diff --git a/configure.in b/configure.in
index d91d92e94d3a..7cdf8e5624cc 100644
--- a/configure.in
+++ b/configure.in
@@ -7798,6 +7798,25 @@ AC_SUBST(PROFILE_GEN_LDFLAGS)
 AC_SUBST(PROFILE_USE_CFLAGS)
 AC_SUBST(PROFILE_USE_LDFLAGS)
 
+dnl =============================================
+dnl Support for -fno-integrated-as (recent clang)
+dnl =============================================
+dnl Under clang 3.4+, use -fno-integrated-as to
+dnl build libvpx's vp8_asm_enc_offsets.c
+
+_SAVE_CFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -fno-integrated-as"
+
+AC_MSG_CHECKING([whether C compiler supports -fno-integrated-as])
+AC_TRY_COMPILE([], [return 0;],
+               [ NO_INTEGRATED_AS_CFLAGS="-fno-integrated-as"
+                 result="yes" ], result="no")
+AC_MSG_RESULT([$result])
+
+CFLAGS="$_SAVE_CFLAGS"
+
+AC_SUBST(NO_INTEGRATED_AS_CFLAGS)
+
 fi # ! SKIP_COMPILER_CHECKS
 
 AC_DEFINE(CPP_THROW_NEW, [throw()])
diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
index 9259c24482e3..64f5484ce983 100644
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -66,6 +66,7 @@ class nsIStyleRule;
 class nsIStyleSheet;
 class nsIURI;
 class nsIVariant;
+class nsLocation;
 class nsViewManager;
 class nsPresContext;
 class nsRange;
@@ -2184,7 +2185,7 @@ public:
                       const nsAString& aQualifiedName,
                       mozilla::ErrorResult& rv);
   void GetInputEncoding(nsAString& aInputEncoding);
-  already_AddRefed<nsIDOMLocation> GetLocation() const;
+  already_AddRefed<nsLocation> GetLocation() const;
   void GetReferrer(nsAString& aReferrer) const;
   void GetLastModified(nsAString& aLastModified) const;
   void GetReadyState(nsAString& aReadyState) const;
diff --git a/content/base/src/Link.cpp b/content/base/src/Link.cpp
index d5994b6cbed5..21f10cf3c1df 100644
--- a/content/base/src/Link.cpp
+++ b/content/base/src/Link.cpp
@@ -128,7 +128,7 @@ Link::GetURI() const
 }
 
 void
-Link::SetProtocol(const nsAString &aProtocol)
+Link::SetProtocol(const nsAString &aProtocol, ErrorResult& aError)
 {
   nsCOMPtr<nsIURI> uri(GetURIToMutate());
   if (!uri) {
@@ -147,7 +147,7 @@ Link::SetProtocol(const nsAString &aProtocol)
 }
 
 void
-Link::SetPassword(const nsAString &aPassword)
+Link::SetPassword(const nsAString &aPassword, ErrorResult& aError)
 {
   nsCOMPtr<nsIURI> uri(GetURIToMutate());
   if (!uri) {
@@ -160,7 +160,7 @@ Link::SetPassword(const nsAString &aPassword)
 }
 
 void
-Link::SetUsername(const nsAString &aUsername)
+Link::SetUsername(const nsAString &aUsername, ErrorResult& aError)
 {
   nsCOMPtr<nsIURI> uri(GetURIToMutate());
   if (!uri) {
@@ -173,7 +173,7 @@ Link::SetUsername(const nsAString &aUsername)
 }
 
 void
-Link::SetHost(const nsAString &aHost)
+Link::SetHost(const nsAString &aHost, ErrorResult& aError)
 {
   nsCOMPtr<nsIURI> uri(GetURIToMutate());
   if (!uri) {
@@ -186,7 +186,7 @@ Link::SetHost(const nsAString &aHost)
 }
 
 void
-Link::SetHostname(const nsAString &aHostname)
+Link::SetHostname(const nsAString &aHostname, ErrorResult& aError)
 {
   nsCOMPtr<nsIURI> uri(GetURIToMutate());
   if (!uri) {
@@ -199,7 +199,7 @@ Link::SetHostname(const nsAString &aHostname)
 }
 
 void
-Link::SetPathname(const nsAString &aPathname)
+Link::SetPathname(const nsAString &aPathname, ErrorResult& aError)
 {
   nsCOMPtr<nsIURI> uri(GetURIToMutate());
   nsCOMPtr<nsIURL> url(do_QueryInterface(uri));
@@ -213,7 +213,7 @@ Link::SetPathname(const nsAString &aPathname)
 }
 
 void
-Link::SetSearch(const nsAString& aSearch)
+Link::SetSearch(const nsAString& aSearch, ErrorResult& aError)
 {
   SetSearchInternal(aSearch);
   UpdateURLSearchParams();
@@ -234,7 +234,7 @@ Link::SetSearchInternal(const nsAString& aSearch)
 }
 
 void
-Link::SetPort(const nsAString &aPort)
+Link::SetPort(const nsAString &aPort, ErrorResult& aError)
 {
   nsCOMPtr<nsIURI> uri(GetURIToMutate());
   if (!uri) {
@@ -259,7 +259,7 @@ Link::SetPort(const nsAString &aPort)
 }
 
 void
-Link::SetHash(const nsAString &aHash)
+Link::SetHash(const nsAString &aHash, ErrorResult& aError)
 {
   nsCOMPtr<nsIURI> uri(GetURIToMutate());
   if (!uri) {
@@ -272,7 +272,7 @@ Link::SetHash(const nsAString &aHash)
 }
 
 void
-Link::GetOrigin(nsAString &aOrigin)
+Link::GetOrigin(nsAString &aOrigin, ErrorResult& aError)
 {
   aOrigin.Truncate();
 
@@ -287,7 +287,7 @@ Link::GetOrigin(nsAString &aOrigin)
 }
 
 void
-Link::GetProtocol(nsAString &_protocol)
+Link::GetProtocol(nsAString &_protocol, ErrorResult& aError)
 {
   nsCOMPtr<nsIURI> uri(GetURI());
   if (!uri) {
@@ -303,7 +303,7 @@ Link::GetProtocol(nsAString &_protocol)
 }
 
 void
-Link::GetUsername(nsAString& aUsername)
+Link::GetUsername(nsAString& aUsername, ErrorResult& aError)
 {
   aUsername.Truncate();
 
@@ -318,7 +318,7 @@ Link::GetUsername(nsAString& aUsername)
 }
 
 void
-Link::GetPassword(nsAString &aPassword)
+Link::GetPassword(nsAString &aPassword, ErrorResult& aError)
 {
   aPassword.Truncate();
 
@@ -333,7 +333,7 @@ Link::GetPassword(nsAString &aPassword)
 }
 
 void
-Link::GetHost(nsAString &_host)
+Link::GetHost(nsAString &_host, ErrorResult& aError)
 {
   _host.Truncate();
 
@@ -351,7 +351,7 @@ Link::GetHost(nsAString &_host)
 }
 
 void
-Link::GetHostname(nsAString &_hostname)
+Link::GetHostname(nsAString &_hostname, ErrorResult& aError)
 {
   _hostname.Truncate();
 
@@ -371,7 +371,7 @@ Link::GetHostname(nsAString &_hostname)
 }
 
 void
-Link::GetPathname(nsAString &_pathname)
+Link::GetPathname(nsAString &_pathname, ErrorResult& aError)
 {
   _pathname.Truncate();
 
@@ -391,7 +391,7 @@ Link::GetPathname(nsAString &_pathname)
 }
 
 void
-Link::GetSearch(nsAString &_search)
+Link::GetSearch(nsAString &_search, ErrorResult& aError)
 {
   _search.Truncate();
 
@@ -411,7 +411,7 @@ Link::GetSearch(nsAString &_search)
 }
 
 void
-Link::GetPort(nsAString &_port)
+Link::GetPort(nsAString &_port, ErrorResult& aError)
 {
   _port.Truncate();
 
@@ -433,7 +433,7 @@ Link::GetPort(nsAString &_port)
 }
 
 void
-Link::GetHash(nsAString &_hash)
+Link::GetHash(nsAString &_hash, ErrorResult& aError)
 {
   _hash.Truncate();
 
diff --git a/content/base/src/Link.h b/content/base/src/Link.h
index c378ddde085e..9ade6e495275 100644
--- a/content/base/src/Link.h
+++ b/content/base/src/Link.h
@@ -57,27 +57,27 @@ public:
   /**
    * Helper methods for modifying and obtaining parts of the URI of the Link.
    */
-  void SetProtocol(const nsAString &aProtocol);
-  void SetUsername(const nsAString &aUsername);
-  void SetPassword(const nsAString &aPassword);
-  void SetHost(const nsAString &aHost);
-  void SetHostname(const nsAString &aHostname);
-  void SetPathname(const nsAString &aPathname);
-  void SetSearch(const nsAString &aSearch);
+  void SetProtocol(const nsAString &aProtocol, ErrorResult& aError);
+  void SetUsername(const nsAString &aUsername, ErrorResult& aError);
+  void SetPassword(const nsAString &aPassword, ErrorResult& aError);
+  void SetHost(const nsAString &aHost, ErrorResult& aError);
+  void SetHostname(const nsAString &aHostname, ErrorResult& aError);
+  void SetPathname(const nsAString &aPathname, ErrorResult& aError);
+  void SetSearch(const nsAString &aSearch, ErrorResult& aError);
   void SetSearchParams(mozilla::dom::URLSearchParams& aSearchParams);
-  void SetPort(const nsAString &aPort);
-  void SetHash(const nsAString &aHash);
-  void GetOrigin(nsAString &aOrigin);
-  void GetProtocol(nsAString &_protocol);
-  void GetUsername(nsAString &aUsername);
-  void GetPassword(nsAString &aPassword);
-  void GetHost(nsAString &_host);
-  void GetHostname(nsAString &_hostname);
-  void GetPathname(nsAString &_pathname);
-  void GetSearch(nsAString &_search);
+  void SetPort(const nsAString &aPort, ErrorResult& aError);
+  void SetHash(const nsAString &aHash, ErrorResult& aError);
+  void GetOrigin(nsAString &aOrigin, ErrorResult& aError);
+  void GetProtocol(nsAString &_protocol, ErrorResult& aError);
+  void GetUsername(nsAString &aUsername, ErrorResult& aError);
+  void GetPassword(nsAString &aPassword, ErrorResult& aError);
+  void GetHost(nsAString &_host, ErrorResult& aError);
+  void GetHostname(nsAString &_hostname, ErrorResult& aError);
+  void GetPathname(nsAString &_pathname, ErrorResult& aError);
+  void GetSearch(nsAString &_search, ErrorResult& aError);
   URLSearchParams* SearchParams();
-  void GetPort(nsAString &_port);
-  void GetHash(nsAString &_hash);
+  void GetPort(nsAString &_port, ErrorResult& aError);
+  void GetHash(nsAString &_hash, ErrorResult& aError);
 
   /**
    * Invalidates any link caching, and resets the state to the default.
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 839e4de5d02b..ecd2b82af969 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -223,6 +223,7 @@
 #include "nsContentPermissionHelper.h"
 #include "mozilla/dom/DOMStringList.h"
 #include "nsWindowMemoryReporter.h"
+#include "nsLocation.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -6546,7 +6547,7 @@ nsDocument::GetLocation(nsIDOMLocation **_retval)
   return NS_OK;
 }
 
-already_AddRefed<nsIDOMLocation>
+already_AddRefed<nsLocation>
 nsIDocument::GetLocation() const
 {
   nsCOMPtr<nsIDOMWindow> w = do_QueryInterface(mScriptGlobalObject);
@@ -6557,7 +6558,7 @@ nsIDocument::GetLocation() const
 
   nsCOMPtr<nsIDOMLocation> loc;
   w->GetLocation(getter_AddRefs(loc));
-  return loc.forget();
+  return loc.forget().downcast<nsLocation>();
 }
 
 Element*
diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp
index 623d114ca6aa..c0bde17a4983 100644
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -367,7 +367,7 @@ public:
                                          mCtx->CurrentState().op);
   }
 
-  operator DrawTarget*() 
+  operator DrawTarget*()
   {
     return mTarget;
   }
@@ -944,7 +944,8 @@ CanvasRenderingContext2D::EnsureTarget()
         if (glue && glue->GetGrContext() && glue->GetGLContext()) {
           mTarget = Factory::CreateDrawTargetSkiaWithGrContext(glue->GetGrContext(), size, format);
           if (mTarget) {
-            mStream = gfx::SurfaceStream::CreateForType(SurfaceStreamType::TripleBuffer, glue->GetGLContext());
+            mStream = gl::SurfaceStream::CreateForType(gl::SurfaceStreamType::TripleBuffer,
+                                                       glue->GetGLContext());
             AddDemotableContext(this);
           } else {
             printf_stderr("Failed to create a SkiaGL DrawTarget, falling back to software\n");
@@ -2526,7 +2527,7 @@ CanvasRenderingContext2D::AddHitRegion(const HitRegionOptions& options, ErrorRes
                                 nsINode::DeleteProperty<bool>);
 #endif
   }
-  
+
   // finally, add the region to the list
   RegionInfo info;
   info.mId = options.mId;
@@ -3468,7 +3469,7 @@ CanvasRenderingContext2D::DrawDirectlyToCanvas(
 
   nsRefPtr<gfxContext> context = new gfxContext(tempTarget);
   context->SetMatrix(contextMatrix);
-  
+
   // FLAG_CLAMP is added for increased performance
   uint32_t modifiedFlags = image.mDrawingFlags | imgIContainer::FLAG_CLAMP;
 
diff --git a/content/canvas/src/CanvasRenderingContext2D.h b/content/canvas/src/CanvasRenderingContext2D.h
index 5c7b8dacf49f..9f9d784bfedc 100644
--- a/content/canvas/src/CanvasRenderingContext2D.h
+++ b/content/canvas/src/CanvasRenderingContext2D.h
@@ -30,7 +30,7 @@ class nsGlobalWindow;
 class nsXULElement;
 
 namespace mozilla {
-namespace gfx {
+namespace gl {
 class SourceSurface;
 class SurfaceStream;
 }
@@ -393,21 +393,21 @@ public:
            double endAngle, bool anticlockwise, mozilla::ErrorResult& error);
 
   void GetMozCurrentTransform(JSContext* cx,
-			      JS::MutableHandle<JSObject*> result,
-			      mozilla::ErrorResult& error) const;
+                              JS::MutableHandle<JSObject*> result,
+                              mozilla::ErrorResult& error) const;
   void SetMozCurrentTransform(JSContext* cx,
                               JS::Handle<JSObject*> currentTransform,
                               mozilla::ErrorResult& error);
   void GetMozCurrentTransformInverse(JSContext* cx,
-				     JS::MutableHandle<JSObject*> result,
-				     mozilla::ErrorResult& error) const;
+                                     JS::MutableHandle<JSObject*> result,
+                                     mozilla::ErrorResult& error) const;
   void SetMozCurrentTransformInverse(JSContext* cx,
                                      JS::Handle<JSObject*> currentTransform,
                                      mozilla::ErrorResult& error);
   void GetFillRule(nsAString& fillRule);
   void SetFillRule(const nsAString& fillRule);
   void GetMozDash(JSContext* cx, JS::MutableHandle<JS::Value> retval,
-		  mozilla::ErrorResult& error);
+                  mozilla::ErrorResult& error);
   void SetMozDash(JSContext* cx, const JS::Value& mozDash,
                   mozilla::ErrorResult& error);
 
@@ -661,7 +661,7 @@ protected:
 
   void DrawImage(const HTMLImageOrCanvasOrVideoElement &imgElt,
                  double sx, double sy, double sw, double sh,
-                 double dx, double dy, double dw, double dh, 
+                 double dx, double dy, double dw, double dh,
                  uint8_t optional_argc, mozilla::ErrorResult& error);
 
   void DrawDirectlyToCanvas(const nsLayoutUtils::DirectDrawInfo& image,
@@ -711,7 +711,7 @@ protected:
   // sErrorTarget.
   mozilla::RefPtr<mozilla::gfx::DrawTarget> mTarget;
 
-  RefPtr<gfx::SurfaceStream> mStream;
+  RefPtr<gl::SurfaceStream> mStream;
 
   /**
     * Flag to avoid duplicate calls to InvalidateFrame. Set to true whenever
@@ -789,7 +789,7 @@ protected:
 
     // The spec says we should not draw shadows if the operator is OVER.
     // If it's over and the alpha value is zero, nothing needs to be drawn.
-    return NS_GET_A(state.shadowColor) != 0 && 
+    return NS_GET_A(state.shadowColor) != 0 &&
       (state.shadowBlur != 0 || state.shadowOffset.x != 0 || state.shadowOffset.y != 0);
   }
 
diff --git a/content/canvas/src/WebGLContextDraw.cpp b/content/canvas/src/WebGLContextDraw.cpp
index 0d70767f6463..d4854aaf5402 100644
--- a/content/canvas/src/WebGLContextDraw.cpp
+++ b/content/canvas/src/WebGLContextDraw.cpp
@@ -450,7 +450,17 @@ WebGLContext::ValidateBufferFetching(const char *info)
             maxVertices = std::min(maxVertices, checked_maxAllowedCount.value());
             hasPerVertex = true;
         } else {
-            maxInstances = std::min(maxInstances, checked_maxAllowedCount.value() / vd.divisor);
+            CheckedUint32 checked_curMaxInstances = checked_maxAllowedCount * vd.divisor;
+
+            uint32_t curMaxInstances = UINT32_MAX;
+            // If this isn't valid, it's because we overflowed our
+            // uint32 above. Just leave this as UINT32_MAX, since
+            // sizeof(uint32) becomes our limiting factor.
+            if (checked_curMaxInstances.isValid()) {
+                curMaxInstances = checked_curMaxInstances.value();
+            }
+
+            maxInstances = std::min(maxInstances, curMaxInstances);
         }
     }
 
diff --git a/content/html/content/public/HTMLAudioElement.h b/content/html/content/public/HTMLAudioElement.h
index 4beac8c8fa00..ba06f2f899de 100644
--- a/content/html/content/public/HTMLAudioElement.h
+++ b/content/html/content/public/HTMLAudioElement.h
@@ -7,7 +7,6 @@
 #define mozilla_dom_HTMLAudioElement_h
 
 #include "mozilla/Attributes.h"
-#include "nsIDOMHTMLAudioElement.h"
 #include "mozilla/dom/HTMLMediaElement.h"
 #include "mozilla/dom/TypedArray.h"
 
@@ -17,21 +16,18 @@ typedef uint16_t nsMediaReadyState;
 namespace mozilla {
 namespace dom {
 
-class HTMLAudioElement MOZ_FINAL : public HTMLMediaElement,
-                                   public nsIDOMHTMLAudioElement
+class HTMLAudioElement MOZ_FINAL : public HTMLMediaElement
 {
 public:
-  HTMLAudioElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  typedef mozilla::dom::NodeInfo NodeInfo;
 
-  // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
+  HTMLAudioElement(already_AddRefed<NodeInfo>& aNodeInfo);
 
   // nsIDOMHTMLMediaElement
   using HTMLMediaElement::GetPaused;
-  NS_FORWARD_NSIDOMHTMLMEDIAELEMENT(HTMLMediaElement::)
 
-  virtual nsresult Clone(mozilla::dom::NodeInfo *aNodeInfo, nsINode **aResult) const;
-  virtual nsresult SetAcceptHeader(nsIHttpChannel* aChannel);
+  virtual nsresult Clone(NodeInfo *aNodeInfo, nsINode **aResult) const MOZ_OVERRIDE;
+  virtual nsresult SetAcceptHeader(nsIHttpChannel* aChannel) MOZ_OVERRIDE;
 
   virtual nsIDOMNode* AsDOMNode() MOZ_OVERRIDE { return this; }
 
diff --git a/content/html/content/public/HTMLMediaElement.h b/content/html/content/public/HTMLMediaElement.h
index cde2717092c5..9bb7726a4232 100644
--- a/content/html/content/public/HTMLMediaElement.h
+++ b/content/html/content/public/HTMLMediaElement.h
@@ -72,6 +72,7 @@ class AudioTrackList;
 class VideoTrackList;
 
 class HTMLMediaElement : public nsGenericHTMLElement,
+                         public nsIDOMHTMLMediaElement,
                          public nsIObserver,
                          public MediaDecoderOwner,
                          public nsIAudioChannelAgentCallback
diff --git a/content/html/content/public/HTMLVideoElement.h b/content/html/content/public/HTMLVideoElement.h
index 80843332ce0d..c62aad859414 100644
--- a/content/html/content/public/HTMLVideoElement.h
+++ b/content/html/content/public/HTMLVideoElement.h
@@ -8,7 +8,6 @@
 #define mozilla_dom_HTMLVideoElement_h
 
 #include "mozilla/Attributes.h"
-#include "nsIDOMHTMLVideoElement.h"
 #include "mozilla/dom/HTMLMediaElement.h"
 
 namespace mozilla {
@@ -17,41 +16,38 @@ namespace dom {
 class WakeLock;
 class VideoPlaybackQuality;
 
-class HTMLVideoElement MOZ_FINAL : public HTMLMediaElement,
-                                   public nsIDOMHTMLVideoElement
+class HTMLVideoElement MOZ_FINAL : public HTMLMediaElement
 {
 public:
-  HTMLVideoElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  typedef mozilla::dom::NodeInfo NodeInfo;
+
+  HTMLVideoElement(already_AddRefed<NodeInfo>& aNodeInfo);
 
   NS_IMPL_FROMCONTENT_HTML_WITH_TAG(HTMLVideoElement, video)
 
-  // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
-
-  // nsIDOMHTMLMediaElement
   using HTMLMediaElement::GetPaused;
-  NS_FORWARD_NSIDOMHTMLMEDIAELEMENT(HTMLMediaElement::)
 
-  // nsIDOMHTMLVideoElement
-  NS_DECL_NSIDOMHTMLVIDEOELEMENT
+  NS_IMETHOD_(bool) IsVideo() MOZ_OVERRIDE {
+    return true;
+  }
 
   virtual bool ParseAttribute(int32_t aNamespaceID,
-                                nsIAtom* aAttribute,
-                                const nsAString& aValue,
-                                nsAttrValue& aResult);
+                              nsIAtom* aAttribute,
+                              const nsAString& aValue,
+                              nsAttrValue& aResult) MOZ_OVERRIDE;
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const MOZ_OVERRIDE;
 
   static void Init();
 
   virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const MOZ_OVERRIDE;
 
-  virtual nsresult Clone(mozilla::dom::NodeInfo *aNodeInfo, nsINode **aResult) const MOZ_OVERRIDE;
+  virtual nsresult Clone(NodeInfo *aNodeInfo, nsINode **aResult) const MOZ_OVERRIDE;
 
   // Set size with the current video frame's height and width.
   // If there is no video frame, returns NS_ERROR_FAILURE.
   nsresult GetVideoSize(nsIntSize* size);
 
-  virtual nsresult SetAcceptHeader(nsIHttpChannel* aChannel);
+  virtual nsresult SetAcceptHeader(nsIHttpChannel* aChannel) MOZ_OVERRIDE;
 
   // WebIDL
 
@@ -85,7 +81,10 @@ public:
     return mMediaSize.height == -1 ? 0 : mMediaSize.height;
   }
 
-  // XPCOM GetPoster is OK
+  void GetPoster(nsAString& aValue)
+  {
+    GetURIAttr(nsGkAtoms::poster, nullptr, aValue);
+  }
   void SetPoster(const nsAString& aValue, ErrorResult& aRv)
   {
     SetHTMLAttr(nsGkAtoms::poster, aValue, aRv);
diff --git a/content/html/content/src/HTMLAnchorElement.cpp b/content/html/content/src/HTMLAnchorElement.cpp
index 860fd5d8113e..ceb36a23ed70 100644
--- a/content/html/content/src/HTMLAnchorElement.cpp
+++ b/content/html/content/src/HTMLAnchorElement.cpp
@@ -300,13 +300,17 @@ HTMLAnchorElement::RelList()
   NS_IMETHODIMP                                              \
   HTMLAnchorElement::Get##_part(nsAString& a##_part)         \
   {                                                          \
-    Link::Get##_part(a##_part);                              \
+    ErrorResult rv;                                          \
+    Link::Get##_part(a##_part, rv);                          \
+    MOZ_ASSERT(!rv.Failed());                                \
     return NS_OK;                                            \
   }                                                          \
   NS_IMETHODIMP                                              \
   HTMLAnchorElement::Set##_part(const nsAString& a##_part)   \
   {                                                          \
-    Link::Set##_part(a##_part);                              \
+    ErrorResult rv;                                          \
+    Link::Set##_part(a##_part, rv);                          \
+    MOZ_ASSERT(!rv.Failed());                                \
     return NS_OK;                                            \
   }
 
diff --git a/content/html/content/src/HTMLAnchorElement.h b/content/html/content/src/HTMLAnchorElement.h
index 5d86f52ff704..9a0d4e24d947 100644
--- a/content/html/content/src/HTMLAnchorElement.h
+++ b/content/html/content/src/HTMLAnchorElement.h
@@ -86,7 +86,7 @@ public:
   virtual bool HasDeferredDNSPrefetchRequest();
 
   // WebIDL API
-  void GetHref(nsString& aValue)
+  void GetHref(nsAString& aValue, ErrorResult& rv)
   {
     GetHTMLURIAttr(nsGkAtoms::href, aValue);
   }
@@ -145,11 +145,32 @@ public:
 
   // Link::GetOrigin is OK for us
 
+  using Link::GetProtocol;
+  using Link::SetProtocol;
+
   // Link::GetUsername is OK for us
   // Link::SetUsername is OK for us
 
-  // Link::Getpassword is OK for us
-  // Link::Setpassword is OK for us
+  // Link::GetPassword is OK for us
+  // Link::SetPassword is OK for us
+
+  using Link::GetHost;
+  using Link::SetHost;
+
+  using Link::GetHostname;
+  using Link::SetHostname;
+
+  using Link::GetPort;
+  using Link::SetPort;
+
+  using Link::GetPathname;
+  using Link::SetPathname;
+
+  using Link::GetSearch;
+  using Link::SetSearch;
+
+  using Link::GetHash;
+  using Link::SetHash;
 
   // The XPCOM URI decomposition attributes are fine for us
   void GetCoords(nsString& aValue)
@@ -192,9 +213,9 @@ public:
   {
     SetHTMLAttr(nsGkAtoms::shape, aValue, rv);
   }
-  void Stringify(nsAString& aResult)
+  void Stringify(nsAString& aResult, ErrorResult& aError)
   {
-    GetHref(aResult);
+    GetHref(aResult, aError);
   }
 
 protected:
diff --git a/content/html/content/src/HTMLAreaElement.cpp b/content/html/content/src/HTMLAreaElement.cpp
index f1bd40cc8a6e..94927087c9b8 100644
--- a/content/html/content/src/HTMLAreaElement.cpp
+++ b/content/html/content/src/HTMLAreaElement.cpp
@@ -202,13 +202,17 @@ HTMLAreaElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
   NS_IMETHODIMP                                              \
   HTMLAreaElement::Get##_part(nsAString& a##_part)           \
   {                                                          \
-    Link::Get##_part(a##_part);                              \
+    ErrorResult rv;                                          \
+    Link::Get##_part(a##_part, rv);                          \
+    MOZ_ASSERT(!rv.Failed());                                \
     return NS_OK;                                            \
   }                                                          \
   NS_IMETHODIMP                                              \
   HTMLAreaElement::Set##_part(const nsAString& a##_part)     \
   {                                                          \
-    Link::Set##_part(a##_part);                              \
+    ErrorResult rv;                                          \
+    Link::Set##_part(a##_part, rv);                          \
+    MOZ_ASSERT(!rv.Failed());                                \
     return NS_OK;                                            \
   }
 
diff --git a/content/html/content/src/HTMLAreaElement.h b/content/html/content/src/HTMLAreaElement.h
index 0c1f53ecca33..fb6502a93972 100644
--- a/content/html/content/src/HTMLAreaElement.h
+++ b/content/html/content/src/HTMLAreaElement.h
@@ -90,7 +90,10 @@ public:
     SetHTMLAttr(nsGkAtoms::shape, aShape, aError);
   }
 
-  // The XPCOM GetHref is OK for us
+  void GetHref(nsAString& aHref, ErrorResult& aError)
+  {
+    aError = GetHref(aHref);
+  }
   void SetHref(const nsAString& aHref, ErrorResult& aError)
   {
     aError = SetHref(aHref);
@@ -124,10 +127,11 @@ public:
     SetHTMLAttr(nsGkAtoms::rel, aRel, aError);
   } 
   nsDOMTokenList* RelList();
+
   // The Link::GetOrigin is OK for us
 
-  // The XPCOM GetProtocol is OK for us
-  // The XPCOM SetProtocol is OK for us
+  using Link::GetProtocol;
+  using Link::SetProtocol;
 
   // The Link::GetUsername is OK for us
   // The Link::SetUsername is OK for us
@@ -135,23 +139,23 @@ public:
   // The Link::GetPassword is OK for us
   // The Link::SetPassword is OK for us
 
-  // The XPCOM GetHost is OK for us
-  // The XPCOM SetHost is OK for us
+  using Link::GetHost;
+  using Link::SetHost;
 
-  // The XPCOM GetHostname is OK for us
-  // The XPCOM SetHostname is OK for us
+  using Link::GetHostname;
+  using Link::SetHostname;
 
-  // The XPCOM GetPort is OK for us
-  // The XPCOM SetPort is OK for us
+  using Link::GetPort;
+  using Link::SetPort;
 
-  // The XPCOM GetPathname is OK for us
-  // The XPCOM SetPathname is OK for us
+  using Link::GetPathname;
+  using Link::SetPathname;
 
-  // The XPCOM GetSearch is OK for us
-  // The XPCOM SetSearch is OK for us
+  using Link::GetSearch;
+  using Link::SetSearch;
 
-  // The XPCOM GetHash is OK for us
-  // The XPCOM SetHash is OK for us
+  using Link::GetHash;
+  using Link::SetHash;
 
   // The Link::GetSearchParams is OK for us
   // The Link::SetSearchParams is OK for us
@@ -166,9 +170,9 @@ public:
     SetHTMLBoolAttr(nsGkAtoms::nohref, aValue, aError);
   }
 
-  void Stringify(nsAString& aResult)
+  void Stringify(nsAString& aResult, ErrorResult& aError)
   {
-    GetHref(aResult);
+    GetHref(aResult, aError);
   }
 
 protected:
diff --git a/content/html/content/src/HTMLAudioElement.cpp b/content/html/content/src/HTMLAudioElement.cpp
index b4babceaad01..ee8a2168a7b2 100644
--- a/content/html/content/src/HTMLAudioElement.cpp
+++ b/content/html/content/src/HTMLAudioElement.cpp
@@ -7,7 +7,6 @@
 #include "mozilla/dom/HTMLAudioElement.h"
 #include "mozilla/dom/HTMLAudioElementBinding.h"
 #include "nsError.h"
-#include "nsIDOMHTMLAudioElement.h"
 #include "nsGenericHTMLElement.h"
 #include "nsGkAtoms.h"
 #include "nsIDocument.h"
@@ -29,13 +28,10 @@ namespace dom {
 
 extern bool IsAudioAPIEnabled();
 
-NS_IMPL_ISUPPORTS_INHERITED(HTMLAudioElement, HTMLMediaElement,
-                            nsIDOMHTMLMediaElement, nsIDOMHTMLAudioElement)
-
 NS_IMPL_ELEMENT_CLONE(HTMLAudioElement)
 
 
-HTMLAudioElement::HTMLAudioElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+HTMLAudioElement::HTMLAudioElement(already_AddRefed<NodeInfo>& aNodeInfo)
   : HTMLMediaElement(aNodeInfo)
 {
 }
@@ -44,7 +40,6 @@ HTMLAudioElement::~HTMLAudioElement()
 {
 }
 
-
 already_AddRefed<HTMLAudioElement>
 HTMLAudioElement::Audio(const GlobalObject& aGlobal,
                         const Optional<nsAString>& aSrc,
diff --git a/content/html/content/src/HTMLMediaElement.cpp b/content/html/content/src/HTMLMediaElement.cpp
index d76e1cdfe44b..497ed0fb505c 100644
--- a/content/html/content/src/HTMLMediaElement.cpp
+++ b/content/html/content/src/HTMLMediaElement.cpp
@@ -48,7 +48,6 @@
 #include "nsICategoryManager.h"
 #include "MediaResource.h"
 
-#include "nsIDOMHTMLVideoElement.h"
 #include "nsIContentPolicy.h"
 #include "nsContentPolicyUtils.h"
 #include "nsCrossSiteListenerProxy.h"
@@ -458,6 +457,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLMediaElement, nsGenericHTMLE
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(HTMLMediaElement)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMHTMLMediaElement)
   NS_INTERFACE_MAP_ENTRY(nsIObserver)
   NS_INTERFACE_MAP_ENTRY(nsIAudioChannelAgentCallback)
 NS_INTERFACE_MAP_END_INHERITING(nsGenericHTMLElement)
@@ -488,6 +488,12 @@ HTMLMediaElement::SetMozAudioChannelType(const nsAString& aValue)
   return SetAttrHelper(nsGkAtoms::mozaudiochannel, aValue);
 }
 
+NS_IMETHODIMP_(bool)
+HTMLMediaElement::IsVideo()
+{
+  return false;
+}
+
 already_AddRefed<DOMMediaStream>
 HTMLMediaElement::GetMozSrcObject() const
 {
@@ -1820,8 +1826,7 @@ HTMLMediaElement::CaptureStreamInternal(bool aFinishWhenEnded)
   // holistically.
   uint8_t hints = 0;
   if (Preferences::GetBool("media.capturestream_hints.enabled")) {
-    nsCOMPtr<nsIDOMHTMLVideoElement> video = do_QueryObject(this);
-    if (video && GetVideoFrameContainer()) {
+    if (IsVideo() && GetVideoFrameContainer()) {
       hints = DOMMediaStream::HINT_CONTENTS_VIDEO | DOMMediaStream::HINT_CONTENTS_AUDIO;
     } else {
       hints = DOMMediaStream::HINT_CONTENTS_AUDIO;
@@ -2763,11 +2768,14 @@ public:
     }
     aGraph->DispatchToMainThreadAfterStreamStateUpdate(event.forget());
   }
-  virtual void NotifyFinished(MediaStreamGraph* aGraph) MOZ_OVERRIDE
+  virtual void NotifyEvent(MediaStreamGraph* aGraph,
+                           MediaStreamListener::MediaStreamGraphEvent event) MOZ_OVERRIDE
   {
-    nsCOMPtr<nsIRunnable> event =
-      NS_NewRunnableMethod(this, &StreamListener::DoNotifyFinished);
-    aGraph->DispatchToMainThreadAfterStreamStateUpdate(event.forget());
+    if (event == EVENT_FINISHED) {
+      nsCOMPtr<nsIRunnable> event =
+        NS_NewRunnableMethod(this, &StreamListener::DoNotifyFinished);
+      aGraph->DispatchToMainThreadAfterStreamStateUpdate(event.forget());
+    }
   }
   virtual void NotifyHasCurrentData(MediaStreamGraph* aGraph) MOZ_OVERRIDE
   {
@@ -3275,9 +3283,9 @@ VideoFrameContainer* HTMLMediaElement::GetVideoFrameContainer()
     return mVideoFrameContainer;
 
   // Only video frames need an image container.
-  nsCOMPtr<nsIDOMHTMLVideoElement> video = do_QueryObject(this);
-  if (!video)
+  if (!IsVideo()) {
     return nullptr;
+  }
 
   mVideoFrameContainer =
     new VideoFrameContainer(this, LayerManager::CreateAsynchronousImageContainer());
@@ -3884,9 +3892,8 @@ void HTMLMediaElement::UpdateAudioChannelPlayingState()
       if (!mAudioChannelAgent) {
         return;
       }
-      nsCOMPtr<nsIDOMHTMLVideoElement> video = do_QueryObject(this);
       // Use a weak ref so the audio channel agent can't leak |this|.
-      if (AudioChannel::Normal == mAudioChannel && video) {
+      if (AudioChannel::Normal == mAudioChannel && IsVideo()) {
         mAudioChannelAgent->InitWithVideo(OwnerDoc()->GetWindow(),
                                           static_cast<int32_t>(mAudioChannel),
                                           this, true);
diff --git a/content/html/content/src/HTMLMetaElement.cpp b/content/html/content/src/HTMLMetaElement.cpp
index 0364d2612ef0..0d8f0f4ab7c4 100644
--- a/content/html/content/src/HTMLMetaElement.cpp
+++ b/content/html/content/src/HTMLMetaElement.cpp
@@ -48,6 +48,21 @@ HTMLMetaElement::SetItemValueText(const nsAString& aValue)
 }
 
 
+nsresult
+HTMLMetaElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                              const nsAttrValue* aValue, bool aNotify)
+{
+  if (aNameSpaceID == kNameSpaceID_None) {
+    if (aName == nsGkAtoms::content) {
+      nsIDocument *document = GetCurrentDoc();
+      CreateAndDispatchEvent(document, NS_LITERAL_STRING("DOMMetaChanged"));
+    }
+  }
+
+  return nsGenericHTMLElement::AfterSetAttr(aNameSpaceID, aName, aValue,
+                                            aNotify);
+}
+
 nsresult
 HTMLMetaElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                             nsIContent* aBindingParent,
diff --git a/content/html/content/src/HTMLMetaElement.h b/content/html/content/src/HTMLMetaElement.h
index 71598df5530a..d5ea4b8d4829 100644
--- a/content/html/content/src/HTMLMetaElement.h
+++ b/content/html/content/src/HTMLMetaElement.h
@@ -30,6 +30,10 @@ public:
                               bool aCompileEventHandlers) MOZ_OVERRIDE;
   virtual void UnbindFromTree(bool aDeep = true,
                               bool aNullParent = true) MOZ_OVERRIDE;
+
+  virtual nsresult AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                                const nsAttrValue* aValue, bool aNotify) MOZ_OVERRIDE;
+
   void CreateAndDispatchEvent(nsIDocument* aDoc, const nsAString& aEventName);
 
   virtual nsresult Clone(mozilla::dom::NodeInfo *aNodeInfo, nsINode **aResult) const MOZ_OVERRIDE;
diff --git a/content/html/content/src/HTMLVideoElement.cpp b/content/html/content/src/HTMLVideoElement.cpp
index 1b52e68a97c3..4705e6de6074 100644
--- a/content/html/content/src/HTMLVideoElement.cpp
+++ b/content/html/content/src/HTMLVideoElement.cpp
@@ -4,7 +4,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "nsIDOMHTMLVideoElement.h"
 #include "nsIDOMHTMLSourceElement.h"
 #include "mozilla/dom/HTMLVideoElement.h"
 #include "mozilla/dom/HTMLVideoElementBinding.h"
@@ -40,31 +39,9 @@ namespace dom {
 
 static bool sVideoStatsEnabled;
 
-NS_IMPL_ISUPPORTS_INHERITED(HTMLVideoElement, HTMLMediaElement,
-                            nsIDOMHTMLMediaElement, nsIDOMHTMLVideoElement)
-
 NS_IMPL_ELEMENT_CLONE(HTMLVideoElement)
 
-// nsIDOMHTMLVideoElement
-NS_IMPL_INT_ATTR(HTMLVideoElement, Width, width)
-NS_IMPL_INT_ATTR(HTMLVideoElement, Height, height)
-
-// nsIDOMHTMLVideoElement
-/* readonly attribute unsigned long videoWidth; */
-NS_IMETHODIMP HTMLVideoElement::GetVideoWidth(uint32_t *aVideoWidth)
-{
-  *aVideoWidth = VideoWidth();
-  return NS_OK;
-}
-
-/* readonly attribute unsigned long videoHeight; */
-NS_IMETHODIMP HTMLVideoElement::GetVideoHeight(uint32_t *aVideoHeight)
-{
-  *aVideoHeight = VideoHeight();
-  return NS_OK;
-}
-
-HTMLVideoElement::HTMLVideoElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+HTMLVideoElement::HTMLVideoElement(already_AddRefed<NodeInfo>& aNodeInfo)
   : HTMLMediaElement(aNodeInfo)
 {
 }
@@ -149,8 +126,6 @@ nsresult HTMLVideoElement::SetAcceptHeader(nsIHttpChannel* aChannel)
                                     false);
 }
 
-NS_IMPL_URI_ATTR(HTMLVideoElement, Poster, poster)
-
 uint32_t HTMLVideoElement::MozParsedFrames() const
 {
   MOZ_ASSERT(NS_IsMainThread(), "Should be on main thread.");
@@ -160,12 +135,6 @@ uint32_t HTMLVideoElement::MozParsedFrames() const
   return mDecoder ? mDecoder->GetFrameStatistics().GetParsedFrames() : 0;
 }
 
-NS_IMETHODIMP HTMLVideoElement::GetMozParsedFrames(uint32_t *aMozParsedFrames)
-{
-  *aMozParsedFrames = MozParsedFrames();
-  return NS_OK;
-}
-
 uint32_t HTMLVideoElement::MozDecodedFrames() const
 {
   MOZ_ASSERT(NS_IsMainThread(), "Should be on main thread.");
@@ -175,12 +144,6 @@ uint32_t HTMLVideoElement::MozDecodedFrames() const
   return mDecoder ? mDecoder->GetFrameStatistics().GetDecodedFrames() : 0;
 }
 
-NS_IMETHODIMP HTMLVideoElement::GetMozDecodedFrames(uint32_t *aMozDecodedFrames)
-{
-  *aMozDecodedFrames = MozDecodedFrames();
-  return NS_OK;
-}
-
 uint32_t HTMLVideoElement::MozPresentedFrames() const
 {
   MOZ_ASSERT(NS_IsMainThread(), "Should be on main thread.");
@@ -190,12 +153,6 @@ uint32_t HTMLVideoElement::MozPresentedFrames() const
   return mDecoder ? mDecoder->GetFrameStatistics().GetPresentedFrames() : 0;
 }
 
-NS_IMETHODIMP HTMLVideoElement::GetMozPresentedFrames(uint32_t *aMozPresentedFrames)
-{
-  *aMozPresentedFrames = MozPresentedFrames();
-  return NS_OK;
-}
-
 uint32_t HTMLVideoElement::MozPaintedFrames()
 {
   MOZ_ASSERT(NS_IsMainThread(), "Should be on main thread.");
@@ -206,12 +163,6 @@ uint32_t HTMLVideoElement::MozPaintedFrames()
   return container ? container->GetPaintCount() : 0;
 }
 
-NS_IMETHODIMP HTMLVideoElement::GetMozPaintedFrames(uint32_t *aMozPaintedFrames)
-{
-  *aMozPaintedFrames = MozPaintedFrames();
-  return NS_OK;
-}
-
 double HTMLVideoElement::MozFrameDelay()
 {
   MOZ_ASSERT(NS_IsMainThread(), "Should be on main thread.");
@@ -219,23 +170,12 @@ double HTMLVideoElement::MozFrameDelay()
   return container ?  container->GetFrameDelay() : 0;
 }
 
-NS_IMETHODIMP HTMLVideoElement::GetMozFrameDelay(double *aMozFrameDelay) {
-  *aMozFrameDelay = MozFrameDelay();
-  return NS_OK;
-}
-
-/* readonly attribute bool mozHasAudio */
 bool HTMLVideoElement::MozHasAudio() const
 {
   MOZ_ASSERT(NS_IsMainThread(), "Should be on main thread.");
   return mHasAudio;
 }
 
-NS_IMETHODIMP HTMLVideoElement::GetMozHasAudio(bool *aHasAudio) {
-  *aHasAudio = MozHasAudio();
-  return NS_OK;
-}
-
 JSObject*
 HTMLVideoElement::WrapNode(JSContext* aCx)
 {
@@ -324,5 +264,6 @@ HTMLVideoElement::Init()
 {
   Preferences::AddBoolVarCache(&sVideoStatsEnabled, "media.video_stats.enabled");
 }
+
 } // namespace dom
 } // namespace mozilla
diff --git a/content/html/content/src/nsHTMLDNSPrefetch.cpp b/content/html/content/src/nsHTMLDNSPrefetch.cpp
index 6090d9f8c775..a9dc8c15bc4f 100644
--- a/content/html/content/src/nsHTMLDNSPrefetch.cpp
+++ b/content/html/content/src/nsHTMLDNSPrefetch.cpp
@@ -175,7 +175,8 @@ nsHTMLDNSPrefetch::CancelPrefetch(Link *aElement,
     return NS_ERROR_NOT_AVAILABLE;
 
   nsAutoString hostname;
-  aElement->GetHostname(hostname);
+  ErrorResult rv;
+  aElement->GetHostname(hostname, rv);
   return CancelPrefetch(hostname, flags, aReason);
 }
 
diff --git a/content/html/document/src/nsHTMLDocument.h b/content/html/document/src/nsHTMLDocument.h
index 15a5fffb33dd..5a64797f06ab 100644
--- a/content/html/document/src/nsHTMLDocument.h
+++ b/content/html/document/src/nsHTMLDocument.h
@@ -240,7 +240,7 @@ public:
   // The XPCOM CaptureEvents works fine for us.
   // The XPCOM ReleaseEvents works fine for us.
   // We're picking up GetLocation from Document
-  already_AddRefed<nsIDOMLocation> GetLocation() const {
+  already_AddRefed<nsLocation> GetLocation() const {
     return nsIDocument::GetLocation();
   }
 
diff --git a/content/media/MediaDecoder.cpp b/content/media/MediaDecoder.cpp
index 6da23d43a930..6d57184cb64f 100644
--- a/content/media/MediaDecoder.cpp
+++ b/content/media/MediaDecoder.cpp
@@ -261,13 +261,15 @@ MediaDecoder::DecodedStreamGraphListener::DoNotifyFinished()
 }
 
 void
-MediaDecoder::DecodedStreamGraphListener::NotifyFinished(MediaStreamGraph* aGraph)
+MediaDecoder::DecodedStreamGraphListener::NotifyEvent(MediaStreamGraph* aGraph,
+  MediaStreamListener::MediaStreamGraphEvent event)
 {
-  nsCOMPtr<nsIRunnable> event =
-    NS_NewRunnableMethod(this, &DecodedStreamGraphListener::DoNotifyFinished);
-  aGraph->DispatchToMainThreadAfterStreamStateUpdate(event.forget());
+  if (event == EVENT_FINISHED) {
+    nsCOMPtr<nsIRunnable> event =
+      NS_NewRunnableMethod(this, &DecodedStreamGraphListener::DoNotifyFinished);
+    aGraph->DispatchToMainThreadAfterStreamStateUpdate(event.forget());
+  }
 }
-
 void MediaDecoder::DestroyDecodedStream()
 {
   MOZ_ASSERT(NS_IsMainThread());
diff --git a/content/media/MediaDecoder.h b/content/media/MediaDecoder.h
index 3a5247e5b044..795cadc6a092 100755
--- a/content/media/MediaDecoder.h
+++ b/content/media/MediaDecoder.h
@@ -440,7 +440,8 @@ public:
   public:
     DecodedStreamGraphListener(MediaStream* aStream, DecodedStreamData* aData);
     virtual void NotifyOutput(MediaStreamGraph* aGraph, GraphTime aCurrentTime) MOZ_OVERRIDE;
-    virtual void NotifyFinished(MediaStreamGraph* aGraph) MOZ_OVERRIDE;
+    virtual void NotifyEvent(MediaStreamGraph* aGraph,
+                             MediaStreamListener::MediaStreamGraphEvent event) MOZ_OVERRIDE;
 
     void DoNotifyFinished();
 
diff --git a/content/media/MediaStreamGraph.cpp b/content/media/MediaStreamGraph.cpp
index 34a7cb4aa546..d918a7116180 100644
--- a/content/media/MediaStreamGraph.cpp
+++ b/content/media/MediaStreamGraph.cpp
@@ -397,7 +397,7 @@ MediaStreamGraphImpl::UpdateCurrentTime()
     GraphTime blockedTime = 0;
     GraphTime t = prevCurrentTime;
     // include |nextCurrentTime| to ensure NotifyBlockingChanged() is called
-    // before NotifyFinished() when |nextCurrentTime == stream end time|
+    // before NotifyEvent(this, EVENT_FINISHED) when |nextCurrentTime == stream end time|
     while (t <= nextCurrentTime) {
       GraphTime end;
       bool blocked = stream->mBlocked.GetAt(t, &end);
@@ -460,7 +460,7 @@ MediaStreamGraphImpl::UpdateCurrentTime()
       SetStreamOrderDirty();
       for (uint32_t j = 0; j < stream->mListeners.Length(); ++j) {
         MediaStreamListener* l = stream->mListeners[j];
-        l->NotifyFinished(this);
+        l->NotifyEvent(this, MediaStreamListener::EVENT_FINISHED);
       }
     }
   }
@@ -1933,7 +1933,7 @@ MediaStream::RemoveAllListenersImpl()
 {
   for (int32_t i = mListeners.Length() - 1; i >= 0; --i) {
     nsRefPtr<MediaStreamListener> listener = mListeners[i].forget();
-    listener->NotifyRemoved(GraphImpl());
+    listener->NotifyEvent(GraphImpl(), MediaStreamListener::EVENT_REMOVED);
   }
   mListeners.Clear();
 }
@@ -2111,7 +2111,7 @@ MediaStream::AddListenerImpl(already_AddRefed<MediaStreamListener> aListener)
   listener->NotifyBlockingChanged(GraphImpl(),
     mNotifiedBlocked ? MediaStreamListener::BLOCKED : MediaStreamListener::UNBLOCKED);
   if (mNotifiedFinished) {
-    listener->NotifyFinished(GraphImpl());
+    listener->NotifyEvent(GraphImpl(), MediaStreamListener::EVENT_FINISHED);
   }
   if (mNotifiedHasCurrentData) {
     listener->NotifyHasCurrentData(GraphImpl());
@@ -2140,7 +2140,7 @@ MediaStream::RemoveListenerImpl(MediaStreamListener* aListener)
   // wouldn't need this if we could do it in the opposite order
   nsRefPtr<MediaStreamListener> listener(aListener);
   mListeners.RemoveElement(aListener);
-  listener->NotifyRemoved(GraphImpl());
+  listener->NotifyEvent(GraphImpl(), MediaStreamListener::EVENT_REMOVED);
 }
 
 void
@@ -2367,15 +2367,37 @@ SourceMediaStream::NotifyDirectConsumers(TrackData *aTrack,
 void
 SourceMediaStream::AddDirectListener(MediaStreamDirectListener* aListener)
 {
-  MutexAutoLock lock(mMutex);
-  mDirectListeners.AppendElement(aListener);
+  bool wasEmpty;
+  {
+    MutexAutoLock lock(mMutex);
+    wasEmpty = mDirectListeners.IsEmpty();
+    mDirectListeners.AppendElement(aListener);
+  }
+
+  if (wasEmpty) {
+    for (uint32_t j = 0; j < mListeners.Length(); ++j) {
+      MediaStreamListener* l = mListeners[j];
+      l->NotifyEvent(GraphImpl(), MediaStreamListener::EVENT_HAS_DIRECT_LISTENERS);
+    }
+  }
 }
 
 void
 SourceMediaStream::RemoveDirectListener(MediaStreamDirectListener* aListener)
 {
-  MutexAutoLock lock(mMutex);
-  mDirectListeners.RemoveElement(aListener);
+  bool isEmpty;
+  {
+    MutexAutoLock lock(mMutex);
+    mDirectListeners.RemoveElement(aListener);
+    isEmpty = mDirectListeners.IsEmpty();
+  }
+
+  if (isEmpty) {
+    for (uint32_t j = 0; j < mListeners.Length(); ++j) {
+      MediaStreamListener* l = mListeners[j];
+      l->NotifyEvent(GraphImpl(), MediaStreamListener::EVENT_HAS_NO_DIRECT_LISTENERS);
+    }
+  }
 }
 
 bool
@@ -2455,7 +2477,7 @@ SourceMediaStream::EndAllTrackAndFinish()
     data->mCommands |= TRACK_END;
   }
   FinishWithLockHeld();
-  // we will call NotifyFinished() to let GetUserMedia know
+  // we will call NotifyEvent() to let GetUserMedia know
 }
 
 TrackTicks
diff --git a/content/media/MediaStreamGraph.h b/content/media/MediaStreamGraph.h
index 90e09b2f3b5a..57156f8bc3f7 100644
--- a/content/media/MediaStreamGraph.h
+++ b/content/media/MediaStreamGraph.h
@@ -111,6 +111,7 @@ public:
     CONSUMED,
     NOT_CONSUMED
   };
+
   /**
    * Notify that the stream is hooked up and we'd like to start or stop receiving
    * data on it. Only fires on SourceMediaStreams.
@@ -157,16 +158,17 @@ public:
    */
   virtual void NotifyOutput(MediaStreamGraph* aGraph, GraphTime aCurrentTime) {}
 
-  /**
-   * Notify that the stream finished.
-   */
-  virtual void NotifyFinished(MediaStreamGraph* aGraph) {}
+  enum MediaStreamGraphEvent {
+    EVENT_FINISHED,
+    EVENT_REMOVED,
+    EVENT_HAS_DIRECT_LISTENERS, // transition from no direct listeners
+    EVENT_HAS_NO_DIRECT_LISTENERS,  // transition to no direct listeners
+  };
 
   /**
-   * Notify that your listener has been removed, either due to RemoveListener(),
-   * or due to the stream being destroyed.  You will get no further notifications.
+   * Notify that an event has occurred on the Stream
    */
-  virtual void NotifyRemoved(MediaStreamGraph* aGraph) {}
+  virtual void NotifyEvent(MediaStreamGraph* aGraph, MediaStreamGraphEvent aEvent) {}
 
   enum {
     TRACK_EVENT_CREATED = 0x01,
diff --git a/content/media/encoder/MediaEncoder.cpp b/content/media/encoder/MediaEncoder.cpp
index 919465653c2d..aabc15982162 100644
--- a/content/media/encoder/MediaEncoder.cpp
+++ b/content/media/encoder/MediaEncoder.cpp
@@ -64,17 +64,17 @@ MediaEncoder::NotifyQueuedTrackChanges(MediaStreamGraph* aGraph,
 }
 
 void
-MediaEncoder::NotifyRemoved(MediaStreamGraph* aGraph)
+MediaEncoder::NotifyEvent(MediaStreamGraph* aGraph,
+                          MediaStreamListener::MediaStreamGraphEvent event)
 {
   // In case that MediaEncoder does not receive a TRACK_EVENT_ENDED event.
   LOG(PR_LOG_DEBUG, ("NotifyRemoved in [MediaEncoder]."));
   if (mAudioEncoder) {
-    mAudioEncoder->NotifyRemoved(aGraph);
+    mAudioEncoder->NotifyEvent(aGraph, event);
   }
   if (mVideoEncoder) {
-    mVideoEncoder->NotifyRemoved(aGraph);
+    mVideoEncoder->NotifyEvent(aGraph, event);
   }
-
 }
 
 /* static */
diff --git a/content/media/encoder/MediaEncoder.h b/content/media/encoder/MediaEncoder.h
index 78acdcfff6a1..d67242f8f969 100644
--- a/content/media/encoder/MediaEncoder.h
+++ b/content/media/encoder/MediaEncoder.h
@@ -80,12 +80,13 @@ public :
                                         TrackRate aTrackRate,
                                         TrackTicks aTrackOffset,
                                         uint32_t aTrackEvents,
-                                        const MediaSegment& aQueuedMedia);
+                                        const MediaSegment& aQueuedMedia) MOZ_OVERRIDE;
 
   /**
    * Notified the stream is being removed.
    */
-  virtual void NotifyRemoved(MediaStreamGraph* aGraph);
+  virtual void NotifyEvent(MediaStreamGraph* aGraph,
+                           MediaStreamListener::MediaStreamGraphEvent event) MOZ_OVERRIDE;
 
   /**
    * Creates an encoder with a given MIME type. Returns null if we are unable
diff --git a/content/media/encoder/TrackEncoder.h b/content/media/encoder/TrackEncoder.h
index 7ed2e4f3d568..41921282dbf4 100644
--- a/content/media/encoder/TrackEncoder.h
+++ b/content/media/encoder/TrackEncoder.h
@@ -13,11 +13,10 @@
 #include "StreamBuffer.h"
 #include "TrackMetadataBase.h"
 #include "VideoSegment.h"
+#include "MediaStreamGraph.h"
 
 namespace mozilla {
 
-class MediaStreamGraph;
-
 /**
  * Base class of AudioTrackEncoder and VideoTrackEncoder. Lifetimes managed by
  * MediaEncoder. Most methods can only be called on the MediaEncoder's thread,
@@ -49,7 +48,13 @@ public:
    * Notified by the same callback of MediaEncoder when it has been removed from
    * MediaStreamGraph. Called on the MediaStreamGraph thread.
    */
-  void NotifyRemoved(MediaStreamGraph* aGraph) { NotifyEndOfStream(); }
+  void NotifyEvent(MediaStreamGraph* aGraph,
+                   MediaStreamListener::MediaStreamGraphEvent event)
+  {
+    if (event == MediaStreamListener::MediaStreamGraphEvent::EVENT_REMOVED) {
+      NotifyEndOfStream();
+    }
+  }
 
   /**
    * Creates and sets up meta data for a specific codec, called on the worker
diff --git a/content/media/gmp/GMPParent.cpp b/content/media/gmp/GMPParent.cpp
index 2e3a5d228f46..12969ff4c4a8 100644
--- a/content/media/gmp/GMPParent.cpp
+++ b/content/media/gmp/GMPParent.cpp
@@ -13,6 +13,7 @@
 #include "nsThreadUtils.h"
 #include "nsIRunnable.h"
 #include "mozIGeckoMediaPluginService.h"
+#include "mozilla/unused.h"
 
 namespace mozilla {
 namespace gmp {
@@ -126,7 +127,8 @@ GMPParent::VideoDecoderDestroyed(GMPVideoDecoderParent* aDecoder)
 {
   MOZ_ASSERT(GMPThread() == NS_GetCurrentThread());
 
-  MOZ_ALWAYS_TRUE(mVideoDecoders.RemoveElement(aDecoder));
+  // If the constructor fails, we'll get called before it's added
+  unused << NS_WARN_IF(!mVideoDecoders.RemoveElement(aDecoder));
 
   // Recv__delete__ is on the stack, don't potentially destroy the top-level actor
   // until after this has completed.
@@ -139,7 +141,8 @@ GMPParent::VideoEncoderDestroyed(GMPVideoEncoderParent* aEncoder)
 {
   MOZ_ASSERT(GMPThread() == NS_GetCurrentThread());
 
-  MOZ_ALWAYS_TRUE(mVideoEncoders.RemoveElement(aEncoder));
+  // If the constructor fails, we'll get called before it's added
+  unused << NS_WARN_IF(!mVideoEncoders.RemoveElement(aEncoder));
 
   // Recv__delete__ is on the stack, don't potentially destroy the top-level actor
   // until after this has completed.
diff --git a/content/media/omx/MediaCodecProxy.cpp b/content/media/omx/MediaCodecProxy.cpp
new file mode 100644
index 000000000000..82e73bc671d9
--- /dev/null
+++ b/content/media/omx/MediaCodecProxy.cpp
@@ -0,0 +1,392 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MediaCodecProxy.h"
+
+#include <string.h>
+
+#include <binder/IPCThreadState.h>
+
+namespace android {
+
+sp<MediaCodecProxy>
+MediaCodecProxy::CreateByType(sp<ALooper> aLooper,
+                              const char *aMime,
+                              bool aEncoder,
+                              bool aAsync,
+                              wp<CodecResourceListener> aListener)
+{
+  sp<MediaCodecProxy> codec = new MediaCodecProxy(aLooper, aMime, aEncoder, aAsync, aListener);
+  if ((!aAsync && codec->allocated()) || codec->requestResource()) {
+    return codec;
+  }
+  return nullptr;
+}
+
+MediaCodecProxy::MediaCodecProxy(sp<ALooper> aLooper,
+                                 const char *aMime,
+                                 bool aEncoder,
+                                 bool aAsync,
+                                 wp<CodecResourceListener> aListener)
+  : mCodecLooper(aLooper)
+  , mCodecMime(aMime)
+  , mCodecEncoder(aEncoder)
+  , mListener(aListener)
+{
+  MOZ_ASSERT(mCodecLooper != nullptr, "ALooper should not be nullptr.");
+  if (aAsync) {
+    mResourceHandler = new MediaResourceHandler(this);
+  } else {
+    allocateCodec();
+  }
+}
+
+MediaCodecProxy::~MediaCodecProxy()
+{
+  releaseCodec();
+
+  // Complete all pending Binder ipc transactions
+  IPCThreadState::self()->flushCommands();
+
+  cancelResource();
+}
+
+bool
+MediaCodecProxy::requestResource()
+{
+  if (mResourceHandler == nullptr) {
+    return false;
+  }
+
+  if (strncasecmp(mCodecMime.get(), "video/", 6) == 0) {
+    mResourceHandler->requestResource(mCodecEncoder
+        ? IMediaResourceManagerService::HW_VIDEO_ENCODER
+        : IMediaResourceManagerService::HW_VIDEO_DECODER);
+  } else if (strncasecmp(mCodecMime.get(), "audio/", 6) == 0) {
+    mResourceHandler->requestResource(mCodecEncoder
+        ? IMediaResourceManagerService::HW_AUDIO_ENCODER
+        : IMediaResourceManagerService::HW_AUDIO_DECODER);
+  } else {
+    return false;
+  }
+
+  return true;
+}
+
+void
+MediaCodecProxy::cancelResource()
+{
+  if (mResourceHandler == nullptr) {
+    return;
+  }
+
+  mResourceHandler->cancelResource();
+}
+
+bool
+MediaCodecProxy::allocateCodec()
+{
+  if (mCodecLooper == nullptr) {
+    return false;
+  }
+
+  // Write Lock for mCodec
+  RWLock::AutoWLock awl(mCodecLock);
+
+  // Create MediaCodec
+  mCodec = MediaCodec::CreateByType(mCodecLooper, mCodecMime.get(), mCodecEncoder);
+  if (mCodec == nullptr) {
+    return false;
+  }
+
+  return true;
+}
+
+void
+MediaCodecProxy::releaseCodec()
+{
+  wp<MediaCodec> codec;
+
+  {
+    // Write Lock for mCodec
+    RWLock::AutoWLock awl(mCodecLock);
+
+    codec = mCodec;
+
+    // Release MediaCodec
+    if (mCodec != nullptr) {
+      mCodec->release();
+      mCodec = nullptr;
+    }
+  }
+
+  while (codec.promote() != nullptr) {
+    // this value come from stagefright's AwesomePlayer.
+    usleep(1000);
+  }
+}
+
+bool
+MediaCodecProxy::allocated() const
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  return mCodec != nullptr;
+}
+
+status_t
+MediaCodecProxy::configure(const sp<AMessage> &aFormat,
+                           const sp<Surface> &aNativeWindow,
+                           const sp<ICrypto> &aCrypto,
+                           uint32_t aFlags)
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->configure(aFormat, aNativeWindow, aCrypto, aFlags);
+}
+
+status_t
+MediaCodecProxy::start()
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->start();
+}
+
+status_t
+MediaCodecProxy::stop()
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->stop();
+}
+
+status_t
+MediaCodecProxy::release()
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->release();
+}
+
+status_t
+MediaCodecProxy::flush()
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->flush();
+}
+
+status_t
+MediaCodecProxy::queueInputBuffer(size_t aIndex,
+                                  size_t aOffset,
+                                  size_t aSize,
+                                  int64_t aPresentationTimeUs,
+                                  uint32_t aFlags,
+                                  AString *aErrorDetailMessage)
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->queueInputBuffer(aIndex, aOffset, aSize,
+      aPresentationTimeUs, aFlags, aErrorDetailMessage);
+}
+
+status_t
+MediaCodecProxy::queueSecureInputBuffer(size_t aIndex,
+                                        size_t aOffset,
+                                        const CryptoPlugin::SubSample *aSubSamples,
+                                        size_t aNumSubSamples,
+                                        const uint8_t aKey[16],
+                                        const uint8_t aIV[16],
+                                        CryptoPlugin::Mode aMode,
+                                        int64_t aPresentationTimeUs,
+                                        uint32_t aFlags,
+                                        AString *aErrorDetailMessage)
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->queueSecureInputBuffer(aIndex, aOffset,
+      aSubSamples, aNumSubSamples, aKey, aIV, aMode,
+      aPresentationTimeUs, aFlags, aErrorDetailMessage);
+}
+
+status_t
+MediaCodecProxy::dequeueInputBuffer(size_t *aIndex,
+                                    int64_t aTimeoutUs)
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->dequeueInputBuffer(aIndex, aTimeoutUs);
+}
+
+status_t
+MediaCodecProxy::dequeueOutputBuffer(size_t *aIndex,
+                                     size_t *aOffset,
+                                     size_t *aSize,
+                                     int64_t *aPresentationTimeUs,
+                                     uint32_t *aFlags,
+                                     int64_t aTimeoutUs)
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->dequeueOutputBuffer(aIndex, aOffset, aSize,
+      aPresentationTimeUs, aFlags, aTimeoutUs);
+}
+
+status_t
+MediaCodecProxy::renderOutputBufferAndRelease(size_t aIndex)
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->renderOutputBufferAndRelease(aIndex);
+}
+
+status_t
+MediaCodecProxy::releaseOutputBuffer(size_t aIndex)
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->releaseOutputBuffer(aIndex);
+}
+
+status_t
+MediaCodecProxy::signalEndOfInputStream()
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->signalEndOfInputStream();
+}
+
+status_t
+MediaCodecProxy::getOutputFormat(sp<AMessage> *aFormat) const
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->getOutputFormat(aFormat);
+}
+
+status_t
+MediaCodecProxy::getInputBuffers(Vector<sp<ABuffer>> *aBuffers) const
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->getInputBuffers(aBuffers);
+}
+
+status_t
+MediaCodecProxy::getOutputBuffers(Vector<sp<ABuffer>> *aBuffers) const
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return NO_INIT;
+  }
+  return mCodec->getOutputBuffers(aBuffers);
+}
+
+void
+MediaCodecProxy::requestActivityNotification(const sp<AMessage> &aNotify)
+{
+  // Read Lock for mCodec
+  RWLock::AutoRLock arl(mCodecLock);
+
+  if (mCodec == nullptr) {
+    return;
+  }
+  mCodec->requestActivityNotification(aNotify);
+}
+
+// Called on a Binder thread
+void
+MediaCodecProxy::resourceReserved()
+{
+  // Create MediaCodec
+  releaseCodec();
+  if (!allocateCodec()) {
+    cancelResource();
+    return;
+  }
+
+  // Notification
+  sp<CodecResourceListener> listener = mListener.promote();
+  if (listener != nullptr) {
+    listener->codecReserved();
+  }
+}
+
+// Called on a Binder thread
+void
+MediaCodecProxy::resourceCanceled()
+{
+  // Release MediaCodec
+  releaseCodec();
+
+  // Notification
+  sp<CodecResourceListener> listener = mListener.promote();
+  if (listener != nullptr) {
+    listener->codecCanceled();
+  }
+}
+
+} // namespace android
diff --git a/content/media/omx/MediaCodecProxy.h b/content/media/omx/MediaCodecProxy.h
new file mode 100644
index 000000000000..3b4435b24664
--- /dev/null
+++ b/content/media/omx/MediaCodecProxy.h
@@ -0,0 +1,156 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MEDIA_CODEC_PROXY_H
+#define MEDIA_CODEC_PROXY_H
+
+#include <nsString.h>
+
+#include <stagefright/MediaCodec.h>
+#include <utils/threads.h>
+
+#include "MediaResourceHandler.h"
+
+namespace android {
+
+class MediaCodecProxy : public MediaResourceHandler::ResourceListener
+{
+public:
+  /* Codec resource notification listener.
+   * All functions are called on the Binder thread.
+   */
+  struct CodecResourceListener : public virtual RefBase {
+    /* The codec resource is reserved and can be granted.
+     * The client can allocate the requested resource.
+     */
+    virtual void codecReserved() = 0;
+    /* The codec resource is not reserved any more.
+     * The client should release the resource as soon as possible if the
+     * resource is still being held.
+     */
+    virtual void codecCanceled() = 0;
+  };
+
+  // Check whether MediaCodec has been allocated.
+  bool allocated() const;
+
+  // Static MediaCodec methods
+  // Only support MediaCodec::CreateByType()
+  static sp<MediaCodecProxy> CreateByType(sp<ALooper> aLooper,
+                                          const char *aMime,
+                                          bool aEncoder,
+                                          bool aAsync=false,
+                                          wp<CodecResourceListener> aListener=nullptr);
+
+  // MediaCodec methods
+  status_t configure(const sp<AMessage> &aFormat,
+                     const sp<Surface> &aNativeWindow,
+                     const sp<ICrypto> &aCrypto,
+                     uint32_t aFlags);
+
+  status_t start();
+
+  status_t stop();
+
+  status_t release();
+
+  status_t flush();
+
+  status_t queueInputBuffer(size_t aIndex,
+                            size_t aOffset,
+                            size_t aSize,
+                            int64_t aPresentationTimeUs,
+                            uint32_t aFlags,
+                            AString *aErrorDetailMessage=nullptr);
+
+  status_t queueSecureInputBuffer(size_t aIndex,
+                                  size_t aOffset,
+                                  const CryptoPlugin::SubSample *aSubSamples,
+                                  size_t aNumSubSamples,
+                                  const uint8_t aKey[16],
+                                  const uint8_t aIV[16],
+                                  CryptoPlugin::Mode aMode,
+                                  int64_t aPresentationTimeUs,
+                                  uint32_t aFlags,
+                                  AString *aErrorDetailMessage=nullptr);
+
+  status_t dequeueInputBuffer(size_t *aIndex,
+                              int64_t aTimeoutUs=INT64_C(0));
+
+  status_t dequeueOutputBuffer(size_t *aIndex,
+                               size_t *aOffset,
+                               size_t *aSize,
+                               int64_t *aPresentationTimeUs,
+                               uint32_t *aFlags,
+                               int64_t aTimeoutUs=INT64_C(0));
+
+  status_t renderOutputBufferAndRelease(size_t aIndex);
+
+  status_t releaseOutputBuffer(size_t aIndex);
+
+  status_t signalEndOfInputStream();
+
+  status_t getOutputFormat(sp<AMessage> *aFormat) const;
+
+  status_t getInputBuffers(Vector<sp<ABuffer>> *aBuffers) const;
+
+  status_t getOutputBuffers(Vector<sp<ABuffer>> *aBuffers) const;
+
+  // Notification will be posted once there "is something to do", i.e.
+  // an input/output buffer has become available, a format change is
+  // pending, an error is pending.
+  void requestActivityNotification(const sp<AMessage> &aNotify);
+
+protected:
+  virtual ~MediaCodecProxy();
+
+  // MediaResourceHandler::EventListener::resourceReserved()
+  virtual void resourceReserved();
+  // MediaResourceHandler::EventListener::resourceCanceled()
+  virtual void resourceCanceled();
+
+private:
+  // Forbidden
+  MediaCodecProxy() MOZ_DELETE;
+  MediaCodecProxy(const MediaCodecProxy &) MOZ_DELETE;
+  const MediaCodecProxy &operator=(const MediaCodecProxy &) MOZ_DELETE;
+
+  // Constructor for MediaCodecProxy::CreateByType
+  MediaCodecProxy(sp<ALooper> aLooper,
+                  const char *aMime,
+                  bool aEncoder,
+                  bool aAsync,
+                  wp<CodecResourceListener> aListener);
+
+  // Request Resource
+  bool requestResource();
+  // Cancel Resource
+  void cancelResource();
+
+  // Allocate Codec Resource
+  bool allocateCodec();
+  // Release Codec Resource
+  void releaseCodec();
+
+  // MediaCodec Parameter
+  sp<ALooper> mCodecLooper;
+  nsCString mCodecMime;
+  bool mCodecEncoder;
+
+  // Codec Resource Notification Listener
+  wp<CodecResourceListener> mListener;
+
+  // Media Resource Management
+  sp<MediaResourceHandler> mResourceHandler;
+
+  // MediaCodec instance
+  mutable RWLock mCodecLock;
+  sp<MediaCodec> mCodec;
+};
+
+} // namespace android
+
+#endif // MEDIA_CODEC_PROXY_H
diff --git a/content/media/omx/mediaresourcemanager/IMediaResourceManagerService.h b/content/media/omx/mediaresourcemanager/IMediaResourceManagerService.h
index 24dc190975b5..3bd8d1bbf5b0 100644
--- a/content/media/omx/mediaresourcemanager/IMediaResourceManagerService.h
+++ b/content/media/omx/mediaresourcemanager/IMediaResourceManagerService.h
@@ -27,6 +27,7 @@ public:
       HW_VIDEO_DECODER = 0,
       HW_AUDIO_DECODER,  // Not supported currently.
       HW_VIDEO_ENCODER,
+      HW_AUDIO_ENCODER,  // Not supported currently.
       HW_CAMERA,          // Not supported currently.
       NUM_OF_RESOURCE_TYPES,
       INVALID_RESOURCE_TYPE = -1
diff --git a/content/media/omx/mediaresourcemanager/MediaResourceHandler.cpp b/content/media/omx/mediaresourcemanager/MediaResourceHandler.cpp
new file mode 100644
index 000000000000..26c5c2ee44b8
--- /dev/null
+++ b/content/media/omx/mediaresourcemanager/MediaResourceHandler.cpp
@@ -0,0 +1,92 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MediaResourceHandler.h"
+
+#include "mozilla/NullPtr.h"
+
+namespace android {
+
+MediaResourceHandler::MediaResourceHandler(const wp<ResourceListener> &aListener)
+  : mListener(aListener)
+  , mState(MediaResourceManagerClient::CLIENT_STATE_WAIT_FOR_RESOURCE)
+  , mType(IMediaResourceManagerService::INVALID_RESOURCE_TYPE)
+{
+}
+
+MediaResourceHandler::~MediaResourceHandler()
+{
+  cancelResource();
+}
+
+bool
+MediaResourceHandler::requestResource(IMediaResourceManagerService::ResourceType aType)
+{
+  Mutex::Autolock al(mLock);
+
+  if (mClient != nullptr && mService != nullptr) {
+    return false;
+  }
+
+  sp<MediaResourceManagerClient> client = new MediaResourceManagerClient(this);
+  sp<IMediaResourceManagerService> service = client->getMediaResourceManagerService();
+
+  if (service == nullptr) {
+    return false;
+  }
+
+  if (service->requestMediaResource(client, (int)aType, true) != OK) {
+    return false;
+  }
+
+  mClient = client;
+  mService = service;
+  mType = aType;
+
+  return true;
+}
+
+void
+MediaResourceHandler::cancelResource()
+{
+  Mutex::Autolock al(mLock);
+
+  if (mClient != nullptr && mService != nullptr) {
+    mService->cancelClient(mClient, (int)mType);
+  }
+
+  mClient = nullptr;
+  mService = nullptr;
+}
+
+// Called on a Binder thread
+void
+MediaResourceHandler::statusChanged(int aEvent)
+{
+  sp<ResourceListener> listener;
+
+  Mutex::Autolock autoLock(mLock);
+
+  MediaResourceManagerClient::State state = (MediaResourceManagerClient::State)aEvent;
+  if (state == mState) {
+    return;
+  }
+
+  mState = state;
+
+  listener = mListener.promote();
+  if (listener == nullptr) {
+    return;
+  }
+
+  if (mState == MediaResourceManagerClient::CLIENT_STATE_RESOURCE_ASSIGNED) {
+    listener->resourceReserved();
+  } else {
+    listener->resourceCanceled();
+  }
+}
+
+} // namespace android
diff --git a/content/media/omx/mediaresourcemanager/MediaResourceHandler.h b/content/media/omx/mediaresourcemanager/MediaResourceHandler.h
new file mode 100644
index 000000000000..04268f7e7504
--- /dev/null
+++ b/content/media/omx/mediaresourcemanager/MediaResourceHandler.h
@@ -0,0 +1,68 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MEDIA_RESOURCE_HANDLER_H
+#define MEDIA_RESOURCE_HANDLER_H
+
+#include <utils/threads.h>
+
+#include <mozilla/Attributes.h>
+
+#include "MediaResourceManagerClient.h"
+
+namespace android {
+
+class MediaResourceHandler : public MediaResourceManagerClient::EventListener
+{
+public:
+  /* Resource notification listener.
+   * All functions are called on the Binder thread.
+   */
+  struct ResourceListener : public virtual RefBase {
+    /* The resource is reserved and can be granted.
+     * The client can allocate the requested resource.
+     */
+    virtual void resourceReserved() = 0;
+    /* The resource is not reserved any more.
+     * The client should release the resource as soon as possible if the
+     * resource is still being held.
+     */
+    virtual void resourceCanceled() = 0;
+  };
+
+  MediaResourceHandler(const wp<ResourceListener> &aListener);
+
+  virtual ~MediaResourceHandler();
+
+  // Request Resource
+  bool requestResource(IMediaResourceManagerService::ResourceType aType);
+  // Cancel Resource
+  void cancelResource();
+
+protected:
+  // MediaResourceManagerClient::EventListener::statusChanged()
+  virtual void statusChanged(int event);
+
+private:
+  // Forbidden
+  MediaResourceHandler() MOZ_DELETE;
+  MediaResourceHandler(const MediaResourceHandler &) MOZ_DELETE;
+  const MediaResourceHandler &operator=(const MediaResourceHandler &) MOZ_DELETE;
+
+  // Resource Notification Listener
+  wp<ResourceListener> mListener;
+
+  // Resource Management
+  Mutex mLock;
+  MediaResourceManagerClient::State mState;
+  sp<IMediaResourceManagerClient> mClient;
+  sp<IMediaResourceManagerService> mService;
+  IMediaResourceManagerService::ResourceType mType;
+};
+
+} // namespace android
+
+#endif // MEDIA_RESOURCE_HANDLER_H
diff --git a/content/media/omx/mediaresourcemanager/moz.build b/content/media/omx/mediaresourcemanager/moz.build
index 024ccf809cb0..e9d6841e9918 100644
--- a/content/media/omx/mediaresourcemanager/moz.build
+++ b/content/media/omx/mediaresourcemanager/moz.build
@@ -16,6 +16,7 @@ SOURCES += [
     'IMediaResourceManagerClient.cpp',
     'IMediaResourceManagerDeathNotifier.cpp',
     'IMediaResourceManagerService.cpp',
+    'MediaResourceHandler.cpp',
     'MediaResourceManagerClient.cpp',
     'MediaResourceManagerService.cpp',
 ]
diff --git a/content/media/omx/moz.build b/content/media/omx/moz.build
index c577820d49f7..2dd24ba7ea82 100755
--- a/content/media/omx/moz.build
+++ b/content/media/omx/moz.build
@@ -47,6 +47,14 @@ if 'rtsp' in CONFIG['NECKO_PROTOCOLS']:
         'RtspOmxReader.cpp',
     ]
 
+if int(CONFIG['ANDROID_VERSION']) >= 16:
+    EXPORTS += [
+        'MediaCodecProxy.h',
+    ]
+    SOURCES += [
+        'MediaCodecProxy.cpp',
+    ]
+
 include('/ipc/chromium/chromium-config.mozbuild')
 
 FINAL_LIBRARY = 'gklayout'
diff --git a/content/media/webrtc/MediaEngine.h b/content/media/webrtc/MediaEngine.h
index b03ca2f4ce31..241c6b4dfabe 100644
--- a/content/media/webrtc/MediaEngine.h
+++ b/content/media/webrtc/MediaEngine.h
@@ -86,6 +86,9 @@ public:
    * immediately after. */
   virtual nsresult Start(SourceMediaStream*, TrackID) = 0;
 
+  /* tell the source if there are any direct listeners attached */
+  virtual void SetDirectListeners(bool) = 0;
+
   /* Take a snapshot from this source. In the case of video this is a single
    * image, and for audio, it is a snippet lasting aDuration milliseconds. The
    * duration argument is ignored for a MediaEngineVideoSource.
diff --git a/content/media/webrtc/MediaEngineDefault.h b/content/media/webrtc/MediaEngineDefault.h
index e64895ae2259..0cfd70e8a15f 100644
--- a/content/media/webrtc/MediaEngineDefault.h
+++ b/content/media/webrtc/MediaEngineDefault.h
@@ -45,6 +45,7 @@ public:
   virtual nsresult Deallocate();
   virtual nsresult Start(SourceMediaStream*, TrackID);
   virtual nsresult Stop(SourceMediaStream*, TrackID);
+  virtual void SetDirectListeners(bool aHasDirectListeners) {};
   virtual nsresult Snapshot(uint32_t aDuration, nsIDOMFile** aFile);
   virtual nsresult Config(bool aEchoOn, uint32_t aEcho,
                           bool aAgcOn, uint32_t aAGC,
@@ -100,6 +101,7 @@ public:
   virtual nsresult Deallocate();
   virtual nsresult Start(SourceMediaStream*, TrackID);
   virtual nsresult Stop(SourceMediaStream*, TrackID);
+  virtual void SetDirectListeners(bool aHasDirectListeners) {};
   virtual nsresult Snapshot(uint32_t aDuration, nsIDOMFile** aFile);
   virtual nsresult Config(bool aEchoOn, uint32_t aEcho,
                           bool aAgcOn, uint32_t aAGC,
diff --git a/content/media/webrtc/MediaEngineTabVideoSource.h b/content/media/webrtc/MediaEngineTabVideoSource.h
index 94de33193c1d..4cab38cf3a53 100644
--- a/content/media/webrtc/MediaEngineTabVideoSource.h
+++ b/content/media/webrtc/MediaEngineTabVideoSource.h
@@ -24,6 +24,7 @@ class MediaEngineTabVideoSource : public MediaEngineVideoSource, nsIDOMEventList
                               const mozilla::MediaEnginePrefs&);
     virtual nsresult Deallocate();
     virtual nsresult Start(mozilla::SourceMediaStream*, mozilla::TrackID);
+    virtual void SetDirectListeners(bool aHasDirectListeners) {};
     virtual nsresult Snapshot(uint32_t, nsIDOMFile**);
     virtual void NotifyPull(mozilla::MediaStreamGraph*, mozilla::SourceMediaStream*, mozilla::TrackID, mozilla::StreamTime, mozilla::TrackTicks&);
     virtual nsresult Stop(mozilla::SourceMediaStream*, mozilla::TrackID);
diff --git a/content/media/webrtc/MediaEngineWebRTC.h b/content/media/webrtc/MediaEngineWebRTC.h
index a323de9cd24d..79e1fae12c36 100644
--- a/content/media/webrtc/MediaEngineWebRTC.h
+++ b/content/media/webrtc/MediaEngineWebRTC.h
@@ -104,6 +104,7 @@ public:
     , mMonitor("WebRTCCamera.Monitor")
     , mWidth(0)
     , mHeight(0)
+    , mHasDirectListeners(false)
     , mInitDone(false)
     , mInSnapshotMode(false)
     , mSnapshotPath(nullptr)
@@ -131,6 +132,7 @@ public:
     , mMonitor("WebRTCCamera.Monitor")
     , mWidth(0)
     , mHeight(0)
+    , mHasDirectListeners(false)
     , mInitDone(false)
     , mInSnapshotMode(false)
     , mSnapshotPath(nullptr) {
@@ -147,6 +149,7 @@ public:
   virtual nsresult Deallocate();
   virtual nsresult Start(SourceMediaStream*, TrackID);
   virtual nsresult Stop(SourceMediaStream*, TrackID);
+  virtual void SetDirectListeners(bool aHasListeners);
   virtual nsresult Snapshot(uint32_t aDuration, nsIDOMFile** aFile);
   virtual nsresult Config(bool aEchoOn, uint32_t aEcho,
                           bool aAgcOn, uint32_t aAGC,
@@ -245,6 +248,7 @@ private:
   int mWidth, mHeight;
   nsRefPtr<layers::Image> mImage;
   nsRefPtr<layers::ImageContainer> mImageContainer;
+  bool mHasDirectListeners;
 
   nsTArray<SourceMediaStream *> mSources; // When this goes empty, we shut down HW
 
@@ -297,6 +301,7 @@ public:
   virtual nsresult Deallocate();
   virtual nsresult Start(SourceMediaStream*, TrackID);
   virtual nsresult Stop(SourceMediaStream*, TrackID);
+  virtual void SetDirectListeners(bool aHasDirectListeners) {};
   virtual nsresult Snapshot(uint32_t aDuration, nsIDOMFile** aFile);
   virtual nsresult Config(bool aEchoOn, uint32_t aEcho,
                           bool aAgcOn, uint32_t aAGC,
diff --git a/content/media/webrtc/MediaEngineWebRTCVideo.cpp b/content/media/webrtc/MediaEngineWebRTCVideo.cpp
index bc343459f6c3..353572301e23 100644
--- a/content/media/webrtc/MediaEngineWebRTCVideo.cpp
+++ b/content/media/webrtc/MediaEngineWebRTCVideo.cpp
@@ -584,6 +584,13 @@ MediaEngineWebRTCVideoSource::Stop(SourceMediaStream *aSource, TrackID aID)
   return NS_OK;
 }
 
+void
+MediaEngineWebRTCVideoSource::SetDirectListeners(bool aHasDirectListeners)
+{
+  LOG((__FUNCTION__));
+  mHasDirectListeners = aHasDirectListeners;
+}
+
 nsresult
 MediaEngineWebRTCVideoSource::Snapshot(uint32_t aDuration, nsIDOMFile** aFile)
 {
@@ -734,16 +741,19 @@ GetRotateAmount(ScreenOrientation aScreen, int aCameraMountAngle, bool aBackCame
 }
 
 // undefine to remove on-the-fly rotation support
-// #define DYNAMIC_GUM_ROTATION
+#define DYNAMIC_GUM_ROTATION
 
 void
 MediaEngineWebRTCVideoSource::Notify(const hal::ScreenConfiguration& aConfiguration) {
 #ifdef DYNAMIC_GUM_ROTATION
-  MonitorAutoLock enter(mMonitor);
-  mRotation = GetRotateAmount(aConfiguration.orientation(), mCameraAngle, mBackCamera);
+  if (mHasDirectListeners) {
+    // aka hooked to PeerConnection
+    MonitorAutoLock enter(mMonitor);
+    mRotation = GetRotateAmount(aConfiguration.orientation(), mCameraAngle, mBackCamera);
 
-  LOG(("*** New orientation: %d (Camera %d Back %d MountAngle: %d)",
-       mRotation, mCaptureIndex, mBackCamera, mCameraAngle));
+    LOG(("*** New orientation: %d (Camera %d Back %d MountAngle: %d)",
+         mRotation, mCaptureIndex, mBackCamera, mCameraAngle));
+  }
 #endif
 }
 
diff --git a/content/media/webspeech/recognition/SpeechStreamListener.cpp b/content/media/webspeech/recognition/SpeechStreamListener.cpp
index 1f2aba605e77..d8f77c3bb9e4 100644
--- a/content/media/webspeech/recognition/SpeechStreamListener.cpp
+++ b/content/media/webspeech/recognition/SpeechStreamListener.cpp
@@ -84,7 +84,8 @@ SpeechStreamListener::ConvertAndDispatchAudioChunk(int aDuration, float aVolume,
 }
 
 void
-SpeechStreamListener::NotifyFinished(MediaStreamGraph* aGraph)
+SpeechStreamListener::NotifyEvent(MediaStreamGraph* aGraph,
+                                  MediaStreamListener::MediaStreamGraphEvent event)
 {
   // TODO dispatch SpeechEnd event so services can be informed
 }
diff --git a/content/media/webspeech/recognition/SpeechStreamListener.h b/content/media/webspeech/recognition/SpeechStreamListener.h
index e6550a1ef1fa..ca6a11fcda67 100644
--- a/content/media/webspeech/recognition/SpeechStreamListener.h
+++ b/content/media/webspeech/recognition/SpeechStreamListener.h
@@ -30,7 +30,8 @@ public:
                                 uint32_t aTrackEvents,
                                 const MediaSegment& aQueuedMedia) MOZ_OVERRIDE;
 
-  void NotifyFinished(MediaStreamGraph* aGraph) MOZ_OVERRIDE;
+  void NotifyEvent(MediaStreamGraph* aGraph,
+                   MediaStreamListener::MediaStreamGraphEvent event) MOZ_OVERRIDE;
 
 private:
   template<typename SampleFormatType>
diff --git a/content/media/webspeech/synth/nsSpeechTask.cpp b/content/media/webspeech/synth/nsSpeechTask.cpp
index e75a7df38825..2a2b5e6477e4 100644
--- a/content/media/webspeech/synth/nsSpeechTask.cpp
+++ b/content/media/webspeech/synth/nsSpeechTask.cpp
@@ -49,11 +49,23 @@ public:
     }
   }
 
-  virtual void NotifyFinished(MediaStreamGraph* aGraph)
+  virtual void NotifyEvent(MediaStreamGraph* aGraph,
+                           MediaStreamListener::MediaStreamGraphEvent event) MOZ_OVERRIDE
   {
-    nsCOMPtr<nsIRunnable> event =
-      NS_NewRunnableMethod(this, &SynthStreamListener::DoNotifyFinished);
-    aGraph->DispatchToMainThreadAfterStreamStateUpdate(event.forget());
+    switch (event) {
+      case EVENT_FINISHED:
+        {
+          nsCOMPtr<nsIRunnable> runnable =
+            NS_NewRunnableMethod(this, &SynthStreamListener::DoNotifyFinished);
+          aGraph->DispatchToMainThreadAfterStreamStateUpdate(runnable.forget());
+        }
+        break;
+      case EVENT_REMOVED:
+        mSpeechTask = nullptr;
+        break;
+      default:
+        break;
+    }
   }
 
   virtual void NotifyBlockingChanged(MediaStreamGraph* aGraph, Blocking aBlocked)
@@ -66,11 +78,6 @@ public:
     }
   }
 
-  virtual void NotifyRemoved(MediaStreamGraph* aGraph)
-  {
-    mSpeechTask = nullptr;
-  }
-
 private:
   // Raw pointer; if we exist, the stream exists,
   // and 'mSpeechTask' exclusively owns it and therefor exists as well.
diff --git a/content/svg/content/src/SVGEllipseElement.cpp b/content/svg/content/src/SVGEllipseElement.cpp
index 512193af87c3..488f62345771 100644
--- a/content/svg/content/src/SVGEllipseElement.cpp
+++ b/content/svg/content/src/SVGEllipseElement.cpp
@@ -103,8 +103,7 @@ SVGEllipseElement::ConstructPath(gfxContext *aCtx)
   RefPtr<PathBuilder> builder = dt->CreatePathBuilder(fillRule);
   RefPtr<Path> path = BuildPath(builder);
   if (path) {
-    nsRefPtr<gfxPath> gfxpath = new gfxPath(path);
-    aCtx->SetPath(gfxpath);
+    aCtx->SetPath(path);
   }
 }
 
diff --git a/docshell/base/nsIContentViewer.idl b/docshell/base/nsIContentViewer.idl
index 2f7999c258fa..7f3d7c549144 100644
--- a/docshell/base/nsIContentViewer.idl
+++ b/docshell/base/nsIContentViewer.idl
@@ -27,7 +27,7 @@ class nsDOMNavigationTiming;
 [ptr] native nsViewPtr(nsView);
 [ptr] native nsDOMNavigationTimingPtr(nsDOMNavigationTiming);
 
-[scriptable, builtinclass, uuid(0cb321bd-5b38-4586-8fcd-d43b366886fb)]
+[scriptable, builtinclass, uuid(f92298b8-4fe3-40d1-aad7-44e704fffd0d)]
 interface nsIContentViewer : nsISupports
 {
 
@@ -176,8 +176,10 @@ interface nsIContentViewer : nsISupports
 
   /**
    * Returns whether this content viewer is in a hidden state.
+   *
+   * @note Only Gecko internal code should set the attribute!
    */
-  readonly attribute boolean isHidden;
+  attribute boolean isHidden;
 
   [noscript] readonly attribute nsIPresShellPtr presShell;
   [noscript] readonly attribute nsPresContextPtr presContext;
diff --git a/dom/apps/tests/file_packaged_app.sjs b/dom/apps/tests/file_packaged_app.sjs
index 9e0e44842ea6..90ff6cb133cc 100644
--- a/dom/apps/tests/file_packaged_app.sjs
+++ b/dom/apps/tests/file_packaged_app.sjs
@@ -20,12 +20,23 @@ var gDevUrl = "http://dev.url";
 function handleRequest(request, response) {
   var query = getQuery(request);
 
-  response.setHeader("Access-Control-Allow-Origin", "*", false);
-
   var packageSize = ("packageSize" in query) ? query.packageSize : 0;
   var appName = ("appName" in query) ? query.appName : gAppName;
   var devName = ("devName" in query) ? query.devName : gDevName;
   var devUrl = ("devUrl" in query) ? query.devUrl : gDevUrl;
+  // allowCancel just means deliver the file slowly so we have time to cancel it
+  var allowCancel = "allowCancel" in query;
+  var getPackage = "getPackage" in query;
+  var alreadyDeferred = Number(getState("alreadyDeferred"));
+
+  if (allowCancel && getPackage && !alreadyDeferred) {
+    // Only do this for the actual package delivery.
+    response.processAsync();
+    // And to avoid timer problems, only do this once.
+    setState("alreadyDeferred", "1");
+  }
+
+  response.setHeader("Access-Control-Allow-Origin", "*", false);
 
   // If this is a version update, update state, prepare the manifest,
   // the application package and return.
@@ -36,7 +47,8 @@ function handleRequest(request, response) {
     var packageName = "test_packaged_app_" + packageVersion + ".zip";
 
     setState("packageName", packageName);
-    var packagePath = "/" + gBasePath + "file_packaged_app.sjs?getPackage=" +
+    var packagePath = "/" + gBasePath + "file_packaged_app.sjs?" +
+                      (allowCancel?"allowCancel&": "") + "getPackage=" +
                       packageName;
     setState("packagePath", packagePath);
 
@@ -84,11 +96,19 @@ function handleRequest(request, response) {
   response.setHeader("Etag", etag, false);
 
   // Serve the application package corresponding to the requested app version.
-  if ("getPackage" in query) {
+  if (getPackage) {
     var resource = readFile(packageName, true);
     response.setHeader("Content-Type",
                        "Content-Type: application/java-archive", false);
-    response.write(resource);
+    if (allowCancel && !alreadyDeferred) {
+      var timer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
+      timer.initWithCallback(function (aTimer) {
+          response.write(resource);
+          response.finish();
+      }, 3000, Ci.nsITimer.TYPE_ONE_SHOT);
+    } else {
+      response.write(resource);
+    }
     return;
   }
 
diff --git a/dom/apps/tests/test_packaged_app_common.js b/dom/apps/tests/test_packaged_app_common.js
index 9a0bddbff4c3..abcdeacf6008 100644
--- a/dom/apps/tests/test_packaged_app_common.js
+++ b/dom/apps/tests/test_packaged_app_common.js
@@ -57,13 +57,17 @@ var PackagedTestHelper = (function PackagedTestHelper() {
     finish();
   }
 
-  function setAppVersion(aVersion, aCb, aDontUpdatePackage) {
+  function setAppVersion(aVersion, aCb, aDontUpdatePackage, aAllowCancel) {
     var xhr = new XMLHttpRequest();
     var dontUpdate = "";
+    var allowCancel = "";
     if (aDontUpdatePackage) {
       dontUpdate = "&dontUpdatePackage=1";
     }
-    var url = gSJS + "?setVersion=" + aVersion + dontUpdate;
+    if (aAllowCancel) {
+      allowCancel= "&allowCancel=1";
+    }
+    var url = gSJS + "?setVersion=" + aVersion + dontUpdate + allowCancel;
     xhr.addEventListener("load", function() {
                            is(xhr.responseText, "OK", "setAppVersion OK");
                            aCb();
diff --git a/dom/apps/tests/test_packaged_app_install.html b/dom/apps/tests/test_packaged_app_install.html
index e3f40b7967f1..2b6bc91a7cb8 100644
--- a/dom/apps/tests/test_packaged_app_install.html
+++ b/dom/apps/tests/test_packaged_app_install.html
@@ -34,7 +34,7 @@ function checkAppInstallError(aMiniManifestURL, aExpectedError) {
   req.onerror = function(evt) {
     var error = evt.target.error.name;
     if (error == aExpectedError) {
-      ok(true, "Got expected " + aExpectedError);
+      info("Got expected " + aExpectedError);
       PackagedTestHelper.next();
     } else {
       ok(false, "Got unexpected " + error);
@@ -46,7 +46,7 @@ function checkAppInstallError(aMiniManifestURL, aExpectedError) {
 function checkUninstallApp(aApp) {
   var req = navigator.mozApps.mgmt.uninstall(aApp);
   req.onsuccess = function() {
-    ok(true, "App uninstalled");
+    info("App uninstalled");
     aApp.ondownloadsuccess = null;
     aApp.ondownloaderror = null;
     aApp.onprogress = null;
@@ -83,11 +83,11 @@ var steps = [
     // Set up
     SpecialPowers.setAllAppsLaunchable(true);
     SpecialPowers.addPermission("webapps-manage", true, document);
-    ok(true, "Set up");
+    info("Set up");
     PackagedTestHelper.next();
   },
   function() {
-    ok(true, "autoConfirmAppInstall");
+    info("autoConfirmAppInstall");
     SpecialPowers.autoConfirmAppInstall(PackagedTestHelper.next);
   },
   function() {
@@ -96,17 +96,17 @@ var steps = [
   function() {
     // Bug 927699 - navigator.mozApps.install(url) lets NS_ERROR_FAILURE onto
     //              the web.
-    ok(true, "== TEST == INVALID_URL");
+    info("== TEST == INVALID_URL");
     checkAppInstallError("", "INVALID_URL");
   },
   function() {
     // Test network error.
-    ok(true, "== TEST == Network error");
+    info("== TEST == Network error");
     checkAppInstallError("http://notvalidurl", "NETWORK_ERROR");
   },
   function() {
     // Test wrong mini-manifest content type.
-    ok(true, "== TEST == Not valid mini-manifest content type");
+    info("== TEST == Not valid mini-manifest content type");
     var miniManifestURL = PackagedTestHelper.gSJS +
                           "?getManifest=true" +
                           "&noManifestContentType=true";
@@ -114,7 +114,7 @@ var steps = [
   },
   function() {
     // Test mini-manifest 'size' value is not number. Bug 839435.
-    ok(true, "== TEST == Size value is not a number");
+    info("== TEST == Size value is not a number");
     var miniManifestURL = PackagedTestHelper.gSJS +
                           "?getManifest=true" +
                           "&packageSize=\"NotANumber\"";
@@ -122,7 +122,7 @@ var steps = [
   },
   function() {
     // Test mini-manifest  negative 'size' value. Bug 839435.
-    ok(true, "== TEST == Negative size value");
+    info("== TEST == Negative size value");
     var miniManifestURL = PackagedTestHelper.gSJS +
                           "?getManifest=true" +
                           "&packageSize=-1";
@@ -130,7 +130,7 @@ var steps = [
   },
   function() {
     // Test wrong package path
-    ok(true, "== TEST == Installing app with wrong package path");
+    info("== TEST == Installing app with wrong package path");
     var miniManifestURL = PackagedTestHelper.gSJS +
                           "?getManifest=true" +
                           "&wrongPackagePath=true";
@@ -138,7 +138,7 @@ var steps = [
   },
   function() {
     // Test no manifest in zip file.
-    ok(true, "== TEST == No manifest in the zip file");
+    info("== TEST == No manifest in the zip file");
     var miniManifestURL = PackagedTestHelper.gSJS + "?getManifest=true";
     PackagedTestHelper.checkAppDownloadError(miniManifestURL,
                                             "MISSING_MANIFEST", 0, true, true,
@@ -150,7 +150,7 @@ var steps = [
   function() {
     // Test mini-manifest app name is different from the webapp manifest name.
     // Bug 844243.
-    ok(true, "== TEST == Mini-manifest app name is different from webapp " +
+    info("== TEST == Mini-manifest app name is different from webapp " +
              "manifest name");
     var miniManifestURL = PackagedTestHelper.gSJS +
                           "?getManifest=true" +
@@ -187,11 +187,11 @@ var steps = [
     PackagedTestHelper.setAppVersion(2, PackagedTestHelper.next);
   },
   function() {
-    ok(true, "== TEST == Install packaged app");
+    info("== TEST == Install packaged app");
     var miniManifestURL = PackagedTestHelper.gSJS +
                           "?getManifest=true";
     navigator.mozApps.mgmt.oninstall = function(evt) {
-      ok(true, "Got oninstall event");
+      info("Got oninstall event");
       PackagedTestHelper.gApp = evt.application;
       PackagedTestHelper.gApp.ondownloaderror = function() {
         ok(false, "Download error " +
@@ -199,7 +199,7 @@ var steps = [
         PackagedTestHelper.finish();
       };
       PackagedTestHelper.gApp.ondownloadsuccess = function() {
-        ok(true, "App downloaded");
+        info("App downloaded");
         var expected = {
           name: PackagedTestHelper.gAppName,
           manifestURL: miniManifestURL,
@@ -220,11 +220,85 @@ var steps = [
     var request = navigator.mozApps.installPackage(miniManifestURL);
     request.onerror = PackagedTestHelper.mozAppsError;
     request.onsuccess = function() {
-      ok(true, "Application installed");
+      info("Application installed");
     };
   },
   function() {
-    ok(true, "all done!\n");
+    PackagedTestHelper.setAppVersion(3, PackagedTestHelper.next, false, true);
+  },
+  function() {
+    info("== TEST == Install packaged app with a cancel/resume");
+    var miniManifestURL = PackagedTestHelper.gSJS +
+                          "?getManifest=true&allowCancel";
+    navigator.mozApps.mgmt.oninstall = function(evt) {
+      info("Got oninstall event");
+      PackagedTestHelper.gApp = evt.application;
+
+      PackagedTestHelper.gApp.onprogress = function() {
+        // Let's try cancelling and resuming the download later on.
+        PackagedTestHelper.gApp.cancelDownload();
+        // And only do this once.
+        PackagedTestHelper.gApp.onprogress = null;
+      };
+
+      var alreadyCancelled = false;
+      PackagedTestHelper.gApp.ondownloaderror = function() {
+        ok(!alreadyCancelled, "The download should be cancelled only once!");
+        is(PackagedTestHelper.gApp.downloadError.name, "DOWNLOAD_CANCELED",
+           "Download error " + PackagedTestHelper.gApp.downloadError.name);
+        if (!alreadyCancelled) {
+          PackagedTestHelper.gApp.download();
+          alreadyCancelled = true;
+        }
+      };
+
+      PackagedTestHelper.gApp.ondownloadsuccess = function() {
+        info("App downloaded");
+        // We could try also applying the download we just made.
+        var expected = {
+          name: PackagedTestHelper.gAppName,
+          manifestURL: miniManifestURL,
+          installOrigin: PackagedTestHelper.gInstallOrigin,
+          progress: 0,
+          installState: "pending",
+          downloadAvailable: false,
+          downloading: false,
+          downloadSize: 0,
+          size: 0,
+          readyToApplyDownload: true
+        };
+        PackagedTestHelper.checkAppState(PackagedTestHelper.gApp, 3, expected,
+                                         true, false, function() {});
+      };
+
+      PackagedTestHelper.gApp.ondownloadapplied = function() {
+        info("App download applied.");
+        var expected = {
+          name: PackagedTestHelper.gAppName,
+          manifestURL: miniManifestURL,
+          installOrigin: PackagedTestHelper.gInstallOrigin,
+          progress: 0,
+          installState: "installed",
+          downloadAvailable: false,
+          downloading: false,
+          downloadSize: 0,
+          size: 0,
+          readyToApplyDownload: false
+        };
+        PackagedTestHelper.checkAppState(PackagedTestHelper.gApp, 3, expected,
+                                         true, false, PackagedTestHelper.next);
+      }
+
+    };
+
+    var request = navigator.mozApps.installPackage(miniManifestURL);
+    request.onerror = PackagedTestHelper.mozAppsError;
+    request.onsuccess = function() {
+      info("Application installed");
+    };
+  },
+  function() {
+    info("all done!\n");
     PackagedTestHelper.finish();
   }
 ];
diff --git a/dom/base/URL.cpp b/dom/base/URL.cpp
index d002dd64e030..80fe487d8471 100644
--- a/dom/base/URL.cpp
+++ b/dom/base/URL.cpp
@@ -204,7 +204,7 @@ URL::RevokeObjectURL(const GlobalObject& aGlobal, const nsAString& aURL)
 }
 
 void
-URL::GetHref(nsString& aHref) const
+URL::GetHref(nsString& aHref, ErrorResult& aRv) const
 {
   aHref.Truncate();
 
@@ -240,13 +240,13 @@ URL::SetHref(const nsAString& aHref, ErrorResult& aRv)
 }
 
 void
-URL::GetOrigin(nsString& aOrigin) const
+URL::GetOrigin(nsString& aOrigin, ErrorResult& aRv) const
 {
   nsContentUtils::GetUTFNonNullOrigin(mURI, aOrigin);
 }
 
 void
-URL::GetProtocol(nsString& aProtocol) const
+URL::GetProtocol(nsString& aProtocol, ErrorResult& aRv) const
 {
   nsCString protocol;
   if (NS_SUCCEEDED(mURI->GetScheme(protocol))) {
@@ -258,7 +258,7 @@ URL::GetProtocol(nsString& aProtocol) const
 }
 
 void
-URL::SetProtocol(const nsAString& aProtocol)
+URL::SetProtocol(const nsAString& aProtocol, ErrorResult& aRv)
 {
   nsAString::const_iterator start, end;
   aProtocol.BeginReading(start);
@@ -305,37 +305,37 @@ URL::SetProtocol(const nsAString& aProtocol)
   }
 
 void
-URL::GetUsername(nsString& aUsername) const
+URL::GetUsername(nsString& aUsername, ErrorResult& aRv) const
 {
   URL_GETTER(aUsername, GetUsername);
 }
 
 void
-URL::SetUsername(const nsAString& aUsername)
+URL::SetUsername(const nsAString& aUsername, ErrorResult& aRv)
 {
   mURI->SetUsername(NS_ConvertUTF16toUTF8(aUsername));
 }
 
 void
-URL::GetPassword(nsString& aPassword) const
+URL::GetPassword(nsString& aPassword, ErrorResult& aRv) const
 {
   URL_GETTER(aPassword, GetPassword);
 }
 
 void
-URL::SetPassword(const nsAString& aPassword)
+URL::SetPassword(const nsAString& aPassword, ErrorResult& aRv)
 {
   mURI->SetPassword(NS_ConvertUTF16toUTF8(aPassword));
 }
 
 void
-URL::GetHost(nsString& aHost) const
+URL::GetHost(nsString& aHost, ErrorResult& aRv) const
 {
   URL_GETTER(aHost, GetHostPort);
 }
 
 void
-URL::SetHost(const nsAString& aHost)
+URL::SetHost(const nsAString& aHost, ErrorResult& aRv)
 {
   mURI->SetHostPort(NS_ConvertUTF16toUTF8(aHost));
 }
@@ -370,7 +370,7 @@ URL::UpdateURLSearchParams()
 }
 
 void
-URL::GetHostname(nsString& aHostname) const
+URL::GetHostname(nsString& aHostname, ErrorResult& aRv) const
 {
   aHostname.Truncate();
   nsAutoCString tmp;
@@ -387,7 +387,7 @@ URL::GetHostname(nsString& aHostname) const
 }
 
 void
-URL::SetHostname(const nsAString& aHostname)
+URL::SetHostname(const nsAString& aHostname, ErrorResult& aRv)
 {
   // nsStandardURL returns NS_ERROR_UNEXPECTED for an empty hostname
   // The return code is silently ignored
@@ -395,7 +395,7 @@ URL::SetHostname(const nsAString& aHostname)
 }
 
 void
-URL::GetPort(nsString& aPort) const
+URL::GetPort(nsString& aPort, ErrorResult& aRv) const
 {
   aPort.Truncate();
 
@@ -409,7 +409,7 @@ URL::GetPort(nsString& aPort) const
 }
 
 void
-URL::SetPort(const nsAString& aPort)
+URL::SetPort(const nsAString& aPort, ErrorResult& aRv)
 {
   nsresult rv;
   nsAutoString portStr(aPort);
@@ -427,7 +427,7 @@ URL::SetPort(const nsAString& aPort)
 }
 
 void
-URL::GetPathname(nsString& aPathname) const
+URL::GetPathname(nsString& aPathname, ErrorResult& aRv) const
 {
   aPathname.Truncate();
 
@@ -446,7 +446,7 @@ URL::GetPathname(nsString& aPathname) const
 }
 
 void
-URL::SetPathname(const nsAString& aPathname)
+URL::SetPathname(const nsAString& aPathname, ErrorResult& aRv)
 {
   nsCOMPtr<nsIURL> url(do_QueryInterface(mURI));
   if (!url) {
@@ -458,7 +458,7 @@ URL::SetPathname(const nsAString& aPathname)
 }
 
 void
-URL::GetSearch(nsString& aSearch) const
+URL::GetSearch(nsString& aSearch, ErrorResult& aRv) const
 {
   aSearch.Truncate();
 
@@ -477,7 +477,7 @@ URL::GetSearch(nsString& aSearch) const
 }
 
 void
-URL::SetSearch(const nsAString& aSearch)
+URL::SetSearch(const nsAString& aSearch, ErrorResult& aRv)
 {
   SetSearchInternal(aSearch);
   UpdateURLSearchParams();
@@ -519,7 +519,7 @@ URL::SetSearchParams(URLSearchParams& aSearchParams)
 }
 
 void
-URL::GetHash(nsString& aHash) const
+URL::GetHash(nsString& aHash, ErrorResult& aRv) const
 {
   aHash.Truncate();
 
@@ -533,7 +533,7 @@ URL::GetHash(nsString& aHash) const
 }
 
 void
-URL::SetHash(const nsAString& aHash)
+URL::SetHash(const nsAString& aHash, ErrorResult& aRv)
 {
   mURI->SetRef(NS_ConvertUTF16toUTF8(aHash));
 }
diff --git a/dom/base/URL.h b/dom/base/URL.h
index 75bb13c93d67..1ed7b85dcbcb 100644
--- a/dom/base/URL.h
+++ b/dom/base/URL.h
@@ -69,55 +69,55 @@ public:
   static void RevokeObjectURL(const GlobalObject& aGlobal,
                               const nsAString& aURL);
 
-  void GetHref(nsString& aHref) const;
+  void GetHref(nsString& aHref, ErrorResult& aRv) const;
 
   void SetHref(const nsAString& aHref, ErrorResult& aRv);
 
-  void GetOrigin(nsString& aOrigin) const;
+  void GetOrigin(nsString& aOrigin, ErrorResult& aRv) const;
 
-  void GetProtocol(nsString& aProtocol) const;
+  void GetProtocol(nsString& aProtocol, ErrorResult& aRv) const;
 
-  void SetProtocol(const nsAString& aProtocol);
+  void SetProtocol(const nsAString& aProtocol, ErrorResult& aRv);
 
-  void GetUsername(nsString& aUsername) const;
+  void GetUsername(nsString& aUsername, ErrorResult& aRv) const;
 
-  void SetUsername(const nsAString& aUsername);
+  void SetUsername(const nsAString& aUsername, ErrorResult& aRv);
 
-  void GetPassword(nsString& aPassword) const;
+  void GetPassword(nsString& aPassword, ErrorResult& aRv) const;
 
-  void SetPassword(const nsAString& aPassword);
+  void SetPassword(const nsAString& aPassword, ErrorResult& aRv);
 
-  void GetHost(nsString& aHost) const;
+  void GetHost(nsString& aHost, ErrorResult& aRv) const;
 
-  void SetHost(const nsAString& aHost);
+  void SetHost(const nsAString& aHost, ErrorResult& aRv);
 
-  void GetHostname(nsString& aHostname) const;
+  void GetHostname(nsString& aHostname, ErrorResult& aRv) const;
 
-  void SetHostname(const nsAString& aHostname);
+  void SetHostname(const nsAString& aHostname, ErrorResult& aRv);
 
-  void GetPort(nsString& aPort) const;
+  void GetPort(nsString& aPort, ErrorResult& aRv) const;
 
-  void SetPort(const nsAString& aPort);
+  void SetPort(const nsAString& aPort, ErrorResult& aRv);
 
-  void GetPathname(nsString& aPathname) const;
+  void GetPathname(nsString& aPathname, ErrorResult& aRv) const;
 
-  void SetPathname(const nsAString& aPathname);
+  void SetPathname(const nsAString& aPathname, ErrorResult& aRv);
 
-  void GetSearch(nsString& aRetval) const;
+  void GetSearch(nsString& aRetval, ErrorResult& aRv) const;
 
-  void SetSearch(const nsAString& aArg);
+  void SetSearch(const nsAString& aArg, ErrorResult& aRv);
 
