Merge m-c to inbound, a=merge

MozReview-Commit-ID: 8k4A4tEOtIT
2017-06-16 18:17:38 -07:00 · 2017-06-16 18:17:38 -07:00 · b0560565d7
--- a/browser/components/customizableui/PanelMultiView.jsm
+++ b/browser/components/customizableui/PanelMultiView.jsm
@ -167,9 +167,6 @@ this.PanelMultiView = class {
  get _mainView() {
    return this._mainViewId ? this.document.getElementById(this._mainViewId) : null;
  }
-  get showingSubViewAsMainView() {
-    return this.node.getAttribute("mainViewIsSubView") == "true";
-  }

  get _transitioning() {
    return this.__transitioning;
@ -460,6 +457,7 @@ this.PanelMultiView = class {
      };

      // Make sure that new panels always have a title set.
+      let cancel = false;
      if (this.panelViews && aAnchor) {
        if (aAnchor && !viewNode.hasAttribute("title"))
          viewNode.setAttribute("title", aAnchor.getAttribute("label"));
@ -468,17 +466,17 @@ this.PanelMultiView = class {
        if (custWidget) {
          if (custWidget.onInit)
            custWidget.onInit(aAnchor);
-          custWidget.onViewShowing({ target: aAnchor, detail });
+          custWidget.onViewShowing({ target: viewNode, preventDefault: () => cancel = true, detail });
        }
      }
-      viewNode.setAttribute("current", true);
      if (this.panelViews && this._mainViewWidth)
        viewNode.style.maxWidth = viewNode.style.minWidth = this._mainViewWidth + "px";

      let evt = new window.CustomEvent("ViewShowing", { bubbles: true, cancelable: true, detail });
      viewNode.dispatchEvent(evt);

-      let cancel = evt.defaultPrevented;
+      if (!cancel)
+        cancel = evt.defaultPrevented;
      if (detail.blockers.size) {
        try {
          let results = await Promise.all(detail.blockers);
@ -494,6 +492,7 @@ this.PanelMultiView = class {
      }

      this._currentSubView = viewNode;
+      viewNode.setAttribute("current", true);
      if (this.panelViews) {
        this.node.setAttribute("viewtype", "subview");
        if (!playTransition)
@ -625,8 +624,8 @@ this.PanelMultiView = class {

                this._viewContainer.removeAttribute("transition-reverse");

-                evt = new window.CustomEvent("ViewShown", { bubbles: true, cancelable: false });
-                viewNode.dispatchEvent(evt);
+                viewNode.dispatchEvent(new window.CustomEvent("ViewShown",
+                  { bubbles: true, cancelable: false }));
              }, { once: true });
            });
          }, { once: true });
@ -638,6 +637,8 @@ this.PanelMultiView = class {
          // Now that the subview is visible, we can check the height of the
          // description elements it contains.
          this.descriptionHeightWorkaround(viewNode);
+          viewNode.dispatchEvent(new window.CustomEvent("ViewShown",
+            { bubbles: true, cancelable: false }));
        });
        this._shiftMainView(aAnchor);
      }
--- a/browser/components/customizableui/content/panelUI.js
+++ b/browser/components/customizableui/content/panelUI.js
@ -515,12 +515,14 @@ const PanelUI = {
      multiView.setAttribute("nosubviews", "true");
      multiView.setAttribute("viewCacheId", "appMenu-viewCache");
      if (gPhotonStructure) {
+        tempPanel.setAttribute("photon", true);
        multiView.setAttribute("mainViewId", viewNode.id);
        multiView.appendChild(viewNode);
      }
      tempPanel.appendChild(multiView);
-      multiView.setAttribute("mainViewIsSubView", "true");
-      multiView.setMainView(viewNode);
+      if (!gPhotonStructure) {
+        multiView.setMainView(viewNode);
+      }
      viewNode.classList.add("cui-widget-panelview");

      let viewShown = false;
--- a/browser/components/customizableui/test/browser_947914_button_history.js
+++ b/browser/components/customizableui/test/browser_947914_button_history.js
@ -14,8 +14,10 @@ add_task(async function() {
  let historyButton = document.getElementById("history-panelmenu");
  ok(historyButton, "History button appears in Panel Menu");

-  historyButton.click();
  let historyPanel = document.getElementById("PanelUI-history");
+  let promise = BrowserTestUtils.waitForEvent(historyPanel, "ViewShown");
+  historyButton.click();
+  await promise;
  ok(historyPanel.getAttribute("current"), "History Panel is in view");

  let panelHiddenPromise = promisePanelHidden(window);
--- a/browser/components/extensions/ext-browserAction.js
+++ b/browser/components/extensions/ext-browserAction.js
@ -130,6 +130,7 @@ this.browserAction = class extends ExtensionAPI {
        let view = document.createElementNS(XUL_NS, "panelview");
        view.id = this.viewId;
        view.setAttribute("flex", "1");
+        view.setAttribute("extension", true);

        document.getElementById("PanelUI-multiView").appendChild(view);
        document.addEventListener("popupshowing", this);
@ -171,6 +172,10 @@ this.browserAction = class extends ExtensionAPI {
        // Google Chrome onClicked extension API.
        if (popupURL) {
          try {
+            // FIXME: The line below needs to change eventually, but for now:
+            // ensure the view is _always_ visible _before_ `popup.attach()` is
+            // called. PanelMultiView.jsm dictates different behavior.
+            event.target.setAttribute("current", true);
            let popup = this.getPopup(document.defaultView, popupURL);
            event.detail.addBlocker(popup.attach(event.target));
          } catch (e) {
--- a/browser/components/extensions/test/browser/browser_ext_popup_corners.js
+++ b/browser/components/extensions/test/browser/browser_ext_popup_corners.js
@ -3,6 +3,8 @@
 "use strict";

 add_task(async function testPopupBorderRadius() {
+  await SpecialPowers.pushPrefEnv({set: [["browser.photon.structure.enabled", false]]});
+
  let extension = ExtensionTestUtils.loadExtension({
    background() {
      browser.tabs.query({active: true, currentWindow: true}, tabs => {
--- a/browser/components/preferences/colors.xul
+++ b/browser/components/preferences/colors.xul
@ -26,7 +26,7 @@
  <script type="application/javascript" src="chrome://browser/content/utilityOverlay.js"/>
  <prefpane id="ColorsDialogPane"
            helpTopic="prefs-fonts-and-colors">
-  
+
    <preferences>
      <preference id="browser.display.document_color_use"   name="browser.display.document_color_use"   type="int"/>
      <preference id="browser.anchor_color"                 name="browser.anchor_color"                 type="string"/>
@ -36,18 +36,18 @@
      <preference id="browser.display.background_color"     name="browser.display.background_color"     type="string"/>
      <preference id="browser.display.use_system_colors"    name="browser.display.use_system_colors"    type="bool"/>
    </preferences>
-    
+
    <hbox>
      <groupbox flex="1">
-        <caption label="&color;"/>
+        <caption><label>&color;</label></caption>
        <hbox align="center">
-          <label value="&textColor.label;" accesskey="&textColor.accesskey;" control="foregroundtextmenu"/>
+          <label accesskey="&textColor.accesskey;" control="foregroundtextmenu">&textColor.label;</label>
          <spacer flex="1"/>
          <colorpicker type="button" id="foregroundtextmenu" palettename="standard"
                       preference="browser.display.foreground_color"/>
        </hbox>
        <hbox align="center" style="margin-top: 5px">
-          <label value="&backgroundColor.label;" accesskey="&backgroundColor.accesskey;" control="backgroundmenu"/>
+          <label accesskey="&backgroundColor.accesskey;" control="backgroundmenu">&backgroundColor.label;</label>
          <spacer flex="1"/>
          <colorpicker type="button" id="backgroundmenu" palettename="standard"
                       preference="browser.display.background_color"/>
@ -58,17 +58,17 @@
                    preference="browser.display.use_system_colors"/>
        </hbox>
      </groupbox>
-        
+
      <groupbox flex="1">
-        <caption label="&links;"/>
+        <caption><label>&links;</label></caption>
        <hbox align="center">
-          <label value="&linkColor.label;" accesskey="&linkColor.accesskey;" control="unvisitedlinkmenu"/>
+          <label accesskey="&linkColor.accesskey;" control="unvisitedlinkmenu">&linkColor.label;</label>
          <spacer flex="1"/>
          <colorpicker type="button" id="unvisitedlinkmenu" palettename="standard"
                       preference="browser.anchor_color"/>
        </hbox>
        <hbox align="center" style="margin-top: 5px">
-          <label value="&visitedLinkColor.label;" accesskey="&visitedLinkColor.accesskey;" control="visitedlinkmenu"/>
+          <label accesskey="&visitedLinkColor.accesskey;" control="visitedlinkmenu">&visitedLinkColor.label;</label>
          <spacer flex="1"/>
          <colorpicker type="button" id="visitedlinkmenu" palettename="standard"
                       preference="browser.visited_color"/>
@ -87,16 +87,18 @@
 #endif
      <label accesskey="&overrideDefaultPageColors.accesskey;"
             control="useDocumentColors">&overrideDefaultPageColors.label;</label>
-      <menulist id="useDocumentColors" preference="browser.display.document_color_use">
-        <menupopup>
-          <menuitem label="&overrideDefaultPageColors.always.label;"
-                    value="2" id="documentColorAlways"/>
-          <menuitem label="&overrideDefaultPageColors.auto.label;"
-                    value="0" id="documentColorAutomatic"/>
-          <menuitem label="&overrideDefaultPageColors.never.label;"
-                    value="1" id="documentColorNever"/>
-        </menupopup>
-      </menulist>
+      <hbox>
+        <menulist id="useDocumentColors" preference="browser.display.document_color_use" flex="1">
+          <menupopup>
+            <menuitem label="&overrideDefaultPageColors.always.label;"
+                      value="2" id="documentColorAlways"/>
+            <menuitem label="&overrideDefaultPageColors.auto.label;"
+                      value="0" id="documentColorAutomatic"/>
+            <menuitem label="&overrideDefaultPageColors.never.label;"
+                      value="1" id="documentColorNever"/>
+          </menupopup>
+        </menulist>
+      </hbox>
    </vbox>
  </prefpane>
 </prefwindow>
--- a/browser/components/preferences/connection.xul
+++ b/browser/components/preferences/connection.xul
@ -65,7 +65,7 @@
    <stringbundle id="preferencesBundle" src="chrome://browser/locale/preferences/preferences.properties"/>

    <groupbox>
-      <caption label="&proxyTitle.label;"/>
+      <caption><label>&proxyTitle.label;</label></caption>

      <radiogroup id="networkProxyType" preference="network.proxy.type"
                  onsyncfrompreference="return gConnectionsDialog.readProxyType();">
@ -81,12 +81,12 @@
          <rows>
            <row align="center">
              <hbox pack="end">
-                <label value="&http.label;" accesskey="&http.accesskey;" control="networkProxyHTTP"/>
+                <label accesskey="&http.accesskey;" control="networkProxyHTTP">&http.label;</label>
              </hbox>
              <hbox align="center">
                <textbox id="networkProxyHTTP" flex="1"
                         preference="network.proxy.http" onsyncfrompreference="return gConnectionsDialog.readHTTPProxyServer();"/>
-                <label value="&port.label;" accesskey="&HTTPport.accesskey;" control="networkProxyHTTP_Port"/>
+                <label accesskey="&HTTPport.accesskey;" control="networkProxyHTTP_Port">&port.label;</label>
                <textbox id="networkProxyHTTP_Port" type="number" max="65535" size="5"
                         preference="network.proxy.http_port" onsyncfrompreference="return gConnectionsDialog.readHTTPProxyPort();"/>
              </hbox>
@ -101,36 +101,36 @@
            </row>
            <row align="center">
              <hbox pack="end">
-                <label value="&ssl.label;" accesskey="&ssl.accesskey;" control="networkProxySSL"/>
+                <label accesskey="&ssl.accesskey;" control="networkProxySSL">&ssl.label;</label>
              </hbox>
              <hbox align="center">
                <textbox id="networkProxySSL" flex="1" preference="network.proxy.ssl"
                         onsyncfrompreference="return gConnectionsDialog.readProxyProtocolPref('ssl', false);"/>
-                <label value="&port.label;" accesskey="&SSLport.accesskey;" control="networkProxySSL_Port"/>
+                <label accesskey="&SSLport.accesskey;" control="networkProxySSL_Port">&port.label;</label>
                <textbox id="networkProxySSL_Port" type="number" max="65535" size="5" preference="network.proxy.ssl_port"
                         onsyncfrompreference="return gConnectionsDialog.readProxyProtocolPref('ssl', true);"/>
              </hbox>
            </row>
            <row align="center">
              <hbox pack="end">
-                <label value="&ftp.label;" accesskey="&ftp.accesskey;" control="networkProxyFTP"/>
+                <label accesskey="&ftp.accesskey;" control="networkProxyFTP">&ftp.label;</label>
              </hbox>
              <hbox align="center">
                <textbox id="networkProxyFTP" flex="1" preference="network.proxy.ftp"
                         onsyncfrompreference="return gConnectionsDialog.readProxyProtocolPref('ftp', false);"/>
-                <label value="&port.label;" accesskey="&FTPport.accesskey;" control="networkProxyFTP_Port"/>
+                <label accesskey="&FTPport.accesskey;" control="networkProxyFTP_Port">&port.label;</label>
                <textbox id="networkProxyFTP_Port" type="number" max="65535" size="5" preference="network.proxy.ftp_port"
                         onsyncfrompreference="return gConnectionsDialog.readProxyProtocolPref('ftp', true);"/>
              </hbox>
            </row>
            <row align="center">
              <hbox pack="end">
-                <label value="&socks.label;" accesskey="&socks.accesskey;" control="networkProxySOCKS"/>
+                <label accesskey="&socks.accesskey;" control="networkProxySOCKS">&socks.label;</label>
              </hbox>
              <hbox align="center">
                <textbox id="networkProxySOCKS" flex="1" preference="network.proxy.socks"
                         onsyncfrompreference="return gConnectionsDialog.readProxyProtocolPref('socks', false);"/>
-                <label value="&port.label;" accesskey="&SOCKSport.accesskey;" control="networkProxySOCKS_Port"/>
+                <label accesskey="&SOCKSport.accesskey;" control="networkProxySOCKS_Port">&port.label;</label>
                <textbox id="networkProxySOCKS_Port" type="number" max="65535" size="5" preference="network.proxy.socks_port"
                         onsyncfrompreference="return gConnectionsDialog.readProxyProtocolPref('socks', true);"/>
              </hbox>
@ -145,9 +145,9 @@
              </radiogroup>
              </box>
            </row>
-            <label value="&noproxy.label;" accesskey="&noproxy.accesskey;" control="networkProxyNone"/>
+            <label accesskey="&noproxy.accesskey;" control="networkProxyNone">&noproxy.label;</label>
            <textbox id="networkProxyNone" preference="network.proxy.no_proxies_on" multiline="true" rows="2"/>
-            <label value="&noproxyExplain.label;" control="networkProxyNone"/>
+            <label control="networkProxyNone">&noproxyExplain.label;</label>
          </rows>
        </grid>
        <radio value="2" label="&autoTypeRadio.label;" accesskey="&autoTypeRadio.accesskey;"/>
--- a/browser/components/preferences/containers.xul
+++ b/browser/components/preferences/containers.xul
@ -31,14 +31,14 @@

