 
+      3,   0,   0,  12,   5,   0, 
+      0, 100,   5,   0,   0,  65, 
+    111, 110,  57,   0,   1,   0, 
+      0,   0,   1,   0,   0,   0, 
+      2, 255, 255, 200,   0,   0, 
       0,  56,   0,   0,   0,   1, 
       0,  44,   0,   0,   0,  56, 
       0,   0,   0,  56,   0,   2, 
@@ -6152,27 +6154,29 @@ const BYTE g_main[] =
       0,   0, 144,   1,   8,  15, 
     160,  66,   0,   0,   3,   0, 
       0,  15, 128,   0,   0, 228, 
-    176,   1,   8, 228, 160,  66, 
+    176,   0,   8, 228, 160,  66, 
       0,   0,   3,   1,   0,  15, 
-    128,   0,   0, 228, 176,   0, 
-      8, 228, 160,   5,   0,   0, 
-      3,   2,   0,  15, 128,   1, 
-      0, 228, 128,   0,   0,   0, 
-    160,   1,   0,   0,   2,   0, 
-      8,  15, 128,   2,   0, 228, 
-    128,   2,   0,   0,   3,   0, 
-      0,  15, 128,   0,   0, 100, 
-    129,   1,   0, 100, 128,   2, 
-      0,   0,   3,   0,   0,  15, 
-    128,   0,   0, 228, 128,   1, 
-      0,   0, 160,   5,   0,   0, 
+    128,   0,   0, 228, 176,   1, 
+      8, 228, 160,   2,   0,   0, 
+      3,   1,   0,  15, 128,   0, 
+      0, 228, 128,   1,   0, 228, 
+    129,   2,   0,   0,   3,   1, 
+      0,  15, 128,   1,   0, 228, 
+    128,   1,   0,   0, 160,   1, 
+      0,   0,   2,   0,   0,   8, 
+    128,   1,   0,  85, 128,   5, 
+      0,   0,   3,   1,   0,  15, 
+    128,   1,   0, 228, 128,   0, 
+      0,   0, 160,   1,   0,   0, 
+      2,   1,   8,  15, 128,   1, 
+      0, 228, 128,   5,   0,   0, 
       3,   0,   0,  15, 128,   0, 
       0, 228, 128,   0,   0,   0, 
-    160,   1,   0,   0,   2,   1, 
+    160,   1,   0,   0,   2,   0, 
       8,  15, 128,   0,   0, 228, 
     128, 255, 255,   0,   0,  83, 
-     72,  68,  82,  68,   1,   0, 
-      0,  64,   0,   0,   0,  81, 
+     72,  68,  82,  88,   1,   0, 
+      0,  64,   0,   0,   0,  86, 
       0,   0,   0,  89,   0,   0, 
       4,  70, 142,  32,   0,   0, 
       0,   0,   0,   3,   0,   0, 
@@ -6193,576 +6197,137 @@ const BYTE g_main[] =
       2,   2,   0,   0,   0,  69, 
       0,   0,   9, 242,   0,  16, 
       0,   0,   0,   0,   0,  70, 
+     16,  16,   0,   1,   0,   0, 
+      0,  70, 126,  16,   0,   1, 
+      0,   0,   0,   0,  96,  16, 
+      0,   0,   0,   0,   0,  69, 
+      0,   0,   9, 242,   0,  16, 
+      0,   1,   0,   0,   0,  70, 
      16,  16,   0,   1,   0,   0, 
       0,  70, 126,  16,   0,   0, 
       0,   0,   0,   0,  96,  16, 
-      0,   0,   0,   0,   0,  56, 
-      0,   0,   8, 242,  32,  16, 
-      0,   0,   0,   0,   0,  70, 
-     14,  16,   0,   0,   0,   0, 
-      0,   6, 128,  32,   0,   0, 
-      0,   0,   0,   2,   0,   0, 
-      0,  69,   0,   0,   9, 242, 
-      0,  16,   0,   1,   0,   0, 
-      0,  70,  16,  16,   0,   1, 
-      0,   0,   0,  70, 126,  16, 
-      0,   1,   0,   0,   0,   0, 
-     96,  16,   0,   0,   0,   0, 
-      0,   0,   0,   0,   8, 242, 
-      0,  16,   0,   0,   0,   0, 
-      0,  70,   6,  16,   0,   0, 
-      0,   0,   0,  70,   6,  16, 
-    128,  65,   0,   0,   0,   1, 
       0,   0,   0,   0,   0,   0, 
-     10, 242,   0,  16,   0,   0, 
-      0,   0,   0,  70,  14,  16, 
-      0,   0,   0,   0,   0,   2, 
-     64,   0,   0,   0,   0, 128, 
-     63,   0,   0, 128,  63,   0, 
+      0,   0,   8, 242,   0,  16, 
+      0,   0,   0,   0,   0,  70, 
+     14,  16, 128,  65,   0,   0, 
+      0,   0,   0,   0,   0,  70, 
+     14,  16,   0,   1,   0,   0, 
+      0,   0,   0,   0,  10, 242, 
+      0,  16,   0,   0,   0,   0, 
+      0,  70,  14,  16,   0,   0, 
+      0,   0,   0,   2,  64,   0, 
+      0,   0,   0, 128,  63,   0, 
       0, 128,  63,   0,   0, 128, 
-     63,  56,   0,   0,   8, 242, 
+     63,   0,   0, 128,  63,  54, 
+      0,   0,   5, 130,   0,  16, 
+      0,   1,   0,   0,   0,  26, 
+      0,  16,   0,   0,   0,   0, 
+      0,  56,   0,   0,   8, 242, 
      32,  16,   0,   1,   0,   0, 
       0,  70,  14,  16,   0,   0, 
       0,   0,   0,   6, 128,  32, 
       0,   0,   0,   0,   0,   2, 
-      0,   0,   0,  62,   0,   0, 
-      1,  83,  84,  65,  84, 116, 
-      0,   0,   0,   7,   0,   0, 
+      0,   0,   0,  56,   0,   0, 
+      8, 242,  32,  16,   0,   0, 
+      0,   0,   0,  70,  14,  16, 
+      0,   1,   0,   0,   0,   6, 
+    128,  32,   0,   0,   0,   0, 
+      0,   2,   0,   0,   0,  62, 
+      0,   0,   1,  83,  84,  65, 
+     84, 116,   0,   0,   0,   8, 
+      0,   0,   0,   2,   0,   0, 
+      0,   0,   0,   0,   0,   3, 
+      0,   0,   0,   4,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
       0,   2,   0,   0,   0,   0, 
-      0,   0,   0,   3,   0,   0, 
-      0,   4,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   2,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,  82,  68,  69,  70, 232, 
+      1,   0,   0,   1,   0,   0, 
+      0, 208,   0,   0,   0,   4, 
+      0,   0,   0,  28,   0,   0, 
+      0,   0,   4, 255, 255,   0, 
+      1,   0,   0, 180,   1,   0, 
+      0, 156,   0,   0,   0,   3, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
       0,   1,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   2, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,  82, 
-     68,  69,  70, 232,   1,   0, 
-      0,   1,   0,   0,   0, 208, 
-      0,   0,   0,   4,   0,   0, 
-      0,  28,   0,   0,   0,   0, 
-      4, 255, 255,   0,   1,   0, 
-      0, 180,   1,   0,   0, 156, 
-      0,   0,   0,   3,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0,   0,   0,   0, 
-      0, 182,   0,   0,   0,   2, 
-      0,   0,   0,   5,   0,   0, 
-      0,   4,   0,   0,   0, 255, 
-    255, 255, 255,   0,   0,   0, 
-      0,   1,   0,   0,   0,  12, 
-      0,   0,   0, 187,   0,   0, 
+      0,   0,   0, 182,   0,   0, 
       0,   2,   0,   0,   0,   5, 
       0,   0,   0,   4,   0,   0, 
-      0, 255, 255, 255, 255,   1, 
+      0, 255, 255, 255, 255,   0, 
       0,   0,   0,   1,   0,   0, 
-      0,  12,   0,   0,   0, 197, 
+      0,  12,   0,   0,   0, 187, 
+      0,   0,   0,   2,   0,   0, 
+      0,   5,   0,   0,   0,   4, 
+      0,   0,   0, 255, 255, 255, 
+    255,   1,   0,   0,   0,   1, 
+      0,   0,   0,  12,   0,   0, 
+      0, 197,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
+      0,   1,   0,   0,   0,   0, 
+      0,   0,   0,  76,  97, 121, 
+    101, 114,  84, 101, 120, 116, 
+    117, 114, 101,  83,  97, 109, 
+    112, 108, 101, 114,  76, 105, 
+    110, 101,  97, 114,   0, 116, 
+     82,  71,  66,   0, 116,  82, 
+     71,  66,  87, 104, 105, 116, 
+    101,   0,  80, 101, 114,  76, 
+     97, 121, 101, 114,   0, 171, 
+    171, 197,   0,   0,   0,   4, 
+      0,   0,   0, 232,   0,   0, 
+      0, 112,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
-      0,  76,  97, 121, 101, 114, 
-     84, 101, 120, 116, 117, 114, 
-    101,  83,  97, 109, 112, 108, 
-    101, 114,  76, 105, 110, 101, 
-     97, 114,   0, 116,  82,  71, 
-     66,   0, 116,  82,  71,  66, 
-     87, 104, 105, 116, 101,   0, 
-     80, 101, 114,  76,  97, 121, 
-    101, 114,   0, 171, 171, 197, 
+      0,  72,   1,   0,   0,   0, 
+      0,   0,   0,  16,   0,   0, 
+      0,   0,   0,   0,   0,  88, 
+      1,   0,   0,   0,   0,   0, 
+      0, 104,   1,   0,   0,  16, 
+      0,   0,   0,  16,   0,   0, 
+      0,   0,   0,   0,   0,  88, 
+      1,   0,   0,   0,   0,   0, 
+      0, 115,   1,   0,   0,  32, 
       0,   0,   0,   4,   0,   0, 
-      0, 232,   0,   0,   0, 112, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,  72, 
+      0,   2,   0,   0,   0, 132, 
       1,   0,   0,   0,   0,   0, 
-      0,  16,   0,   0,   0,   0, 
-      0,   0,   0,  88,   1,   0, 
-      0,   0,   0,   0,   0, 104, 
-      1,   0,   0,  16,   0,   0, 
-      0,  16,   0,   0,   0,   0, 
-      0,   0,   0,  88,   1,   0, 
-      0,   0,   0,   0,   0, 115, 
-      1,   0,   0,  32,   0,   0, 
-      0,   4,   0,   0,   0,   2, 
-      0,   0,   0, 132,   1,   0, 
-      0,   0,   0,   0,   0, 148, 
-      1,   0,   0,  48,   0,   0, 
-      0,  64,   0,   0,   0,   0, 
-      0,   0,   0, 164,   1,   0, 
-      0,   0,   0,   0,   0, 118, 
-     84, 101, 120, 116, 117, 114, 
-    101,  67, 111, 111, 114, 100, 
-    115,   0, 171,   1,   0,   3, 
-      0,   1,   0,   4,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0, 118,  76,  97, 121, 101, 
-    114,  81, 117,  97, 100,   0, 
-    102,  76,  97, 121, 101, 114, 
-     79, 112,  97,  99, 105, 116, 
-    121,   0, 171, 171, 171,   0, 
-      0,   3,   0,   1,   0,   1, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0, 109,  76,  97, 
-    121, 101, 114,  84, 114,  97, 
-    110, 115, 102, 111, 114, 109, 
-      0,   3,   0,   3,   0,   4, 
-      0,   4,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,  77, 
-    105,  99, 114, 111, 115, 111, 
-    102, 116,  32,  40,  82,  41, 
-     32,  72,  76,  83,  76,  32, 
-     83, 104,  97, 100, 101, 114, 
-     32,  67, 111, 109, 112, 105, 
-    108, 101, 114,  32,  57,  46, 
-     50,  57,  46,  57,  53,  50, 
-     46,  51,  49,  49,  49,   0, 
-    171, 171, 171,  73,  83,  71, 
-     78,  80,   0,   0,   0,   2, 
-      0,   0,   0,   8,   0,   0, 
-      0,  56,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,   3,   0,   0,   0,   0, 
-      0,   0,   0,  15,   0,   0, 
-      0,  68,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   3,   0,   0,   0,   1, 
-      0,   0,   0,   3,   3,   0, 
-      0,  83,  86,  95,  80, 111, 
-    115, 105, 116, 105, 111, 110, 
-      0,  84,  69,  88,  67,  79, 
-     79,  82,  68,   0, 171, 171, 
-    171,  79,  83,  71,  78,  68, 
-      0,   0,   0,   2,   0,   0, 
-      0,   8,   0,   0,   0,  56, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   3, 
-      0,   0,   0,   0,   0,   0, 
-      0,  15,   0,   0,   0,  56, 
-      0,   0,   0,   1,   0,   0, 
-      0,   0,   0,   0,   0,   3, 
-      0,   0,   0,   1,   0,   0, 
-      0,  15,   0,   0,   0,  83, 
-     86,  95,  84,  97, 114, 103, 
-    101, 116,   0, 171, 171, 225, 
-     95,   0,   0,   0,   0,   0, 
-      0,  82, 101, 110, 100, 101, 
-    114,  83, 111, 108, 105, 100, 
-     67, 111, 108, 111, 114,  76, 
-     97, 121, 101, 114,   0,   4, 
-      0,   0,   0,   1,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0,   3,   0,   0, 
-      0, 255, 255, 255, 255,   4, 
-      7,   0,   0,  68,  88,  66, 
-     67,  74,   0,  69, 126, 158, 
-    251, 122, 220, 157, 162, 154, 
-    166, 138,  69, 197, 120,   1, 
-      0,   0,   0,   4,   7,   0, 
-      0,   6,   0,   0,   0,  56, 
-      0,   0,   0, 144,   1,   0, 
-      0, 128,   3,   0,   0, 252, 
-      3,   0,   0, 120,   6,   0, 
-      0, 172,   6,   0,   0,  65, 
-    111, 110,  57,  80,   1,   0, 
-      0,  80,   1,   0,   0,   0, 
-      2, 254, 255, 236,   0,   0, 
-      0, 100,   0,   0,   0,   5, 
-      0,  36,   0,   0,   0,  96, 
-      0,   0,   0,  96,   0,   0, 
-      0,  36,   0,   1,   0,  96, 
-      0,   0,   0,   0,   0,   2, 
-      0,   1,   0,   0,   0,   0, 
-      0,   0,   0,   3,   0,   2, 
-      0,   3,   0,   0,   0,   0, 
-      0,   0,   0,   6,   0,   1, 
-      0,   5,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,   1, 
-      0,   6,   0,   0,   0,   0, 
-      0,   2,   0,   0,   0,   4, 
-      0,   7,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      2, 254, 255,  31,   0,   0, 
-      2,   5,   0,   0, 128,   0, 
-      0,  15, 144,   4,   0,   0, 
-      4,   0,   0,   3, 224,   0, 
-      0, 228, 144,   1,   0, 238, 
-    160,   1,   0, 228, 160,   4, 
-      0,   0,   4,   0,   0,   3, 
-    128,   0,   0, 228, 144,   2, 
-      0, 238, 160,   2,   0, 228, 
-    160,   5,   0,   0,   3,   1, 
-      0,  15, 128,   0,   0,  85, 
-    128,   4,   0, 228, 160,   4, 
-      0,   0,   4,   0,   0,  15, 
-    128,   3,   0, 228, 160,   0, 
-      0,   0, 128,   1,   0, 228, 
-    128,   2,   0,   0,   3,   0, 
-      0,  15, 128,   0,   0, 228, 
-    128,   5,   0, 228, 160,   2, 
-      0,   0,   3,   0,   0,  15, 
-    128,   0,   0, 228, 128,   6, 
-      0, 228, 161,   5,   0,   0, 
-      3,   1,   0,  15, 128,   0, 
-      0,  85, 128,   8,   0, 228, 
-    160,   4,   0,   0,   4,   1, 
-      0,  15, 128,   7,   0, 228, 
-    160,   0,   0,   0, 128,   1, 
-      0, 228, 128,   4,   0,   0, 
-      4,   1,   0,  15, 128,   9, 
-      0, 228, 160,   0,   0, 170, 
-    128,   1,   0, 228, 128,   4, 
-      0,   0,   4,   0,   0,  15, 
-    128,  10,   0, 228, 160,   0, 
-      0, 255, 128,   1,   0, 228, 
-    128,   4,   0,   0,   4,   0, 
-      0,   3, 192,   0,   0, 255, 
-    128,   0,   0, 228, 160,   0, 
-      0, 228, 128,   1,   0,   0, 
-      2,   0,   0,  12, 192,   0, 
-      0, 228, 128, 255, 255,   0, 
-      0,  83,  72,  68,  82, 232, 
-      1,   0,   0,  64,   0,   1, 
-      0, 122,   0,   0,   0,  89, 
-      0,   0,   4,  70, 142,  32, 
-      0,   0,   0,   0,   0,   7, 
-      0,   0,   0,  89,   0,   0, 
-      4,  70, 142,  32,   0,   1, 
-      0,   0,   0,   1,   0,   0, 
-      0,  89,   0,   0,   4,  70, 
-    142,  32,   0,   2,   0,   0, 
-      0,   4,   0,   0,   0,  95, 
-      0,   0,   3,  50,  16,  16, 
-      0,   0,   0,   0,   0, 103, 
-      0,   0,   4, 242,  32,  16, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 101,   0,   0, 
-      3,  50,  32,  16,   0,   1, 
-      0,   0,   0, 104,   0,   0, 
-      2,   2,   0,   0,   0,  50, 
-      0,   0,  11,  50,   0,  16, 
-      0,   0,   0,   0,   0,  70, 
-     16,  16,   0,   0,   0,   0, 
-      0, 230, 138,  32,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,  70, 128,  32,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,  56,   0,   0,   8, 242, 
-      0,  16,   0,   1,   0,   0, 
-      0,  86,   5,  16,   0,   0, 
-      0,   0,   0,  70, 142,  32, 
-      0,   0,   0,   0,   0,   4, 
-      0,   0,   0,  50,   0,   0, 
-     10, 242,   0,  16,   0,   0, 
-      0,   0,   0,  70, 142,  32, 
-      0,   0,   0,   0,   0,   3, 
-      0,   0,   0,   6,   0,  16, 
-      0,   0,   0,   0,   0,  70, 
-     14,  16,   0,   1,   0,   0, 
-      0,   0,   0,   0,   8, 242, 
-      0,  16,   0,   0,   0,   0, 
-      0,  70,  14,  16,   0,   0, 
-      0,   0,   0,  70, 142,  32, 
-      0,   0,   0,   0,   0,   6, 
-      0,   0,   0,   0,   0,   0, 
-      9, 242,   0,  16,   0,   0, 
-      0,   0,   0,  70,  14,  16, 
-      0,   0,   0,   0,   0,  70, 
-    142,  32, 128,  65,   0,   0, 
-      0,   1,   0,   0,   0,   0, 
-      0,   0,   0,  56,   0,   0, 
-      8, 242,   0,  16,   0,   1, 
-      0,   0,   0,  86,   5,  16, 
-      0,   0,   0,   0,   0,  70, 
-    142,  32,   0,   2,   0,   0, 
-      0,   1,   0,   0,   0,  50, 
-      0,   0,  10, 242,   0,  16, 
-      0,   1,   0,   0,   0,  70, 
-    142,  32,   0,   2,   0,   0, 
-      0,   0,   0,   0,   0,   6, 
-      0,  16,   0,   0,   0,   0, 
-      0,  70,  14,  16,   0,   1, 
-      0,   0,   0,  50,   0,   0, 
-     10, 242,   0,  16,   0,   1, 
-      0,   0,   0,  70, 142,  32, 
-      0,   2,   0,   0,   0,   2, 
-      0,   0,   0, 166,  10,  16, 
-      0,   0,   0,   0,   0,  70, 
-     14,  16,   0,   1,   0,   0, 
-      0,  50,   0,   0,  10, 242, 
-     32,  16,   0,   0,   0,   0, 
-      0,  70, 142,  32,   0,   2, 
-      0,   0,   0,   3,   0,   0, 
-      0, 246,  15,  16,   0,   0, 
-      0,   0,   0,  70,  14,  16, 
-      0,   1,   0,   0,   0,  50, 
-      0,   0,  11,  50,  32,  16, 
-      0,   1,   0,   0,   0,  70, 
-     16,  16,   0,   0,   0,   0, 
-      0, 230, 138,  32,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,  70, 128,  32,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,  62,   0,   0,   1,  83, 
-     84,  65,  84, 116,   0,   0, 
-      0,  11,   0,   0,   0,   2, 
-      0,   0,   0,   0,   0,   0, 
-      0,   3,   0,   0,   0,   4, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,  82,  68,  69, 
-     70, 116,   2,   0,   0,   3, 
-      0,   0,   0, 168,   0,   0, 
-      0,   3,   0,   0,   0,  28, 
-      0,   0,   0,   0,   4, 254, 
-    255,   0,   1,   0,   0,  64, 
-      2,   0,   0, 124,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,   0,   0,   0,   0, 133, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,   1, 
-      0,   0,   0,   0,   0,   0, 
-      0, 152,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   2,   0,   0, 
-      0,   1,   0,   0,   0,   0, 
-      0,   0,   0,  80, 101, 114, 
-     76,  97, 121, 101, 114,   0, 
-     80, 101, 114,  79,  99,  99, 
-     97, 115, 105, 111, 110,  97, 
-    108,  76,  97, 121, 101, 114, 
-      0,  80, 101, 114,  76,  97, 
-    121, 101, 114,  77,  97, 110, 
-     97, 103, 101, 114,   0, 124, 
-      0,   0,   0,   4,   0,   0, 
-      0, 240,   0,   0,   0, 112, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0, 133, 
-      0,   0,   0,   2,   0,   0, 
-      0, 188,   1,   0,   0,  32, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0, 152, 
-      0,   0,   0,   1,   0,   0, 
-      0,  28,   2,   0,   0,  64, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,  80, 
+      0, 148,   1,   0,   0,  48, 
+      0,   0,   0,  64,   0,   0, 
+      0,   0,   0,   0,   0, 164, 
       1,   0,   0,   0,   0,   0, 
-      0,  16,   0,   0,   0,   2, 
-      0,   0,   0,  96,   1,   0, 
-      0,   0,   0,   0,   0, 112, 
-      1,   0,   0,  16,   0,   0, 
-      0,  16,   0,   0,   0,   2, 
-      0,   0,   0,  96,   1,   0, 
-      0,   0,   0,   0,   0, 123, 
-      1,   0,   0,  32,   0,   0, 
-      0,   4,   0,   0,   0,   0, 
-      0,   0,   0, 140,   1,   0, 
-      0,   0,   0,   0,   0, 156, 
-      1,   0,   0,  48,   0,   0, 
-      0,  64,   0,   0,   0,   2, 
-      0,   0,   0, 172,   1,   0, 
-      0,   0,   0,   0,   0, 118, 
-     84, 101, 120, 116, 117, 114, 
-    101,  67, 111, 111, 114, 100, 
-    115,   0, 171,   1,   0,   3, 
-      0,   1,   0,   4,   0,   0, 
+      0, 118,  84, 101, 120, 116, 
+    117, 114, 101,  67, 111, 111, 
+    114, 100, 115,   0, 171,   1, 
+      0,   3,   0,   1,   0,   4, 
       0,   0,   0,   0,   0,   0, 
-      0, 118,  76,  97, 121, 101, 
-    114,  81, 117,  97, 100,   0, 
-    102,  76,  97, 121, 101, 114, 
-     79, 112,  97,  99, 105, 116, 
-    121,   0, 171, 171, 171,   0, 
-      0,   3,   0,   1,   0,   1, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0, 109,  76,  97, 
-    121, 101, 114,  84, 114,  97, 
-    110, 115, 102, 111, 114, 109, 
-      0,   3,   0,   3,   0,   4, 
-      0,   4,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0, 236, 
-      1,   0,   0,   0,   0,   0, 
-      0,  16,   0,   0,   0,   2, 
-      0,   0,   0,   0,   2,   0, 
-      0,   0,   0,   0,   0,  16, 
-      2,   0,   0,  16,   0,   0, 
-      0,  16,   0,   0,   0,   0, 
-      0,   0,   0,   0,   2,   0, 
-      0,   0,   0,   0,   0, 118, 
-     82, 101, 110, 100, 101, 114, 
-     84,  97, 114, 103, 101, 116, 
-     79, 102, 102, 115, 101, 116, 
-      0,   1,   0,   3,   0,   1, 
-      0,   4,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0, 102, 
-     76,  97, 121, 101, 114,  67, 
-    111, 108, 111, 114,   0,  52, 
-      2,   0,   0,   0,   0,   0, 
-      0,  64,   0,   0,   0,   2, 
-      0,   0,   0, 172,   1,   0, 
+      0,   0,   0, 118,  76,  97, 
+    121, 101, 114,  81, 117,  97, 
+    100,   0, 102,  76,  97, 121, 
+    101, 114,  79, 112,  97,  99, 
+    105, 116, 121,   0, 171, 171, 
+    171,   0,   0,   3,   0,   1, 
+      0,   1,   0,   0,   0,   0, 
       0,   0,   0,   0,   0, 109, 
-     80, 114, 111, 106, 101,  99, 
-    116, 105, 111, 110,   0,  77, 
-    105,  99, 114, 111, 115, 111, 
-    102, 116,  32,  40,  82,  41, 
-     32,  72,  76,  83,  76,  32, 
-     83, 104,  97, 100, 101, 114, 
-     32,  67, 111, 109, 112, 105, 
-    108, 101, 114,  32,  57,  46, 
-     50,  57,  46,  57,  53,  50, 
-     46,  51,  49,  49,  49,   0, 
-    171, 171, 171,  73,  83,  71, 
-     78,  44,   0,   0,   0,   1, 
-      0,   0,   0,   8,   0,   0, 
-      0,  32,   0,   0,   0,   0, 
+     76,  97, 121, 101, 114,  84, 
+    114,  97, 110, 115, 102, 111, 
+    114, 109,   0,   3,   0,   3, 
+      0,   4,   0,   4,   0,   0, 
       0,   0,   0,   0,   0,   0, 
-      0,   3,   0,   0,   0,   0, 
-      0,   0,   0,   3,   3,   0, 
-      0,  80,  79,  83,  73,  84, 
-     73,  79,  78,   0, 171, 171, 
-    171,  79,  83,  71,  78,  80, 
-      0,   0,   0,   2,   0,   0, 
-      0,   8,   0,   0,   0,  56, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,   3, 
-      0,   0,   0,   0,   0,   0, 
-      0,  15,   0,   0,   0,  68, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   3, 
-      0,   0,   0,   1,   0,   0, 
-      0,   3,  12,   0,   0,  83, 
-     86,  95,  80, 111, 115, 105, 
-    116, 105, 111, 110,   0,  84, 
-     69,  88,  67,  79,  79,  82, 
-     68,   0, 171, 171, 171, 195, 
-    101,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,   2, 
-      0,   0,   0,   0,   0,   0, 
-      0, 216,   2,   0,   0,  68, 
-     88,  66,  67, 136, 106,  87, 
-     29, 239,  32, 100, 138, 218, 
-      2, 105,  91, 143, 165, 252, 
-     49,   1,   0,   0,   0, 216, 
-      2,   0,   0,   6,   0,   0, 
-      0,  56,   0,   0,   0, 132, 
-      0,   0,   0, 204,   0,   0, 
-      0,  72,   1,   0,   0,  76, 
-      2,   0,   0, 164,   2,   0, 
-      0,  65, 111, 110,  57,  68, 
-      0,   0,   0,  68,   0,   0, 
-      0,   0,   2, 255, 255,  20, 
-      0,   0,   0,  48,   0,   0, 
-      0,   1,   0,  36,   0,   0, 
-      0,  48,   0,   0,   0,  48, 
-      0,   0,   0,  36,   0,   0, 
-      0,  48,   0,   0,   0,   1, 
-      0,   1,   0,   0,   0,   0, 
-      0,   0,   0,   1,   2, 255, 
-    255,   1,   0,   0,   2,   0, 
-      8,  15, 128,   0,   0, 228, 
-    160, 255, 255,   0,   0,  83, 
-     72,  68,  82,  64,   0,   0, 
-      0,  64,   0,   0,   0,  16, 
-      0,   0,   0,  89,   0,   0, 
-      4,  70, 142,  32,   0,   0, 
-      0,   0,   0,   2,   0,   0, 
-      0, 101,   0,   0,   3, 242, 
-     32,  16,   0,   0,   0,   0, 
-      0,  54,   0,   0,   6, 242, 
-     32,  16,   0,   0,   0,   0, 
-      0,  70, 142,  32,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,  62,   0,   0,   1,  83, 
-     84,  65,  84, 116,   0,   0, 
-      0,   2,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,  82,  68,  69, 
-     70, 252,   0,   0,   0,   1, 
-      0,   0,   0,  80,   0,   0, 
-      0,   1,   0,   0,   0,  28, 
-      0,   0,   0,   0,   4, 255, 
-    255,   0,   1,   0,   0, 200, 
-      0,   0,   0,  60,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,   0,   0,   0,   0,  80, 
-    101, 114,  79,  99,  99,  97, 
-    115, 105, 111, 110,  97, 108, 
-     76,  97, 121, 101, 114,   0, 
-    171,  60,   0,   0,   0,   2, 
-      0,   0,   0, 104,   0,   0, 
-      0,  32,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0, 152,   0,   0,   0,   0, 
-      0,   0,   0,  16,   0,   0, 
-      0,   0,   0,   0,   0, 172, 
-      0,   0,   0,   0,   0,   0, 
-      0, 188,   0,   0,   0,  16, 
-      0,   0,   0,  16,   0,   0, 
-      0,   2,   0,   0,   0, 172, 
-      0,   0,   0,   0,   0,   0, 
-      0, 118,  82, 101, 110, 100, 
-    101, 114,  84,  97, 114, 103, 
-    101, 116,  79, 102, 102, 115, 
-    101, 116,   0,   1,   0,   3, 
-      0,   1,   0,   4,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0, 102,  76,  97, 121, 101, 
-    114,  67, 111, 108, 111, 114, 
       0,  77, 105,  99, 114, 111, 
     115, 111, 102, 116,  32,  40, 
      82,  41,  32,  72,  76,  83, 
@@ -6782,245 +6347,642 @@ const BYTE g_main[] =
       0,   0,   0,   0,   0,   0, 
       0,   0,   0,   3,   0,   0, 
       0,   1,   0,   0,   0,   3, 
-      0,   0,   0,  83,  86,  95, 
+      3,   0,   0,  83,  86,  95, 
      80, 111, 115, 105, 116, 105, 
     111, 110,   0,  84,  69,  88, 
      67,  79,  79,  82,  68,   0, 
     171, 171, 171,  79,  83,  71, 
-     78,  44,   0,   0,   0,   1, 
+     78,  68,   0,   0,   0,   2, 
       0,   0,   0,   8,   0,   0, 
-      0,  32,   0,   0,   0,   0, 
+      0,  56,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
       0,   3,   0,   0,   0,   0, 
       0,   0,   0,  15,   0,   0, 
+      0,  56,   0,   0,   0,   1, 
+      0,   0,   0,   0,   0,   0, 
+      0,   3,   0,   0,   0,   1, 
+      0,   0,   0,  15,   0,   0, 
       0,  83,  86,  95,  84,  97, 
     114, 103, 101, 116,   0, 171, 
-    171, 223, 108,   0,   0,   0, 
+    171, 225,  95,   0,   0,   0, 
+      0,   0,   0,  82, 101, 110, 
+    100, 101, 114,  83, 111, 108, 
+    105, 100,  67, 111, 108, 111, 
+    114,  76,  97, 121, 101, 114, 
+      0,   4,   0,   0,   0,   1, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,   3, 
+      0,   0,   0, 255, 255, 255, 
+    255,   4,   7,   0,   0,  68, 
+     88,  66,  67,  74,   0,  69, 
+    126, 158, 251, 122, 220, 157, 
+    162, 154, 166, 138,  69, 197, 
+    120,   1,   0,   0,   0,   4, 
+      7,   0,   0,   6,   0,   0, 
+      0,  56,   0,   0,   0, 144, 
+      1,   0,   0, 128,   3,   0, 
+      0, 252,   3,   0,   0, 120, 
+      6,   0,   0, 172,   6,   0, 
+      0,  65, 111, 110,  57,  80, 
+      1,   0,   0,  80,   1,   0, 
+      0,   0,   2, 254, 255, 236, 
+      0,   0,   0, 100,   0,   0, 
+      0,   5,   0,  36,   0,   0, 
+      0,  96,   0,   0,   0,  96, 
+      0,   0,   0,  36,   0,   1, 
+      0,  96,   0,   0,   0,   0, 
+      0,   2,   0,   1,   0,   0, 
+      0,   0,   0,   0,   0,   3, 
+      0,   2,   0,   3,   0,   0, 
+      0,   0,   0,   0,   0,   6, 
+      0,   1,   0,   5,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,   1,   0,   6,   0,   0, 
+      0,   0,   0,   2,   0,   0, 
+      0,   4,   0,   7,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   2, 254, 255,  31, 
+      0,   0,   2,   5,   0,   0, 
+    128,   0,   0,  15, 144,   4, 
+      0,   0,   4,   0,   0,   3, 
+    224,   0,   0, 228, 144,   1, 
+      0, 238, 160,   1,   0, 228, 
+    160,   4,   0,   0,   4,   0, 
+      0,   3, 128,   0,   0, 228, 
+    144,   2,   0, 238, 160,   2, 
+      0, 228, 160,   5,   0,   0, 
+      3,   1,   0,  15, 128,   0, 
+      0,  85, 128,   4,   0, 228, 
+    160,   4,   0,   0,   4,   0, 
+      0,  15, 128,   3,   0, 228, 
+    160,   0,   0,   0, 128,   1, 
+      0, 228, 128,   2,   0,   0, 
+      3,   0,   0,  15, 128,   0, 
+      0, 228, 128,   5,   0, 228, 
+    160,   2,   0,   0,   3,   0, 
+      0,  15, 128,   0,   0, 228, 
+    128,   6,   0, 228, 161,   5, 
+      0,   0,   3,   1,   0,  15, 
+    128,   0,   0,  85, 128,   8, 
+      0, 228, 160,   4,   0,   0, 
+      4,   1,   0,  15, 128,   7, 
+      0, 228, 160,   0,   0,   0, 
+    128,   1,   0, 228, 128,   4, 
+      0,   0,   4,   1,   0,  15, 
+    128,   9,   0, 228, 160,   0, 
+      0, 170, 128,   1,   0, 228, 
+    128,   4,   0,   0,   4,   0, 
+      0,  15, 128,  10,   0, 228, 
+    160,   0,   0, 255, 128,   1, 
+      0, 228, 128,   4,   0,   0, 
+      4,   0,   0,   3, 192,   0, 
+      0, 255, 128,   0,   0, 228, 
+    160,   0,   0, 228, 128,   1, 
+      0,   0,   2,   0,   0,  12, 
+    192,   0,   0, 228, 128, 255, 
+    255,   0,   0,  83,  72,  68, 
+     82, 232,   1,   0,   0,  64, 
+      0,   1,   0, 122,   0,   0, 
+      0,  89,   0,   0,   4,  70, 
+    142,  32,   0,   0,   0,   0, 
+      0,   7,   0,   0,   0,  89, 
+      0,   0,   4,  70, 142,  32, 
+      0,   1,   0,   0,   0,   1, 
+      0,   0,   0,  89,   0,   0, 
+      4,  70, 142,  32,   0,   2, 
       0,   0,   0,   4,   0,   0, 
+      0,  95,   0,   0,   3,  50, 
+     16,  16,   0,   0,   0,   0, 
+      0, 103,   0,   0,   4, 242, 
+     32,  16,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0, 101, 
+      0,   0,   3,  50,  32,  16, 
+      0,   1,   0,   0,   0, 104, 
+      0,   0,   2,   2,   0,   0, 
+      0,  50,   0,   0,  11,  50, 
+      0,  16,   0,   0,   0,   0, 
+      0,  70,  16,  16,   0,   0, 
+      0,   0,   0, 230, 138,  32, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0,  70, 128,  32, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0,  56,   0,   0, 
+      8, 242,   0,  16,   0,   1, 
+      0,   0,   0,  86,   5,  16, 
+      0,   0,   0,   0,   0,  70, 
+    142,  32,   0,   0,   0,   0, 
+      0,   4,   0,   0,   0,  50, 
+      0,   0,  10, 242,   0,  16, 
+      0,   0,   0,   0,   0,  70, 
+    142,  32,   0,   0,   0,   0, 
+      0,   3,   0,   0,   0,   6, 
+      0,  16,   0,   0,   0,   0, 
+      0,  70,  14,  16,   0,   1, 
+      0,   0,   0,   0,   0,   0, 
+      8, 242,   0,  16,   0,   0, 
+      0,   0,   0,  70,  14,  16, 
+      0,   0,   0,   0,   0,  70, 
+    142,  32,   0,   0,   0,   0, 
+      0,   6,   0,   0,   0,   0, 
+      0,   0,   9, 242,   0,  16, 
+      0,   0,   0,   0,   0,  70, 
+     14,  16,   0,   0,   0,   0, 
+      0,  70, 142,  32, 128,  65, 
+      0,   0,   0,   1,   0,   0, 
+      0,   0,   0,   0,   0,  56, 
+      0,   0,   8, 242,   0,  16, 
+      0,   1,   0,   0,   0,  86, 
+      5,  16,   0,   0,   0,   0, 
+      0,  70, 142,  32,   0,   2, 
+      0,   0,   0,   1,   0,   0, 
+      0,  50,   0,   0,  10, 242, 
+      0,  16,   0,   1,   0,   0, 
+      0,  70, 142,  32,   0,   2, 
+      0,   0,   0,   0,   0,   0, 
+      0,   6,   0,  16,   0,   0, 
+      0,   0,   0,  70,  14,  16, 
+      0,   1,   0,   0,   0,  50, 
+      0,   0,  10, 242,   0,  16, 
+      0,   1,   0,   0,   0,  70, 
+    142,  32,   0,   2,   0,   0, 
+      0,   2,   0,   0,   0, 166, 
+     10,  16,   0,   0,   0,   0, 
+      0,  70,  14,  16,   0,   1, 
+      0,   0,   0,  50,   0,   0, 
+     10, 242,  32,  16,   0,   0, 
+      0,   0,   0,  70, 142,  32, 
+      0,   2,   0,   0,   0,   3, 
+      0,   0,   0, 246,  15,  16, 
+      0,   0,   0,   0,   0,  70, 
+     14,  16,   0,   1,   0,   0, 
+      0,  50,   0,   0,  11,  50, 
+     32,  16,   0,   1,   0,   0, 
+      0,  70,  16,  16,   0,   0, 
+      0,   0,   0, 230, 138,  32, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,  70, 128,  32, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,  62,   0,   0, 
+      1,  83,  84,  65,  84, 116, 
+      0,   0,   0,  11,   0,   0, 
+      0,   2,   0,   0,   0,   0, 
+      0,   0,   0,   3,   0,   0, 
+      0,   4,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,  82, 
+     68,  69,  70, 116,   2,   0, 
+      0,   3,   0,   0,   0, 168, 
+      0,   0,   0,   3,   0,   0, 
+      0,  28,   0,   0,   0,   0, 
+      4, 254, 255,   0,   1,   0, 
+      0,  64,   2,   0,   0, 124, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0,   0,   0,   0, 
+      0, 133,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,   1,   0,   0,   0,   0, 
+      0,   0,   0, 152,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   2, 
+      0,   0,   0,   1,   0,   0, 
+      0,   0,   0,   0,   0,  80, 
+    101, 114,  76,  97, 121, 101, 
+    114,   0,  80, 101, 114,  79, 
+     99,  99,  97, 115, 105, 111, 
+    110,  97, 108,  76,  97, 121, 
+    101, 114,   0,  80, 101, 114, 
+     76,  97, 121, 101, 114,  77, 
+     97, 110,  97, 103, 101, 114, 
+      0, 124,   0,   0,   0,   4, 
+      0,   0,   0, 240,   0,   0, 
       0, 112,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0, 133,   0,   0,   0,   2, 
+      0,   0,   0, 188,   1,   0, 
+      0,  32,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0, 152,   0,   0,   0,   1, 
+      0,   0,   0,  28,   2,   0, 
+      0,  64,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,  80,   1,   0,   0,   0, 
+      0,   0,   0,  16,   0,   0, 
+      0,   2,   0,   0,   0,  96, 
+      1,   0,   0,   0,   0,   0, 
+      0, 112,   1,   0,   0,  16, 
+      0,   0,   0,  16,   0,   0, 
+      0,   2,   0,   0,   0,  96, 
+      1,   0,   0,   0,   0,   0, 
+      0, 123,   1,   0,   0,  32, 
       0,   0,   0,   4,   0,   0, 
-      0, 255, 255, 255, 255,   0, 
+      0,   0,   0,   0,   0, 140, 
+      1,   0,   0,   0,   0,   0, 
+      0, 156,   1,   0,   0,  48, 
+      0,   0,   0,  64,   0,   0, 
+      0,   2,   0,   0,   0, 172, 
+      1,   0,   0,   0,   0,   0, 
+      0, 118,  84, 101, 120, 116, 
+    117, 114, 101,  67, 111, 111, 
+    114, 100, 115,   0, 171,   1, 
+      0,   3,   0,   1,   0,   4, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0, 118,  76,  97, 
+    121, 101, 114,  81, 117,  97, 
+    100,   0, 102,  76,  97, 121, 
+    101, 114,  79, 112,  97,  99, 
+    105, 116, 121,   0, 171, 171, 
+    171,   0,   0,   3,   0,   1, 
+      0,   1,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0, 109, 
+     76,  97, 121, 101, 114,  84, 
+    114,  97, 110, 115, 102, 111, 
+    114, 109,   0,   3,   0,   3, 
+      0,   4,   0,   4,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0, 236,   1,   0,   0,   0, 
+      0,   0,   0,  16,   0,   0, 
+      0,   2,   0,   0,   0,   0, 
+      2,   0,   0,   0,   0,   0, 
+      0,  16,   2,   0,   0,  16, 
+      0,   0,   0,  16,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      2,   0,   0,   0,   0,   0, 
+      0, 118,  82, 101, 110, 100, 
+    101, 114,  84,  97, 114, 103, 
+    101, 116,  79, 102, 102, 115, 
+    101, 116,   0,   1,   0,   3, 
+      0,   1,   0,   4,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0, 102,  76,  97, 121, 101, 
+    114,  67, 111, 108, 111, 114, 
+      0,  52,   2,   0,   0,   0, 
+      0,   0,   0,  64,   0,   0, 
+      0,   2,   0,   0,   0, 172, 
+      1,   0,   0,   0,   0,   0, 
+      0, 109,  80, 114, 111, 106, 
+    101,  99, 116, 105, 111, 110, 
+      0,  77, 105,  99, 114, 111, 
+    115, 111, 102, 116,  32,  40, 
+     82,  41,  32,  72,  76,  83, 
+     76,  32,  83, 104,  97, 100, 
+    101, 114,  32,  67, 111, 109, 
+    112, 105, 108, 101, 114,  32, 
+     57,  46,  50,  57,  46,  57, 
+     53,  50,  46,  51,  49,  49, 
+     49,   0, 171, 171, 171,  73, 
+     83,  71,  78,  44,   0,   0, 
+      0,   1,   0,   0,   0,   8, 
+      0,   0,   0,  32,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   3,   0,   0, 
+      0,   0,   0,   0,   0,   3, 
+      3,   0,   0,  80,  79,  83, 
+     73,  84,  73,  79,  78,   0, 
+    171, 171, 171,  79,  83,  71, 
+     78,  80,   0,   0,   0,   2, 
+      0,   0,   0,   8,   0,   0, 
+      0,  56,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,   3,   0,   0,   0,   0, 
+      0,   0,   0,  15,   0,   0, 
+      0,  68,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   3,   0,   0,   0,   1, 
+      0,   0,   0,   3,  12,   0, 
+      0,  83,  86,  95,  80, 111, 
+    115, 105, 116, 105, 111, 110, 
+      0,  84,  69,  88,  67,  79, 
+     79,  82,  68,   0, 171, 171, 
+    171, 227, 101,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,   2,   0,   0,   0,   0, 
+      0,   0,   0, 216,   2,   0, 
+      0,  68,  88,  66,  67, 136, 
+    106,  87,  29, 239,  32, 100, 
+    138, 218,   2, 105,  91, 143, 
+    165, 252,  49,   1,   0,   0, 
+      0, 216,   2,   0,   0,   6, 
+      0,   0,   0,  56,   0,   0, 
+      0, 132,   0,   0,   0, 204, 
+      0,   0,   0,  72,   1,   0, 
+      0,  76,   2,   0,   0, 164, 
+      2,   0,   0,  65, 111, 110, 
+     57,  68,   0,   0,   0,  68, 
+      0,   0,   0,   0,   2, 255, 
+    255,  20,   0,   0,   0,  48, 
+      0,   0,   0,   1,   0,  36, 
       0,   0,   0,  48,   0,   0, 
+      0,  48,   0,   0,   0,  36, 
+      0,   0,   0,  48,   0,   0, 
+      0,   1,   0,   1,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      2, 255, 255,   1,   0,   0, 
+      2,   0,   8,  15, 128,   0, 
+      0, 228, 160, 255, 255,   0, 
+      0,  83,  72,  68,  82,  64, 
+      0,   0,   0,  64,   0,   0, 
+      0,  16,   0,   0,   0,  89, 
+      0,   0,   4,  70, 142,  32, 
+      0,   0,   0,   0,   0,   2, 
+      0,   0,   0, 101,   0,   0, 
+      3, 242,  32,  16,   0,   0, 
+      0,   0,   0,  54,   0,   0, 
+      6, 242,  32,  16,   0,   0, 
+      0,   0,   0,  70, 142,  32, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0,  62,   0,   0, 
+      1,  83,  84,  65,  84, 116, 
+      0,   0,   0,   2,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,  82, 
+     68,  69,  70, 252,   0,   0, 
+      0,   1,   0,   0,   0,  80, 
+      0,   0,   0,   1,   0,   0, 
+      0,  28,   0,   0,   0,   0, 
+      4, 255, 255,   0,   1,   0, 
+      0, 200,   0,   0,   0,  60, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0,   0,   0,   0, 
+      0,  80, 101, 114,  79,  99, 
+     99,  97, 115, 105, 111, 110, 
+     97, 108,  76,  97, 121, 101, 
+    114,   0, 171,  60,   0,   0, 
+      0,   2,   0,   0,   0, 104, 
+      0,   0,   0,  32,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0, 152,   0,   0, 
+      0,   0,   0,   0,   0,  16, 
+      0,   0,   0,   0,   0,   0, 
+      0, 172,   0,   0,   0,   0, 
+      0,   0,   0, 188,   0,   0, 
+      0,  16,   0,   0,   0,  16, 
+      0,   0,   0,   2,   0,   0, 
+      0, 172,   0,   0,   0,   0, 
+      0,   0,   0, 118,  82, 101, 
+    110, 100, 101, 114,  84,  97, 
+    114, 103, 101, 116,  79, 102, 
+    102, 115, 101, 116,   0,   1, 
+      0,   3,   0,   1,   0,   4, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0, 102,  76,  97, 
+    121, 101, 114,  67, 111, 108, 
+    111, 114,   0,  77, 105,  99, 
+    114, 111, 115, 111, 102, 116, 
+     32,  40,  82,  41,  32,  72, 
+     76,  83,  76,  32,  83, 104, 
+     97, 100, 101, 114,  32,  67, 
+    111, 109, 112, 105, 108, 101, 
+    114,  32,  57,  46,  50,  57, 
+     46,  57,  53,  50,  46,  51, 
+     49,  49,  49,   0, 171, 171, 
+    171,  73,  83,  71,  78,  80, 
+      0,   0,   0,   2,   0,   0, 
+      0,   8,   0,   0,   0,  56, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,   3, 
+      0,   0,   0,   0,   0,   0, 
+      0,  15,   0,   0,   0,  68, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   3, 
+      0,   0,   0,   1,   0,   0, 
+      0,   3,   0,   0,   0,  83, 
+     86,  95,  80, 111, 115, 105, 
+    116, 105, 111, 110,   0,  84, 
+     69,  88,  67,  79,  79,  82, 
+     68,   0, 171, 171, 171,  79, 
+     83,  71,  78,  44,   0,   0, 
+      0,   1,   0,   0,   0,   8, 
+      0,   0,   0,  32,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   3,   0,   0, 
+      0,   0,   0,   0,   0,  15, 
+      0,   0,   0,  83,  86,  95, 
+     84,  97, 114, 103, 101, 116, 
+      0, 171, 171, 255, 108,   0, 
+      0,   0,   0,   0,   0,   4, 
+      0,   0,   0, 112,   0,   0, 
+      0,   0,   0,   0,   0,   4, 
+      0,   0,   0, 255, 255, 255, 
+    255,   0,   0,   0,   0,  48, 
+      0,   0,   0,  20,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,  63,   0,   0, 
+      0,  20,   0,   0,   0,   0, 
+      0,   0,   0,  16,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0, 108,   0,   0,   0,  80, 
+      0,   0,   0,   0,   0,   0, 
+      0,  32,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0, 159, 
+      0,   0,   0, 131,   0,   0, 
+      0,   0,   0,   0,   0,  48, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0, 175,   0,   0, 
+      0,  32,   0,   0,   0,   0, 
+      0,   0,   0,   2,   0,   0, 
+      0, 255, 255, 255, 255,   0, 
+      0,   0,   0, 194,   0,   0, 
       0,  20,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
-      0,  63,   0,   0,   0,  20, 
+      0, 214,   0,   0,   0,  20, 
       0,   0,   0,   0,   0,   0, 
       0,  16,   0,   0,   0,   0, 
       0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0, 108, 
-      0,   0,   0,  80,   0,   0, 
-      0,   0,   0,   0,   0,  32, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0, 159,   0,   0, 
-      0, 131,   0,   0,   0,   0, 
-      0,   0,   0,  48,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0, 175,   0,   0,   0,  32, 
-      0,   0,   0,   0,   0,   0, 
-      0,   2,   0,   0,   0, 255, 
-    255, 255, 255,   0,   0,   0, 
-      0, 194,   0,   0,   0,  20, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0, 214, 
-      0,   0,   0,  20,   0,   0, 
-      0,   0,   0,   0,   0,  16, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0, 226,   0,   0, 
-      0,  64,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0, 255, 255, 255, 255,   0, 
-      0,   0,   0, 242,   0,   0, 
-      0, 131,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,  37,   1,   0,   0,   9, 
-      1,   0,   0,   0,   0,   0, 
-      0, 255, 255, 255, 255,   9, 
-      0,   0,   0,  36,   0,   0, 
+      0,   0,   0,   0,   0, 226, 
+      0,   0,   0,  64,   0,   0, 
       0,   0,   0,   0,   0,   1, 
-      0,   0,   0,  44,   1,   0, 
-      0,  37,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,  56,   1,   0,   0,  38, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,  68, 
-      1,   0,   0,  39,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0,  80,   1,   0, 
-      0,  40,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,  92,   1,   0,   0,  41, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 104, 
-      1,   0,   0,  42,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 116,   1,   0, 
-      0,  43,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0, 128,   1,   0,   0,  44, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 140, 
-      1,   0,   0,   0,   0,   0, 
-      0, 152,   1,   0,   0,   9, 
-      1,   0,   0,   0,   0,   0, 
-      0, 255, 255, 255, 255,   9, 
-      0,   0,   0,  36,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 162,   1,   0, 
-      0,  37,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0, 174,   1,   0,   0,  38, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 186, 
-      1,   0,   0,  39,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 198,   1,   0, 
-      0,  40,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0, 210,   1,   0,   0,  41, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 222, 
-      1,   0,   0,  42,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 234,   1,   0, 
-      0,  43,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0, 246,   1,   0,   0,  44, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,   2, 
-      2,   0,   0,   0,   0,   0, 
-      0,  14,   2,   0,   0,   9, 
-      1,   0,   0,   0,   0,   0, 
-      0, 255, 255, 255, 255,   9, 
-      0,   0,   0,  36,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0,  34,   2,   0, 
-      0,  37,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,  46,   2,   0,   0,  38, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,  58, 
-      2,   0,   0,  39,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0,  70,   2,   0, 
-      0,  40,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0,  82,   2,   0,   0,  41, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,  94, 
-      2,   0,   0,  42,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 106,   2,   0, 
-      0,  43,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0, 118,   2,   0,   0,  44, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 130, 
-      2,   0,   0,   0,   0,   0, 
-      0, 186,   2,   0,   0, 158, 
-      2,   0,   0,   0,   0,   0, 
-      0, 255, 255, 255, 255,   2, 
-      0,   0,   0,  19,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 196,   2,   0, 
-      0,  13,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0, 208,   2,   0,   0,   0, 
-      0,   0,   0,   2,   3,   0, 
-      0, 230,   2,   0,   0,   0, 
       0,   0,   0, 255, 255, 255, 
-    255,   0,   0,   0,   0,   7, 
+    255,   0,   0,   0,   0, 242, 
+      0,   0,   0, 131,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,  37,   1,   0, 
+      0,   9,   1,   0,   0,   0, 
+      0,   0,   0, 255, 255, 255, 
+    255,   9,   0,   0,   0,  36, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,  44, 
+      1,   0,   0,  37,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0,  56,   1,   0, 
+      0,  38,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,  68,   1,   0,   0,  39, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,  80, 
+      1,   0,   0,  40,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0,  92,   1,   0, 
+      0,  41,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0, 104,   1,   0,   0,  42, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0, 116, 
+      1,   0,   0,  43,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0, 128,   1,   0, 
+      0,  44,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0, 140,   1,   0,   0,   0, 
+      0,   0,   0, 152,   1,   0, 
+      0,   9,   1,   0,   0,   0, 
+      0,   0,   0, 255, 255, 255, 
+    255,   9,   0,   0,   0,  36, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0, 162, 
+      1,   0,   0,  37,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0, 174,   1,   0, 
+      0,  38,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0, 186,   1,   0,   0,  39, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0, 198, 
+      1,   0,   0,  40,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0, 210,   1,   0, 
+      0,  41,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0, 222,   1,   0,   0,  42, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0, 234, 
+      1,   0,   0,  43,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0, 246,   1,   0, 
+      0,  44,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,   2,   2,   0,   0,   0, 
+      0,   0,   0,  14,   2,   0, 
+      0,   9,   1,   0,   0,   0, 
+      0,   0,   0, 255, 255, 255, 
+    255,   9,   0,   0,   0,  36, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,  34, 
+      2,   0,   0,  37,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0,  46,   2,   0, 
+      0,  38,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,  58,   2,   0,   0,  39, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,  70, 
+      2,   0,   0,  40,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0,  82,   2,   0, 
+      0,  41,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0,  94,   2,   0,   0,  42, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0, 106, 
+      2,   0,   0,  43,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0, 118,   2,   0, 
+      0,  44,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0, 130,   2,   0,   0,   0, 
+      0,   0,   0, 186,   2,   0, 
+      0, 158,   2,   0,   0,   0, 
+      0,   0,   0, 255, 255, 255, 
+    255,   2,   0,   0,   0,  19, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0, 196, 
+      2,   0,   0,  13,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0, 208,   2,   0, 
+      0,   0,   0,   0,   0,   2, 
       3,   0,   0, 230,   2,   0, 
       0,   0,   0,   0,   0, 255, 
     255, 255, 255,   0,   0,   0, 
-      0,  10,   3,   0,   0, 230, 
+      0,   7,   3,   0,   0, 230, 
       2,   0,   0,   0,   0,   0, 
       0, 255, 255, 255, 255,   0, 
-      0,   0,   0,  14,   3,   0, 
+      0,   0,   0,  10,   3,   0, 
       0, 230,   2,   0,   0,   0, 
       0,   0,   0, 255, 255, 255, 
-    255,   0,   0,   0,   0,  18, 
+    255,   0,   0,   0,   0,  14, 
       3,   0,   0, 230,   2,   0, 
       0,   0,   0,   0,   0, 255, 
     255, 255, 255,   0,   0,   0, 
-      0,  69,   3,   0,   0,  41, 
-      3,   0,   0,   0,   0,   0, 
-      0, 255, 255, 255, 255,   3, 
-      0,   0,   0,  45,   0,   0, 
+      0,  18,   3,   0,   0, 230, 
+      2,   0,   0,   0,   0,   0, 
+      0, 255, 255, 255, 255,   0, 
+      0,   0,   0,  69,   3,   0, 
+      0,  41,   3,   0,   0,   0, 
+      0,   0,   0, 255, 255, 255, 
+    255,   3,   0,   0,   0,  45, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0,  95, 
+      3,   0,   0,  46,   0,   0, 
       0,   0,   0,   0,   0,   1, 
-      0,   0,   0,  95,   3,   0, 
-      0,  46,   0,   0,   0,   0, 
+      0,   0,   0, 107,   3,   0, 
+      0,  47,   0,   0,   0,   0, 
       0,   0,   0,   1,   0,   0, 
-      0, 107,   3,   0,   0,  47, 
+      0, 119,   3,   0,   0,   0, 
+      0,   0,   0, 131,   3,   0, 
+      0,  41,   3,   0,   0,   0, 
+      0,   0,   0, 255, 255, 255, 
+    255,   3,   0,   0,   0,  45, 
       0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 119, 
-      3,   0,   0,   0,   0,   0, 
-      0, 131,   3,   0,   0,  41, 
-      3,   0,   0,   0,   0,   0, 
-      0, 255, 255, 255, 255,   3, 
-      0,   0,   0,  45,   0,   0, 
+      0,   1,   0,   0,   0, 156, 
+      3,   0,   0,  46,   0,   0, 
       0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 156,   3,   0, 
-      0,  46,   0,   0,   0,   0, 
+      0,   0,   0, 168,   3,   0, 
+      0,  47,   0,   0,   0,   0, 
       0,   0,   0,   1,   0,   0, 
-      0, 168,   3,   0,   0,  47, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 180, 
-      3,   0,   0,   0,   0,   0, 
-      0, 192,   3,   0,   0,   1, 
-      0,   0,   0,   0,   0,   0, 
-      0, 213,   3,   0,   0,   7, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   2,   0,   0, 
-      0, 186,   2,   0,   0,  10, 
-      0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 216, 
-      3,   0,   0,  11,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 252,   3,   0, 
-      0,   2,   0,   0,   0,   0, 
-      0,   0,   0,   2,   0,   0, 
-      0,  37,   1,   0,   0,   6, 
-      0,   0,   0,   0,   0,   0, 
-      0,   7,   0,   0,   0,  16, 
-     11,   0,   0,   8,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0,  24,  11,   0, 
-      0,   7,   0,   0,   0,   0, 
-      0,   0,   0,   7,   0,   0, 
-      0, 124,  15,   0,   0, 132, 
-     15,   0,   0,   1,   0,   0, 
-      0,   0,   0,   0,   0, 213, 
-      3,   0,   0,   7,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   0,   0,   0,   0,   0, 
-      0,   2,   0,   0,   0, 186, 
-      2,   0,   0,  10,   0,   0, 
-      0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 158,  15,   0, 
-      0,  11,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0, 194,  15,   0,   0,   2, 
-      0,   0,   0,   0,   0,   0, 
-      0,   2,   0,   0,   0,  37, 
-      1,   0,   0,   6,   0,   0, 
-      0,   0,   0,   0,   0,   7, 
-      0,   0,   0, 214,  22,   0, 
-      0,   8,   0,   0,   0,   0, 
-      0,   0,   0,   1,   0,   0, 
-      0, 222,  22,   0,   0,   7, 
-      0,   0,   0,   0,   0,   0, 
-      0,   7,   0,   0,   0,  66, 
-     27,   0,   0,  74,  27,   0, 
+      0, 180,   3,   0,   0,   0, 
+      0,   0,   0, 192,   3,   0, 
       0,   1,   0,   0,   0,   0, 
       0,   0,   0, 213,   3,   0, 
       0,   7,   0,   0,   0,   0, 
@@ -7029,21 +6991,21 @@ const BYTE g_main[] =
       0,   0,   0, 186,   2,   0, 
       0,  10,   0,   0,   0,   0, 
       0,   0,   0,   1,   0,   0, 
-      0,  96,  27,   0,   0,  11, 
+      0, 216,   3,   0,   0,  11, 
       0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 132, 
-     27,   0,   0,   2,   0,   0, 
+      0,   1,   0,   0,   0, 252, 
+      3,   0,   0,   2,   0,   0, 
       0,   0,   0,   0,   0,   2, 
       0,   0,   0,  37,   1,   0, 
       0,   6,   0,   0,   0,   0, 
       0,   0,   0,   7,   0,   0, 
-      0, 152,  34,   0,   0,   8, 
+      0,  16,  11,   0,   0,   8, 
       0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 160, 
-     34,   0,   0,   7,   0,   0, 
+      0,   1,   0,   0,   0,  24, 
+     11,   0,   0,   7,   0,   0, 
       0,   0,   0,   0,   0,   7, 
-      0,   0,   0, 224,  38,   0, 
-      0, 232,  38,   0,   0,   1, 
+      0,   0,   0, 124,  15,   0, 
+      0, 132,  15,   0,   0,   1, 
       0,   0,   0,   0,   0,   0, 
       0, 213,   3,   0,   0,   7, 
       0,   0,   0,   0,   0,   0, 
@@ -7051,22 +7013,22 @@ const BYTE g_main[] =
       0,   0,   0,   2,   0,   0, 
       0, 186,   2,   0,   0,  10, 
       0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0,   1, 
-     39,   0,   0,  11,   0,   0, 
+      0,   1,   0,   0,   0, 158, 
+     15,   0,   0,  11,   0,   0, 
       0,   0,   0,   0,   0,   1, 
-      0,   0,   0,  37,  39,   0, 
+      0,   0,   0, 194,  15,   0, 
       0,   2,   0,   0,   0,   0, 
       0,   0,   0,   2,   0,   0, 
-      0, 152,   1,   0,   0,   6, 
+      0,  37,   1,   0,   0,   6, 
       0,   0,   0,   0,   0,   0, 
-      0,   7,   0,   0,   0,  57, 
-     46,   0,   0,   8,   0,   0, 
+      0,   7,   0,   0,   0, 214, 
+     22,   0,   0,   8,   0,   0, 
       0,   0,   0,   0,   0,   1, 
-      0,   0,   0,  65,  46,   0, 
+      0,   0,   0, 222,  22,   0, 
       0,   7,   0,   0,   0,   0, 
       0,   0,   0,   7,   0,   0, 
-      0, 129,  50,   0,   0, 137, 
-     50,   0,   0,   1,   0,   0, 
+      0,  66,  27,   0,   0,  74, 
+     27,   0,   0,   1,   0,   0, 
       0,   0,   0,   0,   0, 213, 
       3,   0,   0,   7,   0,   0, 
       0,   0,   0,   0,   0,   0, 
@@ -7074,21 +7036,21 @@ const BYTE g_main[] =
       0,   2,   0,   0,   0, 186, 
       2,   0,   0,  10,   0,   0, 
       0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 164,  50,   0, 
+      0,   0,   0,  96,  27,   0, 
       0,  11,   0,   0,   0,   0, 
       0,   0,   0,   1,   0,   0, 
-      0, 200,  50,   0,   0,   2, 
+      0, 132,  27,   0,   0,   2, 
       0,   0,   0,   0,   0,   0, 
       0,   2,   0,   0,   0,  37, 
       1,   0,   0,   6,   0,   0, 
       0,   0,   0,   0,   0,   7, 
-      0,   0,   0, 220,  57,   0, 
+      0,   0,   0, 152,  34,   0, 
       0,   8,   0,   0,   0,   0, 
       0,   0,   0,   1,   0,   0, 
-      0, 228,  57,   0,   0,   7, 
+      0, 160,  34,   0,   0,   7, 
       0,   0,   0,   0,   0,   0, 
-      0,   7,   0,   0,   0,  36, 
-     62,   0,   0,  44,  62,   0, 
+      0,   7,   0,   0,   0, 224, 
+     38,   0,   0, 232,  38,   0, 
       0,   1,   0,   0,   0,   0, 
       0,   0,   0, 213,   3,   0, 
       0,   7,   0,   0,   0,   0, 
@@ -7097,21 +7059,21 @@ const BYTE g_main[] =
       0,   0,   0, 186,   2,   0, 
       0,  10,   0,   0,   0,   0, 
       0,   0,   0,   1,   0,   0, 
-      0,  74,  62,   0,   0,  11, 
+      0,   1,  39,   0,   0,  11, 
       0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 110, 
-     62,   0,   0,   2,   0,   0, 
+      0,   1,   0,   0,   0,  37, 
+     39,   0,   0,   2,   0,   0, 
       0,   0,   0,   0,   0,   2, 
       0,   0,   0, 152,   1,   0, 
       0,   6,   0,   0,   0,   0, 
       0,   0,   0,   7,   0,   0, 
-      0, 130,  69,   0,   0,   8, 
+      0,  57,  46,   0,   0,   8, 
       0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 138, 
-     69,   0,   0,   7,   0,   0, 
+      0,   1,   0,   0,   0,  65, 
+     46,   0,   0,   7,   0,   0, 
       0,   0,   0,   0,   0,   7, 
-      0,   0,   0, 202,  73,   0, 
-      0, 210,  73,   0,   0,   1, 
+      0,   0,   0, 129,  50,   0, 
+      0, 137,  50,   0,   0,   1, 
       0,   0,   0,   0,   0,   0, 
       0, 213,   3,   0,   0,   7, 
       0,   0,   0,   0,   0,   0, 
@@ -7119,22 +7081,22 @@ const BYTE g_main[] =
       0,   0,   0,   2,   0,   0, 
       0, 186,   2,   0,   0,  10, 
       0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 227, 
-     73,   0,   0,  11,   0,   0, 
+      0,   1,   0,   0,   0, 164, 
+     50,   0,   0,  11,   0,   0, 
       0,   0,   0,   0,   0,   1, 
-      0,   0,   0,   7,  74,   0, 
+      0,   0,   0, 200,  50,   0, 
       0,   2,   0,   0,   0,   0, 
       0,   0,   0,   2,   0,   0, 
       0,  37,   1,   0,   0,   6, 
       0,   0,   0,   0,   0,   0, 
-      0,   7,   0,   0,   0,  27, 
-     81,   0,   0,   8,   0,   0, 
+      0,   7,   0,   0,   0, 220, 
+     57,   0,   0,   8,   0,   0, 
       0,   0,   0,   0,   0,   1, 
-      0,   0,   0,  35,  81,   0, 
+      0,   0,   0, 228,  57,   0, 
       0,   7,   0,   0,   0,   0, 
       0,   0,   0,   7,   0,   0, 
-      0, 115,  88,   0,   0, 123, 
-     88,   0,   0,   1,   0,   0, 
+      0,  36,  62,   0,   0,  44, 
+     62,   0,   0,   1,   0,   0, 
       0,   0,   0,   0,   0, 213, 
       3,   0,   0,   7,   0,   0, 
       0,   0,   0,   0,   0,   0, 
@@ -7142,21 +7104,21 @@ const BYTE g_main[] =
       0,   2,   0,   0,   0, 186, 
       2,   0,   0,  10,   0,   0, 
       0,   0,   0,   0,   0,   1, 
-      0,   0,   0, 149,  88,   0, 
+      0,   0,   0,  74,  62,   0, 
       0,  11,   0,   0,   0,   0, 
       0,   0,   0,   1,   0,   0, 
-      0, 185,  88,   0,   0,   2, 
+      0, 110,  62,   0,   0,   2, 
       0,   0,   0,   0,   0,   0, 
-      0,   2,   0,   0,   0,  14, 
-      2,   0,   0,   6,   0,   0, 
+      0,   2,   0,   0,   0, 152, 
+      1,   0,   0,   6,   0,   0, 
       0,   0,   0,   0,   0,   7, 
-      0,   0,   0, 205,  95,   0, 
+      0,   0,   0, 130,  69,   0, 
       0,   8,   0,   0,   0,   0, 
       0,   0,   0,   1,   0,   0, 
-      0, 213,  95,   0,   0,   7, 
+      0, 138,  69,   0,   0,   7, 
       0,   0,   0,   0,   0,   0, 
-      0,   7,   0,   0,   0, 117, 
-    101,   0,   0, 125, 101,   0, 
+      0,   7,   0,   0,   0, 202, 
+     73,   0,   0, 210,  73,   0, 
       0,   1,   0,   0,   0,   0, 
       0,   0,   0, 213,   3,   0, 
       0,   7,   0,   0,   0,   0, 
@@ -7165,19 +7127,64 @@ const BYTE g_main[] =
       0,   0,   0, 186,   2,   0, 
       0,  10,   0,   0,   0,   0, 
       0,   0,   0,   1,   0,   0, 
-      0, 147, 101,   0,   0,  11, 
+      0, 227,  73,   0,   0,  11, 
       0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 183, 
-    101,   0,   0,   2,   0,   0, 
+      0,   1,   0,   0,   0,   7, 
+     74,   0,   0,   2,   0,   0, 
       0,   0,   0,   0,   0,   2, 
       0,   0,   0,  37,   1,   0, 
       0,   6,   0,   0,   0,   0, 
       0,   0,   0,   7,   0,   0, 
-      0, 203, 108,   0,   0,   8, 
+      0,  27,  81,   0,   0,   8, 
       0,   0,   0,   0,   0,   0, 
-      0,   1,   0,   0,   0, 211, 
-    108,   0,   0,   7,   0,   0, 
+      0,   1,   0,   0,   0,  35, 
+     81,   0,   0,   7,   0,   0, 
       0,   0,   0,   0,   0,   7, 
-      0,   0,   0, 187, 111,   0, 
-      0
+      0,   0,   0, 115,  88,   0, 
+      0, 123,  88,   0,   0,   1, 
+      0,   0,   0,   0,   0,   0, 
+      0, 213,   3,   0,   0,   7, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   2,   0,   0, 
+      0, 186,   2,   0,   0,  10, 
+      0,   0,   0,   0,   0,   0, 
+      0,   1,   0,   0,   0, 149, 
+     88,   0,   0,  11,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0, 185,  88,   0, 
+      0,   2,   0,   0,   0,   0, 
+      0,   0,   0,   2,   0,   0, 
+      0,  14,   2,   0,   0,   6, 
+      0,   0,   0,   0,   0,   0, 
+      0,   7,   0,   0,   0, 205, 
+     95,   0,   0,   8,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0, 213,  95,   0, 
+      0,   7,   0,   0,   0,   0, 
+      0,   0,   0,   7,   0,   0, 
+      0, 149, 101,   0,   0, 157, 
+    101,   0,   0,   1,   0,   0, 
+      0,   0,   0,   0,   0, 213, 
+      3,   0,   0,   7,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   0,   0,   0,   0,   0, 
+      0,   2,   0,   0,   0, 186, 
+      2,   0,   0,  10,   0,   0, 
+      0,   0,   0,   0,   0,   1, 
+      0,   0,   0, 179, 101,   0, 
+      0,  11,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0, 215, 101,   0,   0,   2, 
+      0,   0,   0,   0,   0,   0, 
+      0,   2,   0,   0,   0,  37, 
+      1,   0,   0,   6,   0,   0, 
+      0,   0,   0,   0,   0,   7, 
+      0,   0,   0, 235, 108,   0, 
+      0,   8,   0,   0,   0,   0, 
+      0,   0,   0,   1,   0,   0, 
+      0, 243, 108,   0,   0,   7, 
+      0,   0,   0,   0,   0,   0, 
+      0,   7,   0,   0,   0, 219, 
+    111,   0,   0
 };
diff --git a/gfx/ots/src/Makefile.in b/gfx/ots/src/Makefile.in
index 84b42f4a75d7..ee40cb6a182b 100644
--- a/gfx/ots/src/Makefile.in
+++ b/gfx/ots/src/Makefile.in
@@ -79,8 +79,6 @@ EXPORTS = \
 LOCAL_INCLUDES  += -I$(srcdir) 
 
 FORCE_STATIC_LIB = 1
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/gfx/qcms/Makefile.in b/gfx/qcms/Makefile.in
index e6612f18789e..8424b8a60262 100644
--- a/gfx/qcms/Makefile.in
+++ b/gfx/qcms/Makefile.in
@@ -56,8 +56,6 @@ endif
 CFLAGS := $(filter-out -pedantic,$(CFLAGS))
 
 FORCE_STATIC_LIB = 1
-# This library is used by other shared libs
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/gfx/qcms/iccread.c b/gfx/qcms/iccread.c
index ff0572fea421..5bd12a2267d3 100644
--- a/gfx/qcms/iccread.c
+++ b/gfx/qcms/iccread.c
@@ -402,11 +402,11 @@ static struct XYZNumber read_tag_XYZType(struct mem_source *src, struct tag_inde
 // present that are not part of the tag_index.
 static struct curveType *read_curveType(struct mem_source *src, uint32_t offset, uint32_t *len)
 {
-	static const size_t COUNT_TO_LENGTH[5] = {1, 3, 4, 5, 7};
+	static const uint32_t COUNT_TO_LENGTH[5] = {1, 3, 4, 5, 7};
 	struct curveType *curve = NULL;
 	uint32_t type = read_u32(src, offset);
 	uint32_t count;
-	int i;
+	uint32_t i;
 
 	if (type != CURVE_TYPE && type != PARAMETRIC_CURVE_TYPE) {
 		invalid_source(src, "unexpected type, expected CURV or PARA");
diff --git a/gfx/src/Makefile.in b/gfx/src/Makefile.in
index 988cca885343..d35d86b48edd 100644
--- a/gfx/src/Makefile.in
+++ b/gfx/src/Makefile.in
@@ -49,8 +49,6 @@ EXPORT_LIBRARY = 1
 GRE_MODULE     = 1
 LIBXUL_LIBRARY = 1
 IS_COMPONENT   = 1
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC  = 1
 
 XPIDLSRCS = \
 	nsIFontEnumerator.idl \
@@ -109,6 +107,10 @@ ifeq ($(MOZ_WIDGET_TOOLKIT),android)
 CPPSRCS += nsSystemFontsAndroid.cpp
 endif
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),gonk)
+CPPSRCS += nsSystemFontsAndroid.cpp
+endif
+
 ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
 CMMSRCS = nsSystemFontsMac.mm
 endif
diff --git a/gfx/src/nsDeviceContext.cpp b/gfx/src/nsDeviceContext.cpp
index b6122b16b283..f80def5c3117 100644
--- a/gfx/src/nsDeviceContext.cpp
+++ b/gfx/src/nsDeviceContext.cpp
@@ -76,7 +76,11 @@ static nsSystemFontsMac *gSystemFonts = nsnull;
 #include "nsSystemFontsQt.h"
 #include "gfxPDFSurface.h"
 static nsSystemFontsQt *gSystemFonts = nsnull;
-#elif defined(ANDROID)
+#elif defined(MOZ_WIDGET_ANDROID)
+#include "nsSystemFontsAndroid.h"
+#include "gfxPDFSurface.h"
+static nsSystemFontsAndroid *gSystemFonts = nsnull;
+#elif defined(MOZ_WIDGET_GONK)
 #include "nsSystemFontsAndroid.h"
 #include "gfxPDFSurface.h"
 static nsSystemFontsAndroid *gSystemFonts = nsnull;
diff --git a/gfx/thebes/GLContextProviderEGL.cpp b/gfx/thebes/GLContextProviderEGL.cpp
index b9c27b9365fa..3a5d4c148f4f 100644
--- a/gfx/thebes/GLContextProviderEGL.cpp
+++ b/gfx/thebes/GLContextProviderEGL.cpp
@@ -52,6 +52,8 @@
 #define GLdouble_defined 1
 // we're using default display for now
 #define GET_NATIVE_WINDOW(aWidget) (EGLNativeWindowType)static_cast<QWidget*>(aWidget->GetNativeData(NS_NATIVE_SHELLWIDGET))->winId()
+#elif defined(MOZ_WIDGET_GONK)
+#define GET_NATIVE_WINDOW(aWidget) ((EGLNativeWindowType)aWidget->GetNativeData(NS_NATIVE_WINDOW))
 #endif
 
 #if defined(MOZ_X11)
@@ -63,7 +65,10 @@
 
 #if defined(ANDROID)
 /* from widget */
+#if defined(MOZ_WIDGET_ANDROID)
 #include "AndroidBridge.h"
+#endif
+#include <android/log.h>
 #define EGL_LIB "/system/lib/libEGL.so"
 #define GLES2_LIB "/system/lib/libGLESv2.so"
 #else
@@ -156,6 +161,10 @@ static bool gUseBackingSurface = true;
 static bool gUseBackingSurface = false;
 #endif
 
+#ifdef MOZ_WIDGET_GONK
+extern nsIntRect gScreenBounds;
+#endif
+
 namespace mozilla {
 namespace gl {
 
@@ -300,6 +309,10 @@ public:
     pfnCreateImageKHR fCreateImageKHR;
     typedef EGLBoolean (GLAPIENTRY * pfnDestroyImageKHR)(EGLDisplay dpy, EGLImageKHR image);
     pfnDestroyImageKHR fDestroyImageKHR;
+#ifdef MOZ_WIDGET_GONK
+    typedef EGLBoolean (GLAPIENTRY * pfnSetSwapRectangleANDROID)(EGLDisplay dpy, EGLSurface surface, EGLint left, EGLint top, EGLint width, EGLint height);
+    pfnSetSwapRectangleANDROID fSetSwapRectangleANDROID;
+#endif
 
     // New extension which allow us to lock texture and get raw image pointer
     typedef EGLBoolean (GLAPIENTRY * pfnLockSurfaceKHR)(EGLDisplay dpy, EGLSurface surface, const EGLint *attrib_list);
@@ -396,6 +409,9 @@ public:
             SYMBOL(BindTexImage),
             SYMBOL(ReleaseTexImage),
             SYMBOL(QuerySurface),
+#ifdef MOZ_WIDGET_GONK
+            SYMBOL(SetSwapRectangleANDROID),
+#endif
             { NULL, { NULL } }
         };
 
@@ -596,7 +612,7 @@ public:
         fGetConfigs(mEGLDisplay, ec, nc, &nc);
 
         for (int i = 0; i < nc; ++i) {
-            printf_stderr ("========= EGL Config %d ========\n");
+            printf_stderr ("========= EGL Config %d ========\n", i);
             DumpEGLConfig(ec[i]);
         }
 
@@ -869,6 +885,7 @@ public:
     bool SwapBuffers()
     {
         if (mSurface && !mPlatformContext) {
+            //sEGLLibrary.fSetSwapRectangleANDROID(EGL_DISPLAY(), mSurface, 0, 0, gScreenBounds.width, gScreenBounds.height);
             return sEGLLibrary.fSwapBuffers(EGL_DISPLAY(), mSurface);
         } else {
             return false;
@@ -1874,7 +1891,7 @@ CreateSurfaceForWindow(nsIWidget *aWidget, EGLConfig config)
     sEGLLibrary.DumpEGLConfig(config);
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     // On Android, we have to ask Java to make the eglCreateWindowSurface
     // call for us.  See GLHelpers.java for a description of why.
     //
@@ -1889,6 +1906,13 @@ CreateSurfaceForWindow(nsIWidget *aWidget, EGLConfig config)
     surface = sEGLLibrary.fCreateWindowSurface(EGL_DISPLAY(), config, GET_NATIVE_WINDOW(aWidget), 0);
 #endif
 
+#ifdef MOZ_WIDGET_GONK
+    gScreenBounds.x = 0;
+    gScreenBounds.y = 0;
+    sEGLLibrary.fQuerySurface(EGL_DISPLAY(), surface, LOCAL_EGL_WIDTH, &gScreenBounds.width);
+    sEGLLibrary.fQuerySurface(EGL_DISPLAY(), surface, LOCAL_EGL_HEIGHT, &gScreenBounds.height);
+#endif
+
     return surface;
 }
 
diff --git a/gfx/thebes/Makefile.in b/gfx/thebes/Makefile.in
index 774b30baaa46..ed7ddd2aff41 100644
--- a/gfx/thebes/Makefile.in
+++ b/gfx/thebes/Makefile.in
@@ -64,6 +64,14 @@ EXPORTS += \
 	$(NULL)
 endif
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),gonk)
+EXPORTS += \
+	gfxAndroidPlatform.h \
+	gfxFT2Fonts.h \
+	gfxFT2FontBase.h \
+	$(NULL)
+endif
+
 ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
 EXPORTS += \
 	gfxPlatformMac.h \
@@ -242,6 +250,21 @@ CPPSRCS += \
 	$(NULL)
 endif
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),gonk)
+EXPORTS	+= \
+	gfxPDFSurface.h \
+	$(NULL)
+CPPSRCS += \
+	gfxAndroidPlatform.cpp \
+	gfxFT2Fonts.cpp \
+	gfxFT2FontBase.cpp \
+	gfxFT2Utils.cpp \
+	gfxFT2FontList.cpp \
+	gfxPDFSurface.cpp \
+	nsUnicodeRange.cpp \
+	$(NULL)
+endif
+
 ifeq ($(MOZ_WIDGET_TOOLKIT),os2)
 CPPSRCS	+=	gfxOS2Fonts.cpp \
 		gfxOS2Platform.cpp \
@@ -354,6 +377,10 @@ ifeq ($(MOZ_WIDGET_TOOLKIT),android)
 GL_PROVIDER = EGL
 endif
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),gonk)
+GL_PROVIDER = EGL
+endif
+
 # Mac is a special snowflake
 ifeq ($(GL_PROVIDER),CGL)
 CMMSRCS += GLContextProvider$(GL_PROVIDER).mm
@@ -380,6 +407,10 @@ ifeq ($(MOZ_WIDGET_TOOLKIT),android)
 CXXFLAGS += $(CAIRO_FT_CFLAGS)
 endif
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),gonk)
+CXXFLAGS += $(CAIRO_FT_CFLAGS)
+endif
+
 ifeq ($(MOZ_WIDGET_TOOLKIT),gtk2)
 CXXFLAGS += $(MOZ_PANGO_CFLAGS)
 endif
diff --git a/gfx/thebes/gfxBlur.cpp b/gfx/thebes/gfxBlur.cpp
index 26e18fb108ec..cd9fffc6b5b4 100644
--- a/gfx/thebes/gfxBlur.cpp
+++ b/gfx/thebes/gfxBlur.cpp
@@ -37,14 +37,12 @@
 
 #include "gfxBlur.h"
 
-#include "nsMathUtils.h"
-#include "nsTArray.h"
+#include "mozilla/gfx/Blur.h"
 
-#ifndef M_PI
-#define M_PI 3.14159265358979323846
-#endif
+using namespace mozilla::gfx;
 
 gfxAlphaBoxBlur::gfxAlphaBoxBlur()
+ : mBlur(nsnull)
 {
 }
 
@@ -59,418 +57,63 @@ gfxAlphaBoxBlur::Init(const gfxRect& aRect,
                       const gfxRect* aDirtyRect,
                       const gfxRect* aSkipRect)
 {
-    mSpreadRadius = aSpreadRadius;
-    mBlurRadius = aBlurRadius;
-
-    gfxRect rect(aRect);
-    rect.Inflate(aBlurRadius + aSpreadRadius);
-    rect.RoundOut();
-
+    Rect rect(aRect.x, aRect.y, aRect.width, aRect.height);
+    IntSize spreadRadius(aSpreadRadius.width, aSpreadRadius.height);
+    IntSize blurRadius(aBlurRadius.width, aBlurRadius.height);
+    nsAutoPtr<Rect> dirtyRect;
     if (aDirtyRect) {
-        // If we get passed a dirty rect from layout, we can minimize the
-        // shadow size and make painting faster.
-        mHasDirtyRect = true;
-        mDirtyRect = *aDirtyRect;
-        gfxRect requiredBlurArea = mDirtyRect.Intersect(rect);
-        requiredBlurArea.Inflate(aBlurRadius + aSpreadRadius);
-        rect = requiredBlurArea.Intersect(rect);
-    } else {
-        mHasDirtyRect = false;
+      dirtyRect = new Rect(aDirtyRect->x, aDirtyRect->y, aDirtyRect->width, aDirtyRect->height);
     }
-
-    // Check rect empty after accounting for aDirtyRect, since that may have
-    // make the rectangle empty. BoxBlurVertical and BoxBlurHorizontal require
-    // that we have a nonzero number of rows and columns.
-    if (rect.IsEmpty())
-        return nsnull;
-
+    nsAutoPtr<Rect> skipRect;
     if (aSkipRect) {
-        // If we get passed a skip rect, we can lower the amount of
-        // blurring/spreading we need to do. We convert it to nsIntRect to avoid
-        // expensive int<->float conversions if we were to use gfxRect instead.
-        gfxRect skipRect = *aSkipRect;
-        skipRect.RoundIn();
-        skipRect.Deflate(aBlurRadius + aSpreadRadius);
-        gfxUtils::GfxRectToIntRect(skipRect, &mSkipRect);
-        nsIntRect shadowIntRect;
-        gfxUtils::GfxRectToIntRect(rect, &shadowIntRect);
-        mSkipRect.IntersectRect(mSkipRect, shadowIntRect);
-        if (mSkipRect.IsEqualInterior(shadowIntRect))
-          return nsnull;
-
-        mSkipRect -= shadowIntRect.TopLeft();
-    } else {
-        mSkipRect = nsIntRect(0, 0, 0, 0);
+      skipRect = new Rect(aSkipRect->x, aSkipRect->y, aSkipRect->width, aSkipRect->height);
     }
 
+    mBlur = new AlphaBoxBlur(rect, spreadRadius, blurRadius, dirtyRect, skipRect);
+
+    unsigned char* data = mBlur->GetData();
+    if (!data)
+      return nsnull;
+
+    IntSize size = mBlur->GetSize();
     // Make an alpha-only surface to draw on. We will play with the data after
     // everything is drawn to create a blur effect.
-    mImageSurface = new gfxImageSurface(gfxIntSize(static_cast<PRInt32>(rect.Width()), static_cast<PRInt32>(rect.Height())),
+    mImageSurface = new gfxImageSurface(data, gfxIntSize(size.width, size.height),
+                                        mBlur->GetStride(),
                                         gfxASurface::ImageFormatA8);
-    if (!mImageSurface || mImageSurface->CairoStatus())
+    if (mImageSurface->CairoStatus())
         return nsnull;
 
+    IntRect irect = mBlur->GetRect();
+    gfxPoint topleft(irect.TopLeft().x, irect.TopLeft().y);
+
     // Use a device offset so callers don't need to worry about translating
     // coordinates, they can draw as if this was part of the destination context
     // at the coordinates of rect.
-    mImageSurface->SetDeviceOffset(-rect.TopLeft());
+    mImageSurface->SetDeviceOffset(-topleft);
 
     mContext = new gfxContext(mImageSurface);
 
     return mContext;
 }
 
-/**
- * Box blur involves looking at one pixel, and setting its value to the average
- * of its neighbouring pixels.
- * @param aInput The input buffer.
- * @param aOutput The output buffer.
- * @param aLeftLobe The number of pixels to blend on the left.
- * @param aRightLobe The number of pixels to blend on the right.
- * @param aWidth The number of columns in the buffers.
- * @param aRows The number of rows in the buffers.
- * @param aSkipRect An area to skip blurring in.
- * XXX shouldn't we pass stride in separately here?
- */
-static void
-BoxBlurHorizontal(unsigned char* aInput,
-                  unsigned char* aOutput,
-                  PRInt32 aLeftLobe,
-                  PRInt32 aRightLobe,
-                  PRInt32 aWidth,
-                  PRInt32 aRows,
-                  const nsIntRect& aSkipRect)
-{
-    NS_ASSERTION(aWidth > 0, "Can't handle zero width here");
-
-    PRInt32 boxSize = aLeftLobe + aRightLobe + 1;
-    bool skipRectCoversWholeRow = 0 >= aSkipRect.x &&
-                                    aWidth <= aSkipRect.XMost();
-    if (boxSize == 1) {
-        memcpy(aOutput, aInput, aWidth*aRows);
-        return;
-    }
-    PRUint32 reciprocal = (PRUint64(1) << 32)/boxSize;
-
-    for (PRInt32 y = 0; y < aRows; y++) {
-        // Check whether the skip rect intersects this row. If the skip
-        // rect covers the whole surface in this row, we can avoid
-        // this row entirely (and any others along the skip rect).
-        bool inSkipRectY = y >= aSkipRect.y &&
-                             y < aSkipRect.YMost();
-        if (inSkipRectY && skipRectCoversWholeRow) {
-            y = aSkipRect.YMost() - 1;
-            continue;
-        }
-
-        PRUint32 alphaSum = 0;
-        for (PRInt32 i = 0; i < boxSize; i++) {
-            PRInt32 pos = i - aLeftLobe;
-            // See assertion above; if aWidth is zero, then we would have no
-            // valid position to clamp to.
-            pos = NS_MAX(pos, 0);
-            pos = NS_MIN(pos, aWidth - 1);
-            alphaSum += aInput[aWidth * y + pos];
-        }
-        for (PRInt32 x = 0; x < aWidth; x++) {
-            // Check whether we are within the skip rect. If so, go
-            // to the next point outside the skip rect.
-            if (inSkipRectY && x >= aSkipRect.x &&
-                x < aSkipRect.XMost()) {
-                x = aSkipRect.XMost();
-                if (x >= aWidth)
-                    break;
-
-                // Recalculate the neighbouring alpha values for
-                // our new point on the surface.
-                alphaSum = 0;
-                for (PRInt32 i = 0; i < boxSize; i++) {
-                    PRInt32 pos = x + i - aLeftLobe;
-                    // See assertion above; if aWidth is zero, then we would have no
-                    // valid position to clamp to.
-                    pos = NS_MAX(pos, 0);
-                    pos = NS_MIN(pos, aWidth - 1);
-                    alphaSum += aInput[aWidth * y + pos];
-                }
-            }
-            PRInt32 tmp = x - aLeftLobe;
-            PRInt32 last = NS_MAX(tmp, 0);
-            PRInt32 next = NS_MIN(tmp + boxSize, aWidth - 1);
-
-            aOutput[aWidth * y + x] = (PRUint64(alphaSum)*reciprocal) >> 32;
-
-            alphaSum += aInput[aWidth * y + next] -
-                        aInput[aWidth * y + last];
-        }
-    }
-}
-
-/**
- * Identical to BoxBlurHorizontal, except it blurs top and bottom instead of
- * left and right.
- * XXX shouldn't we pass stride in separately here?
- */
-static void
-BoxBlurVertical(unsigned char* aInput,
-                unsigned char* aOutput,
-                PRInt32 aTopLobe,
-                PRInt32 aBottomLobe,
-                PRInt32 aWidth,
-                PRInt32 aRows,
-                const nsIntRect& aSkipRect)
-{
-    NS_ASSERTION(aRows > 0, "Can't handle zero rows here");
-
-    PRInt32 boxSize = aTopLobe + aBottomLobe + 1;
-    bool skipRectCoversWholeColumn = 0 >= aSkipRect.y &&
-                                       aRows <= aSkipRect.YMost();
-    if (boxSize == 1) {
-        memcpy(aOutput, aInput, aWidth*aRows);
-        return;
-    }
-    PRUint32 reciprocal = (PRUint64(1) << 32)/boxSize;
-
-    for (PRInt32 x = 0; x < aWidth; x++) {
-        bool inSkipRectX = x >= aSkipRect.x &&
-                             x < aSkipRect.XMost();
-        if (inSkipRectX && skipRectCoversWholeColumn) {
-            x = aSkipRect.XMost() - 1;
-            continue;
-        }
-
-        PRUint32 alphaSum = 0;
-        for (PRInt32 i = 0; i < boxSize; i++) {
-            PRInt32 pos = i - aTopLobe;
-            // See assertion above; if aRows is zero, then we would have no
-            // valid position to clamp to.
-            pos = NS_MAX(pos, 0);
-            pos = NS_MIN(pos, aRows - 1);
-            alphaSum += aInput[aWidth * pos + x];
-        }
-        for (PRInt32 y = 0; y < aRows; y++) {
-            if (inSkipRectX && y >= aSkipRect.y &&
-                y < aSkipRect.YMost()) {
-                y = aSkipRect.YMost();
-                if (y >= aRows)
-                    break;
-
-                alphaSum = 0;
-                for (PRInt32 i = 0; i < boxSize; i++) {
-                    PRInt32 pos = y + i - aTopLobe;
-                    // See assertion above; if aRows is zero, then we would have no
-                    // valid position to clamp to.
-                    pos = NS_MAX(pos, 0);
-                    pos = NS_MIN(pos, aRows - 1);
-                    alphaSum += aInput[aWidth * pos + x];
-                }
-            }
-            PRInt32 tmp = y - aTopLobe;
-            PRInt32 last = NS_MAX(tmp, 0);
-            PRInt32 next = NS_MIN(tmp + boxSize, aRows - 1);
-
-            aOutput[aWidth * y + x] = (PRUint64(alphaSum)*reciprocal) >> 32;
-
-            alphaSum += aInput[aWidth * next + x] -
-                        aInput[aWidth * last + x];
-        }
-    }
-}
-
-static void ComputeLobes(PRInt32 aRadius, PRInt32 aLobes[3][2])
-{
-    PRInt32 major, minor, final;
-
-    /* See http://www.w3.org/TR/SVG/filters.html#feGaussianBlur for
-     * some notes about approximating the Gaussian blur with box-blurs.
-     * The comments below are in the terminology of that page.
-     */
-    PRInt32 z = aRadius/3;
-    switch (aRadius % 3) {
-    case 0:
-        // aRadius = z*3; choose d = 2*z + 1
-        major = minor = final = z;
-        break;
-    case 1:
-        // aRadius = z*3 + 1
-        // This is a tricky case since there is no value of d which will
-        // yield a radius of exactly aRadius. If d is odd, i.e. d=2*k + 1
-        // for some integer k, then the radius will be 3*k. If d is even,
-        // i.e. d=2*k, then the radius will be 3*k - 1.
-        // So we have to choose values that don't match the standard
-        // algorithm.
-        major = z + 1;
-        minor = final = z;
-        break;
-    case 2:
-        // aRadius = z*3 + 2; choose d = 2*z + 2
-        major = final = z + 1;
-        minor = z;
-        break;
-    default:
-        NS_ERROR("Mathematical impossibility.");
-        major = minor = final = 0;
-    }
-    NS_ASSERTION(major + minor + final == aRadius,
-                 "Lobes don't sum to the right length");
-
-    aLobes[0][0] = major;
-    aLobes[0][1] = minor;
-    aLobes[1][0] = minor;
-    aLobes[1][1] = major;
-    aLobes[2][0] = final;
-    aLobes[2][1] = final;
-}
-
-static void
-SpreadHorizontal(unsigned char* aInput,
-                 unsigned char* aOutput,
-                 PRInt32 aRadius,
-                 PRInt32 aWidth,
-                 PRInt32 aRows,
-                 PRInt32 aStride,
-                 const nsIntRect& aSkipRect)
-{
-    if (aRadius == 0) {
-        memcpy(aOutput, aInput, aStride*aRows);
-        return;
-    }
-
-    bool skipRectCoversWholeRow = 0 >= aSkipRect.x &&
-                                    aWidth <= aSkipRect.XMost();
-    for (PRInt32 y = 0; y < aRows; y++) {
-        // Check whether the skip rect intersects this row. If the skip
-        // rect covers the whole surface in this row, we can avoid
-        // this row entirely (and any others along the skip rect).
-        bool inSkipRectY = y >= aSkipRect.y &&
-                             y < aSkipRect.YMost();
-        if (inSkipRectY && skipRectCoversWholeRow) {
-            y = aSkipRect.YMost() - 1;
-            continue;
-        }
-
-        for (PRInt32 x = 0; x < aWidth; x++) {
-            // Check whether we are within the skip rect. If so, go
-            // to the next point outside the skip rect.
-            if (inSkipRectY && x >= aSkipRect.x &&
-                x < aSkipRect.XMost()) {
-                x = aSkipRect.XMost();
-                if (x >= aWidth)
-                    break;
-            }
-
-            PRInt32 sMin = NS_MAX(x - aRadius, 0);
-            PRInt32 sMax = NS_MIN(x + aRadius, aWidth - 1);
-            PRInt32 v = 0;
-            for (PRInt32 s = sMin; s <= sMax; ++s) {
-                v = NS_MAX<PRInt32>(v, aInput[aStride * y + s]);
-            }
-            aOutput[aStride * y + x] = v;
-        }
-    }
-}
-
-static void
-SpreadVertical(unsigned char* aInput,
-               unsigned char* aOutput,
-               PRInt32 aRadius,
-               PRInt32 aWidth,
-               PRInt32 aRows,
-               PRInt32 aStride,
-               const nsIntRect& aSkipRect)
-{
-    if (aRadius == 0) {
-        memcpy(aOutput, aInput, aStride*aRows);
-        return;
-    }
-
-    bool skipRectCoversWholeColumn = 0 >= aSkipRect.y &&
-                                       aRows <= aSkipRect.YMost();
-    for (PRInt32 x = 0; x < aWidth; x++) {
-        bool inSkipRectX = x >= aSkipRect.x &&
-                             x < aSkipRect.XMost();
-        if (inSkipRectX && skipRectCoversWholeColumn) {
-            x = aSkipRect.XMost() - 1;
-            continue;
-        }
-
-        for (PRInt32 y = 0; y < aRows; y++) {
-            // Check whether we are within the skip rect. If so, go
-            // to the next point outside the skip rect.
-            if (inSkipRectX && y >= aSkipRect.y &&
-                y < aSkipRect.YMost()) {
-                y = aSkipRect.YMost();
-                if (y >= aRows)
-                    break;
-            }
-
-            PRInt32 sMin = NS_MAX(y - aRadius, 0);
-            PRInt32 sMax = NS_MIN(y + aRadius, aRows - 1);
-            PRInt32 v = 0;
-            for (PRInt32 s = sMin; s <= sMax; ++s) {
-                v = NS_MAX<PRInt32>(v, aInput[aStride * s + x]);
-            }
-            aOutput[aStride * y + x] = v;
-        }
-    }
-}
-
 void
 gfxAlphaBoxBlur::Paint(gfxContext* aDestinationCtx, const gfxPoint& offset)
 {
     if (!mContext)
         return;
 
-    unsigned char* boxData = mImageSurface->Data();
+    mBlur->Blur();
 
-    // no need to do all this if not blurring or spreading
-    if (mBlurRadius != gfxIntSize(0,0) || mSpreadRadius != gfxIntSize(0,0)) {
-        nsTArray<unsigned char> tempAlphaDataBuf;
-        PRSize szB = mImageSurface->GetDataSize();
-        if (!tempAlphaDataBuf.SetLength(szB))
-           return; // OOM
-
-        unsigned char* tmpData = tempAlphaDataBuf.Elements();
-        // .SetLength above doesn't initialise the new elements since
-        // they are unsigned chars and so have no default constructor.
-        // So we have to initialise them by hand.
-        memset(tmpData, 0, szB);
-
-        PRInt32 stride = mImageSurface->Stride();
-        PRInt32 rows = mImageSurface->Height();
-        PRInt32 width = mImageSurface->Width();
-
-        if (mSpreadRadius.width > 0 || mSpreadRadius.height > 0) {
-            SpreadHorizontal(boxData, tmpData, mSpreadRadius.width, width, rows, stride, mSkipRect);
-            SpreadVertical(tmpData, boxData, mSpreadRadius.height, width, rows, stride, mSkipRect);
-        }
-
-        if (mBlurRadius.width > 0) {
-            PRInt32 lobes[3][2];
-            ComputeLobes(mBlurRadius.width, lobes);
-            BoxBlurHorizontal(boxData, tmpData, lobes[0][0], lobes[0][1], stride, rows, mSkipRect);
-            BoxBlurHorizontal(tmpData, boxData, lobes[1][0], lobes[1][1], stride, rows, mSkipRect);
-            BoxBlurHorizontal(boxData, tmpData, lobes[2][0], lobes[2][1], stride, rows, mSkipRect);
-        } else {
-            memcpy(tmpData, boxData, stride*rows);
-        }
-
-        if (mBlurRadius.height > 0) {
-            PRInt32 lobes[3][2];
-            ComputeLobes(mBlurRadius.height, lobes);
-            BoxBlurVertical(tmpData, boxData, lobes[0][0], lobes[0][1], stride, rows, mSkipRect);
-            BoxBlurVertical(boxData, tmpData, lobes[1][0], lobes[1][1], stride, rows, mSkipRect);
-            BoxBlurVertical(tmpData, boxData, lobes[2][0], lobes[2][1], stride, rows, mSkipRect);
-        } else {
-            memcpy(boxData, tmpData, stride*rows);
-        }
-    }
+    Rect* dirtyrect = mBlur->GetDirtyRect();
 
     // Avoid a semi-expensive clip operation if we can, otherwise
     // clip to the dirty rect
-    if (mHasDirtyRect) {
+    if (dirtyrect) {
         aDestinationCtx->Save();
         aDestinationCtx->NewPath();
-        aDestinationCtx->Rectangle(mDirtyRect);
+        gfxRect dirty(dirtyrect->x, dirtyrect->y, dirtyrect->width, dirtyrect->height);
+        aDestinationCtx->Rectangle(dirty);
         aDestinationCtx->Clip();
         aDestinationCtx->Mask(mImageSurface, offset);
         aDestinationCtx->Restore();
@@ -479,23 +122,9 @@ gfxAlphaBoxBlur::Paint(gfxContext* aDestinationCtx, const gfxPoint& offset)
     }
 }
 
-/**
- * Compute the box blur size (which we're calling the blur radius) from
- * the standard deviation.
- *
- * Much of this, the 3 * sqrt(2 * pi) / 4, is the known value for
- * approximating a Gaussian using box blurs.  This yields quite a good
- * approximation for a Gaussian.  Then we multiply this by 1.5 since our
- * code wants the radius of the entire triple-box-blur kernel instead of
- * the diameter of an individual box blur.  For more details, see:
- *   http://www.w3.org/TR/SVG11/filters.html#feGaussianBlurElement
- *   https://bugzilla.mozilla.org/show_bug.cgi?id=590039#c19
- */
-static const gfxFloat GAUSSIAN_SCALE_FACTOR = (3 * sqrt(2 * M_PI) / 4) * 1.5;
-
 gfxIntSize gfxAlphaBoxBlur::CalculateBlurRadius(const gfxPoint& aStd)
 {
-    return gfxIntSize(
-        static_cast<PRInt32>(floor(aStd.x * GAUSSIAN_SCALE_FACTOR + 0.5)),
-        static_cast<PRInt32>(floor(aStd.y * GAUSSIAN_SCALE_FACTOR + 0.5)));
+    Point std(aStd.x, aStd.y);
+    IntSize size = AlphaBoxBlur::CalculateBlurRadius(std);
+    return gfxIntSize(size.width, size.height);
 }
diff --git a/gfx/thebes/gfxBlur.h b/gfx/thebes/gfxBlur.h
index 48a91b5e7e77..ed56c4675689 100644
--- a/gfx/thebes/gfxBlur.h
+++ b/gfx/thebes/gfxBlur.h
@@ -42,7 +42,12 @@
 #include "gfxImageSurface.h"
 #include "gfxTypes.h"
 #include "gfxUtils.h"
-#include "nsRect.h"
+
+namespace mozilla {
+  namespace gfx {
+    class AlphaBoxBlur;
+  }
+}
 
 /**
  * Implementation of a triple box blur approximation of a Gaussian blur.
@@ -122,15 +127,6 @@ public:
     static gfxIntSize CalculateBlurRadius(const gfxPoint& aStandardDeviation);
 
 protected:
-    /**
-     * The spread radius, in pixels.
-     */
-    gfxIntSize mSpreadRadius;
-    /**
-     * The blur radius, in pixels.
-     */
-    gfxIntSize mBlurRadius;
-
     /**
      * The context of the temporary alpha surface.
      */
@@ -141,18 +137,10 @@ protected:
      */
     nsRefPtr<gfxImageSurface> mImageSurface;
 
-    /**
-     * A copy of the dirty rect passed to Init(). This will only be valid if
-     * mHasDirtyRect is TRUE.
-     */
-    gfxRect mDirtyRect;
-    /**
-     * A rect indicating the area where blurring is unnecessary, and the blur
-     * algorithm should skip over it.
-     */
-    nsIntRect mSkipRect;
-
-    bool mHasDirtyRect;
+     /**
+      * The object that actually does the blurring for us.
+      */
+    nsAutoPtr<mozilla::gfx::AlphaBoxBlur> mBlur;
 };
 
 #endif /* GFX_BLUR_H */
diff --git a/gfx/thebes/gfxRect.cpp b/gfx/thebes/gfxRect.cpp
index 74e847a492af..6c196524dcf1 100644
--- a/gfx/thebes/gfxRect.cpp
+++ b/gfx/thebes/gfxRect.cpp
@@ -55,52 +55,6 @@ gfxRect::WithinEpsilonOfIntegerPixels(gfxFloat aEpsilon) const
             WithinEpsilonOfInteger(height, aEpsilon));
 }
 
-void
-gfxRect::Round()
-{
-    // Note that don't use NS_round here. See the comment for this method in gfxRect.h
-    gfxFloat x0 = floor(X() + 0.5);
-    gfxFloat y0 = floor(Y() + 0.5);
-    gfxFloat x1 = floor(XMost() + 0.5);
-    gfxFloat y1 = floor(YMost() + 0.5);
-
-    x = x0;
-    y = y0;
-
-    width = x1 - x0;
-    height = y1 - y0;
-}
-
-void
-gfxRect::RoundIn()
-{
-    gfxFloat x0 = ceil(X());
-    gfxFloat y0 = ceil(Y());
-    gfxFloat x1 = floor(XMost());
-    gfxFloat y1 = floor(YMost());
-
-    x = x0;
-    y = y0;
-
-    width = x1 - x0;
-    height = y1 - y0;
-}
-
-void
-gfxRect::RoundOut()
-{
-    gfxFloat x0 = floor(X());
-    gfxFloat y0 = floor(Y());
-    gfxFloat x1 = ceil(XMost());
-    gfxFloat y1 = ceil(YMost());
-
-    x = x0;
-    y = y0;
-
-    width = x1 - x0;
-    height = y1 - y0;
-}
-
 /* Clamp r to CAIRO_COORD_MIN .. CAIRO_COORD_MAX
  * these are to be device coordinates.
  *
diff --git a/gfx/thebes/gfxRect.h b/gfx/thebes/gfxRect.h
index 2063845edbd7..38e7315da815 100644
--- a/gfx/thebes/gfxRect.h
+++ b/gfx/thebes/gfxRect.h
@@ -107,27 +107,6 @@ struct THEBES_API gfxRect :
      */
     bool WithinEpsilonOfIntegerPixels(gfxFloat aEpsilon) const;
 
-    // Round the rectangle edges to integer coordinates, such that the rounded
-    // rectangle has the same set of pixel centers as the original rectangle.
-    // Edges at offset 0.5 round up.
-    // Suitable for most places where integral device coordinates
-    // are needed, but note that any translation should be applied first to
-    // avoid pixel rounding errors.
-    // Note that this is *not* rounding to nearest integer if the values are negative.
-    // They are always rounding as floor(n + 0.5).
-    // See https://bugzilla.mozilla.org/show_bug.cgi?id=410748#c14
-    // If you need similar method which is using NS_round(), you should create
-    // new |RoundAwayFromZero()| method.
-    void Round();
-
-    // Snap the rectangle edges to integer coordinates, such that the
-    // original rectangle contains the resulting rectangle.
-    void RoundIn();
-    
-    // Snap the rectangle edges to integer coordinates, such that the
-    // resulting rectangle contains the original rectangle.
-    void RoundOut();
-
     gfxPoint AtCorner(mozilla::css::Corner corner) const {
         switch (corner) {
             case NS_CORNER_TOP_LEFT: return TopLeft();
diff --git a/hal/fallback/FallbackHal.cpp b/hal/fallback/FallbackHal.cpp
index 1cb7a5aa8208..c27b2e57fba0 100644
--- a/hal/fallback/FallbackHal.cpp
+++ b/hal/fallback/FallbackHal.cpp
@@ -66,6 +66,7 @@ GetCurrentBatteryInformation(hal::BatteryInformation* aBatteryInfo)
 {
   aBatteryInfo->level() = dom::battery::kDefaultLevel;
   aBatteryInfo->charging() = dom::battery::kDefaultCharging;
+  aBatteryInfo->remainingTime() = dom::battery::kUnknownRemainingTime;
 }
 
 } // hal_impl
diff --git a/hal/linux/LinuxHal.cpp b/hal/linux/LinuxHal.cpp
index 138238be370f..6aede0842a6c 100644
--- a/hal/linux/LinuxHal.cpp
+++ b/hal/linux/LinuxHal.cpp
@@ -66,6 +66,7 @@ GetCurrentBatteryInformation(hal::BatteryInformation* aBatteryInfo)
 {
   aBatteryInfo->level() = dom::battery::kDefaultLevel;
   aBatteryInfo->charging() = dom::battery::kDefaultCharging;
+  aBatteryInfo->remainingTime() = dom::battery::kUnknownRemainingTime;
 }
 #endif // !MOZ_ENABLE_DBUS
 
diff --git a/hal/linux/UPowerClient.cpp b/hal/linux/UPowerClient.cpp
index c50f64300022..684aeec0339c 100644
--- a/hal/linux/UPowerClient.cpp
+++ b/hal/linux/UPowerClient.cpp
@@ -80,8 +80,9 @@ public:
   void BeginListening();
   void StopListening();
 
-  float GetLevel();
-  bool IsCharging();
+  double GetLevel();
+  bool   IsCharging();
+  double GetRemainingTime();
 
   ~UPowerClient();
 
@@ -138,12 +139,14 @@ private:
   // The path of the tracked device.
   gchar* mTrackedDevice;
 
-  float mLevel;
+  double mLevel;
   bool mCharging;
+  double mRemainingTime;
 
   static UPowerClient* sInstance;
 
   static const guint sDeviceTypeBattery = 2;
+  static const guint64 kUPowerUnknownRemainingTime = 0;
 };
 
 /*
@@ -171,6 +174,7 @@ GetCurrentBatteryInformation(hal::BatteryInformation* aBatteryInfo)
 
   aBatteryInfo->level() = upowerClient->GetLevel();
   aBatteryInfo->charging() = upowerClient->IsCharging();
+  aBatteryInfo->remainingTime() = upowerClient->GetRemainingTime();
 }
 
 /*
@@ -195,6 +199,7 @@ UPowerClient::UPowerClient()
   , mTrackedDevice(nsnull)
   , mLevel(kDefaultLevel)
   , mCharging(kDefaultCharging)
+  , mRemainingTime(kUnknownRemainingTime)
 {
 }
 
@@ -274,6 +279,7 @@ UPowerClient::StopListening()
   // We should now show the default values, not the latest we got.
   mLevel = kDefaultLevel;
   mCharging = kDefaultCharging;
+  mRemainingTime = kUnknownRemainingTime;
 }
 
 void
@@ -332,7 +338,9 @@ UPowerClient::DeviceChanged(DBusGProxy* aProxy, const gchar* aObjectPath, UPower
   nsAutoRef<GHashTable> hashTable(aListener->GetDeviceProperties(aObjectPath));
   aListener->UpdateSavedInfo(hashTable);
 
-  hal::NotifyBatteryChange(hal::BatteryInformation(aListener->mLevel, aListener->mCharging));
+  hal::NotifyBatteryChange(hal::BatteryInformation(aListener->mLevel,
+                                                   aListener->mCharging,
+                                                   aListener->mRemainingTime));
 }
 
 /* static */ DBusHandlerResult
@@ -374,14 +382,34 @@ UPowerClient::GetDeviceProperties(const gchar* aDevice)
 void
 UPowerClient::UpdateSavedInfo(GHashTable* aHashTable)
 {
-  mLevel = g_value_get_double(static_cast<const GValue*>(g_hash_table_lookup(aHashTable, "Percentage")))/100.f;
+  bool isFull = false;
 
+  mLevel = g_value_get_double(static_cast<const GValue*>(g_hash_table_lookup(aHashTable, "Percentage")))*0.01;
+
+  /*
+   * State values are confusing...
+   * First of all, after looking at upower sources (0.9.13), it seems that
+   * PendingDischarge and PendingCharge are not used.
+   * In addition, FullyCharged and Empty states are not clear because we do not
+   * know if the battery is actually charging or not. Those values come directly
+   * from sysfs (in the Linux kernel) which have four states: "Empty", "Full",
+   * "Charging" and "Discharging". In sysfs, "Empty" and "Full" are also only
+   * related to the level, not to the charging state.
+   * In this code, we are going to assume that Full means charging and Empty
+   * means discharging because if that is not the case, the state should not
+   * last a long time (actually, it should disappear at the following update).
+   * It might be even very hard to see real cases where the state is Empty and
+   * the battery is charging or the state is Full and the battery is discharging
+   * given that plugging/unplugging the battery should have an impact on the
+   * level.
+   */
   switch (g_value_get_uint(static_cast<const GValue*>(g_hash_table_lookup(aHashTable, "State")))) {
     case eState_Unknown:
       mCharging = kDefaultCharging;
       break;
-    case eState_Charging:
     case eState_FullyCharged:
+      isFull = true;
+    case eState_Charging:
     case eState_PendingCharge:
       mCharging = true;
       break;
@@ -391,9 +419,20 @@ UPowerClient::UpdateSavedInfo(GHashTable* aHashTable)
       mCharging = false;
       break;
   }
+
+  if (isFull) {
+    mRemainingTime = 0;
+  } else {
+    mRemainingTime = mCharging ? g_value_get_int64(static_cast<const GValue*>(g_hash_table_lookup(aHashTable, "TimeToFull")))
+                               : g_value_get_int64(static_cast<const GValue*>(g_hash_table_lookup(aHashTable, "TimeToEmpty")));
+
+    if (mRemainingTime == kUPowerUnknownRemainingTime) {
+      mRemainingTime = kUnknownRemainingTime;
+    }
+  }
 }
 
-float
+double
 UPowerClient::GetLevel()
 {
   return mLevel;
@@ -405,5 +444,11 @@ UPowerClient::IsCharging()
   return mCharging;
 }
 
+double
+UPowerClient::GetRemainingTime()
+{
+  return mRemainingTime;
+}
+
 } // namespace hal_impl
 } // namespace mozilla
diff --git a/hal/sandbox/PHal.ipdl b/hal/sandbox/PHal.ipdl
index a6980de5a3cd..1eb03da09506 100644
--- a/hal/sandbox/PHal.ipdl
+++ b/hal/sandbox/PHal.ipdl
@@ -44,8 +44,9 @@ namespace mozilla {
 
 namespace hal {
   struct BatteryInformation {
-    float level;
-    bool  charging;
+    double level;
+    bool   charging;
+    double remainingTime;
   };
 }
 
diff --git a/image/decoders/Makefile.in b/image/decoders/Makefile.in
index 00a10d3da860..683fd8776a9e 100644
--- a/image/decoders/Makefile.in
+++ b/image/decoders/Makefile.in
@@ -82,7 +82,7 @@ endif
 ifeq (cocoa,$(MOZ_WIDGET_TOOLKIT))
 DIRS = icon/mac icon
 endif
-ifeq ($(OS_TARGET),Android)
+ifeq (android,$(MOZ_WIDGET_TOOLKIT))
 DIRS = icon/android icon
 endif
 
diff --git a/image/decoders/icon/gtk/Makefile.in b/image/decoders/icon/gtk/Makefile.in
index 1dabaa0fe02f..634ca8017bec 100644
--- a/image/decoders/icon/gtk/Makefile.in
+++ b/image/decoders/icon/gtk/Makefile.in
@@ -56,8 +56,6 @@ endif
 
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/image/decoders/icon/qt/Makefile.in b/image/decoders/icon/qt/Makefile.in
index c31cc1d6ceae..fe0790d93814 100644
--- a/image/decoders/icon/qt/Makefile.in
+++ b/image/decoders/icon/qt/Makefile.in
@@ -52,8 +52,6 @@ LOCAL_INCLUDES += $(MOZ_QT_CFLAGS)
 
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC = 1
 
 DIRS = public
 
diff --git a/image/encoders/bmp/nsBMPEncoder.cpp b/image/encoders/bmp/nsBMPEncoder.cpp
index 64fc2e2c82e3..ccc077567d1f 100644
--- a/image/encoders/bmp/nsBMPEncoder.cpp
+++ b/image/encoders/bmp/nsBMPEncoder.cpp
@@ -441,15 +441,12 @@ nsBMPEncoder::ConvertHostARGBRow(const PRUint8* aSrc, PRUint8* aDest,
     PRUint8 *pixelOut = &aDest[x * BytesPerPixel(mBMPInfoHeader.bpp)];
 
     PRUint8 alpha = (pixelIn & 0xff000000) >> 24;
-    if (alpha == 0) {
-      pixelOut[0] = pixelOut[1] = pixelOut[2] = 0;
-    } else {
-      pixelOut[0] = (((pixelIn & 0xff0000) >> 16) * 255 + alpha / 2) / alpha;
-      pixelOut[1] = (((pixelIn & 0x00ff00) >>  8) * 255 + alpha / 2) / alpha;
-      pixelOut[2] = (((pixelIn & 0x0000ff) >>  0) * 255 + alpha / 2) / alpha;
-      if(mBMPInfoHeader.bpp == 32) {
-        pixelOut[3] = alpha;
-      }
+    pixelOut[0] = (((pixelIn & 0xff0000) >> 16));
+    pixelOut[1] = (((pixelIn & 0x00ff00) >>  8));
+    pixelOut[2] = (((pixelIn & 0x0000ff) >>  0));
+
+    if (mBMPInfoHeader.bpp == 32) {
+      pixelOut[3] = alpha;
     }
   }
 }
diff --git a/image/encoders/jpeg/nsJPEGEncoder.cpp b/image/encoders/jpeg/nsJPEGEncoder.cpp
index 4d199dad3bec..5744572dd86b 100644
--- a/image/encoders/jpeg/nsJPEGEncoder.cpp
+++ b/image/encoders/jpeg/nsJPEGEncoder.cpp
@@ -365,14 +365,9 @@ nsJPEGEncoder::ConvertHostARGBRow(const PRUint8* aSrc, PRUint8* aDest,
     const PRUint32& pixelIn = ((const PRUint32*)(aSrc))[x];
     PRUint8 *pixelOut = &aDest[x * 3];
 
-    PRUint8 alpha = (pixelIn & 0xff000000) >> 24;
-    if (alpha == 0) {
-      pixelOut[0] = pixelOut[1] = pixelOut[2] = 0;
-    } else {
-      pixelOut[0] = (((pixelIn & 0xff0000) >> 16) * 255 + alpha / 2) / alpha;
-      pixelOut[1] = (((pixelIn & 0x00ff00) >>  8) * 255 + alpha / 2) / alpha;
-      pixelOut[2] = (((pixelIn & 0x0000ff) >>  0) * 255 + alpha / 2) / alpha;
-    }
+    pixelOut[0] = (((pixelIn & 0xff0000) >> 16));
+    pixelOut[1] = (((pixelIn & 0x00ff00) >>  8));
+    pixelOut[2] = (((pixelIn & 0x0000ff) >>  0));
   }
 }
 
diff --git a/image/public/imgIContainer.idl b/image/public/imgIContainer.idl
index 01ce8df91bf3..43d41b3dd23a 100644
--- a/image/public/imgIContainer.idl
+++ b/image/public/imgIContainer.idl
@@ -55,7 +55,19 @@ interface imgIDecoderObserver;
 #include "nsSize.h"
 #include "limits.h"
 
+namespace mozilla {
+namespace layers {
+class LayerManager;
+class ImageContainer;
+}
+}
+
 class nsIFrame;
+
+namespace mozilla {
+class TimeStamp;
+}
+
 %}
 
 [ptr] native gfxImageSurface(gfxImageSurface);
@@ -68,6 +80,10 @@ native gfxGraphicsFilter(gfxPattern::GraphicsFilter);
 [ref] native nsIntRect(nsIntRect);
 [ref] native nsIntSize(nsIntSize);
 [ptr] native nsIFrame(nsIFrame);
+[ptr] native ImageContainer(mozilla::layers::ImageContainer);
+[ptr] native LayerManager(mozilla::layers::LayerManager);
+[ref] native TimeStamp(mozilla::TimeStamp);
+
 
 /**
  * imgIContainer is the interface that represents an image. It allows
@@ -77,7 +93,7 @@ native gfxGraphicsFilter(gfxPattern::GraphicsFilter);
  *
  * Internally, imgIContainer also manages animation of images.
  */
-[scriptable, uuid(239dfa70-2285-4d63-99cd-e9b7ff9555c7)]
+[scriptable, uuid(8c82b89f-f90c-4a31-a544-6e1f759673d4)]
 interface imgIContainer : nsISupports
 {
   /**
@@ -170,6 +186,14 @@ interface imgIContainer : nsISupports
   [noscript] gfxASurface getFrame(in PRUint32 aWhichFrame,
                                   in PRUint32 aFlags);
 
+  /**
+   * Attempts to create an ImageContainer (and Image) containing the current
+   * frame. Only valid for RASTER type images.
+   *
+   * @param aManager The layer manager to use to create the ImageContainer.
+   */
+  [noscript] ImageContainer getImageContainer(in LayerManager aManager);
+
   /**
    * Create and return a new copy of the given frame that you can write to
    * and otherwise inspect the pixels of.
@@ -261,6 +285,13 @@ interface imgIContainer : nsISupports
     */
   void unlockImage();
 
+  /**
+    * Indicates that this imgIContainer has been triggered to update
+    * its internal animation state. Likely this should only be called
+    * from within nsImageFrame or objects of similar type.
+    */
+  [notxpcom] void requestRefresh([const] in TimeStamp aTime);
+
   /**
    * Animation mode Constants
    *   0 = normal
diff --git a/image/public/imgIDecoderObserver.idl b/image/public/imgIDecoderObserver.idl
index ae555249375d..bed7cf6fc41f 100644
--- a/image/public/imgIDecoderObserver.idl
+++ b/image/public/imgIDecoderObserver.idl
@@ -59,7 +59,7 @@ interface imgIContainer;
  * filesystem. Decode notifications are fired as the image is decoded. If an
  * image is decoded on load and not visibly discarded, decode notifications are
  * nested logically inside load notifications as one might expect. However, with
- * decode-on-draw, the set of decode notifications can come completely _after_
+ * decode-on-draw, the set of decode notifications can imgRcome completely _after_
  * the load notifications, and can come multiple times if the image is
  * discardable. Moreover, they can be interleaved in various ways. In general,
  * any presumed ordering between load and decode notifications should not be
@@ -77,7 +77,7 @@ interface imgIContainer;
  * @version 0.1
  * @see imagelib2
  */
-[scriptable, uuid(9f6bfbee-9e04-43a0-b8f6-2159973efec8)]
+[scriptable, uuid(2e5fa0c4-57f8-4d16-bda3-1daeba9caa34)]
 interface imgIDecoderObserver : imgIContainerObserver
 {
   /**
@@ -134,6 +134,12 @@ interface imgIDecoderObserver : imgIContainerObserver
    */
   void onStopContainer(in imgIRequest aRequest, in imgIContainer aContainer);
 
+  /**
+   * Notification for when an image is known to be animated. This should be
+   * fired at the earliest possible time.
+   */
+  void onImageIsAnimated(in imgIRequest aRequest);
+
   /**
    * In theory a decode notification, but currently a load notification.
    *
diff --git a/image/src/Decoder.cpp b/image/src/Decoder.cpp
index 1350a6f43c58..b0d45cc965d1 100644
--- a/image/src/Decoder.cpp
+++ b/image/src/Decoder.cpp
@@ -55,6 +55,7 @@ Decoder::Decoder(RasterImage &aImage, imgIDecoderObserver* aObserver)
   , mInFrame(false)
   , mDecodeDone(false)
   , mDataError(false)
+  , mIsAnimated(false)
 {
 }
 
@@ -259,9 +260,14 @@ Decoder::PostFrameStop()
   // Flush any invalidations before we finish the frame
   FlushInvalidations();
 
-  // Fire notification
-  if (mObserver)
+  // Fire notifications
+  if (mObserver) {
     mObserver->OnStopFrame(nsnull, mFrameCount - 1); // frame # is zero-indexed
+    if (mFrameCount > 1 && !mIsAnimated) {
+      mIsAnimated = true;
+      mObserver->OnImageIsAnimated(nsnull);
+    }
+  }
 }
 
 void
diff --git a/image/src/Decoder.h b/image/src/Decoder.h
index 6b93c41c0b18..566e021e0be5 100644
--- a/image/src/Decoder.h
+++ b/image/src/Decoder.h
@@ -218,6 +218,7 @@ private:
   bool mInitialized;
   bool mSizeDecode;
   bool mInFrame;
+  bool mIsAnimated;
 };
 
 } // namespace imagelib
diff --git a/image/src/RasterImage.cpp b/image/src/RasterImage.cpp
index ffb999751f87..3b656ce3aa21 100644
--- a/image/src/RasterImage.cpp
+++ b/image/src/RasterImage.cpp
@@ -58,6 +58,7 @@
 #include "ImageLogging.h"
 #include "mozilla/TimeStamp.h"
 #include "mozilla/Telemetry.h"
+#include "ImageLayers.h"
 
 #include "nsPNGDecoder.h"
 #include "nsGIFDecoder2.h"
@@ -70,6 +71,7 @@
 
 using namespace mozilla;
 using namespace mozilla::imagelib;
+using namespace mozilla::layers;
 
 // a mask for flags that will affect the decoding
 #define DECODE_FLAGS_MASK (imgIContainer::FLAG_DECODE_NO_PREMULTIPLY_ALPHA | imgIContainer::FLAG_DECODE_NO_COLORSPACE_CONVERSION)
@@ -173,10 +175,10 @@ namespace mozilla {
 namespace imagelib {
 
 #ifndef DEBUG
-NS_IMPL_ISUPPORTS4(RasterImage, imgIContainer, nsITimerCallback, nsIProperties,
+NS_IMPL_ISUPPORTS3(RasterImage, imgIContainer, nsIProperties,
                    nsISupportsWeakReference)
 #else
-NS_IMPL_ISUPPORTS5(RasterImage, imgIContainer, nsITimerCallback, nsIProperties,
+NS_IMPL_ISUPPORTS4(RasterImage, imgIContainer, nsIProperties,
                    imgIContainerDebug, nsISupportsWeakReference)
 #endif
 
@@ -313,6 +315,169 @@ RasterImage::Init(imgIDecoderObserver *aObserver,
   return NS_OK;
 }
 
+bool
+RasterImage::AdvanceFrame(TimeStamp aTime, nsIntRect* aDirtyRect)
+{
+  NS_ASSERTION(aTime <= TimeStamp::Now(),
+               "Given time appears to be in the future");
+
+  imgFrame* nextFrame = nsnull;
+  PRUint32 currentFrameIndex = mAnim->currentAnimationFrameIndex;
+  PRUint32 nextFrameIndex = mAnim->currentAnimationFrameIndex + 1;
+  PRUint32 timeout = 0;
+
+  // Figure out if we have the next full frame. This is more complicated than
+  // just checking for mFrames.Length() because decoders append their frames
+  // before they're filled in.
+  NS_ABORT_IF_FALSE(mDecoder || nextFrameIndex <= mFrames.Length(),
+                    "How did we get 2 indices too far by incrementing?");
+
+  // If we don't have a decoder, we know we've got everything we're going to
+  // get. If we do, we only display fully-downloaded frames; everything else
+  // gets delayed.
+  bool haveFullNextFrame = !mDecoder ||
+                           nextFrameIndex < mDecoder->GetCompleteFrameCount();
+
+  // If we're done decoding the next frame, go ahead and display it now and
+  // reinit with the next frame's delay time.
+  if (haveFullNextFrame) {
+    if (mFrames.Length() == nextFrameIndex) {
+      // End of Animation, unless we are looping forever
+
+      // If animation mode is "loop once", it's time to stop animating
+      if (mAnimationMode == kLoopOnceAnimMode || mLoopCount == 0) {
+        mAnimationFinished = true;
+        EvaluateAnimation();
+      }
+
+      // We may have used compositingFrame to build a frame, and then copied
+      // it back into mFrames[..].  If so, delete composite to save memory
+      if (mAnim->compositingFrame && mAnim->lastCompositedFrameIndex == -1) {
+        mAnim->compositingFrame = nsnull;
+      }
+
+      nextFrameIndex = 0;
+
+      if (mLoopCount > 0) {
+        mLoopCount--;
+      }
+
+      if (!mAnimating) {
+        // break out early if we are actually done animating
+        return false;
+      }
+    }
+
+    if (!(nextFrame = mFrames[nextFrameIndex])) {
+      // something wrong with the next frame, skip it
+      mAnim->currentAnimationFrameIndex = nextFrameIndex;
+      return false;
+    }
+
+    timeout = nextFrame->GetTimeout();
+
+  } else {
+    // Uh oh, the frame we want to show is currently being decoded (partial)
+    // Wait until the next refresh driver tick and try again
+    return false;
+  }
+
+  if (!(timeout > 0)) {
+    mAnimationFinished = true;
+    EvaluateAnimation();
+  }
+
+  imgFrame *frameToUse = nsnull;
+
+  if (nextFrameIndex == 0) {
+    frameToUse = nextFrame;
+    *aDirtyRect = mAnim->firstFrameRefreshArea;
+  } else {
+    imgFrame *curFrame = mFrames[currentFrameIndex];
+
+    if (!curFrame) {
+      return false;
+    }
+
+    // Change frame
+    if (NS_FAILED(DoComposite(aDirtyRect, curFrame,
+                              nextFrame, nextFrameIndex))) {
+      // something went wrong, move on to next
+      NS_WARNING("RasterImage::AdvanceFrame(): Compositing of frame failed");
+      nextFrame->SetCompositingFailed(true);
+      mAnim->currentAnimationFrameIndex = nextFrameIndex;
+      mAnim->currentAnimationFrameTime = aTime;
+      return false;
+    }
+
+    nextFrame->SetCompositingFailed(false);
+  }
+
+  // Set currentAnimationFrameIndex at the last possible moment
+  mAnim->currentAnimationFrameIndex = nextFrameIndex;
+  mAnim->currentAnimationFrameTime = aTime;
+
+  return true;
+}
+
+//******************************************************************************
+// [notxpcom] void requestRefresh ([const] in TimeStamp aTime);
+NS_IMETHODIMP_(void)
+RasterImage::RequestRefresh(const mozilla::TimeStamp& aTime)
+{
+  if (!mAnimating || !ShouldAnimate()) {
+    return;
+  }
+
+  EnsureAnimExists();
+
+  // only advance the frame if the current time is greater than or
+  // equal to the current frame's end time.
+  TimeStamp currentFrameEndTime = GetCurrentImgFrameEndTime();
+  bool frameAdvanced = false;
+
+  // The dirtyRect variable will contain an accumulation of the sub-rectangles
+  // that are dirty for each frame we advance in AdvanceFrame().
+  nsIntRect dirtyRect;
+
+  while (currentFrameEndTime <= aTime) {
+    TimeStamp oldFrameEndTime = currentFrameEndTime;
+    nsIntRect frameDirtyRect;
+    bool didAdvance = AdvanceFrame(aTime, &frameDirtyRect);
+    frameAdvanced = frameAdvanced || didAdvance;
+    currentFrameEndTime = GetCurrentImgFrameEndTime();
+
+    // Accumulate the dirty area.
+    dirtyRect = dirtyRect.Union(frameDirtyRect);
+
+    // if we didn't advance a frame, and our frame end time didn't change,
+    // then we need to break out of this loop & wait for the frame(s)
+    // to finish downloading
+    if (!frameAdvanced && (currentFrameEndTime == oldFrameEndTime)) {
+      break;
+    }
+  }
+
+  if (frameAdvanced) {
+    nsCOMPtr<imgIContainerObserver> observer(do_QueryReferent(mObserver));
+
+    if (!observer) {
+      NS_ERROR("Refreshing image after its imgRequest is gone");
+      StopAnimation();
+      return;
+    }
+
+    // Notify listeners that our frame has actually changed, but do this only
+    // once for all frames that we've now passed (if AdvanceFrame() was called
+    // more than once).
+    #ifdef DEBUG
+      mFramesNotified++;
+    #endif
+
+    observer->FrameChanged(this, &dirtyRect);
+  }
+}
+
 //******************************************************************************
 /* [noscript] imgIContainer extractFrame(PRUint32 aWhichFrame,
  *                                       [const] in nsIntRect aRegion,
@@ -494,6 +659,27 @@ RasterImage::GetCurrentImgFrameIndex() const
   return 0;
 }
 
+TimeStamp
+RasterImage::GetCurrentImgFrameEndTime() const
+{
+  imgFrame* currentFrame = mFrames[mAnim->currentAnimationFrameIndex];
+  TimeStamp currentFrameTime = mAnim->currentAnimationFrameTime;
+  PRInt64 timeout = currentFrame->GetTimeout();
+
+  if (timeout < 0) {
+    // We need to return a sentinel value in this case, because our logic
+    // doesn't work correctly if we have a negative timeout value. The reason
+    // this positive infinity was chosen was because it works with the loop in
+    // RequestRefresh() above.
+    return TimeStamp() + TimeDuration::FromMilliseconds(UINT64_MAX_VAL);
+  }
+
+  TimeDuration durationOfTimeout = TimeDuration::FromMilliseconds(timeout);
+  TimeStamp currentFrameEndTime = currentFrameTime + durationOfTimeout;
+
+  return currentFrameEndTime;
+}
+
 imgFrame*
 RasterImage::GetCurrentImgFrame()
 {
@@ -747,6 +933,42 @@ RasterImage::GetFrame(PRUint32 aWhichFrame,
   return rv;
 }
 
+
+NS_IMETHODIMP
+RasterImage::GetImageContainer(LayerManager* aManager,
+                               ImageContainer **_retval)
+{
+  if (mImageContainer && 
+      (mImageContainer->Manager() == aManager || 
+       (!mImageContainer->Manager() && 
+        (mImageContainer->GetBackendType() == aManager->GetBackendType())))) {
+    *_retval = mImageContainer;
+    return NS_OK;
+  }
+  
+  CairoImage::Data cairoData;
+  nsRefPtr<gfxASurface> imageSurface;
+  GetFrame(FRAME_CURRENT, FLAG_SYNC_DECODE, getter_AddRefs(imageSurface));
+  cairoData.mSurface = imageSurface;
+  GetWidth(&cairoData.mSize.width);
+  GetHeight(&cairoData.mSize.height);
+
+  mImageContainer = aManager->CreateImageContainer();
+  NS_ASSERTION(mImageContainer, "Failed to create ImageContainer!");
+  
+  // Now create a CairoImage to display the surface.
+  layers::Image::Format cairoFormat = layers::Image::CAIRO_SURFACE;
+  nsRefPtr<layers::Image> image = mImageContainer->CreateImage(&cairoFormat, 1);
+  NS_ASSERTION(image, "Failed to create Image");
+
+  NS_ASSERTION(image->GetFormat() == cairoFormat, "Wrong format");
+  static_cast<CairoImage*>(image.get())->SetData(cairoData);
+  mImageContainer->SetCurrentImage(image);
+
+  *_retval = mImageContainer;
+  return NS_OK;
+}
+
 namespace {
 
 PRUint32
@@ -1011,6 +1233,8 @@ RasterImage::FrameUpdated(PRUint32 aFrameNum, nsIntRect &aUpdatedRect)
   NS_ABORT_IF_FALSE(frame, "Calling FrameUpdated on frame that doesn't exist!");
 
   frame->ImageUpdated(aUpdatedRect);
+  // The image has changed, so we need to invalidate our cached ImageContainer.
+  mImageContainer = NULL;
 }
 
 nsresult
@@ -1138,25 +1362,18 @@ RasterImage::StartAnimation()
 
   EnsureAnimExists();
 
-  NS_ABORT_IF_FALSE(mAnim && !mAnim->timer, "Anim must exist and not have a timer yet");
-  
-  // Default timeout to 100: the timer notify code will do the right
-  // thing, so just get that started.
-  PRInt32 timeout = 100;
-  imgFrame *currentFrame = GetCurrentImgFrame();
+  imgFrame* currentFrame = GetCurrentImgFrame();
   if (currentFrame) {
-    timeout = currentFrame->GetTimeout();
-    if (timeout < 0) { // -1 means display this frame forever
+    if (currentFrame->GetTimeout() < 0) { // -1 means display this frame forever
       mAnimationFinished = true;
       return NS_ERROR_ABORT;
     }
+
+    // We need to set the time that this initial frame was first displayed, as
+    // this is used in AdvanceFrame().
+    mAnim->currentAnimationFrameTime = TimeStamp::Now();
   }
   
-  mAnim->timer = do_CreateInstance("@mozilla.org/timer;1");
-  NS_ENSURE_TRUE(mAnim->timer, NS_ERROR_OUT_OF_MEMORY);
-  mAnim->timer->InitWithCallback(static_cast<nsITimerCallback*>(this),
-                                 timeout, nsITimer::TYPE_REPEATING_SLACK);
-  
   return NS_OK;
 }
 
@@ -1170,11 +1387,6 @@ RasterImage::StopAnimation()
   if (mError)
     return NS_ERROR_FAILURE;
 
-  if (mAnim->timer) {
-    mAnim->timer->Cancel();
-    mAnim->timer = nsnull;
-  }
-
   return NS_OK;
 }
 
@@ -1430,127 +1642,6 @@ RasterImage::SetSourceSizeHint(PRUint32 sizeHint)
   return NS_OK;
 }
 
-//******************************************************************************
-/* void notify(in nsITimer timer); */
-NS_IMETHODIMP
-RasterImage::Notify(nsITimer *timer)
-{
-#ifdef DEBUG
-  mFramesNotified++;
-#endif
-
-  // This should never happen since the timer is only set up in StartAnimation()
-  // after mAnim is checked to exist.
-  NS_ABORT_IF_FALSE(mAnim, "Need anim for Notify()");
-  NS_ABORT_IF_FALSE(timer, "Need timer for Notify()");
-  NS_ABORT_IF_FALSE(mAnim->timer == timer,
-                    "RasterImage::Notify() called with incorrect timer");
-
-  if (!mAnimating || !ShouldAnimate())
-    return NS_OK;
-
-  nsCOMPtr<imgIContainerObserver> observer(do_QueryReferent(mObserver));
-  if (!observer) {
-    // the imgRequest that owns us is dead, we should die now too.
-    NS_ABORT_IF_FALSE(mAnimationConsumers == 0,
-                      "If no observer, should have no consumers");
-    if (mAnimating)
-      StopAnimation();
-    return NS_OK;
-  }
-
-  if (mFrames.Length() == 0)
-    return NS_OK;
-  
-  imgFrame *nextFrame = nsnull;
-  PRInt32 previousFrameIndex = mAnim->currentAnimationFrameIndex;
-  PRUint32 nextFrameIndex = mAnim->currentAnimationFrameIndex + 1;
-  PRInt32 timeout = 0;
-
-  // Figure out if we have the next full frame. This is more complicated than
-  // just checking for mFrames.Length() because decoders append their frames
-  // before they're filled in.
-  NS_ABORT_IF_FALSE(mDecoder || nextFrameIndex <= mFrames.Length(),
-                    "How did we get 2 indicies too far by incrementing?");
-
-  // If we don't have a decoder, we know we've got everything we're going to get.
-  // If we do, we only display fully-downloaded frames; everything else gets delayed.
-  bool haveFullNextFrame = !mDecoder || nextFrameIndex < mDecoder->GetCompleteFrameCount();
-
-  // If we're done decoding the next frame, go ahead and display it now and
-  // reinit the timer with the next frame's delay time.
-  if (haveFullNextFrame) {
-    if (mFrames.Length() == nextFrameIndex) {
-      // End of Animation
-
-      // If animation mode is "loop once", it's time to stop animating
-      if (mAnimationMode == kLoopOnceAnimMode || mLoopCount == 0) {
-        mAnimationFinished = true;
-        EvaluateAnimation();
-        return NS_OK;
-      } else {
-        // We may have used compositingFrame to build a frame, and then copied
-        // it back into mFrames[..].  If so, delete composite to save memory
-        if (mAnim->compositingFrame && mAnim->lastCompositedFrameIndex == -1)
-          mAnim->compositingFrame = nsnull;
-      }
-
-      nextFrameIndex = 0;
-      if (mLoopCount > 0)
-        mLoopCount--;
-    }
-
-    if (!(nextFrame = mFrames[nextFrameIndex])) {
-      // something wrong with the next frame, skip it
-      mAnim->currentAnimationFrameIndex = nextFrameIndex;
-      mAnim->timer->SetDelay(100);
-      return NS_OK;
-    }
-    timeout = nextFrame->GetTimeout();
-
-  } else {
-    // Uh oh, the frame we want to show is currently being decoded (partial)
-    // Wait a bit and try again
-    mAnim->timer->SetDelay(100);
-    return NS_OK;
-  }
-
-  if (timeout > 0)
-    mAnim->timer->SetDelay(timeout);
-  else {
-    mAnimationFinished = true;
-    EvaluateAnimation();
-  }
-
-  nsIntRect dirtyRect;
-
-  if (nextFrameIndex == 0) {
-    dirtyRect = mAnim->firstFrameRefreshArea;
-  } else {
-    imgFrame *prevFrame = mFrames[previousFrameIndex];
-    if (!prevFrame)
-      return NS_OK;
-
-    // Change frame and announce it
-    if (NS_FAILED(DoComposite(&dirtyRect, prevFrame,
-                              nextFrame, nextFrameIndex))) {
-      // something went wrong, move on to next
-      NS_WARNING("RasterImage::Notify(): Composing Frame Failed\n");
-      nextFrame->SetCompositingFailed(true);
-      mAnim->currentAnimationFrameIndex = nextFrameIndex;
-      return NS_OK;
-    } else {
-      nextFrame->SetCompositingFailed(false);
-    }
-  }
-  // Set currentAnimationFrameIndex at the last possible moment
-  mAnim->currentAnimationFrameIndex = nextFrameIndex;
-  // Refreshes the screen
-  observer->FrameChanged(this, &dirtyRect);
-  
-  return NS_OK;
-}
-
 //******************************************************************************
 // DoComposite gets called when the timer for animation get fired and we have to
 // update the composited frame of the animation.
diff --git a/image/src/RasterImage.h b/image/src/RasterImage.h
index 66b8e1f066a6..afcbe9bf7c0d 100644
--- a/image/src/RasterImage.h
+++ b/image/src/RasterImage.h
@@ -71,6 +71,7 @@
 #endif
 
 class imgIDecoder;
+class imgIContainerObserver;
 class nsIInputStream;
 
 #define NS_RASTERIMAGE_CID \
@@ -81,6 +82,12 @@ class nsIInputStream;
     {0xb1, 0x43, 0x33, 0x40, 0xc0, 0x01, 0x12, 0xf7} \
 }
 
+/**
+ * It would be nice if we had a macro for this in prtypes.h.
+ * TODO: Place this macro in prtypes.h as PR_UINT64_MAX.
+ */
+#define UINT64_MAX_VAL PRUint64(-1)
+
 /**
  * Handles static and animated image containers.
  *
@@ -88,15 +95,27 @@ class nsIInputStream;
  * @par A Quick Walk Through
  * The decoder initializes this class and calls AppendFrame() to add a frame.
  * Once RasterImage detects more than one frame, it starts the animation
- * with StartAnimation().
+ * with StartAnimation(). Note that the invalidation events for RasterImage are
+ * generated automatically using nsRefreshDriver.
  *
  * @par
- * StartAnimation() creates a timer.  The timer calls Notify when the
- * specified frame delay time is up.
+ * StartAnimation() initializes the animation helper object and sets the time
+ * the first frame was displayed to the current clock time.
  *
  * @par
- * Notify() moves on to the next frame, sets up the new timer delay, destroys
- * the old frame, and forces a redraw via observer->FrameChanged().
+ * When the refresh driver corresponding to the imgIContainer that this image is
+ * a part of notifies the RasterImage that it's time to invalidate,
+ * RequestRefresh() is called with a given TimeStamp to advance to. As long as
+ * the timeout of the given frame (the frame's "delay") plus the time that frame
+ * was first displayed is less than or equal to the TimeStamp given,
+ * RequestRefresh() calls AdvanceFrame().
+ *
+ * @par
+ * AdvanceFrame() is responsible for advancing a single frame of the animation.
+ * It can return true, meaning that the frame advanced, or false, meaning that
+ * the frame failed to advance (usually because the next frame hasn't been
+ * decoded yet). It is also responsible for performing the final animation stop
+ * procedure if the final frame of a non-looping animation is reached.
  *
  * @par
  * Each frame can have a different method of removing itself. These are
@@ -145,13 +164,16 @@ class nsIInputStream;
  */
 
 namespace mozilla {
+namespace layers {
+class LayerManager;
+class ImageContainer;
+}
 namespace imagelib {
 
 class imgDecodeWorker;
 class Decoder;
 
 class RasterImage : public Image
-                  , public nsITimerCallback
                   , public nsIProperties
                   , public nsSupportsWeakReference
 #ifdef DEBUG
@@ -160,7 +182,6 @@ class RasterImage : public Image
 {
 public:
   NS_DECL_ISUPPORTS
-  NS_DECL_NSITIMERCALLBACK
   NS_DECL_NSIPROPERTIES
 #ifdef DEBUG
   NS_DECL_IMGICONTAINERDEBUG
@@ -175,6 +196,7 @@ public:
   NS_SCRIPTABLE NS_IMETHOD GetAnimated(bool *aAnimated);
   NS_SCRIPTABLE NS_IMETHOD GetCurrentFrameIsOpaque(bool *aCurrentFrameIsOpaque);
   NS_IMETHOD GetFrame(PRUint32 aWhichFrame, PRUint32 aFlags, gfxASurface **_retval NS_OUTPARAM);
+  NS_IMETHOD GetImageContainer(mozilla::layers::LayerManager* aManager, mozilla::layers::ImageContainer **_retval NS_OUTPARAM);
   NS_IMETHOD CopyFrame(PRUint32 aWhichFrame, PRUint32 aFlags, gfxImageSurface **_retval NS_OUTPARAM);
   NS_IMETHOD ExtractFrame(PRUint32 aWhichFrame, const nsIntRect & aRect, PRUint32 aFlags, imgIContainer **_retval NS_OUTPARAM);
   NS_IMETHOD Draw(gfxContext *aContext, gfxPattern::GraphicsFilter aFilter, const gfxMatrix & aUserSpaceToImageSpace, const gfxRect & aFill, const nsIntRect & aSubimage, const nsIntSize & aViewportSize, PRUint32 aFlags);
@@ -183,6 +205,7 @@ public:
   NS_SCRIPTABLE NS_IMETHOD LockImage(void);
   NS_SCRIPTABLE NS_IMETHOD UnlockImage(void);
   NS_SCRIPTABLE NS_IMETHOD ResetAnimation(void);
+  NS_IMETHOD_(void) RequestRefresh(const mozilla::TimeStamp& aTime);
   // END NS_DECL_IMGICONTAINER
 
   RasterImage(imgStatusTracker* aStatusTracker = nsnull);
@@ -334,6 +357,10 @@ private:
     //! Area of the first frame that needs to be redrawn on subsequent loops.
     nsIntRect                  firstFrameRefreshArea;
     PRUint32                   currentAnimationFrameIndex; // 0 to numFrames-1
+
+    // the time that the animation advanced to the current frame
+    TimeStamp                  currentAnimationFrameTime;
+
     //! Track the last composited frame for Optimizations (See DoComposite code)
     PRInt32                    lastCompositedFrameIndex;
     /** For managing blending of frames
@@ -352,23 +379,33 @@ private:
      * when it's done with the current frame.
      */
     nsAutoPtr<imgFrame>        compositingPrevFrame;
-    //! Timer to animate multiframed images
-    nsCOMPtr<nsITimer>         timer;
 
     Anim() :
       firstFrameRefreshArea(),
       currentAnimationFrameIndex(0),
-      lastCompositedFrameIndex(-1)
-    {
-      ;
-    }
-    ~Anim()
-    {
-      if (timer)
-        timer->Cancel();
-    }
+      lastCompositedFrameIndex(-1) {}
+    ~Anim() {}
   };
 
+  /**
+   * Advances the animation. Typically, this will advance a single frame, but it
+   * may advance multiple frames. This may happen if we have infrequently
+   * "ticking" refresh drivers (e.g. in background tabs), or extremely short-
+   * lived animation frames.
+   *
+   * @param aTime the time that the animation should advance to. This will
+   *              typically be <= TimeStamp::Now().
+   *
+   * @param [out] aDirtyRect a pointer to an nsIntRect which encapsulates the
+   *        area to be repainted after the frame is advanced.
+   *
+   * @returns true, if the frame was successfully advanced, false if it was not
+   *          able to be advanced (e.g. the frame to which we want to advance is
+   *          still decoding). Note: If false is returned, then aDirtyRect will
+   *          remain unmodified.
+   */
+  bool AdvanceFrame(mozilla::TimeStamp aTime, nsIntRect* aDirtyRect);
+
   /**
    * Deletes and nulls out the frame in mFrames[framenum].
    *
@@ -385,6 +422,7 @@ private:
   imgFrame* GetCurrentImgFrame();
   imgFrame* GetCurrentDrawableImgFrame();
   PRUint32 GetCurrentImgFrameIndex() const;
+  mozilla::TimeStamp GetCurrentImgFrameEndTime() const;
   
   inline void EnsureAnimExists()
   {
@@ -403,9 +441,12 @@ private:
       // since we didn't kill the source data in the old world either, locking
       // is acceptable for the moment.
       LockImage();
+
+      // Notify our observers that we are starting animation.
+      mStatusTracker->RecordImageIsAnimated();
     }
   }
-  
+
   /** Function for doing the frame compositing of animations
    *
    * @param aDirtyRect  Area that the display will need to update
@@ -417,7 +458,7 @@ private:
                        imgFrame* aPrevFrame,
                        imgFrame* aNextFrame,
                        PRInt32 aNextFrameIndex);
-  
+
   /** Clears an area of <aFrame> with transparent black.
    *
    * @param aFrame Target Frame
@@ -425,7 +466,7 @@ private:
    * @note Does also clears the transparancy mask
    */
   static void ClearFrame(imgFrame* aFrame);
-  
+
   //! @overload
   static void ClearFrame(imgFrame* aFrame, nsIntRect &aRect);
   
@@ -506,6 +547,9 @@ private: // data
   // This is currently only used for statistics
   PRInt32                        mDecodeCount;
 
+  // Cached value for GetImageContainer.
+  nsRefPtr<mozilla::layers::ImageContainer> mImageContainer;
+
 #ifdef DEBUG
   PRUint32                       mFramesNotified;
 #endif
diff --git a/image/src/VectorImage.cpp b/image/src/VectorImage.cpp
index c6ca627c91eb..181300cb1411 100644
--- a/image/src/VectorImage.cpp
+++ b/image/src/VectorImage.cpp
@@ -172,7 +172,6 @@ SVGDrawingCallback::operator()(gfxContext* aContext,
   gfxContextMatrixAutoSaveRestore contextMatrixRestorer(aContext);
   aContext->Multiply(gfxMatrix(aTransform).Invert());
 
-
   nsPresContext* presContext = presShell->GetPresContext();
   NS_ABORT_IF_FALSE(presContext, "pres shell w/out pres context");
 
@@ -330,6 +329,14 @@ VectorImage::GetWidth(PRInt32* aWidth)
   return NS_OK;
 }
 
+//******************************************************************************
+/* [notxpcom] void requestRefresh ([const] in TimeStamp aTime); */
+NS_IMETHODIMP_(void)
+VectorImage::RequestRefresh(const mozilla::TimeStamp& aTime)
+{
+  // TODO: Implement for b666446.
+}
+
 //******************************************************************************
 /* readonly attribute PRInt32 height; */
 NS_IMETHODIMP
diff --git a/image/src/VectorImage.h b/image/src/VectorImage.h
index d12b9b89d117..516156ea0016 100644
--- a/image/src/VectorImage.h
+++ b/image/src/VectorImage.h
@@ -42,10 +42,15 @@
 #include "Image.h"
 #include "nsIStreamListener.h"
 #include "nsWeakReference.h"
+#include "mozilla/TimeStamp.h"
 
 class imgIDecoderObserver;
 
 namespace mozilla {
+namespace layers {
+class LayerManager;
+class ImageContainer;
+}
 namespace imagelib {
 
 class SVGDocumentWrapper;
@@ -68,6 +73,7 @@ public:
   NS_SCRIPTABLE NS_IMETHOD GetAnimated(bool *aAnimated);
   NS_SCRIPTABLE NS_IMETHOD GetCurrentFrameIsOpaque(bool *aCurrentFrameIsOpaque);
   NS_IMETHOD GetFrame(PRUint32 aWhichFrame, PRUint32 aFlags, gfxASurface **_retval NS_OUTPARAM);
+  NS_IMETHOD GetImageContainer(mozilla::layers::LayerManager* aManager, mozilla::layers::ImageContainer **_retval NS_OUTPARAM) { *_retval = NULL; return NS_OK; }
   NS_IMETHOD CopyFrame(PRUint32 aWhichFrame, PRUint32 aFlags, gfxImageSurface **_retval NS_OUTPARAM);
   NS_IMETHOD ExtractFrame(PRUint32 aWhichFrame, const nsIntRect & aRect, PRUint32 aFlags, imgIContainer **_retval NS_OUTPARAM);
   NS_IMETHOD Draw(gfxContext *aContext, gfxPattern::GraphicsFilter aFilter, const gfxMatrix & aUserSpaceToImageSpace, const gfxRect & aFill, const nsIntRect & aSubimage, const nsIntSize & aViewportSize, PRUint32 aFlags);
@@ -76,6 +82,7 @@ public:
   NS_SCRIPTABLE NS_IMETHOD LockImage(void);
   NS_SCRIPTABLE NS_IMETHOD UnlockImage(void);
   NS_SCRIPTABLE NS_IMETHOD ResetAnimation(void);
+  NS_IMETHOD_(void) RequestRefresh(const mozilla::TimeStamp& aTime);
   // END NS_DECL_IMGICONTAINER
 
   VectorImage(imgStatusTracker* aStatusTracker = nsnull);
diff --git a/image/src/imgRequest.cpp b/image/src/imgRequest.cpp
index 7b5181e64c29..ba0f379162b0 100644
--- a/image/src/imgRequest.cpp
+++ b/image/src/imgRequest.cpp
@@ -796,6 +796,20 @@ NS_IMETHODIMP imgRequest::OnDiscard(imgIRequest *aRequest)
   return NS_OK;
 }
 
+NS_IMETHODIMP imgRequest::OnImageIsAnimated(imgIRequest *aRequest)
+{
+  NS_ABORT_IF_FALSE(mImage,
+                    "OnImageIsAnimated callback before we've created our image");
+  mImage->GetStatusTracker().RecordImageIsAnimated();
+
+  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mObservers);
+  while (iter.HasMore()) {
+    mImage->GetStatusTracker().SendImageIsAnimated(iter.GetNext());
+  }
+
+  return NS_OK;
+}
+
 /** nsIRequestObserver methods **/
 
 /* void onStartRequest (in nsIRequest request, in nsISupports ctxt); */
diff --git a/image/src/imgRequestProxy.cpp b/image/src/imgRequestProxy.cpp
index 00d2e11c308d..dc23c1f70177 100644
--- a/image/src/imgRequestProxy.cpp
+++ b/image/src/imgRequestProxy.cpp
@@ -709,6 +709,16 @@ void imgRequestProxy::OnDiscard()
   }
 }
 
+void imgRequestProxy::OnImageIsAnimated()
+{
+  LOG_FUNC(gImgLog, "imgRequestProxy::OnImageIsAnimated");
+  if (mListener && !mCanceled) {
+    // Hold a ref to the listener while we call it, just in case.
+    nsCOMPtr<imgIDecoderObserver> kungFuDeathGrip(mListener);
+    mListener->OnImageIsAnimated(this);
+  }
+}
+
 void imgRequestProxy::OnStartRequest()
 {
 #ifdef PR_LOGGING
diff --git a/image/src/imgRequestProxy.h b/image/src/imgRequestProxy.h
index 2e3efdfd5137..b90dea4e621f 100644
--- a/image/src/imgRequestProxy.h
+++ b/image/src/imgRequestProxy.h
@@ -168,14 +168,15 @@ protected:
   // notifications.
 
   /* non-virtual imgIDecoderObserver methods */
-  void OnStartDecode   ();
-  void OnStartContainer(imgIContainer *aContainer);
-  void OnStartFrame    (PRUint32 aFrame);
-  void OnDataAvailable (bool aCurrentFrame, const nsIntRect * aRect);
-  void OnStopFrame     (PRUint32 aFrame);
-  void OnStopContainer (imgIContainer *aContainer);
-  void OnStopDecode    (nsresult status, const PRUnichar *statusArg); 
-  void OnDiscard       ();
+  void OnStartDecode     ();
+  void OnStartContainer  (imgIContainer *aContainer);
+  void OnStartFrame      (PRUint32 aFrame);
+  void OnDataAvailable   (bool aCurrentFrame, const nsIntRect * aRect);
+  void OnStopFrame       (PRUint32 aFrame);
+  void OnStopContainer   (imgIContainer *aContainer);
+  void OnStopDecode      (nsresult status, const PRUnichar *statusArg);
+  void OnDiscard         ();
+  void OnImageIsAnimated ();
 
   /* non-virtual imgIContainerObserver methods */
   void FrameChanged(imgIContainer *aContainer,
diff --git a/image/src/imgStatusTracker.cpp b/image/src/imgStatusTracker.cpp
index 652f3be9c7c6..b9149e58eb4e 100644
--- a/image/src/imgStatusTracker.cpp
+++ b/image/src/imgStatusTracker.cpp
@@ -254,6 +254,14 @@ imgStatusTracker::SyncNotify(imgRequestProxy* proxy)
       if (mState & stateFrameStopped)
         proxy->OnStopFrame(frame);
     }
+
+    // OnImageIsAnimated
+    bool isAnimated = false;
+
+    nsresult rv = mImage->GetAnimated(&isAnimated);
+    if (NS_SUCCEEDED(rv) && isAnimated) {
+      proxy->OnImageIsAnimated();
+    }
   }
 
   // See bug 505385 and imgRequest::OnStopDecode for more information on why we
@@ -451,6 +459,24 @@ imgStatusTracker::RecordDiscard()
   mImageStatus &= ~statusBitsToClear;
 }
 
+void
+imgStatusTracker::SendImageIsAnimated(imgRequestProxy* aProxy)
+{
+  if (!aProxy->NotificationsDeferred())
+    aProxy->OnImageIsAnimated();
+}
+
+void
+imgStatusTracker::RecordImageIsAnimated()
+{
+  NS_ABORT_IF_FALSE(mImage,
+                    "RecordImageIsAnimated called before we have an Image");
+  // No bookkeeping necessary here - once decoding is complete, GetAnimated()
+  // will accurately return that this is an animated image. Until that time,
+  // the OnImageIsAnimated notification is the only indication an observer
+  // will have that an image has more than 1 frame.
+}
+
 void
 imgStatusTracker::SendDiscard(imgRequestProxy* aProxy)
 {
diff --git a/image/src/imgStatusTracker.h b/image/src/imgStatusTracker.h
index f429329e3f29..7224eaba3034 100644
--- a/image/src/imgStatusTracker.h
+++ b/image/src/imgStatusTracker.h
@@ -159,6 +159,8 @@ public:
   void SendStopDecode(imgRequestProxy* aProxy, nsresult aStatus, const PRUnichar* statusArg);
   void RecordDiscard();
   void SendDiscard(imgRequestProxy* aProxy);
+  void RecordImageIsAnimated();
+  void SendImageIsAnimated(imgRequestProxy *aProxy);
 
   /* non-virtual imgIContainerObserver methods */
   void RecordFrameChanged(imgIContainer* aContainer,
diff --git a/image/test/mochitest/Makefile.in b/image/test/mochitest/Makefile.in
index 0e3651f3dcd6..8ed8d3957fd8 100644
--- a/image/test/mochitest/Makefile.in
+++ b/image/test/mochitest/Makefile.in
@@ -93,8 +93,27 @@ _TEST_FILES =   imgutils.js \
 # test_bug478398.html disabled - See bug 579139
 
 _CHROME_FILES = imgutils.js \
+                animationPolling.js \
                 lime-anim-100x100.svg \
+                animation.svg \
                 test_animSVGImage.html \
+                test_animation.html \
+                animated-gif-finalframe.gif \
+                animated-gif.gif \
+                animated-gif2.gif \
+                purple.gif \
+                test_svg_animatedGIF.html \
+                test_bullet_animation.html \
+                test_background_image_anim.html \
+                filter.svg \
+                filter-final.svg \
+                test_svg_filter_animation.html \
+                test_xultree_animation.xhtml \
+                test_changeOfSource.html \
+                test_changeOfSource2.html \
+                test_undisplayed_iframe.html \
+                iframe.html \
+                ref-iframe.html \
                 $(NULL)
 
 libs:: $(_TEST_FILES)
diff --git a/image/test/mochitest/animated-gif-finalframe.gif b/image/test/mochitest/animated-gif-finalframe.gif
new file mode 100644
index 000000000000..4e80d31a727f
Binary files /dev/null and b/image/test/mochitest/animated-gif-finalframe.gif differ
diff --git a/image/test/mochitest/animated-gif.gif b/image/test/mochitest/animated-gif.gif
new file mode 100644
index 000000000000..001cbfb87a05
Binary files /dev/null and b/image/test/mochitest/animated-gif.gif differ
diff --git a/image/test/mochitest/animated-gif2.gif b/image/test/mochitest/animated-gif2.gif
new file mode 100644
index 000000000000..c66cc4b7344f
Binary files /dev/null and b/image/test/mochitest/animated-gif2.gif differ
diff --git a/image/test/mochitest/animation.svg b/image/test/mochitest/animation.svg
new file mode 100644
index 000000000000..2141d867916a
--- /dev/null
+++ b/image/test/mochitest/animation.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+	<image id="anim" xlink:href="animated-gif.gif" width="40" height="40"/>
+</svg>
+
diff --git a/image/test/mochitest/animationPolling.js b/image/test/mochitest/animationPolling.js
new file mode 100644
index 000000000000..29d0dcd1139e
--- /dev/null
+++ b/image/test/mochitest/animationPolling.js
@@ -0,0 +1,398 @@
+var currentTest;
+var gIsImageLoaded = false;
+var gIsRefImageLoaded = false;
+
+function pollForSuccess ()
+{
+  if (!currentTest.isTestFinished) {
+    if (!currentTest.reusingReferenceImage || (currentTest.reusingReferenceImage
+        && gRefImageLoaded)) {
+      currentTest.checkImage();
+    }
+
+    setTimeout(pollForSuccess, currentTest.pollFreq);
+  }
+};
+
+function imageLoadCallback()
+{
+  gIsImageLoaded = true;
+}
+
+function referencePoller()
+{
+  currentTest.takeReferenceSnapshot();
+}
+
+function reuseImageCallback()
+{
+  gIsRefImageLoaded = true;
+}
+
+function failTest ()
+{
+  if (currentTest.isTestFinished || currentTest.closeFunc) {
+    return;
+  }
+
+  ok(false, "timing out after " + currentTest.timeout + "ms.  "
+     + "Animated image still doesn't look correct, after poll #"
+     + currentTest.pollCounter);
+  currentTest.wereFailures = true;
+
+  if (currentTest.currentSnapshotDataURI) {
+    currentTest.outputDebugInfo("Snapshot #" + currentTest.pollCounter,
+                                "snapNum" + currentTest.pollCounter,
+                                currentTest.currentSnapshotDataURI);
+  }
+
+  currentTest.enableDisplay(document.getElementById(currentTest.debugElementId));
+
+  currentTest.cleanUpAndFinish();
+};
+
+/**
+ * Create a new AnimationTest object.
+ *
+ * @param pollFreq The amount of time (in ms) to wait between consecutive
+ *        snapshots if the reference image and the test image don't match.
+ * @param timeout The total amount of time (in ms) to wait before declaring the
+ *        test as failed.
+ * @param referenceElementId The id attribute of the reference image element, or
+ *        the source of the image to change to, once the reference snapshot has
+ *        been successfully taken. This latter option could be used if you don't
+ *        want the image to become invisible at any time during the test.
+ * @param imageElementId The id attribute of the test image element.
+ * @param debugElementId The id attribute of the div where links should be
+ *        appended if the test fails.
+ * @param cleanId The id attribute of the div or element to use as the 'clean'
+ *        test. This element is only enabled when we are testing to verify that
+ *        the reference image has been loaded. It can be undefined.
+ * @param srcAttr The location of the source of the image, for preloading. This
+ *        is usually not required, but it useful for preloading reference
+ *        images.
+ * @param xulTest A boolean value indicating whether or not this is a XUL test
+ *        (uses hidden=true/false rather than display: none to hide/show
+ *        elements).
+ * @param closeFunc A function that should be called when this test is finished.
+ *        If null, then cleanUpAndFinish() will be called. This can be used to
+ *        chain tests together, so they are all finished exactly once.
+ * @returns {AnimationTest}
+ */
+function AnimationTest(pollFreq, timeout, referenceElementId, imageElementId,
+                       debugElementId, cleanId, srcAttr, xulTest, closeFunc)
+{
+  // We want to test the cold loading behavior, so clear cache in case an
+  // earlier test got our image in there already.
+  clearImageCache();
+
+  this.wereFailures = false;
+  this.pollFreq = pollFreq;
+  this.timeout = timeout;
+  this.imageElementId = imageElementId;
+  this.referenceElementId = referenceElementId;
+
+  if (!document.getElementById(referenceElementId)) {
+    // In this case, we're assuming the user passed in a string that
+    // indicates the source of the image they want to change to,
+    // after the reference image has been taken.
+    this.reusingImageAsReference = true;
+  }
+
+  this.srcAttr = srcAttr;
+  this.debugElementId = debugElementId;
+  this.referenceSnapshot = ""; // value will be set in takeReferenceSnapshot()
+  this.pollCounter = 0;
+  this.isTestFinished = false;
+  this.numRefsTaken = 0;
+  this.blankWaitTime = 0;
+
+  this.cleanId = cleanId ? cleanId : '';
+  this.xulTest = xulTest ? xulTest : '';
+  this.closeFunc = closeFunc ? closeFunc : '';
+
+  if (this.srcAttr) {
+    this.myImage = new Image();
+    this.myImage.onload = imageLoadCallback;
+    this.myImage.src = this.srcAttr;
+  } else {
+    gIsImageLoaded = true;
+  }
+}
+
+AnimationTest.prototype.outputDebugInfo = function(message, id, dataUri)
+{
+  var debugElement = document.getElementById(this.debugElementId);
+  var newDataUriElement = document.createElement("a");
+  newDataUriElement.setAttribute("id", id);
+  newDataUriElement.setAttribute("href", dataUri);
+  newDataUriElement.appendChild(document.createTextNode(message));
+  debugElement.appendChild(newDataUriElement);
+  var brElement = document.createElement("br");
+  debugElement.appendChild(brElement);
+  todo(false, "Debug (" + id + "): " + message + " " + dataUri);
+};
+
+AnimationTest.prototype.isFinished = function()
+{
+  return this.isTestFinished;
+};
+
+AnimationTest.prototype.takeCleanSnapshot = function()
+{
+  var cleanElement;
+  if (this.cleanId) {
+    cleanElement = document.getElementById(this.cleanId);
+  }
+
+  // Enable clean page comparison element
+  if (cleanElement) {
+    this.enableDisplay(cleanElement);
+  }
+
+  // Take a snapshot of the initial (clean) page
+  this.cleanSnapshot = snapshotWindow(window, false);
+
+  // Disable the clean page comparison element
+  if (cleanElement) {
+    this.disableDisplay(cleanElement);
+  }
+
+  var dataString1 = "Clean Snapshot";
+  this.outputDebugInfo(dataString1, 'cleanSnap',
+                       this.cleanSnapshot.toDataURL());
+};
+
+AnimationTest.prototype.takeBlankSnapshot = function()
+{
+  // Take a snapshot of the initial (essentially blank) page
+  this.blankSnapshot = snapshotWindow(window, false);
+
+  var dataString1 = "Initial Blank Snapshot";
+  this.outputDebugInfo(dataString1, 'blank1Snap',
+                       this.blankSnapshot.toDataURL());
+};
+
+/**
+ * Begin the AnimationTest. This will utilize the information provided in the
+ * constructor to invoke a mochitest on animated images. It will automatically
+ * fail if allowed to run past the timeout.
+ */
+AnimationTest.prototype.beginTest = function ()
+{
+  SimpleTest.waitForExplicitFinish();
+
+  currentTest = this;
+
+  this.takeReferenceSnapshot();
+
+  // In case something goes wrong, fail earlier than mochitest timeout,
+  // and with more information.
+  setTimeout(failTest, this.timeout);
+
+  if (!this.reusingImageAsReference) {
+    this.disableDisplay(document.getElementById(this.imageElementId));
+  }
+
+  this.setupPolledImage();
+  setTimeout(pollForSuccess, 10);
+};
+
+AnimationTest.prototype.setupPolledImage = function ()
+{
+  // Make sure the image is visible
+  if (!this.reusingImageAsReference) {
+    this.enableDisplay(document.getElementById(this.imageElementId));
+    var currentSnapshot = snapshotWindow(window, false);
+    var result = compareSnapshots(currentSnapshot, this.referenceSnapshot, true);
+
+    this.currentSnapshotDataURI = currentSnapshot.toDataURL();
+
+    if (result[0]) {
+      // SUCCESS!
+      ok(true, "Animated image looks correct, at poll #"
+         + this.pollCounter);
+
+      this.cleanUpAndFinish();
+    }
+  } else {
+    if (!gIsRefImageLoaded) {
+      this.myImage = new Image();
+      this.myImage.onload = reuseImageCallback;
+      document.getElementById(this.imageElementId).setAttribute('src',
+        this.referenceElementId);
+    }
+  }
+}
+
+AnimationTest.prototype.checkImage = function ()
+{
+  if (this.isTestFinished) {
+    return;
+  }
+
+  this.pollCounter++;
+
+  // We need this for some tests, because we need to force the
+  // test image to be visible.
+  if (!this.reusingImageAsReference) {
+    this.enableDisplay(document.getElementById(this.imageElementId));
+  }
+
+  var currentSnapshot = snapshotWindow(window, false);
+  var result = compareSnapshots(currentSnapshot, this.referenceSnapshot, true);
+
+  this.currentSnapshotDataURI = currentSnapshot.toDataURL();
+
+  if (result[0]) {
+    // SUCCESS!
+    ok(true, "Animated image looks correct, at poll #"
+       + this.pollCounter);
+
+    this.cleanUpAndFinish();
+  }
+};
+
+AnimationTest.prototype.takeReferenceSnapshot = function ()
+{
+  this.numRefsTaken++;
+
+  // Test to make sure the reference image doesn't match a clean snapshot
+  if (!this.cleanSnapshot) {
+    this.takeCleanSnapshot();
+  }
+
+  // Used later to verify that the reference div disappeared
+  if (!this.blankSnapshot) {
+    this.takeBlankSnapshot();
+  }
+
+  if (this.reusingImageAsReference) {
+    // Show reference div, & take a snapshot
+    var referenceDiv = document.getElementById(this.imageElementId);
+    this.enableDisplay(referenceDiv);
+
+    this.referenceSnapshot = snapshotWindow(window, false);
+    var snapResult = compareSnapshots(this.cleanSnapshot, this.referenceSnapshot,
+                                      false);
+    if (!snapResult[0]) {
+      if (this.blankWaitTime > 2000) {
+        // if it took longer than two seconds to load the image, we probably
+        // have a problem.
+        this.wereFailures = true;
+        ok(snapResult[0],
+           "Reference snapshot shouldn't match clean (non-image) snapshot");
+      } else {
+        this.blankWaitTime += 20;
+        // let's wait a bit and see if it clears up
+        setTimeout(referencePoller, 20);
+        return;
+      }
+    }
+
+    ok(snapResult[0],
+       "Reference snapshot shouldn't match clean (non-image) snapshot");
+
+    var dataString = "Reference Snapshot #" + this.numRefsTaken;
+    this.outputDebugInfo(dataString, 'refSnapId',
+                         this.referenceSnapshot.toDataURL());
+  } else {
+    // Make sure the animation section is hidden
+    this.disableDisplay(document.getElementById(this.imageElementId));
+
+    // Show reference div, & take a snapshot
+    var referenceDiv = document.getElementById(this.referenceElementId);
+    this.enableDisplay(referenceDiv);
+
+    this.referenceSnapshot = snapshotWindow(window, false);
+    var snapResult = compareSnapshots(this.cleanSnapshot, this.referenceSnapshot, false);
+    if (!snapResult[0]) {
+      if (this.blankWaitTime > 2000) {
+        // if it took longer than two seconds to load the image, we probably
+        // have a problem.
+        this.wereFailures = true;
+        ok(snapResult[0],
+           "Reference snapshot shouldn't match clean (non-image) snapshot");
+      } else {
+        this.blankWaitTime += 20;
+        // let's wait a bit and see if it clears up
+        setTimeout(referencePoller, 20);
+        return;
+      }
+    }
+
+    ok(snapResult[0],
+       "Reference snapshot shouldn't match clean (non-image) snapshot");
+
+    var dataString = "Reference Snapshot #" + this.numRefsTaken;
+    this.outputDebugInfo(dataString, 'refSnapId',
+                         this.referenceSnapshot.toDataURL());
+
+    // Re-hide reference div, and take another snapshot to be sure it's gone
+    this.disableDisplay(referenceDiv);
+    this.testBlankCameBack();
+  }
+};
+
+AnimationTest.prototype.enableDisplay = function(element)
+{
+  if (!element) {
+    return;
+  }
+
+  if (!this.xulTest) {
+    element.style.display = '';
+  } else {
+    element.setAttribute('hidden', 'false');
+  }
+};
+
+AnimationTest.prototype.disableDisplay = function(element)
+{
+  if (!element) {
+    return;
+  }
+
+  if (!this.xulTest) {
+    element.style.display = 'none';
+  } else {
+    element.setAttribute('hidden', 'true');
+  }
+};
+
+AnimationTest.prototype.testBlankCameBack = function()
+{
+  var blankSnapshot2 = snapshotWindow(window, false);
+  var result = compareSnapshots(this.blankSnapshot, blankSnapshot2, true);
+  ok(result[0], "Reference image should disappear when it becomes display:none");
+
+  if (!result[0]) {
+    this.wereFailures = true;
+    var dataString = "Second Blank Snapshot";
+    this.outputDebugInfo(dataString, 'blank2SnapId', result[2]);
+  }
+};
+
+AnimationTest.prototype.cleanUpAndFinish = function ()
+{
+  // On the off chance that failTest and checkImage are triggered
+  // back-to-back, use a flag to prevent multiple calls to SimpleTest.finish.
+  if (this.isTestFinished) {
+    return;
+  }
+
+  this.isTestFinished = true;
+
+  // Call our closing function, if one exists
+  if (this.closeFunc) {
+    this.closeFunc();
+    return;
+  }
+
+  if (this.wereFailures) {
+    document.getElementById(this.debugElementId).style.display = 'block';
+  }
+
+  SimpleTest.finish();
+  document.getElementById(this.debugElementId).style.display = "";
+};
diff --git a/image/test/mochitest/filter-final.svg b/image/test/mochitest/filter-final.svg
new file mode 100644
index 000000000000..b2b3dca00885
--- /dev/null
+++ b/image/test/mochitest/filter-final.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<filter id="filter1" x="0%" y="0%" width="100%" height="100%">
+  <feImage xlink:href="animated-gif-finalframe.gif"/>
+</filter>
+<g>
+	<rect x="0" y="0" width="100%" height="100%" filter="url(#filter1)"/>
+</g>
+</svg>
diff --git a/image/test/mochitest/filter.svg b/image/test/mochitest/filter.svg
new file mode 100644
index 000000000000..e185f15b69ad
--- /dev/null
+++ b/image/test/mochitest/filter.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<filter id="filter1" x="0%" y="0%" width="100%" height="100%">
+  <feImage xlink:href="animated-gif.gif"/>
+</filter>
+<g>
+	<rect x="0" y="0" width="100%" height="100%" filter="url(#filter1)"/>
+</g>
+</svg>
diff --git a/image/test/mochitest/iframe.html b/image/test/mochitest/iframe.html
new file mode 100644
index 000000000000..6d66557ef803
--- /dev/null
+++ b/image/test/mochitest/iframe.html
@@ -0,0 +1,5 @@
+<html>
+<body bgcolor="gray">
+  <img src="animated-gif.gif">
+</body>
+</html>
\ No newline at end of file
diff --git a/image/test/mochitest/purple.gif b/image/test/mochitest/purple.gif
new file mode 100644
index 000000000000..79826af205d7
Binary files /dev/null and b/image/test/mochitest/purple.gif differ
diff --git a/image/test/mochitest/ref-iframe.html b/image/test/mochitest/ref-iframe.html
new file mode 100644
index 000000000000..585772c8a96a
--- /dev/null
+++ b/image/test/mochitest/ref-iframe.html
@@ -0,0 +1,6 @@
+<html>
+<body bgcolor="gray">
+  <div id="referenceImage"
+    style="height: 40px; width: 40px; background: #2aff00"></div>
+</body>
+</html>
diff --git a/image/test/mochitest/test_animation.html b/image/test/mochitest/test_animation.html
new file mode 100644
index 000000000000..b0dc5ff7f186
--- /dev/null
+++ b/image/test/mochitest/test_animation.html
@@ -0,0 +1,46 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=666446
+-->
+<head>
+  <title>Test for Bug 666446 - General Animated GIF Test</title>
+  <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
+  <script type="application/javascript" src="imgutils.js"></script>
+  <script type="application/javascript" src="animationPolling.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=666446">
+Mozilla Bug 666446: lots of animated gifs swamp us with paint events
+</a>
+<p id="display"></p>
+
+<div id="content">
+  <div id="referenceDiv" style="height: 40px; width: 40px;
+                                display: none; background: #2aff00"></div>
+  <div id="animatedImage">
+    <img id="animatedGif" src="animated-gif.gif" style="display: none;">
+      <div id="text-descr"></div>
+  </div>
+  <div id="debug" style="display:none">
+  </div>
+</div>
+<pre id="test">
+<script type="text/javascript;version=1.8">
+const FAILURE_TIMEOUT = 120000; // Fail early after 120 seconds (2 minutes)
+
+function main()
+{
+  var animTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceDiv',
+                                   'animatedGif', 'debug');
+  animTest.beginTest();
+}
+
+window.onload = main;
+</script>
+</pre>
+</body>
+</html>
diff --git a/image/test/mochitest/test_background_image_anim.html b/image/test/mochitest/test_background_image_anim.html
new file mode 100644
index 000000000000..f9b1f59265d2
--- /dev/null
+++ b/image/test/mochitest/test_background_image_anim.html
@@ -0,0 +1,44 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=666446
+-->
+<head>
+  <title>Test for Bug 666446 - Animated Background Images</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
+  <script type="application/javascript" src="imgutils.js"></script>
+  <script type="application/javascript" src="animationPolling.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=666446">
+Mozilla Bug 666446: lots of animated gifs swamp us with paint events
+</a>
+<p id="display"></p>
+<div id="content">
+  <div id="referenceDiv" style="height: 140px; width: 140px;
+                                display: none; background: #2aff00"></div>
+  <div id="bgImage" style="height: 140px; width: 140px; background-image: url(animated-gif.gif); display: none;">
+  </div>
+</div>
+<div id="debug" style="display:none"></div>
+<pre id="test">
+<script type="text/javascript;version=1.8">
+
+/** Test for Bug 666446 nsImageLoader/RasterImage**/
+
+const FAILURE_TIMEOUT = 120000; // Fail early after 120 seconds (2 minutes)
+
+function main() {
+  var animTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceDiv',
+                                   'bgImage', 'debug');
+  animTest.beginTest();
+}
+
+window.onload = main;
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/image/test/mochitest/test_bullet_animation.html b/image/test/mochitest/test_bullet_animation.html
new file mode 100644
index 000000000000..fd0622e37adc
--- /dev/null
+++ b/image/test/mochitest/test_bullet_animation.html
@@ -0,0 +1,57 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=666446
+-->
+<head>
+  <title>Test for Bug 666446 - Animated Bullets</title>
+  <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
+  <script type="application/javascript" src="imgutils.js"></script>
+  <script type="application/javascript" src="animationPolling.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=666446">
+Mozilla Bug 666446: lots of animated gifs swamp us with paint events
+</a>
+<p id="display"></p>
+
+<div id="content">
+  <div id="cleanDiv" style="display: none;">
+    <ul>
+      <li>Test 1</li>
+    </ul>
+  </div>
+  <div id="referenceDiv" style="display: none;">
+    <ul>
+      <li style="list-style-image: url(animated-gif-finalframe.gif);">Test 1</li>
+    </ul>
+  </div>
+  <div id="animatedImage" style="display: none;">
+      <ul>
+        <li style="list-style-image: url(animated-gif.gif);">Test 1</li>
+      </ul>
+  </div>
+  <div id="text-descr"></div>
+  <div id="debug" style="display:none">
+  </div>
+</div>
+<pre id="test">
+<script type="text/javascript;version=1.8">
+const FAILURE_TIMEOUT = 120000; // Fail early after 120 seconds (2 minutes)
+
+function main()
+{
+  var animTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceDiv',
+                                   'animatedImage', 'debug', 'cleanDiv',
+                                   'animated-gif-finalframe.gif');
+  animTest.beginTest();
+}
+
+window.onload = main;
+</script>
+</pre>
+</body>
+</html>
diff --git a/image/test/mochitest/test_changeOfSource.html b/image/test/mochitest/test_changeOfSource.html
new file mode 100644
index 000000000000..51972bffb13d
--- /dev/null
+++ b/image/test/mochitest/test_changeOfSource.html
@@ -0,0 +1,63 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=666446
+-->
+<head>
+  <title>Test for Bug 666446 - Change of Source (1st Version)</title>
+  <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
+  <script type="application/javascript" src="imgutils.js"></script>
+  <script type="application/javascript" src="animationPolling.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=666446">
+Mozilla Bug 666446: lots of animated gifs swamp us with paint events
+</a>
+<p id="display"></p>
+
+<div id="content">
+  <div id="referenceDiv" style="height: 40px; width: 40px;
+                                display: none; background: #2aff00;">
+  </div>
+  <div id="animatedImage">
+    <img id='animatedGif' src="animated-gif.gif" style="display: none;">
+  </div>
+  <div id="text-descr"></div>
+  <div id="debug" style="display:none">
+  </div>
+</div>
+<pre id="test">
+<script type="text/javascript;version=1.8">
+const FAILURE_TIMEOUT = 120000; // Fail early after 120 seconds (2 minutes)
+
+var gAnimTest;
+var gIntervalId;
+
+function initSecondTest() {
+  document.getElementById('debug').style.display = 'none';
+  document.getElementById('referenceDiv').style.background = "#9600ff";
+  document.getElementById('animatedGif').setAttribute('src',
+                                                      'animated-gif2.gif');
+  document.getElementById('animatedGif').style.display = 'none';
+  var secondTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceDiv',
+                                     'animatedGif', 'debug', '', '', false);
+  secondTest.beginTest();
+}
+
+function main()
+{
+  gAnimTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceDiv',
+                                'animatedGif', 'debug', '', '', false,
+                                initSecondTest);
+  gAnimTest.beginTest();
+
+}
+
+window.onload = main;
+</script>
+</pre>
+</body>
+</html>
diff --git a/image/test/mochitest/test_changeOfSource2.html b/image/test/mochitest/test_changeOfSource2.html
new file mode 100644
index 000000000000..08168be4feee
--- /dev/null
+++ b/image/test/mochitest/test_changeOfSource2.html
@@ -0,0 +1,48 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=666446
+-->
+<head>
+  <title>Test for Bug 691792 - Change of Source (2nd Version)</title>
+  <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
+  <script type="application/javascript" src="imgutils.js"></script>
+  <script type="application/javascript" src="animationPolling.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=691792">
+Mozilla Bug 691792: Change of src attribute for animated gifs no longer works as expected
+</a>
+<p id="display"></p>
+
+<div id="content">
+  <div id="animatedImage">
+    <img id='animatedGif' src="purple.gif" style="display: none;">
+  </div>
+  <div id="text-descr"></div>
+  <div id="debug" style="display:none">
+  </div>
+</div>
+<pre id="test">
+<script type="text/javascript;version=1.8">
+const FAILURE_TIMEOUT = 120000; // Fail early after 120 seconds (2 minutes)
+
+var gAnimTest;
+var gIntervalId;
+
+function main()
+{
+  gAnimTest = new AnimationTest(20, FAILURE_TIMEOUT, 'animated-gif2.gif',
+                                'animatedGif', 'debug', '', 'animated-gif2.gif',
+                                false);
+  gAnimTest.beginTest();
+}
+
+window.onload = main;
+</script>
+</pre>
+</body>
+</html>
diff --git a/image/test/mochitest/test_svg_animatedGIF.html b/image/test/mochitest/test_svg_animatedGIF.html
new file mode 100644
index 000000000000..d7889726d1f5
--- /dev/null
+++ b/image/test/mochitest/test_svg_animatedGIF.html
@@ -0,0 +1,52 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=666446
+-->
+<head>
+  <title>Test for Bug 666446 - Animated Raster Images inside of SVG Frames</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
+  <script type="application/javascript" src="imgutils.js"></script>
+  <script type="application/javascript" src="animationPolling.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+
+<!--  Make sure embed element is snapped to an exact pixel. -->
+<div class="bug-header" style="height: 100px;">
+  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=666446">
+  Mozilla Bug 666446: lots of animated gifs swamp us with paint events
+  </a>
+</div>
+
+<p id="display"></p>
+<div id="content">
+  <div id="referenceDiv" style="height: 40px; width: 40px;
+                                display: none; background: #2aff00"></div>
+    <!--
+        We use <embed> here instead of <img> because the <img> tag utilizes
+        the VectorImage class for SVG, whereas in this test, we are testing
+        RasterImage.
+     -->
+  <embed id="embeddedSVG" src="animation.svg" type="image/svg+xml" style="display: none;"/>
+</div>
+<div id="debug" style="display:none"></div>
+<pre id="test">
+<script type="text/javascript;version=1.8">
+
+/** Test for Bug 666446 nsSVGImageFrame/RasterImage**/
+
+const FAILURE_TIMEOUT = 120000; // Fail early after 120 seconds (2 minutes)
+
+function main() {
+  var animTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceDiv',
+      							   'embeddedSVG', 'debug', '', 'src');
+  animTest.beginTest();
+}
+
+window.onload = main;
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/image/test/mochitest/test_svg_filter_animation.html b/image/test/mochitest/test_svg_filter_animation.html
new file mode 100644
index 000000000000..c58505416a20
--- /dev/null
+++ b/image/test/mochitest/test_svg_filter_animation.html
@@ -0,0 +1,42 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=666446
+-->
+<head>
+  <title>Test for Bug 666446 - Animated Images within SVG Filters</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
+  <script type="application/javascript" src="imgutils.js"></script>
+  <script type="application/javascript" src="animationPolling.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=666446">
+Mozilla Bug 666446: lots of animated gifs swamp us with paint events
+</a>
+<p id="display"></p>
+<div id="content">
+  <embed id="referenceImage" src="filter-final.svg" type="image/svg+xml" style="display: none;"/>
+  <embed id="embeddedSVGFilt" src="filter.svg" type="image/svg+xml" style="display: none;"/>
+</div>
+<div id="debug" style="display:none"></div>
+<pre id="test">
+<script type="text/javascript;version=1.8">
+
+/** Test for Bug 666446 nsSVGFEImageElement/RasterImage**/
+
+const FAILURE_TIMEOUT = 120000; // Fail early after 120 seconds (2 minutes)
+
+function main() {
+  var animTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceImage',
+                       'embeddedSVGFilt', 'debug', '', 'src');
+  animTest.beginTest();
+}
+
+window.onload = main;
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/image/test/mochitest/test_undisplayed_iframe.html b/image/test/mochitest/test_undisplayed_iframe.html
new file mode 100644
index 000000000000..55c6b41f27db
--- /dev/null
+++ b/image/test/mochitest/test_undisplayed_iframe.html
@@ -0,0 +1,48 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=666446
+-->
+<head>
+<title>Test for Bug 666446 - Test for Animated Gif within IFRAME</title>
+<script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
+<script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+<script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
+<script type="application/javascript" src="imgutils.js"></script>
+<script type="application/javascript" src="animationPolling.js"></script>
+<link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=666446">
+    Mozilla Bug 666446: lots of animated gifs swamp us with paint events</a>
+  <p id="display"></p>
+
+  <div id="content">
+    <div id="referenceDiv" style="display:none;">
+      <iframe id="referenceIFrame" src="ref-iframe.html" width="50%" height="100">
+        Browser does not support iframes.
+      </iframe>
+    </div>
+    <div id="animatedImage">
+      <iframe id="imageIFrame" src="iframe.html" width="50%" height="100" style="display: none;">
+        Browser does not support iframes.
+      </iframe>
+    </div>
+    <div id="debug" style="display: none"></div>
+  </div>
+  <pre id="test">
+<script type="text/javascript;version=1.8">
+const FAILURE_TIMEOUT = 120000; // Fail early after 120 seconds (2 minutes)
+
+function main()
+{
+  var animTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceDiv',
+                                   'imageIFrame', 'debug');
+  animTest.beginTest();
+}
+
+window.onload = main;
+</script>
+</pre>
+</body>
+</html>
diff --git a/image/test/mochitest/test_xultree_animation.xhtml b/image/test/mochitest/test_xultree_animation.xhtml
new file mode 100644
index 000000000000..35157fbe957e
--- /dev/null
+++ b/image/test/mochitest/test_xultree_animation.xhtml
@@ -0,0 +1,67 @@
+<!DOCTYPE HTML>
+<html
+xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      xml:lang="en" lang="en">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=666446
+-->
+<head>
+  <title>Test for Bug 666446 - Animated Images within SVG Filters</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
+  <script type="application/javascript" src="imgutils.js"></script>
+  <script type="application/javascript" src="animationPolling.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=666446">
+Mozilla Bug 666446: lots of animated gifs swamp us with paint events
+</a>
+<p id="display"></p>
+<div id="content">
+  <xul:caption label="Bug 666446 - XULTree Test" />
+  <xul:separator />
+    <br />
+    <xul:window id="main" title="Bug 666446: XUL Tree Testing" width="100" height="100">
+      <xul:tree flex="1">
+        <xul:treecols>
+          <xul:treecol id="icon" label="Icon" flex="1" />
+        </xul:treecols>
+
+        <xul:treechildren>
+          <xul:treeitem id="referenceItem" hidden="true">
+            <xul:treerow>
+              <xul:treecell src="animated-gif-finalframe.gif" width="40" height="40" />
+            </xul:treerow>
+          </xul:treeitem>
+          <xul:treeitem id="imageItem" hidden="true">
+            <xul:treerow>
+              <xul:treecell src="animated-gif.gif" width="40" height="40" />
+            </xul:treerow>
+          </xul:treeitem>
+        </xul:treechildren>
+      </xul:tree>
+    </xul:window>
+  </div>
+<div id="debug" style="display:none"></div>
+<pre id="test">
+<script type="text/javascript;version=1.8">
+
+/** Test for Bug 666446 nsSVGFEImageElement/RasterImage**/
+
+const FAILURE_TIMEOUT = 5000; // Fail early after 120 seconds (2 minutes)
+
+function main() {
+  var animTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceItem',
+                                   'imageItem', 'debug', '',
+                                   'animated-gif-finalframe.gif', true);
+  animTest.beginTest();
+}
+
+window.onload = main;
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/image/test/unit/image1png16x16.jpg b/image/test/unit/image1png16x16.jpg
index b0176d692e73..645bc114c8de 100644
Binary files a/image/test/unit/image1png16x16.jpg and b/image/test/unit/image1png16x16.jpg differ
diff --git a/image/test/unit/image1png64x64.jpg b/image/test/unit/image1png64x64.jpg
index f44ebe90b37c..11c34f6c6606 100644
Binary files a/image/test/unit/image1png64x64.jpg and b/image/test/unit/image1png64x64.jpg differ
diff --git a/image/test/unit/test_imgtools.js b/image/test/unit/test_imgtools.js
index 5578886f85e3..f66682b9811e 100644
--- a/image/test/unit/test_imgtools.js
+++ b/image/test/unit/test_imgtools.js
@@ -171,7 +171,7 @@ var encodedBytes = streamToArray(istream);
 var refName = "image1png16x16.jpg";
 var refFile = do_get_file(refName);
 istream = getFileInputStream(refFile);
-do_check_eq(istream.available(), 1081);
+do_check_eq(istream.available(), 1078);
 var referenceBytes = streamToArray(istream);
 
 // compare the encoder's output to the reference file.
@@ -190,7 +190,7 @@ encodedBytes = streamToArray(istream);
 refName = "image1png64x64.jpg";
 refFile = do_get_file(refName);
 istream = getFileInputStream(refFile);
-do_check_eq(istream.available(), 4493);
+do_check_eq(istream.available(), 4503);
 referenceBytes = streamToArray(istream);
 
 // compare the encoder's output to the reference file.
diff --git a/intl/unicharutil/util/Makefile.in b/intl/unicharutil/util/Makefile.in
index 1ca92ba30d8b..bef60a0da7af 100644
--- a/intl/unicharutil/util/Makefile.in
+++ b/intl/unicharutil/util/Makefile.in
@@ -71,7 +71,6 @@ CPPSRCS	= \
 	$(NULL)
 
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 USE_STATIC_LIBS = 1
 
 LOCAL_INCLUDES += -I$(srcdir)/../src
diff --git a/intl/unicharutil/util/internal/Makefile.in b/intl/unicharutil/util/internal/Makefile.in
index 760236048874..0e583db75b3c 100644
--- a/intl/unicharutil/util/internal/Makefile.in
+++ b/intl/unicharutil/util/internal/Makefile.in
@@ -64,7 +64,6 @@ LOCAL_INCLUDES	+= -I$(srcdir)/.. \
 CPPSRCS	= $(INTL_UNICHARUTIL_UTIL_LCPPSRCS)
 
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/ipc/chromium/src/base/message_loop.cc b/ipc/chromium/src/base/message_loop.cc
index 7f2b444a220e..38edbd594a36 100644
--- a/ipc/chromium/src/base/message_loop.cc
+++ b/ipc/chromium/src/base/message_loop.cc
@@ -27,7 +27,7 @@
 #include "base/message_pump_qt.h"
 #endif
 #endif
-#ifdef MOZ_WIDGET_ANDROID
+#ifdef ANDROID
 #include "base/message_pump_android.h"
 #endif
 
diff --git a/ipc/glue/GeckoChildProcessHost.cpp b/ipc/glue/GeckoChildProcessHost.cpp
index e7038d9182d4..13575a51489c 100644
--- a/ipc/glue/GeckoChildProcessHost.cpp
+++ b/ipc/glue/GeckoChildProcessHost.cpp
@@ -70,14 +70,14 @@
 #define NS_TASKBAR_CONTRACTID "@mozilla.org/windows-taskbar;1"
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "APKOpen.h"
 #endif
 
 using mozilla::MonitorAutoLock;
 using mozilla::ipc::GeckoChildProcessHost;
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 // Like its predecessor in nsExceptionHandler.cpp, this is
 // the magic number of a file descriptor remapping we must
 // preserve for the child process.
@@ -446,9 +446,9 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
         nsCString path;
         greDir->GetNativePath(path);
 # ifdef OS_LINUX
-#  ifdef ANDROID
+#  ifdef MOZ_WIDGET_ANDROID
         path += "/lib";
-#  endif  // ANDROID
+#  endif  // MOZ_WIDGET_ANDROID
         const char *ld_library_path = PR_GetEnv("LD_LIBRARY_PATH");
         nsCString new_ld_lib_path;
         if (ld_library_path && *ld_library_path) {
@@ -489,7 +489,7 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
   FilePath exePath;
   GetPathToBinary(exePath);
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   // The java wrapper unpacks this for us but can't make it executable
   chmod(exePath.value().c_str(), 0700);
   int cacheCount = 0;
@@ -521,7 +521,7 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
     snprintf(buf, sizeof(buf), "%d%s", kMagicAndroidSystemPropFd, szptr);
     newEnvVars["ANDROID_PROPERTY_WORKSPACE"] = buf;
   }
-#endif  // ANDROID
+#endif  // MOZ_WIDGET_ANDROID
 
   // remap the IPC socket fd to a well-known int, as the OS does for
   // STDOUT_FILENO, for example
@@ -589,7 +589,7 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
 
   childArgv.push_back(childProcessType);
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   childArgv.push_back(cacheStr.get());
 #endif
 
diff --git a/js/jsd/idl/jsdIDebuggerService.idl b/js/jsd/idl/jsdIDebuggerService.idl
index 6618c5a9e322..0092d744e5b6 100644
--- a/js/jsd/idl/jsdIDebuggerService.idl
+++ b/js/jsd/idl/jsdIDebuggerService.idl
@@ -274,7 +274,10 @@ interface jsdIDebuggerService : nsISupports
      */
     unsigned long pause();
     /**
-     * Undo a pause.
+     * Undo a pause.  Once this is called, the debugger won't start
+     * getting execution callbacks until the stack is fully unwound so
+     * that no JS scripts are live.  There is no way to query whether
+     * there are such scripts left to unwind at a given point in time.
      *
      * @return depth The number of remaining pending pause calls.
      */
diff --git a/js/jsd/jsd_hook.c b/js/jsd/jsd_hook.c
index 45c6be8e5979..1cef8f8a2410 100644
--- a/js/jsd/jsd_hook.c
+++ b/js/jsd/jsd_hook.c
@@ -124,10 +124,10 @@ jsd_ThrowHandler(JSContext *cx, JSScript *script, jsbytecode *pc,
     void*                 hookData;
 
     if( ! jsdc || ! jsdc->inited )
-        return JSD_HOOK_RETURN_CONTINUE_THROW;
+        return JSTRAP_CONTINUE;
 
     if( JSD_IS_DANGEROUS_THREAD(jsdc) )
-        return JSD_HOOK_RETURN_CONTINUE_THROW;
+        return JSTRAP_CONTINUE;
 
     /* local in case jsdc->throwHook gets cleared on another thread */
     JSD_LOCK();
@@ -135,13 +135,13 @@ jsd_ThrowHandler(JSContext *cx, JSScript *script, jsbytecode *pc,
     hookData = jsdc->throwHookData;
     JSD_UNLOCK();
     if (!hook)
-        return JSD_HOOK_RETURN_CONTINUE_THROW;
+        return JSTRAP_CONTINUE;
 
     JSD_LOCK_SCRIPTS(jsdc);
     jsdscript = jsd_FindOrCreateJSDScript(jsdc, cx, script, NULL);
     JSD_UNLOCK_SCRIPTS(jsdc);
     if( ! jsdscript )
-        return JSD_HOOK_RETURN_CONTINUE_THROW;
+        return JSTRAP_CONTINUE;
 
     JS_GetPendingException(cx, rval);
 
diff --git a/js/jsd/jsd_xpc.cpp b/js/jsd/jsd_xpc.cpp
index f6de7896e87e..3af4daeb4906 100644
--- a/js/jsd/jsd_xpc.cpp
+++ b/js/jsd/jsd_xpc.cpp
@@ -378,7 +378,7 @@ jsds_FilterHook (JSDContext *jsdc, JSDThreadState *state)
 
     jsuword pc = JSD_GetPCForStackFrame (jsdc, state, frame);
 
-    nsDependentCString url(JSD_GetScriptFilename (jsdc, script));
+    nsCString url(JSD_GetScriptFilename (jsdc, script));
     if (url.IsEmpty()) {
         NS_WARNING ("Script with no filename");
         return false;
@@ -471,7 +471,7 @@ jsds_NotifyPendingDeadScripts (JSContext *cx)
     if (jsds) {
         NS_ADDREF(jsds);
         jsds->GetScriptHook (getter_AddRefs(hook));
-        jsds->Pause(nsnull);
+        jsds->DoPause(nsnull, true);
     }
 
     DeadScript *deadScripts = gDeadScripts;
@@ -506,7 +506,7 @@ jsds_NotifyPendingDeadScripts (JSContext *cx)
     }
 
     if (jsds) {
-        jsds->UnPause(nsnull);
+        jsds->DoUnPause(nsnull, true);
         NS_RELEASE(jsds);
     }
 }
@@ -583,9 +583,9 @@ jsds_ErrorHookProc (JSDContext *jsdc, JSContext *cx, const char *message,
         errnum   = 0;
     }
     
-    gJsds->Pause(nsnull);
+    gJsds->DoPause(nsnull, true);
     hook->OnError (nsDependentCString(message), fileName, line, pos, flags, errnum, val, &rval);
-    gJsds->UnPause(nsnull);
+    gJsds->DoUnPause(nsnull, true);
     
     running = false;
     if (!rval)
@@ -626,9 +626,9 @@ jsds_CallHookProc (JSDContext* jsdc, JSDThreadState* jsdthreadstate,
     nsCOMPtr<jsdIStackFrame> frame =
         getter_AddRefs(jsdStackFrame::FromPtr(jsdc, jsdthreadstate,
                                               native_frame));
-    gJsds->Pause(nsnull);
+    gJsds->DoPause(nsnull, true);
     hook->OnCall(frame, type);    
-    gJsds->UnPause(nsnull);
+    gJsds->DoUnPause(nsnull, true);
     jsdStackFrame::InvalidateAll();
 
     return JS_TRUE;
@@ -688,13 +688,13 @@ jsds_ExecutionHookProc (JSDContext* jsdc, JSDThreadState* jsdthreadstate,
     nsCOMPtr<jsdIStackFrame> frame =
         getter_AddRefs(jsdStackFrame::FromPtr(jsdc, jsdthreadstate,
                                               native_frame));
-    gJsds->Pause(nsnull);
+    gJsds->DoPause(nsnull, true);
     jsdIValue *inout_rv = js_rv;
     NS_IF_ADDREF(inout_rv);
     hook->OnExecute (frame, type, &inout_rv, &hook_rv);
     js_rv = inout_rv;
     NS_IF_RELEASE(inout_rv);
-    gJsds->UnPause(nsnull);
+    gJsds->DoUnPause(nsnull, true);
     jsdStackFrame::InvalidateAll();
         
     if (hook_rv == JSD_HOOK_RETURN_RET_WITH_VAL ||
@@ -734,9 +734,9 @@ jsds_ScriptHookProc (JSDContext* jsdc, JSDScript* jsdscript, JSBool creating,
 #ifdef CAUTIOUS_SCRIPTHOOK
         JS_UNKEEP_ATOMS(rt);
 #endif
-        gJsds->Pause(nsnull);
+        gJsds->DoPause(nsnull, true);
         hook->OnScriptCreated (script);
-        gJsds->UnPause(nsnull);
+        gJsds->DoUnPause(nsnull, true);
 #ifdef CAUTIOUS_SCRIPTHOOK
         JS_KEEP_ATOMS(rt);
 #endif
@@ -763,9 +763,9 @@ jsds_ScriptHookProc (JSDContext* jsdc, JSDScript* jsdscript, JSBool creating,
             JS_UNKEEP_ATOMS(rt);
 #endif
                 
-            gJsds->Pause(nsnull);
+            gJsds->DoPause(nsnull, true);
             hook->OnScriptDestroyed (jsdis);
-            gJsds->UnPause(nsnull);
+            gJsds->DoUnPause(nsnull, true);
 #ifdef CAUTIOUS_SCRIPTHOOK
             JS_KEEP_ATOMS(rt);
 #endif
@@ -2546,21 +2546,12 @@ jsdService::AsyncOn (jsdIActivationCallback *activationCallback)
 {
     nsresult  rv;
 
-    /* get JS things from the CallContext */
     nsCOMPtr<nsIXPConnect> xpc = do_GetService(nsIXPConnect::GetCID(), &rv);
     if (NS_FAILED(rv)) return rv;
 
-    nsAXPCNativeCallContext *cc = nsnull;
-    rv = xpc->GetCurrentNativeCallContext(&cc);
-    if (NS_FAILED(rv)) return rv;
-
-    JSContext *cx;
-    rv = cc->GetJSContext (&cx);
-    if (NS_FAILED(rv)) return rv;
-
     mActivationCallback = activationCallback;
     
-    return xpc->SetDebugModeWhenPossible(true);
+    return xpc->SetDebugModeWhenPossible(true, true);
 }
 
 NS_IMETHODIMP
@@ -2706,7 +2697,7 @@ jsdService::Off (void)
     if (NS_FAILED(rv))
         return rv;
 
-    xpc->SetDebugModeWhenPossible(false);
+    xpc->SetDebugModeWhenPossible(false, true);
 
     return NS_OK;
 }
@@ -2721,6 +2712,12 @@ jsdService::GetPauseDepth(PRUint32 *_rval)
     
 NS_IMETHODIMP
 jsdService::Pause(PRUint32 *_rval)
+{
+    return DoPause(_rval, false);
+}
+
+nsresult
+jsdService::DoPause(PRUint32 *_rval, bool internalCall)
 {
     if (!mCx)
         return NS_ERROR_NOT_INITIALIZED;
@@ -2734,6 +2731,15 @@ jsdService::Pause(PRUint32 *_rval)
         JSD_ClearTopLevelHook (mCx);
         JSD_ClearFunctionHook (mCx);
         JSD_DebuggerPause (mCx);
+
+        nsresult rv;
+        nsCOMPtr<nsIXPConnect> xpc = do_GetService(nsIXPConnect::GetCID(), &rv);
+        if (NS_FAILED(rv)) return rv;
+
+        if (!internalCall) {
+            rv = xpc->SetDebugModeWhenPossible(false, false);
+            NS_ENSURE_SUCCESS(rv, rv);
+        }
     }
 
     if (_rval)
@@ -2744,6 +2750,12 @@ jsdService::Pause(PRUint32 *_rval)
 
 NS_IMETHODIMP
 jsdService::UnPause(PRUint32 *_rval)
+{
+    return DoUnPause(_rval, false);
+}
+
+nsresult
+jsdService::DoUnPause(PRUint32 *_rval, bool internalCall)
 {
     if (!mCx)
         return NS_ERROR_NOT_INITIALIZED;
@@ -2774,6 +2786,15 @@ jsdService::UnPause(PRUint32 *_rval)
             JSD_SetFunctionHook (mCx, jsds_CallHookProc, NULL);
         else
             JSD_ClearFunctionHook (mCx);
+
+        nsresult rv;
+        nsCOMPtr<nsIXPConnect> xpc = do_GetService(nsIXPConnect::GetCID(), &rv);
+        if (NS_FAILED(rv)) return rv;
+
+        if (!internalCall) {
+            rv = xpc->SetDebugModeWhenPossible(true, false);
+            NS_ENSURE_SUCCESS(rv, rv);
+        }
     }
     
     if (_rval)
@@ -3110,9 +3131,9 @@ jsdService::EnterNestedEventLoop (jsdINestCallback *callback, PRUint32 *_rval)
 
     if (NS_SUCCEEDED(stack->Push(nsnull))) {
         if (callback) {
-            Pause(nsnull);
+            DoPause(nsnull, true);
             rv = callback->OnNest();
-            UnPause(nsnull);
+            DoUnPause(nsnull, true);
         }
         
         while (NS_SUCCEEDED(rv) && mNestedLoopLevel >= nestLevel) {
diff --git a/js/jsd/jsd_xpc.h b/js/jsd/jsd_xpc.h
index 1301f351c2a6..817576c46d48 100644
--- a/js/jsd/jsd_xpc.h
+++ b/js/jsd/jsd_xpc.h
@@ -291,6 +291,9 @@ class jsdService : public jsdIDebuggerService
 
     bool CheckInterruptHook() { return !!mInterruptHook; }
     
+    nsresult DoPause(PRUint32 *_rval, bool internalCall);
+    nsresult DoUnPause(PRUint32 *_rval, bool internalCall);
+
   private:
     bool        mOn;
     PRUint32    mPauseLevel;
diff --git a/js/public/HashTable.h b/js/public/HashTable.h
index fde17da8c58c..4356eedd55bf 100644
--- a/js/public/HashTable.h
+++ b/js/public/HashTable.h
@@ -260,7 +260,6 @@ class HashTable : private AllocPolicy
 
   private:
     uint32      hashShift;      /* multiplicative hash shift */
-    uint32      tableCapacity;  /* = JS_BIT(sHashBits - hashShift) */
     uint32      entryCount;     /* number of entries in table */
     uint32      gen;            /* entry storage generation number */
     uint32      removedCount;   /* removed entry sentinels in table */
@@ -268,7 +267,6 @@ class HashTable : private AllocPolicy
 
     void setTableSizeLog2(unsigned sizeLog2) {
         hashShift = sHashBits - sizeLog2;
-        tableCapacity = JS_BIT(sizeLog2);
     }
 
 #ifdef DEBUG
@@ -414,7 +412,7 @@ class HashTable : private AllocPolicy
     ~HashTable()
     {
         if (table)
-            destroyTable(*this, table, tableCapacity);
+            destroyTable(*this, table, capacity());
     }
 
   private:
@@ -427,10 +425,11 @@ class HashTable : private AllocPolicy
     }
 
     bool overloaded() {
-        return entryCount + removedCount >= ((sMaxAlphaFrac * tableCapacity) >> 8);
+        return entryCount + removedCount >= ((sMaxAlphaFrac * capacity()) >> 8);
     }
 
     bool underloaded() {
+        uint32 tableCapacity = capacity();
         return tableCapacity > sMinSize &&
                entryCount <= ((sMinAlphaFrac * tableCapacity) >> 8);
     }
@@ -546,7 +545,7 @@ class HashTable : private AllocPolicy
     {
         /* Look, but don't touch, until we succeed in getting new entry store. */
         Entry *oldTable = table;
-        uint32 oldCap = tableCapacity;
+        uint32 oldCap = capacity();
         uint32 newLog2 = sHashBits - hashShift + deltaLog2;
         uint32 newCapacity = JS_BIT(newLog2);
         if (newCapacity > sMaxCapacity) {
@@ -604,8 +603,9 @@ class HashTable : private AllocPolicy
     void clear()
     {
         if (tl::IsPodType<Entry>::result) {
-            memset(table, 0, sizeof(*table) * tableCapacity);
+            memset(table, 0, sizeof(*table) * capacity());
         } else {
+            uint32 tableCapacity = capacity();
             for (Entry *e = table, *end = table + tableCapacity; e != end; ++e)
                 *e = Move(Entry());
         }
@@ -623,7 +623,7 @@ class HashTable : private AllocPolicy
         if (!table)
             return;
         
-        destroyTable(*this, table, tableCapacity);
+        destroyTable(*this, table, capacity());
         table = NULL;
         gen++;
         entryCount = 0;
@@ -634,7 +634,7 @@ class HashTable : private AllocPolicy
     }
 
     Range all() const {
-        return Range(table, table + tableCapacity);
+        return Range(table, table + capacity());
     }
 
     bool empty() const {
@@ -646,7 +646,7 @@ class HashTable : private AllocPolicy
     }
 
     uint32 capacity() const {
-        return tableCapacity;
+        return JS_BIT(sHashBits - hashShift);
     }
 
     uint32 generation() const {
@@ -660,7 +660,7 @@ class HashTable : private AllocPolicy
     size_t sizeOf(JSUsableSizeFun usf, bool countMe) const {
         size_t usable = usf(table) + (countMe ? usf((void*)this) : 0);
         return usable ? usable
-                      : (tableCapacity * sizeof(Entry)) + (countMe ? sizeof(HashTable) : 0);
+                      : (capacity() * sizeof(Entry)) + (countMe ? sizeof(HashTable) : 0);
     }
 
     Ptr lookup(const Lookup &l) const {
@@ -701,7 +701,7 @@ class HashTable : private AllocPolicy
             if (overloaded()) {
                 /* Compress if a quarter or more of all entries are removed. */
                 int deltaLog2;
-                if (removedCount >= (tableCapacity >> 2)) {
+                if (removedCount >= (capacity() >> 2)) {
                     METER(stats.compresses++);
                     deltaLog2 = 0;
                 } else {
@@ -912,7 +912,10 @@ class HashMapEntry
 
   public:
     HashMapEntry() : key(), value() {}
-    HashMapEntry(const Key &k, const Value &v) : key(k), value(v) {}
+
+    template<typename KeyInput, typename ValueInput>
+    HashMapEntry(const KeyInput &k, const ValueInput &v) : key(k), value(v) {}
+
     HashMapEntry(MoveRef<HashMapEntry> rhs) 
       : key(Move(rhs->key)), value(Move(rhs->value)) { }
     void operator=(MoveRef<HashMapEntry> rhs) {
@@ -1048,7 +1051,8 @@ class HashMap
         return impl.lookupForAdd(l);
     }
 
-    bool add(AddPtr &p, const Key &k, const Value &v) {
+    template<typename KeyInput, typename ValueInput>
+    bool add(AddPtr &p, const KeyInput &k, const ValueInput &v) {
         Entry *pentry;
         if (!impl.add(p, &pentry))
             return false;
@@ -1074,7 +1078,8 @@ class HashMap
         return true;
     }
 
-    bool relookupOrAdd(AddPtr &p, const Key &k, const Value &v) {
+    template<typename KeyInput, typename ValueInput>
+    bool relookupOrAdd(AddPtr &p, const KeyInput &k, const ValueInput &v) {
         return impl.relookupOrAdd(p, k, Entry(k, v));
     }
 
@@ -1137,7 +1142,8 @@ class HashMap
     }
 
     /* Overwrite existing value with v. Return NULL on oom. */
-    Entry *put(const Key &k, const Value &v) {
+    template<typename KeyInput, typename ValueInput>
+    Entry *put(const KeyInput &k, const ValueInput &v) {
         AddPtr p = lookupForAdd(k);
         if (p) {
             p->value = v;
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index fc48cbd6c665..e0e4bfbf01e7 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -250,6 +250,7 @@ EXPORTS_ds = \
 
 EXPORTS_gc = \
 		Statistics.h \
+		Barrier.h \
 		$(NULL)
 
 ######################################################
diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
index 6ccc1aa030bf..d8f0e7662baf 100644
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -159,11 +159,11 @@ ExecuteRegExpImpl(JSContext *cx, RegExpStatics *res, T *re, JSLinearString *inpu
 }
 
 bool
-js::ExecuteRegExp(JSContext *cx, RegExpStatics *res, RegExpPrivate *rep, JSLinearString *input,
+js::ExecuteRegExp(JSContext *cx, RegExpStatics *res, RegExpMatcher &matcher, JSLinearString *input,
                   const jschar *chars, size_t length,
                   size_t *lastIndex, RegExpExecType type, Value *rval)
 {
-    return ExecuteRegExpImpl(cx, res, rep, input, chars, length, lastIndex, type, rval);
+    return ExecuteRegExpImpl(cx, res, &matcher, input, chars, length, lastIndex, type, rval);
 }
 
 bool
@@ -278,7 +278,7 @@ CompileRegExpObject(JSContext *cx, RegExpObjectBuilder &builder,
     if (!escapedSourceStr)
         return false;
 
-    if (!RegExpPrivateCode::checkSyntax(cx, NULL, escapedSourceStr))
+    if (!CheckRegExpSyntax(cx, escapedSourceStr))
         return false;
 
     RegExpStatics *res = cx->regExpStatics();
@@ -515,15 +515,10 @@ ExecuteRegExp(JSContext *cx, Native native, uintN argc, Value *vp)
         return ok;
 
     RegExpObject *reobj = obj->asRegExp();
-    RegExpPrivate *rep = reobj->getOrCreatePrivate(cx);
-    if (!rep)
-        return true;
 
-    /*
-     * Code execution under this call could swap out the guts of |reobj|, so we
-     * have to take a defensive refcount here.
-     */
-    AutoRefCount<RegExpPrivate> arc(cx, NeedsIncRef<RegExpPrivate>(rep));
+    RegExpMatcher matcher(cx);
+    if (!matcher.reset(reobj))
+        return false;
 
     RegExpStatics *res = cx->regExpStatics();
 
@@ -548,7 +543,7 @@ ExecuteRegExp(JSContext *cx, Native native, uintN argc, Value *vp)
         return false;
 
     /* Steps 6-7 (with sticky extension). */
-    if (!rep->global() && !rep->sticky())
+    if (!matcher.global() && !matcher.sticky())
         i = 0;
 
     /* Step 9a. */
@@ -561,13 +556,13 @@ ExecuteRegExp(JSContext *cx, Native native, uintN argc, Value *vp)
     /* Steps 8-21. */
     RegExpExecType execType = (native == regexp_test) ? RegExpTest : RegExpExec;
     size_t lastIndexInt(i);
-    if (!ExecuteRegExp(cx, res, rep, linearInput, chars, length, &lastIndexInt, execType,
+    if (!ExecuteRegExp(cx, res, matcher, linearInput, chars, length, &lastIndexInt, execType,
                        &args.rval())) {
         return false;
     }
 