   URLSearchParams* SearchParams();
 
   void SetSearchParams(URLSearchParams& aSearchParams);
 
-  void GetHash(nsString& aRetval) const;
+  void GetHash(nsString& aRetval, ErrorResult& aRv) const;
 
-  void SetHash(const nsAString& aArg);
+  void SetHash(const nsAString& aArg, ErrorResult& aRv);
 
-  void Stringify(nsString& aRetval) const
+  void Stringify(nsString& aRetval, ErrorResult& aRv) const
   {
-    GetHref(aRetval);
+    GetHref(aRetval, aRv);
   }
 
   // URLSearchParamsObserver
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index a93d8e7b2e8a..f12f6c2fa4eb 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -9649,14 +9649,14 @@ nsGlobalWindow::GetPrivateRoot()
 }
 
 
-nsIDOMLocation*
+nsLocation*
 nsGlobalWindow::GetLocation(ErrorResult& aError)
 {
   FORWARD_TO_INNER_OR_THROW(GetLocation, (aError), aError, nullptr);
 
   nsIDocShell *docShell = GetDocShell();
   if (!mLocation && docShell) {
-    mLocation = new nsLocation(docShell);
+    mLocation = new nsLocation(this, docShell);
   }
   return mLocation;
 }
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 4e70b9d7926f..3fac9cd869b3 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -827,7 +827,7 @@ public:
   }
   void GetName(nsAString& aName, mozilla::ErrorResult& aError);
   void SetName(const nsAString& aName, mozilla::ErrorResult& aError);
-  nsIDOMLocation* GetLocation(mozilla::ErrorResult& aError);
+  nsLocation* GetLocation(mozilla::ErrorResult& aError);
   nsHistory* GetHistory(mozilla::ErrorResult& aError);
   mozilla::dom::BarProp* GetLocationbar(mozilla::ErrorResult& aError);
   mozilla::dom::BarProp* GetMenubar(mozilla::ErrorResult& aError);
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 2144e0d80082..109eb5e2c97e 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -3079,16 +3079,6 @@ mozilla::dom::ShutdownJSEnvironment()
   sDidShutdown = true;
 }
 
-class nsJSArgArray;
-
-namespace mozilla {
-template<>
-struct HasDangerousPublicDestructor<nsJSArgArray>
-{
-  static const bool value = true;
-};
-}
-
 // A fast-array class for JS.  This class supports both nsIJSScriptArray and
 // nsIArray.  If it is JS itself providing and consuming this class, all work
 // can be done via nsIJSScriptArray, and avoid the conversion of elements
@@ -3099,7 +3089,7 @@ class nsJSArgArray MOZ_FINAL : public nsIJSArgArray {
 public:
   nsJSArgArray(JSContext *aContext, uint32_t argc, JS::Value *argv,
                nsresult *prv);
-  ~nsJSArgArray();
+
   // nsISupports
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsJSArgArray,
@@ -3114,6 +3104,7 @@ public:
   void ReleaseJSObjects();
 
 protected:
+  ~nsJSArgArray();
   JSContext *mContext;
   JS::Heap<JS::Value> *mArgv;
   uint32_t mArgc;
@@ -3243,13 +3234,11 @@ nsresult NS_CreateJSArgv(JSContext *aContext, uint32_t argc, void *argv,
                          nsIJSArgArray **aArray)
 {
   nsresult rv;
-  nsJSArgArray *ret = new nsJSArgArray(aContext, argc,
-                                       static_cast<JS::Value *>(argv), &rv);
-  if (ret == nullptr)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsCOMPtr<nsIJSArgArray> ret = new nsJSArgArray(aContext, argc,
+                                                static_cast<JS::Value *>(argv), &rv);
   if (NS_FAILED(rv)) {
-    delete ret;
     return rv;
   }
-  return ret->QueryInterface(NS_GET_IID(nsIArray), (void **)aArray);
+  ret.forget(aArray);
+  return NS_OK;
 }
diff --git a/dom/base/nsJSTimeoutHandler.cpp b/dom/base/nsJSTimeoutHandler.cpp
index ed387b011cbb..ed38513f36d9 100644
--- a/dom/base/nsJSTimeoutHandler.cpp
+++ b/dom/base/nsJSTimeoutHandler.cpp
@@ -349,8 +349,8 @@ nsJSScriptTimeoutHandler::Init(nsGlobalWindow *aWindow, bool *aIsInterval,
       return error.ErrorCode();
     }
 
-    mExpr.Append(JS_GetFlatStringChars(expr),
-                 JS_GetStringLength(JS_FORGET_STRING_FLATNESS(expr)));
+    MOZ_ASSERT(mExpr.IsEmpty());
+    AssignJSFlatString(mExpr, expr);
 
     // Get the calling location.
     const char *filename;
diff --git a/dom/base/nsJSUtils.h b/dom/base/nsJSUtils.h
index d78151a21d0c..d9c78a566cfa 100644
--- a/dom/base/nsJSUtils.h
+++ b/dom/base/nsJSUtils.h
@@ -157,6 +157,18 @@ AssignJSString(JSContext *cx, T &dest, JSString *s)
   return true;
 }
 
+inline void
+AssignJSFlatString(nsAString &dest, JSFlatString *s)
+{
+  size_t len = js::GetFlatStringLength(s);
+  static_assert(js::MaxStringLength < (1 << 28),
+                "Shouldn't overflow here or in SetCapacity");
+  dest.SetCapacity(len + 1);
+  js::CopyFlatStringChars(dest.BeginWriting(), s, len);
+  dest.BeginWriting()[len] = '\0';
+  dest.SetLength(len);
+}
+
 class nsAutoJSString : public nsAutoString
 {
 public:
diff --git a/dom/base/nsLocation.cpp b/dom/base/nsLocation.cpp
index c939e98c169e..4727e4bdb040 100644
--- a/dom/base/nsLocation.cpp
+++ b/dom/base/nsLocation.cpp
@@ -32,6 +32,10 @@
 #include "nsCycleCollectionParticipant.h"
 #include "nsNullPrincipal.h"
 #include "ScriptSettings.h"
+#include "mozilla/dom/LocationBinding.h"
+
+using namespace mozilla;
+using namespace mozilla::dom;
 
 static nsresult
 GetDocumentCharacterSetForURI(const nsAString& aHref, nsACString& aCharset)
@@ -52,13 +56,14 @@ GetDocumentCharacterSetForURI(const nsAString& aHref, nsACString& aCharset)
   return NS_OK;
 }
 
-nsLocation::nsLocation(nsIDocShell *aDocShell)
+nsLocation::nsLocation(nsPIDOMWindow* aWindow, nsIDocShell *aDocShell)
+  : mInnerWindow(aWindow)
 {
   MOZ_ASSERT(aDocShell);
+  MOZ_ASSERT(mInnerWindow->IsInnerWindow());
+  SetIsDOMBinding();
 
   mDocShell = do_GetWeakReference(aDocShell);
-  nsCOMPtr<nsIDOMWindow> outer = aDocShell->GetWindow();
-  mOuter = do_GetWeakReference(outer);
 }
 
 nsLocation::~nsLocation()
@@ -75,7 +80,7 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsLocation)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(Location)
 NS_INTERFACE_MAP_END
 
-NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_0(nsLocation)
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(nsLocation, mInnerWindow)
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsLocation)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsLocation)
 
@@ -729,6 +734,102 @@ nsLocation::SetProtocol(const nsAString& aProtocol)
   return SetURI(uri);
 }
 
+void
+nsLocation::GetUsername(nsAString& aUsername, ErrorResult& aError)
+{
+  if (!CallerSubsumes()) {
+    aError.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  aUsername.Truncate();
+  nsCOMPtr<nsIURI> uri;
+  nsresult result = GetURI(getter_AddRefs(uri));
+  if (uri) {
+    nsAutoCString username;
+    result = uri->GetUsername(username);
+    if (NS_SUCCEEDED(result)) {
+      CopyUTF8toUTF16(username, aUsername);
+    }
+  }
+}
+
+void
+nsLocation::SetUsername(const nsAString& aUsername, ErrorResult& aError)
+{
+  if (!CallerSubsumes()) {
+    aError.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = GetWritableURI(getter_AddRefs(uri));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    aError.Throw(rv);
+    return;
+  }
+
+  if (!uri) {
+    return;
+  }
+
+  rv = uri->SetUsername(NS_ConvertUTF16toUTF8(aUsername));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    aError.Throw(rv);
+    return;
+  }
+
+  rv = SetURI(uri);
+}
+
+void
+nsLocation::GetPassword(nsAString& aPassword, ErrorResult& aError)
+{
+  if (!CallerSubsumes()) {
+    aError.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  aPassword.Truncate();
+  nsCOMPtr<nsIURI> uri;
+  nsresult result = GetURI(getter_AddRefs(uri));
+  if (uri) {
+    nsAutoCString password;
+    result = uri->GetPassword(password);
+    if (NS_SUCCEEDED(result)) {
+      CopyUTF8toUTF16(password, aPassword);
+    }
+  }
+}
+
+void
+nsLocation::SetPassword(const nsAString& aPassword, ErrorResult& aError)
+{
+  if (!CallerSubsumes()) {
+    aError.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = GetWritableURI(getter_AddRefs(uri));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    aError.Throw(rv);
+    return;
+  }
+
+  if (!uri) {
+    return;
+  }
+
+  rv = uri->SetPassword(NS_ConvertUTF16toUTF8(aPassword));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    aError.Throw(rv);
+    return;
+  }
+
+  rv = SetURI(uri);
+}
+
 NS_IMETHODIMP
 nsLocation::GetSearch(nsAString& aSearch)
 {
@@ -918,8 +1019,12 @@ nsLocation::GetSourceBaseURL(JSContext* cx, nsIURI** sourceURL)
 bool
 nsLocation::CallerSubsumes()
 {
-  // Get the principal associated with the location object.
-  nsCOMPtr<nsIDOMWindow> outer = do_QueryReferent(mOuter);
+  // Get the principal associated with the location object.  Note that this is
+  // the principal of the page which will actually be navigated, not the
+  // principal of the Location object itself.  This is why we need this check
+  // even though we only allow limited cross-origin access to Location objects
+  // in general.
+  nsCOMPtr<nsIDOMWindow> outer = mInnerWindow->GetOuterWindow();
   if (MOZ_UNLIKELY(!outer))
     return false;
   nsCOMPtr<nsIScriptObjectPrincipal> sop = do_QueryInterface(outer);
@@ -928,3 +1033,9 @@ nsLocation::CallerSubsumes()
   NS_ENSURE_SUCCESS(rv, false);
   return subsumes;
 }
+
+JSObject*
+nsLocation::WrapObject(JSContext* aCx)
+{
+  return LocationBinding::Wrap(aCx, this);
+}
diff --git a/dom/base/nsLocation.h b/dom/base/nsLocation.h
index f688f5737931..f3fc3b4d73e6 100644
--- a/dom/base/nsLocation.h
+++ b/dom/base/nsLocation.h
@@ -13,6 +13,8 @@
 #include "nsWrapperCache.h"
 #include "nsCycleCollectionParticipant.h"
 #include "js/TypeDecls.h"
+#include "mozilla/ErrorResult.h"
+#include "nsPIDOMWindow.h"
 
 class nsIURI;
 class nsIDocShell;
@@ -22,11 +24,13 @@ class nsIDocShellLoadInfo;
 // nsLocation: Script "location" object
 //*****************************************************************************
 
-class nsLocation : public nsIDOMLocation
-                 , public nsWrapperCache
+class nsLocation MOZ_FINAL : public nsIDOMLocation
+                           , public nsWrapperCache
 {
+  typedef mozilla::ErrorResult ErrorResult;
+
 public:
-  nsLocation(nsIDocShell *aDocShell);
+  nsLocation(nsPIDOMWindow* aWindow, nsIDocShell *aDocShell);
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsLocation)
@@ -37,6 +41,101 @@ public:
   // nsIDOMLocation
   NS_DECL_NSIDOMLOCATION
 
+  // WebIDL API:
+  void Assign(const nsAString& aUrl, ErrorResult& aError)
+  {
+    aError = Assign(aUrl);
+  }
+  void Replace(const nsAString& aUrl, ErrorResult& aError)
+  {
+    aError = Replace(aUrl);
+  }
+  void Reload(bool aForceget, ErrorResult& aError)
+  {
+    aError = Reload(aForceget);
+  }
+  void GetHref(nsAString& aHref, ErrorResult& aError)
+  {
+    aError = GetHref(aHref);
+  }
+  void SetHref(const nsAString& aHref, ErrorResult& aError)
+  {
+    aError = SetHref(aHref);
+  }
+  void GetOrigin(nsAString& aOrigin, ErrorResult& aError)
+  {
+    aError = GetOrigin(aOrigin);
+  }
+  void GetProtocol(nsAString& aProtocol, ErrorResult& aError)
+  {
+    aError = GetProtocol(aProtocol);
+  }
+  void SetProtocol(const nsAString& aProtocol, ErrorResult& aError)
+  {
+    aError = SetProtocol(aProtocol);
+  }
+  void GetUsername(nsAString& aUsername, ErrorResult& aError);
+  void SetUsername(const nsAString& aUsername, ErrorResult& aError);
+  void GetPassword(nsAString& aPassword, ErrorResult& aError);
+  void SetPassword(const nsAString& aPassword, ErrorResult& aError);
+  void GetHost(nsAString& aHost, ErrorResult& aError)
+  {
+    aError = GetHost(aHost);
+  }
+  void SetHost(const nsAString& aHost, ErrorResult& aError)
+  {
+    aError = SetHost(aHost);
+  }
+  void GetHostname(nsAString& aHostname, ErrorResult& aError)
+  {
+    aError = GetHostname(aHostname);
+  }
+  void SetHostname(const nsAString& aHostname, ErrorResult& aError)
+  {
+    aError = SetHostname(aHostname);
+  }
+  void GetPort(nsAString& aPort, ErrorResult& aError)
+  {
+    aError = GetPort(aPort);
+  }
+  void SetPort(const nsAString& aPort, ErrorResult& aError)
+  {
+    aError = SetPort(aPort);
+  }
+  void GetPathname(nsAString& aPathname, ErrorResult& aError)
+  {
+    aError = GetPathname(aPathname);
+  }
+  void SetPathname(const nsAString& aPathname, ErrorResult& aError)
+  {
+    aError = SetPathname(aPathname);
+  }
+  void GetSearch(nsAString& aSeach, ErrorResult& aError)
+  {
+    aError = GetSearch(aSeach);
+  }
+  void SetSearch(const nsAString& aSeach, ErrorResult& aError)
+  {
+    aError = SetSearch(aSeach);
+  }
+  void GetHash(nsAString& aHash, ErrorResult& aError)
+  {
+    aError = GetHash(aHash);
+  }
+  void SetHash(const nsAString& aHash, ErrorResult& aError)
+  {
+    aError = SetHash(aHash);
+  }
+  void Stringify(nsAString& aRetval, ErrorResult& aError)
+  {
+    GetHref(aRetval, aError);
+  }
+  nsPIDOMWindow* GetParentObject() const
+  {
+    return mInnerWindow;
+  }
+  virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
+
 protected:
   virtual ~nsLocation();
 
@@ -56,8 +155,8 @@ protected:
   bool CallerSubsumes();
 
   nsString mCachedHash;
+  nsCOMPtr<nsPIDOMWindow> mInnerWindow;
   nsWeakPtr mDocShell;
-  nsWeakPtr mOuter;
 };
 
 #endif // nsLocation_h__
diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index 7153836c3244..275e43d1a133 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -86,10 +86,13 @@ ThrowInvalidThis(JSContext* aCx, const JS::CallArgs& aArgs,
   MOZ_ASSERT(func);
   JS::Rooted<JSString*> funcName(aCx, JS_GetFunctionDisplayId(func));
   MOZ_ASSERT(funcName);
+  nsAutoJSString funcNameStr;
+  if (!funcNameStr.init(aCx, funcName)) {
+    return false;
+  }
   JS_ReportErrorNumberUC(aCx, GetErrorMessage, nullptr,
                          static_cast<const unsigned>(aErrorNumber),
-                         JS_GetStringCharsZ(aCx, funcName),
-                         ifaceName.get());
+                         funcNameStr.get(), ifaceName.get());
   return false;
 }
 
@@ -909,6 +912,14 @@ GetInterfaceImpl(JSContext* aCx, nsIInterfaceRequestor* aRequestor,
   }
 }
 
+bool
+UnforgeableValueOf(JSContext* cx, unsigned argc, JS::Value* vp)
+{
+  JS::CallArgs args = JS::CallArgsFromVp(argc, vp);
+  args.rval().set(args.thisv());
+  return true;
+}
+
 bool
 ThrowingConstructor(JSContext* cx, unsigned argc, JS::Value* vp)
 {
@@ -1053,18 +1064,91 @@ XrayResolveAttribute(JSContext* cx, JS::Handle<JSObject*> wrapper,
   return true;
 }
 
+static bool
+XrayResolveMethod(JSContext* cx, JS::Handle<JSObject*> wrapper,
+                  JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
+                  const Prefable<const JSFunctionSpec>* methods,
+                  jsid* methodIds,
+                  const JSFunctionSpec* methodsSpecs,
+                  JS::MutableHandle<JSPropertyDescriptor> desc)
+{
+  const Prefable<const JSFunctionSpec>* method;
+  for (method = methods; method->specs; ++method) {
+    if (method->isEnabled(cx, obj)) {
+      // Set i to be the index into our full list of ids/specs that we're
+      // looking at now.
+      size_t i = method->specs - methodsSpecs;
+      for ( ; methodIds[i] != JSID_VOID; ++i) {
+        if (id == methodIds[i]) {
+          const JSFunctionSpec& methodSpec = methodsSpecs[i];
+          JSFunction *fun;
+          if (methodSpec.selfHostedName) {
+            fun = JS::GetSelfHostedFunction(cx, methodSpec.selfHostedName, id, methodSpec.nargs);
+            if (!fun) {
+              return false;
+            }
+            MOZ_ASSERT(!methodSpec.call.op, "Bad FunctionSpec declaration: non-null native");
+            MOZ_ASSERT(!methodSpec.call.info, "Bad FunctionSpec declaration: non-null jitinfo");
+          } else {
+            fun = JS_NewFunctionById(cx, methodSpec.call.op, methodSpec.nargs, 0, wrapper, id);
+            if (!fun) {
+              return false;
+            }
+            SET_JITINFO(fun, methodSpec.call.info);
+          }
+          JSObject *funobj = JS_GetFunctionObject(fun);
+          desc.value().setObject(*funobj);
+          desc.setAttributes(methodSpec.flags);
+          desc.object().set(wrapper);
+          desc.setSetter(nullptr);
+          desc.setGetter(nullptr);
+          return true;
+        }
+      }
+    }
+  }
+  return true;
+}
+
 /* static */ bool
 XrayResolveUnforgeableProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
                                JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
                                JS::MutableHandle<JSPropertyDescriptor> desc,
                                const NativeProperties* nativeProperties)
 {
-  return !nativeProperties || !nativeProperties->unforgeableAttributes ||
-         XrayResolveAttribute(cx, wrapper, obj, id,
+  if (!nativeProperties) {
+    return true;
+  }
+
+  if (nativeProperties->unforgeableAttributes) {
+    if (!XrayResolveAttribute(cx, wrapper, obj, id,
                               nativeProperties->unforgeableAttributes,
                               nativeProperties->unforgeableAttributeIds,
                               nativeProperties->unforgeableAttributeSpecs,
-                              desc);
+                              desc)) {
+      return false;
+    }
+
+    if (desc.object()) {
+      return true;
+    }
+  }
+
+  if (nativeProperties->unforgeableMethods) {
+    if (!XrayResolveMethod(cx, wrapper, obj, id,
+                           nativeProperties->unforgeableMethods,
+                           nativeProperties->unforgeableMethodIds,
+                           nativeProperties->unforgeableMethodSpecs,
+                           desc)) {
+      return false;
+    }
+
+    if (desc.object()) {
+      return true;
+    }
+  }
+
+  return true;
 }
 
 static bool
@@ -1086,40 +1170,12 @@ XrayResolveProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
     methodsSpecs = nativeProperties->methodsSpecs;
   }
   if (methods) {
-    const Prefable<const JSFunctionSpec>* method;
-    for (method = methods; method->specs; ++method) {
-      if (method->isEnabled(cx, obj)) {
-        // Set i to be the index into our full list of ids/specs that we're
-        // looking at now.
-        size_t i = method->specs - methodsSpecs;
-        for ( ; methodIds[i] != JSID_VOID; ++i) {
-          if (id == methodIds[i]) {
-            const JSFunctionSpec& methodSpec = methodsSpecs[i];
-            JSFunction *fun;
-            if (methodSpec.selfHostedName) {
-              fun = JS::GetSelfHostedFunction(cx, methodSpec.selfHostedName, id, methodSpec.nargs);
-              if (!fun) {
-                return false;
-              }
-              MOZ_ASSERT(!methodSpec.call.op, "Bad FunctionSpec declaration: non-null native");
-              MOZ_ASSERT(!methodSpec.call.info, "Bad FunctionSpec declaration: non-null jitinfo");
-            } else {
-              fun = JS_NewFunctionById(cx, methodSpec.call.op, methodSpec.nargs, 0, wrapper, id);
-              if (!fun) {
-                return false;
-              }
-              SET_JITINFO(fun, methodSpec.call.info);
-            }
-            JSObject *funobj = JS_GetFunctionObject(fun);
-            desc.value().setObject(*funobj);
-            desc.setAttributes(methodSpec.flags);
-            desc.object().set(wrapper);
-            desc.setSetter(nullptr);
-            desc.setGetter(nullptr);
-           return true;
-          }
-        }
-      }
+    if (!XrayResolveMethod(cx, wrapper, obj, id, methods, methodIds,
+                           methodsSpecs, desc)) {
+      return false;
+    }
+    if (desc.object()) {
+      return true;
     }
   }
 
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index 30ec98c95bb7..492358459ab9 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -1700,6 +1700,9 @@ GetInterface(JSContext* aCx, T* aThis, nsIJSID* aIID,
   GetInterfaceImpl(aCx, aThis, aThis, aIID, aRetval, aError);
 }
 
+bool
+UnforgeableValueOf(JSContext* cx, unsigned argc, JS::Value* vp);
+
 bool
 ThrowingConstructor(JSContext* cx, unsigned argc, JS::Value* vp);
 
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index dcabf2bacae3..d337e31a32e4 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -742,11 +742,7 @@ DOMInterfaces = {
 },
 
 'Location': {
-    # NOTE: Before you turn on codegen for Location, make sure all the
-    # Unforgeable stuff is dealt with.
-    'nativeType': 'nsIDOMLocation',
-    'skipGen': True,
-    'register': False
+    'nativeType': 'nsLocation',
 },
 
 'MediaList': {
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 3755edd20153..a43af48895ad 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -489,10 +489,22 @@ def PrototypeIDAndDepth(descriptor):
     return (prototypeID, depth)
 
 
+def MemberIsUnforgeable(member, descriptor):
+    # Note: "or" and "and" return either their LHS or RHS, not
+    # necessarily booleans.  Make sure to return a boolean from this
+    # method, because callers will compare its return value to
+    # booleans.
+    return bool((member.isAttr() or member.isMethod()) and
+                not member.isStatic() and
+                (member.isUnforgeable() or
+                 descriptor.interface.getExtendedAttribute("Unforgeable")))
+
+
 def UseHolderForUnforgeable(descriptor):
     return (descriptor.concrete and
             descriptor.proxy and
-            any(m for m in descriptor.interface.members if (m.isAttr() or m.isMethod()) and m.isUnforgeable()))
+            any(m for m in descriptor.interface.members
+                if MemberIsUnforgeable(m, descriptor)))
 
 
 def CallOnUnforgeableHolder(descriptor, code, isXrayCheck=None,
@@ -1999,7 +2011,7 @@ class MethodDefiner(PropertyDefiner):
         if descriptor.interface.hasInterfacePrototypeObject() or static:
             methods = [m for m in descriptor.interface.members if
                        m.isMethod() and m.isStatic() == static and
-                       m.isUnforgeable() == unforgeable and
+                       MemberIsUnforgeable(m, descriptor) == unforgeable and
                        not m.isIdentifierLess()]
         else:
             methods = []
@@ -2072,7 +2084,8 @@ class MethodDefiner(PropertyDefiner):
 
         if not static:
             stringifier = descriptor.operations['Stringifier']
-            if stringifier:
+            if (stringifier and
+                unforgeable == MemberIsUnforgeable(stringifier, descriptor)):
                 toStringDesc = {
                     "name": "toString",
                     "nativeName": stringifier.identifier.name,
@@ -2097,6 +2110,18 @@ class MethodDefiner(PropertyDefiner):
                     self.chrome.append(toJSONDesc)
                 else:
                     self.regular.append(toJSONDesc)
+            if (unforgeable and
+                descriptor.interface.getExtendedAttribute("Unforgeable")):
+                # Synthesize our valueOf method
+                self.regular.append({
+                    "name": 'valueOf',
+                    "nativeName": "UnforgeableValueOf",
+                    "methodInfo": False,
+                    "length": 0,
+                    "flags": "JSPROP_ENUMERATE", # readonly/permanent added
+                                                 # automatically.
+                    "condition": MemberCondition(None, None)
+                })
         elif (descriptor.interface.isJSImplemented() and
               descriptor.interface.hasInterfaceObject()):
             self.chrome.append({
@@ -2127,7 +2152,7 @@ class MethodDefiner(PropertyDefiner):
             return m["condition"]
 
         def flags(m):
-            unforgeable = " | JSPROP_PERMANENT" if self.unforgeable else ""
+            unforgeable = " | JSPROP_PERMANENT | JSPROP_READONLY" if self.unforgeable else ""
             return m["flags"] + unforgeable
 
         def specData(m):
@@ -2175,6 +2200,23 @@ class MethodDefiner(PropertyDefiner):
             condition, specData, doIdArrays)
 
 
+def IsCrossOriginWritable(attr, descriptor):
+    """
+    Return whether the IDLAttribute in question is cross-origin writable on the
+    interface represented by descriptor.  This is needed to handle the fact that
+    some, but not all, interfaces implementing URLUtils want a cross-origin
+    writable .href.
+    """
+    crossOriginWritable = attr.getExtendedAttribute("CrossOriginWritable")
+    if not crossOriginWritable:
+        return False
+    if crossOriginWritable == True:
+        return True
+    assert (isinstance(crossOriginWritable, list) and
+            len(crossOriginWritable) == 1)
+    return crossOriginWritable[0] == descriptor.interface.identifier.name
+
+
 class AttrDefiner(PropertyDefiner):
     def __init__(self, descriptor, name, static, unforgeable=False):
         assert not (static and unforgeable)
@@ -2184,7 +2226,7 @@ class AttrDefiner(PropertyDefiner):
         if descriptor.interface.hasInterfacePrototypeObject() or static:
             attributes = [m for m in descriptor.interface.members if
                           m.isAttr() and m.isStatic() == static and
-                          m.isUnforgeable() == unforgeable]
+                          MemberIsUnforgeable(m, descriptor) == unforgeable]
         else:
             attributes = []
         self.chrome = [m for m in attributes if isChromeOnly(m)]
@@ -2238,7 +2280,7 @@ class AttrDefiner(PropertyDefiner):
             else:
                 if attr.hasLenientThis():
                     accessor = "genericLenientSetter"
-                elif attr.getExtendedAttribute("CrossOriginWritable"):
+                elif IsCrossOriginWritable(attr, self.descriptor):
                     accessor = "genericCrossOriginSetter"
                 elif self.descriptor.needsSpecialGenericOps():
                     accessor = "genericSetter"
@@ -2786,6 +2828,11 @@ def InitUnforgeablePropertiesOnObject(descriptor, obj, properties, failureReturn
     """
     unforgeables = []
 
+    if failureReturnValue:
+        failureReturnValue = " " + failureReturnValue
+    else:
+        failureReturnValue = ""
+
     defineUnforgeableAttrs = fill(
         """
         if (!DefineUnforgeableAttributes(aCx, ${obj}, %s)) {
@@ -2793,7 +2840,7 @@ def InitUnforgeablePropertiesOnObject(descriptor, obj, properties, failureReturn
         }
         """,
         obj=obj,
-        rv=" " + failureReturnValue if failureReturnValue else "")
+        rv=failureReturnValue)
     defineUnforgeableMethods = fill(
         """
         if (!DefineUnforgeableMethods(aCx, ${obj}, %s)) {
@@ -2801,7 +2848,7 @@ def InitUnforgeablePropertiesOnObject(descriptor, obj, properties, failureReturn
         }
         """,
         obj=obj,
-        rv=" " + failureReturnValue if failureReturnValue else "")
+        rv=failureReturnValue)
 
     unforgeableMembers = [
         (defineUnforgeableAttrs, properties.unforgeableAttrs),
@@ -2815,6 +2862,19 @@ def InitUnforgeablePropertiesOnObject(descriptor, obj, properties, failureReturn
                 CGIfWrapper(CGGeneric(template % array.variableName(True)),
                             "nsContentUtils::ThreadsafeIsCallerChrome()"))
 
+    if descriptor.interface.getExtendedAttribute("Unforgeable"):
+        # We do our undefined toJSON here, not as a regular property
+        # because we don't have a concept of value props anywhere.
+        unforgeables.append(CGGeneric(fill(
+            """
+            if (!JS_DefineProperty(aCx, ${obj}, "toJSON", JS::UndefinedHandleValue,
+                                   JSPROP_READONLY | JSPROP_ENUMERATE | JSPROP_PERMANENT)) {
+              return${rv};
+            }
+            """,
+            obj=obj,
+            rv=failureReturnValue)))
+
     return CGList(unforgeables)
 
 
@@ -10353,13 +10413,13 @@ class CGDescriptor(CGThing):
                         cgThings.append(CGSpecializedSetter(descriptor, m))
                         if m.hasLenientThis():
                             hasLenientSetter = True
-                        elif m.getExtendedAttribute("CrossOriginWritable"):
+                        elif IsCrossOriginWritable(m, descriptor):
                             crossOriginSetters.add(m.identifier.name)
                         elif descriptor.needsSpecialGenericOps():
                             hasSetter = True
                 elif m.getExtendedAttribute("PutForwards"):
                     cgThings.append(CGSpecializedForwardingSetter(descriptor, m))
-                    if m.getExtendedAttribute("CrossOriginWritable"):
+                    if IsCrossOriginWritable(m, descriptor):
                         crossOriginSetters.add(m.identifier.name)
                     elif descriptor.needsSpecialGenericOps():
                         hasSetter = True
diff --git a/dom/bindings/Exceptions.cpp b/dom/bindings/Exceptions.cpp
index 59efe286aa95..e9166199763f 100644
--- a/dom/bindings/Exceptions.cpp
+++ b/dom/bindings/Exceptions.cpp
@@ -394,9 +394,7 @@ NS_IMETHODIMP JSStackFrame::GetName(nsAString& aFunction)
   if (!mFunnameInitialized) {
     JS::FrameDescription& desc = mStackDescription->FrameAt(mIndex);
     if (JSFlatString *name = desc.funDisplayName()) {
-      mFunname.Assign(JS_GetFlatStringChars(name),
-                      // XXXbz Can't JS_GetStringLength on JSFlatString!
-                      JS_GetStringLength(JS_FORGET_STRING_FLATNESS(name)));
+      AssignJSFlatString(mFunname, name);
     }
     mFunnameInitialized = true;
   }
diff --git a/dom/bindings/parser/WebIDL.py b/dom/bindings/parser/WebIDL.py
index edeebf05fd3a..4c239e36eb72 100644
--- a/dom/bindings/parser/WebIDL.py
+++ b/dom/bindings/parser/WebIDL.py
@@ -669,8 +669,36 @@ class IDLInterface(IDLObjectWithScope):
             for ancestorConsequential in ancestor.getConsequentialInterfaces():
                 ancestorConsequential.interfacesBasedOnSelf.add(self)
 
+        # Deal with interfaces marked [Unforgeable], now that we have our full
+        # member list, except unforgeables pulled in from parents.  We want to
+        # do this before we set "originatingInterface" on our unforgeable
+        # members.
+        if self.getExtendedAttribute("Unforgeable"):
+            # Check that the interface already has all the things the
+            # spec would otherwise require us to synthesize and is
+            # missing the ones we plan to synthesize.
+            if not any(m.isMethod() and m.isStringifier() for m in self.members):
+                raise WebIDLError("Unforgeable interface %s does not have a "
+                                  "stringifier" % self.identifier.name,
+                                  [self.location])
+
+            for m in self.members:
+                if ((m.isMethod() and m.isJsonifier()) or
+                    m.identifier.name == "toJSON"):
+                    raise WebIDLError("Unforgeable interface %s has a "
+                                      "jsonifier so we won't be able to add "
+                                      "one ourselves" % self.identifier.name,
+                                      [self.location, m.location])
+
+                if m.identifier.name == "valueOf" and not m.isStatic():
+                    raise WebIDLError("Unforgeable interface %s has a valueOf "
+                                      "member so we won't be able to add one "
+                                      "ourselves" % self.identifier.name,
+                                      [self.location, m.location])
+
         for member in self.members:
-            if (member.isAttr() and member.isUnforgeable() and
+            if ((member.isAttr() or member.isMethod()) and
+                member.isUnforgeable() and
                 not hasattr(member, "originatingInterface")):
                 member.originatingInterface = self
 
@@ -693,16 +721,16 @@ class IDLInterface(IDLObjectWithScope):
             # worry about anything other than our parent, because it has already
             # imported its ancestors unforgeable attributes into its member
             # list.
-            for unforgeableAttr in (attr for attr in self.parent.members if
-                                    attr.isAttr() and not attr.isStatic() and
-                                    attr.isUnforgeable()):
+            for unforgeableMember in (member for member in self.parent.members if
+                                      (member.isAttr() or member.isMethod()) and
+                                      member.isUnforgeable()):
                 shadows = [ m for m in self.members if
                             (m.isAttr() or m.isMethod()) and
                             not m.isStatic() and
-                            m.identifier.name == unforgeableAttr.identifier.name ]
+                            m.identifier.name == unforgeableMember.identifier.name ]
                 if len(shadows) != 0:
-                    locs = [unforgeableAttr.location] + [ s.location for s
-                                                          in shadows ]
+                    locs = [unforgeableMember.location] + [ s.location for s
+                                                            in shadows ]
                     raise WebIDLError("Interface %s shadows [Unforgeable] "
                                       "members of %s" %
                                       (self.identifier.name,
@@ -711,10 +739,10 @@ class IDLInterface(IDLObjectWithScope):
                 # And now just stick it in our members, since we won't be
                 # inheriting this down the proto chain.  If we really cared we
                 # could try to do something where we set up the unforgeable
-                # attributes of ancestor interfaces, with their corresponding
-                # getters, on our interface, but that gets pretty complicated
-                # and seems unnecessary.
-                self.members.append(unforgeableAttr)
+                # attributes/methods of ancestor interfaces, with their
+                # corresponding getters, on our interface, but that gets pretty
+                # complicated and seems unnecessary.
+                self.members.append(unforgeableMember)
 
         # Ensure that there's at most one of each {named,indexed}
         # {getter,setter,creator,deleter}, at most one stringifier,
@@ -785,6 +813,26 @@ class IDLInterface(IDLObjectWithScope):
                 parent = parent.parent
 
     def validate(self):
+        # We don't support consequential unforgeable interfaces.  Need to check
+        # this here, becaue in finish() an interface might not know yet that
+        # it's consequential.
+        if self.getExtendedAttribute("Unforgeable") and self.isConsequential():
+            raise WebIDLError(
+                "%s is an unforgeable consequential interface" %
+                self.identifier.name,
+                [self.location] +
+                list(i.location for i in
+                     (self.interfacesBasedOnSelf - { self }) ))
+
+        # We also don't support inheriting from unforgeable interfaces.
+        if self.getExtendedAttribute("Unforgeable") and self.hasChildInterfaces():
+            raise WebIDLError("%s is an unforgeable ancestor interface" %
+                self.identifier.name,
+                [self.location] +
+                list(i.location for i in
+                     self.interfacesBasedOnSelf if i.parent == self))
+
+
         for member in self.members:
             member.validate()
 
@@ -992,6 +1040,7 @@ class IDLInterface(IDLObjectWithScope):
             elif (identifier == "NeedNewResolve" or
                   identifier == "OverrideBuiltins" or
                   identifier == "ChromeOnly" or
+                  identifier == "Unforgeable" or
                   identifier == "LegacyEventInit"):
                 # Known extended attributes that do not take values
                 if not attr.noArguments():
@@ -2889,9 +2938,6 @@ class IDLAttribute(IDLInterfaceMember):
                                   [attr.location, self.location])
             self.lenientThis = True
         elif identifier == "Unforgeable":
-            if not self.readonly:
-                raise WebIDLError("[Unforgeable] is only allowed on readonly "
-                                  "attributes", [attr.location, self.location])
             if self.isStatic():
                 raise WebIDLError("[Unforgeable] is only allowed on non-static "
                                   "attributes", [attr.location, self.location])
@@ -2951,7 +2997,7 @@ class IDLAttribute(IDLInterfaceMember):
                                   [attr.location, self.location])
         elif (identifier == "CrossOriginReadable" or
               identifier == "CrossOriginWritable"):
-            if not attr.noArguments():
+            if not attr.noArguments() and identifier == "CrossOriginReadable":
                 raise WebIDLError("[%s] must take no arguments" % identifier,
                                   [attr.location])
             if self.isStatic():
@@ -3545,15 +3591,19 @@ class IDLMethod(IDLInterfaceMember, IDLScope):
                 raise WebIDLError("[LenientFloat] used on an operation with no "
                                   "restricted float type arguments",
                                   [attr.location, self.location])
+        elif (identifier == "Pure" or
+              identifier == "CrossOriginCallable" or
+              identifier == "WebGLHandlesContextLoss"):
+            # Known no-argument attributes.
+            if not attr.noArguments():
+                raise WebIDLError("[%s] must take no arguments" % identifier,
+                                  [attr.location])
         elif (identifier == "Throws" or
               identifier == "NewObject" or
               identifier == "ChromeOnly" or
               identifier == "Pref" or
               identifier == "Func" or
               identifier == "AvailableIn" or
-              identifier == "Pure" or
-              identifier == "CrossOriginCallable" or
-              identifier == "WebGLHandlesContextLoss" or
               identifier == "CheckPermissions"):
             # Known attributes that we don't need to do anything with here
             pass
diff --git a/dom/bindings/parser/tests/test_unforgeable.py b/dom/bindings/parser/tests/test_unforgeable.py
index e512bde215bc..3787e8c6af1e 100644
--- a/dom/bindings/parser/tests/test_unforgeable.py
+++ b/dom/bindings/parser/tests/test_unforgeable.py
@@ -79,6 +79,25 @@ def WebIDLTest(parser, harness):
                "Should have thrown when shadowing unforgeable attribute on "
                "parent with operation.")
 
+    parser = parser.reset();
+    threw = False
+    try:
+        parser.parse("""
+            interface Child : Parent {
+              void foo();
+            };
+            interface Parent {
+              [Unforgeable] void foo();
+            };
+        """)
+
+        results = parser.finish()
+    except:
+        threw = True
+    harness.ok(threw,
+               "Should have thrown when shadowing unforgeable operation on "
+               "parent with operation.")
+
     parser = parser.reset();
     threw = False
     try:
@@ -98,6 +117,25 @@ def WebIDLTest(parser, harness):
                "Should have thrown when shadowing unforgeable attribute on "
                "parent with attribute.")
 
+    parser = parser.reset();
+    threw = False
+    try:
+        parser.parse("""
+            interface Child : Parent {
+              attribute short foo;
+            };
+            interface Parent {
+              [Unforgeable] void foo();
+            };
+        """)
+
+        results = parser.finish()
+    except Exception,x:
+        threw = True
+    harness.ok(threw,
+               "Should have thrown when shadowing unforgeable operation on "
+               "parent with attribute.")
+
     parser = parser.reset();
     parser.parse("""
             interface Child : Parent {
@@ -166,16 +204,38 @@ def WebIDLTest(parser, harness):
     threw = False
     try:
         parser.parse("""
-            interface iface {
-              [Unforgeable] attribute long foo;
+            interface Child : Parent {
             };
+            interface Parent : GrandParent {};
+            interface GrandParent {};
+            interface Consequential {
+              [Unforgeable] void foo();
+            };
+            GrandParent implements Consequential;
+            interface ChildConsequential {
+              void foo();
+            };
+            Child implements ChildConsequential;
         """)
 
         results = parser.finish()
     except:
         threw = True
 
-    harness.ok(threw, "Should have thrown for writable [Unforgeable] attribute.")
+    harness.ok(threw,
+               "Should have thrown when our consequential interface shadows unforgeable operation "
+               "of ancestor's consequential interface.")
+
+    parser = parser.reset();
+    parser.parse("""
+        interface iface {
+          [Unforgeable] attribute long foo;
+        };
+    """)
+
+    results = parser.finish()
+    harness.check(len(results), 1,
+                  "Should allow writable [Unforgeable] attribute.")
 
     parser = parser.reset();
     threw = False
diff --git a/dom/browser-element/BrowserElementChildPreload.js b/dom/browser-element/BrowserElementChildPreload.js
index 393d8d63ba2e..82da8310faf1 100644
--- a/dom/browser-element/BrowserElementChildPreload.js
+++ b/dom/browser-element/BrowserElementChildPreload.js
@@ -186,10 +186,21 @@ BrowserElementChild.prototype = {
                      /* wantsUntrusted = */ false);
 
     addEventListener('DOMMetaAdded',
-                     this._metaAddedHandler.bind(this),
+                     this._metaChangedHandler.bind(this),
                      /* useCapture = */ true,
                      /* wantsUntrusted = */ false);
 
+    addEventListener('DOMMetaChanged',
+                     this._metaChangedHandler.bind(this),
+                     /* useCapture = */ true,
+                     /* wantsUntrusted = */ false);
+
+    addEventListener('DOMMetaRemoved',
+                     this._metaChangedHandler.bind(this),
+                     /* useCapture = */ true,
+                     /* wantsUntrusted = */ false);
+
+
     // This listens to unload events from our message manager, but /not/ from
     // the |content| window.  That's because the window's unload event doesn't
     // bubble, and we're not using a capturing listener.  If we'd used
@@ -513,7 +524,7 @@ BrowserElementChild.prototype = {
     }, this);
   },
 
-  _metaAddedHandler: function(e) {
+  _metaChangedHandler: function(e) {
     let win = e.target.ownerDocument.defaultView;
     // Ignore metas which don't come from the top-level
     // <iframe mozbrowser> window.
@@ -526,41 +537,67 @@ BrowserElementChild.prototype = {
       return;
     }
 
-    debug('Got metaAdded: (' + e.target.name + ') ' + e.target.content);
-    if (e.target.name == 'application-name') {
-      let meta = { name: e.target.name,
-                   content: e.target.content };
+    debug('Got metaChanged: (' + e.target.name + ') ' + e.target.content);
 
-      let lang;
-      let elm;
+    let handlers = {
+      'theme-color': this._themeColorChangedHandler,
+      'application-name': this._applicationNameChangedHandler
+    };
 
-      for (elm = e.target;
-           !lang && elm && elm.nodeType == e.target.ELEMENT_NODE;
-           elm = elm.parentNode) {
-        if (elm.hasAttribute('lang')) {
-          lang = elm.getAttribute('lang');
-          continue;
-        }
-
-        if (elm.hasAttributeNS('http://www.w3.org/XML/1998/namespace', 'lang')) {
-          lang = elm.getAttributeNS('http://www.w3.org/XML/1998/namespace', 'lang');
-          continue;
-        }
-      }
-
-      // No lang has been detected.
-      if (!lang && elm.nodeType == e.target.DOCUMENT_NODE) {
-        lang = elm.contentLanguage;
-      }
-
-      if (lang) {
-        meta.lang = lang;
-      }
-
-      sendAsyncMsg('metachange', meta);
+    let handler = handlers[e.target.name];
+    if (handler) {
+      handler(e.type, e.target);
     }
   },
 
+  _applicationNameChangedHandler: function(eventType, target) {
+    if (eventType !== 'DOMMetaAdded') {
+      // Bug 1037448 - Decide what to do when <meta name="application-name">
+      // changes
+      return;
+    }
+
+    let meta = { name: 'application-name',
+                 content: target.content };
+
+    let lang;
+    let elm;
+
+    for (elm = target;
+         !lang && elm && elm.nodeType == target.ELEMENT_NODE;
+         elm = elm.parentNode) {
+      if (elm.hasAttribute('lang')) {
+        lang = elm.getAttribute('lang');
+        continue;
+      }
+
+      if (elm.hasAttributeNS('http://www.w3.org/XML/1998/namespace', 'lang')) {
+        lang = elm.getAttributeNS('http://www.w3.org/XML/1998/namespace', 'lang');
+        continue;
+      }
+    }
+
+    // No lang has been detected.
+    if (!lang && elm.nodeType == target.DOCUMENT_NODE) {
+      lang = elm.contentLanguage;
+    }
+
+    if (lang) {
+      meta.lang = lang;
+    }
+
+    sendAsyncMsg('metachange', meta);
+  },
+
+  _themeColorChangedHandler: function(eventType, target) {
+    let meta = {
+      name: 'theme-color',
+      content: target.content,
+      type: eventType.replace('DOMMeta', '').toLowerCase()
+    };
+    sendAsyncMsg('metachange', meta);
+  },
+
   _addMozAfterPaintHandler: function(callback) {
     function onMozAfterPaint() {
       let uri = docShell.QueryInterface(Ci.nsIWebNavigation).currentURI;
diff --git a/dom/browser-element/mochitest/browserElement_ThemeColor.js b/dom/browser-element/mochitest/browserElement_ThemeColor.js
new file mode 100644
index 000000000000..4b9394abfcc1
--- /dev/null
+++ b/dom/browser-element/mochitest/browserElement_ThemeColor.js
@@ -0,0 +1,71 @@
+/* Any copyright is dedicated to the public domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// Test that the onmozbrowsermetachange event for theme-color works.
+"use strict";
+
+SimpleTest.waitForExplicitFinish();
+browserElementTestHelpers.setEnabledPref(true);
+browserElementTestHelpers.addPermission();
+
+function runTest() {
+  function loadFrameScript(script) {
+    SpecialPowers.getBrowserFrameMessageManager(iframe1)
+                 .loadFrameScript("data:," + script,
+                                  /* allowDelayedLoad = */ false);
+  }
+
+  let iframe1 = document.createElement('iframe');
+  SpecialPowers.wrap(iframe1).mozbrowser = true;
+  iframe1.src = "http://test/tests/dom/browser-element/mochitest/file_browserElement_ThemeColor.html";
+  iframe1.addEventListener('mozbrowsermetachange', tests);
+  document.body.appendChild(iframe1);
+
+  let numMetaChanges = 0;
+  function tests(e) {
+    let detail = e.detail;
+
+    switch (numMetaChanges++) {
+      case 0: {
+        is(detail.name, 'theme-color', 'name matches');
+        is(detail.content, 'pink', 'content matches');
+        is(detail.type, 'added', 'type matches');
+
+        let script =
+          "var meta = content.document.head.querySelector('meta');" +
+          "meta.content = 'green';";
+        loadFrameScript(script);
+        break;
+      }
+
+      case 1: {
+        is(detail.name, 'theme-color', 'name matches');
+        is(detail.content, 'green', 'content matches');
+        is(detail.type, 'changed', 'type matches');
+
+        let script =
+          "var meta = content.document.head.querySelector('meta');" +
+          "meta.parentNode.removeChild(meta);";
+        loadFrameScript(script);
+        break;
+      }
+
+      case 2: {
+        is(detail.name, 'theme-color', 'name matches');
+        is(detail.content, 'green', 'content matches');
+        is(detail.type, 'removed', 'type matches');
+
+        SimpleTest.finish();
+        break;
+      }
+
+      default: {
+        ok(false, 'Too many metachange events.');
+        break;
+      }
+    }
+  };
+}
+
+window.addEventListener('testready', runTest);
+
diff --git a/dom/browser-element/mochitest/file_browserElement_ThemeColor.html b/dom/browser-element/mochitest/file_browserElement_ThemeColor.html
new file mode 100644
index 000000000000..f8fb9f116d06
--- /dev/null
+++ b/dom/browser-element/mochitest/file_browserElement_ThemeColor.html
@@ -0,0 +1,8 @@
+<html>
+  <head>
+    <meta name="theme-color" content="pink">
+  </head>
+
+  <body>
+  </body>
+</html>
diff --git a/dom/browser-element/mochitest/mochitest-oop.ini b/dom/browser-element/mochitest/mochitest-oop.ini
index 8e444696c2e8..db15d8211edd 100644
--- a/dom/browser-element/mochitest/mochitest-oop.ini
+++ b/dom/browser-element/mochitest/mochitest-oop.ini
@@ -8,6 +8,7 @@ support-files =
   browserElement_OpenMixedProcess.js
   file_browserElement_OpenMixedProcess.html
 
+[test_browserElement_oop_ThemeColor.html]
 [test_browserElement_inproc_ErrorSecurity.html]
 skip-if = toolkit=='gonk'
 [test_browserElement_inproc_OpenMixedProcess.html]
diff --git a/dom/browser-element/mochitest/mochitest.ini b/dom/browser-element/mochitest/mochitest.ini
index 0e5e97f13d65..17472e37ec1c 100644
--- a/dom/browser-element/mochitest/mochitest.ini
+++ b/dom/browser-element/mochitest/mochitest.ini
@@ -11,6 +11,7 @@ support-files =
   browserElement_Auth.js
   browserElement_BackForward.js
   browserElement_BadScreenshot.js
+  browserElement_ThemeColor.js
   browserElement_BrowserWindowNamespace.js
   browserElement_BrowserWindowResize.js
   browserElement_Close.js
@@ -68,6 +69,7 @@ support-files =
   file_browserElement_AlertInFrame_Inner.html
   file_browserElement_AppFramePermission.html
   file_browserElement_AppWindowNamespace.html
+  file_browserElement_ThemeColor.html
   file_browserElement_BrowserWindowNamespace.html
   file_browserElement_CloseApp.html
   file_browserElement_CloseFromOpener.html
@@ -113,6 +115,7 @@ support-files =
 [test_browserElement_NoPref.html]
 [test_browserElement_NoPermission.html]
 [test_browserElement_inproc_Alert.html]
+[test_browserElement_inproc_ThemeColor.html]
 skip-if = buildapp == 'b2g'
 [test_browserElement_inproc_AlertInFrame.html]
 [test_browserElement_inproc_AppFramePermission.html]
diff --git a/dom/browser-element/mochitest/test_browserElement_inproc_ThemeColor.html b/dom/browser-element/mochitest/test_browserElement_inproc_ThemeColor.html
new file mode 100644
index 000000000000..4075ce58dca5
--- /dev/null
+++ b/dom/browser-element/mochitest/test_browserElement_inproc_ThemeColor.html
@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1013913
+-->
+<head>
+  <title>Test for Bug 1013913</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="browserElementTestHelpers.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1013913">Mozilla Bug 1013913</a>
+
+<script type="application/javascript;version=1.7" src="browserElement_ThemeColor.js">
+</script>
+
+</body>
+</html>
diff --git a/dom/browser-element/mochitest/test_browserElement_oop_ThemeColor.html b/dom/browser-element/mochitest/test_browserElement_oop_ThemeColor.html
new file mode 100644
index 000000000000..4075ce58dca5
--- /dev/null
+++ b/dom/browser-element/mochitest/test_browserElement_oop_ThemeColor.html
@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1013913
+-->
+<head>
+  <title>Test for Bug 1013913</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="browserElementTestHelpers.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1013913">Mozilla Bug 1013913</a>
+
+<script type="application/javascript;version=1.7" src="browserElement_ThemeColor.js">
+</script>
+
+</body>
+</html>
diff --git a/dom/camera/CameraPreviewMediaStream.cpp b/dom/camera/CameraPreviewMediaStream.cpp
index 7ebc1fc69d95..dd10d6c1d854 100644
--- a/dom/camera/CameraPreviewMediaStream.cpp
+++ b/dom/camera/CameraPreviewMediaStream.cpp
@@ -103,7 +103,7 @@ CameraPreviewMediaStream::RemoveListener(MediaStreamListener* aListener)
   MediaStreamGraph* gm = MediaStreamGraph::GetInstance();
   nsRefPtr<MediaStreamListener> listener(aListener);
   mListeners.RemoveElement(aListener);
-  listener->NotifyRemoved(gm);
+  listener->NotifyEvent(gm, MediaStreamListener::EVENT_REMOVED);
 }
 
 void
diff --git a/dom/crypto/AesKeyAlgorithm.h b/dom/crypto/AesKeyAlgorithm.h
index b0b7ef3790c7..229510f209ea 100644
--- a/dom/crypto/AesKeyAlgorithm.h
+++ b/dom/crypto/AesKeyAlgorithm.h
@@ -7,18 +7,17 @@
 #ifndef mozilla_dom_AesKeyAlgorithm_h
 #define mozilla_dom_AesKeyAlgorithm_h
 
-#include "mozilla/dom/KeyAlgorithm.h"
+#include "mozilla/dom/BasicSymmetricKeyAlgorithm.h"
 #include "js/TypeDecls.h"
 
 namespace mozilla {
 namespace dom {
 
-class AesKeyAlgorithm MOZ_FINAL : public KeyAlgorithm
+class AesKeyAlgorithm MOZ_FINAL : public BasicSymmetricKeyAlgorithm
 {
 public:
   AesKeyAlgorithm(nsIGlobalObject* aGlobal, const nsString& aName, uint16_t aLength)
-    : KeyAlgorithm(aGlobal, aName)
-    , mLength(aLength)
+    : BasicSymmetricKeyAlgorithm(aGlobal, aName, aLength)
   {}
 
   ~AesKeyAlgorithm()
@@ -26,17 +25,9 @@ public:
 
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
-  uint16_t Length() const
-  {
-    return mLength;
-  }
-
   virtual bool WriteStructuredClone(JSStructuredCloneWriter* aWriter) const MOZ_OVERRIDE;
   static KeyAlgorithm* Create(nsIGlobalObject* aGlobal,
                               JSStructuredCloneReader* aReader);
-
-protected:
-  uint16_t mLength;
 };
 
 } // namespace dom
diff --git a/dom/crypto/BasicSymmetricKeyAlgorithm.h b/dom/crypto/BasicSymmetricKeyAlgorithm.h
new file mode 100644
index 000000000000..afcdc5f20346
--- /dev/null
+++ b/dom/crypto/BasicSymmetricKeyAlgorithm.h
@@ -0,0 +1,38 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_BasicSymmetricKeyAlgorithm_h
+#define mozilla_dom_BasicSymmetricKeyAlgorithm_h
+
+#include "mozilla/dom/KeyAlgorithm.h"
+
+namespace mozilla {
+namespace dom {
+
+class BasicSymmetricKeyAlgorithm : public KeyAlgorithm
+{
+public:
+  BasicSymmetricKeyAlgorithm(nsIGlobalObject* aGlobal, const nsString& aName, uint16_t aLength)
+    : KeyAlgorithm(aGlobal, aName)
+    , mLength(aLength)
+  {}
+
+  ~BasicSymmetricKeyAlgorithm()
+  {}
+
+  uint16_t Length() const
+  {
+    return mLength;
+  }
+
+protected:
+  uint16_t mLength;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_BasicSymmetricKeyAlgorithm_h
diff --git a/dom/crypto/KeyAlgorithm.cpp b/dom/crypto/KeyAlgorithm.cpp
index 72e4b5c5bcfd..ae03d8524f56 100644
--- a/dom/crypto/KeyAlgorithm.cpp
+++ b/dom/crypto/KeyAlgorithm.cpp
@@ -32,27 +32,8 @@ KeyAlgorithm::KeyAlgorithm(nsIGlobalObject* aGlobal, const nsString& aName)
   SetIsDOMBinding();
 
   // Set mechanism based on algorithm name
-  if (mName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC)) {
-    mMechanism = CKM_AES_CBC_PAD;
-  } else if (mName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR)) {
-    mMechanism = CKM_AES_CTR;
-  } else if (mName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM)) {
-    mMechanism = CKM_AES_GCM;
-  } else if (mName.EqualsLiteral(WEBCRYPTO_ALG_SHA1)) {
-    mMechanism = CKM_SHA_1;
-  } else if (mName.EqualsLiteral(WEBCRYPTO_ALG_SHA256)) {
-    mMechanism = CKM_SHA256;
-  } else if (mName.EqualsLiteral(WEBCRYPTO_ALG_SHA384)) {
-    mMechanism = CKM_SHA384;
-  } else if (mName.EqualsLiteral(WEBCRYPTO_ALG_SHA512)) {
-    mMechanism = CKM_SHA512;
-  } else if (mName.EqualsLiteral(WEBCRYPTO_ALG_RSAES_PKCS1)) {
-    mMechanism = CKM_RSA_PKCS;
-  } else if (mName.EqualsLiteral(WEBCRYPTO_ALG_RSASSA_PKCS1)) {
-    mMechanism = CKM_RSA_PKCS;
-  } else {
-    mMechanism = UNKNOWN_CK_MECHANISM;
-  }
+  mMechanism = MapAlgorithmNameToMechanism(aName);
+
   // HMAC not handled here, since it requires extra info
 }
 
diff --git a/dom/crypto/WebCryptoCommon.h b/dom/crypto/WebCryptoCommon.h
index 5b1ce22a8744..f25a8dce5de9 100644
--- a/dom/crypto/WebCryptoCommon.h
+++ b/dom/crypto/WebCryptoCommon.h
@@ -21,6 +21,7 @@
 #define WEBCRYPTO_ALG_SHA384        "SHA-384"
 #define WEBCRYPTO_ALG_SHA512        "SHA-512"
 #define WEBCRYPTO_ALG_HMAC          "HMAC"
+#define WEBCRYPTO_ALG_PBKDF2        "PBKDF2"
 #define WEBCRYPTO_ALG_RSAES_PKCS1   "RSAES-PKCS1-v1_5"
 #define WEBCRYPTO_ALG_RSASSA_PKCS1  "RSASSA-PKCS1-v1_5"
 
@@ -119,6 +120,37 @@ WriteBuffer(JSStructuredCloneWriter* aWriter, const CryptoBuffer& aBuffer)
   return ret;
 }
 
+inline CK_MECHANISM_TYPE
+MapAlgorithmNameToMechanism(const nsString& aName)
+{
+  CK_MECHANISM_TYPE mechanism(UNKNOWN_CK_MECHANISM);
+
+  // Set mechanism based on algorithm name
+  if (aName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC)) {
+    mechanism = CKM_AES_CBC_PAD;
+  } else if (aName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR)) {
+    mechanism = CKM_AES_CTR;
+  } else if (aName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM)) {
+    mechanism = CKM_AES_GCM;
+  } else if (aName.EqualsLiteral(WEBCRYPTO_ALG_SHA1)) {
+    mechanism = CKM_SHA_1;
+  } else if (aName.EqualsLiteral(WEBCRYPTO_ALG_SHA256)) {
+    mechanism = CKM_SHA256;
+  } else if (aName.EqualsLiteral(WEBCRYPTO_ALG_SHA384)) {
+    mechanism = CKM_SHA384;
+  } else if (aName.EqualsLiteral(WEBCRYPTO_ALG_SHA512)) {
+    mechanism = CKM_SHA512;
+  } else if (aName.EqualsLiteral(WEBCRYPTO_ALG_PBKDF2)) {
+    mechanism = CKM_PKCS5_PBKD2;
+  } else if (aName.EqualsLiteral(WEBCRYPTO_ALG_RSAES_PKCS1)) {
+    mechanism = CKM_RSA_PKCS;
+  } else if (aName.EqualsLiteral(WEBCRYPTO_ALG_RSASSA_PKCS1)) {
+    mechanism = CKM_RSA_PKCS;
+  }
+
+  return mechanism;
+}
+
 } // namespace dom
 } // namespace mozilla
 
diff --git a/dom/crypto/WebCryptoTask.cpp b/dom/crypto/WebCryptoTask.cpp
index a99434348fb7..2b50693aa986 100644
--- a/dom/crypto/WebCryptoTask.cpp
+++ b/dom/crypto/WebCryptoTask.cpp
@@ -148,6 +148,78 @@ Coerce(JSContext* aCx, T& aTarget, const OOS& aAlgorithm)
   return NS_OK;
 }
 
+inline size_t
+MapHashAlgorithmNameToBlockSize(const nsString& aName)
+{
+  if (aName.EqualsLiteral(WEBCRYPTO_ALG_SHA1) ||
+      aName.EqualsLiteral(WEBCRYPTO_ALG_SHA256)) {
+    return 512;
+  }
+
+  if (aName.EqualsLiteral(WEBCRYPTO_ALG_SHA384) ||
+      aName.EqualsLiteral(WEBCRYPTO_ALG_SHA512)) {
+    return 1024;
+  }
+
+  return 0;
+}
+
+inline nsresult
+GetKeySizeForAlgorithm(JSContext* aCx, const ObjectOrString& aAlgorithm,
+                       size_t& aLength)
+{
+  aLength = 0;
+
+  // Extract algorithm name
+  nsString algName;
+  if (NS_FAILED(GetAlgorithmName(aCx, aAlgorithm, algName))) {
+    return NS_ERROR_DOM_SYNTAX_ERR;
+  }
+
+  // Read AES key length from given algorithm object.
+  if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC) ||
+      algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR) ||
+      algName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM)) {
+    RootedDictionary<AesKeyGenParams> params(aCx);
+    if (NS_FAILED(Coerce(aCx, params, aAlgorithm)) ||
+        !params.mLength.WasPassed()) {
+      return NS_ERROR_DOM_SYNTAX_ERR;
+    }
+
+    size_t length = params.mLength.Value();
+    if (length != 128 && length != 192 && length != 256) {
+      return NS_ERROR_DOM_DATA_ERR;
+    }
+
+    aLength = length;
+    return NS_OK;
+  }
+
+  // Determine HMAC key length as the block size of the given hash.
+  if (algName.EqualsLiteral(WEBCRYPTO_ALG_HMAC)) {
+    RootedDictionary<HmacImportParams> params(aCx);
+    if (NS_FAILED(Coerce(aCx, params, aAlgorithm)) ||
+        !params.mHash.WasPassed()) {
+      return NS_ERROR_DOM_SYNTAX_ERR;
+    }
+
+    nsString hashName;
+    if (NS_FAILED(GetAlgorithmName(aCx, params.mHash.Value(), hashName))) {
+      return NS_ERROR_DOM_SYNTAX_ERR;
+    }
+
+    size_t length = MapHashAlgorithmNameToBlockSize(hashName);
+    if (length == 0) {
+      return NS_ERROR_DOM_SYNTAX_ERR;
+    }
+
+    aLength = length;
+    return NS_OK;
+  }
+
+  return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+}
+
 // Implementation of WebCryptoTask methods
 
 void
@@ -828,10 +900,12 @@ public:
         mKeyData.Assign(aKeyData.GetAsArrayBufferView());
       } else if (aKeyData.IsArrayBuffer()) {
         mKeyData.Assign(aKeyData.GetAsArrayBuffer());
-      } else {
-        mEarlyRv = NS_ERROR_DOM_DATA_ERR;
-        return;
       }
+      // We would normally fail here if the key data is not an ArrayBuffer or
+      // an ArrayBufferView but let's wait for BeforeCrypto() to be called in
+      // case PBKDF2's deriveKey() operation passed dummy key data. When that
+      // happens DerivePbkdfKeyTask is responsible for calling SetKeyData()
+      // itself before this task is actually run.
     } else if (aFormat.EqualsLiteral(WEBCRYPTO_KEY_FORMAT_JWK)) {
       mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
       return;
@@ -859,6 +933,11 @@ public:
 
   virtual nsresult BeforeCrypto() MOZ_OVERRIDE
   {
+    // Check that we have valid key data.
+    if (mKeyData.Length() == 0) {
+      return NS_ERROR_DOM_DATA_ERR;
+    }
+
     // Construct an appropriate KeyAlorithm,
     // and verify that usages are appropriate
     nsRefPtr<KeyAlgorithm> algorithm;
@@ -875,6 +954,11 @@ public:
         return NS_ERROR_DOM_DATA_ERR;
       }
       algorithm = new AesKeyAlgorithm(global, mAlgName, length);
+    } else if (mAlgName.EqualsLiteral(WEBCRYPTO_ALG_PBKDF2)) {
+      if (mKey->HasUsageOtherThan(CryptoKey::DERIVEKEY)) {
+        return NS_ERROR_DOM_DATA_ERR;
+      }
+      algorithm = new BasicSymmetricKeyAlgorithm(global, mAlgName, length);
     } else if (mAlgName.EqualsLiteral(WEBCRYPTO_ALG_HMAC)) {
       if (mKey->HasUsageOtherThan(CryptoKey::SIGN | CryptoKey::VERIFY)) {
         return NS_ERROR_DOM_DATA_ERR;
@@ -895,6 +979,12 @@ public:
     return NS_OK;
   }
 
+  void SetKeyData(const CryptoBuffer& aKeyData)
+  {
+    // An OOM will just result in an error in BeforeCrypto
+    mKeyData = aKeyData;
+  }
+
 private:
   CryptoBuffer mKeyData;
   nsString mHashName;
@@ -1129,16 +1219,8 @@ public:
     if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC) ||
         algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR) ||
         algName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM)) {
-      RootedDictionary<AesKeyGenParams> params(aCx);
-      mEarlyRv = Coerce(aCx, params, aAlgorithm);
-      if (NS_FAILED(mEarlyRv) || !params.mLength.WasPassed()) {
-        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
-        return;
-      }
-
-      mLength = params.mLength.Value();
-      if (mLength != 128 && mLength != 192 && mLength != 256) {
-        mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+      mEarlyRv = GetKeySizeForAlgorithm(aCx, aAlgorithm, mLength);
+      if (NS_FAILED(mEarlyRv)) {
         return;
       }
       algorithm = new AesKeyAlgorithm(global, algName, mLength);
@@ -1167,20 +1249,7 @@ public:
       if (params.mLength.WasPassed()) {
         mLength = params.mLength.Value();
       } else {
-        nsRefPtr<KeyAlgorithm> hashAlg = new KeyAlgorithm(global, hashName);
-        switch (hashAlg->Mechanism()) {
-          case CKM_SHA_1:
-          case CKM_SHA256:
-            mLength = 512;
-            break;
-          case CKM_SHA384:
-          case CKM_SHA512:
-            mLength = 1024;
-            break;
-          default:
-            mLength = 0;
-            break;
-        }
+        mLength = MapHashAlgorithmNameToBlockSize(hashName);
       }
 
       if (mLength == 0) {
@@ -1421,6 +1490,160 @@ private:
   }
 };
 
+class DerivePbkdfBitsTask : public ReturnArrayBufferViewTask
+{
+public:
+  DerivePbkdfBitsTask(JSContext* aCx,
+      const ObjectOrString& aAlgorithm, CryptoKey& aKey, uint32_t aLength)
+    : mSymKey(aKey.GetSymKey())
+  {
+    Init(aCx, aAlgorithm, aKey, aLength);
+  }
+
+  DerivePbkdfBitsTask(JSContext* aCx, const ObjectOrString& aAlgorithm,
+                      CryptoKey& aKey, const ObjectOrString& aTargetAlgorithm)
+    : mSymKey(aKey.GetSymKey())
+  {
+    size_t length;
+    mEarlyRv = GetKeySizeForAlgorithm(aCx, aTargetAlgorithm, length);
+
+    if (NS_SUCCEEDED(mEarlyRv)) {
+      Init(aCx, aAlgorithm, aKey, length);
+    }
+  }
+
+  void Init(JSContext* aCx, const ObjectOrString& aAlgorithm, CryptoKey& aKey,
+            uint32_t aLength)
+  {
+    // Check that we got a symmetric key
+    if (mSymKey.Length() == 0) {
+      mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+      return;
+    }
+
+    RootedDictionary<Pbkdf2Params> params(aCx);
+    mEarlyRv = Coerce(aCx, params, aAlgorithm);
+    if (NS_FAILED(mEarlyRv) || !params.mHash.WasPassed() ||
+        !params.mIterations.WasPassed() || !params.mSalt.WasPassed()) {
+      mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+      return;
+    }
+
+    // length must be a multiple of 8 bigger than zero.
+    if (aLength == 0 || aLength % 8) {
+      mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+      return;
+    }
+
+    // Extract the hash algorithm.
+    nsString hashName;
+    mEarlyRv = GetAlgorithmName(aCx, params.mHash.Value(), hashName);
+    if (NS_FAILED(mEarlyRv)) {
+      return;
+    }
+
+    // Check the given hash algorithm.
+    switch (MapAlgorithmNameToMechanism(hashName)) {
+      case CKM_SHA_1: mHashOidTag = SEC_OID_HMAC_SHA1; break;
+      case CKM_SHA256: mHashOidTag = SEC_OID_HMAC_SHA256; break;
+      case CKM_SHA384: mHashOidTag = SEC_OID_HMAC_SHA384; break;
+      case CKM_SHA512: mHashOidTag = SEC_OID_HMAC_SHA512; break;
+      default: {
+        mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+        return;
+      }
+    }
+
+    ATTEMPT_BUFFER_INIT(mSalt, params.mSalt.Value())
+    mLength = aLength >> 3; // bits to bytes
+    mIterations = params.mIterations.Value();
+  }
+
+private:
+  size_t mLength;
+  size_t mIterations;
+  CryptoBuffer mSalt;
+  CryptoBuffer mSymKey;
+  SECOidTag mHashOidTag;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    ScopedSECItem salt;
+    ATTEMPT_BUFFER_TO_SECITEM(salt, mSalt);
+
+    // Always pass in cipherAlg=SEC_OID_HMAC_SHA1 (i.e. PBMAC1) as this
+    // parameter is unused for key generation. It is currently only used
+    // for PBKDF2 authentication or key (un)wrapping when specifying an
+    // encryption algorithm (PBES2).
+    ScopedSECAlgorithmID alg_id(PK11_CreatePBEV2AlgorithmID(
+      SEC_OID_PKCS5_PBKDF2, SEC_OID_HMAC_SHA1, mHashOidTag,
+      mLength, mIterations, salt));
+
+    if (!alg_id.get()) {
+      return NS_ERROR_DOM_OPERATION_ERR;
+    }
+
+    ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+    if (!slot.get()) {
+      return NS_ERROR_DOM_OPERATION_ERR;
+    }
+
+    ScopedSECItem keyItem;
+    ATTEMPT_BUFFER_TO_SECITEM(keyItem, mSymKey);
+
+    ScopedPK11SymKey symKey(PK11_PBEKeyGen(slot, alg_id, keyItem, false, nullptr));
+    if (!symKey.get()) {
+      return NS_ERROR_DOM_OPERATION_ERR;
+    }
+
+    nsresult rv = MapSECStatus(PK11_ExtractKeyValue(symKey));
+    if (NS_FAILED(rv)) {
+      return NS_ERROR_DOM_OPERATION_ERR;
+    }
+
+    // This doesn't leak, because the SECItem* returned by PK11_GetKeyData
+    // just refers to a buffer managed by symKey. The assignment copies the
+    // data, so mResult manages one copy, while symKey manages another.
+    ATTEMPT_BUFFER_ASSIGN(mResult, PK11_GetKeyData(symKey));
+    return NS_OK;
+  }
+};
+
+class DerivePbkdfKeyTask : public DerivePbkdfBitsTask
+{
+public:
+  DerivePbkdfKeyTask(JSContext* aCx,
+                     const ObjectOrString& aAlgorithm, CryptoKey& aBaseKey,
+                     const ObjectOrString& aDerivedKeyType, bool aExtractable,
+                     const Sequence<nsString>& aKeyUsages)
+    : DerivePbkdfBitsTask(aCx, aAlgorithm, aBaseKey, aDerivedKeyType)
+  {
+    if (NS_FAILED(mEarlyRv)) {
+      return;
+    }
+
+    CryptoOperationData dummy;
+    NS_NAMED_LITERAL_STRING(format, WEBCRYPTO_KEY_FORMAT_RAW);
+
+    mTask = new ImportSymmetricKeyTask(aCx, format, dummy, aDerivedKeyType,
+                                       aExtractable, aKeyUsages);
+  }
+
+protected:
+  nsRefPtr<ImportSymmetricKeyTask> mTask;
+
+private:
+  virtual void Resolve() MOZ_OVERRIDE {
+    mTask->SetKeyData(mResult);
+    mTask->DispatchWithPromise(mResultPromise);
+  }
+
+  virtual void Cleanup() MOZ_OVERRIDE
+  {
+    mTask = nullptr;
+  }
+};
+
 
 // Task creation methods for WebCryptoTask
 
@@ -1520,6 +1743,7 @@ WebCryptoTask::ImportKeyTask(JSContext* aCx,
   if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC) ||
       algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR) ||
       algName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM) ||
+      algName.EqualsLiteral(WEBCRYPTO_ALG_PBKDF2) ||
       algName.EqualsLiteral(WEBCRYPTO_ALG_HMAC)) {
     return new ImportSymmetricKeyTask(aCx, aFormat, aKeyData, aAlgorithm,
                                       aExtractable, aKeyUsages);
@@ -1582,6 +1806,18 @@ WebCryptoTask::DeriveKeyTask(JSContext* aCx,
                              const Sequence<nsString>& aKeyUsages)
 {
   Telemetry::Accumulate(Telemetry::WEBCRYPTO_METHOD, TM_DERIVEKEY);
+
+  nsString algName;
+  nsresult rv = GetAlgorithmName(aCx, aAlgorithm, algName);
+  if (NS_FAILED(rv)) {
+    return new FailureTask(rv);
+  }
+
+  if (algName.EqualsASCII(WEBCRYPTO_ALG_PBKDF2)) {
+    return new DerivePbkdfKeyTask(aCx, aAlgorithm, aBaseKey, aDerivedKeyType,
+                                  aExtractable, aKeyUsages);
+  }
+
   return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
 }
 
@@ -1592,6 +1828,17 @@ WebCryptoTask::DeriveBitsTask(JSContext* aCx,
                               uint32_t aLength)
 {
   Telemetry::Accumulate(Telemetry::WEBCRYPTO_METHOD, TM_DERIVEBITS);
+
+  nsString algName;
+  nsresult rv = GetAlgorithmName(aCx, aAlgorithm, algName);
+  if (NS_FAILED(rv)) {
+    return new FailureTask(rv);
+  }
+
+  if (algName.EqualsASCII(WEBCRYPTO_ALG_PBKDF2)) {
+    return new DerivePbkdfBitsTask(aCx, aAlgorithm, aKey, aLength);
+  }
+
   return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
 }
 
diff --git a/dom/crypto/moz.build b/dom/crypto/moz.build
index a603aabe21f1..4c7e60de983b 100644
--- a/dom/crypto/moz.build
+++ b/dom/crypto/moz.build
@@ -8,6 +8,7 @@ TEST_DIRS += ['test']
 
 EXPORTS.mozilla.dom += [
     'AesKeyAlgorithm.h',
+    'BasicSymmetricKeyAlgorithm.h',
     'CryptoBuffer.h',
     'CryptoKey.h',
     'CryptoKeyPair.h',
diff --git a/dom/crypto/test/test-vectors.js b/dom/crypto/test/test-vectors.js
index 9d0916fc1c23..5d47e51c9ac6 100644
--- a/dom/crypto/test/test-vectors.js
+++ b/dom/crypto/test/test-vectors.js
@@ -310,4 +310,29 @@ tv = {
       "bcf51540afd0174db4033188556675b1d763360af46feeca5b60f882829ee7b2"
     ),
   },
+
+  // RFC 6070 <http://tools.ietf.org/html/rfc6070>
+  pbkdf2_sha1: {
+    password: new TextEncoder("utf-8").encode("passwordPASSWORDpassword"),
+    salt: new TextEncoder("utf-8").encode("saltSALTsaltSALTsaltSALTsaltSALTsalt"),
+    iterations: 4096,
+    length: 25 * 8,
+
+    derived: util.hex2abv(
+      "3d2eec4fe41c849b80c8d83662c0e44a8b291a964cf2f07038"
+    )
+  },
+
+  // https://stackoverflow.com/questions/5130513/pbkdf2-hmac-sha2-test-vectors
+  pbkdf2_sha256: {
+    password: new TextEncoder("utf-8").encode("passwordPASSWORDpassword"),
+    salt: new TextEncoder("utf-8").encode("saltSALTsaltSALTsaltSALTsaltSALTsalt"),
+    iterations: 4096,
+    length: 40 * 8,
+
+    derived: util.hex2abv(
+      "348c89dbcbd32b2f32d814b8116e84cf2b17347ebc1800181c4e2a1fb8dd53e1" +
+      "c635518c7dac47e9"
+    )
+  },
 }
diff --git a/dom/crypto/test/tests.js b/dom/crypto/test/tests.js
index 6f121c9d831f..d1de549b5c41 100644
--- a/dom/crypto/test/tests.js
+++ b/dom/crypto/test/tests.js
@@ -1018,4 +1018,135 @@ TestArray.addTest(
   }
 );
 
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "Import raw PBKDF2 key",
+  function() {
+    var that = this;
+    var alg = "PBKDF2";
+    var key = new TextEncoder("utf-8").encode("password");
 
+    crypto.subtle.importKey("raw", key, alg, false, ["deriveKey"]).then(
+      complete(that, hasKeyFields),
+      error(that)
+    );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "Import raw PBKDF2 key and derive bits using HMAC-SHA-1",
+  function() {
+    var that = this;
+    var alg = "PBKDF2";
+    var key = tv.pbkdf2_sha1.password;
+
+    function doDerive(x) {
+      console.log("deriving");
+      if (!hasKeyFields(x)) {
+        throw "Invalid key; missing field(s)";
+      }
+
+      var alg = {
+        name: "PBKDF2",
+        hash: "SHA-1",
+        salt: tv.pbkdf2_sha1.salt,
+        iterations: tv.pbkdf2_sha1.iterations
+      };
+      return crypto.subtle.deriveBits(alg, x, tv.pbkdf2_sha1.length);
+    }
+    function fail(x) { console.log("failing"); error(that)(x); }
+
+    crypto.subtle.importKey("raw", key, alg, false, ["deriveKey"])
+      .then( doDerive, fail )
+      .then( memcmp_complete(that, tv.pbkdf2_sha1.derived), fail );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "Import raw PBKDF2 key and derive a new key using HMAC-SHA-1",
+  function() {
+    var that = this;
+    var alg = "PBKDF2";
+    var key = tv.pbkdf2_sha1.password;
+
+    function doDerive(x) {
+      console.log("deriving");
+      if (!hasKeyFields(x)) {
+        throw "Invalid key; missing field(s)";
+      }
+
+      var alg = {
+        name: "PBKDF2",
+        hash: "SHA-1",
+        salt: tv.pbkdf2_sha1.salt,
+        iterations: tv.pbkdf2_sha1.iterations
+      };
+
+      var algDerived = {
+        name: "HMAC",
+        hash: {name: "SHA-1"}
+      };
+
+      return crypto.subtle.deriveKey(alg, x, algDerived, false, ["sign", "verify"])
+        .then(function (x) {
+          if (!hasKeyFields(x)) {
+            throw "Invalid key; missing field(s)";
+          }
+
+          if (x.algorithm.length != 512) {
+            throw "Invalid key; incorrect length";
+          }
+
+          return x;
+        });
+    }
+
+    function doSignAndVerify(x) {
+      var data = new Uint8Array(1024);
+
+      return crypto.subtle.sign("HMAC", x, data)
+        .then(function (sig) {
+          return crypto.subtle.verify("HMAC", x, sig, data);
+        });
+    }
+
+    function fail(x) { console.log("failing"); error(that)(x); }
+
+    crypto.subtle.importKey("raw", key, alg, false, ["deriveKey"])
+      .then( doDerive, fail )
+      .then( doSignAndVerify, fail )
+      .then( complete(that), fail );
+  }
+);
+
+// -----------------------------------------------------------------------------
+/*TestArray.addTest(
+  "Import raw PBKDF2 key and derive bits using HMAC-SHA-256",
+  function() {
+    var that = this;
+    var alg = "PBKDF2";
+    var key = tv.pbkdf2_sha256.password;
+
+    function doDerive(x) {
+      console.log("deriving");
+      if (!hasKeyFields(x)) {
+        throw "Invalid key; missing field(s)";
+      }
+
+      var alg = {
+        name: "PBKDF2",
+        hash: "SHA-256",
+        salt: tv.pbkdf2_sha256.salt,
+        iterations: tv.pbkdf2_sha256.iterations
+      };
+      return crypto.subtle.deriveBits(alg, x, tv.pbkdf2_sha256.length);
+    }
+    function fail(x) { console.log("failing"); error(that)(x); }
+
+    crypto.subtle.importKey("raw", key, alg, false, ["deriveKey"])
+      .then( doDerive, fail )
+      .then( memcmp_complete(that, tv.pbkdf2_sha256.derived), fail );
+  }
+);*/
diff --git a/dom/interfaces/base/nsIServiceWorkerManager.idl b/dom/interfaces/base/nsIServiceWorkerManager.idl
index 0a5e5a2d7127..d9a0944f9ccc 100644
--- a/dom/interfaces/base/nsIServiceWorkerManager.idl
+++ b/dom/interfaces/base/nsIServiceWorkerManager.idl
@@ -5,7 +5,7 @@
 
 #include "domstubs.idl"
 
-[uuid(d9539ecb-6665-452c-bae7-4e42f25d23aa)]
+[uuid(44ef0b7e-92c0-48a7-a092-5a49f2533792)]
 interface nsIServiceWorkerManager : nsISupports
 {
   // Returns a Promise
@@ -14,6 +14,8 @@ interface nsIServiceWorkerManager : nsISupports
   // Returns a Promise
   nsISupports unregister(in nsIDOMWindow aWindow, in DOMString aScope);
 
+  // Testing
+  DOMString getScopeForUrl(in DOMString path);
 };
 
 %{ C++
diff --git a/dom/interfaces/html/moz.build b/dom/interfaces/html/moz.build
index 679b24ce273d..1a77c37ecc95 100644
--- a/dom/interfaces/html/moz.build
+++ b/dom/interfaces/html/moz.build
@@ -8,7 +8,6 @@ XPIDL_SOURCES += [
     'nsIDOMHTMLAnchorElement.idl',
     'nsIDOMHTMLAppletElement.idl',
     'nsIDOMHTMLAreaElement.idl',
-    'nsIDOMHTMLAudioElement.idl',
     'nsIDOMHTMLBaseElement.idl',
     'nsIDOMHTMLBodyElement.idl',
     'nsIDOMHTMLBRElement.idl',
@@ -58,7 +57,6 @@ XPIDL_SOURCES += [
     'nsIDOMHTMLTextAreaElement.idl',
     'nsIDOMHTMLTitleElement.idl',
     'nsIDOMHTMLUListElement.idl',
-    'nsIDOMHTMLVideoElement.idl',
     'nsIDOMMediaError.idl',
     'nsIDOMMozBrowserFrame.idl',
     'nsIDOMTimeRanges.idl',
diff --git a/dom/interfaces/html/nsIDOMHTMLAudioElement.idl b/dom/interfaces/html/nsIDOMHTMLAudioElement.idl
deleted file mode 100644
index 181efc82eaf6..000000000000
--- a/dom/interfaces/html/nsIDOMHTMLAudioElement.idl
+++ /dev/null
@@ -1,22 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim:set ts=2 sw=2 sts=2 et cindent: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsIDOMHTMLMediaElement.idl"
-
-/**
- * The nsIDOMHTMLAudioElement interface is the interface to a HTML
- * <audio> element.
- *
- * For more information on this interface, please see
- * http://www.whatwg.org/specs/web-apps/current-work/#audio
- *
- * @status UNDER_DEVELOPMENT
- */
-
-[uuid(75a7f3ca-0761-4b63-863b-6fd6a87ed51c)]
-interface nsIDOMHTMLAudioElement : nsIDOMHTMLMediaElement
-{
-};
diff --git a/dom/interfaces/html/nsIDOMHTMLMediaElement.idl b/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
index bdd5622357dc..ee58b0df8d64 100644
--- a/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
@@ -27,7 +27,7 @@ interface nsIDOMMediaStream;
 #endif
 %}
 
-[uuid(1f9393e8-2df0-4072-87b9-c26999b09acc)]
+[uuid(0e14e6ad-2074-48b7-a247-e545a3a15131)]
 interface nsIDOMHTMLMediaElement : nsISupports
 {
   // error state
@@ -133,4 +133,6 @@ interface nsIDOMHTMLMediaElement : nsISupports
   // * onmozinterruptbegin - called when the media element is interrupted
   //   because of the audiochannel manager.
   // * onmozinterruptend - called when the interruption is concluded
+
+  [notxpcom] boolean isVideo();
 };
diff --git a/dom/interfaces/html/nsIDOMHTMLVideoElement.idl b/dom/interfaces/html/nsIDOMHTMLVideoElement.idl
deleted file mode 100644
index 6e07a348c7c7..000000000000
--- a/dom/interfaces/html/nsIDOMHTMLVideoElement.idl
+++ /dev/null
@@ -1,50 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim:set ts=2 sw=2 sts=2 et cindent: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsIDOMHTMLMediaElement.idl"
-
-/**
- * The nsIDOMHTMLVideoElement interface is the interface to a HTML
- * <video> element.
- *
- * For more information on this interface, please see
- * http://www.whatwg.org/specs/web-apps/current-work/#video
- *
- * @status UNDER_DEVELOPMENT
- */
-
-[uuid(185a3e8f-56a7-4bda-8dc7-2cff6ed07d1d)]
-interface nsIDOMHTMLVideoElement : nsIDOMHTMLMediaElement
-{
-           attribute long width; 
-           attribute long height;
-  readonly attribute unsigned long videoWidth;
-  readonly attribute unsigned long videoHeight;
-           attribute DOMString poster;
-           
-  // A count of the number of video frames that have demuxed from the media
-  // resource. If we were playing perfectly, we'd be able to paint this many
-  // frames.
-  readonly attribute unsigned long mozParsedFrames;
-
-  // A count of the number of frames that have been decoded. We may drop
-  // frames if the decode is taking too much time.
-  readonly attribute unsigned long mozDecodedFrames;
-
-  // A count of the number of frames that have been presented to the rendering
-  // pipeline. We may drop frames if they arrive late at the renderer.
-  readonly attribute unsigned long mozPresentedFrames;
-
-  // Number of presented frames which were painted on screen.
-  readonly attribute unsigned long mozPaintedFrames;
-
-  // Time which the last painted video frame was late by, in seconds.
-  readonly attribute double mozFrameDelay;
-
-  // True if the video has an audio track available.
-  readonly attribute bool mozHasAudio;
-};
-
diff --git a/dom/media/MediaManager.cpp b/dom/media/MediaManager.cpp
index dfd018f3cf3a..68f8de21dfab 100644
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@@ -2037,6 +2037,19 @@ GetUserMediaCallbackMediaStreamListener::NotifyFinished(MediaStreamGraph* aGraph
   NS_DispatchToMainThread(new GetUserMediaListenerRemove(mWindowID, this));
 }
 
+// Called from the MediaStreamGraph thread
+void
+GetUserMediaCallbackMediaStreamListener::NotifyDirectListeners(MediaStreamGraph* aGraph,
+                                                               bool aHasListeners)
+{
+  nsRefPtr<MediaOperationRunnable> runnable;
+  runnable = new MediaOperationRunnable(MEDIA_DIRECT_LISTENERS,
+                                        this, nullptr, nullptr,
+                                        mAudioSource, mVideoSource,
+                                        aHasListeners, mWindowID, nullptr);
+  mMediaThread->Dispatch(runnable, NS_DISPATCH_NORMAL);
+}
+
 // Called from the MediaStreamGraph thread
 // this can be in response to our own RemoveListener() (via ::Remove()), or
 // because the DOM GC'd the DOMLocalMediaStream/etc we're attached to.
diff --git a/dom/media/MediaManager.h b/dom/media/MediaManager.h
index f710bc621d89..3fa09df76f84 100644
--- a/dom/media/MediaManager.h
+++ b/dom/media/MediaManager.h
@@ -175,10 +175,35 @@ public:
   }
 
   virtual void
-  NotifyFinished(MediaStreamGraph* aGraph) MOZ_OVERRIDE;
+  NotifyEvent(MediaStreamGraph* aGraph,
+              MediaStreamListener::MediaStreamGraphEvent aEvent) MOZ_OVERRIDE
+  {
+    switch (aEvent) {
+      case EVENT_FINISHED:
+        NotifyFinished(aGraph);
+        break;
+      case EVENT_REMOVED:
+        NotifyRemoved(aGraph);
+        break;
+      case EVENT_HAS_DIRECT_LISTENERS:
+        NotifyDirectListeners(aGraph, true);
+        break;
+      case EVENT_HAS_NO_DIRECT_LISTENERS:
+        NotifyDirectListeners(aGraph, false);
+        break;
+      default:
+        break;
+    }
+  }
 
   virtual void
-  NotifyRemoved(MediaStreamGraph* aGraph) MOZ_OVERRIDE;
+  NotifyFinished(MediaStreamGraph* aGraph);
+
+  virtual void
+  NotifyRemoved(MediaStreamGraph* aGraph);
+
+  virtual void
+  NotifyDirectListeners(MediaStreamGraph* aGraph, bool aHasListeners);
 
 private:
   // Set at construction
@@ -244,7 +269,8 @@ class GetUserMediaNotificationEvent: public nsRunnable
 
 typedef enum {
   MEDIA_START,
-  MEDIA_STOP
+  MEDIA_STOP,
+  MEDIA_DIRECT_LISTENERS
 } MediaOperation;
 
 class MediaManager;
@@ -299,7 +325,7 @@ public:
     DOMMediaStream::OnTracksAvailableCallback* aOnTracksAvailableCallback,
     MediaEngineSource* aAudioSource,
     MediaEngineSource* aVideoSource,
-    bool aNeedsFinish,
+    bool aBool,
     uint64_t aWindowID,
     already_AddRefed<nsIDOMGetUserMediaErrorCallback> aError)
     : mType(aType)
@@ -308,7 +334,7 @@ public:
     , mAudioSource(aAudioSource)
     , mVideoSource(aVideoSource)
     , mListener(aListener)
-    , mFinish(aNeedsFinish)
+    , mBool(aBool)
     , mWindowID(aWindowID)
     , mError(aError)
   {}
@@ -398,7 +424,7 @@ public:
             mVideoSource->Deallocate();
           }
           // Do this after stopping all tracks with EndTrack()
-          if (mFinish) {
+          if (mBool) {
             source->Finish();
           }
           nsIRunnable *event =
@@ -413,6 +439,15 @@ public:
         }
         break;
 
+      case MEDIA_DIRECT_LISTENERS:
+        {
+          NS_ASSERTION(!NS_IsMainThread(), "Never call on main thread");
+          if (mVideoSource) {
+            mVideoSource->SetDirectListeners(mBool);
+          }
+        }
+        break;
+
       default:
         MOZ_ASSERT(false,"invalid MediaManager operation");
         break;
@@ -427,7 +462,7 @@ private:
   nsRefPtr<MediaEngineSource> mAudioSource; // threadsafe
   nsRefPtr<MediaEngineSource> mVideoSource; // threadsafe
   nsRefPtr<GetUserMediaCallbackMediaStreamListener> mListener; // threadsafe
-  bool mFinish;
+  bool mBool;
   uint64_t mWindowID;
   nsCOMPtr<nsIDOMGetUserMediaErrorCallback> mError;
 };
diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
index 6debf2bef339..0b62c3b828af 100644
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -15,6 +15,7 @@
 #include "nsIScriptGlobalObject.h"
 #include "nsIScriptContext.h"
 #include "nsDOMJSUtils.h"
+#include "nsJSUtils.h"
 #include "nsCxPusher.h"
 #include "nsIDocument.h"
 #include "nsIJSRuntimeService.h"
@@ -405,13 +406,11 @@ JSValToNPVariant(NPP npp, JSContext *cx, JS::Value val, NPVariant *variant)
       }
     } else if (val.isString()) {
       JSString *jsstr = val.toString();
-      size_t length;
-      const jschar *chars = ::JS_GetStringCharsZAndLength(cx, jsstr, &length);
-      if (!chars) {
-          return false;
-      }
 
-      nsDependentString str(chars, length);
+      nsAutoJSString str;
+      if (!str.init(cx, jsstr)) {
+        return false;
+      }
 
       uint32_t len;
       char *p = ToNewUTF8String(str, &len);
diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp
index 90ab66fd38cb..92b9dbfe12bc 100644
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -1303,10 +1303,10 @@ _utf8fromidentifier(NPIdentifier id)
   }
 
   JSString *str = NPIdentifierToString(id);
+  nsAutoString autoStr;
+  AssignJSFlatString(autoStr, JS_ASSERT_STRING_IS_FLAT(str));
 
-  return
-    ToNewUTF8String(nsDependentString(::JS_GetInternedStringChars(str),
-                                      ::JS_GetStringLength(str)));
+  return ToNewUTF8String(autoStr);
 }
 
 int32_t
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.cpp b/dom/plugins/base/nsNPAPIPluginInstance.cpp
index abc63a7f4120..d6b6c8305905 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.cpp
+++ b/dom/plugins/base/nsNPAPIPluginInstance.cpp
@@ -55,6 +55,7 @@ using namespace mozilla;
 #include "GLContext.h"
 #include "TexturePoolOGL.h"
 #include "GLSharedHandleHelpers.h"
+#include "SurfaceTypes.h"
 
 using namespace mozilla::gl;
 
@@ -89,7 +90,7 @@ static bool EnsureGLContext()
   if (!sPluginContext) {
     gfxIntSize dummySize(16, 16);
     sPluginContext = GLContextProvider::CreateOffscreen(dummySize,
-                                                        GLContext::SurfaceCaps::Any());
+                                                        SurfaceCaps::Any());
   }
 
   return sPluginContext != nullptr;
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index d6a081c135ec..e1c36b3a572a 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -165,7 +165,7 @@ nsPluginInstanceOwner::GetImageContainer()
   gfxSize resolution = mObjectFrame->PresContext()->PresShell()->GetCumulativeResolution();
   ScreenSize screenSize = (r * LayoutDeviceToScreenScale(resolution.width, resolution.height)).Size();
   mInstance->NotifySize(nsIntSize(screenSize.width, screenSize.height));
-  
+
   container = LayerManager::CreateImageContainer();
 
   nsRefPtr<Image> img = container->CreateImage(ImageFormat::SHARED_TEXTURE);
@@ -260,7 +260,7 @@ nsPluginInstanceOwner::nsPluginInstanceOwner()
   // create nsPluginNativeWindow object, it is derived from NPWindow
   // struct and allows to manipulate native window procedure
   nsCOMPtr<nsIPluginHost> pluginHostCOM = do_GetService(MOZ_PLUGIN_HOST_CONTRACTID);
-  mPluginHost = static_cast<nsPluginHost*>(pluginHostCOM.get());  
+  mPluginHost = static_cast<nsPluginHost*>(pluginHostCOM.get());
   if (mPluginHost)
     mPluginHost->NewPluginNativeWindow(&mPluginWindow);
   else
@@ -429,7 +429,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetAttribute(const char* name, const char*
 {
   NS_ENSURE_ARG_POINTER(name);
   NS_ENSURE_ARG_POINTER(result);
-  
+
   nsresult rv = EnsureCachedAttrParamArrays();
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -530,9 +530,9 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetURL(const char *aURL,
 NS_IMETHODIMP nsPluginInstanceOwner::ShowStatus(const char *aStatusMsg)
 {
   nsresult  rv = NS_ERROR_FAILURE;
-  
+
   rv = this->ShowStatus(NS_ConvertUTF8toUTF16(aStatusMsg).get());
-  
+
   return rv;
 }
 
@@ -558,7 +558,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::ShowStatus(const char16_t *aStatusMsg)
   if (NS_FAILED(rv) || !browserChrome) {
     return rv;
   }
-  rv = browserChrome->SetStatus(nsIWebBrowserChrome::STATUS_SCRIPT, 
+  rv = browserChrome->SetStatus(nsIWebBrowserChrome::STATUS_SCRIPT,
                                 aStatusMsg);
 
   return rv;
@@ -626,7 +626,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::InvalidateRegion(NPRegion invalidRegion)
 {
   return NS_ERROR_NOT_IMPLEMENTED;
 }
- 
+
 NS_IMETHODIMP
 nsPluginInstanceOwner::RedrawPlugin()
 {
@@ -642,7 +642,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetNetscapeWindow(void *value)
     NS_WARNING("plugin owner has no owner in getting doc's window handle");
     return NS_ERROR_FAILURE;
   }
-  
+
 #if defined(XP_WIN)
   void** pvalue = (void**)value;
   nsViewManager* vm = mObjectFrame->PresContext()->GetPresShell()->GetViewManager();
@@ -652,18 +652,18 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetNetscapeWindow(void *value)
   // This property is provided to allow a "windowless" plugin to determine the window it is drawing
   // in, so it can translate mouse coordinates it receives directly from the operating system
   // to coordinates relative to itself.
-  
+
   // The original code (outside this #if) returns the document's window, which is OK if the window the "windowless" plugin
   // is drawing into has the same origin as the document's window, but this is not the case for "windowless" plugins inside of scrolling DIVs etc
-  
+
   // To make sure "windowless" plugins always get the right origin for translating mouse coordinates, this code
   // determines the window handle of the mozilla window containing the "windowless" plugin.
-  
+
   // Given that this HWND may not be that of the document's window, there is a slight risk
   // of confusing a plugin that is using this HWND for illicit purposes, but since the documentation
   // does not suggest this HWND IS that of the document window, rather that of the window
   // the plugin is drawn in, this seems like a safe fix.
-  
+
   // we only attempt to get the nearest window if this really is a "windowless" plugin so as not
   // to change any behaviour for the much more common windowed plugins,
   // though why this method would even be being called for a windowed plugin escapes me.
@@ -676,13 +676,13 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetNetscapeWindow(void *value)
     //
     // fixing both the caret and ability to interact issues for a windowless control in a non document aligned windw
     // does not seem to be possible without a change to the flash plugin
-    
+
     nsIWidget* win = mObjectFrame->GetNearestWidget();
     if (win) {
       nsView *view = nsView::GetViewFor(win);
       NS_ASSERTION(view, "No view for widget");
       nsPoint offset = view->GetOffsetTo(nullptr);
-      
+
       if (offset.x || offset.y) {
         // in the case the two windows are offset from eachother, we do go ahead and return the correct enclosing window
         // so that mouse co-ordinates are not messed up.
@@ -1180,7 +1180,7 @@ void nsPluginInstanceOwner::CARefresh(nsITimer *aTimer, void *aClosure) {
     r.left = 0;
     r.top = 0;
     r.right = window->width;
-    r.bottom = window->height; 
+    r.bottom = window->height;
     instanceOwner->InvalidateRect(&r);
   }
 }
@@ -1220,7 +1220,7 @@ void nsPluginInstanceOwner::AddToCARefreshTimer() {
 
   if (sCARefreshListeners->Length() == 1) {
     *sCATimer = do_CreateInstance("@mozilla.org/timer;1");
-    (*sCATimer)->InitWithFuncCallback(CARefresh, nullptr, 
+    (*sCATimer)->InitWithFuncCallback(CARefresh, nullptr,
                    DEFAULT_REFRESH_RATE, nsITimer::TYPE_REPEATING_SLACK);
   }
 }
@@ -1321,13 +1321,13 @@ void nsPluginInstanceOwner::RenderCoreAnimation(CGContextRef aCGContext,
 
 void* nsPluginInstanceOwner::GetPluginPortCopy()
 {
-  if (GetDrawingModel() == NPDrawingModelCoreGraphics || 
+  if (GetDrawingModel() == NPDrawingModelCoreGraphics ||
       GetDrawingModel() == NPDrawingModelCoreAnimation ||
       GetDrawingModel() == NPDrawingModelInvalidatingCoreAnimation)
     return &mCGPluginPortCopy;
   return nullptr;
 }
-  
+
 // Currently (on OS X in Cocoa widgets) any changes made as a result of
 // calling GetPluginPortFromWidget() are immediately reflected in the NPWindow
 // structure that has been passed to the plugin via SetWindow().  This is
@@ -1446,7 +1446,7 @@ bool nsPluginInstanceOwner::AddPluginView(const LayoutDeviceRect& aRect /* = Lay
 {
   if (!mJavaView) {
     mJavaView = mInstance->GetJavaSurface();
-  
+
     if (!mJavaView)
       return false;
 
@@ -1537,7 +1537,7 @@ void nsPluginInstanceOwner::ExitFullScreen() {
   RemovePluginView();
 
   mFullScreen = false;
-  
+
   int32_t model = mInstance->GetANPDrawingModel();
 
   if (model == kSurface_ANPDrawingModel) {
@@ -1581,7 +1581,7 @@ nsresult nsPluginInstanceOwner::DispatchFocusToPlugin(nsIDOMEvent* aFocusEvent)
       event.data.lifecycle.action = kLoseFocus_ANPLifecycleAction;
     }
     else {
-      NS_ASSERTION(false, "nsPluginInstanceOwner::DispatchFocusToPlugin, wierd eventType");   
+      NS_ASSERTION(false, "nsPluginInstanceOwner::DispatchFocusToPlugin, wierd eventType");
     }
     mInstance->HandleEvent(&event, nullptr);
   }
@@ -1603,11 +1603,11 @@ nsresult nsPluginInstanceOwner::DispatchFocusToPlugin(nsIDOMEvent* aFocusEvent)
     if (nsEventStatus_eConsumeNoDefault == rv) {
       aFocusEvent->PreventDefault();
       aFocusEvent->StopPropagation();
-    }   
+    }
   }
-  
+
   return NS_OK;
-}    
+}
 
 nsresult nsPluginInstanceOwner::ProcessKeyPress(nsIDOMEvent* aKeyEvent)
 {
@@ -1643,12 +1643,12 @@ nsresult nsPluginInstanceOwner::DispatchKeyToPlugin(nsIDOMEvent* aKeyEvent)
       if (nsEventStatus_eConsumeNoDefault == rv) {
         aKeyEvent->PreventDefault();
         aKeyEvent->StopPropagation();
-      }   
+      }
     }
   }
 
   return NS_OK;
-}    
+}
 
 nsresult
 nsPluginInstanceOwner::ProcessMouseDown(nsIDOMEvent* aMouseEvent)
@@ -1663,7 +1663,7 @@ nsPluginInstanceOwner::ProcessMouseDown(nsIDOMEvent* aMouseEvent)
   // otherwise, we might not get key events
   if (mObjectFrame && mPluginWindow &&
       mPluginWindow->type == NPWindowTypeDrawable) {
-    
+
     nsIFocusManager* fm = nsFocusManager::GetFocusManager();
     if (fm) {
       nsCOMPtr<nsIDOMElement> elem = do_QueryInterface(mContent);
@@ -1680,7 +1680,7 @@ nsPluginInstanceOwner::ProcessMouseDown(nsIDOMEvent* aMouseEvent)
       return aMouseEvent->PreventDefault(); // consume event
     }
   }
-  
+
   return NS_OK;
 }
 
@@ -2115,7 +2115,7 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
       break;
 
    //XXX case NS_MOUSE_SCROLL_EVENT: not received.
- 
+
    case NS_KEY_EVENT:
       if (anEvent.pluginEvent)
         {
@@ -2163,7 +2163,7 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
         }
       break;
 
-    default: 
+    default:
       switch (anEvent.message)
         {
         case NS_FOCUS_CONTENT:
@@ -2283,7 +2283,7 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
     }
     rv = nsEventStatus_eConsumeNoDefault;
 #endif
- 
+
   return rv;
 }
 
@@ -2354,7 +2354,7 @@ void nsPluginInstanceOwner::Paint(const gfxRect& aDirtyRect, CGContextRef cgCont
   if (!mInstance || !mObjectFrame)
     return;
 
-  gfxRect dirtyRectCopy = aDirtyRect; 
+  gfxRect dirtyRectCopy = aDirtyRect;
   double scaleFactor = 1.0;
   GetContentsScaleFactor(&scaleFactor);
   if (scaleFactor != 1.0) {
@@ -2375,7 +2375,7 @@ void nsPluginInstanceOwner::DoCocoaEventDrawRect(const gfxRect& aDrawRect, CGCon
 {
   if (!mInstance || !mObjectFrame)
     return;
- 
+
   // The context given here is only valid during the HandleEvent call.
   NPCocoaEvent updateEvent;
   InitializeNPCocoaEvent(&updateEvent);
@@ -2432,7 +2432,7 @@ void nsPluginInstanceOwner::Paint(gfxContext* aContext,
       aFrameRect.width  != pluginSurface->Width() ||
       aFrameRect.height != pluginSurface->Height()) {
 
-    pluginSurface = new gfxImageSurface(gfxIntSize(aFrameRect.width, aFrameRect.height), 
+    pluginSurface = new gfxImageSurface(gfxIntSize(aFrameRect.width, aFrameRect.height),
                                         gfxImageFormat::ARGB32);
     if (!pluginSurface)
       return;
@@ -2440,26 +2440,26 @@ void nsPluginInstanceOwner::Paint(gfxContext* aContext,
 
   // Clears buffer.  I think this is needed.
   gfxUtils::ClearThebesSurface(pluginSurface);
-  
+
   ANPEvent event;
   event.inSize = sizeof(ANPEvent);
   event.eventType = 4;
   event.data.draw.model = 1;
-  
+
   event.data.draw.clip.top     = 0;
   event.data.draw.clip.left    = 0;
   event.data.draw.clip.bottom  = aFrameRect.width;
   event.data.draw.clip.right   = aFrameRect.height;
-  
+
   event.data.draw.data.bitmap.format   = kRGBA_8888_ANPBitmapFormat;
   event.data.draw.data.bitmap.width    = aFrameRect.width;
   event.data.draw.data.bitmap.height   = aFrameRect.height;
   event.data.draw.data.bitmap.baseAddr = pluginSurface->Data();
   event.data.draw.data.bitmap.rowBytes = aFrameRect.width * 4;
-  
+
   if (!mInstance)
     return;
-    
+
   mInstance->HandleEvent(&event, nullptr);
 
   aContext->SetOperator(gfxContext::OPERATOR_SOURCE);
@@ -2543,7 +2543,7 @@ void nsPluginInstanceOwner::Paint(gfxContext* aContext,
 nsresult
 nsPluginInstanceOwner::Renderer::DrawWithXlib(cairo_surface_t* xsurface,
                                               nsIntPoint offset,
-                                              nsIntRect *clipRects, 
+                                              nsIntRect *clipRects,
                                               uint32_t numClipRects)
 {
   Screen *screen = cairo_xlib_surface_get_screen(xsurface);
@@ -2612,7 +2612,7 @@ nsPluginInstanceOwner::Renderer::DrawWithXlib(cairo_surface_t* xsurface,
     doupdatewindow = true;
   }
 
-  NPSetWindowCallbackStruct* ws_info = 
+  NPSetWindowCallbackStruct* ws_info =
     static_cast<NPSetWindowCallbackStruct*>(mWindow->ws_info);
 #ifdef MOZ_X11
   if (ws_info->visual != visual || ws_info->colormap != colormap) {
@@ -2725,7 +2725,7 @@ nsresult nsPluginInstanceOwner::Init(nsIContent* aContent)
   mContent->AddEventListener(NS_LITERAL_STRING("draggesture"), this, true);
   mContent->AddEventListener(NS_LITERAL_STRING("dragend"), this, true);
 
-  return NS_OK; 
+  return NS_OK;
 }
 
 void* nsPluginInstanceOwner::GetPluginPortFromWidget()
@@ -2740,7 +2740,7 @@ void* nsPluginInstanceOwner::GetPluginPortFromWidget()
     else
 #endif
 #ifdef XP_MACOSX
-    if (GetDrawingModel() == NPDrawingModelCoreGraphics || 
+    if (GetDrawingModel() == NPDrawingModelCoreGraphics ||
         GetDrawingModel() == NPDrawingModelCoreAnimation ||
         GetDrawingModel() == NPDrawingModelInvalidatingCoreAnimation)
       result = mWidget->GetNativeData(NS_NATIVE_PLUGIN_PORT_CG);
@@ -2766,13 +2766,13 @@ NS_IMETHODIMP nsPluginInstanceOwner::CreateWidget(void)
   NS_ENSURE_TRUE(mPluginWindow, NS_ERROR_NULL_POINTER);
 
   nsresult rv = NS_ERROR_FAILURE;
-  
+
   // Can't call this twice!
   if (mWidget) {
     NS_WARNING("Trying to create a plugin widget twice!");
     return NS_ERROR_FAILURE;
   }
-  
+
   bool windowless = false;
   mInstance->IsWindowless(&windowless);
   if (!windowless
@@ -2844,10 +2844,10 @@ NS_IMETHODIMP nsPluginInstanceOwner::CreateWidget(void)
     mPluginWindow->window = nullptr;
 #ifdef MOZ_X11
     // Fill in the display field.
-    NPSetWindowCallbackStruct* ws_info = 
+    NPSetWindowCallbackStruct* ws_info =
     static_cast<NPSetWindowCallbackStruct*>(mPluginWindow->ws_info);
     ws_info->display = DefaultXDisplay();
-    
+
     nsAutoCString description;
     GetPluginDescription(description);
     NS_NAMED_LITERAL_CSTRING(flash10Head, "Shockwave Flash 10.");
@@ -2860,7 +2860,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::CreateWidget(void)
     mPluginWindow->window = GetPluginPortFromWidget();
     // tell the plugin window about the widget
     mPluginWindow->SetPluginWidget(mWidget);
-    
+
     // tell the widget about the current plugin instance owner.
     nsCOMPtr<nsIPluginWidget> pluginWidget = do_QueryInterface(mWidget);
     if (pluginWidget) {
diff --git a/dom/plugins/ipc/PluginInstanceParent.cpp b/dom/plugins/ipc/PluginInstanceParent.cpp
index e6b1c75e4f0e..d4f771dac7af 100644
--- a/dom/plugins/ipc/PluginInstanceParent.cpp
+++ b/dom/plugins/ipc/PluginInstanceParent.cpp
@@ -583,7 +583,7 @@ PluginInstanceParent::RecvShow(const NPRect& updatedRect,
             NS_WARNING("Got bad IOSurfaceDescriptor in RecvShow");
             return false;
         }
-      
+
         if (mFrontIOSurface)
             *prevSurface = IOSurfaceDescriptor(mFrontIOSurface->GetIOSurfaceID(),
                                                mFrontIOSurface->GetContentsScaleFactor());
@@ -624,7 +624,7 @@ PluginInstanceParent::RecvShow(const NPRect& updatedRect,
             // scribbling on it again, or worse, destroys it.
             mFrontSurface->Finish();
             FinishX(DefaultXDisplay());
-        } else 
+        } else
 #endif
         {
             mFrontSurface->Flush();
@@ -697,7 +697,7 @@ PluginInstanceParent::GetImageContainer(ImageContainer** aContainer)
 {
 #ifdef XP_MACOSX
     MacIOSurface* ioSurface = nullptr;
-  
+
     if (mFrontIOSurface) {
       ioSurface = mFrontIOSurface;
     } else if (mIOSurface) {
@@ -1001,7 +1001,7 @@ PluginInstanceParent::NPP_SetWindow(const NPWindow* aWindow)
     window.contentsScaleFactor = floatScaleFactor;
 
     if (mShWidth != window.width * scaleFactor || mShHeight != window.height * scaleFactor) {
-        if (mDrawingModel == NPDrawingModelCoreAnimation || 
+        if (mDrawingModel == NPDrawingModelCoreAnimation ||
             mDrawingModel == NPDrawingModelInvalidatingCoreAnimation) {
             mIOSurface = MacIOSurface::CreateIOSurface(window.width, window.height,
                                                        floatScaleFactor);
@@ -1018,7 +1018,7 @@ PluginInstanceParent::NPP_SetWindow(const NPWindow* aWindow)
                                 SharedMemory::TYPE_BASIC, &mShSurface)) {
                     PLUGIN_LOG_DEBUG(("Shared memory could not be allocated."));
                     return NPERR_GENERIC_ERROR;
-                } 
+                }
             }
         }
         mShWidth = window.width * scaleFactor;
@@ -1280,9 +1280,9 @@ PluginInstanceParent::NPP_HandleEvent(void* event)
                 NS_ERROR("No IOSurface allocated.");
                 return false;
             }
-            if (!CallNPP_HandleEvent_IOSurface(npremoteevent, 
-                                               mIOSurface->GetIOSurfaceID(), 
-                                               &handled)) 
+            if (!CallNPP_HandleEvent_IOSurface(npremoteevent,
+                                               mIOSurface->GetIOSurfaceID(),
+                                               &handled))
                 return false; // no good way to handle errors here...
 