  <vbox class="contentPane largeDialogContainer" flex="1" hidden="true" id="containers-content">
    <hbox align="start">
-      <label id="nameLabel" control="name" value="&name.label;" accesskey="&name.accesskey;"/>
+      <label id="nameLabel" control="name" accesskey="&name.accesskey;">&name.label;</label>
      <textbox id="name" placeholder="&name.placeholder;" flex="1" onkeyup="gContainersManager.checkForm();" />
    </hbox>
    <hbox align="center" id="iconWrapper">
-      <label id="iconLabel" control="icon" value="&icon.label;" accesskey="&icon.accesskey;"/>
+      <label id="iconLabel" control="icon" accesskey="&icon.accesskey;">&icon.label;</label>
    </hbox>
    <hbox align="center" id="colorWrapper">
-      <label id="colorLabel" control="color" value="&color.label;" accesskey="&color.accesskey;"/>
+      <label id="colorLabel" control="color" accesskey="&color.accesskey;">&color.label;</label>
    </hbox>
  </vbox>
  <vbox>
--- a/browser/components/preferences/cookies.xul
+++ b/browser/components/preferences/cookies.xul
@ -39,7 +39,7 @@
               accesskey="&searchFilter.accesskey;"/>
    </hbox>
    <separator class="thin"/>
-    <label control="cookiesList" id="cookiesIntro" value="&cookiesonsystem.label;"/>
+    <label control="cookiesList" id="cookiesIntro">&cookiesonsystem.label;</label>
    <separator class="thin"/>
    <tree id="cookiesList" flex="1" style="height: 10em;"
          onkeypress="gCookiesWindow.onCookieKeyPress(event)"
@ -63,31 +63,31 @@
        </columns>
        <rows>
          <row align="center">
-            <hbox pack="end"><label id="nameLabel" control="name" value="&props.name.label;"/></hbox>
+            <hbox pack="end"><label id="nameLabel" control="name">&props.name.label;</label></hbox>
            <textbox id="name" readonly="true" class="plain"/>
          </row>
          <row align="center">
-            <hbox pack="end"><label id="valueLabel" control="value" value="&props.value.label;"/></hbox>
+            <hbox pack="end"><label id="valueLabel" control="value">&props.value.label;</label></hbox>
            <textbox id="value" readonly="true" class="plain"/>
          </row>
          <row align="center">
-            <hbox pack="end"><label id="isDomain" control="host" value="&props.domain.label;"/></hbox>
+            <hbox pack="end"><label id="isDomain" control="host">&props.domain.label;</label></hbox>
            <textbox id="host" readonly="true" class="plain"/>
          </row>
          <row align="center">
-            <hbox pack="end"><label id="pathLabel" control="path" value="&props.path.label;"/></hbox>
+            <hbox pack="end"><label id="pathLabel" control="path">&props.path.label;</label></hbox>
            <textbox id="path" readonly="true" class="plain"/>
          </row>
          <row align="center">
-            <hbox pack="end"><label id="isSecureLabel" control="isSecure" value="&props.secure.label;"/></hbox>
+            <hbox pack="end"><label id="isSecureLabel" control="isSecure">&props.secure.label;</label></hbox>
            <textbox id="isSecure" readonly="true" class="plain"/>
          </row>
          <row align="center">
-            <hbox pack="end"><label id="expiresLabel" control="expires" value="&props.expires.label;"/></hbox>
+            <hbox pack="end"><label id="expiresLabel" control="expires">&props.expires.label;</label></hbox>
            <textbox id="expires" readonly="true" class="plain"/>
          </row>
          <row align="center" id="userContextRow">
-            <hbox pack="end"><label id="userContextLabel" control="userContext" value="&props.container.label;"/></hbox>
+            <hbox pack="end"><label id="userContextLabel" control="userContext">&props.container.label;</label></hbox>
            <textbox id="userContext" readonly="true" class="plain"/>
          </row>
        </rows>
--- a/browser/components/preferences/donottrack.xul
+++ b/browser/components/preferences/donottrack.xul
@ -36,8 +36,7 @@
    <description flex="1" class="doNotTrackLearnMore">
      &doNotTrackTPInfo.description;
      <label class="text-link"
-             value="&doNotTrackLearnMore.label;"
-             href="https://www.mozilla.org/dnt"/>
+             href="https://www.mozilla.org/dnt">&doNotTrackLearnMore.label;</label>
    </description>
  </prefpane>
 </prefwindow>
--- a/browser/components/preferences/fonts.xul
+++ b/browser/components/preferences/fonts.xul
@ -104,9 +104,8 @@
              </menupopup>
            </menulist>
            <hbox align="center" pack="end">
-              <label value="&size.label;"
-                     accesskey="&sizeProportional.accesskey;"
-                     control="sizeVar"/>
+              <label accesskey="&sizeProportional.accesskey;"
+                     control="sizeVar">&size.label;</label>
            </hbox>
            <menulist id="sizeVar" delayprefsave="true">
              <menupopup>
@ -142,58 +141,65 @@
            <hbox align="center" pack="end">
              <label accesskey="&serif.accesskey;" control="serif">&serif.label;</label>
            </hbox>
-            <menulist id="serif" flex="1" style="width: 0px;" delayprefsave="true"
-                      onsyncfrompreference="return FontBuilder.readFontSelection(this);"/>
+            <hbox>
+              <menulist id="serif" flex="1" style="width: 0px;" delayprefsave="true"
+                        onsyncfrompreference="return FontBuilder.readFontSelection(this);"/>
+            </hbox>
            <spacer/>
          </row>
          <row align="center">
            <hbox align="center" pack="end">
              <label accesskey="&sans-serif.accesskey;" control="sans-serif">&sans-serif.label;</label>
            </hbox>
-            <menulist id="sans-serif" flex="1" style="width: 0px;" delayprefsave="true"
-                      onsyncfrompreference="return FontBuilder.readFontSelection(this);"/>
+            <hbox>
+              <menulist id="sans-serif" flex="1" style="width: 0px;" delayprefsave="true"
+                        onsyncfrompreference="return FontBuilder.readFontSelection(this);"/>
+            </hbox>
            <spacer/>
          </row>
          <row align="center">
            <hbox align="center" pack="end">
              <label accesskey="&monospace.accesskey;" control="monospace">&monospace.label;</label>
            </hbox>
-            <menulist id="monospace" flex="1" style="width: 0px;" crop="right" delayprefsave="true"
-                      onsyncfrompreference="return FontBuilder.readFontSelection(this);"/>
-            <hbox align="center" pack="end">
-              <label value="&size.label;"
-                     accesskey="&sizeMonospace.accesskey;"
-                     control="sizeMono"/>
+            <hbox>
+              <menulist id="monospace" flex="1" style="width: 0px;" crop="right" delayprefsave="true"
+                        onsyncfrompreference="return FontBuilder.readFontSelection(this);"/>
+            </hbox>
+            <hbox align="center" pack="end">
+              <label accesskey="&sizeMonospace.accesskey;"
+                     control="sizeMono">&size.label;</label>
+            </hbox>
+            <hbox>
+              <menulist id="sizeMono" delayprefsave="true">
+                <menupopup>
+                  <menuitem value="9" label="9"/>
+                  <menuitem value="10" label="10"/>
+                  <menuitem value="11" label="11"/>
+                  <menuitem value="12" label="12"/>
+                  <menuitem value="13" label="13"/>
+                  <menuitem value="14" label="14"/>
+                  <menuitem value="15" label="15"/>
+                  <menuitem value="16" label="16"/>
+                  <menuitem value="17" label="17"/>
+                  <menuitem value="18" label="18"/>
+                  <menuitem value="20" label="20"/>
+                  <menuitem value="22" label="22"/>
+                  <menuitem value="24" label="24"/>
+                  <menuitem value="26" label="26"/>
+                  <menuitem value="28" label="28"/>
+                  <menuitem value="30" label="30"/>
+                  <menuitem value="32" label="32"/>
+                  <menuitem value="34" label="34"/>
+                  <menuitem value="36" label="36"/>
+                  <menuitem value="40" label="40"/>
+                  <menuitem value="44" label="44"/>
+                  <menuitem value="48" label="48"/>
+                  <menuitem value="56" label="56"/>
+                  <menuitem value="64" label="64"/>
+                  <menuitem value="72" label="72"/>
+                </menupopup>
+              </menulist>
            </hbox>
-            <menulist id="sizeMono" delayprefsave="true">
-              <menupopup>
-                <menuitem value="9" label="9"/>
-                <menuitem value="10" label="10"/>
-                <menuitem value="11" label="11"/>
-                <menuitem value="12" label="12"/>
-                <menuitem value="13" label="13"/>
-                <menuitem value="14" label="14"/>
-                <menuitem value="15" label="15"/>
-                <menuitem value="16" label="16"/>
-                <menuitem value="17" label="17"/>
-                <menuitem value="18" label="18"/>
-                <menuitem value="20" label="20"/>
-                <menuitem value="22" label="22"/>
-                <menuitem value="24" label="24"/>
-                <menuitem value="26" label="26"/>
-                <menuitem value="28" label="28"/>
-                <menuitem value="30" label="30"/>
-                <menuitem value="32" label="32"/>
-                <menuitem value="34" label="34"/>
-                <menuitem value="36" label="36"/>
-                <menuitem value="40" label="40"/>
-                <menuitem value="44" label="44"/>
-                <menuitem value="48" label="48"/>
-                <menuitem value="56" label="56"/>
-                <menuitem value="64" label="64"/>
-                <menuitem value="72" label="72"/>
-              </menupopup>
-            </menulist>
          </row>
        </rows>
      </grid>
@ -247,12 +253,11 @@

    <!-- Text Encoding -->
    <groupbox>
-      <caption label="&languages.customize.Fallback2.grouplabel;"/>
+      <caption><label>&languages.customize.Fallback2.grouplabel;</label></caption>
      <description>&languages.customize.Fallback2.desc;</description>
      <hbox align="center">
-        <label value="&languages.customize.Fallback2.label;"
-               accesskey="&languages.customize.Fallback2.accesskey;"
-               control="DefaultCharsetList"/>
+        <label accesskey="&languages.customize.Fallback2.accesskey;"
+               control="DefaultCharsetList">&languages.customize.Fallback2.label;</label>
        <menulist id="DefaultCharsetList" preference="intl.charset.fallback.override">
          <menupopup>
            <menuitem label="&languages.customize.Fallback.auto;"        value=""/>
--- a/browser/components/preferences/in-content-new/findInPage.js
+++ b/browser/components/preferences/in-content-new/findInPage.js
@ -5,16 +5,12 @@
 /* import-globals-from preferences.js */

 var gSearchResultsPane = {
-  findSelection: null,
  listSearchTooltips: new Set(),
  listSearchMenuitemIndicators: new Set(),
  searchResultsCategory: null,
  searchInput: null,

  init() {
-    let controller = this.getSelectionController();
-    this.findSelection = controller.getSelection(Ci.nsISelectionController.SELECTION_FIND);
-    this.findSelection.setColors("currentColor", "#ffe900", "currentColor", "#003eaa");
    this.searchResultsCategory = document.getElementById("category-search-results");

    this.searchInput = document.getElementById("searchInput");
@ -123,6 +119,10 @@ var gSearchResultsPane = {
   *      Returns true when atleast one instance of search phrase is found, otherwise false
   */
  highlightMatches(textNodes, nodeSizes, textSearch, searchPhrase) {
+    if (!searchPhrase) {
+      return false;
+    }
+
    let indices = [];
    let i = -1;
    while ((i = textSearch.indexOf(searchPhrase, i + 1)) >= 0) {
@ -160,23 +160,32 @@ var gSearchResultsPane = {
      let range = document.createRange();
      range.setStart(startNode, startValue);
      range.setEnd(endNode, endValue);
-      this.findSelection.addRange(range);
+      this.getFindSelection(startNode.ownerGlobal).addRange(range);
    }

    return indices.length > 0;
  },

-  getSelectionController() {
+  /**
+   * Get the selection instance from given window
+   *
+   * @param Object win
+   *   The window object points to frame's window
+   */
+  getFindSelection(win) {
    // Yuck. See bug 138068.
-    let docShell = window.QueryInterface(Ci.nsIInterfaceRequestor)
-                         .getInterface(Ci.nsIWebNavigation)
-                         .QueryInterface(Ci.nsIDocShell);
+    let docShell = win.QueryInterface(Ci.nsIInterfaceRequestor)
+                      .getInterface(Ci.nsIWebNavigation)
+                      .QueryInterface(Ci.nsIDocShell);

    let controller = docShell.QueryInterface(Ci.nsIInterfaceRequestor)
-                             .getInterface(Ci.nsISelectionDisplay)
-                             .QueryInterface(Ci.nsISelectionController);
+                              .getInterface(Ci.nsISelectionDisplay)
+                              .QueryInterface(Ci.nsISelectionController);

-    return controller;
+    let selection = controller.getSelection(Ci.nsISelectionController.SELECTION_FIND);
+    selection.setColors("currentColor", "#ffe900", "currentColor", "#003eaa");
+
+    return selection;
  },

  get strings() {
@ -191,14 +200,14 @@ var gSearchResultsPane = {
   *    to search for filted query in
   */
  searchFunction(event) {
-    let query = event.target.value.trim().toLowerCase();
-    this.findSelection.removeAllRanges();
+    this.query = event.target.value.trim().toLowerCase();
+    this.getFindSelection(window).removeAllRanges();
    this.removeAllSearchTooltips();
    this.removeAllSearchMenuitemIndicators();

    let srHeader = document.getElementById("header-searchResults");

-    if (query) {
+    if (this.query) {
      // Showing the Search Results Tag
      gotoPref("paneSearchResults");

@ -219,7 +228,7 @@ var gSearchResultsPane = {
      for (let i = 0; i < rootPreferencesChildren.length; i++) {
        if (rootPreferencesChildren[i].className != "header" &&
            rootPreferencesChildren[i].className != "no-results-message" &&
-            this.searchWithinNode(rootPreferencesChildren[i], query)) {
+            this.searchWithinNode(rootPreferencesChildren[i], this.query)) {
          rootPreferencesChildren[i].hidden = false;
          resultsFound = true;
        } else {
@ -236,15 +245,15 @@ var gSearchResultsPane = {
        let strings = this.strings;

        document.getElementById("sorry-message").textContent = AppConstants.platform == "win" ?
-          strings.getFormattedString("searchResults.sorryMessageWin", [query]) :
-          strings.getFormattedString("searchResults.sorryMessageUnix", [query]);
+          strings.getFormattedString("searchResults.sorryMessageWin", [this.query]) :
+          strings.getFormattedString("searchResults.sorryMessageUnix", [this.query]);
        let helpUrl = Services.urlFormatter.formatURLPref("app.support.baseURL") + "preferences";
        let brandName = document.getElementById("bundleBrand").getString("brandShortName");
        document.getElementById("need-help").innerHTML =
          strings.getFormattedString("searchResults.needHelp2", [helpUrl, brandName]);
      } else {
        // Creating tooltips for all the instances found
-        this.listSearchTooltips.forEach((node) => this.createSearchTooltip(node, query));
+        this.listSearchTooltips.forEach((anchorNode) => this.createSearchTooltip(anchorNode, this.query));
      }
    } else {
      this.searchResultsCategory.hidden = true;
@ -368,25 +377,26 @@ var gSearchResultsPane = {
   * Inserting a div structure infront of the DOM element matched textContent.
   * Then calculation the offsets to position the tooltip in the correct place.
   *
-   * @param Node currentNode
+   * @param Node anchorNode
   *    DOM Element
   * @param String query
   *    Word or words that are being searched for
   */
-  createSearchTooltip(currentNode, query) {
-    let searchTooltip = document.createElement("span");
+  createSearchTooltip(anchorNode, query) {
+    let searchTooltip = anchorNode.ownerDocument.createElement("span");
    searchTooltip.setAttribute("class", "search-tooltip");
    searchTooltip.textContent = query;

-    currentNode.parentElement.classList.add("search-tooltip-parent");
-    currentNode.parentElement.appendChild(searchTooltip);
+    anchorNode.setAttribute("data-has-tooltip", "true");
+    anchorNode.parentElement.classList.add("search-tooltip-parent");
+    anchorNode.parentElement.appendChild(searchTooltip);

    // In order to get the up-to-date position of each of the nodes that we're
    // putting tooltips on, we have to flush layout intentionally, and that
    // this is the result of a XUL limitation (bug 1363730).
-    let anchorRect = currentNode.getBoundingClientRect();
+    let anchorRect = anchorNode.getBoundingClientRect();
    let tooltipRect = searchTooltip.getBoundingClientRect();
-    let parentRect = currentNode.parentElement.getBoundingClientRect();
+    let parentRect = anchorNode.parentElement.getBoundingClientRect();

    let offSet = (anchorRect.width / 2) - (tooltipRect.width / 2);
    let relativeOffset = anchorRect.left - parentRect.left;
@ -404,6 +414,7 @@ var gSearchResultsPane = {
      searchTooltip.parentElement.classList.remove("search-tooltip-parent");
      searchTooltip.remove();
    }
+    this.listSearchTooltips.forEach((anchorNode) => anchorNode.removeAttribute("data-has-tooltip"));
    this.listSearchTooltips.clear();
  },

--- a/browser/components/preferences/in-content-new/main.xul
+++ b/browser/components/preferences/in-content-new/main.xul
@ -321,7 +321,7 @@

 <!-- Default Search Engine -->
 <groupbox id="defaultEngineGroup" data-category="paneGeneral" data-subcategory="search">
-  <caption label="&defaultSearchEngine.label;"/>
+  <caption><label>&defaultSearchEngine.label;</label></caption>
  <label>&chooseYourDefaultSearchEngine.label;</label>
  <box align="start">
    <menulist id="defaultEngine">
@ -344,7 +344,7 @@
 </groupbox>

 <groupbox id="oneClickSearchProvidersGroup" data-category="paneGeneral" data-subcategory="search">
-  <caption label="&oneClickSearchEngines.label;"/>
+  <caption><label>&oneClickSearchEngines.label;</label></caption>
  <label>&chooseWhichOneToDisplay.label;</label>

  <tree id="engineList" flex="1" rows="8" hidecolumnpicker="true" editable="true"
--- a/browser/components/preferences/in-content-new/preferences.js
+++ b/browser/components/preferences/in-content-new/preferences.js
@ -166,7 +166,7 @@ function gotoPref(aCategory) {
  if (category != "paneSearchResults") {
    gSearchResultsPane.searchInput.value = "";
    gSearchResultsPane.searchResultsCategory.hidden = true;
-    gSearchResultsPane.findSelection.removeAllRanges();
+    gSearchResultsPane.getFindSelection(window).removeAllRanges();
    gSearchResultsPane.removeAllSearchTooltips();
    gSearchResultsPane.removeAllSearchMenuitemIndicators();
  } else if (!gSearchResultsPane.searchInput.value) {
@ -174,6 +174,7 @@ function gotoPref(aCategory) {
    // a query string. Default to the General pane instead.
    category = kDefaultCategoryInternalName;
    document.location.hash = kDefaultCategory;
+    gSearchResultsPane.query = null;
  }