     /* Step 11 (with sticky extension). */
-    if (rep->global() || (!args.rval().isNull() && rep->sticky())) {
+    if (matcher.global() || (!args.rval().isNull() && matcher.sticky())) {
         if (args.rval().isNull())
             reobj->zeroLastIndex();
         else
diff --git a/js/src/builtin/RegExp.h b/js/src/builtin/RegExp.h
index eca17b112efc..eeccb431b207 100644
--- a/js/src/builtin/RegExp.h
+++ b/js/src/builtin/RegExp.h
@@ -64,7 +64,7 @@ ExecuteRegExp(JSContext *cx, RegExpStatics *res, RegExpObject *reobj, JSLinearSt
               size_t *lastIndex, RegExpExecType type, Value *rval);
 
 bool
-ExecuteRegExp(JSContext *cx, RegExpStatics *res, RegExpPrivate *rep, JSLinearString *input,
+ExecuteRegExp(JSContext *cx, RegExpStatics *res, RegExpMatcher &matcher, JSLinearString *input,
               const jschar *chars, size_t length,
               size_t *lastIndex, RegExpExecType type, Value *rval);
 
diff --git a/js/src/configure.in b/js/src/configure.in
index 499154c9c5a7..a42af11126b7 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -281,6 +281,60 @@ i?86-*android*)
     ;;
 esac
 
+MOZ_ARG_WITH_STRING(gonk,
+[  --with-gonk=DIR
+               location of gonk dir],
+    gonkdir=$withval)
+
+if test -n "$gonkdir" ; then
+    kernel_name=`uname -s | tr "[[:upper:]]" "[[:lower:]]"`
+    gonk_toolchain="$gonkdir"/prebuilt/$kernel_name-x86/toolchain/arm-eabi-4.4.3
+
+    dnl set up compilers
+    AS="$gonk_toolchain"/bin/"$android_tool_prefix"-as
+    CC="$gonk_toolchain"/bin/"$android_tool_prefix"-gcc
+    CXX="$gonk_toolchain"/bin/"$android_tool_prefix"-g++
+    CPP="$gonk_toolchain"/bin/"$android_tool_prefix"-cpp
+    LD="$gonk_toolchain"/bin/"$android_tool_prefix"-ld
+    AR="$gonk_toolchain"/bin/"$android_tool_prefix"-ar
+    RANLIB="$gonk_toolchain"/bin/"$android_tool_prefix"-ranlib
+    STRIP="$gonk_toolchain"/bin/"$android_tool_prefix"-strip
+
+    STLPORT_CPPFLAGS="-I$gonkdir/external/stlport/stlport"
+    STLPORT_LIBS="-lstlport"
+
+    CPPFLAGS="-DANDROID -I$gonkdir/bionic/libc/include/ -I$gonkdir/bionic/libc/kernel/common -I$gonkdir/bionic/libc/arch-arm/include -I$gonkdir/bionic/libc/kernel/arch-arm -I$gonkdir/bionic/libm/include -I$gonkdir/frameworks/base/native/include -I$gonkdir/system/core/include -I$gonkdir/bionic $STLPORT_CPPFLAGS $CPPFLAGS"
+    CFLAGS="-mandroid -fno-short-enums -fno-exceptions $CFLAGS"
+    CXXFLAGS="-mandroid -fno-short-enums -fno-exceptions $CXXFLAGS"
+    LIBS="$LIBS $STLPORT_LIBS"
+
+    dnl Add -llog by default, since we use it all over the place.
+    LDFLAGS="-mandroid -L$gonkdir/out/target/product/$GONK_PRODUCT/obj/lib -Wl,-rpath-link=$gonkdir/out/target/product/$GONK_PRODUCT/obj/lib --sysroot=$gonkdir/out/target/product/$GONK_PRODUCT/obj/ -llog $LDFLAGS"
+
+    dnl prevent cross compile section from using these flags as host flags
+    if test -z "$HOST_CPPFLAGS" ; then
+        HOST_CPPFLAGS=" "
+    fi
+    if test -z "$HOST_CFLAGS" ; then
+        HOST_CFLAGS=" "
+    fi
+    if test -z "$HOST_CXXFLAGS" ; then
+        HOST_CXXFLAGS=" "
+    fi
+    if test -z "$HOST_LDFLAGS" ; then
+        HOST_LDFLAGS=" "
+    fi
+
+    # save these for libffi's subconfigure,
+    # which doesn't know how to figure this stuff out on its own
+    ANDROID_CFLAGS="$CFLAGS"
+    ANDROID_CPPFLAGS="$CPPFLAGS"
+    ANDROID_LDFLAGS="$LDFLAGS"
+
+    AC_DEFINE(ANDROID)
+    AC_DEFINE(GONK)
+    CROSS_COMPILE=1
+else
 case "$target" in
 *-android*|*-linuxandroid*)
     if test -z "$android_ndk" ; then
@@ -403,6 +457,8 @@ case "$target" in
     ;;
 esac
 
+fi
+
 AC_SUBST(ANDROID_NDK)
 AC_SUBST(ANDROID_TOOLCHAIN)
 AC_SUBST(ANDROID_PLATFORM)
@@ -1247,8 +1303,6 @@ fi
 # but that breaks when you have a 64 bit kernel with a 32 bit userland.
 OS_TEST="${target_cpu}"
 
-_COMPILER_PREFIX=
-
 HOST_OS_ARCH=`echo $host_os | sed -e 's|/|_|g'`
 
 #######################################################################
@@ -1638,6 +1692,48 @@ fi # CPU_ARCH = arm
 AC_SUBST(HAVE_ARM_SIMD)
 AC_SUBST(HAVE_ARM_NEON)
 
+dnl =================================================================
+dnl Set up and test static assertion macros used to avoid AC_TRY_RUN,
+dnl which is bad when cross compiling.
+dnl =================================================================
+if test "$COMPILE_ENVIRONMENT"; then
+configure_static_assert_macros='
+#define CONFIGURE_STATIC_ASSERT(condition) CONFIGURE_STATIC_ASSERT_IMPL(condition, __LINE__)
+#define CONFIGURE_STATIC_ASSERT_IMPL(condition, line) CONFIGURE_STATIC_ASSERT_IMPL2(condition, line)
+#define CONFIGURE_STATIC_ASSERT_IMPL2(condition, line) typedef int static_assert_line_##line[(condition) ? 1 : -1]
+'
+
+dnl test that the macros actually work:
+AC_MSG_CHECKING(that static assertion macros used in autoconf tests work)
+AC_CACHE_VAL(ac_cv_static_assertion_macros_work,
+ [AC_LANG_SAVE
+  AC_LANG_C
+  ac_cv_static_assertion_macros_work="yes"
+  AC_TRY_COMPILE([$configure_static_assert_macros],
+                 [CONFIGURE_STATIC_ASSERT(1)],
+                 ,
+                 ac_cv_static_assertion_macros_work="no")
+  AC_TRY_COMPILE([$configure_static_assert_macros],
+                 [CONFIGURE_STATIC_ASSERT(0)],
+                 ac_cv_static_assertion_macros_work="no",
+                 )
+  AC_LANG_CPLUSPLUS
+  AC_TRY_COMPILE([$configure_static_assert_macros],
+                 [CONFIGURE_STATIC_ASSERT(1)],
+                 ,
+                 ac_cv_static_assertion_macros_work="no")
+  AC_TRY_COMPILE([$configure_static_assert_macros],
+                 [CONFIGURE_STATIC_ASSERT(0)],
+                 ac_cv_static_assertion_macros_work="no",
+                 )
+  AC_LANG_RESTORE
+ ])
+AC_MSG_RESULT("$ac_cv_static_assertion_macros_work")
+if test "$ac_cv_static_assertion_macros_work" = "no"; then
+    AC_MSG_ERROR([Compiler cannot compile macros used in autoconf tests.])
+fi
+fi # COMPILE_ENVIRONMENT
+
 dnl ========================================================
 dnl Android libstdc++, placed here so it can use MOZ_ARCH
 dnl computed above.
@@ -1701,8 +1797,8 @@ if test "$GNU_CC"; then
     DSO_CFLAGS=''
     DSO_PIC_CFLAGS='-fPIC'
     ASFLAGS="$ASFLAGS -fPIC"
-    _MOZ_RTTI_FLAGS_ON=${_COMPILER_PREFIX}-frtti
-    _MOZ_RTTI_FLAGS_OFF=${_COMPILER_PREFIX}-fno-rtti
+    _MOZ_RTTI_FLAGS_ON=-frtti
+    _MOZ_RTTI_FLAGS_OFF=-fno-rtti
 
     # Turn on GNU specific features
     # -Wall - turn on all warnings
@@ -1775,13 +1871,44 @@ if test "$GNU_CXX"; then
     _DEFINES_CXXFLAGS='-DMOZILLA_CLIENT -include $(DEPTH)/js-confdefs.h'
     _USE_CPP_INCLUDE_FLAG=1
 
+    # Recent clang and gcc support C++11 deleted functions without warnings if
+    # compiling with -std=c++0x or -std=gnu++0x (or c++11 or gnu++11 in very new
+    # versions).  We can't use -std=c++0x yet, so gcc's support must remain
+    # unused.  But clang's warning can be disabled, so when compiling with clang
+    # we use it to opt out of the warning, enabling (macro-encapsulated) use of
+    # deleted function syntax.
+    if test "$CLANG_CXX"; then
+        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-c++0x-extensions"
+    fi
+
+    AC_CACHE_CHECK(whether the compiler supports -Wno-extended-offsetof,
+                   ac_has_wno_extended_offsetof,
+        [
+            AC_LANG_SAVE
+            AC_LANG_CPLUSPLUS
+            _SAVE_CXXFLAGS="$CXXFLAGS"
+            CXXFLAGS="$CXXFLAGS -Wno-extended-offsetof"
+            AC_TRY_COMPILE([$configure_static_assert_macros
+                            #ifndef __has_warning
+                            #define __has_warning(x) 0
+                            #endif],
+                           [CONFIGURE_STATIC_ASSERT(__has_warning("-Wextended-offsetof"))],
+                           ac_has_wno_extended_offsetof="yes",
+                           ac_has_wno_extended_offsetof="no")
+            CXXFLAGS="$_SAVE_CXXFLAGS"
+            AC_LANG_RESTORE
+        ])
+    if test "$ac_has_wno_extended_offsetof" = "yes"; then
+        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-extended-offsetof"
+    fi
+
     AC_CACHE_CHECK(whether the compiler supports -Wno-invalid-offsetof,
                    ac_has_wno_invalid_offsetof,
         [
             AC_LANG_SAVE
             AC_LANG_CPLUSPLUS
             _SAVE_CXXFLAGS="$CXXFLAGS"
-            CXXFLAGS="$CXXFLAGS ${_COMPILER_PREFIX}-Wno-invalid-offsetof"
+            CXXFLAGS="$CXXFLAGS -Wno-invalid-offsetof"
             AC_TRY_COMPILE([],
                            [return(0);],
                            ac_has_wno_invalid_offsetof="yes",
@@ -1790,7 +1917,7 @@ if test "$GNU_CXX"; then
             AC_LANG_RESTORE
         ])
     if test "$ac_has_wno_invalid_offsetof" = "yes"; then
-        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} ${_COMPILER_PREFIX}-Wno-invalid-offsetof"
+        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-invalid-offsetof"
     fi
 
     AC_CACHE_CHECK(whether the compiler supports -Wno-variadic-macros,
@@ -1799,7 +1926,7 @@ if test "$GNU_CXX"; then
             AC_LANG_SAVE
             AC_LANG_CPLUSPLUS
             _SAVE_CXXFLAGS="$CXXFLAGS"
-            CXXFLAGS="$CXXFLAGS ${_COMPILER_PREFIX}-Wno-variadic-macros"
+            CXXFLAGS="$CXXFLAGS -Wno-variadic-macros"
             AC_TRY_COMPILE([],
                            [return(0);],
                            ac_has_wno_variadic_macros="yes",
@@ -1808,7 +1935,7 @@ if test "$GNU_CXX"; then
             AC_LANG_RESTORE
         ])
     if test "$ac_has_wno_variadic_macros" = "yes"; then
-        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} ${_COMPILER_PREFIX}-Wno-variadic-macros"
+        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-variadic-macros"
     fi
 
     AC_CACHE_CHECK(whether the compiler supports -Werror=return-type,
@@ -1873,48 +2000,6 @@ LOOP_INPUT
 fi # GNU_CC
 fi # COMPILE_ENVIRONMENT
 
-dnl =================================================================
-dnl Set up and test static assertion macros used to avoid AC_TRY_RUN,
-dnl which is bad when cross compiling.
-dnl =================================================================
-if test "$COMPILE_ENVIRONMENT"; then
-configure_static_assert_macros='
-#define CONFIGURE_STATIC_ASSERT(condition) CONFIGURE_STATIC_ASSERT_IMPL(condition, __LINE__)
-#define CONFIGURE_STATIC_ASSERT_IMPL(condition, line) CONFIGURE_STATIC_ASSERT_IMPL2(condition, line)
-#define CONFIGURE_STATIC_ASSERT_IMPL2(condition, line) typedef int static_assert_line_##line[(condition) ? 1 : -1]
-'
-
-dnl test that the macros actually work:
-AC_MSG_CHECKING(that static assertion macros used in autoconf tests work)
-AC_CACHE_VAL(ac_cv_static_assertion_macros_work,
- [AC_LANG_SAVE
-  AC_LANG_C
-  ac_cv_static_assertion_macros_work="yes"
-  AC_TRY_COMPILE([$configure_static_assert_macros],
-                 [CONFIGURE_STATIC_ASSERT(1)],
-                 ,
-                 ac_cv_static_assertion_macros_work="no")
-  AC_TRY_COMPILE([$configure_static_assert_macros],
-                 [CONFIGURE_STATIC_ASSERT(0)],
-                 ac_cv_static_assertion_macros_work="no",
-                 )
-  AC_LANG_CPLUSPLUS
-  AC_TRY_COMPILE([$configure_static_assert_macros],
-                 [CONFIGURE_STATIC_ASSERT(1)],
-                 ,
-                 ac_cv_static_assertion_macros_work="no")
-  AC_TRY_COMPILE([$configure_static_assert_macros],
-                 [CONFIGURE_STATIC_ASSERT(0)],
-                 ac_cv_static_assertion_macros_work="no",
-                 )
-  AC_LANG_RESTORE
- ])
-AC_MSG_RESULT("$ac_cv_static_assertion_macros_work")
-if test "$ac_cv_static_assertion_macros_work" = "no"; then
-    AC_MSG_ERROR([Compiler cannot compile macros used in autoconf tests.])
-fi
-fi # COMPILE_ENVIRONMENT
-
 dnl ========================================================
 dnl Checking for 64-bit OS
 dnl ========================================================
@@ -2109,8 +2194,8 @@ case "$target" in
     MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -o $@'
     MOZ_OPTIMIZE_FLAGS="-O3 -fno-stack-protector"
     _PEDANTIC=
-    CFLAGS="$CFLAGS -fpascal-strings -fno-common"
-    CXXFLAGS="$CXXFLAGS -fpascal-strings -fno-common"
+    CFLAGS="$CFLAGS -fno-common"
+    CXXFLAGS="$CXXFLAGS -fno-common"
     DLL_SUFFIX=".dylib"
     DSO_LDOPTS=''
     STRIP="$STRIP -x -S"
@@ -4432,6 +4517,17 @@ if test -n "$MOZ_TRACEVIS"; then
     fi
 fi
 
+dnl ========================================================
+dnl = Use incremental GC
+dnl ========================================================
+JSGC_INCREMENTAL=1
+MOZ_ARG_DISABLE_BOOL(gcincremental,
+[  --disable-gcincremental Disable incremental GC],
+    JSGC_INCREMENTAL= )
+if test -n "$JSGC_INCREMENTAL"; then
+    AC_DEFINE(JSGC_INCREMENTAL)
+fi
+
 dnl ========================================================
 dnl = Use Valgrind
 dnl ========================================================
@@ -4777,7 +4873,7 @@ MOZ_ARG_DISABLE_BOOL(pedantic,
 _PEDANTIC= )
 if test "$_PEDANTIC"; then
     _SAVE_CXXFLAGS=$CXXFLAGS
-    CXXFLAGS="$CXXFLAGS ${_WARNINGS_CXXFLAGS} ${_COMPILER_PREFIX}-pedantic ${_COMPILER_PREFIX}-Wno-long-long"
+    CXXFLAGS="$CXXFLAGS -pedantic ${_WARNINGS_CXXFLAGS} -Wno-long-long"
     AC_MSG_CHECKING([whether C++ compiler has -pedantic long long bug])
     AC_TRY_COMPILE([$configure_static_assert_macros],
                    [CONFIGURE_STATIC_ASSERT(sizeof(long long) == 8)],
@@ -4787,8 +4883,8 @@ if test "$_PEDANTIC"; then
 
     case "$result" in
     no)
-        _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} ${_COMPILER_PREFIX}-pedantic ${_COMPILER_PREFIX}-Wno-long-long"
-        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} ${_COMPILER_PREFIX}-pedantic ${_COMPILER_PREFIX}-Wno-long-long"
+        _WARNINGS_CFLAGS="-pedantic ${_WARNINGS_CFLAGS} -Wno-long-long"
+        _WARNINGS_CXXFLAGS="-pedantic ${_WARNINGS_CXXFLAGS} -Wno-long-long"
         ;;
     yes)
         AC_MSG_ERROR([Your compiler appears to have a known bug where long long is miscompiled when using -pedantic.  Reconfigure using --disable-pedantic. ])
diff --git a/js/src/frontend/BytecodeCompiler.cpp b/js/src/frontend/BytecodeCompiler.cpp
index 5b58bc503ae1..46ab206da518 100644
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -295,7 +295,7 @@ frontend::CompileScript(JSContext *cx, JSObject *scopeChain, StackFrame *callerF
             goto out;
 
 #if JS_HAS_XML_SUPPORT
-        if (!pn->isKind(TOK_SEMI) || !pn->pn_kid || !TreeTypeIsXML(pn->pn_kid->getKind()))
+        if (!pn->isKind(PNK_SEMI) || !pn->pn_kid || !pn->pn_kid->isXMLItem())
             onlyXML = false;
 #endif
         bce.freeTree(pn);
@@ -403,8 +403,7 @@ frontend::CompileFunctionBody(JSContext *cx, JSFunction *fun, JSPrincipals *prin
         return false;
 
     /* FIXME: make Function format the source for a function definition. */
-    tokenStream.mungeCurrentToken(TOK_NAME);
-    ParseNode *fn = FunctionNode::create(&funbce);
+    ParseNode *fn = FunctionNode::create(PNK_NAME, &funbce);
     if (fn) {
         fn->pn_body = NULL;
         fn->pn_cookie.makeFree();
@@ -451,7 +450,7 @@ frontend::CompileFunctionBody(JSContext *cx, JSFunction *fun, JSPrincipals *prin
             pn = NULL;
         } else {
             if (fn->pn_body) {
-                JS_ASSERT(fn->pn_body->isKind(TOK_ARGSBODY));
+                JS_ASSERT(fn->pn_body->isKind(PNK_ARGSBODY));
                 fn->pn_body->append(pn);
                 fn->pn_body->pn_pos = pn->pn_pos;
                 pn = fn->pn_body;
diff --git a/widget/public/nsIMenuRollup.h b/js/src/frontend/BytecodeEmitter-inl.h
similarity index 57%
rename from widget/public/nsIMenuRollup.h
rename to js/src/frontend/BytecodeEmitter-inl.h
index b64bbec2fe8c..5f3d7b0e9286 100644
--- a/widget/public/nsIMenuRollup.h
+++ b/js/src/frontend/BytecodeEmitter-inl.h
@@ -1,5 +1,7 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sw=4 et tw=99:
+ *
+ * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
@@ -12,7 +14,8 @@
  * for the specific language governing rights and limitations under the
  * License.
  *
- * The Original Code is mozilla.org code.
+ * The Original Code is Mozilla Communicator client code, released
+ * March 31, 1998.
  *
  * The Initial Developer of the Original Code is
  * Netscape Communications Corporation.
@@ -35,42 +38,36 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+#ifndef BytecodeEmitter_inl_h__
+#define BytecodeEmitter_inl_h__
 
-#ifndef nsIMenuRollup_h___
-#define nsIMenuRollup_h___
+#include "frontend/ParseNode.h"
+#include "frontend/TokenStream.h"
 
-#include "nsISupports.h"
-#include "nsTArray.h"
+namespace js {
 
-class nsIWidget;
-class nsIContent;
-class nsPIDOMWindow;
+inline
+TreeContext::TreeContext(Parser *prs)
+  : flags(0), bodyid(0), blockidGen(0), parenDepth(0), yieldCount(0), argumentsCount(0),
+    topStmt(NULL), topScopeStmt(NULL), blockChainBox(NULL), blockNode(NULL),
+    decls(prs->context), parser(prs), yieldNode(NULL), argumentsNode(NULL), scopeChain_(NULL),
+    lexdeps(prs->context), parent(prs->tc), staticLevel(0), funbox(NULL), functionList(NULL),
+    innermostWith(NULL), bindings(prs->context), sharpSlotBase(-1)
+{
+    prs->tc = this;
+}
 
-#define NS_IMENUROLLUP_IID \
-  {0xa707b588, 0xa564, 0x488d, \
-    { 0x87, 0xb6, 0xdb, 0x71, 0x2d, 0x78, 0x9d, 0x4c }}
+/*
+ * For functions the tree context is constructed and destructed a second
+ * time during code generation. To avoid a redundant stats update in such
+ * cases, we store uint16(-1) in maxScopeDepth.
+ */
+inline
+TreeContext::~TreeContext()
+{
+    parser->tc = this->parent;
+}
 
-class nsIMenuRollup : public nsISupports {
- public: 
+} /* namespace js */
 
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IMENUROLLUP_IID)
-
-  /*
-   * Retrieve the widgets for open menus are store them in the array
-   * aWidgetChain. The number of menus of the same type should be returned,
-   * for example, if a context menu is open, return only the number of menus
-   * that are part of the context menu chain. This allows closing up only
-   * those menus in different situations.
-   */
-  virtual PRUint32 GetSubmenuWidgetChain(nsTArray<nsIWidget*> *aWidgetChain) = 0;
-
-  /**
-   * Adjust the position of open panels when a window is moved or resized.
-   */ 
-  virtual void AdjustPopupsOnWindowChange(nsPIDOMWindow* aWindow) = 0;
-
-};
-
-  NS_DEFINE_STATIC_IID_ACCESSOR(nsIMenuRollup, NS_IMENUROLLUP_IID)
-
-#endif
+#endif /* BytecodeEmitter_inl_h__ */
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 69dc7e37b20b..71ee009136b5 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -71,10 +71,10 @@
 #include "vm/RegExpObject.h"
 
 #include "jsatominlines.h"
-#include "jsobjinlines.h"
 #include "jsscopeinlines.h"
 #include "jsscriptinlines.h"
 
+#include "frontend/BytecodeEmitter-inl.h"
 #include "frontend/ParseMaps-inl.h"
 
 /* Allocation chunk counts, must be powers of two in general. */
@@ -905,6 +905,7 @@ OptimizeSpanDeps(JSContext *cx, BytecodeEmitter *bce)
                       case JSOP_DEFAULT:      op = JSOP_DEFAULTX; break;
                       case JSOP_TABLESWITCH:  op = JSOP_TABLESWITCHX; break;
                       case JSOP_LOOKUPSWITCH: op = JSOP_LOOKUPSWITCHX; break;
+                      case JSOP_LABEL:        op = JSOP_LABELX; break;
                       default:
                         ReportStatementTooLarge(cx, bce);
                         return JS_FALSE;
@@ -1463,7 +1464,7 @@ EmitTraceOp(JSContext *cx, BytecodeEmitter *bce, ParseNode *nextpn)
          * instruction. nextpn is often a block, in which case the next
          * instruction typically comes from the first statement inside.
          */
-        if (nextpn->isKind(TOK_LC) && nextpn->isArity(PN_LIST) && nextpn->pn_head)
+        if (nextpn->isKind(PNK_LC) && nextpn->isArity(PN_LIST) && nextpn->pn_head)
             nextpn = nextpn->pn_head;
         if (!UpdateLineNumberNotes(cx, bce, nextpn->pn_pos.begin.lineno))
             return -1;
@@ -1704,7 +1705,7 @@ JSBool
 frontend::DefineCompileTimeConstant(JSContext *cx, BytecodeEmitter *bce, JSAtom *atom, ParseNode *pn)
 {
     /* XXX just do numbers for now */
-    if (pn->isKind(TOK_NUMBER)) {
+    if (pn->isKind(PNK_NUMBER)) {
         if (!bce->constMap.put(atom, NumberValue(pn->pn_dval)))
             return JS_FALSE;
     }
@@ -1986,7 +1987,7 @@ AdjustBlockSlot(JSContext *cx, BytecodeEmitter *bce, jsint slot)
 static bool
 EmitEnterBlock(JSContext *cx, ParseNode *pn, BytecodeEmitter *bce)
 {
-    JS_ASSERT(pn->isKind(TOK_LEXICALSCOPE));
+    JS_ASSERT(pn->isKind(PNK_LEXICALSCOPE));
     if (!EmitObjectOp(cx, pn->pn_objbox, JSOP_ENTERBLOCK, bce))
         return false;
 
@@ -2169,7 +2170,7 @@ BindGlobal(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSAtom *atom)
 
 /*
  * BindNameToSlot attempts to optimize name gets and sets to stack slot loads
- * and stores, given the compile-time information in bce and a TOK_NAME node pn.
+ * and stores, given the compile-time information in bce and a PNK_NAME node pn.
  * It returns false on error, true on success.
  *
  * The caller can inspect pn->pn_cookie for FREE_UPVAR_COOKIE to tell whether
@@ -2181,8 +2182,8 @@ BindGlobal(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSAtom *atom)
  * successful return.
  *
  * NB: if you add more opcodes specialized from JSOP_NAME, etc., don't forget
- * to update the TOK_FOR (for-in) and TOK_ASSIGN (op=, e.g. +=) special cases
- * in EmitTree.
+ * to update the special cases in EmitFor (for-in) and EmitAssignment (= and
+ * op=, e.g. +=).
  */
 static JSBool
 BindNameToSlot(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
@@ -2192,7 +2193,7 @@ BindNameToSlot(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     JSAtom *atom;
     Definition::Kind dn_kind;
 
-    JS_ASSERT(pn->isKind(TOK_NAME));
+    JS_ASSERT(pn->isKind(PNK_NAME));
 
     /* Idempotency tests come first, since we may be called more than once. */
     if (pn->pn_dflags & PND_BOUND)
@@ -2594,11 +2595,11 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool *ans
                 ok &= CheckSideEffects(cx, bce, pn2, answer);
         } else {
             /*
-             * All invocation operations (construct: TOK_NEW, call: TOK_LP)
+             * All invocation operations (construct: PNK_NEW, call: PNK_LP)
              * are presumed to be useful, because they may have side effects
              * even if their main effect (their return value) is discarded.
              *
-             * TOK_LB binary trees of 3 or more nodes are flattened into lists
+             * PNK_LB binary trees of 3 or more nodes are flattened into lists
              * to avoid too much recursion.  All such lists must be presumed
              * to be useful because each index operation could invoke a getter
              * (the JSOP_ARGUMENTS special case below, in the PN_BINARY case,
@@ -2620,7 +2621,7 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool *ans
         break;
 
       case PN_BINARY:
-        if (pn->isKind(TOK_ASSIGN)) {
+        if (pn->isAssignment()) {
             /*
              * Assignment is presumed to be useful, even if the next operation
              * is another assignment overwriting this one's ostensible effect,
@@ -2631,7 +2632,7 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool *ans
              * declared in the function currently being compiled.
              */
             pn2 = pn->pn_left;
-            if (!pn2->isKind(TOK_NAME)) {
+            if (!pn2->isKind(PNK_NAME)) {
                 *answer = JS_TRUE;
             } else {
                 if (!BindNameToSlot(cx, bce, pn2))
@@ -2662,10 +2663,10 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool *ans
 
       case PN_UNARY:
         switch (pn->getKind()) {
-          case TOK_DELETE:
+          case PNK_DELETE:
             pn2 = pn->pn_kid;
             switch (pn2->getKind()) {
-              case TOK_NAME:
+              case PNK_NAME:
                 if (!BindNameToSlot(cx, bce, pn2))
                     return JS_FALSE;
                 if (pn2->isConst()) {
@@ -2673,15 +2674,15 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool *ans
                     break;
                 }
                 /* FALL THROUGH */
-              case TOK_DOT:
+              case PNK_DOT:
 #if JS_HAS_XML_SUPPORT
-              case TOK_DBLDOT:
-                JS_ASSERT_IF(pn2->getKind() == TOK_DBLDOT, !bce->inStrictMode());
+              case PNK_DBLDOT:
+                JS_ASSERT_IF(pn2->getKind() == PNK_DBLDOT, !bce->inStrictMode());
                 /* FALL THROUGH */
 
 #endif
-              case TOK_LP:
-              case TOK_LB:
+              case PNK_LP:
+              case PNK_LB:
                 /* All these delete addressing modes have effects too. */
                 *answer = JS_TRUE;
                 break;
@@ -2691,7 +2692,10 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool *ans
             }
             break;
 
-          case TOK_UNARYOP:
+          case PNK_TYPEOF:
+          case PNK_VOID:
+          case PNK_NOT:
+          case PNK_BITNOT:
             if (pn->isOp(JSOP_NOT)) {
                 /* ! does not convert its operand via toString or valueOf. */
                 ok = CheckSideEffects(cx, bce, pn->pn_kid, answer);
@@ -2701,7 +2705,7 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool *ans
 
           default:
             /*
-             * All of TOK_INC, TOK_DEC, TOK_THROW, TOK_YIELD, and TOK_DEFSHARP
+             * All of PNK_INC, PNK_DEC, PNK_THROW, PNK_YIELD, and PNK_DEFSHARP
              * have direct effects. Of the remaining unary-arity node types,
              * we can't easily prove that the operand never denotes an object
              * with a toString or valueOf method.
@@ -2717,7 +2721,7 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool *ans
          * statements and property values in object initialisers, have pn_op
          * defaulted to JSOP_NOP).
          */
-        if (pn->isKind(TOK_NAME) && !pn->isOp(JSOP_NOP)) {
+        if (pn->isKind(PNK_NAME) && !pn->isOp(JSOP_NOP)) {
             if (!BindNameToSlot(cx, bce, pn))
                 return JS_FALSE;
             if (!pn->isOp(JSOP_ARGUMENTS) && !pn->isOp(JSOP_CALLEE) &&
@@ -2731,8 +2735,8 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool *ans
             }
         }
         pn2 = pn->maybeExpr();
-        if (pn->isKind(TOK_DOT)) {
-            if (pn2->isKind(TOK_NAME) && !BindNameToSlot(cx, bce, pn2))
+        if (pn->isKind(PNK_DOT)) {
+            if (pn2->isKind(PNK_NAME) && !BindNameToSlot(cx, bce, pn2))
                 return JS_FALSE;
             if (!(pn2->isOp(JSOP_ARGUMENTS) &&
                   pn->pn_atom == cx->runtime->atomState.lengthAtom)) {
@@ -2751,7 +2755,7 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool *ans
         break;
 
       case PN_NULLARY:
-        if (pn->isKind(TOK_DEBUGGER))
+        if (pn->isKind(PNK_DEBUGGER))
             *answer = JS_TRUE;
         break;
     }
@@ -2812,7 +2816,7 @@ static bool
 EmitXMLName(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)
 {
     JS_ASSERT(!bce->inStrictMode());
-    JS_ASSERT(pn->isKind(TOK_UNARYOP));
+    JS_ASSERT(pn->isKind(PNK_XMLUNARY));
     JS_ASSERT(pn->isOp(JSOP_XMLNAME));
     JS_ASSERT(op == JSOP_XMLNAME || op == JSOP_CALLXMLNAME);
 
@@ -2873,11 +2877,11 @@ EmitPropOp(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce,
     }
 
     if (callContext) {
-        JS_ASSERT(pn->isKind(TOK_DOT));
+        JS_ASSERT(pn->isKind(PNK_DOT));
         JS_ASSERT(op == JSOP_GETPROP);
         op = JSOP_CALLPROP;
-    } else if (op == JSOP_GETPROP && pn->isKind(TOK_DOT)) {
-        if (pn2->isKind(TOK_NAME)) {
+    } else if (op == JSOP_GETPROP && pn->isKind(PNK_DOT)) {
+        if (pn2->isKind(PNK_NAME)) {
             if (!BindNameToSlot(cx, bce, pn2))
                 return false;
         }
@@ -2888,7 +2892,7 @@ EmitPropOp(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce,
      * list linked via pn_expr temporarily so we can iterate over it from the
      * bottom up (reversing again as we go), to avoid excessive recursion.
      */
-    if (pn2->isKind(TOK_DOT)) {
+    if (pn2->isKind(PNK_DOT)) {
         pndot = pn2;
         pnup = NULL;
         top = bce->offset();
@@ -2898,7 +2902,7 @@ EmitPropOp(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce,
             JS_ASSERT(!pndot->isUsed());
             pndown = pndot->pn_expr;
             pndot->pn_expr = pnup;
-            if (!pndown->isKind(TOK_DOT))
+            if (!pndown->isKind(PNK_DOT))
                 break;
             pnup = pndot;
             pndot = pndown;
@@ -3063,26 +3067,24 @@ EmitElemOp(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)
 
     if (pn->isArity(PN_NAME)) {
         /*
-         * Set left and right so pn appears to be a TOK_LB node, instead
-         * of a TOK_DOT node.  See the TOK_FOR/IN case in EmitTree, and
+         * Set left and right so pn appears to be a PNK_LB node, instead
+         * of a PNK_DOT node.  See the PNK_FOR/IN case in EmitTree, and
          * EmitDestructuringOps nearer below.  In the destructuring case,
          * the base expression (pn_expr) of the name may be null, which
          * means we have to emit a JSOP_BINDNAME.
          */
         left = pn->maybeExpr();
         if (!left) {
-            left = NullaryNode::create(bce);
+            left = NullaryNode::create(PNK_STRING, bce);
             if (!left)
                 return false;
-            left->setKind(TOK_STRING);
             left->setOp(JSOP_BINDNAME);
             left->pn_pos = pn->pn_pos;
             left->pn_atom = pn->pn_atom;
         }
-        right = NullaryNode::create(bce);
+        right = NullaryNode::create(PNK_STRING, bce);
         if (!right)
             return false;
-        right->setKind(TOK_STRING);
         right->setOp(IsIdentifier(pn->pn_atom) ? JSOP_QNAMEPART : JSOP_STRING);
         right->pn_pos = pn->pn_pos;
         right->pn_atom = pn->pn_atom;
@@ -3092,9 +3094,7 @@ EmitElemOp(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)
         right = pn->pn_right;
     }
 
-    if (op == JSOP_GETELEM &&
-        left->isKind(TOK_NAME) &&
-        right->isKind(TOK_NUMBER)) {
+    if (op == JSOP_GETELEM && left->isKind(PNK_NAME) && right->isKind(PNK_NUMBER)) {
         if (!BindNameToSlot(cx, bce, left))
             return false;
     }
@@ -3103,7 +3103,7 @@ EmitElemOp(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)
         return false;
 
     /* The right side of the descendant operator is implicitly quoted. */
-    JS_ASSERT(op != JSOP_DESCENDANTS || !right->isKind(TOK_STRING) ||
+    JS_ASSERT(op != JSOP_DESCENDANTS || !right->isKind(PNK_STRING) ||
               right->isOp(JSOP_QNAMEPART));
     if (!EmitTree(cx, bce, right))
         return false;
@@ -3314,7 +3314,7 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     pn2 = pn->pn_right;
 #if JS_HAS_BLOCK_SCOPE
     TempPopScope tps;
-    if (pn2->isKind(TOK_LEXICALSCOPE)) {
+    if (pn2->isKind(PNK_LEXICALSCOPE)) {
         /*
          * Push the body's block scope before discriminant code-gen to reflect
          * the order of slots on the stack. The block's locals must lie under
@@ -3355,7 +3355,7 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 #if !JS_HAS_BLOCK_SCOPE
     PushStatement(bce, &stmtInfo, STMT_SWITCH, top);
 #else
-    if (pn2->isKind(TOK_LC)) {
+    if (pn2->isKind(PNK_LC)) {
         PushStatement(bce, &stmtInfo, STMT_SWITCH, top);
     } else {
         /* Re-push the switch's statement info record. */
@@ -3379,7 +3379,7 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
     if (caseCount == 0 ||
         (caseCount == 1 &&
-         (hasDefault = (pn2->pn_head->isKind(TOK_DEFAULT))))) {
+         (hasDefault = (pn2->pn_head->isKind(PNK_DEFAULT))))) {
         caseCount = 0;
         low = 0;
         high = -1;
@@ -3393,29 +3393,38 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         high = JSVAL_INT_MIN;
 
         for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
-            if (pn3->isKind(TOK_DEFAULT)) {
+            if (pn3->isKind(PNK_DEFAULT)) {
                 hasDefault = JS_TRUE;
                 caseCount--;    /* one of the "cases" was the default */
                 continue;
             }
 
-            JS_ASSERT(pn3->isKind(TOK_CASE));
+            JS_ASSERT(pn3->isKind(PNK_CASE));
             if (switchOp == JSOP_CONDSWITCH)
                 continue;
 
             pn4 = pn3->pn_left;
-            while (pn4->isKind(TOK_RP))
+            while (pn4->isKind(PNK_RP))
                 pn4 = pn4->pn_kid;
 
             Value constVal;
             switch (pn4->getKind()) {
-              case TOK_NUMBER:
+              case PNK_NUMBER:
                 constVal.setNumber(pn4->pn_dval);
                 break;
-              case TOK_STRING:
+              case PNK_STRING:
                 constVal.setString(pn4->pn_atom);
                 break;
-              case TOK_NAME:
+              case PNK_TRUE:
+                constVal.setBoolean(true);
+                break;
+              case PNK_FALSE:
+                constVal.setBoolean(false);
+                break;
+              case PNK_NULL:
+                constVal.setNull();
+                break;
+              case PNK_NAME:
                 if (!pn4->maybeExpr()) {
                     ok = LookupCompileTimeConstant(cx, bce, pn4->pn_atom, &constVal);
                     if (!ok)
@@ -3434,20 +3443,6 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                     }
                 }
                 /* FALL THROUGH */
-              case TOK_PRIMARY:
-                if (pn4->isOp(JSOP_TRUE)) {
-                    constVal.setBoolean(true);
-                    break;
-                }
-                if (pn4->isOp(JSOP_FALSE)) {
-                    constVal.setBoolean(false);
-                    break;
-                }
-                if (pn4->isOp(JSOP_NULL)) {
-                    constVal.setNull();
-                    break;
-                }
-                /* FALL THROUGH */
               default:
                 switchOp = JSOP_CONDSWITCH;
                 continue;
@@ -3594,7 +3589,7 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                     return JS_FALSE;
             }
             if (!pn4) {
-                JS_ASSERT(pn3->isKind(TOK_DEFAULT));
+                JS_ASSERT(pn3->isKind(PNK_DEFAULT));
                 continue;
             }
             caseNoteIndex = NewSrcNote2(cx, bce, SRC_PCDELTA, 0);
@@ -3657,7 +3652,7 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                     return JS_FALSE;
                 memset(table, 0, tableSize);
                 for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
-                    if (pn3->isKind(TOK_DEFAULT))
+                    if (pn3->isKind(PNK_DEFAULT))
                         continue;
                     i = pn3->pn_pval->toInt32();
                     i -= low;
@@ -3703,7 +3698,8 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                     pn3 = table[i];
                     if (pn3 &&
                         (pn4 = pn3->pn_left) != NULL &&
-                        pn4->isKind(TOK_NAME)) {
+                        pn4->isKind(PNK_NAME))
+                    {
                         /* Note a propagated constant with the const's name. */
                         JS_ASSERT(!pn4->maybeExpr());
                         jsatomid index;
@@ -3718,7 +3714,7 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             } else {
                 for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
                     pn4 = pn3->pn_left;
-                    if (pn4 && pn4->isKind(TOK_NAME)) {
+                    if (pn4 && pn4->isKind(PNK_NAME)) {
                         /* Note a propagated constant with the const's name. */
                         JS_ASSERT(!pn4->maybeExpr());
                         jsatomid index;
@@ -3737,14 +3733,14 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
     /* Emit code for each case's statements, copying pn_offset up to pn3. */
     for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
-        if (switchOp == JSOP_CONDSWITCH && !pn3->isKind(TOK_DEFAULT))
+        if (switchOp == JSOP_CONDSWITCH && !pn3->isKind(PNK_DEFAULT))
             CHECK_AND_SET_JUMP_OFFSET_AT_CUSTOM(cx, bce, pn3->pn_offset, goto bad);
         pn4 = pn3->pn_right;
         ok = EmitTree(cx, bce, pn4);
         if (!ok)
             goto out;
         pn3->pn_offset = pn4->pn_offset;
-        if (pn3->isKind(TOK_DEFAULT))
+        if (pn3->isKind(PNK_DEFAULT))
             off = pn3->pn_offset - top;
     }
 
@@ -3795,7 +3791,7 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         pc += INDEX_LEN;
 
         for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
-            if (pn3->isKind(TOK_DEFAULT))
+            if (pn3->isKind(PNK_DEFAULT))
                 continue;
             if (!bce->constList.append(*pn3->pn_pval))
                 goto bad;
@@ -3817,7 +3813,7 @@ out:
         ok = PopStatementBCE(cx, bce);
 
 #if JS_HAS_BLOCK_SCOPE
-        if (ok && pn->pn_right->isKind(TOK_LEXICALSCOPE))
+        if (ok && pn->pn_right->isKind(PNK_LEXICALSCOPE))
             ok = EmitLeaveBlock(cx, bce, JSOP_LEAVEBLOCK, box);
 #endif
     }
@@ -3919,7 +3915,7 @@ typedef JSBool
 static JSBool
 EmitDestructuringDecl(JSContext *cx, BytecodeEmitter *bce, JSOp prologOp, ParseNode *pn)
 {
-    JS_ASSERT(pn->isKind(TOK_NAME));
+    JS_ASSERT(pn->isKind(PNK_NAME));
     if (!BindNameToSlot(cx, bce, pn))
         return JS_FALSE;
 
@@ -3933,21 +3929,21 @@ EmitDestructuringDecls(JSContext *cx, BytecodeEmitter *bce, JSOp prologOp, Parse
     ParseNode *pn2, *pn3;
     DestructuringDeclEmitter emitter;
 
-    if (pn->isKind(TOK_RB)) {
+    if (pn->isKind(PNK_RB)) {
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-            if (pn2->isKind(TOK_COMMA))
+            if (pn2->isKind(PNK_COMMA))
                 continue;
-            emitter = (pn2->isKind(TOK_NAME))
+            emitter = (pn2->isKind(PNK_NAME))
                       ? EmitDestructuringDecl
                       : EmitDestructuringDecls;
             if (!emitter(cx, bce, prologOp, pn2))
                 return JS_FALSE;
         }
     } else {
-        JS_ASSERT(pn->isKind(TOK_RC));
+        JS_ASSERT(pn->isKind(PNK_RC));
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
             pn3 = pn2->pn_right;
-            emitter = pn3->isKind(TOK_NAME) ? EmitDestructuringDecl : EmitDestructuringDecls;
+            emitter = pn3->isKind(PNK_NAME) ? EmitDestructuringDecl : EmitDestructuringDecls;
             if (!emitter(cx, bce, prologOp, pn3))
                 return JS_FALSE;
         }
@@ -3967,13 +3963,13 @@ EmitDestructuringLHS(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
      * pop the matched value.  Otherwise emit an lvalue bytecode sequence
      * ending with a JSOP_ENUMELEM or equivalent op.
      */
-    if (pn->isKind(TOK_RB) || pn->isKind(TOK_RC)) {
+    if (pn->isKind(PNK_RB) || pn->isKind(PNK_RC)) {
         if (!EmitDestructuringOpsHelper(cx, bce, pn))
             return JS_FALSE;
         if (Emit1(cx, bce, JSOP_POP) < 0)
             return JS_FALSE;
     } else {
-        if (pn->isKind(TOK_NAME)) {
+        if (pn->isKind(PNK_NAME)) {
             if (!BindNameToSlot(cx, bce, pn))
                 return JS_FALSE;
             if (pn->isConst() && !pn->isInitialized())
@@ -4053,7 +4049,7 @@ EmitDestructuringOpsHelper(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     intN stackDepth = bce->stackDepth;
     JS_ASSERT(stackDepth != 0);
     JS_ASSERT(pn->isArity(PN_LIST));
-    JS_ASSERT(pn->isKind(TOK_RB) || pn->isKind(TOK_RC));
+    JS_ASSERT(pn->isKind(PNK_RB) || pn->isKind(PNK_RC));
 #endif
 
     if (pn->pn_count == 0) {
@@ -4080,15 +4076,15 @@ EmitDestructuringOpsHelper(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
          * to the lvalue node, which is in the value-initializing position.
          */
         doElemOp = JS_TRUE;
-        if (pn->isKind(TOK_RB)) {
+        if (pn->isKind(PNK_RB)) {
             if (!EmitNumberOp(cx, index, bce))
                 return JS_FALSE;
             pn3 = pn2;
         } else {
-            JS_ASSERT(pn->isKind(TOK_RC));
-            JS_ASSERT(pn2->isKind(TOK_COLON));
+            JS_ASSERT(pn->isKind(PNK_RC));
+            JS_ASSERT(pn2->isKind(PNK_COLON));
             pn3 = pn2->pn_left;
-            if (pn3->isKind(TOK_NUMBER)) {
+            if (pn3->isKind(PNK_NUMBER)) {
                 /*
                  * If we are emitting an object destructuring initialiser,
                  * annotate the index op with SRC_INITPROP so we know we are
@@ -4099,7 +4095,7 @@ EmitDestructuringOpsHelper(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                 if (!EmitNumberOp(cx, pn3->pn_dval, bce))
                     return JS_FALSE;
             } else {
-                JS_ASSERT(pn3->isKind(TOK_STRING) || pn3->isKind(TOK_NAME));
+                JS_ASSERT(pn3->isKind(PNK_STRING) || pn3->isKind(PNK_NAME));
                 if (!EmitAtomOp(cx, pn3, JSOP_GETPROP, bce))
                     return JS_FALSE;
                 doElemOp = JS_FALSE;
@@ -4119,8 +4115,8 @@ EmitDestructuringOpsHelper(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
 
         /* Nullary comma node makes a hole in the array destructurer. */
-        if (pn3->isKind(TOK_COMMA) && pn3->isArity(PN_NULLARY)) {
-            JS_ASSERT(pn->isKind(TOK_RB));
+        if (pn3->isKind(PNK_COMMA) && pn3->isArity(PN_NULLARY)) {
+            JS_ASSERT(pn->isKind(PNK_RB));
             JS_ASSERT(pn2 == pn3);
             if (Emit1(cx, bce, JSOP_POP) < 0)
                 return JS_FALSE;
@@ -4186,7 +4182,7 @@ EmitGroupAssignment(JSContext *cx, BytecodeEmitter *bce, JSOp prologOp,
         }
 
         /* MaybeEmitGroupAssignment won't call us if rhs is holey. */
-        JS_ASSERT(!(pn->isKind(TOK_COMMA) && pn->isArity(PN_NULLARY)));
+        JS_ASSERT(!(pn->isKind(PNK_COMMA) && pn->isArity(PN_NULLARY)));
         if (!EmitTree(cx, bce, pn))
             return JS_FALSE;
         ++limit;
@@ -4204,7 +4200,7 @@ EmitGroupAssignment(JSContext *cx, BytecodeEmitter *bce, JSOp prologOp,
             return JS_FALSE;
         EMIT_UINT16_IMM_OP(JSOP_GETLOCAL, slot);
 
-        if (pn->isKind(TOK_COMMA) && pn->isArity(PN_NULLARY)) {
+        if (pn->isKind(PNK_COMMA) && pn->isArity(PN_NULLARY)) {
             if (Emit1(cx, bce, JSOP_POP) < 0)
                 return JS_FALSE;
         } else {
@@ -4228,13 +4224,13 @@ static JSBool
 MaybeEmitGroupAssignment(JSContext *cx, BytecodeEmitter *bce, JSOp prologOp, ParseNode *pn,
                          JSOp *pop)
 {
-    ParseNode *lhs, *rhs;
-
-    JS_ASSERT(pn->isKind(TOK_ASSIGN));
+    JS_ASSERT(pn->isKind(PNK_ASSIGN));
+    JS_ASSERT(pn->isOp(JSOP_NOP));
     JS_ASSERT(*pop == JSOP_POP || *pop == JSOP_POPV);
-    lhs = pn->pn_left;
-    rhs = pn->pn_right;
-    if (lhs->isKind(TOK_RB) && rhs->isKind(TOK_RB) &&
+
+    ParseNode *lhs = pn->pn_left;
+    ParseNode *rhs = pn->pn_right;
+    if (lhs->isKind(PNK_RB) && rhs->isKind(PNK_RB) &&
         !(rhs->pn_xflags & PNX_HOLEY) &&
         lhs->pn_count <= rhs->pn_count) {
         if (!EmitGroupAssignment(cx, bce, prologOp, lhs, rhs))
@@ -4280,13 +4276,13 @@ EmitVariables(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool inLetHe
         first = pn2 == pn->pn_head;
         next = pn2->pn_next;
 
-        if (!pn2->isKind(TOK_NAME)) {
+        if (!pn2->isKind(PNK_NAME)) {
 #if JS_HAS_DESTRUCTURING
-            if (pn2->isKind(TOK_RB) || pn2->isKind(TOK_RC)) {
+            if (pn2->isKind(PNK_RB) || pn2->isKind(PNK_RC)) {
                 /*
                  * Emit variable binding ops, but not destructuring ops.  The
                  * parser (see Parser::variables) has ensured that our caller
-                 * will be the TOK_FOR/TOK_IN case in EmitTree, and that case
+                 * will be the PNK_FOR/PNK_IN case in EmitTree, and that case
                  * will emit the destructuring code only after emitting an
                  * enumerating opcode and a branch that tests whether the
                  * enumeration ended.
@@ -4305,7 +4301,8 @@ EmitVariables(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool inLetHe
              * (var x = i in o)...', this will cause the entire 'var [a, b] =
              * i' to be hoisted out of the loop.
              */
-            JS_ASSERT(pn2->isKind(TOK_ASSIGN));
+            JS_ASSERT(pn2->isKind(PNK_ASSIGN));
+            JS_ASSERT(pn2->isOp(JSOP_NOP));
             JS_ASSERT(!forInVar);
 
             /*
@@ -4314,9 +4311,9 @@ EmitVariables(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool inLetHe
              * here and initialize the name.
              */
 #if !JS_HAS_DESTRUCTURING
-            JS_ASSERT(pn2->pn_left->isKind(TOK_NAME));
+            JS_ASSERT(pn2->pn_left->isKind(PNK_NAME));
 #else
-            if (pn2->pn_left->isKind(TOK_NAME))
+            if (pn2->pn_left->isKind(PNK_NAME))
 #endif
             {
                 pn3 = pn2->pn_right;
@@ -4418,9 +4415,9 @@ EmitVariables(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSBool inLetHe
         /*
          * The parser rewrites 'for (var x = i in o)' to hoist 'var x = i' --
          * likewise 'for (let x = i in o)' becomes 'i; for (let x in o)' using
-         * a TOK_SEQ node to make the two statements appear as one. Therefore
+         * a PNK_SEQ node to make the two statements appear as one. Therefore
          * if this declaration is part of a for-in loop head, we do not need to
-         * emit op or any source note. Our caller, the TOK_FOR/TOK_IN case in
+         * emit op or any source note. Our caller, the PNK_FOR/PNK_IN case in
          * EmitTree, will annotate appropriately.
          */
         JS_ASSERT_IF(pn2->isDefn(), pn3 == pn2->pn_expr);
@@ -4492,7 +4489,7 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
     jsbytecode offset = 1;
 
     switch (lhs->getKind()) {
-      case TOK_NAME:
+      case PNK_NAME:
         if (!BindNameToSlot(cx, bce, lhs))
             return false;
         if (!lhs->pn_cookie.isFree()) {
@@ -4507,14 +4504,14 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
             }
         }
         break;
-      case TOK_DOT:
+      case PNK_DOT:
         if (!EmitTree(cx, bce, lhs->expr()))
             return false;
         offset++;
         if (!bce->makeAtomIndex(lhs->pn_atom, &atomIndex))
             return false;
         break;
-      case TOK_LB:
+      case PNK_LB:
         JS_ASSERT(lhs->isArity(PN_BINARY));
         if (!EmitTree(cx, bce, lhs->pn_left))
             return false;
@@ -4523,17 +4520,17 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
         offset += 2;
         break;
 #if JS_HAS_DESTRUCTURING
-      case TOK_RB:
-      case TOK_RC:
+      case PNK_RB:
+      case PNK_RC:
         break;
 #endif
-      case TOK_LP:
+      case PNK_LP:
         if (!EmitTree(cx, bce, lhs))
             return false;
         offset++;
         break;
 #if JS_HAS_XML_SUPPORT
-      case TOK_UNARYOP:
+      case PNK_XMLUNARY:
         JS_ASSERT(!bce->inStrictMode());
         JS_ASSERT(lhs->isOp(JSOP_SETXMLNAME));
         if (!EmitTree(cx, bce, lhs->pn_kid))
@@ -4550,7 +4547,7 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
     if (op != JSOP_NOP) {
         JS_ASSERT(rhs);
         switch (lhs->getKind()) {
-          case TOK_NAME:
+          case PNK_NAME:
             if (lhs->isConst()) {
                 if (lhs->isOp(JSOP_CALLEE)) {
                     if (Emit1(cx, bce, JSOP_CALLEE) < 0)
@@ -4570,7 +4567,7 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
                 EMIT_UINT16_IMM_OP(lhs->isOp(JSOP_SETARG) ? JSOP_GETARG : JSOP_GETLOCAL, atomIndex);
             }
             break;
-          case TOK_DOT:
+          case PNK_DOT:
             if (Emit1(cx, bce, JSOP_DUP) < 0)
                 return false;
             if (lhs->pn_atom == cx->runtime->atomState.protoAtom) {
@@ -4583,10 +4580,10 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
                 EMIT_INDEX_OP(isLength ? JSOP_LENGTH : JSOP_GETPROP, atomIndex);
             }
             break;
-          case TOK_LB:
-          case TOK_LP:
+          case PNK_LB:
+          case PNK_LP:
 #if JS_HAS_XML_SUPPORT
-          case TOK_UNARYOP:
+          case PNK_XMLUNARY:
 #endif
             if (Emit1(cx, bce, JSOP_DUP2) < 0)
                 return false;
@@ -4614,7 +4611,7 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
          * declared in the current compilation unit, as in this case (just
          * a bit further below) we will avoid emitting the assignment op.
          */
-        if (!lhs->isKind(TOK_NAME) || !lhs->isConst()) {
+        if (!lhs->isKind(PNK_NAME) || !lhs->isConst()) {
             if (NewSrcNote(cx, bce, SRC_ASSIGNOP) < 0)
                 return false;
         }
@@ -4623,10 +4620,10 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
     }
 
     /* Left parts such as a.b.c and a[b].c need a decompiler note. */
-    if (!lhs->isKind(TOK_NAME) &&
+    if (!lhs->isKind(PNK_NAME) &&
 #if JS_HAS_DESTRUCTURING
-        !lhs->isKind(TOK_RB) &&
-        !lhs->isKind(TOK_RC) &&
+        !lhs->isKind(PNK_RB) &&
+        !lhs->isKind(PNK_RC) &&
 #endif
         NewSrcNote2(cx, bce, SRC_PCBASE, bce->offset() - top) < 0)
     {
@@ -4635,7 +4632,7 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
 
     /* Finally, emit the specialized assignment bytecode. */
     switch (lhs->getKind()) {
-      case TOK_NAME:
+      case PNK_NAME:
         if (lhs->isConst()) {
             if (!rhs) {
                 ReportCompileErrorNumber(cx, bce->tokenStream(), lhs, JSREPORT_ERROR,
@@ -4645,23 +4642,23 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
             break;
         }
         /* FALL THROUGH */
-      case TOK_DOT:
+      case PNK_DOT:
         EMIT_INDEX_OP(lhs->getOp(), atomIndex);
         break;
-      case TOK_LB:
-      case TOK_LP:
+      case PNK_LB:
+      case PNK_LP:
         if (Emit1(cx, bce, JSOP_SETELEM) < 0)
             return false;
         break;
 #if JS_HAS_DESTRUCTURING
-      case TOK_RB:
-      case TOK_RC:
+      case PNK_RB:
+      case PNK_RC:
         if (!EmitDestructuringOps(cx, bce, JSOP_SETNAME, lhs))
             return false;
         break;
 #endif
 #if JS_HAS_XML_SUPPORT
-      case TOK_UNARYOP:
+      case PNK_XMLUNARY:
         JS_ASSERT(!bce->inStrictMode());
         if (Emit1(cx, bce, JSOP_SETXMLNAME) < 0)
             return false;
@@ -4733,28 +4730,22 @@ bool
 ParseNode::getConstantValue(JSContext *cx, bool strictChecks, Value *vp)
 {
     switch (getKind()) {
-      case TOK_NUMBER:
+      case PNK_NUMBER:
         vp->setNumber(pn_dval);
         return true;
-      case TOK_STRING:
+      case PNK_STRING:
         vp->setString(pn_atom);
         return true;
-      case TOK_PRIMARY:
-        switch (getOp()) {
-          case JSOP_NULL:
-            vp->setNull();
-            return true;
-          case JSOP_FALSE:
-            vp->setBoolean(false);
-            return true;
-          case JSOP_TRUE:
-            vp->setBoolean(true);
-            return true;
-          default:
-            JS_NOT_REACHED("Unexpected node");
-            return false;
-        }
-      case TOK_RB: {
+      case PNK_TRUE:
+        vp->setBoolean(true);
+        return true;
+      case PNK_FALSE:
+        vp->setBoolean(false);
+        return true;
+      case PNK_NULL:
+        vp->setNull();
+        return true;
+      case PNK_RB: {
         JS_ASSERT(isOp(JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST));
 
         JSObject *obj = NewDenseAllocatedArray(cx, pn_count);
@@ -4775,7 +4766,7 @@ ParseNode::getConstantValue(JSContext *cx, bool strictChecks, Value *vp)
         vp->setObject(*obj);
         return true;
       }
-      case TOK_RC: {
+      case PNK_RC: {
         JS_ASSERT(isOp(JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST));
 
         gc::AllocKind kind = GuessObjectGCKind(pn_count, false);
@@ -4789,7 +4780,7 @@ ParseNode::getConstantValue(JSContext *cx, bool strictChecks, Value *vp)
                 return false;
 
             ParseNode *pnid = pn->pn_left;
-            if (pnid->isKind(TOK_NUMBER)) {
+            if (pnid->isKind(PNK_NUMBER)) {
                 Value idvalue = NumberValue(pnid->pn_dval);
                 jsid id;
                 if (idvalue.isInt32() && INT_FITS_IN_JSID(idvalue.toInt32()))
@@ -4799,8 +4790,7 @@ ParseNode::getConstantValue(JSContext *cx, bool strictChecks, Value *vp)
                 if (!obj->defineGeneric(cx, id, value, NULL, NULL, JSPROP_ENUMERATE))
                     return false;
             } else {
-                JS_ASSERT(pnid->isKind(TOK_NAME) ||
-                          pnid->isKind(TOK_STRING));
+                JS_ASSERT(pnid->isKind(PNK_NAME) || pnid->isKind(PNK_STRING));
                 JS_ASSERT(pnid->pn_atom != cx->runtime->atomState.protoAtom);
                 jsid id = ATOM_TO_JSID(pnid->pn_atom);
                 if (!DefineNativeProperty(cx, obj, id, value, NULL, NULL,
@@ -4879,8 +4869,8 @@ EmitCatch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     ParseNode *pn2 = pn->pn_kid1;
     switch (pn2->getKind()) {
 #if JS_HAS_DESTRUCTURING
-      case TOK_RB:
-      case TOK_RC:
+      case PNK_RB:
+      case PNK_RC:
         if (!EmitDestructuringOps(cx, bce, JSOP_NOP, pn2))
             return false;
         if (Emit1(cx, bce, JSOP_POP) < 0)
@@ -4888,7 +4878,7 @@ EmitCatch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
 #endif
 
-      case TOK_NAME:
+      case PNK_NAME:
         /* Inline and specialize BindNameToSlot for pn2. */
         JS_ASSERT(!pn2->pn_cookie.isFree());
         EMIT_UINT16_IMM_OP(JSOP_SETLOCALPOP, pn2->pn_cookie.asInteger());
@@ -4921,7 +4911,7 @@ EmitCatch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
     /*
      * Annotate the JSOP_LEAVEBLOCK that will be emitted as we unwind via
-     * our TOK_LEXICALSCOPE parent, so the decompiler knows to pop.
+     * our PNK_LEXICALSCOPE parent, so the decompiler knows to pop.
      */
     ptrdiff_t off = bce->stackDepth;
     if (NewSrcNote2(cx, bce, SRC_CATCH, off) < 0)
@@ -5049,7 +5039,7 @@ EmitTry(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             /*
              * Annotate the JSOP_ENTERBLOCK that's about to be generated
              * by the call to EmitTree immediately below.  Save this
-             * source note's index in stmtInfo for use by the TOK_CATCH:
+             * source note's index in stmtInfo for use by the PNK_CATCH:
              * case, where the length of the catch guard is set as the
              * note's offset.
              */
@@ -5063,7 +5053,7 @@ EmitTry(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
              * block object population via count, for use when targeting
              * guardJump at the next catch (the guard mismatch case).
              */
-            JS_ASSERT(pn3->isKind(TOK_LEXICALSCOPE));
+            JS_ASSERT(pn3->isKind(PNK_LEXICALSCOPE));
             count = OBJ_BLOCK_COUNT(cx, pn3->pn_objbox->object);
             prevBox = pn3->pn_objbox;
             if (!EmitTree(cx, bce, pn3))
@@ -5239,7 +5229,7 @@ EmitIf(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
         /* Ensure the branch-if-false comes here, then emit the else. */
         CHECK_AND_SET_JUMP_OFFSET_AT(cx, bce, beq);
-        if (pn3->isKind(TOK_IF)) {
+        if (pn3->isKind(PNK_IF)) {
             pn = pn3;
             goto if_again;
         }
@@ -5329,7 +5319,7 @@ EmitXMLTag(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
     {
         jsatomid index;
-        JSAtom *tagAtom = (pn->isKind(TOK_XMLETAGO))
+        JSAtom *tagAtom = (pn->isKind(PNK_XMLETAGO))
                           ? cx->runtime->atomState.etagoAtom
                           : cx->runtime->atomState.stagoAtom;
         if (!bce->makeAtomIndex(tagAtom, &index))
@@ -5339,7 +5329,7 @@ EmitXMLTag(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
     JS_ASSERT(pn->pn_count != 0);
     ParseNode *pn2 = pn->pn_head;
-    if (pn2->isKind(TOK_LC) && Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0)
+    if (pn2->isKind(PNK_LC) && Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0)
         return false;
     if (!EmitTree(cx, bce, pn2))
         return false;
@@ -5348,11 +5338,11 @@ EmitXMLTag(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
     uint32 i;
     for (pn2 = pn2->pn_next, i = 0; pn2; pn2 = pn2->pn_next, i++) {
-        if (pn2->isKind(TOK_LC) && Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0)
+        if (pn2->isKind(PNK_LC) && Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0)
             return false;
         if (!EmitTree(cx, bce, pn2))
             return false;
-        if ((i & 1) && pn2->isKind(TOK_LC)) {
+        if ((i & 1) && pn2->isKind(PNK_LC)) {
             if (Emit1(cx, bce, JSOP_TOATTRVAL) < 0)
                 return false;
         }
@@ -5362,7 +5352,7 @@ EmitXMLTag(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
     {
         jsatomid index;
-        JSAtom *tmp = (pn->isKind(TOK_XMLPTAGC)) ? cx->runtime->atomState.ptagcAtom
+        JSAtom *tmp = (pn->isKind(PNK_XMLPTAGC)) ? cx->runtime->atomState.ptagcAtom
                                                  : cx->runtime->atomState.tagcAtom;
         if (!bce->makeAtomIndex(tmp, &index))
             return false;
@@ -5410,11 +5400,12 @@ EmitLexicalScope(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
      * statements get braces by default from the decompiler.
      */
     ptrdiff_t noteIndex = -1;
-    TokenKind type = pn->expr()->getKind();
-    if (type != TOK_CATCH && type != TOK_LET && type != TOK_FOR &&
+    ParseNodeKind kind = pn->expr()->getKind();
+    if (kind != PNK_CATCH && kind != PNK_LET && kind != PNK_FOR &&
         (!(stmt = stmtInfo.down)
          ? !bce->inFunction()
-         : stmt->type == STMT_BLOCK)) {
+         : stmt->type == STMT_BLOCK))
+    {
 #if defined DEBUG_brendan || defined DEBUG_mrbkap
         /* There must be no source note already output for the next op. */
         JS_ASSERT(bce->noteCount() == 0 ||
@@ -5487,8 +5478,8 @@ EmitForIn(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
      */
     bool forLet = false;
     if (ParseNode *decl = forHead->pn_kid1) {
-        JS_ASSERT(TokenKindIsDecl(decl->getKind()));
-        forLet = decl->isKind(TOK_LET);
+        JS_ASSERT(decl->isKind(PNK_VAR) || decl->isKind(PNK_LET));
+        forLet = decl->isKind(PNK_LET);
         bce->flags |= TCF_IN_FOR_INIT;
         if (!EmitTree(cx, bce, decl))
             return false;
@@ -5623,15 +5614,16 @@ EmitNormalFor(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
     } else {
         bce->flags |= TCF_IN_FOR_INIT;
 #if JS_HAS_DESTRUCTURING
-        if (pn3->isKind(TOK_ASSIGN) &&
-            !MaybeEmitGroupAssignment(cx, bce, op, pn3, &op)) {
-            return false;
+        if (pn3->isKind(PNK_ASSIGN)) {
+            JS_ASSERT(pn3->isOp(JSOP_NOP));
+            if (!MaybeEmitGroupAssignment(cx, bce, op, pn3, &op))
+                return false;
         }
 #endif
         if (op == JSOP_POP) {
             if (!EmitTree(cx, bce, pn3))
                 return false;
-            if (TokenKindIsDecl(pn3->getKind())) {
+            if (pn3->isKind(PNK_VAR) || pn3->isKind(PNK_LET)) {
                 /*
                  * Check whether a destructuring-initialized var decl
                  * was optimized to a group assignment.  If so, we do
@@ -5693,9 +5685,10 @@ EmitNormalFor(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
     if (pn3) {
         op = JSOP_POP;
 #if JS_HAS_DESTRUCTURING
-        if (pn3->isKind(TOK_ASSIGN) &&
-            !MaybeEmitGroupAssignment(cx, bce, op, pn3, &op)) {
-            return false;
+        if (pn3->isKind(PNK_ASSIGN)) {
+            JS_ASSERT(pn3->isOp(JSOP_NOP));
+            if (!MaybeEmitGroupAssignment(cx, bce, op, pn3, &op))
+                return false;
         }
 #endif
         if (op == JSOP_POP && !EmitTree(cx, bce, pn3))
@@ -5752,7 +5745,7 @@ EmitNormalFor(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
 static inline bool
 EmitFor(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
 {
-    return pn->pn_left->isKind(TOK_IN)
+    return pn->pn_left->isKind(PNK_IN)
            ? EmitForIn(cx, bce, pn, top)
            : EmitNormalFor(cx, bce, pn, top);
 }
@@ -5787,7 +5780,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     UPDATE_LINE_NUMBER_NOTES(cx, bce, pn->pn_pos.begin.lineno);
 
     switch (pn->getKind()) {
-      case TOK_FUNCTION:
+      case PNK_FUNCTION:
       {
         JSFunction *fun;
         uintN slot;
@@ -5806,7 +5799,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             /*
              * This second pass is needed to emit JSOP_NOP with a source note
              * for the already-emitted function definition prolog opcode. See
-             * comments in the TOK_LC case.
+             * comments in the PNK_LC case.
              */
             JS_ASSERT(pn->isOp(JSOP_NOP));
             JS_ASSERT(bce->inFunction());
@@ -5931,7 +5924,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
       }
 
-      case TOK_ARGSBODY:
+      case PNK_ARGSBODY:
       {
         ParseNode *pnlast = pn->last();
         for (ParseNode *pn2 = pn->pn_head; pn2 != pnlast; pn2 = pn2->pn_next) {
@@ -5948,7 +5941,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
       }
 
-      case TOK_UPVARS:
+      case PNK_UPVARS:
         JS_ASSERT(pn->pn_names->count() != 0);
         bce->roLexdeps = pn->pn_names;
         ok = EmitTree(cx, bce, pn->pn_tree);
@@ -5956,15 +5949,15 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         pn->pn_names.releaseMap(cx);
         break;
 
-      case TOK_IF:
+      case PNK_IF:
         ok = EmitIf(cx, bce, pn);
         break;
 
-      case TOK_SWITCH:
+      case PNK_SWITCH:
         ok = EmitSwitch(cx, bce, pn);
         break;
 
-      case TOK_WHILE:
+      case PNK_WHILE:
         /*
          * Minimize bytecodes issued for one or more iterations by jumping to
          * the condition below the body and closing the loop if the condition
@@ -6017,7 +6010,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         ok = PopStatementBCE(cx, bce);
         break;
 
-      case TOK_DO:
+      case PNK_DO:
         /* Emit an annotated nop so we know to decompile a 'do' keyword. */
         noteIndex = NewSrcNote(cx, bce, SRC_WHILE);
         if (noteIndex < 0 || Emit1(cx, bce, JSOP_NOP) < 0)
@@ -6065,11 +6058,11 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         ok = PopStatementBCE(cx, bce);
         break;
 
-      case TOK_FOR:
+      case PNK_FOR:
         ok = EmitFor(cx, bce, pn, top);
         break;
 
-      case TOK_BREAK: {
+      case PNK_BREAK: {
         stmt = bce->topStmt;
         atom = pn->pn_atom;
 
@@ -6093,7 +6086,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
       }
 
-      case TOK_CONTINUE: {
+      case PNK_CONTINUE: {
         stmt = bce->topStmt;
         atom = pn->pn_atom;
 
@@ -6122,26 +6115,26 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
       }
 
-      case TOK_WITH:
+      case PNK_WITH:
         ok = EmitWith(cx, bce, pn);
         break;
 
-      case TOK_TRY:
+      case PNK_TRY:
         if (!EmitTry(cx, bce, pn))
             return false;
         break;
 
-      case TOK_CATCH:
+      case PNK_CATCH:
         if (!EmitCatch(cx, bce, pn))
             return false;
         break;
 
-      case TOK_VAR:
+      case PNK_VAR:
         if (!EmitVariables(cx, bce, pn, JS_FALSE, &noteIndex))
             return JS_FALSE;
         break;
 
-      case TOK_RETURN:
+      case PNK_RETURN:
         /* Push a return value */
         pn2 = pn->pn_kid;
         if (pn2) {
@@ -6178,7 +6171,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
 
 #if JS_HAS_GENERATORS
-      case TOK_YIELD:
+      case PNK_YIELD:
         JS_ASSERT(bce->inFunction());
         if (pn->pn_kid) {
             if (!EmitTree(cx, bce, pn->pn_kid))
@@ -6194,7 +6187,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
 #endif
 
-      case TOK_LC:
+      case PNK_LC:
       {
 #if JS_HAS_XML_SUPPORT
         if (pn->isArity(PN_UNARY)) {
@@ -6237,15 +6230,15 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                  * Assign the destructuring arguments before defining any
                  * functions, see bug 419662.
                  */
-                JS_ASSERT(pnchild->isKind(TOK_SEMI));
-                JS_ASSERT(pnchild->pn_kid->isKind(TOK_VAR));
+                JS_ASSERT(pnchild->isKind(PNK_SEMI));
+                JS_ASSERT(pnchild->pn_kid->isKind(PNK_VAR));
                 if (!EmitTree(cx, bce, pnchild))
                     return JS_FALSE;
                 pnchild = pnchild->pn_next;
             }
 
             for (pn2 = pnchild; pn2; pn2 = pn2->pn_next) {
-                if (pn2->isKind(TOK_FUNCTION)) {
+                if (pn2->isKind(PNK_FUNCTION)) {
                     if (pn2->isOp(JSOP_NOP)) {
                         if (!EmitTree(cx, bce, pn2))
                             return JS_FALSE;
@@ -6273,7 +6266,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
       }
 
-      case TOK_SEQ:
+      case PNK_SEQ:
         JS_ASSERT(pn->isArity(PN_LIST));
         PushStatement(bce, &stmtInfo, STMT_SEQ, top);
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
@@ -6283,7 +6276,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         ok = PopStatementBCE(cx, bce);
         break;
 
-      case TOK_SEMI:
+      case PNK_SEMI:
         pn2 = pn->pn_kid;
         if (pn2) {
             /*
@@ -6328,9 +6321,10 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                 }
             } else {
                 op = wantval ? JSOP_POPV : JSOP_POP;
+                JS_ASSERT_IF(pn2->isKind(PNK_ASSIGN), pn2->isOp(JSOP_NOP));
 #if JS_HAS_DESTRUCTURING
                 if (!wantval &&
-                    pn2->isKind(TOK_ASSIGN) &&
+                    pn2->isKind(PNK_ASSIGN) &&
                     !MaybeEmitGroupAssignment(cx, bce, op, pn2, &op)) {
                     return JS_FALSE;
                 }
@@ -6344,8 +6338,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                      * can't escape directly.
                      */
                     if (!wantval &&
-                        pn2->isKind(TOK_ASSIGN) &&
-                        pn2->isOp(JSOP_NOP) &&
+                        pn2->isKind(PNK_ASSIGN) &&
                         pn2->pn_left->isOp(JSOP_SETPROP) &&
                         pn2->pn_right->isOp(JSOP_LAMBDA) &&
                         pn2->pn_right->pn_funbox->joinable()) {
@@ -6360,8 +6353,12 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
         break;
 
-      case TOK_COLON:
-        /* Emit an annotated nop so we know to decompile a label. */
+      case PNK_COLON:
+        /*
+         * Emit a JSOP_LABEL instruction. The argument is the offset to the statement
+         * following the labeled statement. This op has either a SRC_LABEL or
+         * SRC_LABELBRACE source note for the decompiler.
+         */
         atom = pn->pn_atom;
 
         jsatomid index;
@@ -6369,13 +6366,17 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             return JS_FALSE;
 
         pn2 = pn->expr();
-        noteType = (pn2->isKind(TOK_LC) ||
-                    (pn2->isKind(TOK_LEXICALSCOPE) &&
-                     pn2->expr()->isKind(TOK_LC)))
+        noteType = (pn2->isKind(PNK_LC) ||
+                    (pn2->isKind(PNK_LEXICALSCOPE) &&
+                     pn2->expr()->isKind(PNK_LC)))
                    ? SRC_LABELBRACE
                    : SRC_LABEL;
         noteIndex = NewSrcNote2(cx, bce, noteType, ptrdiff_t(index));
-        if (noteIndex < 0 || Emit1(cx, bce, JSOP_NOP) < 0)
+        if (noteIndex < 0)
+            return JS_FALSE;
+
+        top = EmitJump(cx, bce, JSOP_LABEL, 0);
+        if (top < 0)
             return JS_FALSE;
 
         /* Emit code for the labeled statement. */
@@ -6386,6 +6387,9 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         if (!PopStatementBCE(cx, bce))
             return JS_FALSE;
 
+        /* Patch the JSOP_LABEL offset. */
+        CHECK_AND_SET_JUMP_OFFSET_AT(cx, bce, top);
+
         /* If the statement was compound, emit a note for the end brace. */
         if (noteType == SRC_LABELBRACE) {
             if (NewSrcNote(cx, bce, SRC_ENDBRACE) < 0 ||
@@ -6395,7 +6399,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
         break;
 
-      case TOK_COMMA:
+      case PNK_COMMA:
         /*
          * Emit SRC_PCDELTA notes on each JSOP_POP between comma operands.
          * These notes help the decompiler bracket the bytecodes generated
@@ -6421,12 +6425,23 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
         break;
 
-      case TOK_ASSIGN:
+      case PNK_ASSIGN:
+      case PNK_ADDASSIGN:
+      case PNK_SUBASSIGN:
+      case PNK_BITORASSIGN:
+      case PNK_BITXORASSIGN:
+      case PNK_BITANDASSIGN:
+      case PNK_LSHASSIGN:
+      case PNK_RSHASSIGN:
+      case PNK_URSHASSIGN:
+      case PNK_MULASSIGN:
+      case PNK_DIVASSIGN:
+      case PNK_MODASSIGN:
         if (!EmitAssignment(cx, bce, pn->pn_left, pn->getOp(), pn->pn_right))
             return false;
         break;
 
-      case TOK_HOOK:
+      case PNK_HOOK:
         /* Emit the condition, then branch if false to the else part. */
         if (!EmitTree(cx, bce, pn->pn_kid1))
             return JS_FALSE;
@@ -6464,24 +6479,25 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             return JS_FALSE;
         break;
 
-      case TOK_OR:
-      case TOK_AND:
+      case PNK_OR:
+      case PNK_AND:
         /*
-         * JSOP_OR converts the operand on the stack to boolean, and if true,
-         * leaves the original operand value on the stack and jumps; otherwise
-         * it pops and falls into the next bytecode, which evaluates the right
-         * operand.  The jump goes around the right operand evaluation.
+         * JSOP_OR converts the operand on the stack to boolean, leaves the original
+         * value on the stack and jumps if true; otherwise it falls into the next
+         * bytecode, which pops the left operand and then evaluates the right operand.
+         * The jump goes around the right operand evaluation.
          *
-         * JSOP_AND converts the operand on the stack to boolean, and if false,
-         * leaves the original operand value on the stack and jumps; otherwise
-         * it pops and falls into the right operand's bytecode.
+         * JSOP_AND converts the operand on the stack to boolean and jumps if false;
+         * otherwise it falls into the right operand's bytecode.
          */
         if (pn->isArity(PN_BINARY)) {
             if (!EmitTree(cx, bce, pn->pn_left))
                 return JS_FALSE;
-            top = EmitJump(cx, bce, JSOP_BACKPATCH_POP, 0);
+            top = EmitJump(cx, bce, JSOP_BACKPATCH, 0);
             if (top < 0)
                 return JS_FALSE;
+            if (Emit1(cx, bce, JSOP_POP) < 0)
+                return JS_FALSE;
             if (!EmitTree(cx, bce, pn->pn_right))
                 return JS_FALSE;
             off = bce->offset();
@@ -6496,18 +6512,22 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             pn2 = pn->pn_head;
             if (!EmitTree(cx, bce, pn2))
                 return JS_FALSE;
-            top = EmitJump(cx, bce, JSOP_BACKPATCH_POP, 0);
+            top = EmitJump(cx, bce, JSOP_BACKPATCH, 0);
             if (top < 0)
                 return JS_FALSE;
+            if (Emit1(cx, bce, JSOP_POP) < 0)
+                return JS_FALSE;
 
             /* Emit nodes between the head and the tail. */
             jmp = top;
             while ((pn2 = pn2->pn_next)->pn_next) {
                 if (!EmitTree(cx, bce, pn2))
                     return JS_FALSE;
-                off = EmitJump(cx, bce, JSOP_BACKPATCH_POP, 0);
+                off = EmitJump(cx, bce, JSOP_BACKPATCH, 0);
                 if (off < 0)
                     return JS_FALSE;
+                if (Emit1(cx, bce, JSOP_POP) < 0)
+                    return JS_FALSE;
                 if (!SetBackPatchDelta(cx, bce, bce->code(jmp), off - jmp))
                     return JS_FALSE;
                 jmp = off;
@@ -6528,18 +6548,29 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
         break;
 
-      case TOK_PLUS:
-      case TOK_BITOR:
-      case TOK_BITXOR:
-      case TOK_BITAND:
-      case TOK_EQOP:
-      case TOK_RELOP:
-      case TOK_IN:
-      case TOK_INSTANCEOF:
-      case TOK_SHOP:
-      case TOK_MINUS:
-      case TOK_STAR:
-      case TOK_DIVOP:
+      case PNK_PLUS:
+      case PNK_MINUS:
+        if (pn->isArity(PN_UNARY))
+            goto unary_plusminus;
+      case PNK_BITOR:
+      case PNK_BITXOR:
+      case PNK_BITAND:
+      case PNK_STRICTEQ:
+      case PNK_EQ:
+      case PNK_STRICTNE:
+      case PNK_NE:
+      case PNK_LT:
+      case PNK_LE:
+      case PNK_GT:
+      case PNK_GE:
+      case PNK_IN:
+      case PNK_INSTANCEOF:
+      case PNK_LSH:
+      case PNK_RSH:
+      case PNK_URSH:
+      case PNK_STAR:
+      case PNK_DIV:
+      case PNK_MOD:
         if (pn->isArity(PN_LIST)) {
             /* Left-associative operator chain: avoid too much recursion. */
             pn2 = pn->pn_head;
@@ -6556,7 +6587,8 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 #if JS_HAS_XML_SUPPORT
             uintN oldflags;
 
-      case TOK_DBLCOLON:
+      case PNK_DBLCOLON:
+            JS_ASSERT(pn->getOp() != JSOP_XMLNAME);
             if (pn->isArity(PN_NAME)) {
                 if (!EmitTree(cx, bce, pn->expr()))
                     return JS_FALSE;
@@ -6587,32 +6619,47 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
         break;
 
-      case TOK_THROW:
 #if JS_HAS_XML_SUPPORT
-      case TOK_AT:
-      case TOK_DEFAULT:
+      case PNK_XMLUNARY:
+        if (pn->getOp() == JSOP_XMLNAME) {
+            if (!EmitXMLName(cx, pn, JSOP_XMLNAME, bce))
+                return false;
+        } else {
+            JSOp op = pn->getOp();
+            JS_ASSERT(op == JSOP_BINDXMLNAME || op == JSOP_SETXMLNAME);
+            uintN oldflags = bce->flags;
+            bce->flags &= ~TCF_IN_FOR_INIT;
+            if (!EmitTree(cx, bce, pn->pn_kid))
+                return false;
+            bce->flags |= oldflags & TCF_IN_FOR_INIT;
+            if (Emit1(cx, bce, op) < 0)
+                return false;
+        }
+        break;
+#endif
+
+      case PNK_THROW:
+#if JS_HAS_XML_SUPPORT
+      case PNK_AT:
+      case PNK_DEFAULT:
         JS_ASSERT(pn->isArity(PN_UNARY));
         /* FALL THROUGH */
 #endif
-      case TOK_UNARYOP:
+      case PNK_TYPEOF:
+      case PNK_VOID:
+      case PNK_NOT:
+      case PNK_BITNOT:
+      unary_plusminus:
       {
-        uintN oldflags;
-
         /* Unary op, including unary +/-. */
         op = pn->getOp();
-#if JS_HAS_XML_SUPPORT
-        if (op == JSOP_XMLNAME) {
-            if (!EmitXMLName(cx, pn, op, bce))
-                return JS_FALSE;
-            break;
-        }
-#endif
         pn2 = pn->pn_kid;
 
-        if (op == JSOP_TYPEOF && !pn2->isKind(TOK_NAME))
+        JS_ASSERT(op != JSOP_XMLNAME);
+        if (op == JSOP_TYPEOF && !pn2->isKind(PNK_NAME))
             op = JSOP_TYPEOFEXPR;
 
-        oldflags = bce->flags;
+        uintN oldflags = bce->flags;
         bce->flags &= ~TCF_IN_FOR_INIT;
         if (!EmitTree(cx, bce, pn2))
             return JS_FALSE;
@@ -6622,15 +6669,15 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
       }
 
-      case TOK_INC:
-      case TOK_DEC:
+      case PNK_INC:
+      case PNK_DEC:
         /* Emit lvalue-specialized code for ++/-- operators. */
         pn2 = pn->pn_kid;
-        JS_ASSERT(!pn2->isKind(TOK_RP));
+        JS_ASSERT(!pn2->isKind(PNK_RP));
         op = pn->getOp();
         switch (pn2->getKind()) {
           default:
-            JS_ASSERT(pn2->isKind(TOK_NAME));
+            JS_ASSERT(pn2->isKind(PNK_NAME));
             pn2->setOp(op);
             if (!BindNameToSlot(cx, bce, pn2))
                 return JS_FALSE;
@@ -6665,15 +6712,15 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                 }
             }
             break;
-          case TOK_DOT:
+          case PNK_DOT:
             if (!EmitPropIncDec(cx, pn2, op, bce))
                 return JS_FALSE;
             break;
-          case TOK_LB:
+          case PNK_LB:
             if (!EmitElemIncDec(cx, pn2, op, bce))
                 return JS_FALSE;
             break;
-          case TOK_LP:
+          case PNK_LP:
             if (!EmitTree(cx, bce, pn2))
                 return JS_FALSE;
             if (NewSrcNote2(cx, bce, SRC_PCBASE, bce->offset() - pn2->pn_offset) < 0)
@@ -6693,7 +6740,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                 return JS_FALSE;
             break;
 #if JS_HAS_XML_SUPPORT
-          case TOK_UNARYOP:
+          case PNK_XMLUNARY:
             JS_ASSERT(!bce->inStrictMode());
             JS_ASSERT(pn2->isOp(JSOP_SETXMLNAME));
             if (!EmitTree(cx, bce, pn2->pn_kid))
@@ -6707,14 +6754,14 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
         break;
 
-      case TOK_DELETE:
+      case PNK_DELETE:
         /*
          * Under ECMA 3, deleting a non-reference returns true -- but alas we
          * must evaluate the operand if it appears it might have side effects.
          */
         pn2 = pn->pn_kid;
         switch (pn2->getKind()) {
-          case TOK_NAME:
+          case PNK_NAME:
             if (!BindNameToSlot(cx, bce, pn2))
                 return JS_FALSE;
             op = pn2->getOp();
@@ -6726,18 +6773,18 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                     return JS_FALSE;
             }
             break;
-          case TOK_DOT:
+          case PNK_DOT:
             if (!EmitPropOp(cx, pn2, JSOP_DELPROP, bce, JS_FALSE))
                 return JS_FALSE;
             break;
 #if JS_HAS_XML_SUPPORT
-          case TOK_DBLDOT:
+          case PNK_DBLDOT:
             JS_ASSERT(!bce->inStrictMode());
             if (!EmitElemOp(cx, pn2, JSOP_DELDESC, bce))
                 return JS_FALSE;
             break;
 #endif
-          case TOK_LB:
+          case PNK_LB:
             if (!EmitElemOp(cx, pn2, JSOP_DELELEM, bce))
                 return JS_FALSE;
             break;
@@ -6752,7 +6799,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             if (!useful) {
                 off = noteIndex = -1;
             } else {
-                JS_ASSERT_IF(pn2->isKind(TOK_LP), !(pn2->pn_xflags & PNX_SETCALL));
+                JS_ASSERT_IF(pn2->isKind(PNK_LP), !(pn2->pn_xflags & PNX_SETCALL));
                 if (!EmitTree(cx, bce, pn2))
                     return JS_FALSE;
                 off = bce->offset();
@@ -6771,7 +6818,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
 
 #if JS_HAS_XML_SUPPORT
-      case TOK_FILTER:
+      case PNK_FILTER:
         JS_ASSERT(!bce->inStrictMode());
 
         if (!EmitTree(cx, bce, pn->pn_left))
@@ -6794,7 +6841,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
 #endif
 
-      case TOK_DOT:
+      case PNK_DOT:
         /*
          * Pop a stack operand, convert it to object, get a property named by
          * this bytecode's immediate-indexed atom operand, and push its value
@@ -6804,11 +6851,11 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
 
 #if JS_HAS_XML_SUPPORT
-      case TOK_DBLDOT:
+      case PNK_DBLDOT:
         JS_ASSERT(!bce->inStrictMode());
         /* FALL THROUGH */
 #endif
-      case TOK_LB:
+      case PNK_LB:
         /*
          * Pop two operands, convert the left one to object and the right one
          * to property name (atom or tagged int), get the named property, and
@@ -6818,10 +6865,10 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         ok = EmitElemOp(cx, pn, pn->getOp(), bce);
         break;
 
-      case TOK_NEW:
-      case TOK_LP:
+      case PNK_NEW:
+      case PNK_LP:
       {
-        bool callop = pn->isKind(TOK_LP);
+        bool callop = pn->isKind(PNK_LP);
 
         /*
          * Emit callable invocation or operator new (constructor call) code.
@@ -6840,29 +6887,27 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
          */
         pn2 = pn->pn_head;
         switch (pn2->getKind()) {
-          case TOK_NAME:
+          case PNK_NAME:
             if (!EmitNameOp(cx, bce, pn2, callop))
                 return JS_FALSE;
             break;
-          case TOK_DOT:
+          case PNK_DOT:
             if (!EmitPropOp(cx, pn2, pn2->getOp(), bce, callop))
                 return JS_FALSE;
             break;
-          case TOK_LB:
+          case PNK_LB:
             JS_ASSERT(pn2->isOp(JSOP_GETELEM));
             if (!EmitElemOp(cx, pn2, callop ? JSOP_CALLELEM : JSOP_GETELEM, bce))
                 return JS_FALSE;
             break;
-          case TOK_UNARYOP:
 #if JS_HAS_XML_SUPPORT
-            if (pn2->isOp(JSOP_XMLNAME)) {
-                if (!EmitXMLName(cx, pn2, JSOP_CALLXMLNAME, bce))
-                    return JS_FALSE;
-                callop = true;          /* suppress JSOP_PUSH after */
-                break;
-            }
+          case PNK_XMLUNARY:
+            JS_ASSERT(pn2->isOp(JSOP_XMLNAME));
+            if (!EmitXMLName(cx, pn2, JSOP_CALLXMLNAME, bce))
+                return JS_FALSE;
+            callop = true;          /* suppress JSOP_PUSH after */
+            break;
 #endif
-            /* FALL THROUGH */
           default:
             if (!EmitTree(cx, bce, pn2))
                 return JS_FALSE;
@@ -6906,18 +6951,18 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
       }
 
-      case TOK_LEXICALSCOPE:
+      case PNK_LEXICALSCOPE:
         ok = EmitLexicalScope(cx, bce, pn);
         break;
 
 #if JS_HAS_BLOCK_SCOPE
-      case TOK_LET: 
+      case PNK_LET:
         if (!EmitLet(cx, bce, pn))
             return false;
         break;
 #endif /* JS_HAS_BLOCK_SCOPE */
 #if JS_HAS_GENERATORS
-      case TOK_ARRAYPUSH: {
+      case PNK_ARRAYPUSH: {
         jsint slot;
 
         /*
@@ -6935,9 +6980,9 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
       }
 #endif
 
-      case TOK_RB:
+      case PNK_RB:
 #if JS_HAS_GENERATORS
-      case TOK_ARRAYCOMP:
+      case PNK_ARRAYCOMP:
 #endif
         /*
          * Emit code for [a, b, c] that is equivalent to constructing a new
@@ -6953,15 +6998,15 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 #endif
 
 #if JS_HAS_GENERATORS
-        if (pn->isKind(TOK_ARRAYCOMP)) {
+        if (pn->isKind(PNK_ARRAYCOMP)) {
             uintN saveDepth;
 
             if (!EmitNewInit(cx, bce, JSProto_Array, pn, sharpnum))
                 return JS_FALSE;
 
             /*
-             * Pass the new array's stack index to the TOK_ARRAYPUSH case via
-             * bce->arrayCompDepth, then simply traverse the TOK_FOR node and
+             * Pass the new array's stack index to the PNK_ARRAYPUSH case via
+             * bce->arrayCompDepth, then simply traverse the PNK_FOR node and
              * its kids under pn2 to generate this comprehension.
              */
             JS_ASSERT(bce->stackDepth > 0);
@@ -7001,7 +7046,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         for (atomIndex = 0; pn2; atomIndex++, pn2 = pn2->pn_next) {
             if (!EmitNumberOp(cx, atomIndex, bce))
                 return JS_FALSE;
-            if (pn2->isKind(TOK_COMMA) && pn2->isArity(PN_NULLARY)) {
+            if (pn2->isKind(PNK_COMMA) && pn2->isArity(PN_NULLARY)) {
                 if (Emit1(cx, bce, JSOP_HOLE) < 0)
                     return JS_FALSE;
             } else {
@@ -7027,7 +7072,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             return JS_FALSE;
         break;
 
-      case TOK_RC: {
+      case PNK_RC: {
 #if JS_HAS_SHARP_VARS
         sharpnum = -1;
       do_emit_object:
@@ -7075,7 +7120,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
             /* Emit an index for t[2] for later consumption by JSOP_INITELEM. */
             pn3 = pn2->pn_left;
-            if (pn3->isKind(TOK_NUMBER)) {
+            if (pn3->isKind(PNK_NUMBER)) {
                 if (!EmitNumberOp(cx, pn3->pn_dval, bce))
                     return JS_FALSE;
             }
@@ -7092,15 +7137,14 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             }
 
             /* Annotate JSOP_INITELEM so we decompile 2:c and not just c. */
-            if (pn3->isKind(TOK_NUMBER)) {
+            if (pn3->isKind(PNK_NUMBER)) {
                 obj = NULL;
                 if (NewSrcNote(cx, bce, SRC_INITPROP) < 0)
                     return JS_FALSE;
                 if (Emit1(cx, bce, JSOP_INITELEM) < 0)
                     return JS_FALSE;
             } else {
-                JS_ASSERT(pn3->isKind(TOK_NAME) ||
-                          pn3->isKind(TOK_STRING));
+                JS_ASSERT(pn3->isKind(PNK_NAME) || pn3->isKind(PNK_STRING));
                 jsatomid index;
                 if (!bce->makeAtomIndex(pn3->pn_atom, &index))
                     return JS_FALSE;
@@ -7166,17 +7210,17 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
       }
 
 #if JS_HAS_SHARP_VARS
-      case TOK_DEFSHARP:
+      case PNK_DEFSHARP:
         JS_ASSERT(bce->hasSharps());
         sharpnum = pn->pn_num;
         pn = pn->pn_kid;
-        if (pn->isKind(TOK_RB))
+        if (pn->isKind(PNK_RB))
             goto do_emit_array;
 # if JS_HAS_GENERATORS
-        if (pn->isKind(TOK_ARRAYCOMP))
+        if (pn->isKind(PNK_ARRAYCOMP))
             goto do_emit_array;
 # endif
-        if (pn->isKind(TOK_RC))
+        if (pn->isKind(PNK_RC))
             goto do_emit_object;
 
         if (!EmitTree(cx, bce, pn))
@@ -7184,13 +7228,13 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         EMIT_UINT16PAIR_IMM_OP(JSOP_DEFSHARP, bce->sharpSlotBase, (jsatomid) sharpnum);
         break;
 
-      case TOK_USESHARP:
+      case PNK_USESHARP:
         JS_ASSERT(bce->hasSharps());
         EMIT_UINT16PAIR_IMM_OP(JSOP_USESHARP, bce->sharpSlotBase, (jsatomid) pn->pn_num);
         break;
 #endif /* JS_HAS_SHARP_VARS */
 
-      case TOK_NAME:
+      case PNK_NAME:
         /*
          * Cope with a left-over function definition that was replaced by a use
          * of a later function definition of the same name. See FunctionDef and
@@ -7203,52 +7247,55 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
 
 #if JS_HAS_XML_SUPPORT
-      case TOK_XMLATTR:
-      case TOK_XMLSPACE:
-      case TOK_XMLTEXT:
-      case TOK_XMLCDATA:
-      case TOK_XMLCOMMENT:
+      case PNK_XMLATTR:
+      case PNK_XMLSPACE:
+      case PNK_XMLTEXT:
+      case PNK_XMLCDATA:
+      case PNK_XMLCOMMENT:
         JS_ASSERT(!bce->inStrictMode());
         /* FALL THROUGH */
 #endif
-      case TOK_STRING:
+      case PNK_STRING:
         ok = EmitAtomOp(cx, pn, pn->getOp(), bce);
         break;
 
-      case TOK_NUMBER:
+      case PNK_NUMBER:
         ok = EmitNumberOp(cx, pn->pn_dval, bce);
         break;
 
-      case TOK_REGEXP:
+      case PNK_REGEXP:
         JS_ASSERT(pn->isOp(JSOP_REGEXP));
         ok = EmitIndexOp(cx, JSOP_REGEXP, bce->regexpList.index(pn->pn_objbox), bce);
         break;
 
 #if JS_HAS_XML_SUPPORT
-      case TOK_ANYNAME:
+      case PNK_ANYNAME:
 #endif
-      case TOK_PRIMARY:
+      case PNK_TRUE:
+      case PNK_FALSE:
+      case PNK_THIS:
+      case PNK_NULL:
         if (Emit1(cx, bce, pn->getOp()) < 0)
             return JS_FALSE;
         break;
 
-      case TOK_DEBUGGER:
+      case PNK_DEBUGGER:
         if (Emit1(cx, bce, JSOP_DEBUGGER) < 0)
             return JS_FALSE;
         break;
 
 #if JS_HAS_XML_SUPPORT
-      case TOK_XMLELEM:
-      case TOK_XMLLIST:
+      case PNK_XMLELEM:
+      case PNK_XMLLIST:
         JS_ASSERT(!bce->inStrictMode());
-        JS_ASSERT(pn->isKind(TOK_XMLLIST) || pn->pn_count != 0);
+        JS_ASSERT(pn->isKind(PNK_XMLLIST) || pn->pn_count != 0);
 
-        switch (pn->pn_head ? pn->pn_head->getKind() : TOK_XMLLIST) {
-          case TOK_XMLETAGO:
+        switch (pn->pn_head ? pn->pn_head->getKind() : PNK_XMLLIST) {
+          case PNK_XMLETAGO:
             JS_ASSERT(0);
             /* FALL THROUGH */
-          case TOK_XMLPTAGC:
-          case TOK_XMLSTAGO:
+          case PNK_XMLPTAGC:
+          case PNK_XMLSTAGO:
             break;
           default:
             if (Emit1(cx, bce, JSOP_STARTXML) < 0)
@@ -7256,10 +7303,8 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
 
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-            if (pn2->isKind(TOK_LC) &&
-                Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0) {
+            if (pn2->isKind(PNK_LC) && Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0)
                 return JS_FALSE;
-            }
             if (!EmitTree(cx, bce, pn2))
                 return JS_FALSE;
             if (pn2 != pn->pn_head && Emit1(cx, bce, JSOP_ADD) < 0)
@@ -7268,7 +7313,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
         if (pn->pn_xflags & PNX_XMLROOT) {
             if (pn->pn_count == 0) {
-                JS_ASSERT(pn->isKind(TOK_XMLLIST));
+                JS_ASSERT(pn->isKind(PNK_XMLLIST));
                 atom = cx->runtime->atomState.emptyAtom;
                 jsatomid index;
                 if (!bce->makeAtomIndex(atom, &index))
@@ -7284,23 +7329,21 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 #endif
         break;
 
-      case TOK_XMLPTAGC:
-      case TOK_XMLSTAGO:
-      case TOK_XMLETAGO:
+      case PNK_XMLPTAGC:
+      case PNK_XMLSTAGO:
+      case PNK_XMLETAGO:
         if (!EmitXMLTag(cx, bce, pn))
             return false;
         break;
 
-      case TOK_XMLNAME:
+      case PNK_XMLNAME:
         JS_ASSERT(!bce->inStrictMode());
 
         if (pn->isArity(PN_LIST)) {
             JS_ASSERT(pn->pn_count != 0);
             for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-                if (pn2->isKind(TOK_LC) &&
-                    Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0) {
+                if (pn2->isKind(PNK_LC) && Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0)
                     return JS_FALSE;
-                }
                 if (!EmitTree(cx, bce, pn2))
                     return JS_FALSE;
                 if (pn2 != pn->pn_head && Emit1(cx, bce, JSOP_ADD) < 0)
@@ -7314,7 +7357,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
         break;
 
-      case TOK_XMLPI:
+      case PNK_XMLPI:
         if (!EmitXMLProcessingInstruction(cx, bce, pn))
             return false;
         break;
@@ -7734,7 +7777,7 @@ CGObjectList::finish(JSObjectArray *array)
     JS_ASSERT(length <= INDEX_LIMIT);
     JS_ASSERT(length == array->length);
 
-    JSObject **cursor = array->vector + array->length;
+    js::HeapPtrObject *cursor = array->vector + array->length;
     ObjectBox *objbox = lastbox;
     do {
         --cursor;
@@ -7749,7 +7792,7 @@ GCConstList::finish(JSConstArray *array)
 {
     JS_ASSERT(array->length == list.length());
     Value *src = list.begin(), *srcend = list.end();
-    Value *dst = array->vector;
+    HeapValue *dst = array->vector;
     for (; src != srcend; ++src, ++dst)
         *dst = *src;
 }
diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h
index 330d7c41f92f..1493ca47ce6c 100644
--- a/js/src/frontend/BytecodeEmitter.h
+++ b/js/src/frontend/BytecodeEmitter.h
@@ -359,24 +359,8 @@ struct TreeContext {                /* tree context for semantic checks */
 
     void trace(JSTracer *trc);
 
-    TreeContext(Parser *prs)
-      : flags(0), bodyid(0), blockidGen(0), parenDepth(0), yieldCount(0), argumentsCount(0),
-        topStmt(NULL), topScopeStmt(NULL), blockChainBox(NULL), blockNode(NULL),
-        decls(prs->context), parser(prs), yieldNode(NULL), argumentsNode(NULL), scopeChain_(NULL),
-        lexdeps(prs->context), parent(prs->tc), staticLevel(0), funbox(NULL), functionList(NULL),
-        innermostWith(NULL), bindings(prs->context), sharpSlotBase(-1)
-    {
-        prs->tc = this;
-    }
-
-    /*
-     * For functions the tree context is constructed and destructed a second
-     * time during code generation. To avoid a redundant stats update in such
-     * cases, we store uint16(-1) in maxScopeDepth.
-     */
-    ~TreeContext() {
-        parser->tc = this->parent;
-    }
+    inline TreeContext(Parser *prs);
+    inline ~TreeContext();
 
     /*
      * js::BytecodeEmitter derives from js::TreeContext; however, only the
@@ -993,8 +977,8 @@ enum SrcNoteType {
     SRC_PCBASE      = 12,       /* distance back from annotated getprop or
                                    setprop op to left-most obj.prop.subprop
                                    bytecode -- always a backward delta */
-    SRC_LABEL       = 13,       /* JSOP_NOP for label: with atomid immediate */
-    SRC_LABELBRACE  = 14,       /* JSOP_NOP for label: {...} begin brace */
+    SRC_LABEL       = 13,       /* JSOP_LABEL for label: with atomid immediate */
+    SRC_LABELBRACE  = 14,       /* JSOP_LABEL for label: {...} begin brace */
     SRC_ENDBRACE    = 15,       /* JSOP_NOP for label: {...} end brace */
     SRC_BREAK2LABEL = 16,       /* JSOP_GOTO for 'break label' with atomid */
     SRC_CONT2LABEL  = 17,       /* JSOP_GOTO for 'continue label' with atomid */
diff --git a/js/src/frontend/FoldConstants.cpp b/js/src/frontend/FoldConstants.cpp
index 7c27bba097f7..9f1b7fb58ecb 100644
--- a/js/src/frontend/FoldConstants.cpp
+++ b/js/src/frontend/FoldConstants.cpp
@@ -52,30 +52,25 @@
 using namespace js;
 
 static ParseNode *
-ContainsStmt(ParseNode *pn, TokenKind tt)
+ContainsStmt(ParseNode *pn, ParseNodeKind kind)
 {
-    ParseNode *pn2, *pnt;
-
     if (!pn)
         return NULL;
-    if (pn->isKind(tt))
+    if (pn->isKind(kind))
         return pn;
     switch (pn->getArity()) {
       case PN_LIST:
-        for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-            pnt = ContainsStmt(pn2, tt);
-            if (pnt)
+        for (ParseNode *pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
+            if (ParseNode *pnt = ContainsStmt(pn2, kind))
                 return pnt;
         }
         break;
       case PN_TERNARY:
-        pnt = ContainsStmt(pn->pn_kid1, tt);
-        if (pnt)
+        if (ParseNode *pnt = ContainsStmt(pn->pn_kid1, kind))
             return pnt;
-        pnt = ContainsStmt(pn->pn_kid2, tt);
-        if (pnt)
+        if (ParseNode *pnt = ContainsStmt(pn->pn_kid2, kind))
             return pnt;
-        return ContainsStmt(pn->pn_kid3, tt);
+        return ContainsStmt(pn->pn_kid3, kind);
       case PN_BINARY:
         /*
          * Limit recursion if pn is a binary expression, which can't contain a
@@ -83,18 +78,17 @@ ContainsStmt(ParseNode *pn, TokenKind tt)
          */
         if (!pn->isOp(JSOP_NOP))
             return NULL;
-        pnt = ContainsStmt(pn->pn_left, tt);
-        if (pnt)
+        if (ParseNode *pnt = ContainsStmt(pn->pn_left, kind))
             return pnt;
-        return ContainsStmt(pn->pn_right, tt);
+        return ContainsStmt(pn->pn_right, kind);
       case PN_UNARY:
         if (!pn->isOp(JSOP_NOP))
             return NULL;
-        return ContainsStmt(pn->pn_kid, tt);
+        return ContainsStmt(pn->pn_kid, kind);
       case PN_NAME:
-        return ContainsStmt(pn->maybeExpr(), tt);
+        return ContainsStmt(pn->maybeExpr(), kind);
       case PN_NAMESET:
-        return ContainsStmt(pn->pn_tree, tt);
+        return ContainsStmt(pn->pn_tree, kind);
       default:;
     }
     return NULL;
@@ -105,30 +99,30 @@ ContainsStmt(ParseNode *pn, TokenKind tt)
  * XXX handles only strings and numbers for now
  */
 static JSBool
-FoldType(JSContext *cx, ParseNode *pn, TokenKind type)
+FoldType(JSContext *cx, ParseNode *pn, ParseNodeKind kind)
 {
-    if (!pn->isKind(type)) {
-        switch (type) {
-          case TOK_NUMBER:
-            if (pn->isKind(TOK_STRING)) {
+    if (!pn->isKind(kind)) {
+        switch (kind) {
+          case PNK_NUMBER:
+            if (pn->isKind(PNK_STRING)) {
                 jsdouble d;
                 if (!ToNumber(cx, StringValue(pn->pn_atom), &d))
                     return JS_FALSE;
                 pn->pn_dval = d;
-                pn->setKind(TOK_NUMBER);
+                pn->setKind(PNK_NUMBER);
                 pn->setOp(JSOP_DOUBLE);
             }
             break;
 
-          case TOK_STRING:
-            if (pn->isKind(TOK_NUMBER)) {
+          case PNK_STRING:
+            if (pn->isKind(PNK_NUMBER)) {
                 JSString *str = js_NumberToString(cx, pn->pn_dval);
                 if (!str)
                     return JS_FALSE;
                 pn->pn_atom = js_AtomizeString(cx, str);
                 if (!pn->pn_atom)
                     return JS_FALSE;
-                pn->setKind(TOK_STRING);
+                pn->setKind(PNK_STRING);
                 pn->setOp(JSOP_STRING);
             }
             break;
@@ -151,7 +145,7 @@ FoldBinaryNumeric(JSContext *cx, JSOp op, ParseNode *pn1, ParseNode *pn2,
     jsdouble d, d2;
     int32 i, j;
 
-    JS_ASSERT(pn1->isKind(TOK_NUMBER) && pn2->isKind(TOK_NUMBER));
+    JS_ASSERT(pn1->isKind(PNK_NUMBER) && pn2->isKind(PNK_NUMBER));
     d = pn1->pn_dval;
     d2 = pn2->pn_dval;
     switch (op) {
@@ -216,7 +210,7 @@ FoldBinaryNumeric(JSContext *cx, JSOp op, ParseNode *pn1, ParseNode *pn2,
         tc->freeTree(pn1);
     if (pn2 != pn)
         tc->freeTree(pn2);
-    pn->setKind(TOK_NUMBER);
+    pn->setKind(PNK_NUMBER);
     pn->setOp(JSOP_DOUBLE);
     pn->setArity(PN_NULLARY);
     pn->pn_dval = d;
@@ -228,61 +222,58 @@ FoldBinaryNumeric(JSContext *cx, JSOp op, ParseNode *pn1, ParseNode *pn2,
 static JSBool
 FoldXMLConstants(JSContext *cx, ParseNode *pn, TreeContext *tc)
 {
-    TokenKind tt;
-    ParseNode **pnp, *pn1, *pn2;
-    JSString *accum, *str;
-    uint32 i, j;
-
     JS_ASSERT(pn->isArity(PN_LIST));
-    tt = pn->getKind();
-    pnp = &pn->pn_head;
-    pn1 = *pnp;
-    accum = NULL;
-    str = NULL;
+    ParseNodeKind kind = pn->getKind();
+    ParseNode **pnp = &pn->pn_head;
+    ParseNode *pn1 = *pnp;
+    JSString *accum = NULL;
+    JSString *str = NULL;
     if ((pn->pn_xflags & PNX_CANTFOLD) == 0) {
-        if (tt == TOK_XMLETAGO)
+        if (kind == PNK_XMLETAGO)
             accum = cx->runtime->atomState.etagoAtom;
-        else if (tt == TOK_XMLSTAGO || tt == TOK_XMLPTAGC)
+        else if (kind == PNK_XMLSTAGO || kind == PNK_XMLPTAGC)
             accum = cx->runtime->atomState.stagoAtom;
     }
 
     /*
      * GC Rooting here is tricky: for most of the loop, |accum| is safe via
-     * the newborn string root. However, when |pn2->pn_type| is TOK_XMLCDATA,
-     * TOK_XMLCOMMENT, or TOK_XMLPI it is knocked out of the newborn root.
+     * the newborn string root. However, when |pn2->getKind()| is PNK_XMLCDATA,
+     * PNK_XMLCOMMENT, or PNK_XMLPI it is knocked out of the newborn root.
      * Therefore, we have to add additonal protection from GC nesting under
      * js_ConcatStrings.
      */
+    ParseNode *pn2;
+    uint32 i, j;
     for (pn2 = pn1, i = j = 0; pn2; pn2 = pn2->pn_next, i++) {
         /* The parser already rejected end-tags with attributes. */
-        JS_ASSERT(tt != TOK_XMLETAGO || i == 0);
+        JS_ASSERT(kind != PNK_XMLETAGO || i == 0);
         switch (pn2->getKind()) {
-          case TOK_XMLATTR:
+          case PNK_XMLATTR:
             if (!accum)
                 goto cantfold;
             /* FALL THROUGH */
-          case TOK_XMLNAME:
-          case TOK_XMLSPACE:
-          case TOK_XMLTEXT:
-          case TOK_STRING:
+          case PNK_XMLNAME:
+          case PNK_XMLSPACE:
+          case PNK_XMLTEXT:
+          case PNK_STRING:
             if (pn2->isArity(PN_LIST))
                 goto cantfold;
             str = pn2->pn_atom;
             break;
 
-          case TOK_XMLCDATA:
+          case PNK_XMLCDATA:
             str = js_MakeXMLCDATAString(cx, pn2->pn_atom);
             if (!str)
                 return JS_FALSE;
             break;
 
-          case TOK_XMLCOMMENT:
+          case PNK_XMLCOMMENT:
             str = js_MakeXMLCommentString(cx, pn2->pn_atom);
             if (!str)
                 return JS_FALSE;
             break;
 
-          case TOK_XMLPI:
+          case PNK_XMLPI:
             str = js_MakeXMLPIString(cx, pn2->pn_pitarget, pn2->pn_pidata);
             if (!str)
                 return JS_FALSE;
@@ -291,7 +282,7 @@ FoldXMLConstants(JSContext *cx, ParseNode *pn, TreeContext *tc)
           cantfold:
           default:
             JS_ASSERT(*pnp == pn1);
-            if ((tt == TOK_XMLSTAGO || tt == TOK_XMLPTAGC) &&
+            if ((kind == PNK_XMLSTAGO || kind == PNK_XMLPTAGC) &&
                 (i & 1) ^ (j & 1)) {
 #ifdef DEBUG_brendanXXX
                 printf("1: %d, %d => ", i, j);
@@ -306,7 +297,7 @@ FoldXMLConstants(JSContext *cx, ParseNode *pn, TreeContext *tc)
                     pn1 = tc->freeTree(pn1);
                     --pn->pn_count;
                 }
-                pn1->setKind(TOK_XMLTEXT);
+                pn1->setKind(PNK_XMLTEXT);
                 pn1->setOp(JSOP_STRING);
                 pn1->setArity(PN_NULLARY);
                 pn1->pn_atom = js_AtomizeString(cx, accum);
@@ -324,7 +315,7 @@ FoldXMLConstants(JSContext *cx, ParseNode *pn, TreeContext *tc)
         if (accum) {
             {
                 AutoStringRooter tvr(cx, accum);
-                str = ((tt == TOK_XMLSTAGO || tt == TOK_XMLPTAGC) && i != 0)
+                str = ((kind == PNK_XMLSTAGO || kind == PNK_XMLPTAGC) && i != 0)
                       ? js_AddAttributePart(cx, i & 1, accum, str)
                       : js_ConcatStrings(cx, accum, str);
             }
@@ -343,9 +334,9 @@ FoldXMLConstants(JSContext *cx, ParseNode *pn, TreeContext *tc)
     if (accum) {
         str = NULL;
         if ((pn->pn_xflags & PNX_CANTFOLD) == 0) {
-            if (tt == TOK_XMLPTAGC)
+            if (kind == PNK_XMLPTAGC)
                 str = cx->runtime->atomState.ptagcAtom;
-            else if (tt == TOK_XMLSTAGO || tt == TOK_XMLETAGO)
+            else if (kind == PNK_XMLSTAGO || kind == PNK_XMLETAGO)
                 str = cx->runtime->atomState.tagcAtom;
         }
         if (str) {
@@ -359,7 +350,7 @@ FoldXMLConstants(JSContext *cx, ParseNode *pn, TreeContext *tc)
             pn1 = tc->freeTree(pn1);
             --pn->pn_count;
         }
-        pn1->setKind(TOK_XMLTEXT);
+        pn1->setKind(PNK_XMLTEXT);
         pn1->setOp(JSOP_STRING);
         pn1->setArity(PN_NULLARY);
         pn1->pn_atom = js_AtomizeString(cx, accum);
@@ -374,13 +365,13 @@ FoldXMLConstants(JSContext *cx, ParseNode *pn, TreeContext *tc)
          * Only one node under pn, and it has been folded: move pn1 onto pn
          * unless pn is an XML root (in which case we need it to tell the code
          * generator to emit a JSOP_TOXML or JSOP_TOXMLLIST op).  If pn is an
-         * XML root *and* it's a point-tag, rewrite it to TOK_XMLELEM to avoid
+         * XML root *and* it's a point-tag, rewrite it to PNK_XMLELEM to avoid
          * extra "<" and "/>" bracketing at runtime.
          */
         if (!(pn->pn_xflags & PNX_XMLROOT)) {
             pn->become(pn1);
-        } else if (tt == TOK_XMLPTAGC) {
-            pn->setKind(TOK_XMLELEM);
+        } else if (kind == PNK_XMLPTAGC) {
+            pn->setKind(PNK_XMLELEM);
             pn->setOp(JSOP_TOXML);
         }
     }
@@ -412,7 +403,7 @@ Boolish(ParseNode *pn)
         if (pn->pn_count != 1)
             return Unknown;
         ParseNode *pn2 = pn->pn_head;
-        if (!pn2->isKind(TOK_FUNCTION))
+        if (!pn2->isKind(PNK_FUNCTION))
             return Unknown;
         if (!(pn2->pn_funbox->tcflags & TCF_GENEXP_LAMBDA))
             return Unknown;
@@ -460,11 +451,11 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
       case PN_LIST:
       {
         /* Propagate inCond through logical connectives. */
-        bool cond = inCond && (pn->isKind(TOK_OR) || pn->isKind(TOK_AND));
+        bool cond = inCond && (pn->isKind(PNK_OR) || pn->isKind(PNK_AND));
 
         /* Don't fold a parenthesized call expression. See bug 537673. */
         pn1 = pn2 = pn->pn_head;
-        if ((pn->isKind(TOK_LP) || pn->isKind(TOK_NEW)) && pn2->isInParens())
+        if ((pn->isKind(PNK_LP) || pn->isKind(PNK_NEW)) && pn2->isInParens())
             pn2 = pn2->pn_next;
 
         /* Save the list head in pn1 for later use. */
@@ -480,12 +471,12 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
         pn1 = pn->pn_kid1;
         pn2 = pn->pn_kid2;
         pn3 = pn->pn_kid3;
-        if (pn1 && !FoldConstants(cx, pn1, tc, pn->isKind(TOK_IF)))
+        if (pn1 && !FoldConstants(cx, pn1, tc, pn->isKind(PNK_IF)))
             return false;
         if (pn2) {
-            if (!FoldConstants(cx, pn2, tc, pn->isKind(TOK_FORHEAD)))
+            if (!FoldConstants(cx, pn2, tc, pn->isKind(PNK_FORHEAD)))
                 return false;
-            if (pn->isKind(TOK_FORHEAD) && pn2->isOp(JSOP_TRUE)) {
+            if (pn->isKind(PNK_FORHEAD) && pn2->isOp(JSOP_TRUE)) {
                 tc->freeTree(pn2);
                 pn->pn_kid2 = NULL;
             }
@@ -499,7 +490,7 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
         pn2 = pn->pn_right;
 
         /* Propagate inCond through logical connectives. */
-        if (pn->isKind(TOK_OR) || pn->isKind(TOK_AND)) {
+        if (pn->isKind(PNK_OR) || pn->isKind(PNK_AND)) {
             if (!FoldConstants(cx, pn1, tc, inCond))
                 return false;
             if (!FoldConstants(cx, pn2, tc, inCond))
@@ -508,9 +499,9 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
         }
 
         /* First kid may be null (for default case in switch). */
-        if (pn1 && !FoldConstants(cx, pn1, tc, pn->isKind(TOK_WHILE)))
+        if (pn1 && !FoldConstants(cx, pn1, tc, pn->isKind(PNK_WHILE)))
             return false;
-        if (!FoldConstants(cx, pn2, tc, pn->isKind(TOK_DO)))
+        if (!FoldConstants(cx, pn2, tc, pn->isKind(PNK_DO)))
             return false;
         break;
 
@@ -526,7 +517,7 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
          * null. This assumption does not hold true for other unary
          * expressions.
          */
-        if (pn->isOp(JSOP_TYPEOF) && !pn1->isKind(TOK_NAME))
+        if (pn->isOp(JSOP_TYPEOF) && !pn1->isKind(PNK_NAME))
             pn->setOp(JSOP_TYPEOFEXPR);
 
         if (pn1 && !FoldConstants(cx, pn1, tc, pn->isOp(JSOP_NOT)))
@@ -560,30 +551,28 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
     }
 
     switch (pn->getKind()) {
-      case TOK_IF:
-        if (ContainsStmt(pn2, TOK_VAR) || ContainsStmt(pn3, TOK_VAR))
+      case PNK_IF:
+        if (ContainsStmt(pn2, PNK_VAR) || ContainsStmt(pn3, PNK_VAR))
             break;
         /* FALL THROUGH */
 
-      case TOK_HOOK:
+      case PNK_HOOK:
         /* Reduce 'if (C) T; else E' into T for true C, E for false. */
         switch (pn1->getKind()) {
-          case TOK_NUMBER:
+          case PNK_NUMBER:
             if (pn1->pn_dval == 0 || JSDOUBLE_IS_NaN(pn1->pn_dval))
                 pn2 = pn3;
             break;
-          case TOK_STRING:
+          case PNK_STRING:
             if (pn1->pn_atom->length() == 0)
                 pn2 = pn3;
             break;
-          case TOK_PRIMARY:
-            if (pn1->isOp(JSOP_TRUE))
-                break;
-            if (pn1->isOp(JSOP_FALSE) || pn1->isOp(JSOP_NULL)) {
-                pn2 = pn3;
-                break;
-            }
-            /* FALL THROUGH */
+          case PNK_TRUE:
+            break;
+          case PNK_FALSE:
+          case PNK_NULL:
+            pn2 = pn3;
+            break;
           default:
             /* Early return to dodge common code that copies pn2 to pn. */
             return true;
@@ -597,15 +586,15 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
 
         if (pn2 && !pn2->isDefn())
             pn->become(pn2);
-        if (!pn2 || (pn->isKind(TOK_SEMI) && !pn->pn_kid)) {
+        if (!pn2 || (pn->isKind(PNK_SEMI) && !pn->pn_kid)) {
             /*
              * False condition and no else, or an empty then-statement was
              * moved up over pn.  Either way, make pn an empty block (not an
              * empty statement, which does not decompile, even when labeled).
-             * NB: pn must be a TOK_IF as TOK_HOOK can never have a null kid
+             * NB: pn must be a PNK_IF as PNK_HOOK can never have a null kid
              * or an empty statement for a child.
              */
-            pn->setKind(TOK_LC);
+            pn->setKind(PNK_LC);
             pn->setArity(PN_LIST);
             pn->makeEmpty();
         }
@@ -614,8 +603,8 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
             tc->freeTree(pn3);
         break;
 
-      case TOK_OR:
-      case TOK_AND:
+      case PNK_OR:
+      case PNK_AND:
         if (inCond) {
             if (pn->isArity(PN_LIST)) {
                 ParseNode **pnp = &pn->pn_head;
@@ -626,7 +615,7 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
                         pnp = &pn1->pn_next;
                         continue;
                     }
-                    if ((t == Truthy) == pn->isKind(TOK_OR)) {
+                    if ((t == Truthy) == pn->isKind(PNK_OR)) {
                         for (pn2 = pn1->pn_next; pn2; pn2 = pn3) {
                             pn3 = pn2->pn_next;
                             tc->freeTree(pn2);
@@ -635,7 +624,7 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
                         pn1->pn_next = NULL;
                         break;
                     }
-                    JS_ASSERT((t == Truthy) == pn->isKind(TOK_AND));
+                    JS_ASSERT((t == Truthy) == pn->isKind(PNK_AND));
                     if (pn->pn_count == 1)
                         break;
                     *pnp = pn1->pn_next;
@@ -659,11 +648,11 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
             } else {
                 Truthiness t = Boolish(pn1);
                 if (t != Unknown) {
-                    if ((t == Truthy) == pn->isKind(TOK_OR)) {
+                    if ((t == Truthy) == pn->isKind(PNK_OR)) {
                         tc->freeTree(pn2);
                         pn->become(pn1);
                     } else {
-                        JS_ASSERT((t == Truthy) == pn->isKind(TOK_AND));
+                        JS_ASSERT((t == Truthy) == pn->isKind(PNK_AND));
                         tc->freeTree(pn1);
                         pn->become(pn2);
                     }
@@ -672,20 +661,31 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
         }
         break;
 
-      case TOK_ASSIGN:
+      case PNK_SUBASSIGN:
+      case PNK_BITORASSIGN:
+      case PNK_BITXORASSIGN:
+      case PNK_BITANDASSIGN:
+      case PNK_LSHASSIGN:
+      case PNK_RSHASSIGN:
+      case PNK_URSHASSIGN:
+      case PNK_MULASSIGN:
+      case PNK_DIVASSIGN:
+      case PNK_MODASSIGN:
         /*
          * Compound operators such as *= should be subject to folding, in case
          * the left-hand side is constant, and so that the decompiler produces
          * the same string that you get from decompiling a script or function
-         * compiled from that same string.  As with +, += is special.
+         * compiled from that same string.  += is special and so must be
+         * handled below.
          */
-        if (pn->isOp(JSOP_NOP))
-            break;
-        if (!pn->isOp(JSOP_ADD))
-            goto do_binary_op;
-        /* FALL THROUGH */
+        goto do_binary_op;
 
-      case TOK_PLUS:
+      case PNK_ADDASSIGN:
+        JS_ASSERT(pn->isOp(JSOP_ADD));
+        /* FALL THROUGH */
+      case PNK_PLUS:
+        if (pn->isArity(PN_UNARY))
+            goto unary_plusminus;
         if (pn->isArity(PN_LIST)) {
             /*
              * Any string literal term with all others number or string means
@@ -701,10 +701,10 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
             /* Ok, we're concatenating: convert non-string constant operands. */
             size_t length = 0;
             for (pn2 = pn1; pn2; pn2 = pn2->pn_next) {
-                if (!FoldType(cx, pn2, TOK_STRING))
+                if (!FoldType(cx, pn2, PNK_STRING))
                     return false;
                 /* XXX fold only if all operands convert to string */
-                if (!pn2->isKind(TOK_STRING))
+                if (!pn2->isKind(PNK_STRING))
                     return true;
                 length += pn2->pn_atom->length();
             }
@@ -733,7 +733,7 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
             pn->pn_atom = js_AtomizeString(cx, str);
             if (!pn->pn_atom)
                 return false;
-            pn->setKind(TOK_STRING);
+            pn->setKind(PNK_STRING);
             pn->setOp(JSOP_STRING);
             pn->setArity(PN_NULLARY);
             break;
@@ -741,12 +741,12 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
 
         /* Handle a binary string concatenation. */
         JS_ASSERT(pn->isArity(PN_BINARY));
-        if (pn1->isKind(TOK_STRING) || pn2->isKind(TOK_STRING)) {
+        if (pn1->isKind(PNK_STRING) || pn2->isKind(PNK_STRING)) {
             JSString *left, *right, *str;
 
-            if (!FoldType(cx, !pn1->isKind(TOK_STRING) ? pn1 : pn2, TOK_STRING))
+            if (!FoldType(cx, !pn1->isKind(PNK_STRING) ? pn1 : pn2, PNK_STRING))
                 return false;
-            if (!pn1->isKind(TOK_STRING) || !pn2->isKind(TOK_STRING))
+            if (!pn1->isKind(PNK_STRING) || !pn2->isKind(PNK_STRING))
                 return true;
             left = pn1->pn_atom;
             right = pn2->pn_atom;
@@ -756,7 +756,7 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
             pn->pn_atom = js_AtomizeString(cx, str);
             if (!pn->pn_atom)
                 return false;
-            pn->setKind(TOK_STRING);
+            pn->setKind(PNK_STRING);
             pn->setOp(JSOP_STRING);
             pn->setArity(PN_NULLARY);
             tc->freeTree(pn1);
@@ -767,20 +767,26 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
         /* Can't concatenate string literals, let's try numbers. */
         goto do_binary_op;
 
-      case TOK_STAR:
-      case TOK_SHOP:
-      case TOK_MINUS:
-      case TOK_DIVOP:
+      case PNK_MINUS:
+        if (pn->isArity(PN_UNARY))
+            goto unary_plusminus;
+        /* FALL THROUGH */
+      case PNK_STAR:
+      case PNK_LSH:
+      case PNK_RSH:
+      case PNK_URSH:
+      case PNK_DIV:
+      case PNK_MOD:
       do_binary_op:
         if (pn->isArity(PN_LIST)) {
             JS_ASSERT(pn->pn_count > 2);
             for (pn2 = pn1; pn2; pn2 = pn2->pn_next) {
-                if (!FoldType(cx, pn2, TOK_NUMBER))
+                if (!FoldType(cx, pn2, PNK_NUMBER))
                     return false;
             }
             for (pn2 = pn1; pn2; pn2 = pn2->pn_next) {
                 /* XXX fold only if all operands convert to number */
-                if (!pn2->isKind(TOK_NUMBER))
+                if (!pn2->isKind(PNK_NUMBER))
                     break;
             }
             if (!pn2) {
@@ -798,19 +804,23 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
             }
         } else {
             JS_ASSERT(pn->isArity(PN_BINARY));
-            if (!FoldType(cx, pn1, TOK_NUMBER) ||
-                !FoldType(cx, pn2, TOK_NUMBER)) {
+            if (!FoldType(cx, pn1, PNK_NUMBER) ||
+                !FoldType(cx, pn2, PNK_NUMBER)) {
                 return false;
             }
-            if (pn1->isKind(TOK_NUMBER) && pn2->isKind(TOK_NUMBER)) {
+            if (pn1->isKind(PNK_NUMBER) && pn2->isKind(PNK_NUMBER)) {
                 if (!FoldBinaryNumeric(cx, pn->getOp(), pn1, pn2, pn, tc))
                     return false;
             }
         }
         break;
 
-      case TOK_UNARYOP:
-        if (pn1->isKind(TOK_NUMBER)) {
+      case PNK_TYPEOF:
+      case PNK_VOID:
+      case PNK_NOT:
+      case PNK_BITNOT:
+      unary_plusminus:
+        if (pn1->isKind(PNK_NUMBER)) {
             jsdouble d;
 
             /* Operate on one numeric constant. */
@@ -828,45 +838,56 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
                 break;
 
               case JSOP_NOT:
-                pn->setKind(TOK_PRIMARY);
-                pn->setOp((d == 0 || JSDOUBLE_IS_NaN(d)) ? JSOP_TRUE : JSOP_FALSE);
+                if (d == 0 || JSDOUBLE_IS_NaN(d)) {
+                    pn->setKind(PNK_TRUE);
+                    pn->setOp(JSOP_TRUE);
+                } else {
+                    pn->setKind(PNK_FALSE);
+                    pn->setOp(JSOP_FALSE);
+                }
                 pn->setArity(PN_NULLARY);
                 /* FALL THROUGH */
 
               default:
-                /* Return early to dodge the common TOK_NUMBER code. */
+                /* Return early to dodge the common PNK_NUMBER code. */
                 return true;
             }
-            pn->setKind(TOK_NUMBER);
+            pn->setKind(PNK_NUMBER);
             pn->setOp(JSOP_DOUBLE);
             pn->setArity(PN_NULLARY);
             pn->pn_dval = d;
             tc->freeTree(pn1);
-        } else if (pn1->isKind(TOK_PRIMARY)) {
-            if (pn->isOp(JSOP_NOT) && (pn1->isOp(JSOP_TRUE) || pn1->isOp(JSOP_FALSE))) {
+        } else if (pn1->isKind(PNK_TRUE) || pn1->isKind(PNK_FALSE)) {
+            if (pn->isOp(JSOP_NOT)) {
                 pn->become(pn1);
-                pn->setOp(pn->isOp(JSOP_TRUE) ? JSOP_FALSE : JSOP_TRUE);
+                if (pn->isKind(PNK_TRUE)) {
+                    pn->setKind(PNK_FALSE);
+                    pn->setOp(JSOP_FALSE);
+                } else {
+                    pn->setKind(PNK_TRUE);
+                    pn->setOp(JSOP_TRUE);
+                }
                 tc->freeTree(pn1);
             }
         }
         break;
 
 #if JS_HAS_XML_SUPPORT
-      case TOK_XMLELEM:
-      case TOK_XMLLIST:
-      case TOK_XMLPTAGC:
-      case TOK_XMLSTAGO:
-      case TOK_XMLETAGO:
-      case TOK_XMLNAME:
+      case PNK_XMLELEM:
+      case PNK_XMLLIST:
+      case PNK_XMLPTAGC:
+      case PNK_XMLSTAGO:
+      case PNK_XMLETAGO:
+      case PNK_XMLNAME:
         if (pn->isArity(PN_LIST)) {
-            JS_ASSERT(pn->isKind(TOK_XMLLIST) || pn->pn_count != 0);
+            JS_ASSERT(pn->isKind(PNK_XMLLIST) || pn->pn_count != 0);
             if (!FoldXMLConstants(cx, pn, tc))
                 return false;
         }
         break;
 
-      case TOK_AT:
-        if (pn1->isKind(TOK_XMLNAME)) {
+      case PNK_AT:
+        if (pn1->isKind(PNK_XMLNAME)) {
             Value v = StringValue(pn1->pn_atom);
             if (!js_ToAttributeName(cx, &v))
                 return false;
@@ -876,7 +897,7 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
             if (!xmlbox)
                 return false;
 
-            pn->setKind(TOK_XMLNAME);
+            pn->setKind(PNK_XMLNAME);
             pn->setOp(JSOP_OBJECT);
             pn->setArity(PN_NULLARY);
             pn->pn_objbox = xmlbox;
@@ -898,8 +919,13 @@ js::FoldConstants(JSContext *cx, ParseNode *pn, TreeContext *tc, bool inCond)
              * statements of the form 'this.foo = M;', which we never fold, so we're okay.
              */
             tc->parser->allocator.prepareNodeForMutation(pn);
-            pn->setKind(TOK_PRIMARY);
-            pn->setOp(t == Truthy ? JSOP_TRUE : JSOP_FALSE);
+            if (t == Truthy) {
+                pn->setKind(PNK_TRUE);
+                pn->setOp(JSOP_TRUE);
+            } else {
+                pn->setKind(PNK_FALSE);
+                pn->setOp(JSOP_FALSE);
+            }
             pn->setArity(PN_NULLARY);
         }
     }
diff --git a/js/src/frontend/ParseNode-inl.h b/js/src/frontend/ParseNode-inl.h
index b514b2550a05..4de49569f3b4 100644
--- a/js/src/frontend/ParseNode-inl.h
+++ b/js/src/frontend/ParseNode-inl.h
@@ -50,20 +50,14 @@ inline bool
 ParseNode::isConstant()
 {
     switch (pn_type) {
-      case TOK_NUMBER:
-      case TOK_STRING:
+      case PNK_NUMBER:
+      case PNK_STRING:
+      case PNK_NULL:
+      case PNK_FALSE:
+      case PNK_TRUE:
         return true;
-      case TOK_PRIMARY:
-        switch (pn_op) {
-          case JSOP_NULL:
-          case JSOP_FALSE:
-          case JSOP_TRUE:
-            return true;
-          default:
-            return false;
-        }
-      case TOK_RB:
-      case TOK_RC:
+      case PNK_RB:
+      case PNK_RC:
         return isOp(JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST);
       default:
         return false;
diff --git a/js/src/frontend/ParseNode.cpp b/js/src/frontend/ParseNode.cpp
index e89b494dc5e5..ada45e00cedc 100644
--- a/js/src/frontend/ParseNode.cpp
+++ b/js/src/frontend/ParseNode.cpp
@@ -84,7 +84,7 @@ ParseNode::become(ParseNode *pn2)
      * If any pointers are pointing to pn2, change them to point to this
      * instead, since pn2 will be cleared and probably recycled.
      */
-    if (this->isKind(TOK_FUNCTION) && isArity(PN_FUNC)) {
+    if (this->isKind(PNK_FUNCTION) && isArity(PN_FUNC)) {
         /* Function node: fix up the pn_funbox->node back-pointer. */
         JS_ASSERT(pn_funbox->node == pn2);
         pn_funbox->node = this;
@@ -101,7 +101,7 @@ ParseNode::become(ParseNode *pn2)
 void
 ParseNode::clear()
 {
-    pn_type = TOK_EOF;
+    pn_type = PNK_LIMIT;
     setOp(JSOP_NOP);
     pn_used = pn_defn = false;
     pn_arity = PN_NULLARY;
@@ -384,15 +384,52 @@ ParseNodeAllocator::allocNode()
 /* used only by static create methods of subclasses */
 
 ParseNode *
-ParseNode::create(ParseNodeArity arity, TreeContext *tc)
+ParseNode::create(ParseNodeKind kind, ParseNodeArity arity, TreeContext *tc)
 {
     Parser *parser = tc->parser;
     const Token &tok = parser->tokenStream.currentToken();
-    return parser->new_<ParseNode>(tok.type, JSOP_NOP, arity, tok.pos);
+    return parser->new_<ParseNode>(kind, JSOP_NOP, arity, tok.pos);
 }
 
 ParseNode *
-ParseNode::newBinaryOrAppend(TokenKind tt, JSOp op, ParseNode *left, ParseNode *right,
+ParseNode::append(ParseNodeKind kind, JSOp op, ParseNode *left, ParseNode *right)
+{
+    if (!left || !right)
+        return NULL;
+
+    JS_ASSERT(left->isKind(kind) && left->isOp(op) && (js_CodeSpec[op].format & JOF_LEFTASSOC));
+
+    if (left->pn_arity != PN_LIST) {
+        ParseNode *pn1 = left->pn_left, *pn2 = left->pn_right;
+        left->setArity(PN_LIST);
+        left->pn_parens = false;
+        left->initList(pn1);
+        left->append(pn2);
+        if (kind == PNK_PLUS) {
+            if (pn1->isKind(PNK_STRING))
+                left->pn_xflags |= PNX_STRCAT;
+            else if (!pn1->isKind(PNK_NUMBER))
+                left->pn_xflags |= PNX_CANTFOLD;
+            if (pn2->isKind(PNK_STRING))
+                left->pn_xflags |= PNX_STRCAT;
+            else if (!pn2->isKind(PNK_NUMBER))
+                left->pn_xflags |= PNX_CANTFOLD;
+        }
+    }
+    left->append(right);
+    left->pn_pos.end = right->pn_pos.end;
+    if (kind == PNK_PLUS) {
+        if (right->isKind(PNK_STRING))
+            left->pn_xflags |= PNX_STRCAT;
+        else if (!right->isKind(PNK_NUMBER))
+            left->pn_xflags |= PNX_CANTFOLD;
+    }
+
+    return left;
+}
+
+ParseNode *
+ParseNode::newBinaryOrAppend(ParseNodeKind kind, JSOp op, ParseNode *left, ParseNode *right,
                              TreeContext *tc)
 {
     if (!left || !right)
@@ -402,34 +439,8 @@ ParseNode::newBinaryOrAppend(TokenKind tt, JSOp op, ParseNode *left, ParseNode *
      * Flatten a left-associative (left-heavy) tree of a given operator into
      * a list, to reduce js_FoldConstants and js_EmitTree recursion.
      */
-    if (left->isKind(tt) && left->isOp(op) && (js_CodeSpec[op].format & JOF_LEFTASSOC)) {
-        if (left->pn_arity != PN_LIST) {
-            ParseNode *pn1 = left->pn_left, *pn2 = left->pn_right;
-            left->setArity(PN_LIST);
-            left->pn_parens = false;
-            left->initList(pn1);
-            left->append(pn2);
-            if (tt == TOK_PLUS) {
-                if (pn1->isKind(TOK_STRING))
-                    left->pn_xflags |= PNX_STRCAT;
-                else if (!pn1->isKind(TOK_NUMBER))
-                    left->pn_xflags |= PNX_CANTFOLD;
-                if (pn2->isKind(TOK_STRING))
-                    left->pn_xflags |= PNX_STRCAT;
-                else if (!pn2->isKind(TOK_NUMBER))
-                    left->pn_xflags |= PNX_CANTFOLD;
-            }
-        }
-        left->append(right);
-        left->pn_pos.end = right->pn_pos.end;
-        if (tt == TOK_PLUS) {
-            if (right->isKind(TOK_STRING))
-                left->pn_xflags |= PNX_STRCAT;
-            else if (!right->isKind(TOK_NUMBER))
-                left->pn_xflags |= PNX_CANTFOLD;
-        }
-        return left;
-    }
+    if (left->isKind(kind) && left->isOp(op) && (js_CodeSpec[op].format & JOF_LEFTASSOC))
+        return append(kind, op, left, right);
 
     /*
      * Fold constant addition immediately, to conserve node space and, what's
@@ -438,9 +449,9 @@ ParseNode::newBinaryOrAppend(TokenKind tt, JSOp op, ParseNode *left, ParseNode *
      * generated for expressions such as 1 + 2 + "pt" (which should evaluate
      * to "3pt", not "12pt").
      */
-    if (tt == TOK_PLUS &&
-        left->isKind(TOK_NUMBER) &&
-        right->isKind(TOK_NUMBER) &&
+    if (kind == PNK_PLUS &&
+        left->isKind(PNK_NUMBER) &&
+        right->isKind(PNK_NUMBER) &&
         tc->parser->foldConstants)
     {
         left->pn_dval += right->pn_dval;
@@ -449,13 +460,13 @@ ParseNode::newBinaryOrAppend(TokenKind tt, JSOp op, ParseNode *left, ParseNode *
         return left;
     }
 
-    return tc->parser->new_<BinaryNode>(tt, op, left, right);
+    return tc->parser->new_<BinaryNode>(kind, op, left, right);
 }
 
 NameNode *
-NameNode::create(JSAtom *atom, TreeContext *tc)
+NameNode::create(ParseNodeKind kind, JSAtom *atom, TreeContext *tc)
 {
-    ParseNode *pn = ParseNode::create(PN_NAME, tc);
+    ParseNode *pn = ParseNode::create(kind, PN_NAME, tc);
     if (pn) {
         pn->pn_atom = atom;
         ((NameNode *)pn)->initCommon(tc);
@@ -608,13 +619,13 @@ js::CloneLeftHandSide(ParseNode *opn, TreeContext *tc)
 
 #if JS_HAS_DESTRUCTURING
     if (opn->isArity(PN_LIST)) {
-        JS_ASSERT(opn->isKind(TOK_RB) || opn->isKind(TOK_RC));
+        JS_ASSERT(opn->isKind(PNK_RB) || opn->isKind(PNK_RC));
         pn->makeEmpty();
         for (ParseNode *opn2 = opn->pn_head; opn2; opn2 = opn2->pn_next) {
             ParseNode *pn2;
-            if (opn->isKind(TOK_RC)) {
+            if (opn->isKind(PNK_RC)) {
                 JS_ASSERT(opn2->isArity(PN_BINARY));
-                JS_ASSERT(opn2->isKind(TOK_COLON));
+                JS_ASSERT(opn2->isKind(PNK_COLON));
 
                 ParseNode *tag = CloneParseTree(opn2->pn_left, tc);
                 if (!tag)
@@ -623,9 +634,9 @@ js::CloneLeftHandSide(ParseNode *opn, TreeContext *tc)
                 if (!target)
                     return NULL;
 
-                pn2 = tc->parser->new_<BinaryNode>(TOK_COLON, JSOP_INITPROP, opn2->pn_pos, tag, target);
+                pn2 = tc->parser->new_<BinaryNode>(PNK_COLON, JSOP_INITPROP, opn2->pn_pos, tag, target);
             } else if (opn2->isArity(PN_NULLARY)) {
-                JS_ASSERT(opn2->isKind(TOK_COMMA));
+                JS_ASSERT(opn2->isKind(PNK_COMMA));
                 pn2 = CloneParseTree(opn2, tc);
             } else {
                 pn2 = CloneLeftHandSide(opn2, tc);
@@ -641,7 +652,7 @@ js::CloneLeftHandSide(ParseNode *opn, TreeContext *tc)
 #endif
 
     JS_ASSERT(opn->isArity(PN_NAME));
-    JS_ASSERT(opn->isKind(TOK_NAME));
+    JS_ASSERT(opn->isKind(PNK_NAME));
 
     /* If opn is a definition or use, make pn a use. */
     pn->pn_u.name = opn->pn_u.name;
diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h
index 2e54112fba43..57a9629f42e0 100644
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@@ -53,81 +53,220 @@ namespace js {
  * not a concrete syntax tree in all respects (for example, || and && are left
  * associative, but (A && B && C) translates into the right-associated tree
  * <A && <B && C>> so that code generation can emit a left-associative branch
- * around <B && C> when A is false).  Nodes are labeled by token type, with a
- * JSOp secondary label when needed:
+ * around <B && C> when A is false).  Nodes are labeled by kind, with a
+ * secondary JSOp label when needed.
  *
+ * The long comment after this enum block describes the kinds in detail.
+ */
+enum ParseNodeKind {
+    PNK_SEMI,
+    PNK_COMMA,
+    PNK_HOOK,
+    PNK_COLON,
+    PNK_OR,
+    PNK_AND,
+    PNK_BITOR,
+    PNK_BITXOR,
+    PNK_BITAND,
+    PNK_PLUS,
+    PNK_MINUS,
+    PNK_STAR,
+    PNK_DIV,
+    PNK_MOD,
+    PNK_INC,
+    PNK_DEC,
+    PNK_DOT,
+    PNK_LB,
+    PNK_RB,
+    PNK_LC,
+    PNK_RC,
+    PNK_LP,
+    PNK_RP,
+    PNK_NAME,
+    PNK_NUMBER,
+    PNK_STRING,
+    PNK_REGEXP,
+    PNK_TRUE,
+    PNK_FALSE,
+    PNK_NULL,
+    PNK_THIS,
+    PNK_FUNCTION,
+    PNK_IF,
+    PNK_ELSE,
+    PNK_SWITCH,
+    PNK_CASE,
+    PNK_DEFAULT,
+    PNK_WHILE,
+    PNK_DO,
+    PNK_FOR,
+    PNK_BREAK,
+    PNK_CONTINUE,
+    PNK_IN,
+    PNK_VAR,
+    PNK_WITH,
+    PNK_RETURN,
+    PNK_NEW,
+    PNK_DELETE,
+    PNK_DEFSHARP,
+    PNK_USESHARP,
+    PNK_TRY,
+    PNK_CATCH,
+    PNK_CATCHLIST,
+    PNK_FINALLY,
+    PNK_THROW,
+    PNK_INSTANCEOF,
+    PNK_DEBUGGER,
+    PNK_XMLSTAGO,
+    PNK_XMLETAGO,
+    PNK_XMLPTAGC,
+    PNK_XMLTAGC,
+    PNK_XMLNAME,
+    PNK_XMLATTR,
+    PNK_XMLSPACE,
+    PNK_XMLTEXT,
+    PNK_XMLCOMMENT,
+    PNK_XMLCDATA,
+    PNK_XMLPI,
+    PNK_XMLUNARY,
+    PNK_AT,
+    PNK_DBLCOLON,
+    PNK_ANYNAME,
+    PNK_DBLDOT,
+    PNK_FILTER,
+    PNK_XMLELEM,
+    PNK_XMLLIST,
+    PNK_YIELD,
+    PNK_ARRAYCOMP,
+    PNK_ARRAYPUSH,
+    PNK_LEXICALSCOPE,
+    PNK_LET,
+    PNK_SEQ,
+    PNK_FORHEAD,
+    PNK_ARGSBODY,
+    PNK_UPVARS,
+
+    /*
+     * The following parse node kinds occupy contiguous ranges to enable easy
+     * range-testing.
+     */
+
+    /* Equality operators. */
+    PNK_STRICTEQ,
+    PNK_EQ,
+    PNK_STRICTNE,
+    PNK_NE,
+
+    /* Unary operators. */
+    PNK_TYPEOF,
+    PNK_VOID,
+    PNK_NOT,
+    PNK_BITNOT,
+
+    /* Relational operators (< <= > >=). */
+    PNK_LT,
+    PNK_LE,
+    PNK_GT,
+    PNK_GE,
+
+    /* Shift operators (<< >> >>>). */
+    PNK_LSH,
+    PNK_RSH,
+    PNK_URSH,
+
+    /* Assignment operators (= += -= etc.). */
+    PNK_ASSIGN,
+    PNK_ASSIGNMENT_START = PNK_ASSIGN,
+    PNK_ADDASSIGN,
+    PNK_SUBASSIGN,
+    PNK_BITORASSIGN,
+    PNK_BITXORASSIGN,
+    PNK_BITANDASSIGN,
+    PNK_LSHASSIGN,
+    PNK_RSHASSIGN,
+    PNK_URSHASSIGN,
+    PNK_MULASSIGN,
+    PNK_DIVASSIGN,
+    PNK_MODASSIGN,
+    PNK_ASSIGNMENT_LAST = PNK_MODASSIGN,
+
+    PNK_LIMIT /* domain size */
+};
+
+/*
  * Label        Variant     Members
  * -----        -------     -------
  * <Definitions>
- * TOK_FUNCTION name        pn_funbox: ptr to js::FunctionBox holding function
+ * PNK_FUNCTION name        pn_funbox: ptr to js::FunctionBox holding function
  *                            object containing arg and var properties.  We
  *                            create the function object at parse (not emit)
  *                            time to specialize arg and var bytecodes early.
- *                          pn_body: TOK_UPVARS if the function's source body
- *                                   depends on outer names, else TOK_ARGSBODY
- *                                   if formal parameters, else TOK_LC node for
- *                                   function body statements, else TOK_RETURN
- *                                   for expression closure, else TOK_SEQ for
+ *                          pn_body: PNK_UPVARS if the function's source body
+ *                                   depends on outer names, else PNK_ARGSBODY
+ *                                   if formal parameters, else PNK_LC node for
+ *                                   function body statements, else PNK_RETURN
+ *                                   for expression closure, else PNK_SEQ for
  *                                   expression closure with destructured
  *                                   formal parameters
  *                          pn_cookie: static level and var index for function
  *                          pn_dflags: PND_* definition/use flags (see below)
  *                          pn_blockid: block id number
- * TOK_ARGSBODY list        list of formal parameters followed by TOK_LC node
+ * PNK_ARGSBODY list        list of formal parameters followed by PNK_LC node
  *                            for function body statements as final element
  *                          pn_count: 1 + number of formal parameters
- * TOK_UPVARS   nameset     pn_names: lexical dependencies (js::Definitions)
+ * PNK_UPVARS   nameset     pn_names: lexical dependencies (js::Definitions)
  *                            defined in enclosing scopes, or ultimately not
  *                            defined (free variables, either global property
  *                            references or reference errors).
- *                          pn_tree: TOK_ARGSBODY or TOK_LC node
+ *                          pn_tree: PNK_ARGSBODY or PNK_LC node
  *
  * <Statements>
- * TOK_LC       list        pn_head: list of pn_count statements
- * TOK_IF       ternary     pn_kid1: cond, pn_kid2: then, pn_kid3: else or null.
+ * PNK_LC       list        pn_head: list of pn_count statements
+ * PNK_IF       ternary     pn_kid1: cond, pn_kid2: then, pn_kid3: else or null.
  *                            In body of a comprehension or desugared generator
- *                            expression, pn_kid2 is TOK_YIELD, TOK_ARRAYPUSH,
- *                            or (if the push was optimized away) empty TOK_LC.
- * TOK_SWITCH   binary      pn_left: discriminant
- *                          pn_right: list of TOK_CASE nodes, with at most one
- *                            TOK_DEFAULT node, or if there are let bindings
+ *                            expression, pn_kid2 is PNK_YIELD, PNK_ARRAYPUSH,
+ *                            or (if the push was optimized away) empty PNK_LC.
+ * PNK_SWITCH   binary      pn_left: discriminant
+ *                          pn_right: list of PNK_CASE nodes, with at most one
+ *                            PNK_DEFAULT node, or if there are let bindings
  *                            in the top level of the switch body's cases, a
- *                            TOK_LEXICALSCOPE node that contains the list of
- *                            TOK_CASE nodes.
- * TOK_CASE,    binary      pn_left: case expr or null if TOK_DEFAULT
- * TOK_DEFAULT              pn_right: TOK_LC node for this case's statements
+ *                            PNK_LEXICALSCOPE node that contains the list of
+ *                            PNK_CASE nodes.
+ * PNK_CASE,    binary      pn_left: case expr
+ *                          pn_right: PNK_LC node for this case's statements
+ * PNK_DEFAULT  binary      pn_left: null
+ *                          pn_right: PNK_LC node for this default's statements
  *                          pn_val: constant value if lookup or table switch
- * TOK_WHILE    binary      pn_left: cond, pn_right: body
- * TOK_DO       binary      pn_left: body, pn_right: cond
- * TOK_FOR      binary      pn_left: either
- *                            for/in loop: a ternary TOK_IN node with
- *                              pn_kid1:  TOK_VAR to left of 'in', or NULL
+ * PNK_WHILE    binary      pn_left: cond, pn_right: body
+ * PNK_DO       binary      pn_left: body, pn_right: cond
+ * PNK_FOR      binary      pn_left: either
+ *                            for/in loop: a ternary PNK_IN node with
+ *                              pn_kid1:  PNK_VAR to left of 'in', or NULL
  *                                its pn_xflags may have PNX_POPVAR
  *                                and PNX_FORINVAR bits set
- *                              pn_kid2: TOK_NAME or destructuring expr
+ *                              pn_kid2: PNK_NAME or destructuring expr
  *                                to left of 'in'; if pn_kid1, then this
  *                                is a clone of pn_kid1->pn_head
  *                              pn_kid3: object expr to right of 'in'
- *                            for(;;) loop: a ternary TOK_RESERVED node with
+ *                            for(;;) loop: a ternary PNK_FORHEAD node with
  *                              pn_kid1:  init expr before first ';'
  *                              pn_kid2:  cond expr before second ';'
  *                              pn_kid3:  update expr after second ';'
  *                              any kid may be null
  *                          pn_right: body
- * TOK_THROW    unary       pn_op: JSOP_THROW, pn_kid: exception
- * TOK_TRY      ternary     pn_kid1: try block
- *                          pn_kid2: null or TOK_RESERVED list of
- *                          TOK_LEXICALSCOPE nodes, each with pn_expr pointing
- *                          to a TOK_CATCH node
+ * PNK_THROW    unary       pn_op: JSOP_THROW, pn_kid: exception
+ * PNK_TRY      ternary     pn_kid1: try block
+ *                          pn_kid2: null or PNK_CATCHLIST list of
+ *                          PNK_LEXICALSCOPE nodes, each with pn_expr pointing
+ *                          to a PNK_CATCH node
  *                          pn_kid3: null or finally block
- * TOK_CATCH    ternary     pn_kid1: TOK_NAME, TOK_RB, or TOK_RC catch var node
- *                                   (TOK_RB or TOK_RC if destructuring)
+ * PNK_CATCH    ternary     pn_kid1: PNK_NAME, PNK_RB, or PNK_RC catch var node
+ *                                   (PNK_RB or PNK_RC if destructuring)
  *                          pn_kid2: null or the catch guard expression
  *                          pn_kid3: catch block statements
- * TOK_BREAK    name        pn_atom: label or null
- * TOK_CONTINUE name        pn_atom: label or null
- * TOK_WITH     binary      pn_left: head expr, pn_right: body
- * TOK_VAR      list        pn_head: list of TOK_NAME or TOK_ASSIGN nodes
+ * PNK_BREAK    name        pn_atom: label or null
+ * PNK_CONTINUE name        pn_atom: label or null
+ * PNK_WITH     binary      pn_left: head expr, pn_right: body
+ * PNK_VAR      list        pn_head: list of PNK_NAME or PNK_ASSIGN nodes
  *                                   each name node has either
  *                                     pn_used: false
  *                                     pn_atom: variable name
@@ -137,121 +276,145 @@ namespace js {
  *                                     pn_atom: variable name
  *                                     pn_lexdef: def node
  *                                   each assignment node has
- *                                     pn_left: TOK_NAME with pn_used true and
+ *                                     pn_left: PNK_NAME with pn_used true and
  *                                              pn_lexdef (NOT pn_expr) set
  *                                     pn_right: initializer
- * TOK_RETURN   unary       pn_kid: return expr or null
- * TOK_SEMI     unary       pn_kid: expr or null statement
+ * PNK_RETURN   unary       pn_kid: return expr or null
+ * PNK_SEMI     unary       pn_kid: expr or null statement
  *                          pn_prologue: true if Directive Prologue member
  *                              in original source, not introduced via
  *                              constant folding or other tree rewriting
- * TOK_COLON    name        pn_atom: label, pn_expr: labeled statement
+ * PNK_COLON    name        pn_atom: label, pn_expr: labeled statement
  *
  * <Expressions>
  * All left-associated binary trees of the same type are optimized into lists
  * to avoid recursion when processing expression chains.
- * TOK_COMMA    list        pn_head: list of pn_count comma-separated exprs
- * TOK_ASSIGN   binary      pn_left: lvalue, pn_right: rvalue
- *                          pn_op: JSOP_ADD for +=, etc.
- * TOK_HOOK     ternary     pn_kid1: cond, pn_kid2: then, pn_kid3: else
- * TOK_OR       binary      pn_left: first in || chain, pn_right: rest of chain
- * TOK_AND      binary      pn_left: first in && chain, pn_right: rest of chain
- * TOK_BITOR    binary      pn_left: left-assoc | expr, pn_right: ^ expr
- * TOK_BITXOR   binary      pn_left: left-assoc ^ expr, pn_right: & expr
- * TOK_BITAND   binary      pn_left: left-assoc & expr, pn_right: EQ expr
- * TOK_EQOP     binary      pn_left: left-assoc EQ expr, pn_right: REL expr
- *                          pn_op: JSOP_EQ, JSOP_NE,
- *                                 JSOP_STRICTEQ, JSOP_STRICTNE
- * TOK_RELOP    binary      pn_left: left-assoc REL expr, pn_right: SH expr
- *                          pn_op: JSOP_LT, JSOP_LE, JSOP_GT, JSOP_GE
- * TOK_SHOP     binary      pn_left: left-assoc SH expr, pn_right: ADD expr
- *                          pn_op: JSOP_LSH, JSOP_RSH, JSOP_URSH
- * TOK_PLUS,    binary      pn_left: left-assoc ADD expr, pn_right: MUL expr
- *                          pn_xflags: if a left-associated binary TOK_PLUS
+ * PNK_COMMA    list        pn_head: list of pn_count comma-separated exprs
+ * PNK_ASSIGN   binary      pn_left: lvalue, pn_right: rvalue
+ * PNK_ADDASSIGN,   binary  pn_left: lvalue, pn_right: rvalue
+ * PNK_SUBASSIGN,           pn_op: JSOP_ADD for +=, etc.
+ * PNK_BITORASSIGN,
+ * PNK_BITXORASSIGN,
+ * PNK_BITANDASSIGN,
+ * PNK_LSHASSIGN,
+ * PNK_RSHASSIGN,
+ * PNK_URSHASSIGN,
+ * PNK_MULASSIGN,
+ * PNK_DIVASSIGN,
+ * PNK_MODASSIGN
+ * PNK_HOOK     ternary     pn_kid1: cond, pn_kid2: then, pn_kid3: else
+ * PNK_OR       binary      pn_left: first in || chain, pn_right: rest of chain
+ * PNK_AND      binary      pn_left: first in && chain, pn_right: rest of chain
+ * PNK_BITOR    binary      pn_left: left-assoc | expr, pn_right: ^ expr
+ * PNK_BITXOR   binary      pn_left: left-assoc ^ expr, pn_right: & expr
+ * PNK_BITAND   binary      pn_left: left-assoc & expr, pn_right: EQ expr
+ *
+ * PNK_EQ,      binary      pn_left: left-assoc EQ expr, pn_right: REL expr
+ * PNK_NE,
+ * PNK_STRICTEQ,
+ * PNK_STRICTNE
+ * PNK_LT,      binary      pn_left: left-assoc REL expr, pn_right: SH expr
+ * PNK_LE,
+ * PNK_GT,
+ * PNK_GE
+ * PNK_LSH,     binary      pn_left: left-assoc SH expr, pn_right: ADD expr
+ * PNK_RSH,
+ * PNK_URSH
+ * PNK_PLUS,    binary      pn_left: left-assoc ADD expr, pn_right: MUL expr
+ *                          pn_xflags: if a left-associated binary PNK_PLUS
  *                            tree has been flattened into a list (see above
  *                            under <Expressions>), pn_xflags will contain
  *                            PNX_STRCAT if at least one list element is a
- *                            string literal (TOK_STRING); if such a list has
+ *                            string literal (PNK_STRING); if such a list has
  *                            any non-string, non-number term, pn_xflags will
  *                            contain PNX_CANTFOLD.
  *                          pn_
- * TOK_MINUS                pn_op: JSOP_ADD, JSOP_SUB
- * TOK_STAR,    binary      pn_left: left-assoc MUL expr, pn_right: UNARY expr
- * TOK_DIVOP                pn_op: JSOP_MUL, JSOP_DIV, JSOP_MOD
- * TOK_UNARYOP  unary       pn_kid: UNARY expr, pn_op: JSOP_NEG, JSOP_POS,
- *                          JSOP_NOT, JSOP_BITNOT, JSOP_TYPEOF, JSOP_VOID
- * TOK_INC,     unary       pn_kid: MEMBER expr
- * TOK_DEC
- * TOK_NEW      list        pn_head: list of ctor, arg1, arg2, ... argN
+ * PNK_MINUS                pn_op: JSOP_ADD, JSOP_SUB
+ * PNK_STAR,    binary      pn_left: left-assoc MUL expr, pn_right: UNARY expr
+ * PNK_DIV,                 pn_op: JSOP_MUL, JSOP_DIV, JSOP_MOD
+ * PNK_MOD
+ * PNK_TYPEOF,  unary       pn_kid: UNARY expr
+ * PNK_VOID,
+ * PNK_NOT,
+ * PNK_BITNOT
+ * PNK_INC,     unary       pn_kid: MEMBER expr
+ * PNK_DEC
+ * PNK_NEW      list        pn_head: list of ctor, arg1, arg2, ... argN
  *                          pn_count: 1 + N (where N is number of args)
  *                          ctor is a MEMBER expr
- * TOK_DELETE   unary       pn_kid: MEMBER expr
- * TOK_DOT,     name        pn_expr: MEMBER expr to left of .
- * TOK_DBLDOT               pn_atom: name to right of .
- * TOK_LB       binary      pn_left: MEMBER expr to left of [
+ * PNK_DELETE   unary       pn_kid: MEMBER expr
+ * PNK_DOT,     name        pn_expr: MEMBER expr to left of .
+ * PNK_DBLDOT               pn_atom: name to right of .
+ * PNK_LB       binary      pn_left: MEMBER expr to left of [
  *                          pn_right: expr between [ and ]
- * TOK_LP       list        pn_head: list of call, arg1, arg2, ... argN
+ * PNK_LP       list        pn_head: list of call, arg1, arg2, ... argN
  *                          pn_count: 1 + N (where N is number of args)
  *                          call is a MEMBER expr naming a callable object
- * TOK_RB       list        pn_head: list of pn_count array element exprs
- *                          [,,] holes are represented by TOK_COMMA nodes
+ * PNK_RB       list        pn_head: list of pn_count array element exprs
+ *                          [,,] holes are represented by PNK_COMMA nodes
  *                          pn_xflags: PN_ENDCOMMA if extra comma at end
- * TOK_RC       list        pn_head: list of pn_count binary TOK_COLON nodes
- * TOK_COLON    binary      key-value pair in object initializer or
+ * PNK_RC       list        pn_head: list of pn_count binary PNK_COLON nodes
+ * PNK_COLON    binary      key-value pair in object initializer or
  *                          destructuring lhs
  *                          pn_left: property id, pn_right: value
  *                          var {x} = object destructuring shorthand shares
- *                          PN_NAME node for x on left and right of TOK_COLON
- *                          node in TOK_RC's list, has PNX_DESTRUCT flag
- * TOK_DEFSHARP unary       pn_num: jsint value of n in #n=
+ *                          PN_NAME node for x on left and right of PNK_COLON
+ *                          node in PNK_RC's list, has PNX_DESTRUCT flag
+ * PNK_DEFSHARP unary       pn_num: jsint value of n in #n=
  *                          pn_kid: primary function, paren, name, object or
  *                                  array literal expressions
- * TOK_USESHARP nullary     pn_num: jsint value of n in #n#
- * TOK_NAME,    name        pn_atom: name, string, or object atom
- * TOK_STRING,              pn_op: JSOP_NAME, JSOP_STRING, or JSOP_OBJECT, or
+ * PNK_USESHARP nullary     pn_num: jsint value of n in #n#
+ * PNK_NAME,    name        pn_atom: name, string, or object atom
+ * PNK_STRING,              pn_op: JSOP_NAME, JSOP_STRING, or JSOP_OBJECT, or
  *                                 JSOP_REGEXP
- * TOK_REGEXP               If JSOP_NAME, pn_op may be JSOP_*ARG or JSOP_*VAR
+ * PNK_REGEXP               If JSOP_NAME, pn_op may be JSOP_*ARG or JSOP_*VAR
  *                          with pn_cookie telling (staticLevel, slot) (see
  *                          jsscript.h's UPVAR macros) and pn_dflags telling
  *                          const-ness and static analysis results
- * TOK_NAME     name        If pn_used, TOK_NAME uses the lexdef member instead
+ * PNK_NAME     name        If pn_used, PNK_NAME uses the lexdef member instead
  *                          of the expr member it overlays
- * TOK_NUMBER   dval        pn_dval: double value of numeric literal
- * TOK_PRIMARY  nullary     pn_op: JSOp bytecode
+ * PNK_NUMBER   dval        pn_dval: double value of numeric literal
+ * PNK_TRUE,    nullary     pn_op: JSOp bytecode
+ * PNK_FALSE,
+ * PNK_NULL,
+ * PNK_THIS
  *
  * <E4X node descriptions>
- * TOK_DEFAULT  name        pn_atom: default XML namespace string literal
- * TOK_FILTER   binary      pn_left: container expr, pn_right: filter expr
- * TOK_DBLDOT   binary      pn_left: container expr, pn_right: selector expr
- * TOK_ANYNAME  nullary     pn_op: JSOP_ANYNAME
+ * PNK_XMLUNARY unary       pn_kid: PNK_AT, PNK_ANYNAME, or PNK_DBLCOLON node
+ *                          pn_op: JSOP_XMLNAME, JSOP_BINDXMLNAME, or
+ *                                 JSOP_SETXMLNAME
+ * PNK_DEFAULT  name        pn_atom: default XML namespace string literal
+ * PNK_FILTER   binary      pn_left: container expr, pn_right: filter expr
+ * PNK_DBLDOT   binary      pn_left: container expr, pn_right: selector expr
+ * PNK_ANYNAME  nullary     pn_op: JSOP_ANYNAME
  *                          pn_atom: cx->runtime->atomState.starAtom
- * TOK_AT       unary       pn_op: JSOP_TOATTRNAME; pn_kid attribute id/expr
- * TOK_DBLCOLON binary      pn_op: JSOP_QNAME
- *                          pn_left: TOK_ANYNAME or TOK_NAME node
- *                          pn_right: TOK_STRING "*" node, or expr within []
+ * PNK_AT       unary       pn_op: JSOP_TOATTRNAME; pn_kid attribute id/expr
+ * PNK_DBLCOLON binary      pn_op: JSOP_QNAME
+ *                          pn_left: PNK_ANYNAME or PNK_NAME node
+ *                          pn_right: PNK_STRING "*" node, or expr within []
  *              name        pn_op: JSOP_QNAMECONST
- *                          pn_expr: TOK_ANYNAME or TOK_NAME left operand
+ *                          pn_expr: PNK_ANYNAME or PNK_NAME left operand
  *                          pn_atom: name on right of ::
- * TOK_XMLELEM  list        XML element node
+ * PNK_XMLELEM  list        XML element node
  *                          pn_head: start tag, content1, ... contentN, end tag
  *                          pn_count: 2 + N where N is number of content nodes
  *                                    N may be > x.length() if {expr} embedded
  *                            After constant folding, these contents may be
  *                            concatenated into string nodes.
- * TOK_XMLLIST  list        XML list node
+ * PNK_XMLLIST  list        XML list node
  *                          pn_head: content1, ... contentN
- * TOK_XMLSTAGO, list       XML start, end, and point tag contents
- * TOK_XMLETAGO,            pn_head: tag name or {expr}, ... XML attrs ...
- * TOK_XMLPTAGC
- * TOK_XMLNAME  nullary     pn_atom: XML name, with no {expr} embedded
- * TOK_XMLNAME  list        pn_head: tag name or {expr}, ... name or {expr}
- * TOK_XMLATTR, nullary     pn_atom: attribute value string; pn_op: JSOP_STRING
- * TOK_XMLCDATA,
- * TOK_XMLCOMMENT
- * TOK_XMLPI    nullary     pn_pitarget: XML processing instruction target
+ * PNK_XMLSTAGO, list       XML start, end, and point tag contents
+ * PNK_XMLETAGO,            pn_head: tag name or {expr}, ... XML attrs ...
+ * PNK_XMLPTAGC
+ * PNK_XMLNAME  nullary     pn_atom: XML name, with no {expr} embedded
+ * PNK_XMLNAME  list        pn_head: tag name or {expr}, ... name or {expr}
+ * PNK_XMLATTR, nullary     pn_atom: attribute value string; pn_op: JSOP_STRING
+ * PNK_XMLCDATA,
+ * PNK_XMLCOMMENT
+ * PNK_XMLPI    nullary     pn_pitarget: XML processing instruction target
  *                          pn_pidata: XML PI data, or null if no data
- * TOK_XMLTEXT  nullary     pn_atom: marked-up text, or null if empty string
- * TOK_LC       unary       {expr} in XML tag or content; pn_kid is expr
+ * PNK_XMLTEXT  nullary     pn_atom: marked-up text, or null if empty string
+ * PNK_LC       unary       {expr} in XML tag or content; pn_kid is expr
  *
  * So an XML tag with no {expr} and three attributes is a list with the form:
  *
@@ -266,10 +429,10 @@ namespace js {
  *    ((name1 {expr1}) (name2 {expr2} name3) {expr3})
  *
  * where () bracket a list with elements separated by spaces, and {expr} is a
- * TOK_LC unary node with expr as its kid.
+ * PNK_LC unary node with expr as its kid.
  *
  * Thus, the attribute name/value pairs occupy successive odd and even list
- * locations, where pn_head is the TOK_XMLNAME node at list location 0.  The
+ * locations, where pn_head is the PNK_XMLNAME node at list location 0.  The
  * parser builds the same sort of structures for elements:
  *
  *    <a x={x}>Hi there!<b y={y}>How are you?</b><answer>{x + y}</answer></a>
@@ -282,14 +445,14 @@ namespace js {
  *
  * Label              Variant   Members
  * -----              -------   -------
- * TOK_LEXICALSCOPE   name      pn_op: JSOP_LEAVEBLOCK or JSOP_LEAVEBLOCKEXPR
+ * PNK_LEXICALSCOPE   name      pn_op: JSOP_LEAVEBLOCK or JSOP_LEAVEBLOCKEXPR
  *                              pn_objbox: block object in ObjectBox holder
  *                              pn_expr: block body
- * TOK_ARRAYCOMP      list      pn_count: 1
+ * PNK_ARRAYCOMP      list      pn_count: 1
  *                              pn_head: list of 1 element, which is block
  *                                enclosing for loop(s) and optionally
- *                                if-guarded TOK_ARRAYPUSH
- * TOK_ARRAYPUSH      unary     pn_op: JSOP_ARRAYCOMP
+ *                                if-guarded PNK_ARRAYPUSH
+ * PNK_ARRAYPUSH      unary     pn_op: JSOP_ARRAYCOMP
  *                              pn_kid: array comprehension expression
  */
 enum ParseNodeArity {
@@ -307,7 +470,7 @@ struct Definition;
 
 struct ParseNode {
   private:
-    uint32              pn_type   : 16, /* TOK_* type, see frontend/TokenStream.h */
+    uint32              pn_type   : 16, /* PNK_* type */
                         pn_op     : 8,  /* see JSOp enum and jsopcode.tbl */
                         pn_arity  : 5,  /* see ParseNodeArity enum */
                         pn_parens : 1,  /* this expr was enclosed in parens */
@@ -315,10 +478,11 @@ struct ParseNode {
                         pn_defn   : 1;  /* this node is a Definition */
 
   public:
-    ParseNode(TokenKind type, JSOp op, ParseNodeArity arity)
-      : pn_type(type), pn_op(op), pn_arity(arity), pn_parens(0), pn_used(0), pn_defn(0),
+    ParseNode(ParseNodeKind kind, JSOp op, ParseNodeArity arity)
+      : pn_type(kind), pn_op(op), pn_arity(arity), pn_parens(0), pn_used(0), pn_defn(0),
         pn_offset(0), pn_next(NULL), pn_link(NULL)
     {
+        JS_ASSERT(kind < PNK_LIMIT);
         pn_pos.begin.index = 0;
         pn_pos.begin.lineno = 0;
         pn_pos.end.index = 0;
@@ -326,23 +490,52 @@ struct ParseNode {
         memset(&pn_u, 0, sizeof pn_u);
     }
 
-    ParseNode(TokenKind type, JSOp op, ParseNodeArity arity, const TokenPos &pos)
-      : pn_type(type), pn_op(op), pn_arity(arity), pn_parens(0), pn_used(0), pn_defn(0),
+    ParseNode(ParseNodeKind kind, JSOp op, ParseNodeArity arity, const TokenPos &pos)
+      : pn_type(kind), pn_op(op), pn_arity(arity), pn_parens(0), pn_used(0), pn_defn(0),
         pn_pos(pos), pn_offset(0), pn_next(NULL), pn_link(NULL)
     {
+        JS_ASSERT(kind < PNK_LIMIT);
         memset(&pn_u, 0, sizeof pn_u);
     }
 
     JSOp getOp() const                     { return JSOp(pn_op); }
     void setOp(JSOp op)                    { pn_op = op; }
     bool isOp(JSOp op) const               { return getOp() == op; }
-    TokenKind getKind() const              { return TokenKind(pn_type); }
-    void setKind(TokenKind kind)           { pn_type = kind; }
-    bool isKind(TokenKind kind) const      { return getKind() == kind; }
+
+    ParseNodeKind getKind() const {
+        JS_ASSERT(pn_type < PNK_LIMIT);
+        return ParseNodeKind(pn_type);
+    }
+    void setKind(ParseNodeKind kind) {
+        JS_ASSERT(kind < PNK_LIMIT);
+        pn_type = kind;
+    }
+    bool isKind(ParseNodeKind kind) const  { return getKind() == kind; }
+
     ParseNodeArity getArity() const        { return ParseNodeArity(pn_arity); }
     bool isArity(ParseNodeArity a) const   { return getArity() == a; }
     void setArity(ParseNodeArity a)        { pn_arity = a; }
 
+    bool isXMLNameOp() const {
+        ParseNodeKind kind = getKind();
+        return kind == PNK_ANYNAME || kind == PNK_AT || kind == PNK_DBLCOLON;
+    }
+    bool isAssignment() const {
+        ParseNodeKind kind = getKind();
+        return PNK_ASSIGNMENT_START <= kind && kind <= PNK_ASSIGNMENT_LAST;
+    }
+
+    bool isXMLPropertyIdentifier() const {
+        ParseNodeKind kind = getKind();
+        return kind == PNK_ANYNAME || kind == PNK_AT || kind == PNK_DBLCOLON;
+    }
+
+    bool isXMLItem() const {
+        ParseNodeKind kind = getKind();
+        return kind == PNK_XMLCOMMENT || kind == PNK_XMLCDATA || kind == PNK_XMLPI ||
+               kind == PNK_XMLELEM || kind == PNK_XMLLIST;
+    }
+
     /* Boolean attributes. */
     bool isInParens() const                { return pn_parens; }
     void setInParens(bool enabled)         { pn_parens = enabled; }
@@ -375,7 +568,7 @@ struct ParseNode {
             ParseNode   *left;
             ParseNode   *right;
             Value       *pval;          /* switch case value */
-            uintN       iflags;         /* JSITER_* flags for TOK_FOR node */
+            uintN       iflags;         /* JSITER_* flags for PNK_FOR node */
         } binary;
         struct {                        /* one kid if unary */
             ParseNode   *kid;
@@ -392,7 +585,7 @@ struct ParseNode {
             };
             union {
                 ParseNode    *expr;     /* function body, var initializer, or
-                                           base object of TOK_DOT */
+                                           base object of PNK_DOT */
                 Definition   *lexdef;   /* lexical definition for this use */
             };
             UpvarCookie cookie;         /* upvar cookie with absolute frame
@@ -456,11 +649,24 @@ struct ParseNode {
         pn_next = pn_link = NULL;
     }
 
-    static ParseNode *create(ParseNodeArity arity, TreeContext *tc);
+    static ParseNode *create(ParseNodeKind kind, ParseNodeArity arity, TreeContext *tc);
 
   public:
-    static ParseNode *newBinaryOrAppend(TokenKind tt, JSOp op, ParseNode *left, ParseNode *right,
-                                        TreeContext *tc);
+    /*
+     * Append right to left, forming a list node.  |left| must have the given
+     * kind and op, and op must be left-associative.
+     */
+    static ParseNode *
+    append(ParseNodeKind tt, JSOp op, ParseNode *left, ParseNode *right);
+
+    /*
+     * Either append right to left, if left meets the conditions necessary to
+     * append (see append), or form a binary node whose children are right and
+     * left.
+     */
+    static ParseNode *
+    newBinaryOrAppend(ParseNodeKind kind, JSOp op, ParseNode *left, ParseNode *right,
+                      TreeContext *tc);
 
     /*
      * The pn_expr and lexdef members are arms of an unsafe union. Unless you
@@ -504,11 +710,11 @@ struct ParseNode {
 #define PND_USE2DEF_FLAGS (PND_ASSIGNED | PND_FUNARG | PND_CLOSED)
 
 /* PN_LIST pn_xflags bits. */
-#define PNX_STRCAT      0x01            /* TOK_PLUS list has string term */
-#define PNX_CANTFOLD    0x02            /* TOK_PLUS list has unfoldable term */
-#define PNX_POPVAR      0x04            /* TOK_VAR last result needs popping */
-#define PNX_FORINVAR    0x08            /* TOK_VAR is left kid of TOK_IN node,
-                                           which is left kid of TOK_FOR */
+#define PNX_STRCAT      0x01            /* PNK_PLUS list has string term */
+#define PNX_CANTFOLD    0x02            /* PNK_PLUS list has unfoldable term */
+#define PNX_POPVAR      0x04            /* PNK_VAR last result needs popping */
+#define PNX_FORINVAR    0x08            /* PNK_VAR is left kid of PNK_IN node,
+                                           which is left kid of PNK_FOR */
 #define PNX_ENDCOMMA    0x10            /* array literal has comma at end */
 #define PNX_XMLROOT     0x20            /* top-most node in XML literal tree */
 #define PNX_GROUPINIT   0x40            /* var [a, b] = [c, d]; unit list */
@@ -568,9 +774,11 @@ struct ParseNode {
 
     /* True if pn is a parsenode representing a literal constant. */
     bool isLiteral() const {
-        return isKind(TOK_NUMBER) ||
-               isKind(TOK_STRING) ||
-               (isKind(TOK_PRIMARY) && !isOp(JSOP_THIS));
+        return isKind(PNK_NUMBER) ||
+               isKind(PNK_STRING) ||
+               isKind(PNK_TRUE) ||
+               isKind(PNK_FALSE) ||
+               isKind(PNK_NULL);
     }
 
     /*
@@ -589,28 +797,28 @@ struct ParseNode {
      * a directive.
      */
     bool isStringExprStatement() const {
-        if (getKind() == TOK_SEMI) {
+        if (getKind() == PNK_SEMI) {
             JS_ASSERT(pn_arity == PN_UNARY);
             ParseNode *kid = pn_kid;
-            return kid && kid->getKind() == TOK_STRING && !kid->pn_parens;
+            return kid && kid->getKind() == PNK_STRING && !kid->pn_parens;
         }
         return false;
     }
 
     /*
-     * Return true if this node, known to be a string literal, could be the
-     * string of a directive in a Directive Prologue. Directive strings never
-     * contain escape sequences or line continuations.
+     * Return true if this node, known to be an unparenthesized string literal,
+     * could be the string of a directive in a Directive Prologue. Directive
+     * strings never contain escape sequences or line continuations.
      */
     bool isEscapeFreeStringLiteral() const {
-        JS_ASSERT(pn_type == TOK_STRING && !pn_parens);
-        JSString *str = pn_atom;
+        JS_ASSERT(isKind(PNK_STRING) && !pn_parens);
 
         /*
          * If the string's length in the source code is its length as a value,
          * accounting for the quotes, then it must not contain any escape
          * sequences or line continuations.
          */
+        JSString *str = pn_atom;
         return (pn_pos.begin.lineno == pn_pos.end.lineno &&
                 pn_pos.begin.index + str->length() + 2 == pn_pos.end.index);
     }
@@ -623,13 +831,13 @@ struct ParseNode {
      * True if this node is a desugared generator expression.
      */
     bool isGeneratorExpr() const {
-        if (getKind() == TOK_LP) {
+        if (getKind() == PNK_LP) {
             ParseNode *callee = this->pn_head;
-            if (callee->getKind() == TOK_FUNCTION) {
-                ParseNode *body = (callee->pn_body->getKind() == TOK_UPVARS)
+            if (callee->getKind() == PNK_FUNCTION) {
+                ParseNode *body = (callee->pn_body->getKind() == PNK_UPVARS)
                                   ? callee->pn_body->pn_tree
                                   : callee->pn_body;
-                if (body->getKind() == TOK_LEXICALSCOPE)
+                if (body->getKind() == PNK_LEXICALSCOPE)
                     return true;
             }
         }
@@ -639,10 +847,10 @@ struct ParseNode {
     ParseNode *generatorExpr() const {
         JS_ASSERT(isGeneratorExpr());
         ParseNode *callee = this->pn_head;
-        ParseNode *body = callee->pn_body->getKind() == TOK_UPVARS
+        ParseNode *body = callee->pn_body->getKind() == PNK_UPVARS
                           ? callee->pn_body->pn_tree
                           : callee->pn_body;
-        JS_ASSERT(body->getKind() == TOK_LEXICALSCOPE);
+        JS_ASSERT(body->getKind() == PNK_LEXICALSCOPE);
         return body->pn_expr;
     }
 #endif
@@ -687,46 +895,46 @@ struct ParseNode {
 };
 
 struct NullaryNode : public ParseNode {
-    static inline NullaryNode *create(TreeContext *tc) {
-        return (NullaryNode *)ParseNode::create(PN_NULLARY, tc);
+    static inline NullaryNode *create(ParseNodeKind kind, TreeContext *tc) {
+        return (NullaryNode *)ParseNode::create(kind, PN_NULLARY, tc);
     }
 };
 
 struct UnaryNode : public ParseNode {
-    UnaryNode(TokenKind type, JSOp op, const TokenPos &pos, ParseNode *kid)
-      : ParseNode(type, op, PN_UNARY, pos)
+    UnaryNode(ParseNodeKind kind, JSOp op, const TokenPos &pos, ParseNode *kid)
+      : ParseNode(kind, op, PN_UNARY, pos)
     {
         pn_kid = kid;
     }
 
-    static inline UnaryNode *create(TreeContext *tc) {
-        return (UnaryNode *)ParseNode::create(PN_UNARY, tc);
+    static inline UnaryNode *create(ParseNodeKind kind, TreeContext *tc) {
+        return (UnaryNode *)ParseNode::create(kind, PN_UNARY, tc);
     }
 };
 
 struct BinaryNode : public ParseNode {
-    BinaryNode(TokenKind type, JSOp op, const TokenPos &pos, ParseNode *left, ParseNode *right)
-      : ParseNode(type, op, PN_BINARY, pos)
+    BinaryNode(ParseNodeKind kind, JSOp op, const TokenPos &pos, ParseNode *left, ParseNode *right)
+      : ParseNode(kind, op, PN_BINARY, pos)
     {
         pn_left = left;
         pn_right = right;
     }
 
-    BinaryNode(TokenKind type, JSOp op, ParseNode *left, ParseNode *right)
-      : ParseNode(type, op, PN_BINARY, TokenPos::box(left->pn_pos, right->pn_pos))
+    BinaryNode(ParseNodeKind kind, JSOp op, ParseNode *left, ParseNode *right)
+      : ParseNode(kind, op, PN_BINARY, TokenPos::box(left->pn_pos, right->pn_pos))
     {
         pn_left = left;
         pn_right = right;
     }
 
-    static inline BinaryNode *create(TreeContext *tc) {
-        return (BinaryNode *)ParseNode::create(PN_BINARY, tc);
+    static inline BinaryNode *create(ParseNodeKind kind, TreeContext *tc) {
+        return (BinaryNode *)ParseNode::create(kind, PN_BINARY, tc);
     }
 };
 
 struct TernaryNode : public ParseNode {
-    TernaryNode(TokenKind type, JSOp op, ParseNode *kid1, ParseNode *kid2, ParseNode *kid3)
-      : ParseNode(type, op, PN_TERNARY,
+    TernaryNode(ParseNodeKind kind, JSOp op, ParseNode *kid1, ParseNode *kid2, ParseNode *kid3)
+      : ParseNode(kind, op, PN_TERNARY,
                   TokenPos::make((kid1 ? kid1 : kid2 ? kid2 : kid3)->pn_pos.begin,
                                  (kid3 ? kid3 : kid2 ? kid2 : kid1)->pn_pos.end))
     {
@@ -735,38 +943,38 @@ struct TernaryNode : public ParseNode {
         pn_kid3 = kid3;
     }
 
-    static inline TernaryNode *create(TreeContext *tc) {
-        return (TernaryNode *)ParseNode::create(PN_TERNARY, tc);
+    static inline TernaryNode *create(ParseNodeKind kind, TreeContext *tc) {
+        return (TernaryNode *)ParseNode::create(kind, PN_TERNARY, tc);
     }
 };
 
 struct ListNode : public ParseNode {
-    static inline ListNode *create(TreeContext *tc) {
-        return (ListNode *)ParseNode::create(PN_LIST, tc);
+    static inline ListNode *create(ParseNodeKind kind, TreeContext *tc) {
+        return (ListNode *)ParseNode::create(kind, PN_LIST, tc);
     }
 };
 
 struct FunctionNode : public ParseNode {
-    static inline FunctionNode *create(TreeContext *tc) {
-        return (FunctionNode *)ParseNode::create(PN_FUNC, tc);
+    static inline FunctionNode *create(ParseNodeKind kind, TreeContext *tc) {
+        return (FunctionNode *)ParseNode::create(kind, PN_FUNC, tc);
     }
 };
 
 struct NameNode : public ParseNode {
-    static NameNode *create(JSAtom *atom, TreeContext *tc);
+    static NameNode *create(ParseNodeKind kind, JSAtom *atom, TreeContext *tc);
 
     inline void initCommon(TreeContext *tc);
 };
 
 struct NameSetNode : public ParseNode {
-    static inline NameSetNode *create(TreeContext *tc) {
-        return (NameSetNode *)ParseNode::create(PN_NAMESET, tc);
+    static inline NameSetNode *create(ParseNodeKind kind, TreeContext *tc) {
+        return (NameSetNode *)ParseNode::create(kind, PN_NAMESET, tc);
     }
 };
 
 struct LexicalScopeNode : public ParseNode {
-    static inline LexicalScopeNode *create(TreeContext *tc) {
-        return (LexicalScopeNode *)ParseNode::create(PN_NAME, tc);
+    static inline LexicalScopeNode *create(ParseNodeKind kind, TreeContext *tc) {
+        return (LexicalScopeNode *)ParseNode::create(kind, PN_NAME, tc);
     }
 };
 
@@ -777,7 +985,7 @@ CloneLeftHandSide(ParseNode *opn, TreeContext *tc);
  * js::Definition is a degenerate subtype of the PN_FUNC and PN_NAME variants
  * of js::ParseNode, allocated only for function, var, const, and let
  * declarations that define truly lexical bindings. This means that a child of
- * a TOK_VAR list may be a Definition instead of a ParseNode. The pn_defn
+ * a PNK_VAR list may be a Definition instead of a ParseNode. The pn_defn
  * bit is set for all Definitions, clear otherwise.
  *
  * In an upvars list, defn->resolve() is the outermost definition the
@@ -821,7 +1029,7 @@ CloneLeftHandSide(ParseNode *opn, TreeContext *tc);
  *               map x to dn via tc->decls;
  *               pn = dn;
  *           }
- *           insert pn into its parent TOK_VAR list;
+ *           insert pn into its parent PNK_VAR list;
  *       } else {
  *           pn = allocate a ParseNode for this reference to x;
  *           dn = lookup x in tc's lexical scope chain;
@@ -907,7 +1115,7 @@ struct Definition : public ParseNode
     Definition *resolve() {
         ParseNode *pn = this;
         while (!pn->isDefn()) {
-            if (pn->getKind() == TOK_ASSIGN) {
+            if (pn->isAssignment()) {
                 pn = pn->pn_left;
                 continue;
             }
@@ -933,9 +1141,9 @@ struct Definition : public ParseNode
     static const char *kindString(Kind kind);
 
     Kind kind() {
-        if (getKind() == TOK_FUNCTION)
+        if (getKind() == PNK_FUNCTION)
             return FUNCTION;
-        JS_ASSERT(getKind() == TOK_NAME);
+        JS_ASSERT(getKind() == PNK_NAME);
         if (isOp(JSOP_NOP))
             return UNKNOWN;
         if (isOp(JSOP_GETARG))
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 9c71a8ce96e9..a8273cbf3b6c 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -92,9 +92,9 @@
 #endif
 
 #include "jsatominlines.h"
-#include "jsobjinlines.h"
 #include "jsscriptinlines.h"
 
+#include "frontend/BytecodeEmitter-inl.h"
 #include "frontend/ParseMaps-inl.h"
 #include "frontend/ParseNode-inl.h"
 #include "vm/RegExpObject-inl.h"
@@ -246,7 +246,7 @@ Parser::trace(JSTracer *trc)
 {
     ObjectBox *objbox = traceListHead;
     while (objbox) {
-        MarkObject(trc, *objbox->object, "parser.object");
+        MarkRoot(trc, objbox->object, "parser.object");
         if (objbox->isFunctionBox)
             static_cast<FunctionBox *>(objbox)->bindings.trace(trc);
         objbox = objbox->traceLink;
@@ -261,7 +261,7 @@ GenerateBlockIdForStmtNode(ParseNode *pn, TreeContext *tc)
 {
     JS_ASSERT(tc->topStmt);
     JS_ASSERT(STMT_MAYBE_SCOPE(tc->topStmt));
-    JS_ASSERT(pn->isKind(TOK_LC) || pn->isKind(TOK_LEXICALSCOPE));
+    JS_ASSERT(pn->isKind(PNK_LC) || pn->isKind(PNK_LEXICALSCOPE));
     if (!GenerateBlockId(tc, tc->topStmt->blockid))
         return false;
     pn->pn_blockid = tc->topStmt->blockid;
@@ -321,56 +321,54 @@ HasFinalReturn(ParseNode *pn)
     uintN rv, rv2, hasDefault;
 
     switch (pn->getKind()) {
-      case TOK_LC:
+      case PNK_LC:
         if (!pn->pn_head)
             return ENDS_IN_OTHER;
         return HasFinalReturn(pn->last());
 
-      case TOK_IF:
+      case PNK_IF:
         if (!pn->pn_kid3)
             return ENDS_IN_OTHER;
         return HasFinalReturn(pn->pn_kid2) & HasFinalReturn(pn->pn_kid3);
 
-      case TOK_WHILE:
+      case PNK_WHILE:
         pn2 = pn->pn_left;
-        if (pn2->isKind(TOK_PRIMARY) && pn2->isOp(JSOP_TRUE))
+        if (pn2->isKind(PNK_TRUE))
             return ENDS_IN_RETURN;
-        if (pn2->isKind(TOK_NUMBER) && pn2->pn_dval)
+        if (pn2->isKind(PNK_NUMBER) && pn2->pn_dval)
             return ENDS_IN_RETURN;
         return ENDS_IN_OTHER;
 
-      case TOK_DO:
+      case PNK_DO:
         pn2 = pn->pn_right;
-        if (pn2->isKind(TOK_PRIMARY)) {
-            if (pn2->isOp(JSOP_FALSE))
-                return HasFinalReturn(pn->pn_left);
-            if (pn2->isOp(JSOP_TRUE))
-                return ENDS_IN_RETURN;
-        }
-        if (pn2->isKind(TOK_NUMBER)) {
+        if (pn2->isKind(PNK_FALSE))
+            return HasFinalReturn(pn->pn_left);
+        if (pn2->isKind(PNK_TRUE))
+            return ENDS_IN_RETURN;
+        if (pn2->isKind(PNK_NUMBER)) {
             if (pn2->pn_dval == 0)
                 return HasFinalReturn(pn->pn_left);
             return ENDS_IN_RETURN;
         }
         return ENDS_IN_OTHER;
 
-      case TOK_FOR:
+      case PNK_FOR:
         pn2 = pn->pn_left;
         if (pn2->isArity(PN_TERNARY) && !pn2->pn_kid2)
             return ENDS_IN_RETURN;
         return ENDS_IN_OTHER;
 
-      case TOK_SWITCH:
+      case PNK_SWITCH:
         rv = ENDS_IN_RETURN;
         hasDefault = ENDS_IN_OTHER;
         pn2 = pn->pn_right;
-        if (pn2->isKind(TOK_LEXICALSCOPE))
+        if (pn2->isKind(PNK_LEXICALSCOPE))
             pn2 = pn2->expr();
         for (pn2 = pn2->pn_head; rv && pn2; pn2 = pn2->pn_next) {
-            if (pn2->isKind(TOK_DEFAULT))
+            if (pn2->isKind(PNK_DEFAULT))
                 hasDefault = ENDS_IN_RETURN;
             pn3 = pn2->pn_right;
-            JS_ASSERT(pn3->isKind(TOK_LC));
+            JS_ASSERT(pn3->isKind(PNK_LC));
             if (pn3->pn_head) {
                 rv2 = HasFinalReturn(pn3->last());
                 if (rv2 == ENDS_IN_OTHER && pn2->pn_next)
@@ -383,23 +381,23 @@ HasFinalReturn(ParseNode *pn)
         rv &= hasDefault;
         return rv;
 
-      case TOK_BREAK:
+      case PNK_BREAK:
         return ENDS_IN_BREAK;
 
-      case TOK_WITH:
+      case PNK_WITH:
         return HasFinalReturn(pn->pn_right);
 
-      case TOK_RETURN:
+      case PNK_RETURN:
         return ENDS_IN_RETURN;
 
-      case TOK_COLON:
-      case TOK_LEXICALSCOPE:
+      case PNK_COLON:
+      case PNK_LEXICALSCOPE:
         return HasFinalReturn(pn->expr());
 
-      case TOK_THROW:
+      case PNK_THROW:
         return ENDS_IN_RETURN;
 
-      case TOK_TRY:
+      case PNK_TRY:
         /* If we have a finally block that returns, we are done. */
         if (pn->pn_kid3) {
             rv = HasFinalReturn(pn->pn_kid3);
@@ -416,11 +414,11 @@ HasFinalReturn(ParseNode *pn)
         }
         return rv;
 
-      case TOK_CATCH:
+      case PNK_CATCH:
         /* Check this catch block's body. */
         return HasFinalReturn(pn->pn_kid3);
 
-      case TOK_LET:
+      case PNK_LET:
         /* Non-binary let statements are let declarations. */
         if (!pn->isArity(PN_BINARY))
             return ENDS_IN_OTHER;
@@ -461,7 +459,7 @@ CheckFinalReturn(JSContext *cx, TreeContext *tc, ParseNode *pn)
 static bool
 CheckStrictAssignment(JSContext *cx, TreeContext *tc, ParseNode *lhs)
 {
-    if (tc->needStrictChecks() && lhs->isKind(TOK_NAME)) {
+    if (tc->needStrictChecks() && lhs->isKind(PNK_NAME)) {
         JSAtom *atom = lhs->pn_atom;
         JSAtomState *atomState = &cx->runtime->atomState;
         if (atom == atomState->evalAtom || atom == atomState->argumentsAtom) {
@@ -589,7 +587,7 @@ Parser::functionBody()
     if (tokenStream.currentToken().type == TOK_LC) {
         pn = statements();
     } else {
-        pn = UnaryNode::create(tc);
+        pn = UnaryNode::create(PNK_RETURN, tc);
         if (pn) {
             pn->pn_kid = assignExpr();
             if (!pn->pn_kid) {
@@ -601,7 +599,6 @@ Parser::functionBody()
                                     JSMSG_BAD_ANON_GENERATOR_RETURN);
                     pn = NULL;
                 } else {
-                    pn->setKind(TOK_RETURN);
                     pn->setOp(JSOP_RETURN);
                     pn->pn_pos.end = pn->pn_kid->pn_pos.end;
                 }
@@ -631,11 +628,10 @@ Parser::functionBody()
 static Definition *
 MakePlaceholder(ParseNode *pn, TreeContext *tc)
 {
-    Definition *dn = (Definition *) NameNode::create(pn->pn_atom, tc);
+    Definition *dn = (Definition *) NameNode::create(PNK_NAME, pn->pn_atom, tc);
     if (!dn)
         return NULL;
 
-    dn->setKind(TOK_NAME);
     dn->setOp(JSOP_NOP);
     dn->setDefn(true);
     dn->pn_dflags |= PND_PLACEHOLDER;
@@ -726,7 +722,7 @@ MakeAssignment(ParseNode *pn, ParseNode *rhs, TreeContext *tc)
         pn->pn_link = NULL;
     }
 
-    pn->setKind(TOK_ASSIGN);
+    pn->setKind(PNK_ASSIGN);
     pn->setOp(JSOP_NOP);
     pn->setArity(PN_BINARY);
     pn->setInParens(false);
@@ -759,13 +755,13 @@ MakeDefIntoUse(Definition *dn, ParseNode *pn, JSAtom *atom, TreeContext *tc)
     } else if (dn->kind() == Definition::FUNCTION) {
         JS_ASSERT(dn->isOp(JSOP_NOP));
         tc->parser->prepareNodeForMutation(dn);
-        dn->setKind(TOK_NAME);
+        dn->setKind(PNK_NAME);
         dn->setArity(PN_NAME);
         dn->pn_atom = atom;
     }
 
     /* Now make dn no longer a definition, rather a use of pn. */
-    JS_ASSERT(dn->isKind(TOK_NAME));
+    JS_ASSERT(dn->isKind(PNK_NAME));
     JS_ASSERT(dn->isArity(PN_NAME));
     JS_ASSERT(dn->pn_atom == atom);
 
@@ -789,33 +785,30 @@ MakeDefIntoUse(Definition *dn, ParseNode *pn, JSAtom *atom, TreeContext *tc)
 bool
 js::DefineArg(ParseNode *pn, JSAtom *atom, uintN i, TreeContext *tc)
 {
-    ParseNode *argpn, *argsbody;
-
     /* Flag tc so we don't have to lookup arguments on every use. */
     if (atom == tc->parser->context->runtime->atomState.argumentsAtom)
         tc->flags |= TCF_FUN_PARAM_ARGUMENTS;
 
     /*
      * Make an argument definition node, distinguished by being in tc->decls
-     * but having TOK_NAME type and JSOP_NOP op. Insert it in a TOK_ARGSBODY
+     * but having PNK_NAME kind and JSOP_NOP op. Insert it in a PNK_ARGSBODY
      * list node returned via pn->pn_body.
      */
-    argpn = NameNode::create(atom, tc);
+    ParseNode *argpn = NameNode::create(PNK_NAME, atom, tc);
     if (!argpn)
         return false;
-    JS_ASSERT(argpn->isKind(TOK_NAME) && argpn->isOp(JSOP_NOP));
+    JS_ASSERT(argpn->isKind(PNK_NAME) && argpn->isOp(JSOP_NOP));
 
     /* Arguments are initialized by definition. */
     argpn->pn_dflags |= PND_INITIALIZED;
     if (!Define(argpn, atom, tc))
         return false;
 
-    argsbody = pn->pn_body;
+    ParseNode *argsbody = pn->pn_body;
     if (!argsbody) {
-        argsbody = ListNode::create(tc);
+        argsbody = ListNode::create(PNK_ARGSBODY, tc);
         if (!argsbody)
             return false;
-        argsbody->setKind(TOK_ARGSBODY);
         argsbody->setOp(JSOP_NOP);
         argsbody->makeEmpty();
         pn->pn_body = argsbody;
@@ -1152,11 +1145,10 @@ LeaveFunction(ParseNode *fn, TreeContext *funtc, PropertyName *funName = NULL,
         if (funtc->lexdeps->count() - foundCallee != 0) {
             ParseNode *body = fn->pn_body;
 
-            fn->pn_body = NameSetNode::create(tc);
+            fn->pn_body = NameSetNode::create(PNK_UPVARS, tc);
             if (!fn->pn_body)
                 return false;
 
-            fn->pn_body->setKind(TOK_UPVARS);
             fn->pn_body->pn_pos = body->pn_pos;
             if (foundCallee)
                 funtc->lexdeps->remove(funName);
@@ -1256,23 +1248,22 @@ Parser::functionArguments(TreeContext &funtc, FunctionBox *funbox, ParseNode **l
                  * anonymous positional parameter into the destructuring
                  * left-hand-side expression and accumulate it in list.
                  */
-                ParseNode *rhs = NameNode::create(context->runtime->atomState.emptyAtom, &funtc);
+                ParseNode *rhs =
+                    NameNode::create(PNK_NAME, context->runtime->atomState.emptyAtom, &funtc);
                 if (!rhs)
                     return false;
-                rhs->setKind(TOK_NAME);
                 rhs->setOp(JSOP_GETARG);
                 rhs->pn_cookie.set(funtc.staticLevel, slot);
                 rhs->pn_dflags |= PND_BOUND;
 
                 ParseNode *item =
-                    ParseNode::newBinaryOrAppend(TOK_ASSIGN, JSOP_NOP, lhs, rhs, &funtc);
+                    ParseNode::newBinaryOrAppend(PNK_ASSIGN, JSOP_NOP, lhs, rhs, &funtc);
                 if (!item)
                     return false;
                 if (!list) {
-                    list = ListNode::create(&funtc);
+                    list = ListNode::create(PNK_VAR, &funtc);
                     if (!list)
                         return false;
-                    list->setKind(TOK_VAR);
                     list->makeEmpty();
                     *listp = list;
                 }
@@ -1347,8 +1338,7 @@ Parser::functionDef(PropertyName *funName, FunctionType type, FunctionSyntaxKind
     JS_ASSERT_IF(kind == Statement, funName);
 
     /* Make a TOK_FUNCTION node. */
-    tokenStream.mungeCurrentToken(TOK_FUNCTION, JSOP_NOP);
-    ParseNode *pn = FunctionNode::create(tc);
+    ParseNode *pn = FunctionNode::create(PNK_FUNCTION, tc);
     if (!pn)
         return NULL;
     pn->pn_body = NULL;
@@ -1408,7 +1398,7 @@ Parser::functionDef(PropertyName *funName, FunctionType type, FunctionSyntaxKind
 
             if (Definition *fn = tc->lexdeps.lookupDefn(funName)) {
                 JS_ASSERT(fn->isDefn());
-                fn->setKind(TOK_FUNCTION);
+                fn->setKind(PNK_FUNCTION);
                 fn->setArity(PN_FUNC);
                 fn->pn_pos.begin = pn->pn_pos.begin;
 
@@ -1569,28 +1559,26 @@ Parser::functionDef(PropertyName *funName, FunctionType type, FunctionSyntaxKind
     /*
      * If there were destructuring formal parameters, prepend the initializing
      * comma expression that we synthesized to body. If the body is a return
-     * node, we must make a special TOK_SEQ node, to prepend the destructuring
+     * node, we must make a special PNK_SEQ node, to prepend the destructuring
      * code without bracing the decompilation of the function body.
      */
     if (prelude) {
         if (!body->isArity(PN_LIST)) {
             ParseNode *block;
 
-            block = ListNode::create(outertc);
+            block = ListNode::create(PNK_SEQ, outertc);
             if (!block)
                 return NULL;
-            block->setKind(TOK_SEQ);
             block->pn_pos = body->pn_pos;
             block->initList(body);
 
             body = block;
         }
 
-        ParseNode *item = UnaryNode::create(outertc);
+        ParseNode *item = UnaryNode::create(PNK_SEMI, outertc);
         if (!item)
             return NULL;
 
-        item->setKind(TOK_SEMI);
         item->pn_pos.begin = item->pn_pos.end = body->pn_pos.begin;
         item->pn_kid = prelude;
         item->pn_next = body->pn_head;
@@ -1778,15 +1766,14 @@ Parser::recognizeDirectivePrologue(ParseNode *pn, bool *isDirectivePrologueMembe
 ParseNode *
 Parser::statements()
 {
-    ParseNode *pn, *pn2, *saveBlock;
+    ParseNode *pn2, *saveBlock;
     TokenKind tt;
 
     JS_CHECK_RECURSION(context, return NULL);
 
-    pn = ListNode::create(tc);
+    ParseNode *pn = ListNode::create(PNK_LC, tc);
     if (!pn)
         return NULL;
-    pn->setKind(TOK_LC);
     pn->makeEmpty();
     pn->pn_blockid = tc->blockid();
     saveBlock = tc->blockNode;
@@ -1814,7 +1801,7 @@ Parser::statements()
         if (inDirectivePrologue && !recognizeDirectivePrologue(pn2, &inDirectivePrologue))
             return NULL;
 
-        if (pn2->isKind(TOK_FUNCTION)) {
+        if (pn2->isKind(PNK_FUNCTION)) {
             /*
              * PNX_FUNCDEFS notifies the emitter that the block contains body-
              * level function definitions that should be processed before the
@@ -1860,10 +1847,11 @@ Parser::condition()
     MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_COND);
 
     /* Check for (a = b) and warn about possible (a == b) mistype. */
-    if (pn->isKind(TOK_ASSIGN) &&
-        pn->isOp(JSOP_NOP) &&
+    JS_ASSERT_IF(pn->isKind(PNK_ASSIGN), pn->isOp(JSOP_NOP));
+    if (pn->isKind(PNK_ASSIGN) &&
         !pn->isInParens() &&
-        !reportErrorNumber(NULL, JSREPORT_WARNING | JSREPORT_STRICT, JSMSG_EQUAL_AS_ASSIGN, "")) {
+        !reportErrorNumber(NULL, JSREPORT_WARNING | JSREPORT_STRICT, JSMSG_EQUAL_AS_ASSIGN, ""))
+    {
         return NULL;
     }
     return pn;
@@ -2036,7 +2024,7 @@ DefineGlobal(ParseNode *pn, BytecodeEmitter *bce, PropertyName *name)
         if (!globalObj->lookupProperty(cx, name, &holder, &prop))
             return false;
 
-        FunctionBox *funbox = pn->isKind(TOK_FUNCTION) ? pn->pn_funbox : NULL;
+        FunctionBox *funbox = pn->isKind(PNK_FUNCTION) ? pn->pn_funbox : NULL;
 
         GlobalScope::GlobalDef def;
         if (prop) {
@@ -2083,7 +2071,7 @@ DefineGlobal(ParseNode *pn, BytecodeEmitter *bce, PropertyName *name)
          * hoisted to the top of the script, and the |c = []| will just
          * overwrite it at runtime.
          */
-        if (pn->isKind(TOK_FUNCTION)) {
+        if (pn->isKind(PNK_FUNCTION)) {
             JS_ASSERT(pn->isArity(PN_FUNC));
             jsatomid index = p.value();
             globalScope->defs[index].funbox = pn->pn_funbox;
@@ -2271,7 +2259,7 @@ BindVarOrConst(JSContext *cx, BindData *data, JSAtom *atom, TreeContext *tc)
          * it and possibly reinitializes its value. Beware that if pn becomes a
          * use of |mdl.defn()|, and if we have an initializer for this var or
          * const (typically a const would ;-), then pn must be rewritten into a
-         * TOK_ASSIGN node. See Variables, further below.
+         * PNK_ASSIGN node. See js::Parser::variables, further below.
          *
          * A case such as let (x = 1) { var x = 2; print(x); } is even harder.
          * There the x definition is hoisted but the x = 2 assignment mutates
@@ -2286,7 +2274,7 @@ BindVarOrConst(JSContext *cx, BindData *data, JSAtom *atom, TreeContext *tc)
             ParseNode *pnu = pn;
 
             if (pn->isDefn()) {
-                pnu = NameNode::create(atom, tc);
+                pnu = NameNode::create(PNK_NAME, atom, tc);
                 if (!pnu)
                     return JS_FALSE;
             }
@@ -2318,12 +2306,11 @@ BindVarOrConst(JSContext *cx, BindData *data, JSAtom *atom, TreeContext *tc)
             if (tc->lexdeps->lookup(atom)) {
                 tc->lexdeps->remove(atom);
             } else {
-                ParseNode *pn2 = NameNode::create(atom, tc);
+                ParseNode *pn2 = NameNode::create(PNK_NAME, atom, tc);
                 if (!pn2)
                     return JS_FALSE;
 
                 /* The token stream may be past the location for pn. */
-                pn2->setKind(TOK_NAME);
                 pn2->pn_pos = pn->pn_pos;
                 pn = pn2;
             }
@@ -2355,7 +2342,7 @@ MakeSetCall(JSContext *cx, ParseNode *pn, TreeContext *tc, uintN msg)
         return false;
 
     ParseNode *pn2 = pn->pn_head;
-    if (pn2->isKind(TOK_FUNCTION) && (pn2->pn_funbox->tcflags & TCF_GENEXP_LAMBDA)) {
+    if (pn2->isKind(PNK_FUNCTION) && (pn2->pn_funbox->tcflags & TCF_GENEXP_LAMBDA)) {
         ReportCompileErrorNumber(cx, TS(tc->parser), pn, JSREPORT_ERROR, msg);
         return false;
     }
@@ -2420,7 +2407,7 @@ BindDestructuringVar(JSContext *cx, BindData *data, ParseNode *pn, TreeContext *
      * simple variable, we must check for assignment to 'arguments' and flag
      * the enclosing function (if any) as heavyweight.
      */
-    JS_ASSERT(pn->isKind(TOK_NAME));
+    JS_ASSERT(pn->isKind(PNK_NAME));
     atom = pn->pn_atom;
     if (atom == cx->runtime->atomState.argumentsAtom)
         tc->flags |= TCF_FUN_HEAVYWEIGHT;
@@ -2469,12 +2456,12 @@ static JSBool
 BindDestructuringLHS(JSContext *cx, ParseNode *pn, TreeContext *tc)
 {
     switch (pn->getKind()) {
-      case TOK_NAME:
+      case PNK_NAME:
         NoteLValue(cx, pn, tc);
         /* FALL THROUGH */
 
-      case TOK_DOT:
-      case TOK_LB:
+      case PNK_DOT:
+      case PNK_LB:
         /*
          * We may be called on a name node that has already been specialized,
          * in the very weird and ECMA-262-required "for (var [x] = i in o) ..."
@@ -2484,18 +2471,16 @@ BindDestructuringLHS(JSContext *cx, ParseNode *pn, TreeContext *tc)
             pn->setOp(JSOP_SETNAME);
         break;
 
-      case TOK_LP:
+      case PNK_LP:
         if (!MakeSetCall(cx, pn, tc, JSMSG_BAD_LEFTSIDE_OF_ASS))
             return JS_FALSE;
         break;
 
 #if JS_HAS_XML_SUPPORT
-      case TOK_UNARYOP:
-        if (pn->isOp(JSOP_XMLNAME)) {
-            pn->setOp(JSOP_BINDXMLNAME);
-            break;
-        }
-        /* FALL THROUGH */
+      case PNK_XMLUNARY:
+        JS_ASSERT(pn->isOp(JSOP_XMLNAME));
+        pn->setOp(JSOP_BINDXMLNAME);
+        break;
 #endif
 
       default:
@@ -2552,21 +2537,21 @@ CheckDestructuring(JSContext *cx, BindData *data, ParseNode *left, TreeContext *
 {
     bool ok;
 
-    if (left->isKind(TOK_ARRAYCOMP)) {
+    if (left->isKind(PNK_ARRAYCOMP)) {
         ReportCompileErrorNumber(cx, TS(tc->parser), left, JSREPORT_ERROR,
                                  JSMSG_ARRAY_COMP_LEFTSIDE);
         return false;
     }
 
-    if (left->isKind(TOK_RB)) {
+    if (left->isKind(PNK_RB)) {
         for (ParseNode *pn = left->pn_head; pn; pn = pn->pn_next) {
             /* Nullary comma is an elision; binary comma is an expression.*/
-            if (!pn->isKind(TOK_COMMA) || !pn->isArity(PN_NULLARY)) {
-                if (pn->isKind(TOK_RB) || pn->isKind(TOK_RC)) {
+            if (!pn->isKind(PNK_COMMA) || !pn->isArity(PN_NULLARY)) {
+                if (pn->isKind(PNK_RB) || pn->isKind(PNK_RC)) {
                     ok = CheckDestructuring(cx, data, pn, tc);
                 } else {
                     if (data) {
-                        if (!pn->isKind(TOK_NAME)) {
+                        if (!pn->isKind(PNK_NAME)) {
                             ReportCompileErrorNumber(cx, TS(tc->parser), pn, JSREPORT_ERROR,
                                                      JSMSG_NO_VARIABLE_NAME);
                             return false;
@@ -2581,15 +2566,15 @@ CheckDestructuring(JSContext *cx, BindData *data, ParseNode *left, TreeContext *
             }
         }
     } else {
-        JS_ASSERT(left->isKind(TOK_RC));
+        JS_ASSERT(left->isKind(PNK_RC));
         for (ParseNode *pair = left->pn_head; pair; pair = pair->pn_next) {
-            JS_ASSERT(pair->isKind(TOK_COLON));
+            JS_ASSERT(pair->isKind(PNK_COLON));
             ParseNode *pn = pair->pn_right;
 
-            if (pn->isKind(TOK_RB) || pn->isKind(TOK_RC)) {
+            if (pn->isKind(PNK_RB) || pn->isKind(PNK_RC)) {
                 ok = CheckDestructuring(cx, data, pn, tc);
             } else if (data) {
-                if (!pn->isKind(TOK_NAME)) {
+                if (!pn->isKind(PNK_NAME)) {
                     ReportCompileErrorNumber(cx, TS(tc->parser), pn, JSREPORT_ERROR,
                                              JSMSG_NO_VARIABLE_NAME);
                     return false;
@@ -2655,23 +2640,23 @@ CheckDestructuring(JSContext *cx, BindData *data, ParseNode *left, TreeContext *
 static void
 UndominateInitializers(ParseNode *left, const TokenPtr &end, TreeContext *tc)
 {
-    if (left->isKind(TOK_RB)) {
+    if (left->isKind(PNK_RB)) {
         for (ParseNode *pn = left->pn_head; pn; pn = pn->pn_next) {
             /* Nullary comma is an elision; binary comma is an expression.*/
-            if (!pn->isKind(TOK_COMMA) || !pn->isArity(PN_NULLARY)) {
-                if (pn->isKind(TOK_RB) || pn->isKind(TOK_RC))
+            if (!pn->isKind(PNK_COMMA) || !pn->isArity(PN_NULLARY)) {
+                if (pn->isKind(PNK_RB) || pn->isKind(PNK_RC))
                     UndominateInitializers(pn, end, tc);
                 else
                     pn->pn_pos.end = end;
             }
         }
     } else {
-        JS_ASSERT(left->isKind(TOK_RC));
+        JS_ASSERT(left->isKind(PNK_RC));
 
         for (ParseNode *pair = left->pn_head; pair; pair = pair->pn_next) {
-            JS_ASSERT(pair->isKind(TOK_COLON));
+            JS_ASSERT(pair->isKind(PNK_COLON));
             ParseNode *pn = pair->pn_right;
-            if (pn->isKind(TOK_RB) || pn->isKind(TOK_RC))
+            if (pn->isKind(PNK_RB) || pn->isKind(PNK_RC))
                 UndominateInitializers(pn, end, tc);
             else
                 pn->pn_pos.end = end;
@@ -2682,6 +2667,8 @@ UndominateInitializers(ParseNode *left, const TokenPtr &end, TreeContext *tc)
 ParseNode *
 Parser::destructuringExpr(BindData *data, TokenKind tt)
 {
+    JS_ASSERT(tokenStream.isCurrentTokenType(tt));
+
     tc->flags |= TCF_DECL_DESTRUCTURING;
     ParseNode *pn = primaryExpr(tt, JS_FALSE);
     tc->flags &= ~TCF_DECL_DESTRUCTURING;
@@ -2697,17 +2684,14 @@ Parser::destructuringExpr(BindData *data, TokenKind tt)
 ParseNode *
 Parser::returnOrYield(bool useAssignExpr)
 {
-    TokenKind tt, tt2;
-    ParseNode *pn, *pn2;
-
-    tt = tokenStream.currentToken().type;
+    TokenKind tt = tokenStream.currentToken().type;
     if (!tc->inFunction()) {
         reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_RETURN_OR_YIELD,
                           (tt == TOK_RETURN) ? js_return_str : js_yield_str);
         return NULL;
     }
 
-    pn = UnaryNode::create(tc);
+    ParseNode *pn = UnaryNode::create((tt == TOK_RETURN) ? PNK_RETURN : PNK_YIELD, tc);
     if (!pn)
         return NULL;
 
@@ -2727,7 +2711,7 @@ Parser::returnOrYield(bool useAssignExpr)
 #endif
 
     /* This is ugly, but we don't want to require a semicolon. */
-    tt2 = tokenStream.peekTokenSameLine(TSF_OPERAND);
+    TokenKind tt2 = tokenStream.peekTokenSameLine(TSF_OPERAND);
     if (tt2 == TOK_ERROR)
         return NULL;
 
@@ -2737,8 +2721,9 @@ Parser::returnOrYield(bool useAssignExpr)
             (tt2 != tt && tt2 != TOK_RB && tt2 != TOK_RP &&
              tt2 != TOK_COLON && tt2 != TOK_COMMA))
 #endif
-        ) {
-        pn2 = useAssignExpr ? assignExpr() : expr();
+        )
+    {
+        ParseNode *pn2 = useAssignExpr ? assignExpr() : expr();
         if (!pn2)
             return NULL;
 #if JS_HAS_GENERATORS
@@ -2776,7 +2761,7 @@ Parser::returnOrYield(bool useAssignExpr)
 static ParseNode *
 PushLexicalScope(JSContext *cx, TokenStream *ts, TreeContext *tc, StmtInfo *stmt)
 {
-    ParseNode *pn = LexicalScopeNode::create(tc);
+    ParseNode *pn = LexicalScopeNode::create(PNK_LEXICALSCOPE, tc);
     if (!pn)
         return NULL;
 
@@ -2789,7 +2774,6 @@ PushLexicalScope(JSContext *cx, TokenStream *ts, TreeContext *tc, StmtInfo *stmt
         return NULL;
 