             CGContextRef cgContext = npevent->data.draw.context;
@@ -1294,7 +1294,7 @@ PluginInstanceParent::NPP_HandleEvent(void* event)
                 return false;
             }
             if (cgContext) {
-                nsCARenderer::DrawSurfaceToCGContext(cgContext, mIOSurface, 
+                nsCARenderer::DrawSurfaceToCGContext(cgContext, mIOSurface,
                                                      mShColorSpace,
                                                      npevent->data.draw.x,
                                                      npevent->data.draw.y,
@@ -1312,7 +1312,7 @@ PluginInstanceParent::NPP_HandleEvent(void* event)
                 return false;
             }
             if (cgContext) {
-                nsCARenderer::DrawSurfaceToCGContext(cgContext, mFrontIOSurface, 
+                nsCARenderer::DrawSurfaceToCGContext(cgContext, mFrontIOSurface,
                                                      mShColorSpace,
                                                      npevent->data.draw.x,
                                                      npevent->data.draw.y,
@@ -1330,8 +1330,8 @@ PluginInstanceParent::NPP_HandleEvent(void* event)
                 return false;
             }
 
-            if (!CallNPP_HandleEvent_Shmem(npremoteevent, mShSurface, 
-                                           &handled, &mShSurface)) 
+            if (!CallNPP_HandleEvent_Shmem(npremoteevent, mShSurface,
+                                           &handled, &mShSurface))
                 return false; // no good way to handle errors here...
 
             if (!mShSurface.IsReadable()) {
@@ -1348,11 +1348,11 @@ PluginInstanceParent::NPP_HandleEvent(void* event)
             if (!mShColorSpace) {
                 PLUGIN_LOG_DEBUG(("Could not allocate ColorSpace."));
                 return false;
-            } 
-            CGContextRef shContext = ::CGBitmapContextCreate(shContextByte, 
-                                    mShWidth, mShHeight, 8, 
-                                    mShWidth*4, mShColorSpace, 
-                                    kCGImageAlphaPremultipliedFirst | 
+            }
+            CGContextRef shContext = ::CGBitmapContextCreate(shContextByte,
+                                    mShWidth, mShHeight, 8,
+                                    mShWidth*4, mShColorSpace,
+                                    kCGImageAlphaPremultipliedFirst |
                                     kCGBitmapByteOrder32Host);
             if (!shContext) {
                 PLUGIN_LOG_DEBUG(("Could not allocate CGBitmapContext."));
@@ -1362,9 +1362,9 @@ PluginInstanceParent::NPP_HandleEvent(void* event)
             CGImageRef shImage = ::CGBitmapContextCreateImage(shContext);
             if (shImage) {
                 CGContextRef cgContext = npevent->data.draw.context;
-     
-                ::CGContextDrawImage(cgContext, 
-                                     CGRectMake(0,0,mShWidth,mShHeight), 
+
+                ::CGContextDrawImage(cgContext,
+                                     CGRectMake(0,0,mShWidth,mShHeight),
                                      shImage);
                 ::CGImageRelease(shImage);
             } else {
@@ -1723,7 +1723,7 @@ PluginInstanceParent::AnswerNPN_InitAsyncSurface(const gfxIntSize& size,
             ID3D10Device1 *device = gfxWindowsPlatform::GetPlatform()->GetD3D10Device();
 
             nsRefPtr<ID3D10Texture2D> texture;
-            
+
             CD3D10_TEXTURE2D_DESC desc(DXGI_FORMAT_B8G8R8A8_UNORM, size.width, size.height, 1, 1);
             desc.MiscFlags = D3D10_RESOURCE_MISC_SHARED_KEYEDMUTEX;
             desc.BindFlags = D3D10_BIND_RENDER_TARGET | D3D10_BIND_SHADER_RESOURCE;
@@ -1744,7 +1744,7 @@ PluginInstanceParent::AnswerNPN_InitAsyncSurface(const gfxIntSize& size,
                 *result = false;
                 return true;
             }
-            
+
             surfData->size() = size;
             surfData->data() = sharedHandle;
             surfData->format() = format;
@@ -1798,7 +1798,7 @@ PluginInstanceParent::RecvReleaseDXGISharedSurface(const DXGISharedSurfaceHandle
   focus from dom -> child:
     Focus manager calls on widget to set the focus on the window.
     We pick up the resulting wm_setfocus event here, and forward
-    that over ipc to the child which calls set focus on itself. 
+    that over ipc to the child which calls set focus on itself.
 
   focus from child -> focus manager:
     Child picks up the local wm_setfocus and sends it via ipc over
@@ -1854,7 +1854,7 @@ PluginInstanceParent::SubclassPluginWindow(HWND aWnd)
 
     if (!mPluginHWND) {
         mPluginHWND = aWnd;
-        mPluginWndProc = 
+        mPluginWndProc =
             (WNDPROC)::SetWindowLongPtrA(mPluginHWND, GWLP_WNDPROC,
                          reinterpret_cast<LONG_PTR>(PluginWindowHookProc));
         DebugOnly<bool> bRes = ::SetPropW(mPluginHWND, kPluginInstanceParentProperty, this);
@@ -1886,13 +1886,13 @@ PluginInstanceParent::UnsubclassPluginWindow()
  *
  * windowless, offscreen:
  *
- * WM_WINDOWPOSCHANGED: origin is relative to container 
+ * WM_WINDOWPOSCHANGED: origin is relative to container
  * setwindow: origin is 0,0
  * WM_PAINT: origin is 0,0
  *
  * windowless, native:
  *
- * WM_WINDOWPOSCHANGED: origin is relative to container 
+ * WM_WINDOWPOSCHANGED: origin is relative to container
  * setwindow: origin is relative to container
  * WM_PAINT: origin is relative to container
  *
diff --git a/dom/tests/mochitest/bugs/test_bug291377.html b/dom/tests/mochitest/bugs/test_bug291377.html
index 926fdb388b80..9902c17680f9 100644
--- a/dom/tests/mochitest/bugs/test_bug291377.html
+++ b/dom/tests/mochitest/bugs/test_bug291377.html
@@ -26,13 +26,13 @@ try {
   /* Check that we can touch various properties */
   isnot(e.lineNumber, undefined, "Unexpected line number"); //This line number is dependent on the implementation of the SpecialPowers API
   is(e.name, "NS_ERROR_MALFORMED_URI", "Unexpected exception name");
-  isnot(e.message, "", "Should have a message");
+  ise(e.message, "", "Should not have a message for this case");
   isnot(e.result, 0, "Should have a result");
   
   is(e.result, SpecialPowers.Cr.NS_ERROR_MALFORMED_URI);
 }
 
-is(threw, true, "Not enough arguments to a call should throw");
+is(threw, true, "We need a different testcase for XPConnect exceptions?");
 </script>
 </pre>
 </body>
diff --git a/dom/tests/mochitest/bugs/test_bug541530.html b/dom/tests/mochitest/bugs/test_bug541530.html
index 952ece1c9cf4..cb97d4ca3823 100644
--- a/dom/tests/mochitest/bugs/test_bug541530.html
+++ b/dom/tests/mochitest/bugs/test_bug541530.html
@@ -50,7 +50,9 @@ try {
     this.__defineGetter__.call(window.location, 'href', function(){});
     ok(false, "shouldn't be able to override location.href");
 } catch (e) {
-    ok(/shadow/.exec(e.message), "Should be caught by the anti-shadow mechanism.");
+    ok(/shadow/.exec(e.message) ||
+       /can't redefine non-configurable/.exec(e.message),
+       "Should be caught by the anti-shadow mechanism.");
 }
 
 // Try deleting the property.
@@ -61,17 +63,16 @@ delete Object.getPrototypeOf(window.location).href;
 ok(typeof window.location.href !== 'undefined',
    "shouldn't be able to delete the property off of the prototype");
 
-try {
-    this.__defineGetter__.call(Object.getPrototypeOf(window.location), 'href', function(){});
-    ok(false, "shouldn't be able to use the prototype");
-} catch (e) {
-}
+this.__defineGetter__.call(Object.getPrototypeOf(window.location), 'href', function(){});
+ok(true, "should be able to define things on the prototype");
 
 try {
     this.__defineSetter__.call(window.location, 'href', function(){});
     ok(false, "overrode a setter for location.href?");
 } catch (e) {
-    ok(/shadow/.exec(e.message), "Should be caught by the anti-shadow mechanism.");
+    ok(/shadow/.exec(e.message) ||
+       /can't redefine non-configurable/.exec(e.message),
+       "Should be caught by the anti-shadow mechanism.");
 }
 
 try {
diff --git a/dom/tests/mochitest/webapps/head.js b/dom/tests/mochitest/webapps/head.js
index 52ae6361fa00..22e63766221a 100644
--- a/dom/tests/mochitest/webapps/head.js
+++ b/dom/tests/mochitest/webapps/head.js
@@ -1,6 +1,10 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
+const { classes: Cc, interfaces: Ci, utils: Cu, results: Cr } = Components;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+
 function runAll(steps) {
   SimpleTest.waitForExplicitFinish();
 
@@ -46,3 +50,44 @@ function confirmNextInstall() {
   }
   popupPanel.addEventListener("popupshown", onPopupShown, false);
 }
+
+// We need to mock the Alerts service, otherwise the alert that is shown
+// at the end of an installation makes the test leak the app's icon.
+
+const CID = Cc["@mozilla.org/uuid-generator;1"].getService(Ci.nsIUUIDGenerator).generateUUID();
+const ALERTS_SERVICE_CONTRACT_ID = "@mozilla.org/alerts-service;1";
+const ALERTS_SERVICE_CID = Components.ID(Cc[ALERTS_SERVICE_CONTRACT_ID].number);
+
+var AlertsService = {
+  classID: Components.ID(CID),
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIFactory,
+                                         Ci.nsIAlertsService]),
+
+  createInstance: function(aOuter, aIID) {
+    if (aOuter) {
+      throw Cr.NS_ERROR_NO_AGGREGATION;
+    }
+
+    return this.QueryInterface(aIID);
+  },
+
+  init: function() {
+    Components.manager.nsIComponentRegistrar.registerFactory(this.classID,
+      "", ALERTS_SERVICE_CONTRACT_ID, this);
+  },
+
+  restore: function() {
+    Components.manager.nsIComponentRegistrar.registerFactory(ALERTS_SERVICE_CID,
+      "", ALERTS_SERVICE_CONTRACT_ID, null);
+  },
+
+  showAlertNotification: function() {
+  },
+};
+
+AlertsService.init();
+
+SimpleTest.registerCleanupFunction(() => {
+  AlertsService.restore();
+});
diff --git a/dom/tests/mochitest/webapps/test_bug_771294.xul b/dom/tests/mochitest/webapps/test_bug_771294.xul
index e395e063a004..4438c7a73505 100644
--- a/dom/tests/mochitest/webapps/test_bug_771294.xul
+++ b/dom/tests/mochitest/webapps/test_bug_771294.xul
@@ -17,9 +17,6 @@
   </body>
 
 <script>
-const Ci = Components.interfaces;
-const Cu = Components.utils;
-
 SimpleTest.waitForExplicitFinish();
 
 SpecialPowers.setAllAppsLaunchable(true);
diff --git a/dom/tests/mochitest/webapps/test_getNotInstalled.xul b/dom/tests/mochitest/webapps/test_getNotInstalled.xul
index 0cf9d54a30b3..ca355baf1f70 100644
--- a/dom/tests/mochitest/webapps/test_getNotInstalled.xul
+++ b/dom/tests/mochitest/webapps/test_getNotInstalled.xul
@@ -18,7 +18,6 @@
 
 <script type="application/javascript;version=1.8">
 
-const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
 Cu.import("resource://gre/modules/Webapps.jsm");
 
 // We use a different origin than other webapps test files because we compare
diff --git a/dom/webidl/Location.webidl b/dom/webidl/Location.webidl
index 33d4c2e0d30a..7cc105890d02 100644
--- a/dom/webidl/Location.webidl
+++ b/dom/webidl/Location.webidl
@@ -11,11 +11,15 @@
  * and create derivative works of this document.
  */
 
-// No support for [Unforgeable] on interfaces yet
-//[Unforgeable]
+[Unforgeable]
 interface Location {
+  [Throws]
   void assign(DOMString url);
+  [Throws, CrossOriginCallable]
   void replace(DOMString url);
-  void reload();
+  // XXXbz there is no forceget argument in the spec!  See bug 1037721.
+  [Throws]
+  void reload(optional boolean forceget = false);
 };
-Location implements URLUtils;
+// No support for .searchParams on Location yet.  See bug 1037715.
+Location implements URLUtilsNoSearchParams;
diff --git a/dom/webidl/ServiceWorkerContainer.webidl b/dom/webidl/ServiceWorkerContainer.webidl
index 902a35d82956..2c762cb0c822 100644
--- a/dom/webidl/ServiceWorkerContainer.webidl
+++ b/dom/webidl/ServiceWorkerContainer.webidl
@@ -44,6 +44,10 @@ interface ServiceWorkerContainer {
 partial interface ServiceWorkerContainer {
   [Throws]
   Promise clearAllServiceWorkerData();
+
+  [Throws]
+  DOMString getScopeForUrl(DOMString url);
+
   [Throws]
   DOMString getControllingWorkerScriptURLForPath(DOMString path);
 };
diff --git a/dom/webidl/SubtleCrypto.webidl b/dom/webidl/SubtleCrypto.webidl
index 865280f4d534..4fc9999762fb 100644
--- a/dom/webidl/SubtleCrypto.webidl
+++ b/dom/webidl/SubtleCrypto.webidl
@@ -67,6 +67,12 @@ dictionary HmacImportParams : Algorithm {
   AlgorithmIdentifier hash;
 };
 
+dictionary Pbkdf2Params : Algorithm {
+  CryptoOperationData salt;
+  [EnforceRange] unsigned long iterations;
+  AlgorithmIdentifier hash;
+};
+
 dictionary RsaHashedImportParams {
   AlgorithmIdentifier hash;
 };
diff --git a/dom/webidl/URLUtils.webidl b/dom/webidl/URLUtils.webidl
index 9877afbec5ec..2e56c20429cd 100644
--- a/dom/webidl/URLUtils.webidl
+++ b/dom/webidl/URLUtils.webidl
@@ -14,25 +14,41 @@
  */
 
 [NoInterfaceObject]
-interface URLUtils {
-  [SetterThrows]
+interface URLUtilsNoSearchParams {
   // Bug 824857: no support for stringifier attributes yet.
   //  stringifier attribute DOMString href;
+  [Throws, CrossOriginWritable=Location]
            attribute DOMString href;
+  [Throws]
   readonly attribute DOMString origin;
 
+  [Throws]
            attribute DOMString protocol;
+  [Throws]
            attribute DOMString username;
+  [Throws]
            attribute DOMString password;
+  [Throws]
            attribute DOMString host;
+  [Throws]
            attribute DOMString hostname;
+  [Throws]
            attribute DOMString port;
+  [Throws]
            attribute DOMString pathname;
+  [Throws]
            attribute DOMString search;
-           attribute URLSearchParams searchParams;
+  // searchParams should go here once Location implements it.  See bug 1037715.
+  [Throws]
            attribute DOMString hash;
 
   // Bug 824857 should remove this.
+  [Throws]
   stringifier;
 };
 
+[NoInterfaceObject]
+interface URLUtils : URLUtilsNoSearchParams
+{
+           attribute URLSearchParams searchParams;
+};
diff --git a/dom/workers/ServiceWorkerContainer.cpp b/dom/workers/ServiceWorkerContainer.cpp
index e81989650221..5c864736f057 100644
--- a/dom/workers/ServiceWorkerContainer.cpp
+++ b/dom/workers/ServiceWorkerContainer.cpp
@@ -135,6 +135,22 @@ ServiceWorkerContainer::ClearAllServiceWorkerData(ErrorResult& aRv)
   return nullptr;
 }
 
+// Testing only.
+void
+ServiceWorkerContainer::GetScopeForUrl(const nsAString& aUrl,
+                                       nsString& aScope,
+                                       ErrorResult& aRv)
+{
+  nsresult rv;
+  nsCOMPtr<nsIServiceWorkerManager> swm = do_GetService(SERVICEWORKERMANAGER_CONTRACTID, &rv);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    aRv.Throw(rv);
+    return;
+  }
+
+  aRv = swm->GetScopeForUrl(aUrl, aScope);
+}
+
 // Testing only.
 void
 ServiceWorkerContainer::GetControllingWorkerScriptURLForPath(
diff --git a/dom/workers/ServiceWorkerContainer.h b/dom/workers/ServiceWorkerContainer.h
index 875c55df1651..2bf61738c9cb 100644
--- a/dom/workers/ServiceWorkerContainer.h
+++ b/dom/workers/ServiceWorkerContainer.h
@@ -79,6 +79,10 @@ public:
   already_AddRefed<Promise>
   ClearAllServiceWorkerData(ErrorResult& aRv);
 
+  // Testing only.
+  void
+  GetScopeForUrl(const nsAString& aUrl, nsString& aScope, ErrorResult& aRv);
+
   // Testing only.
   void
   GetControllingWorkerScriptURLForPath(const nsAString& aPath,
diff --git a/dom/workers/ServiceWorkerManager.cpp b/dom/workers/ServiceWorkerManager.cpp
index 47c021f008a9..68462c1e29b8 100644
--- a/dom/workers/ServiceWorkerManager.cpp
+++ b/dom/workers/ServiceWorkerManager.cpp
@@ -367,8 +367,7 @@ public:
     }
 
     nsRefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
-    ServiceWorkerManager::ServiceWorkerDomainInfo* domainInfo =
-      swm->mDomainMap.Get(domain);
+    ServiceWorkerManager::ServiceWorkerDomainInfo* domainInfo;
     // XXXnsm: This pattern can be refactored if we end up using it
     // often enough.
     if (!swm->mDomainMap.Get(domain, &domainInfo)) {
@@ -987,6 +986,163 @@ ServiceWorkerManager::CreateServiceWorkerForWindow(nsPIDOMWindow* aWindow,
   return rv;
 }
 
+already_AddRefed<ServiceWorkerRegistration>
+ServiceWorkerManager::GetServiceWorkerRegistration(nsPIDOMWindow* aWindow)
+{
+  nsCOMPtr<nsIURI> documentURI = aWindow->GetDocumentURI();
+  return GetServiceWorkerRegistration(documentURI);
+}
+
+already_AddRefed<ServiceWorkerRegistration>
+ServiceWorkerManager::GetServiceWorkerRegistration(nsIDocument* aDoc)
+{
+  nsCOMPtr<nsIURI> documentURI = aDoc->GetDocumentURI();
+  return GetServiceWorkerRegistration(documentURI);
+}
+
+already_AddRefed<ServiceWorkerRegistration>
+ServiceWorkerManager::GetServiceWorkerRegistration(nsIURI* aURI)
+{
+  if (!aURI) {
+    return nullptr;
+  }
+
+  nsCString domain;
+  nsresult rv = aURI->GetHost(domain);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return nullptr;
+  }
+
+  ServiceWorkerDomainInfo* domainInfo = mDomainMap.Get(domain);
+
+  // XXXnsm: This pattern can be refactored if we end up using it
+  // often enough.
+  if (!domainInfo) {
+    return nullptr;
+  }
+
+  nsCString spec;
+  rv = aURI->GetSpec(spec);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return nullptr;
+  }
+
+  nsCString scope = FindScopeForPath(domainInfo->mOrderedScopes, spec);
+  if (scope.IsEmpty()) {
+    return nullptr;
+  }
+
+  ServiceWorkerRegistration* registration;
+  domainInfo->mServiceWorkerRegistrations.Get(scope, &registration);
+  // ordered scopes and registrations better be in sync.
+  MOZ_ASSERT(registration);
+
+  return registration;
+}
+
+namespace {
+/*
+ * Returns string without trailing '*'.
+ */
+void ScopeWithoutStar(const nsACString& aScope, nsACString& out)
+{
+  if (aScope.Last() == '*') {
+    out.Assign(StringHead(aScope, aScope.Length() - 1));
+    return;
+  }
+
+  out.Assign(aScope);
+}
+}; // anonymous namespace
+
+/* static */ void
+ServiceWorkerManager::AddScope(nsTArray<nsCString>& aList, const nsACString& aScope)
+{
+  for (uint32_t i = 0; i < aList.Length(); ++i) {
+    const nsCString& current = aList[i];
+
+    // Perfect match!
+    if (aScope.Equals(current)) {
+      return;
+    }
+
+    nsCString withoutStar;
+    ScopeWithoutStar(current, withoutStar);
+    // Edge case of match without '*'.
+    // /foo should be sorted before /foo*.
+    if (aScope.Equals(withoutStar)) {
+      aList.InsertElementAt(i, aScope);
+      return;
+    }
+
+    // /foo/bar* should be before /foo/*
+    // Similarly /foo/b* is between the two.
+    // But is /foo* categorically different?
+    if (StringBeginsWith(aScope, withoutStar)) {
+      // If the new scope is a pattern and the old one is a path, the new one
+      // goes after.  This way Add(/foo) followed by Add(/foo*) ends up with
+      // [/foo, /foo*].
+      if (aScope.Last() == '*' &&
+          withoutStar.Equals(current)) {
+        aList.InsertElementAt(i+1, aScope);
+      } else {
+        aList.InsertElementAt(i, aScope);
+      }
+      return;
+    }
+  }
+
+  aList.AppendElement(aScope);
+}
+
+// aPath can have a '*' at the end, but it is treated literally.
+/* static */ nsCString
+ServiceWorkerManager::FindScopeForPath(nsTArray<nsCString>& aList, const nsACString& aPath)
+{
+  MOZ_ASSERT(aPath.FindChar('*') == -1);
+
+  nsCString match;
+
+  for (uint32_t i = 0; i < aList.Length(); ++i) {
+    const nsCString& current = aList[i];
+    nsCString withoutStar;
+    ScopeWithoutStar(current, withoutStar);
+    if (StringBeginsWith(aPath, withoutStar)) {
+      // If non-pattern match, then check equality.
+      if (current.Last() == '*' ||
+          aPath.Equals(current)) {
+        match = current;
+        break;
+      }
+    }
+  }
+
+  return match;
+}
+
+/* static */ void
+ServiceWorkerManager::RemoveScope(nsTArray<nsCString>& aList, const nsACString& aScope)
+{
+  aList.RemoveElement(aScope);
+}
+
+NS_IMETHODIMP
+ServiceWorkerManager::GetScopeForUrl(const nsAString& aUrl, nsAString& aScope)
+{
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = NS_NewURI(getter_AddRefs(uri), aUrl, nullptr, nullptr);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsRefPtr<ServiceWorkerRegistration> r = GetServiceWorkerRegistration(uri);
+  if (!r) {
+      return NS_ERROR_FAILURE;
+  }
+
+  aScope = NS_ConvertUTF8toUTF16(r->mScope);
+  return NS_OK;
+}
 NS_IMETHODIMP
 ServiceWorkerManager::CreateServiceWorker(const nsACString& aScriptSpec,
                                           const nsACString& aScope,
diff --git a/dom/workers/ServiceWorkerManager.h b/dom/workers/ServiceWorkerManager.h
index 5193ed963404..b5d08cd6eca3 100644
--- a/dom/workers/ServiceWorkerManager.h
+++ b/dom/workers/ServiceWorkerManager.h
@@ -198,6 +198,15 @@ public:
    */
   struct ServiceWorkerDomainInfo
   {
+    // Ordered list of scopes for glob matching.
+    // Each entry is an absolute URL representing the scope.
+    //
+    // An array is used for now since the number of controlled scopes per
+    // domain is expected to be relatively low. If that assumption was proved
+    // wrong this should be replaced with a better structure to avoid the
+    // memmoves associated with inserting stuff in the middle of the array.
+    nsTArray<nsCString> mOrderedScopes;
+
     // Scope to registration.
     nsRefPtrHashtable<nsCStringHashKey, ServiceWorkerRegistration> mServiceWorkerRegistrations;
 
@@ -220,6 +229,7 @@ public:
       // From now on ownership of registration is with
       // mServiceWorkerRegistrations.
       mServiceWorkerRegistrations.Put(aScope, registration);
+      ServiceWorkerManager::AddScope(mOrderedScopes, aScope);
       return registration;
     }
   };
@@ -285,6 +295,25 @@ private:
   CleanupServiceWorkerInformation(const nsACString& aDomain,
                                   ServiceWorkerDomainInfo* aDomainInfo,
                                   void *aUnused);
+
+  already_AddRefed<ServiceWorkerRegistration>
+  GetServiceWorkerRegistration(nsPIDOMWindow* aWindow);
+
+  already_AddRefed<ServiceWorkerRegistration>
+  GetServiceWorkerRegistration(nsIDocument* aDoc);
+
+  already_AddRefed<ServiceWorkerRegistration>
+  GetServiceWorkerRegistration(nsIURI* aURI);
+
+  static void
+  AddScope(nsTArray<nsCString>& aList, const nsACString& aScope);
+
+  static nsCString
+  FindScopeForPath(nsTArray<nsCString>& aList, const nsACString& aPath);
+
+  static void
+  RemoveScope(nsTArray<nsCString>& aList, const nsACString& aScope);
+
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(ServiceWorkerManager,
diff --git a/dom/workers/URL.cpp b/dom/workers/URL.cpp
index a292153e817e..6c0313158217 100644
--- a/dom/workers/URL.cpp
+++ b/dom/workers/URL.cpp
@@ -318,52 +318,54 @@ public:
   {
     AssertIsOnMainThread();
 
+    ErrorResult rv;
     switch (mType) {
       case GetterHref:
-        mURLProxy->URL()->GetHref(mValue);
+        mURLProxy->URL()->GetHref(mValue, rv);
         break;
 
       case GetterOrigin:
-        mURLProxy->URL()->GetOrigin(mValue);
+        mURLProxy->URL()->GetOrigin(mValue, rv);
         break;
 
       case GetterProtocol:
-        mURLProxy->URL()->GetProtocol(mValue);
+        mURLProxy->URL()->GetProtocol(mValue, rv);
         break;
 
       case GetterUsername:
-        mURLProxy->URL()->GetUsername(mValue);
+        mURLProxy->URL()->GetUsername(mValue, rv);
         break;
 
       case GetterPassword:
-        mURLProxy->URL()->GetPassword(mValue);
+        mURLProxy->URL()->GetPassword(mValue, rv);
         break;
 
       case GetterHost:
-        mURLProxy->URL()->GetHost(mValue);
+        mURLProxy->URL()->GetHost(mValue, rv);
         break;
 
       case GetterHostname:
-        mURLProxy->URL()->GetHostname(mValue);
+        mURLProxy->URL()->GetHostname(mValue, rv);
         break;
 
       case GetterPort:
-        mURLProxy->URL()->GetPort(mValue);
+        mURLProxy->URL()->GetPort(mValue, rv);
         break;
 
       case GetterPathname:
-        mURLProxy->URL()->GetPathname(mValue);
+        mURLProxy->URL()->GetPathname(mValue, rv);
         break;
 
       case GetterSearch:
-        mURLProxy->URL()->GetSearch(mValue);
+        mURLProxy->URL()->GetSearch(mValue, rv);
         break;
 
       case GetterHash:
-        mURLProxy->URL()->GetHash(mValue);
+        mURLProxy->URL()->GetHash(mValue, rv);
         break;
     }
 
+    MOZ_ASSERT(!rv.Failed());
     return true;
   }
 
@@ -413,39 +415,39 @@ public:
         break;
 
       case SetterProtocol:
-        mURLProxy->URL()->SetProtocol(mValue);
+        mURLProxy->URL()->SetProtocol(mValue, mRv);
         break;
 
       case SetterUsername:
-        mURLProxy->URL()->SetUsername(mValue);
+        mURLProxy->URL()->SetUsername(mValue, mRv);
         break;
 
       case SetterPassword:
-        mURLProxy->URL()->SetPassword(mValue);
+        mURLProxy->URL()->SetPassword(mValue, mRv);
         break;
 
       case SetterHost:
-        mURLProxy->URL()->SetHost(mValue);
+        mURLProxy->URL()->SetHost(mValue, mRv);
         break;
 
       case SetterHostname:
-        mURLProxy->URL()->SetHostname(mValue);
+        mURLProxy->URL()->SetHostname(mValue, mRv);
         break;
 
       case SetterPort:
-        mURLProxy->URL()->SetPort(mValue);
+        mURLProxy->URL()->SetPort(mValue, mRv);
         break;
 
       case SetterPathname:
-        mURLProxy->URL()->SetPathname(mValue);
+        mURLProxy->URL()->SetPathname(mValue, mRv);
         break;
 
       case SetterSearch:
-        mURLProxy->URL()->SetSearch(mValue);
+        mURLProxy->URL()->SetSearch(mValue, mRv);
         break;
 
       case SetterHash:
-        mURLProxy->URL()->SetHash(mValue);
+        mURLProxy->URL()->SetHash(mValue, mRv);
         break;
     }
 
@@ -547,7 +549,7 @@ URL::WrapObject(JSContext* aCx)
 }
 
 void
-URL::GetHref(nsString& aHref) const
+URL::GetHref(nsString& aHref, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterHref, aHref,
@@ -573,7 +575,7 @@ URL::SetHref(const nsAString& aHref, ErrorResult& aRv)
 }
 
 void
-URL::GetOrigin(nsString& aOrigin) const
+URL::GetOrigin(nsString& aOrigin, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterOrigin, aOrigin,
@@ -585,7 +587,7 @@ URL::GetOrigin(nsString& aOrigin) const
 }
 
 void
-URL::GetProtocol(nsString& aProtocol) const
+URL::GetProtocol(nsString& aProtocol, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterProtocol, aProtocol,
@@ -597,7 +599,7 @@ URL::GetProtocol(nsString& aProtocol) const
 }
 
 void
-URL::SetProtocol(const nsAString& aProtocol)
+URL::SetProtocol(const nsAString& aProtocol, ErrorResult& aRv)
 {
   ErrorResult rv;
   nsRefPtr<SetterRunnable> runnable =
@@ -610,7 +612,7 @@ URL::SetProtocol(const nsAString& aProtocol)
 }
 
 void
-URL::GetUsername(nsString& aUsername) const
+URL::GetUsername(nsString& aUsername, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterUsername, aUsername,
@@ -622,7 +624,7 @@ URL::GetUsername(nsString& aUsername) const
 }
 
 void
-URL::SetUsername(const nsAString& aUsername)
+URL::SetUsername(const nsAString& aUsername, ErrorResult& aRv)
 {
   ErrorResult rv;
   nsRefPtr<SetterRunnable> runnable =
@@ -635,7 +637,7 @@ URL::SetUsername(const nsAString& aUsername)
 }
 
 void
-URL::GetPassword(nsString& aPassword) const
+URL::GetPassword(nsString& aPassword, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterPassword, aPassword,
@@ -647,7 +649,7 @@ URL::GetPassword(nsString& aPassword) const
 }
 
 void
-URL::SetPassword(const nsAString& aPassword)
+URL::SetPassword(const nsAString& aPassword, ErrorResult& aRv)
 {
   ErrorResult rv;
   nsRefPtr<SetterRunnable> runnable =
@@ -660,7 +662,7 @@ URL::SetPassword(const nsAString& aPassword)
 }
 
 void
-URL::GetHost(nsString& aHost) const
+URL::GetHost(nsString& aHost, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterHost, aHost,
@@ -672,7 +674,7 @@ URL::GetHost(nsString& aHost) const
 }
 
 void
-URL::SetHost(const nsAString& aHost)
+URL::SetHost(const nsAString& aHost, ErrorResult& aRv)
 {
   ErrorResult rv;
   nsRefPtr<SetterRunnable> runnable =
@@ -685,7 +687,7 @@ URL::SetHost(const nsAString& aHost)
 }
 
 void
-URL::GetHostname(nsString& aHostname) const
+URL::GetHostname(nsString& aHostname, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterHostname, aHostname,
@@ -697,7 +699,7 @@ URL::GetHostname(nsString& aHostname) const
 }
 
 void
-URL::SetHostname(const nsAString& aHostname)
+URL::SetHostname(const nsAString& aHostname, ErrorResult& aRv)
 {
   ErrorResult rv;
   nsRefPtr<SetterRunnable> runnable =
@@ -710,7 +712,7 @@ URL::SetHostname(const nsAString& aHostname)
 }
 
 void
-URL::GetPort(nsString& aPort) const
+URL::GetPort(nsString& aPort, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterPort, aPort,
@@ -722,7 +724,7 @@ URL::GetPort(nsString& aPort) const
 }
 
 void
-URL::SetPort(const nsAString& aPort)
+URL::SetPort(const nsAString& aPort, ErrorResult& aRv)
 {
   ErrorResult rv;
   nsRefPtr<SetterRunnable> runnable =
@@ -735,7 +737,7 @@ URL::SetPort(const nsAString& aPort)
 }
 
 void
-URL::GetPathname(nsString& aPathname) const
+URL::GetPathname(nsString& aPathname, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterPathname, aPathname,
@@ -747,7 +749,7 @@ URL::GetPathname(nsString& aPathname) const
 }
 
 void
-URL::SetPathname(const nsAString& aPathname)
+URL::SetPathname(const nsAString& aPathname, ErrorResult& aRv)
 {
   ErrorResult rv;
   nsRefPtr<SetterRunnable> runnable =
@@ -760,7 +762,7 @@ URL::SetPathname(const nsAString& aPathname)
 }
 
 void
-URL::GetSearch(nsString& aSearch) const
+URL::GetSearch(nsString& aSearch, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterSearch, aSearch,
@@ -772,7 +774,7 @@ URL::GetSearch(nsString& aSearch) const
 }
 
 void
-URL::SetSearch(const nsAString& aSearch)
+URL::SetSearch(const nsAString& aSearch, ErrorResult& aRv)
 {
   SetSearchInternal(aSearch);
   UpdateURLSearchParams();
@@ -814,7 +816,7 @@ URL::SetSearchParams(URLSearchParams& aSearchParams)
 }
 
 void
-URL::GetHash(nsString& aHash) const
+URL::GetHash(nsString& aHash, ErrorResult& aRv) const
 {
   nsRefPtr<GetterRunnable> runnable =
     new GetterRunnable(mWorkerPrivate, GetterRunnable::GetterHash, aHash,
@@ -826,7 +828,7 @@ URL::GetHash(nsString& aHash) const
 }
 
 void
-URL::SetHash(const nsAString& aHash)
+URL::SetHash(const nsAString& aHash, ErrorResult& aRv)
 {
   ErrorResult rv;
   nsRefPtr<SetterRunnable> runnable =
@@ -906,7 +908,8 @@ URL::UpdateURLSearchParams()
 {
   if (mSearchParams) {
     nsString search;
-    GetSearch(search);
+    ErrorResult rv;
+    GetSearch(search, rv);
     mSearchParams->ParseInput(NS_ConvertUTF16toUTF8(Substring(search, 1)), this);
   }
 }
diff --git a/dom/workers/URL.h b/dom/workers/URL.h
index d5ee60cdb72c..50492b61b04b 100644
--- a/dom/workers/URL.h
+++ b/dom/workers/URL.h
@@ -67,55 +67,55 @@ public:
   static void
   RevokeObjectURL(const GlobalObject& aGlobal, const nsAString& aUrl);
 
-  void GetHref(nsString& aHref) const;
+  void GetHref(nsString& aHref, ErrorResult& aRv) const;
 
   void SetHref(const nsAString& aHref, ErrorResult& aRv);
 
-  void GetOrigin(nsString& aOrigin) const;
+  void GetOrigin(nsString& aOrigin, ErrorResult& aRv) const;
 
-  void GetProtocol(nsString& aProtocol) const;
+  void GetProtocol(nsString& aProtocol, ErrorResult& aRv) const;
 
-  void SetProtocol(const nsAString& aProtocol);
+  void SetProtocol(const nsAString& aProtocol, ErrorResult& aRv);
 
-  void GetUsername(nsString& aUsername) const;
+  void GetUsername(nsString& aUsername, ErrorResult& aRv) const;
 
-  void SetUsername(const nsAString& aUsername);
+  void SetUsername(const nsAString& aUsername, ErrorResult& aRv);
 
-  void GetPassword(nsString& aPassword) const;
+  void GetPassword(nsString& aPassword, ErrorResult& aRv) const;
 
-  void SetPassword(const nsAString& aPassword);
+  void SetPassword(const nsAString& aPassword, ErrorResult& aRv);
 
-  void GetHost(nsString& aHost) const;
+  void GetHost(nsString& aHost, ErrorResult& aRv) const;
 
-  void SetHost(const nsAString& aHost);
+  void SetHost(const nsAString& aHost, ErrorResult& aRv);
 
-  void GetHostname(nsString& aHostname) const;
+  void GetHostname(nsString& aHostname, ErrorResult& aRv) const;
 
-  void SetHostname(const nsAString& aHostname);
+  void SetHostname(const nsAString& aHostname, ErrorResult& aRv);
 
-  void GetPort(nsString& aPort) const;
+  void GetPort(nsString& aPort, ErrorResult& aRv) const;
 
-  void SetPort(const nsAString& aPort);
+  void SetPort(const nsAString& aPort, ErrorResult& aRv);
 
-  void GetPathname(nsString& aPathname) const;
+  void GetPathname(nsString& aPathname, ErrorResult& aRv) const;
 
-  void SetPathname(const nsAString& aPathname);
+  void SetPathname(const nsAString& aPathname, ErrorResult& aRv);
 
-  void GetSearch(nsString& aSearch) const;
+  void GetSearch(nsString& aSearch, ErrorResult& aRv) const;
 
-  void SetSearch(const nsAString& aSearch);
+  void SetSearch(const nsAString& aSearch, ErrorResult& aRv);
 
   URLSearchParams* SearchParams();
 
   void SetSearchParams(URLSearchParams& aSearchParams);
 
-  void GetHash(nsString& aHost) const;
+  void GetHash(nsString& aHost, ErrorResult& aRv) const;
 
-  void SetHash(const nsAString& aHash);
+  void SetHash(const nsAString& aHash, ErrorResult& aRv);
 
-  void Stringify(nsString& aRetval) const
+  void Stringify(nsString& aRetval, ErrorResult& aRv) const
   {
-    GetHref(aRetval);
+    GetHref(aRetval, aRv);
   }
 
   // IURLSearchParamsObserver
diff --git a/dom/workers/test/promise_worker.js b/dom/workers/test/promise_worker.js
index 2af938d6c67e..d3d1fef17896 100644
--- a/dom/workers/test/promise_worker.js
+++ b/dom/workers/test/promise_worker.js
@@ -556,14 +556,6 @@ function promiseRaceValuesArray() {
 }
 
 function promiseRacePromiseArray() {
-  function timeoutPromise(n) {
-    return new Promise(function(resolve) {
-      setTimeout(function() {
-        resolve(n);
-      }, n);
-    });
-  }
-
   var arr = [
     new Promise(function(resolve) {
       resolve("first");
@@ -674,7 +666,7 @@ function promiseResolveThenableCleanStack() {
   var thenable = { then: immed };
   var results = [];
 
-  Promise.resolve(thenable).then(incX);
+  var p = Promise.resolve(thenable).then(incX);
   results.push(x);
 
   // check what happens after all "next cycle" steps
@@ -683,8 +675,11 @@ function promiseResolveThenableCleanStack() {
     results.push(x);
     // Result should be [0, 2] since `thenable` will be called async.
     is(results[0], 0, "Expected thenable to be called asynchronously");
-    is(results[1], 2, "Expected thenable to be called asynchronously");
-    runTest();
+    // See Bug 1023547 comment 13 for why this check has to be gated on p.
+    p.then(function() {
+      is(results[1], 2, "Expected thenable to be called asynchronously");
+      runTest();
+    });
   },1000);
 }
 
diff --git a/dom/workers/test/serviceworkers/mochitest.ini b/dom/workers/test/serviceworkers/mochitest.ini
index f0d114a663e2..1b0ea254758f 100644
--- a/dom/workers/test/serviceworkers/mochitest.ini
+++ b/dom/workers/test/serviceworkers/mochitest.ini
@@ -9,3 +9,4 @@ support-files =
 [test_installation_simple.html]
 [test_install_event.html]
 [test_navigator.html]
+[test_scopes.html]
diff --git a/dom/workers/test/serviceworkers/test_scopes.html b/dom/workers/test/serviceworkers/test_scopes.html
new file mode 100644
index 000000000000..5e04201658af
--- /dev/null
+++ b/dom/workers/test/serviceworkers/test_scopes.html
@@ -0,0 +1,69 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Bug 984048 - Test scope glob matching.</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none"></div>
+<pre id="test"></pre>
+<script class="testbody" type="text/javascript">
+
+  function registerWorkers() {
+    return Promise.all([
+      navigator.serviceWorker.register("worker.js", { scope: "*" }),
+      navigator.serviceWorker.register("worker.js", { scope: "sub/dir/*"}),
+      navigator.serviceWorker.register("worker.js", { scope: "sub/dir*" }),
+      navigator.serviceWorker.register("worker.js", { scope: "sub/dir" }),
+      navigator.serviceWorker.register("worker.js", { scope: "sub/dir/a*" }),
+      navigator.serviceWorker.register("worker.js", { scope: "sub*" }),
+    ]);
+  }
+
+  function testScopes() {
+    return new Promise(function(resolve, reject) {
+      var getScope = navigator.serviceWorker.getScopeForUrl.bind(navigator.serviceWorker);
+      var base = new URL(".", document.baseURI);
+
+      function p(s) {
+        return base + s;
+      }
+
+      ok(getScope(p("index.html")) === p("*"), "Scope should match");
+      ok(getScope(p("sua.html")) === p("*"), "Scope should match");
+      ok(getScope(p("sub.html")) === p("sub*"), "Scope should match");
+      ok(getScope(p("sub/dir.html")) === p("sub/dir*"), "Scope should match");
+      ok(getScope(p("sub/dir")) === p("sub/dir"), "Scope should match");
+      ok(getScope(p("sub/dir/foo")) === p("sub/dir/*"), "Scope should match");
+      ok(getScope(p("sub/dir/afoo")) === p("sub/dir/a*"), "Scope should match");
+      resolve(true);
+    });
+  }
+
+  function runTest() {
+    registerWorkers()
+      .then(testScopes)
+      .then(function() {
+        SimpleTest.finish();
+      }).catch(function(e) {
+        ok(false, "Some test failed with error " + e);
+        SimpleTest.finish();
+      });
+  }
+
+  SimpleTest.waitForExplicitFinish();
+  SpecialPowers.pushPrefEnv({"set": [
+    ["dom.serviceWorkers.enabled", true],
+    ["dom.serviceWorkers.testing.enabled", true]
+  ]}, runTest);
+</script>
+</pre>
+</body>
+</html>
+
diff --git a/gfx/2d/MacIOSurface.cpp b/gfx/2d/MacIOSurface.cpp
index 390aea23a68b..b21e9fef7a9b 100644
--- a/gfx/2d/MacIOSurface.cpp
+++ b/gfx/2d/MacIOSurface.cpp
@@ -43,6 +43,7 @@ IOSurfaceGetBaseAddressFunc   MacIOSurfaceLib::sGetBaseAddress;
 IOSurfaceGetWidthFunc         MacIOSurfaceLib::sWidth;
 IOSurfaceGetHeightFunc        MacIOSurfaceLib::sHeight;
 IOSurfaceGetBytesPerRowFunc   MacIOSurfaceLib::sBytesPerRow;
+IOSurfaceGetPropertyMaximumFunc   MacIOSurfaceLib::sGetPropertyMaximum;
 IOSurfaceLockFunc             MacIOSurfaceLib::sLock;
 IOSurfaceUnlockFunc           MacIOSurfaceLib::sUnlock;
 CGLTexImageIOSurface2DFunc    MacIOSurfaceLib::sTexImage;
@@ -94,6 +95,10 @@ size_t MacIOSurfaceLib::IOSurfaceGetBytesPerRow(IOSurfacePtr aIOSurfacePtr) {
   return sBytesPerRow(aIOSurfacePtr);
 }
 
+size_t MacIOSurfaceLib::IOSurfaceGetPropertyMaximum(CFStringRef property) {
+  return sGetPropertyMaximum(property);
+}
+
 IOReturn MacIOSurfaceLib::IOSurfaceLock(IOSurfacePtr aIOSurfacePtr, 
                                        uint32_t options, uint32_t *seed) {
   return sLock(aIOSurfacePtr, options, seed);
@@ -177,6 +182,7 @@ void MacIOSurfaceLib::LoadLibrary() {
   sWidth = GET_IOSYM(sWidth, "IOSurfaceGetWidth");
   sHeight = GET_IOSYM(sHeight, "IOSurfaceGetHeight");
   sBytesPerRow = GET_IOSYM(sBytesPerRow, "IOSurfaceGetBytesPerRow");
+  sGetPropertyMaximum = GET_IOSYM(sGetPropertyMaximum, "IOSurfaceGetPropertyMaximum");
   sLookup = GET_IOSYM(sLookup, "IOSurfaceLookup");
   sLock = GET_IOSYM(sLock, "IOSurfaceLock");
   sUnlock = GET_IOSYM(sUnlock, "IOSurfaceUnlock");
@@ -192,7 +198,7 @@ void MacIOSurfaceLib::LoadLibrary() {
   if (!sCreate || !sGetID || !sLookup || !sTexImage || !sGetBaseAddress ||
       !kPropWidth || !kPropHeight || !kPropBytesPerElem || !kPropIsGlobal ||
       !sLock || !sUnlock || !sWidth || !sHeight || !kPropBytesPerRow ||
-      !sBytesPerRow) {
+      !sBytesPerRow || !sGetPropertyMaximum) {
     CloseLibrary();
   }
 }
@@ -225,6 +231,9 @@ TemporaryRef<MacIOSurface> MacIOSurface::CreateIOSurface(int aWidth, int aHeight
   if (!props)
     return nullptr;
 
+  MOZ_ASSERT((size_t)aWidth <= GetMaxWidth());
+  MOZ_ASSERT((size_t)aHeight <= GetMaxHeight());
+
   int32_t bytesPerElem = 4;
   size_t intScaleFactor = ceil(aContentsScaleFactor);
   aWidth *= intScaleFactor;
@@ -295,6 +304,14 @@ size_t MacIOSurface::GetHeight() {
   return GetDevicePixelHeight() / intScaleFactor;
 }
 
+/*static*/ size_t MacIOSurface::GetMaxWidth() {
+  return MacIOSurfaceLib::IOSurfaceGetPropertyMaximum(MacIOSurfaceLib::kPropWidth);
+}
+
+/*static*/ size_t MacIOSurface::GetMaxHeight() {
+  return MacIOSurfaceLib::IOSurfaceGetPropertyMaximum(MacIOSurfaceLib::kPropHeight);
+}
+
 size_t MacIOSurface::GetDevicePixelWidth() {
   return MacIOSurfaceLib::IOSurfaceGetWidth(mIOSurfacePtr);
 }
diff --git a/gfx/2d/MacIOSurface.h b/gfx/2d/MacIOSurface.h
index 448c145c9cc7..c335f82da3de 100644
--- a/gfx/2d/MacIOSurface.h
+++ b/gfx/2d/MacIOSurface.h
@@ -25,6 +25,7 @@ typedef void* (*IOSurfaceGetBaseAddressFunc) (CFTypeRef io_surface);
 typedef size_t (*IOSurfaceGetWidthFunc) (IOSurfacePtr io_surface);
 typedef size_t (*IOSurfaceGetHeightFunc) (IOSurfacePtr io_surface);
 typedef size_t (*IOSurfaceGetBytesPerRowFunc) (IOSurfacePtr io_surface);
+typedef size_t (*IOSurfaceGetPropertyMaximumFunc) (CFStringRef property);
 typedef CGLError (*CGLTexImageIOSurface2DFunc) (CGLContextObj ctxt,
                              GLenum target, GLenum internalFormat,
                              GLsizei width, GLsizei height,
@@ -38,7 +39,6 @@ typedef CGImageRef (*IOSurfaceContextCreateImageFunc)(CGContextRef ref);
 typedef IOSurfacePtr (*IOSurfaceContextGetSurfaceFunc)(CGContextRef ref);
 
 
-
 #import <OpenGL/OpenGL.h>
 #include "2D.h"
 #include "mozilla/RefPtr.h"
@@ -101,6 +101,8 @@ public:
   static mozilla::TemporaryRef<MacIOSurface> IOSurfaceContextGetSurface(CGContextRef aContext,
                                                                         double aContentsScaleFactor = 1.0,
                                                                         bool aHasAlpha = true);
+  static size_t GetMaxWidth();
+  static size_t GetMaxHeight();
 
 private:
   friend class nsCARenderer;
@@ -125,6 +127,7 @@ public:
   static IOSurfaceGetWidthFunc        sWidth;
   static IOSurfaceGetHeightFunc       sHeight;
   static IOSurfaceGetBytesPerRowFunc  sBytesPerRow;
+  static IOSurfaceGetPropertyMaximumFunc  sGetPropertyMaximum;
   static CGLTexImageIOSurface2DFunc   sTexImage;
   static IOSurfaceContextCreateFunc   sIOSurfaceContextCreate;
   static IOSurfaceContextCreateImageFunc  sIOSurfaceContextCreateImage;
@@ -140,10 +143,11 @@ public:
   static IOSurfacePtr IOSurfaceCreate(CFDictionaryRef properties);
   static IOSurfacePtr IOSurfaceLookup(IOSurfaceID aIOSurfaceID);
   static IOSurfaceID  IOSurfaceGetID(IOSurfacePtr aIOSurfacePtr);
-  static void        *IOSurfaceGetBaseAddress(IOSurfacePtr aIOSurfacePtr);
+  static void*        IOSurfaceGetBaseAddress(IOSurfacePtr aIOSurfacePtr);
   static size_t       IOSurfaceGetWidth(IOSurfacePtr aIOSurfacePtr);
   static size_t       IOSurfaceGetHeight(IOSurfacePtr aIOSurfacePtr);
   static size_t       IOSurfaceGetBytesPerRow(IOSurfacePtr aIOSurfacePtr);
+  static size_t       IOSurfaceGetPropertyMaximum(CFStringRef property);
   static IOReturn     IOSurfaceLock(IOSurfacePtr aIOSurfacePtr, 
                                     uint32_t options, uint32_t *seed);
   static IOReturn     IOSurfaceUnlock(IOSurfacePtr aIOSurfacePtr, 
diff --git a/gfx/2d/Tools.h b/gfx/2d/Tools.h
index 624cf206f901..1dfd46c8d62d 100644
--- a/gfx/2d/Tools.h
+++ b/gfx/2d/Tools.h
@@ -152,6 +152,12 @@ struct AlignedArray
     // We don't create an array of T here, since we don't want ctors to be
     // invoked at the wrong places if we realign below.
     mStorage = new (std::nothrow) uint8_t[storageByteCount.value()];
+    if (!mStorage) {
+      mStorage = nullptr;
+      mPtr = nullptr;
+      mCount = 0;
+      return;
+    }
     if (uintptr_t(mStorage) % alignment) {
       // Our storage does not start at a <alignment>-byte boundary. Make sure mPtr does!
       mPtr = (T*)(uintptr_t(mStorage) + alignment - (uintptr_t(mStorage) % alignment));
diff --git a/gfx/gl/GLContext.cpp b/gfx/gl/GLContext.cpp
index 245c293f5583..d1152fc2c454 100644
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -677,10 +677,6 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
                 MarkUnsupported(GLFeature::depth_texture);
             }
 #endif
-            // ANGLE's divisor support is busted. (see bug 916816)
-            if (IsANGLE()) {
-                MarkUnsupported(GLFeature::instanced_arrays);
-            }
         }
 
         NS_ASSERTION(!IsExtensionSupported(GLContext::ARB_pixel_buffer_object) ||
@@ -1669,22 +1665,15 @@ GLContext::PublishFrame()
 {
     MOZ_ASSERT(mScreen);
 
-    if (!mScreen->PublishFrame(OffscreenSize()))
-        return false;
-
-    return true;
+    return mScreen->PublishFrame(OffscreenSize());
 }
 
-SharedSurface_GL*
+SharedSurface*
 GLContext::RequestFrame()
 {
     MOZ_ASSERT(mScreen);
 
-    SharedSurface* ret = mScreen->Stream()->SwapConsumer();
-    if (!ret)
-        return nullptr;
-
-    return SharedSurface_GL::Cast(ret);
+    return mScreen->Stream()->SwapConsumer();
 }
 
 
diff --git a/gfx/gl/GLContext.h b/gfx/gl/GLContext.h
index 2777dd3758c7..94d854b997df 100644
--- a/gfx/gl/GLContext.h
+++ b/gfx/gl/GLContext.h
@@ -54,9 +54,8 @@ namespace android {
 
 namespace mozilla {
     namespace gfx {
-        class SourceSurface;
         class DataSourceSurface;
-        struct SurfaceCaps;
+        class SourceSurface;
     }
 
     namespace gl {
@@ -67,7 +66,7 @@ namespace mozilla {
         class GLBlitHelper;
         class GLBlitTextureImageHelper;
         class GLReadTexImageHelper;
-        class SharedSurface_GL;
+        struct SurfaceCaps;
     }
 
     namespace layers {
@@ -850,9 +849,9 @@ public:
             !data &&
             Vendor() == GLVendor::NVIDIA)
         {
-            ScopedDeleteArray<char> buf(new char[1]);
+            UniquePtr<char[]> buf = MakeUnique<char[]>(1);
             buf[0] = 0;
-            fBufferSubData(target, size-1, 1, buf);
+            fBufferSubData(target, size-1, 1, buf.get());
         }
     }
 
@@ -2504,11 +2503,6 @@ public:
 
 // -----------------------------------------------------------------------------
 // Constructor
-public:
-
-    typedef struct gfx::SurfaceCaps SurfaceCaps;
-
-
 protected:
     GLContext(const SurfaceCaps& caps,
               GLContext* sharedContext = nullptr,
@@ -2524,8 +2518,6 @@ public:
 // -----------------------------------------------------------------------------
 // Everything that isn't standard GL APIs
 protected:
-    typedef class gfx::SharedSurface SharedSurface;
-    typedef gfx::SharedSurfaceType SharedSurfaceType;
     typedef gfx::SurfaceFormat SurfaceFormat;
 
     virtual bool MakeCurrentImpl(bool aForce) = 0;
@@ -2709,7 +2701,7 @@ public:
     GLint GetMaxTextureImageSize() { return mMaxTextureImageSize; }
 
 public:
-    std::map<GLuint, SharedSurface_GL*> mFBOMapping;
+    std::map<GLuint, SharedSurface*> mFBOMapping;
 
     enum {
         DebugEnabled = 1 << 0,
@@ -2778,7 +2770,7 @@ public:
         fScissor(0, 0, size.width, size.height);
         fViewport(0, 0, size.width, size.height);
 
-        mCaps = mScreen->Caps();
+        mCaps = mScreen->mCaps;
         if (mCaps.any)
             DetermineCaps();
 
@@ -2869,20 +2861,20 @@ protected:
 
     void DestroyScreenBuffer();
 
-    SharedSurface_GL* mLockedSurface;
+    SharedSurface* mLockedSurface;
 
 public:
-    void LockSurface(SharedSurface_GL* surf) {
+    void LockSurface(SharedSurface* surf) {
         MOZ_ASSERT(!mLockedSurface);
         mLockedSurface = surf;
     }
 
-    void UnlockSurface(SharedSurface_GL* surf) {
+    void UnlockSurface(SharedSurface* surf) {
         MOZ_ASSERT(mLockedSurface == surf);
         mLockedSurface = nullptr;
     }
 
-    SharedSurface_GL* GetLockedSurface() const {
+    SharedSurface* GetLockedSurface() const {
         return mLockedSurface;
     }
 
@@ -2895,7 +2887,7 @@ public:
     }
 
     bool PublishFrame();
-    SharedSurface_GL* RequestFrame();
+    SharedSurface* RequestFrame();
 
     /* Clear to transparent black, with 0 depth and stencil,
      * while preserving current ClearColor etc. values.
diff --git a/gfx/gl/GLContextProviderImpl.h b/gfx/gl/GLContextProviderImpl.h
index 1f9bf609fb6b..69498c0c115a 100644
--- a/gfx/gl/GLContextProviderImpl.h
+++ b/gfx/gl/GLContextProviderImpl.h
@@ -14,7 +14,6 @@
 class GL_CONTEXT_PROVIDER_NAME
 {
 public:
-    typedef gfx::SurfaceCaps SurfaceCaps;
     /**
      * Create a context that renders to the surface of the widget that is
      * passed in.  The context is always created with an RGB pixel format,
diff --git a/gfx/gl/GLScreenBuffer.cpp b/gfx/gl/GLScreenBuffer.cpp
index 8deba1578bef..fb83cb0aaab2 100755
--- a/gfx/gl/GLScreenBuffer.cpp
+++ b/gfx/gl/GLScreenBuffer.cpp
@@ -24,12 +24,12 @@
 namespace mozilla {
 namespace gl {
 
-using namespace mozilla::gfx;
+using gfx::SurfaceFormat;
 
 GLScreenBuffer*
 GLScreenBuffer::Create(GLContext* gl,
-                     const gfx::IntSize& size,
-                     const SurfaceCaps& caps)
+                       const gfx::IntSize& size,
+                       const SurfaceCaps& caps)
 {
     if (caps.antialias &&
         !gl->IsSupported(GLFeature::framebuffer_multisample))
@@ -37,7 +37,7 @@ GLScreenBuffer::Create(GLContext* gl,
         return nullptr;
     }
 
-    SurfaceFactory_GL* factory = nullptr;
+    SurfaceFactory* factory = nullptr;
 
 #ifdef MOZ_WIDGET_GONK
     /* On B2G, we want a Gralloc factory, and we want one right at the start */
@@ -50,9 +50,8 @@ GLScreenBuffer::Create(GLContext* gl,
 #endif
 #ifdef XP_MACOSX
     /* On OSX, we want an IOSurface factory, and we want one right at the start */
-    if (!factory)
-    {
-        factory = new SurfaceFactory_IOSurface(gl, caps);
+    if (!factory) {
+        factory = SurfaceFactory_IOSurface::Create(gl, caps);
     }
 #endif
 
@@ -300,15 +299,17 @@ GLScreenBuffer::BeforeReadCall()
 }
 
 bool
-GLScreenBuffer::ReadPixels(GLint x, GLint y, GLsizei width, GLsizei height,
-                           GLenum format, GLenum type, GLvoid *pixels)
+GLScreenBuffer::ReadPixels(GLint x, GLint y,
+                           GLsizei width, GLsizei height,
+                           GLenum format, GLenum type,
+                           GLvoid* pixels)
 {
-    // If the currently bound framebuffer is backed by a SharedSurface_GL
+    // If the currently bound framebuffer is backed by a SharedSurface
     // then it might want to override how we read pixel data from it.
     // This is normally only the default framebuffer, but we can also
     // have SharedSurfaces bound to other framebuffers when doing
     // readback for BasicLayers.
-    SharedSurface_GL* surf;
+    SharedSurface* surf;
     if (GetReadFB() == 0) {
         surf = SharedSurf();
     } else {
@@ -340,7 +341,7 @@ GLScreenBuffer::AssureBlitted()
         MOZ_ASSERT(drawFB != 0);
         MOZ_ASSERT(drawFB != readFB);
         MOZ_ASSERT(mGL->IsSupported(GLFeature::framebuffer_blit));
-        MOZ_ASSERT(mDraw->Size() == mRead->Size());
+        MOZ_ASSERT(mDraw->mSize == mRead->Size());
 
         ScopedBindFramebuffer boundFB(mGL);
         ScopedGLState scissor(mGL, LOCAL_GL_SCISSOR_TEST, false);
@@ -348,7 +349,7 @@ GLScreenBuffer::AssureBlitted()
         BindReadFB_Internal(drawFB);
         BindDrawFB_Internal(readFB);
 
-        const gfx::IntSize&  srcSize = mDraw->Size();
+        const gfx::IntSize&  srcSize = mDraw->mSize;
         const gfx::IntSize& destSize = mRead->Size();
 
         mGL->raw_fBlitFramebuffer(0, 0,  srcSize.width,  srcSize.height,
@@ -362,7 +363,7 @@ GLScreenBuffer::AssureBlitted()
 }
 
 void
-GLScreenBuffer::Morph(SurfaceFactory_GL* newFactory, SurfaceStreamType streamType)
+GLScreenBuffer::Morph(SurfaceFactory* newFactory, SurfaceStreamType streamType)
 {
     MOZ_ASSERT(mStream);
 
@@ -381,18 +382,17 @@ GLScreenBuffer::Morph(SurfaceFactory_GL* newFactory, SurfaceStreamType streamTyp
 }
 
 bool
-GLScreenBuffer::Attach(SharedSurface* surface, const gfx::IntSize& size)
+GLScreenBuffer::Attach(SharedSurface* surf, const gfx::IntSize& size)
 {
     ScopedBindFramebuffer autoFB(mGL);
 
-    SharedSurface_GL* surf = SharedSurface_GL::Cast(surface);
     if (mRead && SharedSurf())
         SharedSurf()->UnlockProd();
 
     surf->LockProd();
 
     if (mRead &&
-        surf->AttachType() == SharedSurf()->AttachType() &&
+        surf->mAttachType == SharedSurf()->mAttachType &&
         size == Size())
     {
         // Same size, same type, ready for reuse!
@@ -436,7 +436,7 @@ GLScreenBuffer::Swap(const gfx::IntSize& size)
 {
     SharedSurface* nextSurf = mStream->SwapProducer(mFactory, size);
     if (!nextSurf) {
-        SurfaceFactory_Basic basicFactory(mGL, mFactory->Caps());
+        SurfaceFactory_Basic basicFactory(mGL, mFactory->mCaps);
         nextSurf = mStream->SwapProducer(&basicFactory, size);
         if (!nextSurf)
           return false;
@@ -470,30 +470,30 @@ GLScreenBuffer::Resize(const gfx::IntSize& size)
 bool
 GLScreenBuffer::CreateDraw(const gfx::IntSize& size, DrawBuffer** out_buffer)
 {
-    GLContext* gl = mFactory->GL();
-    const GLFormats& formats = mFactory->Formats();
+    GLContext* gl = mFactory->mGL;
+    const GLFormats& formats = mFactory->mFormats;
     const SurfaceCaps& caps = mFactory->DrawCaps();
 
     return DrawBuffer::Create(gl, caps, formats, size, out_buffer);
 }
 
 ReadBuffer*
-GLScreenBuffer::CreateRead(SharedSurface_GL* surf)
+GLScreenBuffer::CreateRead(SharedSurface* surf)
 {
-    GLContext* gl = mFactory->GL();
-    const GLFormats& formats = mFactory->Formats();
+    GLContext* gl = mFactory->mGL;
+    const GLFormats& formats = mFactory->mFormats;
     const SurfaceCaps& caps = mFactory->ReadCaps();
 
     return ReadBuffer::Create(gl, caps, formats, surf);
 }
 
 void
-GLScreenBuffer::Readback(SharedSurface_GL* src, DataSourceSurface* dest)
+GLScreenBuffer::Readback(SharedSurface* src, gfx::DataSourceSurface* dest)
 {
   MOZ_ASSERT(src && dest);
-  MOZ_ASSERT(dest->GetSize() == src->Size());
-  MOZ_ASSERT(dest->GetFormat() == (src->HasAlpha() ? SurfaceFormat::B8G8R8A8
-                                                   : SurfaceFormat::B8G8R8X8));
+  MOZ_ASSERT(dest->GetSize() == src->mSize);
+  MOZ_ASSERT(dest->GetFormat() == (src->mHasAlpha ? SurfaceFormat::B8G8R8A8
+                                                  : SurfaceFormat::B8G8R8X8));
 
   mGL->MakeCurrent();
 
@@ -506,7 +506,7 @@ GLScreenBuffer::Readback(SharedSurface_GL* src, DataSourceSurface* dest)
   ReadBuffer* buffer = CreateRead(src);
   MOZ_ASSERT(buffer);
 
-  ScopedBindFramebuffer autoFB(mGL, buffer->FB());
+  ScopedBindFramebuffer autoFB(mGL, buffer->mFB);
   ReadPixelsIntoDataSurface(mGL, dest);
 
   delete buffer;
@@ -517,6 +517,9 @@ GLScreenBuffer::Readback(SharedSurface_GL* src, DataSourceSurface* dest)
   }
 }
 
+////////////////////////////////////////////////////////////////////////
+// DrawBuffer
+
 bool
 DrawBuffer::Create(GLContext* const gl,
                    const SurfaceCaps& caps,
@@ -591,20 +594,18 @@ DrawBuffer::~DrawBuffer()
     mGL->fDeleteRenderbuffers(3, rbs);
 }
 
-
-
-
-
+////////////////////////////////////////////////////////////////////////
+// ReadBuffer
 
 ReadBuffer*
 ReadBuffer::Create(GLContext* gl,
                    const SurfaceCaps& caps,
                    const GLFormats& formats,
-                   SharedSurface_GL* surf)
+                   SharedSurface* surf)
 {
     MOZ_ASSERT(surf);
 
-    if (surf->AttachType() == AttachmentType::Screen) {
+    if (surf->mAttachType == AttachmentType::Screen) {
         // Don't need anything. Our read buffer will be the 'screen'.
 
         return new ReadBuffer(gl,
@@ -618,14 +619,14 @@ ReadBuffer::Create(GLContext* gl,
     GLuint* pDepthRB   = caps.depth   ? &depthRB   : nullptr;
     GLuint* pStencilRB = caps.stencil ? &stencilRB : nullptr;
 
-    CreateRenderbuffersForOffscreen(gl, formats, surf->Size(), caps.antialias,
+    CreateRenderbuffersForOffscreen(gl, formats, surf->mSize, caps.antialias,
                                     nullptr, pDepthRB, pStencilRB);
 
     GLuint colorTex = 0;
     GLuint colorRB = 0;
     GLenum target = 0;
 
-    switch (surf->AttachType()) {
+    switch (surf->mAttachType) {
     case AttachmentType::GLTexture:
         colorTex = surf->ProdTexture();
         target = surf->ProdTextureTarget();
@@ -670,19 +671,19 @@ ReadBuffer::~ReadBuffer()
 }
 
 void
-ReadBuffer::Attach(SharedSurface_GL* surf)
+ReadBuffer::Attach(SharedSurface* surf)
 {
     MOZ_ASSERT(surf && mSurf);
-    MOZ_ASSERT(surf->AttachType() == mSurf->AttachType());
-    MOZ_ASSERT(surf->Size() == mSurf->Size());
+    MOZ_ASSERT(surf->mAttachType == mSurf->mAttachType);
+    MOZ_ASSERT(surf->mSize == mSurf->mSize);
 
     // Nothing else is needed for AttachType Screen.
-    if (surf->AttachType() != AttachmentType::Screen) {
+    if (surf->mAttachType != AttachmentType::Screen) {
         GLuint colorTex = 0;
         GLuint colorRB = 0;
         GLenum target = 0;
 
-        switch (surf->AttachType()) {
+        switch (surf->mAttachType) {
         case AttachmentType::GLTexture:
             colorTex = surf->ProdTexture();
             target = surf->ProdTextureTarget();
@@ -705,7 +706,7 @@ ReadBuffer::Attach(SharedSurface_GL* surf)
 const gfx::IntSize&
 ReadBuffer::Size() const
 {
-    return mSurf->Size();
+    return mSurf->mSize;
 }
 
 } /* namespace gl */
diff --git a/gfx/gl/GLScreenBuffer.h b/gfx/gl/GLScreenBuffer.h
index cfe04dccd11d..60965970fbd4 100644
--- a/gfx/gl/GLScreenBuffer.h
+++ b/gfx/gl/GLScreenBuffer.h
@@ -22,26 +22,15 @@
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/Point.h"
 
-namespace mozilla {
-    namespace gfx {
-        class SurfaceStream;
-        class SharedSurface;
-    }
-    namespace gl {
-        class GLContext;
-        class SharedSurface_GL;
-        class SurfaceFactory_GL;
-    }
-}
-
 namespace mozilla {
 namespace gl {
 
+class GLContext;
+class SharedSurface;
+class SurfaceStream;
+
 class DrawBuffer
 {
-protected:
-    typedef struct gfx::SurfaceCaps SurfaceCaps;
-
 public:
     // Fallible!
     // But it may return true with *out_buffer==nullptr if unneeded.
@@ -53,8 +42,10 @@ public:
 
 protected:
     GLContext* const mGL;
+public:
     const gfx::IntSize mSize;
     const GLuint mFB;
+protected:
     const GLuint mColorMSRB;
     const GLuint mDepthRB;
     const GLuint mStencilRB;
@@ -75,43 +66,33 @@ protected:
 
 public:
     virtual ~DrawBuffer();
-
-    const gfx::IntSize& Size() const {
-        return mSize;
-    }
-
-    GLuint FB() const {
-        return mFB;
-    }
 };
 
 class ReadBuffer
 {
-protected:
-    typedef struct gfx::SurfaceCaps SurfaceCaps;
-
 public:
     // Infallible, always non-null.
     static ReadBuffer* Create(GLContext* gl,
                               const SurfaceCaps& caps,
                               const GLFormats& formats,
-                              SharedSurface_GL* surf);
+                              SharedSurface* surf);
 
 protected:
     GLContext* const mGL;
-
+public:
     const GLuint mFB;
+protected:
     // mFB has the following attachments:
     const GLuint mDepthRB;
     const GLuint mStencilRB;
     // note no mColorRB here: this is provided by mSurf.
-    SharedSurface_GL* mSurf; // Owned by GLScreenBuffer's SurfaceStream.
+    SharedSurface* mSurf; // Owned by GLScreenBuffer's SurfaceStream.
 
     ReadBuffer(GLContext* gl,
                GLuint fb,
                GLuint depthRB,
                GLuint stencilRB,
-               SharedSurface_GL* surf)
+               SharedSurface* surf)
         : mGL(gl)
         , mFB(fb)
         , mDepthRB(depthRB)
@@ -123,15 +104,11 @@ public:
     virtual ~ReadBuffer();
 
     // Cannot attach a surf of a different AttachType or Size than before.
-    void Attach(SharedSurface_GL* surf);
+    void Attach(SharedSurface* surf);
 
     const gfx::IntSize& Size() const;
 
-    GLuint FB() const {
-        return mFB;
-    }
-
-    SharedSurface_GL* SharedSurf() const {
+    SharedSurface* SharedSurf() const {
         return mSurf;
     }
 };
@@ -139,13 +116,6 @@ public:
 
 class GLScreenBuffer
 {
-protected:
-    typedef class gfx::SurfaceStream SurfaceStream;
-    typedef class gfx::SharedSurface SharedSurface;
-    typedef gfx::SurfaceStreamType SurfaceStreamType;
-    typedef gfx::SharedSurfaceType SharedSurfaceType;
-    typedef struct gfx::SurfaceCaps SurfaceCaps;
-
 public:
     // Infallible.
     static GLScreenBuffer* Create(GLContext* gl,
@@ -154,8 +124,10 @@ public:
 
 protected:
     GLContext* const mGL;         // Owns us.
-    SurfaceCaps mCaps;
-    SurfaceFactory_GL* mFactory;  // Owned by us.
+public:
+    const SurfaceCaps mCaps;
+protected:
+    SurfaceFactory* mFactory;  // Owned by us.
     RefPtr<SurfaceStream> mStream;
 
     DrawBuffer* mDraw;            // Owned by us.
@@ -176,7 +148,7 @@ protected:
 
     GLScreenBuffer(GLContext* gl,
                    const SurfaceCaps& caps,
-                   SurfaceFactory_GL* factory,
+                   SurfaceFactory* factory,
                    SurfaceStream* stream)
         : mGL(gl)
         , mCaps(caps)
@@ -202,11 +174,11 @@ public:
         return mStream;
     }
 
-    SurfaceFactory_GL* Factory() const {
+    SurfaceFactory* Factory() const {
         return mFactory;
     }
 
-    SharedSurface_GL* SharedSurf() const {
+    SharedSurface* SharedSurf() const {
         MOZ_ASSERT(mRead);
         return mRead->SharedSurf();
     }
@@ -215,26 +187,22 @@ public:
         return mCaps.preserve;
     }
 
-    const SurfaceCaps& Caps() const {
-        return mCaps;
-    }
-
     GLuint DrawFB() const {
         if (!mDraw)
             return ReadFB();
 
-        return mDraw->FB();
+        return mDraw->mFB;
     }
 
     GLuint ReadFB() const {
-        return mRead->FB();
+        return mRead->mFB;
     }
 
     void DeletingFB(GLuint fb);
 
     const gfx::IntSize& Size() const {
         MOZ_ASSERT(mRead);
-        MOZ_ASSERT(!mDraw || mDraw->Size() == mRead->Size());
+        MOZ_ASSERT(!mDraw || mDraw->mSize == mRead->Size());
         return mRead->Size();
     }
 
@@ -247,7 +215,7 @@ public:
 
     /**
      * Attempts to read pixels from the current bound framebuffer, if
-     * it is backed by a SharedSurface_GL.
+     * it is backed by a SharedSurface.
      *
      * Returns true if the pixel data has been read back, false
      * otherwise.
@@ -267,7 +235,7 @@ public:
      * Once you pass newFactory into Morph, newFactory will be owned by
      * GLScreenBuffer, so `forget` any references to it that still exist.
      */
-    void Morph(SurfaceFactory_GL* newFactory, SurfaceStreamType streamType);
+    void Morph(SurfaceFactory* newFactory, SurfaceStreamType streamType);
 
 protected:
     // Returns false on error or inability to resize.
@@ -278,13 +246,13 @@ public:
 
     bool Resize(const gfx::IntSize& size);
 
-    void Readback(SharedSurface_GL* src, gfx::DataSourceSurface* dest);
+    void Readback(SharedSurface* src, gfx::DataSourceSurface* dest);
 
 protected:
     bool Attach(SharedSurface* surface, const gfx::IntSize& size);
 
     bool CreateDraw(const gfx::IntSize& size, DrawBuffer** out_buffer);
-    ReadBuffer* CreateRead(SharedSurface_GL* surf);
+    ReadBuffer* CreateRead(SharedSurface* surf);
 
 public:
     /* `fb` in these functions is the framebuffer the GLContext is hoping to
diff --git a/gfx/gl/ScopedGLHelpers.cpp b/gfx/gl/ScopedGLHelpers.cpp
index ec7a29de4974..9d00912224b6 100644
--- a/gfx/gl/ScopedGLHelpers.cpp
+++ b/gfx/gl/ScopedGLHelpers.cpp
@@ -3,6 +3,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "mozilla/UniquePtr.h"
+
 #include "GLContext.h"
 #include "ScopedGLHelpers.h"
 
@@ -428,7 +430,7 @@ ScopedGLDrawState::ScopedGLDrawState(GLContext* aGL)
     mGL->GetUIntegerv(LOCAL_GL_CURRENT_PROGRAM, &boundProgram);
     mGL->GetUIntegerv(LOCAL_GL_ARRAY_BUFFER_BINDING, &boundBuffer);
     mGL->GetUIntegerv(LOCAL_GL_MAX_VERTEX_ATTRIBS, &maxAttrib);
-    attrib_enabled = new GLint[maxAttrib];
+    attrib_enabled = MakeUnique<GLint[]>(maxAttrib);
 
     for (unsigned int i = 0; i < maxAttrib; i++) {
         mGL->fGetVertexAttribiv(i, LOCAL_GL_VERTEX_ATTRIB_ARRAY_ENABLED, &attrib_enabled[i]);
diff --git a/gfx/gl/ScopedGLHelpers.h b/gfx/gl/ScopedGLHelpers.h
index e55529f5236f..9a1f53cab6a1 100644
--- a/gfx/gl/ScopedGLHelpers.h
+++ b/gfx/gl/ScopedGLHelpers.h
@@ -6,6 +6,8 @@
 #ifndef SCOPEDGLHELPERS_H_
 #define SCOPEDGLHELPERS_H_
 
+#include "mozilla/UniquePtr.h"
+
 #include "GLContext.h"
 
 namespace mozilla {
@@ -322,7 +324,7 @@ struct ScopedGLDrawState {
     ScopedGLState stencil;
 
     GLuint maxAttrib;
-    ScopedDeleteArray<GLint> attrib_enabled;
+    UniquePtr<GLint[]> attrib_enabled;
     GLint attrib0_size;
     GLint attrib0_stride;
     GLint attrib0_type;
diff --git a/gfx/gl/SharedSurface.cpp b/gfx/gl/SharedSurface.cpp
index 5c8eb227adbe..443c18847063 100644
--- a/gfx/gl/SharedSurface.cpp
+++ b/gfx/gl/SharedSurface.cpp
@@ -4,25 +4,297 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SharedSurface.h"
+
+#include "GLContext.h"
+#include "GLBlitHelper.h"
+#include "ScopedGLHelpers.h"
 #include "SharedSurfaceGL.h"
 
-using namespace mozilla::gl;
-
 namespace mozilla {
-namespace gfx {
+namespace gl {
 
-// |src| must begin and end locked, though it
-// can be temporarily unlocked if needed.
-void
-SharedSurface::Copy(SharedSurface* src, SharedSurface* dest, SurfaceFactory* factory)
+/*static*/ void
+SharedSurface::ProdCopy(SharedSurface* src, SharedSurface* dest,
+                        SurfaceFactory* factory)
 {
-    MOZ_ASSERT( src->APIType() == APITypeT::OpenGL);
-    MOZ_ASSERT(dest->APIType() == APITypeT::OpenGL);
+    GLContext* gl = src->mGL;
 
-    SharedSurface_GL* srcGL = (SharedSurface_GL*)src;
-    SharedSurface_GL* destGL = (SharedSurface_GL*)dest;
+    // If `src` begins locked, it must end locked, though we may
+    // temporarily unlock it if we need to.
+    MOZ_ASSERT((src == gl->GetLockedSurface()) == src->IsLocked());
 
-    SharedSurface_GL::ProdCopy(srcGL, destGL, (SurfaceFactory_GL*)factory);
+    gl->MakeCurrent();
+
+    if (src->mAttachType  == AttachmentType::Screen &&
+        dest->mAttachType == AttachmentType::Screen)
+    {
+        // Here, we actually need to blit through a temp surface, so let's make one.
+        nsAutoPtr<SharedSurface_GLTexture> tempSurf;
+        tempSurf = SharedSurface_GLTexture::Create(gl,
+                                                   gl,
+                                                   factory->mFormats,
+                                                   src->mSize,
+                                                   factory->mCaps.alpha);
+
+        ProdCopy(src, tempSurf, factory);
+        ProdCopy(tempSurf, dest, factory);
+        return;
+    }
+
+    if (src->mAttachType == AttachmentType::Screen) {
+        SharedSurface* origLocked = gl->GetLockedSurface();
+        bool srcNeedsUnlock = false;
+        bool origNeedsRelock = false;
+        if (origLocked != src) {
+            if (origLocked) {
+                origLocked->UnlockProd();
+                origNeedsRelock = true;
+            }
+
+            src->LockProd();
+            srcNeedsUnlock = true;
+        }
+
+        if (dest->mAttachType == AttachmentType::GLTexture) {
+            GLuint destTex = dest->ProdTexture();
+            GLenum destTarget = dest->ProdTextureTarget();
+
+            gl->BlitHelper()->BlitFramebufferToTexture(0, destTex, src->mSize, dest->mSize, destTarget);
+        } else if (dest->mAttachType == AttachmentType::GLRenderbuffer) {
+            GLuint destRB = dest->ProdRenderbuffer();
+            ScopedFramebufferForRenderbuffer destWrapper(gl, destRB);
+
+            gl->BlitHelper()->BlitFramebufferToFramebuffer(0, destWrapper.FB(),
+                                                           src->mSize, dest->mSize);
+        } else {
+            MOZ_CRASH("Unhandled dest->mAttachType.");
+        }
+
+        if (srcNeedsUnlock)
+            src->UnlockProd();
+
+        if (origNeedsRelock)
+            origLocked->LockProd();
+
+        return;
+    }
+
+    if (dest->mAttachType == AttachmentType::Screen) {
+        SharedSurface* origLocked = gl->GetLockedSurface();
+        bool destNeedsUnlock = false;
+        bool origNeedsRelock = false;
+        if (origLocked != dest) {
+            if (origLocked) {
+                origLocked->UnlockProd();
+                origNeedsRelock = true;
+            }
+
+            dest->LockProd();
+            destNeedsUnlock = true;
+        }
+
+        if (src->mAttachType == AttachmentType::GLTexture) {
+            GLuint srcTex = src->ProdTexture();
+            GLenum srcTarget = src->ProdTextureTarget();
+
+            gl->BlitHelper()->BlitTextureToFramebuffer(srcTex, 0, src->mSize, dest->mSize, srcTarget);
+        } else if (src->mAttachType == AttachmentType::GLRenderbuffer) {
+            GLuint srcRB = src->ProdRenderbuffer();
+            ScopedFramebufferForRenderbuffer srcWrapper(gl, srcRB);
+
+            gl->BlitHelper()->BlitFramebufferToFramebuffer(srcWrapper.FB(), 0,
+                                                           src->mSize, dest->mSize);
+        } else {
+            MOZ_CRASH("Unhandled src->mAttachType.");
+        }
+
+        if (destNeedsUnlock)
+            dest->UnlockProd();
+
+        if (origNeedsRelock)
+            origLocked->LockProd();
+
+        return;
+    }
+
+    // Alright, done with cases involving Screen types.
+    // Only {src,dest}x{texture,renderbuffer} left.
+
+    if (src->mAttachType == AttachmentType::GLTexture) {
+        GLuint srcTex = src->ProdTexture();
+        GLenum srcTarget = src->ProdTextureTarget();
+
+        if (dest->mAttachType == AttachmentType::GLTexture) {
+            GLuint destTex = dest->ProdTexture();
+            GLenum destTarget = dest->ProdTextureTarget();
+
+            gl->BlitHelper()->BlitTextureToTexture(srcTex, destTex,
+                                                   src->mSize, dest->mSize,
+                                                   srcTarget, destTarget);
+
+            return;
+        }
+
+        if (dest->mAttachType == AttachmentType::GLRenderbuffer) {
+            GLuint destRB = dest->ProdRenderbuffer();
+            ScopedFramebufferForRenderbuffer destWrapper(gl, destRB);
+
+            gl->BlitHelper()->BlitTextureToFramebuffer(srcTex, destWrapper.FB(),
+                                                       src->mSize, dest->mSize, srcTarget);
+
+            return;
+        }
+
+        MOZ_CRASH("Unhandled dest->mAttachType.");
+    }
+
+    if (src->mAttachType == AttachmentType::GLRenderbuffer) {
+        GLuint srcRB = src->ProdRenderbuffer();
+        ScopedFramebufferForRenderbuffer srcWrapper(gl, srcRB);
+
+        if (dest->mAttachType == AttachmentType::GLTexture) {
+            GLuint destTex = dest->ProdTexture();
+            GLenum destTarget = dest->ProdTextureTarget();
+
+            gl->BlitHelper()->BlitFramebufferToTexture(srcWrapper.FB(), destTex,
+                                                       src->mSize, dest->mSize, destTarget);
+
+            return;
+        }
+
+        if (dest->mAttachType == AttachmentType::GLRenderbuffer) {
+            GLuint destRB = dest->ProdRenderbuffer();
+            ScopedFramebufferForRenderbuffer destWrapper(gl, destRB);
+
+            gl->BlitHelper()->BlitFramebufferToFramebuffer(srcWrapper.FB(), destWrapper.FB(),
+                                                           src->mSize, dest->mSize);
+
+            return;
+        }
+
+        MOZ_CRASH("Unhandled dest->mAttachType.");
+    }
+
+    MOZ_CRASH("Unhandled src->mAttachType.");
+}
+
+////////////////////////////////////////////////////////////////////////
+// SharedSurface
+
+void
+SharedSurface::LockProd()
+{
+    MOZ_ASSERT(!mIsLocked);
+
+    LockProdImpl();
+
+    mGL->LockSurface(this);
+    mIsLocked = true;
+}
+
+void
+SharedSurface::UnlockProd()
+{
+    if (!mIsLocked)
+        return;
+
+    UnlockProdImpl();
+
+    mGL->UnlockSurface(this);
+    mIsLocked = false;
+}
+
+////////////////////////////////////////////////////////////////////////
+// SurfaceFactory
+
+static void
+ChooseBufferBits(const SurfaceCaps& caps,
+                 SurfaceCaps* const out_drawCaps,
+                 SurfaceCaps* const out_readCaps)
+{
+    MOZ_ASSERT(out_drawCaps);
+    MOZ_ASSERT(out_readCaps);
+
+    SurfaceCaps screenCaps;
+
+    screenCaps.color = caps.color;
+    screenCaps.alpha = caps.alpha;
+    screenCaps.bpp16 = caps.bpp16;
+
+    screenCaps.depth = caps.depth;
+    screenCaps.stencil = caps.stencil;
+
+    screenCaps.antialias = caps.antialias;
+    screenCaps.preserve = caps.preserve;
+
+    if (caps.antialias) {
+        *out_drawCaps = screenCaps;
+        out_readCaps->Clear();
+
+        // Color caps need to be duplicated in readCaps.
+        out_readCaps->color = caps.color;
+        out_readCaps->alpha = caps.alpha;
+        out_readCaps->bpp16 = caps.bpp16;
+    } else {
+        out_drawCaps->Clear();
+        *out_readCaps = screenCaps;
+    }
+}
+
+SurfaceFactory::SurfaceFactory(GLContext* gl,
+                               SharedSurfaceType type,
+                               const SurfaceCaps& caps)
+    : mGL(gl)
+    , mCaps(caps)
+    , mType(type)
+    , mFormats(gl->ChooseGLFormats(caps))
+{
+    ChooseBufferBits(mCaps, &mDrawCaps, &mReadCaps);
+}
+
+SurfaceFactory::~SurfaceFactory()
+{
+    while (!mScraps.empty()) {
+        SharedSurface* cur = mScraps.front();
+        mScraps.pop();
+
+        delete cur;
+    }
+}
+
+SharedSurface*
+SurfaceFactory::NewSharedSurface(const gfx::IntSize& size)
+{
+    // Attempt to reuse an old surface.
+    while (!mScraps.empty()) {
+        SharedSurface* cur = mScraps.front();
+        mScraps.pop();
+        if (cur->mSize == size)
+            return cur;
+
+        // Destroy old surfaces of the wrong size.
+        delete cur;
+    }
+
+    SharedSurface* ret = CreateShared(size);
+
+    return ret;
+}
+
+// Auto-deletes surfs of the wrong type.
+void
+SurfaceFactory::Recycle(SharedSurface*& surf)
+{
+    if (!surf)
+        return;
+
+    if (surf->mType == mType) {
+        mScraps.push(surf);
+    } else {
+        delete surf;
+    }
+
+    surf = nullptr;
 }
 
 } /* namespace gfx */
diff --git a/gfx/gl/SharedSurface.h b/gfx/gl/SharedSurface.h
index ad197137a538..340d14cbbda4 100644
--- a/gfx/gl/SharedSurface.h
+++ b/gfx/gl/SharedSurface.h
@@ -15,35 +15,43 @@
 #ifndef SHARED_SURFACE_H_
 #define SHARED_SURFACE_H_
 
+#include <queue>
 #include <stdint.h>
-#include "mozilla/Attributes.h"
+
+#include "GLContextTypes.h"
 #include "GLDefs.h"
+#include "mozilla/Attributes.h"
 #include "mozilla/gfx/Point.h"
 #include "SurfaceTypes.h"
 
 namespace mozilla {
-namespace gfx {
+namespace gl {
 
+class GLContext;
 class SurfaceFactory;
 
 class SharedSurface
 {
-protected:
+public:
+    static void ProdCopy(SharedSurface* src, SharedSurface* dest,
+                         SurfaceFactory* factory);
+
     const SharedSurfaceType mType;
-    const APITypeT mAPI;
     const AttachmentType mAttachType;
+    GLContext* const mGL;
     const gfx::IntSize mSize;
     const bool mHasAlpha;
+protected:
     bool mIsLocked;
 
     SharedSurface(SharedSurfaceType type,
-                  APITypeT api,
                   AttachmentType attachType,
+                  GLContext* gl,
                   const gfx::IntSize& size,
                   bool hasAlpha)
         : mType(type)
-        , mAPI(api)
         , mAttachType(attachType)
+        , mGL(gl)
         , mSize(size)
         , mHasAlpha(hasAlpha)
         , mIsLocked(false)
@@ -54,29 +62,22 @@ public:
     virtual ~SharedSurface() {
     }
 
-    static void Copy(SharedSurface* src, SharedSurface* dest,
-                     SurfaceFactory* factory);
+    bool IsLocked() const {
+        return mIsLocked;
+    }
 
     // This locks the SharedSurface as the production buffer for the context.
     // This is needed by backends which use PBuffers and/or EGLSurfaces.
-    virtual void LockProd() {
-        MOZ_ASSERT(!mIsLocked);
-        LockProdImpl();
-        mIsLocked = true;
-    }
+    void LockProd();
 
     // Unlocking is harmless if we're already unlocked.
-    virtual void UnlockProd() {
-        if (!mIsLocked)
-            return;
-
-        UnlockProdImpl();
-        mIsLocked = false;
-    }
+    void UnlockProd();
 
+protected:
     virtual void LockProdImpl() = 0;
     virtual void UnlockProdImpl() = 0;
 
+public:
     virtual void Fence() = 0;
     virtual bool WaitSync() = 0;
 
@@ -85,28 +86,71 @@ public:
     // even when its buffer is still being used.
     virtual void WaitForBufferOwnership() {}
 
-    SharedSurfaceType Type() const {
-        return mType;
+    // For use when AttachType is correct.
+    virtual GLenum ProdTextureTarget() const {
+        MOZ_ASSERT(mAttachType == AttachmentType::GLTexture);
+        return LOCAL_GL_TEXTURE_2D;
     }
 
-    APITypeT APIType() const {
-        return mAPI;
+    virtual GLuint ProdTexture() {
+        MOZ_ASSERT(mAttachType == AttachmentType::GLTexture);
+        MOZ_CRASH("Did you forget to override this function?");
     }
 
-    AttachmentType AttachType() const {
-        return mAttachType;
+    virtual GLuint ProdRenderbuffer() {
+        MOZ_ASSERT(mAttachType == AttachmentType::GLRenderbuffer);
+        MOZ_CRASH("Did you forget to override this function?");
     }
 
-    const gfx::IntSize& Size() const {
-        return mSize;
-    }
-
-    bool HasAlpha() const {
-        return mHasAlpha;
+    virtual bool ReadPixels(GLint x, GLint y,
+                            GLsizei width, GLsizei height,
+                            GLenum format, GLenum type,
+                            GLvoid* pixels)
+    {
+        return false;
     }
 };
 
-} /* namespace gfx */
-} /* namespace mozilla */
+class SurfaceFactory
+{
+public:
+    GLContext* const mGL;
+    const SurfaceCaps mCaps;
+    const SharedSurfaceType mType;
+    const GLFormats mFormats;
 
-#endif /* SHARED_SURFACE_H_ */
+protected:
+    SurfaceCaps mDrawCaps;
+    SurfaceCaps mReadCaps;
+
+    SurfaceFactory(GLContext* gl,
+                   SharedSurfaceType type,
+                   const SurfaceCaps& caps);
+
+public:
+    virtual ~SurfaceFactory();
+
+    const SurfaceCaps& DrawCaps() const {
+        return mDrawCaps;
+    }
+
+    const SurfaceCaps& ReadCaps() const {
+        return mReadCaps;
+    }
+
+protected:
+    virtual SharedSurface* CreateShared(const gfx::IntSize& size) = 0;
+
+    std::queue<SharedSurface*> mScraps;
+
+public:
+    SharedSurface* NewSharedSurface(const gfx::IntSize& size);
+
+    // Auto-deletes surfs of the wrong type.
+    void Recycle(SharedSurface*& surf);
+};
+
+} // namespace gl
+} // namespace mozilla
+
+#endif // SHARED_SURFACE_H_
diff --git a/gfx/gl/SharedSurfaceANGLE.cpp b/gfx/gl/SharedSurfaceANGLE.cpp
index e91af9a15966..8b22a7f0f5e2 100644
--- a/gfx/gl/SharedSurfaceANGLE.cpp
+++ b/gfx/gl/SharedSurfaceANGLE.cpp
@@ -6,12 +6,11 @@
 #include "SharedSurfaceANGLE.h"
 
 #include "GLContextEGL.h"
+#include "GLLibraryEGL.h"
 
 namespace mozilla {
 namespace gl {
 
-using namespace mozilla::gfx;
-
 SurfaceFactory_ANGLEShareHandle*
 SurfaceFactory_ANGLEShareHandle::Create(GLContext* gl,
                                         const SurfaceCaps& caps)
@@ -227,7 +226,7 @@ SharedSurface_ANGLEShareHandle::Create(GLContext* gl,
 SurfaceFactory_ANGLEShareHandle::SurfaceFactory_ANGLEShareHandle(GLContext* gl,
                                                                  GLLibraryEGL* egl,
                                                                  const SurfaceCaps& caps)
-    : SurfaceFactory_GL(gl, SharedSurfaceType::EGLSurfaceANGLE, caps)
+    : SurfaceFactory(gl, SharedSurfaceType::EGLSurfaceANGLE, caps)
     , mProdGL(gl)
     , mEGL(egl)
 {
diff --git a/gfx/gl/SharedSurfaceANGLE.h b/gfx/gl/SharedSurfaceANGLE.h
index 1c666767b409..b2537f498d1b 100644
--- a/gfx/gl/SharedSurfaceANGLE.h
+++ b/gfx/gl/SharedSurfaceANGLE.h
@@ -6,20 +6,18 @@
 #ifndef SHARED_SURFACE_ANGLE_H_
 #define SHARED_SURFACE_ANGLE_H_
 
-#include "SharedSurfaceGL.h"
-#include "SurfaceFactory.h"
-#include "GLLibraryEGL.h"
-#include "SurfaceTypes.h"
-
 #include <windows.h>
 
+#include "SharedSurface.h"
+
 namespace mozilla {
 namespace gl {
 
 class GLContext;
+class GLLibraryEGL;
 
 class SharedSurface_ANGLEShareHandle
-    : public SharedSurface_GL
+    : public SharedSurface
 {
 public:
     static SharedSurface_ANGLEShareHandle* Create(GLContext* gl,
@@ -28,7 +26,7 @@ public:
                                                   bool hasAlpha);
 
     static SharedSurface_ANGLEShareHandle* Cast(SharedSurface* surf) {
-        MOZ_ASSERT(surf->Type() == SharedSurfaceType::EGLSurfaceANGLE);
+        MOZ_ASSERT(surf->mType == SharedSurfaceType::EGLSurfaceANGLE);
 
         return (SharedSurface_ANGLEShareHandle*)surf;
     }
@@ -46,11 +44,11 @@ protected:
                                    EGLContext context,
                                    EGLSurface pbuffer,
                                    HANDLE shareHandle)
-        : SharedSurface_GL(SharedSurfaceType::EGLSurfaceANGLE,
-                           AttachmentType::Screen,
-                           gl,
-                           size,
-                           hasAlpha)
+        : SharedSurface(SharedSurfaceType::EGLSurfaceANGLE,
+                        AttachmentType::Screen,
+                        gl,
+                        size,
+                        hasAlpha)
         , mEGL(egl)
         , mContext(context)
         , mPBuffer(pbuffer)
@@ -77,7 +75,7 @@ public:
 
 
 class SurfaceFactory_ANGLEShareHandle
-    : public SurfaceFactory_GL
+    : public SurfaceFactory
 {
 protected:
     GLContext* const mProdGL;
diff --git a/gfx/gl/SharedSurfaceEGL.cpp b/gfx/gl/SharedSurfaceEGL.cpp
index 3525b71defe0..a14c0f292bd8 100644
--- a/gfx/gl/SharedSurfaceEGL.cpp
+++ b/gfx/gl/SharedSurfaceEGL.cpp
@@ -4,16 +4,14 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SharedSurfaceEGL.h"
-#include "GLContextEGL.h"
-#include "GLBlitHelper.h"
-#include "ScopedGLHelpers.h"
-#include "SharedSurfaceGL.h"
-#include "SurfaceFactory.h"
-#include "GLLibraryEGL.h"
-#include "TextureGarbageBin.h"
-#include "GLReadTexImageHelper.h"
 
-using namespace mozilla::gfx;
+#include "GLBlitHelper.h"
+#include "GLContextEGL.h"
+#include "GLLibraryEGL.h"
+#include "GLReadTexImageHelper.h"
+#include "ScopedGLHelpers.h"
+#include "SharedSurface.h"
+#include "TextureGarbageBin.h"
 
 namespace mozilla {
 namespace gl {
@@ -69,11 +67,11 @@ SharedSurface_EGLImage::SharedSurface_EGLImage(GLContext* gl,
                                                const GLFormats& formats,
                                                GLuint prodTex,
                                                EGLImage image)
-    : SharedSurface_GL(SharedSurfaceType::EGLImageShare,
-                        AttachmentType::GLTexture,
-                        gl,
-                        size,
-                        hasAlpha)
+    : SharedSurface(SharedSurfaceType::EGLImageShare,
+                    AttachmentType::GLTexture,
+                    gl,
+                    size,
+                    hasAlpha)
     , mMutex("SharedSurface_EGLImage mutex")
     , mEGL(egl)
     , mFormats(formats)
diff --git a/gfx/gl/SharedSurfaceEGL.h b/gfx/gl/SharedSurfaceEGL.h
index 4a07f0fcf06f..ec91a87d8a09 100644
--- a/gfx/gl/SharedSurfaceEGL.h
+++ b/gfx/gl/SharedSurfaceEGL.h
@@ -6,21 +6,20 @@
 #ifndef SHARED_SURFACE_EGL_H_
 #define SHARED_SURFACE_EGL_H_
 
-#include "SharedSurfaceGL.h"
-#include "SurfaceFactory.h"
-#include "GLLibraryEGL.h"
-#include "SurfaceTypes.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/Mutex.h"
+#include "nsAutoPtr.h"
+#include "SharedSurface.h"
 
 namespace mozilla {
 namespace gl {
 
 class GLContext;
+class GLLibraryEGL;
 class TextureGarbageBin;
 
 class SharedSurface_EGLImage
-    : public SharedSurface_GL
+    : public SharedSurface
 {
 public:
     static SharedSurface_EGLImage* Create(GLContext* prodGL,
@@ -30,7 +29,7 @@ public:
                                           EGLContext context);
 
     static SharedSurface_EGLImage* Cast(SharedSurface* surf) {
-        MOZ_ASSERT(surf->Type() == SharedSurfaceType::EGLImageShare);
+        MOZ_ASSERT(surf->mType == SharedSurfaceType::EGLImageShare);
 
         return (SharedSurface_EGLImage*)surf;
     }
@@ -81,7 +80,7 @@ public:
 
 
 class SurfaceFactory_EGLImage
-    : public SurfaceFactory_GL
+    : public SurfaceFactory
 {
 public:
     // Fallible:
@@ -94,7 +93,7 @@ protected:
     SurfaceFactory_EGLImage(GLContext* prodGL,
                             EGLContext context,
                             const SurfaceCaps& caps)
-        : SurfaceFactory_GL(prodGL, SharedSurfaceType::EGLImageShare, caps)
+        : SurfaceFactory(prodGL, SharedSurfaceType::EGLImageShare, caps)
         , mContext(context)
     {}
 
diff --git a/gfx/gl/SharedSurfaceGL.cpp b/gfx/gl/SharedSurfaceGL.cpp
index 8d84dc640bf7..ba3f55578f5a 100644
--- a/gfx/gl/SharedSurfaceGL.cpp
+++ b/gfx/gl/SharedSurfaceGL.cpp
@@ -4,244 +4,18 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SharedSurfaceGL.h"
+
 #include "GLContext.h"
 #include "GLBlitHelper.h"
 #include "ScopedGLHelpers.h"
 #include "mozilla/gfx/2D.h"
 #include "GLReadTexImageHelper.h"
 
-using namespace mozilla::gfx;
-
 namespace mozilla {
 namespace gl {
 
-// |src| must begin and end locked, though we may
-// temporarily unlock it if we need to.
-void
-SharedSurface_GL::ProdCopy(SharedSurface_GL* src, SharedSurface_GL* dest,
-                           SurfaceFactory_GL* factory)
-{
-    GLContext* gl = src->GL();
-
-    gl->MakeCurrent();
-
-    if (src->AttachType() == AttachmentType::Screen &&
-        dest->AttachType() == AttachmentType::Screen)
-    {
-        // Here, we actually need to blit through a temp surface, so let's make one.
-        nsAutoPtr<SharedSurface_GLTexture> tempSurf(
-            SharedSurface_GLTexture::Create(gl, gl,
-                                            factory->Formats(),
-                                            src->Size(),
-                                            factory->Caps().alpha));
-
-        ProdCopy(src, tempSurf, factory);
-        ProdCopy(tempSurf, dest, factory);
-        return;
-    }
-
-    if (src->AttachType() == AttachmentType::Screen) {
-        SharedSurface_GL* origLocked = gl->GetLockedSurface();
-        bool srcNeedsUnlock = false;
-        bool origNeedsRelock = false;
-        if (origLocked != src) {
-            if (origLocked) {
-                origLocked->UnlockProd();
-                origNeedsRelock = true;
-            }
-
-            src->LockProd();
-            srcNeedsUnlock = true;
-        }
-
-        if (dest->AttachType() == AttachmentType::GLTexture) {
-            GLuint destTex = dest->ProdTexture();
-            GLenum destTarget = dest->ProdTextureTarget();
-
-            gl->BlitHelper()->BlitFramebufferToTexture(0, destTex, src->Size(), dest->Size(), destTarget);
-        } else if (dest->AttachType() == AttachmentType::GLRenderbuffer) {
-            GLuint destRB = dest->ProdRenderbuffer();
-            ScopedFramebufferForRenderbuffer destWrapper(gl, destRB);
-
-            gl->BlitHelper()->BlitFramebufferToFramebuffer(0, destWrapper.FB(),
-                                                           src->Size(), dest->Size());
-        } else {
-            MOZ_CRASH("Unhandled dest->AttachType().");
-        }
-
-        if (srcNeedsUnlock)
-            src->UnlockProd();
-
-        if (origNeedsRelock)
-            origLocked->LockProd();
-
-        return;
-    }
-
-    if (dest->AttachType() == AttachmentType::Screen) {
-        SharedSurface_GL* origLocked = gl->GetLockedSurface();
-        bool destNeedsUnlock = false;
-        bool origNeedsRelock = false;
-        if (origLocked != dest) {
-            if (origLocked) {
-                origLocked->UnlockProd();
-                origNeedsRelock = true;
-            }
-
-            dest->LockProd();
-            destNeedsUnlock = true;
-        }
-
-        if (src->AttachType() == AttachmentType::GLTexture) {
-            GLuint srcTex = src->ProdTexture();
-            GLenum srcTarget = src->ProdTextureTarget();
-
-            gl->BlitHelper()->BlitTextureToFramebuffer(srcTex, 0, src->Size(), dest->Size(), srcTarget);
-        } else if (src->AttachType() == AttachmentType::GLRenderbuffer) {
-            GLuint srcRB = src->ProdRenderbuffer();
-            ScopedFramebufferForRenderbuffer srcWrapper(gl, srcRB);
-
-            gl->BlitHelper()->BlitFramebufferToFramebuffer(srcWrapper.FB(), 0,
-                                                           src->Size(), dest->Size());
-        } else {
-            MOZ_CRASH("Unhandled src->AttachType().");
-        }
-
-        if (destNeedsUnlock)
-            dest->UnlockProd();
-
-        if (origNeedsRelock)
-            origLocked->LockProd();
-
-        return;
-    }
-
-    // Alright, done with cases involving Screen types.
-    // Only {src,dest}x{texture,renderbuffer} left.
-
-    if (src->AttachType() == AttachmentType::GLTexture) {
-        GLuint srcTex = src->ProdTexture();
-        GLenum srcTarget = src->ProdTextureTarget();
-
-        if (dest->AttachType() == AttachmentType::GLTexture) {
-            GLuint destTex = dest->ProdTexture();
-            GLenum destTarget = dest->ProdTextureTarget();
-
-            gl->BlitHelper()->BlitTextureToTexture(srcTex, destTex,
-                                                   src->Size(), dest->Size(),
-                                                   srcTarget, destTarget);
-
-            return;
-        }
-
-        if (dest->AttachType() == AttachmentType::GLRenderbuffer) {
-            GLuint destRB = dest->ProdRenderbuffer();
-            ScopedFramebufferForRenderbuffer destWrapper(gl, destRB);
-
-            gl->BlitHelper()->BlitTextureToFramebuffer(srcTex, destWrapper.FB(),
-                                                       src->Size(), dest->Size(), srcTarget);
-
-            return;
-        }
-
-        MOZ_CRASH("Unhandled dest->AttachType().");
-    }
-
-    if (src->AttachType() == AttachmentType::GLRenderbuffer) {
-        GLuint srcRB = src->ProdRenderbuffer();
-        ScopedFramebufferForRenderbuffer srcWrapper(gl, srcRB);
-
-        if (dest->AttachType() == AttachmentType::GLTexture) {
-            GLuint destTex = dest->ProdTexture();
-            GLenum destTarget = dest->ProdTextureTarget();
-
-            gl->BlitHelper()->BlitFramebufferToTexture(srcWrapper.FB(), destTex,
-                                                       src->Size(), dest->Size(), destTarget);
-
-            return;
-        }
-
-        if (dest->AttachType() == AttachmentType::GLRenderbuffer) {
-            GLuint destRB = dest->ProdRenderbuffer();
-            ScopedFramebufferForRenderbuffer destWrapper(gl, destRB);
-
-            gl->BlitHelper()->BlitFramebufferToFramebuffer(srcWrapper.FB(), destWrapper.FB(),
-                                                           src->Size(), dest->Size());
-
-            return;
-        }
-
-        MOZ_CRASH("Unhandled dest->AttachType().");
-    }
-
-    MOZ_CRASH("Unhandled src->AttachType().");
-}
-
-void
-SharedSurface_GL::LockProd()
-{
-    MOZ_ASSERT(!mIsLocked);
-
-    LockProdImpl();
-
-    mGL->LockSurface(this);
-    mIsLocked = true;
-}
-
-void
-SharedSurface_GL::UnlockProd()
-{
-    if (!mIsLocked)
-        return;
-
-    UnlockProdImpl();
-
-    mGL->UnlockSurface(this);
-    mIsLocked = false;
-}
-
-
-SurfaceFactory_GL::SurfaceFactory_GL(GLContext* gl,
-                                     SharedSurfaceType type,
-                                     const SurfaceCaps& caps)
-    : SurfaceFactory(type, caps)
-    , mGL(gl)
-    , mFormats(gl->ChooseGLFormats(caps))
-{
-    ChooseBufferBits(caps, mDrawCaps, mReadCaps);
-}
-
-void
-SurfaceFactory_GL::ChooseBufferBits(const SurfaceCaps& caps,
-                                    SurfaceCaps& drawCaps,
-                                    SurfaceCaps& readCaps) const
-{
-    SurfaceCaps screenCaps;
-
-    screenCaps.color = caps.color;
-    screenCaps.alpha = caps.alpha;
-    screenCaps.bpp16 = caps.bpp16;
-
-    screenCaps.depth = caps.depth;
-    screenCaps.stencil = caps.stencil;
-
-    screenCaps.antialias = caps.antialias;
-    screenCaps.preserve = caps.preserve;
-
-    if (caps.antialias) {
-        drawCaps = screenCaps;
-        readCaps.Clear();
-
-        // Color caps need to be duplicated in readCaps.
-        readCaps.color = caps.color;
-        readCaps.alpha = caps.alpha;
-        readCaps.bpp16 = caps.bpp16;
-    } else {
-        drawCaps.Clear();
-        readCaps = screenCaps;
-    }
-}
-
+using gfx::IntSize;
+using gfx::SurfaceFormat;
 
 SharedSurface_Basic*
 SharedSurface_Basic::Create(GLContext* gl,
@@ -279,12 +53,13 @@ SharedSurface_Basic::SharedSurface_Basic(GLContext* gl,
                                          bool hasAlpha,
                                          SurfaceFormat format,
                                          GLuint tex)
-    : SharedSurface_GL(SharedSurfaceType::Basic,
-                       AttachmentType::GLTexture,
-                       gl,
-                       size,
-                       hasAlpha)
-    , mTex(tex), mFB(0)
+    : SharedSurface(SharedSurfaceType::Basic,
+                    AttachmentType::GLTexture,
+                    gl,
+                    size,
+                    hasAlpha)
+    , mTex(tex)
+    , mFB(0)
 {
     mGL->MakeCurrent();
     mGL->fGenFramebuffers(1, &mFB);
@@ -302,8 +77,8 @@ SharedSurface_Basic::SharedSurface_Basic(GLContext* gl,
         mFB = 0;
     }
 
-    mData = Factory::CreateDataSourceSurfaceWithStride(size, format,
-              GetAlignedStride<4>(size.width * BytesPerPixel(format)));
+    int32_t stride = gfx::GetAlignedStride<4>(size.width * BytesPerPixel(format));
+    mData = gfx::Factory::CreateDataSourceSurfaceWithStride(size, format, stride);
 }
 
 SharedSurface_Basic::~SharedSurface_Basic()
@@ -331,7 +106,7 @@ SharedSurface_GLTexture*
 SharedSurface_GLTexture::Create(GLContext* prodGL,
                                 GLContext* consGL,
                                 const GLFormats& formats,
-                                const gfx::IntSize& size,
+                                const IntSize& size,
                                 bool hasAlpha,
                                 GLuint texture)
 {
diff --git a/gfx/gl/SharedSurfaceGL.h b/gfx/gl/SharedSurfaceGL.h
index e98dae850623..bc58748646cb 100644
--- a/gfx/gl/SharedSurfaceGL.h
+++ b/gfx/gl/SharedSurfaceGL.h
@@ -8,7 +8,6 @@
 
 #include "ScopedGLHelpers.h"
 #include "SharedSurface.h"
-#include "SurfaceFactory.h"
 #include "SurfaceTypes.h"
 #include "GLContextTypes.h"
 #include "nsAutoPtr.h"
@@ -30,111 +29,9 @@ namespace mozilla {
 namespace mozilla {
 namespace gl {
 
-class SurfaceFactory_GL;
-
-class SharedSurface_GL
-    : public gfx::SharedSurface
-{
-protected:
-    typedef class gfx::SharedSurface SharedSurface;
-    typedef gfx::SharedSurfaceType SharedSurfaceType;
-    typedef gfx::APITypeT APITypeT;
-    typedef gfx::AttachmentType AttachmentType;
-
-    GLContext* const mGL;
-
-    SharedSurface_GL(SharedSurfaceType type,
-                     AttachmentType attachType,
-                     GLContext* gl,
-                     const gfx::IntSize& size,
-                     bool hasAlpha)
-        : SharedSurface(type, APITypeT::OpenGL, attachType, size, hasAlpha)
-        , mGL(gl)
-    {}
-
-public:
-    static void ProdCopy(SharedSurface_GL* src, SharedSurface_GL* dest,
-                         SurfaceFactory_GL* factory);
-
-    static SharedSurface_GL* Cast(SharedSurface* surf) {
-        MOZ_ASSERT(surf->APIType() == APITypeT::OpenGL);
-
-        return (SharedSurface_GL*)surf;
-    }
-
-    // For use when AttachType is correct.
-    virtual GLuint ProdTexture() {
-        MOZ_ASSERT(AttachType() == AttachmentType::GLTexture);
-        MOZ_CRASH("Did you forget to override this function?");
-    }
-
-    virtual GLenum ProdTextureTarget() const {
-        return LOCAL_GL_TEXTURE_2D;
-    }
-
-    virtual GLuint ProdRenderbuffer() {
-        MOZ_ASSERT(AttachType() == AttachmentType::GLRenderbuffer);
-        MOZ_CRASH("Did you forget to override this function?");
-    }
-
-    virtual bool ReadPixels(GLint x, GLint y, GLsizei width, GLsizei height,
-                            GLenum format, GLenum type, GLvoid *pixels) {
-        return false;
-    }
-
-    virtual void LockProd() MOZ_OVERRIDE;
-    virtual void UnlockProd() MOZ_OVERRIDE;
-
-    GLContext* GL() const {
-        return mGL;
-    }
-};
-
-class SurfaceFactory_GL
-    : public gfx::SurfaceFactory
-{
-protected:
-    typedef struct gfx::SurfaceCaps SurfaceCaps;
-    typedef class gfx::SurfaceFactory SurfaceFactory;
-    typedef class gfx::SharedSurface SharedSurface;
-    typedef gfx::SharedSurfaceType SharedSurfaceType;
-
-    GLContext* const mGL;
-    const GLFormats mFormats;
-
-    SurfaceCaps mDrawCaps;
-    SurfaceCaps mReadCaps;
-
-    // This uses ChooseBufferBits to pick drawBits/readBits.
-    SurfaceFactory_GL(GLContext* gl,
-                      SharedSurfaceType type,
-                      const SurfaceCaps& caps);
-
-    virtual void ChooseBufferBits(const SurfaceCaps& caps,
-                                  SurfaceCaps& drawCaps,
-                                  SurfaceCaps& readCaps) const;
-
-public:
-    GLContext* GL() const {
-        return mGL;
-    }
-
-    const GLFormats& Formats() const {
-        return mFormats;
-    }
-
-    const SurfaceCaps& DrawCaps() const {
-        return mDrawCaps;
-    }
-
-    const SurfaceCaps& ReadCaps() const {
-        return mReadCaps;
-    }
-};
-
 // For readback and bootstrapping:
 class SharedSurface_Basic
-    : public SharedSurface_GL
+    : public SharedSurface
 {
 public:
     static SharedSurface_Basic* Create(GLContext* gl,
@@ -143,7 +40,7 @@ public:
                                        bool hasAlpha);
 
     static SharedSurface_Basic* Cast(SharedSurface* surf) {
-        MOZ_ASSERT(surf->Type() == SharedSurfaceType::Basic);
+        MOZ_ASSERT(surf->mType == SharedSurfaceType::Basic);
 
         return (SharedSurface_Basic*)surf;
     }
@@ -185,11 +82,11 @@ public:
 };
 
 class SurfaceFactory_Basic
-    : public SurfaceFactory_GL
+    : public SurfaceFactory
 {
 public:
     SurfaceFactory_Basic(GLContext* gl, const SurfaceCaps& caps)
-        : SurfaceFactory_GL(gl, SharedSurfaceType::Basic, caps)
+        : SurfaceFactory(gl, SharedSurfaceType::Basic, caps)
     {}
 
     virtual SharedSurface* CreateShared(const gfx::IntSize& size) MOZ_OVERRIDE {
@@ -201,7 +98,7 @@ public:
 