  // Updating the hash (below) or changing the selected category
--- a/browser/components/preferences/in-content-new/subdialogs.js
+++ b/browser/components/preferences/in-content-new/subdialogs.js
@ -333,6 +333,24 @@ SubDialog.prototype = {
    }

    this._trapFocus();
+
+    // Search within main document and highlight matched keyword.
+    gSearchResultsPane.searchWithinNode(this._titleElement, gSearchResultsPane.query);
+
+    // Search within sub-dialog document and highlight matched keyword.
+    let subDialogsChildren = this._frame.contentDocument
+      .querySelectorAll(":scope > *:not([data-hidden-from-search])");
+
+    for (let i = 0; i < subDialogsChildren.length; i++) {
+      gSearchResultsPane.searchWithinNode(subDialogsChildren[i], gSearchResultsPane.query);
+    }
+
+    // Creating tooltips for all the instances found
+    for (let node of gSearchResultsPane.listSearchTooltips) {
+      if (!node.getAttribute("data-has-tooltip")) {
+        gSearchResultsPane.createSearchTooltip(node, gSearchResultsPane.query);
+      }
+    }
  },

  _onResize(mutations) {
--- a/browser/components/preferences/permissions.xul
+++ b/browser/components/preferences/permissions.xul
@ -32,7 +32,7 @@
  <vbox class="contentPane largeDialogContainer" flex="1">
    <description id="permissionsText" control="url"/>
    <separator class="thin"/>
-    <label id="urlLabel" control="url" value="&address.label;" accesskey="&address.accesskey;"/>
+    <label id="urlLabel" control="url" accesskey="&address.accesskey;">&address.label;</label>
    <hbox align="start">
      <textbox id="url" flex="1"
               oninput="gPermissionManager.onHostInput(event.target);"
--- a/browser/components/preferences/sanitize.xul
+++ b/browser/components/preferences/sanitize.xul
@ -6,7 +6,7 @@
   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->

 <?xml-stylesheet href="chrome://global/skin/"?>
-<?xml-stylesheet href="chrome://browser/skin/preferences/preferences.css" type="text/css"?> 
+<?xml-stylesheet href="chrome://browser/skin/preferences/preferences.css" type="text/css"?>

 <!DOCTYPE dialog [
  <!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd">
@ -45,7 +45,7 @@
    <description>&clearDataSettings2.label;</description>

    <groupbox orient="horizontal">
-      <caption label="&historySection.label;"/>
+      <caption><label>&historySection.label;</label></caption>
      <grid flex="1">
        <columns>
          <column dialogWidth="&sanitizePrefs2.column.width;"
@ -78,7 +78,7 @@
      </grid>
    </groupbox>
    <groupbox orient="horizontal">
-      <caption label="&dataSection.label;"/>
+      <caption><label>&dataSection.label;</label></caption>
      <grid flex="1">
        <columns>
          <column dialogWidth="&sanitizePrefs2.column.width;"
--- a/browser/components/resistfingerprinting/test/browser/browser.ini
+++ b/browser/components/resistfingerprinting/test/browser/browser.ini
@ -2,8 +2,10 @@
 tags = resistfingerprinting
 support-files =
  file_dummy.html
+  file_workerPerformance.js
  head.js

+[browser_performanceAPI.js]
 [browser_roundedWindow_dialogWindow.js]
 [browser_roundedWindow_newWindow.js]
 [browser_roundedWindow_open_max.js]
--- a/browser/components/resistfingerprinting/test/browser/browser_performanceAPI.js
+++ b/browser/components/resistfingerprinting/test/browser/browser_performanceAPI.js
@ -0,0 +1,85 @@
+/**
+ * Bug 1369303 - A test for making sure that performance APIs have been correctly
+ *   spoofed or disabled.
+ */
+
+const TEST_PATH = "http://example.net/browser/browser/" +
+                  "components/resistfingerprinting/test/browser/"
+
+const PERFORMANCE_TIMINGS = [
+  "navigationStart",
+  "unloadEventStart",
+  "unloadEventEnd",
+  "redirectStart",
+  "redirectEnd",
+  "fetchStart",
+  "domainLookupStart",
+  "domainLookupEnd",
+  "connectStart",
+  "connectEnd",
+  "requestStart",
+  "responseStart",
+  "responseEnd",
+  "domLoading",
+  "domInteractive",
+  "domContentLoadedEventStart",
+  "domContentLoadedEventEnd",
+  "domComplete",
+  "loadEventStart",
+  "loadEventEnd",
+];
+
+add_task(async function setup() {
+  await SpecialPowers.pushPrefEnv({"set":
+    [["privacy.resistFingerprinting", true]]
+  });
+});
+
+add_task(async function runTests() {
+  let tab = await BrowserTestUtils.openNewForegroundTab(
+    gBrowser, TEST_PATH + "file_dummy.html");
+
+  await ContentTask.spawn(tab.linkedBrowser, PERFORMANCE_TIMINGS, async function(list) {
+    // Check that whether the performance timing API is correctly spoofed.
+    for (let time of list) {
+      is(content.performance.timing[time], 0, `The timing(${time}) is correctly spoofed.`);
+    }
+
+    // Try to add some entries.
+    content.performance.mark("Test");
+    content.performance.mark("Test-End");
+    content.performance.measure("Test-Measure", "Test", "Test-End");
+
+    // Check that no entries for performance.getEntries/getEntriesByType/getEntriesByName.
+    is(content.performance.getEntries().length, 0, "No entries for performance.getEntries()");
+    is(content.performance.getEntriesByType("resource").length, 0, "No entries for performance.getEntriesByType()");
+    is(content.performance.getEntriesByName("Test", "mark").length, 0, "No entries for performance.getEntriesByName()");
+
+  });
+
+  await BrowserTestUtils.removeTab(tab);
+});
+
+add_task(async function runTestsForWorker() {
+  let tab = await BrowserTestUtils.openNewForegroundTab(
+    gBrowser, TEST_PATH + "file_dummy.html");
+
+  await ContentTask.spawn(tab.linkedBrowser, null, async function() {
+    await new Promise(resolve => {
+      let worker = new content.Worker("file_workerPerformance.js");
+      worker.onmessage = function(e) {
+        if (e.data.type == "status") {
+          ok(e.data.status, e.data.msg);
+        } else if (e.data.type == "finish") {
+          resolve();
+        } else {
+          ok(false, "Unknown message type");
+          resolve();
+        }
+      }
+      worker.postMessage({type: "runTests"});
+    });
+  });
+
+  await BrowserTestUtils.removeTab(tab);
+});
--- a/browser/components/resistfingerprinting/test/browser/file_workerPerformance.js
+++ b/browser/components/resistfingerprinting/test/browser/file_workerPerformance.js
@ -0,0 +1,33 @@
+function ok(a, msg) {
+  postMessage({type: "status", status: !!a, msg});
+}
+
+function is(a, b, msg) {
+  ok(a === b, msg);
+}
+
+function finish() {
+  postMessage({type: "finish"});
+}
+
+function runTests() {
+  // Try to add some entries.
+  performance.mark("Test");
+  performance.mark("Test-End");
+  performance.measure("Test-Measure", "Test", "Test-End");
+
+  // Check that no entries for performance.getEntries/getEntriesByType/getEntriesByName.
+  is(performance.getEntries().length, 0, "No entries for performance.getEntries() for workers");
+  is(performance.getEntriesByType("resource").length, 0, "No entries for performance.getEntriesByType() for workers");
+  is(performance.getEntriesByName("Test", "mark").length, 0, "No entries for performance.getEntriesByName() for workers");
+
+  finish();
+}
+
+self.onmessage = function(e) {
+  if (e.data.type === "runTests") {
+    runTests();
+  } else {
+    ok(false, "Unknown message type");
+  }
+}
--- a/browser/components/uitour/UITour-lib.js
+++ b/browser/components/uitour/UITour-lib.js
@ -556,6 +556,8 @@ if (typeof Mozilla == "undefined") {
   * is a string, begins with "utm_" and contains only only alphanumeric
   * characters, dashes or underscores. The values may be any string and will
   * automatically be encoded.
+   * @param {String} email - A string containing the default email account
+   * for the URL opened by the browser.
   * @since 31, 47 for `extraURLCampaignParams`
   * @example
   * // Will open about:accounts?action=signup&entrypoint=uitour
@ -567,10 +569,15 @@ if (typeof Mozilla == "undefined") {
   *   'utm_foo': 'bar',
   *   'utm_bar': 'baz'
   * });
+   * @example
+   * // Will open:
+   * // about:accounts?action=signup&entrypoint=uitour&email=foo%40bar.com
+   * Mozilla.UITour.showFirefoxAccounts(null, "foo@bar.com");
   */
-  Mozilla.UITour.showFirefoxAccounts = function(extraURLCampaignParams) {
+  Mozilla.UITour.showFirefoxAccounts = function(extraURLCampaignParams, email) {
    _sendEvent("showFirefoxAccounts", {
      extraURLCampaignParams: JSON.stringify(extraURLCampaignParams),
+      email
    });
  };

--- a/browser/components/uitour/UITour.jsm
+++ b/browser/components/uitour/UITour.jsm
@ -576,6 +576,9 @@ this.UITour = {
          return false;
        }

+        if (data.email) {
+          p.append("email", data.email);
+        }
        // We want to replace the current tab.
        browser.loadURI("about:accounts?" + p.toString());
        break;
--- a/browser/components/uitour/test/browser_UITour_sync.js
+++ b/browser/components/uitour/test/browser_UITour_sync.js
@ -51,17 +51,27 @@ add_UITour_task(async function test_checkSyncCounts() {

 // The showFirefoxAccounts API is sync related, so we test that here too...
 add_UITour_task(async function test_firefoxAccountsNoParams() {
+  info("Load about:accounts containing an iframe to https://accounts.firefox.com");
  await gContentAPI.showFirefoxAccounts();
  await BrowserTestUtils.browserLoaded(gTestTab.linkedBrowser, false,
                                       "about:accounts?action=signup&entrypoint=uitour");
 });

+
 add_UITour_task(async function test_firefoxAccountsValidParams() {
+  info("Load about:accounts containing an iframe to https://accounts.firefox.com");
  await gContentAPI.showFirefoxAccounts({ utm_foo: "foo", utm_bar: "bar" });
  await BrowserTestUtils.browserLoaded(gTestTab.linkedBrowser, false,
                                       "about:accounts?action=signup&entrypoint=uitour&utm_foo=foo&utm_bar=bar");
 });

+add_UITour_task(async function test_firefoxAccountsWithEmail() {
+  info("Load about:accounts containing an iframe to https://accounts.firefox.com");
+  await gContentAPI.showFirefoxAccounts(null, "foo@bar.com");
+  await BrowserTestUtils.browserLoaded(gTestTab.linkedBrowser, false,
+                                       "about:accounts?action=signup&entrypoint=uitour&email=foo%40bar.com");
+});
+
 add_UITour_task(async function test_firefoxAccountsNonAlphaValue() {
  // All characters in the value are allowed, but they must be automatically escaped.
  // (we throw a unicode character in there too - it's not auto-utf8 encoded,
@ -69,6 +79,7 @@ add_UITour_task(async function test_firefoxAccountsNonAlphaValue() {
  let value = "foo& /=?:\\\xa9";
  // encodeURIComponent encodes spaces to %20 but we want "+"
  let expected = encodeURIComponent(value).replace(/%20/g, "+");
+  info("Load about:accounts containing an iframe to https://accounts.firefox.com");
  await gContentAPI.showFirefoxAccounts({ utm_foo: value });
  await BrowserTestUtils.browserLoaded(gTestTab.linkedBrowser, false,
                                       "about:accounts?action=signup&entrypoint=uitour&utm_foo=" + expected);
--- a/browser/extensions/onboarding/content/onboarding-tour-agent.js
+++ b/browser/extensions/onboarding/content/onboarding-tour-agent.js
@ -15,6 +15,9 @@ document.getElementById("onboarding-overlay-dialog")
    case "onboarding-tour-customize-button":
      Mozilla.UITour.showHighlight("customize");
      break;
+   case "onboarding-tour-default-browser-button":
+      Mozilla.UITour.setConfiguration("defaultBrowser");
+      break;
    case "onboarding-tour-private-browsing-button":
      Mozilla.UITour.showHighlight("privateWindow");
      break;
--- a/browser/extensions/onboarding/content/onboarding.js
+++ b/browser/extensions/onboarding/content/onboarding.js
@ -121,6 +121,8 @@ var onboardingTours = [
    tourNameId: "onboarding.tour-default-browser",
    getPage(win) {
      let div = win.document.createElement("div");
+      let defaultBrowserButtonId = win.matchMedia("(-moz-os-version: windows-win7)").matches ?
+        "onboarding.tour-default-browser.win7.button" : "onboarding.tour-default-browser.button";
      div.innerHTML = `
        <section class="onboarding-tour-description">
          <h1 data-l10n-id="onboarding.tour-default-browser.title"></h1>
@ -129,6 +131,9 @@ var onboardingTours = [
        <section class="onboarding-tour-content">
          <img src="resource://onboarding/img/figure_default.svg" />
        </section>
+        <aside class="onboarding-tour-button">
+          <button id="onboarding-tour-default-browser-button" data-l10n-id="${defaultBrowserButtonId}"></button>
+        </aside>
      `;
      return div;
    },
--- a/browser/themes/shared/browser.inc.css
+++ b/browser/themes/shared/browser.inc.css
@ -5,16 +5,17 @@
 %ifdef MOZ_PHOTON_THEME
 %ifdef CAN_DRAW_IN_TITLEBAR
 /* Add space for dragging the window */
-%ifdef MENUBAR_CAN_AUTOHIDE
-:root[tabsintitlebar][sizemode=normal] #toolbar-menubar[autohide=true] ~ #TabsToolbar {
-  padding-inline-start: 40px;
-}
+%ifdef MOZ_WIDGET_COCOA
+:root[tabsintitlebar]:not([sizemode=fullscreen]) #TabsToolbar
+%elifdef MENUBAR_CAN_AUTOHIDE
+:root[tabsintitlebar][sizemode=normal] #toolbar-menubar[autohide=true] ~ #TabsToolbar
 %else
-:root[tabsintitlebar][sizemode=normal] #TabsToolbar {
+:root[tabsintitlebar][sizemode=normal] #TabsToolbar
+%endif
+{
  padding-inline-start: 40px;
 }
 %endif
-%endif

 /* Go button */
 .urlbar-go-button {
--- a/browser/themes/shared/customizableui/panelUI.inc.css
+++ b/browser/themes/shared/customizableui/panelUI.inc.css
@ -261,7 +261,8 @@ photonpanelmultiview .panel-subview-header {
 }

 #appMenu-popup > .panel-arrowcontainer > .panel-arrowcontent,
-#PanelUI-popup > .panel-arrowcontainer > .panel-arrowcontent {
+#PanelUI-popup > .panel-arrowcontainer > .panel-arrowcontent,
+panel[photon] > .panel-arrowcontainer > .panel-arrowcontent {
  overflow: hidden;
 }

@ -338,7 +339,8 @@ panelview:not([mainview]) .toolbarbutton-text,

 /* START photonpanelview adjustments */

-#appMenu-popup > .panel-arrowcontainer > .panel-arrowcontent {
+#appMenu-popup > .panel-arrowcontainer > .panel-arrowcontent,
+panel[photon] > .panel-arrowcontainer > .panel-arrowcontent {
  padding: 0;
  border-radius: 0;
 }
@ -348,7 +350,8 @@ photonpanelmultiview panelview {
  padding: 6px 0;
 }

-#appMenu-popup panelview {
+#appMenu-popup panelview,
+#customizationui-widget-multiview panelview:not([extension]) {
  min-width: @menuPanelWidth@;
 }

@ -2076,4 +2079,14 @@ photonpanelmultiview .PanelUI-subView toolbarseparator {
  margin-inline-end: 0;
 }

+photonpanelmultiview#customizationui-widget-multiview > .panel-viewcontainer {
+  overflow: hidden;
+}
+
+/* This is explicitly overriding the overflow properties set above. */
+photonpanelmultiview .cui-widget-panelview {
+  overflow-x: visible;
+  overflow-y: visible;
+}
+
 /* END photon adjustments */
--- a/browser/themes/shared/incontentprefs/preferences.inc.css
+++ b/browser/themes/shared/incontentprefs/preferences.inc.css
@ -272,6 +272,11 @@ description > html|a {
  margin-inline-start: 0;
 }

+groupbox {
+  /* Give more available space for displaying tooltip on scrollable groupbox */
+  margin-top: 15px !important;
+}
+
 #tabsElement {
  margin-inline-end: 4px; /* add the 4px end-margin of other elements */
 }
@ -614,6 +619,7 @@ description > html|a {
 }

 .search-tooltip {
+  font-size: 1.25rem;
  position: absolute;
  padding: 0 10px;
  bottom: 100%;
--- a/browser/tools/mozscreenshots/browser.ini
+++ b/browser/tools/mozscreenshots/browser.ini
@ -2,11 +2,5 @@
 subsuite = screenshots
 support-files =
  head.js
-  mozscreenshots/extension/lib/permissionPrompts.html
-  mozscreenshots/extension/lib/controlCenter/password.html
-  mozscreenshots/extension/lib/controlCenter/mixed.html
-  mozscreenshots/extension/lib/controlCenter/mixed_active.html
-  mozscreenshots/extension/lib/controlCenter/mixed_passive.html
-  mozscreenshots/extension/lib/borderify.xpi