     PushBlockScope(tc, stmt, blockbox, -1);
-    pn->setKind(TOK_LEXICALSCOPE);
     pn->setOp(JSOP_LEAVEBLOCK);
     pn->pn_objbox = blockbox;
     pn->pn_cookie.makeFree();
@@ -2805,23 +2789,21 @@ PushLexicalScope(JSContext *cx, TokenStream *ts, TreeContext *tc, StmtInfo *stmt
 ParseNode *
 Parser::letBlock(JSBool statement)
 {
-    ParseNode *pn, *pnblock, *pnlet;
-    StmtInfo stmtInfo;
-
     JS_ASSERT(tokenStream.currentToken().type == TOK_LET);
 
     /* Create the let binary node. */
-    pnlet = BinaryNode::create(tc);
+    ParseNode *pnlet = BinaryNode::create(PNK_LET, tc);
     if (!pnlet)
         return NULL;
 
     MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_LET);
 
     /* This is a let block or expression of the form: let (a, b, c) .... */
-    pnblock = PushLexicalScope(context, &tokenStream, tc, &stmtInfo);
+    StmtInfo stmtInfo;
+    ParseNode *pnblock = PushLexicalScope(context, &tokenStream, tc, &stmtInfo);
     if (!pnblock)
         return NULL;
-    pn = pnblock;
+    ParseNode *pn = pnblock;
     pn->pn_expr = pnlet;
 
     pnlet->pn_left = variables(true);
@@ -2850,10 +2832,9 @@ Parser::letBlock(JSBool statement)
          * need to wrap the TOK_LET node in a TOK_SEMI node so that we pop
          * the return value of the expression.
          */
-        pn = UnaryNode::create(tc);
+        pn = UnaryNode::create(PNK_SEMI, tc);
         if (!pn)
             return NULL;
-        pn->setKind(TOK_SEMI);
         pn->pn_num = -1;
         pn->pn_kid = pnblock;
 
@@ -2925,7 +2906,8 @@ NewBindingNode(JSAtom *atom, TreeContext *tc, bool let = false)
     }
 
     /* Make a new node for this declarator name (or destructuring pattern). */
-    pn = NameNode::create(atom, tc);
+    JS_ASSERT(tc->parser->tokenStream.currentToken().type == TOK_NAME);
+    pn = NameNode::create(PNK_NAME, atom, tc);
     if (!pn)
         return NULL;
 
@@ -2938,10 +2920,8 @@ NewBindingNode(JSAtom *atom, TreeContext *tc, bool let = false)
 ParseNode *
 Parser::switchStatement()
 {
-    ParseNode *pn5, *saveBlock;
-    JSBool seenDefault = JS_FALSE;
-
-    ParseNode *pn = BinaryNode::create(tc);
+    JS_ASSERT(tc->parser->tokenStream.currentToken().type == TOK_SWITCH);
+    ParseNode *pn = BinaryNode::create(PNK_SWITCH, tc);
     if (!pn)
         return NULL;
     MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_SWITCH);
@@ -2962,15 +2942,16 @@ Parser::switchStatement()
     PushStatement(tc, &stmtInfo, STMT_SWITCH, -1);
 
     /* pn2 is a list of case nodes. The default case has pn_left == NULL */
-    ParseNode *pn2 = ListNode::create(tc);
+    ParseNode *pn2 = ListNode::create(PNK_LC, tc);
     if (!pn2)
         return NULL;
     pn2->makeEmpty();
     if (!GenerateBlockIdForStmtNode(pn2, tc))
         return NULL;
-    saveBlock = tc->blockNode;
+    ParseNode *saveBlock = tc->blockNode;
     tc->blockNode = pn2;
 
+    bool seenDefault = false;
     TokenKind tt;
     while ((tt = tokenStream.getToken()) != TOK_RC) {
         ParseNode *pn3;
@@ -2980,24 +2961,20 @@ Parser::switchStatement()
                 reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_TOO_MANY_DEFAULTS);
                 return NULL;
             }
-            seenDefault = JS_TRUE;
-            /* FALL THROUGH */
+            seenDefault = true;
+            pn3 = BinaryNode::create(PNK_DEFAULT, tc);
+            if (!pn3)
+                return NULL;
+            break;
 
           case TOK_CASE:
           {
-            pn3 = BinaryNode::create(tc);
+            pn3 = BinaryNode::create(PNK_CASE, tc);
             if (!pn3)
                 return NULL;
-            if (tt == TOK_CASE) {
-                pn3->pn_left = expr();
-                if (!pn3->pn_left)
-                    return NULL;
-            }
-            pn2->append(pn3);
-            if (pn2->pn_count == JS_BIT(16)) {
-                reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_TOO_MANY_CASES);
+            pn3->pn_left = expr();
+            if (!pn3->pn_left)
                 return NULL;
-            }
             break;
           }
 
@@ -3008,18 +2985,24 @@ Parser::switchStatement()
             reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_SWITCH);
             return NULL;
         }
+
+        pn2->append(pn3);
+        if (pn2->pn_count == JS_BIT(16)) {
+            reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_TOO_MANY_CASES);
+            return NULL;
+        }
+
         MUST_MATCH_TOKEN(TOK_COLON, JSMSG_COLON_AFTER_CASE);
 
-        ParseNode *pn4 = ListNode::create(tc);
+        ParseNode *pn4 = ListNode::create(PNK_LC, tc);
         if (!pn4)
             return NULL;
-        pn4->setKind(TOK_LC);
         pn4->makeEmpty();
         while ((tt = tokenStream.peekToken(TSF_OPERAND)) != TOK_RC &&
                tt != TOK_CASE && tt != TOK_DEFAULT) {
             if (tt == TOK_ERROR)
                 return NULL;
-            pn5 = statement();
+            ParseNode *pn5 = statement();
             if (!pn5)
                 return NULL;
             pn4->pn_pos.end = pn5->pn_pos.end;
@@ -3053,6 +3036,8 @@ Parser::switchStatement()
 ParseNode *
 Parser::forStatement()
 {
+    JS_ASSERT(tokenStream.isCurrentTokenType(TOK_FOR));
+
     ParseNode *pnseq = NULL;
 #if JS_HAS_BLOCK_SCOPE
     ParseNode *pnlet = NULL;
@@ -3060,7 +3045,7 @@ Parser::forStatement()
 #endif
 
     /* A FOR node is binary, left is loop control and right is the body. */
-    ParseNode *pn = BinaryNode::create(tc);
+    ParseNode *pn = BinaryNode::create(PNK_FOR, tc);
     if (!pn)
         return NULL;
     StmtInfo stmtInfo;
@@ -3148,10 +3133,8 @@ Parser::forStatement()
      * as we've excluded 'in' from being parsed in RelExpr by setting
      * the TCF_IN_FOR_INIT flag in our TreeContext.
      */
-    ParseNode *pn2, *pn3;
-    ParseNode *pn4 = TernaryNode::create(tc);
-    if (!pn4)
-        return NULL;
+    TokenPos pos = tokenStream.currentToken().pos;
+    ParseNode *pn2, *pn3, *pn4;
     if (pn1 && tokenStream.matchToken(TOK_IN)) {
         /*
          * Parse the rest of the for/in head.
@@ -3170,29 +3153,29 @@ Parser::forStatement()
                || (versionNumber() == JSVERSION_1_7 &&
                    pn->isOp(JSOP_ITER) &&
                    !(pn->pn_iflags & JSITER_FOREACH) &&
-                   (pn1->pn_head->isKind(TOK_RC) ||
-                    (pn1->pn_head->isKind(TOK_RB) &&
+                   (pn1->pn_head->isKind(PNK_RC) ||
+                    (pn1->pn_head->isKind(PNK_RB) &&
                      pn1->pn_head->pn_count != 2) ||
-                    (pn1->pn_head->isKind(TOK_ASSIGN) &&
-                     (!pn1->pn_head->pn_left->isKind(TOK_RB) ||
+                    (pn1->pn_head->isKind(PNK_ASSIGN) &&
+                     (!pn1->pn_head->pn_left->isKind(PNK_RB) ||
                       pn1->pn_head->pn_left->pn_count != 2))))
 #endif
               )
-            : (!pn1->isKind(TOK_NAME) &&
-               !pn1->isKind(TOK_DOT) &&
+            : (!pn1->isKind(PNK_NAME) &&
+               !pn1->isKind(PNK_DOT) &&
 #if JS_HAS_DESTRUCTURING
                ((versionNumber() == JSVERSION_1_7 &&
                  pn->isOp(JSOP_ITER) &&
                  !(pn->pn_iflags & JSITER_FOREACH))
-                ? (!pn1->isKind(TOK_RB) || pn1->pn_count != 2)
-                : (!pn1->isKind(TOK_RB) && !pn1->isKind(TOK_RC))) &&
+                ? (!pn1->isKind(PNK_RB) || pn1->pn_count != 2)
+                : (!pn1->isKind(PNK_RB) && !pn1->isKind(PNK_RC))) &&
 #endif
-               !pn1->isKind(TOK_LP) &&
+               !pn1->isKind(PNK_LP) &&
 #if JS_HAS_XML_SUPPORT
-               (!pn1->isKind(TOK_UNARYOP) ||
-                !pn1->isOp(JSOP_XMLNAME)) &&
+               !pn1->isKind(PNK_XMLUNARY) &&
 #endif
-               !pn1->isKind(TOK_LB))) {
+               !pn1->isKind(PNK_LB)))
+        {
             reportErrorNumber(pn1, JSREPORT_ERROR, JSMSG_BAD_FOR_LEFTSIDE);
             return NULL;
         }
@@ -3210,11 +3193,12 @@ Parser::forStatement()
             pn1->pn_xflags |= PNX_FORINVAR;
 
             pn2 = pn1->pn_head;
-            if ((pn2->isKind(TOK_NAME) && pn2->maybeExpr())
+            if ((pn2->isKind(PNK_NAME) && pn2->maybeExpr())
 #if JS_HAS_DESTRUCTURING
-                || pn2->isKind(TOK_ASSIGN)
+                || pn2->isKind(PNK_ASSIGN)
 #endif
-                ) {
+                )
+            {
                 /*
                  * Declaration with initializer.
                  *
@@ -3229,10 +3213,9 @@ Parser::forStatement()
                 }
 #endif /* JS_HAS_BLOCK_SCOPE */
 
-                pnseq = ListNode::create(tc);
+                pnseq = ListNode::create(PNK_SEQ, tc);
                 if (!pnseq)
                     return NULL;
-                pnseq->setKind(TOK_SEQ);
                 pnseq->pn_pos.begin = pn->pn_pos.begin;
 
                 dflag = PND_INITIALIZED;
@@ -3250,10 +3233,10 @@ Parser::forStatement()
                 pnseq->initList(pn1);
 
 #if JS_HAS_DESTRUCTURING
-                if (pn2->isKind(TOK_ASSIGN)) {
+                if (pn2->isKind(PNK_ASSIGN)) {
                     pn2 = pn2->pn_left;
-                    JS_ASSERT(pn2->isKind(TOK_RB) || pn2->isKind(TOK_RC) ||
-                              pn2->isKind(TOK_NAME));
+                    JS_ASSERT(pn2->isKind(PNK_RB) || pn2->isKind(PNK_RC) ||
+                              pn2->isKind(PNK_NAME));
                 }
 #endif
                 pn1 = NULL;
@@ -3276,18 +3259,18 @@ Parser::forStatement()
         }
 
         switch (pn2->getKind()) {
-          case TOK_NAME:
+          case PNK_NAME:
             /* Beware 'for (arguments in ...)' with or without a 'var'. */
             NoteLValue(context, pn2, tc, dflag);
             break;
 
 #if JS_HAS_DESTRUCTURING
-          case TOK_ASSIGN:
+          case PNK_ASSIGN:
             JS_NOT_REACHED("forStatement TOK_ASSIGN");
             break;
 
-          case TOK_RB:
-          case TOK_RC:
+          case PNK_RB:
+          case PNK_RC:
             if (versionNumber() == JSVERSION_1_7) {
                 /*
                  * Destructuring for-in requires [key, value] enumeration
@@ -3321,7 +3304,9 @@ Parser::forStatement()
             tc->topStmt = save;
 #endif
 
-        pn4->setKind(TOK_IN);
+        pn4 = TernaryNode::create(PNK_IN, tc);
+        if (!pn4)
+            return NULL;
     } else {
         if (pn->pn_iflags & JSITER_FOREACH) {
             reportErrorNumber(pn, JSREPORT_ERROR, JSMSG_BAD_FOR_EACH_LOOP);
@@ -3351,8 +3336,11 @@ Parser::forStatement()
                 return NULL;
         }
 
-        pn4->setKind(TOK_FORHEAD);
+        pn4 = TernaryNode::create(PNK_FORHEAD, tc);
+        if (!pn4)
+            return NULL;
     }
+    pn4->pn_pos = pos;
     pn4->setOp(JSOP_NOP);
     pn4->pn_kid1 = pn1;
     pn4->pn_kid2 = pn2;
@@ -3389,7 +3377,7 @@ Parser::forStatement()
 ParseNode *
 Parser::tryStatement()
 {
-    ParseNode *catchList, *lastCatch;
+    JS_ASSERT(tokenStream.isCurrentTokenType(TOK_TRY));
 
     /*
      * try nodes are ternary.
@@ -3408,7 +3396,7 @@ Parser::tryStatement()
      *
      * finally nodes are TOK_LC statement lists.
      */
-    ParseNode *pn = TernaryNode::create(tc);
+    ParseNode *pn = TernaryNode::create(PNK_TRY, tc);
     if (!pn)
         return NULL;
     pn->setOp(JSOP_NOP);
@@ -3423,13 +3411,13 @@ Parser::tryStatement()
     MUST_MATCH_TOKEN(TOK_RC, JSMSG_CURLY_AFTER_TRY);
     PopStatement(tc);
 
-    catchList = NULL;
+    ParseNode *lastCatch;
+    ParseNode *catchList = NULL;
     TokenKind tt = tokenStream.getToken();
     if (tt == TOK_CATCH) {
-        catchList = ListNode::create(tc);
+        catchList = ListNode::create(PNK_CATCHLIST, tc);
         if (!catchList)
             return NULL;
-        catchList->setKind(TOK_RESERVED);
         catchList->makeEmpty();
         lastCatch = NULL;
 
@@ -3459,7 +3447,7 @@ Parser::tryStatement()
              * where lhs is a name or a destructuring left-hand side.
              * (the latter is legal only #ifdef JS_HAS_CATCH_GUARD)
              */
-            ParseNode *pn2 = TernaryNode::create(tc);
+            ParseNode *pn2 = TernaryNode::create(PNK_CATCH, tc);
             if (!pn2)
                 return NULL;
             pnblock->pn_expr = pn2;
@@ -3555,6 +3543,8 @@ Parser::tryStatement()
 ParseNode *
 Parser::withStatement()
 {
+    JS_ASSERT(tokenStream.isCurrentTokenType(TOK_WITH));
+
     /*
      * In most cases, we want the constructs forbidden in strict mode
      * code to be a subset of those that JSOPTION_STRICT warns about, and
@@ -3568,7 +3558,7 @@ Parser::withStatement()
         return NULL;
     }
 
-    ParseNode *pn = BinaryNode::create(tc);
+    ParseNode *pn = BinaryNode::create(PNK_WITH, tc);
     if (!pn)
         return NULL;
     MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_WITH);
@@ -3619,7 +3609,7 @@ Parser::letStatement()
                 return pn;
 
             /* Let expressions require automatic semicolon insertion. */
-            JS_ASSERT(pn->isKind(TOK_SEMI) || pn->isOp(JSOP_LEAVEBLOCKEXPR));
+            JS_ASSERT(pn->isKind(PNK_SEMI) || pn->isOp(JSOP_LEAVEBLOCKEXPR));
             break;
         }
 
@@ -3697,15 +3687,14 @@ Parser::letStatement()
 
 #ifdef DEBUG
             ParseNode *tmp = tc->blockNode;
-            JS_ASSERT(!tmp || !tmp->isKind(TOK_LEXICALSCOPE));
+            JS_ASSERT(!tmp || !tmp->isKind(PNK_LEXICALSCOPE));
 #endif
 
             /* Create a new lexical scope node for these statements. */
-            ParseNode *pn1 = LexicalScopeNode::create(tc);
+            ParseNode *pn1 = LexicalScopeNode::create(PNK_LEXICALSCOPE, tc);
             if (!pn1)
                 return NULL;
 
-            pn1->setKind(TOK_LEXICALSCOPE);
             pn1->setOp(JSOP_LEAVEBLOCK);
             pn1->pn_pos = tc->blockNode->pn_pos;
             pn1->pn_objbox = blockbox;
@@ -3734,7 +3723,7 @@ Parser::expressionStatement()
         return NULL;
 
     if (tokenStream.peekToken() == TOK_COLON) {
-        if (!pn2->isKind(TOK_NAME)) {
+        if (!pn2->isKind(PNK_NAME)) {
             reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_LABEL);
             return NULL;
         }
@@ -3758,49 +3747,49 @@ Parser::expressionStatement()
             return NULL;
 
         /* Normalize empty statement to empty block for the decompiler. */
-        if (pn->isKind(TOK_SEMI) && !pn->pn_kid) {
-            pn->setKind(TOK_LC);
+        if (pn->isKind(PNK_SEMI) && !pn->pn_kid) {
+            pn->setKind(PNK_LC);
             pn->setArity(PN_LIST);
             pn->makeEmpty();
         }
 
         /* Pop the label, set pn_expr, and return early. */
         PopStatement(tc);
-        pn2->setKind(TOK_COLON);
+        pn2->setKind(PNK_COLON);
         pn2->pn_pos.end = pn->pn_pos.end;
         pn2->pn_expr = pn;
         return pn2;
     }
 
-    ParseNode *pn = UnaryNode::create(tc);
+    ParseNode *pn = UnaryNode::create(PNK_SEMI, tc);
     if (!pn)
         return NULL;
-    pn->setKind(TOK_SEMI);
     pn->pn_pos = pn2->pn_pos;
     pn->pn_kid = pn2;
 
     switch (pn2->getKind()) {
-      case TOK_LP:
+      case PNK_LP:
         /*
          * Flag lambdas immediately applied as statements as instances of
          * the JS "module pattern". See CheckForImmediatelyAppliedLambda.
          */
-        if (pn2->pn_head->isKind(TOK_FUNCTION) &&
+        if (pn2->pn_head->isKind(PNK_FUNCTION) &&
             !pn2->pn_head->pn_funbox->node->isFunArg()) {
             pn2->pn_head->pn_funbox->tcflags |= TCF_FUN_MODULE_PATTERN;
         }
         break;
-      case TOK_ASSIGN:
+      case PNK_ASSIGN:
         /*
          * Keep track of all apparent methods created by assignments such
          * as this.foo = function (...) {...} in a function that could end
          * up a constructor function. See Parser::setFunctionKinds.
          */
+        JS_ASSERT(pn2->isOp(JSOP_NOP));
         if (tc->funbox &&
-            pn2->isOp(JSOP_NOP) &&
             pn2->pn_left->isOp(JSOP_SETPROP) &&
-            pn2->pn_left->pn_expr->isOp(JSOP_THIS) &&
-            pn2->pn_right->isOp(JSOP_LAMBDA)) {
+            pn2->pn_left->pn_expr->isKind(PNK_THIS) &&
+            pn2->pn_right->isOp(JSOP_LAMBDA))
+        {
             JS_ASSERT(!pn2->isDefn());
             JS_ASSERT(!pn2->isUsed());
             pn2->pn_right->pn_link = tc->funbox->methods;
@@ -3837,7 +3826,7 @@ Parser::statement()
       case TOK_IF:
       {
         /* An IF node has three kids: condition, then, and optional else. */
-        pn = TernaryNode::create(tc);
+        pn = TernaryNode::create(PNK_IF, tc);
         if (!pn)
             return NULL;
         ParseNode *pn1 = condition();
@@ -3871,7 +3860,7 @@ Parser::statement()
 
       case TOK_WHILE:
       {
-        pn = BinaryNode::create(tc);
+        pn = BinaryNode::create(PNK_WHILE, tc);
         if (!pn)
             return NULL;
         StmtInfo stmtInfo;
@@ -3891,7 +3880,7 @@ Parser::statement()
 
       case TOK_DO:
       {
-        pn = BinaryNode::create(tc);
+        pn = BinaryNode::create(PNK_DO, tc);
         if (!pn)
             return NULL;
         StmtInfo stmtInfo;
@@ -3927,7 +3916,7 @@ Parser::statement()
 
       case TOK_THROW:
       {
-        pn = UnaryNode::create(tc);
+        pn = UnaryNode::create(PNK_THROW, tc);
         if (!pn)
             return NULL;
 
@@ -3960,7 +3949,7 @@ Parser::statement()
 
       case TOK_BREAK:
       {
-        pn = NullaryNode::create(tc);
+        pn = NullaryNode::create(PNK_BREAK, tc);
         if (!pn)
             return NULL;
         if (!MatchLabel(context, &tokenStream, pn))
@@ -3993,7 +3982,7 @@ Parser::statement()
 
       case TOK_CONTINUE:
       {
-        pn = NullaryNode::create(tc);
+        pn = NullaryNode::create(PNK_CONTINUE, tc);
         if (!pn)
             return NULL;
         if (!MatchLabel(context, &tokenStream, pn))
@@ -4085,17 +4074,15 @@ Parser::statement()
       }
 
       case TOK_SEMI:
-        pn = UnaryNode::create(tc);
+        pn = UnaryNode::create(PNK_SEMI, tc);
         if (!pn)
             return NULL;
-        pn->setKind(TOK_SEMI);
         return pn;
 
       case TOK_DEBUGGER:
-        pn = NullaryNode::create(tc);
+        pn = NullaryNode::create(PNK_DEBUGGER, tc);
         if (!pn)
             return NULL;
-        pn->setKind(TOK_DEBUGGER);
         tc->flags |= TCF_FUN_HEAVYWEIGHT;
         break;
 
@@ -4105,19 +4092,21 @@ Parser::statement()
         if (tc->inStrictMode())
             return expressionStatement();
 
-        pn = UnaryNode::create(tc);
+        pn = UnaryNode::create(PNK_DEFAULT, tc);
         if (!pn)
             return NULL;
         if (!tokenStream.matchToken(TOK_NAME) ||
             tokenStream.currentToken().name() != context->runtime->atomState.xmlAtom ||
             !tokenStream.matchToken(TOK_NAME) ||
             tokenStream.currentToken().name() != context->runtime->atomState.namespaceAtom ||
-            !tokenStream.matchToken(TOK_ASSIGN) ||
-            tokenStream.currentToken().t_op != JSOP_NOP) {
+            !tokenStream.matchToken(TOK_ASSIGN))
+        {
             reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_DEFAULT_XML_NAMESPACE);
             return NULL;
         }
 
+        JS_ASSERT(tokenStream.currentToken().t_op == JSOP_NOP);
+
         /* Is this an E4X dagger I see before me? */
         tc->flags |= TCF_FUN_HEAVYWEIGHT;
         ParseNode *pn2 = expr();
@@ -4144,21 +4133,16 @@ Parser::statement()
 ParseNode *
 Parser::variables(bool inLetHead)
 {
-    TokenKind tt;
-    bool let;
-    StmtInfo *scopeStmt;
-    BindData data;
-    ParseNode *pn, *pn2;
-
     /*
      * The three options here are:
+     * - TOK_VAR: We're parsing var declarations.
      * - TOK_LET: We are parsing a let declaration.
      * - TOK_LP: We are parsing the head of a let block.
-     * - Otherwise, we're parsing var declarations.
      */
-    tt = tokenStream.currentToken().type;
-    let = (tt == TOK_LET || tt == TOK_LP);
-    JS_ASSERT(let || tt == TOK_VAR);
+    TokenKind tt = tokenStream.currentToken().type;
+    JS_ASSERT(tt == TOK_VAR || tt == TOK_LET || tt == TOK_LP);
+
+    bool let = (tt == TOK_LET || tt == TOK_LP);
 
 #if JS_HAS_BLOCK_SCOPE
     bool popScope = (inLetHead || (let && (tc->flags & TCF_IN_FOR_INIT)));
@@ -4166,7 +4150,7 @@ Parser::variables(bool inLetHead)
 #endif
 
     /* Make sure that statement set up the tree context correctly. */
-    scopeStmt = tc->topScopeStmt;
+    StmtInfo *scopeStmt = tc->topScopeStmt;
     if (let) {
         while (scopeStmt && !(scopeStmt->flags & SIF_SCOPE)) {
             JS_ASSERT(!STMT_MAYBE_SCOPE(scopeStmt));
@@ -4175,8 +4159,9 @@ Parser::variables(bool inLetHead)
         JS_ASSERT(scopeStmt);
     }
 
+    BindData data;
     data.op = let ? JSOP_NOP : tokenStream.currentToken().t_op;
-    pn = ListNode::create(tc);
+    ParseNode *pn = ListNode::create(tt == TOK_LET ? PNK_LET : tt == TOK_VAR ? PNK_VAR : PNK_LP, tc);
     if (!pn)
         return NULL;
     pn->setOp(data.op);
@@ -4195,6 +4180,7 @@ Parser::variables(bool inLetHead)
         data.binder = BindVarOrConst;
     }
 
+    ParseNode *pn2;
     do {
         tt = tokenStream.getToken();
 #if JS_HAS_DESTRUCTURING
@@ -4213,8 +4199,7 @@ Parser::variables(bool inLetHead)
             }
 
             MUST_MATCH_TOKEN(TOK_ASSIGN, JSMSG_BAD_DESTRUCT_DECL);
-            if (tokenStream.currentToken().t_op != JSOP_NOP)
-                goto bad_var_init;
+            JS_ASSERT(tokenStream.currentToken().t_op == JSOP_NOP);
 
 #if JS_HAS_BLOCK_SCOPE
             if (popScope) {
@@ -4234,7 +4219,7 @@ Parser::variables(bool inLetHead)
                 return NULL;
             UndominateInitializers(pn2, init->pn_pos.end, tc);
 
-            pn2 = ParseNode::newBinaryOrAppend(TOK_ASSIGN, JSOP_NOP, pn2, init, tc);
+            pn2 = ParseNode::newBinaryOrAppend(PNK_ASSIGN, JSOP_NOP, pn2, init, tc);
             if (!pn2)
                 return NULL;
             pn->append(pn2);
@@ -4260,8 +4245,7 @@ Parser::variables(bool inLetHead)
         pn->append(pn2);
 
         if (tokenStream.matchToken(TOK_ASSIGN)) {
-            if (tokenStream.currentToken().t_op != JSOP_NOP)
-                goto bad_var_init;
+            JS_ASSERT(tokenStream.currentToken().t_op == JSOP_NOP);
 
 #if JS_HAS_BLOCK_SCOPE
             if (popScope) {
@@ -4312,10 +4296,6 @@ Parser::variables(bool inLetHead)
 
     pn->pn_pos.end = pn->last()->pn_pos.end;
     return pn;
-
-bad_var_init:
-    reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_VAR_INIT);
-    return NULL;
 }
 
 ParseNode *
@@ -4323,7 +4303,7 @@ Parser::expr()
 {
     ParseNode *pn = assignExpr();
     if (pn && tokenStream.matchToken(TOK_COMMA)) {
-        ParseNode *pn2 = ListNode::create(tc);
+        ParseNode *pn2 = ListNode::create(PNK_COMMA, tc);
         if (!pn2)
             return NULL;
         pn2->pn_pos.begin = pn->pn_pos.begin;
@@ -4332,7 +4312,7 @@ Parser::expr()
         do {
 #if JS_HAS_GENERATORS
             pn2 = pn->last();
-            if (pn2->isKind(TOK_YIELD) && !pn2->isInParens()) {
+            if (pn2->isKind(PNK_YIELD) && !pn2->isInParens()) {
                 reportErrorNumber(pn2, JSREPORT_ERROR, JSMSG_BAD_GENERATOR_SYNTAX, js_yield_str);
                 return NULL;
             }
@@ -4365,7 +4345,6 @@ Parser::expr()
 
 BEGIN_EXPR_PARSER(mulExpr1)
 {
-    TokenKind tt;
     ParseNode *pn = unaryExpr();
 
     /*
@@ -4373,10 +4352,15 @@ BEGIN_EXPR_PARSER(mulExpr1)
      * isCurrentTokenType() because unaryExpr() doesn't leave the TokenStream
      * state one past the end of the unary expression.
      */
-    while (pn && ((tt = tokenStream.getToken()) == TOK_STAR || tt == TOK_DIVOP)) {
-        tt = tokenStream.currentToken().type;
+    TokenKind tt;
+    while (pn && ((tt = tokenStream.getToken()) == TOK_STAR || tt == TOK_DIV || tt == TOK_MOD)) {
+        ParseNodeKind kind = (tt == TOK_STAR)
+                             ? PNK_STAR
+                             : (tt == TOK_DIV)
+                             ? PNK_DIV
+                             : PNK_MOD;
         JSOp op = tokenStream.currentToken().t_op;
-        pn = ParseNode::newBinaryOrAppend(tt, op, pn, unaryExpr(), tc);
+        pn = ParseNode::newBinaryOrAppend(kind, op, pn, unaryExpr(), tc);
     }
     return pn;
 }
@@ -4388,23 +4372,62 @@ BEGIN_EXPR_PARSER(addExpr1)
     while (pn && tokenStream.isCurrentTokenType(TOK_PLUS, TOK_MINUS)) {
         TokenKind tt = tokenStream.currentToken().type;
         JSOp op = (tt == TOK_PLUS) ? JSOP_ADD : JSOP_SUB;
-        pn = ParseNode::newBinaryOrAppend(tt, op, pn, mulExpr1n(), tc);
+        ParseNodeKind kind = (tt == TOK_PLUS) ? PNK_PLUS : PNK_MINUS;
+        pn = ParseNode::newBinaryOrAppend(kind, op, pn, mulExpr1n(), tc);
     }
     return pn;
 }
 END_EXPR_PARSER(addExpr1)
 
+inline ParseNodeKind
+ShiftTokenToParseNodeKind(const Token &token)
+{
+    switch (token.type) {
+      case TOK_LSH:
+        return PNK_LSH;
+      case TOK_RSH:
+        return PNK_RSH;
+      default:
+        JS_ASSERT(token.type == TOK_URSH);
+        return PNK_URSH;
+    }
+}
+
 BEGIN_EXPR_PARSER(shiftExpr1)
 {
-    ParseNode *pn = addExpr1i();
-    while (pn && tokenStream.isCurrentTokenType(TOK_SHOP)) {
+    ParseNode *left = addExpr1i();
+    while (left && tokenStream.isCurrentTokenShift()) {
+        ParseNodeKind kind = ShiftTokenToParseNodeKind(tokenStream.currentToken());
         JSOp op = tokenStream.currentToken().t_op;
-        pn = ParseNode::newBinaryOrAppend(TOK_SHOP, op, pn, addExpr1n(), tc);
+        ParseNode *right = addExpr1n();
+        if (!right)
+            return NULL;
+        left = tc->parser->new_<BinaryNode>(kind, op, left, right);
     }
-    return pn;
+    return left;
 }
 END_EXPR_PARSER(shiftExpr1)
 
+inline ParseNodeKind
+RelationalTokenToParseNodeKind(const Token &token)
+{
+    switch (token.type) {
+      case TOK_IN:
+        return PNK_IN;
+      case TOK_INSTANCEOF:
+        return PNK_INSTANCEOF;
+      case TOK_LT:
+        return PNK_LT;
+      case TOK_LE:
+        return PNK_LE;
+      case TOK_GT:
+        return PNK_GT;
+      default:
+        JS_ASSERT(token.type == TOK_GE);
+        return PNK_GE;
+    }
+}
+
 BEGIN_EXPR_PARSER(relExpr1)
 {
     uintN inForInitFlag = tc->flags & TCF_IN_FOR_INIT;
@@ -4417,16 +4440,16 @@ BEGIN_EXPR_PARSER(relExpr1)
 
     ParseNode *pn = shiftExpr1i();
     while (pn &&
-           (tokenStream.isCurrentTokenType(TOK_RELOP) ||
+           (tokenStream.isCurrentTokenRelational() ||
             /*
              * Recognize the 'in' token as an operator only if we're not
              * currently in the init expr of a for loop.
              */
             (inForInitFlag == 0 && tokenStream.isCurrentTokenType(TOK_IN)) ||
             tokenStream.isCurrentTokenType(TOK_INSTANCEOF))) {
-        TokenKind tt = tokenStream.currentToken().type;
+        ParseNodeKind kind = RelationalTokenToParseNodeKind(tokenStream.currentToken());
         JSOp op = tokenStream.currentToken().t_op;
-        pn = ParseNode::newBinaryOrAppend(tt, op, pn, shiftExpr1n(), tc);
+        pn = ParseNode::newBinaryOrAppend(kind, op, pn, shiftExpr1n(), tc);
     }
     /* Restore previous state of inForInit flag. */
     tc->flags |= inForInitFlag;
@@ -4435,14 +4458,34 @@ BEGIN_EXPR_PARSER(relExpr1)
 }
 END_EXPR_PARSER(relExpr1)
 
+inline ParseNodeKind
+EqualityTokenToParseNodeKind(const Token &token)
+{
+    switch (token.type) {
+      case TOK_STRICTEQ:
+        return PNK_STRICTEQ;
+      case TOK_EQ:
+        return PNK_EQ;
+      case TOK_STRICTNE:
+        return PNK_STRICTNE;
+      default:
+        JS_ASSERT(token.type == TOK_NE);
+        return PNK_NE;
+    }
+}
+
 BEGIN_EXPR_PARSER(eqExpr1)
 {
-    ParseNode *pn = relExpr1i();
-    while (pn && tokenStream.isCurrentTokenType(TOK_EQOP)) {
+    ParseNode *left = relExpr1i();
+    while (left && tokenStream.isCurrentTokenEquality()) {
+        ParseNodeKind kind = EqualityTokenToParseNodeKind(tokenStream.currentToken());
         JSOp op = tokenStream.currentToken().t_op;
-        pn = ParseNode::newBinaryOrAppend(TOK_EQOP, op, pn, relExpr1n(), tc);
+        ParseNode *right = relExpr1n();
+        if (!right)
+            return NULL;
+        left = tc->parser->new_<BinaryNode>(kind, op, left, right);
     }
-    return pn;
+    return left;
 }
 END_EXPR_PARSER(eqExpr1)
 
@@ -4450,7 +4493,7 @@ BEGIN_EXPR_PARSER(bitAndExpr1)
 {
     ParseNode *pn = eqExpr1i();
     while (pn && tokenStream.isCurrentTokenType(TOK_BITAND))
-        pn = ParseNode::newBinaryOrAppend(TOK_BITAND, JSOP_BITAND, pn, eqExpr1n(), tc);
+        pn = ParseNode::newBinaryOrAppend(PNK_BITAND, JSOP_BITAND, pn, eqExpr1n(), tc);
     return pn;
 }
 END_EXPR_PARSER(bitAndExpr1)
@@ -4459,7 +4502,7 @@ BEGIN_EXPR_PARSER(bitXorExpr1)
 {
     ParseNode *pn = bitAndExpr1i();
     while (pn && tokenStream.isCurrentTokenType(TOK_BITXOR))
-        pn = ParseNode::newBinaryOrAppend(TOK_BITXOR, JSOP_BITXOR, pn, bitAndExpr1n(), tc);
+        pn = ParseNode::newBinaryOrAppend(PNK_BITXOR, JSOP_BITXOR, pn, bitAndExpr1n(), tc);
     return pn;
 }
 END_EXPR_PARSER(bitXorExpr1)
@@ -4468,7 +4511,7 @@ BEGIN_EXPR_PARSER(bitOrExpr1)
 {
     ParseNode *pn = bitXorExpr1i();
     while (pn && tokenStream.isCurrentTokenType(TOK_BITOR))
-        pn = ParseNode::newBinaryOrAppend(TOK_BITOR, JSOP_BITOR, pn, bitXorExpr1n(), tc);
+        pn = ParseNode::newBinaryOrAppend(PNK_BITOR, JSOP_BITOR, pn, bitXorExpr1n(), tc);
     return pn;
 }
 END_EXPR_PARSER(bitOrExpr1)
@@ -4477,7 +4520,7 @@ BEGIN_EXPR_PARSER(andExpr1)
 {
     ParseNode *pn = bitOrExpr1i();
     while (pn && tokenStream.isCurrentTokenType(TOK_AND))
-        pn = ParseNode::newBinaryOrAppend(TOK_AND, JSOP_AND, pn, bitOrExpr1n(), tc);
+        pn = ParseNode::newBinaryOrAppend(PNK_AND, JSOP_AND, pn, bitOrExpr1n(), tc);
     return pn;
 }
 END_EXPR_PARSER(andExpr1)
@@ -4487,7 +4530,7 @@ Parser::orExpr1()
 {
     ParseNode *pn = andExpr1i();
     while (pn && tokenStream.isCurrentTokenType(TOK_OR))
-        pn = ParseNode::newBinaryOrAppend(TOK_OR, JSOP_OR, pn, andExpr1n(), tc);
+        pn = ParseNode::newBinaryOrAppend(PNK_OR, JSOP_OR, pn, andExpr1n(), tc);
     return pn;
 }
 
@@ -4497,7 +4540,7 @@ Parser::condExpr1()
     ParseNode *pn = orExpr1();
     if (pn && tokenStream.isCurrentTokenType(TOK_HOOK)) {
         ParseNode *pn1 = pn;
-        pn = TernaryNode::create(tc);
+        pn = TernaryNode::create(PNK_HOOK, tc);
         if (!pn)
             return NULL;
 
@@ -4531,21 +4574,21 @@ bool
 Parser::setAssignmentLhsOps(ParseNode *pn, JSOp op)
 {
     switch (pn->getKind()) {
-      case TOK_NAME:
+      case PNK_NAME:
         if (!CheckStrictAssignment(context, tc, pn))
             return false;
         pn->setOp(pn->isOp(JSOP_GETLOCAL) ? JSOP_SETLOCAL : JSOP_SETNAME);
         NoteLValue(context, pn, tc);
         break;
-      case TOK_DOT:
+      case PNK_DOT:
         pn->setOp(JSOP_SETPROP);
         break;
-      case TOK_LB:
+      case PNK_LB:
         pn->setOp(JSOP_SETELEM);
         break;
 #if JS_HAS_DESTRUCTURING
-      case TOK_RB:
-      case TOK_RC:
+      case PNK_RB:
+      case PNK_RC:
         if (op != JSOP_NOP) {
             reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_DESTRUCT_ASS);
             return false;
@@ -4554,17 +4597,15 @@ Parser::setAssignmentLhsOps(ParseNode *pn, JSOp op)
             return false;
         break;
 #endif
-      case TOK_LP:
+      case PNK_LP:
         if (!MakeSetCall(context, pn, tc, JSMSG_BAD_LEFTSIDE_OF_ASS))
             return false;
         break;
 #if JS_HAS_XML_SUPPORT
-      case TOK_UNARYOP:
-        if (pn->isOp(JSOP_XMLNAME)) {
-            pn->setOp(JSOP_SETXMLNAME);
-            break;
-        }
-        /* FALL THROUGH */
+      case PNK_XMLUNARY:
+        JS_ASSERT(pn->isOp(JSOP_XMLNAME));
+        pn->setOp(JSOP_SETXMLNAME);
+        break;
 #endif
       default:
         reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_LEFTSIDE_OF_ASS);
@@ -4583,24 +4624,39 @@ Parser::assignExpr()
         return returnOrYield(true);
 #endif
 
-    ParseNode *pn = condExpr1();
-    if (!pn)
+    ParseNode *lhs = condExpr1();
+    if (!lhs)
         return NULL;
 
-    if (!tokenStream.isCurrentTokenType(TOK_ASSIGN)) {
+    ParseNodeKind kind;
+    switch (tokenStream.currentToken().type) {
+      case TOK_ASSIGN:       kind = PNK_ASSIGN;       break;
+      case TOK_ADDASSIGN:    kind = PNK_ADDASSIGN;    break;
+      case TOK_SUBASSIGN:    kind = PNK_SUBASSIGN;    break;
+      case TOK_BITORASSIGN:  kind = PNK_BITORASSIGN;  break;
+      case TOK_BITXORASSIGN: kind = PNK_BITXORASSIGN; break;
+      case TOK_BITANDASSIGN: kind = PNK_BITANDASSIGN; break;
+      case TOK_LSHASSIGN:    kind = PNK_LSHASSIGN;    break;
+      case TOK_RSHASSIGN:    kind = PNK_RSHASSIGN;    break;
+      case TOK_URSHASSIGN:   kind = PNK_URSHASSIGN;   break;
+      case TOK_MULASSIGN:    kind = PNK_MULASSIGN;    break;
+      case TOK_DIVASSIGN:    kind = PNK_DIVASSIGN;    break;
+      case TOK_MODASSIGN:    kind = PNK_MODASSIGN;    break;
+      default:
+        JS_ASSERT(!tokenStream.isCurrentTokenAssignment());
         tokenStream.ungetToken();
-        return pn;
+        return lhs;
     }
 
     JSOp op = tokenStream.currentToken().t_op;
-    if (!setAssignmentLhsOps(pn, op))
+    if (!setAssignmentLhsOps(lhs, op))
         return NULL;
 
     ParseNode *rhs = assignExpr();
     if (!rhs)
         return NULL;
-    if (pn->isKind(TOK_NAME) && pn->isUsed()) {
-        Definition *dn = pn->pn_lexdef;
+    if (lhs->isKind(PNK_NAME) && lhs->isUsed()) {
+        Definition *dn = lhs->pn_lexdef;
 
         /*
          * If the definition is not flagged as assigned, we must have imputed
@@ -4615,22 +4671,23 @@ Parser::assignExpr()
         }
     }
 
-    return ParseNode::newBinaryOrAppend(TOK_ASSIGN, op, pn, rhs, tc);
+    return ParseNode::newBinaryOrAppend(kind, op, lhs, rhs, tc);
 }
 
 static ParseNode *
 SetLvalKid(JSContext *cx, TokenStream *ts, TreeContext *tc, ParseNode *pn, ParseNode *kid,
            const char *name)
 {
-    if (!kid->isKind(TOK_NAME) &&
-        !kid->isKind(TOK_DOT) &&
-        (!kid->isKind(TOK_LP) ||
+    if (!kid->isKind(PNK_NAME) &&
+        !kid->isKind(PNK_DOT) &&
+        (!kid->isKind(PNK_LP) ||
          (!kid->isOp(JSOP_CALL) && !kid->isOp(JSOP_EVAL) &&
           !kid->isOp(JSOP_FUNCALL) && !kid->isOp(JSOP_FUNAPPLY))) &&
 #if JS_HAS_XML_SUPPORT
-        (!kid->isKind(TOK_UNARYOP) || !kid->isOp(JSOP_XMLNAME)) &&
+        !kid->isKind(PNK_XMLUNARY) &&
 #endif
-        !kid->isKind(TOK_LB)) {
+        !kid->isKind(PNK_LB))
+    {
         ReportCompileErrorNumber(cx, ts, NULL, JSREPORT_ERROR, JSMSG_BAD_OPERAND, name);
         return NULL;
     }
@@ -4652,30 +4709,30 @@ SetIncOpKid(JSContext *cx, TokenStream *ts, TreeContext *tc, ParseNode *pn, Pars
     if (!kid)
         return JS_FALSE;
     switch (kid->getKind()) {
-      case TOK_NAME:
+      case PNK_NAME:
         op = (tt == TOK_INC)
              ? (preorder ? JSOP_INCNAME : JSOP_NAMEINC)
              : (preorder ? JSOP_DECNAME : JSOP_NAMEDEC);
         NoteLValue(cx, kid, tc);
         break;
 
-      case TOK_DOT:
+      case PNK_DOT:
         op = (tt == TOK_INC)
              ? (preorder ? JSOP_INCPROP : JSOP_PROPINC)
              : (preorder ? JSOP_DECPROP : JSOP_PROPDEC);
         break;
 
-      case TOK_LP:
+      case PNK_LP:
         if (!MakeSetCall(cx, kid, tc, JSMSG_BAD_INCOP_OPERAND))
             return JS_FALSE;
         /* FALL THROUGH */
 #if JS_HAS_XML_SUPPORT
-      case TOK_UNARYOP:
+      case PNK_XMLUNARY:
         if (kid->isOp(JSOP_XMLNAME))
             kid->setOp(JSOP_SETXMLNAME);
         /* FALL THROUGH */
 #endif
-      case TOK_LB:
+      case PNK_LB:
         op = (tt == TOK_INC)
              ? (preorder ? JSOP_INCELEM : JSOP_ELEMINC)
              : (preorder ? JSOP_DECELEM : JSOP_ELEMDEC);
@@ -4689,6 +4746,16 @@ SetIncOpKid(JSContext *cx, TokenStream *ts, TreeContext *tc, ParseNode *pn, Pars
     return JS_TRUE;
 }
 
+ParseNode *
+Parser::unaryOpExpr(ParseNodeKind kind, JSOp op)
+{
+    TokenPtr begin = tokenStream.currentToken().pos.begin;
+    ParseNode *kid = unaryExpr();
+    if (!kid)
+        return NULL;
+    return new_<UnaryNode>(kind, op, TokenPos::make(begin, kid->pn_pos.end), kid);
+}
+
 ParseNode *
 Parser::unaryExpr()
 {
@@ -4696,26 +4763,23 @@ Parser::unaryExpr()
 
     JS_CHECK_RECURSION(context, return NULL);
 
-    TokenKind tt = tokenStream.getToken(TSF_OPERAND);
-    switch (tt) {
-      case TOK_UNARYOP:
+    switch (TokenKind tt = tokenStream.getToken(TSF_OPERAND)) {
+      case TOK_TYPEOF:
+        return unaryOpExpr(PNK_TYPEOF, JSOP_TYPEOF);
+      case TOK_VOID:
+        return unaryOpExpr(PNK_VOID, JSOP_VOID);
+      case TOK_NOT:
+        return unaryOpExpr(PNK_NOT, JSOP_NOT);
+      case TOK_BITNOT:
+        return unaryOpExpr(PNK_BITNOT, JSOP_BITNOT);
       case TOK_PLUS:
+        return unaryOpExpr(PNK_PLUS, JSOP_POS);
       case TOK_MINUS:
-        pn = UnaryNode::create(tc);
-        if (!pn)
-            return NULL;
-        pn->setKind(TOK_UNARYOP);      /* PLUS and MINUS are binary */
-        pn->setOp(tokenStream.currentToken().t_op);
-        pn2 = unaryExpr();
-        if (!pn2)
-            return NULL;
-        pn->pn_pos.end = pn2->pn_pos.end;
-        pn->pn_kid = pn2;
-        break;
+        return unaryOpExpr(PNK_MINUS, JSOP_NEG);
 
       case TOK_INC:
       case TOK_DEC:
-        pn = UnaryNode::create(tc);
+        pn = UnaryNode::create((tt == TOK_INC) ? PNK_INC : PNK_DEC, tc);
         if (!pn)
             return NULL;
         pn2 = memberExpr(JS_TRUE);
@@ -4728,7 +4792,7 @@ Parser::unaryExpr()
 
       case TOK_DELETE:
       {
-        pn = UnaryNode::create(tc);
+        pn = UnaryNode::create(PNK_DELETE, tc);
         if (!pn)
             return NULL;
         pn2 = unaryExpr();
@@ -4744,7 +4808,7 @@ Parser::unaryExpr()
         if (foldConstants && !FoldConstants(context, pn2, tc))
             return NULL;
         switch (pn2->getKind()) {
-          case TOK_LP:
+          case PNK_LP:
             if (!(pn2->pn_xflags & PNX_SETCALL)) {
                 /*
                  * Call MakeSetCall to check for errors, but clear PNX_SETCALL
@@ -4755,7 +4819,7 @@ Parser::unaryExpr()
                 pn2->pn_xflags &= ~PNX_SETCALL;
             }
             break;
-          case TOK_NAME:
+          case PNK_NAME:
             if (!ReportStrictModeError(context, &tokenStream, tc, pn,
                                        JSMSG_DEPRECATED_DELETE_OPERAND)) {
                 return NULL;
@@ -4785,7 +4849,7 @@ Parser::unaryExpr()
             tt = tokenStream.peekTokenSameLine(TSF_OPERAND);
             if (tt == TOK_INC || tt == TOK_DEC) {
                 (void) tokenStream.getToken();
-                pn2 = UnaryNode::create(tc);
+                pn2 = UnaryNode::create((tt == TOK_INC) ? PNK_INC : PNK_DEC, tc);
                 if (!pn2)
                     return NULL;
                 if (!SetIncOpKid(context, &tokenStream, tc, pn2, pn, tt, JS_FALSE))
@@ -5148,11 +5212,11 @@ CompExprTransplanter::transplant(ParseNode *pn)
  *
  * Return null on failure, else return the top-most parse node for the array
  * comprehension or generator expression, with a unary node as the body of the
- * (possibly nested) for-loop, initialized by |type, op, kid|.
+ * (possibly nested) for-loop, initialized by |kind, op, kid|.
  */
 ParseNode *
 Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
-                          TokenKind type, JSOp op)
+                          ParseNodeKind kind, JSOp op)
 {
     uintN adjust;
     ParseNode *pn, *pn2, *pn3, **pnp;
@@ -5162,7 +5226,7 @@ Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
 
     JS_ASSERT(tokenStream.currentToken().type == TOK_FOR);
 
-    if (type == TOK_SEMI) {
+    if (kind == PNK_SEMI) {
         /*
          * Generator expression desugars to an immediately applied lambda that
          * yields the next value from a for-in loop (possibly nested, and with
@@ -5173,7 +5237,7 @@ Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
             return NULL;
         adjust = pn->pn_blockid - blockid;
     } else {
-        JS_ASSERT(type == TOK_ARRAYPUSH);
+        JS_ASSERT(kind == PNK_ARRAYPUSH);
 
         /*
          * Make a parse-node and literal object representing the block scope of
@@ -5202,7 +5266,7 @@ Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
 
     pnp = &pn->pn_expr;
 
-    CompExprTransplanter transplanter(kid, tc, type == TOK_SEMI, adjust);
+    CompExprTransplanter transplanter(kid, tc, kind == PNK_SEMI, adjust);
     transplanter.transplant(kid);
 
     data.pn = NULL;
@@ -5216,7 +5280,7 @@ Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
          * index to count each block-local let-variable on the left-hand side
          * of the IN.
          */
-        pn2 = BinaryNode::create(tc);
+        pn2 = BinaryNode::create(PNK_FOR, tc);
         if (!pn2)
             return NULL;
 
@@ -5293,7 +5357,7 @@ Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
 
             if (versionNumber() == JSVERSION_1_7) {
                 /* Destructuring requires [key, value] enumeration in JS1.7. */
-                if (!pn3->isKind(TOK_RB) || pn3->pn_count != 2) {
+                if (!pn3->isKind(PNK_RB) || pn3->pn_count != 2) {
                     reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_FOR_LEFTSIDE);
                     return NULL;
                 }
@@ -5319,11 +5383,10 @@ Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
          * Synthesize a declaration. Every definition must appear in the parse
          * tree in order for ComprehensionTranslator to work.
          */
-        ParseNode *vars = ListNode::create(tc);
+        ParseNode *vars = ListNode::create(PNK_VAR, tc);
         if (!vars)
             return NULL;
         vars->setOp(JSOP_NOP);
-        vars->setKind(TOK_VAR);
         vars->pn_pos = pn3->pn_pos;
         vars->makeEmpty();
         vars->append(pn3);
@@ -5334,7 +5397,7 @@ Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
         if (!pn3)
             return NULL;
 
-        pn2->pn_left = new_<TernaryNode>(TOK_IN, JSOP_NOP, vars, pn3, pn4);
+        pn2->pn_left = new_<TernaryNode>(PNK_IN, JSOP_NOP, vars, pn3, pn4);
         if (!pn2->pn_left)
             return NULL;
         *pnp = pn2;
@@ -5342,7 +5405,7 @@ Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
     } while (tokenStream.matchToken(TOK_FOR));
 
     if (tokenStream.matchToken(TOK_IF)) {
-        pn2 = TernaryNode::create(tc);
+        pn2 = TernaryNode::create(PNK_IF, tc);
         if (!pn2)
             return NULL;
         pn2->pn_kid1 = condition();
@@ -5352,10 +5415,9 @@ Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
         pnp = &pn2->pn_kid2;
     }
 
-    pn2 = UnaryNode::create(tc);
+    pn2 = UnaryNode::create(kind, tc);
     if (!pn2)
         return NULL;
-    pn2->setKind(type);
     pn2->setOp(op);
     pn2->pn_kid = kid;
     *pnp = pn2;
@@ -5384,11 +5446,12 @@ Parser::comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
 ParseNode *
 Parser::generatorExpr(ParseNode *kid)
 {
+    JS_ASSERT(tokenStream.isCurrentTokenType(TOK_FOR));
+
     /* Create a |yield| node for |kid|. */
-    ParseNode *pn = UnaryNode::create(tc);
+    ParseNode *pn = UnaryNode::create(PNK_YIELD, tc);
     if (!pn)
         return NULL;
-    pn->setKind(TOK_YIELD);
     pn->setOp(JSOP_YIELD);
     pn->setInParens(true);
     pn->pn_pos = kid->pn_pos;
@@ -5396,10 +5459,9 @@ Parser::generatorExpr(ParseNode *kid)
     pn->pn_hidden = true;
 
     /* Make a new node for the desugared generator function. */
-    ParseNode *genfn = FunctionNode::create(tc);
+    ParseNode *genfn = FunctionNode::create(PNK_FUNCTION, tc);
     if (!genfn)
         return NULL;
-    genfn->setKind(TOK_FUNCTION);
     genfn->setOp(JSOP_LAMBDA);
     JS_ASSERT(!genfn->pn_body);
     genfn->pn_dflags = PND_FUNARG;
@@ -5456,10 +5518,9 @@ Parser::generatorExpr(ParseNode *kid)
      * Our result is a call expression that invokes the anonymous generator
      * function object.
      */
-    ParseNode *result = ListNode::create(tc);
+    ParseNode *result = ListNode::create(PNK_LP, tc);
     if (!result)
         return NULL;
-    result->setKind(TOK_LP);
     result->setOp(JSOP_CALL);
     result->pn_pos.begin = genfn->pn_pos.begin;
     result->initList(genfn);
@@ -5488,7 +5549,7 @@ Parser::argumentList(ParseNode *listNode)
             guard.endBody();
 
 #if JS_HAS_GENERATORS
-        if (argNode->isKind(TOK_YIELD) &&
+        if (argNode->isKind(PNK_YIELD) &&
             !argNode->isInParens() &&
             tokenStream.peekToken() == TOK_COMMA) {
             reportErrorNumber(argNode, JSREPORT_ERROR, JSMSG_BAD_GENERATOR_SYNTAX, js_yield_str);
@@ -5529,7 +5590,7 @@ Parser::argumentList(ParseNode *listNode)
 static ParseNode *
 CheckForImmediatelyAppliedLambda(ParseNode *pn)
 {
-    if (pn->isKind(TOK_FUNCTION)) {
+    if (pn->isKind(PNK_FUNCTION)) {
         JS_ASSERT(pn->isArity(PN_FUNC));
 
         FunctionBox *funbox = pn->pn_funbox;
@@ -5550,7 +5611,7 @@ Parser::memberExpr(JSBool allowCallSyntax)
     /* Check for new expression first. */
     TokenKind tt = tokenStream.getToken(TSF_OPERAND);
     if (tt == TOK_NEW) {
-        pn = ListNode::create(tc);
+        pn = ListNode::create(PNK_NEW, tc);
         if (!pn)
             return NULL;
         pn2 = memberExpr(JS_FALSE);
@@ -5574,8 +5635,8 @@ Parser::memberExpr(JSBool allowCallSyntax)
         if (!pn)
             return NULL;
 
-        if (pn->isKind(TOK_ANYNAME) || pn->isKind(TOK_AT) || pn->isKind(TOK_DBLCOLON)) {
-            pn = new_<UnaryNode>(TOK_UNARYOP, JSOP_XMLNAME, pn->pn_pos, pn);
+        if (pn->isXMLNameOp()) {
+            pn = new_<UnaryNode>(PNK_XMLUNARY, JSOP_XMLNAME, pn->pn_pos, pn);
             if (!pn)
                 return NULL;
         }
@@ -5583,7 +5644,7 @@ Parser::memberExpr(JSBool allowCallSyntax)
 
     while ((tt = tokenStream.getToken()) > TOK_EOF) {
         if (tt == TOK_DOT) {
-            pn2 = NameNode::create(NULL, tc);
+            pn2 = NameNode::create(PNK_DOT, NULL, tc);
             if (!pn2)
                 return NULL;
 
@@ -5613,21 +5674,21 @@ Parser::memberExpr(JSBool allowCallSyntax)
             }
 
             /* Check both tt and pn_type, to distinguish |x.(y)| and |x.y::z| from |x.y|. */
-            if (tt == TOK_NAME && pn3->isKind(TOK_NAME)) {
+            if (tt == TOK_NAME && pn3->isKind(PNK_NAME)) {
                 pn2->setOp(JSOP_GETPROP);
                 pn2->pn_expr = pn;
                 pn2->pn_atom = pn3->pn_atom;
                 freeTree(pn3);
             } else {
                 if (tt == TOK_LP) {
-                    pn2->setKind(TOK_FILTER);
+                    pn2->setKind(PNK_FILTER);
                     pn2->setOp(JSOP_FILTER);
 
                     /* A filtering predicate is like a with statement. */
                     tc->flags |= TCF_FUN_HEAVYWEIGHT;
-                } else if (TokenKindIsXML(pn3->getKind())) {
+                } else if (pn3->isXMLPropertyIdentifier()) {
                     JS_ASSERT(!tc->inStrictMode());
-                    pn2->setKind(TOK_LB);
+                    pn2->setKind(PNK_LB);
                     pn2->setOp(JSOP_GETELEM);
                 } else {
                     reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_NAME_AFTER_DOT);
@@ -5652,19 +5713,18 @@ Parser::memberExpr(JSBool allowCallSyntax)
                 return NULL;
             }
 
-            pn2 = BinaryNode::create(tc);
+            pn2 = BinaryNode::create(PNK_DBLDOT, tc);
             if (!pn2)
                 return NULL;
             tt = tokenStream.getToken(TSF_OPERAND | TSF_KEYWORD_IS_NAME);
             pn3 = primaryExpr(tt, JS_TRUE);
             if (!pn3)
                 return NULL;
-            tt = pn3->getKind();
-            if (tt == TOK_NAME && !pn3->isInParens()) {
-                pn3->setKind(TOK_STRING);
+            if (pn3->isKind(PNK_NAME) && !pn3->isInParens()) {
+                pn3->setKind(PNK_STRING);
                 pn3->setArity(PN_NULLARY);
                 pn3->setOp(JSOP_QNAMEPART);
-            } else if (!TokenKindIsXML(tt)) {
+            } else if (!pn3->isXMLPropertyIdentifier()) {
                 reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_NAME_AFTER_DOT);
                 return NULL;
             }
@@ -5675,7 +5735,7 @@ Parser::memberExpr(JSBool allowCallSyntax)
             pn2->pn_pos.end = tokenStream.currentToken().pos.end;
 #endif
         } else if (tt == TOK_LB) {
-            pn2 = BinaryNode::create(tc);
+            pn2 = BinaryNode::create(PNK_LB, tc);
             if (!pn2)
                 return NULL;
             pn3 = expr();
@@ -5694,18 +5754,18 @@ Parser::memberExpr(JSBool allowCallSyntax)
              * instead of a string.
              */
             do {
-                if (pn3->isKind(TOK_STRING)) {
+                if (pn3->isKind(PNK_STRING)) {
                     jsuint index;
 
                     if (!js_IdIsIndex(ATOM_TO_JSID(pn3->pn_atom), &index)) {
-                        pn2->setKind(TOK_DOT);
+                        pn2->setKind(PNK_DOT);
                         pn2->setOp(JSOP_GETPROP);
                         pn2->setArity(PN_NAME);
                         pn2->pn_expr = pn;
                         pn2->pn_atom = pn3->pn_atom;
                         break;
                     }
-                    pn3->setKind(TOK_NUMBER);
+                    pn3->setKind(PNK_NUMBER);
                     pn3->setOp(JSOP_DOUBLE);
                     pn3->pn_dval = index;
                 }
@@ -5714,7 +5774,7 @@ Parser::memberExpr(JSBool allowCallSyntax)
                 pn2->pn_right = pn3;
             } while (0);
         } else if (allowCallSyntax && tt == TOK_LP) {
-            pn2 = ListNode::create(tc);
+            pn2 = ListNode::create(PNK_LP, tc);
             if (!pn2)
                 return NULL;
             pn2->setOp(JSOP_CALL);
@@ -5853,24 +5913,24 @@ Parser::propertySelector()
 {
     JS_ASSERT(!tc->inStrictMode());
 
-    DebugOnly<const Token *> tp = &tokenStream.currentToken();
-    JS_ASSERT(tp->type == TOK_STAR || tp->type == TOK_NAME);
-
-    ParseNode *pn = NullaryNode::create(tc);
-    if (!pn)
-        return NULL;
-    if (pn->isKind(TOK_STAR)) {
-        pn->setKind(TOK_ANYNAME);
-        pn->setOp(JSOP_ANYNAME);
-        pn->pn_atom = context->runtime->atomState.starAtom;
+    ParseNode *selector;
+    if (tokenStream.isCurrentTokenType(TOK_STAR)) {
+        selector = NullaryNode::create(PNK_ANYNAME, tc);
+        if (!selector)
+            return NULL;
+        selector->setOp(JSOP_ANYNAME);
+        selector->pn_atom = context->runtime->atomState.starAtom;
     } else {
-        JS_ASSERT(pn->isKind(TOK_NAME));
-        pn->setOp(JSOP_QNAMEPART);
-        pn->setArity(PN_NAME);
-        pn->pn_atom = tokenStream.currentToken().name();
-        pn->pn_cookie.makeFree();
+        JS_ASSERT(tokenStream.isCurrentTokenType(TOK_NAME));
+        selector = NullaryNode::create(PNK_NAME, tc);
+        if (!selector)
+            return NULL;
+        selector->setOp(JSOP_QNAMEPART);
+        selector->setArity(PN_NAME);
+        selector->pn_atom = tokenStream.currentToken().name();
+        selector->pn_cookie.makeFree();
     }
-    return pn;
+    return selector;
 }
 
 ParseNode *
@@ -5878,11 +5938,8 @@ Parser::qualifiedSuffix(ParseNode *pn)
 {
     JS_ASSERT(!tc->inStrictMode());
 
-    ParseNode *pn2, *pn3;
-    TokenKind tt;
-
     JS_ASSERT(tokenStream.currentToken().type == TOK_DBLCOLON);
-    pn2 = NameNode::create(NULL, tc);
+    ParseNode *pn2 = NameNode::create(PNK_DBLCOLON, NULL, tc);
     if (!pn2)
         return NULL;
 
@@ -5890,7 +5947,7 @@ Parser::qualifiedSuffix(ParseNode *pn)
     if (pn->isOp(JSOP_QNAMEPART))
         pn->setOp(JSOP_NAME);
 
-    tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
+    TokenKind tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
     if (tt == TOK_STAR || tt == TOK_NAME) {
         /* Inline and specialize propertySelector for JSOP_QNAMECONST. */
         pn2->setOp(JSOP_QNAMECONST);
@@ -5907,7 +5964,7 @@ Parser::qualifiedSuffix(ParseNode *pn)
         reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_SYNTAX_ERROR);
         return NULL;
     }
-    pn3 = endBracketedExpr();
+    ParseNode *pn3 = endBracketedExpr();
     if (!pn3)
         return NULL;
 
@@ -5925,9 +5982,6 @@ Parser::qualifiedIdentifier()
 {
     JS_ASSERT(!tc->inStrictMode());
 
-    DebugOnly<const Token *> tp = &tokenStream.currentToken();
-    JS_ASSERT(tp->type == TOK_STAR || tp->type == TOK_NAME);
-
     ParseNode *pn = propertySelector();
     if (!pn)
         return NULL;
@@ -5944,15 +5998,14 @@ Parser::attributeIdentifier()
 {
     JS_ASSERT(!tc->inStrictMode());
 
-    ParseNode *pn, *pn2;
-    TokenKind tt;
-
     JS_ASSERT(tokenStream.currentToken().type == TOK_AT);
-    pn = UnaryNode::create(tc);
+    ParseNode *pn = UnaryNode::create(PNK_AT, tc);
     if (!pn)
         return NULL;
     pn->setOp(JSOP_TOATTRNAME);
-    tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
+
+    ParseNode *pn2;
+    TokenKind tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
     if (tt == TOK_STAR || tt == TOK_NAME) {
         pn2 = qualifiedIdentifier();
     } else if (tt == TOK_LB) {
@@ -5975,10 +6028,8 @@ Parser::xmlExpr(JSBool inTag)
 {
     JS_ASSERT(!tc->inStrictMode());
 
-    ParseNode *pn, *pn2;
-
     JS_ASSERT(tokenStream.currentToken().type == TOK_LC);
-    pn = UnaryNode::create(tc);
+    ParseNode *pn = UnaryNode::create(PNK_LC, tc);
     if (!pn)
         return NULL;
 
@@ -5990,7 +6041,7 @@ Parser::xmlExpr(JSBool inTag)
      */
     bool oldflag = tokenStream.isXMLTagMode();
     tokenStream.setXMLTagMode(false);
-    pn2 = expr();
+    ParseNode *pn2 = expr();
     if (!pn2)
         return NULL;
 
@@ -6001,29 +6052,16 @@ Parser::xmlExpr(JSBool inTag)
     return pn;
 }
 
-/*
- * Make a terminal node for one of TOK_XMLNAME, TOK_XMLATTR, TOK_XMLSPACE,
- * TOK_XMLTEXT, TOK_XMLCDATA, TOK_XMLCOMMENT, or TOK_XMLPI.  When converting
- * parse tree to XML, we preserve a TOK_XMLSPACE node only if it's the sole
- * child of a container tag.
- */
 ParseNode *
-Parser::xmlAtomNode()
+Parser::atomNode(ParseNodeKind kind, JSOp op)
 {
-    JS_ASSERT(!tc->inStrictMode());
-
-    ParseNode *pn = NullaryNode::create(tc);
-    if (!pn)
+    ParseNode *node = NullaryNode::create(kind, tc);
+    if (!node)
         return NULL;
+    node->setOp(op);
     const Token &tok = tokenStream.currentToken();
-    pn->setOp(tok.t_op);
-    if (tok.type == TOK_XMLPI) {
-        pn->pn_pitarget = tok.xmlPITarget();
-        pn->pn_pidata = tok.xmlPIData();
-    } else {
-        pn->pn_atom = tok.atom();
-    }
-    return pn;
+    node->pn_atom = tok.atom();
+    return node;
 }
 
 /*
@@ -6035,8 +6073,8 @@ Parser::xmlAtomNode()
  *
  * Return a PN_LIST, PN_UNARY, or PN_NULLARY according as XMLNameExpr produces
  * a list of names and/or expressions, a single expression, or a single name.
- * If PN_LIST or PN_NULLARY, pn_type will be TOK_XMLNAME; if PN_UNARY, pn_type
- * will be TOK_LC.
+ * If PN_LIST or PN_NULLARY, getKind() will be PNK_XMLNAME.  Otherwise if
+ * PN_UNARY, getKind() will be PNK_LC.
  */
 ParseNode *
 Parser::xmlNameExpr()
@@ -6055,7 +6093,8 @@ Parser::xmlNameExpr()
                 return NULL;
         } else {
             JS_ASSERT(tt == TOK_XMLNAME);
-            pn2 = xmlAtomNode();
+            JS_ASSERT(tokenStream.currentToken().t_op == JSOP_STRING);
+            pn2 = atomNode(PNK_XMLNAME, JSOP_STRING);
             if (!pn2)
                 return NULL;
         }
@@ -6064,10 +6103,9 @@ Parser::xmlNameExpr()
             pn = pn2;
         } else {
             if (!list) {
-                list = ListNode::create(tc);
+                list = ListNode::create(PNK_XMLNAME, tc);
                 if (!list)
                     return NULL;
-                list->setKind(TOK_XMLNAME);
                 list->pn_pos.begin = pn->pn_pos.begin;
                 list->initList(pn);
                 list->pn_xflags = PNX_CANTFOLD;
@@ -6088,7 +6126,7 @@ Parser::xmlNameExpr()
  */
 #define XML_FOLDABLE(pn)        ((pn)->isArity(PN_LIST)                     \
                                  ? ((pn)->pn_xflags & PNX_CANTFOLD) == 0    \
-                                 : !(pn)->isKind(TOK_LC))
+                                 : !(pn)->isKind(PNK_LC))
 
 /*
  * Parse the productions:
@@ -6102,13 +6140,13 @@ Parser::xmlNameExpr()
  * produces a list of name and attribute values and/or braced expressions, a
  * single expression, or a single name.
  *
- * If PN_LIST or PN_NULLARY, pn_type will be TOK_XMLNAME for the case where
- * XMLTagContent: XMLNameExpr.  If pn_type is not TOK_XMLNAME but pn_arity is
- * PN_LIST, pn_type will be tagtype.  If PN_UNARY, pn_type will be TOK_LC and
- * we parsed exactly one expression.
+ * If PN_LIST or PN_NULLARY, getKind() will be PNK_XMLNAME for the case where
+ * XMLTagContent: XMLNameExpr.  If getKind() is not PNK_XMLNAME but getArity()
+ * is PN_LIST, getKind() will be tagkind.  If PN_UNARY, getKind() will be
+ * PNK_LC and we parsed exactly one expression.
  */
 ParseNode *
-Parser::xmlTagContent(TokenKind tagtype, JSAtom **namep)
+Parser::xmlTagContent(ParseNodeKind tagkind, JSAtom **namep)
 {
     JS_ASSERT(!tc->inStrictMode());
 
@@ -6132,10 +6170,9 @@ Parser::xmlTagContent(TokenKind tagtype, JSAtom **namep)
         if (!pn2)
             return NULL;
         if (!list) {
-            list = ListNode::create(tc);
+            list = ListNode::create(tagkind, tc);
             if (!list)
                 return NULL;
-            list->setKind(tagtype);
             list->pn_pos.begin = pn->pn_pos.begin;
             list->initList(pn);
             pn = list;
@@ -6150,7 +6187,8 @@ Parser::xmlTagContent(TokenKind tagtype, JSAtom **namep)
 
         tt = tokenStream.getToken();
         if (tt == TOK_XMLATTR) {
-            pn2 = xmlAtomNode();
+            JS_ASSERT(tokenStream.currentToken().t_op == JSOP_STRING);
+            pn2 = atomNode(PNK_XMLATTR, JSOP_STRING);
         } else if (tt == TOK_LC) {
             pn2 = xmlExpr(JS_TRUE);
             pn->pn_xflags |= PNX_CANTFOLD;
@@ -6195,9 +6233,11 @@ Parser::xmlElementContent(ParseNode *pn)
         JSAtom *textAtom = tokenStream.currentToken().atom();
         if (textAtom) {
             /* Non-zero-length XML text scanned. */
-            ParseNode *pn2 = xmlAtomNode();
+            JS_ASSERT(tokenStream.currentToken().t_op == JSOP_STRING);
+            ParseNode *pn2 = atomNode(tt == TOK_XMLSPACE ? PNK_XMLSPACE : PNK_XMLTEXT,
+                                      JSOP_STRING);
             if (!pn2)
-                return JS_FALSE;
+                return false;
             pn->pn_pos.end = pn2->pn_pos.end;
             pn->append(pn2);
         }
@@ -6210,20 +6250,30 @@ Parser::xmlElementContent(ParseNode *pn)
         ParseNode *pn2;
         if (tt == TOK_LC) {
             pn2 = xmlExpr(JS_FALSE);
+            if (!pn2)
+                return false;
             pn->pn_xflags |= PNX_CANTFOLD;
         } else if (tt == TOK_XMLSTAGO) {
             pn2 = xmlElementOrList(JS_FALSE);
-            if (pn2) {
-                pn2->pn_xflags &= ~PNX_XMLROOT;
-                pn->pn_xflags |= pn2->pn_xflags;
-            }
+            if (!pn2)
+                return false;
+            pn2->pn_xflags &= ~PNX_XMLROOT;
+            pn->pn_xflags |= pn2->pn_xflags;
+        } else if (tt == TOK_XMLPI) {
+            pn2 = NullaryNode::create(PNK_XMLPI, tc);
+            if (!pn2)
+                return false;
+            const Token &tok = tokenStream.currentToken();
+            pn2->setOp(tok.t_op);
+            pn2->pn_pitarget = tok.xmlPITarget();
+            pn2->pn_pidata = tok.xmlPIData();
         } else {
-            JS_ASSERT(tt == TOK_XMLCDATA || tt == TOK_XMLCOMMENT ||
-                      tt == TOK_XMLPI);
-            pn2 = xmlAtomNode();
+            JS_ASSERT(tt == TOK_XMLCDATA || tt == TOK_XMLCOMMENT);
+            pn2 = atomNode(tt == TOK_XMLCDATA ? PNK_XMLCDATA : PNK_XMLCOMMENT,
+                           tokenStream.currentToken().t_op);
+            if (!pn2)
+                return false;
         }
-        if (!pn2)
-            return JS_FALSE;
         pn->pn_pos.end = pn2->pn_pos.end;
         pn->append(pn2);
     }
@@ -6248,7 +6298,7 @@ Parser::xmlElementOrList(JSBool allowList)
     JS_CHECK_RECURSION(context, return NULL);
 
     JS_ASSERT(tokenStream.currentToken().type == TOK_XMLSTAGO);
-    pn = ListNode::create(tc);
+    pn = ListNode::create(PNK_XMLSTAGO, tc);
     if (!pn)
         return NULL;
 
@@ -6261,7 +6311,7 @@ Parser::xmlElementOrList(JSBool allowList)
         /*
          * XMLElement.  Append the tag and its contents, if any, to pn.
          */
-        pn2 = xmlTagContent(TOK_XMLSTAGO, &startAtom);
+        pn2 = xmlTagContent(PNK_XMLSTAGO, &startAtom);
         if (!pn2)
             return NULL;
         tokenStream.matchToken(TOK_XMLSPACE);
@@ -6269,18 +6319,17 @@ Parser::xmlElementOrList(JSBool allowList)
         tt = tokenStream.getToken();
         if (tt == TOK_XMLPTAGC) {
             /* Point tag (/>): recycle pn if pn2 is a list of tag contents. */
-            if (pn2->isKind(TOK_XMLSTAGO)) {
+            if (pn2->isKind(PNK_XMLSTAGO)) {
                 pn->makeEmpty();
                 freeTree(pn);
                 pn = pn2;
             } else {
-                JS_ASSERT(pn2->isKind(TOK_XMLNAME) ||
-                          pn2->isKind(TOK_LC));
+                JS_ASSERT(pn2->isKind(PNK_XMLNAME) || pn2->isKind(PNK_LC));
                 pn->initList(pn2);
                 if (!XML_FOLDABLE(pn2))
                     pn->pn_xflags |= PNX_CANTFOLD;
             }
-            pn->setKind(TOK_XMLPTAGC);
+            pn->setKind(PNK_XMLPTAGC);
             pn->pn_xflags |= PNX_XMLROOT;
         } else {
             /* We had better have a tag-close (>) at this point. */
@@ -6291,18 +6340,18 @@ Parser::xmlElementOrList(JSBool allowList)
             pn2->pn_pos.end = tokenStream.currentToken().pos.end;
 
             /* Make sure pn2 is a TOK_XMLSTAGO list containing tag contents. */
-            if (!pn2->isKind(TOK_XMLSTAGO)) {
+            if (!pn2->isKind(PNK_XMLSTAGO)) {
                 pn->initList(pn2);
                 if (!XML_FOLDABLE(pn2))
                     pn->pn_xflags |= PNX_CANTFOLD;
                 pn2 = pn;
-                pn = ListNode::create(tc);
+                pn = ListNode::create(PNK_XMLTAGC, tc);
                 if (!pn)
                     return NULL;
             }
 
             /* Now make pn a nominal-root TOK_XMLELEM list containing pn2. */
-            pn->setKind(TOK_XMLELEM);
+            pn->setKind(PNK_XMLELEM);
             pn->pn_pos.begin = pn2->pn_pos.begin;
             pn->initList(pn2);
             if (!XML_FOLDABLE(pn2))
@@ -6321,10 +6370,10 @@ Parser::xmlElementOrList(JSBool allowList)
             }
 
             /* Parse end tag; check mismatch at compile-time if we can. */
-            pn2 = xmlTagContent(TOK_XMLETAGO, &endAtom);
+            pn2 = xmlTagContent(PNK_XMLETAGO, &endAtom);
             if (!pn2)
                 return NULL;
-            if (pn2->isKind(TOK_XMLETAGO)) {
+            if (pn2->isKind(PNK_XMLETAGO)) {
                 /* Oops, end tag has attributes! */
                 reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_XML_TAG_SYNTAX);
                 return NULL;
@@ -6337,11 +6386,10 @@ Parser::xmlElementOrList(JSBool allowList)
             }
 
             /* Make a TOK_XMLETAGO list with pn2 as its single child. */
-            JS_ASSERT(pn2->isKind(TOK_XMLNAME) || pn2->isKind(TOK_LC));
-            list = ListNode::create(tc);
+            JS_ASSERT(pn2->isKind(PNK_XMLNAME) || pn2->isKind(PNK_LC));
+            list = ListNode::create(PNK_XMLETAGO, tc);
             if (!list)
                 return NULL;
-            list->setKind(TOK_XMLETAGO);
             list->initList(pn2);
             pn->append(list);
             if (!XML_FOLDABLE(pn2)) {
@@ -6357,7 +6405,7 @@ Parser::xmlElementOrList(JSBool allowList)
         pn->setOp(JSOP_TOXML);
     } else if (allowList && tt == TOK_XMLTAGC) {
         /* XMLList Initialiser. */
-        pn->setKind(TOK_XMLLIST);
+        pn->setKind(PNK_XMLLIST);
         pn->setOp(JSOP_TOXMLLIST);
         pn->makeEmpty();
         pn->pn_xflags |= PNX_XMLROOT;
@@ -6459,9 +6507,21 @@ BlockIdInScope(uintN blockid, TreeContext *tc)
 }
 #endif
 
+static ParseNode *
+PrimaryExprNode(ParseNodeKind kind, JSOp op, TreeContext *tc)
+{
+    ParseNode *pn = NullaryNode::create(kind, tc);
+    if (!pn)
+        return NULL;
+    pn->setOp(op);
+    return pn;
+}
+
 ParseNode *
 Parser::primaryExpr(TokenKind tt, JSBool afterDot)
 {
+    JS_ASSERT(tokenStream.isCurrentTokenType(tt));
+
     ParseNode *pn, *pn2, *pn3;
     JSOp op;
 
@@ -6471,10 +6531,9 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
       case TOK_FUNCTION:
 #if JS_HAS_XML_SUPPORT
         if (!tc->inStrictMode() && tokenStream.matchToken(TOK_DBLCOLON, TSF_KEYWORD_IS_NAME)) {
-            pn2 = NullaryNode::create(tc);
+            pn2 = NullaryNode::create(PNK_FUNCTION, tc);
             if (!pn2)
                 return NULL;
-            pn2->setKind(TOK_FUNCTION);
             pn = qualifiedSuffix(pn2);
             if (!pn)
                 return NULL;
@@ -6491,10 +6550,9 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         JSBool matched;
         jsuint index;
 
-        pn = ListNode::create(tc);
+        pn = ListNode::create(PNK_RB, tc);
         if (!pn)
             return NULL;
-        pn->setKind(TOK_RB);
         pn->setOp(JSOP_NEWINIT);
         pn->makeEmpty();
 
@@ -6519,7 +6577,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                 if (tt == TOK_COMMA) {
                     /* So CURRENT_TOKEN gets TOK_COMMA and not TOK_LB. */
                     tokenStream.matchToken(TOK_COMMA);
-                    pn2 = NullaryNode::create(tc);
+                    pn2 = NullaryNode::create(PNK_COMMA, tc);
                     pn->pn_xflags |= PNX_HOLEY | PNX_NONCONST;
                 } else {
                     pn2 = assignExpr();
@@ -6583,7 +6641,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                 ParseNode *pnexp, *pntop;
 
                 /* Relabel pn as an array comprehension node. */
-                pn->setKind(TOK_ARRAYCOMP);
+                pn->setKind(PNK_ARRAYCOMP);
 
                 /*
                  * Remove the comprehension expression from pn's linked list
@@ -6597,7 +6655,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                 *pn->pn_tail = NULL;
 
                 pntop = comprehensionTail(pnexp, pn->pn_blockid, false,
-                                          TOK_ARRAYPUSH, JSOP_ARRAYPUSH);
+                                          PNK_ARRAYPUSH, JSOP_ARRAYPUSH);
                 if (!pntop)
                     return NULL;
                 pn->append(pntop);
@@ -6626,10 +6684,9 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
             VALUE   = 0x4 | GET | SET
         };
 
-        pn = ListNode::create(tc);
+        pn = ListNode::create(PNK_RC, tc);
         if (!pn)
             return NULL;
-        pn->setKind(TOK_RC);
         pn->setOp(JSOP_NEWINIT);
         pn->makeEmpty();
 
@@ -6638,7 +6695,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
             tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
             switch (tt) {
               case TOK_NUMBER:
-                pn3 = NullaryNode::create(tc);
+                pn3 = NullaryNode::create(PNK_NUMBER, tc);
                 if (!pn3)
                     return NULL;
                 pn3->pn_dval = tokenStream.currentToken().number();
@@ -6648,23 +6705,31 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
               case TOK_NAME:
                 {
                     atom = tokenStream.currentToken().name();
-                    if (atom == context->runtime->atomState.getAtom)
+                    if (atom == context->runtime->atomState.getAtom) {
                         op = JSOP_GETTER;
-                    else if (atom == context->runtime->atomState.setAtom)
+                    } else if (atom == context->runtime->atomState.setAtom) {
                         op = JSOP_SETTER;
-                    else
-                        goto property_name;
+                    } else {
+                        pn3 = NullaryNode::create(PNK_NAME, tc);
+                        if (!pn3)
+                            return NULL;
+                        pn3->pn_atom = atom;
+                        break;
+                    }
 
                     tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
-                    if (tt == TOK_NAME || tt == TOK_STRING) {
-                        atom = (tt == TOK_NAME)
-                               ? tokenStream.currentToken().name()
-                               : tokenStream.currentToken().atom();
-                        pn3 = NameNode::create(atom, tc);
+                    if (tt == TOK_NAME) {
+                        atom = tokenStream.currentToken().name();
+                        pn3 = NameNode::create(PNK_NAME, atom, tc);
+                        if (!pn3)
+                            return NULL;
+                    } else if (tt == TOK_STRING) {
+                        atom = tokenStream.currentToken().atom();
+                        pn3 = NameNode::create(PNK_STRING, atom, tc);
                         if (!pn3)
                             return NULL;
                     } else if (tt == TOK_NUMBER) {
-                        pn3 = NullaryNode::create(tc);
+                        pn3 = NullaryNode::create(PNK_NUMBER, tc);
                         if (!pn3)
                             return NULL;
                         pn3->pn_dval = tokenStream.currentToken().number();
@@ -6672,20 +6737,23 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                             return NULL;
                     } else {
                         tokenStream.ungetToken();
-                        goto property_name;
+                        pn3 = NullaryNode::create(PNK_NAME, tc);
+                        if (!pn3)
+                            return NULL;
+                        pn3->pn_atom = atom;
+                        break;
                     }
 
                     pn->pn_xflags |= PNX_NONCONST;
 
                     /* NB: Getter function in { get x(){} } is unnamed. */
                     pn2 = functionDef(NULL, op == JSOP_GETTER ? Getter : Setter, Expression);
-                    pn2 = ParseNode::newBinaryOrAppend(TOK_COLON, op, pn3, pn2, tc);
+                    pn2 = ParseNode::newBinaryOrAppend(PNK_COLON, op, pn3, pn2, tc);
                     goto skip;
                 }
               case TOK_STRING:
                 atom = tokenStream.currentToken().atom();
-              property_name:
-                pn3 = NullaryNode::create(tc);
+                pn3 = NullaryNode::create(PNK_STRING, tc);
                 if (!pn3)
                     return NULL;
                 pn3->pn_atom = atom;
@@ -6729,14 +6797,14 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                     return NULL;
                 pn->pn_xflags |= PNX_DESTRUCT | PNX_NONCONST;
                 pnval = pn3;
-                if (pnval->isKind(TOK_NAME)) {
+                if (pnval->isKind(PNK_NAME)) {
                     pnval->setArity(PN_NAME);
                     ((NameNode *)pnval)->initCommon(tc);
                 }
 #endif
             }
 
-            pn2 = ParseNode::newBinaryOrAppend(TOK_COLON, op, pn3, pnval, tc);
+            pn2 = ParseNode::newBinaryOrAppend(PNK_COLON, op, pn3, pnval, tc);
           skip:
             if (!pn2)
                 return NULL;
@@ -6812,7 +6880,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
 
 #if JS_HAS_SHARP_VARS
       case TOK_DEFSHARP:
-        pn = UnaryNode::create(tc);
+        pn = UnaryNode::create(PNK_DEFSHARP, tc);
         if (!pn)
             return NULL;
         pn->pn_num = tokenStream.currentToken().sharpNumber();
@@ -6820,11 +6888,15 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         pn->pn_kid = primaryExpr(tt, JS_FALSE);
         if (!pn->pn_kid)
             return NULL;
-        if (pn->pn_kid->isKind(TOK_USESHARP) ||
-            pn->pn_kid->isKind(TOK_DEFSHARP) ||
-            pn->pn_kid->isKind(TOK_STRING) ||
-            pn->pn_kid->isKind(TOK_NUMBER) ||
-            pn->pn_kid->isKind(TOK_PRIMARY)) {
+        if (pn->pn_kid->isKind(PNK_USESHARP) ||
+            pn->pn_kid->isKind(PNK_DEFSHARP) ||
+            pn->pn_kid->isKind(PNK_STRING) ||
+            pn->pn_kid->isKind(PNK_NUMBER) ||
+            pn->pn_kid->isKind(PNK_TRUE) ||
+            pn->pn_kid->isKind(PNK_FALSE) ||
+            pn->pn_kid->isKind(PNK_NULL) ||
+            pn->pn_kid->isKind(PNK_THIS))
+        {
             reportErrorNumber(pn->pn_kid, JSREPORT_ERROR, JSMSG_BAD_SHARP_VAR_DEF);
             return NULL;
         }
@@ -6834,7 +6906,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
 
       case TOK_USESHARP:
         /* Check for forward/dangling references at runtime, to allow eval. */
-        pn = NullaryNode::create(tc);
+        pn = NullaryNode::create(PNK_USESHARP, tc);
         if (!pn)
             return NULL;
         if (!tc->ensureSharpSlots())
@@ -6858,12 +6930,20 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
 
 #if JS_HAS_XML_SUPPORT
       case TOK_STAR:
+        if (tc->inStrictMode()) {
+            reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_SYNTAX_ERROR);
+            return NULL;
+        }
         pn = qualifiedIdentifier();
         if (!pn)
             return NULL;
         break;
 
       case TOK_AT:
+        if (tc->inStrictMode()) {
+            reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_SYNTAX_ERROR);
+            return NULL;
+        }      
         pn = attributeIdentifier();
         if (!pn)
             return NULL;
@@ -6878,22 +6958,29 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
 
 #if JS_HAS_XML_SUPPORT
       case TOK_XMLCDATA:
-      case TOK_XMLCOMMENT:
         JS_ASSERT(!tc->inStrictMode());
-        /* FALL THROUGH */
-#endif
-      case TOK_STRING:
-        pn = NullaryNode::create(tc);
+        pn = atomNode(PNK_XMLCDATA, JSOP_XMLCDATA);
+        if (!pn)
+            return NULL;
+        break;
+
+      case TOK_XMLCOMMENT:
+        JS_ASSERT(!tc->inStrictMode());
+        pn = atomNode(PNK_XMLCOMMENT, JSOP_XMLCOMMENT);
+        if (!pn)
+            return NULL;
+        break;
+#endif
+      case TOK_STRING:
+        pn = atomNode(PNK_STRING, JSOP_STRING);
         if (!pn)
             return NULL;
-        pn->pn_atom = tokenStream.currentToken().atom();
-        pn->setOp(tokenStream.currentToken().t_op);
         break;
 
 #if JS_HAS_XML_SUPPORT
       case TOK_XMLPI:
         JS_ASSERT(!tc->inStrictMode());
-        pn = NullaryNode::create(tc);
+        pn = NullaryNode::create(PNK_XMLPI, tc);
         if (!pn)
             return NULL;
         pn->pn_pitarget = tokenStream.currentToken().xmlPITarget();
@@ -6902,7 +6989,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
 #endif
 
       case TOK_NAME:
-        pn = NameNode::create(tokenStream.currentToken().name(), tc);
+        pn = NameNode::create(PNK_NAME, tokenStream.currentToken().name(), tc);
         if (!pn)
             return NULL;
         JS_ASSERT(tokenStream.currentToken().t_op == JSOP_NAME);
@@ -7025,7 +7112,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                     }
 
                     pn->setArity(PN_NULLARY);
-                    pn->setKind(TOK_FUNCTION);
+                    pn->setKind(PNK_FUNCTION);
                 }
             }
             pn = qualifiedSuffix(pn);
@@ -7037,7 +7124,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
 
       case TOK_REGEXP:
       {
-        pn = NullaryNode::create(tc);
+        pn = NullaryNode::create(PNK_REGEXP, tc);
         if (!pn)
             return NULL;
 
@@ -7069,19 +7156,21 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
       }
 
       case TOK_NUMBER:
-        pn = NullaryNode::create(tc);
+        pn = NullaryNode::create(PNK_NUMBER, tc);
         if (!pn)
             return NULL;
         pn->setOp(JSOP_DOUBLE);
         pn->pn_dval = tokenStream.currentToken().number();
         break;
 
-      case TOK_PRIMARY:
-        pn = NullaryNode::create(tc);
-        if (!pn)
-            return NULL;
-        pn->setOp(tokenStream.currentToken().t_op);
-        break;
+      case TOK_TRUE:
+        return PrimaryExprNode(PNK_TRUE, JSOP_TRUE, tc);
+      case TOK_FALSE:
+        return PrimaryExprNode(PNK_FALSE, JSOP_FALSE, tc);
+      case TOK_THIS:
+        return PrimaryExprNode(PNK_THIS, JSOP_THIS, tc);
+      case TOK_NULL:
+        return PrimaryExprNode(PNK_NULL, JSOP_NULL, tc);
 
       case TOK_ERROR:
         /* The scanner or one of its subroutines reported the error. */
@@ -7117,8 +7206,8 @@ Parser::parenExpr(JSBool *genexp)
     if (tokenStream.matchToken(TOK_FOR)) {
         if (!guard.checkValidBody(pn))
             return NULL;
-        JS_ASSERT(!pn->isKind(TOK_YIELD));
-        if (pn->isKind(TOK_COMMA) && !pn->isInParens()) {
+        JS_ASSERT(!pn->isKind(PNK_YIELD));
+        if (pn->isKind(PNK_COMMA) && !pn->isInParens()) {
             reportErrorNumber(pn->last(), JSREPORT_ERROR, JSMSG_BAD_GENERATOR_SYNTAX,
                               js_generator_str);
             return NULL;
diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h
index 17f11e387c45..6ff7f3f9ced2 100644
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -141,6 +141,12 @@ struct Parser : private AutoGCRooter
         return allocator.allocNode();
     }
 
+    /*
+     * Create a parse node with the given kind and op using the current token's
+     * atom.
+     */
+    ParseNode *atomNode(ParseNodeKind kind, JSOp op);
+
   public:
     ParseNode *freeTree(ParseNode *pn) { return allocator.freeTree(pn); }
     void prepareNodeForMutation(ParseNode *pn) { return allocator.prepareNodeForMutation(pn); }
@@ -218,9 +224,11 @@ struct Parser : private AutoGCRooter
 
     ParseNode *functionDef(PropertyName *name, FunctionType type, FunctionSyntaxKind kind);
 
+    ParseNode *unaryOpExpr(ParseNodeKind kind, JSOp op);
+
     ParseNode *condition();
     ParseNode *comprehensionTail(ParseNode *kid, uintN blockid, bool isGenexp,
-                                 TokenKind type = TOK_SEMI, JSOp op = JSOP_NOP);
+                                 ParseNodeKind kind = PNK_SEMI, JSOp op = JSOP_NOP);
     ParseNode *generatorExpr(ParseNode *kid);
     JSBool argumentList(ParseNode *listNode);
     ParseNode *bracketedExpr();
@@ -236,9 +244,8 @@ struct Parser : private AutoGCRooter
     ParseNode *qualifiedIdentifier();
     ParseNode *attributeIdentifier();
     ParseNode *xmlExpr(JSBool inTag);
-    ParseNode *xmlAtomNode();
     ParseNode *xmlNameExpr();
-    ParseNode *xmlTagContent(TokenKind tagtype, JSAtom **namep);
+    ParseNode *xmlTagContent(ParseNodeKind tagkind, JSAtom **namep);
     JSBool xmlElementContent(ParseNode *pn);
     ParseNode *xmlElementOrList(JSBool allowList);
     ParseNode *xmlElementOrListRoot(JSBool allowList);
diff --git a/js/src/frontend/SemanticAnalysis.cpp b/js/src/frontend/SemanticAnalysis.cpp
index 79984e40148a..03eabc26bcd5 100644
--- a/js/src/frontend/SemanticAnalysis.cpp
+++ b/js/src/frontend/SemanticAnalysis.cpp
@@ -45,6 +45,7 @@
 #include "frontend/BytecodeEmitter.h"
 #include "frontend/Parser.h"
 
+#include "jsobjinlines.h"
 #include "jsfuninlines.h"
 
 using namespace js;
@@ -194,7 +195,7 @@ FindFunArgs(FunctionBox *funbox, int level, FunctionBoxQueue *queue)
         uintN skipmin = UpvarCookie::FREE_LEVEL;
         ParseNode *pn = fn->pn_body;
 
-        if (pn->isKind(TOK_UPVARS)) {
+        if (pn->isKind(PNK_UPVARS)) {
             AtomDefnMapPtr &upvars = pn->pn_names;
             JS_ASSERT(upvars->count() != 0);
 
@@ -273,7 +274,7 @@ MarkFunArgs(JSContext *cx, FunctionBox *funbox, uint32 functionCount)
         JS_ASSERT(fn->isFunArg());
 
         ParseNode *pn = fn->pn_body;
-        if (pn->isKind(TOK_UPVARS)) {
+        if (pn->isKind(PNK_UPVARS)) {
             AtomDefnMapPtr upvars = pn->pn_names;
             JS_ASSERT(!upvars->empty());
 
@@ -528,11 +529,11 @@ ConsiderUnbranding(FunctionBox *funbox)
 #if JS_HAS_EXPR_CLOSURES
     {
         ParseNode *pn2 = funbox->node->pn_body;
-        if (pn2->isKind(TOK_UPVARS))
+        if (pn2->isKind(PNK_UPVARS))
             pn2 = pn2->pn_tree;
-        if (pn2->isKind(TOK_ARGSBODY))
+        if (pn2->isKind(PNK_ARGSBODY))
             pn2 = pn2->last();
-        if (!pn2->isKind(TOK_LC))
+        if (!pn2->isKind(PNK_LC))
             returnsExpr = true;
     }
 #endif
@@ -585,7 +586,7 @@ SetFunctionKinds(FunctionBox *funbox, uint32 *tcflags, bool isDirectEval)
             bool hasUpvars = false;
             bool canFlatten = true;
 
-            if (pn->isKind(TOK_UPVARS)) {
+            if (pn->isKind(PNK_UPVARS)) {
                 AtomDefnMapPtr upvars = pn->pn_names;
                 JS_ASSERT(!upvars->empty());
 
@@ -630,13 +631,13 @@ SetFunctionKinds(FunctionBox *funbox, uint32 *tcflags, bool isDirectEval)
                     fn->setOp(JSOP_LAMBDA_FC);
                     break;
                   default:
-                    /* js_EmitTree's case TOK_FUNCTION: will select op. */
+                    /* js::frontend::EmitTree's PNK_FUNCTION case sets op. */
                     JS_ASSERT(fn->isOp(JSOP_NOP));
                 }
             }
         }
 
-        if (fun->kind() == JSFUN_INTERPRETED && pn->isKind(TOK_UPVARS)) {
+        if (fun->kind() == JSFUN_INTERPRETED && pn->isKind(PNK_UPVARS)) {
             /*
              * One or more upvars cannot be safely snapshot into a flat
              * closure's non-reserved slot (see JSOP_GETFCSLOT), so we loop
diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
index 4dc851f43772..743269d03415 100644
--- a/js/src/frontend/TokenStream.cpp
+++ b/js/src/frontend/TokenStream.cpp
@@ -1558,8 +1558,13 @@ TokenStream::getTokenInternal()
 
     if (c1kind == Equals) {
         if (matchChar('=')) {
-            tp->t_op = matchChar('=') ? JSOP_STRICTEQ : JSOP_EQ;
-            tt = TOK_EQOP;
+            if (matchChar('=')) {
+                tp->t_op = JSOP_STRICTEQ;
+                tt = TOK_STRICTEQ;
+            } else {
+                tp->t_op = JSOP_EQ;
+                tt = TOK_EQ;
+            }
         } else {
             tp->t_op = JSOP_NOP;
             tt = TOK_ASSIGN;
@@ -1750,7 +1755,7 @@ TokenStream::getTokenInternal()
     if (c1kind == Plus) {
         if (matchChar('=')) {
             tp->t_op = JSOP_ADD;
-            tt = TOK_ASSIGN;
+            tt = TOK_ADDASSIGN;
         } else if (matchChar('+')) {
             tt = TOK_INC;
         } else {
@@ -1840,7 +1845,7 @@ TokenStream::getTokenInternal()
             tt = TOK_OR;
         } else if (matchChar('=')) {
             tp->t_op = JSOP_BITOR;
-            tt = TOK_ASSIGN;
+            tt = TOK_BITORASSIGN;
         } else {
             tt = TOK_BITOR;
         }
@@ -1849,18 +1854,18 @@ TokenStream::getTokenInternal()
       case '^':
         if (matchChar('=')) {
             tp->t_op = JSOP_BITXOR;
-            tt = TOK_ASSIGN;
+            tt = TOK_BITXORASSIGN;
         } else {
             tt = TOK_BITXOR;
         }
         break;
 
       case '&':
-        if (matchChar(c)) {
+        if (matchChar('&')) {
             tt = TOK_AND;
         } else if (matchChar('=')) {
             tp->t_op = JSOP_BITAND;
-            tt = TOK_ASSIGN;
+            tt = TOK_BITANDASSIGN;
         } else {
             tt = TOK_BITAND;
         }
@@ -1868,11 +1873,16 @@ TokenStream::getTokenInternal()
 
       case '!':
         if (matchChar('=')) {
-            tp->t_op = matchChar('=') ? JSOP_STRICTNE : JSOP_NE;
-            tt = TOK_EQOP;
+            if (matchChar('=')) {
+                tp->t_op = JSOP_STRICTNE;
+                tt = TOK_STRICTNE;
+            } else {
+                tp->t_op = JSOP_NE;
+                tt = TOK_NE;
+            }
         } else {
             tp->t_op = JSOP_NOT;
-            tt = TOK_UNARYOP;
+            tt = TOK_NOT;
         }
         break;
 
@@ -1902,28 +1912,43 @@ TokenStream::getTokenInternal()
             }
             ungetChar('!');
         }
-        if (matchChar(c)) {
+        if (matchChar('<')) {
             tp->t_op = JSOP_LSH;
-            tt = matchChar('=') ? TOK_ASSIGN : TOK_SHOP;
+            tt = matchChar('=') ? TOK_LSHASSIGN : TOK_LSH;
         } else {
-            tp->t_op = matchChar('=') ? JSOP_LE : JSOP_LT;
-            tt = TOK_RELOP;
+            if (matchChar('=')) {
+                tp->t_op = JSOP_LE;
+                tt = TOK_LE;
+            } else {
+                tp->t_op = JSOP_LT;
+                tt = TOK_LT;
+            }
         }
         break;
 
       case '>':
-        if (matchChar(c)) {
-            tp->t_op = matchChar(c) ? JSOP_URSH : JSOP_RSH;
-            tt = matchChar('=') ? TOK_ASSIGN : TOK_SHOP;
+        if (matchChar('>')) {
+            if (matchChar('>')) {
+                tp->t_op = JSOP_URSH;
+                tt = matchChar('=') ? TOK_URSHASSIGN : TOK_URSH;
+            } else {
+                tp->t_op = JSOP_RSH;
+                tt = matchChar('=') ? TOK_RSHASSIGN : TOK_RSH;
+            }
         } else {
-            tp->t_op = matchChar('=') ? JSOP_GE : JSOP_GT;
-            tt = TOK_RELOP;
+            if (matchChar('=')) {
+                tp->t_op = JSOP_GE;
+                tt = TOK_GE;
+            } else {
+                tp->t_op = JSOP_GT;
+                tt = TOK_GT;
+            }
         }
         break;
 
       case '*':
         tp->t_op = JSOP_MUL;
-        tt = matchChar('=') ? TOK_ASSIGN : TOK_STAR;
+        tt = matchChar('=') ? TOK_MULASSIGN : TOK_STAR;
         break;
 
       case '/':
@@ -2038,23 +2063,23 @@ TokenStream::getTokenInternal()
         }
 
         tp->t_op = JSOP_DIV;
-        tt = matchChar('=') ? TOK_ASSIGN : TOK_DIVOP;
+        tt = matchChar('=') ? TOK_DIVASSIGN : TOK_DIV;
         break;
 
       case '%':
         tp->t_op = JSOP_MOD;
-        tt = matchChar('=') ? TOK_ASSIGN : TOK_DIVOP;
+        tt = matchChar('=') ? TOK_MODASSIGN : TOK_MOD;
         break;
 
       case '~':
         tp->t_op = JSOP_BITNOT;
-        tt = TOK_UNARYOP;
+        tt = TOK_BITNOT;
         break;
 
       case '-':
         if (matchChar('=')) {
             tp->t_op = JSOP_SUB;
-            tt = TOK_ASSIGN;
+            tt = TOK_SUBASSIGN;
         } else if (matchChar(c)) {
             if (peekChar() == '>' && !(flags & TSF_DIRTYLINE)) {
                 flags &= ~TSF_IN_HTML_COMMENT;
@@ -2173,3 +2198,124 @@ js_fgets(char *buf, int size, FILE *file)
     buf[i] = '\0';
     return i;
 }
+
+#ifdef DEBUG
+const char *
+TokenKindToString(TokenKind tt)
+{
+    switch (tt) {
+      case TOK_ERROR:           return "TOK_ERROR";
+      case TOK_EOF:             return "TOK_EOF";
+      case TOK_EOL:             return "TOK_EOL";
+      case TOK_SEMI:            return "TOK_SEMI";
+      case TOK_COMMA:           return "TOK_COMMA";
+      case TOK_HOOK:            return "TOK_HOOK";
+      case TOK_COLON:           return "TOK_COLON";
+      case TOK_OR:              return "TOK_OR";
+      case TOK_AND:             return "TOK_AND";
+      case TOK_BITOR:           return "TOK_BITOR";
+      case TOK_BITXOR:          return "TOK_BITXOR";
+      case TOK_BITAND:          return "TOK_BITAND";
+      case TOK_PLUS:            return "TOK_PLUS";
+      case TOK_MINUS:           return "TOK_MINUS";
+      case TOK_STAR:            return "TOK_STAR";
+      case TOK_DIV:             return "TOK_DIV";
+      case TOK_MOD:             return "TOK_MOD";
+      case TOK_INC:             return "TOK_INC";
+      case TOK_DEC:             return "TOK_DEC";
+      case TOK_DOT:             return "TOK_DOT";
+      case TOK_LB:              return "TOK_LB";
+      case TOK_RB:              return "TOK_RB";
+      case TOK_LC:              return "TOK_LC";
+      case TOK_RC:              return "TOK_RC";
+      case TOK_LP:              return "TOK_LP";
+      case TOK_RP:              return "TOK_RP";
+      case TOK_NAME:            return "TOK_NAME";
+      case TOK_NUMBER:          return "TOK_NUMBER";
+      case TOK_STRING:          return "TOK_STRING";
+      case TOK_REGEXP:          return "TOK_REGEXP";
+      case TOK_TRUE:            return "TOK_TRUE";
+      case TOK_FALSE:           return "TOK_FALSE";
+      case TOK_NULL:            return "TOK_NULL";
+      case TOK_THIS:            return "TOK_THIS";
+      case TOK_FUNCTION:        return "TOK_FUNCTION";
+      case TOK_IF:              return "TOK_IF";
+      case TOK_ELSE:            return "TOK_ELSE";
+      case TOK_SWITCH:          return "TOK_SWITCH";
+      case TOK_CASE:            return "TOK_CASE";
+      case TOK_DEFAULT:         return "TOK_DEFAULT";
+      case TOK_WHILE:           return "TOK_WHILE";
+      case TOK_DO:              return "TOK_DO";
+      case TOK_FOR:             return "TOK_FOR";
+      case TOK_BREAK:           return "TOK_BREAK";
+      case TOK_CONTINUE:        return "TOK_CONTINUE";
+      case TOK_IN:              return "TOK_IN";
+      case TOK_VAR:             return "TOK_VAR";
+      case TOK_WITH:            return "TOK_WITH";
+      case TOK_RETURN:          return "TOK_RETURN";
+      case TOK_NEW:             return "TOK_NEW";
+      case TOK_DELETE:          return "TOK_DELETE";
+      case TOK_DEFSHARP:        return "TOK_DEFSHARP";
+      case TOK_USESHARP:        return "TOK_USESHARP";
+      case TOK_TRY:             return "TOK_TRY";
+      case TOK_CATCH:           return "TOK_CATCH";
+      case TOK_FINALLY:         return "TOK_FINALLY";
+      case TOK_THROW:           return "TOK_THROW";
+      case TOK_INSTANCEOF:      return "TOK_INSTANCEOF";
+      case TOK_DEBUGGER:        return "TOK_DEBUGGER";
+      case TOK_XMLSTAGO:        return "TOK_XMLSTAGO";
+      case TOK_XMLETAGO:        return "TOK_XMLETAGO";
+      case TOK_XMLPTAGC:        return "TOK_XMLPTAGC";
+      case TOK_XMLTAGC:         return "TOK_XMLTAGC";
+      case TOK_XMLNAME:         return "TOK_XMLNAME";
+      case TOK_XMLATTR:         return "TOK_XMLATTR";
+      case TOK_XMLSPACE:        return "TOK_XMLSPACE";
+      case TOK_XMLTEXT:         return "TOK_XMLTEXT";
+      case TOK_XMLCOMMENT:      return "TOK_XMLCOMMENT";
+      case TOK_XMLCDATA:        return "TOK_XMLCDATA";
+      case TOK_XMLPI:           return "TOK_XMLPI";
+      case TOK_AT:              return "TOK_AT";
+      case TOK_DBLCOLON:        return "TOK_DBLCOLON";
+      case TOK_ANYNAME:         return "TOK_ANYNAME";
+      case TOK_DBLDOT:          return "TOK_DBLDOT";
+      case TOK_FILTER:          return "TOK_FILTER";
+      case TOK_XMLELEM:         return "TOK_XMLELEM";
+      case TOK_XMLLIST:         return "TOK_XMLLIST";
+      case TOK_YIELD:           return "TOK_YIELD";
+      case TOK_LEXICALSCOPE:    return "TOK_LEXICALSCOPE";
+      case TOK_LET:             return "TOK_LET";
+      case TOK_RESERVED:        return "TOK_RESERVED";
+      case TOK_STRICT_RESERVED: return "TOK_STRICT_RESERVED";
+      case TOK_STRICTEQ:        return "TOK_STRICTEQ";
+      case TOK_EQ:              return "TOK_EQ";
+      case TOK_STRICTNE:        return "TOK_STRICTNE";
+      case TOK_NE:              return "TOK_NE";
+      case TOK_TYPEOF:          return "TOK_TYPEOF";
+      case TOK_VOID:            return "TOK_VOID";
+      case TOK_NOT:             return "TOK_NOT";
+      case TOK_BITNOT:          return "TOK_BITNOT";
+      case TOK_LT:              return "TOK_LT";
+      case TOK_LE:              return "TOK_LE";
+      case TOK_GT:              return "TOK_GT";
+      case TOK_GE:              return "TOK_GE";
+      case TOK_LSH:             return "TOK_LSH";
+      case TOK_RSH:             return "TOK_RSH";
+      case TOK_URSH:            return "TOK_URSH";
+      case TOK_ASSIGN:          return "TOK_ASSIGN";
+      case TOK_ADDASSIGN:       return "TOK_ADDASSIGN";
+      case TOK_SUBASSIGN:       return "TOK_SUBASSIGN";
+      case TOK_BITORASSIGN:     return "TOK_BITORASSIGN";
+      case TOK_BITXORASSIGN:    return "TOK_BITXORASSIGN";
+      case TOK_BITANDASSIGN:    return "TOK_BITANDASSIGN";
+      case TOK_LSHASSIGN:       return "TOK_LSHASSIGN";
+      case TOK_RSHASSIGN:       return "TOK_RSHASSIGN";
+      case TOK_URSHASSIGN:      return "TOK_URSHASSIGN";
+      case TOK_MULASSIGN:       return "TOK_MULASSIGN";
+      case TOK_DIVASSIGN:       return "TOK_DIVASSIGN";
+      case TOK_MODASSIGN:       return "TOK_MODASSIGN";
+      case TOK_LIMIT:           break;
+    }
+
+    return "<bad TokenKind>";
+}
+#endif
diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
index 3e6a84944eac..a47917dcf205 100644
--- a/js/src/frontend/TokenStream.h
+++ b/js/src/frontend/TokenStream.h
@@ -63,95 +63,143 @@
 namespace js {
 
 enum TokenKind {
-    TOK_ERROR = -1,                     /* well-known as the only code < EOF */
-    TOK_EOF = 0,                        /* end of file */
-    TOK_EOL = 1,                        /* end of line; only returned by peekTokenSameLine() */
-    TOK_SEMI = 2,                       /* semicolon */
-    TOK_COMMA = 3,                      /* comma operator */
-    TOK_ASSIGN = 4,                     /* assignment ops (= += -= etc.) */
-    TOK_HOOK = 5, TOK_COLON = 6,        /* conditional (?:) */
-    TOK_OR = 7,                         /* logical or (||) */
-    TOK_AND = 8,                        /* logical and (&&) */
-    TOK_BITOR = 9,                      /* bitwise-or (|) */
-    TOK_BITXOR = 10,                    /* bitwise-xor (^) */
-    TOK_BITAND = 11,                    /* bitwise-and (&) */
-    TOK_EQOP = 12,                      /* equality ops (== !=) */
-    TOK_RELOP = 13,                     /* relational ops (< <= > >=) */
-    TOK_SHOP = 14,                      /* shift ops (<< >> >>>) */
-    TOK_PLUS = 15,                      /* plus */
-    TOK_MINUS = 16,                     /* minus */
-    TOK_STAR = 17, TOK_DIVOP = 18,      /* multiply/divide ops (* / %) */
-    TOK_UNARYOP = 19,                   /* unary prefix operator */
-    TOK_INC = 20, TOK_DEC = 21,         /* increment/decrement (++ --) */
-    TOK_DOT = 22,                       /* member operator (.) */
-    TOK_LB = 23, TOK_RB = 24,           /* left and right brackets */
-    TOK_LC = 25, TOK_RC = 26,           /* left and right curlies (braces) */
-    TOK_LP = 27, TOK_RP = 28,           /* left and right parentheses */
-    TOK_NAME = 29,                      /* identifier */
-    TOK_NUMBER = 30,                    /* numeric constant */
-    TOK_STRING = 31,                    /* string constant */
-    TOK_REGEXP = 32,                    /* RegExp constant */
-    TOK_PRIMARY = 33,                   /* true, false, null, this, super */
-    TOK_FUNCTION = 34,                  /* function keyword */
-    TOK_IF = 35,                        /* if keyword */
-    TOK_ELSE = 36,                      /* else keyword */
-    TOK_SWITCH = 37,                    /* switch keyword */
-    TOK_CASE = 38,                      /* case keyword */
-    TOK_DEFAULT = 39,                   /* default keyword */
-    TOK_WHILE = 40,                     /* while keyword */
-    TOK_DO = 41,                        /* do keyword */
-    TOK_FOR = 42,                       /* for keyword */
-    TOK_BREAK = 43,                     /* break keyword */
-    TOK_CONTINUE = 44,                  /* continue keyword */
-    TOK_IN = 45,                        /* in keyword */
-    TOK_VAR = 46,                       /* var keyword */
-    TOK_WITH = 47,                      /* with keyword */
-    TOK_RETURN = 48,                    /* return keyword */
-    TOK_NEW = 49,                       /* new keyword */
-    TOK_DELETE = 50,                    /* delete keyword */
-    TOK_DEFSHARP = 51,                  /* #n= for object/array initializers */
-    TOK_USESHARP = 52,                  /* #n# for object/array initializers */
-    TOK_TRY = 53,                       /* try keyword */
-    TOK_CATCH = 54,                     /* catch keyword */
-    TOK_FINALLY = 55,                   /* finally keyword */
-    TOK_THROW = 56,                     /* throw keyword */
-    TOK_INSTANCEOF = 57,                /* instanceof keyword */
-    TOK_DEBUGGER = 58,                  /* debugger keyword */
-    TOK_XMLSTAGO = 59,                  /* XML start tag open (<) */
-    TOK_XMLETAGO = 60,                  /* XML end tag open (</) */
-    TOK_XMLPTAGC = 61,                  /* XML point tag close (/>) */
-    TOK_XMLTAGC = 62,                   /* XML start or end tag close (>) */
-    TOK_XMLNAME = 63,                   /* XML start-tag non-final fragment */
-    TOK_XMLATTR = 64,                   /* XML quoted attribute value */
-    TOK_XMLSPACE = 65,                  /* XML whitespace */
-    TOK_XMLTEXT = 66,                   /* XML text */
-    TOK_XMLCOMMENT = 67,                /* XML comment */
-    TOK_XMLCDATA = 68,                  /* XML CDATA section */
-    TOK_XMLPI = 69,                     /* XML processing instruction */
-    TOK_AT = 70,                        /* XML attribute op (@) */
-    TOK_DBLCOLON = 71,                  /* namespace qualified name op (::) */
-    TOK_ANYNAME = 72,                   /* XML AnyName singleton (*) */
-    TOK_DBLDOT = 73,                    /* XML descendant op (..) */
-    TOK_FILTER = 74,                    /* XML filtering predicate op (.()) */
-    TOK_XMLELEM = 75,                   /* XML element node type (no token) */
-    TOK_XMLLIST = 76,                   /* XML list node type (no token) */
-    TOK_YIELD = 77,                     /* yield from generator function */
-    TOK_ARRAYCOMP = 78,                 /* array comprehension initialiser */
-    TOK_ARRAYPUSH = 79,                 /* array push within comprehension */
-    TOK_LEXICALSCOPE = 80,              /* block scope AST node label */
-    TOK_LET = 81,                       /* let keyword */
-    TOK_SEQ = 82,                       /* synthetic sequence of statements,
-                                           not a block */
-    TOK_FORHEAD = 83,                   /* head of for(;;)-style loop */
-    TOK_ARGSBODY = 84,                  /* formal args in list + body at end */
-    TOK_UPVARS = 85,                    /* lexical dependencies as JSAtomDefnMap
-                                           of definitions paired with a parse
-                                           tree full of uses of those names */
-    TOK_RESERVED,                       /* reserved keywords */
-    TOK_STRICT_RESERVED,                /* reserved keywords in strict mode */
-    TOK_LIMIT                           /* domain size */
+    TOK_ERROR = -1,                /* well-known as the only code < EOF */
+    TOK_EOF,                       /* end of file */
+    TOK_EOL,                       /* end of line; only returned by peekTokenSameLine() */
+    TOK_SEMI,                      /* semicolon */
+    TOK_COMMA,                     /* comma operator */
+    TOK_HOOK, TOK_COLON,           /* conditional (?:) */
+    TOK_OR,                        /* logical or (||) */
+    TOK_AND,                       /* logical and (&&) */
+    TOK_BITOR,                     /* bitwise-or (|) */
+    TOK_BITXOR,                    /* bitwise-xor (^) */
+    TOK_BITAND,                    /* bitwise-and (&) */
+    TOK_PLUS,                      /* plus */
+    TOK_MINUS,                     /* minus */
+    TOK_STAR,                      /* multiply */
+    TOK_DIV,                       /* divide */
+    TOK_MOD,                       /* modulus */
+    TOK_INC, TOK_DEC,              /* increment/decrement (++ --) */
+    TOK_DOT,                       /* member operator (.) */
+    TOK_LB, TOK_RB,                /* left and right brackets */
+    TOK_LC, TOK_RC,                /* left and right curlies (braces) */
+    TOK_LP, TOK_RP,                /* left and right parentheses */
+    TOK_NAME,                      /* identifier */
+    TOK_NUMBER,                    /* numeric constant */
+    TOK_STRING,                    /* string constant */
+    TOK_REGEXP,                    /* RegExp constant */
+    TOK_TRUE,                      /* true */
+    TOK_FALSE,                     /* false */
+    TOK_NULL,                      /* null */
+    TOK_THIS,                      /* this */
+    TOK_FUNCTION,                  /* function keyword */
+    TOK_IF,                        /* if keyword */
+    TOK_ELSE,                      /* else keyword */
+    TOK_SWITCH,                    /* switch keyword */
+    TOK_CASE,                      /* case keyword */
+    TOK_DEFAULT,                   /* default keyword */
+    TOK_WHILE,                     /* while keyword */
+    TOK_DO,                        /* do keyword */
+    TOK_FOR,                       /* for keyword */
+    TOK_BREAK,                     /* break keyword */
+    TOK_CONTINUE,                  /* continue keyword */
+    TOK_IN,                        /* in keyword */
+    TOK_VAR,                       /* var keyword */
+    TOK_WITH,                      /* with keyword */
+    TOK_RETURN,                    /* return keyword */
+    TOK_NEW,                       /* new keyword */
+    TOK_DELETE,                    /* delete keyword */
+    TOK_DEFSHARP,                  /* #n= for object/array initializers */
+    TOK_USESHARP,                  /* #n# for object/array initializers */
+    TOK_TRY,                       /* try keyword */
+    TOK_CATCH,                     /* catch keyword */
+    TOK_FINALLY,                   /* finally keyword */
+    TOK_THROW,                     /* throw keyword */
+    TOK_INSTANCEOF,                /* instanceof keyword */
+    TOK_DEBUGGER,                  /* debugger keyword */
+    TOK_XMLSTAGO,                  /* XML start tag open (<) */
+    TOK_XMLETAGO,                  /* XML end tag open (</) */
+    TOK_XMLPTAGC,                  /* XML point tag close (/>) */
+    TOK_XMLTAGC,                   /* XML start or end tag close (>) */
+    TOK_XMLNAME,                   /* XML start-tag non-final fragment */
+    TOK_XMLATTR,                   /* XML quoted attribute value */
+    TOK_XMLSPACE,                  /* XML whitespace */
+    TOK_XMLTEXT,                   /* XML text */
+    TOK_XMLCOMMENT,                /* XML comment */
+    TOK_XMLCDATA,                  /* XML CDATA section */
+    TOK_XMLPI,                     /* XML processing instruction */
+    TOK_AT,                        /* XML attribute op (@) */
+    TOK_DBLCOLON,                  /* namespace qualified name op (::) */
+    TOK_ANYNAME,                   /* XML AnyName singleton (*) */
+    TOK_DBLDOT,                    /* XML descendant op (..) */
+    TOK_FILTER,                    /* XML filtering predicate op (.()) */
+    TOK_XMLELEM,                   /* XML element node type (no token) */
+    TOK_XMLLIST,                   /* XML list node type (no token) */
+    TOK_YIELD,                     /* yield from generator function */
+    TOK_LEXICALSCOPE,              /* block scope AST node label */
+    TOK_LET,                       /* let keyword */
+    TOK_RESERVED,                  /* reserved keywords */
+    TOK_STRICT_RESERVED,           /* reserved keywords in strict mode */
+
+    /*
+     * The following token types occupy contiguous ranges to enable easy
+     * range-testing.
+     */
+
+    /* Equality operation tokens, per TokenKindIsEquality */
+    TOK_STRICTEQ,
+    TOK_EQUALITY_START = TOK_STRICTEQ,
+    TOK_EQ,
+    TOK_STRICTNE,
+    TOK_NE,
+    TOK_EQUALITY_LAST = TOK_NE,
+
+    /* Unary operation tokens */
+    TOK_TYPEOF,
+    TOK_VOID,
+    TOK_NOT,
+    TOK_BITNOT,
+
+    /* Relational ops (< <= > >=), per TokenKindIsRelational */
+    TOK_LT,
+    TOK_RELOP_START = TOK_LT,
+    TOK_LE,
+    TOK_GT,
+    TOK_GE,
+    TOK_RELOP_LAST = TOK_GE,
+
+    /* Shift ops (<< >> >>>), per TokenKindIsShift */
+    TOK_LSH,
+    TOK_SHIFTOP_START = TOK_LSH,
+    TOK_RSH,
+    TOK_URSH,
+    TOK_SHIFTOP_LAST = TOK_URSH,
+
+    /* Assignment ops (= += -= etc.), per TokenKindIsAssignment */
+    TOK_ASSIGN,                    /* assignment ops (= += -= etc.) */
+    TOK_ASSIGNMENT_START = TOK_ASSIGN,
+    TOK_ADDASSIGN,
+    TOK_SUBASSIGN,
+    TOK_BITORASSIGN,
+    TOK_BITXORASSIGN,
+    TOK_BITANDASSIGN,
+    TOK_LSHASSIGN,
+    TOK_RSHASSIGN,
+    TOK_URSHASSIGN,
+    TOK_MULASSIGN,
+    TOK_DIVASSIGN,
+    TOK_MODASSIGN,
+    TOK_ASSIGNMENT_LAST = TOK_MODASSIGN,
+
+    TOK_LIMIT                      /* domain size */
 };
 
+inline bool
+TokenKindIsEquality(TokenKind tt)
+{
+    return TOK_EQUALITY_START <= tt && tt <= TOK_EQUALITY_LAST;
+}
+
 inline bool
 TokenKindIsXML(TokenKind tt)
 {
@@ -159,10 +207,21 @@ TokenKindIsXML(TokenKind tt)
 }
 
 inline bool
-TreeTypeIsXML(TokenKind tt)
+TokenKindIsRelational(TokenKind tt)
 {
-    return tt == TOK_XMLCOMMENT || tt == TOK_XMLCDATA || tt == TOK_XMLPI ||
-           tt == TOK_XMLELEM || tt == TOK_XMLLIST;
+    return TOK_RELOP_START <= tt && tt <= TOK_RELOP_LAST;
+}
+
+inline bool
+TokenKindIsShift(TokenKind tt)
+{
+    return TOK_SHIFTOP_START <= tt && tt <= TOK_SHIFTOP_LAST;
+}
+
+inline bool
+TokenKindIsAssignment(TokenKind tt)
+{
+    return TOK_ASSIGNMENT_START <= tt && tt <= TOK_ASSIGNMENT_LAST;
 }
 
 inline bool
@@ -454,6 +513,22 @@ class TokenStream
     bool hasXML() const { return xml || VersionShouldParseXML(versionNumber()); }
     void setXML(bool enabled) { xml = enabled; }
 
+    bool isCurrentTokenEquality() const {
+        return TokenKindIsEquality(currentToken().type);
+    }
+
+    bool isCurrentTokenRelational() const {
+        return TokenKindIsRelational(currentToken().type);
+    }
+
+    bool isCurrentTokenShift() const {
+        return TokenKindIsShift(currentToken().type);
+    }
+
+    bool isCurrentTokenAssignment() const {
+        return TokenKindIsAssignment(currentToken().type);
+    }
+
     /* Flag methods. */
     void setStrictMode(bool enabled = true) { setFlag(enabled, TSF_STRICT_MODE_CODE); }
     void setXMLTagMode(bool enabled = true) { setFlag(enabled, TSF_XMLTAGMODE); }
@@ -834,4 +909,9 @@ ReportStrictModeError(JSContext *cx, TokenStream *ts, TreeContext *tc, ParseNode
 extern JS_FRIEND_API(int)
 js_fgets(char *buf, int size, FILE *file);
 
+#ifdef DEBUG
+extern const char *
+TokenKindToString(js::TokenKind tt);
+#endif
+
 #endif /* TokenStream_h__ */
diff --git a/js/src/gc/Barrier-inl.h b/js/src/gc/Barrier-inl.h
new file mode 100644
index 000000000000..d7a496df7f5e
--- /dev/null
+++ b/js/src/gc/Barrier-inl.h
@@ -0,0 +1,259 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sw=4 et tw=78:
+ *
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is SpiderMonkey global object code.
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "jsgcmark.h"
+
+#include "gc/Barrier.h"
+
+#ifndef jsgc_barrier_inl_h___
+#define jsgc_barrier_inl_h___
+
+namespace js {
+
+static JS_ALWAYS_INLINE void
+ClearValueRange(JSCompartment *comp, HeapValue *vec, uintN len, bool useHoles)
+{
+    if (useHoles) {
+        for (uintN i = 0; i < len; i++)
+            vec[i].set(comp, MagicValue(JS_ARRAY_HOLE));
+    } else {
+        for (uintN i = 0; i < len; i++)
+            vec[i].set(comp, UndefinedValue());
+    }
+}
+
+static JS_ALWAYS_INLINE void
+InitValueRange(HeapValue *vec, uintN len, bool useHoles)
+{
+    if (useHoles) {
+        for (uintN i = 0; i < len; i++)
+            vec[i].init(MagicValue(JS_ARRAY_HOLE));
+    } else {
+        for (uintN i = 0; i < len; i++)
+            vec[i].init(UndefinedValue());
+    }
+}
+
+static JS_ALWAYS_INLINE void
+DestroyValueRange(HeapValue *vec, uintN len)
+{
+    for (uintN i = 0; i < len; i++)
+        vec[i].~HeapValue();
+}
+
+inline
+HeapValue::HeapValue(const Value &v)
+    : value(v)
+{
+    post();
+}
+
+inline
+HeapValue::HeapValue(const HeapValue &v)
+    : value(v.value)
+{
+    post();
+}
+
+inline
+HeapValue::~HeapValue()
+{
+    pre();
+}
+
+inline void
+HeapValue::init(const Value &v)
+{
+    value = v;
+    post();
+}
+
+inline void
+HeapValue::writeBarrierPre(const Value &value)
+{
+#ifdef JSGC_INCREMENTAL
+    if (value.isMarkable()) {
+        js::gc::Cell *cell = (js::gc::Cell *)value.toGCThing();
+        writeBarrierPre(cell->compartment(), value);
+    }
+#endif
+}
+
+inline void
+HeapValue::writeBarrierPost(const Value &value, void *addr)
+{
+}
+
+inline void
+HeapValue::writeBarrierPre(JSCompartment *comp, const Value &value)
+{
+#ifdef JSGC_INCREMENTAL
+    if (comp->needsBarrier())
+        js::gc::MarkValueUnbarriered(comp->barrierTracer(), value, "write barrier");
+#endif
+}
+
+inline void
+HeapValue::writeBarrierPost(JSCompartment *comp, const Value &value, void *addr)
+{
+}
+
+inline void
+HeapValue::pre()
+{
+    writeBarrierPre(value);
+}
+
+inline void
+HeapValue::post()
+{
+}
+
+inline void
+HeapValue::pre(JSCompartment *comp)
+{
+    writeBarrierPre(comp, value);
+}
+
+inline void
+HeapValue::post(JSCompartment *comp)
+{
+}
+
+inline HeapValue &
+HeapValue::operator=(const Value &v)
+{
+    pre();
+    value = v;
+    post();
+    return *this;
+}
+
+inline HeapValue &
+HeapValue::operator=(const HeapValue &v)
+{
+    pre();
+    value = v.value;
+    post();
+    return *this;
+}
+
+inline void
+HeapValue::set(JSCompartment *comp, const Value &v)
+{
+#ifdef DEBUG
+    if (value.isMarkable()) {
+        js::gc::Cell *cell = (js::gc::Cell *)value.toGCThing();
+        JS_ASSERT(cell->compartment() == comp ||
+                  cell->compartment() == comp->rt->atomsCompartment);
+    }
+#endif
+
+    pre(comp);
+    value = v;
+    post(comp);
+}
+
+inline void
+HeapValue::boxNonDoubleFrom(JSValueType type, uint64 *out)
+{
+    pre();
+    value.boxNonDoubleFrom(type, out);
+    post();
+}
+
+inline
+HeapId::HeapId(jsid id)
+    : value(id)
+{
+    post();
+}
+
+inline
+HeapId::~HeapId()
+{
+    pre();
+}
+
+inline void
+HeapId::init(jsid id)
+{
+    value = id;
+    post();
+}
+
+inline void
+HeapId::pre()
+{
+#ifdef JSGC_INCREMENTAL
+    if (JS_UNLIKELY(JSID_IS_OBJECT(value))) {
+        JSObject *obj = JSID_TO_OBJECT(value);
+        JSCompartment *comp = obj->compartment();
+        if (comp->needsBarrier())
+            js::gc::MarkObjectUnbarriered(comp->barrierTracer(), obj, "write barrier");
+    }
+#endif
+}
+
+inline void
+HeapId::post()
+{
+}
+
+inline HeapId &
+HeapId::operator=(jsid id)
+{
+    pre();
+    value = id;
+    post();
+    return *this;
+}
+
+inline HeapId &
+HeapId::operator=(const HeapId &v)
+{
+    pre();
+    value = v.value;
+    post();
+    return *this;
+}
+
+} /* namespace js */
+
+#endif /* jsgc_barrier_inl_h___ */
diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
new file mode 100644
index 000000000000..a410eea6759e
--- /dev/null
+++ b/js/src/gc/Barrier.h
@@ -0,0 +1,450 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sw=4 et tw=78:
+ *
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is SpiderMonkey global object code.
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef jsgc_barrier_h___
+#define jsgc_barrier_h___
+
+#include "jsapi.h"
+#include "jscell.h"
+
+#include "js/HashTable.h"
+
+/*
+ * A write barrier is a mechanism used by incremental or generation GCs to
+ * ensure that every value that needs to be marked is marked. In general, the
+ * write barrier should be invoked whenever a write can cause the set of things
+ * traced through by the GC to change. This includes:
+ *   - writes to object properties
+ *   - writes to array slots
+ *   - writes to fields like JSObject::lastProp that we trace through
+ *   - writes to fields in private data, like JSGenerator::obj
+ *   - writes to non-markable fields like JSObject::private that point to
+ *     markable data
+ * The last category is the trickiest. Even though the private pointers does not
+ * point to a GC thing, changing the private pointer may change the set of
+ * objects that are traced by the GC. Therefore it needs a write barrier.
+ *
+ * Every barriered write should have the following form:
+ *   <pre-barrier>
+ *   obj->field = value; // do the actual write
+ *   <post-barrier>
+ * The pre-barrier is used for incremental GC and the post-barrier is for
+ * generational GC.
+ *
+ *                               PRE-BARRIER
+ *
+ * To understand the pre-barrier, let's consider how incremental GC works. The
+ * GC itself is divided into "slices". Between each slice, JS code is allowed to
+ * run. Each slice should be short so that the user doesn't notice the
+ * interruptions. In our GC, the structure of the slices is as follows:
+ *
+ * 1. ... JS work, which leads to a request to do GC ...
+ * 2. [first GC slice, which performs all root marking and possibly more marking]
+ * 3. ... more JS work is allowed to run ...
+ * 4. [GC mark slice, which runs entirely in drainMarkStack]
+ * 5. ... more JS work ...
+ * 6. [GC mark slice, which runs entirely in drainMarkStack]
+ * 7. ... more JS work ...
+ * 8. [GC marking finishes; sweeping done non-incrementally; GC is done]
+ * 9. ... JS continues uninterrupted now that GC is finishes ...
+ *
+ * Of course, there may be a different number of slices depending on how much
+ * marking is to be done.
+ *
+ * The danger inherent in this scheme is that the JS code in steps 3, 5, and 7
+ * might change the heap in a way that causes the GC to collect an object that
+ * is actually reachable. The write barrier prevents this from happening. We use
+ * a variant of incremental GC called "snapshot at the beginning." This approach
+ * guarantees the invariant that if an object is reachable in step 2, then we
+ * will mark it eventually. The name comes from the idea that we take a
+ * theoretical "snapshot" of all reachable objects in step 2; all objects in
+ * that snapshot should eventually be marked. (Note that the write barrier
+ * verifier code takes an actual snapshot.)
+ *
+ * The basic correctness invariant of a snapshot-at-the-beginning collector is
+ * that any object reachable at the end of the GC (step 9) must either:
+ *   (1) have been reachable at the beginning (step 2) and thus in the snapshot
+ *   (2) or must have been newly allocated, in steps 3, 5, or 7.
+ * To deal with case (2), any objects allocated during an incremental GC are
+ * automatically marked black.
+ *
+ * This strategy is actually somewhat conservative: if an object becomes
+ * unreachable between steps 2 and 8, it would be safe to collect it. We won't,
+ * mainly for simplicity. (Also, note that the snapshot is entirely
+ * theoretical. We don't actually do anything special in step 2 that we wouldn't
+ * do in a non-incremental GC.
+ *
+ * It's the pre-barrier's job to maintain the snapshot invariant. Consider the
+ * write "obj->field = value". Let the prior value of obj->field be
+ * value0. Since it's possible that value0 may have been what obj->field
+ * contained in step 2, when the snapshot was taken, the barrier marks
+ * value0. Note that it only does this if we're in the middle of an incremental
+ * GC. Since this is rare, the cost of the write barrier is usually just an
+ * extra branch.
+ *
+ * In practice, we implement the pre-barrier differently based on the type of
+ * value0. E.g., see JSObject::writeBarrierPre, which is used if obj->field is
+ * a JSObject*. It takes value0 as a parameter.
+ *
+ *                                POST-BARRIER
+ *
+ * These are not yet implemented. Once we get generational GC, they will allow
+ * us to keep track of pointers from non-nursery space into the nursery.
+ *
+ *                            IMPLEMENTATION DETAILS
+ *
+ * Since it would be awkward to change every write to memory into a function
+ * call, this file contains a bunch of C++ classes and templates that use
+ * operator overloading to take care of barriers automatically. In many cases,
+ * all that's necessary to make some field be barriered is to replace
+ *     Type *field;
+ * with
+ *     HeapPtr<Type> field;
+ * There are also special classes HeapValue and HeapId, which barrier js::Value
+ * and jsid, respectively.
+ *
+ * One additional note: not all object writes need to be barriered. Writes to
+ * newly allocated objects do not need a barrier as long as the GC is not
+ * allowed to run in between the allocation and the write. In these cases, we
+ * use the "obj->field.init(value)" method instead of "obj->field = value".
+ * We use the init naming idiom in many places to signify that a field is being
+ * assigned for the first time, and that no GCs have taken place between the
+ * object allocation and the assignment.
+ */
+
+namespace js {
+
+/*
+ * Ideally, we would like to make the argument to functions like MarkShape be a
+ * HeapPtr<const js::Shape>. That would ensure that we don't forget to
+ * barrier any fields that we mark through. However, that would prohibit us from
+ * passing in a derived class like HeapPtr<js::EmptyShape>.
+ *
+ * To overcome the problem, we make the argument to MarkShape be a
+ * MarkablePtr<const js::Shape>. And we allow conversions from HeapPtr<T>
+ * to MarkablePtr<U> as long as T can be converted to U.
+ */
+template<class T>
+class MarkablePtr
+{
+  public:
+    T *value;
+
+    explicit MarkablePtr(T *value) : value(value) {}
+};
+
+template<class T, typename Unioned = uintptr_t>
+class HeapPtr
+{
+    union {
+        T *value;
+        Unioned other;
+    };
+
+  public:
+    HeapPtr() : value(NULL) {}
+    explicit HeapPtr(T *v) : value(v) { post(); }
+    explicit HeapPtr(const HeapPtr<T> &v) : value(v.value) { post(); }
+
+    ~HeapPtr() { pre(); }
+
+    /* Use this to install a ptr into a newly allocated object. */
+    void init(T *v) {
+        value = v;
+        post();
+    }
+
+    /* Use to set the pointer to NULL. */
+    void clear() {
+	pre();
+	value = NULL;
+    }
+
+    /* Use this if the automatic coercion to T* isn't working. */
+    T *get() const { return value; }
+
+    /*
+     * Use these if you want to change the value without invoking the barrier.
+     * Obviously this is dangerous unless you know the barrier is not needed.
+     */
+    T **unsafeGet() { return &value; }
+    void unsafeSet(T *v) { value = v; }
+
+    Unioned *unsafeGetUnioned() { return &other; }
+
+    HeapPtr<T, Unioned> &operator=(T *v) {
+        pre();
+        value = v;
+        post();
+        return *this;
+    }
+
+    HeapPtr<T, Unioned> &operator=(const HeapPtr<T> &v) {
+        pre();
+        value = v.value;
+        post();
+        return *this;
+    }
+
+    T &operator*() const { return *value; }
+    T *operator->() const { return value; }
+
+    operator T*() const { return value; }
+
+    /*
+     * This coerces to MarkablePtr<U> as long as T can coerce to U. See the
+     * comment for MarkablePtr above.
+     */
+    template<class U>
+    operator MarkablePtr<U>() const { return MarkablePtr<U>(value); }
+
+  private:
+    void pre() { T::writeBarrierPre(value); }
+    void post() { T::writeBarrierPost(value, (void *)&value); }
+
+    /* Make this friend so it can access pre() and post(). */
+    template<class T1, class T2>
+    friend inline void
+    BarrieredSetPair(JSCompartment *comp,
+                     HeapPtr<T1> &v1, T1 *val1,
+                     HeapPtr<T2> &v2, T2 *val2);
+};
+
+/*
+ * This is a hack for RegExpStatics::updateFromMatch. It allows us to do two
+ * barriers with only one branch to check if we're in an incremental GC.
+ */
+template<class T1, class T2>
+static inline void
+BarrieredSetPair(JSCompartment *comp,
+                 HeapPtr<T1> &v1, T1 *val1,
+                 HeapPtr<T2> &v2, T2 *val2)
+{
+    if (T1::needWriteBarrierPre(comp)) {
+        v1.pre();
+        v2.pre();
+    }
+    v1.unsafeSet(val1);
+    v2.unsafeSet(val2);
+    v1.post();
+    v2.post();
+}
+
+typedef HeapPtr<JSObject> HeapPtrObject;
+typedef HeapPtr<JSFunction> HeapPtrFunction;
+typedef HeapPtr<JSString> HeapPtrString;
+typedef HeapPtr<JSScript> HeapPtrScript;
+typedef HeapPtr<Shape> HeapPtrShape;
+typedef HeapPtr<const Shape> HeapPtrConstShape;
+typedef HeapPtr<JSXML> HeapPtrXML;
+
+/* Useful for hashtables with a HeapPtr as key. */
+template<class T>
+struct HeapPtrHasher
+{
+    typedef HeapPtr<T> Key;
+    typedef T *Lookup;
+
+    static HashNumber hash(Lookup obj) { return DefaultHasher<T *>::hash(obj); }
+    static bool match(const Key &k, Lookup l) { return k.get() == l; }
+};
+
+/* Specialized hashing policy for HeapPtrs. */
+template <class T>
+struct DefaultHasher< HeapPtr<T> >: HeapPtrHasher<T> { };
+
+class HeapValue
+{
+    Value value;
+
+  public:
+    explicit HeapValue() : value(UndefinedValue()) {}
+    explicit inline HeapValue(const Value &v);
+    explicit inline HeapValue(const HeapValue &v);
+
+    inline ~HeapValue();
+
+    inline void init(const Value &v);
+
+    inline HeapValue &operator=(const Value &v);
+    inline HeapValue &operator=(const HeapValue &v);
+
+    /*
+     * This is a faster version of operator=. Normally, operator= has to
+     * determine the compartment of the value before it can decide whether to do
+     * the barrier. If you already know the compartment, it's faster to pass it
+     * in.
+     */
+    inline void set(JSCompartment *comp, const Value &v);
+
+    const Value &get() const { return value; }
+    operator const Value &() const { return value; }
+
+    bool isMarkable() const { return value.isMarkable(); }
+    bool isMagic(JSWhyMagic why) const { return value.isMagic(why); }
+    bool isUndefined() const { return value.isUndefined(); }
+    bool isObject() const { return value.isObject(); }
+    bool isGCThing() const { return value.isGCThing(); }
+    bool isTrue() const { return value.isTrue(); }
+    bool isFalse() const { return value.isFalse(); }
+    bool isInt32() const { return value.isInt32(); }
+    bool isNull() const { return value.isNull(); }
+
+    JSObject &toObject() const { return value.toObject(); }
+    JSObject *toObjectOrNull() const { return value.toObjectOrNull(); }
+    void *toGCThing() const { return value.toGCThing(); }
+    double toDouble() const { return value.toDouble(); }
+    int32 toInt32() const { return value.toInt32(); }
+    JSString *toString() const { return value.toString(); }
+    bool toBoolean() const { return value.toBoolean(); }
+    double toNumber() const { return value.toNumber(); }
+
+    unsigned gcKind() const { return value.gcKind(); }
+
+    inline void boxNonDoubleFrom(JSValueType type, uint64 *out);
+
+    uint64 asRawBits() const { return value.asRawBits(); }
+
+#ifdef DEBUG
+    JSWhyMagic whyMagic() const { return value.whyMagic(); }
+#endif
+
+    static inline void writeBarrierPre(const Value &v);
+    static inline void writeBarrierPost(const Value &v, void *addr);
+
+    static inline void writeBarrierPre(JSCompartment *comp, const Value &v);
+    static inline void writeBarrierPost(JSCompartment *comp, const Value &v, void *addr);
+
+  private:
+    inline void pre();
+    inline void post();
+
+    inline void pre(JSCompartment *comp);
+    inline void post(JSCompartment *comp);
+};
+
+static inline const Value *
+Valueify(const HeapValue *array)
+{
+    JS_ASSERT(sizeof(HeapValue) == sizeof(Value));
+    return (const Value *)array;
+}
+
+class HeapValueArray
+{
+    HeapValue *array;
+
+  public:
+    HeapValueArray(HeapValue *array) : array(array) {}
+
+    operator const Value *() const { return Valueify(array); }
+    operator HeapValue *() const { return array; }
+
+    HeapValueArray operator +(int offset) const { return HeapValueArray(array + offset); }
+    HeapValueArray operator +(uint32 offset) const { return HeapValueArray(array + offset); }
+};
+
+class HeapId
+{
+    jsid value;
+
+  public:
+    explicit HeapId() : value(JSID_VOID) {}
+    explicit inline HeapId(jsid id);
+
+    inline ~HeapId();
+
+    inline void init(jsid id);
+
+    inline HeapId &operator=(jsid id);
+    inline HeapId &operator=(const HeapId &v);
+
+    bool operator==(jsid id) const { return value == id; }
+    bool operator!=(jsid id) const { return value != id; }
+
+    jsid get() const { return value; }
+    operator jsid() const { return value; }
+
+  private:
+    inline void pre();
+    inline void post();
+
+    HeapId(const HeapId &v);
+};
+
+/*
+ * Incremental GC requires that weak pointers have read barriers. This is mostly
+ * an issue for empty shapes stored in JSCompartment. The problem happens when,
+ * during an incremental GC, some JS code stores one of the compartment's empty
+ * shapes into an object already marked black. Normally, this would not be a
+ * problem, because the empty shape would have been part of the initial snapshot
+ * when the GC started. However, since this is a weak pointer, it isn't. So we
+ * may collect the empty shape even though a live object points to it. To fix
+ * this, we mark these empty shapes black whenever they get read out.
+ */
+template<class T>
+class ReadBarriered
+{
+    T *value;
+
+  public:
+    ReadBarriered(T *value) : value(value) {}
+
+    T *get() const {
+        if (!value)
+            return NULL;
+        T::readBarrier(value);
+        return value;
+    }
+
+    operator T*() const { return get(); }
+
+    T *unsafeGet() { return value; }
+
+    void set(T *v) { value = v; }
+
+    operator bool() { return !!value; }
+
+    template<class U>
+    operator MarkablePtr<U>() const { return MarkablePtr<U>(value); }
+};
+
+}
+
+#endif /* jsgc_barrier_h___ */
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index 8ef58d6c508d..170739d60b11 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -40,10 +40,11 @@
 #include <stdio.h>
 
 #include "jscntxt.h"
-#include "jsprobes.h"
-#include "jsutil.h"
 #include "jscrashformat.h"
 #include "jscrashreport.h"
+#include "jsprf.h"
+#include "jsprobes.h"
+#include "jsutil.h"
 #include "prmjtime.h"
 
 #include "gc/Statistics.h"
@@ -51,6 +52,70 @@
 namespace js {
 namespace gcstats {
 
+Statistics::ColumnInfo::ColumnInfo(const char *title, double t, double total)
+  : title(title)
+{
+    JS_snprintf(str, sizeof(str), "%.1f", t);
+    JS_snprintf(totalStr, sizeof(totalStr), "%.1f", total);
+    width = 6;
+}
+
+Statistics::ColumnInfo::ColumnInfo(const char *title, double t)
+  : title(title)
+{
+    JS_snprintf(str, sizeof(str), "%.1f", t);
+    strcpy(totalStr, "n/a");
+    width = 6;
+}
+
+Statistics::ColumnInfo::ColumnInfo(const char *title, unsigned int data)
+  : title(title)
+{
+    JS_snprintf(str, sizeof(str), "%d", data);
+    strcpy(totalStr, "n/a");
+    width = 4;
+}
+
+Statistics::ColumnInfo::ColumnInfo(const char *title, const char *data)
+  : title(title)
+{
+    JS_ASSERT(strlen(data) < sizeof(str));
+    strcpy(str, data);
+    strcpy(totalStr, "n/a ");
+    width = 0;
+}
+
+static const int NUM_COLUMNS = 17;
+
+void
+Statistics::makeTable(ColumnInfo *cols)
+{
+    int i = 0;
+
+    cols[i++] = ColumnInfo("Type", compartment ? "Comp" : "Glob");
+
+    cols[i++] = ColumnInfo("Total", t(PHASE_GC), total(PHASE_GC));
+    cols[i++] = ColumnInfo("Wait", beginDelay(PHASE_MARK, PHASE_GC));
+    cols[i++] = ColumnInfo("Mark", t(PHASE_MARK), total(PHASE_MARK));
+    cols[i++] = ColumnInfo("Sweep", t(PHASE_SWEEP), total(PHASE_SWEEP));
+    cols[i++] = ColumnInfo("FinObj", t(PHASE_SWEEP_OBJECT), total(PHASE_SWEEP_OBJECT));
+    cols[i++] = ColumnInfo("FinStr", t(PHASE_SWEEP_STRING), total(PHASE_SWEEP_STRING));
+    cols[i++] = ColumnInfo("FinScr", t(PHASE_SWEEP_SCRIPT), total(PHASE_SWEEP_SCRIPT));
+    cols[i++] = ColumnInfo("FinShp", t(PHASE_SWEEP_SHAPE), total(PHASE_SWEEP_SHAPE));
+    cols[i++] = ColumnInfo("DisCod", t(PHASE_DISCARD_CODE), total(PHASE_DISCARD_CODE));
+    cols[i++] = ColumnInfo("DisAnl", t(PHASE_DISCARD_ANALYSIS), total(PHASE_DISCARD_ANALYSIS));
+    cols[i++] = ColumnInfo("XPCnct", t(PHASE_XPCONNECT), total(PHASE_XPCONNECT));
+    cols[i++] = ColumnInfo("Destry", t(PHASE_DESTROY), total(PHASE_DESTROY));
+    cols[i++] = ColumnInfo("End", endDelay(PHASE_GC, PHASE_DESTROY));
+
+    cols[i++] = ColumnInfo("+Chu", counts[STAT_NEW_CHUNK]);
+    cols[i++] = ColumnInfo("-Chu", counts[STAT_DESTROY_CHUNK]);
+
+    cols[i++] = ColumnInfo("Reason", ExplainReason(triggerReason));
+
+    JS_ASSERT(i == NUM_COLUMNS);
+}
+
 Statistics::Statistics(JSRuntime *rt)
   : runtime(rt)
 {
@@ -72,8 +137,13 @@ Statistics::Statistics(JSRuntime *rt)
         fp = fopen(env, "a");
         JS_ASSERT(fp);
 
-        fprintf(fp, "     AppTime,  Total,   Wait,   Mark,  Sweep, FinObj,"
-                " FinStr, FinScr, FinShp, Destry,    End, +Chu, -Chu, T, Reason\n");
+        fprintf(fp, "     AppTime");
+
+        ColumnInfo cols[NUM_COLUMNS];
+        makeTable(cols);
+        for (int i = 0; i < NUM_COLUMNS; i++)
+            fprintf(fp, ", %*s", cols[i].width, cols[i].title);
+        fprintf(fp, "\n");
     }
 
     PodArrayZero(counts);
@@ -85,14 +155,15 @@ Statistics::Statistics(JSRuntime *rt)
 Statistics::~Statistics()
 {
     if (fp) {
-        if (fullFormat)
-            fprintf(fp,
-                    "------>TOTAL  "
-                    "%6.1f,         %6.1f, %6.1f, %6.1f, %6.1f, %6.1f, %6.1f, %6.1f\n",
-                    total(PHASE_GC), total(PHASE_MARK), total(PHASE_SWEEP),
-                    total(PHASE_SWEEP_OBJECT), total(PHASE_SWEEP_STRING),
-                    total(PHASE_SWEEP_SCRIPT), total(PHASE_SWEEP_SHAPE),
-                    total(PHASE_DESTROY));
+        if (fullFormat) {
+            fprintf(fp, "------>TOTAL");
+
+            ColumnInfo cols[NUM_COLUMNS];
+            makeTable(cols);
+            for (int i = 0; i < NUM_COLUMNS && cols[i].totalStr[0]; i++)
+                fprintf(fp, ", %*s", cols[i].width, cols[i].totalStr);
+            fprintf(fp, "\n");
+        }
 
         if (fp != stdout && fp != stderr)
             fclose(fp);
@@ -149,24 +220,42 @@ Statistics::endDelay(Phase phase1, Phase phase2)
     return double(phaseEnds[phase1] - phaseEnds[phase2]) / PRMJ_USEC_PER_MSEC;
 }
 
+void
+Statistics::statsToString(char *buffer, size_t size)
+{
+    JS_ASSERT(size);
+    buffer[0] = 0x00;
+
+    ColumnInfo cols[NUM_COLUMNS];
+    makeTable(cols);
+
+    size_t pos = 0;
+    for (int i = 0; i < NUM_COLUMNS; i++) {
+        int len = strlen(cols[i].title) + 1 + strlen(cols[i].str);
+        if (i > 0)
+            len += 2;
+        if (pos + len >= size)
+            break;
+        if (i > 0)
+            strcat(buffer, ", ");
+        strcat(buffer, cols[i].title);
+        strcat(buffer, ":");
+        strcat(buffer, cols[i].str);
+        pos += len;
+    }
+}
+
 void
 Statistics::printStats()
 {
     if (fullFormat) {
-        /*       App   , Total, Wait , Mark , Sweep, FinOb, FinSt, FinSc, FinSh, Destry, End */
-        fprintf(fp,
-                "%12.0f, %6.1f, %6.1f, %6.1f, %6.1f, %6.1f, %6.1f, %6.1f, %6.1f, %6.1f, %6.1f, ",
-                double(phaseStarts[PHASE_GC] - startupTime) / PRMJ_USEC_PER_MSEC,
-                t(PHASE_GC),
-                beginDelay(PHASE_MARK, PHASE_GC),
-                t(PHASE_MARK), t(PHASE_SWEEP),
-                t(PHASE_SWEEP_OBJECT), t(PHASE_SWEEP_STRING),
-                t(PHASE_SWEEP_SCRIPT), t(PHASE_SWEEP_SHAPE),
-                t(PHASE_DESTROY),
-                endDelay(PHASE_GC, PHASE_DESTROY));
+        fprintf(fp, "%12.0f", double(phaseStarts[PHASE_GC] - startupTime) / PRMJ_USEC_PER_MSEC);
 
-        fprintf(fp, "%4d, %4d,", counts[STAT_NEW_CHUNK], counts[STAT_DESTROY_CHUNK]);
-        fprintf(fp, " %s, %s\n", compartment ? "C" : "G", ExplainReason(triggerReason));
+        ColumnInfo cols[NUM_COLUMNS];
+        makeTable(cols);
+        for (int i = 0; i < NUM_COLUMNS; i++)
+            fprintf(fp, ", %*s", cols[i].width, cols[i].str);
+        fprintf(fp, "\n");
     } else {
         fprintf(fp, "%f %f %f\n",
                 t(PHASE_GC), t(PHASE_MARK), t(PHASE_SWEEP));
@@ -194,6 +283,12 @@ Statistics::endGC()
         (*cb)(JS_TELEMETRY_GC_SWEEP_MS, t(PHASE_SWEEP));
     }
 
+    if (JSGCFinishedCallback cb = runtime->gcFinishedCallback) {
+        char buffer[1024];
+        statsToString(buffer, sizeof(buffer));
+        (*cb)(runtime, compartment, buffer);
+    }
+
     if (fp)
         printStats();
 
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 3afcd4756d59..eb28a7121085 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -84,6 +84,9 @@ enum Phase {
     PHASE_SWEEP_STRING,
     PHASE_SWEEP_SCRIPT,
     PHASE_SWEEP_SHAPE,
+    PHASE_DISCARD_CODE,
+    PHASE_DISCARD_ANALYSIS,
+    PHASE_XPCONNECT,
     PHASE_DESTROY,
 
     PHASE_LIMIT
@@ -133,6 +136,22 @@ struct Statistics {
     double beginDelay(Phase phase1, Phase phase2);
     double endDelay(Phase phase1, Phase phase2);
     void printStats();
+    void statsToString(char *buffer, size_t size);
+
+    struct ColumnInfo {
+        const char *title;
+        char str[12];
+        char totalStr[12];
+        int width;
+
+        ColumnInfo() {}
+        ColumnInfo(const char *title, double t, double total);
+        ColumnInfo(const char *title, double t);
+        ColumnInfo(const char *title, unsigned int data);
+        ColumnInfo(const char *title, const char *data);
+    };
+
+    void makeTable(ColumnInfo *cols);
 };
 
 struct AutoGC {
diff --git a/js/src/jit-test/jit_test.py b/js/src/jit-test/jit_test.py
index 61c4fb8efd26..5b7c13e0076b 100755
--- a/js/src/jit-test/jit_test.py
+++ b/js/src/jit-test/jit_test.py
@@ -267,11 +267,12 @@ def run_tests(tests, test_dir, lib_dir, shell_args):
     if not OPTIONS.hide_progress and not OPTIONS.show_cmd:
         try:
             from progressbar import ProgressBar
-            pb = ProgressBar('', len(tests), 16)
+            pb = ProgressBar('', len(tests), 24)
         except ImportError:
             pass
 
     failures = []
+    timeouts = 0
     complete = False
     doing = 'before starting'
     try:
@@ -282,6 +283,8 @@ def run_tests(tests, test_dir, lib_dir, shell_args):
 
             if not ok:
                 failures.append([ test, out, err, code, timed_out ])
+            if timed_out:
+                timeouts += 1
 
             if OPTIONS.tinderbox:
                 if ok:
@@ -297,7 +300,7 @@ def run_tests(tests, test_dir, lib_dir, shell_args):
 
             n = i + 1
             if pb:
-                pb.label = '[%4d|%4d|%4d]'%(n - len(failures), len(failures), n)
+                pb.label = '[%4d|%4d|%4d|%4d]'%(n - len(failures), len(failures), timeouts, n)
                 pb.update(n)
         complete = True
     except KeyboardInterrupt:
diff --git a/js/src/jit-test/tests/basic/testBug701227.js b/js/src/jit-test/tests/basic/testBug701227.js
new file mode 100644
index 000000000000..cf12409fea4d
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug701227.js
@@ -0,0 +1 @@
+(function f() { try {} catch(e) { let x } }).toString()
diff --git a/js/src/jit-test/tests/basic/testBug701239.js b/js/src/jit-test/tests/basic/testBug701239.js
new file mode 100644
index 000000000000..665134c1d1b8
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug701239.js
@@ -0,0 +1 @@
+(function f(w) { for([w] in 1) {} }).toString();
diff --git a/js/src/jit-test/tests/basic/testBug701244.js b/js/src/jit-test/tests/basic/testBug701244.js
new file mode 100644
index 000000000000..4a9931f80453
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug701244.js
@@ -0,0 +1 @@
+(function f({length}) {}).toString();
diff --git a/js/src/jit-test/tests/basic/xml-in-strict.js b/js/src/jit-test/tests/basic/xml-in-strict.js
new file mode 100644
index 000000000000..0e2ddf89b5c8
--- /dev/null
+++ b/js/src/jit-test/tests/basic/xml-in-strict.js
@@ -0,0 +1,17 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+function checkSyntaxError(code) {
+    var error;
+    try {
+        eval(code);
+    } catch (e) {
+        error = e;
+    }
+    assertEq(error.name, 'SyntaxError');
+}
+
+checkSyntaxError('"use strict"; *');
+checkSyntaxError('"use strict"; @7');
diff --git a/js/src/jsanalyze.cpp b/js/src/jsanalyze.cpp
index 672ca3d5db4e..378f60c3f353 100644
--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -568,18 +568,6 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
             unsigned newStackDepth = stackDepth;
 
             switch (op) {
-              case JSOP_OR:
-              case JSOP_AND:
-              case JSOP_ORX:
-              case JSOP_ANDX:
-                /*
-                 * OR/AND instructions push the operation result when branching.
-                 * We accounted for this in GetDefCount, so subtract the pushed value
-                 * for the fallthrough case.
-                 */
-                stackDepth--;
-                break;
-
               case JSOP_CASE:
               case JSOP_CASEX:
                 /* Case instructions do not push the lvalue back when branching. */
diff --git a/js/src/jsapi-tests/testArgumentsObject.cpp b/js/src/jsapi-tests/testArgumentsObject.cpp
index 83587c56fbd5..359852f50a2c 100644
--- a/js/src/jsapi-tests/testArgumentsObject.cpp
+++ b/js/src/jsapi-tests/testArgumentsObject.cpp
@@ -6,6 +6,8 @@
 
 #include "vm/Stack-inl.h"
 
+#include "jsobjinlines.h"
+
 using namespace js;
 
 static const char NORMAL_ZERO[] =
diff --git a/js/src/jsapi-tests/testBug604087.cpp b/js/src/jsapi-tests/testBug604087.cpp
index 27b7e0b54aa8..63a43c2978ca 100644
--- a/js/src/jsapi-tests/testBug604087.cpp
+++ b/js/src/jsapi-tests/testBug604087.cpp
@@ -8,6 +8,8 @@
 #include "jsobj.h"
 #include "jswrapper.h"
 
+#include "jsobjinlines.h"
+
 struct OuterWrapper : js::Wrapper
 {
     OuterWrapper() : Wrapper(0) {}
diff --git a/js/src/jsapi-tests/testConservativeGC.cpp b/js/src/jsapi-tests/testConservativeGC.cpp
index 0286060b157a..45eb898e8885 100644
--- a/js/src/jsapi-tests/testConservativeGC.cpp
+++ b/js/src/jsapi-tests/testConservativeGC.cpp
@@ -7,7 +7,8 @@ BEGIN_TEST(testConservativeGC)
     jsval v2;
     EVAL("({foo: 'bar'});", &v2);
     CHECK(JSVAL_IS_OBJECT(v2));
-    JSObject objCopy = *JSVAL_TO_OBJECT(v2);
+    char objCopy[sizeof(JSObject)];
+    memcpy(&objCopy, JSVAL_TO_OBJECT(v2), sizeof(JSObject));
 
     jsval v3;
     EVAL("String(Math.PI);", &v3);
@@ -18,7 +19,8 @@ BEGIN_TEST(testConservativeGC)
     EVAL("({foo2: 'bar2'});", &tmp);
     CHECK(JSVAL_IS_OBJECT(tmp));
     JSObject *obj2 = JSVAL_TO_OBJECT(tmp);
-    JSObject obj2Copy = *obj2;
+    char obj2Copy[sizeof(JSObject)];
+    memcpy(&obj2Copy, obj2, sizeof(JSObject));
 
     EVAL("String(Math.sqrt(3));", &tmp);
     CHECK(JSVAL_IS_STRING(tmp));
@@ -36,10 +38,10 @@ BEGIN_TEST(testConservativeGC)
 
     JS_GC(cx);
 
-    checkObjectFields(&objCopy, JSVAL_TO_OBJECT(v2));
+    checkObjectFields((JSObject *)objCopy, JSVAL_TO_OBJECT(v2));
     CHECK(!memcmp(&strCopy, JSVAL_TO_STRING(v3), sizeof(strCopy)));
 
-    checkObjectFields(&obj2Copy, obj2);
+    checkObjectFields((JSObject *)obj2Copy, obj2);
     CHECK(!memcmp(&str2Copy, str2, sizeof(str2Copy)));
 
     return true;
diff --git a/js/src/jsapi-tests/testIndexToString.cpp b/js/src/jsapi-tests/testIndexToString.cpp
index c93410f59554..f240b601ac72 100644
--- a/js/src/jsapi-tests/testIndexToString.cpp
+++ b/js/src/jsapi-tests/testIndexToString.cpp
@@ -9,6 +9,8 @@
 #include "jsnum.h"
 #include "jsstr.h"
 
+#include "jsobjinlines.h"
+
 #include "vm/String-inl.h"
 
 using namespace mozilla;
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 53702c2f106d..e5adf9d33738 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -96,6 +96,7 @@
 #include "jsscriptinlines.h"
 
 #include "vm/RegExpObject-inl.h"
+#include "vm/RegExpStatics-inl.h"
 #include "vm/Stack-inl.h"
 #include "vm/String-inl.h"
 
@@ -657,7 +658,8 @@ JSRuntime::JSRuntime()
     gcMaxMallocBytes(0),
     gcEmptyArenaPoolLifespan(0),
     gcNumber(0),
-    gcMarkingTracer(NULL),
+    gcIncrementalTracer(NULL),
+    gcVerifyData(NULL),
     gcChunkAllocationSinceLastGC(false),
     gcNextFullGCTime(0),
     gcJitReleaseTime(0),
@@ -679,6 +681,7 @@ JSRuntime::JSRuntime()
     gcDebugCompartmentGC(false),
 #endif
     gcCallback(NULL),
+    gcFinishedCallback(NULL),
     gcMallocBytes(0),
     gcBlackRootsTraceOp(NULL),
     gcBlackRootsData(NULL),
@@ -1326,7 +1329,7 @@ JS_EnterCrossCompartmentCallScript(JSContext *cx, JSScript *target)
 {
     CHECK_REQUEST(cx);
     JS_ASSERT(!target->isCachedEval);
-    GlobalObject *global = target->u.globalObject;
+    GlobalObject *global = target->globalObject;
     if (!global) {
         SwitchToCompartment sc(cx, target->compartment());
         global = GlobalObject::create(cx, &dummy_class);
@@ -1951,9 +1954,7 @@ JS_EnumerateStandardClasses(JSContext *cx, JSObject *obj)
     return JS_TRUE;
 }
 
-namespace js {
-
-JSIdArray *
+static JSIdArray *
 NewIdArray(JSContext *cx, jsint length)
 {
     JSIdArray *ida;
@@ -1965,8 +1966,6 @@ NewIdArray(JSContext *cx, jsint length)
     return ida;
 }
 
-}
-
 /*
  * Unlike realloc(3), this function frees ida on failure.
  */
@@ -1999,7 +1998,7 @@ AddAtomToArray(JSContext *cx, JSAtom *atom, JSIdArray *ida, jsint *ip)
             return NULL;
         JS_ASSERT(i < ida->length);
     }
-    ida->vector[i] = ATOM_TO_JSID(atom);
+    ida->vector[i].init(ATOM_TO_JSID(atom));
     *ip = i + 1;
     return ida;
 }
@@ -2329,11 +2328,16 @@ JS_TraceRuntime(JSTracer *trc)
     TraceRuntime(trc);
 }
 
+JS_PUBLIC_API(void)
+JS_TraceChildren(JSTracer *trc, void *thing, JSGCTraceKind kind)
+{
+    js::TraceChildren(trc, thing, kind);
+}
+
 JS_PUBLIC_API(void)
 JS_CallTracer(JSTracer *trc, void *thing, JSGCTraceKind kind)
 {
-    JS_ASSERT(thing);
-    MarkKind(trc, thing, kind);
+    js::CallTracer(trc, thing, kind);
 }
 
 #ifdef DEBUG
@@ -2743,6 +2747,7 @@ JS_CompartmentGC(JSContext *cx, JSCompartment *comp)
 
     LeaveTrace(cx);
 
+    js::gc::VerifyBarriers(cx, true);
     js_GC(cx, comp, GC_NORMAL, gcstats::PUBLIC_API);
 }
 
@@ -2781,8 +2786,8 @@ JS_PUBLIC_API(JSBool)
 JS_IsAboutToBeFinalized(JSContext *cx, void *thing)
 {
     JS_ASSERT(thing);
-    JS_ASSERT(!cx->runtime->gcMarkingTracer);
-    return IsAboutToBeFinalized(cx, thing);
+    JS_ASSERT(!cx->runtime->gcIncrementalTracer);
+    return IsAboutToBeFinalized(cx, (gc::Cell *)thing);
 }
 
 JS_PUBLIC_API(void)
@@ -2941,6 +2946,19 @@ JS_SetNativeStackQuota(JSContext *cx, size_t stackSize)
 
 /************************************************************************/
 
+JS_PUBLIC_API(jsint)
+JS_IdArrayLength(JSContext *cx, JSIdArray *ida)
+{
+    return ida->length;
+}
+
+JS_PUBLIC_API(jsid)
+JS_IdArrayGet(JSContext *cx, JSIdArray *ida, jsint index)
+{
+    JS_ASSERT(index >= 0 && index < ida->length);
+    return ida->vector[index];
+}
+
 JS_PUBLIC_API(void)
 JS_DestroyIdArray(JSContext *cx, JSIdArray *ida)
 {
@@ -4104,12 +4122,16 @@ prop_iter_trace(JSTracer *trc, JSObject *obj)
         return;
 
     if (obj->getSlot(JSSLOT_ITER_INDEX).toInt32() < 0) {
-        /* Native case: just mark the next property to visit. */
-        MarkShape(trc, (Shape *)pdata, "prop iter shape");
+        /*
+         * Native case: just mark the next property to visit. We don't need a
+         * barrier here because the pointer is updated via setPrivate, which
+         * always takes a barrier.
+         */
+        MarkShapeUnbarriered(trc, (Shape *)pdata, "prop iter shape");
     } else {
         /* Non-native case: mark each id in the JSIdArray private. */
         JSIdArray *ida = (JSIdArray *) pdata;
-        MarkIdRange(trc, ida->length, ida->vector, "prop iter");
+        MarkIdRange(trc, ida->vector, ida->vector + ida->length, "prop iter");
     }
 }
 
@@ -4137,7 +4159,7 @@ JS_PUBLIC_API(JSObject *)
 JS_NewPropertyIterator(JSContext *cx, JSObject *obj)
 {
     JSObject *iterobj;
-    const void *pdata;
+    void *pdata;
     jsint index;
     JSIdArray *ida;
 
@@ -4149,7 +4171,7 @@ JS_NewPropertyIterator(JSContext *cx, JSObject *obj)
 
     if (obj->isNative()) {
         /* Native case: start with the last property in obj. */
-        pdata = obj->lastProperty();
+        pdata = (void *)obj->lastProperty();
         index = -1;
     } else {
         /*
@@ -4167,7 +4189,7 @@ JS_NewPropertyIterator(JSContext *cx, JSObject *obj)
     }
 
     /* iterobj cannot escape to other threads here. */
-    iterobj->setPrivate(const_cast<void *>(pdata));
+    iterobj->setPrivate(pdata);
     iterobj->setSlot(JSSLOT_ITER_INDEX, Int32Value(index));
     return iterobj;
 }
@@ -4430,7 +4452,7 @@ JS_CloneFunctionObject(JSContext *cx, JSObject *funobj, JSObject *parent)
         Value v;
         if (!obj->getGeneric(cx, r.front().propid, &v))
             return NULL;
-        clone->getFlatClosureUpvars()[i] = v;
+        clone->setFlatClosureUpvar(i, v);
     }
 
     return clone;
@@ -4881,9 +4903,9 @@ JS_PUBLIC_API(JSObject *)
 JS_GetGlobalFromScript(JSScript *script)
 {
     JS_ASSERT(!script->isCachedEval);
-    JS_ASSERT(script->u.globalObject);
+    JS_ASSERT(script->globalObject);
 
-    return script->u.globalObject;
+    return script->globalObject;
 }
 
 static JSFunction *
@@ -6344,9 +6366,10 @@ JS_ClearContextThread(JSContext *cx)
 JS_PUBLIC_API(void)
 JS_SetGCZeal(JSContext *cx, uint8 zeal, uint32 frequency, JSBool compartment)
 {
+    bool schedule = zeal >= js::gc::ZealAllocThreshold && zeal < js::gc::ZealVerifierThreshold;
     cx->runtime->gcZeal_ = zeal;
     cx->runtime->gcZealFrequency = frequency;
-    cx->runtime->gcNextScheduled = zeal >= 2 ? frequency : 0;
+    cx->runtime->gcNextScheduled = schedule ? frequency : 0;
     cx->runtime->gcDebugCompartmentGC = !!compartment;
 }
 
@@ -6366,6 +6389,63 @@ js_GetCompartmentPrivate(JSCompartment *compartment)
 
 /************************************************************************/
 
+JS_PUBLIC_API(void)
+JS_RegisterReference(void **ref)
+{
+}
+
+JS_PUBLIC_API(void)
+JS_ModifyReference(void **ref, void *newval)
+{
+    // XPConnect uses the lower bits of its JSObject refs for evil purposes,
+    // so we need to fix this.
+    void *thing = *ref;
+    *ref = newval;
+    thing = (void *)((uintptr_t)thing & ~7);
+    if (!thing)
+        return;
+    uint32 kind = GetGCThingTraceKind(thing);
+    if (kind == JSTRACE_OBJECT)
+        JSObject::writeBarrierPre((JSObject *) thing);
+    else if (kind == JSTRACE_STRING)
+        JSString::writeBarrierPre((JSString *) thing);
+    else
+        JS_NOT_REACHED("invalid trace kind");
+}
+
+JS_PUBLIC_API(void)
+JS_UnregisterReference(void **ref)
+{
+    // For now we just want to trigger a write barrier.
+    JS_ModifyReference(ref, NULL);
+}
+
+JS_PUBLIC_API(void)
+JS_RegisterValue(jsval *val)
+{
+}
+
+JS_PUBLIC_API(void)
+JS_ModifyValue(jsval *val, jsval newval)
+{
+    HeapValue::writeBarrierPre(*val);
+    *val = newval;
+}
+
+JS_PUBLIC_API(void)
+JS_UnregisterValue(jsval *val)
+{
+    JS_ModifyValue(val, JSVAL_VOID);
+}
+
+JS_PUBLIC_API(JSTracer *)
+JS_GetIncrementalGCTracer(JSRuntime *rt)
+{
+    return rt->gcIncrementalTracer;
+}
+
+/************************************************************************/
+
 #if !defined(STATIC_EXPORTABLE_JS_API) && !defined(STATIC_JS_API) && defined(XP_WIN)
 
 #include "jswin.h"
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index fd03c0f683e8..c86f6bc92245 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -2177,11 +2177,12 @@ JS_StringToVersion(const char *string);
 #define JSOPTION_PCCOUNT        JS_BIT(17)      /* Collect per-op execution counts */
 
 #define JSOPTION_TYPE_INFERENCE JS_BIT(18)      /* Perform type inference. */
+#define JSOPTION_SOFTEN         JS_BIT(19)      /* Disable JIT hardening. */
 
 /* Options which reflect compile-time properties of scripts. */
 #define JSCOMPILEOPTION_MASK    (JSOPTION_XML)
 
-#define JSRUNOPTION_MASK        (JS_BITMASK(19) & ~JSCOMPILEOPTION_MASK)
+#define JSRUNOPTION_MASK        (JS_BITMASK(20) & ~JSCOMPILEOPTION_MASK)
 #define JSALLOPTION_MASK        (JSCOMPILEOPTION_MASK | JSRUNOPTION_MASK)
 
 extern JS_PUBLIC_API(uint32)
@@ -2697,6 +2698,7 @@ typedef void
 (* JSTraceCallback)(JSTracer *trc, void *thing, JSGCTraceKind kind);
 
 struct JSTracer {
+    JSRuntime           *runtime;
     JSContext           *context;
     JSTraceCallback     callback;
     JSTraceNamePrinter  debugPrinter;
@@ -2797,6 +2799,7 @@ JS_CallTracer(JSTracer *trc, void *thing, JSGCTraceKind kind);
  */
 # define JS_TRACER_INIT(trc, cx_, callback_)                                  \
     JS_BEGIN_MACRO                                                            \
+        (trc)->runtime = (cx_)->runtime;                                      \
         (trc)->context = (cx_);                                               \
         (trc)->callback = (callback_);                                        \
         (trc)->debugPrinter = NULL;                                           \
@@ -2841,6 +2844,88 @@ JS_DumpHeap(JSContext *cx, FILE *fp, void* startThing, JSGCTraceKind kind,
 
 #endif
 
+/*
+ * Write barrier API.
+ *
+ * This API is used to inform SpiderMonkey of pointers to JS GC things in the
+ * malloc heap. There is no need to use this API unless incremental GC is
+ * enabled. When they are, the requirements for using the API are as follows:
+ *
+ * All pointers to JS GC things from the malloc heap must be registered and
+ * unregistered with the API functions below. This is *in addition* to the
+ * normal rooting and tracing that must be done normally--these functions will
+ * not take care of rooting for you.
+ *
+ * Besides registration, the JS_ModifyReference function must be called to
+ * change the value of these references. You should not change them using
+ * assignment.
+ *
+ * To avoid the headache of using these API functions, the JSBarrieredObjectPtr
+ * C++ class is provided--simply replace your JSObject* with a
+ * JSBarrieredObjectPtr. It will take care of calling the registration and
+ * modification APIs.
+ *
+ * For more explanation, see the comment in gc/Barrier.h.
+ */
+
+/* These functions are to be used for objects and strings. */
+extern JS_PUBLIC_API(void)
+JS_RegisterReference(void **ref);
+
+extern JS_PUBLIC_API(void)
+JS_ModifyReference(void **ref, void *newval);
+
+extern JS_PUBLIC_API(void)
+JS_UnregisterReference(void **ref);
+
+/* These functions are for values. */
+extern JS_PUBLIC_API(void)
+JS_RegisterValue(jsval *val);
+
+extern JS_PUBLIC_API(void)
+JS_ModifyValue(jsval *val, jsval newval);
+
+extern JS_PUBLIC_API(void)
+JS_UnregisterValue(jsval *val);
+
+extern JS_PUBLIC_API(JSTracer *)
+JS_GetIncrementalGCTracer(JSRuntime *rt);
+
+#ifdef __cplusplus
+JS_END_EXTERN_C
+
+namespace JS {
+
+class HeapPtrObject
+{
+    JSObject *value;
+
+  public:
+    HeapPtrObject() : value(NULL) { JS_RegisterReference((void **) &value); }
+
+    HeapPtrObject(JSObject *obj) : value(obj) { JS_RegisterReference((void **) &value); }
+
+    ~HeapPtrObject() { JS_UnregisterReference((void **) &value); }
+
+    void init(JSObject *obj) { value = obj; }
+
+    JSObject *get() const { return value; }
+
+    HeapPtrObject &operator=(JSObject *obj) {
+        JS_ModifyReference((void **) &value, obj);
+        return *this;
+    }
+
+    JSObject &operator*() const { return *value; }
+    JSObject *operator->() const { return value; }
+    operator JSObject *() const { return value; }
+};
+
+} /* namespace JS */
+
+JS_BEGIN_EXTERN_C
+#endif
+
 /*
  * Garbage collector API.
  */
@@ -3114,10 +3199,11 @@ struct JSClass {
 #define JSCLASS_NO_INTERNAL_MEMBERS     0,{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}
 #define JSCLASS_NO_OPTIONAL_MEMBERS     0,0,0,0,0,0,0,JSCLASS_NO_INTERNAL_MEMBERS
 
-struct JSIdArray {
-    jsint length;
-    jsid  vector[1];    /* actually, length jsid words */
-};
+extern JS_PUBLIC_API(jsint)
+JS_IdArrayLength(JSContext *cx, JSIdArray *ida);
+
+extern JS_PUBLIC_API(jsid)
+JS_IdArrayGet(JSContext *cx, JSIdArray *ida, jsint index);
 
 extern JS_PUBLIC_API(void)
 JS_DestroyIdArray(JSContext *cx, JSIdArray *ida);
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index b21ce5c9ea7f..64a3da7f6552 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -649,14 +649,13 @@ array_length_setter(JSContext *cx, JSObject *obj, jsid id, JSBool strict, Value
          * the initialized capacity.
          */
         jsuint oldcap = obj->getDenseArrayCapacity();
+        jsuint oldinit = obj->getDenseArrayInitializedLength();
+        if (oldinit > newlen)
+            obj->setDenseArrayInitializedLength(newlen);
         if (oldcap > newlen)
             obj->shrinkDenseArrayElements(cx, newlen);
-        jsuint oldinit = obj->getDenseArrayInitializedLength();
-        if (oldinit > newlen) {
-            obj->setDenseArrayInitializedLength(newlen);
-            if (!cx->typeInferenceEnabled())
-                obj->backfillDenseArrayHoles(cx);
-        }
+        if (oldinit > newlen && !cx->typeInferenceEnabled())
+            obj->backfillDenseArrayHoles(cx);
     } else if (oldlen - newlen < (1 << 24)) {
         do {
             --oldlen;
@@ -1340,8 +1339,11 @@ JSObject::makeDenseArraySlow(JSContext *cx)
 
     /* Create a native scope. */
     gc::AllocKind kind = getAllocKind();
-    if (!InitScopeForObject(cx, this, &SlowArrayClass, getProto()->getNewType(cx), kind))
+    js::EmptyShape *empty = InitScopeForObject(cx, this, &SlowArrayClass,
+                                               getProto()->getNewType(cx), kind);
+    if (!empty)
         return false;
+    setMap(empty);
 
     backfillDenseArrayHoles(cx);
 
@@ -1367,10 +1369,10 @@ JSObject::makeDenseArraySlow(JSContext *cx)
      * Root all values in the array during conversion, as SlowArrayClass only
      * protects up to its slot span.
      */
-    AutoValueArray autoArray(cx, slots, arrayInitialized);
+    AutoValueArray autoArray(cx, Valueify(slots), arrayInitialized);
 
     /* The initialized length is used iff this is a dense array. */
-    initializedLength = 0;
+    initializedLength() = 0;
     JS_ASSERT(newType == NULL);
 
     /*
@@ -1380,7 +1382,7 @@ JSObject::makeDenseArraySlow(JSContext *cx)
     if (!AddLengthProperty(cx, this)) {
         setMap(oldMap);
         capacity = arrayCapacity;
-        initializedLength = arrayInitialized;
+        initializedLength() = arrayInitialized;
         clasp = &ArrayClass;
         return false;
     }
@@ -1398,12 +1400,21 @@ JSObject::makeDenseArraySlow(JSContext *cx)
         if (slots[i].isMagic(JS_ARRAY_HOLE))
             continue;
 
-        setSlot(next, slots[i]);
+        /*
+         * No barrier is needed here because the set of reachable objects before
+         * and after slowification is the same. During slowification, the
+         * autoArray rooter guarantees that all slots will be marked.
+         *
+         * It's important that we avoid a barrier here because the fixed slots
+         * of a dense array can be garbage; a write barrier after the switch to
+         * a slow array could cause a crash.
+         */
+        initSlotUnchecked(next, slots[i]);
 
         if (!addDataProperty(cx, id, next, JSPROP_ENUMERATE)) {
             setMap(oldMap);
             capacity = arrayCapacity;
-            initializedLength = arrayInitialized;
+            initializedLength() = arrayInitialized;
             clasp = &ArrayClass;
             return false;
         }
@@ -2151,8 +2162,7 @@ sort_compare(void *arg, const void *a, const void *b, int *result)
     if (!ag.pushed() && !cx->stack.pushInvokeArgs(cx, 2, &ag))
         return JS_FALSE;
         
-    ag.calleeHasBeenReset();
-    ag.calleev() = ca->fval;
+    ag.setCallee(ca->fval);
     ag.thisv() = UndefinedValue();
     ag[0] = *av;
     ag[1] = *bv;
@@ -2498,7 +2508,7 @@ NewbornArrayPushImpl(JSContext *cx, JSObject *obj, const Value &v)
     if (cx->typeInferenceEnabled())
         obj->setDenseArrayInitializedLength(length + 1);
     obj->setDenseArrayLength(length + 1);
-    obj->setDenseArrayElementWithType(cx, length, v);
+    obj->initDenseArrayElementWithType(cx, length, v);
     return true;
 }
 
@@ -2894,16 +2904,16 @@ array_splice(JSContext *cx, uintN argc, Value *vp)
             /* Steps 12(a)-(b). */
             obj->moveDenseArrayElements(targetIndex, sourceIndex, len - sourceIndex);
 
-            /* Steps 12(c)-(d). */
-            obj->shrinkDenseArrayElements(cx, finalLength);
-
             /*
-             * The array's initialized length is now out of sync with the array
-             * elements: resynchronize it.
+             * Update the initialized length. Do so before shrinking so that we
+             * can apply the write barrier to the old slots.
              */
             if (cx->typeInferenceEnabled())
                 obj->setDenseArrayInitializedLength(finalLength);
 
+            /* Steps 12(c)-(d). */
+            obj->shrinkDenseArrayElements(cx, finalLength);
+
             /* Fix running enumerators for the deleted items. */
             if (!js_SuppressDeletedElements(cx, obj, finalLength, len))
                 return false;
@@ -3020,10 +3030,12 @@ mjit::stubs::ArrayConcatTwoArrays(VMFrame &f)
     if (!result->ensureSlots(f.cx, len))
         THROW();
 
-    result->copyDenseArrayElements(0, obj1->getDenseArrayElements(), initlen1);
-    result->copyDenseArrayElements(initlen1, obj2->getDenseArrayElements(), initlen2);
-
+    JS_ASSERT(!result->getDenseArrayInitializedLength());
     result->setDenseArrayInitializedLength(len);
+
+    result->initDenseArrayElements(0, obj1->getDenseArrayElements(), initlen1);
+    result->initDenseArrayElements(initlen1, obj2->getDenseArrayElements(), initlen2);
+
     result->setDenseArrayLength(len);
 }
 #endif /* JS_METHODJIT */
@@ -3360,8 +3372,7 @@ array_readonlyCommon(JSContext *cx, CallArgs &args)
         if (!kNotPresent) {
             if (!ag.pushed() && !cx->stack.pushInvokeArgs(cx, 3, &ag))
                 return false;
-            ag.calleeHasBeenReset();
-            ag.calleev() = ObjectValue(*callable);
+            ag.setCallee(ObjectValue(*callable));
             ag.thisv() = thisv;
             ag[0] = kValue;
             ag[1] = NumberValue(k);
@@ -3462,8 +3473,7 @@ array_map(JSContext *cx, uintN argc, Value *vp)
         if (!kNotPresent) {
             if (!ag.pushed() && !cx->stack.pushInvokeArgs(cx, 3, &ag))
                 return false;
-            ag.calleeHasBeenReset();
-            ag.calleev() = ObjectValue(*callable);
+            ag.setCallee(ObjectValue(*callable));
             ag.thisv() = thisv;
             ag[0] = kValue;
             ag[1] = NumberValue(k);
@@ -3542,8 +3552,7 @@ array_filter(JSContext *cx, uintN argc, Value *vp)
         if (!kNotPresent) {
             if (!ag.pushed() && !cx->stack.pushInvokeArgs(cx, 3, &ag))
                 return false;
-            ag.calleeHasBeenReset();
-            ag.calleev() = ObjectValue(*callable);
+            ag.setCallee(ObjectValue(*callable));
             ag.thisv() = thisv;
             ag[0] = kValue;
             ag[1] = NumberValue(k);
@@ -3661,8 +3670,7 @@ array_reduceCommon(JSContext *cx, CallArgs &args)
         if (!kNotPresent) {
             if (!ag.pushed() && !cx->stack.pushInvokeArgs(cx, 4, &ag))
                 return false;
-            ag.calleeHasBeenReset();
-            ag.calleev() = ObjectValue(*callable);
+            ag.setCallee(ObjectValue(*callable));
             ag.thisv() = UndefinedValue();
             ag[0] = accumulator;
             ag[1] = kValue;
@@ -3925,7 +3933,7 @@ NewDenseCopiedArray(JSContext *cx, uint32 length, const Value *vp, JSObject *pro
         obj->setDenseArrayInitializedLength(vp ? length : 0);
 
     if (vp)
-        obj->copyDenseArrayElements(0, vp, length);
+        obj->initDenseArrayElements(0, vp, length);
 
     return obj;
 }
diff --git a/js/src/jsarray.h b/js/src/jsarray.h
index b775cfe2ee5a..9db642634368 100644
--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -55,7 +55,7 @@ inline uint32
 JSObject::getDenseArrayInitializedLength()
 {
     JS_ASSERT(isDenseArray());
-    return initializedLength;
+    return initializedLength();
 }
 
 inline bool
diff --git a/js/src/jsarrayinlines.h b/js/src/jsarrayinlines.h
index c30af8f79762..c347f1751802 100644
--- a/js/src/jsarrayinlines.h
+++ b/js/src/jsarrayinlines.h
@@ -48,7 +48,9 @@ JSObject::setDenseArrayInitializedLength(uint32 length)
 {
     JS_ASSERT(isDenseArray());
     JS_ASSERT(length <= getDenseArrayCapacity());
-    initializedLength = length;
+    uint32 cur = initializedLength();
+    prepareSlotRangeForOverwrite(length, cur);
+    initializedLength() = length;
 }
 
 inline void
@@ -77,12 +79,13 @@ JSObject::ensureDenseArrayInitializedLength(JSContext *cx, uint32 index, uint32
      * for a write.
      */
     JS_ASSERT(index + extra <= capacity);
-    if (initializedLength < index) {
+    if (initializedLength() < index)
         markDenseArrayNotPacked(cx);
-        js::ClearValueRange(slots + initializedLength, index - initializedLength, true);
+
+    if (initializedLength() < index + extra) {
+        js::InitValueRange(slots + initializedLength(), index + extra - initializedLength(), true);
+        initializedLength() = index + extra;
     }
-    if (initializedLength < index + extra)
-        initializedLength = index + extra;
 }
 
 inline JSObject::EnsureDenseResult
diff --git a/js/src/jsatom.cpp b/js/src/jsatom.cpp
index 829b6c7c2561..3e01b01adbe0 100644
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -389,7 +389,7 @@ js_FinishCommonAtoms(JSContext *cx)
 void
 js_TraceAtomState(JSTracer *trc)
 {
-    JSRuntime *rt = trc->context->runtime;
+    JSRuntime *rt = trc->runtime;
     JSAtomState *state = &rt->atomState;
 
 #ifdef DEBUG
@@ -399,7 +399,7 @@ js_TraceAtomState(JSTracer *trc)
     if (rt->gcKeepAtoms) {
         for (AtomSet::Range r = state->atoms.all(); !r.empty(); r.popFront()) {
             JS_SET_TRACING_INDEX(trc, "locked_atom", number++);
-            MarkString(trc, r.front().asPtr());
+            MarkAtom(trc, r.front().asPtr());
         }
     } else {
         for (AtomSet::Range r = state->atoms.all(); !r.empty(); r.popFront()) {
@@ -408,7 +408,7 @@ js_TraceAtomState(JSTracer *trc)
                 continue;
 
             JS_SET_TRACING_INDEX(trc, "interned_atom", number++);
-            MarkString(trc, entry.asPtr());
+            MarkAtom(trc, entry.asPtr());
         }
     }
 }
diff --git a/js/src/jsatom.h b/js/src/jsatom.h
index dc7740ef92f0..4370c33250bc 100644
--- a/js/src/jsatom.h
+++ b/js/src/jsatom.h
@@ -49,9 +49,15 @@
 #include "jspubtd.h"
 #include "jslock.h"
 
+#include "gc/Barrier.h"
 #include "js/HashTable.h"
 #include "vm/String.h"
 
+struct JSIdArray {
+    jsint length;
+    js::HeapId vector[1];    /* actually, length jsid words */
+};
+
 /* Engine-internal extensions of jsid */
 
 static JS_ALWAYS_INLINE jsid
diff --git a/js/src/jscell.h b/js/src/jscell.h
index 3477e7c3358f..2ec7ae8afdbf 100644
--- a/js/src/jscell.h
+++ b/js/src/jscell.h
@@ -79,7 +79,9 @@ enum AllocKind {
     FINALIZE_LAST = FINALIZE_EXTERNAL_STRING
 };
 
-const size_t FINALIZE_LIMIT = FINALIZE_LAST + 1;
+static const unsigned FINALIZE_LIMIT = FINALIZE_LAST + 1;
+static const unsigned FINALIZE_OBJECT_LIMIT = FINALIZE_OBJECT_LAST + 1;
+static const unsigned FINALIZE_FUNCTION_AND_OBJECT_LIMIT = FINALIZE_FUNCTION_AND_OBJECT_LAST + 1;
 
 /*
  * Live objects are marked black. How many other additional colors are available
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 5cef498fcaa9..5a8c1e3f70ab 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -124,6 +124,8 @@ ThreadData::ThreadData()
 
 ThreadData::~ThreadData()
 {
+    JS_ASSERT(!repCache);
+
     if (dtoaState)
         js_DestroyDtoaState(dtoaState);
 }
@@ -131,6 +133,7 @@ ThreadData::~ThreadData()
 bool
 ThreadData::init()
 {
+    JS_ASSERT(!repCache);
     return stackSpace.init() && !!(dtoaState = js_NewDtoaState());
 }
 
@@ -172,9 +175,6 @@ ThreadData::createRegExpPrivateCache(JSRuntime *rt)
 void
 ThreadData::purgeRegExpPrivateCache(JSRuntime *rt)
 {
-    if (!repCache)
-        return;
-
     rt->delete_<RegExpPrivateCache>(repCache);
     repCache = NULL;
 }
@@ -1601,7 +1601,7 @@ JSContext::purge()
 static bool
 ComputeIsJITBroken()
 {
-#ifndef ANDROID
+#if !defined(ANDROID) || defined(GONK)
     return false;
 #else  // ANDROID
     if (getenv("JS_IGNORE_JIT_BROKENNESS")) {
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 6570c0d19556..7b6c7505f31f 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -460,11 +460,13 @@ struct JSRuntime
     /* We access this without the GC lock, however a race will not affect correctness */
     volatile uint32     gcNumFreeArenas;
     uint32              gcNumber;
-    js::GCMarker        *gcMarkingTracer;
+    js::GCMarker        *gcIncrementalTracer;
+    void                *gcVerifyData;
     bool                gcChunkAllocationSinceLastGC;
     int64               gcNextFullGCTime;
     int64               gcJitReleaseTime;
     JSGCMode            gcMode;
+    volatile jsuword    gcBarrierFailed;
     volatile jsuword    gcIsNeeded;
     js::WeakMapBase     *gcWeakMapList;
     js::gcstats::Statistics gcStats;
@@ -522,6 +524,9 @@ struct JSRuntime
      * Additionally, if gzZeal_ == 1 then we perform GCs in select places
      * (during MaybeGC and whenever a GC poke happens). This option is mainly
      * useful to embedders.
+     *
+     * We use gcZeal_ == 4 to enable write barrier verification. See the comment
+     * in jsgc.cpp for more information about this.
      */
 #ifdef JS_GC_ZEAL
     int                 gcZeal_;
@@ -533,7 +538,7 @@ struct JSRuntime
 
     bool needZealousGC() {
         if (gcNextScheduled > 0 && --gcNextScheduled == 0) {
-            if (gcZeal() >= 2)
+            if (gcZeal() >= js::gc::ZealAllocThreshold && gcZeal() < js::gc::ZealVerifierThreshold)
                 gcNextScheduled = gcZealFrequency;
             return true;
         }
@@ -545,6 +550,7 @@ struct JSRuntime
 #endif
 
     JSGCCallback        gcCallback;
+    JSGCFinishedCallback gcFinishedCallback;
 
   private:
     /*
@@ -1127,6 +1133,7 @@ struct JSContext
     bool hasStrictOption() const { return hasRunOption(JSOPTION_STRICT); }
     bool hasWErrorOption() const { return hasRunOption(JSOPTION_WERROR); }
     bool hasAtLineOption() const { return hasRunOption(JSOPTION_ATLINE); }
+    bool hasJITHardeningOption() const { return !hasRunOption(JSOPTION_SOFTEN); }
 
     js::LifoAlloc &tempLifoAlloc() { return JS_THREAD_DATA(this)->tempLifoAlloc; }
     inline js::LifoAlloc &typeLifoAlloc();
@@ -2213,18 +2220,6 @@ namespace js {
 
 /************************************************************************/
 
-static JS_ALWAYS_INLINE void
-ClearValueRange(Value *vec, uintN len, bool useHoles)
-{
-    if (useHoles) {
-        for (uintN i = 0; i < len; i++)
-            vec[i].setMagic(JS_ARRAY_HOLE);
-    } else {
-        for (uintN i = 0; i < len; i++)
-            vec[i].setUndefined();
-    }
-}
-
 static JS_ALWAYS_INLINE void
 MakeRangeGCSafe(Value *vec, size_t len)
 {
@@ -2414,26 +2409,23 @@ class AutoShapeVector : public AutoVectorRooter<const Shape *>
 
 class AutoValueArray : public AutoGCRooter
 {
-    js::Value *start_;
+    const js::Value *start_;
     unsigned length_;
 
   public:
-    AutoValueArray(JSContext *cx, js::Value *start, unsigned length
+    AutoValueArray(JSContext *cx, const js::Value *start, unsigned length
                    JS_GUARD_OBJECT_NOTIFIER_PARAM)
         : AutoGCRooter(cx, VALARRAY), start_(start), length_(length)
     {
         JS_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
-    Value *start() const { return start_; }
+    const Value *start() const { return start_; }
     unsigned length() const { return length_; }
 
     JS_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
-JSIdArray *
-NewIdArray(JSContext *cx, jsint length);
-
 /*
  * Allocation policy that uses JSRuntime::malloc_ and friends, so that
  * memory pressure is properly accounted for. This is suitable for
diff --git a/js/src/jscntxtinlines.h b/js/src/jscntxtinlines.h
index f9c36dc62ce2..78221d807c66 100644
--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -115,7 +115,7 @@ class AutoNamespaceArray : protected AutoGCRooter {
   public:
     friend void AutoGCRooter::trace(JSTracer *trc);
 
-    JSXMLArray array;
+    JSXMLArray<JSObject> array;
 };
 
 #ifdef DEBUG
@@ -208,8 +208,8 @@ class CompartmentChecker
     void check(JSScript *script) {
         if (script) {
             check(script->compartment());
-            if (!script->isCachedEval && script->u.globalObject)
-                check(script->u.globalObject);
+            if (!script->isCachedEval && script->globalObject)
+                check(script->globalObject);
         }
     }
 
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 3db31a519c3f..4a52f7ef5597 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -58,6 +58,7 @@
 #include "vm/Debugger.h"
 
 #include "jsgcinlines.h"
+#include "jsobjinlines.h"
 #include "jsscopeinlines.h"
 
 #if ENABLE_YARR_JIT
@@ -71,6 +72,8 @@ using namespace js::gc;
 JSCompartment::JSCompartment(JSRuntime *rt)
   : rt(rt),
     principals(NULL),
+    needsBarrier_(false),
+    gcIncrementalTracer(NULL),
     gcBytes(0),
     gcTriggerBytes(0),
     gcLastBytes(0),
@@ -348,6 +351,16 @@ JSCompartment::wrap(JSContext *cx, JSString **strp)
     return true;
 }
 
+bool
+JSCompartment::wrap(JSContext *cx, HeapPtrString *strp)
+{
+    AutoValueRooter tvr(cx, StringValue(*strp));
+    if (!wrap(cx, tvr.addr()))
+        return false;
+    *strp = tvr.value().toString();
+    return true;
+}
+
 bool
 JSCompartment::wrap(JSContext *cx, JSObject **objp)
 {
@@ -420,10 +433,10 @@ JSCompartment::wrap(JSContext *cx, AutoIdVector &props)
 void
 JSCompartment::markCrossCompartmentWrappers(JSTracer *trc)
 {
-    JS_ASSERT(trc->context->runtime->gcCurrentCompartment);
+    JS_ASSERT(trc->runtime->gcCurrentCompartment);
 
     for (WrapperMap::Enum e(crossCompartmentWrappers); !e.empty(); e.popFront())
-        MarkValue(trc, e.front().key, "cross-compartment wrapper");
+        MarkRoot(trc, e.front().key, "cross-compartment wrapper");
 }
 
 void
@@ -438,21 +451,21 @@ JSCompartment::markTypes(JSTracer *trc)
 
     for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
         JSScript *script = i.get<JSScript>();
-        MarkScript(trc, script, "mark_types_script");
+        MarkRoot(trc, script, "mark_types_script");
     }
 
     for (size_t thingKind = FINALIZE_OBJECT0;
-         thingKind <= FINALIZE_FUNCTION_AND_OBJECT_LAST;
+         thingKind < FINALIZE_FUNCTION_AND_OBJECT_LIMIT;
          thingKind++) {
         for (CellIterUnderGC i(this, AllocKind(thingKind)); !i.done(); i.next()) {
             JSObject *object = i.get<JSObject>();
             if (!object->isNewborn() && object->hasSingletonType())
-                MarkObject(trc, *object, "mark_types_singleton");
+                MarkRoot(trc, object, "mark_types_singleton");
         }
     }
 
     for (CellIterUnderGC i(this, FINALIZE_TYPE_OBJECT); !i.done(); i.next())
-        MarkTypeObject(trc, i.get<types::TypeObject>(), "mark_types_scan");
+        MarkRoot(trc, i.get<types::TypeObject>(), "mark_types_scan");
 }
 
 void
@@ -460,11 +473,11 @@ JSCompartment::sweep(JSContext *cx, bool releaseTypes)
 {
     /* Remove dead wrappers from the table. */
     for (WrapperMap::Enum e(crossCompartmentWrappers); !e.empty(); e.popFront()) {
-        JS_ASSERT_IF(IsAboutToBeFinalized(cx, e.front().key.toGCThing()) &&
-                     !IsAboutToBeFinalized(cx, e.front().value.toGCThing()),
+        JS_ASSERT_IF(IsAboutToBeFinalized(cx, e.front().key) &&
+                     !IsAboutToBeFinalized(cx, e.front().value),
                      e.front().key.isString());
-        if (IsAboutToBeFinalized(cx, e.front().key.toGCThing()) ||
-            IsAboutToBeFinalized(cx, e.front().value.toGCThing())) {
+        if (IsAboutToBeFinalized(cx, e.front().key) ||
+            IsAboutToBeFinalized(cx, e.front().value)) {
             e.removeFront();
         }
     }
@@ -495,27 +508,33 @@ JSCompartment::sweep(JSContext *cx, bool releaseTypes)
         traceMonitor()->sweep(cx);
 #endif
 
-    /*
-     * Kick all frames on the stack into the interpreter, and release all JIT
-     * code in the compartment.
-     */
-#ifdef JS_METHODJIT
-    mjit::ClearAllFrames(this);
-
-    for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-        JSScript *script = i.get<JSScript>();
-        mjit::ReleaseScriptCode(cx, script);
+    {
+        gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_DISCARD_CODE);
 
         /*
-         * Use counts for scripts are reset on GC. After discarding code we
-         * need to let it warm back up to get information like which opcodes
-         * are setting array holes or accessing getter properties.
+         * Kick all frames on the stack into the interpreter, and release all JIT
+         * code in the compartment.
          */
-        script->resetUseCount();
-    }
+#ifdef JS_METHODJIT
+        mjit::ClearAllFrames(this);
+
+        for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
+            JSScript *script = i.get<JSScript>();
+            mjit::ReleaseScriptCode(cx, script);
+
+            /*
+             * Use counts for scripts are reset on GC. After discarding code we
+             * need to let it warm back up to get information like which opcodes
+             * are setting array holes or accessing getter properties.
+             */
+            script->resetUseCount();
+        }
 #endif
+    }
 
     if (!activeAnalysis) {
+        gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
+
         /*
          * Clear the analysis pool, but don't release its data yet. While
          * sweeping types any live data will be allocated into the pool.
@@ -578,7 +597,7 @@ JSCompartment::purge(JSContext *cx)
             JSScript *script = *listHeadp;
             JS_ASSERT(GetGCThingTraceKind(script) == JSTRACE_SCRIPT);
             *listHeadp = NULL;
-            listHeadp = &script->u.evalHashLink;
+            listHeadp = &script->evalHashLink();
         }
     }
 
@@ -821,7 +840,7 @@ JSCompartment::markTrapClosuresIteratively(JSTracer *trc)
         // Put off marking trap state until we know the script is live.
         if (site->trapHandler && !IsAboutToBeFinalized(cx, site->script)) {
             if (site->trapClosure.isMarkable() &&
-                IsAboutToBeFinalized(cx, site->trapClosure.toGCThing()))
+                IsAboutToBeFinalized(cx, site->trapClosure))
             {
                 markedAny = true;
             }
@@ -852,3 +871,10 @@ JSCompartment::sweepBreakpoints(JSContext *cx)
             site->clearTrap(cx, &e);
     }
 }
+
+GCMarker *
+JSCompartment::createBarrierTracer()
+{
+    JS_ASSERT(!gcIncrementalTracer);
+    return NULL;
+}
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index 52403eab6658..c01476833be4 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -397,6 +397,20 @@ struct JS_FRIEND_API(JSCompartment) {
 
     js::gc::ArenaLists           arenas;
 
+    bool                         needsBarrier_;
+    js::GCMarker                 *gcIncrementalTracer;
+
+    bool needsBarrier() {
+        return needsBarrier_;
+    }
+
+    js::GCMarker *barrierTracer() {
+        JS_ASSERT(needsBarrier_);
+        if (gcIncrementalTracer)
+            return gcIncrementalTracer;
+        return createBarrierTracer();
+    }
+
     uint32                       gcBytes;
     uint32                       gcTriggerBytes;
     size_t                       gcLastBytes;
@@ -474,16 +488,19 @@ struct JS_FRIEND_API(JSCompartment) {
     jsrefcount                   liveDictModeNodes;
 #endif
 
+    typedef js::ReadBarriered<js::EmptyShape> BarrieredEmptyShape;
+    typedef js::ReadBarriered<const js::Shape> BarrieredShape;
+
     /*
      * Runtime-shared empty scopes for well-known built-in objects that lack
      * class prototypes (the usual locus of an emptyShape). Mnemonic: ABCDEW
      */
-    js::EmptyShape               *emptyArgumentsShape;
-    js::EmptyShape               *emptyBlockShape;
-    js::EmptyShape               *emptyCallShape;
-    js::EmptyShape               *emptyDeclEnvShape;
-    js::EmptyShape               *emptyEnumeratorShape;
-    js::EmptyShape               *emptyWithShape;
+    BarrieredEmptyShape          emptyArgumentsShape;
+    BarrieredEmptyShape          emptyBlockShape;
+    BarrieredEmptyShape          emptyCallShape;
+    BarrieredEmptyShape          emptyDeclEnvShape;
+    BarrieredEmptyShape          emptyEnumeratorShape;
+    BarrieredEmptyShape          emptyWithShape;
 
     typedef js::HashSet<js::EmptyShape *,
                         js::DefaultHasher<js::EmptyShape *>,
@@ -500,8 +517,8 @@ struct JS_FRIEND_API(JSCompartment) {
      * dictionary mode). But because all the initial properties are
      * non-configurable, they will always map to fixed slots.
      */
-    const js::Shape              *initialRegExpShape;
-    const js::Shape              *initialStringShape;
+    BarrieredShape               initialRegExpShape;
+    BarrieredShape               initialStringShape;
 
   private:
     enum { DebugFromC = 1, DebugFromJS = 2 };
@@ -526,6 +543,7 @@ struct JS_FRIEND_API(JSCompartment) {
 
     bool wrap(JSContext *cx, js::Value *vp);
     bool wrap(JSContext *cx, JSString **strp);
+    bool wrap(JSContext *cx, js::HeapPtrString *strp);
     bool wrap(JSContext *cx, JSObject **objp);
     bool wrapId(JSContext *cx, jsid *idp);
     bool wrap(JSContext *cx, js::PropertyOp *op);
@@ -624,6 +642,8 @@ struct JS_FRIEND_API(JSCompartment) {
   private:
     void sweepBreakpoints(JSContext *cx);
 
+    js::GCMarker *createBarrierTracer();
+
   public:
     js::WatchpointMap *watchpointMap;
 };
diff --git a/js/src/jscpucfg.h b/js/src/jscpucfg.h
index 045c5ef24f79..dd32bce6affc 100644
--- a/js/src/jscpucfg.h
+++ b/js/src/jscpucfg.h
@@ -44,73 +44,73 @@
 
 #if defined(_WIN64)
 
-#if defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)
-#define IS_LITTLE_ENDIAN 1
-#undef  IS_BIG_ENDIAN
-#define JS_BYTES_PER_DOUBLE 8
-#define JS_BYTES_PER_WORD   8
-#define JS_BITS_PER_WORD_LOG2   6
-#define JS_ALIGN_OF_POINTER 8
-#else  /* !(defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)) */
-#error "CPU type is unknown"
-#endif /* !(defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)) */
+# if defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)
+#  define IS_LITTLE_ENDIAN 1
+#  undef  IS_BIG_ENDIAN
+#  define JS_BYTES_PER_DOUBLE 8
+#  define JS_BYTES_PER_WORD   8
+#  define JS_BITS_PER_WORD_LOG2   6
+#  define JS_ALIGN_OF_POINTER 8
+# else  /* !(defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)) */
+#  error "CPU type is unknown"
+# endif /* !(defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)) */
 
 #elif defined(_WIN32) || defined(XP_OS2)
 
-#ifdef __WATCOMC__
-#define HAVE_VA_LIST_AS_ARRAY 1
-#endif
+# ifdef __WATCOMC__
+#  define HAVE_VA_LIST_AS_ARRAY 1
+# endif
 
-#define IS_LITTLE_ENDIAN 1
-#undef  IS_BIG_ENDIAN
-#define JS_BYTES_PER_DOUBLE 8
-#define JS_BYTES_PER_WORD   4
-#define JS_BITS_PER_WORD_LOG2   5
-#define JS_ALIGN_OF_POINTER 4
+# define IS_LITTLE_ENDIAN 1
+# undef  IS_BIG_ENDIAN
+# define JS_BYTES_PER_DOUBLE 8
+# define JS_BYTES_PER_WORD   4
+# define JS_BITS_PER_WORD_LOG2   5
+# define JS_ALIGN_OF_POINTER 4
 
 #elif defined(__APPLE__)
-#if __LITTLE_ENDIAN__
-#define IS_LITTLE_ENDIAN 1
-#undef  IS_BIG_ENDIAN
-#elif __BIG_ENDIAN__
-#undef  IS_LITTLE_ENDIAN
-#define IS_BIG_ENDIAN 1
-#endif
+# if __LITTLE_ENDIAN__
+#  define IS_LITTLE_ENDIAN 1
+#  undef  IS_BIG_ENDIAN
+# elif __BIG_ENDIAN__
+#  undef  IS_LITTLE_ENDIAN
+#  define IS_BIG_ENDIAN 1
+# endif
 
 #elif defined(JS_HAVE_ENDIAN_H)
-#include <endian.h>
+# include <endian.h>
 
-#if defined(__BYTE_ORDER)
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-#define IS_LITTLE_ENDIAN 1
-#undef  IS_BIG_ENDIAN
-#elif __BYTE_ORDER == __BIG_ENDIAN
-#undef  IS_LITTLE_ENDIAN
-#define IS_BIG_ENDIAN 1
-#endif
-#else /* !defined(__BYTE_ORDER) */
-#error "endian.h does not define __BYTE_ORDER. Cannot determine endianness."
-#endif
+# if defined(__BYTE_ORDER)
+#  if __BYTE_ORDER == __LITTLE_ENDIAN
+#   define IS_LITTLE_ENDIAN 1
+#   undef  IS_BIG_ENDIAN
+#  elif __BYTE_ORDER == __BIG_ENDIAN
+#   undef  IS_LITTLE_ENDIAN
+#   define IS_BIG_ENDIAN 1
+#  endif
+# else /* !defined(__BYTE_ORDER) */
+#  error "endian.h does not define __BYTE_ORDER. Cannot determine endianness."
+# endif
 
 #elif defined(JS_HAVE_SYS_ISA_DEFS_H)
-#include <sys/isa_defs.h>
+# include <sys/isa_defs.h>
 
-#if defined(_BIG_ENDIAN)
-#undef IS_LITTLE_ENDIAN
-#define IS_BIG_ENDIAN 1
-#elif defined(_LITTLE_ENDIAN)
-#define IS_LITTLE_ENDIAN 1
-#undef IS_BIG_ENDIAN
-#else /* !defined(_LITTLE_ENDIAN) */
-#error "sys/isa_defs.h does not define _BIG_ENDIAN or _LITTLE_ENDIAN. Cannot determine endianness."
-#endif
-#if !defined(JS_STACK_GROWTH_DIRECTION)
-#if defined(_STACK_GROWS_UPWARD)
-#define JS_STACK_GROWTH_DIRECTION (1)
-#elif defined(_STACK_GROWS_DOWNWARD)
-#define JS_STACK_GROWTH_DIRECTION (-1)
-#endif
-#endif
+# if defined(_BIG_ENDIAN)
+#  undef IS_LITTLE_ENDIAN
+#  define IS_BIG_ENDIAN 1
+# elif defined(_LITTLE_ENDIAN)
+#  define IS_LITTLE_ENDIAN 1
+#  undef IS_BIG_ENDIAN
+# else /* !defined(_LITTLE_ENDIAN) */
+#  error "sys/isa_defs.h does not define _BIG_ENDIAN or _LITTLE_ENDIAN. Cannot determine endianness."
+# endif
+# if !defined(JS_STACK_GROWTH_DIRECTION)
+#  if defined(_STACK_GROWS_UPWARD)
+#   define JS_STACK_GROWTH_DIRECTION (1)
+#  elif defined(_STACK_GROWS_DOWNWARD)
+#   define JS_STACK_GROWTH_DIRECTION (-1)
+#  endif
+# endif
 
 #elif defined(__sparc) || defined(__sparc__) || \
       defined(_POWER) || defined(__powerpc__) || \
@@ -119,19 +119,19 @@
 /* IA64 running HP-UX will have _BIG_ENDIAN defined.
  * IA64 running Linux will have endian.h and be handled above.
  */
-#undef IS_LITTLE_ENDIAN
-#define IS_BIG_ENDIAN 1
+# undef IS_LITTLE_ENDIAN
+# define IS_BIG_ENDIAN 1
 
 #else /* !defined(__sparc) && !defined(__sparc__) && ... */
-#error "Cannot determine endianness of your platform. Please add support to jscpucfg.h."
+# error "Cannot determine endianness of your platform. Please add support to jscpucfg.h."
 #endif
 
 #ifndef JS_STACK_GROWTH_DIRECTION
-#ifdef __hppa
-# define JS_STACK_GROWTH_DIRECTION (1)
-#else
-# define JS_STACK_GROWTH_DIRECTION (-1)
-#endif
+# ifdef __hppa
+#  define JS_STACK_GROWTH_DIRECTION (1)
+# else
+#  define JS_STACK_GROWTH_DIRECTION (-1)
+# endif
 #endif
 
 #endif /* js_cpucfg___ */
diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
index c6a552a0bced..88fceefb20eb 100644
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -2139,6 +2139,23 @@ JS_DumpBytecode(JSContext *cx, JSScript *script)
 #endif
 }
 
+extern JS_PUBLIC_API(void)
+JS_DumpPCCounts(JSContext *cx, JSScript *script)
+{
+#if defined(DEBUG)
+    JS_ASSERT(script->pcCounters);
+
+    LifoAlloc lifoAlloc(1024);
+    Sprinter sprinter;
+    INIT_SPRINTER(cx, &sprinter, &lifoAlloc, 0);
+
+    fprintf(stdout, "--- SCRIPT %s:%d ---\n", script->filename, script->lineno);
+    js_DumpPCCounts(cx, script, &sprinter);
+    fputs(sprinter.base, stdout);
+    fprintf(stdout, "--- END SCRIPT %s:%d ---\n", script->filename, script->lineno);
+#endif
+}
+
 static void
 DumpBytecodeScriptCallback(JSContext *cx, void *data, void *thing,
                            JSGCTraceKind traceKind, size_t thingSize)
@@ -2155,6 +2172,23 @@ JS_DumpCompartmentBytecode(JSContext *cx)
     IterateCells(cx, cx->compartment, gc::FINALIZE_SCRIPT, NULL, DumpBytecodeScriptCallback);
 }
 
+static void
+DumpPCCountsScriptCallback(JSContext *cx, void *data, void *thing,
+                           JSGCTraceKind traceKind, size_t thingSize)
+{
+    JS_ASSERT(traceKind == JSTRACE_SCRIPT);
+    JS_ASSERT(!data);
+    JSScript *script = static_cast<JSScript *>(thing);
+    if (script->pcCounters)
+        JS_DumpPCCounts(cx, script);
+}
+
+JS_PUBLIC_API(void)
+JS_DumpCompartmentPCCounts(JSContext *cx)
+{
+    IterateCells(cx, cx->compartment, gc::FINALIZE_SCRIPT, NULL, DumpPCCountsScriptCallback);
+}
+
 JS_PUBLIC_API(JSObject *)
 JS_UnwrapObject(JSObject *obj)
 {
diff --git a/js/src/jsdbgapi.h b/js/src/jsdbgapi.h
index 24b5e687e5b8..faffc3ea7cd5 100644
--- a/js/src/jsdbgapi.h
+++ b/js/src/jsdbgapi.h
@@ -612,6 +612,12 @@ JS_DumpBytecode(JSContext *cx, JSScript *script);
 extern JS_PUBLIC_API(void)
 JS_DumpCompartmentBytecode(JSContext *cx);
 
+extern JS_PUBLIC_API(void)
+JS_DumpPCCounts(JSContext *cx, JSScript *script);
+
+extern JS_PUBLIC_API(void)
+JS_DumpCompartmentPCCounts(JSContext *cx);
+
 extern JS_PUBLIC_API(JSObject *)
 JS_UnwrapObject(JSObject *obj);
 
diff --git a/js/src/jsexn.cpp b/js/src/jsexn.cpp
index a0d9223eae72..ff0cd4f4ce70 100644
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -69,8 +69,10 @@
 
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
+#include "jsstrinlines.h"
 
 #include "vm/Stack-inl.h"
+#include "vm/String-inl.h"
 
 using namespace mozilla;
 using namespace js;
@@ -113,7 +115,7 @@ Class js::ErrorClass = {
 };
 
 typedef struct JSStackTraceElem {
-    JSString            *funName;
+    js::HeapPtrString   funName;
     size_t              argc;
     const char          *filename;
     uintN               ulineno;
@@ -122,8 +124,8 @@ typedef struct JSStackTraceElem {
 typedef struct JSExnPrivate {
     /* A copy of the JSErrorReport originally generated. */
     JSErrorReport       *errorReport;
-    JSString            *message;
-    JSString            *filename;
+    js::HeapPtrString   message;
+    js::HeapPtrString   filename;
     uintN               lineno;
     size_t              stackDepth;
     intN                exnType;
@@ -328,12 +330,12 @@ InitExnPrivate(JSContext *cx, JSObject *exnObject, JSString *message,
                 return false;
             JSStackTraceElem &frame = frames.back();
             if (fp->isNonEvalFunctionFrame()) {
-                frame.funName = fp->fun()->atom ? fp->fun()->atom : cx->runtime->emptyString;
+                frame.funName.init(fp->fun()->atom ? fp->fun()->atom : cx->runtime->emptyString);
                 frame.argc = fp->numActualArgs();
                 if (!fp->forEachCanonicalActualArg(AppendArg(values)))
                     return false;
             } else {
-                frame.funName = NULL;
+                frame.funName.init(NULL);
                 frame.argc = 0;
             }
             if (fp->isScriptFrame()) {
@@ -357,6 +359,9 @@ InitExnPrivate(JSContext *cx, JSObject *exnObject, JSString *message,
     if (!priv)
         return false;
 
+    /* Initialize to zero so that write barriers don't witness undefined values. */
+    memset(priv, 0, nbytes);
+
     if (report) {
         /*
          * Construct a new copy of the error report struct. We can't use the
@@ -373,8 +378,8 @@ InitExnPrivate(JSContext *cx, JSObject *exnObject, JSString *message,
         priv->errorReport = NULL;
     }
 