 // Using shared GL textures:
 class SharedSurface_GLTexture
-    : public SharedSurface_GL
+    : public SharedSurface
 {
 public:
     static SharedSurface_GLTexture* Create(GLContext* prodGL,
@@ -212,7 +109,7 @@ public:
                                            GLuint texture = 0);
 
     static SharedSurface_GLTexture* Cast(SharedSurface* surf) {
-        MOZ_ASSERT(surf->Type() == SharedSurfaceType::GLTextureShare);
+        MOZ_ASSERT(surf->mType == SharedSurfaceType::GLTextureShare);
 
         return (SharedSurface_GLTexture*)surf;
     }
@@ -230,11 +127,11 @@ protected:
                             bool hasAlpha,
                             GLuint tex,
                             bool ownsTex)
-        : SharedSurface_GL(SharedSurfaceType::GLTextureShare,
-                           AttachmentType::GLTexture,
-                           prodGL,
-                           size,
-                           hasAlpha)
+        : SharedSurface(SharedSurfaceType::GLTextureShare,
+                        AttachmentType::GLTexture,
+                        prodGL,
+                        size,
+                        hasAlpha)
         , mConsGL(consGL)
         , mTex(tex)
         , mOwnsTex(ownsTex)
@@ -268,7 +165,7 @@ public:
 };
 
 class SurfaceFactory_GLTexture
-    : public SurfaceFactory_GL
+    : public SurfaceFactory
 {
 protected:
     GLContext* const mConsGL;
@@ -280,7 +177,7 @@ public:
     SurfaceFactory_GLTexture(GLContext* prodGL,
                              GLContext* consGL,
                              const SurfaceCaps& caps)
-        : SurfaceFactory_GL(prodGL, SharedSurfaceType::GLTextureShare, caps)
+        : SurfaceFactory(prodGL, SharedSurfaceType::GLTextureShare, caps)
         , mConsGL(consGL)
     {
         MOZ_ASSERT(consGL != prodGL);
diff --git a/gfx/gl/SharedSurfaceGralloc.cpp b/gfx/gl/SharedSurfaceGralloc.cpp
index c7662746299a..8cbdf25e7447 100644
--- a/gfx/gl/SharedSurfaceGralloc.cpp
+++ b/gfx/gl/SharedSurfaceGralloc.cpp
@@ -4,12 +4,12 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/Preferences.h"
+#include "mozilla/UniquePtr.h"
 
 #include "SharedSurfaceGralloc.h"
 
 #include "GLContext.h"
-#include "SharedSurfaceGL.h"
-#include "SurfaceFactory.h"
+#include "SharedSurface.h"
 #include "GLLibraryEGL.h"
 #include "mozilla/layers/GrallocTextureClient.h"
 #include "mozilla/layers/ShadowLayers.h"
@@ -32,14 +32,13 @@
 namespace mozilla {
 namespace gl {
 
-using namespace mozilla::gfx;
 using namespace mozilla::layers;
 using namespace android;
 
 SurfaceFactory_Gralloc::SurfaceFactory_Gralloc(GLContext* prodGL,
                                                const SurfaceCaps& caps,
                                                layers::ISurfaceAllocator* allocator)
-    : SurfaceFactory_GL(prodGL, SharedSurfaceType::Gralloc, caps)
+    : SurfaceFactory(prodGL, SharedSurfaceType::Gralloc, caps)
 {
     if (caps.surfaceAllocator) {
         allocator = caps.surfaceAllocator;
@@ -126,11 +125,11 @@ SharedSurface_Gralloc::SharedSurface_Gralloc(GLContext* prodGL,
                                              layers::ISurfaceAllocator* allocator,
                                              layers::GrallocTextureClientOGL* textureClient,
                                              GLuint prodTex)
-    : SharedSurface_GL(SharedSurfaceType::Gralloc,
-                       AttachmentType::GLTexture,
-                       prodGL,
-                       size,
-                       hasAlpha)
+    : SharedSurface(SharedSurfaceType::Gralloc,
+                    AttachmentType::GLTexture,
+                    prodGL,
+                    size,
+                    hasAlpha)
     , mEGL(egl)
     , mSync(0)
     , mAllocator(allocator)
@@ -223,8 +222,8 @@ SharedSurface_Gralloc::Fence()
     // work.  glReadPixels seems to, though.
     if (gfxPrefs::GrallocFenceWithReadPixels()) {
         mGL->MakeCurrent();
-        ScopedDeleteArray<char> buf(new char[4]);
-        mGL->fReadPixels(0, 0, 1, 1, LOCAL_GL_RGBA, LOCAL_GL_UNSIGNED_BYTE, buf);
+        UniquePtr<char[]> buf = MakeUnique<char[]>(4);
+        mGL->fReadPixels(0, 0, 1, 1, LOCAL_GL_RGBA, LOCAL_GL_UNSIGNED_BYTE, buf.get());
     }
 }
 
diff --git a/gfx/gl/SharedSurfaceGralloc.h b/gfx/gl/SharedSurfaceGralloc.h
index 37fff32bf473..b8644fa56a1d 100644
--- a/gfx/gl/SharedSurfaceGralloc.h
+++ b/gfx/gl/SharedSurfaceGralloc.h
@@ -6,8 +6,8 @@
 #ifndef SHARED_SURFACE_GRALLOC_H_
 #define SHARED_SURFACE_GRALLOC_H_
 
-#include "SharedSurfaceGL.h"
 #include "mozilla/layers/LayersSurfaces.h"
+#include "SharedSurface.h"
 
 namespace mozilla {
 namespace layers {
@@ -20,7 +20,7 @@ class GLContext;
 class GLLibraryEGL;
 
 class SharedSurface_Gralloc
-    : public SharedSurface_GL
+    : public SharedSurface
 {
 public:
     static SharedSurface_Gralloc* Create(GLContext* prodGL,
@@ -30,7 +30,7 @@ public:
                                          layers::ISurfaceAllocator* allocator);
 
     static SharedSurface_Gralloc* Cast(SharedSurface* surf) {
-        MOZ_ASSERT(surf->Type() == SharedSurfaceType::Gralloc);
+        MOZ_ASSERT(surf->mType == SharedSurfaceType::Gralloc);
 
         return (SharedSurface_Gralloc*)surf;
     }
@@ -73,7 +73,7 @@ public:
 };
 
 class SurfaceFactory_Gralloc
-    : public SurfaceFactory_GL
+    : public SurfaceFactory
 {
 protected:
     RefPtr<layers::ISurfaceAllocator> mAllocator;
diff --git a/gfx/gl/SharedSurfaceIO.cpp b/gfx/gl/SharedSurfaceIO.cpp
index 78982982c718..efcf62a991b3 100644
--- a/gfx/gl/SharedSurfaceIO.cpp
+++ b/gfx/gl/SharedSurfaceIO.cpp
@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SharedSurfaceIO.h"
+
 #include "GLContextCGL.h"
 #include "mozilla/gfx/MacIOSurface.h"
 #include "mozilla/DebugOnly.h"
@@ -12,10 +13,8 @@
 namespace mozilla {
 namespace gl {
 
-using namespace gfx;
-
 /* static */ SharedSurface_IOSurface*
-SharedSurface_IOSurface::Create(MacIOSurface* surface, GLContext *gl, bool hasAlpha)
+SharedSurface_IOSurface::Create(MacIOSurface* surface, GLContext* gl, bool hasAlpha)
 {
     MOZ_ASSERT(surface);
     MOZ_ASSERT(gl);
@@ -33,7 +32,7 @@ SharedSurface_IOSurface::Fence()
 
 bool
 SharedSurface_IOSurface::ReadPixels(GLint x, GLint y, GLsizei width, GLsizei height,
-                                    GLenum format, GLenum type, GLvoid *pixels)
+                                    GLenum format, GLenum type, GLvoid* pixels)
 {
     // Calling glReadPixels when an IOSurface is bound to the current framebuffer
     // can cause corruption in following glReadPixel calls (even if they aren't
@@ -50,7 +49,7 @@ SharedSurface_IOSurface::ReadPixels(GLint x, GLint y, GLsizei width, GLsizei hei
         ScopedBindFramebuffer bindFB(mGL, srcFB.FB());
         ScopedBindTexture bindTex(mGL, destTex.Texture());
         mGL->fCopyTexImage2D(LOCAL_GL_TEXTURE_2D, 0,
-                             HasAlpha() ? LOCAL_GL_RGBA : LOCAL_GL_RGB,
+                             mHasAlpha ? LOCAL_GL_RGBA : LOCAL_GL_RGB,
                              x, y,
                              width, height, 0);
     }
@@ -92,7 +91,11 @@ SharedSurface_IOSurface::SharedSurface_IOSurface(MacIOSurface* surface,
                                                  GLContext* gl,
                                                  const gfx::IntSize& size,
                                                  bool hasAlpha)
-  : SharedSurface_GL(SharedSurfaceType::IOSurface, AttachmentType::GLTexture, gl, size, hasAlpha)
+  : SharedSurface(SharedSurfaceType::IOSurface,
+                  AttachmentType::GLTexture,
+                  gl,
+                  size,
+                  hasAlpha)
   , mSurface(surface)
   , mCurConsGL(nullptr)
   , mConsTex(0)
@@ -131,9 +134,25 @@ SharedSurface_IOSurface::~SharedSurface_IOSurface()
     }
 }
 
+
+/*static*/ SurfaceFactory_IOSurface*
+SurfaceFactory_IOSurface::Create(GLContext* gl,
+                                 const SurfaceCaps& caps)
+{
+    gfx::IntSize maxDims(MacIOSurface::GetMaxWidth(),
+                         MacIOSurface::GetMaxHeight());
+    return new SurfaceFactory_IOSurface(gl, caps, maxDims);
+}
+
 SharedSurface*
 SurfaceFactory_IOSurface::CreateShared(const gfx::IntSize& size)
 {
+    if (size.width > mMaxDims.width ||
+        size.height > mMaxDims.height)
+    {
+        return nullptr;
+    }
+
     bool hasAlpha = mReadCaps.alpha;
     RefPtr<MacIOSurface> surf =
         MacIOSurface::CreateIOSurface(size.width, size.height, 1.0, hasAlpha);
diff --git a/gfx/gl/SharedSurfaceIO.h b/gfx/gl/SharedSurfaceIO.h
index 9fd661cb6fe7..0c06a2d1903b 100644
--- a/gfx/gl/SharedSurfaceIO.h
+++ b/gfx/gl/SharedSurfaceIO.h
@@ -6,18 +6,18 @@
 #ifndef SHARED_SURFACEIO_H_
 #define SHARED_SURFACEIO_H_
 
-#include "SharedSurfaceGL.h"
 #include "mozilla/RefPtr.h"
+#include "SharedSurface.h"
 
 class MacIOSurface;
 
 namespace mozilla {
 namespace gl {
 
-class SharedSurface_IOSurface : public SharedSurface_GL
+class SharedSurface_IOSurface : public SharedSurface
 {
 public:
-    static SharedSurface_IOSurface* Create(MacIOSurface* surface, GLContext *gl, bool hasAlpha);
+    static SharedSurface_IOSurface* Create(MacIOSurface* surface, GLContext* gl, bool hasAlpha);
 
     ~SharedSurface_IOSurface();
 
@@ -39,7 +39,7 @@ public:
     }
 
     static SharedSurface_IOSurface* Cast(SharedSurface *surf) {
-        MOZ_ASSERT(surf->Type() == SharedSurfaceType::IOSurface);
+        MOZ_ASSERT(surf->mType == SharedSurfaceType::IOSurface);
         return static_cast<SharedSurface_IOSurface*>(surf);
     }
 
@@ -62,16 +62,23 @@ private:
     GLuint mConsTex;
 };
 
-class SurfaceFactory_IOSurface : public SurfaceFactory_GL
+class SurfaceFactory_IOSurface : public SurfaceFactory
 {
 public:
+    // Infallible.
+    static SurfaceFactory_IOSurface* Create(GLContext* gl,
+                                            const SurfaceCaps& caps);
+protected:
+    const gfx::IntSize mMaxDims;
+
     SurfaceFactory_IOSurface(GLContext* gl,
-                             const SurfaceCaps& caps)
-        : SurfaceFactory_GL(gl, SharedSurfaceType::IOSurface, caps)
+                             const SurfaceCaps& caps,
+                             const gfx::IntSize& maxDims)
+        : SurfaceFactory(gl, SharedSurfaceType::IOSurface, caps)
+        , mMaxDims(maxDims)
     {
     }
 
-protected:
     virtual SharedSurface* CreateShared(const gfx::IntSize& size) MOZ_OVERRIDE;
 };
 
diff --git a/gfx/gl/SurfaceFactory.cpp b/gfx/gl/SurfaceFactory.cpp
deleted file mode 100644
index 885f447ed64c..000000000000
--- a/gfx/gl/SurfaceFactory.cpp
+++ /dev/null
@@ -1,59 +0,0 @@
-/* -*- Mode: c++; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40; -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "SurfaceFactory.h"
-
-#include "SharedSurface.h"
-
-namespace mozilla {
-namespace gfx {
-
-SurfaceFactory::~SurfaceFactory()
-{
-    while (!mScraps.empty()) {
-        SharedSurface* cur = mScraps.front();
-        mScraps.pop();
-
-        delete cur;
-    }
-}
-
-SharedSurface*
-SurfaceFactory::NewSharedSurface(const gfx::IntSize& size)
-{
-    // Attempt to reuse an old surface.
-    while (!mScraps.empty()) {
-        SharedSurface* cur = mScraps.front();
-        mScraps.pop();
-        if (cur->Size() == size)
-            return cur;
-
-        // Destroy old surfaces of the wrong size.
-        delete cur;
-    }
-
-    SharedSurface* ret = CreateShared(size);
-
-    return ret;
-}
-
-// Auto-deletes surfs of the wrong type.
-void
-SurfaceFactory::Recycle(SharedSurface*& surf)
-{
-    if (!surf)
-        return;
-
-    if (surf->Type() == mType) {
-        mScraps.push(surf);
-    } else {
-        delete surf;
-    }
-
-    surf = nullptr;
-}
-
-} /* namespace gfx */
-} /* namespace mozilla */
diff --git a/gfx/gl/SurfaceFactory.h b/gfx/gl/SurfaceFactory.h
deleted file mode 100644
index 4209d4628a0d..000000000000
--- a/gfx/gl/SurfaceFactory.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/* -*- Mode: c++; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40; -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef SURFACE_FACTORY_H_
-#define SURFACE_FACTORY_H_
-
-#include <queue>
-#include "SurfaceTypes.h"
-#include "gfxPoint.h"
-
-namespace mozilla {
-namespace gfx {
-// Forward:
-class SharedSurface;
-
-class SurfaceFactory
-{
-protected:
-    SurfaceCaps mCaps;
-    SharedSurfaceType mType;
-
-    SurfaceFactory(SharedSurfaceType type, const SurfaceCaps& caps)
-        : mCaps(caps)
-        , mType(type)
-    {}
-
-public:
-    virtual ~SurfaceFactory();
-
-protected:
-    virtual SharedSurface* CreateShared(const gfx::IntSize& size) = 0;
-
-    std::queue<SharedSurface*> mScraps;
-
-public:
-    SharedSurface* NewSharedSurface(const gfx::IntSize& size);
-
-    // Auto-deletes surfs of the wrong type.
-    void Recycle(SharedSurface*& surf);
-
-    const SurfaceCaps& Caps() const {
-        return mCaps;
-    }
-
-    SharedSurfaceType Type() const {
-        return mType;
-    }
-};
-
-}   // namespace gfx
-}   // namespace mozilla
-
-#endif  // SURFACE_FACTORY_H_
diff --git a/gfx/gl/SurfaceStream.cpp b/gfx/gl/SurfaceStream.cpp
index b6569ec9f971..b05705745b99 100644
--- a/gfx/gl/SurfaceStream.cpp
+++ b/gfx/gl/SurfaceStream.cpp
@@ -8,11 +8,10 @@
 #include "gfxPoint.h"
 #include "SharedSurface.h"
 #include "SharedSurfaceGL.h"
-#include "SurfaceFactory.h"
 #include "GeckoProfiler.h"
 
 namespace mozilla {
-namespace gfx {
+namespace gl {
 
 SurfaceStreamType
 SurfaceStream::ChooseGLStreamType(SurfaceStream::OMTC omtc,
@@ -61,15 +60,15 @@ bool
 SurfaceStream_TripleBuffer::CopySurfaceToProducer(SharedSurface* src, SurfaceFactory* factory)
 {
     if (!mProducer) {
-        New(factory, src->Size(), mProducer);
+        New(factory, src->mSize, mProducer);
         if (!mProducer) {
             return false;
         }
     }
 
-    MOZ_ASSERT(src->Size() == mProducer->Size(), "Size mismatch");
+    MOZ_ASSERT(src->mSize == mProducer->mSize, "Size mismatch");
 
-    SharedSurface::Copy(src, mProducer, factory);
+    SharedSurface::ProdCopy(src, mProducer, factory);
     return true;
 }
 
@@ -254,12 +253,12 @@ SurfaceStream_SingleBuffer::SwapProducer(SurfaceFactory* factory,
 
         // Size mismatch means we need to squirrel the current Prod
         // into Cons, and leave Prod empty, so it gets a new surface below.
-        bool needsNewBuffer = mProducer->Size() != size;
+        bool needsNewBuffer = mProducer->mSize != size;
 
         // Even if we're the right size, if the type has changed, and we don't
         // need to preserve, we should switch out for (presumedly) better perf.
-        if (mProducer->Type() != factory->Type() &&
-            !factory->Caps().preserve)
+        if (mProducer->mType != factory->mType &&
+            !factory->mCaps.preserve)
         {
             needsNewBuffer = true;
         }
@@ -350,9 +349,9 @@ SurfaceStream_TripleBuffer_Copy::SwapProducer(SurfaceFactory* factory,
         mStaging->Fence();
 
         New(factory, size, mProducer);
-        
-        if (mProducer && mStaging->Size() == mProducer->Size())
-            SharedSurface::Copy(mStaging, mProducer, factory);
+
+        if (mProducer && mStaging->mSize == mProducer->mSize)
+            SharedSurface::ProdCopy(mStaging, mProducer, factory);
     } else {
         New(factory, size, mProducer);
     }
diff --git a/gfx/gl/SurfaceStream.h b/gfx/gl/SurfaceStream.h
index 0b95d7b5dd0f..ffa440153224 100644
--- a/gfx/gl/SurfaceStream.h
+++ b/gfx/gl/SurfaceStream.h
@@ -18,9 +18,6 @@ namespace mozilla {
 
 namespace gl {
 class GLContext;
-}
-
-namespace gfx {
 class SharedSurface;
 class SurfaceFactory;
 
@@ -41,14 +38,6 @@ public:
                                         mozilla::gl::GLContext* glContext,
                                         SurfaceStream* prevStream = nullptr);
 
-    SurfaceStreamHandle GetShareHandle() {
-        return reinterpret_cast<SurfaceStreamHandle>(this);
-    }
-
-    static SurfaceStream* FromHandle(SurfaceStreamHandle handle) {
-        return (SurfaceStream*)handle;
-    }
-
     const SurfaceStreamType mType;
 
     mozilla::gl::GLContext* GLContext() const { return mGLContext; }
@@ -229,7 +218,7 @@ public:
 };
 
 
-} /* namespace gfx */
-} /* namespace mozilla */
+} // namespace gl
+} // namespace mozilla
 
-#endif /* SURFACESTREAM_H_ */
+#endif // SURFACESTREAM_H_
diff --git a/gfx/gl/SurfaceTypes.cpp b/gfx/gl/SurfaceTypes.cpp
index 112ec48c42c7..d39626b12050 100644
--- a/gfx/gl/SurfaceTypes.cpp
+++ b/gfx/gl/SurfaceTypes.cpp
@@ -4,10 +4,11 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SurfaceTypes.h"
+
 #include "mozilla/layers/ISurfaceAllocator.h"
 
 namespace mozilla {
-namespace gfx {
+namespace gl {
 
 SurfaceCaps::SurfaceCaps()
 {
@@ -53,5 +54,5 @@ SurfaceCaps::~SurfaceCaps()
 {
 }
 
-}
-}
+} // namespace gl
+} // namespace mozilla
diff --git a/gfx/gl/SurfaceTypes.h b/gfx/gl/SurfaceTypes.h
index 639e482fa737..c1f342eb98be 100644
--- a/gfx/gl/SurfaceTypes.h
+++ b/gfx/gl/SurfaceTypes.h
@@ -16,9 +16,7 @@ namespace layers {
 class ISurfaceAllocator;
 }
 
-namespace gfx {
-
-typedef uintptr_t SurfaceStreamHandle;
+namespace gl {
 
 struct SurfaceCaps MOZ_FINAL
 {
@@ -93,15 +91,6 @@ MOZ_BEGIN_ENUM_CLASS(SurfaceStreamType, uint8_t)
 MOZ_END_ENUM_CLASS(SurfaceStreamType)
 
 
-MOZ_BEGIN_ENUM_CLASS(APITypeT, uint8_t)
-    Generic = 0,
-
-    OpenGL,
-
-    Max
-MOZ_END_ENUM_CLASS(APITypeT)
-
-
 MOZ_BEGIN_ENUM_CLASS(AttachmentType, uint8_t)
     Screen = 0,
 
diff --git a/gfx/gl/moz.build b/gfx/gl/moz.build
index 7bf76db2cb8d..e3d1c9156fba 100644
--- a/gfx/gl/moz.build
+++ b/gfx/gl/moz.build
@@ -52,7 +52,6 @@ EXPORTS += [
     'SharedSurface.h',
     'SharedSurfaceEGL.h',
     'SharedSurfaceGL.h',
-    'SurfaceFactory.h',
     'SurfaceStream.h',
     'SurfaceTypes.h',
     'TextureGarbageBin.h',
@@ -135,7 +134,6 @@ UNIFIED_SOURCES += [
     'SharedSurface.cpp',
     'SharedSurfaceEGL.cpp',
     'SharedSurfaceGL.cpp',
-    'SurfaceFactory.cpp',
     'SurfaceStream.cpp',
     'SurfaceTypes.cpp',
     'TextureGarbageBin.cpp',
diff --git a/gfx/layers/CopyableCanvasLayer.cpp b/gfx/layers/CopyableCanvasLayer.cpp
index 030e40617b15..cd55fc314ee4 100644
--- a/gfx/layers/CopyableCanvasLayer.cpp
+++ b/gfx/layers/CopyableCanvasLayer.cpp
@@ -8,8 +8,8 @@
 #include "GLContext.h"                  // for GLContext
 #include "GLScreenBuffer.h"             // for GLScreenBuffer
 #include "SharedSurface.h"              // for SharedSurface
-#include "SharedSurfaceGL.h"            // for SharedSurface_GL, etc
-#include "SurfaceTypes.h"               // for APITypeT, APITypeT::OpenGL, etc
+#include "SharedSurfaceGL.h"              // for SharedSurface
+#include "SurfaceStream.h"              // for SurfaceStream
 #include "gfxMatrix.h"                  // for gfxMatrix
 #include "gfxPattern.h"                 // for gfxPattern, etc
 #include "gfxPlatform.h"                // for gfxPlatform, gfxImageFormat
@@ -98,9 +98,9 @@ CopyableCanvasLayer::UpdateTarget(DrawTarget* aDestTarget)
   }
 
   if (mGLContext) {
-    SharedSurface_GL* sharedSurf = nullptr;
+    SharedSurface* sharedSurf = nullptr;
     if (mStream) {
-      sharedSurf = SharedSurface_GL::Cast(mStream->SwapConsumer());
+      sharedSurf = mStream->SwapConsumer();
     } else {
       sharedSurf = mGLContext->RequestFrame();
     }
@@ -110,11 +110,11 @@ CopyableCanvasLayer::UpdateTarget(DrawTarget* aDestTarget)
       return;
     }
 
-    IntSize readSize(sharedSurf->Size());
+    IntSize readSize(sharedSurf->mSize);
     SurfaceFormat format = (GetContentFlags() & CONTENT_OPAQUE)
                             ? SurfaceFormat::B8G8R8X8
                             : SurfaceFormat::B8G8R8A8;
-    bool needsPremult = sharedSurf->HasAlpha() && !mIsAlphaPremultiplied;
+    bool needsPremult = sharedSurf->mHasAlpha && !mIsAlphaPremultiplied;
 
     // Try to read back directly into aDestTarget's output buffer
     if (aDestTarget) {
@@ -138,7 +138,7 @@ CopyableCanvasLayer::UpdateTarget(DrawTarget* aDestTarget)
     }
 
     RefPtr<SourceSurface> resultSurf;
-    if (sharedSurf->Type() == SharedSurfaceType::Basic && !needsPremult) {
+    if (sharedSurf->mType == SharedSurfaceType::Basic && !needsPremult) {
       SharedSurface_Basic* sharedSurf_Basic = SharedSurface_Basic::Cast(sharedSurf);
       resultSurf = sharedSurf_Basic->GetData();
     } else {
diff --git a/gfx/layers/CopyableCanvasLayer.h b/gfx/layers/CopyableCanvasLayer.h
index 7d1490fb09a3..15a117478e0d 100644
--- a/gfx/layers/CopyableCanvasLayer.h
+++ b/gfx/layers/CopyableCanvasLayer.h
@@ -21,11 +21,8 @@
 #include "nsISupportsImpl.h"            // for MOZ_COUNT_CTOR, etc
 
 namespace mozilla {
-
-namespace gfx {
+namespace gl{
 class SurfaceStream;
-class SharedSurface;
-class SurfaceFactory;
 }
 
 namespace layers {
@@ -52,10 +49,10 @@ protected:
   void UpdateTarget(gfx::DrawTarget* aDestTarget = nullptr);
 
   RefPtr<gfx::SourceSurface> mSurface;
-  nsRefPtr<mozilla::gl::GLContext> mGLContext;
+  nsRefPtr<gl::GLContext> mGLContext;
   mozilla::RefPtr<mozilla::gfx::DrawTarget> mDrawTarget;
 
-  RefPtr<gfx::SurfaceStream> mStream;
+  RefPtr<gl::SurfaceStream> mStream;
 
   uint32_t mCanvasFramebuffer;
 
diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp
index 90f034b0d78e..c1b5f2d0de5e 100644
--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -249,7 +249,7 @@ ImageContainer::HasCurrentImage()
 
   if (mRemoteData) {
     CrossProcessMutexAutoLock autoLock(*mRemoteDataMutex);
-    
+
     EnsureActiveImage();
 
     return !!mActiveImage.get();
@@ -262,7 +262,7 @@ already_AddRefed<Image>
 ImageContainer::LockCurrentImage()
 {
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  
+
   if (mRemoteData) {
     NS_ASSERTION(mRemoteDataMutex, "Should have remote data mutex when having remote data!");
     mRemoteDataMutex->Lock();
@@ -405,13 +405,13 @@ ImageContainer::EnsureActiveImage()
     if (mRemoteData->mType == RemoteImageData::RAW_BITMAP &&
         mRemoteData->mBitmap.mData && !mActiveImage) {
       nsRefPtr<RemoteBitmapImage> newImg = new RemoteBitmapImage();
-      
+
       newImg->mFormat = mRemoteData->mFormat;
       newImg->mData = mRemoteData->mBitmap.mData;
       newImg->mSize = mRemoteData->mSize;
       newImg->mStride = mRemoteData->mBitmap.mStride;
       mRemoteData->mWasUpdated = false;
-              
+
       mActiveImage = newImg;
     }
 #ifdef XP_WIN
@@ -464,10 +464,10 @@ PlanarYCbCrImage::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
   return size;
 }
 
-uint8_t* 
+uint8_t*
 PlanarYCbCrImage::AllocateBuffer(uint32_t aSize)
 {
-  return mRecycleBin->GetBuffer(aSize); 
+  return mRecycleBin->GetBuffer(aSize);
 }
 
 static void
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 4944f236798b..5acb2fe71d4d 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -59,11 +59,11 @@ class WebGLContext;
 
 namespace gl {
 class GLContext;
+class SurfaceStream;
 }
 
 namespace gfx {
 class DrawTarget;
-class SurfaceStream;
 }
 
 namespace css {
@@ -1746,7 +1746,7 @@ public:
   float GetPreYScale() const { return mPreYScale; }
   float GetInheritedXScale() const { return mInheritedXScale; }
   float GetInheritedYScale() const { return mInheritedYScale; }
-  
+
   gfxRGBA GetBackgroundColor() const { return mBackgroundColor; }
 
   MOZ_LAYER_DECL_NAME("ContainerLayer", TYPE_CONTAINER)
@@ -1930,7 +1930,7 @@ public:
     mozilla::gl::GLContext* mGLContext; // or this, for GL.
 
     // Canvas/SkiaGL uses this
-    mozilla::gfx::SurfaceStream* mStream;
+    mozilla::gl::SurfaceStream* mStream;
 
     // ID of the texture backing the canvas layer (defaults to 0)
     uint32_t mTexID;
diff --git a/gfx/layers/apz/src/APZCTreeManager.cpp b/gfx/layers/apz/src/APZCTreeManager.cpp
index 2204f46ad4ac..b1f31515d498 100644
--- a/gfx/layers/apz/src/APZCTreeManager.cpp
+++ b/gfx/layers/apz/src/APZCTreeManager.cpp
@@ -960,12 +960,18 @@ APZCTreeManager::GetTargetAPZC(const ScreenPoint& aPoint, bool* aOutInOverscroll
   nsRefPtr<AsyncPanZoomController> target;
   // The root may have siblings, so check those too
   gfxPoint point(aPoint.x, aPoint.y);
+  bool inOverscrolledApzc = false;
   for (AsyncPanZoomController* apzc = mRootApzc; apzc; apzc = apzc->GetPrevSibling()) {
-    target = GetAPZCAtPoint(apzc, point, aOutInOverscrolledApzc);
+    target = GetAPZCAtPoint(apzc, point, &inOverscrolledApzc);
     if (target) {
       break;
     }
   }
+  // If we are in an overscrolled APZC, we should be returning nullptr.
+  MOZ_ASSERT(!(target && inOverscrolledApzc));
+  if (aOutInOverscrolledApzc) {
+    *aOutInOverscrolledApzc = inOverscrolledApzc;
+  }
   return target.forget();
 }
 
@@ -1139,6 +1145,10 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
   if (hitTestPointForChildLayers.HasPositiveWCoord()) {
     for (AsyncPanZoomController* child = aApzc->GetLastChild(); child; child = child->GetPrevSibling()) {
       AsyncPanZoomController* match = GetAPZCAtPoint(child, hitTestPointForChildLayers.As2DPoint(), aOutInOverscrolledApzc);
+      if (*aOutInOverscrolledApzc) {
+        // We matched an overscrolled APZC, abort.
+        return nullptr;
+      }
       if (match) {
         result = match;
         break;
@@ -1156,9 +1166,7 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
   // the result is inside an overscrolled APZC, inform our caller of this
   // (callers typically ignore events targeted at overscrolled APZCs).
   if (result && aApzc->IsOverscrolled()) {
-    if (aOutInOverscrolledApzc) {
-      *aOutInOverscrolledApzc = true;
-    }
+    *aOutInOverscrolledApzc = true;
     result = nullptr;
   }
 
diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index 785062c65800..d63d1e047d16 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -190,7 +190,7 @@ static void
 PixmanTransform(DataSourceSurface* aDest,
                 DataSourceSurface* aSource,
                 const gfx3DMatrix& aTransform,
-                gfxPoint aDestOffset)
+                const Point& aDestOffset)
 {
   IntSize destSize = aDest->GetSize();
   pixman_image_t* dest = pixman_image_create_bits(PIXMAN_a8r8g8b8,
@@ -273,6 +273,10 @@ BasicCompositor::DrawQuad(const gfx::Rect& aRect,
       return;
     }
 
+    Matrix destTransform;
+    destTransform.Translate(-aRect.x, -aRect.y);
+    dest->SetTransform(destTransform);
+
     // Get the bounds post-transform.
     To3DMatrix(aTransform, new3DTransform);
     gfxRect bounds = new3DTransform.TransformBounds(ThebesRect(aRect));
@@ -286,9 +290,7 @@ BasicCompositor::DrawQuad(const gfx::Rect& aRect,
 
     // When we apply the 3D transformation, we do it against a temporary
     // surface, so undo the coordinate offset.
-    new3DTransform = new3DTransform * gfx3DMatrix::Translation(-transformBounds.x, -transformBounds.y, 0);
-
-    transformBounds.MoveTo(0, 0);
+    new3DTransform = gfx3DMatrix::Translation(aRect.x, aRect.y, 0) * new3DTransform;
   }
 
   newTransform.PostTranslate(-offset.x, -offset.y);
@@ -379,8 +381,9 @@ BasicCompositor::DrawQuad(const gfx::Rect& aRect,
       return;
     }
 
-    PixmanTransform(temp, source, new3DTransform, gfxPoint(0, 0));
+    PixmanTransform(temp, source, new3DTransform, transformBounds.TopLeft());
 
+    transformBounds.MoveTo(0, 0);
     buffer->DrawSurface(temp, transformBounds, transformBounds);
   }
 
diff --git a/gfx/layers/client/CanvasClient.cpp b/gfx/layers/client/CanvasClient.cpp
index d6e30178b64a..ecc6d0eb830e 100644
--- a/gfx/layers/client/CanvasClient.cpp
+++ b/gfx/layers/client/CanvasClient.cpp
@@ -3,7 +3,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/layers/CanvasClient.h"
+#include "CanvasClient.h"
+
 #include "ClientCanvasLayer.h"          // for ClientCanvasLayer
 #include "CompositorChild.h"            // for CompositorChild
 #include "GLContext.h"                  // for GLContext
@@ -169,7 +170,7 @@ CanvasClientSurfaceStream::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
     return;
   }
 
-  if (surf->Type() != SharedSurfaceType::Gralloc) {
+  if (surf->mType != SharedSurfaceType::Gralloc) {
     printf_stderr("Unexpected non-Gralloc SharedSurface in IPC path!");
     MOZ_ASSERT(false);
     return;
diff --git a/gfx/layers/client/CanvasClient.h b/gfx/layers/client/CanvasClient.h
index 539758dbb513..df130567b174 100644
--- a/gfx/layers/client/CanvasClient.h
+++ b/gfx/layers/client/CanvasClient.h
@@ -19,7 +19,7 @@
 #include "mozilla/gfx/Types.h"          // for SurfaceFormat
 
 namespace mozilla {
-namespace gfx {
+namespace gl {
 class SharedSurface;
 }
 }
diff --git a/gfx/layers/client/ClientCanvasLayer.cpp b/gfx/layers/client/ClientCanvasLayer.cpp
index 8d1e7473a9cc..8cfb78fae295 100644
--- a/gfx/layers/client/ClientCanvasLayer.cpp
+++ b/gfx/layers/client/ClientCanvasLayer.cpp
@@ -66,14 +66,14 @@ ClientCanvasLayer::Initialize(const Data& aData)
       // The screen caps are irrelevant if we're using a separate stream
       caps = aData.mHasAlpha ? SurfaceCaps::ForRGBA() : SurfaceCaps::ForRGB();
     } else {
-      caps = screen->Caps();
+      caps = screen->mCaps;
     }
     MOZ_ASSERT(caps.alpha == aData.mHasAlpha);
 
     SurfaceStreamType streamType =
         SurfaceStream::ChooseGLStreamType(SurfaceStream::OffMainThread,
                                           screen->PreserveBuffer());
-    SurfaceFactory_GL* factory = nullptr;
+    SurfaceFactory* factory = nullptr;
     if (!gfxPrefs::WebGLForceLayersReadback()) {
       switch (ClientManager()->AsShadowForwarder()->GetCompositorBackendType()) {
         case mozilla::layers::LayersBackend::LAYERS_OPENGL: {
@@ -94,7 +94,7 @@ ClientCanvasLayer::Initialize(const Data& aData)
             // [Basic Layers, OMTC] WebGL layer init.
             // Well, this *should* work...
 #ifdef XP_MACOSX
-            factory = new SurfaceFactory_IOSurface(mGLContext, caps);
+            factory = SurfaceFactory_IOSurface::Create(mGLContext, caps);
 #else
             factory = new SurfaceFactory_GLTexture(mGLContext, nullptr, caps);
 #endif
diff --git a/gfx/layers/client/ClientCanvasLayer.h b/gfx/layers/client/ClientCanvasLayer.h
index 37e5a1e6a539..b9f9d86818e9 100644
--- a/gfx/layers/client/ClientCanvasLayer.h
+++ b/gfx/layers/client/ClientCanvasLayer.h
@@ -20,6 +20,12 @@
 #include "nsRegion.h"                   // for nsIntRegion
 
 namespace mozilla {
+namespace gl {
+class SurfaceStream;
+class SharedSurface;
+class SurfaceFactory;
+}
+
 namespace layers {
 
 class CompositableClient;
@@ -92,8 +98,8 @@ protected:
 
   RefPtr<CanvasClient> mCanvasClient;
 
-  gfx::SharedSurface* mTextureSurface;
-  gfx::SurfaceFactory* mFactory;
+  gl::SharedSurface* mTextureSurface;
+  gl::SurfaceFactory* mFactory;
 
   friend class DeprecatedCanvasClient2D;
   friend class CanvasClient2D;
diff --git a/gfx/layers/client/TextureClient.cpp b/gfx/layers/client/TextureClient.cpp
index e42d03d2c6c3..dc048f272c82 100644
--- a/gfx/layers/client/TextureClient.cpp
+++ b/gfx/layers/client/TextureClient.cpp
@@ -787,13 +787,12 @@ StreamTextureClient::ToSurfaceDescriptor(SurfaceDescriptor& aOutDescriptor)
     return false;
   }
 
-  gfx::SurfaceStreamHandle handle = mStream->GetShareHandle();
-  aOutDescriptor = SurfaceStreamDescriptor(handle, false);
+  aOutDescriptor = SurfaceStreamDescriptor((uintptr_t)mStream.get(), false);
   return true;
 }
 
 void
-StreamTextureClient::InitWith(gfx::SurfaceStream* aStream)
+StreamTextureClient::InitWith(gl::SurfaceStream* aStream)
 {
   MOZ_ASSERT(!IsAllocated());
   mStream = aStream;
diff --git a/gfx/layers/client/TextureClient.h b/gfx/layers/client/TextureClient.h
index fe25d28292ec..7c338ab241d2 100644
--- a/gfx/layers/client/TextureClient.h
+++ b/gfx/layers/client/TextureClient.h
@@ -31,12 +31,9 @@ class gfxReusableSurfaceWrapper;
 class gfxImageSurface;
 
 namespace mozilla {
-namespace gfx {
-class SurfaceStream;
-}
-
 namespace gl {
 class GLContext;
+class SurfaceStream;
 }
 
 namespace layers {
@@ -576,7 +573,7 @@ public:
 
   virtual bool HasInternalBuffer() const MOZ_OVERRIDE { return false; }
 
-  void InitWith(gfx::SurfaceStream* aStream);
+  void InitWith(gl::SurfaceStream* aStream);
 
   virtual gfx::IntSize GetSize() const { return gfx::IntSize(); }
 
@@ -593,7 +590,7 @@ public:
 
 protected:
   bool mIsLocked;
-  RefPtr<gfx::SurfaceStream> mStream;
+  RefPtr<gl::SurfaceStream> mStream;
   RefPtr<gl::GLContext> mGL; // Just for reference holding.
 };
 
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index b46eb4f6ded2..4fcaac6c0e61 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -814,7 +814,7 @@ StreamTextureHost::StreamTextureHost(TextureFlags aFlags,
                                      const SurfaceStreamDescriptor& aDesc)
   : TextureHost(aFlags)
 {
-  mStream = gfx::SurfaceStream::FromHandle(aDesc.handle());
+  mStream = (gl::SurfaceStream*)aDesc.surfStream();
   MOZ_ASSERT(mStream);
 }
 
@@ -831,7 +831,7 @@ StreamTextureHost::Lock()
     return false;
   }
 
-  gfx::SharedSurface* abstractSurf = mStream->SwapConsumer();
+  gl::SharedSurface* abstractSurf = mStream->SwapConsumer();
   if (!abstractSurf) {
     return false;
   }
@@ -841,8 +841,8 @@ StreamTextureHost::Lock()
     case LayersBackend::LAYERS_BASIC:
     case LayersBackend::LAYERS_D3D9:
     case LayersBackend::LAYERS_D3D10:
-      switch (abstractSurf->Type()) {
-        case gfx::SharedSurfaceType::Basic:
+      switch (abstractSurf->mType) {
+        case gl::SharedSurfaceType::Basic:
           compositorSupportsShSurfType = true;
           break;
         default:
@@ -850,12 +850,12 @@ StreamTextureHost::Lock()
       }
       break;
     case LayersBackend::LAYERS_OPENGL:
-      switch (abstractSurf->Type()) {
-        case gfx::SharedSurfaceType::Basic:
-        case gfx::SharedSurfaceType::GLTextureShare:
-        case gfx::SharedSurfaceType::EGLImageShare:
-        case gfx::SharedSurfaceType::Gralloc:
-        case gfx::SharedSurfaceType::IOSurface:
+      switch (abstractSurf->mType) {
+        case gl::SharedSurfaceType::Basic:
+        case gl::SharedSurfaceType::GLTextureShare:
+        case gl::SharedSurfaceType::EGLImageShare:
+        case gl::SharedSurfaceType::Gralloc:
+        case gl::SharedSurfaceType::IOSurface:
           compositorSupportsShSurfType = true;
           break;
         default:
@@ -863,9 +863,9 @@ StreamTextureHost::Lock()
       }
       break;
     case LayersBackend::LAYERS_D3D11:
-      switch (abstractSurf->Type()) {
-        case gfx::SharedSurfaceType::Basic:
-        case gfx::SharedSurfaceType::EGLSurfaceANGLE:
+      switch (abstractSurf->mType) {
+        case gl::SharedSurfaceType::Basic:
+        case gl::SharedSurfaceType::EGLSurfaceANGLE:
           compositorSupportsShSurfType = true;
           break;
         default:
@@ -878,11 +878,11 @@ StreamTextureHost::Lock()
 
   RefPtr<NewTextureSource> newTexSource;
   if (compositorSupportsShSurfType) {
-    gfx::SurfaceFormat format = abstractSurf->HasAlpha() ? gfx::SurfaceFormat::R8G8B8A8
-                                                         : gfx::SurfaceFormat::R8G8B8X8;
+    gfx::SurfaceFormat format = abstractSurf->mHasAlpha ? gfx::SurfaceFormat::R8G8B8A8
+                                                        : gfx::SurfaceFormat::R8G8B8X8;
 
-    switch (abstractSurf->Type()) {
-      case gfx::SharedSurfaceType::Basic: {
+    switch (abstractSurf->mType) {
+      case gl::SharedSurfaceType::Basic: {
         gl::SharedSurface_Basic* surf = gl::SharedSurface_Basic::Cast(abstractSurf);
 
         if (!this->mDataTextureSource) {
@@ -894,7 +894,7 @@ StreamTextureHost::Lock()
         newTexSource = mDataTextureSource;
         break;
       }
-      case gfx::SharedSurfaceType::GLTextureShare: {
+      case gl::SharedSurfaceType::GLTextureShare: {
         gl::SharedSurface_GLTexture* surf = gl::SharedSurface_GLTexture::Cast(abstractSurf);
 
         MOZ_ASSERT(mCompositor->GetBackendType() == LayersBackend::LAYERS_OPENGL);
@@ -907,11 +907,11 @@ StreamTextureHost::Lock()
                                            tex,
                                            format,
                                            target,
-                                           surf->Size());
+                                           surf->mSize);
         break;
       }
 #ifdef MOZ_ENABLE_D3D10_LAYER
-      case gfx::SharedSurfaceType::EGLSurfaceANGLE: {
+      case gl::SharedSurfaceType::EGLSurfaceANGLE: {
         gl::SharedSurface_ANGLEShareHandle* surf = gl::SharedSurface_ANGLEShareHandle::Cast(abstractSurf);
         HANDLE shareHandle = surf->GetShareHandle();
 
@@ -931,7 +931,7 @@ StreamTextureHost::Lock()
         break;
       }
 #endif
-      case gfx::SharedSurfaceType::EGLImageShare: {
+      case gl::SharedSurfaceType::EGLImageShare: {
         gl::SharedSurface_EGLImage* surf = gl::SharedSurface_EGLImage::Cast(abstractSurf);
 
         MOZ_ASSERT(mCompositor->GetBackendType() == LayersBackend::LAYERS_OPENGL);
@@ -947,15 +947,15 @@ StreamTextureHost::Lock()
                                            tex,
                                            format,
                                            target,
-                                           surf->Size());
+                                           surf->mSize);
         break;
       }
-      case gfx::SharedSurfaceType::Gralloc: {
+      case gl::SharedSurfaceType::Gralloc: {
         MOZ_ASSERT(false, "WebGL in the Host process? Gralloc without E10S? Not yet supported.");
         break;
       }
 #ifdef XP_MACOSX
-      case gfx::SharedSurfaceType::IOSurface: {
+      case gl::SharedSurfaceType::IOSurface: {
         gl::SharedSurface_IOSurface* surf = gl::SharedSurface_IOSurface::Cast(abstractSurf);
         MacIOSurface* ioSurf = surf->GetIOSurface();
 
diff --git a/gfx/layers/composite/TextureHost.h b/gfx/layers/composite/TextureHost.h
index 2a0697697d6e..846ccc4dc7e8 100644
--- a/gfx/layers/composite/TextureHost.h
+++ b/gfx/layers/composite/TextureHost.h
@@ -33,7 +33,7 @@ struct nsIntSize;
 struct nsIntRect;
 
 namespace mozilla {
-namespace gfx {
+namespace gl {
 class SurfaceStream;
 }
 namespace ipc {
@@ -635,7 +635,7 @@ public:
 
 protected:
   Compositor* mCompositor;
-  gfx::SurfaceStream* mStream;
+  gl::SurfaceStream* mStream;
   RefPtr<NewTextureSource> mTextureSource;
   RefPtr<DataTextureSource> mDataTextureSource;
 };
diff --git a/gfx/layers/d3d10/CanvasLayerD3D10.cpp b/gfx/layers/d3d10/CanvasLayerD3D10.cpp
index 3f82dcc10588..2f9ca3038585 100644
--- a/gfx/layers/d3d10/CanvasLayerD3D10.cpp
+++ b/gfx/layers/d3d10/CanvasLayerD3D10.cpp
@@ -51,11 +51,11 @@ CanvasLayerD3D10::Initialize(const Data& aData)
         SurfaceStream::ChooseGLStreamType(SurfaceStream::MainThread,
                                           screen->PreserveBuffer());
 
-    SurfaceFactory_GL* factory = nullptr;
+    SurfaceFactory* factory = nullptr;
     if (!gfxPrefs::WebGLForceLayersReadback()) {
       if (mGLContext->IsANGLE()) {
         factory = SurfaceFactory_ANGLEShareHandle::Create(mGLContext,
-                                                          screen->Caps());
+                                                          screen->mCaps);
       }
     }
 
@@ -121,12 +121,12 @@ CanvasLayerD3D10::UpdateSurface()
   }
 
   if (mGLContext) {
-    SharedSurface_GL* surf = mGLContext->RequestFrame();
+    SharedSurface* surf = mGLContext->RequestFrame();
     if (!surf) {
       return;
     }
 
-    switch (surf->Type()) {
+    switch (surf->mType) {
       case SharedSurfaceType::EGLSurfaceANGLE: {
         SharedSurface_ANGLEShareHandle* shareSurf = SharedSurface_ANGLEShareHandle::Cast(surf);
         HANDLE shareHandle = shareSurf->GetShareHandle();
diff --git a/gfx/layers/d3d9/CanvasLayerD3D9.cpp b/gfx/layers/d3d9/CanvasLayerD3D9.cpp
index 00d8dc87d628..6f9cd6aa30d9 100644
--- a/gfx/layers/d3d9/CanvasLayerD3D9.cpp
+++ b/gfx/layers/d3d9/CanvasLayerD3D9.cpp
@@ -9,6 +9,7 @@
 #include "gfxWindowsSurface.h"
 #include "gfxWindowsPlatform.h"
 #include "SurfaceStream.h"
+#include "SharedSurface.h"
 #include "SharedSurfaceGL.h"
 #include "GLContext.h"
 #include "CanvasLayerD3D9.h"
@@ -79,7 +80,7 @@ CanvasLayerD3D9::UpdateSurface()
   RefPtr<SourceSurface> surface;
 
   if (mGLContext) {
-    SharedSurface_GL* surf = mGLContext->RequestFrame();
+    SharedSurface* surf = mGLContext->RequestFrame();
     if (!surf)
         return;
 
diff --git a/gfx/layers/ipc/LayersSurfaces.ipdlh b/gfx/layers/ipc/LayersSurfaces.ipdlh
index 75abc2455b0d..d926c85081de 100644
--- a/gfx/layers/ipc/LayersSurfaces.ipdlh
+++ b/gfx/layers/ipc/LayersSurfaces.ipdlh
@@ -13,7 +13,6 @@ using struct mozilla::null_t from "ipc/IPCMessageUtils.h";
 using mozilla::WindowsHandle from "ipc/IPCMessageUtils.h";
 using mozilla::gl::SharedTextureHandle from "GLContextTypes.h";
 using mozilla::gl::SharedTextureShareType from "GLContextTypes.h";
-using mozilla::gfx::SurfaceStreamHandle from "SurfaceTypes.h";
 using mozilla::gfx::SurfaceFormat from "mozilla/gfx/Types.h";
 using mozilla::gfx::IntSize from "mozilla/gfx/Point.h";
 using gfxImageFormat from "gfxTypes.h";
@@ -67,7 +66,7 @@ struct NewSurfaceDescriptorGralloc {
 };
 
 struct SurfaceStreamDescriptor {
-  SurfaceStreamHandle handle;
+  uintptr_t surfStream;
   bool yflip;
 };
 
diff --git a/gfx/layers/opengl/TextureClientOGL.h b/gfx/layers/opengl/TextureClientOGL.h
index 0083a2e72e0d..91460e94933d 100644
--- a/gfx/layers/opengl/TextureClientOGL.h
+++ b/gfx/layers/opengl/TextureClientOGL.h
@@ -15,7 +15,7 @@
 #include "mozilla/layers/TextureClient.h"  // for TextureClient, etc
 
 namespace mozilla {
-namespace gfx {
+namespace gl {
 class SurfaceStream;
 }
 }
diff --git a/gfx/layers/opengl/TextureHostOGL.h b/gfx/layers/opengl/TextureHostOGL.h
index 77caacf60159..b9398ee77727 100644
--- a/gfx/layers/opengl/TextureHostOGL.h
+++ b/gfx/layers/opengl/TextureHostOGL.h
@@ -45,6 +45,9 @@ struct nsIntSize;
 namespace mozilla {
 namespace gfx {
 class DataSourceSurface;
+}
+
+namespace gl {
 class SurfaceStream;
 }
 
diff --git a/gfx/thebes/gfxContext.cpp b/gfx/thebes/gfxContext.cpp
index a8155dd9541d..4ce1e8b166aa 100644
--- a/gfx/thebes/gfxContext.cpp
+++ b/gfx/thebes/gfxContext.cpp
@@ -235,18 +235,16 @@ gfxContext::ClosePath()
   mPathBuilder->Close();
 }
 
-already_AddRefed<gfxPath> gfxContext::CopyPath()
+TemporaryRef<Path> gfxContext::GetPath()
 {
   EnsurePath();
-  nsRefPtr<gfxPath> path = new gfxPath(mPath);
-  return path.forget();
+  return mPath;
 }
 
-void gfxContext::SetPath(gfxPath* path)
+void gfxContext::SetPath(Path* path)
 {
-  MOZ_ASSERT(path->mMoz2DPath, "Can't mix cairo and azure paths!");
-  MOZ_ASSERT(path->mMoz2DPath->GetBackendType() == mDT->GetBackendType());
-  mPath = path->mMoz2DPath;
+  MOZ_ASSERT(path->GetBackendType() == mDT->GetBackendType());
+  mPath = path;
   mPathBuilder = nullptr;
   mPathIsRect = false;
   mTransformChanged = false;
diff --git a/gfx/thebes/gfxContext.h b/gfx/thebes/gfxContext.h
index 9f24f86e4f83..eaa98ee69c0e 100644
--- a/gfx/thebes/gfxContext.h
+++ b/gfx/thebes/gfxContext.h
@@ -13,7 +13,6 @@
 #include "gfxRect.h"
 #include "gfxMatrix.h"
 #include "gfxPattern.h"
-#include "gfxPath.h"
 #include "nsTArray.h"
 #include "nsAutoPtr.h"
 
@@ -38,6 +37,8 @@ template <typename T> class FallibleTArray;
  * as opposed to app units.
  */
 class gfxContext MOZ_FINAL {
+    typedef mozilla::gfx::Path Path;
+
     NS_INLINE_DECL_REFCOUNTING(gfxContext)
 
 public:
@@ -133,14 +134,14 @@ public:
     void ClosePath();
 
     /**
-     * Copies the current path and returns the copy.
+     * Returns the current path.
      */
-    already_AddRefed<gfxPath> CopyPath();
+    mozilla::TemporaryRef<Path> GetPath();
 
     /**
      * Appends the given path to the current path.
      */
-    void SetPath(gfxPath* path);
+    void SetPath(Path* path);
 
     /**
      * Moves the pen to a new point without drawing a line.
@@ -724,7 +725,6 @@ private:
   typedef mozilla::gfx::Float Float;
   typedef mozilla::gfx::Rect Rect;
   typedef mozilla::gfx::CompositionOp CompositionOp;
-  typedef mozilla::gfx::Path Path;
   typedef mozilla::gfx::PathBuilder PathBuilder;
   typedef mozilla::gfx::SourceSurface SourceSurface;
   
@@ -852,6 +852,8 @@ private:
  */
 class gfxContextPathAutoSaveRestore
 {
+    typedef mozilla::gfx::Path Path;
+
 public:
     gfxContextPathAutoSaveRestore() : mContext(nullptr) {}
 
@@ -880,7 +882,7 @@ public:
     void Save()
     {
         if (!mPath && mContext) {
-            mPath = mContext->CopyPath();
+            mPath = mContext->GetPath();
         }
     }
 
@@ -899,7 +901,7 @@ public:
 private:
     gfxContext *mContext;
 
-    nsRefPtr<gfxPath> mPath;
+    mozilla::RefPtr<Path> mPath;
 };
 
 /**
diff --git a/gfx/thebes/gfxPath.cpp b/gfx/thebes/gfxPath.cpp
deleted file mode 100644
index b5a5096285e0..000000000000
--- a/gfx/thebes/gfxPath.cpp
+++ /dev/null
@@ -1,27 +0,0 @@
-/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "gfxPath.h"
-#include "mozilla/gfx/2D.h"
-
-#include "cairo.h"
-
-using namespace mozilla::gfx;
-
-gfxPath::gfxPath(cairo_path_t* aPath)
-  : mPath(aPath)
-{
-}
-
-gfxPath::gfxPath(Path* aPath)
-  : mPath(nullptr)
-  , mMoz2DPath(aPath)
-{
-}
-
-gfxPath::~gfxPath()
-{
-    cairo_path_destroy(mPath);
-}
diff --git a/gfx/thebes/gfxPath.h b/gfx/thebes/gfxPath.h
deleted file mode 100644
index 86da24cec53c..000000000000
--- a/gfx/thebes/gfxPath.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef GFX_PATH_H
-#define GFX_PATH_H
-
-#include "gfxTypes.h"
-#include "nsISupportsImpl.h"
-#include "mozilla/RefPtr.h"
-
-class gfxContext;
-typedef struct cairo_path cairo_path_t;
-
-namespace mozilla {
-namespace gfx {
-class Path;
-}
-}
-
-/**
- * Class representing a path. Can be created by copying the current path
- * of a gfxContext.
- */
-class gfxPath MOZ_FINAL {
-    NS_INLINE_DECL_REFCOUNTING(gfxPath)
-
-    friend class gfxContext;
-
-    gfxPath(cairo_path_t* aPath);
-
-public:
-    gfxPath(mozilla::gfx::Path* aPath);
-
-private:
-    // Private destructor, to discourage deletion outside of Release():
-    ~gfxPath();
-
-    cairo_path_t* mPath;
-    mozilla::RefPtr<mozilla::gfx::Path> mMoz2DPath;
-};
-
-#endif
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index 93b4ff37549c..de8ce944a6f5 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -886,7 +886,7 @@ gfxPlatform::GetSkiaGLGlue()
      * FIXME: This should be stored in TLS or something, since there needs to be one for each thread using it. As it
      * stands, this only works on the main thread.
      */
-    mozilla::gfx::SurfaceCaps caps = mozilla::gfx::SurfaceCaps::ForRGBA();
+    mozilla::gl::SurfaceCaps caps = mozilla::gl::SurfaceCaps::ForRGBA();
     nsRefPtr<mozilla::gl::GLContext> glContext = mozilla::gl::GLContextProvider::CreateOffscreen(gfxIntSize(16, 16), caps);
     if (!glContext) {
       printf_stderr("Failed to create GLContext for SkiaGL!\n");
diff --git a/gfx/thebes/moz.build b/gfx/thebes/moz.build
index 3cbf66487484..68fff976ce3c 100644
--- a/gfx/thebes/moz.build
+++ b/gfx/thebes/moz.build
@@ -28,7 +28,6 @@ EXPORTS += [
     'gfxLineSegment.h',
     'gfxMathTable.h',
     'gfxMatrix.h',
-    'gfxPath.h',
     'gfxPattern.h',
     'gfxPlatform.h',
     'gfxPoint.h',
@@ -233,7 +232,6 @@ UNIFIED_SOURCES += [
     'gfxImageSurface.cpp',
     'gfxMathTable.cpp',
     'gfxMatrix.cpp',
-    'gfxPath.cpp',
     'gfxPattern.cpp',
     'gfxRect.cpp',
     'gfxReusableImageSurfaceWrapper.cpp',
diff --git a/js/ipc/JavaScriptShared.cpp b/js/ipc/JavaScriptShared.cpp
index 9d5b3de20463..b048d8e3e367 100644
--- a/js/ipc/JavaScriptShared.cpp
+++ b/js/ipc/JavaScriptShared.cpp
@@ -201,12 +201,7 @@ JavaScriptShared::convertIdToGeckoString(JSContext *cx, JS::HandleId id, nsStrin
     if (!str)
         return false;
 
-    const jschar *chars = JS_GetStringCharsZ(cx, str);
-    if (!chars)
-        return false;
-
-    *to = chars;
-    return true;
+    return AssignJSString(cx, *to, str);
 }
 
 bool
diff --git a/js/public/Utility.h b/js/public/Utility.h
index f688990d7524..89c495e41116 100644
--- a/js/public/Utility.h
+++ b/js/public/Utility.h
@@ -170,6 +170,9 @@ static inline void js_free(void* p)
 #define JS_NEW_BODY(allocator, t, parms)                                       \
     void *memory = allocator(sizeof(t));                                       \
     return memory ? new(memory) t parms : nullptr;
+#define JS_MAKE_BODY(newname, T, parms)                                        \
+    T *ptr = newname<T> parms;                                                 \
+    return mozilla::UniquePtr<T, JS::DeletePolicy<T>>(ptr);
 
 /*
  * Given a class which should provide 'new' methods, add
@@ -324,6 +327,187 @@ static inline void js_free(void* p)
                      mozilla::Forward<P12>(p12)))\
     }\
 
+/*
+ * Given a class which should provide 'make' methods, add
+ * JS_DECLARE_MAKE_METHODS (see JSContext for a usage example).  This method
+ * is functionally the same as JS_DECLARE_NEW_METHODS: it just declares methods
+ * that return mozilla::UniquePtr instances that will singly-manage ownership
+ * of the created object.  This adds makes with up to 12 parameters.  Add more
+ * versions below if you need more than 12 parameters.
+ *
+ * Note: Do not add a ; at the end of a use of JS_DECLARE_MAKE_METHODS,
+ * or the build will break.
+ */
+#define JS_DECLARE_MAKE_METHODS(MAKENAME, NEWNAME, QUALIFIERS)\
+    template <class T> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME() MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T, ())\
+    }\
+\
+    template <class T, class P1> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1)))\
+    }\
+\
+    template <class T, class P1, class P2> \
+    QUALIFIERS \
+mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2)))\
+    }\
+\
+    template <class T, class P1, class P2, class P3> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2, P3 &&p3) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2),\
+                     mozilla::Forward<P3>(p3)))\
+    }\
+\
+    template <class T, class P1, class P2, class P3, class P4> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2, P3 &&p3, P4 &&p4) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2),\
+                     mozilla::Forward<P3>(p3),\
+                     mozilla::Forward<P4>(p4)))\
+    }\
+\
+    template <class T, class P1, class P2, class P3, class P4, class P5> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2, P3 &&p3, P4 &&p4, P5 &&p5) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2),\
+                     mozilla::Forward<P3>(p3),\
+                     mozilla::Forward<P4>(p4),\
+                     mozilla::Forward<P5>(p5)))\
+    }\
+\
+    template <class T, class P1, class P2, class P3, class P4, class P5, class P6> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2, P3 &&p3, P4 &&p4, P5 &&p5, P6 &&p6) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2),\
+                     mozilla::Forward<P3>(p3),\
+                     mozilla::Forward<P4>(p4),\
+                     mozilla::Forward<P5>(p5),\
+                     mozilla::Forward<P6>(p6)))\
+    }\
+\
+    template <class T, class P1, class P2, class P3, class P4, class P5, class P6, class P7> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2, P3 &&p3, P4 &&p4, P5 &&p5, P6 &&p6, P7 &&p7) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2),\
+                     mozilla::Forward<P3>(p3),\
+                     mozilla::Forward<P4>(p4),\
+                     mozilla::Forward<P5>(p5),\
+                     mozilla::Forward<P6>(p6),\
+                     mozilla::Forward<P7>(p7)))\
+    }\
+\
+    template <class T, class P1, class P2, class P3, class P4, class P5, class P6, class P7, class P8> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2, P3 &&p3, P4 &&p4, P5 &&p5, P6 &&p6, P7 &&p7, P8 &&p8) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2),\
+                     mozilla::Forward<P3>(p3),\
+                     mozilla::Forward<P4>(p4),\
+                     mozilla::Forward<P5>(p5),\
+                     mozilla::Forward<P6>(p6),\
+                     mozilla::Forward<P7>(p7),\
+                     mozilla::Forward<P8>(p8)))\
+    }\
+\
+    template <class T, class P1, class P2, class P3, class P4, class P5, class P6, class P7, class P8, class P9> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2, P3 &&p3, P4 &&p4, P5 &&p5, P6 &&p6, P7 &&p7, P8 &&p8, P9 &&p9) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2),\
+                     mozilla::Forward<P3>(p3),\
+                     mozilla::Forward<P4>(p4),\
+                     mozilla::Forward<P5>(p5),\
+                     mozilla::Forward<P6>(p6),\
+                     mozilla::Forward<P7>(p7),\
+                     mozilla::Forward<P8>(p8),\
+                     mozilla::Forward<P9>(p9)))\
+    }\
+\
+    template <class T, class P1, class P2, class P3, class P4, class P5, class P6, class P7, class P8, class P9, class P10> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2, P3 &&p3, P4 &&p4, P5 &&p5, P6 &&p6, P7 &&p7, P8 &&p8, P9 &&p9, P10 &&p10) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2),\
+                     mozilla::Forward<P3>(p3),\
+                     mozilla::Forward<P4>(p4),\
+                     mozilla::Forward<P5>(p5),\
+                     mozilla::Forward<P6>(p6),\
+                     mozilla::Forward<P7>(p7),\
+                     mozilla::Forward<P8>(p8),\
+                     mozilla::Forward<P9>(p9),\
+                     mozilla::Forward<P10>(p10)))\
+    }\
+\
+    template <class T, class P1, class P2, class P3, class P4, class P5, class P6, class P7, class P8, class P9, class P10, class P11> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2, P3 &&p3, P4 &&p4, P5 &&p5, P6 &&p6, P7 &&p7, P8 &&p8, P9 &&p9, P10 &&p10, P11 &&p11) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2),\
+                     mozilla::Forward<P3>(p3),\
+                     mozilla::Forward<P4>(p4),\
+                     mozilla::Forward<P5>(p5),\
+                     mozilla::Forward<P6>(p6),\
+                     mozilla::Forward<P7>(p7),\
+                     mozilla::Forward<P8>(p8),\
+                     mozilla::Forward<P9>(p9),\
+                     mozilla::Forward<P10>(p10),\
+                     mozilla::Forward<P11>(p11)))\
+    }\
+\
+    template <class T, class P1, class P2, class P3, class P4, class P5, class P6, class P7, class P8, class P9, class P10, class P11, class P12> \
+    QUALIFIERS \
+    mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
+    MAKENAME(P1 &&p1, P2 &&p2, P3 &&p3, P4 &&p4, P5 &&p5, P6 &&p6, P7 &&p7, P8 &&p8, P9 &&p9, P10 &&p10, P11 &&p11, P12 &&p12) MOZ_HEAP_ALLOCATOR {\
+        JS_MAKE_BODY(NEWNAME, T,\
+                    (mozilla::Forward<P1>(p1),\
+                     mozilla::Forward<P2>(p2),\
+                     mozilla::Forward<P3>(p3),\
+                     mozilla::Forward<P4>(p4),\
+                     mozilla::Forward<P5>(p5),\
+                     mozilla::Forward<P6>(p6),\
+                     mozilla::Forward<P7>(p7),\
+                     mozilla::Forward<P8>(p8),\
+                     mozilla::Forward<P9>(p9),\
+                     mozilla::Forward<P10>(p10),\
+                     mozilla::Forward<P11>(p11),\
+                     mozilla::Forward<P12>(p12)))\
+    }\
+
 JS_DECLARE_NEW_METHODS(js_new, js_malloc, static MOZ_ALWAYS_INLINE)
 
 template <class T>
diff --git a/js/src/assembler/jit/ExecutableAllocator.h b/js/src/assembler/jit/ExecutableAllocator.h
index 16de139cf21f..7ec50d3570a9 100644
--- a/js/src/assembler/jit/ExecutableAllocator.h
+++ b/js/src/assembler/jit/ExecutableAllocator.h
@@ -145,7 +145,7 @@ public:
             MOZ_ASSERT(m_otherCodeBytes < m_allocation.size);
             break;
           default:
-            MOZ_CRASH("bad code kind");
+            MOZ_ASSUME_UNREACHABLE("bad code kind");
         }
 
         release();
@@ -180,7 +180,7 @@ private:
           case BASELINE_CODE: m_baselineCodeBytes += n;        break;
           case REGEXP_CODE:   m_regexpCodeBytes   += n;        break;
           case OTHER_CODE:    m_otherCodeBytes    += n;        break;
-          default:            MOZ_CRASH("bad code kind");
+          default:            MOZ_ASSUME_UNREACHABLE("bad code kind");
         }
         return result;
     }
diff --git a/js/src/assembler/wtf/Assertions.h b/js/src/assembler/wtf/Assertions.h
index 776832b67329..d8158bfc95f5 100644
--- a/js/src/assembler/wtf/Assertions.h
+++ b/js/src/assembler/wtf/Assertions.h
@@ -44,8 +44,8 @@
     (void)variable; \
     ASSERT(assertion); \
 } while (0)
-#define ASSERT_NOT_REACHED() MOZ_CRASH("WTF: ASSERT_NOT_REACHED")
-#define CRASH() MOZ_CRASH("WTF: CRASH")
+#define ASSERT_NOT_REACHED() MOZ_ASSUME_UNREACHABLE("wtf/Assertions.h")
+#define CRASH() MOZ_CRASH()
 #define COMPILE_ASSERT(exp, name) static_assert(exp, #name)
 
 #endif /* assembler_wtf_Assertions_h */
diff --git a/js/src/builtin/Object.cpp b/js/src/builtin/Object.cpp
index 9a3e2043f3d5..b0fd0ba13ec4 100644
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -277,7 +277,7 @@ js::ObjectToSource(JSContext *cx, HandleObject obj)
             if (gsop[j]) {
                 if (!buf.append(gsop[j]) || !buf.append(' '))
                     return nullptr;
-            } 
+            }
             if (JSID_IS_SYMBOL(id) && !buf.append('['))
                 return nullptr;
             if (!buf.append(idstr))
@@ -1226,3 +1226,13 @@ const JSFunctionSpec js::object_static_methods[] = {
     JS_FN("isSealed",                  obj_isSealed,                1,0),
     JS_FS_END
 };
+
+/*
+ * For Object, self-hosted functions have to be done at a different
+ * time, after the intrinsic holder has been set, so we put them
+ * in a different array.
+ */
+const JSFunctionSpec js::object_static_selfhosted_methods[] = {
+    JS_FS_END
+};
+
diff --git a/js/src/builtin/Object.h b/js/src/builtin/Object.h
index 6360220510d3..7854b2034f75 100644
--- a/js/src/builtin/Object.h
+++ b/js/src/builtin/Object.h
@@ -16,6 +16,7 @@ namespace js {
 extern const JSFunctionSpec object_methods[];
 extern const JSPropertySpec object_properties[];
 extern const JSFunctionSpec object_static_methods[];
+extern const JSFunctionSpec object_static_selfhosted_methods[];
 
 // Object constructor native. Exposed only so the JIT can know its address.
 bool
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 4b754a34d1dc..b0e1bebf5fba 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -13,6 +13,7 @@
 #include "mozilla/DebugOnly.h"
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/PodOperations.h"
+#include "mozilla/UniquePtr.h"
 
 #include <string.h>
 
@@ -46,6 +47,7 @@ using namespace js::frontend;
 using mozilla::DebugOnly;
 using mozilla::NumberIsInt32;
 using mozilla::PodCopy;
+using mozilla::UniquePtr;
 
 static bool
 SetSrcNoteOffset(ExclusiveContext *cx, BytecodeEmitter *bce, unsigned index, unsigned which, ptrdiff_t offset);
@@ -2551,7 +2553,7 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     /* Switch bytecodes run from here till end of final case. */
     uint32_t caseCount = pn2->pn_count;
     uint32_t tableLength = 0;
-    ScopedJSFreePtr<ParseNode*> table(nullptr);
+    UniquePtr<ParseNode*[], JS::FreePolicy> table(nullptr);
 
     if (caseCount > JS_BIT(16)) {
         bce->parser->tokenStream.reportError(JSMSG_TOO_MANY_CASES);
@@ -2746,10 +2748,10 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
         /*
          * Use malloc to avoid arena bloat for programs with many switches.
-         * ScopedJSFreePtr takes care of freeing it on exit.
+         * UniquePtr takes care of freeing it on exit.
          */
         if (tableLength != 0) {
-            table = cx->pod_calloc<ParseNode*>(tableLength);
+            table = cx->make_zeroed_pod_array<ParseNode*>(tableLength);
             if (!table)
                 return false;
             for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
index f74207495e06..94caa4235385 100644
--- a/js/src/frontend/TokenStream.cpp
+++ b/js/src/frontend/TokenStream.cpp
@@ -654,11 +654,13 @@ TokenStream::reportCompileErrorNumberVA(uint32_t offset, unsigned flags, unsigne
     }
 
     // If we have no location information, try to get one from the caller.
+    bool callerFilename = false;
     if (offset != NoOffset && !err.report.filename && cx->isJSContext()) {
         NonBuiltinFrameIter iter(cx->asJSContext(),
                                  FrameIter::ALL_CONTEXTS, FrameIter::GO_THROUGH_SAVED,
                                  cx->compartment()->principals);
         if (!iter.done() && iter.scriptFilename()) {
+            callerFilename = true;
             err.report.filename = iter.scriptFilename();
             err.report.lineno = iter.computeLine(&err.report.column);
         }
@@ -680,7 +682,7 @@ TokenStream::reportCompileErrorNumberVA(uint32_t offset, unsigned flags, unsigne
     // So we don't even try, leaving report.linebuf and friends zeroed.  This
     // means that any error involving a multi-line token (e.g. an unterminated
     // multi-line string literal) won't have a context printed.
-    if (offset != NoOffset && err.report.lineno == lineno) {
+    if (offset != NoOffset && err.report.lineno == lineno && !callerFilename) {
         const jschar *tokenStart = userbuf.base() + offset;
 
         // We show only a portion (a "window") of the line around the erroneous
diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
index 895188e3869c..cbd001dc723b 100644
--- a/js/src/gc/GCRuntime.h
+++ b/js/src/gc/GCRuntime.h
@@ -700,6 +700,12 @@ class GCRuntime
 
     GCHelperState helperState;
 
+    /*
+     * During incremental sweeping, this field temporarily holds the arenas of
+     * the current AllocKind being swept in order of increasing free space.
+     */
+    SortedArenaList incrementalSweepList;
+
     ConservativeGCData conservativeGC;
 
     friend class js::GCHelperState;
diff --git a/js/src/gc/Heap.h b/js/src/gc/Heap.h
index 1c1087cec734..b6e664f0da6e 100644
--- a/js/src/gc/Heap.h
+++ b/js/src/gc/Heap.h
@@ -39,6 +39,7 @@ namespace gc {
 
 struct Arena;
 class ArenaList;
+class SortedArenaList;
 struct ArenaHeader;
 struct Chunk;
 
@@ -597,7 +598,7 @@ struct Arena
     void setAsFullyUnused(AllocKind thingKind);
 
     template <typename T>
-    bool finalize(FreeOp *fop, AllocKind thingKind, size_t thingSize);
+    size_t finalize(FreeOp *fop, AllocKind thingKind, size_t thingSize);
 };
 
 static_assert(sizeof(Arena) == ArenaSize, "The hardcoded arena size must match the struct size.");
@@ -828,7 +829,8 @@ struct Chunk
     ArenaHeader *allocateArena(JS::Zone *zone, AllocKind kind);
 
     void releaseArena(ArenaHeader *aheader);
-    void recycleArena(ArenaHeader *aheader, ArenaList &dest, AllocKind thingKind);
+    void recycleArena(ArenaHeader *aheader, SortedArenaList &dest, AllocKind thingKind,
+                      size_t thingsPerArena);
 
     static Chunk *allocate(JSRuntime *rt);
 
diff --git a/js/src/jit-test/tests/basic/bug1024786.js b/js/src/jit-test/tests/basic/bug1024786.js
new file mode 100644
index 000000000000..95add49195e8
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1024786.js
@@ -0,0 +1,65 @@
+//|jit-test| error: SyntaxError
+
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+(function(){});
+evaluate("function f(){\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",({
+    fileName: null,
+    lineNumber: 42,
+    compileAndGo: 9
+}))
diff --git a/js/src/jit-test/tests/profiler/test-bug1026485.js b/js/src/jit-test/tests/profiler/test-bug1026485.js
new file mode 100644
index 000000000000..22865f526562
--- /dev/null
+++ b/js/src/jit-test/tests/profiler/test-bug1026485.js
@@ -0,0 +1,14 @@
+
+function TestCase(n, d, e, a)
+  TestCase.prototype.dump = function () {}
+enableSPSProfiling();
+new TestCase(typeof Number(new Number()));
+new TestCase(typeof Number(new Number(Number.NaN)));
+test();
+function test() {
+    try {
+        test();
+    } catch (e) {
+        new TestCase();
+    }
+}
diff --git a/js/src/jit/AsmJS.cpp b/js/src/jit/AsmJS.cpp
index d00b136837dc..868984a118b2 100644
--- a/js/src/jit/AsmJS.cpp
+++ b/js/src/jit/AsmJS.cpp
@@ -457,7 +457,7 @@ class Type
           case Void:
             return MIRType_None;
         }
-        MOZ_CRASH("Invalid Type");
+        MOZ_ASSUME_UNREACHABLE("Invalid Type");
     }
 
     const char *toChars() const {
@@ -474,7 +474,7 @@ class Type
           case Intish:      return "intish";
           case Void:        return "void";
         }
-        MOZ_CRASH("Invalid Type");
+        MOZ_ASSUME_UNREACHABLE("Invalid Type");
     }
 };
 
@@ -518,7 +518,7 @@ class RetType
           case Float: // will be converted to a Double
           case Double: return AsmJSModule::Return_Double;
         }
-        MOZ_CRASH("Unexpected return type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected return type");
     }
     MIRType toMIRType() const {
         switch (which_) {
@@ -527,7 +527,7 @@ class RetType
           case Double: return MIRType_Double;
           case Float: return MIRType_Float32;
         }
-        MOZ_CRASH("Unexpected return type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected return type");
     }
     bool operator==(RetType rhs) const { return which_ == rhs.which_; }
     bool operator!=(RetType rhs) const { return which_ != rhs.which_; }
@@ -592,7 +592,7 @@ class VarType
           case Double:  return MIRType_Double;
           case Float:   return MIRType_Float32;
         }
-        MOZ_CRASH("VarType can only be Int, Double or Float");
+        MOZ_ASSUME_UNREACHABLE("VarType can only be Int, Double or Float");
     }
     AsmJSCoercion toCoercion() const {
         switch(which_) {
@@ -600,7 +600,7 @@ class VarType
           case Double:  return AsmJS_ToNumber;
           case Float:   return AsmJS_FRound;
         }
-        MOZ_CRASH("VarType can only be Int, Double or Float");
+        MOZ_ASSUME_UNREACHABLE("VarType can only be Int, Double or Float");
     }
     static VarType FromCheckedType(Type type) {
         JS_ASSERT(type.isInt() || type.isMaybeDouble() || type.isFloatish());
@@ -626,7 +626,7 @@ operator<=(Type lhs, VarType rhs)
       case VarType::Double: return lhs.isDouble();
       case VarType::Float:  return lhs.isFloat();
     }
-    MOZ_CRASH("Unexpected rhs type");
+    MOZ_ASSUME_UNREACHABLE("Unexpected rhs type");
 }
 
 /*****************************************************************************/
@@ -738,7 +738,7 @@ TypedArrayLoadType(Scalar::Type viewType)
         return Type::MaybeDouble;
       default:;
     }
-    MOZ_CRASH("Unexpected array type");
+    MOZ_ASSUME_UNREACHABLE("Unexpected array type");
 }
 
 enum NeedsBoundsCheck {
@@ -1634,7 +1634,7 @@ class NumLit
             return VarType::Float;
           case NumLit::OutOfRangeInt:;
         }
-        MOZ_CRASH("Unexpected NumLit type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected NumLit type");
     }
 };
 
@@ -1773,7 +1773,7 @@ IsLiteralInt(ModuleCompiler &m, ParseNode *pn, uint32_t *u32)
         return false;
     }
 
-    MOZ_CRASH("Bad literal type");
+    MOZ_ASSUME_UNREACHABLE("Bad literal type");
 }
 
 /*****************************************************************************/
@@ -3041,7 +3041,7 @@ CheckGlobalDotImport(ModuleCompiler &m, PropertyName *varName, ParseNode *initNo
           default:
             break;
         }
-        MOZ_CRASH("unexpected or uninitialized math builtin type");
+        MOZ_ASSUME_UNREACHABLE("unexpected or uninitialized math builtin type");
     }
 
     if (IsUseOfName(base, m.module().globalArgumentName())) {
@@ -3509,7 +3509,7 @@ CheckStoreArray(FunctionCompiler &f, ParseNode *lhs, ParseNode *rhs, MDefinition
             return f.failf(lhs, "%s is not a subtype of float? or double?", rhsType.toChars());
         break;
       default:
-        MOZ_CRASH("Unexpected view type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected view type");
     }
 
     f.storeHeap(viewType, pointerDef, rhsDef, needsBoundsCheck);
@@ -3979,7 +3979,7 @@ CheckMathFRound(FunctionCompiler &f, ParseNode *callNode, RetType retType, MDefi
         return true;
     }
 
-    MOZ_CRASH("return value of fround is ignored");
+    MOZ_ASSUME_UNREACHABLE("return value of fround is ignored");
 }
 
 static bool
@@ -4023,7 +4023,7 @@ CheckMathBuiltinCall(FunctionCompiler &f, ParseNode *callNode, AsmJSMathBuiltinF
       case AsmJSMathBuiltin_log:    arity = 1; doubleCallee = AsmJSImm_LogD;   floatCallee = AsmJSImm_Invalid; break;
       case AsmJSMathBuiltin_pow:    arity = 2; doubleCallee = AsmJSImm_PowD;   floatCallee = AsmJSImm_Invalid; break;
       case AsmJSMathBuiltin_atan2:  arity = 2; doubleCallee = AsmJSImm_ATan2D; floatCallee = AsmJSImm_Invalid; break;
-      default: MOZ_CRASH("unexpected mathBuiltin function");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected mathBuiltin function");
     }
 
     if (retType == RetType::Float && floatCallee == AsmJSImm_Invalid)
@@ -4311,7 +4311,7 @@ IsValidIntMultiplyConstant(ModuleCompiler &m, ParseNode *expr)
         return false;
     }
 
-    MOZ_CRASH("Bad literal");
+    MOZ_ASSUME_UNREACHABLE("Bad literal");
 }
 
 static bool
@@ -4527,7 +4527,7 @@ CheckBitwise(FunctionCompiler &f, ParseNode *bitwise, MDefinition **def, Type *t
       case PNK_LSH:    identityElement = 0;  onlyOnRight = true;  *type = Type::Signed;   break;
       case PNK_RSH:    identityElement = 0;  onlyOnRight = true;  *type = Type::Signed;   break;
       case PNK_URSH:   identityElement = 0;  onlyOnRight = true;  *type = Type::Unsigned; break;
-      default: MOZ_CRASH("not a bitwise op");
+      default: MOZ_ASSUME_UNREACHABLE("not a bitwise op");
     }
 
     uint32_t i;
@@ -4574,7 +4574,7 @@ CheckBitwise(FunctionCompiler &f, ParseNode *bitwise, MDefinition **def, Type *t
       case PNK_LSH:    *def = f.bitwise<MLsh>(lhsDef, rhsDef); break;
       case PNK_RSH:    *def = f.bitwise<MRsh>(lhsDef, rhsDef); break;
       case PNK_URSH:   *def = f.bitwise<MUrsh>(lhsDef, rhsDef); break;
-      default: MOZ_CRASH("not a bitwise op");
+      default: MOZ_ASSUME_UNREACHABLE("not a bitwise op");
     }
 
     return true;
@@ -6182,6 +6182,7 @@ FillArgumentArray(ModuleCompiler &m, const VarTypeVector &argTypes,
                 masm.canonicalizeDouble(ScratchDoubleReg);
                 masm.storeDouble(ScratchDoubleReg, dstAddr);
             }
+            break;
         }
     }
 }
@@ -6284,7 +6285,8 @@ GenerateFFIInterpreterExit(ModuleCompiler &m, const ModuleCompiler::ExitDescript
         masm.loadDouble(argv, ReturnDoubleReg);
         break;
       case RetType::Float:
-        MOZ_CRASH("Float32 shouldn't be returned from a FFI");
+        MOZ_ASSUME_UNREACHABLE("Float32 shouldn't be returned from a FFI");
+        break;
     }
 
     // Note: the caller is IonMonkey code which means there are no non-volatile
@@ -6508,7 +6510,8 @@ GenerateFFIIonExit(ModuleCompiler &m, const ModuleCompiler::ExitDescriptor &exit
         masm.convertValueToDouble(JSReturnOperand, ReturnDoubleReg, &oolConvert);
         break;
       case RetType::Float:
-        MOZ_CRASH("Float shouldn't be returned from a FFI");
+        MOZ_ASSUME_UNREACHABLE("Float shouldn't be returned from a FFI");
+        break;
     }
 
     Label done;
@@ -6576,7 +6579,7 @@ GenerateFFIIonExit(ModuleCompiler &m, const ModuleCompiler::ExitDescriptor &exit
             masm.loadDouble(Address(StackPointer, offsetToArgv), ReturnDoubleReg);
             break;
           default:
-            MOZ_CRASH("Unsupported convert type");
+            MOZ_ASSUME_UNREACHABLE("Unsupported convert type");
         }
 
         masm.jump(&done);
diff --git a/js/src/jit/AsmJSModule.cpp b/js/src/jit/AsmJSModule.cpp
index d9a1c5445b51..4f3034828681 100644
--- a/js/src/jit/AsmJSModule.cpp
+++ b/js/src/jit/AsmJSModule.cpp
@@ -576,7 +576,8 @@ AddressOf(AsmJSImmKind kind, ExclusiveContext *cx)
         break;
     }
 
-    MOZ_CRASH("Bad AsmJSImmKind");
+    MOZ_ASSUME_UNREACHABLE("Bad AsmJSImmKind");
+    return nullptr;
 }
 
 void
@@ -1272,10 +1273,10 @@ AsmJSModule::protectCode(JSRuntime *rt) const
 #if defined(XP_WIN)
     DWORD oldProtect;
     if (!VirtualProtect(codeBase(), functionBytes(), PAGE_NOACCESS, &oldProtect))
-        MOZ_CRASH("PAGE_NOACESS failed");
+        MOZ_CRASH();
 #else  // assume Unix
     if (mprotect(codeBase(), functionBytes(), PROT_NONE))
-        MOZ_CRASH("PROT_NONE");
+        MOZ_CRASH();
 #endif
 }
 
@@ -1293,10 +1294,10 @@ AsmJSModule::unprotectCode(JSRuntime *rt) const
 #if defined(XP_WIN)
     DWORD oldProtect;
     if (!VirtualProtect(codeBase(), functionBytes(), PAGE_EXECUTE_READWRITE, &oldProtect))
-        MOZ_CRASH("PAGE_EXECUTE_READWRITE failed");
+        MOZ_CRASH();
 #else  // assume Unix
     if (mprotect(codeBase(), functionBytes(), PROT_READ | PROT_WRITE | PROT_EXEC))
-        MOZ_CRASH("PROT_READ | PROT_WRITE | PROT_EXEC failed");
+        MOZ_CRASH();
 #endif
 }
 
diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index 2fca6e0e178d..da81fb5b5792 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -1267,7 +1267,7 @@ BacktrackingAllocator::populateSafepoints()
                     break;
 #endif
                   default:
-                    MOZ_CRASH("Bad register type");
+                    MOZ_ASSUME_UNREACHABLE("Bad register type");
                 }
             }
         }
@@ -1506,7 +1506,7 @@ BacktrackingAllocator::computeSpillWeight(const LiveInterval *interval)
 
           default:
             // Note: RECOVERED_INPUT will not appear in UsePositionIterator.
-            MOZ_CRASH("Bad use");
+            MOZ_ASSUME_UNREACHABLE("Bad use");
         }
     }
 
diff --git a/js/src/jit/Bailouts.cpp b/js/src/jit/Bailouts.cpp
index 7d8ca6a21c45..17ba5f176f13 100644
--- a/js/src/jit/Bailouts.cpp
+++ b/js/src/jit/Bailouts.cpp
@@ -110,9 +110,14 @@ jit::Bailout(BailoutStack *sp, BaselineBailoutInfo **bailoutInfo)
         //
         // We call ExitScript here to ensure that if the ionScript had SPS
         // instrumentation, then the SPS entry for it is popped.
+        //
+        // However, if the bailout was during argument check, then a
+        // pseudostack frame would not have been pushed in the first
+        // place, so don't pop anything in that case.
+        bool popSPSFrame = iter.ionScript()->hasSPSInstrumentation() &&
+                           (SnapshotIterator(iter).bailoutKind() != Bailout_ArgumentCheck);
         JSScript *script = iter.script();
-        probes::ExitScript(cx, script, script->functionNonDelazifying(),
-                           iter.ionScript()->hasSPSInstrumentation());
+        probes::ExitScript(cx, script, script->functionNonDelazifying(), popSPSFrame);
 
         EnsureExitFrame(iter.jsFrame());
     }
@@ -161,9 +166,14 @@ jit::InvalidationBailout(InvalidationBailoutStack *sp, size_t *frameSizeOut,
         //
         // We call ExitScript here to ensure that if the ionScript had SPS
         // instrumentation, then the SPS entry for it is popped.
+        //
+        // However, if the bailout was during argument check, then a
+        // pseudostack frame would not have been pushed in the first
+        // place, so don't pop anything in that case.
+        bool popSPSFrame = iter.ionScript()->hasSPSInstrumentation() &&
+                           (SnapshotIterator(iter).bailoutKind() != Bailout_ArgumentCheck);
         JSScript *script = iter.script();
-        probes::ExitScript(cx, script, script->functionNonDelazifying(),
-                           iter.ionScript()->hasSPSInstrumentation());
+        probes::ExitScript(cx, script, script->functionNonDelazifying(), popSPSFrame);
 
         IonJSFrameLayout *frame = iter.jsFrame();
         IonSpew(IonSpew_Invalidate, "Bailout failed (%s): converting to exit frame",
diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index c0a5e0c480cd..885b3120d703 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -1724,7 +1724,7 @@ jit::FinishBailoutToBaseline(BaselineBailoutInfo *bailoutInfo)
         // baseline frame.
         return false;
       default:
-        MOZ_CRASH("Unknown bailout kind!");
+        MOZ_ASSUME_UNREACHABLE("Unknown bailout kind!");
     }
 
     if (!CheckFrequentBailouts(cx, outerScript))
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index a9f7860cc2ff..7d06fcd23a12 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -1361,7 +1361,7 @@ BaselineCompiler::storeValue(const StackValue *source, const Address &dest,
         masm.storeValue(scratch, dest);
         break;
       default:
-        MOZ_CRASH("Invalid kind");
+        MOZ_ASSUME_UNREACHABLE("Invalid kind");
     }
 }
 
diff --git a/js/src/jit/BaselineDebugModeOSR.cpp b/js/src/jit/BaselineDebugModeOSR.cpp
index c4c4fb1b4110..a7d129967d9b 100644
--- a/js/src/jit/BaselineDebugModeOSR.cpp
+++ b/js/src/jit/BaselineDebugModeOSR.cpp
@@ -251,7 +251,7 @@ ICEntryKindToString(ICEntry::Kind kind)
       case ICEntry::Kind_DebugEpilogue:
         return "debug epilogue";
       default:
-        MOZ_CRASH("bad ICEntry kind");
+        MOZ_ASSUME_UNREACHABLE("bad ICEntry kind");
     }
 }
 
@@ -610,7 +610,7 @@ CloneOldBaselineStub(JSContext *cx, DebugModeOSREntryVector &entries, size_t ent
 #undef CASE_KIND
 
       default:
-        MOZ_CRASH("Bad stub kind");
+        MOZ_ASSUME_UNREACHABLE("Bad stub kind");
     }
 
     if (!entry.newStub)
@@ -707,7 +707,7 @@ BaselineDebugModeOSRInfo::popValueInto(PCMappingSlotInfo::SlotLocation loc, Valu
       case PCMappingSlotInfo::SlotIgnore:
         break;
       default:
-        MOZ_CRASH("Bad slot location");
+        MOZ_ASSUME_UNREACHABLE("Bad slot location");
     }
 
     stackAdjust++;
diff --git a/js/src/jit/BaselineFrameInfo.cpp b/js/src/jit/BaselineFrameInfo.cpp
index c00ff7d56811..ee2918e48134 100644
--- a/js/src/jit/BaselineFrameInfo.cpp
+++ b/js/src/jit/BaselineFrameInfo.cpp
@@ -46,7 +46,7 @@ FrameInfo::sync(StackValue *val)
         masm.pushValue(val->constant());
         break;
       default:
-        MOZ_CRASH("Invalid kind");
+        MOZ_ASSUME_UNREACHABLE("Invalid kind");
     }
 
     val->setStack();
@@ -102,7 +102,7 @@ FrameInfo::popValue(ValueOperand dest)
         masm.moveValue(val->reg(), dest);
         break;
       default:
-        MOZ_CRASH("Invalid kind");
+        MOZ_ASSUME_UNREACHABLE("Invalid kind");
     }
 
     // masm.popValue already adjusted the stack pointer, don't do it twice.
@@ -138,7 +138,7 @@ FrameInfo::popRegsAndSync(uint32_t uses)
         break;
       }
       default:
-        MOZ_CRASH("Invalid uses");
+        MOZ_ASSUME_UNREACHABLE("Invalid uses");
     }
 }
 
@@ -175,7 +175,7 @@ FrameInfo::assertValidState(const BytecodeInfo &info)
                 JS_ASSERT(!usedR1);
                 usedR1 = true;
             } else {
-                MOZ_CRASH("Invalid register");
+                MOZ_ASSUME_UNREACHABLE("Invalid register");
             }
         }
     }
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 510eb97efb67..1d5bdd6ecf28 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -253,7 +253,7 @@ ICStub::trace(JSTracer *trc)
           case 2: setElemStub->toImpl<2>()->traceShapes(trc); break;
           case 3: setElemStub->toImpl<3>()->traceShapes(trc); break;
           case 4: setElemStub->toImpl<4>()->traceShapes(trc); break;
-          default: MOZ_CRASH("Invalid proto stub.");
+          default: MOZ_ASSUME_UNREACHABLE("Invalid proto stub.");
         }
         break;
       }
@@ -348,7 +348,7 @@ ICStub::trace(JSTracer *trc)
           case 6: propStub->toImpl<6>()->traceShapes(trc); break;
           case 7: propStub->toImpl<7>()->traceShapes(trc); break;
           case 8: propStub->toImpl<8>()->traceShapes(trc); break;
-          default: MOZ_CRASH("Invalid proto stub.");
+          default: MOZ_ASSUME_UNREACHABLE("Invalid proto stub.");
         }
         break;
       }
@@ -415,7 +415,7 @@ ICStub::trace(JSTracer *trc)
           case 2: propStub->toImpl<2>()->traceShapes(trc); break;
           case 3: propStub->toImpl<3>()->traceShapes(trc); break;
           case 4: propStub->toImpl<4>()->traceShapes(trc); break;
-          default: MOZ_CRASH("Invalid proto stub.");
+          default: MOZ_ASSUME_UNREACHABLE("Invalid proto stub.");
         }
         break;
       }
@@ -827,7 +827,7 @@ EnsureCanEnterIon(JSContext *cx, ICUseCount_Fallback *stub, BaselineFrame *frame
     else if (stat == Method_Compiled)
         IonSpew(IonSpew_BaselineOSR, "  Compiled with Ion!");
     else
-        MOZ_CRASH("Invalid MethodStatus!");
+        MOZ_ASSUME_UNREACHABLE("Invalid MethodStatus!");
 
     // Failed to compile.  Reset use count and return.
     if (stat != Method_Compiled) {
@@ -1544,7 +1544,7 @@ DoTypeUpdateFallback(JSContext *cx, BaselineFrame *frame, ICUpdatedStub *stub, H
         break;
       }
       default:
-        MOZ_CRASH("Invalid stub");
+        MOZ_ASSUME_UNREACHABLE("Invalid stub");
     }
 
     return stub->addUpdateStubForValue(cx, script, obj, id, value);
@@ -2590,7 +2590,7 @@ DoBinaryArithFallback(JSContext *cx, BaselineFrame *frame, ICBinaryArith_Fallbac
         break;
       }
       default:
-        MOZ_CRASH("Unhandled baseline arith op");
+        MOZ_ASSUME_UNREACHABLE("Unhandled baseline arith op");
     }
 
     // Check if debug mode toggling made the stub invalid.
@@ -2914,7 +2914,7 @@ ICBinaryArith_Double::Compiler::generateStubCode(MacroAssembler &masm)
         JS_ASSERT(ReturnDoubleReg == FloatReg0);
         break;
       default:
-        MOZ_CRASH("Unexpected op");
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 
     masm.boxDouble(FloatReg0, R0);
@@ -2992,7 +2992,7 @@ ICBinaryArith_BooleanWithInt32::Compiler::generateStubCode(MacroAssembler &masm)
         break;
       }
       default:
-       MOZ_CRASH("Unhandled op for BinaryArith_BooleanWithInt32.");
+       MOZ_ASSUME_UNREACHABLE("Unhandled op for BinaryArith_BooleanWithInt32.");
     }
 
     // Failure case - jump to next stub
@@ -3054,7 +3054,7 @@ ICBinaryArith_DoubleWithInt32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.andPtr(intReg, intReg2);
         break;
       default:
-       MOZ_CRASH("Unhandled op for BinaryArith_DoubleWithInt32.");
+       MOZ_ASSUME_UNREACHABLE("Unhandled op for BinaryArith_DoubleWithInt32.");
     }
     masm.tagValue(JSVAL_TYPE_INT32, intReg2, R0);
     EmitReturnFromIC(masm);
@@ -3098,7 +3098,7 @@ DoUnaryArithFallback(JSContext *cx, BaselineFrame *frame, ICUnaryArith_Fallback
             return false;
         break;
       default:
-        MOZ_CRASH("Unexpected op");
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 
     // Check if debug mode toggling made the stub invalid.
@@ -3736,7 +3736,7 @@ RemoveExistingGetElemNativeStubs(JSContext *cx, ICGetElem_Fallback *stub, Handle
 
         // Should never get here, because this means a matching stub exists, and if
         // a matching stub exists, this procedure should never have been called.
-        MOZ_CRASH("Procedure should never have been called.");
+        MOZ_ASSUME_UNREACHABLE("Procedure should never have been called.");
     }
 }
 
@@ -5342,7 +5342,7 @@ ICSetElemDenseAddCompiler::getStub(ICStubSpace *space)
       case 2: stub = getStubSpecific<2>(space, &shapes); break;
       case 3: stub = getStubSpecific<3>(space, &shapes); break;
       case 4: stub = getStubSpecific<4>(space, &shapes); break;
-      default: MOZ_CRASH("ProtoChainDepth too high.");
+      default: MOZ_ASSUME_UNREACHABLE("ProtoChainDepth too high.");
     }
     if (!stub || !stub->initUpdatingChain(cx, space))
         return nullptr;
@@ -6695,7 +6695,7 @@ ICGetProp_Primitive::Compiler::generateStubCode(MacroAssembler &masm)
         masm.branchTestBoolean(Assembler::NotEqual, R0, &failure);
         break;
       default:
-        MOZ_CRASH("unexpected type");
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 
     GeneralRegisterSet regs(availableGeneralRegs(1));
@@ -6850,7 +6850,7 @@ ICGetPropNativeDoesNotExistCompiler::getStub(ICStubSpace *space)
       case 6: stub = getStubSpecific<6>(space, &shapes); break;
       case 7: stub = getStubSpecific<7>(space, &shapes); break;
       case 8: stub = getStubSpecific<8>(space, &shapes); break;
-      default: MOZ_CRASH("ProtoChainDepth too high.");
+      default: MOZ_ASSUME_UNREACHABLE("ProtoChainDepth too high.");
     }
     if (!stub)
         return nullptr;
@@ -7729,7 +7729,7 @@ ICSetPropNativeAddCompiler::getStub(ICStubSpace *space)
       case 2: stub = getStubSpecific<2>(space, &shapes); break;
       case 3: stub = getStubSpecific<3>(space, &shapes); break;
       case 4: stub = getStubSpecific<4>(space, &shapes); break;
-      default: MOZ_CRASH("ProtoChainDepth too high.");
+      default: MOZ_ASSUME_UNREACHABLE("ProtoChainDepth too high.");
     }
     if (!stub || !stub->initUpdatingChain(cx, space))
         return nullptr;
@@ -10028,7 +10028,7 @@ ICTypeOf_Typed::Compiler::generateStubCode(MacroAssembler &masm)
         break;
 
       default:
-        MOZ_CRASH("Unexpected type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected type");
     }
 
     masm.movePtr(ImmGCPtr(typeString_), R0.scratchReg());
diff --git a/js/src/jit/BaselineIC.h b/js/src/jit/BaselineIC.h
index 3aa120fe105a..52d55e5eeb4c 100644
--- a/js/src/jit/BaselineIC.h
+++ b/js/src/jit/BaselineIC.h
@@ -597,7 +597,7 @@ class ICStub
             IC_STUB_KIND_LIST(DEF_KIND_STR)
 #undef DEF_KIND_STR
           default:
-            MOZ_CRASH("Invalid kind.");
+            MOZ_ASSUME_UNREACHABLE("Invalid kind.");
         }
     }
 
@@ -1132,7 +1132,7 @@ class ICStubCompiler
             regs.take(R1);
             break;
           default:
-            MOZ_CRASH("Invalid numInputs");
+            MOZ_ASSUME_UNREACHABLE("Invalid numInputs");
         }
 
         return regs;
@@ -3308,7 +3308,8 @@ class ICGetElemNativeCompiler : public ICStubCompiler
                     getter_, pcOffset_, holder_, holderShape);
         }
 
-        MOZ_CRASH("Invalid kind.");
+        MOZ_ASSUME_UNREACHABLE("Invalid kind.");
+        return nullptr;
     }
 };
 
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
index 5a94ab89af43..6158feb144f4 100644
--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@@ -552,7 +552,7 @@ BaselineScript::icEntryFromPCOffset(uint32_t pcOffset)
         if (icEntry(i).isForOp())
             return icEntry(i);
     }
-    MOZ_CRASH("Invalid PC offset for IC entry.");
+    MOZ_ASSUME_UNREACHABLE("Invalid PC offset for IC entry.");
 }
 
 ICEntry &
@@ -695,7 +695,7 @@ BaselineScript::nativeCodeForPC(JSScript *script, jsbytecode *pc, PCMappingSlotI
         curPC += GetBytecodeLength(curPC);
     }
 
-    MOZ_CRASH("Invalid pc");
+    MOZ_ASSUME_UNREACHABLE("Invalid pc");
 }
 
 jsbytecode *
@@ -739,7 +739,7 @@ BaselineScript::pcForReturnOffset(JSScript *script, uint32_t nativeOffset)
         curPC += GetBytecodeLength(curPC);
     }
 
-    MOZ_CRASH("Invalid pc");
+    MOZ_ASSUME_UNREACHABLE("Invalid pc");
 }
 
 jsbytecode *
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 446acc23ec29..aa36ae40e50e 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1552,7 +1552,7 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
           case LDefinition::INT32:   moveType = MoveOp::INT32;   break;
           case LDefinition::FLOAT32: moveType = MoveOp::FLOAT32; break;
           case LDefinition::DOUBLE:  moveType = MoveOp::DOUBLE;  break;
-          default: MOZ_CRASH("Unexpected move type");
+          default: MOZ_ASSUME_UNREACHABLE("Unexpected move type");
         }
 
         if (!resolver.addMove(toMoveOperand(from), toMoveOperand(to), moveType))
@@ -2140,7 +2140,7 @@ CodeGenerator::visitCallNative(LCallNative *call)
         break;
 
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     // Test for failure.
@@ -2386,7 +2386,7 @@ CodeGenerator::visitCallGeneric(LCallGeneric *call)
         break;
 
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     masm.bind(&end);
@@ -2486,7 +2486,7 @@ CodeGenerator::visitCallKnown(LCallKnown *call)
         break;
 
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     masm.bind(&end);
@@ -3669,7 +3669,7 @@ ShouldInitFixedSlots(LInstruction *lir, JSObject *templateObj)
         iter = block->begin();
     }
 
-    MOZ_CRASH("Shouldn't get here");
+    MOZ_ASSUME_UNREACHABLE("Shouldn't get here");
 }
 
 bool
@@ -4551,7 +4551,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
         funptr = JS_FUNC_TO_DATA_PTR(void *, js::math_round_impl);
         break;
       default:
-        MOZ_CRASH("Unknown math function");
+        MOZ_ASSUME_UNREACHABLE("Unknown math function");
     }
 
 #   undef MAYBE_CACHED
@@ -4576,7 +4576,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
       case MMathFunction::Round: funptr = JS_FUNC_TO_DATA_PTR(void *, math_roundf_impl); break;
       case MMathFunction::Ceil:  funptr = JS_FUNC_TO_DATA_PTR(void *, ceilf);            break;
       default:
-        MOZ_CRASH("Unknown or unsupported float32 math function");
+        MOZ_ASSUME_UNREACHABLE("Unknown or unsupported float32 math function");
     }
 
     masm.callWithABI(funptr, MoveOp::FLOAT32);
@@ -4641,7 +4641,7 @@ CodeGenerator::visitBinaryV(LBinaryV *lir)
         return callVM(UrshInfo, lir);
 
       default:
-        MOZ_CRASH("Unexpected binary op");
+        MOZ_ASSUME_UNREACHABLE("Unexpected binary op");
     }
 }
 
@@ -4774,7 +4774,7 @@ CodeGenerator::visitCompareVM(LCompareVM *lir)
         return callVM(GeInfo, lir);
 
       default:
-        MOZ_CRASH("Unexpected compare op");
+        MOZ_ASSUME_UNREACHABLE("Unexpected compare op");
     }
 }
 
@@ -5141,7 +5141,7 @@ ConcatFatInlineString(MacroAssembler &masm, Register lhs, Register rhs, Register
         masm.pop(temp1);
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     // Store length and flags.
@@ -5262,7 +5262,7 @@ JitCompartment::generateStringConcatStub(JSContext *cx, ExecutionMode mode)
         masm.pop(temp1);
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     // Store rope length and flags. temp1 still holds the result of AND'ing the
@@ -6777,7 +6777,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
     if (callTargets.length() > 0)
         ionScript->copyCallTargetEntries(callTargets.begin());
     if (patchableBackedges_.length() > 0)
-        ionScript->copyPatchableBackedges(cx, code, patchableBackedges_.begin());
+        ionScript->copyPatchableBackedges(cx, code, patchableBackedges_.begin(), masm);
 
 #ifdef JS_TRACE_LOGGING
     TraceLogger *logger = TraceLoggerForMainThread(cx->runtime());
@@ -6809,7 +6809,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
         // turn on barriers.
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     // Attach any generated script counts to the script.
@@ -7087,7 +7087,7 @@ CodeGenerator::addGetPropertyCache(LInstruction *ins, RegisterSet liveRegs, Regi
         return addCache(ins, allocateCache(cache));
       }
       default:
-        MOZ_CRASH("Bad execution mode");
+        MOZ_ASSUME_UNREACHABLE("Bad execution mode");
     }
 }
 
@@ -7108,7 +7108,7 @@ CodeGenerator::addSetPropertyCache(LInstruction *ins, RegisterSet liveRegs, Regi
           return addCache(ins, allocateCache(cache));
       }
       default:
-        MOZ_CRASH("Bad execution mode");
+        MOZ_ASSUME_UNREACHABLE("Bad execution mode");
     }
 }
 
@@ -7133,7 +7133,7 @@ CodeGenerator::addSetElementCache(LInstruction *ins, Register obj, Register unbo
         return addCache(ins, allocateCache(cache));
       }
       default:
-        MOZ_CRASH("Bad execution mode");
+        MOZ_ASSUME_UNREACHABLE("Bad execution mode");
     }
 }
 
@@ -7231,7 +7231,7 @@ CodeGenerator::addGetElementCache(LInstruction *ins, Register obj, ConstantOrReg
         return addCache(ins, allocateCache(cache));
       }
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 }
 
@@ -7610,7 +7610,7 @@ CodeGenerator::visitBitOpV(LBitOpV *lir)
       default:
         break;
     }
-    MOZ_CRASH("unexpected bitop");
+    MOZ_ASSUME_UNREACHABLE("unexpected bitop");
 }
 
 class OutOfLineTypeOfV : public OutOfLineCodeBase<CodeGenerator>
@@ -8458,7 +8458,7 @@ CodeGenerator::visitProfilerStackOp(LProfilerStackOp *lir)
             return true;
 
         default:
-            MOZ_CRASH("invalid LProfilerStackOp type");
+            MOZ_ASSUME_UNREACHABLE("invalid LProfilerStackOp type");
     }
 }
 
diff --git a/js/src/jit/CompactBuffer.h b/js/src/jit/CompactBuffer.h
index f94ca4bcf5cd..9c9e07158be3 100644
--- a/js/src/jit/CompactBuffer.h
+++ b/js/src/jit/CompactBuffer.h
@@ -43,7 +43,7 @@ class CompactBufferReader
             if (!(byte & 1))
                 return val;
         }
-        MOZ_CRASH("unreachable");
+        MOZ_ASSUME_UNREACHABLE("unreachable");
     }
 
   public:
diff --git a/js/src/jit/ExecutionMode-inl.h b/js/src/jit/ExecutionMode-inl.h
index db88b1b5f6a7..c475e01d6ea6 100644
--- a/js/src/jit/ExecutionMode-inl.h
+++ b/js/src/jit/ExecutionMode-inl.h
@@ -24,7 +24,7 @@ HasIonScript(JSScript *script, ExecutionMode cmode)
       case ParallelExecution: return script->hasParallelIonScript();
       default:;
     }
-    MOZ_CRASH("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline IonScript *
@@ -35,7 +35,7 @@ GetIonScript(JSScript *script, ExecutionMode cmode)
       case ParallelExecution: return script->maybeParallelIonScript();
       default:;
     }
-    MOZ_CRASH("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline void
@@ -46,7 +46,7 @@ SetIonScript(JSScript *script, ExecutionMode cmode, IonScript *ionScript)
       case ParallelExecution: script->setParallelIonScript(ionScript); return;
       default:;
     }
-    MOZ_CRASH("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline size_t
@@ -57,7 +57,7 @@ OffsetOfIonInJSScript(ExecutionMode cmode)
       case ParallelExecution: return JSScript::offsetOfParallelIonScript();
       default:;
     }
-    MOZ_CRASH("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline bool
@@ -70,7 +70,7 @@ CanIonCompile(JSScript *script, ExecutionMode cmode)
       case ArgumentsUsageAnalysis: return true;
       default:;
     }
-    MOZ_CRASH("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
     return false;
 }
 
@@ -82,7 +82,7 @@ CompilingOffThread(JSScript *script, ExecutionMode cmode)
       case ParallelExecution: return script->isParallelIonCompilingOffThread();
       default:;
     }
-    MOZ_CRASH("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline bool
@@ -93,7 +93,7 @@ CompilingOffThread(HandleScript script, ExecutionMode cmode)
       case ParallelExecution: return script->isParallelIonCompilingOffThread();
       default:;
     }
-    MOZ_CRASH("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 } // namespace jit
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index b5c3e79b06b3..a8377118aa35 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -468,7 +468,7 @@ jit::RequestInterruptForIonCode(JSRuntime *rt, JSRuntime::InterruptMode mode)
         break;
 
       default:
-        MOZ_CRASH("Bad interrupt mode");
+        MOZ_ASSUME_UNREACHABLE("Bad interrupt mode");
     }
 }
 
@@ -1031,15 +1031,21 @@ IonScript::copyCallTargetEntries(JSScript **callTargets)
 
 void
 IonScript::copyPatchableBackedges(JSContext *cx, JitCode *code,
-                                  PatchableBackedgeInfo *backedges)
+                                  PatchableBackedgeInfo *backedges,
+                                  MacroAssembler &masm)
 {
     for (size_t i = 0; i < backedgeEntries_; i++) {
-        const PatchableBackedgeInfo &info = backedges[i];
+        PatchableBackedgeInfo &info = backedges[i];
         PatchableBackedge *patchableBackedge = &backedgeList()[i];
 