 [browser_screenshots.js]
--- a/browser/tools/mozscreenshots/head.js
+++ b/browser/tools/mozscreenshots/head.js
@ -8,7 +8,7 @@

 const chromeRegistry = Cc["@mozilla.org/chrome/chrome-registry;1"].getService(Ci.nsIChromeRegistry);
 const env = Cc["@mozilla.org/process/environment;1"].getService(Ci.nsIEnvironment);
-const EXTENSION_DIR = "chrome://mochitests/content/extensions/mozscreenshots/browser/";
+const EXTENSION_DIR = "chrome://mochitests/content/browser/browser/tools/mozscreenshots/mozscreenshots/extension/mozscreenshots/browser/";

 let TestRunner;

--- a/browser/tools/mozscreenshots/mozscreenshots/extension/Makefile.in
+++ b/browser/tools/mozscreenshots/mozscreenshots/extension/Makefile.in
@ -2,11 +2,11 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-TEST_EXTENSIONS_DIR = $(DEPTH)/_tests/testing/mochitest/extensions
-GENERATED_DIRS = $(TEST_EXTENSIONS_DIR)
+OUTPUT_DIR = $(DEPTH)/_tests/testing/mochitest/browser/browser/tools/mozscreenshots/mozscreenshots/extension
+GENERATED_DIRS = $(OUTPUT_DIR)
 XPI_PKGNAME = mozscreenshots@mozilla.org

 include $(topsrcdir)/config/rules.mk

 libs::
-	(cd $(DIST)/xpi-stage && tar $(TAR_CREATE_FLAGS) - $(XPI_NAME)) | (cd $(TEST_EXTENSIONS_DIR) && tar -xf -)
+	(cd $(DIST)/xpi-stage && tar $(TAR_CREATE_FLAGS) - $(XPI_NAME)) | (cd $(OUTPUT_DIR) && tar -xf -)
--- a/browser/tools/mozscreenshots/mozscreenshots/extension/configurations/ControlCenter.jsm
+++ b/browser/tools/mozscreenshots/mozscreenshots/extension/configurations/ControlCenter.jsm
@ -16,7 +16,7 @@ Cu.import("resource://gre/modules/NetUtil.jsm");

 let {UrlClassifierTestUtils} = Cu.import("resource://testing-common/UrlClassifierTestUtils.jsm", {});

-const RESOURCE_PATH = "extensions/mozscreenshots/browser/chrome/mozscreenshots/lib/controlCenter";
+const RESOURCE_PATH = "browser/browser/tools/mozscreenshots/mozscreenshots/extension/mozscreenshots/browser/chrome/mozscreenshots/lib/controlCenter";
 const HTTP_PAGE = "http://example.com/";
 const HTTPS_PAGE = "https://example.com/";
 const PERMISSIONS_PAGE = "https://test1.example.com/";
--- a/browser/tools/mozscreenshots/mozscreenshots/extension/configurations/PermissionPrompts.jsm
+++ b/browser/tools/mozscreenshots/mozscreenshots/extension/configurations/PermissionPrompts.jsm
@ -13,7 +13,7 @@ Cu.import("resource:///modules/E10SUtils.jsm");
 Cu.import("resource://testing-common/ContentTask.jsm");
 Cu.import("resource://testing-common/BrowserTestUtils.jsm");

-const URL = "https://test1.example.com/extensions/mozscreenshots/browser/chrome/mozscreenshots/lib/permissionPrompts.html";
+const URL = "https://test1.example.com/browser/browser/tools/mozscreenshots/mozscreenshots/extension/mozscreenshots/browser/chrome/mozscreenshots/lib/permissionPrompts.html";
 let lastTab = null;

 this.PermissionPrompts = {
--- a/devtools/client/webconsole/new-console-output/new-console-output-wrapper.js
+++ b/devtools/client/webconsole/new-console-output/new-console-output-wrapper.js
@ -184,9 +184,11 @@ NewConsoleOutputWrapper.prototype = {
  },

  dispatchMessageUpdate: function (message, res) {
-    // network-message-updated will emit when eventTimings message arrives
-    // which is the last one of 8 updates happening on network message update.
-    if (res.packet.updateType === "eventTimings") {
+    // network-message-updated will emit when all the update message arrives.
+    // Since we can't ensure the order of the network update, we check
+    // that networkInfo.updates has all we need.
+    const NUMBER_OF_NETWORK_UPDATE = 8;
+    if (res.networkInfo.updates.length === NUMBER_OF_NETWORK_UPDATE) {
      batchedMessageAdd(actions.networkMessageUpdate(message));
      this.jsterm.hud.emit("network-message-updated", res);
    }
--- a/devtools/client/webconsole/new-console-output/test/components/network-event-message.test.js
+++ b/devtools/client/webconsole/new-console-output/test/components/network-event-message.test.js
@ -24,7 +24,7 @@ describe("NetworkEventMessage component:", () => {
  describe("GET request", () => {
    it("renders as expected", () => {
      const message = stubPreparedMessages.get("GET request");
-      const update = stubPreparedMessages.get("GET request eventTimings");
+      const update = stubPreparedMessages.get("GET request update");
      const wrapper = render(NetworkEventMessage({
        message,
        serviceContainer,
@ -43,7 +43,7 @@ describe("NetworkEventMessage component:", () => {
    });

    it("does not have a timestamp when timestampsVisible prop is falsy", () => {
-      const message = stubPreparedMessages.get("GET request eventTimings");
+      const message = stubPreparedMessages.get("GET request update");
      const wrapper = render(NetworkEventMessage({
        message,
        serviceContainer,
@ -69,7 +69,7 @@ describe("NetworkEventMessage component:", () => {
  describe("XHR GET request", () => {
    it("renders as expected", () => {
      const message = stubPreparedMessages.get("XHR GET request");
-      const update = stubPreparedMessages.get("XHR GET request eventTimings");
+      const update = stubPreparedMessages.get("XHR GET request update");
      const wrapper = render(NetworkEventMessage({
        message,
        serviceContainer,
@ -87,7 +87,7 @@ describe("NetworkEventMessage component:", () => {
  describe("XHR POST request", () => {
    it("renders as expected", () => {
      const message = stubPreparedMessages.get("XHR POST request");
-      const update = stubPreparedMessages.get("XHR POST request eventTimings");
+      const update = stubPreparedMessages.get("XHR POST request update");
      const wrapper = render(NetworkEventMessage({
        message,
        serviceContainer,
--- a/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/browser_webconsole_check_stubs_network_event.js
+++ b/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/browser_webconsole_check_stubs_network_event.js
@ -13,6 +13,7 @@ add_task(function* () {
  let repoStubFilePath = getTestFilePath("../stubs/networkEvent.js");
  let repoStubFileContent = yield OS.File.read(repoStubFilePath, { encoding: "utf-8" });

+  is(generatedStubs, repoStubFileContent, "Generated stub has the expected content");
  if (generatedStubs != repoStubFileContent) {
    ok(false, "The networkEvent stubs file needs to be updated by running " +
      "`mach test devtools/client/webconsole/new-console-output/test/fixtures/" +
--- a/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/head.js
+++ b/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/head.js
@ -161,12 +161,14 @@ function getCleanedPacket(key, packet) {
    }

    if (res.packet) {
-      if (res.packet.totalTime) {
-        // res.packet.totalTime is read-only so we use assign to override it.
-        res.packet = Object.assign({}, existingPacket.packet, {
-          totalTime: existingPacket.packet.totalTime
-        });
-      }
+      let override = {};
+      let keys = ["totalTime", "from", "contentSize", "transferredSize"];
+      keys.forEach(x => {
+        if (res.packet[x] !== undefined) {
+          override[x] = existingPacket.packet[key];
+        }
+      });
+      res.packet = Object.assign({}, res.packet, override);
    }

    if (res.networkInfo) {
@ -191,10 +193,24 @@ function getCleanedPacket(key, packet) {
          existingPacket.networkInfo.request.headersSize;
      }

-      if (res.networkInfo.response && res.networkInfo.response.headersSize) {
+      if (
+        res.networkInfo.response
+        && res.networkInfo.response.headersSize !== undefined
+      ) {
        res.networkInfo.response.headersSize =
          existingPacket.networkInfo.response.headersSize;
      }
+      if (res.networkInfo.response && res.networkInfo.response.bodySize !== undefined) {
+        res.networkInfo.response.bodySize =
+          existingPacket.networkInfo.response.bodySize;
+      }
+      if (
+        res.networkInfo.response
+        && res.networkInfo.response.transferredSize !== undefined
+      ) {
+        res.networkInfo.response.transferredSize =
+          existingPacket.networkInfo.response.transferredSize;
+      }
    }
  } else {
    res = packet;
@ -394,8 +410,21 @@ function* generateNetworkEventStubs() {
    let onNetworkUpdate = new Promise(resolve => {
      let i = 0;
      ui.jsterm.hud.on("network-message-updated", function onNetworkUpdated(event, res) {
-        let updateKey = `${keys[i++]} ${res.packet.updateType}`;
-        stubs.packets.push(formatPacket(updateKey, res));
+        let updateKey = `${keys[i++]} update`;
+        // We cannot ensure the form of the network update packet, some properties
+        // might be in another order than in the original packet.
+        // Hand-picking only what we need should prevent this.
+        const packet = {
+          networkInfo: {
+            _type: res.networkInfo._type,
+            actor: res.networkInfo.actor,
+            request: res.networkInfo.request,
+            response: res.networkInfo.response,
+            totalTime: res.networkInfo.totalTime,
+          }
+        };
+
+        stubs.packets.push(formatPacket(updateKey, packet));
        stubs.preparedMessages.push(formatNetworkEventStub(updateKey, res));
        if (i === keys.length) {
          ui.jsterm.hud.off("network-message-updated", onNetworkUpdated);
--- a/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/test-network-event.html
+++ b/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/test-network-event.html
@ -2,6 +2,9 @@
 <html lang="en">
  <head>
    <meta charset="utf-8">
+    <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
+    <meta http-equiv="Pragma" content="no-cache" />
+    <meta http-equiv="Expires" content="0" />
    <title>Stub generator for network event</title>
  </head>
  <body>
--- a/devtools/client/webconsole/new-console-output/test/fixtures/stubs/networkEvent.js
+++ b/devtools/client/webconsole/new-console-output/test/fixtures/stubs/networkEvent.js
@ -30,11 +30,10 @@ stubPreparedMessages.set("GET request", new NetworkEventMessage({
  "indent": 0
 }));

-stubPreparedMessages.set("GET request eventTimings", new NetworkEventMessage({
+stubPreparedMessages.set("GET request update", new NetworkEventMessage({
  "id": "1",
  "actor": "server1.conn0.child1/netEvent30",
  "level": "log",
-  "isXHR": false,
  "request": {
    "url": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/inexistent.html",
    "method": "GET",
@ -46,13 +45,17 @@ stubPreparedMessages.set("GET request eventTimings", new NetworkEventMessage({
    "statusText": "Not Found",
    "headersSize": 160,
    "remoteAddress": "127.0.0.1",
-    "remotePort": 8888
+    "remotePort": 8888,
+    "content": {
+      "mimeType": "text/html; charset=utf-8"
+    },
+    "bodySize": 904,
+    "transferredSize": 904
  },
  "source": "network",
  "type": "log",
  "groupId": null,
-  "timeStamp": 1486927175277,
-  "totalTime": 23,
+  "totalTime": 16,
  "indent": 0
 }));

@ -73,11 +76,10 @@ stubPreparedMessages.set("XHR GET request", new NetworkEventMessage({
  "indent": 0
 }));

-stubPreparedMessages.set("XHR GET request eventTimings", new NetworkEventMessage({
+stubPreparedMessages.set("XHR GET request update", new NetworkEventMessage({
  "id": "1",
-  "actor": "server1.conn1.child1/netEvent30",
+  "actor": "server1.conn0.child1/netEvent31",
  "level": "log",
-  "isXHR": true,
  "request": {
    "url": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/inexistent.html",
    "method": "GET",
@ -89,13 +91,17 @@ stubPreparedMessages.set("XHR GET request eventTimings", new NetworkEventMessage
    "statusText": "Not Found",
    "headersSize": 160,
    "remoteAddress": "127.0.0.1",
-    "remotePort": 8888
+    "remotePort": 8888,
+    "content": {
+      "mimeType": "text/html; charset=utf-8"
+    },
+    "bodySize": 904,
+    "transferredSize": 904
  },
  "source": "network",
  "type": "log",
  "groupId": null,
-  "timeStamp": 1486927179824,
-  "totalTime": 51,
+  "totalTime": 16,
  "indent": 0
 }));

@ -116,11 +122,10 @@ stubPreparedMessages.set("XHR POST request", new NetworkEventMessage({
  "indent": 0
 }));

-stubPreparedMessages.set("XHR POST request eventTimings", new NetworkEventMessage({
+stubPreparedMessages.set("XHR POST request update", new NetworkEventMessage({
  "id": "1",
-  "actor": "server1.conn2.child1/netEvent30",
+  "actor": "server1.conn0.child1/netEvent32",
  "level": "log",
-  "isXHR": true,
  "request": {
    "url": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/inexistent.html",
    "method": "POST",
@ -132,13 +137,17 @@ stubPreparedMessages.set("XHR POST request eventTimings", new NetworkEventMessag
    "statusText": "Not Found",
    "headersSize": 160,
    "remoteAddress": "127.0.0.1",
-    "remotePort": 8888
+    "remotePort": 8888,
+    "content": {
+      "mimeType": "text/html; charset=utf-8"
+    },
+    "bodySize": 904,
+    "transferredSize": 904
  },
  "source": "network",
  "type": "log",
  "groupId": null,
-  "timeStamp": 1486927183220,
-  "totalTime": 12,
+  "totalTime": 10,
  "indent": 0
 }));

@ -189,75 +198,29 @@ stubPackets.set("GET request", {
  "from": "server1.conn0.child1/consoleActor2"
 });

-stubPackets.set("GET request eventTimings", {
-  "packet": {
-    "from": "server1.conn0.child1/netEvent30",
-    "type": "networkEventUpdate",
-    "updateType": "eventTimings",
-    "totalTime": 23
-  },
+stubPackets.set("GET request update", {
  "networkInfo": {
    "_type": "NetworkEvent",
-    "timeStamp": 1486927175277,
-    "node": null,
    "actor": "server1.conn0.child1/netEvent30",
-    "discardRequestBody": true,
-    "discardResponseBody": false,
-    "startedDateTime": "2017-02-12T19:19:35.277Z",
    "request": {
      "url": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/inexistent.html",
      "method": "GET",
      "headersSize": 489
    },
-    "isXHR": false,
-    "cause": {
-      "type": "img",
-      "loadingDocumentUri": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/test-network-event.html",
-      "stacktrace": [
-        {
-          "filename": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/test-network-event.html",
-          "lineNumber": 3,
-          "columnNumber": 1,
-          "functionName": "triggerPacket",
-          "asyncCause": null
-        },
-        {
-          "filename": "resource://testing-common/content-task.js line 52 > eval",
-          "lineNumber": 7,
-          "columnNumber": 9,
-          "functionName": null,
-          "asyncCause": null
-        },
-        {
-          "filename": "resource://testing-common/content-task.js",
-          "lineNumber": 53,
-          "columnNumber": 20,
-          "functionName": null,
-          "asyncCause": null
-        }
-      ]
-    },
    "response": {
      "httpVersion": "HTTP/1.1",
      "status": "404",
      "statusText": "Not Found",
      "headersSize": 160,
      "remoteAddress": "127.0.0.1",
-      "remotePort": 8888
+      "remotePort": 8888,
+      "content": {
+        "mimeType": "text/html; charset=utf-8"
+      },
+      "bodySize": 904,
+      "transferredSize": 904
    },
-    "timings": {},
-    "updates": [
-      "requestHeaders",
-      "requestCookies",
-      "responseStart",
-      "securityInfo",
-      "responseHeaders",
-      "responseCookies",
-      "eventTimings"
-    ],
-    "private": false,
-    "securityInfo": "insecure",
-    "totalTime": 23
+    "totalTime": 16
  }
 });

@ -308,75 +271,29 @@ stubPackets.set("XHR GET request", {
  "from": "server1.conn1.child1/consoleActor2"
 });

-stubPackets.set("XHR GET request eventTimings", {
-  "packet": {
-    "from": "server1.conn1.child1/netEvent30",
-    "type": "networkEventUpdate",
-    "updateType": "eventTimings",
-    "totalTime": 51
-  },
+stubPackets.set("XHR GET request update", {
  "networkInfo": {
    "_type": "NetworkEvent",
-    "timeStamp": 1486927179824,
-    "node": null,
-    "actor": "server1.conn1.child1/netEvent30",
-    "discardRequestBody": true,
-    "discardResponseBody": false,
-    "startedDateTime": "2017-02-12T19:19:39.824Z",
+    "actor": "server1.conn0.child1/netEvent31",
    "request": {
      "url": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/inexistent.html",
      "method": "GET",
      "headersSize": 489
    },
-    "isXHR": true,
-    "cause": {
-      "type": "xhr",
-      "loadingDocumentUri": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/test-network-event.html",
-      "stacktrace": [
-        {
-          "filename": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/test-network-event.html",
-          "lineNumber": 4,
-          "columnNumber": 1,
-          "functionName": "triggerPacket",
-          "asyncCause": null
-        },
-        {
-          "filename": "resource://testing-common/content-task.js line 52 > eval",
-          "lineNumber": 7,
-          "columnNumber": 9,
-          "functionName": null,
-          "asyncCause": null
-        },
-        {
-          "filename": "resource://testing-common/content-task.js",
-          "lineNumber": 53,
-          "columnNumber": 20,
-          "functionName": null,
-          "asyncCause": null
-        }
-      ]
-    },
    "response": {
      "httpVersion": "HTTP/1.1",
      "status": "404",
      "statusText": "Not Found",
      "headersSize": 160,
      "remoteAddress": "127.0.0.1",
-      "remotePort": 8888
+      "remotePort": 8888,
+      "content": {
+        "mimeType": "text/html; charset=utf-8"
+      },
+      "bodySize": 904,
+      "transferredSize": 904
    },
-    "timings": {},
-    "updates": [
-      "requestHeaders",
-      "requestCookies",
-      "responseStart",
-      "securityInfo",
-      "responseHeaders",
-      "responseCookies",
-      "eventTimings"
-    ],
-    "private": false,
-    "securityInfo": "insecure",
-    "totalTime": 51
+    "totalTime": 16
  }
 });