-    priv->message = message;
-    priv->filename = filename;
+    priv->message.init(message);
+    priv->filename.init(filename);
     priv->lineno = lineno;
     priv->stackDepth = frames.length();
     priv->exnType = exnType;
@@ -422,8 +427,9 @@ exn_trace(JSTracer *trc, JSObject *obj)
         }
         vp = GetStackTraceValueBuffer(priv);
         for (i = 0; i != vcount; ++i, ++vp) {
+            /* This value is read-only, so it's okay for it to be Unbarriered. */
             v = *vp;
-            JS_CALL_VALUE_TRACER(trc, v, "stack trace argument");
+            MarkValueUnbarriered(trc, v, "stack trace argument");
         }
     }
 }
@@ -494,8 +500,6 @@ exn_resolve(JSContext *cx, JSObject *obj, jsid id, uintN flags,
             if (!stack)
                 return false;
 
-            /* Allow to GC all things that were used to build stack trace. */
-            priv->stackDepth = 0;
             prop = js_stack_str;
             v = STRING_TO_JSVAL(stack);
             attrs = JSPROP_ENUMERATE;
@@ -1342,11 +1346,11 @@ js_CopyErrorObject(JSContext *cx, JSObject *errobj, JSObject *scope)
     } else {
         copy->errorReport = NULL;
     }
-    copy->message = priv->message;
+    copy->message.init(priv->message);
     if (!cx->compartment->wrap(cx, &copy->message))
         return NULL;
     JS::Anchor<JSString *> messageAnchor(copy->message);
-    copy->filename = priv->filename;
+    copy->filename.init(priv->filename);
     if (!cx->compartment->wrap(cx, &copy->filename))
         return NULL;
     JS::Anchor<JSString *> filenameAnchor(copy->filename);
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index 5a7a9187a699..3e7cbad34a8d 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -229,6 +229,12 @@ JS_SetAccumulateTelemetryCallback(JSRuntime *rt, JSAccumulateTelemetryDataCallba
     rt->telemetryCallback = callback;
 }
 
+JS_FRIEND_API(void)
+JS_SetGCFinishedCallback(JSRuntime *rt, JSGCFinishedCallback callback)
+{
+    rt->gcFinishedCallback = callback;
+}
+
 #ifdef DEBUG
 
 struct DumpingChildInfo {
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index 1d0be6557bb3..9c7512913bca 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -97,6 +97,12 @@ typedef void
 extern JS_FRIEND_API(void)
 JS_SetAccumulateTelemetryCallback(JSRuntime *rt, JSAccumulateTelemetryDataCallback callback);
 
+typedef void
+(* JSGCFinishedCallback)(JSRuntime *rt, JSCompartment *comp, const char *description);
+
+extern JS_FRIEND_API(void)
+JS_SetGCFinishedCallback(JSRuntime *rt, JSGCFinishedCallback callback);
+
 /* Data for tracking analysis/inference memory usage. */
 typedef struct TypeInferenceMemoryStats
 {
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 3cfdb115774a..793c68a5dd82 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -151,32 +151,35 @@ ArgumentsObject::create(JSContext *cx, uint32 argc, JSObject &callee)
         cx->malloc_(offsetof(ArgumentsData, slots) + argc * sizeof(Value));
     if (!data)
         return NULL;
-    SetValueRangeToUndefined(data->slots, argc);
+
+    data->callee.init(ObjectValue(callee));
+    InitValueRange(data->slots, argc, false);
 
     /* Can't fail from here on, so initialize everything in argsobj. */
     obj->init(cx, callee.getFunctionPrivate()->inStrictMode()
               ? &StrictArgumentsObjectClass
               : &NormalArgumentsObjectClass,
               type, proto->getParent(), NULL, false);
-    obj->setMap(emptyArgumentsShape);
+    obj->initMap(emptyArgumentsShape);
 
     ArgumentsObject *argsobj = obj->asArguments();
 
     JS_ASSERT(UINT32_MAX > (uint64(argc) << PACKED_BITS_COUNT));
-    argsobj->setInitialLength(argc);
-
-    argsobj->setCalleeAndData(callee, data);
+    argsobj->initInitialLength(argc);
+    argsobj->initData(data);
 
     return argsobj;
 }
 
 struct STATIC_SKIP_INFERENCE PutArg
 {
-    PutArg(Value *dst) : dst(dst) {}
-    Value *dst;
+    PutArg(JSCompartment *comp, HeapValue *dst) : dst(dst), compartment(comp) {}
+    HeapValue *dst;
+    JSCompartment *compartment;
     bool operator()(uintN, Value *src) {
+        JS_ASSERT(dst->isMagic(JS_ARGS_HOLE) || dst->isUndefined());
         if (!dst->isMagic(JS_ARGS_HOLE))
-            *dst = *src;
+            dst->set(compartment, *src);
         ++dst;
         return true;
     }
@@ -220,7 +223,7 @@ js_GetArgsObject(JSContext *cx, StackFrame *fp)
      * retrieve up-to-date parameter values.
      */
     if (argsobj->isStrictArguments())
-        fp->forEachCanonicalActualArg(PutArg(argsobj->data()->slots));
+        fp->forEachCanonicalActualArg(PutArg(cx->compartment, argsobj->data()->slots));
     else
         argsobj->setStackFrame(fp);
 
@@ -234,7 +237,8 @@ js_PutArgsObject(StackFrame *fp)
     ArgumentsObject &argsobj = fp->argsObj();
     if (argsobj.isNormalArguments()) {
         JS_ASSERT(argsobj.maybeStackFrame() == fp);
-        fp->forEachCanonicalActualArg(PutArg(argsobj.data()->slots));
+        JSCompartment *comp = fp->scopeChain().compartment();
+        fp->forEachCanonicalActualArg(PutArg(comp, argsobj.data()->slots));
         argsobj.setStackFrame(NULL);
     } else {
         JS_ASSERT(!argsobj.maybeStackFrame());
@@ -282,10 +286,11 @@ js_PutArgumentsOnTrace(JSContext *cx, JSObject *obj, Value *argv)
      * need to worry about actual vs. formal arguments.
      */
     Value *srcend = argv + argsobj->initialLength();
-    Value *dst = argsobj->data()->slots;
+    HeapValue *dst = argsobj->data()->slots;
+    JSCompartment *comp = cx->compartment;
     for (Value *src = argv; src < srcend; ++src, ++dst) {
         if (!dst->isMagic(JS_ARGS_HOLE))
-            *dst = *src;
+            dst->set(comp, *src);
     }
 
     argsobj->clearOnTrace();
@@ -601,10 +606,8 @@ MaybeMarkGenerator(JSTracer *trc, JSObject *obj)
 {
 #if JS_HAS_GENERATORS
     StackFrame *fp = (StackFrame *) obj->getPrivate();
-    if (fp && fp->isFloatingGenerator()) {
-        JSObject *genobj = js_FloatingFrameToGenerator(fp)->obj;
-        MarkObject(trc, *genobj, "generator object");
-    }
+    if (fp && fp->isFloatingGenerator())
+        MarkObject(trc, js_FloatingFrameToGenerator(fp)->obj, "generator object");
 #endif
 }
 
@@ -618,8 +621,7 @@ args_trace(JSTracer *trc, JSObject *obj)
     }
 
     ArgumentsData *data = argsobj->data();
-    if (data->callee.isObject())
-        MarkObject(trc, data->callee.toObject(), js_callee_str);
+    MarkValue(trc, data->callee, js_callee_str);
     MarkValueRange(trc, argsobj->initialLength(), data->slots, js_arguments_str);
 
     MaybeMarkGenerator(trc, argsobj);
@@ -707,7 +709,7 @@ NewDeclEnvObject(JSContext *cx, StackFrame *fp)
     if (!emptyDeclEnvShape)
         return NULL;
     envobj->init(cx, &DeclEnvClass, &emptyTypeObject, &fp->scopeChain(), fp, false);
-    envobj->setMap(emptyDeclEnvShape);
+    envobj->initMap(emptyDeclEnvShape);
 
     return envobj;
 }
@@ -786,7 +788,7 @@ js_PutCallObject(StackFrame *fp)
     /* Get the arguments object to snapshot fp's actual argument values. */
     if (fp->hasArgsObj()) {
         if (!fp->hasOverriddenArgs())
-            callobj.setArguments(ObjectValue(fp->argsObj()));
+            callobj.initArguments(ObjectValue(fp->argsObj()));
         js_PutArgsObject(fp);
     }
 
@@ -823,18 +825,29 @@ js_PutCallObject(StackFrame *fp)
             } else {
                 /*
                  * For each arg & var that is closed over, copy it from the stack
-                 * into the call object.
+                 * into the call object. We use initArg/VarUnchecked because,
+                 * when you call a getter on a call object, js_NativeGetInline
+                 * caches the return value in the slot, so we can't assert that
+                 * it's undefined.
                  */
                 uint32 nclosed = script->nClosedArgs;
                 for (uint32 i = 0; i < nclosed; i++) {
                     uint32 e = script->getClosedArg(i);
+#ifdef JS_GC_ZEAL
                     callobj.setArg(e, fp->formalArg(e));
+#else
+                    callobj.initArgUnchecked(e, fp->formalArg(e));
+#endif
                 }
 
                 nclosed = script->nClosedVars;
                 for (uint32 i = 0; i < nclosed; i++) {
                     uint32 e = script->getClosedVar(i);
+#ifdef JS_GC_ZEAL
                     callobj.setVar(e, fp->slots()[e]);
+#else
+                    callobj.initVarUnchecked(e, fp->slots()[e]);
+#endif
                 }
             }
 
@@ -1592,19 +1605,24 @@ fun_trace(JSTracer *trc, JSObject *obj)
         return;
 
     if (fun != obj) {
-        /* obj is a cloned function object, trace the clone-parent, fun. */
-        MarkObject(trc, *fun, "private");
+        /*
+         * obj is a cloned function object, trace the clone-parent, fun.
+         * This is safe to leave Unbarriered for incremental GC because any
+         * change to fun will trigger a setPrivate barrer. But we'll need to
+         * fix this for generational GC.
+         */
+        MarkObjectUnbarriered(trc, fun, "private");
 
         /* The function could be a flat closure with upvar copies in the clone. */
         if (fun->isFlatClosure() && fun->script()->bindings.hasUpvars()) {
             MarkValueRange(trc, fun->script()->bindings.countUpvars(),
-                           obj->getFlatClosureUpvars(), "upvars");
+                           obj->getFlatClosureData()->upvars, "upvars");
         }
         return;
     }
 
     if (fun->atom)
-        MarkString(trc, fun->atom, "atom");
+        MarkAtom(trc, fun->atom, "atom");
 
     if (fun->isInterpreted() && fun->script())
         MarkScript(trc, fun->script(), "script");
@@ -1849,7 +1867,7 @@ JSObject::initBoundFunction(JSContext *cx, const Value &thisArg,
             return false;
 
         JS_ASSERT(numSlots() >= argslen + FUN_CLASS_RESERVED_SLOTS);
-        copySlotRange(FUN_CLASS_RESERVED_SLOTS, args, argslen);
+        copySlotRange(FUN_CLASS_RESERVED_SLOTS, args, argslen, false);
     }
     return true;
 }
@@ -2278,7 +2296,7 @@ js_NewFunction(JSContext *cx, JSObject *funobj, Native native, uintN nargs,
         JS_ASSERT(!native);
         JS_ASSERT(nargs == 0);
         fun->u.i.skipmin = 0;
-        fun->u.i.script_ = NULL;
+        fun->script().init(NULL);
     } else {
         fun->u.n.clasp = NULL;
         if (flags & JSFUN_TRCINFO) {
@@ -2328,7 +2346,7 @@ js_CloneFunctionObject(JSContext *cx, JSFunction *fun, JSObject *parent,
          * definitions or read barriers, so will not get here.
          */
         if (fun->getProto() == proto && !fun->hasSingletonType())
-            clone->setType(fun->type());
+            clone->initType(fun->type());
 
         clone->setPrivate(fun);
     } else {
@@ -2352,11 +2370,11 @@ js_CloneFunctionObject(JSContext *cx, JSFunction *fun, JSObject *parent,
             JS_ASSERT(script->compartment() == fun->compartment());
             JS_ASSERT(script->compartment() != cx->compartment);
 
-            cfun->u.i.script_ = NULL;
+            cfun->script().init(NULL);
             JSScript *cscript = js_CloneScript(cx, script);
             if (!cscript)
                 return NULL;
-            cscript->u.globalObject = cfun->getGlobal();
+            cscript->globalObject = cfun->getGlobal();
             cfun->setScript(cscript);
             if (!cscript->typeSetFunction(cx, cfun))
                 return NULL;
@@ -2395,11 +2413,11 @@ js_AllocFlatClosure(JSContext *cx, JSFunction *fun, JSObject *scopeChain)
     if (nslots == 0)
         return closure;
 
-    Value *upvars = (Value *) cx->malloc_(nslots * sizeof(Value));
-    if (!upvars)
+    FlatClosureData *data = (FlatClosureData *) cx->malloc_(nslots * sizeof(HeapValue));
+    if (!data)
         return NULL;
 
-    closure->setFlatClosureUpvars(upvars);
+    closure->setFlatClosureData(data);
     return closure;
 }
 
@@ -2425,12 +2443,12 @@ js_NewFlatClosure(JSContext *cx, JSFunction *fun, JSOp op, size_t oplen)
     if (!closure || !fun->script()->bindings.hasUpvars())
         return closure;
 
-    Value *upvars = closure->getFlatClosureUpvars();
+    FlatClosureData *data = closure->getFlatClosureData();
     uintN level = fun->script()->staticLevel;
     JSUpvarArray *uva = fun->script()->upvars();
 
     for (uint32 i = 0, n = uva->length; i < n; i++)
-        upvars[i] = GetUpvar(cx, level, uva->vector[i]);
+        data->upvars[i].init(GetUpvar(cx, level, uva->vector[i]));
 
     return closure;
 }
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index 9cf8efc5bb02..65c37c576dba 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -50,6 +50,8 @@
 #include "jsstr.h"
 #include "jsopcode.h"
 
+#include "gc/Barrier.h"
+
 /*
  * The high two bits of JSFunction.flags encode whether the function is native
  * or interpreted, and if interpreted, what kind of optimized closure form (if
@@ -108,7 +110,7 @@ struct JSFunction : public JSObject_Slots2
                                      reflected as f.length/f.arity */
     uint16          flags;        /* flags, see JSFUN_* below and in jsapi.h */
     union U {
-        struct {
+        struct Native {
             js::Native  native;   /* native method pointer or null */
             js::Class   *clasp;   /* class of objects constructed
                                      by this function */
@@ -195,18 +197,16 @@ struct JSFunction : public JSObject_Slots2
 
     inline void setMethodAtom(JSAtom *atom);
 
-    JSScript *script() const {
+    js::HeapPtrScript &script() const {
         JS_ASSERT(isInterpreted());
-        return u.i.script_;
+        return *(js::HeapPtrScript *)&u.i.script_;
     }
 
-    void setScript(JSScript *script) {
-        JS_ASSERT(isInterpreted());
-        u.i.script_ = script;
-    }
+    inline void setScript(JSScript *script_);
+    inline void initScript(JSScript *script_);
 
     JSScript *maybeScript() const {
-        return isInterpreted() ? script() : NULL;
+        return isInterpreted() ? script().get() : NULL;
     }
 
     JSNative native() const {
@@ -269,6 +269,10 @@ JSObject::getFunctionPrivate() const
 
 namespace js {
 
+struct FlatClosureData {
+    HeapValue upvars[1];
+};
+
 static JS_ALWAYS_INLINE bool
 IsFunctionObject(const js::Value &v)
 {
diff --git a/js/src/jsfuninlines.h b/js/src/jsfuninlines.h
index 777f195fee5f..80c94ca04427 100644
--- a/js/src/jsfuninlines.h
+++ b/js/src/jsfuninlines.h
@@ -97,4 +97,18 @@ CloneFunctionObject(JSContext *cx, JSFunction *fun, JSObject *parent,
     return js_CloneFunctionObject(cx, fun, parent, proto);
 }
 
+inline void
+JSFunction::setScript(JSScript *script_)
+{
+    JS_ASSERT(isInterpreted());
+    script() = script_;
+}
+
+inline void
+JSFunction::initScript(JSScript *script_)
+{
+    JS_ASSERT(isInterpreted());
+    script().init(script_);
+}
+
 #endif /* jsfuninlines_h___ */
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index f52b483d4c6f..07dc9f48bef2 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -111,6 +111,14 @@ using namespace js::gc;
 namespace js {
 namespace gc {
 
+#ifdef JS_GC_ZEAL
+static void
+StartVerifyBarriers(JSContext *cx);
+
+static void
+EndVerifyBarriers(JSContext *cx);
+#endif
+
 /* This array should be const, but that doesn't link right under GCC. */
 AllocKind slotsToThingKind[] = {
     /* 0 */  FINALIZE_OBJECT0,  FINALIZE_OBJECT2,  FINALIZE_OBJECT2,  FINALIZE_OBJECT4,
@@ -788,7 +796,7 @@ PickChunk(JSCompartment *comp)
 }
 
 JS_FRIEND_API(bool)
-IsAboutToBeFinalized(JSContext *cx, const void *thing)
+IsAboutToBeFinalized(JSContext *cx, const Cell *thing)
 {
     JS_ASSERT(cx);
 
@@ -801,6 +809,13 @@ IsAboutToBeFinalized(JSContext *cx, const void *thing)
     return !reinterpret_cast<const Cell *>(thing)->isMarked();
 }
 
+bool
+IsAboutToBeFinalized(JSContext *cx, const Value &v)
+{
+    JS_ASSERT(v.isMarkable());
+    return IsAboutToBeFinalized(cx, (Cell *)v.toGCThing());
+}
+
 JS_FRIEND_API(bool)
 js_GCThingIsMarked(void *thing, uintN color = BLACK)
 {
@@ -918,7 +933,7 @@ MarkIfGCThingWord(JSTracer *trc, jsuword w)
 
     Chunk *chunk = Chunk::fromAddress(addr);
 
-    if (!trc->context->runtime->gcChunkSet.has(chunk))
+    if (!trc->runtime->gcChunkSet.has(chunk))
         return CGCT_NOTCHUNK;
 
     /*
@@ -939,7 +954,7 @@ MarkIfGCThingWord(JSTracer *trc, jsuword w)
     if (!aheader->allocated())
         return CGCT_FREEARENA;
 
-    JSCompartment *curComp = trc->context->runtime->gcCurrentCompartment;
+    JSCompartment *curComp = trc->runtime->gcCurrentCompartment;
     if (curComp && curComp != aheader->compartment)
         return CGCT_OTHERCOMPARTMENT;
 
@@ -1045,7 +1060,7 @@ MarkStackRangeConservatively(JSTracer *trc, Value *beginv, Value *endv)
             rt->gcCheckCompartment = NULL;
         }
         ~AutoSkipChecking() { runtime->gcCheckCompartment = savedCompartment; }
-    } as(trc->context->runtime);
+    } as(trc->runtime);
 
     const jsuword *begin = beginv->payloadWord();
     const jsuword *end = endv->payloadWord();
@@ -1066,7 +1081,7 @@ void
 MarkConservativeStackRoots(JSTracer *trc)
 {
 #ifdef JS_THREADSAFE
-    for (JSThread::Map::Range r = trc->context->runtime->threads.all(); !r.empty(); r.popFront()) {
+    for (JSThread::Map::Range r = trc->runtime->threads.all(); !r.empty(); r.popFront()) {
         JSThread *thread = r.front().value;
         ConservativeGCThreadData *ctd = &thread->data.conservativeGC;
         if (ctd->hasStackToScan()) {
@@ -1078,7 +1093,7 @@ MarkConservativeStackRoots(JSTracer *trc)
         }
     }
 #else
-    MarkThreadDataConservatively(trc, &trc->context->runtime->threadData);
+    MarkThreadDataConservatively(trc, &trc->runtime->threadData);
 #endif
 }
 
@@ -1822,7 +1837,7 @@ gc_root_traversal(JSTracer *trc, const RootEntry &entry)
         ptr = vp->isGCThing() ? vp->toGCThing() : NULL;
     }
 
-    if (ptr && !trc->context->runtime->gcCurrentCompartment) {
+    if (ptr && !trc->runtime->gcCurrentCompartment) {
         /*
          * Use conservative machinery to find if ptr is a valid GC thing.
          * We only do this during global GCs, to preserve the invariant
@@ -1841,44 +1856,45 @@ gc_root_traversal(JSTracer *trc, const RootEntry &entry)
         JS_ASSERT(test == CGCT_VALID);
     }
 #endif
-    JS_SET_TRACING_NAME(trc, entry.value.name ? entry.value.name : "root");
+    const char *name = entry.value.name ? entry.value.name : "root";
     if (entry.value.type == JS_GC_ROOT_GCTHING_PTR)
-        MarkGCThing(trc, *reinterpret_cast<void **>(entry.key));
+        MarkRootGCThing(trc, *reinterpret_cast<void **>(entry.key), name);
     else
-        MarkValueRaw(trc, *reinterpret_cast<Value *>(entry.key));
+        MarkRoot(trc, *reinterpret_cast<Value *>(entry.key), name);
 }
 
 static void
 gc_lock_traversal(const GCLocks::Entry &entry, JSTracer *trc)
 {
     JS_ASSERT(entry.value >= 1);
-    MarkGCThing(trc, entry.key, "locked object");
+    MarkRootGCThing(trc, entry.key, "locked object");
 }
 
 void
 js_TraceStackFrame(JSTracer *trc, StackFrame *fp)
 {
-    MarkObject(trc, fp->scopeChain(), "scope chain");
+    MarkRoot(trc, &fp->scopeChain(), "scope chain");
     if (fp->isDummyFrame())
         return;
     if (fp->hasArgsObj())
-        MarkObject(trc, fp->argsObj(), "arguments");
-    MarkScript(trc, fp->script(), "script");
+        MarkRoot(trc, &fp->argsObj(), "arguments");
+    MarkRoot(trc, fp->script(), "script");
     fp->script()->compartment()->active = true;
-    MarkValue(trc, fp->returnValue(), "rval");
+    MarkRoot(trc, fp->returnValue(), "rval");
 }
 
 void
 AutoIdArray::trace(JSTracer *trc)
 {
     JS_ASSERT(tag == IDARRAY);
-    gc::MarkIdRange(trc, idArray->length, idArray->vector, "JSAutoIdArray.idArray");
+    gc::MarkIdRange(trc, idArray->vector, idArray->vector + idArray->length,
+                    "JSAutoIdArray.idArray");
 }
 
 void
 AutoEnumStateRooter::trace(JSTracer *trc)
 {
-    gc::MarkObject(trc, *obj, "js::AutoEnumStateRooter.obj");
+    gc::MarkRoot(trc, obj, "js::AutoEnumStateRooter.obj");
 }
 
 inline void
@@ -1886,7 +1902,7 @@ AutoGCRooter::trace(JSTracer *trc)
 {
     switch (tag) {
       case JSVAL:
-        MarkValue(trc, static_cast<AutoValueRooter *>(this)->val, "js::AutoValueRooter.val");
+        MarkRoot(trc, static_cast<AutoValueRooter *>(this)->val, "js::AutoValueRooter.val");
         return;
 
       case PARSER:
@@ -1899,7 +1915,7 @@ AutoGCRooter::trace(JSTracer *trc)
 
       case IDARRAY: {
         JSIdArray *ida = static_cast<AutoIdArray *>(this)->idArray;
-        MarkIdRange(trc, ida->length, ida->vector, "js::AutoIdArray.idArray");
+        MarkIdRange(trc, ida->vector, ida->vector + ida->length, "js::AutoIdArray.idArray");
         return;
       }
 
@@ -1908,10 +1924,10 @@ AutoGCRooter::trace(JSTracer *trc)
             static_cast<AutoPropDescArrayRooter *>(this)->descriptors;
         for (size_t i = 0, len = descriptors.length(); i < len; i++) {
             PropDesc &desc = descriptors[i];
-            MarkValue(trc, desc.pd, "PropDesc::pd");
-            MarkValue(trc, desc.value, "PropDesc::value");
-            MarkValue(trc, desc.get, "PropDesc::get");
-            MarkValue(trc, desc.set, "PropDesc::set");
+            MarkRoot(trc, desc.pd, "PropDesc::pd");
+            MarkRoot(trc, desc.value, "PropDesc::value");
+            MarkRoot(trc, desc.get, "PropDesc::get");
+            MarkRoot(trc, desc.set, "PropDesc::set");
         }
         return;
       }
@@ -1919,19 +1935,18 @@ AutoGCRooter::trace(JSTracer *trc)
       case DESCRIPTOR : {
         PropertyDescriptor &desc = *static_cast<AutoPropertyDescriptorRooter *>(this);
         if (desc.obj)
-            MarkObject(trc, *desc.obj, "Descriptor::obj");
-        MarkValue(trc, desc.value, "Descriptor::value");
+            MarkRoot(trc, desc.obj, "Descriptor::obj");
+        MarkRoot(trc, desc.value, "Descriptor::value");
         if ((desc.attrs & JSPROP_GETTER) && desc.getter)
-            MarkObject(trc, *CastAsObject(desc.getter), "Descriptor::get");
+            MarkRoot(trc, CastAsObject(desc.getter), "Descriptor::get");
         if (desc.attrs & JSPROP_SETTER && desc.setter)
-            MarkObject(trc, *CastAsObject(desc.setter), "Descriptor::set");
+            MarkRoot(trc, CastAsObject(desc.setter), "Descriptor::set");
         return;
       }
 
       case NAMESPACES: {
-        JSXMLArray &array = static_cast<AutoNamespaceArray *>(this)->array;
-        MarkObjectRange(trc, array.length, reinterpret_cast<JSObject **>(array.vector),
-                        "JSXMLArray.vector");
+        JSXMLArray<JSObject> &array = static_cast<AutoNamespaceArray *>(this)->array;
+        MarkObjectRange(trc, array.length, array.vector, "JSXMLArray.vector");
         array.cursors->trace(trc);
         return;
       }
@@ -1942,51 +1957,52 @@ AutoGCRooter::trace(JSTracer *trc)
 
       case OBJECT:
         if (JSObject *obj = static_cast<AutoObjectRooter *>(this)->obj)
-            MarkObject(trc, *obj, "js::AutoObjectRooter.obj");
+            MarkRoot(trc, obj, "js::AutoObjectRooter.obj");
         return;
 
       case ID:
-        MarkId(trc, static_cast<AutoIdRooter *>(this)->id_, "js::AutoIdRooter.val");
+        MarkRoot(trc, static_cast<AutoIdRooter *>(this)->id_, "js::AutoIdRooter.val");
         return;
 
       case VALVECTOR: {
         AutoValueVector::VectorImpl &vector = static_cast<AutoValueVector *>(this)->vector;
-        MarkValueRange(trc, vector.length(), vector.begin(), "js::AutoValueVector.vector");
+        MarkRootRange(trc, vector.length(), vector.begin(), "js::AutoValueVector.vector");
         return;
       }
 
       case STRING:
         if (JSString *str = static_cast<AutoStringRooter *>(this)->str)
-            MarkString(trc, str, "js::AutoStringRooter.str");
+            MarkRoot(trc, str, "js::AutoStringRooter.str");
         return;
 
       case IDVECTOR: {
         AutoIdVector::VectorImpl &vector = static_cast<AutoIdVector *>(this)->vector;
-        MarkIdRange(trc, vector.length(), vector.begin(), "js::AutoIdVector.vector");
+        MarkRootRange(trc, vector.length(), vector.begin(), "js::AutoIdVector.vector");
         return;
       }
 
       case SHAPEVECTOR: {
         AutoShapeVector::VectorImpl &vector = static_cast<js::AutoShapeVector *>(this)->vector;
-        MarkShapeRange(trc, vector.length(), vector.begin(), "js::AutoShapeVector.vector");
+        MarkRootRange(trc, vector.length(), vector.begin(), "js::AutoShapeVector.vector");
         return;
       }
 
       case OBJVECTOR: {
         AutoObjectVector::VectorImpl &vector = static_cast<AutoObjectVector *>(this)->vector;
-        MarkObjectRange(trc, vector.length(), vector.begin(), "js::AutoObjectVector.vector");
+        MarkRootRange(trc, vector.length(), vector.begin(), "js::AutoObjectVector.vector");
         return;
       }
 
       case VALARRAY: {
         AutoValueArray *array = static_cast<AutoValueArray *>(this);
-        MarkValueRange(trc, array->length(), array->start(), "js::AutoValueArray");
+        MarkRootRange(trc, array->length(), array->start(), "js::AutoValueArray");
         return;
       }
     }
 
     JS_ASSERT(tag >= 0);
-    MarkValueRange(trc, tag, static_cast<AutoArrayRooter *>(this)->array, "js::AutoArrayRooter.array");
+    MarkRootRange(trc, tag, static_cast<AutoArrayRooter *>(this)->array,
+                  "js::AutoArrayRooter.array");
 }
 
 namespace js {
@@ -1998,9 +2014,9 @@ MarkContext(JSTracer *trc, JSContext *acx)
 
     /* Mark other roots-by-definition in acx. */
     if (acx->globalObject && !acx->hasRunOption(JSOPTION_UNROOTED_GLOBAL))
-        MarkObject(trc, *acx->globalObject, "global object");
+        MarkRoot(trc, acx->globalObject, "global object");
     if (acx->isExceptionPending())
-        MarkValue(trc, acx->getPendingException(), "exception");
+        MarkRoot(trc, acx->getPendingException(), "exception");
 
     for (js::AutoGCRooter *gcr = acx->autoGCRooters; gcr; gcr = gcr->down)
         gcr->trace(trc);
@@ -2008,13 +2024,13 @@ MarkContext(JSTracer *trc, JSContext *acx)
     if (acx->sharpObjectMap.depth > 0)
         js_TraceSharpMap(trc, &acx->sharpObjectMap);
 
-    MarkValue(trc, acx->iterValue, "iterValue");
+    MarkRoot(trc, acx->iterValue, "iterValue");
 }
 
 JS_REQUIRES_STACK void
 MarkRuntime(JSTracer *trc)
 {
-    JSRuntime *rt = trc->context->runtime;
+    JSRuntime *rt = trc->runtime;
 
     if (rt->state != JSRTS_LANDING)
         MarkConservativeStackRoots(trc);
@@ -2516,7 +2532,7 @@ EndMarkPhase(JSContext *cx, GCMarker *gcmarker, JSGCInvocationKind gckind)
         gcmarker->drainMarkStack();
     }
 
-    rt->gcMarkingTracer = NULL;
+    rt->gcIncrementalTracer = NULL;
 
     rt->gcStats.endPhase(gcstats::PHASE_MARK);
 
@@ -2635,8 +2651,11 @@ SweepPhase(JSContext *cx, GCMarker *gcmarker, JSGCInvocationKind gckind)
             DecommitFreePages(cx);
     }
 
-    if (rt->gcCallback)
-        (void) rt->gcCallback(cx, JSGC_FINALIZE_END);
+    {
+        gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_XPCONNECT);
+        if (rt->gcCallback)
+            (void) rt->gcCallback(cx, JSGC_FINALIZE_END);
+    }
 }
 
 /*
@@ -2664,7 +2683,7 @@ MarkAndSweep(JSContext *cx, JSGCInvocationKind gckind)
     GCMarker gcmarker(cx);
     JS_ASSERT(IS_GC_MARKING_TRACER(&gcmarker));
     JS_ASSERT(gcmarker.getMarkColor() == BLACK);
-    rt->gcMarkingTracer = &gcmarker;
+    rt->gcIncrementalTracer = &gcmarker;
 
     BeginMarkPhase(cx, &gcmarker, gckind);
     gcmarker.drainMarkStack();
@@ -2958,6 +2977,17 @@ js_GC(JSContext *cx, JSCompartment *comp, JSGCInvocationKind gckind, gcstats::Re
         return;
     }
 
+#ifdef JS_GC_ZEAL
+    struct AutoVerifyBarriers {
+        JSContext *cx;
+        bool inVerify;
+        AutoVerifyBarriers(JSContext *cx) : cx(cx), inVerify(cx->runtime->gcVerifyData) {
+            if (inVerify) EndVerifyBarriers(cx);
+        }
+        ~AutoVerifyBarriers() { if (inVerify) StartVerifyBarriers(cx); }
+    } av(cx);
+#endif
+
     RecordNativeStackTopForGC(cx);
 
     gcstats::AutoGC agc(rt->gcStats, comp, reason);
@@ -3038,7 +3068,7 @@ TraceRuntime(JSTracer *trc)
         }
     }
 #else
-    AutoCopyFreeListToArenas copy(trc->context->runtime);
+    AutoCopyFreeListToArenas copy(trc->runtime);
     RecordNativeStackTopForGC(trc->context);
 #endif
 
@@ -3223,6 +3253,338 @@ RunDebugGC(JSContext *cx)
 #endif
 }
 
+#ifdef JS_GC_ZEAL
+
+/*
+ * Write barrier verification
+ *
+ * The next few functions are for incremental write barrier verification. When
+ * StartVerifyBarriers is called, a snapshot is taken of all objects in the GC
+ * heap and saved in an explicit graph data structure. Later, EndVerifyBarriers
+ * traverses the heap again. Any pointer values that were in the snapshot and
+ * are no longer found must be marked; otherwise an assertion triggers. Note
+ * that we must not GC in between starting and finishing a verification phase.
+ *
+ * The VerifyBarriers function is a shorthand. It checks if a verification phase
+ * is currently running. If not, it starts one. Otherwise, it ends the current
+ * phase and starts a new one.
+ *
+ * The user can adjust the frequency of verifications, which causes
+ * VerifyBarriers to be a no-op all but one out of N calls. However, if the
+ * |always| parameter is true, it starts a new phase no matter what.
+ */
+
+struct EdgeValue
+{
+    void *thing;
+    JSGCTraceKind kind;
+    char *label;
+};
+
+struct VerifyNode
+{
+    void *thing;
+    JSGCTraceKind kind;
+    uint32 count;
+    EdgeValue edges[1];
+};
+
+typedef HashMap<void *, VerifyNode *> NodeMap;
+
+/*
+ * The verifier data structures are simple. The entire graph is stored in a
+ * single block of memory. At the beginning is a VerifyNode for the root
+ * node. It is followed by a sequence of EdgeValues--the exact number is given
+ * in the node. After the edges come more nodes and their edges.
+ *
+ * The edgeptr and term fields are used to allocate out of the block of memory
+ * for the graph. If we run out of memory (i.e., if edgeptr goes beyond term),
+ * we just abandon the verification.
+ *
+ * The nodemap field is a hashtable that maps from the address of the GC thing
+ * to the VerifyNode that represents it.
+ */
+struct VerifyTracer : JSTracer {
+    /* The gcNumber when the verification began. */
+    uint32 number;
+
+    /* This counts up to JS_VERIFIER_FREQ to decide whether to verify. */
+    uint32 count;
+
+    /* This graph represents the initial GC "snapshot". */
+    VerifyNode *curnode;
+    VerifyNode *root;
+    char *edgeptr;
+    char *term;
+    NodeMap nodemap;
+
+    /* A dummy marker used for the write barriers; stored in gcMarkingTracer. */
+    GCMarker gcmarker;
+
+    VerifyTracer(JSContext *cx) : nodemap(cx), gcmarker(cx) {}
+};
+
+/*
+ * This function builds up the heap snapshot by adding edges to the current
+ * node.
+ */
+static void
+AccumulateEdge(JSTracer *jstrc, void *thing, JSGCTraceKind kind)
+{
+    VerifyTracer *trc = (VerifyTracer *)jstrc;
+
+    trc->edgeptr += sizeof(EdgeValue);
+    if (trc->edgeptr >= trc->term) {
+        trc->edgeptr = trc->term;
+        return;
+    }
+
+    VerifyNode *node = trc->curnode;
+    uint32 i = node->count;
+
+    node->edges[i].thing = thing;
+    node->edges[i].kind = kind;
+    node->edges[i].label = trc->debugPrinter ? NULL : (char *)trc->debugPrintArg;
+    node->count++;
+}
+
+static VerifyNode *
+MakeNode(VerifyTracer *trc, void *thing, JSGCTraceKind kind)
+{
+    NodeMap::AddPtr p = trc->nodemap.lookupForAdd(thing);
+    if (!p) {
+        VerifyNode *node = (VerifyNode *)trc->edgeptr;
+        trc->edgeptr += sizeof(VerifyNode) - sizeof(EdgeValue);
+        if (trc->edgeptr >= trc->term) {
+            trc->edgeptr = trc->term;
+            return NULL;
+        }
+
+        node->thing = thing;
+        node->count = 0;
+        node->kind = kind;
+        trc->nodemap.add(p, thing, node);
+        return node;
+    }
+    return NULL;
+}
+
+static
+VerifyNode *
+NextNode(VerifyNode *node)
+{
+    if (node->count == 0)
+        return (VerifyNode *)((char *)node + sizeof(VerifyNode) - sizeof(EdgeValue));
+    else
+        return (VerifyNode *)((char *)node + sizeof(VerifyNode) +
+			      sizeof(EdgeValue)*(node->count - 1));
+}
+
+static void
+StartVerifyBarriers(JSContext *cx)
+{
+    JSRuntime *rt = cx->runtime;
+
+    if (rt->gcVerifyData)
+        return;
+
+    LeaveTrace(cx);
+
+    AutoLockGC lock(rt);
+    AutoGCSession gcsession(cx);
+
+#ifdef JS_THREADSAFE
+    rt->gcHelperThread.waitBackgroundSweepOrAllocEnd();
+#endif
+
+    AutoUnlockGC unlock(rt);
+
+    AutoCopyFreeListToArenas copy(rt);
+    RecordNativeStackTopForGC(cx);
+
+    for (GCChunkSet::Range r(rt->gcChunkSet.all()); !r.empty(); r.popFront())
+        r.front()->bitmap.clear();
+
+    /*
+     * Kick all frames on the stack into the interpreter, and release all JIT
+     * code in the compartment.
+     */
+#ifdef JS_METHODJIT
+    for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); ++c) {
+        mjit::ClearAllFrames(*c);
+
+        for (CellIterUnderGC i(*c, FINALIZE_SCRIPT); !i.done(); i.next()) {
+            JSScript *script = i.get<JSScript>();
+            mjit::ReleaseScriptCode(cx, script);
+
+            /*
+             * Use counts for scripts are reset on GC. After discarding code we
+             * need to let it warm back up to get information like which opcodes
+             * are setting array holes or accessing getter properties.
+             */
+            script->resetUseCount();
+        }
+    }
+#endif
+
+    VerifyTracer *trc = new (js_malloc(sizeof(VerifyTracer))) VerifyTracer(cx);
+
+    rt->gcNumber++;
+    trc->number = rt->gcNumber;
+    trc->count = 0;
+
+    JS_TRACER_INIT(trc, cx, AccumulateEdge);
+
+    const size_t size = 64 * 1024 * 1024;
+    trc->root = (VerifyNode *)js_malloc(size);
+    JS_ASSERT(trc->root);
+    trc->edgeptr = (char *)trc->root;
+    trc->term = trc->edgeptr + size;
+
+    trc->nodemap.init();
+
+    /* Create the root node. */
+    trc->curnode = MakeNode(trc, NULL, JSGCTraceKind(0));
+
+    /* Make all the roots be edges emanating from the root node. */
+    MarkRuntime(trc);
+
+    VerifyNode *node = trc->curnode;
+    if (trc->edgeptr == trc->term)
+        goto oom;
+
+    /* For each edge, make a node for it if one doesn't already exist. */
+    while ((char *)node < trc->edgeptr) {
+        for (uint32 i = 0; i < node->count; i++) {
+            EdgeValue &e = node->edges[i];
+            VerifyNode *child = MakeNode(trc, e.thing, e.kind);
+            if (child) {
+                trc->curnode = child;
+                JS_TraceChildren(trc, e.thing, e.kind);
+            }
+            if (trc->edgeptr == trc->term)
+                goto oom;
+        }
+
+        node = NextNode(node);
+    }
+
+    rt->gcVerifyData = trc;
+    rt->gcIncrementalTracer = &trc->gcmarker;
+    for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); ++c) {
+        (*c)->gcIncrementalTracer = &trc->gcmarker;
+        (*c)->needsBarrier_ = true;
+    }
+
+    return;
+
+oom:
+    js_free(trc->root);
+    trc->~VerifyTracer();
+    js_free(trc);
+}
+
+/*
+ * This function is called by EndVerifyBarriers for every heap edge. If the edge
+ * already existed in the original snapshot, we "cancel it out" by overwriting
+ * it with NULL. EndVerifyBarriers later asserts that the remaining non-NULL
+ * edges (i.e., the ones from the original snapshot that must have been
+ * modified) must point to marked objects.
+ */
+static void
+CheckEdge(JSTracer *jstrc, void *thing, JSGCTraceKind kind)
+{
+    VerifyTracer *trc = (VerifyTracer *)jstrc;
+    VerifyNode *node = trc->curnode;
+
+    for (uint32 i = 0; i < node->count; i++) {
+        if (node->edges[i].thing == thing) {
+            JS_ASSERT(node->edges[i].kind == kind);
+            node->edges[i].thing = NULL;
+            return;
+        }
+    }
+}
+
+static void
+EndVerifyBarriers(JSContext *cx)
+{
+    LeaveTrace(cx);
+
+    JSRuntime *rt = cx->runtime;
+
+    AutoLockGC lock(rt);
+    AutoGCSession gcsession(cx);
+
+#ifdef JS_THREADSAFE
+    rt->gcHelperThread.waitBackgroundSweepOrAllocEnd();
+#endif
+
+    AutoUnlockGC unlock(rt);
+
+    AutoCopyFreeListToArenas copy(rt);
+    RecordNativeStackTopForGC(cx);
+
+    VerifyTracer *trc = (VerifyTracer *)rt->gcVerifyData;
+
+    if (!trc)
+        return;
+
+    JS_ASSERT(trc->number == rt->gcNumber);
+
+    rt->gcIncrementalTracer->markDelayedChildren();
+
+    rt->gcVerifyData = NULL;
+    rt->gcIncrementalTracer = NULL;
+    for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); ++c) {
+        (*c)->gcIncrementalTracer = NULL;
+        (*c)->needsBarrier_ = false;
+    }
+
+    JS_TRACER_INIT(trc, cx, CheckEdge);
+
+    /* Start after the roots. */
+    VerifyNode *node = NextNode(trc->root);
+    int count = 0;
+
+    while ((char *)node < trc->edgeptr) {
+        trc->curnode = node;
+        JS_TraceChildren(trc, node->thing, node->kind);
+
+        for (uint32 i = 0; i < node->count; i++) {
+            void *thing = node->edges[i].thing;
+            JS_ASSERT_IF(thing, static_cast<Cell *>(thing)->isMarked());
+        }
+
+        count++;
+        node = NextNode(node);
+    }
+
+    js_free(trc->root);
+    trc->~VerifyTracer();
+    js_free(trc);
+}
+
+void
+VerifyBarriers(JSContext *cx, bool always)
+{
+    if (cx->runtime->gcZeal() < ZealVerifierThreshold)
+        return;
+
+    uint32 freq = cx->runtime->gcZealFrequency;
+
+    JSRuntime *rt = cx->runtime;
+    if (VerifyTracer *trc = (VerifyTracer *)rt->gcVerifyData) {
+        if (++trc->count < freq && !always)
+            return;
+
+        EndVerifyBarriers(cx);
+    }
+    StartVerifyBarriers(cx);
+}
+
+#endif /* JS_GC_ZEAL */
+
 } /* namespace gc */
 
 } /* namespace js */
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index b7bc7b227bb2..52b089468d80 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -88,7 +88,7 @@ struct Arena;
  * This must be an upper bound, but we do not need the least upper bound, so
  * we just exclude non-background objects.
  */
-const size_t MAX_BACKGROUND_FINALIZE_KINDS = FINALIZE_LIMIT - (FINALIZE_OBJECT_LAST + 1) / 2;
+const size_t MAX_BACKGROUND_FINALIZE_KINDS = FINALIZE_LIMIT - FINALIZE_OBJECT_LIMIT / 2;
 
 const size_t ArenaShift = 12;
 const size_t ArenaSize = size_t(1) << ArenaShift;
@@ -1327,7 +1327,10 @@ extern void
 js_UnlockGCThingRT(JSRuntime *rt, void *thing);
 
 extern JS_FRIEND_API(bool)
-IsAboutToBeFinalized(JSContext *cx, const void *thing);
+IsAboutToBeFinalized(JSContext *cx, const js::gc::Cell *thing);
+
+extern bool
+IsAboutToBeFinalized(JSContext *cx, const js::Value &value);
 
 extern JS_FRIEND_API(bool)
 js_GCThingIsMarked(void *thing, uintN color);
@@ -1492,6 +1495,10 @@ class GCHelperThread {
         backgroundAllocation = false;
     }
 
+    PRThread *getThread() const {
+        return thread;
+    }
+
     /*
      * Outside the GC lock may give true answer when in fact the sweeping has
      * been done.
@@ -1774,6 +1781,25 @@ NewCompartment(JSContext *cx, JSPrincipals *principals);
 void
 RunDebugGC(JSContext *cx);
 
+const int ZealPokeThreshold = 1;
+const int ZealAllocThreshold = 2;
+const int ZealVerifierThreshold = 4;
+
+#ifdef JS_GC_ZEAL
+
+/* Check that write barriers have been used correctly. See jsgc.cpp. */
+void
+VerifyBarriers(JSContext *cx, bool always = false);
+
+#else
+
+static inline void
+VerifyBarriers(JSContext *cx, bool always = false)
+{
+}
+
+#endif
+
 } /* namespace gc */
 
 static inline JSCompartment *
diff --git a/js/src/jsgcinlines.h b/js/src/jsgcinlines.h
index a2efdba95149..5fe0bb2e3dcc 100644
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -115,7 +115,7 @@ static inline bool
 TryIncrementAllocKind(AllocKind *kindp)
 {
     size_t next = size_t(*kindp) + 2;
-    if (next > size_t(FINALIZE_OBJECT_LAST))
+    if (next >= size_t(FINALIZE_OBJECT_LIMIT))
         return false;
     *kindp = AllocKind(next);
     return true;
@@ -167,7 +167,7 @@ GCPoke(JSContext *cx, Value oldval)
 
 #ifdef JS_GC_ZEAL
     /* Schedule a GC to happen "soon" after a GC poke. */
-    if (cx->runtime->gcZeal())
+    if (cx->runtime->gcZeal() >= js::gc::ZealPokeThreshold)
         cx->runtime->gcNextScheduled = 1;
 #endif
 }
@@ -351,8 +351,11 @@ NewGCThing(JSContext *cx, js::gc::AllocKind kind, size_t thingSize)
         js::gc::RunDebugGC(cx);
 #endif
 
-    void *t = cx->compartment->arenas.allocateFromFreeList(kind, thingSize);
-    return static_cast<T *>(t ? t : js::gc::ArenaLists::refillFreeList(cx, kind));
+    JSCompartment *comp = cx->compartment;
+    void *t = comp->arenas.allocateFromFreeList(kind, thingSize);
+    if (!t)
+        t = js::gc::ArenaLists::refillFreeList(cx, kind);
+    return static_cast<T *>(t);
 }
 
 inline JSObject *
@@ -388,10 +391,8 @@ inline JSFunction*
 js_NewGCFunction(JSContext *cx)
 {
     JSFunction *fun = NewGCThing<JSFunction>(cx, js::gc::FINALIZE_FUNCTION, sizeof(JSFunction));
-    if (fun) {
-        fun->capacity = JSObject::FUN_CLASS_RESERVED_SLOTS;
-        fun->lastProp = NULL; /* Stops fun from being scanned until initializated. */
-    }
+    if (fun)
+        fun->earlyInit(JSObject::FUN_CLASS_RESERVED_SLOTS);
     return fun;
 }
 
diff --git a/js/src/jsgcmark.cpp b/js/src/jsgcmark.cpp
index e5bd317ef8f8..bc32d75a275c 100644
--- a/js/src/jsgcmark.cpp
+++ b/js/src/jsgcmark.cpp
@@ -110,12 +110,12 @@ CheckMarkedThing(JSTracer *trc, T *thing)
 {
     JS_ASSERT(thing);
     JS_ASSERT(trc->debugPrinter || trc->debugPrintArg);
-    JS_ASSERT_IF(trc->context->runtime->gcCurrentCompartment, IS_GC_MARKING_TRACER(trc));
+    JS_ASSERT_IF(trc->runtime->gcCurrentCompartment, IS_GC_MARKING_TRACER(trc));
 
     JS_ASSERT(thing->isAligned());
 
     JS_ASSERT(thing->compartment());
-    JS_ASSERT(thing->compartment()->rt == trc->context->runtime);
+    JS_ASSERT(thing->compartment()->rt == trc->runtime);
 }
 
 template<typename T>
@@ -124,7 +124,7 @@ Mark(JSTracer *trc, T *thing)
 {
     CheckMarkedThing(trc, thing);
 
-    JSRuntime *rt = trc->context->runtime;
+    JSRuntime *rt = trc->runtime;
 
     JS_OPT_ASSERT_IF(rt->gcCheckCompartment,
                      thing->compartment() == rt->gcCheckCompartment ||
@@ -148,51 +148,60 @@ Mark(JSTracer *trc, T *thing)
 }
 
 void
-MarkString(JSTracer *trc, JSString *str)
+MarkStringUnbarriered(JSTracer *trc, JSString *str, const char *name)
 {
     JS_ASSERT(str);
+    JS_SET_TRACING_NAME(trc, name);
     Mark(trc, str);
 }
 
 void
-MarkString(JSTracer *trc, JSString *str, const char *name)
+MarkString(JSTracer *trc, const MarkablePtr<JSString> &str, const char *name)
 {
-    JS_ASSERT(str);
-    JS_SET_TRACING_NAME(trc, name);
-    MarkString(trc, str);
+    MarkStringUnbarriered(trc, str.value, name);
 }
 
 void
-MarkObject(JSTracer *trc, JSObject &obj, const char *name)
+MarkAtom(JSTracer *trc, JSAtom *atom)
 {
     JS_ASSERT(trc);
-    JS_ASSERT(&obj);
-    JS_SET_TRACING_NAME(trc, name);
-    Mark(trc, &obj);
+    JS_ASSERT(atom);
+    Mark(trc, atom);
 }
 
 void
-MarkCrossCompartmentObject(JSTracer *trc, JSObject &obj, const char *name)
+MarkAtom(JSTracer *trc, JSAtom *atom, const char *name)
 {
-    JSRuntime *rt = trc->context->runtime;
-    if (rt->gcCurrentCompartment && rt->gcCurrentCompartment != obj.compartment())
-        return;
-
-    MarkObject(trc, obj, name);
+    MarkStringUnbarriered(trc, atom, name);
 }
 
 void
-MarkObjectWithPrinter(JSTracer *trc, JSObject &obj, JSTraceNamePrinter printer,
-                      const void *arg, size_t index)
+MarkObjectUnbarriered(JSTracer *trc, JSObject *obj, const char *name)
 {
     JS_ASSERT(trc);
-    JS_ASSERT(&obj);
+    JS_ASSERT(obj);
+    JS_SET_TRACING_NAME(trc, name);
+    Mark(trc, obj);
+}
+
+void
+MarkObjectWithPrinterUnbarriered(JSTracer *trc, JSObject *obj, JSTraceNamePrinter printer,
+                                 const void *arg, size_t index)
+{
+    JS_ASSERT(trc);
+    JS_ASSERT(obj);
     JS_SET_TRACING_DETAILS(trc, printer, arg, index);
-    Mark(trc, &obj);
+    Mark(trc, obj);
 }
 
 void
-MarkScript(JSTracer *trc, JSScript *script, const char *name)
+MarkObject(JSTracer *trc, const MarkablePtr<JSObject> &obj, const char *name)
+{
+    MarkObjectUnbarriered(trc, obj.value, name);
+}
+
+void
+MarkScriptUnbarriered(JSTracer *trc, JSScript *script, const char *name)
 {
     JS_ASSERT(trc);
     JS_ASSERT(script);
@@ -201,7 +210,13 @@ MarkScript(JSTracer *trc, JSScript *script, const char *name)
 }
 
 void
-MarkShape(JSTracer *trc, const Shape *shape, const char *name)
+MarkScript(JSTracer *trc, const MarkablePtr<JSScript> &script, const char *name)
+{
+    MarkScriptUnbarriered(trc, script.value, name);
+}
+
+void
+MarkShapeUnbarriered(JSTracer *trc, const Shape *shape, const char *name)
 {
     JS_ASSERT(trc);
     JS_ASSERT(shape);
@@ -210,7 +225,13 @@ MarkShape(JSTracer *trc, const Shape *shape, const char *name)
 }
 
 void
-MarkTypeObject(JSTracer *trc, types::TypeObject *type, const char *name)
+MarkShape(JSTracer *trc, const MarkablePtr<const Shape> &shape, const char *name)
+{
+    MarkShapeUnbarriered(trc, shape.value, name);
+}
+
+void
+MarkTypeObjectUnbarriered(JSTracer *trc, types::TypeObject *type, const char *name)
 {
     JS_ASSERT(trc);
     JS_ASSERT(type);
@@ -227,28 +248,40 @@ MarkTypeObject(JSTracer *trc, types::TypeObject *type, const char *name)
      */
     if (IS_GC_MARKING_TRACER(trc)) {
         if (type->singleton)
-            MarkObject(trc, *type->singleton, "type_singleton");
+            MarkObject(trc, type->singleton, "type_singleton");
         if (type->interpretedFunction)
-            MarkObject(trc, *type->interpretedFunction, "type_function");
+            MarkObject(trc, type->interpretedFunction, "type_function");
     }
 }
 
+void
+MarkTypeObject(JSTracer *trc, const MarkablePtr<types::TypeObject> &type, const char *name)
+{
+    MarkTypeObjectUnbarriered(trc, type.value, name);
+}
+
 #if JS_HAS_XML_SUPPORT
 void
-MarkXML(JSTracer *trc, JSXML *xml, const char *name)
+MarkXMLUnbarriered(JSTracer *trc, JSXML *xml, const char *name)
 {
     JS_ASSERT(trc);
     JS_ASSERT(xml);
     JS_SET_TRACING_NAME(trc, name);
     Mark(trc, xml);
 }
+
+void
+MarkXML(JSTracer *trc, const MarkablePtr<JSXML> &xml, const char *name)
+{
+    MarkXMLUnbarriered(trc, xml.value, name);
+}
 #endif
 
 void
 PushMarkStack(GCMarker *gcmarker, JSXML *thing)
 {
-    JS_OPT_ASSERT_IF(gcmarker->context->runtime->gcCurrentCompartment,
-                     thing->compartment() == gcmarker->context->runtime->gcCurrentCompartment);
+    JS_OPT_ASSERT_IF(gcmarker->runtime->gcCurrentCompartment,
+                     thing->compartment() == gcmarker->runtime->gcCurrentCompartment);
 
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         gcmarker->pushXML(thing);
@@ -257,8 +290,8 @@ PushMarkStack(GCMarker *gcmarker, JSXML *thing)
 void
 PushMarkStack(GCMarker *gcmarker, JSObject *thing)
 {
-    JS_OPT_ASSERT_IF(gcmarker->context->runtime->gcCurrentCompartment,
-                     thing->compartment() == gcmarker->context->runtime->gcCurrentCompartment);
+    JS_OPT_ASSERT_IF(gcmarker->runtime->gcCurrentCompartment,
+                     thing->compartment() == gcmarker->runtime->gcCurrentCompartment);
 
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         gcmarker->pushObject(thing);
@@ -267,8 +300,8 @@ PushMarkStack(GCMarker *gcmarker, JSObject *thing)
 void
 PushMarkStack(GCMarker *gcmarker, JSFunction *thing)
 {
-    JS_OPT_ASSERT_IF(gcmarker->context->runtime->gcCurrentCompartment,
-                     thing->compartment() == gcmarker->context->runtime->gcCurrentCompartment);
+    JS_OPT_ASSERT_IF(gcmarker->runtime->gcCurrentCompartment,
+                     thing->compartment() == gcmarker->runtime->gcCurrentCompartment);
 
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         gcmarker->pushObject(thing);
@@ -277,8 +310,8 @@ PushMarkStack(GCMarker *gcmarker, JSFunction *thing)
 void
 PushMarkStack(GCMarker *gcmarker, types::TypeObject *thing)
 {
-    JS_ASSERT_IF(gcmarker->context->runtime->gcCurrentCompartment,
-                 thing->compartment() == gcmarker->context->runtime->gcCurrentCompartment);
+    JS_ASSERT_IF(gcmarker->runtime->gcCurrentCompartment,
+                 thing->compartment() == gcmarker->runtime->gcCurrentCompartment);
 
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         gcmarker->pushType(thing);
@@ -287,8 +320,8 @@ PushMarkStack(GCMarker *gcmarker, types::TypeObject *thing)
 void
 PushMarkStack(GCMarker *gcmarker, JSScript *thing)
 {
-    JS_ASSERT_IF(gcmarker->context->runtime->gcCurrentCompartment,
-                 thing->compartment() == gcmarker->context->runtime->gcCurrentCompartment);
+    JS_ASSERT_IF(gcmarker->runtime->gcCurrentCompartment,
+                 thing->compartment() == gcmarker->runtime->gcCurrentCompartment);
 
     /*
      * We mark scripts directly rather than pushing on the stack as they can
@@ -305,8 +338,8 @@ ScanShape(GCMarker *gcmarker, const Shape *shape);
 void
 PushMarkStack(GCMarker *gcmarker, const Shape *thing)
 {
-    JS_OPT_ASSERT_IF(gcmarker->context->runtime->gcCurrentCompartment,
-                     thing->compartment() == gcmarker->context->runtime->gcCurrentCompartment);
+    JS_OPT_ASSERT_IF(gcmarker->runtime->gcCurrentCompartment,
+                     thing->compartment() == gcmarker->runtime->gcCurrentCompartment);
 
     /* We mark shapes directly rather than pushing on the stack. */
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
@@ -325,7 +358,7 @@ MarkAtomRange(JSTracer *trc, size_t len, JSAtom **vec, const char *name)
 }
 
 void
-MarkObjectRange(JSTracer *trc, size_t len, JSObject **vec, const char *name)
+MarkObjectRange(JSTracer *trc, size_t len, HeapPtr<JSObject> *vec, const char *name)
 {
     for (uint32 i = 0; i < len; i++) {
         if (JSObject *obj = vec[i]) {
@@ -336,7 +369,7 @@ MarkObjectRange(JSTracer *trc, size_t len, JSObject **vec, const char *name)
 }
 
 void
-MarkXMLRange(JSTracer *trc, size_t len, JSXML **vec, const char *name)
+MarkXMLRange(JSTracer *trc, size_t len, HeapPtr<JSXML> *vec, const char *name)
 {
     for (size_t i = 0; i < len; i++) {
         if (JSXML *xml = vec[i]) {
@@ -347,7 +380,7 @@ MarkXMLRange(JSTracer *trc, size_t len, JSXML **vec, const char *name)
 }
 
 void
-MarkId(JSTracer *trc, jsid id)
+MarkIdUnbarriered(JSTracer *trc, jsid id)
 {
     if (JSID_IS_STRING(id))
         Mark(trc, JSID_TO_STRING(id));
@@ -356,25 +389,41 @@ MarkId(JSTracer *trc, jsid id)
 }
 
 void
-MarkId(JSTracer *trc, jsid id, const char *name)
+MarkIdUnbarriered(JSTracer *trc, jsid id, const char *name)
 {
     JS_SET_TRACING_NAME(trc, name);
-    MarkId(trc, id);
+    MarkIdUnbarriered(trc, id);
 }
 
 void
-MarkIdRange(JSTracer *trc, jsid *beg, jsid *end, const char *name)
+MarkId(JSTracer *trc, const HeapId &id, const char *name)
+{
+    JS_SET_TRACING_NAME(trc, name);
+    MarkIdUnbarriered(trc, id.get(), name);
+}
+
+void
+MarkIdRangeUnbarriered(JSTracer *trc, jsid *beg, jsid *end, const char *name)
 {
     for (jsid *idp = beg; idp != end; ++idp) {
         JS_SET_TRACING_INDEX(trc, name, (idp - beg));
-        MarkId(trc, *idp);
+        MarkIdUnbarriered(trc, *idp);
     }
 }
 
 void
-MarkIdRange(JSTracer *trc, size_t len, jsid *vec, const char *name)
+MarkIdRangeUnbarriered(JSTracer *trc, size_t len, jsid *vec, const char *name)
 {
-    MarkIdRange(trc, vec, vec + len, name);
+    MarkIdRangeUnbarriered(trc, vec, vec + len, name);
+}
+
+void
+MarkIdRange(JSTracer *trc, HeapId *beg, HeapId *end, const char *name)
+{
+    for (HeapId *idp = beg; idp != end; ++idp) {
+        JS_SET_TRACING_INDEX(trc, name, (idp - beg));
+        MarkIdUnbarriered(trc, *idp);
+    }
 }
 
 void
@@ -387,7 +436,7 @@ MarkKind(JSTracer *trc, void *thing, JSGCTraceKind kind)
         Mark(trc, reinterpret_cast<JSObject *>(thing));
         break;
       case JSTRACE_STRING:
-        MarkString(trc, reinterpret_cast<JSString *>(thing));
+        Mark(trc, reinterpret_cast<JSString *>(thing));
         break;
       case JSTRACE_SCRIPT:
         Mark(trc, static_cast<JSScript *>(thing));
@@ -396,7 +445,7 @@ MarkKind(JSTracer *trc, void *thing, JSGCTraceKind kind)
         Mark(trc, reinterpret_cast<Shape *>(thing));
         break;
       case JSTRACE_TYPE_OBJECT:
-        MarkTypeObject(trc, reinterpret_cast<types::TypeObject *>(thing), "type_stack");
+        MarkTypeObjectUnbarriered(trc, reinterpret_cast<types::TypeObject *>(thing), "type_stack");
         break;
 #if JS_HAS_XML_SUPPORT
       case JSTRACE_XML:
@@ -417,18 +466,24 @@ MarkValueRaw(JSTracer *trc, const js::Value &v)
 }
 
 void
-MarkValue(JSTracer *trc, const js::Value &v, const char *name)
+MarkValueUnbarriered(JSTracer *trc, const js::Value &v, const char *name)
 {
     JS_SET_TRACING_NAME(trc, name);
     MarkValueRaw(trc, v);
 }
 
 void
-MarkCrossCompartmentValue(JSTracer *trc, const js::Value &v, const char *name)
+MarkValue(JSTracer *trc, const js::HeapValue &v, const char *name)
+{
+    MarkValueUnbarriered(trc, v, name);
+}
+
+void
+MarkCrossCompartmentValue(JSTracer *trc, const js::HeapValue &v, const char *name)
 {
     if (v.isMarkable()) {
         js::gc::Cell *cell = (js::gc::Cell *)v.toGCThing();
-        JSRuntime *rt = trc->context->runtime;
+        JSRuntime *rt = trc->runtime;
         if (rt->gcCurrentCompartment && cell->compartment() != rt->gcCurrentCompartment)
             return;
 
@@ -437,35 +492,20 @@ MarkCrossCompartmentValue(JSTracer *trc, const js::Value &v, const char *name)
 }
 
 void
-MarkValueRange(JSTracer *trc, const Value *beg, const Value *end, const char *name)
+MarkValueRange(JSTracer *trc, const HeapValue *beg, const HeapValue *end, const char *name)
 {
-    for (const Value *vp = beg; vp < end; ++vp) {
+    for (const HeapValue *vp = beg; vp < end; ++vp) {
         JS_SET_TRACING_INDEX(trc, name, vp - beg);
-        MarkValueRaw(trc, *vp);
+        MarkValueRaw(trc, vp->get());
     }
 }
 
 void
-MarkValueRange(JSTracer *trc, size_t len, const Value *vec, const char *name)
+MarkValueRange(JSTracer *trc, size_t len, const HeapValue *vec, const char *name)
 {
     MarkValueRange(trc, vec, vec + len, name);
 }
 
-void
-MarkShapeRange(JSTracer *trc, const Shape **beg, const Shape **end, const char *name)
-{
-    for (const Shape **sp = beg; sp < end; ++sp) {
-        JS_SET_TRACING_INDEX(trc, name, sp - beg);
-        MarkShape(trc, *sp, name);
-    }
-}
-
-void
-MarkShapeRange(JSTracer *trc, size_t len, const Shape **vec, const char *name)
-{
-    MarkShapeRange(trc, vec, vec + len, name);
-}
-
 /* N.B. Assumes JS_SET_TRACING_NAME/INDEX has already been called. */
 void
 MarkGCThing(JSTracer *trc, void *thing, JSGCTraceKind kind)
@@ -484,13 +524,6 @@ MarkGCThing(JSTracer *trc, void *thing)
     MarkKind(trc, thing, GetGCThingTraceKind(thing));
 }
 
-void
-MarkGCThing(JSTracer *trc, void *thing, const char *name)
-{
-    JS_SET_TRACING_NAME(trc, name);
-    MarkGCThing(trc, thing);
-}
-
 void
 MarkGCThing(JSTracer *trc, void *thing, const char *name, size_t index)
 {
@@ -509,37 +542,104 @@ Mark(JSTracer *trc, void *thing, JSGCTraceKind kind, const char *name)
 void
 MarkRoot(JSTracer *trc, JSObject *thing, const char *name)
 {
-    MarkObject(trc, *thing, name);
+    MarkObjectUnbarriered(trc, thing, name);
 }
 
 void
 MarkRoot(JSTracer *trc, JSString *thing, const char *name)
 {
-    MarkString(trc, thing, name);
+    MarkStringUnbarriered(trc, thing, name);
 }
 
 void
 MarkRoot(JSTracer *trc, JSScript *thing, const char *name)
 {
-    MarkScript(trc, thing, name);
+    MarkScriptUnbarriered(trc, thing, name);
 }
 
 void
 MarkRoot(JSTracer *trc, const Shape *thing, const char *name)
 {
-    MarkShape(trc, thing, name);
+    MarkShapeUnbarriered(trc, thing, name);
 }
 
 void
 MarkRoot(JSTracer *trc, types::TypeObject *thing, const char *name)
 {
-    MarkTypeObject(trc, thing, name);
+    MarkTypeObjectUnbarriered(trc, thing, name);
 }
 
 void
 MarkRoot(JSTracer *trc, JSXML *thing, const char *name)
 {
-    MarkXML(trc, thing, name);
+    MarkXMLUnbarriered(trc, thing, name);
+}
+
+void
+MarkRoot(JSTracer *trc, const Value &v, const char *name)
+{
+    MarkValueUnbarriered(trc, v, name);
+}
+
+void
+MarkRoot(JSTracer *trc, jsid id, const char *name)
+{
+    JS_SET_TRACING_NAME(trc, name);
+    MarkIdUnbarriered(trc, id);
+}
+
+void
+MarkRootGCThing(JSTracer *trc, void *thing, const char *name)
+{
+    JS_SET_TRACING_NAME(trc, name);
+    MarkGCThing(trc, thing);
+}
+
+void
+MarkRootRange(JSTracer *trc, size_t len, const Shape **vec, const char *name)
+{
+    const Shape **end = vec + len;
+    for (const Shape **sp = vec; sp < end; ++sp) {
+        JS_SET_TRACING_INDEX(trc, name, sp - vec);
+        MarkShapeUnbarriered(trc, *sp, name);
+    }
+}
+
+void
+MarkRootRange(JSTracer *trc, size_t len, JSObject **vec, const char *name)
+{
+    JSObject **end = vec + len;
+    for (JSObject **sp = vec; sp < end; ++sp) {
+        JS_SET_TRACING_INDEX(trc, name, sp - vec);
+        MarkObjectUnbarriered(trc, *sp, name);
+    }
+}
+
+void
+MarkRootRange(JSTracer *trc, const Value *beg, const Value *end, const char *name)
+{
+    for (const Value *vp = beg; vp < end; ++vp) {
+        JS_SET_TRACING_INDEX(trc, name, vp - beg);
+        MarkValueRaw(trc, *vp);
+    }
+}
+
+void
+MarkRootRange(JSTracer *trc, size_t len, const Value *vec, const char *name)
+{
+    MarkRootRange(trc, vec, vec + len, name);
+}
+
+void
+MarkRootRange(JSTracer *trc, jsid *beg, jsid *end, const char *name)
+{
+    MarkIdRangeUnbarriered(trc, beg, end, name);
+}
+
+void
+MarkRootRange(JSTracer *trc, size_t len, jsid *vec, const char *name)
+{
+    MarkIdRangeUnbarriered(trc, len, vec, name);
 }
 
 static void
@@ -592,7 +692,7 @@ static void
 ScanShape(GCMarker *gcmarker, const Shape *shape)
 {
 restart:
-    JSRuntime *rt = gcmarker->context->runtime;
+    JSRuntime *rt = gcmarker->runtime;
     if (rt->gcRegenShapes)
         shape->shapeid = js_RegenerateShapeForGC(rt);
 
@@ -617,9 +717,9 @@ restart:
 static inline void
 ScanRope(GCMarker *gcmarker, JSRope *rope)
 {
-    JS_OPT_ASSERT_IF(gcmarker->context->runtime->gcCurrentCompartment,
-                     rope->compartment() == gcmarker->context->runtime->gcCurrentCompartment
-                     || rope->compartment() == gcmarker->context->runtime->atomsCompartment);
+    JS_OPT_ASSERT_IF(gcmarker->runtime->gcCurrentCompartment,
+                     rope->compartment() == gcmarker->runtime->gcCurrentCompartment
+                     || rope->compartment() == gcmarker->runtime->atomsCompartment);
     JS_ASSERT(rope->isMarked());
 
     JSString *leftChild = NULL;
@@ -645,9 +745,9 @@ ScanRope(GCMarker *gcmarker, JSRope *rope)
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSString *str)
 {
-    JS_OPT_ASSERT_IF(gcmarker->context->runtime->gcCurrentCompartment,
-                     str->compartment() == gcmarker->context->runtime->gcCurrentCompartment
-                     || str->compartment() == gcmarker->context->runtime->atomsCompartment);
+    JS_OPT_ASSERT_IF(gcmarker->runtime->gcCurrentCompartment,
+                     str->compartment() == gcmarker->runtime->gcCurrentCompartment
+                     || str->compartment() == gcmarker->runtime->atomsCompartment);
 
     if (str->isLinear()) {
         str->asLinear().mark(gcmarker);
@@ -700,11 +800,11 @@ ScanObject(GCMarker *gcmarker, JSObject *obj)
         js::Shape *shape = obj->lastProp;
         PushMarkStack(gcmarker, shape);
 
-        if (gcmarker->context->runtime->gcRegenShapes) {
+        if (gcmarker->runtime->gcRegenShapes) {
             /* We need to regenerate our shape if hasOwnShape(). */
             uint32 newShape = shape->shapeid;
             if (obj->hasOwnShape()) {
-                newShape = js_RegenerateShapeForGC(gcmarker->context->runtime);
+                newShape = js_RegenerateShapeForGC(gcmarker->runtime);
                 JS_ASSERT(newShape != shape->shapeid);
             }
             obj->objShape = newShape;
@@ -761,8 +861,8 @@ MarkChildren(JSTracer *trc, JSObject *obj)
     /* Trace universal (ops-independent) members. */
     if (!obj->isDenseArray() && obj->newType)
         MarkTypeObject(trc, obj->newType, "new_type");
-    if (JSObject *parent = obj->getParent())
-        MarkObject(trc, *parent, "parent");
+    if (obj->parent)
+        MarkObject(trc, obj->parent, "parent");
 
     Class *clasp = obj->getClass();
     if (clasp->trace)
@@ -783,12 +883,16 @@ MarkChildren(JSTracer *trc, JSObject *obj)
 void
 MarkChildren(JSTracer *trc, JSString *str)
 {
+    /*
+     * We use custom barriers in JSString, so it's safe to use unbarriered
+     * marking here.
+     */
     if (str->isDependent()) {
-        MarkString(trc, str->asDependent().base(), "base");
+        MarkStringUnbarriered(trc, str->asDependent().base(), "base");
     } else if (str->isRope()) {
         JSRope &rope = str->asRope();
-        MarkString(trc, rope.leftChild(), "left child");
-        MarkString(trc, rope.rightChild(), "right child");
+        MarkStringUnbarriered(trc, rope.leftChild(), "left child");
+        MarkStringUnbarriered(trc, rope.rightChild(), "right child");
     }
 }
 
@@ -799,10 +903,10 @@ MarkChildren(JSTracer *trc, JSScript *script)
     CheckScript(script, NULL);
 
 #ifdef JS_CRASH_DIAGNOSTICS
-    JSRuntime *rt = trc->context->runtime;
+    JSRuntime *rt = trc->runtime;
     JS_OPT_ASSERT_IF(rt->gcCheckCompartment, script->compartment() == rt->gcCheckCompartment);
 #endif
-    
+
     MarkAtomRange(trc, script->natoms, script->atoms, "atoms");
 
     if (JSScript::isValidOffset(script->objectsOffset)) {
@@ -820,8 +924,8 @@ MarkChildren(JSTracer *trc, JSScript *script)
         MarkValueRange(trc, constarray->length, constarray->vector, "consts");
     }
 
-    if (!script->isCachedEval && script->u.globalObject)
-        MarkObject(trc, *script->u.globalObject, "object");
+    if (!script->isCachedEval && script->globalObject)
+        MarkObject(trc, script->globalObject, "object");
 
     if (IS_GC_MARKING_TRACER(trc) && script->filename)
         js_MarkScriptFilename(script->filename);
@@ -839,12 +943,15 @@ restart:
     MarkId(trc, shape->propid, "propid");
 
     if (shape->hasGetterValue() && shape->getter())
-        MarkObjectWithPrinter(trc, *shape->getterObject(), PrintPropertyGetterOrSetter, shape, 0);
+        MarkObjectWithPrinterUnbarriered(trc, shape->getterObject(),
+                                         PrintPropertyGetterOrSetter, shape, 0);
     if (shape->hasSetterValue() && shape->setter())
-        MarkObjectWithPrinter(trc, *shape->setterObject(), PrintPropertyGetterOrSetter, shape, 1);
+        MarkObjectWithPrinterUnbarriered(trc, shape->setterObject(),
+                                         PrintPropertyGetterOrSetter, shape, 1);
 
     if (shape->isMethod())
-        MarkObjectWithPrinter(trc, shape->methodObject(), PrintPropertyMethod, shape, 0);
+        MarkObjectWithPrinterUnbarriered(trc, &shape->methodObject(),
+                                         PrintPropertyMethod, shape, 0);
 
     shape = shape->previous();
     if (shape)
@@ -864,8 +971,7 @@ ScanTypeObject(GCMarker *gcmarker, types::TypeObject *type)
     }
 
     if (type->emptyShapes) {
-        int count = FINALIZE_OBJECT_LAST - FINALIZE_OBJECT0 + 1;
-        for (int i = 0; i < count; i++) {
+        for (unsigned i = 0; i < FINALIZE_OBJECT_LIMIT; i++) {
             if (type->emptyShapes[i])
                 PushMarkStack(gcmarker, type->emptyShapes[i]);
         }
@@ -901,26 +1007,25 @@ MarkChildren(JSTracer *trc, types::TypeObject *type)
     }
 
     if (type->emptyShapes) {
-        int count = FINALIZE_OBJECT_LAST - FINALIZE_OBJECT0 + 1;
-        for (int i = 0; i < count; i++) {
+        for (unsigned i = 0; i < FINALIZE_OBJECT_LIMIT; i++) {
             if (type->emptyShapes[i])
                 MarkShape(trc, type->emptyShapes[i], "empty_shape");
         }
     }
 
     if (type->proto)
-        MarkObject(trc, *type->proto, "type_proto");
+        MarkObject(trc, type->proto, "type_proto");
 
     if (type->singleton)
-        MarkObject(trc, *type->singleton, "type_singleton");
+        MarkObject(trc, type->singleton, "type_singleton");
 
     if (type->newScript) {
-        MarkObject(trc, *type->newScript->fun, "type_new_function");
+        MarkObject(trc, type->newScript->fun, "type_new_function");
         MarkShape(trc, type->newScript->shape, "type_new_shape");
     }
 
     if (type->interpretedFunction)
-        MarkObject(trc, *type->interpretedFunction, "type_function");
+        MarkObject(trc, type->interpretedFunction, "type_function");
 }
 
 #ifdef JS_HAS_XML_SUPPORT
@@ -936,7 +1041,7 @@ MarkChildren(JSTracer *trc, JSXML *xml)
 void
 GCMarker::drainMarkStack()
 {
-    JSRuntime *rt = context->runtime;
+    JSRuntime *rt = runtime;
     rt->gcCheckCompartment = rt->gcCurrentCompartment;
 
     while (!isMarkStackEmpty()) {
@@ -970,10 +1075,8 @@ GCMarker::drainMarkStack()
     rt->gcCheckCompartment = NULL;
 }
 
-} /* namespace js */
-
-JS_PUBLIC_API(void)
-JS_TraceChildren(JSTracer *trc, void *thing, JSGCTraceKind kind)
+void
+TraceChildren(JSTracer *trc, void *thing, JSGCTraceKind kind)
 {
     switch (kind) {
       case JSTRACE_OBJECT:
@@ -1004,6 +1107,15 @@ JS_TraceChildren(JSTracer *trc, void *thing, JSGCTraceKind kind)
     }
 }
 
+void
+CallTracer(JSTracer *trc, void *thing, JSGCTraceKind kind)
+{
+    JS_ASSERT(thing);
+    MarkKind(trc, thing, kind);
+}
+
+} /* namespace js */
+
 inline void
 JSObject::scanSlots(GCMarker *gcmarker)
 {
@@ -1016,7 +1128,7 @@ JSObject::scanSlots(GCMarker *gcmarker)
     if (slots) {
         unsigned nfixed = numFixedSlots();
         if (nslots > nfixed) {
-            Value *vp = fixedSlots();
+            HeapValue *vp = fixedSlots();
             for (i = 0; i < nfixed; i++, vp++)
                 ScanValue(gcmarker, *vp);
             vp = slots;
@@ -1026,7 +1138,7 @@ JSObject::scanSlots(GCMarker *gcmarker)
         }
     }
     JS_ASSERT(nslots <= numFixedSlots());
-    Value *vp = fixedSlots();
+    HeapValue *vp = fixedSlots();
     for (i = 0; i < nslots; i++, vp++)
         ScanValue(gcmarker, *vp);
 }
diff --git a/js/src/jsgcmark.h b/js/src/jsgcmark.h
index 34cf0719392d..b9205416dae8 100644
--- a/js/src/jsgcmark.h
+++ b/js/src/jsgcmark.h
@@ -1,4 +1,4 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ -45,105 +45,93 @@
 #include "jscompartment.h"
 #include "jslock.h"
 
-
+#include "gc/Barrier.h"
 #include "js/TemplateLib.h"
 
 namespace js {
 namespace gc {
 
 void
-MarkString(JSTracer *trc, JSString *str);
+MarkAtom(JSTracer *trc, JSAtom *str);
 
 void
-MarkString(JSTracer *trc, JSString *str, const char *name);
+MarkAtom(JSTracer *trc, JSAtom *str, const char *name);
 
 void
-MarkObject(JSTracer *trc, JSObject &obj, const char *name);
-
-/*
- * Mark an object that may be in a different compartment from the compartment
- * being GC'd. (Although it won't be marked if it's in the wrong compartment.)
- */
-void
-MarkCrossCompartmentObject(JSTracer *trc, JSObject &obj, const char *name);
+MarkObjectUnbarriered(JSTracer *trc, JSObject *obj, const char *name);
 
 void
-MarkObjectWithPrinter(JSTracer *trc, JSObject &obj, JSTraceNamePrinter printer,
-		      const void *arg, size_t index);
+MarkObject(JSTracer *trc, const MarkablePtr<JSObject> &obj, const char *name);
 
 void
-MarkScript(JSTracer *trc, JSScript *script, const char *name);
+MarkStringUnbarriered(JSTracer *trc, JSString *str, const char *name);
 
 void
-MarkShape(JSTracer *trc, const Shape *shape, const char *name);
+MarkString(JSTracer *trc, const MarkablePtr<JSString> &str, const char *name);
 
 void
-MarkTypeObject(JSTracer *trc, types::TypeObject *type, const char *name);
+MarkScriptUnbarriered(JSTracer *trc, JSScript *script, const char *name);
 
 void
-MarkXML(JSTracer *trc, JSXML *xml, const char *name);
+MarkScript(JSTracer *trc, const MarkablePtr<JSScript> &script, const char *name);
 
 void
-MarkObjectRange(JSTracer *trc, size_t len, JSObject **vec, const char *name);
+MarkShapeUnbarriered(JSTracer *trc, const Shape *shape, const char *name);
 
 void
-MarkXMLRange(JSTracer *trc, size_t len, JSXML **vec, const char *name);
+MarkShape(JSTracer *trc, const MarkablePtr<const Shape> &shape, const char *name);
 
 void
-MarkId(JSTracer *trc, jsid id);
+MarkTypeObjectUnbarriered(JSTracer *trc, types::TypeObject *type, const char *name);
 
 void
-MarkId(JSTracer *trc, jsid id, const char *name);
+MarkTypeObject(JSTracer *trc, const MarkablePtr<types::TypeObject> &type, const char *name);
 
 void
-MarkIdRange(JSTracer *trc, jsid *beg, jsid *end, const char *name);
+MarkXMLUnbarriered(JSTracer *trc, JSXML *xml, const char *name);
 
 void
-MarkIdRange(JSTracer *trc, size_t len, jsid *vec, const char *name);
+MarkXML(JSTracer *trc, const MarkablePtr<JSXML> &xml, const char *name);
+
+void
+MarkObjectRange(JSTracer *trc, size_t len, HeapPtr<JSObject> *vec, const char *name);
+
+void
+MarkXMLRange(JSTracer *trc, size_t len, HeapPtr<JSXML> *vec, const char *name);
+
+void
+MarkId(JSTracer *trc, const HeapId &id, const char *name);
+
+void
+MarkIdRange(JSTracer *trc, js::HeapId *beg, js::HeapId *end, const char *name);
+
+void
+MarkIdRangeUnbarriered(JSTracer *trc, size_t len, jsid *vec, const char *name);
+
+void
+MarkIdRangeUnbarriered(JSTracer *trc, jsid *beg, jsid *end, const char *name);
 
 void
 MarkKind(JSTracer *trc, void *thing, JSGCTraceKind kind);
 
 void
-MarkValueRaw(JSTracer *trc, const js::Value &v);
+MarkValueUnbarriered(JSTracer *trc, const js::Value &v, const char *name);
 
 void
-MarkValue(JSTracer *trc, const js::Value &v, const char *name);
+MarkValue(JSTracer *trc, const js::HeapValue &v, const char *name);
 
 /*
  * Mark a value that may be in a different compartment from the compartment
  * being GC'd. (Although it won't be marked if it's in the wrong compartment.)
  */
 void
-MarkCrossCompartmentValue(JSTracer *trc, const js::Value &v, const char *name);
+MarkCrossCompartmentValue(JSTracer *trc, const js::HeapValue &v, const char *name);
 
 void
-MarkValueRange(JSTracer *trc, const Value *beg, const Value *end, const char *name);
+MarkValueRange(JSTracer *trc, const HeapValue *beg, const HeapValue *end, const char *name);
 
 void
-MarkValueRange(JSTracer *trc, size_t len, const Value *vec, const char *name);
-
-void
-MarkShapeRange(JSTracer *trc, const Shape **beg, const Shape **end, const char *name);
-
-void
-MarkShapeRange(JSTracer *trc, size_t len, const Shape **vec, const char *name);
-
-/* N.B. Assumes JS_SET_TRACING_NAME/INDEX has already been called. */
-void
-MarkGCThing(JSTracer *trc, void *thing, uint32 kind);
-
-void
-MarkGCThing(JSTracer *trc, void *thing);
-
-void
-MarkGCThing(JSTracer *trc, void *thing, const char *name);
-
-void
-MarkGCThing(JSTracer *trc, void *thing, const char *name, size_t index);
-
-void
-Mark(JSTracer *trc, void *thing, uint32 kind, const char *name);
+MarkValueRange(JSTracer *trc, size_t len, const HeapValue *vec, const char *name);
 
 void
 MarkRoot(JSTracer *trc, JSObject *thing, const char *name);
@@ -163,6 +151,33 @@ MarkRoot(JSTracer *trc, types::TypeObject *thing, const char *name);
 void
 MarkRoot(JSTracer *trc, JSXML *thing, const char *name);
 
+void
+MarkRoot(JSTracer *trc, const Value &v, const char *name);
+
+void
+MarkRoot(JSTracer *trc, jsid id, const char *name);
+
+void
+MarkRootGCThing(JSTracer *trc, void *thing, const char *name);
+
+void
+MarkRootRange(JSTracer *trc, size_t len, const Shape **vec, const char *name);
+
+void
+MarkRootRange(JSTracer *trc, size_t len, JSObject **vec, const char *name);
+
+void
+MarkRootRange(JSTracer *trc, const Value *beg, const Value *end, const char *name);
+
+void
+MarkRootRange(JSTracer *trc, size_t len, const Value *vec, const char *name);
+
+void
+MarkRootRange(JSTracer *trc, jsid *beg, jsid *end, const char *name);
+
+void
+MarkRootRange(JSTracer *trc, size_t len, jsid *vec, const char *name);
+
 void
 MarkChildren(JSTracer *trc, JSObject *obj);
 
@@ -184,22 +199,22 @@ MarkChildren(JSTracer *trc, JSXML *xml);
  * the corresponding Mark/IsMarked function.
  */
 inline void
-Mark(JSTracer *trc, const js::Value &v, const char *name)
+Mark(JSTracer *trc, const js::HeapValue &v, const char *name)
 {
     MarkValue(trc, v, name);
 }
 
 inline void
-Mark(JSTracer *trc, JSObject *o, const char *name)
+Mark(JSTracer *trc, const MarkablePtr<JSObject> &o, const char *name)
 {
-    MarkObject(trc, *o, name);
+    MarkObject(trc, o, name);
 }
 
 inline bool
 IsMarked(JSContext *cx, const js::Value &v)
 {
     if (v.isMarkable())
-        return !IsAboutToBeFinalized(cx, v.toGCThing());
+        return !IsAboutToBeFinalized(cx, v);
     return true;
 }
 
@@ -215,7 +230,14 @@ IsMarked(JSContext *cx, Cell *cell)
     return !IsAboutToBeFinalized(cx, cell);
 }
 
-}
-}
+} /* namespace gc */
+
+void
+TraceChildren(JSTracer *trc, void *thing, JSGCTraceKind kind);
+
+void
+CallTracer(JSTracer *trc, void *thing, JSGCTraceKind kind);
+
+} /* namespace js */
 
 #endif
diff --git a/js/src/jsgcstats.cpp b/js/src/jsgcstats.cpp
index 9c0b1bb44b9f..0d7ebb6f8444 100644
--- a/js/src/jsgcstats.cpp
+++ b/js/src/jsgcstats.cpp
@@ -47,6 +47,7 @@
 #include "jscompartment.h"
 
 #include "jsgcinlines.h"
+#include "jsobjinlines.h"
 
 using namespace mozilla;
 using namespace js;
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 49a0402a3c27..4a0ba8ff0699 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -474,6 +474,33 @@ TypeSet::print(JSContext *cx)
     }
 }
 
+bool
+TypeSet::propertyNeedsBarrier(JSContext *cx, jsid id)
+{
+    id = MakeTypeId(cx, id);
+
+    if (unknownObject())
+        return true;
+
+    for (unsigned i = 0; i < getObjectCount(); i++) {
+        if (getSingleObject(i))
+            return true;
+
+        if (types::TypeObject *otype = getTypeObject(i)) {
+            if (otype->unknownProperties())
+                return true;
+
+            if (types::TypeSet *propTypes = otype->maybeGetProperty(cx, id)) {
+                if (propTypes->needsBarrier(cx))
+                    return true;
+            }
+        }
+    }
+
+    addFreeze(cx);
+    return false;
+}
+
 /////////////////////////////////////////////////////////////////////
 // TypeSet constraints
 /////////////////////////////////////////////////////////////////////
@@ -1919,6 +1946,17 @@ TypeSet::hasGlobalObject(JSContext *cx, JSObject *global)
     return true;
 }
 
+bool
+TypeSet::needsBarrier(JSContext *cx)
+{
+    bool result = unknownObject()
+               || getObjectCount() > 0
+               || hasAnyFlag(TYPE_FLAG_STRING);
+    if (!result)
+        addFreeze(cx);
+    return result;
+}
+
 /////////////////////////////////////////////////////////////////////
 // TypeCompartment
 /////////////////////////////////////////////////////////////////////
@@ -2546,7 +2584,7 @@ struct types::ObjectTableKey
     typedef JSObject * Lookup;
 
     static inline uint32 hash(JSObject *obj) {
-        return (uint32) (JSID_BITS(obj->lastProperty()->propid) ^
+        return (uint32) (JSID_BITS(obj->lastProperty()->propid.get()) ^
                          obj->slotSpan() ^ obj->numFixedSlots() ^
                          ((uint32)(size_t)obj->getProto() >> 2));
     }
@@ -3084,8 +3122,10 @@ TypeObject::clearNewScript(JSContext *cx)
         }
     }
 
-    cx->free_(newScript);
+    /* We NULL out newScript *before* freeing it so the write barrier works. */
+    TypeNewScript *savedNewScript = newScript;
     newScript = NULL;
+    cx->free_(savedNewScript);
 
     markStateChange(cx);
 }
@@ -3389,6 +3429,8 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
       case JSOP_LOOKUPSWITCH:
       case JSOP_LOOKUPSWITCHX:
       case JSOP_TRY:
+      case JSOP_LABEL:
+      case JSOP_LABELX:
         break;
 
         /* Bytecodes pushing values of known type. */
@@ -4738,7 +4780,7 @@ CheckNewScriptProperties(JSContext *cx, TypeObject *type, JSFunction *fun)
     type->newScript->shape = baseobj->lastProperty();
 
     type->newScript->initializerList = (TypeNewScript::Initializer *)
-        ((char *) type->newScript + sizeof(TypeNewScript));
+        ((char *) type->newScript.get() + sizeof(TypeNewScript));
     PodCopy(type->newScript->initializerList, initializerList.begin(), initializerList.length());
 }
 
@@ -5199,8 +5241,8 @@ TypeScript::SetScope(JSContext *cx, JSScript *script, JSObject *scope)
         if (!SetScope(cx, parent, scope->getParent()))
             return false;
         parent->nesting()->activeCall = scope;
-        parent->nesting()->argArray = call.argArray();
-        parent->nesting()->varArray = call.varArray();
+        parent->nesting()->argArray = Valueify(call.argArray());
+        parent->nesting()->varArray = Valueify(call.varArray());
     }
 
     JS_ASSERT(!script->types->nesting);
@@ -5717,7 +5759,7 @@ JSObject::makeNewType(JSContext *cx, JSFunction *fun, bool unknown)
     if (!type)
         return;
 
-    newType = type;
+    newType.init(type);
     setDelegate();
 
     if (!cx->typeInferenceEnabled())
@@ -6262,7 +6304,7 @@ JS_GetTypeInferenceObjectStats(void *object_, TypeInferenceMemoryStats *stats, J
     if (object->emptyShapes) {
         size_t usable = usf(object->emptyShapes);
         stats->emptyShapes +=
-            usable ? usable : sizeof(EmptyShape*) * gc::FINALIZE_FUNCTION_AND_OBJECT_LAST;
+            usable ? usable : sizeof(EmptyShape*) * gc::FINALIZE_OBJECT_LIMIT;
     }
 
     /*
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 0f60a6a5a1ce..b760af2b8675 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -48,6 +48,7 @@
 #include "jsprvtd.h"
 
 #include "ds/LifoAlloc.h"
+#include "gc/Barrier.h"
 #include "js/HashTable.h"
 
 namespace js {
@@ -508,6 +509,15 @@ class TypeSet
 
     inline void clearObjects();
 
+    /*
+     * Whether a location with this TypeSet needs a write barrier (i.e., whether
+     * it can hold GC things). The type set is frozen if no barrier is needed.
+     */
+    bool needsBarrier(JSContext *cx);
+
+    /* The type set is frozen if no barrier is needed. */
+    bool propertyNeedsBarrier(JSContext *cx, jsid id);
+
   private:
     uint32 baseObjectCount() const {
         return (flags & TYPE_FLAG_OBJECT_COUNT_MASK) >> TYPE_FLAG_OBJECT_COUNT_SHIFT;
@@ -621,18 +631,13 @@ struct TypeBarrier
 struct Property
 {
     /* Identifier for this property, JSID_VOID for the aggregate integer index property. */
-    jsid id;
+    HeapId id;
 
     /* Possible types for this property, including types inherited from prototypes. */
     TypeSet types;
 
-    Property(jsid id)
-        : id(id)
-    {}
-
-    Property(const Property &o)
-        : id(o.id), types(o.types)
-    {}
+    inline Property(jsid id);
+    inline Property(const Property &o);
 
     static uint32 keyBits(jsid id) { return (uint32) JSID_BITS(id); }
     static jsid getKey(Property *p) { return p->id; }
@@ -650,7 +655,7 @@ struct Property
  */
 struct TypeNewScript
 {
-    JSFunction *fun;
+    HeapPtrFunction fun;
 
     /* Allocation kind to use for newly constructed objects. */
     gc::AllocKind allocKind;
@@ -659,7 +664,7 @@ struct TypeNewScript
      * Shape to use for newly constructed objects. Reflects all definite
      * properties the object will have.
      */
-    const Shape *shape;
+    HeapPtr<const Shape> shape;
 
     /*
      * Order in which properties become initialized. We need this in case a
@@ -682,6 +687,9 @@ struct TypeNewScript
         {}
     };
     Initializer *initializerList;
+
+    static inline void writeBarrierPre(TypeNewScript *newScript);
+    static inline void writeBarrierPost(TypeNewScript *newScript, void *addr);
 };
 
 /*
@@ -714,17 +722,17 @@ struct TypeNewScript
 struct TypeObject : gc::Cell
 {
     /* Prototype shared by objects using this type. */
-    JSObject *proto;
+    HeapPtrObject proto;
 
     /*
      * Whether there is a singleton JS object with this type. That JS object
      * must appear in type sets instead of this; we include the back reference
      * here to allow reverting the JS object to a lazy type.
      */
-    JSObject *singleton;
+    HeapPtrObject singleton;
 
     /* Lazily filled array of empty shapes for each size of objects with this type. */
-    js::EmptyShape **emptyShapes;
+    HeapPtr<EmptyShape> *emptyShapes;
 
     /* Flags for this object. */
     TypeObjectFlags flags;
@@ -734,7 +742,7 @@ struct TypeObject : gc::Cell
      * 'new' on the specified script, which adds some number of properties to
      * the object in a definite order before the object escapes.
      */
-    TypeNewScript *newScript;
+    HeapPtr<TypeNewScript> newScript;
 
     /*
      * Estimate of the contribution of this object to the type sets it appears in.
@@ -783,7 +791,7 @@ struct TypeObject : gc::Cell
     Property **propertySet;
 
     /* If this is an interpreted function, the function object. */
-    JSFunction *interpretedFunction;
+    HeapPtrFunction interpretedFunction;
 
     inline TypeObject(JSObject *proto, bool isFunction, bool unknown);
 
@@ -868,6 +876,9 @@ struct TypeObject : gc::Cell
      */
     void finalize(JSContext *cx) {}
 
+    static inline void writeBarrierPre(TypeObject *type);
+    static inline void writeBarrierPost(TypeObject *type, void *addr);
+
   private:
     inline uint32 basePropertyCount() const;
     inline void setBasePropertyCount(uint32 count);
@@ -984,8 +995,8 @@ struct TypeScriptNesting
      * these fields can be embedded directly in JIT code (though remember to
      * use 'addDependency == true' when calling resolveNameAccess).
      */
-    Value *argArray;
-    Value *varArray;
+    const Value *argArray;
+    const Value *varArray;
 
     /* Number of frames for this function on the stack. */
     uint32 activeFrames;
@@ -1010,7 +1021,7 @@ class TypeScript
     analyze::ScriptAnalysis *analysis;
 
     /* Function for the script, if it has one. */
-    JSFunction *function;
+    HeapPtrFunction function;
 
     /*
      * Information about the scope in which a script executes. This information
@@ -1020,7 +1031,7 @@ class TypeScript
     static const size_t GLOBAL_MISSING_SCOPE = 0x1;
 
     /* Global object for the script, if compileAndGo. */
-    js::GlobalObject *global;
+    HeapPtr<GlobalObject> global;
 
   public:
 
@@ -1030,12 +1041,10 @@ class TypeScript
     /* Dynamic types generated at points within this script. */
     TypeResult *dynamicList;
 
-    TypeScript(JSFunction *fun) {
-        this->function = fun;
-        this->global = (js::GlobalObject *) GLOBAL_MISSING_SCOPE;
-    }
+    inline TypeScript(JSFunction *fun);
+    inline ~TypeScript();
 
-    bool hasScope() { return size_t(global) != GLOBAL_MISSING_SCOPE; }
+    bool hasScope() { return size_t(global.get()) != GLOBAL_MISSING_SCOPE; }
 
     /* Array of type type sets for variables and JOF_TYPESET ops. */
     TypeSet *typeArray() { return (TypeSet *) (jsuword(this) + sizeof(TypeScript)); }
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index ea93a3ece8fd..dbec2891ab1f 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -71,7 +71,7 @@ Type::ObjectType(JSObject *obj)
 Type::ObjectType(TypeObject *obj)
 {
     if (obj->singleton)
-        return Type((jsuword) obj->singleton | 1);
+        return Type((jsuword) obj->singleton.get() | 1);
     return Type((jsuword) obj);
 }
 
@@ -459,6 +459,18 @@ UseNewTypeAtEntry(JSContext *cx, StackFrame *fp)
 // Script interface functions
 /////////////////////////////////////////////////////////////////////
 
+inline
+TypeScript::TypeScript(JSFunction *fun)
+  : function(fun),
+    global((js::GlobalObject *) GLOBAL_MISSING_SCOPE)
+{
+}
+
+inline
+TypeScript::~TypeScript()
+{
+}
+
 /* static */ inline unsigned
 TypeScript::NumTypeSets(JSScript *script)
 {
@@ -689,9 +701,9 @@ void
 TypeScript::trace(JSTracer *trc)
 {
     if (function)
-        gc::MarkObject(trc, *function, "script_fun");
+        gc::MarkObject(trc, function, "script_fun");
     if (hasScope() && global)
-        gc::MarkObject(trc, *global, "script_global");
+        gc::MarkObject(trc, global, "script_global");
 
     /* Note: nesting does not keep anything alive. */
 }
@@ -1252,6 +1264,56 @@ TypeObject::getGlobal()
     return NULL;
 }
 
+inline void
+TypeObject::writeBarrierPre(TypeObject *type)
+{
+#ifdef JSGC_INCREMENTAL
+    if (!type || type == &js::types::emptyTypeObject)
+        return;
+
+    JSCompartment *comp = type->compartment();
+    if (comp->needsBarrier())
+        MarkTypeObjectUnbarriered(comp->barrierTracer(), type, "write barrier");
+#endif
+}
+
+inline void
+TypeObject::writeBarrierPost(TypeObject *type, void *addr)
+{
+}
+
+inline void
+TypeNewScript::writeBarrierPre(TypeNewScript *newScript)
+{
+#ifdef JSGC_INCREMENTAL
+    if (!newScript)
+        return;
+
+    JSCompartment *comp = newScript->fun->compartment();
+    if (comp->needsBarrier()) {
+        MarkObjectUnbarriered(comp->barrierTracer(), newScript->fun, "write barrier");
+        MarkShapeUnbarriered(comp->barrierTracer(), newScript->shape, "write barrier");
+    }
+#endif
+}
+
+inline void
+TypeNewScript::writeBarrierPost(TypeNewScript *newScript, void *addr)
+{
+}
+
+inline
+Property::Property(jsid id)
+  : id(id)
+{
+}
+
+inline
+Property::Property(const Property &o)
+  : id(o.id.get()), types(o.types)
+{
+}
+
 } } /* namespace js::types */
 
 inline bool
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index d6be08b110f5..c97d0498ac1c 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -452,8 +452,8 @@ const uint32 JSSLOT_SAVED_ID        = 1;
 static void
 no_such_method_trace(JSTracer *trc, JSObject *obj)
 {
-    gc::MarkValue(trc, obj->getSlot(JSSLOT_FOUND_FUNCTION), "found function");
-    gc::MarkValue(trc, obj->getSlot(JSSLOT_SAVED_ID), "saved id");
+    gc::MarkValue(trc, obj->getSlotRef(JSSLOT_FOUND_FUNCTION), "found function");
+    gc::MarkValue(trc, obj->getSlotRef(JSSLOT_SAVED_ID), "saved id");
 }
 
 Class js_NoSuchMethodClass = {
@@ -1332,7 +1332,7 @@ js::FindUpvarFrame(JSContext *cx, uintN targetLevel)
 #define POP_COPY_TO(v)           v = *--regs.sp
 #define POP_RETURN_VALUE()       regs.fp()->setReturnValue(*--regs.sp)
 
-#define POP_BOOLEAN(cx, vp, b)                                                \
+#define VALUE_TO_BOOLEAN(cx, vp, b)                                           \
     JS_BEGIN_MACRO                                                            \
         vp = &regs.sp[-1];                                                    \
         if (vp->isNull()) {                                                   \
@@ -1342,9 +1342,10 @@ js::FindUpvarFrame(JSContext *cx, uintN targetLevel)
         } else {                                                              \
             b = !!js_ValueToBoolean(*vp);                                     \
         }                                                                     \
-        regs.sp--;                                                            \
     JS_END_MACRO
 
+#define POP_BOOLEAN(cx, vp, b)   do { VALUE_TO_BOOLEAN(cx, vp, b); regs.sp--; } while(0)
+
 #define VALUE_TO_OBJECT(cx, vp, obj)                                          \
     JS_BEGIN_MACRO                                                            \
         if ((vp)->isObject()) {                                               \
@@ -1589,17 +1590,14 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
 #endif
     JSAutoResolveFlags rf(cx, RESOLVE_INFER);
 
+    gc::VerifyBarriers(cx, true);
+
     JS_ASSERT(!cx->compartment->activeAnalysis);
 
-#define ENABLE_PCCOUNT_INTERRUPTS()     JS_BEGIN_MACRO                        \
-                                            if (pcCounts)                     \
-                                                ENABLE_INTERRUPTS();          \
-                                        JS_END_MACRO
-
 #if JS_THREADED_INTERP
-#define CHECK_PCCOUNT_INTERRUPTS() JS_ASSERT_IF(pcCounts, jumpTable == interruptJumpTable)
+#define CHECK_PCCOUNT_INTERRUPTS() JS_ASSERT_IF(script->pcCounters, jumpTable == interruptJumpTable)
 #else
-#define CHECK_PCCOUNT_INTERRUPTS() JS_ASSERT_IF(pcCounts, switchMask == -1)
+#define CHECK_PCCOUNT_INTERRUPTS() JS_ASSERT_IF(script->pcCounters, switchMask == -1)
 #endif
 
     /*
@@ -1635,6 +1633,7 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
 # define DO_OP()            JS_BEGIN_MACRO                                    \
                                 CHECK_RECORDER();                             \
                                 CHECK_PCCOUNT_INTERRUPTS();                   \
+                                js::gc::VerifyBarriers(cx);                   \
                                 JS_EXTENSION_(goto *jumpTable[op]);           \
                             JS_END_MACRO
 # define DO_NEXT_OP(n)      JS_BEGIN_MACRO                                    \
@@ -1777,8 +1776,6 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
 #define RESTORE_INTERP_VARS()                                                 \
     JS_BEGIN_MACRO                                                            \
         SET_SCRIPT(regs.fp()->script());                                      \
-        pcCounts = script->pcCounters.get(JSPCCounters::INTERP);              \
-        ENABLE_PCCOUNT_INTERRUPTS();                                          \
         argv = regs.fp()->maybeFormalArgs();                                  \
         atoms = FrameAtomBase(cx, regs.fp());                                 \
         JS_ASSERT(&cx->regs() == &regs);                                      \
@@ -1816,6 +1813,8 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
         script = (s);                                                         \
         if (script->stepModeEnabled())                                        \
             ENABLE_INTERRUPTS();                                              \
+        if (script->pcCounters)                                             \
+            ENABLE_INTERRUPTS();                                              \
     JS_END_MACRO
 
 #define CHECK_INTERRUPT_HANDLER()                                             \
@@ -1838,8 +1837,6 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
     JSRuntime *const rt = cx->runtime;
     JSScript *script;
     SET_SCRIPT(regs.fp()->script());
-    double *pcCounts = script->pcCounters.get(JSPCCounters::INTERP);
-    ENABLE_PCCOUNT_INTERRUPTS();
     Value *argv = regs.fp()->maybeFormalArgs();
     CHECK_INTERRUPT_HANDLER();
 
@@ -1966,6 +1963,7 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
       do_op:
         CHECK_RECORDER();
         CHECK_PCCOUNT_INTERRUPTS();
+        js::gc::VerifyBarriers(cx);
         switchOp = intN(op) | switchMask;
       do_switch:
         switch (switchOp) {
@@ -1980,9 +1978,11 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
     {
         bool moreInterrupts = false;
 
-        if (pcCounts) {
-            if (!regs.fp()->hasImacropc())
-                ++pcCounts[regs.pc - script->code];
+        if (script->pcCounters) {
+            if (!regs.fp()->hasImacropc()) {
+                OpcodeCounts counts = script->getCounts(regs.pc);
+                counts.get(OpcodeCounts::BASE_INTERP)++;
+            }
             moreInterrupts = true;
         }
 
@@ -2089,6 +2089,12 @@ BEGIN_CASE(JSOP_NOTRACE)
     /* No-op */
 END_CASE(JSOP_TRACE)
 
+BEGIN_CASE(JSOP_LABEL)
+END_CASE(JSOP_LABEL)
+
+BEGIN_CASE(JSOP_LABELX)
+END_CASE(JSOP_LABELX)
+
 check_backedge:
 {
     CHECK_BRANCH();
@@ -2320,11 +2326,10 @@ END_CASE(JSOP_IFNE)
 BEGIN_CASE(JSOP_OR)
 {
     bool cond;
-    Value *vp;
-    POP_BOOLEAN(cx, vp, cond);
+    Value *_;
+    VALUE_TO_BOOLEAN(cx, _, cond);
     if (cond == true) {
         len = GET_JUMP_OFFSET(regs.pc);
-        PUSH_COPY(*vp);
         DO_NEXT_OP(len);
     }
 }
@@ -2333,11 +2338,10 @@ END_CASE(JSOP_OR)
 BEGIN_CASE(JSOP_AND)
 {
     bool cond;
-    Value *vp;
-    POP_BOOLEAN(cx, vp, cond);
+    Value *_;
+    VALUE_TO_BOOLEAN(cx, _, cond);
     if (cond == false) {
         len = GET_JUMP_OFFSET(regs.pc);
-        PUSH_COPY(*vp);
         DO_NEXT_OP(len);
     }
 }
@@ -2380,11 +2384,10 @@ END_CASE(JSOP_IFNEX)
 BEGIN_CASE(JSOP_ORX)
 {
     bool cond;
-    Value *vp;
-    POP_BOOLEAN(cx, vp, cond);
+    Value *_;
+    VALUE_TO_BOOLEAN(cx, _, cond);
     if (cond == true) {
         len = GET_JUMPX_OFFSET(regs.pc);
-        PUSH_COPY(*vp);
         DO_NEXT_OP(len);
     }
 }
@@ -2393,11 +2396,10 @@ END_CASE(JSOP_ORX)
 BEGIN_CASE(JSOP_ANDX)
 {
     bool cond;
-    Value *vp;
-    POP_BOOLEAN(cx, vp, cond);
+    Value *_;
+    VALUE_TO_BOOLEAN(cx, _, cond);
     if (cond == JS_FALSE) {
         len = GET_JUMPX_OFFSET(regs.pc);
-        PUSH_COPY(*vp);
         DO_NEXT_OP(len);
     }
 }
@@ -4467,9 +4469,6 @@ BEGIN_CASE(JSOP_CALLFCSLOT)
 }
 END_CASE(JSOP_GETFCSLOT)
 
-BEGIN_CASE(JSOP_UNUSED0)
-BEGIN_CASE(JSOP_UNUSED1)
-
 BEGIN_CASE(JSOP_DEFCONST)
 BEGIN_CASE(JSOP_DEFVAR)
 {
@@ -6128,6 +6127,7 @@ END_CASE(JSOP_ARRAYPUSH)
   leave_on_safe_point:
 #endif
 
+    gc::VerifyBarriers(cx, true);
     return interpReturnOK;
 
   atom_not_defined:
diff --git a/js/src/jsiter.cpp b/js/src/jsiter.cpp
index 9f870259f002..0d90780c17ed 100644
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -124,7 +124,7 @@ NativeIterator::mark(JSTracer *trc)
 {
     MarkIdRange(trc, begin(), end(), "props");
     if (obj)
-        MarkObject(trc, *obj, "obj");
+        MarkObject(trc, obj, "obj");
 }
 
 static void
@@ -134,8 +134,8 @@ iterator_finalize(JSContext *cx, JSObject *obj)
 
     NativeIterator *ni = obj->getNativeIterator();
     if (ni) {
+        obj->setPrivate(NULL);
         cx->free_(ni);
-        obj->setNativeIterator(NULL);
     }
 }
 
@@ -337,7 +337,9 @@ js::VectorToIdArray(JSContext *cx, AutoIdVector &props, JSIdArray **idap)
         return false;
 
     ida->length = static_cast<jsint>(len);
-    memcpy(ida->vector, props.begin(), idsz);
+    jsid *v = props.begin();
+    for (jsint i = 0; i < ida->length; i++)
+        ida->vector[i].init(v[i]);
     *idap = ida;
     return true;
 }
@@ -441,17 +443,19 @@ NativeIterator::allocateIterator(JSContext *cx, uint32 slength, const AutoIdVect
         cx->malloc_(sizeof(NativeIterator) + plength * sizeof(jsid) + slength * sizeof(uint32));
     if (!ni)
         return NULL;
-    ni->props_array = ni->props_cursor = (jsid *) (ni + 1);
-    ni->props_end = (jsid *)ni->props_array + plength;
-    if (plength)
-        memcpy(ni->props_array, props.begin(), plength * sizeof(jsid));
+    ni->props_array = ni->props_cursor = (HeapId *) (ni + 1);
+    ni->props_end = ni->props_array + plength;
+    if (plength) {
+        for (size_t i = 0; i < plength; i++)
+            ni->props_array[i].init(props[i]);
+    }
     return ni;
 }
 
 inline void
 NativeIterator::init(JSObject *obj, uintN flags, uint32 slength, uint32 key)
 {
-    this->obj = obj;
+    this->obj.init(obj);
     this->flags = flags;
     this->shapes_array = (uint32 *) this->props_end;
     this->shapes_length = slength;
@@ -853,9 +857,9 @@ SuppressDeletedPropertyHelper(JSContext *cx, JSObject *obj, IdPredicate predicat
         /* This only works for identified surpressed keys, not values. */
         if (ni->isKeyIter() && ni->obj == obj && ni->props_cursor < ni->props_end) {
             /* Check whether id is still to come. */
-            jsid *props_cursor = ni->current();
-            jsid *props_end = ni->end();
-            for (jsid *idp = props_cursor; idp < props_end; ++idp) {
+            HeapId *props_cursor = ni->current();
+            HeapId *props_end = ni->end();
+            for (HeapId *idp = props_cursor; idp < props_end; ++idp) {
                 if (predicate(*idp)) {
                     /*
                      * Check whether another property along the prototype chain
@@ -894,7 +898,8 @@ SuppressDeletedPropertyHelper(JSContext *cx, JSObject *obj, IdPredicate predicat
                     if (idp == props_cursor) {
                         ni->incCursor();
                     } else {
-                        memmove(idp, idp + 1, (props_end - (idp + 1)) * sizeof(jsid));
+                        for (HeapId *p = idp; p + 1 != props_end; p++)
+                            *p = *(p + 1);
                         ni->props_end = ni->end() - 1;
                     }
 
@@ -1109,6 +1114,37 @@ generator_finalize(JSContext *cx, JSObject *obj)
     cx->free_(gen);
 }
 
+static void
+MarkGenerator(JSTracer *trc, JSGenerator *gen)
+{
+    StackFrame *fp = gen->floatingFrame();
+
+    /*
+     * MarkGenerator should only be called when regs is based on the floating frame.
+     * See calls to RebaseRegsFromTo.
+     */
+    JS_ASSERT(size_t(gen->regs.sp - fp->slots()) <= fp->numSlots());
+
+    /*
+     * Currently, generators are not mjitted. Still, (overflow) args can be
+     * pushed by the mjit and need to be conservatively marked. Technically, the
+     * formal args and generator slots are safe for exact marking, but since the
+     * plan is to eventually mjit generators, it makes sense to future-proof
+     * this code and save someone an hour later.
+     */
+    MarkStackRangeConservatively(trc, gen->floatingStack, fp->formalArgsEnd());
+    js_TraceStackFrame(trc, fp);
+    MarkStackRangeConservatively(trc, fp->slots(), gen->regs.sp);
+}
+
+static void
+GeneratorWriteBarrierPre(JSContext *cx, JSGenerator *gen)
+{
+    JSCompartment *comp = cx->compartment;
+    if (comp->needsBarrier())
+        MarkGenerator(comp->barrierTracer(), gen);
+}
+
 static void
 generator_trace(JSTracer *trc, JSObject *obj)
 {
@@ -1123,19 +1159,8 @@ generator_trace(JSTracer *trc, JSObject *obj)
     if (gen->state == JSGEN_RUNNING || gen->state == JSGEN_CLOSING)
         return;
 
-    StackFrame *fp = gen->floatingFrame();
-    JS_ASSERT(gen->liveFrame() == fp);
-
-    /*
-     * Currently, generators are not mjitted. Still, (overflow) args can be
-     * pushed by the mjit and need to be conservatively marked. Technically, the
-     * formal args and generator slots are safe for exact marking, but since the
-     * plan is to eventually mjit generators, it makes sense to future-proof
-     * this code and save someone an hour later.
-     */
-    MarkStackRangeConservatively(trc, gen->floatingStack, fp->formalArgsEnd());
-    js_TraceStackFrame(trc, fp);
-    MarkStackRangeConservatively(trc, fp->slots(), gen->regs.sp);
+    JS_ASSERT(gen->liveFrame() == gen->floatingFrame());
+    MarkGenerator(trc, gen);
 }
 
 Class js::GeneratorClass = {
@@ -1209,7 +1234,7 @@ js_NewGenerator(JSContext *cx)
     StackFrame *genfp = reinterpret_cast<StackFrame *>(genvp + vplen);
 
     /* Initialize JSGenerator. */
-    gen->obj = obj;
+    gen->obj.init(obj);
     gen->state = JSGEN_NEWBORN;
     gen->enumerators = NULL;
     gen->floating = genfp;
@@ -1258,6 +1283,19 @@ SendToGenerator(JSContext *cx, JSGeneratorOp op, JSObject *obj,
     if (!cx->ensureGeneratorStackSpace())
         return JS_FALSE;
 
+    /*
+     * Write barrier is needed since the generator stack can be updated,
+     * and it's not barriered in any other way. We need to do it before
+     * gen->state changes, which can cause us to trace the generator
+     * differently.
+     *
+     * We could optimize this by setting a bit on the generator to signify
+     * that it has been marked. If this bit has already been set, there is no
+     * need to mark again. The bit would have to be reset before the next GC,
+     * or else some kind of epoch scheme would have to be used.
+     */
+    GeneratorWriteBarrierPre(cx, gen);
+
     JS_ASSERT(gen->state == JSGEN_NEWBORN || gen->state == JSGEN_OPEN);
     switch (op) {
       case JSGENOP_NEXT:
diff --git a/js/src/jsiter.h b/js/src/jsiter.h
index b7396c615f18..5cf2bcdccc72 100644
--- a/js/src/jsiter.h
+++ b/js/src/jsiter.h
@@ -48,6 +48,7 @@
 #include "jspubtd.h"
 #include "jsversion.h"
 
+#include "gc/Barrier.h"
 #include "vm/Stack.h"
 
 /*
@@ -60,10 +61,10 @@
 namespace js {
 
 struct NativeIterator {
-    JSObject  *obj;
-    jsid      *props_array;
-    jsid      *props_cursor;
-    jsid      *props_end;
+    HeapPtrObject  obj;
+    HeapId    *props_array;
+    HeapId    *props_cursor;
+    HeapId    *props_end;
     uint32    *shapes_array;
     uint32    shapes_length;
     uint32    shapes_key;
@@ -72,11 +73,11 @@ struct NativeIterator {
 
     bool isKeyIter() const { return (flags & JSITER_FOREACH) == 0; }
 
-    inline jsid *begin() const {
+    inline HeapId *begin() const {
         return props_array;
     }
 
-    inline jsid *end() const {
+    inline HeapId *end() const {
         return props_end;
     }
 
@@ -84,7 +85,7 @@ struct NativeIterator {
         return end() - begin();
     }
 
-    jsid *current() const {
+    HeapId *current() const {
         JS_ASSERT(props_cursor < props_end);
         return props_cursor;
     }
@@ -170,7 +171,7 @@ typedef enum JSGeneratorState {
 } JSGeneratorState;
 
 struct JSGenerator {
-    JSObject            *obj;
+    js::HeapPtrObject   obj;
     JSGeneratorState    state;
     js::FrameRegs       regs;
     JSObject            *enumerators;
diff --git a/js/src/jskeyword.tbl b/js/src/jskeyword.tbl
index 01933d2e3b5c..447fbfb2f35f 100644
--- a/js/src/jskeyword.tbl
+++ b/js/src/jskeyword.tbl
@@ -38,13 +38,9 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-/*
- * Keywords used as primary expressions, sharing the TOK_PRIMARY token kind,
- * distinguished by opcode.
- */
-JS_KEYWORD(false,       TOK_PRIMARY,    JSOP_FALSE,     JSVERSION_DEFAULT)
-JS_KEYWORD(true,        TOK_PRIMARY,    JSOP_TRUE,      JSVERSION_DEFAULT)
-JS_KEYWORD(null,        TOK_PRIMARY,    JSOP_NULL,      JSVERSION_DEFAULT)
+JS_KEYWORD(false,       TOK_FALSE,      JSOP_FALSE,     JSVERSION_DEFAULT)
+JS_KEYWORD(true,        TOK_TRUE,       JSOP_TRUE,      JSVERSION_DEFAULT)
+JS_KEYWORD(null,        TOK_NULL,       JSOP_NULL,      JSVERSION_DEFAULT)
 
 /* ES5 Keywords. */
 JS_KEYWORD(break,       TOK_BREAK,      JSOP_NOP,       JSVERSION_DEFAULT)
@@ -65,12 +61,12 @@ JS_KEYWORD(instanceof,  TOK_INSTANCEOF, JSOP_INSTANCEOF,JSVERSION_DEFAULT)
 JS_KEYWORD(new,         TOK_NEW,        JSOP_NEW,       JSVERSION_DEFAULT)
 JS_KEYWORD(return,      TOK_RETURN,     JSOP_NOP,       JSVERSION_DEFAULT)
 JS_KEYWORD(switch,      TOK_SWITCH,     JSOP_NOP,       JSVERSION_DEFAULT)
-JS_KEYWORD(this,        TOK_PRIMARY,    JSOP_THIS,      JSVERSION_DEFAULT)
+JS_KEYWORD(this,        TOK_THIS,       JSOP_THIS,      JSVERSION_DEFAULT)
 JS_KEYWORD(throw,       TOK_THROW,      JSOP_NOP,       JSVERSION_DEFAULT)
 JS_KEYWORD(try,         TOK_TRY,        JSOP_NOP,       JSVERSION_DEFAULT)
-JS_KEYWORD(typeof,      TOK_UNARYOP,    JSOP_TYPEOF,    JSVERSION_DEFAULT)
+JS_KEYWORD(typeof,      TOK_TYPEOF,     JSOP_TYPEOF,    JSVERSION_DEFAULT)
 JS_KEYWORD(var,         TOK_VAR,        JSOP_DEFVAR,    JSVERSION_DEFAULT)
-JS_KEYWORD(void,        TOK_UNARYOP,    JSOP_VOID,      JSVERSION_DEFAULT)
+JS_KEYWORD(void,        TOK_VOID,       JSOP_VOID,      JSVERSION_DEFAULT)
 JS_KEYWORD(while,       TOK_WHILE,      JSOP_NOP,       JSVERSION_DEFAULT)
 JS_KEYWORD(with,        TOK_WITH,       JSOP_NOP,       JSVERSION_DEFAULT)
 
diff --git a/js/src/jslock.cpp b/js/src/jslock.cpp
index 013bb3f4a39f..44ff1da73f55 100644
--- a/js/src/jslock.cpp
+++ b/js/src/jslock.cpp
@@ -61,6 +61,8 @@
 #include "jsscope.h"
 #include "jsstr.h"
 
+#include "jsscopeinlines.h"
+
 using namespace js;
 
 #define ReadWord(W) (W)
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 8b240da5a9b9..1b5ad439aa3c 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -463,7 +463,7 @@ js_LeaveSharpObject(JSContext *cx, JSIdArray **idap)
 static intN
 gc_sharp_table_entry_marker(JSHashEntry *he, intN i, void *arg)
 {
-    MarkObject((JSTracer *)arg, *(JSObject *)he->key, "sharp table entry");
+    MarkRoot((JSTracer *)arg, (JSObject *)he->key, "sharp table entry");
     return JS_DHASH_NEXT;
 }
 
@@ -1061,8 +1061,8 @@ EvalCacheLookup(JSContext *cx, JSLinearString *str, StackFrame *caller, uintN st
                     if (i < 0 ||
                         objarray->vector[i]->getParent() == &scopeobj) {
                         JS_ASSERT(staticLevel == script->staticLevel);
-                        *scriptp = script->u.evalHashLink;
-                        script->u.evalHashLink = NULL;
+                        *scriptp = script->evalHashLink();
+                        script->evalHashLink() = NULL;
                         return script;
                     }
                 }
@@ -1071,7 +1071,7 @@ EvalCacheLookup(JSContext *cx, JSLinearString *str, StackFrame *caller, uintN st
 
         if (++count == EVAL_CACHE_CHAIN_LIMIT)
             return NULL;
-        scriptp = &script->u.evalHashLink;
+        scriptp = &script->evalHashLink();
     }
     return NULL;
 }
@@ -1085,7 +1085,7 @@ EvalCacheLookup(JSContext *cx, JSLinearString *str, StackFrame *caller, uintN st
  * a jsdbgapi user's perspective, we want each eval() to create and destroy a
  * script. This hides implementation details and means we don't have to deal
  * with calls to JS_GetScriptObject for scripts in the eval cache (currently,
- * script->u.object aliases script->u.evalHashLink).
+ * script->object aliases script->evalHashLink()).
  */
 class EvalScriptGuard
 {
@@ -1107,7 +1107,7 @@ class EvalScriptGuard
             js_CallDestroyScriptHook(cx_, script_);
             script_->isActiveEval = false;
             script_->isCachedEval = true;
-            script_->u.evalHashLink = *bucket_;
+            script_->evalHashLink() = *bucket_;
             *bucket_ = script_;
         }
     }
@@ -3004,7 +3004,7 @@ CreateThisForFunctionWithType(JSContext *cx, types::TypeObject *type, JSObject *
         gc::AllocKind kind = type->newScript->allocKind;
         JSObject *res = NewObjectWithType(cx, type, parent, kind);
         if (res)
-            res->setMap((Shape *) type->newScript->shape);
+            res->initMap((Shape *) type->newScript->shape.get());
         return res;
     }
 
@@ -3504,7 +3504,7 @@ js_NewWithObject(JSContext *cx, JSObject *proto, JSObject *parent, jsint depth)
     if (!emptyWithShape)
         return NULL;
 
-    obj->setMap(emptyWithShape);
+    obj->initMap(emptyWithShape);
     OBJ_SET_BLOCK_DEPTH(cx, obj, depth);
 
     AutoObjectRooter tvr(cx, obj);
@@ -3533,7 +3533,7 @@ js_NewBlockObject(JSContext *cx)
     if (!emptyBlockShape)
         return NULL;
     blockObj->init(cx, &BlockClass, &emptyTypeObject, NULL, NULL, false);
-    blockObj->setMap(emptyBlockShape);
+    blockObj->initMap(emptyBlockShape);
 
     return blockObj;
 }
@@ -3591,7 +3591,7 @@ js_PutBlockObject(JSContext *cx, JSBool normalUnwind)
     if (normalUnwind) {
         uintN slot = JSSLOT_BLOCK_FIRST_FREE_SLOT;
         depth += fp->numFixed();
-        obj->copySlotRange(slot, fp->slots() + depth, count);
+        obj->copySlotRange(slot, fp->slots() + depth, count, true);
     }
 
     /* We must clear the private slot even with errors. */
@@ -3794,8 +3794,8 @@ struct JSObject::TradeGutsReserved {
     JSContext *cx;
     Vector<Value> avals;
     Vector<Value> bvals;
-    Value *newaslots;
-    Value *newbslots;
+    HeapValue *newaslots;
+    HeapValue *newbslots;
 
     TradeGutsReserved(JSContext *cx)
         : cx(cx), avals(cx), bvals(cx), newaslots(NULL), newbslots(NULL)
@@ -3843,12 +3843,12 @@ JSObject::ReserveForTradeGuts(JSContext *cx, JSObject *a, JSObject *b,
     unsigned bfixed = b->numFixedSlots();
 
     if (afixed < bcap) {
-        reserved.newaslots = (Value *) cx->malloc_(sizeof(Value) * (bcap - afixed));
+        reserved.newaslots = (HeapValue *) cx->malloc_(sizeof(HeapValue) * (bcap - afixed));
         if (!reserved.newaslots)
             return false;
     }
     if (bfixed < acap) {
-        reserved.newbslots = (Value *) cx->malloc_(sizeof(Value) * (acap - bfixed));
+        reserved.newbslots = (HeapValue *) cx->malloc_(sizeof(HeapValue) * (acap - bfixed));
         if (!reserved.newbslots)
             return false;
     }
@@ -3885,6 +3885,19 @@ JSObject::TradeGuts(JSContext *cx, JSObject *a, JSObject *b, TradeGutsReserved &
     JS_ASSERT(!a->isDenseArray() && !b->isDenseArray());
     JS_ASSERT(!a->isArrayBuffer() && !b->isArrayBuffer());
 
+#ifdef JSGC_INCREMENTAL
+    /*
+     * We need a write barrier here. If |a| was marked and |b| was not, then
+     * after the swap, |b|'s guts would never be marked. The write barrier
+     * solves this.
+     */
+    JSCompartment *comp = a->compartment();
+    if (comp->needsBarrier()) {
+        MarkChildren(comp->barrierTracer(), a);
+        MarkChildren(comp->barrierTracer(), b);
+    }
+#endif
+
     /* New types for a JSObject need to be stable when trading guts. */
     TypeObject *newTypeA = a->newType;
     TypeObject *newTypeB = b->newType;
@@ -3938,7 +3951,7 @@ JSObject::TradeGuts(JSContext *cx, JSObject *a, JSObject *b, TradeGutsReserved &
         unsigned afixed = a->numFixedSlots();
         unsigned bfixed = b->numFixedSlots();
 
-        JSObject tmp;
+        char tmp[sizeof(JSObject)];
         memcpy(&tmp, a, sizeof tmp);
         memcpy(a, b, sizeof tmp);
         memcpy(b, &tmp, sizeof tmp);
@@ -3946,13 +3959,13 @@ JSObject::TradeGuts(JSContext *cx, JSObject *a, JSObject *b, TradeGutsReserved &
         a->updateFixedSlots(afixed);
         a->slots = reserved.newaslots;
         a->capacity = Max(afixed, bcap);
-        a->copySlotRange(0, reserved.bvals.begin(), bcap);
+        a->copySlotRange(0, reserved.bvals.begin(), bcap, false);
         a->clearSlotRange(bcap, a->capacity - bcap);
 
         b->updateFixedSlots(bfixed);
         b->slots = reserved.newbslots;
         b->capacity = Max(bfixed, acap);
-        b->copySlotRange(0, reserved.avals.begin(), acap);
+        b->copySlotRange(0, reserved.avals.begin(), acap, false);
         b->clearSlotRange(acap, b->capacity - acap);
 
         /* Make sure the destructor for reserved doesn't free the slots. */
@@ -4448,27 +4461,31 @@ JSObject::clearSlotRange(size_t start, size_t length)
 {
     JS_ASSERT(start + length <= capacity);
     if (isDenseArray()) {
-        ClearValueRange(slots + start, length, true);
+        ClearValueRange(compartment(), slots + start, length, true);
     } else {
         size_t fixed = numFixedSlots();
         if (start < fixed) {
             if (start + length < fixed) {
-                ClearValueRange(fixedSlots() + start, length, false);
+                ClearValueRange(compartment(), fixedSlots() + start, length, false);
             } else {
                 size_t localClear = fixed - start;
-                ClearValueRange(fixedSlots() + start, localClear, false);
-                ClearValueRange(slots, length - localClear, false);
+                ClearValueRange(compartment(), fixedSlots() + start, localClear, false);
+                ClearValueRange(compartment(), slots, length - localClear, false);
             }
         } else {
-            ClearValueRange(slots + start - fixed, length, false);
+            ClearValueRange(compartment(), slots + start - fixed, length, false);
         }
     }
 }
 
 void
-JSObject::copySlotRange(size_t start, const Value *vector, size_t length)
+JSObject::copySlotRange(size_t start, const Value *vector, size_t length, bool valid)
 {
     JS_ASSERT(start + length <= capacity);
+
+    if (valid)
+        prepareSlotRangeForOverwrite(start, start + length);
+
     if (isDenseArray()) {
         memcpy(slots + start, vector, length * sizeof(Value));
     } else {
@@ -4522,7 +4539,7 @@ JSObject::allocSlots(JSContext *cx, size_t newcap)
 
     uint32 allocCount = numDynamicSlots(newcap);
 
-    Value *tmpslots = (Value*) cx->malloc_(allocCount * sizeof(Value));
+    HeapValue *tmpslots = (HeapValue*) cx->malloc_(allocCount * sizeof(HeapValue));
     if (!tmpslots)
         return false;  /* Leave slots at inline buffer. */
     slots = tmpslots;
@@ -4530,12 +4547,12 @@ JSObject::allocSlots(JSContext *cx, size_t newcap)
 
     if (isDenseArray()) {
         /* Copy over anything from the inline buffer. */
-        memcpy(slots, fixedSlots(), getDenseArrayInitializedLength() * sizeof(Value));
+        memcpy(slots, fixedSlots(), getDenseArrayInitializedLength() * sizeof(HeapValue));
         if (!cx->typeInferenceEnabled())
             backfillDenseArrayHoles(cx);
     } else {
         /* Clear out the new slots without copying. */
-        ClearValueRange(slots, allocCount, false);
+        InitValueRange(slots, allocCount, false);
     }
 
     Probes::resizeObject(cx, this, oldSize, slotsAndStructSize());
@@ -4592,8 +4609,8 @@ JSObject::growSlots(JSContext *cx, size_t newcap)
     uint32 oldAllocCount = numDynamicSlots(oldcap);
     uint32 allocCount = numDynamicSlots(actualCapacity);
 
-    Value *tmpslots = (Value*) cx->realloc_(slots, oldAllocCount * sizeof(Value),
-                                            allocCount * sizeof(Value));
+    HeapValue *tmpslots = (HeapValue*) cx->realloc_(slots, oldAllocCount * sizeof(HeapValue),
+                                                    allocCount * sizeof(HeapValue));
     if (!tmpslots)
         return false;    /* Leave dslots as its old size. */
 
@@ -4606,7 +4623,7 @@ JSObject::growSlots(JSContext *cx, size_t newcap)
             backfillDenseArrayHoles(cx);
     } else {
         /* Clear the new slots we added. */
-        ClearValueRange(slots + oldAllocCount, allocCount - oldAllocCount, false);
+        InitValueRange(slots + oldAllocCount, allocCount - oldAllocCount, false);
     }
 
     if (changed && isGlobal())
@@ -4629,6 +4646,8 @@ JSObject::shrinkSlots(JSContext *cx, size_t newcap)
     if (isCall())
         return;
 
+    JS_ASSERT_IF(isDenseArray(), initializedLength() <= newcap);
+
     uint32 oldcap = numSlots();
     JS_ASSERT(newcap <= oldcap);
     JS_ASSERT(newcap >= slotSpan());
@@ -4650,7 +4669,7 @@ JSObject::shrinkSlots(JSContext *cx, size_t newcap)
     newcap = Max(newcap, size_t(SLOT_CAPACITY_MIN));
     newcap = Max(newcap, numFixedSlots());
 
-    Value *tmpslots = (Value*) cx->realloc_(slots, newcap * sizeof(Value));
+    HeapValue *tmpslots = (HeapValue*) cx->realloc_(slots, newcap * sizeof(HeapValue));
     if (!tmpslots)
         return;  /* Leave slots at its old size. */
 
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index 91cb9c4b955f..645da327946b 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -59,6 +59,7 @@
 #include "jslock.h"
 #include "jscell.h"
 
+#include "gc/Barrier.h"
 #include "vm/String.h"
 
 namespace nanojit { class ValidateWriter; }
@@ -427,7 +428,7 @@ struct JSObject : js::gc::Cell {
      * Private pointer to the last added property and methods to manipulate the
      * list it links among properties in this scope.
      */
-    js::Shape           *lastProp;
+    js::HeapPtrShape    lastProp;
 
   private:
     js::Class           *clasp;
@@ -488,25 +489,25 @@ struct JSObject : js::gc::Cell {
         NSLOTS_LIMIT    = JS_BIT(NSLOTS_BITS)
     };
 
-    uint32      flags;                      /* flags */
-    uint32      objShape;                   /* copy of lastProp->shape, or override if different */
+    uint32            flags;                /* flags */
+    uint32            objShape;             /* copy of lastProp->shape, or override if different */
 
-    union {
-        /* If prototype, type of values using this as their prototype. */
-        js::types::TypeObject *newType;
+    /*
+     * If prototype, type of values using this as their prototype. If a dense
+     * array, this holds the initialized length (see jsarray.cpp).
+     */
+    js::HeapPtr<js::types::TypeObject, jsuword> newType;
 
-        /* If dense array, the initialized length (see jsarray.cpp). */
-        jsuword initializedLength;
-    };
+    jsuword &initializedLength() { return *newType.unsafeGetUnioned(); }
 
     JS_FRIEND_API(size_t) sizeOfSlotsArray(JSUsableSizeFun usf);
 
-    JSObject    *parent;                    /* object's parent */
-    void        *privateData;               /* private data */
-    jsuword     capacity;                   /* total number of available slots */
+    js::HeapPtrObject parent;               /* object's parent */
+    void              *privateData;         /* private data */
+    jsuword           capacity;             /* total number of available slots */
 
   private:
-    js::Value   *slots;                     /* dynamically allocated slots,
+    js::HeapValue     *slots;               /* dynamically allocated slots,
                                                or pointer to fixedSlots() for
                                                dense arrays. */
 
@@ -515,13 +516,12 @@ struct JSObject : js::gc::Cell {
      * set, this is the prototype's default 'new' type and can only be used
      * to get that prototype.
      */
-    js::types::TypeObject *type_;
+    js::HeapPtr<js::types::TypeObject> type_;
 
     /* Make the type object to use for LAZY_TYPE objects. */
     void makeLazyType(JSContext *cx);
 
   public:
-
     inline bool isNative() const;
     inline bool isNewborn() const;
 
@@ -537,7 +537,6 @@ struct JSObject : js::gc::Cell {
         return &getClass()->ops;
     }
 
-    inline void trace(JSTracer *trc);
     inline void scanSlots(js::GCMarker *gcmarker);
 
     uint32 shape() const {
@@ -617,6 +616,7 @@ struct JSObject : js::gc::Cell {
 
     bool hasOwnShape() const    { return !!(flags & OWN_SHAPE); }
 
+    inline void initMap(js::Shape *amap);
     inline void setMap(js::Shape *amap);
 
     inline void setSharedNonNativeMap();
@@ -730,13 +730,14 @@ struct JSObject : js::gc::Cell {
     static inline size_t getFixedSlotOffset(size_t slot);
     static inline size_t offsetOfCapacity() { return offsetof(JSObject, capacity); }
     static inline size_t offsetOfSlots() { return offsetof(JSObject, slots); }
+    static inline size_t offsetOfInitializedLength() { return offsetof(JSObject, newType); }
 
     /*
      * Get a raw pointer to the object's slots, or a slot of the object given
      * a previous value for its since-reallocated dynamic slots.
      */
-    inline const js::Value *getRawSlots();
-    inline const js::Value *getRawSlot(size_t slot, const js::Value *slots);
+    inline const js::HeapValue *getRawSlots();
+    inline const js::HeapValue *getRawSlot(size_t slot, const js::HeapValue *slots);
 
     /* Whether a slot is at a fixed offset from this object. */
     inline bool isFixedSlot(size_t slot);
@@ -753,7 +754,7 @@ struct JSObject : js::gc::Cell {
     inline size_t numDynamicSlots(size_t capacity) const;
 
   private:
-    inline js::Value* fixedSlots() const;
+    inline js::HeapValue *fixedSlots() const;
 
   protected:
     inline bool hasContiguousSlots(size_t start, size_t count) const;
@@ -772,6 +773,12 @@ struct JSObject : js::gc::Cell {
         return true;
     }
 
+    /*
+     * Trigger the write barrier on a range of slots that will no longer be
+     * reachable.
+     */
+    inline void prepareSlotRangeForOverwrite(size_t start, size_t end);
+
     /*
      * Fill a range of slots with holes or undefined, depending on whether this
      * is a dense array.
@@ -780,9 +787,11 @@ struct JSObject : js::gc::Cell {
 
     /*
      * Copy a flat array of slots to this object at a start slot. Caller must
-     * ensure there are enough slots in this object.
+     * ensure there are enough slots in this object. If |valid|, then the slots
+     * being overwritten hold valid data and must be invalidated for the write
+     * barrier.
      */
-    void copySlotRange(size_t start, const js::Value *vector, size_t length);
+    void copySlotRange(size_t start, const js::Value *vector, size_t length, bool valid);
 
     /*
      * Ensure that the object has at least JSCLASS_RESERVED_SLOTS(clasp) +
@@ -817,12 +826,13 @@ struct JSObject : js::gc::Cell {
 
     void rollbackProperties(JSContext *cx, uint32 slotSpan);
 
-    js::Value *getSlotAddress(uintN slot) {
+    js::HeapValue *getSlotAddress(uintN slot) {
         /*
          * This can be used to get the address of the end of the slots for the
          * object, which may be necessary when fetching zero-length arrays of
          * slots (e.g. for callObjVarArray).
          */
+        JS_ASSERT(!isDenseArray());
         JS_ASSERT(slot <= capacity);
         size_t fixed = numFixedSlots();
         if (slot < fixed)
@@ -830,12 +840,12 @@ struct JSObject : js::gc::Cell {
         return slots + (slot - fixed);
     }
 
-    js::Value &getSlotRef(uintN slot) {
+    js::HeapValue &getSlotRef(uintN slot) {
         JS_ASSERT(slot < capacity);
         return *getSlotAddress(slot);
     }
 
-    inline js::Value &nativeGetSlotRef(uintN slot);
+    inline js::HeapValue &nativeGetSlotRef(uintN slot);
 
     const js::Value &getSlot(uintN slot) const {
         JS_ASSERT(slot < capacity);
@@ -847,22 +857,22 @@ struct JSObject : js::gc::Cell {
 
     inline const js::Value &nativeGetSlot(uintN slot) const;
 
-    void setSlot(uintN slot, const js::Value &value) {
-        JS_ASSERT(slot < capacity);
-        getSlotRef(slot) = value;
-    }
+    inline void setSlot(uintN slot, const js::Value &value);
+    inline void initSlot(uintN slot, const js::Value &value);
+    inline void initSlotUnchecked(uintN slot, const js::Value &value);
 
     inline void nativeSetSlot(uintN slot, const js::Value &value);
     inline void nativeSetSlotWithType(JSContext *cx, const js::Shape *shape, const js::Value &value);
 
     inline js::Value getReservedSlot(uintN index) const;
+    inline js::HeapValue &getReservedSlotRef(uintN index);
 
     /* Call this only after the appropriate ensure{Class,Instance}ReservedSlots call. */
     inline void setReservedSlot(uintN index, const js::Value &v);
 
     /* For slots which are known to always be fixed, due to the way they are allocated. */
 
-    js::Value &getFixedSlotRef(uintN slot) {
+    js::HeapValue &getFixedSlotRef(uintN slot) {
         JS_ASSERT(slot < numFixedSlots());
         return fixedSlots()[slot];
     }
@@ -872,10 +882,8 @@ struct JSObject : js::gc::Cell {
         return fixedSlots()[slot];
     }
 
-    void setFixedSlot(uintN slot, const js::Value &value) {
-        JS_ASSERT(slot < numFixedSlots());
-        fixedSlots()[slot] = value;
-    }
+    inline void setFixedSlot(uintN slot, const js::Value &value);
+    inline void initFixedSlot(uintN slot, const js::Value &value);
 
     /* Defined in jsscopeinlines.h to avoid including implementation dependencies here. */
     inline void updateShape(JSContext *cx);
@@ -912,7 +920,7 @@ struct JSObject : js::gc::Cell {
         return type_;
     }
 
-    js::types::TypeObject *typeFromGC() const {
+    const js::HeapPtr<js::types::TypeObject> &typeFromGC() const {
         /* Direct field access for use by GC. */
         return type_;
     }
@@ -921,13 +929,14 @@ struct JSObject : js::gc::Cell {
 
     inline void clearType();
     inline void setType(js::types::TypeObject *newType);
+    inline void initType(js::types::TypeObject *newType);
 
     inline js::types::TypeObject *getNewType(JSContext *cx, JSFunction *fun = NULL,
                                              bool markUnknown = false);
   private:
     void makeNewType(JSContext *cx, JSFunction *fun, bool markUnknown);
-  public:
 
+  public:
     /* Set a new prototype for an object with a singleton type. */
     bool splicePrototype(JSContext *cx, JSObject *proto);
 
@@ -945,18 +954,9 @@ struct JSObject : js::gc::Cell {
         return parent;
     }
 
-    void clearParent() {
-        parent = NULL;
-    }
-
-    void setParent(JSObject *newParent) {
-#ifdef DEBUG
-        for (JSObject *obj = newParent; obj; obj = obj->getParent())
-            JS_ASSERT(obj != this);
-#endif
-        setDelegateNullSafe(newParent);
-        parent = newParent;
-    }
+    inline void clearParent();
+    inline void setParent(JSObject *newParent);
+    inline void initParent(JSObject *newParent);
 
     JS_FRIEND_API(js::GlobalObject *) getGlobal() const;
 
@@ -971,10 +971,8 @@ struct JSObject : js::gc::Cell {
         return privateData;
     }
 
-    void setPrivate(void *data) {
-        JS_ASSERT(getClass()->flags & JSCLASS_HAS_PRIVATE);
-        privateData = data;
-    }
+    inline void initPrivate(void *data);
+    inline void setPrivate(void *data);
 
     /* N.B. Infallible: NULL means 'no principal', not an error. */
     inline JSPrincipals *principals(JSContext *cx);
@@ -1043,11 +1041,14 @@ struct JSObject : js::gc::Cell {
     inline void setDenseArrayInitializedLength(uint32 length);
     inline void ensureDenseArrayInitializedLength(JSContext *cx, uintN index, uintN extra);
     inline void backfillDenseArrayHoles(JSContext *cx);
-    inline const js::Value* getDenseArrayElements();
+    inline js::HeapValueArray getDenseArrayElements();
     inline const js::Value &getDenseArrayElement(uintN idx);
     inline void setDenseArrayElement(uintN idx, const js::Value &val);
+    inline void initDenseArrayElement(uintN idx, const js::Value &val);
     inline void setDenseArrayElementWithType(JSContext *cx, uintN idx, const js::Value &val);
+    inline void initDenseArrayElementWithType(JSContext *cx, uintN idx, const js::Value &val);
     inline void copyDenseArrayElements(uintN dstStart, const js::Value *src, uintN count);
+    inline void initDenseArrayElements(uintN dstStart, const js::Value *src, uintN count);
     inline void moveDenseArrayElements(uintN dstStart, uintN srcStart, uintN count);
     inline void shrinkDenseArrayElements(JSContext *cx, uintN cap);
     inline bool denseArrayHasInlineSlots() const;
@@ -1156,11 +1157,11 @@ struct JSObject : js::gc::Cell {
 
     inline JSFunction *getFunctionPrivate() const;
 
-    inline js::Value *getFlatClosureUpvars() const;
+    inline js::FlatClosureData *getFlatClosureData() const;
     inline js::Value getFlatClosureUpvar(uint32 i) const;
     inline const js::Value &getFlatClosureUpvar(uint32 i);
     inline void setFlatClosureUpvar(uint32 i, const js::Value &v);
-    inline void setFlatClosureUpvars(js::Value *upvars);
+    inline void setFlatClosureData(js::FlatClosureData *data);
 
     /* See comments in fun_finalize. */
     inline void finalizeUpvarsIfFlatClosure();
@@ -1240,12 +1241,7 @@ struct JSObject : js::gc::Cell {
     inline bool isCallable();
 
     /* Do initialization required immediately after allocation. */
-    void earlyInit(jsuword capacity) {
-        this->capacity = capacity;
-
-        /* Stops obj from being scanned until initializated. */
-        lastProp = NULL;
-    }
+    inline void earlyInit(jsuword capacity);
 
     /* The map field is not initialized here and should be set separately. */
     void init(JSContext *cx, js::Class *aclasp, js::types::TypeObject *type,
@@ -1503,6 +1499,11 @@ struct JSObject : js::gc::Cell {
     /*** For jit compiler: ***/
 
     static size_t offsetOfClassPointer() { return offsetof(JSObject, clasp); }
+
+    static inline void writeBarrierPre(JSObject *obj);
+    static inline void writeBarrierPost(JSObject *obj, void *addr);
+    inline void privateWriteBarrierPre(void **oldval);
+    inline void privateWriteBarrierPost(void **oldval);
 };
 
 /*
@@ -1522,9 +1523,10 @@ operator!=(const JSObject &lhs, const JSObject &rhs)
     return &lhs != &rhs;
 }
 
-inline js::Value*
-JSObject::fixedSlots() const {
-    return (js::Value*) (jsuword(this) + sizeof(JSObject));
+inline js::HeapValue*
+JSObject::fixedSlots() const
+{
+    return (js::HeapValue *) (jsuword(this) + sizeof(JSObject));
 }
 
 inline size_t
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 1611a41b1e84..f19d9e332db8 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1,4 +1,4 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sw=4 et tw=99:
  *
  * ***** BEGIN LICENSE BLOCK *****
@@ -42,9 +42,11 @@
 #define jsobjinlines_h___
 
 #include <new>
+
 #include "jsarray.h"
 #include "jsdate.h"
 #include "jsfun.h"
+#include "jsgcmark.h"
 #include "jsiter.h"
 #include "jslock.h"
 #include "jsobj.h"
@@ -65,6 +67,8 @@
 #include "jsscriptinlines.h"
 #include "jsstr.h"
 
+#include "gc/Barrier.h"
+#include "js/TemplateLib.h"
 #include "vm/GlobalObject.h"
 
 #include "jsatominlines.h"
@@ -72,6 +76,9 @@
 #include "jsgcinlines.h"
 #include "jsscopeinlines.h"
 
+#include "gc/Barrier-inl.h"
+#include "vm/String-inl.h"
+
 inline bool
 JSObject::preventExtensions(JSContext *cx, js::AutoIdVector *props)
 {
@@ -277,7 +284,7 @@ inline void
 JSObject::initCall(JSContext *cx, const js::Bindings &bindings, JSObject *parent)
 {
     init(cx, &js::CallClass, &js::types::emptyTypeObject, parent, NULL, false);
-    lastProp = bindings.lastShape();
+    lastProp.init(bindings.lastShape());
 
     /*
      * If |bindings| is for a function that has extensible parents, that means
@@ -317,7 +324,8 @@ JSObject::initClonedBlock(JSContext *cx, js::types::TypeObject *type, js::StackF
  * also need unique shapes. See js::Bindings::extensibleParents.
  */
 inline void
-JSObject::setBlockOwnShape(JSContext *cx) {
+JSObject::setBlockOwnShape(JSContext *cx)
+{
     JS_ASSERT(isStaticBlock());
     setOwnShape(js_GenerateShape(cx));
 }
@@ -397,15 +405,15 @@ JSObject::methodWriteBarrier(JSContext *cx, uint32 slot, const js::Value &v)
     return true;
 }
 
-inline const js::Value *
+inline const js::HeapValue *
 JSObject::getRawSlots()
 {
     JS_ASSERT(isGlobal());
     return slots;
 }
 
-inline const js::Value *
-JSObject::getRawSlot(size_t slot, const js::Value *slots)
+inline const js::HeapValue *
+JSObject::getRawSlot(size_t slot, const js::HeapValue *slots)
 {
     JS_ASSERT(isGlobal());
     size_t fixed = numFixedSlots();
@@ -447,6 +455,13 @@ JSObject::getReservedSlot(uintN index) const
     return (index < numSlots()) ? getSlot(index) : js::UndefinedValue();
 }
 
+inline js::HeapValue &
+JSObject::getReservedSlotRef(uintN index)
+{
+    JS_ASSERT(index < numSlots());
+    return getSlotRef(index);
+}
+
 inline void
 JSObject::setReservedSlot(uintN index, const js::Value &v)
 {
@@ -493,6 +508,19 @@ JSObject::hasContiguousSlots(size_t start, size_t count) const
     return (start + count <= numFixedSlots()) || (start >= numFixedSlots());
 }
 
+inline void
+JSObject::prepareSlotRangeForOverwrite(size_t start, size_t end)
+{
+    if (isDenseArray()) {
+        JS_ASSERT(end <= initializedLength());
+        for (size_t i = start; i < end; i++)
+            slots[i].js::HeapValue::~HeapValue();
+    } else {
+        for (size_t i = start; i < end; i++)
+            getSlotRef(i).js::HeapValue::~HeapValue();
+    }
+}
+
 inline size_t
 JSObject::structSize() const
 {
@@ -541,7 +569,7 @@ JSObject::setArrayLength(JSContext *cx, uint32 length)
                                      js::types::Type::DoubleType());
     }
 
-    setPrivate((void*)(uintptr_t) length);
+    privateData = (void*)(uintptr_t) length;
 }
 
 inline void
@@ -550,7 +578,7 @@ JSObject::setDenseArrayLength(uint32 length)
     /* Variant of setArrayLength for use on dense arrays where the length cannot overflow int32. */
     JS_ASSERT(isDenseArray());
     JS_ASSERT(length <= INT32_MAX);
-    setPrivate((void*)(uintptr_t) length);
+    privateData = (void*)(uintptr_t) length;
 }
 
 inline uint32
@@ -560,11 +588,11 @@ JSObject::getDenseArrayCapacity()
     return numSlots();
 }
 
-inline const js::Value *
+inline js::HeapValueArray
 JSObject::getDenseArrayElements()
 {
     JS_ASSERT(isDenseArray());
-    return slots;
+    return js::HeapValueArray(slots);
 }
 
 inline const js::Value &
@@ -581,6 +609,13 @@ JSObject::setDenseArrayElement(uintN idx, const js::Value &val)
     slots[idx] = val;
 }
 
+inline void
+JSObject::initDenseArrayElement(uintN idx, const js::Value &val)
+{
+    JS_ASSERT(isDenseArray() && idx < getDenseArrayInitializedLength());
+    slots[idx].init(val);
+}
+
 inline void
 JSObject::setDenseArrayElementWithType(JSContext *cx, uintN idx, const js::Value &val)
 {
@@ -588,8 +623,24 @@ JSObject::setDenseArrayElementWithType(JSContext *cx, uintN idx, const js::Value
     setDenseArrayElement(idx, val);
 }
 
+inline void
+JSObject::initDenseArrayElementWithType(JSContext *cx, uintN idx, const js::Value &val)
+{
+    js::types::AddTypePropertyId(cx, this, JSID_VOID, val);
+    initDenseArrayElement(idx, val);
+}
+
 inline void
 JSObject::copyDenseArrayElements(uintN dstStart, const js::Value *src, uintN count)
+{
+    JS_ASSERT(isDenseArray());
+    JS_ASSERT(dstStart + count <= capacity);
+    prepareSlotRangeForOverwrite(dstStart, dstStart + count);
+    memcpy(slots + dstStart, src, count * sizeof(js::Value));
+}
+
+inline void
+JSObject::initDenseArrayElements(uintN dstStart, const js::Value *src, uintN count)
 {
     JS_ASSERT(isDenseArray());
     JS_ASSERT(dstStart + count <= capacity);
@@ -602,6 +653,21 @@ JSObject::moveDenseArrayElements(uintN dstStart, uintN srcStart, uintN count)
     JS_ASSERT(isDenseArray());
     JS_ASSERT(dstStart + count <= capacity);
     JS_ASSERT(srcStart + count <= capacity);
+
+    /*
+     * Use a custom write barrier here since it's performance sensitive. We
+     * only want to barrier the slots that are being overwritten.
+     */
+    uintN markStart, markEnd;
+    if (dstStart > srcStart) {
+        markStart = js::Max(srcStart + count, dstStart);
+        markEnd = dstStart + count;
+    } else {
+        markStart = dstStart;
+        markEnd = js::Min(dstStart + count, srcStart);
+    }
+    prepareSlotRangeForOverwrite(markStart, markEnd);
+
     memmove(slots + dstStart, slots + srcStart, count * sizeof(js::Value));
 }
 
@@ -647,15 +713,15 @@ JSObject::setDateUTCTime(const js::Value &time)
     setFixedSlot(JSSLOT_DATE_UTC_TIME, time);
 }
 
-inline js::Value *
-JSObject::getFlatClosureUpvars() const
+inline js::FlatClosureData *
+JSObject::getFlatClosureData() const
 {
 #ifdef DEBUG
     JSFunction *fun = getFunctionPrivate();
     JS_ASSERT(fun->isFlatClosure());
     JS_ASSERT(fun->script()->bindings.countUpvars() == fun->script()->upvars()->length);
 #endif
-    return (js::Value *) getFixedSlot(JSSLOT_FLAT_CLOSURE_UPVARS).toPrivate();
+    return (js::FlatClosureData *) getFixedSlot(JSSLOT_FLAT_CLOSURE_UPVARS).toPrivate();
 }
 
 inline void
@@ -693,29 +759,29 @@ inline js::Value
 JSObject::getFlatClosureUpvar(uint32 i) const
 {
     JS_ASSERT(i < getFunctionPrivate()->script()->bindings.countUpvars());
-    return getFlatClosureUpvars()[i];
+    return getFlatClosureData()->upvars[i];
 }
 
 inline const js::Value &
 JSObject::getFlatClosureUpvar(uint32 i)
 {
     JS_ASSERT(i < getFunctionPrivate()->script()->bindings.countUpvars());
-    return getFlatClosureUpvars()[i];
+    return getFlatClosureData()->upvars[i];
 }
 
 inline void
 JSObject::setFlatClosureUpvar(uint32 i, const js::Value &v)
 {
     JS_ASSERT(i < getFunctionPrivate()->script()->bindings.countUpvars());
-    getFlatClosureUpvars()[i] = v;
+    getFlatClosureData()->upvars[i] = v;
 }
 
 inline void
-JSObject::setFlatClosureUpvars(js::Value *upvars)
+JSObject::setFlatClosureData(js::FlatClosureData *data)
 {
     JS_ASSERT(isFunction());
     JS_ASSERT(getFunctionPrivate()->isFlatClosure());
-    setFixedSlot(JSSLOT_FLAT_CLOSURE_UPVARS, js::PrivateValue(upvars));
+    setFixedSlot(JSSLOT_FLAT_CLOSURE_UPVARS, js::PrivateValue(data));
 }
 
 inline bool
@@ -840,7 +906,7 @@ JSObject::getWithThis() const
 inline void
 JSObject::setWithThis(JSObject *thisp)
 {
-    getFixedSlotRef(JSSLOT_WITH_THIS).setObject(*thisp);
+    setFixedSlot(JSSLOT_WITH_THIS, js::ObjectValue(*thisp));
 }
 
 inline bool
@@ -913,6 +979,28 @@ JSObject::setType(js::types::TypeObject *newType)
     type_ = newType;
 }
 
+inline void
+JSObject::earlyInit(jsuword capacity)
+{
+    this->capacity = capacity;
+
+    /* Stops obj from being scanned until initializated. */
+    lastProp.init(NULL);
+}
+
+inline void
+JSObject::initType(js::types::TypeObject *newType)
+{
+#ifdef DEBUG
+    JS_ASSERT(newType);
+    for (JSObject *obj = newType->proto; obj; obj = obj->getProto())
+        JS_ASSERT(obj != this);
+#endif
+    JS_ASSERT_IF(hasSpecialEquality(), newType->hasAnyFlags(js::types::OBJECT_FLAG_SPECIAL_EQUALITY));
+    JS_ASSERT(!hasSingletonType());
+    type_.init(newType);
+}
+
 inline void
 JSObject::init(JSContext *cx, js::Class *aclasp, js::types::TypeObject *type,
                JSObject *parent, void *priv, bool denseArray)
@@ -944,14 +1032,12 @@ JSObject::init(JSContext *cx, js::Class *aclasp, js::types::TypeObject *type,
         slots = fixedSlots();
         flags |= PACKED_ARRAY;
     } else {
-        js::ClearValueRange(fixedSlots(), capacity, denseArray);
+        js::InitValueRange(fixedSlots(), capacity, denseArray);
     }
 
-    newType = NULL;
-    JS_ASSERT(initializedLength == 0);
-
-    setType(type);
-    setParent(parent);
+    newType.init(NULL);
+    initType(type);
+    initParent(parent);
 }
 
 inline void
@@ -977,7 +1063,7 @@ JSObject::initSharingEmptyShape(JSContext *cx,
     if (!empty)
         return false;
 
-    setMap(empty);
+    initMap(empty);
     return true;
 }
 
@@ -1028,7 +1114,15 @@ JSObject::setMap(js::Shape *amap)
     objShape = lastProp->shapeid;
 }
 
-inline js::Value &
+inline void
+JSObject::initMap(js::Shape *amap)
+{
+    JS_ASSERT(!hasOwnShape());
+    lastProp.init(amap);
+    objShape = lastProp->shapeid;
+}
+
+inline js::HeapValue &
 JSObject::nativeGetSlotRef(uintN slot)
 {
     JS_ASSERT(isNative());
@@ -1400,7 +1494,7 @@ class AutoPropertyDescriptorRooter : private AutoGCRooter, public PropertyDescri
     friend void AutoGCRooter::trace(JSTracer *trc);
 };
 
-static inline bool
+static inline js::EmptyShape *
 InitScopeForObject(JSContext* cx, JSObject* obj, js::Class *clasp, js::types::TypeObject *type,
                    gc::AllocKind kind)
 {
@@ -1420,13 +1514,12 @@ InitScopeForObject(JSContext* cx, JSObject* obj, js::Class *clasp, js::types::Ty
     if (!empty)
         goto bad;
 
-    obj->setMap(empty);
-    return true;
+    return empty;
 
   bad:
     /* The GC nulls map initially. It should still be null on error. */
     JS_ASSERT(obj->isNewborn());
-    return false;
+    return NULL;
 }
 
 static inline bool
@@ -1487,9 +1580,8 @@ NewNativeClassInstance(JSContext *cx, Class *clasp, JSObject *proto,
 
         JS_ASSERT(type->canProvideEmptyShape(clasp));
         js::EmptyShape *empty = type->getEmptyShape(cx, clasp, kind);
-
         if (empty)
-            obj->setMap(empty);
+            obj->initMap(empty);
         else
             obj = NULL;
     }
@@ -1660,10 +1752,12 @@ NewObject(JSContext *cx, js::Class *clasp, JSObject *proto, JSObject *parent,
               NULL, clasp == &ArrayClass);
 
     if (clasp->isNative()) {
-        if (!InitScopeForObject(cx, obj, clasp, type, kind)) {
+        js::EmptyShape *empty = InitScopeForObject(cx, obj, clasp, type, kind);
+        if (!empty) {
             obj = NULL;
             goto out;
         }
+        obj->initMap(empty);
     } else {
         obj->setSharedNonNativeMap();
     }
@@ -1749,10 +1843,13 @@ NewObjectWithType(JSContext *cx, types::TypeObject *type, JSObject *parent, gc::
               (!parent && type->proto) ? type->proto->getParent() : parent,
               NULL, false);
 
-    if (!InitScopeForObject(cx, obj, &ObjectClass, type, kind)) {
+    js::EmptyShape *empty;
+    empty = InitScopeForObject(cx, obj, &ObjectClass, type, kind);
+    if (!empty) {
         obj = NULL;
         goto out;
     }
+    obj->initMap(empty);
 
 out:
     Probes::createObject(cx, obj);
@@ -1997,4 +2094,126 @@ js_GetProtoIfDenseArray(JSObject *obj)
     return obj->isDenseArray() ? obj->getProto() : obj;
 }
 
+inline void
+JSObject::setSlot(uintN slot, const js::Value &value)
+{
+    JS_ASSERT(slot < capacity);
+    getSlotRef(slot).set(compartment(), value);
+}
+
+inline void
+JSObject::initSlot(uintN slot, const js::Value &value)
+{
+    JS_ASSERT(getSlot(slot).isUndefined() || getSlot(slot).isMagic(JS_ARRAY_HOLE));
+    initSlotUnchecked(slot, value);
+}
+
+inline void
+JSObject::initSlotUnchecked(uintN slot, const js::Value &value)
+{
+    JS_ASSERT(slot < capacity);
+    getSlotRef(slot).init(value);
+}
+
+inline void
+JSObject::setFixedSlot(uintN slot, const js::Value &value)
+{
+    JS_ASSERT(slot < numFixedSlots());
+    fixedSlots()[slot] = value;
+}
+
+inline void
+JSObject::initFixedSlot(uintN slot, const js::Value &value)
+{
+    JS_ASSERT(slot < numFixedSlots());
+    fixedSlots()[slot].init(value);
+}
+
+inline void
+JSObject::clearParent()
+{
+    parent.clear();
+}
+
+inline void
+JSObject::setParent(JSObject *newParent)
+{
+#ifdef DEBUG
+    for (JSObject *obj = newParent; obj; obj = obj->getParent())
+        JS_ASSERT(obj != this);
+#endif
+    setDelegateNullSafe(newParent);
+    parent = newParent;
+}
+
+inline void
+JSObject::initParent(JSObject *newParent)
+{
+    JS_ASSERT(isNewborn());
+#ifdef DEBUG
+    for (JSObject *obj = newParent; obj; obj = obj->getParent())
+        JS_ASSERT(obj != this);
+#endif
+    setDelegateNullSafe(newParent);
+    parent.init(newParent);
+}
+
+inline void
+JSObject::setPrivate(void *data)
+{
+    JS_ASSERT(getClass()->flags & JSCLASS_HAS_PRIVATE);
+
+    privateWriteBarrierPre(&privateData);
+    privateData = data;
+    privateWriteBarrierPost(&privateData);
+}
+
+inline void
+JSObject::initPrivate(void *data)
+{
+    JS_ASSERT(getClass()->flags & JSCLASS_HAS_PRIVATE);
+    privateData = data;
+}
+
+inline void
+JSObject::privateWriteBarrierPre(void **old)
+{
+#ifdef JSGC_INCREMENTAL
+    JSCompartment *comp = compartment();
+    if (comp->needsBarrier()) {
+        if (clasp->trace && *old)
+            clasp->trace(comp->barrierTracer(), this);
+    }
+#endif
+}
+
+inline void
+JSObject::privateWriteBarrierPost(void **old)
+{
+}
+
+inline void
+JSObject::writeBarrierPre(JSObject *obj)
+{
+#ifdef JSGC_INCREMENTAL
+    /*
+     * This would normally be a null test, but TypeScript::global uses 0x1 as a
+     * special value.
+     */
+    if (uintptr_t(obj) < 32)
+        return;
+
+    JSCompartment *comp = obj->compartment();
+    if (comp->needsBarrier()) {
+        JS_ASSERT(!comp->rt->gcRunning);
+        MarkObjectUnbarriered(comp->barrierTracer(), obj, "write barrier");
+    }
+#endif
+}
+
+inline void
+JSObject::writeBarrierPost(JSObject *obj, void *addr)
+{
+}
+
 #endif /* jsobjinlines_h___ */
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 211103b1e210..1e88b5454052 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -301,8 +301,132 @@ AutoScriptUntrapper::~AutoScriptUntrapper()
     }
 }
 
+static const char * countBaseNames[] = {
+    "interp",
+    "mjit",
+    "mjit_calls",
+    "mjit_code",
+    "mjit_pics"
+};
+
+JS_STATIC_ASSERT(JS_ARRAY_LENGTH(countBaseNames) == OpcodeCounts::BASE_COUNT);
+
+static const char * countAccessNames[] = {
+    "infer_mono",
+    "infer_di",
+    "infer_poly",
+    "infer_barrier",
+    "infer_nobarrier",
+    "observe_undefined",
+    "observe_null",
+    "observe_boolean",
+    "observe_int32",
+    "observe_double",
+    "observe_string",
+    "observe_object"
+};
+
+JS_STATIC_ASSERT(JS_ARRAY_LENGTH(countBaseNames) +
+                 JS_ARRAY_LENGTH(countAccessNames) == OpcodeCounts::ACCESS_COUNT);
+
+static const char * countElementNames[] = {
+    "id_int",
+    "id_double",
+    "id_other",
+    "id_unknown",
+    "elem_typed",
+    "elem_packed",
+    "elem_dense",
+    "elem_other"
+};
+
+JS_STATIC_ASSERT(JS_ARRAY_LENGTH(countBaseNames) +
+                 JS_ARRAY_LENGTH(countAccessNames) +
+                 JS_ARRAY_LENGTH(countElementNames) == OpcodeCounts::ELEM_COUNT);
+
+static const char * countPropertyNames[] = {
+    "prop_static",
+    "prop_definite",
+    "prop_other"
+};
+
+JS_STATIC_ASSERT(JS_ARRAY_LENGTH(countBaseNames) +
+                 JS_ARRAY_LENGTH(countAccessNames) +
+                 JS_ARRAY_LENGTH(countPropertyNames) == OpcodeCounts::PROP_COUNT);
+
+static const char * countArithNames[] = {
+    "arith_int",
+    "arith_double",
+    "arith_other",
+    "arith_unknown",
+};
+
+JS_STATIC_ASSERT(JS_ARRAY_LENGTH(countBaseNames) +
+                 JS_ARRAY_LENGTH(countArithNames) == OpcodeCounts::ARITH_COUNT);
+
+/* static */ const char *
+OpcodeCounts::countName(JSOp op, size_t which)
+{
+    JS_ASSERT(which < numCounts(op));
+
+    if (which < BASE_COUNT)
+        return countBaseNames[which];
+
+    if (accessOp(op)) {
+        if (which < ACCESS_COUNT)
+            return countAccessNames[which - BASE_COUNT];
+        if (elementOp(op))
+            return countElementNames[which - ACCESS_COUNT];
+        if (propertyOp(op))
+            return countPropertyNames[which - ACCESS_COUNT];
+        JS_NOT_REACHED("bad op");
+        return NULL;
+    }
+
+    if (arithOp(op))
+        return countArithNames[which - BASE_COUNT];
+
+    JS_NOT_REACHED("bad op");
+    return NULL;
+}
+
 #ifdef DEBUG
 
+JS_FRIEND_API(void)
+js_DumpPCCounts(JSContext *cx, JSScript *script, js::Sprinter *sp)
+{
+    JS_ASSERT(script->pcCounters);
+
+    jsbytecode *pc = script->code;
+    while (pc < script->code + script->length) {
+        JSOp op = js_GetOpcode(cx, script, pc);
+
+        int len = js_CodeSpec[op].length;
+        jsbytecode *next = (len != -1) ? pc + len : pc + js_GetVariableBytecodeLength(pc);
+
+        if (!js_Disassemble1(cx, script, pc, pc - script->code, true, sp))
+            return;
+
+        size_t total = OpcodeCounts::numCounts(op);
+        double *raw = script->getCounts(pc).rawCounts();
+
+        Sprint(sp, "                  {");
+        bool printed = false;
+        for (size_t i = 0; i < total; i++) {
+            double val = raw[i];
+            if (val) {
+                if (printed)
+                    Sprint(sp, ", ");
+                Sprint(sp, "\"%s\": %.0f", OpcodeCounts::countName(op, i), val);
+                printed = true;
+            }
+        }
+        Sprint(sp, "}\n");
+
+        pc = next;
+    }
+}
+
 /*
  * If pc != NULL, include a prefix indicating whether the PC is at the current line.
  * If counts != NULL, include a counter of the number of times each op was executed.
@@ -314,17 +438,10 @@ js_DisassembleAtPC(JSContext *cx, JSScript *script, JSBool lines, jsbytecode *pc
     uintN len;
 
     SprintCString(sp, "loc   ");
-    if (script->pcCounters)
-        Sprint(sp, "counts%*s x ", COUNTS_LEN - strlen("counts"), "");
     if (lines)
         SprintCString(sp, "line");
     SprintCString(sp, "  op\n");
     SprintCString(sp, "----- ");
-    if (script->pcCounters) {
-        for (int i = 0; i < COUNTS_LEN; ++i)
-            SprintCString(sp, "-");
-        SprintCString(sp, "   ");
-    }
     if (lines)
         SprintCString(sp, "----");
     SprintCString(sp, "  --\n");
@@ -476,21 +593,6 @@ js_Disassemble1(JSContext *cx, JSScript *script, jsbytecode *pc,
     const JSCodeSpec *cs = &js_CodeSpec[op];
     ptrdiff_t len = (ptrdiff_t) cs->length;
     Sprint(sp, "%05u:", loc);
-    if (JSPCCounters &counts = script->pcCounters) {
-        ptrdiff_t start = Sprint(sp, "%.0f", counts.get(0, loc));
-        for (size_t i = 1; i < JSPCCounters::NUM_COUNTERS; ++i)
-            Sprint(sp, "/%.0f", counts.get(i, loc));
-        int l = Sprint(sp, "") - start;
-        if (l < COUNTS_LEN)
-            Sprint(sp, "%*s", COUNTS_LEN - l, "");
-        double mjitHits = counts.get(JSPCCounters::METHODJIT, loc);
-        if (mjitHits) {
-            Sprint(sp, "  %.0f/%.0f",
-                   counts.get(JSPCCounters::METHODJIT_CODE, loc) / mjitHits,
-                   counts.get(JSPCCounters::METHODJIT_PICS, loc) / mjitHits);
-        }
-        Sprint(sp, " x ");
-    }
     if (lines)
         Sprint(sp, "%4u", JS_PCToLineNumber(cx, script, pc));
     Sprint(sp, "  %s", js_CodeName[op]);
@@ -1577,9 +1679,13 @@ DecompileDestructuringLHS(SprintStack *ss, jsbytecode *pc, jsbytecode *endpc,
       case JSOP_SETLOCAL:
         LOCAL_ASSERT(pc[oplen] == JSOP_POP || pc[oplen] == JSOP_POPN);
         /* FALL THROUGH */
-
       case JSOP_SETLOCALPOP:
-        if (IsVarSlot(jp, pc, &i)) {
+        if (op == JSOP_SETARG) {
+            atom = GetArgOrVarAtom(jp, GET_SLOTNO(pc));
+            LOCAL_ASSERT(atom);
+            if (!QuoteString(&ss->sprinter, atom, 0))
+                return NULL;
+        } else if (IsVarSlot(jp, pc, &i)) {
             atom = GetArgOrVarAtom(jp, i);
             LOCAL_ASSERT(atom);
             if (!QuoteString(&ss->sprinter, atom, 0))
@@ -1589,6 +1695,15 @@ DecompileDestructuringLHS(SprintStack *ss, jsbytecode *pc, jsbytecode *endpc,
             if (!lval || SprintCString(&ss->sprinter, lval) < 0)
                 return NULL;
         }
+        if (op != JSOP_SETLOCALPOP) {
+            pc += oplen;
+            if (pc == endpc)
+                return pc;
+            LOAD_OP_DATA(pc);
+            if (op == JSOP_POPN)
+                return pc;
+            LOCAL_ASSERT(op == JSOP_POP);
+        }
         break;
 
       default: {
@@ -1731,6 +1846,7 @@ DecompileDestructuring(SprintStack *ss, jsbytecode *pc, jsbytecode *endpc)
             break;
 
           case JSOP_GETPROP:
+          case JSOP_LENGTH:
           {
             LOAD_ATOM(0);
             *OFF2STR(&ss->sprinter, head) = '{';
@@ -2389,27 +2505,6 @@ Decompile(SprintStack *ss, jsbytecode *pc, intN nb)
                     len = tail + js_CodeSpec[pc[tail]].length;
                     break;
 
-                  case SRC_LABEL:
-                    GET_SOURCE_NOTE_ATOM(sn, atom);
-                    jp->indent -= 4;
-                    rval = QuoteString(&ss->sprinter, atom, 0);
-                    if (!rval)
-                        return NULL;
-                    RETRACT(&ss->sprinter, rval);
-                    js_printf(jp, "\t%s:\n", rval);
-                    jp->indent += 4;
-                    break;
-
-                  case SRC_LABELBRACE:
-                    GET_SOURCE_NOTE_ATOM(sn, atom);
-                    rval = QuoteString(&ss->sprinter, atom, 0);
-                    if (!rval)
-                        return NULL;
-                    RETRACT(&ss->sprinter, rval);
-                    js_printf(jp, "\t%s: {\n", rval);
-                    jp->indent += 4;
-                    break;
-
                   case SRC_ENDBRACE:
                     jp->indent -= 4;
                     js_printf(jp, "\t}\n");
@@ -2446,6 +2541,38 @@ Decompile(SprintStack *ss, jsbytecode *pc, intN nb)
                 }
                 break;
 
+              case JSOP_LABEL:
+              case JSOP_LABELX:
+                sn = js_GetSrcNote(jp->script, pc);
+                todo = -2;
+                switch (sn ? SN_TYPE(sn) : SRC_NULL) {
+                  case SRC_LABEL:
+                    GET_SOURCE_NOTE_ATOM(sn, atom);
+                    jp->indent -= 4;
+                    rval = QuoteString(&ss->sprinter, atom, 0);
+                    if (!rval)
+                        return NULL;
+                    RETRACT(&ss->sprinter, rval);
+                    js_printf(jp, "\t%s:\n", rval);
+                    jp->indent += 4;
+                    break;
+
+                  case SRC_LABELBRACE:
+                    GET_SOURCE_NOTE_ATOM(sn, atom);
+                    rval = QuoteString(&ss->sprinter, atom, 0);
+                    if (!rval)
+                        return NULL;
+                    RETRACT(&ss->sprinter, rval);
+                    js_printf(jp, "\t%s: {\n", rval);
+                    jp->indent += 4;
+                    break;
+
+                  default:
+                    JS_NOT_REACHED("JSOP_LABEL without source note");
+                    break;
+                }
+                break;
+
               case JSOP_PUSH:
 #if JS_HAS_DESTRUCTURING
                 sn = js_GetSrcNote(jp->script, pc);
@@ -2837,9 +2964,8 @@ Decompile(SprintStack *ss, jsbytecode *pc, intN nb)
 #endif
                         LOCAL_ASSERT(*pc == JSOP_SETLOCALPOP);
                         pc += JSOP_SETLOCALPOP_LENGTH;
-                        LOCAL_ASSERT(OBJ_BLOCK_COUNT(cx, obj) == 1);
-                        atom = JSID_TO_ATOM(obj->lastProperty()->propid);
-                        if (!QuoteString(&jp->sprinter, atom, 0))
+                        LOCAL_ASSERT(OBJ_BLOCK_COUNT(cx, obj) >= 1);
+                        if (!QuoteString(&jp->sprinter, atoms[0], 0))
                             return NULL;
 #if JS_HAS_DESTRUCTURING
                     }
@@ -3464,6 +3590,8 @@ Decompile(SprintStack *ss, jsbytecode *pc, intN nb)
                     return NULL;
                 done = pc + GetJumpOffset(pc, pc);
                 pc += len;
+                JS_ASSERT(*pc == JSOP_POP);
+                pc += JSOP_POP_LENGTH;
                 len = done - pc;
                 if (!Decompile(ss, pc, len)) {
                     cx->free_((char *)lval);
diff --git a/js/src/jsopcode.h b/js/src/jsopcode.h
index 2f483aa28326..22c551d18c1f 100644
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -139,6 +139,7 @@ typedef enum JSOp {
 #define JOF_TYPESET      (1U<<26) /* has an entry in a script's type sets */
 #define JOF_DECOMPOSE    (1U<<27) /* followed by an equivalent decomposed
                                    * version of the opcode */
+#define JOF_ARITH        (1U<<28) /* unary or binary arithmetic opcode */
 
 /* Shorthands for type from format and type from opcode. */
 #define JOF_TYPE(fmt)   ((fmt) & JOF_TYPEMASK)
@@ -582,9 +583,135 @@ class AutoScriptUntrapper
     ~AutoScriptUntrapper();
 };
 
-}
+/*
+ * Counts accumulated for a single opcode in a script. The counts tracked vary
+ * between opcodes, and this structure ensures that counts are accessed in
+ * a coherent fashion.
+ */
+class OpcodeCounts
+{
+    friend struct ::JSScript;
+    double *counts;
+#ifdef DEBUG
+    size_t capacity;
 #endif
 
+ public:
+
+    enum BaseCounts {
+        BASE_INTERP = 0,
+        BASE_METHODJIT,
+
+        BASE_METHODJIT_STUBS,
+        BASE_METHODJIT_CODE,
+        BASE_METHODJIT_PICS,
+
+        BASE_COUNT
+    };
+
+    enum AccessCounts {
+        ACCESS_MONOMORPHIC = BASE_COUNT,
+        ACCESS_DIMORPHIC,
+        ACCESS_POLYMORPHIC,
+
+        ACCESS_BARRIER,
+        ACCESS_NOBARRIER,
+
+        ACCESS_UNDEFINED,
+        ACCESS_NULL,
+        ACCESS_BOOLEAN,
+        ACCESS_INT32,
+        ACCESS_DOUBLE,
+        ACCESS_STRING,
+        ACCESS_OBJECT,
+
+        ACCESS_COUNT
+    };
+
+    static bool accessOp(JSOp op) {
+        /*
+         * Access ops include all name, element and property reads, as well as
+         * SETELEM and SETPROP (for ElementCounts/PropertyCounts alignment).
+         */
+        JS_ASSERT(op != JSOP_TRAP);
+        if (op == JSOP_SETELEM || op == JSOP_SETPROP || op == JSOP_SETMETHOD)
+            return true;
+        int format = js_CodeSpec[op].format;
+        return !!(format & (JOF_NAME | JOF_GNAME | JOF_ELEM | JOF_PROP))
+            && !(format & (JOF_SET | JOF_INCDEC));
+    }
+
+    enum ElementCounts {
+        ELEM_ID_INT = ACCESS_COUNT,
+        ELEM_ID_DOUBLE,
+        ELEM_ID_OTHER,
+        ELEM_ID_UNKNOWN,
+
+        ELEM_OBJECT_TYPED,
+        ELEM_OBJECT_PACKED,
+        ELEM_OBJECT_DENSE,
+        ELEM_OBJECT_OTHER,
+
+        ELEM_COUNT
+    };
+
+    static bool elementOp(JSOp op) {
+        return accessOp(op) && !!(js_CodeSpec[op].format & JOF_ELEM);
+    }
+
+    enum PropertyCounts {
+        PROP_STATIC = ACCESS_COUNT,
+        PROP_DEFINITE,
+        PROP_OTHER,
+
+        PROP_COUNT
+    };
+
+    static bool propertyOp(JSOp op) {
+        return accessOp(op) && !!(js_CodeSpec[op].format & JOF_PROP);
+    }
+
+    enum ArithCounts {
+        ARITH_INT = BASE_COUNT,
+        ARITH_DOUBLE,
+        ARITH_OTHER,
+        ARITH_UNKNOWN,
+
+        ARITH_COUNT
+    };
+
+    static bool arithOp(JSOp op) {
+        JS_ASSERT(op != JSOP_TRAP);
+        return !!(js_CodeSpec[op].format & (JOF_INCDEC | JOF_ARITH));
+    }
+
+    static size_t numCounts(JSOp op)
+    {
+        if (accessOp(op)) {
+            if (elementOp(op))
+                return ELEM_COUNT;
+            if (propertyOp(op))
+                return PROP_COUNT;
+            return ACCESS_COUNT;
+        }
+        if (arithOp(op))
+            return ARITH_COUNT;
+        return BASE_COUNT;
+    }
+
+    static const char *countName(JSOp op, size_t which);
+
+    double *rawCounts() { return counts; }
+
+    double& get(size_t which) {
+        JS_ASSERT(which < capacity);
+        return counts[which];
+    }
+};
+
+} /* namespace js */
+#endif /* __cplusplus */
+
 #if defined(DEBUG) && defined(__cplusplus)
 /*
  * Disassemblers, for debugging only.
@@ -595,6 +722,9 @@ js_Disassemble(JSContext *cx, JSScript *script, JSBool lines, js::Sprinter *sp);
 extern JS_FRIEND_API(uintN)
 js_Disassemble1(JSContext *cx, JSScript *script, jsbytecode *pc, uintN loc,
                 JSBool lines, js::Sprinter *sp);
+
+extern JS_FRIEND_API(void)
+js_DumpPCCounts(JSContext *cx, JSScript *script, js::Sprinter *sp);
 #endif
 
 #endif /* jsopcode_h___ */
diff --git a/js/src/jsopcode.tbl b/js/src/jsopcode.tbl
index 549d75270450..efd2cb5f598e 100644
--- a/js/src/jsopcode.tbl
+++ b/js/src/jsopcode.tbl
@@ -132,27 +132,27 @@ OPDEF(JSOP_POPN,      11, "popn",       NULL,         3, -1,  0,  0,  JOF_UINT16
 OPDEF(JSOP_DUP,       12, "dup",        NULL,         1,  1,  2,  0,  JOF_BYTE)
 OPDEF(JSOP_DUP2,      13, "dup2",       NULL,         1,  2,  4,  0,  JOF_BYTE)
 OPDEF(JSOP_SETCONST,  14, "setconst",   NULL,         3,  1,  1,  3,  JOF_ATOM|JOF_NAME|JOF_SET)
-OPDEF(JSOP_BITOR,     15, "bitor",      "|",          1,  2,  1,  7,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_BITXOR,    16, "bitxor",     "^",          1,  2,  1,  8,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_BITAND,    17, "bitand",     "&",          1,  2,  1,  9,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_EQ,        18, "eq",         "==",         1,  2,  1,  10,  JOF_BYTE|JOF_LEFTASSOC|JOF_DETECTING)
-OPDEF(JSOP_NE,        19, "ne",         "!=",         1,  2,  1,  10,  JOF_BYTE|JOF_LEFTASSOC|JOF_DETECTING)
-OPDEF(JSOP_LT,        20, "lt",         "<",          1,  2,  1, 11,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_LE,        21, "le",         "<=",         1,  2,  1, 11,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_GT,        22, "gt",         ">",          1,  2,  1, 11,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_GE,        23, "ge",         ">=",         1,  2,  1, 11,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_LSH,       24, "lsh",        "<<",         1,  2,  1, 12,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_RSH,       25, "rsh",        ">>",         1,  2,  1, 12,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_URSH,      26, "ursh",       ">>>",        1,  2,  1, 12,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_ADD,       27, "add",        "+",          1,  2,  1, 13,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_SUB,       28, "sub",        "-",          1,  2,  1, 13,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_MUL,       29, "mul",        "*",          1,  2,  1, 14,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_DIV,       30, "div",        "/",          1,  2,  1, 14,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_MOD,       31, "mod",        "%",          1,  2,  1, 14,  JOF_BYTE|JOF_LEFTASSOC)
-OPDEF(JSOP_NOT,       32, "not",        "!",          1,  1,  1, 15,  JOF_BYTE|JOF_DETECTING)
-OPDEF(JSOP_BITNOT,    33, "bitnot",     "~",          1,  1,  1, 15,  JOF_BYTE)
-OPDEF(JSOP_NEG,       34, "neg",        "- ",         1,  1,  1, 15,  JOF_BYTE)
-OPDEF(JSOP_POS,       35, "pos",        "+ ",         1,  1,  1, 15,  JOF_BYTE)
+OPDEF(JSOP_BITOR,     15, "bitor",      "|",          1,  2,  1,  7,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_BITXOR,    16, "bitxor",     "^",          1,  2,  1,  8,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_BITAND,    17, "bitand",     "&",          1,  2,  1,  9,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_EQ,        18, "eq",         "==",         1,  2,  1,  10,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH|JOF_DETECTING)
+OPDEF(JSOP_NE,        19, "ne",         "!=",         1,  2,  1,  10,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH|JOF_DETECTING)
+OPDEF(JSOP_LT,        20, "lt",         "<",          1,  2,  1, 11,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_LE,        21, "le",         "<=",         1,  2,  1, 11,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_GT,        22, "gt",         ">",          1,  2,  1, 11,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_GE,        23, "ge",         ">=",         1,  2,  1, 11,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_LSH,       24, "lsh",        "<<",         1,  2,  1, 12,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_RSH,       25, "rsh",        ">>",         1,  2,  1, 12,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_URSH,      26, "ursh",       ">>>",        1,  2,  1, 12,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_ADD,       27, "add",        "+",          1,  2,  1, 13,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_SUB,       28, "sub",        "-",          1,  2,  1, 13,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_MUL,       29, "mul",        "*",          1,  2,  1, 14,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_DIV,       30, "div",        "/",          1,  2,  1, 14,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_MOD,       31, "mod",        "%",          1,  2,  1, 14,  JOF_BYTE|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_NOT,       32, "not",        "!",          1,  1,  1, 15,  JOF_BYTE|JOF_ARITH|JOF_DETECTING)
+OPDEF(JSOP_BITNOT,    33, "bitnot",     "~",          1,  1,  1, 15,  JOF_BYTE|JOF_ARITH)
+OPDEF(JSOP_NEG,       34, "neg",        "- ",         1,  1,  1, 15,  JOF_BYTE|JOF_ARITH)
+OPDEF(JSOP_POS,       35, "pos",        "+ ",         1,  1,  1, 15,  JOF_BYTE|JOF_ARITH)
 OPDEF(JSOP_DELNAME,   36, "delname",    NULL,         3,  0,  1, 15,  JOF_ATOM|JOF_NAME|JOF_DEL)
 OPDEF(JSOP_DELPROP,   37, "delprop",    NULL,         3,  1,  1, 15,  JOF_ATOM|JOF_PROP|JOF_DEL)
 OPDEF(JSOP_DELELEM,   38, "delelem",    NULL,         1,  2,  1, 15,  JOF_BYTE |JOF_ELEM|JOF_DEL)
@@ -187,16 +187,16 @@ OPDEF(JSOP_NULL,      64, js_null_str,  js_null_str,  1,  0,  1, 19,  JOF_BYTE)
 OPDEF(JSOP_THIS,      65, js_this_str,  js_this_str,  1,  0,  1, 19,  JOF_BYTE)
 OPDEF(JSOP_FALSE,     66, js_false_str, js_false_str, 1,  0,  1, 19,  JOF_BYTE)
 OPDEF(JSOP_TRUE,      67, js_true_str,  js_true_str,  1,  0,  1, 19,  JOF_BYTE)
-OPDEF(JSOP_OR,        68, "or",         NULL,         3,  1,  0,  5,  JOF_JUMP|JOF_DETECTING|JOF_LEFTASSOC)
-OPDEF(JSOP_AND,       69, "and",        NULL,         3,  1,  0,  6,  JOF_JUMP|JOF_DETECTING|JOF_LEFTASSOC)
+OPDEF(JSOP_OR,        68, "or",         NULL,         3,  1,  1,  5,  JOF_JUMP|JOF_DETECTING|JOF_LEFTASSOC)
+OPDEF(JSOP_AND,       69, "and",        NULL,         3,  1,  1,  6,  JOF_JUMP|JOF_DETECTING|JOF_LEFTASSOC)
 
 /* The switch bytecodes have variable length. */
 OPDEF(JSOP_TABLESWITCH,  70, "tableswitch",  NULL,   -1,  1,  0,  0,  JOF_TABLESWITCH|JOF_DETECTING|JOF_PARENHEAD)
 OPDEF(JSOP_LOOKUPSWITCH, 71, "lookupswitch", NULL,   -1,  1,  0,  0,  JOF_LOOKUPSWITCH|JOF_DETECTING|JOF_PARENHEAD)
 
 /* New, infallible/transitive identity ops. */
-OPDEF(JSOP_STRICTEQ,  72, "stricteq",   "===",        1,  2,  1, 10,  JOF_BYTE|JOF_DETECTING|JOF_LEFTASSOC)
-OPDEF(JSOP_STRICTNE,  73, "strictne",   "!==",        1,  2,  1, 10,  JOF_BYTE|JOF_DETECTING|JOF_LEFTASSOC)
+OPDEF(JSOP_STRICTEQ,  72, "stricteq",   "===",        1,  2,  1, 10,  JOF_BYTE|JOF_DETECTING|JOF_LEFTASSOC|JOF_ARITH)
+OPDEF(JSOP_STRICTNE,  73, "strictne",   "!==",        1,  2,  1, 10,  JOF_BYTE|JOF_DETECTING|JOF_LEFTASSOC|JOF_ARITH)
 
 /*
  * Host object extension: given 'o.item(i) = j', the left-hand side compiles
@@ -274,9 +274,9 @@ OPDEF(JSOP_LOCALDEC,  104,"localdec",   NULL,         3,  0,  1, 15,  JOF_LOCAL|
 
 OPDEF(JSOP_IMACOP,    105,"imacop",     NULL,         1,  0,  0,  0,  JOF_BYTE)
 
-/* Static binding for globals. */
-OPDEF(JSOP_UNUSED0,   106,"unused0",    NULL,         3,  0,  1, 19,  JOF_BYTE)
-OPDEF(JSOP_UNUSED1,   107,"unused1",    NULL,         3,  0,  2, 19,  JOF_BYTE)
+/* The argument is the offset to the next statement and is used by IonMonkey. */
+OPDEF(JSOP_LABEL,     106,"label",     NULL,          3,  0,  0,  0,  JOF_JUMP)
+OPDEF(JSOP_LABELX,    107,"labelx",    NULL,          5,  0,  0,  0,  JOF_JUMPX)
 
 /* Like JSOP_FUNAPPLY but for f.call instead of f.apply. */
 OPDEF(JSOP_FUNCALL,   108,"funcall",    NULL,         3, -1,  1, 18,  JOF_UINT16|JOF_INVOKE|JOF_TYPESET)
@@ -384,8 +384,8 @@ OPDEF(JSOP_DEFLOCALFUN, 138,"deflocalfun",NULL,       5,  0,  0,  0,  JOF_SLOTOB
 OPDEF(JSOP_GOTOX,         139,"gotox",    NULL,       5,  0,  0,  0,  JOF_JUMPX)
 OPDEF(JSOP_IFEQX,         140,"ifeqx",    NULL,       5,  1,  0,  4,  JOF_JUMPX|JOF_DETECTING)
 OPDEF(JSOP_IFNEX,         141,"ifnex",    NULL,       5,  1,  0,  0,  JOF_JUMPX|JOF_PARENHEAD)
-OPDEF(JSOP_ORX,           142,"orx",      NULL,       5,  1,  0,  5,  JOF_JUMPX|JOF_DETECTING)
-OPDEF(JSOP_ANDX,          143,"andx",     NULL,       5,  1,  0,  6,  JOF_JUMPX|JOF_DETECTING)
+OPDEF(JSOP_ORX,           142,"orx",      NULL,       5,  1,  1,  5,  JOF_JUMPX|JOF_DETECTING)
+OPDEF(JSOP_ANDX,          143,"andx",     NULL,       5,  1,  1,  6,  JOF_JUMPX|JOF_DETECTING)
 OPDEF(JSOP_GOSUBX,        144,"gosubx",   NULL,       5,  0,  0,  0,  JOF_JUMPX)
 OPDEF(JSOP_CASEX,         145,"casex",    NULL,       5,  2,  1,  0,  JOF_JUMPX)
 OPDEF(JSOP_DEFAULTX,      146,"defaultx", NULL,       5,  1,  0,  0,  JOF_JUMPX)
diff --git a/js/src/jsprobes.cpp b/js/src/jsprobes.cpp
index 639ea6b1ac8a..5fb03e86a763 100644
--- a/js/src/jsprobes.cpp
+++ b/js/src/jsprobes.cpp
@@ -36,6 +36,7 @@
 #ifdef MOZ_ETW
 #include "jswin.h"
 #include <evntprov.h>
+#include <sys/types.h>
 
 /* Generated from ETWProvider.man */
 #include "ETWProvider.h"
@@ -49,11 +50,11 @@
 #include "jsfun.h"
 #include "jsinterp.h"
 #include "jsobj.h"
+#include "jsprobes.h"
 #include "jsscript.h"
 #include "jsstr.h"
 
-#include "jsprobes.h"
-#include <sys/types.h>
+#include "jsobjinlines.h"
 
 #define TYPEOF(cx,v)    (JSVAL_IS_NULL(v) ? JSTYPE_NULL : JS_TypeOfValue(cx,v))
 
diff --git a/js/src/jspropertytree.cpp b/js/src/jspropertytree.cpp
index aa04b3976218..bec0df458083 100644
--- a/js/src/jspropertytree.cpp
+++ b/js/src/jspropertytree.cpp
@@ -159,6 +159,20 @@ Shape::removeChild(Shape *child)
     }
 }
 
+/*
+ * We need a read barrier for the shape tree, since these are weak pointers.
+ */
+static Shape *
+ReadBarrier(Shape *shape)
+{
+#ifdef JSGC_INCREMENTAL
+    JSCompartment *comp = shape->compartment();
+    if (comp->needsBarrier())
+        MarkShapeUnbarriered(comp->barrierTracer(), shape, "read barrier");
+#endif
+    return shape;
+}
+
 Shape *
 PropertyTree::getChild(JSContext *cx, Shape *parent, const Shape &child)
 {
@@ -179,11 +193,11 @@ PropertyTree::getChild(JSContext *cx, Shape *parent, const Shape &child)
     if (kidp->isShape()) {
         shape = kidp->toShape();
         if (shape->matches(&child))
-            return shape;
+            return ReadBarrier(shape);
     } else if (kidp->isHash()) {
         shape = *kidp->toHash()->lookup(&child);
         if (shape)
-            return shape;
+            return ReadBarrier(shape);
     } else {
         /* If kidp->isNull(), we always insert. */
     }
@@ -192,7 +206,7 @@ PropertyTree::getChild(JSContext *cx, Shape *parent, const Shape &child)
     if (!shape)
         return NULL;
 
-    new (shape) Shape(child.propid, child.rawGetter, child.rawSetter, child.slot, child.attrs,
+    new (shape) Shape(child.propid, child.getter(), child.setter(), child.slot, child.attrs,
                       child.flags, child.shortid, js_GenerateShape(cx));
 
     if (!insertChild(cx, parent, shape))
@@ -256,8 +270,8 @@ Shape::dump(JSContext *cx, FILE *fp) const
     }
 
     fprintf(fp, " g/s %p/%p slot %u attrs %x ",
-            JS_FUNC_TO_DATA_PTR(void *, rawGetter),
-            JS_FUNC_TO_DATA_PTR(void *, rawSetter),
+            JS_FUNC_TO_DATA_PTR(void *, getter()),
+            JS_FUNC_TO_DATA_PTR(void *, setter()),
             slot, attrs);
     if (attrs) {
         int first = 1;
diff --git a/js/src/jsproxy.cpp b/js/src/jsproxy.cpp
index ad454c48a379..142f8864ffef 100644
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -57,19 +57,29 @@
 using namespace js;
 using namespace js::gc;
 
-static inline const Value &
-GetCall(JSObject *proxy) {
+static inline const HeapValue &
+GetCall(JSObject *proxy)
+{
     JS_ASSERT(IsFunctionProxy(proxy));
-    return proxy->getSlot(JSSLOT_PROXY_CALL);
+    return proxy->getSlotRef(JSSLOT_PROXY_CALL);
 }
 
 static inline Value
-GetConstruct(JSObject *proxy) {
+GetConstruct(JSObject *proxy)
+{
     if (proxy->numSlots() <= JSSLOT_PROXY_CONSTRUCT)
         return UndefinedValue();
     return proxy->getSlot(JSSLOT_PROXY_CONSTRUCT);
 }
 
+static inline const HeapValue &
+GetFunctionProxyConstruct(JSObject *proxy)
+{
+    JS_ASSERT(IsFunctionProxy(proxy));
+    JS_ASSERT(proxy->numSlots() > JSSLOT_PROXY_CONSTRUCT);
+    return proxy->getSlotRef(JSSLOT_PROXY_CONSTRUCT);
+}
+
 static bool
 OperationInProgress(JSContext *cx, JSObject *proxy)
 {
@@ -1191,12 +1201,12 @@ static void
 proxy_TraceObject(JSTracer *trc, JSObject *obj)
 {
     GetProxyHandler(obj)->trace(trc, obj);
-    MarkCrossCompartmentValue(trc, GetProxyPrivate(obj), "private");
-    MarkCrossCompartmentValue(trc, GetProxyExtra(obj, 0), "extra0");
-    MarkCrossCompartmentValue(trc, GetProxyExtra(obj, 1), "extra1");
+    MarkCrossCompartmentValue(trc, obj->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "private");
+    MarkCrossCompartmentValue(trc, obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 0), "extra0");
+    MarkCrossCompartmentValue(trc, obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 1), "extra1");
     if (IsFunctionProxy(obj)) {
         MarkCrossCompartmentValue(trc, GetCall(obj), "call");
-        MarkCrossCompartmentValue(trc, GetConstruct(obj), "construct");
+        MarkCrossCompartmentValue(trc, GetFunctionProxyConstruct(obj), "construct");
     }
 }
 
@@ -1205,7 +1215,7 @@ proxy_TraceFunction(JSTracer *trc, JSObject *obj)
 {
     proxy_TraceObject(trc, obj);
     MarkCrossCompartmentValue(trc, GetCall(obj), "call");
-    MarkCrossCompartmentValue(trc, GetConstruct(obj), "construct");
+    MarkCrossCompartmentValue(trc, GetFunctionProxyConstruct(obj), "construct");
 }
 
 static JSBool
diff --git a/js/src/jsprvtd.h b/js/src/jsprvtd.h
index 10a44d0b1711..2c6c29f7674e 100644
--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -93,8 +93,6 @@ typedef struct JSSubString          JSSubString;
 typedef struct JSNativeTraceInfo    JSNativeTraceInfo;
 typedef struct JSSpecializedNative  JSSpecializedNative;
 typedef struct JSXML                JSXML;
-typedef struct JSXMLArray           JSXMLArray;
-typedef struct JSXMLArrayCursor     JSXMLArrayCursor;
 
 /*
  * Template declarations.
@@ -120,14 +118,22 @@ class JSWrapper;
 namespace js {
 
 struct ArgumentsData;
+struct FlatClosureData;
 struct Class;
 
 class RegExpObject;
-class RegExpPrivate;
+class RegExpMatcher;
 class RegExpObjectBuilder;
 class RegExpStatics;
 class MatchPairs;
 
+namespace detail {
+
+class RegExpPrivate;
+class RegExpPrivateCode;
+
+} /* namespace detail */
+
 enum RegExpFlag
 {
     IgnoreCaseFlag  = 0x01,
@@ -233,7 +239,7 @@ typedef HashMap<jsbytecode *, BreakpointSite *, DefaultHasher<jsbytecode *>, Run
 class Debugger;
 class WatchpointMap;
 
-typedef HashMap<JSAtom *, RegExpPrivate *, DefaultHasher<JSAtom *>, RuntimeAllocPolicy>
+typedef HashMap<JSAtom *, detail::RegExpPrivate *, DefaultHasher<JSAtom *>, RuntimeAllocPolicy>
     RegExpPrivateCache;
 
 typedef JSNative             Native;
diff --git a/js/src/jsreflect.cpp b/js/src/jsreflect.cpp
index e7b9fb862906..b4bfc71aa5b6 100644
--- a/js/src/jsreflect.cpp
+++ b/js/src/jsreflect.cpp
@@ -1607,8 +1607,8 @@ class ASTSerializer
         return StringValue(atom ? atom : cx->runtime->atomState.emptyAtom);
     }
 
-    BinaryOperator binop(TokenKind tk, JSOp op);
-    UnaryOperator unop(TokenKind tk, JSOp op);
+    BinaryOperator binop(ParseNodeKind kind, JSOp op);
+    UnaryOperator unop(ParseNodeKind kind, JSOp op);
     AssignmentOperator aop(JSOp op);
 
     bool statements(ParseNode *pn, NodeVector &elts);
@@ -1730,9 +1730,9 @@ ASTSerializer::aop(JSOp op)
 }
 
 UnaryOperator
-ASTSerializer::unop(TokenKind tk, JSOp op)
+ASTSerializer::unop(ParseNodeKind kind, JSOp op)
 {
-    if (tk == TOK_DELETE)
+    if (kind == PNK_DELETE)
         return UNOP_DELETE;
 
     switch (op) {
@@ -1755,68 +1755,52 @@ ASTSerializer::unop(TokenKind tk, JSOp op)
 }
 
 BinaryOperator
-ASTSerializer::binop(TokenKind tk, JSOp op)
+ASTSerializer::binop(ParseNodeKind kind, JSOp op)
 {
-    switch (tk) {
-      case TOK_EQOP:
-        switch (op) {
-          case JSOP_EQ:
-            return BINOP_EQ;
-          case JSOP_NE:
-            return BINOP_NE;
-          case JSOP_STRICTEQ:
-            return BINOP_STRICTEQ;
-          case JSOP_STRICTNE:
-            return BINOP_STRICTNE;
-          default:
-            return BINOP_ERR;
-        }
-
-      case TOK_RELOP:
-        switch (op) {
-          case JSOP_LT:
-            return BINOP_LT;
-          case JSOP_LE:
-            return BINOP_LE;
-          case JSOP_GT:
-            return BINOP_GT;
-          case JSOP_GE:
-            return BINOP_GE;
-          default:
-            return BINOP_ERR;
-        }
-
-      case TOK_SHOP:
-        switch (op) {
-          case JSOP_LSH:
-            return BINOP_LSH;
-          case JSOP_RSH:
-            return BINOP_RSH;
-          case JSOP_URSH:
-            return BINOP_URSH;
-          default:
-            return BINOP_ERR;
-        }
-
-      case TOK_PLUS:
+    switch (kind) {
+      case PNK_LSH:
+        return BINOP_LSH;
+      case PNK_RSH:
+        return BINOP_RSH;
+      case PNK_URSH:
+        return BINOP_URSH;
+      case PNK_LT:
+        return BINOP_LT;
+      case PNK_LE:
+        return BINOP_LE;
+      case PNK_GT:
+        return BINOP_GT;
+      case PNK_GE:
+        return BINOP_GE;
+      case PNK_EQ:
+        return BINOP_EQ;
+      case PNK_NE:
+        return BINOP_NE;
+      case PNK_STRICTEQ:
+        return BINOP_STRICTEQ;
+      case PNK_STRICTNE:
+        return BINOP_STRICTNE;
+      case PNK_PLUS:
         return BINOP_PLUS;
-      case TOK_MINUS:
+      case PNK_MINUS:
         return BINOP_MINUS;
-      case TOK_STAR:
+      case PNK_STAR:
         return BINOP_STAR;
-      case TOK_DIVOP:
-        return (op == JSOP_MOD) ? BINOP_MOD : BINOP_DIV;
-      case TOK_BITOR:
+      case PNK_DIV:
+        return BINOP_DIV;
+      case PNK_MOD:
+        return BINOP_MOD;
+      case PNK_BITOR:
         return BINOP_BITOR;
-      case TOK_BITXOR:
+      case PNK_BITXOR:
         return BINOP_BITXOR;
-      case TOK_BITAND:
+      case PNK_BITAND:
         return BINOP_BITAND;
-      case TOK_IN:
+      case PNK_IN:
         return BINOP_IN;
-      case TOK_INSTANCEOF:
+      case PNK_INSTANCEOF:
         return BINOP_INSTANCEOF;
-      case TOK_DBLDOT:
+      case PNK_DBLDOT:
         return BINOP_DBLDOT;
       default:
         return BINOP_ERR;
@@ -1826,7 +1810,7 @@ ASTSerializer::binop(TokenKind tk, JSOp op)
 bool
 ASTSerializer::statements(ParseNode *pn, NodeVector &elts)
 {
-    JS_ASSERT(pn->isKind(TOK_LC) && pn->isArity(PN_LIST));
+    JS_ASSERT(pn->isKind(PNK_LC) && pn->isArity(PN_LIST));
 
     if (!elts.reserve(pn->pn_count))
         return false;
@@ -1876,7 +1860,7 @@ ASTSerializer::xmls(ParseNode *pn, NodeVector &elts)
 bool
 ASTSerializer::blockStatement(ParseNode *pn, Value *dst)
 {
-    JS_ASSERT(pn->isKind(TOK_LC));
+    JS_ASSERT(pn->isKind(PNK_LC));
 
     NodeVector stmts(cx);
     return statements(pn, stmts) &&
@@ -1903,17 +1887,17 @@ ASTSerializer::sourceElement(ParseNode *pn, Value *dst)
 bool
 ASTSerializer::declaration(ParseNode *pn, Value *dst)
 {
-    JS_ASSERT(pn->isKind(TOK_FUNCTION) || pn->isKind(TOK_VAR) || pn->isKind(TOK_LET));
+    JS_ASSERT(pn->isKind(PNK_FUNCTION) || pn->isKind(PNK_VAR) || pn->isKind(PNK_LET));
 
     switch (pn->getKind()) {
-      case TOK_FUNCTION:
+      case PNK_FUNCTION:
         return function(pn, AST_FUNC_DECL, dst);
 
-      case TOK_VAR:
+      case PNK_VAR:
         return variableDeclaration(pn, false, dst);
 
       default:
-        JS_ASSERT(pn->isKind(TOK_LET));
+        JS_ASSERT(pn->isKind(PNK_LET));
         return variableDeclaration(pn, true, dst);
     }
 }
@@ -1921,7 +1905,7 @@ ASTSerializer::declaration(ParseNode *pn, Value *dst)
 bool
 ASTSerializer::variableDeclaration(ParseNode *pn, bool let, Value *dst)
 {
-    JS_ASSERT(let ? pn->isKind(TOK_LET) : pn->isKind(TOK_VAR));
+    JS_ASSERT(let ? pn->isKind(PNK_LET) : pn->isKind(PNK_VAR));
 
     /* Later updated to VARDECL_CONST if we find a PND_CONST declarator. */
     VarDeclKind kind = let ? VARDECL_LET : VARDECL_VAR;
@@ -1952,17 +1936,17 @@ ASTSerializer::variableDeclaration(ParseNode *pn, bool let, Value *dst)
 bool
 ASTSerializer::variableDeclarator(ParseNode *pn, VarDeclKind *pkind, Value *dst)
 {
-    /* A destructuring declarator is always a TOK_ASSIGN. */
-    JS_ASSERT(pn->isKind(TOK_NAME) || pn->isKind(TOK_ASSIGN));
+    /* A destructuring declarator is always a PNK_ASSIGN. */
+    JS_ASSERT(pn->isKind(PNK_NAME) || pn->isKind(PNK_ASSIGN));
 
     ParseNode *pnleft;
     ParseNode *pnright;
 
-    if (pn->isKind(TOK_NAME)) {
+    if (pn->isKind(PNK_NAME)) {
         pnleft = pn;
         pnright = pn->isUsed() ? NULL : pn->pn_expr;
     } else {
-        JS_ASSERT(pn->isKind(TOK_ASSIGN));
+        JS_ASSERT(pn->isKind(PNK_ASSIGN));
         pnleft = pn->pn_left;
         pnright = pn->pn_right;
     }
@@ -2018,7 +2002,7 @@ ASTSerializer::switchStatement(ParseNode *pn, Value *dst)
     ParseNode *listNode;
     bool lexical;
 
-    if (pn->pn_right->isKind(TOK_LEXICALSCOPE)) {
+    if (pn->pn_right->isKind(PNK_LEXICALSCOPE)) {
         listNode = pn->pn_right->pn_expr;
         lexical = true;
     } else {
@@ -2087,9 +2071,9 @@ ASTSerializer::forInit(ParseNode *pn, Value *dst)
         return true;
     }
 
-    return pn->isKind(TOK_VAR)
+    return pn->isKind(PNK_VAR)
            ? variableDeclaration(pn, false, dst)
-           : pn->isKind(TOK_LET)
+           : pn->isKind(PNK_LET)
            ? variableDeclaration(pn, true, dst)
            : expression(pn, dst);
 }
@@ -2099,16 +2083,16 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
 {
     JS_CHECK_RECURSION(cx, return false);
     switch (pn->getKind()) {
-      case TOK_FUNCTION:
-      case TOK_VAR:
-      case TOK_LET:
+      case PNK_FUNCTION:
+      case PNK_VAR:
+      case PNK_LET:
         return declaration(pn, dst);
 
-      case TOK_NAME:
+      case PNK_NAME:
         LOCAL_ASSERT(pn->isUsed());
         return statement(pn->pn_lexdef, dst);
 
-      case TOK_SEMI:
+      case PNK_SEMI:
         if (pn->pn_kid) {
             Value expr;
             return expression(pn->pn_kid, &expr) &&
@@ -2116,9 +2100,9 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
         }
         return builder.emptyStatement(&pn->pn_pos, dst);
 
-      case TOK_LEXICALSCOPE:
+      case PNK_LEXICALSCOPE:
         pn = pn->pn_expr;
-        if (pn->isKind(TOK_LET)) {
+        if (pn->isKind(PNK_LET)) {
             NodeVector dtors(cx);
             Value stmt;
 
@@ -2127,14 +2111,14 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
                    builder.letStatement(dtors, stmt, &pn->pn_pos, dst);
         }
 
-        if (!pn->isKind(TOK_LC))
+        if (!pn->isKind(PNK_LC))
             return statement(pn, dst);
         /* FALL THROUGH */
 
-      case TOK_LC:
+      case PNK_LC:
         return blockStatement(pn, dst);
 
-      case TOK_IF:
+      case PNK_IF:
       {
         Value test, cons, alt;
 
@@ -2144,25 +2128,25 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
                builder.ifStatement(test, cons, alt, &pn->pn_pos, dst);
       }
 
-      case TOK_SWITCH:
+      case PNK_SWITCH:
         return switchStatement(pn, dst);
 
-      case TOK_TRY:
+      case PNK_TRY:
         return tryStatement(pn, dst);
 
-      case TOK_WITH:
-      case TOK_WHILE:
+      case PNK_WITH:
+      case PNK_WHILE:
       {
         Value expr, stmt;
 
         return expression(pn->pn_left, &expr) &&
                statement(pn->pn_right, &stmt) &&
-               (pn->isKind(TOK_WITH)
+               (pn->isKind(PNK_WITH)
                 ? builder.withStatement(expr, stmt, &pn->pn_pos, dst)
                 : builder.whileStatement(expr, stmt, &pn->pn_pos, dst));
       }
 
-      case TOK_DO:
+      case PNK_DO:
       {
         Value stmt, test;
 
@@ -2171,7 +2155,7 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
                builder.doWhileStatement(stmt, test, &pn->pn_pos, dst);
       }
 
-      case TOK_FOR:
+      case PNK_FOR:
       {
         ParseNode *head = pn->pn_left;
 
@@ -2181,13 +2165,13 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
 
         bool isForEach = pn->pn_iflags & JSITER_FOREACH;
 
-        if (head->isKind(TOK_IN)) {
+        if (head->isKind(PNK_IN)) {
             Value var, expr;
 
             return (!head->pn_kid1
                     ? pattern(head->pn_kid2, NULL, &var)
                     : variableDeclaration(head->pn_kid1,
-                                          head->pn_kid1->isKind(TOK_LET),
+                                          head->pn_kid1->isKind(PNK_LET),
                                           &var)) &&
                    expression(head->pn_kid3, &expr) &&
                    builder.forInStatement(var, expr, stmt, isForEach, &pn->pn_pos, dst);
@@ -2202,21 +2186,21 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
       }
 
       /* Synthesized by the parser when a for-in loop contains a variable initializer. */
-      case TOK_SEQ:
+      case PNK_SEQ:
       {
         LOCAL_ASSERT(pn->pn_count == 2);
 
         ParseNode *prelude = pn->pn_head;
         ParseNode *loop = prelude->pn_next;
 
-        LOCAL_ASSERT(prelude->isKind(TOK_VAR) && loop->isKind(TOK_FOR));
+        LOCAL_ASSERT(prelude->isKind(PNK_VAR) && loop->isKind(PNK_FOR));
 
         Value var;
         if (!variableDeclaration(prelude, false, &var))
             return false;
 
         ParseNode *head = loop->pn_left;
-        JS_ASSERT(head->isKind(TOK_IN));
+        JS_ASSERT(head->isKind(PNK_IN));
 
         bool isForEach = loop->pn_iflags & JSITER_FOREACH;
 
@@ -2227,18 +2211,18 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
                builder.forInStatement(var, expr, stmt, isForEach, &pn->pn_pos, dst);
       }
 
-      case TOK_BREAK:
-      case TOK_CONTINUE:
+      case PNK_BREAK:
+      case PNK_CONTINUE:
       {
         Value label;
 
         return optIdentifier(pn->pn_atom, NULL, &label) &&
-               (pn->isKind(TOK_BREAK)
+               (pn->isKind(PNK_BREAK)
                 ? builder.breakStatement(label, &pn->pn_pos, dst)
                 : builder.continueStatement(label, &pn->pn_pos, dst));
       }
 
-      case TOK_COLON:
+      case PNK_COLON:
       {
         Value label, stmt;
 
@@ -2247,22 +2231,22 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
                builder.labeledStatement(label, stmt, &pn->pn_pos, dst);
       }
 
-      case TOK_THROW:
-      case TOK_RETURN:
+      case PNK_THROW:
+      case PNK_RETURN:
       {
         Value arg;
 
         return optExpression(pn->pn_kid, &arg) &&
-               (pn->isKind(TOK_THROW)
+               (pn->isKind(PNK_THROW)
                 ? builder.throwStatement(arg, &pn->pn_pos, dst)
                 : builder.returnStatement(arg, &pn->pn_pos, dst));
       }
 
-      case TOK_DEBUGGER:
+      case PNK_DEBUGGER:
         return builder.debuggerStatement(&pn->pn_pos, dst);
 
 #if JS_HAS_XML_SUPPORT
-      case TOK_DEFAULT:
+      case PNK_DEFAULT:
       {
         LOCAL_ASSERT(pn->isArity(PN_UNARY));
 
@@ -2284,9 +2268,9 @@ ASTSerializer::leftAssociate(ParseNode *pn, Value *dst)
     JS_ASSERT(pn->isArity(PN_LIST));
     JS_ASSERT(pn->pn_count >= 1);
 
-    TokenKind tk = pn->getKind();
-    bool lor = tk == TOK_OR;
-    bool logop = lor || (tk == TOK_AND);
+    ParseNodeKind kind = pn->getKind();
+    bool lor = kind == PNK_OR;
+    bool logop = lor || (kind == PNK_AND);
 
     ParseNode *head = pn->pn_head;
     Value left;
@@ -2322,7 +2306,7 @@ ASTSerializer::comprehensionBlock(ParseNode *pn, Value *dst)
 
     ParseNode *in = pn->pn_left;
 
-    LOCAL_ASSERT(in && in->isKind(TOK_IN));
+    LOCAL_ASSERT(in && in->isKind(PNK_IN));
 
     bool isForEach = pn->pn_iflags & JSITER_FOREACH;
 
@@ -2335,12 +2319,12 @@ ASTSerializer::comprehensionBlock(ParseNode *pn, Value *dst)
 bool
 ASTSerializer::comprehension(ParseNode *pn, Value *dst)
 {
-    LOCAL_ASSERT(pn->isKind(TOK_FOR));
+    LOCAL_ASSERT(pn->isKind(PNK_FOR));
 
     NodeVector blocks(cx);
 
     ParseNode *next = pn;
-    while (next->isKind(TOK_FOR)) {
+    while (next->isKind(PNK_FOR)) {
         Value block;
         if (!comprehensionBlock(next, &block) || !blocks.append(block))
             return false;
@@ -2349,17 +2333,17 @@ ASTSerializer::comprehension(ParseNode *pn, Value *dst)
 
     Value filter = MagicValue(JS_SERIALIZE_NO_NODE);
 
-    if (next->isKind(TOK_IF)) {
+    if (next->isKind(PNK_IF)) {
         if (!optExpression(next->pn_kid1, &filter))
             return false;
         next = next->pn_kid2;
-    } else if (next->isKind(TOK_LC) && next->pn_count == 0) {
+    } else if (next->isKind(PNK_LC) && next->pn_count == 0) {
         /* FoldConstants optimized away the push. */
         NodeVector empty(cx);
         return builder.arrayExpression(empty, &pn->pn_pos, dst);
     }
 