+        // Convert to actual offsets for the benefit of the ARM backend.
+        info.backedge.fixup(&masm);
+        uint32_t loopHeaderOffset = masm.actualOffset(info.loopHeader->offset());
+        uint32_t interruptCheckOffset = masm.actualOffset(info.interruptCheck->offset());
+
         CodeLocationJump backedge(code, info.backedge);
-        CodeLocationLabel loopHeader(code, CodeOffsetLabel(info.loopHeader->offset()));
-        CodeLocationLabel interruptCheck(code, CodeOffsetLabel(info.interruptCheck->offset()));
+        CodeLocationLabel loopHeader(code, CodeOffsetLabel(loopHeaderOffset));
+        CodeLocationLabel interruptCheck(code, CodeOffsetLabel(interruptCheckOffset));
         new(patchableBackedge) PatchableBackedge(backedge, loopHeader, interruptCheck);
 
         // Point the backedge to either of its possible targets, according to
@@ -1136,7 +1142,7 @@ IonScript::getSafepointIndex(uint32_t disp) const
         }
     }
 
-    MOZ_CRASH("displacement not found.");
+    MOZ_ASSUME_UNREACHABLE("displacement not found.");
 }
 
 const OsiIndex *
@@ -1150,7 +1156,7 @@ IonScript::getOsiIndex(uint32_t disp) const
             return it;
     }
 
-    MOZ_CRASH("Failed to find OSI point return address");
+    MOZ_ASSUME_UNREACHABLE("Failed to find OSI point return address");
 }
 
 const OsiIndex *
@@ -1650,7 +1656,7 @@ GenerateLIR(MIRGenerator *mir)
           }
 
           default:
-            MOZ_CRASH("Bad regalloc");
+            MOZ_ASSUME_UNREACHABLE("Bad regalloc");
         }
 
         if (mir->shouldCancel("Allocate Registers"))
@@ -2541,7 +2547,7 @@ InvalidateActivation(FreeOp *fop, uint8_t *jitTop, bool invalidateAll)
             break;
           case JitFrame_Unwound_IonJS:
           case JitFrame_Unwound_BaselineStub:
-            MOZ_CRASH("invalid");
+            MOZ_ASSUME_UNREACHABLE("invalid");
           case JitFrame_Unwound_Rectifier:
             IonSpew(IonSpew_Invalidate, "#%d unwound rectifier frame @ %p", frameno, it.fp());
             break;
@@ -2785,7 +2791,7 @@ jit::Invalidate(JSContext *cx, JSScript *script, ExecutionMode mode, bool resetU
             return false;
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     Invalidate(cx, scripts, resetUses, cancelOffThread);
@@ -2838,7 +2844,7 @@ jit::FinishInvalidation(FreeOp *fop, JSScript *script)
         return;
 
       default:
-        MOZ_CRASH("bad execution mode");
+        MOZ_ASSUME_UNREACHABLE("bad execution mode");
     }
 }
 
@@ -2899,10 +2905,10 @@ jit::ForbidCompilation(JSContext *cx, JSScript *script, ExecutionMode mode)
         return;
 
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
-    MOZ_CRASH("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 AutoFlushICache *
diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index 95509a57bb5b..5ccb64198d86 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -726,7 +726,7 @@ TypeAnalyzer::replaceRedundantPhi(MPhi *phi)
         v = MagicValue(JS_OPTIMIZED_OUT);
         break;
       default:
-        MOZ_CRASH("unexpected type");
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
     MConstant *c = MConstant::New(alloc(), v);
     // The instruction pass will insert the box
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 5b6f72c6a07d..fc2c3d351f99 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1374,7 +1374,7 @@ IonBuilder::snoopControlFlow(JSOp op)
 
           default:
             // Hard assert for now - make an error later.
-            MOZ_CRASH("unknown goto case");
+            MOZ_ASSUME_UNREACHABLE("unknown goto case");
         }
         break;
       }
@@ -1385,7 +1385,7 @@ IonBuilder::snoopControlFlow(JSOp op)
       case JSOP_IFNE:
         // We should never reach an IFNE, it's a stopAt point, which will
         // trigger closing the loop.
-        MOZ_CRASH("we should never reach an ifne!");
+        MOZ_ASSUME_UNREACHABLE("we should never reach an ifne!");
 
       default:
         break;
@@ -1662,7 +1662,7 @@ IonBuilder::inspectOpcode(JSOp op)
 
       case JSOP_LOOPHEAD:
         // JSOP_LOOPHEAD is handled when processing the loop header.
-        MOZ_CRASH("JSOP_LOOPHEAD outside loop");
+        MOZ_ASSUME_UNREACHABLE("JSOP_LOOPHEAD outside loop");
 
       case JSOP_GETELEM:
       case JSOP_CALLELEM:
@@ -1871,7 +1871,7 @@ IonBuilder::processCfgEntry(CFGState &state)
         return processTryEnd(state);
 
       default:
-        MOZ_CRASH("unknown cfgstate");
+        MOZ_ASSUME_UNREACHABLE("unknown cfgstate");
     }
 }
 
@@ -2579,7 +2579,7 @@ IonBuilder::processSwitchBreak(JSOp op)
         breaks = &state.condswitch.breaks;
         break;
       default:
-        MOZ_CRASH("Unexpected switch state.");
+        MOZ_ASSUME_UNREACHABLE("Unexpected switch state.");
     }
 
     *breaks = new(alloc()) DeferredEdge(current, *breaks);
@@ -2658,7 +2658,7 @@ IonBuilder::maybeLoop(JSOp op, jssrcnote *sn)
         break;
 
       default:
-        MOZ_CRASH("unexpected opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected opcode");
     }
 
     return ControlStatus_None;
@@ -2688,7 +2688,7 @@ IonBuilder::assertValidLoopHeadOp(jsbytecode *pc)
             break;
 
           default:
-            MOZ_CRASH("JSOP_LOOPHEAD unexpected source note");
+            MOZ_ASSUME_UNREACHABLE("JSOP_LOOPHEAD unexpected source note");
         }
 
         // Make sure this loop goes to the same ifne as the loop header's
@@ -3585,7 +3585,7 @@ IonBuilder::jsop_ifeq(JSOp op)
       }
 
       default:
-        MOZ_CRASH("unexpected source note type");
+        MOZ_ASSUME_UNREACHABLE("unexpected source note type");
     }
 
     // Switch to parsing the true branch. Note that no PC update is needed,
@@ -3706,7 +3706,8 @@ IonBuilder::processReturn(JSOp op)
         break;
 
       default:
-        MOZ_CRASH("unknown return op");
+        def = nullptr;
+        MOZ_ASSUME_UNREACHABLE("unknown return op");
     }
 
     if (instrumentedProfiling() && inliningDepth_ == 0) {
@@ -3825,7 +3826,7 @@ IonBuilder::jsop_bitop(JSOp op)
         break;
 
       default:
-        MOZ_CRASH("unexpected bitop");
+        MOZ_ASSUME_UNREACHABLE("unexpected bitop");
     }
 
     current->add(ins);
@@ -3882,7 +3883,7 @@ IonBuilder::jsop_binary(JSOp op, MDefinition *left, MDefinition *right)
         break;
 
       default:
-        MOZ_CRASH("unexpected binary opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected binary opcode");
     }
 
     current->add(ins);
@@ -4228,7 +4229,7 @@ IonBuilder::selectInliningTargets(ObjectVector &targets, CallInfo &callInfo, Boo
             inlineable = true;
             break;
           default:
-            MOZ_CRASH("Unhandled InliningDecision value!");
+            MOZ_ASSUME_UNREACHABLE("Unhandled InliningDecision value!");
         }
 
         // Enforce a maximum inlined bytecode limit at the callsite.
@@ -6535,7 +6536,7 @@ jit::TypeSetIncludes(types::TypeSet *types, MIRType input, types::TypeSet *input
         return types->unknown() || (inputTypes && inputTypes->isSubset(types));
 
       default:
-        MOZ_CRASH("Bad input type");
+        MOZ_ASSUME_UNREACHABLE("Bad input type");
     }
 }
 
@@ -6819,10 +6820,10 @@ IonBuilder::getElemTryTypedObject(bool *emitted, MDefinition *obj, MDefinition *
         return true;
 
       case type::UnsizedArray:
-        MOZ_CRASH("Unsized arrays cannot be element types");
+        MOZ_ASSUME_UNREACHABLE("Unsized arrays cannot be element types");
     }
 
-    MOZ_CRASH("Bad kind");
+    MOZ_ASSUME_UNREACHABLE("Bad kind");
 }
 
 static MIRType
@@ -7564,7 +7565,7 @@ MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble)
       default:
         break;
     }
-    MOZ_CRASH("Unknown typed array type");
+    MOZ_ASSUME_UNREACHABLE("Unknown typed array type");
 }
 
 bool
@@ -7632,7 +7633,7 @@ IonBuilder::jsop_getelem_typed(MDefinition *obj, MDefinition *index,
                 barrier = BarrierKind::NoBarrier;
             break;
           default:
-            MOZ_CRASH("Unknown typed array type");
+            MOZ_ASSUME_UNREACHABLE("Unknown typed array type");
         }
 
         // Assume we will read out-of-bound values. In this case the
@@ -7730,7 +7731,7 @@ IonBuilder::setElemTryTypedObject(bool *emitted, MDefinition *obj,
                                                  elemSize);
     }
 
-    MOZ_CRASH("Bad kind");
+    MOZ_ASSUME_UNREACHABLE("Bad kind");
 }
 
 bool
@@ -7993,7 +7994,7 @@ IonBuilder::jsop_setelem_dense(types::TemporaryTypeSet::DoubleConversion convers
         break;
 
       default:
-        MOZ_CRASH("Unknown double conversion");
+        MOZ_ASSUME_UNREACHABLE("Unknown double conversion");
     }
 
     bool writeHole = false;
@@ -8799,10 +8800,10 @@ IonBuilder::getPropTryTypedObject(bool *emitted,
                                                  resultTypes);
 
       case type::UnsizedArray:
-        MOZ_CRASH("Field of unsized array type");
+        MOZ_ASSUME_UNREACHABLE("Field of unsized array type");
     }
 
-    MOZ_CRASH("Bad kind");
+    MOZ_ASSUME_UNREACHABLE("Bad kind");
 }
 
 bool
@@ -9436,7 +9437,7 @@ IonBuilder::setPropTryTypedObject(bool *emitted, MDefinition *obj,
                                                  value, fieldPrediction);
     }
 
-    MOZ_CRASH("Unknown kind");
+    MOZ_ASSUME_UNREACHABLE("Unknown kind");
 }
 
 bool
diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp
index 3033daf17a43..8e06020d4638 100644
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -1242,7 +1242,7 @@ GetPropertyIC::tryAttachNative(JSContext *cx, HandleScript outerScript, IonScrip
         attachKind = "array length";
         break;
       default:
-        MOZ_CRASH("Bad NativeGetPropCacheability");
+        MOZ_ASSUME_UNREACHABLE("Bad NativeGetPropCacheability");
     }
     return linkAndAttachStub(cx, masm, attacher, ion, attachKind);
 }
@@ -4159,7 +4159,7 @@ IsCacheableNonGlobalScopeChain(JSObject *scopeChain, JSObject *holder)
         }
     }
 
-    MOZ_CRASH("Invalid scope chain");
+    MOZ_ASSUME_UNREACHABLE("Invalid scope chain");
 }
 
 JSObject *
diff --git a/js/src/jit/IonCaches.h b/js/src/jit/IonCaches.h
index f48137d23b56..a0a7868207d3 100644
--- a/js/src/jit/IonCaches.h
+++ b/js/src/jit/IonCaches.h
@@ -47,7 +47,7 @@ class IonCacheVisitor
   public:
 #define VISIT_INS(op)                                               \
     virtual bool visit##op##IC(CodeGenerator *codegen) {            \
-        MOZ_CRASH("NYI: " #op "IC");                                \
+        MOZ_ASSUME_UNREACHABLE("NYI: " #op "IC");                   \
     }
 
     IONCACHE_KIND_LIST(VISIT_INS)
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index 337be00cdf1a..19d77f362881 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -557,7 +557,8 @@ struct IonScript
     void copySafepoints(const SafepointWriter *writer);
     void copyCallTargetEntries(JSScript **callTargets);
     void copyPatchableBackedges(JSContext *cx, JitCode *code,
-                                PatchableBackedgeInfo *backedges);
+                                PatchableBackedgeInfo *backedges,
+                                MacroAssembler &masm);
 
     bool invalidated() const {
         return refcount_ != 0;
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index cbb7507a5203..bbfcf34a4aa4 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -283,7 +283,7 @@ SizeOfFramePrefix(FrameType type)
       case JitFrame_Exit:
         return IonExitFrameLayout::Size();
       default:
-        MOZ_CRASH("unknown frame type");
+        MOZ_ASSUME_UNREACHABLE("unknown frame type");
     }
 }
 
@@ -454,7 +454,7 @@ HandleExceptionIon(JSContext *cx, const InlineFrameIterator &frame, ResumeFromEx
             break;
 
           default:
-            MOZ_CRASH("Unexpected try note");
+            MOZ_ASSUME_UNREACHABLE("Unexpected try note");
         }
     }
 }
@@ -515,7 +515,7 @@ HandleExceptionBaseline(JSContext *cx, const JitFrameIterator &frame, ResumeFrom
             return;
 
           default:
-            MOZ_CRASH("Invalid trap status");
+            MOZ_ASSUME_UNREACHABLE("Invalid trap status");
         }
     }
 
@@ -594,7 +594,7 @@ HandleExceptionBaseline(JSContext *cx, const JitFrameIterator &frame, ResumeFrom
             break;
 
           default:
-            MOZ_CRASH("Invalid try note");
+            MOZ_ASSUME_UNREACHABLE("Invalid try note");
         }
     }
 
@@ -829,7 +829,7 @@ MarkCalleeToken(JSTracer *trc, CalleeToken token)
         return CalleeToToken(script);
       }
       default:
-        MOZ_CRASH("unknown callee token type");
+        MOZ_ASSUME_UNREACHABLE("unknown callee token type");
     }
 }
 
@@ -1033,7 +1033,7 @@ JitActivationIterator::jitStackRange(uintptr_t *&min, uintptr_t *&end)
         if (exitFrame->isWrapperExit() && f->outParam == Type_Handle) {
             switch (f->outParamRootType) {
               case VMFunction::RootNone:
-                MOZ_CRASH("Handle outparam must have root type");
+                MOZ_ASSUME_UNREACHABLE("Handle outparam must have root type");
               case VMFunction::RootObject:
               case VMFunction::RootString:
               case VMFunction::RootPropertyName:
@@ -1221,7 +1221,7 @@ MarkJitExitFrame(JSTracer *trc, const JitFrameIterator &frame)
     if (f->outParam == Type_Handle) {
         switch (f->outParamRootType) {
           case VMFunction::RootNone:
-            MOZ_CRASH("Handle outparam must have root type");
+            MOZ_ASSUME_UNREACHABLE("Handle outparam must have root type");
           case VMFunction::RootObject:
             gc::MarkObjectRoot(trc, footer->outParam<JSObject *>(), "ion-vm-out");
             break;
@@ -1286,14 +1286,14 @@ MarkJitActivation(JSTracer *trc, const JitActivationIterator &activations)
             MarkIonJSFrame(trc, frames);
             break;
           case JitFrame_Unwound_IonJS:
-            MOZ_CRASH("JitFrame_Unwound_IonJS");
+            MOZ_ASSUME_UNREACHABLE("invalid");
           case JitFrame_Rectifier:
             MarkRectifierFrame(trc, frames);
             break;
           case JitFrame_Unwound_Rectifier:
             break;
           default:
-            MOZ_CRASH("unexpected frame type");
+            MOZ_ASSUME_UNREACHABLE("unexpected frame type");
         }
     }
 }
@@ -1515,7 +1515,7 @@ FromTypedPayload(JSValueType type, uintptr_t payload)
       case JSVAL_TYPE_OBJECT:
         return FromObjectPayload(payload);
       default:
-        MOZ_CRASH("unexpected type - needs payload");
+        MOZ_ASSUME_UNREACHABLE("unexpected type - needs payload");
     }
 }
 
@@ -1603,7 +1603,7 @@ SnapshotIterator::allocationValue(const RValueAllocation &alloc)
           case JSVAL_TYPE_OBJECT:
             return FromObjectPayload(fromStack(alloc.stackOffset2()));
           default:
-            MOZ_CRASH("Unexpected type");
+            MOZ_ASSUME_UNREACHABLE("Unexpected type");
         }
       }
 
@@ -1659,7 +1659,7 @@ SnapshotIterator::allocationValue(const RValueAllocation &alloc)
         return fromInstructionResult(alloc.index());
 
       default:
-        MOZ_CRASH("huh?");
+        MOZ_ASSUME_UNREACHABLE("huh?");
     }
 }
 
@@ -1770,10 +1770,10 @@ JitFrameIterator::ionScriptFromCalleeToken() const
           case ParallelExecution:
             return script()->parallelIonScript();
           default:
-            MOZ_CRASH("No such execution mode");
+            MOZ_ASSUME_UNREACHABLE("No such execution mode");
         }
       default:
-        MOZ_CRASH("unknown callee token type");
+        MOZ_ASSUME_UNREACHABLE("unknown callee token type");
     }
 }
 
diff --git a/js/src/jit/IonFrames.h b/js/src/jit/IonFrames.h
index fc36212313b0..add4997689f4 100644
--- a/js/src/jit/IonFrames.h
+++ b/js/src/jit/IonFrames.h
@@ -71,7 +71,7 @@ ScriptFromCalleeToken(CalleeToken token)
       case CalleeToken_Function:
         return CalleeTokenToFunction(token)->nonLazyScript();
     }
-    MOZ_CRASH("invalid callee token tag");
+    MOZ_ASSUME_UNREACHABLE("invalid callee token tag");
 }
 
 // In between every two frames lies a small header describing both frames. This
diff --git a/js/src/jit/IonLinker.h b/js/src/jit/IonLinker.h
index 760cdc5839c4..7b86a91207e6 100644
--- a/js/src/jit/IonLinker.h
+++ b/js/src/jit/IonLinker.h
@@ -82,10 +82,6 @@ class Linker
     }
 
     JitCode *newCodeForIonScript(JSContext *cx) {
-#ifdef JS_CODEGEN_ARM
-        // ARM does not yet use implicit interrupt checks, see bug 864220.
-        return newCode<CanGC>(cx, JSC::ION_CODE);
-#else
         // The caller must lock the runtime against interrupt requests, as the
         // thread requesting an interrupt may use the executable allocator below.
         JS_ASSERT(cx->runtime()->currentThreadOwnsInterruptLock());
@@ -95,7 +91,6 @@ class Linker
             return nullptr;
 
         return newCode<CanGC>(cx, alloc, JSC::ION_CODE);
-#endif
     }
 };
 
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index 96e97039bda8..6b85019bee14 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -297,7 +297,7 @@ StoreToTypedFloatArray(MacroAssembler &masm, int arrayType, const S &value, cons
         masm.storeDouble(value, dest);
         break;
       default:
-        MOZ_CRASH("Invalid typed array type");
+        MOZ_ASSUME_UNREACHABLE("Invalid typed array type");
     }
 }
 
@@ -363,7 +363,7 @@ MacroAssembler::loadFromTypedArray(Scalar::Type arrayType, const T &src, AnyRegi
         canonicalizeDouble(dest.fpu());
         break;
       default:
-        MOZ_CRASH("Invalid typed array type");
+        MOZ_ASSUME_UNREACHABLE("Invalid typed array type");
     }
 }
 
@@ -424,7 +424,7 @@ MacroAssembler::loadFromTypedArray(Scalar::Type arrayType, const T &src, const V
         boxDouble(ScratchDoubleReg, dest);
         break;
       default:
-        MOZ_CRASH("Invalid typed array type");
+        MOZ_ASSUME_UNREACHABLE("Invalid typed array type");
     }
 }
 
@@ -978,7 +978,7 @@ MacroAssembler::checkInterruptFlagPar(Register tempReg, Label *fail)
     movePtr(ImmPtr(GetIonContext()->runtime->addressOfInterruptPar()), tempReg);
     branch32(Assembler::NonZero, Address(tempReg, 0), Imm32(0), fail);
 #else
-    MOZ_CRASH("JSRuntime::interruptPar doesn't exist on non-threadsafe builds.");
+    MOZ_ASSUME_UNREACHABLE("JSRuntime::interruptPar doesn't exist on non-threadsafe builds.");
 #endif
 }
 
@@ -1236,7 +1236,7 @@ MacroAssembler::loadContext(Register cxReg, Register scratch, ExecutionMode exec
         loadForkJoinContext(cxReg, scratch);
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 }
 
@@ -1279,7 +1279,7 @@ MacroAssembler::enterExitFrameAndLoadContext(const VMFunction *f, Register cxReg
         enterParallelExitFrameAndLoadContext(f, cxReg, scratch);
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 }
 
@@ -1297,7 +1297,7 @@ MacroAssembler::enterFakeExitFrame(Register cxReg, Register scratch,
         enterFakeParallelExitFrame(cxReg, scratch, codeVal);
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 }
 
@@ -1319,7 +1319,7 @@ MacroAssembler::handleFailure(ExecutionMode executionMode)
         handler = JS_FUNC_TO_DATA_PTR(void *, jit::HandleParallelFailure);
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
     MacroAssemblerSpecific::handleFailureWithHandler(handler);
 
@@ -1612,7 +1612,7 @@ MacroAssembler::PushEmptyRooted(VMFunction::RootType rootType)
 {
     switch (rootType) {
       case VMFunction::RootNone:
-        MOZ_CRASH("Handle must have root type");
+        MOZ_ASSUME_UNREACHABLE("Handle must have root type");
       case VMFunction::RootObject:
       case VMFunction::RootString:
       case VMFunction::RootPropertyName:
@@ -1632,7 +1632,7 @@ MacroAssembler::popRooted(VMFunction::RootType rootType, Register cellReg,
 {
     switch (rootType) {
       case VMFunction::RootNone:
-        MOZ_CRASH("Handle must have root type");
+        MOZ_ASSUME_UNREACHABLE("Handle must have root type");
       case VMFunction::RootObject:
       case VMFunction::RootString:
       case VMFunction::RootPropertyName:
@@ -1703,7 +1703,7 @@ MacroAssembler::convertTypedOrValueToFloatingPoint(TypedOrValueRegister src, Flo
         loadConstantFloatingPoint(GenericNaN(), float(GenericNaN()), output, outputType);
         break;
       default:
-        MOZ_CRASH("Bad MIRType");
+        MOZ_ASSUME_UNREACHABLE("Bad MIRType");
     }
 }
 
@@ -1918,7 +1918,7 @@ MacroAssembler::convertTypedOrValueToInt(TypedOrValueRegister src, FloatRegister
         jump(fail);
         break;
       default:
-        MOZ_CRASH("Bad MIRType");
+        MOZ_ASSUME_UNREACHABLE("Bad MIRType");
     }
 }
 
@@ -2004,7 +2004,7 @@ MacroAssembler::branchEqualTypeIfNeeded(MIRType type, MDefinition *maybeDef, Reg
             branchTestObject(Equal, tag, label);
             break;
           default:
-            MOZ_CRASH("Unsupported type");
+            MOZ_ASSUME_UNREACHABLE("Unsupported type");
         }
     }
 }
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index 836af311d5a3..2cecf439ecc1 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -139,7 +139,7 @@ class MacroAssembler : public MacroAssemblerSpecific
             } else if (type_.isAnyObject()) {
                 mirType = MIRType_Object;
             } else {
-                MOZ_CRASH("Unknown conversion to mirtype");
+                MOZ_ASSUME_UNREACHABLE("Unknown conversion to mirtype");
             }
 
             if (mirType == MIRType_Double)
@@ -341,7 +341,7 @@ class MacroAssembler : public MacroAssemblerSpecific
           case MIRType_MagicIsConstructing:
           case MIRType_MagicHole: return branchTestMagic(cond, val, label);
           default:
-            MOZ_CRASH("Bad MIRType");
+            MOZ_ASSUME_UNREACHABLE("Bad MIRType");
         }
     }
 
@@ -731,7 +731,7 @@ class MacroAssembler : public MacroAssemblerSpecific
             store32(value, dest);
             break;
           default:
-            MOZ_CRASH("Invalid typed array type");
+            MOZ_ASSUME_UNREACHABLE("Invalid typed array type");
         }
     }
 
@@ -1159,7 +1159,7 @@ class MacroAssembler : public MacroAssemblerSpecific
         switch (executionMode) {
           case SequentialExecution: return &sequentialFailureLabel_;
           case ParallelExecution: return &parallelFailureLabel_;
-          default: MOZ_CRASH("Unexpected execution mode");
+          default: MOZ_ASSUME_UNREACHABLE("Unexpected execution mode");
         }
     }
 
@@ -1446,7 +1446,7 @@ JSOpToDoubleCondition(JSOp op)
       case JSOP_GE:
         return Assembler::DoubleGreaterThanOrEqual;
       default:
-        MOZ_CRASH("Unexpected comparison operation");
+        MOZ_ASSUME_UNREACHABLE("Unexpected comparison operation");
     }
 }
 
@@ -1473,7 +1473,7 @@ JSOpToCondition(JSOp op, bool isSigned)
           case JSOP_GE:
             return Assembler::GreaterThanOrEqual;
           default:
-            MOZ_CRASH("Unrecognized comparison operation");
+            MOZ_ASSUME_UNREACHABLE("Unrecognized comparison operation");
         }
     } else {
         switch (op) {
@@ -1492,7 +1492,7 @@ JSOpToCondition(JSOp op, bool isSigned)
           case JSOP_GE:
             return Assembler::AboveOrEqual;
           default:
-            MOZ_CRASH("Unrecognized comparison operation");
+            MOZ_ASSUME_UNREACHABLE("Unrecognized comparison operation");
         }
     }
 }
diff --git a/js/src/jit/IonOptimizationLevels.cpp b/js/src/jit/IonOptimizationLevels.cpp
index d9c7162a93d3..d53c7297d23e 100644
--- a/js/src/jit/IonOptimizationLevels.cpp
+++ b/js/src/jit/IonOptimizationLevels.cpp
@@ -117,7 +117,7 @@ OptimizationInfos::nextLevel(OptimizationLevel level) const
       case Optimization_DontCompile:
         return Optimization_Normal;
       default:
-        MOZ_CRASH("Unknown optimization level.");
+        MOZ_ASSUME_UNREACHABLE("Unknown optimization level.");
     }
 }
 
diff --git a/js/src/jit/IonOptimizationLevels.h b/js/src/jit/IonOptimizationLevels.h
index 47b41ae20d5d..bd0827e54c02 100644
--- a/js/src/jit/IonOptimizationLevels.h
+++ b/js/src/jit/IonOptimizationLevels.h
@@ -38,7 +38,7 @@ OptimizationLevelString(OptimizationLevel level)
       case Optimization_AsmJS:
         return "Optimization_AsmJS";
       default:
-        MOZ_CRASH("Invalid OptimizationLevel");
+        MOZ_ASSUME_UNREACHABLE("Invalid OptimizationLevel");
     }
 }
 #endif
diff --git a/js/src/jit/IonTypes.h b/js/src/jit/IonTypes.h
index 5cce924c2035..42a52bcc12bf 100644
--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@@ -221,7 +221,7 @@ BailoutKindString(BailoutKind kind)
       case Bailout_IonExceptionDebugMode:
         return "Bailout_IonExceptionDebugMode";
       default:
-        MOZ_CRASH("Invalid BailoutKind");
+        MOZ_ASSUME_UNREACHABLE("Invalid BailoutKind");
     }
 }
 
@@ -301,7 +301,7 @@ MIRTypeFromValueType(JSValueType type)
       case JSVAL_TYPE_UNKNOWN:
         return MIRType_Value;
       default:
-        MOZ_CRASH("unexpected jsval type");
+        MOZ_ASSUME_UNREACHABLE("unexpected jsval type");
     }
 }
 
@@ -384,7 +384,7 @@ StringFromMIRType(MIRType type)
     case MIRType_ForkJoinContext:
       return "ForkJoinContext";
     default:
-      MOZ_CRASH("Unknown MIRType.");
+      MOZ_ASSUME_UNREACHABLE("Unknown MIRType.");
   }
 }
 
diff --git a/js/src/jit/JitCompartment.h b/js/src/jit/JitCompartment.h
index ae3772660e48..b2da45b216d5 100644
--- a/js/src/jit/JitCompartment.h
+++ b/js/src/jit/JitCompartment.h
@@ -311,7 +311,7 @@ class JitRuntime
         switch (mode) {
           case SequentialExecution: return bailoutHandler_;
           case ParallelExecution:   return parallelBailoutHandler_;
-          default:                  MOZ_CRASH("No such execution mode");
+          default:                  MOZ_ASSUME_UNREACHABLE("No such execution mode");
         }
     }
 
@@ -329,7 +329,7 @@ class JitRuntime
         switch (mode) {
           case SequentialExecution: return argumentsRectifier_;
           case ParallelExecution:   return parallelArgumentsRectifier_;
-          default:                  MOZ_CRASH("No such execution mode");
+          default:                  MOZ_ASSUME_UNREACHABLE("No such execution mode");
         }
     }
 
@@ -489,7 +489,7 @@ class JitCompartment
         switch (mode) {
           case SequentialExecution: return stringConcatStub_;
           case ParallelExecution:   return parallelStringConcatStub_;
-          default:                  MOZ_CRASH("No such execution mode");
+          default:                  MOZ_ASSUME_UNREACHABLE("No such execution mode");
         }
     }
 };
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index d49778800427..1d68dfdf472e 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -5655,19 +5655,19 @@ class LPhi MOZ_FINAL : public LInstruction
         return 0;
     }
     LDefinition *getTemp(size_t index) {
-        MOZ_CRASH("no temps");
+        MOZ_ASSUME_UNREACHABLE("no temps");
     }
     void setTemp(size_t index, const LDefinition &temp) {
-        MOZ_CRASH("no temps");
+        MOZ_ASSUME_UNREACHABLE("no temps");
     }
     size_t numSuccessors() const {
         return 0;
     }
     MBasicBlock *getSuccessor(size_t i) const {
-        MOZ_CRASH("no successors");
+        MOZ_ASSUME_UNREACHABLE("no successors");
     }
     void setSuccessor(size_t i, MBasicBlock *) {
-        MOZ_CRASH("no successors");
+        MOZ_ASSUME_UNREACHABLE("no successors");
     }
 
     virtual void printInfo(FILE *fp) {
@@ -5988,19 +5988,19 @@ class LAsmJSCall MOZ_FINAL : public LInstruction
         return 0;
     }
     LDefinition *getTemp(size_t index) {
-        MOZ_CRASH("no temps");
+        MOZ_ASSUME_UNREACHABLE("no temps");
     }
     void setTemp(size_t index, const LDefinition &a) {
-        MOZ_CRASH("no temps");
+        MOZ_ASSUME_UNREACHABLE("no temps");
     }
     size_t numSuccessors() const {
         return 0;
     }
     MBasicBlock *getSuccessor(size_t i) const {
-        MOZ_CRASH("no successors");
+        MOZ_ASSUME_UNREACHABLE("no successors");
     }
     void setSuccessor(size_t i, MBasicBlock *) {
-        MOZ_CRASH("no successors");
+        MOZ_ASSUME_UNREACHABLE("no successors");
     }
 };
 
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index 741ee710bef2..a6280c35b75b 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -408,7 +408,7 @@ PrintUse(char *buf, size_t size, const LUse *use)
         JS_snprintf(buf, size, "v%d:**", use->virtualRegister());
         break;
       default:
-        MOZ_CRASH("invalid use policy");
+        MOZ_ASSUME_UNREACHABLE("invalid use policy");
     }
 }
 
@@ -438,7 +438,7 @@ LAllocation::toString() const
         PrintUse(buf, sizeof(buf), toUse());
         return buf;
       default:
-        MOZ_CRASH("what?");
+        MOZ_ASSUME_UNREACHABLE("what?");
     }
 }
 #endif // DEBUG
diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index e9bcdec671e4..2495a2483b0b 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -570,7 +570,7 @@ class LDefinition
           case MIRType_ForkJoinContext:
             return LDefinition::GENERAL;
           default:
-            MOZ_CRASH("unexpected type");
+            MOZ_ASSUME_UNREACHABLE("unexpected type");
         }
     }
 
@@ -750,7 +750,7 @@ class LInstructionVisitor
     {}
 
   public:
-#define VISIT_INS(op) virtual bool visit##op(L##op *) { MOZ_CRASH("NYI: " #op); }
+#define VISIT_INS(op) virtual bool visit##op(L##op *) { MOZ_ASSUME_UNREACHABLE("NYI: " #op); }
     LIR_OPCODE_LIST(VISIT_INS)
 #undef VISIT_INS
 };
diff --git a/js/src/jit/LiveRangeAllocator.cpp b/js/src/jit/LiveRangeAllocator.cpp
index 1e849c794c3b..f99f1e7c8052 100644
--- a/js/src/jit/LiveRangeAllocator.cpp
+++ b/js/src/jit/LiveRangeAllocator.cpp
@@ -33,7 +33,7 @@ Requirement::priority() const
         return 2;
 
       default:
-        MOZ_CRASH("Unknown requirement kind.");
+        MOZ_ASSUME_UNREACHABLE("Unknown requirement kind.");
     }
 }
 
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index 5780a7d0e14c..2cec3e192783 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -159,7 +159,7 @@ UseCompatibleWith(const LUse *use, LAllocation alloc)
           // UsePosition is only used as hint.
         return alloc.isRegister();
       default:
-        MOZ_CRASH("Unknown use policy");
+        MOZ_ASSUME_UNREACHABLE("Unknown use policy");
     }
 }
 
@@ -188,7 +188,7 @@ DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation
       case LDefinition::PASSTHROUGH:
         return true;
       default:
-        MOZ_CRASH("Unknown definition policy");
+        MOZ_ASSUME_UNREACHABLE("Unknown definition policy");
     }
 }
 
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 70dd8569e716..c345188399b1 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -1032,7 +1032,7 @@ LIRGenerator::visitCompare(MCompare *comp)
         return define(lir, comp);
     }
 
-    MOZ_CRASH("Unrecognized compare type.");
+    MOZ_ASSUME_UNREACHABLE("Unrecognized compare type.");
 }
 
 bool
@@ -1769,7 +1769,7 @@ LIRGenerator::visitToDouble(MToDouble *convert)
       default:
         // Objects might be effectful.
         // Strings are complicated - we don't handle them yet.
-        MOZ_CRASH("unexpected type");
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -1818,7 +1818,7 @@ LIRGenerator::visitToFloat32(MToFloat32 *convert)
       default:
         // Objects might be effectful.
         // Strings are complicated - we don't handle them yet.
-        MOZ_CRASH("unexpected type");
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
         return false;
     }
 }
@@ -1864,11 +1864,11 @@ LIRGenerator::visitToInt32(MToInt32 *convert)
       case MIRType_Object:
       case MIRType_Undefined:
         // Objects might be effectful. Undefined and symbols coerce to NaN, not int32.
-        MOZ_CRASH("ToInt32 invalid input type");
+        MOZ_ASSUME_UNREACHABLE("ToInt32 invalid input type");
         return false;
 
       default:
-        MOZ_CRASH("unexpected type");
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -1907,7 +1907,7 @@ LIRGenerator::visitTruncateToInt32(MTruncateToInt32 *truncate)
       default:
         // Objects might be effectful.
         // Strings are complicated - we don't handle them yet.
-        MOZ_CRASH("unexpected type");
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -1966,7 +1966,7 @@ LIRGenerator::visitToString(MToString *ins)
 
       default:
         // Float32 and objects are not supported.
-        MOZ_CRASH("unexpected type");
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -2178,7 +2178,7 @@ LIRGenerator::visitLoadSlot(MLoadSlot *ins)
 
       case MIRType_Undefined:
       case MIRType_Null:
-        MOZ_CRASH("typed load must have a payload");
+        MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
 
       default:
         return define(new(alloc()) LLoadSlotT(useRegister(ins->slots())), ins);
@@ -2216,15 +2216,11 @@ LIRGenerator::visitGuardThreadExclusive(MGuardThreadExclusive *ins)
 bool
 LIRGenerator::visitInterruptCheck(MInterruptCheck *ins)
 {
-    // Implicit interrupt checks require asm.js signal handlers to be
-    // installed. ARM does not yet use implicit interrupt checks, see
-    // bug 864220.
-#ifndef JS_CODEGEN_ARM
+    // Implicit interrupt checks require asm.js signal handlers to be installed.
     if (GetIonContext()->runtime->signalHandlersInstalled()) {
         LInterruptCheckImplicit *lir = new(alloc()) LInterruptCheckImplicit();
         return add(lir, ins) && assignSafepoint(lir, ins);
     }
-#endif
 
     LInterruptCheck *lir = new(alloc()) LInterruptCheck();
     return add(lir, ins) && assignSafepoint(lir, ins);
@@ -2277,7 +2273,7 @@ LIRGenerator::visitStoreSlot(MStoreSlot *ins)
         return add(new(alloc()) LStoreSlotT(useRegister(ins->slots()), useRegister(ins->value())), ins);
 
       case MIRType_Float32:
-        MOZ_CRASH("Float32 shouldn't be stored in a slot.");
+        MOZ_ASSUME_UNREACHABLE("Float32 shouldn't be stored in a slot.");
 
       default:
         return add(new(alloc()) LStoreSlotT(useRegister(ins->slots()), useRegisterOrConstant(ins->value())),
@@ -2520,7 +2516,7 @@ LIRGenerator::visitNot(MNot *ins)
       }
 
       default:
-        MOZ_CRASH("Unexpected MIRType.");
+        MOZ_ASSUME_UNREACHABLE("Unexpected MIRType.");
     }
 }
 
@@ -2596,10 +2592,9 @@ LIRGenerator::visitLoadElement(MLoadElement *ins)
             return false;
         return defineBox(lir, ins);
       }
-
       case MIRType_Undefined:
       case MIRType_Null:
-        MOZ_CRASH("typed load must have a payload");
+        MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
 
       default:
       {
@@ -2707,7 +2702,7 @@ LIRGenerator::visitArrayPopShift(MArrayPopShift *ins)
       }
       case MIRType_Undefined:
       case MIRType_Null:
-        MOZ_CRASH("typed load must have a payload");
+        MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
 
       default:
       {
@@ -2816,7 +2811,7 @@ LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
       }
 
       default:
-        MOZ_CRASH("unexpected type");
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -3129,7 +3124,8 @@ LIRGenerator::visitAssertRange(MAssertRange *ins)
         break;
 
       default:
-        MOZ_CRASH("Unexpected Range for MIRType");
+        MOZ_ASSUME_UNREACHABLE("Unexpected Range for MIRType");
+        break;
     }
 
     lir->setMir(ins);
@@ -3532,7 +3528,7 @@ LIRGenerator::visitAsmJSReturn(MAsmJSReturn *ins)
     else if (rval->type() == MIRType_Int32)
         lir->setOperand(0, useFixed(rval, ReturnReg));
     else
-        MOZ_CRASH("Unexpected asm.js return type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected asm.js return type");
     return add(lir);
 }
 
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 4b23c34d5a3a..2c8dc3f591c9 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -1435,7 +1435,7 @@ IonBuilder::inlineUnsafePutElements(CallInfo &callInfo)
             continue;
         }
 
-        MOZ_CRASH("Element access not dense array nor typed array");
+        MOZ_ASSUME_UNREACHABLE("Element access not dense array nor typed array");
     }
 
     return InliningStatus_Inlined;
@@ -1550,7 +1550,7 @@ IonBuilder::inlineForceSequentialOrInParallelSection(CallInfo &callInfo)
         return InliningStatus_NotInlined;
     }
 
-    MOZ_CRASH("Invalid execution mode");
+    MOZ_ASSUME_UNREACHABLE("Invalid execution mode");
 }
 
 IonBuilder::InliningStatus
@@ -1588,7 +1588,7 @@ IonBuilder::inlineForkJoinGetSlice(CallInfo &callInfo)
         return InliningStatus_Inlined;
     }
 
-    MOZ_CRASH("Invalid execution mode");
+    MOZ_ASSUME_UNREACHABLE("Invalid execution mode");
 }
 
 IonBuilder::InliningStatus
@@ -1607,7 +1607,7 @@ IonBuilder::inlineNewDenseArray(CallInfo &callInfo)
         return inlineNewDenseArrayForSequentialExecution(callInfo);
     }
 
-    MOZ_CRASH("unknown ExecutionMode");
+    MOZ_ASSUME_UNREACHABLE("unknown ExecutionMode");
 }
 
 IonBuilder::InliningStatus
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index b45be066bdab..ead13b1a4459 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -118,7 +118,7 @@ EvaluateConstantOperands(TempAllocator &alloc, MBinaryInstruction *ins, bool *pt
         ret.setNumber(NumberMod(lhs.toNumber(), rhs.toNumber()));
         break;
       default:
-        MOZ_CRASH("NYI");
+        MOZ_ASSUME_UNREACHABLE("NYI");
     }
 
     // setNumber eagerly transforms a number to int32.
@@ -565,7 +565,7 @@ MConstant::printOpcode(FILE *fp) const
         fprintf(fp, "magic optimized-out");
         break;
       default:
-        MOZ_CRASH("unexpected type");
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -656,7 +656,7 @@ MMathFunction::FunctionName(Function function)
       case Ceil:   return "Ceil";
       case Round:  return "Round";
       default:
-        MOZ_CRASH("Unknown math function");
+        MOZ_ASSUME_UNREACHABLE("Unknown math function");
     }
 }
 
@@ -1950,7 +1950,7 @@ MCompare::inputType()
       case Compare_Value:
         return MIRType_Value;
       default:
-        MOZ_CRASH("No known conversion");
+        MOZ_ASSUME_UNREACHABLE("No known conversion");
     }
 }
 
@@ -2519,7 +2519,7 @@ MCompare::tryFold(bool *result)
             *result = (op == JSOP_NE || op == JSOP_STRICTNE);
             return true;
           default:
-            MOZ_CRASH("Unexpected type");
+            MOZ_ASSUME_UNREACHABLE("Unexpected type");
         }
     }
 
@@ -2542,9 +2542,9 @@ MCompare::tryFold(bool *result)
             return true;
           case MIRType_Boolean:
             // Int32 specialization should handle this.
-            MOZ_CRASH("Wrong specialization");
+            MOZ_ASSUME_UNREACHABLE("Wrong specialization");
           default:
-            MOZ_CRASH("Unexpected type");
+            MOZ_ASSUME_UNREACHABLE("Unexpected type");
         }
     }
 
@@ -2567,9 +2567,9 @@ MCompare::tryFold(bool *result)
             return true;
           case MIRType_String:
             // Compare_String specialization should handle this.
-            MOZ_CRASH("Wrong specialization");
+            MOZ_ASSUME_UNREACHABLE("Wrong specialization");
           default:
-            MOZ_CRASH("Unexpected type");
+            MOZ_ASSUME_UNREACHABLE("Unexpected type");
         }
     }
 
@@ -2619,7 +2619,7 @@ MCompare::evaluateConstantOperands(bool *result)
             *result = (comp != 0);
             break;
           default:
-            MOZ_CRASH("Unexpected op.");
+            MOZ_ASSUME_UNREACHABLE("Unexpected op.");
         }
 
         return true;
@@ -2651,7 +2651,7 @@ MCompare::evaluateConstantOperands(bool *result)
             *result = (lhsUint != rhsUint);
             break;
           default:
-            MOZ_CRASH("Unexpected op.");
+            MOZ_ASSUME_UNREACHABLE("Unexpected op.");
         }
 
         return true;
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index db8fe981b802..134be33efd51 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2731,7 +2731,7 @@ class MUnbox : public MUnaryInstruction, public BoxInputsPolicy
             kind = Bailout_NonObjectInput;
             break;
           default:
-            MOZ_CRASH("Given MIRType cannot be unboxed.");
+            MOZ_ASSUME_UNREACHABLE("Given MIRType cannot be unboxed.");
         }
 
         return new(alloc) MUnbox(ins, type, mode, kind);
@@ -4569,7 +4569,7 @@ class MDiv : public MBinaryArithInstruction
     void analyzeEdgeCasesBackward();
 
     double getIdentity() {
-        MOZ_CRASH("not used");
+        MOZ_ASSUME_UNREACHABLE("not used");
     }
 
     bool canBeNegativeZero() const {
@@ -4663,7 +4663,7 @@ class MMod : public MBinaryArithInstruction
     MDefinition *foldsTo(TempAllocator &alloc);
 
     double getIdentity() {
-        MOZ_CRASH("not used");
+        MOZ_ASSUME_UNREACHABLE("not used");
     }
 
     bool canBeNegativeDividend() const {
diff --git a/js/src/jit/MIRGraph.cpp b/js/src/jit/MIRGraph.cpp
index 3b0176014456..070b8db490c0 100644
--- a/js/src/jit/MIRGraph.cpp
+++ b/js/src/jit/MIRGraph.cpp
@@ -1076,7 +1076,7 @@ MBasicBlock::getSuccessorIndex(MBasicBlock *block) const
         if (getSuccessor(i) == block)
             return i;
     }
-    MOZ_CRASH("Invalid successor");
+    MOZ_ASSUME_UNREACHABLE("Invalid successor");
 }
 
 void
@@ -1108,7 +1108,7 @@ MBasicBlock::replacePredecessor(MBasicBlock *old, MBasicBlock *split)
         }
     }
 
-    MOZ_CRASH("predecessor was not found");
+    MOZ_ASSUME_UNREACHABLE("predecessor was not found");
 }
 
 void
@@ -1148,7 +1148,7 @@ MBasicBlock::removePredecessor(MBasicBlock *pred)
         return;
     }
 
-    MOZ_CRASH("predecessor was not found");
+    MOZ_ASSUME_UNREACHABLE("predecessor was not found");
 }
 
 void
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index 3c57db0504ad..8ef8f8ec2c29 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -243,7 +243,7 @@ class MInstructionVisitor // interface i.e. pure abstract class
 class MInstructionVisitorWithDefaults : public MInstructionVisitor
 {
   public:
-#define VISIT_INS(op) virtual bool visit##op(M##op *) { MOZ_CRASH("NYI: " #op); }
+#define VISIT_INS(op) virtual bool visit##op(M##op *) { MOZ_ASSUME_UNREACHABLE("NYI: " #op); }
     MIR_OPCODE_LIST(VISIT_INS)
 #undef VISIT_INS
 };
diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp
index 541605c576c3..355609fb3954 100644
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -503,7 +503,7 @@ Range::Range(const MDefinition *def)
             wrapAroundToBoolean();
             break;
           case MIRType_None:
-            MOZ_CRASH("Asking for the range of an instruction with no value");
+            MOZ_ASSUME_UNREACHABLE("Asking for the range of an instruction with no value");
           default:
             break;
         }
@@ -519,7 +519,7 @@ Range::Range(const MDefinition *def)
             setInt32(0, 1);
             break;
           case MIRType_None:
-            MOZ_CRASH("Asking for the range of an instruction with no value");
+            MOZ_ASSUME_UNREACHABLE("Asking for the range of an instruction with no value");
           default:
             setUnknown();
             break;
diff --git a/js/src/jit/Recover.cpp b/js/src/jit/Recover.cpp
index 06c9b4a1d4af..df00cdbcd78f 100644
--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -27,7 +27,8 @@ using namespace js::jit;
 bool
 MNode::writeRecoverData(CompactBufferWriter &writer) const
 {
-    MOZ_CRASH("This instruction is not serializable");
+    MOZ_ASSUME_UNREACHABLE("This instruction is not serializable");
+    return false;
 }
 
 void
@@ -47,7 +48,7 @@ RInstruction::readRecoverData(CompactBufferReader &reader, RInstructionStorage *
 
       case Recover_Invalid:
       default:
-        MOZ_CRASH("Bad decoding of the previous instruction?");
+        MOZ_ASSUME_UNREACHABLE("Bad decoding of the previous instruction?");
         break;
     }
 }
@@ -135,7 +136,7 @@ RResumePoint::RResumePoint(CompactBufferReader &reader)
 bool
 RResumePoint::recover(JSContext *cx, SnapshotIterator &iter) const
 {
-    MOZ_CRASH("This instruction is not recoverable.");
+    MOZ_ASSUME_UNREACHABLE("This instruction is not recoverable.");
 }
 
 bool
@@ -824,7 +825,8 @@ MMathFunction::writeRecoverData(CompactBufferWriter &writer) const
         writer.writeUnsigned(uint32_t(RInstruction::Recover_Round));
         return true;
       default:
-        MOZ_CRASH("Unknown math function.");
+        MOZ_ASSUME_UNREACHABLE("Unknown math function.");
+        return false;
     }
 }
 
diff --git a/js/src/jit/Snapshots.cpp b/js/src/jit/Snapshots.cpp
index 5d18e886d3e3..e2132c6c3267 100644
--- a/js/src/jit/Snapshots.cpp
+++ b/js/src/jit/Snapshots.cpp
@@ -251,7 +251,7 @@ RValueAllocation::layoutFromMode(Mode mode)
       }
     }
 
-    MOZ_CRASH("Wrong mode type?");
+    MOZ_ASSUME_UNREACHABLE("Wrong mode type?");
 }
 
 // Pad serialized RValueAllocations by a multiple of X bytes in the allocation
@@ -401,7 +401,7 @@ ValTypeToString(JSValueType type)
       case JSVAL_TYPE_MAGIC:
         return "magic";
       default:
-        MOZ_CRASH("no payload");
+        MOZ_ASSUME_UNREACHABLE("no payload");
     }
 }
 
diff --git a/js/src/jit/StackSlotAllocator.h b/js/src/jit/StackSlotAllocator.h
index 787e06226caa..136f3917ba58 100644
--- a/js/src/jit/StackSlotAllocator.h
+++ b/js/src/jit/StackSlotAllocator.h
@@ -69,7 +69,7 @@ class StackSlotAllocator
           case LDefinition::PAYLOAD:
 #endif
           case LDefinition::DOUBLE:  return freeDoubleSlot(index);
-          default: MOZ_CRASH("Unknown slot type");
+          default: MOZ_ASSUME_UNREACHABLE("Unknown slot type");
         }
     }
 
@@ -95,7 +95,7 @@ class StackSlotAllocator
           case LDefinition::PAYLOAD:
 #endif
           case LDefinition::DOUBLE:  return allocateDoubleSlot();
-          default: MOZ_CRASH("Unknown slot type");
+          default: MOZ_ASSUME_UNREACHABLE("Unknown slot type");
         }
     }
 
diff --git a/js/src/jit/StupidAllocator.cpp b/js/src/jit/StupidAllocator.cpp
index f01500dc5d01..95015ffa62aa 100644
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -34,7 +34,7 @@ StupidAllocator::registerIndex(AnyRegister reg)
         if (reg == registers[i].reg)
             return i;
     }
-    MOZ_CRASH("Bad register");
+    MOZ_ASSUME_UNREACHABLE("Bad register");
 }
 
 bool
diff --git a/js/src/jit/TypePolicy.cpp b/js/src/jit/TypePolicy.cpp
index d8e008c915bd..ae2326da6a7f 100644
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -261,7 +261,7 @@ ComparePolicy::adjustInputs(TempAllocator &alloc, MInstruction *def)
             replace = MUnbox::New(alloc, in, MIRType_String, MUnbox::Infallible);
             break;
           default:
-            MOZ_CRASH("Unknown compare specialization");
+            MOZ_ASSUME_UNREACHABLE("Unknown compare specialization");
         }
 
         def->block()->insertBefore(def, replace);
@@ -746,7 +746,7 @@ StoreTypedArrayPolicy::adjustValueInput(TempAllocator &alloc, MInstruction *ins,
         value = boxAt(alloc, ins, value);
         break;
       default:
-        MOZ_CRASH("Unexpected type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected type");
     }
 
     if (value != curValue) {
@@ -793,7 +793,7 @@ StoreTypedArrayPolicy::adjustValueInput(TempAllocator &alloc, MInstruction *ins,
         }
         break;
       default:
-        MOZ_CRASH("Invalid array type");
+        MOZ_ASSUME_UNREACHABLE("Invalid array type");
     }
 
     if (value != curValue)
diff --git a/js/src/jit/TypedObjectPrediction.cpp b/js/src/jit/TypedObjectPrediction.cpp
index cd3dd7ac3219..9ff15d291389 100644
--- a/js/src/jit/TypedObjectPrediction.cpp
+++ b/js/src/jit/TypedObjectPrediction.cpp
@@ -98,7 +98,7 @@ TypedObjectPrediction::addProto(const TypedProto &proto)
         return;
     }
 
-    MOZ_CRASH("Bad predictionKind");
+    MOZ_ASSUME_UNREACHABLE("Bad predictionKind");
 }
 
 type::Kind
@@ -119,7 +119,7 @@ TypedObjectPrediction::kind() const
         return prefix().descr->kind();
     }
 
-    MOZ_CRASH("Bad prediction kind");
+    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
 }
 
 bool
@@ -137,7 +137,7 @@ TypedObjectPrediction::ofArrayKind() const
         return true;
     }
 
-    MOZ_CRASH("Bad kind");
+    MOZ_ASSUME_UNREACHABLE("Bad kind");
 }
 
 static bool
@@ -172,7 +172,7 @@ TypedObjectPrediction::hasKnownSize(int32_t *out) const
             // The prototype does not track the precise dimensions of arrays.
             return false;
         }
-        MOZ_CRASH("Unknown kind");
+        MOZ_ASSUME_UNREACHABLE("Unknown kind");
 
       case TypedObjectPrediction::Descr:
         return DescrHasKnownSize(descr(), out);
@@ -183,7 +183,7 @@ TypedObjectPrediction::hasKnownSize(int32_t *out) const
         return false;
     }
 
-    MOZ_CRASH("Bad prediction kind");
+    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
 }
 
 const TypedProto *
@@ -206,7 +206,7 @@ TypedObjectPrediction::getKnownPrototype() const
           case type::UnsizedArray:
             return &proto();
         }
-        MOZ_CRASH("Invalid proto().kind()");
+        MOZ_ASSUME_UNREACHABLE("Invalid proto().kind()");
 
       case TypedObjectPrediction::Descr:
         if (descr().is<ComplexTypeDescr>())
@@ -219,7 +219,7 @@ TypedObjectPrediction::getKnownPrototype() const
         return nullptr;
     }
 
-    MOZ_CRASH("Bad prediction kind");
+    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
 }
 
 template<typename T>
@@ -242,7 +242,7 @@ TypedObjectPrediction::extractType() const
         break; // Prefixes are always structs, never scalars etc
     }
 
-    MOZ_CRASH("Bad prediction kind");
+    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
 }
 
 ScalarTypeDescr::Type
@@ -288,7 +288,7 @@ TypedObjectPrediction::hasKnownArrayLength(int32_t *length) const
       case TypedObjectPrediction::Prefix:
         break; // Prefixes are always structs, never arrays
     }
-    MOZ_CRASH("Bad prediction kind");
+    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
 }
 
 static TypeDescr &
@@ -316,7 +316,7 @@ TypedObjectPrediction::arrayElementType() const
       case TypedObjectPrediction::Prefix:
         break; // Prefixes are always structs, never arrays
     }
-    MOZ_CRASH("Bad prediction kind");
+    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
 }
 
 bool
@@ -369,5 +369,5 @@ TypedObjectPrediction::hasFieldNamed(jsid id,
             *prefix().descr, prefix().fields,
             id, fieldOffset, fieldType, fieldIndex);
     }
-    MOZ_CRASH("Bad prediction kind");
+    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
 }
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 982757ecde32..0ead89986bb7 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -760,7 +760,7 @@ DebugPrologue(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *mustRet
         return false;
 
       default:
-        MOZ_CRASH("Invalid trap status");
+        MOZ_ASSUME_UNREACHABLE("Invalid trap status");
     }
 }
 
@@ -917,7 +917,7 @@ HandleDebugTrap(JSContext *cx, BaselineFrame *frame, uint8_t *retAddr, bool *mus
         return false;
 
       default:
-        MOZ_CRASH("Invalid trap status");
+        MOZ_ASSUME_UNREACHABLE("Invalid trap status");
     }
 
     return true;
@@ -955,7 +955,7 @@ OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *m
         return false;
 
       default:
-        MOZ_CRASH("Invalid trap status");
+        MOZ_ASSUME_UNREACHABLE("Invalid trap status");
     }
 }
 
diff --git a/js/src/jit/arm/Architecture-arm.cpp b/js/src/jit/arm/Architecture-arm.cpp
index 52eb97e18658..884f3fadf95e 100644
--- a/js/src/jit/arm/Architecture-arm.cpp
+++ b/js/src/jit/arm/Architecture-arm.cpp
@@ -352,7 +352,7 @@ VFPRegister::getRegisterDumpOffsetInBytes()
         return id() * sizeof(float);
     if (isDouble())
         return id() * sizeof(double);
-    MOZ_CRASH("Unexpected register dump offset");
+    MOZ_ASSUME_UNREACHABLE();
 }
 
 } // namespace jit
diff --git a/js/src/jit/arm/Assembler-arm.cpp b/js/src/jit/arm/Assembler-arm.cpp
index 26cf0189715c..eb3681b7c8a7 100644
--- a/js/src/jit/arm/Assembler-arm.cpp
+++ b/js/src/jit/arm/Assembler-arm.cpp
@@ -58,7 +58,7 @@ ABIArgGenerator::next(MIRType type)
         floatRegIndex_++;
         break;
       default:
-        MOZ_CRASH("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
 
     return current_;
@@ -699,7 +699,7 @@ Assembler::GetCF32Target(Iter *iter)
 
     }
 
-    MOZ_CRASH("unsupported branch relocation");
+    MOZ_ASSUME_UNREACHABLE("unsupported branch relocation");
 }
 
 uintptr_t
@@ -763,7 +763,7 @@ Assembler::GetPtr32Target(Iter *start, Register *dest, RelocStyle *style)
         return *ptr;
     }
 
-    MOZ_CRASH("unsupported relocation");
+    MOZ_ASSUME_UNREACHABLE("unsupported relocation");
 }
 
 static JitCode *
@@ -1664,7 +1664,7 @@ Assembler::as_extdtr(LoadStore ls, int size, bool IsSigned, Index mode,
         extra_bits1 = 0;
         break;
       default:
-        MOZ_CRASH("SAY WHAT?");
+        MOZ_ASSUME_UNREACHABLE("SAY WHAT?");
     }
     return writeInst(extra_bits2 << 5 | extra_bits1 << 20 | 0x90 |
                      addr.encode() | RT(rt) | mode | c, dest);
@@ -1770,7 +1770,7 @@ Assembler::PatchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
     int offset = (char *)constPoolAddr - (char *)loadAddr;
     switch(data.getLoadType()) {
       case PoolHintData::PoolBOGUS:
-        MOZ_CRASH("bogus load type!");
+        MOZ_ASSUME_UNREACHABLE("bogus load type!");
       case PoolHintData::PoolDTR:
         Dummy->as_dtr(IsLoad, 32, Offset, data.getReg(),
                       DTRAddr(pc, DtrOffImm(offset+4*data.getIndex() - 8)), data.getCond(), instAddr);
@@ -2000,20 +2000,22 @@ Assembler::as_vnmul(VFPRegister vd, VFPRegister vn, VFPRegister vm,
                   Condition c)
 {
     return as_vfp_float(vd, vn, vm, OpvMul, c);
+    MOZ_ASSUME_UNREACHABLE("Feature NYI");
 }
 
 BufferOffset
 Assembler::as_vnmla(VFPRegister vd, VFPRegister vn, VFPRegister vm,
                   Condition c)
 {
-    MOZ_CRASH("Feature NYI");
+    MOZ_ASSUME_UNREACHABLE("Feature NYI");
 }
 
 BufferOffset
 Assembler::as_vnmls(VFPRegister vd, VFPRegister vn, VFPRegister vm,
                   Condition c)
 {
-    MOZ_CRASH("Feature NYI");
+    MOZ_ASSUME_UNREACHABLE("Feature NYI");
+    return BufferOffset();
 }
 
 BufferOffset
@@ -2247,7 +2249,7 @@ Assembler::bind(Label *label, BufferOffset boff)
             else if (branch.is<InstBLImm>())
                 as_bl(dest.diffB<BOffImm>(b), c, b);
             else
-                MOZ_CRASH("crazy fixup!");
+                MOZ_ASSUME_UNREACHABLE("crazy fixup!");
             b = next;
         } while (more);
     }
@@ -2304,7 +2306,7 @@ Assembler::retarget(Label *label, Label *target)
             else if (branch.is<InstBLImm>())
                 as_bl(BOffImm(prev), c, labelBranchOffset);
             else
-                MOZ_CRASH("crazy fixup!");
+                MOZ_ASSUME_UNREACHABLE("crazy fixup!");
         } else {
             // The target is unbound and unused. We can just take the head of
             // the list hanging off of label, and dump that into target.
diff --git a/js/src/jit/arm/Assembler-arm.h b/js/src/jit/arm/Assembler-arm.h
index 6e7ac5c8de96..b9b08a681432 100644
--- a/js/src/jit/arm/Assembler-arm.h
+++ b/js/src/jit/arm/Assembler-arm.h
@@ -1584,7 +1584,7 @@ class Assembler : public AssemblerShared
         JS_ASSERT(rn.code() > dtmLastReg);
         dtmRegBitField |= 1 << rn.code();
         if (dtmLoadStore == IsLoad && rn.code() == 13 && dtmBase.code() == 13) {
-            MOZ_CRASH("ARM Spec says this is invalid");
+            MOZ_ASSUME_UNREACHABLE("ARM Spec says this is invalid");
         }
     }
     void finishDataTransfer() {
@@ -1689,7 +1689,7 @@ class Assembler : public AssemblerShared
     static void PatchWrite_Imm32(CodeLocationLabel label, Imm32 imm);
 
     static void PatchInstructionImmediate(uint8_t *code, PatchedImmPtr imm) {
-        MOZ_CRASH("Unused.");
+        MOZ_ASSUME_UNREACHABLE("Unused.");
     }
 
     static uint32_t AlignDoubleArg(uint32_t offset) {
diff --git a/js/src/jit/arm/Bailouts-arm.cpp b/js/src/jit/arm/Bailouts-arm.cpp
index d0722801dfe8..0db5a3d7ef8d 100644
--- a/js/src/jit/arm/Bailouts-arm.cpp
+++ b/js/src/jit/arm/Bailouts-arm.cpp
@@ -84,7 +84,7 @@ IonBailoutIterator::IonBailoutIterator(const JitActivationIterator &activations,
     switch (mode_) {
       case SequentialExecution: topIonScript_ = script()->ionScript(); break;
       case ParallelExecution: topIonScript_ = script()->parallelIonScript(); break;
-      default: MOZ_CRASH("No such execution mode");
+      default: MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     if (bailout->frameClass() == FrameSizeClass::None()) {
diff --git a/js/src/jit/arm/BaselineIC-arm.cpp b/js/src/jit/arm/BaselineIC-arm.cpp
index 2539e8e854a6..0f37e5685ad1 100644
--- a/js/src/jit/arm/BaselineIC-arm.cpp
+++ b/js/src/jit/arm/BaselineIC-arm.cpp
@@ -197,7 +197,7 @@ ICBinaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         }
         break;
       default:
-        MOZ_CRASH("Unhandled op for BinaryArith_Int32.");
+        MOZ_ASSUME_UNREACHABLE("Unhandled op for BinaryArith_Int32.");
     }
 
     EmitReturnFromIC(masm);
@@ -248,7 +248,7 @@ ICUnaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.ma_rsb(R0.payloadReg(), Imm32(0), R0.payloadReg());
         break;
       default:
-        MOZ_CRASH("Unexpected op");
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 
     EmitReturnFromIC(masm);
diff --git a/js/src/jit/arm/CodeGenerator-arm.cpp b/js/src/jit/arm/CodeGenerator-arm.cpp
index c939570b8b53..cebef4145182 100644
--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -894,7 +894,7 @@ CodeGeneratorARM::visitBitOpI(LBitOpI *ins)
             masm.ma_and(ToRegister(rhs), ToRegister(lhs), ToRegister(dest));
         break;
       default:
-        MOZ_CRASH("unexpected binary opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected binary opcode");
     }
 
     return true;
@@ -936,7 +936,7 @@ CodeGeneratorARM::visitShiftI(LShiftI *ins)
             }
             break;
           default:
-            MOZ_CRASH("Unexpected shift op");
+            MOZ_ASSUME_UNREACHABLE("Unexpected shift op");
         }
     } else {
         // The shift amounts should be AND'ed into the 0-31 range since arm
@@ -961,7 +961,7 @@ CodeGeneratorARM::visitShiftI(LShiftI *ins)
             }
             break;
           default:
-            MOZ_CRASH("Unexpected shift op");
+            MOZ_ASSUME_UNREACHABLE("Unexpected shift op");
         }
     }
 
@@ -1154,7 +1154,7 @@ CodeGeneratorARM::visitMathD(LMathD *math)
         masm.ma_vdiv(ToFloatRegister(src1), ToFloatRegister(src2), ToFloatRegister(output));
         break;
       default:
-        MOZ_CRASH("unexpected opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected opcode");
     }
     return true;
 }
@@ -1180,7 +1180,7 @@ CodeGeneratorARM::visitMathF(LMathF *math)
         masm.ma_vdiv_f32(ToFloatRegister(src1), ToFloatRegister(src2), ToFloatRegister(output));
         break;
       default:
-        MOZ_CRASH("unexpected opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected opcode");
     }
     return true;
 }
@@ -1781,13 +1781,13 @@ getBase(U *mir)
 bool
 CodeGeneratorARM::visitLoadTypedArrayElementStatic(LLoadTypedArrayElementStatic *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
 CodeGeneratorARM::visitStoreTypedArrayElementStatic(LStoreTypedArrayElementStatic *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
@@ -1806,7 +1806,7 @@ CodeGeneratorARM::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
       case Scalar::Uint32:  isSigned = true;  size = 32; break;
       case Scalar::Float64: isFloat = true;   size = 64; break;
       case Scalar::Float32: isFloat = true;   size = 32; break;
-      default: MOZ_CRASH("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     const LAllocation *ptr = ins->ptr();
@@ -1880,7 +1880,7 @@ CodeGeneratorARM::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
       case Scalar::Uint32:  isSigned = true;  size = 32; break;
       case Scalar::Float64: isFloat  = true;  size = 64; break;
       case Scalar::Float32: isFloat = true;   size = 32; break;
-      default: MOZ_CRASH("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
     const LAllocation *ptr = ins->ptr();
     if (ptr->isConstant()) {
@@ -2156,11 +2156,11 @@ CodeGeneratorARM::visitNegF(LNegF *ins)
 bool
 CodeGeneratorARM::visitForkJoinGetSlice(LForkJoinGetSlice *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 JitCode *
 JitRuntime::generateForkJoinGetSliceStub(JSContext *cx)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
diff --git a/js/src/jit/arm/Lowering-arm.cpp b/js/src/jit/arm/Lowering-arm.cpp
index 585c837d0672..5d56e6a1f51f 100644
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -541,13 +541,13 @@ LIRGeneratorARM::lowerTruncateFToInt32(MTruncateToInt32 *ins)
 bool
 LIRGeneratorARM::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
 LIRGeneratorARM::visitForkJoinGetSlice(MForkJoinGetSlice *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 //__aeabi_uidiv
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index c5d308ff166e..8dcb4a1767cf 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -780,7 +780,7 @@ MacroAssemblerARM::ma_cmn(Register src1, Register src2, Condition c)
 void
 MacroAssemblerARM::ma_cmn(Register src1, Operand op, Condition c)
 {
-    MOZ_CRASH("Feature NYI");
+    MOZ_ASSUME_UNREACHABLE("Feature NYI");
 }
 
 // Compare (src - src2).
@@ -814,7 +814,7 @@ MacroAssemblerARM::ma_cmp(Register src1, Operand op, Condition c)
         as_cmp(src1, O2Reg(ScratchRegister), c);
         break;
       default:
-        MOZ_CRASH("trying to compare FP and integer registers");
+        MOZ_ASSUME_UNREACHABLE("trying to compare FP and integer registers");
     }
 }
 void
@@ -887,7 +887,7 @@ MacroAssemblerARM::ma_check_mul(Register src1, Register src2, Register dest, Con
         return NotEqual;
     }
 
-    MOZ_CRASH("Condition NYI");
+    MOZ_ASSUME_UNREACHABLE("Condition NYI");
 }
 
 Assembler::Condition
@@ -905,7 +905,7 @@ MacroAssemblerARM::ma_check_mul(Register src1, Imm32 imm, Register dest, Conditi
         return NotEqual;
     }
 
-    MOZ_CRASH("Condition NYI");
+    MOZ_ASSUME_UNREACHABLE("Condition NYI");
 }
 
 void
@@ -1016,7 +1016,7 @@ void
 MacroAssemblerARM::ma_dtr(LoadStore ls, Register rn, Register rm, Register rt,
                           Index mode, Assembler::Condition cc)
 {
-    MOZ_CRASH("Feature NYI");
+    MOZ_ASSUME_UNREACHABLE("Feature NYI");
 }
 
 void
@@ -1362,7 +1362,7 @@ MacroAssemblerARM::ma_b(void *target, Relocation::Kind reloc, Assembler::Conditi
             m_buffer.markGuard();
         break;
       default:
-        MOZ_CRASH("Other methods of generating tracable jumps NYI");
+        MOZ_ASSUME_UNREACHABLE("Other methods of generating tracable jumps NYI");
     }
 }
 
@@ -3486,7 +3486,7 @@ MacroAssemblerARMCompat::loadValue(Address src, ValueOperand val)
                 mode = IB;
                 break;
               default:
-                MOZ_CRASH("Bogus Offset for LoadValue as DTM");
+                MOZ_ASSUME_UNREACHABLE("Bogus Offset for LoadValue as DTM");
             }
             startDataTransferM(IsLoad, Register::FromCode(srcOp.base()), mode);
             transferReg(val.payloadReg());
@@ -3556,7 +3556,8 @@ MacroAssemblerARMCompat::storePayload(Register src, Operand dest)
         ma_str(src, ToPayload(dest));
         return;
     }
-    MOZ_CRASH("unexpected operand");
+    MOZ_ASSUME_UNREACHABLE("why do we do all of these things?");
+
 }
 
 void
@@ -3604,7 +3605,9 @@ MacroAssemblerARMCompat::storeTypeTag(ImmTag tag, Operand dest) {
         ma_str(secondScratchReg_, ToType(dest));
         return;
     }
-    MOZ_CRASH("unexpected operand");
+
+    MOZ_ASSUME_UNREACHABLE("why do we do all of these things?");
+
 }
 
 void
@@ -3818,7 +3821,7 @@ MacroAssemblerARMCompat::passHardFpABIArg(const MoveOperand &from, MoveOp::Type
         break;
       }
       default:
-        MOZ_CRASH("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
 
     enoughMemory_ = moveResolver_.addMove(from, to, type);
@@ -3848,7 +3851,7 @@ MacroAssemblerARMCompat::passSoftFpABIArg(const MoveOperand &from, MoveOp::Type
         passedArgTypes_ = (passedArgTypes_ << ArgType_Shift) | ArgType_General;
         break;
       default:
-        MOZ_CRASH("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
 
     Register destReg;
@@ -3995,7 +3998,7 @@ MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, MoveOp::Type resu
         break;
 
       default:
-        MOZ_CRASH("unexpected callWithABI result");
+        MOZ_ASSUME_UNREACHABLE("unexpected callWithABI result");
     }
 
     freeStack(stackAdjust);
@@ -4035,7 +4038,7 @@ AssertValidABIFunctionType(uint32_t passedArgTypes)
       case Args_Int_IntDouble:
         break;
       default:
-        MOZ_CRASH("Unexpected type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected type");
     }
 }
 #endif
@@ -4050,7 +4053,7 @@ MacroAssemblerARMCompat::callWithABI(void *fun, MoveOp::Type result)
       case MoveOp::GENERAL: passedArgTypes_ |= ArgType_General; break;
       case MoveOp::DOUBLE:  passedArgTypes_ |= ArgType_Double;  break;
       case MoveOp::FLOAT32: passedArgTypes_ |= ArgType_Float32; break;
-      default: MOZ_CRASH("Invalid return type");
+      default: MOZ_ASSUME_UNREACHABLE("Invalid return type");
     }
 #ifdef DEBUG
     AssertValidABIFunctionType(passedArgTypes_);
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index 4c67cf0c8df5..1e9ab8a425b1 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -420,7 +420,7 @@ class MacroAssemblerARM : public Assembler
             return transferMultipleByRunsImpl
                 <FloatRegisterBackwardIterator>(set, ls, rm, mode, -1);
         }
-        MOZ_CRASH("Invalid data transfer addressing mode");
+        MOZ_ASSUME_UNREACHABLE("Invalid data transfer addressing mode");
     }
 
 private:
@@ -530,10 +530,10 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         mov(ImmWord(uintptr_t(imm.value)), dest);
     }
     void mov(Register src, Address dest) {
-        MOZ_CRASH("NYI-IC");
+        MOZ_ASSUME_UNREACHABLE("NYI-IC");
     }
     void mov(Address src, Register dest) {
-        MOZ_CRASH("NYI-IC");
+        MOZ_ASSUME_UNREACHABLE("NYI-IC");
     }
 
     void call(const Register reg) {
diff --git a/js/src/jit/arm/MoveEmitter-arm.cpp b/js/src/jit/arm/MoveEmitter-arm.cpp
index 81cb1c0ed58c..91a427180e00 100644
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -136,7 +136,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
         }
         break;
       default:
-        MOZ_CRASH("Unexpected move type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected move type");
     }
 }
 
@@ -175,7 +175,7 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
         }
         break;
       default:
-        MOZ_CRASH("Unexpected move type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected move type");
     }
 }
 
@@ -204,7 +204,7 @@ MoveEmitterARM::emitMove(const MoveOperand &from, const MoveOperand &to)
             masm.ma_str(from.reg(), toOperand(to, false));
             break;
           default:
-            MOZ_CRASH("strange move!");
+            MOZ_ASSUME_UNREACHABLE("strange move!");
         }
     } else if (to.isGeneralReg()) {
         JS_ASSERT(from.isMemoryOrEffectiveAddress());
@@ -299,7 +299,7 @@ MoveEmitterARM::emit(const MoveOp &move)
         emitMove(from, to);
         break;
       default:
-        MOZ_CRASH("Unexpected move type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected move type");
     }
 }
 
diff --git a/js/src/jit/arm/Simulator-arm.cpp b/js/src/jit/arm/Simulator-arm.cpp
index 2dee825dc864..635fa0990fbc 100644
--- a/js/src/jit/arm/Simulator-arm.cpp
+++ b/js/src/jit/arm/Simulator-arm.cpp
@@ -1653,8 +1653,9 @@ Simulator::conditionallyExecute(SimInstruction *instr)
       case Assembler::GT: return !z_flag_ && (n_flag_ == v_flag_);
       case Assembler::LE: return z_flag_ || (n_flag_ != v_flag_);
       case Assembler::AL: return true;
+      default: MOZ_ASSUME_UNREACHABLE();
     }
-    MOZ_CRASH("unexpected condition field");
+    return false;
 }
 
 // Calculate and set the Negative and Zero flags.
@@ -1767,7 +1768,8 @@ Simulator::getShiftRm(SimInstruction *instr, bool *carry_out)
     if (instr->bit(4) == 0) {
         // By immediate.
         if (shift == ROR && shift_amount == 0) {
-            MOZ_CRASH("NYI");
+            MOZ_ASSUME_UNREACHABLE("NYI");
+            return result;
         }
         if ((shift == LSR || shift == ASR) && shift_amount == 0)
             shift_amount = 32;
@@ -1827,7 +1829,8 @@ Simulator::getShiftRm(SimInstruction *instr, bool *carry_out)
           }
 
           default:
-            MOZ_CRASH("Unexpected shift");
+            MOZ_ASSUME_UNREACHABLE();
+            break;
         }
     } else {
         // By register.
@@ -1904,7 +1907,8 @@ Simulator::getShiftRm(SimInstruction *instr, bool *carry_out)
           }
 
           default:
-            MOZ_CRASH("Unexpected shift");
+            MOZ_ASSUME_UNREACHABLE();
+            break;
         }
     }
     return result;
@@ -1930,7 +1934,8 @@ Simulator::processPU(SimInstruction *instr, int num_regs, int reg_size,
     int32_t rn_val = get_register(rn);
     switch (instr->PUField()) {
       case da_x:
-        MOZ_CRASH("Unexpected PUField: da_x");
+        MOZ_CRASH();
+        break;
       case ia_x:
         *start_address = rn_val;
         *end_address = rn_val + (num_regs * reg_size) - reg_size;
@@ -1947,7 +1952,8 @@ Simulator::processPU(SimInstruction *instr, int num_regs, int reg_size,
         rn_val = *end_address;
         break;
       default:
-        MOZ_CRASH("Unexpected PUField");
+        MOZ_ASSUME_UNREACHABLE();
+        break;
     }
     return rn_val;
 }
@@ -2285,7 +2291,7 @@ Simulator::softwareInterrupt(SimInstruction *instr)
             break;
           }
           default:
-            MOZ_CRASH("call");
+            MOZ_ASSUME_UNREACHABLE("call");
         }
 
         set_register(lr, saved_lr);
@@ -3326,7 +3332,7 @@ Simulator::decodeTypeVFP(SimInstruction *instr)
             const bool is_vmls = (instr->opc3Value() & 0x1);
 
             if (instr->szValue() != 0x1)
-                MOZ_CRASH("Not used by V8.");
+                MOZ_ASSUME_UNREACHABLE();  // Not used by V8.
 
             const double dd_val = get_double_from_d_register(vd);
             const double dn_val = get_double_from_d_register(vn);
@@ -3733,7 +3739,7 @@ Simulator::decodeVCVTBetweenFloatingPointAndIntegerFrac(SimInstruction *instr)
             set_s_register_from_sinteger(dst, temp);
         }
     } else {
-        MOZ_CRASH("Not implemented, fixed to float.");
+        MOZ_ASSUME_UNREACHABLE();  // Not implemented, fixed to float.
     }
 }
 
diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
index 7309ca5d2b79..89d52ef869a1 100644
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -691,7 +691,7 @@ JitRuntime::generateBailoutHandler(JSContext *cx, ExecutionMode mode)
         GenerateParallelBailoutThunk(masm, NO_FRAME_SIZE_CLASS_ID);
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     Linker linker(masm);
@@ -825,7 +825,7 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         masm.branchIfFalseBool(r0, masm.failureLabel(f.executionMode));
         break;
       default:
-        MOZ_CRASH("unknown failure kind");
+        MOZ_ASSUME_UNREACHABLE("unknown failure kind");
     }
 
     // Load the outparam and free any allocated stack.
diff --git a/js/src/jit/mips/Assembler-mips.cpp b/js/src/jit/mips/Assembler-mips.cpp
index 26bc5d133719..a3883e9b1333 100644
--- a/js/src/jit/mips/Assembler-mips.cpp
+++ b/js/src/jit/mips/Assembler-mips.cpp
@@ -59,7 +59,7 @@ ABIArgGenerator::next(MIRType type)
         }
         break;
       default:
-        MOZ_CRASH("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
     return current_;
 
@@ -383,7 +383,8 @@ Assembler::InvertCondition(Condition cond)
       case NotSigned:
         return Signed;
       default:
-        MOZ_CRASH("unexpected condition");
+        MOZ_ASSUME_UNREACHABLE("unexpected condition");
+        return Equal;
     }
 }
 
@@ -420,7 +421,8 @@ Assembler::InvertCondition(DoubleCondition cond)
       case DoubleLessThanOrEqualOrUnordered:
         return DoubleGreaterThan;
       default:
-        MOZ_CRASH("unexpected condition");
+        MOZ_ASSUME_UNREACHABLE("unexpected condition");
+        return DoubleEqual;
     }
 }
 
@@ -620,7 +622,7 @@ Assembler::getBranchCode(Register s, Condition c)
       case Assembler::LessThanOrEqual:
         return InstImm(op_blez, s, zero, BOffImm16(0));
       default:
-        MOZ_CRASH("Condition not supported.");
+        MOZ_ASSUME_UNREACHABLE("Condition not supported.");
     }
 }
 
@@ -1510,7 +1512,8 @@ InstImm Assembler::invertBranch(InstImm branch, BOffImm16 skipOffset)
             return branch;
         }
 
-        MOZ_CRASH("Error creating long branch.");
+        MOZ_ASSUME_UNREACHABLE("Error creating long branch.");
+        return branch;
 
       case op_cop1:
         MOZ_ASSERT(branch.extractRS() == rs_bc1 >> RSShift);
@@ -1524,7 +1527,8 @@ InstImm Assembler::invertBranch(InstImm branch, BOffImm16 skipOffset)
         return branch;
     }
 
-    MOZ_CRASH("Error creating long branch.");
+    MOZ_ASSUME_UNREACHABLE("Error creating long branch.");
+    return branch;
 }
 
 void
diff --git a/js/src/jit/mips/Bailouts-mips.cpp b/js/src/jit/mips/Bailouts-mips.cpp
index 4a5f10fcb61e..0196365850e4 100644
--- a/js/src/jit/mips/Bailouts-mips.cpp
+++ b/js/src/jit/mips/Bailouts-mips.cpp
@@ -27,7 +27,7 @@ IonBailoutIterator::IonBailoutIterator(const JitActivationIterator &activations,
     switch (mode_) {
       case SequentialExecution: topIonScript_ = script()->ionScript(); break;
       case ParallelExecution: topIonScript_ = script()->parallelIonScript(); break;
-      default: MOZ_CRASH("No such execution mode");
+      default: MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     if (bailout->frameClass() == FrameSizeClass::None()) {
diff --git a/js/src/jit/mips/BaselineIC-mips.cpp b/js/src/jit/mips/BaselineIC-mips.cpp
index 717a96ce066e..595a3f9cc7e2 100644
--- a/js/src/jit/mips/BaselineIC-mips.cpp
+++ b/js/src/jit/mips/BaselineIC-mips.cpp
@@ -180,7 +180,7 @@ ICBinaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         }
         break;
       default:
-        MOZ_CRASH("Unhandled op for BinaryArith_Int32.");
+        MOZ_ASSUME_UNREACHABLE("Unhandled op for BinaryArith_Int32.");
     }
 
     EmitReturnFromIC(masm);
@@ -209,7 +209,7 @@ ICUnaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.neg32(R0.payloadReg());
         break;
       default:
-        MOZ_CRASH("Unexpected op");
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
         return false;
     }
 
diff --git a/js/src/jit/mips/CodeGenerator-mips.cpp b/js/src/jit/mips/CodeGenerator-mips.cpp
index 13050618b5c2..c6945a8c6bb0 100644
--- a/js/src/jit/mips/CodeGenerator-mips.cpp
+++ b/js/src/jit/mips/CodeGenerator-mips.cpp
@@ -847,7 +847,7 @@ CodeGeneratorMIPS::visitBitOpI(LBitOpI *ins)
             masm.ma_and(ToRegister(dest), ToRegister(lhs), ToRegister(rhs));
         break;
       default:
-        MOZ_CRASH("unexpected binary opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected binary opcode");
     }
 
     return true;
@@ -888,7 +888,7 @@ CodeGeneratorMIPS::visitShiftI(LShiftI *ins)
             }
             break;
           default:
-            MOZ_CRASH("Unexpected shift op");
+            MOZ_ASSUME_UNREACHABLE("Unexpected shift op");
         }
     } else {
         // The shift amounts should be AND'ed into the 0-31 range
@@ -910,7 +910,7 @@ CodeGeneratorMIPS::visitShiftI(LShiftI *ins)
             }
             break;
           default:
-            MOZ_CRASH("Unexpected shift op");
+            MOZ_ASSUME_UNREACHABLE("Unexpected shift op");
         }
     }
 
@@ -1077,7 +1077,7 @@ CodeGeneratorMIPS::visitMathD(LMathD *math)
         masm.as_divd(ToFloatRegister(output), ToFloatRegister(src1), ToFloatRegister(src2));
         break;
       default:
-        MOZ_CRASH("unexpected opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected opcode");
     }
     return true;
 }
@@ -1103,7 +1103,7 @@ CodeGeneratorMIPS::visitMathF(LMathF *math)
         masm.as_divs(ToFloatRegister(output), ToFloatRegister(src1), ToFloatRegister(src2));
         break;
       default:
-        MOZ_CRASH("unexpected opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected opcode");
     }
     return true;
 }
@@ -1893,13 +1893,13 @@ DispatchIonCache::initializeAddCacheState(LInstruction *ins, AddCacheState *addS
 bool
 CodeGeneratorMIPS::visitLoadTypedArrayElementStatic(LLoadTypedArrayElementStatic *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
 CodeGeneratorMIPS::visitStoreTypedArrayElementStatic(LStoreTypedArrayElementStatic *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
@@ -1921,7 +1921,7 @@ CodeGeneratorMIPS::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
       case ArrayBufferView::TYPE_UINT32:  isSigned = false; size = 32; break;
       case ArrayBufferView::TYPE_FLOAT64: isFloat  = true;  size = 64; break;
       case ArrayBufferView::TYPE_FLOAT32: isFloat  = true;  size = 32; break;
-      default: MOZ_CRASH("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     if (ptr->isConstant()) {
@@ -2008,7 +2008,7 @@ CodeGeneratorMIPS::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
       case ArrayBufferView::TYPE_UINT32:  isSigned = false; size = 32; break;
       case ArrayBufferView::TYPE_FLOAT64: isFloat  = true;  size = 64; break;
       case ArrayBufferView::TYPE_FLOAT32: isFloat  = true;  size = 32; break;
-      default: MOZ_CRASH("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     if (ptr->isConstant()) {
@@ -2252,11 +2252,11 @@ CodeGeneratorMIPS::visitNegF(LNegF *ins)
 bool
 CodeGeneratorMIPS::visitForkJoinGetSlice(LForkJoinGetSlice *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 JitCode *
 JitRuntime::generateForkJoinGetSliceStub(JSContext *cx)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
diff --git a/js/src/jit/mips/CodeGenerator-mips.h b/js/src/jit/mips/CodeGenerator-mips.h
index c30f605b902d..d952c1922b35 100644
--- a/js/src/jit/mips/CodeGenerator-mips.h
+++ b/js/src/jit/mips/CodeGenerator-mips.h
@@ -75,7 +75,7 @@ class CodeGeneratorMIPS : public CodeGeneratorShared
               return bailoutCmp32(c, lhs.toReg(), rhs, snapshot);
         if (lhs.getTag() == Operand::MEM)
               return bailoutCmp32(c, lhs.toAddress(), rhs, snapshot);
-        MOZ_CRASH("Invalid operand tag.");
+        MOZ_ASSUME_UNREACHABLE("Invalid operand tag.");
         return false;
     }
     template<typename T>
diff --git a/js/src/jit/mips/Lowering-mips.cpp b/js/src/jit/mips/Lowering-mips.cpp
index d4565705a00c..6cf79daf57b5 100644
--- a/js/src/jit/mips/Lowering-mips.cpp
+++ b/js/src/jit/mips/Lowering-mips.cpp
@@ -523,11 +523,11 @@ LIRGeneratorMIPS::lowerTruncateFToInt32(MTruncateToInt32 *ins)
 bool
 LIRGeneratorMIPS::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
 LIRGeneratorMIPS::visitForkJoinGetSlice(MForkJoinGetSlice *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
diff --git a/js/src/jit/mips/MacroAssembler-mips.cpp b/js/src/jit/mips/MacroAssembler-mips.cpp
index 878773d7b90c..89ab08c18db9 100644
--- a/js/src/jit/mips/MacroAssembler-mips.cpp
+++ b/js/src/jit/mips/MacroAssembler-mips.cpp
@@ -728,7 +728,8 @@ MacroAssemblerMIPS::ma_load(Register dest, Address address,
         as_lw(dest, base, encodedOffset);
         break;
       default:
-        MOZ_CRASH("Invalid argument for ma_load");
+        MOZ_ASSUME_UNREACHABLE("Invalid argument for ma_load");
+        break;
     }
 }
 
@@ -767,7 +768,8 @@ MacroAssemblerMIPS::ma_store(Register data, Address address, LoadStoreSize size,
         as_sw(data, base, encodedOffset);
         break;
       default:
-        MOZ_CRASH("Invalid argument for ma_store");
+        MOZ_ASSUME_UNREACHABLE("Invalid argument for ma_store");
+        break;
     }
 }
 
@@ -1068,11 +1070,13 @@ MacroAssemblerMIPS::ma_cmp(Register scratch, Register lhs, Register rhs, Conditi
       case Always:
       case Signed:
       case NotSigned:
-        MOZ_CRASH("There is a better way to compare for equality.");
+        MOZ_ASSUME_UNREACHABLE("There is a better way to compare for equality.");
+        break;
       case Overflow:
-        MOZ_CRASH("Overflow condition not supported for MIPS.");
+        MOZ_ASSUME_UNREACHABLE("Overflow condition not supported for MIPS.");
+        break;
       default:
-        MOZ_CRASH("Invalid condition for branch.");
+        MOZ_ASSUME_UNREACHABLE("Invalid condition for branch.");
     }
     return Always;
 }
@@ -1167,7 +1171,8 @@ MacroAssemblerMIPS::ma_cmp_set(Register rd, Register rs, Register rt, Condition
         as_xori(rd, rd, 1);
         break;
       default:
-        MOZ_CRASH("Invalid condition for ma_cmp_set.");
+        MOZ_ASSUME_UNREACHABLE("Invalid condition for ma_cmp_set.");
+        break;
     }
 }
 
@@ -1234,7 +1239,8 @@ MacroAssemblerMIPS::compareFloatingPoint(FloatFormat fmt, FloatRegister lhs, Flo
         *testKind = TestForTrue;
         break;
       default:
-        MOZ_CRASH("Invalid DoubleCondition.");
+        MOZ_ASSUME_UNREACHABLE("Invalid DoubleCondition.");
+        break;
     }
 }
 
@@ -3184,7 +3190,7 @@ MacroAssemblerMIPSCompat::passABIArg(const MoveOperand &from, MoveOp::Type type)
         passedArgTypes_ = (passedArgTypes_ << ArgType_Shift) | ArgType_General;
         break;
       default:
-        MOZ_CRASH("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
 }
 
@@ -3333,7 +3339,7 @@ AssertValidABIFunctionType(uint32_t passedArgTypes)
       case Args_Int_IntDouble:
         break;
       default:
-        MOZ_CRASH("Unexpected type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected type");
     }
 }
 #endif
@@ -3348,7 +3354,7 @@ MacroAssemblerMIPSCompat::callWithABI(void *fun, MoveOp::Type result)
       case MoveOp::GENERAL: passedArgTypes_ |= ArgType_General; break;
       case MoveOp::DOUBLE:  passedArgTypes_ |= ArgType_Double;  break;
       case MoveOp::FLOAT32: passedArgTypes_ |= ArgType_Float32; break;
-      default: MOZ_CRASH("Invalid return type");
+      default: MOZ_ASSUME_UNREACHABLE("Invalid return type");
     }
 #ifdef DEBUG
     AssertValidABIFunctionType(passedArgTypes_);
diff --git a/js/src/jit/mips/MacroAssembler-mips.h b/js/src/jit/mips/MacroAssembler-mips.h
index b53a294ea42d..4594b8f47a5c 100644
--- a/js/src/jit/mips/MacroAssembler-mips.h
+++ b/js/src/jit/mips/MacroAssembler-mips.h
@@ -379,10 +379,10 @@ class MacroAssemblerMIPSCompat : public MacroAssemblerMIPS
         mov(ImmWord(uintptr_t(imm.value)), dest);
     }
     void mov(Register src, Address dest) {
-        MOZ_CRASH("NYI-IC");
+        MOZ_ASSUME_UNREACHABLE("NYI-IC");
     }
     void mov(Address src, Register dest) {
-        MOZ_CRASH("NYI-IC");
+        MOZ_ASSUME_UNREACHABLE("NYI-IC");
     }
 
     void call(const Register reg) {
@@ -997,7 +997,7 @@ public:
             ma_addTestOverflow(dest, dest, src, overflow);
             break;
           default:
-            MOZ_CRASH("NYI");
+            MOZ_ASSUME_UNREACHABLE("NYI");
         }
     }
     template <typename T>
@@ -1012,7 +1012,7 @@ public:
             ma_b(dest, dest, overflow, cond);
             break;
           default:
-            MOZ_CRASH("NYI");
+            MOZ_ASSUME_UNREACHABLE("NYI");
         }
     }
 
diff --git a/js/src/jit/mips/MoveEmitter-mips.cpp b/js/src/jit/mips/MoveEmitter-mips.cpp
index 9226923a21d0..0ca88c0bd228 100644
--- a/js/src/jit/mips/MoveEmitter-mips.cpp
+++ b/js/src/jit/mips/MoveEmitter-mips.cpp
@@ -113,7 +113,7 @@ MoveEmitterMIPS::breakCycle(const MoveOperand &from, const MoveOperand &to, Move
         }
         break;
       default:
-        MOZ_CRASH("Unexpected move type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected move type");
     }
 }
 
@@ -159,7 +159,7 @@ MoveEmitterMIPS::completeCycle(const MoveOperand &from, const MoveOperand &to, M
         }
         break;
       default:
-        MOZ_CRASH("Unexpected move type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected move type");
     }
 }
 
@@ -175,7 +175,7 @@ MoveEmitterMIPS::emitMove(const MoveOperand &from, const MoveOperand &to)
         else if (to.isMemory())
             masm.storePtr(from.reg(), getAdjustedAddress(to));
         else
-            MOZ_CRASH("Invalid emitMove arguments.");
+            MOZ_ASSUME_UNREACHABLE("Invalid emitMove arguments.");
     } else if (from.isMemory()) {
         if (to.isGeneralReg()) {
             masm.loadPtr(getAdjustedAddress(from), to.reg());
@@ -183,7 +183,7 @@ MoveEmitterMIPS::emitMove(const MoveOperand &from, const MoveOperand &to)
             masm.loadPtr(getAdjustedAddress(from), tempReg());
             masm.storePtr(tempReg(), getAdjustedAddress(to));
         } else {
-            MOZ_CRASH("Invalid emitMove arguments.");
+            MOZ_ASSUME_UNREACHABLE("Invalid emitMove arguments.");
         }
     } else if (from.isEffectiveAddress()) {
         if (to.isGeneralReg()) {
@@ -192,10 +192,10 @@ MoveEmitterMIPS::emitMove(const MoveOperand &from, const MoveOperand &to)
             masm.computeEffectiveAddress(getAdjustedAddress(from), tempReg());
             masm.storePtr(tempReg(), getAdjustedAddress(to));
         } else {
-            MOZ_CRASH("Invalid emitMove arguments.");
+            MOZ_ASSUME_UNREACHABLE("Invalid emitMove arguments.");
         }
     } else {
-        MOZ_CRASH("Invalid emitMove arguments.");
+        MOZ_ASSUME_UNREACHABLE("Invalid emitMove arguments.");
     }
 }
 
@@ -252,7 +252,7 @@ MoveEmitterMIPS::emitDoubleMove(const MoveOperand &from, const MoveOperand &to)
             else if(to.reg() == a3)
                 masm.moveFromDoubleHi(from.floatReg(), a3);
             else
-                MOZ_CRASH("Invalid emitDoubleMove arguments.");
+                MOZ_ASSUME_UNREACHABLE("Invalid emitDoubleMove arguments.");
         } else {
             MOZ_ASSERT(to.isMemory());
             masm.storeDouble(from.floatReg(), getAdjustedAddress(to));
@@ -270,7 +270,7 @@ MoveEmitterMIPS::emitDoubleMove(const MoveOperand &from, const MoveOperand &to)
         else if(to.reg() == a3)
             masm.loadPtr(Address(from.base(), getAdjustedOffset(from) + sizeof(uint32_t)), a3);
         else
-            MOZ_CRASH("Invalid emitDoubleMove arguments.");
+            MOZ_ASSUME_UNREACHABLE("Invalid emitDoubleMove arguments.");
     } else {
         MOZ_ASSERT(from.isMemory());
         MOZ_ASSERT(to.isMemory());
@@ -311,7 +311,7 @@ MoveEmitterMIPS::emit(const MoveOp &move)
         emitMove(from, to);
         break;
       default:
-        MOZ_CRASH("Unexpected move type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected move type");
     }
 }
 
diff --git a/js/src/jit/mips/Simulator-mips.cpp b/js/src/jit/mips/Simulator-mips.cpp
index 7a5dde7437a7..01759055b505 100644
--- a/js/src/jit/mips/Simulator-mips.cpp
+++ b/js/src/jit/mips/Simulator-mips.cpp
@@ -944,7 +944,7 @@ MipsDebugger::debug()
                             value = getRegisterValue(reg.code());
                             printf("%s: 0x%08x %d \n", arg1, value, value);
                         } else if (fReg.code() != FloatRegisters::Invalid) {
-                            MOZ_CRASH("NYI");
+                            MOZ_ASSUME_UNREACHABLE("NYI");
                         } else {
                             printf("%s unrecognized\n", arg1);
                         }
@@ -1865,7 +1865,7 @@ Simulator::softwareInterrupt(SimInstruction *instr)
     // We first check if we met a call_rt_redirected.
     if (instr->instructionBits() == kCallRedirInstr) {
 #if !defined(USES_O32_ABI)
-        MOZ_CRASH("Only O32 ABI supported.");
+        MOZ_ASSUME_UNREACHABLE("Only O32 ABI supported.");
 #else
         Redirection *redirection = Redirection::FromSwiInstruction(instr);
         int32_t arg0 = getRegister(a0);
@@ -2021,7 +2021,7 @@ Simulator::softwareInterrupt(SimInstruction *instr)
             break;
           }
           default:
-            MOZ_CRASH("call");
+            MOZ_ASSUME_UNREACHABLE("call");
         }
 
         setRegister(ra, saved_ra);
@@ -2146,7 +2146,7 @@ Simulator::signalExceptions()
 {
     for (int i = 1; i < kNumExceptions; i++) {
         if (exceptions[i] != 0)
-            MOZ_CRASH("Error: Exception raised.");
+            MOZ_ASSUME_UNREACHABLE("Error: Exception raised.");
     }
 }
 
@@ -3298,7 +3298,7 @@ Simulator::branchDelayInstructionDecode(SimInstruction *instr)
     }
 
     if (instr->isForbiddenInBranchDelay()) {
-        MOZ_CRASH("Eror:Unexpected opcode in a branch delay slot.");
+        MOZ_ASSUME_UNREACHABLE("Eror:Unexpected opcode in a branch delay slot.");
     }
     instructionDecode(instr);
 }
diff --git a/js/src/jit/mips/Trampoline-mips.cpp b/js/src/jit/mips/Trampoline-mips.cpp
index e0063157c707..3c22ae567f84 100644
--- a/js/src/jit/mips/Trampoline-mips.cpp
+++ b/js/src/jit/mips/Trampoline-mips.cpp
@@ -690,7 +690,7 @@ JitRuntime::generateBailoutHandler(JSContext *cx, ExecutionMode mode)
         GenerateParallelBailoutThunk(masm, NO_FRAME_SIZE_CLASS_ID);
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     Linker linker(masm);
@@ -843,7 +843,7 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         masm.branchIfFalseBool(v0, masm.failureLabel(f.executionMode));
         break;
       default:
-        MOZ_CRASH("unknown failure kind");
+        MOZ_ASSUME_UNREACHABLE("unknown failure kind");
     }
 
     masm.freeStack(outParamOffset);
diff --git a/js/src/jit/shared/Assembler-shared.h b/js/src/jit/shared/Assembler-shared.h
index dee30349955b..1dd7fbc64c2e 100644
--- a/js/src/jit/shared/Assembler-shared.h
+++ b/js/src/jit/shared/Assembler-shared.h
@@ -65,7 +65,7 @@ ScaleFromElemWidth(int shift)
         return TimesEight;
     }
 
-    MOZ_CRASH("Invalid scale");
+    MOZ_ASSUME_UNREACHABLE("Invalid scale");
 }
 
 // Used for 32-bit immediates which do not require relocation.
@@ -87,7 +87,7 @@ struct Imm32
           case TimesEight:
             return Imm32(3);
         };
-        MOZ_CRASH("Invalid scale");
+        MOZ_ASSUME_UNREACHABLE("Invalid scale");
     }
 
     static inline Imm32 FactorOf(enum Scale s) {
diff --git a/js/src/jit/shared/Assembler-x86-shared.cpp b/js/src/jit/shared/Assembler-x86-shared.cpp
index 737f63bd05dd..53fd21018568 100644
--- a/js/src/jit/shared/Assembler-x86-shared.cpp
+++ b/js/src/jit/shared/Assembler-x86-shared.cpp
@@ -128,6 +128,6 @@ AssemblerX86Shared::InvertCondition(Condition cond)
       case BelowOrEqual:
         return Above;
       default:
-        MOZ_CRASH("unexpected condition");
+        MOZ_ASSUME_UNREACHABLE("unexpected condition");
     }
 }
diff --git a/js/src/jit/shared/Assembler-x86-shared.h b/js/src/jit/shared/Assembler-x86-shared.h
index 97ba20e27634..4495446f8dcf 100644
--- a/js/src/jit/shared/Assembler-x86-shared.h
+++ b/js/src/jit/shared/Assembler-x86-shared.h
@@ -245,7 +245,7 @@ class AssemblerX86Shared : public AssemblerShared
             return NaN_IsTrue;
         }
 
-        MOZ_CRASH("Unknown double condition");
+        MOZ_ASSUME_UNREACHABLE("Unknown double condition");
     }
 
     static void StaticAsserts() {
@@ -361,7 +361,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movl_mr(src.address(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movl(Register src, const Operand &dest) {
@@ -379,7 +379,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movl_rm(src.code(), dest.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movl(Imm32 imm32, const Operand &dest) {
@@ -394,7 +394,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movl_i32m(imm32.value, dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -450,7 +450,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movdqa_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movdqa(FloatRegister src, const Operand &dest) {
@@ -463,7 +463,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movdqa_rm(src.code(), dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cvtss2sd(FloatRegister src, FloatRegister dest) {
@@ -483,7 +483,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movzbl_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movsbl(const Operand &src, Register dest) {
@@ -495,7 +495,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movsbl_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movb(Register src, const Operand &dest) {
@@ -507,7 +507,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movb_rm(src.code(), dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movb(Imm32 src, const Operand &dest) {
@@ -519,7 +519,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movb_i8m(src.value, dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movzwl(const Operand &src, Register dest) {
@@ -534,7 +534,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movzwl_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movzwl(Register src, Register dest) {
@@ -549,7 +549,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movw_rm(src.code(), dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movw(Imm32 src, const Operand &dest) {
@@ -561,7 +561,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movw_i16m(src.value, dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movswl(const Operand &src, Register dest) {
@@ -573,7 +573,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.movswl_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void leal(const Operand &src, Register dest) {
@@ -585,7 +585,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.leal_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -670,7 +670,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.jmp_r(op.reg());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpEAX(Label *label) { cmpSrc(label); }
@@ -769,7 +769,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.call_m(op.disp(), op.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -804,7 +804,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.cmpl_mr(rhs.disp(), rhs.base(), lhs.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpl(Register src, Imm32 imm) {
@@ -825,7 +825,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.cmpl_im(imm.value, op.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpl(const Operand &lhs, Register rhs) {
@@ -840,7 +840,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.cmpl_rm(rhs.code(), lhs.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpl(const Operand &op, ImmWord imm) {
@@ -855,7 +855,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.cmpl_im(imm.value, op.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpl(const Operand &op, ImmPtr imm) {
@@ -893,7 +893,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.testl_i32m(rhs.value, lhs.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
             break;
         }
     }
@@ -913,7 +913,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.addl_im(imm.value, op.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void subl(Imm32 imm, Register dest) {
@@ -928,7 +928,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.subl_im(imm.value, op.disp(), op.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void addl(Register src, Register dest) {
@@ -946,7 +946,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.subl_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void subl(Register src, const Operand &dest) {
@@ -958,7 +958,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.subl_rm(src.code(), dest.disp(), dest.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void orl(Register reg, Register dest) {
@@ -976,7 +976,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.orl_im(imm.value, op.disp(), op.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void xorl(Register src, Register dest) {
@@ -994,7 +994,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.xorl_im(imm.value, op.disp(), op.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void andl(Register src, Register dest) {
@@ -1012,7 +1012,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.andl_im(imm.value, op.disp(), op.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void addl(const Operand &src, Register dest) {
@@ -1024,7 +1024,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.addl_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void orl(const Operand &src, Register dest) {
@@ -1036,7 +1036,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.orl_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void xorl(const Operand &src, Register dest) {
@@ -1048,7 +1048,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.xorl_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void andl(const Operand &src, Register dest) {
@@ -1060,7 +1060,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.andl_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void imull(Register multiplier) {
@@ -1084,7 +1084,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.imull_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void negl(const Operand &src) {
@@ -1096,7 +1096,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.negl_m(src.disp(), src.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void negl(Register reg) {
@@ -1111,7 +1111,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.notl_m(src.disp(), src.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void notl(Register reg) {
@@ -1142,7 +1142,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.incl_m32(op.disp(), op.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void lock_incl(const Operand &op) {
@@ -1156,7 +1156,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.decl_m32(op.disp(), op.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void lock_decl(const Operand &op) {
@@ -1171,7 +1171,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.cmpxchg32(src.code(), op.disp(), op.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -1184,7 +1184,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.xaddl_rm(srcdest.code(), mem.disp(), mem.base(), mem.index(), mem.scale());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -1201,7 +1201,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.push_m(src.disp(), src.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void push(Register src) {
@@ -1220,7 +1220,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.pop_m(src.disp(), src.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void pop(Register src) {
@@ -1276,7 +1276,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.pinsrd_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void psrldq(Imm32 shift, FloatRegister dest) {
@@ -1305,7 +1305,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.cvtsi2sd_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cvttsd2si(FloatRegister src, Register dest) {
@@ -1329,7 +1329,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.cvtsi2ss_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cvtsi2ss(Register src, FloatRegister dest) {
@@ -1393,7 +1393,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.addsd_mr(src.address(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void addss(const Operand &src, FloatRegister dest) {
@@ -1409,7 +1409,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.addss_mr(src.address(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void subsd(FloatRegister src, FloatRegister dest) {
@@ -1430,7 +1430,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.subsd_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void subss(const Operand &src, FloatRegister dest) {
@@ -1443,7 +1443,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.subss_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void mulsd(FloatRegister src, FloatRegister dest) {
@@ -1460,7 +1460,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.mulsd_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void mulss(const Operand &src, FloatRegister dest) {
@@ -1473,7 +1473,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.mulss_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void mulss(FloatRegister src, FloatRegister dest) {
@@ -1498,7 +1498,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.divsd_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void divss(const Operand &src, FloatRegister dest) {
@@ -1511,7 +1511,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.divss_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void xorpd(FloatRegister src, FloatRegister dest) {
@@ -1568,7 +1568,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.minsd_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void maxsd(FloatRegister src, FloatRegister dest) {
@@ -1585,7 +1585,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.maxsd_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void fisttp(const Operand &dest) {
@@ -1595,7 +1595,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.fisttp_m(dest.disp(), dest.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void fld(const Operand &dest) {
@@ -1604,7 +1604,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.fld_m(dest.disp(), dest.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void fstp(const Operand &src) {
@@ -1613,7 +1613,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.fstp_m(src.disp(), src.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void fstp32(const Operand &src) {
@@ -1622,7 +1622,7 @@ class AssemblerX86Shared : public AssemblerShared
             masm.fstp32_m(src.disp(), src.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -1673,14 +1673,14 @@ class AssemblerX86Shared : public AssemblerShared
     }
 
     static void PatchInstructionImmediate(uint8_t *code, PatchedImmPtr imm) {
-        MOZ_CRASH("Unused.");
+        MOZ_ASSUME_UNREACHABLE("Unused.");
     }
 
     static uint32_t NopSize() {
         return 1;
     }
     static uint8_t *NextInstruction(uint8_t *cur, uint32_t *count) {
-        MOZ_CRASH("nextInstruction NYI on x86");
+        MOZ_ASSUME_UNREACHABLE("nextInstruction NYI on x86");
     }
 
     // Toggle a jmp or cmp emitted by toggledJump().
diff --git a/js/src/jit/shared/CodeGenerator-shared-inl.h b/js/src/jit/shared/CodeGenerator-shared-inl.h
index bf46bd382d11..9539909d3deb 100644
--- a/js/src/jit/shared/CodeGenerator-shared-inl.h
+++ b/js/src/jit/shared/CodeGenerator-shared-inl.h
@@ -19,7 +19,7 @@ ToInt32(const LAllocation *a)
         return a->toConstant()->toInt32();
     if (a->isConstantIndex())
         return a->toConstantIndex()->index();
-    MOZ_CRASH("this is not a constant!");
+    MOZ_ASSUME_UNREACHABLE("this is not a constant!");
 }
 static inline double
 ToDouble(const LAllocation *a)
diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
index 6951b01cc2ee..a7c29b660e03 100644
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -343,7 +343,7 @@ CodeGeneratorShared::assignBailoutId(LSnapshot *snapshot)
     switch (gen->info().executionMode()) {
       case SequentialExecution: break;
       case ParallelExecution: return false;
-      default: MOZ_CRASH("No such execution mode");
+      default: MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     JS_ASSERT(frameClass_ != FrameSizeClass::None());
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.cpp b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
index 23ee73eff66c..019f8b9ede60 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -1326,7 +1326,7 @@ CodeGeneratorX86Shared::visitBitOpI(LBitOpI *ins)
                 masm.andl(ToOperand(rhs), ToRegister(lhs));
             break;
         default:
-            MOZ_CRASH("unexpected binary opcode");
+            MOZ_ASSUME_UNREACHABLE("unexpected binary opcode");
     }
 
     return true;
@@ -1360,7 +1360,7 @@ CodeGeneratorX86Shared::visitShiftI(LShiftI *ins)
             }
             break;
           default:
-            MOZ_CRASH("Unexpected shift op");
+            MOZ_ASSUME_UNREACHABLE("Unexpected shift op");
         }
     } else {
         JS_ASSERT(ToRegister(rhs) == ecx);
@@ -1381,7 +1381,7 @@ CodeGeneratorX86Shared::visitShiftI(LShiftI *ins)
             }
             break;
           default:
-            MOZ_CRASH("Unexpected shift op");
+            MOZ_ASSUME_UNREACHABLE("Unexpected shift op");
         }
     }
 
@@ -1523,7 +1523,7 @@ CodeGeneratorX86Shared::visitMathD(LMathD *math)
         masm.divsd(rhs, lhs);
         break;
       default:
-        MOZ_CRASH("unexpected opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected opcode");
     }
     return true;
 }
@@ -1550,7 +1550,7 @@ CodeGeneratorX86Shared::visitMathF(LMathF *math)
         masm.divss(rhs, lhs);
         break;
       default:
-        MOZ_CRASH("unexpected opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected opcode");
         return false;
     }
     return true;
diff --git a/js/src/jit/shared/IonAssemblerBuffer.h b/js/src/jit/shared/IonAssemblerBuffer.h
index 37c5e6df2f4f..e2b9616ab40f 100644
--- a/js/src/jit/shared/IonAssemblerBuffer.h
+++ b/js/src/jit/shared/IonAssemblerBuffer.h
@@ -243,7 +243,7 @@ struct AssemblerBuffer
             return BufferOffset(bufferSize);
     }
     BufferOffset prevOffset() const {
-        MOZ_CRASH("Don't current record lastInstSize");
+        MOZ_ASSUME_UNREACHABLE("Don't current record lastInstSize");
     }
 
     // Break the instruction stream so we can go back and edit it at this point
diff --git a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
index 68a64d85776a..de99f34fdd8c 100644
--- a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
+++ b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
@@ -1202,7 +1202,7 @@ struct AssemblerBufferWithConstantPool : public AssemblerBuffer<SliceSize, Inst>
             }
             start = poolGroup[idx].other->addPoolSize(start);
         }
-        MOZ_CRASH("Entry is not in a pool");
+        MOZ_ASSUME_UNREACHABLE("Entry is not in a pool");
     }
     void writePoolEntry(PoolEntry pe, uint8_t *buff) {
         size_t size = getPoolEntrySize(pe);
diff --git a/js/src/jit/shared/MacroAssembler-x86-shared.h b/js/src/jit/shared/MacroAssembler-x86-shared.h
index 4093613d48df..a7c8236245be 100644
--- a/js/src/jit/shared/MacroAssembler-x86-shared.h
+++ b/js/src/jit/shared/MacroAssembler-x86-shared.h
@@ -404,7 +404,7 @@ class MacroAssemblerX86Shared : public Assembler
             loadDouble(src.toBaseIndex(), dest);
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void storeDouble(FloatRegister src, const Address &dest) {
@@ -422,7 +422,7 @@ class MacroAssemblerX86Shared : public Assembler
             storeDouble(src, dest.toBaseIndex());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void moveDouble(FloatRegister src, FloatRegister dest) {
@@ -499,7 +499,7 @@ class MacroAssemblerX86Shared : public Assembler
             loadFloat32(src.toBaseIndex(), dest);
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void storeFloat32(FloatRegister src, const Address &dest) {
@@ -517,7 +517,7 @@ class MacroAssemblerX86Shared : public Assembler
             storeFloat32(src, dest.toBaseIndex());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void moveFloat32(FloatRegister src, FloatRegister dest) {
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.cpp b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
index ab6c74e9aa6a..35d63f8f47ee 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -142,7 +142,7 @@ MoveEmitterX86::emit(const MoveResolver &moves)
             emitGeneralMove(from, to);
             break;
           default:
-            MOZ_CRASH("Unexpected move type");
+            MOZ_ASSUME_UNREACHABLE("Unexpected move type");
         }
     }
 }
@@ -256,7 +256,7 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, MoveOp::Type type)
         masm.Push(toOperand(to));
         break;
       default:
-        MOZ_CRASH("Unexpected move type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected move type");
     }
 }
 