@ -427,75 +344,29 @@ stubPackets.set("XHR POST request", {
  "from": "server1.conn2.child1/consoleActor2"
 });

-stubPackets.set("XHR POST request eventTimings", {
-  "packet": {
-    "from": "server1.conn2.child1/netEvent30",
-    "type": "networkEventUpdate",
-    "updateType": "eventTimings",
-    "totalTime": 12
-  },
+stubPackets.set("XHR POST request update", {
  "networkInfo": {
    "_type": "NetworkEvent",
-    "timeStamp": 1486927183220,
-    "node": null,
-    "actor": "server1.conn2.child1/netEvent30",
-    "discardRequestBody": true,
-    "discardResponseBody": false,
-    "startedDateTime": "2017-02-12T19:19:43.220Z",
+    "actor": "server1.conn0.child1/netEvent32",
    "request": {
      "url": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/inexistent.html",
      "method": "POST",
      "headersSize": 509
    },
-    "isXHR": true,
-    "cause": {
-      "type": "xhr",
-      "loadingDocumentUri": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/test-network-event.html",
-      "stacktrace": [
-        {
-          "filename": "http://example.com/browser/devtools/client/webconsole/new-console-output/test/fixtures/stub-generators/test-network-event.html",
-          "lineNumber": 4,
-          "columnNumber": 1,
-          "functionName": "triggerPacket",
-          "asyncCause": null
-        },
-        {
-          "filename": "resource://testing-common/content-task.js line 52 > eval",
-          "lineNumber": 7,
-          "columnNumber": 9,
-          "functionName": null,
-          "asyncCause": null
-        },
-        {
-          "filename": "resource://testing-common/content-task.js",
-          "lineNumber": 53,
-          "columnNumber": 20,
-          "functionName": null,
-          "asyncCause": null
-        }
-      ]
-    },
    "response": {
      "httpVersion": "HTTP/1.1",
      "status": "404",
      "statusText": "Not Found",
      "headersSize": 160,
      "remoteAddress": "127.0.0.1",
-      "remotePort": 8888
+      "remotePort": 8888,
+      "content": {
+        "mimeType": "text/html; charset=utf-8"
+      },
+      "bodySize": 904,
+      "transferredSize": 904
    },
-    "timings": {},
-    "updates": [
-      "requestHeaders",
-      "requestCookies",
-      "responseStart",
-      "securityInfo",
-      "responseHeaders",
-      "responseCookies",
-      "eventTimings"
-    ],
-    "private": false,
-    "securityInfo": "insecure",
-    "totalTime": 12
+    "totalTime": 10
  }
 });

--- a/devtools/client/webconsole/new-console-output/test/store/messages.test.js
+++ b/devtools/client/webconsole/new-console-output/test/store/messages.test.js
@ -489,13 +489,13 @@ describe("Message reducer:", () => {
      let networkUpdates = getAllNetworkMessagesUpdateById(getState());
      expect(Object.keys(networkUpdates).length).toBe(0);

-      let updatePacket = stubPackets.get("GET request eventTimings");
+      let updatePacket = stubPackets.get("GET request update");
      dispatch(actions.networkMessageUpdate(updatePacket));

      networkUpdates = getAllNetworkMessagesUpdateById(getState());
      expect(Object.keys(networkUpdates).length).toBe(1);

-      let xhrUpdatePacket = stubPackets.get("XHR GET request eventTimings");
+      let xhrUpdatePacket = stubPackets.get("XHR GET request update");
      dispatch(actions.networkMessageUpdate(xhrUpdatePacket));

      networkUpdates = getAllNetworkMessagesUpdateById(getState());
@ -507,7 +507,7 @@ describe("Message reducer:", () => {
        "XHR GET request"
      ]);

-      const updatePacket = stubPackets.get("XHR GET request eventTimings");
+      const updatePacket = stubPackets.get("XHR GET request update");
      dispatch(actions.networkMessageUpdate(updatePacket));

      let networkUpdates = getAllNetworkMessagesUpdateById(getState());
--- a/dom/base/ChildIterator.cpp
+++ b/dom/base/ChildIterator.cpp
@ -370,7 +370,18 @@ AllChildrenIterator::Seek(nsIContent* aChildToFind)
 void
 AllChildrenIterator::AppendNativeAnonymousChildren()
 {
-  AppendNativeAnonymousChildrenFromFrame(mOriginalContent->GetPrimaryFrame());
+  if (nsIFrame* primaryFrame = mOriginalContent->GetPrimaryFrame()) {
+    // NAC created by the element's primary frame.
+    AppendNativeAnonymousChildrenFromFrame(primaryFrame);
+
+    // NAC created by any other non-primary frames for the element.
+    AutoTArray<nsIFrame::OwnedAnonBox,8> ownedAnonBoxes;
+    primaryFrame->AppendOwnedAnonBoxes(ownedAnonBoxes);
+    for (nsIFrame::OwnedAnonBox& box : ownedAnonBoxes) {
+      MOZ_ASSERT(box.mAnonBoxFrame->GetContent() == mOriginalContent);
+      AppendNativeAnonymousChildrenFromFrame(box.mAnonBoxFrame);
+    }
+  }

  // The root scroll frame is not the primary frame of the root element.
  // Detect and handle this case.
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@ -220,7 +220,6 @@
 #include "nsIWebNavigationInfo.h"
 #include "nsPluginHost.h"
 #include "mozilla/HangAnnotations.h"
-#include "mozilla/ServoRestyleManager.h"
 #include "mozilla/Encoding.h"

 #include "nsIBidiKeyboard.h"
@ -2317,7 +2316,17 @@ nsContentUtils::IsCallerChrome()
 bool
 nsContentUtils::ShouldResistFingerprinting()
 {
-  return nsRFPService::IsResistFingerprintingEnabled();
+  if (NS_IsMainThread()) {
+    return nsRFPService::IsResistFingerprintingEnabled();
+  }
+
+  workers::WorkerPrivate* workerPrivate = workers::GetCurrentThreadWorkerPrivate();
+  if (NS_WARN_IF(!workerPrivate)) {
+    return false;
+  }
+  workerPrivate->AssertIsOnWorkerThread();
+
+  return workerPrivate->ResistFingerprintingEnabled();
 }

 bool
@ -2327,7 +2336,7 @@ nsContentUtils::ShouldResistFingerprinting(nsIDocShell* aDocShell)
    return false;
  }
  bool isChrome = nsContentUtils::IsChromeDoc(aDocShell->GetDocument());
-  return !isChrome && nsRFPService::IsResistFingerprintingEnabled();
+  return !isChrome && ShouldResistFingerprinting();
 }

 /* static */
@ -5324,12 +5333,6 @@ void
 nsContentUtils::DestroyAnonymousContent(nsCOMPtr<nsIContent>* aContent)
 {
  if (*aContent) {
-    // Don't wait until UnbindFromTree to clear ServoElementData, since
-    // leak checking at shutdown can run before the AnonymousContentDestroyer
-    // runs.
-    if ((*aContent)->IsStyledByServo() && (*aContent)->IsElement()) {
-      ServoRestyleManager::ClearServoDataFromSubtree((*aContent)->AsElement());
-    }
    AddScriptRunner(new AnonymousContentDestroyer(aContent));
  }
 }
@ -5339,12 +5342,6 @@ void
 nsContentUtils::DestroyAnonymousContent(nsCOMPtr<Element>* aElement)
 {
  if (*aElement) {
-    // Don't wait until UnbindFromTree to clear ServoElementData, since
-    // leak checking at shutdown can run before the AnonymousContentDestroyer
-    // runs.
-    if ((*aElement)->IsStyledByServo()) {
-      ServoRestyleManager::ClearServoDataFromSubtree(*aElement);
-    }
    AddScriptRunner(new AnonymousContentDestroyer(aElement));
  }
 }
--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@ -270,6 +270,7 @@ public:
                                  JS::MutableHandle<JS::PropertyDescriptor> aDesc);

  // Check whether we should avoid leaking distinguishing information to JS/CSS.
+  // This function can be called both in the main thread and worker threads.
  static bool ShouldResistFingerprinting();
  static bool ShouldResistFingerprinting(nsIDocShell* aDocShell);

@ -2202,7 +2203,7 @@ public:
  static bool ResistFingerprinting(mozilla::dom::CallerType aCallerType)
  {
    return aCallerType != mozilla::dom::CallerType::System &&
-           mozilla::nsRFPService::IsResistFingerprintingEnabled();
+           ShouldResistFingerprinting();
  }

  /**
--- a/dom/html/nsGenericHTMLElement.cpp
+++ b/dom/html/nsGenericHTMLElement.cpp
@ -178,8 +178,12 @@ NS_INTERFACE_MAP_END_INHERITING(nsGenericHTMLElementBase)
 nsresult
 nsGenericHTMLElement::CopyInnerTo(Element* aDst, bool aPreallocateChildren)
 {
+  MOZ_ASSERT(!aDst->GetUncomposedDoc(),
+             "Should not CopyInnerTo an Element in a document");
  nsresult rv;

+  bool reparse = (aDst->OwnerDoc() != OwnerDoc());
+
  rv = static_cast<nsGenericHTMLElement*>(aDst)->mAttrsAndChildren.
       EnsureCapacityToClone(mAttrsAndChildren, aPreallocateChildren);
  NS_ENSURE_SUCCESS(rv, rv);
@ -189,11 +193,14 @@ nsGenericHTMLElement::CopyInnerTo(Element* aDst, bool aPreallocateChildren)
    const nsAttrName *name = mAttrsAndChildren.AttrNameAt(i);
    const nsAttrValue *value = mAttrsAndChildren.AttrAt(i);

-    nsAutoString valStr;
-    value->ToString(valStr);
-
    if (name->Equals(nsGkAtoms::style, kNameSpaceID_None) &&
        value->Type() == nsAttrValue::eCSSDeclaration) {
+      // We still clone CSS attributes, even in the cross-document case.
+      // https://github.com/w3c/webappsec-csp/issues/212
+
+      nsAutoString valStr;
+      value->ToString(valStr);
+
      DeclarationBlock* decl = value->GetCSSDeclarationValue();
      // We can't just set this as a string, because that will fail
      // to reparse the string into style data until the node is
@ -202,13 +209,19 @@ nsGenericHTMLElement::CopyInnerTo(Element* aDst, bool aPreallocateChildren)

      rv = aDst->SetInlineStyleDeclaration(declClone, &valStr, false);
      NS_ENSURE_SUCCESS(rv, rv);
+    } else if (reparse) {
+      nsAutoString valStr;
+      value->ToString(valStr);

-      continue;
+      rv = aDst->SetAttr(name->NamespaceID(), name->LocalName(),
+                         name->GetPrefix(), valStr, false);
+      NS_ENSURE_SUCCESS(rv, rv);
+    } else {
+      nsAttrValue valueCopy(*value);
+      rv = aDst->SetParsedAttr(name->NamespaceID(), name->LocalName(),
+                               name->GetPrefix(), valueCopy, false);
+      NS_ENSURE_SUCCESS(rv, rv);
    }
-
-    rv = aDst->SetAttr(name->NamespaceID(), name->LocalName(),
-                       name->GetPrefix(), valStr, false);
-    NS_ENSURE_SUCCESS(rv, rv);
  }

  return NS_OK;
--- a/dom/media/TextTrack.cpp
+++ b/dom/media/TextTrack.cpp
@ -205,7 +205,7 @@ TextTrack::UpdateActiveCueList()
  // Remove all the cues from the active cue list whose end times now occur
  // earlier then the current playback time.
  for (uint32_t i = mActiveCueList->Length(); i > 0; i--) {
-    if ((*mActiveCueList)[i - 1]->EndTime() < playbackTime) {
+    if ((*mActiveCueList)[i - 1]->EndTime() <= playbackTime) {
      mActiveCueList->RemoveCueAt(i - 1);
    }
  }
@ -215,7 +215,7 @@ TextTrack::UpdateActiveCueList()
  // a valid start time as the cue list is sorted.
  for (; mCuePos < mCueList->Length() &&
         (*mCueList)[mCuePos]->StartTime() <= playbackTime; mCuePos++) {
-    if ((*mCueList)[mCuePos]->EndTime() >= playbackTime) {
+    if ((*mCueList)[mCuePos]->EndTime() > playbackTime) {
      mActiveCueList->AddCue(*(*mCueList)[mCuePos]);
    }
  }
--- a/dom/media/tests/mochitest/test_peerConnection_stats.html
+++ b/dom/media/tests/mochitest/test_peerConnection_stats.html
@ -393,21 +393,11 @@ var pedanticChecks = report => {
        stat.type + ".remoteCandidateId has a value. value="
        + stat.remoteCandidateId);

-      // state
-      ok(stat.state == "succeeded",
-        stat.type + ".state is succeeded. value="
-        + stat.state);
-
      // priority
      ok(stat.priority,
        stat.type + ".priority has a value. value="
        + stat.priority);

-      // nominated
-      ok(stat.nominated,
-        stat.type + ".nominated is true. value="
-        + stat.nominated);
-
      // readable
      ok(stat.readable,
        stat.type + ".readable is true. value="
@ -418,31 +408,48 @@ var pedanticChecks = report => {
        stat.type + ".writable is true. value="
        + stat.writable);

-      // bytesSent
-      ok(stat.bytesSent > 20000 && stat.bytesSent < 800000,
-        stat.type + ".bytesSent is a sane number (20,000<>800,000)for a short test. value="
-        + stat.bytesSent);
+      // state
+      if (stat.state == "succeeded") {
+        // nominated
+        ok(stat.nominated,
+          stat.type + ".nominated is true. value="
+          + stat.nominated);

-      // bytesReceived
-      ok(stat.bytesReceived > 20000 && stat.bytesReceived < 800000,
-        stat.type + ".bytesReceived is a sane number (20,000<>800,000) for a short test. value="
-        + stat.bytesReceived);
+        // bytesSent
+        ok(stat.bytesSent > 20000 && stat.bytesSent < 800000,
+          stat.type + ".bytesSent is a sane number (20,000<>800,000)for a short test. value="
+          + stat.bytesSent);

-      // lastPacketSentTimestamp
-      ok(stat.lastPacketSentTimestamp,
-        stat.type + ".lastPacketSentTimestamp has a value. value="
-        + stat.lastPacketSentTimestamp);
+        // bytesReceived
+        ok(stat.bytesReceived > 20000 && stat.bytesReceived < 800000,
+          stat.type + ".bytesReceived is a sane number (20,000<>800,000) for a short test. value="
+          + stat.bytesReceived);
+
+        // lastPacketSentTimestamp
+        ok(stat.lastPacketSentTimestamp,
+          stat.type + ".lastPacketSentTimestamp has a value. value="
+          + stat.lastPacketSentTimestamp);
+
+        // lastPacketReceivedTimestamp
+        ok(stat.lastPacketReceivedTimestamp,
+          stat.type + ".lastPacketReceivedTimestamp has a value. value="
+          + stat.lastPacketReceivedTimestamp);
+
+      } else {
+        // nominated
+        ok(!stat.nominated,
+          stat.type + ".nominated is false. value="
+          + stat.nominated);
+      }

-      // lastPacketReceivedTimestamp
-      ok(stat.lastPacketReceivedTimestamp,
-        stat.type + ".lastPacketReceivedTimestamp has a value. value="
-        + stat.lastPacketReceivedTimestamp);

      //
      // Optional fields
      //
      // selected
-      ok(stat.selected === undefined || stat.selected == true,
+      ok(stat.selected === undefined ||
+         ((stat.state == "succeeded" && stat.selected == true) ||
+          (stat.selected == false)),
        stat.type + ".selected is undefined or true. value="
        + stat.selected);