-    LOCAL_ASSERT(next->isKind(TOK_ARRAYPUSH));
+    LOCAL_ASSERT(next->isKind(PNK_ARRAYPUSH));
 
     Value body;
 
@@ -2370,12 +2354,12 @@ ASTSerializer::comprehension(ParseNode *pn, Value *dst)
 bool
 ASTSerializer::generatorExpression(ParseNode *pn, Value *dst)
 {
-    LOCAL_ASSERT(pn->isKind(TOK_FOR));
+    LOCAL_ASSERT(pn->isKind(PNK_FOR));
 
     NodeVector blocks(cx);
 
     ParseNode *next = pn;
-    while (next->isKind(TOK_FOR)) {
+    while (next->isKind(PNK_FOR)) {
         Value block;
         if (!comprehensionBlock(next, &block) || !blocks.append(block))
             return false;
@@ -2384,14 +2368,14 @@ ASTSerializer::generatorExpression(ParseNode *pn, Value *dst)
 
     Value filter = MagicValue(JS_SERIALIZE_NO_NODE);
 
-    if (next->isKind(TOK_IF)) {
+    if (next->isKind(PNK_IF)) {
         if (!optExpression(next->pn_kid1, &filter))
             return false;
         next = next->pn_kid2;
     }
 
-    LOCAL_ASSERT(next->isKind(TOK_SEMI) &&
-                 next->pn_kid->isKind(TOK_YIELD) &&
+    LOCAL_ASSERT(next->isKind(PNK_SEMI) &&
+                 next->pn_kid->isKind(PNK_YIELD) &&
                  next->pn_kid->pn_kid);
 
     Value body;
@@ -2405,17 +2389,17 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
 {
     JS_CHECK_RECURSION(cx, return false);
     switch (pn->getKind()) {
-      case TOK_FUNCTION:
+      case PNK_FUNCTION:
         return function(pn, AST_FUNC_EXPR, dst);
 
-      case TOK_COMMA:
+      case PNK_COMMA:
       {
         NodeVector exprs(cx);
         return expressions(pn, exprs) &&
                builder.sequenceExpression(exprs, &pn->pn_pos, dst);
       }
 
-      case TOK_HOOK:
+      case PNK_HOOK:
       {
         Value test, cons, alt;
 
@@ -2425,22 +2409,22 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
                builder.conditionalExpression(test, cons, alt, &pn->pn_pos, dst);
       }
 
-      case TOK_OR:
-      case TOK_AND:
+      case PNK_OR:
+      case PNK_AND:
       {
         if (pn->isArity(PN_BINARY)) {
             Value left, right;
             return expression(pn->pn_left, &left) &&
                    expression(pn->pn_right, &right) &&
-                   builder.logicalExpression(pn->isKind(TOK_OR), left, right, &pn->pn_pos, dst);
+                   builder.logicalExpression(pn->isKind(PNK_OR), left, right, &pn->pn_pos, dst);
         }
         return leftAssociate(pn, dst);
       }
 
-      case TOK_INC:
-      case TOK_DEC:
+      case PNK_INC:
+      case PNK_DEC:
       {
-        bool incr = pn->isKind(TOK_INC);
+        bool incr = pn->isKind(PNK_INC);
         bool prefix = pn->getOp() >= JSOP_INCNAME && pn->getOp() <= JSOP_DECELEM;
 
         Value expr;
@@ -2448,7 +2432,18 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
                builder.updateExpression(expr, incr, prefix, &pn->pn_pos, dst);
       }
 
-      case TOK_ASSIGN:
+      case PNK_ASSIGN:
+      case PNK_ADDASSIGN:
+      case PNK_SUBASSIGN:
+      case PNK_BITORASSIGN:
+      case PNK_BITXORASSIGN:
+      case PNK_BITANDASSIGN:
+      case PNK_LSHASSIGN:
+      case PNK_RSHASSIGN:
+      case PNK_URSHASSIGN:
+      case PNK_MULASSIGN:
+      case PNK_DIVASSIGN:
+      case PNK_MODASSIGN:
       {
         AssignmentOperator op = aop(pn->getOp());
         LOCAL_ASSERT(op > AOP_ERR && op < AOP_LIMIT);
@@ -2459,19 +2454,31 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
                builder.assignmentExpression(op, lhs, rhs, &pn->pn_pos, dst);
       }
 
-      case TOK_EQOP:
-      case TOK_RELOP:
-      case TOK_SHOP:
-      case TOK_PLUS:
-      case TOK_MINUS:
-      case TOK_STAR:
-      case TOK_DIVOP:
-      case TOK_BITOR:
-      case TOK_BITXOR:
-      case TOK_BITAND:
-      case TOK_IN:
-      case TOK_INSTANCEOF:
-      case TOK_DBLDOT:
+      case PNK_PLUS:
+      case PNK_MINUS:
+        if (pn->isArity(PN_UNARY))
+            goto unary_plusminus;
+        /* FALL THROUGH */
+      case PNK_STRICTEQ:
+      case PNK_EQ:
+      case PNK_STRICTNE:
+      case PNK_NE:
+      case PNK_LT:
+      case PNK_LE:
+      case PNK_GT:
+      case PNK_GE:
+      case PNK_LSH:
+      case PNK_RSH:
+      case PNK_URSH:
+      case PNK_STAR:
+      case PNK_DIV:
+      case PNK_MOD:
+      case PNK_BITOR:
+      case PNK_BITXOR:
+      case PNK_BITAND:
+      case PNK_IN:
+      case PNK_INSTANCEOF:
+      case PNK_DBLDOT:
         if (pn->isArity(PN_BINARY)) {
             BinaryOperator op = binop(pn->getKind(), pn->getOp());
             LOCAL_ASSERT(op > BINOP_ERR && op < BINOP_LIMIT);
@@ -2483,16 +2490,12 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
         }
         return leftAssociate(pn, dst);
 
-      case TOK_DELETE:
-      case TOK_UNARYOP:
-#if JS_HAS_XML_SUPPORT
-        if (pn->isOp(JSOP_XMLNAME) ||
-            pn->isOp(JSOP_SETXMLNAME) ||
-            pn->isOp(JSOP_BINDXMLNAME))
-            return expression(pn->pn_kid, dst);
-#endif
-
-      {
+      case PNK_DELETE:
+      case PNK_TYPEOF:
+      case PNK_VOID:
+      case PNK_NOT:
+      case PNK_BITNOT:
+      unary_plusminus: {
         UnaryOperator op = unop(pn->getKind(), pn->getOp());
         LOCAL_ASSERT(op > UNOP_ERR && op < UNOP_LIMIT);
 
@@ -2501,8 +2504,8 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
                builder.unaryExpression(op, expr, &pn->pn_pos, dst);
       }
 
-      case TOK_NEW:
-      case TOK_LP:
+      case PNK_NEW:
+      case PNK_LP:
       {
 #ifdef JS_HAS_GENERATOR_EXPRS
         if (pn->isGeneratorExpr())
@@ -2526,12 +2529,12 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
             args.infallibleAppend(arg);
         }
 
-        return pn->isKind(TOK_NEW)
+        return pn->isKind(PNK_NEW)
                ? builder.newExpression(callee, args, &pn->pn_pos, dst)
                : builder.callExpression(callee, args, &pn->pn_pos, dst);
       }
 
-      case TOK_DOT:
+      case PNK_DOT:
       {
         Value expr, id;
         return expression(pn->pn_expr, &expr) &&
@@ -2539,28 +2542,22 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
                builder.memberExpression(false, expr, id, &pn->pn_pos, dst);
       }
 
-      case TOK_LB:
+      case PNK_LB:
       {
         Value left, right;
-        bool computed = true;
-#ifdef JS_HAS_XML_SUPPORT
-        computed = (!pn->pn_right->isKind(TOK_DBLCOLON) &&
-                    !pn->pn_right->isKind(TOK_ANYNAME) &&
-                    !pn->pn_right->isKind(TOK_AT));
-#endif
         return expression(pn->pn_left, &left) &&
                expression(pn->pn_right, &right) &&
-               builder.memberExpression(computed, left, right, &pn->pn_pos, dst);
+               builder.memberExpression(true, left, right, &pn->pn_pos, dst);
       }
 
-      case TOK_RB:
+      case PNK_RB:
       {
         NodeVector elts(cx);
         if (!elts.reserve(pn->pn_count))
             return false;
 
         for (ParseNode *next = pn->pn_head; next; next = next->pn_next) {
-            if (next->isKind(TOK_COMMA)) {
+            if (next->isKind(PNK_COMMA)) {
                 elts.infallibleAppend(MagicValue(JS_SERIALIZE_NO_NODE));
             } else {
                 Value expr;
@@ -2573,7 +2570,7 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
         return builder.arrayExpression(elts, &pn->pn_pos, dst);
       }
 
-      case TOK_RC:
+      case PNK_RC:
       {
         /* The parser notes any uninitialized properties by setting the PNX_DESTRUCT flag. */
         if (pn->pn_xflags & PNX_DESTRUCT) {
@@ -2594,40 +2591,45 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
         return builder.objectExpression(elts, &pn->pn_pos, dst);
       }
 
-      case TOK_NAME:
+      case PNK_NAME:
         return identifier(pn, dst);
 
-      case TOK_STRING:
-      case TOK_REGEXP:
-      case TOK_NUMBER:
-      case TOK_PRIMARY:
-        return pn->isOp(JSOP_THIS) ? builder.thisExpression(&pn->pn_pos, dst) : literal(pn, dst);
+      case PNK_THIS:
+        return builder.thisExpression(&pn->pn_pos, dst);
 
-      case TOK_YIELD:
+      case PNK_STRING:
+      case PNK_REGEXP:
+      case PNK_NUMBER:
+      case PNK_TRUE:
+      case PNK_FALSE:
+      case PNK_NULL:
+        return literal(pn, dst);
+
+      case PNK_YIELD:
       {
         Value arg;
         return optExpression(pn->pn_kid, &arg) &&
                builder.yieldExpression(arg, &pn->pn_pos, dst);
       }
 
-      case TOK_DEFSHARP:
+      case PNK_DEFSHARP:
       {
         Value expr;
         return expression(pn->pn_kid, &expr) &&
                builder.graphExpression(pn->pn_num, expr, &pn->pn_pos, dst);
       }
 
-      case TOK_USESHARP:
+      case PNK_USESHARP:
         return builder.graphIndexExpression(pn->pn_num, &pn->pn_pos, dst);
 
-      case TOK_ARRAYCOMP:
+      case PNK_ARRAYCOMP:
         /* NB: it's no longer the case that pn_count could be 2. */
         LOCAL_ASSERT(pn->pn_count == 1);
-        LOCAL_ASSERT(pn->pn_head->isKind(TOK_LEXICALSCOPE));
+        LOCAL_ASSERT(pn->pn_head->isKind(PNK_LEXICALSCOPE));
 
         return comprehension(pn->pn_head->pn_expr, dst);
 
-      case TOK_LEXICALSCOPE:
+      case PNK_LEXICALSCOPE:
       {
         pn = pn->pn_expr;
 
@@ -2640,10 +2642,16 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
       }
 
 #ifdef JS_HAS_XML_SUPPORT
-      case TOK_ANYNAME:
+      case PNK_XMLUNARY:
+        JS_ASSERT(pn->isOp(JSOP_XMLNAME) ||
+                  pn->isOp(JSOP_SETXMLNAME) ||
+                  pn->isOp(JSOP_BINDXMLNAME));
+        return expression(pn->pn_kid, dst);
+
+      case PNK_ANYNAME:
         return builder.xmlAnyName(&pn->pn_pos, dst);
 
-      case TOK_DBLCOLON:
+      case PNK_DBLCOLON:
       {
         Value right;
 
@@ -2665,7 +2673,7 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
                 return false;
         }
 
-        if (pnleft->isKind(TOK_FUNCTION))
+        if (pnleft->isKind(PNK_FUNCTION))
             return builder.xmlFunctionQualifiedIdentifier(right, computed, &pn->pn_pos, dst);
 
         Value left;
@@ -2673,18 +2681,18 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
                builder.xmlQualifiedIdentifier(left, right, computed, &pn->pn_pos, dst);
       }
 
-      case TOK_AT:
+      case PNK_AT:
       {
         Value expr;
         ParseNode *kid = pn->pn_kid;
-        bool computed = ((!kid->isKind(TOK_NAME) || !kid->isOp(JSOP_QNAMEPART)) &&
-                         !kid->isKind(TOK_DBLCOLON) &&
-                         !kid->isKind(TOK_ANYNAME));
+        bool computed = ((!kid->isKind(PNK_NAME) || !kid->isOp(JSOP_QNAMEPART)) &&
+                         !kid->isKind(PNK_DBLCOLON) &&
+                         !kid->isKind(PNK_ANYNAME));
         return expression(kid, &expr) &&
             builder.xmlAttributeSelector(expr, computed, &pn->pn_pos, dst);
       }
 
-      case TOK_FILTER:
+      case PNK_FILTER:
       {
         Value left, right;
         return expression(pn->pn_left, &left) &&
@@ -2708,14 +2716,14 @@ ASTSerializer::xml(ParseNode *pn, Value *dst)
     JS_CHECK_RECURSION(cx, return false);
     switch (pn->getKind()) {
 #ifdef JS_HAS_XML_SUPPORT
-      case TOK_LC:
+      case PNK_LC:
       {
         Value expr;
         return expression(pn->pn_kid, &expr) &&
                builder.xmlEscapeExpression(expr, &pn->pn_pos, dst);
       }
 
-      case TOK_XMLELEM:
+      case PNK_XMLELEM:
       {
         NodeVector elts(cx);
         if (!xmls(pn, elts))
@@ -2723,7 +2731,7 @@ ASTSerializer::xml(ParseNode *pn, Value *dst)
         return builder.xmlElement(elts, &pn->pn_pos, dst);
       }
 
-      case TOK_XMLLIST:
+      case PNK_XMLLIST:
       {
         NodeVector elts(cx);
         if (!xmls(pn, elts))
@@ -2731,7 +2739,7 @@ ASTSerializer::xml(ParseNode *pn, Value *dst)
         return builder.xmlList(elts, &pn->pn_pos, dst);
       }
 
-      case TOK_XMLSTAGO:
+      case PNK_XMLSTAGO:
       {
         NodeVector elts(cx);
         if (!xmls(pn, elts))
@@ -2739,7 +2747,7 @@ ASTSerializer::xml(ParseNode *pn, Value *dst)
         return builder.xmlStartTag(elts, &pn->pn_pos, dst);
       }
 
-      case TOK_XMLETAGO:
+      case PNK_XMLETAGO:
       {
         NodeVector elts(cx);
         if (!xmls(pn, elts))
@@ -2747,7 +2755,7 @@ ASTSerializer::xml(ParseNode *pn, Value *dst)
         return builder.xmlEndTag(elts, &pn->pn_pos, dst);
       }
 
-      case TOK_XMLPTAGC:
+      case PNK_XMLPTAGC:
       {
         NodeVector elts(cx);
         if (!xmls(pn, elts))
@@ -2755,11 +2763,11 @@ ASTSerializer::xml(ParseNode *pn, Value *dst)
         return builder.xmlPointTag(elts, &pn->pn_pos, dst);
       }
 
-      case TOK_XMLTEXT:
-      case TOK_XMLSPACE:
+      case PNK_XMLTEXT:
+      case PNK_XMLSPACE:
         return builder.xmlText(atomContents(pn->pn_atom), &pn->pn_pos, dst);
 
-      case TOK_XMLNAME:
+      case PNK_XMLNAME:
         if (pn->isArity(PN_NULLARY))
             return builder.xmlName(atomContents(pn->pn_atom), &pn->pn_pos, dst);
 
@@ -2771,16 +2779,16 @@ ASTSerializer::xml(ParseNode *pn, Value *dst)
                    builder.xmlName(elts, &pn->pn_pos, dst);
         }
 
-      case TOK_XMLATTR:
+      case PNK_XMLATTR:
         return builder.xmlAttribute(atomContents(pn->pn_atom), &pn->pn_pos, dst);
 
-      case TOK_XMLCDATA:
+      case PNK_XMLCDATA:
         return builder.xmlCdata(atomContents(pn->pn_atom), &pn->pn_pos, dst);
 
-      case TOK_XMLCOMMENT:
+      case PNK_XMLCOMMENT:
         return builder.xmlComment(atomContents(pn->pn_atom), &pn->pn_pos, dst);
 
-      case TOK_XMLPI:
+      case PNK_XMLPI:
         if (!pn->pn_pidata)
             return builder.xmlPI(atomContents(pn->pn_pitarget), &pn->pn_pos, dst);
         else
@@ -2798,10 +2806,10 @@ ASTSerializer::xml(ParseNode *pn, Value *dst)
 bool
 ASTSerializer::propertyName(ParseNode *pn, Value *dst)
 {
-    if (pn->isKind(TOK_NAME))
+    if (pn->isKind(PNK_NAME))
         return identifier(pn, dst);
 
-    LOCAL_ASSERT(pn->isKind(TOK_STRING) || pn->isKind(TOK_NUMBER));
+    LOCAL_ASSERT(pn->isKind(PNK_STRING) || pn->isKind(PNK_NUMBER));
 
     return literal(pn, dst);
 }
@@ -2838,11 +2846,11 @@ ASTSerializer::literal(ParseNode *pn, Value *dst)
 {
     Value val;
     switch (pn->getKind()) {
-      case TOK_STRING:
+      case PNK_STRING:
         val.setString(pn->pn_atom);
         break;
 
-      case TOK_REGEXP:
+      case PNK_REGEXP:
       {
         JSObject *re1 = pn->pn_objbox ? pn->pn_objbox->object : NULL;
         LOCAL_ASSERT(re1 && re1->isRegExp());
@@ -2859,15 +2867,20 @@ ASTSerializer::literal(ParseNode *pn, Value *dst)
         break;
       }
 
-      case TOK_NUMBER:
+      case PNK_NUMBER:
         val.setNumber(pn->pn_dval);
         break;
 
-      case TOK_PRIMARY:
-        if (pn->isOp(JSOP_NULL))
-            val.setNull();
-        else
-            val.setBoolean(pn->isOp(JSOP_TRUE));
+      case PNK_NULL:
+        val.setNull();
+        break;
+
+      case PNK_TRUE:
+        val.setBoolean(true);
+        break;
+
+      case PNK_FALSE:
+        val.setBoolean(false);
         break;
 
       default:
@@ -2880,14 +2893,14 @@ ASTSerializer::literal(ParseNode *pn, Value *dst)
 bool
 ASTSerializer::arrayPattern(ParseNode *pn, VarDeclKind *pkind, Value *dst)
 {
-    JS_ASSERT(pn->isKind(TOK_RB));
+    JS_ASSERT(pn->isKind(PNK_RB));
 
     NodeVector elts(cx);
     if (!elts.reserve(pn->pn_count))
         return false;
 
     for (ParseNode *next = pn->pn_head; next; next = next->pn_next) {
-        if (next->isKind(TOK_COMMA)) {
+        if (next->isKind(PNK_COMMA)) {
             elts.infallibleAppend(MagicValue(JS_SERIALIZE_NO_NODE));
         } else {
             Value patt;
@@ -2903,7 +2916,7 @@ ASTSerializer::arrayPattern(ParseNode *pn, VarDeclKind *pkind, Value *dst)
 bool
 ASTSerializer::objectPattern(ParseNode *pn, VarDeclKind *pkind, Value *dst)
 {
-    JS_ASSERT(pn->isKind(TOK_RC));
+    JS_ASSERT(pn->isKind(PNK_RC));
 
     NodeVector elts(cx);
     if (!elts.reserve(pn->pn_count))
@@ -2930,13 +2943,13 @@ ASTSerializer::pattern(ParseNode *pn, VarDeclKind *pkind, Value *dst)
 {
     JS_CHECK_RECURSION(cx, return false);
     switch (pn->getKind()) {
-      case TOK_RC:
+      case PNK_RC:
         return objectPattern(pn, pkind, dst);
 
-      case TOK_RB:
+      case PNK_RB:
         return arrayPattern(pn, pkind, dst);
 
-      case TOK_NAME:
+      case PNK_NAME:
         if (pkind && (pn->pn_dflags & PND_CONST))
             *pkind = VARDECL_CONST;
         /* FALL THROUGH */
@@ -2986,7 +2999,7 @@ ASTSerializer::function(ParseNode *pn, ASTType type, Value *dst)
 
     NodeVector args(cx);
 
-    ParseNode *argsAndBody = pn->pn_body->isKind(TOK_UPVARS)
+    ParseNode *argsAndBody = pn->pn_body->isKind(PNK_UPVARS)
                              ? pn->pn_body->pn_tree
                              : pn->pn_body;
 
@@ -3002,7 +3015,7 @@ ASTSerializer::functionArgsAndBody(ParseNode *pn, NodeVector &args, Value *body)
     ParseNode *pnbody;
 
     /* Extract the args and body separately. */
-    if (pn->isKind(TOK_ARGSBODY)) {
+    if (pn->isKind(PNK_ARGSBODY)) {
         pnargs = pn;
         pnbody = pn->last();
     } else {
@@ -3015,30 +3028,30 @@ ASTSerializer::functionArgsAndBody(ParseNode *pn, NodeVector &args, Value *body)
     /* Extract the destructuring assignments. */
     if (pnbody->isArity(PN_LIST) && (pnbody->pn_xflags & PNX_DESTRUCT)) {
         ParseNode *head = pnbody->pn_head;
-        LOCAL_ASSERT(head && head->isKind(TOK_SEMI));
+        LOCAL_ASSERT(head && head->isKind(PNK_SEMI));
 
         pndestruct = head->pn_kid;
-        LOCAL_ASSERT(pndestruct && pndestruct->isKind(TOK_VAR));
+        LOCAL_ASSERT(pndestruct && pndestruct->isKind(PNK_VAR));
     } else {
         pndestruct = NULL;
     }
 
     /* Serialize the arguments and body. */
     switch (pnbody->getKind()) {
-      case TOK_RETURN: /* expression closure, no destructured args */
+      case PNK_RETURN: /* expression closure, no destructured args */
         return functionArgs(pn, pnargs, NULL, pnbody, args) &&
                expression(pnbody->pn_kid, body);
 
-      case TOK_SEQ:    /* expression closure with destructured args */
+      case PNK_SEQ:    /* expression closure with destructured args */
       {
         ParseNode *pnstart = pnbody->pn_head->pn_next;
-        LOCAL_ASSERT(pnstart && pnstart->isKind(TOK_RETURN));
+        LOCAL_ASSERT(pnstart && pnstart->isKind(PNK_RETURN));
 
         return functionArgs(pn, pnargs, pndestruct, pnbody, args) &&
                expression(pnstart->pn_kid, body);
       }
 
-      case TOK_LC:     /* statement closure */
+      case PNK_LC:     /* statement closure */
       {
         ParseNode *pnstart = (pnbody->pn_xflags & PNX_DESTRUCT)
                                ? pnbody->pn_head->pn_next
diff --git a/js/src/jsscope.cpp b/js/src/jsscope.cpp
index 2eb94c23ac9b..0dfd6d3d2825 100644
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -214,7 +214,7 @@ PropertyTable::search(jsid id, bool adding)
 
     /* Hit: return entry. */
     shape = SHAPE_CLEAR_COLLISION(stored);
-    if (shape && shape->propid == id)
+    if (shape && shape->propid.get() == id)
         return spp;
 
     /* Collision: double hash. */
@@ -248,7 +248,7 @@ PropertyTable::search(jsid id, bool adding)
             return (adding && firstRemoved) ? firstRemoved : spp;
 
         shape = SHAPE_CLEAR_COLLISION(stored);
-        if (shape && shape->propid == id) {
+        if (shape && shape->propid.get() == id) {
             JS_ASSERT(collision_flag);
             return spp;
         }
@@ -322,8 +322,26 @@ PropertyTable::grow(JSContext *cx)
     return true;
 }
 
+void
+Shape::update(js::PropertyOp getter, js::StrictPropertyOp setter, uint8 attrs)
+{
+    if (hasGetterValue())
+        JSObject::writeBarrierPre(getterObject());
+    if (hasSetterValue())
+        JSObject::writeBarrierPre(setterObject());
+
+    this->rawGetter = getter;
+    this->rawSetter = setter;
+    this->attrs = attrs;
+
+    if (hasGetterValue())
+        JSObject::writeBarrierPost(getterObject(), this);
+    if (hasSetterValue())
+        JSObject::writeBarrierPost(setterObject(), this);
+}
+
 Shape *
-Shape::getChild(JSContext *cx, const js::Shape &child, Shape **listp)
+Shape::getChild(JSContext *cx, const js::Shape &child, HeapPtr<Shape> *listp)
 {
     JS_ASSERT(!JSID_IS_VOID(child.propid));
     JS_ASSERT(!child.inDictionary());
@@ -444,13 +462,13 @@ JSObject::getChildProperty(JSContext *cx, Shape *parent, Shape &child)
 }
 
 Shape *
-Shape::newDictionaryShape(JSContext *cx, const Shape &child, Shape **listp)
+Shape::newDictionaryShape(JSContext *cx, const Shape &child, HeapPtr<Shape> *listp)
 {
     Shape *dprop = JS_PROPERTY_TREE(cx).newShape(cx);
     if (!dprop)
         return NULL;
 
-    new (dprop) Shape(child.propid, child.rawGetter, child.rawSetter, child.slot, child.attrs,
+    new (dprop) Shape(child.propid, child.getter(), child.setter(), child.slot, child.attrs,
                       (child.flags & ~FROZEN) | IN_DICTIONARY, child.shortid,
                       js_GenerateShape(cx), child.slotSpan);
 
@@ -460,7 +478,7 @@ Shape::newDictionaryShape(JSContext *cx, const Shape &child, Shape **listp)
 }
 
 Shape *
-Shape::newDictionaryList(JSContext *cx, Shape **listp)
+Shape::newDictionaryList(JSContext *cx, HeapPtr<Shape> *listp)
 {
     Shape *shape = *listp;
     Shape *list = shape;
@@ -470,8 +488,8 @@ Shape::newDictionaryList(JSContext *cx, Shape **listp)
      * stack. This way, the GC doesn't see any intermediate state until we
      * switch listp at the end.
      */
-    Shape *root = NULL;
-    Shape **childp = &root;
+    HeapPtrShape root(NULL);
+    HeapPtrShape *childp = &root;
 
     while (shape) {
         JS_ASSERT_IF(!shape->frozen(), !shape->inDictionary());
@@ -819,9 +837,7 @@ JSObject::putProperty(JSContext *cx, jsid id,
             }
         }
 
-        shape->rawGetter = getter;
-        shape->rawSetter = setter;
-        shape->attrs = uint8(attrs);
+        shape->update(getter, setter, uint8(attrs));
         shape->flags = flags | Shape::IN_DICTIONARY;
         shape->shortid = int16(shortid);
 
@@ -900,7 +916,7 @@ JSObject::changeProperty(JSContext *cx, const Shape *shape, uintN attrs, uintN m
               !(attrs & JSPROP_SHARED));
 
     /* Don't allow method properties to be changed to have a getter. */
-    JS_ASSERT_IF(getter != shape->rawGetter, !shape->isMethod());
+    JS_ASSERT_IF(getter != shape->getter(), !shape->isMethod());
 
     types::MarkTypePropertyConfigured(cx, this, shape->propid);
     if (attrs & (JSPROP_GETTER | JSPROP_SETTER))
@@ -942,9 +958,7 @@ JSObject::changeProperty(JSContext *cx, const Shape *shape, uintN attrs, uintN m
             }
         }
 
-        mutableShape->rawGetter = getter;
-        mutableShape->rawSetter = setter;
-        mutableShape->attrs = uint8(attrs);
+        mutableShape->update(getter, setter, uint8(attrs));
 
         updateFlags(shape);
 
@@ -976,7 +990,7 @@ JSObject::changeProperty(JSContext *cx, const Shape *shape, uintN attrs, uintN m
          */
         Shape child(shape->propid, getter, setter, shape->slot, attrs, shape->flags,
                     shape->shortid);
-        newShape = putProperty(cx, child.propid, child.rawGetter, child.rawSetter, child.slot,
+        newShape = putProperty(cx, child.propid, child.getter(), child.setter(), child.slot,
                                child.attrs, child.flags, child.shortid);
     }
 
@@ -1189,16 +1203,16 @@ JSObject::methodShapeChange(JSContext *cx, const Shape &shape)
         JS_ASSERT(shape.methodObject() == prev.toObject());
         JS_ASSERT(canHaveMethodBarrier());
         JS_ASSERT(hasMethodBarrier());
-        JS_ASSERT(!shape.rawSetter);
+        JS_ASSERT(!shape.setter());
 #endif
 
         /*
-         * Pass null to make a stub getter, but pass along shape.rawSetter to
+         * Pass null to make a stub getter, but pass along shape.setter() to
          * preserve watchpoints. Clear Shape::METHOD from flags as we are
          * despecializing from a method memoized in the property tree to a
          * plain old function-valued property.
          */
-        result = putProperty(cx, shape.propid, NULL, shape.rawSetter, shape.slot,
+        result = putProperty(cx, shape.propid, NULL, shape.setter(), shape.slot,
                              shape.attrs,
                              shape.getFlags() & ~Shape::METHOD,
                              shape.shortid);
diff --git a/js/src/jsscope.h b/js/src/jsscope.h
index 3494111b8d20..b29701ebfbda 100644
--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -330,7 +330,7 @@ struct Shape : public js::gc::Cell
 
     inline void freeTable(JSContext *cx);
 
-    jsid                propid;
+    HeapId              propid;
 
   protected:
     union {
@@ -358,26 +358,27 @@ struct Shape : public js::gc::Cell
     int16               shortid;        /* tinyid, or local arg/var index */
 
   protected:
-    mutable js::Shape   *parent;        /* parent node, reverse for..in order */
+    mutable HeapPtrShape parent;        /* parent node, reverse for..in order */
     /* kids is valid when !inDictionary(), listp is valid when inDictionary(). */
     union {
         mutable js::KidsPointer kids;   /* null, single child, or a tagged ptr
                                            to many-kids data structure */
-        mutable js::Shape **listp;      /* dictionary list starting at lastProp
+        mutable HeapPtrShape *listp;    /* dictionary list starting at lastProp
                                            has a double-indirect back pointer,
                                            either to shape->parent if not last,
                                            else to obj->lastProp */
     };
 
-    static inline js::Shape **search(JSContext *cx, js::Shape **startp, jsid id,
+    static inline js::Shape **search(JSContext *cx, HeapPtr<Shape> *startp, jsid id,
                                      bool adding = false);
-    static js::Shape *newDictionaryShape(JSContext *cx, const js::Shape &child, js::Shape **listp);
-    static js::Shape *newDictionaryList(JSContext *cx, js::Shape **listp);
+    static js::Shape *newDictionaryShape(JSContext *cx, const js::Shape &child,
+                                         HeapPtr<Shape> *listp);
+    static js::Shape *newDictionaryList(JSContext *cx, HeapPtr<Shape> *listp);
 
     inline void removeFromDictionary(JSObject *obj) const;
-    inline void insertIntoDictionary(js::Shape **dictp);
+    inline void insertIntoDictionary(HeapPtr<Shape> *dictp);
 
-    js::Shape *getChild(JSContext *cx, const js::Shape &child, js::Shape **listp);
+    js::Shape *getChild(JSContext *cx, const js::Shape &child, HeapPtr<Shape> *listp);
 
     bool hashify(JSContext *cx);
 
@@ -574,6 +575,8 @@ struct Shape : public js::gc::Cell
         return hasSetterValue() && setterObj ? js::ObjectValue(*setterObj) : js::UndefinedValue();
     }
 
+    void update(js::PropertyOp getter, js::StrictPropertyOp setter, uint8 attrs);
+
     inline JSDHashNumber hash() const;
     inline bool matches(const js::Shape *p) const;
     inline bool matchesParamsAfterId(PropertyOp agetter, StrictPropertyOp asetter,
@@ -647,6 +650,16 @@ struct Shape : public js::gc::Cell
 
     void finalize(JSContext *cx);
     void removeChild(js::Shape *child);
+
+    inline static void writeBarrierPre(const js::Shape *shape);
+    inline static void writeBarrierPost(const js::Shape *shape, void *addr);
+
+    /*
+     * All weak references need a read barrier for incremental GC. This getter
+     * method implements the read barrier. It's used to obtain initial shapes
+     * from the compartment.
+     */
+    inline static void readBarrier(const js::Shape *shape);
 };
 
 struct EmptyShape : public js::Shape
@@ -662,18 +675,10 @@ struct EmptyShape : public js::Shape
         return new (eprop) EmptyShape(cx->compartment, clasp);
     }
 
-    static EmptyShape *ensure(JSContext *cx, js::Class *clasp, EmptyShape **shapep) {
-        EmptyShape *shape = *shapep;
-        if (!shape) {
-            if (!(shape = create(cx, clasp)))
-                return NULL;
-            return *shapep = shape;
-        }
-        return shape;
-    }
+    static inline EmptyShape *ensure(JSContext *cx, js::Class *clasp,
+                                     ReadBarriered<EmptyShape> *shapep);
 
     static inline EmptyShape *getEmptyArgumentsShape(JSContext *cx);
-
     static inline EmptyShape *getEmptyBlockShape(JSContext *cx);
     static inline EmptyShape *getEmptyCallShape(JSContext *cx);
     static inline EmptyShape *getEmptyDeclEnvShape(JSContext *cx);
@@ -730,7 +735,7 @@ namespace js {
  * |emptyShape| is the EmptyShape at the start of the shape lineage.
  */
 JS_ALWAYS_INLINE js::Shape **
-Shape::search(JSContext *cx, js::Shape **startp, jsid id, bool adding)
+Shape::search(JSContext *cx, HeapPtr<js::Shape> *startp, jsid id, bool adding)
 {
     js::Shape *start = *startp;
     if (start->hasTable())
@@ -757,12 +762,12 @@ Shape::search(JSContext *cx, js::Shape **startp, jsid id, bool adding)
      * the end).  This avoids an extra load per iteration at the cost (if the
      * search fails) of an extra load and id test at the end.
      */
-    js::Shape **spp;
+    HeapPtr<js::Shape> *spp;
     for (spp = startp; js::Shape *shape = *spp; spp = &shape->parent) {
-        if (shape->propid == id)
-            return spp;
+        if (shape->propid.get() == id)
+            return spp->unsafeGet();
     }
-    return spp;
+    return spp->unsafeGet();
 }
 
 } // namespace js
diff --git a/js/src/jsscopeinlines.h b/js/src/jsscopeinlines.h
index 26bb1a614bf7..9dc089f56851 100644
--- a/js/src/jsscopeinlines.h
+++ b/js/src/jsscopeinlines.h
@@ -49,6 +49,7 @@
 #include "jsobj.h"
 #include "jsscope.h"
 #include "jsgc.h"
+#include "jsgcmark.h"
 
 #include "vm/ArgumentsObject.h"
 #include "vm/StringObject.h"
@@ -83,8 +84,8 @@ js::types::TypeObject::getEmptyShape(JSContext *cx, js::Class *aclasp,
     int i = kind - js::gc::FINALIZE_OBJECT0;
 
     if (!emptyShapes) {
-        emptyShapes = (js::EmptyShape**)
-            cx->calloc_(sizeof(js::EmptyShape*) * js::gc::FINALIZE_FUNCTION_AND_OBJECT_LAST);
+        emptyShapes = (js::HeapPtr<js::EmptyShape>*)
+            cx->calloc_(sizeof(js::HeapPtr<js::EmptyShape>) * js::gc::FINALIZE_OBJECT_LIMIT);
         if (!emptyShapes)
             return NULL;
 
@@ -92,7 +93,7 @@ js::types::TypeObject::getEmptyShape(JSContext *cx, js::Class *aclasp,
          * Always fill in emptyShapes[0], so canProvideEmptyShape works.
          * Other empty shapes are filled in lazily.
          */
-        emptyShapes[0] = js::EmptyShape::create(cx, aclasp);
+        emptyShapes[0].init(js::EmptyShape::create(cx, aclasp));
         if (!emptyShapes[0]) {
             cx->free_(emptyShapes);
             emptyShapes = NULL;
@@ -103,7 +104,7 @@ js::types::TypeObject::getEmptyShape(JSContext *cx, js::Class *aclasp,
     JS_ASSERT(aclasp == emptyShapes[0]->getClass());
 
     if (!emptyShapes[i]) {
-        emptyShapes[i] = js::EmptyShape::create(cx, aclasp);
+        emptyShapes[i].init(js::EmptyShape::create(cx, aclasp));
         if (!emptyShapes[i])
             return NULL;
     }
@@ -154,15 +155,16 @@ StringObject::init(JSContext *cx, JSString *str)
 {
     JS_ASSERT(nativeEmpty());
 
-    const Shape **shapep = &cx->compartment->initialStringShape;
-    if (*shapep) {
-        setLastProperty(*shapep);
+    const Shape *shape = cx->compartment->initialStringShape;
+    if (shape) {
+        setLastProperty(shape);
     } else {
-        *shapep = assignInitialShape(cx);
-        if (!*shapep)
+        shape = assignInitialShape(cx);
+        if (!shape)
             return false;
+        cx->compartment->initialStringShape = shape;
     }
-    JS_ASSERT(*shapep == lastProperty());
+    JS_ASSERT(shape == lastProperty());
     JS_ASSERT(!nativeEmpty());
     JS_ASSERT(nativeLookup(cx, ATOM_TO_JSID(cx->runtime->atomState.lengthAtom))->slot == LENGTH_SLOT);
 
@@ -232,15 +234,15 @@ Shape::hash() const
 
     /* Accumulate from least to most random so the low bits are most random. */
     JS_ASSERT_IF(isMethod(), !rawSetter);
-    if (rawGetter)
-        hash = JS_ROTATE_LEFT32(hash, 4) ^ jsuword(rawGetter);
-    if (rawSetter)
-        hash = JS_ROTATE_LEFT32(hash, 4) ^ jsuword(rawSetter);
+    if (getter())
+        hash = JS_ROTATE_LEFT32(hash, 4) ^ jsuword(getter());
+    if (setter())
+        hash = JS_ROTATE_LEFT32(hash, 4) ^ jsuword(setter());
     hash = JS_ROTATE_LEFT32(hash, 4) ^ (flags & PUBLIC_FLAGS);
     hash = JS_ROTATE_LEFT32(hash, 4) ^ attrs;
     hash = JS_ROTATE_LEFT32(hash, 4) ^ shortid;
     hash = JS_ROTATE_LEFT32(hash, 4) ^ slot;
-    hash = JS_ROTATE_LEFT32(hash, 4) ^ JSID_BITS(propid);
+    hash = JS_ROTATE_LEFT32(hash, 4) ^ JSID_BITS(propid.get());
     return hash;
 }
 
@@ -249,8 +251,8 @@ Shape::matches(const js::Shape *other) const
 {
     JS_ASSERT(!JSID_IS_VOID(propid));
     JS_ASSERT(!JSID_IS_VOID(other->propid));
-    return propid == other->propid &&
-           matchesParamsAfterId(other->rawGetter, other->rawSetter, other->slot, other->attrs,
+    return propid.get() == other->propid.get() &&
+           matchesParamsAfterId(other->getter(), other->setter(), other->slot, other->attrs,
                                 other->flags, other->shortid);
 }
 
@@ -259,8 +261,8 @@ Shape::matchesParamsAfterId(PropertyOp agetter, StrictPropertyOp asetter, uint32
                             uintN aattrs, uintN aflags, intN ashortid) const
 {
     JS_ASSERT(!JSID_IS_VOID(propid));
-    return rawGetter == agetter &&
-           rawSetter == asetter &&
+    return getter() == agetter &&
+           setter() == asetter &&
            slot == aslot &&
            attrs == aattrs &&
            ((flags ^ aflags) & PUBLIC_FLAGS) == 0 &&
@@ -333,7 +335,7 @@ Shape::removeFromDictionary(JSObject *obj) const
 }
 
 inline void
-Shape::insertIntoDictionary(js::Shape **dictp)
+Shape::insertIntoDictionary(HeapPtr<js::Shape> *dictp)
 {
     /*
      * Don't assert inDictionaryMode() here because we may be called from
@@ -361,6 +363,18 @@ EmptyShape::EmptyShape(JSCompartment *comp, js::Class *aclasp)
   : js::Shape(comp, aclasp)
 {}
 
+/* static */ inline EmptyShape *
+EmptyShape::ensure(JSContext *cx, js::Class *clasp, ReadBarriered<EmptyShape> *shapep)
+{
+    EmptyShape *shape = shapep->get();
+    if (!shape) {
+        if (!(shape = create(cx, clasp)))
+            return NULL;
+        shapep->set(shape);
+    }
+    return shape;
+}
+
 /* static */ inline EmptyShape *
 EmptyShape::getEmptyArgumentsShape(JSContext *cx)
 {
@@ -397,6 +411,34 @@ EmptyShape::getEmptyWithShape(JSContext *cx)
     return ensure(cx, &WithClass, &cx->compartment->emptyWithShape);
 }
 
+inline void
+Shape::writeBarrierPre(const js::Shape *shape)
+{
+#ifdef JSGC_INCREMENTAL
+    if (!shape || shape == &sharedNonNative)
+        return;
+
+    JSCompartment *comp = shape->compartment();
+    if (comp->needsBarrier())
+        MarkShapeUnbarriered(comp->barrierTracer(), shape, "write barrier");
+#endif
+}
+
+inline void
+Shape::writeBarrierPost(const js::Shape *shape, void *addr)
+{
+}
+
+inline void
+Shape::readBarrier(const js::Shape *shape)
+{
+#ifdef JSGC_INCREMENTAL
+    JSCompartment *comp = shape->compartment();
+    if (comp->needsBarrier())
+        MarkShapeUnbarriered(comp->barrierTracer(), shape, "read barrier");
+#endif
+}
+
 } /* namespace js */
 
 #endif /* jsscopeinlines_h___ */
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 7d1a2b0611d2..d95b73d2723b 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -91,7 +91,7 @@ Bindings::lookup(JSContext *cx, JSAtom *name, uintN *indexp) const
         return NONE;
 
     Shape *shape =
-        SHAPE_FETCH(Shape::search(cx, const_cast<Shape **>(&lastBinding),
+        SHAPE_FETCH(Shape::search(cx, const_cast<HeapPtr<Shape> *>(&lastBinding),
                     ATOM_TO_JSID(name)));
     if (!shape)
         return NONE;
@@ -195,7 +195,7 @@ Bindings::getLocalNameArray(JSContext *cx, Vector<JSAtom *> *namesp)
         names[i] = POISON;
 #endif
 
-    for (Shape::Range r = lastBinding; !r.empty(); r.popFront()) {
+    for (Shape::Range r = lastBinding->all(); !r.empty(); r.popFront()) {
         const Shape &shape = r.front();
         uintN index = uint16(shape.shortid);
 
@@ -644,7 +644,7 @@ js_XDRScript(JSXDRState *xdr, JSScript **scriptp)
      * to restore the parent chain.
      */
     for (i = 0; i != nobjects; ++i) {
-        JSObject **objp = &script->objects()->vector[i];
+        HeapPtr<JSObject> *objp = &script->objects()->vector[i];
         uint32 isBlock;
         if (xdr->mode == JSXDR_ENCODE) {
             Class *clasp = (*objp)->getClass();
@@ -654,22 +654,26 @@ js_XDRScript(JSXDRState *xdr, JSScript **scriptp)
         }
         if (!JS_XDRUint32(xdr, &isBlock))
             goto error;
+        JSObject *tmp = *objp;
         if (isBlock == 0) {
-            if (!js_XDRFunctionObject(xdr, objp))
+            if (!js_XDRFunctionObject(xdr, &tmp))
                 goto error;
         } else {
             JS_ASSERT(isBlock == 1);
-            if (!js_XDRBlockObject(xdr, objp))
+            if (!js_XDRBlockObject(xdr, &tmp))
                 goto error;
         }
+        *objp = tmp;
     }
     for (i = 0; i != nupvars; ++i) {
         if (!JS_XDRUint32(xdr, reinterpret_cast<uint32 *>(&script->upvars()->vector[i])))
             goto error;
     }
     for (i = 0; i != nregexps; ++i) {
-        if (!js_XDRRegExpObject(xdr, &script->regexps()->vector[i]))
+        JSObject *tmp = script->regexps()->vector[i];
+        if (!js_XDRRegExpObject(xdr, &tmp))
             goto error;
+        script->regexps()->vector[i] = tmp;
     }
     for (i = 0; i != nClosedArgs; ++i) {
         if (!JS_XDRUint32(xdr, &script->closedSlots[i]))
@@ -712,10 +716,15 @@ js_XDRScript(JSXDRState *xdr, JSScript **scriptp)
     }
 
     for (i = 0; i != nconsts; ++i) {
-        if (!JS_XDRValue(xdr, &script->consts()->vector[i]))
+        Value tmp = script->consts()->vector[i];
+        if (!JS_XDRValue(xdr, &tmp))
             goto error;
+        script->consts()->vector[i] = tmp;
     }
 
+    if (xdr->mode == JSXDR_DECODE && cx->hasRunOption(JSOPTION_PCCOUNT))
+        (void) script->initCounts(cx);
+
     xdr->script = oldscript;
     return JS_TRUE;
 
@@ -729,25 +738,55 @@ js_XDRScript(JSXDRState *xdr, JSScript **scriptp)
 #endif /* JS_HAS_XDR */
 
 bool
-JSPCCounters::init(JSContext *cx, size_t numBytecodes)
+JSScript::initCounts(JSContext *cx)
 {
-    this->numBytecodes = numBytecodes;
-    size_t nbytes = sizeof(*counts) * numBytecodes * NUM_COUNTERS;
-    counts = (double*) cx->calloc_(nbytes);
-    if (!counts)
+    JS_ASSERT(!pcCounters);
+
+    size_t count = 0;
+
+    jsbytecode *pc, *next;
+    for (pc = code; pc < code + length; pc = next) {
+        analyze::UntrapOpcode untrap(cx, this, pc);
+        count += OpcodeCounts::numCounts(JSOp(*pc));
+        next = pc + analyze::GetBytecodeLength(pc);
+    }
+
+    size_t bytes = (length * sizeof(OpcodeCounts)) + (count * sizeof(double));
+    char *cursor = (char *) cx->calloc_(bytes);
+    if (!cursor)
         return false;
+
+    DebugOnly<char *> base = cursor;
+
+    pcCounters.counts = (OpcodeCounts *) cursor;
+    cursor += length * sizeof(OpcodeCounts);
+
+    for (pc = code; pc < code + length; pc = next) {
+        analyze::UntrapOpcode untrap(cx, this, pc);
+        pcCounters.counts[pc - code].counts = (double *) cursor;
+        size_t capacity = OpcodeCounts::numCounts(JSOp(*pc));
+#ifdef DEBUG
+        pcCounters.counts[pc - code].capacity = capacity;
+#endif
+        cursor += capacity * sizeof(double);
+        next = pc + analyze::GetBytecodeLength(pc);
+    }
+
+    JS_ASSERT(size_t(cursor - base) == bytes);
+
     return true;
 }
 
 void
-JSPCCounters::destroy(JSContext *cx)
+JSScript::destroyCounts(JSContext *cx)
 {
-    if (counts) {
-        cx->free_(counts);
-        counts = NULL;
+    if (pcCounters) {
+        cx->free_(pcCounters.counts);
+        pcCounters.counts = NULL;
     }
 }
 
+
 /*
  * Shared script filename management.
  */
@@ -936,9 +975,6 @@ JSScript::NewScript(JSContext *cx, uint32 length, uint32 nsrcnotes, uint32 natom
     script->version = version;
     new (&script->bindings) Bindings(cx);
 
-    if (cx->hasRunOption(JSOPTION_PCCOUNT))
-        (void) script->pcCounters.init(cx, length);
-
     uint8 *cursor = data;
     if (nobjects != 0) {
         script->objectsOffset = (uint8)(cursor - data);
@@ -988,7 +1024,7 @@ JSScript::NewScript(JSContext *cx, uint32 length, uint32 nsrcnotes, uint32 natom
     if (nconsts != 0) {
         JS_ASSERT(reinterpret_cast<jsuword>(cursor) % sizeof(jsval) == 0);
         script->consts()->length = nconsts;
-        script->consts()->vector = reinterpret_cast<Value *>(cursor);
+        script->consts()->vector = (HeapValue *)cursor;
         cursor += nconsts * sizeof(script->consts()->vector[0]);
     }
 
@@ -1000,13 +1036,13 @@ JSScript::NewScript(JSContext *cx, uint32 length, uint32 nsrcnotes, uint32 natom
 
     if (nobjects != 0) {
         script->objects()->length = nobjects;
-        script->objects()->vector = reinterpret_cast<JSObject **>(cursor);
+        script->objects()->vector = (HeapPtr<JSObject> *)cursor;
         cursor += nobjects * sizeof(script->objects()->vector[0]);
     }
 
     if (nregexps != 0) {
         script->regexps()->length = nregexps;
-        script->regexps()->vector = reinterpret_cast<JSObject **>(cursor);
+        script->regexps()->vector = (HeapPtr<JSObject> *)cursor;
         cursor += nregexps * sizeof(script->regexps()->vector[0]);
     }
 
@@ -1202,14 +1238,14 @@ JSScript::NewScriptFromEmitter(JSContext *cx, BytecodeEmitter *bce)
             return NULL;
 
         fun->setScript(script);
-        script->u.globalObject = fun->getParent() ? fun->getParent()->getGlobal() : NULL;
+        script->globalObject = fun->getParent() ? fun->getParent()->getGlobal() : NULL;
     } else {
         /*
          * Initialize script->object, if necessary, so that the debugger has a
          * valid holder object.
          */
         if (bce->flags & TCF_NEED_SCRIPT_GLOBAL)
-            script->u.globalObject = GetCurrentGlobal(cx);
+            script->globalObject = GetCurrentGlobal(cx);
     }
 
     /* Tell the debugger about this compiled script. */
@@ -1217,13 +1253,16 @@ JSScript::NewScriptFromEmitter(JSContext *cx, BytecodeEmitter *bce)
     if (!bce->parent) {
         GlobalObject *compileAndGoGlobal = NULL;
         if (script->compileAndGo) {
-            compileAndGoGlobal = script->u.globalObject;
+            compileAndGoGlobal = script->globalObject;
             if (!compileAndGoGlobal)
                 compileAndGoGlobal = bce->scopeChain()->getGlobal();
         }
         Debugger::onNewScript(cx, script, compileAndGoGlobal);
     }
 
+    if (cx->hasRunOption(JSOPTION_PCCOUNT))
+        (void) script->initCounts(cx);
+
     return script;
 }
 
@@ -1312,7 +1351,7 @@ JSScript::finalize(JSContext *cx)
     mjit::ReleaseScriptCode(cx, this);
 #endif
 
-    pcCounters.destroy(cx);
+    destroyCounts(cx);
 
     if (sourceMap)
         cx->free_(sourceMap);
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index c7c56a4bb2a3..7f3ebfc5dceb 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -49,6 +49,8 @@
 #include "jsclist.h"
 #include "jsinfer.h"
 
+#include "gc/Barrier.h"
+
 /*
  * Type of try note associated with each catch or finally block, and also with
  * for-in loops.
@@ -132,7 +134,7 @@ typedef struct JSTryNoteArray {
 } JSTryNoteArray;
 
 typedef struct JSObjectArray {
-    JSObject        **vector;   /* array of indexed objects */
+    js::HeapPtrObject *vector;  /* array of indexed objects */
     uint32          length;     /* count of indexed objects */
 } JSObjectArray;
 
@@ -142,7 +144,7 @@ typedef struct JSUpvarArray {
 } JSUpvarArray;
 
 typedef struct JSConstArray {
-    js::Value       *vector;    /* array of indexed constant values */
+    js::HeapValue   *vector;    /* array of indexed constant values */
     uint32          length;
 } JSConstArray;
 
@@ -168,17 +170,15 @@ enum BindingKind { NONE, ARGUMENT, VARIABLE, CONSTANT, UPVAR };
  * strict mode eval code, to give such code its own lexical environment).
  */
 class Bindings {
-    js::Shape *lastBinding;
+    HeapPtr<Shape> lastBinding;
     uint16 nargs;
     uint16 nvars;
     uint16 nupvars;
     bool hasExtensibleParents;
 
   public:
-    inline Bindings(JSContext *cx)
-        : lastBinding(NULL), nargs(0), nvars(0), nupvars(0), hasExtensibleParents(false)
-    {
-    }
+    inline Bindings(JSContext *cx);
+    inline ~Bindings();
 
     /*
      * Transfers ownership of bindings data from bindings into this fresh
@@ -379,51 +379,32 @@ enum JITScriptStatus {
 namespace js { namespace mjit { struct JITScript; } }
 #endif
 
-namespace js { namespace analyze { class ScriptAnalysis; } }
+namespace js {
 
-class JSPCCounters {
-    size_t numBytecodes;
-    double *counts;
+namespace analyze { class ScriptAnalysis; }
+
+class ScriptOpcodeCounts
+{
+    friend struct ::JSScript;
+    OpcodeCounts *counts;
 
  public:
 
-    enum {
-        INTERP = 0,
-        TRACEJIT,
-        METHODJIT,
-        METHODJIT_STUBS,
-        METHODJIT_CODE,
-        METHODJIT_PICS,
-        NUM_COUNTERS
-    };
-
-    JSPCCounters() : numBytecodes(0), counts(NULL) {
+    ScriptOpcodeCounts() : counts(NULL) {
     }
 
-    ~JSPCCounters() {
+    ~ScriptOpcodeCounts() {
         JS_ASSERT(!counts);
     }
 
-    bool init(JSContext *cx, size_t numBytecodes);
-    void destroy(JSContext *cx);
-
     // Boolean conversion, for 'if (counters) ...'
     operator void*() const {
         return counts;
     }
-
-    double *get(int runmode) {
-        JS_ASSERT(runmode >= 0 && runmode < NUM_COUNTERS);
-        return counts ? &counts[numBytecodes * runmode] : NULL;
-    }
-
-    double& get(int runmode, size_t offset) {
-        JS_ASSERT(offset < numBytecodes);
-        JS_ASSERT(counts);
-        return get(runmode)[offset];
-    }
 };
 
+} /* namespace js */
+
 static const uint32 JS_SCRIPT_COOKIE = 0xc00cee;
 
 struct JSScript : public js::gc::Cell {
@@ -539,10 +520,8 @@ struct JSScript : public js::gc::Cell {
      * the script with 4 bytes. We use them to store tiny scripts like empty
      * scripts.
      */
-#if JS_BITS_PER_WORD == 64
 #define JS_SCRIPT_INLINE_DATA_LIMIT 4
     uint8           inlineData[JS_SCRIPT_INLINE_DATA_LIMIT];
-#endif
 
     const char      *filename;  /* source filename or null */
     JSAtom          **atoms;    /* maps immediate index to literal struct */
@@ -556,28 +535,26 @@ struct JSScript : public js::gc::Cell {
     JSPrincipals    *principals;/* principals for this script */
     jschar          *sourceMap; /* source map file or null */
 
-    union {
-        /*
-         * A global object for the script.
-         * - All scripts returned by JSAPI functions (JS_CompileScript,
-         *   JS_CompileFile, etc.) have a non-null globalObject.
-         * - A function script has a globalObject if the function comes from a
-         *   compile-and-go script.
-         * - Temporary scripts created by obj_eval, JS_EvaluateScript, and
-         *   similar functions never have the globalObject field set; for such
-         *   scripts the global should be extracted from the JS frame that
-         *   execute scripts.
-         */
-        js::GlobalObject    *globalObject;
+    /*
+     * A global object for the script.
+     * - All scripts returned by JSAPI functions (JS_CompileScript,
+     *   JS_CompileFile, etc.) have a non-null globalObject.
+     * - A function script has a globalObject if the function comes from a
+     *   compile-and-go script.
+     * - Temporary scripts created by obj_eval, JS_EvaluateScript, and
+     *   similar functions never have the globalObject field set; for such
+     *   scripts the global should be extracted from the JS frame that
+     *   execute scripts.
+     */
+    js::HeapPtr<js::GlobalObject, JSScript*> globalObject;
 
-        /* Hash table chaining for JSCompartment::evalCache. */
-        JSScript            *evalHashLink;
-    } u;
+    /* Hash table chaining for JSCompartment::evalCache. */
+    JSScript        *&evalHashLink() { return *globalObject.unsafeGetUnioned(); }
 
     uint32          *closedSlots; /* vector of closed slots; args first, then vars. */
 
-    /* array of execution counters for every JSOp in the script, by runmode */
-    JSPCCounters    pcCounters;
+    /* Execution and profiling information for JIT code in the script. */
+    js::ScriptOpcodeCounts pcCounters;
 
 #ifdef JS_CRASH_DIAGNOSTICS
     /* All diagnostic fields must be multiples of Cell::CellSize. */
@@ -634,7 +611,7 @@ struct JSScript : public js::gc::Cell {
 
     /* Return creation time global or null. */
     js::GlobalObject *getGlobalObjectOrNull() const {
-        return isCachedEval ? NULL : u.globalObject;
+        return isCachedEval ? NULL : globalObject.get();
     }
 
   private:
@@ -687,6 +664,15 @@ struct JSScript : public js::gc::Cell {
 
 #endif
 
+    /* Counter accessors. */
+    js::OpcodeCounts getCounts(jsbytecode *pc) {
+        JS_ASSERT(unsigned(pc - code) < length);
+        return pcCounters.counts[pc - code];
+    }
+
+    bool initCounts(JSContext *cx);
+    void destroyCounts(JSContext *cx);
+
     jsbytecode *main() {
         return code + mainOffset;
     }
@@ -818,6 +804,9 @@ struct JSScript : public js::gc::Cell {
 #endif
 
     void finalize(JSContext *cx);
+
+    static inline void writeBarrierPre(JSScript *script);
+    static inline void writeBarrierPost(JSScript *script, void *addr);
 };
 
 JS_STATIC_ASSERT(sizeof(JSScript) % js::gc::Cell::CellSize == 0);
diff --git a/js/src/jsscriptinlines.h b/js/src/jsscriptinlines.h
index 4eaa0f5db024..e2db5d2d0475 100644
--- a/js/src/jsscriptinlines.h
+++ b/js/src/jsscriptinlines.h
@@ -1,4 +1,4 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sw=4 et tw=79 ft=cpp:
  *
  * ***** BEGIN LICENSE BLOCK *****
@@ -55,6 +55,17 @@
 
 namespace js {
 
+inline
+Bindings::Bindings(JSContext *cx)
+    : nargs(0), nvars(0), nupvars(0), hasExtensibleParents(false)
+{
+}
+
+inline
+Bindings::~Bindings()
+{
+}
+
 inline void
 Bindings::transfer(JSContext *cx, Bindings *bindings)
 {
@@ -215,4 +226,24 @@ JSScript::clearNesting()
     }
 }
 
+inline void
+JSScript::writeBarrierPre(JSScript *script)
+{
+#ifdef JSGC_INCREMENTAL
+    if (!script)
+        return;
+
+    JSCompartment *comp = script->compartment();
+    if (comp->needsBarrier()) {
+        JS_ASSERT(!comp->rt->gcRunning);
+        MarkScriptUnbarriered(comp->barrierTracer(), script, "write barrier");
+    }
+#endif
+}
+
+inline void
+JSScript::writeBarrierPost(JSScript *script, void *addr)
+{
+}
+
 #endif /* jsscriptinlines_h___ */
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index b6f4108bce86..dc2cd61a71fc 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -1271,38 +1271,33 @@ class FlatMatch
  */
 class RegExpPair
 {
-    JSContext                   *cx;
-    AutoRefCount<RegExpPrivate> rep_;
-    RegExpObject                *reobj_;
+    JSContext               *cx;
+    mutable RegExpMatcher   matcher_;
+    RegExpObject            *reobj_;
 
-    explicit RegExpPair(RegExpPair &);
-    void operator=(const RegExpPair &);
+    explicit RegExpPair(RegExpPair &) MOZ_DELETE;
+    void operator=(const RegExpPair &) MOZ_DELETE;
 
   public:
-    explicit RegExpPair(JSContext *cx) : cx(cx), rep_(cx) {}
+    explicit RegExpPair(JSContext *cx) : cx(cx), matcher_(cx) {}
 
-    bool resetWithObject(JSContext *cx, RegExpObject *reobj) {
-        JS_ASSERT(cx == this->cx);
+    bool reset(RegExpObject *reobj) {
         reobj_ = reobj;
-        RegExpPrivate *rep = reobj_->asRegExp()->getOrCreatePrivate(cx);
-        if (!rep)
-            return false;
-        rep_.reset(NeedsIncRef<RegExpPrivate>(rep));
-        return true;
+        return matcher_.reset(reobj);
     }
 
-    void resetWithPrivate(AlreadyIncRefed<RegExpPrivate> rep) {
+    bool reset(JSLinearString *patstr, JSString *opt) {
         reobj_ = NULL;
-        rep_.reset(rep);
+        return matcher_.reset(patstr, opt);
     }
 
-    bool null() const { return rep_.null(); }
+    bool null() const { return matcher_.null(); }
 
     RegExpObject *reobj() const { return reobj_; }
 
-    RegExpPrivate *getPrivate() const {
+    RegExpMatcher &matcher() const {
         JS_ASSERT(!null());
-        return rep_.get();
+        return matcher_;
     }
 };
 
@@ -1356,7 +1351,8 @@ class RegExpGuard
     init(uintN argc, Value *vp, bool convertVoid = false)
     {
         if (argc != 0 && ValueIsRegExp(vp[2])) {
-            rep.resetWithObject(cx, vp[2].toObject().asRegExp());
+            if (!rep.reset(vp[2].toObject().asRegExp()))
+                return false;
         } else {
             if (convertVoid && (argc == 0 || vp[2].isUndefined())) {
                 fm.patstr = cx->runtime->emptyString;
@@ -1440,10 +1436,9 @@ class RegExpGuard
         }
         JS_ASSERT(patstr);
 
-        AlreadyIncRefed<RegExpPrivate> re = RegExpPrivate::create(cx, patstr, opt, NULL);
-        if (!re)
+        if (!rep.reset(patstr, opt))
             return NULL;
-        rep.resetWithPrivate(re);
+
         return &rep;
     }
 
@@ -1480,21 +1475,21 @@ static bool
 DoMatch(JSContext *cx, RegExpStatics *res, JSString *str, const RegExpPair &regExpPair,
         DoMatchCallback callback, void *data, MatchControlFlags flags, Value *rval)
 {
-    RegExpPrivate *rep = regExpPair.getPrivate();
+    RegExpMatcher &matcher = regExpPair.matcher();
     JSLinearString *linearStr = str->ensureLinear(cx);
     if (!linearStr)
         return false;
     const jschar *chars = linearStr->chars();
     size_t length = linearStr->length();
 
-    if (rep->global()) {
+    if (matcher.global()) {
         /* global matching ('g') */
         RegExpExecType type = (flags & TEST_GLOBAL_BIT) ? RegExpTest : RegExpExec;
         if (RegExpObject *reobj = regExpPair.reobj())
             reobj->zeroLastIndex();
 
         for (size_t count = 0, i = 0, length = str->length(); i <= length; ++count) {
-            if (!ExecuteRegExp(cx, res, rep, linearStr, chars, length, &i, type, rval))
+            if (!ExecuteRegExp(cx, res, matcher, linearStr, chars, length, &i, type, rval))
                 return false;
             if (!Matched(type, *rval))
                 break;
@@ -1508,7 +1503,7 @@ DoMatch(JSContext *cx, RegExpStatics *res, JSString *str, const RegExpPair &regE
         RegExpExecType type = (flags & TEST_SINGLE_BIT) ? RegExpTest : RegExpExec;
         bool callbackOnSingle = !!(flags & CALLBACK_ON_SINGLE_BIT);
         size_t i = 0;
-        if (!ExecuteRegExp(cx, res, rep, linearStr, chars, length, &i, type, rval))
+        if (!ExecuteRegExp(cx, res, matcher, linearStr, chars, length, &i, type, rval))
             return false;
         if (callbackOnSingle && Matched(type, *rval) && !callback(cx, res, 0, data))
             return false;
@@ -1583,7 +1578,7 @@ js::str_match(JSContext *cx, uintN argc, Value *vp)
     if (!DoMatch(cx, res, str, *rep, MatchCallback, arg, MATCH_ARGS, &rval))
         return false;
 
-    if (rep->getPrivate()->global())
+    if (rep->matcher().global())
         vp->setObjectOrNull(array.object());
     else
         *vp = rval;
@@ -1619,7 +1614,7 @@ js::str_search(JSContext *cx, uintN argc, Value *vp)
     RegExpStatics *res = cx->regExpStatics();
     /* Per ECMAv5 15.5.4.12 (5) The last index property is ignored and left unchanged. */
     size_t i = 0;
-    if (!ExecuteRegExp(cx, res, rep->getPrivate(), linearStr, chars, length, &i, RegExpTest, vp))
+    if (!ExecuteRegExp(cx, res, rep->matcher(), linearStr, chars, length, &i, RegExpTest, vp))
         return false;
 
     if (vp->isTrue())
@@ -1791,8 +1786,7 @@ FindReplaceLength(JSContext *cx, RegExpStatics *res, ReplaceData &rdata, size_t
         if (!args.pushed() && !cx->stack.pushInvokeArgs(cx, argc, &args))
             return false;
 
-        args.calleeHasBeenReset();
-        args.calleev() = ObjectValue(*lambda);
+        args.setCallee(ObjectValue(*lambda));
         args.thisv() = UndefinedValue();
 
         /* Push $&, $1, $2, ... */
@@ -2408,11 +2402,11 @@ SplitHelper(JSContext *cx, JSLinearString *str, uint32 limit, Matcher splitMatch
  */
 class SplitRegExpMatcher {
     RegExpStatics *res;
-    RegExpPrivate *rep;
+    RegExpMatcher &matcher;
 
   public:
     static const bool returnsCaptures = true;
-    SplitRegExpMatcher(RegExpPrivate *rep, RegExpStatics *res) : res(res), rep(rep) {}
+    SplitRegExpMatcher(RegExpMatcher &matcher, RegExpStatics *res) : res(res), matcher(matcher) {}
 
     inline bool operator()(JSContext *cx, JSLinearString *str, size_t index,
                            SplitMatchResult *result) {
@@ -2423,7 +2417,7 @@ class SplitRegExpMatcher {
         ;
         const jschar *chars = str->chars();
         size_t length = str->length();
-        if (!ExecuteRegExp(cx, res, rep, str, chars, length, &index, RegExpTest, &rval))
+        if (!ExecuteRegExp(cx, res, matcher, str, chars, length, &index, RegExpTest, &rval))
             return false;
         if (!rval.isTrue()) {
             result->setFailure();
@@ -2487,13 +2481,13 @@ js::str_split(JSContext *cx, uintN argc, Value *vp)
     }
 
     /* Step 8. */
-    RegExpPrivate *re = NULL;
+    RegExpMatcher matcher(cx);
     JSLinearString *sepstr = NULL;
     bool sepUndefined = (argc == 0 || vp[2].isUndefined());
     if (!sepUndefined) {
         if (ValueIsRegExp(vp[2])) {
-            re = vp[2].toObject().asRegExp()->getOrCreatePrivate(cx);
-            if (!re)
+            RegExpObject *reobj = vp[2].toObject().asRegExp();
+            if (!matcher.reset(reobj))
                 return false;
         } else {
             JSString *sep = js_ValueToString(cx, vp[2]);
@@ -2533,11 +2527,12 @@ js::str_split(JSContext *cx, uintN argc, Value *vp)
 
     /* Steps 11-15. */
     JSObject *aobj;
-    if (re) {
-        aobj = SplitHelper(cx, strlin, limit, SplitRegExpMatcher(re, cx->regExpStatics()), type);
-    } else {
+    if (matcher.null()) {
         // NB: sepstr is anchored through its storage in vp[2].
         aobj = SplitHelper(cx, strlin, limit, SplitStringMatcher(sepstr), type);
+    } else {
+        aobj = SplitHelper(cx, strlin, limit,
+                           SplitRegExpMatcher(matcher, cx->regExpStatics()), type);
     }
     if (!aobj)
         return false;
diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 662a94c4eb35..6695a8f0bf18 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -1883,7 +1883,7 @@ public:
     {}
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE void
-    visitGlobalSlot(Value *vp, unsigned n, unsigned slot) {
+    visitGlobalSlot(HeapValue *vp, unsigned n, unsigned slot) {
             JSValueType type = getCoercedType(*vp);
             if (type == JSVAL_TYPE_INT32 && (!mOracle || mOracle->isGlobalSlotUndemotable(mCx, slot)))
                 type = JSVAL_TYPE_DOUBLE;
@@ -2475,6 +2475,13 @@ TraceRecorder::w_immpIdGC(jsid id)
 
 ptrdiff_t
 TraceRecorder::nativeGlobalSlot(const Value* p) const
+{
+    JS_ASSERT(isGlobal(p));
+    return ptrdiff_t(p - Valueify(globalObj->slots) + globalObj->numFixedSlots());
+}
+
+ptrdiff_t
+TraceRecorder::nativeGlobalSlot(const HeapValue* p) const
 {
     JS_ASSERT(isGlobal(p));
     return ptrdiff_t(p - globalObj->slots + globalObj->numFixedSlots());
@@ -2491,7 +2498,15 @@ TraceRecorder::nativeGlobalOffset(const Value* p) const
 bool
 TraceRecorder::isGlobal(const Value* p) const
 {
-    return (size_t(p - globalObj->slots) < globalObj->numSlots() - globalObj->numFixedSlots());
+    return (size_t(p - Valueify(globalObj->slots)) <
+            globalObj->numSlots() - globalObj->numFixedSlots());
+}
+
+bool
+TraceRecorder::isGlobal(const HeapValue* p) const
+{
+    return (size_t(p - globalObj->slots) <
+            globalObj->numSlots() - globalObj->numFixedSlots());
 }
 
 bool
@@ -2719,7 +2734,7 @@ HasUnreachableGCThings(JSContext *cx, TreeFragment *f)
     for (unsigned len = f->gcthings.length(); len; --len) {
         Value &v = *vp++;
         JS_ASSERT(v.isMarkable());
-        if (IsAboutToBeFinalized(cx, v.toGCThing()))
+        if (IsAboutToBeFinalized(cx, v))
             return true;
     }
     const Shape** shapep = f->shapes.data();
@@ -2861,31 +2876,46 @@ TraceMonitor::mark(JSTracer *trc)
     TracerState* state = tracerState;
     while (state) {
         if (state->nativeVp)
-            MarkValueRange(trc, state->nativeVpLen, state->nativeVp, "nativeVp");
+            MarkRootRange(trc, state->nativeVpLen, state->nativeVp, "nativeVp");
         state = state->prev;
     }
 }
 
+template<class VALUE>
+static void
+SetValue(JSCompartment *comp, VALUE& dst, const Value &src)
+{
+    dst = src;
+}
+
+template<>
+void
+SetValue(JSCompartment *comp, HeapValue& dst, const Value &src)
+{
+    dst.set(comp, src);
+}
+
 /*
  * Box a value from the native stack back into the Value format.
  */
+template<typename VALUE>
 static inline void
-NativeToValue(JSContext* cx, Value& v, JSValueType type, double* slot)
+NativeToValue(JSContext* cx, VALUE& v, JSValueType type, double* slot)
 {
     if (type == JSVAL_TYPE_DOUBLE) {
-        v = NumberValue(*slot);
+        SetValue(cx->compartment, v, NumberValue(*slot));
     } else if (JS_LIKELY(type <= JSVAL_UPPER_INCL_TYPE_OF_BOXABLE_SET)) {
         v.boxNonDoubleFrom(type, (uint64 *)slot);
     } else if (type == JSVAL_TYPE_STRORNULL) {
         JSString *str = *(JSString **)slot;
-        v = str ? StringValue(str) : NullValue();
+        SetValue(cx->compartment, v, str ? StringValue(str) : NullValue());
     } else if (type == JSVAL_TYPE_OBJORNULL) {
         JSObject *obj = *(JSObject **)slot;
-        v = obj ? ObjectValue(*obj) : NullValue();
+        SetValue(cx->compartment, v, obj ? ObjectValue(*obj) : NullValue());
     } else {
         JS_ASSERT(type == JSVAL_TYPE_BOXED);
         JS_STATIC_ASSERT(sizeof(Value) == sizeof(double));
-        v = *(Value *)slot;
+        SetValue(cx->compartment, v, *(Value *)slot);
     }
 
 #ifdef DEBUG
@@ -2974,7 +3004,7 @@ public:
     {}
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE void
-    visitGlobalSlot(Value *vp, unsigned n, unsigned slot) {
+    visitGlobalSlot(HeapValue *vp, unsigned n, unsigned slot) {
         debug_only_printf(LC_TMTracer, "global%d: ", n);
         ValueToNative(*vp, *mTypeMap++, &mGlobal[slot]);
     }
@@ -3038,7 +3068,7 @@ public:
     {}
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE void
-    visitGlobalSlot(Value *vp, unsigned n, unsigned slot) {
+    visitGlobalSlot(HeapValue *vp, unsigned n, unsigned slot) {
         debug_only_printf(LC_TMTracer, "global%d=", n);
         JS_ASSERT(JS_THREAD_DATA(mCx)->waiveGCQuota);
         NativeToValue(mCx, *vp, *mTypeMap++, &mGlobal[slot]);
@@ -3840,6 +3870,12 @@ TraceRecorder::get(const Value *p)
     return getImpl(p);
 }
 
+JS_REQUIRES_STACK LIns*
+TraceRecorder::get(const HeapValue *p)
+{
+    return getImpl(p);
+}
+
 #ifdef DEBUG
 bool
 TraceRecorder::isValidFrameObjPtr(void *p)
@@ -3896,17 +3932,17 @@ JS_REQUIRES_STACK void
 TraceRecorder::checkForGlobalObjectReallocationHelper()
 {
     debug_only_print0(LC_TMTracer, "globalObj->slots relocated, updating tracker\n");
-    const Value* src = global_slots;
-    const Value* dst = globalObj->getRawSlots();
+    const HeapValue* src = global_slots;
+    const HeapValue* dst = globalObj->getRawSlots();
     jsuint length = globalObj->capacity;
     LIns** map = (LIns**)alloca(sizeof(LIns*) * length);
     for (jsuint n = 0; n < length; ++n) {
-        const Value *slot = globalObj->getRawSlot(n, src);
+        const HeapValue *slot = globalObj->getRawSlot(n, src);
         map[n] = tracker.get(slot);
         tracker.set(slot, NULL);
     }
     for (jsuint n = 0; n < length; ++n) {
-        const Value *slot = globalObj->getRawSlot(n, dst);
+        const HeapValue *slot = globalObj->getRawSlot(n, dst);
         tracker.set(slot, map[n]);
     }
     global_slots = globalObj->getRawSlots();
@@ -3951,12 +3987,12 @@ public:
     }
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE void
-    visitGlobalSlot(Value *vp, unsigned n, unsigned slot) {
+    visitGlobalSlot(HeapValue *vp, unsigned n, unsigned slot) {
         LIns *ins = mRecorder.get(vp);
         bool isPromote = IsPromotedInt32(ins);
         if (isPromote && *mTypeMap == JSVAL_TYPE_DOUBLE) {
             mRecorder.w.st(mRecorder.get(vp),
-                           EosAddress(mRecorder.eos_ins, mRecorder.nativeGlobalOffset(vp)));
+                           EosAddress(mRecorder.eos_ins, mRecorder.nativeGlobalOffset(&vp->get())));
             /*
              * Aggressively undo speculation so the inner tree will compile
              * if this fails.
@@ -4039,7 +4075,7 @@ TraceRecorder::adjustCallerTypes(TreeFragment* f)
 }
 
 JS_REQUIRES_STACK inline JSValueType
-TraceRecorder::determineSlotType(Value* vp)
+TraceRecorder::determineSlotType(const Value* vp)
 {
     if (vp->isNumber()) {
         LIns *i = getFromTracker(vp);
@@ -4074,8 +4110,8 @@ public:
     {}
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE void
-    visitGlobalSlot(Value *vp, unsigned n, unsigned slot) {
-        *mTypeMap++ = mRecorder.determineSlotType(vp);
+    visitGlobalSlot(HeapValue *vp, unsigned n, unsigned slot) {
+        *mTypeMap++ = mRecorder.determineSlotType(&vp->get());
     }
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE bool
@@ -4528,7 +4564,7 @@ class SlotMap : public SlotVisitorBase
         SlotInfo()
           : vp(NULL), isPromotedInt32(false), lastCheck(TypeCheck_Bad)
         {}
-        SlotInfo(Value* vp, bool isPromotedInt32)
+        SlotInfo(const Value* vp, bool isPromotedInt32)
           : vp(vp), isPromotedInt32(isPromotedInt32), lastCheck(TypeCheck_Bad),
             type(getCoercedType(*vp))
         {}
@@ -4538,7 +4574,7 @@ class SlotMap : public SlotVisitorBase
         SlotInfo(Value* vp, JSValueType t)
           : vp(vp), isPromotedInt32(t == JSVAL_TYPE_INT32), lastCheck(TypeCheck_Bad), type(t)
         {}
-        void            *vp;
+        const void      *vp;
         bool            isPromotedInt32;
         TypeCheckResult lastCheck;
         JSValueType     type;
@@ -4556,9 +4592,9 @@ class SlotMap : public SlotVisitorBase
     }
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE void
-    visitGlobalSlot(Value *vp, unsigned n, unsigned slot)
+    visitGlobalSlot(HeapValue *vp, unsigned n, unsigned slot)
     {
-        addSlot(vp);
+        addSlot(&vp->get());
     }
 
     JS_ALWAYS_INLINE SlotMap::SlotInfo&
@@ -4610,7 +4646,7 @@ class SlotMap : public SlotVisitorBase
     }
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE void
-    addSlot(Value* vp)
+    addSlot(const Value* vp)
     {
         bool isPromotedInt32 = false;
         if (vp->isNumber()) {
@@ -6137,7 +6173,7 @@ public:
     {}
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE void
-    visitGlobalSlot(Value *vp, unsigned n, unsigned slot) {
+    visitGlobalSlot(HeapValue *vp, unsigned n, unsigned slot) {
         debug_only_printf(LC_TMTracer, "global%d=", n);
         if (!IsEntryTypeCompatible(*vp, *mTypeMap)) {
             mOk = false;
@@ -6242,7 +6278,7 @@ public:
     }
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE void
-    visitGlobalSlot(Value *vp, unsigned n, unsigned slot) {
+    visitGlobalSlot(HeapValue *vp, unsigned n, unsigned slot) {
         if (mOk)
             checkSlot(*vp, "global", n);
     }
@@ -6478,6 +6514,8 @@ ExecuteTree(JSContext* cx, TraceMonitor* tm, TreeFragment* f,
 #endif
     JS_ASSERT(f->root == f && f->code());
 
+    JS_ASSERT(!cx->compartment->needsBarrier());
+
     if (!ScopeChainCheck(cx, f) ||
         !cx->stack.space().ensureEnoughSpaceToEnterTrace(cx)) {
         *lrp = NULL;
@@ -6932,6 +6970,9 @@ RecordLoopEdge(JSContext* cx, TraceMonitor* tm)
     TraceVisStateObj tvso(cx, S_MONITOR);
 #endif
 
+    if (cx->compartment->needsBarrier())
+        return MONITOR_NOT_RECORDING;
+
     /* Is the recorder currently active? */
     if (tm->recorder) {
         tm->recorder->assertInsideLoop();
@@ -7216,17 +7257,6 @@ TraceRecorder::monitorRecording(JSOp op)
 
     AbortableRecordingStatus status;
     bool wasInImacro = (cx->fp()->hasImacropc());
-    if (!wasInImacro && cx->hasRunOption(JSOPTION_PCCOUNT)) {
-        JSScript *script = cx->fp()->script();
-        if (script->pcCounters) {
-            int offset = cx->regs().pc - script->code;
-            LIns *pcCounter_addr_ins = w.nameImmpNonGC(&script->pcCounters.get(JSPCCounters::TRACEJIT, offset));
-            AnyAddress pcCounter_addr(pcCounter_addr_ins);
-            LIns *ins = w.ldd(pcCounter_addr);
-            ins = w.ins2(LIR_addd, ins, w.name(w.immd(1.0), "pctick"));
-            w.st(ins, pcCounter_addr);
-        }
-    }
 
     switch (op) {
       default:
@@ -12036,7 +12066,7 @@ TraceRecorder::nativeSet(JSObject* obj, LIns* obj_ins, const Shape* shape,
         if (obj == globalObj) {
             if (!lazilyImportGlobalSlot(slot))
                 RETURN_STOP("lazy import of global slot failed");
-            set(&obj->getSlotRef(slot), v_ins);
+            set(&obj->getSlot(slot), v_ins);
         } else {
             LIns* slots_ins = NULL;
             stobj_set_slot(obj, obj_ins, slot, slots_ins, v, v_ins);
@@ -13015,7 +13045,7 @@ TraceRecorder::setElem(int lval_spindex, int idx_spindex, int v_spindex)
         if (!idx.isPrimitive())
             RETURN_STOP_A("non-primitive index");
         CHECK_STATUS_A(initOrSetPropertyByName(obj_ins, &idx, &v,
-                                             *cx->regs().pc == JSOP_INITELEM));
+                                               *cx->regs().pc == JSOP_INITELEM));
     } else if (OkToTraceTypedArrays && js_IsTypedArray(obj)) {
         // Fast path: assigning to element of typed array.
         VMSideExit* branchExit = snapshot(BRANCH_EXIT);
@@ -13843,7 +13873,7 @@ TraceRecorder::name(const Value*& vp, LIns*& ins, NameResult& nr)
     if (!lazilyImportGlobalSlot(slot))
         RETURN_STOP_A("lazy import of global slot failed");
 
-    vp = &obj->getSlotRef(slot);
+    vp = &obj->getSlot(slot);
     ins = get(vp);
     nr.tracked = true;
     return ARECORD_CONTINUE;
@@ -15421,6 +15451,16 @@ TraceRecorder::record_JSOP_FINALLY()
     return ARECORD_CONTINUE;
 }
 
+JS_REQUIRES_STACK AbortableRecordingStatus
+TraceRecorder::record_JSOP_LABEL() {
+    return ARECORD_CONTINUE;
+}
+
+JS_REQUIRES_STACK AbortableRecordingStatus
+TraceRecorder::record_JSOP_LABELX() {
+    return ARECORD_CONTINUE;
+}
+
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_NOP()
 {
@@ -16157,16 +16197,6 @@ TraceRecorder::record_JSOP_SHARPINIT()
     return ARECORD_STOP;
 }
 
-JS_REQUIRES_STACK AbortableRecordingStatus
-TraceRecorder::record_JSOP_UNUSED0() {
-    return ARECORD_CONTINUE;
-}
-
-JS_REQUIRES_STACK AbortableRecordingStatus
-TraceRecorder::record_JSOP_UNUSED1() {
-    return ARECORD_CONTINUE;
-}
-
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_GETGNAME()
 {
@@ -16366,6 +16396,9 @@ class AutoRetBlacklist
 JS_REQUIRES_STACK TracePointAction
 RecordTracePoint(JSContext* cx, TraceMonitor* tm, bool* blacklist, bool execAllowed)
 {
+    if (cx->compartment->needsBarrier())
+        return TPA_Nothing;
+
     StackFrame* fp = cx->fp();
     jsbytecode* pc = cx->regs().pc;
 
diff --git a/js/src/jstracer.h b/js/src/jstracer.h
index 381d15fa4431..6caafffd7962 100644
--- a/js/src/jstracer.h
+++ b/js/src/jstracer.h
@@ -1062,14 +1062,14 @@ class TraceRecorder
     Tracker                         nativeFrameTracker;
 
     /* The start of the global object's slots we assume for the trackers. */
-    const Value*                    global_slots;
+    const HeapValue*                global_slots;
 
     /* The number of interpreted calls entered (and not yet left) since recording began. */
     unsigned                        callDepth;
 
     /* The current atom table, mirroring the interpreter loop's variable of the same name. */
     JSAtom**                        atoms;
-    Value*                          consts;
+    HeapValue*                      consts;
 
     /* An instruction yielding the current script's strict mode code flag.  */
     nanojit::LIns*                  strictModeCode_ins;
@@ -1185,7 +1185,9 @@ class TraceRecorder
 
     bool isVoidPtrGlobal(const void* p) const;
     bool isGlobal(const Value* p) const;
+    bool isGlobal(const HeapValue* p) const;
     ptrdiff_t nativeGlobalSlot(const Value *p) const;
+    ptrdiff_t nativeGlobalSlot(const HeapValue *p) const;
     ptrdiff_t nativeGlobalOffset(const Value* p) const;
     JS_REQUIRES_STACK ptrdiff_t nativeStackOffsetImpl(const void* p) const;
     JS_REQUIRES_STACK ptrdiff_t nativeStackOffset(const Value* p) const;
@@ -1228,6 +1230,7 @@ class TraceRecorder
     nanojit::LIns* getFromTracker(const Value* p);
     JS_REQUIRES_STACK nanojit::LIns* getImpl(const void* p);
     JS_REQUIRES_STACK nanojit::LIns* get(const Value* p);
+    JS_REQUIRES_STACK nanojit::LIns* get(const HeapValue* p);
     JS_REQUIRES_STACK nanojit::LIns* getFrameObjPtr(void* p);
     JS_REQUIRES_STACK nanojit::LIns* attemptImport(const Value* p);
     JS_REQUIRES_STACK nanojit::LIns* addr(Value* p);
@@ -1528,7 +1531,7 @@ class TraceRecorder
 
     JS_REQUIRES_STACK jsatomid getFullIndex(ptrdiff_t pcoff = 0);
 
-    JS_REQUIRES_STACK JSValueType determineSlotType(Value* vp);
+    JS_REQUIRES_STACK JSValueType determineSlotType(const Value* vp);
 
     JS_REQUIRES_STACK RecordingStatus setUpwardTrackedVar(Value* stackVp, const Value& v,
                                                           nanojit::LIns* v_ins);
@@ -1616,7 +1619,7 @@ class TraceRecorder
              * Do slot arithmetic manually to avoid getSlotRef assertions which
              * do not need to be satisfied for this purpose.
              */
-            const Value *vp = globalObj->getRawSlot(slot, globalObj->getRawSlots());
+            const HeapValue *vp = globalObj->getRawSlot(slot, globalObj->getRawSlots());
 
             /* If this global is definitely being tracked, then the write is unexpected. */
             if (tracker.has(vp))
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 0ed6c5e94c38..a329186f3862 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -164,8 +164,8 @@ JSObject::allocateArrayBufferSlots(JSContext *cx, uint32 size)
     JS_ASSERT(isArrayBuffer() && !hasSlotsArray());
 
     uint32 bytes = size + sizeof(Value);
-    if (size > sizeof(Value) * ARRAYBUFFER_RESERVED_SLOTS - sizeof(Value) ) {
-        Value *tmpslots = (Value *)cx->calloc_(bytes);
+    if (size > sizeof(HeapValue) * ARRAYBUFFER_RESERVED_SLOTS - sizeof(HeapValue) ) {
+        HeapValue *tmpslots = (HeapValue *)cx->calloc_(bytes);
         if (!tmpslots)
             return false;
         slots = tmpslots;
@@ -174,7 +174,7 @@ JSObject::allocateArrayBufferSlots(JSContext *cx, uint32 size)
          * |capacity * sizeof(Value)| may underestimate the size by up to
          * |sizeof(Value) - 1| bytes.
          */
-        capacity = bytes / sizeof(Value);
+        capacity = bytes / sizeof(HeapValue);
     } else {
         slots = fixedSlots();
         memset(slots, 0, bytes);
@@ -232,9 +232,13 @@ ArrayBuffer::~ArrayBuffer()
 void
 ArrayBuffer::obj_trace(JSTracer *trc, JSObject *obj)
 {
+    /*
+     * If this object changes, it will get marked via the private data barrier,
+     * so it's safe to leave it Unbarriered.
+     */
     JSObject *delegate = static_cast<JSObject*>(obj->getPrivate());
     if (delegate)
-        MarkObject(trc, *delegate, "arraybuffer.delegate");
+        MarkObjectUnbarriered(trc, delegate, "arraybuffer.delegate");
 }
 
 static JSProperty * const PROPERTY_FOUND = reinterpret_cast<JSProperty *>(1);
@@ -995,9 +999,7 @@ class TypedArrayTemplate
     static void
     obj_trace(JSTracer *trc, JSObject *obj)
     {
-        JSObject *buffer = static_cast<JSObject*>(getBuffer(obj));
-        if (buffer)
-            MarkObject(trc, *buffer, "typedarray.buffer");
+        MarkValue(trc, obj->getFixedSlotRef(FIELD_BUFFER), "typedarray.buffer");
     }
 
     static JSBool
diff --git a/js/src/jstypedarray.h b/js/src/jstypedarray.h
index 4320edea10a6..f6e660a93a8c 100644
--- a/js/src/jstypedarray.h
+++ b/js/src/jstypedarray.h
@@ -43,6 +43,8 @@
 #include "jsapi.h"
 #include "jsclass.h"
 
+#include "gc/Barrier.h"
+
 typedef struct JSProperty JSProperty;
 
 namespace js {
diff --git a/js/src/jsutil.h b/js/src/jsutil.h
index da8328198afc..856e37cd0b63 100644
--- a/js/src/jsutil.h
+++ b/js/src/jsutil.h
@@ -187,7 +187,7 @@ class AlreadyIncRefed
     RefCountable *obj;
 
   public:
-    explicit AlreadyIncRefed(RefCountable *obj) : obj(obj) {}
+    explicit AlreadyIncRefed(RefCountable *obj = NULL) : obj(obj) {}
 
     bool null() const { return obj == NULL; }
     operator ConvertibleToBool() const { return (ConvertibleToBool)obj; }
@@ -205,7 +205,7 @@ class NeedsIncRef
     RefCountable *obj;
 
   public:
-    explicit NeedsIncRef(RefCountable *obj) : obj(obj) {}
+    explicit NeedsIncRef(RefCountable *obj = NULL) : obj(obj) {}
 
     bool null() const { return obj == NULL; }
     operator ConvertibleToBool() const { return (ConvertibleToBool)obj; }
diff --git a/js/src/jswatchpoint.cpp b/js/src/jswatchpoint.cpp
index 9c118a9f7729..d7e54a1f0038 100644
--- a/js/src/jswatchpoint.cpp
+++ b/js/src/jswatchpoint.cpp
@@ -48,7 +48,7 @@ using namespace js::gc;
 inline HashNumber
 DefaultHasher<WatchKey>::hash(const Lookup &key)
 {
-    return DefaultHasher<JSObject *>::hash(key.object) ^ HashId(key.id);
+    return DefaultHasher<JSObject *>::hash(key.object.get()) ^ HashId(key.id.get());
 }
 
 class AutoEntryHolder {
@@ -177,7 +177,7 @@ WatchpointMap::triggerWatchpoint(JSContext *cx, JSObject *obj, jsid id, Value *v
 bool
 WatchpointMap::markAllIteratively(JSTracer *trc)
 {
-    JSRuntime *rt = trc->context->runtime;
+    JSRuntime *rt = trc->runtime;
     if (rt->gcCurrentCompartment) {
         WatchpointMap *wpmap = rt->gcCurrentCompartment->watchpointMap;
         return wpmap && wpmap->markIteratively(trc);
@@ -201,16 +201,16 @@ WatchpointMap::markIteratively(JSTracer *trc)
         bool objectIsLive = !IsAboutToBeFinalized(cx, e.key.object);
         if (objectIsLive || e.value.held) {
             if (!objectIsLive) {
-                MarkObject(trc, *e.key.object, "held Watchpoint object");
+                MarkObject(trc, e.key.object, "held Watchpoint object");
                 marked = true;
             }
 
-            jsid id = e.key.id;
+            const HeapId &id = e.key.id;
             JS_ASSERT(JSID_IS_STRING(id) || JSID_IS_INT(id));
             MarkId(trc, id, "WatchKey::id");
 
             if (e.value.closure && IsAboutToBeFinalized(cx, e.value.closure)) {
-                MarkObject(trc, *e.value.closure, "Watchpoint::closure");
+                MarkObject(trc, e.value.closure, "Watchpoint::closure");
                 marked = true;
             }
         }
diff --git a/js/src/jswatchpoint.h b/js/src/jswatchpoint.h
index dd5b7d027db2..2bf8e9008213 100644
--- a/js/src/jswatchpoint.h
+++ b/js/src/jswatchpoint.h
@@ -44,6 +44,7 @@
 #include "jsprvtd.h"
 #include "jsapi.h"
 
+#include "gc/Barrier.h"
 #include "js/HashTable.h"
 
 namespace js {
@@ -51,13 +52,14 @@ namespace js {
 struct WatchKey {
     WatchKey() {}
     WatchKey(JSObject *obj, jsid id) : object(obj), id(id) {}
-    JSObject *object;
-    jsid id;
+    WatchKey(const WatchKey &key) : object(key.object.get()), id(key.id.get()) {}
+    HeapPtrObject object;
+    HeapId id;
 };
 
 struct Watchpoint {
     JSWatchPointHandler handler;
-    JSObject *closure;
+    HeapPtrObject closure;
     bool held;  /* true if currently running handler */
 };
 
@@ -67,7 +69,7 @@ struct DefaultHasher<WatchKey> {
     static inline js::HashNumber hash(const Lookup &key);
 
     static bool match(const WatchKey &k, const Lookup &l) {
-        return k.object == l.object && k.id == l.id;
+        return k.object == l.object && k.id.get() == l.id.get();
     }
 };
 
diff --git a/js/src/jsweakmap.cpp b/js/src/jsweakmap.cpp
index 087fe8e19b2b..ac1faa2b8996 100644
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@@ -80,7 +80,7 @@ WeakMapBase::sweepAll(JSTracer *tracer)
 
 } /* namespace js */
 
-typedef WeakMap<JSObject *, Value> ObjectValueMap;
+typedef WeakMap<HeapPtr<JSObject>, HeapValue> ObjectValueMap;
 
 static ObjectValueMap *
 GetObjectMap(JSObject *obj)
@@ -275,7 +275,7 @@ WeakMap_construct(JSContext *cx, uintN argc, Value *vp)
     if (!obj)
         return false;
 
-    obj->setPrivate(NULL);
+    obj->initPrivate(NULL);
 
     vp->setObject(*obj);
     return true;
@@ -320,7 +320,7 @@ js_InitWeakMapClass(JSContext *cx, JSObject *obj)
     JSObject *weakMapProto = global->createBlankPrototype(cx, &WeakMapClass);
     if (!weakMapProto)
         return NULL;
-    weakMapProto->setPrivate(NULL);
+    weakMapProto->initPrivate(NULL);
 
     JSFunction *ctor = global->createConstructor(cx, WeakMap_construct, &WeakMapClass,
                                                  CLASS_ATOM(cx, WeakMap), 0);
diff --git a/js/src/jsweakmap.h b/js/src/jsweakmap.h
index 288de64fa15d..0ddaf0fe8726 100644
--- a/js/src/jsweakmap.h
+++ b/js/src/jsweakmap.h
@@ -80,59 +80,26 @@ namespace js {
 // - There is no AllocPolicy parameter; these are used with our garbage collector, so
 //   RuntimeAllocPolicy is hard-wired.
 //
-// - Optional fourth template parameter is a class MarkPolicy, with the following constructor:
-//   
+// - Optional fourth and fifth parameters are the MarkPolicies for the key and value type.
+//   A MarkPolicy has the constructor:
+//
 //     MarkPolicy(JSTracer *)
 //
 //   and the following member functions:
 //
-//     bool keyMarked(Key &k)
-//     bool valueMarked(Value &v)
-//        Return true if k/v has been marked as live by the garbage collector.
+//     bool isMarked(const Type &x)
+//        Return true if x has been marked as live by the garbage collector.
 //
-//     bool markEntryIfLive(Key &k, Value &v)
-//        If a table entry whose key is k should be retained, ensure its key and
-//        value are marked. Return true if any previously unmarked objects
-//        became marked.
+//     bool mark(const Type &x)
+//        Return false if x is already marked. Otherwise, mark x and return true.
 //
-//        To ensure that the WeakMap's behavior isn't visibly affected by
-//        garbage collection, this should leave k unmarked only when no key
-//        matching k could ever be produced after this GC cycle completes ---
-//        removing entries whose keys this function leaves unmarked should never
-//        make future lookups fail.
-//
-//        A typical definition of markEntryIfLive would be:
-//
-//          if (keyMarked(k) && !valueMarked(v)) {
-//              markObject(*v, "WeakMap entry value");
-//              return true;
-//          }
-//          return false;
-//
-//        This meets the above constraint when, for example, Key is JSObject *:
-//        if k isn't marked, it won't exist once the collection cycle completes,
-//        and thus can't be supplied as a key.
-//
-//        Note that this may mark entries where keyMarked(k) is not initially
-//        true. For example, you could have a table whose keys match when the
-//        values of one of their properties are equal: k1.x === k2.x. An entry
-//        in such a table could be live even when its key is not marked. The
-//        markEntryIfLive function for such a table would generally mark both k and v.
-//
-//     void markEntry(Value &v)
-//        Mark the table entry's value v as reachable by the collector. WeakMap
-//        uses this function for non-marking tracers: other code using the GC
-//        heap tracing functions to map the heap for some purpose or other.
-//        This provides a conservative approximation of the true reachability
-//        relation of the heap graph.
-//
-//   If omitted, the MarkPolicy parameter defaults to js::DefaultMarkPolicy<Key,
-//   Value>, a policy template with the obvious definitions for some typical
+//   If omitted, the MarkPolicy parameter defaults to js::DefaultMarkPolicy<Type>,
+//   a policy template with the obvious definitions for some typical
 //   SpiderMonkey type combinations.
 
 // A policy template holding default marking algorithms for common type combinations. This
 // provides default types for WeakMap's MarkPolicy template parameter.
-template <class Key, class Value> class DefaultMarkPolicy;
+template <class Type> class DefaultMarkPolicy;
 
 // Common base class for all WeakMap specializations. The collector uses this to call
 // their markIteratively and sweep methods.
@@ -188,7 +155,8 @@ class WeakMapBase {
 
 template <class Key, class Value,
           class HashPolicy = DefaultHasher<Key>,
-          class MarkPolicy = DefaultMarkPolicy<Key, Value> >
+          class KeyMarkPolicy = DefaultMarkPolicy<Key>,
+          class ValueMarkPolicy = DefaultMarkPolicy<Value> >
 class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, public WeakMapBase {
   private:
     typedef HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy> Base;
@@ -206,127 +174,121 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
     }
 
   private:
-    void nonMarkingTrace(JSTracer *tracer) {
-        MarkPolicy t(tracer);
+    void nonMarkingTrace(JSTracer *trc) {
+        ValueMarkPolicy vp(trc);
         for (Range r = Base::all(); !r.empty(); r.popFront())
-            t.markEntry(r.front().value);
+            vp.mark(r.front().value);
     }
 
-    bool markIteratively(JSTracer *tracer) {
-        MarkPolicy t(tracer);
+    bool markIteratively(JSTracer *trc) {
+        KeyMarkPolicy kp(trc);
+        ValueMarkPolicy vp(trc);
         bool markedAny = false;
         for (Range r = Base::all(); !r.empty(); r.popFront()) {
+            const Key &k = r.front().key;
+            const Value &v = r.front().value;
             /* If the entry is live, ensure its key and value are marked. */
-            if (t.markEntryIfLive(r.front().key, r.front().value)) {
-                /* We revived a value with children, we have to iterate again. */
+            if (kp.isMarked(k)) {
+                markedAny |= vp.mark(v);
+            } else if (kp.overrideKeyMarking(k)) {
+                // We always mark wrapped natives.  This will cause leaks, but WeakMap+CC
+                // integration is currently busted anyways.  When WeakMap+CC integration is
+                // fixed in Bug 668855, XPC wrapped natives should only be marked during
+                // non-BLACK marking (ie grey marking).
+                kp.mark(k);
+                vp.mark(v);
                 markedAny = true;
             }
-            JS_ASSERT_IF(t.keyMarked(r.front().key), t.valueMarked(r.front().value));
+            JS_ASSERT_IF(kp.isMarked(k), vp.isMarked(v));
         }
         return markedAny;
     }
 
-    void sweep(JSTracer *tracer) {
-        MarkPolicy t(tracer);
+    void sweep(JSTracer *trc) {
+        KeyMarkPolicy kp(trc);
 
         /* Remove all entries whose keys remain unmarked. */
         for (Enum e(*this); !e.empty(); e.popFront()) {
-            if (!t.keyMarked(e.front().key))
+            if (!kp.isMarked(e.front().key))
                 e.removeFront();
         }
 
 #if DEBUG
-        /* 
+        ValueMarkPolicy vp(trc);
+        /*
          * Once we've swept, all remaining edges should stay within the
          * known-live part of the graph.
          */
         for (Range r = Base::all(); !r.empty(); r.popFront()) {
-            JS_ASSERT(t.keyMarked(r.front().key));
-            JS_ASSERT(t.valueMarked(r.front().value));
+            JS_ASSERT(kp.isMarked(r.front().key));
+            JS_ASSERT(vp.isMarked(r.front().value));
         }
 #endif
     }
 };
 
-// Marking policy for maps from JSObject pointers to js::Values.
-//
-// We always mark wrapped natives.  This will cause leaks, but WeakMap+CC
-// integration is currently busted anyways.  When WeakMap+CC integration is
-// fixed in Bug 668855, XPC wrapped natives should only be marked during
-// non-BLACK marking (ie grey marking).
 template <>
-class DefaultMarkPolicy<JSObject *, Value> {
+class DefaultMarkPolicy<HeapValue> {
   private:
     JSTracer *tracer;
   public:
     DefaultMarkPolicy(JSTracer *t) : tracer(t) { }
-    bool keyMarked(JSObject *k) { return !IsAboutToBeFinalized(tracer->context, k); }
-    bool valueMarked(const Value &v) {
-        if (v.isMarkable())
-            return !IsAboutToBeFinalized(tracer->context, v.toGCThing());
+    bool isMarked(const HeapValue &x) {
+        if (x.isMarkable())
+            return !IsAboutToBeFinalized(tracer->context, x);
         return true;
     }
-  private:
-    bool markUnmarkedValue(const Value &v) {
-        if (valueMarked(v))
+    bool mark(const HeapValue &x) {
+        if (isMarked(x))
             return false;
-        js::gc::MarkValue(tracer, v, "WeakMap entry value");
+        js::gc::MarkValue(tracer, x, "WeakMap entry");
         return true;
     }
+    bool overrideKeyMarking(const HeapValue &k) { return false; }
+};
 
-    // Return true if we should override the GC's default marking
-    // behavior for this key.
-    bool overrideKeyMarking(JSObject *k) {
+template <>
+class DefaultMarkPolicy<HeapPtrObject> {
+  private:
+    JSTracer *tracer;
+  public:
+    DefaultMarkPolicy(JSTracer *t) : tracer(t) { }
+    bool isMarked(const HeapPtrObject &x) {
+        return !IsAboutToBeFinalized(tracer->context, x);
+    }
+    bool mark(const HeapPtrObject &x) {
+        if (isMarked(x))
+            return false;
+        js::gc::MarkObject(tracer, x, "WeakMap entry");
+        return true;
+    }
+    bool overrideKeyMarking(const HeapPtrObject &k) {
         // We only need to worry about extra marking of keys when
         // we're doing a GC marking pass.
         if (!IS_GC_MARKING_TRACER(tracer))
             return false;
         return k->getClass()->ext.isWrappedNative;
     }
-  public:
-    bool markEntryIfLive(JSObject *k, const Value &v) {
-        if (keyMarked(k))
-            return markUnmarkedValue(v);
-        if (!overrideKeyMarking(k))
-            return false;
-        js::gc::MarkObject(tracer, *k, "WeakMap entry wrapper key");
-        markUnmarkedValue(v);
-        return true;
-    }
-    void markEntry(const Value &v) {
-        js::gc::MarkValue(tracer, v, "WeakMap entry value");
-    }
 };
 
 template <>
-class DefaultMarkPolicy<gc::Cell *, JSObject *> {
-  protected:
+class DefaultMarkPolicy<HeapPtrScript> {
+  private:
     JSTracer *tracer;
   public:
     DefaultMarkPolicy(JSTracer *t) : tracer(t) { }
-    bool keyMarked(gc::Cell *k)   { return !IsAboutToBeFinalized(tracer->context, k); }
-    bool valueMarked(JSObject *v) { return !IsAboutToBeFinalized(tracer->context, v); }
-    bool markEntryIfLive(gc::Cell *k, JSObject *v) {
-        if (keyMarked(k) && !valueMarked(v)) {
-            js::gc::MarkObject(tracer, *v, "WeakMap entry value");
-            return true;
-        }
-        return false;
+    bool isMarked(const HeapPtrScript &x) {
+        return !IsAboutToBeFinalized(tracer->context, x);
     }
-    void markEntry(JSObject *v) {
-        js::gc::MarkObject(tracer, *v, "WeakMap entry value");
+    bool mark(const HeapPtrScript &x) {
+        if (isMarked(x))
+            return false;
+        js::gc::MarkScript(tracer, x, "WeakMap entry");
+        return true;
     }
+    bool overrideKeyMarking(const HeapPtrScript &k) { return false; }
 };
 
-// A MarkPolicy for WeakMaps whose keys and values may be objects in arbitrary
-// compartments within a runtime.
-//
-// With the current GC, the implementation turns out to be identical to the
-// default mark policy. We give it a distinct name anyway, in case this ever
-// changes.
-//
-typedef DefaultMarkPolicy<gc::Cell *, JSObject *> CrossCompartmentMarkPolicy;
-
 }
 
 extern JSObject *
diff --git a/js/src/jswrapper.cpp b/js/src/jswrapper.cpp
index 4dea5be01989..8d1bbc107813 100644
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@@ -346,7 +346,7 @@ Wrapper::defaultValue(JSContext *cx, JSObject *wrapper, JSType hint, Value *vp)
 void
 Wrapper::trace(JSTracer *trc, JSObject *wrapper)
 {
-    MarkObject(trc, *wrappedObject(wrapper), "wrappedObject");
+    MarkValue(trc, wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "wrappedObject");
 }
 
 JSObject *
@@ -844,7 +844,8 @@ CrossCompartmentWrapper::defaultValue(JSContext *cx, JSObject *wrapper, JSType h
 void
 CrossCompartmentWrapper::trace(JSTracer *trc, JSObject *wrapper)
 {
-    MarkCrossCompartmentObject(trc, *wrappedObject(wrapper), "wrappedObject");
+    MarkCrossCompartmentValue(trc, wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE),
+                              "wrappedObject");
 }
 
 CrossCompartmentWrapper CrossCompartmentWrapper::singleton(0u);
@@ -862,9 +863,9 @@ SecurityWrapper<Base>::nativeCall(JSContext *cx, JSObject *wrapper, Class *clasp
                                   CallArgs args)
 {
     /* Let ProxyHandler report the error. */
-    bool ret = ProxyHandler::nativeCall(cx, wrapper, clasp, native, args);
-    JS_ASSERT(!ret && cx->isExceptionPending());
-    return ret;
+    DebugOnly<bool> ret = ProxyHandler::nativeCall(cx, wrapper, clasp, native, args);
+    JS_ASSERT(!ret);
+    return false;
 }
 
 template <class Base>
diff --git a/js/src/jsxdrapi.cpp b/js/src/jsxdrapi.cpp
index d6ef5c68087f..19d7e1ffb321 100644
--- a/js/src/jsxdrapi.cpp
+++ b/js/src/jsxdrapi.cpp
@@ -708,18 +708,23 @@ JS_XDRScript(JSXDRState *xdr, JSScript **scriptp)
 
     JSScript *script;
     uint32 magic;
+    uint32 bytecodeVer;
     if (xdr->mode == JSXDR_DECODE) {
         script = NULL;
         *scriptp = NULL;
     } else {
         script = *scriptp;
         magic = JSXDR_MAGIC_SCRIPT_CURRENT;
+        bytecodeVer = JSXDR_BYTECODE_VERSION;
     }
 
     if (!JS_XDRUint32(xdr, &magic))
         return false;
+    if (!JS_XDRUint32(xdr, &bytecodeVer))
+        return false;
 
-    if (magic != JSXDR_MAGIC_SCRIPT_CURRENT) {
+    if (magic != JSXDR_MAGIC_SCRIPT_CURRENT ||
+        bytecodeVer != JSXDR_BYTECODE_VERSION) {
         /* We do not provide binary compatibility with older scripts. */
         JS_ReportErrorNumber(xdr->cx, js_GetErrorMessage, NULL, JSMSG_BAD_SCRIPT_MAGIC);
         return false;
@@ -739,7 +744,7 @@ JS_XDRScript(JSXDRState *xdr, JSScript **scriptp)
 
     if (xdr->mode == JSXDR_DECODE) {
         JS_ASSERT(!script->compileAndGo);
-        script->u.globalObject = GetCurrentGlobal(xdr->cx);
+        script->globalObject = GetCurrentGlobal(xdr->cx);
         js_CallNewScriptHook(xdr->cx, script, NULL);
         Debugger::onNewScript(xdr->cx, script, NULL);
         *scriptp = script;
diff --git a/js/src/jsxdrapi.h b/js/src/jsxdrapi.h
index 15641364854e..a4a29bad4574 100644
--- a/js/src/jsxdrapi.h
+++ b/js/src/jsxdrapi.h
@@ -214,18 +214,19 @@ JS_XDRFindClassById(JSXDRState *xdr, uint32 id);
 #define JSXDR_MAGIC_SCRIPT_9        0xdead0009
 #define JSXDR_MAGIC_SCRIPT_10       0xdead000a
 #define JSXDR_MAGIC_SCRIPT_11       0xdead000b
-#define JSXDR_MAGIC_SCRIPT_CURRENT  JSXDR_MAGIC_SCRIPT_11
+#define JSXDR_MAGIC_SCRIPT_12       0xdead000c
+#define JSXDR_MAGIC_SCRIPT_CURRENT  JSXDR_MAGIC_SCRIPT_12
 
 /*
  * Bytecode version number. Increment the subtrahend whenever JS bytecode
  * changes incompatibly.
  *
- * This version number should be XDR'ed once near the front of any file or
- * larger storage unit containing XDR'ed bytecode and other data, and checked
- * before deserialization of bytecode.  If the saved version does not match
- * the current version, abort deserialization and invalidate the file.
+ * This version number is XDR'd near the front of xdr bytecode and
+ * aborts deserialization if there is a mismatch between the current
+ * and saved versions. If deserialization fails, the data should be
+ * invalidated if possible.
  */
-#define JSXDR_BYTECODE_VERSION      (0xb973c0de - 96)
+#define JSXDR_BYTECODE_VERSION      (0xb973c0de - 98)
 
 /*
  * Library-private functions.
diff --git a/js/src/jsxml.cpp b/js/src/jsxml.cpp
index c98735055478..8075d73cf867 100644
--- a/js/src/jsxml.cpp
+++ b/js/src/jsxml.cpp
@@ -78,6 +78,7 @@
 #include "jsstrinlines.h"
 
 #include "vm/Stack-inl.h"
+#include "vm/String-inl.h"
 
 #ifdef DEBUG
 #include <string.h>     /* for #ifdef DEBUG memset calls */
@@ -88,6 +89,19 @@ using namespace js;
 using namespace js::gc;
 using namespace js::types;
 
+template<class T, class U>
+struct IdentityOp
+{
+    typedef JSBool (* compare)(const T *a, const U *b);
+};
+
+template<class T>
+static JSBool
+pointer_match(const T *a, const T *b)
+{
+    return a == b;
+}
+
 /*
  * NOTES
  * - in the js shell, you must use the -x command line option, or call
@@ -302,7 +316,7 @@ DEFINE_GETTER(QNameLocalName_getter,
                   *vp = obj->getQNameLocalNameVal())
 
 static JSBool
-qname_identity(JSObject *qna, JSObject *qnb)
+qname_identity(JSObject *qna, const JSObject *qnb)
 {
     JSLinearString *uri1 = qna->getNameURI();
     JSLinearString *uri2 = qnb->getNameURI();
@@ -839,10 +853,8 @@ QName(JSContext *cx, uintN argc, Value *vp)
  * XMLArray library functions.
  */
 static JSBool
-namespace_identity(const void *a, const void *b)
+namespace_identity(const JSObject *nsa, const JSObject *nsb)
 {
-    const JSObject *nsa = (const JSObject *) a;
-    const JSObject *nsb = (const JSObject *) b;
     JSLinearString *prefixa = nsa->getNamePrefix();
     JSLinearString *prefixb = nsb->getNamePrefix();
 
@@ -857,32 +869,51 @@ namespace_identity(const void *a, const void *b)
 }
 
 static JSBool
-attr_identity(const void *a, const void *b)
+attr_identity(const JSXML *xmla, const JSXML *xmlb)
 {
-    const JSXML *xmla = (const JSXML *) a;
-    const JSXML *xmlb = (const JSXML *) b;
-
     return qname_identity(xmla->name, xmlb->name);
 }
 
+template<>
 void
-JSXMLArrayCursor::trace(JSTracer *trc) {
-#ifdef DEBUG
-    size_t index = 0;
-#endif
-    for (JSXMLArrayCursor *cursor = this; cursor; cursor = cursor->next)
-        js::gc::MarkGCThing(trc, cursor->root, "cursor_root", index++);
+JSXMLArrayCursor<JSXML>::trace(JSTracer *trc)
+{
+    for (JSXMLArrayCursor<JSXML> *cursor = this; cursor; cursor = cursor->next)
+        MarkXML(trc, cursor->root, "cursor_root");
 }
 
+template<>
+void
+JSXMLArrayCursor<JSObject>::trace(JSTracer *trc)
+{
+    for (JSXMLArrayCursor<JSObject> *cursor = this; cursor; cursor = cursor->next)
+        MarkObject(trc, cursor->root, "cursor_root");
+}
+
+template<class T>
 static void
-XMLArrayCursorTrace(JSTracer *trc, JSXMLArrayCursor *cursor)
+XMLArrayCursorTrace(JSTracer *trc, JSXMLArrayCursor<T> *cursor)
 {
     cursor->trace(trc);
 }
 
+template<class T>
+static HeapPtr<T> *
+ReallocateVector(HeapPtr<T> *vector, size_t count)
+{
+#if JS_BITS_PER_WORD == 32
+    if (count > ~(size_t)0 / sizeof(HeapPtr<T>))
+        return NULL;
+#endif
+
+    size_t size = count * sizeof(HeapPtr<T>);
+    return (HeapPtr<T> *) OffTheBooks::realloc_(vector, size);
+}
+
 /* NB: called with null cx from the GC, via xml_trace => JSXMLArray::trim. */
+template<class T>
 bool
-JSXMLArray::setCapacity(JSContext *cx, uint32 newCapacity)
+JSXMLArray<T>::setCapacity(JSContext *cx, uint32 newCapacity)
 {
     if (newCapacity == 0) {
         /* We could let realloc(p, 0) free this, but purify gets confused. */
@@ -894,13 +925,8 @@ JSXMLArray::setCapacity(JSContext *cx, uint32 newCapacity)
         }
         vector = NULL;
     } else {
-        void **tmp;
-
-        if (
-#if JS_BITS_PER_WORD == 32
-            (size_t)newCapacity > ~(size_t)0 / sizeof(void *) ||
-#endif
-            !(tmp = (void **) OffTheBooks::realloc_(vector, newCapacity * sizeof(void *)))) {
+        HeapPtr<T> *tmp = ReallocateVector(vector, newCapacity);
+        if (!tmp) {
             if (cx)
                 JS_ReportOutOfMemory(cx);
             return false;
@@ -911,8 +937,9 @@ JSXMLArray::setCapacity(JSContext *cx, uint32 newCapacity)
     return true;
 }
 
+template<class T>
 void
-JSXMLArray::trim()
+JSXMLArray<T>::trim()
 {
     if (capacity & JSXML_PRESET_CAPACITY)
         return;
@@ -920,12 +947,19 @@ JSXMLArray::trim()
         setCapacity(NULL, length);
 }
 
+template<class T>
 void
-JSXMLArray::finish(JSContext *cx)
+JSXMLArray<T>::finish(JSContext *cx)
 {
+    if (!cx->runtime->gcRunning) {
+        /* We need to clear these to trigger a write barrier. */
+        for (uint32 i = 0; i < length; i++)
+            vector[i].~HeapPtr<T>();
+    }
+
     cx->free_(vector);
 
-    while (JSXMLArrayCursor *cursor = cursors)
+    while (JSXMLArrayCursor<T> *cursor = cursors)
         cursor->disconnect();
 
 #ifdef DEBUG
@@ -935,24 +969,18 @@ JSXMLArray::finish(JSContext *cx)
 
 #define XML_NOT_FOUND   ((uint32) -1)
 
+template<class T, class U>
 static uint32
-XMLArrayFindMember(const JSXMLArray *array, void *elt, JSIdentityOp identity)
+XMLArrayFindMember(const JSXMLArray<T> *array, U *elt, typename IdentityOp<T, U>::compare identity)
 {
-    void **vector;
+    HeapPtr<T> *vector;
     uint32 i, n;
 
     /* The identity op must not reallocate array->vector. */
     vector = array->vector;
-    if (identity) {
-        for (i = 0, n = array->length; i < n; i++) {
-            if (identity(vector[i], elt))
-                return i;
-        }
-    } else {
-        for (i = 0, n = array->length; i < n; i++) {
-            if (vector[i] == elt)
-                return i;
-        }
+    for (i = 0, n = array->length; i < n; i++) {
+        if (identity(vector[i].get(), elt))
+            return i;
     }
     return XML_NOT_FOUND;
 }
@@ -965,12 +993,13 @@ XMLArrayFindMember(const JSXMLArray *array, void *elt, JSIdentityOp identity)
 #define LINEAR_THRESHOLD        256
 #define LINEAR_INCREMENT        32
 
+template<class T>
 static JSBool
-XMLArrayAddMember(JSContext *cx, JSXMLArray *array, uint32 index, void *elt)
+XMLArrayAddMember(JSContext *cx, JSXMLArray<T> *array, uint32 index, T *elt)
 {
     uint32 capacity, i;
     int log2;
-    void **vector;
+    HeapPtr<T> *vector;
 
     if (index >= array->length) {
         if (index >= JSXML_CAPACITY(array)) {
@@ -982,20 +1011,16 @@ XMLArrayAddMember(JSContext *cx, JSXMLArray *array, uint32 index, void *elt)
                 JS_CEILING_LOG2(log2, capacity);
                 capacity = JS_BIT(log2);
             }
-            if (
-#if JS_BITS_PER_WORD == 32
-                (size_t)capacity > ~(size_t)0 / sizeof(void *) ||
-#endif
-                !(vector = (void **)
-                           cx->realloc_(array->vector, capacity * sizeof(void *)))) {
+            if (!(vector = ReallocateVector(array->vector, capacity))) {
                 JS_ReportOutOfMemory(cx);
                 return JS_FALSE;
             }
             array->capacity = capacity;
             array->vector = vector;
             for (i = array->length; i < index; i++)
-                vector[i] = NULL;
+                vector[i].init(NULL);
         }
+        array->vector[index].init(NULL);
         array->length = index + 1;
     }
 
@@ -1003,17 +1028,24 @@ XMLArrayAddMember(JSContext *cx, JSXMLArray *array, uint32 index, void *elt)
     return JS_TRUE;
 }
 
+template<class T>
 static JSBool
-XMLArrayInsert(JSContext *cx, JSXMLArray *array, uint32 i, uint32 n)
+XMLArrayInsert(JSContext *cx, JSXMLArray<T> *array, uint32 i, uint32 n)
 {
-    uint32 j;
-    JSXMLArrayCursor *cursor;
+    uint32 j, k;
+    JSXMLArrayCursor<T> *cursor;
 
     j = array->length;
     JS_ASSERT(i <= j);
     if (!array->setCapacity(cx, j + n))
         return JS_FALSE;
 
+    k = j;
+    while (k != j + n) {
+        array->vector[k].init(NULL);
+        k++;
+    }
+
     array->length = j + n;
     JS_ASSERT(n != (uint32)-1);
     while (j != i) {
@@ -1028,12 +1060,14 @@ XMLArrayInsert(JSContext *cx, JSXMLArray *array, uint32 i, uint32 n)
     return JS_TRUE;
 }
 
-static void *
-XMLArrayDelete(JSContext *cx, JSXMLArray *array, uint32 index, JSBool compress)
+template<class T>
+static T *
+XMLArrayDelete(JSContext *cx, JSXMLArray<T> *array, uint32 index, JSBool compress)
 {
     uint32 length;
-    void **vector, *elt;
-    JSXMLArrayCursor *cursor;
+    HeapPtr<T> *vector;
+    T *elt;
+    JSXMLArrayCursor<T> *cursor;
 
     length = array->length;
     if (index >= length)
@@ -1042,6 +1076,7 @@ XMLArrayDelete(JSContext *cx, JSXMLArray *array, uint32 index, JSBool compress)
     vector = array->vector;
     elt = vector[index];
     if (compress) {
+        vector[length - 1].~HeapPtr<T>();
         while (++index < length)
             vector[index-1] = vector[index];
         array->length = length - 1;
@@ -1057,21 +1092,25 @@ XMLArrayDelete(JSContext *cx, JSXMLArray *array, uint32 index, JSBool compress)
     return elt;
 }
 
+template<class T>
 static void
-XMLArrayTruncate(JSContext *cx, JSXMLArray *array, uint32 length)
+XMLArrayTruncate(JSContext *cx, JSXMLArray<T> *array, uint32 length)
 {
-    void **vector;
+    HeapPtr<T> *vector;
 
     JS_ASSERT(!array->cursors);
     if (length >= array->length)
         return;
 
+    for (uint32 i = length; i < array->length; i++)
+        array->vector[i].~HeapPtr<T>();
+
     if (length == 0) {
         if (array->vector)
             cx->free_(array->vector);
         vector = NULL;
     } else {
-        vector = (void **) cx->realloc_(array->vector, length * sizeof(void *));
+        vector = ReallocateVector(array->vector, length);
         if (!vector)
             return;
     }
@@ -1082,21 +1121,24 @@ XMLArrayTruncate(JSContext *cx, JSXMLArray *array, uint32 length)
     array->vector = vector;
 }
 
-#define XMLARRAY_FIND_MEMBER(a,e,f) XMLArrayFindMember(a, (void *)(e), f)
-#define XMLARRAY_HAS_MEMBER(a,e,f)  (XMLArrayFindMember(a, (void *)(e), f) != \
+#define XMLARRAY_FIND_MEMBER(a,e,f) XMLArrayFindMember(a, e, f)
+#define XMLARRAY_HAS_MEMBER(a,e,f)  (XMLArrayFindMember(a, e, f) !=           \
                                      XML_NOT_FOUND)
 #define XMLARRAY_MEMBER(a,i,t)      (((i) < (a)->length)                      \
-                                     ? (t *) (a)->vector[i]                   \
+                                     ? (a)->vector[i].get()                   \
                                      : NULL)
 #define XMLARRAY_SET_MEMBER(a,i,e)  JS_BEGIN_MACRO                            \
-                                        if ((a)->length <= (i))               \
+                                        if ((a)->length <= (i)) {             \
                                             (a)->length = (i) + 1;            \
-                                        ((a)->vector[i] = (void *)(e));       \
+                                            ((a)->vector[i].init(e));         \
+                                        } else {                              \
+                                            ((a)->vector[i] = e);             \
+                                        }                                     \
                                     JS_END_MACRO
-#define XMLARRAY_ADD_MEMBER(x,a,i,e)XMLArrayAddMember(x, a, i, (void *)(e))
+#define XMLARRAY_ADD_MEMBER(x,a,i,e)XMLArrayAddMember(x, a, i, e)
 #define XMLARRAY_INSERT(x,a,i,n)    XMLArrayInsert(x, a, i, n)
 #define XMLARRAY_APPEND(x,a,e)      XMLARRAY_ADD_MEMBER(x, a, (a)->length, (e))
-#define XMLARRAY_DELETE(x,a,i,c,t)  ((t *) XMLArrayDelete(x, a, i, c))
+#define XMLARRAY_DELETE(x,a,i,c,t)  (XMLArrayDelete<t>(x, a, i, c))
 #define XMLARRAY_TRUNCATE(x,a,n)    XMLArrayTruncate(x, a, n)
 
 /*
@@ -1155,8 +1197,24 @@ HAS_NS_AFTER_XML(const jschar *chars)
 static const char xml_namespace_str[] = "http://www.w3.org/XML/1998/namespace";
 static const char xmlns_namespace_str[] = "http://www.w3.org/2000/xmlns/";
 
+void
+JSXML::finalize(JSContext *cx)
+{
+    if (JSXML_HAS_KIDS(this)) {
+        xml_kids.finish(cx);
+        if (xml_class == JSXML_CLASS_ELEMENT) {
+            xml_namespaces.finish(cx);
+            xml_attrs.finish(cx);
+        }
+    }
+#ifdef DEBUG_notme
+    JS_REMOVE_LINK(&links);
+#endif
+}
+
 static JSObject *
-ParseNodeToQName(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, JSBool isAttributeName)
+ParseNodeToQName(Parser *parser, ParseNode *pn,
+                 JSXMLArray<JSObject> *inScopeNSes, JSBool isAttributeName)
 {
     JSContext *cx = parser->context;
     JSLinearString *uri, *prefix;
@@ -1284,7 +1342,8 @@ ChompXMLWhitespace(JSContext *cx, JSString *str)
 }
 
 static JSXML *
-ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN flags)
+ParseNodeToXML(Parser *parser, ParseNode *pn,
+               JSXMLArray<JSObject> *inScopeNSes, uintN flags)
 {
     JSContext *cx = parser->context;
     JSXML *xml, *kid, *attr, *attrj;
@@ -1313,7 +1372,7 @@ ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN fla
     if (!js_EnterLocalRootScope(cx))
         return NULL;
     switch (pn->getKind()) {
-      case TOK_XMLELEM:
+      case PNK_XMLELEM:
         length = inScopeNSes->length;
         pn2 = pn->pn_head;
         xml = ParseNodeToXML(parser, pn2, inScopeNSes, flags);
@@ -1330,12 +1389,12 @@ ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN fla
         while ((pn2 = pn2->pn_next) != NULL) {
             if (!pn2->pn_next) {
                 /* Don't append the end tag! */
-                JS_ASSERT(pn2->isKind(TOK_XMLETAGO));
+                JS_ASSERT(pn2->isKind(PNK_XMLETAGO));
                 break;
             }
 
             if ((flags & XSF_IGNORE_WHITESPACE) &&
-                n > 1 && pn2->isKind(TOK_XMLSPACE)) {
+                n > 1 && pn2->isKind(PNK_XMLSPACE)) {
                 --n;
                 continue;
             }
@@ -1370,7 +1429,7 @@ ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN fla
         XMLARRAY_TRUNCATE(cx, inScopeNSes, length);
         break;
 
-      case TOK_XMLLIST:
+      case PNK_XMLLIST:
         xml = js_NewXML(cx, JSXML_CLASS_LIST);
         if (!xml)
             goto fail;
@@ -1386,7 +1445,7 @@ ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN fla
              * condition this on an XML.ignoreWhitespace setting when the list
              * constructor is XMLList (note XML/XMLList unification hazard).
              */
-            if (pn2->isKind(TOK_XMLSPACE)) {
+            if (pn2->isKind(PNK_XMLSPACE)) {
                 --n;
                 continue;
             }
@@ -1408,11 +1467,11 @@ ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN fla
             xml->xml_kids.trim();
         break;
 
-      case TOK_XMLSTAGO:
-      case TOK_XMLPTAGC:
+      case PNK_XMLSTAGO:
+      case PNK_XMLPTAGC:
         length = inScopeNSes->length;
         pn2 = pn->pn_head;
-        JS_ASSERT(pn2->isKind(TOK_XMLNAME));
+        JS_ASSERT(pn2->isKind(PNK_XMLNAME));
         if (pn2->isArity(PN_LIST))
             goto syntax;
 
@@ -1429,7 +1488,7 @@ ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN fla
             size_t length;
             const jschar *chars;
 
-            if (!pn2->isKind(TOK_XMLNAME) || !pn2->isArity(PN_NULLARY))
+            if (!pn2->isKind(PNK_XMLNAME) || !pn2->isArity(PN_NULLARY))
                 goto syntax;
 
             /* Enforce "Well-formedness constraint: Unique Att Spec". */
@@ -1449,7 +1508,7 @@ ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN fla
             JSAtom *atom = pn2->pn_atom;
             pn2 = pn2->pn_next;
             JS_ASSERT(pn2);
-            if (!pn2->isKind(TOK_XMLATTR))
+            if (!pn2->isKind(PNK_XMLATTR))
                 goto syntax;
 
             chars = atom->chars();
@@ -1546,7 +1605,7 @@ ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN fla
 
             pn2 = pn2->pn_next;
             JS_ASSERT(pn2);
-            JS_ASSERT(pn2->isKind(TOK_XMLATTR));
+            JS_ASSERT(pn2->isKind(PNK_XMLATTR));
 
             attr = js_NewXML(cx, JSXML_CLASS_ATTRIBUTE);
             if (!attr)
@@ -1559,22 +1618,22 @@ ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN fla
         }
 
         /* Point tag closes its own namespace scope. */
-        if (pn->isKind(TOK_XMLPTAGC))
+        if (pn->isKind(PNK_XMLPTAGC))
             XMLARRAY_TRUNCATE(cx, inScopeNSes, length);
         break;
 
-      case TOK_XMLSPACE:
-      case TOK_XMLTEXT:
-      case TOK_XMLCDATA:
-      case TOK_XMLCOMMENT:
-      case TOK_XMLPI:
+      case PNK_XMLSPACE:
+      case PNK_XMLTEXT:
+      case PNK_XMLCDATA:
+      case PNK_XMLCOMMENT:
+      case PNK_XMLPI:
         str = pn->pn_atom;
         qn = NULL;
-        if (pn->isKind(TOK_XMLCOMMENT)) {
+        if (pn->isKind(PNK_XMLCOMMENT)) {
             if (flags & XSF_IGNORE_COMMENTS)
                 goto skip_child;
             xml_class = JSXML_CLASS_COMMENT;
-        } else if (pn->isKind(TOK_XMLPI)) {
+        } else if (pn->isKind(PNK_XMLPI)) {
             if (IS_XML(str)) {
                 Value v = StringValue(str);
                 JSAutoByteString bytes;
@@ -1603,7 +1662,7 @@ ParseNodeToXML(Parser *parser, ParseNode *pn, JSXMLArray *inScopeNSes, uintN fla
         if (!xml)
             goto fail;
         xml->name = qn;
-        if (pn->isKind(TOK_XMLSPACE))
+        if (pn->isKind(PNK_XMLSPACE))
             xml->xml_flags |= XMLF_WHITESPACE_TEXT;
         xml->xml_value = str;
         break;
@@ -2173,7 +2232,7 @@ EscapeElementValue(JSContext *cx, StringBuffer &sb, JSString *str, uint32 toSour
 
 /* 13.3.5.4 [[GetNamespace]]([InScopeNamespaces]) */
 static JSObject *
-GetNamespace(JSContext *cx, JSObject *qn, const JSXMLArray *inScopeNSes)
+GetNamespace(JSContext *cx, JSObject *qn, const JSXMLArray<JSObject> *inScopeNSes)
 {
     JSLinearString *uri, *prefix, *nsprefix;
     JSObject *match, *ns;
@@ -2254,7 +2313,7 @@ GetNamespace(JSContext *cx, JSObject *qn, const JSXMLArray *inScopeNSes)
 }
 
 static JSLinearString *
-GeneratePrefix(JSContext *cx, JSLinearString *uri, JSXMLArray *decls)
+GeneratePrefix(JSContext *cx, JSLinearString *uri, JSXMLArray<JSObject> *decls)
 {
     const jschar *cp, *start, *end;
     size_t length, newlength, offset;
@@ -2370,10 +2429,8 @@ GeneratePrefix(JSContext *cx, JSLinearString *uri, JSXMLArray *decls)
 }
 
 static JSBool
-namespace_match(const void *a, const void *b)
+namespace_match(const JSObject *nsa, const JSObject *nsb)
 {
-    const JSObject *nsa = (const JSObject *) a;
-    const JSObject *nsb = (const JSObject *) b;
     JSLinearString *prefixa, *prefixb = nsb->getNamePrefix();
 
     if (prefixb) {
@@ -2387,7 +2444,7 @@ namespace_match(const void *a, const void *b)
 #define TO_SOURCE_FLAG 0x80000000
 
 static JSString *
-XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
+XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray<JSObject> *ancestorNSes,
                uint32 indentLevel, JSBool pretty)
 {
     JSBool indentKids;
@@ -2434,9 +2491,9 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
       case JSXML_CLASS_LIST:
         /* ECMA-357 10.2.2. */
         {
-            JSXMLArrayCursor cursor(&xml->xml_kids);
+            JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
             i = 0;
-            while (JSXML *kid = (JSXML *) cursor.getNext()) {
+            while (JSXML *kid = cursor.getNext()) {
                 if (pretty && i != 0) {
                     if (!sb.append('\n'))
                         return NULL;
@@ -2474,8 +2531,8 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
 
     /* Clone in-scope namespaces not in ancestorNSes into decls. */
     {
-        JSXMLArrayCursor cursor(&xml->xml_namespaces);
-        while ((ns = (JSObject *) cursor.getNext()) != NULL) {
+        JSXMLArrayCursor<JSObject> cursor(&xml->xml_namespaces);
+        while ((ns = cursor.getNext()) != NULL) {
             if (!IsDeclared(ns))
                 continue;
             if (!XMLARRAY_HAS_MEMBER(ancestorNSes, ns, namespace_identity)) {
@@ -2597,8 +2654,8 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
 
     /* Step 17(b): append attributes. */
     {
-        JSXMLArrayCursor cursor(&xml->xml_attrs);
-        while (JSXML *attr = (JSXML *) cursor.getNext()) {
+        JSXMLArrayCursor<JSXML> cursor(&xml->xml_attrs);
+        while (JSXML *attr = cursor.getNext()) {
             if (!sb.append(' '))
                 goto out;
             ns2 = GetNamespace(cx, attr->name, &ancdecls.array);
@@ -2648,8 +2705,8 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
 
     /* Step 17(c): append XML namespace declarations. */
     {
-        JSXMLArrayCursor cursor(&decls.array);
-        while (JSObject *ns3 = (JSObject *) cursor.getNext()) {
+        JSXMLArrayCursor<JSObject> cursor(&decls.array);
+        while (JSObject *ns3 = cursor.getNext()) {
             JS_ASSERT(IsDeclared(ns3));
 
             if (!sb.append(" xmlns"))
@@ -2702,8 +2759,8 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
         }
 
         {
-            JSXMLArrayCursor cursor(&xml->xml_kids);
-            while (JSXML *kid = (JSXML *) cursor.getNext()) {
+            JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
+            while (JSXML *kid = cursor.getNext()) {
                 if (pretty && indentKids) {
                     if (!sb.append('\n'))
                         goto out;
@@ -3067,7 +3124,7 @@ DeepCopy(JSContext *cx, JSXML *xml, JSObject *obj, uintN flags)
  * (iii) from's owning object must be locked if not thread-local.
  */
 static JSBool
-DeepCopySetInLRS(JSContext *cx, JSXMLArray *from, JSXMLArray *to, JSXML *parent,
+DeepCopySetInLRS(JSContext *cx, JSXMLArray<JSXML> *from, JSXMLArray<JSXML> *to, JSXML *parent,
                  uintN flags)
 {
     uint32 j, n;
@@ -3078,9 +3135,9 @@ DeepCopySetInLRS(JSContext *cx, JSXMLArray *from, JSXMLArray *to, JSXML *parent,
     if (!to->setCapacity(cx, n))
         return JS_FALSE;
 
-    JSXMLArrayCursor cursor(from);
+    JSXMLArrayCursor<JSXML> cursor(from);
     j = 0;
-    while (JSXML *kid = (JSXML *) cursor.getNext()) {
+    while (JSXML *kid = cursor.getNext()) {
         if ((flags & XSF_IGNORE_COMMENTS) &&
             kid->xml_class == JSXML_CLASS_COMMENT) {
             continue;
@@ -3360,11 +3417,11 @@ retry:
         *bp = JS_FALSE;
     } else {
         {
-            JSXMLArrayCursor cursor(&xml->xml_kids);
-            JSXMLArrayCursor vcursor(&vxml->xml_kids);
+            JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
+            JSXMLArrayCursor<JSXML> vcursor(&vxml->xml_kids);
             for (;;) {
-                kid = (JSXML *) cursor.getNext();
-                vkid = (JSXML *) vcursor.getNext();
+                kid = cursor.getNext();
+                vkid = vcursor.getNext();
                 if (!kid || !vkid) {
                     *bp = !kid && !vkid;
                     break;
@@ -3600,7 +3657,7 @@ static void
 DeleteNamedProperty(JSContext *cx, JSXML *xml, JSObject *nameqn,
                     JSBool attributes)
 {
-    JSXMLArray *array;
+    JSXMLArray<JSXML> *array;
     uint32 index, deleteCount;
     JSXML *kid;
     JSXMLNameMatcher matcher;
@@ -3658,7 +3715,7 @@ DeleteListElement(JSContext *cx, JSXML *xml, uint32 index)
                     DeleteNamedProperty(cx, parent, kid->name, JS_TRUE);
                 } else {
                     kidIndex = XMLARRAY_FIND_MEMBER(&parent->xml_kids, kid,
-                                                    NULL);
+                                                    pointer_match);
                     JS_ASSERT(kidIndex != XML_NOT_FOUND);
                     DeleteByIndex(cx, parent, kidIndex);
                 }
@@ -3671,7 +3728,7 @@ DeleteListElement(JSContext *cx, JSXML *xml, uint32 index)
 static JSBool
 SyncInScopeNamespaces(JSContext *cx, JSXML *xml)
 {
-    JSXMLArray *nsarray;
+    JSXMLArray<JSObject> *nsarray;
     uint32 i, n;
     JSObject *ns;
 
@@ -3691,13 +3748,13 @@ SyncInScopeNamespaces(JSContext *cx, JSXML *xml)
 static JSBool
 GetNamedProperty(JSContext *cx, JSXML *xml, JSObject* nameqn, JSXML *list)
 {
-    JSXMLArray *array;
+    JSXMLArray<JSXML> *array;
     JSXMLNameMatcher matcher;
     JSBool attrs;
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
-        JSXMLArrayCursor cursor(&xml->xml_kids);
-        while (JSXML *kid = (JSXML *) cursor.getNext()) {
+        JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
+        while (JSXML *kid = cursor.getNext()) {
             if (kid->xml_class == JSXML_CLASS_ELEMENT &&
                 !GetNamedProperty(cx, kid, nameqn, list)) {
                 return JS_FALSE;
@@ -3713,8 +3770,8 @@ GetNamedProperty(JSContext *cx, JSXML *xml, JSObject* nameqn, JSXML *list)
             matcher = MatchElemName;
         }
 
-        JSXMLArrayCursor cursor(array);
-        while (JSXML *kid = (JSXML *) cursor.getNext()) {
+        JSXMLArrayCursor<JSXML> cursor(array);
+        while (JSXML *kid = cursor.getNext()) {
             if (matcher(nameqn, kid)) {
                 if (!attrs &&
                     kid->xml_class == JSXML_CLASS_ELEMENT &&
@@ -4100,7 +4157,7 @@ PutProperty(JSContext *cx, JSObject *obj, jsid id, JSBool strict, jsval *vp)
 
             JS_ASSERT(parent != xml);
             if (parent) {
-                q = XMLARRAY_FIND_MEMBER(&parent->xml_kids, kid, NULL);
+                q = XMLARRAY_FIND_MEMBER(&parent->xml_kids, kid, pointer_match);
                 JS_ASSERT(q != XML_NOT_FOUND);
                 ok = Replace(cx, parent, q, OBJECT_TO_JSVAL(copyobj));
                 if (!ok)
@@ -4137,7 +4194,7 @@ PutProperty(JSContext *cx, JSObject *obj, jsid id, JSBool strict, jsval *vp)
         /* 2(g). */
         else if (vxml || JSXML_HAS_VALUE(kid)) {
             if (parent) {
-                q = XMLARRAY_FIND_MEMBER(&parent->xml_kids, kid, NULL);
+                q = XMLARRAY_FIND_MEMBER(&parent->xml_kids, kid, pointer_match);
                 JS_ASSERT(q != XML_NOT_FOUND);
                 ok = Replace(cx, parent, q, *vp);
                 if (!ok)
@@ -4448,9 +4505,9 @@ PutProperty(JSContext *cx, JSObject *obj, jsid id, JSBool strict, jsval *vp)
 
         /* 14. */
         if (primitiveAssign) {
-            JSXMLArrayCursor cursor(&xml->xml_kids);
+            JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
             cursor.index = matchIndex;
-            kid = (JSXML *) cursor.getCurrent();
+            kid = cursor.getCurrent();
             if (JSXML_HAS_KIDS(kid)) {
                 kid->xml_kids.finish(cx);
                 kid->xml_kids.init();
@@ -4463,7 +4520,7 @@ PutProperty(JSContext *cx, JSObject *obj, jsid id, JSBool strict, jsval *vp)
                 ok = JS_ConvertValue(cx, *vp, JSTYPE_STRING, vp);
                 if (ok && !JSVAL_TO_STRING(*vp)->empty()) {
                     roots[VAL_ROOT] = *vp;
-                    if ((JSXML *) cursor.getCurrent() == kid)
+                    if (cursor.getCurrent() == kid)
                         ok = Replace(cx, kid, 0, *vp);
                 }
             }
@@ -4551,14 +4608,14 @@ static JSBool
 HasNamedProperty(JSXML *xml, JSObject *nameqn)
 {
     JSBool found;
-    JSXMLArray *array;
+    JSXMLArray<JSXML> *array;
     JSXMLNameMatcher matcher;
     uint32 i, n;
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
         found = JS_FALSE;
-        JSXMLArrayCursor cursor(&xml->xml_kids);
-        while (JSXML *kid = (JSXML *) cursor.getNext()) {
+        JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
+        while (JSXML *kid = cursor.getNext()) {
             found = HasNamedProperty(kid, nameqn);
             if (found)
                 break;
@@ -4690,17 +4747,6 @@ HasProperty(JSContext *cx, JSObject *obj, jsval id, JSBool *found)
 static void
 xml_finalize(JSContext *cx, JSObject *obj)
 {
-    JSXML *xml = (JSXML *) obj->getPrivate();
-    if (!xml)
-        return;
-    if (xml->object == obj)
-        xml->object = NULL;
-}
-
-static void
-xml_trace_vector(JSTracer *trc, JSXML **vec, uint32 len)
-{
-    MarkXMLRange(trc, len, vec, "xml_vector");
 }
 
 /*
@@ -5074,7 +5120,7 @@ xml_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op, Value *statep,
 {
     JSXML *xml;
     uint32 length, index;
-    JSXMLArrayCursor *cursor;
+    JSXMLArrayCursor<JSXML> *cursor;
 
     xml = (JSXML *)obj->getPrivate();
     length = JSXML_LENGTH(xml);
@@ -5085,7 +5131,7 @@ xml_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op, Value *statep,
         if (length == 0) {
             statep->setInt32(0);
         } else {
-            cursor = cx->new_<JSXMLArrayCursor>(&xml->xml_kids);
+            cursor = cx->new_< JSXMLArrayCursor<JSXML> >(&xml->xml_kids);
             if (!cursor)
                 return JS_FALSE;
             statep->setPrivate(cursor);
@@ -5099,7 +5145,7 @@ xml_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op, Value *statep,
             statep->setNull();
             break;
         }
-        cursor = (JSXMLArrayCursor *) statep->toPrivate();
+        cursor = (JSXMLArrayCursor<JSXML> *) statep->toPrivate();
         if (cursor && cursor->array && (index = cursor->index) < length) {
             *idp = INT_TO_JSID(index);
             cursor->index = index + 1;
@@ -5109,7 +5155,7 @@ xml_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op, Value *statep,
 
       case JSENUMERATE_DESTROY:
         if (!statep->isInt32(0)) {
-            cursor = (JSXMLArrayCursor *) statep->toPrivate();
+            cursor = (JSXMLArrayCursor<JSXML> *) statep->toPrivate();
             if (cursor)
                 cx->delete_(cursor);
         }
@@ -5135,8 +5181,12 @@ static void
 xml_trace(JSTracer *trc, JSObject *obj)
 {
     JSXML *xml = (JSXML *) obj->getPrivate();
+    /*
+     * This is safe to leave Unbarriered for incremental GC, but we'll need
+     * to fix somehow for generational.
+     */
     if (xml)
-        JS_CALL_TRACER(trc, xml, JSTRACE_XML, "private");
+        MarkXMLUnbarriered(trc, xml, "private");
 }
 
 static JSBool
@@ -5645,8 +5695,8 @@ xml_child(JSContext *cx, uintN argc, jsval *vp)
         if (!list)
             return JS_FALSE;
 
-        JSXMLArrayCursor cursor(&xml->xml_kids);
-        while (JSXML *kid = (JSXML *) cursor.getNext()) {
+        JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
+        while (JSXML *kid = cursor.getNext()) {
             kidobj = js_GetXMLObject(cx, kid);
             if (!kidobj)
                 return JS_FALSE;
@@ -5786,8 +5836,8 @@ xml_contains(JSContext *cx, uintN argc, jsval *vp)
     value = argc != 0 ? vp[2] : JSVAL_VOID;
     if (xml->xml_class == JSXML_CLASS_LIST) {
         eq = JS_FALSE;
-        JSXMLArrayCursor cursor(&xml->xml_kids);
-        while (JSXML *kid = (JSXML *) cursor.getNext()) {
+        JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
+        while (JSXML *kid = cursor.getNext()) {
             kidobj = js_GetXMLObject(cx, kid);
             if (!kidobj || !js_TestXMLEquality(cx, ObjectValue(*kidobj), value, &eq))
                 return JS_FALSE;
@@ -5852,8 +5902,8 @@ xml_elements_helper(JSContext *cx, JSObject *obj, JSXML *xml,
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
         /* 13.5.4.6 */
-        JSXMLArrayCursor cursor(&xml->xml_kids);
-        while (JSXML *kid = (JSXML *) cursor.getNext()) {
+        JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
+        while (JSXML *kid = cursor.getNext()) {
             if (kid->xml_class == JSXML_CLASS_ELEMENT) {
                 ok = js_EnterLocalRootScope(cx);
                 if (!ok)
@@ -5992,7 +6042,7 @@ xml_hasSimpleContent(JSContext *cx, uintN argc, jsval *vp)
 }
 
 static JSBool
-FindInScopeNamespaces(JSContext *cx, JSXML *xml, JSXMLArray *nsarray)
+FindInScopeNamespaces(JSContext *cx, JSXML *xml, JSXMLArray<JSObject> *nsarray)
 {
     uint32 length, i, j, n;
     JSObject *ns, *ns2;
@@ -6037,7 +6087,7 @@ FindInScopeNamespaces(JSContext *cx, JSXML *xml, JSXMLArray *nsarray)
  * rval.  rval must point to a rooted location.
  */
 static bool
-NamespacesToJSArray(JSContext *cx, JSXMLArray *array, jsval *rval)
+NamespacesToJSArray(JSContext *cx, JSXMLArray<JSObject> *array, jsval *rval)
 {
     JSObject *arrayobj = NewDenseEmptyArray(cx);
     if (!arrayobj)
@@ -6086,7 +6136,7 @@ xml_insertChildAfter(JSContext *cx, uintN argc, jsval *vp)
         if (!VALUE_IS_XML(arg))
             return JS_TRUE;
         kid = (JSXML *) JSVAL_TO_OBJECT(arg)->getPrivate();
-        i = XMLARRAY_FIND_MEMBER(&xml->xml_kids, kid, NULL);
+        i = XMLARRAY_FIND_MEMBER(&xml->xml_kids, kid, pointer_match);
         if (i == XML_NOT_FOUND)
             return JS_TRUE;
         ++i;
@@ -6118,7 +6168,7 @@ xml_insertChildBefore(JSContext *cx, uintN argc, jsval *vp)
         if (!VALUE_IS_XML(arg))
             return JS_TRUE;
         kid = (JSXML *) JSVAL_TO_OBJECT(arg)->getPrivate();
-        i = XMLARRAY_FIND_MEMBER(&xml->xml_kids, kid, NULL);
+        i = XMLARRAY_FIND_MEMBER(&xml->xml_kids, kid, pointer_match);
         if (i == XML_NOT_FOUND)
             return JS_TRUE;
     }
@@ -6397,8 +6447,8 @@ xml_processingInstructions_helper(JSContext *cx, JSObject *obj, JSXML *xml,
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
         /* 13.5.4.17 Step 4 (misnumbered 9 -- Erratum?). */
-        JSXMLArrayCursor cursor(&xml->xml_kids);
-        while (JSXML *kid = (JSXML *) cursor.getNext()) {
+        JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
+        while (JSXML *kid = cursor.getNext()) {
             if (kid->xml_class == JSXML_CLASS_ELEMENT) {
                 ok = js_EnterLocalRootScope(cx);
                 if (!ok)
@@ -6500,10 +6550,8 @@ xml_propertyIsEnumerable(JSContext *cx, uintN argc, jsval *vp)
 }
 
 static JSBool
-namespace_full_match(const void *a, const void *b)
+namespace_full_match(const JSObject *nsa, const JSObject *nsb)
 {
-    const JSObject *nsa = (const JSObject *) a;
-    const JSObject *nsb = (const JSObject *) b;
     JSLinearString *prefixa = nsa->getNamePrefix();
     JSLinearString *prefixb;
 
@@ -6706,7 +6754,7 @@ xml_setName(JSContext *cx, uintN argc, jsval *vp)
     jsval name;
     JSObject *nameqn;
     JSXML *nsowner;
-    JSXMLArray *nsarray;
+    JSXMLArray<JSObject> *nsarray;
     uint32 i, n;
     JSObject *ns;
 
@@ -6769,7 +6817,7 @@ xml_setName(JSContext *cx, uintN argc, jsval *vp)
             return JS_FALSE;
 
         /* XXXbe have to test membership to see whether GetNamespace added */
-        if (XMLARRAY_HAS_MEMBER(&nsowner->xml_namespaces, ns, NULL)) {
+        if (XMLARRAY_HAS_MEMBER(&nsowner->xml_namespaces, ns, pointer_match)) {
             vp[0] = JSVAL_VOID;
             return JS_TRUE;
         }
@@ -6812,8 +6860,9 @@ xml_setName(JSContext *cx, uintN argc, jsval *vp)
 }
 
 /* Utility function used within xml_setNamespace */
-static JSBool qn_match(const void *xml, const void *qn) {
-    return qname_identity(((JSXML *)xml)->name, (JSObject *)qn);
+static JSBool qn_match(const JSXML *xml, const JSObject *qn)
+{
+    return qname_identity(xml->name, qn);
 }
 
 /* ECMA-357 13.4.4.36 */
@@ -6855,7 +6904,7 @@ xml_setNamespace(JSContext *cx, uintN argc, jsval *vp)
         xml->parent && xml->parent->xml_class == JSXML_CLASS_ELEMENT &&
         !qn_match(xml, qn))
     {
-        JSXMLArray *array = &xml->parent->xml_attrs;
+        JSXMLArray<JSXML> *array = &xml->parent->xml_attrs;
         uint32 i = XMLArrayFindMember(array, qn, qn_match);
         if (i != XML_NOT_FOUND)
             XMLArrayDelete(cx, array, i, JS_TRUE);
@@ -6953,8 +7002,8 @@ xml_toString_helper(JSContext *cx, JSXML *xml)
     str = cx->runtime->emptyString;
     if (!js_EnterLocalRootScope(cx))
         return NULL;
-    JSXMLArrayCursor cursor(&xml->xml_kids);
-    while (JSXML *kid = (JSXML *) cursor.getNext()) {
+    JSXMLArrayCursor<JSXML> cursor(&xml->xml_kids);
+    while (JSXML *kid = cursor.getNext()) {
         if (kid->xml_class != JSXML_CLASS_COMMENT &&
             kid->xml_class != JSXML_CLASS_PROCESSING_INSTRUCTION) {
             kidstr = xml_toString_helper(cx, kid);
@@ -7249,19 +7298,20 @@ js_NewXML(JSContext *cx, JSXMLClass xml_class)
     if (!xml)
         return NULL;
 
-    xml->object = NULL;
+    xml->object.init(NULL);
     xml->domnode = NULL;
-    xml->parent = NULL;
-    xml->name = NULL;
+    xml->parent.init(NULL);
+    xml->name.init(NULL);
     xml->xml_class = xml_class;
     xml->xml_flags = 0;
     if (JSXML_CLASS_HAS_VALUE(xml_class)) {
-        xml->xml_value = cx->runtime->emptyString;
+        xml->xml_value.init(cx->runtime->emptyString);
     } else {
+        xml->xml_value.init(NULL);
         xml->xml_kids.init();
         if (xml_class == JSXML_CLASS_LIST) {
-            xml->xml_target = NULL;
-            xml->xml_targetprop = NULL;
+            xml->xml_target.init(NULL);
+            xml->xml_targetprop.init(NULL);
         } else {
             xml->xml_namespaces.init();
             xml->xml_attrs.init();
@@ -7275,15 +7325,33 @@ js_NewXML(JSContext *cx, JSXMLClass xml_class)
     return xml;
 }
 
+void
+JSXML::writeBarrierPre(JSXML *xml)
+{
+#ifdef JSGC_INCREMENTAL
+    if (!xml)
+        return;
+
+    JSCompartment *comp = xml->compartment();
+    if (comp->needsBarrier())
+        MarkXMLUnbarriered(comp->barrierTracer(), xml, "write barrier");
+#endif
+}
+
+void
+JSXML::writeBarrierPost(JSXML *xml, void *addr)
+{
+}
+
 void
 js_TraceXML(JSTracer *trc, JSXML *xml)
 {
     if (xml->object)
-        MarkObject(trc, *xml->object, "object");
+        MarkObject(trc, xml->object, "object");
     if (xml->name)
-        MarkObject(trc, *xml->name, "name");
+        MarkObject(trc, xml->name, "name");
     if (xml->parent)
-        JS_CALL_TRACER(trc, xml->parent, JSTRACE_XML, "xml_parent");
+        MarkXML(trc, xml->parent, "xml_parent");
 
     if (JSXML_HAS_VALUE(xml)) {
         if (xml->xml_value)
@@ -7291,25 +7359,21 @@ js_TraceXML(JSTracer *trc, JSXML *xml)
         return;
     }
 
-    xml_trace_vector(trc,
-                     (JSXML **) xml->xml_kids.vector,
-                     xml->xml_kids.length);
+    MarkXMLRange(trc, xml->xml_kids.length, xml->xml_kids.vector, "xml_kids");
     XMLArrayCursorTrace(trc, xml->xml_kids.cursors);
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
         if (xml->xml_target)
-            JS_CALL_TRACER(trc, xml->xml_target, JSTRACE_XML, "target");
+            MarkXML(trc, xml->xml_target, "target");
         if (xml->xml_targetprop)
-            MarkObject(trc, *xml->xml_targetprop, "targetprop");
+            MarkObject(trc, xml->xml_targetprop, "targetprop");
     } else {
         MarkObjectRange(trc, xml->xml_namespaces.length,
-                        (JSObject **) xml->xml_namespaces.vector,
+                        xml->xml_namespaces.vector,
                         "xml_namespaces");
         XMLArrayCursorTrace(trc, xml->xml_namespaces.cursors);
 
-        xml_trace_vector(trc,
-                         (JSXML **) xml->xml_attrs.vector,
-                         xml->xml_attrs.length);
+        MarkXMLRange(trc, xml->xml_attrs.length, xml->xml_attrs.vector, "xml_attrs");
         XMLArrayCursorTrace(trc, xml->xml_attrs.cursors);
     }
 }
@@ -7500,7 +7564,7 @@ namespace js {
 bool
 GlobalObject::getFunctionNamespace(JSContext *cx, Value *vp)
 {
-    Value &v = getSlotRef(FUNCTION_NS);
+    HeapValue &v = getSlotRef(FUNCTION_NS);
     if (v.isUndefined()) {
         JSRuntime *rt = cx->runtime;
         JSLinearString *prefix = rt->atomState.typeAtoms[JSTYPE_FUNCTION];
@@ -7518,7 +7582,7 @@ GlobalObject::getFunctionNamespace(JSContext *cx, Value *vp)
          */
         obj->clearType();
 
-        v.setObject(*obj);
+        v.set(compartment(), ObjectValue(*obj));
     }
 
     *vp = v;
@@ -7837,12 +7901,12 @@ js_DeleteXMLListElements(JSContext *cx, JSObject *listobj)
 
 struct JSXMLFilter
 {
-    JSXML               *list;
-    JSXML               *result;
-    JSXML               *kid;
-    JSXMLArrayCursor    cursor;
+    HeapPtr<JSXML>             list;
+    HeapPtr<JSXML>             result;
+    HeapPtr<JSXML>             kid;
+    JSXMLArrayCursor<JSXML>    cursor;
 
-    JSXMLFilter(JSXML *list, JSXMLArray *array)
+    JSXMLFilter(JSXML *list, JSXMLArray<JSXML> *array)
       : list(list), result(NULL), kid(NULL), cursor(array) {}
 
     ~JSXMLFilter() {}
@@ -7856,11 +7920,11 @@ xmlfilter_trace(JSTracer *trc, JSObject *obj)
         return;
 
     JS_ASSERT(filter->list);
-    JS_CALL_TRACER(trc, filter->list, JSTRACE_XML, "list");
+    MarkXML(trc, filter->list, "list");
     if (filter->result)
-        JS_CALL_TRACER(trc, filter->result, JSTRACE_XML, "result");
+        MarkXML(trc, filter->result, "result");
     if (filter->kid)
-        JS_CALL_TRACER(trc, filter->kid, JSTRACE_XML, "kid");
+        MarkXML(trc, filter->kid, "kid");
 
     /*
      * We do not need to trace the cursor as that would be done when
@@ -7975,7 +8039,7 @@ js_StepXMLListFilter(JSContext *cx, JSBool initialized)
     }
 
     /* Do the iteration. */
-    filter->kid = (JSXML *) filter->cursor.getNext();
+    filter->kid = filter->cursor.getNext();
     if (!filter->kid) {
         /*
          * Do not defer finishing the cursor until the next GC cycle to avoid
diff --git a/js/src/jsxml.h b/js/src/jsxml.h
index 2a3e3a08de8f..888c9d6bb00a 100644
--- a/js/src/jsxml.h
+++ b/js/src/jsxml.h
@@ -43,6 +43,8 @@
 #include "jsobj.h"
 #include "jscell.h"
 
+#include "gc/Barrier.h"
+
 extern const char js_AnyName_str[];
 extern const char js_AttributeName_str[];
 extern const char js_isXMLName_str[];
@@ -53,14 +55,16 @@ extern const char js_gt_entity_str[];
 extern const char js_lt_entity_str[];
 extern const char js_quot_entity_str[];
 
-typedef JSBool
-(* JSIdentityOp)(const void *a, const void *b);
+template<class T>
+struct JSXMLArrayCursor;
 
-struct JSXMLArray {
+template<class T>
+struct JSXMLArray
+{
     uint32              length;
     uint32              capacity;
-    void                **vector;
-    JSXMLArrayCursor    *cursors;
+    js::HeapPtr<T>      *vector;
+    JSXMLArrayCursor<T> *cursors;
 
     void init() {
         length = capacity = 0;
@@ -74,15 +78,18 @@ struct JSXMLArray {
     void trim();
 };
 
+template<class T>
 struct JSXMLArrayCursor
 {
-    JSXMLArray       *array;
-    uint32           index;
-    JSXMLArrayCursor *next;
-    JSXMLArrayCursor **prevp;
-    void             *root;
+    typedef js::HeapPtr<T> HeapPtrT;
 
-    JSXMLArrayCursor(JSXMLArray *array)
+    JSXMLArray<T>       *array;
+    uint32              index;
+    JSXMLArrayCursor<T> *next;
+    JSXMLArrayCursor<T> **prevp;
+    HeapPtrT            root;
+
+    JSXMLArrayCursor(JSXMLArray<T> *array)
       : array(array), index(0), next(array->cursors), prevp(&array->cursors),
         root(NULL)
     {
@@ -100,15 +107,16 @@ struct JSXMLArrayCursor
             next->prevp = prevp;
         *prevp = next;
         array = NULL;
+        root.~HeapPtrT();
     }
 
-    void *getNext() {
+    T *getNext() {
         if (!array || index >= array->length)
             return NULL;
         return root = array->vector[index++];
     }
 
-    void *getCurrent() {
+    T *getCurrent() {
         if (!array || index >= array->length)
             return NULL;
         return root = array->vector[index];
@@ -146,24 +154,24 @@ typedef enum JSXMLClass {
 #endif
 
 typedef struct JSXMLListVar {
-    JSXMLArray          kids;           /* NB: must come first */
-    JSXML               *target;
-    JSObject            *targetprop;
+    JSXMLArray<JSXML>   kids;           /* NB: must come first */
+    js::HeapPtrXML      target;
+    js::HeapPtrObject   targetprop;
 } JSXMLListVar;
 
 typedef struct JSXMLElemVar {
-    JSXMLArray          kids;           /* NB: must come first */
-    JSXMLArray          namespaces;
-    JSXMLArray          attrs;
+    JSXMLArray<JSXML>    kids;          /* NB: must come first */
+    JSXMLArray<JSObject> namespaces;
+    JSXMLArray<JSXML>    attrs;
 } JSXMLElemVar;
 
 /* union member shorthands */
-#define xml_kids        u.list.kids
-#define xml_target      u.list.target
-#define xml_targetprop  u.list.targetprop
-#define xml_namespaces  u.elem.namespaces
-#define xml_attrs       u.elem.attrs
-#define xml_value       u.value
+#define xml_kids        list.kids
+#define xml_target      list.target
+#define xml_targetprop  list.targetprop
+#define xml_namespaces  elem.namespaces
+#define xml_attrs       elem.attrs
+#define xml_value       value
 
 /* xml_class-testing macros */
 #define JSXML_HAS_KIDS(xml)     JSXML_CLASS_HAS_KIDS((xml)->xml_class)
@@ -178,30 +186,26 @@ struct JSXML : js::gc::Cell {
     JSCList             links;
     uint32              serial;
 #endif
-    JSObject            *object;
+    js::HeapPtrObject   object;
     void                *domnode;       /* DOM node if mapped info item */
-    JSXML               *parent;
-    JSObject            *name;
+    js::HeapPtrXML      parent;
+    js::HeapPtrObject   name;
     uint32              xml_class;      /* discriminates u, below */
     uint32              xml_flags;      /* flags, see below */
-    union {
-        JSXMLListVar    list;
-        JSXMLElemVar    elem;
-        JSString        *value;
-    } u;
-    
-    void finalize(JSContext *cx) {
-        if (JSXML_HAS_KIDS(this)) {
-            xml_kids.finish(cx);
-            if (xml_class == JSXML_CLASS_ELEMENT) {
-                xml_namespaces.finish(cx);
-                xml_attrs.finish(cx);
-            }
-        }
-#ifdef DEBUG_notme
-        JS_REMOVE_LINK(&links);
+
+    JSXMLListVar        list;
+    JSXMLElemVar        elem;
+    js::HeapPtrString   value;
+
+#if JS_BITS_PER_WORD == 32
+    /* The size of every GC thing must be divisible by the FreeCell size. */
+    void *pad;
 #endif
-    }
+
+    void finalize(JSContext *cx);
+
+    static void writeBarrierPre(JSXML *xml);
+    static void writeBarrierPost(JSXML *xml, void *addr);
 };
 
 /* xml_flags values */
diff --git a/js/src/methodjit/BaseAssembler.h b/js/src/methodjit/BaseAssembler.h
index 98b0095eb152..e8af5b36afd1 100644
--- a/js/src/methodjit/BaseAssembler.h
+++ b/js/src/methodjit/BaseAssembler.h
@@ -624,7 +624,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
             addPtr(Imm32(sizeof(StackFrame) + frameDepth * sizeof(jsval)),
                    JSFrameReg,
                    Registers::ClobberInCall);
-            storePtr(Registers::ClobberInCall, FrameAddress(offsetof(VMFrame, regs.sp)));
+            storePtr(Registers::ClobberInCall, FrameAddress(VMFrame::offsetOfRegsSp()));
         }
     }
 
@@ -645,7 +645,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
         storePtr(JSFrameReg, FrameAddress(VMFrame::offsetOfFp));
 
         /* PC -> regs->pc :( */
-        storePtr(ImmPtr(pc), FrameAddress(offsetof(VMFrame, regs.pc)));
+        storePtr(ImmPtr(pc), FrameAddress(VMFrame::offsetOfRegsPc()));
 
         if (inlining) {
             /* inlined -> regs->inlined :( */
@@ -663,7 +663,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
 
         /* Store fp and pc */
         storePtr(JSFrameReg, FrameAddress(VMFrame::offsetOfFp));
-        storePtr(ImmPtr(pc), FrameAddress(offsetof(VMFrame, regs.pc)));
+        storePtr(ImmPtr(pc), FrameAddress(VMFrame::offsetOfRegsPc()));
 
         if (inlining) {
             /* ABI calls cannot be made from inlined frames. */
@@ -771,7 +771,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
         JS_ASSERT(objReg != typeReg);
 
         FastArrayLoadFails fails;
-        fails.rangeCheck = guardArrayExtent(offsetof(JSObject, initializedLength),
+        fails.rangeCheck = guardArrayExtent(JSObject::offsetOfInitializedLength(),
                                             objReg, key, BelowOrEqual);
 
         RegisterID dslotsReg = objReg;
@@ -1285,7 +1285,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
          * slots first.
          */
         if (templateObject->isDenseArray()) {
-            JS_ASSERT(!templateObject->initializedLength);
+            JS_ASSERT(!templateObject->initializedLength());
             addPtr(Imm32(-thingSize + sizeof(JSObject)), result);
             storePtr(result, Address(result, -(int)sizeof(JSObject) + JSObject::offsetOfSlots()));
             addPtr(Imm32(-(int)sizeof(JSObject)), result);
@@ -1328,12 +1328,19 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
         storeDouble(Registers::FPConversionTemp, Address(scratch));
     }
 
+    /* Add one to the accumulator 'counter'. */
+    void bumpCounter(double *counter, RegisterID scratch)
+    {
+        addCounter(&oneDouble, counter, scratch);
+    }
+
     /* Bump the stub call count for script/pc if they are being counted. */
     void bumpStubCounter(JSScript *script, jsbytecode *pc, RegisterID scratch)
     {
         if (script->pcCounters) {
-            double *counter = &script->pcCounters.get(JSPCCounters::METHODJIT_STUBS, pc - script->code);
-            addCounter(&oneDouble, counter, scratch);
+            OpcodeCounts counts = script->getCounts(pc);
+            double *counter = &counts.get(OpcodeCounts::BASE_METHODJIT_STUBS);
+            bumpCounter(counter, scratch);
         }
     }
 
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index e286444108a1..6b3ca2a87a50 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -1591,7 +1591,7 @@ mjit::Compiler::generateMethod()
                     Label start = masm.label();
                     if (!frame.syncForBranch(PC, Uses(0)))
                         return Compile_Error;
-                    if (pcLengths) {
+                    if (pcLengths && lastPC) {
                         /* Track this sync code for the previous op. */
                         size_t length = masm.size() - masm.distanceOf(start);
                         uint32 offset = ssa.frameLength(a->inlineIndex) + lastPC - script->code;
@@ -1649,6 +1649,28 @@ mjit::Compiler::generateMethod()
 
         Label codeStart = masm.label();
         bool countersUpdated = false;
+        bool arithUpdated = false;
+
+        JSValueType arithFirstUseType = JSVAL_TYPE_UNKNOWN;
+        JSValueType arithSecondUseType = JSVAL_TYPE_UNKNOWN;
+        if (script->pcCounters && !!(js_CodeSpec[op].format & JOF_ARITH)) {
+            if (GetUseCount(script, PC - script->code) == 1) {
+                FrameEntry *use = frame.peek(-1);
+                /*
+                 * Pretend it's a binary operation and the second operand has
+                 * the same type as the first one.
+                 */
+                if (use->isTypeKnown())
+                    arithFirstUseType = arithSecondUseType = use->getKnownType();
+            } else {
+                FrameEntry *use = frame.peek(-1);
+                if (use->isTypeKnown())
+                    arithFirstUseType = use->getKnownType();
+                use = frame.peek(-2);
+                if (use->isTypeKnown())
+                    arithSecondUseType = use->getKnownType();
+            }
+        }
 
         /*
          * Update PC counters for jump opcodes at their start, so that we don't
@@ -1829,6 +1851,11 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_EQ)
           BEGIN_CASE(JSOP_NE)
           {
+           if (script->pcCounters) {
+               updateArithCounters(PC, NULL, arithFirstUseType, arithSecondUseType);
+               arithUpdated = true;
+           }
+
             /* Detect fusions. */
             jsbytecode *next = &PC[JSOP_GE_LENGTH];
             JSOp fused = JSOp(*next);
@@ -2059,6 +2086,8 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_GETPROP)
 
           BEGIN_CASE(JSOP_GETELEM)
+            if (script->pcCounters)
+                updateElemCounters(PC, frame.peek(-2), frame.peek(-1));
             if (!jsop_getelem(false))
                 return Compile_Error;
           END_CASE(JSOP_GETELEM)
@@ -2069,6 +2098,8 @@ mjit::Compiler::generateMethod()
 
           BEGIN_CASE(JSOP_SETELEM)
           {
+            if (script->pcCounters)
+                updateElemCounters(PC, frame.peek(-3), frame.peek(-2));
             jsbytecode *next = &PC[JSOP_SETELEM_LENGTH];
             bool pop = (JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next));
             if (!jsop_setelem(pop))
@@ -2242,13 +2273,14 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_CASE)
 
           BEGIN_CASE(JSOP_STRICTEQ)
+          BEGIN_CASE(JSOP_STRICTNE)
+            if (script->pcCounters) {
+                updateArithCounters(PC, NULL, arithFirstUseType, arithSecondUseType);
+                arithUpdated = true;
+            }
             jsop_stricteq(op);
           END_CASE(JSOP_STRICTEQ)
 
-          BEGIN_CASE(JSOP_STRICTNE)
-            jsop_stricteq(op);
-          END_CASE(JSOP_STRICTNE)
-
           BEGIN_CASE(JSOP_ITER)
             if (!iter(PC[1]))
                 return Compile_Error;
@@ -2403,16 +2435,42 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_DECARG)
           BEGIN_CASE(JSOP_ARGINC)
           BEGIN_CASE(JSOP_ARGDEC)
+            if (script->pcCounters) {
+                restoreVarType();
+                FrameEntry *fe = frame.getArg(GET_SLOTNO(PC));
+                if (fe->isTypeKnown())
+                    arithFirstUseType = fe->getKnownType();
+            }
+
             if (!jsop_arginc(op, GET_SLOTNO(PC)))
                 return Compile_Retry;
+
+            if (script->pcCounters) {
+                FrameEntry *fe = frame.getArg(GET_SLOTNO(PC));
+                updateArithCounters(PC, fe, arithFirstUseType, JSVAL_TYPE_INT32);
+                arithUpdated = true;
+            }
           END_CASE(JSOP_ARGDEC)
 
           BEGIN_CASE(JSOP_INCLOCAL)
           BEGIN_CASE(JSOP_DECLOCAL)
           BEGIN_CASE(JSOP_LOCALINC)
           BEGIN_CASE(JSOP_LOCALDEC)
+            if (script->pcCounters) {
+                restoreVarType();
+                FrameEntry *fe = frame.getLocal(GET_SLOTNO(PC));
+                if (fe->isTypeKnown())
+                    arithFirstUseType = fe->getKnownType();
+            }
+
             if (!jsop_localinc(op, GET_SLOTNO(PC)))
                 return Compile_Retry;
+
+            if (script->pcCounters) {
+                FrameEntry *fe = frame.getLocal(GET_SLOTNO(PC));
+                updateArithCounters(PC, fe, arithFirstUseType, JSVAL_TYPE_INT32);
+                arithUpdated = true;
+            }
           END_CASE(JSOP_LOCALDEC)
 
           BEGIN_CASE(JSOP_BINDNAME)
@@ -2442,6 +2500,7 @@ mjit::Compiler::generateMethod()
             prepareStubCall(Uses(1));
             INLINE_STUBCALL(stubs::Throw, REJOIN_NONE);
             frame.pop();
+            fallthrough = false;
           END_CASE(JSOP_THROW)
 
           BEGIN_CASE(JSOP_IN)
@@ -2504,6 +2563,12 @@ mjit::Compiler::generateMethod()
             /* No-op for the decompiler. */
           END_CASE(JSOP_CONDSWITCH)
 
+          BEGIN_CASE(JSOP_LABEL)
+          END_CASE(JSOP_LABEL)
+
+          BEGIN_CASE(JSOP_LABELX)
+          END_CASE(JSOP_LABELX)
+
           BEGIN_CASE(JSOP_DEFFUN)
           {
             uint32 index = fullAtomIndex(PC);
@@ -2641,6 +2706,7 @@ mjit::Compiler::generateMethod()
 
           BEGIN_CASE(JSOP_RETRVAL)
             emitReturn(NULL);
+            fallthrough = false;
           END_CASE(JSOP_RETRVAL)
 
           BEGIN_CASE(JSOP_GETGNAME)
@@ -2686,6 +2752,8 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_UINT24)
 
           BEGIN_CASE(JSOP_CALLELEM)
+            if (script->pcCounters)
+                updateElemCounters(PC, frame.peek(-2), frame.peek(-1));
             jsop_getelem(true);
           END_CASE(JSOP_CALLELEM)
 
@@ -2801,10 +2869,31 @@ mjit::Compiler::generateMethod()
             }
         }
 
-        if (script->pcCounters || pcLengths) {
+        if (script->pcCounters) {
             size_t length = masm.size() - masm.distanceOf(codeStart);
-            if (countersUpdated || length != 0) {
-                if (!countersUpdated && script->pcCounters)
+            bool typesUpdated = false;
+
+            /* Update information about the type of value pushed by arithmetic ops. */
+            if ((js_CodeSpec[op].format & JOF_ARITH) && !arithUpdated) {
+                FrameEntry *pushed = NULL;
+                if (PC == lastPC + analyze::GetBytecodeLength(lastPC))
+                    pushed = frame.peek(-1);
+                updateArithCounters(lastPC, pushed, arithFirstUseType, arithSecondUseType);
+                typesUpdated = true;
+            }
+
+            /* Update information about the result type of access operations. */
+            if (OpcodeCounts::accessOp(op) &&
+                op != JSOP_SETPROP && op != JSOP_SETMETHOD && op != JSOP_SETELEM) {
+                FrameEntry *fe = (GetDefCount(script, lastPC - script->code) == 1)
+                    ? frame.peek(-1)
+                    : frame.peek(-2);
+                updatePCTypes(lastPC, fe);
+                typesUpdated = true;
+            }
+
+            if (countersUpdated || typesUpdated || length != 0) {
+                if (!countersUpdated)
                     updatePCCounters(lastPC, &codeStart, &countersUpdated);
 
                 if (pcLengths) {
@@ -2813,6 +2902,11 @@ mjit::Compiler::generateMethod()
                     pcLengths[offset].codeLength += length;
                 }
             }
+        } else if (pcLengths) {
+            /* Fill in the amount of inline code generated for the op. */
+            size_t length = masm.size() - masm.distanceOf(codeStart);
+            uint32 offset = ssa.frameLength(a->inlineIndex) + lastPC - script->code;
+            pcLengths[offset].codeLength += length;
         }
 
         frame.assertValidRegisterState();
@@ -2828,6 +2922,8 @@ mjit::Compiler::generateMethod()
 void
 mjit::Compiler::updatePCCounters(jsbytecode *pc, Label *start, bool *updated)
 {
+    JS_ASSERT(script->pcCounters);
+
     /*
      * Bump the METHODJIT count for the opcode, read the METHODJIT_CODE_LENGTH
      * and METHODJIT_PICS_LENGTH counts, indicating the amounts of inline path
@@ -2845,17 +2941,18 @@ mjit::Compiler::updatePCCounters(jsbytecode *pc, Label *start, bool *updated)
     RegisterID reg = Registers::ReturnReg;
     masm.storePtr(reg, frame.addressOfTop());
 
-    double *code = &script->pcCounters.get(JSPCCounters::METHODJIT_CODE, pc - script->code);
+    OpcodeCounts counts = script->getCounts(pc);
+
+    double *code = &counts.get(OpcodeCounts::BASE_METHODJIT_CODE);
     double *codeLength = &pcLengths[offset].codeLength;
     masm.addCounter(codeLength, code, reg);
 
-    double *pics = &script->pcCounters.get(JSPCCounters::METHODJIT_PICS, pc - script->code);
+    double *pics = &counts.get(OpcodeCounts::BASE_METHODJIT_PICS);
     double *picsLength = &pcLengths[offset].picsLength;
     masm.addCounter(picsLength, pics, reg);
 
-    static const double oneDouble = 1.0;
-    double *counter = &script->pcCounters.get(JSPCCounters::METHODJIT, pc - script->code);
-    masm.addCounter(&oneDouble, counter, reg);
+    double *counter = &counts.get(OpcodeCounts::BASE_METHODJIT);
+    masm.bumpCounter(counter, reg);
 
     /* Reload the base register's original value. */
     masm.loadPtr(frame.addressOfTop(), reg);
@@ -2865,6 +2962,209 @@ mjit::Compiler::updatePCCounters(jsbytecode *pc, Label *start, bool *updated)
     *updated = true;
 }
 
+static inline bool
+HasPayloadType(types::TypeSet *types)
+{
+    if (types->unknown())
+        return false;
+
+    types::TypeFlags flags = types->baseFlags();
+    bool objects = !!(flags & types::TYPE_FLAG_ANYOBJECT) || !!types->getObjectCount();
+
+    if (objects && !!(flags & types::TYPE_FLAG_STRING))
+        return false;
+
+    flags = flags & ~(types::TYPE_FLAG_ANYOBJECT | types::TYPE_FLAG_STRING);
+
+    return (flags == types::TYPE_FLAG_UNDEFINED)
+        || (flags == types::TYPE_FLAG_NULL)
+        || (flags == types::TYPE_FLAG_BOOLEAN);
+}
+
+void
+mjit::Compiler::updatePCTypes(jsbytecode *pc, FrameEntry *fe)
+{
+    JS_ASSERT(script->pcCounters);
+
+    /*
+     * Get a temporary register, as for updatePCCounters. Don't overlap with
+     * the backing store for the entry's type tag, if there is one.
+     */
+    RegisterID reg = Registers::ReturnReg;
+    if (frame.peekTypeInRegister(fe) && reg == frame.tempRegForType(fe)) {
+        JS_STATIC_ASSERT(Registers::ReturnReg != Registers::ArgReg1);
+        reg = Registers::ArgReg1;
+    }
+    masm.push(reg);
+
+    OpcodeCounts counts = script->getCounts(pc);
+
+    /* Update the counters for pushed type tags and possible access types. */
+    if (fe->isTypeKnown()) {
+        masm.bumpCounter(&counts.get(OpcodeCounts::ACCESS_MONOMORPHIC), reg);
+        OpcodeCounts::AccessCounts counter = OpcodeCounts::ACCESS_OBJECT;
+        switch (fe->getKnownType()) {
+          case JSVAL_TYPE_UNDEFINED:  counter = OpcodeCounts::ACCESS_UNDEFINED;  break;
+          case JSVAL_TYPE_NULL:       counter = OpcodeCounts::ACCESS_NULL;       break;
+          case JSVAL_TYPE_BOOLEAN:    counter = OpcodeCounts::ACCESS_BOOLEAN;    break;
+          case JSVAL_TYPE_INT32:      counter = OpcodeCounts::ACCESS_INT32;      break;
+          case JSVAL_TYPE_DOUBLE:     counter = OpcodeCounts::ACCESS_DOUBLE;     break;
+          case JSVAL_TYPE_STRING:     counter = OpcodeCounts::ACCESS_STRING;     break;
+          case JSVAL_TYPE_OBJECT:     counter = OpcodeCounts::ACCESS_OBJECT;     break;
+          default:;
+        }
+        if (counter)
+            masm.bumpCounter(&counts.get(counter), reg);
+    } else {
+        types::TypeSet *types = frame.extra(fe).types;
+        if (types && HasPayloadType(types))
+            masm.bumpCounter(&counts.get(OpcodeCounts::ACCESS_DIMORPHIC), reg);
+        else
+            masm.bumpCounter(&counts.get(OpcodeCounts::ACCESS_POLYMORPHIC), reg);
+
+        frame.loadTypeIntoReg(fe, reg);
+
+        Jump j = masm.testUndefined(Assembler::NotEqual, reg);
+        masm.bumpCounter(&counts.get(OpcodeCounts::ACCESS_UNDEFINED), reg);
+        frame.loadTypeIntoReg(fe, reg);
+        j.linkTo(masm.label(), &masm);
+
+        j = masm.testNull(Assembler::NotEqual, reg);
+        masm.bumpCounter(&counts.get(OpcodeCounts::ACCESS_NULL), reg);
+        frame.loadTypeIntoReg(fe, reg);
+        j.linkTo(masm.label(), &masm);
+
+        j = masm.testBoolean(Assembler::NotEqual, reg);
+        masm.bumpCounter(&counts.get(OpcodeCounts::ACCESS_BOOLEAN), reg);
+        frame.loadTypeIntoReg(fe, reg);
+        j.linkTo(masm.label(), &masm);
+
+        j = masm.testInt32(Assembler::NotEqual, reg);
+        masm.bumpCounter(&counts.get(OpcodeCounts::ACCESS_INT32), reg);
+        frame.loadTypeIntoReg(fe, reg);
+        j.linkTo(masm.label(), &masm);
+
+        j = masm.testDouble(Assembler::NotEqual, reg);
+        masm.bumpCounter(&counts.get(OpcodeCounts::ACCESS_DOUBLE), reg);
+        frame.loadTypeIntoReg(fe, reg);
+        j.linkTo(masm.label(), &masm);
+
+        j = masm.testString(Assembler::NotEqual, reg);
+        masm.bumpCounter(&counts.get(OpcodeCounts::ACCESS_STRING), reg);
+        frame.loadTypeIntoReg(fe, reg);
+        j.linkTo(masm.label(), &masm);
+
+        j = masm.testObject(Assembler::NotEqual, reg);
+        masm.bumpCounter(&counts.get(OpcodeCounts::ACCESS_OBJECT), reg);
+        frame.loadTypeIntoReg(fe, reg);
+        j.linkTo(masm.label(), &masm);
+    }
+
+    /* Update the counter for accesses with type barriers. */
+    if (js_CodeSpec[*pc].format & JOF_TYPESET) {
+        double *counter = &counts.get(hasTypeBarriers(pc)
+                                      ? OpcodeCounts::ACCESS_BARRIER
+                                      : OpcodeCounts::ACCESS_NOBARRIER);
+        masm.bumpCounter(counter, reg);
+    }
+
+    /* Reload the base register's original value. */
+    masm.pop(reg);
+}
+
+void
+mjit::Compiler::updateArithCounters(jsbytecode *pc, FrameEntry *fe,
+                                    JSValueType firstUseType, JSValueType secondUseType)
+{
+    JS_ASSERT(script->pcCounters);
+
+    RegisterID reg = Registers::ReturnReg;
+    masm.push(reg);
+
+    /*
+     * What counter we bump for arithmetic expressions depend on the
+     * known types of its operands.
+     *
+     * ARITH_INT: operands are known ints, result is int
+     * ARITH_OVERFLOW: operands are known ints, result is double
+     * ARITH_DOUBLE: either operand is a known double, result is double
+     * ARITH_OTHER: operands are monomorphic but not int or double
+     * ARITH_UNKNOWN: operands are polymorphic
+     */
+
+    OpcodeCounts::ArithCounts counter;
+    if (firstUseType == JSVAL_TYPE_INT32 && secondUseType == JSVAL_TYPE_INT32 &&
+        (!fe || fe->isNotType(JSVAL_TYPE_DOUBLE))) {
+        counter = OpcodeCounts::ARITH_INT;
+    } else if (firstUseType == JSVAL_TYPE_INT32 || firstUseType == JSVAL_TYPE_DOUBLE ||
+               secondUseType == JSVAL_TYPE_INT32 || secondUseType == JSVAL_TYPE_DOUBLE) {
+        counter = OpcodeCounts::ARITH_DOUBLE;
+    } else if (firstUseType != JSVAL_TYPE_UNKNOWN && secondUseType != JSVAL_TYPE_UNKNOWN &&
+               (!fe || fe->isTypeKnown())) {
+        counter = OpcodeCounts::ARITH_OTHER;
+    } else {
+        counter = OpcodeCounts::ARITH_UNKNOWN;
+    }
+
+    masm.bumpCounter(&script->getCounts(pc).get(counter), reg);
+    masm.pop(reg);
+}
+
+void
+mjit::Compiler::updateElemCounters(jsbytecode *pc, FrameEntry *obj, FrameEntry *id)
+{
+    JS_ASSERT(script->pcCounters);
+
+    RegisterID reg = Registers::ReturnReg;
+    masm.push(reg);
+
+    OpcodeCounts counts = script->getCounts(pc);
+
+    OpcodeCounts::ElementCounts counter;
+    if (id->isTypeKnown()) {
+        switch (id->getKnownType()) {
+          case JSVAL_TYPE_INT32:   counter = OpcodeCounts::ELEM_ID_INT;     break;
+          case JSVAL_TYPE_DOUBLE:  counter = OpcodeCounts::ELEM_ID_DOUBLE;  break;
+          default:                 counter = OpcodeCounts::ELEM_ID_OTHER;   break;
+        }
+    } else {
+        counter = OpcodeCounts::ELEM_ID_UNKNOWN;
+    }
+    masm.bumpCounter(&counts.get(counter), reg);
+
+    if (obj->mightBeType(JSVAL_TYPE_OBJECT)) {
+        types::TypeSet *types = frame.extra(obj).types;
+        if (types && !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_TYPED_ARRAY) &&
+            types->getTypedArrayType(cx) != TypedArray::TYPE_MAX) {
+            counter = OpcodeCounts::ELEM_OBJECT_TYPED;
+        } else if (types && !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY)) {
+            if (!types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED_ARRAY))
+                counter = OpcodeCounts::ELEM_OBJECT_PACKED;
+            else
+                counter = OpcodeCounts::ELEM_OBJECT_DENSE;
+        } else {
+            counter = OpcodeCounts::ELEM_OBJECT_OTHER;
+        }
+        masm.bumpCounter(&counts.get(counter), reg);
+    } else {
+        masm.bumpCounter(&counts.get(OpcodeCounts::ELEM_OBJECT_OTHER), reg);
+    }
+
+    masm.pop(reg);
+}
+
+void
+mjit::Compiler::bumpPropCounter(jsbytecode *pc, int counter)
+{
+    /* Don't accumulate counts for property ops fused with other ops. */
+    if (!(js_CodeSpec[*pc].format & JOF_PROP))
+        return;
+    RegisterID reg = Registers::ReturnReg;
+    masm.push(reg);
+    masm.bumpCounter(&script->getCounts(pc).get(counter), reg);
+    masm.pop(reg);
+}
+
 JSC::MacroAssembler::Label
 mjit::Compiler::labelOf(jsbytecode *pc, uint32 inlineIndex)
 {
@@ -3203,28 +3503,34 @@ mjit::Compiler::emitStubCall(void *ptr, DataLabelPtr *pinline)
 void
 mjit::Compiler::interruptCheckHelper()
 {
-    /*
-     * Bake in and test the address of the interrupt counter for the runtime.
-     * This is faster than doing two additional loads for the context's
-     * thread data, but will cause this thread to run slower if there are
-     * pending interrupts on some other thread.  For non-JS_THREADSAFE builds
-     * we can skip this, as there is only one flag to poll.
-     */
+    Jump jump;
+    if (cx->runtime->gcZeal() >= js::gc::ZealVerifierThreshold) {
+        /* For barrier verification, always take the interrupt so we can verify. */
+        jump = masm.jump();
+    } else {
+        /*
+         * Bake in and test the address of the interrupt counter for the runtime.
+         * This is faster than doing two additional loads for the context's
+         * thread data, but will cause this thread to run slower if there are
+         * pending interrupts on some other thread.  For non-JS_THREADSAFE builds
+         * we can skip this, as there is only one flag to poll.
+         */
 #ifdef JS_THREADSAFE
-    void *interrupt = (void*) &cx->runtime->interruptCounter;
+        void *interrupt = (void*) &cx->runtime->interruptCounter;
 #else
-    void *interrupt = (void*) &JS_THREAD_DATA(cx)->interruptFlags;
+        void *interrupt = (void*) &JS_THREAD_DATA(cx)->interruptFlags;
 #endif
 
 #if defined(JS_CPU_X86) || defined(JS_CPU_ARM)
-    Jump jump = masm.branch32(Assembler::NotEqual, AbsoluteAddress(interrupt), Imm32(0));
+        jump = masm.branch32(Assembler::NotEqual, AbsoluteAddress(interrupt), Imm32(0));
 #else
-    /* Handle processors that can't load from absolute addresses. */
-    RegisterID reg = frame.allocReg();
-    masm.move(ImmPtr(interrupt), reg);
-    Jump jump = masm.branchTest32(Assembler::NonZero, Address(reg, 0));
-    frame.freeReg(reg);
+        /* Handle processors that can't load from absolute addresses. */
+        RegisterID reg = frame.allocReg();
+        masm.move(ImmPtr(interrupt), reg);
+        jump = masm.branchTest32(Assembler::NonZero, Address(reg, 0));
+        frame.freeReg(reg);
 #endif
+    }
 
     stubcc.linkExitDirect(jump, stubcc.masm.label());
 
@@ -3286,7 +3592,7 @@ mjit::Compiler::emitUncachedCall(uint32 argc, bool callingNew)
 
     Jump notCompiled = masm.branchTestPtr(Assembler::Zero, r0, r0);
 
-    masm.loadPtr(FrameAddress(offsetof(VMFrame, regs.sp)), JSFrameReg);
+    masm.loadPtr(FrameAddress(VMFrame::offsetOfRegsSp()), JSFrameReg);
     callPatch.hasFastNcode = true;
     callPatch.fastNcodePatch =
         masm.storePtrWithPatch(ImmPtr(NULL),
@@ -3393,7 +3699,7 @@ mjit::Compiler::checkCallApplySpeculation(uint32 callImmArgc, uint32 speculatedA
      */
     if (*PC == JSOP_FUNAPPLY) {
         masm.store32(Imm32(applyTricks == LazyArgsObj),
-                     FrameAddress(offsetof(VMFrame, u.call.lazyArgsObj)));
+                     FrameAddress(VMFrame::offsetOfLazyArgsObj()));
     }
 }
 
@@ -3672,8 +3978,8 @@ mjit::Compiler::inlineCallHelper(uint32 callImmArgc, bool callingNew, FrameSize
         if (callIC.frameSize.isStatic())
             stubcc.masm.move(Imm32(callIC.frameSize.staticArgc()), JSParamReg_Argc);
         else
-            stubcc.masm.load32(FrameAddress(offsetof(VMFrame, u.call.dynamicArgc)), JSParamReg_Argc);
-        stubcc.masm.loadPtr(FrameAddress(offsetof(VMFrame, regs.sp)), JSFrameReg);
+            stubcc.masm.load32(FrameAddress(VMFrame::offsetOfDynamicArgc()), JSParamReg_Argc);
+        stubcc.masm.loadPtr(FrameAddress(VMFrame::offsetOfRegsSp()), JSFrameReg);
         callPatch.hasSlowNcode = true;
         callPatch.slowNcodePatch =
             stubcc.masm.storePtrWithPatch(ImmPtr(NULL),
@@ -4172,6 +4478,8 @@ mjit::Compiler::jsop_setprop_slow(JSAtom *atom, bool usePropCache)
         INLINE_STUBCALL(STRICT_VARIANT(stubs::SetPropNoCache), REJOIN_FALLTHROUGH);
     JS_STATIC_ASSERT(JSOP_SETNAME_LENGTH == JSOP_SETPROP_LENGTH);
     frame.shimmy(1);
+    if (script->pcCounters)
+        bumpPropCounter(PC, OpcodeCounts::PROP_OTHER);
 }
 
 void
@@ -4191,6 +4499,9 @@ mjit::Compiler::jsop_getprop_slow(JSAtom *atom, bool usePropCache)
 
     frame.pop();
     frame.pushSynced(JSVAL_TYPE_UNKNOWN);
+
+    if (script->pcCounters)
+        bumpPropCounter(PC, OpcodeCounts::PROP_OTHER);
 }
 
 bool
@@ -4203,6 +4514,8 @@ mjit::Compiler::jsop_callprop_slow(JSAtom *atom)
     frame.pop();
     pushSyncedEntry(0);
     pushSyncedEntry(1);
+    if (script->pcCounters)
+        bumpPropCounter(PC, OpcodeCounts::PROP_OTHER);
     return true;
 }
 
@@ -4277,6 +4590,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
                 frame.learnType(fe, JSVAL_TYPE_INT32, false);
                 frame.pop();
                 frame.pushCopyOf(fe);
+                if (script->pcCounters)
+                    bumpPropCounter(PC, OpcodeCounts::PROP_STATIC);
                 return true;
             }
         }
@@ -4301,6 +4616,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
             RegisterID reg = frame.tempRegForData(top);
             frame.pop();
             frame.pushWord(Address(reg, offsetof(JSObject, privateData)), JSVAL_TYPE_INT32);
+            if (script->pcCounters)
+                bumpPropCounter(PC, OpcodeCounts::PROP_DEFINITE);
             if (!isObject)
                 stubcc.rejoin(Changes(1));
             return true;
@@ -4324,6 +4641,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
             frame.pop();
             masm.loadPayload(Address(reg, TypedArray::lengthOffset()), reg);
             frame.pushTypedPayload(JSVAL_TYPE_INT32, reg);
+            if (script->pcCounters)
+                bumpPropCounter(PC, OpcodeCounts::PROP_DEFINITE);
             if (!isObject)
                 stubcc.rejoin(Changes(1));
             return true;
@@ -4337,6 +4656,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
         if (types->isLazyArguments(cx)) {
             frame.pop();
             frame.pushWord(Address(JSFrameReg, StackFrame::offsetOfArgs()), JSVAL_TYPE_INT32);
+            if (script->pcCounters)
+                bumpPropCounter(PC, OpcodeCounts::PROP_DEFINITE);
             return true;
         }
     }
@@ -4350,6 +4671,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
                 frame.learnType(fe, knownType, false);
             frame.pop();
             frame.pushCopyOf(fe);
+            if (script->pcCounters)
+                bumpPropCounter(PC, OpcodeCounts::PROP_STATIC);
             return true;
         }
     }
@@ -4387,6 +4710,9 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
             RegisterID reg = frame.tempRegForData(top);
             frame.pop();
 
+            if (script->pcCounters)
+                bumpPropCounter(PC, OpcodeCounts::PROP_DEFINITE);
+
             Address address(reg, JSObject::getFixedSlotOffset(slot));
             BarrierState barrier = pushAddressMaybeBarrier(address, knownType, false);
             if (!isObject)
@@ -4397,6 +4723,9 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
         }
     }
 
+    if (script->pcCounters)
+        bumpPropCounter(PC, OpcodeCounts::PROP_OTHER);
+
     /*
      * These two must be loaded first. The objReg because the string path
      * wants to read it, and the shapeReg because it could cause a spill that
@@ -4523,6 +4852,9 @@ mjit::Compiler::jsop_callprop_generic(JSAtom *atom)
 {
     FrameEntry *top = frame.peek(-1);
 
+    if (script->pcCounters)
+        bumpPropCounter(PC, OpcodeCounts::PROP_OTHER);
+
     /*
      * These two must be loaded first. The objReg because the string path
      * wants to read it, and the shapeReg because it could cause a spill that
@@ -4696,6 +5028,9 @@ mjit::Compiler::jsop_callprop_obj(JSAtom *atom)
 {
     FrameEntry *top = frame.peek(-1);
 
+    if (script->pcCounters)
+        bumpPropCounter(PC, OpcodeCounts::PROP_OTHER);
+
     PICGenInfo pic(ic::PICInfo::CALL, JSOp(*PC), true);
 
     JS_ASSERT(top->isTypeKnown());
@@ -5046,6 +5381,9 @@ mjit::Compiler::jsop_callprop_dispatch(JSAtom *atom)
     frame.shift(-2);
     // FUN THIS
 
+    if (script->pcCounters)
+        bumpPropCounter(PC, OpcodeCounts::PROP_DEFINITE);
+
     stubcc.rejoin(Changes(2));
     return true;
 }
@@ -5080,6 +5418,9 @@ mjit::Compiler::jsop_callprop(JSAtom *atom)
         frame.shift(-2);
         // FUN THIS
 
+        if (script->pcCounters && cx->typeInferenceEnabled())
+            bumpPropCounter(PC, OpcodeCounts::PROP_STATIC);
+
         if (testObject)
             stubcc.rejoin(Changes(2));
 
@@ -5124,7 +5465,21 @@ mjit::Compiler::jsop_setprop(JSAtom *atom, bool usePropCache, bool popGuaranteed
         ScriptAnalysis::NameAccess access =
             analysis->resolveNameAccess(cx, ATOM_TO_JSID(atom), true);
         if (access.nesting) {
-            Address address = frame.loadNameAddress(access);
+            /* Use a SavedReg so it isn't clobbered by the stub call. */
+            RegisterID nameReg = frame.allocReg(Registers::SavedRegs).reg();
+            Address address = frame.loadNameAddress(access, nameReg);
+
+#ifdef JSGC_INCREMENTAL_MJ
+            /* Write barrier. */
+            if (cx->compartment->needsBarrier()) {
+                stubcc.linkExit(masm.jump(), Uses(0));
+                stubcc.leave();
+                stubcc.masm.addPtr(Imm32(address.offset), address.base, Registers::ArgReg1);
+                OOL_STUBCALL(stubs::WriteBarrier, REJOIN_NONE);
+                stubcc.rejoin(Changes(0));
+            }
+#endif
+
             frame.storeTo(rhs, address, popGuaranteed);
             frame.shimmy(1);
             frame.freeReg(address.base);
@@ -5152,7 +5507,24 @@ mjit::Compiler::jsop_setprop(JSAtom *atom, bool usePropCache, bool popGuaranteed
             !propertyTypes->isOwnProperty(cx, object, true)) {
             types->addFreeze(cx);
             uint32 slot = propertyTypes->definiteSlot();
+            RegisterID reg = frame.tempRegForData(lhs);
             bool isObject = lhs->isTypeKnown();
+#ifdef JSGC_INCREMENTAL_MJ
+            if (cx->compartment->needsBarrier() && propertyTypes->needsBarrier(cx)) {
+                /* Write barrier. */
+                Jump j;
+                if (isObject)
+                    j = masm.testGCThing(Address(reg, JSObject::getFixedSlotOffset(slot)));
+                else
+                    j = masm.jump();
+                stubcc.linkExit(j, Uses(0));
+                stubcc.leave();
+                stubcc.masm.addPtr(Imm32(JSObject::getFixedSlotOffset(slot)),
+                                   reg, Registers::ArgReg1);
+                OOL_STUBCALL(stubs::GCThingWriteBarrier, REJOIN_NONE);
+                stubcc.rejoin(Changes(0));
+            }
+#endif
             if (!isObject) {
                 Jump notObject = frame.testObject(Assembler::NotEqual, lhs);
                 stubcc.linkExit(notObject, Uses(2));
@@ -5160,15 +5532,27 @@ mjit::Compiler::jsop_setprop(JSAtom *atom, bool usePropCache, bool popGuaranteed
                 stubcc.masm.move(ImmPtr(atom), Registers::ArgReg1);
                 OOL_STUBCALL(STRICT_VARIANT(stubs::SetName), REJOIN_FALLTHROUGH);
             }
-            RegisterID reg = frame.tempRegForData(lhs);
             frame.storeTo(rhs, Address(reg, JSObject::getFixedSlotOffset(slot)), popGuaranteed);
             frame.shimmy(1);
             if (!isObject)
                 stubcc.rejoin(Changes(1));
+            if (script->pcCounters)
+                bumpPropCounter(PC, OpcodeCounts::PROP_DEFINITE);
             return true;
         }
     }
 
+    if (script->pcCounters)
+        bumpPropCounter(PC, OpcodeCounts::PROP_OTHER);
+
+#ifdef JSGC_INCREMENTAL_MJ
+    /* Write barrier. */
+    if (cx->compartment->needsBarrier() && (!types || types->propertyNeedsBarrier(cx, id))) {
+        jsop_setprop_slow(atom, usePropCache);
+        return true;
+    }
+#endif
+
     JSOp op = JSOp(*PC);
 
     ic::PICInfo::Kind kind = (op == JSOP_SETMETHOD)
@@ -5710,6 +6094,18 @@ mjit::Compiler::iter(uintN flags)
     Jump overlongChain = masm.branchPtr(Assembler::NonZero, T1, T1);
     stubcc.linkExit(overlongChain, Uses(1));
 
+#ifdef JSGC_INCREMENTAL_MJ
+    /*
+     * Write barrier for stores to the iterator. We only need to take a write
+     * barrier if NativeIterator::obj is actually going to change.
+     */
+    if (cx->compartment->needsBarrier()) {
+        Jump j = masm.branchPtr(Assembler::NotEqual,
+                                Address(nireg, offsetof(NativeIterator, obj)), reg);
+        stubcc.linkExit(j, Uses(1));
+    }
+#endif
+
     /* Found a match with the most recent iterator. Hooray! */
 
     /* Mark iterator as active. */
@@ -5955,7 +6351,7 @@ mjit::Compiler::jsop_getgname(uint32 index)
          */
         const js::Shape *shape = globalObj->nativeLookup(cx, ATOM_TO_JSID(atom));
         if (shape && shape->hasDefaultGetterOrIsMethod() && shape->hasSlot()) {
-            Value *value = &globalObj->getSlotRef(shape->slot);
+            HeapValue *value = &globalObj->getSlotRef(shape->slot);
             if (!value->isUndefined() &&
                 !propertyTypes->isOwnProperty(cx, globalObj->getType(cx), true)) {
                 watchGlobalReallocation();
@@ -6185,8 +6581,18 @@ mjit::Compiler::jsop_setgname(JSAtom *atom, bool usePropertyCache, bool popGuara
             shape->writable() && shape->hasSlot() &&
             !types->isOwnProperty(cx, globalObj->getType(cx), true)) {
             watchGlobalReallocation();
-            Value *value = &globalObj->getSlotRef(shape->slot);
+            HeapValue *value = &globalObj->getSlotRef(shape->slot);
             RegisterID reg = frame.allocReg();
+#ifdef JSGC_INCREMENTAL_MJ
+            /* Write barrier. */
+            if (cx->compartment->needsBarrier() && types->needsBarrier(cx)) {
+                stubcc.linkExit(masm.jump(), Uses(0));
+                stubcc.leave();
+                stubcc.masm.move(ImmPtr(value), Registers::ArgReg1);
+                OOL_STUBCALL(stubs::WriteBarrier, REJOIN_NONE);
+                stubcc.rejoin(Changes(0));
+            }
+#endif
             masm.move(ImmPtr(value), reg);
             frame.storeTo(frame.peek(-1), Address(reg), popGuaranteed);
             frame.shimmy(1);
@@ -6195,6 +6601,14 @@ mjit::Compiler::jsop_setgname(JSAtom *atom, bool usePropertyCache, bool popGuara
         }
     }
 
+#ifdef JSGC_INCREMENTAL_MJ
+    /* Write barrier. */
+    if (cx->compartment->needsBarrier()) {
+        jsop_setgname_slow(atom, usePropertyCache);
+        return;
+    }
+#endif
+
 #if defined JS_MONOIC
     FrameEntry *objFe = frame.peek(-2);
     FrameEntry *fe = frame.peek(-1);
@@ -6209,6 +6623,7 @@ mjit::Compiler::jsop_setgname(JSAtom *atom, bool usePropertyCache, bool popGuara
     Jump shapeGuard;
 
     RESERVE_IC_SPACE(masm);
+
     ic.fastPathStart = masm.label();
     if (objFe->isConstant()) {
         JSObject *obj = &objFe->getValue().toObject();
@@ -6567,11 +6982,12 @@ mjit::Compiler::jsop_regexp()
     }
 
     /*
-     * Force creation of the RegExpPrivate in the script's RegExpObject so we take it in the
-     * getNewObject template copy.
+     * Force creation of the RegExpPrivate in the script's RegExpObject
+     * so that we grab it in the getNewObject template copy. Note that
+     * JIT code is discarded on every GC, which permits us to burn in
+     * the pointer to the RegExpPrivate refcount.
      */
-    RegExpPrivate *rep = reobj->getOrCreatePrivate(cx);
-    if (!rep)
+    if (!reobj->makePrivateNow(cx))
         return false;
 
     RegisterID result = frame.allocReg();
@@ -6584,7 +7000,7 @@ mjit::Compiler::jsop_regexp()
     OOL_STUBCALL(stubs::RegExp, REJOIN_FALLTHROUGH);
 
     /* Bump the refcount on the wrapped RegExp. */
-    size_t *refcount = rep->addressOfRefCount();
+    size_t *refcount = reobj->addressOfPrivateRefCount();
     masm.add32(Imm32(1), AbsoluteAddress(refcount));
 
     frame.pushTypedPayload(JSVAL_TYPE_OBJECT, result);
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index 349bf12f3459..793a586fa21b 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -367,7 +367,7 @@ class Compiler : public BaseCompiler
     analyze::CrossScriptSSA ssa;
 
     GlobalObject *globalObj;
-    const Value *globalSlots;  /* Original slots pointer. */
+    const HeapValue *globalSlots;  /* Original slots pointer. */
 
     Assembler masm;
     FrameState frame;
@@ -530,6 +530,11 @@ private:
     CompileStatus pushActiveFrame(JSScript *script, uint32 argc);
     void popActiveFrame();
     void updatePCCounters(jsbytecode *pc, Label *start, bool *updated);
+    void updatePCTypes(jsbytecode *pc, FrameEntry *fe);
+    void updateArithCounters(jsbytecode *pc, FrameEntry *fe,
+                             JSValueType firstUseType, JSValueType secondUseType);
+    void updateElemCounters(jsbytecode *pc, FrameEntry *obj, FrameEntry *id);
+    void bumpPropCounter(jsbytecode *pc, int counter);
 
     /* Analysis helpers. */
     CompileStatus prepareInferenceTypes(JSScript *script, ActiveFrame *a);
diff --git a/js/src/methodjit/FastBuiltins.cpp b/js/src/methodjit/FastBuiltins.cpp
index cbd745099c0a..95fc40423f6c 100644
--- a/js/src/methodjit/FastBuiltins.cpp
+++ b/js/src/methodjit/FastBuiltins.cpp
@@ -467,7 +467,7 @@ mjit::Compiler::compileArrayPush(FrameEntry *thisValue, FrameEntry *arg)
     Int32Key key = Int32Key::FromRegister(lengthReg);
 
     /* Test for 'length == initializedLength' */
-    Jump initlenGuard = masm.guardArrayExtent(offsetof(JSObject, initializedLength),
+    Jump initlenGuard = masm.guardArrayExtent(JSObject::offsetOfInitializedLength(),
                                               objReg, key, Assembler::NotEqual);
     stubcc.linkExit(initlenGuard, Uses(3));
 
@@ -481,7 +481,7 @@ mjit::Compiler::compileArrayPush(FrameEntry *thisValue, FrameEntry *arg)
 
     masm.bumpKey(key, 1);
     masm.store32(lengthReg, Address(objReg, offsetof(JSObject, privateData)));
-    masm.store32(lengthReg, Address(objReg, offsetof(JSObject, initializedLength)));
+    masm.store32(lengthReg, Address(objReg, JSObject::offsetOfInitializedLength()));
 
     stubcc.leave();
     stubcc.masm.move(Imm32(1), Registers::ArgReg1);
@@ -504,6 +504,12 @@ mjit::Compiler::compileArrayPopShift(FrameEntry *thisValue, bool isPacked, bool
     if (thisValue->isConstant())
         return Compile_InlineAbort;
 
+#ifdef JSGC_INCREMENTAL_MJ
+    /* Write barrier. */
+    if (cx->compartment->needsBarrier())
+        return Compile_InlineAbort;
+#endif
+
     RegisterID objReg = frame.tempRegForData(thisValue);
     frame.pinReg(objReg);
 
@@ -533,7 +539,7 @@ mjit::Compiler::compileArrayPopShift(FrameEntry *thisValue, bool isPacked, bool
 
     /* Test for 'length == initializedLength' */
     Int32Key key = Int32Key::FromRegister(lengthReg);
-    Jump initlenGuard = masm.guardArrayExtent(offsetof(JSObject, initializedLength),
+    Jump initlenGuard = masm.guardArrayExtent(JSObject::offsetOfInitializedLength(),
                                               objReg, key, Assembler::NotEqual);
     stubcc.linkExit(initlenGuard, Uses(3));
 
@@ -569,7 +575,7 @@ mjit::Compiler::compileArrayPopShift(FrameEntry *thisValue, bool isPacked, bool
     }
 
     masm.store32(lengthReg, Address(objReg, offsetof(JSObject, privateData)));
-    masm.store32(lengthReg, Address(objReg, offsetof(JSObject, initializedLength)));
+    masm.store32(lengthReg, Address(objReg, JSObject::offsetOfInitializedLength()));
 
     if (!isArrayPop)
         INLINE_STUBCALL(stubs::ArrayShift, REJOIN_NONE);
@@ -668,13 +674,13 @@ mjit::Compiler::compileArrayConcat(types::TypeSet *thisTypes, types::TypeSet *ar
 
     RegisterID objReg = frame.tempRegForData(thisValue);
     masm.load32(Address(objReg, offsetof(JSObject, privateData)), reg);
-    Jump initlenOneGuard = masm.guardArrayExtent(offsetof(JSObject, initializedLength),
+    Jump initlenOneGuard = masm.guardArrayExtent(JSObject::offsetOfInitializedLength(),
                                                  objReg, key, Assembler::NotEqual);
     stubcc.linkExit(initlenOneGuard, Uses(3));
 
     objReg = frame.tempRegForData(argValue);
     masm.load32(Address(objReg, offsetof(JSObject, privateData)), reg);
-    Jump initlenTwoGuard = masm.guardArrayExtent(offsetof(JSObject, initializedLength),
+    Jump initlenTwoGuard = masm.guardArrayExtent(JSObject::offsetOfInitializedLength(),
                                                  objReg, key, Assembler::NotEqual);
     stubcc.linkExit(initlenTwoGuard, Uses(3));
 
@@ -785,7 +791,7 @@ mjit::Compiler::compileArrayWithArgs(uint32 argc)
     }
 
     masm.storePtr(ImmIntPtr(intptr_t(argc)),
-                  Address(result, offsetof(JSObject, initializedLength)));
+                  Address(result, JSObject::offsetOfInitializedLength()));
 
     stubcc.leave();
 
diff --git a/js/src/methodjit/FastOps.cpp b/js/src/methodjit/FastOps.cpp
index e61c5e1a6de9..92b83404e899 100644
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -1102,6 +1102,8 @@ mjit::Compiler::jsop_setelem_dense()
     bool hoisted = loop && id->isType(JSVAL_TYPE_INT32) &&
         loop->hoistArrayLengthCheck(DENSE_ARRAY, objv, indexv);
 
+    MaybeJump initlenExit;
+
     if (hoisted) {
         FrameEntry *slotsFe = loop->invariantArraySlots(objv);
         slotsReg = frame.tempRegForData(slotsFe);
@@ -1129,13 +1131,13 @@ mjit::Compiler::jsop_setelem_dense()
         // Make an OOL path for setting exactly the initialized length.
         Label syncTarget = stubcc.syncExitAndJump(Uses(3));
 
-        Jump initlenGuard = masm.guardArrayExtent(offsetof(JSObject, initializedLength),
+        Jump initlenGuard = masm.guardArrayExtent(JSObject::offsetOfInitializedLength(),
                                                   objReg, key, Assembler::BelowOrEqual);
         stubcc.linkExitDirect(initlenGuard, stubcc.masm.label());
 
         // Recheck for an exact initialized length. :TODO: would be nice to
         // reuse the condition bits from the previous test.
-        Jump exactlenGuard = stubcc.masm.guardArrayExtent(offsetof(JSObject, initializedLength),
+        Jump exactlenGuard = stubcc.masm.guardArrayExtent(JSObject::offsetOfInitializedLength(),
                                                           objReg, key, Assembler::NotEqual);
         exactlenGuard.linkTo(syncTarget, &stubcc.masm);
 
@@ -1149,7 +1151,7 @@ mjit::Compiler::jsop_setelem_dense()
         stubcc.masm.bumpKey(key, 1);
 
         // Update the initialized length.
-        stubcc.masm.storeKey(key, Address(objReg, offsetof(JSObject, initializedLength)));
+        stubcc.masm.storeKey(key, Address(objReg, JSObject::offsetOfInitializedLength()));
 
         // Update the array length if needed.
         Jump lengthGuard = stubcc.masm.guardArrayExtent(offsetof(JSObject, privateData),
@@ -1160,14 +1162,41 @@ mjit::Compiler::jsop_setelem_dense()
         // Restore the index.
         stubcc.masm.bumpKey(key, -1);
 
-        // Rejoin with the inline path.
-        Jump initlenExit = stubcc.masm.jump();
-        stubcc.crossJump(initlenExit, masm.label());
+        stubcc.masm.loadPtr(Address(objReg, offsetof(JSObject, slots)), objReg);
+
+        initlenExit = stubcc.masm.jump();
 
         masm.loadPtr(Address(objReg, offsetof(JSObject, slots)), objReg);
         slotsReg = objReg;
     }
 
+#ifdef JSGC_INCREMENTAL_MJ
+    /*
+     * Write barrier.
+     * We skip over the barrier if we incremented initializedLength above,
+     * because in that case the slot we're overwriting was previously
+     * undefined.
+     */
+    types::TypeSet *types = frame.extra(obj).types;
+    if (cx->compartment->needsBarrier() && (!types || types->propertyNeedsBarrier(cx, JSID_VOID))) {
+        Label barrierStart = stubcc.masm.label();
+        frame.sync(stubcc.masm, Uses(3));
+        stubcc.linkExitDirect(masm.jump(), barrierStart);
+        stubcc.masm.storePtr(slotsReg, FrameAddress(offsetof(VMFrame, scratch)));
+        if (key.isConstant())
+            stubcc.masm.lea(Address(slotsReg, key.index() * sizeof(Value)), Registers::ArgReg1);
+        else
+            stubcc.masm.lea(BaseIndex(slotsReg, key.reg(), masm.JSVAL_SCALE), Registers::ArgReg1);
+        OOL_STUBCALL(stubs::WriteBarrier, REJOIN_NONE);
+        stubcc.masm.loadPtr(FrameAddress(offsetof(VMFrame, scratch)), slotsReg);
+        stubcc.rejoin(Changes(0));
+    }
+#endif
+
+    /* Jump over the write barrier in the initlen case. */
+    if (initlenExit.isSet())
+        stubcc.crossJump(initlenExit.get(), masm.label());
+
     // Fully store the value. :TODO: don't need to do this in the non-initlen case
     // if the array is packed and monomorphic.
     if (key.isConstant())
@@ -1501,6 +1530,14 @@ mjit::Compiler::jsop_setelem(bool popGuaranteed)
         return true;
     }
 
+#ifdef JSGC_INCREMENTAL_MJ
+    // Write barrier.
+    if (cx->compartment->needsBarrier()) {
+        jsop_setelem_slow();
+        return true;
+    }
+#endif
+
     SetElementICInfo ic = SetElementICInfo(JSOp(*PC));
 
     // One by one, check if the most important stack entries have registers,
@@ -1588,7 +1625,7 @@ mjit::Compiler::jsop_setelem(bool popGuaranteed)
     stubcc.linkExitDirect(ic.claspGuard, ic.slowPathStart);
 
     // Guard in range of initialized length.
-    Jump initlenGuard = masm.guardArrayExtent(offsetof(JSObject, initializedLength),
+    Jump initlenGuard = masm.guardArrayExtent(JSObject::offsetOfInitializedLength(),
                                               ic.objReg, ic.key, Assembler::BelowOrEqual);
     stubcc.linkExitDirect(initlenGuard, ic.slowPathStart);
 
@@ -1746,7 +1783,7 @@ mjit::Compiler::jsop_getelem_dense(bool isPacked)
     // Guard on the array's initialized length.
     MaybeJump initlenGuard;
     if (!hoisted) {
-        initlenGuard = masm.guardArrayExtent(offsetof(JSObject, initializedLength),
+        initlenGuard = masm.guardArrayExtent(JSObject::offsetOfInitializedLength(),
                                              baseReg, key, Assembler::BelowOrEqual);
     }
 
@@ -2678,7 +2715,7 @@ mjit::Compiler::jsop_initelem()
 
     if (cx->typeInferenceEnabled()) {
         /* Update the initialized length. */
-        masm.store32(Imm32(idx + 1), Address(objReg, offsetof(JSObject, initializedLength)));
+        masm.store32(Imm32(idx + 1), Address(objReg, JSObject::offsetOfInitializedLength()));
     }
 