@@ -308,7 +308,7 @@ MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Type type)
         masm.Pop(toPopOperand(to));
         break;
       default:
-        MOZ_CRASH("Unexpected move type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected move type");
     }
 }
 
diff --git a/js/src/jit/x64/Assembler-x64.cpp b/js/src/jit/x64/Assembler-x64.cpp
index 2a702efdecde..ba0139ff43a3 100644
--- a/js/src/jit/x64/Assembler-x64.cpp
+++ b/js/src/jit/x64/Assembler-x64.cpp
@@ -44,7 +44,7 @@ ABIArgGenerator::next(MIRType type)
         current_ = ABIArg(FloatArgRegs[regIndex_++]);
         break;
       default:
-        MOZ_CRASH("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
     return current_;
 #else
@@ -68,7 +68,7 @@ ABIArgGenerator::next(MIRType type)
         current_ = ABIArg(FloatArgRegs[floatRegIndex_++]);
         break;
       default:
-        MOZ_CRASH("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
     return current_;
 #endif
diff --git a/js/src/jit/x64/Assembler-x64.h b/js/src/jit/x64/Assembler-x64.h
index f06a7ad57d47..ad9d60df275e 100644
--- a/js/src/jit/x64/Assembler-x64.h
+++ b/js/src/jit/x64/Assembler-x64.h
@@ -344,7 +344,7 @@ class Assembler : public AssemblerX86Shared
             masm.movq_mr(src.address(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movq(Register src, const Operand &dest) {
@@ -362,7 +362,7 @@ class Assembler : public AssemblerX86Shared
             masm.movq_rm(src.code(), dest.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movq(Imm32 imm32, const Operand &dest) {
@@ -380,7 +380,7 @@ class Assembler : public AssemblerX86Shared
             masm.movq_i32m(imm32.value, dest.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movq(Register src, FloatRegister dest) {
@@ -418,7 +418,7 @@ class Assembler : public AssemblerX86Shared
             masm.andq_mr(src.address(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -437,7 +437,7 @@ class Assembler : public AssemblerX86Shared
             masm.addq_im(imm.value, dest.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void addq(Register src, Register dest) {
@@ -455,7 +455,7 @@ class Assembler : public AssemblerX86Shared
             masm.addq_mr(src.address(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -477,7 +477,7 @@ class Assembler : public AssemblerX86Shared
             masm.subq_mr(src.address(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void subq(Register src, const Operand &dest) {
@@ -489,7 +489,7 @@ class Assembler : public AssemblerX86Shared
             masm.subq_rm(src.code(), dest.disp(), dest.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void shlq(Imm32 imm, Register dest) {
@@ -519,7 +519,7 @@ class Assembler : public AssemblerX86Shared
             masm.orq_mr(src.address(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void xorq(Register src, Register dest) {
@@ -578,7 +578,7 @@ class Assembler : public AssemblerX86Shared
             masm.leaq_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            MOZ_CRASH("unexepcted operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexepcted operand kind");
         }
     }
 
@@ -616,7 +616,7 @@ class Assembler : public AssemblerX86Shared
             masm.cmpq_rm(rhs.code(), lhs.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpq(const Operand &lhs, Imm32 rhs) {
@@ -631,7 +631,7 @@ class Assembler : public AssemblerX86Shared
             masm.cmpq_im(rhs.value, lhs.address());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpq(Register lhs, const Operand &rhs) {
@@ -643,7 +643,7 @@ class Assembler : public AssemblerX86Shared
             masm.cmpq_mr(rhs.disp(), rhs.base(), lhs.code());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpq(Register lhs, Register rhs) {
@@ -668,7 +668,8 @@ class Assembler : public AssemblerX86Shared
             masm.testq_i32m(rhs.value, lhs.disp(), lhs.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
+            break;
         }
     }
 
diff --git a/js/src/jit/x64/Bailouts-x64.cpp b/js/src/jit/x64/Bailouts-x64.cpp
index e95d050a42b4..3f8bb8ad7fe1 100644
--- a/js/src/jit/x64/Bailouts-x64.cpp
+++ b/js/src/jit/x64/Bailouts-x64.cpp
@@ -60,7 +60,7 @@ IonBailoutIterator::IonBailoutIterator(const JitActivationIterator &activations,
     switch (mode_) {
       case SequentialExecution: topIonScript_ = script()->ionScript(); break;
       case ParallelExecution: topIonScript_ = script()->parallelIonScript(); break;
-      default: MOZ_CRASH("No such execution mode");
+      default: MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
     snapshotOffset_ = bailout->snapshotOffset();
 }
diff --git a/js/src/jit/x64/BaselineIC-x64.cpp b/js/src/jit/x64/BaselineIC-x64.cpp
index caeae9b1cc10..ce8705a999a4 100644
--- a/js/src/jit/x64/BaselineIC-x64.cpp
+++ b/js/src/jit/x64/BaselineIC-x64.cpp
@@ -184,7 +184,7 @@ ICBinaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         }
         break;
       default:
-        MOZ_CRASH("Unhandled op in BinaryArith_Int32");
+        MOZ_ASSUME_UNREACHABLE("Unhandled op in BinaryArith_Int32");
     }
 
     // Return from stub.
@@ -233,7 +233,7 @@ ICUnaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.negl(R0.valueReg());
         break;
       default:
-        MOZ_CRASH("Unexpected op");
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 
     masm.tagValue(JSVAL_TYPE_INT32, R0.valueReg(), R0);
diff --git a/js/src/jit/x64/CodeGenerator-x64.cpp b/js/src/jit/x64/CodeGenerator-x64.cpp
index c8d6469cade0..dfcf70256191 100644
--- a/js/src/jit/x64/CodeGenerator-x64.cpp
+++ b/js/src/jit/x64/CodeGenerator-x64.cpp
@@ -54,7 +54,7 @@ FrameSizeClass::ClassLimit()
 uint32_t
 FrameSizeClass::frameSize() const
 {
-    MOZ_CRASH("x64 does not use frame size classes");
+    MOZ_ASSUME_UNREACHABLE("x64 does not use frame size classes");
 }
 
 bool
@@ -110,7 +110,7 @@ CodeGeneratorX64::visitUnbox(LUnbox *unbox)
             cond = masm.testSymbol(Assembler::NotEqual, value);
             break;
           default:
-            MOZ_CRASH("Given MIRType cannot be unboxed.");
+            MOZ_ASSUME_UNREACHABLE("Given MIRType cannot be unboxed.");
         }
         if (!bailoutIf(cond, unbox->snapshot()))
             return false;
@@ -133,7 +133,7 @@ CodeGeneratorX64::visitUnbox(LUnbox *unbox)
         masm.unboxSymbol(value, ToRegister(result));
         break;
       default:
-        MOZ_CRASH("Given MIRType cannot be unboxed.");
+        MOZ_ASSUME_UNREACHABLE("Given MIRType cannot be unboxed.");
     }
 
     return true;
@@ -231,13 +231,13 @@ CodeGeneratorX64::visitAsmJSUInt32ToFloat32(LAsmJSUInt32ToFloat32 *lir)
 bool
 CodeGeneratorX64::visitLoadTypedArrayElementStatic(LLoadTypedArrayElementStatic *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
 CodeGeneratorX64::visitStoreTypedArrayElementStatic(LStoreTypedArrayElementStatic *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
@@ -271,7 +271,7 @@ CodeGeneratorX64::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
       case Scalar::Uint32:  masm.movl(srcAddr, ToRegister(ins->output())); break;
       case Scalar::Float32: masm.loadFloat32(srcAddr, ToFloatRegister(ins->output())); break;
       case Scalar::Float64: masm.loadDouble(srcAddr, ToFloatRegister(ins->output())); break;
-      default: MOZ_CRASH("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
     uint32_t after = masm.size();
     if (!skipNote)
@@ -308,7 +308,7 @@ CodeGeneratorX64::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
           case Scalar::Uint16:  masm.movw(Imm32(ToInt32(ins->value())), dstAddr); break;
           case Scalar::Int32:
           case Scalar::Uint32:  masm.movl(Imm32(ToInt32(ins->value())), dstAddr); break;
-          default: MOZ_CRASH("unexpected array type");
+          default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
         }
     } else {
         switch (vt) {
@@ -320,7 +320,7 @@ CodeGeneratorX64::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
           case Scalar::Uint32:  masm.movl(ToRegister(ins->value()), dstAddr); break;
           case Scalar::Float32: masm.storeFloat32(ToFloatRegister(ins->value()), dstAddr); break;
           case Scalar::Float64: masm.storeDouble(ToFloatRegister(ins->value()), dstAddr); break;
-          default: MOZ_CRASH("unexpected array type");
+          default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
         }
     }
     uint32_t after = masm.size();
diff --git a/js/src/jit/x64/Lowering-x64.cpp b/js/src/jit/x64/Lowering-x64.cpp
index dd3869366122..eeee558d72bc 100644
--- a/js/src/jit/x64/Lowering-x64.cpp
+++ b/js/src/jit/x64/Lowering-x64.cpp
@@ -168,7 +168,7 @@ LIRGeneratorX64::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
         lir = new(alloc()) LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value()));
         break;
       default:
-        MOZ_CRASH("unexpected array type");
+        MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     return add(lir, ins);
@@ -183,5 +183,5 @@ LIRGeneratorX64::visitAsmJSLoadFuncPtr(MAsmJSLoadFuncPtr *ins)
 bool
 LIRGeneratorX64::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins)
 {
-    MOZ_CRASH("NYI");
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index de7ad34c8fcf..f159169e87d7 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -150,7 +150,7 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Type type)
             switch (type) {
               case MoveOp::FLOAT32: stackForCall_ += sizeof(float);  break;
               case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
-              default: MOZ_CRASH("Unexpected float register class argument type");
+              default: MOZ_ASSUME_UNREACHABLE("Unexpected float register class argument type");
             }
         }
         break;
@@ -170,7 +170,7 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Type type)
         break;
       }
       default:
-        MOZ_CRASH("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
 
     enoughMemory_ = moveResolver_.addMove(from, to, type);
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index bcecf3016c3e..a045e9bfdea9 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -113,7 +113,7 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
                            base.scale(), base.disp() + 4);
 
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     static inline Operand ToUpper32(const Address &address) {
diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
index 671a5a677e1d..82a9442ab677 100644
--- a/js/src/jit/x64/Trampoline-x64.cpp
+++ b/js/src/jit/x64/Trampoline-x64.cpp
@@ -519,7 +519,7 @@ GenerateParallelBailoutThunk(MacroAssembler &masm)
 JitCode *
 JitRuntime::generateBailoutTable(JSContext *cx, uint32_t frameClass)
 {
-    MOZ_CRASH("x64 does not use bailout tables");
+    MOZ_ASSUME_UNREACHABLE("x64 does not use bailout tables");
 }
 
 JitCode *
@@ -535,7 +535,7 @@ JitRuntime::generateBailoutHandler(JSContext *cx, ExecutionMode mode)
         GenerateParallelBailoutThunk(masm);
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     Linker linker(masm);
@@ -651,7 +651,7 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
             break;
           case VMFunction::DoubleByValue:
           case VMFunction::DoubleByRef:
-            MOZ_CRASH("NYI: x64 callVM should not be used with 128bits values.");
+            MOZ_ASSUME_UNREACHABLE("NYI: x64 callVM should not be used with 128bits values.");
         }
     }
 
@@ -671,7 +671,7 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         masm.j(Assembler::Zero, masm.failureLabel(f.executionMode));
         break;
       default:
-        MOZ_CRASH("unknown failure kind");
+        MOZ_ASSUME_UNREACHABLE("unknown failure kind");
     }
 
     // Load the outparam and free any allocated stack.
diff --git a/js/src/jit/x86/Assembler-x86.cpp b/js/src/jit/x86/Assembler-x86.cpp
index a63cfa7196d3..fb1c13d6a9f8 100644
--- a/js/src/jit/x86/Assembler-x86.cpp
+++ b/js/src/jit/x86/Assembler-x86.cpp
@@ -30,7 +30,7 @@ ABIArgGenerator::next(MIRType type)
         stackOffset_ += sizeof(uint64_t);
         break;
       default:
-        MOZ_CRASH("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
     return current_;
 }
diff --git a/js/src/jit/x86/Assembler-x86.h b/js/src/jit/x86/Assembler-x86.h
index fab7d83a6134..ef313f2e61c1 100644
--- a/js/src/jit/x86/Assembler-x86.h
+++ b/js/src/jit/x86/Assembler-x86.h
@@ -237,7 +237,7 @@ class Assembler : public AssemblerX86Shared
             writeDataRelocation(ptr);
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movl(ImmWord imm, Register dest) {
@@ -294,7 +294,7 @@ class Assembler : public AssemblerX86Shared
             masm.fld32_m(dest.disp(), dest.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -304,7 +304,7 @@ class Assembler : public AssemblerX86Shared
             masm.fstp32_m(src.disp(), src.base());
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -336,7 +336,7 @@ class Assembler : public AssemblerX86Shared
             writeDataRelocation(imm);
             break;
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpl(AsmJSAbsoluteAddress lhs, Register rhs) {
diff --git a/js/src/jit/x86/Bailouts-x86.cpp b/js/src/jit/x86/Bailouts-x86.cpp
index 7e372d403bc7..aab1f2af3126 100644
--- a/js/src/jit/x86/Bailouts-x86.cpp
+++ b/js/src/jit/x86/Bailouts-x86.cpp
@@ -80,7 +80,7 @@ IonBailoutIterator::IonBailoutIterator(const JitActivationIterator &activations,
     switch (mode_) {
       case SequentialExecution: topIonScript_ = script()->ionScript(); break;
       case ParallelExecution: topIonScript_ = script()->parallelIonScript(); break;
-      default: MOZ_CRASH("No such execution mode");
+      default: MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     if (bailout->frameClass() == FrameSizeClass::None()) {
diff --git a/js/src/jit/x86/BaselineIC-x86.cpp b/js/src/jit/x86/BaselineIC-x86.cpp
index ff781355fa8e..c220711c7573 100644
--- a/js/src/jit/x86/BaselineIC-x86.cpp
+++ b/js/src/jit/x86/BaselineIC-x86.cpp
@@ -191,7 +191,7 @@ ICBinaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         }
         break;
       default:
-       MOZ_CRASH("Unhandled op for BinaryArith_Int32.  ");
+       MOZ_ASSUME_UNREACHABLE("Unhandled op for BinaryArith_Int32.  ");
     }
 
     // Return.
@@ -252,7 +252,7 @@ ICUnaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.negl(R0.payloadReg());
         break;
       default:
-        MOZ_CRASH("Unexpected op");
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 
     EmitReturnFromIC(masm);
diff --git a/js/src/jit/x86/CodeGenerator-x86.cpp b/js/src/jit/x86/CodeGenerator-x86.cpp
index cb2598a2e6e2..3ce89c66534a 100644
--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@@ -296,7 +296,7 @@ CodeGeneratorX86::loadViewTypeElement(Scalar::Type vt, const T &srcAddr,
       case Scalar::Uint32:  masm.movlWithPatch(srcAddr, ToRegister(out)); break;
       case Scalar::Float32: masm.movssWithPatch(srcAddr, ToFloatRegister(out)); break;
       case Scalar::Float64: masm.movsdWithPatch(srcAddr, ToFloatRegister(out)); break;
-      default: MOZ_CRASH("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 }
 
@@ -417,7 +417,7 @@ CodeGeneratorX86::storeViewTypeElement(Scalar::Type vt, const LAllocation *value
       case Scalar::Uint32:  masm.movlWithPatch(ToRegister(value), dstAddr); break;
       case Scalar::Float32: masm.movssWithPatch(ToFloatRegister(value), dstAddr); break;
       case Scalar::Float64: masm.movsdWithPatch(ToFloatRegister(value), dstAddr); break;
-      default: MOZ_CRASH("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 }
 
@@ -576,7 +576,7 @@ DispatchIonCache::initializeAddCacheState(LInstruction *ins, AddCacheState *addS
 {
     // On x86, where there is no general purpose scratch register available,
     // child cache classes must manually specify a dispatch scratch register.
-    MOZ_CRASH("x86 needs manual assignment of dispatchScratch");
+    MOZ_ASSUME_UNREACHABLE("x86 needs manual assignment of dispatchScratch");
 }
 
 void
diff --git a/js/src/jit/x86/Lowering-x86.cpp b/js/src/jit/x86/Lowering-x86.cpp
index ac7b8912a7f0..8dbbfa5aaef3 100644
--- a/js/src/jit/x86/Lowering-x86.cpp
+++ b/js/src/jit/x86/Lowering-x86.cpp
@@ -254,7 +254,7 @@ LIRGeneratorX86::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
             // See comment below.
             lir = new(alloc()) LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value()));
             break;
-          default: MOZ_CRASH("unexpected array type");
+          default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
         }
         return add(lir, ins);
     }
@@ -271,7 +271,7 @@ LIRGeneratorX86::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
         // affects instruction layout which affects patching.
         lir = new(alloc()) LAsmJSStoreHeap(useRegisterAtStart(ptr), useRegisterAtStart(ins->value()));
         break;
-      default: MOZ_CRASH("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     return add(lir, ins);
@@ -295,7 +295,7 @@ LIRGeneratorX86::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic
         lir = new(alloc()) LStoreTypedArrayElementStatic(useRegisterAtStart(ins->ptr()),
                                                          useRegisterAtStart(ins->value()));
         break;
-      default: MOZ_CRASH("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     return add(lir, ins);
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index 0c46c7e2f3a6..b71a84ad15ab 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -173,7 +173,7 @@ MacroAssemblerX86::passABIArg(const MoveOperand &from, MoveOp::Type type)
       case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
       case MoveOp::INT32:   stackForCall_ += sizeof(int32_t); break;
       case MoveOp::GENERAL: stackForCall_ += sizeof(intptr_t); break;
-      default: MOZ_CRASH("Unexpected argument type");
+      default: MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
     enoughMemory_ &= moveResolver_.addMove(from, to, type);
 }
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index a3bd5181c6da..f5ea5d3c4592 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -102,7 +102,7 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
                            base.scale(), base.disp() + sizeof(void *));
 
           default:
-            MOZ_CRASH("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     Address ToType(Address base) {
diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
index 787308b8f79f..fb9ec21e18ef 100644
--- a/js/src/jit/x86/Trampoline-x86.cpp
+++ b/js/src/jit/x86/Trampoline-x86.cpp
@@ -575,7 +575,7 @@ JitRuntime::generateBailoutHandler(JSContext *cx, ExecutionMode mode)
         GenerateParallelBailoutThunk(masm, NO_FRAME_SIZE_CLASS_ID);
         break;
       default:
-        MOZ_CRASH("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     Linker linker(masm);
@@ -711,7 +711,7 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         masm.j(Assembler::Zero, masm.failureLabel(f.executionMode));
         break;
       default:
-        MOZ_CRASH("unknown failure kind");
+        MOZ_ASSUME_UNREACHABLE("unknown failure kind");
     }
 
     // Load the outparam and free any allocated stack.
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index ceaa920cdcd0..32cda5b05801 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -813,6 +813,12 @@ GetStringLength(JSString *s)
     return reinterpret_cast<shadow::String*>(s)->length;
 }
 
+MOZ_ALWAYS_INLINE size_t
+GetFlatStringLength(JSFlatString *s)
+{
+    return reinterpret_cast<shadow::String*>(s)->length;
+}
+
 MOZ_ALWAYS_INLINE bool
 LinearStringHasLatin1Chars(JSLinearString *s)
 {
@@ -861,6 +867,12 @@ AtomToLinearString(JSAtom *atom)
     return reinterpret_cast<JSLinearString *>(atom);
 }
 
+MOZ_ALWAYS_INLINE JSLinearString *
+FlatStringToLinearString(JSFlatString *s)
+{
+    return reinterpret_cast<JSLinearString *>(s);
+}
+
 MOZ_ALWAYS_INLINE const JS::Latin1Char *
 GetLatin1AtomChars(const JS::AutoCheckCannotGC &nogc, JSAtom *atom)
 {
@@ -886,6 +898,20 @@ StringToLinearString(JSContext *cx, JSString *str)
     return reinterpret_cast<JSLinearString *>(str);
 }
 
+MOZ_ALWAYS_INLINE void
+CopyLinearStringChars(jschar *dest, JSLinearString *s, size_t len)
+{
+    JS::AutoCheckCannotGC nogc;
+    if (LinearStringHasLatin1Chars(s)) {
+        const JS::Latin1Char *src = GetLatin1LinearStringChars(nogc, s);
+        for (size_t i = 0; i < len; i++)
+            dest[i] = src[i];
+    } else {
+        const jschar *src = GetTwoByteLinearStringChars(nogc, s);
+        mozilla::PodCopy(dest, src, len);
+    }
+}
+
 inline bool
 CopyStringChars(JSContext *cx, jschar *dest, JSString *s, size_t len)
 {
@@ -893,19 +919,16 @@ CopyStringChars(JSContext *cx, jschar *dest, JSString *s, size_t len)
     if (!linear)
         return false;
 
-    JS::AutoCheckCannotGC nogc;
-    if (LinearStringHasLatin1Chars(linear)) {
-        const JS::Latin1Char *src = GetLatin1LinearStringChars(nogc, linear);
-        for (size_t i = 0; i < len; i++)
-            dest[i] = src[i];
-    } else {
-        const jschar *src = GetTwoByteLinearStringChars(nogc, linear);
-        mozilla::PodCopy(dest, src, len);
-    }
-
+    CopyLinearStringChars(dest, linear, len);
     return true;
 }
 
+inline void
+CopyFlatStringChars(jschar *dest, JSFlatString *s, size_t len)
+{
+    CopyLinearStringChars(dest, FlatStringToLinearString(s), len);
+}
+
 JS_FRIEND_API(bool)
 GetPropertyNames(JSContext *cx, JSObject *obj, unsigned flags, JS::AutoIdVector *props);
 
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index dd2fa1517256..804b8a168ee8 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -175,6 +175,7 @@
 
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/DebugOnly.h"
+#include "mozilla/MacroForEach.h"
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/Move.h"
 
@@ -255,7 +256,14 @@ const AllocKind gc::slotsToThingKind[] = {
 static_assert(JS_ARRAY_LENGTH(slotsToThingKind) == SLOTS_TO_THING_KIND_LIMIT,
               "We have defined a slot count for each kind.");
 
-const uint32_t Arena::ThingSizes[] = {
+// Assert that SortedArenaList::MinThingSize is <= the real minimum thing size.
+#define CHECK_MIN_THING_SIZE_INNER(x_)                                         \
+    static_assert(x_ >= SortedArenaList::MinThingSize,                         \
+    #x_ " is less than SortedArenaList::MinThingSize!");
+#define CHECK_MIN_THING_SIZE(...) { __VA_ARGS__ }; /* Define the array. */     \
+    MOZ_FOR_EACH(CHECK_MIN_THING_SIZE_INNER, (), (__VA_ARGS__ UINT32_MAX))
+
+const uint32_t Arena::ThingSizes[] = CHECK_MIN_THING_SIZE(
     sizeof(JSObject),           /* FINALIZE_OBJECT0             */
     sizeof(JSObject),           /* FINALIZE_OBJECT0_BACKGROUND  */
     sizeof(JSObject_Slots2),    /* FINALIZE_OBJECT2             */
@@ -278,7 +286,10 @@ const uint32_t Arena::ThingSizes[] = {
     sizeof(JSExternalString),   /* FINALIZE_EXTERNAL_STRING     */
     sizeof(JS::Symbol),         /* FINALIZE_SYMBOL              */
     sizeof(jit::JitCode),       /* FINALIZE_JITCODE             */
-};
+);
+
+#undef CHECK_MIN_THING_SIZE_INNER
+#undef CHECK_MIN_THING_SIZE
 
 #define OFFSET(type) uint32_t(sizeof(ArenaHeader) + (ArenaSize - sizeof(ArenaHeader)) % sizeof(type))
 
@@ -450,7 +461,7 @@ Arena::setAsFullyUnused(AllocKind thingKind)
 }
 
 template<typename T>
-inline bool
+inline size_t
 Arena::finalize(FreeOp *fop, AllocKind thingKind, size_t thingSize)
 {
     /* Enforce requirements on size of T. */
@@ -496,7 +507,7 @@ Arena::finalize(FreeOp *fop, AllocKind thingKind, size_t thingSize)
         // Do nothing. The caller will update the arena header appropriately.
         JS_ASSERT(newListTail == &newListHead);
         JS_EXTRA_POISON(data, JS_SWEPT_TENURED_PATTERN, sizeof(data));
-        return true;
+        return nmarked;
     }
 
     JS_ASSERT(firstThingOrSuccessorOfLastMarkedThing != firstThing);
@@ -517,20 +528,38 @@ Arena::finalize(FreeOp *fop, AllocKind thingKind, size_t thingSize)
     JS_ASSERT(nfree + nmarked == thingsPerArena(thingSize));
 #endif
     aheader.setFirstFreeSpan(&newListHead);
-    return false;
+    return nmarked;
+}
+
+ArenaList 
+SortedArenaList::toArenaList()
+{
+    // Link the non-empty segment tails up to the non-empty segment heads.
+    size_t tailIndex = 0;
+    for (size_t headIndex = 1; headIndex <= thingsPerArena_; ++headIndex) {
+        if (headAt(headIndex)) {
+            segments[tailIndex].linkTo(headAt(headIndex));
+            tailIndex = headIndex;
+        }
+    }
+    // Point the tail of the final non-empty segment at null. Note that if the
+    // list is empty, this will just set segments[0].head to null, a noop.
+    segments[tailIndex].linkTo(nullptr);
+    // Return an ArenaList representing the flattened list.
+    return ArenaList(segments[0]);
 }
 
 template<typename T>
 static inline bool
 FinalizeTypedArenas(FreeOp *fop,
                     ArenaHeader **src,
-                    ArenaList &dest,
+                    SortedArenaList &dest,
                     AllocKind thingKind,
                     SliceBudget &budget)
 {
     /*
      * Finalize arenas from src list, releasing empty arenas and inserting the
-     * others into dest in an appropriate position.
+     * others into the appropriate destination size bins.
      */
 
     /*
@@ -541,22 +570,24 @@ FinalizeTypedArenas(FreeOp *fop,
     bool releaseArenas = !InParallelSection();
 
     size_t thingSize = Arena::thingSize(thingKind);
+    size_t thingsPerArena = Arena::thingsPerArena(thingSize);
 
     while (ArenaHeader *aheader = *src) {
         *src = aheader->next;
-        bool allClear = aheader->getArena()->finalize<T>(fop, thingKind, thingSize);
-        if (!allClear)
-            dest.insertAtCursor(aheader);
+        size_t nmarked = aheader->getArena()->finalize<T>(fop, thingKind, thingSize);
+        size_t nfree = thingsPerArena - nmarked;
+
+        if (nmarked)
+            dest.insertAt(aheader, nfree);
         else if (releaseArenas)
             aheader->chunk()->releaseArena(aheader);
         else
-            aheader->chunk()->recycleArena(aheader, dest, thingKind);
+            aheader->chunk()->recycleArena(aheader, dest, thingKind, thingsPerArena);
 
-        budget.step(Arena::thingsPerArena(thingSize));
+        budget.step(thingsPerArena);
         if (budget.isOverBudget())
             return false;
     }
-    dest.deepCheck();
 
     return true;
 }
@@ -568,7 +599,7 @@ FinalizeTypedArenas(FreeOp *fop,
 static bool
 FinalizeArenas(FreeOp *fop,
                ArenaHeader **src,
-               ArenaList &dest,
+               SortedArenaList &dest,
                AllocKind thingKind,
                SliceBudget &budget)
 {
@@ -965,10 +996,11 @@ Chunk::addArenaToFreeList(JSRuntime *rt, ArenaHeader *aheader)
 }
 
 void
-Chunk::recycleArena(ArenaHeader *aheader, ArenaList &dest, AllocKind thingKind)
+Chunk::recycleArena(ArenaHeader *aheader, SortedArenaList &dest, AllocKind thingKind,
+                    size_t thingsPerArena)
 {
     aheader->getArena()->setAsFullyUnused(thingKind);
-    dest.insertAtCursor(aheader);
+    dest.insertAt(aheader, thingsPerArena);
 }
 
 void
@@ -1893,10 +1925,6 @@ ArenaLists::allocateFromArenaInline(Zone *zone, AllocKind thingKind,
      * While we still hold the GC lock get an arena from some chunk, mark it
      * as full as its single free span is moved to the free lists, and insert
      * it to the list as a fully allocated arena.
-     *
-     * We add the arena before the the head, so that after the GC the most
-     * recently added arena will be used first for allocations. This improves
-     * cache locality.
      */
     JS_ASSERT(al->isCursorAtEnd());
     aheader = chunk->allocateArena(zone, thingKind);
@@ -1905,7 +1933,7 @@ ArenaLists::allocateFromArenaInline(Zone *zone, AllocKind thingKind,
 
     if (MOZ_UNLIKELY(zone->wasGCStarted()))
         rt->gc.arenaAllocatedDuringGC(zone, aheader);
-    al->insertAtStart(aheader);
+    al->insertAtCursor(aheader);
 
     /*
      * Allocate from a newly allocated arena. The arena will have been set up
@@ -1978,9 +2006,14 @@ ArenaLists::forceFinalizeNow(FreeOp *fop, AllocKind thingKind)
     ArenaHeader *arenas = arenaLists[thingKind].head();
     arenaLists[thingKind].clear();
 
+    size_t thingsPerArena = Arena::thingsPerArena(Arena::thingSize(thingKind));
+    SortedArenaList finalizedSorted(thingsPerArena);
+
     SliceBudget budget;
-    FinalizeArenas(fop, &arenas, arenaLists[thingKind], thingKind, budget);
+    FinalizeArenas(fop, &arenas, finalizedSorted, thingKind, budget);
     JS_ASSERT(!arenas);
+
+    arenaLists[thingKind] = finalizedSorted.toArenaList();
 }
 
 void
@@ -2028,23 +2061,31 @@ ArenaLists::backgroundFinalize(FreeOp *fop, ArenaHeader *listHead, bool onBackgr
     AllocKind thingKind = listHead->getAllocKind();
     Zone *zone = listHead->zone;
 
-    ArenaList finalized;
+    size_t thingsPerArena = Arena::thingsPerArena(Arena::thingSize(thingKind));
+    SortedArenaList finalizedSorted(thingsPerArena);
+
     SliceBudget budget;
-    FinalizeArenas(fop, &listHead, finalized, thingKind, budget);
+    FinalizeArenas(fop, &listHead, finalizedSorted, thingKind, budget);
     JS_ASSERT(!listHead);
 
-    // When arenas are queued for background finalization, all
-    // arenas are moved to arenaListsToSweep[], leaving the arenaLists[] empty.
-    // Then, if new arenas are allocated before background finalization
-    // finishes they are always added to the front of the list. Therefore,
-    // at this point, |al|'s cursor will always be at the end of its list.
+    // When arenas are queued for background finalization, all arenas are moved
+    // to arenaListsToSweep[], leaving the arenaLists[] empty. However, new
+    // arenas may be allocated before background finalization finishes; now that
+    // finalization is complete, we want to merge these lists back together.
     ArenaLists *lists = &zone->allocator.arenas;
     ArenaList *al = &lists->arenaLists[thingKind];
 
+    // Flatten |finalizedSorted| into a regular ArenaList.
+    ArenaList finalized = finalizedSorted.toArenaList();
+
+    // Store this for later, since merging may change the state of |finalized|.
+    bool allClear = finalized.isEmpty();
+
     AutoLockGC lock(fop->runtime());
     JS_ASSERT(lists->backgroundFinalizeState[thingKind] == BFS_RUN);
 
-    al->appendToListWithCursorAtEnd(finalized);
+    // Join |al| and |finalized| into a single list.
+    *al = finalized.insertListWithCursorAtEnd(*al);
 
     /*
      * We must set the state to BFS_JUST_FINISHED if we are running on the
@@ -2055,7 +2096,7 @@ ArenaLists::backgroundFinalize(FreeOp *fop, ArenaHeader *listHead, bool onBackgr
      * allocating new arenas from the chunks we can set the state to BFS_DONE if
      * we have released all finalized arenas back to their chunks.
      */
-    if (onBackgroundThread && !finalized.isEmpty())
+    if (onBackgroundThread && !allClear)
         lists->backgroundFinalizeState[thingKind] = BFS_JUST_FINISHED;
     else
         lists->backgroundFinalizeState[thingKind] = BFS_DONE;
@@ -4314,13 +4355,17 @@ GCRuntime::beginSweepPhase(bool lastGC)
 }
 
 bool
-ArenaLists::foregroundFinalize(FreeOp *fop, AllocKind thingKind, SliceBudget &sliceBudget)
+ArenaLists::foregroundFinalize(FreeOp *fop, AllocKind thingKind, SliceBudget &sliceBudget,
+                               SortedArenaList &sweepList)
 {
-    if (!arenaListsToSweep[thingKind])
-        return true;
+    if (!FinalizeArenas(fop, &arenaListsToSweep[thingKind], sweepList, thingKind, sliceBudget))
+        return false;
 
-    ArenaList &dest = arenaLists[thingKind];
-    return FinalizeArenas(fop, &arenaListsToSweep[thingKind], dest, thingKind, sliceBudget);
+    // Join |arenaLists[thingKind]| and |sweepList| into a single list.
+    ArenaList finalized = sweepList.toArenaList();
+    arenaLists[thingKind] = finalized.insertListWithCursorAtEnd(arenaLists[thingKind]);
+
+    return true;
 }
 
 bool
@@ -4352,9 +4397,17 @@ GCRuntime::sweepPhase(SliceBudget &sliceBudget)
                 while (sweepKindIndex < FinalizePhaseLength[finalizePhase]) {
                     AllocKind kind = FinalizePhases[finalizePhase][sweepKindIndex];
 
-                    if (!zone->allocator.arenas.foregroundFinalize(&fop, kind, sliceBudget))
+                    /* Set the number of things per arena for this AllocKind. */
+                    size_t thingsPerArena = Arena::thingsPerArena(Arena::thingSize(kind));
+                    incrementalSweepList.setThingsPerArena(thingsPerArena);
+
+                    if (!zone->allocator.arenas.foregroundFinalize(&fop, kind, sliceBudget,
+                                                                   incrementalSweepList))
                         return false;  /* Yield to the mutator. */
 
+                    /* Reset the slots of the sweep list that we used. */
+                    incrementalSweepList.reset(thingsPerArena);
+
                     ++sweepKindIndex;
                 }
                 sweepKindIndex = 0;
@@ -5727,8 +5780,8 @@ ArenaLists::adoptArenas(JSRuntime *rt, ArenaLists *fromArenaLists)
 #endif
         ArenaList *fromList = &fromArenaLists->arenaLists[thingKind];
         ArenaList *toList = &arenaLists[thingKind];
-        fromList->deepCheck();
-        toList->deepCheck();
+        fromList->check();
+        toList->check();
         ArenaHeader *next;
         for (ArenaHeader *fromHeader = fromList->head(); fromHeader; fromHeader = next) {
             // Copy fromHeader->next before releasing/reinserting.
@@ -5744,7 +5797,7 @@ ArenaLists::adoptArenas(JSRuntime *rt, ArenaLists *fromArenaLists)
                 toList->insertAtCursor(fromHeader);
         }
         fromList->clear();
-        toList->deepCheck();
+        toList->check();
     }
 }
 
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 4a0a01a511d7..99e95615a6b8 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -383,6 +383,90 @@ GetGCKindSlots(AllocKind thingKind, const Class *clasp)
 // above locks is held.
 class AutoMaybeStartBackgroundAllocation;
 
+// A single segment of a SortedArenaList. Each segment has a head and a tail,
+// which track the start and end of a segment for O(1) append and concatenation.
+struct SortedArenaListSegment
+{
+    ArenaHeader *head;
+    ArenaHeader **tailp;
+
+    void clear() {
+        head = nullptr;
+        tailp = &head;
+    }
+
+    bool isEmpty() const {
+        return tailp == &head;
+    }
+
+    // Appends |aheader| to this segment.
+    void append(ArenaHeader *aheader) {
+        JS_ASSERT(aheader);
+        JS_ASSERT_IF(head, head->getAllocKind() == aheader->getAllocKind());
+        *tailp = aheader;
+        tailp = &aheader->next;
+    }
+
+    // Points the tail of this segment at |aheader|, which may be null.
+    void linkTo(ArenaHeader *aheader) {
+        *tailp = aheader;
+    }
+};
+
+// A class that holds arenas in sorted order by appending arenas to specific
+// segments. SortedArenaLists can be flattened to a regular ArenaList.
+class SortedArenaList
+{
+  public:
+    // The minimum size, in bytes, of a GC thing.
+    static const size_t MinThingSize = 16;
+
+    static_assert(ArenaSize <= 4096, "When increasing the Arena size, please consider how"\
+                                     " this will affect the size of a SortedArenaList.");
+
+    static_assert(MinThingSize >= 16, "When decreasing the minimum thing size, please consider"\
+                                      " how this will affect the size of a SortedArenaList.");
+
+  private:
+    // The maximum number of GC things that an arena can hold.
+    static const size_t MaxThingsPerArena = (ArenaSize - sizeof(ArenaHeader)) / MinThingSize;
+
+    size_t thingsPerArena_;
+    SortedArenaListSegment segments[MaxThingsPerArena + 1];
+
+    // Convenience functions to get the nth head and tail.
+    ArenaHeader *headAt(size_t n) { return segments[n].head; }
+    ArenaHeader **tailAt(size_t n) { return segments[n].tailp; }
+
+  public:
+    explicit SortedArenaList(size_t thingsPerArena = MaxThingsPerArena) {
+        reset(thingsPerArena);
+    }
+
+    void setThingsPerArena(size_t thingsPerArena) {
+        JS_ASSERT(thingsPerArena && thingsPerArena <= MaxThingsPerArena);
+        thingsPerArena_ = thingsPerArena;
+    }
+
+    // Resets the first |thingsPerArena| segments of this list for further use.
+    void reset(size_t thingsPerArena = MaxThingsPerArena) {
+        setThingsPerArena(thingsPerArena);
+        // Initialize the segments.
+        for (size_t i = 0; i <= thingsPerArena; ++i)
+            segments[i].clear();
+    }
+
+    // Inserts a header, which has room for |nfree| more things, in its segment.
+    void insertAt(ArenaHeader *aheader, size_t nfree) {
+        JS_ASSERT(nfree <= thingsPerArena_);
+        segments[nfree].append(aheader);
+    }
+
+    // Flattens the SortedArenaList into a regular ArenaList. Although we don't
+    // expect to do this more than once, note this operation is not destructive.
+    ArenaList toArenaList();
+};
+
 /*
  * Arena lists have a head and a cursor. The cursor conceptually lies on arena
  * boundaries, i.e. before the first arena, between two arenas, or after the
@@ -425,11 +509,33 @@ class ArenaList {
     ArenaHeader     *head_;
     ArenaHeader     **cursorp_;
 
+    void copy(const ArenaList &other) {
+        other.check();
+        head_ = other.head_;
+        cursorp_ = other.isCursorAtHead() ? &head_ : other.cursorp_;
+        check();
+    }
+
   public:
     ArenaList() {
         clear();
     }
 
+    ArenaList(const ArenaList &other) {
+        copy(other);
+    }
+
+    ArenaList &operator=(const ArenaList &other) {
+        copy(other);
+        return *this;
+    }
+    
+    ArenaList(const SortedArenaListSegment &segment) {
+        head_ = segment.head;
+        cursorp_ = segment.isEmpty() ? &head_ : segment.tailp;
+        check();
+    }
+    
     // This does checking just of |head_| and |cursorp_|.
     void check() const {
 #ifdef DEBUG
@@ -442,28 +548,6 @@ class ArenaList {
 #endif
     }
 
-    // This does checking involving all the arenas in the list.
-    void deepCheck() const {
-#ifdef DEBUG
-        check();
-        // All full arenas must precede all non-full arenas.
-        //
-        // XXX: this is currently commented out because it fails moderately
-        // often. I'm not sure if this is because (a) it's not true that all
-        // full arenas must precede all non-full arenas, or (b) we have some
-        // defective list-handling code.
-        //
-//      bool havePassedFullArenas = false;
-//      for (ArenaHeader *aheader = head_; aheader; aheader = aheader->next) {
-//          if (havePassedFullArenas) {
-//              JS_ASSERT(aheader->hasFreeThings());
-//          } else if (aheader->hasFreeThings()) {
-//              havePassedFullArenas = true;
-//          }
-//      }
-#endif
-    }
-
     void clear() {
         head_ = nullptr;
         cursorp_ = &head_;
@@ -481,6 +565,11 @@ class ArenaList {
         return head_;
     }
 
+    bool isCursorAtHead() const {
+        check();
+        return cursorp_ == &head_;
+    }
+
     bool isCursorAtEnd() const {
         check();
         return !*cursorp_;
@@ -515,33 +604,19 @@ class ArenaList {
         check();
     }
 
-    // This inserts |a| at the start of the list, and doesn't change the
-    // cursor.
-    void insertAtStart(ArenaHeader *a) {
+    // This inserts |other|, which must be full, at the cursor of |this|.
+    ArenaList &insertListWithCursorAtEnd(const ArenaList &other) {
         check();
-        a->next = head_;
-        if (isEmpty())
-            cursorp_ = &a->next;        // The cursor remains null.
-        head_ = a;
+        other.check();
+        JS_ASSERT(other.isCursorAtEnd());
+        if (other.isCursorAtHead())
+            return *this;
+        // Insert the full arenas of |other| after those of |this|.
+        *other.cursorp_ = *cursorp_;
+        *cursorp_ = other.head_;
+        cursorp_ = other.cursorp_;
         check();
-    }
-
-    // Appends |list|. |this|'s cursor must be at the end.
-    void appendToListWithCursorAtEnd(ArenaList &other) {
-        JS_ASSERT(isCursorAtEnd());
-        deepCheck();
-        other.deepCheck();
-        if (!other.isEmpty()) {
-            // Because |this|'s cursor is at the end, |cursorp_| points to the
-            // list-ending null. So this assignment appends |other| to |this|.
-            *cursorp_ = other.head_;
-
-            // If |other|'s cursor isn't at the start of the list, then update
-            // |this|'s cursor accordingly.
-            if (other.cursorp_ != &other.head_)
-                cursorp_ = other.cursorp_;
-        }
-        deepCheck();
+        return *this;
     }
 };
 
@@ -800,7 +875,8 @@ class ArenaLists
     void queueScriptsForSweep(FreeOp *fop);
     void queueJitCodeForSweep(FreeOp *fop);
 
-    bool foregroundFinalize(FreeOp *fop, AllocKind thingKind, SliceBudget &sliceBudget);
+    bool foregroundFinalize(FreeOp *fop, AllocKind thingKind, SliceBudget &sliceBudget,
+                            SortedArenaList &sweepList);
     static void backgroundFinalize(FreeOp *fop, ArenaHeader *listHead, bool onBackgroundThread);
 
     void wipeDuringParallelExecution(JSRuntime *rt);
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 65d5c8f89456..ea65950a3fdd 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -168,6 +168,13 @@ FinishObjectClassInit(JSContext *cx, JS::HandleObject ctor, JS::HandleObject pro
         return false;
     }
 
+    /*
+     * Define self-hosted functions after setting the intrinsics holder
+     * (which is needed to define self-hosted functions)
+     */
+    if (!JS_DefineFunctions(cx, ctor, object_static_selfhosted_methods))
+        return false;
+
     /*
      * The global object should have |Object.prototype| as its [[Prototype]].
      * Eventually we'd like to have standard classes be there from the start,
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index e7552648f2cb..4d6ac2be3a71 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -9,6 +9,7 @@
 
 #include "jsobj.h"
 
+#include "builtin/TypedObject.h"
 #include "vm/ArrayObject.h"
 #include "vm/DateObject.h"
 #include "vm/NumberObject.h"
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 5a28230b93f8..1dc0e3169fa9 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -1756,8 +1756,6 @@ ScriptSource::~ScriptSource()
     if (introducerFilename_ != filename_)
         js_free(introducerFilename_);
     js_free(filename_);
-    js_free(displayURL_);
-    js_free(sourceMapURL_);
     if (originPrincipals_)
         JS_DropPrincipals(TlsPerThreadData.get()->runtimeFromMainThread(), originPrincipals_);
 }
@@ -1858,22 +1856,18 @@ ScriptSource::performXDR(XDRState<mode> *xdr)
         return false;
 
     if (haveSourceMap) {
-        uint32_t sourceMapURLLen = (mode == XDR_DECODE) ? 0 : js_strlen(sourceMapURL_);
+        uint32_t sourceMapURLLen = (mode == XDR_DECODE) ? 0 : js_strlen(sourceMapURL_.get());
         if (!xdr->codeUint32(&sourceMapURLLen))
             return false;
 
         if (mode == XDR_DECODE) {
-            size_t byteLen = (sourceMapURLLen + 1) * sizeof(jschar);
-            MOZ_ASSERT(!sourceMapURL_, "Don't leak sourceMapURL_");
-            sourceMapURL_ = static_cast<jschar *>(xdr->cx()->malloc_(byteLen));
+            sourceMapURL_ = xdr->cx()->template make_pod_array<jschar>(sourceMapURLLen + 1);
             if (!sourceMapURL_)
                 return false;
         }
-        if (!xdr->codeChars(sourceMapURL_, sourceMapURLLen)) {
-            if (mode == XDR_DECODE) {
-                js_free(sourceMapURL_);
+        if (!xdr->codeChars(sourceMapURL_.get(), sourceMapURLLen)) {
+            if (mode == XDR_DECODE)
                 sourceMapURL_ = nullptr;
-            }
             return false;
         }
         sourceMapURL_[sourceMapURLLen] = '\0';
@@ -1884,21 +1878,18 @@ ScriptSource::performXDR(XDRState<mode> *xdr)
         return false;
 
     if (haveDisplayURL) {
-        uint32_t displayURLLen = (mode == XDR_DECODE) ? 0 : js_strlen(displayURL_);
+        uint32_t displayURLLen = (mode == XDR_DECODE) ? 0 : js_strlen(displayURL_.get());
         if (!xdr->codeUint32(&displayURLLen))
             return false;
 
         if (mode == XDR_DECODE) {
-            size_t byteLen = (displayURLLen + 1) * sizeof(jschar);
-            displayURL_ = static_cast<jschar *>(xdr->cx()->malloc_(byteLen));
+            displayURL_ = xdr->cx()->template make_pod_array<jschar>(displayURLLen + 1);
             if (!displayURL_)
                 return false;
         }
-        if (!xdr->codeChars(displayURL_, displayURLLen)) {
-            if (mode == XDR_DECODE) {
-                js_free(displayURL_);
+        if (!xdr->codeChars(displayURL_.get(), displayURLLen)) {
+            if (mode == XDR_DECODE)
                 displayURL_ = nullptr;
-            }
             return false;
         }
         displayURL_[displayURLLen] = '\0';
@@ -2018,17 +2009,9 @@ ScriptSource::setDisplayURL(ExclusiveContext *cx, const jschar *displayURL)
     size_t len = js_strlen(displayURL) + 1;
     if (len == 1)
         return true;
-    displayURL_ = js_strdup(cx, displayURL);
-    if (!displayURL_)
-        return false;
-    return true;
-}
 
-const jschar *
-ScriptSource::displayURL()
-{
-    JS_ASSERT(hasDisplayURL());
-    return displayURL_;
+    displayURL_ = DuplicateString(cx, displayURL);
+    return displayURL_ != nullptr;
 }
 
 bool
@@ -2044,24 +2027,15 @@ ScriptSource::setSourceMapURL(ExclusiveContext *cx, const jschar *sourceMapURL)
                                          "//# sourceMappingURL");
         }
 
-        js_free(sourceMapURL_);
         sourceMapURL_ = nullptr;
     }
 
     size_t len = js_strlen(sourceMapURL) + 1;
     if (len == 1)
         return true;
-    sourceMapURL_ = js_strdup(cx, sourceMapURL);
-    if (!sourceMapURL_)
-        return false;
-    return true;
-}
 
-const jschar *
-ScriptSource::sourceMapURL()
-{
-    JS_ASSERT(hasSourceMapURL());
-    return sourceMapURL_;
+    sourceMapURL_ = DuplicateString(cx, sourceMapURL);
+    return sourceMapURL_ != nullptr;
 }
 
 size_t
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index c88fef82d00a..dccfbb433075 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -11,6 +11,7 @@
 
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/PodOperations.h"
+#include "mozilla/UniquePtr.h"
 
 #include "jsatom.h"
 #ifdef JS_THREADSAFE
@@ -417,8 +418,8 @@ class ScriptSource
 
     uint32_t length_;
     char *filename_;
-    jschar *displayURL_;
-    jschar *sourceMapURL_;
+    mozilla::UniquePtr<jschar[], JS::FreePolicy> displayURL_;
+    mozilla::UniquePtr<jschar[], JS::FreePolicy> sourceMapURL_;
     JSPrincipals *originPrincipals_;
 
     // bytecode offset in caller script that generated this code.
@@ -560,13 +561,19 @@ class ScriptSource
 
     // Display URLs
     bool setDisplayURL(ExclusiveContext *cx, const jschar *displayURL);
-    const jschar *displayURL();
     bool hasDisplayURL() const { return displayURL_ != nullptr; }
+    const jschar * displayURL() {
+        MOZ_ASSERT(hasDisplayURL());
+        return displayURL_.get();
+    }
 
     // Source maps
     bool setSourceMapURL(ExclusiveContext *cx, const jschar *sourceMapURL);
-    const jschar *sourceMapURL();
     bool hasSourceMapURL() const { return sourceMapURL_ != nullptr; }
+    const jschar * sourceMapURL() {
+        MOZ_ASSERT(hasSourceMapURL());
+        return sourceMapURL_.get();
+    }
 
     JSPrincipals *originPrincipals() const { return originPrincipals_; }
 
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index d4e7a0e19a20..03ce12745f43 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -24,6 +24,7 @@
 #include "mozilla/PodOperations.h"
 #include "mozilla/Range.h"
 #include "mozilla/TypeTraits.h"
+#include "mozilla/UniquePtr.h"
 
 #include <ctype.h>
 #include <string.h>
@@ -72,10 +73,12 @@ using mozilla::CheckedInt;
 using mozilla::IsNaN;
 using mozilla::IsNegativeZero;
 using mozilla::IsSame;
+using mozilla::Move;
 using mozilla::PodCopy;
 using mozilla::PodEqual;
 using mozilla::RangedPtr;
 using mozilla::SafeCast;
+using mozilla::UniquePtr;
 
 using JS::AutoCheckCannotGC;
 
@@ -4823,16 +4826,16 @@ js_strcmp(const jschar *lhs, const jschar *rhs)
     }
 }
 
-jschar *
-js_strdup(js::ThreadSafeContext *cx, const jschar *s)
+UniquePtr<jschar[], JS::FreePolicy>
+js::DuplicateString(js::ThreadSafeContext *cx, const jschar *s)
 {
     size_t n = js_strlen(s);
-    jschar *ret = cx->pod_malloc<jschar>(n + 1);
+    auto ret = cx->make_pod_array<jschar>(n + 1);
     if (!ret)
-        return nullptr;
-    js_strncpy(ret, s, n);
+        return ret;
+    js_strncpy(ret.get(), s, n);
     ret[n] = '\0';
-    return ret;
+    return Move(ret);
 }
 
 template <typename CharT>
diff --git a/js/src/jsstr.h b/js/src/jsstr.h
index 07fb2edebc8e..0a68d15d0adf 100644
--- a/js/src/jsstr.h
+++ b/js/src/jsstr.h
@@ -9,6 +9,7 @@
 
 #include "mozilla/HashFunctions.h"
 #include "mozilla/PodOperations.h"
+#include "mozilla/UniquePtr.h"
 
 #include "jsutil.h"
 #include "NamespaceImports.h"
@@ -121,11 +122,11 @@ js_strncpy(jschar *dst, const jschar *src, size_t nelem)
     return mozilla::PodCopy(dst, src, nelem);
 }
 
-extern jschar *
-js_strdup(js::ThreadSafeContext *cx, const jschar *s);
-
 namespace js {
 
+extern mozilla::UniquePtr<jschar[], JS::FreePolicy>
+DuplicateString(ThreadSafeContext *cx, const jschar *s);
+
 /* GC-allocate a string descriptor for the given malloc-allocated chars. */
 template <js::AllowGC allowGC, typename CharT>
 extern JSFlatString *
@@ -339,6 +340,12 @@ str_fromCharCode_one_arg(JSContext *cx, HandleValue code, MutableHandleValue rva
 
 } /* namespace js */
 
+inline jschar *
+js_strdup(js::ThreadSafeContext *cx, const jschar *s)
+{
+    return js::DuplicateString(cx, s).release();
+}
+
 extern bool
 js_str_toString(JSContext *cx, unsigned argc, js::Value *vp);
 
diff --git a/js/src/tests/ecma_5/extensions/reviver-mutates-holder-array-ccw.js b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-array-ccw.js
new file mode 100644
index 000000000000..1594e98c7cb1
--- /dev/null
+++ b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-array-ccw.js
@@ -0,0 +1,47 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor:
+ *   Jeff Walden <jwalden+code@mit.edu>
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 901351;
+var summary = "Behavior when the JSON.parse reviver mutates the holder array";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+if (typeof newGlobal !== "function")
+{
+  var newGlobal = function()
+  {
+    return { evaluate: eval };
+  };
+}
+
+var proxyObj = null;
+
+var arr = JSON.parse('[0, 1]', function(prop, v) {
+  if (prop === "0")
+  {
+    proxyObj = newGlobal().evaluate("({ c: 17, d: 42 })");
+    this[1] = proxyObj;
+  }
+  return v;
+});
+
+assertEq(arr[0], 0);
+assertEq(arr[1], proxyObj);
+assertEq(arr[1].c, 17);
+assertEq(arr[1].d, 42);
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
diff --git a/js/src/tests/ecma_5/extensions/reviver-mutates-holder-array-nonnative.js b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-array-nonnative.js
new file mode 100644
index 000000000000..de4ad7032e2d
--- /dev/null
+++ b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-array-nonnative.js
@@ -0,0 +1,46 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor:
+ *   Jeff Walden <jwalden+code@mit.edu>
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 901380;
+var summary = "Behavior when JSON.parse walks over a non-native object";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+var typedArray = null;
+
+var observedTypedArrayElementCount = 0;
+
+var arr = JSON.parse('[0, 1]', function(prop, v) {
+  if (prop === "0" && Array.isArray(this)) // exclude typedArray[0]
+  {
+    typedArray = new Int8Array(1);
+    this[1] = typedArray;
+  }
+  if (this instanceof Int8Array)
+  {
+    assertEq(prop, "0");
+    observedTypedArrayElementCount++;
+  }
+  return v;
+});
+
+assertEq(arr[0], 0);
+assertEq(arr[1], typedArray);
+
+assertEq(observedTypedArrayElementCount, 1);
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
diff --git a/js/src/tests/ecma_5/extensions/reviver-mutates-holder-array.js b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-array.js
new file mode 100644
index 000000000000..f4f89ac0abbf
--- /dev/null
+++ b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-array.js
@@ -0,0 +1,39 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor:
+ *   Jeff Walden <jwalden+code@mit.edu>
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 901351;
+var summary = "Behavior when the JSON.parse reviver mutates the holder array";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+var proxyObj = null;
+
+var arr = JSON.parse('[0, 1]', function(prop, v) {
+  if (prop === "0")
+  {
+    proxyObj = new Proxy({ c: 17, d: 42 }, {});
+    this[1] = proxyObj;
+  }
+  return v;
+});
+
+assertEq(arr[0], 0);
+assertEq(arr[1], proxyObj);
+assertEq(arr[1].c, 17);
+assertEq(arr[1].d, 42);
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
diff --git a/js/src/tests/ecma_5/extensions/reviver-mutates-holder-object-ccw.js b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-object-ccw.js
new file mode 100644
index 000000000000..8b97db237a30
--- /dev/null
+++ b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-object-ccw.js
@@ -0,0 +1,64 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor:
+ *   Jeff Walden <jwalden+code@mit.edu>
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 901351;
+var summary = "Behavior when the JSON.parse reviver mutates the holder object";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+if (typeof newGlobal !== "function")
+{
+  var newGlobal = function()
+  {
+    return { evaluate: eval };
+  };
+}
+
+// A little trickiness to account for the undefined-ness of property
+// enumeration order.
+var first = "unset";
+
+var proxyObj = null;
+
+var obj = JSON.parse('{ "a": 0, "b": 1 }', function(prop, v) {
+  if (first === "unset")
+  {
+    first = prop;
+    var second = (prop === "a") ? "b" : "a";
+
+    proxyObj = newGlobal().evaluate("({ c: 42, d: 17 })");
+    Object.defineProperty(this, second, { value: proxyObj });
+  }
+  return v;
+});
+
+if (first === "a")
+{
+  assertEq(obj.a, 0);
+  assertEq(obj.b, proxyObj);
+  assertEq(obj.b.c, 42);
+  assertEq(obj.b.d, 17);
+}
+else
+{
+  assertEq(obj.a, proxyObj);
+  assertEq(obj.a.c, 42);
+  assertEq(obj.a.d, 17);
+  assertEq(obj.b, 1);
+}
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
diff --git a/js/src/tests/ecma_5/extensions/reviver-mutates-holder-object-nonnative.js b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-object-nonnative.js
new file mode 100644
index 000000000000..1300f8dd0dd3
--- /dev/null
+++ b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-object-nonnative.js
@@ -0,0 +1,60 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor:
+ *   Jeff Walden <jwalden+code@mit.edu>
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 901380;
+var summary = "Behavior when JSON.parse walks over a non-native object";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+// A little trickiness to account for the undefined-ness of property
+// enumeration order.
+var first = "unset";
+
+var observedTypedArrayElementCount = 0;
+
+var typedArray = null;
+
+var obj = JSON.parse('{ "a": 0, "b": 1 }', function(prop, v) {
+  if (first === "unset")
+  {
+    first = prop;
+    var second = (prop === "a") ? "b" : "a";
+    typedArray = new Int8Array(1);
+    Object.defineProperty(this, second, { value: typedArray });
+  }
+  if (this instanceof Int8Array)
+  {
+    assertEq(prop, "0");
+    observedTypedArrayElementCount++;
+  }
+  return v;
+});
+
+if (first === "a")
+{
+  assertEq(obj.a, 0);
+  assertEq(obj.b, typedArray);
+}
+else
+{
+  assertEq(obj.a, typedArray);
+  assertEq(obj.b, 1);
+}
+
+assertEq(observedTypedArrayElementCount, 1);
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
diff --git a/js/src/tests/ecma_5/extensions/reviver-mutates-holder-object.js b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-object.js
new file mode 100644
index 000000000000..973766e9ae53
--- /dev/null
+++ b/js/src/tests/ecma_5/extensions/reviver-mutates-holder-object.js
@@ -0,0 +1,56 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor:
+ *   Jeff Walden <jwalden+code@mit.edu>
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 901351;
+var summary = "Behavior when the JSON.parse reviver mutates the holder object";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+// A little trickiness to account for the undefined-ness of property
+// enumeration order.
+var first = "unset";
+
+var proxyObj = null;
+
+var obj = JSON.parse('{ "a": 0, "b": 1 }', function(prop, v) {
+  if (first === "unset")
+  {
+    first = prop;
+    var second = (prop === "a") ? "b" : "a";
+
+    proxyObj = new Proxy({ c: 42, d: 17 }, {});
+    Object.defineProperty(this, second, { value: proxyObj });
+  }
+  return v;
+});
+
+if (first === "a")
+{
+  assertEq(obj.a, 0);
+  assertEq(obj.b, proxyObj);
+  assertEq(obj.b.c, 42);
+  assertEq(obj.b.d, 17);
+}
+else
+{
+  assertEq(obj.a, proxyObj);
+  assertEq(obj.a.c, 42);
+  assertEq(obj.a.d, 17);
+  assertEq(obj.b, 1);
+}
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index e424b645cc97..95aafed69d17 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -12,6 +12,7 @@
 #include "jsnum.h"
 #include "jsobj.h"
 #include "jswrapper.h"
+
 #include "frontend/BytecodeCompiler.h"
 #include "gc/Marking.h"
 #include "jit/BaselineJIT.h"
@@ -19,10 +20,12 @@
 #include "vm/ArgumentsObject.h"
 #include "vm/DebuggerMemory.h"
 #include "vm/WrapperObject.h"
+
 #include "jsgcinlines.h"
 #include "jsobjinlines.h"
 #include "jsopcodeinlines.h"
 #include "jsscriptinlines.h"
+
 #include "vm/ObjectImpl-inl.h"
 #include "vm/Stack-inl.h"
 
@@ -2246,21 +2249,18 @@ Debugger::construct(JSContext *cx, unsigned argc, Value *vp)
     obj->setReservedSlot(JSSLOT_DEBUG_MEMORY_INSTANCE, ObjectValue(*memory));
 
     /* Construct the underlying C++ object. */
-    Debugger *dbg = cx->new_<Debugger>(cx, obj.get());
-    if (!dbg)
+    auto dbg = cx->make_unique<Debugger>(cx, obj.get());
+    if (!dbg || !dbg->init(cx))
         return false;
-    if (!dbg->init(cx)) {
-        js_delete(dbg);
-        return false;
-    }
-    obj->setPrivate(dbg);
-    /* Now the JSObject owns the js::Debugger instance, so we needn't delete it. */
+
+    Debugger *debugger = dbg.release();
+    obj->setPrivate(debugger); // owns the released pointer
 
     /* Add the initial debuggees, if any. */
     for (unsigned i = 0; i < args.length(); i++) {
         Rooted<GlobalObject*>
             debuggee(cx, &args[i].toObject().as<ProxyObject>().private_().toObject().global());
-        if (!dbg->addDebuggeeGlobal(cx, debuggee))
+        if (!debugger->addDebuggeeGlobal(cx, debuggee))
             return false;
     }
 
diff --git a/js/src/vm/MallocProvider.h b/js/src/vm/MallocProvider.h
index d6959188dc5d..972e486b2aa8 100644
--- a/js/src/vm/MallocProvider.h
+++ b/js/src/vm/MallocProvider.h
@@ -123,7 +123,17 @@ struct MallocProvider
         return (T *)calloc_(numElems * sizeof(T));
     }
 
+    template <class T>
+    mozilla::UniquePtr<T[], JS::FreePolicy>
+    make_zeroed_pod_array(size_t numElems,
+                          JSCompartment *comp = nullptr,
+                          JSContext *cx = nullptr)
+    {
+        return mozilla::UniquePtr<T[], JS::FreePolicy>(pod_calloc<T>(numElems, comp, cx));
+    }
+
     JS_DECLARE_NEW_METHODS(new_, malloc_, MOZ_ALWAYS_INLINE)
+    JS_DECLARE_MAKE_METHODS(make_unique, new_, MOZ_ALWAYS_INLINE)
 };
 
 } /* namespace js */
diff --git a/js/xpconnect/src/Sandbox.cpp b/js/xpconnect/src/Sandbox.cpp
index 2b076641360e..080242d1b27a 100644
--- a/js/xpconnect/src/Sandbox.cpp
+++ b/js/xpconnect/src/Sandbox.cpp
@@ -908,13 +908,6 @@ xpc::CreateSandboxObject(JSContext *cx, MutableHandleValue vp, nsISupports *prin
             if (!ok)
                 return NS_ERROR_XPC_UNEXPECTED;
 
-            if (xpc::WrapperFactory::IsXrayWrapper(options.proto) && !options.wantXrays) {
-                RootedValue v(cx, ObjectValue(*options.proto));
-                if (!xpc::WrapperFactory::WaiveXrayAndWrap(cx, &v))
-                    return NS_ERROR_FAILURE;
-                options.proto = &v.toObject();
-            }
-
             // Now check what sort of thing we've got in |proto|
             JSObject *unwrappedProto = js::UncheckedUnwrap(options.proto, false);
             const js::Class *unwrappedClass = js::GetObjectClass(unwrappedProto);
@@ -971,13 +964,8 @@ xpc::CreateSandboxObject(JSContext *cx, MutableHandleValue vp, nsISupports *prin
             return NS_ERROR_XPC_UNEXPECTED;
     }
 
-    // We have this crazy behavior where wantXrays=false also implies that the
-    // returned sandbox is implicitly waived. We've stopped advertising it, but
-    // keep supporting it for now.
     vp.setObject(*sandbox);
-    if (options.wantXrays && !JS_WrapValue(cx, vp))
-        return NS_ERROR_UNEXPECTED;
-    if (!options.wantXrays && !xpc::WrapperFactory::WaiveXrayAndWrap(cx, vp))
+    if (!JS_WrapValue(cx, vp))
         return NS_ERROR_UNEXPECTED;
 
     // Set the location information for the new global, so that tools like
@@ -1446,6 +1434,12 @@ nsXPCComponents_utils_Sandbox::CallOrConstruct(nsIXPConnectWrappedNative *wrappe
     if (NS_FAILED(rv))
         return ThrowAndFail(rv, cx, _retval);
 
+    // We have this crazy behavior where wantXrays=false also implies that the
+    // returned sandbox is implicitly waived. We've stopped advertising it, but
+    // keep supporting it for now.
+    if (!options.wantXrays && !xpc::WrapperFactory::WaiveXrayAndWrap(cx, args.rval()))
+        return NS_ERROR_UNEXPECTED;
+
     *_retval = true;
     return NS_OK;
 }
diff --git a/js/xpconnect/src/XPCConvert.cpp b/js/xpconnect/src/XPCConvert.cpp
index e6decb7b01d1..29788813ddcc 100644
--- a/js/xpconnect/src/XPCConvert.cpp
+++ b/js/xpconnect/src/XPCConvert.cpp
@@ -388,7 +388,7 @@ bool ConvertToPrimitive(JSContext *cx, HandleValue v, T *retval)
 bool
 XPCConvert::JSData2Native(void* d, HandleValue s,
                           const nsXPTType& type,
-                          bool useAllocator, const nsID* iid,
+                          const nsID* iid,
                           nsresult* pErr)
 {
     NS_PRECONDITION(d, "bad param");
@@ -489,10 +489,7 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
     case nsXPTType::T_ASTRING:
     {
         if (s.isUndefined()) {
-            if (useAllocator)
-                *((const nsAString**)d) = &NullString();
-            else
-                (**((nsAString**)d)).SetIsVoid(true);
+            (**((nsAString**)d)).SetIsVoid(true);
             return true;
         }
         // Fall through to T_DOMSTRING case.
@@ -500,10 +497,7 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
     case nsXPTType::T_DOMSTRING:
     {
         if (s.isNull()) {
-            if (useAllocator)
-                *((const nsAString**)d) = &NullString();
-            else
-                (**((nsAString**)d)).SetIsVoid(true);
+            (**((nsAString**)d)).SetIsVoid(true);
             return true;
         }
         size_t length = 0;
@@ -515,21 +509,12 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
 
             length = JS_GetStringLength(str);
             if (!length) {
-                if (useAllocator)
-                    *((const nsAString**)d) = &EmptyString();
-                else
-                    (**((nsAString**)d)).Truncate();
+                (**((nsAString**)d)).Truncate();
                 return true;
             }
         }
 
-        nsString* ws;
-        if (useAllocator) {
-            ws = nsXPConnect::GetRuntimeInstance()->NewShortLivedString();
-            *((const nsString**)d) = ws;
-        } else {
-            ws = *((nsString**)d);
-        }
+        nsAString* ws = *((nsAString**)d);
 
         if (!str) {
             ws->AssignLiteral(MOZ_UTF16("undefined"));
@@ -619,12 +604,8 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
     case nsXPTType::T_UTF8STRING:
     {
         if (s.isNull() || s.isUndefined()) {
-            if (useAllocator) {
-                *((const nsACString**)d) = &NullCString();
-            } else {
-                nsCString* rs = *((nsCString**)d);
-                rs->SetIsVoid(true);
-            }
+            nsCString* rs = *((nsCString**)d);
+            rs->SetIsVoid(true);
             return true;
         }
 
@@ -635,54 +616,30 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
 
         size_t length = JS_GetStringLength(str);
         if (!length) {
-            if (useAllocator) {
-                *((const nsACString**)d) = &EmptyCString();
-            } else {
-                nsCString* rs = *((nsCString**)d);
-                rs->Truncate();
-            }
+            nsCString* rs = *((nsCString**)d);
+            rs->Truncate();
             return true;
         }
 
-        nsCString *rs;
-        if (useAllocator) {
-            // Use nsCString to enable sharing
-            rs = new nsCString();
-            if (!rs)
-                return false;
-
-            *((const nsCString**)d) = rs;
-        } else {
-            rs = *((nsCString**)d);
-        }
-
         JSFlatString *flat = JS_FlattenString(cx, str);
         if (!flat)
             return false;
 
         size_t utf8Length = JS::GetDeflatedUTF8StringLength(flat);
+        nsACString *rs = *((nsACString**)d);
         rs->SetLength(utf8Length);
 
         JS::DeflateStringToUTF8Buffer(flat, mozilla::RangedPtr<char>(rs->BeginWriting(), utf8Length));
-        MOZ_ASSERT(rs->get()[utf8Length] == '\0');
+
         return true;
     }
 
     case nsXPTType::T_CSTRING:
     {
         if (s.isNull() || s.isUndefined()) {
-            if (useAllocator) {
-                nsACString *rs = new nsCString();
-                if (!rs)
-                    return false;
-
-                rs->SetIsVoid(true);
-                *((nsACString**)d) = rs;
-            } else {
-                nsACString* rs = *((nsACString**)d);
-                rs->Truncate();
-                rs->SetIsVoid(true);
-            }
+            nsACString* rs = *((nsACString**)d);
+            rs->Truncate();
+            rs->SetIsVoid(true);
             return true;
         }
 
@@ -698,25 +655,12 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
         }
 
         if (!length) {
-            if (useAllocator) {
-                *((const nsACString**)d) = &EmptyCString();
-            } else {
-                nsCString* rs = *((nsCString**)d);
-                rs->Truncate();
-            }
+            nsCString* rs = *((nsCString**)d);
+            rs->Truncate();
             return true;
         }
 
-        nsACString *rs;
-        if (useAllocator) {
-            rs = new nsCString();
-            if (!rs)
-                return false;
-            *((const nsACString**)d) = rs;
-        } else {
-            rs = *((nsACString**)d);
-        }
-
+        nsACString *rs = *((nsACString**)d);
         rs->SetLength(uint32_t(length));
         if (rs->Length() != uint32_t(length)) {
             return false;
@@ -1618,7 +1562,7 @@ XPCConvert::JSArray2Native(void** d, HandleValue s,
         for (initedCount = 0; initedCount < count; initedCount++) {            \
             if (!JS_GetElement(cx, jsarray, initedCount, &current) ||          \
                 !JSData2Native(((_t*)array)+initedCount, current, type,        \
-                               true, iid, pErr))                               \
+                               iid, pErr))                                     \
                 goto failure;                                                  \
         }                                                                      \
     PR_END_MACRO
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index e0f27fc2bd1a..1969a3d7ae22 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -1497,9 +1497,6 @@ XPCJSRuntime::NewShortLivedString()
 void
 XPCJSRuntime::DeleteShortLivedString(nsString *string)
 {
-    if (string == &EmptyString() || string == &NullString())
-        return;
-
     for (uint32_t i = 0; i < XPCCCX_STRING_CACHE_SIZE; ++i) {
         if (!mScratchStrings[i].empty() &&
             mScratchStrings[i].addr() == string) {
diff --git a/js/xpconnect/src/XPCWrappedJSClass.cpp b/js/xpconnect/src/XPCWrappedJSClass.cpp
index 30145ec3066e..26f6f7f69fe4 100644
--- a/js/xpconnect/src/XPCWrappedJSClass.cpp
+++ b/js/xpconnect/src/XPCWrappedJSClass.cpp
@@ -286,10 +286,7 @@ GetNamedPropertyAsVariantRaw(XPCCallContext& ccx,
     RootedValue val(ccx);
 
     return JS_GetPropertyById(ccx, aJSObj, aName, &val) &&
-           // Note that this always takes the T_INTERFACE path through
-           // JSData2Native, so the value passed for useAllocator
-           // doesn't really matter. We pass true for consistency.
-           XPCConvert::JSData2Native(aResult, val, type, true,
+           XPCConvert::JSData2Native(aResult, val, type,
                                      &NS_GET_IID(nsIVariant), pErr);
 }
 
@@ -1352,13 +1349,13 @@ pre_call_clean_up:
     (defined(__powerpc__) && !defined (__powerpc64__)))
         if (type_tag == nsXPTType::T_JSVAL) {
             if (!XPCConvert::JSData2Native(*(void**)(&pv->val), val, type,
-                                           !param.IsDipper(), &param_iid, nullptr))
+                                           &param_iid, nullptr))
                 break;
         } else
 #endif
         {
             if (!XPCConvert::JSData2Native(&pv->val, val, type,
-                                           !param.IsDipper(), &param_iid, nullptr))
+                                           &param_iid, nullptr))
                 break;
         }
     }
@@ -1431,7 +1428,7 @@ pre_call_clean_up:
                     break;
             } else {
                 if (!XPCConvert::JSData2Native(&pv->val, val, type,
-                                               true, &param_iid,
+                                               &param_iid,
                                                nullptr))
                     break;
             }
diff --git a/js/xpconnect/src/XPCWrappedNative.cpp b/js/xpconnect/src/XPCWrappedNative.cpp
index efd47c5e0929..cda2084b9656 100644
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -1656,8 +1656,8 @@ class MOZ_STACK_CLASS CallMethodHelper
 
     MOZ_ALWAYS_INLINE void CleanupParam(nsXPTCMiniVariant& param, nsXPTType& type);
 
-    MOZ_ALWAYS_INLINE bool HandleDipperParam(nsXPTCVariant* dp,
-                                             const nsXPTParamInfo& paramInfo);
+    MOZ_ALWAYS_INLINE bool AllocateStringClass(nsXPTCVariant* dp,
+                                               const nsXPTParamInfo& paramInfo);
 
     MOZ_ALWAYS_INLINE nsresult Invoke();
 
@@ -2096,9 +2096,18 @@ CallMethodHelper::ConvertIndependentParam(uint8_t i)
     dp->type = type;
     MOZ_ASSERT(!paramInfo.IsShared(), "[shared] implies [noscript]!");
 
-    // Handle dipper types separately.
-    if (paramInfo.IsDipper())
-        return HandleDipperParam(dp, paramInfo);
+    // String classes are always "in" - those that are marked "out" are converted
+    // by the XPIDL compiler to "in+dipper". See the note above IsDipper() in
+    // xptinfo.h.
+    //
+    // Also note that the fact that we bail out early for dipper parameters means
+    // that "inout" dipper parameters don't work - see bug 687612.
+    if (paramInfo.IsStringClass()) {
+        if (!AllocateStringClass(dp, paramInfo))
+            return false;
+        if (paramInfo.IsDipper())
+            return true;
+    }
 
     // Specify the correct storage/calling semantics.
     if (paramInfo.IsIndirect())
@@ -2156,7 +2165,7 @@ CallMethodHelper::ConvertIndependentParam(uint8_t i)
     }
 
     nsresult err;
-    if (!XPCConvert::JSData2Native(&dp->val, src, type, true, &param_iid, &err)) {
+    if (!XPCConvert::JSData2Native(&dp->val, src, type, &param_iid, &err)) {
         ThrowBadParam(err, i, mCallContext);
         return false;
     }
@@ -2276,7 +2285,7 @@ CallMethodHelper::ConvertDependentParam(uint8_t i)
             }
         }
     } else {
-        if (!XPCConvert::JSData2Native(&dp->val, src, type, true,
+        if (!XPCConvert::JSData2Native(&dp->val, src, type,
                                        &param_iid, &err)) {
             ThrowBadParam(err, i, mCallContext);
             return false;
@@ -2317,8 +2326,7 @@ CallMethodHelper::CleanupParam(nsXPTCMiniVariant& param, nsXPTType& type)
         case nsXPTType::T_CSTRING:
             {
                 nsCString* rs = (nsCString*)param.val.p;
-                if (rs != &EmptyCString() && rs != &NullCString())
-                    delete rs;
+                delete rs;
             }
             break;
         default:
@@ -2328,44 +2336,19 @@ CallMethodHelper::CleanupParam(nsXPTCMiniVariant& param, nsXPTType& type)
     }
 }
 
-// Handle parameters with dipper types.
-//
-// Dipper types are one of the more inscrutable aspects of xpidl. In a
-// nutshell, dippers are empty container objects, created and passed by
-// the caller, and filled by the callee. The callee receives a
-// fully-formed object, and thus does not have to construct anything. But
-// the object is functionally empty, and the callee is responsible for
-// putting something useful inside of it.
-//
-// XPIDL decides which types to make dippers. The list of these types
-// is given in the isDipperType() function in typelib.py, and is currently
-// limited to 4 string types.
-//
-// When a dipper type is declared as an 'out' parameter, xpidl internally
-// converts it to an 'in', and sets the XPT_PD_DIPPER flag on it. For this
-// reason, dipper types are sometimes referred to as 'out parameters
-// masquerading as in'. The burden of maintaining this illusion falls mostly
-// on XPConnect - we create the empty containers, and harvest the results
-// after the call.
-//
-// This method creates these empty containers.
 bool
-CallMethodHelper::HandleDipperParam(nsXPTCVariant* dp,
-                                    const nsXPTParamInfo& paramInfo)
+CallMethodHelper::AllocateStringClass(nsXPTCVariant* dp,
+                                      const nsXPTParamInfo& paramInfo)
 {
     // Get something we can make comparisons with.
     uint8_t type_tag = paramInfo.GetType().TagPart();
 
-    // Dippers always have the 'in' and 'dipper' flags set. Never 'out'.
-    MOZ_ASSERT(!paramInfo.IsOut(), "Dipper has unexpected flags.");
-
-    // xpidl.h specifies that dipper types will be used in exactly four
-    // cases, all strings. Verify that here.
+    // There should be 4 cases, all strings. Verify that here.
     MOZ_ASSERT(type_tag == nsXPTType::T_ASTRING ||
                type_tag == nsXPTType::T_DOMSTRING ||
                type_tag == nsXPTType::T_UTF8STRING ||
                type_tag == nsXPTType::T_CSTRING,
-               "Unexpected dipper type!");
+               "Unexpected string class type!");
 
     // ASTRING and DOMSTRING are very similar, and both use nsString.
     // UTF8_STRING and CSTRING are also quite similar, and both use nsCString.
diff --git a/js/xpconnect/src/XPCWrappedNativeScope.cpp b/js/xpconnect/src/XPCWrappedNativeScope.cpp
index f184f203a9a2..cf27ac3df117 100644
--- a/js/xpconnect/src/XPCWrappedNativeScope.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeScope.cpp
@@ -214,12 +214,15 @@ XPCWrappedNativeScope::EnsureContentXBLScope(JSContext *cx)
     // sandboxPrototype so that the XBL scope can access all the DOM objects
     // it's accustomed to accessing.
     //
-    // NB: One would think that wantXrays wouldn't make a difference here.
-    // However, wantXrays lives a secret double life, and one of its other
-    // hobbies is to waive Xray on the returned sandbox when set to false.
-    // So make sure to keep this set to true, here.
+    // In general wantXrays shouldn't matter much here, but there are weird
+    // cases when adopting bound content between same-origin globals where a
+    // <destructor> in one content XBL scope sees anonymous content in another
+    // content XBL scope. When that happens, we hit LookupBindingMember for an
+    // anonymous element that lives in a content XBL scope, which isn't a tested
+    // or audited codepath. So let's avoid hitting that case by opting out of
+    // same-origin Xrays.
     SandboxOptions options;
-    options.wantXrays = true;
+    options.wantXrays = false;
     options.wantComponents = true;
     options.proto = global;
     options.sameZoneAs = global;
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 00ef6df22e8d..3bd706984149 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -2507,7 +2507,7 @@ public:
 
     static bool JSData2Native(void* d, JS::HandleValue s,
                               const nsXPTType& type,
-                              bool useAllocator, const nsID* iid,
+                              const nsID* iid,
                               nsresult* pErr);
 
     /**
diff --git a/js/xpconnect/tests/mochitest/file_bug802557.html b/js/xpconnect/tests/mochitest/file_bug802557.html
index 3c444d589fe6..02b4aedce735 100644
--- a/js/xpconnect/tests/mochitest/file_bug802557.html
+++ b/js/xpconnect/tests/mochitest/file_bug802557.html
@@ -3,7 +3,7 @@
 <head>
 <script>
 var gTS = window.location.toString;
-var gGHR = Object.__lookupGetter__.call(window.location, 'href');
+var gGHR = Object.getOwnPropertyDescriptor(window.location, 'href').get;
 function getTests(fromOuter) {
 
   function loc() fromOuter ? window.location : location;
@@ -23,18 +23,12 @@ function getTests(fromOuter) {
     getLocationApply3: function() {
       return Function.call.apply(gTS, [loc()]);
     },
-    getLocationViaPrototype: function() {
-      return Location.prototype.toString.call(loc());
-    },
     getHref: function() {
       return loc().href;
     },
     getHrefViaApply: function() {
       return Function.call.apply(gGHR, [loc()]);
     },
-    getHrefViaPrototype: function() {
-      return Object.getOwnPropertyDescriptor(Location.prototype, 'href').get.call(loc());
-    }
   }
 };
 
diff --git a/js/xpconnect/tests/mochitest/test_bug793969.html b/js/xpconnect/tests/mochitest/test_bug793969.html
index 45bf53f39da2..9d016f80841a 100644
--- a/js/xpconnect/tests/mochitest/test_bug793969.html
+++ b/js/xpconnect/tests/mochitest/test_bug793969.html
@@ -26,7 +26,9 @@ function checkThrows(f, desc, skipMessageCheck) {
   } catch (e) {
     ok(true, "threw correctly");
     if (!skipMessageCheck)
-      ok(/denied/.exec(e), "Correctly threw a security exception: " + e);
+      ok(/denied/.exec(e) ||
+         /can't redefine non-configurable property/.exec(e),
+         "Correctly threw a security exception: " + e);
   }
 }
 
@@ -35,24 +37,13 @@ checkThrows(function() { "use strict"; location.valueOf = 'hah'; }, 'Shadow with
 checkThrows(function() { "use strict"; location.valueOf = function() { return {a: 'hah'};} }, 'Shadow with function', /* skipMessageCheck = */ true);
 checkThrows(function() { Object.defineProperty(location, 'valueOf', { value: function() { return 'hah'; } }); }, 'defineProperty with value');
 checkThrows(function() { delete location.valueOf; Object.defineProperty(location, 'valueOf', { value: function() { return 'hah'; } }); }, 'delete + defineProperty with value');
-checkThrows(function() { Object.defineProperty(location, 'valueOf', { getter: function() { return 'hah'; } }); }, 'defineProperty with getter');
-checkThrows(function() { delete location.valueOf; Object.defineProperty(location, 'valueOf', { getter: function() { return 'hah'; } }); }, 'delete + defineProperty with getter');
+checkThrows(function() { Object.defineProperty(location, 'valueOf', { get: function() { return 'hah'; } }); }, 'defineProperty with getter');
+checkThrows(function() { delete location.valueOf; Object.defineProperty(location, 'valueOf', { get: function() { return 'hah'; } }); }, 'delete + defineProperty with getter');
 
 Object.prototype.valueOf = function() { return 'hah'; };
 is(({}).valueOf(), 'hah', "Shadowing on Object.prototype works for vanilla objects");
 is(location.valueOf(), location, "Shadowing on Object.prototype and Location.prototype doesn't for location objects");
 
-// Make sure that Location.prototype can't be mucked with.
-function checkProto() {
-  "use strict"
-  checkThrows(function() { Location.prototype.foo = 'hah'; }, 'adding new property to Location.prototype', /* skipMessageCheck = */ true);
-  checkThrows(function() { Location.prototype.valueOf = 'hah'; }, 'defining valueOf on Location.prototype', /* skipMessageCheck = */ true);
-  checkThrows(function() { delete Location.prototype.toString; }, 'deleting property on Location.prototype', /* skipMessageCheck = */ true);
-  checkThrows(function() { Location.prototype.toString = 'hah'; }, 'setting property on Location.prototype', /* skipMessageCheck = */ true);
-  checkThrows(function() { Object.defineProperty(Location.prototype, 'toString', {value: 'hah'}); }, 'defining property on Location.prototype', /* skipMessageCheck = */ true);
-};
-checkProto();
-
 </script>
 </pre>
 </body>
diff --git a/js/xpconnect/tests/mochitest/test_bug802557.html b/js/xpconnect/tests/mochitest/test_bug802557.html
index b5ae0ccb5737..073f22e72b4c 100644
--- a/js/xpconnect/tests/mochitest/test_bug802557.html
+++ b/js/xpconnect/tests/mochitest/test_bug802557.html
@@ -35,12 +35,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=802557
       // [getter, description, locationObj, bound]
       gGetters = [[ location.toString, 'toString from LW' ],
                   [ gLoc.toString, 'toString from XLW' ],
-                  [ Location.prototype.toString, 'toString from Location.prototype' ],
-                  [ iWin.Location.prototype.toString, 'toString from iWin.Location.prototype' ],
                   [ Object.__lookupGetter__.call(location, 'href'), 'href getter from LW' ],
                   [ Object.__lookupGetter__.call(gLoc, 'href'), 'href getter from XLW' ],
-                  [ Object.getOwnPropertyDescriptor(Location.prototype, 'href').get, 'href getter from Location.prototype' ],
-                  [ Object.getOwnPropertyDescriptor(iWin.Location.prototype, 'href').get, 'href getter from iWin.Location.prototype' ],
+                  [ Object.getOwnPropertyDescriptor(location, 'href').get, 'href getter from location' ],
+                  [ Object.getOwnPropertyDescriptor(gLoc, 'href').get, 'href getter from iWin.location' ],
                   [ function() { return this + ''; }, 'implicit conversion via [[DefaultValue]]', /* doMessageCheck = */ true ]];
       gGetters.forEach(function(item) {
         try {
@@ -71,6 +69,32 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=802557
         var f = gTestFunctions[fun];
         checkThrows(f, "calling " + fun);
       }
+
+      // Verify that URL.prototype.toString can't be applied to Location
+      var threw = false;
+      try {
+        URL.prototype.toString.call(location);
+      } catch (e) {
+        threw = true;
+      }
+      ok(threw,
+         "Should not be able to use URL.prototype.toString on a Location instance");
+  
+      // Verify that URL.prototype.href getter can't be applied to Location
+      threw = false;
+      var reachedTest = false;
+      try {
+        var get = Object.getOwnPropertyDescriptor(URL.prototype, "href").get;
+        is(typeof(get), "function", "Should have an href getter on URL.prototype");
+        var reachedTest = true;
+        get.call(location);
+      } catch (e) {
+        threw = true;
+      }
+      ok(reachedTest,
+         "Should not be able to find URL.prototype.href getter");
+      ok(threw,
+         "Should not be able to use URL.prototype.href getter on a Location instance");
       SimpleTest.finish();
     }
   }
diff --git a/js/xpconnect/tests/mochitest/test_bug870423.html b/js/xpconnect/tests/mochitest/test_bug870423.html
index 97e75195066e..6fce43527221 100644
--- a/js/xpconnect/tests/mochitest/test_bug870423.html
+++ b/js/xpconnect/tests/mochitest/test_bug870423.html
@@ -23,7 +23,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=870423
     check(window, sowin, 'Location', function(win) { return win.location; });
 
     ok(xowin instanceof Window, "Cross-origin instanceof should work");
-    todo(xowin.location instanceof Location, "Cross-origin instanceof should work");
+    ok(xowin.location instanceof Location, "Cross-origin instanceof should work");
 
     SimpleTest.finish();
   }
diff --git a/js/xpconnect/wrappers/AccessCheck.cpp b/js/xpconnect/wrappers/AccessCheck.cpp
index e9b7811cb048..75ab39356650 100644
--- a/js/xpconnect/wrappers/AccessCheck.cpp
+++ b/js/xpconnect/wrappers/AccessCheck.cpp
@@ -14,6 +14,7 @@
 
 #include "jsfriendapi.h"
 #include "mozilla/dom/BindingUtils.h"
+#include "mozilla/dom/LocationBinding.h"
 #include "mozilla/dom/WindowBinding.h"
 #include "nsIDOMWindowCollection.h"
 #include "nsJSUtils.h"
@@ -90,13 +91,6 @@ AccessCheck::getPrincipal(JSCompartment *compartment)
     return GetCompartmentPrincipal(compartment);
 }
 
-#define NAME(ch, str, cases)                                                  \
-    case ch: if (!strcmp(name, str)) switch (propChar0) { cases }; break;
-#define PROP(ch, actions) case ch: { actions }; break;
-#define RW(str) if (JS_FlatStringEqualsAscii(prop, str)) return true;
-#define R(str) if (!set && JS_FlatStringEqualsAscii(prop, str)) return true;
-#define W(str) if (set && JS_FlatStringEqualsAscii(prop, str)) return true;
-
 // Hardcoded policy for cross origin property access. This was culled from the
 // preferences file (all.js). We don't want users to overwrite highly sensitive
 // security policies.
@@ -109,9 +103,9 @@ IsPermitted(const char *name, JSFlatString *prop, bool set)
 
     jschar propChar0 = JS_GetFlatStringCharAt(prop, 0);
     switch (name[0]) {
-        NAME('L', "Location",
-             PROP('h', W("href"))
-             PROP('r', R("replace")))
+        case 'L':
+            if (!strcmp(name, "Location"))
+                return dom::LocationBinding::IsPermitted(prop, propChar0, set);
         case 'W':
             if (!strcmp(name, "Window"))
                 return dom::WindowBinding::IsPermitted(prop, propChar0, set);
@@ -120,11 +114,6 @@ IsPermitted(const char *name, JSFlatString *prop, bool set)
     return false;
 }
 
-#undef NAME
-#undef RW
-#undef R
-#undef W
-
 static bool
 IsFrameId(JSContext *cx, JSObject *objArg, jsid idArg)
 {
diff --git a/layout/base/SelectionCarets.cpp b/layout/base/SelectionCarets.cpp
index a06b21b62630..e548674f7927 100644
--- a/layout/base/SelectionCarets.cpp
+++ b/layout/base/SelectionCarets.cpp
@@ -469,7 +469,8 @@ SelectionCarets::UpdateSelectionCarets()
                            false);
     startFrame->PeekOffset(&pos);
     nsCOMPtr<nsIContent> endContent = do_QueryInterface(range->GetEndParent());
-    if (nsLayoutUtils::CompareTreePosition(pos.mResultContent, endContent) > 0 ||
+    if ((pos.mResultContent &&
+         nsLayoutUtils::CompareTreePosition(pos.mResultContent, endContent) > 0) ||
         (pos.mResultContent == endContent &&
          pos.mContentOffset >= range->EndOffset())) {
       isTilt = true;
diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index d071ca060727..aeb06752b556 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -1377,6 +1377,7 @@ AttachContainerRecurse(nsIDocShell* aShell)
   nsCOMPtr<nsIContentViewer> viewer;
   aShell->GetContentViewer(getter_AddRefs(viewer));
   if (viewer) {
+    viewer->SetIsHidden(false);
     nsIDocument* doc = viewer->GetDocument();
     if (doc) {
       doc->SetContainer(static_cast<nsDocShell*>(aShell));
@@ -4417,6 +4418,13 @@ nsDocumentViewer::GetIsHidden(bool *aHidden)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDocumentViewer::SetIsHidden(bool aHidden)
+{
+  mHidden = aHidden;
+  return NS_OK;
+}
+
 void
 nsDocumentViewer::DestroyPresShell()
 {
diff --git a/layout/base/tests/chrome/chrome.ini b/layout/base/tests/chrome/chrome.ini
index 8117f6c59ed7..7dc47b96e9b5 100644
--- a/layout/base/tests/chrome/chrome.ini
+++ b/layout/base/tests/chrome/chrome.ini
@@ -15,6 +15,7 @@ support-files =
   printpreview_bug482976_helper.xul
   printpreview_helper.xul
   transformed_scrolling_repaints_3_window.html
+  file_bug1018265.xul
 
 [test_bug370436.html]
 [test_bug396367-1.html]
@@ -29,6 +30,7 @@ support-files =
 [test_bug708062.html]
 [test_bug812817.xul]
 [test_bug847890_paintFlashing.html]
+[test_bug1018265.xul]
 [test_chrome_content_integration.xul]
 [test_chrome_over_plugin.xul]
 [test_default_background.xul]
diff --git a/layout/base/tests/chrome/file_bug1018265.xul b/layout/base/tests/chrome/file_bug1018265.xul
new file mode 100644
index 000000000000..91944c5b435c
--- /dev/null
+++ b/layout/base/tests/chrome/file_bug1018265.xul
@@ -0,0 +1,51 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1018265
+-->
+<window title="Mozilla Bug 1018265"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="setTimeout(run, 0);">
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+
+  /** Test for Bug 1018265 **/
+
+  var testcontent = null;
+
+  function run() {
+    testcontent = document.getElementById("testcontent");
+    shouldHaveTwoNonHiddenContentViewers();
+    testcontent.setAttribute("src", "foobarpage");
+    setTimeout(errorPageLoaded, 2500)
+  }
+
+  function errorPageLoaded() {
+    testcontent.addEventListener("pageshow", didGoBack, true);
+    setTimeout("testcontent.contentWindow.history.back();", 0);
+  }
+
+  function didGoBack(e) {
+    testcontent.removeEventListener("pageshow", didGoBack, true);
+    shouldHaveTwoNonHiddenContentViewers();
+    opener.done();
+    window.close();
+  }
+
+  function getContentViewer(win) {
+    return win.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
+              .getInterface(Components.interfaces.nsIDocShell).contentViewer;
+  }
+
+  function shouldHaveTwoNonHiddenContentViewers() {
+    opener.is(getContentViewer(testcontent.contentWindow).isHidden, false, "Top level ContentViewer should not be hidden.");
+    opener.is(getContentViewer(testcontent.contentWindow.frames[0]).isHidden, false, " Iframe's ContentViewer should not be hidden.");
+  }
+  ]]>
+  </script>
+
+  <browser type="content" id="testcontent" flex="1" src="data:text/html,&lt;iframe&gt;&lt;/iframe&gt;"/>
+</window>
diff --git a/layout/base/tests/chrome/test_bug1018265.xul b/layout/base/tests/chrome/test_bug1018265.xul
new file mode 100644
index 000000000000..5787be72c644
--- /dev/null
+++ b/layout/base/tests/chrome/test_bug1018265.xul
@@ -0,0 +1,38 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1018265
+-->
+<window title="Mozilla Bug 1018265"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="run()">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+
+  /** Test for Bug 1018265 **/
+
+  SimpleTest.waitForExplicitFinish();
+
+  function run() {
+    window.open("file_bug1018265.xul", "contentViewerTest", "chrome,width=100,height=100");
+  }
+
+  function done() {
+    ok(true, "done");
+    setTimeout("SimpleTest.finish()", 0);
+  }
+  ]]>
+  </script>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1018265"
+     target="_blank">Mozilla Bug 1018265</a>
+  </body>
+</window>
diff --git a/layout/forms/test/test_bug402198.html b/layout/forms/test/test_bug402198.html
index 8689b224281b..e46894a2ab4f 100644
--- a/layout/forms/test/test_bug402198.html
+++ b/layout/forms/test/test_bug402198.html
@@ -56,8 +56,7 @@ function doe3() {
   synthesizeKey('VK_TAB', {type: "keypress", shiftKey: true});
 
   is(0, 0, "this is a crash/assertion test, so we're ok if we survived this far");
-  SimpleTest.finish();
-  setTimeout(function() {document.body.style.display = '';}, 400);
+  setTimeout(function() {document.body.style.display = ''; SimpleTest.finish();}, 0);
 }
 
 function do_test() {
diff --git a/layout/generic/nsVideoFrame.cpp b/layout/generic/nsVideoFrame.cpp
index 6afc2c94adbb..ce5377baccf3 100644
--- a/layout/generic/nsVideoFrame.cpp
+++ b/layout/generic/nsVideoFrame.cpp
@@ -12,7 +12,6 @@
 #include "nsGkAtoms.h"
 
 #include "mozilla/dom/HTMLVideoElement.h"
-#include "nsIDOMHTMLVideoElement.h"
 #include "nsIDOMHTMLImageElement.h"
 #include "nsDisplayList.h"
 #include "nsGenericHTMLElement.h"
@@ -618,8 +617,8 @@ nsVideoFrame::AttributeChanged(int32_t aNameSpaceID,
 }
 
 bool nsVideoFrame::HasVideoElement() {
-  nsCOMPtr<nsIDOMHTMLVideoElement> videoDomElement = do_QueryInterface(mContent);
-  return videoDomElement != nullptr;
+  nsCOMPtr<nsIDOMHTMLMediaElement> mediaDomElement = do_QueryInterface(mContent);
+  return mediaDomElement->IsVideo();
 }
 
 bool nsVideoFrame::HasVideoData()
diff --git a/layout/reftests/box-shadow/fieldset-inset-ref.html b/layout/reftests/box-shadow/fieldset-inset-ref.html
new file mode 100644
index 000000000000..6d02c04c8b63
--- /dev/null
+++ b/layout/reftests/box-shadow/fieldset-inset-ref.html
@@ -0,0 +1,95 @@
+<!DOCTYPE HTML>
+<html><head>
+    <meta charset="utf-8">
+    <title>Testcase #2 for bug 485149</title>
+    <style type="text/css">
+
+        html,body {
+            color:black; background-color:white; font-size:16px; padding:0; margin:0;
+        }
+	
+
+body {padding:20px;}
+
+field {
+  display:block;
+  overflow:hidden;
+  background:yellow;
+
+  box-shadow: inset 0 0 5px 5px #cccccc; 
+  border:1px solid #000000;
+  border-radius:7px;
+  width:200px;
+  height:50px;
+  margin-left:5px;
+  margin-right:2px;
+  padding:10px;
+  border-box;
+}
+
+.with-legend {
+  margin-top:8px;
+  height:42px;
+}
+
+p { height:40px; margin:0; }
+
+#mask1 {
+ position:absolute;
+ left:0;
+ top:0;
+ background:black;
+ z-index:1;
+ width:150px;
+ height:700px;
+}
+
+#mask2 {
+ position:absolute;
+ left:170px;
+ top:330px;
+ background:black;
+ z-index:1;
+ width:150px;
+ height:300px;
+}
+
+#mask3 {
+ position:absolute;
+ left:0;
+ top:380px;
+ background:black;
+ z-index:1;
+ width:300px;
+ height:300px;
+}
+
+</style>
+</head>
+<body>
+
+<field class="with-legend">
+1
+</field>
+
+<p></p>
+<field class="with-legend" style="position:relative">
+2
+</field>
+
+<p></p>
+<field>
+3
+</field>
+
+<p></p>
+<field class="with-legend" style="border-color:transparent">
+4
+</field>
+
+<div id="mask1"></div>
+<div id="mask2"></div>
+<div id="mask3"></div>
+
+</body>
+</html>
diff --git a/layout/reftests/box-shadow/fieldset-inset.html b/layout/reftests/box-shadow/fieldset-inset.html
new file mode 100644
index 000000000000..d49e2411f91e
--- /dev/null
+++ b/layout/reftests/box-shadow/fieldset-inset.html
@@ -0,0 +1,90 @@
+<!DOCTYPE HTML>
+<html><head>
+    <meta charset="utf-8">
+    <title>Testcase #2 for bug 485149</title>
+    <style type="text/css">
+
+        html,body {
+            color:black; background-color:white; font-size:16px; padding:0; margin:0;
+        }
+	
+
+body {padding:20px;}
+
+fieldset {
+  overflow:hidden;
+  background:yellow;
+
+  box-shadow: inset 0 0 5px 5px #cccccc; 
+  border:1px solid #000000;
+  border-radius:7px;
+  width:200px;
+  height:50px;
+  margin-left:5px;
+  margin-right:2px;
+  padding:10px;
+}
+
+legend { height:16px; }
+
+p { height:40px; margin:0; }
+
+#mask1 {
+ position:absolute;
+ left:0;
+ top:0;
+ background:black;
+ z-index:1;
+ width:150px;
+ height:700px;
+}
+
+#mask2 {
+ position:absolute;
+ left:170px;
+ top:330px;
+ background:black;
+ z-index:1;
+ width:150px;
+ height:300px;
+}
+
+#mask3 {
+ position:absolute;
+ left:0;
+ top:380px;
+ background:black;
+ z-index:1;
+ width:300px;
+ height:300px;
+}
+
+</style>
+</head>
+<body>
+
+<fieldset><legend>Legend</legend>
+1
+</fieldset>
+
+<p></p>
+<fieldset style="position:relative;"><legend>Legend</legend>
+2
+</fieldset>
+
+<p></p>
+<fieldset>
+3
+</fieldset>
+
+<p></p>
+<fieldset><legend style="width:150px;"></legend>
+4
+</fieldset>
+
+<div id="mask1"></div>
+<div id="mask2"></div>
+<div id="mask3"></div>
+
+</body>
+</html>
diff --git a/layout/reftests/box-shadow/reftest.list b/layout/reftests/box-shadow/reftest.list
index 80a9c77ccff1..b85800f77a02 100644
--- a/layout/reftests/box-shadow/reftest.list
+++ b/layout/reftests/box-shadow/reftest.list
@@ -28,3 +28,4 @@ random-if(d2d) == boxshadow-threecorners.html boxshadow-threecorners-ref.html
 fails-if(Android||B2G) == 611574-1.html 611574-1-ref.html
 fails-if(Android||B2G) == 611574-2.html 611574-2-ref.html
 fuzzy-if(winWidget,5,30) == fieldset.html fieldset-ref.html # minor anti-aliasing problem on Windows
+fuzzy-if(winWidget,5,30) == fieldset-inset.html fieldset-inset-ref.html # minor anti-aliasing problem on Windows
diff --git a/layout/style/crashtests/637242.xhtml b/layout/style/crashtests/637242.xhtml
new file mode 100644
index 000000000000..a8d99a732595
--- /dev/null
+++ b/layout/style/crashtests/637242.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style id="style">p { color: red; }</style>
+<script>
+<![CDATA[
+
+function boom()
+{
+	var styleText = "p { color: green; }";
+	
+	// Make 2^17 rules
+	for (var i = 0; i < 17; ++i) {
+	  styleText += styleText;
+	}
+
+	document.getElementById("style").firstChild.data = styleText;
+    
+    document.body.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"));
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><p>This should be green</p></body>
+
+</html>
diff --git a/layout/style/crashtests/crashtests.list b/layout/style/crashtests/crashtests.list
index b0325e1724b3..f2ae7dedbcdb 100644
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -69,6 +69,7 @@ load 592698-1.html
 load 601437-1.html
 load 601439-1.html
 load 605689-1.html
+load 637242.xhtml
 load 645142.html
 load 611922-1.html
 == 645951-1.html 645951-1-ref.html
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index f96a106d7604..b456affb0a0f 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -1331,8 +1331,7 @@ SetFactor(const nsCSSValue& aValue, float& aField, bool& aCanStoreInRuleTree,
   NS_NOTREACHED("SetFactor: inappropriate unit");
 }
 
-// Overloaded new operator. Initializes the memory to 0 and relies on an arena
-// (which comes from the presShell) to perform the allocation.
+// Overloaded new operator that allocates from a presShell arena.
 void*
 nsRuleNode::operator new(size_t sz, nsPresContext* aPresContext) CPP_THROW_NEW
 {
@@ -1415,6 +1414,7 @@ nsRuleNode::nsRuleNode(nsPresContext* aContext, nsRuleNode* aParent,
   : mPresContext(aContext),
     mParent(aParent),
     mRule(aRule),
+    mNextSibling(nullptr),
     mDependentBits((uint32_t(aLevel) << NS_RULE_NODE_LEVEL_SHIFT) |
                    (aIsImportant ? NS_RULE_NODE_IS_IMPORTANT : 0)),
     mNoneBits(0),
@@ -8920,18 +8920,8 @@ nsRuleNode::Mark()
     node->mDependentBits |= NS_RULE_NODE_GC_MARK;
 }
 
-static PLDHashOperator
-SweepRuleNodeChildren(PLDHashTable *table, PLDHashEntryHdr *hdr,
-                      uint32_t number, void *arg)
-{
-  ChildrenHashEntry *entry = static_cast<ChildrenHashEntry*>(hdr);
-  if (entry->mRuleNode->Sweep())
-    return PL_DHASH_REMOVE; // implies NEXT, unless |ed with STOP
-  return PL_DHASH_NEXT;
-}
-
 bool
-nsRuleNode::Sweep()
+nsRuleNode::DestroyIfNotMarked()
 {
   // If we're not marked, then we have to delete ourself.
   // However, we never allow the root node to GC itself, because nsStyleSet
@@ -8946,36 +8936,92 @@ nsRuleNode::Sweep()
 
   // Clear our mark, for the next time around.
   mDependentBits &= ~NS_RULE_NODE_GC_MARK;
+  return false;
+}
 
-  // Call sweep on the children, since some may not be marked, and
-  // remove any deleted children from the child lists.
-  if (HaveChildren()) {
-    uint32_t childrenDestroyed;
-    if (ChildrenAreHashed()) {
-      PLDHashTable *children = ChildrenHash();
-      uint32_t oldChildCount = children->entryCount;
-      PL_DHashTableEnumerate(children, SweepRuleNodeChildren, nullptr);
-      childrenDestroyed = children->entryCount - oldChildCount;
-    } else {
-      childrenDestroyed = 0;
-      for (nsRuleNode **children = ChildrenListPtr(); *children; ) {
-        nsRuleNode *next = (*children)->mNextSibling;
-        if ((*children)->Sweep()) {
-          // This rule node was destroyed, so implicitly advance by
-          // making *children point to the next entry.
-          *children = next;
-          ++childrenDestroyed;
-        } else {
-          // Advance.
-          children = &(*children)->mNextSibling;
-        }
+PLDHashOperator
+nsRuleNode::SweepHashEntry(PLDHashTable *table, PLDHashEntryHdr *hdr,
+                           uint32_t number, void *arg)
+{
+  ChildrenHashEntry *entry = static_cast<ChildrenHashEntry*>(hdr);
+  nsRuleNode* node = entry->mRuleNode;
+  if (node->DestroyIfNotMarked()) {
+    return PL_DHASH_REMOVE; // implies NEXT, unless |ed with STOP
+  }
+  if (node->HaveChildren()) {
+    // When children are hashed mNextSibling is not normally used but we use it
+    // here to build a list of children that needs to be swept.
+    nsRuleNode** headQ = static_cast<nsRuleNode**>(arg);
+    node->mNextSibling = *headQ;
+    *headQ = node;
+  }
+  return PL_DHASH_NEXT;
+}
+
+void
+nsRuleNode::SweepChildren(nsTArray<nsRuleNode*>& aSweepQueue)
+{
+  NS_ASSERTION(!(mDependentBits & NS_RULE_NODE_GC_MARK),
+               "missing DestroyIfNotMarked() call");
+  NS_ASSERTION(HaveChildren(),
+               "why call SweepChildren with no children?");
+  uint32_t childrenDestroyed = 0;
+  nsRuleNode* survivorsWithChildren = nullptr;
+  if (ChildrenAreHashed()) {
+    PLDHashTable* children = ChildrenHash();
+    uint32_t oldChildCount = children->entryCount;
+    PL_DHashTableEnumerate(children, SweepHashEntry, &survivorsWithChildren);
+    childrenDestroyed = oldChildCount - children->entryCount;
+    if (childrenDestroyed == oldChildCount) {
+      PL_DHashTableDestroy(children);
+      mChildren.asVoid = nullptr;
+    }
+  } else {
+    for (nsRuleNode** children = ChildrenListPtr(); *children; ) {
+      nsRuleNode* next = (*children)->mNextSibling;
+      if ((*children)->DestroyIfNotMarked()) {
+        // This rule node was destroyed, unlink it from the list by
+        // making *children point to the next entry.
+        *children = next;
+        ++childrenDestroyed;
+      } else {
+        children = &(*children)->mNextSibling;
+      }
+    }
+    survivorsWithChildren = ChildrenList();
+  }
+  if (survivorsWithChildren) {
+    aSweepQueue.AppendElement(survivorsWithChildren);
+  }
+  NS_ASSERTION(childrenDestroyed <= mRefCnt, "wrong ref count");
+  mRefCnt -= childrenDestroyed;
+  NS_POSTCONDITION(IsRoot() || mRefCnt > 0,
+                   "We didn't get swept, so we'd better have style contexts "
+                   "pointing to us or to one of our descendants, which means "
+                   "we'd better have a nonzero mRefCnt here!");
+}
+
+bool
+nsRuleNode::Sweep()
+{
+  NS_ASSERTION(IsRoot(), "must start sweeping at a root");
+  NS_ASSERTION(!mNextSibling, "root must not have mNextSibling");
+
+  if (DestroyIfNotMarked()) {
+    return true;
+  }
+
+  nsAutoTArray<nsRuleNode*, 70> sweepQueue;
+  sweepQueue.AppendElement(this);
+  while (!sweepQueue.IsEmpty()) {
+    nsTArray<nsRuleNode*>::index_type last = sweepQueue.Length() - 1;
+    nsRuleNode* ruleNode = sweepQueue[last];
+    sweepQueue.RemoveElementAt(last);
+    for (; ruleNode; ruleNode = ruleNode->mNextSibling) {
+      if (ruleNode->HaveChildren()) {
+        ruleNode->SweepChildren(sweepQueue);
       }
     }
-    mRefCnt -= childrenDestroyed;
-    NS_POSTCONDITION(IsRoot() || mRefCnt > 0,
-                     "We didn't get swept, so we'd better have style contexts "
-                     "pointing to us or to one of our descendants, which means "
-                     "we'd better have a nonzero mRefCnt here!");
   }
   return false;
 }
diff --git a/layout/style/nsRuleNode.h b/layout/style/nsRuleNode.h
index 7f116b9f1f60..ede709f14028 100644
--- a/layout/style/nsRuleNode.h
+++ b/layout/style/nsRuleNode.h
@@ -306,6 +306,12 @@ private:
                          const PLDHashEntryHdr *aHdr,
                          const void *aKey);
 
+  static PLDHashOperator
+  SweepHashEntry(PLDHashTable *table, PLDHashEntryHdr *hdr,
+                 uint32_t number, void *arg);
+  void SweepChildren(nsTArray<nsRuleNode*>& aSweepQueue);
+  bool DestroyIfNotMarked();
+
   static const PLDHashTableOps ChildrenHashOps;
 
   static PLDHashOperator
@@ -401,8 +407,7 @@ private:
   uint32_t mRefCnt;
 
 public:
-  // Overloaded new operator. Initializes the memory to 0 and relies on an arena
-  // (which comes from the presShell) to perform the allocation.
+  // Overloaded new operator that allocates from a presShell arena.
   void* operator new(size_t sz, nsPresContext* aContext) CPP_THROW_NEW;
   void Destroy() { DestroyInternal(nullptr); }
 