--- a/dom/performance/Performance.cpp
+++ b/dom/performance/Performance.cpp
@ -171,6 +171,12 @@ Performance::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
 void
 Performance::GetEntries(nsTArray<RefPtr<PerformanceEntry>>& aRetval)
 {
+  // We return an empty list when 'privacy.resistFingerprinting' is on.
+  if (nsContentUtils::ShouldResistFingerprinting()) {
+    aRetval.Clear();
+    return;
+  }
+
  aRetval = mResourceEntries;
  aRetval.AppendElements(mUserEntries);
  aRetval.Sort(PerformanceEntryComparator());
@ -180,6 +186,12 @@ void
 Performance::GetEntriesByType(const nsAString& aEntryType,
                              nsTArray<RefPtr<PerformanceEntry>>& aRetval)
 {
+  // We return an empty list when 'privacy.resistFingerprinting' is on.
+  if (nsContentUtils::ShouldResistFingerprinting()) {
+    aRetval.Clear();
+    return;
+  }
+
  if (aEntryType.EqualsLiteral("resource")) {
    aRetval = mResourceEntries;
    return;
@ -204,6 +216,11 @@ Performance::GetEntriesByName(const nsAString& aName,
 {
  aRetval.Clear();

+  // We return an empty list when 'privacy.resistFingerprinting' is on.
+  if (nsContentUtils::ShouldResistFingerprinting()) {
+    return;
+  }
+
  for (PerformanceEntry* entry : mResourceEntries) {
    if (entry->GetName().Equals(aName) &&
        (!aEntryType.WasPassed() ||
@ -261,6 +278,11 @@ Performance::RoundTime(double aTime) const
 void
 Performance::Mark(const nsAString& aName, ErrorResult& aRv)
 {
+  // We add nothing when 'privacy.resistFingerprinting' is on.
+  if (nsContentUtils::ShouldResistFingerprinting()) {
+    return;
+  }
+
  // Don't add the entry if the buffer is full. XXX should be removed by bug 1159003.
  if (mUserEntries.Length() >= mResourceTimingBufferSize) {
    return;
@ -325,6 +347,11 @@ Performance::Measure(const nsAString& aName,
                     const Optional<nsAString>& aEndMark,
                     ErrorResult& aRv)
 {
+  // We add nothing when 'privacy.resistFingerprinting' is on.
+  if (nsContentUtils::ShouldResistFingerprinting()) {
+    return;
+  }
+
  // Don't add the entry if the buffer is full. XXX should be removed by bug
  // 1159003.
  if (mUserEntries.Length() >= mResourceTimingBufferSize) {
@ -439,6 +466,12 @@ Performance::InsertResourceEntry(PerformanceEntry* aEntry)
 {
  MOZ_ASSERT(aEntry);
  MOZ_ASSERT(mResourceEntries.Length() < mResourceTimingBufferSize);
+
+  // We won't add an entry when 'privacy.resistFingerprint' is true.
+  if (nsContentUtils::ShouldResistFingerprinting()) {
+    return;
+  }
+
  if (mResourceEntries.Length() >= mResourceTimingBufferSize) {
    return;
  }
--- a/dom/performance/PerformanceTiming.cpp
+++ b/dom/performance/PerformanceTiming.cpp
@ -35,7 +35,8 @@ PerformanceTiming::PerformanceTiming(Performance* aPerformance,
 {
  MOZ_ASSERT(aPerformance, "Parent performance object should be provided");

-  if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    mZeroTime = 0;
  }

@ -94,7 +95,8 @@ DOMHighResTimeStamp
 PerformanceTiming::FetchStartHighRes()
 {
  if (!mFetchStart) {
-    if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return mZeroTime;
    }
    MOZ_ASSERT(!mAsyncOpen.IsNull(), "The fetch start time stamp should always be "
@ -151,7 +153,8 @@ PerformanceTiming::TimingAllowed() const
 uint16_t
 PerformanceTiming::GetRedirectCount() const
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return 0;
  }
  if (!mAllRedirectsSameOrigin) {
@ -163,7 +166,8 @@ PerformanceTiming::GetRedirectCount() const
 bool
 PerformanceTiming::ShouldReportCrossOriginRedirect() const
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return false;
  }

@ -186,7 +190,8 @@ PerformanceTiming::ShouldReportCrossOriginRedirect() const
 DOMHighResTimeStamp
 PerformanceTiming::RedirectStartHighRes()
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return mZeroTime;
  }
  return TimeStampToDOMHighResOrFetchStart(mRedirectStart);
@ -219,7 +224,8 @@ PerformanceTiming::RedirectStart()
 DOMHighResTimeStamp
 PerformanceTiming::RedirectEndHighRes()
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return mZeroTime;
  }
  return TimeStampToDOMHighResOrFetchStart(mRedirectEnd);
@ -242,7 +248,8 @@ PerformanceTiming::RedirectEnd()
 DOMHighResTimeStamp
 PerformanceTiming::DomainLookupStartHighRes()
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return mZeroTime;
  }
  return TimeStampToDOMHighResOrFetchStart(mDomainLookupStart);
@ -257,7 +264,8 @@ PerformanceTiming::DomainLookupStart()
 DOMHighResTimeStamp
 PerformanceTiming::DomainLookupEndHighRes()
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return mZeroTime;
  }
  // Bug 1155008 - nsHttpTransaction is racy. Return DomainLookupStart when null
@ -274,7 +282,8 @@ PerformanceTiming::DomainLookupEnd()
 DOMHighResTimeStamp
 PerformanceTiming::ConnectStartHighRes()
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return mZeroTime;
  }
  return mConnectStart.IsNull() ? DomainLookupEndHighRes()
@ -290,7 +299,8 @@ PerformanceTiming::ConnectStart()
 DOMHighResTimeStamp
 PerformanceTiming::ConnectEndHighRes()
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return mZeroTime;
  }
  // Bug 1155008 - nsHttpTransaction is racy. Return ConnectStart when null
@ -307,7 +317,8 @@ PerformanceTiming::ConnectEnd()
 DOMHighResTimeStamp
 PerformanceTiming::RequestStartHighRes()
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return mZeroTime;
  }
  return TimeStampToDOMHighResOrFetchStart(mRequestStart);
@ -322,7 +333,8 @@ PerformanceTiming::RequestStart()
 DOMHighResTimeStamp
 PerformanceTiming::ResponseStartHighRes()
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return mZeroTime;
  }
  if (mResponseStart.IsNull() ||
@ -341,7 +353,8 @@ PerformanceTiming::ResponseStart()
 DOMHighResTimeStamp
 PerformanceTiming::ResponseEndHighRes()
 {
-  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
+  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized() ||
+      nsContentUtils::ShouldResistFingerprinting()) {
    return mZeroTime;
  }
  if (mResponseEnd.IsNull() ||
--- a/dom/performance/PerformanceTiming.h
+++ b/dom/performance/PerformanceTiming.h
@ -116,7 +116,8 @@ public:
  // PerformanceNavigation WebIDL methods
  DOMTimeMilliSec NavigationStart() const
  {
-    if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return 0;
    }
    return GetDOMTiming()->GetNavigationStart();
@ -124,7 +125,8 @@ public:

  DOMTimeMilliSec UnloadEventStart()
  {
-    if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return 0;
    }
    return GetDOMTiming()->GetUnloadEventStart();
@ -132,7 +134,8 @@ public:

  DOMTimeMilliSec UnloadEventEnd()
  {
-    if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return 0;
    }
    return GetDOMTiming()->GetUnloadEventEnd();
@ -180,7 +183,8 @@ public:

  DOMTimeMilliSec DomLoading()
  {
-    if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return 0;
    }
    return GetDOMTiming()->GetDomLoading();
@ -188,7 +192,8 @@ public:

  DOMTimeMilliSec DomInteractive() const
  {
-    if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return 0;
    }
    return GetDOMTiming()->GetDomInteractive();
@ -196,7 +201,8 @@ public:

  DOMTimeMilliSec DomContentLoadedEventStart() const
  {
-    if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return 0;
    }
    return GetDOMTiming()->GetDomContentLoadedEventStart();
@ -204,7 +210,8 @@ public:

  DOMTimeMilliSec DomContentLoadedEventEnd() const
  {
-    if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return 0;
    }
    return GetDOMTiming()->GetDomContentLoadedEventEnd();
@ -212,7 +219,8 @@ public:

  DOMTimeMilliSec DomComplete() const
  {
-    if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return 0;
    }
    return GetDOMTiming()->GetDomComplete();
@ -220,7 +228,8 @@ public:

  DOMTimeMilliSec LoadEventStart() const
  {
-    if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return 0;
    }
    return GetDOMTiming()->GetLoadEventStart();
@ -228,7 +237,8 @@ public:

  DOMTimeMilliSec LoadEventEnd() const
  {
-    if (!nsContentUtils::IsPerformanceTimingEnabled()) {
+    if (!nsContentUtils::IsPerformanceTimingEnabled() ||
+        nsContentUtils::ShouldResistFingerprinting()) {
      return 0;
    }
    return GetDOMTiming()->GetLoadEventEnd();
--- a/dom/workers/WorkerPrefs.h
+++ b/dom/workers/WorkerPrefs.h
@ -43,6 +43,7 @@ WORKER_SIMPLE_PREF("dom.webkitBlink.dirPicker.enabled", WebkitBlinkDirectoryPick
 WORKER_SIMPLE_PREF("dom.netinfo.enabled", NetworkInformationEnabled, NETWORKINFORMATION_ENABLED)
 WORKER_SIMPLE_PREF("dom.fetchController.enabled", FetchControllerEnabled, FETCHCONTROLLER_ENABLED)
 WORKER_SIMPLE_PREF("dom.fetchObserver.enabled", FetchObserverEnabled, FETCHOBSERVER_ENABLED)
+WORKER_SIMPLE_PREF("privacy.resistFingerprinting", ResistFingerprintingEnabled, RESISTFINGERPRINTING_ENABLED)
 WORKER_PREF("intl.accept_languages", PrefLanguagesChanged)
 WORKER_PREF("general.appname.override", AppNameOverrideChanged)
 WORKER_PREF("general.appversion.override", AppVersionOverrideChanged)
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@ -246,7 +246,7 @@ function checkFieldWrite(entry, location, fields)
            return;
        if (/nsCOMPtr<.*?>.mRawPtr/.test(field))
            return;
-}
+    }

    var str = "";
    for (var field of fields)
@ -323,6 +323,14 @@ function ignoreCallEdge(entry, callee)
        return true;
    }

+    // AllChildrenIterator asks AppendOwnedAnonBoxes to append into an nsTArray
+    // local variable.
+    if (/nsIFrame::AppendOwnedAnonBoxes/.test(callee) &&
+        /AllChildrenIterator::AppendNativeAnonymousChildren/.test(name))
+    {
+        return true;
+    }
+
    // Runnables are created and named on one thread, then dispatched
    // (possibly to another). Writes on the origin thread are ok.
    if (/::SetName/.test(callee) &&
--- a/layout/base/ServoRestyleManager.cpp
+++ b/layout/base/ServoRestyleManager.cpp
@ -182,16 +182,19 @@ struct ServoRestyleManager::TextPostTraversalState
  bool mShouldPostHints;
  bool mShouldComputeHints;
  nsChangeHint mComputedHint;
+  nsChangeHint mHintsHandled;

  TextPostTraversalState(nsStyleContext& aParentContext,
                         ServoStyleSet& aStyleSet,
-                         bool aDisplayContentsParentStyleChanged)
+                         bool aDisplayContentsParentStyleChanged,
+                         nsChangeHint aHintsHandled)
    : mParentContext(aParentContext)
    , mStyleSet(aStyleSet)
    , mStyle(nullptr)
    , mShouldPostHints(aDisplayContentsParentStyleChanged)
    , mShouldComputeHints(aDisplayContentsParentStyleChanged)
    , mComputedHint(nsChangeHint_Empty)
+    , mHintsHandled(aHintsHandled)
  {}

  nsStyleContext& ComputeStyle(nsIContent* aTextNode)
@ -230,6 +233,7 @@ struct ServoRestyleManager::TextPostTraversalState
        oldContext->CalcStyleDifference(&aNewContext,
                                        &equalStructs,
                                        &samePointerStructs);
+      mComputedHint = NS_RemoveSubsumedHints(mComputedHint, mHintsHandled);
    }

    if (mComputedHint) {
@ -312,12 +316,15 @@ bool
 ServoRestyleManager::ProcessPostTraversal(Element* aElement,
                                          nsStyleContext* aParentContext,
                                          ServoStyleSet* aStyleSet,
-                                          nsStyleChangeList& aChangeList)
+                                          nsStyleChangeList& aChangeList,
+                                          nsChangeHint aChangesHandled)
 {
  nsIFrame* styleFrame = nsLayoutUtils::GetStyleFrame(aElement);

  // Grab the change hint from Servo.
  nsChangeHint changeHint = Servo_TakeChangeHint(aElement);
+  changeHint = NS_RemoveSubsumedHints(changeHint, aChangesHandled);
+  aChangesHandled |= changeHint;

  // Handle lazy frame construction by posting a reconstruct for any lazily-
  // constructed roots.
@ -446,12 +453,15 @@ ServoRestyleManager::ProcessPostTraversal(Element* aElement,

    StyleChildrenIterator it(aElement);
    TextPostTraversalState textState(
-        *upToDateContext, *aStyleSet, displayContentsNode && recreateContext);
+        *upToDateContext,
+        *aStyleSet,
+        displayContentsNode && recreateContext,
+        aChangesHandled);
    for (nsIContent* n = it.GetNextChild(); n; n = it.GetNextChild()) {
      if (traverseElementChildren && n->IsElement()) {
        recreatedAnyContext |=
          ProcessPostTraversal(n->AsElement(), upToDateContext,
-                               aStyleSet, aChangeList);
+                               aStyleSet, aChangeList, aChangesHandled);
      } else if (traverseTextChildren && n->IsNodeOfType(nsINode::eTEXT)) {
        recreatedAnyContext |=
          ProcessPostTraversalForText(n, aChangeList, textState);
@ -616,7 +626,8 @@ ServoRestyleManager::DoProcessPendingRestyles(TraversalRestyleBehavior
    bool anyStyleChanged = false;
    while (Element* root = iter.GetNextStyleRoot()) {
      anyStyleChanged |=
-        ProcessPostTraversal(root, nullptr, styleSet, currentChanges);
+        ProcessPostTraversal(
+            root, nullptr, styleSet, currentChanges, nsChangeHint(0));
    }

    // Process the change hints.
--- a/layout/base/ServoRestyleManager.h
+++ b/layout/base/ServoRestyleManager.h
@ -128,7 +128,8 @@ private:
  bool ProcessPostTraversal(Element* aElement,
                            nsStyleContext* aParentContext,
                            ServoStyleSet* aStyleSet,
-                            nsStyleChangeList& aChangeList);
+                            nsStyleChangeList& aChangeList,
+                            nsChangeHint aChangesHandledForDescendants);

  struct TextPostTraversalState;
  bool ProcessPostTraversalForText(nsIContent* aTextNode,
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@ -1189,15 +1189,10 @@ nsComboboxControlFrame::GetContentInsertionFrame() {
 }

 void
-nsComboboxControlFrame::DoUpdateStyleOfOwnedAnonBoxes(
-  ServoStyleSet& aStyleSet,
-  nsStyleChangeList& aChangeList,
-  nsChangeHint aHintForThisFrame)
+nsComboboxControlFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
-  UpdateStyleOfChildAnonBox(mDropdownFrame, aStyleSet, aChangeList,
-                            aHintForThisFrame);
-  UpdateStyleOfChildAnonBox(mDisplayFrame, aStyleSet, aChangeList,
-                            aHintForThisFrame);
+  aResult.AppendElement(OwnedAnonBox(mDropdownFrame));
+  aResult.AppendElement(OwnedAnonBox(mDisplayFrame));
 }

 nsresult
--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@ -117,10 +117,8 @@ public:

  virtual nsContainerFrame* GetContentInsertionFrame() override;

-  // Update the style on the block wrappers around our kids.
-  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                     nsStyleChangeList& aChangeList,
-                                     nsChangeHint aHintForThisFrame) override;
+  // Return the dropdown and display frame.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;

  // nsIFormControlFrame
  virtual nsresult SetFormProperty(nsIAtom* aName, const nsAString& aValue) override;
--- a/layout/forms/nsFieldSetFrame.cpp
+++ b/layout/forms/nsFieldSetFrame.cpp
@ -664,13 +664,10 @@ nsFieldSetFrame::GetNaturalBaselineBOffset(WritingMode          aWM,
 }

 void
-nsFieldSetFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
-                                               nsStyleChangeList& aChangeList,
-                                               nsChangeHint aHintForThisFrame)
+nsFieldSetFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
-  nsIFrame* kid = GetInner();
-  if (kid) {
-    UpdateStyleOfChildAnonBox(kid, aStyleSet, aChangeList, aHintForThisFrame);
+  if (nsIFrame* kid = GetInner()) {
+    aResult.AppendElement(OwnedAnonBox(kid));
  }
 }

--- a/layout/forms/nsFieldSetFrame.h
+++ b/layout/forms/nsFieldSetFrame.h
@ -73,11 +73,8 @@ public:
    return do_QueryFrame(GetInner());
  }

-  // Update the style on the block wrappers around our kids.
-  virtual void DoUpdateStyleOfOwnedAnonBoxes(
-    mozilla::ServoStyleSet& aStyleSet,
-    nsStyleChangeList& aChangeList,
-    nsChangeHint aHintForThisFrame) override;
+  // Return the block wrapper around our kids.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;