     /* Perform the store. */
diff --git a/js/src/methodjit/FrameState-inl.h b/js/src/methodjit/FrameState-inl.h
index 228376b79b7c..a6eb90a61a6a 100644
--- a/js/src/methodjit/FrameState-inl.h
+++ b/js/src/methodjit/FrameState-inl.h
@@ -542,6 +542,42 @@ FrameState::tempRegForType(FrameEntry *fe)
     return reg;
 }
 
+inline void
+FrameState::loadTypeIntoReg(const FrameEntry *fe, RegisterID reg)
+{
+    if (fe->isCopy())
+        fe = fe->copyOf();
+
+    JS_ASSERT(!fe->type.isConstant());
+
+    if (fe->type.inRegister()) {
+        if (fe->type.reg() == reg)
+            return;
+        masm.move(fe->type.reg(), reg);
+        return;
+    }
+
+    masm.loadTypeTag(addressOf(fe), reg);
+}
+
+inline void
+FrameState::loadDataIntoReg(const FrameEntry *fe, RegisterID reg)
+{
+    if (fe->isCopy())
+        fe = fe->copyOf();
+
+    JS_ASSERT(!fe->data.isConstant());
+
+    if (fe->data.inRegister()) {
+        if (fe->data.reg() == reg)
+            return;
+        masm.move(fe->data.reg(), reg);
+        return;
+    }
+
+    masm.loadPayload(addressOf(fe), reg);
+}
+
 inline JSC::MacroAssembler::RegisterID
 FrameState::tempRegForData(FrameEntry *fe)
 {
@@ -879,18 +915,24 @@ FrameState::syncAndForgetFe(FrameEntry *fe, bool markSynced)
 }
 
 inline JSC::MacroAssembler::Address
-FrameState::loadNameAddress(const analyze::ScriptAnalysis::NameAccess &access)
+FrameState::loadNameAddress(const analyze::ScriptAnalysis::NameAccess &access, RegisterID reg)
 {
     JS_ASSERT(access.script && access.nesting);
 
-    RegisterID reg = allocReg();
-    Value **pbase = access.arg ? &access.nesting->argArray : &access.nesting->varArray;
+    const Value **pbase = access.arg ? &access.nesting->argArray : &access.nesting->varArray;
     masm.move(ImmPtr(pbase), reg);
     masm.loadPtr(Address(reg), reg);
 
     return Address(reg, access.index * sizeof(Value));
 }
 
+inline JSC::MacroAssembler::Address
+FrameState::loadNameAddress(const analyze::ScriptAnalysis::NameAccess &access)
+{
+    RegisterID reg = allocReg();
+    return loadNameAddress(access, reg);
+}
+
 inline void
 FrameState::forgetLoopReg(FrameEntry *fe)
 {
@@ -1142,6 +1184,14 @@ FrameState::testObject(Assembler::Condition cond, FrameEntry *fe)
     return masm.testObject(cond, tempRegForType(fe));
 }
 
+inline JSC::MacroAssembler::Jump
+FrameState::testGCThing(FrameEntry *fe)
+{
+    if (shouldAvoidTypeRemat(fe))
+        return masm.testGCThing(addressOf(fe));
+    return masm.testGCThing(tempRegForType(fe));
+}
+
 inline JSC::MacroAssembler::Jump
 FrameState::testDouble(Assembler::Condition cond, FrameEntry *fe)
 {
diff --git a/js/src/methodjit/FrameState.h b/js/src/methodjit/FrameState.h
index e1759c579fe5..0ff85222d852 100644
--- a/js/src/methodjit/FrameState.h
+++ b/js/src/methodjit/FrameState.h
@@ -424,6 +424,9 @@ class FrameState
      */
     inline RegisterID tempRegForType(FrameEntry *fe, RegisterID fallback);
 
+    inline void loadTypeIntoReg(const FrameEntry *fe, RegisterID reg);
+    inline void loadDataIntoReg(const FrameEntry *fe, RegisterID reg);
+
     /*
      * Returns a register that is guaranteed to contain the frame entry's
      * data payload. The compiler may not modify the contents of the register.
@@ -732,7 +735,7 @@ class FrameState
         void reset() { PodZero(this); }
     };
     StackEntryExtra& extra(const FrameEntry *fe) {
-        JS_ASSERT(fe >= a->spBase && fe < a->sp);
+        JS_ASSERT(fe >= a->args && fe < a->sp);
         return extraArray[fe - entries];
     }
     StackEntryExtra& extra(uint32 slot) { return extra(entries + slot); }
@@ -779,6 +782,8 @@ class FrameState
      */
     inline Jump testObject(Assembler::Condition cond, FrameEntry *fe);
 
+    inline Jump testGCThing(FrameEntry *fe);
+
     /*
      * Helper function. Tests if a slot's type is primitive. Condition must
      * be Equal or NotEqual.
@@ -961,6 +966,8 @@ class FrameState
      * The compiler owns the result's base register.
      */
     inline Address loadNameAddress(const analyze::ScriptAnalysis::NameAccess &access);
+    inline Address loadNameAddress(const analyze::ScriptAnalysis::NameAccess &access,
+                                   RegisterID reg);
 
   private:
     inline AnyRegisterID allocAndLoadReg(FrameEntry *fe, bool fp, RematInfo::RematType type);
diff --git a/js/src/methodjit/InlineFrameAssembler.h b/js/src/methodjit/InlineFrameAssembler.h
index 073c1558b2ee..e8bce636f0f1 100644
--- a/js/src/methodjit/InlineFrameAssembler.h
+++ b/js/src/methodjit/InlineFrameAssembler.h
@@ -137,7 +137,7 @@ class InlineFrameAssembler {
              * here to get the new frame pointer.
              */
             RegisterID newfp = tempRegs.takeAnyReg().reg();
-            masm.loadPtr(FrameAddress(offsetof(VMFrame, regs.sp)), newfp);
+            masm.loadPtr(FrameAddress(VMFrame::offsetOfRegsSp()), newfp);
 
             Address flagsAddr(newfp, StackFrame::offsetOfFlags());
             masm.store32(Imm32(flags), flagsAddr);
diff --git a/js/src/methodjit/LoopState.cpp b/js/src/methodjit/LoopState.cpp
index 018b47203a1c..79b80480ec8c 100644
--- a/js/src/methodjit/LoopState.cpp
+++ b/js/src/methodjit/LoopState.cpp
@@ -1325,7 +1325,7 @@ LoopState::restoreInvariants(jsbytecode *pc, Assembler &masm,
              */
             masm.loadPayload(frame.addressOf(entry.u.check.arraySlot), T0);
             if (entry.kind == InvariantEntry::DENSE_ARRAY_BOUNDS_CHECK)
-                masm.load32(Address(T0, offsetof(JSObject, initializedLength)), T0);
+                masm.load32(Address(T0, JSObject::offsetOfInitializedLength()), T0);
             else
                 masm.loadPayload(Address(T0, TypedArray::lengthOffset()), T0);
 
diff --git a/js/src/methodjit/MethodJIT.h b/js/src/methodjit/MethodJIT.h
index 6e43f1c9232c..f8fdac4e1463 100644
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -39,6 +39,10 @@
 #if !defined jsjaeger_h__ && defined JS_METHODJIT
 #define jsjaeger_h__
 
+#ifdef JSGC_INCREMENTAL
+#define JSGC_INCREMENTAL_MJ
+#endif
+
 #include "jscntxt.h"
 #include "jscompartment.h"
 
@@ -106,9 +110,26 @@ struct VMFrame
         } call;
     } u;
 
+    static size_t offsetOfLazyArgsObj() {
+        return offsetof(VMFrame, u.call.lazyArgsObj);
+    }
+
+    static size_t offsetOfDynamicArgc() {
+        return offsetof(VMFrame, u.call.dynamicArgc);
+    }
+
     VMFrame      *previous;
     void         *scratch;
     FrameRegs    regs;
+
+    static size_t offsetOfRegsSp() {
+        return offsetof(VMFrame, regs.sp);
+    }
+
+    static size_t offsetOfRegsPc() {
+        return offsetof(VMFrame, regs.pc);
+    }
+
     JSContext    *cx;
     Value        *stackLimit;
     StackFrame   *entryfp;
@@ -728,7 +749,7 @@ struct InlineFrame
 {
     InlineFrame *parent;
     jsbytecode *parentpc;
-    JSFunction *fun;
+    HeapPtrFunction fun;
 
     // Total distance between the start of the outer JSStackFrame and the start
     // of this frame, in multiples of sizeof(Value).
diff --git a/js/src/methodjit/MonoIC.cpp b/js/src/methodjit/MonoIC.cpp
index be573b19009c..02ffe7550c1e 100644
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -768,14 +768,14 @@ class CallCompiler : public BaseCompiler
             masm.fallibleVMCall(cx->typeInferenceEnabled(),
                                 compilePtr, f.regs.pc, &inlined, ic.frameSize.staticLocalSlots());
         } else {
-            masm.load32(FrameAddress(offsetof(VMFrame, u.call.dynamicArgc)), Registers::ArgReg1);
+            masm.load32(FrameAddress(VMFrame::offsetOfDynamicArgc()), Registers::ArgReg1);
             masm.fallibleVMCall(cx->typeInferenceEnabled(),
                                 compilePtr, f.regs.pc, &inlined, -1);
         }
 
         Jump notCompiled = masm.branchTestPtr(Assembler::Zero, Registers::ReturnReg,
                                               Registers::ReturnReg);
-        masm.loadPtr(FrameAddress(offsetof(VMFrame, regs.sp)), JSFrameReg);
+        masm.loadPtr(FrameAddress(VMFrame::offsetOfRegsSp()), JSFrameReg);
 
         /* Compute the value of ncode to use at this call site. */
         ncode = (uint8 *) f.jit()->code.m_code.executableAddress() + ic.call->codeOffset;
@@ -789,7 +789,7 @@ class CallCompiler : public BaseCompiler
         if (ic.frameSize.isStatic())
             masm.move(Imm32(ic.frameSize.staticArgc()), JSParamReg_Argc);
         else
-            masm.load32(FrameAddress(offsetof(VMFrame, u.call.dynamicArgc)), JSParamReg_Argc);
+            masm.load32(FrameAddress(VMFrame::offsetOfDynamicArgc()), JSParamReg_Argc);
         masm.jump(t0);
 
         LinkerHelper linker(masm, JSC::METHOD_CODE);
@@ -1023,7 +1023,7 @@ class CallCompiler : public BaseCompiler
         MaybeRegisterID argcReg;
         if (!ic.frameSize.isStatic()) {
             argcReg = tempRegs.takeAnyReg().reg();
-            masm.load32(FrameAddress(offsetof(VMFrame, u.call.dynamicArgc)), argcReg.reg());
+            masm.load32(FrameAddress(VMFrame::offsetOfDynamicArgc()), argcReg.reg());
         }
 
         /* Mark vp[1] as magic for |new|. */
diff --git a/js/src/methodjit/NunboxAssembler.h b/js/src/methodjit/NunboxAssembler.h
index db41f966e7f0..8dc2a1fa76c1 100644
--- a/js/src/methodjit/NunboxAssembler.h
+++ b/js/src/methodjit/NunboxAssembler.h
@@ -402,6 +402,14 @@ class NunboxAssembler : public JSC::MacroAssembler
         return branch32(cond, tagOf(address), ImmTag(JSVAL_TAG_OBJECT));
     }
 
+    Jump testGCThing(RegisterID reg) {
+        return branch32(AboveOrEqual, reg, ImmTag(JSVAL_LOWER_INCL_TAG_OF_GCTHING_SET));
+    }
+
+    Jump testGCThing(Address address) {
+        return branch32(AboveOrEqual, tagOf(address), ImmTag(JSVAL_LOWER_INCL_TAG_OF_GCTHING_SET));
+    }
+
     Jump testDouble(Condition cond, RegisterID reg) {
         Condition opcond;
         if (cond == Equal)
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index bed8c8131777..167681cbe335 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -3224,6 +3224,21 @@ SetElementIC::update(VMFrame &f, const Value &objval, const Value &idval)
     return disable(f.cx, "unsupported object type");
 }
 
+bool
+SetElementIC::shouldUpdate(JSContext *cx)
+{
+    if (!hit) {
+        hit = true;
+        spew(cx, "ignored", "first hit");
+        return false;
+    }
+#ifdef JSGC_INCREMENTAL_MJ
+    JS_ASSERT(!cx->compartment->needsBarrier());
+#endif
+    JS_ASSERT(stubsGenerated < MAX_PIC_STUBS);
+    return true;
+}
+
 template<JSBool strict>
 void JS_FASTCALL
 ic::SetElement(VMFrame &f, ic::SetElementIC *ic)
diff --git a/js/src/methodjit/PolyIC.h b/js/src/methodjit/PolyIC.h
index b70ae2c9c1c2..f54170241dbd 100644
--- a/js/src/methodjit/PolyIC.h
+++ b/js/src/methodjit/PolyIC.h
@@ -370,6 +370,7 @@ struct SetElementIC : public BaseIC {
     LookupStatus update(VMFrame &f, const Value &objval, const Value &idval);
     LookupStatus disable(JSContext *cx, const char *reason);
     LookupStatus error(JSContext *cx);
+    bool shouldUpdate(JSContext *cx);
 };
 
 struct PICInfo : public BasePolyIC {
diff --git a/js/src/methodjit/PunboxAssembler.h b/js/src/methodjit/PunboxAssembler.h
index 7ebac0e6653b..9b59930a9520 100644
--- a/js/src/methodjit/PunboxAssembler.h
+++ b/js/src/methodjit/PunboxAssembler.h
@@ -338,6 +338,16 @@ class PunboxAssembler : public JSC::MacroAssembler
         return testObject(cond, Registers::ValueReg);
     }
 
+    Jump testGCThing(RegisterID reg) {
+        return branchPtr(AboveOrEqual, reg, ImmTag(JSVAL_LOWER_INCL_SHIFTED_TAG_OF_GCTHING_SET));
+    }
+
+    Jump testGCThing(Address address) {
+        loadValue(address, Registers::ValueReg);
+        return branchPtr(AboveOrEqual, Registers::ValueReg,
+                         ImmTag(JSVAL_LOWER_INCL_SHIFTED_TAG_OF_GCTHING_SET));
+    }
+
     Jump testDouble(Condition cond, RegisterID reg) {
         cond = (cond == Equal) ? BelowOrEqual : Above;
         return branchPtr(cond, reg, ImmTag(JSVAL_SHIFTED_TAG_MAX_DOUBLE));
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index 04c077371347..17ce254cbccb 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -43,6 +43,7 @@
 #include "jsobj.h"
 #include "jslibmath.h"
 #include "jsiter.h"
+#include "jsgcmark.h"
 #include "jsnum.h"
 #include "jsxml.h"
 #include "jsbool.h"
@@ -1214,6 +1215,8 @@ stubs::DebuggerStatement(VMFrame &f, jsbytecode *pc)
 void JS_FASTCALL
 stubs::Interrupt(VMFrame &f, jsbytecode *pc)
 {
+    gc::VerifyBarriers(f.cx);
+
     if (!js_HandleExecutionInterrupt(f.cx))
         THROW();
 }
@@ -2548,3 +2551,17 @@ stubs::ConvertToTypedFloat(JSContext *cx, Value *vp)
         vp->setDouble(d);
     }
 }
+
+void JS_FASTCALL
+stubs::WriteBarrier(VMFrame &f, Value *addr)
+{
+    js::gc::MarkValueUnbarriered(f.cx->compartment->barrierTracer(), *addr, "write barrier");
+}
+
+void JS_FASTCALL
+stubs::GCThingWriteBarrier(VMFrame &f, Value *addr)
+{
+    gc::Cell *cell = (gc::Cell *)addr->toGCThing();
+    if (cell && !cell->isMarked())
+        gc::MarkValueUnbarriered(f.cx->compartment->barrierTracer(), *addr, "write barrier");
+}
diff --git a/js/src/methodjit/StubCalls.h b/js/src/methodjit/StubCalls.h
index 717ae4f9ecc9..a75bb01f6243 100644
--- a/js/src/methodjit/StubCalls.h
+++ b/js/src/methodjit/StubCalls.h
@@ -231,6 +231,9 @@ NewDenseUnallocatedArray(VMFrame &f, uint32 length);
 void JS_FASTCALL ArrayConcatTwoArrays(VMFrame &f);
 void JS_FASTCALL ArrayShift(VMFrame &f);
 
+void JS_FASTCALL WriteBarrier(VMFrame &f, Value *addr);
+void JS_FASTCALL GCThingWriteBarrier(VMFrame &f, Value *addr);
+
 } /* namespace stubs */
 
 /* 
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 66c2e876e3ae..632ec29c500e 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -1609,31 +1609,33 @@ SetDebug(JSContext *cx, uintN argc, jsval *vp)
 }
 
 static JSBool
-GetTrapArgs(JSContext *cx, uintN argc, jsval *argv, JSScript **scriptp,
-            int32 *ip)
+GetScriptAndPCArgs(JSContext *cx, uintN argc, jsval *argv, JSScript **scriptp,
+                   int32 *ip)
 {
-    jsval v;
-    uintN intarg;
-    JSScript *script;
-
-    *scriptp = JS_GetFrameScript(cx, JS_GetScriptedCaller(cx, NULL));
+    JSScript *script = JS_GetFrameScript(cx, JS_GetScriptedCaller(cx, NULL));
     *ip = 0;
     if (argc != 0) {
-        v = argv[0];
-        intarg = 0;
+        jsval v = argv[0];
+        uintN intarg = 0;
         if (!JSVAL_IS_PRIMITIVE(v) &&
             JS_GET_CLASS(cx, JSVAL_TO_OBJECT(v)) == Jsvalify(&FunctionClass)) {
             script = ValueToScript(cx, v);
             if (!script)
                 return JS_FALSE;
-            *scriptp = script;
             intarg++;
         }
         if (argc > intarg) {
             if (!JS_ValueToInt32(cx, argv[intarg], ip))
                 return JS_FALSE;
+            if ((uint32)*ip >= script->length) {
+                JS_ReportError(cx, "Invalid PC");
+                return JS_FALSE;
+            }
         }
     }
+
+    *scriptp = script;
+
     return JS_TRUE;
 }
 
@@ -1678,7 +1680,7 @@ Trap(JSContext *cx, uintN argc, jsval *vp)
     if (!str)
         return JS_FALSE;
     argv[argc] = STRING_TO_JSVAL(str);
-    if (!GetTrapArgs(cx, argc, argv, &script, &i))
+    if (!GetScriptAndPCArgs(cx, argc, argv, &script, &i))
         return JS_FALSE;
     if (uint32(i) >= script->length) {
         JS_ReportErrorNumber(cx, my_GetErrorMessage, NULL, JSSMSG_TRAP_USAGE);
@@ -1694,7 +1696,7 @@ Untrap(JSContext *cx, uintN argc, jsval *vp)
     JSScript *script;
     int32 i;
 
-    if (!GetTrapArgs(cx, argc, JS_ARGV(cx, vp), &script, &i))
+    if (!GetScriptAndPCArgs(cx, argc, JS_ARGV(cx, vp), &script, &i))
         return JS_FALSE;
     JS_ClearTrap(cx, script, script->code + i, NULL, NULL);
     JS_SET_RVAL(cx, vp, JSVAL_VOID);
@@ -1750,8 +1752,8 @@ static JSBool
 LineToPC(JSContext *cx, uintN argc, jsval *vp)
 {
     JSScript *script;
-    int32 i;
-    uintN lineno;
+    int32 lineArg = 0;
+    uint32 lineno;
     jsbytecode *pc;
 
     if (argc == 0) {
@@ -1759,9 +1761,17 @@ LineToPC(JSContext *cx, uintN argc, jsval *vp)
         return JS_FALSE;
     }
     script = JS_GetFrameScript(cx, JS_GetScriptedCaller(cx, NULL));
-    if (!GetTrapArgs(cx, argc, JS_ARGV(cx, vp), &script, &i))
+    jsval v = JS_ARGV(cx, vp)[0];
+    if (!JSVAL_IS_PRIMITIVE(v) &&
+        JS_GET_CLASS(cx, JSVAL_TO_OBJECT(v)) == Jsvalify(&FunctionClass))
+    {
+        script = ValueToScript(cx, v);
+        if (!script)
+            return JS_FALSE;
+        lineArg++;
+    }
+    if (!JS_ValueToECMAUint32(cx, JS_ARGV(cx, vp)[lineArg], &lineno))
         return JS_FALSE;
-    lineno = (i == 0) ? script->lineno : (uintN)i;
     pc = JS_LineNumberToPC(cx, script, lineno);
     if (!pc)
         return JS_FALSE;
@@ -1776,7 +1786,7 @@ PCToLine(JSContext *cx, uintN argc, jsval *vp)
     int32 i;
     uintN lineno;
 
-    if (!GetTrapArgs(cx, argc, JS_ARGV(cx, vp), &script, &i))
+    if (!GetScriptAndPCArgs(cx, argc, JS_ARGV(cx, vp), &script, &i))
         return JS_FALSE;
     lineno = JS_PCToLineNumber(cx, script, script->code + i);
     if (!lineno)
@@ -1856,7 +1866,8 @@ SrcNotes(JSContext *cx, JSScript *script, Sprinter *sp)
             if (switchTableStart <= offset && offset < switchTableEnd) {
                 name = "case";
             } else {
-                JS_ASSERT(js_GetOpcode(cx, script, script->code + offset) == JSOP_NOP);
+                JSOp op = js_GetOpcode(cx, script, script->code + offset);
+                JS_ASSERT(op == JSOP_LABEL || op == JSOP_LABELX);
             }
         }
         Sprint(sp, "%3u: %4u %5u [%4u] %-8s", uintN(sn - notes), lineno, offset, delta, name);
@@ -4322,42 +4333,10 @@ enum its_tinyid {
 };
 
 static JSBool
-its_getter(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
-{
-  jsval *val = (jsval *) JS_GetPrivate(cx, obj);
-  *vp = val ? *val : JSVAL_VOID;
-  return JS_TRUE;
-}
+its_getter(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
 
 static JSBool
-its_setter(JSContext *cx, JSObject *obj, jsid id, JSBool strict, jsval *vp)
-{
-  jsval *val = (jsval *) JS_GetPrivate(cx, obj);
-  if (val) {
-      *val = *vp;
-      return JS_TRUE;
-  }
-
-  val = new jsval;
-  if (!val) {
-      JS_ReportOutOfMemory(cx);
-      return JS_FALSE;
-  }
-
-  if (!JS_AddValueRoot(cx, val)) {
-      delete val;
-      return JS_FALSE;
-  }
-
-  if (!JS_SetPrivate(cx, obj, (void*)val)) {
-      JS_RemoveValueRoot(cx, val);
-      delete val;
-      return JS_FALSE;
-  }
-
-  *val = *vp;
-  return JS_TRUE;
-}
+its_setter(JSContext *cx, JSObject *obj, jsid id, JSBool strict, jsval *vp);
 
 static JSPropertySpec its_props[] = {
     {"color",           ITS_COLOR,      JSPROP_ENUMERATE,       NULL, NULL},
@@ -4529,6 +4508,52 @@ static JSClass its_class = {
     JSCLASS_NO_OPTIONAL_MEMBERS
 };
 
+static JSBool
+its_getter(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
+{
+    if (JS_GET_CLASS(cx, obj) == &its_class) {
+        jsval *val = (jsval *) JS_GetPrivate(cx, obj);
+        *vp = val ? *val : JSVAL_VOID;
+    } else {
+        *vp = JSVAL_VOID;
+    }
+
+    return JS_TRUE;
+}
+
+static JSBool
+its_setter(JSContext *cx, JSObject *obj, jsid id, JSBool strict, jsval *vp)
+{
+    if (JS_GET_CLASS(cx, obj) != &its_class)
+        return JS_TRUE;
+
+    jsval *val = (jsval *) JS_GetPrivate(cx, obj);
+    if (val) {
+        *val = *vp;
+        return JS_TRUE;
+    }
+
+    val = new jsval;
+    if (!val) {
+        JS_ReportOutOfMemory(cx);
+        return JS_FALSE;
+    }
+
+    if (!JS_AddValueRoot(cx, val)) {
+        delete val;
+        return JS_FALSE;
+    }
+
+    if (!JS_SetPrivate(cx, obj, (void*)val)) {
+        JS_RemoveValueRoot(cx, val);
+        delete val;
+        return JS_FALSE;
+    }
+
+    *val = *vp;
+    return JS_TRUE;
+}
+
 JSErrorFormatString jsShell_ErrorFormatString[JSErr_Limit] = {
 #define MSG_DEF(name, number, count, exception, format) \
     { format, count, JSEXN_ERR } ,
@@ -5209,7 +5234,7 @@ Shell(JSContext *cx, OptionParser *op, char **envp)
 #endif  /* JSDEBUGGER */
 
     if (enableDisassemblyDumps)
-        JS_DumpCompartmentBytecode(cx);
+        JS_DumpCompartmentPCCounts(cx);
  
     return result;
 }
diff --git a/js/src/shell/jsheaptools.cpp b/js/src/shell/jsheaptools.cpp
index e7fe1a35d014..e596171a4c02 100644
--- a/js/src/shell/jsheaptools.cpp
+++ b/js/src/shell/jsheaptools.cpp
@@ -75,7 +75,16 @@ using namespace js;
  * at such objects.
  */
 
-/* A JSTracer that produces a map of the heap with edges reversed. */
+/*
+ * A JSTracer that produces a map of the heap with edges reversed. 
+ *
+ * HeapReversers must be allocated in a stack frame. (They contain an AutoArrayRooter,
+ * and those must be allocated and destroyed in a stack-like order.)
+ *
+ * HeapReversers keep all the roots they find in their traversal alive until
+ * they are destroyed. So you don't need to worry about nodes going away while
+ * you're using them.
+ */
 class HeapReverser : public JSTracer {
   public:
     struct Edge;
@@ -159,9 +168,8 @@ class HeapReverser : public JSTracer {
     Map map;
 
     /* Construct a HeapReverser for |context|'s heap. */
-    HeapReverser(JSContext *cx) : map(cx), work(cx), parent(NULL) {
-        context = cx;
-        callback = traverseEdgeWithThis;
+    HeapReverser(JSContext *cx) : map(cx), roots(cx), rooter(cx, 0, NULL), work(cx), parent(NULL) {
+        JS_TRACER_INIT(this, cx, traverseEdgeWithThis);
     }
 
     bool init() { return map.init(); }
@@ -170,6 +178,22 @@ class HeapReverser : public JSTracer {
     bool reverseHeap();
 
   private:    
+    /*
+     * Conservative scanning can, on a whim, decide that a root is no longer a
+     * root, and cause bits of our graph to disappear. The 'roots' vector holds
+     * all the roots we find alive, and 'rooter' keeps them alive until we're
+     * destroyed.
+     *
+     * Note that AutoArrayRooters must be constructed and destroyed in a
+     * stack-like order, so the same rule applies to this HeapReverser. The
+     * easiest way to satisfy this requirement is to only allocate HeapReversers
+     * as local variables in functions, or in types that themselves follow that
+     * rule. This is kind of dumb, but JSAPI doesn't provide any less restricted
+     * way to register arrays of roots.
+     */
+    Vector<jsval> roots;
+    AutoArrayRooter rooter;
+
     /*
      * Return the name of the most recent edge this JSTracer has traversed. The
      * result is allocated with malloc; if we run out of memory, raise an error
@@ -227,10 +251,27 @@ class HeapReverser : public JSTracer {
         HeapReverser *reverser = static_cast<HeapReverser *>(tracer);
         reverser->traversalStatus = reverser->traverseEdge(cell, kind);
     }
+
+    /* Return a jsval representing a node, if possible; otherwise, return JSVAL_VOID. */
+    jsval nodeToValue(void *cell, int kind) {
+        if (kind == JSTRACE_OBJECT) {
+            JSObject *object = static_cast<JSObject *>(cell);
+            return OBJECT_TO_JSVAL(object);
+        } else {
+            return JSVAL_VOID;
+        }
+    }
 };
 
 bool
 HeapReverser::traverseEdge(void *cell, JSGCTraceKind kind) {
+    /* If this is a root, make our own root for it as well. */
+    if (!parent) {
+        if (!roots.append(nodeToValue(cell, kind)))
+            return false;
+        rooter.changeArray(roots.begin(), roots.length());
+    }
+
     /* Capture this edge before the JSTracer members get overwritten. */
     char *edgeDescription = getEdgeDescription();
     if (!edgeDescription)
diff --git a/js/src/tests/e4x/extensions/assign-to-xml.js b/js/src/tests/e4x/extensions/assign-to-xml.js
new file mode 100644
index 000000000000..ab0f6ce4e341
--- /dev/null
+++ b/js/src/tests/e4x/extensions/assign-to-xml.js
@@ -0,0 +1,23 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+try
+{
+  eval("d, {" +
+       "  x: [{" +
+       "    x: x::x" +
+       "  }]" +
+       "} = q");
+  throw new Error("didn't throw?");
+}
+catch (e)
+{
+  assertEq(e instanceof SyntaxError, true, "expected syntax error, got: " + e);
+}
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
diff --git a/js/src/tests/e4x/extensions/qualified-name-expr.js b/js/src/tests/e4x/extensions/qualified-name-expr.js
new file mode 100644
index 000000000000..9a347bed9ca3
--- /dev/null
+++ b/js/src/tests/e4x/extensions/qualified-name-expr.js
@@ -0,0 +1,15 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+var v;
+(function::v);
+
+function f() { }
+(function::f);
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
diff --git a/js/src/tests/js1_8_5/extensions/reflect-parse.js b/js/src/tests/js1_8_5/extensions/reflect-parse.js
index 859a6955fdf9..701382fc530f 100644
--- a/js/src/tests/js1_8_5/extensions/reflect-parse.js
+++ b/js/src/tests/js1_8_5/extensions/reflect-parse.js
@@ -822,7 +822,7 @@ try {
 // E4X
 
 assertExpr("x..tagName", binExpr("..", ident("x"), lit("tagName")));
-assertExpr("x.*", dotExpr(ident("x"), xmlAnyName));
+assertExpr("x.*", memExpr(ident("x"), xmlAnyName));
 assertExpr("x[*]", memExpr(ident("x"), xmlAnyName));
 assertExpr("x::y", xmlQualId(ident("x"), ident("y"), false));
 assertExpr("x::[foo]", xmlQualId(ident("x"), ident("foo"), true));
@@ -830,15 +830,15 @@ assertExpr("x::[foo()]", xmlQualId(ident("x"), callExpr(ident("foo"), []), true)
 assertExpr("*::*", xmlQualId(xmlAnyName, ident("*"), false));
 assertExpr("*::[foo]", xmlQualId(xmlAnyName, ident("foo"), true));
 assertExpr("*::[foo()]", xmlQualId(xmlAnyName, callExpr(ident("foo"), []), true));
-assertExpr("x.y::z", dotExpr(ident("x"), xmlQualId(ident("y"), ident("z"), false)));
+assertExpr("x.y::z", memExpr(ident("x"), xmlQualId(ident("y"), ident("z"), false)));
 assertExpr("x[y::z]", memExpr(ident("x"), xmlQualId(ident("y"), ident("z"), false)));
 assertExpr("x[y::[z]]", memExpr(ident("x"), xmlQualId(ident("y"), ident("z"), true)));
 assertExpr("function::x", xmlFuncQualId(ident("x"), false));
 assertExpr("function::[foo]", xmlFuncQualId(ident("foo"), true));
 assertExpr("@foo", xmlAttrSel(ident("foo"), false));
 assertExpr("@[foo]", xmlAttrSel(ident("foo"), true));
-assertExpr("x.@foo", dotExpr(ident("x"), xmlAttrSel(ident("foo"), false)));
-assertExpr("x.@[foo]", dotExpr(ident("x"), xmlAttrSel(ident("foo"), true)));
+assertExpr("x.@foo", memExpr(ident("x"), xmlAttrSel(ident("foo"), false)));
+assertExpr("x.@[foo]", memExpr(ident("x"), xmlAttrSel(ident("foo"), true)));
 assertExpr("x[@foo]", memExpr(ident("x"), xmlAttrSel(ident("foo"), false)));
 assertExpr("x[@[foo]]", memExpr(ident("x"), xmlAttrSel(ident("foo"), true)));
 assertExpr("x.(p)", xmlFilter(ident("x"), ident("p")));
@@ -863,7 +863,7 @@ assertExpr("function::x = foo", aExpr("=", xmlFuncQualId(ident("x"), false), ide
 assertExpr("@x = foo", aExpr("=", xmlAttrSel(ident("x")), ident("foo")));
 assertExpr("x::* = foo", aExpr("=", xmlQualId(ident("x"), ident("*"), false), ident("foo")));
 assertExpr("*::* = foo", aExpr("=", xmlQualId(xmlAnyName, ident("*"), false), ident("foo")));
-assertExpr("x.* = foo", aExpr("=", dotExpr(ident("x"), xmlAnyName), ident("foo")));
+assertExpr("x.* = foo", aExpr("=", memExpr(ident("x"), xmlAnyName), ident("foo")));
 assertExpr("x[*] = foo", aExpr("=", memExpr(ident("x"), xmlAnyName), ident("foo")));
 
 assertExpr("x::y += foo", aExpr("+=", xmlQualId(ident("x"), ident("y"), false), ident("foo")));
@@ -871,7 +871,7 @@ assertExpr("function::x += foo", aExpr("+=", xmlFuncQualId(ident("x"), false), i
 assertExpr("@x += foo", aExpr("+=", xmlAttrSel(ident("x")), ident("foo")));
 assertExpr("x::* += foo", aExpr("+=", xmlQualId(ident("x"), ident("*"), false), ident("foo")));
 assertExpr("*::* += foo", aExpr("+=", xmlQualId(xmlAnyName, ident("*"), false), ident("foo")));
-assertExpr("x.* += foo", aExpr("+=", dotExpr(ident("x"), xmlAnyName), ident("foo")));
+assertExpr("x.* += foo", aExpr("+=", memExpr(ident("x"), xmlAnyName), ident("foo")));
 assertExpr("x[*] += foo", aExpr("+=", memExpr(ident("x"), xmlAnyName), ident("foo")));
 
 assertExpr("x::y++", updExpr("++", xmlQualId(ident("x"), ident("y"), false), false));
@@ -879,7 +879,7 @@ assertExpr("function::x++", updExpr("++", xmlFuncQualId(ident("x"), false), fals
 assertExpr("@x++", updExpr("++", xmlAttrSel(ident("x")), false));
 assertExpr("x::*++", updExpr("++", xmlQualId(ident("x"), ident("*"), false), false));
 assertExpr("*::*++", updExpr("++", xmlQualId(xmlAnyName, ident("*"), false), false));
-assertExpr("x.*++", updExpr("++", dotExpr(ident("x"), xmlAnyName), false));
+assertExpr("x.*++", updExpr("++", memExpr(ident("x"), xmlAnyName), false));
 assertExpr("x[*]++", updExpr("++", memExpr(ident("x"), xmlAnyName), false));
 
 assertExpr("++x::y", updExpr("++", xmlQualId(ident("x"), ident("y"), false), true));
@@ -887,7 +887,7 @@ assertExpr("++function::x", updExpr("++", xmlFuncQualId(ident("x"), false), true
 assertExpr("++@x", updExpr("++", xmlAttrSel(ident("x")), true));
 assertExpr("++x::*", updExpr("++", xmlQualId(ident("x"), ident("*"), false), true));
 assertExpr("++*::*", updExpr("++", xmlQualId(xmlAnyName, ident("*"), false), true));
-assertExpr("++x.*", updExpr("++", dotExpr(ident("x"), xmlAnyName), true));
+assertExpr("++x.*", updExpr("++", memExpr(ident("x"), xmlAnyName), true));
 assertExpr("++x[*]", updExpr("++", memExpr(ident("x"), xmlAnyName), true));
 
 
@@ -900,7 +900,7 @@ assertExpr("({a:function::x}) = foo", aExpr("=", singletonObjPatt("a", xmlFuncQu
 assertExpr("({a:@x}) = foo", aExpr("=", singletonObjPatt("a", xmlAttrSel(ident("x"))), ident("foo")));
 assertExpr("({a:x::*}) = foo", aExpr("=", singletonObjPatt("a", xmlQualId(ident("x"), ident("*"), false)), ident("foo")));
 assertExpr("({a:*::*}) = foo", aExpr("=", singletonObjPatt("a", xmlQualId(xmlAnyName, ident("*"), false)), ident("foo")));
-assertExpr("({a:x.*}) = foo", aExpr("=", singletonObjPatt("a", dotExpr(ident("x"), xmlAnyName)), ident("foo")));
+assertExpr("({a:x.*}) = foo", aExpr("=", singletonObjPatt("a", memExpr(ident("x"), xmlAnyName)), ident("foo")));
 assertExpr("({a:x[*]}) = foo", aExpr("=", singletonObjPatt("a", memExpr(ident("x"), xmlAnyName)), ident("foo")));
 
 function emptyForInPatt(val, rhs) forInStmt(val, rhs, emptyStmt)
@@ -910,7 +910,7 @@ assertStmt("for (function::x in foo);", emptyForInPatt(xmlFuncQualId(ident("x"),
 assertStmt("for (@x in foo);", emptyForInPatt(xmlAttrSel(ident("x")), ident("foo")));
 assertStmt("for (x::* in foo);", emptyForInPatt(xmlQualId(ident("x"), ident("*"), false), ident("foo")));
 assertStmt("for (*::* in foo);", emptyForInPatt(xmlQualId(xmlAnyName, ident("*"), false), ident("foo")));
-assertStmt("for (x.* in foo);", emptyForInPatt(dotExpr(ident("x"), xmlAnyName), ident("foo")));
+assertStmt("for (x.* in foo);", emptyForInPatt(memExpr(ident("x"), xmlAnyName), ident("foo")));
 assertStmt("for (x[*] in foo);", emptyForInPatt(memExpr(ident("x"), xmlAnyName), ident("foo")));
 
 
@@ -1027,7 +1027,7 @@ assertGlobalExpr("[ x ] = y", aExpr("=", 3, ident("y")), { arrayPattern: functio
 assertGlobalExpr("({a:x::y}) = foo", aExpr("=", singletonObjPatt("a", 1), ident("foo")), { xmlQualifiedIdentifier: function() 1 });
 assertGlobalExpr("({a:function::x}) = foo", aExpr("=", singletonObjPatt("a", 2), ident("foo")), { xmlFunctionQualifiedIdentifier: function() 2 });
 assertGlobalExpr("({a:@x}) = foo", aExpr("=", singletonObjPatt("a", 3), ident("foo")), { xmlAttributeSelector: function() 3 });
-assertGlobalExpr("({a:x.*}) = foo", aExpr("=", singletonObjPatt("a", dotExpr(ident("x"), 4)), ident("foo")), { xmlAnyName: function() 4 });
+assertGlobalExpr("({a:x.*}) = foo", aExpr("=", singletonObjPatt("a", memExpr(ident("x"), 4)), ident("foo")), { xmlAnyName: function() 4 });
 
 assertGlobalExpr("(<x> </x>)()", callExpr(xmlElt([5, xmlText(" "), xmlEndTag([xmlName("x")])]), []), { xmlStartTag: function() 5 });
 assertGlobalExpr("(<x> </x>)()", callExpr(xmlElt([xmlStartTag([6]), xmlText(" "), xmlEndTag([6])]), []), { xmlName: function() 6 });
diff --git a/js/src/tracejit/Writer.cpp b/js/src/tracejit/Writer.cpp
index 8f6476e8429f..5d4276962e37 100644
--- a/js/src/tracejit/Writer.cpp
+++ b/js/src/tracejit/Writer.cpp
@@ -403,11 +403,13 @@ void ValidateWriter::checkAccSet(LOpcode op, LIns *base, int32_t disp, AccSet ac
       //
       // base = <JSObject>
       // ins  = ldp.obj<field> base[offsetof(JSObject, <field>)]
-      #define OK_OBJ_FIELD(ldop, field) \
+      #define OK_OBJ_FIELD_OFF(ldop, fieldoff) \
             ((op == (ldop)) && \
-            (disp == offsetof(JSObject, field)) && \
+            (disp == fieldoff) && \
             couldBeObjectOrString(base))
 
+      #define OK_OBJ_FIELD(ldop, field) OK_OBJ_FIELD_OFF(ldop, offsetof(JSObject, field))
+
       case ACCSET_OBJ_CLASP:
         ok = OK_OBJ_FIELD(LIR_ldp, clasp);
         break;
@@ -441,7 +443,8 @@ void ValidateWriter::checkAccSet(LOpcode op, LIns *base, int32_t disp, AccSet ac
         break;
 
       case ACCSET_OBJ_CAPACITY:
-        ok = OK_OBJ_FIELD(LIR_ldi, capacity) || OK_OBJ_FIELD(LIR_ldi, initializedLength);
+        ok = OK_OBJ_FIELD(LIR_ldi, capacity) ||
+             OK_OBJ_FIELD_OFF(LIR_ldi, (int32_t)JSObject::offsetOfInitializedLength());
         break;
 
       case ACCSET_OBJ_SLOTS:
diff --git a/js/src/tracejit/Writer.h b/js/src/tracejit/Writer.h
index ab96acca2bf4..f2dfe1d150c3 100644
--- a/js/src/tracejit/Writer.h
+++ b/js/src/tracejit/Writer.h
@@ -525,7 +525,7 @@ class Writer
     }
 
     nj::LIns *ldiDenseArrayInitializedLength(nj::LIns *array) const {
-        return name(lir->insLoad(nj::LIR_ldi, array, offsetof(JSObject, initializedLength),
+        return name(lir->insLoad(nj::LIR_ldi, array, JSObject::offsetOfInitializedLength(),
                                  ACCSET_OBJ_CAPACITY),
                     "capacity");
     }
diff --git a/js/src/vm/ArgumentsObject-inl.h b/js/src/vm/ArgumentsObject-inl.h
index 9103151c6fa7..e502afd1828b 100644
--- a/js/src/vm/ArgumentsObject-inl.h
+++ b/js/src/vm/ArgumentsObject-inl.h
@@ -46,10 +46,10 @@
 namespace js {
 
 inline void
-ArgumentsObject::setInitialLength(uint32 length)
+ArgumentsObject::initInitialLength(uint32 length)
 {
     JS_ASSERT(getSlot(INITIAL_LENGTH_SLOT).isUndefined());
-    setSlot(INITIAL_LENGTH_SLOT, Int32Value(length << PACKED_BITS_COUNT));
+    initSlot(INITIAL_LENGTH_SLOT, Int32Value(length << PACKED_BITS_COUNT));
     JS_ASSERT((getSlot(INITIAL_LENGTH_SLOT).toInt32() >> PACKED_BITS_COUNT) == int32(length));
     JS_ASSERT(!hasOverriddenLength());
 }
@@ -77,11 +77,10 @@ ArgumentsObject::hasOverriddenLength() const
 }
 
 inline void
-ArgumentsObject::setCalleeAndData(JSObject &callee, ArgumentsData *data)
+ArgumentsObject::initData(ArgumentsData *data)
 {
     JS_ASSERT(getSlot(DATA_SLOT).isUndefined());
-    setSlot(DATA_SLOT, PrivateValue(data));
-    data->callee.setObject(callee);
+    initSlot(DATA_SLOT, PrivateValue(data));
 }
 
 inline ArgumentsData *
@@ -100,7 +99,7 @@ ArgumentsObject::element(uint32 i) const
 inline const js::Value *
 ArgumentsObject::elements() const
 {
-    return data()->slots;
+    return Valueify(data()->slots);
 }
 
 inline void
@@ -150,7 +149,7 @@ NormalArgumentsObject::callee() const
 inline void
 NormalArgumentsObject::clearCallee()
 {
-    data()->callee = MagicValue(JS_ARGS_HOLE);
+    data()->callee.set(compartment(), MagicValue(JS_ARGS_HOLE));
 }
 
 } // namespace js
diff --git a/js/src/vm/ArgumentsObject.h b/js/src/vm/ArgumentsObject.h
index 7b64716f1cb0..aeefbe3b6445 100644
--- a/js/src/vm/ArgumentsObject.h
+++ b/js/src/vm/ArgumentsObject.h
@@ -92,13 +92,13 @@ struct ArgumentsData
      * arguments.callee, or MagicValue(JS_ARGS_HOLE) if arguments.callee has
      * been modified.
      */
-    js::Value   callee;
+    HeapValue   callee;
 
     /*
      * Values of the arguments for this object, or MagicValue(JS_ARGS_HOLE) if
      * the indexed argument has been modified.
      */
-    js::Value   slots[1];
+    HeapValue   slots[1];
 };
 
 /*
@@ -183,9 +183,9 @@ class ArgumentsObject : public ::JSObject
     friend struct mjit::ic::GetElementIC;
 #endif
 
-    void setInitialLength(uint32 length);
+    void initInitialLength(uint32 length);
 
-    void setCalleeAndData(JSObject &callee, ArgumentsData *data);
+    void initData(ArgumentsData *data);
 
   public:
     /* Create an arguments object for the given callee function. */
diff --git a/js/src/vm/CallObject-inl.h b/js/src/vm/CallObject-inl.h
index b869853fb5a1..5cfd7371c21f 100644
--- a/js/src/vm/CallObject-inl.h
+++ b/js/src/vm/CallObject-inl.h
@@ -73,6 +73,13 @@ CallObject::setCallee(JSObject *callee)
     setFixedSlot(CALLEE_SLOT, js::ObjectOrNullValue(callee));
 }
 
+inline void
+CallObject::initCallee(JSObject *callee)
+{
+    JS_ASSERT_IF(callee, callee->isFunction());
+    initFixedSlot(CALLEE_SLOT, js::ObjectOrNullValue(callee));
+}
+
 inline JSObject *
 CallObject::getCallee() const
 {
@@ -99,6 +106,13 @@ CallObject::setArguments(const js::Value &v)
     setFixedSlot(ARGUMENTS_SLOT, v);
 }
 
+inline void
+CallObject::initArguments(const js::Value &v)
+{
+    JS_ASSERT(!isForEval());
+    initFixedSlot(ARGUMENTS_SLOT, v);
+}
+
 inline const js::Value &
 CallObject::arg(uintN i) const
 {
@@ -113,6 +127,13 @@ CallObject::setArg(uintN i, const js::Value &v)
     setSlot(RESERVED_SLOTS + i, v);
 }
 
+inline void
+CallObject::initArgUnchecked(uintN i, const js::Value &v)
+{
+    JS_ASSERT(i < getCalleeFunction()->nargs);
+    initSlotUnchecked(RESERVED_SLOTS + i, v);
+}
+
 inline const js::Value &
 CallObject::var(uintN i) const
 {
@@ -131,29 +152,38 @@ CallObject::setVar(uintN i, const js::Value &v)
     setSlot(RESERVED_SLOTS + fun->nargs + i, v);
 }
 
+inline void
+CallObject::initVarUnchecked(uintN i, const js::Value &v)
+{
+    JSFunction *fun = getCalleeFunction();
+    JS_ASSERT(fun->nargs == fun->script()->bindings.countArgs());
+    JS_ASSERT(i < fun->script()->bindings.countVars());
+    initSlotUnchecked(RESERVED_SLOTS + fun->nargs + i, v);
+}
+
 inline void
 CallObject::copyValues(uintN nargs, Value *argv, uintN nvars, Value *slots)
 {
     JS_ASSERT(numSlots() >= RESERVED_SLOTS + nargs + nvars);
-    copySlotRange(RESERVED_SLOTS, argv, nargs);
-    copySlotRange(RESERVED_SLOTS + nargs, slots, nvars);
+    copySlotRange(RESERVED_SLOTS, argv, nargs, true);
+    copySlotRange(RESERVED_SLOTS + nargs, slots, nvars, true);
 }
 
-inline js::Value *
+inline js::HeapValueArray
 CallObject::argArray()
 {
     js::DebugOnly<JSFunction*> fun = getCalleeFunction();
     JS_ASSERT(hasContiguousSlots(RESERVED_SLOTS, fun->nargs));
-    return getSlotAddress(RESERVED_SLOTS);
+    return HeapValueArray(getSlotAddress(RESERVED_SLOTS));
 }
 
-inline js::Value *
+inline js::HeapValueArray
 CallObject::varArray()
 {
     JSFunction *fun = getCalleeFunction();
     JS_ASSERT(hasContiguousSlots(RESERVED_SLOTS + fun->nargs,
                                  fun->script()->bindings.countVars()));
-    return getSlotAddress(RESERVED_SLOTS + fun->nargs);
+    return HeapValueArray(getSlotAddress(RESERVED_SLOTS + fun->nargs));
 }
 
 }
diff --git a/js/src/vm/CallObject.cpp b/js/src/vm/CallObject.cpp
index 63174325a08b..21b8ea5fd677 100644
--- a/js/src/vm/CallObject.cpp
+++ b/js/src/vm/CallObject.cpp
@@ -83,7 +83,7 @@ CallObject::create(JSContext *cx, JSScript *script, JSObject &scopeChain, JSObje
         return NULL;
 
 #ifdef DEBUG
-    for (Shape::Range r = obj->lastProp; !r.empty(); r.popFront()) {
+    for (Shape::Range r = obj->lastProperty(); !r.empty(); r.popFront()) {
         const Shape &s = r.front();
         if (s.slot != SHAPE_INVALID_SLOT) {
             JS_ASSERT(s.slot + 1 == obj->slotSpan());
@@ -93,7 +93,7 @@ CallObject::create(JSContext *cx, JSScript *script, JSObject &scopeChain, JSObje
 #endif
 
     CallObject &callobj = obj->asCall();
-    callobj.setCallee(callee);
+    callobj.initCallee(callee);
     return &callobj;
 }
 
diff --git a/js/src/vm/CallObject.h b/js/src/vm/CallObject.h
index a382d25edde9..ff745d8e153f 100644
--- a/js/src/vm/CallObject.h
+++ b/js/src/vm/CallObject.h
@@ -78,28 +78,32 @@ class CallObject : public ::JSObject
      * invocation, or null if it was created for a strict mode eval frame.
      */
     inline JSObject *getCallee() const;
-    inline JSFunction *getCalleeFunction() const; 
+    inline JSFunction *getCalleeFunction() const;
     inline void setCallee(JSObject *callee);
+    inline void initCallee(JSObject *callee);
 
     /* Returns the callee's arguments object. */
     inline const js::Value &getArguments() const;
     inline void setArguments(const js::Value &v);
+    inline void initArguments(const js::Value &v);
 
     /* Returns the formal argument at the given index. */
     inline const js::Value &arg(uintN i) const;
     inline void setArg(uintN i, const js::Value &v);
+    inline void initArgUnchecked(uintN i, const js::Value &v);
 
     /* Returns the variable at the given index. */
     inline const js::Value &var(uintN i) const;
     inline void setVar(uintN i, const js::Value &v);
+    inline void initVarUnchecked(uintN i, const js::Value &v);
 
     /*
      * Get the actual arrays of arguments and variables. Only call if type
      * inference is enabled, where we ensure that call object variables are in
      * contiguous slots (see NewCallObject).
      */
-    inline js::Value *argArray();
-    inline js::Value *varArray();
+    inline js::HeapValueArray argArray();
+    inline js::HeapValueArray varArray();
 
     inline void copyValues(uintN nargs, Value *argv, uintN nvars, Value *slots);
 };
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index dbaf01512a14..d2928e13edae 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -223,7 +223,7 @@ BreakpointSite::clearTrap(JSContext *cx, BreakpointSiteMap::Enum *e,
         *closurep = trapClosure;
 
     trapHandler = NULL;
-    trapClosure.setUndefined();
+    trapClosure = UndefinedValue();
     if (enabledCount == 0) {
         *pc = realOpcode;
         if (!cx->runtime->gcRunning) {
@@ -483,12 +483,12 @@ Debugger::slowPathOnLeaveFrame(JSContext *cx)
 bool
 Debugger::wrapDebuggeeValue(JSContext *cx, Value *vp)
 {
-    assertSameCompartment(cx, object);
+    assertSameCompartment(cx, object.get());
 
     if (vp->isObject()) {
         JSObject *obj = &vp->toObject();
 
-        CellWeakMap::AddPtr p = objects.lookupForAdd(obj);
+        ObjectWeakMap::AddPtr p = objects.lookupForAdd(obj);
         if (p) {
             vp->setObject(*p->value);
         } else {
@@ -517,7 +517,7 @@ Debugger::wrapDebuggeeValue(JSContext *cx, Value *vp)
 bool
 Debugger::unwrapDebuggeeValue(JSContext *cx, Value *vp)
 {
-    assertSameCompartment(cx, object, *vp);
+    assertSameCompartment(cx, object.get(), *vp);
     if (vp->isObject()) {
         JSObject *dobj = &vp->toObject();
         if (dobj->getClass() != &DebuggerObject_class) {
@@ -1005,9 +1005,9 @@ Debugger::onSingleStep(JSContext *cx, Value *vp)
 /*** Debugger JSObjects **************************************************************************/
 
 void
-Debugger::markKeysInCompartment(JSTracer *tracer, const CellWeakMap &map, bool scripts)
+Debugger::markKeysInCompartment(JSTracer *tracer)
 {
-    JSCompartment *comp = tracer->context->runtime->gcCurrentCompartment;
+    JSCompartment *comp = tracer->runtime->gcCurrentCompartment;
     JS_ASSERT(comp);
 
     /*
@@ -1015,19 +1015,22 @@ Debugger::markKeysInCompartment(JSTracer *tracer, const CellWeakMap &map, bool s
      * enumerating WeakMap keys. However in this case we need access, so we
      * make a base-class reference. Range is public in HashMap.
      */
-    typedef HashMap<gc::Cell *, JSObject *, DefaultHasher<gc::Cell *>, RuntimeAllocPolicy> Map;
-    const Map &storage = map;
-    for (Map::Range r = storage.all(); !r.empty(); r.popFront()) {
-        gc::Cell *key = r.front().key;
-        if (key->compartment() == comp && IsAboutToBeFinalized(tracer->context, key)) {
-            if (scripts) {
-                js::gc::MarkScript(tracer, static_cast<JSScript *>(key),
-                                   "cross-compartment WeakMap key");
-            } else {
-                js::gc::MarkObject(tracer, *static_cast<JSObject *>(key),
-                                   "cross-compartment WeakMap key");
-            }
-        }
+    typedef HashMap<HeapPtrObject, HeapPtrObject, DefaultHasher<HeapPtrObject>, RuntimeAllocPolicy>
+        ObjectMap;
+    const ObjectMap &objStorage = objects;
+    for (ObjectMap::Range r = objStorage.all(); !r.empty(); r.popFront()) {
+        const HeapPtrObject &key = r.front().key;
+        if (key->compartment() == comp && IsAboutToBeFinalized(tracer->context, key))
+            js::gc::MarkObject(tracer, key, "cross-compartment WeakMap key");
+    }
+
+    typedef HashMap<HeapPtrScript, HeapPtrObject, DefaultHasher<HeapPtrScript>, RuntimeAllocPolicy>
+        ScriptMap;
+    const ScriptMap &scriptStorage = scripts;
+    for (ScriptMap::Range r = scriptStorage.all(); !r.empty(); r.popFront()) {
+        const HeapPtrScript &key = r.front().key;
+        if (key->compartment() == comp && IsAboutToBeFinalized(tracer->context, key))
+            js::gc::MarkScript(tracer, key, "cross-compartment WeakMap key");
     }
 }
 
@@ -1057,7 +1060,7 @@ Debugger::markKeysInCompartment(JSTracer *tracer, const CellWeakMap &map, bool s
 void
 Debugger::markCrossCompartmentDebuggerObjectReferents(JSTracer *tracer)
 {
-    JSRuntime *rt = tracer->context->runtime;
+    JSRuntime *rt = tracer->runtime;
     JSCompartment *comp = rt->gcCurrentCompartment;
 
     /*
@@ -1066,10 +1069,8 @@ Debugger::markCrossCompartmentDebuggerObjectReferents(JSTracer *tracer)
      */
     for (JSCList *p = &rt->debuggerList; (p = JS_NEXT_LINK(p)) != &rt->debuggerList;) {
         Debugger *dbg = Debugger::fromLinks(p);
-        if (dbg->object->compartment() != comp) {
-            markKeysInCompartment(tracer, dbg->objects, false);
-            markKeysInCompartment(tracer, dbg->scripts, true);
-        }
+        if (dbg->object->compartment() != comp)
+            dbg->markKeysInCompartment(tracer);
     }
 }
 
@@ -1128,7 +1129,7 @@ Debugger::markAllIteratively(GCMarker *trc)
                  *   - it isn't already marked
                  *   - it actually has hooks that might be called
                  */
-                JSObject *dbgobj = dbg->toJSObject();
+                const HeapPtrObject &dbgobj = dbg->toJSObject();
                 if (comp && comp != dbgobj->compartment())
                     continue;
 
@@ -1138,7 +1139,7 @@ Debugger::markAllIteratively(GCMarker *trc)
                      * obj could be reachable only via its live, enabled
                      * debugger hooks, which may yet be called.
                      */
-                    MarkObject(trc, *dbgobj, "enabled Debugger");
+                    MarkObject(trc, dbgobj, "enabled Debugger");
                     markedAny = true;
                     dbgMarked = true;
                 }
@@ -1151,9 +1152,9 @@ Debugger::markAllIteratively(GCMarker *trc)
                              * The debugger and the script are both live.
                              * Therefore the breakpoint handler is live.
                              */
-                            JSObject *handler = bp->getHandler();
+                            const HeapPtrObject &handler = bp->getHandler();
                             if (IsAboutToBeFinalized(cx, handler)) {
-                                MarkObject(trc, *bp->getHandler(), "breakpoint handler");
+                                MarkObject(trc, bp->getHandler(), "breakpoint handler");
                                 markedAny = true;
                             }
                         }
@@ -1176,7 +1177,7 @@ void
 Debugger::trace(JSTracer *trc)
 {
     if (uncaughtExceptionHook)
-        MarkObject(trc, *uncaughtExceptionHook, "hooks");
+        MarkObject(trc, uncaughtExceptionHook, "hooks");
 
     /*
      * Mark Debugger.Frame objects. These are all reachable from JS, because the
@@ -1187,9 +1188,9 @@ Debugger::trace(JSTracer *trc)
      * frames.)
      */
     for (FrameMap::Range r = frames.all(); !r.empty(); r.popFront()) {
-        JSObject *frameobj = r.front().value;
+        const HeapPtrObject &frameobj = r.front().value;
         JS_ASSERT(frameobj->getPrivate());
-        MarkObject(trc, *frameobj, "live Debugger.Frame");
+        MarkObject(trc, frameobj, "live Debugger.Frame");
     }
 
     /* Trace the referent -> Debugger.Object weak map. */
@@ -1786,9 +1787,11 @@ GetScriptReferent(JSObject *obj)
 static void
 DebuggerScript_trace(JSTracer *trc, JSObject *obj)
 {
-    if (!trc->context->runtime->gcCurrentCompartment) {
+    if (!trc->runtime->gcCurrentCompartment) {
+        /* This comes from a private pointer, so no barrier needed. */
         if (JSScript *script = GetScriptReferent(obj))
-            MarkScript(trc, script, "Debugger.Script referent");
+            MarkScriptUnbarriered(trc, script, "Debugger.Script referent");
+
     }
 }
 
@@ -1808,15 +1811,15 @@ Class DebuggerScript_class = {
 JSObject *
 Debugger::newDebuggerScript(JSContext *cx, JSScript *script)
 {
-    assertSameCompartment(cx, object);
+    assertSameCompartment(cx, object.get());
 
     JSObject *proto = &object->getReservedSlot(JSSLOT_DEBUG_SCRIPT_PROTO).toObject();
     JS_ASSERT(proto);
     JSObject *scriptobj = NewNonFunction<WithProto::Given>(cx, &DebuggerScript_class, proto, NULL);
     if (!scriptobj || !scriptobj->ensureClassReservedSlots(cx))
         return NULL;
-    scriptobj->setPrivate(script);
     scriptobj->setReservedSlot(JSSLOT_DEBUGSCRIPT_OWNER, ObjectValue(*object));
+    scriptobj->setPrivate(script);
 
     return scriptobj;
 }
@@ -1824,9 +1827,9 @@ Debugger::newDebuggerScript(JSContext *cx, JSScript *script)
 JSObject *
 Debugger::wrapScript(JSContext *cx, JSScript *script)
 {
-    assertSameCompartment(cx, object);
+    assertSameCompartment(cx, object.get());
     JS_ASSERT(cx->compartment != script->compartment());
-    CellWeakMap::AddPtr p = scripts.lookupForAdd(script);
+    ScriptWeakMap::AddPtr p = scripts.lookupForAdd(script);
     if (!p) {
         JSObject *scriptobj = newDebuggerScript(cx, script);
 
@@ -2857,9 +2860,13 @@ static JSFunctionSpec DebuggerFrame_methods[] = {
 static void
 DebuggerObject_trace(JSTracer *trc, JSObject *obj)
 {
-    if (!trc->context->runtime->gcCurrentCompartment) {
+    if (!trc->runtime->gcCurrentCompartment) {
+        /*
+         * There is a barrier on private pointers, so the Unbarriered marking
+         * is okay.
+         */
         if (JSObject *referent = (JSObject *) obj->getPrivate())
-            MarkObject(trc, *referent, "Debugger.Object referent");
+            MarkObjectUnbarriered(trc, referent, "Debugger.Object referent");
     }
 }
 
diff --git a/js/src/vm/Debugger.h b/js/src/vm/Debugger.h
index f8bed2db2343..bd99ee85f621 100644
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -50,6 +50,7 @@
 #include "jsweakmap.h"
 #include "jswrapper.h"
 
+#include "gc/Barrier.h"
 #include "js/HashTable.h"
 #include "vm/GlobalObject.h"
 
@@ -81,9 +82,9 @@ class Debugger {
 
   private:
     JSCList link;                       /* See JSRuntime::debuggerList. */
-    JSObject *object;                   /* The Debugger object. Strong reference. */
+    HeapPtrObject object;               /* The Debugger object. Strong reference. */
     GlobalObjectSet debuggees;          /* Debuggee globals. Cross-compartment weak references. */
-    JSObject *uncaughtExceptionHook;    /* Strong reference. */
+    js::HeapPtrObject uncaughtExceptionHook; /* Strong reference. */
     bool enabled;
     JSCList breakpoints;                /* cyclic list of all js::Breakpoints in this debugger */
 
@@ -100,18 +101,17 @@ class Debugger {
      * that way, but since stack frames are not gc-things, the implementation
      * has to be different.
      */
-    typedef HashMap<StackFrame *, JSObject *, DefaultHasher<StackFrame *>, RuntimeAllocPolicy>
+    typedef HashMap<StackFrame *, HeapPtrObject, DefaultHasher<StackFrame *>, RuntimeAllocPolicy>
         FrameMap;
     FrameMap frames;
 
-    typedef WeakMap<gc::Cell *, JSObject *, DefaultHasher<gc::Cell *>, CrossCompartmentMarkPolicy>
-        CellWeakMap;
-
     /* The map from debuggee objects to their Debugger.Object instances. */
-    CellWeakMap objects;
+    typedef WeakMap<HeapPtrObject, HeapPtrObject> ObjectWeakMap;
+    ObjectWeakMap objects;
 
     /* An ephemeral map from JSScript* to Debugger.Script instances. */
-    CellWeakMap scripts;
+    typedef WeakMap<HeapPtrScript, HeapPtrObject> ScriptWeakMap;
+    ScriptWeakMap scripts;
 
     bool addDebuggeeGlobal(JSContext *cx, GlobalObject *obj);
     void removeDebuggeeGlobal(JSContext *cx, GlobalObject *global,
@@ -167,7 +167,7 @@ class Debugger {
     static void traceObject(JSTracer *trc, JSObject *obj);
     void trace(JSTracer *trc);
     static void finalize(JSContext *cx, JSObject *obj);
-    static void markKeysInCompartment(JSTracer *tracer, const CellWeakMap &map, bool scripts);
+    void markKeysInCompartment(JSTracer *tracer);
 
     static Class jsclass;
 
@@ -229,7 +229,7 @@ class Debugger {
     ~Debugger();
 
     bool init(JSContext *cx);
-    inline JSObject *toJSObject() const;
+    inline const js::HeapPtrObject &toJSObject() const;
     static inline Debugger *fromJSObject(JSObject *obj);
     static Debugger *fromChildJSObject(JSObject *obj);
 
@@ -363,7 +363,7 @@ class BreakpointSite {
     JSCList breakpoints;  /* cyclic list of all js::Breakpoints at this instruction */
     size_t enabledCount;  /* number of breakpoints in the list that are enabled */
     JSTrapHandler trapHandler;  /* jsdbgapi trap state */
-    Value trapClosure;
+    HeapValue trapClosure;
 
     bool recompile(JSContext *cx, bool forTrap);
 
@@ -408,7 +408,7 @@ class Breakpoint {
     Debugger * const debugger;
     BreakpointSite * const site;
   private:
-    JSObject *handler;
+    js::HeapPtrObject handler;
     JSCList debuggerLinks;
     JSCList siteLinks;
 
@@ -419,7 +419,7 @@ class Breakpoint {
     void destroy(JSContext *cx, BreakpointSiteMap::Enum *e = NULL);
     Breakpoint *nextInDebugger();
     Breakpoint *nextInSite();
-    JSObject *getHandler() const { return handler; }
+    const HeapPtrObject &getHandler() const { return handler; }
 };
 
 Debugger *
@@ -437,7 +437,7 @@ Debugger::firstBreakpoint() const
     return Breakpoint::fromDebuggerLinks(JS_NEXT_LINK(&breakpoints));
 }
 
-JSObject *
+const js::HeapPtrObject &
 Debugger::toJSObject() const
 {
     JS_ASSERT(object);
diff --git a/js/src/vm/GlobalObject-inl.h b/js/src/vm/GlobalObject-inl.h
new file mode 100644
index 000000000000..016be678bff7
--- /dev/null
+++ b/js/src/vm/GlobalObject-inl.h
@@ -0,0 +1,102 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sw=4 et tw=78:
+ *
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is SpiderMonkey global object code.
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Jeff Walden <jwalden+code@mit.edu> (original author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef GlobalObject_inl_h___
+#define GlobalObject_inl_h___
+
+namespace js {
+
+inline void
+GlobalObject::setFlags(int32 flags)
+{
+    setSlot(FLAGS, Int32Value(flags));
+}
+
+inline void
+GlobalObject::initFlags(int32 flags)
+{
+    initSlot(FLAGS, Int32Value(flags));
+}
+
+inline void
+GlobalObject::setDetailsForKey(JSProtoKey key, JSObject *ctor, JSObject *proto)
+{
+    HeapValue &ctorVal = getSlotRef(key);
+    HeapValue &protoVal = getSlotRef(JSProto_LIMIT + key);
+    HeapValue &visibleVal = getSlotRef(2 * JSProto_LIMIT + key);
+    JS_ASSERT(ctorVal.isUndefined());
+    JS_ASSERT(protoVal.isUndefined());
+    JS_ASSERT(visibleVal.isUndefined());
+    ctorVal = ObjectValue(*ctor);
+    protoVal = ObjectValue(*proto);
+    visibleVal = ctorVal;
+}
+
+inline void
+GlobalObject::setObjectClassDetails(JSFunction *ctor, JSObject *proto)
+{
+    setDetailsForKey(JSProto_Object, ctor, proto);
+}
+
+inline void
+GlobalObject::setFunctionClassDetails(JSFunction *ctor, JSObject *proto)
+{
+    setDetailsForKey(JSProto_Function, ctor, proto);
+}
+
+void
+GlobalObject::setThrowTypeError(JSFunction *fun)
+{
+    HeapValue &v = getSlotRef(THROWTYPEERROR);
+    JS_ASSERT(v.isUndefined());
+    v = ObjectValue(*fun);
+}
+
+void
+GlobalObject::setOriginalEval(JSObject *evalobj)
+{
+    HeapValue &v = getSlotRef(EVAL);
+    JS_ASSERT(v.isUndefined());
+    v = ObjectValue(*evalobj);
+}
+
+} // namespace js
+
+#endif
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index e284cf969c86..d2a7e8c3fd81 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -47,9 +47,11 @@
 
 #include "builtin/RegExp.h"
 #include "frontend/BytecodeEmitter.h"
+#include "vm/GlobalObject-inl.h"
 
 #include "jsobjinlines.h"
 #include "vm/RegExpObject-inl.h"
+#include "vm/RegExpStatics-inl.h"
 
 using namespace js;
 
@@ -134,7 +136,7 @@ GlobalObject::initFunctionAndObjectClasses(JSContext *cx)
         script->noScriptRval = true;
         script->code[0] = JSOP_STOP;
         script->code[1] = SRC_NULL;
-        functionProto->setScript(script);
+        functionProto->initScript(script);
         functionProto->getType(cx)->interpretedFunction = functionProto;
         script->hasFunction = true;
     }
@@ -258,8 +260,8 @@ GlobalObject::create(JSContext *cx, Class *clasp)
     JSObject *res = RegExpStatics::create(cx, globalObj);
     if (!res)
         return NULL;
-    globalObj->setSlot(REGEXP_STATICS, ObjectValue(*res));
-    globalObj->setFlags(0);
+    globalObj->initSlot(REGEXP_STATICS, ObjectValue(*res));
+    globalObj->initFlags(0);
 
     return globalObj;
 }
@@ -337,7 +339,7 @@ GlobalObject::clear(JSContext *cx)
 bool
 GlobalObject::isRuntimeCodeGenEnabled(JSContext *cx)
 {
-    Value &v = getSlotRef(RUNTIME_CODEGEN_ENABLED);
+    HeapValue &v = getSlotRef(RUNTIME_CODEGEN_ENABLED);
     if (v.isUndefined()) {
         JSSecurityCallbacks *callbacks = JS_GetSecurityCallbacks(cx);
 
@@ -345,8 +347,9 @@ GlobalObject::isRuntimeCodeGenEnabled(JSContext *cx)
          * If there are callbacks, make sure that the CSP callback is installed
          * and that it permits runtime code generation, then cache the result.
          */
-        v = BooleanValue((!callbacks || !callbacks->contentSecurityPolicyAllows) ||
-                         callbacks->contentSecurityPolicyAllows(cx));
+        v.set(compartment(),
+              BooleanValue((!callbacks || !callbacks->contentSecurityPolicyAllows) ||
+                           callbacks->contentSecurityPolicyAllows(cx)));
     }
     return !v.isFalse();
 }
diff --git a/js/src/vm/GlobalObject.h b/js/src/vm/GlobalObject.h
index 6363f1c7d24f..cc890b9d6c46 100644
--- a/js/src/vm/GlobalObject.h
+++ b/js/src/vm/GlobalObject.h
@@ -120,9 +120,8 @@ class GlobalObject : public ::JSObject {
 
     static const int32 FLAGS_CLEARED = 0x1;
 
-    void setFlags(int32 flags) {
-        setSlot(FLAGS, Int32Value(flags));
-    }
+    inline void setFlags(int32 flags);
+    inline void initFlags(int32 flags);
 
     friend JSObject *
     ::js_InitObjectClass(JSContext *cx, JSObject *obj);
@@ -133,37 +132,13 @@ class GlobalObject : public ::JSObject {
     JSObject *
     initFunctionAndObjectClasses(JSContext *cx);
 
-    void setDetailsForKey(JSProtoKey key, JSObject *ctor, JSObject *proto) {
-        Value &ctorVal = getSlotRef(key);
-        Value &protoVal = getSlotRef(JSProto_LIMIT + key);
-        Value &visibleVal = getSlotRef(2 * JSProto_LIMIT + key);
-        JS_ASSERT(ctorVal.isUndefined());
-        JS_ASSERT(protoVal.isUndefined());
-        JS_ASSERT(visibleVal.isUndefined());
-        ctorVal = ObjectValue(*ctor);
-        protoVal = ObjectValue(*proto);
-        visibleVal = ctorVal;
-    }
+    inline void setDetailsForKey(JSProtoKey key, JSObject *ctor, JSObject *proto);
+    inline void setObjectClassDetails(JSFunction *ctor, JSObject *proto);
+    inline void setFunctionClassDetails(JSFunction *ctor, JSObject *proto);
 
-    void setObjectClassDetails(JSFunction *ctor, JSObject *proto) {
-        setDetailsForKey(JSProto_Object, ctor, proto);
-    }
+    inline void setThrowTypeError(JSFunction *fun);
 
-    void setFunctionClassDetails(JSFunction *ctor, JSObject *proto) {
-        setDetailsForKey(JSProto_Function, ctor, proto);
-    }
-
-    void setThrowTypeError(JSFunction *fun) {
-        Value &v = getSlotRef(THROWTYPEERROR);
-        JS_ASSERT(v.isUndefined());
-        v.setObject(*fun);
-    }
-
-    void setOriginalEval(JSObject *evalobj) {
-        Value &v = getSlotRef(EVAL);
-        JS_ASSERT(v.isUndefined());
-        v.setObject(*evalobj);
-    }
+    inline void setOriginalEval(JSObject *evalobj);
 
     Value getConstructor(JSProtoKey key) const {
         JS_ASSERT(key <= JSProto_LIMIT);
@@ -298,7 +273,7 @@ class GlobalObject : public ::JSObject {
     }
 
     JSObject *getOrCreateGeneratorPrototype(JSContext *cx) {
-        Value &v = getSlotRef(GENERATOR_PROTO);
+        HeapValue &v = getSlotRef(GENERATOR_PROTO);
         if (!v.isObject() && !js_InitIteratorClasses(cx, this))
             return NULL;
         JS_ASSERT(v.toObject().isGenerator());
diff --git a/js/src/vm/MatchPairs.h b/js/src/vm/MatchPairs.h
index f45ccc2cb7bd..f73ac0afa463 100644
--- a/js/src/vm/MatchPairs.h
+++ b/js/src/vm/MatchPairs.h
@@ -93,7 +93,7 @@ class MatchPairs
 
     int *buffer() { return buffer_; }
 
-    friend class RegExpPrivate;
+    friend class detail::RegExpPrivate;
 
   public:
     /*
diff --git a/js/src/vm/RegExpObject-inl.h b/js/src/vm/RegExpObject-inl.h
index ca833dcd7b62..157a5a8522c4 100644
--- a/js/src/vm/RegExpObject-inl.h
+++ b/js/src/vm/RegExpObject-inl.h
@@ -89,6 +89,13 @@ HasRegExpMetaChars(const jschar *chars, size_t length)
     return false;
 }
 
+inline size_t *
+RegExpObject::addressOfPrivateRefCount() const
+{
+    JS_ASSERT(getPrivate());
+    return getPrivate()->addressOfRefCount();
+}
+
 inline void
 RegExpObject::setPrivate(RegExpPrivate *rep)
 {
@@ -130,7 +137,7 @@ RegExpObject::purge(JSContext *cx)
 {
     if (RegExpPrivate *rep = getPrivate()) {
         rep->decref(cx);
-        setPrivate(NULL);
+        privateData = NULL;
     }
 }
 
@@ -147,13 +154,14 @@ inline bool
 RegExpObject::init(JSContext *cx, JSLinearString *source, RegExpFlag flags)
 {
     if (nativeEmpty()) {
-        const js::Shape **shapep = &cx->compartment->initialRegExpShape;
-        if (!*shapep) {
-            *shapep = assignInitialShape(cx);
-            if (!*shapep)
+        const js::Shape *shape = cx->compartment->initialRegExpShape;
+        if (!shape) {
+            shape = assignInitialShape(cx);
+            if (!shape)
                 return false;
+            cx->compartment->initialRegExpShape = shape;
         }
-        setLastProperty(*shapep);
+        setLastProperty(shape);
         JS_ASSERT(!nativeEmpty());
     }
 
@@ -177,10 +185,128 @@ RegExpObject::init(JSContext *cx, JSLinearString *source, RegExpFlag flags)
     return true;
 }
 
+inline bool
+RegExpMatcher::reset(JSLinearString *patstr, JSString *opt)
+{
+    AlreadyIncRefed<RegExpPrivate> priv = RegExpPrivate::create(cx, patstr, opt, NULL);
+    if (!priv)
+        return false;
+    arc.reset(priv);
+    return true;
+}
+
+inline void
+RegExpObject::setLastIndex(const Value &v)
+{
+    setSlot(LAST_INDEX_SLOT, v);
+}
+
+inline void
+RegExpObject::setLastIndex(double d)
+{
+    setSlot(LAST_INDEX_SLOT, NumberValue(d));
+}
+
+inline void
+RegExpObject::zeroLastIndex()
+{
+    setSlot(LAST_INDEX_SLOT, Int32Value(0));
+}
+
+inline void
+RegExpObject::setSource(JSLinearString *source)
+{
+    setSlot(SOURCE_SLOT, StringValue(source));
+}
+
+inline void
+RegExpObject::setIgnoreCase(bool enabled)
+{
+    setSlot(IGNORE_CASE_FLAG_SLOT, BooleanValue(enabled));
+}
+
+inline void
+RegExpObject::setGlobal(bool enabled)
+{
+    setSlot(GLOBAL_FLAG_SLOT, BooleanValue(enabled));
+}
+
+inline void
+RegExpObject::setMultiline(bool enabled)
+{
+    setSlot(MULTILINE_FLAG_SLOT, BooleanValue(enabled));
+}
+
+inline void
+RegExpObject::setSticky(bool enabled)
+{
+    setSlot(STICKY_FLAG_SLOT, BooleanValue(enabled));
+}
+
 /* RegExpPrivate inlines. */
 
-inline AlreadyIncRefed<RegExpPrivate>
-RegExpPrivate::create(JSContext *cx, JSLinearString *source, RegExpFlag flags, TokenStream *ts)
+inline RegExpPrivateCache *
+detail::RegExpPrivate::getOrCreateCache(JSContext *cx)
+{
+    if (RegExpPrivateCache *cache = cx->threadData()->getOrCreateRegExpPrivateCache(cx->runtime))
+        return cache;
+
+    js_ReportOutOfMemory(cx);
+    return NULL;
+}
+
+inline bool
+detail::RegExpPrivate::cacheLookup(JSContext *cx, JSAtom *atom, RegExpFlag flags,
+                                   AlreadyIncRefed<RegExpPrivate> *result)
+{
+    RegExpPrivateCache *cache = getOrCreateCache(cx);
+    if (!cache)
+        return false;
+
+    if (RegExpPrivateCache::Ptr p = cache->lookup(atom)) {
+        NeedsIncRef<RegExpPrivate> cached(p->value);
+        if (cached->getFlags() == flags) {
+            cached->incref(cx);
+            *result = AlreadyIncRefed<RegExpPrivate>(cached.get());
+            return true;
+        }
+    }
+
+    JS_ASSERT(result->null());
+    return true;
+}
+
+inline bool
+detail::RegExpPrivate::cacheInsert(JSContext *cx, JSAtom *atom, RegExpPrivate *priv)
+{
+    JS_ASSERT(priv);
+
+    /*
+     * Note: allocation performed since lookup may cause a garbage collection,
+     * so we have to re-lookup the cache (and inside the cache) after the
+     * allocation is performed.
+     */
+    RegExpPrivateCache *cache = getOrCreateCache(cx);
+    if (!cache)
+        return false;
+
+    if (RegExpPrivateCache::AddPtr addPtr = cache->lookupForAdd(atom)) {
+        /* We clobber existing entries with the same source (but different flags). */
+        JS_ASSERT(addPtr->value->getFlags() != priv->getFlags());
+        addPtr->value = priv;
+    } else {
+        if (!cache->add(addPtr, atom, priv)) {
+            js_ReportOutOfMemory(cx);
+            return false;
+        }
+    }
+
+    return true;
+}
+
+inline AlreadyIncRefed<detail::RegExpPrivate>
+detail::RegExpPrivate::create(JSContext *cx, JSLinearString *source, RegExpFlag flags,
+                              TokenStream *ts)
 {
     typedef AlreadyIncRefed<RegExpPrivate> RetType;
 
@@ -190,6 +316,8 @@ RegExpPrivate::create(JSContext *cx, JSLinearString *source, RegExpFlag flags, T
      * low hit rate (both hit ratio and absolute number of hits).
      */
     bool cacheable = source->isAtom();
+    if (!cacheable)
+        return RetType(RegExpPrivate::createUncached(cx, source, flags, ts));
 
     /*
      * Refcount note: not all |RegExpPrivate|s are cached so we need to
@@ -198,58 +326,28 @@ RegExpPrivate::create(JSContext *cx, JSLinearString *source, RegExpFlag flags, T
      * remove itself from the cache.
      */
 
-    JSRuntime *rt = cx->runtime;
-    RegExpPrivateCache *cache = NULL; /* Quell "may be used uninitialized". */
-    RegExpPrivateCache::AddPtr addPtr;
-    if (cacheable) {
-        cache = cx->threadData()->getOrCreateRegExpPrivateCache(rt);
-        if (!cache) {
-            js_ReportOutOfMemory(cx);
-            return RetType(NULL);
-        }
+    JSAtom *sourceAtom = &source->asAtom();
 
-        addPtr = cache->lookupForAdd(&source->asAtom());
-        if (addPtr) {
-            RegExpPrivate *cached = addPtr->value;
-            if (cached->getFlags() == flags) {
-                cached->incref(cx);
-                return RetType(cached);
-            }
-            /* Note: on flag mismatch, we clobber the existing entry. */
-        }
-    }
-
-    JSLinearString *flatSource = source->ensureLinear(cx);
-    if (!flatSource)
+    AlreadyIncRefed<RegExpPrivate> cached;
+    if (!cacheLookup(cx, sourceAtom, flags, &cached))
         return RetType(NULL);
 
-    RegExpPrivate *self = cx->new_<RegExpPrivate>(flatSource, flags);
-    if (!self)
+    if (cached)
+        return cached;
+
+    RegExpPrivate *priv = RegExpPrivate::createUncached(cx, source, flags, ts);
+    if (!priv)
         return RetType(NULL);
 
-    if (!self->compile(cx, ts)) {
-        Foreground::delete_(self);
+    if (!cacheInsert(cx, sourceAtom, priv))
         return RetType(NULL);
-    }
 
-    if (cacheable) {
-        if (addPtr) {
-            JS_ASSERT(addPtr->key == &self->getSource()->asAtom());
-            addPtr->value = self;
-        } else {
-            if (!cache->add(addPtr, &source->asAtom(), self)) {
-                js_ReportOutOfMemory(cx);
-                return RetType(NULL);
-            }
-        }
-    }
-
-    return RetType(self);
+    return RetType(priv);
 }
 
 /* This function should be deleted once bad Android platforms phase out. See bug 604774. */
 inline bool
-RegExpPrivateCode::isJITRuntimeEnabled(JSContext *cx)
+detail::RegExpPrivateCode::isJITRuntimeEnabled(JSContext *cx)
 {
 #if defined(ANDROID) && defined(JS_TRACER) && defined(JS_METHODJIT)
     return cx->traceJitEnabled || cx->methodJitEnabled;
@@ -259,8 +357,8 @@ RegExpPrivateCode::isJITRuntimeEnabled(JSContext *cx)
 }
 
 inline bool
-RegExpPrivateCode::compile(JSContext *cx, JSLinearString &pattern, TokenStream *ts,
-                           uintN *parenCount, RegExpFlag flags)
+detail::RegExpPrivateCode::compile(JSContext *cx, JSLinearString &pattern, TokenStream *ts,
+                                   uintN *parenCount, RegExpFlag flags)
 {
 #if ENABLE_YARR_JIT
     /* Parse the pattern. */
@@ -309,12 +407,8 @@ RegExpPrivateCode::compile(JSContext *cx, JSLinearString &pattern, TokenStream *
 }
 
 inline bool
-RegExpPrivate::compile(JSContext *cx, TokenStream *ts)
+detail::RegExpPrivate::compile(JSContext *cx, TokenStream *ts)
 {
-    /* Flatten source early for the rest of compilation. */
-    if (!source->ensureLinear(cx))
-        return false;
-
     if (!sticky())
         return code.compile(cx, *source, ts, &parenCount, getFlags());
 
@@ -340,8 +434,8 @@ RegExpPrivate::compile(JSContext *cx, TokenStream *ts)
 }
 
 inline RegExpRunStatus
-RegExpPrivateCode::execute(JSContext *cx, const jschar *chars, size_t length, size_t start,
-                           int *output, size_t outputCount)
+detail::RegExpPrivateCode::execute(JSContext *cx, const jschar *chars, size_t length, size_t start,
+                                   int *output, size_t outputCount)
 {
     int result;
 #if ENABLE_YARR_JIT
@@ -369,14 +463,19 @@ RegExpPrivateCode::execute(JSContext *cx, const jschar *chars, size_t length, si
 }
 
 inline void
-RegExpPrivate::incref(JSContext *cx)
+detail::RegExpPrivate::incref(JSContext *cx)
 {
     ++refCount;
 }
 
 inline void
-RegExpPrivate::decref(JSContext *cx)
+detail::RegExpPrivate::decref(JSContext *cx)
 {
+#ifdef JS_THREADSAFE
+    JS_OPT_ASSERT_IF(cx->runtime->gcHelperThread.getThread(),
+                     PR_GetCurrentThread() != cx->runtime->gcHelperThread.getThread());
+#endif
+
     if (--refCount != 0)
         return;
 
@@ -387,7 +486,13 @@ RegExpPrivate::decref(JSContext *cx)
             cache->remove(ptr);
     }
 
+#ifdef DEBUG
+    this->~RegExpPrivate();
+    memset(this, 0xcd, sizeof(*this));
+    cx->free_(this);
+#else
     cx->delete_(this);
+#endif
 }
 
 } /* namespace js */
diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
index 9653e39b5bb2..5affdcf15889 100644
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -46,6 +46,7 @@
 #include "jsstrinlines.h"
 
 #include "vm/RegExpObject-inl.h"
+#include "vm/RegExpStatics-inl.h"
 
 #ifdef JS_TRACER
 #include "jstracer.h"
@@ -53,6 +54,8 @@ using namespace nanojit;
 #endif
 
 using namespace js;
+using js::detail::RegExpPrivate;
+using js::detail::RegExpPrivateCode;
 
 JS_STATIC_ASSERT(IgnoreCaseFlag == JSREG_FOLD);
 JS_STATIC_ASSERT(GlobalFlag == JSREG_GLOB);
@@ -339,7 +342,8 @@ regexp_finalize(JSContext *cx, JSObject *obj)
 static void
 regexp_trace(JSTracer *trc, JSObject *obj)
 {
-    obj->asRegExp()->purge(trc->context);
+    if (IS_GC_MARKING_TRACER(trc))
+        obj->asRegExp()->purge(trc->context);
 }
 
 Class js::RegExpClass = {
@@ -469,6 +473,22 @@ js::ParseRegExpFlags(JSContext *cx, JSString *flagStr, RegExpFlag *flagsOut)
     return true;
 }
 
+/* static */ RegExpPrivate *
+RegExpPrivate::createUncached(JSContext *cx, JSLinearString *source, RegExpFlag flags,
+                              TokenStream *tokenStream)
+{
+    RegExpPrivate *priv = cx->new_<RegExpPrivate>(source, flags);
+    if (!priv)
+        return NULL;
+
+    if (!priv->compile(cx, tokenStream)) {
+        Foreground::delete_(priv);
+        return NULL;
+    }
+
+    return priv;
+}
+
 AlreadyIncRefed<RegExpPrivate>
 RegExpPrivate::create(JSContext *cx, JSLinearString *str, JSString *opt, TokenStream *ts)
 {
diff --git a/js/src/vm/RegExpObject.h b/js/src/vm/RegExpObject.h
index 7535b2f51538..0d7949b8a9ba 100644
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -65,6 +65,9 @@ enum RegExpRunStatus
 
 class RegExpObject : public ::JSObject
 {
+    typedef detail::RegExpPrivate RegExpPrivate;
+    typedef detail::RegExpPrivateCode RegExpPrivateCode;
+
     static const uintN LAST_INDEX_SLOT          = 0;
     static const uintN SOURCE_SLOT              = 1;
     static const uintN GLOBAL_FLAG_SLOT         = 2;
@@ -113,22 +116,15 @@ class RegExpObject : public ::JSObject
     const Value &getLastIndex() const {
         return getSlot(LAST_INDEX_SLOT);
     }
-    void setLastIndex(const Value &v) {
-        setSlot(LAST_INDEX_SLOT, v);
-    }
-    void setLastIndex(double d) {
-        setSlot(LAST_INDEX_SLOT, NumberValue(d));
-    }
-    void zeroLastIndex() {
-        setSlot(LAST_INDEX_SLOT, Int32Value(0));
-    }
+    inline void setLastIndex(const Value &v);
+    inline void setLastIndex(double d);
+    inline void zeroLastIndex();
 
     JSLinearString *getSource() const {
         return &getSlot(SOURCE_SLOT).toString()->asLinear();
     }
-    void setSource(JSLinearString *source) {
-        setSlot(SOURCE_SLOT, StringValue(source));
-    }
+    inline void setSource(JSLinearString *source);
+
     RegExpFlag getFlags() const {
         uintN flags = 0;
         flags |= global() ? GlobalFlag : 0;
@@ -138,12 +134,16 @@ class RegExpObject : public ::JSObject
         return RegExpFlag(flags);
     }
 
+    /* JIT only. */
+
+    inline size_t *addressOfPrivateRefCount() const;
+
     /* Flags. */
 
-    void setIgnoreCase(bool enabled)    { setSlot(IGNORE_CASE_FLAG_SLOT, BooleanValue(enabled)); }
-    void setGlobal(bool enabled)        { setSlot(GLOBAL_FLAG_SLOT, BooleanValue(enabled)); }
-    void setMultiline(bool enabled)     { setSlot(MULTILINE_FLAG_SLOT, BooleanValue(enabled)); }
-    void setSticky(bool enabled)        { setSlot(STICKY_FLAG_SLOT, BooleanValue(enabled)); }
+    inline void setIgnoreCase(bool enabled);
+    inline void setGlobal(bool enabled);
+    inline void setMultiline(bool enabled);
+    inline void setSticky(bool enabled);
     bool ignoreCase() const { return getSlot(IGNORE_CASE_FLAG_SLOT).toBoolean(); }
     bool global() const     { return getSlot(GLOBAL_FLAG_SLOT).toBoolean(); }
     bool multiline() const  { return getSlot(MULTILINE_FLAG_SLOT).toBoolean(); }
@@ -154,6 +154,20 @@ class RegExpObject : public ::JSObject
     /* Clear out lazy |RegExpPrivate|. */
     inline void purge(JSContext *x);
 
+    /*
+     * Trigger an eager creation of the associated RegExpPrivate. Note
+     * that a GC may purge it away.
+     */
+    bool makePrivateNow(JSContext *cx) {
+        return getPrivate() ? true : !!makePrivate(cx);
+    }
+
+  private:
+    friend class RegExpObjectBuilder;
+    friend class RegExpMatcher;
+
+    inline bool init(JSContext *cx, JSLinearString *source, RegExpFlag flags);
+
     RegExpPrivate *getOrCreatePrivate(JSContext *cx) {
         if (RegExpPrivate *rep = getPrivate())
             return rep;
@@ -161,11 +175,6 @@ class RegExpObject : public ::JSObject
         return makePrivate(cx);
     }
 
-  private:
-    friend class RegExpObjectBuilder;
-
-    inline bool init(JSContext *cx, JSLinearString *source, RegExpFlag flags);
-
     /* The |RegExpPrivate| is lazily created at the time of use. */
     RegExpPrivate *getPrivate() const {
         return static_cast<RegExpPrivate *>(JSObject::getPrivate());
@@ -196,12 +205,16 @@ class RegExpObject : public ::JSObject
 /* Either builds a new RegExpObject or re-initializes an existing one. */
 class RegExpObjectBuilder
 {
+    typedef detail::RegExpPrivate RegExpPrivate;
+
     JSContext       *cx;
     RegExpObject    *reobj_;
 
     bool getOrCreate();
     bool getOrCreateClone(RegExpObject *proto);
 
+    RegExpObject *build(AlreadyIncRefed<RegExpPrivate> rep);
+
   public:
     RegExpObjectBuilder(JSContext *cx, RegExpObject *reobj = NULL)
       : cx(cx), reobj_(reobj)
@@ -209,9 +222,6 @@ class RegExpObjectBuilder
 
     RegExpObject *reobj() { return reobj_; }
 
-    /* Note: In case of failure, |rep| will be decrefed. */
-    RegExpObject *build(AlreadyIncRefed<RegExpPrivate> rep);
-
     RegExpObject *build(JSLinearString *str, RegExpFlag flags);
     RegExpObject *build(RegExpObject *other);
 
@@ -219,6 +229,8 @@ class RegExpObjectBuilder
     RegExpObject *clone(RegExpObject *other, RegExpObject *proto);
 };
 
+namespace detail {
+
 /* Abstracts away the gross |RegExpPrivate| backend details. */
 class RegExpPrivateCode
 {
@@ -326,6 +338,15 @@ class RegExpPrivate
     bool compile(JSContext *cx, TokenStream *ts);
     static inline void checkMatchPairs(JSString *input, int *buf, size_t matchItemCount);
 
+    static RegExpPrivate *
+    createUncached(JSContext *cx, JSLinearString *source, RegExpFlag flags,
+                   TokenStream *tokenStream);
+
+    static RegExpPrivateCache *getOrCreateCache(JSContext *cx);
+    static bool cacheLookup(JSContext *cx, JSAtom *atom, RegExpFlag flags,
+                            AlreadyIncRefed<RegExpPrivate> *result);
+    static bool cacheInsert(JSContext *cx, JSAtom *atom, RegExpPrivate *priv);
+
   public:
     static AlreadyIncRefed<RegExpPrivate>
     create(JSContext *cx, JSLinearString *source, RegExpFlag flags, TokenStream *ts);
@@ -359,6 +380,55 @@ class RegExpPrivate
     bool sticky() const     { return flags & StickyFlag; }
 };
 
+} /* namespace detail */
+
+/*
+ * Wraps the RegExpObject's internals in a recount-safe interface for
+ * use in RegExp execution. This is used in situations where we'd like
+ * to avoid creating a full-fledged RegExpObject. This interface is
+ * provided in lieu of exposing the RegExpPrivate directly.
+ *
+ * Note: this exposes precisely the execute interface of a RegExpObject.
+ */
+class RegExpMatcher
+{
+    typedef detail::RegExpPrivate RegExpPrivate;
+
+    JSContext                   *cx;
+    AutoRefCount<RegExpPrivate> arc;
+
+  public:
+    explicit RegExpMatcher(JSContext *cx)
+      : cx(cx), arc(cx)
+    { }
+
+    bool null() const {
+        return arc.null();
+    }
+    bool global() const {
+        return arc.get()->global();
+    }
+    bool sticky() const {
+        return arc.get()->sticky();
+    }
+
+    bool reset(RegExpObject *reobj) {
+        RegExpPrivate *priv = reobj->getOrCreatePrivate(cx);
+        if (!priv)
+            return false;
+        arc.reset(NeedsIncRef<RegExpPrivate>(priv));
+        return true;
+    }
+
+    inline bool reset(JSLinearString *patstr, JSString *opt);
+
+    RegExpRunStatus execute(JSContext *cx, const jschar *chars, size_t length, size_t *lastIndex,
+                            LifoAllocScope &allocScope, MatchPairs **output) {
+        JS_ASSERT(!arc.null());
+        return arc.get()->execute(cx, chars, length, lastIndex, allocScope, output);
+    }
+};
+
 /*
  * Parse regexp flags. Report an error and return false if an invalid
  * sequence of flags is encountered (repeat/invalid flag).
@@ -374,6 +444,12 @@ ValueIsRegExp(const Value &v);
 inline bool
 IsRegExpMetaChar(jschar c);
 
+inline bool
+CheckRegExpSyntax(JSContext *cx, JSLinearString *str)
+{
+    return detail::RegExpPrivateCode::checkSyntax(cx, NULL, str);
+}
+
 } /* namespace js */
 
 extern JS_FRIEND_API(JSObject *) JS_FASTCALL
diff --git a/js/src/vm/RegExpStatics-inl.h b/js/src/vm/RegExpStatics-inl.h
index c0c25f177e6f..feee5619cf29 100644
--- a/js/src/vm/RegExpStatics-inl.h
+++ b/js/src/vm/RegExpStatics-inl.h
@@ -43,8 +43,18 @@
 
 #include "RegExpStatics.h"
 
+#include "vm/String-inl.h"
+
 namespace js {
 
+inline
+RegExpStatics::RegExpStatics()
+  : bufferLink(NULL),
+    copied(false)
+{
+    clear();
+}
+
 inline bool
 RegExpStatics::createDependent(JSContext *cx, size_t start, size_t end, Value *out) const 
 {
@@ -60,7 +70,7 @@ RegExpStatics::createDependent(JSContext *cx, size_t start, size_t end, Value *o
 inline bool
 RegExpStatics::createPendingInput(JSContext *cx, Value *out) const
 {
-    out->setString(pendingInput ? pendingInput : cx->runtime->emptyString);
+    out->setString(pendingInput ? pendingInput.get() : cx->runtime->emptyString);
     return true;
 }
 
@@ -181,6 +191,78 @@ RegExpStatics::getRightContext(JSSubString *out) const
     out->length = matchPairsInput->length() - get(0, 1);
 }
 
+inline void
+RegExpStatics::copyTo(RegExpStatics &dst)
+{
+    dst.matchPairs.clear();
+    /* 'save' has already reserved space in matchPairs */
+    dst.matchPairs.infallibleAppend(matchPairs);
+    dst.matchPairsInput = matchPairsInput;
+    dst.pendingInput = pendingInput;
+    dst.flags = flags;
+}
+
+inline void
+RegExpStatics::aboutToWrite()
+{
+    if (bufferLink && !bufferLink->copied) {
+        copyTo(*bufferLink);
+        bufferLink->copied = true;
+    }
+}
+
+inline void
+RegExpStatics::restore()
+{
+    if (bufferLink->copied)
+        bufferLink->copyTo(*this);
+    bufferLink = bufferLink->bufferLink;
+}
+
+inline bool
+RegExpStatics::updateFromMatchPairs(JSContext *cx, JSLinearString *input, MatchPairs *newPairs)
+{
+    JS_ASSERT(input);
+    aboutToWrite();
+    BarrieredSetPair<JSString, JSLinearString>(cx->compartment,
+                                               pendingInput, input,
+                                               matchPairsInput, input);
+
+    if (!matchPairs.resizeUninitialized(2 * newPairs->pairCount())) {
+        js_ReportOutOfMemory(cx);
+        return false;
+    }
+
+    for (size_t i = 0; i < newPairs->pairCount(); ++i) {
+        matchPairs[2 * i] = newPairs->pair(i).start;
+        matchPairs[2 * i + 1] = newPairs->pair(i).limit;
+    }
+
+    return true;
+}
+
+inline void
+RegExpStatics::clear()
+{
+    aboutToWrite();
+    flags = RegExpFlag(0);
+    pendingInput = NULL;
+    matchPairsInput = NULL;
+    matchPairs.clear();
+}
+
+inline void
+RegExpStatics::setPendingInput(JSString *newInput)
+{
+    aboutToWrite();
+    pendingInput = newInput;
+}
+
+PreserveRegExpStatics::~PreserveRegExpStatics()
+{
+    original->restore();
+}
+
 inline void
 RegExpStatics::setMultiline(JSContext *cx, bool enabled)
 {
diff --git a/js/src/vm/RegExpStatics.cpp b/js/src/vm/RegExpStatics.cpp
index 972cd0469aa7..1ed77ecefb27 100644
--- a/js/src/vm/RegExpStatics.cpp
+++ b/js/src/vm/RegExpStatics.cpp
@@ -42,6 +42,8 @@
 
 #include "jsobjinlines.h"
 
+#include "vm/RegExpStatics-inl.h"
+
 using namespace js;
 
 /*
@@ -96,6 +98,6 @@ RegExpStatics::create(JSContext *cx, GlobalObject *parent)
     RegExpStatics *res = cx->new_<RegExpStatics>();
     if (!res)
         return NULL;
-    obj->setPrivate(static_cast<void *>(res));
+    obj->initPrivate(static_cast<void *>(res));
     return obj;
 }
diff --git a/js/src/vm/RegExpStatics.h b/js/src/vm/RegExpStatics.h
index 25b9e9c11d3f..77db01e49f6f 100644
--- a/js/src/vm/RegExpStatics.h
+++ b/js/src/vm/RegExpStatics.h
@@ -42,7 +42,9 @@
 #define RegExpStatics_h__
 
 #include "jscntxt.h"
+#include "jsgcmark.h"
 
+#include "gc/Barrier.h"
 #include "js/Vector.h"
 
 #include "vm/MatchPairs.h"
@@ -52,32 +54,20 @@ namespace js {
 class RegExpStatics
 {
     typedef Vector<int, 20, SystemAllocPolicy> Pairs;
-    Pairs           matchPairs;
+    Pairs                   matchPairs;
     /* The input that was used to produce matchPairs. */
-    JSLinearString  *matchPairsInput;
+    HeapPtr<JSLinearString> matchPairsInput;
     /* The input last set on the statics. */
-    JSString        *pendingInput;
-    RegExpFlag      flags;
-    RegExpStatics   *bufferLink;
-    bool            copied;
+    HeapPtr<JSString>       pendingInput;
+    RegExpFlag              flags;
+    RegExpStatics           *bufferLink;
+    bool                    copied;
 
     bool createDependent(JSContext *cx, size_t start, size_t end, Value *out) const;
 
-    void copyTo(RegExpStatics &dst) {
-        dst.matchPairs.clear();
-        /* 'save' has already reserved space in matchPairs */
-        dst.matchPairs.infallibleAppend(matchPairs);
-        dst.matchPairsInput = matchPairsInput;
-        dst.pendingInput = pendingInput;
-        dst.flags = flags;
-    }
+    inline void copyTo(RegExpStatics &dst);
 
-    void aboutToWrite() {
-        if (bufferLink && !bufferLink->copied) {
-            copyTo(*bufferLink);
-            bufferLink->copied = true;
-        }
-    }
+    inline void aboutToWrite();
 
     bool save(JSContext *cx, RegExpStatics *buffer) {
         JS_ASSERT(!buffer->copied && !buffer->bufferLink);
@@ -90,11 +80,7 @@ class RegExpStatics
         return true;
     }
 
-    void restore() {
-        if (bufferLink->copied)
-            bufferLink->copyTo(*this);
-        bufferLink = bufferLink->bufferLink;
-    }
+    inline void restore();
 
     void checkInvariants() {
 #if DEBUG
@@ -158,48 +144,21 @@ class RegExpStatics
     friend class PreserveRegExpStatics;
 
   public:
-    RegExpStatics() : bufferLink(NULL), copied(false) { clear(); }
+    inline RegExpStatics();
 
     static JSObject *create(JSContext *cx, GlobalObject *parent);
 
     /* Mutators. */
 
-    bool updateFromMatchPairs(JSContext *cx, JSLinearString *input, MatchPairs *newPairs) {
-        JS_ASSERT(input);
-        aboutToWrite();
-        pendingInput = input;
-
-        if (!matchPairs.resizeUninitialized(2 * newPairs->pairCount())) {
-            js_ReportOutOfMemory(cx);
-            return false;
-        }
-
-        for (size_t i = 0; i < newPairs->pairCount(); ++i) {
-            matchPairs[2 * i] = newPairs->pair(i).start;
-            matchPairs[2 * i + 1] = newPairs->pair(i).limit;
-        }
-
-        matchPairsInput = input;
-        return true;
-    }
-
+    inline bool updateFromMatchPairs(JSContext *cx, JSLinearString *input, MatchPairs *newPairs);
     inline void setMultiline(JSContext *cx, bool enabled);
 
-    void clear() {
-        aboutToWrite();
-        flags = RegExpFlag(0);
-        pendingInput = NULL;
-        matchPairsInput = NULL;
-        matchPairs.clear();
-    }
+    inline void clear();
 
     /* Corresponds to JSAPI functionality to set the pending RegExp input. */
     inline void reset(JSContext *cx, JSString *newInput, bool newMultiline);
 
-    void setPendingInput(JSString *newInput) {
-        aboutToWrite();
-        pendingInput = newInput;
-    }
+    inline void setPendingInput(JSString *newInput);
 
     /* Accessors. */
 
@@ -248,9 +207,9 @@ class RegExpStatics
 
     void mark(JSTracer *trc) const {
         if (pendingInput)
-            JS_CALL_STRING_TRACER(trc, pendingInput, "res->pendingInput");
+            MarkString(trc, pendingInput, "res->pendingInput");
         if (matchPairsInput)
-            JS_CALL_STRING_TRACER(trc, matchPairsInput, "res->matchPairsInput");
+            MarkString(trc, matchPairsInput, "res->matchPairsInput");
     }
 
     bool pairIsPresent(size_t pairNum) const {
@@ -299,9 +258,7 @@ class PreserveRegExpStatics
         return original->save(cx, &buffer);
     }
 
-    ~PreserveRegExpStatics() {
-        original->restore();
-    }
+    inline ~PreserveRegExpStatics();
 };
 
 } /* namespace js */
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index dd321035a970..0c8668249763 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -208,8 +208,9 @@ class CallReceiver
         return argv_ - 1;
     }
 
-    void calleeHasBeenReset() const {
+    void setCallee(Value calleev) {
         clearUsedRval();
+        this->calleev() = calleev;
     }
 };
 
diff --git a/js/src/vm/String-inl.h b/js/src/vm/String-inl.h
index 68c66a20d80a..5b124c2d4227 100644
--- a/js/src/vm/String-inl.h
+++ b/js/src/vm/String-inl.h
@@ -44,8 +44,38 @@
 #include "String.h"
 
 #include "jscntxt.h"
+#include "jsgcmark.h"
+
 #include "jsgcinlines.h"
 
+inline void
+JSString::writeBarrierPre(JSString *str)
+{
+#ifdef JSGC_INCREMENTAL
+    if (!str)
+        return;
+
+    JSCompartment *comp = str->compartment();
+    if (comp->needsBarrier())
+        MarkStringUnbarriered(comp->barrierTracer(), str, "write barrier");
+#endif
+}
+
+inline void
+JSString::writeBarrierPost(JSString *str, void *addr)
+{
+}
+
+inline bool
+JSString::needWriteBarrierPre(JSCompartment *comp)
+{
+#ifdef JSGC_INCREMENTAL
+    return comp->needsBarrier();
+#else
+    return false;
+#endif
+}
+
 JS_ALWAYS_INLINE bool
 JSString::validateLength(JSContext *cx, size_t length)
 {
@@ -359,15 +389,15 @@ JSFlatString::finalize(JSRuntime *rt)
 inline void
 JSShortString::finalize(JSContext *cx)
 {
-    JS_ASSERT(isShort());
+    JS_ASSERT(JSString::isShort());
 }
 
 inline void
 JSAtom::finalize(JSRuntime *rt)
 {
-    JS_ASSERT(isAtom());
+    JS_ASSERT(JSString::isAtom());
     if (getAllocKind() == js::gc::FINALIZE_STRING)
-        asFlat().finalize(rt);
+        JSFlatString::finalize(rt);
     else
         JS_ASSERT(getAllocKind() == js::gc::FINALIZE_SHORT_STRING);
 }
diff --git a/js/src/vm/String.cpp b/js/src/vm/String.cpp
index a26f2fe77c44..f6a1226e3f6f 100644
--- a/js/src/vm/String.cpp
+++ b/js/src/vm/String.cpp
@@ -45,6 +45,8 @@
 #include "String.h"
 #include "String-inl.h"
 
+#include "jsobjinlines.h"
+
 using namespace mozilla;
 using namespace js;
 
@@ -149,8 +151,9 @@ AllocChars(JSContext *maybecx, size_t length, jschar **chars, size_t *capacity)
     return *chars != NULL;
 }
 
+template<JSRope::UsingBarrier b>
 JSFlatString *
-JSRope::flatten(JSContext *maybecx)
+JSRope::flattenInternal(JSContext *maybecx)
 {
     /*
      * Perform a depth-first dag traversal, splatting each node's characters
@@ -194,12 +197,19 @@ JSRope::flatten(JSContext *maybecx)
         JSExtensibleString &left = this->leftChild()->asExtensible();
         size_t capacity = left.capacity();
         if (capacity >= wholeLength) {
+            if (b == WithBarrier) {
+                JSString::writeBarrierPre(d.u1.left);
+                JSString::writeBarrierPre(d.s.u2.right);
+            }
+
             wholeCapacity = capacity;
             wholeChars = const_cast<jschar *>(left.chars());
             size_t bits = left.d.lengthAndFlags;
             pos = wholeChars + (bits >> LENGTH_SHIFT);
             left.d.lengthAndFlags = bits ^ (EXTENSIBLE_FLAGS | DEPENDENT_BIT);
             left.d.s.u2.base = (JSLinearString *)this;  /* will be true on exit */
+            if (b == WithBarrier)
+                JSString::writeBarrierPost(this, &left.d.s.u2.base);
             goto visit_right_child;
         }
     }
@@ -209,6 +219,11 @@ JSRope::flatten(JSContext *maybecx)
 
     pos = wholeChars;
     first_visit_node: {
+        if (b == WithBarrier) {
+            JSString::writeBarrierPre(str->d.u1.left);
+            JSString::writeBarrierPre(str->d.s.u2.right);
+        }
+
         JSString &left = *str->d.u1.left;
         str->d.u1.chars = pos;
         if (left.isRope()) {
@@ -245,6 +260,8 @@ JSRope::flatten(JSContext *maybecx)
         size_t progress = str->d.lengthAndFlags;
         str->d.lengthAndFlags = buildLengthAndFlags(pos - str->d.u1.chars, DEPENDENT_BIT);
         str->d.s.u2.base = (JSLinearString *)this;       /* will be true on exit */
+        if (b == WithBarrier)
+            JSString::writeBarrierPost(this, &str->d.s.u2.base);
         str = str->d.s.u3.parent;
         if (progress == 0x200)
             goto visit_right_child;
@@ -253,6 +270,19 @@ JSRope::flatten(JSContext *maybecx)
     }
 }
 
+JSFlatString *
+JSRope::flatten(JSContext *maybecx)
+{
+#if JSGC_INCREMENTAL
+    if (compartment()->needsBarrier())
+        return flattenInternal<WithBarrier>(maybecx);
+    else
+        return flattenInternal<NoBarrier>(maybecx);
+#else
+    return flattenInternal<NoBarrier>(maybecx);
+#endif
+}
+
 JSString * JS_FASTCALL
 js_ConcatStrings(JSContext *cx, JSString *left, JSString *right)
 {
@@ -295,7 +325,14 @@ js_ConcatStrings(JSContext *cx, JSString *left, JSString *right)
 JSFixedString *
 JSDependentString::undepend(JSContext *cx)
 {
-    JS_ASSERT(isDependent());
+    JS_ASSERT(JSString::isDependent());
+
+    /*
+     * We destroy the base() pointer in undepend, so we need a pre-barrier. We
+     * don't need a post-barrier because there aren't any outgoing pointers
+     * afterwards.
+     */
+    JSString::writeBarrierPre(base());
 
     size_t n = length();
     size_t size = (n + 1) * sizeof(jschar);
@@ -446,15 +483,17 @@ StaticStrings::trace(JSTracer *trc)
     if (!initialized)
         return;
 
+    /* These strings never change, so barriers are not needed. */
+
     for (uint32 i = 0; i < UNIT_STATIC_LIMIT; i++)
-        MarkString(trc, unitStaticTable[i], "unit-static-string");
+        MarkStringUnbarriered(trc, unitStaticTable[i], "unit-static-string");
 
     for (uint32 i = 0; i < NUM_SMALL_CHARS * NUM_SMALL_CHARS; i++)
-        MarkString(trc, length2StaticTable[i], "length2-static-string");
+        MarkStringUnbarriered(trc, length2StaticTable[i], "length2-static-string");
 
     /* This may mark some strings more than once, but so be it. */
     for (uint32 i = 0; i < INT_STATIC_LIMIT; i++)
-        MarkString(trc, intStaticTable[i], "int-static-string");
+        MarkStringUnbarriered(trc, intStaticTable[i], "int-static-string");
 }
 
 bool
diff --git a/js/src/vm/String.h b/js/src/vm/String.h
index 5a58e7f5f18c..3ab907ce6ece 100644
--- a/js/src/vm/String.h
+++ b/js/src/vm/String.h
@@ -275,8 +275,7 @@ class JSString : public js::gc::Cell
         JS_STATIC_ASSERT(((JSString::MAX_LENGTH << JSString::LENGTH_SHIFT) >>
                            JSString::LENGTH_SHIFT) == JSString::MAX_LENGTH);
         JS_STATIC_ASSERT(sizeof(JSString) ==
-                         offsetof(JSString, d.inlineStorage) +
-                         NUM_INLINE_CHARS * sizeof(jschar));
+                         offsetof(JSString, d.inlineStorage) + NUM_INLINE_CHARS * sizeof(jschar));
     }
 
     /* Avoid lame compile errors in JSRope::flatten */
@@ -319,7 +318,7 @@ class JSString : public js::gc::Cell
     }
 
     JS_ALWAYS_INLINE
-    JSRope &asRope() {
+    JSRope &asRope() const {
         JS_ASSERT(isRope());
         return *(JSRope *)this;
     }
@@ -330,8 +329,8 @@ class JSString : public js::gc::Cell
     }
 
     JS_ALWAYS_INLINE
-    JSLinearString &asLinear() {
-        JS_ASSERT(isLinear());
+    JSLinearString &asLinear() const {
+        JS_ASSERT(JSString::isLinear());
         return *(JSLinearString *)this;
     }
 
@@ -343,7 +342,7 @@ class JSString : public js::gc::Cell
     }
 
     JS_ALWAYS_INLINE
-    JSDependentString &asDependent() {
+    JSDependentString &asDependent() const {
         JS_ASSERT(isDependent());
         return *(JSDependentString *)this;
     }
@@ -354,7 +353,7 @@ class JSString : public js::gc::Cell
     }
 
     JS_ALWAYS_INLINE
-    JSFlatString &asFlat() {
+    JSFlatString &asFlat() const {
         JS_ASSERT(isFlat());
         return *(JSFlatString *)this;
     }
@@ -376,7 +375,7 @@ class JSString : public js::gc::Cell
     bool isInline() const;
 
     JS_ALWAYS_INLINE
-    JSFixedString &asFixed() {
+    JSFixedString &asFixed() const {
         JS_ASSERT(isFixed());
         return *(JSFixedString *)this;
     }
@@ -384,7 +383,7 @@ class JSString : public js::gc::Cell
     bool isExternal() const;
 
     JS_ALWAYS_INLINE
-    JSExternalString &asExternal() {
+    JSExternalString &asExternal() const {
         JS_ASSERT(isExternal());
         return *(JSExternalString *)this;
     }
@@ -419,10 +418,18 @@ class JSString : public js::gc::Cell
     static size_t offsetOfChars() {
         return offsetof(JSString, d.u1.chars);
     }
+
+    static inline void writeBarrierPre(JSString *str);
+    static inline void writeBarrierPost(JSString *str, void *addr);
+    static inline bool needWriteBarrierPre(JSCompartment *comp);
 };
 
 class JSRope : public JSString
 {
+    enum UsingBarrier { WithBarrier, NoBarrier };
+    template<UsingBarrier b>
+    JSFlatString *flattenInternal(JSContext *cx);
+
     friend class JSString;
     JSFlatString *flatten(JSContext *cx);
 
@@ -449,12 +456,17 @@ class JSLinearString : public JSString
 {
     friend class JSString;
 
+    /* Vacuous and therefore unimplemented. */
+    JSLinearString *ensureLinear(JSContext *cx) MOZ_DELETE;
+    bool isLinear() const MOZ_DELETE;
+    JSLinearString &asLinear() const MOZ_DELETE;
+
   public:
     void mark(JSTracer *trc);
 
     JS_ALWAYS_INLINE
     const jschar *chars() const {
-        JS_ASSERT(isLinear());
+        JS_ASSERT(JSString::isLinear());
         return d.u1.chars;
     }
 };
@@ -468,12 +480,16 @@ class JSDependentString : public JSLinearString
 
     void init(JSLinearString *base, const jschar *chars, size_t length);
 
+    /* Vacuous and therefore unimplemented. */
+    bool isDependent() const MOZ_DELETE;
+    JSDependentString &asDependent() const MOZ_DELETE;
+
   public:
     static inline JSDependentString *new_(JSContext *cx, JSLinearString *base,
                                           const jschar *chars, size_t length);
 
     JSLinearString *base() const {
-        JS_ASSERT(isDependent());
+        JS_ASSERT(JSString::isDependent());
         return d.s.u2.base;
     }
 };
@@ -488,10 +504,15 @@ class JSFlatString : public JSLinearString
         d.s.u2.base = base;
     }
 
+    /* Vacuous and therefore unimplemented. */
+    JSFlatString *ensureFlat(JSContext *cx) MOZ_DELETE;
+    bool isFlat() const MOZ_DELETE;
+    JSFlatString &asFlat() const MOZ_DELETE;
+
   public:
     JS_ALWAYS_INLINE
     const jschar *charsZ() const {
-        JS_ASSERT(isFlat());
+        JS_ASSERT(JSString::isFlat());
         return chars();
     }
 
@@ -519,10 +540,14 @@ JS_STATIC_ASSERT(sizeof(JSFlatString) == sizeof(JSString));
 
 class JSExtensibleString : public JSFlatString
 {
+    /* Vacuous and therefore unimplemented. */
+    bool isExtensible() const MOZ_DELETE;
+    JSExtensibleString &asExtensible() const MOZ_DELETE;
+
   public:
     JS_ALWAYS_INLINE
     size_t capacity() const {
-        JS_ASSERT(isExtensible());
+        JS_ASSERT(JSString::isExtensible());
         return d.s.u2.capacity;
     }
 };
@@ -533,6 +558,11 @@ class JSFixedString : public JSFlatString
 {
     void init(const jschar *chars, size_t length);
 
+    /* Vacuous and therefore unimplemented. */
+    JSFlatString *ensureFixed(JSContext *cx) MOZ_DELETE;
+    bool isFixed() const MOZ_DELETE;
+    JSFixedString &asFixed() const MOZ_DELETE;
+
   public:
     static inline JSFixedString *new_(JSContext *cx, const jschar *chars, size_t length);
 
@@ -615,18 +645,22 @@ class JSExternalString : public JSFixedString
 
     void init(const jschar *chars, size_t length, intN type, void *closure);
 
+    /* Vacuous and therefore unimplemented. */
+    bool isExternal() const MOZ_DELETE;
+    JSExternalString &asExternal() const MOZ_DELETE;
+
   public:
     static inline JSExternalString *new_(JSContext *cx, const jschar *chars,
                                          size_t length, intN type, void *closure);
 
     intN externalType() const {
-        JS_ASSERT(isExternal());
+        JS_ASSERT(JSString::isExternal());
         JS_ASSERT(d.s.u2.externalType < TYPE_LIMIT);
         return intN(d.s.u2.externalType);
     }
 
     void *externalClosure() const {
-        JS_ASSERT(isExternal());
+        JS_ASSERT(JSString::isExternal());
         return d.s.u3.externalClosure;
     }
 
@@ -654,6 +688,10 @@ JS_STATIC_ASSERT(sizeof(JSExternalString) == sizeof(JSString));
 
 class JSAtom : public JSFixedString
 {
+    /* Vacuous and therefore unimplemented. */
+    bool isAtom() const MOZ_DELETE;
+    JSAtom &asAtom() const MOZ_DELETE;
+
   public:
     /* Returns the PropertyName for this.  isIndex() must be false. */
     inline js::PropertyName *asPropertyName();
diff --git a/js/xpconnect/idl/nsIXPConnect.idl b/js/xpconnect/idl/nsIXPConnect.idl
index 04bac1dd8a17..80fc48d3ecfc 100644
--- a/js/xpconnect/idl/nsIXPConnect.idl
+++ b/js/xpconnect/idl/nsIXPConnect.idl
@@ -392,7 +392,7 @@ interface nsIXPCFunctionThisTranslator : nsISupports
     { 0xbd, 0xd6, 0x0, 0x0, 0x64, 0x65, 0x73, 0x74 } }
 %}
 
-[uuid(a995b541-d514-43f1-ac0e-f49746c0b063)]
+[uuid(29b63029-0868-4344-b0ca-d93256ee7c78)]
 interface nsIXPConnect : nsISupports
 {
 %{ C++
@@ -795,5 +795,6 @@ interface nsIXPConnect : nsISupports
      * This method will turn debug mode on or off when the context 
      * stack reaches zero length.
      */
-    [noscript] void setDebugModeWhenPossible(in boolean mode);
+    [noscript] void setDebugModeWhenPossible(in boolean mode,
+                                             in boolean allowSyncDisable);
 };
diff --git a/js/xpconnect/loader/mozJSComponentLoader.cpp b/js/xpconnect/loader/mozJSComponentLoader.cpp
index a32cb755af83..88c6b7985e6a 100644
--- a/js/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/xpconnect/loader/mozJSComponentLoader.cpp
@@ -48,6 +48,9 @@
 #include <stdarg.h>
 
 #include "prlog.h"
+#ifdef ANDROID
+#include <android/log.h>
+#endif
 
 #include "nsCOMPtr.h"
 #include "nsAutoPtr.h"
@@ -204,7 +207,11 @@ Dump(JSContext *cx, uintN argc, jsval *vp)
     if (!chars)
         return JS_FALSE;
 
-    fputs(NS_ConvertUTF16toUTF8(reinterpret_cast<const PRUnichar*>(chars)).get(), stdout);
+    NS_ConvertUTF16toUTF8 utf8str(reinterpret_cast<const PRUnichar*>(chars));
+#ifdef ANDROID
+    __android_log_print(ANDROID_LOG_INFO, "Gecko", utf8str.get());
+#endif
+    fputs(utf8str.get(), stdout);
     fflush(stdout);
     return JS_TRUE;
 }
diff --git a/js/xpconnect/shell/xpcshell.cpp b/js/xpconnect/shell/xpcshell.cpp
index 90f44e36eabc..1f9c143d485a 100644
--- a/js/xpconnect/shell/xpcshell.cpp
+++ b/js/xpconnect/shell/xpcshell.cpp
@@ -90,6 +90,10 @@
 #include <windows.h>
 #endif
 
+#ifdef ANDROID
+#include <android/log.h>
+#endif
+
 #include "nsIScriptSecurityManager.h"
 #include "nsIPrincipal.h"
 
@@ -455,6 +459,9 @@ Dump(JSContext *cx, uintN argc, jsval *vp)
     if (!bytes)
         return JS_FALSE;
 
+#ifdef ANDROID
+    __android_log_print(ANDROID_LOG_INFO, "Gecko", bytes.ptr());
+#endif
     fputs(bytes.ptr(), gOutFile);
     fflush(gOutFile);
     return JS_TRUE;
diff --git a/js/xpconnect/src/XPCWrappedNative.cpp b/js/xpconnect/src/XPCWrappedNative.cpp
index 6743681e3819..050f1f7ca871 100644
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -138,13 +138,15 @@ NS_CYCLE_COLLECTION_CLASSNAME(XPCWrappedNative)::Traverse(void *p,
         cb.NoteScriptChild(nsIProgrammingLanguage::JAVASCRIPT, obj);
     }
 
-    XPCJSRuntime *rt = tmp->GetRuntime();
-    TraverseExpandoObjectClosure closure = {
-         rt->GetXPConnect()->GetCycleCollectionContext()->GetJSContext(),
-         tmp,
-         cb
-    };
-    rt->GetCompartmentMap().EnumerateRead(TraverseExpandoObjects, &closure);
+    if (tmp->MightHaveExpandoObject()) {
+        XPCJSRuntime *rt = tmp->GetRuntime();
+        TraverseExpandoObjectClosure closure = {
+             rt->GetXPConnect()->GetCycleCollectionContext()->GetJSContext(),
+             tmp,
+             cb
+        };
+        rt->GetCompartmentMap().EnumerateRead(TraverseExpandoObjects, &closure);
+    }
 
     // XPCWrappedNative keeps its native object alive.
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mIdentity");
@@ -823,6 +825,8 @@ XPCWrappedNative::XPCWrappedNative(already_AddRefed<nsISupports> aIdentity,
     NS_ASSERTION(mSet, "bad ctor param");
 
     DEBUG_TrackNewWrapper(this);
+
+    JS_RegisterReference((void **) &mWrapperWord);
 }
 
 // This ctor is used if this object will NOT have a proto.
@@ -845,6 +849,8 @@ XPCWrappedNative::XPCWrappedNative(already_AddRefed<nsISupports> aIdentity,
     NS_ASSERTION(aSet, "bad ctor param");
 
     DEBUG_TrackNewWrapper(this);
+
+    JS_RegisterReference((void **) &mWrapperWord);
 }
 
 XPCWrappedNative::~XPCWrappedNative()
@@ -894,6 +900,36 @@ XPCWrappedNative::Destroy()
     }
 
     mMaybeScope = nsnull;
+
+    JS_UnregisterReference((void **) &mWrapperWord);
+}
+
+void
+XPCWrappedNative::UpdateScriptableInfo(XPCNativeScriptableInfo *si)
+{
+    NS_ASSERTION(mScriptableInfo, "UpdateScriptableInfo expects an existing scriptable info");
+
+    // Write barrier for incremental GC.
+    JSRuntime* rt = GetRuntime()->GetJSRuntime();
+    if (JS_GetIncrementalGCTracer(rt))
+        mScriptableInfo->Mark();
+
+    mScriptableInfo = si;
+}
+
+void
+XPCWrappedNative::SetProto(XPCWrappedNativeProto* p)
+{
+    NS_ASSERTION(!IsWrapperExpired(), "bad ptr!");
+
+    // Write barrier for incremental GC.
+    if (HasProto()) {
+        JSRuntime* rt = GetRuntime()->GetJSRuntime();
+        if (JS_GetIncrementalGCTracer(rt))
+            GetProto()->TraceJS(JS_GetIncrementalGCTracer(rt));
+    }
+
+    mMaybeProto = p;
 }
 
 // This is factored out so that it can be called publicly
@@ -1099,12 +1135,30 @@ XPCWrappedNative::Init(XPCCallContext& ccx,
     if (!mFlatJSObject)
         return JS_FALSE;
 
+    // In the current JS engine JS_SetPrivate can't fail. But if it *did*
+    // fail then we would not receive our finalizer call and would not be
+    // able to properly cleanup. So, if it fails we null out mFlatJSObject
+    // to indicate the invalid state of this object and return false.
+    if (!JS_SetPrivate(ccx, mFlatJSObject, this)) {
+        mFlatJSObject = nsnull;
+        return JS_FALSE;
+    }
+
     return FinishInit(ccx);
 }
 
 JSBool
 XPCWrappedNative::Init(XPCCallContext &ccx, JSObject *existingJSObject)
 {
+    // In the current JS engine JS_SetPrivate can't fail. But if it *did*
+    // fail then we would not receive our finalizer call and would not be
+    // able to properly cleanup. So, if it fails we null out mFlatJSObject
+    // to indicate the invalid state of this object and return false.
+    if (!JS_SetPrivate(ccx, existingJSObject, this)) {
+        mFlatJSObject = nsnull;
+        return JS_FALSE;
+    }
+
     // Morph the existing object.
     if (!JS_SetReservedSlot(ccx, existingJSObject, 0, JSVAL_VOID))
         return JS_FALSE;
@@ -1122,15 +1176,6 @@ XPCWrappedNative::Init(XPCCallContext &ccx, JSObject *existingJSObject)
 JSBool
 XPCWrappedNative::FinishInit(XPCCallContext &ccx)
 {
-    // In the current JS engine JS_SetPrivate can't fail. But if it *did*
-    // fail then we would not receive our finalizer call and would not be
-    // able to properly cleanup. So, if it fails we null out mFlatJSObject
-    // to indicate the invalid state of this object and return false.
-    if (!JS_SetPrivate(ccx, mFlatJSObject, this)) {
-        mFlatJSObject = nsnull;
-        return JS_FALSE;
-    }
-
     // This reference will be released when mFlatJSObject is finalized.
     // Since this reference will push the refcount to 2 it will also root
     // mFlatJSObject;
@@ -1478,7 +1523,7 @@ XPCWrappedNative::ReparentWrapperIfFound(XPCCallContext& ccx,
                                  "Changing proto is also changing JSObject Classname or "
                                  "helper's nsIXPScriptable flags. This is not allowed!");
 
-                    wrapper->mScriptableInfo = newProto->GetScriptableInfo();
+                    wrapper->UpdateScriptableInfo(newProto->GetScriptableInfo());
                 }
 
                 NS_ASSERTION(!newMap->Find(wrapper->GetIdentityObject()),
@@ -3015,7 +3060,7 @@ NS_IMETHODIMP XPCWrappedNative::RefreshPrototype()
     SetProto(newProto);
 
     if (mScriptableInfo == oldProto->GetScriptableInfo())
-        mScriptableInfo = newProto->GetScriptableInfo();
+        UpdateScriptableInfo(newProto->GetScriptableInfo());
 
     return NS_OK;
 }
diff --git a/js/xpconnect/src/XPCWrappedNativeProto.cpp b/js/xpconnect/src/XPCWrappedNativeProto.cpp
index e97dbd921272..14847982ba1e 100644
--- a/js/xpconnect/src/XPCWrappedNativeProto.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeProto.cpp
@@ -266,7 +266,7 @@ XPCWrappedNativeProto::DebugDump(PRInt16 depth)
     XPC_LOG_INDENT();
         XPC_LOG_ALWAYS(("gDEBUG_LiveProtoCount is %d", gDEBUG_LiveProtoCount));
         XPC_LOG_ALWAYS(("mScope @ %x", mScope));
-        XPC_LOG_ALWAYS(("mJSProtoObject @ %x", mJSProtoObject));
+        XPC_LOG_ALWAYS(("mJSProtoObject @ %x", mJSProtoObject.get()));
         XPC_LOG_ALWAYS(("mSet @ %x", mSet));
         XPC_LOG_ALWAYS(("mSecurityInfo of %x", mSecurityInfo));
         XPC_LOG_ALWAYS(("mScriptableInfo @ %x", mScriptableInfo));
diff --git a/js/xpconnect/src/XPCWrappedNativeScope.cpp b/js/xpconnect/src/XPCWrappedNativeScope.cpp
index 66e0b909fc3a..646f259e45c6 100644
--- a/js/xpconnect/src/XPCWrappedNativeScope.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeScope.cpp
@@ -947,9 +947,9 @@ XPCWrappedNativeScope::DebugDump(PRInt16 depth)
         XPC_LOG_ALWAYS(("mRuntime @ %x", mRuntime));
         XPC_LOG_ALWAYS(("mNext @ %x", mNext));
         XPC_LOG_ALWAYS(("mComponents @ %x", mComponents));
-        XPC_LOG_ALWAYS(("mGlobalJSObject @ %x", mGlobalJSObject));
-        XPC_LOG_ALWAYS(("mPrototypeJSObject @ %x", mPrototypeJSObject));
-        XPC_LOG_ALWAYS(("mPrototypeJSFunction @ %x", mPrototypeJSFunction));
+        XPC_LOG_ALWAYS(("mGlobalJSObject @ %x", mGlobalJSObject.get()));
+        XPC_LOG_ALWAYS(("mPrototypeJSObject @ %x", mPrototypeJSObject.get()));
+        XPC_LOG_ALWAYS(("mPrototypeJSFunction @ %x", mPrototypeJSFunction.get()));
         XPC_LOG_ALWAYS(("mPrototypeNoHelper @ %x", mPrototypeNoHelper));
 
         XPC_LOG_ALWAYS(("mWrappedNativeMap @ %x with %d wrappers(s)",         \
diff --git a/js/xpconnect/src/dombindings.cpp b/js/xpconnect/src/dombindings.cpp
index 32036e2605ae..f11477b95015 100644
--- a/js/xpconnect/src/dombindings.cpp
+++ b/js/xpconnect/src/dombindings.cpp
@@ -676,7 +676,7 @@ ListBase<LC>::ensureExpandoObject(JSContext *cx, JSObject *obj)
             return NULL;
 
         js::SetProxyExtra(obj, JSPROXYSLOT_EXPANDO, ObjectValue(*expando));
-        expando->setPrivate(js::GetProxyPrivate(obj).toPrivate());
+        JS_SetPrivate(cx, expando, js::GetProxyPrivate(obj).toPrivate());
     }
     return expando;
 }
@@ -1015,26 +1015,34 @@ template<class LC>
 bool
 ListBase<LC>::get(JSContext *cx, JSObject *proxy, JSObject *receiver, jsid id, Value *vp)
 {
+    NS_ASSERTION(!xpc::WrapperFactory::IsXrayWrapper(proxy),
+                 "Should not have a XrayWrapper here");
+
+    bool getFromExpandoObject = true;
+
     if (hasIndexGetter) {
         int32 index = GetArrayIndexFromId(cx, id);
         if (index >= 0) {
             IndexGetterType result;
-            if (!getItemAt(getListObject(proxy), PRUint32(index), result)) {
-                vp->setUndefined();
-                return true;
-            }
-            return Wrap(cx, proxy, result, vp);
+            if (getItemAt(getListObject(proxy), PRUint32(index), result))
+                return Wrap(cx, proxy, result, vp);
+
+            // Even if we don't have this index, we don't forward the
+            // get on to our expando object.
+            getFromExpandoObject = false;
         }
     }
 
-    JSObject *expando = getExpandoObject(proxy);
-    if (expando) {
-        JSBool hasProp;
-        if (!JS_HasPropertyById(cx, expando, id, &hasProp))
-            return false;
+    if (getFromExpandoObject) {
+        JSObject *expando = getExpandoObject(proxy);
+        if (expando) {
+            JSBool hasProp;
+            if (!JS_HasPropertyById(cx, expando, id, &hasProp))
+                return false;
 
-        if (hasProp)
-            return JS_GetPropertyById(cx, expando, id, vp);
+            if (hasProp)
+                return JS_GetPropertyById(cx, expando, id, vp);
+        }
     }
 
     bool found;
@@ -1063,28 +1071,31 @@ bool
 ListBase<LC>::getElementIfPresent(JSContext *cx, JSObject *proxy, JSObject *receiver,
                                   uint32 index, Value *vp, bool *present)
 {
+    NS_ASSERTION(!xpc::WrapperFactory::IsXrayWrapper(proxy),
+                 "Should not have a XrayWrapper here");
+
     if (hasIndexGetter) {
         IndexGetterType result;
         *present = getItemAt(getListObject(proxy), index, result);
         if (*present)
             return Wrap(cx, proxy, result, vp);
-
-        vp->setUndefined();
-        return true;
     }
 
     jsid id;
     if (!JS_IndexToId(cx, index, &id))
         return false;
 
-    JSObject *expando = getExpandoObject(proxy);
-    if (expando) {
-        JSBool isPresent;
-        if (!JS_GetElementIfPresent(cx, expando, index, expando, vp, &isPresent))
-            return false;
-        if (isPresent) {
-            *present = true;
-            return true;
+    // if hasIndexGetter, we skip the expando object
+    if (!hasIndexGetter) {
+        JSObject *expando = getExpandoObject(proxy);
+        if (expando) {
+            JSBool isPresent;
+            if (!JS_GetElementIfPresent(cx, expando, index, expando, vp, &isPresent))
+                return false;
+            if (isPresent) {
+                *present = true;
+                return true;
+            }
         }
     }
 
diff --git a/js/xpconnect/src/nsXPConnect.cpp b/js/xpconnect/src/nsXPConnect.cpp
index f20c8f547259..9ea17428294c 100644
--- a/js/xpconnect/src/nsXPConnect.cpp
+++ b/js/xpconnect/src/nsXPConnect.cpp
@@ -2862,10 +2862,10 @@ nsXPConnect::Base64Decode(JSContext *cx, jsval val, jsval *out)
 }
 
 NS_IMETHODIMP
-nsXPConnect::SetDebugModeWhenPossible(bool mode)
+nsXPConnect::SetDebugModeWhenPossible(bool mode, bool allowSyncDisable)
 {
     gDesiredDebugMode = mode;
-    if (!mode)
+    if (!mode && allowSyncDisable)
         CheckForDebugMode(mRuntime->GetJSRuntime());
     return NS_OK;
 }
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 0a8a725c8f8e..d5130e41b41f 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -277,9 +277,9 @@ class PtrAndPrincipalHashKey : public PLDHashEntryHdr
         return aKey->mSavedHash;
     }
 
-    nsISupports* GetPtr()
-    {
-        return mPtr;
+    nsISupports* GetPtr()
+    {
+        return mPtr;
     }
 
     enum { ALLOW_MEMMOVE = true };
@@ -1663,12 +1663,12 @@ private:
     // default parent for the XPCWrappedNatives that have us as the scope,
     // unless a PreCreate hook overrides it.  Note that this _may_ be null (see
     // constructor).
-    JSObject*                        mGlobalJSObject;
+    JS::HeapPtrObject                mGlobalJSObject;
 
     // Cached value of Object.prototype
-    JSObject*                        mPrototypeJSObject;
+    JS::HeapPtrObject                mPrototypeJSObject;
     // Cached value of Function.prototype
-    JSObject*                        mPrototypeJSFunction;
+    JS::HeapPtrObject                mPrototypeJSFunction;
     // Prototype to use for wrappers with no helper.
     JSObject*                        mPrototypeNoHelper;
 
@@ -2366,7 +2366,7 @@ private:
     }
 
     XPCWrappedNativeScope*   mScope;
-    JSObject*                mJSProtoObject;
+    JS::HeapPtrObject        mJSProtoObject;
     nsCOMPtr<nsIClassInfo>   mClassInfo;
     PRUint32                 mClassInfoFlags;
     XPCNativeSet*            mSet;
@@ -2525,10 +2525,7 @@ public:
          (XPCWrappedNativeProto*)
          (XPC_SCOPE_WORD(mMaybeProto) & ~XPC_SCOPE_MASK) : nsnull;}
 
-    void
-    SetProto(XPCWrappedNativeProto* p)
-        {NS_ASSERTION(!IsWrapperExpired(), "bad ptr!");
-         mMaybeProto = p;}
+    void SetProto(XPCWrappedNativeProto* p);
 
     XPCWrappedNativeScope*
     GetScope() const
@@ -2744,6 +2741,8 @@ public:
     void SetNeedsSOW() { mWrapperWord |= NEEDS_SOW; }
     JSBool NeedsCOW() { return !!(mWrapperWord & NEEDS_COW); }
     void SetNeedsCOW() { mWrapperWord |= NEEDS_COW; }
+    JSBool MightHaveExpandoObject() { return !!(mWrapperWord & MIGHT_HAVE_EXPANDO); }
+    void SetHasExpandoObject() { mWrapperWord |= MIGHT_HAVE_EXPANDO; }
 
     JSObject* GetWrapperPreserveColor() const
         {return (JSObject*)(mWrapperWord & (size_t)~(size_t)FLAG_MASK);}
@@ -2760,11 +2759,8 @@ public:
     }
     void SetWrapper(JSObject *obj)
     {
-        PRWord needsSOW = NeedsSOW() ? NEEDS_SOW : 0;
-        PRWord needsCOW = NeedsCOW() ? NEEDS_COW : 0;
-        mWrapperWord = PRWord(obj) |
-                         needsSOW |
-                         needsCOW;
+        PRWord newval = PRWord(obj) | (mWrapperWord & FLAG_MASK);
+        JS_ModifyReference((void **)&mWrapperWord, (void *)newval);
     }
 
     void NoteTearoffs(nsCycleCollectionTraversalCallback& cb);
@@ -2799,14 +2795,14 @@ protected:
     virtual ~XPCWrappedNative();
     void Destroy();
 
+    void UpdateScriptableInfo(XPCNativeScriptableInfo *si);
+
 private:
     enum {
         NEEDS_SOW = JS_BIT(0),
         NEEDS_COW = JS_BIT(1),
-
-        LAST_FLAG = NEEDS_COW,
-
-        FLAG_MASK = 0x7
+        MIGHT_HAVE_EXPANDO = JS_BIT(2),
+        FLAG_MASK = JS_BITMASK(3)
     };
 
 private:
@@ -4379,7 +4375,7 @@ xpc_GetJSPrivate(JSObject *obj)
 // and used.
 nsresult
 xpc_CreateSandboxObject(JSContext * cx, jsval * vp, nsISupports *prinOrSop,
-                        JSObject *proto, bool preferXray, const nsACString &sandboxName,
+                        JSObject *proto, bool preferXray, const nsACString &sandboxName,
                         nsISupports *identityPtr = nsnull);
 // Helper for evaluating scripts in a sandbox object created with
 // xpc_CreateSandboxObject(). The caller is responsible of ensuring
@@ -4467,6 +4463,7 @@ struct CompartmentPrivate
                 return false;
             }
         }
+        wn->SetHasExpandoObject();
         return expandoMap->Put(wn, expando);
     }
 
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 1a18cf5069cc..3b6634254e9a 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -49,6 +49,8 @@
 #include "nsImageFrame.h"
 #include "nsRenderingContext.h"
 
+#include "mozilla/Preferences.h"
+
 #ifdef DEBUG
 #include <stdio.h>
 #endif
@@ -470,6 +472,27 @@ FrameLayerBuilder::DisplayItemDataEntry::HasNonEmptyContainerLayer()
   return false;
 }
 
+void
+FrameLayerBuilder::FlashPaint(gfxContext *aContext)
+{
+  static bool sPaintFlashingEnabled;
+  static bool sPaintFlashingPrefCached = false;
+
+  if (!sPaintFlashingPrefCached) {
+    sPaintFlashingPrefCached = true;
+    mozilla::Preferences::AddBoolVarCache(&sPaintFlashingEnabled, 
+                                          "nglayout.debug.paint_flashing");
+  }
+
+  if (sPaintFlashingEnabled) {
+    float r = float(rand()) / RAND_MAX;
+    float g = float(rand()) / RAND_MAX;
+    float b = float(rand()) / RAND_MAX;
+    aContext->SetColor(gfxRGBA(r, g, b, 0.2));
+    aContext->Paint();
+  }
+}
+
 /* static */ nsTArray<FrameLayerBuilder::DisplayItemData>*
 FrameLayerBuilder::GetDisplayItemDataArrayForFrame(nsIFrame* aFrame)
 {
@@ -2127,6 +2150,8 @@ FrameLayerBuilder::DrawThebesLayer(ThebesLayer* aLayer,
   if (setClipRect) {
     aContext->Restore();
   }
+
+  FlashPaint(aContext);
 }
 
 bool
diff --git a/layout/base/FrameLayerBuilder.h b/layout/base/FrameLayerBuilder.h
index da2082a6f60e..99a2e6dd47fd 100644
--- a/layout/base/FrameLayerBuilder.h
+++ b/layout/base/FrameLayerBuilder.h
@@ -441,6 +441,9 @@ protected:
   // LayerManagerData needs to see DisplayItemDataEntry.
   friend class LayerManagerData;
 
+  // Flash the area within the context clip if paint flashing is enabled.
+  static void FlashPaint(gfxContext *aContext);
+
   /*
    * Get the DisplayItemData array associated with this frame, or null if one
    * doesn't exist.
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 3769c8cd4088..33f92af12b86 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -4547,7 +4547,8 @@ nsCSSFrameConstructor::ResolveStyleContext(nsStyleContext* aParentStyleContext,
                                            nsFrameConstructorState* aState)
 {
   nsStyleSet *styleSet = mPresShell->StyleSet();
-
+  aContent->OwnerDoc()->FlushPendingLinkUpdates();
+  
   if (aContent->IsElement()) {
     if (aState) {
       return styleSet->ResolveStyleFor(aContent->AsElement(),
diff --git a/layout/base/nsFrameManager.cpp b/layout/base/nsFrameManager.cpp
index dd069fc794c9..6813b57ddc71 100644
--- a/layout/base/nsFrameManager.cpp
+++ b/layout/base/nsFrameManager.cpp
@@ -1111,6 +1111,7 @@ nsFrameManager::ReResolveStyleContext(nsPresContext     *aPresContext,
     nsIContent* content = localContent ? localContent : aParentContent;
 
     if (content && content->IsElement()) {
+      content->OwnerDoc()->FlushPendingLinkUpdates();
       RestyleTracker::RestyleData restyleData;
       if (aRestyleTracker.GetRestyleData(content->AsElement(), &restyleData)) {
         if (NS_UpdateHint(aMinChange, restyleData.mChangeHint)) {
diff --git a/layout/base/nsImageLoader.cpp b/layout/base/nsImageLoader.cpp
index bd711a155dd5..753e11259ac1 100644
--- a/layout/base/nsImageLoader.cpp
+++ b/layout/base/nsImageLoader.cpp
@@ -57,6 +57,7 @@
 
 #include "nsStyleContext.h"
 #include "nsGkAtoms.h"
+#include "nsLayoutUtils.h"
 
 // Paint forcing
 #include "prenv.h"
@@ -67,17 +68,14 @@ nsImageLoader::nsImageLoader(nsIFrame *aFrame, PRUint32 aActions,
                              nsImageLoader *aNextLoader)
   : mFrame(aFrame),
     mActions(aActions),
-    mNextLoader(aNextLoader)
+    mNextLoader(aNextLoader),
+    mRequestRegistered(false)
 {
 }
 
 nsImageLoader::~nsImageLoader()
 {
-  mFrame = nsnull;
-
-  if (mRequest) {
-    mRequest->CancelAndForgetObserver(NS_ERROR_FAILURE);
-  }
+  Destroy();
 }
 
 /* static */ already_AddRefed<nsImageLoader>
@@ -105,12 +103,13 @@ nsImageLoader::Destroy()
     todestroy->Destroy();
   }
 
-  mFrame = nsnull;
-
-  if (mRequest) {
+  if (mRequest && mFrame) {
+    nsLayoutUtils::DeregisterImageRequest(mFrame->PresContext(), mRequest,
+                                          &mRequestRegistered);
     mRequest->CancelAndForgetObserver(NS_ERROR_FAILURE);
   }
 
+  mFrame = nsnull;
   mRequest = nsnull;
 }
 
@@ -127,17 +126,28 @@ nsImageLoader::Load(imgIRequest *aImage)
   if (!aImage)
     return NS_ERROR_FAILURE;
 
+  // Deregister mRequest from the refresh driver, since it is no longer
+  // going to be managed by this nsImageLoader.
+  nsPresContext* presContext = mFrame->PresContext();
+
+  nsLayoutUtils::DeregisterImageRequest(presContext, mRequest,
+                                        &mRequestRegistered);
+
   // Make sure to clone into a temporary, then set mRequest, since
   // cloning may notify and we don't want to trigger paints from this
   // code.
   nsCOMPtr<imgIRequest> newRequest;
   nsresult rv = aImage->Clone(this, getter_AddRefs(newRequest));
   mRequest.swap(newRequest);
+
+  if (mRequest) {
+    nsLayoutUtils::RegisterImageRequestIfAnimated(presContext, mRequest,
+                                                  &mRequestRegistered);
+  }
+
   return rv;
 }
 
-                    
-
 NS_IMETHODIMP nsImageLoader::OnStartContainer(imgIRequest *aRequest,
                                               imgIContainer *aImage)
 {
@@ -174,6 +184,15 @@ NS_IMETHODIMP nsImageLoader::OnStopFrame(imgIRequest *aRequest,
   return NS_OK;
 }
 
+NS_IMETHODIMP nsImageLoader::OnImageIsAnimated(imgIRequest *aRequest)
+{
+  // Register with the refresh driver now that we are aware that
+  // we are animated.
+  nsLayoutUtils::RegisterImageRequest(mFrame->PresContext(),
+                                      aRequest, &mRequestRegistered);
+  return NS_OK;
+}
+
 NS_IMETHODIMP nsImageLoader::OnStopRequest(imgIRequest *aRequest,
                                            bool aLastPart)
 {
diff --git a/layout/base/nsImageLoader.h b/layout/base/nsImageLoader.h
index de5287b5243e..8cc8232f5ed8 100644
--- a/layout/base/nsImageLoader.h
+++ b/layout/base/nsImageLoader.h
@@ -84,6 +84,7 @@ public:
   NS_IMETHOD OnStartContainer(imgIRequest *aRequest, imgIContainer *aImage);
   NS_IMETHOD OnStopFrame(imgIRequest *aRequest, PRUint32 aFrame);
   NS_IMETHOD OnStopRequest(imgIRequest *aRequest, bool aLastPart);
+  NS_IMETHOD OnImageIsAnimated(imgIRequest *aRequest);
   // Do not override OnDataAvailable since background images are not
   // displayed incrementally; they are displayed after the entire image
   // has been loaded.
@@ -109,4 +110,8 @@ private:
   nsCOMPtr<imgIRequest> mRequest;
   PRUint32 mActions;
   nsRefPtr<nsImageLoader> mNextLoader;
+
+  // This is a boolean flag indicating whether or not the current image request
+  // has been registered with the refresh driver.
+  bool mRequestRegistered;
 };
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 157a82f8e9ee..546abc05996c 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -4327,6 +4327,102 @@ nsLayoutUtils::Shutdown()
   }
 }
 
+/* static */
+void
+nsLayoutUtils::RegisterImageRequest(nsPresContext* aPresContext,
+                                    imgIRequest* aRequest,
+                                    bool* aRequestRegistered)
+{
+  if (!aPresContext) {
+    return;
+  }
+
+  if (aRequestRegistered && *aRequestRegistered) {
+    // Our request is already registered with the refresh driver, so
+    // no need to register it again.
+    return;
+  }
+
+  if (aRequest) {
+    if (!aPresContext->RefreshDriver()->AddImageRequest(aRequest)) {
+      NS_WARNING("Unable to add image request");
+      return;
+    }
+
+    if (aRequestRegistered) {
+      *aRequestRegistered = true;
+    }
+  }
+}
+
+/* static */
+void
+nsLayoutUtils::RegisterImageRequestIfAnimated(nsPresContext* aPresContext,
+                                              imgIRequest* aRequest,
+                                              bool* aRequestRegistered)
+{
+  if (!aPresContext) {
+    return;
+  }
+
+  if (aRequestRegistered && *aRequestRegistered) {
+    // Our request is already registered with the refresh driver, so
+    // no need to register it again.
+    return;
+  }
+
+  if (aRequest) {
+    nsCOMPtr<imgIContainer> image;
+    aRequest->GetImage(getter_AddRefs(image));
+    if (image) {
+
+      // Check to verify that the image is animated. If so, then add it to the
+      // list of images tracked by the refresh driver.
+      bool isAnimated = false;
+      nsresult rv = image->GetAnimated(&isAnimated);
+      if (NS_SUCCEEDED(rv) && isAnimated) {
+        if (!aPresContext->RefreshDriver()->AddImageRequest(aRequest)) {
+          NS_WARNING("Unable to add image request");
+          return;
+        }
+
+        if (aRequestRegistered) {
+          *aRequestRegistered = true;
+        }
+      }
+    }
+  }
+}
+
+/* static */
+void
+nsLayoutUtils::DeregisterImageRequest(nsPresContext* aPresContext,
+                                      imgIRequest* aRequest,
+                                      bool* aRequestRegistered)
+{
+  if (!aPresContext) {
+    return;
+  }
+
+  // Deregister our imgIRequest with the refresh driver to
+  // complete tear-down, but only if it has been registered
+  if (aRequestRegistered && !*aRequestRegistered) {
+    return;
+  }
+
+  if (aRequest) {
+    nsCOMPtr<imgIContainer> image;
+    aRequest->GetImage(getter_AddRefs(image));
+    if (image) {
+      aPresContext->RefreshDriver()->RemoveImageRequest(aRequest);
+
+      if (aRequestRegistered) {
+        *aRequestRegistered = false;
+      }
+    }
+  }
+}
+
 nsSetAttrRunnable::nsSetAttrRunnable(nsIContent* aContent, nsIAtom* aAttrName,
                                      const nsAString& aValue)
   : mContent(aContent),
diff --git a/layout/base/nsLayoutUtils.h b/layout/base/nsLayoutUtils.h
index 4b13c9d8d721..623bacb78f67 100644
--- a/layout/base/nsLayoutUtils.h
+++ b/layout/base/nsLayoutUtils.h
@@ -1454,6 +1454,64 @@ public:
 
   static void Shutdown();
 
+  /**
+   * Register an imgIRequest object with a refresh driver.
+   *
+   * @param aPresContext The nsPresContext whose refresh driver we want to
+   *        register with.
+   * @param aRequest A pointer to the imgIRequest object which the client wants
+   *        to register with the refresh driver.
+   * @param aRequestRegistered A pointer to a boolean value which indicates
+   *        whether the given image request is registered. If
+   *        *aRequestRegistered is true, then this request will not be
+   *        registered again. If the request is registered by this function,
+   *        then *aRequestRegistered will be set to true upon the completion of
+   *        this function.
+   *
+   */
+  static void RegisterImageRequest(nsPresContext* aPresContext,
+                                   imgIRequest* aRequest,
+                                   bool* aRequestRegistered);
+
+  /**
+   * Register an imgIRequest object with a refresh driver, but only if the
+   * request is for an image that is animated.
+   *
+   * @param aPresContext The nsPresContext whose refresh driver we want to
+   *        register with.
+   * @param aRequest A pointer to the imgIRequest object which the client wants
+   *        to register with the refresh driver.
+   * @param aRequestRegistered A pointer to a boolean value which indicates
+   *        whether the given image request is registered. If
+   *        *aRequestRegistered is true, then this request will not be
+   *        registered again. If the request is registered by this function,
+   *        then *aRequestRegistered will be set to true upon the completion of
+   *        this function.
+   *
+   */
+  static void RegisterImageRequestIfAnimated(nsPresContext* aPresContext,
+                                             imgIRequest* aRequest,
+                                             bool* aRequestRegistered);
+
+  /**
+   * Deregister an imgIRequest object from a refresh driver.
+   *
+   * @param aPresContext The nsPresContext whose refresh driver we want to
+   *        deregister from.
+   * @param aRequest A pointer to the imgIRequest object with which the client
+   *        previously registered and now wants to deregister from the refresh
+   *        driver.
+   * @param aRequestRegistered A pointer to a boolean value which indicates
+   *        whether the given image request is registered. If
+   *        *aRequestRegistered is false, then this request will not be
+   *        deregistered. If the request is deregistered by this function,
+   *        then *aRequestRegistered will be set to false upon the completion of
+   *        this function.
+   */
+  static void DeregisterImageRequest(nsPresContext* aPresContext,
+                                     imgIRequest* aRequest,
+                                     bool* aRequestRegistered);
+
 #ifdef DEBUG
   /**
    * Assert that there are no duplicate continuations of the same frame
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 86be91783759..6320f2a51ed5 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -6283,13 +6283,13 @@ IsFullScreenAndRestrictedKeyEvent(nsIContent* aTarget, const nsEvent* aEvent)
 
   // Bail out if the event is not a key event, or the target's document is
   // not in DOM full screen mode, or full-screen key input is not restricted.
-  nsIDocument *doc;
+  nsIDocument *root = nsnull;
   if (!aTarget ||
       (aEvent->message != NS_KEY_DOWN &&
       aEvent->message != NS_KEY_UP &&
       aEvent->message != NS_KEY_PRESS) ||
-      !(doc = aTarget->OwnerDoc()) ||
-      !doc->IsFullScreenDoc() ||
+      !(root = nsContentUtils::GetRootDocument(aTarget->OwnerDoc())) ||
+      !root->IsFullScreenDoc() ||
       !nsContentUtils::IsFullScreenKeyInputRestricted()) {
     return false;
   }
@@ -6368,9 +6368,10 @@ PresShell::HandleEventInternal(nsEvent* aEvent, nsIView *aView,
       case NS_KEY_UP: {
         nsIDocument *doc = mCurrentEventContent ?
                            mCurrentEventContent->OwnerDoc() : nsnull;
-        if (doc &&
-            doc->IsFullScreenDoc() &&
-            static_cast<const nsKeyEvent*>(aEvent)->keyCode == NS_VK_ESCAPE) {
+        nsIDocument* root = nsnull;
+        if (static_cast<const nsKeyEvent*>(aEvent)->keyCode == NS_VK_ESCAPE &&
+            (root = nsContentUtils::GetRootDocument(doc)) &&
+            root->IsFullScreenDoc()) {
           // Prevent default action on ESC key press when exiting
           // DOM full-screen mode. This prevents the browser ESC key
           // handler from stopping all loads in the document, which
@@ -6382,7 +6383,7 @@ PresShell::HandleEventInternal(nsEvent* aEvent, nsIView *aView,
            // ESC key released while in DOM full-screen mode.
            // Exit full-screen mode.
            NS_DispatchToCurrentThread(
-             NS_NewRunnableMethod(mCurrentEventContent->OwnerDoc(),
+             NS_NewRunnableMethod(root,
                                   &nsIDocument::CancelFullScreen));
           }
         } else if (IsFullScreenAndRestrictedKeyEvent(mCurrentEventContent, aEvent)) {
diff --git a/layout/base/nsRefreshDriver.cpp b/layout/base/nsRefreshDriver.cpp
index baa1cd797f7b..f7d403b1b8c2 100644
--- a/layout/base/nsRefreshDriver.cpp
+++ b/layout/base/nsRefreshDriver.cpp
@@ -114,6 +114,7 @@ nsRefreshDriver::nsRefreshDriver(nsPresContext *aPresContext)
     mTimerIsPrecise(false),
     mLastTimerInterval(0)
 {
+  mRequests.Init();
 }
 
 nsRefreshDriver::~nsRefreshDriver()
@@ -185,6 +186,29 @@ nsRefreshDriver::RemoveRefreshObserver(nsARefreshObserver *aObserver,
   return array.RemoveElement(aObserver);
 }
 
+bool
+nsRefreshDriver::AddImageRequest(imgIRequest* aRequest)
+{
+  if (!mRequests.PutEntry(aRequest)) {
+    return false;
+  }
+
+  EnsureTimerStarted(false);
+
+  return true;
+}
+
+void
+nsRefreshDriver::RemoveImageRequest(imgIRequest* aRequest)
+{
+  mRequests.RemoveEntry(aRequest);
+}
+
+void nsRefreshDriver::ClearAllImageRequests()
+{
+  mRequests.Clear();
+}
+
 void
 nsRefreshDriver::EnsureTimerStarted(bool aAdjustingTimer)
 {
@@ -238,6 +262,7 @@ nsRefreshDriver::ObserverCount() const
   for (PRUint32 i = 0; i < ArrayLength(mObservers); ++i) {
     sum += mObservers[i].Length();
   }
+
   // Even while throttled, we need to process layout and style changes.  Style
   // changes can trigger transitions which fire events when they complete, and
   // layout changes can affect media queries on child documents, triggering
@@ -249,6 +274,12 @@ nsRefreshDriver::ObserverCount() const
   return sum;
 }
 
+PRUint32
+nsRefreshDriver::ImageRequestCount() const
+{
+  return mRequests.Count();
+}
+
 void
 nsRefreshDriver::UpdateMostRecentRefresh()
 {
@@ -303,7 +334,7 @@ nsRefreshDriver::Notify(nsITimer *aTimer)
   UpdateMostRecentRefresh();
 
   nsCOMPtr<nsIPresShell> presShell = mPresContext->GetPresShell();
-  if (!presShell || ObserverCount() == 0) {
+  if (!presShell || (ObserverCount() == 0 && ImageRequestCount() == 0)) {
     // Things are being destroyed, or we no longer have any observers.
     // We don't want to stop the timer when observers are initially
     // removed, because sometimes observers can be added and removed
@@ -332,6 +363,7 @@ nsRefreshDriver::Notify(nsITimer *aTimer)
         return NS_OK;
       }
     }
+
     if (i == 0) {
       // Don't just loop while we have things in mBeforePaintTargets,
       // the whole point is that event handlers should readd the
@@ -404,6 +436,17 @@ nsRefreshDriver::Notify(nsITimer *aTimer)
     }
   }
 
+  /*
+   * Perform notification to imgIRequests subscribed to listen
+   * for refresh events.
+   */
+
+  ImageRequestParameters parms = {mMostRecentRefresh};
+  if (mRequests.Count()) {
+    mRequests.EnumerateEntries(nsRefreshDriver::ImageRequestEnumerator, &parms);
+    EnsureTimerStarted(false);
+  }
+
   if (mThrottled ||
       (mTimerIsPrecise !=
        (GetRefreshTimerType() == nsITimer::TYPE_REPEATING_PRECISE_CAN_SKIP))) {
@@ -424,6 +467,24 @@ nsRefreshDriver::Notify(nsITimer *aTimer)
   return NS_OK;
 }
 
+PLDHashOperator
+nsRefreshDriver::ImageRequestEnumerator(nsISupportsHashKey* aEntry,
+                                        void* aUserArg)
+{
+  ImageRequestParameters* parms =
+    static_cast<ImageRequestParameters*> (aUserArg);
+  mozilla::TimeStamp mostRecentRefresh = parms->ts;
+  imgIRequest* req = static_cast<imgIRequest*>(aEntry->GetKey());
+  NS_ABORT_IF_FALSE(req, "Unable to retrieve the image request");
+  nsCOMPtr<imgIContainer> image;
+  req->GetImage(getter_AddRefs(image));
+  if (image) {
+    image->RequestRefresh(mostRecentRefresh);
+  }
+
+  return PL_DHASH_NEXT;
+}
+
 void
 nsRefreshDriver::Freeze()
 {
@@ -437,7 +498,7 @@ nsRefreshDriver::Thaw()
 {
   NS_ASSERTION(mFrozen, "Thaw called on an unfrozen refresh driver");
   mFrozen = false;
-  if (ObserverCount()) {
+  if (ObserverCount() || ImageRequestCount()) {
     // FIXME: This isn't quite right, since our EnsureTimerStarted call
     // updates our mMostRecentRefresh, but the DoRefresh call won't run
     // and notify our observers until we get back to the event loop.
diff --git a/layout/base/nsRefreshDriver.h b/layout/base/nsRefreshDriver.h
index d458ccb7d5cf..3a1ac1966ff1 100644
--- a/layout/base/nsRefreshDriver.h
+++ b/layout/base/nsRefreshDriver.h
@@ -50,10 +50,13 @@
 #include "nsTObserverArray.h"
 #include "nsTArray.h"
 #include "nsAutoPtr.h"
+#include "nsTHashtable.h"
+#include "nsHashKeys.h"
 
 class nsPresContext;
 class nsIPresShell;
 class nsIDocument;
+class imgIRequest;
 
 /**
  * An abstract base class to be implemented by callers wanting to be
@@ -128,6 +131,24 @@ public:
   bool RemoveRefreshObserver(nsARefreshObserver *aObserver,
                                mozFlushType aFlushType);
 
+  /**
+   * Add/Remove imgIRequest versions of observers.
+   *
+   * These are used for hooking into the refresh driver for
+   * controlling animated images.
+   *
+   * @note The refresh driver owns a reference to these listeners.
+   *
+   * @note Technically, imgIRequest objects are not nsARefreshObservers, but
+   * for controlling animated image repaint events, we subscribe the
+   * imgIRequests to the nsRefreshDriver for notification of paint events.
+   *
+   * @returns whether the operation succeeded, or void in the case of removal.
+   */
+  bool AddImageRequest(imgIRequest* aRequest);
+  void RemoveImageRequest(imgIRequest* aRequest);
+  void ClearAllImageRequests();
+
   /**
    * Add / remove presshells that we should flush style and layout on
    */
@@ -218,10 +239,15 @@ public:
 
 private:
   typedef nsTObserverArray<nsARefreshObserver*> ObserverArray;
+  typedef nsTHashtable<nsISupportsHashKey> RequestTable;
 
   void EnsureTimerStarted(bool aAdjustingTimer);
   void StopTimer();
+
   PRUint32 ObserverCount() const;
+  PRUint32 ImageRequestCount() const;
+  static PLDHashOperator ImageRequestEnumerator(nsISupportsHashKey* aEntry,
+                                          void* aUserArg);
   void UpdateMostRecentRefresh();
   ObserverArray& ArrayFor(mozFlushType aFlushType);
   // Trigger a refresh immediately, if haven't been disconnected or frozen.
@@ -252,6 +278,8 @@ private:
 
   // separate arrays for each flush type we support
   ObserverArray mObservers[3];
+  RequestTable mRequests;
+
   nsAutoTArray<nsIPresShell*, 16> mStyleFlushObservers;
   nsAutoTArray<nsIPresShell*, 16> mLayoutFlushObservers;
   // nsTArray on purpose, because we want to be able to swap.
@@ -262,6 +290,11 @@ private:
   // This is the last interval we used for our timer.  May be 0 if we
   // haven't computed a timer interval yet.
   mutable PRInt32 mLastTimerInterval;
+
+  // Helper struct for processing image requests
+  struct ImageRequestParameters {
+      mozilla::TimeStamp ts;
+  };
 };
 
 #endif /* !defined(nsRefreshDriver_h_) */
diff --git a/layout/base/tests/chrome/printpreview_bug396024_helper.xul b/layout/base/tests/chrome/printpreview_bug396024_helper.xul
index bfb6bcdf98eb..8fe2609f5bf8 100644
--- a/layout/base/tests/chrome/printpreview_bug396024_helper.xul
+++ b/layout/base/tests/chrome/printpreview_bug396024_helper.xul
@@ -20,7 +20,7 @@ function printpreview() {
   gWbp = window.frames[1].QueryInterface(Components.interfaces.nsIInterfaceRequestor)
              .getInterface(Components.interfaces.nsIWebBrowserPrint);
   var listener = {
-    onLocationChange: function(webProgress, request, location) { },
+    onLocationChange: function(webProgress, request, location, flags) { },
     onProgressChange: function(webProgress, request, curSelfProgress, 
                                maxSelfProgress, curTotalProgress,
                                maxTotalProgress) { },
diff --git a/layout/base/tests/chrome/printpreview_bug482976_helper.xul b/layout/base/tests/chrome/printpreview_bug482976_helper.xul
index 01b26f093283..34c2d658ec74 100644
--- a/layout/base/tests/chrome/printpreview_bug482976_helper.xul
+++ b/layout/base/tests/chrome/printpreview_bug482976_helper.xul
@@ -20,7 +20,7 @@ function printpreview() {
   gWbp = window.frames[1].QueryInterface(Components.interfaces.nsIInterfaceRequestor)
              .getInterface(Components.interfaces.nsIWebBrowserPrint);
   var listener = {
-    onLocationChange: function(webProgress, request, location) { },
+    onLocationChange: function(webProgress, request, location, flags) { },
     onProgressChange: function(webProgress, request, curSelfProgress, 
                                maxSelfProgress, curTotalProgress,
                                maxTotalProgress) { },
diff --git a/layout/base/tests/chrome/printpreview_helper.xul b/layout/base/tests/chrome/printpreview_helper.xul
index 0d5716d20ae8..3ad11f5bc31a 100644
--- a/layout/base/tests/chrome/printpreview_helper.xul
+++ b/layout/base/tests/chrome/printpreview_helper.xul
@@ -27,7 +27,7 @@ function printpreview() {
   gWbp = window.frames[1].QueryInterface(Components.interfaces.nsIInterfaceRequestor)
              .getInterface(Components.interfaces.nsIWebBrowserPrint);
   var listener = {
-    onLocationChange: function(webProgress, request, location) { },
+    onLocationChange: function(webProgress, request, location, flags) { },
     onProgressChange: function(webProgress, request, curSelfProgress, 
                                maxSelfProgress, curTotalProgress,
                                maxTotalProgress) { },
diff --git a/layout/build/nsLayoutCID.h b/layout/build/nsLayoutCID.h
index af09a6cf2732..14b162918e4a 100644
--- a/layout/build/nsLayoutCID.h
+++ b/layout/build/nsLayoutCID.h
@@ -115,10 +115,6 @@
 #define NS_DOMSTORAGEMANAGER_CID               \
 { 0xb88a4712, 0xeb52, 0x4c10, { 0x9b, 0x85, 0xbf, 0x58, 0x94, 0xb5, 0x10, 0xf0 } }
 
-// {14632191-AC21-4BDF-83E7-2363AD17E838}
-#define NS_XULPOPUPMANAGER_CID \
-{ 0x14632191, 0xac21, 0x4bdf, { 0x83, 0xe7, 0x23, 0x63, 0xad, 0x17, 0xe8, 0x38 } }
-
 // {93ad72a6-02cd-4716-9626-d47d5ec275ec}
 #define NS_DOMJSON_CID \
 { 0x93ad72a6, 0x02cd, 0x4716, { 0x96, 0x26, 0xd4, 0x7d, 0x5e, 0xc2, 0x75, 0xec } }
diff --git a/layout/build/nsLayoutModule.cpp b/layout/build/nsLayoutModule.cpp
index e47fa05f6cab..335710728b15 100644
--- a/layout/build/nsLayoutModule.cpp
+++ b/layout/build/nsLayoutModule.cpp
@@ -86,7 +86,6 @@
 #include "nsIFrameTraversal.h"
 #include "nsLayoutCID.h"
 #include "nsStyleSheetService.h"
-#include "nsXULPopupManager.h"
 #include "nsFocusManager.h"
 #include "ThirdPartyUtil.h"
 #include "mozilla/Services.h"
@@ -148,7 +147,7 @@ using mozilla::dom::indexedDB::IndexedDatabaseManager;
 #include "nsNullPrincipal.h"
 #include "nsNetCID.h"
 #include "nsINodeInfo.h"
-#if defined(ANDROID) || defined(MOZ_PLATFORM_MAEMO)
+#if defined(MOZ_WIDGET_ANDROID) || defined(MOZ_PLATFORM_MAEMO)
 #include "nsHapticFeedback.h"
 #endif
 
@@ -277,12 +276,14 @@ static void Shutdown();
 #endif
 
 #include "nsGeolocation.h"
+#ifndef MOZ_WIDGET_GONK
 #if defined(XP_UNIX)    || \
     defined(_WINDOWS)   || \
     defined(machintosh) || \
     defined(android)
 #include "nsDeviceMotionSystem.h"
 #endif
+#endif
 #include "nsCSPService.h"
 
 // Transformiix
@@ -310,16 +311,18 @@ NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(nsDOMStorageManager,
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsChannelPolicy)
 NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(IndexedDatabaseManager,
                                          IndexedDatabaseManager::FactoryCreate)
+#ifndef MOZ_WIDGET_GONK
 #if defined(XP_UNIX)    || \
     defined(_WINDOWS)   || \
     defined(machintosh) || \
     defined(android)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsDeviceMotionSystem)
 #endif
-NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(ThirdPartyUtil, Init)
 #if defined(ANDROID) || defined(MOZ_PLATFORM_MAEMO)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsHapticFeedback)
 #endif
+#endif
+NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(ThirdPartyUtil, Init)
 
 //-----------------------------------------------------------------------------
 
@@ -534,7 +537,6 @@ MAKE_CTOR(CreateXULSortService,           nsIXULSortService,           NS_NewXUL
 // NS_NewXULTreeBuilder
 MAKE_CTOR(CreateXULDocument,              nsIXULDocument,              NS_NewXULDocument)
 // NS_NewXULControllers
-MAKE_CTOR(CreateXULPopupManager,      nsISupports,      NS_NewXULPopupManager)
 #endif
 #ifdef MOZ_XTF
 MAKE_CTOR(CreateXTFService,               nsIXTFService,               NS_NewXTFService)
@@ -776,7 +778,6 @@ NS_DEFINE_NAMED_CID(NS_XULCONTROLLERS_CID);
 NS_DEFINE_NAMED_CID(NS_XULSORTSERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_XULTEMPLATEBUILDER_CID);
 NS_DEFINE_NAMED_CID(NS_XULTREEBUILDER_CID);
-NS_DEFINE_NAMED_CID(NS_XULPOPUPMANAGER_CID);
 NS_DEFINE_NAMED_CID(NS_XULDOCUMENT_CID);
 #endif
 #ifdef MOZ_XTF
@@ -839,6 +840,7 @@ NS_DEFINE_NAMED_CID(NS_SECURITYNAMESET_CID);
 NS_DEFINE_NAMED_CID(THIRDPARTYUTIL_CID);
 NS_DEFINE_NAMED_CID(NS_STRUCTUREDCLONECONTAINER_CID);
 
+#ifndef MOZ_WIDGET_GONK
 #if defined(XP_UNIX)    || \
     defined(_WINDOWS)   || \
     defined(machintosh) || \
@@ -848,6 +850,7 @@ NS_DEFINE_NAMED_CID(NS_DEVICE_MOTION_CID);
 #if defined(ANDROID) || defined(MOZ_PLATFORM_MAEMO)
 NS_DEFINE_NAMED_CID(NS_HAPTICFEEDBACK_CID);
 #endif
+#endif
 
 static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
   XPCONNECT_CIDENTRIES
@@ -909,7 +912,6 @@ static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
   { &kNS_XULSORTSERVICE_CID, false, NULL, CreateXULSortService },
   { &kNS_XULTEMPLATEBUILDER_CID, false, NULL, NS_NewXULContentBuilder },
   { &kNS_XULTREEBUILDER_CID, false, NULL, NS_NewXULTreeBuilder },
-  { &kNS_XULPOPUPMANAGER_CID, false, NULL, CreateXULPopupManager },
   { &kNS_XULDOCUMENT_CID, false, NULL, CreateXULDocument },
 #endif
 #ifdef MOZ_XTF
@@ -969,6 +971,7 @@ static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
   { &kNS_SYSTEMPRINCIPAL_CID, false, NULL, nsSystemPrincipalConstructor },
   { &kNS_NULLPRINCIPAL_CID, false, NULL, nsNullPrincipalConstructor },
   { &kNS_SECURITYNAMESET_CID, false, NULL, nsSecurityNameSetConstructor },
+#ifndef MOZ_WIDGET_GONK
 #if defined(XP_UNIX)    || \
     defined(_WINDOWS)   || \
     defined(machintosh) || \
@@ -977,6 +980,7 @@ static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
 #endif
 #if defined(ANDROID) || defined(MOZ_PLATFORM_MAEMO)
   { &kNS_HAPTICFEEDBACK_CID, false, NULL, nsHapticFeedbackConstructor },
+#endif
 #endif
   { &kTHIRDPARTYUTIL_CID, false, NULL, ThirdPartyUtilConstructor },
   { &kNS_STRUCTUREDCLONECONTAINER_CID, false, NULL, nsStructuredCloneContainerConstructor },
@@ -1044,7 +1048,6 @@ static const mozilla::Module::ContractIDEntry kLayoutContracts[] = {
   { "@mozilla.org/xul/xul-sort-service;1", &kNS_XULSORTSERVICE_CID },
   { "@mozilla.org/xul/xul-template-builder;1", &kNS_XULTEMPLATEBUILDER_CID },
   { "@mozilla.org/xul/xul-tree-builder;1", &kNS_XULTREEBUILDER_CID },
-  { "@mozilla.org/xul/xul-popup-manager;1", &kNS_XULPOPUPMANAGER_CID },
   { "@mozilla.org/xul/xul-document;1", &kNS_XULDOCUMENT_CID },
 #endif
 #ifdef MOZ_XTF
@@ -1097,6 +1100,7 @@ static const mozilla::Module::ContractIDEntry kLayoutContracts[] = {
   { NS_SYSTEMPRINCIPAL_CONTRACTID, &kNS_SYSTEMPRINCIPAL_CID },
   { NS_NULLPRINCIPAL_CONTRACTID, &kNS_NULLPRINCIPAL_CID },
   { NS_SECURITYNAMESET_CONTRACTID, &kNS_SECURITYNAMESET_CID },
+#ifndef MOZ_WIDGET_GONK
 #if defined(XP_UNIX)    || \
     defined(_WINDOWS)   || \
     defined(machintosh) || \
@@ -1105,6 +1109,7 @@ static const mozilla::Module::ContractIDEntry kLayoutContracts[] = {
 #endif
 #if defined(ANDROID) || defined(MOZ_PLATFORM_MAEMO)
   { "@mozilla.org/widget/hapticfeedback;1", &kNS_HAPTICFEEDBACK_CID },
+#endif
 #endif
   { THIRDPARTYUTIL_CONTRACTID, &kTHIRDPARTYUTIL_CID },
   { NS_STRUCTUREDCLONECONTAINER_CONTRACTID, &kNS_STRUCTUREDCLONECONTAINER_CID },
diff --git a/layout/forms/nsComboboxControlFrame.cpp b/layout/forms/nsComboboxControlFrame.cpp
index 0a5cb0e57d27..cc28013a492b 100644
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -473,7 +473,7 @@ nsComboboxControlFrame::ShowList(bool aShowList)
     if (view) {
       nsIWidget* widget = view->GetWidget();
       if (widget) {
-        widget->CaptureRollupEvents(this, nsnull, mDroppedDown, mDroppedDown);
+        widget->CaptureRollupEvents(this, mDroppedDown, mDroppedDown);
 
         if (!aShowList) {
           nsCOMPtr<nsIRunnable> widgetDestroyer =
@@ -1322,7 +1322,7 @@ nsComboboxControlFrame::DestroyFrom(nsIFrame* aDestructRoot)
       if (view) {
         nsIWidget* widget = view->GetWidget();
         if (widget)
-          widget->CaptureRollupEvents(this, nsnull, false, true);
+          widget->CaptureRollupEvents(this, false, true);
       }
     }
   }
@@ -1375,24 +1375,21 @@ nsComboboxControlFrame::SetInitialChildList(ChildListID     aListID,
 //----------------------------------------------------------------------
   //nsIRollupListener
 //----------------------------------------------------------------------
-NS_IMETHODIMP 
-nsComboboxControlFrame::Rollup(PRUint32 aCount,
-                               nsIContent** aLastRolledUp)
+nsIContent*
+nsComboboxControlFrame::Rollup(PRUint32 aCount, bool aGetLastRolledUp)
 {
-  if (aLastRolledUp)
-    *aLastRolledUp = nsnull;
-
   if (mDroppedDown) {
     nsWeakFrame weakFrame(this);
     mListControlFrame->AboutToRollup(); // might destroy us
     if (!weakFrame.IsAlive())
-      return NS_OK;
+      return nsnull;
     ShowDropDown(false); // might destroy us
     if (!weakFrame.IsAlive())
-      return NS_OK;
+      return nsnull;
     mListControlFrame->CaptureMouseEvents(false);
   }
-  return NS_OK;
+
+  return nsnull;
 }
 
 void
diff --git a/layout/forms/nsComboboxControlFrame.h b/layout/forms/nsComboboxControlFrame.h
index 39dc1b34460a..ea412a8a4fc1 100644
--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@@ -192,20 +192,24 @@ public:
    * Hide the dropdown menu and stop capturing mouse events.
    * @note This method might destroy |this|.
    */
-  NS_IMETHOD Rollup(PRUint32 aCount, nsIContent** aLastRolledUp);
+  virtual nsIContent* Rollup(PRUint32 aCount, bool aGetLastRolledUp = false);
+
   /**
    * A combobox should roll up if a mousewheel event happens outside of
    * the popup area.
    */
-  NS_IMETHOD ShouldRollupOnMouseWheelEvent(bool *aShouldRollup)
-    { *aShouldRollup = true; return NS_OK;}
+  virtual bool ShouldRollupOnMouseWheelEvent()
+    { return true; }
 
   /**
    * A combobox should not roll up if activated by a mouse activate message
    * (eg. X-mouse).
    */
-  NS_IMETHOD ShouldRollupOnMouseActivate(bool *aShouldRollup)
-    { *aShouldRollup = false; return NS_OK;}
+  virtual bool ShouldRollupOnMouseActivate()
+    { return false; }
+
+  virtual PRUint32 GetSubmenuWidgetChain(nsTArray<nsIWidget*> *aWidgetChain)
+    { return 0; }
 
   //nsIStatefulFrame
   NS_IMETHOD SaveState(SpecialStateID aStateID, nsPresState** aState);
diff --git a/layout/generic/crashtests/683712.html b/layout/generic/crashtests/683712.html
new file mode 100644
index 000000000000..1aaa4c2fd084
--- /dev/null
+++ b/layout/generic/crashtests/683712.html
@@ -0,0 +1,9 @@
+<!-- Quirks mode on purpose -->
+<svg>
+  <foreignObject>
+    <div>
+      <div style="height: 100%"></div>
+    </div>
+  </foreignObject>
+</svg>
+  
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index 7be438ed9341..35b39c9b0112 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -381,3 +381,4 @@ load 682649-1.html
 load 683702-1.xhtml
 load 688996-1.html
 load 688996-2.html
+load 683712.html
diff --git a/layout/generic/nsBulletFrame.cpp b/layout/generic/nsBulletFrame.cpp
index eb3cc0137b09..442dcc42dfff 100644
--- a/layout/generic/nsBulletFrame.cpp
+++ b/layout/generic/nsBulletFrame.cpp
@@ -80,6 +80,8 @@ public:
                              const nsIntRect *aRect);
   NS_IMETHOD OnStopDecode(imgIRequest *aRequest, nsresult status,
                           const PRUnichar *statusArg);
+  NS_IMETHOD OnImageIsAnimated(imgIRequest *aRequest);
+
   // imgIContainerObserver (override nsStubImageDecoderObserver)
   NS_IMETHOD FrameChanged(imgIContainer *aContainer,
                           const nsIntRect *dirtyRect);
@@ -101,6 +103,10 @@ nsBulletFrame::DestroyFrom(nsIFrame* aDestructRoot)
 {
   // Stop image loading first
   if (mImageRequest) {
+    // Deregister our image request from the refresh driver
+    nsLayoutUtils::DeregisterImageRequest(PresContext(),
+                                          mImageRequest,
+                                          &mRequestRegistered);
     mImageRequest->CancelAndForgetObserver(NS_ERROR_FAILURE);
     mImageRequest = nsnull;
   }
@@ -170,6 +176,8 @@ nsBulletFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
         if (same) {
           needNewRequest = false;
         } else {
+          nsLayoutUtils::DeregisterImageRequest(PresContext(), mImageRequest,
+                                                &mRequestRegistered);
           mImageRequest->Cancel(NS_ERROR_FAILURE);
           mImageRequest = nsnull;
         }
@@ -178,10 +186,18 @@ nsBulletFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 
     if (needNewRequest) {
       newRequest->Clone(mListener, getter_AddRefs(mImageRequest));
+      if (mImageRequest) {
+        nsLayoutUtils::RegisterImageRequestIfAnimated(PresContext(),
+                                                      mImageRequest,
+                                                      &mRequestRegistered);
+      }
     }
   } else {
     // No image request on the new style context
     if (mImageRequest) {
+      nsLayoutUtils::DeregisterImageRequest(PresContext(), mImageRequest,
+                                            &mRequestRegistered);
+
       mImageRequest->Cancel(NS_ERROR_FAILURE);
       mImageRequest = nsnull;
     }
@@ -1540,6 +1556,18 @@ NS_IMETHODIMP nsBulletFrame::OnStopDecode(imgIRequest *aRequest,
   return NS_OK;
 }
 
+NS_IMETHODIMP nsBulletFrame::OnImageIsAnimated(imgIRequest* aRequest)
+{
+  // Register the image request with the refresh driver now that we know it's
+  // animated.
+  if (aRequest == mImageRequest) {
+    nsLayoutUtils::RegisterImageRequest(PresContext(), mImageRequest,
+                                        &mRequestRegistered);
+  }
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP nsBulletFrame::FrameChanged(imgIContainer *aContainer,
                                           const nsIntRect *aDirtyRect)
 {
@@ -1634,7 +1662,7 @@ NS_IMETHODIMP nsBulletListener::OnDataAvailable(imgIRequest *aRequest,
                                                 const nsIntRect *aRect)
 {
   if (!mFrame)
-    return NS_ERROR_FAILURE;
+    return NS_OK;
 
   return mFrame->OnDataAvailable(aRequest, aCurrentFrame, aRect);
 }
@@ -1644,16 +1672,24 @@ NS_IMETHODIMP nsBulletListener::OnStopDecode(imgIRequest *aRequest,
                                              const PRUnichar *statusArg)
 {
   if (!mFrame)
-    return NS_ERROR_FAILURE;
+    return NS_OK;
   
   return mFrame->OnStopDecode(aRequest, status, statusArg);
 }
 
+NS_IMETHODIMP nsBulletListener::OnImageIsAnimated(imgIRequest *aRequest)
+{
+  if (!mFrame)
+    return NS_OK;
+
+  return mFrame->OnImageIsAnimated(aRequest);
+}
+
 NS_IMETHODIMP nsBulletListener::FrameChanged(imgIContainer *aContainer,
                                              const nsIntRect *aDirtyRect)
 {
   if (!mFrame)
-    return NS_ERROR_FAILURE;
+    return NS_OK;
 
   return mFrame->FrameChanged(aContainer, aDirtyRect);
 }
diff --git a/layout/generic/nsBulletFrame.h b/layout/generic/nsBulletFrame.h
index 2b73fad9c712..8f67fa115358 100644
--- a/layout/generic/nsBulletFrame.h
+++ b/layout/generic/nsBulletFrame.h
@@ -87,6 +87,7 @@ public:
   NS_IMETHOD OnStopDecode(imgIRequest *aRequest,
                           nsresult aStatus,
                           const PRUnichar *aStatusArg);
+  NS_IMETHOD OnImageIsAnimated(imgIRequest *aRequest);
   NS_IMETHOD FrameChanged(imgIContainer *aContainer,
                           const nsIntRect *aDirtyRect);
 
@@ -121,6 +122,12 @@ protected:
   nsSize mComputedSize;
   PRInt32 mOrdinal;
   bool mTextIsRTL;
+
+private:
+
+  // This is a boolean flag indicating whether or not the current image request
+  // has been registered with the refresh driver.
+  bool mRequestRegistered;
 };
 
 #endif /* nsBulletFrame_h___ */
diff --git a/layout/generic/nsFloatManager.h b/layout/generic/nsFloatManager.h
index 9b897c95b759..88ed01752084 100644
--- a/layout/generic/nsFloatManager.h
+++ b/layout/generic/nsFloatManager.h
@@ -42,6 +42,8 @@
 #ifndef nsFloatManager_h_
 #define nsFloatManager_h_
 
+#include "mozilla/Types.h"
+
 #include "nsIntervalSet.h"
 #include "nsCoord.h"
 #include "nsRect.h"
@@ -344,8 +346,8 @@ private:
   static PRInt32 sCachedFloatManagerCount;
   static void* sCachedFloatManagers[NS_FLOAT_MANAGER_CACHE_SIZE];
 
-  nsFloatManager(const nsFloatManager&);  // no implementation
-  void operator=(const nsFloatManager&);  // no implementation
+  nsFloatManager(const nsFloatManager&) MOZ_DELETE;
+  void operator=(const nsFloatManager&) MOZ_DELETE;
 };
 
 /**
diff --git a/layout/generic/nsHTMLReflowState.cpp b/layout/generic/nsHTMLReflowState.cpp
index 1aa9822f17da..58d22c684a34 100644
--- a/layout/generic/nsHTMLReflowState.cpp
+++ b/layout/generic/nsHTMLReflowState.cpp
@@ -1513,6 +1513,7 @@ CalcQuirkContainingBlockHeight(const nsHTMLReflowState* aCBReflowState)
     }
     // if we got to the html frame (a block child of the canvas) ...
     else if (nsGkAtoms::blockFrame == frameType &&
+             rs->parentReflowState &&
              nsGkAtoms::canvasFrame ==
                rs->parentReflowState->frame->GetType()) {
       // ... then subtract out margin/border/padding for the BODY element
diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
index 759f463afeac..470b21aab8df 100644
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -579,6 +579,10 @@ protected:
   /**
    * Implements Destroy(). Do not call this directly except from within a
    * DestroyFrom() implementation.
+   *
+   * @note This will always be called, so it is not necessary to override
+   *       Destroy() in subclasses of nsFrame, just DestroyFrom().
+   *
    * @param  aDestructRoot is the root of the subtree being destroyed
    */
   virtual void DestroyFrom(nsIFrame* aDestructRoot) = 0;
diff --git a/layout/generic/nsImageFrame.cpp b/layout/generic/nsImageFrame.cpp
index b34d4f0f023a..d709c3e2813b 100644
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -231,6 +231,10 @@ nsImageFrame::DestroyFrom(nsIFrame* aDestructRoot)
       nsCxPusher pusher;
       pusher.PushNull();
 
+      // Notify our image loading content that we are going away so it can
+      // deregister with our refresh driver.
+      imageLoader->FrameDestroyed(this);
+
       imageLoader->RemoveObserver(mListener);
     }
     
@@ -276,6 +280,10 @@ nsImageFrame::Init(nsIContent*      aContent,
   if (!gIconLoad)
     LoadIcons(aPresContext);
 
+  // We have a PresContext now, so we need to notify the image content node
+  // that it can register images.
+  imageLoader->FrameCreated(this);
+
   // Give image loads associated with an image frame a small priority boost!
   nsCOMPtr<imgIRequest> currentRequest;
   imageLoader->GetRequest(nsIImageLoadingContent::CURRENT_REQUEST,
@@ -550,7 +558,6 @@ nsImageFrame::OnStartContainer(imgIRequest *aRequest, imgIContainer *aImage)
    */
   nsPresContext *presContext = PresContext();
   aImage->SetAnimationMode(presContext->ImageAnimationMode());
-  mImageContainer = nsnull;
 
   if (IsPendingLoad(aRequest)) {
     // We don't care
@@ -614,7 +621,6 @@ nsImageFrame::OnDataAvailable(imgIRequest *aRequest,
          r.x, r.y, r.width, r.height);
 #endif
 
-  mImageContainer = nsnull;
   Invalidate(r);
   
   return NS_OK;
@@ -628,7 +634,6 @@ nsImageFrame::OnStopDecode(imgIRequest *aRequest,
   nsPresContext *presContext = PresContext();
   nsIPresShell *presShell = presContext->GetPresShell();
   NS_ASSERTION(presShell, "No PresShell.");
-  mImageContainer = nsnull;
 
   // Check what request type we're dealing with
   nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
@@ -695,7 +700,6 @@ nsImageFrame::FrameChanged(imgIContainer *aContainer,
 
   // Update border+content to account for image change
   Invalidate(r);
-  mImageContainer = nsnull;
   return NS_OK;
 }
 
@@ -1213,7 +1217,10 @@ nsDisplayImage::GetImage()
 nsRefPtr<ImageContainer>
 nsDisplayImage::GetContainer(LayerManager* aManager)
 {
-  return static_cast<nsImageFrame*>(mFrame)->GetContainer(aManager, mImage);
+  ImageContainer* container;
+  nsresult rv = mImage->GetImageContainer(aManager, &container);
+  NS_ENSURE_SUCCESS(rv, NULL);
+  return container;
 }
 
 void
@@ -1242,44 +1249,6 @@ nsDisplayImage::ConfigureLayer(ImageLayer* aLayer)
   aLayer->SetVisibleRegion(nsIntRect(0, 0, imageWidth, imageHeight));
 }
 
-nsRefPtr<ImageContainer>
-nsImageFrame::GetContainer(LayerManager* aManager, imgIContainer* aImage)
-{
-  if (mImageContainer && 
-      (mImageContainer->Manager() == aManager || 
-       (!mImageContainer->Manager() && 
-        (mImageContainer->GetBackendType() == aManager->GetBackendType())))) {
-    return mImageContainer;
-  }
-
-  if (aImage->GetType() != imgIContainer::TYPE_RASTER) {
-    return nsnull;
-  }
-  
-  CairoImage::Data cairoData;
-  nsRefPtr<gfxASurface> imageSurface;
-  aImage->GetFrame(imgIContainer::FRAME_CURRENT,
-                   imgIContainer::FLAG_SYNC_DECODE,
-                   getter_AddRefs(imageSurface));
-  cairoData.mSurface = imageSurface;
-  aImage->GetWidth(&cairoData.mSize.width);
-  aImage->GetHeight(&cairoData.mSize.height);
-
-  mImageContainer = aManager->CreateImageContainer();
-  NS_ASSERTION(mImageContainer, "Failed to create ImageContainer!");
-  
-  // Now create a CairoImage to display the surface.
-  Image::Format cairoFormat = Image::CAIRO_SURFACE;
-  nsRefPtr<Image> image = mImageContainer->CreateImage(&cairoFormat, 1);
-  NS_ASSERTION(image, "Failed to create Image");
-
-  NS_ASSERTION(image->GetFormat() == cairoFormat, "Wrong format");
-  static_cast<CairoImage*>(image.get())->SetData(cairoData);
-  mImageContainer->SetCurrentImage(image);
-
-  return mImageContainer;
-}
-
 void
 nsImageFrame::PaintImage(nsRenderingContext& aRenderingContext, nsPoint aPt,
                          const nsRect& aDirtyRect, imgIContainer* aImage,
@@ -1992,6 +1961,12 @@ nsImageFrame::IconLoad::OnStopDecode(imgIRequest *aRequest,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsImageFrame::IconLoad::OnImageIsAnimated(imgIRequest *aRequest)
+{
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsImageFrame::IconLoad::OnStopRequest(imgIRequest *aRequest,
                                       bool aIsLastPart)
diff --git a/layout/generic/nsImageFrame.h b/layout/generic/nsImageFrame.h
index 815207a84e8e..b6bc5c63e794 100644
--- a/layout/generic/nsImageFrame.h
+++ b/layout/generic/nsImageFrame.h
@@ -187,9 +187,6 @@ public:
   virtual void AddInlineMinWidth(nsRenderingContext *aRenderingContext,
                                  InlineMinWidthData *aData);
 
-  nsRefPtr<ImageContainer> GetContainer(LayerManager* aManager,
-                                        imgIContainer* aImage);
-
   void DisconnectMap();
 protected:
   virtual ~nsImageFrame();
@@ -307,8 +304,6 @@ private:
 
   static nsIIOService* sIOService;
   
-  nsRefPtr<ImageContainer> mImageContainer; 
-
   /* loading / broken image icon support */
 
   // XXXbz this should be handled by the prescontext, I think; that
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index d449d4f8d724..45afede876cd 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -1705,7 +1705,7 @@ nsObjectFrame::PaintPlugin(nsDisplayListBuilder* aBuilder,
                            nsRenderingContext& aRenderingContext,
                            const nsRect& aDirtyRect, const nsRect& aPluginRect)
 {
-#if defined(ANDROID)
+#if defined(MOZ_WIDGET_ANDROID)
   if (mInstanceOwner) {
     NPWindow *window;
     mInstanceOwner->GetWindow(window);
diff --git a/layout/generic/nsSelection.cpp b/layout/generic/nsSelection.cpp
index ef2238724440..812058f9dcc9 100644
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -3055,7 +3055,7 @@ nsIContent*
 nsFrameSelection::IsInSameTable(nsIContent  *aContent1,
                                 nsIContent  *aContent2) const
 {
-  if (!aContent1 || !aContent2) return false;
+  if (!aContent1 || !aContent2) return nsnull;
   
   nsIContent* tableNode1 = GetParentTable(aContent1);
   nsIContent* tableNode2 = GetParentTable(aContent2);
diff --git a/layout/inspector/src/Makefile.in b/layout/inspector/src/Makefile.in
index 1043be4dafb2..0fc910ae263f 100644
--- a/layout/inspector/src/Makefile.in
+++ b/layout/inspector/src/Makefile.in
@@ -69,8 +69,6 @@ CPPSRCS += \
 endif
 
 FORCE_STATIC_LIB = 1
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC = 1
 
 LOCAL_INCLUDES	+= \
 		-I$(srcdir)/../../style \
diff --git a/layout/reftests/font-face/font-redirect.html b/layout/reftests/font-face/font-redirect.html
new file mode 100644
index 000000000000..5341d07419f6
--- /dev/null
+++ b/layout/reftests/font-face/font-redirect.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"
+	"http://www.w3.org/TR/html4/strict.dtd">
+<html lang="en-US">
+<head>
+	<title></title>
+	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+	<style type="text/css">
+
+	@font-face {
+		font-family: "MarkA";
+		src: url(../fonts/markA-redirect.ttf);
+	}
+
+	body { font-family: "MarkA"; }
+
+	</style>
+</head>
+<body>
+
+<p>ABC</p>
+
+</body>
+</html>
diff --git a/layout/reftests/font-face/reftest.list b/layout/reftests/font-face/reftest.list
index 2a40a56e195e..1b5bde6232bb 100644
--- a/layout/reftests/font-face/reftest.list
+++ b/layout/reftests/font-face/reftest.list
@@ -138,3 +138,6 @@ HTTP(..) == missing-names.html missing-names-ref.html
 HTTP(..) == font-error-404-1.html font-error-404-1-ref.html # HTTP status 404, don't load
 HTTP(..) == font-error-404-2.html font-error-404-2-ref.html # HTTP status 200, load
 HTTP(..) != font-error-404-1.html font-error-404-2.html # sanity-check that the results differ
+
+# Font load redirection
+HTTP(..) == font-redirect.html order-1-ref.html
diff --git a/layout/reftests/fonts/markA-redirect.ttf b/layout/reftests/fonts/markA-redirect.ttf
new file mode 100644
index 000000000000..4eb90b4aca04
--- /dev/null
+++ b/layout/reftests/fonts/markA-redirect.ttf
@@ -0,0 +1 @@
+This is not a font!
\ No newline at end of file
diff --git a/layout/reftests/fonts/markA-redirect.ttf^headers^ b/layout/reftests/fonts/markA-redirect.ttf^headers^
new file mode 100644
index 000000000000..f3f0f6a01fd1
--- /dev/null
+++ b/layout/reftests/fonts/markA-redirect.ttf^headers^
@@ -0,0 +1,2 @@
+HTTP 301 Moved Permanently
+Location: markA.ttf
diff --git a/layout/reftests/svg/as-image/img-blobBuilder-1.html b/layout/reftests/svg/as-image/img-blobBuilder-1.html
new file mode 100644
index 000000000000..572eed811edf
--- /dev/null
+++ b/layout/reftests/svg/as-image/img-blobBuilder-1.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<!-- This test checks to be sure we can render SVG-as-an-image
+     from a MozBlobBuilder-generated 'moz-filedata' URI. -->
+<html class="reftest-wait">
+<head>
+  <script>
+    function go() {
+      // Generate a moz-filedata URL encoding of an SVG document
+      var filedataURL = generateMozFiledataURL();
+
+      // Tell our img element to render the URL
+      var img = document.getElementsByTagName("img")[0]
+      img.src = filedataURL;
+
+      // Once our img loads, take reftest snapshot.
+      img.addEventListener("load", function() {
+        document.documentElement.removeAttribute("class");
+      });
+    }
+
+    // Helper function -- returns a moz-filedata URL representing a
+    // 100x100 fully-lime SVG document.
+    function generateMozFiledataURL() {
+      var blobBuilder = new self.MozBlobBuilder;
+      var svg =
+        '<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">' +
+          '<rect height="100%" width="100%" fill="lime"/>' +
+        '</svg>';
+      blobBuilder.append(svg);
+      return self.URL.createObjectURL(blobBuilder.getBlob("image/svg+xml"));
+    }
+  </script>
+</head>
+<body onload="go()">
+  <img src="">
+</body>
+</html>
diff --git a/layout/reftests/svg/as-image/img-blobBuilder-2.html b/layout/reftests/svg/as-image/img-blobBuilder-2.html
new file mode 100644
index 000000000000..3d0690881e63
--- /dev/null
+++ b/layout/reftests/svg/as-image/img-blobBuilder-2.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<!-- This test checks to be sure we allow MozBlobBuilder-generated
+     'moz-filedata' URIs *inside of* SVG-as-an-image. -->
+<html class="reftest-wait">
+<head>
+  <script>
+    function go() {
+      // Generate a moz-filedata URL encoding of an SVG document
+      var filedataURL = generateMozFiledataURL();
+
+      // Now generate a data URI, containing our moz-filedata URI
+      var outerSVG =
+        '<svg xmlns="http://www.w3.org/2000/svg" ' +
+             'xmlns:xlink="http://www.w3.org/1999/xlink" ' +
+             'width="100" height="100">' +
+          '<image height="100" width="100" ' +
+             'xlink:href="' + filedataURL + '"/>' +
+        '</svg>';
+
+      // Tell our img element to render the URL
+      var img = document.getElementsByTagName("img")[0]
+      img.src = "data:image/svg+xml," + outerSVG;
+
+      // Once our img loads, take reftest snapshot.
+      img.addEventListener("load", function() {
+        document.documentElement.removeAttribute("class");
+      });
+    }
+
+    // Helper function -- returns a moz-filedata URL representing a
+    // 100x100 fully-lime SVG document.
+    function generateMozFiledataURL() {
+      var blobBuilder = new self.MozBlobBuilder;
+      var svg =
+        '<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">' +
+          '<rect height="100%" width="100%" fill="lime"/>' +
+        '</svg>';
+      blobBuilder.append(svg);
+      return self.URL.createObjectURL(blobBuilder.getBlob("image/svg+xml"));
+    }
+  </script>
+</head>
+<body onload="go()">
+  <img src="">
+</body>
+</html>
diff --git a/layout/reftests/svg/as-image/img-foreignObject-embed-1-helper.svg b/layout/reftests/svg/as-image/img-foreignObject-embed-1-helper.svg
index 9288e07185ba..e7f93d241c8f 100644
--- a/layout/reftests/svg/as-image/img-foreignObject-embed-1-helper.svg
+++ b/layout/reftests/svg/as-image/img-foreignObject-embed-1-helper.svg
@@ -1,13 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg">
   <foreignObject x="0" y="0" width="100px" height="100px">
+
     <!-- lime background -->
     <div xmlns="http://www.w3.org/1999/xhtml"
-         style="background:lime; width:100%; height:100%;"/>
-
-    <!-- embedded iframe, whose contents shouldn't be shown and whose
-         scripts shouldn't be run, when we're being viewed as an image -->
-    <iframe xmlns="http://www.w3.org/1999/xhtml"
-            style="width:80px; height:80px; border: 0"
-            src="data:text/html,%3Chtml%3E%3Cbody%20style%3D%22background-color%3A%20red%22%3Eiframe%20contents%3Cscript%3Ealert(%22script%20shouldn't%20be%20running!!%22)%3C%2Fscript%3E%3C%2Fbody%3E%3C%2Fhtml%3E"/>
+         style="background:lime; width:100%; height:100%;">
+      <!-- Use an unrecognized media type, so that if we're honoring plugins,
+           the "download plugin" placeholder will be shown. -->
+      <embed xmlns="http://www.w3.org/1999/xhtml"
+             src="data:audio/hahaThisIsntReallyAFormat,"
+             width="100px" height="50px"/>
+      <!-- Also try a possibly-recognized media format, for completeness. -->
+      <embed xmlns="http://www.w3.org/1999/xhtml"
+             src="data:audio/wav,"
+             width="100px" height="50px"/>
+    </div>
   </foreignObject>
 </svg>
diff --git a/layout/reftests/svg/as-image/img-foreignObject-embed-2-helper.svg b/layout/reftests/svg/as-image/img-foreignObject-embed-2-helper.svg
deleted file mode 100644
index e7f93d241c8f..000000000000
--- a/layout/reftests/svg/as-image/img-foreignObject-embed-2-helper.svg
+++ /dev/null
@@ -1,18 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg">
-  <foreignObject x="0" y="0" width="100px" height="100px">
-
-    <!-- lime background -->
-    <div xmlns="http://www.w3.org/1999/xhtml"
-         style="background:lime; width:100%; height:100%;">
-      <!-- Use an unrecognized media type, so that if we're honoring plugins,
-           the "download plugin" placeholder will be shown. -->
-      <embed xmlns="http://www.w3.org/1999/xhtml"
-             src="data:audio/hahaThisIsntReallyAFormat,"
-             width="100px" height="50px"/>
-      <!-- Also try a possibly-recognized media format, for completeness. -->
-      <embed xmlns="http://www.w3.org/1999/xhtml"
-             src="data:audio/wav,"
-             width="100px" height="50px"/>
-    </div>
-  </foreignObject>
-</svg>
diff --git a/layout/reftests/svg/as-image/img-foreignObject-embed-2.html b/layout/reftests/svg/as-image/img-foreignObject-embed-2.html
deleted file mode 100644
index f60dbd01489e..000000000000
--- a/layout/reftests/svg/as-image/img-foreignObject-embed-2.html
+++ /dev/null
@@ -1,5 +0,0 @@
-<html>
-<body>
-  <img src="img-foreignObject-embed-2-helper.svg" height="100px" width="100px">
-</body>
-</html>
diff --git a/layout/reftests/svg/as-image/img-foreignObject-iframe-1a-helper.svg b/layout/reftests/svg/as-image/img-foreignObject-iframe-1a-helper.svg
new file mode 100644
index 000000000000..e60fa172ae8d
--- /dev/null
+++ b/layout/reftests/svg/as-image/img-foreignObject-iframe-1a-helper.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <foreignObject x="0" y="0" width="100px" height="100px">
+    <!-- lime background -->
+    <div xmlns="http://www.w3.org/1999/xhtml"
+         style="background:lime; width:100%; height:100%;">
+
+      <!-- embedded iframe, whose contents shouldn't be shown and whose
+           scripts shouldn't be run, when we're being viewed as an image -->
+      <iframe xmlns="http://www.w3.org/1999/xhtml"
+              style="width:80px; height:80px; border: 0"
+              src="data:text/html,%3Chtml%3E%3Cbody%20style%3D%22background-color%3A%20red%22%3Eiframe%20contents%3Cscript%3Ealert(%22script%20shouldn't%20be%20running!!%22)%3C%2Fscript%3E%3C%2Fbody%3E%3C%2Fhtml%3E"/>
+    </div>
+  </foreignObject>
+</svg>
diff --git a/layout/reftests/svg/as-image/img-foreignObject-iframe-1a.html b/layout/reftests/svg/as-image/img-foreignObject-iframe-1a.html
new file mode 100644
index 000000000000..2840a1b2277d
--- /dev/null
+++ b/layout/reftests/svg/as-image/img-foreignObject-iframe-1a.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+  <img src="img-foreignObject-iframe-1a-helper.svg" height="100px" width="100px">
+</body>
+</html>
diff --git a/layout/reftests/svg/as-image/img-foreignObject-iframe-1b-helper.svg b/layout/reftests/svg/as-image/img-foreignObject-iframe-1b-helper.svg
new file mode 100644
index 000000000000..5bc57390d770
--- /dev/null
+++ b/layout/reftests/svg/as-image/img-foreignObject-iframe-1b-helper.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <foreignObject x="0" y="0" width="100px" height="100px">
+    <!-- lime background -->
+    <div xmlns="http://www.w3.org/1999/xhtml"
+         style="background:lime; width:100%; height:100%;">
+
+      <!-- embedded iframe, whose contents shouldn't be shown, when we're
+           being viewed as an image -->
+      <iframe xmlns="http://www.w3.org/1999/xhtml"
+              style="width:80px; height:80px; border: 0"
+              src="data:text/html,%3Chtml%3E%3Cbody%20style%3D%22background-color%3A%20red%22%3Eiframe%20contents%3C%2Fbody%3E%3C%2Fhtml%3E"/>
+    </div>
+  </foreignObject>
+</svg>
diff --git a/layout/reftests/svg/as-image/img-foreignObject-iframe-1b.html b/layout/reftests/svg/as-image/img-foreignObject-iframe-1b.html
new file mode 100644
index 000000000000..3ee04d4a72b9
--- /dev/null
+++ b/layout/reftests/svg/as-image/img-foreignObject-iframe-1b.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+  <img src="img-foreignObject-iframe-1b-helper.svg" height="100px" width="100px">
+</body>
+</html>
diff --git a/layout/reftests/svg/as-image/reftest.list b/layout/reftests/svg/as-image/reftest.list
index 54fc3ad92665..c82bbc713ce4 100644
--- a/layout/reftests/svg/as-image/reftest.list
+++ b/layout/reftests/svg/as-image/reftest.list
@@ -55,11 +55,24 @@ fails == canvas-drawImage-slice-1b.html lime100x100-ref.html # XXX all edges fuz
 random == img-and-image-1.html img-and-image-1-ref.svg # bug 645267
 
 # More complex <img> tests
+== img-blobBuilder-1.html lime100x100-ref.html
+== img-blobBuilder-2.html lime100x100-ref.html
 == img-content-outside-viewBox-1.html img-content-outside-viewBox-1-ref.html
 == img-dyn-1.html img-dyn-1-ref.html
 == img-foreignObject-1.html lime100x100-ref.html
-== img-foreignObject-embed-1.html lime100x100-ref.html
-== img-foreignObject-embed-2.html lime100x100-ref.html
+
+# The following tests check that content embedded via <iframe> and <embed>
+# doesn't load (or execute scripts) in SVG-as-an-image.
+# The "!=" lines are to test that the SVG content, when viewed directly (not as
+# an image), does actually render its external content (making it look
+# different from the reference case).  We don't do that check for
+# img-foreignObject-iframe-1a.html, though, because its SVG image tries to
+# alert(), and that'd trigger a reftest timeout if we loaded that file directly.
+== img-foreignObject-embed-1.html         lime100x100-ref.html
+!= img-foreignObject-embed-1-helper.svg   lime100x100-ref.html
+== img-foreignObject-iframe-1a.html       lime100x100-ref.html
+== img-foreignObject-iframe-1b.html       lime100x100-ref.html
+!= img-foreignObject-iframe-1b-helper.svg lime100x100-ref.html
 
 == img-widthAndHeight-meet-1.html  img-widthAndHeight-meet-1-ref.html
 == img-widthAndHeight-meet-2.html  img-widthAndHeight-meet-2-ref.html
@@ -109,11 +122,11 @@ random == img-and-image-1.html img-and-image-1-ref.svg # bug 645267
 # tests for external resources vs. data URIs in SVG as an image
 == svg-image-datauri-1.html            lime100x100.svg
 HTTP == svg-image-datauri-1.html       lime100x100.svg
-fails-if(Android) == svg-image-external-1.html           lime100x100.svg
+== svg-image-external-1.html           blue100x100.svg
 HTTP == svg-image-external-1.html      blue100x100.svg
 == svg-stylesheet-datauri-1.html       lime100x100.svg
 HTTP == svg-stylesheet-datauri-1.html  lime100x100.svg
-random == svg-stylesheet-external-1.html      lime100x100.svg # see bug 629885 comment 9
+== svg-stylesheet-external-1.html      blue100x100.svg
 HTTP == svg-stylesheet-external-1.html blue100x100.svg
 
 # test that :visited status is ignored in image documents
diff --git a/layout/style/Loader.cpp b/layout/style/Loader.cpp
index 964217685a4e..cc0c47c3d786 100644
--- a/layout/style/Loader.cpp
+++ b/layout/style/Loader.cpp
@@ -1093,7 +1093,10 @@ Loader::CreateSheet(nsIURI* aURI,
                     nsIContent* aLinkingContent,
                     nsIPrincipal* aLoaderPrincipal,
                     bool aSyncLoad,
+                    bool aHasAlternateRel,
+                    const nsAString& aTitle,                       
                     StyleSheetState& aSheetState,
+                    bool *aIsAlternate,
                     nsCSSStyleSheet** aSheet)
 {
   LOG(("css::Loader::CreateSheet"));
@@ -1108,6 +1111,10 @@ Loader::CreateSheet(nsIURI* aURI,
   *aSheet = nsnull;
   aSheetState = eSheetStateUnknown;
 
+  // Check the alternate state before doing anything else, because it
+  // can mess with our hashtables.
+  *aIsAlternate = IsAlternate(aTitle, aHasAlternateRel);
+
   if (aURI) {
     aSheetState = eSheetComplete;
     nsRefPtr<nsCSSStyleSheet> sheet;
@@ -1241,8 +1248,7 @@ Loader::PrepareSheet(nsCSSStyleSheet* aSheet,
                      const nsSubstring& aTitle,
                      const nsSubstring& aMediaString,
                      nsMediaList* aMediaList,
-                     bool aHasAlternateRel,
-                     bool *aIsAlternate)
+                     bool isAlternate)
 {
   NS_PRECONDITION(aSheet, "Must have a sheet!");
 
@@ -1267,11 +1273,7 @@ Loader::PrepareSheet(nsCSSStyleSheet* aSheet,
   aSheet->SetMedia(mediaList);
 
   aSheet->SetTitle(aTitle);
-  bool alternate = IsAlternate(aTitle, aHasAlternateRel);
-  aSheet->SetEnabled(! alternate);
-  if (aIsAlternate) {
-    *aIsAlternate = alternate;
-  }
+  aSheet->SetEnabled(! isAlternate);
   return NS_OK;
 }
 
@@ -1839,18 +1841,17 @@ Loader::LoadInlineStyle(nsIContent* aElement,
   // load data or to CreateSheet().
   StyleSheetState state;
   nsRefPtr<nsCSSStyleSheet> sheet;
-  nsresult rv = CreateSheet(nsnull, aElement, nsnull, false, state,
-                            getter_AddRefs(sheet));
+  nsresult rv = CreateSheet(nsnull, aElement, nsnull, false, false,
+                            aTitle, state, aIsAlternate, getter_AddRefs(sheet));
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ASSERTION(state == eSheetNeedsParser,
                "Inline sheets should not be cached");
 
-  rv = PrepareSheet(sheet, aTitle, aMedia, nsnull, false,
-                    aIsAlternate);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   LOG(("  Sheet is alternate: %d", *aIsAlternate));
 
+  rv = PrepareSheet(sheet, aTitle, aMedia, nsnull, *aIsAlternate);
+  NS_ENSURE_SUCCESS(rv, rv);
+
   rv = InsertSheetInDoc(sheet, aElement, mDocument);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1913,16 +1914,15 @@ Loader::LoadStyleLink(nsIContent* aElement,
 
   StyleSheetState state;
   nsRefPtr<nsCSSStyleSheet> sheet;
-  rv = CreateSheet(aURL, aElement, principal, false, state,
-                   getter_AddRefs(sheet));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  rv = PrepareSheet(sheet, aTitle, aMedia, nsnull, aHasAlternateRel,
-                    aIsAlternate);
+  rv = CreateSheet(aURL, aElement, principal, false, aHasAlternateRel,
+                   aTitle, state, aIsAlternate, getter_AddRefs(sheet));
   NS_ENSURE_SUCCESS(rv, rv);
 
   LOG(("  Sheet is alternate: %d", *aIsAlternate));
 
+  rv = PrepareSheet(sheet, aTitle, aMedia, nsnull, *aIsAlternate);
+  NS_ENSURE_SUCCESS(rv, rv);
+
   rv = InsertSheetInDoc(sheet, aElement, mDocument);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -2070,14 +2070,15 @@ Loader::LoadChildSheet(nsCSSStyleSheet* aParentSheet,
   // Now that we know it's safe to load this (passes security check and not a
   // loop) do so
   nsRefPtr<nsCSSStyleSheet> sheet;
+  bool isAlternate;
   StyleSheetState state;
+  const nsSubstring& empty = EmptyString();
   rv = CreateSheet(aURL, nsnull, principal,
                    parentData ? parentData->mSyncLoad : false,
-                   state, getter_AddRefs(sheet));
+                   false, empty, state, &isAlternate, getter_AddRefs(sheet));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  const nsSubstring& empty = EmptyString();
-  rv = PrepareSheet(sheet, empty, empty, aMedia);
+  rv = PrepareSheet(sheet, empty, empty, aMedia, isAlternate);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = InsertChildSheet(sheet, aParentSheet, aParentRule);
@@ -2177,15 +2178,16 @@ Loader::InternalLoadNonDocumentSheet(nsIURI* aURL,
   }
 
   StyleSheetState state;
+  bool isAlternate;
   nsRefPtr<nsCSSStyleSheet> sheet;
   bool syncLoad = (aObserver == nsnull);
+  const nsSubstring& empty = EmptyString();
 
-  rv = CreateSheet(aURL, nsnull, aOriginPrincipal, syncLoad, state,
-                   getter_AddRefs(sheet));
+  rv = CreateSheet(aURL, nsnull, aOriginPrincipal, syncLoad, false, empty,
+                   state, &isAlternate, getter_AddRefs(sheet));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  const nsSubstring& empty = EmptyString();
-  rv = PrepareSheet(sheet, empty, empty, nsnull);
+  rv = PrepareSheet(sheet, empty, empty, nsnull, isAlternate);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (state == eSheetComplete) {
diff --git a/layout/style/Loader.h b/layout/style/Loader.h
index 71a83bf50f22..31ee5e8b5880 100644
--- a/layout/style/Loader.h
+++ b/layout/style/Loader.h
@@ -384,23 +384,25 @@ private:
   // For inline style, the aURI param is null, but the aLinkingContent
   // must be non-null then.  The loader principal must never be null
   // if aURI is not null.
+  // *aIsAlternate is set based on aTitle and aHasAlternateRel.
   nsresult CreateSheet(nsIURI* aURI,
                        nsIContent* aLinkingContent,
                        nsIPrincipal* aLoaderPrincipal,
                        bool aSyncLoad,
+                       bool aHasAlternateRel,
+                       const nsAString& aTitle,
                        StyleSheetState& aSheetState,
+                       bool *aIsAlternate,
                        nsCSSStyleSheet** aSheet);
 