@@ -713,6 +718,8 @@ public:
    * ancestors until it reaches a marked one.  Sweep recursively sweeps
    * the children, destroys any that are unmarked, and clears marks,
    * returning true if the node on which it was called was destroyed.
+   * If children are hashed, the mNextSibling field on the children is
+   * temporarily used internally by Sweep.
    */
   void Mark();
   bool Sweep();
diff --git a/media/libvpx/Makefile.in b/media/libvpx/Makefile.in
index b224881a598e..23e7bb99e46d 100644
--- a/media/libvpx/Makefile.in
+++ b/media/libvpx/Makefile.in
@@ -75,7 +75,7 @@ vp8_asm_enc_offsets.s: CFLAGS := -DINLINE_ASM
 
 vp8_asm_enc_offsets.s: $(srcdir)/vp8/encoder/vp8_asm_enc_offsets.c
 	$(REPORT_BUILD)
-	$(CC) -S $(COMPILE_CFLAGS) $(TARGET_LOCAL_INCLUDES) $(_VPATH_SRCS)
+	$(CC) -S $(COMPILE_CFLAGS) $(NO_INTEGRATED_AS_CFLAGS) $(TARGET_LOCAL_INCLUDES) $(_VPATH_SRCS)
 
 vp8_asm_enc_offsets.asm: vp8_asm_enc_offsets.s
 	grep $(OFFSET_PATTERN) $< | sed -e 's/[$$\#]//g' \
diff --git a/media/mtransport/databuffer.h b/media/mtransport/databuffer.h
index d3bc0d524d1a..a95ab1c52119 100644
--- a/media/mtransport/databuffer.h
+++ b/media/mtransport/databuffer.h
@@ -15,16 +15,6 @@
 
 namespace mozilla {
 
-class DataBuffer;
-
-// Temporary whitelist for refcounted class dangerously exposing its destructor.
-// Filed bug 1028139 to address this class.
-template<>
-struct HasDangerousPublicDestructor<DataBuffer>
-{
-  static const bool value = true;
-};
-
 class DataBuffer {
  public:
   DataBuffer() : data_(nullptr), len_(0) {}
@@ -43,8 +33,6 @@ class DataBuffer {
   size_t len() const { return len_; }
   const bool empty() const { return len_ != 0; }
 
-  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(DataBuffer)
-
 private:
   ScopedDeleteArray<uint8_t> data_;
   size_t len_;
diff --git a/media/mtransport/test/transport_unittests.cpp b/media/mtransport/test/transport_unittests.cpp
index 00a7f52142bd..d25f1603e1af 100644
--- a/media/mtransport/test/transport_unittests.cpp
+++ b/media/mtransport/test/transport_unittests.cpp
@@ -168,7 +168,7 @@ class DtlsRecordParser {
   DtlsRecordParser(const unsigned char *data, size_t len)
       : buffer_(data, len), offset_(0) {}
 
-  bool NextRecord(uint8_t* ct, RefPtr<DataBuffer>* buffer) {
+  bool NextRecord(uint8_t* ct, nsAutoPtr<DataBuffer>* buffer) {
     if (!remaining())
       return false;
 
@@ -210,7 +210,7 @@ class DtlsRecordInspector : public Inspector {
     DtlsRecordParser parser(data, len);
 
     uint8_t ct;
-    RefPtr<DataBuffer> buf;
+    nsAutoPtr<DataBuffer> buf;
     while(parser.NextRecord(&ct, &buf)) {
       OnRecord(layer, ct, buf->data(), buf->len());
     }
diff --git a/media/webrtc/signaling/src/media/VcmSIPCCBinding.cpp b/media/webrtc/signaling/src/media/VcmSIPCCBinding.cpp
index 656dd73e5c05..0af36be61740 100644
--- a/media/webrtc/signaling/src/media/VcmSIPCCBinding.cpp
+++ b/media/webrtc/signaling/src/media/VcmSIPCCBinding.cpp
@@ -2793,14 +2793,15 @@ int vcmGetVideoCodecList(int request_type)
 }
 
 /**
- * Get max supported H.264 video packetization mode.
- * @return maximum supported video packetization mode for H.264. Value returned
- * must be 0 or 1. Value 2 is not supported yet.
+ * Get supported H.264 video packetization modes
+ * @return mask of supported video packetization modes for H.264. Value returned
+ * must be 1 to 3 (bit 0 is mode 0, bit 1 is mode 1.
+ * Bit 2 (Mode 2) is not supported yet.
  */
-int vcmGetVideoMaxSupportedPacketizationMode()
+int vcmGetH264SupportedPacketizationModes()
 {
-  // We support mode 1 packetization in webrtc
-  return 1;
+  // We support mode 1 packetization only in webrtc currently
+  return VCM_H264_MODE_1;
 }
 
 /**
diff --git a/media/webrtc/signaling/src/sipcc/core/common/prot_configmgr.c b/media/webrtc/signaling/src/sipcc/core/common/prot_configmgr.c
index 20ba61f3929f..8c0727756c7a 100755
--- a/media/webrtc/signaling/src/sipcc/core/common/prot_configmgr.c
+++ b/media/webrtc/signaling/src/sipcc/core/common/prot_configmgr.c
@@ -606,12 +606,16 @@ sip_config_video_add_codecs (rtp_ptype aSupportedCodecs[],
     count++;
   }
   if ( codec_mask & VCM_CODEC_RESOURCE_H264) {
-    if (vcmGetVideoMaxSupportedPacketizationMode() == 1) {
+    int modes = vcmGetH264SupportedPacketizationModes();
+    // prefer mode 1 to mode 0
+    if (modes & VCM_H264_MODE_1) {
       aSupportedCodecs[count] = RTP_H264_P1;
       count++;
     }
-    aSupportedCodecs[count] = RTP_H264_P0;
-    count++;
+    if (modes & VCM_H264_MODE_0) {
+      aSupportedCodecs[count] = RTP_H264_P0;
+      count++;
+    }
   }
   if ( codec_mask & VCM_CODEC_RESOURCE_H263) {
     aSupportedCodecs[count] = RTP_H263;
diff --git a/media/webrtc/signaling/src/sipcc/core/gsm/gsm_sdp.c b/media/webrtc/signaling/src/sipcc/core/gsm/gsm_sdp.c
index ea7efad275f8..e17fad6bc032 100644
--- a/media/webrtc/signaling/src/sipcc/core/gsm/gsm_sdp.c
+++ b/media/webrtc/signaling/src/sipcc/core/gsm/gsm_sdp.c
@@ -1178,6 +1178,8 @@ gsmsdp_set_video_media_attributes (uint32_t media_type, void *cc_sdp_p, uint16_t
                 return;
             }
             added_fmtp = 1;
+            (void) sdp_attr_set_fmtp_payload_type(sdp_p, level, 0, a_inst,
+                                                  payload_number);
             {
                 char buffer[32];
                 uint32_t profile_level_id = vcmGetVideoH264ProfileLevelID();
@@ -1221,10 +1223,10 @@ gsmsdp_set_video_media_attributes (uint32_t media_type, void *cc_sdp_p, uint16_t
                         return;
                     }
                     added_fmtp = 1;
-                }
 
-                (void) sdp_attr_set_fmtp_payload_type(sdp_p, level, 0, a_inst,
-                                                      payload_number);
+                    (void) sdp_attr_set_fmtp_payload_type(sdp_p, level, 0, a_inst,
+                                                          payload_number);
+                }
 
                 if (max_fs) {
                     (void) sdp_attr_set_fmtp_max_fs(sdp_p, level, 0, a_inst,
diff --git a/media/webrtc/signaling/src/sipcc/core/sdp/sdp_access.c b/media/webrtc/signaling/src/sipcc/core/sdp/sdp_access.c
index 8fae68e76a0d..2143f2eae84c 100644
--- a/media/webrtc/signaling/src/sipcc/core/sdp/sdp_access.c
+++ b/media/webrtc/signaling/src/sipcc/core/sdp/sdp_access.c
@@ -1744,12 +1744,18 @@ u32 sdp_get_media_payload_type (void *sdp_ptr, u16 level, u16 payload_num,
                         return (SET_PAYLOAD_TYPE_WITH_DYNAMIC(ptype, RTP_OPUS));
                     }
                     if (cpr_strcasecmp(encname, SIPSDP_ATTR_ENCNAME_H264) == 0) {
-                        sdp_attr_get_fmtp_pack_mode(sdp_p, level, 0, (uint16_t) (i + 1), &pack_mode);
+                      int fmtp_inst = sdp_find_fmtp_inst(sdp_p, level,
+                                                         mca_p->payload_type[payload_num-1]);
+                      if (fmtp_inst < 0) {
+                        return (SET_PAYLOAD_TYPE_WITH_DYNAMIC(ptype, RTP_H264_P0));
+                      } else {
+                        sdp_attr_get_fmtp_pack_mode(sdp_p, level, 0, (uint16_t) fmtp_inst, &pack_mode);
                         if (pack_mode == SDP_DEFAULT_PACKETIZATION_MODE_VALUE) {
                             return (SET_PAYLOAD_TYPE_WITH_DYNAMIC(ptype, RTP_H264_P0));
                         } else {
                             return (SET_PAYLOAD_TYPE_WITH_DYNAMIC(ptype, RTP_H264_P1));
                         }
+                      }
                     }
                     if (cpr_strcasecmp(encname, SIPSDP_ATTR_ENCNAME_VP8) == 0) {
                         return (SET_PAYLOAD_TYPE_WITH_DYNAMIC(ptype, RTP_VP8));
diff --git a/media/webrtc/signaling/src/sipcc/include/vcm.h b/media/webrtc/signaling/src/sipcc/include/vcm.h
index 03e9545e5b1e..a499e13e585b 100755
--- a/media/webrtc/signaling/src/sipcc/include/vcm.h
+++ b/media/webrtc/signaling/src/sipcc/include/vcm.h
@@ -66,6 +66,11 @@
 #define VCM_DSP_FULLDUPLEX_HW 4 // HW codecs
 #define VCM_DSP_FULLDUPLEX_GMP 5 // GMP-loaded codecs
 
+// Bitmasks for vcmGetH264SupportedPacketizationMode()
+#define VCM_H264_MODE_0     1
+#define VCM_H264_MODE_1     2
+#define VCM_H264_MODE_2     4
+
 #define CC_KFACTOR_STAT_LEN   (256)
 
 /* Should be enough for any reasonable use-case */
@@ -881,11 +886,12 @@ int vcmGetAudioCodecList(int request_type);
 int vcmGetVideoCodecList(int request_type);
 
 /**
- * Get max supported H.264 video packetization mode.
- * @return maximum supported video packetization mode for H.264. Value returned
- * must be 0 or 1. Value 2 is not supported yet.
+ * Get supported H.264 video packetization modes
+ * @return mask of supported video packetization modes for H.264. Value returned
+ * must be 1 to 3 (bit 0 is mode 0, bit 1 is mode 1.
+ * Bit 2 (Mode 2) is not supported yet.
  */
-int vcmGetVideoMaxSupportedPacketizationMode();
+int vcmGetH264SupportedPacketizationModes();
 
 /**
  * Get supported H.264 profile-level-id
diff --git a/mfbt/lz4.c b/mfbt/lz4.c
index 91819addd836..042a2201e6f8 100644
--- a/mfbt/lz4.c
+++ b/mfbt/lz4.c
@@ -1,690 +1,1162 @@
-/*
-   LZ4 - Fast LZ compression algorithm
-   Copyright (C) 2011-2013, Yann Collet.
-   BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php)
-
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions are
-   met:
-
-       * Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-       * Redistributions in binary form must reproduce the above
-   copyright notice, this list of conditions and the following disclaimer
-   in the documentation and/or other materials provided with the
-   distribution.
-
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-   You can contact the author at :
-   - LZ4 homepage : http://fastcompression.blogspot.com/p/lz4.html
-   - LZ4 source repository : http://code.google.com/p/lz4/
-*/
-
-/*
-Note : this source file requires "lz4_encoder.h"
-*/
-
-//**************************************
-// Tuning parameters
-//**************************************
-// MEMORY_USAGE :
-// Memory usage formula : N->2^N Bytes (examples : 10 -> 1KB; 12 -> 4KB ; 16 -> 64KB; 20 -> 1MB; etc.)
-// Increasing memory usage improves compression ratio
-// Reduced memory usage can improve speed, due to cache effect
-// Default value is 14, for 16KB, which nicely fits into Intel x86 L1 cache
-#define MEMORY_USAGE 14
-
-// HEAPMODE :
-// Select how default compression function will allocate memory for its hash table,
-// in memory stack (0:default, fastest), or in memory heap (1:requires memory allocation (malloc)).
-// Default allocation strategy is to use stack (HEAPMODE 0)
-// Note : explicit functions *_stack* and *_heap* are unaffected by this setting
-#define HEAPMODE 0
-
-// BIG_ENDIAN_NATIVE_BUT_INCOMPATIBLE :
-// This will provide a small boost to performance for big endian cpu, but the resulting compressed stream will be incompatible with little-endian CPU.
-// You can set this option to 1 in situations where data will remain within closed environment
-// This option is useless on Little_Endian CPU (such as x86)
-//#define BIG_ENDIAN_NATIVE_BUT_INCOMPATIBLE 1
-
-
-
-//**************************************
-// CPU Feature Detection
-//**************************************
-// 32 or 64 bits ?
-#if (defined(__x86_64__) || defined(_M_X64) || defined(_WIN64) \
-  || defined(__powerpc64__) || defined(__ppc64__) || defined(__PPC64__) \
-  || defined(__64BIT__) || defined(_LP64) || defined(__LP64__) \
-  || defined(__ia64) || defined(__itanium__) || defined(_M_IA64) )   // Detects 64 bits mode
-#  define LZ4_ARCH64 1
-#else
-#  define LZ4_ARCH64 0
-#endif
-
-// Little Endian or Big Endian ?
-// Overwrite the #define below if you know your architecture endianess
-#if defined (__GLIBC__)
-#  include <endian.h>
-#  if (__BYTE_ORDER == __BIG_ENDIAN)
-#     define LZ4_BIG_ENDIAN 1
-#  endif
-#elif (defined(__BIG_ENDIAN__) || defined(__BIG_ENDIAN) || defined(_BIG_ENDIAN)) && !(defined(__LITTLE_ENDIAN__) || defined(__LITTLE_ENDIAN) || defined(_LITTLE_ENDIAN))
-#  define LZ4_BIG_ENDIAN 1
-#elif defined(__sparc) || defined(__sparc__) \
-   || defined(__powerpc__) || defined(__ppc__) || defined(__PPC__) \
-   || defined(__hpux)  || defined(__hppa) \
-   || defined(_MIPSEB) || defined(__s390__)
-#  define LZ4_BIG_ENDIAN 1
-#else
-// Little Endian assumed. PDP Endian and other very rare endian format are unsupported.
-#endif
-
-// Unaligned memory access is automatically enabled for "common" CPU, such as x86.
-// For others CPU, the compiler will be more cautious, and insert extra code to ensure aligned access is respected
-// If you know your target CPU supports unaligned memory access, you want to force this option manually to improve performance
-#if defined(__ARM_FEATURE_UNALIGNED)
-#  define LZ4_FORCE_UNALIGNED_ACCESS 1
-#endif
-
-// Define this parameter if your target system or compiler does not support hardware bit count
-#if defined(_MSC_VER) && defined(_WIN32_WCE)            // Visual Studio for Windows CE does not support Hardware bit count
-#  define LZ4_FORCE_SW_BITCOUNT
-#endif
-
-
-//**************************************
-// Compiler Options
-//**************************************
-#if defined (__STDC_VERSION__) && __STDC_VERSION__ >= 199901L   // C99
-/* "restrict" is a known keyword */
-#else
-#  define restrict // Disable restrict
-#endif
-
-#define GCC_VERSION (__GNUC__ * 100 + __GNUC_MINOR__)
-
-#ifdef _MSC_VER    // Visual Studio
-#  include <intrin.h>   // For Visual 2005
-#  if LZ4_ARCH64   // 64-bit
-#    pragma intrinsic(_BitScanForward64) // For Visual 2005
-#    pragma intrinsic(_BitScanReverse64) // For Visual 2005
-#  else
-#    pragma intrinsic(_BitScanForward)   // For Visual 2005
-#    pragma intrinsic(_BitScanReverse)   // For Visual 2005
-#  endif
-#  pragma warning(disable : 4127)        // disable: C4127: conditional expression is constant
-#endif
-
-#ifdef _MSC_VER
-#  define lz4_bswap16(x) _byteswap_ushort(x)
-#else
-#  define lz4_bswap16(x) ((unsigned short int) ((((x) >> 8) & 0xffu) | (((x) & 0xffu) << 8)))
-#endif
-
-#if (GCC_VERSION >= 302) || (__INTEL_COMPILER >= 800) || defined(__clang__)
-#  define expect(expr,value)    (__builtin_expect ((expr),(value)) )
-#else
-#  define expect(expr,value)    (expr)
-#endif
-
-#define likely(expr)     expect((expr) != 0, 1)
-#define unlikely(expr)   expect((expr) != 0, 0)
-
-
-//**************************************
-// Includes
-//**************************************
-#include <stdlib.h>   // for malloc
-#include <string.h>   // for memset
-#include "lz4.h"
-
-
-//**************************************
-// Basic Types
-//**************************************
-#if defined (__STDC_VERSION__) && __STDC_VERSION__ >= 199901L   // C99
-# include <stdint.h>
-  typedef uint8_t  BYTE;
-  typedef uint16_t U16;
-  typedef uint32_t U32;
-  typedef  int32_t S32;
-  typedef uint64_t U64;
-#else
-  typedef unsigned char       BYTE;
-  typedef unsigned short      U16;
-  typedef unsigned int        U32;
-  typedef   signed int        S32;
-  typedef unsigned long long  U64;
-#endif
-
-#if defined(__GNUC__)  && !defined(LZ4_FORCE_UNALIGNED_ACCESS)
-#  define _PACKED __attribute__ ((packed))
-#else
-#  define _PACKED
-#endif
-
-#if !defined(LZ4_FORCE_UNALIGNED_ACCESS) && !defined(__GNUC__)
-#  pragma pack(push, 1)
-#endif
-
-typedef struct _U16_S { U16 v; } _PACKED U16_S;
-typedef struct _U32_S { U32 v; } _PACKED U32_S;
-typedef struct _U64_S { U64 v; } _PACKED U64_S;
-
-#if !defined(LZ4_FORCE_UNALIGNED_ACCESS) && !defined(__GNUC__)
-#  pragma pack(pop)
-#endif
-
-#define A64(x) (((U64_S *)(x))->v)
-#define A32(x) (((U32_S *)(x))->v)
-#define A16(x) (((U16_S *)(x))->v)
-
-
-//**************************************
-// Constants
-//**************************************
-#define HASHTABLESIZE (1 << MEMORY_USAGE)
-
-#define MINMATCH 4
-
-#define COPYLENGTH 8
-#define LASTLITERALS 5
-#define MFLIMIT (COPYLENGTH+MINMATCH)
-#define MINLENGTH (MFLIMIT+1)
-
-#define LZ4_64KLIMIT ((1<<16) + (MFLIMIT-1))
-#define SKIPSTRENGTH 6     // Increasing this value will make the compression run slower on incompressible data
-
-#define MAXD_LOG 16
-#define MAX_DISTANCE ((1 << MAXD_LOG) - 1)
-
-#define ML_BITS  4
-#define ML_MASK  ((1U<<ML_BITS)-1)
-#define RUN_BITS (8-ML_BITS)
-#define RUN_MASK ((1U<<RUN_BITS)-1)
-
-
-//**************************************
-// Architecture-specific macros
-//**************************************
-#if LZ4_ARCH64   // 64-bit
-#  define STEPSIZE 8
-#  define UARCH U64
-#  define AARCH A64
-#  define LZ4_COPYSTEP(s,d)       A64(d) = A64(s); d+=8; s+=8;
-#  define LZ4_COPYPACKET(s,d)     LZ4_COPYSTEP(s,d)
-#  define LZ4_SECURECOPY(s,d,e)   if (d<e) LZ4_WILDCOPY(s,d,e)
-#  define HTYPE                   U32
-#  define INITBASE(base)          const BYTE* const base = ip
-#else      // 32-bit
-#  define STEPSIZE 4
-#  define UARCH U32
-#  define AARCH A32
-#  define LZ4_COPYSTEP(s,d)       A32(d) = A32(s); d+=4; s+=4;
-#  define LZ4_COPYPACKET(s,d)     LZ4_COPYSTEP(s,d); LZ4_COPYSTEP(s,d);
-#  define LZ4_SECURECOPY          LZ4_WILDCOPY
-#  define HTYPE                   const BYTE*
-#  define INITBASE(base)          const int base = 0
-#endif
-
-#if (defined(LZ4_BIG_ENDIAN) && !defined(BIG_ENDIAN_NATIVE_BUT_INCOMPATIBLE))
-#  define LZ4_READ_LITTLEENDIAN_16(d,s,p) { U16 v = A16(p); v = lz4_bswap16(v); d = (s) - v; }
-#  define LZ4_WRITE_LITTLEENDIAN_16(p,i)  { U16 v = (U16)(i); v = lz4_bswap16(v); A16(p) = v; p+=2; }
-#else      // Little Endian
-#  define LZ4_READ_LITTLEENDIAN_16(d,s,p) { d = (s) - A16(p); }
-#  define LZ4_WRITE_LITTLEENDIAN_16(p,v)  { A16(p) = v; p+=2; }
-#endif
-
-
-//**************************************
-// Macros
-//**************************************
-#define LZ4_WILDCOPY(s,d,e)     do { LZ4_COPYPACKET(s,d) } while (d<e);
-#define LZ4_BLINDCOPY(s,d,l)    { BYTE* e=(d)+(l); LZ4_WILDCOPY(s,d,e); d=e; }
-
-
-//****************************
-// Private functions
-//****************************
-#if LZ4_ARCH64
-
-static inline int LZ4_NbCommonBytes (register U64 val)
-{
-#if defined(LZ4_BIG_ENDIAN)
-    #if defined(_MSC_VER) && !defined(LZ4_FORCE_SW_BITCOUNT)
-    unsigned long r = 0;
-    _BitScanReverse64( &r, val );
-    return (int)(r>>3);
-    #elif defined(__GNUC__) && (GCC_VERSION >= 304) && !defined(LZ4_FORCE_SW_BITCOUNT)
-    return (__builtin_clzll(val) >> 3);
-    #else
-    int r;
-    if (!(val>>32)) { r=4; } else { r=0; val>>=32; }
-    if (!(val>>16)) { r+=2; val>>=8; } else { val>>=24; }
-    r += (!val);
-    return r;
-    #endif
-#else
-    #if defined(_MSC_VER) && !defined(LZ4_FORCE_SW_BITCOUNT)
-    unsigned long r = 0;
-    _BitScanForward64( &r, val );
-    return (int)(r>>3);
-    #elif defined(__GNUC__) && (GCC_VERSION >= 304) && !defined(LZ4_FORCE_SW_BITCOUNT)
-    return (__builtin_ctzll(val) >> 3);
-    #else
-    static const int DeBruijnBytePos[64] = { 0, 0, 0, 0, 0, 1, 1, 2, 0, 3, 1, 3, 1, 4, 2, 7, 0, 2, 3, 6, 1, 5, 3, 5, 1, 3, 4, 4, 2, 5, 6, 7, 7, 0, 1, 2, 3, 3, 4, 6, 2, 6, 5, 5, 3, 4, 5, 6, 7, 1, 2, 4, 6, 4, 4, 5, 7, 2, 6, 5, 7, 6, 7, 7 };
-    return DeBruijnBytePos[((U64)((val & -val) * 0x0218A392CDABBD3F)) >> 58];
-    #endif
-#endif
-}
-
-#else
-
-static inline int LZ4_NbCommonBytes (register U32 val)
-{
-#if defined(LZ4_BIG_ENDIAN)
-#  if defined(_MSC_VER) && !defined(LZ4_FORCE_SW_BITCOUNT)
-    unsigned long r = 0;
-    _BitScanReverse( &r, val );
-    return (int)(r>>3);
-#  elif defined(__GNUC__) && (GCC_VERSION >= 304) && !defined(LZ4_FORCE_SW_BITCOUNT)
-    return (__builtin_clz(val) >> 3);
-#  else
-    int r;
-    if (!(val>>16)) { r=2; val>>=8; } else { r=0; val>>=24; }
-    r += (!val);
-    return r;
-#  endif
-#else
-#  if defined(_MSC_VER) && !defined(LZ4_FORCE_SW_BITCOUNT)
-    unsigned long r;
-    _BitScanForward( &r, val );
-    return (int)(r>>3);
-#  elif defined(__GNUC__) && (GCC_VERSION >= 304) && !defined(LZ4_FORCE_SW_BITCOUNT)
-    return (__builtin_ctz(val) >> 3);
-#  else
-    static const int DeBruijnBytePos[32] = { 0, 0, 3, 0, 3, 1, 3, 0, 3, 2, 2, 1, 3, 2, 0, 1, 3, 3, 1, 2, 2, 2, 2, 0, 3, 1, 2, 0, 1, 0, 1, 1 };
-    return DeBruijnBytePos[((U32)((val & -(S32)val) * 0x077CB531U)) >> 27];
-#  endif
-#endif
-}
-
-#endif
-
-
-
-//******************************
-// Compression functions
-//******************************
-
-/*
-int LZ4_compress_stack(
-                 const char* source,
-                 char* dest,
-                 int inputSize)
-
-Compress 'inputSize' bytes from 'source' into an output buffer 'dest'.
-Destination buffer must be already allocated, and sized at a minimum of LZ4_compressBound(inputSize).
-return : the number of bytes written in buffer 'dest'
-*/
-#define FUNCTION_NAME LZ4_compress_stack
-#include "lz4_encoder.h"
-
-
-/*
-int LZ4_compress_stack_limitedOutput(
-                 const char* source,
-                 char* dest,
-                 int inputSize,
-                 int maxOutputSize)
-
-Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'.
-If it cannot achieve it, compression will stop, and result of the function will be zero.
-return : the number of bytes written in buffer 'dest', or 0 if the compression fails
-*/
-#define FUNCTION_NAME LZ4_compress_stack_limitedOutput
-#define LIMITED_OUTPUT
-#include "lz4_encoder.h"
-
-
-/*
-int LZ4_compress64k_stack(
-                 const char* source,
-                 char* dest,
-                 int inputSize)
-
-Compress 'inputSize' bytes from 'source' into an output buffer 'dest'.
-This function compresses better than LZ4_compress_stack(), on the condition that
-'inputSize' must be < to LZ4_64KLIMIT, or the function will fail.
-Destination buffer must be already allocated, and sized at a minimum of LZ4_compressBound(inputSize).
-return : the number of bytes written in buffer 'dest', or 0 if compression fails
-*/
-#define FUNCTION_NAME LZ4_compress64k_stack
-#define COMPRESS_64K
-#include "lz4_encoder.h"
-
-
-/*
-int LZ4_compress64k_stack_limitedOutput(
-                 const char* source,
-                 char* dest,
-                 int inputSize,
-                 int maxOutputSize)
-
-Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'.
-This function compresses better than LZ4_compress_stack_limitedOutput(), on the condition that
-'inputSize' must be < to LZ4_64KLIMIT, or the function will fail.
-If it cannot achieve it, compression will stop, and result of the function will be zero.
-return : the number of bytes written in buffer 'dest', or 0 if the compression fails
-*/
-#define FUNCTION_NAME LZ4_compress64k_stack_limitedOutput
-#define COMPRESS_64K
-#define LIMITED_OUTPUT
-#include "lz4_encoder.h"
-
-
-/*
-void* LZ4_createHeapMemory();
-int LZ4_freeHeapMemory(void* ctx);
-
-Used to allocate and free hashTable memory 
-to be used by the LZ4_compress_heap* family of functions.
-LZ4_createHeapMemory() returns NULL is memory allocation fails.
-*/
-void* LZ4_create() { return malloc(HASHTABLESIZE); }
-int   LZ4_free(void* ctx) { free(ctx); return 0; }
-
-
-/*
-int LZ4_compress_heap(
-                 void* ctx,
-                 const char* source,
-                 char* dest,
-                 int inputSize)
-
-Compress 'inputSize' bytes from 'source' into an output buffer 'dest'.
-The memory used for compression must be created by LZ4_createHeapMemory() and provided by pointer 'ctx'.
-Destination buffer must be already allocated, and sized at a minimum of LZ4_compressBound(inputSize).
-return : the number of bytes written in buffer 'dest'
-*/
-#define FUNCTION_NAME LZ4_compress_heap
-#define USE_HEAPMEMORY
-#include "lz4_encoder.h"
-
-
-/*
-int LZ4_compress_heap_limitedOutput(
-                 void* ctx,
-                 const char* source,
-                 char* dest,
-                 int inputSize,
-                 int maxOutputSize)
-
-Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'.
-If it cannot achieve it, compression will stop, and result of the function will be zero.
-The memory used for compression must be created by LZ4_createHeapMemory() and provided by pointer 'ctx'.
-return : the number of bytes written in buffer 'dest', or 0 if the compression fails
-*/
-#define FUNCTION_NAME LZ4_compress_heap_limitedOutput
-#define LIMITED_OUTPUT
-#define USE_HEAPMEMORY
-#include "lz4_encoder.h"
-
-
-/*
-int LZ4_compress64k_heap(
-                 void* ctx,
-                 const char* source,
-                 char* dest,
-                 int inputSize)
-
-Compress 'inputSize' bytes from 'source' into an output buffer 'dest'.
-The memory used for compression must be created by LZ4_createHeapMemory() and provided by pointer 'ctx'.
-'inputSize' must be < to LZ4_64KLIMIT, or the function will fail.
-Destination buffer must be already allocated, and sized at a minimum of LZ4_compressBound(inputSize).
-return : the number of bytes written in buffer 'dest'
-*/
-#define FUNCTION_NAME LZ4_compress64k_heap
-#define COMPRESS_64K
-#define USE_HEAPMEMORY
-#include "lz4_encoder.h"
-
-
-/*
-int LZ4_compress64k_heap_limitedOutput(
-                 void* ctx,
-                 const char* source,
-                 char* dest,
-                 int inputSize,
-                 int maxOutputSize)
-
-Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'.
-If it cannot achieve it, compression will stop, and result of the function will be zero.
-The memory used for compression must be created by LZ4_createHeapMemory() and provided by pointer 'ctx'.
-'inputSize' must be < to LZ4_64KLIMIT, or the function will fail.
-return : the number of bytes written in buffer 'dest', or 0 if the compression fails
-*/
-#define FUNCTION_NAME LZ4_compress64k_heap_limitedOutput
-#define COMPRESS_64K
-#define LIMITED_OUTPUT
-#define USE_HEAPMEMORY
-#include "lz4_encoder.h"
-
-
-int LZ4_compress(const char* source, char* dest, int inputSize)
-{
-#if HEAPMODE
-    void* ctx = LZ4_create();
-    int result;
-    if (ctx == NULL) return 0;    // Failed allocation => compression not done
-    if (inputSize < LZ4_64KLIMIT)
-        result = LZ4_compress64k_heap(ctx, source, dest, inputSize);
-    else result = LZ4_compress_heap(ctx, source, dest, inputSize);
-    LZ4_free(ctx);
-    return result;
-#else
-    if (inputSize < (int)LZ4_64KLIMIT) return LZ4_compress64k_stack(source, dest, inputSize);
-    return LZ4_compress_stack(source, dest, inputSize);
-#endif
-}
-
-
-int LZ4_compress_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize)
-{
-#if HEAPMODE
-    void* ctx = LZ4_create();
-    int result;
-    if (ctx == NULL) return 0;    // Failed allocation => compression not done
-    if (inputSize < LZ4_64KLIMIT)
-        result = LZ4_compress64k_heap_limitedOutput(ctx, source, dest, inputSize, maxOutputSize);
-    else result = LZ4_compress_heap_limitedOutput(ctx, source, dest, inputSize, maxOutputSize);
-    LZ4_free(ctx);
-    return result;
-#else
-    if (inputSize < (int)LZ4_64KLIMIT) return LZ4_compress64k_stack_limitedOutput(source, dest, inputSize, maxOutputSize);
-    return LZ4_compress_stack_limitedOutput(source, dest, inputSize, maxOutputSize);
-#endif
-}
-
-
-//****************************
-// Decompression functions
-//****************************
-
-typedef enum { noPrefix = 0, withPrefix = 1 } prefix64k_directive;
-typedef enum { endOnOutputSize = 0, endOnInputSize = 1 } end_directive;
-typedef enum { full = 0, partial = 1 } exit_directive;
-
-
-// This generic decompression function cover all use cases.
-// It shall be instanciated several times, using different sets of directives
-// Note that it is essential this generic function is really inlined, 
-// in order to remove useless branches during compilation optimisation.
-static inline int LZ4_decompress_generic(
-                 const char* source,
-                 char* dest,
-                 int inputSize,          //
-                 int outputSize,         // OutputSize must be != 0; if endOnInput==endOnInputSize, this value is the max size of Output Buffer.
-
-                 int endOnInput,         // endOnOutputSize, endOnInputSize
-                 int prefix64k,          // noPrefix, withPrefix
-                 int partialDecoding,    // full, partial
-                 int targetOutputSize    // only used if partialDecoding==partial
-                 )
-{
-    // Local Variables
-    const BYTE* restrict ip = (const BYTE*) source;
-    const BYTE* ref;
-    const BYTE* const iend = ip + inputSize;
-
-    BYTE* op = (BYTE*) dest;
-    BYTE* const oend = op + outputSize;
-    BYTE* cpy;
-    BYTE* oexit = op + targetOutputSize;
-
-    size_t dec32table[] = {0, 3, 2, 3, 0, 0, 0, 0};
-#if LZ4_ARCH64
-    size_t dec64table[] = {0, 0, 0, (size_t)-1, 0, 1, 2, 3};
-#endif
-
-
-    // Special case
-    if ((partialDecoding) && (oexit> oend-MFLIMIT)) oexit = oend-MFLIMIT;   // targetOutputSize too large, better decode everything
-    if unlikely(outputSize==0) goto _output_error;                          // Empty output buffer
-
-
-    // Main Loop
-    while (1)
-    {
-        unsigned token;
-        size_t length;
-
-        // get runlength
-        token = *ip++;
-        if ((length=(token>>ML_BITS)) == RUN_MASK)  
-        { 
-            unsigned s=255; 
-            while (((endOnInput)?ip<iend:1) && (s==255)) 
-            { 
-                s = *ip++; 
-                length += s; 
-            } 
-        }
-
-        // copy literals
-        cpy = op+length;
-        if (((endOnInput) && ((cpy>(partialDecoding?oexit:oend-MFLIMIT)) || (ip+length>iend-(2+1+LASTLITERALS))) )
-            || ((!endOnInput) && (cpy>oend-COPYLENGTH)))
-        {
-            if (partialDecoding)
-            {
-                if (cpy > oend) goto _output_error;                            // Error : write attempt beyond end of output buffer
-                if ((endOnInput) && (ip+length > iend)) goto _output_error;    // Error : read attempt beyond end of input buffer
-            }
-            else
-            {
-                if ((!endOnInput) && (cpy != oend)) goto _output_error;        // Error : block decoding must stop exactly there, due to parsing restrictions
-                if ((endOnInput) && ((ip+length != iend) || (cpy > oend))) goto _output_error;   // Error : not enough place for another match (min 4) + 5 literals
-            }
-            memcpy(op, ip, length);
-            ip += length;
-            op += length;
-            break;                                       // Necessarily EOF, due to parsing restrictions
-        }
-        LZ4_WILDCOPY(ip, op, cpy); ip -= (op-cpy); op = cpy;
-
-        // get offset
-        LZ4_READ_LITTLEENDIAN_16(ref,cpy,ip); ip+=2;
-        if ((prefix64k==noPrefix) && unlikely(ref < (BYTE* const)dest)) goto _output_error;   // Error : offset outside destination buffer
-
-        // get matchlength
-        if ((length=(token&ML_MASK)) == ML_MASK) 
-        { 
-            while (endOnInput ? ip<iend-(LASTLITERALS+1) : 1)    // A minimum nb of input bytes must remain for LASTLITERALS + token
-            { 
-                unsigned s = *ip++; 
-                length += s; 
-                if (s==255) continue; 
-                break; 
-            } 
-        }
-
-        // copy repeated sequence
-        if unlikely((op-ref)<STEPSIZE)
-        {
-#if LZ4_ARCH64
-            size_t dec64 = dec64table[op-ref];
-#else
-            const size_t dec64 = 0;
-#endif
-            op[0] = ref[0];
-            op[1] = ref[1];
-            op[2] = ref[2];
-            op[3] = ref[3];
-            op += 4, ref += 4; ref -= dec32table[op-ref];
-            A32(op) = A32(ref); 
-            op += STEPSIZE-4; ref -= dec64;
-        } else { LZ4_COPYSTEP(ref,op); }
-        cpy = op + length - (STEPSIZE-4);
-
-        if unlikely(cpy>oend-(COPYLENGTH)-(STEPSIZE-4))
-        {
-            if (cpy > oend-LASTLITERALS) goto _output_error;    // Error : last 5 bytes must be literals
-            LZ4_SECURECOPY(ref, op, (oend-COPYLENGTH));
-            while(op<cpy) *op++=*ref++;
-            op=cpy;
-            continue;
-        }
-        LZ4_WILDCOPY(ref, op, cpy);
-        op=cpy;   // correction
-    }
-
-    // end of decoding
-    if (endOnInput)
-       return (int) (((char*)op)-dest);     // Nb of output bytes decoded
-    else
-       return (int) (((char*)ip)-source);   // Nb of input bytes read
-
-    // Overflow error detected
-_output_error:
-    return (int) (-(((char*)ip)-source))-1;
-}
-
-
-int LZ4_decompress_safe(const char* source, char* dest, int inputSize, int maxOutputSize)
-{
-    return LZ4_decompress_generic(source, dest, inputSize, maxOutputSize, endOnInputSize, noPrefix, full, 0);
-}
-
-int LZ4_decompress_fast(const char* source, char* dest, int outputSize)
-{
-    return LZ4_decompress_generic(source, dest, 0, outputSize, endOnOutputSize, noPrefix, full, 0);
-}
-
-int LZ4_decompress_safe_withPrefix64k(const char* source, char* dest, int inputSize, int maxOutputSize)
-{
-    return LZ4_decompress_generic(source, dest, inputSize, maxOutputSize, endOnInputSize, withPrefix, full, 0);
-}
-
-int LZ4_decompress_fast_withPrefix64k(const char* source, char* dest, int outputSize)
-{
-    return LZ4_decompress_generic(source, dest, 0, outputSize, endOnOutputSize, withPrefix, full, 0);
-}
-
-int LZ4_decompress_safe_partial(const char* source, char* dest, int inputSize, int targetOutputSize, int maxOutputSize)
-{
-    return LZ4_decompress_generic(source, dest, inputSize, maxOutputSize, endOnInputSize, noPrefix, partial, targetOutputSize);
-}
-
+/*
+   LZ4 - Fast LZ compression algorithm
+   Copyright (C) 2011-2014, Yann Collet.
+   BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php)
+
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions are
+   met:
+
+       * Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+       * Redistributions in binary form must reproduce the above
+   copyright notice, this list of conditions and the following disclaimer
+   in the documentation and/or other materials provided with the
+   distribution.
+
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+   You can contact the author at :
+   - LZ4 source repository : http://code.google.com/p/lz4/
+   - LZ4 public forum : https://groups.google.com/forum/#!forum/lz4c
+*/
+
+/**************************************
+   Tuning parameters
+**************************************/
+/*
+ * HEAPMODE :
+ * Select how default compression functions will allocate memory for their hash table,
+ * in memory stack (0:default, fastest), or in memory heap (1:requires memory allocation (malloc)).
+ */
+#define HEAPMODE 0
+
+
+/**************************************
+   CPU Feature Detection
+**************************************/
+/* 32 or 64 bits ? */
+#if (defined(__x86_64__) || defined(_M_X64) || defined(_WIN64) \
+  || defined(__powerpc64__) || defined(__powerpc64le__) \
+  || defined(__ppc64__) || defined(__ppc64le__) \
+  || defined(__PPC64__) || defined(__PPC64LE__) \
+  || defined(__ia64) || defined(__itanium__) || defined(_M_IA64) )   /* Detects 64 bits mode */
+#  define LZ4_ARCH64 1
+#else
+#  define LZ4_ARCH64 0
+#endif
+
+/*
+ * Little Endian or Big Endian ?
+ * Overwrite the #define below if you know your architecture endianess
+ */
+#include <stdlib.h>   /* Apparently required to detect endianess */
+#if defined (__GLIBC__)
+#  include <endian.h>
+#  if (__BYTE_ORDER == __BIG_ENDIAN)
+#     define LZ4_BIG_ENDIAN 1
+#  endif
+#elif (defined(__BIG_ENDIAN__) || defined(__BIG_ENDIAN) || defined(_BIG_ENDIAN)) && !(defined(__LITTLE_ENDIAN__) || defined(__LITTLE_ENDIAN) || defined(_LITTLE_ENDIAN))
+#  define LZ4_BIG_ENDIAN 1
+#elif defined(__sparc) || defined(__sparc__) \
+   || defined(__powerpc__) || defined(__ppc__) || defined(__PPC__) \
+   || defined(__hpux)  || defined(__hppa) \
+   || defined(_MIPSEB) || defined(__s390__)
+#  define LZ4_BIG_ENDIAN 1
+#else
+/* Little Endian assumed. PDP Endian and other very rare endian format are unsupported. */
+#endif
+
+/*
+ * Unaligned memory access is automatically enabled for "common" CPU, such as x86.
+ * For others CPU, such as ARM, the compiler may be more cautious, inserting unnecessary extra code to ensure aligned access property
+ * If you know your target CPU supports unaligned memory access, you want to force this option manually to improve performance
+ */
+#if defined(__ARM_FEATURE_UNALIGNED)
+#  define LZ4_FORCE_UNALIGNED_ACCESS 1
+#endif
+
+/* Define this parameter if your target system or compiler does not support hardware bit count */
+#if defined(_MSC_VER) && defined(_WIN32_WCE)   /* Visual Studio for Windows CE does not support Hardware bit count */
+#  define LZ4_FORCE_SW_BITCOUNT
+#endif
+
+/*
+ * BIG_ENDIAN_NATIVE_BUT_INCOMPATIBLE :
+ * This option may provide a small boost to performance for some big endian cpu, although probably modest.
+ * You may set this option to 1 if data will remain within closed environment.
+ * This option is useless on Little_Endian CPU (such as x86)
+ */
+
+/* #define BIG_ENDIAN_NATIVE_BUT_INCOMPATIBLE 1 */
+
+
+/**************************************
+ Compiler Options
+**************************************/
+#if defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L)   /* C99 */
+/* "restrict" is a known keyword */
+#else
+#  define restrict /* Disable restrict */
+#endif
+
+#ifdef _MSC_VER    /* Visual Studio */
+#  define FORCE_INLINE static __forceinline
+#  include <intrin.h>                    /* For Visual 2005 */
+#  if LZ4_ARCH64   /* 64-bits */
+#    pragma intrinsic(_BitScanForward64) /* For Visual 2005 */
+#    pragma intrinsic(_BitScanReverse64) /* For Visual 2005 */
+#  else            /* 32-bits */
+#    pragma intrinsic(_BitScanForward)   /* For Visual 2005 */
+#    pragma intrinsic(_BitScanReverse)   /* For Visual 2005 */
+#  endif
+#  pragma warning(disable : 4127)        /* disable: C4127: conditional expression is constant */
+#else
+#  ifdef __GNUC__
+#    define FORCE_INLINE static inline __attribute__((always_inline))
+#  else
+#    define FORCE_INLINE static inline
+#  endif
+#endif
+
+#ifdef _MSC_VER  /* Visual Studio */
+#  define lz4_bswap16(x) _byteswap_ushort(x)
+#else
+#  define lz4_bswap16(x) ((unsigned short int) ((((x) >> 8) & 0xffu) | (((x) & 0xffu) << 8)))
+#endif
+
+#define GCC_VERSION (__GNUC__ * 100 + __GNUC_MINOR__)
+
+#if (GCC_VERSION >= 302) || (__INTEL_COMPILER >= 800) || defined(__clang__)
+#  define expect(expr,value)    (__builtin_expect ((expr),(value)) )
+#else
+#  define expect(expr,value)    (expr)
+#endif
+
+#define likely(expr)     expect((expr) != 0, 1)
+#define unlikely(expr)   expect((expr) != 0, 0)
+
+
+/**************************************
+   Memory routines
+**************************************/
+#include <stdlib.h>   /* malloc, calloc, free */
+#define ALLOCATOR(n,s) calloc(n,s)
+#define FREEMEM        free
+#include <string.h>   /* memset, memcpy */
+#define MEM_INIT       memset
+
+
+/**************************************
+   Includes
+**************************************/
+#include "lz4.h"
+
+
+/**************************************
+   Basic Types
+**************************************/
+#if defined (__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L)   /* C99 */
+# include <stdint.h>
+  typedef  uint8_t BYTE;
+  typedef uint16_t U16;
+  typedef uint32_t U32;
+  typedef  int32_t S32;
+  typedef uint64_t U64;
+#else
+  typedef unsigned char       BYTE;
+  typedef unsigned short      U16;
+  typedef unsigned int        U32;
+  typedef   signed int        S32;
+  typedef unsigned long long  U64;
+#endif
+
+#if defined(__GNUC__)  && !defined(LZ4_FORCE_UNALIGNED_ACCESS)
+#  define _PACKED __attribute__ ((packed))
+#else
+#  define _PACKED
+#endif
+
+#if !defined(LZ4_FORCE_UNALIGNED_ACCESS) && !defined(__GNUC__)
+#  if defined(__IBMC__) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)
+#    pragma pack(1)
+#  else
+#    pragma pack(push, 1)
+#  endif
+#endif
+
+typedef struct { U16 v; }  _PACKED U16_S;
+typedef struct { U32 v; }  _PACKED U32_S;
+typedef struct { U64 v; }  _PACKED U64_S;
+typedef struct {size_t v;} _PACKED size_t_S;
+
+#if !defined(LZ4_FORCE_UNALIGNED_ACCESS) && !defined(__GNUC__)
+#  if defined(__SUNPRO_C) || defined(__SUNPRO_CC)
+#    pragma pack(0)
+#  else
+#    pragma pack(pop)
+#  endif
+#endif
+
+#define A16(x)   (((U16_S *)(x))->v)
+#define A32(x)   (((U32_S *)(x))->v)
+#define A64(x)   (((U64_S *)(x))->v)
+#define AARCH(x) (((size_t_S *)(x))->v)
+
+
+/**************************************
+   Constants
+**************************************/
+#define LZ4_HASHLOG   (LZ4_MEMORY_USAGE-2)
+#define HASHTABLESIZE (1 << LZ4_MEMORY_USAGE)
+#define HASH_SIZE_U32 (1 << LZ4_HASHLOG)
+
+#define MINMATCH 4
+
+#define COPYLENGTH 8
+#define LASTLITERALS 5
+#define MFLIMIT (COPYLENGTH+MINMATCH)
+static const int LZ4_minLength = (MFLIMIT+1);
+
+#define KB *(1U<<10)
+#define MB *(1U<<20)
+#define GB *(1U<<30)
+
+#define LZ4_64KLIMIT ((64 KB) + (MFLIMIT-1))
+#define SKIPSTRENGTH 6   /* Increasing this value will make the compression run slower on incompressible data */
+
+#define MAXD_LOG 16
+#define MAX_DISTANCE ((1 << MAXD_LOG) - 1)
+
+#define ML_BITS  4
+#define ML_MASK  ((1U<<ML_BITS)-1)
+#define RUN_BITS (8-ML_BITS)
+#define RUN_MASK ((1U<<RUN_BITS)-1)
+
+
+/**************************************
+   Structures and local types
+**************************************/
+typedef struct {
+    U32  hashTable[HASH_SIZE_U32];
+    U32  currentOffset;
+    U32  initCheck;
+    const BYTE* dictionary;
+    const BYTE* bufferStart;
+    U32  dictSize;
+} LZ4_stream_t_internal;
+
+typedef enum { notLimited = 0, limitedOutput = 1 } limitedOutput_directive;
+typedef enum { byPtr, byU32, byU16 } tableType_t;
+
+typedef enum { noDict = 0, withPrefix64k, usingExtDict } dict_directive;
+typedef enum { noDictIssue = 0, dictSmall } dictIssue_directive;
+
+typedef enum { endOnOutputSize = 0, endOnInputSize = 1 } endCondition_directive;
+typedef enum { full = 0, partial = 1 } earlyEnd_directive;
+
+
+/**************************************
+   Architecture-specific macros
+**************************************/
+#define STEPSIZE                  sizeof(size_t)
+#define LZ4_COPYSTEP(d,s)         { AARCH(d) = AARCH(s); d+=STEPSIZE; s+=STEPSIZE; }
+#define LZ4_COPY8(d,s)            { LZ4_COPYSTEP(d,s); if (STEPSIZE<8) LZ4_COPYSTEP(d,s); }
+
+#if (defined(LZ4_BIG_ENDIAN) && !defined(BIG_ENDIAN_NATIVE_BUT_INCOMPATIBLE))
+#  define LZ4_READ_LITTLEENDIAN_16(d,s,p) { U16 v = A16(p); v = lz4_bswap16(v); d = (s) - v; }
+#  define LZ4_WRITE_LITTLEENDIAN_16(p,i)  { U16 v = (U16)(i); v = lz4_bswap16(v); A16(p) = v; p+=2; }
+#else      /* Little Endian */
+#  define LZ4_READ_LITTLEENDIAN_16(d,s,p) { d = (s) - A16(p); }
+#  define LZ4_WRITE_LITTLEENDIAN_16(p,v)  { A16(p) = v; p+=2; }
+#endif
+
+
+/**************************************
+   Macros
+**************************************/
+#define LZ4_STATIC_ASSERT(c)    { enum { LZ4_static_assert = 1/(!!(c)) }; }   /* use only *after* variable declarations */
+#if LZ4_ARCH64 || !defined(__GNUC__)
+#  define LZ4_WILDCOPY(d,s,e)   { do { LZ4_COPY8(d,s) } while (d<e); }        /* at the end, d>=e; */
+#else
+#  define LZ4_WILDCOPY(d,s,e)   { if (likely(e-d <= 8)) LZ4_COPY8(d,s) else do { LZ4_COPY8(d,s) } while (d<e); }
+#endif
+
+
+/****************************
+   Private local functions
+****************************/
+#if LZ4_ARCH64
+
+int LZ4_NbCommonBytes (register U64 val)
+{
+# if defined(LZ4_BIG_ENDIAN)
+#   if defined(_MSC_VER) && !defined(LZ4_FORCE_SW_BITCOUNT)
+    unsigned long r = 0;
+    _BitScanReverse64( &r, val );
+    return (int)(r>>3);
+#   elif defined(__GNUC__) && (GCC_VERSION >= 304) && !defined(LZ4_FORCE_SW_BITCOUNT)
+    return (__builtin_clzll(val) >> 3);
+#   else
+    int r;
+    if (!(val>>32)) { r=4; } else { r=0; val>>=32; }
+    if (!(val>>16)) { r+=2; val>>=8; } else { val>>=24; }
+    r += (!val);
+    return r;
+#   endif
+# else
+#   if defined(_MSC_VER) && !defined(LZ4_FORCE_SW_BITCOUNT)
+    unsigned long r = 0;
+    _BitScanForward64( &r, val );
+    return (int)(r>>3);
+#   elif defined(__GNUC__) && (GCC_VERSION >= 304) && !defined(LZ4_FORCE_SW_BITCOUNT)
+    return (__builtin_ctzll(val) >> 3);
+#   else
+    static const int DeBruijnBytePos[64] = { 0, 0, 0, 0, 0, 1, 1, 2, 0, 3, 1, 3, 1, 4, 2, 7, 0, 2, 3, 6, 1, 5, 3, 5, 1, 3, 4, 4, 2, 5, 6, 7, 7, 0, 1, 2, 3, 3, 4, 6, 2, 6, 5, 5, 3, 4, 5, 6, 7, 1, 2, 4, 6, 4, 4, 5, 7, 2, 6, 5, 7, 6, 7, 7 };
+    return DeBruijnBytePos[((U64)((val & -(long long)val) * 0x0218A392CDABBD3FULL)) >> 58];
+#   endif
+# endif
+}
+
+#else
+
+int LZ4_NbCommonBytes (register U32 val)
+{
+# if defined(LZ4_BIG_ENDIAN)
+#   if defined(_MSC_VER) && !defined(LZ4_FORCE_SW_BITCOUNT)
+    unsigned long r = 0;
+    _BitScanReverse( &r, val );
+    return (int)(r>>3);
+#   elif defined(__GNUC__) && (GCC_VERSION >= 304) && !defined(LZ4_FORCE_SW_BITCOUNT)
+    return (__builtin_clz(val) >> 3);
+#   else
+    int r;
+    if (!(val>>16)) { r=2; val>>=8; } else { r=0; val>>=24; }
+    r += (!val);
+    return r;
+#   endif
+# else
+#   if defined(_MSC_VER) && !defined(LZ4_FORCE_SW_BITCOUNT)
+    unsigned long r;
+    _BitScanForward( &r, val );
+    return (int)(r>>3);
+#   elif defined(__GNUC__) && (GCC_VERSION >= 304) && !defined(LZ4_FORCE_SW_BITCOUNT)
+    return (__builtin_ctz(val) >> 3);
+#   else
+    static const int DeBruijnBytePos[32] = { 0, 0, 3, 0, 3, 1, 3, 0, 3, 2, 2, 1, 3, 2, 0, 1, 3, 3, 1, 2, 2, 2, 2, 0, 3, 1, 2, 0, 1, 0, 1, 1 };
+    return DeBruijnBytePos[((U32)((val & -(S32)val) * 0x077CB531U)) >> 27];
+#   endif
+# endif
+}
+
+#endif
+
+
+/********************************
+   Compression functions
+********************************/
+int LZ4_compressBound(int isize)  { return LZ4_COMPRESSBOUND(isize); }
+
+static int LZ4_hashSequence(U32 sequence, tableType_t tableType)
+{
+    if (tableType == byU16)
+        return (((sequence) * 2654435761U) >> ((MINMATCH*8)-(LZ4_HASHLOG+1)));
+    else
+        return (((sequence) * 2654435761U) >> ((MINMATCH*8)-LZ4_HASHLOG));
+}
+
+static int LZ4_hashPosition(const BYTE* p, tableType_t tableType) { return LZ4_hashSequence(A32(p), tableType); }
+
+static void LZ4_putPositionOnHash(const BYTE* p, U32 h, void* tableBase, tableType_t tableType, const BYTE* srcBase)
+{
+    switch (tableType)
+    {
+    case byPtr: { const BYTE** hashTable = (const BYTE**) tableBase; hashTable[h] = p; break; }
+    case byU32: { U32* hashTable = (U32*) tableBase; hashTable[h] = (U32)(p-srcBase); break; }
+    case byU16: { U16* hashTable = (U16*) tableBase; hashTable[h] = (U16)(p-srcBase); break; }
+    }
+}
+
+static void LZ4_putPosition(const BYTE* p, void* tableBase, tableType_t tableType, const BYTE* srcBase)
+{
+    U32 h = LZ4_hashPosition(p, tableType);
+    LZ4_putPositionOnHash(p, h, tableBase, tableType, srcBase);
+}
+
+static const BYTE* LZ4_getPositionOnHash(U32 h, void* tableBase, tableType_t tableType, const BYTE* srcBase)
+{
+    if (tableType == byPtr) { const BYTE** hashTable = (const BYTE**) tableBase; return hashTable[h]; }
+    if (tableType == byU32) { U32* hashTable = (U32*) tableBase; return hashTable[h] + srcBase; }
+    { U16* hashTable = (U16*) tableBase; return hashTable[h] + srcBase; }   /* default, to ensure a return */
+}
+
+static const BYTE* LZ4_getPosition(const BYTE* p, void* tableBase, tableType_t tableType, const BYTE* srcBase)
+{
+    U32 h = LZ4_hashPosition(p, tableType);
+    return LZ4_getPositionOnHash(h, tableBase, tableType, srcBase);
+}
+
+static unsigned LZ4_count(const BYTE* pIn, const BYTE* pRef, const BYTE* pInLimit)
+{
+    const BYTE* const pStart = pIn;
+
+    while (likely(pIn<pInLimit-(STEPSIZE-1)))
+    {
+        size_t diff = AARCH(pRef) ^ AARCH(pIn);
+        if (!diff) { pIn+=STEPSIZE; pRef+=STEPSIZE; continue; }
+        pIn += LZ4_NbCommonBytes(diff);
+        return (unsigned)(pIn - pStart);
+    }
+    if (sizeof(void*)==8) if ((pIn<(pInLimit-3)) && (A32(pRef) == A32(pIn))) { pIn+=4; pRef+=4; }
+    if ((pIn<(pInLimit-1)) && (A16(pRef) == A16(pIn))) { pIn+=2; pRef+=2; }
+    if ((pIn<pInLimit) && (*pRef == *pIn)) pIn++;
+
+    return (unsigned)(pIn - pStart);
+}
+
+
+static int LZ4_compress_generic(
+                 void* ctx,
+                 const char* source,
+                 char* dest,
+                 int inputSize,
+                 int maxOutputSize,
+
+                 limitedOutput_directive outputLimited,
+                 tableType_t tableType,
+                 dict_directive dict,
+                 dictIssue_directive dictIssue)
+{
+    LZ4_stream_t_internal* const dictPtr = (LZ4_stream_t_internal*)ctx;
+
+    const BYTE* ip = (const BYTE*) source;
+    const BYTE* base;
+    const BYTE* lowLimit;
+    const BYTE* const lowRefLimit = ip - dictPtr->dictSize;
+    const BYTE* const dictionary = dictPtr->dictionary;
+    const BYTE* const dictEnd = dictionary + dictPtr->dictSize;
+    const size_t dictDelta = dictEnd - (const BYTE*)source;
+    const BYTE* anchor = (const BYTE*) source;
+    const BYTE* const iend = ip + inputSize;
+    const BYTE* const mflimit = iend - MFLIMIT;
+    const BYTE* const matchlimit = iend - LASTLITERALS;
+
+    BYTE* op = (BYTE*) dest;
+    BYTE* const olimit = op + maxOutputSize;
+
+    const int skipStrength = SKIPSTRENGTH;
+    U32 forwardH;
+    size_t refDelta=0;
+
+    /* Init conditions */
+    if ((U32)inputSize > (U32)LZ4_MAX_INPUT_SIZE) return 0;          /* Unsupported input size, too large (or negative) */
+    switch(dict)
+    {
+    case noDict:
+    default:
+        base = (const BYTE*)source;
+        lowLimit = (const BYTE*)source;
+        break;
+    case withPrefix64k:
+        base = (const BYTE*)source - dictPtr->currentOffset;
+        lowLimit = (const BYTE*)source - dictPtr->dictSize;
+        break;
+    case usingExtDict:
+        base = (const BYTE*)source - dictPtr->currentOffset;
+        lowLimit = (const BYTE*)source;
+        break;
+    }
+    if ((tableType == byU16) && (inputSize>=(int)LZ4_64KLIMIT)) return 0;   /* Size too large (not within 64K limit) */
+    if (inputSize<LZ4_minLength) goto _last_literals;                       /* Input too small, no compression (all literals) */
+
+    /* First Byte */
+    LZ4_putPosition(ip, ctx, tableType, base);
+    ip++; forwardH = LZ4_hashPosition(ip, tableType);
+
+    /* Main Loop */
+    for ( ; ; )
+    {
+        const BYTE* ref;
+        BYTE* token;
+        {
+            const BYTE* forwardIp = ip;
+            unsigned step=1;
+            unsigned searchMatchNb = (1U << skipStrength);
+
+            /* Find a match */
+            do {
+                U32 h = forwardH;
+                ip = forwardIp;
+                forwardIp += step;
+                step = searchMatchNb++ >> skipStrength;
+                //if (step>8) step=8;   // required for valid forwardIp ; slows down uncompressible data a bit
+
+                if (unlikely(forwardIp > mflimit)) goto _last_literals;
+
+                ref = LZ4_getPositionOnHash(h, ctx, tableType, base);
+                if (dict==usingExtDict)
+                {
+                    if (ref<(const BYTE*)source)
+                    {
+                        refDelta = dictDelta;
+                        lowLimit = dictionary;
+                    }
+                    else
+                    {
+                        refDelta = 0;
+                        lowLimit = (const BYTE*)source;
+                    }
+                }
+                forwardH = LZ4_hashPosition(forwardIp, tableType);
+                LZ4_putPositionOnHash(ip, h, ctx, tableType, base);
+
+            } while ( ((dictIssue==dictSmall) ? (ref < lowRefLimit) : 0)
+                || ((tableType==byU16) ? 0 : (ref + MAX_DISTANCE < ip))
+                || (A32(ref+refDelta) != A32(ip)) );
+        }
+
+        /* Catch up */
+        while ((ip>anchor) && (ref+refDelta > lowLimit) && (unlikely(ip[-1]==ref[refDelta-1]))) { ip--; ref--; }
+
+        {
+            /* Encode Literal length */
+            unsigned litLength = (unsigned)(ip - anchor);
+            token = op++;
+            if ((outputLimited) && (unlikely(op + litLength + (2 + 1 + LASTLITERALS) + (litLength/255) > olimit)))
+                return 0;   /* Check output limit */
+            if (litLength>=RUN_MASK)
+            {
+                int len = (int)litLength-RUN_MASK;
+                *token=(RUN_MASK<<ML_BITS);
+                for(; len >= 255 ; len-=255) *op++ = 255;
+                *op++ = (BYTE)len;
+            }
+            else *token = (BYTE)(litLength<<ML_BITS);
+
+            /* Copy Literals */
+            { BYTE* end = op+litLength; LZ4_WILDCOPY(op,anchor,end); op=end; }
+        }
+
+_next_match:
+        /* Encode Offset */
+        LZ4_WRITE_LITTLEENDIAN_16(op, (U16)(ip-ref));
+
+        /* Encode MatchLength */
+        {
+            unsigned matchLength;
+
+            if ((dict==usingExtDict) && (lowLimit==dictionary))
+            {
+                const BYTE* limit;
+                ref += refDelta;
+                limit = ip + (dictEnd-ref);
+                if (limit > matchlimit) limit = matchlimit;
+                matchLength = LZ4_count(ip+MINMATCH, ref+MINMATCH, limit);
+                ip += MINMATCH + matchLength;
+                if (ip==limit)
+                {
+                    unsigned more = LZ4_count(ip, (const BYTE*)source, matchlimit);
+                    matchLength += more;
+                    ip += more;
+                }
+            }
+            else
+            {
+                matchLength = LZ4_count(ip+MINMATCH, ref+MINMATCH, matchlimit);
+                ip += MINMATCH + matchLength;
+            }
+
+            if (matchLength>=ML_MASK)
+            {
+                if ((outputLimited) && (unlikely(op + (1 + LASTLITERALS) + (matchLength>>8) > olimit)))
+                    return 0;    /* Check output limit */
+                *token += ML_MASK;
+                matchLength -= ML_MASK;
+                for (; matchLength >= 510 ; matchLength-=510) { *op++ = 255; *op++ = 255; }
+                if (matchLength >= 255) { matchLength-=255; *op++ = 255; }
+                *op++ = (BYTE)matchLength;
+            }
+            else *token += (BYTE)(matchLength);
+        }
+
+        anchor = ip;
+
+        /* Test end of chunk */
+        if (ip > mflimit) break;
+
+        /* Fill table */
+        LZ4_putPosition(ip-2, ctx, tableType, base);
+
+        /* Test next position */
+        ref = LZ4_getPosition(ip, ctx, tableType, base);
+        if (dict==usingExtDict)
+        {
+            if (ref<(const BYTE*)source)
+            {
+                refDelta = dictDelta;
+                lowLimit = dictionary;
+            }
+            else
+            {
+                refDelta = 0;
+                lowLimit = (const BYTE*)source;
+            }
+        }
+        LZ4_putPosition(ip, ctx, tableType, base);
+        if ( ((dictIssue==dictSmall) ? (ref>=lowRefLimit) : 1)
+            && (ref+MAX_DISTANCE>=ip)
+            && (A32(ref+refDelta)==A32(ip)) )
+        { token=op++; *token=0; goto _next_match; }
+
+        /* Prepare next loop */
+        forwardH = LZ4_hashPosition(++ip, tableType);
+    }
+
+_last_literals:
+    /* Encode Last Literals */
+    {
+        int lastRun = (int)(iend - anchor);
+        if ((outputLimited) && (((char*)op - dest) + lastRun + 1 + ((lastRun+255-RUN_MASK)/255) > (U32)maxOutputSize))
+            return 0;   /* Check output limit */
+        if (lastRun>=(int)RUN_MASK) { *op++=(RUN_MASK<<ML_BITS); lastRun-=RUN_MASK; for(; lastRun >= 255 ; lastRun-=255) *op++ = 255; *op++ = (BYTE) lastRun; }
+        else *op++ = (BYTE)(lastRun<<ML_BITS);
+        memcpy(op, anchor, iend - anchor);
+        op += iend-anchor;
+    }
+
+    /* End */
+    return (int) (((char*)op)-dest);
+}
+
+
+int LZ4_compress(const char* source, char* dest, int inputSize)
+{
+#if (HEAPMODE)
+    void* ctx = ALLOCATOR(LZ4_STREAMSIZE_U32, 4);   /* Aligned on 4-bytes boundaries */
+#else
+    U32 ctx[LZ4_STREAMSIZE_U32] = {0};      /* Ensure data is aligned on 4-bytes boundaries */
+#endif
+    int result;
+
+    if (inputSize < (int)LZ4_64KLIMIT)
+        result = LZ4_compress_generic((void*)ctx, source, dest, inputSize, 0, notLimited, byU16, noDict, noDictIssue);
+    else
+        result = LZ4_compress_generic((void*)ctx, source, dest, inputSize, 0, notLimited, (sizeof(void*)==8) ? byU32 : byPtr, noDict, noDictIssue);
+
+#if (HEAPMODE)
+    FREEMEM(ctx);
+#endif
+    return result;
+}
+
+int LZ4_compress_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize)
+{
+#if (HEAPMODE)
+    void* ctx = ALLOCATOR(LZ4_STREAMSIZE_U32, 4);   /* Aligned on 4-bytes boundaries */
+#else
+    U32 ctx[LZ4_STREAMSIZE_U32] = {0};      /* Ensure data is aligned on 4-bytes boundaries */
+#endif
+    int result;
+
+    if (inputSize < (int)LZ4_64KLIMIT)
+        result = LZ4_compress_generic((void*)ctx, source, dest, inputSize, maxOutputSize, limitedOutput, byU16, noDict, noDictIssue);
+    else
+        result = LZ4_compress_generic((void*)ctx, source, dest, inputSize, maxOutputSize, limitedOutput, (sizeof(void*)==8) ? byU32 : byPtr, noDict, noDictIssue);
+
+#if (HEAPMODE)
+    FREEMEM(ctx);
+#endif
+    return result;
+}
+
+
+/*****************************************
+   Experimental : Streaming functions
+*****************************************/
+
+void* LZ4_createStream()
+{
+    void* lz4s = ALLOCATOR(4, LZ4_STREAMSIZE_U32);
+    MEM_INIT(lz4s, 0, LZ4_STREAMSIZE);
+    return lz4s;
+}
+
+int LZ4_free (void* LZ4_stream)
+{
+    FREEMEM(LZ4_stream);
+    return (0);
+}
+
+
+int LZ4_loadDict (void* LZ4_dict, const char* dictionary, int dictSize)
+{
+    LZ4_stream_t_internal* dict = (LZ4_stream_t_internal*) LZ4_dict;
+    const BYTE* p = (const BYTE*)dictionary;
+    const BYTE* const dictEnd = p + dictSize;
+    const BYTE* base;
+
+    LZ4_STATIC_ASSERT(LZ4_STREAMSIZE >= sizeof(LZ4_stream_t_internal));      /* A compilation error here means LZ4_STREAMSIZE is not large enough */
+    if (dict->initCheck) MEM_INIT(dict, 0, sizeof(LZ4_stream_t_internal));   /* Uninitialized structure detected */
+
+    if (dictSize < MINMATCH)
+    {
+        dict->dictionary = NULL;
+        dict->dictSize = 0;
+        return 1;
+    }
+
+    if (p <= dictEnd - 64 KB) p = dictEnd - 64 KB;
+    base = p - dict->currentOffset;
+    dict->dictionary = p;
+    dict->dictSize = (U32)(dictEnd - p);
+    dict->currentOffset += dict->dictSize;
+
+    while (p <= dictEnd-MINMATCH)
+    {
+        LZ4_putPosition(p, dict, byU32, base);
+        p+=3;
+    }
+
+    return 1;
+}
+
+
+void LZ4_renormDictT(LZ4_stream_t_internal* LZ4_dict, const BYTE* src)
+{
+    if ((LZ4_dict->currentOffset > 0x80000000) ||
+        ((size_t)LZ4_dict->currentOffset > (size_t)src))   /* address space overflow */
+    {
+        /* rescale hash table */
+        U32 delta = LZ4_dict->currentOffset - 64 KB;
+        const BYTE* dictEnd = LZ4_dict->dictionary + LZ4_dict->dictSize;
+        int i;
+        for (i=0; i<HASH_SIZE_U32; i++)
+        {
+            if (LZ4_dict->hashTable[i] < delta) LZ4_dict->hashTable[i]=0;
+            else LZ4_dict->hashTable[i] -= delta;
+        }
+        LZ4_dict->currentOffset = 64 KB;
+        if (LZ4_dict->dictSize > 64 KB) LZ4_dict->dictSize = 64 KB;
+        LZ4_dict->dictionary = dictEnd - LZ4_dict->dictSize;
+    }
+}
+
+
+FORCE_INLINE int LZ4_compress_continue_generic (void* LZ4_stream, const char* source, char* dest, int inputSize,
+                                                int maxOutputSize, limitedOutput_directive limit)
+{
+    LZ4_stream_t_internal* streamPtr = (LZ4_stream_t_internal*)LZ4_stream;
+    const BYTE* const dictEnd = streamPtr->dictionary + streamPtr->dictSize;
+
+    const BYTE* smallest = (const BYTE*) source;
+    if (streamPtr->initCheck) return 0;   /* Uninitialized structure detected */
+    if ((streamPtr->dictSize>0) && (smallest>dictEnd)) smallest = dictEnd;
+    LZ4_renormDictT(streamPtr, smallest);
+
+    /* Check overlapping input/dictionary space */
+    {
+        const BYTE* sourceEnd = (const BYTE*) source + inputSize;
+        if ((sourceEnd > streamPtr->dictionary) && (sourceEnd < dictEnd))
+        {
+            streamPtr->dictSize = (U32)(dictEnd - sourceEnd);
+            if (streamPtr->dictSize > 64 KB) streamPtr->dictSize = 64 KB;
+            if (streamPtr->dictSize < 4) streamPtr->dictSize = 0;
+            streamPtr->dictionary = dictEnd - streamPtr->dictSize;
+        }
+    }
+
+    /* prefix mode : source data follows dictionary */
+    if (dictEnd == (const BYTE*)source)
+    {
+        int result;
+        if ((streamPtr->dictSize < 64 KB) && (streamPtr->dictSize < streamPtr->currentOffset))
+            result = LZ4_compress_generic(LZ4_stream, source, dest, inputSize, maxOutputSize, limit, byU32, withPrefix64k, dictSmall);
+        else
+            result = LZ4_compress_generic(LZ4_stream, source, dest, inputSize, maxOutputSize, limit, byU32, withPrefix64k, noDictIssue);
+        streamPtr->dictSize += (U32)inputSize;
+        streamPtr->currentOffset += (U32)inputSize;
+        return result;
+    }
+
+    /* external dictionary mode */
+    {
+        int result;
+        if ((streamPtr->dictSize < 64 KB) && (streamPtr->dictSize < streamPtr->currentOffset))
+            result = LZ4_compress_generic(LZ4_stream, source, dest, inputSize, maxOutputSize, limit, byU32, usingExtDict, dictSmall);
+        else
+            result = LZ4_compress_generic(LZ4_stream, source, dest, inputSize, maxOutputSize, limit, byU32, usingExtDict, noDictIssue);
+        streamPtr->dictionary = (const BYTE*)source;
+        streamPtr->dictSize = (U32)inputSize;
+        streamPtr->currentOffset += (U32)inputSize;
+        return result;
+    }
+}
+
+
+int LZ4_compress_continue (void* LZ4_stream, const char* source, char* dest, int inputSize)
+{
+    return LZ4_compress_continue_generic(LZ4_stream, source, dest, inputSize, 0, notLimited);
+}
+
+int LZ4_compress_limitedOutput_continue (void* LZ4_stream, const char* source, char* dest, int inputSize, int maxOutputSize)
+{
+    return LZ4_compress_continue_generic(LZ4_stream, source, dest, inputSize, maxOutputSize, limitedOutput);
+}
+
+
+// Hidden debug function, to force separate dictionary mode
+int LZ4_compress_forceExtDict (LZ4_stream_t* LZ4_dict, const char* source, char* dest, int inputSize)
+{
+    LZ4_stream_t_internal* streamPtr = (LZ4_stream_t_internal*)LZ4_dict;
+    int result;
+    const BYTE* const dictEnd = streamPtr->dictionary + streamPtr->dictSize;
+
+    const BYTE* smallest = dictEnd;
+    if (smallest > (const BYTE*) source) smallest = (const BYTE*) source;
+    LZ4_renormDictT((LZ4_stream_t_internal*)LZ4_dict, smallest);
+
+    result = LZ4_compress_generic(LZ4_dict, source, dest, inputSize, 0, notLimited, byU32, usingExtDict, noDictIssue);
+
+    streamPtr->dictionary = (const BYTE*)source;
+    streamPtr->dictSize = (U32)inputSize;
+    streamPtr->currentOffset += (U32)inputSize;
+
+    return result;
+}
+
+
+int LZ4_saveDict (void* LZ4_dict, char* safeBuffer, int dictSize)
+{
+    LZ4_stream_t_internal* dict = (LZ4_stream_t_internal*) LZ4_dict;
+    const BYTE* previousDictEnd = dict->dictionary + dict->dictSize;
+
+    if ((U32)dictSize > 64 KB) dictSize = 64 KB;   /* useless to define a dictionary > 64 KB */
+    if ((U32)dictSize > dict->dictSize) dictSize = dict->dictSize;
+
+    memcpy(safeBuffer, previousDictEnd - dictSize, dictSize);
+
+    dict->dictionary = (const BYTE*)safeBuffer;
+    dict->dictSize = (U32)dictSize;
+
+    return 1;
+}
+
+
+
+/****************************
+   Decompression functions
+****************************/
+/*
+ * This generic decompression function cover all use cases.
+ * It shall be instanciated several times, using different sets of directives
+ * Note that it is essential this generic function is really inlined,
+ * in order to remove useless branches during compilation optimisation.
+ */
+FORCE_INLINE int LZ4_decompress_generic(
+                 const char* source,
+                 char* dest,
+                 int inputSize,
+                 int outputSize,         /* If endOnInput==endOnInputSize, this value is the max size of Output Buffer. */
+
+                 int endOnInput,         /* endOnOutputSize, endOnInputSize */
+                 int partialDecoding,    /* full, partial */
+                 int targetOutputSize,   /* only used if partialDecoding==partial */
+                 int dict,               /* noDict, withPrefix64k, usingExtDict */
+                 const char* dictStart,  /* only if dict==usingExtDict */
+                 int dictSize            /* note : = 0 if noDict */
+                 )
+{
+    /* Local Variables */
+    const BYTE* restrict ip = (const BYTE*) source;
+    const BYTE* ref;
+    const BYTE* const iend = ip + inputSize;
+
+    BYTE* op = (BYTE*) dest;
+    BYTE* const oend = op + outputSize;
+    BYTE* cpy;
+    BYTE* oexit = op + targetOutputSize;
+    const BYTE* const lowLimit = (const BYTE*)dest - dictSize;
+
+    const BYTE* const dictEnd = (const BYTE*)dictStart + dictSize;
+//#define OLD
+#ifdef OLD
+    const size_t dec32table[] = {0, 3, 2, 3, 0, 0, 0, 0};   /* static reduces speed for LZ4_decompress_safe() on GCC64 */
+#else
+    const size_t dec32table[] = {4-0, 4-3, 4-2, 4-3, 4-0, 4-0, 4-0, 4-0};   /* static reduces speed for LZ4_decompress_safe() on GCC64 */
+#endif
+    static const size_t dec64table[] = {0, 0, 0, (size_t)-1, 0, 1, 2, 3};
+
+    const int checkOffset = (endOnInput) && (dictSize < (int)(64 KB));
+
+
+    /* Special cases */
+    if ((partialDecoding) && (oexit> oend-MFLIMIT)) oexit = oend-MFLIMIT;                        /* targetOutputSize too high => decode everything */
+    if ((endOnInput) && (unlikely(outputSize==0))) return ((inputSize==1) && (*ip==0)) ? 0 : -1;   /* Empty output buffer */
+    if ((!endOnInput) && (unlikely(outputSize==0))) return (*ip==0?1:-1);
+
+
+    /* Main Loop */
+    while (1)
+    {
+        unsigned token;
+        size_t length;
+
+        /* get runlength */
+        token = *ip++;
+        if ((length=(token>>ML_BITS)) == RUN_MASK)
+        {
+            unsigned s;
+            do
+            {
+                s = *ip++;
+                length += s;
+            }
+            while (likely((endOnInput)?ip<iend-RUN_MASK:1) && (s==255));
+            //if ((sizeof(void*)==4) && unlikely(length>LZ4_MAX_INPUT_SIZE)) goto _output_error;   /* overflow detection */
+            if ((sizeof(void*)==4) && unlikely((size_t)(op+length)<(size_t)(op))) goto _output_error;   /* quickfix issue 134 */
+            if ((endOnInput) && (sizeof(void*)==4) && unlikely((size_t)(ip+length)<(size_t)(ip))) goto _output_error;   /* quickfix issue 134 */
+        }
+
+        /* copy literals */
+        cpy = op+length;
+        if (((endOnInput) && ((cpy>(partialDecoding?oexit:oend-MFLIMIT)) || (ip+length>iend-(2+1+LASTLITERALS))) )
+            || ((!endOnInput) && (cpy>oend-COPYLENGTH)))
+        {
+            if (partialDecoding)
+            {
+                if (cpy > oend) goto _output_error;                           /* Error : write attempt beyond end of output buffer */
+                if ((endOnInput) && (ip+length > iend)) goto _output_error;   /* Error : read attempt beyond end of input buffer */
+            }
+            else
+            {
+                if ((!endOnInput) && (cpy != oend)) goto _output_error;       /* Error : block decoding must stop exactly there */
+                if ((endOnInput) && ((ip+length != iend) || (cpy > oend))) goto _output_error;   /* Error : input must be consumed */
+            }
+            memcpy(op, ip, length);
+            ip += length;
+            op += length;
+            break;                                       /* Necessarily EOF, due to parsing restrictions */
+        }
+        LZ4_WILDCOPY(op, ip, cpy); ip -= (op-cpy); op = cpy;
+
+        /* get offset */
+        LZ4_READ_LITTLEENDIAN_16(ref,cpy,ip); ip+=2;
+        if ((checkOffset) && (unlikely(ref < lowLimit))) goto _output_error;   /* Error : offset outside destination buffer */
+
+        /* get matchlength */
+        if ((length=(token&ML_MASK)) == ML_MASK)
+        {
+            unsigned s;
+            do
+            {
+                if ((endOnInput) && (ip > iend-LASTLITERALS)) goto _output_error;
+                s = *ip++;
+                length += s;
+            } while (s==255);
+            //if ((sizeof(void*)==4) && unlikely(length>LZ4_MAX_INPUT_SIZE)) goto _output_error;   /* overflow detection */
+            if ((sizeof(void*)==4) && unlikely((size_t)(op+length)<(size_t)op)) goto _output_error;   /* quickfix issue 134 */
+        }
+
+        /* check external dictionary */
+        if ((dict==usingExtDict) && (ref < (BYTE* const)dest))
+        {
+            if (unlikely(op+length+MINMATCH > oend-LASTLITERALS)) goto _output_error;
+
+            if (length+MINMATCH <= (size_t)(dest-(char*)ref))
+            {
+                ref = dictEnd - (dest-(char*)ref);
+                memcpy(op, ref, length+MINMATCH);
+                op += length+MINMATCH;
+            }
+            else
+            {
+                size_t copySize = (size_t)(dest-(char*)ref);
+                memcpy(op, dictEnd - copySize, copySize);
+                op += copySize;
+                copySize = length+MINMATCH - copySize;
+                if (copySize > (size_t)((char*)op-dest))   /* overlap */
+                {
+                    BYTE* const cpy = op + copySize;
+                    const BYTE* ref = (BYTE*)dest;
+                    while (op < cpy) *op++ = *ref++;
+                }
+                else
+                {
+                    memcpy(op, dest, copySize);
+                    op += copySize;
+                }
+            }
+            continue;
+        }
+
+        /* copy repeated sequence */
+        if (unlikely((op-ref)<(int)STEPSIZE))
+        {
+            const size_t dec64 = dec64table[(sizeof(void*)==4) ? 0 : op-ref];
+            op[0] = ref[0];
+            op[1] = ref[1];
+            op[2] = ref[2];
+            op[3] = ref[3];
+#ifdef OLD
+            op += 4, ref += 4; ref -= dec32table[op-ref];
+            A32(op) = A32(ref);
+            op += STEPSIZE-4; ref -= dec64;
+#else
+            ref += dec32table[op-ref];
+            A32(op+4) = A32(ref);
+            op += STEPSIZE; ref -= dec64;
+#endif
+        } else { LZ4_COPYSTEP(op,ref); }
+        cpy = op + length - (STEPSIZE-4);
+
+        if (unlikely(cpy>oend-COPYLENGTH-(STEPSIZE-4)))
+        {
+            if (cpy > oend-LASTLITERALS) goto _output_error;    /* Error : last 5 bytes must be literals */
+            if (op<oend-COPYLENGTH) LZ4_WILDCOPY(op, ref, (oend-COPYLENGTH));
+            while(op<cpy) *op++=*ref++;
+            op=cpy;
+            continue;
+        }
+        LZ4_WILDCOPY(op, ref, cpy);
+        op=cpy;   /* correction */
+    }
+
+    /* end of decoding */
+    if (endOnInput)
+       return (int) (((char*)op)-dest);     /* Nb of output bytes decoded */
+    else
+       return (int) (((char*)ip)-source);   /* Nb of input bytes read */
+
+    /* Overflow error detected */
+_output_error:
+    return (int) (-(((char*)ip)-source))-1;
+}
+
+
+int LZ4_decompress_safe(const char* source, char* dest, int compressedSize, int maxOutputSize)
+{
+    return LZ4_decompress_generic(source, dest, compressedSize, maxOutputSize, endOnInputSize, full, 0, noDict, NULL, 0);
+}
+
+int LZ4_decompress_safe_partial(const char* source, char* dest, int compressedSize, int targetOutputSize, int maxOutputSize)
+{
+    return LZ4_decompress_generic(source, dest, compressedSize, maxOutputSize, endOnInputSize, partial, targetOutputSize, noDict, NULL, 0);
+}
+
+int LZ4_decompress_fast(const char* source, char* dest, int originalSize)
+{
+    return LZ4_decompress_generic(source, dest, 0, originalSize, endOnOutputSize, full, 0, withPrefix64k, NULL, 0);
+}
+
+/* streaming decompression functions */
+
+//#define LZ4_STREAMDECODESIZE_U32 4
+//#define LZ4_STREAMDECODESIZE     (LZ4_STREAMDECODESIZE_U32 * sizeof(unsigned int))
+//typedef struct { unsigned int table[LZ4_STREAMDECODESIZE_U32]; } LZ4_streamDecode_t;
+typedef struct
+{
+    const char* dictionary;
+    int dictSize;
+} LZ4_streamDecode_t_internal;
+
+/*
+ * If you prefer dynamic allocation methods,
+ * LZ4_createStreamDecode()
+ * provides a pointer (void*) towards an initialized LZ4_streamDecode_t structure.
+ */
+void* LZ4_createStreamDecode()
+{
+    void* lz4s = ALLOCATOR(sizeof(U32), LZ4_STREAMDECODESIZE_U32);
+    MEM_INIT(lz4s, 0, LZ4_STREAMDECODESIZE);
+    return lz4s;
+}
+
+/*
+ * LZ4_setDictDecode
+ * Use this function to instruct where to find the dictionary
+ * This function is not necessary if previous data is still available where it was decoded.
+ * Loading a size of 0 is allowed (same effect as no dictionary).
+ * Return : 1 if OK, 0 if error
+ */
+int LZ4_setDictDecode (void* LZ4_streamDecode, const char* dictionary, int dictSize)
+{
+    LZ4_streamDecode_t_internal* lz4sd = (LZ4_streamDecode_t_internal*) LZ4_streamDecode;
+    lz4sd->dictionary = dictionary;
+    lz4sd->dictSize = dictSize;
+    return 1;
+}
+
+/*
+*_continue() :
+    These decoding functions allow decompression of multiple blocks in "streaming" mode.
+    Previously decoded blocks must still be available at the memory position where they were decoded.
+    If it's not possible, save the relevant part of decoded data into a safe buffer,
+    and indicate where it stands using LZ4_setDictDecode()
+*/
+int LZ4_decompress_safe_continue (void* LZ4_streamDecode, const char* source, char* dest, int compressedSize, int maxOutputSize)
+{
+    LZ4_streamDecode_t_internal* lz4sd = (LZ4_streamDecode_t_internal*) LZ4_streamDecode;
+    int result;
+
+    result = LZ4_decompress_generic(source, dest, compressedSize, maxOutputSize, endOnInputSize, full, 0, usingExtDict, lz4sd->dictionary, lz4sd->dictSize);
+    if (result <= 0) return result;
+    if (lz4sd->dictionary + lz4sd->dictSize == dest)
+    {
+        lz4sd->dictSize += result;
+    }
+    else
+    {
+        lz4sd->dictionary = dest;
+        lz4sd->dictSize = result;
+    }
+
+    return result;
+}
+
+int LZ4_decompress_fast_continue (void* LZ4_streamDecode, const char* source, char* dest, int originalSize)
+{
+    LZ4_streamDecode_t_internal* lz4sd = (LZ4_streamDecode_t_internal*) LZ4_streamDecode;
+    int result;
+
+    result = LZ4_decompress_generic(source, dest, 0, originalSize, endOnOutputSize, full, 0, usingExtDict, lz4sd->dictionary, lz4sd->dictSize);
+    if (result <= 0) return result;
+    if (lz4sd->dictionary + lz4sd->dictSize == dest)
+    {
+        lz4sd->dictSize += result;
+    }
+    else
+    {
+        lz4sd->dictionary = dest;
+        lz4sd->dictSize = result;
+    }
+
+    return result;
+}
+
+
+/*
+Advanced decoding functions :
+*_usingDict() :
+    These decoding functions work the same as "_continue" ones,
+    the dictionary must be explicitly provided within parameters
+*/
+
+int LZ4_decompress_safe_usingDict(const char* source, char* dest, int compressedSize, int maxOutputSize, const char* dictStart, int dictSize)
+{
+    return LZ4_decompress_generic(source, dest, compressedSize, maxOutputSize, endOnInputSize, full, 0, usingExtDict, dictStart, dictSize);
+}
+
+int LZ4_decompress_fast_usingDict(const char* source, char* dest, int originalSize, const char* dictStart, int dictSize)
+{
+    return LZ4_decompress_generic(source, dest, 0, originalSize, endOnOutputSize, full, 0, usingExtDict, dictStart, dictSize);
+}
diff --git a/mfbt/lz4.h b/mfbt/lz4.h
index ec6a64f52250..bf6780122f6f 100644
--- a/mfbt/lz4.h
+++ b/mfbt/lz4.h
@@ -1,165 +1,276 @@
-/*
-   LZ4 - Fast LZ compression algorithm
-   Header File
-   Copyright (C) 2011-2013, Yann Collet.
-   BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php)
-
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions are
-   met:
-
-       * Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-       * Redistributions in binary form must reproduce the above
-   copyright notice, this list of conditions and the following disclaimer
-   in the documentation and/or other materials provided with the
-   distribution.
-
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-   You can contact the author at :
-   - LZ4 homepage : http://fastcompression.blogspot.com/p/lz4.html
-   - LZ4 source repository : http://code.google.com/p/lz4/
-*/
-#pragma once
-
-#if defined (__cplusplus)
-extern "C" {
-#endif
-
-
-//**************************************
-// Compiler Options
-//**************************************
-#if defined(_MSC_VER) && !defined(__cplusplus)   // Visual Studio
-#  define inline __forceinline           // Visual C is not C99, but supports some kind of inline. Note : we *do* want to force inline
-#endif
-
-
-//****************************
-// Simple Functions
-//****************************
-
-int LZ4_compress        (const char* source, char* dest, int inputSize);
-int LZ4_decompress_safe (const char* source, char* dest, int inputSize, int maxOutputSize);
-
-/*
-LZ4_compress() :
-    Compresses 'inputSize' bytes from 'source' into 'dest'.
-    Destination buffer must be already allocated,
-    and must be sized to handle worst cases situations (input data not compressible)
-    Worst case size evaluation is provided by function LZ4_compressBound()
-    inputSize : Max supported value is ~1.9GB
-    return : the number of bytes written in buffer dest
-             or 0 if the compression fails
-
-LZ4_decompress_safe() :
-    maxOutputSize : is the size of the destination buffer (which must be already allocated)
-    return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize)
-             If the source stream is malformed or too large, the function will stop decoding and return a negative result.
-             This function is protected against any kind of buffer overflow attemps (never writes outside of output buffer, and never reads outside of input buffer). It is therefore protected against malicious data packets
-*/
-
-
-//****************************
-// Advanced Functions
-//****************************
-
-static inline int LZ4_compressBound(int isize)   { return ((isize) + ((isize)/255) + 16); }
-#define           LZ4_COMPRESSBOUND(    isize)            ((isize) + ((isize)/255) + 16)
-
-/*
-LZ4_compressBound() :
-    Provides the maximum size that LZ4 may output in a "worst case" scenario (input data not compressible)
-    primarily useful for memory allocation of output buffer.
-	inline function is recommended for the general case,
-	macro is also provided when result needs to be evaluated at compile time (such as table size allocation).
-
-    isize  : is the input size. Max supported value is ~1.9GB
-    return : maximum output size in a "worst case" scenario
-    note : this function is limited by "int" range (2^31-1)
-*/
-
-
-int LZ4_compress_limitedOutput (const char* source, char* dest, int inputSize, int maxOutputSize);
-
-/*
-LZ4_compress_limitedOutput() :
-    Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'.
-    If it cannot achieve it, compression will stop, and result of the function will be zero.
-    This function never writes outside of provided output buffer.
-
-    inputSize  : Max supported value is ~1.9GB
-    maxOutputSize : is the size of the destination buffer (which must be already allocated)
-    return : the number of bytes written in buffer 'dest'
-             or 0 if the compression fails
-*/
-
-
-int LZ4_decompress_fast (const char* source, char* dest, int outputSize);
-
-/*
-LZ4_decompress_fast() :
-    outputSize : is the original (uncompressed) size
-    return : the number of bytes read from the source buffer (in other words, the compressed size)
-             If the source stream is malformed, the function will stop decoding and return a negative result.
-    note : This function is a bit faster than LZ4_decompress_safe()
-           This function never writes outside of output buffers, and never read before input buffer, but may read beyond input buffer (since it doesn't know its size) in case of malicious data packet.
-           Use this function preferably into a trusted environment (data to decode comes from a trusted source).
-           Destination buffer must be already allocated. Its size must be a minimum of 'outputSize' bytes.
-*/
-
-int LZ4_decompress_safe_partial (const char* source, char* dest, int inputSize, int targetOutputSize, int maxOutputSize);
-
-/*
-LZ4_decompress_safe_partial() :
-    This function decompress a compressed block of size 'inputSize' at position 'source'
-    into output buffer 'dest' of size 'maxOutputSize'.
-    The function stops decompressing operation as soon as 'targetOutputSize' has been reached,
-    reducing decompression time.
-    return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize)
-       Note : this number might be < 'targetOutputSize' if the number of bytes to decode into the compressed block is not enough.
-             Always control how many bytes were  decoded.
-             If the source stream is malformed, the function will stop decoding and return a negative result.
-             This function never writes outside of output buffer, and never reads outside of input buffer. It is therefore protected against malicious data packets
-*/
-
-
-int LZ4_decompress_safe_withPrefix64k (const char* source, char* dest, int inputSize, int maxOutputSize);
-int LZ4_decompress_fast_withPrefix64k (const char* source, char* dest, int outputSize);
-
-/*
-*_withPrefix64k() :
-    These decoding functions work the same as their "normal name" versions,
-    but will potentially use up to 64KB of data in front of 'char* dest'.
-    These functions are used for decoding inter-dependant blocks.
-*/
-
-
-//****************************
-// Obsolete Functions
-//****************************
-
-static inline int LZ4_uncompress (const char* source, char* dest, int outputSize) { return LZ4_decompress_fast(source, dest, outputSize); }
-static inline int LZ4_uncompress_unknownOutputSize (const char* source, char* dest, int isize, int maxOutputSize) { return LZ4_decompress_safe(source, dest, isize, maxOutputSize); }
-
-/* 
-These functions are deprecated and should no longer be used.
-They are provided here for compatibility with existing user programs.
-*/
-
-
-
-#if defined (__cplusplus)
-}
-#endif
+/*
+   LZ4 - Fast LZ compression algorithm
+   Header File
+   Copyright (C) 2011-2014, Yann Collet.
+   BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php)
+
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions are
+   met:
+
+       * Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+       * Redistributions in binary form must reproduce the above
+   copyright notice, this list of conditions and the following disclaimer
+   in the documentation and/or other materials provided with the
+   distribution.
+
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+   You can contact the author at :
+   - LZ4 source repository : http://code.google.com/p/lz4/
+   - LZ4 public forum : https://groups.google.com/forum/#!forum/lz4c
+*/
+#pragma once
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+
+/**************************************
+   Version
+**************************************/
+#define LZ4_VERSION_MAJOR    1    /* for major interface/format changes  */
+#define LZ4_VERSION_MINOR    2    /* for minor interface/format changes  */
+#define LZ4_VERSION_RELEASE  0    /* for tweaks, bug-fixes, or development */
+
+
+/**************************************
+   Tuning parameter
+**************************************/
+/*
+ * LZ4_MEMORY_USAGE :
+ * Memory usage formula : N->2^N Bytes (examples : 10 -> 1KB; 12 -> 4KB ; 16 -> 64KB; 20 -> 1MB; etc.)
+ * Increasing memory usage improves compression ratio
+ * Reduced memory usage can improve speed, due to cache effect
+ * Default value is 14, for 16KB, which nicely fits into Intel x86 L1 cache
+ */
+#define LZ4_MEMORY_USAGE 14
+
+
+/**************************************
+   Simple Functions
+**************************************/
+
+int LZ4_compress        (const char* source, char* dest, int inputSize);
+int LZ4_decompress_safe (const char* source, char* dest, int compressedSize, int maxOutputSize);
+
+/*
+LZ4_compress() :
+    Compresses 'inputSize' bytes from 'source' into 'dest'.
+    Destination buffer must be already allocated,
+    and must be sized to handle worst cases situations (input data not compressible)
+    Worst case size evaluation is provided by function LZ4_compressBound()
+    inputSize : Max supported value is LZ4_MAX_INPUT_VALUE
+    return : the number of bytes written in buffer dest
+             or 0 if the compression fails
+
+LZ4_decompress_safe() :
+    compressedSize : is obviously the source size
+    maxOutputSize : is the size of the destination buffer, which must be already allocated.
+    return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize)
+             If the destination buffer is not large enough, decoding will stop and output an error code (<0).
+             If the source stream is detected malformed, the function will stop decoding and return a negative result.
+             This function is protected against buffer overflow exploits :
+             it never writes outside of output buffer, and never reads outside of input buffer.
+             Therefore, it is protected against malicious data packets.
+*/
+
+
+/*
+Note :
+    Should you prefer to explicitly allocate compression-table memory using your own allocation method,
+    use the streaming functions provided below, simply reset the memory area between each call to LZ4_compress_continue()
+*/
+
+
+/**************************************
+   Advanced Functions
+**************************************/
+#define LZ4_MAX_INPUT_SIZE        0x7E000000   /* 2 113 929 216 bytes */
+#define LZ4_COMPRESSBOUND(isize)  ((unsigned int)(isize) > (unsigned int)LZ4_MAX_INPUT_SIZE ? 0 : (isize) + ((isize)/255) + 16)
+
+/*
+LZ4_compressBound() :
+    Provides the maximum size that LZ4 may output in a "worst case" scenario (input data not compressible)
+    primarily useful for memory allocation of output buffer.
+    macro is also provided when result needs to be evaluated at compilation (such as stack memory allocation).
+
+    isize  : is the input size. Max supported value is LZ4_MAX_INPUT_SIZE
+    return : maximum output size in a "worst case" scenario
+             or 0, if input size is too large ( > LZ4_MAX_INPUT_SIZE)
+*/
+int LZ4_compressBound(int isize);
+
+
+/*
+LZ4_compress_limitedOutput() :
+    Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'.
+    If it cannot achieve it, compression will stop, and result of the function will be zero.
+    This function never writes outside of provided output buffer.
+
+    inputSize  : Max supported value is LZ4_MAX_INPUT_VALUE
+    maxOutputSize : is the size of the destination buffer (which must be already allocated)
+    return : the number of bytes written in buffer 'dest'
+             or 0 if the compression fails
+*/
+int LZ4_compress_limitedOutput (const char* source, char* dest, int inputSize, int maxOutputSize);
+
+
+/*
+LZ4_decompress_fast() :
+    originalSize : is the original and therefore uncompressed size
+    return : the number of bytes read from the source buffer (in other words, the compressed size)
+             If the source stream is malformed, the function will stop decoding and return a negative result.
+             Destination buffer must be already allocated. Its size must be a minimum of 'originalSize' bytes.
+    note : This function is a bit faster than LZ4_decompress_safe()
+           It provides fast decompression and fully respect memory boundaries for properly formed compressed data.
+           It does not provide full protection against intentionnally modified data stream.
+           Use this function in a trusted environment (data to decode comes from a trusted source).
+*/
+int LZ4_decompress_fast (const char* source, char* dest, int originalSize);
+
+
+/*
+LZ4_decompress_safe_partial() :
+    This function decompress a compressed block of size 'compressedSize' at position 'source'
+    into output buffer 'dest' of size 'maxOutputSize'.
+    The function tries to stop decompressing operation as soon as 'targetOutputSize' has been reached,
+    reducing decompression time.
+    return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize)
+       Note : this number can be < 'targetOutputSize' should the compressed block to decode be smaller.
+             Always control how many bytes were decoded.
+             If the source stream is detected malformed, the function will stop decoding and return a negative result.
+             This function never writes outside of output buffer, and never reads outside of input buffer. It is therefore protected against malicious data packets
+*/
+int LZ4_decompress_safe_partial (const char* source, char* dest, int compressedSize, int targetOutputSize, int maxOutputSize);
+
+
+/***********************************************
+   Experimental Streaming Compression Functions
+***********************************************/
+
+#define LZ4_STREAMSIZE_U32 ((1 << (LZ4_MEMORY_USAGE-2)) + 8)
+#define LZ4_STREAMSIZE     (LZ4_STREAMSIZE_U32 * sizeof(unsigned int))
+/*
+ * LZ4_stream_t
+ * information structure to track an LZ4 stream.
+ * important : set this structure content to zero before first use !
+ */
+typedef struct { unsigned int table[LZ4_STREAMSIZE_U32]; } LZ4_stream_t;
+
+/*
+ * If you prefer dynamic allocation methods,
+ * LZ4_createStream
+ * provides a pointer (void*) towards an initialized LZ4_stream_t structure.
+ * LZ4_free just frees it.
+ */
+void* LZ4_createStream();
+int   LZ4_free (void* LZ4_stream);
+
+
+/*
+ * LZ4_loadDict
+ * Use this function to load a static dictionary into LZ4_stream.
+ * Any previous data will be forgotten, only 'dictionary' will remain in memory.
+ * Loading a size of 0 is allowed (same effect as init).
+ * Return : 1 if OK, 0 if error
+ */
+int LZ4_loadDict (void* LZ4_stream, const char* dictionary, int dictSize);
+
+/*
+ * LZ4_compress_continue
+ * Compress data block 'source', using blocks compressed before as dictionary to improve compression ratio
+ * Previous data blocks are assumed to still be present at their previous location.
+ */
+int LZ4_compress_continue (void* LZ4_stream, const char* source, char* dest, int inputSize);
+
+/*
+ * LZ4_compress_limitedOutput_continue
+ * Same as before, but also specify a maximum target compressed size (maxOutputSize)
+ * If objective cannot be met, compression exits, and returns a zero.
+ */
+int LZ4_compress_limitedOutput_continue (void* LZ4_stream, const char* source, char* dest, int inputSize, int maxOutputSize);
+
+/*
+ * LZ4_saveDict
+ * If previously compressed data block is not guaranteed to remain at its previous memory location
+ * save it into a safe place (char* safeBuffer)
+ * Note : you don't need to call LZ4_loadDict() afterwards,
+ *        dictionary is immediately usable, you can therefore call again LZ4_compress_continue()
+ * Return : 1 if OK, 0 if error
+ * Note : any dictSize > 64 KB will be interpreted as 64KB.
+ */
+int LZ4_saveDict (void* LZ4_stream, char* safeBuffer, int dictSize);
+
+
+/************************************************
+  Experimental Streaming Decompression Functions
+************************************************/
+
+#define LZ4_STREAMDECODESIZE_U32 4
+#define LZ4_STREAMDECODESIZE     (LZ4_STREAMDECODESIZE_U32 * sizeof(unsigned int))
+/*
+ * LZ4_streamDecode_t
+ * information structure to track an LZ4 stream.
+ * important : set this structure content to zero before first use !
+ */
+typedef struct { unsigned int table[LZ4_STREAMDECODESIZE_U32]; } LZ4_streamDecode_t;
+
+/*
+ * If you prefer dynamic allocation methods,
+ * LZ4_createStreamDecode()
+ * provides a pointer (void*) towards an initialized LZ4_streamDecode_t structure.
+ * LZ4_free just frees it.
+ */
+void* LZ4_createStreamDecode();
+int   LZ4_free (void* LZ4_stream);   /* yes, it's the same one as for compression */
+
+/*
+*_continue() :
+    These decoding functions allow decompression of multiple blocks in "streaming" mode.
+    Previously decoded blocks must still be available at the memory position where they were decoded.
+    If it's not possible, save the relevant part of decoded data into a safe buffer,
+    and indicate where it stands using LZ4_setDictDecode()
+*/
+int LZ4_decompress_safe_continue (void* LZ4_streamDecode, const char* source, char* dest, int compressedSize, int maxOutputSize);
+int LZ4_decompress_fast_continue (void* LZ4_streamDecode, const char* source, char* dest, int originalSize);
+
+/*
+ * LZ4_setDictDecode
+ * Use this function to instruct where to find the dictionary.
+ * This function can be used to specify a static dictionary,
+ * or to instruct where to find some previously decoded data saved into a different memory space.
+ * Setting a size of 0 is allowed (same effect as no dictionary).
+ * Return : 1 if OK, 0 if error
+ */
+int LZ4_setDictDecode (void* LZ4_streamDecode, const char* dictionary, int dictSize);
+
+
+/*
+Advanced decoding functions :
+*_usingDict() :
+    These decoding functions work the same as
+    a combination of LZ4_setDictDecode() followed by LZ4_decompress_x_continue()
+    all together into a single function call.
+    It doesn't use nor update an LZ4_streamDecode_t structure.
+*/
+int LZ4_decompress_safe_usingDict (const char* source, char* dest, int compressedSize, int maxOutputSize, const char* dictStart, int dictSize);
+int LZ4_decompress_fast_usingDict (const char* source, char* dest, int originalSize, const char* dictStart, int dictSize);
+
+
+
+#if defined (__cplusplus)
+}
+#endif
diff --git a/mfbt/lz4_encoder.h b/mfbt/lz4_encoder.h
deleted file mode 100644
index ee87cbbf3526..000000000000
--- a/mfbt/lz4_encoder.h
+++ /dev/null
@@ -1,258 +0,0 @@
-/*
-   LZ4 Encoder - Part of LZ4 compression algorithm
-   Copyright (C) 2011-2013, Yann Collet.
-   BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php)
-
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions are
-   met:
-
-       * Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-       * Redistributions in binary form must reproduce the above
-   copyright notice, this list of conditions and the following disclaimer
-   in the documentation and/or other materials provided with the
-   distribution.
-
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-   You can contact the author at :
-   - LZ4 homepage : http://fastcompression.blogspot.com/p/lz4.html
-   - LZ4 source repository : http://code.google.com/p/lz4/
-*/
-
-/* lz4_encoder.h must be included into lz4.c
-   The objective of this file is to create a single LZ4 compression function source
-   which will be instanciated multiple times with minor variations
-   depending on a set of #define.
-*/
-
-
-
-//****************************
-// Check required defines
-//****************************
-
-#ifndef FUNCTION_NAME
-#  error "FUNTION_NAME is not defined"
-#endif
-
-
-//****************************
-// Local definitions
-//****************************
-
-#ifdef COMPRESS_64K
-#  define HASHLOG (MEMORY_USAGE-1)
-#  define CURRENT_H_TYPE U16
-#  define CURRENTBASE(base) const BYTE* const base = ip
-#else
-#  define HASHLOG (MEMORY_USAGE-2)
-#  define CURRENT_H_TYPE HTYPE
-#  define CURRENTBASE(base) INITBASE(base)
-#endif
-
-#define HASHTABLE_NBCELLS  (1U<<HASHLOG)
-#define LZ4_HASH(i)        (((i) * 2654435761U) >> ((MINMATCH*8)-HASHLOG))
-#define LZ4_HASHVALUE(p)   LZ4_HASH(A32(p))
-
-
-
-//****************************
-// Function code
-//****************************
-
-int FUNCTION_NAME(
-#ifdef USE_HEAPMEMORY
-                 void* ctx,
-#endif
-                 const char* source,
-                 char* dest,
-                 int inputSize
-#ifdef LIMITED_OUTPUT
-                ,int maxOutputSize
-#endif
-                 )
-{
-#ifdef USE_HEAPMEMORY
-    CURRENT_H_TYPE* HashTable = (CURRENT_H_TYPE*)ctx;
-#else
-    CURRENT_H_TYPE HashTable[HASHTABLE_NBCELLS] = {0};
-#endif
-
-    const BYTE* ip = (BYTE*) source;
-    CURRENTBASE(base);
-    const BYTE* anchor = ip;
-    const BYTE* const iend = ip + inputSize;
-    const BYTE* const mflimit = iend - MFLIMIT;
-#define matchlimit (iend - LASTLITERALS)
-
-    BYTE* op = (BYTE*) dest;
-#ifdef LIMITED_OUTPUT
-    BYTE* const oend = op + maxOutputSize;
-#endif
-
-    int length;
-    const int skipStrength = SKIPSTRENGTH;
-    U32 forwardH;
-
-
-    // Init
-    if (inputSize<MINLENGTH) goto _last_literals;
-#ifdef COMPRESS_64K
-    if (inputSize>LZ4_64KLIMIT) return 0;   // Size too large (not within 64K limit)
-#endif
-#ifdef USE_HEAPMEMORY
-    memset((void*)HashTable, 0, HASHTABLESIZE);
-#endif
-
-    // First Byte
-    HashTable[LZ4_HASHVALUE(ip)] = (CURRENT_H_TYPE)(ip - base);
-    ip++; forwardH = LZ4_HASHVALUE(ip);
-
-    // Main Loop
-    for ( ; ; )
-    {
-        int findMatchAttempts = (1U << skipStrength) + 3;
-        const BYTE* forwardIp = ip;
-        const BYTE* ref;
-        BYTE* token;
-
-        // Find a match
-        do {
-            U32 h = forwardH;
-            int step = findMatchAttempts++ >> skipStrength;
-            ip = forwardIp;
-            forwardIp = ip + step;
-
-            if unlikely(forwardIp > mflimit) { goto _last_literals; }
-
-            forwardH = LZ4_HASHVALUE(forwardIp);
-            ref = base + HashTable[h];
-            HashTable[h] = (CURRENT_H_TYPE)(ip - base);
-
-        } while ((ref < ip - MAX_DISTANCE) || (A32(ref) != A32(ip)));
-
-        // Catch up
-        while ((ip>anchor) && (ref>(BYTE*)source) && unlikely(ip[-1]==ref[-1])) { ip--; ref--; }
-
-        // Encode Literal length
-        length = (int)(ip - anchor);
-        token = op++;
-#ifdef LIMITED_OUTPUT
-        if unlikely(op + length + (2 + 1 + LASTLITERALS) + (length>>8) > oend) return 0;   // Check output limit
-#endif
-        if (length>=(int)RUN_MASK) 
-        { 
-            int len = length-RUN_MASK; 
-            *token=(RUN_MASK<<ML_BITS); 
-            for(; len >= 255 ; len-=255) *op++ = 255; 
-            *op++ = (BYTE)len; 
-        }
-        else *token = (BYTE)(length<<ML_BITS);
-
-        // Copy Literals
-        LZ4_BLINDCOPY(anchor, op, length);
-
-_next_match:
-        // Encode Offset
-        LZ4_WRITE_LITTLEENDIAN_16(op,(U16)(ip-ref));
-
-        // Start Counting
-        ip+=MINMATCH; ref+=MINMATCH;    // MinMatch already verified
-        anchor = ip;
-        while likely(ip<matchlimit-(STEPSIZE-1))
-        {
-            UARCH diff = AARCH(ref) ^ AARCH(ip);
-            if (!diff) { ip+=STEPSIZE; ref+=STEPSIZE; continue; }
-            ip += LZ4_NbCommonBytes(diff);
-            goto _endCount;
-        }
-        if (LZ4_ARCH64) if ((ip<(matchlimit-3)) && (A32(ref) == A32(ip))) { ip+=4; ref+=4; }
-        if ((ip<(matchlimit-1)) && (A16(ref) == A16(ip))) { ip+=2; ref+=2; }
-        if ((ip<matchlimit) && (*ref == *ip)) ip++;
-_endCount:
-
-        // Encode MatchLength
-        length = (int)(ip - anchor);
-#ifdef LIMITED_OUTPUT
-        if unlikely(op + (1 + LASTLITERALS) + (length>>8) > oend) return 0;    // Check output limit
-#endif
-        if (length>=(int)ML_MASK) 
-        { 
-            *token += ML_MASK; 
-            length -= ML_MASK; 
-            for (; length > 509 ; length-=510) { *op++ = 255; *op++ = 255; } 
-            if (length >= 255) { length-=255; *op++ = 255; } 
-            *op++ = (BYTE)length; 
-        }
-        else *token += (BYTE)length;
-
-        // Test end of chunk
-        if (ip > mflimit) { anchor = ip;  break; }
-
-        // Fill table
-        HashTable[LZ4_HASHVALUE(ip-2)] = (CURRENT_H_TYPE)(ip - 2 - base);
-
-        // Test next position
-        ref = base + HashTable[LZ4_HASHVALUE(ip)];
-        HashTable[LZ4_HASHVALUE(ip)] = (CURRENT_H_TYPE)(ip - base);
-        if ((ref >= ip - MAX_DISTANCE) && (A32(ref) == A32(ip))) { token = op++; *token=0; goto _next_match; }
-
-        // Prepare next loop
-        anchor = ip++;
-        forwardH = LZ4_HASHVALUE(ip);
-    }
-
-_last_literals:
-    // Encode Last Literals
-    {
-        int lastRun = (int)(iend - anchor);
-#ifdef LIMITED_OUTPUT
-        if (((char*)op - dest) + lastRun + 1 + ((lastRun+255-RUN_MASK)/255) > (U32)maxOutputSize) return 0;  // Check output limit
-#endif
-        if (lastRun>=(int)RUN_MASK) { *op++=(RUN_MASK<<ML_BITS); lastRun-=RUN_MASK; for(; lastRun >= 255 ; lastRun-=255) *op++ = 255; *op++ = (BYTE) lastRun; }
-        else *op++ = (BYTE)(lastRun<<ML_BITS);
-        memcpy(op, anchor, iend - anchor);
-        op += iend-anchor;
-    }
-
-    // End
-    return (int) (((char*)op)-dest);
-}
-
-
-
-//****************************
-// Clean defines
-//****************************
-
-// Required defines
-#undef FUNCTION_NAME
-
-// Locally Generated
-#undef HASHLOG
-#undef HASHTABLE_NBCELLS
-#undef LZ4_HASH
-#undef LZ4_HASHVALUE
-#undef CURRENT_H_TYPE
-#undef CURRENTBASE
-
-// Optional defines
-#ifdef LIMITED_OUTPUT
-#undef LIMITED_OUTPUT
-#endif
-
-#ifdef USE_HEAPMEMORY
-#undef USE_HEAPMEMORY
-#endif
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index e43bbc2d2934..2858d9f9d8c2 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -4884,14 +4884,14 @@ var BrowserEventHandler = {
    * <video>, <object>, <embed>, <applet>, <canvas>, <img>, <media>, <pre>
    */
   _shouldSuppressReflowOnZoom: function(aElement) {
-    if (aElement instanceof Ci.nsIDOMHTMLVideoElement ||
-        aElement instanceof Ci.nsIDOMHTMLObjectElement ||
-        aElement instanceof Ci.nsIDOMHTMLEmbedElement ||
-        aElement instanceof Ci.nsIDOMHTMLAppletElement ||
-        aElement instanceof Ci.nsIDOMHTMLCanvasElement ||
-        aElement instanceof Ci.nsIDOMHTMLImageElement ||
-        aElement instanceof Ci.nsIDOMHTMLMediaElement ||
-        aElement instanceof Ci.nsIDOMHTMLPreElement) {
+    if (aElement instanceof HTMLVideoElement ||
+        aElement instanceof HTMLObjectElement ||
+        aElement instanceof HTMLEmbedElement ||
+        aElement instanceof HTMLAppletElement ||
+        aElement instanceof HTMLCanvasElement ||
+        aElement instanceof HTMLImageElement ||
+        aElement instanceof HTMLMediaElement ||
+        aElement instanceof HTMLPreElement) {
       return true;
     }
 
diff --git a/mobile/android/components/MobileComponents.manifest b/mobile/android/components/MobileComponents.manifest
index ee788eda97a6..75d4622d2741 100644
--- a/mobile/android/components/MobileComponents.manifest
+++ b/mobile/android/components/MobileComponents.manifest
@@ -110,7 +110,7 @@ contract @mozilla.org/tab-source-service;1 {5850c76e-b916-4218-b99a-31f004e0a7e7
 # Snippets.js
 component {a78d7e59-b558-4321-a3d6-dffe2f1e76dd} Snippets.js
 contract @mozilla.org/snippets;1 {a78d7e59-b558-4321-a3d6-dffe2f1e76dd}
-category profile-after-change Snippets @mozilla.org/snippets;1
+category browser-delayed-startup-finished Snippets @mozilla.org/snippets;1
 category update-timer Snippets @mozilla.org/snippets;1,getService,snippets-update-timer,browser.snippets.updateInterval,86400
 