 #ifdef ACCESSIBILITY  
  virtual mozilla::a11y::AccType AccessibleType() override;
--- a/layout/forms/nsHTMLButtonControlFrame.cpp
+++ b/layout/forms/nsHTMLButtonControlFrame.cpp
@ -396,16 +396,12 @@ nsHTMLButtonControlFrame::SetAdditionalStyleContext(int32_t aIndex,
 }

 void
-nsHTMLButtonControlFrame::DoUpdateStyleOfOwnedAnonBoxes(
-  ServoStyleSet& aStyleSet,
-  nsStyleChangeList& aChangeList,
-  nsChangeHint aHintForThisFrame)
+nsHTMLButtonControlFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
  MOZ_ASSERT(mFrames.FirstChild(), "Must have our button-content anon box");
  MOZ_ASSERT(!mFrames.FirstChild()->GetNextSibling(),
             "Must only have our button-content anon box");
-  UpdateStyleOfChildAnonBox(mFrames.FirstChild(),
-                            aStyleSet, aChangeList, aHintForThisFrame);
+  aResult.AppendElement(OwnedAnonBox(mFrames.FirstChild()));
 }

 #ifdef DEBUG
--- a/layout/forms/nsHTMLButtonControlFrame.h
+++ b/layout/forms/nsHTMLButtonControlFrame.h
@ -98,12 +98,9 @@ public:
      ~(nsIFrame::eReplaced | nsIFrame::eReplacedContainsBlock));
  }

-  /**
-   * Update the style of our ::-moz-button-content anonymous box.
-   */
-  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                     nsStyleChangeList& aChangeList,
-                                     nsChangeHint aHintForThisFrame) override;
+  // Return the ::-moz-button-content anonymous box.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+
 protected:
  nsHTMLButtonControlFrame(nsStyleContext* aContext, nsIFrame::ClassID aID);

--- a/layout/generic/crashtests/1364361-1.html
+++ b/layout/generic/crashtests/1364361-1.html
@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<style>
+details {
+  column-count: 3;
+  column-width: 5em;
+  background-color: yellow;
+  overflow: scroll;
+  width: 300px; height: 300px;
+}
+</style>
+<details>
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+</details>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@ -652,5 +652,6 @@ load 1304441.html
 load 1316649.html
 load 1349650.html
 asserts-if(browserIsRemote,0-5) load 1349816-1.html # bug 1350352
+load 1364361-1.html
 load 1367413-1.html
 load 1368617-1.html
--- a/layout/generic/nsColumnSetFrame.cpp
+++ b/layout/generic/nsColumnSetFrame.cpp
@ -1260,10 +1260,7 @@ nsColumnSetFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
 }

 void
-nsColumnSetFrame::DoUpdateStyleOfOwnedAnonBoxes(
-    mozilla::ServoStyleSet& aStyleSet,
-    nsStyleChangeList& aChangeList,
-    nsChangeHint aHintForThisFrame)
+nsColumnSetFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
  // Everything in mFrames is continuations of the first thing in mFrames.
  nsIFrame* column = mFrames.FirstChild();
@ -1276,7 +1273,7 @@ nsColumnSetFrame::DoUpdateStyleOfOwnedAnonBoxes(
  MOZ_ASSERT(column->StyleContext()->GetPseudo() ==
               nsCSSAnonBoxes::columnContent,
             "What sort of child is this?");
-  UpdateStyleOfChildAnonBox(column, aStyleSet, aChangeList, aHintForThisFrame);
+  aResult.AppendElement(OwnedAnonBox(column));
 }

 #ifdef DEBUG
--- a/layout/generic/nsColumnSetFrame.h
+++ b/layout/generic/nsColumnSetFrame.h
@ -77,12 +77,8 @@ public:
   */
  void DrainOverflowColumns();

-  /**
-   * Update the style on our column-content frames.
-   */
-  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                     nsStyleChangeList& aChangeList,
-                                     nsChangeHint aHintForThisFrame) override;
+  // Return the column-content frame.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;

 #ifdef DEBUG_FRAME_DUMP
  virtual nsresult GetFrameName(nsAString& aResult) const override {
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@ -46,7 +46,7 @@
 #include "mozilla/GeckoRestyleManager.h"
 #include "mozilla/RestyleManager.h"
 #include "mozilla/RestyleManagerInlines.h"
-
+#include "nsInlineFrame.h"
 #include "nsIDOMNode.h"
 #include "nsISelection.h"
 #include "nsISelectionPrivate.h"
@ -10201,10 +10201,10 @@ nsFrame::BoxMetrics() const
 }

 void
-nsFrame::UpdateStyleOfChildAnonBox(nsIFrame* aChildFrame,
-                                   ServoStyleSet& aStyleSet,
-                                   nsStyleChangeList& aChangeList,
-                                   nsChangeHint aHintForThisFrame)
+nsIFrame::UpdateStyleOfChildAnonBox(nsIFrame* aChildFrame,
+                                    ServoStyleSet& aStyleSet,
+                                    nsStyleChangeList& aChangeList,
+                                    nsChangeHint aHintForThisFrame)
 {
  MOZ_ASSERT(aChildFrame->GetParent() == this,
             "This should only be used for children!");
@ -10479,16 +10479,73 @@ nsIFrame::IsScrolledOutOfView()
  return IsFrameScrolledOutOfView(this);
 }

-/* virtual */
 void
 nsIFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
-                                      nsStyleChangeList& aChangeList,
-                                      nsChangeHint aHintForThisFrame)
+                                        nsStyleChangeList& aChangeList,
+                                        nsChangeHint aHintForThisFrame)
+{
+  // As a special case, we check for {ib}-split block frames here, rather
+  // than have an nsInlineFrame::AppendDirectlyOwnedAnonBoxes implementation
+  // that returns them.
+  //
+  // (If we did handle them in AppendDirectlyOwnedAnonBoxes, we would have to
+  // return *all* of the in-flow {ib}-split block frames, not just the first
+  // one.  For restyling, we really just need the first in flow, and the other
+  // user of the AppendOwnedAnonBoxes API, AllChildIterator, doesn't need to
+  // know about them at all, since these block frames never create NAC.  So we
+  // avoid any unncessary hashtable lookups for the {ib}-split frames by calling
+  // UpdateStyleOfOwnedAnonBoxesForIBSplit directly here.)
+  if (IsInlineFrame()) {
+    if ((GetStateBits() & NS_FRAME_PART_OF_IBSPLIT)) {
+      static_cast<nsInlineFrame*>(this)->
+        UpdateStyleOfOwnedAnonBoxesForIBSplit(aStyleSet, aChangeList,
+                                              aHintForThisFrame);
+    }
+    return;
+  }
+
+  AutoTArray<OwnedAnonBox,4> frames;
+  AppendDirectlyOwnedAnonBoxes(frames);
+  for (OwnedAnonBox& box : frames) {
+    if (box.mUpdateStyleFn) {
+      box.mUpdateStyleFn(this, box.mAnonBoxFrame,
+                         aStyleSet, aChangeList, aHintForThisFrame);
+    } else {
+      UpdateStyleOfChildAnonBox(box.mAnonBoxFrame,
+                                aStyleSet, aChangeList, aHintForThisFrame);
+    }
+  }
+}
+
+/* virtual */ void
+nsIFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
  MOZ_ASSERT(!(GetStateBits() & NS_FRAME_OWNS_ANON_BOXES));
  MOZ_ASSERT(false, "Why did this get called?");
 }

+void
+nsIFrame::DoAppendOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+{
+  size_t i = aResult.Length();
+  AppendDirectlyOwnedAnonBoxes(aResult);
+
+  // After appending the directly owned anonymous boxes of this frame to
+  // aResult above, we need to check each of them to see if they own
+  // any anonymous boxes themselves.  Note that we keep progressing
+  // through aResult, looking for additional entries in aResult from these
+  // subsequent AppendDirectlyOwnedAnonBoxes calls.  (Thus we can't
+  // use a ranged for loop here.)
+
+  while (i < aResult.Length()) {
+    nsIFrame* f = aResult[i].mAnonBoxFrame;
+    if (f->GetStateBits() & NS_FRAME_OWNS_ANON_BOXES) {
+      f->AppendDirectlyOwnedAnonBoxes(aResult);
+    }
+    ++i;
+  }
+}
+
 nsIFrame::CaretPosition::CaretPosition()
  : mContentOffset(0)
 {
--- a/layout/generic/nsFrame.h
+++ b/layout/generic/nsFrame.h
@ -701,13 +701,6 @@ protected:
  // Fire DOM event. If no aContent argument use frame's mContent.
  void FireDOMEvent(const nsAString& aDOMEventName, nsIContent *aContent = nullptr);

-  // A helper for implementing UpdateStyleOfOwnedAnonBoxes for the specific case
-  // of the owned anon box being a child of this frame.
-  void UpdateStyleOfChildAnonBox(nsIFrame* aChildFrame,
-                                 mozilla::ServoStyleSet& aStyleSet,
-                                 nsStyleChangeList& aChangeList,
-                                 nsChangeHint aHintForThisFrame);
-
 private:
  void BoxReflow(nsBoxLayoutState& aState,
                 nsPresContext*    aPresContext,
--- a/layout/generic/nsGfxScrollFrame.h
+++ b/layout/generic/nsGfxScrollFrame.h
@ -1042,12 +1042,9 @@ public:
    return mHelper.IsRootScrollFrameOfDocument();
  }

-  // Update the style on our scrolled frame.
-  virtual void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                             nsStyleChangeList& aChangeList,
-                                             nsChangeHint aHintForThisFrame) override {
-    UpdateStyleOfChildAnonBox(mHelper.GetScrolledFrame(), aStyleSet,
-                              aChangeList, aHintForThisFrame);
+  // Return the scrolled frame.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override {
+    aResult.AppendElement(OwnedAnonBox(mHelper.GetScrolledFrame()));
  }

 #ifdef DEBUG_FRAME_DUMP
@ -1487,11 +1484,9 @@ public:
    return mHelper.IsRootScrollFrameOfDocument();
  }

-  virtual void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                             nsStyleChangeList& aChangeList,
-                                             nsChangeHint aHintForThisFrame) override {
-    UpdateStyleOfChildAnonBox(mHelper.GetScrolledFrame(), aStyleSet,
-                              aChangeList, aHintForThisFrame);
+  // Return the scrolled frame.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override {
+    aResult.AppendElement(OwnedAnonBox(mHelper.GetScrolledFrame()));
  }

 #ifdef DEBUG_FRAME_DUMP
--- a/layout/generic/nsHTMLCanvasFrame.cpp
+++ b/layout/generic/nsHTMLCanvasFrame.cpp
@ -414,15 +414,12 @@ nsHTMLCanvasFrame::GetContinuationOffset(nscoord* aWidth) const
 }

 void
-nsHTMLCanvasFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
-                                                 nsStyleChangeList& aChangeList,
-                                                 nsChangeHint aHintForThisFrame)
+nsHTMLCanvasFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
  MOZ_ASSERT(mFrames.FirstChild(), "Must have our canvas content anon box");
  MOZ_ASSERT(!mFrames.FirstChild()->GetNextSibling(),
             "Must only have our canvas content anon box");
-  UpdateStyleOfChildAnonBox(mFrames.FirstChild(),
-                            aStyleSet, aChangeList, aHintForThisFrame);
+  aResult.AppendElement(OwnedAnonBox(mFrames.FirstChild()));
 }

 #ifdef ACCESSIBILITY
--- a/layout/generic/nsHTMLCanvasFrame.h
+++ b/layout/generic/nsHTMLCanvasFrame.h
@ -97,12 +97,9 @@ public:
    return PrincipalChildList().FirstChild()->GetContentInsertionFrame();
  }

-  /**
-   * Update the style of our ::-moz-html-canvas-content anonymous box.
-   */
-  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                     nsStyleChangeList& aChangeList,
-                                     nsChangeHint aHintForThisFrame) override;
+  // Return the ::-moz-html-canvas-content anonymous box.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+
 protected:
  virtual ~nsHTMLCanvasFrame();

--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@ -3310,6 +3310,22 @@ public:
    }
  }

+protected:
+  // This does the actual work of UpdateStyleOfOwnedAnonBoxes.  It calls
+  // AppendDirectlyOwnedAnonBoxes to find all of the anonymous boxes
+  // owned by this frame, and then updates styles on each of them.
+  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
+                                     nsStyleChangeList& aChangeList,
+                                     nsChangeHint aHintForThisFrame);
+
+  // A helper for DoUpdateStyleOfOwnedAnonBoxes for the specific case
+  // of the owned anon box being a child of this frame.
+  void UpdateStyleOfChildAnonBox(nsIFrame* aChildFrame,
+                                 mozilla::ServoStyleSet& aStyleSet,
+                                 nsStyleChangeList& aChangeList,
+                                 nsChangeHint aHintForThisFrame);
+
+public:
  // A helper both for UpdateStyleOfChildAnonBox, and to update frame-backed
  // pseudo-elements in ServoRestyleManager.
  //
@ -3318,17 +3334,57 @@ public:
  // and adding to the change list as appropriate.
  //
  // Returns the generated change hint for the frame.
-  nsChangeHint UpdateStyleOfOwnedChildFrame(nsIFrame* aChildFrame,
-                                            nsStyleContext* aNewStyleContext,
-                                            nsStyleChangeList& aChangeList);
+  nsChangeHint UpdateStyleOfOwnedChildFrame(
+      nsIFrame* aChildFrame,
+      nsStyleContext* aNewStyleContext,
+      nsStyleChangeList& aChangeList);
+
+  struct OwnedAnonBox
+  {
+    typedef void (*UpdateStyleFn)(nsIFrame* aOwningFrame, nsIFrame* aAnonBox,
+                                  mozilla::ServoStyleSet&,
+                                  nsStyleChangeList&, nsChangeHint);
+
+    explicit OwnedAnonBox(nsIFrame* aAnonBoxFrame,
+                          UpdateStyleFn aUpdateStyleFn = nullptr)
+      : mAnonBoxFrame(aAnonBoxFrame)
+      , mUpdateStyleFn(aUpdateStyleFn)
+    {}
+
+    nsIFrame* mAnonBoxFrame;
+    UpdateStyleFn mUpdateStyleFn;
+  };

  /**
-   * Hook subclasses can override to actually implement updating of style of
-   * owned anon boxes.
+   * Appends information about all of the anonymous boxes owned by this frame,
+   * including other anonymous boxes owned by those which this frame owns
+   * directly.
   */
-  virtual void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                             nsStyleChangeList& aChangeList,
-                                             nsChangeHint aHintForThisFrame);
+  void AppendOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) {
+    if (GetStateBits() & NS_FRAME_OWNS_ANON_BOXES) {
+      if (IsInlineFrame()) {
+        // See comment in nsIFrame::DoUpdateStyleOfOwnedAnonBoxes for why
+        // we skip nsInlineFrames.
+        return;
+      }
+      DoAppendOwnedAnonBoxes(aResult);
+    }
+  }
+
+protected:
+  // This does the actual work of AppendOwnedAnonBoxes.
+  void DoAppendOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult);
+
+public:
+  /**
+   * Hook subclasses can override to return their owned anonymous boxes.
+   *
+   * This function only appends anonymous boxes that are directly owned by
+   * this frame, i.e. direct children or (for certain frames) a wrapper
+   * parent, unlike AppendOwnedAnonBoxes, which will append all anonymous
+   * boxes transitively owned by this frame.
+   */
+  virtual void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult);

  /**
   * Determines whether a frame is visible for painting;
--- a/layout/generic/nsInlineFrame.cpp
+++ b/layout/generic/nsInlineFrame.cpp
@ -1014,9 +1014,10 @@ nsInlineFrame::AccessibleType()
 #endif

 void
-nsInlineFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
-                                             nsStyleChangeList& aChangeList,
-                                             nsChangeHint aHintForThisFrame)
+nsInlineFrame::UpdateStyleOfOwnedAnonBoxesForIBSplit(
+    ServoStyleSet& aStyleSet,
+    nsStyleChangeList& aChangeList,
+    nsChangeHint aHintForThisFrame)
 {
  MOZ_ASSERT(GetStateBits() & NS_FRAME_OWNS_ANON_BOXES,
             "Why did we get called?");
--- a/layout/generic/nsInlineFrame.h
+++ b/layout/generic/nsInlineFrame.h
@ -114,12 +114,12 @@ public:
             : (!GetNextInFlow());
  }

-  // Update the style on the block wrappers around our non-inline-outside kids.
+  // Restyles the block wrappers around our non-inline-outside kids.
  // This will only be called when such wrappers in fact exist.
-  virtual void DoUpdateStyleOfOwnedAnonBoxes(
-    mozilla::ServoStyleSet& aStyleSet,
-    nsStyleChangeList& aChangeList,
-    nsChangeHint aHintForThisFrame) override;
+  void UpdateStyleOfOwnedAnonBoxesForIBSplit(
+      mozilla::ServoStyleSet& aStyleSet,
+      nsStyleChangeList& aChangeList,
+      nsChangeHint aHintForThisFrame);

 protected:
  // Additional reflow state used during our reflow methods
--- a/layout/reftests/counter-style/redefine-attr-mapping-ref.html
+++ b/layout/reftests/counter-style/redefine-attr-mapping-ref.html
@ -15,8 +15,6 @@
 <ul class="triangle"><li></ul>
 <ul class="triangle"><li></ul>
 <ul class="triangle"><li></ul>
-<ul class="triangle"><li></ul>
-<ul class="triangle"><li></ul>
 <ul class="hiragana"><li></ul>
 <ul class="katakana"><li></ul>
 <ul class="hiragana-iroha"><li></ul>
@ -30,7 +28,6 @@
 <ol class="triangle"><li></ol>
 <ol class="triangle"><li></ol>
 <ol class="triangle"><li></ol>
-<ol class="triangle"><li></ol>
 <ol class="hiragana"><li></ol>
 <ol class="katakana"><li></ol>
 <ol class="hiragana-iroha"><li></ol>
@ -44,7 +41,6 @@
  <li class="triangle">
  <li class="triangle">
  <li class="triangle">
-  <li class="triangle">
  <li class="hiragana">
  <li class="katakana">
  <li class="hiragana-iroha">
--- a/layout/reftests/counter-style/redefine-attr-mapping.html
+++ b/layout/reftests/counter-style/redefine-attr-mapping.html
@ -28,8 +28,6 @@
    system: extends katakana-iroha;
  }
 </style>
-<ul><li></ul>
-<ul type="disc"><li></ul>
 <ul type="circle"><li></ul>
 <ul type="round"><li></ul>
 <ul type="square"><li></ul>
@ -43,7 +41,6 @@
 <ul type="upper-alpha"><li></ul>