   // Pass in either a media string or the nsMediaList from the
   // CSSParser.  Don't pass both.
-  // If aIsAlternate is non-null, this method will set *aIsAlternate to
-  // correspond to the sheet's enabled state (which it will set no matter what)
+  // This method will set the sheet's enabled state based on isAlternate
   nsresult PrepareSheet(nsCSSStyleSheet* aSheet,
                         const nsAString& aTitle,
                         const nsAString& aMediaString,
                         nsMediaList* aMediaList,
-                        bool aHasAlternateRel = false,
-                        bool *aIsAlternate = nsnull);
+                        bool isAlternate);
 
   nsresult InsertSheetInDoc(nsCSSStyleSheet* aSheet,
                             nsIContent* aLinkingContent,
diff --git a/layout/style/crashtests/700116.html b/layout/style/crashtests/700116.html
new file mode 100644
index 000000000000..de35ce702966
--- /dev/null
+++ b/layout/style/crashtests/700116.html
@@ -0,0 +1,5 @@
+<head>
+  <script>
+    document.write('<link rel="stylesheet" href="#"><link rel="alternate stylesheet" title="x" href="data:text/css,"><link rel="stylesheet" title="x" href="data:text/css,">');
+  </script>
+</head>
diff --git a/layout/style/crashtests/crashtests.list b/layout/style/crashtests/crashtests.list
index be9766ac4c99..72f2f2e613e3 100644
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -74,3 +74,4 @@ asserts(2) load 671799-1.html
 asserts(2) load 671799-2.html
 load 690990-1.html
 load 696188-1.html
+load 700116.html
diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp
index a612913db263..f29d357cd005 100644
--- a/layout/style/nsCSSRuleProcessor.cpp
+++ b/layout/style/nsCSSRuleProcessor.cpp
@@ -1249,8 +1249,6 @@ nsCSSRuleProcessor::GetWindowsThemeIdentifier()
 nsEventStates
 nsCSSRuleProcessor::GetContentState(Element* aElement)
 {
-  // FIXME: RequestLinkStateUpdate is a hack; see bug 660959.
-  aElement->RequestLinkStateUpdate();
   nsEventStates state = aElement->State();
 
   // If we are not supposed to mark visited links as such, be sure to
@@ -1271,8 +1269,6 @@ nsCSSRuleProcessor::GetContentState(Element* aElement)
 bool
 nsCSSRuleProcessor::IsLink(Element* aElement)
 {
-  // FIXME: RequestLinkStateUpdate is a hack; see bug 660959.
-  aElement->RequestLinkStateUpdate();
   nsEventStates state = aElement->State();
   return state.HasAtLeastOneOfStates(NS_EVENT_STATE_VISITED | NS_EVENT_STATE_UNVISITED);
 }
diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
index af3dd8f29c36..5363e010fbe8 100644
--- a/layout/style/nsComputedDOMStyle.cpp
+++ b/layout/style/nsComputedDOMStyle.cpp
@@ -447,6 +447,7 @@ nsComputedDOMStyle::GetPropertyCSSValue(const nsAString& aPropertyName,
 
   nsCOMPtr<nsIDocument> document = do_QueryReferent(mDocumentWeak);
   NS_ENSURE_TRUE(document, NS_ERROR_NOT_AVAILABLE);
+  document->FlushPendingLinkUpdates();
 
   nsCSSProperty prop = nsCSSProps::LookupProperty(aPropertyName);
 
diff --git a/layout/style/nsFontFaceLoader.cpp b/layout/style/nsFontFaceLoader.cpp
index d2add2628ded..db32efd4bf66 100644
--- a/layout/style/nsFontFaceLoader.cpp
+++ b/layout/style/nsFontFaceLoader.cpp
@@ -221,7 +221,10 @@ nsFontFaceLoader::OnStreamComplete(nsIStreamLoader* aLoader,
     // because HTTP responses such as 404 (Not Found) will still result in
     // a success code and potentially an HTML error page from the server
     // as the resulting data. We don't want to use that as a font.
-    nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(mChannel);
+    nsCOMPtr<nsIRequest> request;
+    nsCOMPtr<nsIHttpChannel> httpChannel;
+    aLoader->GetRequest(getter_AddRefs(request));
+    httpChannel = do_QueryInterface(request);
     if (httpChannel) {
       bool succeeded;
       nsresult rv = httpChannel->GetRequestSucceeded(&succeeded);
diff --git a/layout/svg/base/src/nsSVGForeignObjectFrame.cpp b/layout/svg/base/src/nsSVGForeignObjectFrame.cpp
index 57af49aee328..5b5852560bfb 100644
--- a/layout/svg/base/src/nsSVGForeignObjectFrame.cpp
+++ b/layout/svg/base/src/nsSVGForeignObjectFrame.cpp
@@ -436,9 +436,6 @@ gfxRect
 nsSVGForeignObjectFrame::GetBBoxContribution(const gfxMatrix &aToBBoxUserspace,
                                              PRUint32 aFlags)
 {
-  NS_ASSERTION(!(GetStateBits() & NS_STATE_SVG_NONDISPLAY_CHILD),
-               "Should not be calling this on a non-display child");
-
   nsSVGForeignObjectElement *content =
     static_cast<nsSVGForeignObjectElement*>(mContent);
 
diff --git a/layout/svg/base/src/nsSVGGeometryFrame.cpp b/layout/svg/base/src/nsSVGGeometryFrame.cpp
index 53d130335b63..c40254f66c1a 100644
--- a/layout/svg/base/src/nsSVGGeometryFrame.cpp
+++ b/layout/svg/base/src/nsSVGGeometryFrame.cpp
@@ -120,7 +120,8 @@ nsSVGGeometryFrame::GetStrokeDashArray(gfxFloat **aDashes, PRUint32 *aCount)
     gfxFloat pathScale = 1.0;
 
     if (mContent->Tag() == nsGkAtoms::path) {
-      pathScale = static_cast<nsSVGPathElement*>(mContent)->GetScale();
+      pathScale =
+        static_cast<nsSVGPathElement*>(mContent)->GetPathLengthScale();
       if (pathScale <= 0) {
         return NS_OK;
       }
diff --git a/layout/svg/base/src/nsSVGGlyphFrame.cpp b/layout/svg/base/src/nsSVGGlyphFrame.cpp
index f661a3c16a67..bc75a44b90fe 100644
--- a/layout/svg/base/src/nsSVGGlyphFrame.cpp
+++ b/layout/svg/base/src/nsSVGGlyphFrame.cpp
@@ -751,7 +751,7 @@ nsSVGGlyphFrame::GetCharacterPositions(nsTArray<CharacterPosition>* aCharacterPo
     if (!aCharacterPositions->SetLength(strLength))
       return false;
 
-    gfxFloat pathScale = textPath->GetPathScale();
+    gfxFloat pathScale = textPath->GetOffsetScale();
 
     CharacterPosition *cp = aCharacterPositions->Elements();
 
@@ -877,7 +877,7 @@ nsSVGGlyphFrame::GetSubStringAdvance(PRUint32 aCharnum,
     gfxFloat pathScale = 1.0;
     nsSVGTextPathFrame *textPath = FindTextPathParent();
     if (textPath)
-      pathScale = textPath->GetPathScale();
+      pathScale = textPath->GetOffsetScale();
     if (dxcount > aFragmentChars) 
       dxcount = aFragmentChars;
     for (PRUint32 i = aCharnum; i < dxcount; i++) {
@@ -1101,7 +1101,7 @@ nsSVGGlyphFrame::SetGlyphPosition(gfxPoint *aPosition, bool aForceGlobalTransfor
 
   gfxFloat pathScale = 1.0;
   if (textPath)
-    pathScale = textPath->GetPathScale();
+    pathScale = textPath->GetOffsetScale();
 
   nsTArray<float> dxList, dyList;
   GetEffectiveDxDy(strLength, dxList, dyList);
diff --git a/layout/svg/base/src/nsSVGImageFrame.cpp b/layout/svg/base/src/nsSVGImageFrame.cpp
index 2fbe8340afb2..2f679f3a7213 100644
--- a/layout/svg/base/src/nsSVGImageFrame.cpp
+++ b/layout/svg/base/src/nsSVGImageFrame.cpp
@@ -103,6 +103,7 @@ public:
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
+  virtual void DestroyFrom(nsIFrame* aDestructRoot);
 
   /**
    * Get the "type" of the frame
@@ -179,6 +180,10 @@ nsSVGImageFrame::Init(nsIContent* aContent,
   nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
   NS_ENSURE_TRUE(imageLoader, NS_ERROR_UNEXPECTED);
 
+  // We should have a PresContext now, so let's notify our image loader that
+  // we need to register any image animations with the refresh driver.
+  imageLoader->FrameCreated(this);
+
   // Push a null JSContext on the stack so that code that runs within
   // the below code doesn't think it's being called by JS. See bug
   // 604262.
@@ -190,6 +195,19 @@ nsSVGImageFrame::Init(nsIContent* aContent,
   return NS_OK; 
 }
 
+/* virtual */ void
+nsSVGImageFrame::DestroyFrom(nsIFrame* aDestructRoot)
+{
+  nsCOMPtr<nsIImageLoadingContent> imageLoader =
+    do_QueryInterface(nsFrame::mContent);
+
+  if (imageLoader) {
+    imageLoader->FrameDestroyed(this);
+  }
+
+  nsFrame::DestroyFrom(aDestructRoot);
+}
+
 //----------------------------------------------------------------------
 // nsIFrame methods:
 
diff --git a/layout/svg/base/src/nsSVGLeafFrame.cpp b/layout/svg/base/src/nsSVGLeafFrame.cpp
index 9716bd29acbf..387e83a26497 100644
--- a/layout/svg/base/src/nsSVGLeafFrame.cpp
+++ b/layout/svg/base/src/nsSVGLeafFrame.cpp
@@ -36,6 +36,7 @@
 
 #include "nsFrame.h"
 #include "nsSVGEffects.h"
+#include "nsImageLoadingContent.h"
 
 class nsSVGLeafFrame : public nsFrame
 {
@@ -47,6 +48,12 @@ protected:
 public:
   NS_DECL_FRAMEARENA_HELPERS
 
+  NS_IMETHOD Init(nsIContent*      aContent,
+                  nsIFrame*        aParent,
+                  nsIFrame*        asPrevInFlow);
+
+  virtual void DestroyFrom(nsIFrame* aDestructRoot);
+
   virtual bool IsFrameOfType(PRUint32 aFlags) const
   {
     return nsFrame::IsFrameOfType(aFlags & ~(nsIFrame::eSVG));
@@ -70,6 +77,33 @@ NS_NewSVGLeafFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 
 NS_IMPL_FRAMEARENA_HELPERS(nsSVGLeafFrame)
 
+NS_IMETHODIMP
+nsSVGLeafFrame::Init(nsIContent* aContent, nsIFrame* aParent, nsIFrame* asPrevInFlow)
+{
+  nsFrame::Init(aContent, aParent, asPrevInFlow);
+  nsCOMPtr<nsIImageLoadingContent> imageLoader =
+    do_QueryInterface(nsFrame::mContent);
+
+  if (imageLoader) {
+    imageLoader->FrameCreated(this);
+  }
+
+  return NS_OK;
+}
+
+/* virtual */ void
+nsSVGLeafFrame::DestroyFrom(nsIFrame* aDestructRoot)
+{
+  nsCOMPtr<nsIImageLoadingContent> imageLoader =
+    do_QueryInterface(nsFrame::mContent);
+
+  if (imageLoader) {
+    imageLoader->FrameDestroyed(this);
+  }
+
+  nsFrame::DestroyFrom(aDestructRoot);
+}
+
 /* virtual */ void
 nsSVGLeafFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 {
diff --git a/layout/svg/base/src/nsSVGMarkerFrame.cpp b/layout/svg/base/src/nsSVGMarkerFrame.cpp
index d05670cc2f2f..9235963467d7 100644
--- a/layout/svg/base/src/nsSVGMarkerFrame.cpp
+++ b/layout/svg/base/src/nsSVGMarkerFrame.cpp
@@ -175,37 +175,6 @@ nsSVGMarkerFrame::PaintMark(nsSVGRenderState *aContext,
   return NS_OK;
 }
 
-
-nsRect
-nsSVGMarkerFrame::RegionMark(nsSVGPathGeometryFrame *aMarkedFrame,
-                             const nsSVGMark *aMark, float aStrokeWidth)
-{
-  // If the flag is set when we get here, it means this marker frame
-  // has already been used in calculating the current mark region, and
-  // the document has a marker reference loop.
-  if (mInUse)
-    return nsRect(0,0,0,0);
-
-  AutoMarkerReferencer markerRef(this, aMarkedFrame);
-
-  mStrokeWidth = aStrokeWidth;
-  mX = aMark->x;
-  mY = aMark->y;
-  mAutoAngle = aMark->angle;
-
-  // Force children to update their covered region
-  for (nsIFrame* kid = mFrames.FirstChild();
-       kid;
-       kid = kid->GetNextSibling()) {
-    nsISVGChildFrame* child = do_QueryFrame(kid);
-    if (child)
-      child->UpdateCoveredRegion();
-  }
-
-  // Now get the combined covered region
-  return nsSVGUtils::GetCoveredRegion(mFrames);
-}
-
 gfxRect
 nsSVGMarkerFrame::GetMarkBBoxContribution(const gfxMatrix &aToBBoxUserspace,
                                           PRUint32 aFlags,
diff --git a/layout/svg/base/src/nsSVGMarkerFrame.h b/layout/svg/base/src/nsSVGMarkerFrame.h
index 48e8f046f7ad..5cfbab47d98e 100644
--- a/layout/svg/base/src/nsSVGMarkerFrame.h
+++ b/layout/svg/base/src/nsSVGMarkerFrame.h
@@ -92,9 +92,6 @@ public:
                      nsSVGMark *aMark,
                      float aStrokeWidth);
 
-  nsRect RegionMark(nsSVGPathGeometryFrame *aMarkedFrame,
-                    const nsSVGMark *aMark, float aStrokeWidth);
-
   gfxRect GetMarkBBoxContribution(const gfxMatrix &aToBBoxUserspace,
                                   PRUint32 aFlags,
                                   nsSVGPathGeometryFrame *aMarkedFrame,
diff --git a/layout/svg/base/src/nsSVGTextPathFrame.cpp b/layout/svg/base/src/nsSVGTextPathFrame.cpp
index e5649d8b7eb8..eaf00e108418 100644
--- a/layout/svg/base/src/nsSVGTextPathFrame.cpp
+++ b/layout/svg/base/src/nsSVGTextPathFrame.cpp
@@ -166,17 +166,18 @@ nsSVGTextPathFrame::GetStartOffset()
     nsRefPtr<gfxFlattenedPath> data = GetFlattenedPath();
     return data ? (val * data->GetLength() / 100.0) : 0.0;
   }
-  return val * GetPathScale();
+  return val * GetOffsetScale();
 }
 
 gfxFloat
-nsSVGTextPathFrame::GetPathScale() 
+nsSVGTextPathFrame::GetOffsetScale()
 {
   nsIFrame *pathFrame = GetPathFrame();
   if (!pathFrame)
     return 1.0;
 
-  return static_cast<nsSVGPathElement*>(pathFrame->GetContent())->GetScale();
+  return static_cast<nsSVGPathElement*>(pathFrame->GetContent())->
+    GetPathLengthScale();
 }
 
 //----------------------------------------------------------------------
diff --git a/layout/svg/base/src/nsSVGTextPathFrame.h b/layout/svg/base/src/nsSVGTextPathFrame.h
index 992817aebe13..94ce2ae51e7a 100644
--- a/layout/svg/base/src/nsSVGTextPathFrame.h
+++ b/layout/svg/base/src/nsSVGTextPathFrame.h
@@ -84,8 +84,20 @@ public:
   already_AddRefed<gfxFlattenedPath> GetFlattenedPath();
   nsIFrame *GetPathFrame();
 
+  /**
+   * Gets the scale by which offsets along this textPath must be scaled. This
+   * scaling is due to the user provided 'pathLength' attribute on the <path>
+   * element, which is a user provided estimate of the path length.
+   */
+  gfxFloat GetOffsetScale();
+
+  /**
+   * Gets the offset from the start of the path at which the first character
+   * should be positioned. The value returned already takes GetOffsetScale
+   * into account.
+   */
   gfxFloat GetStartOffset();
-  gfxFloat GetPathScale();
+
 protected:
 
   virtual void GetXY(SVGUserUnitList *aX, SVGUserUnitList *aY);
diff --git a/layout/svg/crashtests/693424-1.svg b/layout/svg/crashtests/693424-1.svg
new file mode 100644
index 000000000000..8485f6b617dd
--- /dev/null
+++ b/layout/svg/crashtests/693424-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <marker id="m">
+    <foreignObject/>
+  </marker>
+  <line marker-end="url(#m)"/>
+</svg>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
index a6e3876e7978..2c2a29d70e80 100644
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -118,3 +118,4 @@ load 669025-2.svg
 load 682411-1.svg
 load 692203-1.svg
 load 692203-2.svg
+load 693424-1.svg
diff --git a/layout/tools/layout-debug/ui/content/layoutdebug.js b/layout/tools/layout-debug/ui/content/layoutdebug.js
index 0965a9e18ca7..a8ab730164fd 100644
--- a/layout/tools/layout-debug/ui/content/layoutdebug.js
+++ b/layout/tools/layout-debug/ui/content/layoutdebug.js
@@ -105,7 +105,7 @@ nsLDBBrowserContentListener.prototype = {
     {
     },
 
-  onLocationChange : function(aWebProgress, aRequest, aLocation)
+  onLocationChange : function(aWebProgress, aRequest, aLocation, aFlags)
     {
       this.mURLBar.value = aLocation.spec;
       this.setButtonEnabled(this.mForwardButton, gBrowser.canGoForward);
diff --git a/layout/tools/reftest/Makefile.in b/layout/tools/reftest/Makefile.in
index 7d589259262f..94b0ddba4a26 100644
--- a/layout/tools/reftest/Makefile.in
+++ b/layout/tools/reftest/Makefile.in
@@ -84,7 +84,6 @@ _HARNESS_FILES = \
   $(topsrcdir)/build/mobile/devicemanagerADB.py \
   $(topsrcdir)/build/mobile/devicemanagerSUT.py \
   $(topsrcdir)/build/automationutils.py \
-  $(topsrcdir)/build/poster.zip \
   $(topsrcdir)/build/mobile/remoteautomation.py \
   $(topsrcdir)/testing/mochitest/server.js \
   $(topsrcdir)/build/pgo/server-locations.txt \
diff --git a/layout/xul/base/public/nsXULPopupManager.h b/layout/xul/base/public/nsXULPopupManager.h
index ed4768c42723..c69e75a01698 100644
--- a/layout/xul/base/public/nsXULPopupManager.h
+++ b/layout/xul/base/public/nsXULPopupManager.h
@@ -45,7 +45,6 @@
 #include "nsGUIEvent.h"
 #include "nsIContent.h"
 #include "nsIRollupListener.h"
-#include "nsIMenuRollup.h"
 #include "nsIDOMEventListener.h"
 #include "nsPoint.h"
 #include "nsCOMPtr.h"
@@ -302,7 +301,6 @@ private:
 };
 
 class nsXULPopupManager : public nsIDOMEventListener,
-                          public nsIMenuRollup,
                           public nsIRollupListener,
                           public nsITimerCallback,
                           public nsIObserver
@@ -319,12 +317,10 @@ public:
   NS_DECL_NSIDOMEVENTLISTENER
 
   // nsIRollupListener
-  NS_IMETHOD Rollup(PRUint32 aCount, nsIContent **aContent);
-  NS_IMETHOD ShouldRollupOnMouseWheelEvent(bool *aShould);
-  NS_IMETHOD ShouldRollupOnMouseActivate(bool *aShould);
-
+  virtual nsIContent* Rollup(PRUint32 aCount, bool aGetLastRolledUp = false);
+  virtual bool ShouldRollupOnMouseWheelEvent();
+  virtual bool ShouldRollupOnMouseActivate();
   virtual PRUint32 GetSubmenuWidgetChain(nsTArray<nsIWidget*> *aWidgetChain);
-  virtual void AdjustPopupsOnWindowChange(nsPIDOMWindow* aWindow);
 
   static nsXULPopupManager* sInstance;
 
@@ -336,6 +332,8 @@ public:
   // if a popup manager could not be allocated
   static nsXULPopupManager* GetInstance();
 
+  void AdjustPopupsOnWindowChange(nsPIDOMWindow* aWindow);
+
   // get the frame for a content node aContent if the frame's type
   // matches aFrameType. Otherwise, return null. If aShouldFlush is true,
   // then the frames are flushed before retrieving the frame.
@@ -790,7 +788,4 @@ protected:
   nsCOMPtr<nsIContent> mOpeningPopup;
 };
 
-nsresult
-NS_NewXULPopupManager(nsISupports** aResult);
-
 #endif
diff --git a/layout/xul/base/src/nsImageBoxFrame.cpp b/layout/xul/base/src/nsImageBoxFrame.cpp
index bce55d36b28b..fa6a186feb7c 100644
--- a/layout/xul/base/src/nsImageBoxFrame.cpp
+++ b/layout/xul/base/src/nsImageBoxFrame.cpp
@@ -72,6 +72,7 @@
 #include "nsIDOMDocument.h"
 #include "nsTransform2D.h"
 #include "nsITheme.h"
+#include "nsIImageLoadingContent.h"
 
 #include "nsIServiceManager.h"
 #include "nsIURI.h"
@@ -173,6 +174,7 @@ nsImageBoxFrame::AttributeChanged(PRInt32 aNameSpaceID,
 nsImageBoxFrame::nsImageBoxFrame(nsIPresShell* aShell, nsStyleContext* aContext):
   nsLeafBoxFrame(aShell, aContext),
   mIntrinsicSize(0,0),
+  mRequestRegistered(false),
   mLoadFlags(nsIRequest::LOAD_NORMAL),
   mUseSrcAttr(false),
   mSuppressStyleCheck(false)
@@ -195,9 +197,13 @@ nsImageBoxFrame::MarkIntrinsicWidthsDirty()
 void
 nsImageBoxFrame::DestroyFrom(nsIFrame* aDestructRoot)
 {
-  // Release image loader first so that it's refcnt can go to zero
-  if (mImageRequest)
+  if (mImageRequest) {
+    nsLayoutUtils::DeregisterImageRequest(PresContext(), mImageRequest,
+                                          &mRequestRegistered);
+
+    // Release image loader first so that it's refcnt can go to zero
     mImageRequest->CancelAndForgetObserver(NS_ERROR_FAILURE);
+  }
 
   if (mListener)
     reinterpret_cast<nsImageBoxListener*>(mListener.get())->SetFrame(nsnull); // set the frame to null so we don't send messages to a dead object.
@@ -232,7 +238,11 @@ nsImageBoxFrame::Init(nsIContent*      aContent,
 void
 nsImageBoxFrame::UpdateImage()
 {
+  nsPresContext* presContext = PresContext();
+
   if (mImageRequest) {
+    nsLayoutUtils::DeregisterImageRequest(presContext, mImageRequest,
+                                          &mRequestRegistered);
     mImageRequest->CancelAndForgetObserver(NS_ERROR_FAILURE);
     mImageRequest = nsnull;
   }
@@ -259,6 +269,12 @@ nsImageBoxFrame::UpdateImage()
       nsContentUtils::LoadImage(uri, doc, mContent->NodePrincipal(),
                                 doc->GetDocumentURI(), mListener, mLoadFlags,
                                 getter_AddRefs(mImageRequest));
+
+      if (mImageRequest) {
+        nsLayoutUtils::RegisterImageRequestIfAnimated(presContext,
+                                                      mImageRequest,
+                                                      &mRequestRegistered);
+      }
     }
   } else {
     // Only get the list-style-image if we aren't being drawn
@@ -601,6 +617,15 @@ NS_IMETHODIMP nsImageBoxFrame::OnStopDecode(imgIRequest *request,
   return NS_OK;
 }
 
+NS_IMETHODIMP nsImageBoxFrame::OnImageIsAnimated(imgIRequest *aRequest)
+{
+  // Register with our refresh driver, if we're animated.
+  nsLayoutUtils::RegisterImageRequest(PresContext(), aRequest,
+                                      &mRequestRegistered);
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP nsImageBoxFrame::FrameChanged(imgIContainer *aContainer,
                                             const nsIntRect *aDirtyRect)
 {
@@ -624,7 +649,7 @@ NS_IMETHODIMP nsImageBoxListener::OnStartContainer(imgIRequest *request,
                                                    imgIContainer *image)
 {
   if (!mFrame)
-    return NS_ERROR_FAILURE;
+    return NS_OK;
 
   return mFrame->OnStartContainer(request, image);
 }
@@ -633,7 +658,7 @@ NS_IMETHODIMP nsImageBoxListener::OnStopContainer(imgIRequest *request,
                                                   imgIContainer *image)
 {
   if (!mFrame)
-    return NS_ERROR_FAILURE;
+    return NS_OK;
 
   return mFrame->OnStopContainer(request, image);
 }
@@ -643,11 +668,19 @@ NS_IMETHODIMP nsImageBoxListener::OnStopDecode(imgIRequest *request,
                                                const PRUnichar *statusArg)
 {
   if (!mFrame)
-    return NS_ERROR_FAILURE;
+    return NS_OK;
 
   return mFrame->OnStopDecode(request, status, statusArg);
 }
 
+NS_IMETHODIMP nsImageBoxListener::OnImageIsAnimated(imgIRequest* aRequest)
+{
+  if (!mFrame)
+    return NS_OK;
+
+  return mFrame->OnImageIsAnimated(aRequest);
+}
+
 NS_IMETHODIMP nsImageBoxListener::FrameChanged(imgIContainer *aContainer,
                                                const nsIntRect *aDirtyRect)
 {
diff --git a/layout/xul/base/src/nsImageBoxFrame.h b/layout/xul/base/src/nsImageBoxFrame.h
index f6f2fdce747d..720094af6760 100644
--- a/layout/xul/base/src/nsImageBoxFrame.h
+++ b/layout/xul/base/src/nsImageBoxFrame.h
@@ -58,6 +58,8 @@ public:
   NS_IMETHOD OnStopContainer(imgIRequest *request, imgIContainer *image);
   NS_IMETHOD OnStopDecode(imgIRequest *request, nsresult status,
                           const PRUnichar *statusArg);
+  NS_IMETHOD OnImageIsAnimated(imgIRequest* aRequest);
+
   // imgIContainerObserver (override nsStubImageDecoderObserver)
   NS_IMETHOD FrameChanged(imgIContainer *aContainer,
                           const nsIntRect *aDirtyRect);
@@ -122,6 +124,8 @@ public:
   NS_IMETHOD OnStopDecode(imgIRequest *request,
                           nsresult status,
                           const PRUnichar *statusArg);
+  NS_IMETHOD OnImageIsAnimated(imgIRequest* aRequest);
+
   NS_IMETHOD FrameChanged(imgIContainer *aContainer,
                           const nsIntRect *aDirtyRect);
 
@@ -142,6 +146,10 @@ private:
   nsSize mIntrinsicSize;
   nsSize mImageSize;
 
+  // Boolean variable to determine if the current image request has been
+  // registered with the refresh driver.
+  bool mRequestRegistered;
+
   nsCOMPtr<imgIRequest> mImageRequest;
   nsCOMPtr<imgIDecoderObserver> mListener;
 
diff --git a/layout/xul/base/src/nsXULPopupManager.cpp b/layout/xul/base/src/nsXULPopupManager.cpp
index 9f2fb9bfaeed..1966e80140a2 100644
--- a/layout/xul/base/src/nsXULPopupManager.cpp
+++ b/layout/xul/base/src/nsXULPopupManager.cpp
@@ -137,9 +137,8 @@ void nsMenuChainItem::Detach(nsMenuChainItem** aRoot)
   }
 }
 
-NS_IMPL_ISUPPORTS4(nsXULPopupManager,
+NS_IMPL_ISUPPORTS3(nsXULPopupManager,
                    nsIDOMEventListener,
-                   nsIMenuRollup,
                    nsITimerCallback,
                    nsIObserver)
 
@@ -207,15 +206,14 @@ nsXULPopupManager::GetInstance()
   return sInstance;
 }
 
-NS_IMETHODIMP
-nsXULPopupManager::Rollup(PRUint32 aCount, nsIContent** aLastRolledUp)
+nsIContent*
+nsXULPopupManager::Rollup(PRUint32 aCount, bool aGetLastRolledUp)
 {
-  if (aLastRolledUp)
-    *aLastRolledUp = nsnull;
+  nsIContent* lastRolledUpPopup = nsnull;
 
   nsMenuChainItem* item = GetTopVisibleMenu();
   if (item) {
-    if (aLastRolledUp) {
+    if (aGetLastRolledUp) {
       // we need to get the popup that will be closed last, so that
       // widget can keep track of it so it doesn't reopen if a mouse
       // down event is going to processed.
@@ -227,7 +225,7 @@ nsXULPopupManager::Rollup(PRUint32 aCount, nsIContent** aLastRolledUp)
       nsMenuChainItem* first = item;
       while (first->GetParent())
         first = first->GetParent();
-      NS_ADDREF(*aLastRolledUp = first->Content());
+      lastRolledUpPopup = first->Content();
     }
 
     // if a number of popups to close has been specified, determine the last
@@ -245,35 +243,33 @@ nsXULPopupManager::Rollup(PRUint32 aCount, nsIContent** aLastRolledUp)
 
     HidePopup(item->Content(), true, true, false, lastPopup);
   }
-  return NS_OK;
+
+  return lastRolledUpPopup;
 }
 
 ////////////////////////////////////////////////////////////////////////
-NS_IMETHODIMP nsXULPopupManager::ShouldRollupOnMouseWheelEvent(bool *aShouldRollup) 
+bool nsXULPopupManager::ShouldRollupOnMouseWheelEvent()
 {
   // should rollup only for autocomplete widgets
   // XXXndeakin this should really be something the popup has more control over
 
-  *aShouldRollup = false;
   nsMenuChainItem* item = GetTopVisibleMenu();
   if (!item)
-    return NS_OK;
+    return false;
 
   nsIContent* content = item->Frame()->GetContent();
-  if (content) {
-    nsAutoString value;
-    content->GetAttr(kNameSpaceID_None, nsGkAtoms::type, value);
-    *aShouldRollup = StringBeginsWith(value, NS_LITERAL_STRING("autocomplete"));
-  }
+  if (!content)
+    return false;
 
-  return NS_OK;
+  nsAutoString value;
+  content->GetAttr(kNameSpaceID_None, nsGkAtoms::type, value);
+  return StringBeginsWith(value, NS_LITERAL_STRING("autocomplete"));
 }
 
 // a menu should not roll up if activated by a mouse activate message (eg. X-mouse)
-NS_IMETHODIMP nsXULPopupManager::ShouldRollupOnMouseActivate(bool *aShouldRollup) 
+bool nsXULPopupManager::ShouldRollupOnMouseActivate()
 {
-  *aShouldRollup = false;
-  return NS_OK;
+  return false;
 }
 
 PRUint32
@@ -1620,7 +1616,7 @@ nsXULPopupManager::SetCaptureState(nsIContent* aOldPopup)
     return;
 
   if (mWidget) {
-    mWidget->CaptureRollupEvents(this, this, false, false);
+    mWidget->CaptureRollupEvents(this, false, false);
     mWidget = nsnull;
   }
 
@@ -1629,8 +1625,7 @@ nsXULPopupManager::SetCaptureState(nsIContent* aOldPopup)
     nsCOMPtr<nsIWidget> widget;
     popup->GetWidget(getter_AddRefs(widget));
     if (widget) {
-      widget->CaptureRollupEvents(this, this, true,
-                                  popup->ConsumeOutsideClicks());
+      widget->CaptureRollupEvents(this, true, popup->ConsumeOutsideClicks());
       mWidget = widget;
       popup->AttachedDismissalListener();
     }
@@ -2182,7 +2177,7 @@ nsXULPopupManager::KeyDown(nsIDOMKeyEvent* aKeyEvent)
         // The access key just went down and no other
         // modifiers are already down.
         if (mPopups)
-          Rollup(nsnull, nsnull);
+          Rollup(0);
         else if (mActiveMenuBar)
           mActiveMenuBar->MenuClosed();
       }
@@ -2261,7 +2256,7 @@ nsXULPopupManager::KeyPress(nsIDOMKeyEvent* aKeyEvent)
   ) {
     // close popups or deactivate menubar when Tab or F10 are pressed
     if (item)
-      Rollup(nsnull, nsnull);
+      Rollup(0);
     else if (mActiveMenuBar)
       mActiveMenuBar->MenuClosed();
   }
@@ -2381,12 +2376,3 @@ nsXULMenuCommandEvent::Run()
 
   return NS_OK;
 }
-
-nsresult
-NS_NewXULPopupManager(nsISupports** aResult)
-{
-  nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
-  NS_IF_ADDREF(pm);
-  *aResult = static_cast<nsIMenuRollup *>(pm);
-  return NS_OK;
-}
diff --git a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
index f323f9ebcb08..8e3c73aac7d3 100644
--- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
@@ -54,6 +54,7 @@
 
 #include "nsTreeBodyFrame.h"
 #include "nsTreeSelection.h"
+#include "nsTreeImageListener.h"
 
 #include "nsGkAtoms.h"
 #include "nsCSSAnonBoxes.h"
@@ -114,6 +115,14 @@ static PLDHashOperator
 CancelImageRequest(const nsAString& aKey,
                    nsTreeImageCacheEntry aEntry, void* aData)
 {
+
+  // If our imgIRequest object was registered with the refresh driver,
+  // then we need to deregister it.
+  nsTreeBodyFrame* frame = static_cast<nsTreeBodyFrame*>(aData);
+
+  nsLayoutUtils::DeregisterImageRequest(frame->PresContext(), aEntry.request,
+                                        nsnull);
+
   aEntry.request->CancelAndForgetObserver(NS_BINDING_ABORTED);
   return PL_DHASH_NEXT;
 }
@@ -164,7 +173,8 @@ nsTreeBodyFrame::nsTreeBodyFrame(nsIPresShell* aPresShell, nsStyleContext* aCont
 // Destructor
 nsTreeBodyFrame::~nsTreeBodyFrame()
 {
-  mImageCache.EnumerateRead(CancelImageRequest, nsnull);
+  mImageCache.EnumerateRead(CancelImageRequest, this);
+  DetachImageListeners();
   delete mSlots;
 }
 
@@ -197,8 +207,11 @@ nsTreeBodyFrame::Init(nsIContent*     aContent,
   mIndentation = GetIndentation();
   mRowHeight = GetRowHeight();
 
+  NS_ENSURE_TRUE(mCreatedListeners.Init(), NS_ERROR_OUT_OF_MEMORY);
+
   NS_ENSURE_TRUE(mImageCache.Init(16), NS_ERROR_OUT_OF_MEMORY);
   EnsureBoxObject();
+
   return rv;
 }
 
@@ -2144,9 +2157,11 @@ nsTreeBodyFrame::GetImage(PRInt32 aRowIndex, nsTreeColumn* aCol, bool aUseContex
       // We either aren't done loading, or we're animating. Add our row as a listener for invalidations.
       nsCOMPtr<imgIDecoderObserver> obs;
       imgReq->GetDecoderObserver(getter_AddRefs(obs));
-      nsCOMPtr<nsITreeImageListener> listener(do_QueryInterface(obs));
-      if (listener)
-        listener->AddCell(aRowIndex, aCol);
+
+      if (obs) {
+        static_cast<nsTreeImageListener*> (obs.get())->AddCell(aRowIndex, aCol);
+      }
+
       return NS_OK;
     }
   }
@@ -2154,10 +2169,14 @@ nsTreeBodyFrame::GetImage(PRInt32 aRowIndex, nsTreeColumn* aCol, bool aUseContex
   if (!*aResult) {
     // Create a new nsTreeImageListener object and pass it our row and column
     // information.
-    nsTreeImageListener* listener = new nsTreeImageListener(mTreeBoxObject);
+    nsTreeImageListener* listener = new nsTreeImageListener(this);
     if (!listener)
       return NS_ERROR_OUT_OF_MEMORY;
 
+    if (!mCreatedListeners.PutEntry(listener)) {
+      return NS_ERROR_FAILURE;
+    }
+
     listener->AddCell(aRowIndex, aCol);
     nsCOMPtr<imgIDecoderObserver> imgDecoderObserver = listener;
 
@@ -4236,7 +4255,7 @@ nsresult
 nsTreeBodyFrame::ClearStyleAndImageCaches()
 {
   mStyleCache.Clear();
-  mImageCache.EnumerateRead(CancelImageRequest, nsnull);
+  mImageCache.EnumerateRead(CancelImageRequest, this);
   mImageCache.Clear();
   return NS_OK;
 }
@@ -4468,6 +4487,20 @@ nsTreeBodyFrame::PostScrollEvent()
   }
 }
 
+void
+nsTreeBodyFrame::DetachImageListeners()
+{
+  mCreatedListeners.Clear();
+}
+
+void
+nsTreeBodyFrame::RemoveTreeImageListener(nsTreeImageListener* aListener)
+{
+  if (aListener) {
+    mCreatedListeners.RemoveEntry(aListener);
+  }
+}
+
 #ifdef ACCESSIBILITY
 void
 nsTreeBodyFrame::FireRowCountChangedEvent(PRInt32 aIndex, PRInt32 aCount)
@@ -4641,3 +4674,12 @@ nsTreeBodyFrame::FullScrollbarsUpdate(bool aNeedsFullInvalidation)
   nsContentUtils::AddScriptRunner(new nsOverflowChecker(this));
   return weakFrame.IsAlive();
 }
+
+nsresult
+nsTreeBodyFrame::OnImageIsAnimated(imgIRequest* aRequest)
+{
+  nsLayoutUtils::RegisterImageRequest(PresContext(),
+                                      aRequest, nsnull);
+
+  return NS_OK;
+}
diff --git a/layout/xul/base/src/tree/src/nsTreeBodyFrame.h b/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
index b6f625d7ef22..69127614a90b 100644
--- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
+++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
@@ -54,7 +54,6 @@
 #include "nsTArray.h"
 #include "nsTreeStyleCache.h"
 #include "nsTreeColumns.h"
-#include "nsTreeImageListener.h"
 #include "nsAutoPtr.h"
 #include "nsDataHashtable.h"
 #include "imgIRequest.h"
@@ -64,6 +63,7 @@
 #include "mozilla/LookAndFeel.h"
 
 class nsOverflowChecker;
+class nsTreeImageListener;
 
 // An entry in the tree's image cache
 struct nsTreeImageCacheEntry
@@ -91,6 +91,11 @@ public:
   NS_DECL_QUERYFRAME
   NS_DECL_FRAMEARENA_HELPERS
 
+  // Callback handler methods for refresh driver based animations.
+  // Calls to these functions are forwarded from nsTreeImageListener. These
+  // mirror how nsImageFrame works.
+  nsresult OnImageIsAnimated(imgIRequest* aRequest);
+
   // non-virtual signatures like nsITreeBodyFrame
   nsresult GetColumns(nsITreeColumns **aColumns);
   nsresult GetView(nsITreeView **aView);
@@ -435,6 +440,15 @@ public:
     return col;
   }
 
+  /**
+   * Remove an nsITreeImageListener from being tracked by this frame. Only tree
+   * image listeners that are created by this frame are tracked.
+   *
+   * @param aListener A pointer to an nsTreeImageListener to no longer
+   *        track.
+   */
+  void RemoveTreeImageListener(nsTreeImageListener* aListener);
+
 protected:
 
   // Create a new timer. This method is used to delay various actions like
@@ -465,6 +479,12 @@ protected:
   void PostScrollEvent();
   void FireScrollEvent();
 
+  /**
+   * Clear the pointer to this frame for all nsTreeImageListeners that were
+   * created by this frame.
+   */
+  void DetachImageListeners();
+
 #ifdef ACCESSIBILITY
   /**
    * Fires 'treeRowCountChanged' event asynchronously. The event supports
@@ -602,6 +622,11 @@ protected: // Data Members
   bool mHorizontalOverflow;
 
   bool mReflowCallbackPosted;
+
+  // Hash table to keep track of which listeners we created and thus
+  // have pointers to us.
+  nsTHashtable<nsPtrHashKey<nsTreeImageListener> > mCreatedListeners;
+
 }; // class nsTreeBodyFrame
 
 #endif
diff --git a/layout/xul/base/src/tree/src/nsTreeImageListener.cpp b/layout/xul/base/src/tree/src/nsTreeImageListener.cpp
index e60c392f1cdc..3155f5d9224f 100644
--- a/layout/xul/base/src/tree/src/nsTreeImageListener.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeImageListener.cpp
@@ -42,10 +42,10 @@
 #include "imgIRequest.h"
 #include "imgIContainer.h"
 
-NS_IMPL_ISUPPORTS3(nsTreeImageListener, imgIDecoderObserver, imgIContainerObserver, nsITreeImageListener)
+NS_IMPL_ISUPPORTS2(nsTreeImageListener, imgIDecoderObserver, imgIContainerObserver)
 
-nsTreeImageListener::nsTreeImageListener(nsITreeBoxObject* aTree)
-  : mTree(aTree),
+nsTreeImageListener::nsTreeImageListener(nsTreeBodyFrame* aTreeFrame)
+  : mTreeFrame(aTreeFrame),
     mInvalidationSuppressed(true),
     mInvalidationArea(nsnull)
 {
@@ -56,6 +56,16 @@ nsTreeImageListener::~nsTreeImageListener()
   delete mInvalidationArea;
 }
 
+NS_IMETHODIMP
+nsTreeImageListener::OnImageIsAnimated(imgIRequest *aRequest)
+{
+  if (!mTreeFrame) {
+    return NS_OK;
+  }
+
+  return mTreeFrame->OnImageIsAnimated(aRequest);
+}
+
 NS_IMETHODIMP nsTreeImageListener::OnStartContainer(imgIRequest *aRequest,
                                                     imgIContainer *aImage)
 {
@@ -82,7 +92,7 @@ NS_IMETHODIMP nsTreeImageListener::FrameChanged(imgIContainer *aContainer,
 }
 
 
-NS_IMETHODIMP
+void
 nsTreeImageListener::AddCell(PRInt32 aIndex, nsITreeColumn* aCol)
 {
   if (!mInvalidationArea) {
@@ -104,8 +114,6 @@ nsTreeImageListener::AddCell(PRInt32 aIndex, nsITreeColumn* aCol)
       mInvalidationArea->AddRow(aIndex);
     }
   }
-
-  return NS_OK;
 }
 
 
@@ -113,10 +121,16 @@ void
 nsTreeImageListener::Invalidate()
 {
   if (!mInvalidationSuppressed) {
-    for (InvalidationArea* currArea = mInvalidationArea; currArea; currArea = currArea->GetNext()) {
+    for (InvalidationArea* currArea = mInvalidationArea; currArea;
+         currArea = currArea->GetNext()) {
       // Loop from min to max, invalidating each cell that was listening for this image.
       for (PRInt32 i = currArea->GetMin(); i <= currArea->GetMax(); ++i) {
-        mTree->InvalidateCell(i, currArea->GetCol());
+        if (mTreeFrame) {
+          nsITreeBoxObject* tree = mTreeFrame->GetTreeBoxObject();
+          if (tree) {
+            tree->InvalidateCell(i, currArea->GetCol());
+          }
+        }
       }
     }
   }
@@ -140,3 +154,10 @@ nsTreeImageListener::InvalidationArea::AddRow(PRInt32 aIndex)
   else if (aIndex > mMax)
     mMax = aIndex;
 }
+
+NS_IMETHODIMP
+nsTreeImageListener::ClearFrame()
+{
+  mTreeFrame = nsnull;
+  return NS_OK;
+}
diff --git a/layout/xul/base/src/tree/src/nsTreeImageListener.h b/layout/xul/base/src/tree/src/nsTreeImageListener.h
index d78684f069db..e0beba4d915b 100644
--- a/layout/xul/base/src/tree/src/nsTreeImageListener.h
+++ b/layout/xul/base/src/tree/src/nsTreeImageListener.h
@@ -44,50 +44,36 @@
 #include "nsCOMPtr.h"
 #include "nsITreeColumns.h"
 #include "nsStubImageDecoderObserver.h"
-
-class nsITreeBoxObject;
-
-// The interface for our image listener.
-// {90586540-2D50-403e-8DCE-981CAA778444}
-#define NS_ITREEIMAGELISTENER_IID \
-{ 0x90586540, 0x2d50, 0x403e, { 0x8d, 0xce, 0x98, 0x1c, 0xaa, 0x77, 0x84, 0x44 } }
-
-class nsITreeImageListener : public nsISupports
-{
-public:
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ITREEIMAGELISTENER_IID)
-
-  NS_IMETHOD AddCell(PRInt32 aIndex, nsITreeColumn* aCol) = 0;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsITreeImageListener, NS_ITREEIMAGELISTENER_IID)
+#include "nsTreeBodyFrame.h"
 
 // This class handles image load observation.
-class nsTreeImageListener : public nsStubImageDecoderObserver, public nsITreeImageListener
+class nsTreeImageListener : public nsStubImageDecoderObserver
 {
 public:
-  nsTreeImageListener(nsITreeBoxObject* aTree);
+  nsTreeImageListener(nsTreeBodyFrame *aTreeFrame);
   ~nsTreeImageListener();
 
   NS_DECL_ISUPPORTS
   // imgIDecoderObserver (override nsStubImageDecoderObserver)
   NS_IMETHOD OnStartContainer(imgIRequest *aRequest, imgIContainer *aImage);
+  NS_IMETHOD OnImageIsAnimated(imgIRequest* aRequest);
   NS_IMETHOD OnDataAvailable(imgIRequest *aRequest, bool aCurrentFrame,
                              const nsIntRect *aRect);
   // imgIContainerObserver (override nsStubImageDecoderObserver)
   NS_IMETHOD FrameChanged(imgIContainer *aContainer,
                           const nsIntRect *aDirtyRect);
 
-  NS_IMETHOD AddCell(PRInt32 aIndex, nsITreeColumn* aCol);
- 
+  NS_IMETHOD ClearFrame();
+
   friend class nsTreeBodyFrame;
 
 protected:
   void UnsuppressInvalidation() { mInvalidationSuppressed = false; }
   void Invalidate();
+  void AddCell(PRInt32 aIndex, nsITreeColumn* aCol);
 
 private:
-  nsITreeBoxObject* mTree;
+  nsTreeBodyFrame* mTreeFrame;
 
   // A guard that prevents us from recursive painting.
   bool mInvalidationSuppressed;
diff --git a/layout/xul/base/test/test_resizer.xul b/layout/xul/base/test/test_resizer.xul
index 6feed51e7e79..2ba971d05934 100644
--- a/layout/xul/base/test/test_resizer.xul
+++ b/layout/xul/base/test/test_resizer.xul
@@ -16,6 +16,7 @@ XUL <resizer> tests
   <!-- test code goes here -->
   <script type="application/javascript"><![CDATA[
     SimpleTest.waitForExplicitFinish();
+    SimpleTest.ignoreAllUncaughtExceptions();
 
     function openPopup()
     {
diff --git a/media/libpng/Makefile.in b/media/libpng/Makefile.in
index 993d7a3aa2d0..3313e39b0d13 100644
--- a/media/libpng/Makefile.in
+++ b/media/libpng/Makefile.in
@@ -80,8 +80,6 @@ EXPORTS		= png.h pngconf.h mozpngconf.h
 LOCAL_INCLUDES	= -I$(srcdir)
 
 FORCE_STATIC_LIB = 1
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/media/libsydneyaudio/src/Makefile.in b/media/libsydneyaudio/src/Makefile.in
index 9bc528a18318..692bbea285e3 100644
--- a/media/libsydneyaudio/src/Makefile.in
+++ b/media/libsydneyaudio/src/Makefile.in
@@ -51,7 +51,11 @@ CSRCS		= \
 		$(NULL)
 endif
 
-ifeq ($(OS_TARGET),Android)
+ifeq ($(MOZ_WIDGET_TOOLKIT),gonk)
+CSRCS		= \
+		sydney_audio_gonk.c \
+		$(NULL)
+else ifeq ($(MOZ_WIDGET_TOOLKIT),android)
 CSRCS		= \
 		sydney_audio_android.c \
 		$(NULL)
diff --git a/media/libsydneyaudio/src/sydney_audio_gonk.c b/media/libsydneyaudio/src/sydney_audio_gonk.c
new file mode 100644
index 000000000000..3f3c6e7b27dd
--- /dev/null
+++ b/media/libsydneyaudio/src/sydney_audio_gonk.c
@@ -0,0 +1,315 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Initial Developer of the Original Code is
+ * CSIRO
+ * Portions created by the Initial Developer are Copyright (C) 2007
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s): Michael Martin
+ *                 Michael Wu <mwu@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** *
+ */
+
+#include <stdlib.h>
+#include <time.h>
+#include "sydney_audio.h"
+
+#include "android/log.h"
+
+#ifndef ALOG
+#if defined(DEBUG) || defined(FORCE_ALOG)
+#define ALOG(args...)  __android_log_print(ANDROID_LOG_INFO, "Gecko - SYDNEY_AUDIO" , ## args)
+#else
+#define ALOG(args...)
+#endif
+#endif 
+
+/* Gonk implementation based on sydney_audio_mac.c */
+/* XXX This is temporary until we figure out a way to hook ALSA up */
+
+#define NANOSECONDS_IN_MILLISECOND 1000000
+#define MILLISECONDS_PER_SECOND    1000
+
+struct sa_stream {
+  unsigned int rate;
+  unsigned int channels;
+  unsigned int isPaused;
+
+  int64_t lastStartTime;
+  int64_t timePlaying;
+  int64_t amountWritten;
+  unsigned int bufferSize;
+};
+
+/*
+ * -----------------------------------------------------------------------------
+ * Startup and shutdown functions
+ * -----------------------------------------------------------------------------
+ */
+
+int
+sa_stream_create_pcm(
+  sa_stream_t      ** _s,
+  const char        * client_name,
+  sa_mode_t           mode,
+  sa_pcm_format_t     format,
+  unsigned  int       rate,
+  unsigned  int       channels
+) {
+
+  /*
+   * Make sure we return a NULL stream pointer on failure.
+   */
+  if (_s == NULL) {
+    return SA_ERROR_INVALID;
+  }
+  *_s = NULL;
+
+  if (mode != SA_MODE_WRONLY) {
+    return SA_ERROR_NOT_SUPPORTED;
+  }
+  if (format != SA_PCM_FORMAT_S16_NE) {
+    return SA_ERROR_NOT_SUPPORTED;
+  }
+  if (channels != 1 && channels != 2) {
+    return SA_ERROR_NOT_SUPPORTED;
+  }
+
+  /*
+   * Allocate the instance and required resources.
+   */
+  sa_stream_t *s;
+  if ((s = malloc(sizeof(sa_stream_t))) == NULL) {
+    return SA_ERROR_OOM;
+  }
+
+  s->rate        = rate;
+  s->channels    = channels;
+  s->isPaused    = 0;
+
+  s->lastStartTime = 0;
+  s->timePlaying = 0;
+  s->amountWritten = 0;
+
+  s->bufferSize = rate * channels;
+
+  *_s = s;
+  return SA_SUCCESS;
+}
+
+
+int
+sa_stream_open(sa_stream_t *s) {
+
+  if (s == NULL) {
+    return SA_ERROR_NO_INIT;
+  }
+
+  return SA_ERROR_NO_DEVICE;
+}
+
+
+int
+sa_stream_destroy(sa_stream_t *s) {
+
+  if (s == NULL) {
+    return SA_ERROR_NO_INIT;
+  }
+// XXX
+  return SA_SUCCESS;
+}
+
+
+/*
+ * -----------------------------------------------------------------------------
+ * Data read and write functions
+ * -----------------------------------------------------------------------------
+ */
+
+int
+sa_stream_write(sa_stream_t *s, const void *data, size_t nbytes) {
+
+  if (s == NULL) {
+    return SA_ERROR_NO_INIT;
+  }
+  if (nbytes == 0) {
+    return SA_SUCCESS;
+  }
+// XXX
+  return SA_SUCCESS;
+}
+
+
+/*
+ * -----------------------------------------------------------------------------
+ * General query and support functions
+ * -----------------------------------------------------------------------------
+ */
+
+int
+sa_stream_get_write_size(sa_stream_t *s, size_t *size) {
+
+  if (s == NULL) {
+    return SA_ERROR_NO_INIT;
+  }
+
+// XXX
+  return SA_SUCCESS;
+}
+
+
+int
+sa_stream_get_position(sa_stream_t *s, sa_position_t position, int64_t *pos) {
+
+  if (s == NULL) {
+    return SA_ERROR_NO_INIT;
+  }
+
+// XXX
+  return SA_SUCCESS;
+}
+
+
+int
+sa_stream_pause(sa_stream_t *s) {
+
+  if (s == NULL) {
+    return SA_ERROR_NO_INIT;
+  }
+
+// XXX
+  return SA_SUCCESS;
+}
+
+
+int
+sa_stream_resume(sa_stream_t *s) {
+
+  if (s == NULL) {
+    return SA_ERROR_NO_INIT;
+  }
+
+// XXX
+  return SA_SUCCESS;
+}
+
+
+int
+sa_stream_drain(sa_stream_t *s)
+{
+  if (s == NULL) {
+    return SA_ERROR_NO_INIT;
+  }
+
+// XXX
+  return SA_SUCCESS;
+}
+
+
+/*
+ * -----------------------------------------------------------------------------
+ * Extension functions
+ * -----------------------------------------------------------------------------
+ */
+
+int
+sa_stream_set_volume_abs(sa_stream_t *s, float vol) {
+
+  if (s == NULL) {
+    return SA_ERROR_NO_INIT;
+  }
+
+// XXX
+  return SA_SUCCESS;
+}
+
+/*
+ * -----------------------------------------------------------------------------
+ * Unsupported functions
+ * -----------------------------------------------------------------------------
+ */
+#define UNSUPPORTED(func)   func { return SA_ERROR_NOT_SUPPORTED; }
+
+UNSUPPORTED(int sa_stream_create_opaque(sa_stream_t **s, const char *client_name, sa_mode_t mode, const char *codec))
+UNSUPPORTED(int sa_stream_set_write_lower_watermark(sa_stream_t *s, size_t size))
+UNSUPPORTED(int sa_stream_set_read_lower_watermark(sa_stream_t *s, size_t size))
+UNSUPPORTED(int sa_stream_set_write_upper_watermark(sa_stream_t *s, size_t size))
+UNSUPPORTED(int sa_stream_set_read_upper_watermark(sa_stream_t *s, size_t size))
+UNSUPPORTED(int sa_stream_set_channel_map(sa_stream_t *s, const sa_channel_t map[], unsigned int n))
+UNSUPPORTED(int sa_stream_set_xrun_mode(sa_stream_t *s, sa_xrun_mode_t mode))
+UNSUPPORTED(int sa_stream_set_non_interleaved(sa_stream_t *s, int enable))
+UNSUPPORTED(int sa_stream_set_dynamic_rate(sa_stream_t *s, int enable))
+UNSUPPORTED(int sa_stream_set_driver(sa_stream_t *s, const char *driver))
+UNSUPPORTED(int sa_stream_start_thread(sa_stream_t *s, sa_event_callback_t callback))
+UNSUPPORTED(int sa_stream_stop_thread(sa_stream_t *s))
+UNSUPPORTED(int sa_stream_change_device(sa_stream_t *s, const char *device_name))
+UNSUPPORTED(int sa_stream_change_read_volume(sa_stream_t *s, const int32_t vol[], unsigned int n))
+UNSUPPORTED(int sa_stream_change_write_volume(sa_stream_t *s, const int32_t vol[], unsigned int n))
+UNSUPPORTED(int sa_stream_change_rate(sa_stream_t *s, unsigned int rate))
+UNSUPPORTED(int sa_stream_change_meta_data(sa_stream_t *s, const char *name, const void *data, size_t size))
+UNSUPPORTED(int sa_stream_change_user_data(sa_stream_t *s, const void *value))
+UNSUPPORTED(int sa_stream_set_adjust_rate(sa_stream_t *s, sa_adjust_t direction))
+UNSUPPORTED(int sa_stream_set_adjust_nchannels(sa_stream_t *s, sa_adjust_t direction))
+UNSUPPORTED(int sa_stream_set_adjust_pcm_format(sa_stream_t *s, sa_adjust_t direction))
+UNSUPPORTED(int sa_stream_set_adjust_watermarks(sa_stream_t *s, sa_adjust_t direction))
+UNSUPPORTED(int sa_stream_get_mode(sa_stream_t *s, sa_mode_t *access_mode))
+UNSUPPORTED(int sa_stream_get_codec(sa_stream_t *s, char *codec, size_t *size))
+UNSUPPORTED(int sa_stream_get_pcm_format(sa_stream_t *s, sa_pcm_format_t *format))
+UNSUPPORTED(int sa_stream_get_rate(sa_stream_t *s, unsigned int *rate))
+UNSUPPORTED(int sa_stream_get_nchannels(sa_stream_t *s, int *nchannels))
+UNSUPPORTED(int sa_stream_get_user_data(sa_stream_t *s, void **value))
+UNSUPPORTED(int sa_stream_get_write_lower_watermark(sa_stream_t *s, size_t *size))
+UNSUPPORTED(int sa_stream_get_read_lower_watermark(sa_stream_t *s, size_t *size))
+UNSUPPORTED(int sa_stream_get_write_upper_watermark(sa_stream_t *s, size_t *size))
+UNSUPPORTED(int sa_stream_get_read_upper_watermark(sa_stream_t *s, size_t *size))
+UNSUPPORTED(int sa_stream_get_channel_map(sa_stream_t *s, sa_channel_t map[], unsigned int *n))
+UNSUPPORTED(int sa_stream_get_xrun_mode(sa_stream_t *s, sa_xrun_mode_t *mode))
+UNSUPPORTED(int sa_stream_get_non_interleaved(sa_stream_t *s, int *enabled))
+UNSUPPORTED(int sa_stream_get_dynamic_rate(sa_stream_t *s, int *enabled))
+UNSUPPORTED(int sa_stream_get_driver(sa_stream_t *s, char *driver_name, size_t *size))
+UNSUPPORTED(int sa_stream_get_device(sa_stream_t *s, char *device_name, size_t *size))
+UNSUPPORTED(int sa_stream_get_read_volume(sa_stream_t *s, int32_t vol[], unsigned int *n))
+UNSUPPORTED(int sa_stream_get_write_volume(sa_stream_t *s, int32_t vol[], unsigned int *n))
+UNSUPPORTED(int sa_stream_get_meta_data(sa_stream_t *s, const char *name, void*data, size_t *size))
+UNSUPPORTED(int sa_stream_get_adjust_rate(sa_stream_t *s, sa_adjust_t *direction))
+UNSUPPORTED(int sa_stream_get_adjust_nchannels(sa_stream_t *s, sa_adjust_t *direction))
+UNSUPPORTED(int sa_stream_get_adjust_pcm_format(sa_stream_t *s, sa_adjust_t *direction))
+UNSUPPORTED(int sa_stream_get_adjust_watermarks(sa_stream_t *s, sa_adjust_t *direction))
+UNSUPPORTED(int sa_stream_get_state(sa_stream_t *s, sa_state_t *state))
+UNSUPPORTED(int sa_stream_get_event_error(sa_stream_t *s, sa_error_t *error))
+UNSUPPORTED(int sa_stream_get_event_notify(sa_stream_t *s, sa_notify_t *notify))
+UNSUPPORTED(int sa_stream_read(sa_stream_t *s, void *data, size_t nbytes))
+UNSUPPORTED(int sa_stream_read_ni(sa_stream_t *s, unsigned int channel, void *data, size_t nbytes))
+UNSUPPORTED(int sa_stream_write_ni(sa_stream_t *s, unsigned int channel, const void *data, size_t nbytes))
+UNSUPPORTED(int sa_stream_pwrite(sa_stream_t *s, const void *data, size_t nbytes, int64_t offset, sa_seek_t whence))
+UNSUPPORTED(int sa_stream_pwrite_ni(sa_stream_t *s, unsigned int channel, const void *data, size_t nbytes, int64_t offset, sa_seek_t whence))
+UNSUPPORTED(int sa_stream_get_read_size(sa_stream_t *s, size_t *size))
+UNSUPPORTED(int sa_stream_get_volume_abs(sa_stream_t *s, float *vol))
+UNSUPPORTED(int sa_stream_get_min_write(sa_stream_t *s, size_t *size))
+
+const char *sa_strerror(int code) { return NULL; }
+
diff --git a/memory/mozalloc/Makefile.in b/memory/mozalloc/Makefile.in
index 3f8fb942b1ec..1112af01d6d3 100644
--- a/memory/mozalloc/Makefile.in
+++ b/memory/mozalloc/Makefile.in
@@ -51,9 +51,14 @@ endif
 
 MODULE		= mozalloc
 LIBRARY_NAME	= mozalloc
-FORCE_SHARED_LIB= 1
 DIST_INSTALL 	= 1
 
+ifeq (gonk,$(MOZ_WIDGET_TOOLKIT))
+FORCE_STATIC_LIB= 1
+else
+FORCE_SHARED_LIB= 1
+endif
+
 ifeq (,$(filter-out OS2,$(OS_ARCH)))
 # The strndup declaration in string.h is in an ifdef __USE_GNU section
 DEFINES		+= -D_GNU_SOURCE
diff --git a/memory/mozutils/Makefile.in b/memory/mozutils/Makefile.in
index 30a09c3368b6..b090c6a19175 100644
--- a/memory/mozutils/Makefile.in
+++ b/memory/mozutils/Makefile.in
@@ -80,10 +80,13 @@ NO_INSTALL_IMPORT_LIBRARY = 1
 endif
 endif
 
-ifeq (Android, $(OS_TARGET))
+ifeq (android, $(MOZ_WIDGET_TOOLKIT))
 # Add Android linker
 EXTRA_DSO_LDOPTS += $(ZLIB_LIBS)
 SHARED_LIBRARY_LIBS += $(call EXPAND_LIBNAME_PATH,android,$(DEPTH)/other-licenses/android)
+endif
+
+ifeq (Android, $(OS_TARGET))
 WRAP_LDFLAGS =
 endif
 
diff --git a/mfbt/RangedPtr.h b/mfbt/RangedPtr.h
index ce12479800a9..82726755dd16 100644
--- a/mfbt/RangedPtr.h
+++ b/mfbt/RangedPtr.h
@@ -268,9 +268,9 @@ class RangedPtr
     }
 
   private:
-    RangedPtr();
-    T* operator&();
-    operator T*() const;
+    RangedPtr() MOZ_DELETE;
+    T* operator&() MOZ_DELETE;
+    operator T*() const MOZ_DELETE;
 };
 
 } /* namespace mozilla */
diff --git a/mfbt/RefPtr.h b/mfbt/RefPtr.h
index 3c9be7ff8af9..1f480c3cccf1 100644
--- a/mfbt/RefPtr.h
+++ b/mfbt/RefPtr.h
@@ -269,8 +269,8 @@ private:
     RefPtr<T>& refPtr;
     T* tmp;
 
-    OutParamRef();
-    OutParamRef& operator=(const OutParamRef&);
+    OutParamRef() MOZ_DELETE;
+    OutParamRef& operator=(const OutParamRef&) MOZ_DELETE;
 };
 
 /**
diff --git a/mfbt/Types.h b/mfbt/Types.h
index 1f9c8e666bec..67f0b3c94346 100644
--- a/mfbt/Types.h
+++ b/mfbt/Types.h
@@ -88,4 +88,49 @@
 #define MOZ_BEGIN_EXTERN_C     JS_BEGIN_EXTERN_C
 #define MOZ_END_EXTERN_C       JS_END_EXTERN_C
 
+#ifdef __cplusplus
+
+/*
+ * MOZ_DELETE, specified immediately prior to the ';' terminating an undefined-
+ * method declaration, attempts to delete that method from the corresponding
+ * class.  An attempt to use the method will always produce an error *at compile
+ * time* (instead of sometimes as late as link time) when this macro can be
+ * implemented.  For example, you can use MOZ_DELETE to produce classes with no
+ * implicit copy constructor or assignment operator:
+ *
+ *   struct NonCopyable
+ *   {
+ *     private:
+ *       NonCopyable(const NonCopyable& other) MOZ_DELETE;
+ *       void operator=(const NonCopyable& other) MOZ_DELETE;
+ *   };
+ *
+ * If MOZ_DELETE can't be implemented for the current compiler, use of the
+ * annotated method will still cause an error, but the error might occur at link
+ * time in some cases rather than at compile time.
+ *
+ * MOZ_DELETE relies on C++11 functionality not universally implemented.  As a
+ * backstop, method declarations using MOZ_DELETE should be private.
+ */
+#if defined(__clang__) && (__clang_major__ >= 3 || (__clang_major__ == 2 && __clang_minor__ >= 9))
+# define MOZ_DELETE            = delete
+#elif defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 4))
+ /*
+  * g++ >= 4.4 requires -std=c++0x or -std=gnu++0x to support deleted functions
+  * without warnings.  These modes are detectable by the experimental macro used
+  * below or, more standardly, by checking whether __cplusplus has a C++11 or
+  * greater value.  Current versions of g++ do not correctly set __cplusplus, so
+  * we check both for forward compatibility.
+  */
+# if defined(__GXX_EXPERIMENTAL_CXX0X__) || __cplusplus >= 201103L
+#  define MOZ_DELETE           = delete
+# else
+#  define MOZ_DELETE           /* = delete */
+# endif
+#else
+# define MOZ_DELETE            /* no = delete support, or unknown support */
+#endif
+
+#endif /* __cplusplus */
+
 #endif  /* mozilla_Types_h_ */
diff --git a/mobile/chrome/content/bindings/browser.js b/mobile/chrome/content/bindings/browser.js
index cacb4fb2ac69..b39995597953 100644
--- a/mobile/chrome/content/bindings/browser.js
+++ b/mobile/chrome/content/bindings/browser.js
@@ -35,7 +35,7 @@ let WebProgressListener = {
 
   _firstPaint: false,
 
-  onLocationChange: function onLocationChange(aWebProgress, aRequest, aLocationURI) {
+  onLocationChange: function onLocationChange(aWebProgress, aRequest, aLocationURI, aFlags) {
     if (content != aWebProgress.DOMWindow)
       return;
 
diff --git a/mobile/chrome/tests/Makefile.in b/mobile/chrome/tests/Makefile.in
index 37a0cbd945c9..8eb8887bd176 100644
--- a/mobile/chrome/tests/Makefile.in
+++ b/mobile/chrome/tests/Makefile.in
@@ -74,7 +74,7 @@ _BROWSER_FILES = \
   $(warning browser_forms.js disabled due to failures) \
   browser_formsZoom.html \
   $(warning browser_formsZoom.js disabled due to failures) \
-  browser_history.js \
+  $(info browser_history.js is disabled because it is random orange on XUL fennec (bug 700537)) \
   $(info browser_localepicker.js is disabled because the localepicker is disabled (bug 694047)) \
   browser_localepicker_escape.js \
   browser_mainui.js \
@@ -88,7 +88,7 @@ _BROWSER_FILES = \
   browser_select.html \
   browser_select.js \
   browser_sessionstore.js \
-  browser_tabs.js \
+  $(info browser_tabs.js is disabled because it is random orange on XUL fennec (bug 700537)) \
   $(info browser_tapping.js is disabled because it is random orange on XUL fennec (bug 698387)) \
   $(info browser_tap_content.html is disabled because it is random orange on XUL fennec (bug 698387)) \
   browser_tapping_edit.js \
@@ -99,7 +99,7 @@ _BROWSER_FILES = \
   browser_viewport.sjs \
   browser_scrollbar.sjs \
   browser_title.sjs \
-  browser_thumbnails.js \
+  $(info browser_thumbnails.js is disabled because it is random orange on XUL fennec (bug 700537)) \
   browser_install.xml \
   browser_upgrade.rdf\
   browser_localerepository.js \
diff --git a/mobile/components/SafeBrowsing.js b/mobile/components/SafeBrowsing.js
index 57cb8fba12f0..10dec7017441 100644
--- a/mobile/components/SafeBrowsing.js
+++ b/mobile/components/SafeBrowsing.js
@@ -101,13 +101,13 @@ SafeBrowsing.prototype = {
     this.listManager = Cc["@mozilla.org/url-classifier/listmanager;1"].getService(Ci.nsIUrlListManager);
 
     // Add a test chunk to the database
-    let testData = "mozilla.com/firefox/its-an-attack.html";
+    let testData = "mozilla.org/firefox/its-an-attack.html";
     let testUpdate =
       "n:1000\ni:test-malware-simple\nad:1\n" +
       "a:1:32:" + testData.length + "\n" +
       testData;
 
-    testData = "mozilla.com/firefox/its-a-trap.html";
+    testData = "mozilla.org/firefox/its-a-trap.html";
     testUpdate +=
       "n:1000\ni:test-phish-simple\nad:1\n" +
       "a:1:32:" + testData.length + "\n" +
diff --git a/mobile/components/build/nsShellService.cpp b/mobile/components/build/nsShellService.cpp
index 18e5af005b25..477976477d48 100644
--- a/mobile/components/build/nsShellService.cpp
+++ b/mobile/components/build/nsShellService.cpp
@@ -48,7 +48,7 @@
 #include <QtGui/QWidget>
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidBridge.h"
 #endif
 
@@ -92,7 +92,7 @@ nsShellService::CreateShortcut(const nsAString& aTitle, const nsAString& aURI, c
   if (!aTitle.Length() || !aURI.Length() || !aIconData.Length())
     return NS_ERROR_FAILURE;
 
-#if ANDROID
+#if MOZ_WIDGET_ANDROID
   mozilla::AndroidBridge::Bridge()->CreateShortcut(aTitle, aURI, aIconData, aIntent);
   return NS_OK;
 #else
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 7c4d5ee74836..0461c700b0eb 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -319,6 +319,7 @@ pref("browser.fixup.alternate.enabled", true);
 pref("browser.fixup.alternate.prefix", "www.");
 pref("browser.fixup.alternate.suffix", ".com");
 pref("browser.fixup.hide_user_pass", true);
+pref("browser.fixup.use-utf8", false);
 
 // Location Bar AutoComplete
 pref("browser.urlbar.autocomplete.enabled", true);
@@ -634,6 +635,7 @@ pref("javascript.options.jitprofiling.chrome",  true);
 pref("javascript.options.pccounts.content", false);
 pref("javascript.options.pccounts.chrome",  false);
 pref("javascript.options.methodjit_always", false);
+pref("javascript.options.jit_hardening", true);
 pref("javascript.options.typeinference", true);
 // This preference limits the memory usage of javascript.
 // If you want to change these values for your device,
@@ -989,10 +991,6 @@ pref("network.standard-url.escape-utf8", true);
 // UTF-8.
 pref("network.standard-url.encode-utf8", true);
 
-// This preference controls whether or not queries are encoded and sent as
-// UTF-8.
-pref("network.standard-url.encode-query-utf8", false);
-
 // Idle timeout for ftp control connections - 5 minute default
 pref("network.ftp.idleConnectionTimeout", 300);
 
diff --git a/modules/libreg/src/Makefile.in b/modules/libreg/src/Makefile.in
index 58e5132fae28..53bdf99bdf37 100644
--- a/modules/libreg/src/Makefile.in
+++ b/modules/libreg/src/Makefile.in
@@ -55,8 +55,6 @@ PROGOBJS        = $(addprefix R_,$(BIN_SRCS:.c=.o))
 # We don't want a shared lib.  Static lib only.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 # We do want this in the static libraries list
 EXPORT_LIBRARY = 1
diff --git a/modules/zlib/src/Makefile.in b/modules/zlib/src/Makefile.in
index 79003fa5dcf5..7328ca7589fa 100644
--- a/modules/zlib/src/Makefile.in
+++ b/modules/zlib/src/Makefile.in
@@ -57,7 +57,5 @@ CSRCS		= $(MODULES_ZLIB_SRC_LCSRCS)
 
 EXPORTS		= zlib.h zconf.h mozzconf.h
 
-# This library is used by other shared libs in a static build
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
diff --git a/netwerk/base/src/nsStandardURL.cpp b/netwerk/base/src/nsStandardURL.cpp
index df06b767c83f..573c712de045 100644
--- a/netwerk/base/src/nsStandardURL.cpp
+++ b/netwerk/base/src/nsStandardURL.cpp
@@ -67,7 +67,6 @@ nsICharsetConverterManager *nsStandardURL::gCharsetMgr = nsnull;
 bool nsStandardURL::gInitialized = false;
 bool nsStandardURL::gEscapeUTF8 = true;
 bool nsStandardURL::gAlwaysEncodeInUTF8 = true;
-bool nsStandardURL::gEncodeQueryInUTF8 = true;
 
 #if defined(PR_LOGGING)
 //
@@ -144,7 +143,6 @@ end:
 #define NS_NET_PREF_ESCAPEUTF8         "network.standard-url.escape-utf8"
 #define NS_NET_PREF_ENABLEIDN          "network.enableIDN"
 #define NS_NET_PREF_ALWAYSENCODEINUTF8 "network.standard-url.encode-utf8"
-#define NS_NET_PREF_ENCODEQUERYINUTF8  "network.standard-url.encode-query-utf8"
 
 NS_IMPL_ISUPPORTS1(nsStandardURL::nsPrefObserver, nsIObserver)
 
@@ -273,8 +271,7 @@ nsSegmentEncoder::InitUnicodeEncoder()
     GET_SEGMENT_ENCODER_INTERNAL(name, gAlwaysEncodeInUTF8)
 
 #define GET_QUERY_ENCODER(name) \
-    GET_SEGMENT_ENCODER_INTERNAL(name, gAlwaysEncodeInUTF8 && \
-                                 gEncodeQueryInUTF8)
+    GET_SEGMENT_ENCODER_INTERNAL(name, false)
 
 //----------------------------------------------------------------------------
 // nsStandardURL <public>
@@ -350,7 +347,6 @@ nsStandardURL::InitGlobalObjects()
         nsCOMPtr<nsIObserver> obs( new nsPrefObserver() );
         prefBranch->AddObserver(NS_NET_PREF_ESCAPEUTF8, obs.get(), false);
         prefBranch->AddObserver(NS_NET_PREF_ALWAYSENCODEINUTF8, obs.get(), false);
-        prefBranch->AddObserver(NS_NET_PREF_ENCODEQUERYINUTF8, obs.get(), false);
         prefBranch->AddObserver(NS_NET_PREF_ENABLEIDN, obs.get(), false);
 
         PrefsChanged(prefBranch, nsnull);
@@ -956,12 +952,6 @@ nsStandardURL::PrefsChanged(nsIPrefBranch *prefs, const char *pref)
             gAlwaysEncodeInUTF8 = val;
         LOG(("encode in UTF-8 %s\n", gAlwaysEncodeInUTF8 ? "enabled" : "disabled"));
     }
-
-    if (PREF_CHANGED(NS_NET_PREF_ENCODEQUERYINUTF8)) {
-        if (GOT_PREF(NS_NET_PREF_ENCODEQUERYINUTF8, val))
-            gEncodeQueryInUTF8 = val;
-        LOG(("encode query in UTF-8 %s\n", gEncodeQueryInUTF8 ? "enabled" : "disabled"));
-    }
 #undef PREF_CHANGED
 #undef GOT_PREF
 }
diff --git a/netwerk/build/nsNetModule.cpp b/netwerk/build/nsNetModule.cpp
index f74fbd3e6fee..9385f2f1a166 100644
--- a/netwerk/build/nsNetModule.cpp
+++ b/netwerk/build/nsNetModule.cpp
@@ -364,7 +364,7 @@ NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsMaemoNetworkLinkService, Init)
 #elif defined(MOZ_ENABLE_QTNETWORK)
 #include "nsQtNetworkLinkService.h"
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsQtNetworkLinkService, Init)
-#elif defined(ANDROID)
+#elif defined(MOZ_WIDGET_ANDROID)
 #include "nsAndroidNetworkLinkService.h"
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsAndroidNetworkLinkService)
 #endif
@@ -801,7 +801,7 @@ NS_DEFINE_NAMED_CID(NS_NETWORK_LINK_SERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_NETWORK_LINK_SERVICE_CID);
 #elif defined(MOZ_ENABLE_QTNETWORK)
 NS_DEFINE_NAMED_CID(NS_NETWORK_LINK_SERVICE_CID);
-#elif defined(ANDROID)
+#elif defined(MOZ_WIDGET_ANDROID)
 NS_DEFINE_NAMED_CID(NS_NETWORK_LINK_SERVICE_CID);
 #endif
 NS_DEFINE_NAMED_CID(NS_SERIALIZATION_HELPER_CID);
@@ -934,7 +934,7 @@ static const mozilla::Module::CIDEntry kNeckoCIDs[] = {
     { &kNS_NETWORK_LINK_SERVICE_CID, false, NULL, nsMaemoNetworkLinkServiceConstructor },
 #elif defined(MOZ_ENABLE_QTNETWORK)
     { &kNS_NETWORK_LINK_SERVICE_CID, false, NULL, nsQtNetworkLinkServiceConstructor },
-#elif defined(ANDROID)
+#elif defined(MOZ_WIDGET_ANDROID)
     { &kNS_NETWORK_LINK_SERVICE_CID, false, NULL, nsAndroidNetworkLinkServiceConstructor },
 #endif
     { &kNS_SERIALIZATION_HELPER_CID, false, NULL, nsSerializationHelperConstructor },
@@ -1072,7 +1072,7 @@ static const mozilla::Module::ContractIDEntry kNeckoContracts[] = {
     { NS_NETWORK_LINK_SERVICE_CONTRACTID, &kNS_NETWORK_LINK_SERVICE_CID },
 #elif defined(MOZ_ENABLE_QTNETWORK)
     { NS_NETWORK_LINK_SERVICE_CONTRACTID, &kNS_NETWORK_LINK_SERVICE_CID },
-#elif defined(ANDROID)
+#elif defined(MOZ_WIDGET_ANDROID)
     { NS_NETWORK_LINK_SERVICE_CONTRACTID, &kNS_NETWORK_LINK_SERVICE_CID },
 #endif
     { NS_SERIALIZATION_HELPER_CONTRACTID, &kNS_SERIALIZATION_HELPER_CID },
diff --git a/netwerk/protocol/device/Makefile.in b/netwerk/protocol/device/Makefile.in
index 0634fa209a23..51f56a9db0d4 100644
--- a/netwerk/protocol/device/Makefile.in
+++ b/netwerk/protocol/device/Makefile.in
@@ -51,7 +51,7 @@ CPPSRCS = \
   nsDeviceProtocolHandler.cpp \
   $(NULL)
 
-ifeq (Android,$(OS_TARGET))
+ifeq (android,$(MOZ_WIDGET_TOOLKIT))
 CPPSRCS += AndroidCaptureProvider.cpp \
            CameraStreamImpl.cpp \
            $(NULL)
diff --git a/netwerk/protocol/device/nsDeviceChannel.cpp b/netwerk/protocol/device/nsDeviceChannel.cpp
index 3d77756093d5..96a34caa1b43 100644
--- a/netwerk/protocol/device/nsDeviceChannel.cpp
+++ b/netwerk/protocol/device/nsDeviceChannel.cpp
@@ -41,7 +41,7 @@
 #include "nsDeviceCaptureProvider.h"
 #include "mozilla/Preferences.h"
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidCaptureProvider.h"
 #endif
 
@@ -140,7 +140,7 @@ nsDeviceChannel::OpenContentStream(bool aAsync,
     if (!captureParams.height)
       captureParams.height = 480;
     captureParams.bpp = 32;
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     capture = GetAndroidCaptureProvider();
 #endif
   } else if (kNotFound != spec.Find(NS_LITERAL_CSTRING("type=video/x-raw-yuv"),
@@ -164,7 +164,7 @@ nsDeviceChannel::OpenContentStream(bool aAsync,
     captureParams.bpp = 32;
     captureParams.timeLimit = 0;
     captureParams.frameLimit = 60000;
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     // only enable if "device.camera.enabled" is true.
     if (mozilla::Preferences::GetBool("device.camera.enabled", false) == true)
       capture = GetAndroidCaptureProvider();
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index dec2a83f6a3e..1c4ae7d25288 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -1853,6 +1853,9 @@ nsHttpChannel::ProcessNotModified()
     rv = UpdateExpirationTime();
     if (NS_FAILED(rv)) return rv;
 
+    rv = AddCacheEntryHeaders(mCacheEntry);
+    if (NS_FAILED(rv)) return rv;
+
     // notify observers interested in looking at a reponse that has been
     // merged with any cached headers
     gHttpHandler->OnExamineMergedResponse(this);
diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.cpp b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
index 07661bbc8e0e..f43770c3797c 100644
--- a/netwerk/protocol/http/nsHttpNTLMAuth.cpp
+++ b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
@@ -22,6 +22,7 @@
  * Contributor(s):
  *   Darin Fisher <darin@meer.net>
  *   Jim Mathies <jmathies@mozilla.com>
+ *   Guillermo Robla Vicario <groblavicario@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -52,6 +53,9 @@
 #include "nsIServiceManager.h"
 #include "nsIHttpAuthenticableChannel.h"
 #include "nsIURI.h"
+#include "nsIX509Cert.h"
+#include "nsISSLStatus.h"
+#include "nsISSLStatusProvider.h"
 
 static const char kAllowProxies[] = "network.automatic-ntlm-auth.allow-proxies";
 static const char kTrustedURIs[]  = "network.automatic-ntlm-auth.trusted-uris";
@@ -235,6 +239,9 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpAuthenticableChannel *channel,
     LOG(("nsHttpNTLMAuth::ChallengeReceived [ss=%p cs=%p]\n",
          *sessionState, *continuationState));
 
+    // Use the native NTLM if available
+    mUseNative = true;
+
     // NOTE: we don't define any session state, but we do use the pointer.
 
     *identityInvalid = false;
@@ -298,6 +305,8 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpAuthenticableChannel *channel,
             // see bug 520607 for details.
             LOG(("Trying to fall back on internal ntlm auth.\n"));
             module = do_CreateInstance(NS_AUTH_MODULE_CONTRACTID_PREFIX "ntlm");
+	    
+            mUseNative = false;
 
             // Prompt user for domain, username, and password.
             *identityInvalid = true;
@@ -366,8 +375,61 @@ nsHttpNTLMAuth::GenerateCredentials(nsIHttpAuthenticableChannel *authChannel,
         if (NS_FAILED(rv))
             return rv;
 
+// This update enables updated Windows machines (Win7 or patched previous
+// versions) and Linux machines running Samba (updated for Channel 
+// Binding), to perform Channel Binding when authenticating using NTLMv2 
+// and an outer secure channel.
+// 
+// Currently only implemented for Windows, linux support will be landing in 
+// a separate patch, update this #ifdef accordingly then.
+#if defined (XP_WIN) /* || defined (LINUX) */
+        // We should retrieve the server certificate and compute the CBT, 
+        // but only when we are using the native NTLM implementation and 
+        // not the internal one.
+        // It is a valid case not having the security info object.  This
+        // occures when we connect an https site through an ntlm proxy.
+        // After the ssl tunnel has been created, we get here the second
+        // time and now generate the CBT from now valid security info.
+        nsCOMPtr<nsIChannel> channel = do_QueryInterface(authChannel, &rv);
+        if (NS_FAILED(rv))
+            return rv;
+
+        nsCOMPtr<nsISupports> security;
+        rv = channel->GetSecurityInfo(getter_AddRefs(security));
+        if (NS_FAILED(rv))
+            return rv;
+
+        nsCOMPtr<nsISSLStatusProvider> statusProvider =
+            do_QueryInterface(security);
+
+        if (mUseNative && statusProvider) {
+            nsCOMPtr<nsISSLStatus> status;
+            rv = statusProvider->GetSSLStatus(getter_AddRefs(status));
+            if (NS_FAILED(rv))
+                return rv;
+
+            nsCOMPtr<nsIX509Cert> cert;
+            rv = status->GetServerCert(getter_AddRefs(cert));
+            if (NS_FAILED(rv))
+                return rv;
+
+            PRUint32 length;
+            PRUint8* certArray;
+            cert->GetRawDER(&length, &certArray);						  
+			
+            // If there is a server certificate, we pass it along the
+            // first time we call GetNextToken().
+            inBufLen = length;
+            inBuf = certArray;
+        } else { 
+            // If there is no server certificate, we don't pass anything.
+            inBufLen = 0;
+            inBuf = nsnull;
+        }
+#else // Extended protection update is just for Linux and Windows machines.
         inBufLen = 0;
         inBuf = nsnull;
+#endif
     }
     else {
         // decode challenge; skip past "NTLM " to the start of the base64
diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.h b/netwerk/protocol/http/nsHttpNTLMAuth.h
index ed22a3f59393..9384568a95c8 100644
--- a/netwerk/protocol/http/nsHttpNTLMAuth.h
+++ b/netwerk/protocol/http/nsHttpNTLMAuth.h
@@ -20,6 +20,7 @@
  *
  * Contributor(s):
  *   Darin Fisher <darin@netscape.com>
+ *   Guillermo Robla Vicario <groblavicario@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -48,6 +49,11 @@ public:
 
     nsHttpNTLMAuth() {}
     virtual ~nsHttpNTLMAuth() {}
+
+private:
+    // This flag indicates whether we are using the native NTLM implementation
+    // or the internal one.
+    bool  mUseNative;
 };
 
 #endif // !nsHttpNTLMAuth_h__
diff --git a/netwerk/protocol/http/nsHttpPipeline.cpp b/netwerk/protocol/http/nsHttpPipeline.cpp
index 46eeb8cf5b5b..1ed0b9075513 100644
--- a/netwerk/protocol/http/nsHttpPipeline.cpp
+++ b/netwerk/protocol/http/nsHttpPipeline.cpp
@@ -166,7 +166,8 @@ nsHttpPipeline::OnHeadersAvailable(nsAHttpTransaction *trans,
 nsresult
 nsHttpPipeline::ResumeSend()
 {
-    NS_NOTREACHED("nsHttpPipeline::ResumeSend");
+    if (mConnection)
+        return mConnection->ResumeSend();
     return NS_ERROR_UNEXPECTED;
 }
 
@@ -411,7 +412,17 @@ nsHttpPipeline::OnTransportStatus(nsITransport* transport,
 bool
 nsHttpPipeline::IsDone()
 {
-    return (mRequestQ.Length() == 0) && (mResponseQ.Length() == 0);
+    bool done = true;
+    
+    PRUint32 i, count = mRequestQ.Length();
+    for (i = 0; done && (i < count); i++)
+        done = Request(i)->IsDone();
+
+    count = mResponseQ.Length();
+    for (i = 0; done && (i < count); i++)
+        done = Response(i)->IsDone();
+    
+    return done;
 }
 
 nsresult
diff --git a/netwerk/streamconv/converters/nsMultiMixedConv.cpp b/netwerk/streamconv/converters/nsMultiMixedConv.cpp
index 3092999453ac..0fe4ef6baf60 100644
--- a/netwerk/streamconv/converters/nsMultiMixedConv.cpp
+++ b/netwerk/streamconv/converters/nsMultiMixedConv.cpp
@@ -463,7 +463,29 @@ nsMultiMixedConv::AsyncConvertData(const char *aFromType, const char *aToType,
     return NS_OK;
 }
 
-#define ERR_OUT { free(buffer); return rv; }
+// AutoFree implementation to prevent memory leaks
+class AutoFree
+{
+public:
+  AutoFree() : mBuffer(NULL) {}
+
+  AutoFree(char *buffer) : mBuffer(buffer) {}
+
+  ~AutoFree() {
+    free(mBuffer);
+  }
+
+  AutoFree& operator=(char *buffer) {
+    mBuffer = buffer;
+    return *this;
+  }
+
+  operator char*() const {
+    return mBuffer;
+  }
+private:
+  char *mBuffer;
+};
 
 // nsIStreamListener implementation
 NS_IMETHODIMP
@@ -474,7 +496,7 @@ nsMultiMixedConv::OnDataAvailable(nsIRequest *request, nsISupports *context,
         return NS_ERROR_FAILURE;
 
     nsresult rv = NS_OK;
-    char *buffer = nsnull;
+    AutoFree buffer = nsnull;
     PRUint32 bufLen = 0, read = 0;
 
     NS_ASSERTION(request, "multimixed converter needs a request");
@@ -548,12 +570,12 @@ nsMultiMixedConv::OnDataAvailable(nsIRequest *request, nsISupports *context,
         // us in the previous OnDataAvailable callback.
         bool done = false;
         rv = ParseHeaders(channel, cursor, bufLen, &done);
-        if (NS_FAILED(rv)) ERR_OUT
+        if (NS_FAILED(rv)) return rv;
 
         if (done) {
             mProcessingHeaders = false;
             rv = SendStart(channel);
-            if (NS_FAILED(rv)) ERR_OUT
+            if (NS_FAILED(rv)) return rv;
         }
     }
 
@@ -563,7 +585,6 @@ nsMultiMixedConv::OnDataAvailable(nsIRequest *request, nsISupports *context,
         if (*(token+mTokenLen+1) == '-') {
             // This was the last delimiter so we can stop processing
             rv = SendData(cursor, LengthToToken(cursor, token));
-            free(buffer);
             if (NS_FAILED(rv)) return rv;
             return SendStop(NS_OK);
         }
@@ -573,7 +594,7 @@ nsMultiMixedConv::OnDataAvailable(nsIRequest *request, nsISupports *context,
             NS_ASSERTION(!mProcessingHeaders, "we should be pushing raw data");
             rv = SendData(cursor, LengthToToken(cursor, token));
             bufLen -= token - cursor;
-            if (NS_FAILED(rv)) ERR_OUT
+            if (NS_FAILED(rv)) return rv;
         }
         // XXX else NS_ASSERTION(token == cursor, "?");
         token += mTokenLen;
@@ -586,10 +607,10 @@ nsMultiMixedConv::OnDataAvailable(nsIRequest *request, nsISupports *context,
             cursor = token;
             bool done = false; 
             rv = ParseHeaders(channel, cursor, bufLen, &done);
-            if (NS_FAILED(rv)) ERR_OUT
+            if (NS_FAILED(rv)) return rv;
             if (done) {
                 rv = SendStart(channel);
-                if (NS_FAILED(rv)) ERR_OUT
+                if (NS_FAILED(rv)) return rv;
             }
             else {
                 // we haven't finished processing header info.
@@ -609,7 +630,7 @@ nsMultiMixedConv::OnDataAvailable(nsIRequest *request, nsISupports *context,
             mByteRangeEnd = 0;
             
             rv = SendStop(NS_OK);
-            if (NS_FAILED(rv)) ERR_OUT
+            if (NS_FAILED(rv)) return rv;
             // reset the token to front. this allows us to treat
             // the token as a starting token.
             token -= mTokenLen + tokenLinefeed;
@@ -639,16 +660,15 @@ nsMultiMixedConv::OnDataAvailable(nsIRequest *request, nsISupports *context,
 
     if (bufAmt) {
         rv = BufferData(cursor + (bufLen - bufAmt), bufAmt);
-        if (NS_FAILED(rv)) ERR_OUT
+        if (NS_FAILED(rv)) return rv;
         bufLen -= bufAmt;
     }
 
     if (bufLen) {
         rv = SendData(cursor, bufLen);
-        if (NS_FAILED(rv)) ERR_OUT
+        if (NS_FAILED(rv)) return rv;
     }
 
-    free(buffer);
     return rv;
 }
 
diff --git a/netwerk/test/unit/test_bug669001.js b/netwerk/test/unit/test_bug669001.js
new file mode 100644
index 000000000000..d4adff0005c4
--- /dev/null
+++ b/netwerk/test/unit/test_bug669001.js
@@ -0,0 +1,158 @@
+do_load_httpd_js();
+
+var httpServer = null;
+var path = "/bug699001";
+var URI = "http://localhost:4444" + path;
+
+function make_channel(url) {
+  var ios = Cc["@mozilla.org/network/io-service;1"].
+            getService(Ci.nsIIOService);
+  return ios.newChannel(url, "", null);
+}
+
+var fetched;
+
+// The test loads a resource that expires in one year, has an etag and varies only by User-Agent
+// First we load it, then check we load it only from the cache w/o even checking with the server
+// Then we modify our User-Agent and try it again
+// We have to get a new content (even though with the same etag) and again on next load only from
+// cache w/o accessing the server
+// Goal is to check we've updated User-Agent request header in cache after we've got 304 response
+// from the server
+
+var tests = [
+{
+  prepare: function() { },
+  test: function(response) {
+    do_check_true(fetched);
+  }
+},
+{
+  prepare: function() { },
+  test: function(response) {
+    do_check_false(fetched);
+  }
+},
+{
+  prepare: function() {
+    setUA("A different User Agent");
+  },
+  test: function(response) {
+    do_check_true(fetched);
+  }
+},
+{
+  prepare: function() { },
+  test: function(response) {
+    do_check_false(fetched);
+  }
+},
+{
+  prepare: function() {
+    setUA("And another User Agent");
+  },
+  test: function(response) {
+    do_check_true(fetched);
+  }
+},
+{
+  prepare: function() { },
+  test: function(response) {
+    do_check_false(fetched);
+  }
+}
+];
+
+function handler(metadata, response)
+{
+  if (metadata.hasHeader("If-None-Match")) {
+    response.setStatusLine(metadata.httpVersion, 304, "Not modified");
+  }
+  else {
+    response.setStatusLine(metadata.httpVersion, 200, "OK");
+    response.setHeader("Content-Type", "text/plain");
+
+    var body = "body";
+    response.bodyOutputStream.write(body, body.length);
+  }
+
+  fetched = true;
+
+  response.setHeader("Expires", getDateString(+1));
+  response.setHeader("Cache-Control", "private");
+  response.setHeader("Vary", "User-Agent");
+  response.setHeader("ETag", "1234");
+}
+
+function run_test()
+{
+  httpServer = new nsHttpServer();
+  httpServer.registerPathHandler(path, handler);
+  httpServer.start(4444);
+
+  do_test_pending();
+
+  nextTest();
+}
+
+function nextTest()
+{
+  fetched = false;
+  tests[0].prepare();
+
+  dump("Testing with User-Agent: " + getUA() + "\n");
+  var chan = make_channel(URI);
+
+  // Give the old channel a chance to close the cache entry first.
+  // XXX This is actually a race condition that might be considered a bug...
+  do_execute_soon(function() {
+    chan.asyncOpen(new ChannelListener(checkAndShiftTest, null), null);
+  });
+}
+
+function checkAndShiftTest(request, response)
+{
+  tests[0].test(response);
+
+  tests.shift();
+  if (tests.length == 0) {
+    httpServer.stop(tearDown);
+    return;
+  }
+
+  nextTest();
+}
+
+function tearDown()
+{
+  setUA("");
+  do_test_finished();
+}
+
+// Helpers
+
+function getUA()
+{
+  var httphandler = Cc["@mozilla.org/network/protocol;1?name=http"].
+                 getService(Ci.nsIHttpProtocolHandler);
+  return httphandler.userAgent;
+}
+
+function setUA(value)
+{
+  var prefs = Cc["@mozilla.org/preferences-service;1"].
+                 getService(Ci.nsIPrefBranch);
+  prefs.setCharPref("general.useragent.override", value);
+}
+
+function getDateString(yearDelta) {
+  var months = [ 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug',
+          'Sep', 'Oct', 'Nov', 'Dec' ];
+  var days = [ 'Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat' ];
+
+  var d = new Date();
+  return days[d.getUTCDay()] + ", " + d.getUTCDate() + " "
+          + months[d.getUTCMonth()] + " " + (d.getUTCFullYear() + yearDelta)
+          + " " + d.getUTCHours() + ":" + d.getUTCMinutes() + ":"
+          + d.getUTCSeconds() + " UTC";
+}
diff --git a/netwerk/test/unit/test_multipart_streamconv_missing_lead_boundary.js b/netwerk/test/unit/test_multipart_streamconv_missing_lead_boundary.js
new file mode 100644
index 000000000000..87ea7ccc275e
--- /dev/null
+++ b/netwerk/test/unit/test_multipart_streamconv_missing_lead_boundary.js
@@ -0,0 +1,93 @@
+do_load_httpd_js();
+
+var httpserver = null;
+var uri = "http://localhost:4444/multipart";
+
+function make_channel(url) {
+  var ios = Cc["@mozilla.org/network/io-service;1"].
+            getService(Ci.nsIIOService);
+  return ios.newChannel(url, "", null);
+}
+
+var multipartBody = "\r\nSome text\r\n--boundary\r\n\r\n<?xml version='1.0'?><root/>\r\n--boundary--";
+
+function make_channel(url) {
+  var ios = Cc["@mozilla.org/network/io-service;1"].
+            getService(Ci.nsIIOService);
+  return ios.newChannel(url, "", null);
+}
+
+function contentHandler(metadata, response)
+{
+  response.setHeader("Content-Type", 'multipart/mixed; boundary="boundary"');
+  response.bodyOutputStream.write(multipartBody, multipartBody.length);
+}
+
+var numTests = 2;
+var testNum = 0;
+
+var testData =
+  [
+   { data: "Some text", type: "text/plain" },
+   { data: "<?xml version='1.0'?><root/>", type: "text/xml" }
+  ];
+
+function responseHandler(request, buffer)
+{
+    do_check_eq(buffer, testData[testNum].data);
+    do_check_eq(request.QueryInterface(Ci.nsIChannel).contentType,
+		testData[testNum].type);
+    if (++testNum == numTests)
+	httpserver.stop(do_test_finished);
+}
+
+var multipartListener = {
+  _buffer: "",
+
+  QueryInterface: function(iid) {
+    if (iid.equals(Components.interfaces.nsIStreamListener) ||
+        iid.equals(Components.interfaces.nsIRequestObserver) ||
+        iid.equals(Components.interfaces.nsISupports))
+      return this;
+    throw Components.results.NS_ERROR_NO_INTERFACE;
+  },
+
+  onStartRequest: function(request, context) {
+    this._buffer = "";
+  },
+
+  onDataAvailable: function(request, context, stream, offset, count) {
+    try {
+      this._buffer = this._buffer.concat(read_stream(stream, count));
+      dump("BUFFEEE: " + this._buffer + "\n\n");
+    } catch (ex) {
+      do_throw("Error in onDataAvailable: " + ex);
+    }
+  },
+
+  onStopRequest: function(request, context, status) {
+    try {
+      responseHandler(request, this._buffer);
+    } catch (ex) {
+      do_throw("Error in closure function: " + ex);
+    }
+  }  
+};
+
+function run_test()
+{
+  httpserver = new nsHttpServer();
+  httpserver.registerPathHandler("/multipart", contentHandler);
+  httpserver.start(4444);
+
+  var streamConv = Cc["@mozilla.org/streamConverters;1"]
+                     .getService(Ci.nsIStreamConverterService);
+  var conv = streamConv.asyncConvertData("multipart/mixed",
+					 "*/*",
+					 multipartListener,
+					 null);
+
+  var chan = make_channel(uri);
+  chan.asyncOpen(conv, null);
+  do_test_pending();
+}
diff --git a/netwerk/test/unit/xpcshell.ini b/netwerk/test/unit/xpcshell.ini
index 22cce7358748..a06cd6e4a5e5 100644
--- a/netwerk/test/unit/xpcshell.ini
+++ b/netwerk/test/unit/xpcshell.ini
@@ -82,6 +82,7 @@ fail-if = os == "android"
 [test_bug660066.js]
 [test_bug667907.js]
 [test_bug667818.js]
+[test_bug669001.js]
 [test_cacheflags.js]
 [test_channel_close.js]
 [test_compareURIs.js]
@@ -130,6 +131,7 @@ skip-if = os == "android"
 [test_localstreams.js]
 [test_MIME_params.js]
 [test_multipart_streamconv.js]
+[test_multipart_streamconv_missing_lead_boundary.js]
 [test_nestedabout_serialize.js]
 [test_nojsredir.js]
 [test_offline_status.js]
diff --git a/other-licenses/android/APKOpen.cpp b/other-licenses/android/APKOpen.cpp
index e0083ba2cdca..b49d6eb1eb88 100644
--- a/other-licenses/android/APKOpen.cpp
+++ b/other-licenses/android/APKOpen.cpp
@@ -241,7 +241,7 @@ SHELL_WRAPPER1(onChangeNetworkLinkStatus, jstring)
 SHELL_WRAPPER1(reportJavaCrash, jstring)
 SHELL_WRAPPER0(executeNextRunnable)
 SHELL_WRAPPER1(cameraCallbackBridge, jbyteArray)
-SHELL_WRAPPER2(notifyBatteryChange, jfloat, jboolean);
+SHELL_WRAPPER3(notifyBatteryChange, jdouble, jboolean, jdouble);
 
 static void * xul_handle = NULL;
 static time_t apk_mtime = 0;
diff --git a/security/manager/Makefile.in b/security/manager/Makefile.in
index 1c16ad7b23f7..f48964f07911 100644
--- a/security/manager/Makefile.in
+++ b/security/manager/Makefile.in
@@ -260,8 +260,14 @@ DEFAULT_GMAKE_FLAGS += \
 	OS_RELEASE="2.6" \
 	OS_PTHREAD= \
 	STANDARDS_CFLAGS="-std=gnu89" \
-	ARCHFLAG="$(CFLAGS) -DCHECK_FORK_GETPID -DRTLD_NOLOAD=0 -DANDROID_VERSION=$(ANDROID_VERSION) -include $(ABS_topsrcdir)/security/manager/android_stub.h" \
 	$(NULL)
+
+ifeq ($(MOZ_WIDGET_TOOLKIT),android)
+DEFAULT_GMAKE_FLAGS += ARCHFLAG="$(CFLAGS) -DCHECK_FORK_GETPID -DRTLD_NOLOAD=0 -DANDROID_VERSION=$(ANDROID_VERSION) -include $(ABS_topsrcdir)/security/manager/android_stub.h"
+else
+DEFAULT_GMAKE_FLAGS += ARCHFLAG="$(CFLAGS) -DCHECK_FORK_GETPID -DRTLD_NOLOAD=0 -include $(ABS_topsrcdir)/security/manager/android_stub.h"
+endif
+
 endif
 endif
 
diff --git a/security/manager/android_stub.h b/security/manager/android_stub.h
index a8690f1c9790..00b91098bdb8 100644
--- a/security/manager/android_stub.h
+++ b/security/manager/android_stub.h
@@ -41,6 +41,7 @@
 #define ANDROID_STUB_H
 
 #include "dlfcn.h"
+#ifdef ANDROID_VERSION
 #if ANDROID_VERSION < 8
 /* because dladdr isn't supported in android 2.1 and older.
  * however, it exists in the android repos so.. maybe someday. */
@@ -50,6 +51,7 @@ typedef struct {
 
 #define dladdr(foo, bar) 0
 #endif
+#endif
 
 /* sysinfo is defined but not implemented.
  * we may be able to implement it ourselves. */
diff --git a/security/manager/boot/src/nsSecureBrowserUIImpl.cpp b/security/manager/boot/src/nsSecureBrowserUIImpl.cpp
index 770bc930586f..1e62e243bcda 100644
--- a/security/manager/boot/src/nsSecureBrowserUIImpl.cpp
+++ b/security/manager/boot/src/nsSecureBrowserUIImpl.cpp
@@ -1511,7 +1511,8 @@ nsresult nsSecureBrowserUIImpl::TellTheWorld(bool showWarning,
 NS_IMETHODIMP
 nsSecureBrowserUIImpl::OnLocationChange(nsIWebProgress* aWebProgress,
                                         nsIRequest* aRequest,
-                                        nsIURI* aLocation)
+                                        nsIURI* aLocation,
+                                        PRUint32 aFlags)
 {
 #ifdef DEBUG
   nsAutoAtomic atomic(mOnStateLocationChangeReentranceDetection);
@@ -1551,9 +1552,10 @@ nsSecureBrowserUIImpl::OnLocationChange(nsIWebProgress* aWebProgress,
     NS_ASSERTION(window, "Window has gone away?!");
   }
 
-  // If the location change does not have a corresponding request, then we
-  // assume that it does not impact the security state.
-  if (!aRequest)
+  // When |aRequest| is null, basically we don't trust that document. But if
+  // docshell insists that the document has not changed at all, we will reuse
+  // the previous security state, no matter what |aRequest| may be.
+  if (aFlags & LOCATION_CHANGE_SAME_DOCUMENT)
     return NS_OK;
 
   // The location bar has changed, so we must update the security state.  The
diff --git a/services/crypto/component/Makefile.in b/services/crypto/component/Makefile.in
index 73b12b22cb94..3a77beae665a 100644
--- a/services/crypto/component/Makefile.in
+++ b/services/crypto/component/Makefile.in
@@ -55,7 +55,6 @@ EXPORT_LIBRARY = 1
 IS_COMPONENT   = 1
 MODULE_NAME    = nsServicesCryptoModule
 LIBXUL_LIBRARY = 1
-FORCE_USE_PIC  = 1
 MOZILLA_INTERNAL_API = 1
 
 CPPSRCS = \
diff --git a/services/sync/tests/tps/all_tests.json b/services/sync/tests/tps/all_tests.json
index 9e0178bed882..43f4bedea210 100644
--- a/services/sync/tests/tps/all_tests.json
+++ b/services/sync/tests/tps/all_tests.json
@@ -21,8 +21,7 @@
     "test_privbrw_tabs.js",
     "test_bookmarks_in_same_named_folder.js",
     "test_client_wipe.js",
-    "test_special_tabs.js",
-    "test_mozmill_sanity.js"
+    "test_special_tabs.js"
   ]
 }
 
diff --git a/services/sync/tests/tps/test_addon_sanity.js b/services/sync/tests/tps/test_addon_sanity.js
new file mode 100644
index 000000000000..78d56f4908dc
--- /dev/null
+++ b/services/sync/tests/tps/test_addon_sanity.js
@@ -0,0 +1,50 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/*
+ * The list of phases mapped to their corresponding profiles.  The object
+ * here must be in strict JSON format, as it will get parsed by the Python
+ * testrunner (no single quotes, extra comma's, etc).
+ */
+
+var phases = { "phase1": "profile1",
+               "phase2": "profile1",
+               "phase3": "profile1",
+               "phase4": "profile1",
+               "phase5": "profile1" };
+
+/*
+ * Test phases
+ */
+
+Phase('phase1', [
+  [Addons.install, ['unsigned-1.0.xml']],
+  [Addons.verify, ['unsigned-xpi@tests.mozilla.org'], STATE_DISABLED],
+  [Sync, SYNC_WIPE_SERVER],
+]);
+
+Phase('phase2', [
+  [Sync],
+  [Addons.verify, ['unsigned-xpi@tests.mozilla.org'], STATE_ENABLED],
+  [Addons.setState, ['unsigned-xpi@tests.mozilla.org'], STATE_DISABLED],
+  [Sync],
+]);
+
+Phase('phase3', [
+  [Sync],
+  [Addons.verify, ['unsigned-xpi@tests.mozilla.org'], STATE_DISABLED],
+  [Addons.setState, ['unsigned-xpi@tests.mozilla.org'], STATE_ENABLED],
+  [Sync],
+]);
+
+Phase('phase4', [
+  [Sync],
+  [Addons.verify, ['unsigned-xpi@tests.mozilla.org'], STATE_ENABLED],
+  [Addons.uninstall, ['unsigned-xpi@tests.mozilla.org']],
+  [Sync],
+]);
+
+Phase('phase5', [
+  [Sync],
+  [Addons.verifyNot, ['unsigned-xpi@tests.mozilla.org']],
+]);
diff --git a/services/sync/tests/tps/unsigned-1.0.xml b/services/sync/tests/tps/unsigned-1.0.xml
new file mode 100644
index 000000000000..e311f47ddcc9
--- /dev/null
+++ b/services/sync/tests/tps/unsigned-1.0.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<searchresults total_results="1">
+  <addon id="5612">
+  <name>Unsigned Test XPI</name>
+  <type id="1">Extension</type>
+  <guid>unsigned-xpi@tests.mozilla.org</guid>
+  <slug>unsigned-xpi</slug>
+  <version>1.0</version>
+
+  <compatible_applications><application>
+      <name>Firefox</name>
+      <application_id>1</application_id>
+      <min_version>3.6</min_version>
+      <max_version>*</max_version>
+      <appID>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</appID>
+    </application></compatible_applications>
+  <all_compatible_os><os>ALL</os></all_compatible_os>
+
+  <install os="ALL" size="452">http://127.0.0.1:4567/unsigned-1.0.xpi</install>
+    <created epoch="1252903662">
+      2009-09-14T04:47:42Z
+    </created>
+    <last_updated epoch="1315255329">
+      2011-09-05T20:42:09Z
+    </last_updated>
+    </addon>
+</searchresults>
\ No newline at end of file
diff --git a/services/sync/tests/tps/unsigned-1.0.xpi b/services/sync/tests/tps/unsigned-1.0.xpi
new file mode 100644
index 000000000000..51b00475a964
Binary files /dev/null and b/services/sync/tests/tps/unsigned-1.0.xpi differ
diff --git a/services/sync/tests/unit/xpcshell.ini b/services/sync/tests/unit/xpcshell.ini
index 30a5cd837512..f8cc583e624f 100644
--- a/services/sync/tests/unit/xpcshell.ini
+++ b/services/sync/tests/unit/xpcshell.ini
@@ -30,9 +30,8 @@ tail =
 # Bug 676978: test hangs on Android (see also testing/xpcshell/xpcshell.ini)
 skip-if = os == "android"
 [test_errorhandler_sync_checkServerError.js]
-# Bug 604565: this test intermittently hangs on OS X debug builds.
 # Bug 676978: test hangs on Android (see also testing/xpcshell/xpcshell.ini)
-skip-if = (os == "mac" && debug) || os == "android"
+skip-if = os == "android"
 [test_forms_store.js]
 [test_forms_tracker.js]
 [test_history_engine.js]
@@ -80,13 +79,11 @@ skip-if = os == "win" || os == "android"
 [test_service_sync_401.js]
 [test_service_sync_locked.js]
 [test_service_sync_remoteSetup.js]
-# Bug 604565: this test intermittently hangs on OS X debug builds.
 # Bug 676978: test hangs on Android (see also testing/xpcshell/xpcshell.ini)
-skip-if = (os == "mac" && debug) || os == "android"
+skip-if = os == "android"
 [test_service_sync_updateEnabledEngines.js]
-# Bug 604565: this test intermittently hangs on OS X debug builds.
 # Bug 676978: test hangs on Android (see also testing/xpcshell/xpcshell.ini)
-skip-if = (os == "mac" && debug) || os == "android"
+skip-if = os == "android"
 [test_service_verifyLogin.js]
 [test_service_wipeClient.js]
 [test_service_wipeServer.js]
@@ -94,9 +91,8 @@ skip-if = (os == "mac" && debug) || os == "android"
 [test_status_checkSetup.js]
 [test_syncengine.js]
 [test_syncengine_sync.js]
-# Bug 604565: this test intermittently hangs on OS X debug builds.
 # Bug 676978: test hangs on Android (see also testing/xpcshell/xpcshell.ini)
-skip-if = (os == "mac" && debug) || os == "android"
+skip-if = os == "android"
 [test_syncscheduler.js]
 [test_syncstoragerequest.js]
 [test_tab_engine.js]
diff --git a/services/sync/tps/extensions/tps/modules/addons.jsm b/services/sync/tps/extensions/tps/modules/addons.jsm
new file mode 100644
index 000000000000..9324b7a0fade
--- /dev/null
+++ b/services/sync/tps/extensions/tps/modules/addons.jsm
@@ -0,0 +1,252 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Crossweave.
+ *
+ * The Initial Developer of the Original Code is Mozilla.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Jonathan Griffin <jgriffin@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+var EXPORTED_SYMBOLS = ["Addon", "STATE_ENABLED", "STATE_DISABLED"];
+
+const CC = Components.classes;
+const CI = Components.interfaces;
+const CU = Components.utils;
+
+CU.import("resource://gre/modules/AddonManager.jsm");
+CU.import("resource://gre/modules/AddonRepository.jsm");
+CU.import("resource://gre/modules/Services.jsm");
+CU.import("resource://services-sync/async.js");
+CU.import("resource://services-sync/util.js");
+CU.import("resource://tps/logger.jsm");
+var XPIProvider = CU.import("resource://gre/modules/XPIProvider.jsm")
+                  .XPIProvider;
+
+const ADDONSGETURL = 'http://127.0.0.1:4567/';
+const STATE_ENABLED = 1;
+const STATE_DISABLED = 2;
+
+function GetFileAsText(file)
+{
+  let channel = Services.io.newChannel(file, null, null);
+  let inputStream = channel.open();
+  if (channel instanceof CI.nsIHttpChannel && 
+      channel.responseStatus != 200) {
+    return "";
+  }
+
+  let streamBuf = "";
+  let sis = CC["@mozilla.org/scriptableinputstream;1"]
+            .createInstance(CI.nsIScriptableInputStream);
+  sis.init(inputStream);
+
+  let available;
+  while ((available = sis.available()) != 0) {
+    streamBuf += sis.read(available);
+  }
+
+  inputStream.close();
+  return streamBuf;
+}
+
+function Addon(TPS, id) {
+  this.TPS = TPS;
+  this.id = id;
+}
+
+Addon.prototype = {
+  _addons_requiring_restart: [],
+  _addons_pending_install: [],
+
+  Delete: function() {
+    // find our addon locally
+    let cb = Async.makeSyncCallback();
+    XPIProvider.getAddonsByTypes(null, cb);
+    let results =  Async.waitForSyncCallback(cb);
+    var addon;
+    var id = this.id;
+    results.forEach(function(result) {
+      if (result.id == id) {
+        addon = result;
+      }
+    });
+    Logger.AssertTrue(!!addon, 'could not find addon ' + this.id + ' to uninstall');
+    addon.uninstall();
+  },
+
+  Find: function(state) {
+    let cb = Async.makeSyncCallback();
+    let addon_found = false;
+    var that = this;
+
+    var log_addon = function(addon) {
+      that.addon = addon;
+      Logger.logInfo('addon ' + addon.id + ' found, isActive: ' + addon.isActive);
+      if (state == STATE_ENABLED || state == STATE_DISABLED) {
+          Logger.AssertEqual(addon.isActive,
+            state == STATE_ENABLED ? true : false,
+            "addon " + that.id + " has an incorrect enabled state");
+      }
+    };
+
+    // first look in the list of all addons
+    XPIProvider.getAddonsByTypes(null, cb);
+    let addonlist = Async.waitForSyncCallback(cb);
+    addonlist.forEach(function(addon) {
+      if (addon.id == that.id) {
+        addon_found = true;
+        log_addon.call(that, addon);
+      }
+    });
+
+    if (!addon_found) {
+      // then look in the list of recent installs
+      cb = Async.makeSyncCallback();
+      XPIProvider.getInstallsByTypes(null, cb);
+      addonlist = Async.waitForSyncCallback(cb);
+      for (var i in addonlist) {
+        if (addonlist[i].addon && addonlist[i].addon.id == that.id &&
+            addonlist[i].state == AddonManager.STATE_INSTALLED) {
+          addon_found = true;
+          log_addon.call(that, addonlist[i].addon);
+        }
+      }
+    }
+
+    return addon_found;
+  },
+
+  Install: function() {
+    // For Install, the id parameter initially passed is really the filename
+    // for the addon's install .xml; we'll read the actual id from the .xml.
+    let url = this.id;
+
+    // set the url used by getAddonsByIDs
+    var prefs = CC["@mozilla.org/preferences-service;1"]
+                .getService(CI.nsIPrefBranch);
+    prefs.setCharPref('extensions.getAddons.get.url', ADDONSGETURL + url);
+
+    // read the XML and find the addon id
+    xml = GetFileAsText(ADDONSGETURL + url);
+    Logger.AssertTrue(xml.indexOf("<guid>") > -1, 'guid not found in ' + url);
+    this.id = xml.substring(xml.indexOf("<guid>") + 6, xml.indexOf("</guid"));
+    Logger.logInfo('addon XML = ' + this.id);
+
+    // find our addon on 'AMO'
+    let cb = Async.makeSyncCallback();
+    AddonRepository.getAddonsByIDs([this.id], {
+      searchSucceeded: cb,
+      searchFailed: cb
+    }, false);
+
+    // Result will be array of addons on searchSucceeded or undefined on
+    // searchFailed.
+    let install_addons = Async.waitForSyncCallback(cb);
+
+    Logger.AssertTrue(install_addons,
+                      "no addons found for id " + this.id);
+    Logger.AssertEqual(install_addons.length,
+                       1,
+                       "multiple addons found for id " + this.id);
+
+    let addon = install_addons[0];
+    Logger.logInfo(JSON.stringify(addon), null, ' ');
+    if (XPIProvider.installRequiresRestart(addon)) {
+      this._addons_requiring_restart.push(addon.id);
+    }
+
+    // Start installing the addon asynchronously; finish up in
+    // onInstallEnded(), onInstallFailed(), or onDownloadFailed().
+    this._addons_pending_install.push(addon.id);
+    this.TPS.StartAsyncOperation();
+
+    Utils.nextTick(function() {
+      let callback = function(aInstall) {
+        addon.install = aInstall;
+        Logger.logInfo("addon install: " + addon.install);
+        Logger.AssertTrue(addon.install,
+                          "could not get install object for id " + this.id);
+        addon.install.addListener(this);
+        addon.install.install();
+      };
+
+      AddonManager.getInstallForURL(addon.sourceURI.spec,
+                                    callback.bind(this),
+                                    "application/x-xpinstall");
+    }, this);
+  },
+
+  SetState: function(state) {
+    if (!this.Find())
+      return false;
+    this.addon.userDisabled = state == STATE_ENABLED ? false : true;
+      return true;
+  },
+
+  // addon installation callbacks
+  onInstallEnded: function(addon) {
+    try {
+      Logger.logInfo('--------- event observed: addon onInstallEnded');
+      Logger.AssertTrue(addon.addon,
+        "No addon object in addon instance passed to onInstallEnded");
+      Logger.AssertTrue(this._addons_pending_install.indexOf(addon.addon.id) > -1,
+        "onInstallEnded received for unexpected addon " + addon.addon.id);
+      this._addons_pending_install.splice(
+        this._addons_pending_install.indexOf(addon.addon.id),
+        1);
+    }
+    catch(e) {
+      // We can't throw during a callback, as it will just get eaten by
+      // the callback's caller.
+      Utils.nextTick(function() {
+        this.DumpError(e);
+      }, this);
+      return;
+    }
+    this.TPS.FinishAsyncOperation();
+  },
+
+  onInstallFailed: function(addon) {
+    Logger.logInfo('--------- event observed: addon onInstallFailed');
+    Utils.nextTick(function() {
+      this.DumpError('Installation failed for addon ' + 
+        (addon.addon && addon.addon.id ? addon.addon.id : 'unknown'));
+    }, this);
+  },
+
+  onDownloadFailed: function(addon) {
+    Logger.logInfo('--------- event observed: addon onDownloadFailed');
+    Utils.nextTick(function() {
+      this.DumpError('Download failed for addon ' + 
+        (addon.addon && addon.addon.id ? addon.addon.id : 'unknown'));
+    }, this);
+  },
+
+};
diff --git a/services/sync/tps/extensions/tps/modules/tps.jsm b/services/sync/tps/extensions/tps/modules/tps.jsm
index d9c20014a4e0..3824405b7a0a 100644
--- a/services/sync/tps/extensions/tps/modules/tps.jsm
+++ b/services/sync/tps/extensions/tps/modules/tps.jsm
@@ -48,9 +48,11 @@ const CU = Components.utils;
 
 CU.import("resource://services-sync/service.js");
 CU.import("resource://services-sync/constants.js");
+CU.import("resource://services-sync/async.js");
 CU.import("resource://services-sync/util.js");
 CU.import("resource://gre/modules/XPCOMUtils.jsm");
 CU.import("resource://gre/modules/Services.jsm");
+CU.import("resource://tps/addons.jsm");
 CU.import("resource://tps/bookmarks.jsm");
 CU.import("resource://tps/logger.jsm");
 CU.import("resource://tps/passwords.jsm");
@@ -61,6 +63,8 @@ CU.import("resource://tps/tabs.jsm");
 
 var hh = CC["@mozilla.org/network/protocol;1?name=http"]
          .getService(CI.nsIHttpProtocolHandler);
+var prefs = CC["@mozilla.org/preferences-service;1"]
+            .getService(CI.nsIPrefBranch);
 
 var mozmillInit = {}; 
 CU.import('resource://mozmill/modules/init.js', mozmillInit);
@@ -73,37 +77,16 @@ const ACTION_SYNC = "sync";
 const ACTION_DELETE = "delete";
 const ACTION_PRIVATE_BROWSING = "private-browsing";
 const ACTION_WIPE_SERVER = "wipe-server";
+const ACTION_SETSTATE = "set-state";
 const ACTIONS = [ACTION_ADD, ACTION_VERIFY, ACTION_VERIFY_NOT, 
                  ACTION_MODIFY, ACTION_SYNC, ACTION_DELETE,
-                 ACTION_PRIVATE_BROWSING, ACTION_WIPE_SERVER];
+                 ACTION_PRIVATE_BROWSING, ACTION_WIPE_SERVER,
+                 ACTION_SETSTATE];
 
 const SYNC_WIPE_SERVER = "wipe-server";
 const SYNC_RESET_CLIENT = "reset-client";
 const SYNC_WIPE_CLIENT = "wipe-client";
 
-function GetFileAsText(file)
-{
-  let channel = Services.io.newChannel(file, null, null);
-  let inputStream = channel.open();
-  if (channel instanceof CI.nsIHttpChannel && 
-      channel.responseStatus != 200) {
-    return "";
-  }
-
-  let streamBuf = "";
-  let sis = CC["@mozilla.org/scriptableinputstream;1"]
-            .createInstance(CI.nsIScriptableInputStream);
-  sis.init(inputStream);
-
-  let available;
-  while ((available = sis.available()) != 0) {
-    streamBuf += sis.read(available);
-  }
-
-  inputStream.close();
-  return streamBuf;
-}
-
 var TPS = 
 {
   _waitingForSync: false,
@@ -351,6 +334,33 @@ var TPS =
     }
   },
 
+  HandleAddons: function (addons, action, state) {
+    for (var i in addons) {
+      Logger.logInfo("executing action " + action.toUpperCase() + 
+                     " on addon " + JSON.stringify(addons[i]));
+      var addon = new Addon(this, addons[i]);
+      switch(action) {
+        case ACTION_ADD:
+          addon.Install();
+          break;
+        case ACTION_DELETE:
+          addon.Delete();
+          break;
+        case ACTION_VERIFY:
+          Logger.AssertTrue(addon.Find(state), 'addon ' + addon.id + ' not found');
+          break;
+        case ACTION_VERIFY_NOT:
+          Logger.AssertTrue(!addon.Find(state), 'addon ' + addon.id + " is present, but it shouldn't be");
+          break;
+        case ACTION_SETSTATE:
+          Logger.AssertTrue(addon.SetState(state), 'addon ' + addon.id + ' not found');
+          break;
+      }
+    }
+    Logger.logPass("executing action " + action.toUpperCase() + 
+                   " on addons");
+  },
+
   HandleBookmarks: function (bookmarks, action) {
     try {
       let items = [];
@@ -460,7 +470,7 @@ var TPS =
       let phase = this._phaselist["phase" + this._currentPhase];
       let action = phase[this._currentAction];
       Logger.logInfo("starting action: " + JSON.stringify(action));
-      action[0].call(this, action[1]);
+      action[0].apply(this, action.slice(1));
 
       // if we're in an async operation, don't continue on to the next action
       if (this._operations_pending)
@@ -517,8 +527,6 @@ var TPS =
 
       // Store account details as prefs so they're accessible to the mozmill
       // framework.
-      let prefs = CC["@mozilla.org/preferences-service;1"]
-                  .getService(CI.nsIPrefBranch);
       prefs.setCharPref('tps.account.username', this.config.account.username);
       prefs.setCharPref('tps.account.password', this.config.account.password);
       prefs.setCharPref('tps.account.passphrase', this.config.account.passphrase);
@@ -634,6 +642,24 @@ var TPS =
   },
 };
 
+var Addons = {
+  install: function Addons__install(addons) {
+    TPS.HandleAddons(addons, ACTION_ADD);
+  },
+  setState: function Addons__setState(addons, state) {
+    TPS.HandleAddons(addons, ACTION_SETSTATE, state);
+  },
+  uninstall: function Addons__uninstall(addons) {
+    TPS.HandleAddons(addons, ACTION_DELETE);
+  },
+  verify: function Addons__verify(addons, state) {
+    TPS.HandleAddons(addons, ACTION_VERIFY, state);
+  },
+  verifyNot: function Addons__verifyNot(addons) {
+    TPS.HandleAddons(addons, ACTION_VERIFY_NOT);
+  },
+};
+
 var Bookmarks = {
   add: function Bookmarks__add(bookmarks) {
     TPS.HandleBookmarks(bookmarks, ACTION_ADD);
diff --git a/storage/src/TelemetryVFS.cpp b/storage/src/TelemetryVFS.cpp
index 6bbec8183104..3d74dea45d28 100644
--- a/storage/src/TelemetryVFS.cpp
+++ b/storage/src/TelemetryVFS.cpp
@@ -69,6 +69,7 @@ Histograms gHistograms[] = {
   SQLITE_TELEMETRY("places.sqlite", PLACES),
   SQLITE_TELEMETRY("urlclassifier3.sqlite", URLCLASSIFIER),
   SQLITE_TELEMETRY("cookies.sqlite", COOKIES),
+  SQLITE_TELEMETRY("webappsstore.sqlite", WEBAPPS),
   SQLITE_TELEMETRY(NULL, OTHER)
 };
 #undef SQLITE_TELEMETRY
diff --git a/storage/src/mozStorageConnection.cpp b/storage/src/mozStorageConnection.cpp
index 5f8d08aa2fd8..c492250f0ee1 100644
--- a/storage/src/mozStorageConnection.cpp
+++ b/storage/src/mozStorageConnection.cpp
@@ -72,6 +72,13 @@
 
 #define MIN_AVAILABLE_BYTES_PER_CHUNKED_GROWTH 524288000 // 500 MiB
 
+// Maximum size of the pages cache per connection.  If the default cache_size
+// value evaluates to a larger size, it will be reduced to save memory.
+#define MAX_CACHE_SIZE_BYTES 4194304 // 4 MiB
+
+// Default maximum number of pages to allow in the connection pages cache.
+#define DEFAULT_CACHE_SIZE_PAGES 2000
+
 #ifdef PR_LOGGING
 PRLogModuleInfo* gStorageLog = nsnull;
 #endif
@@ -548,16 +555,39 @@ Connection::initialize(nsIFile *aDatabaseFile,
   PR_LOG(gStorageLog, PR_LOG_NOTICE, ("Opening connection to '%s' (%p)",
                                       leafName.get(), this));
 #endif
-  // Switch db to preferred page size in case the user vacuums.
+
+  // Set page_size to the preferred default value.  This is effective only if
+  // the database has just been created, otherwise, if the database does not
+  // use WAL journal mode, a VACUUM operation will updated its page_size.
+  PRInt64 pageSize = DEFAULT_PAGE_SIZE;
+  nsCAutoString pageSizeQuery("PRAGMA page_size = ");
+  pageSizeQuery.AppendInt(pageSize);
+  rv = ExecuteSimpleSQL(pageSizeQuery);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Get the current page_size, since it may differ from the specified value.
   sqlite3_stmt *stmt;
-  nsCAutoString pageSizeQuery(NS_LITERAL_CSTRING("PRAGMA page_size = "));
-  pageSizeQuery.AppendInt(DEFAULT_PAGE_SIZE);
-  srv = prepareStmt(mDBConn, pageSizeQuery, &stmt);
+  srv = prepareStmt(mDBConn, NS_LITERAL_CSTRING("PRAGMA page_size"), &stmt);
   if (srv == SQLITE_OK) {
-    (void)stepStmt(stmt);
+    if (SQLITE_ROW == stepStmt(stmt)) {
+      PRInt64 pageSize = ::sqlite3_column_int64(stmt, 0);
+    }
     (void)::sqlite3_finalize(stmt);
   }
 
+  // Setting the cache_size forces the database open, verifying if it is valid
+  // or corrupt.  So this is executed regardless it being actually needed.
+  // The cache_size is calculated from the actual page_size, to save memory.
+  nsCAutoString cacheSizeQuery("PRAGMA cache_size = ");
+  cacheSizeQuery.AppendInt(NS_MIN(DEFAULT_CACHE_SIZE_PAGES,
+                                  PRInt32(MAX_CACHE_SIZE_BYTES / pageSize)));
+  srv = ::sqlite3_exec(mDBConn, cacheSizeQuery.get(), NULL, NULL, NULL);
+  if (srv != SQLITE_OK) {
+    ::sqlite3_close(mDBConn);
+    mDBConn = nsnull;
+    return convertResultCode(srv);
+  }
+
   // Register our built-in SQL functions.
   srv = registerFunctions(mDBConn);
   if (srv != SQLITE_OK) {
@@ -574,25 +604,6 @@ Connection::initialize(nsIFile *aDatabaseFile,
     return convertResultCode(srv);
   }
 
-  // Execute a dummy statement to force the db open, and to verify if it is
-  // valid or not.
-  srv = prepareStmt(mDBConn, NS_LITERAL_CSTRING("SELECT * FROM sqlite_master"),
-                    &stmt);
-  if (srv == SQLITE_OK) {
-    srv = stepStmt(stmt);
-
-    if (srv == SQLITE_DONE || srv == SQLITE_ROW)
-        srv = SQLITE_OK;
-    ::sqlite3_finalize(stmt);
-  }
-
-  if (srv != SQLITE_OK) {
-    ::sqlite3_close(mDBConn);
-    mDBConn = nsnull;
-
-    return convertResultCode(srv);
-  }
-
   // Set the synchronous PRAGMA, according to the preference.
   switch (Service::getSynchronousPref()) {
     case 2:
diff --git a/storage/test/unit/fakeDB.sqlite b/storage/test/unit/fakeDB.sqlite
new file mode 100644
index 000000000000..5f7498bfc2d1
--- /dev/null
+++ b/storage/test/unit/fakeDB.sqlite
@@ -0,0 +1 @@
+BACON
diff --git a/storage/test/unit/head_storage.js b/storage/test/unit/head_storage.js
index beb9aa63bb6f..3536bde3df4e 100644
--- a/storage/test/unit/head_storage.js
+++ b/storage/test/unit/head_storage.js
@@ -58,6 +58,14 @@ function getCorruptDB()
   return do_get_file("corruptDB.sqlite");
 }
 
+/**
+ * Obtains a fake (non-SQLite format) database to test against.
+ */
+function getFakeDB()
+{
+  return do_get_file("fakeDB.sqlite");
+}
+
 function cleanup()
 {
   // close the connection
diff --git a/storage/test/unit/test_page_size_is_32k.js b/storage/test/unit/test_page_size_is_32k.js
index a69405a6caa9..51d53c22ecee 100644
--- a/storage/test/unit/test_page_size_is_32k.js
+++ b/storage/test/unit/test_page_size_is_32k.js
@@ -4,12 +4,18 @@
 
 // This file tests that dbs are using 32k pagesize
 
+const kExpectedPageSize = 32768; // 32K
+const kExpectedCacheSize = 128; // (4MiB / 32KiB)
+
 function check_size(db)
 {
   var stmt = db.createStatement("PRAGMA page_size");
   stmt.executeStep();
-  const expected_block_size = 32768; // 32K
-  do_check_eq(stmt.getInt32(0), expected_block_size);
+  do_check_eq(stmt.getInt32(0), kExpectedPageSize);
+  stmt.finalize();
+  stmt = db.createStatement("PRAGMA cache_size");
+  stmt.executeStep();
+  do_check_eq(stmt.getInt32(0), kExpectedCacheSize);
   stmt.finalize();
 }
 
diff --git a/storage/test/unit/test_storage_service.js b/storage/test/unit/test_storage_service.js
index 9bc1a1ba0d6f..91d87a771649 100644
--- a/storage/test/unit/test_storage_service.js
+++ b/storage/test/unit/test_storage_service.js
@@ -105,6 +105,17 @@ function test_corrupt_db_throws_with_openDatabase()
   }
 }
 
+function test_fake_db_throws_with_openDatabase()
+{
+  try {
+    getDatabase(getFakeDB());
+    do_throw("should not be here");
+  }
+  catch (e) {
+    do_check_eq(Cr.NS_ERROR_FILE_CORRUPTED, e.result);
+  }
+}
+
 function test_backup_not_new_filename()
 {
   const fname = getTestDB().leafName;
@@ -147,6 +158,7 @@ var tests = [
   test_openDatabase_file_DNE,
   test_openDatabase_file_exists,
   test_corrupt_db_throws_with_openDatabase,
+  test_fake_db_throws_with_openDatabase,
   test_backup_not_new_filename,
   test_backup_new_filename,
   test_backup_new_folder,
diff --git a/testing/mochitest/Makefile.in b/testing/mochitest/Makefile.in
index 2a8eb7dd21a4..6e38bc9c4331 100644
--- a/testing/mochitest/Makefile.in
+++ b/testing/mochitest/Makefile.in
@@ -82,7 +82,6 @@ _SERV_FILES = 	\
 		$(topsrcdir)/build/mobile/devicemanagerADB.py \
 		$(topsrcdir)/build/mobile/devicemanagerSUT.py \
 		$(topsrcdir)/build/automationutils.py \
-		$(topsrcdir)/build/poster.zip \
 		$(topsrcdir)/build/mobile/remoteautomation.py \
 		gen_template.pl \
 		server.js \
diff --git a/testing/mochitest/browser-test.js b/testing/mochitest/browser-test.js
index 4e50fa3f6b7d..b3a869c78465 100644
--- a/testing/mochitest/browser-test.js
+++ b/testing/mochitest/browser-test.js
@@ -168,7 +168,7 @@ Tester.prototype = {
                          "\tTodo: " + todoCount + "\n");
       } else {
         this.dumper.dump("TEST-UNEXPECTED-FAIL | (browser-test.js) | " +
-                         "No tests to run. Did you pass an invalid --test-path?");
+                         "No tests to run. Did you pass an invalid --test-path?\n");
       }
   
       this.dumper.dump("\n*** End BrowserChrome Test Results ***\n");
@@ -188,7 +188,7 @@ Tester.prototype = {
       if (this.currentTest)
         this.currentTest.addResult(new testMessage(msg));
       else
-        this.dumper.dump("TEST-INFO | (browser-test.js) | " + msg);
+        this.dumper.dump("TEST-INFO | (browser-test.js) | " + msg.replace(/\n$/, "") + "\n");
     } catch (ex) {
       // Swallow exception so we don't lead to another error being reported,
       // throwing us into an infinite loop
@@ -471,6 +471,10 @@ function testScope(aTester, aTest) {
     self.SimpleTest.expectUncaughtException();
   };
 
+  this.ignoreAllUncaughtExceptions = function test_ignoreAllUncaughtExceptions() {
+    self.SimpleTest.ignoreAllUncaughtExceptions();
+  };
+
   this.finish = function test_finish() {
     self.__done = true;
     if (self.SimpleTest._expectingUncaughtException) {
diff --git a/testing/mochitest/tests/SimpleTest/SimpleTest.js b/testing/mochitest/tests/SimpleTest/SimpleTest.js
index d8f6ebd856a0..4b958f722e11 100644
--- a/testing/mochitest/tests/SimpleTest/SimpleTest.js
+++ b/testing/mochitest/tests/SimpleTest/SimpleTest.js
@@ -15,24 +15,35 @@
 **/
 
 var SimpleTest = { };
-
 var parentRunner = null;
-if (parent) {
-    parentRunner = parent.TestRunner;
-    if (!parentRunner && parent.wrappedJSObject) {
-        parentRunner = parent.wrappedJSObject.TestRunner;
+var isPrimaryTestWindow = !!parent.TestRunner;
+
+// Finds the TestRunner for this test run and the SpecialPowers object (in
+// case it is not defined) from a parent/opener window.
+//
+// Finding the SpecialPowers object is needed when we have ChromePowers in
+// harness.xul and we need SpecialPowers in the iframe, and also for tests
+// like test_focus.xul where we open a window which opens another window which
+// includes SimpleTest.js.
+(function() {
+    function ancestor(w) {
+        return w.parent != w ? w.parent : w.opener;
     }
 
-    // This is the case where we have ChromePowers in harness.xul and we need it in the iframe
-    if (window.SpecialPowers == undefined && parent.SpecialPowers !== undefined) {
-        window.SpecialPowers = parent.SpecialPowers;
+    var w = ancestor(window);
+    while (w && (!parentRunner || !window.SpecialPowers)) {
+        if (!parentRunner) {
+            parentRunner = w.TestRunner;
+            if (!parentRunner && w.wrappedJSObject) {
+                parentRunner = w.wrappedJSObject.TestRunner;
+            }
+        }
+        if (!window.SpecialPowers) {
+            window.SpecialPowers = w.SpecialPowers;
+        }
+        w = ancestor(w);
     }
-}
-
-// Workaround test_focus.xul where we open a window which opens another window which includes SimpleTest.js
-if (window.SpecialPowers == undefined && window.opener && window.opener.SpecialPowers !== undefined) {
-    window.SpecialPowers = window.opener.SpecialPowers;
-}
+})();
 
 /* Helper functions pulled out of various MochiKit modules */
 if (typeof(repr) == 'undefined') {
@@ -703,12 +714,22 @@ SimpleTest.expectUncaughtException = function () {
     SimpleTest._expectingUncaughtException = true;
 };
 
+/**
+ * Indicates to the test framework that all of the uncaught exceptions
+ * during the test are known problems that should be fixed in the future,
+ * but which should not cause the test to fail currently.
+ */
+SimpleTest.ignoreAllUncaughtExceptions = function () {
+    SimpleTest._ignoringAllUncaughtExceptions = true;
+};
 
-addLoadEvent(function() {
-    if (SimpleTest._stopOnLoad) {
-        SimpleTest.finish();
-    }
-});
+if (isPrimaryTestWindow) {
+    addLoadEvent(function() {
+        if (SimpleTest._stopOnLoad) {
+            SimpleTest.finish();
+        }
+    });
+}
 
 //  --------------- Test.Builder/Test.More isDeeply() -----------------
 
@@ -924,19 +945,18 @@ window.onerror = function simpletestOnerror(errorMsg, url, lineNumber) {
 
     // Log the message.
     // XXX Chrome mochitests sometimes trigger this window.onerror handler,
-    // but there are a number of uncaught JS exceptions from those tests
-    // currently, so we can't log them as errors just yet.  For now, when
-    // not in a plain mochitest, just dump it so that the error is visible but
-    // doesn't cause a test failure.  See bug 652494.
+    // but there are a number of uncaught JS exceptions from those tests.
+    // For now, for tests that self identify as having unintentional uncaught
+    // exceptions, just dump it so that the error is visible but doesn't cause
+    // a test failure.  See bug 652494.
     var message = "An error occurred: " + errorMsg + " at " + url + ":" + lineNumber;
     var href = SpecialPowers.getPrivilegedProps(window, 'location.href');
-    var isPlainMochitest = href.substring(0,7) != "chrome:";
     var isExpected = !!SimpleTest._expectingUncaughtException;
-    if (isPlainMochitest) {
+    if (!SimpleTest._ignoringAllUncaughtExceptions) {
         SimpleTest.ok(isExpected, funcIdentifier, message);
         SimpleTest._expectingUncaughtException = false;
     } else {
-        SimpleTest.info(funcIdentifier + " " + message);
+        SimpleTest.todo(false, funcIdentifier, message);
     }
     // There is no Components.stack.caller to log. (See bug 511888.)
 
diff --git a/testing/testsuite-targets.mk b/testing/testsuite-targets.mk
index e51169333ff9..4889c2018552 100644
--- a/testing/testsuite-targets.mk
+++ b/testing/testsuite-targets.mk
@@ -55,6 +55,10 @@ SYMBOLS_PATH := --symbols-path=$(DIST)/crashreporter-symbols
 MOCHITESTS := mochitest-plain mochitest-chrome mochitest-a11y mochitest-ipcplugins
 mochitest:: $(MOCHITESTS)
 
+ifndef TEST_PACKAGE_NAME
+TEST_PACKAGE_NAME := $(ANDROID_PACKAGE_NAME)
+endif
+
 RUN_MOCHITEST = \
 	rm -f ./$@.log && \
 	$(PYTHON) _tests/testing/mochitest/runtests.py --autorun --close-when-done \
@@ -65,7 +69,7 @@ RUN_MOCHITEST_REMOTE = \
 	rm -f ./$@.log && \
 	$(PYTHON) _tests/testing/mochitest/runtestsremote.py --autorun --close-when-done \
 	  --console-level=INFO --log-file=./$@.log --file-level=INFO $(DM_FLAGS) --dm_trans=$(DM_TRANS) \
-	  --app=$(ANDROID_PACKAGE_NAME) --deviceIP=${TEST_DEVICE} --xre-path=${MOZ_HOST_BIN} \
+	  --app=$(TEST_PACKAGE_NAME) --deviceIP=${TEST_DEVICE} --xre-path=${MOZ_HOST_BIN} \
 	  $(SYMBOLS_PATH) $(TEST_PATH_ARG) $(EXTRA_TEST_ARGS)
 
 ifndef NO_FAIL_ON_TEST_ERRORS
@@ -129,7 +133,7 @@ RUN_REFTEST = rm -f ./$@.log && $(PYTHON) _tests/reftest/runreftest.py \
 
 REMOTE_REFTEST = rm -f ./$@.log && $(PYTHON) _tests/reftest/remotereftest.py \
   --dm_trans=$(DM_TRANS) --ignore-window-size \
-  --app=$(ANDROID_PACKAGE_NAME) --deviceIP=${TEST_DEVICE} --xre-path=${MOZ_HOST_BIN} \
+  --app=$(TEST_PACKAGE_NAME) --deviceIP=${TEST_DEVICE} --xre-path=${MOZ_HOST_BIN} \
   $(SYMBOLS_PATH) $(EXTRA_TEST_ARGS) $(1) | tee ./$@.log
 
 ifeq ($(OS_ARCH),WINNT) #{
diff --git a/testing/tps/tps/__init__.py b/testing/tps/tps/__init__.py
index 6d710ca4ce5c..a9ad3167302d 100644
--- a/testing/tps/tps/__init__.py
+++ b/testing/tps/tps/__init__.py
@@ -38,4 +38,5 @@
 from firefoxrunner import TPSFirefoxRunner
 from pulse import TPSPulseMonitor
 from testrunner import TPSTestRunner
+from mozhttpd import MozHttpd
 
diff --git a/testing/tps/tps/mozhttpd.py b/testing/tps/tps/mozhttpd.py
new file mode 100644
index 000000000000..daccf8ff41a2
--- /dev/null
+++ b/testing/tps/tps/mozhttpd.py
@@ -0,0 +1,111 @@
+#!/usr/bin/python
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# the Mozilla Foundation.
+# Portions created by the Initial Developer are Copyright (C) 2011
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#   Joel Maher <joel.maher@gmail.com>
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+import BaseHTTPServer
+import SimpleHTTPServer
+import threading
+import sys
+import os
+import urllib
+import re
+from urlparse import urlparse
+from SocketServer import ThreadingMixIn
+
+DOCROOT = '.'
+
+class EasyServer(ThreadingMixIn, BaseHTTPServer.HTTPServer):
+    allow_reuse_address = True
+    
+class MozRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
+    def translate_path(self, path):
+        # It appears that the default path is '/' and os.path.join makes the '/' 
+        o = urlparse(path)
+        return "%s%s" % ('' if sys.platform == 'win32' else '/', '/'.join([i.strip('/') for i in (DOCROOT, o.path)]))
+
+    # I found on my local network that calls to this were timing out
+    # I believe all of these calls are from log_message
+    def address_string(self):
+        return "a.b.c.d"
+
+    # This produces a LOT of noise
+    def log_message(self, format, *args):
+        pass
+
+class MozHttpd(object):
+    def __init__(self, host="127.0.0.1", port=8888, docroot='.'):
+        global DOCROOT
+        self.host = host
+        self.port = int(port)
+        DOCROOT = docroot
+
+    def start(self):
+        self.httpd = EasyServer((self.host, self.port), MozRequestHandler)
+        self.server = threading.Thread(target=self.httpd.serve_forever)
+        self.server.setDaemon(True) # don't hang on exit
+        self.server.start()
+        #self.testServer()
+
+    #TODO: figure this out
+    def testServer(self):
+        fileList = os.listdir(DOCROOT)
+        filehandle = urllib.urlopen('http://%s:%s' % (self.host, self.port))
+        data = filehandle.readlines();
+        filehandle.close()
+
+        for line in data:
+            found = False
+            # '@' denotes a symlink and we need to ignore it.
+            webline = re.sub('\<[a-zA-Z0-9\-\_\.\=\"\'\/\\\%\!\@\#\$\^\&\*\(\) ]*\>', '', line.strip('\n')).strip('/').strip().strip('@')
+            if webline != "":
+                if webline == "Directory listing for":
+                    found = True
+                else:
+                    for fileName in fileList:
+                        if fileName == webline:
+                            found = True
+                
+                if (found == False):
+                    print "NOT FOUND: " + webline.strip()                
+
+    def stop(self):
+        if self.httpd:
+            self.httpd.shutdown()
+        
+    __del__ = stop
+
diff --git a/testing/tps/tps/testrunner.py b/testing/tps/tps/testrunner.py
index bf107b83d6d9..4ecf5287677c 100644
--- a/testing/tps/tps/testrunner.py
+++ b/testing/tps/tps/testrunner.py
@@ -53,7 +53,7 @@ from mozprofile import Profile
 
 from tps.firefoxrunner import TPSFirefoxRunner
 from tps.phase import TPSTestPhase
-
+from tps.mozhttpd import MozHttpd
 
 class TempFile(object):
   """Class for temporary files that delete themselves when garbage-collected.
@@ -397,6 +397,9 @@ class TPSTestRunner(object):
       testlist = [os.path.basename(self.testfile)]
     testdir = os.path.dirname(self.testfile)
 
+    self.mozhttpd = MozHttpd(port=4567, docroot=testdir)
+    self.mozhttpd.start()
+
     # run each test, and save the results
     for test in testlist:
       result = self.run_single_test(testdir, test)
@@ -415,6 +418,8 @@ class TPSTestRunner(object):
       else:
         self.numfailed += 1
 
+    self.mozhttpd.stop()
+
     # generate the postdata we'll use to post the results to the db
     self.postdata = { 'tests': self.results, 
                       'os':os_string,
@@ -440,7 +445,7 @@ class TPSTestRunner(object):
                                  self.numpassed,
                                  self.numfailed,
                                  self.config['account']['serverURL'],
-                                 self.buildUrl)
+                                 buildUrl)
 
       subj = "TPS Report: "
       if self.numfailed == 0 and self.numpassed > 0:
diff --git a/testing/xpcshell/Makefile.in b/testing/xpcshell/Makefile.in
index 8528c3dba1b6..d1a37405526e 100644
--- a/testing/xpcshell/Makefile.in
+++ b/testing/xpcshell/Makefile.in
@@ -65,7 +65,6 @@ EXTRA_BUILD_FILES := \
   automationutils.py \
   manifestparser.py \
   mozinfo.py \
-  poster.zip \
   $(NULL)
 
 # And files for running xpcshell remotely from $(topsrcdir)/build/mobile
diff --git a/toolkit/components/aboutmemory/tests/chrome/test_aboutmemory.xul b/toolkit/components/aboutmemory/tests/chrome/test_aboutmemory.xul
index 4eb609d3e884..cb32c7ff96a2 100644
--- a/toolkit/components/aboutmemory/tests/chrome/test_aboutmemory.xul
+++ b/toolkit/components/aboutmemory/tests/chrome/test_aboutmemory.xul
@@ -367,11 +367,10 @@ Other Measurements\n\
     SimpleTest.finish();
   }
 
-  function check(actual, expected) {
-    var a = actual.QueryInterface(Ci.nsISupportsString).data;
-    if (a != expected) {
+  function checkClipboard(actual, expected) {
+    if (actual != expected) {
       dump("*******ACTUAL*******\n");
-      dump(a);
+      dump(actual);
       dump("******EXPECTED******\n");
       dump(expected);
       dump("********************\n");
@@ -393,7 +392,8 @@ Other Measurements\n\
 
     SimpleTest.executeSoon(function() {
       document.querySelector("#" + aFrame).focus();
-      SimpleTest.waitForClipboard(function(actual) { return check(actual, aExpectedText) },
+      SimpleTest.waitForClipboard(
+        function(actual) { return checkClipboard(actual, aExpectedText) },
         function() {
           synthesizeKey("A", {accelKey: true});
           synthesizeKey("C", {accelKey: true});
diff --git a/toolkit/components/alerts/mac/growl/CFGrowlAdditions.c b/toolkit/components/alerts/mac/growl/CFGrowlAdditions.c
index d6a63e05fd56..34d983787465 100644
--- a/toolkit/components/alerts/mac/growl/CFGrowlAdditions.c
+++ b/toolkit/components/alerts/mac/growl/CFGrowlAdditions.c
@@ -2,7 +2,7 @@
 //  CFGrowlAdditions.c
 //  Growl
 //
-//  Created by Mac-arena the Bored Zo on Wed Jun 18 2004.
+//  Created by Peter Hosey on Wed Jun 18 2004.
 //  Copyright 2005-2006 The Growl Project.
 //
 // This file is under the BSD License, refer to License.txt for details
diff --git a/toolkit/components/alerts/mac/growl/CFGrowlAdditions.h b/toolkit/components/alerts/mac/growl/CFGrowlAdditions.h
index a65d78d06ea6..dbab606df088 100644
--- a/toolkit/components/alerts/mac/growl/CFGrowlAdditions.h
+++ b/toolkit/components/alerts/mac/growl/CFGrowlAdditions.h
@@ -2,7 +2,7 @@
 //  CFGrowlAdditions.h
 //  Growl
 //
-//  Created by Mac-arena the Bored Zo on Wed Jun 18 2004.
+//  Created by Peter Hosey on Wed Jun 18 2004.
 //  Copyright 2005-2006 The Growl Project.
 //
 // This file is under the BSD License, refer to License.txt for details
diff --git a/toolkit/components/alerts/mac/growl/GrowlApplicationBridge.m b/toolkit/components/alerts/mac/growl/GrowlApplicationBridge.m
index 4996301353c5..48c4970178ef 100644
--- a/toolkit/components/alerts/mac/growl/GrowlApplicationBridge.m
+++ b/toolkit/components/alerts/mac/growl/GrowlApplicationBridge.m
@@ -293,7 +293,7 @@ static BOOL		registerWhenGrowlIsReady = NO;
 		/*if Growl launches, and the user hasn't already said NO to installing
 		 *	it, store this notification for posting
 		 */
-		if (!userChoseNotToInstallGrowl) {
+		if (!([self isGrowlInstalled] || userChoseNotToInstallGrowl)) {
 			if (!queuedGrowlNotifications)
 				queuedGrowlNotifications = [[NSMutableArray alloc] init];
 			[queuedGrowlNotifications addObject:userInfo];
@@ -448,7 +448,7 @@ static BOOL		registerWhenGrowlIsReady = NO;
 				} else {
 					[mRegDict removeObjectForKey:GROWL_APP_LOCATION];
 				}
-				[myURL release];
+				[NSMakeCollectable(myURL) release];
 			}
 		}
 	}
@@ -549,7 +549,7 @@ static BOOL		registerWhenGrowlIsReady = NO;
 	if (!iconData) {
 		NSURL *URL = copyCurrentProcessURL();
 		iconData = [copyIconDataForURL(URL) autorelease];
-		[URL release];
+		[NSMakeCollectable(URL) release];
 	}
 
 	return iconData;
@@ -724,25 +724,96 @@ static BOOL		registerWhenGrowlIsReady = NO;
 
 #pragma mark -
 
++ (OSStatus) getPSN:(struct ProcessSerialNumber *)outAppPSN forAppWithBundleAtPath:(NSString *)appPath {
+	OSStatus err;
+	while ((err = GetNextProcess(outAppPSN)) == noErr) {
+		NSDictionary *dict = [NSMakeCollectable(ProcessInformationCopyDictionary(outAppPSN, kProcessDictionaryIncludeAllInformationMask)) autorelease];
+		NSString *bundlePath = [dict objectForKey:@"BundlePath"];
+		if ([bundlePath isEqualToString:appPath]) {
+			//Match!
+			break;
+		}
+	}
+	return err;
+}
+
++ (BOOL) launchApplicationWithBundleAtPath:(NSString *)appPath openDocumentURL:(NSURL *)regItemURL {
+	const struct LSLaunchURLSpec spec = {
+		.appURL = (CFURLRef)[NSURL fileURLWithPath:appPath],
+		.itemURLs = (CFArrayRef)(regItemURL ? [NSArray arrayWithObject:regItemURL] : nil),
+		.passThruParams = NULL,
+		.launchFlags = kLSLaunchDontAddToRecents | kLSLaunchDontSwitch | kLSLaunchNoParams | kLSLaunchAsync,
+		.asyncRefCon = NULL
+	};
+	OSStatus err = LSOpenFromURLSpec(&spec, NULL);
+	if (err != noErr) {
+		NSLog(@"Could not launch application at path %@ (with document %@) because LSOpenFromURLSpec returned %i (%s)", appPath, regItemURL, err, GetMacOSStatusCommentString(err));
+	}
+	return (err == noErr);
+}
++ (BOOL) sendOpenEventToProcessWithProcessSerialNumber:(struct ProcessSerialNumber *)appPSN openDocumentURL:(NSURL *)regItemURL {
+	OSStatus err;
+	BOOL success = NO;
+	AEStreamRef stream = AEStreamCreateEvent(kCoreEventClass, kAEOpenDocuments,
+											 //Target application
+											 typeProcessSerialNumber, appPSN, sizeof(*appPSN),
+											 kAutoGenerateReturnID, kAnyTransactionID);
+	if (!stream) {
+		NSLog(@"%@: Could not create open-document event to register this application with Growl", [self class]);
+	} else {
+		if (regItemURL) {
+			NSString *regItemURLString = [regItemURL absoluteString];
+			NSData *regItemURLUTF8Data = [regItemURLString dataUsingEncoding:NSUTF8StringEncoding];
+			err = AEStreamWriteKeyDesc(stream, keyDirectObject, typeFileURL, [regItemURLUTF8Data bytes], [regItemURLUTF8Data length]);
+			if (err != noErr) {
+				NSLog(@"%@: Could not set direct object of open-document event to register this application with Growl because AEStreamWriteKeyDesc returned %li/%s", [self class], (long)err, GetMacOSStatusCommentString(err));
+			}
+		}
+
+		AppleEvent event;
+		err = AEStreamClose(stream, &event);
+		if (err != noErr) {
+			NSLog(@"%@: Could not finish open-document event to register this application with Growl because AEStreamClose returned %li/%s", [self class], (long)err, GetMacOSStatusCommentString(err));
+		} else {
+			err = AESendMessage(&event, /*reply*/ NULL, kAENoReply | kAEDontReconnect | kAENeverInteract | kAEDontRecord, kAEDefaultTimeout);
+			if (err != noErr) {
+				NSLog(@"%@: Could not send open-document event to register this application with Growl because AESend returned %li/%s", [self class], (long)err, GetMacOSStatusCommentString(err));
+			}
+
+			AEDisposeDesc(&event);
+		}
+
+		success = (err == noErr);
+	}
+
+	return success;
+}
 + (BOOL) _launchGrowlIfInstalledWithRegistrationDictionary:(NSDictionary *)regDict {
 	BOOL success = NO;
-	NSBundle *growlPrefPaneBundle;
+	NSBundle *growlPrefPaneBundle = nil;
 	NSString *growlHelperAppPath;
 
-#ifdef DEBUG
-	//For a debug build, first look for a running GHA. It might not actually be within a Growl prefpane bundle.
+	//First look for a running GHA. It might not actually be within a Growl prefpane bundle.
 	growlHelperAppPath = [[GrowlPathUtilities runningHelperAppBundle] bundlePath];
-	if (!growlHelperAppPath) {
+	if (growlHelperAppPath) {
+		//The GHA bundle path should be: .../Growl.prefPane/Contents/Resources/GrowlHelperApp.app
+		NSArray *growlHelperAppPathComponents = [growlHelperAppPath pathComponents];
+		NSString *growlPrefPaneBundlePath = [NSString pathWithComponents:[growlHelperAppPathComponents subarrayWithRange:(NSRange){ 0UL, [growlHelperAppPathComponents count] - 3UL }]];
+		growlPrefPaneBundle = [NSBundle bundleWithPath:growlPrefPaneBundlePath];
+		//Make sure we actually got a Growl.prefPane and not, say, a Growl project folder. (NSBundle can be liberal in its acceptance of a directory as a bundle at times.)
+		if (![[growlPrefPaneBundle bundleIdentifier] isEqualToString:GROWL_PREFPANE_BUNDLE_IDENTIFIER])
+			growlPrefPaneBundle = nil;
+	}
+	//If we didn't get a Growl prefpane bundle by finding the bundle that contained GHA, look it up directly.
+	if (!growlPrefPaneBundle) {
 		growlPrefPaneBundle = [GrowlPathUtilities growlPrefPaneBundle];
+	}
+	//If we don't already have the path to a running GHA, then…
+	if (!growlHelperAppPath) {
+		//Look for an installed-but-not-running GHA.
 		growlHelperAppPath = [growlPrefPaneBundle pathForResource:@"GrowlHelperApp"
 														   ofType:@"app"];
 	}
-	NSLog(@"Will use GrowlHelperApp at %@", growlHelperAppPath);
-#else
-	growlPrefPaneBundle = [GrowlPathUtilities growlPrefPaneBundle];
-	growlHelperAppPath = [growlPrefPaneBundle pathForResource:@"GrowlHelperApp"
-													   ofType:@"app"];
-#endif
 
 #ifdef GROWL_WITH_INSTALLER
 	if (growlPrefPaneBundle) {
@@ -762,16 +833,12 @@ static BOOL		registerWhenGrowlIsReady = NO;
 			struct ProcessSerialNumber appPSN = {
 				0, kNoProcess
 			};
-			while ((err = GetNextProcess(&appPSN)) == noErr) {
-				NSDictionary *dict = [(id)ProcessInformationCopyDictionary(&appPSN, kProcessDictionaryIncludeAllInformationMask) autorelease];
-				NSString *bundlePath = [dict objectForKey:@"BundlePath"];
-				if ([bundlePath isEqualToString:growlHelperAppPath]) {
-					//Match!
-					break;
-				}
-			}
+			err = [self getPSN:&appPSN forAppWithBundleAtPath:growlHelperAppPath];
+			BOOL foundGrowlProcess = (err == noErr);
+			BOOL foundNoGrowlProcess = (err == procNotFound);
 
-			if (err == noErr) {
+			//If both of these are false, the process search failed with an error (and I don't mean procNotFound).
+			if (foundGrowlProcess || foundNoGrowlProcess) {
 				NSURL *regItemURL = nil;
 				BOOL passRegDict = NO;
 
@@ -814,35 +881,10 @@ static BOOL		registerWhenGrowlIsReady = NO;
 					}
 				}
 
-				AEStreamRef stream = AEStreamCreateEvent(kCoreEventClass, kAEOpenDocuments,
-					//Target application
-					typeProcessSerialNumber, &appPSN, sizeof(appPSN),
-					kAutoGenerateReturnID, kAnyTransactionID);
-				if (!stream) {
-					NSLog(@"%@: Could not create open-document event to register this application with Growl", [self class]);
-				} else {
-					if (passRegDict) {
-						NSString *regItemURLString = [regItemURL absoluteString];
-						NSData *regItemURLUTF8Data = [regItemURLString dataUsingEncoding:NSUTF8StringEncoding];
-						err = AEStreamWriteKeyDesc(stream, keyDirectObject, typeFileURL, [regItemURLUTF8Data bytes], [regItemURLUTF8Data length]);
-						if (err != noErr) {
-							NSLog(@"%@: Could not set direct object of open-document event to register this application with Growl because AEStreamWriteKeyDesc returned %li/%s", [self class], (long)err, GetMacOSStatusCommentString(err));
-						}
-					}
-
-					AppleEvent event;
-					err = AEStreamClose(stream, &event);
-					if (err != noErr) {
-						NSLog(@"%@: Could not finish open-document event to register this application with Growl because AEStreamClose returned %li/%s", [self class], (long)err, GetMacOSStatusCommentString(err));
-					} else {
-						err = AESendMessage(&event, /*reply*/ NULL, kAENoReply | kAEDontReconnect | kAENeverInteract | kAEDontRecord, kAEDefaultTimeout);
-						if (err != noErr) {
-							NSLog(@"%@: Could not send open-document event to register this application with Growl because AESend returned %li/%s", [self class], (long)err, GetMacOSStatusCommentString(err));
-						}
-					}
-					
-					success = (err == noErr);
-				}
+				if (foundNoGrowlProcess)
+					success = [self launchApplicationWithBundleAtPath:growlHelperAppPath openDocumentURL:(passRegDict ? regItemURL : nil)];
+				else
+					success = [self sendOpenEventToProcessWithProcessSerialNumber:&appPSN openDocumentURL:(passRegDict ? regItemURL : nil)];
 			}
 		}
 	}
diff --git a/toolkit/components/alerts/mac/growl/GrowlDefinesInternal.h b/toolkit/components/alerts/mac/growl/GrowlDefinesInternal.h
index c8ab20b3ea08..1044b9a9f739 100644
--- a/toolkit/components/alerts/mac/growl/GrowlDefinesInternal.h
+++ b/toolkit/components/alerts/mac/growl/GrowlDefinesInternal.h
@@ -293,6 +293,7 @@ struct GrowlNetworkNotification {
 #define GROWL_PATHWAY_EXTENSION                 XSTR("growlPathway")
 #define GROWL_VIEW_EXTENSION					XSTR("growlView")
 #define GROWL_STYLE_EXTENSION					XSTR("growlStyle")
+#define GROWL_PATHEXTENSION_TICKET				XSTR("growlTicket")
 
 /* --- These following macros are intended for plug-ins --- */
 
diff --git a/toolkit/components/alerts/mac/growl/GrowlPathUtilities.m b/toolkit/components/alerts/mac/growl/GrowlPathUtilities.m
index f762e1627a59..6ea2da82a951 100644
--- a/toolkit/components/alerts/mac/growl/GrowlPathUtilities.m
+++ b/toolkit/components/alerts/mac/growl/GrowlPathUtilities.m
@@ -10,8 +10,6 @@
 #import <Cocoa/Cocoa.h>
 
 #import "GrowlPathUtilities.h"
-#import "GrowlPreferencesController.h"
-#import "GrowlTicketController.h"
 #import "GrowlDefinesInternal.h"
 
 static NSBundle *helperAppBundle;
diff --git a/toolkit/components/alerts/mac/growl/Makefile.in b/toolkit/components/alerts/mac/growl/Makefile.in
index 79270fe87a65..10e0c7d530d6 100644
--- a/toolkit/components/alerts/mac/growl/Makefile.in
+++ b/toolkit/components/alerts/mac/growl/Makefile.in
@@ -44,7 +44,6 @@ include $(DEPTH)/config/autoconf.mk
 MODULE = alerts
 LIBRARY_NAME = growl_s
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 CMSRCS = \
   GrowlApplicationBridge.m \
diff --git a/toolkit/components/alerts/mac/growl/license.txt b/toolkit/components/alerts/mac/growl/license.txt
index 8e8721f7239f..6cd6635db671 100644
--- a/toolkit/components/alerts/mac/growl/license.txt
+++ b/toolkit/components/alerts/mac/growl/license.txt
@@ -1,4 +1,4 @@
-Copyright (c) The Growl Project, 2004-2009
+Copyright (c) The Growl Project, 2004-2011
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
diff --git a/toolkit/components/alerts/mac/nsAlertsService.mm b/toolkit/components/alerts/mac/nsAlertsService.mm
index 0f1d6724f5c9..e7b5b427d229 100644
--- a/toolkit/components/alerts/mac/nsAlertsService.mm
+++ b/toolkit/components/alerts/mac/nsAlertsService.mm
@@ -92,8 +92,7 @@ DispatchNamedNotification(const nsAString &aName,
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  if ([GrowlApplicationBridge isGrowlInstalled] == NO ||
-      [GrowlApplicationBridge isGrowlRunning] == NO)
+  if ([GrowlApplicationBridge isGrowlRunning] == NO)
     return NS_ERROR_NOT_AVAILABLE;
 
   mozGrowlDelegate *delegate =
@@ -146,9 +145,6 @@ nsAlertsService::Init()
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  if ([GrowlApplicationBridge isGrowlInstalled] == NO)
-    return NS_ERROR_SERVICE_NOT_AVAILABLE;
-
   NS_ASSERTION([GrowlApplicationBridge growlDelegate] == nil,
                "We already registered with Growl!");
 
diff --git a/toolkit/components/build/nsToolkitCompsCID.h b/toolkit/components/build/nsToolkitCompsCID.h
index da4e3168594a..0d9bac659ca1 100644
--- a/toolkit/components/build/nsToolkitCompsCID.h
+++ b/toolkit/components/build/nsToolkitCompsCID.h
@@ -160,9 +160,9 @@
 #define NS_TYPEAHEADFIND_CID \
 { 0xe7f70966, 0x9a37, 0x48d7, { 0x8a, 0xeb, 0x35, 0x99, 0x8f, 0x31, 0x09, 0x0e} }
 
-// {42ef1d52-3351-4973-98f8-d18f089bccfa}
+// {5edc87c2-6960-44e5-8431-bdfbb56f6aff}
 #define NS_URLCLASSIFIERPREFIXSET_CID \
-{ 0x42ef1d52, 0x3351, 0x4973, { 0x98, 0xf8, 0xd1, 0x8f, 0x08, 0x9b, 0xcc, 0xfa} }
+{ 0x5edc87c2, 0x6960, 0x44e5, { 0x84, 0x31, 0xbd, 0xfb, 0xb5, 0x6f, 0x6a, 0xff} }
 
 // {5eb7c3c1-ec1f-4007-87cc-eefb37d68ce6}
 #define NS_URLCLASSIFIERDBSERVICE_CID \
diff --git a/toolkit/components/downloads/nsDownloadManager.cpp b/toolkit/components/downloads/nsDownloadManager.cpp
index 00a6e7d5b341..ca87f1a965db 100644
--- a/toolkit/components/downloads/nsDownloadManager.cpp
+++ b/toolkit/components/downloads/nsDownloadManager.cpp
@@ -83,7 +83,7 @@
 #include <CoreFoundation/CoreFoundation.h>
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidBridge.h"
 #endif
 
@@ -1178,7 +1178,7 @@ nsDownloadManager::GetDefaultDownloadsDirectory(nsILocalFile **aResult)
     rv = dirService->Get(NS_UNIX_XDG_DOCUMENTS_DIR,
                          NS_GET_IID(nsILocalFile),
                          getter_AddRefs(downloadDir));
-#elif defined(ANDROID)
+#elif defined(MOZ_WIDGET_ANDROID)
     // Android doesn't have a $HOME directory, and by default we only have
     // write access to /data/data/org.mozilla.{$APP} and /sdcard
     char* downloadDirPath = getenv("DOWNLOADS_DIRECTORY");
@@ -2254,7 +2254,7 @@ nsDownload::SetState(DownloadState aState)
         }
       }
 
-#if defined(XP_WIN) || defined(XP_MACOSX) || defined(ANDROID)
+#if defined(XP_WIN) || defined(XP_MACOSX) || defined(MOZ_WIDGET_ANDROID)
       nsCOMPtr<nsIFileURL> fileURL = do_QueryInterface(mTarget);
       nsCOMPtr<nsIFile> file;
       nsAutoString path;
@@ -2288,7 +2288,7 @@ nsDownload::SetState(DownloadState aState)
                                                observedObject, NULL, TRUE);
         ::CFRelease(observedObject);
 #endif
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
         nsCOMPtr<nsIMIMEInfo> mimeInfo;
         nsCAutoString contentType;
         GetMIMEInfo(getter_AddRefs(mimeInfo));
@@ -2482,7 +2482,8 @@ nsDownload::OnProgressChange(nsIWebProgress *aWebProgress,
 
 NS_IMETHODIMP
 nsDownload::OnLocationChange(nsIWebProgress *aWebProgress,
-                             nsIRequest *aRequest, nsIURI *aLocation)
+                             nsIRequest *aRequest, nsIURI *aLocation,
+                             PRUint32 aFlags)
 {
   return NS_OK;
 }
diff --git a/toolkit/components/downloads/nsDownloadProxy.h b/toolkit/components/downloads/nsDownloadProxy.h
index 0d4b37221bd4..ad7529a91e4e 100644
--- a/toolkit/components/downloads/nsDownloadProxy.h
+++ b/toolkit/components/downloads/nsDownloadProxy.h
@@ -123,10 +123,11 @@ public:
   }
 
   NS_IMETHODIMP OnLocationChange(nsIWebProgress *aWebProgress,
-                                 nsIRequest *aRequest, nsIURI *aLocation)
+                                 nsIRequest *aRequest, nsIURI *aLocation,
+                                 PRUint32 aFlags)
   {
     NS_ENSURE_TRUE(mInner, NS_ERROR_NOT_INITIALIZED);
-    return mInner->OnLocationChange(aWebProgress, aRequest, aLocation);
+    return mInner->OnLocationChange(aWebProgress, aRequest, aLocation, aFlags);
   }
   
   NS_IMETHODIMP OnProgressChange(nsIWebProgress *aWebProgress,
diff --git a/toolkit/components/downloads/test/unit/test_history_expiration.js b/toolkit/components/downloads/test/unit/test_history_expiration.js
index d26a7943fb0c..fb0c982a23ce 100644
--- a/toolkit/components/downloads/test/unit/test_history_expiration.js
+++ b/toolkit/components/downloads/test/unit/test_history_expiration.js
@@ -39,6 +39,23 @@
  * Make sure bug 431346 and bug 431597 don't cause crashes when batching.
  */
 
+/**
+ * Returns a PRTime in the past usable to add expirable visits.
+ *
+ * @note Expiration ignores any visit added in the last 7 days, but it's
+ *       better be safe against DST issues, by going back one day more.
+ */
+function getExpirablePRTime() {
+  let dateObj = new Date();
+  // Normalize to midnight
+  dateObj.setHours(0);
+  dateObj.setMinutes(0);
+  dateObj.setSeconds(0);
+  dateObj.setMilliseconds(0);
+  dateObj = new Date(dateObj.getTime() - 8 * 86400000);
+  return dateObj.getTime() * 1000;
+}
+
 function run_test()
 {
   // Like the code, we check to see if nav-history-service exists
@@ -88,13 +105,10 @@ function run_test()
     stmt.finalize();
   }
 
+  // Add an expirable visit to this download.
   let histsvc = Cc["@mozilla.org/browser/nav-history-service;1"].
                 getService(Ci.nsINavHistoryService);
-  // Add the download to places
-  // Add the visit in the past to circumvent possible VM timing bugs
-  // Go back by 9 days, since expiration ignores history in the last 7 days.
-  let expirableTime = Date.now() - 9 * 24 * 60 * 60 * 1000;
-  histsvc.addVisit(theURI, expirableTime * 1000, null,
+  histsvc.addVisit(theURI, getExpirablePRTime(), null,
                    histsvc.TRANSITION_DOWNLOAD, false, 0);
 
   // Get the download manager as history observer and batch expirations
diff --git a/toolkit/components/feeds/FeedProcessor.js b/toolkit/components/feeds/FeedProcessor.js
index 11a0e6ae215e..3ff51eb76753 100644
--- a/toolkit/components/feeds/FeedProcessor.js
+++ b/toolkit/components/feeds/FeedProcessor.js
@@ -865,49 +865,21 @@ function rssArrayElement(s) {
   return str;
 }
 
-/***** Some feed utils from TBird *****/
-
 /**
- * Tests a RFC822 date against a regex.
- * @param aDateStr A string to test as an RFC822 date.
- *
- * @returns A boolean indicating whether the string is a valid RFC822 date.
- */
-function isValidRFC822Date(aDateStr) {
-  var regex = new RegExp(RFC822_RE);
-  return regex.test(aDateStr);
-}
-
-// Regular expression matching RFC822 dates 
-const RFC822_RE = "^((Mon|Tue|Wed|Thu|Fri|Sat|Sun)([a-z]+)?,? *)?\\d\\d?"
-+ " +(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)([a-z]+)?"
-+ " +\\d\\d(\\d\\d)? +\\d?\\d:\\d\\d(:\\d\\d)?"
-+ " +([+-]?\\d\\d\\d\\d|GMT|UT[C]?|(E|C|M|P)(ST|DT)|[A-IK-Z])$";
-
-/**
- * XXX -- need to decide what this should return. 
- * XXX -- Is there a Date class usable from C++?
- *
- * Tries tries parsing various date formats.
- * @param dateString
+ * Tries parsing a string through the JavaScript Date object.
+ * @param aDateString
  *        A string that is supposedly an RFC822 or RFC3339 date.
- * @returns A Date.toString XXX--fixme
+ * @return A Date.toUTCString, or null if the string can't be parsed.
  */
-function dateParse(dateString) {
-  var date = dateString.trim();
-
-  // Could be a ISO8601/W3C date.
-  if (/^\d{4}/.test(date))
-    return new Date(dateString).toUTCString();
-
-  if (isValidRFC822Date(date))
-    return date; 
-
-  // Can't help.
+function dateParse(aDateString) {
+  let dateString = aDateString.trim();
+  let date = new Date(dateString);
+  if (!isNaN(date)) {
+    return date.toUTCString();
+  }
   return null;
 } 
 
-
 const XHTML_NS = "http://www.w3.org/1999/xhtml";
 
 // The XHTMLHandler handles inline XHTML found in things like atom:summary
diff --git a/toolkit/components/feeds/test/xml/rfc4287/feed_updated_invalid.xml b/toolkit/components/feeds/test/xml/rfc4287/feed_updated_invalid.xml
new file mode 100644
index 000000000000..560d756b97cb
--- /dev/null
+++ b/toolkit/components/feeds/test/xml/rfc4287/feed_updated_invalid.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!--
+
+Description: non-date atom updated should produce null feed.updated
+Expect: feed.updated == null
+
+-->
+
+<feed xmlns="http://www.w3.org/2005/Atom">
+
+  <title>Example Feed</title>
+  <link href="http://example.org/"/>
+  <updated>2003I'mNotADate</updated>
+  <author>
+       <name>John Doe</name>
+  </author>
+  <id>urn:uuid:60a76c80-d399-11d9-b93C-0003939e0af6</id>
+
+  <entry>
+    <title>Atom-Powered Robots Run Amok</title>
+    <link href="http://example.org/2003/12/13/atom03"/>
+    <id>urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6a</id>
+    <updated>2003-12-13T18:30:02Z</updated>
+    <summary>Some text.</summary>
+  </entry>
+
+</feed>
diff --git a/toolkit/components/feeds/test/xml/rss2/feed_pubDate_invalid.xml b/toolkit/components/feeds/test/xml/rss2/feed_pubDate_invalid.xml
new file mode 100644
index 000000000000..48cce256ad4a
--- /dev/null
+++ b/toolkit/components/feeds/test/xml/rss2/feed_pubDate_invalid.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!--
+
+Description: non-RFC822 date should produce null feed.updated
+Expect:      feed.updated == null
+
+-->
+<rss version="2.0" >
+<channel>
+<pubDate>Satmonkey, 07 Sepmonkey 2002 00:00:01 GMT</pubDate>
+</channel>
+</rss>
diff --git a/toolkit/components/feeds/test/xml/rss2/feed_pubDate_nonRFC822_1.xml b/toolkit/components/feeds/test/xml/rss2/feed_pubDate_nonRFC822_1.xml
index 54f8491a6a50..846ef22a61c7 100644
--- a/toolkit/components/feeds/test/xml/rss2/feed_pubDate_nonRFC822_1.xml
+++ b/toolkit/components/feeds/test/xml/rss2/feed_pubDate_nonRFC822_1.xml
@@ -1,12 +1,12 @@
 <?xml version="1.0" encoding="iso-8859-1"?>
 <!--
 
-Description: Test whether new regexp handles irregular dates.
-Expect:      feed.updated == 'Tues, 25 April 2006 08:00:00 GMT'
+Description: Test whether date parsing handles partly-abbreviated dates.
+Expect:      feed.updated == 'Tue, 25 Apr 2006 08:00:00 GMT'
 
 -->
 <rss version="2.0" >
 <channel>
-<pubDate>Tues, 25 April 2006 08:00:00 GMT</pubDate>
+<pubDate>Tues, 25 Apri 2006 08:00:00 GMT</pubDate>
 </channel>
 </rss>
diff --git a/toolkit/components/feeds/test/xml/rss2/feed_pubDate_nonRFC822_2.xml b/toolkit/components/feeds/test/xml/rss2/feed_pubDate_nonRFC822_2.xml
index cf4c96d180c4..d1ee96f367c4 100644
--- a/toolkit/components/feeds/test/xml/rss2/feed_pubDate_nonRFC822_2.xml
+++ b/toolkit/components/feeds/test/xml/rss2/feed_pubDate_nonRFC822_2.xml
@@ -1,12 +1,12 @@
 <?xml version="1.0" encoding="iso-8859-1"?>
 <!--
 
-Description: Test whether new regexp handles irregular dates.
-Expect:      feed.updated == 'Saturday 25 November 2006 3:12:45 +1000'
+Description: Test whether date parsing handles unabbreviated dates.
+Expect:      feed.updated == 'Sat, 25 Nov 2006 00:12:45 GMT'
 
 -->
 <rss version="2.0" >
 <channel>
-<pubDate>Saturday 25 November 2006 3:12:45 +1000</pubDate>
+<pubDate>Saturday 25 November 2006 10:12:45 +1000</pubDate>
 </channel>
 </rss>
diff --git a/toolkit/components/feeds/test/xml/rss2/feed_pubDate_utc.xml b/toolkit/components/feeds/test/xml/rss2/feed_pubDate_utc.xml
index 947c67b248b8..8eff560460a5 100644
--- a/toolkit/components/feeds/test/xml/rss2/feed_pubDate_utc.xml
+++ b/toolkit/components/feeds/test/xml/rss2/feed_pubDate_utc.xml
@@ -1,12 +1,12 @@
 <?xml version="1.0" encoding="iso-8859-1"?>
 <!--
 
-Description: Test whether new regexp handles irregular dates.
-Expect:      feed.updated == 'Monday, 16 April 2007 03:12:45 UTC'
+Description: Test whether date parsing handles 'UTC' as a timezone.
+Expect:      feed.updated == 'Mon, 16 Apr 2007 03:12:45 GMT'
 
 -->
 <rss version="2.0" >
 <channel>
 <pubDate>Monday, 16 April 2007 03:12:45 UTC</pubDate>
 </channel>
-</rss>
\ No newline at end of file
+</rss>
diff --git a/toolkit/components/feeds/test/xml/rss2/item_pubDate.xml b/toolkit/components/feeds/test/xml/rss2/item_pubDate.xml
index 434de2085b6b..acb4abdccac3 100644
--- a/toolkit/components/feeds/test/xml/rss2/item_pubDate.xml
+++ b/toolkit/components/feeds/test/xml/rss2/item_pubDate.xml
@@ -2,13 +2,13 @@
 <!--
 
 Description: entry pubDate works 
-Expect:      feed.items.queryElementAt(0, Components.interfaces.nsIFeedEntry).published == 'Sat, 02 Sep 2003 00:00:01 GMT'
+Expect:      feed.items.queryElementAt(0, Components.interfaces.nsIFeedEntry).published == 'Tue, 02 Sep 2003 00:00:01 GMT'
 
 -->
 <rss version="2.0" xmlns:dcterms="http://purl.org/dc/terms/">
 <channel>
 <item>
-<pubDate>Sat, 02 Sep 2003 00:00:01 GMT</pubDate>
+<pubDate>Tue, 02 Sep 2003 00:00:01 GMT</pubDate>
 </item>
 </channel>
-</rss>
\ No newline at end of file
+</rss>
diff --git a/toolkit/components/help/content/help.js b/toolkit/components/help/content/help.js
index 4a49bfb9b7c7..a86198fab504 100644
--- a/toolkit/components/help/content/help.js
+++ b/toolkit/components/help/content/help.js
@@ -543,7 +543,7 @@ nsHelpStatusHandler.prototype = {
         aMaxSelfProgress, aCurTotalProgress, aMaxTotalProgress) {},
     onStatusChange : function(aWebProgress, aRequest, aStatus, aMessage) {},
     onSecurityChange : function(aWebProgress, aRequest, state) {},
-    onLocationChange : function(aWebProgress, aRequest, aLocation) {
+    onLocationChange : function(aWebProgress, aRequest, aLocation, aFlags) {
         UpdateBackForwardButtons();
     },
     QueryInterface : function(aIID) {
diff --git a/toolkit/components/places/History.cpp b/toolkit/components/places/History.cpp
index 2ca42dd24bef..bc4735442ca8 100644
--- a/toolkit/components/places/History.cpp
+++ b/toolkit/components/places/History.cpp
@@ -356,8 +356,9 @@ public:
       return NS_OK;
     }
 
-    mozIStorageAsyncStatement* stmt =
-      History::GetService()->GetIsVisitedStatement();
+    History* history = History::GetService();
+    NS_ENSURE_STATE(history);
+    mozIStorageAsyncStatement* stmt = history->GetIsVisitedStatement();
     NS_ENSURE_STATE(stmt);
 
     // Bind by index for performance.
@@ -400,7 +401,9 @@ public:
   nsresult NotifyVisitedStatus()
   {
     if (mIsVisited) {
-      History::GetService()->NotifyVisited(mURI);
+      History* history = History::GetService();
+      NS_ENSURE_STATE(history);
+      history->NotifyVisited(mURI);
     }
 
     nsCOMPtr<nsIObserverService> observerService =
@@ -477,7 +480,9 @@ public:
       NS_WARN_IF_FALSE(NS_SUCCEEDED(rv), "Could not notify observers");
     }
 
-    History::GetService()->NotifyVisited(uri);
+    History* history = History::GetService();
+    NS_ENSURE_STATE(history);
+    history->NotifyVisited(uri);
 
     return NS_OK;
   }
diff --git a/toolkit/components/places/Makefile.in b/toolkit/components/places/Makefile.in
index c7adc223d29d..e75890dd9026 100644
--- a/toolkit/components/places/Makefile.in
+++ b/toolkit/components/places/Makefile.in
@@ -101,9 +101,6 @@ CPPSRCS = \
 
 LOCAL_INCLUDES += -I$(srcdir)/../build
 
-# This is the default value.  Must be in sync with the one defined in SQLite.
-DEFINES += -DSQLITE_DEFAULT_PAGE_SIZE=32768
-
 EXTRA_COMPONENTS = \
   toolkitplaces.manifest \
   nsLivemarkService.js \
diff --git a/toolkit/components/printing/content/printPreviewProgress.js b/toolkit/components/printing/content/printPreviewProgress.js
index 7c92958bb85c..2677c3ce8239 100644
--- a/toolkit/components/printing/content/printPreviewProgress.js
+++ b/toolkit/components/printing/content/printPreviewProgress.js
@@ -91,7 +91,7 @@ var progressListener = {
     }
   },
 
-  onLocationChange: function (aWebProgress, aRequest, aLocation) {},
+  onLocationChange: function (aWebProgress, aRequest, aLocation, aFlags) {},
   onSecurityChange: function (aWebProgress, aRequest, state) {},
 
   onStatusChange: function (aWebProgress, aRequest, aStatus, aMessage)
diff --git a/toolkit/components/printing/content/printProgress.js b/toolkit/components/printing/content/printProgress.js
index 87046b5364b7..395bfa5bfd15 100644
--- a/toolkit/components/printing/content/printProgress.js
+++ b/toolkit/components/printing/content/printProgress.js
@@ -180,7 +180,7 @@ var progressListener = {
       }
     },
 
-	  onLocationChange: function(aWebProgress, aRequest, aLocation)
+	  onLocationChange: function(aWebProgress, aRequest, aLocation, aFlags)
     {
       // we can ignore this notification
     },
diff --git a/toolkit/components/satchel/nsFormHistory.js b/toolkit/components/satchel/nsFormHistory.js
index 95d3468efade..540393a3146d 100644
--- a/toolkit/components/satchel/nsFormHistory.js
+++ b/toolkit/components/satchel/nsFormHistory.js
@@ -55,6 +55,7 @@ FormHistory.prototype = {
     QueryInterface   : XPCOMUtils.generateQI([Ci.nsIFormHistory2,
                                               Ci.nsIObserver,
                                               Ci.nsIFrameMessageListener,
+                                              Ci.nsISupportsWeakReference,
                                               ]),
 
     debug          : true,
@@ -124,9 +125,7 @@ FormHistory.prototype = {
 
 
     init : function() {
-        let self = this;
-
-        Services.prefs.addObserver("browser.formfill.", this, false);
+        Services.prefs.addObserver("browser.formfill.", this, true);
 
         this.updatePrefs();
 
@@ -138,8 +137,8 @@ FormHistory.prototype = {
         this.messageManager.addMessageListener("FormHistory:FormSubmitEntries", this);
 
         // Add observers
-        Services.obs.addObserver(this, "idle-daily", false);
-        Services.obs.addObserver(this, "formhistory-expire-now", false);
+        Services.obs.addObserver(this, "idle-daily", true);
+        Services.obs.addObserver(this, "formhistory-expire-now", true);
     },
 
     /* ---- message listener ---- */
diff --git a/toolkit/components/statusfilter/nsBrowserStatusFilter.cpp b/toolkit/components/statusfilter/nsBrowserStatusFilter.cpp
index 1158f6fa728e..34dfd8bac1f7 100644
--- a/toolkit/components/statusfilter/nsBrowserStatusFilter.cpp
+++ b/toolkit/components/statusfilter/nsBrowserStatusFilter.cpp
@@ -223,12 +223,14 @@ nsBrowserStatusFilter::OnProgressChange(nsIWebProgress *aWebProgress,
 NS_IMETHODIMP
 nsBrowserStatusFilter::OnLocationChange(nsIWebProgress *aWebProgress,
                                         nsIRequest *aRequest,
-                                        nsIURI *aLocation)
+                                        nsIURI *aLocation,
+                                        PRUint32 aFlags)
 {
     if (!mListener)
         return NS_OK;
 
-    return mListener->OnLocationChange(aWebProgress, aRequest, aLocation);
+    return mListener->OnLocationChange(aWebProgress, aRequest, aLocation,
+                                       aFlags);
 }
 
 NS_IMETHODIMP
diff --git a/toolkit/components/telemetry/TelemetryHistograms.h b/toolkit/components/telemetry/TelemetryHistograms.h
index 3f636942a293..5bfce5b984ab 100644
--- a/toolkit/components/telemetry/TelemetryHistograms.h
+++ b/toolkit/components/telemetry/TelemetryHistograms.h
@@ -184,7 +184,8 @@ HISTOGRAM(CHECK_JAVA_ENABLED, 1, 3000, 10, EXPONENTIAL, "Time spent checking if
   SQLITE_TIME_SPENT(OTHER_ ## NAME, DESC) \
   SQLITE_TIME_SPENT(PLACES_ ## NAME, DESC) \
   SQLITE_TIME_SPENT(COOKIES_ ## NAME, DESC) \
-  SQLITE_TIME_SPENT(URLCLASSIFIER_ ## NAME, DESC)
+  SQLITE_TIME_SPENT(URLCLASSIFIER_ ## NAME, DESC) \
+  SQLITE_TIME_SPENT(WEBAPPS_ ## NAME, DESC)
 
 SQLITE_TIME_SPENT(OPEN, "Time spent on SQLite open() (ms)")
 SQLITE_TIME_SPENT(TRUNCATE, "Time spent on SQLite truncate() (ms)")
@@ -197,9 +198,11 @@ HISTOGRAM(MOZ_SQLITE_OTHER_READ_B, 1, 32768, 3, LINEAR, "SQLite read() (bytes)")
 HISTOGRAM(MOZ_SQLITE_PLACES_READ_B, 1, 32768, 3, LINEAR, "SQLite read() (bytes)")
 HISTOGRAM(MOZ_SQLITE_COOKIES_READ_B, 1, 32768, 3, LINEAR, "SQLite read() (bytes)")
 HISTOGRAM(MOZ_SQLITE_URLCLASSIFIER_READ_B, 1, 32768, 3, LINEAR, "SQLite read() (bytes)")
+HISTOGRAM(MOZ_SQLITE_WEBAPPS_READ_B, 1, 32768, 3, LINEAR, "SQLite read() (bytes)")
 HISTOGRAM(MOZ_SQLITE_PLACES_WRITE_B, 1, 32768, 3, LINEAR, "SQLite write (bytes)")
 HISTOGRAM(MOZ_SQLITE_COOKIES_WRITE_B, 1, 32768, 3, LINEAR, "SQLite write (bytes)")
 HISTOGRAM(MOZ_SQLITE_URLCLASSIFIER_WRITE_B, 1, 32768, 3, LINEAR, "SQLite write (bytes)")
+HISTOGRAM(MOZ_SQLITE_WEBAPPS_WRITE_B, 1, 32768, 3, LINEAR, "SQLite write (bytes)")
 HISTOGRAM(MOZ_SQLITE_OTHER_WRITE_B, 1, 32768, 3, LINEAR, "SQLite write (bytes)")
 HISTOGRAM(MOZ_STORAGE_ASYNC_REQUESTS_MS, 1, 32768, 20, EXPONENTIAL, "mozStorage async requests completion (ms)")
 HISTOGRAM(MOZ_STORAGE_ASYNC_REQUESTS_SUCCESS, 0, 1, 2, BOOLEAN, "mozStorage async requests success")
diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index 5eca67c92c35..cd8a30cade20 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -83,57 +83,6 @@ XPCOMUtils.defineLazyServiceGetter(this, "idleService",
                                    "@mozilla.org/widget/idleservice;1",
                                    "nsIIdleService");
 
-/**
- * Returns a set of histograms that can be converted into JSON
- * @return a snapshot of the histograms of form:
- *  { histogram_name: {range:[minvalue,maxvalue], bucket_count:<number of buckets>,
- *    histogram_type: <0 for exponential, 1 for linear>, bucketX:countX, ....} ...}
- * where bucket[XY], count[XY] are positive integers.
- */
-function getHistograms() {
-  let hls = Telemetry.histogramSnapshots;
-  let ret = {};
-
-  for (let key in hls) {
-    let hgram = hls[key];
-    if (!hgram.static)
-      continue;
-
-    let r = hgram.ranges;
-    let c = hgram.counts;
-    let retgram = {
-      range: [r[1], r[r.length - 1]],
-      bucket_count: r.length,
-      histogram_type: hgram.histogram_type,
-      values: {},
-      sum: hgram.sum
-    };
-    let first = true;
-    let last = 0;
-
-    for (let i = 0; i < c.length; i++) {
-      let value = c[i];
-      if (!value)
-        continue;
-
-      // add a lower bound
-      if (i && first) {
-        first = false;
-        retgram.values[r[i - 1]] = 0;
-      }
-      first = false;
-      last = i + 1;
-      retgram.values[r[i]] = value;
-    }
-
-    // add an upper bound
-    if (last && last < c.length)
-      retgram.values[r[last]] = 0;
-    ret[key] = retgram;
-  }
-  return ret;
-}
-
 function generateUUID() {
   let str = Cc["@mozilla.org/uuid-generator;1"].getService(Ci.nsIUUIDGenerator).generateUUID().toString();
   // strip {}
@@ -221,6 +170,63 @@ TelemetryPing.prototype = {
   _histograms: {},
   _initialized: false,
   _prevValues: {},
+  _sqliteOverhead: {},
+
+  /**
+   * Returns a set of histograms that can be converted into JSON
+   * @return a snapshot of the histograms of form:
+   *  { histogram_name: {range:[minvalue,maxvalue], bucket_count:<number of buckets>,
+   *    histogram_type: <0 for exponential, 1 for linear>, bucketX:countX, ....} ...}
+   * where bucket[XY], count[XY] are positive integers.
+   */
+  getHistograms: function getHistograms() {
+    let hls = Telemetry.histogramSnapshots;
+    let ret = {};
+
+    // bug 701583: report sqlite overhead on startup
+    for (let key in this._sqliteOverhead) {
+      hls[key] = this._sqliteOverhead[key];
+    }
+
+    for (let key in hls) {
+      let hgram = hls[key];
+      if (!hgram.static)
+        continue;
+
+      let r = hgram.ranges;
+      let c = hgram.counts;
+      let retgram = {
+        range: [r[1], r[r.length - 1]],
+        bucket_count: r.length,
+        histogram_type: hgram.histogram_type,
+        values: {},
+        sum: hgram.sum
+      };
+      let first = true;
+      let last = 0;
+
+      for (let i = 0; i < c.length; i++) {
+        let value = c[i];
+        if (!value)
+          continue;
+
+        // add a lower bound
+        if (i && first) {
+          first = false;
+          retgram.values[r[i - 1]] = 0;
+        }
+        first = false;
+        last = i + 1;
+        retgram.values[r[i]] = value;
+      }
+
+      // add an upper bound
+      if (last && last < c.length)
+        retgram.values[r[last]] = 0;
+      ret[key] = retgram;
+    }
+    return ret;
+  },
 
   addValue: function addValue(name, id, val) {
     let h = this._histograms[name];
@@ -337,6 +343,18 @@ TelemetryPing.prototype = {
     }
   },
   
+  /** 
+   * Make a copy of sqlite histograms on startup
+   */
+  gatherStartupSqlite: function gatherStartupSqlite() {
+    let hls = Telemetry.histogramSnapshots;
+    let sqlite_re = /SQLITE/;
+    for (let key in hls) {
+      if (sqlite_re.test(key))
+        this._sqliteOverhead["STARTUP_" + key] = hls[key];
+    }
+  },
+
   /**
    * Send data to the server. Record success/send-time in histograms
    */
@@ -347,7 +365,7 @@ TelemetryPing.prototype = {
       ver: PAYLOAD_VERSION,
       info: this.getMetadata(reason),
       simpleMeasurements: getSimpleMeasurements(),
-      histograms: getHistograms()
+      histograms: this.getHistograms()
     };
 
     let isTestPing = (reason == "test-ping");
@@ -423,6 +441,7 @@ TelemetryPing.prototype = {
     }
     Services.obs.addObserver(this, "private-browsing", false);
     Services.obs.addObserver(this, "profile-before-change", false);
+    Services.obs.addObserver(this, "sessionstore-windows-restored", false);
 
     // Delay full telemetry initialization to give the browser time to
     // run various late initializers. Otherwise our gathered memory
@@ -443,6 +462,7 @@ TelemetryPing.prototype = {
    */
   uninstall: function uninstall() {
     this.detachObservers()
+    Services.obs.removeObserver(this, "sessionstore-windows-restored");
     Services.obs.removeObserver(this, "profile-before-change");
     Services.obs.removeObserver(this, "private-browsing");
   },
@@ -480,6 +500,9 @@ TelemetryPing.prototype = {
         this.attachObservers()
       }
       break;
+    case "sessionstore-windows-restored":
+      this.gatherStartupSqlite();
+      break;
     case "idle-daily":
       // Enqueue to main-thread, otherwise components may be inited by the
       // idle-daily category and miss the gather-telemetry notification.
diff --git a/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl b/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
index 489fa1ba7103..596386b9e7f2 100644
--- a/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
+++ b/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
@@ -41,7 +41,7 @@
 
 interface nsIArray;
 
-[scriptable, uuid(42ef1d52-3351-4973-98f8-d18f089bccfa)]
+[scriptable, uuid(5edc87c2-6960-44e5-8431-bdfbb56f6aff)]
 interface nsIUrlClassifierPrefixSet : nsISupports
 {
   void setPrefixes([const, array, size_is(aLength)] in unsigned long aPrefixes,
@@ -51,7 +51,7 @@ interface nsIUrlClassifierPrefixSet : nsISupports
   boolean contains(in unsigned long aPrefix);
   boolean probe(in unsigned long aPrefix, in unsigned long aKey,
                 inout boolean aReady);
-  PRUint32 estimateSize();
+  PRUint32 sizeOfIncludingThis(in boolean aCountMe);
   PRUint32 getKey();
   boolean isEmpty();
   void loadFromFile(in nsIFile aFile);
diff --git a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
index 860093fca194..c9899eb60cb8 100644
--- a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
@@ -3653,7 +3653,7 @@ nsUrlClassifierDBServiceWorker::LoadPrefixSet(nsCOMPtr<nsIFile> & aFile)
 
 #ifdef DEBUG
   PRUint32 size = 0;
-  rv = mPrefixSet->EstimateSize(&size);
+  rv = mPrefixSet->SizeOfIncludingThis(true, &size);
   LOG(("SB tree done, size = %d bytes\n", size));
   NS_ENSURE_SUCCESS(rv, rv);
 #endif
diff --git a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
index 0196ac760541..32b0416bbf8b 100644
--- a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
@@ -42,6 +42,7 @@
 #include "nsCOMPtr.h"
 #include "nsDebug.h"
 #include "nsTArray.h"
+#include "nsString.h"
 #include "nsUrlClassifierPrefixSet.h"
 #include "nsIUrlClassifierPrefixSet.h"
 #include "nsIRandomGenerator.h"
@@ -67,6 +68,78 @@ static const PRLogModuleInfo *gUrlClassifierPrefixSetLog = nsnull;
 #define LOG_ENABLED() (false)
 #endif
 
+class nsPrefixSetReporter : public nsIMemoryReporter
+{
+public:
+  nsPrefixSetReporter(nsUrlClassifierPrefixSet * aParent, const nsACString & aName);
+  virtual ~nsPrefixSetReporter() {};
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIMEMORYREPORTER
+
+private:
+  nsCString mPath;
+  nsUrlClassifierPrefixSet * mParent;
+};
+
+NS_IMPL_THREADSAFE_ISUPPORTS1(nsPrefixSetReporter, nsIMemoryReporter)
+
+nsPrefixSetReporter::nsPrefixSetReporter(nsUrlClassifierPrefixSet * aParent,
+                                         const nsACString & aName)
+: mParent(aParent)
+{
+  mPath.Assign(NS_LITERAL_CSTRING("explicit/storage/prefixset"));
+  if (!aName.IsEmpty()) {
+    mPath.Append("/");
+    mPath.Append(aName);
+  }
+}
+
+NS_IMETHODIMP
+nsPrefixSetReporter::GetProcess(nsACString & aProcess)
+{
+  aProcess.Truncate();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsPrefixSetReporter::GetPath(nsACString & aPath)
+{
+  aPath.Assign(mPath);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsPrefixSetReporter::GetKind(PRInt32 * aKind)
+{
+  *aKind = nsIMemoryReporter::KIND_HEAP;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsPrefixSetReporter::GetUnits(PRInt32 * aUnits)
+{
+  *aUnits = nsIMemoryReporter::UNITS_BYTES;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsPrefixSetReporter::GetAmount(PRInt64 * aAmount)
+{
+  PRUint32 size;
+  nsresult rv = mParent->SizeOfIncludingThis(true, &size);
+  *aAmount = size;
+  return rv;
+}
+
+NS_IMETHODIMP
+nsPrefixSetReporter::GetDescription(nsACString & aDescription)
+{
+  aDescription.Assign(NS_LITERAL_CSTRING("Memory used by a PrefixSet for "
+                                         "UrlClassifier, in bytes."));
+  return NS_OK;
+}
+
 NS_IMPL_THREADSAFE_ISUPPORTS1(nsUrlClassifierPrefixSet, nsIUrlClassifierPrefixSet)
 
 nsUrlClassifierPrefixSet::nsUrlClassifierPrefixSet()
@@ -84,6 +157,14 @@ nsUrlClassifierPrefixSet::nsUrlClassifierPrefixSet()
   if (NS_FAILED(rv)) {
     LOG(("Failed to initialize PrefixSet"));
   }
+
+  mReporter = new nsPrefixSetReporter(this, NS_LITERAL_CSTRING("all"));
+  NS_RegisterMemoryReporter(mReporter);
+}
+
+nsUrlClassifierPrefixSet::~nsUrlClassifierPrefixSet()
+{
+  NS_UnregisterMemoryReporter(mReporter);
 }
 
 nsresult
@@ -199,6 +280,8 @@ PRUint32 nsUrlClassifierPrefixSet::BinSearch(PRUint32 start,
 NS_IMETHODIMP
 nsUrlClassifierPrefixSet::Contains(PRUint32 aPrefix, bool * aFound)
 {
+  mPrefixSetLock.AssertCurrentThreadOwns();
+
   *aFound = false;
 
   if (!mHasPrefixes) {
@@ -244,15 +327,18 @@ nsUrlClassifierPrefixSet::Contains(PRUint32 aPrefix, bool * aFound)
 }
 
 NS_IMETHODIMP
-nsUrlClassifierPrefixSet::EstimateSize(PRUint32 * aSize)
+nsUrlClassifierPrefixSet::SizeOfIncludingThis(bool aCountMe, PRUint32 * aSize)
 {
   MutexAutoLock lock(mPrefixSetLock);
-  *aSize = sizeof(bool);
-  if (mHasPrefixes) {
-    *aSize += sizeof(PRUint16) * mDeltas.Length();
-    *aSize += sizeof(PRUint32) * mIndexPrefixes.Length();
-    *aSize += sizeof(PRUint32) * mIndexStarts.Length();
+  if (aCountMe) {
+    size_t usable = moz_malloc_usable_size(this);
+    *aSize = (PRUint32)(usable ? usable : sizeof(*this));
+  } else {
+    *aSize = 0;
   }
+  *aSize += mDeltas.SizeOf();
+  *aSize += mIndexPrefixes.SizeOf();
+  *aSize += mIndexStarts.SizeOf();
   return NS_OK;
 }
 
diff --git a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h
index 9203d2913f6f..21d40e542806 100644
--- a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h
+++ b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h
@@ -45,16 +45,19 @@
 #include "nsID.h"
 #include "nsIFile.h"
 #include "nsIUrlClassifierPrefixSet.h"
+#include "nsIMemoryReporter.h"
 #include "nsToolkitCompsCID.h"
 #include "mozilla/Mutex.h"
 #include "mozilla/CondVar.h"
 #include "mozilla/FileUtils.h"
 
+class nsPrefixSetReporter;
+
 class nsUrlClassifierPrefixSet : public nsIUrlClassifierPrefixSet
 {
 public:
   nsUrlClassifierPrefixSet();
-  virtual ~nsUrlClassifierPrefixSet() {};
+  virtual ~nsUrlClassifierPrefixSet();
 
   // Can send an empty Array to clean the tree
   NS_IMETHOD SetPrefixes(const PRUint32* aArray, PRUint32 aLength);
@@ -69,7 +72,7 @@ public:
   NS_IMETHOD Probe(PRUint32 aPrefix, PRUint32 aKey, bool* aReady, bool* aFound);
   // Return the estimated size of the set on disk and in memory,
   // in bytes
-  NS_IMETHOD EstimateSize(PRUint32* aSize);
+  NS_IMETHOD SizeOfIncludingThis(bool aCountMe, PRUint32* aSize);
   NS_IMETHOD IsEmpty(bool * aEmpty);
   NS_IMETHOD LoadFromFile(nsIFile* aFile);
   NS_IMETHOD StoreToFile(nsIFile* aFile);
@@ -85,6 +88,7 @@ protected:
 
   mozilla::Mutex mPrefixSetLock;
   mozilla::CondVar mSetIsReady;
+  nsRefPtr<nsPrefixSetReporter> mReporter;
 
   PRUint32 BinSearch(PRUint32 start, PRUint32 end, PRUint32 target);
   nsresult LoadFromFd(mozilla::AutoFDClose & fileFd);
@@ -103,6 +107,7 @@ protected:
   nsTArray<PRUint32> mIndexStarts;
   // array containing deltas from indices.
   nsTArray<PRUint16> mDeltas;
+
 };
 
 #endif
diff --git a/toolkit/components/url-classifier/tests/unit/test_prefixset.js b/toolkit/components/url-classifier/tests/unit/test_prefixset.js
index 6200f4152d5c..6c275b230dc8 100644
--- a/toolkit/components/url-classifier/tests/unit/test_prefixset.js
+++ b/toolkit/components/url-classifier/tests/unit/test_prefixset.js
@@ -28,6 +28,12 @@ function arrContains(arr, target) {
   return (!(i < 0 || i >= arr.length) && arr[i] == target);
 }
 
+function wrappedProbe(pset, prefix) {
+  let key = pset.getKey();
+  let dummy = {};
+  return pset.probe(prefix, key, dummy);
+};
+
 // doRandomLookups: we use this to test for false membership with random input
 // over the range of prefixes (unsigned 32-bits integers).
 //    pset: a nsIUrlClassifierPrefixSet to test.
@@ -39,7 +45,7 @@ function doRandomLookups(pset, prefixes, N) {
     while (arrContains(prefixes, randInt))
       randInt = Math.floor(Math.random() * Math.pow(2, 32));
 
-    do_check_false(pset.contains(randInt));
+    do_check_false(wrappedProbe(pset, randInt));
   }
 }
 
@@ -50,7 +56,7 @@ function doExpectedLookups(pset, prefixes, N) {
   for (let i = 0; i < N; i++) {
     prefixes.forEach(function (x) {
       dump("Checking " + x + "\n");
-      do_check_true(pset.contains(x));
+      do_check_true(wrappedProbe(pset, x));
     });
   }
 }
@@ -63,11 +69,11 @@ function testBasicPset() {
   let prefixes = [2,100,50,2000,78000,1593203];
   pset.setPrefixes(prefixes, prefixes.length);
 
-  do_check_true(pset.contains(100));
-  do_check_false(pset.contains(100000));
-  do_check_true(pset.contains(1593203));
-  do_check_false(pset.contains(999));
-  do_check_false(pset.contains(0));
+  do_check_true(wrappedProbe(pset, 100));
+  do_check_false(wrappedProbe(pset, 100000));
+  do_check_true(wrappedProbe(pset, 1593203));
+  do_check_false(wrappedProbe(pset, 999));
+  do_check_false(wrappedProbe(pset, 0));
 }
 
 function testDuplicates() {
@@ -76,12 +82,12 @@ function testDuplicates() {
   let prefixes = [1,1,2,2,2,3,3,3,3,3,3,5,6,6,7,7,9,9,9];
   pset.setPrefixes(prefixes, prefixes.length);
 
-  do_check_true(pset.contains(1));
-  do_check_true(pset.contains(2));
-  do_check_true(pset.contains(5));
-  do_check_true(pset.contains(9));
-  do_check_false(pset.contains(4));
-  do_check_false(pset.contains(8));
+  do_check_true(wrappedProbe(pset, 1));
+  do_check_true(wrappedProbe(pset, 2));
+  do_check_true(wrappedProbe(pset, 5));
+  do_check_true(wrappedProbe(pset, 9));
+  do_check_false(wrappedProbe(pset, 4));
+  do_check_false(wrappedProbe(pset, 8));
 }
 
 function testSimplePset() {
@@ -114,7 +120,7 @@ function testReSetPrefixes() {
 
   doExpectedLookups(pset, secondPrefixes, 1);
   for (let i = 0; i < prefixes.length; i++) {
-    do_check_false(pset.contains(prefixes[i]));
+    do_check_false(wrappedProbe(pset, prefixes[i]));
   }
 }
 
@@ -142,12 +148,12 @@ function testTinySet() {
   let prefixes = [1];
   pset.setPrefixes(prefixes, prefixes.length);
 
-  do_check_true(pset.contains(1));
-  do_check_false(pset.contains(100000));
+  do_check_true(wrappedProbe(pset, 1));
+  do_check_false(wrappedProbe(pset, 100000));
 
   prefixes = [];
   pset.setPrefixes(prefixes, prefixes.length);
-  do_check_false(pset.contains(1));
+  do_check_false(wrappedProbe(pset, 1));
 }
 
 let tests = [testBasicPset,
diff --git a/toolkit/content/customizeToolbar.js b/toolkit/content/customizeToolbar.js
index ed5818d16adc..1eaddf450f80 100644
--- a/toolkit/content/customizeToolbar.js
+++ b/toolkit/content/customizeToolbar.js
@@ -757,7 +757,7 @@ function onToolbarDragStart(aEvent)
 function onToolbarDragOver(aEvent)
 {
   var documentId = gToolboxDocument.documentElement.id;
-  if (!aEvent.dataTransfer.types.contains("text/toolbarwrapper-id/" + documentId))
+  if (!aEvent.dataTransfer.types.contains("text/toolbarwrapper-id/" + documentId.toLowerCase()))
     return;
 
   var toolbar = aEvent.target;
@@ -917,7 +917,7 @@ function onToolbarDrop(aEvent)
 function onPaletteDragOver(aEvent)
 {
   var documentId = gToolboxDocument.documentElement.id;
-  if (aEvent.dataTransfer.types.contains("text/toolbarwrapper-id/" + documentId))
+  if (aEvent.dataTransfer.types.contains("text/toolbarwrapper-id/" + documentId.toLowerCase()))
     aEvent.preventDefault();
 }
 
diff --git a/toolkit/content/license.html b/toolkit/content/license.html
index c990c4126fd4..73038d20c5f2 100644
--- a/toolkit/content/license.html
+++ b/toolkit/content/license.html
@@ -2623,12 +2623,11 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <h1><a name="growl"></a>Growl License</h1>
 
     <p>This license applies to certain files in the directory
-    <span class="path">toolkit/components/alerts/src/mac/growl/</span> and
-    <span class="path">camino/growl/</span>. (This code only ships in the Mac
-    OS X version of the product.)
+    <span class="path">toolkit/components/alerts/mac/growl/</span>.
+    (This code only ships in the Mac OS X version of the product.)
 