 # WebappsUpdateTimer.js
diff --git a/mobile/android/components/Snippets.js b/mobile/android/components/Snippets.js
index 74786f52f9a4..a1c1b7546cb9 100644
--- a/mobile/android/components/Snippets.js
+++ b/mobile/android/components/Snippets.js
@@ -385,9 +385,6 @@ Snippets.prototype = {
 
   observe: function(subject, topic, data) {
     switch(topic) {
-      case "profile-after-change":
-        Services.obs.addObserver(this, "browser-delayed-startup-finished", false);
-        break;
       case "browser-delayed-startup-finished":
         Services.obs.removeObserver(this, "browser-delayed-startup-finished", false);
         if (Services.prefs.getBoolPref("browser.snippets.syncPromo.enabled")) {
diff --git a/netwerk/test/crashtests/785753-1.html b/netwerk/test/crashtests/785753-1.html
new file mode 100644
index 000000000000..7ccb82355563
--- /dev/null
+++ b/netwerk/test/crashtests/785753-1.html
@@ -0,0 +1,253 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 0.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+<head>
+<title>Test for importing styles via incorrect link element</title>
+<link type="text/css" href="data:text/css;charset=utf-8,p#one%-32519279132875%7Bbackground-color%32769A%340282366920938463463374607431768211436red%1B%7D%0D%0A"/>
+<link rel="stylesheet" href="data:text/css;charset=utf-16,p#two%1%7Bbackground-color%65535A%4294967297lime%3B%7D%0D%0A"/>
+</head>
+<link href="data:text/css;charset=utf-8,p#three%1%7Bbackground-color%3A%20red%3B%7D%0D%0A"/>
+<link type="text/css" rel="stylesheet" href="data:text/css;charset=utf-8,p#four%32767%7Bbackground-color%2147483649A%20lime%257B%7D%0D%0A"/>
+</head>
+<body>
+<p id="one">This line should not have red background</p>
+<p id="two">This line should have lime background</p>
+<p id="three">This line should not have red background</p>
+<p id="four">This line should have lime background</p>
+</body>
+<script type="text/javascript"> 
+ function alert(msg){}; function confirm(msg){}; function prompt(msg){};  
+ try{ document.head.appendChild(document.createElement("style"));}catch(e){}
+ var styleSheet = document.styleSheets[document.styleSheets.length-1];
+try{if(styleSheet.length===undefined){styleSheet.insertRule(":root{}",0); styleSheet.disabled=false}
+
+styleSheet.insertRule("body {counter-reset:c}",0)}catch(e){}
+var styleSheet0 = document.styleSheets[0];
+var styleSheet1 = document.styleSheets[1];
+var styleSheet2 = document.styleSheets[2];
+var test0=document.getElementById("four")
+var test1=document.getElementById("one")
+var test2=document.getElementById("two")
+var test3=document.getElementById("three")
+setTimeout(function(){
+try{test0.style['padding-top']='32px';}catch(e){}
+try{test2.insertBefore(test3);}catch(e){}
+try{test0.style.setProperty('background-image','url(data:image/gif;base64,R0lGODlhEAAOALMAAOazToeHh0tLS/7LZv/0jvb29t/f3//Ub//ge8WSLf/rhf/3kdbW1mxsbP//mf///yH5BAAAAAAALAAAAAAQAA4AAARe8L1Ekyky67QZ1hLnjM5UUde0ECwLJoExKcppV0aCcGCmTIHEIUEqjgaORCMxIC6e0CcguWw6aFjsVMkkIr7g77ZKPJjPZqIyd7sJAgVGoEGv2xsBxqNgYPj/gAwXEQA7)','important');}catch(e){}
+try{test3.style['line-height']='-324px';}catch(e){}
+try{test0.style.setProperty('border-image-repeat','repeat','important');}catch(e){}
+},3);
+
+setTimeout(function(){
+try{test1.style['line-height']='43px';}catch(e){}
+try{styleSheet0.insertRule(".undefined,.undefined{clear:right; }",styleSheet0.cssRules.length);}catch(e){}
+try{test2.style.setProperty('bottom','inherit','important');}catch(e){}
+try{test3.parentNode.removeChild(test3)}catch(e){};
+try{test0.style.setProperty('overflow-x','no-content','important');}catch(e){}
+},0);
+
+setTimeout(function(){
+try{styleSheet0.insertRule(".undefined,.undefined{font-size:40px; overflow-x:no-content; -moz-transition-duration:-5.408991568721831s; -moz-column-span:483; }",styleSheet0.cssRules.length);}catch(e){}
+try{test0.parentNode.removeChild(test0)}catch(e){};
+try{test0.insertBefore(test2);}catch(e){}
+try{test3.style.setProperty('bottom','inherit','important');}catch(e){}
+try{test2.style.setProperty('background-origin','border-box','important');}catch(e){}
+},2);
+
+setTimeout(function(){
+window.resizeTo(1018,353)
+try{test0.insertBefore(test1);}catch(e){}
+try{test1.style.setProperty('bottom','auto','important');}catch(e){}
+try{test1.style.setProperty('z-index','inherit','important');}catch(e){}
+window.resizeTo(1018,353)
+},1);
+
+setTimeout(function(){
+try{test0.innerHtml=test3.innerHtml;}catch(e){}
+document.body.style.setProperty('-webkit-filter','blur(18px)','null')
+try{test3.parentNode.removeChild(test3)}catch(e){};
+try{test0.style.setProperty('padding-right','18px','important');}catch(e){}
+try{test3.style.setProperty('border-bottom-color','rgb(96%,328%,106)','important');}catch(e){}
+},4);
+
+setTimeout(function(){
+try{test2.innerHtml=test0.innerHtml;}catch(e){}
+try{styleSheet1.insertRule(".undefined,.undefined{list-style-type:sidama; background-clip:border-box; overflow-x:scroll; border-bottom-left-radius:70px; text-transform:uppercase; empty-cells:inherit; }",styleSheet1.cssRules.length);}catch(e){}
+try{styleSheet1.insertRule(".undefined:active {min-width:759; }",styleSheet1.cssRules.length);}catch(e){}
+try{test1.style.setProperty('top','343','important');}catch(e){}
+try{test2.replaceChild(test0,test2.firstChild)}catch(e){}
+},4);
+
+setTimeout(function(){
+try{styleSheet1.insertRule(".undefined,.undefined,.undefined,.undefined{background-attachment:inherit; flood-color:rgba(93%,364%,104,4.471563883125782); }",0);}catch(e){}
+try{test1.style.setProperty('font-style','oblique','important');}catch(e){}
+try{styleSheet0.insertRule(".undefined,.undefined,.undefined{border-right-style:double; }",styleSheet0.cssRules.length);}catch(e){}
+document.execCommand("SelectAll", true);
+try{test3.parentNode.removeChild(test3)}catch(e){};
+},1);
+
+setTimeout(function(){
+try{test1.parentNode.removeChild(test1)}catch(e){};
+try{test0.innerHtml=test2.innerHtml;}catch(e){}
+try{test1.parentNode.removeChild(test1)}catch(e){};
+try{test0.parentNode.removeChild(test0)}catch(e){};
+try{test2.innerHtml=test2.innerHtml;}catch(e){}
+},4);
+
+setTimeout(function(){
+try{test0.appendChild(test1);}catch(e){}
+try{test1.style['position']='inherit';}catch(e){}
+try{test2.replaceChild(test3,test2.lastChild)}catch(e){}
+try{test1.style['border-left-color']='#6D8997';}catch(e){}
+try{test1.innerHtml=test3.innerHtml;}catch(e){}
+},6);
+
+setTimeout(function(){
+try{test2.insertBefore(test1);}catch(e){}
+try{test2.innerHtml=test3.innerHtml;}catch(e){}
+try{test0.appendChild(test2);}catch(e){}
+try{styleSheet0.insertRule(".undefined,.undefined{resize:both; background-color:#A22225; position:relative; -moz-column-width:auto; letter-spacing:361px; border-top-width:151%; }",styleSheet0.cssRules.length);}catch(e){}
+document.body.style.zoom=1.8764980849809945
+},6);
+
+setTimeout(function(){
+try{styleSheet1.insertRule(".undefined,.undefined,.undefined{outline-color:rgba(126,179,46,0.8964905887842178); width:183; }",styleSheet1.cssRules.length);}catch(e){}
+try{test2.insertBefore(test3);}catch(e){}
+try{test1.innerHtml=test3.innerHtml;}catch(e){}
+try{styleSheet0.insertRule("article,footer,article,article{border-bottom-right-radius:7px; }",0);}catch(e){}
+try{test1.insertBefore(test0);}catch(e){}
+},4);
+
+setTimeout(function(){
+try{test0.parentNode.removeChild(test0)}catch(e){};
+try{styleSheet1.insertRule(".undefined,.undefined,.undefined,.undefined{display: table-header-group; content: counter(c, ethiopic); counter-increment:c;}",0);}catch(e){}
+try{test0.style.setProperty('background-color','#8897D3','important');}catch(e){}
+try{test3.appendChild(test0);}catch(e){}
+try{styleSheet0.insertRule("hgroup,hgroup,hgroup{outline-color:rgba(167,242,90%,-0.10827295063063502); }",styleSheet0.cssRules.length);}catch(e){}
+},4);
+
+setTimeout(function(){
+try{test3.style.setProperty('border-bottom-color','#55D7F6','important');}catch(e){}
+try{test1.parentNode.removeChild(test1)}catch(e){};
+try{test2.insertBefore(test1);}catch(e){}
+try{test2.innerHtml=test0.innerHtml;}catch(e){}
+try{styleSheet1.insertRule("#one,#one,#three,#three{background-clip:border-box; border-top-width:85em; }",0);}catch(e){}
+},5);
+
+setTimeout(function(){
+try{test3.appendChild(test0);}catch(e){}
+try{test2.innerHtml=test1.innerHtml;}catch(e){}
+try{test2.style['background-attachment']='inherit';}catch(e){}
+try{test3.style['clip']='inherit';}catch(e){}
+try{test3.parentNode.removeChild(test3)}catch(e){};
+},3);
+
+setTimeout(function(){
+try{test1.parentNode.removeChild(test1)}catch(e){};
+try{styleSheet0.insertRule(".undefined,.undefined{height:424; }",styleSheet0.cssRules.length);}catch(e){}
+try{test2.style.setProperty('border-top-style','solid','important');}catch(e){}
+try{styleSheet0.insertRule(".undefined,.undefined,.undefined,.undefined{page-break-inside:left; border-image-slice:fill; border-left-width:184pc; }",styleSheet0.cssRules.length);}catch(e){}
+try{styleSheet0.insertRule(".undefined,.undefined{margin-left:-105px; text-transform:inherit; box-sizing:border-box; }",styleSheet0.cssRules.length);}catch(e){}
+},4);
+
+setTimeout(function(){
+try{styleSheet0.insertRule("param,img,img,param{left:auto; background-clip:padding-box; }",styleSheet0.cssRules.length);}catch(e){}
+try{test2.style.setProperty('min-height','605','important');}catch(e){}
+try{test2.parentNode.removeChild(test2)}catch(e){};
+try{styleSheet1.insertRule(".undefined::first-line, #two::first-line {border-bottom-width:69pt; lighting-color:rgba(75%,166,81,-0.8728196211159229); text-shadow:85px 459px #2F1; }",styleSheet1.cssRules.length);}catch(e){}
+try{test3.appendChild(document.createTextNode(unescape("!F幓[")))}catch(e){}
+},4);
+
+setTimeout(function(){
+try{styleSheet0.insertRule("#two,#four{font-style:italic; list-style-position:inside; border-collapse:inherit; word-wrap:break-word; text-transform:uppercase; }",styleSheet0.cssRules.length);}catch(e){}
+try{test1.style.setProperty('border-bottom-right-radius','2px','important');}catch(e){}
+try{test3.style['text-shadow']='58px 64px rgba(61%,60,199,0.03203143551945686)';}catch(e){}
+try{styleSheet1.insertRule("dir,dir,nav{display: inline-table; content: counter(c, upper-greek); counter-increment:c;}",styleSheet1.cssRules.length);}catch(e){}
+try{styleSheet0.insertRule("#one:target, #three:after {color:#D9B; outline-style:hidden; flood-color:rgba(22,59%,99%,-0.008097740123048425); }",0);}catch(e){}
+},6);
+
+setTimeout(function(){
+try{test2.parentNode.removeChild(test2)}catch(e){};
+document.execCommand("Copy", true);
+try{test3.style['letter-spacing']='102px';}catch(e){}
+try{test2.parentNode.removeChild(test2)}catch(e){};
+try{test3.appendChild(test0);}catch(e){}
+},5);
+
+setTimeout(function(){
+try{test0.style['text-transform']='inherit';}catch(e){}
+try{test0.style['word-break']='hyphenate';}catch(e){}
+try{test3.insertBefore(test2);}catch(e){}
+try{test2.style.setProperty('bottom','410','important');}catch(e){}
+try{test1.style['background']='url(data:image/gif;base64,R0lGODlhEAAOALMAAOazToeHh0tLS/7LZv/0jvb29t/f3//Ub//ge8WSLf/rhf/3kdbW1mxsbP//mf///yH5BAAAAAAALAAAAAAQAA4AAARe8L1Ekyky67QZ1hLnjM5UUde0ECwLJoExKcppV0aCcGCmTIHEIUEqjgaORCMxIC6e0CcguWw6aFjsVMkkIr7g77ZKPJjPZqIyd7sJAgVGoEGv2xsBxqNgYPj/gAwXEQA7)';}catch(e){}
+},5);
+
+setTimeout(function(){
+try{test2.appendChild(test2);}catch(e){}
+try{test1.appendChild(test2);}catch(e){}
+try{test2.appendChild(document.createTextNode(unescape("zn!쎔gw눢fb¤£kꄍ£3wa02fnpå0!äwC䰴頥!!a")))}catch(e){}
+try{styleSheet0.insertRule(".undefined,.undefined,.undefined{display: inline; content: counter(c, khmer); counter-increment:c;}",0);}catch(e){}
+try{test3.style.setProperty('line-height','42in','important');}catch(e){}
+},7);
+
+setTimeout(function(){
+window.moveBy(133,126)
+try{test0.style['padding-right']='20px';}catch(e){}
+try{test1.replaceChild(test2,test1.firstChild)}catch(e){}
+try{test1.style.setProperty('letter-spacing','120px','important');}catch(e){}
+try{test1.style.setProperty('height','57','important');}catch(e){}
+},4);
+
+setTimeout(function(){
+try{styleSheet1.insertRule(".undefined:nth-child(even), #one:nth-last-child(even) {margin-top:-241cm; font-size:23px; }",0);}catch(e){}
+try{styleSheet0.insertRule(".undefined:nth-child(even), #three:default {stop-color:rgba(92%,-201%,31,0.8133529485203326); lighting-color:#E31; }",styleSheet0.cssRules.length);}catch(e){}
+try{test1.style.setProperty('border-top-left-radius','63px','important');}catch(e){}
+try{test0.style['letter-spacing']='36px';}catch(e){}
+try{test1.appendChild(document.createTextNode(unescape("1u£Fⶵ隗(籬fsä⍉㯗cሮ銐k䆴n#蹹圭篺(1w馁")))}catch(e){}
+},7);
+
+setTimeout(function(){
+try{test1.appendChild(test3);}catch(e){}
+try{test2.style.setProperty('lighting-color','rgb(4,36%,95%)','important');}catch(e){}
+try{test0.style.setProperty('border-right-width','71pt','important');}catch(e){}
+try{test2.style['box-shadow']='-228px , 86px , 9px , #F0A134';}catch(e){}
+try{styleSheet0.insertRule(".undefined,.undefined,.undefined{left:inherit; }",styleSheet0.cssRules.length);}catch(e){}
+},7);
+
+setTimeout(function(){
+try{styleSheet1.insertRule(".undefined,.undefined,.undefined,.undefined{min-height:277; -moz-transition-property:none; }",0);}catch(e){}
+try{test0.style.setProperty('word-wrap','break-word','important');}catch(e){}
+try{test1.style.setProperty('top','inherit','important');}catch(e){}
+try{styleSheet0.insertRule(".undefined,.undefined,.undefined{overflow-x:visible; border-bottom-left-radius:844488.660965659px; }",0);}catch(e){}
+try{test2.style.setProperty('margin-bottom','auto','important');}catch(e){}
+},0);
+
+setTimeout(function(){
+try{styleSheet1.insertRule("hgroup,hgroup,dl,dl{display: list-item; content: counter(c, hebrew); counter-increment:c;}",styleSheet1.cssRules.length);}catch(e){}
+try{test0.style.setProperty('border-image-repeat','repeat','important');}catch(e){}
+try{styleSheet0.insertRule("figure,footer,figure,table{-moz-border-image-repeat:stretch; word-wrap:normal; border-right-color:rgb(4%,19%,6%); caption-side:top; stop-color:rgba(450%,226,14%,1.5385327017866075); }",styleSheet0.cssRules.length);}catch(e){}
+try{test3.innerHtml=test2.innerHtml;}catch(e){}
+try{test2.appendChild(test0);}catch(e){}
+},0);
+
+setTimeout(function(){
+try{test1.replaceChild(test0,test1.lastChild)}catch(e){}
+try{test2.style.setProperty('border-collapse','inherit','important');}catch(e){}
+try{test1.style['overflow-x']='visible';}catch(e){}
+try{test1.style['text-indent']='-30.283706605434418cm';}catch(e){}
+try{styleSheet0.insertRule("tt,hgroup{stroke-width:-439px; box-sizing:border-box; }",styleSheet0.cssRules.length);}catch(e){}
+},1);
+
+setTimeout(function(){
+styleSheet0.disabled=true
+styleSheet1.disabled=false
+styleSheet1.disabled=true
+document.body.style.setProperty('-webkit-filter','invert(338%)','null')
+window.moveBy(302,115)
+},0);
+
+setTimeout(function(){
+window.blur()
+},4);
+
+</script>
+
+</html>
diff --git a/netwerk/test/crashtests/785753-2.html b/netwerk/test/crashtests/785753-2.html
new file mode 100644
index 000000000000..15a9865388f3
--- /dev/null
+++ b/netwerk/test/crashtests/785753-2.html
@@ -0,0 +1,3 @@
+<link rel="stylesheet" href="data:text/css;charset=utf-16,a"/>
+
+<link rel="stylesheet" href="data:text/css;charset=utf-16,p#two%1%7Bbackground-color%65535A%4294967297lime%3B%7D%0D%0A"/>
\ No newline at end of file
diff --git a/netwerk/test/crashtests/crashtests.list b/netwerk/test/crashtests/crashtests.list
new file mode 100644
index 000000000000..174564aff274
--- /dev/null
+++ b/netwerk/test/crashtests/crashtests.list
@@ -0,0 +1,2 @@
+load 785753-1.html
+load 785753-2.html
diff --git a/python/mozbuild/mozbuild/mach_commands.py b/python/mozbuild/mozbuild/mach_commands.py
index 0e42f045a521..857d1fcd8406 100644
--- a/python/mozbuild/mozbuild/mach_commands.py
+++ b/python/mozbuild/mozbuild/mach_commands.py
@@ -423,14 +423,19 @@ class Build(MachCommandBase):
         # Only for full builds because incremental builders likely don't
         # need to be burdened with this.
         if not what:
-            # Fennec doesn't have useful output from just building. We should
-            # arguably make the build action useful for Fennec. Another day...
-            if self.substs['MOZ_BUILD_APP'] != 'mobile/android':
-                print('To take your build for a test drive, run: |mach run|')
-            app = self.substs['MOZ_BUILD_APP']
-            if app in ('browser', 'mobile/android'):
-                print('For more information on what to do now, see '
-                    'https://developer.mozilla.org/docs/Developer_Guide/So_You_Just_Built_Firefox')
+            try:
+                # Fennec doesn't have useful output from just building. We should
+                # arguably make the build action useful for Fennec. Another day...
+                if self.substs['MOZ_BUILD_APP'] != 'mobile/android':
+                    print('To take your build for a test drive, run: |mach run|')
+                app = self.substs['MOZ_BUILD_APP']
+                if app in ('browser', 'mobile/android'):
+                    print('For more information on what to do now, see '
+                        'https://developer.mozilla.org/docs/Developer_Guide/So_You_Just_Built_Firefox')
+            except Exception:
+                # Ignore Exceptions in case we can't find config.status (such
+                # as when doing OSX Universal builds)
+                pass
 
         return status
 
diff --git a/security/apps/AppTrustDomain.cpp b/security/apps/AppTrustDomain.cpp
index 5f89b46f1f17..cc1f825eb387 100644
--- a/security/apps/AppTrustDomain.cpp
+++ b/security/apps/AppTrustDomain.cpp
@@ -113,7 +113,9 @@ AppTrustDomain::FindIssuer(const SECItem& encodedIssuerName,
     for (CERTCertListNode* n = CERT_LIST_HEAD(candidates);
          !CERT_LIST_END(n, candidates); n = CERT_LIST_NEXT(n)) {
       bool keepGoing;
-      SECStatus srv = checker.Check(n->cert->derCert, keepGoing);
+      SECStatus srv = checker.Check(n->cert->derCert,
+                                    nullptr/*additionalNameConstraints*/,
+                                    keepGoing);
       if (srv != SECSuccess) {
         return SECFailure;
       }
diff --git a/security/certverifier/NSSCertDBTrustDomain.cpp b/security/certverifier/NSSCertDBTrustDomain.cpp
index 8aabbe7602b0..90e0d6e752e7 100644
--- a/security/certverifier/NSSCertDBTrustDomain.cpp
+++ b/security/certverifier/NSSCertDBTrustDomain.cpp
@@ -61,6 +61,51 @@ NSSCertDBTrustDomain::NSSCertDBTrustDomain(SECTrustType certDBTrustType,
 {
 }
 
+// E=igca@sgdn.pm.gouv.fr,CN=IGC/A,OU=DCSSI,O=PM/SGDN,L=Paris,ST=France,C=FR
+static const uint8_t ANSSI_SUBJECT_DATA[] =
+                       "\x30\x81\x85\x31\x0B\x30\x09\x06\x03\x55\x04"
+                       "\x06\x13\x02\x46\x52\x31\x0F\x30\x0D\x06\x03"
+                       "\x55\x04\x08\x13\x06\x46\x72\x61\x6E\x63\x65"
+                       "\x31\x0E\x30\x0C\x06\x03\x55\x04\x07\x13\x05"
+                       "\x50\x61\x72\x69\x73\x31\x10\x30\x0E\x06\x03"
+                       "\x55\x04\x0A\x13\x07\x50\x4D\x2F\x53\x47\x44"
+                       "\x4E\x31\x0E\x30\x0C\x06\x03\x55\x04\x0B\x13"
+                       "\x05\x44\x43\x53\x53\x49\x31\x0E\x30\x0C\x06"
+                       "\x03\x55\x04\x03\x13\x05\x49\x47\x43\x2F\x41"
+                       "\x31\x23\x30\x21\x06\x09\x2A\x86\x48\x86\xF7"
+                       "\x0D\x01\x09\x01\x16\x14\x69\x67\x63\x61\x40"
+                       "\x73\x67\x64\x6E\x2E\x70\x6D\x2E\x67\x6F\x75"
+                       "\x76\x2E\x66\x72";
+
+static const SECItem ANSSI_SUBJECT = {
+  siBuffer,
+  const_cast<uint8_t*>(ANSSI_SUBJECT_DATA),
+  sizeof(ANSSI_SUBJECT_DATA) - 1
+};
+
+static const uint8_t PERMIT_FRANCE_GOV_NAME_CONSTRAINTS_DATA[] =
+                       "\x30\x5D" // SEQUENCE (length=93)
+                       "\xA0\x5B" // permittedSubtrees (length=91)
+                       "\x30\x05\x82\x03" ".fr"
+                       "\x30\x05\x82\x03" ".gp"
+                       "\x30\x05\x82\x03" ".gf"
+                       "\x30\x05\x82\x03" ".mq"
+                       "\x30\x05\x82\x03" ".re"
+                       "\x30\x05\x82\x03" ".yt"
+                       "\x30\x05\x82\x03" ".pm"
+                       "\x30\x05\x82\x03" ".bl"
+                       "\x30\x05\x82\x03" ".mf"
+                       "\x30\x05\x82\x03" ".wf"
+                       "\x30\x05\x82\x03" ".pf"
+                       "\x30\x05\x82\x03" ".nc"
+                       "\x30\x05\x82\x03" ".tf";
+
+static const SECItem PERMIT_FRANCE_GOV_NAME_CONSTRAINTS = {
+  siBuffer,
+  const_cast<uint8_t*>(PERMIT_FRANCE_GOV_NAME_CONSTRAINTS_DATA),
+  sizeof(PERMIT_FRANCE_GOV_NAME_CONSTRAINTS_DATA) - 1
+};
+
 SECStatus
 NSSCertDBTrustDomain::FindIssuer(const SECItem& encodedIssuerName,
                                  IssuerChecker& checker, PRTime time)
@@ -73,8 +118,14 @@ NSSCertDBTrustDomain::FindIssuer(const SECItem& encodedIssuerName,
   if (candidates) {
     for (CERTCertListNode* n = CERT_LIST_HEAD(candidates);
          !CERT_LIST_END(n, candidates); n = CERT_LIST_NEXT(n)) {
+      const SECItem* additionalNameConstraints = nullptr;
+      // TODO: Use CERT_CompareName or equivalent
+      if (SECITEM_ItemsAreEqual(&encodedIssuerName, &ANSSI_SUBJECT)) {
+        additionalNameConstraints = &PERMIT_FRANCE_GOV_NAME_CONSTRAINTS;
+      }
       bool keepGoing;
-      SECStatus srv = checker.Check(n->cert->derCert, keepGoing);
+      SECStatus srv = checker.Check(n->cert->derCert,
+                                    additionalNameConstraints, keepGoing);
       if (srv != SECSuccess) {
         return SECFailure;
       }
diff --git a/security/manager/pki/resources/content/certManager.js b/security/manager/pki/resources/content/certManager.js
index 1c00322948d3..bcb1f8a9281d 100644
--- a/security/manager/pki/resources/content/certManager.js
+++ b/security/manager/pki/resources/content/certManager.js
@@ -16,6 +16,9 @@ const nsPKIParamBlock    = "@mozilla.org/security/pkiparamblock;1";
 const nsINSSCertCache = Components.interfaces.nsINSSCertCache;
 const nsNSSCertCache = "@mozilla.org/security/nsscertcache;1";
 
+let { NetUtil } = Components.utils.import("resource://gre/modules/NetUtil.jsm", {});
+let { Services } = Components.utils.import("resource://gre/modules/Services.jsm", {});
+
 var key;
 
 var selected_certs = [];
@@ -368,9 +371,34 @@ function restoreCerts()
           nsIFilePicker.modeOpen);
   fp.appendFilter(bundle.getString("file_browse_PKCS12_spec"),
                   "*.p12; *.pfx");
+  fp.appendFilter(bundle.getString("file_browse_Certificate_spec"),
+                  "*.crt; *.cert; *.cer; *.pem; *.der");
   fp.appendFilters(nsIFilePicker.filterAll);
   if (fp.show() == nsIFilePicker.returnOK) {
-    certdb.importPKCS12File(null, fp.file);
+    // If this is an X509 user certificate, import it as one.
+    if (fp.file.path.endsWith(".crt") || fp.file.path.endsWith(".cert") ||
+        fp.file.path.endsWith(".cer") || fp.file.path.endsWith(".pem") ||
+        fp.file.path.endsWith(".der")) {
+      let fstream = Components.classes["@mozilla.org/network/file-input-stream;1"]
+                      .createInstance(Components.interfaces.nsIFileInputStream);
+      fstream.init(fp.file, -1, 0, 0);
+      let dataString = NetUtil.readInputStreamToString(fstream, fstream.available());
+      let dataArray = [];
+      for (let i = 0; i < dataString.length; i++) {
+        dataArray.push(dataString.charCodeAt(i));
+      }
+      fstream.close();
+      let prompter = Services.ww.getNewPrompter(window);
+      let interfaceRequestor = {
+        getInterface: function() {
+          return prompter;
+        }
+      };
+      certdb.importUserCertificate(dataArray, dataArray.length, interfaceRequestor);
+    } else {
+      // Otherwise, assume it's a PKCS12 file and import it that way.
+      certdb.importPKCS12File(null, fp.file);
+    }
 
     var certcache = Components.classes[nsNSSCertCache].createInstance(nsINSSCertCache);
     certcache.cacheAllCerts();
diff --git a/security/manager/ssl/src/ScopedNSSTypes.h b/security/manager/ssl/src/ScopedNSSTypes.h
index 4934e76957bf..f287eb79c92f 100644
--- a/security/manager/ssl/src/ScopedNSSTypes.h
+++ b/security/manager/ssl/src/ScopedNSSTypes.h
@@ -291,6 +291,11 @@ inline void SECITEM_FreeItem_true(SECItem * s)
   return SECITEM_FreeItem(s, true);
 }
 
+inline void SECOID_DestroyAlgorithmID_true(SECAlgorithmID * a)
+{
+  return SECOID_DestroyAlgorithmID(a, true);
+}
+
 } // namespace internal
 
 MOZ_TYPE_SPECIFIC_SCOPED_POINTER_TEMPLATE(ScopedSECItem,
@@ -303,6 +308,10 @@ MOZ_TYPE_SPECIFIC_SCOPED_POINTER_TEMPLATE(ScopedSECKEYPrivateKey,
 MOZ_TYPE_SPECIFIC_SCOPED_POINTER_TEMPLATE(ScopedSECKEYPublicKey,
                                           SECKEYPublicKey,
                                           SECKEY_DestroyPublicKey)
+MOZ_TYPE_SPECIFIC_SCOPED_POINTER_TEMPLATE(ScopedSECAlgorithmID,
+                                          SECAlgorithmID,
+                                          internal::SECOID_DestroyAlgorithmID_true)
+
 
 } // namespace mozilla
 
diff --git a/security/manager/ssl/src/nsNSSCertificateDB.cpp b/security/manager/ssl/src/nsNSSCertificateDB.cpp
index e49322498e1e..a1ad3a624141 100644
--- a/security/manager/ssl/src/nsNSSCertificateDB.cpp
+++ b/security/manager/ssl/src/nsNSSCertificateDB.cpp
@@ -1629,8 +1629,10 @@ NS_IMETHODIMP nsNSSCertificateDB::AddCertFromBase64(const char* aBase64,
     return MapSECStatus(SECFailure);
   }
 
+   // If there's already a certificate that matches this one in the database,
+   // we still want to set its trust to the given value.
   if (tmpCert->isperm) {
-    return NS_OK;
+    return SetCertTrustFromString(newCert, aTrust);
   }
 
   nsXPIDLCString nickname;
diff --git a/security/manager/ssl/tests/unit/test_add_preexisting_cert.js b/security/manager/ssl/tests/unit/test_add_preexisting_cert.js
new file mode 100644
index 000000000000..4521235cafc5
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_add_preexisting_cert.js
@@ -0,0 +1,46 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+do_get_profile();
+let certDB = Cc["@mozilla.org/security/x509certdb;1"]
+               .getService(Ci.nsIX509CertDB);
+
+function load_cert(cert, trust) {
+  let file = "test_intermediate_basic_usage_constraints/" + cert + ".der";
+  addCertFromFile(certDB, file, trust);
+}
+
+function getDERString(cert)
+{
+  var length = {};
+  var cert_der = cert.getRawDER(length);
+  var cert_der_string = '';
+  for (var i = 0; i < cert_der.length; i++) {
+    cert_der_string += String.fromCharCode(cert_der[i]);
+  }
+  return cert_der_string;
+}
+
+function run_test() {
+  load_cert("ca", "CTu,CTu,CTu");
+  load_cert("int-limited-depth", "CTu,CTu,CTu");
+  let file = "test_intermediate_basic_usage_constraints/ee-int-limited-depth.der";
+  let cert_der = readFile(do_get_file(file));
+  let ee = certDB.constructX509(cert_der, cert_der.length);
+  let hasEVPolicy = {};
+  let verifiedChain = {};
+  equal(Cr.NS_OK, certDB.verifyCertNow(ee, certificateUsageSSLServer,
+                                       NO_FLAGS, verifiedChain, hasEVPolicy));
+  // Change the already existing intermediate certificate's trust using
+  // addCertFromBase64(). We use findCertByNickname first to ensure that the
+  // certificate already exists.
+  let int_cert = certDB.findCertByNickname(null, "int-limited-depth");
+  ok(int_cert);
+  let base64_cert = btoa(getDERString(int_cert));
+  certDB.addCertFromBase64(base64_cert, "p,p,p", "ignored_argument");
+  equal(SEC_ERROR_UNTRUSTED_ISSUER, certDB.verifyCertNow(ee,
+                                                         certificateUsageSSLServer,
+                                                         NO_FLAGS, verifiedChain,
+                                                         hasEVPolicy));
+}
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/xpcshell.ini b/security/manager/ssl/tests/unit/xpcshell.ini
index 40f405310609..44cb9230b363 100644
--- a/security/manager/ssl/tests/unit/xpcshell.ini
+++ b/security/manager/ssl/tests/unit/xpcshell.ini
@@ -91,3 +91,4 @@ skip-if = os == "android"
 run-sequentially = hardcoded ports
 # Bug 1009158: this test times out on Android
 skip-if = os == "android"
+[test_add_preexisting_cert.js]
diff --git a/security/pkix/include/pkix/pkixtypes.h b/security/pkix/include/pkix/pkixtypes.h
index e9998cc8bbbd..9ea33ee8596c 100644
--- a/security/pkix/include/pkix/pkixtypes.h
+++ b/security/pkix/include/pkix/pkixtypes.h
@@ -146,8 +146,16 @@ public:
   class IssuerChecker
   {
   public:
+    // potentialIssuerDER is the complete DER encoding of the certificate to
+    // be checked as a potential issuer.
+    //
+    // If additionalNameConstraints is not nullptr then it must point to an
+    // encoded NameConstraints extension value; in that case, those name
+    // constraints will be checked in addition to any any name constraints
+    // contained in potentialIssuerDER.
     virtual SECStatus Check(const SECItem& potentialIssuerDER,
-                            /*out*/ bool& keepGoing) = 0;
+               /*optional*/ const SECItem* additionalNameConstraints,
+                    /*out*/ bool& keepGoing) = 0;
   protected:
     IssuerChecker();
     virtual ~IssuerChecker();
diff --git a/security/pkix/lib/pkixbuild.cpp b/security/pkix/lib/pkixbuild.cpp
index 34ee9f24a412..910380e8c373 100644
--- a/security/pkix/lib/pkixbuild.cpp
+++ b/security/pkix/lib/pkixbuild.cpp
@@ -65,6 +65,7 @@ public:
   }
 
   SECStatus Check(const SECItem& potentialIssuerDER,
+                  /*optional*/ const SECItem* additionalNameConstraints,
                   /*out*/ bool& keepGoing);
 
   Result CheckResult() const;
@@ -130,6 +131,7 @@ PathBuildingStep::CheckResult() const
 // The code that executes in the inner loop of BuildForward
 SECStatus
 PathBuildingStep::Check(const SECItem& potentialIssuerDER,
+                        /*optional*/ const SECItem* additionalNameConstraints,
                         /*out*/ bool& keepGoing)
 {
   BackCert potentialIssuer(potentialIssuerDER, EndEntityOrCA::MustBeCA,
@@ -157,9 +159,20 @@ PathBuildingStep::Check(const SECItem& potentialIssuerDER,
     }
   }
 
-  rv = CheckNameConstraints(potentialIssuer, requiredEKUIfPresent);
-  if (rv != Success) {
-    return RecordResult(PR_GetError(), keepGoing);
+  if (potentialIssuer.GetNameConstraints()) {
+    rv = CheckNameConstraints(*potentialIssuer.GetNameConstraints(),
+                              subject, requiredEKUIfPresent);
+    if (rv != Success) {
+       return RecordResult(PR_GetError(), keepGoing);
+    }
+  }
+
+  if (additionalNameConstraints) {
+    rv = CheckNameConstraints(*additionalNameConstraints, subject,
+                              requiredEKUIfPresent);
+    if (rv != Success) {
+       return RecordResult(PR_GetError(), keepGoing);
+    }
   }
 
   // RFC 5280, Section 4.2.1.3: "If the keyUsage extension is present, then the
diff --git a/security/pkix/lib/pkixcheck.cpp b/security/pkix/lib/pkixcheck.cpp
index 61b7577a59bb..a73b087ea92d 100644
--- a/security/pkix/lib/pkixcheck.cpp
+++ b/security/pkix/lib/pkixcheck.cpp
@@ -412,81 +412,10 @@ PORT_FreeArena_false(PLArenaPool* arena) {
 }
 
 Result
-CheckNameConstraints(const BackCert& cert, KeyPurposeId requiredEKUIfPresent)
+CheckNameConstraints(const SECItem& encodedNameConstraints,
+                     const BackCert& firstChild,
+                     KeyPurposeId requiredEKUIfPresent)
 {
-  // These hardcoded consts are to handle a post certificate creation
-  // name constraints. In this case for ANSSI.
-  static const char constraintFranceGov[] =
-                                     "\x30\x5D" /* sequence len 93*/
-                                     "\xA0\x5B" /* element len 91 */
-                                     "\x30\x05" /* sequence len 5 */
-                                     "\x82\x03" /* entry len 3 */
-                                     ".fr"
-                                     "\x30\x05\x82\x03" /* sequence len 5, entry len 3 */
-                                     ".gp"
-                                     "\x30\x05\x82\x03"
-                                     ".gf"
-                                     "\x30\x05\x82\x03"
-                                     ".mq"
-                                     "\x30\x05\x82\x03"
-                                     ".re"
-                                     "\x30\x05\x82\x03"
-                                     ".yt"
-                                     "\x30\x05\x82\x03"
-                                     ".pm"
-                                     "\x30\x05\x82\x03"
-                                     ".bl"
-                                     "\x30\x05\x82\x03"
-                                     ".mf"
-                                     "\x30\x05\x82\x03"
-                                     ".wf"
-                                     "\x30\x05\x82\x03"
-                                     ".pf"
-                                     "\x30\x05\x82\x03"
-                                     ".nc"
-                                     "\x30\x05\x82\x03"
-                                     ".tf";
-
-  /* The stringified value for the subject is:
-     E=igca@sgdn.pm.gouv.fr,CN=IGC/A,OU=DCSSI,O=PM/SGDN,L=Paris,ST=France,C=FR
-   */
-  static const char rawANSSISubject[] =
-                                 "\x30\x81\x85\x31\x0B\x30\x09\x06\x03\x55\x04"
-                                 "\x06\x13\x02\x46\x52\x31\x0F\x30\x0D\x06\x03"
-                                 "\x55\x04\x08\x13\x06\x46\x72\x61\x6E\x63\x65"
-                                 "\x31\x0E\x30\x0C\x06\x03\x55\x04\x07\x13\x05"
-                                 "\x50\x61\x72\x69\x73\x31\x10\x30\x0E\x06\x03"
-                                 "\x55\x04\x0A\x13\x07\x50\x4D\x2F\x53\x47\x44"
-                                 "\x4E\x31\x0E\x30\x0C\x06\x03\x55\x04\x0B\x13"
-                                 "\x05\x44\x43\x53\x53\x49\x31\x0E\x30\x0C\x06"
-                                 "\x03\x55\x04\x03\x13\x05\x49\x47\x43\x2F\x41"
-                                 "\x31\x23\x30\x21\x06\x09\x2A\x86\x48\x86\xF7"
-                                 "\x0D\x01\x09\x01\x16\x14\x69\x67\x63\x61\x40"
-                                 "\x73\x67\x64\x6E\x2E\x70\x6D\x2E\x67\x6F\x75"
-                                 "\x76\x2E\x66\x72";
-
-  const SECItem ANSSI_SUBJECT = {
-    siBuffer,
-    reinterpret_cast<uint8_t *>(const_cast<char *>(rawANSSISubject)),
-    sizeof(rawANSSISubject) - 1
-  };
-
-  const SECItem PERMIT_FRANCE_GOV_NC = {
-    siBuffer,
-    reinterpret_cast<uint8_t *>(const_cast<char *>(constraintFranceGov)),
-    sizeof(constraintFranceGov) - 1
-  };
-
-  const SECItem* nameConstraintsToUse = cert.GetNameConstraints();
-
-  if (!nameConstraintsToUse) {
-    if (SECITEM_ItemsAreEqual(&cert.GetSubject(), &ANSSI_SUBJECT)) {
-      nameConstraintsToUse = &PERMIT_FRANCE_GOV_NC;
-    } else {
-      return Success;
-    }
-   }
-
   ScopedPtr<PLArenaPool, PORT_FreeArena_false>
     arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
   if (!arena) {
@@ -495,13 +424,12 @@ CheckNameConstraints(const BackCert& cert, KeyPurposeId requiredEKUIfPresent)
 
   // Owned by arena
   const CERTNameConstraints* constraints =
-    CERT_DecodeNameConstraintsExtension(arena.get(), nameConstraintsToUse);
+    CERT_DecodeNameConstraintsExtension(arena.get(), &encodedNameConstraints);
   if (!constraints) {
     return MapSECStatus(SECFailure);
   }
 
-  for (const BackCert* child = cert.childCert; child;
-       child = child->childCert) {
+  for (const BackCert* child = &firstChild; child; child = child->childCert) {
     ScopedPtr<CERTCertificate, CERT_DestroyCertificate>
       nssCert(CERT_NewTempCertificate(CERT_GetDefaultCertDB(),
                                       const_cast<SECItem*>(&child->GetDER()),
diff --git a/security/pkix/lib/pkixcheck.h b/security/pkix/lib/pkixcheck.h
index 5c17bd686b0f..7f60ddd9087e 100644
--- a/security/pkix/lib/pkixcheck.h
+++ b/security/pkix/lib/pkixcheck.h
@@ -41,7 +41,8 @@ Result CheckIssuerIndependentProperties(
           unsigned int subCACount,
           /*optional out*/ TrustLevel* trustLevel = nullptr);
 
-Result CheckNameConstraints(const BackCert& cert,
+Result CheckNameConstraints(const SECItem& encodedNameConstraints,
+                            const BackCert& firstChild,
                             KeyPurposeId requiredEKUIfPresent);
 
 } } // namespace mozilla::pkix
diff --git a/security/pkix/test/gtest/pkixbuild_tests.cpp b/security/pkix/test/gtest/pkixbuild_tests.cpp
index a8a9fccc99d2..e07865854b02 100644
--- a/security/pkix/test/gtest/pkixbuild_tests.cpp
+++ b/security/pkix/test/gtest/pkixbuild_tests.cpp
@@ -135,7 +135,9 @@ private:
       for (CERTCertListNode* n = CERT_LIST_HEAD(candidates);
            !CERT_LIST_END(n, candidates); n = CERT_LIST_NEXT(n)) {
         bool keepGoing;
-        SECStatus srv = checker.Check(n->cert->derCert, keepGoing);
+        SECStatus srv = checker.Check(n->cert->derCert,
+                                      nullptr/*additionalNameConstraints*/,
+                                      keepGoing);
         if (srv != SECSuccess) {
           return SECFailure;
         }
diff --git a/storage/src/mozStorageAsyncStatementParams.cpp b/storage/src/mozStorageAsyncStatementParams.cpp
index 882f1d062b51..f88063dc8d3f 100644
--- a/storage/src/mozStorageAsyncStatementParams.cpp
+++ b/storage/src/mozStorageAsyncStatementParams.cpp
@@ -7,6 +7,7 @@
 #include "nsMemory.h"
 #include "nsString.h"
 #include "nsCOMPtr.h"
+#include "nsJSUtils.h"
 
 #include "jsapi.h"
 
@@ -65,9 +66,12 @@ AsyncStatementParams::SetProperty(
   }
   else if (JSID_IS_STRING(aId)) {
     JSString *str = JSID_TO_STRING(aId);
-    size_t length;
-    const jschar *chars = JS_GetInternedStringCharsAndLength(str, &length);
-    NS_ConvertUTF16toUTF8 name(chars, length);
+    nsAutoJSString autoStr;
+    if (!autoStr.init(aCtx, str)) {
+      return NS_ERROR_FAILURE;
+    }
+
+    NS_ConvertUTF16toUTF8 name(autoStr);
 
     nsCOMPtr<nsIVariant> variant(convertJSValToVariant(aCtx, *_vp));
     NS_ENSURE_TRUE(variant, NS_ERROR_UNEXPECTED);
diff --git a/storage/src/mozStorageStatementParams.cpp b/storage/src/mozStorageStatementParams.cpp
index d661733323aa..3d1d2466acc5 100644
--- a/storage/src/mozStorageStatementParams.cpp
+++ b/storage/src/mozStorageStatementParams.cpp
@@ -4,6 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "nsJSUtils.h"
 #include "nsMemory.h"
 #include "nsString.h"
 
@@ -63,10 +64,12 @@ StatementParams::SetProperty(nsIXPConnectWrappedNative *aWrapper,
   }
   else if (JSID_IS_STRING(aId)) {
     JSString *str = JSID_TO_STRING(aId);
-    size_t length;
-    const jschar *chars = JS_GetStringCharsAndLength(aCtx, str, &length);
-    NS_ENSURE_TRUE(chars, NS_ERROR_UNEXPECTED);
-    NS_ConvertUTF16toUTF8 name(chars, length);
+    nsAutoJSString autoStr;
+    if (!autoStr.init(aCtx, str)) {
+      return NS_ERROR_FAILURE;
+    }
+
+    NS_ConvertUTF16toUTF8 name(autoStr);
 
     // check to see if there's a parameter with this name
     nsCOMPtr<nsIVariant> variant(convertJSValToVariant(aCtx, *_vp));
@@ -182,13 +185,14 @@ StatementParams::NewResolve(nsIXPConnectWrappedNative *aWrapper,
   }
   else if (JSID_IS_STRING(id)) {
     JSString *str = JSID_TO_STRING(id);
-    size_t nameLength;
-    const jschar *nameChars = JS_GetStringCharsAndLength(aCtx, str, &nameLength);
-    NS_ENSURE_TRUE(nameChars, NS_ERROR_UNEXPECTED);
+    nsAutoJSString autoStr;
+    if (!autoStr.init(aCtx, str)) {
+      return NS_ERROR_FAILURE;
+    }
 
     // Check to see if there's a parameter with this name, and if not, let
     // the rest of the prototype chain be checked.
-    NS_ConvertUTF16toUTF8 name(nameChars, nameLength);
+    NS_ConvertUTF16toUTF8 name(autoStr);
     uint32_t idx;
     nsresult rv = mStatement->GetParameterIndex(name, &idx);
     if (NS_SUCCEEDED(rv)) {
diff --git a/testing/crashtest/crashtests.list b/testing/crashtest/crashtests.list
index fcee7cbb82e3..67ec7f30c20f 100644
--- a/testing/crashtest/crashtests.list
+++ b/testing/crashtest/crashtests.list
@@ -60,6 +60,7 @@ include ../../gfx/tests/crashtests/crashtests.list
 include ../../image/test/crashtests/crashtests.list
 include ../../dom/plugins/test/crashtests/crashtests.list
 
+include ../../netwerk/test/crashtests/crashtests.list
 include ../../parser/htmlparser/tests/crashtests/crashtests.list
 
 include ../../security/manager/ssl/crashtests/crashtests.list
diff --git a/testing/mochitest/runtests.py b/testing/mochitest/runtests.py
index 7a4cc921922f..5db5d02d0641 100644
--- a/testing/mochitest/runtests.py
+++ b/testing/mochitest/runtests.py
@@ -1864,26 +1864,14 @@ class Mochitest(MochitestUtilsMixin):
     """
         Make the list of directories by parsing manifests
     """
-    info = {}
-    for k, v in mozinfo.info.items():
-      if isinstance(k, unicode):
-        k = k.encode('ascii')
-      info[k] = v
-
+    tests = self.getActiveTests(options, False)
     dirlist = []
 
-    manifest = self.getTestManifest(options)
-    tests = manifest.active_tests(disabled=False, options=options, **info)
     for test in tests:
-      pathAbs = os.path.abspath(test['path'])
-      assert pathAbs.startswith(self.testRootAbs)
-      tp = pathAbs[len(self.testRootAbs):].replace('\\', '/').strip('/')
-
-      rootdir = '/'.join(tp.split('/')[:-1])
+      rootdir = '/'.join(test['path'].split('/')[:-1])
       if rootdir not in dirlist:
         dirlist.append(rootdir)
 
-    dirlist.sort()
     return dirlist
 
 def main():
diff --git a/toolkit/components/places/History.cpp b/toolkit/components/places/History.cpp
index d58936e3d360..7fd88a94fa04 100644
--- a/toolkit/components/places/History.cpp
+++ b/toolkit/components/places/History.cpp
@@ -31,6 +31,7 @@
 #include "nsIXPConnect.h"
 #include "mozilla/unused.h"
 #include "nsContentUtils.h" // for nsAutoScriptBlocker
+#include "nsJSUtils.h"
 #include "mozilla/ipc/URIUtils.h"
 #include "nsPrintfCString.h"
 #include "nsTHashtable.h"
@@ -326,14 +327,10 @@ GetJSValueAsString(JSContext* aCtx,
     _string.Truncate();
     return;
   }
-  size_t length;
-  const jschar* chars =
-    JS_GetStringCharsZAndLength(aCtx, aValue.toString(), &length);
-  if (!chars) {
+
+  if (!AssignJSString(aCtx, _string, aValue.toString())) {
     _string.SetIsVoid(true);
-    return;
   }
-  _string.Assign(static_cast<const char16_t*>(chars), length);
 }
 
 /**
diff --git a/toolkit/components/printing/content/printUtils.js b/toolkit/components/printing/content/printUtils.js
index 6bd4acfdc9a9..5d68f5b62d57 100644
--- a/toolkit/components/printing/content/printUtils.js
+++ b/toolkit/components/printing/content/printUtils.js
@@ -1,3 +1,4 @@
+
 // -*- tab-width: 2; indent-tabs-mode: nil; js-indent-level: 2 -*-
 
 /* This Source Code Form is subject to the terms of the Mozilla Public
@@ -9,9 +10,23 @@ var gSavePrintSettings = false;
 var gFocusedElement = null;
 
 var PrintUtils = {
+  bailOut: function () {
+    let remote = window.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
+            .getInterface(Components.interfaces.nsIWebNavigation)
+            .QueryInterface(Components.interfaces.nsILoadContext)
+            .useRemoteTabs;
+    if (remote) {
+      alert("e10s printing is not implemented yet. Bug 927188.");
+      return true;
+    }
+    return false;
+  },
 
   showPageSetup: function ()
   {
+    if (this.bailOut()) {
+      return;
+    }
     try {
       var printSettings = this.getPrintSettings();
       var PRINTPROMPTSVC = Components.classes["@mozilla.org/embedcomp/printingprompt-service;1"]
@@ -32,6 +47,9 @@ var PrintUtils = {
 
   print: function (aWindow)
   {
+    if (this.bailOut()) {
+      return;
+    }
     var webBrowserPrint = this.getWebBrowserPrint(aWindow);
     var printSettings = this.getPrintSettings();
     try {
@@ -59,6 +77,9 @@ var PrintUtils = {
   // non-null aCallback and that object will be reused.
   printPreview: function (aCallback)
   {
+    if (this.bailOut()) {
+      return;
+    }
     // if we're already in PP mode, don't set the callback; chances
     // are it is null because someone is calling printPreview() to
     // get us to refresh the display.
diff --git a/toolkit/components/url-classifier/SafeBrowsing.jsm b/toolkit/components/url-classifier/SafeBrowsing.jsm
index 998e22116634..2449ae6c6a12 100644
--- a/toolkit/components/url-classifier/SafeBrowsing.jsm
+++ b/toolkit/components/url-classifier/SafeBrowsing.jsm
@@ -35,7 +35,8 @@ function log(...stuff) {
   if (!debug)
     return;
 
-  let msg = "SafeBrowsing: " + stuff.join(" ");
+  var d = new Date();
+  let msg = "SafeBrowsing: " + d.toTimeString() + ": " + stuff.join(" ");
   Services.console.logStringMessage(msg);
   dump(msg + "\n");
 }
@@ -49,6 +50,7 @@ this.SafeBrowsing = {
     }
 
     Services.prefs.addObserver("browser.safebrowsing", this.readPrefs.bind(this), false);
+    Services.prefs.addObserver("privacy.trackingprotection", this.readPrefs.bind(this), false);
     this.readPrefs();
 
     // Register our two types of tables, and add custom Mozilla entries
@@ -112,8 +114,9 @@ this.SafeBrowsing = {
     // XXX The listManager backend gets confused if this is called before the
     // lists are registered. So only call it here when a pref changes, and not
     // when doing initialization. I expect to refactor this later, so pardon the hack.
-    if (this.initialized)
+    if (this.initialized) {
       this.controlUpdateChecking();
+    }
   },
 
 
@@ -148,7 +151,8 @@ this.SafeBrowsing = {
   },
 
   controlUpdateChecking: function() {
-    log("phishingEnabled:", this.phishingEnabled, "malwareEnabled:", this.malwareEnabled);
+    log("phishingEnabled:", this.phishingEnabled, "malwareEnabled:",
+        this.malwareEnabled, "trackingEnabled:", this.trackingEnabled);
 
     let listManager = Cc["@mozilla.org/url-classifier/listmanager;1"].
                       getService(Ci.nsIUrlListManager);
@@ -188,6 +192,7 @@ this.SafeBrowsing = {
         listManager.disableUpdate(trackingProtectionLists[i]);
       }
     }
+    listManager.maybeToggleUpdateChecking();
   },
 
 
diff --git a/toolkit/components/url-classifier/content/listmanager.js b/toolkit/components/url-classifier/content/listmanager.js
index 1b85825ca7fa..0213b71eb4b5 100644
--- a/toolkit/components/url-classifier/content/listmanager.js
+++ b/toolkit/components/url-classifier/content/listmanager.js
@@ -2,6 +2,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+const Cu = Components.utils;
+Cu.import("resource://gre/modules/Services.jsm");
+
 // This is the only implementation of nsIUrlListManager.
 // A class that manages lists, namely white and black lists for
 // phishing or malware protection. The ListManager knows how to fetch,
@@ -13,13 +16,16 @@
 //      that the listmanagers tables are properly written on updates
 
 // Log only if browser.safebrowsing.debug is true
-var debug = false;
 function log(...stuff) {
+  var prefs_ = new G_Preferences();
+  var debug = prefs_.getPref("browser.safebrowsing.debug");
   if (!debug) {
     return;
   }
 
-  let msg = "listmanager: " + stuff.join(" ");
+  var d = new Date();
+  let msg = "listmanager: " + d.toTimeString() + ": " + stuff.join(" ");
+  Services.console.logStringMessage(msg);
   dump(msg + "\n");
 }
 
@@ -38,6 +44,7 @@ QueryAdapter.prototype.handleResponse = function(value) {
  * @constructor
  */
 function PROT_ListManager() {
+  log("Initializing list manager");
   this.prefs_ = new G_Preferences();
   this.updateInterval = this.prefs_.getPref("urlclassifier.updateinterval", 30 * 60) * 1000;
 
@@ -62,7 +69,6 @@ function PROT_ListManager() {
 
   this.hashCompleter_ = Cc["@mozilla.org/url-classifier/hashcompleter;1"]
                         .getService(Ci.nsIUrlClassifierHashCompleter);
-  debug = this.prefs_.getPref("browser.safebrowsing.debug");
 }
 
 /**
@@ -127,16 +133,10 @@ PROT_ListManager.prototype.getGethashUrl = function(tableName) {
  * @param tables - an array of table names that need updating
  */
 PROT_ListManager.prototype.enableUpdate = function(tableName) {
-  var changed = false;
   var table = this.tablesData[tableName];
   if (table) {
     log("Enabling table updates for " + tableName);
     this.needsUpdate_[table.updateUrl][tableName] = true;
-    changed = true;
-  }
-
-  if (changed) {
-    this.maybeToggleUpdateChecking();
   }
 }
 
@@ -152,10 +152,6 @@ PROT_ListManager.prototype.disableUpdate = function(tableName) {
     this.needsUpdate_[table.updateUrl][tableName] = false;
     changed = true;
   }
-
-  if (changed) {
-    this.maybeToggleUpdateChecking();
-  }
 }
 
 /**
@@ -192,19 +188,22 @@ PROT_ListManager.prototype.kickoffUpdate_ = function (onDiskTableData)
 
   // If the user has never downloaded tables, do the check now.
   log("needsUpdate: " + JSON.stringify(this.needsUpdate_, undefined, 2));
-  for (var url in this.needsUpdate_) {
+  for (var updateUrl in this.needsUpdate_) {
     // If the user has tables, add a fuzz of a few minutes.
     if (updatingExisting) {
       // Add a fuzz of 0-5 minutes.
       initialUpdateDelay += Math.floor(Math.random() * (5 * 60 * 1000));
+      log("Waiting " + initialUpdateDelay / 1000 +
+          " for updating existing table from " + updateUrl);
     }
     // If we haven't already kicked off updates for this updateUrl, set a
-    // repeating timer for it. The delay will be reset either on updateSuccess
-    // to this.updateinterval, or backed off on downloadError.
-    if (!this.updateCheckers_[url]) {
-      this.updateCheckers_[url] =
-        new G_Alarm(BindToObject(this.checkForUpdates, this, url),
-                    initialUpdateDelay, true /* repeating */);
+    // non-repeating timer for it. The timer delay will be reset either on
+    // updateSuccess to this.updateinterval, or backed off on downloadError.
+    if (!this.updateCheckers_[updateUrl]) {
+      log("Initializing update checker for " + updateUrl);
+      this.updateCheckers_[updateUrl] =
+        new G_Alarm(BindToObject(this.checkForUpdates, this, updateUrl),
+                    initialUpdateDelay, false /* repeating */);
     }
   }
 }
@@ -220,7 +219,7 @@ PROT_ListManager.prototype.stopUpdateCheckers = function() {
 /**
  * Determine if we have any tables that require updating.  Different
  * Wardens may call us with new tables that need to be updated.
- */ 
+ */
 PROT_ListManager.prototype.maybeToggleUpdateChecking = function() {
   // We update tables if we have some tables that want updates.  If there
   // are no tables that want to be updated - we dont need to check anything.
@@ -278,6 +277,7 @@ PROT_ListManager.prototype.checkForUpdates = function(updateUrl) {
   }
   if (!this.requestBackoffs_[updateUrl] ||
       !this.requestBackoffs_[updateUrl].canMakeRequest()) {
+    log("Can't make update request");
     return false;
   }
   // Grab the current state of the tables from the database
@@ -338,17 +338,20 @@ PROT_ListManager.prototype.makeUpdateRequest_ = function(updateUrl, tableData) {
 
   log("update request: " + JSON.stringify(streamerMap, undefined, 2) + "\n");
 
-  if (Object.keys(streamerMap.tableNames).length > 0) {
+  // Don't send an empty request.
+  if (streamerMap.request.length > 0) {
     this.makeUpdateRequestForEntry_(updateUrl, streamerMap.tableList,
                                     streamerMap.request);
+  } else {
+    log("Not sending empty request");
   }
 }
 
 PROT_ListManager.prototype.makeUpdateRequestForEntry_ = function(updateUrl,
                                                                  tableList,
                                                                  request) {
-  log("makeUpdateRequestForEntry_: request " + request + " update: " +
-      updateUrl + " tablelist: " + tableList + "\n");
+  log("makeUpdateRequestForEntry_: request " + request +
+      " update: " + updateUrl + " tablelist: " + tableList + "\n");
   var streamer = Cc["@mozilla.org/url-classifier/streamupdater;1"]
                  .getService(Ci.nsIUrlClassifierStreamUpdater);
 
@@ -361,7 +364,8 @@ PROT_ListManager.prototype.makeUpdateRequestForEntry_ = function(updateUrl,
         BindToObject(this.updateSuccess_, this, tableList, updateUrl),
         BindToObject(this.updateError_, this, tableList, updateUrl),
         BindToObject(this.downloadError_, this, tableList, updateUrl))) {
-    log("pending update, wait until later");
+    // Our alarm gets reset in one of the 3 callbacks.
+    log("pending update, queued request until later");
   }
 }
 
@@ -374,19 +378,23 @@ PROT_ListManager.prototype.updateSuccess_ = function(tableList, updateUrl,
                                                      waitForUpdate) {
   log("update success for " + tableList + " from " + updateUrl + ": " +
       waitForUpdate + "\n");
+  var delay;
   if (waitForUpdate) {
-    var delay = parseInt(waitForUpdate, 10);
-    // As long as the delay is something sane (5 minutes or more), update
-    // our delay time for requesting updates. Setting the delay requires a
-    // repeating timer, so always use one.
-    if (delay >= (5 * 60) && this.updateCheckers_[updateUrl]) {
-      log("Waiting " + delay);
-      this.updateCheckers_[updateUrl].setDelay(delay * 1000);
-    } else {
-      log("Ignoring delay from server, waiting " + this.updateInterval);
-      this.updateCheckers_[updateUrl].setDelay(this.updateInterval);
-    }
+    delay = parseInt(waitForUpdate, 10);
   }
+  // As long as the delay is something sane (5 minutes or more), update
+  // our delay time for requesting updates. We always use a non-repeating
+  // timer since the delay is set differently at every callback.
+  if (delay >= (5 * 60)) {
+    log("Waiting " + delay + " seconds");
+    delay = delay * 1000;
+  } else {
+    log("Ignoring delay from server, waiting " + this.updateInterval / 1000);
+    delay = this.updateInterval;
+  }
+  this.updateCheckers_[updateUrl] =
+    new G_Alarm(BindToObject(this.checkForUpdates, this, updateUrl),
+                delay, false);
 
   // Let the backoff object know that we completed successfully.
   this.requestBackoffs_[updateUrl].noteServerResponse(200);
@@ -398,7 +406,11 @@ PROT_ListManager.prototype.updateSuccess_ = function(tableList, updateUrl,
  */
 PROT_ListManager.prototype.updateError_ = function(table, updateUrl, result) {
   log("update error for " + table + " from " + updateUrl + ": " + result + "\n");
-  // XXX: there was some trouble applying the updates.
+  // There was some trouble applying the updates. Don't try again for at least
+  // updateInterval seconds.
+  this.updateCheckers_[updateUrl] =
+    new G_Alarm(BindToObject(this.checkForUpdates, this, updateUrl),
+                this.updateInterval, false);
 }
 
 /**
@@ -414,11 +426,17 @@ PROT_ListManager.prototype.downloadError_ = function(table, updateUrl, status) {
   }
   status = parseInt(status, 10);
   this.requestBackoffs_[updateUrl].noteServerResponse(status);
+  var delay = this.updateInterval;
   if (this.requestBackoffs_[updateUrl].isErrorStatus(status)) {
     // Schedule an update for when our backoff is complete
-    this.updateCheckers_[updateUrl].setDelay(
-      this.requestBackoffs_[updateUrl].nextRequestDelay());
+    delay = this.requestBackoffs_[updateUrl].nextRequestDelay();
+  } else {
+    log("Got non error status for error callback?!");
   }
+  this.updateCheckers_[updateUrl] =
+    new G_Alarm(BindToObject(this.checkForUpdates, this, updateUrl),
+                delay, false);
+
 }
 
 PROT_ListManager.prototype.QueryInterface = function(iid) {
diff --git a/toolkit/components/url-classifier/nsIUrlListManager.idl b/toolkit/components/url-classifier/nsIUrlListManager.idl
index 97c279b2ac34..3c5beb6a24ef 100644
--- a/toolkit/components/url-classifier/nsIUrlListManager.idl
+++ b/toolkit/components/url-classifier/nsIUrlListManager.idl
@@ -18,7 +18,7 @@ interface nsIUrlListManagerCallback : nsISupports {
 };
 
 
-[scriptable, uuid(653afdc4-ad4e-4ee0-8375-c576e85ebc40)]
+[scriptable, uuid(5d5ed98f-72cd-46b6-a9fe-76418adfdfeb)]
 interface nsIUrlListManager : nsISupports
 {
     /**
@@ -50,6 +50,11 @@ interface nsIUrlListManager : nsISupports
      */
     void disableUpdate(in ACString tableName);
 
+    /**
+     * Toggle update checking, if necessary.
+     */
+    void maybeToggleUpdateChecking();
+
     /**
      * Lookup a key.  Should not raise exceptions.  Calls the callback
      * function with a comma-separated list of tables to which the key
diff --git a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
index 11f17ba15060..8d3214fc57b6 100644
--- a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
@@ -397,6 +397,7 @@ nsUrlClassifierDBServiceWorker::GetTables(nsIUrlClassifierCallback* c)
 
   nsAutoCString response;
   mClassifier->TableRequest(response);
+  LOG(("GetTables: %s", response.get()));
   c->HandleEvent(response);
 
   return rv;
diff --git a/toolkit/content/tests/chrome/test_autocomplete4.xul b/toolkit/content/tests/chrome/test_autocomplete4.xul
index cbd2adf7cab4..db520331807b 100644
--- a/toolkit/content/tests/chrome/test_autocomplete4.xul
+++ b/toolkit/content/tests/chrome/test_autocomplete4.xul
@@ -13,6 +13,7 @@
 <textbox id="autocomplete"
          type="autocomplete"
          completedefaultindex="true"
+
          onsearchcomplete="searchComplete();"
          autocompletesearch="simple"/>
 
@@ -143,6 +144,13 @@ const tests = [
     result: "Result",
     start: 6, end: 6
   },
+  { desc: "TAB key should confirm suggestion when forcecomplete is set",
+    key: "VK_TAB",
+    removeSelection: false,
+    forceComplete: true,
+    result: "Result",
+    start: 6, end: 6
+  },
 ];
 
 function nextTest() {
@@ -181,6 +189,8 @@ function searchComplete() {
   is(autocomplete.value, "result",
      "Test '" + currentTest.desc + "': autocomplete.value should equal 'result'");
 
+  autocomplete.setAttribute("forcecomplete", currentTest.forceComplete ? true : false);
+
   if (autocomplete.selectionStart == 2) {  // Finished inserting "re" string.
     if (currentTest.removeSelection) {
       // remove current selection
diff --git a/toolkit/content/widgets/autocomplete.xml b/toolkit/content/widgets/autocomplete.xml
index d12c55b92487..c88b6d30a802 100644
--- a/toolkit/content/widgets/autocomplete.xml
+++ b/toolkit/content/widgets/autocomplete.xml
@@ -464,6 +464,8 @@
                   cancel = this.mController.handleKeyNavigation(aEvent.shiftKey ?
                                                                 KeyEvent.DOM_VK_UP :
                                                                 KeyEvent.DOM_VK_DOWN);
+                else if (this.forceComplete && this.mController.matchCount >= 1)
+                  this.mController.handleTab();
                 break;
               case KeyEvent.DOM_VK_UP:
               case KeyEvent.DOM_VK_DOWN:
diff --git a/toolkit/content/widgets/textbox.xml b/toolkit/content/widgets/textbox.xml
index 4d4d9c25ce12..c6bff267d784 100644
--- a/toolkit/content/widgets/textbox.xml
+++ b/toolkit/content/widgets/textbox.xml
@@ -171,6 +171,9 @@
 
       <destructor>
         <![CDATA[
+          // Touch a non-existent property on our anonymous input field. This
+          // serves as test coverage for bug 1034682.
+          this.inputField.foo;
           if (this.inputField.value)
             this.boxObject.setProperty('value', this.inputField.value);
           this.mInputField = null;
diff --git a/toolkit/webapps/moz.build b/toolkit/webapps/moz.build
index a8b7e824e024..69fb0356bba2 100644
--- a/toolkit/webapps/moz.build
+++ b/toolkit/webapps/moz.build
@@ -9,7 +9,7 @@ EXTRA_PP_JS_MODULES += [
     'WebappOSUtils.jsm',
 ]
 
-MOCHITEST_CHROME_MANIFESTS += ['tests/chrome.ini']
+TEST_DIRS += ['tests']
 
 if CONFIG['MOZ_BUILD_APP'] == 'mobile/android':
     DEFINES['MOZ_FENNEC'] = True
diff --git a/toolkit/webapps/tests/Makefile.in b/toolkit/webapps/tests/Makefile.in
new file mode 100644
index 000000000000..4cc7f8191209
--- /dev/null
+++ b/toolkit/webapps/tests/Makefile.in
@@ -0,0 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+PROGRAMS_DEST = $(DEPTH)/_tests/testing/mochitest/chrome/$(relativesrcdir)
+
+include $(topsrcdir)/config/rules.mk
diff --git a/toolkit/webapps/tests/TestWebappRT.cpp b/toolkit/webapps/tests/TestWebappRT.cpp
new file mode 100644
index 000000000000..bc1c0dd768e6
--- /dev/null
+++ b/toolkit/webapps/tests/TestWebappRT.cpp
@@ -0,0 +1,7 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+int main(int argc, char *argv[]) {
+  return 42;
+}
diff --git a/toolkit/webapps/tests/app.sjs b/toolkit/webapps/tests/app.sjs
index 6b07fe54dfd7..3a8c0a66a6f3 100644
--- a/toolkit/webapps/tests/app.sjs
+++ b/toolkit/webapps/tests/app.sjs
@@ -1,3 +1,10 @@
+var Cc = Components.classes;
+var Ci = Components.interfaces;
+var Cu = Components.utils;
+
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/NetUtil.jsm");
+
 function getQuery(request) {
   let query = {};
 
@@ -9,6 +16,68 @@ function getQuery(request) {
   return query;
 }
 
+function getTestFile(aName) {
+  var file = Services.dirsvc.get("CurWorkD", Ci.nsIFile);
+
+  var path = "chrome/toolkit/webapps/tests/data/app/" + aName;
+
+  path.split("/").forEach(function(component) {
+    file.append(component);
+  });
+
+  return file;
+}
+
+function readFile(aFile) {
+  var fstream = Cc["@mozilla.org/network/file-input-stream;1"].
+                createInstance(Ci.nsIFileInputStream);
+  fstream.init(aFile, -1, 0, 0);
+  var data = NetUtil.readInputStreamToString(fstream, fstream.available());
+  fstream.close();
+  return data;
+}
+
+function getHostedManifest(aVersion) {
+  return readFile(getTestFile("hosted_manifest.webapp")).
+           replace(/VERSION_TOKEN/g, aVersion);
+}
+
+function getManifest(aVersion) {
+  return readFile(getTestFile("manifest.webapp")).
+           replace(/VERSION_TOKEN/g, aVersion);
+}
+
+function buildAppPackage(aVersion) {
+  const PR_RDWR        = 0x04;
+  const PR_CREATE_FILE = 0x08;
+  const PR_TRUNCATE    = 0x20;
+
+  let zipFile = Services.dirsvc.get("TmpD", Ci.nsIFile);
+  zipFile.append("application.zip");
+
+  let zipWriter = Cc["@mozilla.org/zipwriter;1"].createInstance(Ci.nsIZipWriter);
+  zipWriter.open(zipFile, PR_RDWR | PR_CREATE_FILE | PR_TRUNCATE);
+
+  // Add index.html file to the zip file
+  zipWriter.addEntryFile("index.html",
+                         Ci.nsIZipWriter.COMPRESSION_NONE,
+                         getTestFile("index.html"),
+                         false);
+
+  // Add manifest to the zip file
+  var manStream = Cc["@mozilla.org/io/string-input-stream;1"].
+                  createInstance(Ci.nsIStringInputStream);
+  var manifest = getManifest(aVersion);
+  manStream.setData(manifest, manifest.length);
+  zipWriter.addEntryStream("manifest.webapp", Date.now(),
+                           Ci.nsIZipWriter.COMPRESSION_NONE,
+                           manStream, false);
+
+  zipWriter.close();
+
+  return readFile(zipFile);
+}
+
 function handleRequest(request, response) {
   response.setHeader("Cache-Control", "no-cache", false);
 
@@ -30,4 +99,53 @@ function handleRequest(request, response) {
 
     return;
   }
+
+  if ("setVersion" in query) {
+    setState("version", query.setVersion);
+    response.write("OK");
+    return;
+  }
+  var version = Number(getState("version"));
+
+  if ("getPackage" in query) {
+    response.setHeader("Content-Type", "application/zip", false);
+    response.write(buildAppPackage(version));
+
+    var getPackageQueries = Number(getState("getPackageQueries"));
+    setState("getPackageQueries", String(++getPackageQueries));
+
+    return;
+  }
+
+  if ("getPackageQueries" in query) {
+    response.setHeader("Content-Type", "text/plain", false);
+    response.write(String(Number(getState("getPackageQueries"))));
+    return;
+  }
+
+  if ("getManifest" in query) {
+    response.setHeader("Content-Type", "application/x-web-app-manifest+json", false);
+    response.write(getManifest(version));
+
+    var getManifestQueries = Number(getState("getManifestQueries"));
+    setState("getManifestQueries", String(++getManifestQueries));
+
+    return;
+  }
+
+  if ("getHostedManifest" in query) {
+    response.setHeader("Content-Type", "application/x-web-app-manifest+json", false);
+    response.write(getHostedManifest(version));
+
+    var getManifestQueries = Number(getState("getManifestQueries"));
+    setState("getManifestQueries", String(++getManifestQueries));
+
+    return;
+  }
+
+  if ("getManifestQueries" in query) {
+    response.setHeader("Content-Type", "text/plain", false);
+    response.write(String(Number(getState("getManifestQueries"))));
+    return;
+  }
 }
diff --git a/toolkit/webapps/tests/chrome.ini b/toolkit/webapps/tests/chrome.ini
index 288dd77c97f4..2ec622fa2ad7 100644
--- a/toolkit/webapps/tests/chrome.ini
+++ b/toolkit/webapps/tests/chrome.ini
@@ -28,4 +28,9 @@ skip-if = asan
 [test_packaged_update_from_webapp_runtime.xul]
 skip-if = asan
 [test_hosted_icons.xul]
+[test_hosted_checkforupdates_from_webapp_runtime.xul]
+skip-if = asan
 [test_packaged_icons.xul]
+[test_packaged_checkforupdates_from_webapp_runtime.xul]
+skip-if = asan
+[test_webapp_runtime_executable_update.xul]
diff --git a/toolkit/webapps/tests/data/app/hosted_manifest.webapp b/toolkit/webapps/tests/data/app/hosted_manifest.webapp
new file mode 100644
index 000000000000..614692710cea
--- /dev/null
+++ b/toolkit/webapps/tests/data/app/hosted_manifest.webapp
@@ -0,0 +1,11 @@
+{
+  "name" : "Test app",
+  "version" : "VERSION_TOKEN",
+  "description": "Test app",
+  "launch_path": "/chrome/toolkit/webapps/tests/app.sjs?appreq",
+  "developer": {
+    "name": "marco",
+    "url": "http://www.example.com/"
+  },
+  "default_locale": "en-US"
+}
diff --git a/toolkit/webapps/tests/data/app/manifest.webapp b/toolkit/webapps/tests/data/app/manifest.webapp
new file mode 100644
index 000000000000..486509e4988e
--- /dev/null
+++ b/toolkit/webapps/tests/data/app/manifest.webapp
@@ -0,0 +1,12 @@
+{
+  "name" : "Test app",
+  "version" : "VERSION_TOKEN",
+  "package_path": "app.sjs?getPackage=true",
+  "description": "Test app",
+  "launch_path": "/index.html",
+  "developer": {
+    "name": "marco",
+    "url": "http://www.example.com/"
+  },
+  "default_locale": "en-US"
+}
diff --git a/toolkit/webapps/tests/head.js b/toolkit/webapps/tests/head.js
index 42296983fabc..0f5a1c99d7ba 100644
--- a/toolkit/webapps/tests/head.js
+++ b/toolkit/webapps/tests/head.js
@@ -1,8 +1,9 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+const { classes: Cc, interfaces: Ci, utils: Cu, results: Cr } = Components;
 
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/osfile.jsm");
 Cu.import("resource://gre/modules/Task.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
@@ -155,6 +156,8 @@ function TestAppInfo(aApp, aIsPackaged) {
 
     this.iconFile = OS.Path.join(this.installPath, "icon.png");
 
+    this.webappINI = OS.Path.join(this.installPath, "webapp.ini");
+
     let xdg_data_home = Cc["@mozilla.org/process/environment;1"].
                         getService(Ci.nsIEnvironment).
                         get("XDG_DATA_HOME");
@@ -167,7 +170,7 @@ function TestAppInfo(aApp, aIsPackaged) {
 
     this.installedFiles = [
       OS.Path.join(this.installPath, "webapp.json"),
-      OS.Path.join(this.installPath, "webapp.ini"),
+      this.webappINI,
       this.iconFile,
       this.exePath,
       desktopINI,
@@ -179,7 +182,7 @@ function TestAppInfo(aApp, aIsPackaged) {
     ];
     this.updatedFiles = [
       OS.Path.join(this.installPath, "webapp.json"),
-      OS.Path.join(this.installPath, "webapp.ini"),
+      this.webappINI,
       this.iconFile,
       desktopINI,
     ];
@@ -215,6 +218,8 @@ function TestAppInfo(aApp, aIsPackaged) {
 
     this.iconFile = OS.Path.join(this.installPath, "chrome", "icons", "default", "default.ico");
 
+    this.webappINI = OS.Path.join(this.installPath, "webapp.ini");
+
     let desktopShortcut = OS.Path.join(OS.Constants.Path.desktopDir,
                                        aApp.name + ".lnk");
     let startMenuShortcut = OS.Path.join(OS.Constants.Path.winStartMenuProgsDir,
@@ -222,7 +227,7 @@ function TestAppInfo(aApp, aIsPackaged) {
 
     this.installedFiles = [
       OS.Path.join(this.installPath, "webapp.json"),
-      OS.Path.join(this.installPath, "webapp.ini"),
+      this.webappINI,
       OS.Path.join(this.installPath, "uninstall", "shortcuts_log.ini"),
       OS.Path.join(this.installPath, "uninstall", "uninstall.log"),
       OS.Path.join(this.installPath, "uninstall", "webapp-uninstaller.exe"),
@@ -241,7 +246,7 @@ function TestAppInfo(aApp, aIsPackaged) {
     ];
     this.updatedFiles = [
       OS.Path.join(this.installPath, "webapp.json"),
-      OS.Path.join(this.installPath, "webapp.ini"),
+      this.webappINI,
       OS.Path.join(this.installPath, "uninstall", "shortcuts_log.ini"),
       OS.Path.join(this.installPath, "uninstall", "uninstall.log"),
       this.iconFile,
@@ -312,13 +317,15 @@ function TestAppInfo(aApp, aIsPackaged) {
 
     this.iconFile = OS.Path.join(this.installPath, "Contents", "Resources", "appicon.icns");
 
+    this.webappINI = OS.Path.join(this.installPath, "Contents", "MacOS", "webapp.ini");
+
     let appProfileDir = OS.Path.join(OS.Constants.Path.macUserLibDir,
                                      "Application Support",
                                      this.uniqueName);
 
     this.installedFiles = [
       OS.Path.join(this.installPath, "Contents", "Info.plist"),
-      OS.Path.join(this.installPath, "Contents", "MacOS", "webapp.ini"),
+      this.webappINI,
       OS.Path.join(appProfileDir, "webapp.json"),
       this.iconFile,
       this.exePath,
@@ -331,7 +338,7 @@ function TestAppInfo(aApp, aIsPackaged) {
     ];
     this.updatedFiles = [
       OS.Path.join(this.installPath, "Contents", "Info.plist"),
-      OS.Path.join(this.installPath, "Contents", "MacOS", "webapp.ini"),
+      this.webappINI,
       OS.Path.join(appProfileDir, "webapp.json"),
       this.iconFile,
     ];
@@ -444,25 +451,40 @@ function buildAppPackage(aManifest, aIconFile) {
   return zipFile.path;
 }
 
-function wasAppSJSAccessed() {
+function xhrRequest(aQueryString) {
   let deferred = Promise.defer();
 
   var xhr = new XMLHttpRequest();
 
   xhr.addEventListener("load", function() {
-    let ret = (xhr.responseText == "done") ? true : false;
-    deferred.resolve(ret);
+    deferred.resolve(xhr.responseText);
   });
 
   xhr.addEventListener("error", aError => deferred.reject(aError));
   xhr.addEventListener("abort", aError => deferred.reject(aError));
 
-  xhr.open('GET', 'http://test/chrome/toolkit/webapps/tests/app.sjs?testreq', true);
+  xhr.open('GET', 'http://test/chrome/toolkit/webapps/tests/app.sjs' + aQueryString, true);
   xhr.send();
 
   return deferred.promise;
 }
 
+function wasAppSJSAccessed() {
+  return xhrRequest('?testreq').then((aResponseText) => {
+    return (aResponseText == 'done') ? true : false;
+  });
+}
+
+function setState(aVar, aState) {
+  return xhrRequest('?set' + aVar + '=' + aState).then((aResponseText) => {
+    is(aResponseText, "OK", "set" + aVar + " OK");
+  });
+}
+
+function getState(aVar) {
+  return xhrRequest('?get' + aVar);
+}
+
 function generateDataURI(aFile) {
   var contentType = Cc["@mozilla.org/mime;1"].
                     getService(Ci.nsIMIMEService).
@@ -511,3 +533,56 @@ let setMacRootInstallDir = Task.async(function*(aPath) {
     NativeApp.prototype._rootInstallDir = oldRootInstallDir;
   });
 });
+
+let writeToFile = Task.async(function*(aPath, aData) {
+  let data = new TextEncoder().encode(aData);
+
+  let file;
+  try {
+    file = yield OS.File.open(aPath, { truncate: true, write: true }, { unixMode: 0o777 });
+    yield file.write(data);
+  } finally {
+    yield file.close();
+  }
+});
+
+// We need to mock the Alerts service, otherwise the alert that is shown
+// at the end of an installation makes the test leak the app's icon.
+
+const CID = Cc["@mozilla.org/uuid-generator;1"].getService(Ci.nsIUUIDGenerator).generateUUID();
+const ALERTS_SERVICE_CONTRACT_ID = "@mozilla.org/alerts-service;1";
+const ALERTS_SERVICE_CID = Components.ID(Cc[ALERTS_SERVICE_CONTRACT_ID].number);
+
+let AlertsService = {
+  classID: Components.ID(CID),
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIFactory,
+                                         Ci.nsIAlertsService]),
+
+  createInstance: function(aOuter, aIID) {
+    if (aOuter) {
+      throw Cr.NS_ERROR_NO_AGGREGATION;
+    }
+
+    return this.QueryInterface(aIID);
+  },
+
+  init: function() {
+    Components.manager.nsIComponentRegistrar.registerFactory(this.classID,
+      "", ALERTS_SERVICE_CONTRACT_ID, this);
+  },
+
+  restore: function() {
+    Components.manager.nsIComponentRegistrar.registerFactory(ALERTS_SERVICE_CID,
+      "", ALERTS_SERVICE_CONTRACT_ID, null);
+  },
+
+  showAlertNotification: function() {
+  },
+};
+
+AlertsService.init();
+
+SimpleTest.registerCleanupFunction(() => {
+  AlertsService.restore();
+});
diff --git a/toolkit/webapps/tests/moz.build b/toolkit/webapps/tests/moz.build
new file mode 100644
index 000000000000..b39ce28c6f84
--- /dev/null
+++ b/toolkit/webapps/tests/moz.build
@@ -0,0 +1,9 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+MOCHITEST_CHROME_MANIFESTS += ['chrome.ini']
+SOURCES += ['TestWebappRT.cpp' ]
+SIMPLE_PROGRAMS += ['TestWebappRT']
diff --git a/toolkit/webapps/tests/test_hosted_checkforupdates_from_webapp_runtime.xul b/toolkit/webapps/tests/test_hosted_checkforupdates_from_webapp_runtime.xul
new file mode 100644
index 000000000000..43189a9a79ec
--- /dev/null
+++ b/toolkit/webapps/tests/test_hosted_checkforupdates_from_webapp_runtime.xul
@@ -0,0 +1,115 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1036717
+-->
+<window title="Mozilla Bug 1036717"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/chrome-harness.js"></script>
+  <script type="application/javascript" src="head.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1036717"
+     target="_blank">Mozilla Bug 1036717</a>
+  </body>
+
+<script type="application/javascript">
+<![CDATA[
+
+/** Test for Bug 1036717 **/
+
+"use strict";
+
+SimpleTest.waitForExplicitFinish();
+
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/NativeApp.jsm");
+Cu.import("resource://gre/modules/WebappOSUtils.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+
+let runTest = Task.async(function*() {
+  let manifest = yield readJSON(getTestFilePath("data/app/hosted_manifest.webapp"));
+
+  let app = {
+    name: manifest.name,
+    manifestURL: "http://127.0.0.1:8888/chrome/toolkit/webapps/tests/app.sjs?getHostedManifest=true",
+    origin: "http://127.0.0.1:8888",
+  };
+
+  let testAppInfo = new TestAppInfo(app, true);
+
+  // Get to a clean state before the test
+  yield testAppInfo.cleanup();
+
+  SimpleTest.registerCleanupFunction(() => testAppInfo.cleanup());
+
+  setDryRunPref();
+
+  // On Mac build servers, we don't have enough privileges to write to /Applications,
+  // so we install apps in a user-owned directory.
+  if (MAC) {
+    yield setMacRootInstallDir(OS.Path.join(OS.Constants.Path.homeDir, "Applications"));
+  }
+
+  confirmNextInstall();
+
+  yield setState("Version", 1);
+
+  let request = navigator.mozApps.install(app.manifestURL);
+
+  let (deferred = Promise.defer()) {
+    request.onerror = function() {
+      deferred.reject(this.error.name);
+    };
+    request.onsuccess = deferred.resolve;
+    yield deferred.promise;
+  }
+
+  let appObject = request.result;
+  ok(appObject, "app is non-null");
+
+  while (!WebappOSUtils.isLaunchable(app)) {
+    yield wait(1000);
+  }
+  ok(true, "App launchable");
+
+  // Force the update timer to fire in 1 second
+  let prefsFile = OS.Path.join(testAppInfo.profileDir.path, "prefs.js");
+  yield writeToFile(prefsFile, "user_pref(\"webapprt.app_update_interval\", 1);");
+
+  // Update app version
+  yield setState("Version", 2);
+
+  // Launch the webapprt executable that will verify the presence of an update
+  let exeFile = getFile(testAppInfo.exePath);
+
+  let appClosed = false;
+
+  testAppInfo.appProcess.init(exeFile)
+  testAppInfo.appProcess.runAsync([], 0, () => appClosed = true);
+
+  // If there was a second request to get the manifest, then the webapprt
+  // has searched for an update.
+  while (Number(yield getState("ManifestQueries")) < 2 &&
+         !appClosed) {
+    yield wait(1000);
+  }
+  ok(!appClosed, "App was launched and is still running");
+  ok(Number(yield getState("ManifestQueries")) >= 2, "Two manifest requests");
+
+  SimpleTest.finish();
+});
+
+runTest().catch((e) => {
+  ok(false, "Error during test: " + e);
+  SimpleTest.finish();
+});
+
+]]>
+</script>
+</window>
diff --git a/toolkit/webapps/tests/test_packaged_checkforupdates_from_webapp_runtime.xul b/toolkit/webapps/tests/test_packaged_checkforupdates_from_webapp_runtime.xul
new file mode 100644
index 000000000000..8c9429814210
--- /dev/null
+++ b/toolkit/webapps/tests/test_packaged_checkforupdates_from_webapp_runtime.xul
@@ -0,0 +1,126 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1036717
+-->
+<window title="Mozilla Bug 1036717"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/chrome-harness.js"></script>
+  <script type="application/javascript" src="head.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1036717"
+     target="_blank">Mozilla Bug 1036717</a>
+  </body>
+
+<script type="application/javascript">
+<![CDATA[
+
+/** Test for Bug 1036717 **/
+
+"use strict";
+
+SimpleTest.waitForExplicitFinish();
+
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/NativeApp.jsm");
+Cu.import("resource://gre/modules/WebappOSUtils.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+
+let runTest = Task.async(function*() {
+  let manifest = yield readJSON(getTestFilePath("data/app/manifest.webapp"));
+
+  let app = {
+    name: manifest.name,
+    manifestURL: "http://127.0.0.1:8888/chrome/toolkit/webapps/tests/app.sjs?getManifest=true",
+    origin: "app://test.app",
+  };
+
+  let testAppInfo = new TestAppInfo(app, true);
+
+  // Get to a clean state before the test
+  yield testAppInfo.cleanup();
+
+  SimpleTest.registerCleanupFunction(() => testAppInfo.cleanup());
+
+  setDryRunPref();
+
+  // On Mac build servers, we don't have enough privileges to write to /Applications,
+  // so we install apps in a user-owned directory.
+  if (MAC) {
+    yield setMacRootInstallDir(OS.Path.join(OS.Constants.Path.homeDir, "Applications"));
+  }
+
+  confirmNextInstall();
+
+  yield setState("Version", 1);
+
+  let request = navigator.mozApps.installPackage(app.manifestURL);
+
+  let (deferred = Promise.defer()) {
+    request.onerror = function() {
+      deferred.reject(this.error.name);
+    };
+    request.onsuccess = deferred.resolve;
+    yield deferred.promise;
+  }
+
+  let appObject = request.result;
+  ok(appObject, "app is non-null");
+
+  let (deferred = Promise.defer()) {
+    appObject.ondownloaderror = function() {
+      deferred.reject(appObject.downloadError.name);
+    };
+    appObject.ondownloadapplied = deferred.resolve;
+    yield deferred.promise;
+  };
+
+  while (!WebappOSUtils.isLaunchable(app)) {
+    yield wait(1000);
+  }
+  ok(true, "App launchable");
+
+  // Force the update timer to fire in 1 second
+  let prefsFile = OS.Path.join(testAppInfo.profileDir.path, "prefs.js");
+  yield writeToFile(prefsFile, "user_pref(\"webapprt.app_update_interval\", 1);");
+
+  // Update app version
+  yield setState("Version", 2);
+
+  // Launch the webapprt executable that will verify the presence of an update
+  let exeFile = getFile(testAppInfo.exePath);
+
+  let appClosed = false;
+
+  testAppInfo.appProcess.init(exeFile)
+  testAppInfo.appProcess.runAsync([], 0, () => appClosed = true);
+
+  // If there was a second request to get the manifest and the package,
+  // then the webapprt has searched for an update and has started to
+  // download it.
+  while ((Number(yield getState("PackageQueries")) < 2 ||
+          Number(yield getState("ManifestQueries")) < 2) &&
+         !appClosed) {
+    yield wait(1000);
+  }
+  ok(!appClosed, "App was launched and is still running");
+  ok(Number(yield getState("ManifestQueries")) >= 2, "Two manifest requests");
+  ok(Number(yield getState("PackageQueries")) >= 2, "Two package requests");
+
+  SimpleTest.finish();
+});
+
+runTest().catch((e) => {
+  ok(false, "Error during test: " + e);
+  SimpleTest.finish();
+});
+
+]]>
+</script>
+</window>
diff --git a/toolkit/webapps/tests/test_webapp_runtime_executable_update.xul b/toolkit/webapps/tests/test_webapp_runtime_executable_update.xul
new file mode 100644
index 000000000000..9886fc061311
--- /dev/null
+++ b/toolkit/webapps/tests/test_webapp_runtime_executable_update.xul
@@ -0,0 +1,158 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1036751
+-->
+<window title="Mozilla Bug 1036751"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/chrome-harness.js"></script>
+  <script type="application/javascript" src="head.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1036751"
+     target="_blank">Mozilla Bug 1036751</a>
+  </body>
+
+<script type="application/javascript">
+<![CDATA[
+
+/** Test for Bug 1036751 **/
+
+"use strict";
+
+SimpleTest.waitForExplicitFinish();
+
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/NativeApp.jsm");
+Cu.import("resource://gre/modules/WebappOSUtils.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+
+let manifest = {
+  name: "test_desktop_hosted_launch",
+  launch_path: "/chrome/toolkit/webapps/tests/app.sjs?appreq",
+};
+
+let app = {
+  name: "test_desktop_hosted_launch",
+  manifestURL: "http://127.0.0.1:8888/sample.manifest",
+  manifest: manifest,
+  origin: "http://127.0.0.1:8888/",
+  categories: [],
+  installOrigin: "http://127.0.0.1:8888/",
+  receipts: [],
+  installTime: Date.now(),
+};
+
+let testAppInfo = new TestAppInfo(app);
+
+function runProcess() {
+    let deferred = Promise.defer();
+
+    testAppInfo.appProcess.runAsync([], 0, (aSubject, aTopic) => {
+      if (aTopic == "process-finished") {
+        deferred.resolve(aSubject.exitValue);
+      } else if (aTopic == "process-failed") {
+        deferred.reject(aSubject.exitValue);
+      }
+    });
+
+    return deferred.promise;
+}
+
+let runTest = Task.async(function*() {
+  // Get to a clean state before the test
+  yield testAppInfo.cleanup();
+
+  SimpleTest.registerCleanupFunction(() => testAppInfo.cleanup());
+
+  setDryRunPref();
+
+  let nativeApp = new NativeApp(app, manifest, app.categories);
+  ok(nativeApp, "NativeApp object created");
+
+  testAppInfo.profileDir = nativeApp.createProfile();
+  ok(testAppInfo.profileDir && testAppInfo.profileDir.exists(), "Profile directory created");
+
+  // On Mac build servers, we don't have enough privileges to write to /Applications,
+  // so we install apps in a user-owned directory.
+  if (MAC) {
+    yield setMacRootInstallDir(OS.Path.join(OS.Constants.Path.homeDir, "Applications"));
+  }
+
+  // Install application
+  info("Test installation");
+  yield nativeApp.install(app, manifest);
+  while (!WebappOSUtils.isLaunchable(app)) {
+    yield wait(1000);
+  }
+  ok(true, "App launchable");
+
+  let fakeInstallDir;
+  if (MAC) {
+    fakeInstallDir = getFile(testAppInfo.installPath, "Contents", "MacOS");
+  } else {
+    fakeInstallDir = getFile(OS.Constants.Path.profileDir, "fakeInstallDir");
+    fakeInstallDir.createUnique(Ci.nsIFile.DIRECTORY_TYPE, 0o755);
+  }
+
+  let fakeAppIniFile = fakeInstallDir.clone();
+  fakeAppIniFile.append("application.ini");
+
+  let iniFile = getFile(testAppInfo.webappINI);
+
+  let iniWriter = Cc["@mozilla.org/xpcom/ini-processor-factory;1"].
+                  getService(Ci.nsIINIParserFactory).
+                  createINIParser(iniFile).
+                  QueryInterface(Ci.nsIINIParserWriter);
+  iniWriter.setString("WebappRT", "InstallDir", fakeInstallDir.path);
+  iniWriter.writeFile();
+
+  let appIniWriter = Cc["@mozilla.org/xpcom/ini-processor-factory;1"].
+                     getService(Ci.nsIINIParserFactory).
+                     createINIParser(fakeAppIniFile).
+                     QueryInterface(Ci.nsIINIParserWriter);
+  appIniWriter.setString("App", "BuildID", "aBuildID");
+  appIniWriter.writeFile();
+
+  let exeName = "webapprt-stub";
+  if (WIN) {
+    exeName += ".exe";
+  }
+
+  let stubExeName = "TestWebappRT";
+  if (WIN) {
+    stubExeName += ".exe";
+  }
+
+  let exeFile = getFile(testAppInfo.exePath);
+
+  let stubExeFile = getFile(getTestFilePath(stubExeName));
+  stubExeFile.copyTo(fakeInstallDir, exeName);
+
+  if (MAC) {
+    stubExeFile.copyTo(getFile(testAppInfo.installPath, "Contents", "MacOS"), "firefox-bin");
+  }
+
+  testAppInfo.appProcess.init(exeFile);
+
+  if (WIN) {
+    is((yield runProcess()), 0, "Webapp runtime executable has been replaced");
+  }
+  is((yield runProcess()), 42, "Webapp runtime executable has been replaced");
+
+  SimpleTest.finish();
+});
+
+runTest().catch((e) => {
+  ok(false, "Error during test: " + e);
+  SimpleTest.finish();
+});
+
+]]>
+</script>
+</window>
diff --git a/webapprt/Startup.jsm b/webapprt/Startup.jsm
index b27b85e41924..fbaef25c363c 100644
--- a/webapprt/Startup.jsm
+++ b/webapprt/Startup.jsm
@@ -12,17 +12,24 @@ this.EXPORTED_SYMBOLS = ["startup"];
 const Ci = Components.interfaces;
 const Cu = Components.utils;
 
+/* We load here modules that are needed to perform the application startup.
+ * We lazily load modules that aren't needed on every startup.
+ * We load modules that aren't used here but that need to perform some
+ * initialization steps later in the startup function. */
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
-Cu.import("resource://gre/modules/AppsUtils.jsm");
-Cu.import("resource://gre/modules/PermissionsInstaller.jsm");
-Cu.import('resource://gre/modules/Payment.jsm');
-Cu.import('resource://gre/modules/AlarmService.jsm');
 Cu.import("resource://gre/modules/Task.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
 Cu.import("resource://gre/modules/osfile.jsm");
 
 Cu.import("resource://webapprt/modules/WebappRT.jsm");
-Cu.import("resource://webapprt/modules/WebRTCHandler.jsm");
+
+// Lazily load these modules because we don't need them at every
+// startup, but only during first run or runtime update.
+
+XPCOMUtils.defineLazyModuleGetter(this, "PermissionsInstaller",
+  "resource://gre/modules/PermissionsInstaller.jsm");
 
 const PROFILE_DIR = OS.Constants.Path.profileDir;
 
@@ -135,6 +142,12 @@ this.startup = function(window) {
     // Wait for XUL window loading
     yield deferredWindowLoad.promise;
 
+    // Load these modules here because they aren't needed right at startup,
+    // but they need to be loaded to perform some initialization steps.
+    Cu.import("resource://gre/modules/Payment.jsm");
+    Cu.import("resource://gre/modules/AlarmService.jsm");
+    Cu.import("resource://webapprt/modules/WebRTCHandler.jsm");
+
     // Get the <browser> element in the webapp.xul window.
     let appBrowser = window.document.getElementById("content");
 
diff --git a/webapprt/WebappRT.jsm b/webapprt/WebappRT.jsm
index a6122df05a35..d1a2be82dfb0 100644
--- a/webapprt/WebappRT.jsm
+++ b/webapprt/WebappRT.jsm
@@ -133,6 +133,6 @@ this.WebappRT = {
 
         thisApp.checkForUpdate();
       }
-    }, 24 * 60 * 60);
+    }, Services.prefs.getIntPref("webapprt.app_update_interval"));
   },
 };
diff --git a/webapprt/prefs.js b/webapprt/prefs.js
index cdf230ed0480..9aebfa47777b 100644
--- a/webapprt/prefs.js
+++ b/webapprt/prefs.js
@@ -2,6 +2,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+// Check for updates once a day.
+pref("webapprt.app_update_interval", 86400);
+
 pref("browser.chromeURL", "chrome://webapprt/content/webapp.xul");
 pref("browser.download.folderList", 1);
 
diff --git a/widget/android/GfxInfo.cpp b/widget/android/GfxInfo.cpp
index 8a04cf2fcbe8..d94e0a2d43a6 100644
--- a/widget/android/GfxInfo.cpp
+++ b/widget/android/GfxInfo.cpp
@@ -71,9 +71,9 @@ public:
       return;
     }
 
-    nsRefPtr<gl::GLContext> gl = gl::GLContextProvider::CreateOffscreen(
-      gfxIntSize(16, 16),
-      gfx::SurfaceCaps::ForRGB());
+    nsRefPtr<gl::GLContext> gl;
+    gl = gl::GLContextProvider::CreateOffscreen(gfxIntSize(16, 16),
+                                                gl::SurfaceCaps::ForRGB());
 
     if (!gl) {
       // Setting mReady to true here means that we won't retry. Everything will
diff --git a/widget/android/NativeJSContainer.cpp b/widget/android/NativeJSContainer.cpp
index c41b81c2c2d5..76acde918dcb 100644
--- a/widget/android/NativeJSContainer.cpp
+++ b/widget/android/NativeJSContainer.cpp
@@ -7,6 +7,7 @@
 #include "AndroidBridge.h"
 #include "mozilla/Vector.h"
 #include "prthread.h"
+#include "nsJSUtils.h"
 
 using namespace mozilla;
 using namespace mozilla::widget;
@@ -502,14 +503,13 @@ struct StringProperty
 
     static Type FromValue(JNIEnv* env, jobject instance,
                           JSContext* cx, const JS::HandleString str) {
-        size_t strLen = 0;
-        const jschar* const strChars =
-            JS_GetStringCharsAndLength(cx, str, &strLen);
-        if (!CheckJSCall(env, !!strChars)) {
+        nsAutoJSString autoStr;
+        if (!CheckJSCall(env, autoStr.init(cx, str))) {
             return nullptr;
         }
         jstring ret = env->NewString(
-            reinterpret_cast<const jchar*>(strChars), strLen);
+            reinterpret_cast<const jchar*>(autoStr.BeginReading()),
+            autoStr.Length());
         MOZ_ASSERT(ret);
         return ret;
     }
diff --git a/widget/android/nsAppShell.cpp b/widget/android/nsAppShell.cpp
index 84e95d86b0d9..99c02200d92b 100644
--- a/widget/android/nsAppShell.cpp
+++ b/widget/android/nsAppShell.cpp
@@ -24,6 +24,7 @@
 #include "nsIDOMWakeLockListener.h"
 #include "nsIPowerManagerService.h"
 #include "nsINetworkLinkService.h"
+#include "nsCategoryManagerUtils.h"
 
 #include "mozilla/Services.h"
 #include "mozilla/unused.h"
@@ -182,6 +183,7 @@ nsAppShell::Init()
         mozilla::services::GetObserverService();
     if (obsServ) {
         obsServ->AddObserver(this, "xpcom-shutdown", false);
+        obsServ->AddObserver(this, "browser-delayed-startup-finished", false);
     }
 
     if (sPowerManagerService)
@@ -207,6 +209,9 @@ nsAppShell::Observe(nsISupports* aSubject,
                nsDependentString(aData).Equals(NS_LITERAL_STRING(PREFNAME_COALESCE_TOUCHES))) {
         mAllowCoalescingTouches = Preferences::GetBool(PREFNAME_COALESCE_TOUCHES, true);
         return NS_OK;
+    } else if (!strcmp(aTopic, "browser-delayed-startup-finished")) {
+        NS_CreateServicesFromCategory("browser-delayed-startup-finished", nullptr,
+                                      "browser-delayed-startup-finished");
     }
     return NS_OK;
 }
diff --git a/xpcom/base/CycleCollectedJSRuntime.cpp b/xpcom/base/CycleCollectedJSRuntime.cpp
index ab157a12cfaf..7f4eb1abd4f8 100644
--- a/xpcom/base/CycleCollectedJSRuntime.cpp
+++ b/xpcom/base/CycleCollectedJSRuntime.cpp
@@ -66,6 +66,7 @@
 #include "nsCycleCollectionParticipant.h"
 #include "nsCycleCollector.h"
 #include "nsDOMJSUtils.h"
+#include "nsJSUtils.h"
 
 #ifdef MOZ_CRASHREPORTER
 #include "nsExceptionHandler.h"
@@ -565,7 +566,10 @@ CycleCollectedJSRuntime::DescribeGCThing(bool aIsMarked, void* aThing,
       JSFunction* fun = JS_GetObjectFunction(obj);
       JSString* str = JS_GetFunctionDisplayId(fun);
       if (str) {
-        NS_ConvertUTF16toUTF8 fname(JS_GetInternedStringChars(str));
+        JSFlatString* flat = JS_ASSERT_STRING_IS_FLAT(str);
+        nsAutoString chars;
+        AssignJSFlatString(chars, flat);
+        NS_ConvertUTF16toUTF8 fname(chars);
         JS_snprintf(name, sizeof(name),
                     "JS Object (Function - %s)", fname.get());
       } else {
diff --git a/xpcom/base/VisualEventTracer.cpp b/xpcom/base/VisualEventTracer.cpp
index d08bc01261a3..73de6235f03e 100644
--- a/xpcom/base/VisualEventTracer.cpp
+++ b/xpcom/base/VisualEventTracer.cpp
@@ -537,7 +537,7 @@ Mark(uint32_t aType, void* aItem, const char* aText, const char* aText2)
 
 // The scriptable classes
 
-class VisualEventTracerLog : public nsIVisualEventTracerLog
+class VisualEventTracerLog MOZ_FINAL: public nsIVisualEventTracerLog
 {
   NS_DECL_ISUPPORTS
   NS_DECL_NSIVISUALEVENTTRACERLOG
@@ -547,8 +547,8 @@ class VisualEventTracerLog : public nsIVisualEventTracerLog
     , mProfilerStart(*gProfilerStart)
   {
   }
-
-  virtual ~VisualEventTracerLog();
+private:
+  ~VisualEventTracerLog();
 
 protected:
   RecordBatch* mBatch;
diff --git a/xpcom/base/VisualEventTracer.h b/xpcom/base/VisualEventTracer.h
index 71430003e02c..5414de4621a7 100644
--- a/xpcom/base/VisualEventTracer.h
+++ b/xpcom/base/VisualEventTracer.h
@@ -214,10 +214,12 @@ private:
 
 // The scriptable class that drives the event tracer
 
-class VisualEventTracer : public nsIVisualEventTracer
+class VisualEventTracer MOZ_FINAL: public nsIVisualEventTracer
 {
   NS_DECL_ISUPPORTS
   NS_DECL_NSIVISUALEVENTTRACER
+private:
+  ~VisualEventTracer() {}
 };
 
 #define NS_VISUALEVENTTRACER_CID \
diff --git a/xpcom/reflect/xptinfo/ShimInterfaceInfo.cpp b/xpcom/reflect/xptinfo/ShimInterfaceInfo.cpp
index 00c1b6a64e32..64a7d576cb2c 100644
--- a/xpcom/reflect/xptinfo/ShimInterfaceInfo.cpp
+++ b/xpcom/reflect/xptinfo/ShimInterfaceInfo.cpp
@@ -51,7 +51,6 @@
 #include "nsIDOMHTMLAnchorElement.h"
 #include "nsIDOMHTMLAppletElement.h"
 #include "nsIDOMHTMLAreaElement.h"
-#include "nsIDOMHTMLAudioElement.h"
 #include "nsIDOMHTMLBRElement.h"
 #include "nsIDOMHTMLBaseElement.h"
 #include "nsIDOMHTMLBodyElement.h"
@@ -100,7 +99,6 @@
 #include "nsIDOMHTMLTextAreaElement.h"
 #include "nsIDOMHTMLTitleElement.h"
 #include "nsIDOMHTMLUListElement.h"
-#include "nsIDOMHTMLVideoElement.h"
 #include "nsIDOMKeyEvent.h"
 #include "nsIDOMMediaError.h"
 #include "nsIDOMMediaList.h"
@@ -190,7 +188,6 @@
 #include "mozilla/dom/HTMLAnchorElementBinding.h"
 #include "mozilla/dom/HTMLAppletElementBinding.h"
 #include "mozilla/dom/HTMLAreaElementBinding.h"
-#include "mozilla/dom/HTMLAudioElementBinding.h"
 #include "mozilla/dom/HTMLBRElementBinding.h"
 #include "mozilla/dom/HTMLBaseElementBinding.h"
 #include "mozilla/dom/HTMLBodyElementBinding.h"
@@ -239,7 +236,6 @@
 #include "mozilla/dom/HTMLTextAreaElementBinding.h"
 #include "mozilla/dom/HTMLTitleElementBinding.h"
 #include "mozilla/dom/HTMLUListElementBinding.h"
-#include "mozilla/dom/HTMLVideoElementBinding.h"
 #include "mozilla/dom/KeyEventBinding.h"
 #include "mozilla/dom/LocalMediaStreamBinding.h"
 #include "mozilla/dom/MediaErrorBinding.h"
@@ -381,7 +377,6 @@ const ComponentsInterfaceShimEntry kComponentsInterfaceShimMap[] =
   DEFINE_SHIM(HTMLAnchorElement),
   DEFINE_SHIM(HTMLAppletElement),
   DEFINE_SHIM(HTMLAreaElement),
-  DEFINE_SHIM(HTMLAudioElement),
   DEFINE_SHIM(HTMLBRElement),
   DEFINE_SHIM(HTMLBaseElement),
   DEFINE_SHIM(HTMLBodyElement),
@@ -430,7 +425,6 @@ const ComponentsInterfaceShimEntry kComponentsInterfaceShimMap[] =
   DEFINE_SHIM(HTMLTextAreaElement),
   DEFINE_SHIM(HTMLTitleElement),
   DEFINE_SHIM(HTMLUListElement),
-  DEFINE_SHIM(HTMLVideoElement),
   DEFINE_SHIM(KeyEvent),
   DEFINE_SHIM(LocalMediaStream),
   DEFINE_SHIM(MediaError),
diff --git a/xpcom/reflect/xptinfo/xptinfo.h b/xpcom/reflect/xptinfo/xptinfo.h
index c5f097e4a0fd..91301345496b 100644
--- a/xpcom/reflect/xptinfo/xptinfo.h
+++ b/xpcom/reflect/xptinfo/xptinfo.h
@@ -132,10 +132,40 @@ public:
     bool IsOut() const    {return 0 != (XPT_PD_IS_OUT(flags));}
     bool IsRetval() const {return 0 != (XPT_PD_IS_RETVAL(flags));}
     bool IsShared() const {return 0 != (XPT_PD_IS_SHARED(flags));}
+
+    // Dipper types are one of the more inscrutable aspects of xpidl. In a
+    // nutshell, dippers are empty container objects, created and passed by
+    // the caller, and filled by the callee. The callee receives a fully-
+    // formed object, and thus does not have to construct anything. But
+    // the object is functionally empty, and the callee is responsible for
+    // putting something useful inside of it.
+    //
+    // XPIDL decides which types to make dippers. The list of these types
+    // is given in the isDipperType() function in typelib.py, and is currently
+    // limited to 4 string types.
+    //
+    // When a dipper type is declared as an 'out' parameter, xpidl internally
+    // converts it to an 'in', and sets the XPT_PD_DIPPER flag on it. For this
+    // reason, dipper types are sometimes referred to as 'out parameters
+    // masquerading as in'. The burden of maintaining this illusion falls mostly
+    // on XPConnect, which creates the empty containers, and harvest the results
+    // after the call.
     bool IsDipper() const {return 0 != (XPT_PD_IS_DIPPER(flags));}
     bool IsOptional() const {return 0 != (XPT_PD_IS_OPTIONAL(flags));}
     const nsXPTType GetType() const {return type.prefix;}
 
+    bool IsStringClass() const {
+      switch (GetType().TagPart()) {
+        case nsXPTType::T_ASTRING:
+        case nsXPTType::T_DOMSTRING:
+        case nsXPTType::T_UTF8STRING:
+        case nsXPTType::T_CSTRING:
+          return true;
+        default:
+          return false;
+      }
+    }
+
     // Whether this parameter is passed indirectly on the stack. This mainly
     // applies to out/inout params, but we use it unconditionally for certain
     // types.