 <ol><li></ol>
-<ol type="disc"><li></ol>
 <ol type="circle"><li></ol>
 <ol type="round"><li></ol>
 <ol type="square"><li></ol>
@ -57,7 +54,6 @@
 <ol type="upper-alpha"><li></ol>

 <ul>
-  <li type="disc">
  <li type="circle">
  <li type="round">
  <li type="square">
--- a/layout/reftests/counter-style/redefine-builtin-ref.html
+++ b/layout/reftests/counter-style/redefine-builtin-ref.html
@ -3,5 +3,6 @@
 <ol>
  <li style="list-style-type: none">foo
  <li style="list-style-type: decimal">bar
+  <li style="list-style-type: disc">baz
  <li style="list-style-type: cjk-decimal">
 </ol>
--- a/layout/reftests/counter-style/redefine-builtin.html
+++ b/layout/reftests/counter-style/redefine-builtin.html
@ -7,6 +7,9 @@
  @counter-style decimal {
    system: extends upper-roman;
  }
+  @counter-style disc {
+    system: extends decimal;
+  }
  @counter-style hebrew {
    system: extends cjk-decimal;
  }
@ -14,5 +17,6 @@
 <ol>
  <li style="list-style-type: none">foo
  <li style="list-style-type: decimal">bar
+  <li style="list-style-type: disc">baz
  <li style="list-style-type: hebrew">
 </ol>
--- a/layout/reftests/frameset/frameset-add-col-ref.html
+++ b/layout/reftests/frameset/frameset-add-col-ref.html
@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset=utf-8>
+  </head>
+  <frameset id="frameset" cols="*,*">
+    <frame />
+    <frame />
+  </frameset>
+</html>
--- a/layout/reftests/frameset/frameset-add-col.html
+++ b/layout/reftests/frameset/frameset-add-col.html
@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <head>
+    <meta charset=utf-8>
+    <script type="text/javascript">
+      window.addEventListener("MozReftestInvalidate", () => {
+        let frameset = document.getElementById("frameset");
+        let newFrame = document.createElement("frame");
+        frameset.appendChild(newFrame);
+        frameset.cols = "*";
+
+        newFrame = document.createElement("frame");
+        frameset.appendChild(newFrame);
+        frameset.cols = frameset.cols + ",*";
+
+        document.documentElement.removeAttribute("class");
+      });
+    </script>
+  </head>
+  <frameset id="frameset" cols="">
+  </frameset>
+</html>
--- a/layout/reftests/frameset/frameset-add-row-ref.html
+++ b/layout/reftests/frameset/frameset-add-row-ref.html
@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset=utf-8>
+  </head>
+  <frameset id="frameset" rows="*,*">
+    <frame />
+    <frame />
+  </frameset>
+</html>
--- a/layout/reftests/frameset/frameset-add-row.html
+++ b/layout/reftests/frameset/frameset-add-row.html
@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <head>
+    <meta charset=utf-8>
+    <script type="text/javascript">
+      window.addEventListener("MozReftestInvalidate", () => {
+        let frameset = document.getElementById("frameset");
+        let newFrame = document.createElement("frame");
+        frameset.appendChild(newFrame);
+        frameset.rows = "*";
+
+        newFrame = document.createElement("frame");
+        frameset.appendChild(newFrame);
+        frameset.rows = frameset.rows + ",*";
+
+        document.documentElement.removeAttribute("class");
+      });
+    </script>
+  </head>
+  <frameset id="frameset" rows="">
+  </frameset>
+</html>
--- a/layout/reftests/frameset/frameset-remove-col-ref.html
+++ b/layout/reftests/frameset/frameset-remove-col-ref.html
@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset=utf-8>
+  </head>
+  <frameset id="frameset" cols="*,*">
+    <frame />
+    <frame />
+  </frameset>
+</html>
--- a/layout/reftests/frameset/frameset-remove-col.html
+++ b/layout/reftests/frameset/frameset-remove-col.html
@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <head>
+    <meta charset=utf-8>
+    <script type="text/javascript">
+      window.addEventListener("MozReftestInvalidate", () => {
+        let frameset = document.getElementById("frameset");
+        frameset.removeChild(frameset.lastChild);
+        frameset.cols = frameset.cols.replace(/,[^,]*$/, "");
+
+        document.documentElement.removeAttribute("class");
+      });
+    </script>
+  </head>
+  <frameset id="frameset" cols="*,*,*">
+    <frame />
+    <frame />
+    <frame />
+  </frameset>
+</html>
--- a/layout/reftests/frameset/frameset-remove-row-ref.html
+++ b/layout/reftests/frameset/frameset-remove-row-ref.html
@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset=utf-8>
+  </head>
+  <frameset id="frameset" rows="*,*">
+    <frame />
+    <frame />
+  </frameset>
+</html>
--- a/layout/reftests/frameset/frameset-remove-row.html
+++ b/layout/reftests/frameset/frameset-remove-row.html
@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <head>
+    <meta charset=utf-8>
+    <script type="text/javascript">
+      window.addEventListener("MozReftestInvalidate", () => {
+        let frameset = document.getElementById("frameset");
+        frameset.removeChild(frameset.lastChild);
+        frameset.rows = frameset.rows.replace(/,[^,]*$/, "");
+
+        document.documentElement.removeAttribute("class");
+      });
+    </script>
+  </head>
+  <frameset id="frameset" rows="*,*,*">
+    <frame />
+    <frame />
+    <frame />
+  </frameset>
+</html>
--- a/layout/reftests/frameset/reftest.list
+++ b/layout/reftests/frameset/reftest.list
@ -0,0 +1,4 @@
+== frameset-add-row.html frameset-add-row-ref.html
+== frameset-remove-row.html frameset-remove-row-ref.html
+== frameset-add-col.html frameset-add-col-ref.html
+== frameset-remove-col.html frameset-remove-col-ref.html
--- a/layout/reftests/mathml/reftest.list
+++ b/layout/reftests/mathml/reftest.list
@ -294,8 +294,8 @@ fails-if(Android||OSX) == mathvariant-2.html mathvariant-2-ref.html # Bugs 10106
 == mathvariant-4.html mathvariant-4-ref.html
 == mathvariant-5.html mathvariant-5-ref.html
 == dtls-1.html dtls-1-ref.html
-fails-if(styloVsGecko||stylo) == dtls-2.html dtls-2-ref.html # bug 1366206
-fails-if(styloVsGecko||stylo) == dtls-3.html dtls-3-ref.html # bug 1366206
+== dtls-2.html dtls-2-ref.html
+== dtls-3.html dtls-3-ref.html
 == ssty-1.html ssty-1-ref.html
 == ssty-2.html ssty-2-ref.html
 == ssty-3.html ssty-3-ref.html
--- a/layout/reftests/reftest.list
+++ b/layout/reftests/reftest.list
@ -208,6 +208,9 @@ include font-matching/reftest.list
 # forms
 include forms/reftest.list

+# frameset
+include frameset/reftest.list
+
 # gfx
 include ../../gfx/tests/reftest/reftest.list

--- a/layout/style/CounterStyleManager.cpp
+++ b/layout/style/CounterStyleManager.cpp
@ -1977,6 +1977,7 @@ CounterStyleManager::CounterStyleManager(nsPresContext* aPresContext)
  // Insert the static styles into cache table
  mStyles.Put(nsGkAtoms::none, GetNoneStyle());
  mStyles.Put(nsGkAtoms::decimal, GetDecimalStyle());
+  mStyles.Put(nsGkAtoms::disc, GetDiscStyle());
 }

 CounterStyleManager::~CounterStyleManager()
--- a/layout/style/CounterStyleManager.h
+++ b/layout/style/CounterStyleManager.h
@ -320,8 +320,8 @@ public:

  bool IsInitial() const
  {
-    // only 'none' and 'decimal'
-    return mStyles.Count() == 2;
+    // only 'none', 'decimal', and 'disc'
+    return mStyles.Count() == 3;
  }

  // Returns the counter style object for the given name from the style
@ -342,6 +342,10 @@ public:
  {
    return GetBuiltinStyle(NS_STYLE_LIST_STYLE_DECIMAL);
  }
+  static CounterStyle* GetDiscStyle()
+  {
+    return GetBuiltinStyle(NS_STYLE_LIST_STYLE_DISC);
+  }

  // This method will scan all existing counter styles generated by this
  // manager, and remove or mark data dirty accordingly. It returns true
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@ -4938,6 +4938,7 @@ CSSParserImpl::ParseCounterStyleName(bool aForDefinition)
  static const nsCSSKeyword kReservedNames[] = {
    eCSSKeyword_none,
    eCSSKeyword_decimal,
+    eCSSKeyword_disc,
    eCSSKeyword_UNKNOWN
  };

--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@ -602,12 +602,7 @@ nsStyleList::nsStyleList(const nsPresContext* aContext)
  : mListStylePosition(NS_STYLE_LIST_STYLE_POSITION_OUTSIDE)
 {
  MOZ_COUNT_CTOR(nsStyleList);
-  if (aContext->StyleSet()->IsServo()) {
-    mCounterStyle = do_AddRef(nsGkAtoms::disc);
-  } else {
-    mCounterStyle = aContext->
-      CounterStyleManager()->BuildCounterStyle(nsGkAtoms::disc);
-  }
+  mCounterStyle = CounterStyleManager::GetDiscStyle();
  SetQuotesInitial();
 }

--- a/layout/svg/SVGTextFrame.cpp
+++ b/layout/svg/SVGTextFrame.cpp
@ -5582,11 +5582,8 @@ SVGTextFrame::TransformFrameRectFromTextChild(const nsRect& aRect,
 }

 void
-SVGTextFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
-                                            nsStyleChangeList& aChangeList,
-                                            nsChangeHint aHintForThisFrame)
+SVGTextFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
  MOZ_ASSERT(PrincipalChildList().FirstChild(), "Must have our anon box");
-  UpdateStyleOfChildAnonBox(PrincipalChildList().FirstChild(),
-                            aStyleSet, aChangeList, aHintForThisFrame);
+  aResult.AppendElement(OwnedAnonBox(PrincipalChildList().FirstChild()));
 }
--- a/layout/svg/SVGTextFrame.h
+++ b/layout/svg/SVGTextFrame.h
@ -353,12 +353,8 @@ public:
  gfxRect TransformFrameRectFromTextChild(const nsRect& aRect,
                                          nsIFrame* aChildFrame);

-  /**
-   * Update the style of our ::-moz-svg-text anonymous box.
-   */
-  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                     nsStyleChangeList& aChangeList,
-                                     nsChangeHint aHintForThisFrame) override;
+  // Return our ::-moz-svg-text anonymous box.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;

 private:
  /**
--- a/layout/svg/nsSVGForeignObjectFrame.cpp
+++ b/layout/svg/nsSVGForeignObjectFrame.cpp
@ -572,12 +572,8 @@ nsSVGForeignObjectFrame::GetInvalidRegion()
 }

 void
-nsSVGForeignObjectFrame::DoUpdateStyleOfOwnedAnonBoxes(
-  ServoStyleSet& aStyleSet,
-  nsStyleChangeList& aChangeList,
-  nsChangeHint aHintForThisFrame)
+nsSVGForeignObjectFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
  MOZ_ASSERT(PrincipalChildList().FirstChild(), "Must have our anon box");
-  UpdateStyleOfChildAnonBox(PrincipalChildList().FirstChild(),
-                            aStyleSet, aChangeList, aHintForThisFrame);
+  aResult.AppendElement(OwnedAnonBox(PrincipalChildList().FirstChild()));
 }
--- a/layout/svg/nsSVGForeignObjectFrame.h
+++ b/layout/svg/nsSVGForeignObjectFrame.h
@ -82,12 +82,8 @@ public:

  nsRect GetInvalidRegion();

-  /**
-   * Update the style of our ::-moz-svg-foreign-content anonymous box.
-   */
-  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                     nsStyleChangeList& aChangeList,
-                                     nsChangeHint aHintForThisFrame) override;
+  // Return our ::-moz-svg-foreign-content anonymous box.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;

 protected:
  // implementation helpers:
--- a/layout/svg/nsSVGMarkerFrame.cpp
+++ b/layout/svg/nsSVGMarkerFrame.cpp
@ -201,13 +201,9 @@ nsSVGMarkerFrame::SetParentCoordCtxProvider(SVGSVGElement *aContext)
 }

 void
-nsSVGMarkerFrame::DoUpdateStyleOfOwnedAnonBoxes(
-  mozilla::ServoStyleSet& aStyleSet,
-  nsStyleChangeList& aChangeList,
-  nsChangeHint aHintForThisFrame)
+nsSVGMarkerFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
-  UpdateStyleOfChildAnonBox(GetAnonymousChildFrame(this), aStyleSet,
-                            aChangeList, aHintForThisFrame);
+  aResult.AppendElement(OwnedAnonBox(GetAnonymousChildFrame(this)));
 }

 //----------------------------------------------------------------------
--- a/layout/svg/nsSVGMarkerFrame.h
+++ b/layout/svg/nsSVGMarkerFrame.h
@ -90,10 +90,8 @@ public:
                                  const nsSVGMark& aMark,
                                  float aStrokeWidth);

-  // Update the style on our anonymous box child.
-  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                     nsStyleChangeList& aChangeList,
-                                     nsChangeHint aHintForThisFrame) override;
+  // Return our anonymous box child.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;

 private:
  // stuff needed for callback
--- a/layout/svg/nsSVGOuterSVGFrame.cpp
+++ b/layout/svg/nsSVGOuterSVGFrame.cpp
@ -971,14 +971,11 @@ nsSVGOuterSVGFrame::VerticalScrollbarNotNeeded() const
 }

 void
-nsSVGOuterSVGFrame::DoUpdateStyleOfOwnedAnonBoxes(
-  mozilla::ServoStyleSet& aStyleSet,
-  nsStyleChangeList& aChangeList,
-  nsChangeHint aHintForThisFrame)
+nsSVGOuterSVGFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
  nsIFrame* anonKid = PrincipalChildList().FirstChild();
  MOZ_ASSERT(anonKid->IsSVGOuterSVGAnonChildFrame());
-  UpdateStyleOfChildAnonBox(anonKid, aStyleSet, aChangeList, aHintForThisFrame);
+  aResult.AppendElement(OwnedAnonBox(anonKid));
 }

 //----------------------------------------------------------------------
--- a/layout/svg/nsSVGOuterSVGFrame.h
+++ b/layout/svg/nsSVGOuterSVGFrame.h
@ -99,10 +99,8 @@ public:
  bool IsSVGTransformed(Matrix* aOwnTransform,
                        Matrix* aFromParentTransform) const override;

-  // Update the style on our anonymous box child.
-  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                     nsStyleChangeList& aChangeList,
-                                     nsChangeHint aHintForThisFrame) override;
+  // Return our anonymous box child.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;

  // nsISVGSVGFrame interface:
  virtual void NotifyViewportOrTransformChanged(uint32_t aFlags) override;
--- a/layout/tables/nsTableCellFrame.cpp
+++ b/layout/tables/nsTableCellFrame.cpp
@ -1071,14 +1071,12 @@ nsTableCellFrame::GetBorderWidth(WritingMode aWM) const
 }

 void
-nsTableCellFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
-                                                nsStyleChangeList& aChangeList,
-                                                nsChangeHint aHintForThisFrame)
+nsTableCellFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
  nsIFrame* kid = mFrames.FirstChild();
  MOZ_ASSERT(kid && !kid->GetNextSibling(),
             "Table cells should have just one child");
-  UpdateStyleOfChildAnonBox(kid, aStyleSet, aChangeList, aHintForThisFrame);
+  aResult.AppendElement(OwnedAnonBox(kid));
 }

 #ifdef DEBUG_FRAME_DUMP
--- a/layout/tables/nsTableCellFrame.h
+++ b/layout/tables/nsTableCellFrame.h
@ -158,11 +158,8 @@ public:

  // there is no set row index because row index depends on the cell's parent row only

-  // Update the style on the block wrappers around our kids.
-  virtual void DoUpdateStyleOfOwnedAnonBoxes(
-    mozilla::ServoStyleSet& aStyleSet,
-    nsStyleChangeList& aChangeList,
-    nsChangeHint aHintForThisFrame) override;
+  // Return our cell content frame.
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;

  /*---------------- nsITableCellLayout methods ------------------------*/

--- a/Показать больше
+++ b/Показать больше