 <pre>
-Copyright (c) The Growl Project, 2004-2009
+Copyright (c) The Growl Project, 2004-2011
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,
diff --git a/toolkit/crashreporter/client/Makefile.in b/toolkit/crashreporter/client/Makefile.in
index 467cc5a39bc0..c5c9b6adad45 100644
--- a/toolkit/crashreporter/client/Makefile.in
+++ b/toolkit/crashreporter/client/Makefile.in
@@ -122,7 +122,6 @@ LIBS += \
 LOCAL_INCLUDES += -I$(srcdir)
 OS_CXXFLAGS += $(MOZ_GTK2_CFLAGS) $(MOZ_GTHREAD_CFLAGS)
 OS_LIBS += $(MOZ_GTK2_LIBS) $(MOZ_GTHREAD_LIBS)
-FORCE_USE_PIC=1
 endif
 
 ifeq ($(OS_ARCH),SunOS)
@@ -133,7 +132,6 @@ LIBS += \
 LOCAL_INCLUDES += -I$(srcdir)
 OS_CXXFLAGS += $(MOZ_GTK2_CFLAGS) $(MOZ_GTHREAD_CFLAGS)
 OS_LIBS += $(MOZ_GTK2_LIBS) $(MOZ_GTHREAD_LIBS)
-FORCE_USE_PIC=1
 endif
 
 include $(topsrcdir)/config/rules.mk
diff --git a/toolkit/crashreporter/fileid/Makefile.in b/toolkit/crashreporter/fileid/Makefile.in
index ab0ef10cf311..52efd6c814aa 100644
--- a/toolkit/crashreporter/fileid/Makefile.in
+++ b/toolkit/crashreporter/fileid/Makefile.in
@@ -59,7 +59,6 @@ HOST_LIBS += \
 
 # force C++ linking
 CPP_PROG_LINK = 1
-FORCE_USE_PIC = 1
 
 #XXX: bug 554854 causes us to be unable to run binaries on the build slaves
 # due to them having an older libstdc++
diff --git a/toolkit/crashreporter/google-breakpad/src/client/Makefile.in b/toolkit/crashreporter/google-breakpad/src/client/Makefile.in
index 041e80cc8c11..f07d7ca9aad3 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/client/Makefile.in
@@ -53,6 +53,5 @@ CPPSRCS	= \
 
 # need static lib
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
diff --git a/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/Makefile.in b/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/Makefile.in
index 3ef204a51ff2..507f78cb7381 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/Makefile.in
@@ -54,7 +54,6 @@ CPPSRCS		=				\
 
 # need static lib
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
 ifeq ($(OS_ARCH),Linux)
diff --git a/toolkit/crashreporter/google-breakpad/src/client/linux/handler/Makefile.in b/toolkit/crashreporter/google-breakpad/src/client/linux/handler/Makefile.in
index b1471a17de54..1fbf4a4e769b 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/linux/handler/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/client/linux/handler/Makefile.in
@@ -67,7 +67,6 @@ CPPSRCS	= \
 
 # need static lib
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 ifeq ($(OS_TARGET),Android)
 # NDK5 workarounds
diff --git a/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/Makefile.in b/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/Makefile.in
index 51a7cfdfd292..a4b555249a20 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/Makefile.in
@@ -55,6 +55,5 @@ CPPSRCS	= \
 
 # need static lib
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
diff --git a/toolkit/crashreporter/google-breakpad/src/client/solaris/handler/Makefile.in b/toolkit/crashreporter/google-breakpad/src/client/solaris/handler/Makefile.in
index 87300becb30c..611342c4b88f 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/solaris/handler/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/client/solaris/handler/Makefile.in
@@ -55,6 +55,5 @@ CPPSRCS	= \
 
 # need static lib
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
diff --git a/toolkit/crashreporter/google-breakpad/src/common/Makefile.in b/toolkit/crashreporter/google-breakpad/src/common/Makefile.in
index 39e7a38a97f8..ab50776f72ad 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/common/Makefile.in
@@ -90,6 +90,5 @@ HOST_CSRCS = $(CSRCS)
 
 # need static lib
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
diff --git a/toolkit/crashreporter/google-breakpad/src/common/linux/Makefile.in b/toolkit/crashreporter/google-breakpad/src/common/linux/Makefile.in
index 3af0ad9cf1f3..424614c2f15d 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/linux/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/common/linux/Makefile.in
@@ -64,6 +64,5 @@ HOST_CPPSRCS = \
 
 # need static lib
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
diff --git a/toolkit/crashreporter/google-breakpad/src/common/solaris/Makefile.in b/toolkit/crashreporter/google-breakpad/src/common/solaris/Makefile.in
index 60e1ecf0e7ca..b9c5603a7fb6 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/solaris/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/common/solaris/Makefile.in
@@ -63,6 +63,5 @@ HOST_CPPSRCS = \
 
 # need static lib
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
diff --git a/toolkit/crashreporter/google-breakpad/src/tools/linux/dump_syms/Makefile.in b/toolkit/crashreporter/google-breakpad/src/tools/linux/dump_syms/Makefile.in
index 5145faee1b1b..fed5791ab6aa 100644
--- a/toolkit/crashreporter/google-breakpad/src/tools/linux/dump_syms/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/tools/linux/dump_syms/Makefile.in
@@ -60,7 +60,6 @@ HOST_LIBS += \
 
 # force C++ linking
 CPP_PROG_LINK = 1
-FORCE_USE_PIC = 1
 
 #XXX: bug 554854 causes us to be unable to run binaries on the build slaves
 # due to them having an older libstdc++
diff --git a/toolkit/crashreporter/google-breakpad/src/tools/solaris/dump_syms/Makefile.in b/toolkit/crashreporter/google-breakpad/src/tools/solaris/dump_syms/Makefile.in
index 10ede3290671..000b45f5fc8c 100644
--- a/toolkit/crashreporter/google-breakpad/src/tools/solaris/dump_syms/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/tools/solaris/dump_syms/Makefile.in
@@ -61,6 +61,5 @@ HOST_LDFLAGS += -lelf -ldemangle
 
 # force C++ linking
 CPP_PROG_LINK = 1
-FORCE_USE_PIC = 1
 
 include $(topsrcdir)/config/rules.mk
diff --git a/toolkit/library/Makefile.in b/toolkit/library/Makefile.in
index 027fe1cec14a..4f6de767f010 100644
--- a/toolkit/library/Makefile.in
+++ b/toolkit/library/Makefile.in
@@ -47,7 +47,6 @@ include $(topsrcdir)/intl/unicharutil/util/objs.mk
 
 MODULE = libxul
 LIBRARY_NAME = xul
-FORCE_USE_PIC = 1
 FORCE_SHARED_LIB = 1
 MOZILLA_INTERNAL_API = 1
 
diff --git a/toolkit/library/libxul-config.mk b/toolkit/library/libxul-config.mk
index 13bb5cb0c2a6..14fa06380da2 100644
--- a/toolkit/library/libxul-config.mk
+++ b/toolkit/library/libxul-config.mk
@@ -217,7 +217,7 @@ COMPONENT_LIBS += universalchardet
 DEFINES += -DMOZ_UNIVERSALCHARDET
 endif
 
-ifeq (,$(filter android qt os2 cocoa windows,$(MOZ_WIDGET_TOOLKIT)))
+ifeq (,$(filter android gonk qt os2 cocoa windows,$(MOZ_WIDGET_TOOLKIT)))
 ifdef MOZ_XUL
 COMPONENT_LIBS += fileview
 DEFINES += -DMOZ_FILEVIEW
@@ -261,6 +261,10 @@ ifeq ($(MOZ_WIDGET_TOOLKIT),android)
 COMPONENT_LIBS += widget_android
 endif
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),gonk)
+COMPONENT_LIBS += widget_gonk
+endif
+
 STATIC_LIBS += thebes ycbcr
 
 ifeq ($(MOZ_WIDGET_TOOLKIT),android)
@@ -365,3 +369,7 @@ endif
 ifeq (android,$(MOZ_WIDGET_TOOLKIT))
 OS_LIBS += -lGLESv2
 endif
+
+ifeq (gonk,$(MOZ_WIDGET_TOOLKIT))
+OS_LIBS += -lui
+endif
diff --git a/toolkit/library/nsStaticXULComponents.cpp b/toolkit/library/nsStaticXULComponents.cpp
index 7825fe4e9d40..f040d18e1b62 100644
--- a/toolkit/library/nsStaticXULComponents.cpp
+++ b/toolkit/library/nsStaticXULComponents.cpp
@@ -77,6 +77,8 @@
 #  define WIDGET_MODULES MODULE(nsWidgetQtModule)
 #elif defined(MOZ_WIDGET_ANDROID)
 #  define WIDGET_MODULES MODULE(nsWidgetAndroidModule)
+#elif defined(MOZ_WIDGET_GONK)
+#  define WIDGET_MODULES MODULE(nsWidgetGonkModule)
 #else
 #  error Unknown widget module.
 #endif
diff --git a/toolkit/mozapps/downloads/nsHelperAppDlg.js b/toolkit/mozapps/downloads/nsHelperAppDlg.js
index f525cd94e960..c592af3eab77 100644
--- a/toolkit/mozapps/downloads/nsHelperAppDlg.js
+++ b/toolkit/mozapps/downloads/nsHelperAppDlg.js
@@ -109,7 +109,7 @@ nsUnkownContentTypeDialogProgressListener.prototype = {
   onStateChange: function( aWebProgress, aRequest, aStateFlags, aStatus ) {
   },
 
-  onLocationChange: function( aWebProgress, aRequest, aLocation ) {
+  onLocationChange: function( aWebProgress, aRequest, aLocation, aFlags ) {
   },
 
   onSecurityChange: function( aWebProgress, aRequest, state ) {
diff --git a/toolkit/mozapps/extensions/AddonRepository.jsm b/toolkit/mozapps/extensions/AddonRepository.jsm
index 53d526fe3906..e0b0909e9cff 100644
--- a/toolkit/mozapps/extensions/AddonRepository.jsm
+++ b/toolkit/mozapps/extensions/AddonRepository.jsm
@@ -47,6 +47,7 @@ Components.utils.import("resource://gre/modules/FileUtils.jsm");
 Components.utils.import("resource://gre/modules/NetUtil.jsm");
 Components.utils.import("resource://gre/modules/Services.jsm");
 Components.utils.import("resource://gre/modules/AddonManager.jsm");
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 
 var EXPORTED_SYMBOLS = [ "AddonRepository" ];
 
@@ -61,13 +62,17 @@ const PREF_GETADDONS_BROWSESEARCHRESULTS = "extensions.getAddons.search.browseUR
 const PREF_GETADDONS_GETSEARCHRESULTS    = "extensions.getAddons.search.url";
 
 const PREF_CHECK_COMPATIBILITY_BASE = "extensions.checkCompatibility";
+
+const BRANCH_REGEXP                   = /^([^\.]+\.[0-9]+[a-z]*).*/gi;
+
+XPCOMUtils.defineLazyGetter(this, "PREF_CHECK_COMPATIBILITY", function () {
 #ifdef MOZ_COMPATIBILITY_NIGHTLY
-const PREF_CHECK_COMPATIBILITY = PREF_CHECK_COMPATIBILITY_BASE +
-                                 ".nightly";
+  return PREF_CHECK_COMPATIBILITY_BASE + ".nightly";
 #else
-const PREF_CHECK_COMPATIBILITY = PREF_CHECK_COMPATIBILITY_BASE + "." +
-                                 Services.appinfo.version.replace(BRANCH_REGEXP, "$1");
+  return PREF_CHECK_COMPATIBILITY_BASE + "." +
+         Services.appinfo.version.replace(BRANCH_REGEXP, "$1");
 #endif
+});
 
 const XMLURI_PARSE_ERROR  = "http://www.mozilla.org/newlayout/xml/parsererror.xml";
 
@@ -729,10 +734,6 @@ var AddonRepository = {
    *         The callback to pass results to
    */
   getAddonsByIDs: function(aIDs, aCallback) {
-    let startupInfo = Cc["@mozilla.org/toolkit/app-startup;1"].
-                      getService(Ci.nsIAppStartup).
-                      getStartupInfo();
-
     let ids = aIDs.slice(0);
 
     let params = {
@@ -740,16 +741,6 @@ var AddonRepository = {
       IDS : ids.map(encodeURIComponent).join(',')
     };
 
-    if (startupInfo.process) {
-      if (startupInfo.main)
-        params.TIME_MAIN = startupInfo.main - startupInfo.process;
-      if (startupInfo.firstPaint)
-        params.TIME_FIRST_PAINT = startupInfo.firstPaint - startupInfo.process;
-      if (startupInfo.sessionRestored)
-        params.TIME_SESSION_RESTORED = startupInfo.sessionRestored -
-                                       startupInfo.process;
-    };
-
     let url = this._formatURLPref(PREF_GETADDONS_BYIDS, params);
 
     let self = this;
diff --git a/toolkit/mozapps/extensions/XPIProvider.jsm b/toolkit/mozapps/extensions/XPIProvider.jsm
index aab225b731d2..cd8f6131c9be 100644
--- a/toolkit/mozapps/extensions/XPIProvider.jsm
+++ b/toolkit/mozapps/extensions/XPIProvider.jsm
@@ -2955,16 +2955,18 @@ var XPIProvider = {
 
     let state = this.getInstallLocationStates();
 
-    // If the database exists then the previous file cache can be trusted
-    // otherwise the database needs to be recreated
-    let dbFile = FileUtils.getFile(KEY_PROFILEDIR, [FILE_DATABASE], true);
-    updateDatabase |= !dbFile.exists();
     if (!updateDatabase) {
       // If the state has changed then we must update the database
       let cache = Prefs.getCharPref(PREF_INSTALL_CACHE, null);
       updateDatabase |= cache != JSON.stringify(state);
     }
 
+    // If the database doesn't exist and there are add-ons installed then we
+    // must update the database however if there are no add-ons then there is
+    // no need to update the database.
+    if (!XPIDatabase.dbfileExists)
+      updateDatabase = state.length > 0;
+
     if (!updateDatabase) {
       let bootstrapDescriptors = [this.bootstrappedAddons[b].descriptor
                                   for (b in this.bootstrappedAddons)];
@@ -2976,7 +2978,7 @@ var XPIProvider = {
             bootstrapDescriptors.splice(pos, 1);
         }
       });
-  
+
       if (bootstrapDescriptors.length > 0) {
         WARN("Bootstrap state is invalid (missing add-ons: " + bootstrapDescriptors.toSource() + ")");
         updateDatabase = true;
@@ -2990,7 +2992,7 @@ var XPIProvider = {
       // If the database needs to be updated then open it and then update it
       // from the filesystem
       if (updateDatabase || hasPendingChanges) {
-        let migrateData = XPIDatabase.openConnection(false);
+        let migrateData = XPIDatabase.openConnection(false, true);
 
         try {
           extensionListChanged = this.processFileChanges(state, manifests,
@@ -4041,6 +4043,8 @@ var XPIDatabase = {
   addonCache: [],
   // The nested transaction count
   transactionCount: 0,
+  // The database file
+  dbfile: FileUtils.getFile(KEY_PROFILEDIR, [FILE_DATABASE], true),
 
   // The statements used by the database
   statements: {
@@ -4132,6 +4136,11 @@ var XPIDatabase = {
     rollbackSavepoint: "ROLLBACK TO SAVEPOINT 'default'"
   },
 
+  get dbfileExists() {
+    delete this.dbfileExists;
+    return this.dbfileExists = this.dbfile.exists();
+  },
+
   /**
    * Begins a new transaction in the database. Transactions may be nested. Data
    * written by an inner transaction may be rolled back on its own. Rolling back
@@ -4195,6 +4204,7 @@ var XPIDatabase = {
     // Attempt to open the database
     try {
       connection = Services.storage.openUnsharedDatabase(aDBFile);
+      this.dbfileExists = true;
     }
     catch (e) {
       ERROR("Failed to open database (1st attempt)", e);
@@ -4232,12 +4242,17 @@ var XPIDatabase = {
    * @return the migration data from the database if it was an old schema or
    *         null otherwise.
    */
-  openConnection: function XPIDB_openConnection(aRebuildOnError) {
-    this.initialized = true;
-    let dbfile = FileUtils.getFile(KEY_PROFILEDIR, [FILE_DATABASE], true);
+  openConnection: function XPIDB_openConnection(aRebuildOnError, aForceOpen) {
     delete this.connection;
 
-    this.connection = this.openDatabaseFile(dbfile);
+    if (!aForceOpen && !this.dbfileExists) {
+      this.connection = null;
+      return {};
+    }
+
+    this.initialized = true;
+
+    this.connection = this.openDatabaseFile(this.dbfile);
 
     let migrateData = null;
     // If the database was corrupt or missing then the new blank database will
@@ -4254,11 +4269,11 @@ var XPIDatabase = {
         // Delete the existing database
         this.connection.close();
         try {
-          if (dbfile.exists())
-            dbfile.remove(true);
+          if (this.dbfileExists)
+            this.dbfile.remove(true);
 
           // Reopen an empty database
-          this.connection = this.openDatabaseFile(dbfile);
+          this.connection = this.openDatabaseFile(this.dbfile);
         }
         catch (e) {
           ERROR("Failed to remove old database", e);
@@ -4269,7 +4284,6 @@ var XPIDatabase = {
       }
       else if (Prefs.getIntPref(PREF_DB_SCHEMA, 0) == 0) {
         // Only migrate data from the RDF if we haven't done it before
-        LOG("Migrating data from extensions.rdf");
         migrateData = this.getMigrateDataFromRDF();
       }
 
@@ -4369,6 +4383,7 @@ var XPIDatabase = {
     // Migrate data from extensions.rdf
     let rdffile = FileUtils.getFile(KEY_PROFILEDIR, [FILE_OLD_DATABASE], true);
     if (rdffile.exists()) {
+      LOG("Migrating data from extensions.rdf");
       let ds = gRDF.GetDataSourceBlocking(Services.io.newFileURI(rdffile).spec);
       let root = Cc["@mozilla.org/rdf/container;1"].
                  createInstance(Ci.nsIRDFContainer);
@@ -4982,6 +4997,9 @@ var XPIDatabase = {
    * @return  an array of names of install locations
    */
   getInstallLocations: function XPIDB_getInstallLocations() {
+    if (!this.connection)
+      return [];
+
     let stmt = this.getStatement("getInstallLocations");
 
     return [row.location for each (row in resultRows(stmt))];
@@ -4995,6 +5013,9 @@ var XPIDatabase = {
    * @return an array of DBAddonInternals
    */
   getAddonsInLocation: function XPIDB_getAddonsInLocation(aLocation) {
+    if (!this.connection)
+      return [];
+
     let stmt = this.getStatement("getAddonsInLocation");
 
     stmt.params.location = aLocation;
@@ -5013,6 +5034,11 @@ var XPIDatabase = {
    *         A callback to pass the DBAddonInternal to
    */
   getAddonInLocation: function XPIDB_getAddonInLocation(aId, aLocation, aCallback) {
+    if (!this.connection) {
+      aCallback(null);
+      return;
+    }
+
     let stmt = this.getStatement("getAddonInLocation");
 
     stmt.params.id = aId;
@@ -5039,6 +5065,11 @@ var XPIDatabase = {
    *         A callback to pass the DBAddonInternal to
    */
   getVisibleAddonForID: function XPIDB_getVisibleAddonForID(aId, aCallback) {
+    if (!this.connection) {
+      aCallback(null);
+      return;
+    }
+
     let stmt = this.getStatement("getVisibleAddonForID");
 
     stmt.params.id = aId;
@@ -5064,6 +5095,11 @@ var XPIDatabase = {
    *         A callback to pass the array of DBAddonInternals to
    */
   getVisibleAddons: function XPIDB_getVisibleAddons(aTypes, aCallback) {
+    if (!this.connection) {
+      aCallback([]);
+      return;
+    }
+
     let stmt = null;
     if (!aTypes || aTypes.length == 0) {
       stmt = this.getStatement("getVisibleAddons");
@@ -5095,6 +5131,9 @@ var XPIDatabase = {
    * @return an array of DBAddonInternals
    */
   getAddonsByType: function XPIDB_getAddonsByType(aType) {
+    if (!this.connection)
+      return [];
+
     let stmt = this.getStatement("getAddonsByType");
 
     stmt.params.type = aType;
@@ -5109,6 +5148,9 @@ var XPIDatabase = {
    * @return a DBAddonInternal
    */
   getVisibleAddonForInternalName: function XPIDB_getVisibleAddonForInternalName(aInternalName) {
+    if (!this.connection)
+      return null;
+
     let stmt = this.getStatement("getVisibleAddonForInternalName");
 
     let addon = null;
@@ -5131,6 +5173,11 @@ var XPIDatabase = {
    */
   getVisibleAddonsWithPendingOperations:
     function XPIDB_getVisibleAddonsWithPendingOperations(aTypes, aCallback) {
+    if (!this.connection) {
+      aCallback([]);
+      return;
+    }
+
     let stmt = null;
     if (!aTypes || aTypes.length == 0) {
       stmt = this.getStatement("getVisibleAddonsWithPendingOperations");
@@ -5162,6 +5209,9 @@ var XPIDatabase = {
    * @return  an array of DBAddonInternals
    */
   getAddons: function XPIDB_getAddons() {
+    if (!this.connection)
+      return [];
+
     let stmt = this.getStatement("getAddons");
 
     return [this.makeAddonFromRow(row) for each (row in resultRows(stmt))];;
@@ -5176,6 +5226,10 @@ var XPIDatabase = {
    *         The file descriptor of the add-on
    */
   addAddonMetadata: function XPIDB_addAddonMetadata(aAddon, aDescriptor) {
+    // If there is no DB yet then forcibly create one
+    if (!this.connection)
+      this.openConnection(false, true);
+
     this.beginTransaction();
 
     var self = this;
@@ -5449,28 +5503,34 @@ var XPIDatabase = {
     let enabledAddons = [];
     let text = "[ExtensionDirs]\r\n";
     let count = 0;
+    let stmt;
 
-    let stmt = this.getStatement("getActiveAddons");
+    if (this.connection) {
+      stmt = this.getStatement("getActiveAddons");
 
-    for (let row in resultRows(stmt)) {
-      text += "Extension" + (count++) + "=" + row.descriptor + "\r\n";
-      enabledAddons.push(row.id + ":" + row.version);
+      for (let row in resultRows(stmt)) {
+        text += "Extension" + (count++) + "=" + row.descriptor + "\r\n";
+        enabledAddons.push(row.id + ":" + row.version);
+      }
     }
 
     // The selected skin may come from an inactive theme (the default theme
     // when a lightweight theme is applied for example)
     text += "\r\n[ThemeDirs]\r\n";
-    if (Prefs.getBoolPref(PREF_EM_DSS_ENABLED)) {
-      stmt = this.getStatement("getThemes");
-    }
-    else {
-      stmt = this.getStatement("getActiveTheme");
-      stmt.params.internalName = XPIProvider.selectedSkin;
-    }
-    count = 0;
-    for (let row in resultRows(stmt)) {
-      text += "Extension" + (count++) + "=" + row.descriptor + "\r\n";
-      enabledAddons.push(row.id + ":" + row.version);
+
+    if (this.connection) {
+      if (Prefs.getBoolPref(PREF_EM_DSS_ENABLED)) {
+        stmt = this.getStatement("getThemes");
+      }
+      else {
+        stmt = this.getStatement("getActiveTheme");
+        stmt.params.internalName = XPIProvider.selectedSkin;
+      }
+      count = 0;
+      for (let row in resultRows(stmt)) {
+        text += "Extension" + (count++) + "=" + row.descriptor + "\r\n";
+        enabledAddons.push(row.id + ":" + row.version);
+      }
     }
 
     var fos = FileUtils.openSafeFileOutputStream(addonsList);
diff --git a/toolkit/mozapps/extensions/content/extensions.js b/toolkit/mozapps/extensions/content/extensions.js
index 425d8c5512e1..ee7a87a9eda4 100644
--- a/toolkit/mozapps/extensions/content/extensions.js
+++ b/toolkit/mozapps/extensions/content/extensions.js
@@ -1909,7 +1909,7 @@ var gDiscoverView = {
     this._browser.loadURIWithFlags(aURL, flags);
   },
 
-  onLocationChange: function(aWebProgress, aRequest, aLocation) {
+  onLocationChange: function(aWebProgress, aRequest, aLocation, aFlags) {
     // Ignore the about:blank load
     if (aLocation.spec == "about:blank")
       return;
@@ -2859,6 +2859,7 @@ var gDetailView = {
 
     var xhr = new XMLHttpRequest();
     xhr.open("GET", this._addon.optionsURL, false);
+    xhr.responseType = "document";
     xhr.send();
 
     var xml = xhr.responseXML;
diff --git a/toolkit/mozapps/extensions/test/browser/Makefile.in b/toolkit/mozapps/extensions/test/browser/Makefile.in
index fc052ac7796d..cc353493aeb7 100644
--- a/toolkit/mozapps/extensions/test/browser/Makefile.in
+++ b/toolkit/mozapps/extensions/test/browser/Makefile.in
@@ -96,7 +96,6 @@ _TEST_FILES = \
   head.js \
   browser_bug557956.js \
   browser_bug616841.js \
-  browser_bug623950.js \
   browser_updatessl.js \
   browser_installssl.js \
   browser_newaddon.js \
diff --git a/toolkit/mozapps/extensions/test/browser/browser_bug623950.js b/toolkit/mozapps/extensions/test/browser/browser_bug623950.js
deleted file mode 100644
index ccb9db1b9804..000000000000
--- a/toolkit/mozapps/extensions/test/browser/browser_bug623950.js
+++ /dev/null
@@ -1,68 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
- * http://creativecommons.org/publicdomain/zero/1.0/
- */
-
-// Tests that the metadata request includes startup time measurements
-
-Components.utils.import("resource://gre/modules/AddonRepository.jsm");
-
-var gManagerWindow;
-var gProvider;
-
-function parseParams(aQuery) {
-  let params = {};
-
-  aQuery.split("&").forEach(function(aParam) {
-    let [key, value] = aParam.split("=");
-    params[key] = value;
-  });
-
-  return params;
-}
-
-function test() {
-  waitForExplicitFinish();
-
-  var gSeenRequest = false;
-
-  gProvider = new MockProvider();
-  gProvider.createAddons([{
-    id: "test1@tests.mozilla.org",
-    name: "Test add-on"
-  }]);
-
-  function observe(aSubject, aTopic, aData) {
-    aSubject.QueryInterface(Ci.nsIChannel);
-    let url = aSubject.URI.QueryInterface(Ci.nsIURL);
-    if (url.filePath != "/extensions-dummy/metadata")
-      return;
-    info(url.query);
-
-    let params = parseParams(url.query);
-
-    is(params.appOS, Services.appinfo.OS, "OS should be correct");
-    is(params.appVersion, Services.appinfo.version, "Version should be correct");
-    ok(params.tMain >= 0, "Should be a sensible tMain");
-    ok(params.tFirstPaint >= 0, "Should be a sensible tFirstPaint");
-    ok(params.tSessionRestored >= 0, "Should be a sensible tSessionRestored");
-
-    gSeenRequest = true;
-  }
-
-  // Watch HTTP requests
-  Services.obs.addObserver(observe, "http-on-modify-request", false);
-  Services.prefs.setCharPref("extensions.getAddons.get.url",
-    "http://127.0.0.1:8888/extensions-dummy/metadata?appOS=%OS%&appVersion=%VERSION%&tMain=%TIME_MAIN%&tFirstPaint=%TIME_FIRST_PAINT%&tSessionRestored=%TIME_SESSION_RESTORED%");
-
-  registerCleanupFunction(function() {
-    Services.obs.removeObserver(observe, "http-on-modify-request");
-    Services.prefs.clearUserPref("extensions.getAddons.get.url");
-  });
-
-  AddonRepository.getAddonsByIDs(["test1@tests.mozilla.org"], {
-    searchFailed: function() {
-      ok(gSeenRequest, "Should have seen metadata request");
-      finish();
-    }
-  });
-}
diff --git a/toolkit/mozapps/extensions/test/browser/browser_searching.js b/toolkit/mozapps/extensions/test/browser/browser_searching.js
index 4588543f227b..2019a207c3db 100644
--- a/toolkit/mozapps/extensions/test/browser/browser_searching.js
+++ b/toolkit/mozapps/extensions/test/browser/browser_searching.js
@@ -19,6 +19,22 @@ var gProvider;
 var gServer;
 var gAddonInstalled = false;
 
+var channel = "default";
+try {
+  channel = Services.prefs.getCharPref("app.update.channel");
+}
+catch (e) { }
+if (channel != "aurora" &&
+    channel != "beta" &&
+    channel != "release") {
+  var version = "nightly";
+}
+else {
+  version = Services.appinfo.version.replace(/^([^\.]+\.[0-9]+[a-z]*).*/gi, "$1");
+}
+
+const COMPATIBILITY_PREF = "extensions.checkCompatibility." + version;
+
 function test() {
   requestLongerTimeout(2);
   // Turn on searching for this test
@@ -591,7 +607,7 @@ add_test(function() {
 
 // Tests that incompatible add-ons are shown with a warning if compatibility checking is disabled
 add_test(function() {
-  Services.prefs.setBoolPref("extensions.checkCompatibility.nightly", false);
+  Services.prefs.setBoolPref(COMPATIBILITY_PREF, false);
   search("incompatible", false, function() {
     var item = get_addon_item("remote5");
     is_element_visible(item, "Incompatible addon should be visible");
@@ -600,7 +616,7 @@ add_test(function() {
     var item = get_addon_item("remote6");
     is(item, null, "Addon incompatible with the product should not be visible");
 
-    Services.prefs.clearUserPref("extensions.checkCompatibility.nightly");
+    Services.prefs.clearUserPref(COMPATIBILITY_PREF);
     run_next_test();
   });
 });
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_bootstrap.js b/toolkit/mozapps/extensions/test/xpcshell/test_bootstrap.js
index d5cdf2a70fc8..6adc0520a0f5 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_bootstrap.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_bootstrap.js
@@ -125,6 +125,10 @@ function run_test() {
 
   startupManager();
 
+  let file = gProfD.clone();
+  file.append("extensions.sqlite");
+  do_check_false(file.exists());
+
   run_test_1();
 }
 
@@ -167,6 +171,10 @@ function run_test_1() {
 }
 
 function check_test_1() {
+  let file = gProfD.clone();
+  file.append("extensions.sqlite");
+  do_check_true(file.exists());
+
   AddonManager.getAllInstalls(function(installs) {
     // There should be no active installs now since the install completed and
     // doesn't require a restart.
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_corrupt.js b/toolkit/mozapps/extensions/test/xpcshell/test_corrupt.js
index a16cb87f6020..a289c7393e79 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_corrupt.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_corrupt.js
@@ -247,13 +247,15 @@ function run_test_1() {
     do_check_false(t2.appDisabled);
     do_check_eq(t2.pendingOperations, AddonManager.PENDING_NONE);
 
-    // After restarting the database won't be open and so can be replaced with
-    // a bad file
-    restartManager();
+    // Shutdown and replace the database with a corrupt file (a directory
+    // serves this purpose). On startup the add-ons manager won't rebuild
+    // because there is a file there still.
+    shutdownManager();
     var dbfile = gProfD.clone();
     dbfile.append("extensions.sqlite");
     dbfile.remove(true);
     dbfile.create(AM_Ci.nsIFile.DIRECTORY_TYPE, 0755);
+    startupManager(false);
 
     // Accessing the add-ons should open and recover the database
     AddonManager.getAddonsByIDs(["addon1@tests.mozilla.org",
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_corrupt_strictcompat.js b/toolkit/mozapps/extensions/test/xpcshell/test_corrupt_strictcompat.js
index 4a9766fbe8e4..648664f360bf 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_corrupt_strictcompat.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_corrupt_strictcompat.js
@@ -247,13 +247,15 @@ function run_test_1() {
     do_check_false(t2.appDisabled);
     do_check_eq(t2.pendingOperations, AddonManager.PENDING_NONE);
 
-    // After restarting the database won't be open and so can be replaced with
-    // a bad file
-    restartManager();
+    // Shutdown and replace the database with a corrupt file (a directory
+    // serves this purpose). On startup the add-ons manager won't rebuild
+    // because there is a file there still.
+    shutdownManager();
     var dbfile = gProfD.clone();
     dbfile.append("extensions.sqlite");
     dbfile.remove(true);
     dbfile.create(AM_Ci.nsIFile.DIRECTORY_TYPE, 0755);
+    startupManager(false);
 
     // Accessing the add-ons should open and recover the database
     AddonManager.getAddonsByIDs(["addon1@tests.mozilla.org",
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_startup.js b/toolkit/mozapps/extensions/test/xpcshell/test_startup.js
index 71f41b6775f8..3e4f112a1826 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_startup.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_startup.js
@@ -132,6 +132,10 @@ function run_test() {
   check_startup_changes(AddonManager.STARTUP_CHANGE_DISABLED, []);
   check_startup_changes(AddonManager.STARTUP_CHANGE_ENABLED, []);
 
+  let file = gProfD.clone();
+  file.append("extensions.sqlite");
+  do_check_false(file.exists());
+
   AddonManager.getAddonsByIDs(["addon1@tests.mozilla.org",
                                "addon2@tests.mozilla.org",
                                "addon3@tests.mozilla.org",
@@ -183,6 +187,10 @@ function run_test_1() {
   check_startup_changes(AddonManager.STARTUP_CHANGE_ENABLED, []);
   do_check_true(gCachePurged);
 
+  let file = gProfD.clone();
+  file.append("extensions.sqlite");
+  do_check_true(file.exists());
+
   AddonManager.getAddonsByIDs(["addon1@tests.mozilla.org",
                                "addon2@tests.mozilla.org",
                                "addon3@tests.mozilla.org",
diff --git a/toolkit/mozapps/installer/packager.mk b/toolkit/mozapps/installer/packager.mk
index 371e302ca6e4..8e4c1825886c 100644
--- a/toolkit/mozapps/installer/packager.mk
+++ b/toolkit/mozapps/installer/packager.mk
@@ -56,7 +56,7 @@ else
    ifeq (,$(filter-out gtk2 qt, $(MOZ_WIDGET_TOOLKIT)))
       MOZ_PKG_FORMAT  = BZ2
    else
-      ifeq (Android,$(OS_TARGET))
+      ifeq (android,$(MOZ_WIDGET_TOOLKIT))
           MOZ_PKG_FORMAT = APK
       else
           MOZ_PKG_FORMAT = TGZ
@@ -442,11 +442,11 @@ PRECOMPILE_GRE=$$PWD
 endif
 
 GENERATE_CACHE = \
-  $(_ABS_RUN_TEST_PROGRAM) $(LIBXUL_DIST)/bin/xpcshell$(BIN_SUFFIX) -g "$(PRECOMPILE_GRE)" -a "$$PWD" -f $(call core_abspath,$(MOZILLA_DIR)/toolkit/mozapps/installer/precompile_cache.js) -e "populate_startupcache('$(PRECOMPILE_DIR)', 'omni.jar', 'startupCache.zip');" && \
+  $(_ABS_RUN_TEST_PROGRAM) $(LIBXUL_DIST)/bin/xpcshell$(BIN_SUFFIX) -g "$(PRECOMPILE_GRE)" -a "$$PWD" -f $(call core_abspath,$(MOZILLA_DIR)/toolkit/mozapps/installer/precompile_cache.js) -e "populate_startupcache('$(PRECOMPILE_DIR)', '$(OMNIJAR_NAME)', 'startupCache.zip');" && \
   rm -rf jsloader && \
   $(UNZIP) startupCache.zip && \
   rm startupCache.zip && \
-  $(ZIP) -r9m omni.jar jsloader/resource/$(PRECOMPILE_RESOURCE)
+  $(ZIP) -r9m $(OMNIJAR_NAME) jsloader/resource/$(PRECOMPILE_RESOURCE)
 else
 GENERATE_CACHE = true
 endif
@@ -476,20 +476,20 @@ NON_OMNIJAR_FILES += \
   $(NULL)
 
 PACK_OMNIJAR	= \
-  rm -f omni.jar components/binary.manifest && \
+  rm -f $(OMNIJAR_NAME) components/binary.manifest && \
   grep -h '^binary-component' components/*.manifest > binary.manifest ; \
   for m in components/*.manifest; do \
     sed -e 's/^binary-component/\#binary-component/' $$m > tmp.manifest && \
     mv tmp.manifest $$m; \
   done; \
-  $(ZIP) -r9m omni.jar $(OMNIJAR_FILES) -x $(NON_OMNIJAR_FILES) && \
+  $(ZIP) -r9m $(OMNIJAR_NAME) $(OMNIJAR_FILES) -x $(NON_OMNIJAR_FILES) && \
   $(GENERATE_CACHE) && \
   $(OPTIMIZE_JARS_CMD) --optimize $(JARLOG_DIR_AB_CD) ./ ./ && \
   mv binary.manifest components && \
   printf "manifest components/binary.manifest\n" > chrome.manifest
 UNPACK_OMNIJAR	= \
   $(OPTIMIZE_JARS_CMD) --deoptimize $(JARLOG_DIR_AB_CD) ./ ./ && \
-  $(UNZIP) -o omni.jar && \
+  $(UNZIP) -o $(OMNIJAR_NAME) && \
   rm -f components/binary.manifest && \
   for m in components/*.manifest; do \
     sed -e 's/^\#binary-component/binary-component/' $$m > tmp.manifest && \
diff --git a/toolkit/system/gnome/nsAlertsIconListener.cpp b/toolkit/system/gnome/nsAlertsIconListener.cpp
index 905147028e7f..8cf8c575d16c 100644
--- a/toolkit/system/gnome/nsAlertsIconListener.cpp
+++ b/toolkit/system/gnome/nsAlertsIconListener.cpp
@@ -175,6 +175,12 @@ nsAlertsIconListener::OnDiscard(imgIRequest *aRequest)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsAlertsIconListener::OnImageIsAnimated(imgIRequest *aRequest)
+{
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsAlertsIconListener::OnStopFrame(imgIRequest* aRequest,
                                   PRUint32 aFrame)
diff --git a/toolkit/xre/Makefile.in b/toolkit/xre/Makefile.in
index 2be2760980a2..7b5996f095de 100644
--- a/toolkit/xre/Makefile.in
+++ b/toolkit/xre/Makefile.in
@@ -128,7 +128,7 @@ ifdef MOZ_X11
 CPPSRCS += nsX11ErrorHandler.cpp
 endif
 
-ifeq ($(OS_TARGET),Android)
+ifeq ($(MOZ_WIDGET_TOOLKIT),android)
 CPPSRCS += nsAndroidStartup.cpp
 DEFINES += -DANDROID_PACKAGE_NAME='"$(ANDROID_PACKAGE_NAME)"'
 endif
diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index 159dd45d1a7d..487a7af70702 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -217,7 +217,7 @@ using mozilla::unused;
 
 #include "mozilla/FunctionTimer.h"
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidBridge.h"
 #endif
 
@@ -1607,7 +1607,7 @@ static nsresult LaunchChild(nsINativeAppSupport* aNative,
 
   SaveToEnv("MOZ_LAUNCHED_CHILD=1");
 
-#if defined(ANDROID)
+#if defined(MOZ_WIDGET_ANDROID)
   mozilla::AndroidBridge::Bridge()->ScheduleRestart();
 #else
 #if defined(XP_MACOSX)
@@ -1658,7 +1658,7 @@ static nsresult LaunchChild(nsINativeAppSupport* aNative,
 #endif // XP_OS2 series
 #endif // WP_WIN
 #endif // WP_MACOSX
-#endif // ANDROID
+#endif // MOZ_WIDGET_ANDROID
 
   return NS_ERROR_LAUNCHED_CHILD_PROCESS;
 }
diff --git a/toolkit/xre/nsXREDirProvider.cpp b/toolkit/xre/nsXREDirProvider.cpp
index 45bdfb179c9b..200de65d9d2d 100644
--- a/toolkit/xre/nsXREDirProvider.cpp
+++ b/toolkit/xre/nsXREDirProvider.cpp
@@ -1065,6 +1065,9 @@ nsXREDirProvider::GetUserDataDirectoryHome(nsILocalFile** aFile, bool aLocal)
     *strrchr(appDir, '\\') = '\0';
     rv = NS_NewNativeLocalFile(nsDependentCString(appDir), true, getter_AddRefs(localDir));
   }
+#elif defined(MOZ_WIDGET_GONK)
+  rv = NS_NewNativeLocalFile(NS_LITERAL_CSTRING("/data/b2g"), PR_TRUE,
+                             getter_AddRefs(localDir));
 #elif defined(XP_UNIX)
   const char* homeDir = getenv("HOME");
   if (!homeDir || !*homeDir)
diff --git a/uriloader/base/nsDocLoader.cpp b/uriloader/base/nsDocLoader.cpp
index 7a15a7c5ddff..1eb8aa38e3a8 100644
--- a/uriloader/base/nsDocLoader.cpp
+++ b/uriloader/base/nsDocLoader.cpp
@@ -1391,7 +1391,8 @@ void nsDocLoader::DoFireOnStateChange(nsIWebProgress * const aProgress,
 void
 nsDocLoader::FireOnLocationChange(nsIWebProgress* aWebProgress,
                                   nsIRequest* aRequest,
-                                  nsIURI *aUri)
+                                  nsIURI *aUri,
+                                  PRUint32 aFlags)
 {
   /*                                                                           
    * First notify any listeners of the new state info...
@@ -1418,14 +1419,14 @@ nsDocLoader::FireOnLocationChange(nsIWebProgress* aWebProgress,
       continue;
     }
 
-    listener->OnLocationChange(aWebProgress, aRequest, aUri);
+    listener->OnLocationChange(aWebProgress, aRequest, aUri, aFlags);
   }
 
   mListenerInfoList.Compact();
 
   // Pass the notification up to the parent...
   if (mParent) {
-    mParent->FireOnLocationChange(aWebProgress, aRequest, aUri);
+    mParent->FireOnLocationChange(aWebProgress, aRequest, aUri, aFlags);
   }
 }
 
diff --git a/uriloader/base/nsDocLoader.h b/uriloader/base/nsDocLoader.h
index f730a65a4f62..d469e690ba7a 100644
--- a/uriloader/base/nsDocLoader.h
+++ b/uriloader/base/nsDocLoader.h
@@ -185,7 +185,8 @@ protected:
 
     void FireOnLocationChange(nsIWebProgress* aWebProgress,
                               nsIRequest* aRequest,
-                              nsIURI *aUri);
+                              nsIURI *aUri,
+                              PRUint32 aFlags);
 
     bool RefreshAttempted(nsIWebProgress* aWebProgress,
                             nsIURI *aURI,
diff --git a/uriloader/base/nsIWebProgressListener.idl b/uriloader/base/nsIWebProgressListener.idl
index 010bef874ca9..2aeffbc65748 100644
--- a/uriloader/base/nsIWebProgressListener.idl
+++ b/uriloader/base/nsIWebProgressListener.idl
@@ -51,7 +51,7 @@ interface nsIURI;
  * nsIWebProgress instances.  nsIWebProgress.idl describes the parent-child
  * relationship of nsIWebProgress instances.
  */
-[scriptable, uuid(570F39D1-EFD0-11d3-B093-00A024FFC08C)]
+[scriptable, uuid(a0cda7e4-c6ca-11e0-b6a5-001320257da5)]
 interface nsIWebProgressListener : nsISupports
 {
   /**
@@ -302,6 +302,16 @@ interface nsIWebProgressListener : nsISupports
                         in long aCurTotalProgress,
                         in long aMaxTotalProgress);
 
+  /**
+   * Flags for onLocationChange
+   *
+   * LOCATION_CHANGE_SAME_DOCUMENT
+   *   This flag is on when |aWebProgress| did not load a new document. 
+   *   For example, the location change is due to an anchor scroll or a
+   *   pushState/popState/replaceState.
+   */
+  const unsigned long LOCATION_CHANGE_SAME_DOCUMENT   = 0x00000001;
+
   /**
    * Called when the location of the window being watched changes.  This is not
    * when a load is requested, but rather once it is verified that the load is
@@ -316,10 +326,14 @@ interface nsIWebProgressListener : nsISupports
    *        The associated nsIRequest.  This may be null in some cases.
    * @param aLocation
    *        The URI of the location that is being loaded.
+   * @param aFlags
+   *        This is a value which explains the situation or the reason why
+   *        the location has changed.
    */
   void onLocationChange(in nsIWebProgress aWebProgress,
                         in nsIRequest aRequest,
-                        in nsIURI aLocation);
+                        in nsIURI aLocation,
+                        [optional] in unsigned long aFlags);
 
   /**
    * Notification that the status of a request has changed.  The status message
diff --git a/uriloader/exthandler/Makefile.in b/uriloader/exthandler/Makefile.in
index 80e23f1c402c..5b29d2a52b3e 100644
--- a/uriloader/exthandler/Makefile.in
+++ b/uriloader/exthandler/Makefile.in
@@ -60,11 +60,15 @@ else
 ifeq ($(MOZ_WIDGET_TOOLKIT),android)
 OSDIR		= android
 else
+ifeq ($(MOZ_WIDGET_TOOLKIT),gonk)
+OSDIR		= gonk
+else
 OSDIR		= unix
 endif
 endif
 endif
 endif
+endif
 
 VPATH		:= $(srcdir) $(srcdir)/$(OSDIR)
 
diff --git a/uriloader/exthandler/gonk/nsOSHelperAppService.cpp b/uriloader/exthandler/gonk/nsOSHelperAppService.cpp
new file mode 100644
index 000000000000..f37d27cba14b
--- /dev/null
+++ b/uriloader/exthandler/gonk/nsOSHelperAppService.cpp
@@ -0,0 +1,63 @@
+/* -*- Mode: c++; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Gonk code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Michael Wu <mwu@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsOSHelperAppService.h"
+
+nsOSHelperAppService::nsOSHelperAppService() : nsExternalHelperAppService()
+{
+}
+
+nsOSHelperAppService::~nsOSHelperAppService()
+{
+}
+
+already_AddRefed<nsIMIMEInfo>
+nsOSHelperAppService::GetMIMEInfoFromOS(const nsACString& aMIMEType,
+                                        const nsACString& aFileExt,
+                                        bool* aFound)
+{
+    *aFound = false;
+    return nsnull;
+}
+
+nsresult
+nsOSHelperAppService::OSProtocolHandlerExists(const char* aScheme,
+                                              bool* aExists)
+{
+    *aExists = false;
+    return NS_OK;
+}
diff --git a/uriloader/exthandler/gonk/nsOSHelperAppService.h b/uriloader/exthandler/gonk/nsOSHelperAppService.h
new file mode 100644
index 000000000000..2561ef73946b
--- /dev/null
+++ b/uriloader/exthandler/gonk/nsOSHelperAppService.h
@@ -0,0 +1,60 @@
+/* -*- Mode: c++; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Gonk code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Michael Wu <mwu@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsOSHelperAppService_h
+#define nsOSHelperAppService_h
+
+#include "nsCExternalHandlerService.h"
+#include "nsExternalHelperAppService.h"
+
+class nsOSHelperAppService : public nsExternalHelperAppService
+{
+public:
+    nsOSHelperAppService();
+    virtual ~nsOSHelperAppService();
+
+    virtual already_AddRefed<nsIMIMEInfo>
+    GetMIMEInfoFromOS(const nsACString& aMIMEType,
+                      const nsACString& aFileExt,
+                      bool* aFound);
+
+    virtual NS_HIDDEN_(nsresult)
+    OSProtocolHandlerExists(const char* aScheme,
+                            bool* aExists);
+};
+
+#endif /* nsOSHelperAppService_h */
diff --git a/uriloader/exthandler/nsExternalHelperAppService.cpp b/uriloader/exthandler/nsExternalHelperAppService.cpp
index d3045e78eae1..4831cc03b601 100644
--- a/uriloader/exthandler/nsExternalHelperAppService.cpp
+++ b/uriloader/exthandler/nsExternalHelperAppService.cpp
@@ -147,7 +147,7 @@
 #include "nsIDocShellTreeItem.h"
 #include "ExternalHelperAppChild.h"
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidBridge.h"
 #endif
 
@@ -485,7 +485,7 @@ static nsExtraMimeTypeEntry extraMimeEntries [] =
   { APPLICATION_XPINSTALL, "xpi", "XPInstall Install" },
   { APPLICATION_POSTSCRIPT, "ps,eps,ai", "Postscript File" },
   { APPLICATION_XJAVASCRIPT, "js", "Javascript Source File" },
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
   { "application/vnd.android.package-archive", "apk", "Android Package" },
 #endif
   { IMAGE_ART, "art", "ART Image" },
diff --git a/uriloader/prefetch/nsOfflineCacheUpdateService.cpp b/uriloader/prefetch/nsOfflineCacheUpdateService.cpp
index ea7ef0c0de5b..39be1b2f1054 100644
--- a/uriloader/prefetch/nsOfflineCacheUpdateService.cpp
+++ b/uriloader/prefetch/nsOfflineCacheUpdateService.cpp
@@ -206,7 +206,8 @@ nsOfflineCachePendingUpdate::OnStateChange(nsIWebProgress* aWebProgress,
 NS_IMETHODIMP
 nsOfflineCachePendingUpdate::OnLocationChange(nsIWebProgress* aWebProgress,
                                               nsIRequest* aRequest,
-                                              nsIURI *location)
+                                              nsIURI *location,
+                                              PRUint32 aFlags)
 {
     NS_NOTREACHED("notification excluded in AddProgressListener(...)");
     return NS_OK;
diff --git a/uriloader/prefetch/nsPrefetchService.cpp b/uriloader/prefetch/nsPrefetchService.cpp
index 99555627d13d..3fe73e96bf89 100644
--- a/uriloader/prefetch/nsPrefetchService.cpp
+++ b/uriloader/prefetch/nsPrefetchService.cpp
@@ -898,7 +898,8 @@ nsPrefetchService::OnStateChange(nsIWebProgress* aWebProgress,
 NS_IMETHODIMP
 nsPrefetchService::OnLocationChange(nsIWebProgress* aWebProgress,
                                     nsIRequest* aRequest,
-                                    nsIURI *location)
+                                    nsIURI *location,
+                                    PRUint32 aFlags)
 {
     NS_NOTREACHED("notification excluded in AddProgressListener(...)");
     return NS_OK;
diff --git a/widget/public/Makefile.in b/widget/public/Makefile.in
index a70e65a88576..90eb8abf6676 100644
--- a/widget/public/Makefile.in
+++ b/widget/public/Makefile.in
@@ -74,7 +74,6 @@ EXPORTS		= \
 		nsIPluginWidget.h \
 		nsINativeKeyBindings.h \
 		nsIDeviceContextSpec.h \
-		nsIMenuRollup.h \
 		nsIRollupListener.h \
 		$(NULL)
 
@@ -89,7 +88,7 @@ ifeq ($(MOZ_WIDGET_TOOLKIT),os2)
 EXPORTS		+= nsIDragSessionOS2.h
 endif
 
-ifeq ($(MOZ_WIDGET_TOOLKIT),android)
+ifneq (,$(filter android gonk,$(MOZ_WIDGET_TOOLKIT)))
 EXPORTS		+= \
 		nsIPrintDialogService.h \
 		$(NULL)
diff --git a/widget/public/nsIRollupListener.h b/widget/public/nsIRollupListener.h
index af1d839a4976..abdce647314e 100644
--- a/widget/public/nsIRollupListener.h
+++ b/widget/public/nsIRollupListener.h
@@ -42,7 +42,10 @@
 #ifndef __nsIRollupListener_h__
 #define __nsIRollupListener_h__
 
+#include "nsTArray.h"
+
 class nsIContent;
+class nsIWidget;
 
 class nsIRollupListener {
  public: 
@@ -53,19 +56,30 @@ class nsIRollupListener {
    *
    * aCount is the number of popups in a chain to close. If this is
    * PR_UINT32_MAX, then all popups are closed.
+   * If aGetLastRolledUp is true, then return the last rolled up popup,
+   * if this is supported.
    */
-  NS_IMETHOD Rollup(PRUint32 aCount, nsIContent **aContent) = 0;
+  virtual nsIContent* Rollup(PRUint32 aCount, bool aGetLastRolledUp = false) = 0;
 
   /**
    * Asks the RollupListener if it should rollup on mousevents
    */
-  NS_IMETHOD ShouldRollupOnMouseWheelEvent(bool *aShould) = 0;
+  virtual bool ShouldRollupOnMouseWheelEvent() = 0;
 
   /**
    * Asks the RollupListener if it should rollup on mouse activate, eg. X-Mouse
    */
-  NS_IMETHOD ShouldRollupOnMouseActivate(bool *aShould) = 0;
+  virtual bool ShouldRollupOnMouseActivate() = 0;
 
+  /*
+   * Retrieve the widgets for open menus and store them in the array
+   * aWidgetChain. The number of menus of the same type should be returned,
+   * for example, if a context menu is open, return only the number of menus
+   * that are part of the context menu chain. This allows closing up only
+   * those menus in different situations. The returned value should be exactly
+   * the same number of widgets added to aWidgetChain.
+   */
+  virtual PRUint32 GetSubmenuWidgetChain(nsTArray<nsIWidget*> *aWidgetChain) = 0;
 };
 
 #endif /* __nsIRollupListener_h__ */
diff --git a/widget/public/nsIWidget.h b/widget/public/nsIWidget.h
index 87961269835d..93aaa4281e58 100644
--- a/widget/public/nsIWidget.h
+++ b/widget/public/nsIWidget.h
@@ -62,7 +62,6 @@ class   nsRenderingContext;
 class   nsDeviceContext;
 struct  nsFont;
 class   nsIRollupListener;
-class   nsIMenuRollup;
 class   nsGUIEvent;
 class   imgIContainer;
 class   gfxASurface;
@@ -119,8 +118,8 @@ typedef nsEventStatus (* EVENT_CALLBACK)(nsGUIEvent *event);
 #endif
 
 #define NS_IWIDGET_IID \
-  { 0x712b07a4, 0x4344, 0x4404, \
-    { 0xaf, 0x85, 0x63, 0x3d, 0x68, 0x0b, 0x21, 0xb0 } }
+  { 0x32966f95, 0x89e0, 0x447a, \
+    { 0x91, 0x8d, 0x58, 0x53, 0xd6, 0x99, 0x4a, 0x72 } }
 
 /*
  * Window shadow styles
@@ -1028,8 +1027,8 @@ class nsIWidget : public nsISupports {
      * @param aConsumeRollupEvent true consumes the rollup event, false dispatches rollup event
      *
      */
-    NS_IMETHOD CaptureRollupEvents(nsIRollupListener * aListener, nsIMenuRollup * aMenuRollup,
-                                   bool aDoCapture, bool aConsumeRollupEvent) = 0;
+    NS_IMETHOD CaptureRollupEvents(nsIRollupListener * aListener, bool aDoCapture,
+                                   bool aConsumeRollupEvent) = 0;
 
     /**
      * Bring this window to the user's attention.  This is intended to be a more
diff --git a/widget/src/Makefile.in b/widget/src/Makefile.in
index 2ac259e2545b..bf997103ed25 100644
--- a/widget/src/Makefile.in
+++ b/widget/src/Makefile.in
@@ -46,7 +46,7 @@ MODULE  = widget
 
 DIRS		= shared xpwidgets
 
-ifneq (,$(filter os2 cocoa qt android,$(MOZ_WIDGET_TOOLKIT)))
+ifneq (,$(filter os2 cocoa qt android gonk,$(MOZ_WIDGET_TOOLKIT)))
 DIRS		+= $(MOZ_WIDGET_TOOLKIT)
 endif
 
diff --git a/widget/src/android/AndroidBridge.cpp b/widget/src/android/AndroidBridge.cpp
index f59e1b129fa3..7acc2b50be56 100644
--- a/widget/src/android/AndroidBridge.cpp
+++ b/widget/src/android/AndroidBridge.cpp
@@ -159,7 +159,12 @@ AndroidBridge::Init(JNIEnv *jEnv,
     jCloseCamera = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "closeCamera", "()V");
     jEnableBatteryNotifications = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "enableBatteryNotifications", "()V");
     jDisableBatteryNotifications = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "disableBatteryNotifications", "()V");
-    jGetCurrentBatteryInformation = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getCurrentBatteryInformation", "()[F");
+    jGetCurrentBatteryInformation = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getCurrentBatteryInformation", "()[D");
+
+    jGetAccessibilityEnabled = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getAccessibilityEnabled", "()Z");
+    jHandleGeckoMessage = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "handleGeckoMessage", "(Ljava/lang/String;)Ljava/lang/String;");
+    jCheckUriVisited = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "checkUriVisited", "(Ljava/lang/String;)V");
+    jMarkUriVisited = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "markUriVisited", "(Ljava/lang/String;)V");
 
     jEGLContextClass = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("javax/microedition/khronos/egl/EGLContext"));
     jEGL10Class = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("javax/microedition/khronos/egl/EGL10"));
@@ -670,6 +675,13 @@ AndroidBridge::HideProgressDialogOnce()
     }
 }
 
+bool
+AndroidBridge::GetAccessibilityEnabled()
+{
+    ALOG_BRIDGE("AndroidBridge::GetAccessibilityEnabled");
+    return mJNIEnv->CallStaticBooleanMethod(mGeckoAppShellClass, jGetAccessibilityEnabled);
+}
+
 void
 AndroidBridge::PerformHapticFeedback(bool aIsLongPress)
 {
@@ -681,6 +693,8 @@ AndroidBridge::PerformHapticFeedback(bool aIsLongPress)
 void
 AndroidBridge::Vibrate(const nsTArray<PRUint32>& aPattern)
 {
+    AutoLocalJNIFrame frame;
+
     ALOG_BRIDGE("AndroidBridge::Vibrate");
 
     PRUint32 len = aPattern.Length();
@@ -837,6 +851,12 @@ AndroidBridge::SetSurfaceView(jobject obj)
     mSurfaceView.Init(obj);
 }
 
+void
+AndroidBridge::SetSoftwareLayerClient(jobject obj)
+{
+    mSoftwareLayerClient.Init(obj);
+}
+
 void
 AndroidBridge::ShowInputMethodPicker()
 {
@@ -1000,10 +1020,8 @@ AndroidBridge::CreateShortcut(const nsAString& aTitle, const nsAString& aURI, co
 void
 AndroidBridge::PostToJavaThread(nsIRunnable* aRunnable, bool aMainThread)
 {
-    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "%s", __PRETTY_FUNCTION__);
     JNIEnv* env = AndroidBridge::AttachThread(false);
     if (!env) {
-        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "no jni env in %s!!", __PRETTY_FUNCTION__);
         return;
     }
     mRunnableQueue.AppendObject(aRunnable);
@@ -1014,27 +1032,21 @@ AndroidBridge::PostToJavaThread(nsIRunnable* aRunnable, bool aMainThread)
         env->ExceptionDescribe();
         env->ExceptionClear();
     }
-    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "leaving %s", __PRETTY_FUNCTION__);
 }
 
 void
 AndroidBridge::ExecuteNextRunnable()
 {
-    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "%s", __PRETTY_FUNCTION__);
-
     JNIEnv* env = AndroidBridge::AttachThread(false);
     if (!env) {
-        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "no jni env in %s!!", __PRETTY_FUNCTION__);
         return;
     }
 
     if (mRunnableQueue.Count() > 0) {
         nsIRunnable* r = mRunnableQueue[0];
-        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "going to run %p", r);
         r->Run();
         mRunnableQueue.RemoveObjectAt(0);
     }
-    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "leaving %s", __PRETTY_FUNCTION__);
 }
 
 void
@@ -1251,19 +1263,68 @@ AndroidBridge::GetCurrentBatteryInformation(hal::BatteryInformation* aBatteryInf
     AutoLocalJNIFrame jniFrame;
 
     // To prevent calling too many methods through JNI, the Java method returns
-    // an array of float even if we actually want a float and a boolean.
+    // an array of double even if we actually want a double and a boolean.
     jobject obj = mJNIEnv->CallStaticObjectMethod(mGeckoAppShellClass, jGetCurrentBatteryInformation);
-    jfloatArray arr = static_cast<jfloatArray>(obj);
-    if (!arr || mJNIEnv->GetArrayLength(arr) != 2) {
+    jdoubleArray arr = static_cast<jdoubleArray>(obj);
+    if (!arr || mJNIEnv->GetArrayLength(arr) != 3) {
         return;
     }
 
-    jfloat* info = mJNIEnv->GetFloatArrayElements(arr, 0);
+    jdouble* info = mJNIEnv->GetDoubleArrayElements(arr, 0);
 
     aBatteryInfo->level() = info[0];
     aBatteryInfo->charging() = info[1] == 1.0f;
+    aBatteryInfo->remainingTime() = info[2];
 
-    mJNIEnv->ReleaseFloatArrayElements(arr, info, 0);
+    mJNIEnv->ReleaseDoubleArrayElements(arr, info, 0);
+}
+
+void
+AndroidBridge::HandleGeckoMessage(const nsAString &aMessage, nsAString &aRet)
+{
+    ALOG_BRIDGE("%s", __PRETTY_FUNCTION__);
+    JNIEnv* env = AndroidBridge::AttachThread(false);
+    if (!env) {
+        ALOG_BRIDGE("no jni env in %s!!", __PRETTY_FUNCTION__);
+        return;
+    }
+
+    AutoLocalJNIFrame jniFrame(1);
+    jstring jMessage = mJNIEnv->NewString(nsPromiseFlatString(aMessage).get(), aMessage.Length());
+    jstring returnMessage =  static_cast<jstring>(env->CallStaticObjectMethod(mGeckoAppShellClass, jHandleGeckoMessage, jMessage));
+
+    jthrowable ex = env->ExceptionOccurred();
+    if (ex) {
+        env->ExceptionDescribe();
+        env->ExceptionClear();
+    }
+    nsJNIString jniStr(returnMessage);
+    aRet.Assign(jniStr);
+    ALOG_BRIDGE("leaving %s", __PRETTY_FUNCTION__);
+}
+
+void
+AndroidBridge::CheckURIVisited(const nsAString& aURI)
+{
+  AutoLocalJNIFrame jniFrame(1);
+  jstring jstrURI = mJNIEnv->NewString(nsPromiseFlatString(aURI).get(), aURI.Length());
+  mJNIEnv->CallStaticVoidMethod(mGeckoAppShellClass, jCheckUriVisited, jstrURI);
+}
+
+void
+AndroidBridge::MarkURIVisited(const nsAString& aURI)
+{
+  AutoLocalJNIFrame jniFrame(1);
+  jstring jstrURI = mJNIEnv->NewString(nsPromiseFlatString(aURI).get(), aURI.Length());
+  mJNIEnv->CallStaticVoidMethod(mGeckoAppShellClass, jMarkUriVisited, jstrURI);
+}
+
+void AndroidBridge::EmitGeckoAccessibilityEvent (PRInt32 eventType, const nsAString& role, const nsAString& text, const nsAString& description, bool enabled, bool checked, bool password) {
+    AutoLocalJNIFrame jniFrame;
+    jstring jstrRole = mJNIEnv->NewString(nsPromiseFlatString(role).get(), role.Length());
+    jstring jstrText = mJNIEnv->NewString(nsPromiseFlatString(text).get(), text.Length());
+    jstring jstrDescription = mJNIEnv->NewString(nsPromiseFlatString(description).get(), description.Length());
+    mJNIEnv->CallStaticVoidMethod(mGeckoAppShellClass, jEmitGeckoAccessibilityEvent, eventType, jstrRole, jstrText, jstrDescription, enabled, checked, password);
 }
 
 void *
@@ -1376,3 +1437,21 @@ AndroidBridge::UnlockWindow(void* window)
 
     return true;
 }
+
+/* Implementation file */
+NS_IMPL_ISUPPORTS1(nsAndroidBridge, nsIAndroidBridge)
+
+nsAndroidBridge::nsAndroidBridge()
+{
+}
+
+nsAndroidBridge::~nsAndroidBridge()
+{
+}
+
+/* void handleGeckoEvent (in AString message); */
+NS_IMETHODIMP nsAndroidBridge::HandleGeckoMessage(const nsAString & message, nsAString &aRet NS_OUTPARAM)
+{
+    AndroidBridge::Bridge()->HandleGeckoMessage(message, aRet);
+    return NS_OK;
+}
diff --git a/widget/src/android/AndroidBridge.h b/widget/src/android/AndroidBridge.h
index f9ddb4605f4d..1f3ef976223d 100644
--- a/widget/src/android/AndroidBridge.h
+++ b/widget/src/android/AndroidBridge.h
@@ -40,6 +40,7 @@
 
 #include <jni.h>
 #include <android/log.h>
+#include <cstdlib>
 
 #include "nsCOMPtr.h"
 #include "nsCOMArray.h"
@@ -52,6 +53,8 @@
 #include "nsIMIMEInfo.h"
 #include "nsColor.h"
 
+#include "nsIAndroidBridge.h"
+
 // Some debug #defines
 // #define DEBUG_ANDROID_EVENTS
 // #define DEBUG_ANDROID_WIDGET
@@ -147,6 +150,9 @@ public:
 
     void ScheduleRestart();
 
+    void SetSoftwareLayerClient(jobject jobj);
+    AndroidGeckoSoftwareLayerClient &GetSoftwareLayerClient() { return mSoftwareLayerClient; }
+
     void SetSurfaceView(jobject jobj);
     AndroidGeckoSurfaceView& SurfaceView() { return mSurfaceView; }
 
@@ -222,6 +228,8 @@ public:
 
     void FireAndWaitForTracerEvent();
 
+    bool GetAccessibilityEnabled();
+
     struct AutoLocalJNIFrame {
         AutoLocalJNIFrame(int nEntries = 128) : mEntries(nEntries) {
             // Make sure there is enough space to store a local ref to the
@@ -289,6 +297,13 @@ public:
 
     bool LockWindow(void *window, unsigned char **bits, int *width, int *height, int *format, int *stride);
     bool UnlockWindow(void *window);
+    
+    void HandleGeckoMessage(const nsAString& message, nsAString &aRet);
+
+    void EmitGeckoAccessibilityEvent (PRInt32 eventType, const nsAString& role, const nsAString& text, const nsAString& description, bool enabled, bool checked, bool password);
+
+    void CheckURIVisited(const nsAString& uri);
+    void MarkURIVisited(const nsAString& uri);
 
     bool InitCamera(const nsCString& contentType, PRUint32 camera, PRUint32 *width, PRUint32 *height, PRUint32 *fps);
 
@@ -310,6 +325,7 @@ protected:
 
     // the GeckoSurfaceView
     AndroidGeckoSurfaceView mSurfaceView;
+    AndroidGeckoSoftwareLayerClient mSoftwareLayerClient;
 
     // the GeckoAppShell java class
     jclass mGeckoAppShellClass;
@@ -375,6 +391,11 @@ protected:
     jmethodID jEnableBatteryNotifications;
     jmethodID jDisableBatteryNotifications;
     jmethodID jGetCurrentBatteryInformation;
+    jmethodID jGetAccessibilityEnabled;
+    jmethodID jHandleGeckoMessage;
+    jmethodID jCheckUriVisited;
+    jmethodID jMarkUriVisited;
+    jmethodID jEmitGeckoAccessibilityEvent;
 
     // stuff we need for CallEglCreateWindowSurface
     jclass jEGLSurfaceImplClass;
@@ -399,6 +420,24 @@ protected:
 
 }
 
+#define NS_ANDROIDBRIDGE_CID \
+{ 0x0FE2321D, 0xEBD9, 0x467D, \
+    { 0xA7, 0x43, 0x03, 0xA6, 0x8D, 0x40, 0x59, 0x9E } }
+
+class nsAndroidBridge : public nsIAndroidBridge
+{
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIANDROIDBRIDGE
+
+  nsAndroidBridge();
+
+private:
+  ~nsAndroidBridge();
+
+protected:
+};
+
 extern "C" JNIEnv * GetJNIForThread();
 extern bool mozilla_AndroidBridge_SetMainThread(void *);
 extern jclass GetGeckoAppShellClass();
diff --git a/widget/src/android/AndroidJNI.cpp b/widget/src/android/AndroidJNI.cpp
index a627e3d801c6..476116a41202 100644
--- a/widget/src/android/AndroidJNI.cpp
+++ b/widget/src/android/AndroidJNI.cpp
@@ -44,6 +44,7 @@
 #include <jni.h>
 #include <pthread.h>
 #include <dlfcn.h>
+#include <stdio.h>
 
 #include "nsAppShell.h"
 #include "nsWindow.h"
@@ -52,6 +53,10 @@
 #include "mozilla/Services.h"
 #include "nsINetworkLinkService.h"
 
+#ifdef MOZ_ANDROID_HISTORY
+#include "nsAndroidHistory.h"
+#endif
+
 #ifdef MOZ_CRASHREPORTER
 #include "nsICrashReporter.h"
 #include "nsExceptionHandler.h"
@@ -66,6 +71,7 @@ extern "C" {
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_nativeInit(JNIEnv *, jclass);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_notifyGeckoOfEvent(JNIEnv *, jclass, jobject event);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_processNextNativeEvent(JNIEnv *, jclass);
+    NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_setSoftwareLayerClient(JNIEnv *jenv, jclass, jobject sv);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_setSurfaceView(JNIEnv *jenv, jclass, jobject sv);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_onResume(JNIEnv *, jclass);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_onLowMemory(JNIEnv *, jclass);
@@ -74,7 +80,8 @@ extern "C" {
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv *, jclass, jstring status);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash(JNIEnv *, jclass, jstring stack);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_executeNextRunnable(JNIEnv *, jclass);
-    NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_notifyBatteryChange(JNIEnv* jenv, jclass, jfloat, jboolean);
+    NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_notifyUriVisited(JNIEnv *, jclass, jstring uri);
+    NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_notifyBatteryChange(JNIEnv* jenv, jclass, jdouble, jboolean, jdouble);
 }
 
 
@@ -110,6 +117,12 @@ Java_org_mozilla_gecko_GeckoAppShell_setSurfaceView(JNIEnv *jenv, jclass, jobjec
     AndroidBridge::Bridge()->SetSurfaceView(jenv->NewGlobalRef(obj));
 }
 
+NS_EXPORT void JNICALL
+Java_org_mozilla_gecko_GeckoAppShell_setSoftwareLayerClient(JNIEnv *jenv, jclass, jobject obj)
+{
+    AndroidBridge::Bridge()->SetSoftwareLayerClient(jenv->NewGlobalRef(obj));
+}
+
 NS_EXPORT void JNICALL
 Java_org_mozilla_gecko_GeckoAppShell_onLowMemory(JNIEnv *jenv, jclass jc)
 {
@@ -189,29 +202,40 @@ Java_org_mozilla_gecko_GeckoAppShell_executeNextRunnable(JNIEnv *, jclass)
     __android_log_print(ANDROID_LOG_INFO, "GeckoJNI", "leaving %s", __PRETTY_FUNCTION__);
 }
 
+NS_EXPORT void JNICALL
+Java_org_mozilla_gecko_GeckoAppShell_notifyUriVisited(JNIEnv *jenv, jclass, jstring uri)
+{
+#ifdef MOZ_ANDROID_HISTORY
+    nsAndroidHistory::NotifyURIVisited(nsJNIString(uri, jenv));
+#endif
+}
+
 NS_EXPORT void JNICALL
 Java_org_mozilla_gecko_GeckoAppShell_notifyBatteryChange(JNIEnv* jenv, jclass,
-                                                         jfloat aLevel,
-                                                         jboolean aCharging)
+                                                         jdouble aLevel,
+                                                         jboolean aCharging,
+                                                         jdouble aRemainingTime)
 {
     class NotifyBatteryChangeRunnable : public nsRunnable {
     public:
-      NotifyBatteryChangeRunnable(float aLevel, bool aCharging)
+      NotifyBatteryChangeRunnable(double aLevel, bool aCharging, double aRemainingTime)
         : mLevel(aLevel)
         , mCharging(aCharging)
+        , mRemainingTime(aRemainingTime)
       {}
 
       NS_IMETHODIMP Run() {
-        hal::NotifyBatteryChange(hal::BatteryInformation(mLevel, mCharging));
+        hal::NotifyBatteryChange(hal::BatteryInformation(mLevel, mCharging, mRemainingTime));
         return NS_OK;
       }
 
     private:
-      float mLevel;
-      bool  mCharging;
+      double mLevel;
+      bool   mCharging;
+      double mRemainingTime;
     };
 
-    nsCOMPtr<nsIRunnable> runnable = new NotifyBatteryChangeRunnable(aLevel, aCharging);
+    nsCOMPtr<nsIRunnable> runnable = new NotifyBatteryChangeRunnable(aLevel, aCharging, aRemainingTime);
     NS_DispatchToMainThread(runnable);
 }
 
diff --git a/widget/src/android/AndroidJavaWrappers.cpp b/widget/src/android/AndroidJavaWrappers.cpp
index 5c693c8db0a0..07401d9de2d1 100644
--- a/widget/src/android/AndroidJavaWrappers.cpp
+++ b/widget/src/android/AndroidJavaWrappers.cpp
@@ -56,6 +56,7 @@ jfieldID AndroidGeckoEvent::jRectField = 0;
 jfieldID AndroidGeckoEvent::jNativeWindowField = 0;
 
 jfieldID AndroidGeckoEvent::jCharactersField = 0;
+jfieldID AndroidGeckoEvent::jCharactersExtraField = 0;
 jfieldID AndroidGeckoEvent::jKeyCodeField = 0;
 jfieldID AndroidGeckoEvent::jMetaStateField = 0;
 jfieldID AndroidGeckoEvent::jFlagsField = 0;
@@ -102,6 +103,11 @@ jmethodID AndroidAddress::jGetSubLocalityMethod;
 jmethodID AndroidAddress::jGetSubThoroughfareMethod;
 jmethodID AndroidAddress::jGetThoroughfareMethod;
 
+jclass AndroidGeckoSoftwareLayerClient::jGeckoSoftwareLayerClientClass = 0;
+jmethodID AndroidGeckoSoftwareLayerClient::jLockBufferMethod = 0;
+jmethodID AndroidGeckoSoftwareLayerClient::jUnlockBufferMethod = 0;
+jmethodID AndroidGeckoSoftwareLayerClient::jBeginDrawingMethod = 0;
+jmethodID AndroidGeckoSoftwareLayerClient::jEndDrawingMethod = 0;
 jclass AndroidGeckoSurfaceView::jGeckoSurfaceViewClass = 0;
 jmethodID AndroidGeckoSurfaceView::jBeginDrawingMethod = 0;
 jmethodID AndroidGeckoSurfaceView::jEndDrawingMethod = 0;
@@ -130,10 +136,12 @@ void
 mozilla::InitAndroidJavaWrappers(JNIEnv *jEnv)
 {
     AndroidGeckoEvent::InitGeckoEventClass(jEnv);
-    AndroidGeckoSurfaceView::InitGeckoSurfaceViewClass(jEnv);
     AndroidPoint::InitPointClass(jEnv);
     AndroidLocation::InitLocationClass(jEnv);
     AndroidAddress::InitAddressClass(jEnv);
+    AndroidRect::InitRectClass(jEnv);
+    AndroidGeckoSoftwareLayerClient::InitGeckoSoftwareLayerClientClass(jEnv);
+    AndroidGeckoSurfaceView::InitGeckoSurfaceViewClass(jEnv);
 }
 
 void
@@ -157,6 +165,7 @@ AndroidGeckoEvent::InitGeckoEventClass(JNIEnv *jEnv)
     jRectField = getField("mRect", "Landroid/graphics/Rect;");
 
     jCharactersField = getField("mCharacters", "Ljava/lang/String;");
+    jCharactersExtraField = getField("mCharactersExtra", "Ljava/lang/String;");
     jKeyCodeField = getField("mKeyCode", "I");
     jMetaStateField = getField("mMetaState", "I");
     jFlagsField = getField("mFlags", "I");
@@ -174,6 +183,7 @@ AndroidGeckoEvent::InitGeckoEventClass(JNIEnv *jEnv)
 void
 AndroidGeckoSurfaceView::InitGeckoSurfaceViewClass(JNIEnv *jEnv)
 {
+#ifndef MOZ_JAVA_COMPOSITOR
     initInit();
 
     jGeckoSurfaceViewClass = getClassGlobalRef("org/mozilla/gecko/GeckoSurfaceView");
@@ -186,6 +196,7 @@ AndroidGeckoSurfaceView::InitGeckoSurfaceViewClass(JNIEnv *jEnv)
     jDraw2DBufferMethod = getMethod("draw2D", "(Ljava/nio/ByteBuffer;I)V");
     jGetSurfaceMethod = getMethod("getSurface", "()Landroid/view/Surface;");
     jGetHolderMethod = getMethod("getHolder", "()Landroid/view/SurfaceHolder;");
+#endif
 }
 
 void
@@ -302,6 +313,22 @@ AndroidRect::InitRectClass(JNIEnv *jEnv)
     jRightField = getField("right", "I");
 }
 
+void
+AndroidGeckoSoftwareLayerClient::InitGeckoSoftwareLayerClientClass(JNIEnv *jEnv)
+{
+#ifdef MOZ_JAVA_COMPOSITOR
+    initInit();
+
+    jGeckoSoftwareLayerClientClass =
+        getClassGlobalRef("org/mozilla/gecko/gfx/GeckoSoftwareLayerClient");
+
+    jLockBufferMethod = getMethod("lockBuffer", "()Ljava/nio/ByteBuffer;");
+    jUnlockBufferMethod = getMethod("unlockBuffer", "()V");
+    jBeginDrawingMethod = getMethod("beginDrawing", "()V");
+    jEndDrawingMethod = getMethod("endDrawing", "(IIII)V");
+#endif
+}
+
 #undef initInit
 #undef initClassGlobalRef
 #undef getField
@@ -351,6 +378,27 @@ AndroidGeckoEvent::ReadCharactersField(JNIEnv *jenv)
     jenv->GetStringRegion(s, 0, len, mCharacters.BeginWriting());
 }
 
+void
+AndroidGeckoEvent::ReadCharactersExtraField(JNIEnv *jenv)
+{
+    jstring s = (jstring) jenv->GetObjectField(wrapped_obj, jCharactersExtraField);
+    if (!s) {
+        mCharactersExtra.SetIsVoid(PR_TRUE);
+        return;
+    }
+
+    int len = jenv->GetStringLength(s);
+    mCharactersExtra.SetLength(len);
+    jenv->GetStringRegion(s, 0, len, mCharactersExtra.BeginWriting());
+}
+
+void
+AndroidGeckoEvent::Init(int aType, nsIntRect const& aRect)
+{
+    mType = aType;
+    mRect = aRect;
+}
+
 void
 AndroidGeckoEvent::Init(JNIEnv *jenv, jobject jobj)
 {
@@ -437,6 +485,17 @@ AndroidGeckoEvent::Init(JNIEnv *jenv, jobject jobj)
             break;
         }
 
+        case BROADCAST: {
+            ReadCharactersField(jenv);
+            ReadCharactersExtraField(jenv);
+            break;
+        }
+
+        case SAVE_STATE: {
+            ReadCharactersField(jenv);
+            break;
+        }
+
         default:
             break;
     }
@@ -472,6 +531,25 @@ AndroidGeckoEvent::Init(AndroidGeckoEvent *aResizeEvent)
     mP1.y = aResizeEvent->mP1.y;
 }
 
+void
+AndroidPoint::Init(JNIEnv *jenv, jobject jobj)
+{
+    if (jobj) {
+        mX = jenv->GetIntField(jobj, jXField);
+        mY = jenv->GetIntField(jobj, jYField);
+    } else {
+        mX = 0;
+        mY = 0;
+    }
+}
+
+void
+AndroidGeckoSoftwareLayerClient::Init(jobject jobj)
+{
+    NS_ASSERTION(wrapped_obj == nsnull, "Init called on non-null wrapped_obj!");
+    wrapped_obj = jobj;
+}
+
 void
 AndroidGeckoSurfaceView::Init(jobject jobj)
 {
@@ -506,6 +584,46 @@ AndroidGeckoSurfaceView::Draw2D(jobject buffer, int stride)
     JNI()->CallVoidMethod(wrapped_obj, jDraw2DBufferMethod, buffer, stride);
 }
 
+jobject
+AndroidGeckoSoftwareLayerClient::LockBuffer()
+{
+    NS_ASSERTION(!isNull(), "LockBuffer() called on null software layer client!");
+    AndroidBridge::AutoLocalJNIFrame(1);
+    return JNI()->CallObjectMethod(wrapped_obj, jLockBufferMethod);
+}
+
+unsigned char *
+AndroidGeckoSoftwareLayerClient::LockBufferBits()
+{
+    AndroidBridge::AutoLocalJNIFrame(1);
+    return reinterpret_cast<unsigned char *>(JNI()->GetDirectBufferAddress(LockBuffer()));
+}
+
+void
+AndroidGeckoSoftwareLayerClient::UnlockBuffer()
+{
+    NS_ASSERTION(!isNull(), "UnlockBuffer() called on null software layer client!");
+    AndroidBridge::AutoLocalJNIFrame(1);
+    JNI()->CallVoidMethod(wrapped_obj, jUnlockBufferMethod);
+}
+
+void
+AndroidGeckoSoftwareLayerClient::BeginDrawing()
+{
+    NS_ASSERTION(!isNull(), "BeginDrawing() called on null software layer client!");
+    AndroidBridge::AutoLocalJNIFrame(1);
+    return JNI()->CallVoidMethod(wrapped_obj, jBeginDrawingMethod);
+}
+
+void
+AndroidGeckoSoftwareLayerClient::EndDrawing(const nsIntRect &aRect)
+{
+    NS_ASSERTION(!isNull(), "EndDrawing() called on null software layer client!");
+    AndroidBridge::AutoLocalJNIFrame(1);
+    return JNI()->CallVoidMethod(wrapped_obj, jEndDrawingMethod, aRect.x, aRect.y, aRect.width,
+                                 aRect.height);
+}
+
 jobject
 AndroidGeckoSurfaceView::GetSoftwareDrawBitmap()
 {
@@ -530,22 +648,6 @@ AndroidGeckoSurfaceView::GetSurfaceHolder()
     return JNI()->CallObjectMethod(wrapped_obj, jGetHolderMethod);
 }
 
-void
-AndroidPoint::Init(JNIEnv *jenv, jobject jobj)
-{
-    NS_ASSERTION(wrapped_obj == nsnull, "Init called on non-null wrapped_obj!");
-
-    wrapped_obj = jobj;
-
-    if (jobj) {
-        mX = jenv->GetIntField(jobj, jXField);
-        mY = jenv->GetIntField(jobj, jYField);
-    } else {
-        mX = 0;
-        mY = 0;
-    }
-}
-
 void
 AndroidRect::Init(JNIEnv *jenv, jobject jobj)
 {
diff --git a/widget/src/android/AndroidJavaWrappers.h b/widget/src/android/AndroidJavaWrappers.h
index 423335227f9b..3a61132ffa9b 100644
--- a/widget/src/android/AndroidJavaWrappers.h
+++ b/widget/src/android/AndroidJavaWrappers.h
@@ -149,6 +149,32 @@ protected:
     static jfieldID jTopField;
 };
 
+class AndroidGeckoSoftwareLayerClient : public WrappedJavaObject {
+public:
+    static void InitGeckoSoftwareLayerClientClass(JNIEnv *jEnv);
+ 
+     void Init(jobject jobj);
+ 
+    AndroidGeckoSoftwareLayerClient() {}
+    AndroidGeckoSoftwareLayerClient(jobject jobj) { Init(jobj); }
+
+    jobject LockBuffer();
+    unsigned char *LockBufferBits();
+    void UnlockBuffer();
+    void BeginDrawing();
+    void EndDrawing(const nsIntRect &aRect);
+
+private:
+    static jclass jGeckoSoftwareLayerClientClass;
+    static jmethodID jLockBufferMethod;
+    static jmethodID jUnlockBufferMethod;
+
+protected:
+     static jmethodID jBeginDrawingMethod;
+     static jmethodID jEndDrawingMethod;
+};
+
+
 class AndroidGeckoSurfaceView : public WrappedJavaObject
 {
 public:
@@ -388,6 +414,9 @@ public:
     AndroidGeckoEvent(int x1, int y1, int x2, int y2) {
         Init(x1, y1, x2, y2);
     }
+    AndroidGeckoEvent(int aType, const nsIntRect &aRect) {
+        Init(aType, aRect);
+    }
     AndroidGeckoEvent(JNIEnv *jenv, jobject jobj) {
         Init(jenv, jobj);
     }
@@ -398,6 +427,7 @@ public:
     void Init(JNIEnv *jenv, jobject jobj);
     void Init(int aType);
     void Init(int x1, int y1, int x2, int y2);
+    void Init(int aType, const nsIntRect &aRect);
     void Init(AndroidGeckoEvent *aResizeEvent);
 
     int Action() { return mAction; }
@@ -413,6 +443,7 @@ public:
     double Z() { return mZ; }
     const nsIntRect& Rect() { return mRect; }
     nsAString& Characters() { return mCharacters; }
+    nsAString& CharactersExtra() { return mCharactersExtra; }
     int KeyCode() { return mKeyCode; }
     int MetaState() { return mMetaState; }
     int Flags() { return mFlags; }
@@ -440,7 +471,7 @@ protected:
     int mRangeForeColor, mRangeBackColor;
     double mAlpha, mBeta, mGamma;
     double mX, mY, mZ;
-    nsString mCharacters;
+    nsString mCharacters, mCharactersExtra;
     nsRefPtr<nsGeoPosition> mGeoPosition;
     nsRefPtr<nsGeoPositionAddress> mGeoAddress;
 
@@ -448,6 +479,7 @@ protected:
     void ReadP1Field(JNIEnv *jenv);
     void ReadRectField(JNIEnv *jenv);
     void ReadCharactersField(JNIEnv *jenv);
+    void ReadCharactersExtraField(JNIEnv *jenv);
 
     static jclass jGeckoEventClass;
     static jfieldID jActionField;
@@ -465,6 +497,7 @@ protected:
     static jfieldID jNativeWindowField;
 
     static jfieldID jCharactersField;
+    static jfieldID jCharactersExtraField;
     static jfieldID jKeyCodeField;
     static jfieldID jMetaStateField;
     static jfieldID jFlagsField;
@@ -498,6 +531,8 @@ public:
         GECKO_EVENT_SYNC = 15,
         FORCED_RESIZE = 16,
         ACTIVITY_START = 17,
+        SAVE_STATE = 18,
+        BROADCAST = 19,
         dummy_java_enum_list_end
     };
 
diff --git a/widget/src/android/Makefile.in b/widget/src/android/Makefile.in
index 5c89001c5fa9..865142727ab2 100644
--- a/widget/src/android/Makefile.in
+++ b/widget/src/android/Makefile.in
@@ -44,12 +44,16 @@ include $(DEPTH)/config/autoconf.mk
 
 MODULE          = widget
 LIBRARY_NAME    = widget_android
+XPIDL_MODULE	= widget_android
 EXPORT_LIBRARY  = 1
 IS_COMPONENT    = 1
 MODULE_NAME     = nsWidgetAndroidModule
 GRE_MODULE      = 1
 LIBXUL_LIBRARY  = 1
 
+ifdef MOZ_JAVA_COMPOSITOR
+DEFINES += -DMOZ_JAVA_COMPOSITOR
+endif
 
 CPPSRCS	= \
 	GfxInfo.cpp \
@@ -78,6 +82,10 @@ NOT_THERE_YET_CPPSRCS = \
 	nsSound.cpp \
 	$(NULL)
 
+XPIDLSRCS	= \
+	nsIAndroidBridge.idl \
+	$(NULL)
+
 SHARED_LIBRARY_LIBS = ../xpwidgets/libxpwidgets_s.a
 
 EXPORTS = AndroidBridge.h AndroidJavaWrappers.h
@@ -91,6 +99,8 @@ LOCAL_INCLUDES += \
 	-I$(topsrcdir)/widget/src/xpwidgets \
 	-I$(topsrcdir)/widget/src/shared \
 	-I$(topsrcdir)/dom/system/android \
+	-I$(topsrcdir)/toolkit/components/places \
+	-I$(topsrcdir)/docshell/base \
 	-I$(srcdir) \
 	$(NULL)
 
diff --git a/widget/src/android/nsAppShell.cpp b/widget/src/android/nsAppShell.cpp
index 0de3a1ce6912..9d50114cadca 100644
--- a/widget/src/android/nsAppShell.cpp
+++ b/widget/src/android/nsAppShell.cpp
@@ -368,12 +368,30 @@ nsAppShell::ProcessNextNativeEvent(bool mayWait)
         break;
     }
 
+    case AndroidGeckoEvent::BROADCAST: {
+
+        if (curEvent->Characters().Length() == 0)
+            break;
+
+        nsCOMPtr<nsIObserverService> obsServ =
+            mozilla::services::GetObserverService();
+
+        const NS_ConvertUTF16toUTF8 topic(curEvent->Characters());
+        const nsPromiseFlatString& data = PromiseFlatString(curEvent->CharactersExtra());
+
+        obsServ->NotifyObservers(nsnull, topic.get(), data.get());
+        break;
+    }
+
     case AndroidGeckoEvent::LOAD_URI: {
         nsCOMPtr<nsICommandLineRunner> cmdline
             (do_CreateInstance("@mozilla.org/toolkit/command-line;1"));
         if (!cmdline)
             break;
 
+        if (curEvent->Characters().Length() == 0)
+            break;
+
         char *uri = ToNewUTF8String(curEvent->Characters());
         if (!uri)
             break;
diff --git a/widget/src/android/nsIAndroidBridge.idl b/widget/src/android/nsIAndroidBridge.idl
new file mode 100644
index 000000000000..433ef514a5f5
--- /dev/null
+++ b/widget/src/android/nsIAndroidBridge.idl
@@ -0,0 +1,7 @@
+#include "nsISupports.idl"
+
+[scriptable, uuid(32c345d4-9f45-446a-8a93-8939f3453e87)]
+interface nsIAndroidBridge : nsISupports
+{
+  AString handleGeckoMessage(in AString message);
+};
diff --git a/widget/src/android/nsWidgetFactory.cpp b/widget/src/android/nsWidgetFactory.cpp
index 875fc9297bc7..e9f959313381 100644
--- a/widget/src/android/nsWidgetFactory.cpp
+++ b/widget/src/android/nsWidgetFactory.cpp
@@ -41,6 +41,7 @@
 #include "nsCOMPtr.h"
 #include "nsWidgetsCID.h"
 #include "nsAppShell.h"
+#include "AndroidBridge.h"
 
 #include "nsWindow.h"
 #include "nsLookAndFeel.h"
@@ -71,6 +72,7 @@ NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsPrintSession, Init)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsDeviceContextSpecAndroid)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsHTMLFormatConverter)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsIMEPicker)
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsAndroidBridge)
 
 #include "GfxInfo.h"
 namespace mozilla {
@@ -113,6 +115,7 @@ NS_DEFINE_NAMED_CID(NS_FILEPICKER_CID);
 NS_DEFINE_NAMED_CID(NS_HTMLFORMATCONVERTER_CID);
 NS_DEFINE_NAMED_CID(NS_IMEPICKER_CID);
 NS_DEFINE_NAMED_CID(NS_GFXINFO_CID);
+NS_DEFINE_NAMED_CID(NS_ANDROIDBRIDGE_CID);
 
 static const mozilla::Module::CIDEntry kWidgetCIDs[] = {
   { &kNS_WINDOW_CID, false, NULL, nsWindowConstructor },
@@ -130,6 +133,7 @@ static const mozilla::Module::CIDEntry kWidgetCIDs[] = {
   { &kNS_HTMLFORMATCONVERTER_CID, false, NULL, nsHTMLFormatConverterConstructor },
   { &kNS_IMEPICKER_CID, false, NULL, nsIMEPickerConstructor },
   { &kNS_GFXINFO_CID, false, NULL, mozilla::widget::GfxInfoConstructor },
+  { &kNS_ANDROIDBRIDGE_CID, false, NULL, nsAndroidBridgeConstructor },
   { NULL }
 };
 
@@ -149,6 +153,7 @@ static const mozilla::Module::ContractIDEntry kWidgetContracts[] = {
   { "@mozilla.org/widget/htmlformatconverter;1", &kNS_HTMLFORMATCONVERTER_CID },
   { "@mozilla.org/imepicker;1", &kNS_IMEPICKER_CID },
   { "@mozilla.org/gfx/info;1", &kNS_GFXINFO_CID },
+  { "@mozilla.org/android/bridge;1", &kNS_ANDROIDBRIDGE_CID },
   { NULL }
 };
 
diff --git a/widget/src/android/nsWindow.cpp b/widget/src/android/nsWindow.cpp
index 3797ac47c01d..673da5780f45 100644
--- a/widget/src/android/nsWindow.cpp
+++ b/widget/src/android/nsWindow.cpp
@@ -53,6 +53,7 @@ using mozilla::unused;
 #include "nsIdleService.h"
 #include "nsWindow.h"
 #include "nsIObserverService.h"
+#include "nsFocusManager.h"
 
 #include "nsRenderingContext.h"
 #include "nsIDOMSimpleGestureEvent.h"
@@ -74,6 +75,14 @@ using mozilla::unused;
 
 #include "AndroidBridge.h"
 
+#include "imgIEncoder.h"
+
+#include "nsStringGlue.h"
+
+// NB: Keep these in sync with LayerController.java in embedding/android/.
+#define TILE_WIDTH      1024
+#define TILE_HEIGHT     2048
+
 using namespace mozilla;
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsWindow, nsBaseWidget)
@@ -82,6 +91,10 @@ NS_IMPL_ISUPPORTS_INHERITED0(nsWindow, nsBaseWidget)
 static gfxIntSize gAndroidBounds;
 static gfxIntSize gAndroidScreenBounds;
 
+#ifdef ACCESSIBILITY
+bool nsWindow::sAccessibilityEnabled = false;
+#endif
+
 class ContentCreationNotifier;
 static nsCOMPtr<ContentCreationNotifier> gContentCreationNotifier;
 // A helper class to send updates when content processes
@@ -175,6 +188,9 @@ nsWindow::nsWindow() :
     mIsVisible(false),
     mParent(nsnull),
     mFocus(nsnull),
+#ifdef ACCESSIBILITY
+    mRootAccessible(nsnull),
+#endif
     mIMEComposing(false)
 {
 }
@@ -185,6 +201,10 @@ nsWindow::~nsWindow()
     nsWindow *top = FindTopLevel();
     if (top->mFocus == this)
         top->mFocus = nsnull;
+#ifdef ACCESSIBILITY
+    if (mRootAccessible)
+        mRootAccessible = nsnull;
+#endif
     ALOG("nsWindow %p destructor", (void*)this);
 }
 
@@ -282,6 +302,15 @@ nsWindow::ConfigureChildren(const nsTArray<nsIWidget::Configuration>& config)
     return NS_OK;
 }
 
+void
+nsWindow::RedrawAll()
+{
+    nsIntRect entireRect(0, 0, TILE_WIDTH, TILE_HEIGHT);
+    AndroidGeckoEvent *event = new AndroidGeckoEvent(AndroidGeckoEvent::DRAW,
+                                                     entireRect);
+    nsAppShell::gAppShell->PostEvent(event);
+}
+
 NS_IMETHODIMP
 nsWindow::SetParent(nsIWidget *aNewParent)
 {
@@ -302,7 +331,7 @@ nsWindow::SetParent(nsIWidget *aNewParent)
 
     // if we are now in the toplevel window's hierarchy, schedule a redraw
     if (FindTopLevel() == TopWindow())
-        nsAppShell::gAppShell->PostEvent(new AndroidGeckoEvent(-1, -1, -1, -1));
+        RedrawAll();
 
     return NS_OK;
 }
@@ -370,9 +399,20 @@ nsWindow::Show(bool aState)
             }
         }
     } else if (FindTopLevel() == TopWindow()) {
-        nsAppShell::gAppShell->PostEvent(new AndroidGeckoEvent(-1, -1, -1, -1));
+        RedrawAll();
     }
 
+#ifdef ACCESSIBILITY
+    static bool sAccessibilityChecked = false;
+    if (!sAccessibilityChecked) {
+        sAccessibilityChecked = true;
+        sAccessibilityEnabled =
+            AndroidBridge::Bridge()->GetAccessibilityEnabled();
+     } 
+    if (aState && sAccessibilityEnabled)
+        CreateRootAccessible();
+#endif
+
 #ifdef DEBUG_ANDROID_WIDGET
     DumpWindows();
 #endif
@@ -380,6 +420,32 @@ nsWindow::Show(bool aState)
     return NS_OK;
 }
 
+#ifdef ACCESSIBILITY
+void
+nsWindow::CreateRootAccessible()
+{
+    if (IsTopLevel() && !mRootAccessible) {
+        ALOG(("nsWindow:: Create Toplevel Accessibility\n"));
+        nsAccessible *acc = DispatchAccessibleEvent();
+
+        if (acc) {
+            mRootAccessible = acc;
+        }
+    }
+}
+
+nsAccessible*
+nsWindow::DispatchAccessibleEvent()
+{
+    nsAccessibleEvent event(true, NS_GETACCESSIBLE, this);
+
+    nsEventStatus status;
+    DispatchEvent(&event, status);
+
+    return event.mAccessible;
+}
+#endif
+
 NS_IMETHODIMP
 nsWindow::SetModal(bool aState)
 {
@@ -458,7 +524,7 @@ nsWindow::Resize(PRInt32 aX,
 
     // Should we skip honoring aRepaint here?
     if (aRepaint && FindTopLevel() == TopWindow())
-        nsAppShell::gAppShell->PostEvent(new AndroidGeckoEvent(-1, -1, -1, -1));
+        RedrawAll();
 
     return NS_OK;
 }
@@ -511,7 +577,8 @@ NS_IMETHODIMP
 nsWindow::Invalidate(const nsIntRect &aRect,
                      bool aIsSynchronous)
 {
-    nsAppShell::gAppShell->PostEvent(new AndroidGeckoEvent(-1, -1, -1, -1));
+    AndroidGeckoEvent *event = new AndroidGeckoEvent(AndroidGeckoEvent::DRAW, aRect);
+    nsAppShell::gAppShell->PostEvent(event);
     return NS_OK;
 }
 
@@ -555,7 +622,14 @@ nsWindow::SetFocus(bool aRaise)
 void
 nsWindow::BringToFront()
 {
-    if (FindTopLevel() == TopWindow())
+    // If the window to be raised is the same as the currently raised one,
+    // do nothing. We need to check the focus manager as well, as the first
+    // window that is created will be first in the window list but won't yet
+    // be focused.
+    nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
+    nsCOMPtr<nsIDOMWindow> existingTopWindow;
+    fm->GetActiveWindow(getter_AddRefs(existingTopWindow));
+    if (existingTopWindow && FindTopLevel() == TopWindow())
         return;
 
     if (!IsTopLevel()) {
@@ -580,7 +654,7 @@ nsWindow::BringToFront()
 
     // force a window resize
     nsAppShell::gAppShell->ResendLastResizeEvent(this);
-    nsAppShell::gAppShell->PostEvent(new AndroidGeckoEvent(-1, -1, -1, -1));
+    RedrawAll();
 }
 
 NS_IMETHODIMP
@@ -722,6 +796,66 @@ nsWindow::GetThebesSurface()
     return new gfxImageSurface(gfxIntSize(5,5), gfxImageSurface::ImageFormatRGB24);
 }
 
+bool
+nsWindow::DrawToFile(const nsAString &path)
+{
+    if (!IsTopLevel() || !mIsVisible) {
+        ALOG("### DrawToFile works only for a visible toplevel window!");
+        return PR_FALSE;
+    }
+
+    if (GetLayerManager(nsnull)->GetBackendType() != LayerManager::LAYERS_BASIC) {
+        ALOG("### DrawToFile works only for a basic layers!");
+        return PR_FALSE;
+    }
+
+    nsRefPtr<gfxImageSurface> imgSurface =
+        new gfxImageSurface(gfxIntSize(mBounds.width, mBounds.height),
+                            gfxImageSurface::ImageFormatARGB32);
+    
+    if (imgSurface->CairoStatus()) {
+        ALOG("### Failed to create a valid surface");
+        return PR_FALSE;
+    }
+
+    nsIntRect boundsRect(0, 0, mBounds.width, mBounds.height);
+    bool result = DrawTo(imgSurface, boundsRect);
+    NS_ENSURE_TRUE(result, PR_FALSE);
+
+    nsCOMPtr<imgIEncoder> encoder = do_CreateInstance("@mozilla.org/image/encoder;2?type=image/png");
+    NS_ENSURE_TRUE(encoder, PR_FALSE);
+
+    encoder->InitFromData(imgSurface->Data(),
+                          imgSurface->Stride() * mBounds.height,
+                          mBounds.width,
+                          mBounds.height,
+                          imgSurface->Stride(),
+                          imgIEncoder::INPUT_FORMAT_HOSTARGB,
+                          EmptyString());
+
+    nsCOMPtr<nsILocalFile> file;
+    NS_NewLocalFile(path, true, getter_AddRefs(file));
+    NS_ENSURE_TRUE(file, PR_FALSE);
+
+    PRUint32 length;
+    encoder->Available(&length);
+
+    nsCOMPtr<nsIOutputStream> outputStream;
+    NS_NewLocalFileOutputStream(getter_AddRefs(outputStream), file);
+    NS_ENSURE_TRUE(outputStream, PR_FALSE);
+
+    nsCOMPtr<nsIOutputStream> bufferedOutputStream;
+    NS_NewBufferedOutputStream(getter_AddRefs(bufferedOutputStream),
+                               outputStream, length);
+    NS_ENSURE_TRUE(bufferedOutputStream, PR_FALSE);
+
+    PRUint32 numWritten;
+    bufferedOutputStream->WriteFrom(encoder, length, &numWritten);
+    NS_ENSURE_SUCCESS(length == numWritten, PR_FALSE);
+
+    return PR_TRUE;
+}
+
 void
 nsWindow::OnGlobalAndroidEvent(AndroidGeckoEvent *ae)
 {
@@ -874,6 +1008,10 @@ nsWindow::OnGlobalAndroidEvent(AndroidGeckoEvent *ae)
             AndroidBridge::Bridge()->AcknowledgeEventSync();
             break;
 
+        case AndroidGeckoEvent::SAVE_STATE:
+            win->DrawToFile(ae->Characters());
+            break;
+
         default:
             break;
     }
@@ -898,6 +1036,13 @@ nsWindow::OnAndroidEvent(AndroidGeckoEvent *ae)
 
 bool
 nsWindow::DrawTo(gfxASurface *targetSurface)
+{
+    nsIntRect boundsRect(0, 0, mBounds.width, mBounds.height);
+    return DrawTo(targetSurface, boundsRect);
+}
+
+bool
+nsWindow::DrawTo(gfxASurface *targetSurface, const nsIntRect &invalidRect)
 {
     if (!mIsVisible)
         return false;
@@ -919,7 +1064,7 @@ nsWindow::DrawTo(gfxASurface *targetSurface)
     // If we have no covering child, then we need to render this.
     if (coveringChildIndex == -1) {
         nsPaintEvent event(true, NS_PAINT, this);
-        event.region = boundsRect;
+        event.region = boundsRect.Intersect(invalidRect);
         switch (GetLayerManager(nsnull)->GetBackendType()) {
             case LayerManager::LAYERS_BASIC: {
                 nsRefPtr<gfxContext> ctx = new gfxContext(targetSurface);
@@ -974,7 +1119,7 @@ nsWindow::DrawTo(gfxASurface *targetSurface)
             targetSurface->SetDeviceOffset(offset + gfxPoint(mChildren[i]->mBounds.x,
                                                              mChildren[i]->mBounds.y));
 
-        bool ok = mChildren[i]->DrawTo(targetSurface);
+        bool ok = mChildren[i]->DrawTo(targetSurface, invalidRect);
 
         if (!ok) {
             ALOG("nsWindow[%p]::DrawTo child %d[%p] returned FALSE!", (void*) this, i, (void*)mChildren[i]);
@@ -990,11 +1135,6 @@ nsWindow::DrawTo(gfxASurface *targetSurface)
 void
 nsWindow::OnDraw(AndroidGeckoEvent *ae)
 {
-  
-    if (!sSurfaceExists) {
-        return;
-    }
-
     if (!IsTopLevel()) {
         ALOG("##### redraw for window %p, which is not a toplevel window -- sending to toplevel!", (void*) this);
         DumpWindows();
@@ -1008,6 +1148,27 @@ nsWindow::OnDraw(AndroidGeckoEvent *ae)
     }
 
     AndroidBridge::AutoLocalJNIFrame jniFrame;
+#ifdef MOZ_JAVA_COMPOSITOR
+    AndroidGeckoSoftwareLayerClient &client =
+        AndroidBridge::Bridge()->GetSoftwareLayerClient();
+    client.BeginDrawing();
+    unsigned char *bits = client.LockBufferBits();
+    nsRefPtr<gfxImageSurface> targetSurface =
+        new gfxImageSurface(bits, gfxIntSize(TILE_WIDTH, TILE_HEIGHT), TILE_WIDTH * 2,
+                            gfxASurface::ImageFormatRGB16_565);
+    if (targetSurface->CairoStatus()) {
+        ALOG("### Failed to create a valid surface from the bitmap");
+    } else {
+        DrawTo(targetSurface, ae->Rect());
+        client.UnlockBuffer();
+        client.EndDrawing(ae->Rect());
+    }
+        return;
+#endif
+
+    if (!sSurfaceExists) {
+        return;
+    }
 
     AndroidGeckoSurfaceView& sview(AndroidBridge::Bridge()->SurfaceView());
 
diff --git a/widget/src/android/nsWindow.h b/widget/src/android/nsWindow.h
index 7a3fd00a0672..f905bf315ae6 100644
--- a/widget/src/android/nsWindow.h
+++ b/widget/src/android/nsWindow.h
@@ -43,6 +43,10 @@
 
 #include "nsTArray.h"
 
+#ifdef ACCESSIBILITY
+#include "nsAccessible.h"
+#endif
+
 class gfxASurface;
 class nsIdleService;
 
@@ -144,7 +148,6 @@ public:
     NS_IMETHOD EnableDragDrop(bool aEnable) { return NS_OK; }
     NS_IMETHOD CaptureMouse(bool aCapture) { return NS_ERROR_NOT_IMPLEMENTED; }
     NS_IMETHOD CaptureRollupEvents(nsIRollupListener *aListener,
-                                   nsIMenuRollup *aMenuRollup,
                                    bool aDoCapture,
                                    bool aConsumeRollupEvent) { return NS_ERROR_NOT_IMPLEMENTED; }
 
@@ -168,10 +171,17 @@ public:
     gfxASurface* GetThebesSurface();
 
     NS_IMETHOD ReparentNativeWidget(nsIWidget* aNewParent);
+
+#ifdef ACCESSIBILITY
+    static bool sAccessibilityEnabled;
+#endif
+
 protected:
     void BringToFront();
     nsWindow *FindTopLevel();
     bool DrawTo(gfxASurface *targetSurface);
+    bool DrawTo(gfxASurface *targetSurface, const nsIntRect &aRect);
+    bool DrawToFile(const nsAString &path);
     bool IsTopLevel();
     void OnIMEAddRange(mozilla::AndroidGeckoEvent *ae);
 
@@ -212,6 +222,22 @@ private:
     void DispatchGestureEvent(PRUint32 msg, PRUint32 direction, double delta,
                                const nsIntPoint &refPoint, PRUint64 time);
     void HandleSpecialKey(mozilla::AndroidGeckoEvent *ae);
+    void RedrawAll();
+
+#ifdef ACCESSIBILITY
+    nsRefPtr<nsAccessible> mRootAccessible;
+
+    /**
+     * Request to create the accessible for this window if it is top level.
+     */
+    void CreateRootAccessible();
+
+    /**
+     * Generate the NS_GETACCESSIBLE event to get accessible for this window
+     * and return it.
+     */
+    nsAccessible *DispatchAccessibleEvent();
+#endif // ACCESSIBILITY
 };
 
 #endif /* NSWINDOW_H_ */
diff --git a/widget/src/cocoa/nsAppShell.mm b/widget/src/cocoa/nsAppShell.mm
index cc097bc9e0bc..c3e653fa0180 100644
--- a/widget/src/cocoa/nsAppShell.mm
+++ b/widget/src/cocoa/nsAppShell.mm
@@ -979,7 +979,7 @@ nsAppShell::AfterProcessNextEvent(nsIThreadInternal *aThread,
   NSString *sender = [aNotification object];
   if (!sender || ![sender isEqualToString:@"org.mozilla.gecko.PopupWindow"]) {
     if (gRollupListener && gRollupWidget)
-      gRollupListener->Rollup(nsnull, nsnull);
+      gRollupListener->Rollup(0);
   }
 
   NS_OBJC_END_TRY_ABORT_BLOCK;
diff --git a/widget/src/cocoa/nsChildView.h b/widget/src/cocoa/nsChildView.h
index 2e7921b6afe8..b1cb66590e63 100644
--- a/widget/src/cocoa/nsChildView.h
+++ b/widget/src/cocoa/nsChildView.h
@@ -435,8 +435,7 @@ public:
   NS_IMETHOD        SetCursor(nsCursor aCursor);
   NS_IMETHOD        SetCursor(imgIContainer* aCursor, PRUint32 aHotspotX, PRUint32 aHotspotY);
   
-  NS_IMETHOD        CaptureRollupEvents(nsIRollupListener * aListener, nsIMenuRollup * aMenuRollup, 
-                                        bool aDoCapture, bool aConsumeRollupEvent);
+  NS_IMETHOD        CaptureRollupEvents(nsIRollupListener * aListener, bool aDoCapture, bool aConsumeRollupEvent);
   NS_IMETHOD        SetTitle(const nsAString& title);
 
   NS_IMETHOD        GetAttention(PRInt32 aCycleCount);
diff --git a/widget/src/cocoa/nsChildView.mm b/widget/src/cocoa/nsChildView.mm
index eb71c3080a90..f8cdcfbc395f 100644
--- a/widget/src/cocoa/nsChildView.mm
+++ b/widget/src/cocoa/nsChildView.mm
@@ -66,7 +66,6 @@
 #include "nsILocalFile.h"
 #include "nsILocalFileMac.h"
 #include "nsGfxCIID.h"
-#include "nsIMenuRollup.h"
 #include "nsIDOMSimpleGestureEvent.h"
 #include "nsNPAPIPluginInstance.h"
 #include "nsThemeConstants.h"
@@ -139,7 +138,6 @@ static void blinkRgn(RgnHandle rgn);
 #endif
 
 nsIRollupListener * gRollupListener = nsnull;
-nsIMenuRollup     * gMenuRollup = nsnull;
 nsIWidget         * gRollupWidget   = nsnull;
 
 bool gUserCancelledDrag = false;
@@ -1587,7 +1585,6 @@ nsIntPoint nsChildView::WidgetToScreenOffset()
 }
 
 NS_IMETHODIMP nsChildView::CaptureRollupEvents(nsIRollupListener * aListener, 
-                                               nsIMenuRollup * aMenuRollup,
                                                bool aDoCapture, 
                                                bool aConsumeRollupEvent)
 {
@@ -2759,7 +2756,7 @@ NSEvent* gLastDragMouseDownEvent = nil;
 
       // check to see if scroll events should roll up the popup
       if ([theEvent type] == NSScrollWheel) {
-        gRollupListener->ShouldRollupOnMouseWheelEvent(&shouldRollup);
+        shouldRollup = gRollupListener->ShouldRollupOnMouseWheelEvent();
         // always consume scroll events that aren't over the popup
         consumeEvent = YES;
       }
@@ -2768,10 +2765,10 @@ NSEvent* gLastDragMouseDownEvent = nil;
       // we don't want to rollup if the click is in a parent menu of
       // the current submenu
       PRUint32 popupsToRollup = PR_UINT32_MAX;
-      if (gMenuRollup) {
+      if (gRollupListener) {
         nsAutoTArray<nsIWidget*, 5> widgetChain;
-        gMenuRollup->GetSubmenuWidgetChain(&widgetChain);
-        PRUint32 sameTypeCount = gMenuRollup->GetSubmenuWidgetChain(&widgetChain);
+        gRollupListener->GetSubmenuWidgetChain(&widgetChain);
+        PRUint32 sameTypeCount = gRollupListener->GetSubmenuWidgetChain(&widgetChain);
         for (PRUint32 i = 0; i < widgetChain.Length(); i++) {
           nsIWidget* widget = widgetChain[i];
           NSWindow* currWindow = (NSWindow*)widget->GetNativeData(NS_NATIVE_WINDOW);
@@ -2792,7 +2789,7 @@ NSEvent* gLastDragMouseDownEvent = nil;
       }
 
       if (shouldRollup) {
-        gRollupListener->Rollup(popupsToRollup, nsnull);
+        gRollupListener->Rollup(popupsToRollup);
         consumeEvent = (BOOL)gConsumeRollupEvent;
       }
     }
diff --git a/widget/src/cocoa/nsCocoaWindow.h b/widget/src/cocoa/nsCocoaWindow.h
index b53934b26ae9..9cd93933a0ba 100644
--- a/widget/src/cocoa/nsCocoaWindow.h
+++ b/widget/src/cocoa/nsCocoaWindow.h
@@ -260,8 +260,7 @@ public:
                                           LayerManagerPersistence aPersistence = LAYER_MANAGER_CURRENT,
                                           bool* aAllowRetaining = nsnull);
     NS_IMETHOD DispatchEvent(nsGUIEvent* event, nsEventStatus & aStatus) ;
-    NS_IMETHOD CaptureRollupEvents(nsIRollupListener * aListener, nsIMenuRollup * aMenuRollup,
-                                   bool aDoCapture, bool aConsumeRollupEvent);
+    NS_IMETHOD CaptureRollupEvents(nsIRollupListener * aListener, bool aDoCapture, bool aConsumeRollupEvent);
     NS_IMETHOD GetAttention(PRInt32 aCycleCount);
     virtual bool HasPendingInputEvent();
     virtual nsTransparencyMode GetTransparencyMode();
diff --git a/widget/src/cocoa/nsCocoaWindow.mm b/widget/src/cocoa/nsCocoaWindow.mm
index 6093256346b4..b41deb7fb362 100644
--- a/widget/src/cocoa/nsCocoaWindow.mm
+++ b/widget/src/cocoa/nsCocoaWindow.mm
@@ -61,7 +61,6 @@
 #include "nsStyleConsts.h"
 #include "nsNativeThemeColors.h"
 #include "nsChildView.h"
-#include "nsIMenuRollup.h"
 
 #include "gfxPlatform.h"
 #include "qcms.h"
@@ -95,7 +94,6 @@ extern NSMenu* sApplicationMenu; // Application menu shared by all menubars
 
 // defined in nsChildView.mm
 extern nsIRollupListener * gRollupListener;
-extern nsIMenuRollup     * gMenuRollup;
 extern nsIWidget         * gRollupWidget;
 extern BOOL                gSomeMenuBarPainted;
 
@@ -126,7 +124,7 @@ NS_IMPL_ISUPPORTS_INHERITED1(nsCocoaWindow, Inherited, nsPIWidgetCocoa)
 static void RollUpPopups()
 {
   if (gRollupListener && gRollupWidget)
-    gRollupListener->Rollup(nsnull, nsnull);
+    gRollupListener->Rollup(0);
 }
 
 nsCocoaWindow::nsCocoaWindow()
@@ -1486,22 +1484,17 @@ nsMenuBarX* nsCocoaWindow::GetMenuBar()
   return mMenuBar;
 }
 
-NS_IMETHODIMP nsCocoaWindow::CaptureRollupEvents(nsIRollupListener * aListener, 
-                                                 nsIMenuRollup * aMenuRollup,
-                                                 bool aDoCapture, 
+NS_IMETHODIMP nsCocoaWindow::CaptureRollupEvents(nsIRollupListener * aListener,
+                                                 bool aDoCapture,
                                                  bool aConsumeRollupEvent)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
   gRollupListener = nsnull;
-  NS_IF_RELEASE(gMenuRollup);
   NS_IF_RELEASE(gRollupWidget);
   
   if (aDoCapture) {
     gRollupListener = aListener;
-    NS_IF_RELEASE(gMenuRollup);
-    gMenuRollup = aMenuRollup;
-    NS_IF_ADDREF(aMenuRollup);
     gRollupWidget = this;
     NS_ADDREF(this);
 
diff --git a/widget/src/cocoa/nsMenuItemIconX.mm b/widget/src/cocoa/nsMenuItemIconX.mm
index c12a37fb38ec..b84bd5c0895a 100644
--- a/widget/src/cocoa/nsMenuItemIconX.mm
+++ b/widget/src/cocoa/nsMenuItemIconX.mm
@@ -559,3 +559,9 @@ nsMenuItemIconX::OnDiscard(imgIRequest* aRequest)
 {
   return NS_OK;
 }
+
+NS_IMETHODIMP
+nsMenuItemIconX::OnImageIsAnimated(imgIRequest* aRequest)
+{
+  return NS_OK;
+}
diff --git a/widget/src/cocoa/nsMenuX.mm b/widget/src/cocoa/nsMenuX.mm
index ee875755899e..ff3a9dc87c72 100644
--- a/widget/src/cocoa/nsMenuX.mm
+++ b/widget/src/cocoa/nsMenuX.mm
@@ -913,7 +913,7 @@ nsresult nsMenuX::SetupIcon()
     return;
 
   if (gRollupListener && gRollupWidget) {
-    gRollupListener->Rollup(nsnull, nsnull);
+    gRollupListener->Rollup(0);
     [menu cancelTracking];
     return;
   }
diff --git a/widget/src/cocoa/nsToolkit.mm b/widget/src/cocoa/nsToolkit.mm
index ef2b4ba354a6..fec024bdff93 100644
--- a/widget/src/cocoa/nsToolkit.mm
+++ b/widget/src/cocoa/nsToolkit.mm
@@ -218,7 +218,7 @@ static CGEventRef EventTapCallback(CGEventTapProxy proxy, CGEventType type, CGEv
   // so would break the corresponding context menu).
   if (NSPointInRect(screenLocation, [ctxMenuWindow frame]))
     return event;
-  gRollupListener->Rollup(nsnull, nsnull);
+  gRollupListener->Rollup(0);
   return event;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_RETURN(NULL);
diff --git a/widget/src/gonk/Makefile.in b/widget/src/gonk/Makefile.in
new file mode 100644
index 000000000000..f449b8663693
--- /dev/null
+++ b/widget/src/gonk/Makefile.in
@@ -0,0 +1,75 @@
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+#   Mozilla Foundation
+# Portions created by the Initial Developer are Copyright (C) 2009-2011
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#   Vladimir Vukicevic <vladimir@pobox.com>
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH           = ../../..
+topsrcdir       = @top_srcdir@
+srcdir          = @srcdir@
+VPATH           = @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+MODULE          = widget
+LIBRARY_NAME    = widget_gonk
+EXPORT_LIBRARY  = 1
+IS_COMPONENT    = 1
+MODULE_NAME     = nsWidgetGonkModule
+GRE_MODULE      = 1
+LIBXUL_LIBRARY  = 1
+
+
+CPPSRCS	= \
+	nsAppShell.cpp \
+	nsWidgetFactory.cpp \
+	nsWindow.cpp \
+	nsLookAndFeel.cpp \
+	nsScreenManagerGonk.cpp \
+	$(NULL)
+
+SHARED_LIBRARY_LIBS = ../xpwidgets/libxpwidgets_s.a
+
+include $(topsrcdir)/config/rules.mk
+
+DEFINES += -D_IMPL_NS_WIDGET
+
+LOCAL_INCLUDES += \
+	-I$(topsrcdir)/widget/src/xpwidgets \
+	-I$(topsrcdir)/widget/src/shared \
+	-I$(topsrcdir)/dom/system/android \
+	-I$(srcdir) \
+	$(NULL)
+
+include $(topsrcdir)/ipc/chromium/chromium-config.mk
diff --git a/widget/src/gonk/nsAppShell.cpp b/widget/src/gonk/nsAppShell.cpp
new file mode 100644
index 000000000000..02176b49008c
--- /dev/null
+++ b/widget/src/gonk/nsAppShell.cpp
@@ -0,0 +1,473 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* vim: set ts=4 sw=4 sts=4 tw=80 et: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Gonk.
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Michael Wu <mwu@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#define _GNU_SOURCE
+
+#include <dirent.h>
+#include <fcntl.h>
+#include <linux/input.h>
+#include <signal.h>
+#include <sys/epoll.h>
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include "nsAppShell.h"
+#include "nsGkAtoms.h"
+#include "nsGUIEvent.h"
+#include "nsWindow.h"
+#include "nsIObserverService.h"
+#include "mozilla/Services.h"
+
+#include "android/log.h"
+
+#ifndef ABS_MT_TOUCH_MAJOR
+// Taken from include/linux/input.h
+// XXX update the bionic input.h so we don't have to do this!
+#define ABS_MT_TOUCH_MAJOR      0x30    /* Major axis of touching ellipse */
+#define ABS_MT_TOUCH_MINOR      0x31    /* Minor axis (omit if circular) */
+#define ABS_MT_WIDTH_MAJOR      0x32    /* Major axis of approaching ellipse */
+#define ABS_MT_WIDTH_MINOR      0x33    /* Minor axis (omit if circular) */
+#define ABS_MT_ORIENTATION      0x34    /* Ellipse orientation */
+#define ABS_MT_POSITION_X       0x35    /* Center X ellipse position */
+#define ABS_MT_POSITION_Y       0x36    /* Center Y ellipse position */
+#define ABS_MT_TOOL_TYPE        0x37    /* Type of touching device */
+#define ABS_MT_BLOB_ID          0x38    /* Group a set of packets as a blob */
+#define ABS_MT_TRACKING_ID      0x39    /* Unique ID of initiated contact */
+#define ABS_MT_PRESSURE         0x3a    /* Pressure on contact area */
+#define SYN_MT_REPORT           2
+#endif
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "Gonk" , ## args)
+
+using namespace mozilla;
+
+bool gDrawRequest = false;
+static nsAppShell *gAppShell = NULL;
+static int epollfd = 0;
+static int signalfds[2] = {0};
+
+namespace mozilla {
+
+bool ProcessNextEvent()
+{
+    return gAppShell->ProcessNextNativeEvent(true);
+}
+
+void NotifyEvent()
+{
+    gAppShell->NotifyNativeEvent();
+}
+
+}
+
+static void
+pipeHandler(int fd, FdHandler *data)
+{
+    ssize_t len;
+    do {
+        char tmp[32];
+        len = read(fd, tmp, sizeof(tmp));
+    } while (len > 0);
+}
+
+static
+PRUint64 timevalToMS(const struct timeval &time)
+{
+    return time.tv_sec * 1000 + time.tv_usec / 1000;
+}
+
+static void
+sendMouseEvent(PRUint32 msg, struct timeval *time, int x, int y)
+{
+    nsMouseEvent event(true, msg, NULL,
+                       nsMouseEvent::eReal, nsMouseEvent::eNormal);
+
+    event.refPoint.x = x;
+    event.refPoint.y = y;
+    event.time = timevalToMS(*time);
+    event.isShift = false;
+    event.isControl = false;
+    event.isMeta = false;
+    event.isAlt = false;
+    event.button = nsMouseEvent::eLeftButton;
+    if (msg != NS_MOUSE_MOVE)
+        event.clickCount = 1;
+
+    nsWindow::DispatchInputEvent(event);
+    //LOG("Dispatched type %d at %dx%d", msg, x, y);
+}
+
+static void
+multitouchHandler(int fd, FdHandler *data)
+{
+    // The Linux's input documentation (Documentation/input/input.txt)
+    // says that we'll always read a multiple of sizeof(input_event) bytes here.
+    input_event events[16];
+    int event_count = read(fd, events, sizeof(events));
+    if (event_count < 0) {
+        LOG("Error reading in multitouchHandler");
+        return;
+    }
+    MOZ_ASSERT(event_count % sizeof(input_event) == 0);
+
+    event_count /= sizeof(struct input_event);
+
+    for (int i = 0; i < event_count; i++) {
+        input_event *event = &events[i];
+
+        if (event->type == EV_ABS) {
+            if (data->mtState == FdHandler::MT_IGNORE)
+                continue;
+            if (data->mtState == FdHandler::MT_START)
+                data->mtState = FdHandler::MT_COLLECT;
+
+            switch (event->code) {
+            case ABS_MT_TOUCH_MAJOR:
+                data->mtMajor = event->value;
+                break;
+            case ABS_MT_TOUCH_MINOR:
+            case ABS_MT_WIDTH_MAJOR:
+            case ABS_MT_WIDTH_MINOR:
+            case ABS_MT_ORIENTATION:
+            case ABS_MT_TOOL_TYPE:
+            case ABS_MT_BLOB_ID:
+            case ABS_MT_TRACKING_ID:
+            case ABS_MT_PRESSURE:
+                break;
+            case ABS_MT_POSITION_X:
+                data->mtX = event->value;
+                break;
+            case ABS_MT_POSITION_Y:
+                data->mtY = event->value;
+                break;
+            default:
+                LOG("Got unknown event type 0x%04x with code 0x%04x and value %d",
+                    event->type, event->code, event->value);
+            }
+        } else if (event->type == EV_SYN) {
+            switch (event->code) {
+            case SYN_MT_REPORT:
+                if (data->mtState == FdHandler::MT_COLLECT)
+                    data->mtState = FdHandler::MT_IGNORE;
+                break;
+            case SYN_REPORT:
+                if ((!data->mtMajor || data->mtState == FdHandler::MT_START)) {
+                    sendMouseEvent(NS_MOUSE_BUTTON_UP, &event->time,
+                                   data->mtX, data->mtY);
+                    data->mtDown = false;
+                    //LOG("Up mouse event");
+                } else if (!data->mtDown) {
+                    sendMouseEvent(NS_MOUSE_BUTTON_DOWN, &event->time,
+                                   data->mtX, data->mtY);
+                    data->mtDown = true;
+                    //LOG("Down mouse event");
+                } else {
+                    sendMouseEvent(NS_MOUSE_MOVE, &event->time,
+                                   data->mtX, data->mtY);
+                    data->mtDown = true;
+                }
+                data->mtState = FdHandler::MT_START;
+                break;
+            default:
+                LOG("Got unknown event type 0x%04x with code 0x%04x and value %d",
+                    event->type, event->code, event->value);
+            }
+        } else
+            LOG("Got unknown event type 0x%04x with code 0x%04x and value %d",
+                event->type, event->code, event->value);
+    }
+}
+
+static void
+sendKeyEventWithMsg(PRUint32 keyCode, PRUint32 msg, const struct timeval &time)
+{
+    nsKeyEvent event(true, msg, NULL);
+    event.keyCode = keyCode;
+    event.time = timevalToMS(time);
+    nsWindow::DispatchInputEvent(event);
+}
+
+static void
+sendKeyEvent(PRUint32 keyCode, bool keyDown, const struct timeval &time)
+{
+    sendKeyEventWithMsg(keyCode, keyDown ? NS_KEY_DOWN : NS_KEY_UP, time);
+    if (keyDown) {
+        // Send a key press event right after the key down event.
+        sendKeyEventWithMsg(keyCode, NS_KEY_PRESS, time);
+    }
+}
+
+static void
+sendSpecialKeyEvent(nsIAtom *command, const struct timeval &time)
+{
+    nsCommandEvent event(true, nsGkAtoms::onAppCommand, command, NULL);
+    event.time = timevalToMS(time);
+    nsWindow::DispatchInputEvent(event);
+}
+
+static int screenFd = -1;
+static bool sScreenOn = true;
+
+static void
+handlePowerKeyPressed()
+{
+    if (screenFd == -1) {
+        screenFd = open("/sys/power/state", O_RDWR);
+        if (screenFd < 0) {
+            LOG("Unable to open /sys/power/state.");
+            return;
+        }
+    }
+
+    // No idea why the screen-off string is "mem" rather than "off".
+    const char *state = sScreenOn ? "mem" : "on";
+    if (write(screenFd, state, strlen(state)) < 0) {
+        LOG("Unable to write to /sys/power/state.");
+        return;
+    }
+
+    sScreenOn = !sScreenOn;
+}
+
+static void
+keyHandler(int fd, FdHandler *data)
+{
+    input_event events[16];
+    ssize_t bytesRead = read(fd, events, sizeof(events));
+    if (bytesRead < 0) {
+        LOG("Error reading in keyHandler");
+        return;
+    }
+    MOZ_ASSERT(bytesRead % sizeof(input_event) == 0);
+
+    for (unsigned int i = 0; i < bytesRead / sizeof(struct input_event); i++) {
+        const input_event &e = events[i];
+
+        if (e.type == EV_SYN) {
+            // Ignore this event; it just signifies that a key was pressed.
+            continue;
+        }
+
+        if (e.type != EV_KEY) {
+            LOG("Got unknown key event type. type 0x%04x code 0x%04x value %d",
+                e.type, e.code, e.value);
+            continue;
+        }
+
+        if (e.value != 0 && e.value != 1) {
+            LOG("Got unknown key event value. type 0x%04x code 0x%04x value %d",
+                e.type, e.code, e.value);
+            continue;
+        }
+
+        if (!sScreenOn && e.code != KEY_POWER) {
+            LOG("Ignoring key event, because the screen is off. "
+                "type 0x%04x code 0x%04x value %d",
+                e.type, e.code, e.value);
+            continue;
+        }
+
+        bool pressed = e.value == 1;
+        const char* upOrDown = pressed ? "pressed" : "released";
+        switch (e.code) {
+        case KEY_BACK:
+            sendKeyEvent(NS_VK_ESCAPE, pressed, e.time);
+            break;
+        case KEY_MENU:
+            if (!pressed)
+                sendSpecialKeyEvent(nsGkAtoms::Menu, e.time);
+            break;
+        case KEY_SEARCH:
+            if (pressed)
+                sendSpecialKeyEvent(nsGkAtoms::Search, e.time);
+            break;
+        case KEY_HOME:
+            sendKeyEvent(NS_VK_HOME, pressed, e.time);
+            break;
+        case KEY_POWER:
+            LOG("Power key %s", upOrDown);
+            // Ideally, we'd send a NS_VK_SLEEP event here and let the front-end
+            // sort out what to do.  But for now, let's just turn off the screen
+            // ourselves.
+            if (pressed)
+                handlePowerKeyPressed();
+            break;
+        case KEY_VOLUMEUP:
+            if (pressed)
+                sendSpecialKeyEvent(nsGkAtoms::VolumeUp, e.time);
+            break;
+        case KEY_VOLUMEDOWN:
+            if (pressed)
+                sendSpecialKeyEvent(nsGkAtoms::VolumeDown, e.time);
+            break;
+        default:
+            LOG("Got unknown key event code. type 0x%04x code 0x%04x value %d",
+                e.type, e.code, e.value);
+        }
+    }
+}
+
+nsAppShell::nsAppShell()
+    : mNativeCallbackRequest(false)
+    , mHandlers()
+{
+    gAppShell = this;
+}
+
+nsAppShell::~nsAppShell()
+{
+    gAppShell = NULL;
+}
+
+nsresult
+nsAppShell::Init()
+{
+    epoll_event event = {
+        EPOLLIN,
+        { 0 }
+    };
+
+    nsresult rv = nsBaseAppShell::Init();
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    epollfd = epoll_create(16);
+    NS_ENSURE_TRUE(epollfd >= 0, NS_ERROR_UNEXPECTED);
+
+    int ret = pipe2(signalfds, O_NONBLOCK);
+    NS_ENSURE_FALSE(ret, NS_ERROR_UNEXPECTED);
+
+    FdHandler *handler = mHandlers.AppendElement();
+    handler->fd = signalfds[0];
+    handler->func = pipeHandler;
+    event.data.u32 = mHandlers.Length() - 1;
+    ret = epoll_ctl(epollfd, EPOLL_CTL_ADD, signalfds[0], &event);
+    NS_ENSURE_FALSE(ret, NS_ERROR_UNEXPECTED);
+
+    DIR *dir = opendir("/dev/input");
+    NS_ENSURE_TRUE(dir, NS_ERROR_UNEXPECTED);
+
+#define BITSET(bit, flags) (flags[bit >> 3] & (1 << (bit & 0x7)))
+
+    struct dirent *entry;
+    while ((entry = readdir(dir))) {
+        char entryName[64];
+        char entryPath[MAXPATHLEN];
+        if (snprintf(entryPath, sizeof(entryPath),
+                     "/dev/input/%s", entry->d_name) < 0) {
+            LOG("Couldn't generate path while enumerating input devices!");
+            continue;
+        }
+        int fd = open(entryPath, O_RDONLY);
+        if (ioctl(fd, EVIOCGNAME(sizeof(entryName)), entryName) >= 0)
+            LOG("Found device %s - %s", entry->d_name, entryName);
+        else
+            continue;
+
+        FdHandlerCallback handlerFunc = NULL;
+
+        char flags[(NS_MAX(ABS_MAX, KEY_MAX) + 1) / 8];
+        if (ioctl(fd, EVIOCGBIT(EV_ABS, sizeof(flags)), flags) >= 0 &&
+            BITSET(ABS_MT_POSITION_X, flags)) {
+
+            LOG("Found absolute input device");
+            handlerFunc = multitouchHandler;
+        } else if (ioctl(fd, EVIOCGBIT(EV_KEY, sizeof(flags)), flags) >= 0) {
+            LOG("Found key input device");
+            handlerFunc = keyHandler;
+        }
+
+        // Register the handler, if we have one.
+        if (!handlerFunc)
+            continue;
+
+        handler = mHandlers.AppendElement();
+        handler->fd = fd;
+        handler->func = handlerFunc;
+        event.data.u32 = mHandlers.Length() - 1;
+        if (epoll_ctl(epollfd, EPOLL_CTL_ADD, fd, &event))
+            LOG("Failed to add fd to epoll fd");
+    }
+
+    return rv;
+}
+
+void
+nsAppShell::ScheduleNativeEventCallback()
+{
+    mNativeCallbackRequest = true;
+    NotifyEvent();
+}
+
+bool
+nsAppShell::ProcessNextNativeEvent(bool mayWait)
+{
+    epoll_event events[16] = {{ 0 }};
+
+    int event_count;
+    if ((event_count = epoll_wait(epollfd, events, 16,  mayWait ? -1 : 0)) <= 0)
+        return true;
+
+    for (int i = 0; i < event_count; i++)
+        mHandlers[events[i].data.u32].run();
+
+    // NativeEventCallback always schedules more if it needs it
+    // so we can coalesce these.
+    // See the implementation in nsBaseAppShell.cpp for more info
+    if (mNativeCallbackRequest) {
+        mNativeCallbackRequest = false;
+        NativeEventCallback();
+    }
+
+    if (gDrawRequest) {
+        gDrawRequest = false;
+        nsWindow::DoDraw();
+    }
+
+    return true;
+}
+
+void
+nsAppShell::NotifyNativeEvent()
+{
+    write(signalfds[1], "w", 1);
+}
+
diff --git a/widget/src/gonk/nsAppShell.h b/widget/src/gonk/nsAppShell.h
new file mode 100644
index 000000000000..632cc44d3000
--- /dev/null
+++ b/widget/src/gonk/nsAppShell.h
@@ -0,0 +1,94 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Gonk.
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Michael Wu <mwu@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsAppShell_h
+#define nsAppShell_h
+
+#include "nsBaseAppShell.h"
+
+namespace mozilla {
+bool ProcessNextEvent();
+void NotifyEvent();
+}
+
+extern bool gDrawRequest;
+
+class FdHandler;
+typedef void(*FdHandlerCallback)(int, FdHandler *);
+
+class FdHandler {
+public:
+    FdHandler() : mtState(MT_START), mtDown(false) { }
+
+    int fd;
+    FdHandlerCallback func;
+    enum mtStates {
+        MT_START,
+        MT_COLLECT,
+        MT_IGNORE
+    } mtState;
+    int mtX, mtY;
+    int mtMajor;
+    bool mtDown;
+
+    void run()
+    {
+        func(fd, this);
+    }
+};
+
+class nsAppShell : public nsBaseAppShell {
+public:
+    nsAppShell();
+
+    nsresult Init();
+    virtual bool ProcessNextNativeEvent(bool maywait);
+
+    void NotifyNativeEvent();
+
+protected:
+    virtual ~nsAppShell();
+
+    virtual void ScheduleNativeEventCallback();
+
+    // This is somewhat racy but is perfectly safe given how the callback works
+    bool mNativeCallbackRequest;
+    nsTArray<FdHandler> mHandlers;
+};
+
+#endif /* nsAppShell_h */
+
diff --git a/widget/src/gonk/nsLookAndFeel.cpp b/widget/src/gonk/nsLookAndFeel.cpp
new file mode 100644
index 000000000000..7560944c2956
--- /dev/null
+++ b/widget/src/gonk/nsLookAndFeel.cpp
@@ -0,0 +1,319 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Vladimir Vukicevic <vladimir@pobox.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsLookAndFeel.h"
+
+nsLookAndFeel::nsLookAndFeel()
+    : nsXPLookAndFeel()
+{
+}
+
+nsLookAndFeel::~nsLookAndFeel()
+{
+}
+
+nsresult
+nsLookAndFeel::NativeGetColor(ColorID aID, nscolor &aColor)
+{
+    nsresult rv = NS_OK;
+
+#define BASE_ACTIVE_COLOR     NS_RGB(0xaa,0xaa,0xaa)
+#define BASE_NORMAL_COLOR     NS_RGB(0xff,0xff,0xff)
+#define BASE_SELECTED_COLOR   NS_RGB(0xaa,0xaa,0xaa)
+#define BG_ACTIVE_COLOR       NS_RGB(0xff,0xff,0xff)
+#define BG_INSENSITIVE_COLOR  NS_RGB(0xaa,0xaa,0xaa)
+#define BG_NORMAL_COLOR       NS_RGB(0xff,0xff,0xff)
+#define BG_PRELIGHT_COLOR     NS_RGB(0xee,0xee,0xee)
+#define BG_SELECTED_COLOR     NS_RGB(0x99,0x99,0x99)
+#define DARK_NORMAL_COLOR     NS_RGB(0x88,0x88,0x88)
+#define FG_INSENSITIVE_COLOR  NS_RGB(0x44,0x44,0x44)
+#define FG_NORMAL_COLOR       NS_RGB(0x00,0x00,0x00)
+#define FG_PRELIGHT_COLOR     NS_RGB(0x77,0x77,0x77)
+#define FG_SELECTED_COLOR     NS_RGB(0xaa,0xaa,0xaa)
+#define LIGHT_NORMAL_COLOR    NS_RGB(0xaa,0xaa,0xaa)
+#define TEXT_ACTIVE_COLOR     NS_RGB(0x99,0x99,0x99)
+#define TEXT_NORMAL_COLOR     NS_RGB(0x00,0x00,0x00)
+#define TEXT_SELECTED_COLOR   NS_RGB(0x00,0x00,0x00)
+
+    switch (aID) {
+        // These colors don't seem to be used for anything anymore in Mozilla
+        // (except here at least TextSelectBackground and TextSelectForeground)
+        // The CSS2 colors below are used.
+    case eColorID_WindowBackground:
+        aColor = BASE_NORMAL_COLOR;
+        break;
+    case eColorID_WindowForeground:
+        aColor = TEXT_NORMAL_COLOR;
+        break;
+    case eColorID_WidgetBackground:
+        aColor = BG_NORMAL_COLOR;
+        break;
+    case eColorID_WidgetForeground:
+        aColor = FG_NORMAL_COLOR;
+        break;
+    case eColorID_WidgetSelectBackground:
+        aColor = BG_SELECTED_COLOR;
+        break;
+    case eColorID_WidgetSelectForeground:
+        aColor = FG_SELECTED_COLOR;
+        break;
+    case eColorID_Widget3DHighlight:
+        aColor = NS_RGB(0xa0,0xa0,0xa0);
+        break;
+    case eColorID_Widget3DShadow:
+        aColor = NS_RGB(0x40,0x40,0x40);
+        break;
+    case eColorID_TextBackground:
+        // not used?
+        aColor = BASE_NORMAL_COLOR;
+        break;
+    case eColorID_TextForeground: 
+        // not used?
+        aColor = TEXT_NORMAL_COLOR;
+        break;
+    case eColorID_TextSelectBackground:
+    case eColorID_IMESelectedRawTextBackground:
+    case eColorID_IMESelectedConvertedTextBackground:
+        // still used
+        aColor = BASE_SELECTED_COLOR;
+        break;
+    case eColorID_TextSelectForeground:
+    case eColorID_IMESelectedRawTextForeground:
+    case eColorID_IMESelectedConvertedTextForeground:
+        // still used
+        aColor = TEXT_SELECTED_COLOR;
+        break;
+    case eColorID_IMERawInputBackground:
+    case eColorID_IMEConvertedTextBackground:
+        aColor = NS_TRANSPARENT;
+        break;
+    case eColorID_IMERawInputForeground:
+    case eColorID_IMEConvertedTextForeground:
+        aColor = NS_SAME_AS_FOREGROUND_COLOR;
+        break;
+    case eColorID_IMERawInputUnderline:
+    case eColorID_IMEConvertedTextUnderline:
+        aColor = NS_SAME_AS_FOREGROUND_COLOR;
+        break;
+    case eColorID_IMESelectedRawTextUnderline:
+    case eColorID_IMESelectedConvertedTextUnderline:
+        aColor = NS_TRANSPARENT;
+        break;
+    case eColorID_SpellCheckerUnderline:
+      aColor = NS_RGB(0xff, 0, 0);
+      break;
+
+        // css2  http://www.w3.org/TR/REC-CSS2/ui.html#system-colors
+    case eColorID_activeborder:
+        // active window border
+        aColor = BG_NORMAL_COLOR;
+        break;
+    case eColorID_activecaption:
+        // active window caption background
+        aColor = BG_NORMAL_COLOR;
+        break;
+    case eColorID_appworkspace:
+        // MDI background color
+        aColor = BG_NORMAL_COLOR;
+        break;
+    case eColorID_background:
+        // desktop background
+        aColor = BG_NORMAL_COLOR;
+        break;
+    case eColorID_captiontext:
+        // text in active window caption, size box, and scrollbar arrow box (!)
+        aColor = FG_NORMAL_COLOR;
+        break;
+    case eColorID_graytext:
+        // disabled text in windows, menus, etc.
+        aColor = FG_INSENSITIVE_COLOR;
+        break;
+    case eColorID_highlight:
+        // background of selected item
+        aColor = BASE_SELECTED_COLOR;
+        break;
+    case eColorID_highlighttext:
+        // text of selected item
+        aColor = TEXT_SELECTED_COLOR;
+        break;
+    case eColorID_inactiveborder:
+        // inactive window border
+        aColor = BG_NORMAL_COLOR;
+        break;
+    case eColorID_inactivecaption:
+        // inactive window caption
+        aColor = BG_INSENSITIVE_COLOR;
+        break;
+    case eColorID_inactivecaptiontext:
+        // text in inactive window caption
+        aColor = FG_INSENSITIVE_COLOR;
+        break;
+    case eColorID_infobackground:
+        // tooltip background color
+        aColor = BG_NORMAL_COLOR;
+        break;
+    case eColorID_infotext:
+        // tooltip text color
+        aColor = TEXT_NORMAL_COLOR;
+        break;
+    case eColorID_menu:
+        // menu background
+        aColor = BG_NORMAL_COLOR;
+        break;
+    case eColorID_menutext:
+        // menu text
+        aColor = TEXT_NORMAL_COLOR;
+        break;
+    case eColorID_scrollbar:
+        // scrollbar gray area
+        aColor = BG_ACTIVE_COLOR;
+        break;
+
+    case eColorID_threedface:
+    case eColorID_buttonface:
+        // 3-D face color
+        aColor = BG_NORMAL_COLOR;
+        break;
+
+    case eColorID_buttontext:
+        // text on push buttons
+        aColor = TEXT_NORMAL_COLOR;
+        break;
+
+    case eColorID_buttonhighlight:
+        // 3-D highlighted edge color
+    case eColorID_threedhighlight:
+        // 3-D highlighted outer edge color
+        aColor = LIGHT_NORMAL_COLOR;
+        break;
+
+    case eColorID_threedlightshadow:
+        // 3-D highlighted inner edge color
+        aColor = BG_NORMAL_COLOR;
+        break;
+
+    case eColorID_buttonshadow:
+        // 3-D shadow edge color
+    case eColorID_threedshadow:
+        // 3-D shadow inner edge color
+        aColor = DARK_NORMAL_COLOR;
+        break;
+
+    case eColorID_threeddarkshadow:
+        // 3-D shadow outer edge color
+        aColor = NS_RGB(0,0,0);
+        break;
+
+    case eColorID_window:
+    case eColorID_windowframe:
+        aColor = BG_NORMAL_COLOR;
+        break;
+
+    case eColorID_windowtext:
+        aColor = FG_NORMAL_COLOR;
+        break;
+
+    case eColorID__moz_eventreerow:
+    case eColorID__moz_field:
+        aColor = BASE_NORMAL_COLOR;
+        break;
+    case eColorID__moz_fieldtext:
+        aColor = TEXT_NORMAL_COLOR;
+        break;
+    case eColorID__moz_dialog:
+        aColor = BG_NORMAL_COLOR;
+        break;
+    case eColorID__moz_dialogtext:
+        aColor = FG_NORMAL_COLOR;
+        break;
+    case eColorID__moz_dragtargetzone:
+        aColor = BG_SELECTED_COLOR;
+        break; 
+    case eColorID__moz_buttondefault:
+        // default button border color
+        aColor = NS_RGB(0,0,0);
+        break;
+    case eColorID__moz_buttonhoverface:
+        aColor = BG_PRELIGHT_COLOR;
+        break;
+    case eColorID__moz_buttonhovertext:
+        aColor = FG_PRELIGHT_COLOR;
+        break;
+    case eColorID__moz_cellhighlight:
+    case eColorID__moz_html_cellhighlight:
+        aColor = BASE_ACTIVE_COLOR;
+        break;
+    case eColorID__moz_cellhighlighttext:
+    case eColorID__moz_html_cellhighlighttext:
+        aColor = TEXT_ACTIVE_COLOR;
+        break;
+    case eColorID__moz_menuhover:
+        aColor = BG_PRELIGHT_COLOR;
+        break;
+    case eColorID__moz_menuhovertext:
+        aColor = FG_PRELIGHT_COLOR;
+        break;
+    case eColorID__moz_oddtreerow:
+        aColor = NS_TRANSPARENT;
+        break;
+    case eColorID__moz_nativehyperlinktext:
+        aColor = NS_SAME_AS_FOREGROUND_COLOR;
+        break;
+    case eColorID__moz_comboboxtext:
+        aColor = TEXT_NORMAL_COLOR;
+        break;
+    case eColorID__moz_combobox:
+        aColor = BG_NORMAL_COLOR;
+        break;
+    case eColorID__moz_menubartext:
+        aColor = TEXT_NORMAL_COLOR;
+        break;
+    case eColorID__moz_menubarhovertext:
+        aColor = FG_PRELIGHT_COLOR;
+        break;
+    default:
+        /* default color is BLACK */
+        aColor = 0;
+        rv = NS_ERROR_FAILURE;
+        break;
+    }
+
+    return rv;
+}
+
+
diff --git a/widget/src/gonk/nsLookAndFeel.h b/widget/src/gonk/nsLookAndFeel.h
new file mode 100644
index 000000000000..7d3b8d02beed
--- /dev/null
+++ b/widget/src/gonk/nsLookAndFeel.h
@@ -0,0 +1,54 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Lars Knoll <knoll@kde.org>
+ *   John C. Griggs <johng@corel.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+#ifndef __nsLookAndFeel
+#define __nsLookAndFeel
+
+#include "nsXPLookAndFeel.h"
+
+class nsLookAndFeel : public nsXPLookAndFeel
+{
+public:
+    nsLookAndFeel();
+    virtual ~nsLookAndFeel();
+
+protected:
+    virtual nsresult NativeGetColor(ColorID aID, nscolor &aColor);
+};
+
+#endif
diff --git a/widget/src/gonk/nsScreenManagerGonk.cpp b/widget/src/gonk/nsScreenManagerGonk.cpp
new file mode 100644
index 000000000000..1a7744acd29e
--- /dev/null
+++ b/widget/src/gonk/nsScreenManagerGonk.cpp
@@ -0,0 +1,133 @@
+/* -*- Mode: C++; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Vladimir Vukicevic <vladimir@pobox.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsScreenManagerGonk.h"
+#include "nsWindow.h"
+
+using namespace mozilla;
+
+NS_IMPL_ISUPPORTS2(nsScreenGonk, nsIScreen, nsIScreen)
+
+nsScreenGonk::nsScreenGonk(void *nativeScreen)
+{
+}
+
+nsScreenGonk::~nsScreenGonk()
+{
+}
+
+NS_IMETHODIMP
+nsScreenGonk::GetRect(PRInt32 *outLeft,  PRInt32 *outTop,
+                      PRInt32 *outWidth, PRInt32 *outHeight)
+{
+    *outLeft = gScreenBounds.x;
+    *outTop = gScreenBounds.y;
+
+    *outWidth = gScreenBounds.width;
+    *outHeight = gScreenBounds.height;
+
+    return NS_OK;
+}
+
+
+NS_IMETHODIMP
+nsScreenGonk::GetAvailRect(PRInt32 *outLeft,  PRInt32 *outTop,
+                          PRInt32 *outWidth, PRInt32 *outHeight)
+{
+    return GetRect(outLeft, outTop, outWidth, outHeight);
+}
+
+
+
+NS_IMETHODIMP
+nsScreenGonk::GetPixelDepth(PRInt32 *aPixelDepth)
+{
+    // XXX do we need to lie here about 16bpp?  Or
+    // should we actually check and return the right thing?
+    *aPixelDepth = 24;
+    return NS_OK;
+}
+
+
+NS_IMETHODIMP
+nsScreenGonk::GetColorDepth(PRInt32 *aColorDepth)
+{
+    return GetPixelDepth(aColorDepth);
+}
+
+NS_IMPL_ISUPPORTS1(nsScreenManagerGonk, nsIScreenManager)
+
+nsScreenManagerGonk::nsScreenManagerGonk()
+{
+    mOneScreen = new nsScreenGonk(nsnull);
+}
+
+nsScreenManagerGonk::~nsScreenManagerGonk()
+{
+}
+
+NS_IMETHODIMP
+nsScreenManagerGonk::GetPrimaryScreen(nsIScreen **outScreen)
+{
+    NS_IF_ADDREF(*outScreen = mOneScreen.get());
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsScreenManagerGonk::ScreenForRect(PRInt32 inLeft,
+                                   PRInt32 inTop,
+                                   PRInt32 inWidth,
+                                   PRInt32 inHeight,
+                                   nsIScreen **outScreen)
+{
+    return GetPrimaryScreen(outScreen);
+}
+
+NS_IMETHODIMP
+nsScreenManagerGonk::ScreenForNativeWidget(void *aWidget, nsIScreen **outScreen)
+{
+    return GetPrimaryScreen(outScreen);
+}
+
+NS_IMETHODIMP
+nsScreenManagerGonk::GetNumberOfScreens(PRUint32 *aNumberOfScreens)
+{
+    *aNumberOfScreens = 1;
+    return NS_OK;
+}
+
diff --git a/widget/src/gonk/nsScreenManagerGonk.h b/widget/src/gonk/nsScreenManagerGonk.h
new file mode 100644
index 000000000000..cb6d2a61037e
--- /dev/null
+++ b/widget/src/gonk/nsScreenManagerGonk.h
@@ -0,0 +1,71 @@
+/* -*- Mode: C++; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Vladimir Vukicevic <vladimir@pobox.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsScreenManagerGonk_h___
+#define nsScreenManagerGonk_h___
+
+#include "nsCOMPtr.h"
+
+#include "nsIScreenManager.h"
+#include "nsIScreen.h"
+#include "WidgetUtils.h"
+
+class nsScreenGonk : public nsIScreen
+{
+public:
+    nsScreenGonk(void *nativeScreen);
+    ~nsScreenGonk();
+
+    NS_DECL_ISUPPORTS
+    NS_DECL_NSISCREEN
+};
+
+class nsScreenManagerGonk : public nsIScreenManager
+{
+public:
+    nsScreenManagerGonk();
+    ~nsScreenManagerGonk();
+
+    NS_DECL_ISUPPORTS
+    NS_DECL_NSISCREENMANAGER
+
+protected:
+    nsCOMPtr<nsIScreen> mOneScreen;
+};
+
+#endif /* nsScreenManagerGonk_h___ */
diff --git a/widget/src/gonk/nsWidgetFactory.cpp b/widget/src/gonk/nsWidgetFactory.cpp
new file mode 100644
index 000000000000..38d1ec3ddf92
--- /dev/null
+++ b/widget/src/gonk/nsWidgetFactory.cpp
@@ -0,0 +1,98 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2009-2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Vladimir Vukicevic <vladimir@pobox.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "mozilla/ModuleUtils.h"
+
+#include "nsCOMPtr.h"
+#include "nsWidgetsCID.h"
+#include "nsAppShell.h"
+
+#include "nsWindow.h"
+#include "nsLookAndFeel.h"
+#include "nsAppShellSingleton.h"
+#include "nsScreenManagerGonk.h"
+
+#include "nsHTMLFormatConverter.h"
+#include "nsXULAppAPI.h"
+
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsWindow)
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsScreenManagerGonk)
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsHTMLFormatConverter)
+
+NS_DEFINE_NAMED_CID(NS_APPSHELL_CID);
+NS_DEFINE_NAMED_CID(NS_WINDOW_CID);
+NS_DEFINE_NAMED_CID(NS_CHILD_CID);
+NS_DEFINE_NAMED_CID(NS_SCREENMANAGER_CID);
+NS_DEFINE_NAMED_CID(NS_HTMLFORMATCONVERTER_CID);
+
+static const mozilla::Module::CIDEntry kWidgetCIDs[] = {
+    { &kNS_WINDOW_CID, false, NULL, nsWindowConstructor },
+    { &kNS_CHILD_CID, false, NULL, nsWindowConstructor },
+    { &kNS_APPSHELL_CID, false, NULL, nsAppShellConstructor },
+    { &kNS_SCREENMANAGER_CID, false, NULL, nsScreenManagerGonkConstructor },
+    { &kNS_HTMLFORMATCONVERTER_CID, false, NULL, nsHTMLFormatConverterConstructor },
+    { NULL }
+};
+
+static const mozilla::Module::ContractIDEntry kWidgetContracts[] = {
+    { "@mozilla.org/widgets/window/gonk;1", &kNS_WINDOW_CID },
+    { "@mozilla.org/widgets/child_window/gonk;1", &kNS_CHILD_CID },
+    { "@mozilla.org/widget/appshell/gonk;1", &kNS_APPSHELL_CID },
+    { "@mozilla.org/gfx/screenmanager;1", &kNS_SCREENMANAGER_CID },
+    { "@mozilla.org/widget/htmlformatconverter;1", &kNS_HTMLFORMATCONVERTER_CID },
+    { NULL }
+};
+
+static void
+nsWidgetGonkModuleDtor()
+{
+    nsLookAndFeel::Shutdown();
+    nsAppShellShutdown();
+}
+
+static const mozilla::Module kWidgetModule = {
+    mozilla::Module::kVersion,
+    kWidgetCIDs,
+    kWidgetContracts,
+    NULL,
+    NULL,
+    nsAppShellInit,
+    nsWidgetGonkModuleDtor
+};
+
+NSMODULE_DEFN(nsWidgetGonkModule) = &kWidgetModule;
diff --git a/widget/src/gonk/nsWindow.cpp b/widget/src/gonk/nsWindow.cpp
new file mode 100644
index 000000000000..72be2b518038
--- /dev/null
+++ b/widget/src/gonk/nsWindow.cpp
@@ -0,0 +1,359 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Gonk.
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Michael Wu <mwu@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsAutoPtr.h"
+#include "nsAppShell.h"
+#include "nsTArray.h"
+#include "nsWindow.h"
+
+#include <EGL/egl.h>
+#include <EGL/eglext.h>
+#include "ui/FramebufferNativeWindow.h"
+
+#include "LayerManagerOGL.h"
+#include "GLContextProvider.h"
+
+#include "android/log.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "Gonk" , ## args)
+
+#define IS_TOPLEVEL() (mWindowType == eWindowType_toplevel || mWindowType == eWindowType_dialog)
+
+using namespace mozilla::gl;
+using namespace mozilla::layers;
+
+nsIntRect gScreenBounds;
+
+static nsRefPtr<GLContext> sGLContext;
+static nsTArray<nsWindow *> sTopWindows;
+static nsWindow *gWindowToRedraw = nsnull;
+static nsWindow *gFocusedWindow = nsnull;
+static android::FramebufferNativeWindow *gNativeWindow = nsnull;
+
+nsWindow::nsWindow()
+{
+    if (!sGLContext) {
+        gNativeWindow = new android::FramebufferNativeWindow();
+        sGLContext = GLContextProvider::CreateForWindow(this);
+        // CreateForWindow sets up gScreenBounds
+    }
+}
+
+nsWindow::~nsWindow()
+{
+}
+
+void
+nsWindow::DoDraw(void)
+{
+    if (!gWindowToRedraw)
+        return;
+
+    nsPaintEvent event(true, NS_PAINT, gWindowToRedraw);
+    event.region = gScreenBounds;
+    static_cast<LayerManagerOGL*>(gWindowToRedraw->GetLayerManager(nsnull))->
+                    SetClippingRegion(nsIntRegion(gScreenBounds));
+    gWindowToRedraw->mEventCallback(&event);
+}
+
+nsEventStatus
+nsWindow::DispatchInputEvent(nsGUIEvent &aEvent)
+{
+    if (!gFocusedWindow)
+        return nsEventStatus_eIgnore;
+
+    aEvent.widget = gFocusedWindow;
+    return gFocusedWindow->mEventCallback(&aEvent);
+}
+
+NS_IMETHODIMP
+nsWindow::Create(nsIWidget *aParent,
+                 void *aNativeParent,
+                 const nsIntRect &aRect,
+                 EVENT_CALLBACK aHandleEventFunction,
+                 nsDeviceContext *aContext,
+                 nsWidgetInitData *aInitData)
+{
+    BaseCreate(aParent, IS_TOPLEVEL() ? gScreenBounds : aRect,
+               aHandleEventFunction, aContext, aInitData);
+
+    mBounds = aRect;
+
+    nsWindow *parent = (nsWindow *)aNativeParent;
+    mParent = parent;
+
+    if (!aNativeParent) {
+        mBounds = gScreenBounds;
+    }
+
+    if (!IS_TOPLEVEL())
+        return NS_OK;
+
+    sTopWindows.AppendElement(this);
+
+    Resize(0, 0, gScreenBounds.width, gScreenBounds.height, false);
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::Destroy(void)
+{
+    sTopWindows.RemoveElement(this);
+    if (this == gWindowToRedraw)
+        gWindowToRedraw = nsnull;
+    if (this == gFocusedWindow)
+        gFocusedWindow = nsnull;
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::Show(bool aState)
+{
+    if (!IS_TOPLEVEL())
+        return NS_OK;
+
+    if (aState)
+        BringToTop();
+    else
+        mVisible = false;
+
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::IsVisible(bool & aState)
+{
+    aState = mVisible;
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::ConstrainPosition(bool aAllowSlop,
+                  PRInt32 *aX,
+                  PRInt32 *aY)
+{
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::Move(PRInt32 aX,
+               PRInt32 aY)
+{
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::Resize(PRInt32 aWidth,
+                 PRInt32 aHeight,
+                 bool    aRepaint)
+{
+    return Resize(0, 0, aWidth, aHeight, aRepaint);
+}
+
+NS_IMETHODIMP
+nsWindow::Resize(PRInt32 aX,
+                 PRInt32 aY,
+                 PRInt32 aWidth,
+                 PRInt32 aHeight,
+                 bool    aRepaint)
+{
+    nsSizeEvent event(true, NS_SIZE, this);
+    event.time = PR_Now() / 1000;
+
+    nsIntRect rect(aX, aY, aWidth, aHeight);
+    event.windowSize = &rect;
+    event.mWinWidth = gScreenBounds.width;
+    event.mWinHeight = gScreenBounds.height;
+
+    (*mEventCallback)(&event);
+
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::Enable(bool aState)
+{
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::IsEnabled(bool *aState)
+{
+    *aState = true;
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::SetFocus(bool aRaise)
+{
+    if (aRaise)
+        BringToTop();
+
+    gFocusedWindow = this;
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::ConfigureChildren(const nsTArray<nsIWidget::Configuration>&)
+{
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::Invalidate(const nsIntRect &aRect,
+                     bool aIsSynchronous)
+{
+    gWindowToRedraw = this;
+    gDrawRequest = true;
+    mozilla::NotifyEvent();
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::Update()
+{
+    Invalidate(gScreenBounds, false);
+    return NS_OK;
+}
+
+nsIntPoint
+nsWindow::WidgetToScreenOffset()
+{
+    nsIntPoint p(0, 0);
+    nsWindow *w = this;
+
+    while (w && w->mParent) {
+        p.x += w->mBounds.x;
+        p.y += w->mBounds.y;
+
+        w = w->mParent;
+    }
+
+    return p;
+}
+
+void*
+nsWindow::GetNativeData(PRUint32 aDataType)
+{
+    switch (aDataType) {
+    case NS_NATIVE_WINDOW:
+        return gNativeWindow;
+    case NS_NATIVE_WIDGET:
+        return this;
+    }
+    return nsnull;
+}
+
+NS_IMETHODIMP
+nsWindow::DispatchEvent(nsGUIEvent *aEvent, nsEventStatus &aStatus)
+{
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWindow::ReparentNativeWidget(nsIWidget* aNewParent)
+{
+    return NS_OK;
+}
+
+float
+nsWindow::GetDPI()
+{
+    return gNativeWindow->xdpi;
+}
+
+LayerManager *
+nsWindow::GetLayerManager(PLayersChild* aShadowManager,
+                          LayersBackend aBackendHint,
+                          LayerManagerPersistence aPersistence,
+                          bool* aAllowRetaining)
+{
+    if (aAllowRetaining)
+        *aAllowRetaining = true;
+    if (mLayerManager)
+        return mLayerManager;
+
+    nsWindow *topWindow = sTopWindows[0];
+
+    if (!topWindow) {
+        LOG(" -- no topwindow\n");
+        return nsnull;
+    }
+
+    if (!sGLContext) {
+        LOG(" -- no GLContext\n");
+        return nsnull;
+    }
+
+    nsRefPtr<LayerManagerOGL> layerManager =
+        new LayerManagerOGL(this);
+
+    if (layerManager->Initialize(sGLContext))
+        mLayerManager = layerManager;
+    else
+        LOG("Could not create LayerManager");
+
+    return mLayerManager;
+}
+
+gfxASurface *
+nsWindow::GetThebesSurface()
+{
+    /* This is really a dummy surface; this is only used when doing reflow, because
+     * we need a RenderingContext to measure text against.
+     */
+
+    // XXX this really wants to return already_AddRefed, but this only really gets used
+    // on direct assignment to a gfxASurface
+    return new gfxImageSurface(gfxIntSize(5,5), gfxImageSurface::ImageFormatRGB24);
+}
+
+void
+nsWindow::BringToTop()
+{
+    if (!sTopWindows.IsEmpty()) {
+        nsGUIEvent event(true, NS_DEACTIVATE, sTopWindows[0]);
+        (*mEventCallback)(&event);
+    }
+
+    sTopWindows.RemoveElement(this);
+    sTopWindows.InsertElementAt(0, this);
+
+    nsGUIEvent event(true, NS_ACTIVATE, this);
+    (*mEventCallback)(&event);
+}
+
diff --git a/widget/src/gonk/nsWindow.h b/widget/src/gonk/nsWindow.h
new file mode 100644
index 000000000000..a43be5b1e29b
--- /dev/null
+++ b/widget/src/gonk/nsWindow.h
@@ -0,0 +1,128 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Gonk.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Michael Wu <mwu@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsWindow_h
+#define nsWindow_h
+
+#include "nsBaseWidget.h"
+
+extern nsIntRect gScreenBounds;
+
+namespace mozilla {
+namespace gl {
+class GLContext;
+}
+namespace layers {
+class LayersManager;
+}
+}
+
+namespace android {
+class FramebufferNativeWindow;
+}
+
+class nsWindow : public nsBaseWidget
+{
+public:
+    nsWindow();
+    virtual ~nsWindow();
+
+    static void DoDraw(void);
+    static nsEventStatus DispatchInputEvent(nsGUIEvent &aEvent);
+
+    NS_IMETHOD Create(nsIWidget *aParent,
+                      void *aNativeParent,
+                      const nsIntRect &aRect,
+                      EVENT_CALLBACK aHandleEventFunction,
+                      nsDeviceContext *aContext,
+                      nsWidgetInitData *aInitData);
+    NS_IMETHOD Destroy(void);
+
+    NS_IMETHOD Show(bool aState);
+    NS_IMETHOD IsVisible(bool & aState);
+    NS_IMETHOD ConstrainPosition(bool aAllowSlop,
+                                 PRInt32 *aX,
+                                 PRInt32 *aY);
+    NS_IMETHOD Move(PRInt32 aX,
+                    PRInt32 aY);
+    NS_IMETHOD Resize(PRInt32 aWidth,
+                      PRInt32 aHeight,
+                      bool  aRepaint);
+    NS_IMETHOD Resize(PRInt32 aX,
+                      PRInt32 aY,
+                      PRInt32 aWidth,
+                      PRInt32 aHeight,
+                      bool aRepaint);
+    NS_IMETHOD Enable(bool aState);
+    NS_IMETHOD IsEnabled(bool *aState);
+    NS_IMETHOD SetFocus(bool aRaise = false);
+    NS_IMETHOD ConfigureChildren(const nsTArray<nsIWidget::Configuration>&);
+    NS_IMETHOD Invalidate(const nsIntRect &aRect,
+                          bool aIsSynchronous);
+    NS_IMETHOD Update();
+    virtual void* GetNativeData(PRUint32 aDataType);
+    NS_IMETHOD SetTitle(const nsAString& aTitle)
+    {
+        return NS_OK;
+    }
+    virtual nsIntPoint WidgetToScreenOffset();
+    NS_IMETHOD DispatchEvent(nsGUIEvent *aEvent, nsEventStatus &aStatus);
+    NS_IMETHOD CaptureRollupEvents(nsIRollupListener *aListener,
+                                   nsIMenuRollup *aMenuRollup,
+                                   bool aDoCapture,
+                                   bool aConsumeRollupEvent)
+    {
+        return NS_ERROR_NOT_IMPLEMENTED;
+    }
+    NS_IMETHOD ReparentNativeWidget(nsIWidget* aNewParent);
+
+    virtual float GetDPI();
+    virtual mozilla::layers::LayerManager*
+        GetLayerManager(PLayersChild* aShadowManager = nsnull,
+                        LayersBackend aBackendHint = LayerManager::LAYERS_NONE,
+                        LayerManagerPersistence aPersistence = LAYER_MANAGER_CURRENT,
+                        bool* aAllowRetaining = nsnull);
+    gfxASurface* GetThebesSurface();
+
+protected:
+    nsWindow* mParent;
+    bool mVisible;
+
+    void BringToTop();
+};
+
+#endif /* nsWindow_h */
diff --git a/widget/src/gtk2/nsWindow.cpp b/widget/src/gtk2/nsWindow.cpp
index 2fd6f64914b1..612345b2f254 100644
--- a/widget/src/gtk2/nsWindow.cpp
+++ b/widget/src/gtk2/nsWindow.cpp
@@ -51,7 +51,6 @@
 #include "nsWindow.h"
 #include "nsGTKToolkit.h"
 #include "nsIRollupListener.h"
-#include "nsIMenuRollup.h"
 #include "nsIDOMNode.h"
 
 #include "nsWidgetsCID.h"
@@ -332,7 +331,6 @@ static bool              gRaiseWindows         = true;
 static nsWindow         *gPluginFocusWindow    = NULL;
 
 static nsIRollupListener*          gRollupListener;
-static nsIMenuRollup*              gMenuRollup;
 static nsWeakPtr                   gRollupWindow;
 static bool                        gConsumeRollupEvent;
 
@@ -772,8 +770,7 @@ nsWindow::Destroy(void)
     nsCOMPtr<nsIWidget> rollupWidget = do_QueryReferent(gRollupWindow);
     if (static_cast<nsIWidget *>(this) == rollupWidget.get()) {
         if (gRollupListener)
-            gRollupListener->Rollup(nsnull, nsnull);
-        NS_IF_RELEASE(gMenuRollup);
+            gRollupListener->Rollup(0);
         gRollupWindow = nsnull;
         gRollupListener = nsnull;
     }
@@ -1867,7 +1864,6 @@ nsWindow::CaptureMouse(bool aCapture)
 
 NS_IMETHODIMP
 nsWindow::CaptureRollupEvents(nsIRollupListener *aListener,
-                              nsIMenuRollup     *aMenuRollup,
                               bool               aDoCapture,
                               bool               aConsumeRollupEvent)
 {
@@ -1883,9 +1879,6 @@ nsWindow::CaptureRollupEvents(nsIRollupListener *aListener,
     if (aDoCapture) {
         gConsumeRollupEvent = aConsumeRollupEvent;
         gRollupListener = aListener;
-        NS_IF_RELEASE(gMenuRollup);
-        gMenuRollup = aMenuRollup;
-        NS_IF_ADDREF(aMenuRollup);
         gRollupWindow = do_GetWeakReference(static_cast<nsIWidget*>
                                                        (this));
         // real grab is only done when there is no dragging
@@ -1903,7 +1896,6 @@ nsWindow::CaptureRollupEvents(nsIRollupListener *aListener,
         // was not added to this widget.
         gtk_grab_remove(widget);
         gRollupListener = nsnull;
-        NS_IF_RELEASE(gMenuRollup);
         gRollupWindow = nsnull;
     }
 
@@ -5357,16 +5349,16 @@ check_for_rollup(GdkWindow *aWindow, gdouble aMouseX, gdouble aMouseY,
         if (aAlwaysRollup || !is_mouse_in_window(currentPopup, aMouseX, aMouseY)) {
             bool rollup = true;
             if (aIsWheel) {
-                gRollupListener->ShouldRollupOnMouseWheelEvent(&rollup);
+                rollup = gRollupListener->ShouldRollupOnMouseWheelEvent();
                 retVal = true;
             }
             // if we're dealing with menus, we probably have submenus and
             // we don't want to rollup if the click is in a parent menu of
             // the current submenu
             PRUint32 popupsToRollup = PR_UINT32_MAX;
-            if (gMenuRollup && !aAlwaysRollup) {
+            if (!aAlwaysRollup) {
                 nsAutoTArray<nsIWidget*, 5> widgetChain;
-                PRUint32 sameTypeCount = gMenuRollup->GetSubmenuWidgetChain(&widgetChain);
+                PRUint32 sameTypeCount = gRollupListener->GetSubmenuWidgetChain(&widgetChain);
                 for (PRUint32 i=0; i<widgetChain.Length(); ++i) {
                     nsIWidget* widget = widgetChain[i];
                     GdkWindow* currWindow =
@@ -5390,7 +5382,7 @@ check_for_rollup(GdkWindow *aWindow, gdouble aMouseX, gdouble aMouseY,
 
             // if we've determined that we should still rollup, do it.
             if (rollup) {
-                gRollupListener->Rollup(popupsToRollup, nsnull);
+                gRollupListener->Rollup(popupsToRollup);
                 if (popupsToRollup == PR_UINT32_MAX) {
                     retVal = true;
                 }
@@ -5399,7 +5391,6 @@ check_for_rollup(GdkWindow *aWindow, gdouble aMouseX, gdouble aMouseY,
     } else {
         gRollupWindow = nsnull;
         gRollupListener = nsnull;
-        NS_IF_RELEASE(gMenuRollup);
     }
 
     return retVal;
diff --git a/widget/src/gtk2/nsWindow.h b/widget/src/gtk2/nsWindow.h
index a72eca757d45..1e0744b5a1f7 100644
--- a/widget/src/gtk2/nsWindow.h
+++ b/widget/src/gtk2/nsWindow.h
@@ -186,7 +186,6 @@ public:
     NS_IMETHOD         EnableDragDrop(bool aEnable);
     NS_IMETHOD         CaptureMouse(bool aCapture);
     NS_IMETHOD         CaptureRollupEvents(nsIRollupListener *aListener,
-                                           nsIMenuRollup *aMenuRollup,
                                            bool aDoCapture,
                                            bool aConsumeRollupEvent);
     NS_IMETHOD         GetAttention(PRInt32 aCycleCount);
diff --git a/widget/src/os2/nsWindow.cpp b/widget/src/os2/nsWindow.cpp
index dbea32f532fc..67a8a9f44bd6 100644
--- a/widget/src/os2/nsWindow.cpp
+++ b/widget/src/os2/nsWindow.cpp
@@ -74,7 +74,6 @@
 #include "nsDragService.h"
 #include "nsGfxCIID.h"
 #include "nsHashKeys.h"
-#include "nsIMenuRollup.h"
 #include "nsIRollupListener.h"
 #include "nsIScreenManager.h"
 #include "nsOS2Uni.h"
@@ -184,7 +183,6 @@ using namespace mozilla;
 
 // Rollup Listener - used by nsWindow & os2FrameWindow
 nsIRollupListener*  gRollupListener           = 0;
-nsIMenuRollup*      gMenuRollup               = 0;
 nsIWidget*          gRollupWidget             = 0;
 bool                gRollupConsumeRollupEvent = false;
 
@@ -486,9 +484,9 @@ NS_METHOD nsWindow::Destroy()
   // the rollup widget, rollup and turn off capture.
   if (this == gRollupWidget) {
     if (gRollupListener) {
-      gRollupListener->Rollup(PR_UINT32_MAX, nsnull);
+      gRollupListener->Rollup(PR_UINT32_MAX);
     }
-    CaptureRollupEvents(nsnull, nsnull, false, true);
+    CaptureRollupEvents(nsnull, false, true);
   }
 
   HWND hMain = GetMainWindow();
@@ -1536,7 +1534,6 @@ HBITMAP nsWindow::CreateTransparencyMask(gfxASurface::gfxImageFormat format,
 //=============================================================================
 
 NS_IMETHODIMP nsWindow::CaptureRollupEvents(nsIRollupListener* aListener,
-                                            nsIMenuRollup* aMenuRollup,
                                             bool aDoCapture,
                                             bool aConsumeRollupEvent)
 {
@@ -1548,14 +1545,10 @@ NS_IMETHODIMP nsWindow::CaptureRollupEvents(nsIRollupListener* aListener,
     gRollupConsumeRollupEvent = aConsumeRollupEvent;
     NS_IF_RELEASE(gRollupWidget);
     gRollupListener = aListener;
-    NS_IF_RELEASE(gMenuRollup);
-    gMenuRollup = aMenuRollup;
-    NS_IF_ADDREF(aMenuRollup);
     gRollupWidget = this;
     NS_ADDREF(this);
  } else {
     gRollupListener = nsnull;
-    NS_IF_RELEASE(gMenuRollup);
     NS_IF_RELEASE(gRollupWidget);
   }
 
@@ -1599,9 +1592,9 @@ bool nsWindow::RollupOnButtonDown(ULONG aMsg)
   // event was inside a parent of the current submenu.
   PRUint32 popupsToRollup = PR_UINT32_MAX;
 
-  if (gMenuRollup) {
+  if (gRollupListener) {
     nsAutoTArray<nsIWidget*, 5> widgetChain;
-    PRUint32 sameTypeCount = gMenuRollup->GetSubmenuWidgetChain(&widgetChain);
+    PRUint32 sameTypeCount = gRollupListener->GetSubmenuWidgetChain(&widgetChain);
     for (PRUint32 i = 0; i < widgetChain.Length(); ++i) {
       nsIWidget* widget = widgetChain[i];
       if (EventIsInsideWindow((nsWindow*)widget)) {
@@ -1615,8 +1608,9 @@ bool nsWindow::RollupOnButtonDown(ULONG aMsg)
   } // if rollup listener knows about menus
 
   // We only need to deal with the last rollup for left mouse down events.
-  gRollupListener->Rollup(popupsToRollup,
-                          aMsg == WM_BUTTON1DOWN ? &mLastRollup : nsnull);
+  NS_ASSERTION(!mLastRollup, "mLastRollup is null");
+  mLastRollup = gRollupListener->Rollup(popupsToRollup, aMsg == WM_BUTTON1DOWN);
+  NS_IF_ADDREF(mLastRollup);
 
   // If true, the buttondown event won't be passed on to the wndproc.
   return gRollupConsumeRollupEvent;
@@ -1635,9 +1629,9 @@ void nsWindow::RollupOnFocusLost(HWND aFocus)
   }
 
   // Exit if focus was lost to a parent of the current submenu.
-  if (gMenuRollup) {
+  if (gRollupListener) {
     nsAutoTArray<nsIWidget*, 5> widgetChain;
-    gMenuRollup->GetSubmenuWidgetChain(&widgetChain);
+    gRollupListener->GetSubmenuWidgetChain(&widgetChain);
     for (PRUint32 i = 0; i < widgetChain.Length(); ++i) {
       if (((nsWindow*)widgetChain[i])->mWnd == aFocus) {
         return;
@@ -1646,7 +1640,7 @@ void nsWindow::RollupOnFocusLost(HWND aFocus)
   }
 
   // Rollup all popups.
-  gRollupListener->Rollup(PR_UINT32_MAX, nsnull);
+  gRollupListener->Rollup(PR_UINT32_MAX);
   return;
 }
 
diff --git a/widget/src/os2/nsWindow.h b/widget/src/os2/nsWindow.h
index f240d8f8c9ed..07a9f0542f1c 100644
--- a/widget/src/os2/nsWindow.h
+++ b/widget/src/os2/nsWindow.h
@@ -206,7 +206,6 @@ public:
   NS_IMETHOD            SetCursor(imgIContainer* aCursor,
                                   PRUint32 aHotspotX, PRUint32 aHotspotY);
   NS_IMETHOD            CaptureRollupEvents(nsIRollupListener* aListener,
-                                            nsIMenuRollup* aMenuRollup,
                                             bool aDoCapture, bool aConsumeRollupEvent);
   NS_IMETHOD            GetToggledKeyState(PRUint32 aKeyCode,
                                            bool* aLEDState);
diff --git a/widget/src/os2/os2FrameWindow.cpp b/widget/src/os2/os2FrameWindow.cpp
index b9096c588f77..76c602905a6c 100644
--- a/widget/src/os2/os2FrameWindow.cpp
+++ b/widget/src/os2/os2FrameWindow.cpp
@@ -630,7 +630,7 @@ MRESULT EXPENTRY fnwpFrame(HWND hwnd, ULONG msg, MPARAM mp1, MPARAM mp2)
         msg == WM_BUTTON3DOWN) {
       // Rollup if the event is outside the popup
       if (!nsWindow::EventIsInsideWindow((nsWindow*)gRollupWidget)) {
-        gRollupListener->Rollup(PR_UINT32_MAX, nsnull);
+        gRollupListener->Rollup(PR_UINT32_MAX);
       }
     }
   }
diff --git a/widget/src/qt/faststartupqt/Makefile.in b/widget/src/qt/faststartupqt/Makefile.in
index cbee4f4aa743..f6741be430b8 100644
--- a/widget/src/qt/faststartupqt/Makefile.in
+++ b/widget/src/qt/faststartupqt/Makefile.in
@@ -45,7 +45,6 @@ MODULE = faststartupqt
 LIBRARY_NAME = faststartupqt
 DIST_INSTALL = 1
 FORCE_STATIC_LIB = 1
-FORCE_USE_PIC = 1
 STL_FLAGS=
 
 EXTRA_DSO_LDOPTS = \
diff --git a/widget/src/qt/nsWindow.cpp b/widget/src/qt/nsWindow.cpp
index 88531a5576bb..830f2a55d080 100644
--- a/widget/src/qt/nsWindow.cpp
+++ b/widget/src/qt/nsWindow.cpp
@@ -98,7 +98,6 @@ using namespace QtMobility;
 #include "nsIdleService.h"
 #include "nsRenderingContext.h"
 #include "nsIRollupListener.h"
-#include "nsIMenuRollup.h"
 #include "nsWidgetsCID.h"
 #include "nsQtKeyUtils.h"
 #include "mozilla/Services.h"
@@ -183,7 +182,6 @@ static const int WHEEL_DELTA = 120;
 static bool gGlobalsInitialized = false;
 
 static nsIRollupListener*          gRollupListener;
-static nsIMenuRollup*              gMenuRollup;
 static nsWeakPtr                   gRollupWindow;
 static bool                        gConsumeRollupEvent;
 
@@ -423,10 +421,9 @@ nsWindow::Destroy(void)
     nsCOMPtr<nsIWidget> rollupWidget = do_QueryReferent(gRollupWindow);
     if (static_cast<nsIWidget *>(this) == rollupWidget.get()) {
         if (gRollupListener)
-            gRollupListener->Rollup(nsnull, nsnull);
+            gRollupListener->Rollup(0);
         gRollupWindow = nsnull;
         gRollupListener = nsnull;
-        NS_IF_RELEASE(gMenuRollup);
     }
 
     if (mLayerManager) {
@@ -939,7 +936,6 @@ nsWindow::CaptureMouse(bool aCapture)
 
 NS_IMETHODIMP
 nsWindow::CaptureRollupEvents(nsIRollupListener *aListener,
-                              nsIMenuRollup     *aMenuRollup,
                               bool               aDoCapture,
                               bool               aConsumeRollupEvent)
 {
@@ -951,14 +947,10 @@ nsWindow::CaptureRollupEvents(nsIRollupListener *aListener,
     if (aDoCapture) {
         gConsumeRollupEvent = aConsumeRollupEvent;
         gRollupListener = aListener;
-        NS_IF_RELEASE(gMenuRollup);
-        gMenuRollup = aMenuRollup;
-        NS_IF_ADDREF(aMenuRollup);
         gRollupWindow = do_GetWeakReference(static_cast<nsIWidget*>(this));
     }
     else {
         gRollupListener = nsnull;
-        NS_IF_RELEASE(gMenuRollup);
         gRollupWindow = nsnull;
     }
 
@@ -979,16 +971,16 @@ check_for_rollup(double aMouseX, double aMouseY,
         if (!is_mouse_in_window(currentPopup, aMouseX, aMouseY)) {
             bool rollup = true;
             if (aIsWheel) {
-                gRollupListener->ShouldRollupOnMouseWheelEvent(&rollup);
+                rollup = gRollupListener->ShouldRollupOnMouseWheelEvent();
                 retVal = true;
             }
             // if we're dealing with menus, we probably have submenus and
             // we don't want to rollup if the clickis in a parent menu of
             // the current submenu
             PRUint32 popupsToRollup = PR_UINT32_MAX;
-            if (gMenuRollup) {
+            if (gRollupListener) {
                 nsAutoTArray<nsIWidget*, 5> widgetChain;
-                PRUint32 sameTypeCount = gMenuRollup->GetSubmenuWidgetChain(&widgetChain);
+                PRUint32 sameTypeCount = gRollupListener->GetSubmenuWidgetChain(&widgetChain);
                 for (PRUint32 i=0; i<widgetChain.Length(); ++i) {
                     nsIWidget* widget =  widgetChain[i];
                     MozQWidget* currWindow =
@@ -1007,14 +999,13 @@ check_for_rollup(double aMouseX, double aMouseY,
 
             // if we've determined that we should still rollup, do it.
             if (rollup) {
-                gRollupListener->Rollup(popupsToRollup, nsnull);
+                gRollupListener->Rollup(popupsToRollup);
                 retVal = true;
             }
         }
     } else {
         gRollupWindow = nsnull;
         gRollupListener = nsnull;
-        NS_IF_RELEASE(gMenuRollup);
     }
 
     return retVal;
diff --git a/widget/src/qt/nsWindow.h b/widget/src/qt/nsWindow.h
index e05878f73ce8..df260f1d08a6 100644
--- a/widget/src/qt/nsWindow.h
+++ b/widget/src/qt/nsWindow.h
@@ -186,7 +186,6 @@ public:
     NS_IMETHOD         EnableDragDrop(bool aEnable);
     NS_IMETHOD         CaptureMouse(bool aCapture);
     NS_IMETHOD         CaptureRollupEvents(nsIRollupListener *aListener,
-                                           nsIMenuRollup *aMenuRollup,
                                            bool aDoCapture,
                                            bool aConsumeRollupEvent);
 
diff --git a/widget/src/windows/GfxInfo.cpp b/widget/src/windows/GfxInfo.cpp
index f5b19042bf84..39f3f8cc6468 100644
--- a/widget/src/windows/GfxInfo.cpp
+++ b/widget/src/windows/GfxInfo.cpp
@@ -420,39 +420,6 @@ GfxInfo::Init()
               if (result == ERROR_SUCCESS)
                 mDriverDate = value;
               RegCloseKey(key); 
-
-              // Check for second adapter:
-              //
-              // A second adapter will have the same driver key as the first adapter except for 
-              // the last character, where '1' will be swapped for '0' or vice-versa.
-              // We know driverKey.Length() > 0 since driverKeyPre is a prefix of driverKey.
-              if (driverKey[driverKey.Length()-1] == '0') {
-                driverKey.SetCharAt('1', driverKey.Length()-1);
-              } else {
-                driverKey.SetCharAt('0', driverKey.Length()-1);
-              }
-              result = RegOpenKeyExW(HKEY_LOCAL_MACHINE, driverKey.BeginReading(), 0, KEY_QUERY_VALUE, &key);
-              if (result == ERROR_SUCCESS) {
-                mHasDualGPU = true;
-                mDeviceKey2 = driverKey;
-                dwcbData = sizeof(value);
-                result = RegQueryValueExW(key, L"DriverVersion", NULL, NULL, (LPBYTE)value, &dwcbData);
-                if (result == ERROR_SUCCESS)
-                  mDriverVersion2 = value;
-                dwcbData = sizeof(value);
-                result = RegQueryValueExW(key, L"DriverDate", NULL, NULL, (LPBYTE)value, &dwcbData);
-                if (result == ERROR_SUCCESS)
-                  mDriverDate2 = value;
-                dwcbData = sizeof(value);
-                result = RegQueryValueExW(key, L"Device Description", NULL, NULL, (LPBYTE)value, &dwcbData);
-                if (result == ERROR_SUCCESS)
-                  mDeviceString2 = value;
-                dwcbData = sizeof(value);
-                result = RegQueryValueExW(key, L"MatchingDeviceId", NULL, NULL, (LPBYTE)value, &dwcbData);
-                if (result == ERROR_SUCCESS)
-                  mDeviceID2 = value;
-                RegCloseKey(key);
-              }  
               break;
             }
           }
@@ -460,18 +427,116 @@ GfxInfo::Init()
 
         setupDestroyDeviceInfoList(devinfo);
       }
+
+      mAdapterVendorID  = ParseIDFromDeviceID(mDeviceID,  "VEN_", 4);
+      mAdapterDeviceID  = ParseIDFromDeviceID(mDeviceID,  "&DEV_", 4);
+      mAdapterSubsysID  = ParseIDFromDeviceID(mDeviceID,  "&SUBSYS_", 8);
+
+      // We now check for second display adapter.
+
+      // Device interface class for display adapters.
+      CLSID GUID_DISPLAY_DEVICE_ARRIVAL;
+      HRESULT hresult = CLSIDFromString(L"{1CA05180-A699-450A-9A0C-DE4FBE3DDD89}",
+                                   &GUID_DISPLAY_DEVICE_ARRIVAL);
+      if (hresult == NOERROR) {
+        devinfo = setupGetClassDevs(&GUID_DISPLAY_DEVICE_ARRIVAL, NULL, NULL,
+                                           DIGCF_PRESENT | DIGCF_INTERFACEDEVICE);
+
+        if (devinfo != INVALID_HANDLE_VALUE) {
+          HKEY key;
+          LONG result;
+          WCHAR value[255];
+          DWORD dwcbData;
+          SP_DEVINFO_DATA devinfoData;
+          DWORD memberIndex = 0;
+          devinfoData.cbSize = sizeof(devinfoData);
+
+          nsAutoString adapterDriver2;
+          nsAutoString deviceID2;
+          nsAutoString driverVersion2;
+          nsAutoString driverDate2;
+          PRUint32 adapterVendorID2;
+          PRUint32 adapterDeviceID2;
+
+          NS_NAMED_LITERAL_STRING(driverKeyPre, "System\\CurrentControlSet\\Control\\Class\\");
+          /* enumerate device information elements in the device information set */
+          while (setupEnumDeviceInfo(devinfo, memberIndex++, &devinfoData)) {
+            /* get a string that identifies the device's driver key */
+            if (setupGetDeviceRegistryProperty(devinfo,
+                                               &devinfoData,
+                                               SPDRP_DRIVER,
+                                               NULL,
+                                               (PBYTE)value,
+                                               sizeof(value),
+                                               NULL)) {
+              nsAutoString driverKey2(driverKeyPre);
+              driverKey2 += value;
+              result = RegOpenKeyExW(HKEY_LOCAL_MACHINE, driverKey2.BeginReading(), 0, KEY_QUERY_VALUE, &key);
+              if (result == ERROR_SUCCESS) {
+                dwcbData = sizeof(value);
+                result = RegQueryValueExW(key, L"MatchingDeviceId", NULL, NULL, (LPBYTE)value, &dwcbData);
+                if (result != ERROR_SUCCESS) {
+                  continue;
+                }
+                deviceID2 = value;
+                adapterVendorID2 = ParseIDFromDeviceID(deviceID2, "VEN_", 4);
+                adapterDeviceID2 = ParseIDFromDeviceID(deviceID2, "&DEV_", 4);
+                if ((adapterVendorID2 == mAdapterVendorID) &&
+                    (adapterDeviceID2 == mAdapterDeviceID)) {
+                  RegCloseKey(key);
+                  continue;
+                }
+
+                // If this device is missing driver information, it is unlikely to
+                // be a real display adapter.
+                if (NS_FAILED(GetKeyValue(driverKey2.BeginReading(), L"InstalledDisplayDrivers",
+                               adapterDriver2, REG_MULTI_SZ))) {
+                  RegCloseKey(key);
+                  continue;
+                }
+                dwcbData = sizeof(value);
+                result = RegQueryValueExW(key, L"DriverVersion", NULL, NULL, (LPBYTE)value, &dwcbData);
+                if (result != ERROR_SUCCESS) {
+                  RegCloseKey(key);
+                  continue;
+                }
+                driverVersion2 = value;
+                dwcbData = sizeof(value);
+                result = RegQueryValueExW(key, L"DriverDate", NULL, NULL, (LPBYTE)value, &dwcbData);
+                if (result != ERROR_SUCCESS) {
+                  RegCloseKey(key);
+                  continue;
+                }
+                driverDate2 = value;
+                dwcbData = sizeof(value);
+                result = RegQueryValueExW(key, L"Device Description", NULL, NULL, (LPBYTE)value, &dwcbData);
+                RegCloseKey(key);
+                if (result == ERROR_SUCCESS) {
+                  mHasDualGPU = true;
+                  mDeviceString2 = value;
+                  mDeviceID2 = deviceID2;
+                  mDeviceKey2 = driverKey2;
+                  mDriverVersion2 = driverVersion2;
+                  mDriverDate2 = driverDate2;
+                  mAdapterVendorID2 = adapterVendorID2;
+                  mAdapterDeviceID2 = adapterDeviceID2;
+                  mAdapterSubsysID2 = ParseIDFromDeviceID(mDeviceID2, "&SUBSYS_", 8);
+                  break;
+                }
+              }
+            }
+          }
+
+          setupDestroyDeviceInfoList(devinfo);
+        }
+      }
+
+
     }
 
     FreeLibrary(setupapi);
   }
 
-  mAdapterVendorID  = ParseIDFromDeviceID(mDeviceID,  "VEN_", 4);
-  mAdapterVendorID2 = ParseIDFromDeviceID(mDeviceID2, "VEN_", 4);
-  mAdapterDeviceID  = ParseIDFromDeviceID(mDeviceID,  "&DEV_", 4);
-  mAdapterDeviceID2 = ParseIDFromDeviceID(mDeviceID2, "&DEV_", 4);
-  mAdapterSubsysID  = ParseIDFromDeviceID(mDeviceID,  "&SUBSYS_", 8);
-  mAdapterSubsysID2 = ParseIDFromDeviceID(mDeviceID2, "&SUBSYS_", 8);
-
   const char *spoofedDriverVersionString = PR_GetEnv("MOZ_GFX_SPOOF_DRIVER_VERSION");
   if (spoofedDriverVersionString) {
     mDriverVersion.AssignASCII(spoofedDriverVersionString);
@@ -551,8 +616,11 @@ GfxInfo::GetAdapterRAM(nsAString & aAdapterRAM)
 NS_IMETHODIMP
 GfxInfo::GetAdapterRAM2(nsAString & aAdapterRAM)
 {
-  if (NS_FAILED(GetKeyValue(mDeviceKey2.BeginReading(), L"HardwareInformation.MemorySize", aAdapterRAM, REG_DWORD)))
+  if (!mHasDualGPU) {
+    aAdapterRAM.AssignLiteral("");
+  } else if (NS_FAILED(GetKeyValue(mDeviceKey2.BeginReading(), L"HardwareInformation.MemorySize", aAdapterRAM, REG_DWORD))) {
     aAdapterRAM = L"Unknown";
+  }
   return NS_OK;
 }
 
@@ -569,8 +637,11 @@ GfxInfo::GetAdapterDriver(nsAString & aAdapterDriver)
 NS_IMETHODIMP
 GfxInfo::GetAdapterDriver2(nsAString & aAdapterDriver)
 {
-  if (NS_FAILED(GetKeyValue(mDeviceKey2.BeginReading(), L"InstalledDisplayDrivers", aAdapterDriver, REG_MULTI_SZ)))
+  if (!mHasDualGPU) {
+    aAdapterDriver.AssignLiteral("");
+  } else if (NS_FAILED(GetKeyValue(mDeviceKey2.BeginReading(), L"InstalledDisplayDrivers", aAdapterDriver, REG_MULTI_SZ))) {
     aAdapterDriver = L"Unknown";
+  }
   return NS_OK;
 }
 
diff --git a/widget/src/windows/WinTaskbar.cpp b/widget/src/windows/WinTaskbar.cpp
index 528ff53b2b4c..55e7618775fc 100644
--- a/widget/src/windows/WinTaskbar.cpp
+++ b/widget/src/windows/WinTaskbar.cpp
@@ -281,7 +281,7 @@ WinTaskbar::GetAppUserModelID(nsAString & aDefaultGroupId) {
     Preferences::GetBool("taskbar.grouping.useprofile", false);
   if (useProfile) {
     nsCOMPtr<nsIFile> profileDir;
-    NS_GetSpecialDirectory(NS_APP_PROFILE_DEFAULTS_50_DIR,
+    NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
                            getter_AddRefs(profileDir));
     bool exists = false;
     if (profileDir && NS_SUCCEEDED(profileDir->Exists(&exists)) && exists) {
diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index 683585449420..e058f8199772 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -129,7 +129,6 @@
 #include "imgIContainer.h"
 #include "nsIFile.h"
 #include "nsIRollupListener.h"
-#include "nsIMenuRollup.h"
 #include "nsIServiceManager.h"
 #include "nsIClipboard.h"
 #include "nsIMM32Handler.h"
@@ -206,6 +205,8 @@
 #include "nsCrashOnException.h"
 #include "nsIXULRuntime.h"
 
+#include "nsIContent.h"
+
 using namespace mozilla::widget;
 using namespace mozilla::layers;
 using namespace mozilla;
@@ -253,7 +254,6 @@ UINT            nsWindow::sHookTimerId            = 0;
 
 // Rollup Listener
 nsIRollupListener* nsWindow::sRollupListener      = nsnull;
-nsIMenuRollup*  nsWindow::sMenuRollup             = nsnull;
 nsIWidget*      nsWindow::sRollupWidget           = nsnull;
 bool            nsWindow::sRollupConsumeEvent     = false;
 
@@ -332,6 +332,9 @@ bool            gDisableNativeTheme               = false;
 // Global used in Show window enumerations.
 static bool     gWindowsVisible                   = false;
 
+// True if we have sent a notification that we are suspending/sleeping.
+static bool     gIsSleepMode                      = false;
+
 static NS_DEFINE_CID(kCClipboardCID, NS_CLIPBOARD_CID);
 
 // General purpose user32.dll hook object
@@ -3077,7 +3080,6 @@ NS_METHOD nsWindow::CaptureMouse(bool aCapture)
  **************************************************************/
 
 NS_IMETHODIMP nsWindow::CaptureRollupEvents(nsIRollupListener * aListener,
-                                            nsIMenuRollup * aMenuRollup,
                                             bool aDoCapture,
                                             bool aConsumeRollupEvent)
 {
@@ -3088,10 +3090,7 @@ NS_IMETHODIMP nsWindow::CaptureRollupEvents(nsIRollupListener * aListener,
     NS_ASSERTION(!sRollupWidget, "rollup widget reassigned before release");
     sRollupConsumeEvent = aConsumeRollupEvent;
     NS_IF_RELEASE(sRollupWidget);
-    NS_IF_RELEASE(sMenuRollup);
     sRollupListener = aListener;
-    sMenuRollup = aMenuRollup;
-    NS_IF_ADDREF(aMenuRollup);
     sRollupWidget = this;
     NS_ADDREF(this);
     if (!sMsgFilterHook && !sCallProcHook && !sCallMouseHook) {
@@ -3100,7 +3099,6 @@ NS_IMETHODIMP nsWindow::CaptureRollupEvents(nsIRollupListener * aListener,
     sProcessHook = true;
   } else {
     sRollupListener = nsnull;
-    NS_IF_RELEASE(sMenuRollup);
     NS_IF_RELEASE(sRollupWidget);
     sProcessHook = false;
     UnregisterSpecialDropdownHooks();
@@ -4871,20 +4869,16 @@ bool nsWindow::ProcessMessage(UINT msg, WPARAM &wParam, LPARAM &lParam,
     break;
 
     case WM_POWERBROADCAST:
-      // only hidden window handle this
-      // to prevent duplicate notification
-      if (mWindowType == eWindowType_invisible) {
-        switch (wParam)
-        {
-          case PBT_APMSUSPEND:
-            PostSleepWakeNotification("sleep_notification");
-            break;
-          case PBT_APMRESUMEAUTOMATIC:
-          case PBT_APMRESUMECRITICAL:
-          case PBT_APMRESUMESUSPEND:
-            PostSleepWakeNotification("wake_notification");
-            break;
-        }
+      switch (wParam)
+      {
+        case PBT_APMSUSPEND:
+          PostSleepWakeNotification(true);
+          break;
+        case PBT_APMRESUMEAUTOMATIC:
+        case PBT_APMRESUMECRITICAL:
+        case PBT_APMRESUMESUSPEND:
+          PostSleepWakeNotification(false);
+          break;
       }
       break;
 
@@ -5726,12 +5720,18 @@ nsWindow::ClientMarginHitTestPoint(PRInt32 mx, PRInt32 my)
   return testResult;
 }
 
-void nsWindow::PostSleepWakeNotification(const char* aNotification)
+void nsWindow::PostSleepWakeNotification(const bool aIsSleepMode)
 {
+  if (aIsSleepMode == gIsSleepMode)
+    return;
+
+  gIsSleepMode = aIsSleepMode;
+
   nsCOMPtr<nsIObserverService> observerService =
     mozilla::services::GetObserverService();
   if (observerService)
-    observerService->NotifyObservers(nsnull, aNotification, nsnull);
+    observerService->NotifyObservers(nsnull,
+      aIsSleepMode ? "sleep_notification" : "wake_notification", nsnull);
 }
 
 // RemoveNextCharMessage() should be called by WM_KEYDOWN or WM_SYSKEYDOWM
@@ -7413,8 +7413,8 @@ void nsWindow::OnDestroy()
   // turn off capture.
   if ( this == sRollupWidget ) {
     if ( sRollupListener )
-      sRollupListener->Rollup(nsnull, nsnull);
-    CaptureRollupEvents(nsnull, nsnull, false, true);
+      sRollupListener->Rollup(0);
+    CaptureRollupEvents(nsnull, false, true);
   }
 
   // Restore the IM context.
@@ -8717,7 +8717,7 @@ nsWindow::DealWithPopups(HWND inWnd, UINT inMsg, WPARAM inWParam, LPARAM inLPara
 
       if (rollup && (inMsg == WM_MOUSEWHEEL || inMsg == WM_MOUSEHWHEEL))
       {
-        sRollupListener->ShouldRollupOnMouseWheelEvent(&rollup);
+        rollup = sRollupListener->ShouldRollupOnMouseWheelEvent();
         *outResult = true;
       }
 
@@ -8725,9 +8725,9 @@ nsWindow::DealWithPopups(HWND inWnd, UINT inMsg, WPARAM inWParam, LPARAM inLPara
       // want to rollup if the click is in a parent menu of the current submenu.
       PRUint32 popupsToRollup = PR_UINT32_MAX;
       if (rollup) {
-        if ( sMenuRollup ) {
+        if ( sRollupListener ) {
           nsAutoTArray<nsIWidget*, 5> widgetChain;
-          PRUint32 sameTypeCount = sMenuRollup->GetSubmenuWidgetChain(&widgetChain);
+          PRUint32 sameTypeCount = sRollupListener->GetSubmenuWidgetChain(&widgetChain);
           for ( PRUint32 i = 0; i < widgetChain.Length(); ++i ) {
             nsIWidget* widget = widgetChain[i];
             if ( nsWindow::EventIsInsideWindow(inMsg, (nsWindow*)widget) ) {
@@ -8763,7 +8763,7 @@ nsWindow::DealWithPopups(HWND inWnd, UINT inMsg, WPARAM inWParam, LPARAM inLPara
           {
             // WM_MOUSEACTIVATE cause by moving the mouse - X-mouse (eg. TweakUI)
             // must be enabled in Windows.
-            sRollupListener->ShouldRollupOnMouseActivate(&rollup);
+            rollup = sRollupListener->ShouldRollupOnMouseActivate();
             if (!rollup)
             {
               *outResult = MA_NOACTIVATE;
@@ -8778,7 +8778,9 @@ nsWindow::DealWithPopups(HWND inWnd, UINT inMsg, WPARAM inWParam, LPARAM inLPara
         // nsIRollupListener::Rollup.
         bool consumeRollupEvent = sRollupConsumeEvent;
         // only need to deal with the last rollup for left mouse down events.
-        sRollupListener->Rollup(popupsToRollup, inMsg == WM_LBUTTONDOWN ? &mLastRollup : nsnull);
+        NS_ASSERTION(!mLastRollup, "mLastRollup is null");
+        mLastRollup = sRollupListener->Rollup(popupsToRollup, inMsg == WM_LBUTTONDOWN);
+        NS_IF_ADDREF(mLastRollup);
 
         // Tell hook to stop processing messages
         sProcessHook = false;
diff --git a/widget/src/windows/nsWindow.h b/widget/src/windows/nsWindow.h
index 9b92567d4b38..fe89f6876c74 100644
--- a/widget/src/windows/nsWindow.h
+++ b/widget/src/windows/nsWindow.h
@@ -158,7 +158,7 @@ public:
   NS_IMETHOD              DispatchEvent(nsGUIEvent* event, nsEventStatus & aStatus);
   NS_IMETHOD              EnableDragDrop(bool aEnable);
   NS_IMETHOD              CaptureMouse(bool aCapture);
-  NS_IMETHOD              CaptureRollupEvents(nsIRollupListener * aListener, nsIMenuRollup * aMenuRollup,
+  NS_IMETHOD              CaptureRollupEvents(nsIRollupListener * aListener,
                                               bool aDoCapture, bool aConsumeRollupEvent);
   NS_IMETHOD              GetAttention(PRInt32 aCycleCount);
   virtual bool            HasPendingInputEvent();
@@ -386,7 +386,7 @@ protected:
   static bool             EventIsInsideWindow(UINT Msg, nsWindow* aWindow);
   // Convert nsEventStatus value to a windows boolean
   static bool             ConvertStatus(nsEventStatus aStatus);
-  static void             PostSleepWakeNotification(const char* aNotification);
+  static void             PostSleepWakeNotification(const bool aIsSleepMode);
   PRInt32                 ClientMarginHitTestPoint(PRInt32 mx, PRInt32 my);
   static WORD             GetScanCode(LPARAM aLParam)
   {
@@ -594,7 +594,6 @@ protected:
   static nsIWidget*     sRollupWidget;
   static bool           sRollupConsumeEvent;
   static nsIRollupListener* sRollupListener;
-  static nsIMenuRollup* sMenuRollup;
 
   // Mouse Clicks - static variable definitions for figuring
   // out 1 - 3 Clicks.
diff --git a/widget/src/xpwidgets/Makefile.in b/widget/src/xpwidgets/Makefile.in
index 5612a0133d10..95a2312ee578 100644
--- a/widget/src/xpwidgets/Makefile.in
+++ b/widget/src/xpwidgets/Makefile.in
@@ -82,7 +82,7 @@ ifneq (,$(filter os2 cocoa windows,$(MOZ_WIDGET_TOOLKIT)))
 CPPSRCS += nsBaseClipboard.cpp
 endif
 
-ifneq (,$(filter qt gtk2 os2 cocoa windows android,$(MOZ_WIDGET_TOOLKIT)))
+ifneq (,$(filter qt gtk2 os2 cocoa windows android gonk,$(MOZ_WIDGET_TOOLKIT)))
 CPPSRCS += nsBaseFilePicker.cpp
 endif
 
diff --git a/widget/src/xpwidgets/PuppetWidget.h b/widget/src/xpwidgets/PuppetWidget.h
index e1cca43285a7..16ae7f017bd8 100644
--- a/widget/src/xpwidgets/PuppetWidget.h
+++ b/widget/src/xpwidgets/PuppetWidget.h
@@ -150,7 +150,7 @@ public:
 
   NS_IMETHOD DispatchEvent(nsGUIEvent* event, nsEventStatus& aStatus);
 
-  NS_IMETHOD CaptureRollupEvents(nsIRollupListener* aListener, nsIMenuRollup* aMenuRollup,
+  NS_IMETHOD CaptureRollupEvents(nsIRollupListener* aListener,
                                  bool aDoCapture, bool aConsumeRollupEvent)
   { return NS_ERROR_UNEXPECTED; }
 
diff --git a/widget/tests/TestWinTSF.cpp b/widget/tests/TestWinTSF.cpp
index 86eefcf4c923..dfeb4c7f8f82 100644
--- a/widget/tests/TestWinTSF.cpp
+++ b/widget/tests/TestWinTSF.cpp
@@ -189,7 +189,8 @@ TestApp::OnProgressChange(nsIWebProgress *aWebProgress,
 NS_IMETHODIMP
 TestApp::OnLocationChange(nsIWebProgress *aWebProgress,
                            nsIRequest *aRequest,
-                           nsIURI *aLocation)
+                           nsIURI *aLocation,
+                           PRUint32 aFlags)
 {
   return NS_OK;
 }
diff --git a/xpcom/base/Makefile.in b/xpcom/base/Makefile.in
index e9301445e1bf..e3f14826505b 100644
--- a/xpcom/base/Makefile.in
+++ b/xpcom/base/Makefile.in
@@ -153,8 +153,6 @@ endif
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 include $(topsrcdir)/config/config.mk
 include $(topsrcdir)/ipc/chromium/chromium-config.mk
diff --git a/xpcom/base/nsConsoleService.cpp b/xpcom/base/nsConsoleService.cpp
index 7ca5144775ef..0d29a773358e 100644
--- a/xpcom/base/nsConsoleService.cpp
+++ b/xpcom/base/nsConsoleService.cpp
@@ -53,6 +53,10 @@
 #include "nsConsoleMessage.h"
 #include "nsIClassInfoImpl.h"
 
+#if defined(ANDROID)
+#include <android/log.h>
+#endif
+
 using namespace mozilla;
 
 NS_IMPL_THREADSAFE_ADDREF(nsConsoleService)
@@ -135,6 +139,16 @@ nsConsoleService::LogMessage(nsIConsoleMessage *message)
     {
         MutexAutoLock lock(mLock);
 
+#if defined(ANDROID)
+        {
+            nsXPIDLString msg;
+            message->GetMessageMoz(getter_Copies(msg));
+            __android_log_print(ANDROID_LOG_ERROR, "Gecko *** Console Service *** ",
+                        "%s",
+                        NS_LossyConvertUTF16toASCII(msg).get());
+        }
+#endif
+
         /*
          * If there's already a message in the slot we're about to replace,
          * we've wrapped around, and we need to release the old message.  We
diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
index 51467605222b..94f715e6815e 100644
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -748,7 +748,7 @@ struct nsPurpleBuffer
 private:
     struct Block {
         Block *mNext;
-        nsPurpleBufferEntry mEntries[128];
+        nsPurpleBufferEntry mEntries[255];
 
         Block() : mNext(nsnull) {}
     };
diff --git a/xpcom/base/nsSystemInfo.cpp b/xpcom/base/nsSystemInfo.cpp
index 7dedf9d6dc88..51d455c8e05e 100644
--- a/xpcom/base/nsSystemInfo.cpp
+++ b/xpcom/base/nsSystemInfo.cpp
@@ -49,7 +49,7 @@
 #include <gtk/gtk.h>
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidBridge.h"
 #endif
 
@@ -174,7 +174,7 @@ nsSystemInfo::Init()
     }
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
     if (mozilla::AndroidBridge::Bridge()) {
         nsAutoString str;
         if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "MODEL", str))
diff --git a/xpcom/build/Makefile.in b/xpcom/build/Makefile.in
index c2c1241ffdfb..c0f72397f827 100644
--- a/xpcom/build/Makefile.in
+++ b/xpcom/build/Makefile.in
@@ -125,8 +125,6 @@ EXPORTS_mozilla = \
   Omnijar.h \
   $(NULL)
 
-# Force use of PIC
-FORCE_USE_PIC	= 1 
 
 GARBAGE         += $(XPCOM_GLUE_SRC_LCPPSRCS) $(XPCOM_GLUENS_SRC_LCPPSRCS) $(wildcard *.$(OBJ_SUFFIX))
 
@@ -138,7 +136,9 @@ DEFINES		+= \
 		-D_IMPL_NS_COM \
 		-D_IMPL_NS_STRINGAPI \
 		-DEXPORT_XPT_API \
-		-DEXPORT_XPTC_API
+		-DEXPORT_XPTC_API \
+		-DOMNIJAR_NAME="$(OMNIJAR_NAME)" \
+		$(NULL)
 
 ifdef TARGET_XPCOM_ABI
 DEFINES += -DTARGET_XPCOM_ABI=\"$(TARGET_XPCOM_ABI)\"
diff --git a/xpcom/build/Omnijar.cpp b/xpcom/build/Omnijar.cpp
index d145b86d6834..9f4f951a029a 100644
--- a/xpcom/build/Omnijar.cpp
+++ b/xpcom/build/Omnijar.cpp
@@ -77,8 +77,9 @@ Omnijar::InitOne(nsIFile *aPath, Type aType)
     } else {
         nsCOMPtr<nsIFile> dir;
         nsDirectoryService::gService->Get(SPROP(aType), NS_GET_IID(nsIFile), getter_AddRefs(dir));
+        NS_NAMED_LITERAL_CSTRING (kOmnijarName, NS_STRINGIFY(OMNIJAR_NAME));
         if (NS_FAILED(dir->Clone(getter_AddRefs(file))) ||
-            NS_FAILED(file->AppendNative(NS_LITERAL_CSTRING("omni.jar"))))
+            NS_FAILED(file->AppendNative(kOmnijarName)))
             return;
     }
     bool isFile;
diff --git a/xpcom/components/Makefile.in b/xpcom/components/Makefile.in
index e47ea5134db1..3585d46b01b6 100644
--- a/xpcom/components/Makefile.in
+++ b/xpcom/components/Makefile.in
@@ -92,8 +92,6 @@ LOCAL_INCLUDES	= \
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 include $(topsrcdir)/config/rules.mk
 
 DEFINES	+= -D_IMPL_NS_COM
diff --git a/xpcom/components/ManifestParser.cpp b/xpcom/components/ManifestParser.cpp
index 4d6464cc9abe..7cb46f8b576f 100644
--- a/xpcom/components/ManifestParser.cpp
+++ b/xpcom/components/ManifestParser.cpp
@@ -52,7 +52,7 @@
 #include <gtk/gtk.h>
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidBridge.h"
 #endif
 
@@ -502,7 +502,7 @@ ParseManifestCommon(NSLocationType aType, nsILocalFile* aFile,
   nsTextFormatter::ssprintf(osVersion, NS_LITERAL_STRING("%ld.%ld").get(),
                                        gtk_major_version,
                                        gtk_minor_version);
-#elif defined(ANDROID)
+#elif defined(MOZ_WIDGET_ANDROID)
   if (mozilla::AndroidBridge::Bridge()) {
     mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build$VERSION", "RELEASE", osVersion);
   }
diff --git a/xpcom/components/nsComponentManager.cpp b/xpcom/components/nsComponentManager.cpp
index 8b6cc0b3c964..adf65822b829 100644
--- a/xpcom/components/nsComponentManager.cpp
+++ b/xpcom/components/nsComponentManager.cpp
@@ -550,7 +550,8 @@ nsComponentManagerImpl::RegisterJarManifest(NSLocationType aType, nsIZipReader*
 {
     nsCOMPtr<nsIInputStream> is = LoadEntry(aReader, aPath);
     if (!is) {
-        LogMessage("Could not find jar manifest entry '%s'.", aPath);
+        if (NS_BOOTSTRAPPED_LOCATION != aType)
+            LogMessage("Could not find jar manifest entry '%s'.", aPath);
         return;
     }
 
@@ -619,7 +620,8 @@ nsComponentManagerImpl::RegisterManifestFile(NSLocationType aType,
     if (NS_FAILED(rv)) {
         nsCAutoString path;
         aFile->GetNativePath(path);
-        LogMessage("Could not read chrome manifest file '%s'.", path.get());
+        if (NS_BOOTSTRAPPED_LOCATION != aType)
+            LogMessage("Could not read chrome manifest file '%s'.", path.get());
         return;
     }
 
diff --git a/xpcom/ds/Makefile.in b/xpcom/ds/Makefile.in
index 7e8c1354bc14..f1b65dba5ad0 100644
--- a/xpcom/ds/Makefile.in
+++ b/xpcom/ds/Makefile.in
@@ -162,8 +162,6 @@ EXTRA_COMPONENTS = \
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/xpcom/glue/Makefile.in b/xpcom/glue/Makefile.in
index 2a5b78d60d49..77fc6cb4a2ce 100644
--- a/xpcom/glue/Makefile.in
+++ b/xpcom/glue/Makefile.in
@@ -145,8 +145,6 @@ SDK_LIBRARY     =                        \
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 # Pretend we're statically linking the CRT, even though we might not be: this
 # avoids "msvcrp" and assembly dependencies from creeping into the directives
diff --git a/xpcom/glue/nomozalloc/Makefile.in b/xpcom/glue/nomozalloc/Makefile.in
index e190e27f3228..28267f394b34 100644
--- a/xpcom/glue/nomozalloc/Makefile.in
+++ b/xpcom/glue/nomozalloc/Makefile.in
@@ -70,8 +70,6 @@ GARBAGE += $(CPPSRCS) DeadlockDetector.h SSE.h arm.h
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 # Pretend we're statically linking the CRT, even though we might not be: this
 # avoids "msvcrp" and assembly dependencies from creeping into the directives
diff --git a/xpcom/glue/nsTArray.h b/xpcom/glue/nsTArray.h
index 83d8a2326396..c4212c9a8bdc 100644
--- a/xpcom/glue/nsTArray.h
+++ b/xpcom/glue/nsTArray.h
@@ -442,6 +442,7 @@ public:
   typedef nsTArray_SafeElementAtHelper<E, self_type> safeelementat_helper_type;
 
   using safeelementat_helper_type::SafeElementAt;
+  using base_type::EmptyHdr;
 
   // A special value that is used to indicate an invalid or unknown index
   // into the array.
@@ -515,10 +516,13 @@ public:
   }
 
   // @return The amount of memory taken used by this nsTArray, not including
-  // sizeof(this)
+  // sizeof(*this).
   size_t SizeOf() const {
-    return this->UsesAutoArrayBuffer() ?
-      0 : this->Capacity() * sizeof(elem_type) + sizeof(*this->Hdr());
+    if (this->UsesAutoArrayBuffer() || Hdr() == EmptyHdr())
+      return 0;
+    size_t usable = moz_malloc_usable_size(this->Hdr());
+    return usable ? usable : 
+      this->Capacity() * sizeof(elem_type) + sizeof(*this->Hdr());
   }
 
   //
diff --git a/xpcom/glue/standalone/Makefile.in b/xpcom/glue/standalone/Makefile.in
index 8c414ae55ea0..90cfbf9cee86 100644
--- a/xpcom/glue/standalone/Makefile.in
+++ b/xpcom/glue/standalone/Makefile.in
@@ -94,8 +94,6 @@ SDK_LIBRARY     	= \
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 # Pretend we're statically linking the CRT, even though we might not be: this
 # avoids "msvcrp" and assembly dependencies from creeping into the directives
diff --git a/xpcom/io/Makefile.in b/xpcom/io/Makefile.in
index 94b364efcbb7..b1bd18defcde 100644
--- a/xpcom/io/Makefile.in
+++ b/xpcom/io/Makefile.in
@@ -181,8 +181,6 @@ EXPORTS		:= $(addprefix $(srcdir)/, $(EXPORTS))
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 include $(topsrcdir)/config/rules.mk
 include $(topsrcdir)/ipc/chromium/chromium-config.mk
diff --git a/xpcom/io/nsLocalFileUnix.cpp b/xpcom/io/nsLocalFileUnix.cpp
index 8554f23392bc..9f51762b6410 100644
--- a/xpcom/io/nsLocalFileUnix.cpp
+++ b/xpcom/io/nsLocalFileUnix.cpp
@@ -113,7 +113,7 @@ static nsresult MacErrorMapper(OSErr inErr);
 #include <libosso.h>
 #endif
 
-#ifdef ANDROID
+#ifdef MOZ_WIDGET_ANDROID
 #include "AndroidBridge.h"
 #include "nsIMIMEService.h"
 #include <linux/magic.h>
@@ -1885,7 +1885,7 @@ nsLocalFile::Launch()
     }
 
     return NS_ERROR_FAILURE;
-#elif defined(ANDROID)
+#elif defined(MOZ_WIDGET_ANDROID)
     // Try to get a mimetype, if this fails just use the file uri alone
     nsresult rv;
     nsCAutoString type;
diff --git a/xpcom/proxy/src/Makefile.in b/xpcom/proxy/src/Makefile.in
index 59a3b42c4efa..bdaf69707543 100644
--- a/xpcom/proxy/src/Makefile.in
+++ b/xpcom/proxy/src/Makefile.in
@@ -60,8 +60,6 @@ LOCAL_INCLUDES += -I$(top_srcdir)/xpcom/threads/
 # No shared lib; Force creation of static lib
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/xpcom/reflect/xptcall/src/Makefile.in b/xpcom/reflect/xptcall/src/Makefile.in
index f2a772f053c6..3f6b4fd37c2c 100644
--- a/xpcom/reflect/xptcall/src/Makefile.in
+++ b/xpcom/reflect/xptcall/src/Makefile.in
@@ -54,8 +54,6 @@ CPPSRCS		= xptcall.cpp
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/xpcom/reflect/xptcall/src/md/os2/Makefile.in b/xpcom/reflect/xptcall/src/md/os2/Makefile.in
index e755eb74dfc8..67f2e02c791b 100644
--- a/xpcom/reflect/xptcall/src/md/os2/Makefile.in
+++ b/xpcom/reflect/xptcall/src/md/os2/Makefile.in
@@ -57,8 +57,6 @@ LOCAL_INCLUDES = \
 		$(NULL)
 DEFINES		+= -DMOZ_NEED_LEADING_UNDERSCORE
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 include $(topsrcdir)/config/config.mk
 
diff --git a/xpcom/reflect/xptcall/src/md/unix/Makefile.in b/xpcom/reflect/xptcall/src/md/unix/Makefile.in
index 6c508213e48a..747a3d0c1bd2 100644
--- a/xpcom/reflect/xptcall/src/md/unix/Makefile.in
+++ b/xpcom/reflect/xptcall/src/md/unix/Makefile.in
@@ -53,8 +53,6 @@ MOZILLA_INTERNAL_API = 1
 #
 CPPSRCS = $(error XPTCall not implemented on this platform!)
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 ifeq ($(OS_ARCH),SunOS)
 ifneq (86,$(findstring 86,$(OS_TEST)))
diff --git a/xpcom/reflect/xptcall/src/md/win32/Makefile.in b/xpcom/reflect/xptcall/src/md/win32/Makefile.in
index b6df7e98754c..fdbc0b998951 100644
--- a/xpcom/reflect/xptcall/src/md/win32/Makefile.in
+++ b/xpcom/reflect/xptcall/src/md/win32/Makefile.in
@@ -73,8 +73,6 @@ endif
 
 LOCAL_INCLUDES += -I$(srcdir)/../../../../xptinfo/src
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 include $(topsrcdir)/config/config.mk
 
diff --git a/xpcom/reflect/xptinfo/src/Makefile.in b/xpcom/reflect/xptinfo/src/Makefile.in
index 84a572d01c31..74392dfed7c3 100644
--- a/xpcom/reflect/xptinfo/src/Makefile.in
+++ b/xpcom/reflect/xptinfo/src/Makefile.in
@@ -57,8 +57,6 @@ CPPSRCS		= \
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/xpcom/string/src/Makefile.in b/xpcom/string/src/Makefile.in
index 74c95234a9e5..47a7a2448c7b 100644
--- a/xpcom/string/src/Makefile.in
+++ b/xpcom/string/src/Makefile.in
@@ -67,8 +67,6 @@ CPPSRCS		=				\
 # static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 # Are we targeting x86 or x86-64?  If so, compile the SSE2 functions for
 # nsUTF8Utils.cpp.
diff --git a/xpcom/stub/Makefile.in b/xpcom/stub/Makefile.in
index 276cec7ed71a..8a5675aa37da 100644
--- a/xpcom/stub/Makefile.in
+++ b/xpcom/stub/Makefile.in
@@ -67,8 +67,6 @@ else
 SDK_LIBRARY = $(SHARED_LIBRARY)
 endif
 
-# Force use of PIC
-FORCE_USE_PIC	= 1 
 
 FORCE_SHARED_LIB = 1
 
diff --git a/xpcom/threads/Makefile.in b/xpcom/threads/Makefile.in
index 82214d2ab786..aa444fb583e9 100644
--- a/xpcom/threads/Makefile.in
+++ b/xpcom/threads/Makefile.in
@@ -86,8 +86,6 @@ LOCAL_INCLUDES	= -I$(srcdir)/../components
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/xpcom/typelib/xpt/src/Makefile.in b/xpcom/typelib/xpt/src/Makefile.in
index 0c975e5b5460..6849b027808d 100644
--- a/xpcom/typelib/xpt/src/Makefile.in
+++ b/xpcom/typelib/xpt/src/Makefile.in
@@ -58,8 +58,6 @@ HOST_CSRCS	= $(CSRCS)
 FORCE_STATIC_LIB = 1
 USE_STATIC_LIBS = 1
 
-# Force use of PIC
-FORCE_USE_PIC	= 1
 
 # Don't use profile-guided optimization
 NO_PROFILE_GUIDED_OPTIMIZE = 1
diff --git a/xpfe/appshell/src/nsChromeTreeOwner.cpp b/xpfe/appshell/src/nsChromeTreeOwner.cpp
index 69f433e6ef50..89170e4fc401 100644
--- a/xpfe/appshell/src/nsChromeTreeOwner.cpp
+++ b/xpfe/appshell/src/nsChromeTreeOwner.cpp
@@ -535,7 +535,8 @@ nsChromeTreeOwner::OnStateChange(nsIWebProgress* aWebProgress,
 
 NS_IMETHODIMP nsChromeTreeOwner::OnLocationChange(nsIWebProgress* aWebProgress,
                                                   nsIRequest* aRequest,
-                                                  nsIURI* aLocation)
+                                                  nsIURI* aLocation,
+                                                  PRUint32 aFlags)
 {
   bool itsForYou = true;
 
diff --git a/xpfe/appshell/src/nsWebShellWindow.cpp b/xpfe/appshell/src/nsWebShellWindow.cpp
index cf96a89ac324..73bb7b465f8e 100644
--- a/xpfe/appshell/src/nsWebShellWindow.cpp
+++ b/xpfe/appshell/src/nsWebShellWindow.cpp
@@ -320,8 +320,7 @@ nsWebShellWindow::HandleEvent(nsGUIEvent *aEvent)
       case NS_MOVE: {
         // Adjust any child popups so that their widget offsets and coordinates
         // are correct with respect to the new position of the window
-        nsCOMPtr<nsIMenuRollup> pm =
-          do_GetService("@mozilla.org/xul/xul-popup-manager;1");
+        nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
         if (pm) {
           nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(docShell);
           pm->AdjustPopupsOnWindowChange(window);
@@ -333,8 +332,7 @@ nsWebShellWindow::HandleEvent(nsGUIEvent *aEvent)
         break;
       }
       case NS_SIZE: {
-        nsCOMPtr<nsIMenuRollup> pm =
-          do_GetService("@mozilla.org/xul/xul-popup-manager;1");
+        nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
         if (pm) {
           nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(docShell);
           pm->AdjustPopupsOnWindowChange(window);
@@ -597,7 +595,8 @@ nsWebShellWindow::OnStateChange(nsIWebProgress *aProgress,
 NS_IMETHODIMP
 nsWebShellWindow::OnLocationChange(nsIWebProgress *aProgress,
                                    nsIRequest *aRequest,
-                                   nsIURI *aURI)
+                                   nsIURI *aURI,
+                                   PRUint32 aFlags)
 {
   NS_NOTREACHED("notification excluded in AddProgressListener(...)");
   return NS_OK;